xmrig | 00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37

Analysis

max time kernel
2s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 18:07

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
Size

1.6MB
MD5

1e0d8fe067485cee0ae1c65e5031a1cb
SHA1

22034d3e1c5bd02bd3ec6caf5dbf312a575df9ab
SHA256

00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37
SHA512

e6ee0ef3ba3180e4340fd3864eeb0ab4768929c430e6b7914d4a66b5d2a84e4af0370643d7492921dc1e9c7c31a157ea6000fbc1bd424ddb1b2546c2a9e01c18
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsZLHYm2WVDtdpR/rq2:Lz071uv4BPMkFfdg6NsNtJVlRTT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables containing URLs to raw contents of a Github gist 24 IoCs

resource	yara_rule
behavioral2/memory/4800-362-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3432-363-0x00007FF789440000-0x00007FF789832000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2476-364-0x00007FF61F390000-0x00007FF61F782000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1200-361-0x00007FF6D8F40000-0x00007FF6D9332000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1776-365-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3584-366-0x00007FF60A860000-0x00007FF60AC52000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1032-368-0x00007FF6FC200000-0x00007FF6FC5F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/656-369-0x00007FF75CC80000-0x00007FF75D072000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4444-371-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4532-376-0x00007FF63C1F0000-0x00007FF63C5E2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1008-383-0x00007FF76C260000-0x00007FF76C652000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2400-401-0x00007FF75A080000-0x00007FF75A472000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1848-403-0x00007FF6C0520000-0x00007FF6C0912000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2304-392-0x00007FF700000000-0x00007FF7003F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1724-382-0x00007FF7DB660000-0x00007FF7DBA52000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4196-372-0x00007FF7289A0000-0x00007FF728D92000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4796-370-0x00007FF676130000-0x00007FF676522000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3912-367-0x00007FF615E50000-0x00007FF616242000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/448-72-0x00007FF6AD7B0000-0x00007FF6ADBA2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/1864-66-0x00007FF6FFBE0000-0x00007FF6FFFD2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4536-62-0x00007FF658200000-0x00007FF6585F2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3040-61-0x00007FF6B3970000-0x00007FF6B3D62000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/116-56-0x00007FF69B1E0000-0x00007FF69B5D2000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3944-46-0x00007FF727790000-0x00007FF727B82000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

UPX dump on OEP (original entry point) 58 IoCs

resource	yara_rule
behavioral2/memory/1896-0-0x00007FF7F96A0000-0x00007FF7F9A92000-memory.dmp	UPX
behavioral2/files/0x0008000000023488-6.dat	UPX
behavioral2/files/0x000700000002348c-10.dat	UPX
behavioral2/files/0x000700000002348f-24.dat	UPX
behavioral2/files/0x000700000002348e-36.dat	UPX
behavioral2/files/0x0007000000023490-31.dat	UPX
behavioral2/files/0x000700000002348d-27.dat	UPX
behavioral2/files/0x0007000000023497-74.dat	UPX
behavioral2/files/0x0008000000023494-92.dat	UPX
behavioral2/files/0x000700000002349d-125.dat	UPX
behavioral2/files/0x00070000000234a1-137.dat	UPX
behavioral2/files/0x00070000000234a2-150.dat	UPX
behavioral2/files/0x00070000000234a4-160.dat	UPX
behavioral2/files/0x00070000000234a9-177.dat	UPX
behavioral2/memory/4800-362-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	UPX
behavioral2/memory/3432-363-0x00007FF789440000-0x00007FF789832000-memory.dmp	UPX
behavioral2/memory/2476-364-0x00007FF61F390000-0x00007FF61F782000-memory.dmp	UPX
behavioral2/memory/1200-361-0x00007FF6D8F40000-0x00007FF6D9332000-memory.dmp	UPX
behavioral2/memory/1776-365-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp	UPX
behavioral2/memory/3584-366-0x00007FF60A860000-0x00007FF60AC52000-memory.dmp	UPX
behavioral2/memory/1032-368-0x00007FF6FC200000-0x00007FF6FC5F2000-memory.dmp	UPX
behavioral2/memory/656-369-0x00007FF75CC80000-0x00007FF75D072000-memory.dmp	UPX
behavioral2/memory/4444-371-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	UPX
behavioral2/memory/4532-376-0x00007FF63C1F0000-0x00007FF63C5E2000-memory.dmp	UPX
behavioral2/memory/1008-383-0x00007FF76C260000-0x00007FF76C652000-memory.dmp	UPX
behavioral2/memory/2400-401-0x00007FF75A080000-0x00007FF75A472000-memory.dmp	UPX
behavioral2/memory/1848-403-0x00007FF6C0520000-0x00007FF6C0912000-memory.dmp	UPX
behavioral2/memory/2304-392-0x00007FF700000000-0x00007FF7003F2000-memory.dmp	UPX
behavioral2/memory/1724-382-0x00007FF7DB660000-0x00007FF7DBA52000-memory.dmp	UPX
behavioral2/memory/4196-372-0x00007FF7289A0000-0x00007FF728D92000-memory.dmp	UPX
behavioral2/memory/4796-370-0x00007FF676130000-0x00007FF676522000-memory.dmp	UPX
behavioral2/memory/3912-367-0x00007FF615E50000-0x00007FF616242000-memory.dmp	UPX
behavioral2/files/0x00070000000234aa-182.dat	UPX
behavioral2/files/0x00070000000234a8-180.dat	UPX
behavioral2/files/0x00070000000234a7-175.dat	UPX
behavioral2/files/0x00070000000234a6-170.dat	UPX
behavioral2/files/0x00070000000234a5-165.dat	UPX
behavioral2/files/0x00070000000234a3-155.dat	UPX
behavioral2/files/0x00070000000234a0-140.dat	UPX
behavioral2/files/0x000700000002349f-135.dat	UPX
behavioral2/files/0x000700000002349e-130.dat	UPX
behavioral2/files/0x000700000002349c-120.dat	UPX
behavioral2/files/0x000700000002349b-115.dat	UPX
behavioral2/files/0x000700000002349a-110.dat	UPX
behavioral2/files/0x0007000000023499-105.dat	UPX
behavioral2/files/0x0008000000023489-95.dat	UPX
behavioral2/files/0x0007000000023498-90.dat	UPX
behavioral2/files/0x0007000000023496-80.dat	UPX
behavioral2/files/0x0008000000023495-78.dat	UPX
behavioral2/memory/448-72-0x00007FF6AD7B0000-0x00007FF6ADBA2000-memory.dmp	UPX
behavioral2/files/0x0007000000023492-68.dat	UPX
behavioral2/files/0x0007000000023493-67.dat	UPX
behavioral2/memory/1864-66-0x00007FF6FFBE0000-0x00007FF6FFFD2000-memory.dmp	UPX
behavioral2/memory/4536-62-0x00007FF658200000-0x00007FF6585F2000-memory.dmp	UPX
behavioral2/memory/3040-61-0x00007FF6B3970000-0x00007FF6B3D62000-memory.dmp	UPX
behavioral2/memory/116-56-0x00007FF69B1E0000-0x00007FF69B5D2000-memory.dmp	UPX
behavioral2/files/0x0007000000023491-55.dat	UPX
behavioral2/memory/3944-46-0x00007FF727790000-0x00007FF727B82000-memory.dmp	UPX

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral2/memory/4800-362-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	xmrig
behavioral2/memory/3432-363-0x00007FF789440000-0x00007FF789832000-memory.dmp	xmrig
behavioral2/memory/2476-364-0x00007FF61F390000-0x00007FF61F782000-memory.dmp	xmrig
behavioral2/memory/1200-361-0x00007FF6D8F40000-0x00007FF6D9332000-memory.dmp	xmrig
behavioral2/memory/1776-365-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp	xmrig
behavioral2/memory/3584-366-0x00007FF60A860000-0x00007FF60AC52000-memory.dmp	xmrig
behavioral2/memory/1032-368-0x00007FF6FC200000-0x00007FF6FC5F2000-memory.dmp	xmrig
behavioral2/memory/656-369-0x00007FF75CC80000-0x00007FF75D072000-memory.dmp	xmrig
behavioral2/memory/4444-371-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	xmrig
behavioral2/memory/4532-376-0x00007FF63C1F0000-0x00007FF63C5E2000-memory.dmp	xmrig
behavioral2/memory/1008-383-0x00007FF76C260000-0x00007FF76C652000-memory.dmp	xmrig
behavioral2/memory/2400-401-0x00007FF75A080000-0x00007FF75A472000-memory.dmp	xmrig
behavioral2/memory/1848-403-0x00007FF6C0520000-0x00007FF6C0912000-memory.dmp	xmrig
behavioral2/memory/2304-392-0x00007FF700000000-0x00007FF7003F2000-memory.dmp	xmrig
behavioral2/memory/1724-382-0x00007FF7DB660000-0x00007FF7DBA52000-memory.dmp	xmrig
behavioral2/memory/4196-372-0x00007FF7289A0000-0x00007FF728D92000-memory.dmp	xmrig
behavioral2/memory/4796-370-0x00007FF676130000-0x00007FF676522000-memory.dmp	xmrig
behavioral2/memory/3912-367-0x00007FF615E50000-0x00007FF616242000-memory.dmp	xmrig
behavioral2/memory/448-72-0x00007FF6AD7B0000-0x00007FF6ADBA2000-memory.dmp	xmrig
behavioral2/memory/1864-66-0x00007FF6FFBE0000-0x00007FF6FFFD2000-memory.dmp	xmrig
behavioral2/memory/4536-62-0x00007FF658200000-0x00007FF6585F2000-memory.dmp	xmrig
behavioral2/memory/3040-61-0x00007FF6B3970000-0x00007FF6B3D62000-memory.dmp	xmrig
behavioral2/memory/116-56-0x00007FF69B1E0000-0x00007FF69B5D2000-memory.dmp	xmrig
behavioral2/memory/3944-46-0x00007FF727790000-0x00007FF727B82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2828	powershell.exe

Executes dropped EXE 31 IoCs

pid	Process
448	agglcZZ.exe
3944	xpeiLeE.exe
116	ojhaBYe.exe
3040	GqNoeVL.exe
4536	KETuXlN.exe
1864	YGrCEAG.exe
1200	JheMNdW.exe
4800	msLjOau.exe
3432	LkYXEKI.exe
2476	FmxefxI.exe
2400	vPOcsWW.exe
1848	cnfjBuH.exe
1776	LVqdghO.exe
3584	mYrWfMc.exe
3912	IyDCewb.exe
1032	IlBdVNl.exe
656	xwwDVhd.exe
4796	adRHqOk.exe
4444	FJxTUwN.exe
4196	LYwrbXO.exe
4532	IZtIyBd.exe
1724	TmRrEOk.exe
1008	XZJtYCn.exe
2304	EzaonkH.exe
976	NBgLiYt.exe
2300	lEsGsZH.exe
4408	LGmAkTG.exe
1680	MTHSuGq.exe
4944	dmMRJVO.exe
4144	ZjnBtOU.exe
3224	cDrrWMm.exe

UPX packed file 58 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1896-0-0x00007FF7F96A0000-0x00007FF7F9A92000-memory.dmp	upx
behavioral2/files/0x0008000000023488-6.dat	upx
behavioral2/files/0x000700000002348c-10.dat	upx
behavioral2/files/0x000700000002348f-24.dat	upx
behavioral2/files/0x000700000002348e-36.dat	upx
behavioral2/files/0x0007000000023490-31.dat	upx
behavioral2/files/0x000700000002348d-27.dat	upx
behavioral2/files/0x0007000000023497-74.dat	upx
behavioral2/files/0x0008000000023494-92.dat	upx
behavioral2/files/0x000700000002349d-125.dat	upx
behavioral2/files/0x00070000000234a1-137.dat	upx
behavioral2/files/0x00070000000234a2-150.dat	upx
behavioral2/files/0x00070000000234a4-160.dat	upx
behavioral2/files/0x00070000000234a9-177.dat	upx
behavioral2/memory/4800-362-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	upx
behavioral2/memory/3432-363-0x00007FF789440000-0x00007FF789832000-memory.dmp	upx
behavioral2/memory/2476-364-0x00007FF61F390000-0x00007FF61F782000-memory.dmp	upx
behavioral2/memory/1200-361-0x00007FF6D8F40000-0x00007FF6D9332000-memory.dmp	upx
behavioral2/memory/1776-365-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp	upx
behavioral2/memory/3584-366-0x00007FF60A860000-0x00007FF60AC52000-memory.dmp	upx
behavioral2/memory/1032-368-0x00007FF6FC200000-0x00007FF6FC5F2000-memory.dmp	upx
behavioral2/memory/656-369-0x00007FF75CC80000-0x00007FF75D072000-memory.dmp	upx
behavioral2/memory/4444-371-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp	upx
behavioral2/memory/4532-376-0x00007FF63C1F0000-0x00007FF63C5E2000-memory.dmp	upx
behavioral2/memory/1008-383-0x00007FF76C260000-0x00007FF76C652000-memory.dmp	upx
behavioral2/memory/2400-401-0x00007FF75A080000-0x00007FF75A472000-memory.dmp	upx
behavioral2/memory/1848-403-0x00007FF6C0520000-0x00007FF6C0912000-memory.dmp	upx
behavioral2/memory/2304-392-0x00007FF700000000-0x00007FF7003F2000-memory.dmp	upx
behavioral2/memory/1724-382-0x00007FF7DB660000-0x00007FF7DBA52000-memory.dmp	upx
behavioral2/memory/4196-372-0x00007FF7289A0000-0x00007FF728D92000-memory.dmp	upx
behavioral2/memory/4796-370-0x00007FF676130000-0x00007FF676522000-memory.dmp	upx
behavioral2/memory/3912-367-0x00007FF615E50000-0x00007FF616242000-memory.dmp	upx
behavioral2/files/0x00070000000234aa-182.dat	upx
behavioral2/files/0x00070000000234a8-180.dat	upx
behavioral2/files/0x00070000000234a7-175.dat	upx
behavioral2/files/0x00070000000234a6-170.dat	upx
behavioral2/files/0x00070000000234a5-165.dat	upx
behavioral2/files/0x00070000000234a3-155.dat	upx
behavioral2/files/0x00070000000234a0-140.dat	upx
behavioral2/files/0x000700000002349f-135.dat	upx
behavioral2/files/0x000700000002349e-130.dat	upx
behavioral2/files/0x000700000002349c-120.dat	upx
behavioral2/files/0x000700000002349b-115.dat	upx
behavioral2/files/0x000700000002349a-110.dat	upx
behavioral2/files/0x0007000000023499-105.dat	upx
behavioral2/files/0x0008000000023489-95.dat	upx
behavioral2/files/0x0007000000023498-90.dat	upx
behavioral2/files/0x0007000000023496-80.dat	upx
behavioral2/files/0x0008000000023495-78.dat	upx
behavioral2/memory/448-72-0x00007FF6AD7B0000-0x00007FF6ADBA2000-memory.dmp	upx
behavioral2/files/0x0007000000023492-68.dat	upx
behavioral2/files/0x0007000000023493-67.dat	upx
behavioral2/memory/1864-66-0x00007FF6FFBE0000-0x00007FF6FFFD2000-memory.dmp	upx
behavioral2/memory/4536-62-0x00007FF658200000-0x00007FF6585F2000-memory.dmp	upx
behavioral2/memory/3040-61-0x00007FF6B3970000-0x00007FF6B3D62000-memory.dmp	upx
behavioral2/memory/116-56-0x00007FF69B1E0000-0x00007FF69B5D2000-memory.dmp	upx
behavioral2/files/0x0007000000023491-55.dat	upx
behavioral2/memory/3944-46-0x00007FF727790000-0x00007FF727B82000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\System\FmxefxI.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\IZtIyBd.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\TmRrEOk.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\EzaonkH.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\NBgLiYt.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\msLjOau.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\FJxTUwN.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\lEsGsZH.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\MTHSuGq.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\GqNoeVL.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\LVqdghO.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\LYwrbXO.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\cnfjBuH.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\JheMNdW.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\mYrWfMc.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\IyDCewb.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\xwwDVhd.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\cDrrWMm.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\KETuXlN.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\adRHqOk.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\ausGznx.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\ojhaBYe.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\YGrCEAG.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\LkYXEKI.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\ZjnBtOU.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\xpeiLeE.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\LGmAkTG.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\agglcZZ.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\IlBdVNl.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\XZJtYCn.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\dmMRJVO.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
File created	C:\Windows\System\vPOcsWW.exe	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2828	powershell.exe
2828	powershell.exe
2828	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
Token: SeDebugPrivilege	2828	powershell.exe
Token: SeLockMemoryPrivilege	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2828	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	83
PID 1896 wrote to memory of 2828	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	83
PID 1896 wrote to memory of 448	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	84
PID 1896 wrote to memory of 448	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	84
PID 1896 wrote to memory of 3944	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	85
PID 1896 wrote to memory of 3944	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	85
PID 1896 wrote to memory of 116	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	86
PID 1896 wrote to memory of 116	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	86
PID 1896 wrote to memory of 3040	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	87
PID 1896 wrote to memory of 3040	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	87
PID 1896 wrote to memory of 4536	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	88
PID 1896 wrote to memory of 4536	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	88
PID 1896 wrote to memory of 1864	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	89
PID 1896 wrote to memory of 1864	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	89
PID 1896 wrote to memory of 1200	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	90
PID 1896 wrote to memory of 1200	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	90
PID 1896 wrote to memory of 4800	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	91
PID 1896 wrote to memory of 4800	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	91
PID 1896 wrote to memory of 3432	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	92
PID 1896 wrote to memory of 3432	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	92
PID 1896 wrote to memory of 2476	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	93
PID 1896 wrote to memory of 2476	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	93
PID 1896 wrote to memory of 2400	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	94
PID 1896 wrote to memory of 2400	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	94
PID 1896 wrote to memory of 1848	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	95
PID 1896 wrote to memory of 1848	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	95
PID 1896 wrote to memory of 1776	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	96
PID 1896 wrote to memory of 1776	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	96
PID 1896 wrote to memory of 3584	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	97
PID 1896 wrote to memory of 3584	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	97
PID 1896 wrote to memory of 3912	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	98
PID 1896 wrote to memory of 3912	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	98
PID 1896 wrote to memory of 1032	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	99
PID 1896 wrote to memory of 1032	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	99
PID 1896 wrote to memory of 656	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	100
PID 1896 wrote to memory of 656	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	100
PID 1896 wrote to memory of 4796	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	101
PID 1896 wrote to memory of 4796	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	101
PID 1896 wrote to memory of 4444	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	102
PID 1896 wrote to memory of 4444	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	102
PID 1896 wrote to memory of 4196	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	103
PID 1896 wrote to memory of 4196	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	103
PID 1896 wrote to memory of 4532	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	104
PID 1896 wrote to memory of 4532	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	104
PID 1896 wrote to memory of 1724	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	105
PID 1896 wrote to memory of 1724	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	105
PID 1896 wrote to memory of 1008	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	106
PID 1896 wrote to memory of 1008	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	106
PID 1896 wrote to memory of 2304	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	107
PID 1896 wrote to memory of 2304	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	107
PID 1896 wrote to memory of 976	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	108
PID 1896 wrote to memory of 976	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	108
PID 1896 wrote to memory of 2300	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	109
PID 1896 wrote to memory of 2300	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	109
PID 1896 wrote to memory of 4408	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	110
PID 1896 wrote to memory of 4408	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	110
PID 1896 wrote to memory of 1680	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	111
PID 1896 wrote to memory of 1680	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	111
PID 1896 wrote to memory of 4944	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	112
PID 1896 wrote to memory of 4944	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	112
PID 1896 wrote to memory of 4144	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	113
PID 1896 wrote to memory of 4144	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	113
PID 1896 wrote to memory of 3224	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	114
PID 1896 wrote to memory of 3224	1896	00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe	114

C:\Users\Admin\AppData\Local\Temp\00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe
"C:\Users\Admin\AppData\Local\Temp\00193da1af97eea1d00f846d95c8ff0258efc325fbf89e486548d210eae2db37.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2828
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2828" "3044" "2980" "3048" "0" "0" "3052" "0" "0" "0" "0" "0"
    3⤵
    PID:13024
- C:\Windows\System\agglcZZ.exe
  C:\Windows\System\agglcZZ.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\xpeiLeE.exe
  C:\Windows\System\xpeiLeE.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\ojhaBYe.exe
  C:\Windows\System\ojhaBYe.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\GqNoeVL.exe
  C:\Windows\System\GqNoeVL.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\KETuXlN.exe
  C:\Windows\System\KETuXlN.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\YGrCEAG.exe
  C:\Windows\System\YGrCEAG.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\JheMNdW.exe
  C:\Windows\System\JheMNdW.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\msLjOau.exe
  C:\Windows\System\msLjOau.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\LkYXEKI.exe
  C:\Windows\System\LkYXEKI.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\FmxefxI.exe
  C:\Windows\System\FmxefxI.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\vPOcsWW.exe
  C:\Windows\System\vPOcsWW.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\cnfjBuH.exe
  C:\Windows\System\cnfjBuH.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\LVqdghO.exe
  C:\Windows\System\LVqdghO.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\mYrWfMc.exe
  C:\Windows\System\mYrWfMc.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\IyDCewb.exe
  C:\Windows\System\IyDCewb.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\IlBdVNl.exe
  C:\Windows\System\IlBdVNl.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\xwwDVhd.exe
  C:\Windows\System\xwwDVhd.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\adRHqOk.exe
  C:\Windows\System\adRHqOk.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\FJxTUwN.exe
  C:\Windows\System\FJxTUwN.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\LYwrbXO.exe
  C:\Windows\System\LYwrbXO.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\IZtIyBd.exe
  C:\Windows\System\IZtIyBd.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\TmRrEOk.exe
  C:\Windows\System\TmRrEOk.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\XZJtYCn.exe
  C:\Windows\System\XZJtYCn.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\EzaonkH.exe
  C:\Windows\System\EzaonkH.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\NBgLiYt.exe
  C:\Windows\System\NBgLiYt.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\lEsGsZH.exe
  C:\Windows\System\lEsGsZH.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\LGmAkTG.exe
  C:\Windows\System\LGmAkTG.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\MTHSuGq.exe
  C:\Windows\System\MTHSuGq.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\dmMRJVO.exe
  C:\Windows\System\dmMRJVO.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\ZjnBtOU.exe
  C:\Windows\System\ZjnBtOU.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\cDrrWMm.exe
  C:\Windows\System\cDrrWMm.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\ausGznx.exe
  C:\Windows\System\ausGznx.exe
  2⤵
  PID:3624
- C:\Windows\System\IQjjVAM.exe
  C:\Windows\System\IQjjVAM.exe
  2⤵
  PID:3104
- C:\Windows\System\YGXnaJC.exe
  C:\Windows\System\YGXnaJC.exe
  2⤵
  PID:3132
- C:\Windows\System\JiobTxK.exe
  C:\Windows\System\JiobTxK.exe
  2⤵
  PID:4644
- C:\Windows\System\YAPTogQ.exe
  C:\Windows\System\YAPTogQ.exe
  2⤵
  PID:4476
- C:\Windows\System\pOHGRfz.exe
  C:\Windows\System\pOHGRfz.exe
  2⤵
  PID:3732
- C:\Windows\System\zMqycuF.exe
  C:\Windows\System\zMqycuF.exe
  2⤵
  PID:4920
- C:\Windows\System\YcRuGyc.exe
  C:\Windows\System\YcRuGyc.exe
  2⤵
  PID:3600
- C:\Windows\System\cGfUWfC.exe
  C:\Windows\System\cGfUWfC.exe
  2⤵
  PID:4076
- C:\Windows\System\BHUIeyV.exe
  C:\Windows\System\BHUIeyV.exe
  2⤵
  PID:792
- C:\Windows\System\xfLUvgQ.exe
  C:\Windows\System\xfLUvgQ.exe
  2⤵
  PID:2284
- C:\Windows\System\HejXUQw.exe
  C:\Windows\System\HejXUQw.exe
  2⤵
  PID:3728
- C:\Windows\System\mPymfmu.exe
  C:\Windows\System\mPymfmu.exe
  2⤵
  PID:1612
- C:\Windows\System\pdrpgkh.exe
  C:\Windows\System\pdrpgkh.exe
  2⤵
  PID:4376
- C:\Windows\System\GaaJsMB.exe
  C:\Windows\System\GaaJsMB.exe
  2⤵
  PID:1228
- C:\Windows\System\WdEhuJs.exe
  C:\Windows\System\WdEhuJs.exe
  2⤵
  PID:2872
- C:\Windows\System\EloaZOQ.exe
  C:\Windows\System\EloaZOQ.exe
  2⤵
  PID:2980
- C:\Windows\System\tmYlOOB.exe
  C:\Windows\System\tmYlOOB.exe
  2⤵
  PID:60
- C:\Windows\System\yoGurAG.exe
  C:\Windows\System\yoGurAG.exe
  2⤵
  PID:5064
- C:\Windows\System\jTNvRZG.exe
  C:\Windows\System\jTNvRZG.exe
  2⤵
  PID:1288
- C:\Windows\System\SdEnbKw.exe
  C:\Windows\System\SdEnbKw.exe
  2⤵
  PID:5112
- C:\Windows\System\sUNXmDS.exe
  C:\Windows\System\sUNXmDS.exe
  2⤵
  PID:548
- C:\Windows\System\OSoLKKI.exe
  C:\Windows\System\OSoLKKI.exe
  2⤵
  PID:4864
- C:\Windows\System\uJpKCxG.exe
  C:\Windows\System\uJpKCxG.exe
  2⤵
  PID:4504
- C:\Windows\System\jwjbuaK.exe
  C:\Windows\System\jwjbuaK.exe
  2⤵
  PID:1496
- C:\Windows\System\VrTXDfJ.exe
  C:\Windows\System\VrTXDfJ.exe
  2⤵
  PID:4880
- C:\Windows\System\DweTgwC.exe
  C:\Windows\System\DweTgwC.exe
  2⤵
  PID:4632
- C:\Windows\System\TgLvdUa.exe
  C:\Windows\System\TgLvdUa.exe
  2⤵
  PID:3652
- C:\Windows\System\MyuuvZg.exe
  C:\Windows\System\MyuuvZg.exe
  2⤵
  PID:5068
- C:\Windows\System\LAyDqjh.exe
  C:\Windows\System\LAyDqjh.exe
  2⤵
  PID:4136
- C:\Windows\System\MyLTPzr.exe
  C:\Windows\System\MyLTPzr.exe
  2⤵
  PID:3820
- C:\Windows\System\pwWiOSw.exe
  C:\Windows\System\pwWiOSw.exe
  2⤵
  PID:964
- C:\Windows\System\COkDFRI.exe
  C:\Windows\System\COkDFRI.exe
  2⤵
  PID:1600
- C:\Windows\System\ZeuyIdy.exe
  C:\Windows\System\ZeuyIdy.exe
  2⤵
  PID:468
- C:\Windows\System\hwOeKqd.exe
  C:\Windows\System\hwOeKqd.exe
  2⤵
  PID:4008
- C:\Windows\System\DSppWku.exe
  C:\Windows\System\DSppWku.exe
  2⤵
  PID:4372
- C:\Windows\System\fToksKK.exe
  C:\Windows\System\fToksKK.exe
  2⤵
  PID:3960
- C:\Windows\System\WGUGbGx.exe
  C:\Windows\System\WGUGbGx.exe
  2⤵
  PID:2316
- C:\Windows\System\yEEePeT.exe
  C:\Windows\System\yEEePeT.exe
  2⤵
  PID:408
- C:\Windows\System\VvikjZf.exe
  C:\Windows\System\VvikjZf.exe
  2⤵
  PID:4304
- C:\Windows\System\bNjVanI.exe
  C:\Windows\System\bNjVanI.exe
  2⤵
  PID:3720
- C:\Windows\System\cMIxWte.exe
  C:\Windows\System\cMIxWte.exe
  2⤵
  PID:1456
- C:\Windows\System\gvtxrHp.exe
  C:\Windows\System\gvtxrHp.exe
  2⤵
  PID:3760
- C:\Windows\System\lOmvICv.exe
  C:\Windows\System\lOmvICv.exe
  2⤵
  PID:4980
- C:\Windows\System\LcsWuzP.exe
  C:\Windows\System\LcsWuzP.exe
  2⤵
  PID:4036
- C:\Windows\System\sayinCV.exe
  C:\Windows\System\sayinCV.exe
  2⤵
  PID:4508
- C:\Windows\System\uvdatrl.exe
  C:\Windows\System\uvdatrl.exe
  2⤵
  PID:5144
- C:\Windows\System\sPWaZNm.exe
  C:\Windows\System\sPWaZNm.exe
  2⤵
  PID:5172
- C:\Windows\System\KwnmnXp.exe
  C:\Windows\System\KwnmnXp.exe
  2⤵
  PID:5208
- C:\Windows\System\cAqRfEg.exe
  C:\Windows\System\cAqRfEg.exe
  2⤵
  PID:5232
- C:\Windows\System\tfnxbVj.exe
  C:\Windows\System\tfnxbVj.exe
  2⤵
  PID:5256
- C:\Windows\System\VVSKhKR.exe
  C:\Windows\System\VVSKhKR.exe
  2⤵
  PID:5288
- C:\Windows\System\bBKvnpu.exe
  C:\Windows\System\bBKvnpu.exe
  2⤵
  PID:5320
- C:\Windows\System\qGIFnNh.exe
  C:\Windows\System\qGIFnNh.exe
  2⤵
  PID:5344
- C:\Windows\System\yiuhfLE.exe
  C:\Windows\System\yiuhfLE.exe
  2⤵
  PID:5372
- C:\Windows\System\liGZvek.exe
  C:\Windows\System\liGZvek.exe
  2⤵
  PID:5396
- C:\Windows\System\VLRsNwS.exe
  C:\Windows\System\VLRsNwS.exe
  2⤵
  PID:5428
- C:\Windows\System\PdSMRWP.exe
  C:\Windows\System\PdSMRWP.exe
  2⤵
  PID:5456
- C:\Windows\System\fdhpqAI.exe
  C:\Windows\System\fdhpqAI.exe
  2⤵
  PID:5480
- C:\Windows\System\plLvzYx.exe
  C:\Windows\System\plLvzYx.exe
  2⤵
  PID:5516
- C:\Windows\System\tHKIwbm.exe
  C:\Windows\System\tHKIwbm.exe
  2⤵
  PID:5544
- C:\Windows\System\uWYvuVS.exe
  C:\Windows\System\uWYvuVS.exe
  2⤵
  PID:5568
- C:\Windows\System\uemQLNa.exe
  C:\Windows\System\uemQLNa.exe
  2⤵
  PID:5716
- C:\Windows\System\ZPEFJrA.exe
  C:\Windows\System\ZPEFJrA.exe
  2⤵
  PID:5740
- C:\Windows\System\ibBQSgS.exe
  C:\Windows\System\ibBQSgS.exe
  2⤵
  PID:5780
- C:\Windows\System\mBJhxQh.exe
  C:\Windows\System\mBJhxQh.exe
  2⤵
  PID:5812
- C:\Windows\System\PQbWTBM.exe
  C:\Windows\System\PQbWTBM.exe
  2⤵
  PID:5828
- C:\Windows\System\vYosFaj.exe
  C:\Windows\System\vYosFaj.exe
  2⤵
  PID:5848
- C:\Windows\System\tYNBLKH.exe
  C:\Windows\System\tYNBLKH.exe
  2⤵
  PID:5888
- C:\Windows\System\wvHrxvm.exe
  C:\Windows\System\wvHrxvm.exe
  2⤵
  PID:5908
- C:\Windows\System\ASGzcAP.exe
  C:\Windows\System\ASGzcAP.exe
  2⤵
  PID:5984
- C:\Windows\System\JSRyWcr.exe
  C:\Windows\System\JSRyWcr.exe
  2⤵
  PID:6008
- C:\Windows\System\Obzhsgu.exe
  C:\Windows\System\Obzhsgu.exe
  2⤵
  PID:6036
- C:\Windows\System\nghtiKO.exe
  C:\Windows\System\nghtiKO.exe
  2⤵
  PID:6060
- C:\Windows\System\SOGhGBZ.exe
  C:\Windows\System\SOGhGBZ.exe
  2⤵
  PID:6076
- C:\Windows\System\bDPIAis.exe
  C:\Windows\System\bDPIAis.exe
  2⤵
  PID:6096
- C:\Windows\System\qFMFndR.exe
  C:\Windows\System\qFMFndR.exe
  2⤵
  PID:6112
- C:\Windows\System\qugYgaF.exe
  C:\Windows\System\qugYgaF.exe
  2⤵
  PID:6132
- C:\Windows\System\iSltUpo.exe
  C:\Windows\System\iSltUpo.exe
  2⤵
  PID:4016
- C:\Windows\System\ZZDChpY.exe
  C:\Windows\System\ZZDChpY.exe
  2⤵
  PID:1704
- C:\Windows\System\wOGsvHc.exe
  C:\Windows\System\wOGsvHc.exe
  2⤵
  PID:1144
- C:\Windows\System\wSPEoxB.exe
  C:\Windows\System\wSPEoxB.exe
  2⤵
  PID:5164
- C:\Windows\System\siFnBkK.exe
  C:\Windows\System\siFnBkK.exe
  2⤵
  PID:5196
- C:\Windows\System\qaTImvQ.exe
  C:\Windows\System\qaTImvQ.exe
  2⤵
  PID:5272
- C:\Windows\System\JuVgzBp.exe
  C:\Windows\System\JuVgzBp.exe
  2⤵
  PID:5328
- C:\Windows\System\MuidOCS.exe
  C:\Windows\System\MuidOCS.exe
  2⤵
  PID:5468
- C:\Windows\System\wqpCNjN.exe
  C:\Windows\System\wqpCNjN.exe
  2⤵
  PID:5500
- C:\Windows\System\QGUZizJ.exe
  C:\Windows\System\QGUZizJ.exe
  2⤵
  PID:5540
- C:\Windows\System\kIyqtTs.exe
  C:\Windows\System\kIyqtTs.exe
  2⤵
  PID:5588
- C:\Windows\System\MPbvQvm.exe
  C:\Windows\System\MPbvQvm.exe
  2⤵
  PID:2616
- C:\Windows\System\kfyzRVp.exe
  C:\Windows\System\kfyzRVp.exe
  2⤵
  PID:4320
- C:\Windows\System\KsSmPHF.exe
  C:\Windows\System\KsSmPHF.exe
  2⤵
  PID:3240
- C:\Windows\System\CbWPLsH.exe
  C:\Windows\System\CbWPLsH.exe
  2⤵
  PID:3928
- C:\Windows\System\UUSXIMz.exe
  C:\Windows\System\UUSXIMz.exe
  2⤵
  PID:1972
- C:\Windows\System\qRURfwP.exe
  C:\Windows\System\qRURfwP.exe
  2⤵
  PID:2288
- C:\Windows\System\VTxBpSH.exe
  C:\Windows\System\VTxBpSH.exe
  2⤵
  PID:4716
- C:\Windows\System\AlHGTYg.exe
  C:\Windows\System\AlHGTYg.exe
  2⤵
  PID:2804
- C:\Windows\System\CxElPNH.exe
  C:\Windows\System\CxElPNH.exe
  2⤵
  PID:4032
- C:\Windows\System\QiaCETF.exe
  C:\Windows\System\QiaCETF.exe
  2⤵
  PID:3344
- C:\Windows\System\CAuQBeC.exe
  C:\Windows\System\CAuQBeC.exe
  2⤵
  PID:5772
- C:\Windows\System\OvefXrm.exe
  C:\Windows\System\OvefXrm.exe
  2⤵
  PID:5824
- C:\Windows\System\ygqPCdM.exe
  C:\Windows\System\ygqPCdM.exe
  2⤵
  PID:5840
- C:\Windows\System\HsrhPEZ.exe
  C:\Windows\System\HsrhPEZ.exe
  2⤵
  PID:5976
- C:\Windows\System\sKQMVVE.exe
  C:\Windows\System\sKQMVVE.exe
  2⤵
  PID:6068
- C:\Windows\System\JWQUUxu.exe
  C:\Windows\System\JWQUUxu.exe
  2⤵
  PID:3452
- C:\Windows\System\rGHORKF.exe
  C:\Windows\System\rGHORKF.exe
  2⤵
  PID:5132
- C:\Windows\System\DAvWpKS.exe
  C:\Windows\System\DAvWpKS.exe
  2⤵
  PID:5228
- C:\Windows\System\KMoYfIe.exe
  C:\Windows\System\KMoYfIe.exe
  2⤵
  PID:5384
- C:\Windows\System\IOzYMMM.exe
  C:\Windows\System\IOzYMMM.exe
  2⤵
  PID:5536
- C:\Windows\System\qrEbZQe.exe
  C:\Windows\System\qrEbZQe.exe
  2⤵
  PID:5448
- C:\Windows\System\rwKVLqL.exe
  C:\Windows\System\rwKVLqL.exe
  2⤵
  PID:3524
- C:\Windows\System\PHtlZRX.exe
  C:\Windows\System\PHtlZRX.exe
  2⤵
  PID:3216
- C:\Windows\System\UjrVUXl.exe
  C:\Windows\System\UjrVUXl.exe
  2⤵
  PID:3160
- C:\Windows\System\BzEuKyN.exe
  C:\Windows\System\BzEuKyN.exe
  2⤵
  PID:1056
- C:\Windows\System\ksnsmWw.exe
  C:\Windows\System\ksnsmWw.exe
  2⤵
  PID:6052
- C:\Windows\System\YUIpDZJ.exe
  C:\Windows\System\YUIpDZJ.exe
  2⤵
  PID:5476
- C:\Windows\System\phPFfUL.exe
  C:\Windows\System\phPFfUL.exe
  2⤵
  PID:5560
- C:\Windows\System\tKUDSOt.exe
  C:\Windows\System\tKUDSOt.exe
  2⤵
  PID:4312
- C:\Windows\System\DVOFGsW.exe
  C:\Windows\System\DVOFGsW.exe
  2⤵
  PID:3056
- C:\Windows\System\VRmLBCp.exe
  C:\Windows\System\VRmLBCp.exe
  2⤵
  PID:4028
- C:\Windows\System\ZDuhhZJ.exe
  C:\Windows\System\ZDuhhZJ.exe
  2⤵
  PID:4984
- C:\Windows\System\EaHHcQS.exe
  C:\Windows\System\EaHHcQS.exe
  2⤵
  PID:5192
- C:\Windows\System\SyDpHAn.exe
  C:\Windows\System\SyDpHAn.exe
  2⤵
  PID:5300
- C:\Windows\System\KfBrICT.exe
  C:\Windows\System\KfBrICT.exe
  2⤵
  PID:6156
- C:\Windows\System\Xxfhtsz.exe
  C:\Windows\System\Xxfhtsz.exe
  2⤵
  PID:6172
- C:\Windows\System\LidTdbK.exe
  C:\Windows\System\LidTdbK.exe
  2⤵
  PID:6192
- C:\Windows\System\NqBylYh.exe
  C:\Windows\System\NqBylYh.exe
  2⤵
  PID:6208
- C:\Windows\System\UILKDyo.exe
  C:\Windows\System\UILKDyo.exe
  2⤵
  PID:6224
- C:\Windows\System\jDfcDSm.exe
  C:\Windows\System\jDfcDSm.exe
  2⤵
  PID:6248
- C:\Windows\System\KrOpcEv.exe
  C:\Windows\System\KrOpcEv.exe
  2⤵
  PID:6268
- C:\Windows\System\zqXpdvC.exe
  C:\Windows\System\zqXpdvC.exe
  2⤵
  PID:6288
- C:\Windows\System\WqKxJYY.exe
  C:\Windows\System\WqKxJYY.exe
  2⤵
  PID:6336
- C:\Windows\System\jOztKrM.exe
  C:\Windows\System\jOztKrM.exe
  2⤵
  PID:6360
- C:\Windows\System\ObzcKJR.exe
  C:\Windows\System\ObzcKJR.exe
  2⤵
  PID:6380
- C:\Windows\System\sMBTkmZ.exe
  C:\Windows\System\sMBTkmZ.exe
  2⤵
  PID:6400
- C:\Windows\System\BDRReWm.exe
  C:\Windows\System\BDRReWm.exe
  2⤵
  PID:6420
- C:\Windows\System\jURCPbw.exe
  C:\Windows\System\jURCPbw.exe
  2⤵
  PID:6468
- C:\Windows\System\LKOFreL.exe
  C:\Windows\System\LKOFreL.exe
  2⤵
  PID:6492
- C:\Windows\System\jcHJPTx.exe
  C:\Windows\System\jcHJPTx.exe
  2⤵
  PID:6528
- C:\Windows\System\iKTAaXo.exe
  C:\Windows\System\iKTAaXo.exe
  2⤵
  PID:6596
- C:\Windows\System\YEWqSkE.exe
  C:\Windows\System\YEWqSkE.exe
  2⤵
  PID:6616
- C:\Windows\System\kOuvqJZ.exe
  C:\Windows\System\kOuvqJZ.exe
  2⤵
  PID:6640
- C:\Windows\System\ZATHNqV.exe
  C:\Windows\System\ZATHNqV.exe
  2⤵
  PID:6668
- C:\Windows\System\qMNOhFm.exe
  C:\Windows\System\qMNOhFm.exe
  2⤵
  PID:6712
- C:\Windows\System\EqIXmWT.exe
  C:\Windows\System\EqIXmWT.exe
  2⤵
  PID:6736
- C:\Windows\System\YDMSXPO.exe
  C:\Windows\System\YDMSXPO.exe
  2⤵
  PID:6760
- C:\Windows\System\XTxIVxp.exe
  C:\Windows\System\XTxIVxp.exe
  2⤵
  PID:6776
- C:\Windows\System\qxqqSnk.exe
  C:\Windows\System\qxqqSnk.exe
  2⤵
  PID:6800
- C:\Windows\System\mkaIvCm.exe
  C:\Windows\System\mkaIvCm.exe
  2⤵
  PID:6820
- C:\Windows\System\cshrUex.exe
  C:\Windows\System\cshrUex.exe
  2⤵
  PID:6836
- C:\Windows\System\cPNfMcr.exe
  C:\Windows\System\cPNfMcr.exe
  2⤵
  PID:6852
- C:\Windows\System\hyqifcZ.exe
  C:\Windows\System\hyqifcZ.exe
  2⤵
  PID:6876
- C:\Windows\System\lkjayRk.exe
  C:\Windows\System\lkjayRk.exe
  2⤵
  PID:6896
- C:\Windows\System\qRiuZqw.exe
  C:\Windows\System\qRiuZqw.exe
  2⤵
  PID:6916
- C:\Windows\System\hduXpEY.exe
  C:\Windows\System\hduXpEY.exe
  2⤵
  PID:6968
- C:\Windows\System\mwzKYIz.exe
  C:\Windows\System\mwzKYIz.exe
  2⤵
  PID:7024
- C:\Windows\System\JWtLHqy.exe
  C:\Windows\System\JWtLHqy.exe
  2⤵
  PID:7088
- C:\Windows\System\RYMpouQ.exe
  C:\Windows\System\RYMpouQ.exe
  2⤵
  PID:7120
- C:\Windows\System\Szsqkho.exe
  C:\Windows\System\Szsqkho.exe
  2⤵
  PID:7140
- C:\Windows\System\zXobfMM.exe
  C:\Windows\System\zXobfMM.exe
  2⤵
  PID:7156
- C:\Windows\System\OHUKTeM.exe
  C:\Windows\System\OHUKTeM.exe
  2⤵
  PID:6188
- C:\Windows\System\hvUKXMq.exe
  C:\Windows\System\hvUKXMq.exe
  2⤵
  PID:6168
- C:\Windows\System\MYTYjWw.exe
  C:\Windows\System\MYTYjWw.exe
  2⤵
  PID:6264
- C:\Windows\System\cGYUKdw.exe
  C:\Windows\System\cGYUKdw.exe
  2⤵
  PID:6368
- C:\Windows\System\YLQQKwX.exe
  C:\Windows\System\YLQQKwX.exe
  2⤵
  PID:6456
- C:\Windows\System\WGtEeWV.exe
  C:\Windows\System\WGtEeWV.exe
  2⤵
  PID:6476
- C:\Windows\System\RyqyHis.exe
  C:\Windows\System\RyqyHis.exe
  2⤵
  PID:6580
- C:\Windows\System\oHNeUUW.exe
  C:\Windows\System\oHNeUUW.exe
  2⤵
  PID:6564
- C:\Windows\System\OiWgZVe.exe
  C:\Windows\System\OiWgZVe.exe
  2⤵
  PID:6688
- C:\Windows\System\IRSBoAl.exe
  C:\Windows\System\IRSBoAl.exe
  2⤵
  PID:6728
- C:\Windows\System\WUiHxsu.exe
  C:\Windows\System\WUiHxsu.exe
  2⤵
  PID:6924
- C:\Windows\System\gaEpInV.exe
  C:\Windows\System\gaEpInV.exe
  2⤵
  PID:6868
- C:\Windows\System\XjCxuJe.exe
  C:\Windows\System\XjCxuJe.exe
  2⤵
  PID:6908
- C:\Windows\System\QwDFEkY.exe
  C:\Windows\System\QwDFEkY.exe
  2⤵
  PID:6944
- C:\Windows\System\DyqLBlj.exe
  C:\Windows\System\DyqLBlj.exe
  2⤵
  PID:7084
- C:\Windows\System\TkzrFIN.exe
  C:\Windows\System\TkzrFIN.exe
  2⤵
  PID:7128
- C:\Windows\System\PtMUaVn.exe
  C:\Windows\System\PtMUaVn.exe
  2⤵
  PID:5932
- C:\Windows\System\FOmdVtj.exe
  C:\Windows\System\FOmdVtj.exe
  2⤵
  PID:6216
- C:\Windows\System\LJHfzUB.exe
  C:\Windows\System\LJHfzUB.exe
  2⤵
  PID:6344
- C:\Windows\System\UTYNUFD.exe
  C:\Windows\System\UTYNUFD.exe
  2⤵
  PID:6484
- C:\Windows\System\JKjOnlu.exe
  C:\Windows\System\JKjOnlu.exe
  2⤵
  PID:6636
- C:\Windows\System\LVRhTuo.exe
  C:\Windows\System\LVRhTuo.exe
  2⤵
  PID:6752
- C:\Windows\System\mBKAtko.exe
  C:\Windows\System\mBKAtko.exe
  2⤵
  PID:6884
- C:\Windows\System\rWaHzZg.exe
  C:\Windows\System\rWaHzZg.exe
  2⤵
  PID:6964
- C:\Windows\System\aDLXDgE.exe
  C:\Windows\System\aDLXDgE.exe
  2⤵
  PID:7080
- C:\Windows\System\WVbRfVm.exe
  C:\Windows\System\WVbRfVm.exe
  2⤵
  PID:6312
- C:\Windows\System\qqqpiBp.exe
  C:\Windows\System\qqqpiBp.exe
  2⤵
  PID:6828
- C:\Windows\System\slcTkSF.exe
  C:\Windows\System\slcTkSF.exe
  2⤵
  PID:7188
- C:\Windows\System\QdcUDYJ.exe
  C:\Windows\System\QdcUDYJ.exe
  2⤵
  PID:7216
- C:\Windows\System\QaTSWSt.exe
  C:\Windows\System\QaTSWSt.exe
  2⤵
  PID:7280
- C:\Windows\System\CQyKHvE.exe
  C:\Windows\System\CQyKHvE.exe
  2⤵
  PID:7320
- C:\Windows\System\lwBFmIu.exe
  C:\Windows\System\lwBFmIu.exe
  2⤵
  PID:7348
- C:\Windows\System\LIqIeHO.exe
  C:\Windows\System\LIqIeHO.exe
  2⤵
  PID:7396
- C:\Windows\System\coGggPi.exe
  C:\Windows\System\coGggPi.exe
  2⤵
  PID:7420
- C:\Windows\System\rUxMyjq.exe
  C:\Windows\System\rUxMyjq.exe
  2⤵
  PID:7440
- C:\Windows\System\hgJYHtR.exe
  C:\Windows\System\hgJYHtR.exe
  2⤵
  PID:7480
- C:\Windows\System\gyAAJnR.exe
  C:\Windows\System\gyAAJnR.exe
  2⤵
  PID:7504
- C:\Windows\System\smdlKZe.exe
  C:\Windows\System\smdlKZe.exe
  2⤵
  PID:7528
- C:\Windows\System\CdziMvV.exe
  C:\Windows\System\CdziMvV.exe
  2⤵
  PID:7552
- C:\Windows\System\CMAGSPT.exe
  C:\Windows\System\CMAGSPT.exe
  2⤵
  PID:7576
- C:\Windows\System\VszoNLS.exe
  C:\Windows\System\VszoNLS.exe
  2⤵
  PID:7608
- C:\Windows\System\pTCvQVd.exe
  C:\Windows\System\pTCvQVd.exe
  2⤵
  PID:7632
- C:\Windows\System\oCUzyHE.exe
  C:\Windows\System\oCUzyHE.exe
  2⤵
  PID:7672
- C:\Windows\System\ySZuGhS.exe
  C:\Windows\System\ySZuGhS.exe
  2⤵
  PID:7696
- C:\Windows\System\sNamGyt.exe
  C:\Windows\System\sNamGyt.exe
  2⤵
  PID:7724
- C:\Windows\System\yXOLHtT.exe
  C:\Windows\System\yXOLHtT.exe
  2⤵
  PID:7740
- C:\Windows\System\qnVAZvv.exe
  C:\Windows\System\qnVAZvv.exe
  2⤵
  PID:7768
- C:\Windows\System\uvSxswE.exe
  C:\Windows\System\uvSxswE.exe
  2⤵
  PID:7792
- C:\Windows\System\taLKEnp.exe
  C:\Windows\System\taLKEnp.exe
  2⤵
  PID:7808
- C:\Windows\System\nJNuqSA.exe
  C:\Windows\System\nJNuqSA.exe
  2⤵
  PID:7836
- C:\Windows\System\asyukcg.exe
  C:\Windows\System\asyukcg.exe
  2⤵
  PID:7864
- C:\Windows\System\GEOQksY.exe
  C:\Windows\System\GEOQksY.exe
  2⤵
  PID:7928
- C:\Windows\System\dECvHYh.exe
  C:\Windows\System\dECvHYh.exe
  2⤵
  PID:7964
- C:\Windows\System\gCtaUwE.exe
  C:\Windows\System\gCtaUwE.exe
  2⤵
  PID:8000
- C:\Windows\System\uGEXPgG.exe
  C:\Windows\System\uGEXPgG.exe
  2⤵
  PID:8028
- C:\Windows\System\pvjSrhi.exe
  C:\Windows\System\pvjSrhi.exe
  2⤵
  PID:8060
- C:\Windows\System\VbVmVtk.exe
  C:\Windows\System\VbVmVtk.exe
  2⤵
  PID:8080
- C:\Windows\System\hFrvqCi.exe
  C:\Windows\System\hFrvqCi.exe
  2⤵
  PID:8100
- C:\Windows\System\LfMjiga.exe
  C:\Windows\System\LfMjiga.exe
  2⤵
  PID:8120
- C:\Windows\System\ZQBrOfg.exe
  C:\Windows\System\ZQBrOfg.exe
  2⤵
  PID:8140
- C:\Windows\System\nSsOaJr.exe
  C:\Windows\System\nSsOaJr.exe
  2⤵
  PID:8156
- C:\Windows\System\GXzzyCZ.exe
  C:\Windows\System\GXzzyCZ.exe
  2⤵
  PID:8184
- C:\Windows\System\whoOAJy.exe
  C:\Windows\System\whoOAJy.exe
  2⤵
  PID:7136
- C:\Windows\System\TCuoaOJ.exe
  C:\Windows\System\TCuoaOJ.exe
  2⤵
  PID:6328
- C:\Windows\System\hVdGdxb.exe
  C:\Windows\System\hVdGdxb.exe
  2⤵
  PID:7172
- C:\Windows\System\qWXiffJ.exe
  C:\Windows\System\qWXiffJ.exe
  2⤵
  PID:7248
- C:\Windows\System\EWuuRCy.exe
  C:\Windows\System\EWuuRCy.exe
  2⤵
  PID:7232
- C:\Windows\System\nosYhmm.exe
  C:\Windows\System\nosYhmm.exe
  2⤵
  PID:7316
- C:\Windows\System\wWcgtZp.exe
  C:\Windows\System\wWcgtZp.exe
  2⤵
  PID:7520
- C:\Windows\System\ngBONVn.exe
  C:\Windows\System\ngBONVn.exe
  2⤵
  PID:7568
- C:\Windows\System\qhkuTPg.exe
  C:\Windows\System\qhkuTPg.exe
  2⤵
  PID:7616
- C:\Windows\System\vSavSvi.exe
  C:\Windows\System\vSavSvi.exe
  2⤵
  PID:7656
- C:\Windows\System\YOZokOB.exe
  C:\Windows\System\YOZokOB.exe
  2⤵
  PID:7688
- C:\Windows\System\virXLNy.exe
  C:\Windows\System\virXLNy.exe
  2⤵
  PID:7716
- C:\Windows\System\loGhQiU.exe
  C:\Windows\System\loGhQiU.exe
  2⤵
  PID:7860
- C:\Windows\System\ZvsbYIj.exe
  C:\Windows\System\ZvsbYIj.exe
  2⤵
  PID:7956
- C:\Windows\System\sQlADtx.exe
  C:\Windows\System\sQlADtx.exe
  2⤵
  PID:5964
- C:\Windows\System\uwnHmdM.exe
  C:\Windows\System\uwnHmdM.exe
  2⤵
  PID:8052
- C:\Windows\System\VTZXEbP.exe
  C:\Windows\System\VTZXEbP.exe
  2⤵
  PID:6184
- C:\Windows\System\WmrLEXQ.exe
  C:\Windows\System\WmrLEXQ.exe
  2⤵
  PID:8148
- C:\Windows\System\dXerDUZ.exe
  C:\Windows\System\dXerDUZ.exe
  2⤵
  PID:6432
- C:\Windows\System\jEWzrqO.exe
  C:\Windows\System\jEWzrqO.exe
  2⤵
  PID:7296
- C:\Windows\System\GqBHGwR.exe
  C:\Windows\System\GqBHGwR.exe
  2⤵
  PID:7536
- C:\Windows\System\cudumoM.exe
  C:\Windows\System\cudumoM.exe
  2⤵
  PID:7624
- C:\Windows\System\vZyCbPV.exe
  C:\Windows\System\vZyCbPV.exe
  2⤵
  PID:7736
- C:\Windows\System\JpIkrXp.exe
  C:\Windows\System\JpIkrXp.exe
  2⤵
  PID:7828
- C:\Windows\System\IupBwYb.exe
  C:\Windows\System\IupBwYb.exe
  2⤵
  PID:7996
- C:\Windows\System\bQsfiMI.exe
  C:\Windows\System\bQsfiMI.exe
  2⤵
  PID:3472
- C:\Windows\System\PSRWjBV.exe
  C:\Windows\System\PSRWjBV.exe
  2⤵
  PID:8116
- C:\Windows\System\bBvRGHI.exe
  C:\Windows\System\bBvRGHI.exe
  2⤵
  PID:8164
- C:\Windows\System\tOmiyFT.exe
  C:\Windows\System\tOmiyFT.exe
  2⤵
  PID:7180
- C:\Windows\System\KuxIKjZ.exe
  C:\Windows\System\KuxIKjZ.exe
  2⤵
  PID:7896
- C:\Windows\System\buoSdUp.exe
  C:\Windows\System\buoSdUp.exe
  2⤵
  PID:3328
- C:\Windows\System\FpyzlLT.exe
  C:\Windows\System\FpyzlLT.exe
  2⤵
  PID:5636
- C:\Windows\System\xbvlqpV.exe
  C:\Windows\System\xbvlqpV.exe
  2⤵
  PID:2160
- C:\Windows\System\IZXfdio.exe
  C:\Windows\System\IZXfdio.exe
  2⤵
  PID:8200
- C:\Windows\System\szWRjUU.exe
  C:\Windows\System\szWRjUU.exe
  2⤵
  PID:8248
- C:\Windows\System\kSVeAyr.exe
  C:\Windows\System\kSVeAyr.exe
  2⤵
  PID:8272
- C:\Windows\System\vewsJYm.exe
  C:\Windows\System\vewsJYm.exe
  2⤵
  PID:8316
- C:\Windows\System\MWpKjWo.exe
  C:\Windows\System\MWpKjWo.exe
  2⤵
  PID:8336
- C:\Windows\System\zfANEIw.exe
  C:\Windows\System\zfANEIw.exe
  2⤵
  PID:8356
- C:\Windows\System\KinwUiH.exe
  C:\Windows\System\KinwUiH.exe
  2⤵
  PID:8376
- C:\Windows\System\CXdPwkK.exe
  C:\Windows\System\CXdPwkK.exe
  2⤵
  PID:8400
- C:\Windows\System\ucimDAa.exe
  C:\Windows\System\ucimDAa.exe
  2⤵
  PID:8452
- C:\Windows\System\nUHvllL.exe
  C:\Windows\System\nUHvllL.exe
  2⤵
  PID:8484
- C:\Windows\System\hoJUOkN.exe
  C:\Windows\System\hoJUOkN.exe
  2⤵
  PID:8508
- C:\Windows\System\xQnpjFH.exe
  C:\Windows\System\xQnpjFH.exe
  2⤵
  PID:8524
- C:\Windows\System\yVUscRj.exe
  C:\Windows\System\yVUscRj.exe
  2⤵
  PID:8552
- C:\Windows\System\uAKpSkS.exe
  C:\Windows\System\uAKpSkS.exe
  2⤵
  PID:8568
- C:\Windows\System\ljrUqUp.exe
  C:\Windows\System\ljrUqUp.exe
  2⤵
  PID:8604
- C:\Windows\System\MoiAlrP.exe
  C:\Windows\System\MoiAlrP.exe
  2⤵
  PID:8628
- C:\Windows\System\AdafkPf.exe
  C:\Windows\System\AdafkPf.exe
  2⤵
  PID:8664
- C:\Windows\System\JaUesBm.exe
  C:\Windows\System\JaUesBm.exe
  2⤵
  PID:8688
- C:\Windows\System\gmxWpnY.exe
  C:\Windows\System\gmxWpnY.exe
  2⤵
  PID:8708
- C:\Windows\System\ZQAcAZF.exe
  C:\Windows\System\ZQAcAZF.exe
  2⤵
  PID:8728
- C:\Windows\System\SLrXTPj.exe
  C:\Windows\System\SLrXTPj.exe
  2⤵
  PID:8748
- C:\Windows\System\PBUUfZp.exe
  C:\Windows\System\PBUUfZp.exe
  2⤵
  PID:8780
- C:\Windows\System\BrqJeQd.exe
  C:\Windows\System\BrqJeQd.exe
  2⤵
  PID:8832
- C:\Windows\System\zmTeyIi.exe
  C:\Windows\System\zmTeyIi.exe
  2⤵
  PID:8872
- C:\Windows\System\KKexwiF.exe
  C:\Windows\System\KKexwiF.exe
  2⤵
  PID:8896
- C:\Windows\System\GicTWnr.exe
  C:\Windows\System\GicTWnr.exe
  2⤵
  PID:8936
- C:\Windows\System\zGwjfwO.exe
  C:\Windows\System\zGwjfwO.exe
  2⤵
  PID:8956
- C:\Windows\System\QVCZiyY.exe
  C:\Windows\System\QVCZiyY.exe
  2⤵
  PID:8972
- C:\Windows\System\FLgAfnQ.exe
  C:\Windows\System\FLgAfnQ.exe
  2⤵
  PID:9108
- C:\Windows\System\rkZjqKN.exe
  C:\Windows\System\rkZjqKN.exe
  2⤵
  PID:9124
- C:\Windows\System\UKKGvcw.exe
  C:\Windows\System\UKKGvcw.exe
  2⤵
  PID:9144
- C:\Windows\System\JyyMFlS.exe
  C:\Windows\System\JyyMFlS.exe
  2⤵
  PID:9160
- C:\Windows\System\pFnrFsg.exe
  C:\Windows\System\pFnrFsg.exe
  2⤵
  PID:9176
- C:\Windows\System\cHgzVJJ.exe
  C:\Windows\System\cHgzVJJ.exe
  2⤵
  PID:9196
- C:\Windows\System\mXKFvie.exe
  C:\Windows\System\mXKFvie.exe
  2⤵
  PID:9212
- C:\Windows\System\sjBkhMD.exe
  C:\Windows\System\sjBkhMD.exe
  2⤵
  PID:7560
- C:\Windows\System\OyIFCdr.exe
  C:\Windows\System\OyIFCdr.exe
  2⤵
  PID:8304
- C:\Windows\System\iyYzsNV.exe
  C:\Windows\System\iyYzsNV.exe
  2⤵
  PID:8396
- C:\Windows\System\LFbZaRD.exe
  C:\Windows\System\LFbZaRD.exe
  2⤵
  PID:8564
- C:\Windows\System\dWxIksi.exe
  C:\Windows\System\dWxIksi.exe
  2⤵
  PID:8612
- C:\Windows\System\YeiitlC.exe
  C:\Windows\System\YeiitlC.exe
  2⤵
  PID:8620
- C:\Windows\System\uuJpFZw.exe
  C:\Windows\System\uuJpFZw.exe
  2⤵
  PID:3008
- C:\Windows\System\kdUvLiU.exe
  C:\Windows\System\kdUvLiU.exe
  2⤵
  PID:8704
- C:\Windows\System\FLznEDe.exe
  C:\Windows\System\FLznEDe.exe
  2⤵
  PID:8724
- C:\Windows\System\TwlxVnc.exe
  C:\Windows\System\TwlxVnc.exe
  2⤵
  PID:8796
- C:\Windows\System\fEyWRFF.exe
  C:\Windows\System\fEyWRFF.exe
  2⤵
  PID:8880
- C:\Windows\System\ZXoqWEL.exe
  C:\Windows\System\ZXoqWEL.exe
  2⤵
  PID:8964
- C:\Windows\System\NoTmiZR.exe
  C:\Windows\System\NoTmiZR.exe
  2⤵
  PID:9044
- C:\Windows\System\zajeQuI.exe
  C:\Windows\System\zajeQuI.exe
  2⤵
  PID:8244
- C:\Windows\System\wodUyhJ.exe
  C:\Windows\System\wodUyhJ.exe
  2⤵
  PID:9152
- C:\Windows\System\yvBLmsG.exe
  C:\Windows\System\yvBLmsG.exe
  2⤵
  PID:9068
- C:\Windows\System\VOswYGA.exe
  C:\Windows\System\VOswYGA.exe
  2⤵
  PID:9040
- C:\Windows\System\gAWPngx.exe
  C:\Windows\System\gAWPngx.exe
  2⤵
  PID:8256
- C:\Windows\System\rJRZPEG.exe
  C:\Windows\System\rJRZPEG.exe
  2⤵
  PID:8504
- C:\Windows\System\kowosRC.exe
  C:\Windows\System\kowosRC.exe
  2⤵
  PID:8332
- C:\Windows\System\rWjqIUk.exe
  C:\Windows\System\rWjqIUk.exe
  2⤵
  PID:8672
- C:\Windows\System\lvuRMKJ.exe
  C:\Windows\System\lvuRMKJ.exe
  2⤵
  PID:8740
- C:\Windows\System\sMJpaTh.exe
  C:\Windows\System\sMJpaTh.exe
  2⤵
  PID:8968
- C:\Windows\System\erZYpDG.exe
  C:\Windows\System\erZYpDG.exe
  2⤵
  PID:9060
- C:\Windows\System\YVILRlw.exe
  C:\Windows\System\YVILRlw.exe
  2⤵
  PID:9048
- C:\Windows\System\TnTKOGR.exe
  C:\Windows\System\TnTKOGR.exe
  2⤵
  PID:8448
- C:\Windows\System\EpHmTwd.exe
  C:\Windows\System\EpHmTwd.exe
  2⤵
  PID:7380
- C:\Windows\System\SbTUSJw.exe
  C:\Windows\System\SbTUSJw.exe
  2⤵
  PID:8776
- C:\Windows\System\DNzXEzr.exe
  C:\Windows\System\DNzXEzr.exe
  2⤵
  PID:8952
- C:\Windows\System\inAbXcn.exe
  C:\Windows\System\inAbXcn.exe
  2⤵
  PID:9116
- C:\Windows\System\wPsKjEh.exe
  C:\Windows\System\wPsKjEh.exe
  2⤵
  PID:8264
- C:\Windows\System\bJreEIA.exe
  C:\Windows\System\bJreEIA.exe
  2⤵
  PID:2760
- C:\Windows\System\zzdlFzh.exe
  C:\Windows\System\zzdlFzh.exe
  2⤵
  PID:5796
- C:\Windows\System\vTqKqWC.exe
  C:\Windows\System\vTqKqWC.exe
  2⤵
  PID:8828
- C:\Windows\System\sCLSLQQ.exe
  C:\Windows\System\sCLSLQQ.exe
  2⤵
  PID:9236
- C:\Windows\System\lpHSbJT.exe
  C:\Windows\System\lpHSbJT.exe
  2⤵
  PID:9256
- C:\Windows\System\sCFShpA.exe
  C:\Windows\System\sCFShpA.exe
  2⤵
  PID:9276
- C:\Windows\System\MVEREoF.exe
  C:\Windows\System\MVEREoF.exe
  2⤵
  PID:9308
- C:\Windows\System\REsKrlb.exe
  C:\Windows\System\REsKrlb.exe
  2⤵
  PID:9324
- C:\Windows\System\cUIcfbm.exe
  C:\Windows\System\cUIcfbm.exe
  2⤵
  PID:9344
- C:\Windows\System\bhWUeME.exe
  C:\Windows\System\bhWUeME.exe
  2⤵
  PID:9364
- C:\Windows\System\iUUXxKc.exe
  C:\Windows\System\iUUXxKc.exe
  2⤵
  PID:9416
- C:\Windows\System\HEJeOax.exe
  C:\Windows\System\HEJeOax.exe
  2⤵
  PID:9484
- C:\Windows\System\PmcVnoa.exe
  C:\Windows\System\PmcVnoa.exe
  2⤵
  PID:9516
- C:\Windows\System\pDxqqDH.exe
  C:\Windows\System\pDxqqDH.exe
  2⤵
  PID:9540
- C:\Windows\System\LkSjEWM.exe
  C:\Windows\System\LkSjEWM.exe
  2⤵
  PID:9560
- C:\Windows\System\aVFPypu.exe
  C:\Windows\System\aVFPypu.exe
  2⤵
  PID:9580
- C:\Windows\System\PnvvMgt.exe
  C:\Windows\System\PnvvMgt.exe
  2⤵
  PID:9600
- C:\Windows\System\wwQnqLm.exe
  C:\Windows\System\wwQnqLm.exe
  2⤵
  PID:9632
- C:\Windows\System\GNGbJox.exe
  C:\Windows\System\GNGbJox.exe
  2⤵
  PID:9684
- C:\Windows\System\WFqgzum.exe
  C:\Windows\System\WFqgzum.exe
  2⤵
  PID:9708
- C:\Windows\System\NoAtzVu.exe
  C:\Windows\System\NoAtzVu.exe
  2⤵
  PID:9728
- C:\Windows\System\tAEEBbf.exe
  C:\Windows\System\tAEEBbf.exe
  2⤵
  PID:9756
- C:\Windows\System\NfyuoGY.exe
  C:\Windows\System\NfyuoGY.exe
  2⤵
  PID:9776
- C:\Windows\System\TlUQquc.exe
  C:\Windows\System\TlUQquc.exe
  2⤵
  PID:9824
- C:\Windows\System\LJkpEzj.exe
  C:\Windows\System\LJkpEzj.exe
  2⤵
  PID:9852
- C:\Windows\System\teiWwak.exe
  C:\Windows\System\teiWwak.exe
  2⤵
  PID:9868
- C:\Windows\System\tqQymYz.exe
  C:\Windows\System\tqQymYz.exe
  2⤵
  PID:9888
- C:\Windows\System\REyjmIo.exe
  C:\Windows\System\REyjmIo.exe
  2⤵
  PID:9924
- C:\Windows\System\tJHBNjL.exe
  C:\Windows\System\tJHBNjL.exe
  2⤵
  PID:9960
- C:\Windows\System\nUTBZJa.exe
  C:\Windows\System\nUTBZJa.exe
  2⤵
  PID:10000
- C:\Windows\System\KTstomI.exe
  C:\Windows\System\KTstomI.exe
  2⤵
  PID:10040
- C:\Windows\System\egcVULO.exe
  C:\Windows\System\egcVULO.exe
  2⤵
  PID:10064
- C:\Windows\System\nVEbLMo.exe
  C:\Windows\System\nVEbLMo.exe
  2⤵
  PID:10080
- C:\Windows\System\kQWjrwo.exe
  C:\Windows\System\kQWjrwo.exe
  2⤵
  PID:10100
- C:\Windows\System\aWqfupW.exe
  C:\Windows\System\aWqfupW.exe
  2⤵
  PID:10144
- C:\Windows\System\OzapwId.exe
  C:\Windows\System\OzapwId.exe
  2⤵
  PID:10168
- C:\Windows\System\gZJcxbW.exe
  C:\Windows\System\gZJcxbW.exe
  2⤵
  PID:10184
- C:\Windows\System\WEZhcQs.exe
  C:\Windows\System\WEZhcQs.exe
  2⤵
  PID:10212
- C:\Windows\System\DARcQIU.exe
  C:\Windows\System\DARcQIU.exe
  2⤵
  PID:10232
- C:\Windows\System\ImOGvOm.exe
  C:\Windows\System\ImOGvOm.exe
  2⤵
  PID:9284
- C:\Windows\System\wtoOCib.exe
  C:\Windows\System\wtoOCib.exe
  2⤵
  PID:9336
- C:\Windows\System\QWlCSZk.exe
  C:\Windows\System\QWlCSZk.exe
  2⤵
  PID:9452
- C:\Windows\System\lpUUErE.exe
  C:\Windows\System\lpUUErE.exe
  2⤵
  PID:9448
- C:\Windows\System\tpSOfcS.exe
  C:\Windows\System\tpSOfcS.exe
  2⤵
  PID:9512
- C:\Windows\System\XHrJAda.exe
  C:\Windows\System\XHrJAda.exe
  2⤵
  PID:9532
- C:\Windows\System\LcgoRHg.exe
  C:\Windows\System\LcgoRHg.exe
  2⤵
  PID:9676
- C:\Windows\System\OYSjYBl.exe
  C:\Windows\System\OYSjYBl.exe
  2⤵
  PID:9720
- C:\Windows\System\XthgHjF.exe
  C:\Windows\System\XthgHjF.exe
  2⤵
  PID:9772
- C:\Windows\System\gUwaypX.exe
  C:\Windows\System\gUwaypX.exe
  2⤵
  PID:9860
- C:\Windows\System\ciYVfxC.exe
  C:\Windows\System\ciYVfxC.exe
  2⤵
  PID:9952
- C:\Windows\System\wyRxKJB.exe
  C:\Windows\System\wyRxKJB.exe
  2⤵
  PID:10036
- C:\Windows\System\CjKaTob.exe
  C:\Windows\System\CjKaTob.exe
  2⤵
  PID:10076
- C:\Windows\System\uqQInlr.exe
  C:\Windows\System\uqQInlr.exe
  2⤵
  PID:10132
- C:\Windows\System\lSXkbrW.exe
  C:\Windows\System\lSXkbrW.exe
  2⤵
  PID:9192
- C:\Windows\System\WIyBLVH.exe
  C:\Windows\System\WIyBLVH.exe
  2⤵
  PID:10208
- C:\Windows\System\BTdIazl.exe
  C:\Windows\System\BTdIazl.exe
  2⤵
  PID:9300
- C:\Windows\System\vLjCVjC.exe
  C:\Windows\System\vLjCVjC.exe
  2⤵
  PID:9432
- C:\Windows\System\sMiuqgQ.exe
  C:\Windows\System\sMiuqgQ.exe
  2⤵
  PID:9724
- C:\Windows\System\RHtEgag.exe
  C:\Windows\System\RHtEgag.exe
  2⤵
  PID:9848
- C:\Windows\System\vZFNdzr.exe
  C:\Windows\System\vZFNdzr.exe
  2⤵
  PID:10056
- C:\Windows\System\MCIWOiE.exe
  C:\Windows\System\MCIWOiE.exe
  2⤵
  PID:10180
- C:\Windows\System\GnGLvkK.exe
  C:\Windows\System\GnGLvkK.exe
  2⤵
  PID:9244
- C:\Windows\System\hcbLvCw.exe
  C:\Windows\System\hcbLvCw.exe
  2⤵
  PID:4404
- C:\Windows\System\BmKAsFa.exe
  C:\Windows\System\BmKAsFa.exe
  2⤵
  PID:10024
- C:\Windows\System\XWERMSb.exe
  C:\Windows\System\XWERMSb.exe
  2⤵
  PID:9316
- C:\Windows\System\wIinATn.exe
  C:\Windows\System\wIinATn.exe
  2⤵
  PID:9832
- C:\Windows\System\yIUGGfE.exe
  C:\Windows\System\yIUGGfE.exe
  2⤵
  PID:10248
- C:\Windows\System\jytsKHp.exe
  C:\Windows\System\jytsKHp.exe
  2⤵
  PID:10276
- C:\Windows\System\ErQaFKl.exe
  C:\Windows\System\ErQaFKl.exe
  2⤵
  PID:10292
- C:\Windows\System\kMhZBJv.exe
  C:\Windows\System\kMhZBJv.exe
  2⤵
  PID:10312
- C:\Windows\System\QIIyJAd.exe
  C:\Windows\System\QIIyJAd.exe
  2⤵
  PID:10332
- C:\Windows\System\HPOaHrL.exe
  C:\Windows\System\HPOaHrL.exe
  2⤵
  PID:10348
- C:\Windows\System\YptCIRI.exe
  C:\Windows\System\YptCIRI.exe
  2⤵
  PID:10400
- C:\Windows\System\cOfLsZx.exe
  C:\Windows\System\cOfLsZx.exe
  2⤵
  PID:10440
- C:\Windows\System\SDtufBf.exe
  C:\Windows\System\SDtufBf.exe
  2⤵
  PID:10460
- C:\Windows\System\JiGiCfB.exe
  C:\Windows\System\JiGiCfB.exe
  2⤵
  PID:10508
- C:\Windows\System\ZdbDmdu.exe
  C:\Windows\System\ZdbDmdu.exe
  2⤵
  PID:10560
- C:\Windows\System\BXojrmc.exe
  C:\Windows\System\BXojrmc.exe
  2⤵
  PID:10580
- C:\Windows\System\ZQgOAIa.exe
  C:\Windows\System\ZQgOAIa.exe
  2⤵
  PID:10612
- C:\Windows\System\rYAUKmu.exe
  C:\Windows\System\rYAUKmu.exe
  2⤵
  PID:10640
- C:\Windows\System\QfpIXNy.exe
  C:\Windows\System\QfpIXNy.exe
  2⤵
  PID:10660
- C:\Windows\System\MERrvHm.exe
  C:\Windows\System\MERrvHm.exe
  2⤵
  PID:10700
- C:\Windows\System\HaxzJLH.exe
  C:\Windows\System\HaxzJLH.exe
  2⤵
  PID:10724
- C:\Windows\System\XRbSEiJ.exe
  C:\Windows\System\XRbSEiJ.exe
  2⤵
  PID:10752
- C:\Windows\System\ucYqVkB.exe
  C:\Windows\System\ucYqVkB.exe
  2⤵
  PID:10780
- C:\Windows\System\KMxoxGV.exe
  C:\Windows\System\KMxoxGV.exe
  2⤵
  PID:10800
- C:\Windows\System\TBIWdWh.exe
  C:\Windows\System\TBIWdWh.exe
  2⤵
  PID:10820
- C:\Windows\System\sfBCXzt.exe
  C:\Windows\System\sfBCXzt.exe
  2⤵
  PID:10840
- C:\Windows\System\FlcuOtm.exe
  C:\Windows\System\FlcuOtm.exe
  2⤵
  PID:10908
- C:\Windows\System\fTvBorr.exe
  C:\Windows\System\fTvBorr.exe
  2⤵
  PID:10924
- C:\Windows\System\BIKwzMm.exe
  C:\Windows\System\BIKwzMm.exe
  2⤵
  PID:10948
- C:\Windows\System\RZVVWFg.exe
  C:\Windows\System\RZVVWFg.exe
  2⤵
  PID:10968
- C:\Windows\System\mjGFBoZ.exe
  C:\Windows\System\mjGFBoZ.exe
  2⤵
  PID:10984
- C:\Windows\System\oLodaUc.exe
  C:\Windows\System\oLodaUc.exe
  2⤵
  PID:11004
- C:\Windows\System\cqDxfzB.exe
  C:\Windows\System\cqDxfzB.exe
  2⤵
  PID:11024
- C:\Windows\System\pVxTYfq.exe
  C:\Windows\System\pVxTYfq.exe
  2⤵
  PID:11080
- C:\Windows\System\nJcjTmD.exe
  C:\Windows\System\nJcjTmD.exe
  2⤵
  PID:11120
- C:\Windows\System\VRknHhz.exe
  C:\Windows\System\VRknHhz.exe
  2⤵
  PID:11136
- C:\Windows\System\ZLURnfW.exe
  C:\Windows\System\ZLURnfW.exe
  2⤵
  PID:11160
- C:\Windows\System\IekVPwH.exe
  C:\Windows\System\IekVPwH.exe
  2⤵
  PID:11184
- C:\Windows\System\wmNkCCl.exe
  C:\Windows\System\wmNkCCl.exe
  2⤵
  PID:11208
- C:\Windows\System\JkNpMMA.exe
  C:\Windows\System\JkNpMMA.exe
  2⤵
  PID:11228
- C:\Windows\System\cwnIHSf.exe
  C:\Windows\System\cwnIHSf.exe
  2⤵
  PID:9820
- C:\Windows\System\ORBQhIi.exe
  C:\Windows\System\ORBQhIi.exe
  2⤵
  PID:10256
- C:\Windows\System\tbfsGuo.exe
  C:\Windows\System\tbfsGuo.exe
  2⤵
  PID:10344
- C:\Windows\System\oBgKjBs.exe
  C:\Windows\System\oBgKjBs.exe
  2⤵
  PID:9492
- C:\Windows\System\zxTsSZn.exe
  C:\Windows\System\zxTsSZn.exe
  2⤵
  PID:10424
- C:\Windows\System\cwWxdPt.exe
  C:\Windows\System\cwWxdPt.exe
  2⤵
  PID:10456
- C:\Windows\System\WCCBQPT.exe
  C:\Windows\System\WCCBQPT.exe
  2⤵
  PID:10540
- C:\Windows\System\XRdkkkI.exe
  C:\Windows\System\XRdkkkI.exe
  2⤵
  PID:10600
- C:\Windows\System\vUkbYLz.exe
  C:\Windows\System\vUkbYLz.exe
  2⤵
  PID:10652
- C:\Windows\System\ambOSUU.exe
  C:\Windows\System\ambOSUU.exe
  2⤵
  PID:10716
- C:\Windows\System\kyhclmC.exe
  C:\Windows\System\kyhclmC.exe
  2⤵
  PID:10864
- C:\Windows\System\PRFvhRc.exe
  C:\Windows\System\PRFvhRc.exe
  2⤵
  PID:2920
- C:\Windows\System\hblsfgQ.exe
  C:\Windows\System\hblsfgQ.exe
  2⤵
  PID:10936
- C:\Windows\System\TXnFkAS.exe
  C:\Windows\System\TXnFkAS.exe
  2⤵
  PID:11020
- C:\Windows\System\NJqJFnC.exe
  C:\Windows\System\NJqJFnC.exe
  2⤵
  PID:11112
- C:\Windows\System\UpTKjCB.exe
  C:\Windows\System\UpTKjCB.exe
  2⤵
  PID:11168
- C:\Windows\System\gjyoWOO.exe
  C:\Windows\System\gjyoWOO.exe
  2⤵
  PID:11220
- C:\Windows\System\KFztVhv.exe
  C:\Windows\System\KFztVhv.exe
  2⤵
  PID:10388
- C:\Windows\System\WELyIbH.exe
  C:\Windows\System\WELyIbH.exe
  2⤵
  PID:10416
- C:\Windows\System\jTSINsn.exe
  C:\Windows\System\jTSINsn.exe
  2⤵
  PID:10676
- C:\Windows\System\IMVjoxe.exe
  C:\Windows\System\IMVjoxe.exe
  2⤵
  PID:10876
- C:\Windows\System\sfSvzCt.exe
  C:\Windows\System\sfSvzCt.exe
  2⤵
  PID:10852
- C:\Windows\System\ZELAEXw.exe
  C:\Windows\System\ZELAEXw.exe
  2⤵
  PID:10964
- C:\Windows\System\kMVSWRz.exe
  C:\Windows\System\kMVSWRz.exe
  2⤵
  PID:11260
- C:\Windows\System\zGKQWmZ.exe
  C:\Windows\System\zGKQWmZ.exe
  2⤵
  PID:10288
- C:\Windows\System\SoeLMPC.exe
  C:\Windows\System\SoeLMPC.exe
  2⤵
  PID:10720
- C:\Windows\System\CpMaUUy.exe
  C:\Windows\System\CpMaUUy.exe
  2⤵
  PID:10960
- C:\Windows\System\cMQleuU.exe
  C:\Windows\System\cMQleuU.exe
  2⤵
  PID:10452
- C:\Windows\System\CovydRU.exe
  C:\Windows\System\CovydRU.exe
  2⤵
  PID:11284
- C:\Windows\System\MgDWCeb.exe
  C:\Windows\System\MgDWCeb.exe
  2⤵
  PID:11308
- C:\Windows\System\SNSSewH.exe
  C:\Windows\System\SNSSewH.exe
  2⤵
  PID:11324
- C:\Windows\System\KGQWmVz.exe
  C:\Windows\System\KGQWmVz.exe
  2⤵
  PID:11368
- C:\Windows\System\mEIiqEj.exe
  C:\Windows\System\mEIiqEj.exe
  2⤵
  PID:11396
- C:\Windows\System\JeJapiF.exe
  C:\Windows\System\JeJapiF.exe
  2⤵
  PID:11416
- C:\Windows\System\DrijWHz.exe
  C:\Windows\System\DrijWHz.exe
  2⤵
  PID:11452
- C:\Windows\System\WvVfcEh.exe
  C:\Windows\System\WvVfcEh.exe
  2⤵
  PID:11472
- C:\Windows\System\GFLGYSG.exe
  C:\Windows\System\GFLGYSG.exe
  2⤵
  PID:11492
- C:\Windows\System\uOPUmEy.exe
  C:\Windows\System\uOPUmEy.exe
  2⤵
  PID:11532
- C:\Windows\System\McfFjYV.exe
  C:\Windows\System\McfFjYV.exe
  2⤵
  PID:11552
- C:\Windows\System\ahuPTRn.exe
  C:\Windows\System\ahuPTRn.exe
  2⤵
  PID:11572
- C:\Windows\System\xrejJeV.exe
  C:\Windows\System\xrejJeV.exe
  2⤵
  PID:11608
- C:\Windows\System\gnwKAJM.exe
  C:\Windows\System\gnwKAJM.exe
  2⤵
  PID:11632
- C:\Windows\System\nMvfzSt.exe
  C:\Windows\System\nMvfzSt.exe
  2⤵
  PID:11648
- C:\Windows\System\jfuDZkB.exe
  C:\Windows\System\jfuDZkB.exe
  2⤵
  PID:11672
- C:\Windows\System\nwmjgzf.exe
  C:\Windows\System\nwmjgzf.exe
  2⤵
  PID:11688
- C:\Windows\System\XwYDUaw.exe
  C:\Windows\System\XwYDUaw.exe
  2⤵
  PID:11748
- C:\Windows\System\jgMvuZA.exe
  C:\Windows\System\jgMvuZA.exe
  2⤵
  PID:11808
- C:\Windows\System\MxceMtd.exe
  C:\Windows\System\MxceMtd.exe
  2⤵
  PID:11828
- C:\Windows\System\qEJtyqv.exe
  C:\Windows\System\qEJtyqv.exe
  2⤵
  PID:11848
- C:\Windows\System\WcnNPlq.exe
  C:\Windows\System\WcnNPlq.exe
  2⤵
  PID:11868
- C:\Windows\System\BXamLHt.exe
  C:\Windows\System\BXamLHt.exe
  2⤵
  PID:11888
- C:\Windows\System\ZLJcWSm.exe
  C:\Windows\System\ZLJcWSm.exe
  2⤵
  PID:11912
- C:\Windows\System\pGUzOxb.exe
  C:\Windows\System\pGUzOxb.exe
  2⤵
  PID:11928
- C:\Windows\System\HIkCPSC.exe
  C:\Windows\System\HIkCPSC.exe
  2⤵
  PID:11956
- C:\Windows\System\YwBOoDy.exe
  C:\Windows\System\YwBOoDy.exe
  2⤵
  PID:11984
- C:\Windows\System\HpUzHrr.exe
  C:\Windows\System\HpUzHrr.exe
  2⤵
  PID:12060
- C:\Windows\System\Njxoucn.exe
  C:\Windows\System\Njxoucn.exe
  2⤵
  PID:12084
- C:\Windows\System\glLyrsV.exe
  C:\Windows\System\glLyrsV.exe
  2⤵
  PID:12136
- C:\Windows\System\gyEaoXv.exe
  C:\Windows\System\gyEaoXv.exe
  2⤵
  PID:12152
- C:\Windows\System\BJbcVAu.exe
  C:\Windows\System\BJbcVAu.exe
  2⤵
  PID:12176
- C:\Windows\System\EfMQnWo.exe
  C:\Windows\System\EfMQnWo.exe
  2⤵
  PID:12192
- C:\Windows\System\ETRzzDd.exe
  C:\Windows\System\ETRzzDd.exe
  2⤵
  PID:12220
- C:\Windows\System\hKNUxjS.exe
  C:\Windows\System\hKNUxjS.exe
  2⤵
  PID:12256
- C:\Windows\System\OCnPJIY.exe
  C:\Windows\System\OCnPJIY.exe
  2⤵
  PID:12280
- C:\Windows\System\PZYnKvL.exe
  C:\Windows\System\PZYnKvL.exe
  2⤵
  PID:10884
- C:\Windows\System\MjkfIsu.exe
  C:\Windows\System\MjkfIsu.exe
  2⤵
  PID:11292
- C:\Windows\System\pWJUVuB.exe
  C:\Windows\System\pWJUVuB.exe
  2⤵
  PID:11316
- C:\Windows\System\rTVOKqv.exe
  C:\Windows\System\rTVOKqv.exe
  2⤵
  PID:11356
- C:\Windows\System\FRQYusd.exe
  C:\Windows\System\FRQYusd.exe
  2⤵
  PID:11444
- C:\Windows\System\qwcfUOw.exe
  C:\Windows\System\qwcfUOw.exe
  2⤵
  PID:11560
- C:\Windows\System\YJziKjQ.exe
  C:\Windows\System\YJziKjQ.exe
  2⤵
  PID:11600
- C:\Windows\System\RjMvKVl.exe
  C:\Windows\System\RjMvKVl.exe
  2⤵
  PID:11620
- C:\Windows\System\WdaeRsz.exe
  C:\Windows\System\WdaeRsz.exe
  2⤵
  PID:11684
- C:\Windows\System\JGJcnRi.exe
  C:\Windows\System\JGJcnRi.exe
  2⤵
  PID:11788
- C:\Windows\System\TuWIsyh.exe
  C:\Windows\System\TuWIsyh.exe
  2⤵
  PID:11816
- C:\Windows\System\DoMmxQw.exe
  C:\Windows\System\DoMmxQw.exe
  2⤵
  PID:11844
- C:\Windows\System\FwmPadl.exe
  C:\Windows\System\FwmPadl.exe
  2⤵
  PID:11924
- C:\Windows\System\VgqIEoG.exe
  C:\Windows\System\VgqIEoG.exe
  2⤵
  PID:11972
- C:\Windows\System\oSFLtKU.exe
  C:\Windows\System\oSFLtKU.exe
  2⤵
  PID:12032
- C:\Windows\System\WhHZCol.exe
  C:\Windows\System\WhHZCol.exe
  2⤵
  PID:12148
- C:\Windows\System\dMBqNAO.exe
  C:\Windows\System\dMBqNAO.exe
  2⤵
  PID:12212
- C:\Windows\System\DiGGlMB.exe
  C:\Windows\System\DiGGlMB.exe
  2⤵
  PID:11340
- C:\Windows\System\HDTRkbg.exe
  C:\Windows\System\HDTRkbg.exe
  2⤵
  PID:11408
- C:\Windows\System\HpWYbOB.exe
  C:\Windows\System\HpWYbOB.exe
  2⤵
  PID:11640
- C:\Windows\System\iTiGmwP.exe
  C:\Windows\System\iTiGmwP.exe
  2⤵
  PID:11616
- C:\Windows\System\bPnQFVl.exe
  C:\Windows\System\bPnQFVl.exe
  2⤵
  PID:11736
- C:\Windows\System\HBrnbny.exe
  C:\Windows\System\HBrnbny.exe
  2⤵
  PID:11012
- C:\Windows\System\YGKcRyY.exe
  C:\Windows\System\YGKcRyY.exe
  2⤵
  PID:11952
- C:\Windows\System\mNYtNXY.exe
  C:\Windows\System\mNYtNXY.exe
  2⤵
  PID:12100
- C:\Windows\System\zDGqyjl.exe
  C:\Windows\System\zDGqyjl.exe
  2⤵
  PID:12144
- C:\Windows\System\eBsyNZj.exe
  C:\Windows\System\eBsyNZj.exe
  2⤵
  PID:10828
- C:\Windows\System\sgAUZZk.exe
  C:\Windows\System\sgAUZZk.exe
  2⤵
  PID:11784
- C:\Windows\System\JQIISic.exe
  C:\Windows\System\JQIISic.exe
  2⤵
  PID:11920
- C:\Windows\System\bAjORRS.exe
  C:\Windows\System\bAjORRS.exe
  2⤵
  PID:12296
- C:\Windows\System\hTmHwgF.exe
  C:\Windows\System\hTmHwgF.exe
  2⤵
  PID:12324
- C:\Windows\System\iXCJukg.exe
  C:\Windows\System\iXCJukg.exe
  2⤵
  PID:12376
- C:\Windows\System\aKmBbLl.exe
  C:\Windows\System\aKmBbLl.exe
  2⤵
  PID:12416
- C:\Windows\System\oMNzBOr.exe
  C:\Windows\System\oMNzBOr.exe
  2⤵
  PID:12484
- C:\Windows\System\AgxDLIL.exe
  C:\Windows\System\AgxDLIL.exe
  2⤵
  PID:12504
- C:\Windows\System\svEAdwn.exe
  C:\Windows\System\svEAdwn.exe
  2⤵
  PID:12520
- C:\Windows\System\uzWLngs.exe
  C:\Windows\System\uzWLngs.exe
  2⤵
  PID:12560
- C:\Windows\System\FjUxSMc.exe
  C:\Windows\System\FjUxSMc.exe
  2⤵
  PID:12600
- C:\Windows\System\XTcwuxf.exe
  C:\Windows\System\XTcwuxf.exe
  2⤵
  PID:12624
- C:\Windows\System\NYLVgkW.exe
  C:\Windows\System\NYLVgkW.exe
  2⤵
  PID:12652
- C:\Windows\System\InDzZvV.exe
  C:\Windows\System\InDzZvV.exe
  2⤵
  PID:12680
- C:\Windows\System\tNxkIdO.exe
  C:\Windows\System\tNxkIdO.exe
  2⤵
  PID:12708
- C:\Windows\System\sDbxGqJ.exe
  C:\Windows\System\sDbxGqJ.exe
  2⤵
  PID:12736
- C:\Windows\System\PeVgGPv.exe
  C:\Windows\System\PeVgGPv.exe
  2⤵
  PID:12756
- C:\Windows\System\QBvxgcz.exe
  C:\Windows\System\QBvxgcz.exe
  2⤵
  PID:12772
- C:\Windows\System\dkrHFCV.exe
  C:\Windows\System\dkrHFCV.exe
  2⤵
  PID:12792
- C:\Windows\System\IgRJFrS.exe
  C:\Windows\System\IgRJFrS.exe
  2⤵
  PID:12844
- C:\Windows\System\VAjDAjN.exe
  C:\Windows\System\VAjDAjN.exe
  2⤵
  PID:12876
- C:\Windows\System\YWaynJJ.exe
  C:\Windows\System\YWaynJJ.exe
  2⤵
  PID:12900
- C:\Windows\System\HWbAZNJ.exe
  C:\Windows\System\HWbAZNJ.exe
  2⤵
  PID:12936
- C:\Windows\System\PPLsZEF.exe
  C:\Windows\System\PPLsZEF.exe
  2⤵
  PID:12960
- C:\Windows\System\KPCGbCH.exe
  C:\Windows\System\KPCGbCH.exe
  2⤵
  PID:13056
- C:\Windows\System\toyAvMj.exe
  C:\Windows\System\toyAvMj.exe
  2⤵
  PID:13160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x1zzwgkr.yqh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EzaonkH.exe

Filesize
1.6MB

MD5
1462940acdbae59b23fc8b64c782cfd3

SHA1
c5650cf8834bfba8d71c24b723521be9d2c96e0d

SHA256
324b64f2875bd120711854f63328311ce66b991c3cbe125a8673230b1900abae

SHA512
5924616ea04c8e71aa3a668fc538ce9503a94de9bfac9641620b14254c51359a0a99501e2607268c582bfcc68a7bfc146c417f315551d01bc56350c98df136ae

Download Submit
C:\Windows\System\FJxTUwN.exe

Filesize
1.6MB

MD5
3901c7c17c873160036b35caf8925e37

SHA1
20a62e911a3bcdbf2e58b2ed4a3b90338adbe044

SHA256
b5721e8214df1cbf83672b145607edfa6062c3d0ece0fc43bfc60dfd356d7876

SHA512
aba76ed923aacdca4a308b3f9db77b9886124ac34feb6ebc5a7176f3f93c1aa5867f2c6e3a9a2bae007b77bbedc4a2469a1d5258bd2a97c98738f2eb9b49a76e

Download Submit
C:\Windows\System\FmxefxI.exe

Filesize
1.6MB

MD5
0523f55568bd9a7462b162191620a2c1

SHA1
a4b9fb1493fe7b493158547e3fbf132612ebb18c

SHA256
db4f01af930bafeaf90ff846f1dffb9900cd346ced7fb1eb3df7a0ad382c4a24

SHA512
1def6928179d7bd0af166696a4970d2d1a47965c49b01c25962159753a467968dcc7884149cb4d92858bb52dd05eabbb7ff308fc826da8787d399e8379289aec

Download Submit
C:\Windows\System\GqNoeVL.exe

Filesize
1.6MB

MD5
67d5da47d3d667d600b2d6f80986634f

SHA1
ed01fb62acf54cb3c7aa3c8e2e20c6c050431f4c

SHA256
a1df553cc0ba6079f17579ecccdc67fa06f41bdb62087fdb25dc82c17c9d5c9c

SHA512
a2590c0d5e750125b753cd637b4029eb157cca3bee9ee46eb715b5e8b7ce3b3fa5b6afbe3888f47cb90f0676a7dd218e6bb0e0986b105a692d1a23a6fef24c20

Download Submit
C:\Windows\System\IQjjVAM.exe

Filesize
1.6MB

MD5
befcb8ac376ab34c3a603bf031bd00a8

SHA1
1c61dcf7a557ae1bbe2692fc594254cd760b926e

SHA256
b56a3fe4b3cda13e5e51b4bb07d36b9d0b684bd8f170d380d1c4d0cdf0151ce3

SHA512
39102833ea1bc287ef05c403b699e1d2e71801f1ca8078855e62d6c4cda147134d463fde99738ad83ea5f2841d1bf410a70a534451a8536a0e8dcd87aab2fa68

Download Submit
C:\Windows\System\IZtIyBd.exe

Filesize
1.6MB

MD5
28d1ebc05b6305d0fd290391d869b9eb

SHA1
cc40890485846de708ad9556c5137f7a2e0b66ba

SHA256
fef15e811b8c4def995bdfcd4d83d0a24a1ff9a0f8d831fb9a7b2f4ada20c448

SHA512
33c5703a1d485bd808632b477f598e0dafaefd3a03f75d7bec4e0bfc54f60516f55c1007ec4d59f4d26075ac431b457159eb3b9b6deef8560525d1ca1d8739cb

Download Submit
C:\Windows\System\IlBdVNl.exe

Filesize
1.6MB

MD5
d57dda4e561cccd21539b936b49a0798

SHA1
d6e41cb2022ab03fb0ef2216f53533ad0ff6385d

SHA256
e9ce5a3721ba537ed0c04f7cad76eab4df51d74fbc16f0e9c2659de66037d2a4

SHA512
a16afa4ffb27b8c08d2eb43693d9e7e6eba60dd26ef8c2ac30818b1b31174636f8861dc830eefaa37e1429abdd3b51e778eb6fa4e77116b6d66ef92b58ae3c73

Download Submit
C:\Windows\System\IyDCewb.exe

Filesize
1.6MB

MD5
93af5755ef895594188c05a97c59dc8c

SHA1
f22e2201437d6b34bf2c08f169b5f1b01d9bffca

SHA256
dbc5d47ad51640c52b996359e5b2eb685f2c9b9e80e35f9a696da59ccfefbd0b

SHA512
b8fd3baebc3b2142c62eeb98f681ba24d206581454925c7203d6b5d3c05527618583ba6ebe873d94fd33a1123a6cc4d149b80f3204867d7db8d598c21f7a3f4b

Download Submit
C:\Windows\System\JheMNdW.exe

Filesize
1.6MB

MD5
aee365d77fc46b22193a588389e08b0b

SHA1
1f4953528ebc107e33b1a419f3bd5f1e8f0c579d

SHA256
2e746c0756ed0bbc73bfeae45443e0c31d7fd9e563d02c9121656fa37a3e1c23

SHA512
61a8130c6481bcbea12fd1eccf6988ee7d193d1ed2c16b81619d7f8162b408cdbabb94b9b689e4d9d910bddfcb611bc3df5af1422cde30da99815059eff97da3

Download Submit
C:\Windows\System\KETuXlN.exe

Filesize
1.6MB

MD5
91a900ce638156e407652a5436705f22

SHA1
85bcc7cab29e764f6bd327871b1b09f0e6c05391

SHA256
7b159dd3ed9cb818b8ebff8e16cbf24f8fe186714ccf9e5f35ce3265aaf9a4f1

SHA512
49a44f06341007d1b57495f8f197381ee8fb0c49ea5616477e1ac9b7be8d5a138d935304c1f97a0779a4ce356b423640d78d0cc3c4d18702d617aa5c5726572c

Download Submit
C:\Windows\System\LGmAkTG.exe

Filesize
1.6MB

MD5
72e1c075bf3a2d6519827a3b74c7705d

SHA1
7e426ff19cfaeb2c21f1c0741457f695e2636642

SHA256
993bca7693a5e6cf1d981d822e6f69e4dab413c57717fd311610de9c6c1fb5d9

SHA512
ac0479fc74e44f76b3f724e19900dda5d6cf30b51a126af044f88d89ed637ee97427a91a8aa3c27ab8b8b2a781eb32929c6d1852768c2f477d0ed4440a6fca08

Download Submit
C:\Windows\System\LVqdghO.exe

Filesize
1.6MB

MD5
e72603787725fd2cd9f2826186ea80f3

SHA1
e973fd69ca9676c511abd465ad5c85d900cb8261

SHA256
9ed4a066ee1850502848f4ab310d0dc1f451d629cc431c08a405013515e6079b

SHA512
677620af0a758bd9ef899c6e7b3b0c3ceb3aa5656e67b7dce21f4d4675d3f8979db11f0bceaa13aaa13d0721d4092743179eabad9857033f2ae00f95b189e283

Download Submit
C:\Windows\System\LYwrbXO.exe

Filesize
1.6MB

MD5
f64b7fa17ce681b5007a3508d81cbc6d

SHA1
03fa6690a2a968bac4c1319459bb4feae2cdf970

SHA256
f7d08c9f6a80a76ab266bddb2ba58bfe763bfe073cea5e41f6bd4ca245c588e1

SHA512
9caf5528d0a85bc0fd179138a64af8a0cae5b958b24072c69128968b3bedbc9dcb55c7cf4a2ca2966d07e6714437c41364d13e62149c7ade98f75fe841412e29

Download Submit
C:\Windows\System\LkYXEKI.exe

Filesize
1.6MB

MD5
eccdd78590a257719e35704b217a7a22

SHA1
edda3bdca2ca63c9edfa6f9b2573aa19e2fd24ec

SHA256
e339a7701ac80c143b2c56df955fccea4559f93d75fdb12af207d63a277ebe42

SHA512
6b3d2814ea690bcab3f51cb7d0c2dc7d650acb35bf64ec6457bf2623405fbf0a63ab9cd0b8ddeb650451b125c77eec02aa8de12732daad66c6f081aceddc2424

Download Submit
C:\Windows\System\MTHSuGq.exe

Filesize
1.6MB

MD5
ec018c60afcbf11fdb7e8868566783ed

SHA1
97527a7e4973c85d27fe71370b773a4741cc057e

SHA256
f4ba6e802fa4d6ba66d67a7d549321a32c51edc5f32004ca3eee3666abf9fc26

SHA512
d3767278372b3594f913cb1d73d10544387793591b1171320c1d06088157e9e19810e93fa7753e8165c815d094a44e42e83a562239f412f5d085ac3f2c220495

Download Submit
C:\Windows\System\NBgLiYt.exe

Filesize
1.6MB

MD5
8407d481c60578afdc8243fc91f7ffe7

SHA1
e5400934df92b2b13497b8d9bb9530675fc25dad

SHA256
a0295a18f2e858b2dd3e0bad1fa7d9b4d9f86bcafe7a3a9c4afcd500aedf8594

SHA512
1aae3442fda43e72d78eae709e5bf031db5b5b49365c3b8450b4aed0e977811091877620f96f98003b5b13cea9ac1ba50b38e7d364a1592cdad6b425fa326f5b

Download Submit
C:\Windows\System\PFnLmCk.exe

Filesize
8B

MD5
6c6a33c852f4e05ffd14cdf0dcab7779

SHA1
70449821f99925d7b8d245181569b7ac4d2ffae8

SHA256
889f3baefc9f46c7632a467db8882ec92f1f0df14da91d5a211e7484de261e45

SHA512
92e5654661ef50c470f84dbec4dcad9efdca5e4026c073f08c798af48c0b5d8107a7b2ff4d63fdb982f371e15d79e95f8a6d716a30b5c5123a7273c49d650d19

Download Submit
C:\Windows\System\TmRrEOk.exe

Filesize
1.6MB

MD5
06c31f19538621d880f16047f4d7173c

SHA1
5bdec3dbd46ab4cb45995e7713aeaf73fb938cad

SHA256
38989b5de662f78bf401dd55bf8b983c3b24db517d89ae7a66260e0887d019fa

SHA512
8ec7db4ea5a661f09580f870be266da01527acd9c9f9eab8f81b72e04d18abb2fff0a2bd86d54324c7ce916882aebef5b0697204d80d998d226e8cdf35df3e39

Download Submit
C:\Windows\System\XZJtYCn.exe

Filesize
1.6MB

MD5
f1db8cc67cadeadb1e8597ffc58e38bf

SHA1
70e273453f80b2e1f08107ae2388079a4ce87eba

SHA256
c747c4175075c10dceef4c3c9e8254def113c02276db94bcee503b819a25afae

SHA512
1dd084c7087419800d085f300b7981d3254c5a3cf401979aacfa50e57ddd8fba9b5e1804347b1a0cae51c08357d4569b049705bd7fbc61d7e0fbc9078bb41beb

Download Submit
C:\Windows\System\YGrCEAG.exe

Filesize
1.6MB

MD5
87f3baccd2510a1f6a71463a56480140

SHA1
6961add553628c3135afb31ccde30ee55464e45b

SHA256
c1c10ba75ceceb418bc9887c87e674affa8e7bc1eafdf7a5719c71edb399da6a

SHA512
df094d03e0247127c0fd3a5c34d173cb00aac7f21708a6175efe0764e2af5f7d7eed54550d641e2cab6f781efd0a35cdf6dfc1a36f41d666d69b40b3c8919c95

Download Submit
C:\Windows\System\ZjnBtOU.exe

Filesize
1.6MB

MD5
15419e37f3a4974d6f1a83ff9e41e9d5

SHA1
6d30b497bc7fe14ee362aad615c31007622de315

SHA256
b1d65f3ebbda81003bee2ba29ebb2864c1dad6b572063c5aed59928175129922

SHA512
72a52b881706163804efd32154b745066f2193162f4a12bf398fb5082102f90e1ae743d83375edd34a985d5f411d1f36c7b102f708c6ae50badb9f1dbf5e91e8

Download Submit
C:\Windows\System\adRHqOk.exe

Filesize
1.6MB

MD5
1ecf6c227f5b7e70d21f63660016d208

SHA1
6ee5103d97b8e3776c961ee4712c653a7fc3dae9

SHA256
dd5a4a6da4cffb8f38d850fdc8436c9cc308397d4a1b90c3d27459fe8d8a614b

SHA512
3897677ea7f9e13698b9b96d67c85777f60a4392b89c5240cb395e23145500e4e4aa40e8e5cd0b19d2b2944b69a14970db72052a543ae11469e6b00d4f436f48

Download Submit
C:\Windows\System\agglcZZ.exe

Filesize
1.6MB

MD5
a25730135fbf9d34807422a8538c48ee

SHA1
4ee72fc55dc004757834eab51581c0fbfbb37240

SHA256
1a20a1a976be9fa0933ac34ef39efc59f2ae4e4ed1163cca18b5a83905b47289

SHA512
705227d9b77aaca31bf66facd3350d619c76dc7660fbdeebba66f5f11c8cb93e9fd8237e3fc6e0f685ba15cf5f13d9d79b13b52efc6434ceb6b7d1059177b83b

Download Submit
C:\Windows\System\ausGznx.exe

Filesize
1.6MB

MD5
1b8ae04d268ee0aa94210e7818fbd7a5

SHA1
b3e4e8097496c2ac4c0fd321b2ba05c100889515

SHA256
76a7293a868fe2ff2da9d9de85a24773e37cce1b00d1c0748deb7877c15a683c

SHA512
28d0d04b6d522d99836fff1f328edcde4a27285c4f9b63c5f22f2a2f835e8299369d744dc50f0bbf82914748f26cdfd538581524d9bacb7396971b536fdfe884

Download Submit
C:\Windows\System\cDrrWMm.exe

Filesize
1.6MB

MD5
1c695292e23cf0e7787556ec16a35afc

SHA1
ebb2902fb88a4578efd8962a47e1bfa23f0da73d

SHA256
140e3d702805c65690e1c906c3b4396c4d98fb73a72bb57326a7f33181d0823e

SHA512
bdf523aa243a00b081c3ae19dc7c78156dc4c3110ced2c4c7bab194510f566f216b29a7219cac8c9e9a8c5df163bffdd8bb92106b3d419ebced9506e266bcb35

Download Submit
C:\Windows\System\cnfjBuH.exe

Filesize
1.6MB

MD5
40496d331f953f512ee7680b003c4cfa

SHA1
73a0f56e2088b8258e532872c8298c02d3b2e016

SHA256
ce1fa466a63b78c25fa0c4b81dcb286988d1625192d3965a93bed41ce5125a13

SHA512
42a7ca385f3dc64def44ef37029dd635ad66170c6a0dbf3e5e0d011a9c9f9ec8a87def1b31eb3dff7cea42b658001b766426664c576220ccbd96c634875691e4

Download Submit
C:\Windows\System\dmMRJVO.exe

Filesize
1.6MB

MD5
3ded76020304e9fc678c2c2e2adfc838

SHA1
8f3cf42529aff961d5a8dc6c8bc771ab7e91d843

SHA256
40fe6412bea537b95189cf98c9b62211a6d532fa6e0b96e9725e793001e3e45b

SHA512
3e187d5e8d2e29f054eec6addf89ef9dc2a8412461a59f1a127ef4343c82b8c6f35c297ffa754e26dec7c630450e8ebe6639a07321d28522c97f56796d1b7700

Download Submit
C:\Windows\System\lEsGsZH.exe

Filesize
1.6MB

MD5
edc82270040589fe3ff42fa2963be56c

SHA1
d0173a000c932edcd87d4532ffc7b18c57fb3c64

SHA256
09dec45e259b41c0b93baceaf2dd1f8732162604f7e7d51d0dccad256cb6b206

SHA512
d1c003a2325bf936c0ff2aba63f99de559acc0851dcc34840fae450ac0a438b397a25b2be7db93723ebda4de46190ada308d25b1423e198306d3abaa2ee6f4e8

Download Submit
C:\Windows\System\mYrWfMc.exe

Filesize
1.6MB

MD5
e80ff5b95ba23c01595c669bd2aa5339

SHA1
4ba0902aa0e3438ab5080979ea3b776e9fca3868

SHA256
abe274289d8bc24a5673deff06699d5f15409cbc2b897d1179e4a4f94e491165

SHA512
49dbb63d9e27a388dda28cd37b3a2e995aee2f226bf05b3ec697d1fab78587dd7d568e131df68c518cda3a91755b1524dcabd43dc8a1330ae2f3dbe13790766e

Download Submit
C:\Windows\System\msLjOau.exe

Filesize
1.6MB

MD5
ce4a7bac866f3fde08108327e5ad63da

SHA1
b838d181a416b1417b723f2ac36befd61c64ec1a

SHA256
14cc64bf4b4e915e65b31fb1dca3437602fed9e6a078e17c9c01d378ca3109cd

SHA512
670101aaa8f1471f8ccc615716218d17afa9b728a6b24e3386428efb74611d24aaac9130ecf3df10660e1a7b0129380c83aa0d62bec09437b324069976640948

Download Submit
C:\Windows\System\ojhaBYe.exe

Filesize
1.6MB

MD5
bb69c4aa85486e61522ce3e058891d50

SHA1
a19da23bbabd3b4885b6db7c3ac1ce6392fa586d

SHA256
dbe8619a755cc2976174b9015b25f88a4f1cee279c5e450c9339b76d86cd97b7

SHA512
d1146230d8b34869b2c05dcde23c48bbfcc6ee8bc31bba33dafeaddde8e99d3d33a6a99ba4aee090d3c8fc10f4db9e1a75ddef8ddc291e26b0b3c5dca64068bb

Download Submit
C:\Windows\System\vPOcsWW.exe

Filesize
1.6MB

MD5
bcc05aaa9027aec3d7a9c5254892fee9

SHA1
ac80558a7eed739dc73f1d0a1ad25600f509675c

SHA256
32373da5820cbe4a7688f0dc79b6f59b56bd1e3cc8d00cccc98b50a569497c99

SHA512
ecc7cb577a6bf6254a156f5b800dfe12491d17bef7d8c3ab88218bae0cebc41f35bc78cd3c9cea783aded154f977344764706763a2448493ae3469a5241a6d76

Download Submit
C:\Windows\System\xpeiLeE.exe

Filesize
1.6MB

MD5
4dafbd6ace7520d3c395432c68531d9c

SHA1
82cfea68e4b72ec50917e836148975b969bdecc4

SHA256
93f62f99b9978899a45d2ad92d77e1b6d3533040f8814b9489bb38f0f65f1b60

SHA512
d6bffe004301a79cbf4eed045dbb60739a5dea47ccfe0296534695212d978f36dfa9926eed162b2bc754a93789f2bf0111311646ed82b72b5de7ea7bc560bda4

Download Submit
C:\Windows\System\xwwDVhd.exe

Filesize
1.6MB

MD5
bf3971a7a38992997be1e4ed8fffbe26

SHA1
75861f3cf9a68c1842d4fdb74d124e976daca5a9

SHA256
aa34e864ec33911a064dce0c9ad17506d0c2b27981a26ed0832080bc2618ad4f

SHA512
8a91eee1b8619ecc01c7b5230c23f94140b632d917deb30ff96c1bff7fa0065f45b6a888741543996195b727f6a1dc5a6777dfb414a4b2360e49a711b029aafc

Download Submit
memory/116-56-0x00007FF69B1E0000-0x00007FF69B5D2000-memory.dmp

Filesize
3.9MB

Download
memory/448-72-0x00007FF6AD7B0000-0x00007FF6ADBA2000-memory.dmp

Filesize
3.9MB

Download
memory/656-369-0x00007FF75CC80000-0x00007FF75D072000-memory.dmp

Filesize
3.9MB

Download
memory/1008-383-0x00007FF76C260000-0x00007FF76C652000-memory.dmp

Filesize
3.9MB

Download
memory/1032-368-0x00007FF6FC200000-0x00007FF6FC5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1200-361-0x00007FF6D8F40000-0x00007FF6D9332000-memory.dmp

Filesize
3.9MB

Download
memory/1724-382-0x00007FF7DB660000-0x00007FF7DBA52000-memory.dmp

Filesize
3.9MB

Download
memory/1776-365-0x00007FF71C6D0000-0x00007FF71CAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1848-403-0x00007FF6C0520000-0x00007FF6C0912000-memory.dmp

Filesize
3.9MB

Download
memory/1864-66-0x00007FF6FFBE0000-0x00007FF6FFFD2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-0-0x00007FF7F96A0000-0x00007FF7F9A92000-memory.dmp

Filesize
3.9MB

Download
memory/1896-1-0x0000022255C80000-0x0000022255C90000-memory.dmp

Filesize
64KB

Download
memory/2304-392-0x00007FF700000000-0x00007FF7003F2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-401-0x00007FF75A080000-0x00007FF75A472000-memory.dmp

Filesize
3.9MB

Download
memory/2476-364-0x00007FF61F390000-0x00007FF61F782000-memory.dmp

Filesize
3.9MB

Download
memory/2828-30-0x00007FFA87600000-0x00007FFA880C1000-memory.dmp

Filesize
10.8MB

Download
memory/2828-35-0x00007FFA87600000-0x00007FFA880C1000-memory.dmp

Filesize
10.8MB

Download
memory/2828-47-0x0000026239580000-0x00000262395A2000-memory.dmp

Filesize
136KB

Download
memory/2828-5-0x00007FFA87603000-0x00007FFA87605000-memory.dmp

Filesize
8KB

Download
memory/2828-388-0x00000262548F0000-0x0000026255096000-memory.dmp

Filesize
7.6MB

Download
memory/3040-61-0x00007FF6B3970000-0x00007FF6B3D62000-memory.dmp

Filesize
3.9MB

Download
memory/3432-363-0x00007FF789440000-0x00007FF789832000-memory.dmp

Filesize
3.9MB

Download
memory/3584-366-0x00007FF60A860000-0x00007FF60AC52000-memory.dmp

Filesize
3.9MB

Download
memory/3912-367-0x00007FF615E50000-0x00007FF616242000-memory.dmp

Filesize
3.9MB

Download
memory/3944-46-0x00007FF727790000-0x00007FF727B82000-memory.dmp

Filesize
3.9MB

Download
memory/4196-372-0x00007FF7289A0000-0x00007FF728D92000-memory.dmp

Filesize
3.9MB

Download
memory/4444-371-0x00007FF6FD170000-0x00007FF6FD562000-memory.dmp

Filesize
3.9MB

Download
memory/4532-376-0x00007FF63C1F0000-0x00007FF63C5E2000-memory.dmp

Filesize
3.9MB

Download
memory/4536-62-0x00007FF658200000-0x00007FF6585F2000-memory.dmp

Filesize
3.9MB

Download
memory/4796-370-0x00007FF676130000-0x00007FF676522000-memory.dmp

Filesize
3.9MB

Download
memory/4800-362-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp

Filesize
3.9MB

Download