xmrig | 98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/09/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
Size 2.2MB
Sample260903-lnrbhatfpd
SHA256 98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345
MD5 59e92b95480a8fb8ef1f028fbee111dc
SHA1 d8cf8ee2cb900189e5279854f6e9d8464e74aba2
SHA512 7486c38e2fe4d8a5287681597456391699c5fa9790cd125620ba399b4de4462912f7b09a35f1a1ce68ded46ffe3b508fb64e58442f1f2b2cacf985f99f90ba13
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZO:NABQ
TLSH
T128B5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xmrig miner upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2052-940-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp	xmrig
behavioral1/memory/2848-943-0x00007FF697310000-0x00007FF697702000-memory.dmp	xmrig
behavioral1/memory/4024-959-0x00007FF6C3880000-0x00007FF6C3C72000-memory.dmp	xmrig
behavioral1/memory/1364-968-0x00007FF6220B0000-0x00007FF6224A2000-memory.dmp	xmrig
behavioral1/memory/824-982-0x00007FF75AC50000-0x00007FF75B042000-memory.dmp	xmrig
behavioral1/memory/1604-981-0x00007FF734F20000-0x00007FF735312000-memory.dmp	xmrig
behavioral1/memory/1520-979-0x00007FF6F5550000-0x00007FF6F5942000-memory.dmp	xmrig
behavioral1/memory/3280-977-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp	xmrig
behavioral1/memory/808-976-0x00007FF77BA70000-0x00007FF77BE62000-memory.dmp	xmrig
behavioral1/memory/4560-975-0x00007FF7AE000000-0x00007FF7AE3F2000-memory.dmp	xmrig
behavioral1/memory/3936-974-0x00007FF75E630000-0x00007FF75EA22000-memory.dmp	xmrig
behavioral1/memory/1716-971-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	xmrig
behavioral1/memory/4376-980-0x00007FF7487C0000-0x00007FF748BB2000-memory.dmp	xmrig
behavioral1/memory/4000-978-0x00007FF785D60000-0x00007FF786152000-memory.dmp	xmrig
behavioral1/memory/2748-957-0x00007FF65EFF0000-0x00007FF65F3E2000-memory.dmp	xmrig
behavioral1/memory/2476-956-0x00007FF7D4360000-0x00007FF7D4752000-memory.dmp	xmrig
behavioral1/memory/3996-955-0x00007FF7757C0000-0x00007FF775BB2000-memory.dmp	xmrig
behavioral1/memory/2096-954-0x00007FF635260000-0x00007FF635652000-memory.dmp	xmrig
behavioral1/memory/2744-953-0x00007FF6E1940000-0x00007FF6E1D32000-memory.dmp	xmrig
behavioral1/memory/688-951-0x00007FF739C20000-0x00007FF73A012000-memory.dmp	xmrig
behavioral1/memory/3960-949-0x00007FF7511F0000-0x00007FF7515E2000-memory.dmp	xmrig
behavioral1/memory/4100-948-0x00007FF72CD00000-0x00007FF72D0F2000-memory.dmp	xmrig
behavioral1/memory/2160-947-0x00007FF6EE650000-0x00007FF6EEA42000-memory.dmp	xmrig
behavioral1/memory/4316-946-0x00007FF7B87E0000-0x00007FF7B8BD2000-memory.dmp	xmrig
behavioral1/memory/1392-945-0x00007FF6FE190000-0x00007FF6FE582000-memory.dmp	xmrig
behavioral1/memory/1344-942-0x00007FF786B30000-0x00007FF786F22000-memory.dmp	xmrig
behavioral1/memory/2644-941-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp	xmrig
behavioral1/memory/2648-961-0x00007FF7AD2A0000-0x00007FF7AD692000-memory.dmp	xmrig
behavioral1/memory/2124-950-0x00007FF6D1970000-0x00007FF6D1D62000-memory.dmp	xmrig
behavioral1/memory/1744-936-0x00007FF696080000-0x00007FF696472000-memory.dmp	xmrig
behavioral1/memory/1832-944-0x00007FF7E7830000-0x00007FF7E7C22000-memory.dmp	xmrig
behavioral1/memory/1744-1329-0x00007FF696080000-0x00007FF696472000-memory.dmp	xmrig
behavioral1/memory/1744-2000-0x00007FF696080000-0x00007FF696472000-memory.dmp	xmrig
behavioral1/memory/1820-2588-0x00007FF6A9B90000-0x00007FF6A9F82000-memory.dmp	xmrig
behavioral1/memory/12992-2666-0x00007FF726AC0000-0x00007FF726EB2000-memory.dmp	xmrig
behavioral1/memory/2272-2668-0x00007FF697270000-0x00007FF697662000-memory.dmp	xmrig
behavioral1/memory/3932-2675-0x00007FF74A450000-0x00007FF74A842000-memory.dmp	xmrig
behavioral1/memory/2052-2699-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp	xmrig
behavioral1/memory/2644-2701-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp	xmrig
behavioral1/memory/1832-2710-0x00007FF7E7830000-0x00007FF7E7C22000-memory.dmp	xmrig
behavioral1/memory/2160-2714-0x00007FF6EE650000-0x00007FF6EEA42000-memory.dmp	xmrig
behavioral1/memory/3960-2716-0x00007FF7511F0000-0x00007FF7515E2000-memory.dmp	xmrig
behavioral1/memory/2124-2718-0x00007FF6D1970000-0x00007FF6D1D62000-memory.dmp	xmrig
behavioral1/memory/4100-2713-0x00007FF72CD00000-0x00007FF72D0F2000-memory.dmp	xmrig
behavioral1/memory/2848-2709-0x00007FF697310000-0x00007FF697702000-memory.dmp	xmrig
behavioral1/memory/4316-2707-0x00007FF7B87E0000-0x00007FF7B8BD2000-memory.dmp	xmrig
behavioral1/memory/1392-2705-0x00007FF6FE190000-0x00007FF6FE582000-memory.dmp	xmrig
behavioral1/memory/1344-2703-0x00007FF786B30000-0x00007FF786F22000-memory.dmp	xmrig
behavioral1/memory/3280-2719-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp	xmrig
behavioral1/memory/808-2748-0x00007FF77BA70000-0x00007FF77BE62000-memory.dmp	xmrig
behavioral1/memory/1364-2788-0x00007FF6220B0000-0x00007FF6224A2000-memory.dmp	xmrig
behavioral1/memory/3996-2781-0x00007FF7757C0000-0x00007FF775BB2000-memory.dmp	xmrig
behavioral1/memory/2648-2778-0x00007FF7AD2A0000-0x00007FF7AD692000-memory.dmp	xmrig
behavioral1/memory/2748-2776-0x00007FF65EFF0000-0x00007FF65F3E2000-memory.dmp	xmrig
behavioral1/memory/2476-2767-0x00007FF7D4360000-0x00007FF7D4752000-memory.dmp	xmrig
behavioral1/memory/3936-2744-0x00007FF75E630000-0x00007FF75EA22000-memory.dmp	xmrig
behavioral1/memory/1716-2742-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	xmrig
behavioral1/memory/3236-2739-0x00007FF651BE0000-0x00007FF651FD2000-memory.dmp	xmrig
behavioral1/memory/4332-2738-0x00007FF754900000-0x00007FF754CF2000-memory.dmp	xmrig
behavioral1/memory/628-2737-0x00007FF6C5490000-0x00007FF6C5882000-memory.dmp	xmrig
behavioral1/memory/2536-2735-0x00007FF7B6B70000-0x00007FF7B6F62000-memory.dmp	xmrig
behavioral1/memory/3068-2734-0x00007FF702990000-0x00007FF702D82000-memory.dmp	xmrig
behavioral1/memory/2780-2733-0x00007FF6BE9C0000-0x00007FF6BEDB2000-memory.dmp	xmrig
behavioral1/memory/4880-2730-0x00007FF7CE770000-0x00007FF7CEB62000-memory.dmp	xmrig

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4960	powershell.exe
9	4960	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2052	IauKGgj.exe
2644	NnOXdZc.exe
1344	KQHgLcn.exe
2848	HOxZVbJ.exe
1832	mCWbYmk.exe
1392	OfjoaWu.exe
4316	DXYtPGf.exe
2160	ulGIKxZ.exe
4100	rDSipPk.exe
3960	mvdfQFQ.exe
2124	VXgFGyY.exe
688	gJulSUv.exe
2744	BKaffjk.exe
2096	GUiNhdC.exe
3996	fSFBmaS.exe
2476	fBFnltZ.exe
2748	udRelfW.exe
4024	vREyMRb.exe
2648	dcElcbe.exe
1364	arXSsHR.exe
1716	vDQvpgI.exe
3936	qzgWChA.exe
4560	CuXzTlg.exe
808	pBLZzMe.exe
3280	yLfvAcy.exe
4000	RnyCHZd.exe
1520	UWQcyFE.exe
4376	uBoqWLa.exe
1604	PcrIXkZ.exe
824	GLuAZXA.exe
2272	mpfxbbn.exe
3932	mxqeOwi.exe
4880	iMDhrHC.exe
3020	SobDpmy.exe
2780	GVEfvHJ.exe
3068	LXrUufA.exe
2536	eRCjTHZ.exe
1596	oBcqIbd.exe
628	qDKoVUG.exe
4332	lnzzBrd.exe
3236	SFdaNKY.exe
1672	OQjljkp.exe
4620	TkLjkyq.exe
1380	rtGuhMc.exe
1448	pJOnmzz.exe
4596	jMoUOHu.exe
2480	UsDOWWv.exe
4580	MMAunyF.exe
4268	OYJeFir.exe
3844	kPfcBHC.exe
4420	ikIXGoO.exe
752	ClIuCNu.exe
3700	SsJfkQu.exe
372	amNUAKJ.exe
1348	ElwIWrh.exe
1236	HUStTXj.exe
1588	OSSjiwC.exe
2396	IZgiCOp.exe
3312	tZvpgDd.exe
4972	jWVwCsT.exe
4104	qkpFLEc.exe
3004	nZUOSYe.exe
1764	FPPPWoq.exe
2976	vCrAErT.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1744-0-0x00007FF696080000-0x00007FF696472000-memory.dmp	upx
behavioral1/files/0x000700000002446d-6.dat	upx
behavioral1/files/0x0008000000024468-8.dat	upx
behavioral1/files/0x000700000002446e-20.dat	upx
behavioral1/memory/1344-19-0x00007FF786B30000-0x00007FF786F22000-memory.dmp	upx
behavioral1/files/0x0007000000024470-31.dat	upx
behavioral1/files/0x0007000000024471-38.dat	upx
behavioral1/files/0x0007000000024473-56.dat	upx
behavioral1/files/0x000700000002447b-96.dat	upx
behavioral1/files/0x000700000002447e-119.dat	upx
behavioral1/files/0x0007000000024484-136.dat	upx
behavioral1/files/0x0007000000024487-159.dat	upx
behavioral1/files/0x000700000002448c-176.dat	upx
behavioral1/files/0x000700000002448a-174.dat	upx
behavioral1/files/0x000700000002448b-171.dat	upx
behavioral1/files/0x0007000000024489-169.dat	upx
behavioral1/files/0x0007000000024488-164.dat	upx
behavioral1/files/0x0007000000024486-154.dat	upx
behavioral1/files/0x0007000000024485-149.dat	upx
behavioral1/files/0x0008000000024482-139.dat	upx
behavioral1/files/0x0007000000024483-134.dat	upx
behavioral1/files/0x0007000000024480-129.dat	upx
behavioral1/files/0x000700000002447f-124.dat	upx
behavioral1/files/0x000700000002447d-106.dat	upx
behavioral1/files/0x000700000002447c-101.dat	upx
behavioral1/files/0x000700000002447a-91.dat	upx
behavioral1/files/0x0007000000024479-86.dat	upx
behavioral1/files/0x0007000000024478-81.dat	upx
behavioral1/files/0x0007000000024477-76.dat	upx
behavioral1/files/0x0007000000024476-71.dat	upx
behavioral1/files/0x0007000000024475-66.dat	upx
behavioral1/files/0x0007000000024474-61.dat	upx
behavioral1/files/0x0007000000024472-51.dat	upx
behavioral1/files/0x000700000002446f-34.dat	upx
behavioral1/memory/1832-30-0x00007FF7E7830000-0x00007FF7E7C22000-memory.dmp	upx
behavioral1/memory/2848-24-0x00007FF697310000-0x00007FF697702000-memory.dmp	upx
behavioral1/memory/2644-14-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp	upx
behavioral1/files/0x000c000000024269-12.dat	upx
behavioral1/memory/2052-9-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp	upx
behavioral1/memory/2052-940-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp	upx
behavioral1/memory/2848-943-0x00007FF697310000-0x00007FF697702000-memory.dmp	upx
behavioral1/memory/4024-959-0x00007FF6C3880000-0x00007FF6C3C72000-memory.dmp	upx
behavioral1/memory/1364-968-0x00007FF6220B0000-0x00007FF6224A2000-memory.dmp	upx
behavioral1/memory/824-982-0x00007FF75AC50000-0x00007FF75B042000-memory.dmp	upx
behavioral1/memory/1604-981-0x00007FF734F20000-0x00007FF735312000-memory.dmp	upx
behavioral1/memory/1520-979-0x00007FF6F5550000-0x00007FF6F5942000-memory.dmp	upx
behavioral1/memory/3280-977-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp	upx
behavioral1/memory/808-976-0x00007FF77BA70000-0x00007FF77BE62000-memory.dmp	upx
behavioral1/memory/4560-975-0x00007FF7AE000000-0x00007FF7AE3F2000-memory.dmp	upx
behavioral1/memory/3936-974-0x00007FF75E630000-0x00007FF75EA22000-memory.dmp	upx
behavioral1/memory/1716-971-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp	upx
behavioral1/memory/4376-980-0x00007FF7487C0000-0x00007FF748BB2000-memory.dmp	upx
behavioral1/memory/4000-978-0x00007FF785D60000-0x00007FF786152000-memory.dmp	upx
behavioral1/memory/2748-957-0x00007FF65EFF0000-0x00007FF65F3E2000-memory.dmp	upx
behavioral1/memory/2476-956-0x00007FF7D4360000-0x00007FF7D4752000-memory.dmp	upx
behavioral1/memory/3996-955-0x00007FF7757C0000-0x00007FF775BB2000-memory.dmp	upx
behavioral1/memory/2096-954-0x00007FF635260000-0x00007FF635652000-memory.dmp	upx
behavioral1/memory/2744-953-0x00007FF6E1940000-0x00007FF6E1D32000-memory.dmp	upx
behavioral1/memory/688-951-0x00007FF739C20000-0x00007FF73A012000-memory.dmp	upx
behavioral1/memory/3960-949-0x00007FF7511F0000-0x00007FF7515E2000-memory.dmp	upx
behavioral1/memory/4100-948-0x00007FF72CD00000-0x00007FF72D0F2000-memory.dmp	upx
behavioral1/memory/2160-947-0x00007FF6EE650000-0x00007FF6EEA42000-memory.dmp	upx
behavioral1/memory/4316-946-0x00007FF7B87E0000-0x00007FF7B8BD2000-memory.dmp	upx
behavioral1/memory/1392-945-0x00007FF6FE190000-0x00007FF6FE582000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TiLQxDW.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\dFRixzi.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\oBzWHah.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\ETRZZUJ.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\ZEYbWyg.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\twHKHIL.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\kVtMuHn.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\XPeZDQb.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\qIjRlKg.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\quktObx.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\yDNmhcU.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\lNptOpu.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\IHgoOrH.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\VRPhIsd.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\qaeXEZw.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\rNfLLsa.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\IaVBrdJ.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\gUbuARm.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\MIcpfiq.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\RbbxdaH.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\eBelFzC.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\BflQXbl.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\IRqwGhR.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\zbylwhW.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\qKCdNjH.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\GutMwTA.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\FnIYBKZ.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\EHudZAF.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\cmjWpno.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\HvDIbqq.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\gjdQqQJ.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\AFvKqsP.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\spEaDTj.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\ucnEhSU.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\AchUPtk.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\FMXlIYK.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\fVSokrw.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\PtmKugR.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\xznLgOW.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\DXYtPGf.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\bbiLGMC.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\lvpVNGA.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\tIDvqBm.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\kIJWVos.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\jwpiEWk.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\PJOOnOM.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\nBkKmsK.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\oLSLVWn.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\SEIaQnL.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\ohfMLkL.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\mEMICvb.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\stUzIzY.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\VSFVJJW.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\FIOQzFa.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\rQyssZE.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\BittCxr.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\llsWnWc.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\ntbSORN.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\pwiHynF.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\YDlQwUh.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\YGVOjhs.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\wmkqQPs.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\oPqGpyx.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
File created	C:\Windows\System\MMBVVkx.exe	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
Token: SeLockMemoryPrivilege	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
Token: SeDebugPrivilege	4960	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4960	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	87
PID 1744 wrote to memory of 2052	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	88
PID 1744 wrote to memory of 2644	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	89
PID 1744 wrote to memory of 1344	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	90
PID 1744 wrote to memory of 2848	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	91
PID 1744 wrote to memory of 1832	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	92
PID 1744 wrote to memory of 1392	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	93
PID 1744 wrote to memory of 4316	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	94
PID 1744 wrote to memory of 2160	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	95
PID 1744 wrote to memory of 4100	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	96
PID 1744 wrote to memory of 3960	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	97
PID 1744 wrote to memory of 2124	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	98
PID 1744 wrote to memory of 688	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	99
PID 1744 wrote to memory of 2744	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	100
PID 1744 wrote to memory of 2096	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	101
PID 1744 wrote to memory of 3996	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	102
PID 1744 wrote to memory of 2476	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	103
PID 1744 wrote to memory of 2748	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	104
PID 1744 wrote to memory of 4024	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	105
PID 1744 wrote to memory of 2648	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	106
PID 1744 wrote to memory of 1364	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	107
PID 1744 wrote to memory of 1716	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	108
PID 1744 wrote to memory of 3936	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	109
PID 1744 wrote to memory of 4560	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	110
PID 1744 wrote to memory of 808	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	111
PID 1744 wrote to memory of 3280	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	112
PID 1744 wrote to memory of 4000	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	113
PID 1744 wrote to memory of 1520	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	114
PID 1744 wrote to memory of 4376	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	115
PID 1744 wrote to memory of 1604	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	116
PID 1744 wrote to memory of 824	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	117
PID 1744 wrote to memory of 2272	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	118
PID 1744 wrote to memory of 3932	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	119
PID 1744 wrote to memory of 4880	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	120
PID 1744 wrote to memory of 3020	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	121
PID 1744 wrote to memory of 2780	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	122
PID 1744 wrote to memory of 3068	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	123
PID 1744 wrote to memory of 2536	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	124
PID 1744 wrote to memory of 1596	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	125
PID 1744 wrote to memory of 628	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	126
PID 1744 wrote to memory of 4332	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	127
PID 1744 wrote to memory of 3236	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	128
PID 1744 wrote to memory of 1672	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	129
PID 1744 wrote to memory of 4620	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	130
PID 1744 wrote to memory of 1380	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	131
PID 1744 wrote to memory of 1448	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	132
PID 1744 wrote to memory of 4596	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	133
PID 1744 wrote to memory of 2480	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	134
PID 1744 wrote to memory of 4580	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	135
PID 1744 wrote to memory of 4268	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	136
PID 1744 wrote to memory of 3844	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	137
PID 1744 wrote to memory of 4420	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	138
PID 1744 wrote to memory of 752	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	139
PID 1744 wrote to memory of 3700	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	140
PID 1744 wrote to memory of 372	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	141
PID 1744 wrote to memory of 1348	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	142
PID 1744 wrote to memory of 1236	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	143
PID 1744 wrote to memory of 1588	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	144
PID 1744 wrote to memory of 2396	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	145
PID 1744 wrote to memory of 3312	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	146
PID 1744 wrote to memory of 4972	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	147
PID 1744 wrote to memory of 4104	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	148
PID 1744 wrote to memory of 3004	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	149
PID 1744 wrote to memory of 1764	1744	98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe	150

C:\Users\Admin\AppData\Local\Temp\98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe
"C:\Users\Admin\AppData\Local\Temp\98247a75b34e7538c463e3cc6905c18c48a1a08b9854852f12079a0151aa9345.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\System\IauKGgj.exe
  C:\Windows\System\IauKGgj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\NnOXdZc.exe
  C:\Windows\System\NnOXdZc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\KQHgLcn.exe
  C:\Windows\System\KQHgLcn.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\HOxZVbJ.exe
  C:\Windows\System\HOxZVbJ.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\mCWbYmk.exe
  C:\Windows\System\mCWbYmk.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\OfjoaWu.exe
  C:\Windows\System\OfjoaWu.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\DXYtPGf.exe
  C:\Windows\System\DXYtPGf.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\ulGIKxZ.exe
  C:\Windows\System\ulGIKxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\rDSipPk.exe
  C:\Windows\System\rDSipPk.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\mvdfQFQ.exe
  C:\Windows\System\mvdfQFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\VXgFGyY.exe
  C:\Windows\System\VXgFGyY.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\gJulSUv.exe
  C:\Windows\System\gJulSUv.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\BKaffjk.exe
  C:\Windows\System\BKaffjk.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\GUiNhdC.exe
  C:\Windows\System\GUiNhdC.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\fSFBmaS.exe
  C:\Windows\System\fSFBmaS.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\fBFnltZ.exe
  C:\Windows\System\fBFnltZ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\udRelfW.exe
  C:\Windows\System\udRelfW.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vREyMRb.exe
  C:\Windows\System\vREyMRb.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\dcElcbe.exe
  C:\Windows\System\dcElcbe.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\arXSsHR.exe
  C:\Windows\System\arXSsHR.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\vDQvpgI.exe
  C:\Windows\System\vDQvpgI.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\qzgWChA.exe
  C:\Windows\System\qzgWChA.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\CuXzTlg.exe
  C:\Windows\System\CuXzTlg.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\pBLZzMe.exe
  C:\Windows\System\pBLZzMe.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\yLfvAcy.exe
  C:\Windows\System\yLfvAcy.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\RnyCHZd.exe
  C:\Windows\System\RnyCHZd.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\UWQcyFE.exe
  C:\Windows\System\UWQcyFE.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\uBoqWLa.exe
  C:\Windows\System\uBoqWLa.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\PcrIXkZ.exe
  C:\Windows\System\PcrIXkZ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\GLuAZXA.exe
  C:\Windows\System\GLuAZXA.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\mpfxbbn.exe
  C:\Windows\System\mpfxbbn.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\mxqeOwi.exe
  C:\Windows\System\mxqeOwi.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\iMDhrHC.exe
  C:\Windows\System\iMDhrHC.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\SobDpmy.exe
  C:\Windows\System\SobDpmy.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\GVEfvHJ.exe
  C:\Windows\System\GVEfvHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\LXrUufA.exe
  C:\Windows\System\LXrUufA.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\eRCjTHZ.exe
  C:\Windows\System\eRCjTHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\oBcqIbd.exe
  C:\Windows\System\oBcqIbd.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\qDKoVUG.exe
  C:\Windows\System\qDKoVUG.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\lnzzBrd.exe
  C:\Windows\System\lnzzBrd.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\SFdaNKY.exe
  C:\Windows\System\SFdaNKY.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\OQjljkp.exe
  C:\Windows\System\OQjljkp.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\TkLjkyq.exe
  C:\Windows\System\TkLjkyq.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\rtGuhMc.exe
  C:\Windows\System\rtGuhMc.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\pJOnmzz.exe
  C:\Windows\System\pJOnmzz.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\jMoUOHu.exe
  C:\Windows\System\jMoUOHu.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\UsDOWWv.exe
  C:\Windows\System\UsDOWWv.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\MMAunyF.exe
  C:\Windows\System\MMAunyF.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\OYJeFir.exe
  C:\Windows\System\OYJeFir.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\kPfcBHC.exe
  C:\Windows\System\kPfcBHC.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\ikIXGoO.exe
  C:\Windows\System\ikIXGoO.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\ClIuCNu.exe
  C:\Windows\System\ClIuCNu.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\SsJfkQu.exe
  C:\Windows\System\SsJfkQu.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\amNUAKJ.exe
  C:\Windows\System\amNUAKJ.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\ElwIWrh.exe
  C:\Windows\System\ElwIWrh.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\HUStTXj.exe
  C:\Windows\System\HUStTXj.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\OSSjiwC.exe
  C:\Windows\System\OSSjiwC.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\IZgiCOp.exe
  C:\Windows\System\IZgiCOp.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\tZvpgDd.exe
  C:\Windows\System\tZvpgDd.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\jWVwCsT.exe
  C:\Windows\System\jWVwCsT.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\qkpFLEc.exe
  C:\Windows\System\qkpFLEc.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\nZUOSYe.exe
  C:\Windows\System\nZUOSYe.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\FPPPWoq.exe
  C:\Windows\System\FPPPWoq.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\vCrAErT.exe
  C:\Windows\System\vCrAErT.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\jknuwcG.exe
  C:\Windows\System\jknuwcG.exe
  2⤵
  PID:1020
- C:\Windows\System\vAxJYWE.exe
  C:\Windows\System\vAxJYWE.exe
  2⤵
  PID:4748
- C:\Windows\System\DOKTydW.exe
  C:\Windows\System\DOKTydW.exe
  2⤵
  PID:1060
- C:\Windows\System\GJnUfyH.exe
  C:\Windows\System\GJnUfyH.exe
  2⤵
  PID:1916
- C:\Windows\System\NtSLzas.exe
  C:\Windows\System\NtSLzas.exe
  2⤵
  PID:2872
- C:\Windows\System\kukZDmN.exe
  C:\Windows\System\kukZDmN.exe
  2⤵
  PID:704
- C:\Windows\System\hIlnEUY.exe
  C:\Windows\System\hIlnEUY.exe
  2⤵
  PID:4264
- C:\Windows\System\mSmRkPy.exe
  C:\Windows\System\mSmRkPy.exe
  2⤵
  PID:4312
- C:\Windows\System\TmPPqYu.exe
  C:\Windows\System\TmPPqYu.exe
  2⤵
  PID:4576
- C:\Windows\System\zZPNGre.exe
  C:\Windows\System\zZPNGre.exe
  2⤵
  PID:1540
- C:\Windows\System\NjNaQtN.exe
  C:\Windows\System\NjNaQtN.exe
  2⤵
  PID:4792
- C:\Windows\System\MqPnLVg.exe
  C:\Windows\System\MqPnLVg.exe
  2⤵
  PID:1816
- C:\Windows\System\lWaEARI.exe
  C:\Windows\System\lWaEARI.exe
  2⤵
  PID:5148
- C:\Windows\System\MnCOMcf.exe
  C:\Windows\System\MnCOMcf.exe
  2⤵
  PID:5184
- C:\Windows\System\stUzIzY.exe
  C:\Windows\System\stUzIzY.exe
  2⤵
  PID:5208
- C:\Windows\System\jOiHNzW.exe
  C:\Windows\System\jOiHNzW.exe
  2⤵
  PID:5240
- C:\Windows\System\fjBEMvj.exe
  C:\Windows\System\fjBEMvj.exe
  2⤵
  PID:5268
- C:\Windows\System\HuVqbKH.exe
  C:\Windows\System\HuVqbKH.exe
  2⤵
  PID:5296
- C:\Windows\System\aMOVViw.exe
  C:\Windows\System\aMOVViw.exe
  2⤵
  PID:5324
- C:\Windows\System\yDuFCfz.exe
  C:\Windows\System\yDuFCfz.exe
  2⤵
  PID:5352
- C:\Windows\System\isIBvnD.exe
  C:\Windows\System\isIBvnD.exe
  2⤵
  PID:5380
- C:\Windows\System\rlBBpsZ.exe
  C:\Windows\System\rlBBpsZ.exe
  2⤵
  PID:5408
- C:\Windows\System\MLNYHcg.exe
  C:\Windows\System\MLNYHcg.exe
  2⤵
  PID:5436
- C:\Windows\System\DCZQKuU.exe
  C:\Windows\System\DCZQKuU.exe
  2⤵
  PID:5464
- C:\Windows\System\qVrsTlC.exe
  C:\Windows\System\qVrsTlC.exe
  2⤵
  PID:5492
- C:\Windows\System\dZqTfkz.exe
  C:\Windows\System\dZqTfkz.exe
  2⤵
  PID:5524
- C:\Windows\System\bHocJBm.exe
  C:\Windows\System\bHocJBm.exe
  2⤵
  PID:5556
- C:\Windows\System\aqVcpBV.exe
  C:\Windows\System\aqVcpBV.exe
  2⤵
  PID:5588
- C:\Windows\System\cgdvQJV.exe
  C:\Windows\System\cgdvQJV.exe
  2⤵
  PID:5616
- C:\Windows\System\tNqULTc.exe
  C:\Windows\System\tNqULTc.exe
  2⤵
  PID:5644
- C:\Windows\System\OjBqari.exe
  C:\Windows\System\OjBqari.exe
  2⤵
  PID:5676
- C:\Windows\System\HIvHMJW.exe
  C:\Windows\System\HIvHMJW.exe
  2⤵
  PID:5700
- C:\Windows\System\BKBfaQy.exe
  C:\Windows\System\BKBfaQy.exe
  2⤵
  PID:5728
- C:\Windows\System\VLXQCZw.exe
  C:\Windows\System\VLXQCZw.exe
  2⤵
  PID:5756
- C:\Windows\System\hkEZclv.exe
  C:\Windows\System\hkEZclv.exe
  2⤵
  PID:5784
- C:\Windows\System\zJZqZvc.exe
  C:\Windows\System\zJZqZvc.exe
  2⤵
  PID:5812
- C:\Windows\System\zvdIGPy.exe
  C:\Windows\System\zvdIGPy.exe
  2⤵
  PID:5840
- C:\Windows\System\GgrZrke.exe
  C:\Windows\System\GgrZrke.exe
  2⤵
  PID:5872
- C:\Windows\System\iKKrCJq.exe
  C:\Windows\System\iKKrCJq.exe
  2⤵
  PID:5900
- C:\Windows\System\yFIGpXF.exe
  C:\Windows\System\yFIGpXF.exe
  2⤵
  PID:5928
- C:\Windows\System\cuUXYlJ.exe
  C:\Windows\System\cuUXYlJ.exe
  2⤵
  PID:5956
- C:\Windows\System\ChocBlT.exe
  C:\Windows\System\ChocBlT.exe
  2⤵
  PID:5984
- C:\Windows\System\iTrlPFz.exe
  C:\Windows\System\iTrlPFz.exe
  2⤵
  PID:6012
- C:\Windows\System\uEWsUYo.exe
  C:\Windows\System\uEWsUYo.exe
  2⤵
  PID:6040
- C:\Windows\System\xJszCiB.exe
  C:\Windows\System\xJszCiB.exe
  2⤵
  PID:6068
- C:\Windows\System\gUbuARm.exe
  C:\Windows\System\gUbuARm.exe
  2⤵
  PID:6096
- C:\Windows\System\xvyvBMi.exe
  C:\Windows\System\xvyvBMi.exe
  2⤵
  PID:6124
- C:\Windows\System\cQBbvAK.exe
  C:\Windows\System\cQBbvAK.exe
  2⤵
  PID:3272
- C:\Windows\System\ctKWqXd.exe
  C:\Windows\System\ctKWqXd.exe
  2⤵
  PID:4324
- C:\Windows\System\dFVAdON.exe
  C:\Windows\System\dFVAdON.exe
  2⤵
  PID:3896
- C:\Windows\System\AEfOmgO.exe
  C:\Windows\System\AEfOmgO.exe
  2⤵
  PID:3880
- C:\Windows\System\fJAfseu.exe
  C:\Windows\System\fJAfseu.exe
  2⤵
  PID:928
- C:\Windows\System\IgdWnWF.exe
  C:\Windows\System\IgdWnWF.exe
  2⤵
  PID:5072
- C:\Windows\System\kQuFIDE.exe
  C:\Windows\System\kQuFIDE.exe
  2⤵
  PID:4492
- C:\Windows\System\kIJWVos.exe
  C:\Windows\System\kIJWVos.exe
  2⤵
  PID:5164
- C:\Windows\System\uCpYwfT.exe
  C:\Windows\System\uCpYwfT.exe
  2⤵
  PID:5232
- C:\Windows\System\EKWIoom.exe
  C:\Windows\System\EKWIoom.exe
  2⤵
  PID:5312
- C:\Windows\System\SCYlOAk.exe
  C:\Windows\System\SCYlOAk.exe
  2⤵
  PID:5372
- C:\Windows\System\uEWWXCc.exe
  C:\Windows\System\uEWWXCc.exe
  2⤵
  PID:5432
- C:\Windows\System\NdNygNG.exe
  C:\Windows\System\NdNygNG.exe
  2⤵
  PID:5512
- C:\Windows\System\EYFYDnE.exe
  C:\Windows\System\EYFYDnE.exe
  2⤵
  PID:5576
- C:\Windows\System\IZfDjDZ.exe
  C:\Windows\System\IZfDjDZ.exe
  2⤵
  PID:5640
- C:\Windows\System\WNxmSNn.exe
  C:\Windows\System\WNxmSNn.exe
  2⤵
  PID:5716
- C:\Windows\System\fsbjnEg.exe
  C:\Windows\System\fsbjnEg.exe
  2⤵
  PID:5776
- C:\Windows\System\ZydCoWk.exe
  C:\Windows\System\ZydCoWk.exe
  2⤵
  PID:5836
- C:\Windows\System\UPLVnzs.exe
  C:\Windows\System\UPLVnzs.exe
  2⤵
  PID:5916
- C:\Windows\System\vFPNdlP.exe
  C:\Windows\System\vFPNdlP.exe
  2⤵
  PID:5976
- C:\Windows\System\eMuwLvl.exe
  C:\Windows\System\eMuwLvl.exe
  2⤵
  PID:6036
- C:\Windows\System\FycqHyV.exe
  C:\Windows\System\FycqHyV.exe
  2⤵
  PID:6112
- C:\Windows\System\KRzqXII.exe
  C:\Windows\System\KRzqXII.exe
  2⤵
  PID:3176
- C:\Windows\System\fAjeHYI.exe
  C:\Windows\System\fAjeHYI.exe
  2⤵
  PID:3496
- C:\Windows\System\QcagHxR.exe
  C:\Windows\System\QcagHxR.exe
  2⤵
  PID:1340
- C:\Windows\System\rAgZcmS.exe
  C:\Windows\System\rAgZcmS.exe
  2⤵
  PID:5224
- C:\Windows\System\iwTxZIQ.exe
  C:\Windows\System\iwTxZIQ.exe
  2⤵
  PID:5368
- C:\Windows\System\OoZNPPD.exe
  C:\Windows\System\OoZNPPD.exe
  2⤵
  PID:5552
- C:\Windows\System\QTquZgr.exe
  C:\Windows\System\QTquZgr.exe
  2⤵
  PID:6164
- C:\Windows\System\aPqcKeW.exe
  C:\Windows\System\aPqcKeW.exe
  2⤵
  PID:6192
- C:\Windows\System\HZDcqVz.exe
  C:\Windows\System\HZDcqVz.exe
  2⤵
  PID:6220
- C:\Windows\System\CkEOsyY.exe
  C:\Windows\System\CkEOsyY.exe
  2⤵
  PID:6248
- C:\Windows\System\OdxahVL.exe
  C:\Windows\System\OdxahVL.exe
  2⤵
  PID:6276
- C:\Windows\System\lsTGmYK.exe
  C:\Windows\System\lsTGmYK.exe
  2⤵
  PID:6304
- C:\Windows\System\OxQVJzo.exe
  C:\Windows\System\OxQVJzo.exe
  2⤵
  PID:6332
- C:\Windows\System\BBXPfAm.exe
  C:\Windows\System\BBXPfAm.exe
  2⤵
  PID:6360
- C:\Windows\System\vfDRKeg.exe
  C:\Windows\System\vfDRKeg.exe
  2⤵
  PID:6388
- C:\Windows\System\DzvmOWw.exe
  C:\Windows\System\DzvmOWw.exe
  2⤵
  PID:6416
- C:\Windows\System\QbrIixR.exe
  C:\Windows\System\QbrIixR.exe
  2⤵
  PID:6448
- C:\Windows\System\GjomdMb.exe
  C:\Windows\System\GjomdMb.exe
  2⤵
  PID:6472
- C:\Windows\System\uEqtknu.exe
  C:\Windows\System\uEqtknu.exe
  2⤵
  PID:6500
- C:\Windows\System\WMBZxQS.exe
  C:\Windows\System\WMBZxQS.exe
  2⤵
  PID:6528
- C:\Windows\System\PVNDvzX.exe
  C:\Windows\System\PVNDvzX.exe
  2⤵
  PID:6556
- C:\Windows\System\HBqbtsl.exe
  C:\Windows\System\HBqbtsl.exe
  2⤵
  PID:6584
- C:\Windows\System\LHwOlws.exe
  C:\Windows\System\LHwOlws.exe
  2⤵
  PID:6612
- C:\Windows\System\TRjxmmj.exe
  C:\Windows\System\TRjxmmj.exe
  2⤵
  PID:6640
- C:\Windows\System\jngSntH.exe
  C:\Windows\System\jngSntH.exe
  2⤵
  PID:6668
- C:\Windows\System\jRwHTNo.exe
  C:\Windows\System\jRwHTNo.exe
  2⤵
  PID:6696
- C:\Windows\System\aJYjDiT.exe
  C:\Windows\System\aJYjDiT.exe
  2⤵
  PID:6724
- C:\Windows\System\EAbGfve.exe
  C:\Windows\System\EAbGfve.exe
  2⤵
  PID:6752
- C:\Windows\System\XnXoLgo.exe
  C:\Windows\System\XnXoLgo.exe
  2⤵
  PID:6784
- C:\Windows\System\VdzmizK.exe
  C:\Windows\System\VdzmizK.exe
  2⤵
  PID:6812
- C:\Windows\System\modMWlb.exe
  C:\Windows\System\modMWlb.exe
  2⤵
  PID:6836
- C:\Windows\System\furFKHX.exe
  C:\Windows\System\furFKHX.exe
  2⤵
  PID:6864
- C:\Windows\System\gfmsAre.exe
  C:\Windows\System\gfmsAre.exe
  2⤵
  PID:6892
- C:\Windows\System\SADqYca.exe
  C:\Windows\System\SADqYca.exe
  2⤵
  PID:6924
- C:\Windows\System\NAGJiHW.exe
  C:\Windows\System\NAGJiHW.exe
  2⤵
  PID:6948
- C:\Windows\System\quktObx.exe
  C:\Windows\System\quktObx.exe
  2⤵
  PID:6976
- C:\Windows\System\MLIdEzS.exe
  C:\Windows\System\MLIdEzS.exe
  2⤵
  PID:7008
- C:\Windows\System\eTWitHi.exe
  C:\Windows\System\eTWitHi.exe
  2⤵
  PID:7032
- C:\Windows\System\wabkJuX.exe
  C:\Windows\System\wabkJuX.exe
  2⤵
  PID:7060
- C:\Windows\System\oINuqBF.exe
  C:\Windows\System\oINuqBF.exe
  2⤵
  PID:7088
- C:\Windows\System\gofgZlG.exe
  C:\Windows\System\gofgZlG.exe
  2⤵
  PID:7116
- C:\Windows\System\WRKQaot.exe
  C:\Windows\System\WRKQaot.exe
  2⤵
  PID:7144
- C:\Windows\System\RZYbDyB.exe
  C:\Windows\System\RZYbDyB.exe
  2⤵
  PID:5632
- C:\Windows\System\SiIikKm.exe
  C:\Windows\System\SiIikKm.exe
  2⤵
  PID:5772
- C:\Windows\System\tQGqqBg.exe
  C:\Windows\System\tQGqqBg.exe
  2⤵
  PID:5948
- C:\Windows\System\oeKThQk.exe
  C:\Windows\System\oeKThQk.exe
  2⤵
  PID:6088
- C:\Windows\System\vtJShtd.exe
  C:\Windows\System\vtJShtd.exe
  2⤵
  PID:1544
- C:\Windows\System\cSTIddK.exe
  C:\Windows\System\cSTIddK.exe
  2⤵
  PID:1696
- C:\Windows\System\dadfrUl.exe
  C:\Windows\System\dadfrUl.exe
  2⤵
  PID:6152
- C:\Windows\System\UuKxKwH.exe
  C:\Windows\System\UuKxKwH.exe
  2⤵
  PID:6216
- C:\Windows\System\TloBcXR.exe
  C:\Windows\System\TloBcXR.exe
  2⤵
  PID:6292
- C:\Windows\System\aSOKMqR.exe
  C:\Windows\System\aSOKMqR.exe
  2⤵
  PID:6352
- C:\Windows\System\jhXiibZ.exe
  C:\Windows\System\jhXiibZ.exe
  2⤵
  PID:6408
- C:\Windows\System\JZILHdn.exe
  C:\Windows\System\JZILHdn.exe
  2⤵
  PID:6468
- C:\Windows\System\HPmMEbc.exe
  C:\Windows\System\HPmMEbc.exe
  2⤵
  PID:6544
- C:\Windows\System\gSIOLWE.exe
  C:\Windows\System\gSIOLWE.exe
  2⤵
  PID:6604
- C:\Windows\System\IxrsavI.exe
  C:\Windows\System\IxrsavI.exe
  2⤵
  PID:6664
- C:\Windows\System\GSNFRID.exe
  C:\Windows\System\GSNFRID.exe
  2⤵
  PID:6744
- C:\Windows\System\ZIPgeBd.exe
  C:\Windows\System\ZIPgeBd.exe
  2⤵
  PID:6804
- C:\Windows\System\YQgLKCh.exe
  C:\Windows\System\YQgLKCh.exe
  2⤵
  PID:6860
- C:\Windows\System\vEjIOAS.exe
  C:\Windows\System\vEjIOAS.exe
  2⤵
  PID:6936
- C:\Windows\System\dGAZVMA.exe
  C:\Windows\System\dGAZVMA.exe
  2⤵
  PID:6996
- C:\Windows\System\VefwuBB.exe
  C:\Windows\System\VefwuBB.exe
  2⤵
  PID:7056
- C:\Windows\System\soaYrpH.exe
  C:\Windows\System\soaYrpH.exe
  2⤵
  PID:7132
- C:\Windows\System\VPLcBrF.exe
  C:\Windows\System\VPLcBrF.exe
  2⤵
  PID:5748
- C:\Windows\System\ldXihKr.exe
  C:\Windows\System\ldXihKr.exe
  2⤵
  PID:6084
- C:\Windows\System\dpENqOU.exe
  C:\Windows\System\dpENqOU.exe
  2⤵
  PID:5480
- C:\Windows\System\PyPAdja.exe
  C:\Windows\System\PyPAdja.exe
  2⤵
  PID:6264
- C:\Windows\System\AezEvxM.exe
  C:\Windows\System\AezEvxM.exe
  2⤵
  PID:6380
- C:\Windows\System\mrPzSBm.exe
  C:\Windows\System\mrPzSBm.exe
  2⤵
  PID:6516
- C:\Windows\System\hThSRQa.exe
  C:\Windows\System\hThSRQa.exe
  2⤵
  PID:7188
- C:\Windows\System\uHtqoqI.exe
  C:\Windows\System\uHtqoqI.exe
  2⤵
  PID:7216
- C:\Windows\System\ZrqzJIb.exe
  C:\Windows\System\ZrqzJIb.exe
  2⤵
  PID:7244
- C:\Windows\System\bXRJqWs.exe
  C:\Windows\System\bXRJqWs.exe
  2⤵
  PID:7272
- C:\Windows\System\GFQnpjm.exe
  C:\Windows\System\GFQnpjm.exe
  2⤵
  PID:7296
- C:\Windows\System\zEpNCXl.exe
  C:\Windows\System\zEpNCXl.exe
  2⤵
  PID:7324
- C:\Windows\System\CRDrkPu.exe
  C:\Windows\System\CRDrkPu.exe
  2⤵
  PID:7352
- C:\Windows\System\OMswpBS.exe
  C:\Windows\System\OMswpBS.exe
  2⤵
  PID:7384
- C:\Windows\System\EiIFXlA.exe
  C:\Windows\System\EiIFXlA.exe
  2⤵
  PID:7412
- C:\Windows\System\uYWZdcV.exe
  C:\Windows\System\uYWZdcV.exe
  2⤵
  PID:7440
- C:\Windows\System\qYXISsk.exe
  C:\Windows\System\qYXISsk.exe
  2⤵
  PID:7468
- C:\Windows\System\UskpNTt.exe
  C:\Windows\System\UskpNTt.exe
  2⤵
  PID:7496
- C:\Windows\System\QATGrly.exe
  C:\Windows\System\QATGrly.exe
  2⤵
  PID:7520
- C:\Windows\System\DxUDwZQ.exe
  C:\Windows\System\DxUDwZQ.exe
  2⤵
  PID:7548
- C:\Windows\System\vTwKGlF.exe
  C:\Windows\System\vTwKGlF.exe
  2⤵
  PID:7576
- C:\Windows\System\JkcBBfu.exe
  C:\Windows\System\JkcBBfu.exe
  2⤵
  PID:7604
- C:\Windows\System\DXPNoBF.exe
  C:\Windows\System\DXPNoBF.exe
  2⤵
  PID:7632
- C:\Windows\System\QTbiMTm.exe
  C:\Windows\System\QTbiMTm.exe
  2⤵
  PID:7660
- C:\Windows\System\KhCDBIB.exe
  C:\Windows\System\KhCDBIB.exe
  2⤵
  PID:7688
- C:\Windows\System\nukQXtK.exe
  C:\Windows\System\nukQXtK.exe
  2⤵
  PID:7716
- C:\Windows\System\HEbemih.exe
  C:\Windows\System\HEbemih.exe
  2⤵
  PID:7744
- C:\Windows\System\HenBSUR.exe
  C:\Windows\System\HenBSUR.exe
  2⤵
  PID:7772
- C:\Windows\System\jwpiEWk.exe
  C:\Windows\System\jwpiEWk.exe
  2⤵
  PID:7804
- C:\Windows\System\obCyrIu.exe
  C:\Windows\System\obCyrIu.exe
  2⤵
  PID:7832
- C:\Windows\System\CWeaKEB.exe
  C:\Windows\System\CWeaKEB.exe
  2⤵
  PID:7860
- C:\Windows\System\RDkoWma.exe
  C:\Windows\System\RDkoWma.exe
  2⤵
  PID:7884
- C:\Windows\System\zBGxvTt.exe
  C:\Windows\System\zBGxvTt.exe
  2⤵
  PID:7916
- C:\Windows\System\KqVSJxt.exe
  C:\Windows\System\KqVSJxt.exe
  2⤵
  PID:7940
- C:\Windows\System\PJOOnOM.exe
  C:\Windows\System\PJOOnOM.exe
  2⤵
  PID:7972
- C:\Windows\System\gmhwaeJ.exe
  C:\Windows\System\gmhwaeJ.exe
  2⤵
  PID:8000
- C:\Windows\System\JsfaLAW.exe
  C:\Windows\System\JsfaLAW.exe
  2⤵
  PID:8028
- C:\Windows\System\BdhhEcB.exe
  C:\Windows\System\BdhhEcB.exe
  2⤵
  PID:8052
- C:\Windows\System\GUIABlR.exe
  C:\Windows\System\GUIABlR.exe
  2⤵
  PID:8080
- C:\Windows\System\ZolvOnv.exe
  C:\Windows\System\ZolvOnv.exe
  2⤵
  PID:8112
- C:\Windows\System\FcAXPfB.exe
  C:\Windows\System\FcAXPfB.exe
  2⤵
  PID:8136
- C:\Windows\System\kEMmlhu.exe
  C:\Windows\System\kEMmlhu.exe
  2⤵
  PID:8164
- C:\Windows\System\UsKqLPU.exe
  C:\Windows\System\UsKqLPU.exe
  2⤵
  PID:6580
- C:\Windows\System\EPbPBmj.exe
  C:\Windows\System\EPbPBmj.exe
  2⤵
  PID:6720
- C:\Windows\System\KCKHYPF.exe
  C:\Windows\System\KCKHYPF.exe
  2⤵
  PID:6856
- C:\Windows\System\CZkEFnm.exe
  C:\Windows\System\CZkEFnm.exe
  2⤵
  PID:6992
- C:\Windows\System\oYgYESu.exe
  C:\Windows\System\oYgYESu.exe
  2⤵
  PID:7160
- C:\Windows\System\GutMwTA.exe
  C:\Windows\System\GutMwTA.exe
  2⤵
  PID:5200
- C:\Windows\System\ODhNkwS.exe
  C:\Windows\System\ODhNkwS.exe
  2⤵
  PID:6328
- C:\Windows\System\AEgkKhI.exe
  C:\Windows\System\AEgkKhI.exe
  2⤵
  PID:7200
- C:\Windows\System\qhuMtyD.exe
  C:\Windows\System\qhuMtyD.exe
  2⤵
  PID:7264
- C:\Windows\System\IqvoXVf.exe
  C:\Windows\System\IqvoXVf.exe
  2⤵
  PID:7340
- C:\Windows\System\eGNWddj.exe
  C:\Windows\System\eGNWddj.exe
  2⤵
  PID:7400
- C:\Windows\System\mTBNzAw.exe
  C:\Windows\System\mTBNzAw.exe
  2⤵
  PID:7460
- C:\Windows\System\qdQkuqp.exe
  C:\Windows\System\qdQkuqp.exe
  2⤵
  PID:7516
- C:\Windows\System\XNyaDMV.exe
  C:\Windows\System\XNyaDMV.exe
  2⤵
  PID:7592
- C:\Windows\System\NJEKbVN.exe
  C:\Windows\System\NJEKbVN.exe
  2⤵
  PID:7648
- C:\Windows\System\ywmliYS.exe
  C:\Windows\System\ywmliYS.exe
  2⤵
  PID:7708
- C:\Windows\System\tlDFJRk.exe
  C:\Windows\System\tlDFJRk.exe
  2⤵
  PID:7760
- C:\Windows\System\jFpEzkp.exe
  C:\Windows\System\jFpEzkp.exe
  2⤵
  PID:5100
- C:\Windows\System\InbddMd.exe
  C:\Windows\System\InbddMd.exe
  2⤵
  PID:2352
- C:\Windows\System\QNUYFTT.exe
  C:\Windows\System\QNUYFTT.exe
  2⤵
  PID:7928
- C:\Windows\System\tgUVexx.exe
  C:\Windows\System\tgUVexx.exe
  2⤵
  PID:7964
- C:\Windows\System\NMnIaIv.exe
  C:\Windows\System\NMnIaIv.exe
  2⤵
  PID:8020
- C:\Windows\System\nBkKmsK.exe
  C:\Windows\System\nBkKmsK.exe
  2⤵
  PID:8100
- C:\Windows\System\PJseplK.exe
  C:\Windows\System\PJseplK.exe
  2⤵
  PID:8160
- C:\Windows\System\LWytcrN.exe
  C:\Windows\System\LWytcrN.exe
  2⤵
  PID:6776
- C:\Windows\System\gwDDIRd.exe
  C:\Windows\System\gwDDIRd.exe
  2⤵
  PID:7104
- C:\Windows\System\zJZSqOl.exe
  C:\Windows\System\zJZSqOl.exe
  2⤵
  PID:968
- C:\Windows\System\cgxIdev.exe
  C:\Windows\System\cgxIdev.exe
  2⤵
  PID:7180
- C:\Windows\System\teRGUaE.exe
  C:\Windows\System\teRGUaE.exe
  2⤵
  PID:7368
- C:\Windows\System\IkbrqfI.exe
  C:\Windows\System\IkbrqfI.exe
  2⤵
  PID:7488
- C:\Windows\System\EkZSnpJ.exe
  C:\Windows\System\EkZSnpJ.exe
  2⤵
  PID:7572
- C:\Windows\System\gVXhewv.exe
  C:\Windows\System\gVXhewv.exe
  2⤵
  PID:7736
- C:\Windows\System\RPyThoy.exe
  C:\Windows\System\RPyThoy.exe
  2⤵
  PID:7796
- C:\Windows\System\xRFNLcf.exe
  C:\Windows\System\xRFNLcf.exe
  2⤵
  PID:7904
- C:\Windows\System\dThzsUB.exe
  C:\Windows\System\dThzsUB.exe
  2⤵
  PID:8012
- C:\Windows\System\ZEYbWyg.exe
  C:\Windows\System\ZEYbWyg.exe
  2⤵
  PID:8152
- C:\Windows\System\NVrPgHL.exe
  C:\Windows\System\NVrPgHL.exe
  2⤵
  PID:5896
- C:\Windows\System\gezfPKs.exe
  C:\Windows\System\gezfPKs.exe
  2⤵
  PID:7176
- C:\Windows\System\bRbhEkT.exe
  C:\Windows\System\bRbhEkT.exe
  2⤵
  PID:8220
- C:\Windows\System\uDVwbOS.exe
  C:\Windows\System\uDVwbOS.exe
  2⤵
  PID:8248
- C:\Windows\System\IFKRaSr.exe
  C:\Windows\System\IFKRaSr.exe
  2⤵
  PID:8268
- C:\Windows\System\rPchRTu.exe
  C:\Windows\System\rPchRTu.exe
  2⤵
  PID:8300
- C:\Windows\System\didjSvf.exe
  C:\Windows\System\didjSvf.exe
  2⤵
  PID:8332
- C:\Windows\System\JahBxJf.exe
  C:\Windows\System\JahBxJf.exe
  2⤵
  PID:8360
- C:\Windows\System\EKYYNDK.exe
  C:\Windows\System\EKYYNDK.exe
  2⤵
  PID:8384
- C:\Windows\System\XYPGuTK.exe
  C:\Windows\System\XYPGuTK.exe
  2⤵
  PID:8420
- C:\Windows\System\JiaOJpa.exe
  C:\Windows\System\JiaOJpa.exe
  2⤵
  PID:8444
- C:\Windows\System\oLSLVWn.exe
  C:\Windows\System\oLSLVWn.exe
  2⤵
  PID:8468
- C:\Windows\System\awuwpWQ.exe
  C:\Windows\System\awuwpWQ.exe
  2⤵
  PID:8584
- C:\Windows\System\efsIgma.exe
  C:\Windows\System\efsIgma.exe
  2⤵
  PID:8684
- C:\Windows\System\xsDudIS.exe
  C:\Windows\System\xsDudIS.exe
  2⤵
  PID:8724
- C:\Windows\System\BSzQhVj.exe
  C:\Windows\System\BSzQhVj.exe
  2⤵
  PID:8740
- C:\Windows\System\eAoGrRa.exe
  C:\Windows\System\eAoGrRa.exe
  2⤵
  PID:8772
- C:\Windows\System\VSFVJJW.exe
  C:\Windows\System\VSFVJJW.exe
  2⤵
  PID:8796
- C:\Windows\System\pfQNBEE.exe
  C:\Windows\System\pfQNBEE.exe
  2⤵
  PID:8844
- C:\Windows\System\SEIaQnL.exe
  C:\Windows\System\SEIaQnL.exe
  2⤵
  PID:8876
- C:\Windows\System\KUFpDlj.exe
  C:\Windows\System\KUFpDlj.exe
  2⤵
  PID:8916
- C:\Windows\System\SVwEovf.exe
  C:\Windows\System\SVwEovf.exe
  2⤵
  PID:8948
- C:\Windows\System\vVVcewM.exe
  C:\Windows\System\vVVcewM.exe
  2⤵
  PID:9012
- C:\Windows\System\WdGHjOu.exe
  C:\Windows\System\WdGHjOu.exe
  2⤵
  PID:9028
- C:\Windows\System\lKbkWFC.exe
  C:\Windows\System\lKbkWFC.exe
  2⤵
  PID:9052
- C:\Windows\System\gCVwmdN.exe
  C:\Windows\System\gCVwmdN.exe
  2⤵
  PID:9080
- C:\Windows\System\qTSjgiv.exe
  C:\Windows\System\qTSjgiv.exe
  2⤵
  PID:9108
- C:\Windows\System\xOTgWvH.exe
  C:\Windows\System\xOTgWvH.exe
  2⤵
  PID:9128
- C:\Windows\System\ilATDMw.exe
  C:\Windows\System\ilATDMw.exe
  2⤵
  PID:9156
- C:\Windows\System\mfDFEPH.exe
  C:\Windows\System\mfDFEPH.exe
  2⤵
  PID:9184
- C:\Windows\System\GciGpxz.exe
  C:\Windows\System\GciGpxz.exe
  2⤵
  PID:9212
- C:\Windows\System\nPijRim.exe
  C:\Windows\System\nPijRim.exe
  2⤵
  PID:1692
- C:\Windows\System\dKvshwP.exe
  C:\Windows\System\dKvshwP.exe
  2⤵
  PID:1824
- C:\Windows\System\LPucXJP.exe
  C:\Windows\System\LPucXJP.exe
  2⤵
  PID:7792
- C:\Windows\System\kwNsKtq.exe
  C:\Windows\System\kwNsKtq.exe
  2⤵
  PID:2756
- C:\Windows\System\wSMvPPp.exe
  C:\Windows\System\wSMvPPp.exe
  2⤵
  PID:8128
- C:\Windows\System\zTzTKwS.exe
  C:\Windows\System\zTzTKwS.exe
  2⤵
  PID:6972
- C:\Windows\System\nFCazCJ.exe
  C:\Windows\System\nFCazCJ.exe
  2⤵
  PID:8204
- C:\Windows\System\HsGxNyx.exe
  C:\Windows\System\HsGxNyx.exe
  2⤵
  PID:8256
- C:\Windows\System\KDGHfqG.exe
  C:\Windows\System\KDGHfqG.exe
  2⤵
  PID:912
- C:\Windows\System\ZCPDqTB.exe
  C:\Windows\System\ZCPDqTB.exe
  2⤵
  PID:8324
- C:\Windows\System\zyPBbyM.exe
  C:\Windows\System\zyPBbyM.exe
  2⤵
  PID:1240
- C:\Windows\System\ecyNjhq.exe
  C:\Windows\System\ecyNjhq.exe
  2⤵
  PID:8380
- C:\Windows\System\HosWUmU.exe
  C:\Windows\System\HosWUmU.exe
  2⤵
  PID:1864
- C:\Windows\System\vwxbIJj.exe
  C:\Windows\System\vwxbIJj.exe
  2⤵
  PID:8352
- C:\Windows\System\jGSqZnc.exe
  C:\Windows\System\jGSqZnc.exe
  2⤵
  PID:5024
- C:\Windows\System\rfrhoMu.exe
  C:\Windows\System\rfrhoMu.exe
  2⤵
  PID:2608
- C:\Windows\System\GSfNhCr.exe
  C:\Windows\System\GSfNhCr.exe
  2⤵
  PID:8592
- C:\Windows\System\NeTrxjI.exe
  C:\Windows\System\NeTrxjI.exe
  2⤵
  PID:8720
- C:\Windows\System\UdXzyTH.exe
  C:\Windows\System\UdXzyTH.exe
  2⤵
  PID:8836
- C:\Windows\System\anmlcvW.exe
  C:\Windows\System\anmlcvW.exe
  2⤵
  PID:8904
- C:\Windows\System\mwuTamz.exe
  C:\Windows\System\mwuTamz.exe
  2⤵
  PID:8968
- C:\Windows\System\cubgjwO.exe
  C:\Windows\System\cubgjwO.exe
  2⤵
  PID:9040
- C:\Windows\System\kdALlkX.exe
  C:\Windows\System\kdALlkX.exe
  2⤵
  PID:9100
- C:\Windows\System\hNHqRzT.exe
  C:\Windows\System\hNHqRzT.exe
  2⤵
  PID:9168
- C:\Windows\System\cnvvknA.exe
  C:\Windows\System\cnvvknA.exe
  2⤵
  PID:1772
- C:\Windows\System\iSHDQGI.exe
  C:\Windows\System\iSHDQGI.exe
  2⤵
  PID:4528
- C:\Windows\System\oKMKgTx.exe
  C:\Windows\System\oKMKgTx.exe
  2⤵
  PID:6916
- C:\Windows\System\blaOPzC.exe
  C:\Windows\System\blaOPzC.exe
  2⤵
  PID:4028
- C:\Windows\System\KLKKhPt.exe
  C:\Windows\System\KLKKhPt.exe
  2⤵
  PID:8320
- C:\Windows\System\ZOvBZlH.exe
  C:\Windows\System\ZOvBZlH.exe
  2⤵
  PID:3100
- C:\Windows\System\LJetjbU.exe
  C:\Windows\System\LJetjbU.exe
  2⤵
  PID:8436
- C:\Windows\System\ZmCyHbe.exe
  C:\Windows\System\ZmCyHbe.exe
  2⤵
  PID:8576
- C:\Windows\System\nmGKAPm.exe
  C:\Windows\System\nmGKAPm.exe
  2⤵
  PID:8868
- C:\Windows\System\msjkaGm.exe
  C:\Windows\System\msjkaGm.exe
  2⤵
  PID:9020
- C:\Windows\System\bWYfKMn.exe
  C:\Windows\System\bWYfKMn.exe
  2⤵
  PID:9148
- C:\Windows\System\peEeYyx.exe
  C:\Windows\System\peEeYyx.exe
  2⤵
  PID:3080
- C:\Windows\System\dfbkwUq.exe
  C:\Windows\System\dfbkwUq.exe
  2⤵
  PID:8316
- C:\Windows\System\XAhityZ.exe
  C:\Windows\System\XAhityZ.exe
  2⤵
  PID:8464
- C:\Windows\System\rQVwFvT.exe
  C:\Windows\System\rQVwFvT.exe
  2⤵
  PID:9220
- C:\Windows\System\FreHOou.exe
  C:\Windows\System\FreHOou.exe
  2⤵
  PID:9248
- C:\Windows\System\cRocVXa.exe
  C:\Windows\System\cRocVXa.exe
  2⤵
  PID:9276
- C:\Windows\System\tFGNlvF.exe
  C:\Windows\System\tFGNlvF.exe
  2⤵
  PID:9300
- C:\Windows\System\Rtagxbv.exe
  C:\Windows\System\Rtagxbv.exe
  2⤵
  PID:9332
- C:\Windows\System\InrBvjm.exe
  C:\Windows\System\InrBvjm.exe
  2⤵
  PID:9360
- C:\Windows\System\YQQCRdX.exe
  C:\Windows\System\YQQCRdX.exe
  2⤵
  PID:9376
- C:\Windows\System\nOgchSV.exe
  C:\Windows\System\nOgchSV.exe
  2⤵
  PID:9412
- C:\Windows\System\lgatfun.exe
  C:\Windows\System\lgatfun.exe
  2⤵
  PID:9440
- C:\Windows\System\VJXWuqd.exe
  C:\Windows\System\VJXWuqd.exe
  2⤵
  PID:9468
- C:\Windows\System\MIcpfiq.exe
  C:\Windows\System\MIcpfiq.exe
  2⤵
  PID:9496
- C:\Windows\System\yZDSbHu.exe
  C:\Windows\System\yZDSbHu.exe
  2⤵
  PID:9524
- C:\Windows\System\fWkNBPr.exe
  C:\Windows\System\fWkNBPr.exe
  2⤵
  PID:9552
- C:\Windows\System\kxDjQAF.exe
  C:\Windows\System\kxDjQAF.exe
  2⤵
  PID:9580
- C:\Windows\System\DFVgNPQ.exe
  C:\Windows\System\DFVgNPQ.exe
  2⤵
  PID:9608
- C:\Windows\System\kEfTgnr.exe
  C:\Windows\System\kEfTgnr.exe
  2⤵
  PID:9636
- C:\Windows\System\JgTwoNR.exe
  C:\Windows\System\JgTwoNR.exe
  2⤵
  PID:9664
- C:\Windows\System\sNHyRJL.exe
  C:\Windows\System\sNHyRJL.exe
  2⤵
  PID:9692
- C:\Windows\System\lKHXLXE.exe
  C:\Windows\System\lKHXLXE.exe
  2⤵
  PID:9720
- C:\Windows\System\sDDSGUD.exe
  C:\Windows\System\sDDSGUD.exe
  2⤵
  PID:9748
- C:\Windows\System\VFEqqnc.exe
  C:\Windows\System\VFEqqnc.exe
  2⤵
  PID:9776
- C:\Windows\System\fyVzjXA.exe
  C:\Windows\System\fyVzjXA.exe
  2⤵
  PID:9804
- C:\Windows\System\bbiLGMC.exe
  C:\Windows\System\bbiLGMC.exe
  2⤵
  PID:9832
- C:\Windows\System\WnMmzJi.exe
  C:\Windows\System\WnMmzJi.exe
  2⤵
  PID:9860
- C:\Windows\System\NiosFSF.exe
  C:\Windows\System\NiosFSF.exe
  2⤵
  PID:9892
- C:\Windows\System\QhAgGmW.exe
  C:\Windows\System\QhAgGmW.exe
  2⤵
  PID:9920
- C:\Windows\System\OZmIJpr.exe
  C:\Windows\System\OZmIJpr.exe
  2⤵
  PID:9944
- C:\Windows\System\CVjodon.exe
  C:\Windows\System\CVjodon.exe
  2⤵
  PID:9972
- C:\Windows\System\VJjNOCD.exe
  C:\Windows\System\VJjNOCD.exe
  2⤵
  PID:10000
- C:\Windows\System\CcfHzoG.exe
  C:\Windows\System\CcfHzoG.exe
  2⤵
  PID:10028
- C:\Windows\System\gjdQqQJ.exe
  C:\Windows\System\gjdQqQJ.exe
  2⤵
  PID:10056
- C:\Windows\System\aXMrzzP.exe
  C:\Windows\System\aXMrzzP.exe
  2⤵
  PID:10084
- C:\Windows\System\VsaSWVZ.exe
  C:\Windows\System\VsaSWVZ.exe
  2⤵
  PID:10116
- C:\Windows\System\eUaylwh.exe
  C:\Windows\System\eUaylwh.exe
  2⤵
  PID:10140
- C:\Windows\System\YxNjgMi.exe
  C:\Windows\System\YxNjgMi.exe
  2⤵
  PID:10168
- C:\Windows\System\YHAwUiE.exe
  C:\Windows\System\YHAwUiE.exe
  2⤵
  PID:10196
- C:\Windows\System\eBzezEv.exe
  C:\Windows\System\eBzezEv.exe
  2⤵
  PID:10224
- C:\Windows\System\jDVlwqe.exe
  C:\Windows\System\jDVlwqe.exe
  2⤵
  PID:9140
- C:\Windows\System\jpDbZiW.exe
  C:\Windows\System\jpDbZiW.exe
  2⤵
  PID:1120
- C:\Windows\System\vpOZHJk.exe
  C:\Windows\System\vpOZHJk.exe
  2⤵
  PID:9232
- C:\Windows\System\SDtBCHz.exe
  C:\Windows\System\SDtBCHz.exe
  2⤵
  PID:9292
- C:\Windows\System\UdZETXn.exe
  C:\Windows\System\UdZETXn.exe
  2⤵
  PID:9352
- C:\Windows\System\vIJGNhw.exe
  C:\Windows\System\vIJGNhw.exe
  2⤵
  PID:9428
- C:\Windows\System\xXexamJ.exe
  C:\Windows\System\xXexamJ.exe
  2⤵
  PID:9488
- C:\Windows\System\BZqcSZk.exe
  C:\Windows\System\BZqcSZk.exe
  2⤵
  PID:9540
- C:\Windows\System\AVFZQLx.exe
  C:\Windows\System\AVFZQLx.exe
  2⤵
  PID:9624
- C:\Windows\System\wTJYqFA.exe
  C:\Windows\System\wTJYqFA.exe
  2⤵
  PID:9688
- C:\Windows\System\rPnmnAV.exe
  C:\Windows\System\rPnmnAV.exe
  2⤵
  PID:9744
- C:\Windows\System\pGmPMpw.exe
  C:\Windows\System\pGmPMpw.exe
  2⤵
  PID:9820
- C:\Windows\System\VPwlEjC.exe
  C:\Windows\System\VPwlEjC.exe
  2⤵
  PID:9880
- C:\Windows\System\mjHcfou.exe
  C:\Windows\System\mjHcfou.exe
  2⤵
  PID:9960
- C:\Windows\System\TJVpXnV.exe
  C:\Windows\System\TJVpXnV.exe
  2⤵
  PID:10020
- C:\Windows\System\mSMgzOH.exe
  C:\Windows\System\mSMgzOH.exe
  2⤵
  PID:10076
- C:\Windows\System\aiHuxGv.exe
  C:\Windows\System\aiHuxGv.exe
  2⤵
  PID:8596
- C:\Windows\System\gIbYVMi.exe
  C:\Windows\System\gIbYVMi.exe
  2⤵
  PID:10192
- C:\Windows\System\wTLGyNd.exe
  C:\Windows\System\wTLGyNd.exe
  2⤵
  PID:9096
- C:\Windows\System\CYcuSbJ.exe
  C:\Windows\System\CYcuSbJ.exe
  2⤵
  PID:9264
- C:\Windows\System\kfKbyHs.exe
  C:\Windows\System\kfKbyHs.exe
  2⤵
  PID:9400
- C:\Windows\System\nNgGWDJ.exe
  C:\Windows\System\nNgGWDJ.exe
  2⤵
  PID:9520
- C:\Windows\System\PCIzKiI.exe
  C:\Windows\System\PCIzKiI.exe
  2⤵
  PID:9680
- C:\Windows\System\FMIOZRQ.exe
  C:\Windows\System\FMIOZRQ.exe
  2⤵
  PID:9852
- C:\Windows\System\eyfoSqp.exe
  C:\Windows\System\eyfoSqp.exe
  2⤵
  PID:10052
- C:\Windows\System\biSdKvB.exe
  C:\Windows\System\biSdKvB.exe
  2⤵
  PID:8640
- C:\Windows\System\jgXKUqk.exe
  C:\Windows\System\jgXKUqk.exe
  2⤵
  PID:4476
- C:\Windows\System\ohfMLkL.exe
  C:\Windows\System\ohfMLkL.exe
  2⤵
  PID:408
- C:\Windows\System\PKJZDBP.exe
  C:\Windows\System\PKJZDBP.exe
  2⤵
  PID:3928
- C:\Windows\System\ldgxqku.exe
  C:\Windows\System\ldgxqku.exe
  2⤵
  PID:8652
- C:\Windows\System\FoBtGEI.exe
  C:\Windows\System\FoBtGEI.exe
  2⤵
  PID:3172
- C:\Windows\System\tNAkHup.exe
  C:\Windows\System\tNAkHup.exe
  2⤵
  PID:3920
- C:\Windows\System\LTBkILR.exe
  C:\Windows\System\LTBkILR.exe
  2⤵
  PID:9660
- C:\Windows\System\BsERzuW.exe
  C:\Windows\System\BsERzuW.exe
  2⤵
  PID:8676
- C:\Windows\System\mOtywqa.exe
  C:\Windows\System\mOtywqa.exe
  2⤵
  PID:8608
- C:\Windows\System\ZMdCtnD.exe
  C:\Windows\System\ZMdCtnD.exe
  2⤵
  PID:8628
- C:\Windows\System\cDHAwHA.exe
  C:\Windows\System\cDHAwHA.exe
  2⤵
  PID:9932
- C:\Windows\System\hTLUlmV.exe
  C:\Windows\System\hTLUlmV.exe
  2⤵
  PID:8804
- C:\Windows\System\KjkWJvi.exe
  C:\Windows\System\KjkWJvi.exe
  2⤵
  PID:10256
- C:\Windows\System\jsHIKyB.exe
  C:\Windows\System\jsHIKyB.exe
  2⤵
  PID:10272
- C:\Windows\System\DWWFBdZ.exe
  C:\Windows\System\DWWFBdZ.exe
  2⤵
  PID:10288
- C:\Windows\System\nuytwoU.exe
  C:\Windows\System\nuytwoU.exe
  2⤵
  PID:10304
- C:\Windows\System\QSNAGJs.exe
  C:\Windows\System\QSNAGJs.exe
  2⤵
  PID:10320
- C:\Windows\System\HrclGFN.exe
  C:\Windows\System\HrclGFN.exe
  2⤵
  PID:10336
- C:\Windows\System\TWjyEtK.exe
  C:\Windows\System\TWjyEtK.exe
  2⤵
  PID:10352
- C:\Windows\System\zpfeKjP.exe
  C:\Windows\System\zpfeKjP.exe
  2⤵
  PID:10368
- C:\Windows\System\HEZQQQq.exe
  C:\Windows\System\HEZQQQq.exe
  2⤵
  PID:10384
- C:\Windows\System\wmtUGUR.exe
  C:\Windows\System\wmtUGUR.exe
  2⤵
  PID:10400
- C:\Windows\System\QIdscpU.exe
  C:\Windows\System\QIdscpU.exe
  2⤵
  PID:10416
- C:\Windows\System\dsTTvtF.exe
  C:\Windows\System\dsTTvtF.exe
  2⤵
  PID:10432
- C:\Windows\System\YnMtUxl.exe
  C:\Windows\System\YnMtUxl.exe
  2⤵
  PID:10448
- C:\Windows\System\POHvwvL.exe
  C:\Windows\System\POHvwvL.exe
  2⤵
  PID:10464
- C:\Windows\System\fruJMUa.exe
  C:\Windows\System\fruJMUa.exe
  2⤵
  PID:10480
- C:\Windows\System\medUpzp.exe
  C:\Windows\System\medUpzp.exe
  2⤵
  PID:10496
- C:\Windows\System\fvVtyFb.exe
  C:\Windows\System\fvVtyFb.exe
  2⤵
  PID:10512
- C:\Windows\System\eOmmBnx.exe
  C:\Windows\System\eOmmBnx.exe
  2⤵
  PID:10528
- C:\Windows\System\nUPgecs.exe
  C:\Windows\System\nUPgecs.exe
  2⤵
  PID:10548
- C:\Windows\System\xUPhYlE.exe
  C:\Windows\System\xUPhYlE.exe
  2⤵
  PID:10564
- C:\Windows\System\AQPrURQ.exe
  C:\Windows\System\AQPrURQ.exe
  2⤵
  PID:10580
- C:\Windows\System\cKrKftl.exe
  C:\Windows\System\cKrKftl.exe
  2⤵
  PID:10596
- C:\Windows\System\EZxxOwu.exe
  C:\Windows\System\EZxxOwu.exe
  2⤵
  PID:10612
- C:\Windows\System\nIAekNK.exe
  C:\Windows\System\nIAekNK.exe
  2⤵
  PID:10628
- C:\Windows\System\yYNFlyy.exe
  C:\Windows\System\yYNFlyy.exe
  2⤵
  PID:10652
- C:\Windows\System\KNbiENY.exe
  C:\Windows\System\KNbiENY.exe
  2⤵
  PID:10680
- C:\Windows\System\INqNQJJ.exe
  C:\Windows\System\INqNQJJ.exe
  2⤵
  PID:10700
- C:\Windows\System\khHFEfy.exe
  C:\Windows\System\khHFEfy.exe
  2⤵
  PID:10744
- C:\Windows\System\lHDZPEO.exe
  C:\Windows\System\lHDZPEO.exe
  2⤵
  PID:10808
- C:\Windows\System\FnIYBKZ.exe
  C:\Windows\System\FnIYBKZ.exe
  2⤵
  PID:10856
- C:\Windows\System\YgilXGZ.exe
  C:\Windows\System\YgilXGZ.exe
  2⤵
  PID:10872
- C:\Windows\System\BcSwtPm.exe
  C:\Windows\System\BcSwtPm.exe
  2⤵
  PID:11004
- C:\Windows\System\xMzIdDW.exe
  C:\Windows\System\xMzIdDW.exe
  2⤵
  PID:11216
- C:\Windows\System\wpAczff.exe
  C:\Windows\System\wpAczff.exe
  2⤵
  PID:11236
- C:\Windows\System\XCKprlL.exe
  C:\Windows\System\XCKprlL.exe
  2⤵
  PID:9600
- C:\Windows\System\TWRXERX.exe
  C:\Windows\System\TWRXERX.exe
  2⤵
  PID:9348
- C:\Windows\System\sqCGmst.exe
  C:\Windows\System\sqCGmst.exe
  2⤵
  PID:9484
- C:\Windows\System\pCdwZkF.exe
  C:\Windows\System\pCdwZkF.exe
  2⤵
  PID:8808
- C:\Windows\System\LHcOsmH.exe
  C:\Windows\System\LHcOsmH.exe
  2⤵
  PID:10248
- C:\Windows\System\OBuxzwi.exe
  C:\Windows\System\OBuxzwi.exe
  2⤵
  PID:10280
- C:\Windows\System\YPxLQWE.exe
  C:\Windows\System\YPxLQWE.exe
  2⤵
  PID:10316
- C:\Windows\System\KkzZBVG.exe
  C:\Windows\System\KkzZBVG.exe
  2⤵
  PID:10492
- C:\Windows\System\FymzNDX.exe
  C:\Windows\System\FymzNDX.exe
  2⤵
  PID:10544
- C:\Windows\System\KNMFIzH.exe
  C:\Windows\System\KNMFIzH.exe
  2⤵
  PID:10576
- C:\Windows\System\VSWySZA.exe
  C:\Windows\System\VSWySZA.exe
  2⤵
  PID:10608
- C:\Windows\System\kfzHWMA.exe
  C:\Windows\System\kfzHWMA.exe
  2⤵
  PID:10668
- C:\Windows\System\RKlXSty.exe
  C:\Windows\System\RKlXSty.exe
  2⤵
  PID:10800
- C:\Windows\System\oaVGFPq.exe
  C:\Windows\System\oaVGFPq.exe
  2⤵
  PID:10832
- C:\Windows\System\wYuuwtw.exe
  C:\Windows\System\wYuuwtw.exe
  2⤵
  PID:10864
- C:\Windows\System\JLGwVqe.exe
  C:\Windows\System\JLGwVqe.exe
  2⤵
  PID:11140
- C:\Windows\System\AireGjp.exe
  C:\Windows\System\AireGjp.exe
  2⤵
  PID:11176
- C:\Windows\System\aRimzfo.exe
  C:\Windows\System\aRimzfo.exe
  2⤵
  PID:10984
- C:\Windows\System\NjYdLWI.exe
  C:\Windows\System\NjYdLWI.exe
  2⤵
  PID:11208
- C:\Windows\System\VpfcOne.exe
  C:\Windows\System\VpfcOne.exe
  2⤵
  PID:10736
- C:\Windows\System\EqACzeg.exe
  C:\Windows\System\EqACzeg.exe
  2⤵
  PID:11256
- C:\Windows\System\rHWpKyq.exe
  C:\Windows\System\rHWpKyq.exe
  2⤵
  PID:10424
- C:\Windows\System\erVflEm.exe
  C:\Windows\System\erVflEm.exe
  2⤵
  PID:3096
- C:\Windows\System\GiBgdBM.exe
  C:\Windows\System\GiBgdBM.exe
  2⤵
  PID:3748
- C:\Windows\System\yPcFDRc.exe
  C:\Windows\System\yPcFDRc.exe
  2⤵
  PID:9792
- C:\Windows\System\icBJnko.exe
  C:\Windows\System\icBJnko.exe
  2⤵
  PID:10268
- C:\Windows\System\YDlQwUh.exe
  C:\Windows\System\YDlQwUh.exe
  2⤵
  PID:10460
- C:\Windows\System\AoeXRCn.exe
  C:\Windows\System\AoeXRCn.exe
  2⤵
  PID:10636
- C:\Windows\System\ETONhsJ.exe
  C:\Windows\System\ETONhsJ.exe
  2⤵
  PID:10824
- C:\Windows\System\pniGgeS.exe
  C:\Windows\System\pniGgeS.exe
  2⤵
  PID:10396
- C:\Windows\System\fzVnhxE.exe
  C:\Windows\System\fzVnhxE.exe
  2⤵
  PID:8568
- C:\Windows\System\FopxKfo.exe
  C:\Windows\System\FopxKfo.exe
  2⤵
  PID:8832
- C:\Windows\System\NrbLpnp.exe
  C:\Windows\System\NrbLpnp.exe
  2⤵
  PID:5032
- C:\Windows\System\gftARwb.exe
  C:\Windows\System\gftARwb.exe
  2⤵
  PID:10660
- C:\Windows\System\mCmLDvj.exe
  C:\Windows\System\mCmLDvj.exe
  2⤵
  PID:11268
- C:\Windows\System\OZFGKOB.exe
  C:\Windows\System\OZFGKOB.exe
  2⤵
  PID:11300
- C:\Windows\System\ogTZnwz.exe
  C:\Windows\System\ogTZnwz.exe
  2⤵
  PID:11332
- C:\Windows\System\umKUpzz.exe
  C:\Windows\System\umKUpzz.exe
  2⤵
  PID:11348
- C:\Windows\System\WALmkhZ.exe
  C:\Windows\System\WALmkhZ.exe
  2⤵
  PID:11404
- C:\Windows\System\FIOQzFa.exe
  C:\Windows\System\FIOQzFa.exe
  2⤵
  PID:11444
- C:\Windows\System\VCChLxn.exe
  C:\Windows\System\VCChLxn.exe
  2⤵
  PID:11476
- C:\Windows\System\GdRPnRv.exe
  C:\Windows\System\GdRPnRv.exe
  2⤵
  PID:11496
- C:\Windows\System\EpTuYlp.exe
  C:\Windows\System\EpTuYlp.exe
  2⤵
  PID:11512
- C:\Windows\System\hVGzaSA.exe
  C:\Windows\System\hVGzaSA.exe
  2⤵
  PID:11544
- C:\Windows\System\xCXgRAs.exe
  C:\Windows\System\xCXgRAs.exe
  2⤵
  PID:11580
- C:\Windows\System\BoAThVk.exe
  C:\Windows\System\BoAThVk.exe
  2⤵
  PID:11600
- C:\Windows\System\VwUCxAF.exe
  C:\Windows\System\VwUCxAF.exe
  2⤵
  PID:11616
- C:\Windows\System\BEtNkAP.exe
  C:\Windows\System\BEtNkAP.exe
  2⤵
  PID:11632
- C:\Windows\System\loTIoeh.exe
  C:\Windows\System\loTIoeh.exe
  2⤵
  PID:11652
- C:\Windows\System\eQWuAZe.exe
  C:\Windows\System\eQWuAZe.exe
  2⤵
  PID:11668
- C:\Windows\System\DXJVuij.exe
  C:\Windows\System\DXJVuij.exe
  2⤵
  PID:11684
- C:\Windows\System\PlVCBDz.exe
  C:\Windows\System\PlVCBDz.exe
  2⤵
  PID:11700
- C:\Windows\System\PsrUKJM.exe
  C:\Windows\System\PsrUKJM.exe
  2⤵
  PID:11720
- C:\Windows\System\hpVvMyH.exe
  C:\Windows\System\hpVvMyH.exe
  2⤵
  PID:11736
- C:\Windows\System\usMfzkc.exe
  C:\Windows\System\usMfzkc.exe
  2⤵
  PID:11752
- C:\Windows\System\lzGFkCG.exe
  C:\Windows\System\lzGFkCG.exe
  2⤵
  PID:11776
- C:\Windows\System\RbbxdaH.exe
  C:\Windows\System\RbbxdaH.exe
  2⤵
  PID:11792
- C:\Windows\System\JtYfuGC.exe
  C:\Windows\System\JtYfuGC.exe
  2⤵
  PID:11808
- C:\Windows\System\CnWzCXV.exe
  C:\Windows\System\CnWzCXV.exe
  2⤵
  PID:11824
- C:\Windows\System\VrhkVVx.exe
  C:\Windows\System\VrhkVVx.exe
  2⤵
  PID:11840
- C:\Windows\System\FtfFKVZ.exe
  C:\Windows\System\FtfFKVZ.exe
  2⤵
  PID:11856
- C:\Windows\System\RpPSRNm.exe
  C:\Windows\System\RpPSRNm.exe
  2⤵
  PID:11872
- C:\Windows\System\SkRsKhX.exe
  C:\Windows\System\SkRsKhX.exe
  2⤵
  PID:11892
- C:\Windows\System\WshbHVL.exe
  C:\Windows\System\WshbHVL.exe
  2⤵
  PID:11908
- C:\Windows\System\iWjmcgQ.exe
  C:\Windows\System\iWjmcgQ.exe
  2⤵
  PID:11932
- C:\Windows\System\eBelFzC.exe
  C:\Windows\System\eBelFzC.exe
  2⤵
  PID:11948
- C:\Windows\System\DKMhtbG.exe
  C:\Windows\System\DKMhtbG.exe
  2⤵
  PID:11964
- C:\Windows\System\yDNmhcU.exe
  C:\Windows\System\yDNmhcU.exe
  2⤵
  PID:11980
- C:\Windows\System\zpLObqc.exe
  C:\Windows\System\zpLObqc.exe
  2⤵
  PID:11996
- C:\Windows\System\FgFEOgn.exe
  C:\Windows\System\FgFEOgn.exe
  2⤵
  PID:12012
- C:\Windows\System\BlqeDKK.exe
  C:\Windows\System\BlqeDKK.exe
  2⤵
  PID:12028
- C:\Windows\System\BrmMMsu.exe
  C:\Windows\System\BrmMMsu.exe
  2⤵
  PID:12044
- C:\Windows\System\EOuVzCR.exe
  C:\Windows\System\EOuVzCR.exe
  2⤵
  PID:12060
- C:\Windows\System\TiLQxDW.exe
  C:\Windows\System\TiLQxDW.exe
  2⤵
  PID:12076
- C:\Windows\System\wOhsrpZ.exe
  C:\Windows\System\wOhsrpZ.exe
  2⤵
  PID:12092
- C:\Windows\System\XKLZUoH.exe
  C:\Windows\System\XKLZUoH.exe
  2⤵
  PID:12108
- C:\Windows\System\AbHClAK.exe
  C:\Windows\System\AbHClAK.exe
  2⤵
  PID:12124
- C:\Windows\System\AFJojDr.exe
  C:\Windows\System\AFJojDr.exe
  2⤵
  PID:12140
- C:\Windows\System\VFKZRQU.exe
  C:\Windows\System\VFKZRQU.exe
  2⤵
  PID:12156
- C:\Windows\System\DkkNIWd.exe
  C:\Windows\System\DkkNIWd.exe
  2⤵
  PID:12172
- C:\Windows\System\ayHaMGg.exe
  C:\Windows\System\ayHaMGg.exe
  2⤵
  PID:12188
- C:\Windows\System\dLIMquy.exe
  C:\Windows\System\dLIMquy.exe
  2⤵
  PID:12204
- C:\Windows\System\uaQmTaZ.exe
  C:\Windows\System\uaQmTaZ.exe
  2⤵
  PID:12224
- C:\Windows\System\VBrFkIg.exe
  C:\Windows\System\VBrFkIg.exe
  2⤵
  PID:12244
- C:\Windows\System\isuOzqr.exe
  C:\Windows\System\isuOzqr.exe
  2⤵
  PID:12260
- C:\Windows\System\sXfYnKc.exe
  C:\Windows\System\sXfYnKc.exe
  2⤵
  PID:12276
- C:\Windows\System\cpCpbQj.exe
  C:\Windows\System\cpCpbQj.exe
  2⤵
  PID:11192
- C:\Windows\System\CZFasgl.exe
  C:\Windows\System\CZFasgl.exe
  2⤵
  PID:8668
- C:\Windows\System\NbYWfom.exe
  C:\Windows\System\NbYWfom.exe
  2⤵
  PID:11000
- C:\Windows\System\XDbqRXN.exe
  C:\Windows\System\XDbqRXN.exe
  2⤵
  PID:11184
- C:\Windows\System\fNIkjHM.exe
  C:\Windows\System\fNIkjHM.exe
  2⤵
  PID:11316
- C:\Windows\System\EgLxLPZ.exe
  C:\Windows\System\EgLxLPZ.exe
  2⤵
  PID:11344
- C:\Windows\System\XFgoTkU.exe
  C:\Windows\System\XFgoTkU.exe
  2⤵
  PID:11384
- C:\Windows\System\ihAjuek.exe
  C:\Windows\System\ihAjuek.exe
  2⤵
  PID:11424
- C:\Windows\System\jIABbUi.exe
  C:\Windows\System\jIABbUi.exe
  2⤵
  PID:11468
- C:\Windows\System\axFeiBg.exe
  C:\Windows\System\axFeiBg.exe
  2⤵
  PID:11504
- C:\Windows\System\ZgRzfYQ.exe
  C:\Windows\System\ZgRzfYQ.exe
  2⤵
  PID:11568
- C:\Windows\System\svNvAEd.exe
  C:\Windows\System\svNvAEd.exe
  2⤵
  PID:11592
- C:\Windows\System\CjapIYG.exe
  C:\Windows\System\CjapIYG.exe
  2⤵
  PID:11628
- C:\Windows\System\JzIsRmM.exe
  C:\Windows\System\JzIsRmM.exe
  2⤵
  PID:11716
- C:\Windows\System\TpJWnDJ.exe
  C:\Windows\System\TpJWnDJ.exe
  2⤵
  PID:11800
- C:\Windows\System\PAgAZjg.exe
  C:\Windows\System\PAgAZjg.exe
  2⤵
  PID:11832
- C:\Windows\System\ZsiFuNT.exe
  C:\Windows\System\ZsiFuNT.exe
  2⤵
  PID:11864
- C:\Windows\System\lxqGUex.exe
  C:\Windows\System\lxqGUex.exe
  2⤵
  PID:11648
- C:\Windows\System\SYBDUPG.exe
  C:\Windows\System\SYBDUPG.exe
  2⤵
  PID:11956
- C:\Windows\System\IaVUNus.exe
  C:\Windows\System\IaVUNus.exe
  2⤵
  PID:11988
- C:\Windows\System\WohZZFB.exe
  C:\Windows\System\WohZZFB.exe
  2⤵
  PID:12300
- C:\Windows\System\sPnTpOw.exe
  C:\Windows\System\sPnTpOw.exe
  2⤵
  PID:12316
- C:\Windows\System\hbKSzJO.exe
  C:\Windows\System\hbKSzJO.exe
  2⤵
  PID:12332
- C:\Windows\System\CbmoaeE.exe
  C:\Windows\System\CbmoaeE.exe
  2⤵
  PID:12348
- C:\Windows\System\aGwkThm.exe
  C:\Windows\System\aGwkThm.exe
  2⤵
  PID:12364
- C:\Windows\System\ewmvQYn.exe
  C:\Windows\System\ewmvQYn.exe
  2⤵
  PID:12380
- C:\Windows\System\PswiHaC.exe
  C:\Windows\System\PswiHaC.exe
  2⤵
  PID:12396
- C:\Windows\System\yZmNBav.exe
  C:\Windows\System\yZmNBav.exe
  2⤵
  PID:12412
- C:\Windows\System\twHKHIL.exe
  C:\Windows\System\twHKHIL.exe
  2⤵
  PID:12428
- C:\Windows\System\lGgnWjZ.exe
  C:\Windows\System\lGgnWjZ.exe
  2⤵
  PID:12444
- C:\Windows\System\tFhtndI.exe
  C:\Windows\System\tFhtndI.exe
  2⤵
  PID:12460
- C:\Windows\System\VkSTdvq.exe
  C:\Windows\System\VkSTdvq.exe
  2⤵
  PID:12476
- C:\Windows\System\NsftcgA.exe
  C:\Windows\System\NsftcgA.exe
  2⤵
  PID:12492
- C:\Windows\System\ybTqZWd.exe
  C:\Windows\System\ybTqZWd.exe
  2⤵
  PID:12508
- C:\Windows\System\mMuqRcs.exe
  C:\Windows\System\mMuqRcs.exe
  2⤵
  PID:12532
- C:\Windows\System\aAnqZPp.exe
  C:\Windows\System\aAnqZPp.exe
  2⤵
  PID:12548
- C:\Windows\System\lNptOpu.exe
  C:\Windows\System\lNptOpu.exe
  2⤵
  PID:12564
- C:\Windows\System\QXzMQDZ.exe
  C:\Windows\System\QXzMQDZ.exe
  2⤵
  PID:12580
- C:\Windows\System\lkSgKTa.exe
  C:\Windows\System\lkSgKTa.exe
  2⤵
  PID:12596
- C:\Windows\System\IgyGaim.exe
  C:\Windows\System\IgyGaim.exe
  2⤵
  PID:12612
- C:\Windows\System\yhcAtRO.exe
  C:\Windows\System\yhcAtRO.exe
  2⤵
  PID:12628
- C:\Windows\System\FklFjek.exe
  C:\Windows\System\FklFjek.exe
  2⤵
  PID:12644
- C:\Windows\System\dTOoytg.exe
  C:\Windows\System\dTOoytg.exe
  2⤵
  PID:12660
- C:\Windows\System\ovgdXPg.exe
  C:\Windows\System\ovgdXPg.exe
  2⤵
  PID:12676
- C:\Windows\System\gUyGBuc.exe
  C:\Windows\System\gUyGBuc.exe
  2⤵
  PID:12692
- C:\Windows\System\JioLePS.exe
  C:\Windows\System\JioLePS.exe
  2⤵
  PID:12392
- C:\Windows\System\IJlNcpJ.exe
  C:\Windows\System\IJlNcpJ.exe
  2⤵
  PID:12544
- C:\Windows\System\lopinxU.exe
  C:\Windows\System\lopinxU.exe
  2⤵
  PID:12672
- C:\Windows\System\zgIbUBi.exe
  C:\Windows\System\zgIbUBi.exe
  2⤵
  PID:11804
- C:\Windows\System\EsHbbyc.exe
  C:\Windows\System\EsHbbyc.exe
  2⤵
  PID:12500
- C:\Windows\System\MCTNuAC.exe
  C:\Windows\System\MCTNuAC.exe
  2⤵
  PID:11540
- C:\Windows\System\UwzsoOM.exe
  C:\Windows\System\UwzsoOM.exe
  2⤵
  PID:11532
- C:\Windows\System\nZqBYYi.exe
  C:\Windows\System\nZqBYYi.exe
  2⤵
  PID:11396
- C:\Windows\System\dFRixzi.exe
  C:\Windows\System\dFRixzi.exe
  2⤵
  PID:13148
- C:\Windows\System\MYVLBQW.exe
  C:\Windows\System\MYVLBQW.exe
  2⤵
  PID:12052
- C:\Windows\System\ERGcsgx.exe
  C:\Windows\System\ERGcsgx.exe
  2⤵
  PID:11788
- C:\Windows\System\pgZetEK.exe
  C:\Windows\System\pgZetEK.exe
  2⤵
  PID:12440
- C:\Windows\System\ZseLQXN.exe
  C:\Windows\System\ZseLQXN.exe
  2⤵
  PID:11492
- C:\Windows\System\ahgvsjo.exe
  C:\Windows\System\ahgvsjo.exe
  2⤵
  PID:12864
- C:\Windows\System\KfJcOyX.exe
  C:\Windows\System\KfJcOyX.exe
  2⤵
  PID:11732
- C:\Windows\System\PTALWXE.exe
  C:\Windows\System\PTALWXE.exe
  2⤵
  PID:11292
- C:\Windows\System\AlPmoIR.exe
  C:\Windows\System\AlPmoIR.exe
  2⤵
  PID:11692
- C:\Windows\System\YRFwfoI.exe
  C:\Windows\System\YRFwfoI.exe
  2⤵
  PID:13060
- C:\Windows\System\gNVKrso.exe
  C:\Windows\System\gNVKrso.exe
  2⤵
  PID:12488
- C:\Windows\System\oQrDQNx.exe
  C:\Windows\System\oQrDQNx.exe
  2⤵
  PID:13252
- C:\Windows\System\hKaUMRO.exe
  C:\Windows\System\hKaUMRO.exe
  2⤵
  PID:13292
- C:\Windows\System\POvUkZN.exe
  C:\Windows\System\POvUkZN.exe
  2⤵
  PID:1820
- C:\Windows\System\eqQBGzE.exe
  C:\Windows\System\eqQBGzE.exe
  2⤵
  PID:12576
- C:\Windows\System\VLBObnO.exe
  C:\Windows\System\VLBObnO.exe
  2⤵
  PID:12572
- C:\Windows\System\ZPwuQWR.exe
  C:\Windows\System\ZPwuQWR.exe
  2⤵
  PID:11768
- C:\Windows\System\AzdgPCZ.exe
  C:\Windows\System\AzdgPCZ.exe
  2⤵
  PID:12620
- C:\Windows\System\DEqhkCg.exe
  C:\Windows\System\DEqhkCg.exe
  2⤵
  PID:12860
- C:\Windows\System\kyYrnQm.exe
  C:\Windows\System\kyYrnQm.exe
  2⤵
  PID:12908
- C:\Windows\System\jGODWgU.exe
  C:\Windows\System\jGODWgU.exe
  2⤵
  PID:1564
- C:\Windows\System\aOFYgTu.exe
  C:\Windows\System\aOFYgTu.exe
  2⤵
  PID:12424
- C:\Windows\System\CQFRmdG.exe
  C:\Windows\System\CQFRmdG.exe
  2⤵
  PID:12992
- C:\Windows\System\ExUUtAL.exe
  C:\Windows\System\ExUUtAL.exe
  2⤵
  PID:13036
- C:\Windows\System\tLOHhsB.exe
  C:\Windows\System\tLOHhsB.exe
  2⤵
  PID:12376
- C:\Windows\System\zDktozv.exe
  C:\Windows\System\zDktozv.exe
  2⤵
  PID:4204
- C:\Windows\System\NnynsXF.exe
  C:\Windows\System\NnynsXF.exe
  2⤵
  PID:11624
- C:\Windows\System\lHifoyt.exe
  C:\Windows\System\lHifoyt.exe
  2⤵
  PID:5020
- C:\Windows\System\yRxDOHp.exe
  C:\Windows\System\yRxDOHp.exe
  2⤵
  PID:13080
- C:\Windows\System\aBtHKau.exe
  C:\Windows\System\aBtHKau.exe
  2⤵
  PID:12404
- C:\Windows\System\fPuGgLc.exe
  C:\Windows\System\fPuGgLc.exe
  2⤵
  PID:10408
- C:\Windows\System\cAYYbzJ.exe
  C:\Windows\System\cAYYbzJ.exe
  2⤵
  PID:12948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_p2mae2oi.14u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p2mae2oi.14u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

BKaffjk.exe

Path C:\Windows\System\BKaffjk.exe
Size 2.2MB
SHA256 0fd5a4165e3670bdd208a848380f1ba0a66dd737affe42024d558106b72ceaff
MD5 e877f82a59892d414986609ece7a341f
SHA1 0987db9924170fd03cad64351f1a2f01932ccbe0
SHA512 de0ede96bdf693b1d245e61b1217ab30b0e19520ec8d3f18c52a55dc9cea15f3b521dbdc07642ea670aa972e25fd8ec971068fffd453b9d0bda0f2e131be5877
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZt:NAB3
TLSH
T158B5332A9D2A5D7EDBEC557C2C3D1F4E4791CE414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CuXzTlg.exe

Path C:\Windows\System\CuXzTlg.exe
Size 2.2MB
SHA256 eb2e7f37f85792548a958adab0cec8a7270086507117547abb2a93302e5c0fde
MD5 0975ef9342568432ef1528a53ac3eb55
SHA1 75a4cfa1e24f314909cbea9a984bb05d09a927bd
SHA512 f91d5fbd468029426718eaaeda7ff9c90a0fc45cfff0f275c5ad27d9bef9a59812c7b102e79fde0317ffb34d37360999c5bee51c92fe5f66b6652edabd29f539
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZl:NABX
TLSH
T19AB5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414000DAF1A2D3249A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXYtPGf.exe

Path C:\Windows\System\DXYtPGf.exe
Size 2.2MB
SHA256 231cd2de761f31d47ef33f419036c9bb5d7ba0d79f5055b9c1ab68c7d7867c47
MD5 7406bd7a10d64e1bb04a5ed29f82e412
SHA1 7072165a5eb06951a15f47590bec1e6b2c70bef9
SHA512 470367e30a99fac68dc650ae1a9c8d7c5f9f63e36c82c7cbb998ec140dc4c9eca79612bd0ed4ebc119bfdb26ee83926dfa32dcfae33769cd0f45b9d593de8a01
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZS:NABY
TLSH
T167B5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414000DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GLuAZXA.exe

Path C:\Windows\System\GLuAZXA.exe
Size 2.2MB
SHA256 15e8129e0db6f1e27dae7b185803be99085855f25b8a18da26c9269e65e713f9
MD5 69779198fac5ffbf2c22dbd700d601f4
SHA1 044e306291f939bb5f909eb32eddfa6cffefb43c
SHA512 593d5850a97b6deda4810339d6d9c43afaaea16562a5a4374b50a4e5df89f1ce57582fd7bece2e0e695fba9007fd14420c48350a0b0a4448e8cd578aebae71a9
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ4:NABG
TLSH
T13AB5332A9D2A9D7ED7EC557C2C3D1F4E4790CE414001DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GUiNhdC.exe

Path C:\Windows\System\GUiNhdC.exe
Size 2.2MB
SHA256 0098efd0deba01eb137b2ef5fda98a61e97b895be5bf4e26bb48efbe4861aaba
MD5 a18e326271d3c4cef656865e095f1491
SHA1 b654b43fd3196450be712e80e05685b4cd7d4340
SHA512 b5e15cdbbd73f30512b2ae184b5822fa6be618a5de2c740cddc26bc568f092c2807601976d0f966225878848a9cbffa77d0bea1c9c1dabe21cd022dc71fdb8e4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ/:NABB
TLSH
T151B5332A9D2A9D7ED7EC557C2C3D1F4F4790CE414001DAF1A2D3209A6B4CFAD1A2F46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HOxZVbJ.exe

Path C:\Windows\System\HOxZVbJ.exe
Size 2.2MB
SHA256 c7ddcbadf01b9cd87f9ffa3c007d1971c619ebc4defaf9cfca50bbd2498ca707
MD5 8fc35fa29113d32399ba0a8fcb2bbe37
SHA1 385c57291ce6463581e20a8d93889852a45c77cb
SHA512 77f403d8b5d5d8ea6b117738e14c9a9b253f652ec74a2aefb5015221e72dcb7ccfa4bc2fec790f6df8ceff49048060b53ead9f445702e3b2b4f79e5f10ac52c3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZC:NABU
TLSH
T10CB5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414000DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IauKGgj.exe

Path C:\Windows\System\IauKGgj.exe
Size 2.2MB
SHA256 6d96b69fa33a70041a66894ce540623d84d5e47d898ac1831fadd943e693eb81
MD5 2d8c84cf50f62e2ec7624080a318d2c5
SHA1 3539698a40109bb3b213e8504a46b4fcae228e18
SHA512 8cbbf9b43082a2f020cb51f5670e5c6a26a93f88d3e4095b2ac64f5b4c283dda9346bb50677ce6d73a2a7dbb54e2941ac3e775e2090579b7e7a8b6f028570117
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZU:NABu
TLSH
T13DB5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KQHgLcn.exe

Path C:\Windows\System\KQHgLcn.exe
Size 2.2MB
SHA256 4b830563cfb1bc3a5d26e8d8dcccadd23a64895ef4a10d4ec15032d5ae86d9b6
MD5 5197ff47f0020a40edeb94a680307701
SHA1 feac0a0f2866e4a02baad181da1acc0f5912476c
SHA512 62e3977061c22f57e51adc2e22b88a0ac7114c4d106c60ba38887f39d1b69f72e31f2766b0255b609980a30ec9094aac0af8b10fd800d0ccca65d77893b50ca7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZK:NABo
TLSH
T1EDB5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NnOXdZc.exe

Path C:\Windows\System\NnOXdZc.exe
Size 2.2MB
SHA256 ecb3f40d458ab95514650137e84ce19cc9ccb9ea809b22fb8d23a86d138d342c
MD5 7795726a950ef45eca78b0d515dedc10
SHA1 d0f335aeb8fb33702b1206fc0ddcb735b36d7c9d
SHA512 e9497bf832dee638594918ccbcb6525b372b944bf5f77fb625f7a262fb7cb38deae89eaac66792dddca591ec75dd0cafa9ce9c82dcd13e1ec4a72487ed6df0c3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZV:NABr
TLSH
T141B5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfjoaWu.exe

Path C:\Windows\System\OfjoaWu.exe
Size 2.2MB
SHA256 83c7ebe01efab785130b8d3b0fd3bce85e73bbdc839dc0550371daf1829b7a15
MD5 b4081e2e39d912cb324c8f295602c834
SHA1 720fd2baf515526020d1908c7fc16ca360795e15
SHA512 69a0cdde4ca8efdc551919d19fae9d940f9d746d3627e5ed6ef47255f8bc970ccbcfb1f5fe9c141d60535f10a342823b408be5943d18011e8b2beec409f8c29d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZy:NABs
TLSH
T146B5332A9D2A9D7ED7E8557C2C3D1F4E4791CF414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PcrIXkZ.exe

Path C:\Windows\System\PcrIXkZ.exe
Size 2.2MB
SHA256 29d9f3276d1d48fd409e65f792d6b8a4d4d908321121c794b80f4301f7a6ec5b
MD5 6d4bc5a69d3af7db3f12b9a139244009
SHA1 ec36e5b9e191e19a4f9b1d34fd04c215faa7a359
SHA512 2fb12e378c678950eebc95fa830264474c81fda4bc4d62b6cec9e0ed16243ebd10a0c4896962e43a1840cdc8443992901b968762a378163256bd9820756a846a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZvN:NABD
TLSH
T120B5332A9D2A9D7ED7EC517C2C3D1F4E0791CE414001DAB1A2D3209A6F4CFAD1A6F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RnyCHZd.exe

Path C:\Windows\System\RnyCHZd.exe
Size 2.2MB
SHA256 2295c424f32384c8e57902534ff21c95cd1c5b8eb5599820aa1e23877d52209c
MD5 7c5c8a9c3ac60f0628567ac423b0e662
SHA1 ea7d09f49b3f80c2718137618c501c2326bffca0
SHA512 d94601dd3ec826d8fcd3d7b2a998eab9cbc1810b9c093b8bda6e669de189e87b3a0bb7f5ae2f7b827faac89bc73a3232a265f4ce62d26ad4614120a1175d593b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZj:NABt
TLSH
T177B5332A9D2A5D7ED7EC657C2C3D1F4E4791CE414001DAF1A2D3208A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UWQcyFE.exe

Path C:\Windows\System\UWQcyFE.exe
Size 2.2MB
SHA256 11e5e37a99251f85014447926c1846aeda766ab9be471e12a4f1793d3410aee6
MD5 9caffd64b9e895ffb0437dcadb921cda
SHA1 b88cba831d5f9f73671091b23a46d3537d660218
SHA512 a9e965818eded427b5fe7d9eb3a79f5afb097f527591589099bf53d5d5ef79252a669459c3600acfee86623d46f53b88285d7081bc6e85ada9595a2ad6cae054
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZN:NABX
TLSH
T1AEB5332A9D2A9D7ED7AC517C2C3D1F4E4791CE414001DAF1A2D3249A6F4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UggpkMy.exe

Path C:\Windows\System\UggpkMy.exe
Size 8B
SHA256 7e9bbeeba45dae16f8c444596ee4180d7313e899e46fa6263fde6904f32d92a1
MD5 a8f2921c80c15a3d426e5fdff8a56196
SHA1 4dc21bf95e22427a9dafcd4930e81b62e77d5fda
SHA512 996666f646b1878ee129a778184f9520541ee458797b8bfaefed6e1f152a5436e0ff19d28744463b706ffe3e24e429f5af102aa1e7733dbeeb6210754c828802
MD5 SHA1 SHA512

Submit Download

VXgFGyY.exe

Path C:\Windows\System\VXgFGyY.exe
Size 2.2MB
SHA256 c950676dee23709008e71d598c7c664c8ed5c39e4310577cb9a6c5ec1016cdff
MD5 230c937371faa59449f0910b1d0b8135
SHA1 af9e2707e5b560707d67c38951061bf744bb1451
SHA512 200bd450362fb38495be374b5d810f24c1472c6afece27e5734de54711225a2ec2fe69612aaf9a1e2296beeed7572d62d73596d16296e916d204514963366fd6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ+:NABs
TLSH
T195B5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414001DAF1A2D3248A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arXSsHR.exe

Path C:\Windows\System\arXSsHR.exe
Size 2.2MB
SHA256 f6562586db6838a7198d796a025a3c17d0bf616e3cfc45af4519152baad557d7
MD5 11703f76c9d9bcadf75c24efd32c53d2
SHA1 6acc4b7c238865398ea1e500bdbf4a9bb4f92d7c
SHA512 d517678d2ef96d3350f7e16d654495140fe620063aa2c5f8adcc2f79d116503a7ce7d48b766496b82f8687c8367ea2195e4748a21be09a854b4df8b32db4e73d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZW:NABc
TLSH
T193B5332A9D2A9D7ED7EC557C2C3D1F4E0791CE414001DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dcElcbe.exe

Path C:\Windows\System\dcElcbe.exe
Size 2.2MB
SHA256 d0777ae9096356286cb26eeb673e0921cbef4a5dead82e62c3573c4d6ac065f9
MD5 99327cc4e7b09d92838fd06370e645c4
SHA1 232de174f81f750d15a20aef69cd78f3ef2d8482
SHA512 eca17af21403af1b10be0f8b63bfbac69aa489c307635c160941e096e9852f5d8b227f229a6042ac1b76e548a48479bcf3c9a1b64c5bdabcdf96d4404de81242
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ4:NABS
TLSH
T196B5332A9D2A9D7ED7EC557C2C3D1F4E4790CE414001DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fBFnltZ.exe

Path C:\Windows\System\fBFnltZ.exe
Size 2.2MB
SHA256 dce2da7cd31be4bebc07fc457ea8f9b9b7cae623c2399b2ec05bfcb662a0b19b
MD5 96f7bd3d7e4457252e3ea81082b775be
SHA1 13847221f110ee8c93b3f19565c3340a0fddb853
SHA512 7a10603971ae391e1718feb9f86ee781cd6a73edacbdbbaa16b9fe2c77ee5ee7c171064b090a49448d966d049e7c173e1f5e926b3a980c58180d8fc45c6b15dd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZf:NAB1
TLSH
T1C0B5332A9D2A9D7ED7EC557C2C3D1F4E0790CF414001DAF1A2D3209A6B4CFAD1A6F46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fSFBmaS.exe

Path C:\Windows\System\fSFBmaS.exe
Size 2.2MB
SHA256 edaa98b9d00df3ba99679a8b8a727c71d44136b910373a4d2bbe7214d67c22ba
MD5 eb2d658d9d36c7aaa4740494882804d6
SHA1 ce767c83336f2651fed794a76351ee26bc9729f9
SHA512 da39dc90b0c7fc9ff7f062448ff3bf9f636a2743097dde4d04f7574d290fede667563c16b997d6fd4ba3b7c502bf9344e263775690bc82fba03acff575d23c9b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZJ:NABb
TLSH
T1C8B5332A9D2A9D7ED7EC557C2C3D1F4E0790CE414001DAB1A2D3249A6F4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gJulSUv.exe

Path C:\Windows\System\gJulSUv.exe
Size 2.2MB
SHA256 7ae0c059263fd23d825664a04a4fa4ec264d52e8c799f72c91d12827825a62eb
MD5 38d65f76c368d3081e9bd1b6f70023ff
SHA1 9d68e03813aee88d5b4b365de97212ac8bd9b73e
SHA512 a7e7e385cca1ddda402707b87d3a3b1ffce9aed83344b1e7ce36bcb5677c8fb87445a18a4a61eb104aa1fd13b591559d147d5372177ad91f4fd4ea94f87f6ad6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZM:NABK
TLSH
T151B5332A9D2A9D7ED7EC557C2C3D1F4E0791CE414001DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iMDhrHC.exe

Path C:\Windows\System\iMDhrHC.exe
Size 2.2MB
SHA256 5e4c53da36f7dfd39f0373959ac46166b88e220965e7c821d154d5bd4a628839
MD5 b704c99d7de56316886dff18c6636361
SHA1 148c34846a21871e8ae02963aedc50233b7903e4
SHA512 ebf8d3b7f005ad1d9d6e0ad524eed2a784f20c7bd77b4327c3916955c45d106fccbd548774883e10ec668928d0394f825abd1621521d8af0d2668fd0e0410fcc
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ5:NABL
TLSH
T155B5332A9D2A9D7ED7EC557C2C3D1F4E0791CE414001DAF1A2D3249A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mCWbYmk.exe

Path C:\Windows\System\mCWbYmk.exe
Size 2.2MB
SHA256 5c9059c6fae3a1667aca1a58051b009fba90ca6e00de279112a4558772e7a704
MD5 29cdb3226a0cb72157de669d07a03f98
SHA1 867dc48b218a3d944c1f6c79977cc8c6d3956358
SHA512 0a9692afb76d5c98e2b1834a21b79064374e84a53fcead03cbb118d7ce4264b9a4b056f8be038e2b22925467f9779c845908b111d309848a28cc52dd40aa1053
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZl:NABH
TLSH
T110B5332A9D2A9D7ED7EC557C2C3D1F4E0791CE414001DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpfxbbn.exe

Path C:\Windows\System\mpfxbbn.exe
Size 2.2MB
SHA256 9a625ccf07c59a3314514deeb04ab37f26dc963363e6a4a72bb2b10d37f1fbae
MD5 b9802ea7e286249842b191a592ead6e6
SHA1 dbea7c37e004ede02b5b4caa962593a046269fa8
SHA512 471e98bbd3c50e2bbcf3e307fa7106ccc189199d5e6c70608ab776b81f1a633bf1aa3ce3fd41e25f0fbb197099fd711b3ca793b294c8c5f9cccda13fa07c2b93
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZsd:NABY
TLSH
T135B5332A5D2A5D3ED7EC657C2C3E1F4E4790CE414001DAF1A2D3249A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mvdfQFQ.exe

Path C:\Windows\System\mvdfQFQ.exe
Size 2.2MB
SHA256 63c34b7cf0135959775290c1fec18eb8bc641bac6786336475304fa7a1829c23
MD5 1d9d53cf78adf4a95cb90ed815318656
SHA1 34d0ce3ba4f1d51b558c7ee9d1df17123055bf58
SHA512 fdc7aec6498f62dc4a2a0083a6741d24b82063edc5e2af1fae9f680c5d60bef81da3d3fb2487c6fa9bee9cc58d8c83ee538eac26efd650dfe8b8fd5e3dbdb3b2
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ1:NABn
TLSH
T170B5332A9D2A9D7ED7EC557C2C3D1F4E4790CF414001DAF1A2D3209A6B4CFAD1A2F46A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mxqeOwi.exe

Path C:\Windows\System\mxqeOwi.exe
Size 2.2MB
SHA256 bbdf918c3ccafcfd5aa6e7b13650235b039ae7ea3128b3baddaa476a338be2f4
MD5 84bfda7c504cc1d765d532ca65967492
SHA1 114fb9bda8d6975753c48ff2365a50d5c4ce94a2
SHA512 2e8faa514a625807b30c2d16e100906b9976a3c438f8b915f0a471ee1937481b4262ceb9650a7708bbf8825781c6832a465225e514e42b72b67531f417fdc6e4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZC:NABA
TLSH
T13CB5332A5D2A5D7EDBEC557C2C3E1F4E0790CF414001DAB1A2D3249A6B4CFAD1A6F06A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pBLZzMe.exe

Path C:\Windows\System\pBLZzMe.exe
Size 2.2MB
SHA256 20348d5b82d46fcb991db7f7321d0b47001c246d5f2eac2a04f673e5f8002e6e
MD5 d45c9257ce66841524eea44fc27155d0
SHA1 00daea8af83c76378418364047d9a6ab29a95c8e
SHA512 563821ec7815d2749168a01190fd59bebc25ceac93e49a0c5137fc51a63f3ccf730ba5b137705726d1252a809626b13f3b9aee9f3679cd73d1d2998136feabb3
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZB:NABb
TLSH
T105B5332A5D2A9D7EDBEC557C2C3D1F4E4791CE414000DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qzgWChA.exe

Path C:\Windows\System\qzgWChA.exe
Size 2.2MB
SHA256 e3b01ff0b9549dbf96c160885d0dd73547f40b757ff87695db690c8a9f74512f
MD5 c55887a5e60b6bf688b9f68c1af79e62
SHA1 5f2948ce4d0df5dfacfc9ff18e27f29d3438f292
SHA512 3af123e243fecd6644e47503e11f2ff28f43b4de23a3bb4cbe2076e7e19c69bd0ad0493f3c6b0f34c3d392ba474ba59bc388edce39a6a4d099095466a3de5945
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZu:NABk
TLSH
T136B5332A9D2A9D7ED7E8557C2C3D1F4F4791CE414001DAF1A2D3208A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rDSipPk.exe

Path C:\Windows\System\rDSipPk.exe
Size 2.2MB
SHA256 4a612e81fe9838f0f80178a0dff70aea5810df5f27bf8d321753aae7079cbaae
MD5 91653104856a2634ba041783a4e80c84
SHA1 22f3012561723e7869040174eeae6ca5c1e68a77
SHA512 d352b5c9077c673ebc500542fc96a079d9cd00db05743fd6308a644a1432250fd8bab2192350018f565c78aff182f37d80a7cbaea252eb95c7c8b0ba81575836
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZA:NABe
TLSH
T180B5332A9D2A9D7ED7EC557C2C3D1F4E0791CE414000DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uBoqWLa.exe

Path C:\Windows\System\uBoqWLa.exe
Size 2.2MB
SHA256 faf992ec0007bffa5279b02f4dbf51dcdc24e1cc904e58cf923b619df0c3e9e2
MD5 58a67f1d0e8872a6709c74b7faad3d0c
SHA1 a13217ce6c47110df7627d99bb2977e3579620d1
SHA512 a23da04461b9c7c3a7329bd23652269ea951666c00cc76f8c333ff2ad25d060508575db69066f0cca4dd379946316b318a647db7bbc8a94776154267c037b801
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ5:NABL
TLSH
T188B5332A5D2A9D7EDBEC557C2C3D1F4E0791CE414000DAF1A2D3209A6B4CFAD1A6F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

udRelfW.exe

Path C:\Windows\System\udRelfW.exe
Size 2.2MB
SHA256 25e91c6ccfee09f66058a60bf2f1fa97c9e80bc5c94f291687934f2ad09b8097
MD5 73f657d80087b8feebbf35d07957d919
SHA1 cdfc039043e7d109ba24289a3bfe0eb2dd687614
SHA512 7000a616a228b279b6e0d8c1413762f1255cdb732e6497f7436d0c6b608be3f474eb0a137f61ee6d2d70bfc5b952c70f9e459d7dce03c0ad3a27cf095be77613
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZ5:NABn
TLSH
T133B5332A9D2A5D7EDBEC557C2C3D1F4E4791CE414000DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ulGIKxZ.exe

Path C:\Windows\System\ulGIKxZ.exe
Size 2.2MB
SHA256 a37e7380b31a839e3aaa0cf592bd4557f056aa55b1a0a6d8de8a8977dbf8fa75
MD5 eadbcc65d7bd8830b4a95e7a3310a3f1
SHA1 10411420d0a9f7b545026724c36791b3d0b446c0
SHA512 c95de189d7c90ce95a5a91bc566950ccb4d2b09cdea2aebc95d399a8e1230bafba5376c34ef7f7dbf0d166b285ad537226ae7779a008422f9738539cd58861af
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZl:NABL
TLSH
T1A2B5332A5D2A9D7ED7EC557C2C3E1F4E4791CE414001DAF1A2D3209A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vDQvpgI.exe

Path C:\Windows\System\vDQvpgI.exe
Size 2.2MB
SHA256 e485325b96f181bf3bc98df8eb3ccb74452ecbb69af218aa1faaa6c05839956d
MD5 ee1f2fb788134dee5364e580569498f7
SHA1 24b85ec659a723422c22c38782595d9116219ecc
SHA512 1cd362afee1991b998cda6e301f26f197e31d22281f21989591b21fd84e8ff6145eb6e319f4cc5c0558d2c40b15d832b45fec4d50f79e4c662ad6a24d7721568
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZL:NABB
TLSH
T13DB5332A9D2A9D7ED7EC557C2C3D1F4E4790CE414001DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vREyMRb.exe

Path C:\Windows\System\vREyMRb.exe
Size 2.2MB
SHA256 83d9f3f39f29281a3e57f250d41972de783584d2902c2423a5354611a90242f9
MD5 2e61488271c6a879e5da8312a1e6bd45
SHA1 486475db72212f2bef2dd45641617992c9b08a78
SHA512 147f6cfbfbf17f266238d8b568c3cc6ec88df9f36a4c5491e28900b0320bab11f4348b13cd797445b3de4167cb2424c1cbd58487c5c48c31868860f0c6204ff0
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZx:NABb
TLSH
T1F8B5332A5D2A9D7EDBEC557C2C3D1F4E4791CE414000DAF1A2D3209A6B4CFAD1A2F46E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yLfvAcy.exe

Path C:\Windows\System\yLfvAcy.exe
Size 2.2MB
SHA256 f8f3ea8ea7b90573524673c4d9190b9f537b43e19da757d35112338171a7cb4f
MD5 df4686c851aba28c1b505b142c1fbf16
SHA1 e72656ba94e4ce249b3c4696cc565ba66399917e
SHA512 ca97d90f03ed5335e99727c992884924b8b76c71b8256ed1b9c4f7441cebf0fce55b24c47166156d23b8ca7b8d0d61bf1547bcc872060738db3e05aff66c5f23
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrAHZJ:NABD
TLSH
T153B5332A9D2A9D7ED7EC557C2C3D1F4E4791CE414001DAF1A2D3248A6B4CFAD1A2F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-2737-0x00007FF6C5490000-0x00007FF6C5882000-memory.dmp

Download

memory/688-951-0x00007FF739C20000-0x00007FF73A012000-memory.dmp

Download

memory/688-2774-0x00007FF739C20000-0x00007FF73A012000-memory.dmp

Download

memory/808-2748-0x00007FF77BA70000-0x00007FF77BE62000-memory.dmp

Download

memory/808-976-0x00007FF77BA70000-0x00007FF77BE62000-memory.dmp

Download

memory/824-982-0x00007FF75AC50000-0x00007FF75B042000-memory.dmp

Download

memory/824-2726-0x00007FF75AC50000-0x00007FF75B042000-memory.dmp

Download

memory/1344-942-0x00007FF786B30000-0x00007FF786F22000-memory.dmp

Download

memory/1344-2703-0x00007FF786B30000-0x00007FF786F22000-memory.dmp

Download

memory/1344-19-0x00007FF786B30000-0x00007FF786F22000-memory.dmp

Download

memory/1364-968-0x00007FF6220B0000-0x00007FF6224A2000-memory.dmp

Download

memory/1364-2788-0x00007FF6220B0000-0x00007FF6224A2000-memory.dmp

Download

memory/1392-945-0x00007FF6FE190000-0x00007FF6FE582000-memory.dmp

Download

memory/1392-2705-0x00007FF6FE190000-0x00007FF6FE582000-memory.dmp

Download

memory/1520-2721-0x00007FF6F5550000-0x00007FF6F5942000-memory.dmp

Download

memory/1520-979-0x00007FF6F5550000-0x00007FF6F5942000-memory.dmp

Download

memory/1596-2736-0x00007FF6067B0000-0x00007FF606BA2000-memory.dmp

Download

memory/1604-981-0x00007FF734F20000-0x00007FF735312000-memory.dmp

Download

memory/1604-2725-0x00007FF734F20000-0x00007FF735312000-memory.dmp

Download

memory/1716-971-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp

Download

memory/1716-2742-0x00007FF7D3130000-0x00007FF7D3522000-memory.dmp

Download

memory/1744-1-0x0000022A223A0000-0x0000022A223B0000-memory.dmp

Download

memory/1744-0-0x00007FF696080000-0x00007FF696472000-memory.dmp

Download

memory/1744-2000-0x00007FF696080000-0x00007FF696472000-memory.dmp

Download

memory/1744-1329-0x00007FF696080000-0x00007FF696472000-memory.dmp

Download

memory/1744-936-0x00007FF696080000-0x00007FF696472000-memory.dmp

Download

memory/1820-2588-0x00007FF6A9B90000-0x00007FF6A9F82000-memory.dmp

Download

memory/1832-2710-0x00007FF7E7830000-0x00007FF7E7C22000-memory.dmp

Download

memory/1832-30-0x00007FF7E7830000-0x00007FF7E7C22000-memory.dmp

Download

memory/1832-944-0x00007FF7E7830000-0x00007FF7E7C22000-memory.dmp

Download

memory/2052-9-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp

Download

memory/2052-2699-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp

Download

memory/2052-940-0x00007FF6091C0000-0x00007FF6095B2000-memory.dmp

Download

memory/2096-2752-0x00007FF635260000-0x00007FF635652000-memory.dmp

Download

memory/2096-954-0x00007FF635260000-0x00007FF635652000-memory.dmp

Download

memory/2124-2718-0x00007FF6D1970000-0x00007FF6D1D62000-memory.dmp

Download

memory/2124-950-0x00007FF6D1970000-0x00007FF6D1D62000-memory.dmp

Download

memory/2160-947-0x00007FF6EE650000-0x00007FF6EEA42000-memory.dmp

Download

memory/2160-2714-0x00007FF6EE650000-0x00007FF6EEA42000-memory.dmp

Download

memory/2272-2727-0x00007FF697270000-0x00007FF697662000-memory.dmp

Download

memory/2272-2668-0x00007FF697270000-0x00007FF697662000-memory.dmp

Download

memory/2476-956-0x00007FF7D4360000-0x00007FF7D4752000-memory.dmp

Download

memory/2476-2767-0x00007FF7D4360000-0x00007FF7D4752000-memory.dmp

Download

memory/2536-2735-0x00007FF7B6B70000-0x00007FF7B6F62000-memory.dmp

Download

memory/2644-941-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp

Download

memory/2644-2701-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp

Download

memory/2644-14-0x00007FF7E36C0000-0x00007FF7E3AB2000-memory.dmp

Download

memory/2648-2778-0x00007FF7AD2A0000-0x00007FF7AD692000-memory.dmp

Download

memory/2648-961-0x00007FF7AD2A0000-0x00007FF7AD692000-memory.dmp

Download

memory/2744-953-0x00007FF6E1940000-0x00007FF6E1D32000-memory.dmp

Download

memory/2744-2791-0x00007FF6E1940000-0x00007FF6E1D32000-memory.dmp

Download

memory/2748-2776-0x00007FF65EFF0000-0x00007FF65F3E2000-memory.dmp

Download

memory/2748-957-0x00007FF65EFF0000-0x00007FF65F3E2000-memory.dmp

Download

memory/2780-2733-0x00007FF6BE9C0000-0x00007FF6BEDB2000-memory.dmp

Download

memory/2848-2709-0x00007FF697310000-0x00007FF697702000-memory.dmp

Download

memory/2848-24-0x00007FF697310000-0x00007FF697702000-memory.dmp

Download

memory/2848-943-0x00007FF697310000-0x00007FF697702000-memory.dmp

Download

memory/3020-2732-0x00007FF7786D0000-0x00007FF778AC2000-memory.dmp

Download

memory/3068-2734-0x00007FF702990000-0x00007FF702D82000-memory.dmp

Download

memory/3236-2739-0x00007FF651BE0000-0x00007FF651FD2000-memory.dmp

Download

memory/3280-2719-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp

Download

memory/3280-977-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp

Download

memory/3932-2728-0x00007FF74A450000-0x00007FF74A842000-memory.dmp

Download

memory/3932-2675-0x00007FF74A450000-0x00007FF74A842000-memory.dmp

Download

memory/3936-974-0x00007FF75E630000-0x00007FF75EA22000-memory.dmp

Download

memory/3936-2744-0x00007FF75E630000-0x00007FF75EA22000-memory.dmp

Download

memory/3960-2716-0x00007FF7511F0000-0x00007FF7515E2000-memory.dmp

Download

memory/3960-949-0x00007FF7511F0000-0x00007FF7515E2000-memory.dmp

Download

memory/3996-2781-0x00007FF7757C0000-0x00007FF775BB2000-memory.dmp

Download

memory/3996-955-0x00007FF7757C0000-0x00007FF775BB2000-memory.dmp

Download

memory/4000-2723-0x00007FF785D60000-0x00007FF786152000-memory.dmp

Download

memory/4000-978-0x00007FF785D60000-0x00007FF786152000-memory.dmp

Download

memory/4024-2765-0x00007FF6C3880000-0x00007FF6C3C72000-memory.dmp

Download

memory/4024-959-0x00007FF6C3880000-0x00007FF6C3C72000-memory.dmp

Download

memory/4100-2713-0x00007FF72CD00000-0x00007FF72D0F2000-memory.dmp

Download

memory/4100-948-0x00007FF72CD00000-0x00007FF72D0F2000-memory.dmp

Download

memory/4316-2707-0x00007FF7B87E0000-0x00007FF7B8BD2000-memory.dmp

Download

memory/4316-946-0x00007FF7B87E0000-0x00007FF7B8BD2000-memory.dmp

Download

memory/4332-2738-0x00007FF754900000-0x00007FF754CF2000-memory.dmp

Download

memory/4376-980-0x00007FF7487C0000-0x00007FF748BB2000-memory.dmp

Download

memory/4376-2722-0x00007FF7487C0000-0x00007FF748BB2000-memory.dmp

Download

memory/4560-975-0x00007FF7AE000000-0x00007FF7AE3F2000-memory.dmp

Download

memory/4560-2746-0x00007FF7AE000000-0x00007FF7AE3F2000-memory.dmp

Download

memory/4880-2730-0x00007FF7CE770000-0x00007FF7CEB62000-memory.dmp

Download

memory/4960-116-0x0000023D4A7F0000-0x0000023D4A812000-memory.dmp

Download

memory/12348-2049-0x00007FF7BA640000-0x00007FF7BAA32000-memory.dmp

Download

memory/12444-1939-0x00007FF8AB5B0000-0x00007FF8AB7A5000-memory.dmp

Download

memory/12444-1936-0x00007FF794310000-0x00007FF794702000-memory.dmp

Download

memory/12476-2037-0x00007FF79FE30000-0x00007FF7A0222000-memory.dmp

Download

memory/12548-2061-0x00007FF6E9570000-0x00007FF6E9962000-memory.dmp

Download

memory/12596-2090-0x00007FF6D2AA0000-0x00007FF6D2E92000-memory.dmp

Download

memory/12676-1846-0x00007FF72CB30000-0x00007FF72CF22000-memory.dmp

Download

memory/12992-2666-0x00007FF726AC0000-0x00007FF726EB2000-memory.dmp

Download

memory/13060-2259-0x00007FF6EF0F0000-0x00007FF6EF4E2000-memory.dmp

Download