xmrig | b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9

Analysis

max time kernel
80s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
Size

3.0MB
MD5

b0910624cbe6a7b1954094ad80225450
SHA1

81178f14390399de4c0d34588c9ba4e6bc7402b7
SHA256

b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9
SHA512

27f7e597c6265752efc57c158d7b34fced152c43c742835d9d8296b28613ff3e32c7d5c2401f1a94462046b86247d387b27d09de723172460bc2e5f0db64f965
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFka

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4628-0-0x00007FF6EDD20000-0x00007FF6EE116000-memory.dmp	xmrig
behavioral2/files/0x0008000000023455-5.dat	xmrig
behavioral2/files/0x000700000002345a-8.dat	xmrig
behavioral2/memory/2124-6-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp	xmrig
behavioral2/memory/3424-39-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp	xmrig
behavioral2/files/0x0007000000023460-45.dat	xmrig
behavioral2/memory/1472-55-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp	xmrig
behavioral2/memory/1036-59-0x00007FF749120000-0x00007FF749516000-memory.dmp	xmrig
behavioral2/memory/448-69-0x00007FF676020000-0x00007FF676416000-memory.dmp	xmrig
behavioral2/memory/5040-79-0x00007FF71BC70000-0x00007FF71C066000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-95.dat	xmrig
behavioral2/memory/1364-117-0x00007FF6D3D10000-0x00007FF6D4106000-memory.dmp	xmrig
behavioral2/memory/2140-121-0x00007FF64C080000-0x00007FF64C476000-memory.dmp	xmrig
behavioral2/memory/4636-124-0x00007FF642A20000-0x00007FF642E16000-memory.dmp	xmrig
behavioral2/memory/4056-127-0x00007FF709B90000-0x00007FF709F86000-memory.dmp	xmrig
behavioral2/memory/2452-126-0x00007FF6831B0000-0x00007FF6835A6000-memory.dmp	xmrig
behavioral2/memory/3764-125-0x00007FF7E5A70000-0x00007FF7E5E66000-memory.dmp	xmrig
behavioral2/memory/216-123-0x00007FF615E60000-0x00007FF616256000-memory.dmp	xmrig
behavioral2/memory/3952-122-0x00007FF6C5FB0000-0x00007FF6C63A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002346c-119.dat	xmrig
behavioral2/memory/820-118-0x00007FF65DC80000-0x00007FF65E076000-memory.dmp	xmrig
behavioral2/files/0x000700000002346b-115.dat	xmrig
behavioral2/files/0x000700000002346a-113.dat	xmrig
behavioral2/files/0x0007000000023469-111.dat	xmrig
behavioral2/files/0x0007000000023467-107.dat	xmrig
behavioral2/files/0x0007000000023466-105.dat	xmrig
behavioral2/memory/4940-104-0x00007FF7DA540000-0x00007FF7DA936000-memory.dmp	xmrig
behavioral2/memory/4256-98-0x00007FF722970000-0x00007FF722D66000-memory.dmp	xmrig
behavioral2/files/0x0007000000023465-87.dat	xmrig
behavioral2/memory/2064-84-0x00007FF7D4010000-0x00007FF7D4406000-memory.dmp	xmrig
behavioral2/files/0x0007000000023464-77.dat	xmrig
behavioral2/files/0x0007000000023462-74.dat	xmrig
behavioral2/files/0x0007000000023463-73.dat	xmrig
behavioral2/files/0x0007000000023461-71.dat	xmrig
behavioral2/memory/2624-70-0x00007FF697460000-0x00007FF697856000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-52.dat	xmrig
behavioral2/files/0x000700000002345e-48.dat	xmrig
behavioral2/files/0x000700000002345c-46.dat	xmrig
behavioral2/files/0x000700000002345d-41.dat	xmrig
behavioral2/files/0x000700000002345b-33.dat	xmrig
behavioral2/memory/2236-29-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023459-21.dat	xmrig
behavioral2/memory/5116-17-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp	xmrig
behavioral2/files/0x000700000002346d-209.dat	xmrig
behavioral2/memory/1452-226-0x00007FF698060000-0x00007FF698456000-memory.dmp	xmrig
behavioral2/files/0x000700000002348a-234.dat	xmrig
behavioral2/files/0x000700000002348b-245.dat	xmrig
behavioral2/files/0x000700000002348c-256.dat	xmrig
behavioral2/memory/680-252-0x00007FF615C40000-0x00007FF616036000-memory.dmp	xmrig
behavioral2/files/0x0007000000023494-270.dat	xmrig
behavioral2/files/0x0007000000023496-289.dat	xmrig
behavioral2/files/0x000700000002349c-296.dat	xmrig
behavioral2/files/0x0007000000023499-293.dat	xmrig
behavioral2/files/0x0007000000023495-287.dat	xmrig
behavioral2/files/0x000700000002348f-283.dat	xmrig
behavioral2/memory/4628-242-0x00007FF6EDD20000-0x00007FF6EE116000-memory.dmp	xmrig
behavioral2/memory/1360-241-0x00007FF6C1B80000-0x00007FF6C1F76000-memory.dmp	xmrig
behavioral2/files/0x0007000000023487-232.dat	xmrig
behavioral2/files/0x0007000000023485-227.dat	xmrig
behavioral2/memory/2124-449-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp	xmrig
behavioral2/memory/5116-456-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp	xmrig
behavioral2/memory/2236-607-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp	xmrig
behavioral2/memory/3424-738-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp	xmrig
behavioral2/memory/1472-741-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp	xmrig

Blocklisted process makes network request 8 IoCs

flow	pid	Process
9	904	powershell.exe
11	904	powershell.exe
13	904	powershell.exe
14	904	powershell.exe
16	904	powershell.exe
18	904	powershell.exe
25	904	powershell.exe
28	904	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
904	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2124	WghRlbB.exe
5116	fHoYCOJ.exe
2236	LbkRJbt.exe
3424	pDJBlRx.exe
4256	gGUGpms.exe
1472	ROJowuv.exe
1036	XWoHQhk.exe
448	mmaWywR.exe
4940	KaFLDxM.exe
2624	ZSTkuoR.exe
1364	OfWiyEF.exe
820	twAEIne.exe
5040	sYtkReM.exe
2064	waMNmCB.exe
2452	ZZTUxSz.exe
2140	ejFdZYO.exe
3952	sXTxUPs.exe
4056	ghzBYav.exe
216	uexwtYT.exe
4636	IJXvuGO.exe
3764	OEKHTlw.exe
1452	HevBupg.exe
1360	LaGSHCM.exe
680	vMWYByl.exe
4516	lZPIlHj.exe
3404	TpKdYAH.exe
2688	xcwzoay.exe
5068	CLStDvW.exe
1448	fKeqRSy.exe
2204	BLPEvbv.exe
2976	rKcVgqE.exe
3876	leYohoo.exe
4908	IPqYhGJ.exe
4736	aXFvlzp.exe
3216	ifXnqHs.exe
3496	jnJjjmM.exe
3492	dPYgNBr.exe
3720	PsjbwPk.exe
3324	gECshze.exe
3100	UwGmNvL.exe
5076	prIVvtl.exe
940	TzZfYMH.exe
3792	dnHiRWd.exe
1564	unvMjbA.exe
2680	UAnwVJT.exe
3672	wzETYVh.exe
3232	mbuqsPY.exe
1968	eJZKdfp.exe
4752	aNPRIPp.exe
2188	yuBymqx.exe
4340	OFeYtMQ.exe
4316	GRooEZf.exe
4428	ejteDch.exe
4372	yrFsZkx.exe
4212	BZgfdMX.exe
1836	dTOtPIJ.exe
4448	zxERSko.exe
3196	bMjHAHG.exe
3172	rxXIiZZ.exe
4812	lWNtbcE.exe
3096	CbVIILL.exe
3980	vZHjlOB.exe
4860	VWPpWYu.exe
3092	PjFEMYp.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4628-0-0x00007FF6EDD20000-0x00007FF6EE116000-memory.dmp	upx
behavioral2/files/0x0008000000023455-5.dat	upx
behavioral2/files/0x000700000002345a-8.dat	upx
behavioral2/memory/2124-6-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp	upx
behavioral2/memory/3424-39-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp	upx
behavioral2/files/0x0007000000023460-45.dat	upx
behavioral2/memory/1472-55-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp	upx
behavioral2/memory/1036-59-0x00007FF749120000-0x00007FF749516000-memory.dmp	upx
behavioral2/memory/448-69-0x00007FF676020000-0x00007FF676416000-memory.dmp	upx
behavioral2/memory/5040-79-0x00007FF71BC70000-0x00007FF71C066000-memory.dmp	upx
behavioral2/files/0x0007000000023468-95.dat	upx
behavioral2/memory/1364-117-0x00007FF6D3D10000-0x00007FF6D4106000-memory.dmp	upx
behavioral2/memory/2140-121-0x00007FF64C080000-0x00007FF64C476000-memory.dmp	upx
behavioral2/memory/4636-124-0x00007FF642A20000-0x00007FF642E16000-memory.dmp	upx
behavioral2/memory/4056-127-0x00007FF709B90000-0x00007FF709F86000-memory.dmp	upx
behavioral2/memory/2452-126-0x00007FF6831B0000-0x00007FF6835A6000-memory.dmp	upx
behavioral2/memory/3764-125-0x00007FF7E5A70000-0x00007FF7E5E66000-memory.dmp	upx
behavioral2/memory/216-123-0x00007FF615E60000-0x00007FF616256000-memory.dmp	upx
behavioral2/memory/3952-122-0x00007FF6C5FB0000-0x00007FF6C63A6000-memory.dmp	upx
behavioral2/files/0x000700000002346c-119.dat	upx
behavioral2/memory/820-118-0x00007FF65DC80000-0x00007FF65E076000-memory.dmp	upx
behavioral2/files/0x000700000002346b-115.dat	upx
behavioral2/files/0x000700000002346a-113.dat	upx
behavioral2/files/0x0007000000023469-111.dat	upx
behavioral2/files/0x0007000000023467-107.dat	upx
behavioral2/files/0x0007000000023466-105.dat	upx
behavioral2/memory/4940-104-0x00007FF7DA540000-0x00007FF7DA936000-memory.dmp	upx
behavioral2/memory/4256-98-0x00007FF722970000-0x00007FF722D66000-memory.dmp	upx
behavioral2/files/0x0007000000023465-87.dat	upx
behavioral2/memory/2064-84-0x00007FF7D4010000-0x00007FF7D4406000-memory.dmp	upx
behavioral2/files/0x0007000000023464-77.dat	upx
behavioral2/files/0x0007000000023462-74.dat	upx
behavioral2/files/0x0007000000023463-73.dat	upx
behavioral2/files/0x0007000000023461-71.dat	upx
behavioral2/memory/2624-70-0x00007FF697460000-0x00007FF697856000-memory.dmp	upx
behavioral2/files/0x000700000002345f-52.dat	upx
behavioral2/files/0x000700000002345e-48.dat	upx
behavioral2/files/0x000700000002345c-46.dat	upx
behavioral2/files/0x000700000002345d-41.dat	upx
behavioral2/files/0x000700000002345b-33.dat	upx
behavioral2/memory/2236-29-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp	upx
behavioral2/files/0x0007000000023459-21.dat	upx
behavioral2/memory/5116-17-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp	upx
behavioral2/files/0x000700000002346d-209.dat	upx
behavioral2/memory/1452-226-0x00007FF698060000-0x00007FF698456000-memory.dmp	upx
behavioral2/files/0x000700000002348a-234.dat	upx
behavioral2/files/0x000700000002348b-245.dat	upx
behavioral2/files/0x000700000002348c-256.dat	upx
behavioral2/memory/680-252-0x00007FF615C40000-0x00007FF616036000-memory.dmp	upx
behavioral2/files/0x0007000000023494-270.dat	upx
behavioral2/files/0x0007000000023496-289.dat	upx
behavioral2/files/0x000700000002349c-296.dat	upx
behavioral2/files/0x0007000000023499-293.dat	upx
behavioral2/files/0x0007000000023495-287.dat	upx
behavioral2/files/0x000700000002348f-283.dat	upx
behavioral2/memory/4628-242-0x00007FF6EDD20000-0x00007FF6EE116000-memory.dmp	upx
behavioral2/memory/1360-241-0x00007FF6C1B80000-0x00007FF6C1F76000-memory.dmp	upx
behavioral2/files/0x0007000000023487-232.dat	upx
behavioral2/files/0x0007000000023485-227.dat	upx
behavioral2/memory/2124-449-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp	upx
behavioral2/memory/5116-456-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp	upx
behavioral2/memory/2236-607-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp	upx
behavioral2/memory/3424-738-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp	upx
behavioral2/memory/1472-741-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uexwtYT.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\vZHjlOB.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\OfyeoXw.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\AWWjSLp.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\bvnaiFO.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\YqfuGfc.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\UObaeFV.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\uIkMYyf.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\QnRWnCQ.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\RrJPDYg.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\xKXVRKG.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\HqTUNIz.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\EXYOZji.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\LHJbDeK.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\lZZdkSt.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\rzjHWsg.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\qZLLJKR.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\gtfOtyK.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\VeReNhV.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\LOdnvkY.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\NJqxYwZ.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\YSsoCFn.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\VbXFSMz.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\ZzhbuAM.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\IqjgcVT.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\ChHgqxu.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\LQupWIC.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\cdUpDZU.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\nZwpdBB.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\odqHQKK.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\oatXRaC.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\mNbwpxo.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\efhSbGi.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\aeVaxNq.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\SfZgigC.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\RheIexR.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\TssxZQh.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\kBkXsWn.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\qsZbRtL.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\QmmzrKi.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\MbudZmV.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\yJpfsyw.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\PaAHMLy.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\mkaJxlc.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\kbsLlfz.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\EvZromb.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\BTMqVZb.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\jGIQzkV.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\jiaiagE.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\jRguxhX.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\cFBvhcQ.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\FtscnIp.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\oIGqBNG.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\gozrjDz.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\YZtAfmC.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\HDFURYT.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\DjbZhtx.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\ISczeol.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\FYUPYMM.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\GsVUKXS.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\RxGDviu.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\wjFZYSn.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\llMUaQD.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
File created	C:\Windows\System\PHFBJJI.exe	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
904	powershell.exe
904	powershell.exe
904	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
Token: SeLockMemoryPrivilege	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
Token: SeDebugPrivilege	904	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 904	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	85
PID 4628 wrote to memory of 904	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	85
PID 4628 wrote to memory of 2124	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	86
PID 4628 wrote to memory of 2124	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	86
PID 4628 wrote to memory of 5116	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	87
PID 4628 wrote to memory of 5116	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	87
PID 4628 wrote to memory of 2236	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	88
PID 4628 wrote to memory of 2236	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	88
PID 4628 wrote to memory of 3424	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	89
PID 4628 wrote to memory of 3424	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	89
PID 4628 wrote to memory of 1472	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	90
PID 4628 wrote to memory of 1472	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	90
PID 4628 wrote to memory of 4256	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	91
PID 4628 wrote to memory of 4256	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	91
PID 4628 wrote to memory of 1036	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	92
PID 4628 wrote to memory of 1036	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	92
PID 4628 wrote to memory of 448	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	93
PID 4628 wrote to memory of 448	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	93
PID 4628 wrote to memory of 4940	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	94
PID 4628 wrote to memory of 4940	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	94
PID 4628 wrote to memory of 2624	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	95
PID 4628 wrote to memory of 2624	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	95
PID 4628 wrote to memory of 820	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	96
PID 4628 wrote to memory of 820	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	96
PID 4628 wrote to memory of 1364	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	97
PID 4628 wrote to memory of 1364	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	97
PID 4628 wrote to memory of 5040	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	98
PID 4628 wrote to memory of 5040	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	98
PID 4628 wrote to memory of 2064	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	99
PID 4628 wrote to memory of 2064	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	99
PID 4628 wrote to memory of 2452	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	100
PID 4628 wrote to memory of 2452	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	100
PID 4628 wrote to memory of 2140	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	101
PID 4628 wrote to memory of 2140	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	101
PID 4628 wrote to memory of 3952	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	102
PID 4628 wrote to memory of 3952	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	102
PID 4628 wrote to memory of 4056	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	103
PID 4628 wrote to memory of 4056	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	103
PID 4628 wrote to memory of 216	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	104
PID 4628 wrote to memory of 216	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	104
PID 4628 wrote to memory of 4636	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	105
PID 4628 wrote to memory of 4636	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	105
PID 4628 wrote to memory of 3764	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	106
PID 4628 wrote to memory of 3764	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	106
PID 4628 wrote to memory of 1452	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	107
PID 4628 wrote to memory of 1452	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	107
PID 4628 wrote to memory of 1360	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	108
PID 4628 wrote to memory of 1360	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	108
PID 4628 wrote to memory of 680	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	109
PID 4628 wrote to memory of 680	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	109
PID 4628 wrote to memory of 4516	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	110
PID 4628 wrote to memory of 4516	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	110
PID 4628 wrote to memory of 3404	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	111
PID 4628 wrote to memory of 3404	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	111
PID 4628 wrote to memory of 2688	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	112
PID 4628 wrote to memory of 2688	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	112
PID 4628 wrote to memory of 5068	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	113
PID 4628 wrote to memory of 5068	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	113
PID 4628 wrote to memory of 1448	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	114
PID 4628 wrote to memory of 1448	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	114
PID 4628 wrote to memory of 2204	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	115
PID 4628 wrote to memory of 2204	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	115
PID 4628 wrote to memory of 2976	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	116
PID 4628 wrote to memory of 2976	4628	b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe	116

C:\Users\Admin\AppData\Local\Temp\b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe
"C:\Users\Admin\AppData\Local\Temp\b838c9fb4e7acc35be5f5dd9dd366860732b398fc5d74d88570559c8795638f9N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904
- C:\Windows\System\WghRlbB.exe
  C:\Windows\System\WghRlbB.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\fHoYCOJ.exe
  C:\Windows\System\fHoYCOJ.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\LbkRJbt.exe
  C:\Windows\System\LbkRJbt.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\pDJBlRx.exe
  C:\Windows\System\pDJBlRx.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\ROJowuv.exe
  C:\Windows\System\ROJowuv.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\gGUGpms.exe
  C:\Windows\System\gGUGpms.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\XWoHQhk.exe
  C:\Windows\System\XWoHQhk.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\mmaWywR.exe
  C:\Windows\System\mmaWywR.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\KaFLDxM.exe
  C:\Windows\System\KaFLDxM.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\ZSTkuoR.exe
  C:\Windows\System\ZSTkuoR.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\twAEIne.exe
  C:\Windows\System\twAEIne.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\OfWiyEF.exe
  C:\Windows\System\OfWiyEF.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\sYtkReM.exe
  C:\Windows\System\sYtkReM.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\waMNmCB.exe
  C:\Windows\System\waMNmCB.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ZZTUxSz.exe
  C:\Windows\System\ZZTUxSz.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ejFdZYO.exe
  C:\Windows\System\ejFdZYO.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\sXTxUPs.exe
  C:\Windows\System\sXTxUPs.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\ghzBYav.exe
  C:\Windows\System\ghzBYav.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\uexwtYT.exe
  C:\Windows\System\uexwtYT.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\IJXvuGO.exe
  C:\Windows\System\IJXvuGO.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\OEKHTlw.exe
  C:\Windows\System\OEKHTlw.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\HevBupg.exe
  C:\Windows\System\HevBupg.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\LaGSHCM.exe
  C:\Windows\System\LaGSHCM.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\vMWYByl.exe
  C:\Windows\System\vMWYByl.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\lZPIlHj.exe
  C:\Windows\System\lZPIlHj.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\TpKdYAH.exe
  C:\Windows\System\TpKdYAH.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\xcwzoay.exe
  C:\Windows\System\xcwzoay.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\CLStDvW.exe
  C:\Windows\System\CLStDvW.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\fKeqRSy.exe
  C:\Windows\System\fKeqRSy.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\BLPEvbv.exe
  C:\Windows\System\BLPEvbv.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\rKcVgqE.exe
  C:\Windows\System\rKcVgqE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\leYohoo.exe
  C:\Windows\System\leYohoo.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\IPqYhGJ.exe
  C:\Windows\System\IPqYhGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\aXFvlzp.exe
  C:\Windows\System\aXFvlzp.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\ifXnqHs.exe
  C:\Windows\System\ifXnqHs.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\jnJjjmM.exe
  C:\Windows\System\jnJjjmM.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\dPYgNBr.exe
  C:\Windows\System\dPYgNBr.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\PsjbwPk.exe
  C:\Windows\System\PsjbwPk.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\gECshze.exe
  C:\Windows\System\gECshze.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\UwGmNvL.exe
  C:\Windows\System\UwGmNvL.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\prIVvtl.exe
  C:\Windows\System\prIVvtl.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\TzZfYMH.exe
  C:\Windows\System\TzZfYMH.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\dnHiRWd.exe
  C:\Windows\System\dnHiRWd.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\unvMjbA.exe
  C:\Windows\System\unvMjbA.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\UAnwVJT.exe
  C:\Windows\System\UAnwVJT.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\wzETYVh.exe
  C:\Windows\System\wzETYVh.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\mbuqsPY.exe
  C:\Windows\System\mbuqsPY.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\eJZKdfp.exe
  C:\Windows\System\eJZKdfp.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\aNPRIPp.exe
  C:\Windows\System\aNPRIPp.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\yuBymqx.exe
  C:\Windows\System\yuBymqx.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\OFeYtMQ.exe
  C:\Windows\System\OFeYtMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\GRooEZf.exe
  C:\Windows\System\GRooEZf.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\ejteDch.exe
  C:\Windows\System\ejteDch.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\yrFsZkx.exe
  C:\Windows\System\yrFsZkx.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\BZgfdMX.exe
  C:\Windows\System\BZgfdMX.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\dTOtPIJ.exe
  C:\Windows\System\dTOtPIJ.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\zxERSko.exe
  C:\Windows\System\zxERSko.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\bMjHAHG.exe
  C:\Windows\System\bMjHAHG.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\rxXIiZZ.exe
  C:\Windows\System\rxXIiZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\lWNtbcE.exe
  C:\Windows\System\lWNtbcE.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\CbVIILL.exe
  C:\Windows\System\CbVIILL.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\vZHjlOB.exe
  C:\Windows\System\vZHjlOB.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\VWPpWYu.exe
  C:\Windows\System\VWPpWYu.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\PjFEMYp.exe
  C:\Windows\System\PjFEMYp.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\zpDHFAp.exe
  C:\Windows\System\zpDHFAp.exe
  2⤵
  PID:4040
- C:\Windows\System\QyAvPYy.exe
  C:\Windows\System\QyAvPYy.exe
  2⤵
  PID:3368
- C:\Windows\System\lvdtmGz.exe
  C:\Windows\System\lvdtmGz.exe
  2⤵
  PID:1516
- C:\Windows\System\GrypUSi.exe
  C:\Windows\System\GrypUSi.exe
  2⤵
  PID:1456
- C:\Windows\System\pOtvZdf.exe
  C:\Windows\System\pOtvZdf.exe
  2⤵
  PID:2384
- C:\Windows\System\UwJArUr.exe
  C:\Windows\System\UwJArUr.exe
  2⤵
  PID:3144
- C:\Windows\System\KYYDVbm.exe
  C:\Windows\System\KYYDVbm.exe
  2⤵
  PID:1780
- C:\Windows\System\sIGtRbs.exe
  C:\Windows\System\sIGtRbs.exe
  2⤵
  PID:4800
- C:\Windows\System\LEcRomH.exe
  C:\Windows\System\LEcRomH.exe
  2⤵
  PID:2480
- C:\Windows\System\yPmhicT.exe
  C:\Windows\System\yPmhicT.exe
  2⤵
  PID:656
- C:\Windows\System\QUvPMEw.exe
  C:\Windows\System\QUvPMEw.exe
  2⤵
  PID:5020
- C:\Windows\System\nZwpdBB.exe
  C:\Windows\System\nZwpdBB.exe
  2⤵
  PID:2348
- C:\Windows\System\gbXUobn.exe
  C:\Windows\System\gbXUobn.exe
  2⤵
  PID:972
- C:\Windows\System\MMafkxa.exe
  C:\Windows\System\MMafkxa.exe
  2⤵
  PID:3376
- C:\Windows\System\TRnTFVS.exe
  C:\Windows\System\TRnTFVS.exe
  2⤵
  PID:4108
- C:\Windows\System\HDddNrP.exe
  C:\Windows\System\HDddNrP.exe
  2⤵
  PID:1604
- C:\Windows\System\nDyHmgD.exe
  C:\Windows\System\nDyHmgD.exe
  2⤵
  PID:3868
- C:\Windows\System\uEGOZcG.exe
  C:\Windows\System\uEGOZcG.exe
  2⤵
  PID:1108
- C:\Windows\System\EMXHqJo.exe
  C:\Windows\System\EMXHqJo.exe
  2⤵
  PID:3108
- C:\Windows\System\BOfKUiB.exe
  C:\Windows\System\BOfKUiB.exe
  2⤵
  PID:2916
- C:\Windows\System\PPsmHMY.exe
  C:\Windows\System\PPsmHMY.exe
  2⤵
  PID:2820
- C:\Windows\System\GsVUKXS.exe
  C:\Windows\System\GsVUKXS.exe
  2⤵
  PID:776
- C:\Windows\System\CUfIzue.exe
  C:\Windows\System\CUfIzue.exe
  2⤵
  PID:5104
- C:\Windows\System\XJdEceu.exe
  C:\Windows\System\XJdEceu.exe
  2⤵
  PID:2456
- C:\Windows\System\qDVZwgO.exe
  C:\Windows\System\qDVZwgO.exe
  2⤵
  PID:4080
- C:\Windows\System\PoycpJk.exe
  C:\Windows\System\PoycpJk.exe
  2⤵
  PID:2516
- C:\Windows\System\yWBhUYK.exe
  C:\Windows\System\yWBhUYK.exe
  2⤵
  PID:3908
- C:\Windows\System\PxGmgFG.exe
  C:\Windows\System\PxGmgFG.exe
  2⤵
  PID:1312
- C:\Windows\System\EVAMIjP.exe
  C:\Windows\System\EVAMIjP.exe
  2⤵
  PID:3800
- C:\Windows\System\xBzUbbV.exe
  C:\Windows\System\xBzUbbV.exe
  2⤵
  PID:4996
- C:\Windows\System\AuZMlBT.exe
  C:\Windows\System\AuZMlBT.exe
  2⤵
  PID:3240
- C:\Windows\System\JZAUAXG.exe
  C:\Windows\System\JZAUAXG.exe
  2⤵
  PID:3292
- C:\Windows\System\sWMVCyC.exe
  C:\Windows\System\sWMVCyC.exe
  2⤵
  PID:2720
- C:\Windows\System\PMJAwps.exe
  C:\Windows\System\PMJAwps.exe
  2⤵
  PID:1676
- C:\Windows\System\dWtMExD.exe
  C:\Windows\System\dWtMExD.exe
  2⤵
  PID:1548
- C:\Windows\System\rVmLuBO.exe
  C:\Windows\System\rVmLuBO.exe
  2⤵
  PID:5124
- C:\Windows\System\JrvFahH.exe
  C:\Windows\System\JrvFahH.exe
  2⤵
  PID:5144
- C:\Windows\System\uzwBDLA.exe
  C:\Windows\System\uzwBDLA.exe
  2⤵
  PID:5196
- C:\Windows\System\JhkpxSH.exe
  C:\Windows\System\JhkpxSH.exe
  2⤵
  PID:5236
- C:\Windows\System\XAKiSlw.exe
  C:\Windows\System\XAKiSlw.exe
  2⤵
  PID:5280
- C:\Windows\System\kkKmeiD.exe
  C:\Windows\System\kkKmeiD.exe
  2⤵
  PID:5304
- C:\Windows\System\ygbblEN.exe
  C:\Windows\System\ygbblEN.exe
  2⤵
  PID:5328
- C:\Windows\System\iLisEYf.exe
  C:\Windows\System\iLisEYf.exe
  2⤵
  PID:5360
- C:\Windows\System\NUQVttL.exe
  C:\Windows\System\NUQVttL.exe
  2⤵
  PID:5396
- C:\Windows\System\MCGBSBE.exe
  C:\Windows\System\MCGBSBE.exe
  2⤵
  PID:5424
- C:\Windows\System\WklXphp.exe
  C:\Windows\System\WklXphp.exe
  2⤵
  PID:5452
- C:\Windows\System\QAmBsAc.exe
  C:\Windows\System\QAmBsAc.exe
  2⤵
  PID:5472
- C:\Windows\System\JpJBNwj.exe
  C:\Windows\System\JpJBNwj.exe
  2⤵
  PID:5500
- C:\Windows\System\VnqrmDe.exe
  C:\Windows\System\VnqrmDe.exe
  2⤵
  PID:5536
- C:\Windows\System\APVEcMy.exe
  C:\Windows\System\APVEcMy.exe
  2⤵
  PID:5564
- C:\Windows\System\IZtpdtL.exe
  C:\Windows\System\IZtpdtL.exe
  2⤵
  PID:5592
- C:\Windows\System\DUXvunG.exe
  C:\Windows\System\DUXvunG.exe
  2⤵
  PID:5620
- C:\Windows\System\dLDMSYp.exe
  C:\Windows\System\dLDMSYp.exe
  2⤵
  PID:5648
- C:\Windows\System\tmMipQo.exe
  C:\Windows\System\tmMipQo.exe
  2⤵
  PID:5664
- C:\Windows\System\dPceboI.exe
  C:\Windows\System\dPceboI.exe
  2⤵
  PID:5692
- C:\Windows\System\OfyeoXw.exe
  C:\Windows\System\OfyeoXw.exe
  2⤵
  PID:5724
- C:\Windows\System\iigvQuS.exe
  C:\Windows\System\iigvQuS.exe
  2⤵
  PID:5760
- C:\Windows\System\lTWxZRf.exe
  C:\Windows\System\lTWxZRf.exe
  2⤵
  PID:5788
- C:\Windows\System\SDegahB.exe
  C:\Windows\System\SDegahB.exe
  2⤵
  PID:5804
- C:\Windows\System\oQEsman.exe
  C:\Windows\System\oQEsman.exe
  2⤵
  PID:5844
- C:\Windows\System\ItPDtQi.exe
  C:\Windows\System\ItPDtQi.exe
  2⤵
  PID:5860
- C:\Windows\System\IneUULC.exe
  C:\Windows\System\IneUULC.exe
  2⤵
  PID:5888
- C:\Windows\System\xsUMwuK.exe
  C:\Windows\System\xsUMwuK.exe
  2⤵
  PID:5908
- C:\Windows\System\jmPHftw.exe
  C:\Windows\System\jmPHftw.exe
  2⤵
  PID:5956
- C:\Windows\System\GhBACHa.exe
  C:\Windows\System\GhBACHa.exe
  2⤵
  PID:5972
- C:\Windows\System\KdZkfpL.exe
  C:\Windows\System\KdZkfpL.exe
  2⤵
  PID:6000
- C:\Windows\System\ZbsHhrA.exe
  C:\Windows\System\ZbsHhrA.exe
  2⤵
  PID:6024
- C:\Windows\System\yRmpAcB.exe
  C:\Windows\System\yRmpAcB.exe
  2⤵
  PID:6048
- C:\Windows\System\vjPrNDK.exe
  C:\Windows\System\vjPrNDK.exe
  2⤵
  PID:6064
- C:\Windows\System\vtTBTik.exe
  C:\Windows\System\vtTBTik.exe
  2⤵
  PID:6080
- C:\Windows\System\AMjmPii.exe
  C:\Windows\System\AMjmPii.exe
  2⤵
  PID:6112
- C:\Windows\System\wWTpQUU.exe
  C:\Windows\System\wWTpQUU.exe
  2⤵
  PID:1496
- C:\Windows\System\EYZPmPA.exe
  C:\Windows\System\EYZPmPA.exe
  2⤵
  PID:5172
- C:\Windows\System\ESDbmeF.exe
  C:\Windows\System\ESDbmeF.exe
  2⤵
  PID:5252
- C:\Windows\System\nthsmDN.exe
  C:\Windows\System\nthsmDN.exe
  2⤵
  PID:5300
- C:\Windows\System\jtaMgrW.exe
  C:\Windows\System\jtaMgrW.exe
  2⤵
  PID:5368
- C:\Windows\System\xPbyKex.exe
  C:\Windows\System\xPbyKex.exe
  2⤵
  PID:5444
- C:\Windows\System\jANYrRJ.exe
  C:\Windows\System\jANYrRJ.exe
  2⤵
  PID:5488
- C:\Windows\System\xkzROFz.exe
  C:\Windows\System\xkzROFz.exe
  2⤵
  PID:5556
- C:\Windows\System\oTEixpF.exe
  C:\Windows\System\oTEixpF.exe
  2⤵
  PID:5676
- C:\Windows\System\SbIJcnk.exe
  C:\Windows\System\SbIJcnk.exe
  2⤵
  PID:5732
- C:\Windows\System\lrzoRCd.exe
  C:\Windows\System\lrzoRCd.exe
  2⤵
  PID:5800
- C:\Windows\System\LrYVHlh.exe
  C:\Windows\System\LrYVHlh.exe
  2⤵
  PID:5872
- C:\Windows\System\ZCeRTtN.exe
  C:\Windows\System\ZCeRTtN.exe
  2⤵
  PID:5916
- C:\Windows\System\JXRTyFl.exe
  C:\Windows\System\JXRTyFl.exe
  2⤵
  PID:5984
- C:\Windows\System\HcYObqe.exe
  C:\Windows\System\HcYObqe.exe
  2⤵
  PID:6100
- C:\Windows\System\oZVBYOq.exe
  C:\Windows\System\oZVBYOq.exe
  2⤵
  PID:6136
- C:\Windows\System\AwudLAY.exe
  C:\Windows\System\AwudLAY.exe
  2⤵
  PID:5216
- C:\Windows\System\bMPNcCI.exe
  C:\Windows\System\bMPNcCI.exe
  2⤵
  PID:5312
- C:\Windows\System\nIjlqod.exe
  C:\Windows\System\nIjlqod.exe
  2⤵
  PID:5464
- C:\Windows\System\zknonan.exe
  C:\Windows\System\zknonan.exe
  2⤵
  PID:5640
- C:\Windows\System\jiaiagE.exe
  C:\Windows\System\jiaiagE.exe
  2⤵
  PID:5716
- C:\Windows\System\qKokCzI.exe
  C:\Windows\System\qKokCzI.exe
  2⤵
  PID:5772
- C:\Windows\System\MiwDQVE.exe
  C:\Windows\System\MiwDQVE.exe
  2⤵
  PID:5948
- C:\Windows\System\ogKYPhI.exe
  C:\Windows\System\ogKYPhI.exe
  2⤵
  PID:5152
- C:\Windows\System\nxRyTpJ.exe
  C:\Windows\System\nxRyTpJ.exe
  2⤵
  PID:5204
- C:\Windows\System\rvaOwOV.exe
  C:\Windows\System\rvaOwOV.exe
  2⤵
  PID:5704
- C:\Windows\System\iVchmNH.exe
  C:\Windows\System\iVchmNH.exe
  2⤵
  PID:5756
- C:\Windows\System\NMRrQlm.exe
  C:\Windows\System\NMRrQlm.exe
  2⤵
  PID:6060
- C:\Windows\System\qQLfqxC.exe
  C:\Windows\System\qQLfqxC.exe
  2⤵
  PID:6160
- C:\Windows\System\ZMUUeYu.exe
  C:\Windows\System\ZMUUeYu.exe
  2⤵
  PID:6196
- C:\Windows\System\hJmmMUC.exe
  C:\Windows\System\hJmmMUC.exe
  2⤵
  PID:6224
- C:\Windows\System\RVyueNa.exe
  C:\Windows\System\RVyueNa.exe
  2⤵
  PID:6252
- C:\Windows\System\MktfKla.exe
  C:\Windows\System\MktfKla.exe
  2⤵
  PID:6276
- C:\Windows\System\HcIGmoQ.exe
  C:\Windows\System\HcIGmoQ.exe
  2⤵
  PID:6300
- C:\Windows\System\njvgwnb.exe
  C:\Windows\System\njvgwnb.exe
  2⤵
  PID:6320
- C:\Windows\System\DVbbqFY.exe
  C:\Windows\System\DVbbqFY.exe
  2⤵
  PID:6344
- C:\Windows\System\rMwRXnn.exe
  C:\Windows\System\rMwRXnn.exe
  2⤵
  PID:6380
- C:\Windows\System\qgrkqfs.exe
  C:\Windows\System\qgrkqfs.exe
  2⤵
  PID:6408
- C:\Windows\System\LgWWaOQ.exe
  C:\Windows\System\LgWWaOQ.exe
  2⤵
  PID:6452
- C:\Windows\System\JoWbuue.exe
  C:\Windows\System\JoWbuue.exe
  2⤵
  PID:6476
- C:\Windows\System\lNDxhvB.exe
  C:\Windows\System\lNDxhvB.exe
  2⤵
  PID:6508
- C:\Windows\System\rvxZZYo.exe
  C:\Windows\System\rvxZZYo.exe
  2⤵
  PID:6548
- C:\Windows\System\gRTfqpb.exe
  C:\Windows\System\gRTfqpb.exe
  2⤵
  PID:6584
- C:\Windows\System\venDHgu.exe
  C:\Windows\System\venDHgu.exe
  2⤵
  PID:6612
- C:\Windows\System\fJHhWdU.exe
  C:\Windows\System\fJHhWdU.exe
  2⤵
  PID:6648
- C:\Windows\System\ezbHZjy.exe
  C:\Windows\System\ezbHZjy.exe
  2⤵
  PID:6668
- C:\Windows\System\qXaYrBN.exe
  C:\Windows\System\qXaYrBN.exe
  2⤵
  PID:6696
- C:\Windows\System\VbXFSMz.exe
  C:\Windows\System\VbXFSMz.exe
  2⤵
  PID:6736
- C:\Windows\System\vLtxQQg.exe
  C:\Windows\System\vLtxQQg.exe
  2⤵
  PID:6764
- C:\Windows\System\EGJRzZj.exe
  C:\Windows\System\EGJRzZj.exe
  2⤵
  PID:6792
- C:\Windows\System\BuCUhaM.exe
  C:\Windows\System\BuCUhaM.exe
  2⤵
  PID:6824
- C:\Windows\System\ihwiZvG.exe
  C:\Windows\System\ihwiZvG.exe
  2⤵
  PID:6852
- C:\Windows\System\tcyavKE.exe
  C:\Windows\System\tcyavKE.exe
  2⤵
  PID:6880
- C:\Windows\System\GfInwbd.exe
  C:\Windows\System\GfInwbd.exe
  2⤵
  PID:6904
- C:\Windows\System\FntFIBx.exe
  C:\Windows\System\FntFIBx.exe
  2⤵
  PID:6932
- C:\Windows\System\RrJPDYg.exe
  C:\Windows\System\RrJPDYg.exe
  2⤵
  PID:6964
- C:\Windows\System\TxwbtsT.exe
  C:\Windows\System\TxwbtsT.exe
  2⤵
  PID:6988
- C:\Windows\System\pnToRpu.exe
  C:\Windows\System\pnToRpu.exe
  2⤵
  PID:7016
- C:\Windows\System\JdJvDph.exe
  C:\Windows\System\JdJvDph.exe
  2⤵
  PID:7040
- C:\Windows\System\dBtjzbF.exe
  C:\Windows\System\dBtjzbF.exe
  2⤵
  PID:7060
- C:\Windows\System\xKXVRKG.exe
  C:\Windows\System\xKXVRKG.exe
  2⤵
  PID:7096
- C:\Windows\System\iQLBtfC.exe
  C:\Windows\System\iQLBtfC.exe
  2⤵
  PID:7128
- C:\Windows\System\RAEecFa.exe
  C:\Windows\System\RAEecFa.exe
  2⤵
  PID:7156
- C:\Windows\System\efvFjis.exe
  C:\Windows\System\efvFjis.exe
  2⤵
  PID:5904
- C:\Windows\System\FwnvSon.exe
  C:\Windows\System\FwnvSon.exe
  2⤵
  PID:6188
- C:\Windows\System\wnlVtJz.exe
  C:\Windows\System\wnlVtJz.exe
  2⤵
  PID:6156
- C:\Windows\System\kginxeb.exe
  C:\Windows\System\kginxeb.exe
  2⤵
  PID:6268
- C:\Windows\System\bCturmH.exe
  C:\Windows\System\bCturmH.exe
  2⤵
  PID:6240
- C:\Windows\System\HIRytlG.exe
  C:\Windows\System\HIRytlG.exe
  2⤵
  PID:6336
- C:\Windows\System\HUBiYYM.exe
  C:\Windows\System\HUBiYYM.exe
  2⤵
  PID:6436
- C:\Windows\System\tbYlPea.exe
  C:\Windows\System\tbYlPea.exe
  2⤵
  PID:6528
- C:\Windows\System\JVXvIJS.exe
  C:\Windows\System\JVXvIJS.exe
  2⤵
  PID:6596
- C:\Windows\System\XoJFcqL.exe
  C:\Windows\System\XoJFcqL.exe
  2⤵
  PID:6680
- C:\Windows\System\XgPvUaY.exe
  C:\Windows\System\XgPvUaY.exe
  2⤵
  PID:6748
- C:\Windows\System\icmcAmc.exe
  C:\Windows\System\icmcAmc.exe
  2⤵
  PID:6812
- C:\Windows\System\CmOTbwr.exe
  C:\Windows\System\CmOTbwr.exe
  2⤵
  PID:6860
- C:\Windows\System\JxCLziP.exe
  C:\Windows\System\JxCLziP.exe
  2⤵
  PID:6928
- C:\Windows\System\oPQBAJV.exe
  C:\Windows\System\oPQBAJV.exe
  2⤵
  PID:6980
- C:\Windows\System\cvzQdpU.exe
  C:\Windows\System\cvzQdpU.exe
  2⤵
  PID:7076
- C:\Windows\System\BETWuCc.exe
  C:\Windows\System\BETWuCc.exe
  2⤵
  PID:7140
- C:\Windows\System\HOqJEol.exe
  C:\Windows\System\HOqJEol.exe
  2⤵
  PID:6152
- C:\Windows\System\PHFBJJI.exe
  C:\Windows\System\PHFBJJI.exe
  2⤵
  PID:6016
- C:\Windows\System\tbrzmKm.exe
  C:\Windows\System\tbrzmKm.exe
  2⤵
  PID:6500
- C:\Windows\System\KCgFyyj.exe
  C:\Windows\System\KCgFyyj.exe
  2⤵
  PID:6636
- C:\Windows\System\OSLTVkM.exe
  C:\Windows\System\OSLTVkM.exe
  2⤵
  PID:6716
- C:\Windows\System\ZXlRvpV.exe
  C:\Windows\System\ZXlRvpV.exe
  2⤵
  PID:6900
- C:\Windows\System\OVJynvC.exe
  C:\Windows\System\OVJynvC.exe
  2⤵
  PID:7024
- C:\Windows\System\PdPvfGj.exe
  C:\Windows\System\PdPvfGj.exe
  2⤵
  PID:5816
- C:\Windows\System\LlkFxlU.exe
  C:\Windows\System\LlkFxlU.exe
  2⤵
  PID:6660
- C:\Windows\System\FWwrLIK.exe
  C:\Windows\System\FWwrLIK.exe
  2⤵
  PID:6872
- C:\Windows\System\NMMJSAr.exe
  C:\Windows\System\NMMJSAr.exe
  2⤵
  PID:5576
- C:\Windows\System\OkHnsMW.exe
  C:\Windows\System\OkHnsMW.exe
  2⤵
  PID:6956
- C:\Windows\System\RujGEGI.exe
  C:\Windows\System\RujGEGI.exe
  2⤵
  PID:6784
- C:\Windows\System\jikMhVC.exe
  C:\Windows\System\jikMhVC.exe
  2⤵
  PID:7192
- C:\Windows\System\nGjCltx.exe
  C:\Windows\System\nGjCltx.exe
  2⤵
  PID:7220
- C:\Windows\System\vnYTgJz.exe
  C:\Windows\System\vnYTgJz.exe
  2⤵
  PID:7252
- C:\Windows\System\NpqpONo.exe
  C:\Windows\System\NpqpONo.exe
  2⤵
  PID:7280
- C:\Windows\System\EeWmUaK.exe
  C:\Windows\System\EeWmUaK.exe
  2⤵
  PID:7320
- C:\Windows\System\OqBPnxV.exe
  C:\Windows\System\OqBPnxV.exe
  2⤵
  PID:7348
- C:\Windows\System\yCGkrRm.exe
  C:\Windows\System\yCGkrRm.exe
  2⤵
  PID:7376
- C:\Windows\System\MiIBTiC.exe
  C:\Windows\System\MiIBTiC.exe
  2⤵
  PID:7408
- C:\Windows\System\MnWcFMp.exe
  C:\Windows\System\MnWcFMp.exe
  2⤵
  PID:7436
- C:\Windows\System\CyvxJHM.exe
  C:\Windows\System\CyvxJHM.exe
  2⤵
  PID:7460
- C:\Windows\System\lfXFQdD.exe
  C:\Windows\System\lfXFQdD.exe
  2⤵
  PID:7488
- C:\Windows\System\vLravtP.exe
  C:\Windows\System\vLravtP.exe
  2⤵
  PID:7516
- C:\Windows\System\cSgCxJY.exe
  C:\Windows\System\cSgCxJY.exe
  2⤵
  PID:7544
- C:\Windows\System\dPHMvsQ.exe
  C:\Windows\System\dPHMvsQ.exe
  2⤵
  PID:7572
- C:\Windows\System\oIGqBNG.exe
  C:\Windows\System\oIGqBNG.exe
  2⤵
  PID:7600
- C:\Windows\System\HNvLbwL.exe
  C:\Windows\System\HNvLbwL.exe
  2⤵
  PID:7616
- C:\Windows\System\EMxgrcz.exe
  C:\Windows\System\EMxgrcz.exe
  2⤵
  PID:7656
- C:\Windows\System\KcxueWQ.exe
  C:\Windows\System\KcxueWQ.exe
  2⤵
  PID:7684
- C:\Windows\System\zufsXxt.exe
  C:\Windows\System\zufsXxt.exe
  2⤵
  PID:7712
- C:\Windows\System\OIVNPQk.exe
  C:\Windows\System\OIVNPQk.exe
  2⤵
  PID:7740
- C:\Windows\System\KRFzawC.exe
  C:\Windows\System\KRFzawC.exe
  2⤵
  PID:7768
- C:\Windows\System\ZTFCARB.exe
  C:\Windows\System\ZTFCARB.exe
  2⤵
  PID:7800
- C:\Windows\System\XgbdGJj.exe
  C:\Windows\System\XgbdGJj.exe
  2⤵
  PID:7828
- C:\Windows\System\WXhUpuA.exe
  C:\Windows\System\WXhUpuA.exe
  2⤵
  PID:7856
- C:\Windows\System\Knnxnto.exe
  C:\Windows\System\Knnxnto.exe
  2⤵
  PID:7884
- C:\Windows\System\EuEudLu.exe
  C:\Windows\System\EuEudLu.exe
  2⤵
  PID:7908
- C:\Windows\System\nmKeLLE.exe
  C:\Windows\System\nmKeLLE.exe
  2⤵
  PID:7940
- C:\Windows\System\pKuJitK.exe
  C:\Windows\System\pKuJitK.exe
  2⤵
  PID:7964
- C:\Windows\System\DctZRxU.exe
  C:\Windows\System\DctZRxU.exe
  2⤵
  PID:7996
- C:\Windows\System\mBmLtHm.exe
  C:\Windows\System\mBmLtHm.exe
  2⤵
  PID:8020
- C:\Windows\System\niwMgRP.exe
  C:\Windows\System\niwMgRP.exe
  2⤵
  PID:8052
- C:\Windows\System\DBYITxx.exe
  C:\Windows\System\DBYITxx.exe
  2⤵
  PID:8080
- C:\Windows\System\yWFEXGy.exe
  C:\Windows\System\yWFEXGy.exe
  2⤵
  PID:8108
- C:\Windows\System\WiCnigX.exe
  C:\Windows\System\WiCnigX.exe
  2⤵
  PID:8136
- C:\Windows\System\iQHgsGU.exe
  C:\Windows\System\iQHgsGU.exe
  2⤵
  PID:8160
- C:\Windows\System\fzliLnj.exe
  C:\Windows\System\fzliLnj.exe
  2⤵
  PID:8188
- C:\Windows\System\noBTFnQ.exe
  C:\Windows\System\noBTFnQ.exe
  2⤵
  PID:7240
- C:\Windows\System\BEzZrdN.exe
  C:\Windows\System\BEzZrdN.exe
  2⤵
  PID:7292
- C:\Windows\System\pEMCoDd.exe
  C:\Windows\System\pEMCoDd.exe
  2⤵
  PID:7340
- C:\Windows\System\tKrkjpM.exe
  C:\Windows\System\tKrkjpM.exe
  2⤵
  PID:7416
- C:\Windows\System\mReHxEs.exe
  C:\Windows\System\mReHxEs.exe
  2⤵
  PID:7484
- C:\Windows\System\eBjSlTJ.exe
  C:\Windows\System\eBjSlTJ.exe
  2⤵
  PID:7540
- C:\Windows\System\ctclfqo.exe
  C:\Windows\System\ctclfqo.exe
  2⤵
  PID:7608
- C:\Windows\System\fpElqFJ.exe
  C:\Windows\System\fpElqFJ.exe
  2⤵
  PID:7668
- C:\Windows\System\MluIpWF.exe
  C:\Windows\System\MluIpWF.exe
  2⤵
  PID:7736
- C:\Windows\System\DIoqmpk.exe
  C:\Windows\System\DIoqmpk.exe
  2⤵
  PID:7808
- C:\Windows\System\DmHQbxo.exe
  C:\Windows\System\DmHQbxo.exe
  2⤵
  PID:7892
- C:\Windows\System\UCKlNHM.exe
  C:\Windows\System\UCKlNHM.exe
  2⤵
  PID:7932
- C:\Windows\System\ltxtJUy.exe
  C:\Windows\System\ltxtJUy.exe
  2⤵
  PID:8004
- C:\Windows\System\EhVVJMV.exe
  C:\Windows\System\EhVVJMV.exe
  2⤵
  PID:8072
- C:\Windows\System\lzlGVAZ.exe
  C:\Windows\System\lzlGVAZ.exe
  2⤵
  PID:6232
- C:\Windows\System\OmzFBUj.exe
  C:\Windows\System\OmzFBUj.exe
  2⤵
  PID:7188
- C:\Windows\System\BxgsnJa.exe
  C:\Windows\System\BxgsnJa.exe
  2⤵
  PID:7300
- C:\Windows\System\cMBkdrD.exe
  C:\Windows\System\cMBkdrD.exe
  2⤵
  PID:7456
- C:\Windows\System\GimDzcU.exe
  C:\Windows\System\GimDzcU.exe
  2⤵
  PID:7628
- C:\Windows\System\RIgOCsr.exe
  C:\Windows\System\RIgOCsr.exe
  2⤵
  PID:7760
- C:\Windows\System\CQdDgue.exe
  C:\Windows\System\CQdDgue.exe
  2⤵
  PID:7928
- C:\Windows\System\ncapWlu.exe
  C:\Windows\System\ncapWlu.exe
  2⤵
  PID:8096
- C:\Windows\System\tRhCPTM.exe
  C:\Windows\System\tRhCPTM.exe
  2⤵
  PID:7276
- C:\Windows\System\bNmalEL.exe
  C:\Windows\System\bNmalEL.exe
  2⤵
  PID:7584
- C:\Windows\System\rYejzxV.exe
  C:\Windows\System\rYejzxV.exe
  2⤵
  PID:7988
- C:\Windows\System\uOHifZq.exe
  C:\Windows\System\uOHifZq.exe
  2⤵
  PID:7564
- C:\Windows\System\IwvBbeB.exe
  C:\Windows\System\IwvBbeB.exe
  2⤵
  PID:7216
- C:\Windows\System\eXQxzPs.exe
  C:\Windows\System\eXQxzPs.exe
  2⤵
  PID:8204
- C:\Windows\System\NMpfDia.exe
  C:\Windows\System\NMpfDia.exe
  2⤵
  PID:8232
- C:\Windows\System\DVFDzbD.exe
  C:\Windows\System\DVFDzbD.exe
  2⤵
  PID:8260
- C:\Windows\System\lsODXZO.exe
  C:\Windows\System\lsODXZO.exe
  2⤵
  PID:8288
- C:\Windows\System\QXNiMaW.exe
  C:\Windows\System\QXNiMaW.exe
  2⤵
  PID:8320
- C:\Windows\System\dqRpDgW.exe
  C:\Windows\System\dqRpDgW.exe
  2⤵
  PID:8352
- C:\Windows\System\FOlYYSb.exe
  C:\Windows\System\FOlYYSb.exe
  2⤵
  PID:8372
- C:\Windows\System\KxjDXPc.exe
  C:\Windows\System\KxjDXPc.exe
  2⤵
  PID:8404
- C:\Windows\System\MrRlnlL.exe
  C:\Windows\System\MrRlnlL.exe
  2⤵
  PID:8428
- C:\Windows\System\QHoSvgr.exe
  C:\Windows\System\QHoSvgr.exe
  2⤵
  PID:8464
- C:\Windows\System\RLMoZcu.exe
  C:\Windows\System\RLMoZcu.exe
  2⤵
  PID:8488
- C:\Windows\System\QkXDoMp.exe
  C:\Windows\System\QkXDoMp.exe
  2⤵
  PID:8516
- C:\Windows\System\ZEluVlZ.exe
  C:\Windows\System\ZEluVlZ.exe
  2⤵
  PID:8548
- C:\Windows\System\gozrjDz.exe
  C:\Windows\System\gozrjDz.exe
  2⤵
  PID:8572
- C:\Windows\System\baZGvqC.exe
  C:\Windows\System\baZGvqC.exe
  2⤵
  PID:8600
- C:\Windows\System\xWEUdml.exe
  C:\Windows\System\xWEUdml.exe
  2⤵
  PID:8628
- C:\Windows\System\JvPdBfx.exe
  C:\Windows\System\JvPdBfx.exe
  2⤵
  PID:8656
- C:\Windows\System\HmZXzss.exe
  C:\Windows\System\HmZXzss.exe
  2⤵
  PID:8684
- C:\Windows\System\uHgbCgy.exe
  C:\Windows\System\uHgbCgy.exe
  2⤵
  PID:8716
- C:\Windows\System\tbvKYrU.exe
  C:\Windows\System\tbvKYrU.exe
  2⤵
  PID:8740
- C:\Windows\System\auUOCHA.exe
  C:\Windows\System\auUOCHA.exe
  2⤵
  PID:8780
- C:\Windows\System\WnBYXYz.exe
  C:\Windows\System\WnBYXYz.exe
  2⤵
  PID:8800
- C:\Windows\System\XIWJbfW.exe
  C:\Windows\System\XIWJbfW.exe
  2⤵
  PID:8824
- C:\Windows\System\qvFPLgU.exe
  C:\Windows\System\qvFPLgU.exe
  2⤵
  PID:8860
- C:\Windows\System\iRTpkKh.exe
  C:\Windows\System\iRTpkKh.exe
  2⤵
  PID:8876
- C:\Windows\System\LPsQZBb.exe
  C:\Windows\System\LPsQZBb.exe
  2⤵
  PID:8904
- C:\Windows\System\rvbCfGx.exe
  C:\Windows\System\rvbCfGx.exe
  2⤵
  PID:8936
- C:\Windows\System\xXvpMeW.exe
  C:\Windows\System\xXvpMeW.exe
  2⤵
  PID:8968
- C:\Windows\System\UTzxDZF.exe
  C:\Windows\System\UTzxDZF.exe
  2⤵
  PID:9004
- C:\Windows\System\kLLJZNM.exe
  C:\Windows\System\kLLJZNM.exe
  2⤵
  PID:9036
- C:\Windows\System\bfeFDvL.exe
  C:\Windows\System\bfeFDvL.exe
  2⤵
  PID:9060
- C:\Windows\System\expSpyJ.exe
  C:\Windows\System\expSpyJ.exe
  2⤵
  PID:9092
- C:\Windows\System\wEdTvky.exe
  C:\Windows\System\wEdTvky.exe
  2⤵
  PID:9128
- C:\Windows\System\sZyNRQq.exe
  C:\Windows\System\sZyNRQq.exe
  2⤵
  PID:9156
- C:\Windows\System\ymQfhgK.exe
  C:\Windows\System\ymQfhgK.exe
  2⤵
  PID:9204
- C:\Windows\System\lxHemDW.exe
  C:\Windows\System\lxHemDW.exe
  2⤵
  PID:8228
- C:\Windows\System\XXtrDQj.exe
  C:\Windows\System\XXtrDQj.exe
  2⤵
  PID:8308
- C:\Windows\System\dkyUuCQ.exe
  C:\Windows\System\dkyUuCQ.exe
  2⤵
  PID:8384
- C:\Windows\System\SkHoBDL.exe
  C:\Windows\System\SkHoBDL.exe
  2⤵
  PID:8456
- C:\Windows\System\DTYQIur.exe
  C:\Windows\System\DTYQIur.exe
  2⤵
  PID:8508
- C:\Windows\System\bqCBfAM.exe
  C:\Windows\System\bqCBfAM.exe
  2⤵
  PID:8568
- C:\Windows\System\uTwWQfb.exe
  C:\Windows\System\uTwWQfb.exe
  2⤵
  PID:8620
- C:\Windows\System\btiuPxX.exe
  C:\Windows\System\btiuPxX.exe
  2⤵
  PID:8696
- C:\Windows\System\jYcTLoP.exe
  C:\Windows\System\jYcTLoP.exe
  2⤵
  PID:8752
- C:\Windows\System\QMRbgvD.exe
  C:\Windows\System\QMRbgvD.exe
  2⤵
  PID:8812
- C:\Windows\System\cEWdjiB.exe
  C:\Windows\System\cEWdjiB.exe
  2⤵
  PID:8888
- C:\Windows\System\mKPFsqT.exe
  C:\Windows\System\mKPFsqT.exe
  2⤵
  PID:8960
- C:\Windows\System\xnOetYO.exe
  C:\Windows\System\xnOetYO.exe
  2⤵
  PID:9020
- C:\Windows\System\OWKLrMu.exe
  C:\Windows\System\OWKLrMu.exe
  2⤵
  PID:9112
- C:\Windows\System\aawqSBz.exe
  C:\Windows\System\aawqSBz.exe
  2⤵
  PID:9176
- C:\Windows\System\jRguxhX.exe
  C:\Windows\System\jRguxhX.exe
  2⤵
  PID:8300
- C:\Windows\System\UzvPxiz.exe
  C:\Windows\System\UzvPxiz.exe
  2⤵
  PID:8420
- C:\Windows\System\berUpph.exe
  C:\Windows\System\berUpph.exe
  2⤵
  PID:8556
- C:\Windows\System\veqLnlu.exe
  C:\Windows\System\veqLnlu.exe
  2⤵
  PID:8732
- C:\Windows\System\IdYNHfQ.exe
  C:\Windows\System\IdYNHfQ.exe
  2⤵
  PID:8868
- C:\Windows\System\LBDTTZB.exe
  C:\Windows\System\LBDTTZB.exe
  2⤵
  PID:9048
- C:\Windows\System\KBUufpY.exe
  C:\Windows\System\KBUufpY.exe
  2⤵
  PID:9184
- C:\Windows\System\jCrIXWL.exe
  C:\Windows\System\jCrIXWL.exe
  2⤵
  PID:8540
- C:\Windows\System\jkTTXog.exe
  C:\Windows\System\jkTTXog.exe
  2⤵
  PID:8920
- C:\Windows\System\XPWkNtj.exe
  C:\Windows\System\XPWkNtj.exe
  2⤵
  PID:9152
- C:\Windows\System\YWRkqxa.exe
  C:\Windows\System\YWRkqxa.exe
  2⤵
  PID:8996
- C:\Windows\System\TZwaAEq.exe
  C:\Windows\System\TZwaAEq.exe
  2⤵
  PID:8820
- C:\Windows\System\YSEFyla.exe
  C:\Windows\System\YSEFyla.exe
  2⤵
  PID:9244
- C:\Windows\System\DldsVKl.exe
  C:\Windows\System\DldsVKl.exe
  2⤵
  PID:9264
- C:\Windows\System\rPtArBW.exe
  C:\Windows\System\rPtArBW.exe
  2⤵
  PID:9300
- C:\Windows\System\dDRqkAC.exe
  C:\Windows\System\dDRqkAC.exe
  2⤵
  PID:9324
- C:\Windows\System\vXrrPdQ.exe
  C:\Windows\System\vXrrPdQ.exe
  2⤵
  PID:9348
- C:\Windows\System\ivgLMbX.exe
  C:\Windows\System\ivgLMbX.exe
  2⤵
  PID:9380
- C:\Windows\System\wRuAePs.exe
  C:\Windows\System\wRuAePs.exe
  2⤵
  PID:9404
- C:\Windows\System\VmnEWcZ.exe
  C:\Windows\System\VmnEWcZ.exe
  2⤵
  PID:9436
- C:\Windows\System\lWAiZhG.exe
  C:\Windows\System\lWAiZhG.exe
  2⤵
  PID:9460
- C:\Windows\System\zsSfusa.exe
  C:\Windows\System\zsSfusa.exe
  2⤵
  PID:9488
- C:\Windows\System\PvakNSj.exe
  C:\Windows\System\PvakNSj.exe
  2⤵
  PID:9532
- C:\Windows\System\lLbSViI.exe
  C:\Windows\System\lLbSViI.exe
  2⤵
  PID:9564
- C:\Windows\System\fOBamDz.exe
  C:\Windows\System\fOBamDz.exe
  2⤵
  PID:9592
- C:\Windows\System\yUjIVMm.exe
  C:\Windows\System\yUjIVMm.exe
  2⤵
  PID:9632
- C:\Windows\System\tXpDSEv.exe
  C:\Windows\System\tXpDSEv.exe
  2⤵
  PID:9676
- C:\Windows\System\jliMdWL.exe
  C:\Windows\System\jliMdWL.exe
  2⤵
  PID:9720
- C:\Windows\System\vyOjxDH.exe
  C:\Windows\System\vyOjxDH.exe
  2⤵
  PID:9760
- C:\Windows\System\wJIzxwV.exe
  C:\Windows\System\wJIzxwV.exe
  2⤵
  PID:9792
- C:\Windows\System\qRDjoLM.exe
  C:\Windows\System\qRDjoLM.exe
  2⤵
  PID:9820
- C:\Windows\System\fYbDLfd.exe
  C:\Windows\System\fYbDLfd.exe
  2⤵
  PID:9872
- C:\Windows\System\IgykHDB.exe
  C:\Windows\System\IgykHDB.exe
  2⤵
  PID:9908
- C:\Windows\System\erccHJe.exe
  C:\Windows\System\erccHJe.exe
  2⤵
  PID:9940
- C:\Windows\System\LcpinMc.exe
  C:\Windows\System\LcpinMc.exe
  2⤵
  PID:9992
- C:\Windows\System\yXCFZIi.exe
  C:\Windows\System\yXCFZIi.exe
  2⤵
  PID:10024
- C:\Windows\System\FRZtgsv.exe
  C:\Windows\System\FRZtgsv.exe
  2⤵
  PID:10064
- C:\Windows\System\BAppvjd.exe
  C:\Windows\System\BAppvjd.exe
  2⤵
  PID:10096
- C:\Windows\System\hFmfwMx.exe
  C:\Windows\System\hFmfwMx.exe
  2⤵
  PID:10124
- C:\Windows\System\NPDRKhb.exe
  C:\Windows\System\NPDRKhb.exe
  2⤵
  PID:10168
- C:\Windows\System\hLKbXpu.exe
  C:\Windows\System\hLKbXpu.exe
  2⤵
  PID:10188
- C:\Windows\System\CHZDGyK.exe
  C:\Windows\System\CHZDGyK.exe
  2⤵
  PID:10220
- C:\Windows\System\MEySqgk.exe
  C:\Windows\System\MEySqgk.exe
  2⤵
  PID:9260
- C:\Windows\System\YZtAfmC.exe
  C:\Windows\System\YZtAfmC.exe
  2⤵
  PID:9332
- C:\Windows\System\qBQFPbB.exe
  C:\Windows\System\qBQFPbB.exe
  2⤵
  PID:9396
- C:\Windows\System\VQkbcNq.exe
  C:\Windows\System\VQkbcNq.exe
  2⤵
  PID:9456
- C:\Windows\System\ctqJnQB.exe
  C:\Windows\System\ctqJnQB.exe
  2⤵
  PID:9552
- C:\Windows\System\mYNvKse.exe
  C:\Windows\System\mYNvKse.exe
  2⤵
  PID:9612
- C:\Windows\System\aGCClNT.exe
  C:\Windows\System\aGCClNT.exe
  2⤵
  PID:9712
- C:\Windows\System\QvsYNUy.exe
  C:\Windows\System\QvsYNUy.exe
  2⤵
  PID:9804
- C:\Windows\System\bkUKqsH.exe
  C:\Windows\System\bkUKqsH.exe
  2⤵
  PID:9896
- C:\Windows\System\LzGxAam.exe
  C:\Windows\System\LzGxAam.exe
  2⤵
  PID:9980
- C:\Windows\System\lpYhpfy.exe
  C:\Windows\System\lpYhpfy.exe
  2⤵
  PID:10084
- C:\Windows\System\zvaPGEV.exe
  C:\Windows\System\zvaPGEV.exe
  2⤵
  PID:10156
- C:\Windows\System\cpdOrVr.exe
  C:\Windows\System\cpdOrVr.exe
  2⤵
  PID:10212
- C:\Windows\System\zydqbBK.exe
  C:\Windows\System\zydqbBK.exe
  2⤵
  PID:9316
- C:\Windows\System\SAdmHIn.exe
  C:\Windows\System\SAdmHIn.exe
  2⤵
  PID:9484
- C:\Windows\System\hNhQhut.exe
  C:\Windows\System\hNhQhut.exe
  2⤵
  PID:9688
- C:\Windows\System\PaAHMLy.exe
  C:\Windows\System\PaAHMLy.exe
  2⤵
  PID:9892
- C:\Windows\System\vqxVejq.exe
  C:\Windows\System\vqxVejq.exe
  2⤵
  PID:10108
- C:\Windows\System\SYJCYir.exe
  C:\Windows\System\SYJCYir.exe
  2⤵
  PID:9256
- C:\Windows\System\gcrGeCE.exe
  C:\Windows\System\gcrGeCE.exe
  2⤵
  PID:9668
- C:\Windows\System\HwOYXvT.exe
  C:\Windows\System\HwOYXvT.exe
  2⤵
  PID:10136
- C:\Windows\System\hBppNxU.exe
  C:\Windows\System\hBppNxU.exe
  2⤵
  PID:9832
- C:\Windows\System\BkrLqqw.exe
  C:\Windows\System\BkrLqqw.exe
  2⤵
  PID:9608
- C:\Windows\System\mvhSmgU.exe
  C:\Windows\System\mvhSmgU.exe
  2⤵
  PID:10268
- C:\Windows\System\AadAgOP.exe
  C:\Windows\System\AadAgOP.exe
  2⤵
  PID:10300
- C:\Windows\System\UxZGvew.exe
  C:\Windows\System\UxZGvew.exe
  2⤵
  PID:10328
- C:\Windows\System\WrWdUdO.exe
  C:\Windows\System\WrWdUdO.exe
  2⤵
  PID:10356
- C:\Windows\System\pmyJDJe.exe
  C:\Windows\System\pmyJDJe.exe
  2⤵
  PID:10384
- C:\Windows\System\jsZdSzi.exe
  C:\Windows\System\jsZdSzi.exe
  2⤵
  PID:10412
- C:\Windows\System\udEiGxd.exe
  C:\Windows\System\udEiGxd.exe
  2⤵
  PID:10440
- C:\Windows\System\TssxZQh.exe
  C:\Windows\System\TssxZQh.exe
  2⤵
  PID:10472
- C:\Windows\System\LEomvLo.exe
  C:\Windows\System\LEomvLo.exe
  2⤵
  PID:10500
- C:\Windows\System\fQPklNe.exe
  C:\Windows\System\fQPklNe.exe
  2⤵
  PID:10528
- C:\Windows\System\nUeOnzN.exe
  C:\Windows\System\nUeOnzN.exe
  2⤵
  PID:10556
- C:\Windows\System\TuTdIIF.exe
  C:\Windows\System\TuTdIIF.exe
  2⤵
  PID:10584
- C:\Windows\System\QuaxqBZ.exe
  C:\Windows\System\QuaxqBZ.exe
  2⤵
  PID:10612
- C:\Windows\System\HtKCgjq.exe
  C:\Windows\System\HtKCgjq.exe
  2⤵
  PID:10640
- C:\Windows\System\ivyQhee.exe
  C:\Windows\System\ivyQhee.exe
  2⤵
  PID:10668
- C:\Windows\System\ubpyscW.exe
  C:\Windows\System\ubpyscW.exe
  2⤵
  PID:10696
- C:\Windows\System\OZSDFgq.exe
  C:\Windows\System\OZSDFgq.exe
  2⤵
  PID:10724
- C:\Windows\System\NLqHLCe.exe
  C:\Windows\System\NLqHLCe.exe
  2⤵
  PID:10752
- C:\Windows\System\fwmCDYu.exe
  C:\Windows\System\fwmCDYu.exe
  2⤵
  PID:10780
- C:\Windows\System\bTYKdKc.exe
  C:\Windows\System\bTYKdKc.exe
  2⤵
  PID:10808
- C:\Windows\System\abYeEbM.exe
  C:\Windows\System\abYeEbM.exe
  2⤵
  PID:10836
- C:\Windows\System\KhrzsWU.exe
  C:\Windows\System\KhrzsWU.exe
  2⤵
  PID:10864
- C:\Windows\System\KYFLprN.exe
  C:\Windows\System\KYFLprN.exe
  2⤵
  PID:10892
- C:\Windows\System\sYGfUqC.exe
  C:\Windows\System\sYGfUqC.exe
  2⤵
  PID:10920
- C:\Windows\System\rvolXxR.exe
  C:\Windows\System\rvolXxR.exe
  2⤵
  PID:10948
- C:\Windows\System\SKXxeGm.exe
  C:\Windows\System\SKXxeGm.exe
  2⤵
  PID:10976
- C:\Windows\System\aQSQtJK.exe
  C:\Windows\System\aQSQtJK.exe
  2⤵
  PID:11004
- C:\Windows\System\PqYAoaV.exe
  C:\Windows\System\PqYAoaV.exe
  2⤵
  PID:11032
- C:\Windows\System\TsiXICZ.exe
  C:\Windows\System\TsiXICZ.exe
  2⤵
  PID:11060
- C:\Windows\System\zcnERzG.exe
  C:\Windows\System\zcnERzG.exe
  2⤵
  PID:11088
- C:\Windows\System\UGnAjIa.exe
  C:\Windows\System\UGnAjIa.exe
  2⤵
  PID:11116
- C:\Windows\System\isBAhSX.exe
  C:\Windows\System\isBAhSX.exe
  2⤵
  PID:11144
- C:\Windows\System\qyIGDoa.exe
  C:\Windows\System\qyIGDoa.exe
  2⤵
  PID:11172
- C:\Windows\System\pLvvQgY.exe
  C:\Windows\System\pLvvQgY.exe
  2⤵
  PID:11200
- C:\Windows\System\EhXNAVP.exe
  C:\Windows\System\EhXNAVP.exe
  2⤵
  PID:11228
- C:\Windows\System\lPeYlkt.exe
  C:\Windows\System\lPeYlkt.exe
  2⤵
  PID:11256
- C:\Windows\System\GYDCCca.exe
  C:\Windows\System\GYDCCca.exe
  2⤵
  PID:10288
- C:\Windows\System\AAtPpKn.exe
  C:\Windows\System\AAtPpKn.exe
  2⤵
  PID:10352
- C:\Windows\System\IMconGq.exe
  C:\Windows\System\IMconGq.exe
  2⤵
  PID:10424
- C:\Windows\System\GyJWjNt.exe
  C:\Windows\System\GyJWjNt.exe
  2⤵
  PID:10492
- C:\Windows\System\CdGFZzR.exe
  C:\Windows\System\CdGFZzR.exe
  2⤵
  PID:10552
- C:\Windows\System\ZvWttlT.exe
  C:\Windows\System\ZvWttlT.exe
  2⤵
  PID:10624
- C:\Windows\System\AqMHObe.exe
  C:\Windows\System\AqMHObe.exe
  2⤵
  PID:10688
- C:\Windows\System\BfMijAX.exe
  C:\Windows\System\BfMijAX.exe
  2⤵
  PID:10748
- C:\Windows\System\ufawvYY.exe
  C:\Windows\System\ufawvYY.exe
  2⤵
  PID:10820
- C:\Windows\System\DUjrNRe.exe
  C:\Windows\System\DUjrNRe.exe
  2⤵
  PID:10884
- C:\Windows\System\KwpEZTi.exe
  C:\Windows\System\KwpEZTi.exe
  2⤵
  PID:10944
- C:\Windows\System\kbECXvf.exe
  C:\Windows\System\kbECXvf.exe
  2⤵
  PID:11016
- C:\Windows\System\ipEVxaw.exe
  C:\Windows\System\ipEVxaw.exe
  2⤵
  PID:11080
- C:\Windows\System\kBkXsWn.exe
  C:\Windows\System\kBkXsWn.exe
  2⤵
  PID:11168
- C:\Windows\System\TcntneV.exe
  C:\Windows\System\TcntneV.exe
  2⤵
  PID:11212
- C:\Windows\System\hiksVus.exe
  C:\Windows\System\hiksVus.exe
  2⤵
  PID:10252
- C:\Windows\System\svDUEZT.exe
  C:\Windows\System\svDUEZT.exe
  2⤵
  PID:10408
- C:\Windows\System\UegPhef.exe
  C:\Windows\System\UegPhef.exe
  2⤵
  PID:10580
- C:\Windows\System\upEVxNq.exe
  C:\Windows\System\upEVxNq.exe
  2⤵
  PID:10736
- C:\Windows\System\NhoeLfo.exe
  C:\Windows\System\NhoeLfo.exe
  2⤵
  PID:10876
- C:\Windows\System\yhdkvpp.exe
  C:\Windows\System\yhdkvpp.exe
  2⤵
  PID:11044
- C:\Windows\System\OKKJbCg.exe
  C:\Windows\System\OKKJbCg.exe
  2⤵
  PID:11136
- C:\Windows\System\tOpdXcu.exe
  C:\Windows\System\tOpdXcu.exe
  2⤵
  PID:10380
- C:\Windows\System\PGUZAhK.exe
  C:\Windows\System\PGUZAhK.exe
  2⤵
  PID:10800
- C:\Windows\System\keaPTTm.exe
  C:\Windows\System\keaPTTm.exe
  2⤵
  PID:11128
- C:\Windows\System\jVOpYZS.exe
  C:\Windows\System\jVOpYZS.exe
  2⤵
  PID:10716
- C:\Windows\System\RkEZoLi.exe
  C:\Windows\System\RkEZoLi.exe
  2⤵
  PID:11108
- C:\Windows\System\rRirdLX.exe
  C:\Windows\System\rRirdLX.exe
  2⤵
  PID:11284
- C:\Windows\System\oNgaJHr.exe
  C:\Windows\System\oNgaJHr.exe
  2⤵
  PID:11312
- C:\Windows\System\zPVeGlZ.exe
  C:\Windows\System\zPVeGlZ.exe
  2⤵
  PID:11340
- C:\Windows\System\ZfHYVLQ.exe
  C:\Windows\System\ZfHYVLQ.exe
  2⤵
  PID:11368
- C:\Windows\System\ounuYpP.exe
  C:\Windows\System\ounuYpP.exe
  2⤵
  PID:11396
- C:\Windows\System\UXrsakr.exe
  C:\Windows\System\UXrsakr.exe
  2⤵
  PID:11424
- C:\Windows\System\bDeTSlX.exe
  C:\Windows\System\bDeTSlX.exe
  2⤵
  PID:11452
- C:\Windows\System\tIqtwaq.exe
  C:\Windows\System\tIqtwaq.exe
  2⤵
  PID:11480
- C:\Windows\System\diJCEEb.exe
  C:\Windows\System\diJCEEb.exe
  2⤵
  PID:11508
- C:\Windows\System\fwRzveY.exe
  C:\Windows\System\fwRzveY.exe
  2⤵
  PID:11536
- C:\Windows\System\TLnGTkN.exe
  C:\Windows\System\TLnGTkN.exe
  2⤵
  PID:11564
- C:\Windows\System\SuVlqHK.exe
  C:\Windows\System\SuVlqHK.exe
  2⤵
  PID:11592
- C:\Windows\System\ITwfZhx.exe
  C:\Windows\System\ITwfZhx.exe
  2⤵
  PID:11620
- C:\Windows\System\xocwfSp.exe
  C:\Windows\System\xocwfSp.exe
  2⤵
  PID:11648
- C:\Windows\System\WevESOJ.exe
  C:\Windows\System\WevESOJ.exe
  2⤵
  PID:11676
- C:\Windows\System\cnKTsyW.exe
  C:\Windows\System\cnKTsyW.exe
  2⤵
  PID:11704
- C:\Windows\System\gCXdaEW.exe
  C:\Windows\System\gCXdaEW.exe
  2⤵
  PID:11732
- C:\Windows\System\GqZqkrM.exe
  C:\Windows\System\GqZqkrM.exe
  2⤵
  PID:11760
- C:\Windows\System\jXDknIs.exe
  C:\Windows\System\jXDknIs.exe
  2⤵
  PID:11788
- C:\Windows\System\dYBxJUp.exe
  C:\Windows\System\dYBxJUp.exe
  2⤵
  PID:11816
- C:\Windows\System\lJDQsfq.exe
  C:\Windows\System\lJDQsfq.exe
  2⤵
  PID:11844
- C:\Windows\System\tInpCJG.exe
  C:\Windows\System\tInpCJG.exe
  2⤵
  PID:11880
- C:\Windows\System\nqEyssP.exe
  C:\Windows\System\nqEyssP.exe
  2⤵
  PID:11920
- C:\Windows\System\BGlqNrL.exe
  C:\Windows\System\BGlqNrL.exe
  2⤵
  PID:11964
- C:\Windows\System\VdXlcBT.exe
  C:\Windows\System\VdXlcBT.exe
  2⤵
  PID:11992
- C:\Windows\System\kEkmGKW.exe
  C:\Windows\System\kEkmGKW.exe
  2⤵
  PID:12020
- C:\Windows\System\IqgRBKY.exe
  C:\Windows\System\IqgRBKY.exe
  2⤵
  PID:12048
- C:\Windows\System\TJpUiNb.exe
  C:\Windows\System\TJpUiNb.exe
  2⤵
  PID:12076
- C:\Windows\System\tDNwNEf.exe
  C:\Windows\System\tDNwNEf.exe
  2⤵
  PID:12104
- C:\Windows\System\UMeBOyd.exe
  C:\Windows\System\UMeBOyd.exe
  2⤵
  PID:12132
- C:\Windows\System\vjbcChy.exe
  C:\Windows\System\vjbcChy.exe
  2⤵
  PID:12160
- C:\Windows\System\TalAVfL.exe
  C:\Windows\System\TalAVfL.exe
  2⤵
  PID:12188
- C:\Windows\System\fvtYwiT.exe
  C:\Windows\System\fvtYwiT.exe
  2⤵
  PID:12216
- C:\Windows\System\JrkzsXw.exe
  C:\Windows\System\JrkzsXw.exe
  2⤵
  PID:12232
- C:\Windows\System\lbElXyY.exe
  C:\Windows\System\lbElXyY.exe
  2⤵
  PID:12272
- C:\Windows\System\yCHtVjn.exe
  C:\Windows\System\yCHtVjn.exe
  2⤵
  PID:11296
- C:\Windows\System\eqFAJKi.exe
  C:\Windows\System\eqFAJKi.exe
  2⤵
  PID:11360
- C:\Windows\System\HqTUNIz.exe
  C:\Windows\System\HqTUNIz.exe
  2⤵
  PID:11392
- C:\Windows\System\xtsMIMb.exe
  C:\Windows\System\xtsMIMb.exe
  2⤵
  PID:11464
- C:\Windows\System\dGwcCCq.exe
  C:\Windows\System\dGwcCCq.exe
  2⤵
  PID:11556
- C:\Windows\System\KTFOdOy.exe
  C:\Windows\System\KTFOdOy.exe
  2⤵
  PID:11616
- C:\Windows\System\BegmFAh.exe
  C:\Windows\System\BegmFAh.exe
  2⤵
  PID:11688
- C:\Windows\System\vJtGjRn.exe
  C:\Windows\System\vJtGjRn.exe
  2⤵
  PID:11752
- C:\Windows\System\mheiyNt.exe
  C:\Windows\System\mheiyNt.exe
  2⤵
  PID:11812
- C:\Windows\System\KiXlSJt.exe
  C:\Windows\System\KiXlSJt.exe
  2⤵
  PID:11900
- C:\Windows\System\IImgNMG.exe
  C:\Windows\System\IImgNMG.exe
  2⤵
  PID:11976
- C:\Windows\System\KqEwECu.exe
  C:\Windows\System\KqEwECu.exe
  2⤵
  PID:12040
- C:\Windows\System\qIgtYIn.exe
  C:\Windows\System\qIgtYIn.exe
  2⤵
  PID:12100
- C:\Windows\System\mkaJxlc.exe
  C:\Windows\System\mkaJxlc.exe
  2⤵
  PID:12172
- C:\Windows\System\mdMWaJp.exe
  C:\Windows\System\mdMWaJp.exe
  2⤵
  PID:12244
- C:\Windows\System\fmiVGLY.exe
  C:\Windows\System\fmiVGLY.exe
  2⤵
  PID:11276
- C:\Windows\System\ngQVYjH.exe
  C:\Windows\System\ngQVYjH.exe
  2⤵
  PID:11448
- C:\Windows\System\XApMDAL.exe
  C:\Windows\System\XApMDAL.exe
  2⤵
  PID:11588
- C:\Windows\System\KDpCFQN.exe
  C:\Windows\System\KDpCFQN.exe
  2⤵
  PID:11744
- C:\Windows\System\LvrjDIx.exe
  C:\Windows\System\LvrjDIx.exe
  2⤵
  PID:11932
- C:\Windows\System\hVZwTgp.exe
  C:\Windows\System\hVZwTgp.exe
  2⤵
  PID:12088
- C:\Windows\System\rVUZdzE.exe
  C:\Windows\System\rVUZdzE.exe
  2⤵
  PID:12228
- C:\Windows\System\SMWlfAP.exe
  C:\Windows\System\SMWlfAP.exe
  2⤵
  PID:11548
- C:\Windows\System\HKhzSQP.exe
  C:\Windows\System\HKhzSQP.exe
  2⤵
  PID:11876
- C:\Windows\System\ytkxITM.exe
  C:\Windows\System\ytkxITM.exe
  2⤵
  PID:11280
- C:\Windows\System\RCmlveS.exe
  C:\Windows\System\RCmlveS.exe
  2⤵
  PID:11872
- C:\Windows\System\KgLWrbM.exe
  C:\Windows\System\KgLWrbM.exe
  2⤵
  PID:12304
- C:\Windows\System\KRGmeBP.exe
  C:\Windows\System\KRGmeBP.exe
  2⤵
  PID:12332
- C:\Windows\System\mwSYCYL.exe
  C:\Windows\System\mwSYCYL.exe
  2⤵
  PID:12360
- C:\Windows\System\TZxXJxI.exe
  C:\Windows\System\TZxXJxI.exe
  2⤵
  PID:12388
- C:\Windows\System\UaGdUTU.exe
  C:\Windows\System\UaGdUTU.exe
  2⤵
  PID:12416
- C:\Windows\System\PVXtjHM.exe
  C:\Windows\System\PVXtjHM.exe
  2⤵
  PID:12444
- C:\Windows\System\YUGKcJb.exe
  C:\Windows\System\YUGKcJb.exe
  2⤵
  PID:12492
- C:\Windows\System\LttFTwx.exe
  C:\Windows\System\LttFTwx.exe
  2⤵
  PID:12508
- C:\Windows\System\oNqVDxl.exe
  C:\Windows\System\oNqVDxl.exe
  2⤵
  PID:12536
- C:\Windows\System\ifPhzMu.exe
  C:\Windows\System\ifPhzMu.exe
  2⤵
  PID:12564
- C:\Windows\System\qUGyNNM.exe
  C:\Windows\System\qUGyNNM.exe
  2⤵
  PID:12592
- C:\Windows\System\bnbwsJf.exe
  C:\Windows\System\bnbwsJf.exe
  2⤵
  PID:12620
- C:\Windows\System\eGjJYWN.exe
  C:\Windows\System\eGjJYWN.exe
  2⤵
  PID:12648
- C:\Windows\System\HORlAxN.exe
  C:\Windows\System\HORlAxN.exe
  2⤵
  PID:12676
- C:\Windows\System\cbQbTHC.exe
  C:\Windows\System\cbQbTHC.exe
  2⤵
  PID:12704
- C:\Windows\System\FwjHGBJ.exe
  C:\Windows\System\FwjHGBJ.exe
  2⤵
  PID:12732
- C:\Windows\System\gDtYGil.exe
  C:\Windows\System\gDtYGil.exe
  2⤵
  PID:12760
- C:\Windows\System\gplhBWx.exe
  C:\Windows\System\gplhBWx.exe
  2⤵
  PID:12788
- C:\Windows\System\HsUPrtT.exe
  C:\Windows\System\HsUPrtT.exe
  2⤵
  PID:12816
- C:\Windows\System\qshEdAl.exe
  C:\Windows\System\qshEdAl.exe
  2⤵
  PID:12844
- C:\Windows\System\YFvVEuv.exe
  C:\Windows\System\YFvVEuv.exe
  2⤵
  PID:12872
- C:\Windows\System\SbufqkC.exe
  C:\Windows\System\SbufqkC.exe
  2⤵
  PID:12900
- C:\Windows\System\rfQyQhe.exe
  C:\Windows\System\rfQyQhe.exe
  2⤵
  PID:12928
- C:\Windows\System\hnIHCCN.exe
  C:\Windows\System\hnIHCCN.exe
  2⤵
  PID:12956
- C:\Windows\System\CJBDGul.exe
  C:\Windows\System\CJBDGul.exe
  2⤵
  PID:12984
- C:\Windows\System\gFFMFmN.exe
  C:\Windows\System\gFFMFmN.exe
  2⤵
  PID:13012
- C:\Windows\System\pcnfjBJ.exe
  C:\Windows\System\pcnfjBJ.exe
  2⤵
  PID:13040
- C:\Windows\System\sUxicly.exe
  C:\Windows\System\sUxicly.exe
  2⤵
  PID:13068
- C:\Windows\System\fAdiGwN.exe
  C:\Windows\System\fAdiGwN.exe
  2⤵
  PID:13096
- C:\Windows\System\XiunTxP.exe
  C:\Windows\System\XiunTxP.exe
  2⤵
  PID:13124
- C:\Windows\System\oyFQkBC.exe
  C:\Windows\System\oyFQkBC.exe
  2⤵
  PID:13152
- C:\Windows\System\rNUdttN.exe
  C:\Windows\System\rNUdttN.exe
  2⤵
  PID:13180
- C:\Windows\System\ehAVwll.exe
  C:\Windows\System\ehAVwll.exe
  2⤵
  PID:13208
- C:\Windows\System\BUvNRGo.exe
  C:\Windows\System\BUvNRGo.exe
  2⤵
  PID:13236
- C:\Windows\System\qeqtWyV.exe
  C:\Windows\System\qeqtWyV.exe
  2⤵
  PID:13264
- C:\Windows\System\LYMMAex.exe
  C:\Windows\System\LYMMAex.exe
  2⤵
  PID:13300
- C:\Windows\System\PXhDmrs.exe
  C:\Windows\System\PXhDmrs.exe
  2⤵
  PID:12300
- C:\Windows\System\hfzGCfx.exe
  C:\Windows\System\hfzGCfx.exe
  2⤵
  PID:12400
- C:\Windows\System\faINmpE.exe
  C:\Windows\System\faINmpE.exe
  2⤵
  PID:12440
- C:\Windows\System\MxGBIyA.exe
  C:\Windows\System\MxGBIyA.exe
  2⤵
  PID:12504
- C:\Windows\System\mQFoOeU.exe
  C:\Windows\System\mQFoOeU.exe
  2⤵
  PID:12584
- C:\Windows\System\pVrcHLx.exe
  C:\Windows\System\pVrcHLx.exe
  2⤵
  PID:12644
- C:\Windows\System\GAJKZRF.exe
  C:\Windows\System\GAJKZRF.exe
  2⤵
  PID:12716
- C:\Windows\System\NXoIXjO.exe
  C:\Windows\System\NXoIXjO.exe
  2⤵
  PID:12780
- C:\Windows\System\wpWbjuA.exe
  C:\Windows\System\wpWbjuA.exe
  2⤵
  PID:12840
- C:\Windows\System\bVfAkcf.exe
  C:\Windows\System\bVfAkcf.exe
  2⤵
  PID:12912
- C:\Windows\System\zvJtAIx.exe
  C:\Windows\System\zvJtAIx.exe
  2⤵
  PID:12976
- C:\Windows\System\MizlIEq.exe
  C:\Windows\System\MizlIEq.exe
  2⤵
  PID:13032
- C:\Windows\System\QhrxqsY.exe
  C:\Windows\System\QhrxqsY.exe
  2⤵
  PID:13092
- C:\Windows\System\vDCiLwb.exe
  C:\Windows\System\vDCiLwb.exe
  2⤵
  PID:13164
- C:\Windows\System\sadxHoL.exe
  C:\Windows\System\sadxHoL.exe
  2⤵
  PID:13228
- C:\Windows\System\DLwvNfI.exe
  C:\Windows\System\DLwvNfI.exe
  2⤵
  PID:13288
- C:\Windows\System\CXpTNgb.exe
  C:\Windows\System\CXpTNgb.exe
  2⤵
  PID:12356
- C:\Windows\System\vxHwqnQ.exe
  C:\Windows\System\vxHwqnQ.exe
  2⤵
  PID:12560
- C:\Windows\System\lntBOAf.exe
  C:\Windows\System\lntBOAf.exe
  2⤵
  PID:12700
- C:\Windows\System\diVGxQa.exe
  C:\Windows\System\diVGxQa.exe
  2⤵
  PID:12868
- C:\Windows\System\pIKiBGo.exe
  C:\Windows\System\pIKiBGo.exe
  2⤵
  PID:11192
- C:\Windows\System\RxGDviu.exe
  C:\Windows\System\RxGDviu.exe
  2⤵
  PID:13148
- C:\Windows\System\yOEWzOh.exe
  C:\Windows\System\yOEWzOh.exe
  2⤵
  PID:12296
- C:\Windows\System\sUbkoYG.exe
  C:\Windows\System\sUbkoYG.exe
  2⤵
  PID:12688
- C:\Windows\System\NNnZckP.exe
  C:\Windows\System\NNnZckP.exe
  2⤵
  PID:13004
- C:\Windows\System\QGPQMQV.exe
  C:\Windows\System\QGPQMQV.exe
  2⤵
  PID:12464
- C:\Windows\System\enssTxM.exe
  C:\Windows\System\enssTxM.exe
  2⤵
  PID:13276
- C:\Windows\System\odqHQKK.exe
  C:\Windows\System\odqHQKK.exe
  2⤵
  PID:13320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pwsoj4e.1xu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BLPEvbv.exe

Filesize
3.0MB

MD5
9ae9204f544d11b8c37f2c5685eb6a70

SHA1
1fbe67362ad697e9ef24104a989612c577d40cc3

SHA256
d72d437b46582886b75009663979f45ac1a3a7530e8b6759494728d75cc1d054

SHA512
3ba763026945a9430847a03b4f004674eef13e92f91610a82f90be17af22a8dc6cd18fbf01b25fca8968e4cd2a53f243e1ddfc916cabc09d45aee65d66640020

Download Submit
C:\Windows\System\CLStDvW.exe

Filesize
3.0MB

MD5
be99cecb12e2475e722029a1ae2d264d

SHA1
36c4c3a0fc4f1ef1f5259c1625530b04e5b463ae

SHA256
381d3dcad481cc38b0f6a88e9f013722b744dd1c2d12540661ae895272563d03

SHA512
59b3d313e867040f90c3c306458c4e7099df32f332a2a57cc7f8a871fdc0066a9a107e92e9a089e8cfab4022db25e8f8a7e3b477b687bd5566662fcc0fd7085d

Download Submit
C:\Windows\System\HevBupg.exe

Filesize
3.0MB

MD5
cc6f46b0d486146e217a74f63d697891

SHA1
6203048ed457a4957cdadcbcc4e88238419b1594

SHA256
a911001aa606ae1337d0f75d53f56eb0153f70797be94bedf65affb0d92678a9

SHA512
87eb5d5893defbefa0bbb685c28817df591c399d6a5c2ed5bad56a6ec01b1bd458d42ce31506f9a4b69cc6b4119b61b3e8b9a8bedd662ad87e5a402aa8d23e3c

Download Submit
C:\Windows\System\IJXvuGO.exe

Filesize
3.0MB

MD5
09985a1759ce2f17f48384d2905e188a

SHA1
9d93ace33735e7b3d91880d5ec3df6cea53b6c40

SHA256
71df68ba01d7ce0fd8b8402e4c862759e92cd020cbd4cfdf6dfa7e8aaa99f460

SHA512
2fdc15d961d2b13f275b99fbe5d29f544bc8c77f5ff9f62cc59d4e082cbe023a6dc19888082d995efd6e0e78bcda75b3933ee1810c7c818b5e0635563f66adf0

Download Submit
C:\Windows\System\IPqYhGJ.exe

Filesize
3.0MB

MD5
784bd98fcbaa60824d86d75738d1c9ea

SHA1
969da93fda85922895e01c13e264a25c4f434a81

SHA256
7b723455e9f68290f83521518f10511250f0fa7882db713490185f53e66c9fba

SHA512
140e34ad11e4a9c6b0df401ad63985bc5a3f14a77aef1a82c769fb09df1d01703c72818e3012898792043687e7db609bc58e3804fc974fc078a683c8225e02e9

Download Submit
C:\Windows\System\KaFLDxM.exe

Filesize
3.0MB

MD5
2b77980538bce80740f1821f293a46d8

SHA1
d66ffab9ae9442643e482dde7d5b48e3639248b0

SHA256
267db79e48d5ad22e9fba3c6b352e1abf3c9cc49c6847e524dabc1d1fd4f0aa3

SHA512
cd82866e12dcde8c28f84cfc15e650090dc35b118b9faf587e24cc0f5c41cba8fd9ef693b95fa91e01e5f284277c9855dba0951c1672dd873f2c5de6601189bb

Download Submit
C:\Windows\System\LaGSHCM.exe

Filesize
3.0MB

MD5
d37c530cdce0a4480ada75c17b5f249c

SHA1
f17825087712af5732c703dcfd1410a49caf300c

SHA256
2b8eae73de4e62afbdd910150ad442443213d96bdd5eadbf6ece8fa12edae362

SHA512
af5b5eb599ed0d4750c6121961fb38ec2fcc023810ffcc49e5ee843635c4c36bcc066a2ebe0f7a17da9613530f9603e4450fc056159dba47db2b309c8b34592a

Download Submit
C:\Windows\System\LbkRJbt.exe

Filesize
3.0MB

MD5
3ff873c6a6d57b4025d7c5b17f351e44

SHA1
659d304e3cdc43c4e9edbed23ea567fc13f53933

SHA256
b25087fd09a8d0b47843c5bd681a0322dd8938cd78bf8be60a2eda375246d9dd

SHA512
f5e39852dcaa72b52422904bf33b3ad10d871260aa0be4f5d7a4fb1aa24e5f6ab9c4e042fe11b559213a2cc048f3e50a365aba263cace5b2c687a7bd63879d7b

Download Submit
C:\Windows\System\OEKHTlw.exe

Filesize
3.0MB

MD5
3cf4bb124d4d5f607b36861e58c8e6d5

SHA1
31aa6b4f84432b508ad4e8515bbb7c44fffb773c

SHA256
f71deb471fef471eadef54dcd302eb49659f4bf1b05ec31930f9092cca257f90

SHA512
7afdcae8eaa1d2c0be0e81d1f7a7d9536e5845395fcc575f2da92d445491357009948e6c0cb249f009fd6ab206997d0c1e4cab6518c548f9413e2ebe5aa82510

Download Submit
C:\Windows\System\OfWiyEF.exe

Filesize
3.0MB

MD5
797a9888f829c470b60a8b582e4c86ad

SHA1
052a1617ef3d3084b5a9ce22db466ebea40e260f

SHA256
93461b836c16fe1908414503961d1e64dfee1fe4fc368ec60cdf4eb5a99ecfd4

SHA512
3b388e082b31aa2cd6fc33e02a5b0fa61029eec80b9af1ab9c7578758967c17b5a3ac08f100560f52ef5d2b9f21ea45657868d5959d61298cc4697b80e646b7a

Download Submit
C:\Windows\System\ROJowuv.exe

Filesize
3.0MB

MD5
d92c6da32b78b4e125f6454985d8814c

SHA1
84bc703d2f91e88170fcaf76c771cfbc0f1be604

SHA256
2bcc4302d619946e0098acae11dee31e4d22878bb0deb38a2deb8dbb4343f89c

SHA512
0fd3214de5190a6139f77cf50243b91fa0cdf8c1d94460536b1b2d10c460cdee725cdd9f3807bf6ffd48d87d8d179353e816813eca4bb1fc28f3c0f2ded7638c

Download Submit
C:\Windows\System\ReGSROQ.exe

Filesize
8B

MD5
ab3cbb0f5b25d29e1fe3885f31b6d5cd

SHA1
7c22d15ea6b3a43c82c09cc7df11efe3a37eb37d

SHA256
28c2807be2e7d04fb566b5f83e2eb3cc33fdcafa16aea05da58ef8a635a2cf4e

SHA512
ed6182d10035a015e01b6a31951ea502b44408b56e8a7e88b1c72aa2be90eda454a56bef8ab64846f932260fd4d1d5c015b4df2e3228a45ce6c70b82989061c9

Download Submit
C:\Windows\System\TpKdYAH.exe

Filesize
3.0MB

MD5
be8a63fb6efde22e690fe931ed44e048

SHA1
19a3c7c27e237e810944b48659ddd7eddb1aec15

SHA256
e46d30d72966b7d22cbc1a0cb783ae33fa8ac941e80e2778a37b3d6e33087eac

SHA512
39ee977578ce691cb9ef25f63a8abcab0d9cc63765cc77aab956810e17553fef86fa95efc5c8566d23aa3021c97770fc4f6764fca2c0a3c9de6af91fd60c3bd9

Download Submit
C:\Windows\System\WghRlbB.exe

Filesize
3.0MB

MD5
da992ba0a94af6a171f5e785bb2cbd86

SHA1
4489cc7ca3de17f8e34d2d54c3f08d6cce713d5c

SHA256
a37630a320cf30c65a250a2a026f48389051eefc32f18adfd1b617fb264a71d5

SHA512
654cab29b345ca1cfa3d9343107dcf9ba2e0bce92345da0011ce756c84f8efdf95bbae1f58a691976e37193b13f9cad77b6900f73c2a7078e7c046d433379d9f

Download Submit
C:\Windows\System\XWoHQhk.exe

Filesize
3.0MB

MD5
ba25178c3ca417f66e6b674b6cb19c34

SHA1
136bf60ce1f013bc095a40a2cfe13220a0aceea3

SHA256
8925f4f99b7e58b2c8ef34950ace3c2d1c747c1e6537396975ad6ec8133d8acf

SHA512
aa2633cdcc019389957da49c5d633b2551cfc075cc97487ef38b61f7653b0a45a8eaf8f436da1602a74fa5f063d8ae93a71a4ee89303a6155eb361a455b1c9bb

Download Submit
C:\Windows\System\ZSTkuoR.exe

Filesize
3.0MB

MD5
abf6e111d77b1a966c85c4a68e01efde

SHA1
f333b7c998bb2e0e62228ea8c7820d8ed618aea5

SHA256
060205c7a6c39bd6778d2b66e3336534614cc12f0039ee7bfd36d4c7c87e53b8

SHA512
874cf98085086e5125ef026158c20681c8ba331aa795de134ed47ef65eb77580ebe812f6abc0faf7322379809dadeb2d65ed8ad889cfc9f696416d793cb3ec3d

Download Submit
C:\Windows\System\ZZTUxSz.exe

Filesize
3.0MB

MD5
b75e7d3faeb1bbdf0a4eda8fd6da4c3d

SHA1
c129226dda6341acf8f2addf2ea53bb803a5217b

SHA256
4b5f395c39be8b32dd1ceea3ebed8b2e017f55f44f43b1cb1f7aee3f12144534

SHA512
ebef66b60f36e8d1c25f923351a76cecd0a78a66692fd7fdcda02c0300a579f759de55a7e749b04b4e01472086d314180c0bcb759d41b77bf39bd0e120e86456

Download Submit
C:\Windows\System\ejFdZYO.exe

Filesize
3.0MB

MD5
891e66c0473c545dfb9cc0f413070016

SHA1
8fcbf5f7b88d338c1ecc73136e365756b9636ab6

SHA256
4dc56d8af8d0d9c134b21abd2bafb3ebb3f79e293ccc8d7d96c5e4d59f1f86d6

SHA512
b0652f402227743a8472a17b802db1b8c6acc1d22b94eafc724c2a841f1ece6f73df0c532ecdc550d49a3abd217d65f82593ff94e0d0569890fc2e4ddffad6a1

Download Submit
C:\Windows\System\fHoYCOJ.exe

Filesize
3.0MB

MD5
b7714e82117462e75cb2be3ae585a1e3

SHA1
f7ecd6654342a8e924271d3bf20edbf28d67d3ed

SHA256
81226a6dc453fb76495a5aa6757569d656b8ab04d2f1aedca0d5e2d1fe9abb13

SHA512
d01b9ccfc2b63059a2e32171573826d075d3df5f72c17850a7b28bed9678f77a3652a7c177e740bb9a33f56931f1fe7fc3f53c7a2218549e02a249c274d8a1b9

Download Submit
C:\Windows\System\fKeqRSy.exe

Filesize
3.0MB

MD5
6ea93f540f7f56a63ba04d2a8fed25ae

SHA1
7554d3ffc3ae0634392ee23356842e9785b61eda

SHA256
ab5d59dc89b442a74b2894ac4c06d708fda4604f76fac808037f240ec734caa0

SHA512
07ed7e9a4f9ceaa7c036672a73f05efd41b5a108ec370430c8f14d271e270501d5fed9b116ae9e747871a1ca0b6401297c31556c26bbb5858f149fe69442b113

Download Submit
C:\Windows\System\gGUGpms.exe

Filesize
3.0MB

MD5
0ed4ea4178713b51f6aecc7f80e11977

SHA1
35edb19803eaf93bfbed984067a84a022c110be4

SHA256
71331c1f04de4cdfecb9e6bbbdeb0966b476e6ccd739c73581c3168c2ad0c913

SHA512
e7232533d24641992dbabcc7103a76027df96b7d86a766e666e59a2946e536959dac3adae32bee0527013a673052a4220338da96f14ec3d0a7a09f99e9c72753

Download Submit
C:\Windows\System\ghzBYav.exe

Filesize
3.0MB

MD5
8ddaafa825096dbc2f9d4cd13c61da73

SHA1
40d5c10109c0169f870eb7c4b30529ffbad50aa3

SHA256
aa312e2ebda93dcabe8b6f918ead9f309d4a48c63432b52e3634498f43cb74d9

SHA512
626f83512995d043554c7decdd25b501c3aa5231b54186659e65b5ee971b5fda178cbf26a09ec864002ea37355b2a80ffb30ab3e36e7d2922b830cb60905b921

Download Submit
C:\Windows\System\lZPIlHj.exe

Filesize
3.0MB

MD5
3b82dd2db5305823bc4d4ea0a1ba7c96

SHA1
10e47e3a8b85298e6b9ee1a8f678b8f01d24a2dd

SHA256
de413864f29dd6a2dd63ae88cc103f8d68d4e351445f4339d6217c08b8730000

SHA512
ae613acc352dc0962917d575f7a44040977f5e8cad66728c7fd3d1f4979ab722ab6b7bfb1d56094cf128c6b56cb72ae2822858ac5fddd47b2cced2e9826d6802

Download Submit
C:\Windows\System\leYohoo.exe

Filesize
3.0MB

MD5
cbf28fb9f0b861ac2e45b7c3693f0f23

SHA1
8563530b57788277764fa619b3b26555b1317b56

SHA256
aeb507e7865922bb2288045530c2a661e7b87b89a1f0094f174a78b781b71100

SHA512
afef4f029f8ecc472e54c70f6ff889430aab00cd68b05a5de6d34599ad7cff27ce7ba38995a2bcb9e1482a16c323a8269ce8ad2e54c96fc6a8ad8acc5f53f3e1

Download Submit
C:\Windows\System\mmaWywR.exe

Filesize
3.0MB

MD5
f95af24fca2b53cc50161b1881d129f9

SHA1
c2002fb9d685d9b869baef0d1ed868ca4b2798db

SHA256
83b3c4f4142cc0b9fdbb988a636e6b9b8ceb253b176094fd33259549ddb589a2

SHA512
1c65e4ba4d832c1de6fa6b17ceba555d142ce61321238ecc5ebec3724f77c275c4b6be4c0697be3a9d9494a84ba67e3010cf3a8a7b614a011f04649ec7c714f3

Download Submit
C:\Windows\System\pDJBlRx.exe

Filesize
3.0MB

MD5
215301afee51645ccf49f27c08b18d2e

SHA1
589689706ed734c11adb4a4e65e2b25445f9de4e

SHA256
ec737d9f9767895f6626b743c1f760baf8bf5a466427b4ef5bb2e1d11ddd87d5

SHA512
c50c081839a939bdfa8a209dc1759d37aac80c63d4a00dab126d6451e0bdd3758e195454ce670bf021e6b4f4ac094077431d6937f59a3242678efe315381b1dd

Download Submit
C:\Windows\System\rKcVgqE.exe

Filesize
3.0MB

MD5
b652bb24197380d6ba487fcb79073af5

SHA1
dcf78cec162180a658444c3e6fa71292ba4a9e90

SHA256
b5ec2ee7db4e2c9aa3883c1425187db4e50513d8a5500baab2aaf8f3053fb8c7

SHA512
df2dcde3dcbcbd176eabb8f0957dd9634b965439d684972f13169b726e7839105cbc3c9f4794b1296481d94bd63e306f6215e1d4bd25f5983016961369fecb09

Download Submit
C:\Windows\System\sXTxUPs.exe

Filesize
3.0MB

MD5
06ac53da22f0a3e9e3822b68afe43acc

SHA1
2d3ab3a0b048a8a51d1a88a635fbe475b5630950

SHA256
43a032f739c2837772cbeb7ed88e8f31d9a35f7597ff44bd05ee35b744dc33dc

SHA512
01cdee483e3d41888cab3f40dc8c33fc4b9e5b3463704099fa73671a6c34a0252b4b927e701f7953bd40fa5f306af3f0428c025797215487903be00f326195a0

Download Submit
C:\Windows\System\sYtkReM.exe

Filesize
3.0MB

MD5
21950f42234caf821de6512eb4977b93

SHA1
6eca5702eb7dbfb87a957953c7323277359f8c33

SHA256
71d6f9d3049e33b854462dec8796350ee32e0b573b96412cedd9cc82f18cb3af

SHA512
2c658f3fab3ef8ae41a5626873825bca8c1d3a0c34525688c705f9bd7b615d1dd2c220489798293d5c5dc3b87b7cd33eaf82282f39744a83abcf5ed6ec7d9feb

Download Submit
C:\Windows\System\twAEIne.exe

Filesize
3.0MB

MD5
f42af1c93419f39d818c87a502602220

SHA1
6a7f076e03b830499ccd63cbd21220e3ef8644f7

SHA256
3a41a3999f90063250edf7b1029e44471edb42a8f9bd61b821a33604273a1523

SHA512
bdda6902cf3b620b7e375dd4538214b93dccfb912b28556e656121f460e2ae4f32ffde78c249baa01388122058f718656667bd786e5284eaa6bf8f04eaca9ac2

Download Submit
C:\Windows\System\uexwtYT.exe

Filesize
3.0MB

MD5
03eca9913c7d93607785a4d5b5d0a48a

SHA1
1b1212fffa82e36e94ce21901e2c4ad52fa0cde0

SHA256
91549df4467f17c37e461277e1e557759374d690633629112ea0e0a9f8e00043

SHA512
322e06a2285860997f7a4707ec6ee8d0abb8fa50969dbef2db75d7b38ddd31103f92201f914d4aab1fbdc90099366247f4593a92471b3107c8fd542eeefa9b35

Download Submit
C:\Windows\System\vMWYByl.exe

Filesize
3.0MB

MD5
c2a91a4ef9e2d05001b83d8fdf78f9a8

SHA1
b55a81c70a533b0842314429017613bb3720f1b2

SHA256
8c4846372bafc60cda6ea4fbbcfc59c271d069eb57d7898054f5ad7687041735

SHA512
daa908d927f5b8e82e3981a94cf3c031d673c07650ea496a1bd0bebb59ce1d4e55f45eb2d8958c206d94c2fe0202d9a38edd46044177793c3cdf5879fc7e18a7

Download Submit
C:\Windows\System\waMNmCB.exe

Filesize
3.0MB

MD5
ab6b3def6c101e59ad56bf16290025da

SHA1
41b43d7477d3108a463da98e377d614ccdc860ed

SHA256
3682947e11a50e47a7a5c9b64690e37744f18acbaaf7651ebc04e184bb665cac

SHA512
3dce425d5dd0c9a0bcf965b0b23ebbfd31ef9a6274706578d29b3c4c297cf48e47f3d70b03a6a5be116dfd48a9470f93115ebbe60d2a55a3a7c8f86a4490e6d3

Download Submit
C:\Windows\System\xcwzoay.exe

Filesize
3.0MB

MD5
23332e3dacea6eed75341dffa131a582

SHA1
ff9bb0ade96068e4e59caa2b0faf715d73a954c2

SHA256
d15fa6e9cee45fd7877a12d6c249aea475340fab87faa80deb8d688b5c8c94cc

SHA512
189a4e09c1bea01422e65f3fd9a986b0db4c4284a90d40f959b6bcdddbeac54e91428c6b045652a3d3e0c90a7a5a03b74668ab46da8544e901f0dfc45fb7c721

Download Submit
memory/216-123-0x00007FF615E60000-0x00007FF616256000-memory.dmp

Filesize
4.0MB

Download
memory/216-2358-0x00007FF615E60000-0x00007FF616256000-memory.dmp

Filesize
4.0MB

Download
memory/448-2347-0x00007FF676020000-0x00007FF676416000-memory.dmp

Filesize
4.0MB

Download
memory/448-69-0x00007FF676020000-0x00007FF676416000-memory.dmp

Filesize
4.0MB

Download
memory/680-252-0x00007FF615C40000-0x00007FF616036000-memory.dmp

Filesize
4.0MB

Download
memory/680-2362-0x00007FF615C40000-0x00007FF616036000-memory.dmp

Filesize
4.0MB

Download
memory/820-118-0x00007FF65DC80000-0x00007FF65E076000-memory.dmp

Filesize
4.0MB

Download
memory/820-2350-0x00007FF65DC80000-0x00007FF65E076000-memory.dmp

Filesize
4.0MB

Download
memory/904-137-0x0000019633DD0000-0x0000019633DF2000-memory.dmp

Filesize
136KB

Download
memory/904-138-0x0000019635470000-0x0000019635C16000-memory.dmp

Filesize
7.6MB

Download
memory/1036-59-0x00007FF749120000-0x00007FF749516000-memory.dmp

Filesize
4.0MB

Download
memory/1036-2345-0x00007FF749120000-0x00007FF749516000-memory.dmp

Filesize
4.0MB

Download
memory/1360-241-0x00007FF6C1B80000-0x00007FF6C1F76000-memory.dmp

Filesize
4.0MB

Download
memory/1360-2361-0x00007FF6C1B80000-0x00007FF6C1F76000-memory.dmp

Filesize
4.0MB

Download
memory/1364-2351-0x00007FF6D3D10000-0x00007FF6D4106000-memory.dmp

Filesize
4.0MB

Download
memory/1364-117-0x00007FF6D3D10000-0x00007FF6D4106000-memory.dmp

Filesize
4.0MB

Download
memory/1452-226-0x00007FF698060000-0x00007FF698456000-memory.dmp

Filesize
4.0MB

Download
memory/1452-2360-0x00007FF698060000-0x00007FF698456000-memory.dmp

Filesize
4.0MB

Download
memory/1452-1209-0x00007FF698060000-0x00007FF698456000-memory.dmp

Filesize
4.0MB

Download
memory/1472-2346-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp

Filesize
4.0MB

Download
memory/1472-55-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp

Filesize
4.0MB

Download
memory/1472-741-0x00007FF6B1D80000-0x00007FF6B2176000-memory.dmp

Filesize
4.0MB

Download
memory/2064-2359-0x00007FF7D4010000-0x00007FF7D4406000-memory.dmp

Filesize
4.0MB

Download
memory/2064-84-0x00007FF7D4010000-0x00007FF7D4406000-memory.dmp

Filesize
4.0MB

Download
memory/2064-838-0x00007FF7D4010000-0x00007FF7D4406000-memory.dmp

Filesize
4.0MB

Download
memory/2124-2339-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp

Filesize
4.0MB

Download
memory/2124-6-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp

Filesize
4.0MB

Download
memory/2124-449-0x00007FF6DD370000-0x00007FF6DD766000-memory.dmp

Filesize
4.0MB

Download
memory/2140-2357-0x00007FF64C080000-0x00007FF64C476000-memory.dmp

Filesize
4.0MB

Download
memory/2140-121-0x00007FF64C080000-0x00007FF64C476000-memory.dmp

Filesize
4.0MB

Download
memory/2236-2340-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp

Filesize
4.0MB

Download
memory/2236-607-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp

Filesize
4.0MB

Download
memory/2236-29-0x00007FF6D6AD0000-0x00007FF6D6EC6000-memory.dmp

Filesize
4.0MB

Download
memory/2452-2356-0x00007FF6831B0000-0x00007FF6835A6000-memory.dmp

Filesize
4.0MB

Download
memory/2452-126-0x00007FF6831B0000-0x00007FF6835A6000-memory.dmp

Filesize
4.0MB

Download
memory/2624-831-0x00007FF697460000-0x00007FF697856000-memory.dmp

Filesize
4.0MB

Download
memory/2624-2349-0x00007FF697460000-0x00007FF697856000-memory.dmp

Filesize
4.0MB

Download
memory/2624-70-0x00007FF697460000-0x00007FF697856000-memory.dmp

Filesize
4.0MB

Download
memory/3424-39-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp

Filesize
4.0MB

Download
memory/3424-738-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp

Filesize
4.0MB

Download
memory/3424-2343-0x00007FF6ADD50000-0x00007FF6AE146000-memory.dmp

Filesize
4.0MB

Download
memory/3764-2352-0x00007FF7E5A70000-0x00007FF7E5E66000-memory.dmp

Filesize
4.0MB

Download
memory/3764-125-0x00007FF7E5A70000-0x00007FF7E5E66000-memory.dmp

Filesize
4.0MB

Download
memory/3952-122-0x00007FF6C5FB0000-0x00007FF6C63A6000-memory.dmp

Filesize
4.0MB

Download
memory/3952-2355-0x00007FF6C5FB0000-0x00007FF6C63A6000-memory.dmp

Filesize
4.0MB

Download
memory/4056-127-0x00007FF709B90000-0x00007FF709F86000-memory.dmp

Filesize
4.0MB

Download
memory/4056-2354-0x00007FF709B90000-0x00007FF709F86000-memory.dmp

Filesize
4.0MB

Download
memory/4256-98-0x00007FF722970000-0x00007FF722D66000-memory.dmp

Filesize
4.0MB

Download
memory/4256-2342-0x00007FF722970000-0x00007FF722D66000-memory.dmp

Filesize
4.0MB

Download
memory/4628-1-0x000002596F4A0000-0x000002596F4B0000-memory.dmp

Filesize
64KB

Download
memory/4628-0-0x00007FF6EDD20000-0x00007FF6EE116000-memory.dmp

Filesize
4.0MB

Download
memory/4628-242-0x00007FF6EDD20000-0x00007FF6EE116000-memory.dmp

Filesize
4.0MB

Download
memory/4636-2353-0x00007FF642A20000-0x00007FF642E16000-memory.dmp

Filesize
4.0MB

Download
memory/4636-124-0x00007FF642A20000-0x00007FF642E16000-memory.dmp

Filesize
4.0MB

Download
memory/4940-2344-0x00007FF7DA540000-0x00007FF7DA936000-memory.dmp

Filesize
4.0MB

Download
memory/4940-104-0x00007FF7DA540000-0x00007FF7DA936000-memory.dmp

Filesize
4.0MB

Download
memory/5040-2348-0x00007FF71BC70000-0x00007FF71C066000-memory.dmp

Filesize
4.0MB

Download
memory/5040-832-0x00007FF71BC70000-0x00007FF71C066000-memory.dmp

Filesize
4.0MB

Download
memory/5040-79-0x00007FF71BC70000-0x00007FF71C066000-memory.dmp

Filesize
4.0MB

Download
memory/5116-456-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp

Filesize
4.0MB

Download
memory/5116-17-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp

Filesize
4.0MB

Download
memory/5116-2341-0x00007FF6EED30000-0x00007FF6EF126000-memory.dmp

Filesize
4.0MB

Download