xmrig | e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037

Analysis

max time kernel
92s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/09/2024, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
Size

1.2MB
MD5

1dd97a21e2abc11f3989cfe34d6474af
SHA1

e56fee829e0b749bb2aabcc799c7fbe235c1b6ee
SHA256

e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037
SHA512

efc125ae313a7b6026317f22956332a46a7ba8e6709309409720f1950cee6bc7864ddd125ccece26c5c54a9527bd981ec9a9bbb987ad110fd3f958ca4db30a07
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVAUNkJxzBMa:Lz071uv4BPMkHC0IaAzPSa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1080-12-0x00007FF632BE0000-0x00007FF632FD2000-memory.dmp	xmrig
behavioral2/memory/1672-75-0x00007FF638B30000-0x00007FF638F22000-memory.dmp	xmrig
behavioral2/memory/4992-89-0x00007FF6BE2F0000-0x00007FF6BE6E2000-memory.dmp	xmrig
behavioral2/memory/2720-118-0x00007FF7467A0000-0x00007FF746B92000-memory.dmp	xmrig
behavioral2/memory/3364-128-0x00007FF6093C0000-0x00007FF6097B2000-memory.dmp	xmrig
behavioral2/memory/4668-699-0x00007FF6DB440000-0x00007FF6DB832000-memory.dmp	xmrig
behavioral2/memory/1144-171-0x00007FF7EB970000-0x00007FF7EBD62000-memory.dmp	xmrig
behavioral2/memory/2660-165-0x00007FF6D1F50000-0x00007FF6D2342000-memory.dmp	xmrig
behavioral2/memory/4456-159-0x00007FF68BB10000-0x00007FF68BF02000-memory.dmp	xmrig
behavioral2/memory/1712-158-0x00007FF69EF40000-0x00007FF69F332000-memory.dmp	xmrig
behavioral2/memory/5064-152-0x00007FF785AB0000-0x00007FF785EA2000-memory.dmp	xmrig
behavioral2/memory/1936-146-0x00007FF79A070000-0x00007FF79A462000-memory.dmp	xmrig
behavioral2/memory/4016-140-0x00007FF63B240000-0x00007FF63B632000-memory.dmp	xmrig
behavioral2/memory/2144-134-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	xmrig
behavioral2/memory/4488-124-0x00007FF7D0600000-0x00007FF7D09F2000-memory.dmp	xmrig
behavioral2/memory/1516-113-0x00007FF6BF570000-0x00007FF6BF962000-memory.dmp	xmrig
behavioral2/memory/2820-109-0x00007FF6EED00000-0x00007FF6EF0F2000-memory.dmp	xmrig
behavioral2/memory/3632-108-0x00007FF6C5CB0000-0x00007FF6C60A2000-memory.dmp	xmrig
behavioral2/memory/2368-97-0x00007FF6EC330000-0x00007FF6EC722000-memory.dmp	xmrig
behavioral2/memory/744-90-0x00007FF62A710000-0x00007FF62AB02000-memory.dmp	xmrig
behavioral2/memory/2468-85-0x00007FF7108E0000-0x00007FF710CD2000-memory.dmp	xmrig
behavioral2/memory/2748-80-0x00007FF62E100000-0x00007FF62E4F2000-memory.dmp	xmrig
behavioral2/memory/5012-79-0x00007FF7A6890000-0x00007FF7A6C82000-memory.dmp	xmrig
behavioral2/memory/3256-63-0x00007FF75AB50000-0x00007FF75AF42000-memory.dmp	xmrig
behavioral2/memory/4176-1054-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp	xmrig
behavioral2/memory/1080-2382-0x00007FF632BE0000-0x00007FF632FD2000-memory.dmp	xmrig
behavioral2/memory/1672-2384-0x00007FF638B30000-0x00007FF638F22000-memory.dmp	xmrig
behavioral2/memory/3632-2386-0x00007FF6C5CB0000-0x00007FF6C60A2000-memory.dmp	xmrig
behavioral2/memory/5012-2388-0x00007FF7A6890000-0x00007FF7A6C82000-memory.dmp	xmrig
behavioral2/memory/3256-2390-0x00007FF75AB50000-0x00007FF75AF42000-memory.dmp	xmrig
behavioral2/memory/2748-2392-0x00007FF62E100000-0x00007FF62E4F2000-memory.dmp	xmrig
behavioral2/memory/2468-2394-0x00007FF7108E0000-0x00007FF710CD2000-memory.dmp	xmrig
behavioral2/memory/2820-2398-0x00007FF6EED00000-0x00007FF6EF0F2000-memory.dmp	xmrig
behavioral2/memory/1516-2400-0x00007FF6BF570000-0x00007FF6BF962000-memory.dmp	xmrig
behavioral2/memory/2368-2402-0x00007FF6EC330000-0x00007FF6EC722000-memory.dmp	xmrig
behavioral2/memory/2720-2404-0x00007FF7467A0000-0x00007FF746B92000-memory.dmp	xmrig
behavioral2/memory/4488-2430-0x00007FF7D0600000-0x00007FF7D09F2000-memory.dmp	xmrig
behavioral2/memory/3364-2432-0x00007FF6093C0000-0x00007FF6097B2000-memory.dmp	xmrig
behavioral2/memory/4016-2435-0x00007FF63B240000-0x00007FF63B632000-memory.dmp	xmrig
behavioral2/memory/2144-2436-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	xmrig
behavioral2/memory/1936-2438-0x00007FF79A070000-0x00007FF79A462000-memory.dmp	xmrig
behavioral2/memory/1712-2441-0x00007FF69EF40000-0x00007FF69F332000-memory.dmp	xmrig
behavioral2/memory/5064-2442-0x00007FF785AB0000-0x00007FF785EA2000-memory.dmp	xmrig
behavioral2/memory/4456-2444-0x00007FF68BB10000-0x00007FF68BF02000-memory.dmp	xmrig
behavioral2/memory/2660-2446-0x00007FF6D1F50000-0x00007FF6D2342000-memory.dmp	xmrig
behavioral2/memory/1144-2450-0x00007FF7EB970000-0x00007FF7EBD62000-memory.dmp	xmrig
behavioral2/memory/4176-2647-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp	xmrig

Blocklisted process makes network request 20 IoCs

flow	pid	Process
7	4720	powershell.exe
9	4720	powershell.exe
25	4720	powershell.exe
24	4720	powershell.exe
26	4720	powershell.exe
28	4720	powershell.exe
29	4720	powershell.exe
30	4720	powershell.exe
31	4720	powershell.exe
32	4720	powershell.exe
33	4720	powershell.exe
34	4720	powershell.exe
35	4720	powershell.exe
36	4720	powershell.exe
37	4720	powershell.exe
38	4720	powershell.exe
39	4720	powershell.exe
40	4720	powershell.exe
41	4720	powershell.exe
42	4720	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4720	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1080	GBHklyL.exe
3632	flNvXBW.exe
3256	ZOzZnmB.exe
1672	RLVyMTP.exe
5012	rgtizKS.exe
2748	usCYLHc.exe
2468	ODyuAjz.exe
4992	AgwTksC.exe
744	xPFLjbv.exe
2820	DavmGvK.exe
1516	tfmLXPS.exe
2368	CACydvq.exe
2720	evHLXtJ.exe
4488	DENpXiS.exe
4176	qvfTXac.exe
3364	Wymymro.exe
2144	txJWENN.exe
4016	TqbgMQB.exe
1936	VxxBGCh.exe
5064	IRxeZgG.exe
1712	Ytlclpy.exe
4456	auXSfTP.exe
2660	nGiwbBF.exe
1144	KpLzAZo.exe
4064	gHBJNbl.exe
4432	gqEpIWZ.exe
2288	bJJlvDU.exe
4628	ggUVtOs.exe
4012	kLTHYHX.exe
448	VxeoIFw.exe
3012	cvwNYNy.exe
4240	oRvDebH.exe
4152	FZeRZaK.exe
2628	zuunwAk.exe
3156	cGEZufz.exe
4568	aCoBrNk.exe
3608	bVhwxXs.exe
3936	lTXAklU.exe
2356	TxChnUi.exe
1364	SAfbuhD.exe
3484	kyyxwJk.exe
2008	SXlhmdG.exe
4532	TDWTZVO.exe
3848	DCJQFnb.exe
4728	GBIXdAv.exe
3088	YQwmClx.exe
4056	CWRBFKu.exe
3932	GeaGfuC.exe
456	DGiqnlY.exe
4484	LBOukqS.exe
556	mEuiYsx.exe
3028	sesckmo.exe
892	gqjZEQY.exe
3172	AOiwvOg.exe
2100	MJjRvOX.exe
2428	rJiCZuY.exe
1008	GcjHlAb.exe
1408	VuSisKI.exe
436	osCIsKr.exe
2964	wZhjgsZ.exe
628	sVlmhyL.exe
976	TjDdwBf.exe
4752	FOSrhmG.exe
3988	MURSNEo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4668-0-0x00007FF6DB440000-0x00007FF6DB832000-memory.dmp	upx
behavioral2/files/0x0009000000023448-4.dat	upx
behavioral2/files/0x0007000000023455-15.dat	upx
behavioral2/memory/1080-12-0x00007FF632BE0000-0x00007FF632FD2000-memory.dmp	upx
behavioral2/files/0x0007000000023454-18.dat	upx
behavioral2/files/0x0007000000023456-22.dat	upx
behavioral2/files/0x000700000002345c-54.dat	upx
behavioral2/files/0x000700000002345e-60.dat	upx
behavioral2/files/0x000700000002345f-64.dat	upx
behavioral2/memory/1672-75-0x00007FF638B30000-0x00007FF638F22000-memory.dmp	upx
behavioral2/files/0x0007000000023460-84.dat	upx
behavioral2/memory/4992-89-0x00007FF6BE2F0000-0x00007FF6BE6E2000-memory.dmp	upx
behavioral2/files/0x000800000002345a-94.dat	upx
behavioral2/files/0x000800000002345b-102.dat	upx
behavioral2/memory/2720-118-0x00007FF7467A0000-0x00007FF746B92000-memory.dmp	upx
behavioral2/memory/3364-128-0x00007FF6093C0000-0x00007FF6097B2000-memory.dmp	upx
behavioral2/files/0x0007000000023467-147.dat	upx
behavioral2/files/0x000700000002346c-168.dat	upx
behavioral2/files/0x000700000002346d-182.dat	upx
behavioral2/memory/4668-699-0x00007FF6DB440000-0x00007FF6DB832000-memory.dmp	upx
behavioral2/files/0x0007000000023472-199.dat	upx
behavioral2/files/0x0007000000023470-197.dat	upx
behavioral2/files/0x0007000000023471-194.dat	upx
behavioral2/files/0x000700000002346f-192.dat	upx
behavioral2/files/0x000700000002346e-187.dat	upx
behavioral2/files/0x000700000002346b-172.dat	upx
behavioral2/memory/1144-171-0x00007FF7EB970000-0x00007FF7EBD62000-memory.dmp	upx
behavioral2/files/0x000700000002346a-166.dat	upx
behavioral2/memory/2660-165-0x00007FF6D1F50000-0x00007FF6D2342000-memory.dmp	upx
behavioral2/files/0x0007000000023469-160.dat	upx
behavioral2/memory/4456-159-0x00007FF68BB10000-0x00007FF68BF02000-memory.dmp	upx
behavioral2/memory/1712-158-0x00007FF69EF40000-0x00007FF69F332000-memory.dmp	upx
behavioral2/files/0x0007000000023468-153.dat	upx
behavioral2/memory/5064-152-0x00007FF785AB0000-0x00007FF785EA2000-memory.dmp	upx
behavioral2/memory/1936-146-0x00007FF79A070000-0x00007FF79A462000-memory.dmp	upx
behavioral2/files/0x0007000000023466-141.dat	upx
behavioral2/memory/4016-140-0x00007FF63B240000-0x00007FF63B632000-memory.dmp	upx
behavioral2/files/0x000900000002344b-135.dat	upx
behavioral2/memory/2144-134-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp	upx
behavioral2/files/0x0007000000023465-129.dat	upx
behavioral2/memory/4488-124-0x00007FF7D0600000-0x00007FF7D09F2000-memory.dmp	upx
behavioral2/files/0x0007000000023464-119.dat	upx
behavioral2/files/0x0007000000023463-114.dat	upx
behavioral2/memory/1516-113-0x00007FF6BF570000-0x00007FF6BF962000-memory.dmp	upx
behavioral2/files/0x0007000000023462-111.dat	upx
behavioral2/memory/2820-109-0x00007FF6EED00000-0x00007FF6EF0F2000-memory.dmp	upx
behavioral2/memory/3632-108-0x00007FF6C5CB0000-0x00007FF6C60A2000-memory.dmp	upx
behavioral2/memory/4176-101-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp	upx
behavioral2/memory/2368-97-0x00007FF6EC330000-0x00007FF6EC722000-memory.dmp	upx
behavioral2/files/0x0007000000023461-91.dat	upx
behavioral2/memory/744-90-0x00007FF62A710000-0x00007FF62AB02000-memory.dmp	upx
behavioral2/memory/2468-85-0x00007FF7108E0000-0x00007FF710CD2000-memory.dmp	upx
behavioral2/memory/2748-80-0x00007FF62E100000-0x00007FF62E4F2000-memory.dmp	upx
behavioral2/memory/5012-79-0x00007FF7A6890000-0x00007FF7A6C82000-memory.dmp	upx
behavioral2/memory/3256-63-0x00007FF75AB50000-0x00007FF75AF42000-memory.dmp	upx
behavioral2/files/0x000700000002345d-53.dat	upx
behavioral2/files/0x0007000000023459-49.dat	upx
behavioral2/files/0x0007000000023458-44.dat	upx
behavioral2/files/0x0007000000023457-34.dat	upx
behavioral2/memory/4176-1054-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp	upx
behavioral2/memory/1080-2382-0x00007FF632BE0000-0x00007FF632FD2000-memory.dmp	upx
behavioral2/memory/1672-2384-0x00007FF638B30000-0x00007FF638F22000-memory.dmp	upx
behavioral2/memory/3632-2386-0x00007FF6C5CB0000-0x00007FF6C60A2000-memory.dmp	upx
behavioral2/memory/5012-2388-0x00007FF7A6890000-0x00007FF7A6C82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TqbgMQB.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\LBOukqS.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\PjEOzUw.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\JsKgQTg.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\wpFrUlF.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\UQmwmDX.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\ODyuAjz.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\MJjRvOX.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\QAKXRvb.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\NMETBAv.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\UaXRvqk.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\WzthNcI.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\suTttiL.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\bYNMNfW.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\cAhoPeW.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\vvpYWby.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\evHLXtJ.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\FISeVLe.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\JXGHboz.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\oCLBlAS.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\dezoLSs.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\OdZErIq.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\peXAQra.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\pZoZhDw.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\hgZyKLa.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\FQUppmw.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\NIzCjVa.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\kyyxwJk.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\CWRBFKu.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\WtJEEun.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\GysjLcZ.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\numidGD.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\okSaUDg.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\IlFTBsK.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\DPyfxfa.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\PIvSUEz.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\zeGjPms.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\oTYpLmw.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\DugMzxi.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\kLTHYHX.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\iJKsRcl.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\ApHkVTC.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\bTXOSpf.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\NVdYwRy.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\nhtEKty.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\ZOzZnmB.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\xChMZoN.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\uIllQqK.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\LiQPWDt.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\epCHwDn.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\auXSfTP.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\AqAzNIT.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\DXXxfPm.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\HDXUXbr.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\fOrEUtr.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\nQxqlMy.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\EGLDSHU.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\pRUYHTx.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\ThoisOl.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\qopffzU.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\knuidHY.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\UtVQaqa.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\YLAHFLb.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
File created	C:\Windows\System\PRLphgo.exe	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4720	powershell.exe
4720	powershell.exe
4720	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeLockMemoryPrivilege	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
Token: SeLockMemoryPrivilege	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 4720	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	83
PID 4668 wrote to memory of 4720	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	83
PID 4668 wrote to memory of 1080	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	84
PID 4668 wrote to memory of 1080	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	84
PID 4668 wrote to memory of 3256	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	85
PID 4668 wrote to memory of 3256	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	85
PID 4668 wrote to memory of 3632	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	86
PID 4668 wrote to memory of 3632	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	86
PID 4668 wrote to memory of 1672	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	87
PID 4668 wrote to memory of 1672	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	87
PID 4668 wrote to memory of 5012	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	88
PID 4668 wrote to memory of 5012	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	88
PID 4668 wrote to memory of 2748	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	89
PID 4668 wrote to memory of 2748	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	89
PID 4668 wrote to memory of 2468	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	90
PID 4668 wrote to memory of 2468	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	90
PID 4668 wrote to memory of 4992	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	91
PID 4668 wrote to memory of 4992	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	91
PID 4668 wrote to memory of 744	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	92
PID 4668 wrote to memory of 744	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	92
PID 4668 wrote to memory of 2820	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	93
PID 4668 wrote to memory of 2820	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	93
PID 4668 wrote to memory of 1516	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	94
PID 4668 wrote to memory of 1516	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	94
PID 4668 wrote to memory of 2368	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	95
PID 4668 wrote to memory of 2368	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	95
PID 4668 wrote to memory of 2720	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	96
PID 4668 wrote to memory of 2720	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	96
PID 4668 wrote to memory of 4176	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	97
PID 4668 wrote to memory of 4176	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	97
PID 4668 wrote to memory of 4488	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	98
PID 4668 wrote to memory of 4488	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	98
PID 4668 wrote to memory of 3364	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	99
PID 4668 wrote to memory of 3364	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	99
PID 4668 wrote to memory of 2144	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	100
PID 4668 wrote to memory of 2144	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	100
PID 4668 wrote to memory of 4016	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	101
PID 4668 wrote to memory of 4016	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	101
PID 4668 wrote to memory of 1936	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	102
PID 4668 wrote to memory of 1936	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	102
PID 4668 wrote to memory of 5064	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	103
PID 4668 wrote to memory of 5064	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	103
PID 4668 wrote to memory of 1712	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	104
PID 4668 wrote to memory of 1712	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	104
PID 4668 wrote to memory of 4456	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	105
PID 4668 wrote to memory of 4456	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	105
PID 4668 wrote to memory of 2660	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	106
PID 4668 wrote to memory of 2660	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	106
PID 4668 wrote to memory of 1144	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	107
PID 4668 wrote to memory of 1144	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	107
PID 4668 wrote to memory of 4064	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	108
PID 4668 wrote to memory of 4064	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	108
PID 4668 wrote to memory of 4432	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	109
PID 4668 wrote to memory of 4432	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	109
PID 4668 wrote to memory of 2288	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	110
PID 4668 wrote to memory of 2288	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	110
PID 4668 wrote to memory of 4628	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	111
PID 4668 wrote to memory of 4628	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	111
PID 4668 wrote to memory of 4012	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	112
PID 4668 wrote to memory of 4012	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	112
PID 4668 wrote to memory of 448	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	113
PID 4668 wrote to memory of 448	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	113
PID 4668 wrote to memory of 3012	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	114
PID 4668 wrote to memory of 3012	4668	e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe	114

C:\Users\Admin\AppData\Local\Temp\e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe
"C:\Users\Admin\AppData\Local\Temp\e79641743707b38c0ed707bf1f465265d58b9aa07097091b9354763d497a4037.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\System\GBHklyL.exe
  C:\Windows\System\GBHklyL.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ZOzZnmB.exe
  C:\Windows\System\ZOzZnmB.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\flNvXBW.exe
  C:\Windows\System\flNvXBW.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\RLVyMTP.exe
  C:\Windows\System\RLVyMTP.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\rgtizKS.exe
  C:\Windows\System\rgtizKS.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\usCYLHc.exe
  C:\Windows\System\usCYLHc.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\ODyuAjz.exe
  C:\Windows\System\ODyuAjz.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\AgwTksC.exe
  C:\Windows\System\AgwTksC.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\xPFLjbv.exe
  C:\Windows\System\xPFLjbv.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\DavmGvK.exe
  C:\Windows\System\DavmGvK.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\tfmLXPS.exe
  C:\Windows\System\tfmLXPS.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\CACydvq.exe
  C:\Windows\System\CACydvq.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\evHLXtJ.exe
  C:\Windows\System\evHLXtJ.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\qvfTXac.exe
  C:\Windows\System\qvfTXac.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\DENpXiS.exe
  C:\Windows\System\DENpXiS.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\Wymymro.exe
  C:\Windows\System\Wymymro.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\txJWENN.exe
  C:\Windows\System\txJWENN.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\TqbgMQB.exe
  C:\Windows\System\TqbgMQB.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\VxxBGCh.exe
  C:\Windows\System\VxxBGCh.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\IRxeZgG.exe
  C:\Windows\System\IRxeZgG.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\Ytlclpy.exe
  C:\Windows\System\Ytlclpy.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\auXSfTP.exe
  C:\Windows\System\auXSfTP.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\nGiwbBF.exe
  C:\Windows\System\nGiwbBF.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\KpLzAZo.exe
  C:\Windows\System\KpLzAZo.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\gHBJNbl.exe
  C:\Windows\System\gHBJNbl.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\gqEpIWZ.exe
  C:\Windows\System\gqEpIWZ.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\bJJlvDU.exe
  C:\Windows\System\bJJlvDU.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ggUVtOs.exe
  C:\Windows\System\ggUVtOs.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\kLTHYHX.exe
  C:\Windows\System\kLTHYHX.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\VxeoIFw.exe
  C:\Windows\System\VxeoIFw.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\cvwNYNy.exe
  C:\Windows\System\cvwNYNy.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\oRvDebH.exe
  C:\Windows\System\oRvDebH.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\FZeRZaK.exe
  C:\Windows\System\FZeRZaK.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\zuunwAk.exe
  C:\Windows\System\zuunwAk.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\cGEZufz.exe
  C:\Windows\System\cGEZufz.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\aCoBrNk.exe
  C:\Windows\System\aCoBrNk.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\bVhwxXs.exe
  C:\Windows\System\bVhwxXs.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\lTXAklU.exe
  C:\Windows\System\lTXAklU.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\TxChnUi.exe
  C:\Windows\System\TxChnUi.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\SAfbuhD.exe
  C:\Windows\System\SAfbuhD.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\kyyxwJk.exe
  C:\Windows\System\kyyxwJk.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\SXlhmdG.exe
  C:\Windows\System\SXlhmdG.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\TDWTZVO.exe
  C:\Windows\System\TDWTZVO.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\DCJQFnb.exe
  C:\Windows\System\DCJQFnb.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\GBIXdAv.exe
  C:\Windows\System\GBIXdAv.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\YQwmClx.exe
  C:\Windows\System\YQwmClx.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\CWRBFKu.exe
  C:\Windows\System\CWRBFKu.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\GeaGfuC.exe
  C:\Windows\System\GeaGfuC.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\DGiqnlY.exe
  C:\Windows\System\DGiqnlY.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\LBOukqS.exe
  C:\Windows\System\LBOukqS.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\mEuiYsx.exe
  C:\Windows\System\mEuiYsx.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\sesckmo.exe
  C:\Windows\System\sesckmo.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\gqjZEQY.exe
  C:\Windows\System\gqjZEQY.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\AOiwvOg.exe
  C:\Windows\System\AOiwvOg.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\MJjRvOX.exe
  C:\Windows\System\MJjRvOX.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\rJiCZuY.exe
  C:\Windows\System\rJiCZuY.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\GcjHlAb.exe
  C:\Windows\System\GcjHlAb.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\VuSisKI.exe
  C:\Windows\System\VuSisKI.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\osCIsKr.exe
  C:\Windows\System\osCIsKr.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\wZhjgsZ.exe
  C:\Windows\System\wZhjgsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\sVlmhyL.exe
  C:\Windows\System\sVlmhyL.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\TjDdwBf.exe
  C:\Windows\System\TjDdwBf.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\FOSrhmG.exe
  C:\Windows\System\FOSrhmG.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\MURSNEo.exe
  C:\Windows\System\MURSNEo.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\doesUvt.exe
  C:\Windows\System\doesUvt.exe
  2⤵
  PID:3916
- C:\Windows\System\nTXlMqh.exe
  C:\Windows\System\nTXlMqh.exe
  2⤵
  PID:1076
- C:\Windows\System\wFdxrsB.exe
  C:\Windows\System\wFdxrsB.exe
  2⤵
  PID:3136
- C:\Windows\System\kcZedPO.exe
  C:\Windows\System\kcZedPO.exe
  2⤵
  PID:3524
- C:\Windows\System\cOuAWdW.exe
  C:\Windows\System\cOuAWdW.exe
  2⤵
  PID:1508
- C:\Windows\System\DcRBwwu.exe
  C:\Windows\System\DcRBwwu.exe
  2⤵
  PID:1732
- C:\Windows\System\UkzjXAu.exe
  C:\Windows\System\UkzjXAu.exe
  2⤵
  PID:3004
- C:\Windows\System\JYmoFQQ.exe
  C:\Windows\System\JYmoFQQ.exe
  2⤵
  PID:4964
- C:\Windows\System\KbIcMdY.exe
  C:\Windows\System\KbIcMdY.exe
  2⤵
  PID:1392
- C:\Windows\System\MTdABUi.exe
  C:\Windows\System\MTdABUi.exe
  2⤵
  PID:3984
- C:\Windows\System\jIuCspL.exe
  C:\Windows\System\jIuCspL.exe
  2⤵
  PID:4200
- C:\Windows\System\sRvKGjE.exe
  C:\Windows\System\sRvKGjE.exe
  2⤵
  PID:3712
- C:\Windows\System\FISeVLe.exe
  C:\Windows\System\FISeVLe.exe
  2⤵
  PID:5040
- C:\Windows\System\QAKXRvb.exe
  C:\Windows\System\QAKXRvb.exe
  2⤵
  PID:1180
- C:\Windows\System\ZcUgPdB.exe
  C:\Windows\System\ZcUgPdB.exe
  2⤵
  PID:1828
- C:\Windows\System\VgKbFgH.exe
  C:\Windows\System\VgKbFgH.exe
  2⤵
  PID:1536
- C:\Windows\System\kLCcOsa.exe
  C:\Windows\System\kLCcOsa.exe
  2⤵
  PID:4588
- C:\Windows\System\gUVEFZD.exe
  C:\Windows\System\gUVEFZD.exe
  2⤵
  PID:1860
- C:\Windows\System\sxLJIPZ.exe
  C:\Windows\System\sxLJIPZ.exe
  2⤵
  PID:1128
- C:\Windows\System\PzhxjbO.exe
  C:\Windows\System\PzhxjbO.exe
  2⤵
  PID:2020
- C:\Windows\System\nkbxbEU.exe
  C:\Windows\System\nkbxbEU.exe
  2⤵
  PID:3704
- C:\Windows\System\meFQvzg.exe
  C:\Windows\System\meFQvzg.exe
  2⤵
  PID:3380
- C:\Windows\System\QLuErhc.exe
  C:\Windows\System\QLuErhc.exe
  2⤵
  PID:3672
- C:\Windows\System\XOPIZdC.exe
  C:\Windows\System\XOPIZdC.exe
  2⤵
  PID:3104
- C:\Windows\System\CDWkWUh.exe
  C:\Windows\System\CDWkWUh.exe
  2⤵
  PID:2480
- C:\Windows\System\xChMZoN.exe
  C:\Windows\System\xChMZoN.exe
  2⤵
  PID:3460
- C:\Windows\System\lJheUit.exe
  C:\Windows\System\lJheUit.exe
  2⤵
  PID:5140
- C:\Windows\System\KyAHjoy.exe
  C:\Windows\System\KyAHjoy.exe
  2⤵
  PID:5168
- C:\Windows\System\gJdabCf.exe
  C:\Windows\System\gJdabCf.exe
  2⤵
  PID:5212
- C:\Windows\System\bDIeiZW.exe
  C:\Windows\System\bDIeiZW.exe
  2⤵
  PID:5236
- C:\Windows\System\QydmYLc.exe
  C:\Windows\System\QydmYLc.exe
  2⤵
  PID:5264
- C:\Windows\System\NMETBAv.exe
  C:\Windows\System\NMETBAv.exe
  2⤵
  PID:5280
- C:\Windows\System\IgfbpZn.exe
  C:\Windows\System\IgfbpZn.exe
  2⤵
  PID:5308
- C:\Windows\System\KEBFmYc.exe
  C:\Windows\System\KEBFmYc.exe
  2⤵
  PID:5336
- C:\Windows\System\CBgNAAK.exe
  C:\Windows\System\CBgNAAK.exe
  2⤵
  PID:5368
- C:\Windows\System\sHrKFGh.exe
  C:\Windows\System\sHrKFGh.exe
  2⤵
  PID:5396
- C:\Windows\System\iGjfgzW.exe
  C:\Windows\System\iGjfgzW.exe
  2⤵
  PID:5420
- C:\Windows\System\yklBqcF.exe
  C:\Windows\System\yklBqcF.exe
  2⤵
  PID:5452
- C:\Windows\System\KQIZCQX.exe
  C:\Windows\System\KQIZCQX.exe
  2⤵
  PID:5476
- C:\Windows\System\ICNvBAW.exe
  C:\Windows\System\ICNvBAW.exe
  2⤵
  PID:5508
- C:\Windows\System\rQdQwLG.exe
  C:\Windows\System\rQdQwLG.exe
  2⤵
  PID:5536
- C:\Windows\System\igofRms.exe
  C:\Windows\System\igofRms.exe
  2⤵
  PID:5564
- C:\Windows\System\bUfPFUR.exe
  C:\Windows\System\bUfPFUR.exe
  2⤵
  PID:5588
- C:\Windows\System\rCuTNPy.exe
  C:\Windows\System\rCuTNPy.exe
  2⤵
  PID:5616
- C:\Windows\System\PkCQVxo.exe
  C:\Windows\System\PkCQVxo.exe
  2⤵
  PID:5648
- C:\Windows\System\EjutfOR.exe
  C:\Windows\System\EjutfOR.exe
  2⤵
  PID:5672
- C:\Windows\System\zGameTN.exe
  C:\Windows\System\zGameTN.exe
  2⤵
  PID:5968
- C:\Windows\System\sArrjDL.exe
  C:\Windows\System\sArrjDL.exe
  2⤵
  PID:6012
- C:\Windows\System\tYpMKKs.exe
  C:\Windows\System\tYpMKKs.exe
  2⤵
  PID:6056
- C:\Windows\System\epwwPuZ.exe
  C:\Windows\System\epwwPuZ.exe
  2⤵
  PID:6076
- C:\Windows\System\pazIpLB.exe
  C:\Windows\System\pazIpLB.exe
  2⤵
  PID:6100
- C:\Windows\System\zsitfjX.exe
  C:\Windows\System\zsitfjX.exe
  2⤵
  PID:6124
- C:\Windows\System\iMiGqwo.exe
  C:\Windows\System\iMiGqwo.exe
  2⤵
  PID:4932
- C:\Windows\System\EeSvISX.exe
  C:\Windows\System\EeSvISX.exe
  2⤵
  PID:1432
- C:\Windows\System\TsnsGBr.exe
  C:\Windows\System\TsnsGBr.exe
  2⤵
  PID:2180
- C:\Windows\System\lEmVgMX.exe
  C:\Windows\System\lEmVgMX.exe
  2⤵
  PID:3152
- C:\Windows\System\SDStlUQ.exe
  C:\Windows\System\SDStlUQ.exe
  2⤵
  PID:2812
- C:\Windows\System\FWZVgwT.exe
  C:\Windows\System\FWZVgwT.exe
  2⤵
  PID:5124
- C:\Windows\System\ZHXwByy.exe
  C:\Windows\System\ZHXwByy.exe
  2⤵
  PID:644
- C:\Windows\System\juCJRiU.exe
  C:\Windows\System\juCJRiU.exe
  2⤵
  PID:5220
- C:\Windows\System\MBKTBCc.exe
  C:\Windows\System\MBKTBCc.exe
  2⤵
  PID:5320
- C:\Windows\System\fHZqGIT.exe
  C:\Windows\System\fHZqGIT.exe
  2⤵
  PID:1716
- C:\Windows\System\ulCthJj.exe
  C:\Windows\System\ulCthJj.exe
  2⤵
  PID:5388
- C:\Windows\System\QfPyrNQ.exe
  C:\Windows\System\QfPyrNQ.exe
  2⤵
  PID:4392
- C:\Windows\System\sbBKoQm.exe
  C:\Windows\System\sbBKoQm.exe
  2⤵
  PID:5500
- C:\Windows\System\XHdpoAJ.exe
  C:\Windows\System\XHdpoAJ.exe
  2⤵
  PID:5552
- C:\Windows\System\zFZPYXh.exe
  C:\Windows\System\zFZPYXh.exe
  2⤵
  PID:1220
- C:\Windows\System\WtJEEun.exe
  C:\Windows\System\WtJEEun.exe
  2⤵
  PID:1804
- C:\Windows\System\mfxHIOf.exe
  C:\Windows\System\mfxHIOf.exe
  2⤵
  PID:5636
- C:\Windows\System\vOijmMG.exe
  C:\Windows\System\vOijmMG.exe
  2⤵
  PID:1904
- C:\Windows\System\xVpmpso.exe
  C:\Windows\System\xVpmpso.exe
  2⤵
  PID:5752
- C:\Windows\System\IvjKKws.exe
  C:\Windows\System\IvjKKws.exe
  2⤵
  PID:5768
- C:\Windows\System\TpjKnmW.exe
  C:\Windows\System\TpjKnmW.exe
  2⤵
  PID:5792
- C:\Windows\System\LTqexNq.exe
  C:\Windows\System\LTqexNq.exe
  2⤵
  PID:5832
- C:\Windows\System\WzthNcI.exe
  C:\Windows\System\WzthNcI.exe
  2⤵
  PID:5880
- C:\Windows\System\ycZEBWh.exe
  C:\Windows\System\ycZEBWh.exe
  2⤵
  PID:5784
- C:\Windows\System\TcQBzOs.exe
  C:\Windows\System\TcQBzOs.exe
  2⤵
  PID:432
- C:\Windows\System\KWZdhXJ.exe
  C:\Windows\System\KWZdhXJ.exe
  2⤵
  PID:3908
- C:\Windows\System\elIaNQY.exe
  C:\Windows\System\elIaNQY.exe
  2⤵
  PID:3996
- C:\Windows\System\adUTQXu.exe
  C:\Windows\System\adUTQXu.exe
  2⤵
  PID:3332
- C:\Windows\System\xCzARHp.exe
  C:\Windows\System\xCzARHp.exe
  2⤵
  PID:6064
- C:\Windows\System\YdWlhbX.exe
  C:\Windows\System\YdWlhbX.exe
  2⤵
  PID:6132
- C:\Windows\System\YpPBSlG.exe
  C:\Windows\System\YpPBSlG.exe
  2⤵
  PID:2740
- C:\Windows\System\GOWPASb.exe
  C:\Windows\System\GOWPASb.exe
  2⤵
  PID:5180
- C:\Windows\System\AqAzNIT.exe
  C:\Windows\System\AqAzNIT.exe
  2⤵
  PID:5292
- C:\Windows\System\FrnEdVH.exe
  C:\Windows\System\FrnEdVH.exe
  2⤵
  PID:5436
- C:\Windows\System\VhHxFkq.exe
  C:\Windows\System\VhHxFkq.exe
  2⤵
  PID:5496
- C:\Windows\System\JnbquSV.exe
  C:\Windows\System\JnbquSV.exe
  2⤵
  PID:5548
- C:\Windows\System\LVJhxIA.exe
  C:\Windows\System\LVJhxIA.exe
  2⤵
  PID:5604
- C:\Windows\System\QZdHVnu.exe
  C:\Windows\System\QZdHVnu.exe
  2⤵
  PID:5744
- C:\Windows\System\gPYKOOX.exe
  C:\Windows\System\gPYKOOX.exe
  2⤵
  PID:5812
- C:\Windows\System\UtVQaqa.exe
  C:\Windows\System\UtVQaqa.exe
  2⤵
  PID:5860
- C:\Windows\System\RfORYhQ.exe
  C:\Windows\System\RfORYhQ.exe
  2⤵
  PID:5900
- C:\Windows\System\thTKGMf.exe
  C:\Windows\System\thTKGMf.exe
  2⤵
  PID:6024
- C:\Windows\System\AzvhJTR.exe
  C:\Windows\System\AzvhJTR.exe
  2⤵
  PID:1208
- C:\Windows\System\dyEuntp.exe
  C:\Windows\System\dyEuntp.exe
  2⤵
  PID:6108
- C:\Windows\System\HRVylLL.exe
  C:\Windows\System\HRVylLL.exe
  2⤵
  PID:920
- C:\Windows\System\CKDUtUg.exe
  C:\Windows\System\CKDUtUg.exe
  2⤵
  PID:5328
- C:\Windows\System\qODFOSu.exe
  C:\Windows\System\qODFOSu.exe
  2⤵
  PID:5384
- C:\Windows\System\pmZapOe.exe
  C:\Windows\System\pmZapOe.exe
  2⤵
  PID:5060
- C:\Windows\System\QncNfER.exe
  C:\Windows\System\QncNfER.exe
  2⤵
  PID:5788
- C:\Windows\System\qWANVah.exe
  C:\Windows\System\qWANVah.exe
  2⤵
  PID:5828
- C:\Windows\System\NACbSMu.exe
  C:\Windows\System\NACbSMu.exe
  2⤵
  PID:3744
- C:\Windows\System\IuxGATu.exe
  C:\Windows\System\IuxGATu.exe
  2⤵
  PID:852
- C:\Windows\System\eoIKNja.exe
  C:\Windows\System\eoIKNja.exe
  2⤵
  PID:5092
- C:\Windows\System\jcChoUX.exe
  C:\Windows\System\jcChoUX.exe
  2⤵
  PID:2832
- C:\Windows\System\tbUeCDs.exe
  C:\Windows\System\tbUeCDs.exe
  2⤵
  PID:6152
- C:\Windows\System\GvwRaBk.exe
  C:\Windows\System\GvwRaBk.exe
  2⤵
  PID:6180
- C:\Windows\System\FtUVliy.exe
  C:\Windows\System\FtUVliy.exe
  2⤵
  PID:6196
- C:\Windows\System\jQWOytj.exe
  C:\Windows\System\jQWOytj.exe
  2⤵
  PID:6224
- C:\Windows\System\QQcsdIa.exe
  C:\Windows\System\QQcsdIa.exe
  2⤵
  PID:6240
- C:\Windows\System\wFboSaA.exe
  C:\Windows\System\wFboSaA.exe
  2⤵
  PID:6256
- C:\Windows\System\eoVNaWO.exe
  C:\Windows\System\eoVNaWO.exe
  2⤵
  PID:6288
- C:\Windows\System\mMAPlmF.exe
  C:\Windows\System\mMAPlmF.exe
  2⤵
  PID:6336
- C:\Windows\System\Lbfblwa.exe
  C:\Windows\System\Lbfblwa.exe
  2⤵
  PID:6376
- C:\Windows\System\VIBgpPk.exe
  C:\Windows\System\VIBgpPk.exe
  2⤵
  PID:6400
- C:\Windows\System\ypcQPMa.exe
  C:\Windows\System\ypcQPMa.exe
  2⤵
  PID:6420
- C:\Windows\System\jcLQCGK.exe
  C:\Windows\System\jcLQCGK.exe
  2⤵
  PID:6448
- C:\Windows\System\OdZErIq.exe
  C:\Windows\System\OdZErIq.exe
  2⤵
  PID:6464
- C:\Windows\System\QSRlvga.exe
  C:\Windows\System\QSRlvga.exe
  2⤵
  PID:6492
- C:\Windows\System\cTYFacM.exe
  C:\Windows\System\cTYFacM.exe
  2⤵
  PID:6512
- C:\Windows\System\LAysEju.exe
  C:\Windows\System\LAysEju.exe
  2⤵
  PID:6568
- C:\Windows\System\flLEijm.exe
  C:\Windows\System\flLEijm.exe
  2⤵
  PID:6588
- C:\Windows\System\DXXxfPm.exe
  C:\Windows\System\DXXxfPm.exe
  2⤵
  PID:6616
- C:\Windows\System\iJKsRcl.exe
  C:\Windows\System\iJKsRcl.exe
  2⤵
  PID:6632
- C:\Windows\System\zgAmtnZ.exe
  C:\Windows\System\zgAmtnZ.exe
  2⤵
  PID:6652
- C:\Windows\System\NGiFTrc.exe
  C:\Windows\System\NGiFTrc.exe
  2⤵
  PID:6676
- C:\Windows\System\mMhVRvv.exe
  C:\Windows\System\mMhVRvv.exe
  2⤵
  PID:6692
- C:\Windows\System\nQxqlMy.exe
  C:\Windows\System\nQxqlMy.exe
  2⤵
  PID:6712
- C:\Windows\System\omOqsnW.exe
  C:\Windows\System\omOqsnW.exe
  2⤵
  PID:6748
- C:\Windows\System\PUDNIcJ.exe
  C:\Windows\System\PUDNIcJ.exe
  2⤵
  PID:6768
- C:\Windows\System\fgmcMQq.exe
  C:\Windows\System\fgmcMQq.exe
  2⤵
  PID:6840
- C:\Windows\System\mHLenIF.exe
  C:\Windows\System\mHLenIF.exe
  2⤵
  PID:6872
- C:\Windows\System\UJnnKwd.exe
  C:\Windows\System\UJnnKwd.exe
  2⤵
  PID:6908
- C:\Windows\System\pIjfYQd.exe
  C:\Windows\System\pIjfYQd.exe
  2⤵
  PID:6928
- C:\Windows\System\RtGQzyw.exe
  C:\Windows\System\RtGQzyw.exe
  2⤵
  PID:6968
- C:\Windows\System\AjDPbig.exe
  C:\Windows\System\AjDPbig.exe
  2⤵
  PID:6988
- C:\Windows\System\nDpMQMn.exe
  C:\Windows\System\nDpMQMn.exe
  2⤵
  PID:7004
- C:\Windows\System\mGLppMS.exe
  C:\Windows\System\mGLppMS.exe
  2⤵
  PID:7024
- C:\Windows\System\HITgxUc.exe
  C:\Windows\System\HITgxUc.exe
  2⤵
  PID:7056
- C:\Windows\System\KflENqe.exe
  C:\Windows\System\KflENqe.exe
  2⤵
  PID:7092
- C:\Windows\System\MldRLCt.exe
  C:\Windows\System\MldRLCt.exe
  2⤵
  PID:7140
- C:\Windows\System\XrkhpGQ.exe
  C:\Windows\System\XrkhpGQ.exe
  2⤵
  PID:5644
- C:\Windows\System\NKlsTCe.exe
  C:\Windows\System\NKlsTCe.exe
  2⤵
  PID:6204
- C:\Windows\System\HCpZTYz.exe
  C:\Windows\System\HCpZTYz.exe
  2⤵
  PID:6236
- C:\Windows\System\RyWZemb.exe
  C:\Windows\System\RyWZemb.exe
  2⤵
  PID:6212
- C:\Windows\System\yLyVcoj.exe
  C:\Windows\System\yLyVcoj.exe
  2⤵
  PID:6328
- C:\Windows\System\EGLDSHU.exe
  C:\Windows\System\EGLDSHU.exe
  2⤵
  PID:6384
- C:\Windows\System\njoxCRz.exe
  C:\Windows\System\njoxCRz.exe
  2⤵
  PID:6440
- C:\Windows\System\NpOykeE.exe
  C:\Windows\System\NpOykeE.exe
  2⤵
  PID:6460
- C:\Windows\System\uIllQqK.exe
  C:\Windows\System\uIllQqK.exe
  2⤵
  PID:1512
- C:\Windows\System\lDMDLUk.exe
  C:\Windows\System\lDMDLUk.exe
  2⤵
  PID:6484
- C:\Windows\System\TXEFBfV.exe
  C:\Windows\System\TXEFBfV.exe
  2⤵
  PID:6580
- C:\Windows\System\YLAHFLb.exe
  C:\Windows\System\YLAHFLb.exe
  2⤵
  PID:6672
- C:\Windows\System\tBlfnEh.exe
  C:\Windows\System\tBlfnEh.exe
  2⤵
  PID:6736
- C:\Windows\System\Jtbvrzp.exe
  C:\Windows\System\Jtbvrzp.exe
  2⤵
  PID:6828
- C:\Windows\System\nhtEKty.exe
  C:\Windows\System\nhtEKty.exe
  2⤵
  PID:6884
- C:\Windows\System\KVGBgiT.exe
  C:\Windows\System\KVGBgiT.exe
  2⤵
  PID:6900
- C:\Windows\System\okSaUDg.exe
  C:\Windows\System\okSaUDg.exe
  2⤵
  PID:6956
- C:\Windows\System\ePeesbn.exe
  C:\Windows\System\ePeesbn.exe
  2⤵
  PID:7040
- C:\Windows\System\VWPfcJq.exe
  C:\Windows\System\VWPfcJq.exe
  2⤵
  PID:7076
- C:\Windows\System\JCrSDBK.exe
  C:\Windows\System\JCrSDBK.exe
  2⤵
  PID:6160
- C:\Windows\System\XexVIFa.exe
  C:\Windows\System\XexVIFa.exe
  2⤵
  PID:6360
- C:\Windows\System\rBBTKOh.exe
  C:\Windows\System\rBBTKOh.exe
  2⤵
  PID:4556
- C:\Windows\System\nfvMZCd.exe
  C:\Windows\System\nfvMZCd.exe
  2⤵
  PID:6472
- C:\Windows\System\aSPqyjD.exe
  C:\Windows\System\aSPqyjD.exe
  2⤵
  PID:6660
- C:\Windows\System\HtZnsTQ.exe
  C:\Windows\System\HtZnsTQ.exe
  2⤵
  PID:6896
- C:\Windows\System\ZGHeKTW.exe
  C:\Windows\System\ZGHeKTW.exe
  2⤵
  PID:6148
- C:\Windows\System\ZJMeAjp.exe
  C:\Windows\System\ZJMeAjp.exe
  2⤵
  PID:6396
- C:\Windows\System\abiHbgT.exe
  C:\Windows\System\abiHbgT.exe
  2⤵
  PID:216
- C:\Windows\System\QxflqsN.exe
  C:\Windows\System\QxflqsN.exe
  2⤵
  PID:7088
- C:\Windows\System\FWrwKnp.exe
  C:\Windows\System\FWrwKnp.exe
  2⤵
  PID:5932
- C:\Windows\System\NGPWsBI.exe
  C:\Windows\System\NGPWsBI.exe
  2⤵
  PID:7172
- C:\Windows\System\HyKRyQV.exe
  C:\Windows\System\HyKRyQV.exe
  2⤵
  PID:7196
- C:\Windows\System\hKPBFHG.exe
  C:\Windows\System\hKPBFHG.exe
  2⤵
  PID:7212
- C:\Windows\System\BghBcOm.exe
  C:\Windows\System\BghBcOm.exe
  2⤵
  PID:7288
- C:\Windows\System\gIdwQVA.exe
  C:\Windows\System\gIdwQVA.exe
  2⤵
  PID:7332
- C:\Windows\System\saHZrId.exe
  C:\Windows\System\saHZrId.exe
  2⤵
  PID:7348
- C:\Windows\System\lTNFMBM.exe
  C:\Windows\System\lTNFMBM.exe
  2⤵
  PID:7376
- C:\Windows\System\MklRjuL.exe
  C:\Windows\System\MklRjuL.exe
  2⤵
  PID:7400
- C:\Windows\System\bSpeMKP.exe
  C:\Windows\System\bSpeMKP.exe
  2⤵
  PID:7416
- C:\Windows\System\OWZXjVz.exe
  C:\Windows\System\OWZXjVz.exe
  2⤵
  PID:7432
- C:\Windows\System\cqHblFM.exe
  C:\Windows\System\cqHblFM.exe
  2⤵
  PID:7448
- C:\Windows\System\JsWFFEt.exe
  C:\Windows\System\JsWFFEt.exe
  2⤵
  PID:7464
- C:\Windows\System\bIsEpDu.exe
  C:\Windows\System\bIsEpDu.exe
  2⤵
  PID:7480
- C:\Windows\System\aCqvoQZ.exe
  C:\Windows\System\aCqvoQZ.exe
  2⤵
  PID:7528
- C:\Windows\System\uHepjZX.exe
  C:\Windows\System\uHepjZX.exe
  2⤵
  PID:7548
- C:\Windows\System\CilHaMO.exe
  C:\Windows\System\CilHaMO.exe
  2⤵
  PID:7568
- C:\Windows\System\VPkBMfz.exe
  C:\Windows\System\VPkBMfz.exe
  2⤵
  PID:7584
- C:\Windows\System\SujvVUG.exe
  C:\Windows\System\SujvVUG.exe
  2⤵
  PID:7608
- C:\Windows\System\VUPEPEe.exe
  C:\Windows\System\VUPEPEe.exe
  2⤵
  PID:7624
- C:\Windows\System\eZdtuuo.exe
  C:\Windows\System\eZdtuuo.exe
  2⤵
  PID:7648
- C:\Windows\System\xGiJtSU.exe
  C:\Windows\System\xGiJtSU.exe
  2⤵
  PID:7720
- C:\Windows\System\wASWAnf.exe
  C:\Windows\System\wASWAnf.exe
  2⤵
  PID:7740
- C:\Windows\System\CJYAHKG.exe
  C:\Windows\System\CJYAHKG.exe
  2⤵
  PID:7772
- C:\Windows\System\YgczClh.exe
  C:\Windows\System\YgczClh.exe
  2⤵
  PID:7792
- C:\Windows\System\suTttiL.exe
  C:\Windows\System\suTttiL.exe
  2⤵
  PID:7888
- C:\Windows\System\jJsqMGf.exe
  C:\Windows\System\jJsqMGf.exe
  2⤵
  PID:7944
- C:\Windows\System\ismWRmM.exe
  C:\Windows\System\ismWRmM.exe
  2⤵
  PID:7968
- C:\Windows\System\nuAJzdN.exe
  C:\Windows\System\nuAJzdN.exe
  2⤵
  PID:7992
- C:\Windows\System\IGYqEWc.exe
  C:\Windows\System\IGYqEWc.exe
  2⤵
  PID:8036
- C:\Windows\System\cpqbGMd.exe
  C:\Windows\System\cpqbGMd.exe
  2⤵
  PID:8064
- C:\Windows\System\IEncdOV.exe
  C:\Windows\System\IEncdOV.exe
  2⤵
  PID:8084
- C:\Windows\System\UtinrZu.exe
  C:\Windows\System\UtinrZu.exe
  2⤵
  PID:8100
- C:\Windows\System\LiQPWDt.exe
  C:\Windows\System\LiQPWDt.exe
  2⤵
  PID:8128
- C:\Windows\System\JlVDmgj.exe
  C:\Windows\System\JlVDmgj.exe
  2⤵
  PID:8144
- C:\Windows\System\jmVjerc.exe
  C:\Windows\System\jmVjerc.exe
  2⤵
  PID:8164
- C:\Windows\System\hpgpViW.exe
  C:\Windows\System\hpgpViW.exe
  2⤵
  PID:6520
- C:\Windows\System\MLsxRFM.exe
  C:\Windows\System\MLsxRFM.exe
  2⤵
  PID:7000
- C:\Windows\System\XmEKtTb.exe
  C:\Windows\System\XmEKtTb.exe
  2⤵
  PID:7240
- C:\Windows\System\xBrFiYt.exe
  C:\Windows\System\xBrFiYt.exe
  2⤵
  PID:7356
- C:\Windows\System\vnpRJIn.exe
  C:\Windows\System\vnpRJIn.exe
  2⤵
  PID:7428
- C:\Windows\System\XTaPPrb.exe
  C:\Windows\System\XTaPPrb.exe
  2⤵
  PID:7472
- C:\Windows\System\nweGZug.exe
  C:\Windows\System\nweGZug.exe
  2⤵
  PID:7268
- C:\Windows\System\WkDvCnp.exe
  C:\Windows\System\WkDvCnp.exe
  2⤵
  PID:7364
- C:\Windows\System\bSFhDsc.exe
  C:\Windows\System\bSFhDsc.exe
  2⤵
  PID:7576
- C:\Windows\System\AHAuHuh.exe
  C:\Windows\System\AHAuHuh.exe
  2⤵
  PID:7620
- C:\Windows\System\iFROIUR.exe
  C:\Windows\System\iFROIUR.exe
  2⤵
  PID:7676
- C:\Windows\System\bGpjzek.exe
  C:\Windows\System\bGpjzek.exe
  2⤵
  PID:7824
- C:\Windows\System\OqNURfW.exe
  C:\Windows\System\OqNURfW.exe
  2⤵
  PID:7732
- C:\Windows\System\nZzfjPg.exe
  C:\Windows\System\nZzfjPg.exe
  2⤵
  PID:7844
- C:\Windows\System\rRFGcTd.exe
  C:\Windows\System\rRFGcTd.exe
  2⤵
  PID:7984
- C:\Windows\System\MaRNhKy.exe
  C:\Windows\System\MaRNhKy.exe
  2⤵
  PID:8028
- C:\Windows\System\ADraOPm.exe
  C:\Windows\System\ADraOPm.exe
  2⤵
  PID:8092
- C:\Windows\System\nwuXsRf.exe
  C:\Windows\System\nwuXsRf.exe
  2⤵
  PID:8116
- C:\Windows\System\FKKRZkr.exe
  C:\Windows\System\FKKRZkr.exe
  2⤵
  PID:8156
- C:\Windows\System\qmpVBGs.exe
  C:\Windows\System\qmpVBGs.exe
  2⤵
  PID:7408
- C:\Windows\System\IlFTBsK.exe
  C:\Windows\System\IlFTBsK.exe
  2⤵
  PID:3420
- C:\Windows\System\DSJrKhR.exe
  C:\Windows\System\DSJrKhR.exe
  2⤵
  PID:7536
- C:\Windows\System\qajqgXM.exe
  C:\Windows\System\qajqgXM.exe
  2⤵
  PID:7696
- C:\Windows\System\ZwsdrVF.exe
  C:\Windows\System\ZwsdrVF.exe
  2⤵
  PID:7752
- C:\Windows\System\odEawVH.exe
  C:\Windows\System\odEawVH.exe
  2⤵
  PID:8072
- C:\Windows\System\XDBoYqa.exe
  C:\Windows\System\XDBoYqa.exe
  2⤵
  PID:8152
- C:\Windows\System\GthiRIP.exe
  C:\Windows\System\GthiRIP.exe
  2⤵
  PID:7388
- C:\Windows\System\BzgFdym.exe
  C:\Windows\System\BzgFdym.exe
  2⤵
  PID:7716
- C:\Windows\System\YBCVicY.exe
  C:\Windows\System\YBCVicY.exe
  2⤵
  PID:8204
- C:\Windows\System\XiSvbFf.exe
  C:\Windows\System\XiSvbFf.exe
  2⤵
  PID:8252
- C:\Windows\System\qsjqAGZ.exe
  C:\Windows\System\qsjqAGZ.exe
  2⤵
  PID:8268
- C:\Windows\System\lqCkfWB.exe
  C:\Windows\System\lqCkfWB.exe
  2⤵
  PID:8284
- C:\Windows\System\QfiaiTN.exe
  C:\Windows\System\QfiaiTN.exe
  2⤵
  PID:8304
- C:\Windows\System\UGaFffM.exe
  C:\Windows\System\UGaFffM.exe
  2⤵
  PID:8332
- C:\Windows\System\bYNMNfW.exe
  C:\Windows\System\bYNMNfW.exe
  2⤵
  PID:8400
- C:\Windows\System\iuZPoYL.exe
  C:\Windows\System\iuZPoYL.exe
  2⤵
  PID:8428
- C:\Windows\System\VWhEYRu.exe
  C:\Windows\System\VWhEYRu.exe
  2⤵
  PID:8444
- C:\Windows\System\iihAhgO.exe
  C:\Windows\System\iihAhgO.exe
  2⤵
  PID:8464
- C:\Windows\System\QmHIdzO.exe
  C:\Windows\System\QmHIdzO.exe
  2⤵
  PID:8512
- C:\Windows\System\yNxgZOU.exe
  C:\Windows\System\yNxgZOU.exe
  2⤵
  PID:8528
- C:\Windows\System\rYmFrKJ.exe
  C:\Windows\System\rYmFrKJ.exe
  2⤵
  PID:8548
- C:\Windows\System\VysEywj.exe
  C:\Windows\System\VysEywj.exe
  2⤵
  PID:8580
- C:\Windows\System\jPNjHmW.exe
  C:\Windows\System\jPNjHmW.exe
  2⤵
  PID:8608
- C:\Windows\System\MXnGggU.exe
  C:\Windows\System\MXnGggU.exe
  2⤵
  PID:8660
- C:\Windows\System\cNHPsDp.exe
  C:\Windows\System\cNHPsDp.exe
  2⤵
  PID:8676
- C:\Windows\System\WFFCLXp.exe
  C:\Windows\System\WFFCLXp.exe
  2⤵
  PID:8712
- C:\Windows\System\VJbnctq.exe
  C:\Windows\System\VJbnctq.exe
  2⤵
  PID:8728
- C:\Windows\System\ovoMNEk.exe
  C:\Windows\System\ovoMNEk.exe
  2⤵
  PID:8772
- C:\Windows\System\bczCzyl.exe
  C:\Windows\System\bczCzyl.exe
  2⤵
  PID:8796
- C:\Windows\System\PRLphgo.exe
  C:\Windows\System\PRLphgo.exe
  2⤵
  PID:8840
- C:\Windows\System\gBcbcwK.exe
  C:\Windows\System\gBcbcwK.exe
  2⤵
  PID:8880
- C:\Windows\System\VrPGOJY.exe
  C:\Windows\System\VrPGOJY.exe
  2⤵
  PID:8912
- C:\Windows\System\lFGXuFu.exe
  C:\Windows\System\lFGXuFu.exe
  2⤵
  PID:8928
- C:\Windows\System\PFDEyKx.exe
  C:\Windows\System\PFDEyKx.exe
  2⤵
  PID:8988
- C:\Windows\System\nafvLYj.exe
  C:\Windows\System\nafvLYj.exe
  2⤵
  PID:9012
- C:\Windows\System\BlycjAW.exe
  C:\Windows\System\BlycjAW.exe
  2⤵
  PID:9036
- C:\Windows\System\WmhLrZu.exe
  C:\Windows\System\WmhLrZu.exe
  2⤵
  PID:9056
- C:\Windows\System\YeBrkwv.exe
  C:\Windows\System\YeBrkwv.exe
  2⤵
  PID:9084
- C:\Windows\System\vLnVsdQ.exe
  C:\Windows\System\vLnVsdQ.exe
  2⤵
  PID:9116
- C:\Windows\System\IqCQEEQ.exe
  C:\Windows\System\IqCQEEQ.exe
  2⤵
  PID:9144
- C:\Windows\System\dLmQHSD.exe
  C:\Windows\System\dLmQHSD.exe
  2⤵
  PID:9176
- C:\Windows\System\ZEWvrZw.exe
  C:\Windows\System\ZEWvrZw.exe
  2⤵
  PID:9204
- C:\Windows\System\RDqHemJ.exe
  C:\Windows\System\RDqHemJ.exe
  2⤵
  PID:7940
- C:\Windows\System\DPyfxfa.exe
  C:\Windows\System\DPyfxfa.exe
  2⤵
  PID:7496
- C:\Windows\System\aDOLnMT.exe
  C:\Windows\System\aDOLnMT.exe
  2⤵
  PID:8276
- C:\Windows\System\hBUXxxP.exe
  C:\Windows\System\hBUXxxP.exe
  2⤵
  PID:7520
- C:\Windows\System\HVVvhYJ.exe
  C:\Windows\System\HVVvhYJ.exe
  2⤵
  PID:8324
- C:\Windows\System\bCvenJk.exe
  C:\Windows\System\bCvenJk.exe
  2⤵
  PID:8352
- C:\Windows\System\QGTVCQk.exe
  C:\Windows\System\QGTVCQk.exe
  2⤵
  PID:8260
- C:\Windows\System\UaXRvqk.exe
  C:\Windows\System\UaXRvqk.exe
  2⤵
  PID:8472
- C:\Windows\System\qAvpMCj.exe
  C:\Windows\System\qAvpMCj.exe
  2⤵
  PID:8496
- C:\Windows\System\epCHwDn.exe
  C:\Windows\System\epCHwDn.exe
  2⤵
  PID:8576
- C:\Windows\System\aAETbEl.exe
  C:\Windows\System\aAETbEl.exe
  2⤵
  PID:8720
- C:\Windows\System\nnciPPD.exe
  C:\Windows\System\nnciPPD.exe
  2⤵
  PID:8768
- C:\Windows\System\uhFpnKs.exe
  C:\Windows\System\uhFpnKs.exe
  2⤵
  PID:8872
- C:\Windows\System\wyYEEmr.exe
  C:\Windows\System\wyYEEmr.exe
  2⤵
  PID:8852
- C:\Windows\System\GEQfeOj.exe
  C:\Windows\System\GEQfeOj.exe
  2⤵
  PID:8920
- C:\Windows\System\JIfeThW.exe
  C:\Windows\System\JIfeThW.exe
  2⤵
  PID:9020
- C:\Windows\System\kvhohfG.exe
  C:\Windows\System\kvhohfG.exe
  2⤵
  PID:9076
- C:\Windows\System\LqwTbAj.exe
  C:\Windows\System\LqwTbAj.exe
  2⤵
  PID:9188
- C:\Windows\System\UmHPrcR.exe
  C:\Windows\System\UmHPrcR.exe
  2⤵
  PID:8060
- C:\Windows\System\ZMWwhIX.exe
  C:\Windows\System\ZMWwhIX.exe
  2⤵
  PID:7180
- C:\Windows\System\WckceMS.exe
  C:\Windows\System\WckceMS.exe
  2⤵
  PID:8476
- C:\Windows\System\TszWCnm.exe
  C:\Windows\System\TszWCnm.exe
  2⤵
  PID:8368
- C:\Windows\System\kDVwKGL.exe
  C:\Windows\System\kDVwKGL.exe
  2⤵
  PID:8600
- C:\Windows\System\JgpKYmG.exe
  C:\Windows\System\JgpKYmG.exe
  2⤵
  PID:8876
- C:\Windows\System\xQjIcSo.exe
  C:\Windows\System\xQjIcSo.exe
  2⤵
  PID:8980
- C:\Windows\System\vfoeYuU.exe
  C:\Windows\System\vfoeYuU.exe
  2⤵
  PID:9080
- C:\Windows\System\FPAGiDp.exe
  C:\Windows\System\FPAGiDp.exe
  2⤵
  PID:9128
- C:\Windows\System\RyLQbsi.exe
  C:\Windows\System\RyLQbsi.exe
  2⤵
  PID:388
- C:\Windows\System\YiPITCE.exe
  C:\Windows\System\YiPITCE.exe
  2⤵
  PID:7932
- C:\Windows\System\oAJVsVU.exe
  C:\Windows\System\oAJVsVU.exe
  2⤵
  PID:820
- C:\Windows\System\eRCFZzW.exe
  C:\Windows\System\eRCFZzW.exe
  2⤵
  PID:9004
- C:\Windows\System\atfxtdD.exe
  C:\Windows\System\atfxtdD.exe
  2⤵
  PID:9196
- C:\Windows\System\UUougrz.exe
  C:\Windows\System\UUougrz.exe
  2⤵
  PID:9248
- C:\Windows\System\JHaVbDK.exe
  C:\Windows\System\JHaVbDK.exe
  2⤵
  PID:9296
- C:\Windows\System\wpFrUlF.exe
  C:\Windows\System\wpFrUlF.exe
  2⤵
  PID:9320
- C:\Windows\System\FZwkYtq.exe
  C:\Windows\System\FZwkYtq.exe
  2⤵
  PID:9356
- C:\Windows\System\QIpqaPo.exe
  C:\Windows\System\QIpqaPo.exe
  2⤵
  PID:9372
- C:\Windows\System\QpVOzEy.exe
  C:\Windows\System\QpVOzEy.exe
  2⤵
  PID:9396
- C:\Windows\System\zNZxaeP.exe
  C:\Windows\System\zNZxaeP.exe
  2⤵
  PID:9448
- C:\Windows\System\OcPqFkl.exe
  C:\Windows\System\OcPqFkl.exe
  2⤵
  PID:9464
- C:\Windows\System\PjWEYYY.exe
  C:\Windows\System\PjWEYYY.exe
  2⤵
  PID:9492
- C:\Windows\System\ARMnjuz.exe
  C:\Windows\System\ARMnjuz.exe
  2⤵
  PID:9544
- C:\Windows\System\fwkVBlm.exe
  C:\Windows\System\fwkVBlm.exe
  2⤵
  PID:9576
- C:\Windows\System\nasLhhz.exe
  C:\Windows\System\nasLhhz.exe
  2⤵
  PID:9600
- C:\Windows\System\aDGiONX.exe
  C:\Windows\System\aDGiONX.exe
  2⤵
  PID:9624
- C:\Windows\System\DrTywke.exe
  C:\Windows\System\DrTywke.exe
  2⤵
  PID:9668
- C:\Windows\System\LmTxXib.exe
  C:\Windows\System\LmTxXib.exe
  2⤵
  PID:9684
- C:\Windows\System\oCJQlwQ.exe
  C:\Windows\System\oCJQlwQ.exe
  2⤵
  PID:9704
- C:\Windows\System\LawZYVk.exe
  C:\Windows\System\LawZYVk.exe
  2⤵
  PID:9736
- C:\Windows\System\LTWewYQ.exe
  C:\Windows\System\LTWewYQ.exe
  2⤵
  PID:9752
- C:\Windows\System\mPomMAq.exe
  C:\Windows\System\mPomMAq.exe
  2⤵
  PID:9772
- C:\Windows\System\UptUYFo.exe
  C:\Windows\System\UptUYFo.exe
  2⤵
  PID:9820
- C:\Windows\System\vVZEbmM.exe
  C:\Windows\System\vVZEbmM.exe
  2⤵
  PID:9840
- C:\Windows\System\XfBBtJq.exe
  C:\Windows\System\XfBBtJq.exe
  2⤵
  PID:9864
- C:\Windows\System\SXhaUIR.exe
  C:\Windows\System\SXhaUIR.exe
  2⤵
  PID:9900
- C:\Windows\System\QWkXToc.exe
  C:\Windows\System\QWkXToc.exe
  2⤵
  PID:9944
- C:\Windows\System\KkBKMtC.exe
  C:\Windows\System\KkBKMtC.exe
  2⤵
  PID:9972
- C:\Windows\System\JXGHboz.exe
  C:\Windows\System\JXGHboz.exe
  2⤵
  PID:10000
- C:\Windows\System\cikZGuI.exe
  C:\Windows\System\cikZGuI.exe
  2⤵
  PID:10020
- C:\Windows\System\gcbCpic.exe
  C:\Windows\System\gcbCpic.exe
  2⤵
  PID:10060
- C:\Windows\System\UQmwmDX.exe
  C:\Windows\System\UQmwmDX.exe
  2⤵
  PID:10088
- C:\Windows\System\pOYoHrM.exe
  C:\Windows\System\pOYoHrM.exe
  2⤵
  PID:10112
- C:\Windows\System\FmOSkBC.exe
  C:\Windows\System\FmOSkBC.exe
  2⤵
  PID:10152
- C:\Windows\System\NAeWXZw.exe
  C:\Windows\System\NAeWXZw.exe
  2⤵
  PID:10172
- C:\Windows\System\SRgZBKZ.exe
  C:\Windows\System\SRgZBKZ.exe
  2⤵
  PID:10196
- C:\Windows\System\DwYxdub.exe
  C:\Windows\System\DwYxdub.exe
  2⤵
  PID:10220
- C:\Windows\System\qtDYZix.exe
  C:\Windows\System\qtDYZix.exe
  2⤵
  PID:8240
- C:\Windows\System\pRUYHTx.exe
  C:\Windows\System\pRUYHTx.exe
  2⤵
  PID:8788
- C:\Windows\System\ZnhjkTD.exe
  C:\Windows\System\ZnhjkTD.exe
  2⤵
  PID:8640
- C:\Windows\System\GSyTfsj.exe
  C:\Windows\System\GSyTfsj.exe
  2⤵
  PID:9240
- C:\Windows\System\GxjDBLw.exe
  C:\Windows\System\GxjDBLw.exe
  2⤵
  PID:9280
- C:\Windows\System\AAaDnKd.exe
  C:\Windows\System\AAaDnKd.exe
  2⤵
  PID:9392
- C:\Windows\System\AGsVoBV.exe
  C:\Windows\System\AGsVoBV.exe
  2⤵
  PID:9436
- C:\Windows\System\lPVdVOr.exe
  C:\Windows\System\lPVdVOr.exe
  2⤵
  PID:9456
- C:\Windows\System\vJCZqFu.exe
  C:\Windows\System\vJCZqFu.exe
  2⤵
  PID:9592
- C:\Windows\System\vxZDkzM.exe
  C:\Windows\System\vxZDkzM.exe
  2⤵
  PID:9612
- C:\Windows\System\LpslKhL.exe
  C:\Windows\System\LpslKhL.exe
  2⤵
  PID:9744
- C:\Windows\System\phhhkrs.exe
  C:\Windows\System\phhhkrs.exe
  2⤵
  PID:9848
- C:\Windows\System\SDTAzsJ.exe
  C:\Windows\System\SDTAzsJ.exe
  2⤵
  PID:9892
- C:\Windows\System\gXOCUJG.exe
  C:\Windows\System\gXOCUJG.exe
  2⤵
  PID:9984
- C:\Windows\System\oCOlkmW.exe
  C:\Windows\System\oCOlkmW.exe
  2⤵
  PID:9988
- C:\Windows\System\tvZirJi.exe
  C:\Windows\System\tvZirJi.exe
  2⤵
  PID:10052
- C:\Windows\System\CcSjTGx.exe
  C:\Windows\System\CcSjTGx.exe
  2⤵
  PID:10108
- C:\Windows\System\itOoJTK.exe
  C:\Windows\System\itOoJTK.exe
  2⤵
  PID:10184
- C:\Windows\System\GysjLcZ.exe
  C:\Windows\System\GysjLcZ.exe
  2⤵
  PID:9408
- C:\Windows\System\papPfSg.exe
  C:\Windows\System\papPfSg.exe
  2⤵
  PID:9540
- C:\Windows\System\peXAQra.exe
  C:\Windows\System\peXAQra.exe
  2⤵
  PID:9588
- C:\Windows\System\pZoZhDw.exe
  C:\Windows\System\pZoZhDw.exe
  2⤵
  PID:9764
- C:\Windows\System\UPNceti.exe
  C:\Windows\System\UPNceti.exe
  2⤵
  PID:9696
- C:\Windows\System\cAhoPeW.exe
  C:\Windows\System\cAhoPeW.exe
  2⤵
  PID:9968
- C:\Windows\System\rQLaXnr.exe
  C:\Windows\System\rQLaXnr.exe
  2⤵
  PID:9952
- C:\Windows\System\qOhSSeN.exe
  C:\Windows\System\qOhSSeN.exe
  2⤵
  PID:10084
- C:\Windows\System\ErPHdpd.exe
  C:\Windows\System\ErPHdpd.exe
  2⤵
  PID:9416
- C:\Windows\System\MEXZbBO.exe
  C:\Windows\System\MEXZbBO.exe
  2⤵
  PID:9800
- C:\Windows\System\EjnTpCj.exe
  C:\Windows\System\EjnTpCj.exe
  2⤵
  PID:10180
- C:\Windows\System\CUDuDLU.exe
  C:\Windows\System\CUDuDLU.exe
  2⤵
  PID:10168
- C:\Windows\System\yuyLJXp.exe
  C:\Windows\System\yuyLJXp.exe
  2⤵
  PID:10256
- C:\Windows\System\ZxqcwEe.exe
  C:\Windows\System\ZxqcwEe.exe
  2⤵
  PID:10300
- C:\Windows\System\qvLheIl.exe
  C:\Windows\System\qvLheIl.exe
  2⤵
  PID:10316
- C:\Windows\System\xNrlzRE.exe
  C:\Windows\System\xNrlzRE.exe
  2⤵
  PID:10344
- C:\Windows\System\rMUduYa.exe
  C:\Windows\System\rMUduYa.exe
  2⤵
  PID:10364
- C:\Windows\System\sybQxVR.exe
  C:\Windows\System\sybQxVR.exe
  2⤵
  PID:10380
- C:\Windows\System\ApHkVTC.exe
  C:\Windows\System\ApHkVTC.exe
  2⤵
  PID:10400
- C:\Windows\System\RSwEdFZ.exe
  C:\Windows\System\RSwEdFZ.exe
  2⤵
  PID:10416
- C:\Windows\System\RRJhREB.exe
  C:\Windows\System\RRJhREB.exe
  2⤵
  PID:10444
- C:\Windows\System\pywsaFJ.exe
  C:\Windows\System\pywsaFJ.exe
  2⤵
  PID:10464
- C:\Windows\System\prplaJv.exe
  C:\Windows\System\prplaJv.exe
  2⤵
  PID:10484
- C:\Windows\System\IiJghJZ.exe
  C:\Windows\System\IiJghJZ.exe
  2⤵
  PID:10516
- C:\Windows\System\SuSKIlQ.exe
  C:\Windows\System\SuSKIlQ.exe
  2⤵
  PID:10536
- C:\Windows\System\nNhDzdA.exe
  C:\Windows\System\nNhDzdA.exe
  2⤵
  PID:10576
- C:\Windows\System\tUeRTYP.exe
  C:\Windows\System\tUeRTYP.exe
  2⤵
  PID:10644
- C:\Windows\System\ISvxHzf.exe
  C:\Windows\System\ISvxHzf.exe
  2⤵
  PID:10664
- C:\Windows\System\ZbNNprB.exe
  C:\Windows\System\ZbNNprB.exe
  2⤵
  PID:10692
- C:\Windows\System\tFFjQqP.exe
  C:\Windows\System\tFFjQqP.exe
  2⤵
  PID:10712
- C:\Windows\System\ThoisOl.exe
  C:\Windows\System\ThoisOl.exe
  2⤵
  PID:10736
- C:\Windows\System\VvIRkmm.exe
  C:\Windows\System\VvIRkmm.exe
  2⤵
  PID:10780
- C:\Windows\System\bkgJGCw.exe
  C:\Windows\System\bkgJGCw.exe
  2⤵
  PID:10820
- C:\Windows\System\COavwms.exe
  C:\Windows\System\COavwms.exe
  2⤵
  PID:10844
- C:\Windows\System\Gvdvjng.exe
  C:\Windows\System\Gvdvjng.exe
  2⤵
  PID:10872
- C:\Windows\System\nrJuQug.exe
  C:\Windows\System\nrJuQug.exe
  2⤵
  PID:10908
- C:\Windows\System\xvJTClj.exe
  C:\Windows\System\xvJTClj.exe
  2⤵
  PID:10940
- C:\Windows\System\oCLBlAS.exe
  C:\Windows\System\oCLBlAS.exe
  2⤵
  PID:10976
- C:\Windows\System\jMGvxVm.exe
  C:\Windows\System\jMGvxVm.exe
  2⤵
  PID:10996
- C:\Windows\System\zHBcDDw.exe
  C:\Windows\System\zHBcDDw.exe
  2⤵
  PID:11020
- C:\Windows\System\rgXqLym.exe
  C:\Windows\System\rgXqLym.exe
  2⤵
  PID:11040
- C:\Windows\System\UJEMOoJ.exe
  C:\Windows\System\UJEMOoJ.exe
  2⤵
  PID:11064
- C:\Windows\System\ZiPHXkI.exe
  C:\Windows\System\ZiPHXkI.exe
  2⤵
  PID:11084
- C:\Windows\System\KUdpvtl.exe
  C:\Windows\System\KUdpvtl.exe
  2⤵
  PID:11108
- C:\Windows\System\KpHOlSH.exe
  C:\Windows\System\KpHOlSH.exe
  2⤵
  PID:11124
- C:\Windows\System\GPfJHpy.exe
  C:\Windows\System\GPfJHpy.exe
  2⤵
  PID:11144
- C:\Windows\System\WeuNqek.exe
  C:\Windows\System\WeuNqek.exe
  2⤵
  PID:11164
- C:\Windows\System\lyJKbBe.exe
  C:\Windows\System\lyJKbBe.exe
  2⤵
  PID:11200
- C:\Windows\System\RoXcyel.exe
  C:\Windows\System\RoXcyel.exe
  2⤵
  PID:11248
- C:\Windows\System\yljrQXb.exe
  C:\Windows\System\yljrQXb.exe
  2⤵
  PID:10012
- C:\Windows\System\jmqQmpP.exe
  C:\Windows\System\jmqQmpP.exe
  2⤵
  PID:9732
- C:\Windows\System\JuUZrsn.exe
  C:\Windows\System\JuUZrsn.exe
  2⤵
  PID:10352
- C:\Windows\System\JEhQGGN.exe
  C:\Windows\System\JEhQGGN.exe
  2⤵
  PID:10432
- C:\Windows\System\ELdBjlm.exe
  C:\Windows\System\ELdBjlm.exe
  2⤵
  PID:10552
- C:\Windows\System\VxWjZkz.exe
  C:\Windows\System\VxWjZkz.exe
  2⤵
  PID:10628
- C:\Windows\System\CsuXHzY.exe
  C:\Windows\System\CsuXHzY.exe
  2⤵
  PID:10616
- C:\Windows\System\qkxBIGr.exe
  C:\Windows\System\qkxBIGr.exe
  2⤵
  PID:10748
- C:\Windows\System\JfNevkw.exe
  C:\Windows\System\JfNevkw.exe
  2⤵
  PID:10816
- C:\Windows\System\KAfkfRb.exe
  C:\Windows\System\KAfkfRb.exe
  2⤵
  PID:10960
- C:\Windows\System\lIgRfal.exe
  C:\Windows\System\lIgRfal.exe
  2⤵
  PID:10964
- C:\Windows\System\kqYIghM.exe
  C:\Windows\System\kqYIghM.exe
  2⤵
  PID:11012
- C:\Windows\System\DpmEQlw.exe
  C:\Windows\System\DpmEQlw.exe
  2⤵
  PID:11076
- C:\Windows\System\dyTHLFN.exe
  C:\Windows\System\dyTHLFN.exe
  2⤵
  PID:11116
- C:\Windows\System\bTXOSpf.exe
  C:\Windows\System\bTXOSpf.exe
  2⤵
  PID:11260
- C:\Windows\System\nPLGrWl.exe
  C:\Windows\System\nPLGrWl.exe
  2⤵
  PID:11236
- C:\Windows\System\NnUvTKT.exe
  C:\Windows\System\NnUvTKT.exe
  2⤵
  PID:10252
- C:\Windows\System\FCgmwfD.exe
  C:\Windows\System\FCgmwfD.exe
  2⤵
  PID:10460
- C:\Windows\System\uValJCy.exe
  C:\Windows\System\uValJCy.exe
  2⤵
  PID:10476
- C:\Windows\System\numidGD.exe
  C:\Windows\System\numidGD.exe
  2⤵
  PID:10728
- C:\Windows\System\taWdQpL.exe
  C:\Windows\System\taWdQpL.exe
  2⤵
  PID:10804
- C:\Windows\System\jMMWUQS.exe
  C:\Windows\System\jMMWUQS.exe
  2⤵
  PID:10932
- C:\Windows\System\zDYPQOu.exe
  C:\Windows\System\zDYPQOu.exe
  2⤵
  PID:9488
- C:\Windows\System\BSSKWIH.exe
  C:\Windows\System\BSSKWIH.exe
  2⤵
  PID:9940
- C:\Windows\System\uTlhamR.exe
  C:\Windows\System\uTlhamR.exe
  2⤵
  PID:10504
- C:\Windows\System\iKcDXty.exe
  C:\Windows\System\iKcDXty.exe
  2⤵
  PID:10776
- C:\Windows\System\BldkRXF.exe
  C:\Windows\System\BldkRXF.exe
  2⤵
  PID:11288
- C:\Windows\System\EQRfoWY.exe
  C:\Windows\System\EQRfoWY.exe
  2⤵
  PID:11308
- C:\Windows\System\EALVPQt.exe
  C:\Windows\System\EALVPQt.exe
  2⤵
  PID:11328
- C:\Windows\System\KLgizYF.exe
  C:\Windows\System\KLgizYF.exe
  2⤵
  PID:11432
- C:\Windows\System\leqZrdY.exe
  C:\Windows\System\leqZrdY.exe
  2⤵
  PID:11448
- C:\Windows\System\PaKkbWl.exe
  C:\Windows\System\PaKkbWl.exe
  2⤵
  PID:11464
- C:\Windows\System\dnnTLTl.exe
  C:\Windows\System\dnnTLTl.exe
  2⤵
  PID:11496
- C:\Windows\System\xqdWaDU.exe
  C:\Windows\System\xqdWaDU.exe
  2⤵
  PID:11524
- C:\Windows\System\YnLmEzp.exe
  C:\Windows\System\YnLmEzp.exe
  2⤵
  PID:11548
- C:\Windows\System\WkBtMbB.exe
  C:\Windows\System\WkBtMbB.exe
  2⤵
  PID:11568
- C:\Windows\System\ictDLDR.exe
  C:\Windows\System\ictDLDR.exe
  2⤵
  PID:11612
- C:\Windows\System\QtVxruZ.exe
  C:\Windows\System\QtVxruZ.exe
  2⤵
  PID:11628
- C:\Windows\System\NIzCjVa.exe
  C:\Windows\System\NIzCjVa.exe
  2⤵
  PID:11648
- C:\Windows\System\blhOvKS.exe
  C:\Windows\System\blhOvKS.exe
  2⤵
  PID:11664
- C:\Windows\System\ibvUrwj.exe
  C:\Windows\System\ibvUrwj.exe
  2⤵
  PID:11708
- C:\Windows\System\uTvQlJG.exe
  C:\Windows\System\uTvQlJG.exe
  2⤵
  PID:11736
- C:\Windows\System\eRsDdWo.exe
  C:\Windows\System\eRsDdWo.exe
  2⤵
  PID:11752
- C:\Windows\System\HufDIBY.exe
  C:\Windows\System\HufDIBY.exe
  2⤵
  PID:11776
- C:\Windows\System\PjEOzUw.exe
  C:\Windows\System\PjEOzUw.exe
  2⤵
  PID:11796
- C:\Windows\System\ROWLcCL.exe
  C:\Windows\System\ROWLcCL.exe
  2⤵
  PID:11840
- C:\Windows\System\utTIaNS.exe
  C:\Windows\System\utTIaNS.exe
  2⤵
  PID:11864
- C:\Windows\System\BPOeMCs.exe
  C:\Windows\System\BPOeMCs.exe
  2⤵
  PID:11880
- C:\Windows\System\vwByeZw.exe
  C:\Windows\System\vwByeZw.exe
  2⤵
  PID:11920
- C:\Windows\System\RbhCPcM.exe
  C:\Windows\System\RbhCPcM.exe
  2⤵
  PID:11940
- C:\Windows\System\frEZsNJ.exe
  C:\Windows\System\frEZsNJ.exe
  2⤵
  PID:11956
- C:\Windows\System\XYNiWcb.exe
  C:\Windows\System\XYNiWcb.exe
  2⤵
  PID:11980
- C:\Windows\System\nOtJoPw.exe
  C:\Windows\System\nOtJoPw.exe
  2⤵
  PID:12004
- C:\Windows\System\fWKOkkK.exe
  C:\Windows\System\fWKOkkK.exe
  2⤵
  PID:12024
- C:\Windows\System\KrEbvnz.exe
  C:\Windows\System\KrEbvnz.exe
  2⤵
  PID:12048
- C:\Windows\System\nvglcfz.exe
  C:\Windows\System\nvglcfz.exe
  2⤵
  PID:12068
- C:\Windows\System\tYXIEii.exe
  C:\Windows\System\tYXIEii.exe
  2⤵
  PID:12084
- C:\Windows\System\ULdOIFA.exe
  C:\Windows\System\ULdOIFA.exe
  2⤵
  PID:12128
- C:\Windows\System\SLrFOvK.exe
  C:\Windows\System\SLrFOvK.exe
  2⤵
  PID:12188
- C:\Windows\System\ZqJJOpI.exe
  C:\Windows\System\ZqJJOpI.exe
  2⤵
  PID:12248
- C:\Windows\System\dezoLSs.exe
  C:\Windows\System\dezoLSs.exe
  2⤵
  PID:12280
- C:\Windows\System\hmwHPnT.exe
  C:\Windows\System\hmwHPnT.exe
  2⤵
  PID:10372
- C:\Windows\System\xvKigiB.exe
  C:\Windows\System\xvKigiB.exe
  2⤵
  PID:11268
- C:\Windows\System\WIoZsTg.exe
  C:\Windows\System\WIoZsTg.exe
  2⤵
  PID:11344
- C:\Windows\System\ozTsIcg.exe
  C:\Windows\System\ozTsIcg.exe
  2⤵
  PID:11408
- C:\Windows\System\bLHusbF.exe
  C:\Windows\System\bLHusbF.exe
  2⤵
  PID:11460
- C:\Windows\System\vvpYWby.exe
  C:\Windows\System\vvpYWby.exe
  2⤵
  PID:11532
- C:\Windows\System\TggkyHM.exe
  C:\Windows\System\TggkyHM.exe
  2⤵
  PID:11588
- C:\Windows\System\vQqHyjT.exe
  C:\Windows\System\vQqHyjT.exe
  2⤵
  PID:11640
- C:\Windows\System\BReSsAi.exe
  C:\Windows\System\BReSsAi.exe
  2⤵
  PID:11728
- C:\Windows\System\RoYBYGm.exe
  C:\Windows\System\RoYBYGm.exe
  2⤵
  PID:11768
- C:\Windows\System\GBJRycL.exe
  C:\Windows\System\GBJRycL.exe
  2⤵
  PID:11912
- C:\Windows\System\ilnTGPm.exe
  C:\Windows\System\ilnTGPm.exe
  2⤵
  PID:11848
- C:\Windows\System\lOoFoCH.exe
  C:\Windows\System\lOoFoCH.exe
  2⤵
  PID:12036
- C:\Windows\System\kpEBvce.exe
  C:\Windows\System\kpEBvce.exe
  2⤵
  PID:12056
- C:\Windows\System\PLGNuex.exe
  C:\Windows\System\PLGNuex.exe
  2⤵
  PID:12196
- C:\Windows\System\ZMbEfEV.exe
  C:\Windows\System\ZMbEfEV.exe
  2⤵
  PID:12176
- C:\Windows\System\uKyQPJX.exe
  C:\Windows\System\uKyQPJX.exe
  2⤵
  PID:11140
- C:\Windows\System\TywyAOP.exe
  C:\Windows\System\TywyAOP.exe
  2⤵
  PID:11104
- C:\Windows\System\xHsZjdJ.exe
  C:\Windows\System\xHsZjdJ.exe
  2⤵
  PID:11320
- C:\Windows\System\HDXUXbr.exe
  C:\Windows\System\HDXUXbr.exe
  2⤵
  PID:11444
- C:\Windows\System\UbLKVmT.exe
  C:\Windows\System\UbLKVmT.exe
  2⤵
  PID:11540
- C:\Windows\System\aZecWOB.exe
  C:\Windows\System\aZecWOB.exe
  2⤵
  PID:11636
- C:\Windows\System\hgZyKLa.exe
  C:\Windows\System\hgZyKLa.exe
  2⤵
  PID:11788
- C:\Windows\System\BQMkKoa.exe
  C:\Windows\System\BQMkKoa.exe
  2⤵
  PID:12020
- C:\Windows\System\ovIqRyN.exe
  C:\Windows\System\ovIqRyN.exe
  2⤵
  PID:11316
- C:\Windows\System\slXxTGy.exe
  C:\Windows\System\slXxTGy.exe
  2⤵
  PID:12240
- C:\Windows\System\UZQlnJa.exe
  C:\Windows\System\UZQlnJa.exe
  2⤵
  PID:11580
- C:\Windows\System\VdBhwAI.exe
  C:\Windows\System\VdBhwAI.exe
  2⤵
  PID:12116
- C:\Windows\System\jKGNiCv.exe
  C:\Windows\System\jKGNiCv.exe
  2⤵
  PID:12204
- C:\Windows\System\hSuNfri.exe
  C:\Windows\System\hSuNfri.exe
  2⤵
  PID:12292
- C:\Windows\System\hfUYglv.exe
  C:\Windows\System\hfUYglv.exe
  2⤵
  PID:12308
- C:\Windows\System\HllsLba.exe
  C:\Windows\System\HllsLba.exe
  2⤵
  PID:12332
- C:\Windows\System\fOrEUtr.exe
  C:\Windows\System\fOrEUtr.exe
  2⤵
  PID:12352
- C:\Windows\System\Uthqdbu.exe
  C:\Windows\System\Uthqdbu.exe
  2⤵
  PID:12384
- C:\Windows\System\JMqYjlQ.exe
  C:\Windows\System\JMqYjlQ.exe
  2⤵
  PID:12404
- C:\Windows\System\IrCSdGa.exe
  C:\Windows\System\IrCSdGa.exe
  2⤵
  PID:12424
- C:\Windows\System\ZZkVJal.exe
  C:\Windows\System\ZZkVJal.exe
  2⤵
  PID:12440
- C:\Windows\System\WvVlTeG.exe
  C:\Windows\System\WvVlTeG.exe
  2⤵
  PID:12460
- C:\Windows\System\fohagqn.exe
  C:\Windows\System\fohagqn.exe
  2⤵
  PID:12476
- C:\Windows\System\uvyEBUQ.exe
  C:\Windows\System\uvyEBUQ.exe
  2⤵
  PID:12520
- C:\Windows\System\VCYpXEg.exe
  C:\Windows\System\VCYpXEg.exe
  2⤵
  PID:12540
- C:\Windows\System\eeCLCzi.exe
  C:\Windows\System\eeCLCzi.exe
  2⤵
  PID:12620
- C:\Windows\System\PieqQQB.exe
  C:\Windows\System\PieqQQB.exe
  2⤵
  PID:12640
- C:\Windows\System\xUuFiLz.exe
  C:\Windows\System\xUuFiLz.exe
  2⤵
  PID:12660
- C:\Windows\System\vjQIJpX.exe
  C:\Windows\System\vjQIJpX.exe
  2⤵
  PID:12716
- C:\Windows\System\CowQqvY.exe
  C:\Windows\System\CowQqvY.exe
  2⤵
  PID:12740
- C:\Windows\System\URZrJXy.exe
  C:\Windows\System\URZrJXy.exe
  2⤵
  PID:12760
- C:\Windows\System\RngbOtg.exe
  C:\Windows\System\RngbOtg.exe
  2⤵
  PID:12780
- C:\Windows\System\lqDnAuX.exe
  C:\Windows\System\lqDnAuX.exe
  2⤵
  PID:12800
- C:\Windows\System\uxrplXh.exe
  C:\Windows\System\uxrplXh.exe
  2⤵
  PID:12868
- C:\Windows\System\kwXjeUI.exe
  C:\Windows\System\kwXjeUI.exe
  2⤵
  PID:12888
- C:\Windows\System\xWPBLMk.exe
  C:\Windows\System\xWPBLMk.exe
  2⤵
  PID:12904
- C:\Windows\System\lFGTCho.exe
  C:\Windows\System\lFGTCho.exe
  2⤵
  PID:12928
- C:\Windows\System\ZCKtsqe.exe
  C:\Windows\System\ZCKtsqe.exe
  2⤵
  PID:12948
- C:\Windows\System\BpyTAbW.exe
  C:\Windows\System\BpyTAbW.exe
  2⤵
  PID:12968
- C:\Windows\System\JgPHdBB.exe
  C:\Windows\System\JgPHdBB.exe
  2⤵
  PID:12996
- C:\Windows\System\lTxYSFh.exe
  C:\Windows\System\lTxYSFh.exe
  2⤵
  PID:13016
- C:\Windows\System\FQUppmw.exe
  C:\Windows\System\FQUppmw.exe
  2⤵
  PID:13068
- C:\Windows\System\lJmQdoI.exe
  C:\Windows\System\lJmQdoI.exe
  2⤵
  PID:13092
- C:\Windows\System\LeQQaZk.exe
  C:\Windows\System\LeQQaZk.exe
  2⤵
  PID:13112
- C:\Windows\System\XKjHaWj.exe
  C:\Windows\System\XKjHaWj.exe
  2⤵
  PID:13160
- C:\Windows\System\yxLFyOs.exe
  C:\Windows\System\yxLFyOs.exe
  2⤵
  PID:13212
- C:\Windows\System\wUxFFOo.exe
  C:\Windows\System\wUxFFOo.exe
  2⤵
  PID:13232
- C:\Windows\System\UTHEQXV.exe
  C:\Windows\System\UTHEQXV.exe
  2⤵
  PID:13252
- C:\Windows\System\NVdYwRy.exe
  C:\Windows\System\NVdYwRy.exe
  2⤵
  PID:13268
- C:\Windows\System\MesFbDX.exe
  C:\Windows\System\MesFbDX.exe
  2⤵
  PID:13288
- C:\Windows\System\YzHzGBs.exe
  C:\Windows\System\YzHzGBs.exe
  2⤵
  PID:13308
- C:\Windows\System\gllBDJB.exe
  C:\Windows\System\gllBDJB.exe
  2⤵
  PID:11744
- C:\Windows\System\zecLXrN.exe
  C:\Windows\System\zecLXrN.exe
  2⤵
  PID:12348
- C:\Windows\System\EKIihmd.exe
  C:\Windows\System\EKIihmd.exe
  2⤵
  PID:12500
- C:\Windows\System\jJrbrXh.exe
  C:\Windows\System\jJrbrXh.exe
  2⤵
  PID:12600
- C:\Windows\System\FJbbTvr.exe
  C:\Windows\System\FJbbTvr.exe
  2⤵
  PID:12636
- C:\Windows\System\LwPUKZt.exe
  C:\Windows\System\LwPUKZt.exe
  2⤵
  PID:12724
- C:\Windows\System\jWLNKEP.exe
  C:\Windows\System\jWLNKEP.exe
  2⤵
  PID:12728
- C:\Windows\System\JuwdsDg.exe
  C:\Windows\System\JuwdsDg.exe
  2⤵
  PID:12820
- C:\Windows\System\wBgYpEs.exe
  C:\Windows\System\wBgYpEs.exe
  2⤵
  PID:12840
- C:\Windows\System\UghJORi.exe
  C:\Windows\System\UghJORi.exe
  2⤵
  PID:12992
- C:\Windows\System\wtDRGfT.exe
  C:\Windows\System\wtDRGfT.exe
  2⤵
  PID:13120
- C:\Windows\System\epdJGvc.exe
  C:\Windows\System\epdJGvc.exe
  2⤵
  PID:13136
- C:\Windows\System\rgZiAvw.exe
  C:\Windows\System\rgZiAvw.exe
  2⤵
  PID:13052
- C:\Windows\System\VGBRbGg.exe
  C:\Windows\System\VGBRbGg.exe
  2⤵
  PID:13200
- C:\Windows\System\XejksaZ.exe
  C:\Windows\System\XejksaZ.exe
  2⤵
  PID:13276
- C:\Windows\System\lGAEDKK.exe
  C:\Windows\System\lGAEDKK.exe
  2⤵
  PID:10656
- C:\Windows\System\OqIFaxz.exe
  C:\Windows\System\OqIFaxz.exe
  2⤵
  PID:12556
- C:\Windows\System\PFOEEAK.exe
  C:\Windows\System\PFOEEAK.exe
  2⤵
  PID:12536
- C:\Windows\System\abRsVzM.exe
  C:\Windows\System\abRsVzM.exe
  2⤵
  PID:12632
- C:\Windows\System\TKAoJTI.exe
  C:\Windows\System\TKAoJTI.exe
  2⤵
  PID:12848
- C:\Windows\System\uoKZRlA.exe
  C:\Windows\System\uoKZRlA.exe
  2⤵
  PID:12864
- C:\Windows\System\fhePFlB.exe
  C:\Windows\System\fhePFlB.exe
  2⤵
  PID:13108
- C:\Windows\System\UtbOnkV.exe
  C:\Windows\System\UtbOnkV.exe
  2⤵
  PID:12324
- C:\Windows\System\xXUwvjB.exe
  C:\Windows\System\xXUwvjB.exe
  2⤵
  PID:13300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hn2cxc0g.x2j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AgwTksC.exe

Filesize
1.2MB

MD5
eafd4d468944b834081ce13db5a78b8b

SHA1
e021cfa9d9a563f9f4d5074909ba32bafb1524a4

SHA256
3f57d275636b326b5d7964f9da53a0976ada38333ea77e62c02db7dd424377cb

SHA512
d3911ebdf79f4c68627c7b7217067c72dfad3157c76c5f0ad24521b9e532fbdd5f9b869b864d8c3d0ed306c42da0584d1aaf8e36ea6281b31a8d8df466eac0af

Download Submit
C:\Windows\System\CACydvq.exe

Filesize
1.2MB

MD5
a7d322c9f075e289d56647f770bcba3f

SHA1
23b9325fca357d925ee2d364567a1746cf93ff1b

SHA256
0451ee90f57576e6a7edfd9f5f9801b142a50957844d54a72449ca7048c93191

SHA512
33e6eb2ca2f916fd68f45fc7926050a92b4b693f3cf4b6abe1c36d04a02de5559d7fee4a986188909dcc88c1cf1d2651caa093b134ac38e456030d3b9a8b84d5

Download Submit
C:\Windows\System\DENpXiS.exe

Filesize
1.2MB

MD5
e5b7f03072d8f629e1e5734feed9704f

SHA1
e4f41a6c776d9fc56fdde1b6a5960f00aa40cca3

SHA256
0e6600fe94d257a7020aa3c8126ec50e4146ca006b67e4e3b9c4815085ce4ff9

SHA512
2b200e914d7b4278a2e54cd05693789a96d3f7ac1f701a48af10618053ce504b9aac6a27ddace6d1178d3f44415eef30d4b83439255565fc669bc8e81082162e

Download Submit
C:\Windows\System\DavmGvK.exe

Filesize
1.2MB

MD5
ac5d43743e82bb8bd1fecd8f9558957c

SHA1
ff3a56ce361476823f267f852f64b9160a180a7c

SHA256
0586304a7118bdd63f8ba45c160d2f3c8b2f93f8b009dd4f66029595014f7ca4

SHA512
e6ea6f23fbd96bb7c8635d915f3bbfd9beca8217675bb7f09de5366544d6b6e627146460187484c3b8c1d8bec3f5a52695870d696a7fa74b88e877a8006497d7

Download Submit
C:\Windows\System\FZeRZaK.exe

Filesize
1.2MB

MD5
87695db769ba095f8bcab24c720e87aa

SHA1
ef9a54f5f666f2d496bac524330ce5d753fb8112

SHA256
bed15960a50efb48f0a9ceff1e46e0e4db493581e9544f45bada6dff2975eb86

SHA512
d6d27f2fafd42ec6d453d8e5126a79639a56253ab25f8531d7e55f2046a78a4d78a5a7f7bd2a84eeda23e16165e8b7cf4c987ec7e925d18494ae3b6d2b0caa86

Download Submit
C:\Windows\System\GBHklyL.exe

Filesize
1.2MB

MD5
840969e204fd458948036f0c8379ac81

SHA1
496c42915b5a4af862f294d2a5866f9693d5276f

SHA256
6d0a4581a89083b6f7eafc0cad628e59ebf7231f0e391ba07e389620d17e2da3

SHA512
94d73d768f48210b149a24fcb72933b965d401f6ec14ace17353b1bfa3ba7197bee1fe509f839277af1282081121132bc5983e6eb1c578041f2a9dc8315f7a48

Download Submit
C:\Windows\System\HYggoeh.exe

Filesize
8B

MD5
a23600e55e0ec53c2a185eee9dce8dda

SHA1
a7acc57678d746e282667c9d5681a5646899c947

SHA256
010160c9bda4371b51d207d80c40b2c8c2963b74e5425fd624ccb8b7e3ec8036

SHA512
e4f286a65256a7e79a28756957c772e470ec0ab0275a1d07ec1878747b6789cfa1723df7433f0340326fdd186ab491ed19686235a250ed9aaffe4843a59599bf

Download Submit
C:\Windows\System\IRxeZgG.exe

Filesize
1.2MB

MD5
a53867d2d2fcc36fdd6300ae90ead6fa

SHA1
734069bd06ee929eb307286f0433f4e8f8175603

SHA256
5ab5aae680b738c3857b4f561f3d2beeb34c523374d22ad648217478ed563212

SHA512
c5e3597ecb2b93f5dc1a598b0c8ca27437e4614e21984bd485f81baf70fccccd58d9ed4d29dc29e8d816b097f445e48d4129918859976278f90798b16d4799c7

Download Submit
C:\Windows\System\KpLzAZo.exe

Filesize
1.2MB

MD5
386a53026dd24e457c4fc86abc08124c

SHA1
e4d8eb8583f0a08d692e9de97e76409c44a63503

SHA256
3615b39ba0ccad0bc6bdb562b89a591cfef1f60a93b12361fafa4e80edf6900f

SHA512
b51c1c11a5ca12ad663d0f9e543f65398d9e4f1bb7484a557c71e2d3fa8adeb50d903f5cbfd46029f2f5828f6c55520f379a1ad8ad8b1c9a70702f595130bd44

Download Submit
C:\Windows\System\ODyuAjz.exe

Filesize
1.2MB

MD5
e7b70fea500fc8c2f0f1f5f7f27b9c29

SHA1
7410bb1ef3b33d935020bed8bab536d0ad61806c

SHA256
a6baab4e2643a908e10c3219e202e552de52834947e4230d27b64c9ba4b19d0b

SHA512
b4ac4f6e702d5d53767b75d76f697ef8626b2c2bc14d257543561f3f5366aa61b28d22bf111e955d7f54d9f95cb9cea02b4fc6c9eb41303d212d9715a607900e

Download Submit
C:\Windows\System\RLVyMTP.exe

Filesize
1.2MB

MD5
e2a355c73b6628d2cd48d3a38d9b66b5

SHA1
cb54909c6604d3eef26db2dbae1d9fa6175303ac

SHA256
e1f15ac9bb67fd12a1cd6d2a791e8212e8cff3183340ee79c76871a6dbecdbce

SHA512
0a69ebc928d48fd8290282dddfb834e7e889fefec901f098e1cd7d040e17522dbe01428ee600208a5dbf6b2984d3c6a340daf7c1c8af17c72dafe0eaf222b74e

Download Submit
C:\Windows\System\TqbgMQB.exe

Filesize
1.2MB

MD5
bdb8df28f6c13df2e1278277db8069b8

SHA1
58bca252ff1c7327164baacb6d591dcef62ab627

SHA256
dab993ff8046b410b8dd35e252468050bdff82d4e838783083be4e151b9350f7

SHA512
68445a04731171203558289ba4685a8e21094b6176e655f71e9d748ac91e48e5b6c6099eaf2fe1cc63f669f08e9ecbfa928151cd04566dabbe1a24b113d5faab

Download Submit
C:\Windows\System\VxeoIFw.exe

Filesize
1.2MB

MD5
69c8cab956e518cae12b093b0da1bbfa

SHA1
98cf0492503438f6ffbf3796189e8e8a08ea9c06

SHA256
27f8123b4c00afa0e42c4556b937386d16c5abfe1b4fa7583b3f4b84c44e7682

SHA512
1847aac0d22c4314f71dfffeffd7b829a597e801931bb91a120da394f0200163c6910841998dd040c9708babf09b72a7c75293c9ea047fad4c948a6dd3b44940

Download Submit
C:\Windows\System\VxxBGCh.exe

Filesize
1.2MB

MD5
f6b5f5acb0bf6bf8007bb945352a6343

SHA1
5e7020ec19e838e6b35c4afee2df8ab6a38db579

SHA256
5540b428b7c093a36607270436aa35fcd85a3c807c1096895d0d4a876ed75d34

SHA512
8eaeae6cc7496cacbcfdf4b4993033703c09b5d3a0ebe72da47a8a47adcfce33a858190e7e6edff2b31ddc6e07af0b22c1bb042c83092beed13a2a96bcaec1f3

Download Submit
C:\Windows\System\Wymymro.exe

Filesize
1.2MB

MD5
e44e1a05c36d6d3619691a8183656646

SHA1
2090861a0e32a4392982e61c5b40284c6522ed1d

SHA256
0da2ee875e818583bfd1638fcfd476fa8d2a921655252f77b5aa9b9ea100d12c

SHA512
04d4c45d8ba171ed4e6fbdd65db1b1a109846d17983fd56fa658eb2ca86273007556ffe2e7cdf510bb145b9caaa707ffdeaf18a46672ff67392687fe9f9653f4

Download Submit
C:\Windows\System\Ytlclpy.exe

Filesize
1.2MB

MD5
1959c85d4e73e607141a0274c15c37b0

SHA1
566eb993b80849aa7063d15cef139e635ab874fa

SHA256
f1a10f8398193c7fbbcad1f081f7d6659aa54bf0a72aae9b73d5115da4d45fa2

SHA512
865a4e339cc2dba4153afbc1773f1529e1d109c8896f5b3ea538c5792fa7d091f535db90e0b9f3c2f6513901fe4c5175664e159230c28631083da12150f1277f

Download Submit
C:\Windows\System\ZOzZnmB.exe

Filesize
1.2MB

MD5
864b16ad28c7f91414422e823ba88ecd

SHA1
5e5612beeee9f1704a9cee139f9aad965be3e526

SHA256
bfc401405ea352f3b64b419ead29c64c6607bce45fe954d2aae4a015027713e6

SHA512
376a8fcbb1c9fa8b75130c377ad2012ef1eaff614098d90cfb834db4a08f50f5fb6e1cb720e9b8dfbf88bb189bfef72c6c2c832d8d0ad7e839498868d101cf7f

Download Submit
C:\Windows\System\auXSfTP.exe

Filesize
1.2MB

MD5
41bb1bd607b8f59a2e87b9a8c5769299

SHA1
6f89b913545d950160347a74aa8a5975f3eff363

SHA256
1ec27a14de9a5de0f8376c227733aeef87a04956b45e9ca92434fa87378884e9

SHA512
9965111e5a0acca61261c88ce520817cbf1262daa85bc6c58ce645005e7de8c226d180bfaa281e741f410e94ea793cc546d04f1654a1ef752ef8cab7e31e34dd

Download Submit
C:\Windows\System\bJJlvDU.exe

Filesize
1.2MB

MD5
97239cf0766064c5a87eeb3ef8e8b839

SHA1
ba31bcc2b491fe8c26b5f2408f464411156fea82

SHA256
32f4ea598d2cdac0101b86871793ef9b64bcd8f07177bd7723778639904c5d65

SHA512
53c71fd99b844145965955fefca98c5bd5d988a451d1c0e5e7ae4ffd6a7921c13f4500a9b152b301a805a337a1eccbfed7e03cab86dd61c3ef945f362a1bfdc0

Download Submit
C:\Windows\System\cvwNYNy.exe

Filesize
1.2MB

MD5
6d8b38e96b63fe518335c65cc758c6c3

SHA1
ed8d1ddec805782dd6bfedff287a99a974853c8f

SHA256
3faf341cefa44ab2042cd2deb91dc88e98cc9257ee73aaacd9837c77bc037f61

SHA512
053586127e060cf3cd3804545cc75edfca7fcf7e181e94cb9955b68a00313c577ae3e715ca094a2ff9572b7cc162e0f3052422cd45336a5df5468fac258b9482

Download Submit
C:\Windows\System\evHLXtJ.exe

Filesize
1.2MB

MD5
0522cacc3384f2cc5cc8e267fd8fb886

SHA1
bcc061255399632208cb0b8fa495077cb0fa4457

SHA256
eca0b406350500d22670d9637fddc420e09fb07212af9610fdd1daf5bbf474bc

SHA512
08687a294660763c503165ab0707dc7f70c02857bbec776b458b4f32b7c614048ad26c01ef4f39a140cc692a6434a7560991c6043d6f0e65920944aae9aa2c2b

Download Submit
C:\Windows\System\flNvXBW.exe

Filesize
1.2MB

MD5
7e0f63d6377164b11b01fd01b8d8cf1b

SHA1
8d18980dc706f5a5b8ed1a8199822055efd585ce

SHA256
fe0d37efe317802b0e718dce01cbd937932c784206a0d171851df114703c10df

SHA512
7098f5a38ce873b970e70b200b3544894b28dae8d610960508cf7c9ac891875d789de78b8290ff0fc64eeffb58b30e3ea907f0b614f416eed5d1200594887054

Download Submit
C:\Windows\System\gHBJNbl.exe

Filesize
1.2MB

MD5
c443d2ecc1ecb62fb0ec4f34185417fe

SHA1
8df540b6ddadb893293dfe3e807a33dc6c989e73

SHA256
013fdc1778a75ea091694d35c2a95f21a2e0fda575cdf19296ba84f84da8cd9d

SHA512
258c5379fbc0e93d82eb2f066a96395880fe9fc4e5f253eca01c07ab3b5aef11882ce6efb338525573b8355ba8c3709525b3fe51e8a3f3d0ae3ba8fce4c15571

Download Submit
C:\Windows\System\ggUVtOs.exe

Filesize
1.2MB

MD5
034b9d30343ba9af7491e388255a29b2

SHA1
f41d7e359863b44a974957523a8bbca85b98289b

SHA256
8935b967cf5b8c750d8ebaf72bf31ee3987b63933f51871dfa0ce91282e3165a

SHA512
4c9f38c3eef9cfa2ee284723fe8c1692c945132c617aacd4704423c1c67d386163617704657d9d88a990812667dbbc5fdbe82efeb4c3570614cc4a74cf427fa5

Download Submit
C:\Windows\System\gqEpIWZ.exe

Filesize
1.2MB

MD5
619438c1a149b72ac5fe4855fffb6237

SHA1
2e6dbbb7b3d61701d92f1086cb5d1ba9362ce809

SHA256
eaf252ffc3b2ffbd3b3b7efff0e79f4acf84a957083ae7dde92bb08fe04c800a

SHA512
e68e8eda7a5499961f44758596e23f898216fd93ee084a10f8ec435ac0e604bb2558ef7ae7b7f21e2825401101853464a91c8f729275f9a9d089e8cd31ce08a3

Download Submit
C:\Windows\System\kLTHYHX.exe

Filesize
1.2MB

MD5
e92bdb64908b7946973a347a47de1e1f

SHA1
80a04467d3c99bf80dc36c7ee2222e4ad2ce2b28

SHA256
aceb64fad3a940f17ac4eec71ad8ca58a67b9757bd4f27b4307913271b745188

SHA512
07ce7a7b9ee16874850b3198236d8afa0b74876e76525a509da5e9f46d8475de99ad1aacca30a6106137ca46c28f2f942e6bbbe1de611592632b28aed99d3e0a

Download Submit
C:\Windows\System\nGiwbBF.exe

Filesize
1.2MB

MD5
6ccaaf99004b2b49139cc82f79f5f6aa

SHA1
286ed6b4d5f765ca658b6870f13346dc59e0e9a8

SHA256
16e30d5dea663de1683afe3f2345ca7b19be3a521fc2516247c1f4aeada23d27

SHA512
b569b13c4eb89dd074f45168e48d80b6af79dc72482eb33f9c1190ef3336698b695d8725570361b95980d947c8884baabdfd90e45afaf9a50c462cb4b3b7bdd3

Download Submit
C:\Windows\System\oRvDebH.exe

Filesize
1.2MB

MD5
812992fb87a3a3d074411bf645f78015

SHA1
a59376d976d710d824e216aa0e861fe5a9f3fe03

SHA256
dd420e8b77618b81a16ff2d8aac98d0280db55829dbecffd0dbfba7d47d3073a

SHA512
337f083b52abb17fc02e6d60d0b035d39f7b00da8060b17f97eed6836c27395d7749d1a69bc12017439c510f66582d296bb0ac74f1350788120c9c0bd49049c6

Download Submit
C:\Windows\System\qvfTXac.exe

Filesize
1.2MB

MD5
0c8c6e96bcc7ab3bcf7c6eaf08930c96

SHA1
9ba79802cdd551a4b57679a875ace5668cb128d3

SHA256
05b0bdad0c5d11fd1423d523d3a82ded6955b831988930f3a75fe23209984631

SHA512
25b97bfa619f1d175606c00e8ea544083a2efaf4f88c2b8cb1a4887b1aa2bd5538affd48fcdd5e4ca0682da285e4b6f2130f3c55115bce1d33aa9f209d5714d2

Download Submit
C:\Windows\System\rgtizKS.exe

Filesize
1.2MB

MD5
f105785a24890a865987e3310fc68edc

SHA1
c5f639ba7dd0ec5ad17897a9021791274581ed6d

SHA256
8e1071643f7bfa58503301a888769ff99e263efa6e07b3ada7d56377cfacfe6b

SHA512
4994184c85ac9a1685d6b566c4353eff52db205bd35c2f726715b10ab9e9f20afce5c2f7ed9831a2463f7042663e95cdc424c19f832afb77e362c17060117b74

Download Submit
C:\Windows\System\tfmLXPS.exe

Filesize
1.2MB

MD5
54294db3406a219692e0e1c71aee02c3

SHA1
0e3fc14b7661a98702084250a7ed73c743eefd81

SHA256
3789523dd59a54fd108a85df43f499d5e66b5145ce16a8318985201221f08fde

SHA512
58da397e485a0d66acd3c8837ac20575331527b433762a01a2aea714d9151788ae2d4925c4536a865d1fcc3d2d7e8d0b5b5a8999ca4f35332245cb5684a39326

Download Submit
C:\Windows\System\txJWENN.exe

Filesize
1.2MB

MD5
dedfa34bb80be8fa15d6761b9bf09cf0

SHA1
f6e842128259638af0cc45bcf76647d24d0d0d66

SHA256
294b6e86405f16908dfe254d724835be1c410d7e2342660aa6d0818765444ebe

SHA512
9ce1ec21a7ec4f72ccf973af81f7beb6406d20d07fdda4c7e55153ed04b353417cf927738d137b4ca09f72e536146a0ece5ca7502d61713f41952d42d99202dd

Download Submit
C:\Windows\System\usCYLHc.exe

Filesize
1.2MB

MD5
fb9b22878e43a4d41dd7b69c3b86720f

SHA1
15324ce427393710475625a9bc7e41020b78f813

SHA256
3fae13a3e8e01dd129e32994373f79971119bc0c133ba6b466d99f587473f178

SHA512
c45b72de7e239b2c6f5d2e6bdda804e271a36859e3b60284b8263fc34e43e35abec16ee892f88956d94308777fbda9bdc072211741777bc14c1f19702e21dfef

Download Submit
C:\Windows\System\xPFLjbv.exe

Filesize
1.2MB

MD5
bb8b784eb4826829fa03fe881adfcde0

SHA1
4b37bf3d3e09bffaf40e1c5cdc1321a247edbb9c

SHA256
70cfa8222b15a58b0b0c8ed79a93bf4abf7717626cc5356471f27a130755b24e

SHA512
6a3a1913d33139724b677d05ad4e9922dd83629811acdfa8bf2dea941e003ee4cb5cca0dad68ccd3c8567ef50f3f6112e3cea334113170943f86d715bf444abc

Download Submit
memory/744-90-0x00007FF62A710000-0x00007FF62AB02000-memory.dmp

Filesize
3.9MB

Download
memory/1080-2382-0x00007FF632BE0000-0x00007FF632FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1080-12-0x00007FF632BE0000-0x00007FF632FD2000-memory.dmp

Filesize
3.9MB

Download
memory/1144-171-0x00007FF7EB970000-0x00007FF7EBD62000-memory.dmp

Filesize
3.9MB

Download
memory/1144-2450-0x00007FF7EB970000-0x00007FF7EBD62000-memory.dmp

Filesize
3.9MB

Download
memory/1516-113-0x00007FF6BF570000-0x00007FF6BF962000-memory.dmp

Filesize
3.9MB

Download
memory/1516-2400-0x00007FF6BF570000-0x00007FF6BF962000-memory.dmp

Filesize
3.9MB

Download
memory/1672-2384-0x00007FF638B30000-0x00007FF638F22000-memory.dmp

Filesize
3.9MB

Download
memory/1672-75-0x00007FF638B30000-0x00007FF638F22000-memory.dmp

Filesize
3.9MB

Download
memory/1712-2441-0x00007FF69EF40000-0x00007FF69F332000-memory.dmp

Filesize
3.9MB

Download
memory/1712-158-0x00007FF69EF40000-0x00007FF69F332000-memory.dmp

Filesize
3.9MB

Download
memory/1936-2438-0x00007FF79A070000-0x00007FF79A462000-memory.dmp

Filesize
3.9MB

Download
memory/1936-146-0x00007FF79A070000-0x00007FF79A462000-memory.dmp

Filesize
3.9MB

Download
memory/2144-134-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2436-0x00007FF6BE760000-0x00007FF6BEB52000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2402-0x00007FF6EC330000-0x00007FF6EC722000-memory.dmp

Filesize
3.9MB

Download
memory/2368-97-0x00007FF6EC330000-0x00007FF6EC722000-memory.dmp

Filesize
3.9MB

Download
memory/2468-85-0x00007FF7108E0000-0x00007FF710CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-2394-0x00007FF7108E0000-0x00007FF710CD2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-2446-0x00007FF6D1F50000-0x00007FF6D2342000-memory.dmp

Filesize
3.9MB

Download
memory/2660-165-0x00007FF6D1F50000-0x00007FF6D2342000-memory.dmp

Filesize
3.9MB

Download
memory/2720-118-0x00007FF7467A0000-0x00007FF746B92000-memory.dmp

Filesize
3.9MB

Download
memory/2720-2404-0x00007FF7467A0000-0x00007FF746B92000-memory.dmp

Filesize
3.9MB

Download
memory/2748-80-0x00007FF62E100000-0x00007FF62E4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-2392-0x00007FF62E100000-0x00007FF62E4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-109-0x00007FF6EED00000-0x00007FF6EF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-2398-0x00007FF6EED00000-0x00007FF6EF0F2000-memory.dmp

Filesize
3.9MB

Download
memory/3256-63-0x00007FF75AB50000-0x00007FF75AF42000-memory.dmp

Filesize
3.9MB

Download
memory/3256-2390-0x00007FF75AB50000-0x00007FF75AF42000-memory.dmp

Filesize
3.9MB

Download
memory/3364-128-0x00007FF6093C0000-0x00007FF6097B2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-2432-0x00007FF6093C0000-0x00007FF6097B2000-memory.dmp

Filesize
3.9MB

Download
memory/3632-108-0x00007FF6C5CB0000-0x00007FF6C60A2000-memory.dmp

Filesize
3.9MB

Download
memory/3632-2386-0x00007FF6C5CB0000-0x00007FF6C60A2000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2435-0x00007FF63B240000-0x00007FF63B632000-memory.dmp

Filesize
3.9MB

Download
memory/4016-140-0x00007FF63B240000-0x00007FF63B632000-memory.dmp

Filesize
3.9MB

Download
memory/4176-1054-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp

Filesize
3.9MB

Download
memory/4176-2647-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp

Filesize
3.9MB

Download
memory/4176-101-0x00007FF7346A0000-0x00007FF734A92000-memory.dmp

Filesize
3.9MB

Download
memory/4456-2444-0x00007FF68BB10000-0x00007FF68BF02000-memory.dmp

Filesize
3.9MB

Download
memory/4456-159-0x00007FF68BB10000-0x00007FF68BF02000-memory.dmp

Filesize
3.9MB

Download
memory/4488-124-0x00007FF7D0600000-0x00007FF7D09F2000-memory.dmp

Filesize
3.9MB

Download
memory/4488-2430-0x00007FF7D0600000-0x00007FF7D09F2000-memory.dmp

Filesize
3.9MB

Download
memory/4668-699-0x00007FF6DB440000-0x00007FF6DB832000-memory.dmp

Filesize
3.9MB

Download
memory/4668-0-0x00007FF6DB440000-0x00007FF6DB832000-memory.dmp

Filesize
3.9MB

Download
memory/4668-1-0x00000217862A0000-0x00000217862B0000-memory.dmp

Filesize
64KB

Download
memory/4720-420-0x000002C567500000-0x000002C567CA6000-memory.dmp

Filesize
7.6MB

Download
memory/4720-1018-0x000002C563FE0000-0x000002C563FF0000-memory.dmp

Filesize
64KB

Download
memory/4720-59-0x00007FF999440000-0x00007FF999F01000-memory.dmp

Filesize
10.8MB

Download
memory/4720-70-0x000002C54BDE0000-0x000002C54BE02000-memory.dmp

Filesize
136KB

Download
memory/4720-1038-0x00007FF999440000-0x00007FF999F01000-memory.dmp

Filesize
10.8MB

Download
memory/4720-13-0x000002C563FE0000-0x000002C563FF0000-memory.dmp

Filesize
64KB

Download
memory/4720-14-0x00007FF999443000-0x00007FF999445000-memory.dmp

Filesize
8KB

Download
memory/4720-1177-0x00007FF999443000-0x00007FF999445000-memory.dmp

Filesize
8KB

Download
memory/4992-89-0x00007FF6BE2F0000-0x00007FF6BE6E2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-79-0x00007FF7A6890000-0x00007FF7A6C82000-memory.dmp

Filesize
3.9MB

Download
memory/5012-2388-0x00007FF7A6890000-0x00007FF7A6C82000-memory.dmp

Filesize
3.9MB

Download
memory/5064-152-0x00007FF785AB0000-0x00007FF785EA2000-memory.dmp

Filesize
3.9MB

Download
memory/5064-2442-0x00007FF785AB0000-0x00007FF785EA2000-memory.dmp

Filesize
3.9MB

Download