xmrig | ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829

Analysis

max time kernel
125s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
Size

3.3MB
MD5

30e3bc6df27995717415f9588c2b1800
SHA1

d778062ea7a94b355519f8b29623cc0d9989081a
SHA256

ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829
SHA512

eda6617f6acae3835637aa5ff774691d9fca833144a269740ca5b8317fc90ffbce58bd967d33ca60cbf8e1a4062a2b42a4274a1502cae9830635a00f64644bdc
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWd:7bBeSFkJ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4880-0-0x00007FF78FF60000-0x00007FF790356000-memory.dmp	xmrig
behavioral2/files/0x0009000000023531-6.dat	xmrig
behavioral2/files/0x0009000000023556-9.dat	xmrig
behavioral2/files/0x000900000002353e-13.dat	xmrig
behavioral2/memory/1152-25-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp	xmrig
behavioral2/files/0x000900000002355a-35.dat	xmrig
behavioral2/files/0x000900000002355c-46.dat	xmrig
behavioral2/files/0x0009000000023560-70.dat	xmrig
behavioral2/files/0x0009000000023566-96.dat	xmrig
behavioral2/memory/4696-110-0x00007FF72B3D0000-0x00007FF72B7C6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023569-127.dat	xmrig
behavioral2/memory/1248-135-0x00007FF749380000-0x00007FF749776000-memory.dmp	xmrig
behavioral2/memory/1060-138-0x00007FF67AF80000-0x00007FF67B376000-memory.dmp	xmrig
behavioral2/memory/3324-143-0x00007FF6430A0000-0x00007FF643496000-memory.dmp	xmrig
behavioral2/memory/2976-146-0x00007FF7B4C00000-0x00007FF7B4FF6000-memory.dmp	xmrig
behavioral2/memory/4776-145-0x00007FF79F5B0000-0x00007FF79F9A6000-memory.dmp	xmrig
behavioral2/memory/2592-144-0x00007FF7B5240000-0x00007FF7B5636000-memory.dmp	xmrig
behavioral2/memory/2220-142-0x00007FF718160000-0x00007FF718556000-memory.dmp	xmrig
behavioral2/memory/4836-141-0x00007FF66A760000-0x00007FF66AB56000-memory.dmp	xmrig
behavioral2/memory/2644-140-0x00007FF7DE000000-0x00007FF7DE3F6000-memory.dmp	xmrig
behavioral2/memory/4144-139-0x00007FF65A6E0000-0x00007FF65AAD6000-memory.dmp	xmrig
behavioral2/memory/5044-137-0x00007FF7A01C0000-0x00007FF7A05B6000-memory.dmp	xmrig
behavioral2/memory/4032-136-0x00007FF651320000-0x00007FF651716000-memory.dmp	xmrig
behavioral2/memory/4764-134-0x00007FF7A2360000-0x00007FF7A2756000-memory.dmp	xmrig
behavioral2/memory/2500-133-0x00007FF75F070000-0x00007FF75F466000-memory.dmp	xmrig
behavioral2/files/0x000800000002356b-131.dat	xmrig
behavioral2/files/0x000900000002356a-129.dat	xmrig
behavioral2/files/0x0009000000023568-125.dat	xmrig
behavioral2/memory/4396-124-0x00007FF697290000-0x00007FF697686000-memory.dmp	xmrig
behavioral2/memory/2868-123-0x00007FF696A10000-0x00007FF696E06000-memory.dmp	xmrig
behavioral2/files/0x0008000000023567-121.dat	xmrig
behavioral2/files/0x0008000000023565-117.dat	xmrig
behavioral2/files/0x0009000000023564-115.dat	xmrig
behavioral2/files/0x0008000000023563-113.dat	xmrig
behavioral2/files/0x0008000000023562-111.dat	xmrig
behavioral2/files/0x000800000002355f-104.dat	xmrig
behavioral2/memory/4788-101-0x00007FF7D6440000-0x00007FF7D6836000-memory.dmp	xmrig
behavioral2/memory/1432-100-0x00007FF74D460000-0x00007FF74D856000-memory.dmp	xmrig
behavioral2/files/0x0008000000023561-97.dat	xmrig
behavioral2/files/0x000800000002355e-88.dat	xmrig
behavioral2/files/0x000900000002355d-81.dat	xmrig
behavioral2/memory/3344-77-0x00007FF7BA200000-0x00007FF7BA5F6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023559-49.dat	xmrig
behavioral2/files/0x000800000002355b-47.dat	xmrig
behavioral2/memory/4572-41-0x00007FF68E420000-0x00007FF68E816000-memory.dmp	xmrig
behavioral2/files/0x0009000000023558-39.dat	xmrig
behavioral2/memory/4420-44-0x00007FF6E9330000-0x00007FF6E9726000-memory.dmp	xmrig
behavioral2/files/0x0008000000023557-33.dat	xmrig
behavioral2/memory/4976-12-0x00007FF6A05A0000-0x00007FF6A0996000-memory.dmp	xmrig
behavioral2/files/0x000900000002356c-294.dat	xmrig
behavioral2/files/0x000800000002359a-310.dat	xmrig
behavioral2/files/0x000800000002359b-311.dat	xmrig
behavioral2/files/0x0008000000023599-327.dat	xmrig
behavioral2/files/0x00080000000235a2-335.dat	xmrig
behavioral2/files/0x00090000000235a0-339.dat	xmrig
behavioral2/files/0x000800000002359f-329.dat	xmrig
behavioral2/files/0x000900000002359c-324.dat	xmrig
behavioral2/memory/4880-861-0x00007FF78FF60000-0x00007FF790356000-memory.dmp	xmrig
behavioral2/memory/1152-943-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp	xmrig
behavioral2/memory/4572-948-0x00007FF68E420000-0x00007FF68E816000-memory.dmp	xmrig
behavioral2/memory/4976-2301-0x00007FF6A05A0000-0x00007FF6A0996000-memory.dmp	xmrig
behavioral2/memory/1152-2302-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp	xmrig
behavioral2/memory/4836-2303-0x00007FF66A760000-0x00007FF66AB56000-memory.dmp	xmrig
behavioral2/memory/4572-2304-0x00007FF68E420000-0x00007FF68E816000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
9	4908	powershell.exe
14	4908	powershell.exe
18	4908	powershell.exe
19	4908	powershell.exe
20	4908	powershell.exe
27	4908	powershell.exe
28	4908	powershell.exe
29	4908	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4976	ywYtliH.exe
1152	EHPIqkm.exe
4572	bImNWef.exe
4836	VbOQmBG.exe
4420	WmnmbuD.exe
2220	TAWDZZR.exe
3344	dtjrXJB.exe
1432	QYabtfp.exe
3324	RHoqthP.exe
4788	aGnPsMV.exe
2592	EyewrsH.exe
4696	UKxKmsk.exe
2868	NIfbqCm.exe
4396	HDcahMq.exe
4776	WniFBRj.exe
2500	cxTKuyg.exe
4764	bIWDVVW.exe
1248	QTxgcLI.exe
4032	PSSwQJr.exe
5044	ecuLXJl.exe
2976	hngEZSL.exe
1060	IcrNTiQ.exe
4144	oZLnszH.exe
2644	AhEtsuB.exe
5076	hwYDiKK.exe
3696	Tejcgnh.exe
3264	mZxuiYg.exe
3172	sdxutbc.exe
2124	qgdMsmk.exe
1164	QpbRSNC.exe
2016	TwKzyGI.exe
3156	JVXUQuD.exe
3880	YCgUksc.exe
3748	bPlfyyT.exe
1116	RbJMAWX.exe
1540	ECKxYfG.exe
1764	CMiThft.exe
3520	IzgAuSN.exe
3052	eDlUygK.exe
456	xwpNKDs.exe
3176	cuigmnb.exe
5060	KvAdPYh.exe
2924	PDydIrz.exe
1016	cmpYRTs.exe
1712	GirQHNd.exe
2756	iahFIpf.exe
644	asUHrKy.exe
2212	gqvLXyr.exe
1008	wEwhwIV.exe
3876	XAArcpY.exe
4952	mPzcTis.exe
1200	KpfoNwv.exe
3300	JGOJFLL.exe
3148	dpoBjAm.exe
4740	ndvktbx.exe
1676	tRImpbr.exe
2968	kTNOnks.exe
4972	DVbWyTj.exe
4264	FTCHVsM.exe
5128	jTXmvVX.exe
5144	sMarTmX.exe
5168	OLSQLrT.exe
5216	jjPjHYE.exe
5264	KSqUjSA.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4880-0-0x00007FF78FF60000-0x00007FF790356000-memory.dmp	upx
behavioral2/files/0x0009000000023531-6.dat	upx
behavioral2/files/0x0009000000023556-9.dat	upx
behavioral2/files/0x000900000002353e-13.dat	upx
behavioral2/memory/1152-25-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp	upx
behavioral2/files/0x000900000002355a-35.dat	upx
behavioral2/files/0x000900000002355c-46.dat	upx
behavioral2/files/0x0009000000023560-70.dat	upx
behavioral2/files/0x0009000000023566-96.dat	upx
behavioral2/memory/4696-110-0x00007FF72B3D0000-0x00007FF72B7C6000-memory.dmp	upx
behavioral2/files/0x0008000000023569-127.dat	upx
behavioral2/memory/1248-135-0x00007FF749380000-0x00007FF749776000-memory.dmp	upx
behavioral2/memory/1060-138-0x00007FF67AF80000-0x00007FF67B376000-memory.dmp	upx
behavioral2/memory/3324-143-0x00007FF6430A0000-0x00007FF643496000-memory.dmp	upx
behavioral2/memory/2976-146-0x00007FF7B4C00000-0x00007FF7B4FF6000-memory.dmp	upx
behavioral2/memory/4776-145-0x00007FF79F5B0000-0x00007FF79F9A6000-memory.dmp	upx
behavioral2/memory/2592-144-0x00007FF7B5240000-0x00007FF7B5636000-memory.dmp	upx
behavioral2/memory/2220-142-0x00007FF718160000-0x00007FF718556000-memory.dmp	upx
behavioral2/memory/4836-141-0x00007FF66A760000-0x00007FF66AB56000-memory.dmp	upx
behavioral2/memory/2644-140-0x00007FF7DE000000-0x00007FF7DE3F6000-memory.dmp	upx
behavioral2/memory/4144-139-0x00007FF65A6E0000-0x00007FF65AAD6000-memory.dmp	upx
behavioral2/memory/5044-137-0x00007FF7A01C0000-0x00007FF7A05B6000-memory.dmp	upx
behavioral2/memory/4032-136-0x00007FF651320000-0x00007FF651716000-memory.dmp	upx
behavioral2/memory/4764-134-0x00007FF7A2360000-0x00007FF7A2756000-memory.dmp	upx
behavioral2/memory/2500-133-0x00007FF75F070000-0x00007FF75F466000-memory.dmp	upx
behavioral2/files/0x000800000002356b-131.dat	upx
behavioral2/files/0x000900000002356a-129.dat	upx
behavioral2/files/0x0009000000023568-125.dat	upx
behavioral2/memory/4396-124-0x00007FF697290000-0x00007FF697686000-memory.dmp	upx
behavioral2/memory/2868-123-0x00007FF696A10000-0x00007FF696E06000-memory.dmp	upx
behavioral2/files/0x0008000000023567-121.dat	upx
behavioral2/files/0x0008000000023565-117.dat	upx
behavioral2/files/0x0009000000023564-115.dat	upx
behavioral2/files/0x0008000000023563-113.dat	upx
behavioral2/files/0x0008000000023562-111.dat	upx
behavioral2/files/0x000800000002355f-104.dat	upx
behavioral2/memory/4788-101-0x00007FF7D6440000-0x00007FF7D6836000-memory.dmp	upx
behavioral2/memory/1432-100-0x00007FF74D460000-0x00007FF74D856000-memory.dmp	upx
behavioral2/files/0x0008000000023561-97.dat	upx
behavioral2/files/0x000800000002355e-88.dat	upx
behavioral2/files/0x000900000002355d-81.dat	upx
behavioral2/memory/3344-77-0x00007FF7BA200000-0x00007FF7BA5F6000-memory.dmp	upx
behavioral2/files/0x0008000000023559-49.dat	upx
behavioral2/files/0x000800000002355b-47.dat	upx
behavioral2/memory/4572-41-0x00007FF68E420000-0x00007FF68E816000-memory.dmp	upx
behavioral2/files/0x0009000000023558-39.dat	upx
behavioral2/memory/4420-44-0x00007FF6E9330000-0x00007FF6E9726000-memory.dmp	upx
behavioral2/files/0x0008000000023557-33.dat	upx
behavioral2/memory/4976-12-0x00007FF6A05A0000-0x00007FF6A0996000-memory.dmp	upx
behavioral2/files/0x000900000002356c-294.dat	upx
behavioral2/files/0x000800000002359a-310.dat	upx
behavioral2/files/0x000800000002359b-311.dat	upx
behavioral2/files/0x0008000000023599-327.dat	upx
behavioral2/files/0x00080000000235a2-335.dat	upx
behavioral2/files/0x00090000000235a0-339.dat	upx
behavioral2/files/0x000800000002359f-329.dat	upx
behavioral2/files/0x000900000002359c-324.dat	upx
behavioral2/memory/4880-861-0x00007FF78FF60000-0x00007FF790356000-memory.dmp	upx
behavioral2/memory/1152-943-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp	upx
behavioral2/memory/4572-948-0x00007FF68E420000-0x00007FF68E816000-memory.dmp	upx
behavioral2/memory/4976-2301-0x00007FF6A05A0000-0x00007FF6A0996000-memory.dmp	upx
behavioral2/memory/1152-2302-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp	upx
behavioral2/memory/4836-2303-0x00007FF66A760000-0x00007FF66AB56000-memory.dmp	upx
behavioral2/memory/4572-2304-0x00007FF68E420000-0x00007FF68E816000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CoKHMsu.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\SYdGHRL.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\oEwtBGo.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\KrrEiVN.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\lDTENFu.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\OojjwTh.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\eqYYrpw.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\JOoOkHA.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\YHsDQqQ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\jrRKwCB.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\gWWHKcQ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\XdddSxm.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\HskgMKs.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\tRfhFee.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\vhpGEVz.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\NLLEOCn.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\CUiZfgs.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\zGpPZdZ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\SfNhCVe.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\pVmsmIk.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\KesyZAC.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\ixCZwxY.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\TFWWtvM.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\IqSpBSt.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\zpXRCuR.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\xIZOyet.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\wSOxsle.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\qLuoOzz.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\aGxzpKA.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\IuHhhwE.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\CnVRcJU.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\mrzGmPJ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\zyYbisg.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\CCOTUGF.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\afMSYjy.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\fxunwTL.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\nChrFEL.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\TGqDDul.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\LJlhITB.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\yvhzyRe.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\SiZeysd.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\oylyuVF.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\TyHbZma.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\LsuIDGr.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\YjWTSap.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\pOwzZRe.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\CnIPken.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\jXrjmnq.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\EBDAjCK.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\cSvKehQ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\UyNTagJ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\FPwJJIT.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\WzGrQSx.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\xVdNseE.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\AfLstXy.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\PawptSp.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\daPGSVc.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\zGwdvIe.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\zrSdFeU.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\dZzObPh.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\xYoeUYF.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\VbhhKPz.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\GkxARCZ.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
File created	C:\Windows\System\busomwr.exe	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
Token: SeLockMemoryPrivilege	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
Token: SeDebugPrivilege	4908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4908	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	90
PID 4880 wrote to memory of 4908	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	90
PID 4880 wrote to memory of 4976	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	91
PID 4880 wrote to memory of 4976	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	91
PID 4880 wrote to memory of 1152	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	92
PID 4880 wrote to memory of 1152	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	92
PID 4880 wrote to memory of 4572	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	93
PID 4880 wrote to memory of 4572	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	93
PID 4880 wrote to memory of 4836	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	94
PID 4880 wrote to memory of 4836	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	94
PID 4880 wrote to memory of 4420	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	95
PID 4880 wrote to memory of 4420	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	95
PID 4880 wrote to memory of 2220	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	96
PID 4880 wrote to memory of 2220	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	96
PID 4880 wrote to memory of 3344	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	97
PID 4880 wrote to memory of 3344	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	97
PID 4880 wrote to memory of 1432	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	98
PID 4880 wrote to memory of 1432	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	98
PID 4880 wrote to memory of 3324	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	99
PID 4880 wrote to memory of 3324	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	99
PID 4880 wrote to memory of 4788	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	100
PID 4880 wrote to memory of 4788	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	100
PID 4880 wrote to memory of 2592	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	101
PID 4880 wrote to memory of 2592	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	101
PID 4880 wrote to memory of 4696	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	102
PID 4880 wrote to memory of 4696	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	102
PID 4880 wrote to memory of 2868	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	103
PID 4880 wrote to memory of 2868	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	103
PID 4880 wrote to memory of 4396	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	104
PID 4880 wrote to memory of 4396	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	104
PID 4880 wrote to memory of 4776	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	105
PID 4880 wrote to memory of 4776	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	105
PID 4880 wrote to memory of 2500	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	106
PID 4880 wrote to memory of 2500	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	106
PID 4880 wrote to memory of 4764	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	107
PID 4880 wrote to memory of 4764	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	107
PID 4880 wrote to memory of 1248	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	108
PID 4880 wrote to memory of 1248	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	108
PID 4880 wrote to memory of 4032	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	109
PID 4880 wrote to memory of 4032	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	109
PID 4880 wrote to memory of 5044	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	110
PID 4880 wrote to memory of 5044	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	110
PID 4880 wrote to memory of 2976	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	111
PID 4880 wrote to memory of 2976	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	111
PID 4880 wrote to memory of 1060	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	112
PID 4880 wrote to memory of 1060	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	112
PID 4880 wrote to memory of 4144	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	113
PID 4880 wrote to memory of 4144	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	113
PID 4880 wrote to memory of 2644	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	114
PID 4880 wrote to memory of 2644	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	114
PID 4880 wrote to memory of 5076	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	115
PID 4880 wrote to memory of 5076	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	115
PID 4880 wrote to memory of 3264	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	119
PID 4880 wrote to memory of 3264	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	119
PID 4880 wrote to memory of 2124	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	120
PID 4880 wrote to memory of 2124	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	120
PID 4880 wrote to memory of 3696	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	121
PID 4880 wrote to memory of 3696	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	121
PID 4880 wrote to memory of 3172	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	122
PID 4880 wrote to memory of 3172	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	122
PID 4880 wrote to memory of 1164	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	123
PID 4880 wrote to memory of 1164	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	123
PID 4880 wrote to memory of 2016	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	124
PID 4880 wrote to memory of 2016	4880	ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe	124

C:\Users\Admin\AppData\Local\Temp\ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe
"C:\Users\Admin\AppData\Local\Temp\ac0764d6e02403dad9a6bb4be1c5de06d93987ce738a4609148fe234f3c5a829.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\System\ywYtliH.exe
  C:\Windows\System\ywYtliH.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\EHPIqkm.exe
  C:\Windows\System\EHPIqkm.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\bImNWef.exe
  C:\Windows\System\bImNWef.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\VbOQmBG.exe
  C:\Windows\System\VbOQmBG.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\WmnmbuD.exe
  C:\Windows\System\WmnmbuD.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\TAWDZZR.exe
  C:\Windows\System\TAWDZZR.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\dtjrXJB.exe
  C:\Windows\System\dtjrXJB.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\QYabtfp.exe
  C:\Windows\System\QYabtfp.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\RHoqthP.exe
  C:\Windows\System\RHoqthP.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\aGnPsMV.exe
  C:\Windows\System\aGnPsMV.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\EyewrsH.exe
  C:\Windows\System\EyewrsH.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\UKxKmsk.exe
  C:\Windows\System\UKxKmsk.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\NIfbqCm.exe
  C:\Windows\System\NIfbqCm.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\HDcahMq.exe
  C:\Windows\System\HDcahMq.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\WniFBRj.exe
  C:\Windows\System\WniFBRj.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\cxTKuyg.exe
  C:\Windows\System\cxTKuyg.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\bIWDVVW.exe
  C:\Windows\System\bIWDVVW.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\QTxgcLI.exe
  C:\Windows\System\QTxgcLI.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\PSSwQJr.exe
  C:\Windows\System\PSSwQJr.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\ecuLXJl.exe
  C:\Windows\System\ecuLXJl.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\hngEZSL.exe
  C:\Windows\System\hngEZSL.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\IcrNTiQ.exe
  C:\Windows\System\IcrNTiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\oZLnszH.exe
  C:\Windows\System\oZLnszH.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\AhEtsuB.exe
  C:\Windows\System\AhEtsuB.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\hwYDiKK.exe
  C:\Windows\System\hwYDiKK.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\mZxuiYg.exe
  C:\Windows\System\mZxuiYg.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\qgdMsmk.exe
  C:\Windows\System\qgdMsmk.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\Tejcgnh.exe
  C:\Windows\System\Tejcgnh.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\sdxutbc.exe
  C:\Windows\System\sdxutbc.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\QpbRSNC.exe
  C:\Windows\System\QpbRSNC.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\TwKzyGI.exe
  C:\Windows\System\TwKzyGI.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\JVXUQuD.exe
  C:\Windows\System\JVXUQuD.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\YCgUksc.exe
  C:\Windows\System\YCgUksc.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\bPlfyyT.exe
  C:\Windows\System\bPlfyyT.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\RbJMAWX.exe
  C:\Windows\System\RbJMAWX.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\ECKxYfG.exe
  C:\Windows\System\ECKxYfG.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\CMiThft.exe
  C:\Windows\System\CMiThft.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\IzgAuSN.exe
  C:\Windows\System\IzgAuSN.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\eDlUygK.exe
  C:\Windows\System\eDlUygK.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\xwpNKDs.exe
  C:\Windows\System\xwpNKDs.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\cuigmnb.exe
  C:\Windows\System\cuigmnb.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\KvAdPYh.exe
  C:\Windows\System\KvAdPYh.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\PDydIrz.exe
  C:\Windows\System\PDydIrz.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\cmpYRTs.exe
  C:\Windows\System\cmpYRTs.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\GirQHNd.exe
  C:\Windows\System\GirQHNd.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\iahFIpf.exe
  C:\Windows\System\iahFIpf.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\asUHrKy.exe
  C:\Windows\System\asUHrKy.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\gqvLXyr.exe
  C:\Windows\System\gqvLXyr.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\wEwhwIV.exe
  C:\Windows\System\wEwhwIV.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\XAArcpY.exe
  C:\Windows\System\XAArcpY.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\mPzcTis.exe
  C:\Windows\System\mPzcTis.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\KpfoNwv.exe
  C:\Windows\System\KpfoNwv.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\JGOJFLL.exe
  C:\Windows\System\JGOJFLL.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\dpoBjAm.exe
  C:\Windows\System\dpoBjAm.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\ndvktbx.exe
  C:\Windows\System\ndvktbx.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\tRImpbr.exe
  C:\Windows\System\tRImpbr.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\kTNOnks.exe
  C:\Windows\System\kTNOnks.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\DVbWyTj.exe
  C:\Windows\System\DVbWyTj.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\FTCHVsM.exe
  C:\Windows\System\FTCHVsM.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\jTXmvVX.exe
  C:\Windows\System\jTXmvVX.exe
  2⤵
  - Executes dropped EXE
  PID:5128
- C:\Windows\System\sMarTmX.exe
  C:\Windows\System\sMarTmX.exe
  2⤵
  - Executes dropped EXE
  PID:5144
- C:\Windows\System\OLSQLrT.exe
  C:\Windows\System\OLSQLrT.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\jjPjHYE.exe
  C:\Windows\System\jjPjHYE.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\KSqUjSA.exe
  C:\Windows\System\KSqUjSA.exe
  2⤵
  - Executes dropped EXE
  PID:5264
- C:\Windows\System\ClnuEZh.exe
  C:\Windows\System\ClnuEZh.exe
  2⤵
  PID:5296
- C:\Windows\System\nbGTfRs.exe
  C:\Windows\System\nbGTfRs.exe
  2⤵
  PID:5332
- C:\Windows\System\kdIcDEj.exe
  C:\Windows\System\kdIcDEj.exe
  2⤵
  PID:5368
- C:\Windows\System\PhuzPIl.exe
  C:\Windows\System\PhuzPIl.exe
  2⤵
  PID:5388
- C:\Windows\System\ktQcHZz.exe
  C:\Windows\System\ktQcHZz.exe
  2⤵
  PID:5404
- C:\Windows\System\NyJIiap.exe
  C:\Windows\System\NyJIiap.exe
  2⤵
  PID:5444
- C:\Windows\System\ntVYMIK.exe
  C:\Windows\System\ntVYMIK.exe
  2⤵
  PID:5472
- C:\Windows\System\xIpyeoB.exe
  C:\Windows\System\xIpyeoB.exe
  2⤵
  PID:5500
- C:\Windows\System\wPoBItI.exe
  C:\Windows\System\wPoBItI.exe
  2⤵
  PID:5532
- C:\Windows\System\QPpsEKh.exe
  C:\Windows\System\QPpsEKh.exe
  2⤵
  PID:5564
- C:\Windows\System\uxgmBam.exe
  C:\Windows\System\uxgmBam.exe
  2⤵
  PID:5596
- C:\Windows\System\OKveoID.exe
  C:\Windows\System\OKveoID.exe
  2⤵
  PID:5616
- C:\Windows\System\jjPOGUA.exe
  C:\Windows\System\jjPOGUA.exe
  2⤵
  PID:5644
- C:\Windows\System\bSPkdNJ.exe
  C:\Windows\System\bSPkdNJ.exe
  2⤵
  PID:5672
- C:\Windows\System\QjXZPkC.exe
  C:\Windows\System\QjXZPkC.exe
  2⤵
  PID:5704
- C:\Windows\System\cjAdCtk.exe
  C:\Windows\System\cjAdCtk.exe
  2⤵
  PID:5728
- C:\Windows\System\TacsyUp.exe
  C:\Windows\System\TacsyUp.exe
  2⤵
  PID:5756
- C:\Windows\System\JqsFHCz.exe
  C:\Windows\System\JqsFHCz.exe
  2⤵
  PID:5784
- C:\Windows\System\PhjHRTn.exe
  C:\Windows\System\PhjHRTn.exe
  2⤵
  PID:5812
- C:\Windows\System\HRJwWVu.exe
  C:\Windows\System\HRJwWVu.exe
  2⤵
  PID:5840
- C:\Windows\System\nNwLyrE.exe
  C:\Windows\System\nNwLyrE.exe
  2⤵
  PID:5868
- C:\Windows\System\rYLKZud.exe
  C:\Windows\System\rYLKZud.exe
  2⤵
  PID:5884
- C:\Windows\System\vnjILKv.exe
  C:\Windows\System\vnjILKv.exe
  2⤵
  PID:5928
- C:\Windows\System\mNQpnFB.exe
  C:\Windows\System\mNQpnFB.exe
  2⤵
  PID:5952
- C:\Windows\System\FCcujLt.exe
  C:\Windows\System\FCcujLt.exe
  2⤵
  PID:5988
- C:\Windows\System\PzlzVql.exe
  C:\Windows\System\PzlzVql.exe
  2⤵
  PID:6008
- C:\Windows\System\yXJodkd.exe
  C:\Windows\System\yXJodkd.exe
  2⤵
  PID:6044
- C:\Windows\System\HIzAkTC.exe
  C:\Windows\System\HIzAkTC.exe
  2⤵
  PID:6064
- C:\Windows\System\zUqYTEM.exe
  C:\Windows\System\zUqYTEM.exe
  2⤵
  PID:6092
- C:\Windows\System\ObLUTCW.exe
  C:\Windows\System\ObLUTCW.exe
  2⤵
  PID:6120
- C:\Windows\System\CiICFgz.exe
  C:\Windows\System\CiICFgz.exe
  2⤵
  PID:1648
- C:\Windows\System\qKcclyD.exe
  C:\Windows\System\qKcclyD.exe
  2⤵
  PID:5160
- C:\Windows\System\zshmkBe.exe
  C:\Windows\System\zshmkBe.exe
  2⤵
  PID:5256
- C:\Windows\System\fMbwgFZ.exe
  C:\Windows\System\fMbwgFZ.exe
  2⤵
  PID:5316
- C:\Windows\System\LmetDLM.exe
  C:\Windows\System\LmetDLM.exe
  2⤵
  PID:5352
- C:\Windows\System\FExxinr.exe
  C:\Windows\System\FExxinr.exe
  2⤵
  PID:5416
- C:\Windows\System\WHgdevl.exe
  C:\Windows\System\WHgdevl.exe
  2⤵
  PID:5468
- C:\Windows\System\eRGvbop.exe
  C:\Windows\System\eRGvbop.exe
  2⤵
  PID:5540
- C:\Windows\System\WpMghfh.exe
  C:\Windows\System\WpMghfh.exe
  2⤵
  PID:5612
- C:\Windows\System\vdzSsHP.exe
  C:\Windows\System\vdzSsHP.exe
  2⤵
  PID:5656
- C:\Windows\System\xsGWvLO.exe
  C:\Windows\System\xsGWvLO.exe
  2⤵
  PID:5720
- C:\Windows\System\DsfGzWK.exe
  C:\Windows\System\DsfGzWK.exe
  2⤵
  PID:5780
- C:\Windows\System\wZNquqx.exe
  C:\Windows\System\wZNquqx.exe
  2⤵
  PID:5864
- C:\Windows\System\ElMrlKx.exe
  C:\Windows\System\ElMrlKx.exe
  2⤵
  PID:5920
- C:\Windows\System\VbnemKI.exe
  C:\Windows\System\VbnemKI.exe
  2⤵
  PID:5964
- C:\Windows\System\oUdyvxn.exe
  C:\Windows\System\oUdyvxn.exe
  2⤵
  PID:5548
- C:\Windows\System\UBsoFiz.exe
  C:\Windows\System\UBsoFiz.exe
  2⤵
  PID:6076
- C:\Windows\System\vgSmHGu.exe
  C:\Windows\System\vgSmHGu.exe
  2⤵
  PID:5140
- C:\Windows\System\gPljWUf.exe
  C:\Windows\System\gPljWUf.exe
  2⤵
  PID:5288
- C:\Windows\System\kJuqxbE.exe
  C:\Windows\System\kJuqxbE.exe
  2⤵
  PID:5396
- C:\Windows\System\PcDFKHU.exe
  C:\Windows\System\PcDFKHU.exe
  2⤵
  PID:5604
- C:\Windows\System\TzDVWmz.exe
  C:\Windows\System\TzDVWmz.exe
  2⤵
  PID:5696
- C:\Windows\System\avUsqUq.exe
  C:\Windows\System\avUsqUq.exe
  2⤵
  PID:5832
- C:\Windows\System\PdibKxS.exe
  C:\Windows\System\PdibKxS.exe
  2⤵
  PID:6000
- C:\Windows\System\VWTcWeV.exe
  C:\Windows\System\VWTcWeV.exe
  2⤵
  PID:4328
- C:\Windows\System\oqzZudX.exe
  C:\Windows\System\oqzZudX.exe
  2⤵
  PID:5464
- C:\Windows\System\qAmgTxR.exe
  C:\Windows\System\qAmgTxR.exe
  2⤵
  PID:5752
- C:\Windows\System\Cignxtf.exe
  C:\Windows\System\Cignxtf.exe
  2⤵
  PID:5944
- C:\Windows\System\NLLEOCn.exe
  C:\Windows\System\NLLEOCn.exe
  2⤵
  PID:5808
- C:\Windows\System\FnTqCpF.exe
  C:\Windows\System\FnTqCpF.exe
  2⤵
  PID:6168
- C:\Windows\System\IxjvzxL.exe
  C:\Windows\System\IxjvzxL.exe
  2⤵
  PID:6196
- C:\Windows\System\xfblAMI.exe
  C:\Windows\System\xfblAMI.exe
  2⤵
  PID:6236
- C:\Windows\System\CZDIPQm.exe
  C:\Windows\System\CZDIPQm.exe
  2⤵
  PID:6268
- C:\Windows\System\SnNQUHe.exe
  C:\Windows\System\SnNQUHe.exe
  2⤵
  PID:6296
- C:\Windows\System\ZAixlzW.exe
  C:\Windows\System\ZAixlzW.exe
  2⤵
  PID:6344
- C:\Windows\System\LRAGvnv.exe
  C:\Windows\System\LRAGvnv.exe
  2⤵
  PID:6364
- C:\Windows\System\SSwHoTg.exe
  C:\Windows\System\SSwHoTg.exe
  2⤵
  PID:6400
- C:\Windows\System\IUHBZpG.exe
  C:\Windows\System\IUHBZpG.exe
  2⤵
  PID:6424
- C:\Windows\System\orPqjxN.exe
  C:\Windows\System\orPqjxN.exe
  2⤵
  PID:6456
- C:\Windows\System\npZohJx.exe
  C:\Windows\System\npZohJx.exe
  2⤵
  PID:6492
- C:\Windows\System\AqciOvi.exe
  C:\Windows\System\AqciOvi.exe
  2⤵
  PID:6528
- C:\Windows\System\ArPlSFI.exe
  C:\Windows\System\ArPlSFI.exe
  2⤵
  PID:6592
- C:\Windows\System\rbEiEFA.exe
  C:\Windows\System\rbEiEFA.exe
  2⤵
  PID:6624
- C:\Windows\System\TwOeQxx.exe
  C:\Windows\System\TwOeQxx.exe
  2⤵
  PID:6664
- C:\Windows\System\BPhDvlu.exe
  C:\Windows\System\BPhDvlu.exe
  2⤵
  PID:6692
- C:\Windows\System\dDSxzHh.exe
  C:\Windows\System\dDSxzHh.exe
  2⤵
  PID:6724
- C:\Windows\System\KmWuXss.exe
  C:\Windows\System\KmWuXss.exe
  2⤵
  PID:6752
- C:\Windows\System\WPnYixO.exe
  C:\Windows\System\WPnYixO.exe
  2⤵
  PID:6768
- C:\Windows\System\DUhHuWn.exe
  C:\Windows\System\DUhHuWn.exe
  2⤵
  PID:6784
- C:\Windows\System\CZANiVU.exe
  C:\Windows\System\CZANiVU.exe
  2⤵
  PID:6800
- C:\Windows\System\feUycxr.exe
  C:\Windows\System\feUycxr.exe
  2⤵
  PID:6824
- C:\Windows\System\CtiihbT.exe
  C:\Windows\System\CtiihbT.exe
  2⤵
  PID:6848
- C:\Windows\System\tjWLeKX.exe
  C:\Windows\System\tjWLeKX.exe
  2⤵
  PID:6884
- C:\Windows\System\YvvvoUZ.exe
  C:\Windows\System\YvvvoUZ.exe
  2⤵
  PID:6940
- C:\Windows\System\DmgHHAt.exe
  C:\Windows\System\DmgHHAt.exe
  2⤵
  PID:6984
- C:\Windows\System\ZwnhpRp.exe
  C:\Windows\System\ZwnhpRp.exe
  2⤵
  PID:7012
- C:\Windows\System\vWnEDhM.exe
  C:\Windows\System\vWnEDhM.exe
  2⤵
  PID:7044
- C:\Windows\System\bjiudyC.exe
  C:\Windows\System\bjiudyC.exe
  2⤵
  PID:7084
- C:\Windows\System\yFyrSYv.exe
  C:\Windows\System\yFyrSYv.exe
  2⤵
  PID:7104
- C:\Windows\System\JsXIIoE.exe
  C:\Windows\System\JsXIIoE.exe
  2⤵
  PID:7132
- C:\Windows\System\wCDdRHT.exe
  C:\Windows\System\wCDdRHT.exe
  2⤵
  PID:7160
- C:\Windows\System\QnbrNrJ.exe
  C:\Windows\System\QnbrNrJ.exe
  2⤵
  PID:6188
- C:\Windows\System\giBpJCl.exe
  C:\Windows\System\giBpJCl.exe
  2⤵
  PID:6216
- C:\Windows\System\IegMDjR.exe
  C:\Windows\System\IegMDjR.exe
  2⤵
  PID:6332
- C:\Windows\System\yYuMqWd.exe
  C:\Windows\System\yYuMqWd.exe
  2⤵
  PID:6416
- C:\Windows\System\wHcEawg.exe
  C:\Windows\System\wHcEawg.exe
  2⤵
  PID:6468
- C:\Windows\System\WveXywS.exe
  C:\Windows\System\WveXywS.exe
  2⤵
  PID:6552
- C:\Windows\System\MRMBDys.exe
  C:\Windows\System\MRMBDys.exe
  2⤵
  PID:6652
- C:\Windows\System\mwmnxUJ.exe
  C:\Windows\System\mwmnxUJ.exe
  2⤵
  PID:6716
- C:\Windows\System\bcQPomw.exe
  C:\Windows\System\bcQPomw.exe
  2⤵
  PID:6776
- C:\Windows\System\ktFvdQw.exe
  C:\Windows\System\ktFvdQw.exe
  2⤵
  PID:6836
- C:\Windows\System\nZgATho.exe
  C:\Windows\System\nZgATho.exe
  2⤵
  PID:6908
- C:\Windows\System\dtLyGAC.exe
  C:\Windows\System\dtLyGAC.exe
  2⤵
  PID:6996
- C:\Windows\System\XtcDjXT.exe
  C:\Windows\System\XtcDjXT.exe
  2⤵
  PID:7092
- C:\Windows\System\KwiduGb.exe
  C:\Windows\System\KwiduGb.exe
  2⤵
  PID:7156
- C:\Windows\System\dsVATud.exe
  C:\Windows\System\dsVATud.exe
  2⤵
  PID:6204
- C:\Windows\System\WeLYzqb.exe
  C:\Windows\System\WeLYzqb.exe
  2⤵
  PID:6408
- C:\Windows\System\YknITtr.exe
  C:\Windows\System\YknITtr.exe
  2⤵
  PID:6620
- C:\Windows\System\ZnpHsAb.exe
  C:\Windows\System\ZnpHsAb.exe
  2⤵
  PID:6744
- C:\Windows\System\pXBpfVS.exe
  C:\Windows\System\pXBpfVS.exe
  2⤵
  PID:6820
- C:\Windows\System\bHUTaCc.exe
  C:\Windows\System\bHUTaCc.exe
  2⤵
  PID:6976
- C:\Windows\System\DeLprvI.exe
  C:\Windows\System\DeLprvI.exe
  2⤵
  PID:7124
- C:\Windows\System\kDTzNjA.exe
  C:\Windows\System\kDTzNjA.exe
  2⤵
  PID:6876
- C:\Windows\System\jdkFRGI.exe
  C:\Windows\System\jdkFRGI.exe
  2⤵
  PID:6920
- C:\Windows\System\eEWnYxU.exe
  C:\Windows\System\eEWnYxU.exe
  2⤵
  PID:6704
- C:\Windows\System\jCdZwjG.exe
  C:\Windows\System\jCdZwjG.exe
  2⤵
  PID:7172
- C:\Windows\System\RkgDPOq.exe
  C:\Windows\System\RkgDPOq.exe
  2⤵
  PID:7216
- C:\Windows\System\NGFHHKW.exe
  C:\Windows\System\NGFHHKW.exe
  2⤵
  PID:7232
- C:\Windows\System\ZYofiFQ.exe
  C:\Windows\System\ZYofiFQ.exe
  2⤵
  PID:7264
- C:\Windows\System\RmQtCsB.exe
  C:\Windows\System\RmQtCsB.exe
  2⤵
  PID:7300
- C:\Windows\System\JNrcEIo.exe
  C:\Windows\System\JNrcEIo.exe
  2⤵
  PID:7328
- C:\Windows\System\rngAYUM.exe
  C:\Windows\System\rngAYUM.exe
  2⤵
  PID:7356
- C:\Windows\System\xFjQeCM.exe
  C:\Windows\System\xFjQeCM.exe
  2⤵
  PID:7384
- C:\Windows\System\jlUfeQh.exe
  C:\Windows\System\jlUfeQh.exe
  2⤵
  PID:7412
- C:\Windows\System\usyuTmw.exe
  C:\Windows\System\usyuTmw.exe
  2⤵
  PID:7440
- C:\Windows\System\JcgBSIJ.exe
  C:\Windows\System\JcgBSIJ.exe
  2⤵
  PID:7468
- C:\Windows\System\dAkvpPz.exe
  C:\Windows\System\dAkvpPz.exe
  2⤵
  PID:7496
- C:\Windows\System\fcahEtB.exe
  C:\Windows\System\fcahEtB.exe
  2⤵
  PID:7524
- C:\Windows\System\cblXPgu.exe
  C:\Windows\System\cblXPgu.exe
  2⤵
  PID:7552
- C:\Windows\System\ZbMRjSa.exe
  C:\Windows\System\ZbMRjSa.exe
  2⤵
  PID:7580
- C:\Windows\System\mmPLETS.exe
  C:\Windows\System\mmPLETS.exe
  2⤵
  PID:7608
- C:\Windows\System\VUcQgCB.exe
  C:\Windows\System\VUcQgCB.exe
  2⤵
  PID:7636
- C:\Windows\System\xRpRrHP.exe
  C:\Windows\System\xRpRrHP.exe
  2⤵
  PID:7664
- C:\Windows\System\ENmeprP.exe
  C:\Windows\System\ENmeprP.exe
  2⤵
  PID:7692
- C:\Windows\System\UwMvGoR.exe
  C:\Windows\System\UwMvGoR.exe
  2⤵
  PID:7716
- C:\Windows\System\xArkyYd.exe
  C:\Windows\System\xArkyYd.exe
  2⤵
  PID:7748
- C:\Windows\System\xhslaDn.exe
  C:\Windows\System\xhslaDn.exe
  2⤵
  PID:7768
- C:\Windows\System\lrpActK.exe
  C:\Windows\System\lrpActK.exe
  2⤵
  PID:7788
- C:\Windows\System\DQJhUSf.exe
  C:\Windows\System\DQJhUSf.exe
  2⤵
  PID:7808
- C:\Windows\System\mpuZrst.exe
  C:\Windows\System\mpuZrst.exe
  2⤵
  PID:7832
- C:\Windows\System\fMcJeVT.exe
  C:\Windows\System\fMcJeVT.exe
  2⤵
  PID:7860
- C:\Windows\System\mwrCdQq.exe
  C:\Windows\System\mwrCdQq.exe
  2⤵
  PID:7892
- C:\Windows\System\tjgMYPv.exe
  C:\Windows\System\tjgMYPv.exe
  2⤵
  PID:7936
- C:\Windows\System\CejkVva.exe
  C:\Windows\System\CejkVva.exe
  2⤵
  PID:7992
- C:\Windows\System\XvErcOn.exe
  C:\Windows\System\XvErcOn.exe
  2⤵
  PID:8016
- C:\Windows\System\manHnkE.exe
  C:\Windows\System\manHnkE.exe
  2⤵
  PID:8044
- C:\Windows\System\dhjGWLU.exe
  C:\Windows\System\dhjGWLU.exe
  2⤵
  PID:8072
- C:\Windows\System\kOLYLOY.exe
  C:\Windows\System\kOLYLOY.exe
  2⤵
  PID:8100
- C:\Windows\System\EOBaYLo.exe
  C:\Windows\System\EOBaYLo.exe
  2⤵
  PID:8128
- C:\Windows\System\fWoWXjI.exe
  C:\Windows\System\fWoWXjI.exe
  2⤵
  PID:8156
- C:\Windows\System\ZnIBarQ.exe
  C:\Windows\System\ZnIBarQ.exe
  2⤵
  PID:8184
- C:\Windows\System\NVSIrXv.exe
  C:\Windows\System\NVSIrXv.exe
  2⤵
  PID:7144
- C:\Windows\System\iljDWTv.exe
  C:\Windows\System\iljDWTv.exe
  2⤵
  PID:7244
- C:\Windows\System\xMAFzDP.exe
  C:\Windows\System\xMAFzDP.exe
  2⤵
  PID:6760
- C:\Windows\System\gXAytTu.exe
  C:\Windows\System\gXAytTu.exe
  2⤵
  PID:7380
- C:\Windows\System\vDYMMtT.exe
  C:\Windows\System\vDYMMtT.exe
  2⤵
  PID:7452
- C:\Windows\System\uvsTvFS.exe
  C:\Windows\System\uvsTvFS.exe
  2⤵
  PID:7520
- C:\Windows\System\ZSafUrj.exe
  C:\Windows\System\ZSafUrj.exe
  2⤵
  PID:7592
- C:\Windows\System\tkJshjl.exe
  C:\Windows\System\tkJshjl.exe
  2⤵
  PID:7648
- C:\Windows\System\oSadeqZ.exe
  C:\Windows\System\oSadeqZ.exe
  2⤵
  PID:7676
- C:\Windows\System\ZPAVBjJ.exe
  C:\Windows\System\ZPAVBjJ.exe
  2⤵
  PID:7760
- C:\Windows\System\TQECwko.exe
  C:\Windows\System\TQECwko.exe
  2⤵
  PID:7828
- C:\Windows\System\bmwEjrj.exe
  C:\Windows\System\bmwEjrj.exe
  2⤵
  PID:7880
- C:\Windows\System\QAXvdsf.exe
  C:\Windows\System\QAXvdsf.exe
  2⤵
  PID:7948
- C:\Windows\System\IisOxOR.exe
  C:\Windows\System\IisOxOR.exe
  2⤵
  PID:7980
- C:\Windows\System\oSvisRl.exe
  C:\Windows\System\oSvisRl.exe
  2⤵
  PID:8012
- C:\Windows\System\zmHyNlu.exe
  C:\Windows\System\zmHyNlu.exe
  2⤵
  PID:656
- C:\Windows\System\hknotNE.exe
  C:\Windows\System\hknotNE.exe
  2⤵
  PID:8120
- C:\Windows\System\KwTjHMj.exe
  C:\Windows\System\KwTjHMj.exe
  2⤵
  PID:8164
- C:\Windows\System\KbuazLI.exe
  C:\Windows\System\KbuazLI.exe
  2⤵
  PID:7224
- C:\Windows\System\afMSYjy.exe
  C:\Windows\System\afMSYjy.exe
  2⤵
  PID:7436
- C:\Windows\System\YhnPLOR.exe
  C:\Windows\System\YhnPLOR.exe
  2⤵
  PID:7036
- C:\Windows\System\SfqtSnM.exe
  C:\Windows\System\SfqtSnM.exe
  2⤵
  PID:2460
- C:\Windows\System\DPdWAHP.exe
  C:\Windows\System\DPdWAHP.exe
  2⤵
  PID:7684
- C:\Windows\System\MexZEgb.exe
  C:\Windows\System\MexZEgb.exe
  2⤵
  PID:7900
- C:\Windows\System\yezhWNc.exe
  C:\Windows\System\yezhWNc.exe
  2⤵
  PID:8172
- C:\Windows\System\cZBQSGb.exe
  C:\Windows\System\cZBQSGb.exe
  2⤵
  PID:7368
- C:\Windows\System\LMcpBWZ.exe
  C:\Windows\System\LMcpBWZ.exe
  2⤵
  PID:7572
- C:\Windows\System\uDLAmUi.exe
  C:\Windows\System\uDLAmUi.exe
  2⤵
  PID:7776
- C:\Windows\System\vNXzwrX.exe
  C:\Windows\System\vNXzwrX.exe
  2⤵
  PID:7756
- C:\Windows\System\RELXnGa.exe
  C:\Windows\System\RELXnGa.exe
  2⤵
  PID:4452
- C:\Windows\System\vwEVlKs.exe
  C:\Windows\System\vwEVlKs.exe
  2⤵
  PID:4364
- C:\Windows\System\CPVHPeK.exe
  C:\Windows\System\CPVHPeK.exe
  2⤵
  PID:4760
- C:\Windows\System\slYUyEC.exe
  C:\Windows\System\slYUyEC.exe
  2⤵
  PID:8216
- C:\Windows\System\ukhTrjV.exe
  C:\Windows\System\ukhTrjV.exe
  2⤵
  PID:8244
- C:\Windows\System\uvateYV.exe
  C:\Windows\System\uvateYV.exe
  2⤵
  PID:8284
- C:\Windows\System\ouKduqp.exe
  C:\Windows\System\ouKduqp.exe
  2⤵
  PID:8300
- C:\Windows\System\dzljwuF.exe
  C:\Windows\System\dzljwuF.exe
  2⤵
  PID:8328
- C:\Windows\System\FjbOGXp.exe
  C:\Windows\System\FjbOGXp.exe
  2⤵
  PID:8356
- C:\Windows\System\cbCzWok.exe
  C:\Windows\System\cbCzWok.exe
  2⤵
  PID:8384
- C:\Windows\System\cBREZhz.exe
  C:\Windows\System\cBREZhz.exe
  2⤵
  PID:8412
- C:\Windows\System\JTRxEgt.exe
  C:\Windows\System\JTRxEgt.exe
  2⤵
  PID:8440
- C:\Windows\System\iEqSTkU.exe
  C:\Windows\System\iEqSTkU.exe
  2⤵
  PID:8468
- C:\Windows\System\lArcvni.exe
  C:\Windows\System\lArcvni.exe
  2⤵
  PID:8496
- C:\Windows\System\klZSfFE.exe
  C:\Windows\System\klZSfFE.exe
  2⤵
  PID:8528
- C:\Windows\System\SVyJOOD.exe
  C:\Windows\System\SVyJOOD.exe
  2⤵
  PID:8560
- C:\Windows\System\jFyzyFK.exe
  C:\Windows\System\jFyzyFK.exe
  2⤵
  PID:8584
- C:\Windows\System\AfLKLxA.exe
  C:\Windows\System\AfLKLxA.exe
  2⤵
  PID:8612
- C:\Windows\System\Vvtizwa.exe
  C:\Windows\System\Vvtizwa.exe
  2⤵
  PID:8640
- C:\Windows\System\LBBrKhu.exe
  C:\Windows\System\LBBrKhu.exe
  2⤵
  PID:8672
- C:\Windows\System\vFNNRlU.exe
  C:\Windows\System\vFNNRlU.exe
  2⤵
  PID:8696
- C:\Windows\System\MyrmsvX.exe
  C:\Windows\System\MyrmsvX.exe
  2⤵
  PID:8720
- C:\Windows\System\pUPfBwk.exe
  C:\Windows\System\pUPfBwk.exe
  2⤵
  PID:8740
- C:\Windows\System\gwybBVT.exe
  C:\Windows\System\gwybBVT.exe
  2⤵
  PID:8756
- C:\Windows\System\WkEBurs.exe
  C:\Windows\System\WkEBurs.exe
  2⤵
  PID:8772
- C:\Windows\System\wjculqN.exe
  C:\Windows\System\wjculqN.exe
  2⤵
  PID:8828
- C:\Windows\System\anTqyzR.exe
  C:\Windows\System\anTqyzR.exe
  2⤵
  PID:8868
- C:\Windows\System\LGAkglY.exe
  C:\Windows\System\LGAkglY.exe
  2⤵
  PID:8896
- C:\Windows\System\vlEudiG.exe
  C:\Windows\System\vlEudiG.exe
  2⤵
  PID:8924
- C:\Windows\System\uTKJxnB.exe
  C:\Windows\System\uTKJxnB.exe
  2⤵
  PID:8952
- C:\Windows\System\SKkiJpJ.exe
  C:\Windows\System\SKkiJpJ.exe
  2⤵
  PID:8980
- C:\Windows\System\DvnzXMR.exe
  C:\Windows\System\DvnzXMR.exe
  2⤵
  PID:9008
- C:\Windows\System\rdGRkPi.exe
  C:\Windows\System\rdGRkPi.exe
  2⤵
  PID:9036
- C:\Windows\System\hcNFmRt.exe
  C:\Windows\System\hcNFmRt.exe
  2⤵
  PID:9064
- C:\Windows\System\XkONFJT.exe
  C:\Windows\System\XkONFJT.exe
  2⤵
  PID:9092
- C:\Windows\System\gRahFZe.exe
  C:\Windows\System\gRahFZe.exe
  2⤵
  PID:9120
- C:\Windows\System\CaSsgOO.exe
  C:\Windows\System\CaSsgOO.exe
  2⤵
  PID:9148
- C:\Windows\System\SXbiRwq.exe
  C:\Windows\System\SXbiRwq.exe
  2⤵
  PID:9176
- C:\Windows\System\tAwrNUJ.exe
  C:\Windows\System\tAwrNUJ.exe
  2⤵
  PID:9204
- C:\Windows\System\zxWDNHf.exe
  C:\Windows\System\zxWDNHf.exe
  2⤵
  PID:8228
- C:\Windows\System\OYlYhpv.exe
  C:\Windows\System\OYlYhpv.exe
  2⤵
  PID:8268
- C:\Windows\System\xDcsTiP.exe
  C:\Windows\System\xDcsTiP.exe
  2⤵
  PID:8352
- C:\Windows\System\nVUeZyw.exe
  C:\Windows\System\nVUeZyw.exe
  2⤵
  PID:8408
- C:\Windows\System\CVXhSaH.exe
  C:\Windows\System\CVXhSaH.exe
  2⤵
  PID:8480
- C:\Windows\System\URLCyYj.exe
  C:\Windows\System\URLCyYj.exe
  2⤵
  PID:8548
- C:\Windows\System\rTOfWTc.exe
  C:\Windows\System\rTOfWTc.exe
  2⤵
  PID:8608
- C:\Windows\System\yGBOJPi.exe
  C:\Windows\System\yGBOJPi.exe
  2⤵
  PID:8664
- C:\Windows\System\cOMCTOc.exe
  C:\Windows\System\cOMCTOc.exe
  2⤵
  PID:8736
- C:\Windows\System\eSmIgRm.exe
  C:\Windows\System\eSmIgRm.exe
  2⤵
  PID:8796
- C:\Windows\System\NQqbrsl.exe
  C:\Windows\System\NQqbrsl.exe
  2⤵
  PID:8864
- C:\Windows\System\NAIcFll.exe
  C:\Windows\System\NAIcFll.exe
  2⤵
  PID:8936
- C:\Windows\System\YzRGasF.exe
  C:\Windows\System\YzRGasF.exe
  2⤵
  PID:9000
- C:\Windows\System\pOwzZRe.exe
  C:\Windows\System\pOwzZRe.exe
  2⤵
  PID:9060
- C:\Windows\System\XdpwOtY.exe
  C:\Windows\System\XdpwOtY.exe
  2⤵
  PID:9132
- C:\Windows\System\wTcwVRB.exe
  C:\Windows\System\wTcwVRB.exe
  2⤵
  PID:9196
- C:\Windows\System\jOwlciJ.exe
  C:\Windows\System\jOwlciJ.exe
  2⤵
  PID:8280
- C:\Windows\System\qJSeHwY.exe
  C:\Windows\System\qJSeHwY.exe
  2⤵
  PID:8432
- C:\Windows\System\HNLyQxg.exe
  C:\Windows\System\HNLyQxg.exe
  2⤵
  PID:8580
- C:\Windows\System\SeLBvCl.exe
  C:\Windows\System\SeLBvCl.exe
  2⤵
  PID:8708
- C:\Windows\System\mKmEZso.exe
  C:\Windows\System\mKmEZso.exe
  2⤵
  PID:8888
- C:\Windows\System\LDYlAna.exe
  C:\Windows\System\LDYlAna.exe
  2⤵
  PID:9056
- C:\Windows\System\tHncobz.exe
  C:\Windows\System\tHncobz.exe
  2⤵
  PID:9188
- C:\Windows\System\xdeODYX.exe
  C:\Windows\System\xdeODYX.exe
  2⤵
  PID:8508
- C:\Windows\System\maNjFeD.exe
  C:\Windows\System\maNjFeD.exe
  2⤵
  PID:8840
- C:\Windows\System\jHZebuE.exe
  C:\Windows\System\jHZebuE.exe
  2⤵
  PID:9172
- C:\Windows\System\kDjOKlk.exe
  C:\Windows\System\kDjOKlk.exe
  2⤵
  PID:8764
- C:\Windows\System\Wzruxfy.exe
  C:\Windows\System\Wzruxfy.exe
  2⤵
  PID:8800
- C:\Windows\System\dQrXZVJ.exe
  C:\Windows\System\dQrXZVJ.exe
  2⤵
  PID:9236
- C:\Windows\System\ckszMpq.exe
  C:\Windows\System\ckszMpq.exe
  2⤵
  PID:9264
- C:\Windows\System\OmXakBD.exe
  C:\Windows\System\OmXakBD.exe
  2⤵
  PID:9292
- C:\Windows\System\AibqSwO.exe
  C:\Windows\System\AibqSwO.exe
  2⤵
  PID:9308
- C:\Windows\System\mbTZnjC.exe
  C:\Windows\System\mbTZnjC.exe
  2⤵
  PID:9348
- C:\Windows\System\ihXSSmP.exe
  C:\Windows\System\ihXSSmP.exe
  2⤵
  PID:9376
- C:\Windows\System\KOgfwKq.exe
  C:\Windows\System\KOgfwKq.exe
  2⤵
  PID:9408
- C:\Windows\System\OWfnaLZ.exe
  C:\Windows\System\OWfnaLZ.exe
  2⤵
  PID:9436
- C:\Windows\System\GRguAJl.exe
  C:\Windows\System\GRguAJl.exe
  2⤵
  PID:9464
- C:\Windows\System\dGTMVvx.exe
  C:\Windows\System\dGTMVvx.exe
  2⤵
  PID:9492
- C:\Windows\System\OgwPKgr.exe
  C:\Windows\System\OgwPKgr.exe
  2⤵
  PID:9508
- C:\Windows\System\AHVKvbn.exe
  C:\Windows\System\AHVKvbn.exe
  2⤵
  PID:9536
- C:\Windows\System\ivBlIcA.exe
  C:\Windows\System\ivBlIcA.exe
  2⤵
  PID:9576
- C:\Windows\System\oNpWNVt.exe
  C:\Windows\System\oNpWNVt.exe
  2⤵
  PID:9604
- C:\Windows\System\hZREzWP.exe
  C:\Windows\System\hZREzWP.exe
  2⤵
  PID:9632
- C:\Windows\System\FYWXOky.exe
  C:\Windows\System\FYWXOky.exe
  2⤵
  PID:9660
- C:\Windows\System\fFbLtGT.exe
  C:\Windows\System\fFbLtGT.exe
  2⤵
  PID:9688
- C:\Windows\System\cRLJLiw.exe
  C:\Windows\System\cRLJLiw.exe
  2⤵
  PID:9704
- C:\Windows\System\wDzcTJV.exe
  C:\Windows\System\wDzcTJV.exe
  2⤵
  PID:9736
- C:\Windows\System\SfUlxDK.exe
  C:\Windows\System\SfUlxDK.exe
  2⤵
  PID:9772
- C:\Windows\System\BQjARBl.exe
  C:\Windows\System\BQjARBl.exe
  2⤵
  PID:9792
- C:\Windows\System\awTNVyJ.exe
  C:\Windows\System\awTNVyJ.exe
  2⤵
  PID:9828
- C:\Windows\System\XTSlXcP.exe
  C:\Windows\System\XTSlXcP.exe
  2⤵
  PID:9856
- C:\Windows\System\nQPjfKa.exe
  C:\Windows\System\nQPjfKa.exe
  2⤵
  PID:9884
- C:\Windows\System\uBwbntq.exe
  C:\Windows\System\uBwbntq.exe
  2⤵
  PID:9912
- C:\Windows\System\iwZjZFv.exe
  C:\Windows\System\iwZjZFv.exe
  2⤵
  PID:9928
- C:\Windows\System\JvMaejr.exe
  C:\Windows\System\JvMaejr.exe
  2⤵
  PID:9956
- C:\Windows\System\JGamETP.exe
  C:\Windows\System\JGamETP.exe
  2⤵
  PID:9984
- C:\Windows\System\LgUYudw.exe
  C:\Windows\System\LgUYudw.exe
  2⤵
  PID:10012
- C:\Windows\System\wEtBwkS.exe
  C:\Windows\System\wEtBwkS.exe
  2⤵
  PID:10052
- C:\Windows\System\ukLHTVp.exe
  C:\Windows\System\ukLHTVp.exe
  2⤵
  PID:10080
- C:\Windows\System\dzYCrht.exe
  C:\Windows\System\dzYCrht.exe
  2⤵
  PID:10108
- C:\Windows\System\xREmaNY.exe
  C:\Windows\System\xREmaNY.exe
  2⤵
  PID:10136
- C:\Windows\System\RpdEYPs.exe
  C:\Windows\System\RpdEYPs.exe
  2⤵
  PID:10156
- C:\Windows\System\puBHPyi.exe
  C:\Windows\System\puBHPyi.exe
  2⤵
  PID:10188
- C:\Windows\System\gsPIlyt.exe
  C:\Windows\System\gsPIlyt.exe
  2⤵
  PID:10220
- C:\Windows\System\uvgoHwi.exe
  C:\Windows\System\uvgoHwi.exe
  2⤵
  PID:10236
- C:\Windows\System\ksgOmre.exe
  C:\Windows\System\ksgOmre.exe
  2⤵
  PID:9300
- C:\Windows\System\ylDvsgr.exe
  C:\Windows\System\ylDvsgr.exe
  2⤵
  PID:9340
- C:\Windows\System\NbsKfxW.exe
  C:\Windows\System\NbsKfxW.exe
  2⤵
  PID:9400
- C:\Windows\System\VPDminq.exe
  C:\Windows\System\VPDminq.exe
  2⤵
  PID:9500
- C:\Windows\System\WnaExVD.exe
  C:\Windows\System\WnaExVD.exe
  2⤵
  PID:9560
- C:\Windows\System\VYeZffR.exe
  C:\Windows\System\VYeZffR.exe
  2⤵
  PID:9624
- C:\Windows\System\SaQoeEB.exe
  C:\Windows\System\SaQoeEB.exe
  2⤵
  PID:9672
- C:\Windows\System\dpNeryQ.exe
  C:\Windows\System\dpNeryQ.exe
  2⤵
  PID:9756
- C:\Windows\System\tuXPrZr.exe
  C:\Windows\System\tuXPrZr.exe
  2⤵
  PID:9812
- C:\Windows\System\FTymPCI.exe
  C:\Windows\System\FTymPCI.exe
  2⤵
  PID:1736
- C:\Windows\System\DveAvoy.exe
  C:\Windows\System\DveAvoy.exe
  2⤵
  PID:9944
- C:\Windows\System\oMarPHD.exe
  C:\Windows\System\oMarPHD.exe
  2⤵
  PID:10036
- C:\Windows\System\sJKxBub.exe
  C:\Windows\System\sJKxBub.exe
  2⤵
  PID:10072
- C:\Windows\System\bSXSpkY.exe
  C:\Windows\System\bSXSpkY.exe
  2⤵
  PID:10180
- C:\Windows\System\vtSqiNZ.exe
  C:\Windows\System\vtSqiNZ.exe
  2⤵
  PID:10212
- C:\Windows\System\yFlwKiw.exe
  C:\Windows\System\yFlwKiw.exe
  2⤵
  PID:9328
- C:\Windows\System\veAAsum.exe
  C:\Windows\System\veAAsum.exe
  2⤵
  PID:9484
- C:\Windows\System\cTJHxuC.exe
  C:\Windows\System\cTJHxuC.exe
  2⤵
  PID:9652
- C:\Windows\System\PzZOFLl.exe
  C:\Windows\System\PzZOFLl.exe
  2⤵
  PID:9804
- C:\Windows\System\rdjMrIR.exe
  C:\Windows\System\rdjMrIR.exe
  2⤵
  PID:9924
- C:\Windows\System\KPvDocW.exe
  C:\Windows\System\KPvDocW.exe
  2⤵
  PID:10048
- C:\Windows\System\YwAbfux.exe
  C:\Windows\System\YwAbfux.exe
  2⤵
  PID:9260
- C:\Windows\System\QTUAkGG.exe
  C:\Windows\System\QTUAkGG.exe
  2⤵
  PID:9616
- C:\Windows\System\txQNMkW.exe
  C:\Windows\System\txQNMkW.exe
  2⤵
  PID:9716
- C:\Windows\System\OlVOvUd.exe
  C:\Windows\System\OlVOvUd.exe
  2⤵
  PID:9396
- C:\Windows\System\iogIPHg.exe
  C:\Windows\System\iogIPHg.exe
  2⤵
  PID:10208
- C:\Windows\System\aQaDeXB.exe
  C:\Windows\System\aQaDeXB.exe
  2⤵
  PID:10244
- C:\Windows\System\LhQPgLs.exe
  C:\Windows\System\LhQPgLs.exe
  2⤵
  PID:10264
- C:\Windows\System\tpfWPTg.exe
  C:\Windows\System\tpfWPTg.exe
  2⤵
  PID:10300
- C:\Windows\System\AUGLmTV.exe
  C:\Windows\System\AUGLmTV.exe
  2⤵
  PID:10336
- C:\Windows\System\luzLtrN.exe
  C:\Windows\System\luzLtrN.exe
  2⤵
  PID:10380
- C:\Windows\System\PohyMQX.exe
  C:\Windows\System\PohyMQX.exe
  2⤵
  PID:10412
- C:\Windows\System\cXSOkyO.exe
  C:\Windows\System\cXSOkyO.exe
  2⤵
  PID:10456
- C:\Windows\System\wnINzEq.exe
  C:\Windows\System\wnINzEq.exe
  2⤵
  PID:10484
- C:\Windows\System\MhRkArS.exe
  C:\Windows\System\MhRkArS.exe
  2⤵
  PID:10512
- C:\Windows\System\UjVeXWK.exe
  C:\Windows\System\UjVeXWK.exe
  2⤵
  PID:10528
- C:\Windows\System\XFAfVOk.exe
  C:\Windows\System\XFAfVOk.exe
  2⤵
  PID:10556
- C:\Windows\System\hfcDFbA.exe
  C:\Windows\System\hfcDFbA.exe
  2⤵
  PID:10588
- C:\Windows\System\JwIGOfP.exe
  C:\Windows\System\JwIGOfP.exe
  2⤵
  PID:10624
- C:\Windows\System\mTAfxqo.exe
  C:\Windows\System\mTAfxqo.exe
  2⤵
  PID:10652
- C:\Windows\System\VMTwQyR.exe
  C:\Windows\System\VMTwQyR.exe
  2⤵
  PID:10680
- C:\Windows\System\NpDEAqR.exe
  C:\Windows\System\NpDEAqR.exe
  2⤵
  PID:10716
- C:\Windows\System\gRILvyV.exe
  C:\Windows\System\gRILvyV.exe
  2⤵
  PID:10744
- C:\Windows\System\oUzWkUi.exe
  C:\Windows\System\oUzWkUi.exe
  2⤵
  PID:10772
- C:\Windows\System\FiiKqSj.exe
  C:\Windows\System\FiiKqSj.exe
  2⤵
  PID:10800
- C:\Windows\System\XsXLdds.exe
  C:\Windows\System\XsXLdds.exe
  2⤵
  PID:10828
- C:\Windows\System\kOTXmvY.exe
  C:\Windows\System\kOTXmvY.exe
  2⤵
  PID:10856
- C:\Windows\System\iZVnTJF.exe
  C:\Windows\System\iZVnTJF.exe
  2⤵
  PID:10884
- C:\Windows\System\AXoVEOj.exe
  C:\Windows\System\AXoVEOj.exe
  2⤵
  PID:10912
- C:\Windows\System\ZAotLUD.exe
  C:\Windows\System\ZAotLUD.exe
  2⤵
  PID:10940
- C:\Windows\System\USUiZEG.exe
  C:\Windows\System\USUiZEG.exe
  2⤵
  PID:10976
- C:\Windows\System\yADjBWp.exe
  C:\Windows\System\yADjBWp.exe
  2⤵
  PID:10992
- C:\Windows\System\xQbLpPf.exe
  C:\Windows\System\xQbLpPf.exe
  2⤵
  PID:11020
- C:\Windows\System\xiZczcx.exe
  C:\Windows\System\xiZczcx.exe
  2⤵
  PID:11040
- C:\Windows\System\uJEdzjC.exe
  C:\Windows\System\uJEdzjC.exe
  2⤵
  PID:11076
- C:\Windows\System\GPNXOEW.exe
  C:\Windows\System\GPNXOEW.exe
  2⤵
  PID:11108
- C:\Windows\System\yRqFjiq.exe
  C:\Windows\System\yRqFjiq.exe
  2⤵
  PID:11140
- C:\Windows\System\bNKjSNk.exe
  C:\Windows\System\bNKjSNk.exe
  2⤵
  PID:11176
- C:\Windows\System\PLzWGkd.exe
  C:\Windows\System\PLzWGkd.exe
  2⤵
  PID:11224
- C:\Windows\System\MQpkTuo.exe
  C:\Windows\System\MQpkTuo.exe
  2⤵
  PID:11252
- C:\Windows\System\ABcuVIQ.exe
  C:\Windows\System\ABcuVIQ.exe
  2⤵
  PID:10252
- C:\Windows\System\CzCItJH.exe
  C:\Windows\System\CzCItJH.exe
  2⤵
  PID:10280
- C:\Windows\System\MnkdAdt.exe
  C:\Windows\System\MnkdAdt.exe
  2⤵
  PID:10364
- C:\Windows\System\UjfLzcw.exe
  C:\Windows\System\UjfLzcw.exe
  2⤵
  PID:10444
- C:\Windows\System\bSqweFl.exe
  C:\Windows\System\bSqweFl.exe
  2⤵
  PID:10520
- C:\Windows\System\eZWgaRo.exe
  C:\Windows\System\eZWgaRo.exe
  2⤵
  PID:10608
- C:\Windows\System\TvxJmIi.exe
  C:\Windows\System\TvxJmIi.exe
  2⤵
  PID:10664
- C:\Windows\System\SExDhVd.exe
  C:\Windows\System\SExDhVd.exe
  2⤵
  PID:10728
- C:\Windows\System\XnyxhFe.exe
  C:\Windows\System\XnyxhFe.exe
  2⤵
  PID:10768
- C:\Windows\System\xVOSgUH.exe
  C:\Windows\System\xVOSgUH.exe
  2⤵
  PID:10844
- C:\Windows\System\YZblbLd.exe
  C:\Windows\System\YZblbLd.exe
  2⤵
  PID:10928
- C:\Windows\System\YBWZEqj.exe
  C:\Windows\System\YBWZEqj.exe
  2⤵
  PID:10988
- C:\Windows\System\VouKVrN.exe
  C:\Windows\System\VouKVrN.exe
  2⤵
  PID:11052
- C:\Windows\System\FTncNch.exe
  C:\Windows\System\FTncNch.exe
  2⤵
  PID:11132
- C:\Windows\System\xzoDWam.exe
  C:\Windows\System\xzoDWam.exe
  2⤵
  PID:3692
- C:\Windows\System\LxVlUAW.exe
  C:\Windows\System\LxVlUAW.exe
  2⤵
  PID:11216
- C:\Windows\System\PJZiLZH.exe
  C:\Windows\System\PJZiLZH.exe
  2⤵
  PID:9900
- C:\Windows\System\YSHtbER.exe
  C:\Windows\System\YSHtbER.exe
  2⤵
  PID:10332
- C:\Windows\System\wnXEpFy.exe
  C:\Windows\System\wnXEpFy.exe
  2⤵
  PID:10544
- C:\Windows\System\UlXGORF.exe
  C:\Windows\System\UlXGORF.exe
  2⤵
  PID:10708
- C:\Windows\System\ezxasQA.exe
  C:\Windows\System\ezxasQA.exe
  2⤵
  PID:10824
- C:\Windows\System\UvfrLag.exe
  C:\Windows\System\UvfrLag.exe
  2⤵
  PID:5048
- C:\Windows\System\rGgGcjk.exe
  C:\Windows\System\rGgGcjk.exe
  2⤵
  PID:3936
- C:\Windows\System\SCzgheC.exe
  C:\Windows\System\SCzgheC.exe
  2⤵
  PID:11240
- C:\Windows\System\BUgntTm.exe
  C:\Windows\System\BUgntTm.exe
  2⤵
  PID:10420
- C:\Windows\System\pRYDGJA.exe
  C:\Windows\System\pRYDGJA.exe
  2⤵
  PID:4624
- C:\Windows\System\GfZiVUF.exe
  C:\Windows\System\GfZiVUF.exe
  2⤵
  PID:11072
- C:\Windows\System\oMERFGU.exe
  C:\Windows\System\oMERFGU.exe
  2⤵
  PID:11244
- C:\Windows\System\ECwqaew.exe
  C:\Windows\System\ECwqaew.exe
  2⤵
  PID:10668
- C:\Windows\System\CBxxzsi.exe
  C:\Windows\System\CBxxzsi.exe
  2⤵
  PID:11280
- C:\Windows\System\hPRFPWy.exe
  C:\Windows\System\hPRFPWy.exe
  2⤵
  PID:11308
- C:\Windows\System\iOMyPiQ.exe
  C:\Windows\System\iOMyPiQ.exe
  2⤵
  PID:11336
- C:\Windows\System\KvDvbTK.exe
  C:\Windows\System\KvDvbTK.exe
  2⤵
  PID:11364
- C:\Windows\System\jVMFvDk.exe
  C:\Windows\System\jVMFvDk.exe
  2⤵
  PID:11392
- C:\Windows\System\FVJcYyb.exe
  C:\Windows\System\FVJcYyb.exe
  2⤵
  PID:11420
- C:\Windows\System\jLQEbni.exe
  C:\Windows\System\jLQEbni.exe
  2⤵
  PID:11448
- C:\Windows\System\MbMCLXh.exe
  C:\Windows\System\MbMCLXh.exe
  2⤵
  PID:11476
- C:\Windows\System\eRflIZZ.exe
  C:\Windows\System\eRflIZZ.exe
  2⤵
  PID:11508
- C:\Windows\System\ORYEtHa.exe
  C:\Windows\System\ORYEtHa.exe
  2⤵
  PID:11536
- C:\Windows\System\fHQbylk.exe
  C:\Windows\System\fHQbylk.exe
  2⤵
  PID:11564
- C:\Windows\System\wZrlCnW.exe
  C:\Windows\System\wZrlCnW.exe
  2⤵
  PID:11592
- C:\Windows\System\dtbzwvC.exe
  C:\Windows\System\dtbzwvC.exe
  2⤵
  PID:11620
- C:\Windows\System\AUZawoP.exe
  C:\Windows\System\AUZawoP.exe
  2⤵
  PID:11648
- C:\Windows\System\CDQuPAu.exe
  C:\Windows\System\CDQuPAu.exe
  2⤵
  PID:11676
- C:\Windows\System\RGQPmsF.exe
  C:\Windows\System\RGQPmsF.exe
  2⤵
  PID:11708
- C:\Windows\System\gySyvZt.exe
  C:\Windows\System\gySyvZt.exe
  2⤵
  PID:11736
- C:\Windows\System\osuUxce.exe
  C:\Windows\System\osuUxce.exe
  2⤵
  PID:11764
- C:\Windows\System\HjZyrAl.exe
  C:\Windows\System\HjZyrAl.exe
  2⤵
  PID:11788
- C:\Windows\System\CNFtSFc.exe
  C:\Windows\System\CNFtSFc.exe
  2⤵
  PID:11824
- C:\Windows\System\GkYNPxz.exe
  C:\Windows\System\GkYNPxz.exe
  2⤵
  PID:11852
- C:\Windows\System\YDJZZsT.exe
  C:\Windows\System\YDJZZsT.exe
  2⤵
  PID:11880
- C:\Windows\System\OArbqnb.exe
  C:\Windows\System\OArbqnb.exe
  2⤵
  PID:11908
- C:\Windows\System\TdFBOQd.exe
  C:\Windows\System\TdFBOQd.exe
  2⤵
  PID:11940
- C:\Windows\System\PKfIIMh.exe
  C:\Windows\System\PKfIIMh.exe
  2⤵
  PID:11968
- C:\Windows\System\tRNPBGY.exe
  C:\Windows\System\tRNPBGY.exe
  2⤵
  PID:11996
- C:\Windows\System\chcPjEt.exe
  C:\Windows\System\chcPjEt.exe
  2⤵
  PID:12028
- C:\Windows\System\vydcIEq.exe
  C:\Windows\System\vydcIEq.exe
  2⤵
  PID:12056
- C:\Windows\System\bsIhLyk.exe
  C:\Windows\System\bsIhLyk.exe
  2⤵
  PID:12084
- C:\Windows\System\cnstyUV.exe
  C:\Windows\System\cnstyUV.exe
  2⤵
  PID:12112
- C:\Windows\System\QvPgfbX.exe
  C:\Windows\System\QvPgfbX.exe
  2⤵
  PID:12140
- C:\Windows\System\aquoGRH.exe
  C:\Windows\System\aquoGRH.exe
  2⤵
  PID:12168
- C:\Windows\System\TTZEaoN.exe
  C:\Windows\System\TTZEaoN.exe
  2⤵
  PID:12196
- C:\Windows\System\wIDYOrQ.exe
  C:\Windows\System\wIDYOrQ.exe
  2⤵
  PID:12224
- C:\Windows\System\dqklgck.exe
  C:\Windows\System\dqklgck.exe
  2⤵
  PID:12252
- C:\Windows\System\LBsxoAX.exe
  C:\Windows\System\LBsxoAX.exe
  2⤵
  PID:12280
- C:\Windows\System\AEVqypN.exe
  C:\Windows\System\AEVqypN.exe
  2⤵
  PID:11300
- C:\Windows\System\KSgqaSb.exe
  C:\Windows\System\KSgqaSb.exe
  2⤵
  PID:11376
- C:\Windows\System\rgCkkPo.exe
  C:\Windows\System\rgCkkPo.exe
  2⤵
  PID:11440
- C:\Windows\System\IwDerRU.exe
  C:\Windows\System\IwDerRU.exe
  2⤵
  PID:11504
- C:\Windows\System\CFqbJSY.exe
  C:\Windows\System\CFqbJSY.exe
  2⤵
  PID:11556
- C:\Windows\System\ETaRrxl.exe
  C:\Windows\System\ETaRrxl.exe
  2⤵
  PID:11632
- C:\Windows\System\goekXwl.exe
  C:\Windows\System\goekXwl.exe
  2⤵
  PID:11672
- C:\Windows\System\BfiwXYT.exe
  C:\Windows\System\BfiwXYT.exe
  2⤵
  PID:11732
- C:\Windows\System\mhngEPh.exe
  C:\Windows\System\mhngEPh.exe
  2⤵
  PID:11836
- C:\Windows\System\YLPwbmt.exe
  C:\Windows\System\YLPwbmt.exe
  2⤵
  PID:11892
- C:\Windows\System\UGACbgo.exe
  C:\Windows\System\UGACbgo.exe
  2⤵
  PID:11964
- C:\Windows\System\UyEETRQ.exe
  C:\Windows\System\UyEETRQ.exe
  2⤵
  PID:12040
- C:\Windows\System\UxpbFMd.exe
  C:\Windows\System\UxpbFMd.exe
  2⤵
  PID:12096
- C:\Windows\System\GwKfvgA.exe
  C:\Windows\System\GwKfvgA.exe
  2⤵
  PID:12132
- C:\Windows\System\qZDSxbd.exe
  C:\Windows\System\qZDSxbd.exe
  2⤵
  PID:12212
- C:\Windows\System\GCUECYR.exe
  C:\Windows\System\GCUECYR.exe
  2⤵
  PID:11276
- C:\Windows\System\XWmPlhL.exe
  C:\Windows\System\XWmPlhL.exe
  2⤵
  PID:11404
- C:\Windows\System\LomWdHv.exe
  C:\Windows\System\LomWdHv.exe
  2⤵
  PID:11468
- C:\Windows\System\XWSaEPB.exe
  C:\Windows\System\XWSaEPB.exe
  2⤵
  PID:11696
- C:\Windows\System\yyswBQL.exe
  C:\Windows\System\yyswBQL.exe
  2⤵
  PID:11864
- C:\Windows\System\jbXNzRf.exe
  C:\Windows\System\jbXNzRf.exe
  2⤵
  PID:12020
- C:\Windows\System\gOfYAyV.exe
  C:\Windows\System\gOfYAyV.exe
  2⤵
  PID:12160
- C:\Windows\System\bjCITUA.exe
  C:\Windows\System\bjCITUA.exe
  2⤵
  PID:11328
- C:\Windows\System\vyUdpuU.exe
  C:\Windows\System\vyUdpuU.exe
  2⤵
  PID:11616
- C:\Windows\System\kobLsyP.exe
  C:\Windows\System\kobLsyP.exe
  2⤵
  PID:11952
- C:\Windows\System\gjdIVsU.exe
  C:\Windows\System\gjdIVsU.exe
  2⤵
  PID:11488
- C:\Windows\System\mMYADmY.exe
  C:\Windows\System\mMYADmY.exe
  2⤵
  PID:12108
- C:\Windows\System\WqyZdyz.exe
  C:\Windows\System\WqyZdyz.exe
  2⤵
  PID:12312
- C:\Windows\System\mkCUsAy.exe
  C:\Windows\System\mkCUsAy.exe
  2⤵
  PID:12336
- C:\Windows\System\MmZvngC.exe
  C:\Windows\System\MmZvngC.exe
  2⤵
  PID:12368
- C:\Windows\System\oJXeFio.exe
  C:\Windows\System\oJXeFio.exe
  2⤵
  PID:12384
- C:\Windows\System\SPAqUiG.exe
  C:\Windows\System\SPAqUiG.exe
  2⤵
  PID:12412
- C:\Windows\System\QNhKcHk.exe
  C:\Windows\System\QNhKcHk.exe
  2⤵
  PID:12440
- C:\Windows\System\CXWmLnb.exe
  C:\Windows\System\CXWmLnb.exe
  2⤵
  PID:12472
- C:\Windows\System\nyQwjST.exe
  C:\Windows\System\nyQwjST.exe
  2⤵
  PID:12496
- C:\Windows\System\amgatNZ.exe
  C:\Windows\System\amgatNZ.exe
  2⤵
  PID:12536
- C:\Windows\System\QsYzqhj.exe
  C:\Windows\System\QsYzqhj.exe
  2⤵
  PID:12564
- C:\Windows\System\TyMFemI.exe
  C:\Windows\System\TyMFemI.exe
  2⤵
  PID:12592
- C:\Windows\System\VrScNEG.exe
  C:\Windows\System\VrScNEG.exe
  2⤵
  PID:12620
- C:\Windows\System\tOBFowv.exe
  C:\Windows\System\tOBFowv.exe
  2⤵
  PID:12640
- C:\Windows\System\TPcOKEh.exe
  C:\Windows\System\TPcOKEh.exe
  2⤵
  PID:12664
- C:\Windows\System\kcBimuM.exe
  C:\Windows\System\kcBimuM.exe
  2⤵
  PID:12692
- C:\Windows\System\VJQsPkK.exe
  C:\Windows\System\VJQsPkK.exe
  2⤵
  PID:12732
- C:\Windows\System\SvXSorG.exe
  C:\Windows\System\SvXSorG.exe
  2⤵
  PID:12760
- C:\Windows\System\LgKaXfx.exe
  C:\Windows\System\LgKaXfx.exe
  2⤵
  PID:12776
- C:\Windows\System\rMFcRFK.exe
  C:\Windows\System\rMFcRFK.exe
  2⤵
  PID:12816
- C:\Windows\System\swrWtwY.exe
  C:\Windows\System\swrWtwY.exe
  2⤵
  PID:12844
- C:\Windows\System\aEUjgbn.exe
  C:\Windows\System\aEUjgbn.exe
  2⤵
  PID:12860
- C:\Windows\System\oLFkJbf.exe
  C:\Windows\System\oLFkJbf.exe
  2⤵
  PID:12900
- C:\Windows\System\ZwWMJqP.exe
  C:\Windows\System\ZwWMJqP.exe
  2⤵
  PID:12928
- C:\Windows\System\CnGuuMJ.exe
  C:\Windows\System\CnGuuMJ.exe
  2⤵
  PID:12956
- C:\Windows\System\djXhIaE.exe
  C:\Windows\System\djXhIaE.exe
  2⤵
  PID:12972
- C:\Windows\System\omCNHDS.exe
  C:\Windows\System\omCNHDS.exe
  2⤵
  PID:13004
- C:\Windows\System\htvKSSx.exe
  C:\Windows\System\htvKSSx.exe
  2⤵
  PID:13028
- C:\Windows\System\sqYTlfl.exe
  C:\Windows\System\sqYTlfl.exe
  2⤵
  PID:13068
- C:\Windows\System\dQwjkJf.exe
  C:\Windows\System\dQwjkJf.exe
  2⤵
  PID:13088
- C:\Windows\System\GxeHYpU.exe
  C:\Windows\System\GxeHYpU.exe
  2⤵
  PID:13120
- C:\Windows\System\UEvysjl.exe
  C:\Windows\System\UEvysjl.exe
  2⤵
  PID:13152
- C:\Windows\System\eAWoWdu.exe
  C:\Windows\System\eAWoWdu.exe
  2⤵
  PID:13180
- C:\Windows\System\ouNgVGU.exe
  C:\Windows\System\ouNgVGU.exe
  2⤵
  PID:13200
- C:\Windows\System\fLtAUux.exe
  C:\Windows\System\fLtAUux.exe
  2⤵
  PID:13224
- C:\Windows\System\xuPgpNt.exe
  C:\Windows\System\xuPgpNt.exe
  2⤵
  PID:13264
- C:\Windows\System\zXGXYKd.exe
  C:\Windows\System\zXGXYKd.exe
  2⤵
  PID:13292
- C:\Windows\System\JPhHgbk.exe
  C:\Windows\System\JPhHgbk.exe
  2⤵
  PID:12292
- C:\Windows\System\IcjfPmj.exe
  C:\Windows\System\IcjfPmj.exe
  2⤵
  PID:12328
- C:\Windows\System\KnCHdDU.exe
  C:\Windows\System\KnCHdDU.exe
  2⤵
  PID:12404
- C:\Windows\System\lhGgzBD.exe
  C:\Windows\System\lhGgzBD.exe
  2⤵
  PID:12428
- C:\Windows\System\elLoWxw.exe
  C:\Windows\System\elLoWxw.exe
  2⤵
  PID:12520
- C:\Windows\System\NbHVzBH.exe
  C:\Windows\System\NbHVzBH.exe
  2⤵
  PID:12604
- C:\Windows\System\NVooSZX.exe
  C:\Windows\System\NVooSZX.exe
  2⤵
  PID:12676
- C:\Windows\System\QAZtKly.exe
  C:\Windows\System\QAZtKly.exe
  2⤵
  PID:12728
- C:\Windows\System\ehQFayX.exe
  C:\Windows\System\ehQFayX.exe
  2⤵
  PID:12808
- C:\Windows\System\RAsWsuc.exe
  C:\Windows\System\RAsWsuc.exe
  2⤵
  PID:12856
- C:\Windows\System\NMbmDye.exe
  C:\Windows\System\NMbmDye.exe
  2⤵
  PID:12940
- C:\Windows\System\vEbZvGI.exe
  C:\Windows\System\vEbZvGI.exe
  2⤵
  PID:13000
- C:\Windows\System\YalLtpk.exe
  C:\Windows\System\YalLtpk.exe
  2⤵
  PID:13056
- C:\Windows\System\XHPQqMM.exe
  C:\Windows\System\XHPQqMM.exe
  2⤵
  PID:13128
- C:\Windows\System\GTGyyYJ.exe
  C:\Windows\System\GTGyyYJ.exe
  2⤵
  PID:13148
- C:\Windows\System\UQcwBCd.exe
  C:\Windows\System\UQcwBCd.exe
  2⤵
  PID:13220
- C:\Windows\System\QIsJnya.exe
  C:\Windows\System\QIsJnya.exe
  2⤵
  PID:13304
- C:\Windows\System\TEcaLch.exe
  C:\Windows\System\TEcaLch.exe
  2⤵
  PID:12424
- C:\Windows\System\nhAVUqh.exe
  C:\Windows\System\nhAVUqh.exe
  2⤵
  PID:12636
- C:\Windows\System\McRMgkz.exe
  C:\Windows\System\McRMgkz.exe
  2⤵
  PID:12716
- C:\Windows\System\EVaLQdO.exe
  C:\Windows\System\EVaLQdO.exe
  2⤵
  PID:12832
- C:\Windows\System\edKJNsm.exe
  C:\Windows\System\edKJNsm.exe
  2⤵
  PID:12984
- C:\Windows\System\oiswGEm.exe
  C:\Windows\System\oiswGEm.exe
  2⤵
  PID:13108
- C:\Windows\System\ujLEMkr.exe
  C:\Windows\System\ujLEMkr.exe
  2⤵
  PID:13236
- C:\Windows\System\RheeKkd.exe
  C:\Windows\System\RheeKkd.exe
  2⤵
  PID:12244
- C:\Windows\System\onIvWcP.exe
  C:\Windows\System\onIvWcP.exe
  2⤵
  PID:12704
- C:\Windows\System\pSPWBtB.exe
  C:\Windows\System\pSPWBtB.exe
  2⤵
  PID:13096
- C:\Windows\System\AaVAbCy.exe
  C:\Windows\System\AaVAbCy.exe
  2⤵
  PID:13248
- C:\Windows\System\DqCZXDG.exe
  C:\Windows\System\DqCZXDG.exe
  2⤵
  PID:13328
- C:\Windows\System\eccNTwZ.exe
  C:\Windows\System\eccNTwZ.exe
  2⤵
  PID:13352
- C:\Windows\System\bztqEVV.exe
  C:\Windows\System\bztqEVV.exe
  2⤵
  PID:13384
- C:\Windows\System\zIkuvEd.exe
  C:\Windows\System\zIkuvEd.exe
  2⤵
  PID:13424
- C:\Windows\System\GrpvMxR.exe
  C:\Windows\System\GrpvMxR.exe
  2⤵
  PID:13448
- C:\Windows\System\bNUEtFY.exe
  C:\Windows\System\bNUEtFY.exe
  2⤵
  PID:13476
- C:\Windows\System\MfuXZyX.exe
  C:\Windows\System\MfuXZyX.exe
  2⤵
  PID:13504
- C:\Windows\System\vaILhEX.exe
  C:\Windows\System\vaILhEX.exe
  2⤵
  PID:13532
- C:\Windows\System\UsEduHx.exe
  C:\Windows\System\UsEduHx.exe
  2⤵
  PID:13604
- C:\Windows\System\PKnpHNF.exe
  C:\Windows\System\PKnpHNF.exe
  2⤵
  PID:13620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:8
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ncl5ddbk.y2t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AhEtsuB.exe

Filesize
3.3MB

MD5
105019a25cfcbcd103fd07261daa37cb

SHA1
8f3b0fdf3f939861478d5933ea4efbc26c42c1a9

SHA256
82689226a70018d1bf44c96043ec6f04d335edba8ed350885f43c7fb137f9242

SHA512
960013b3833995b0514a30dada5716bb20de88100e8f5a855250685b607013fb32c6ba05436c1a715b42517095b95aecd9bbc33a1718d9686a95570f94afc320

Download Submit
C:\Windows\System\EHPIqkm.exe

Filesize
3.3MB

MD5
d3822d0aad4c4c5bad497e3d21c1a4b7

SHA1
604d83dfa831c02dbe95da7172f3d310f3aee841

SHA256
f9cbb49fbf89d4fe83d1296abfef68350e293e5e92cf718e8c1717677c9b2cdf

SHA512
08dec8c6527c73f0e3d8316370970f0dfe7178ec81a26225d4d9a4a237f58c84dfbee7efa76ac7b89284ad632b8699201149d67ae5c12ed28e411b2222382a52

Download Submit
C:\Windows\System\EyewrsH.exe

Filesize
3.3MB

MD5
92ea2c0de412e1b8928540fe20002be8

SHA1
e5147930c10554818afed981ca41c3e9ce76facb

SHA256
267c53437423600ba2a3be5c4e5922c7d3f9b6f2dc9cd1ddc25dfe2448bb47b0

SHA512
4b31c097075455d4afa046ca055b3d4df881b03d5fada09a9f886cdedd4784cf0ee309baf074f0d2d9fd2e147d0a361af499acda897bb29fc3f597d318cb48d6

Download Submit
C:\Windows\System\HDcahMq.exe

Filesize
3.3MB

MD5
bd894b9ea1923b8a8731ebab0bf03904

SHA1
9915f231e742b4b21c38902f1169b4056cc02514

SHA256
07f8184960ad2fabaa976b10c7c4646351fdb467088273b98b50b2710700bb07

SHA512
f0813ed8f36e13641a56e8608813a735768058248686396243147c0a7574437b4a38a5da16a6da4fbaecf1f54f6a7b13c48e239ecc7d211cdd0f9e904682ec04

Download Submit
C:\Windows\System\IcrNTiQ.exe

Filesize
3.3MB

MD5
5c689d2c710b48f76c8792a620f15ca7

SHA1
b56747800c5f20a3e05659207a6477cefe7de893

SHA256
ee3f79d8a67dc4e985bad627dc3be45108f6358518845cc06a428cd3d4a3943e

SHA512
630494388fb5d381b75528fc82351592ee120c4fab1019dc6143943d5e9de90a54c91ae62844096af2035f0b351805890aaef932646ce4abcbe1020f6e5abce7

Download Submit
C:\Windows\System\JVXUQuD.exe

Filesize
3.3MB

MD5
8382f2db1705fb25a484c268acc9e6bb

SHA1
24d253ac88f179af436714f22328781f67752297

SHA256
60cf6dc57ff13c802424a54db1a352e21a86570a703b51f4ac8e09d5b649dad2

SHA512
b2e8f31da25a983d1f1654cd1d4c0ace408c0363b331c8ad45069a8ff4807127ba73e0635018e21c5e08ca0b08a15c5f5a1f58d9d6b403875125c0f29a39bc0c

Download Submit
C:\Windows\System\NIfbqCm.exe

Filesize
3.3MB

MD5
e42bc32d7ee938412784818d37604454

SHA1
e29e40234483bc92c5ca0a8dcbdf79d62b9296a7

SHA256
9182c0794848c0d2c2d766c238fe98de39eb228cea5093e7efa4220a76def236

SHA512
d284f4e20cec71713490c81e67af3b95390deb720f1a7b3842d40140507c01b857518bf15bc591e820c869e399a2cb868dd13d8d85d89b0a450c7ecfcd63e365

Download Submit
C:\Windows\System\PSSwQJr.exe

Filesize
3.3MB

MD5
1ce3bee4c012911a523048f64341c7d2

SHA1
3561fe993eba88f119cbb7f77a8387f0595b757d

SHA256
a96d25effae6e73d32d20ab51f38c5f0b44ee3265c1f5005a8f409dc92816d12

SHA512
e6c63c3dcde1d8a904e8b0dc167213fea14aec46661bdd2bfd3862fa1f60c95e798afaa4c897f3fa41844334c4c974c6208413e4d3613ce8f9abbd397a8b5200

Download Submit
C:\Windows\System\QTxgcLI.exe

Filesize
3.3MB

MD5
d3e9975288ed201d479938ed0dbf0831

SHA1
afa9491034fc20fa752aaf7ef3a21d8bccc418d4

SHA256
e27cc2274624057549dbfaa64a4c51059a291fd7cd530db597dfc0c3c9abef90

SHA512
8f779c3bdc93ee5d016a3e7ff1144c10889aa1c769ab754087d4d9494cb8530335b710aa44041aa30f3fb9e4f43772c914719d436508fe7e4ce685cc5e351ab1

Download Submit
C:\Windows\System\QYabtfp.exe

Filesize
3.3MB

MD5
a8e276ffdb6c64e8581d2ec44a3be8dd

SHA1
afa4d497739795a403142ee7a8650e0b767243af

SHA256
6b9711744dbd8fbec08dcbbcbf24621dae9bdfb388c6a5a2fddc5d927032c0e5

SHA512
c8c1ca70ded247315d18e01afd1faa0937e08d543812084ce91754fceaf1315a56bad2727f7cdb1fed871a607eb7d4a6108ec774d1c03b1f88dab39bc7ef15fa

Download Submit
C:\Windows\System\QpbRSNC.exe

Filesize
3.3MB

MD5
bc645a90e1d8089ceeb754fb0192b9fd

SHA1
9e4734703e0a6d8f6bb9e5c5f539d3dc08f82f0e

SHA256
90bb8211c97f2cd9671ecfbf9b88da20eae90f06103cae54580ebcd8b758d86a

SHA512
7c790dbb89b985e66c1e8555bdc63b760ea5fd3738b9b2cd7cdf654300df9bd05b7f58db55b1739059cf46c75f1c7c0930296e415d575b631106a0b051ea5d84

Download Submit
C:\Windows\System\RHoqthP.exe

Filesize
3.3MB

MD5
fa51a7fb524faf0317798a0c2e9d009d

SHA1
a7f94b2cfbef21473688285658f15cfc2d2de47f

SHA256
7791c71a50e1fb762062d936707cc0c04c3389e2b27346722744f021f4e807d3

SHA512
ca4199819d3976d64584ee8b73901b71fb7c5a28bd3b47385416c969d60539255fae67eeb71a8d0428a2c2e9fd24505aca120c62a1e6bf995077bc45ebe275be

Download Submit
C:\Windows\System\TAWDZZR.exe

Filesize
3.3MB

MD5
6d52c9270c1fe49990a63d649f2110e4

SHA1
0abac61be6fa2a89a591351f1fc5514ea6261278

SHA256
b3a08c339a15b01d6bda2e0253923b04596ea895e8f1a67010c9f1755f5a1981

SHA512
0ef75a9242e6fb271268f0cbef0443ad8601e05ad72e65ed54034d047ca53e1dc107db3641da666eb999c834ab5d8c118d3d9ba78bce4ac6672cccd6bb7d413d

Download Submit
C:\Windows\System\Tejcgnh.exe

Filesize
3.3MB

MD5
66aa828cf011eb0aaf1114ebdd4bfb85

SHA1
72be84084d616390097b024e0560d044a5356d9a

SHA256
a9960e7bec48f19eca18992f4fc47aa97a57c509888c91f739d3408dad65ca29

SHA512
d1bd68eadcc15396a196e5332dbfc7da8b05f14d18673fd7aedb01470f654c65176807e5605494941c401b4582e2314239ce1545de40e6d2b3debffc07bab79c

Download Submit
C:\Windows\System\TwKzyGI.exe

Filesize
3.3MB

MD5
184d747d5f1fe13a38b366a9e8355e4b

SHA1
0c5060b33505642c2323814b85159113d53406b6

SHA256
c3d6e255d282cb966b79f58c369f44666088bbad46e6603c1545c254c0395167

SHA512
e69a6448b576b3a761654470b3fdf61e4e0d75debbc6794f23a006dbb27b6fe3b53f8cf0ce943af14fab883e39b3c75ee0670da80bcd988e28cac69908837b02

Download Submit
C:\Windows\System\UKxKmsk.exe

Filesize
3.3MB

MD5
e69d18517018e6d9582c8c72d33e7998

SHA1
68bf9499991fd51a3343ad099de1f2e2f5f72330

SHA256
afa3ce655400a3449aebae9195bdc88420991df03a4ae2fd1e67bb8138a5053d

SHA512
b004da36358ac6ada8265f82643bbb789e43c1eac882bedf8b71a6521c5195d6c4dc2d34681a6b7fdbb2a7270a45ec55cd8af7f1989272296067e3c912c30f02

Download Submit
C:\Windows\System\VbOQmBG.exe

Filesize
3.3MB

MD5
2258ef36d371270986f2c815cb2e6db9

SHA1
8270e1496ca6e7bf359bf5c434178f6038c63d96

SHA256
f62d386d1f270ed3dea6a51a1be5ac5e648da79aa58076e3b164a53388faca4e

SHA512
ce4257dc0e43c2989b76f0472a187deddc9dbaf4a5f8c5941f7d0f97442ed0021f2cb26402b1aea21425e71f89068092704d3728f3c9a77176bd1566079f8d0f

Download Submit
C:\Windows\System\WmnmbuD.exe

Filesize
3.3MB

MD5
1125434640ffb0e1e74926fb0ed1ee2b

SHA1
365b5044954deac32dd733c5f30b63aa4fcc0280

SHA256
8a4d72becba63cbc2d46b1c54adb94c3ad7c7ef9e534ce048b7296b0a8210380

SHA512
5851ff775bf5cefa688e055c4fe632a5f56f85da67cde6cddae4725c9161c795536f2873de12e0b91bc598599c389c35896e6415a507d9f2ca90bed580c887fb

Download Submit
C:\Windows\System\WniFBRj.exe

Filesize
3.3MB

MD5
8809db4db734478a68263613706d8307

SHA1
8ad8876458ec5619b895ac93a0d083e296375b84

SHA256
a662e1e31de50ce0e92e032aee0ee8469a612eef89bba2787c1d8e17208f6c6a

SHA512
00b682fd6da96498521684d0f033f7d2978fa69bd8166a1dae347f73dfb98b5a9e230d8808061f304afbe75d8add61d6579c2a91c52bfd1ff2d81c25c08a17e3

Download Submit
C:\Windows\System\aGnPsMV.exe

Filesize
3.3MB

MD5
975d15c926c5fa12409cc6c9deaa3dc0

SHA1
fc20eb620dad5fb6eec4a4ab57fa5f2a2765b169

SHA256
2f6bef7322a17cb0caeeae9adca1d995417e82c5e51f07874b20646d7a8d3f2b

SHA512
a8268d55426e0ab860f3ad595903dbabc135f3f13a3e28dd4a9e681f2ed72c4394a77483e565994c4cb6f97f782a6f68f7fc67f7e9811a02a81641616796180b

Download Submit
C:\Windows\System\bIWDVVW.exe

Filesize
3.3MB

MD5
24feafcc1520624a5f6905e3c75f3ac8

SHA1
f1edfeb4b097f731198e645a9d7a787c1e75f4bb

SHA256
320481acc586af1cc9818efea42f35862af118916c2d6ebfcc213ee0ca11f028

SHA512
1266f3929609b7e3ba1a8ad9555006167881ffeb558495a0f10b9144a379516289a76c2a72f10dfe50ced6db19380c0d1faa74b16d3be62204d921fc744f2dcd

Download Submit
C:\Windows\System\bImNWef.exe

Filesize
3.3MB

MD5
e9443837d52bb9e4087e94fcab8e6f90

SHA1
e2ca54fac4acdd063413bec5b5e078a6ea98bfde

SHA256
c3bfa42a4b4cf0682e374025868b6b59027854ea03ed02ad892fd180094a9b41

SHA512
43aa2d11213e2386c3952c700ab17698068e8fd3209d7f974add469b7cc395b4500e7cf7319108c45f5412e6b537c6fe88977fed5ee1a2fa3b506be1f41407b8

Download Submit
C:\Windows\System\bcsoxQZ.exe

Filesize
8B

MD5
5c26b2530215958bf09618431b100cda

SHA1
827eea0f4ea30baef57d8cd89d4099c9255e450e

SHA256
6d3a76086e2142b485f39fd96ed903cea41e83c3b71c6fe0bf00f2155647b1d3

SHA512
b5bcf3d259e1b6f5d3e490a738db7ec66ba7885095a81789a85e89c3ecbb23d5f4fdc2bc5c51e5589900614a9f15c0b14fde8dcd397922cfa873121a61f4f9b6

Download Submit
C:\Windows\System\cxTKuyg.exe

Filesize
3.3MB

MD5
8a478c466cea6118a92781fc9ba8678c

SHA1
75dcdddc4c9c820b7175af3c04edfbe838e95271

SHA256
f90dd480b52af44cb5fe453b127886df62e572da0525e4e5fc9ec2891fd8b983

SHA512
5d4371ac6306a8a5fcce7f94d42a977e2529de5970608db3f601024f2d9dbb50b12bea79187422f990cfb7638fdfebb0d7d69d983a4e70fdce333118d2a870bf

Download Submit
C:\Windows\System\dtjrXJB.exe

Filesize
3.3MB

MD5
433fd7d7014408d7fa1e49236b22439d

SHA1
61a7ac317b75b46061ff633dd023f8844fa21b05

SHA256
8180839f28570a7bbcc5ec824157d00bc1490645ec4dad8ac39ceb521e154b5d

SHA512
e93aa169e442a87af7dc90da2f4b57e7ec3cc988c72fe72496d592d7df9098ac8f2da89ba2f92ba0c752334db751587b99a40e05cf0c2bc4b4a239437412c88b

Download Submit
C:\Windows\System\ecuLXJl.exe

Filesize
3.3MB

MD5
3d575ad38e023df4fd07ca8bc08e3a4c

SHA1
323cffd3e33cb51fbeb6fb3f2dceb275df1869a7

SHA256
1beb0ec0249f77fb120b83eb02a2d2d0b5b4eca181555012af6392b5d0f1ef1d

SHA512
619ad53fc82d919e46099f4eee3a8f7bb8a79cc2afcf48b0c680f3ac570e37f6cb28ab4a9a52285b0a9d7e6a4d64bcac780d6aff9b4c9bfcdec66663c5501293

Download Submit
C:\Windows\System\hngEZSL.exe

Filesize
3.3MB

MD5
aabb1465603ffa7b3e4d120f4949295d

SHA1
5ba4004a360d204a5cf5439535ce571632a2dcd7

SHA256
abfaf58bb64ebd7af99ebb0275f5ce01058a66ee80f660a31d287dde431037a0

SHA512
4d280b176cbeb9d5e5faed3b3dcf4ee0404faa1019eafadd3473d421622d9a5734ebf6d9fc5777d474a61a0bdbb74e084484bf9b71065ec9caf23eb6f2b9720a

Download Submit
C:\Windows\System\hwYDiKK.exe

Filesize
3.3MB

MD5
70b176294237739ce612fd9174d38c9e

SHA1
dd3522c83e9b954261df64dfb5e682ebb5ad2f99

SHA256
308617c368cc98bf512724560e3e9c05dd2dfa958597ef5ce9c801885ae69312

SHA512
a9f5997b824b07fda19f7d24c4b87224751ebbd34dd1b9674b7ccf96419a26773e7f951fe45eb830daf9c35ea8fd9901998678eead1cd5c355f96f7395e1dd26

Download Submit
C:\Windows\System\mZxuiYg.exe

Filesize
3.3MB

MD5
248088f5b6795c6fdcbd3c35ffddcf74

SHA1
89b1ac7e7d82e80157268b90cc9c0c25c930bd96

SHA256
8680a171bf5def3cc41653716a8f41e6a724a074ce69ce39f21c0fd9e5af7f9b

SHA512
5370946a8695769c3c8cc097c00a125b0e602a82c9eafff417a571950870e28979ed77cdd099a7f6aa2cbd367e683885e06f5e13c2ce3928618bfab2fb8f45a0

Download Submit
C:\Windows\System\oZLnszH.exe

Filesize
3.3MB

MD5
e14d7452b4018d7b8af25fd802b57d4a

SHA1
719da8ebf43074043f060e720f7a18ab5ca00669

SHA256
a9eb36d7318b1a6ca649ea0b5640db61737b0159d46a9af8aa5fde814cfa1f38

SHA512
84d0c38fe6ac61579cf4590fa9997793f275be7f52fc3d2e4a6595390162087b6f4ecb28e83fb37f4b67fea9e8d771e460b6702447178d9d0816b9fe821467c4

Download Submit
C:\Windows\System\qgdMsmk.exe

Filesize
3.3MB

MD5
81d49e8cf4164fc52e7f6779c13d43f8

SHA1
4d475cd47bce3e6e93970f979872e4ac98693049

SHA256
12e71342a6b356f374d85075f41201702c95a62e326b3db3b070bf4e7f283a1d

SHA512
be3d192f0cf9800d63636982cce32f5345cfe32c591321e34e88c00c5f0cbf481330a8146587b03cf74762436c31598683b77089e66002e6bd21431b74358db1

Download Submit
C:\Windows\System\sdxutbc.exe

Filesize
3.3MB

MD5
c5b047e965685dd439a6b7e871499277

SHA1
41ee7b0ae06d5cf1d058876fd2c46658e2ee8df1

SHA256
16a487574f2ea8745b426e606ff9d604756886a41fb89f6a8e8284482f2ec911

SHA512
47549ce759199093e45f5465c13a83ec930b6c004280a22505e322407ad01ba929abbf33d2bbde644a7be78f0cab25da8b8d9ea098ef8e09b0bb0364c5fad609

Download Submit
C:\Windows\System\ywYtliH.exe

Filesize
3.3MB

MD5
57e531cc377c4e85dab5e7866226c031

SHA1
27c158136b0270abea96d43d87d0aab108086e7d

SHA256
1c56aacab211dbf18f3ec8075ab9217f7c38e15c8bcd60f91d28c72a66b9498d

SHA512
a4aa85a4358b97e4806802588489e22fb33dda7916c4db952af958ce61711aeee349b974d3e57d6a7e4459c6a59a2e63e6ac7edbff1c1c68359290f771776731

Download Submit
memory/1060-138-0x00007FF67AF80000-0x00007FF67B376000-memory.dmp

Filesize
4.0MB

Download
memory/1060-2309-0x00007FF67AF80000-0x00007FF67B376000-memory.dmp

Filesize
4.0MB

Download
memory/1152-943-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp

Filesize
4.0MB

Download
memory/1152-25-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp

Filesize
4.0MB

Download
memory/1152-2302-0x00007FF6AAF20000-0x00007FF6AB316000-memory.dmp

Filesize
4.0MB

Download
memory/1248-2313-0x00007FF749380000-0x00007FF749776000-memory.dmp

Filesize
4.0MB

Download
memory/1248-135-0x00007FF749380000-0x00007FF749776000-memory.dmp

Filesize
4.0MB

Download
memory/1432-2308-0x00007FF74D460000-0x00007FF74D856000-memory.dmp

Filesize
4.0MB

Download
memory/1432-100-0x00007FF74D460000-0x00007FF74D856000-memory.dmp

Filesize
4.0MB

Download
memory/2220-142-0x00007FF718160000-0x00007FF718556000-memory.dmp

Filesize
4.0MB

Download
memory/2220-2307-0x00007FF718160000-0x00007FF718556000-memory.dmp

Filesize
4.0MB

Download
memory/2500-133-0x00007FF75F070000-0x00007FF75F466000-memory.dmp

Filesize
4.0MB

Download
memory/2500-2315-0x00007FF75F070000-0x00007FF75F466000-memory.dmp

Filesize
4.0MB

Download
memory/2592-144-0x00007FF7B5240000-0x00007FF7B5636000-memory.dmp

Filesize
4.0MB

Download
memory/2592-2318-0x00007FF7B5240000-0x00007FF7B5636000-memory.dmp

Filesize
4.0MB

Download
memory/2644-140-0x00007FF7DE000000-0x00007FF7DE3F6000-memory.dmp

Filesize
4.0MB

Download
memory/2644-2321-0x00007FF7DE000000-0x00007FF7DE3F6000-memory.dmp

Filesize
4.0MB

Download
memory/2868-2323-0x00007FF696A10000-0x00007FF696E06000-memory.dmp

Filesize
4.0MB

Download
memory/2868-123-0x00007FF696A10000-0x00007FF696E06000-memory.dmp

Filesize
4.0MB

Download
memory/2976-2310-0x00007FF7B4C00000-0x00007FF7B4FF6000-memory.dmp

Filesize
4.0MB

Download
memory/2976-146-0x00007FF7B4C00000-0x00007FF7B4FF6000-memory.dmp

Filesize
4.0MB

Download
memory/3324-143-0x00007FF6430A0000-0x00007FF643496000-memory.dmp

Filesize
4.0MB

Download
memory/3324-2320-0x00007FF6430A0000-0x00007FF643496000-memory.dmp

Filesize
4.0MB

Download
memory/3344-77-0x00007FF7BA200000-0x00007FF7BA5F6000-memory.dmp

Filesize
4.0MB

Download
memory/3344-2305-0x00007FF7BA200000-0x00007FF7BA5F6000-memory.dmp

Filesize
4.0MB

Download
memory/4032-2312-0x00007FF651320000-0x00007FF651716000-memory.dmp

Filesize
4.0MB

Download
memory/4032-136-0x00007FF651320000-0x00007FF651716000-memory.dmp

Filesize
4.0MB

Download
memory/4144-139-0x00007FF65A6E0000-0x00007FF65AAD6000-memory.dmp

Filesize
4.0MB

Download
memory/4144-2322-0x00007FF65A6E0000-0x00007FF65AAD6000-memory.dmp

Filesize
4.0MB

Download
memory/4396-124-0x00007FF697290000-0x00007FF697686000-memory.dmp

Filesize
4.0MB

Download
memory/4396-2324-0x00007FF697290000-0x00007FF697686000-memory.dmp

Filesize
4.0MB

Download
memory/4420-44-0x00007FF6E9330000-0x00007FF6E9726000-memory.dmp

Filesize
4.0MB

Download
memory/4420-2306-0x00007FF6E9330000-0x00007FF6E9726000-memory.dmp

Filesize
4.0MB

Download
memory/4572-948-0x00007FF68E420000-0x00007FF68E816000-memory.dmp

Filesize
4.0MB

Download
memory/4572-2304-0x00007FF68E420000-0x00007FF68E816000-memory.dmp

Filesize
4.0MB

Download
memory/4572-41-0x00007FF68E420000-0x00007FF68E816000-memory.dmp

Filesize
4.0MB

Download
memory/4696-110-0x00007FF72B3D0000-0x00007FF72B7C6000-memory.dmp

Filesize
4.0MB

Download
memory/4696-2317-0x00007FF72B3D0000-0x00007FF72B7C6000-memory.dmp

Filesize
4.0MB

Download
memory/4764-134-0x00007FF7A2360000-0x00007FF7A2756000-memory.dmp

Filesize
4.0MB

Download
memory/4764-2314-0x00007FF7A2360000-0x00007FF7A2756000-memory.dmp

Filesize
4.0MB

Download
memory/4776-2316-0x00007FF79F5B0000-0x00007FF79F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/4776-145-0x00007FF79F5B0000-0x00007FF79F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/4788-101-0x00007FF7D6440000-0x00007FF7D6836000-memory.dmp

Filesize
4.0MB

Download
memory/4788-2319-0x00007FF7D6440000-0x00007FF7D6836000-memory.dmp

Filesize
4.0MB

Download
memory/4836-2303-0x00007FF66A760000-0x00007FF66AB56000-memory.dmp

Filesize
4.0MB

Download
memory/4836-141-0x00007FF66A760000-0x00007FF66AB56000-memory.dmp

Filesize
4.0MB

Download
memory/4880-1-0x00000215853D0000-0x00000215853E0000-memory.dmp

Filesize
64KB

Download
memory/4880-861-0x00007FF78FF60000-0x00007FF790356000-memory.dmp

Filesize
4.0MB

Download
memory/4880-0-0x00007FF78FF60000-0x00007FF790356000-memory.dmp

Filesize
4.0MB

Download
memory/4908-157-0x000001CB3AA40000-0x000001CB3B1E6000-memory.dmp

Filesize
7.6MB

Download
memory/4908-156-0x000001CB37C60000-0x000001CB37C82000-memory.dmp

Filesize
136KB

Download
memory/4976-2301-0x00007FF6A05A0000-0x00007FF6A0996000-memory.dmp

Filesize
4.0MB

Download
memory/4976-12-0x00007FF6A05A0000-0x00007FF6A0996000-memory.dmp

Filesize
4.0MB

Download
memory/5044-137-0x00007FF7A01C0000-0x00007FF7A05B6000-memory.dmp

Filesize
4.0MB

Download
memory/5044-2311-0x00007FF7A01C0000-0x00007FF7A05B6000-memory.dmp

Filesize
4.0MB

Download