xmrig | 51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1

Analysis

max time kernel
120s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
Size

1.8MB
MD5

c889b44d1809d2794bff456aad109da2
SHA1

436099cd046b340694fbf0eb7e1796321170f637
SHA256

51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1
SHA512

31fa0c4c80603e62d48231501fbffd69bd2317b16e23fd8a691671ab8d29001e667af1a6188a862f363729c38753fb564b0b9432f5b1abf09302719bfe42f474
SSDEEP

49152:Lz071uv4BPMkHC0I6GCInhG1dtdF2+Dn+:NABa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1948-429-0x00007FF649650000-0x00007FF649A42000-memory.dmp	xmrig
behavioral2/memory/4592-434-0x00007FF742BF0000-0x00007FF742FE2000-memory.dmp	xmrig
behavioral2/memory/4628-435-0x00007FF783E70000-0x00007FF784262000-memory.dmp	xmrig
behavioral2/memory/928-445-0x00007FF696460000-0x00007FF696852000-memory.dmp	xmrig
behavioral2/memory/4580-449-0x00007FF76C5C0000-0x00007FF76C9B2000-memory.dmp	xmrig
behavioral2/memory/1864-452-0x00007FF7C4B90000-0x00007FF7C4F82000-memory.dmp	xmrig
behavioral2/memory/3208-455-0x00007FF79D8B0000-0x00007FF79DCA2000-memory.dmp	xmrig
behavioral2/memory/2436-457-0x00007FF7A0740000-0x00007FF7A0B32000-memory.dmp	xmrig
behavioral2/memory/3176-460-0x00007FF7F6B50000-0x00007FF7F6F42000-memory.dmp	xmrig
behavioral2/memory/3228-475-0x00007FF7C24A0000-0x00007FF7C2892000-memory.dmp	xmrig
behavioral2/memory/3912-467-0x00007FF74EB20000-0x00007FF74EF12000-memory.dmp	xmrig
behavioral2/memory/4072-456-0x00007FF6DDA00000-0x00007FF6DDDF2000-memory.dmp	xmrig
behavioral2/memory/3348-450-0x00007FF769F40000-0x00007FF76A332000-memory.dmp	xmrig
behavioral2/memory/3444-444-0x00007FF751390000-0x00007FF751782000-memory.dmp	xmrig
behavioral2/memory/3876-440-0x00007FF78FBC0000-0x00007FF78FFB2000-memory.dmp	xmrig
behavioral2/memory/528-437-0x00007FF7869B0000-0x00007FF786DA2000-memory.dmp	xmrig
behavioral2/memory/3628-94-0x00007FF629EB0000-0x00007FF62A2A2000-memory.dmp	xmrig
behavioral2/memory/1960-93-0x00007FF614F70000-0x00007FF615362000-memory.dmp	xmrig
behavioral2/memory/2388-88-0x00007FF79B9A0000-0x00007FF79BD92000-memory.dmp	xmrig
behavioral2/memory/2340-82-0x00007FF7F5DA0000-0x00007FF7F6192000-memory.dmp	xmrig
behavioral2/memory/1124-81-0x00007FF765620000-0x00007FF765A12000-memory.dmp	xmrig
behavioral2/memory/3128-66-0x00007FF7157C0000-0x00007FF715BB2000-memory.dmp	xmrig
behavioral2/memory/4324-57-0x00007FF7B57D0000-0x00007FF7B5BC2000-memory.dmp	xmrig
behavioral2/memory/5096-2001-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	xmrig
behavioral2/memory/4324-2017-0x00007FF7B57D0000-0x00007FF7B5BC2000-memory.dmp	xmrig
behavioral2/memory/3348-2019-0x00007FF769F40000-0x00007FF76A332000-memory.dmp	xmrig
behavioral2/memory/3128-2021-0x00007FF7157C0000-0x00007FF715BB2000-memory.dmp	xmrig
behavioral2/memory/1124-2023-0x00007FF765620000-0x00007FF765A12000-memory.dmp	xmrig
behavioral2/memory/2340-2027-0x00007FF7F5DA0000-0x00007FF7F6192000-memory.dmp	xmrig
behavioral2/memory/1960-2026-0x00007FF614F70000-0x00007FF615362000-memory.dmp	xmrig
behavioral2/memory/4072-2034-0x00007FF6DDA00000-0x00007FF6DDDF2000-memory.dmp	xmrig
behavioral2/memory/3628-2031-0x00007FF629EB0000-0x00007FF62A2A2000-memory.dmp	xmrig
behavioral2/memory/2388-2039-0x00007FF79B9A0000-0x00007FF79BD92000-memory.dmp	xmrig
behavioral2/memory/1948-2037-0x00007FF649650000-0x00007FF649A42000-memory.dmp	xmrig
behavioral2/memory/1864-2035-0x00007FF7C4B90000-0x00007FF7C4F82000-memory.dmp	xmrig
behavioral2/memory/3208-2030-0x00007FF79D8B0000-0x00007FF79DCA2000-memory.dmp	xmrig
behavioral2/memory/3912-2058-0x00007FF74EB20000-0x00007FF74EF12000-memory.dmp	xmrig
behavioral2/memory/3228-2056-0x00007FF7C24A0000-0x00007FF7C2892000-memory.dmp	xmrig
behavioral2/memory/2436-2061-0x00007FF7A0740000-0x00007FF7A0B32000-memory.dmp	xmrig
behavioral2/memory/4580-2064-0x00007FF76C5C0000-0x00007FF76C9B2000-memory.dmp	xmrig
behavioral2/memory/4592-2054-0x00007FF742BF0000-0x00007FF742FE2000-memory.dmp	xmrig
behavioral2/memory/4628-2051-0x00007FF783E70000-0x00007FF784262000-memory.dmp	xmrig
behavioral2/memory/3876-2050-0x00007FF78FBC0000-0x00007FF78FFB2000-memory.dmp	xmrig
behavioral2/memory/528-2047-0x00007FF7869B0000-0x00007FF786DA2000-memory.dmp	xmrig
behavioral2/memory/5096-2043-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	xmrig
behavioral2/memory/3176-2060-0x00007FF7F6B50000-0x00007FF7F6F42000-memory.dmp	xmrig
behavioral2/memory/3444-2046-0x00007FF751390000-0x00007FF751782000-memory.dmp	xmrig
behavioral2/memory/928-2042-0x00007FF696460000-0x00007FF696852000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	4988	powershell.exe
5	4988	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4988	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3348	btRoXtY.exe
4324	lrHYCao.exe
3128	wCJHHLy.exe
1124	SOCpcWr.exe
2340	KmtiVHJ.exe
1864	OtaLAPg.exe
2388	OvQwtqA.exe
1960	TwvjqcJ.exe
3208	oTYBeSB.exe
3628	KJNmtgo.exe
4072	SJsfPJJ.exe
5096	JodVugm.exe
1948	LzYGMwd.exe
2436	mlSmXaF.exe
3176	wZxVmXH.exe
3912	YuZTePT.exe
3228	gEFYwXz.exe
4592	RBiirbi.exe
4628	KYMPzLS.exe
528	YOHUhJJ.exe
3876	ZxyLmYk.exe
3444	YlolbJw.exe
928	ynVKmSm.exe
4580	hWJbpzi.exe
3952	rSrhjuI.exe
3112	awsJMpA.exe
4684	vAvGvZp.exe
3216	rlNRqYL.exe
2696	UEGvTnA.exe
4112	bIHBPly.exe
4744	gguzyks.exe
3608	JpaaSwL.exe
1084	fMrPsLa.exe
1148	guFFrlF.exe
2108	RxeaCUf.exe
2896	unFYXqf.exe
212	TwtYNEf.exe
3052	OyOAhAH.exe
3124	SIqjZAd.exe
3896	NYLNjmf.exe
1140	mbdGOdr.exe
1684	soqMOat.exe
4400	ALLJgmO.exe
1072	ikZTmsL.exe
4432	eAmGIUQ.exe
64	CQHLjFB.exe
4976	AEUDiKW.exe
2088	ZvLugQC.exe
3576	gmQjGKI.exe
2616	saGRhfQ.exe
1860	NCgoAiS.exe
3636	xLcXJcp.exe
3380	AZyqEVl.exe
1496	RJVqiYC.exe
4992	qXxJNnI.exe
3872	YAEGwTM.exe
3080	pZlHKjB.exe
1344	vrFkaAF.exe
2384	XaYUzjh.exe
2716	ZuqiXkf.exe
4008	oyrhQQz.exe
2084	CDWrvvP.exe
3092	llUYeNB.exe
2148	VPMazpl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/564-0-0x00007FF7FC640000-0x00007FF7FCA32000-memory.dmp	upx
behavioral2/files/0x0007000000023256-6.dat	upx
behavioral2/files/0x0008000000023427-8.dat	upx
behavioral2/files/0x0008000000023424-9.dat	upx
behavioral2/files/0x0007000000023428-19.dat	upx
behavioral2/files/0x000700000002342a-31.dat	upx
behavioral2/files/0x000700000002342c-47.dat	upx
behavioral2/files/0x0007000000023429-46.dat	upx
behavioral2/files/0x000700000002342b-45.dat	upx
behavioral2/files/0x0007000000023430-68.dat	upx
behavioral2/files/0x0007000000023431-74.dat	upx
behavioral2/files/0x0007000000023432-85.dat	upx
behavioral2/files/0x0007000000023433-90.dat	upx
behavioral2/files/0x0007000000023434-97.dat	upx
behavioral2/files/0x0008000000023425-112.dat	upx
behavioral2/files/0x0007000000023436-122.dat	upx
behavioral2/files/0x0007000000023438-132.dat	upx
behavioral2/files/0x000700000002343b-139.dat	upx
behavioral2/files/0x000700000002343d-149.dat	upx
behavioral2/files/0x000700000002343e-162.dat	upx
behavioral2/files/0x0007000000023440-172.dat	upx
behavioral2/memory/1948-429-0x00007FF649650000-0x00007FF649A42000-memory.dmp	upx
behavioral2/memory/4592-434-0x00007FF742BF0000-0x00007FF742FE2000-memory.dmp	upx
behavioral2/memory/4628-435-0x00007FF783E70000-0x00007FF784262000-memory.dmp	upx
behavioral2/memory/928-445-0x00007FF696460000-0x00007FF696852000-memory.dmp	upx
behavioral2/memory/4580-449-0x00007FF76C5C0000-0x00007FF76C9B2000-memory.dmp	upx
behavioral2/memory/1864-452-0x00007FF7C4B90000-0x00007FF7C4F82000-memory.dmp	upx
behavioral2/memory/3208-455-0x00007FF79D8B0000-0x00007FF79DCA2000-memory.dmp	upx
behavioral2/memory/2436-457-0x00007FF7A0740000-0x00007FF7A0B32000-memory.dmp	upx
behavioral2/memory/3176-460-0x00007FF7F6B50000-0x00007FF7F6F42000-memory.dmp	upx
behavioral2/memory/3228-475-0x00007FF7C24A0000-0x00007FF7C2892000-memory.dmp	upx
behavioral2/memory/3912-467-0x00007FF74EB20000-0x00007FF74EF12000-memory.dmp	upx
behavioral2/memory/4072-456-0x00007FF6DDA00000-0x00007FF6DDDF2000-memory.dmp	upx
behavioral2/memory/3348-450-0x00007FF769F40000-0x00007FF76A332000-memory.dmp	upx
behavioral2/memory/3444-444-0x00007FF751390000-0x00007FF751782000-memory.dmp	upx
behavioral2/memory/3876-440-0x00007FF78FBC0000-0x00007FF78FFB2000-memory.dmp	upx
behavioral2/memory/528-437-0x00007FF7869B0000-0x00007FF786DA2000-memory.dmp	upx
behavioral2/files/0x0007000000023444-184.dat	upx
behavioral2/files/0x0007000000023442-182.dat	upx
behavioral2/files/0x0007000000023443-179.dat	upx
behavioral2/files/0x0007000000023441-177.dat	upx
behavioral2/files/0x000700000002343f-167.dat	upx
behavioral2/files/0x000700000002343c-152.dat	upx
behavioral2/files/0x000700000002343a-142.dat	upx
behavioral2/files/0x0007000000023439-137.dat	upx
behavioral2/files/0x0007000000023437-127.dat	upx
behavioral2/files/0x0007000000023435-117.dat	upx
behavioral2/memory/5096-99-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	upx
behavioral2/memory/3628-94-0x00007FF629EB0000-0x00007FF62A2A2000-memory.dmp	upx
behavioral2/memory/1960-93-0x00007FF614F70000-0x00007FF615362000-memory.dmp	upx
behavioral2/memory/2388-88-0x00007FF79B9A0000-0x00007FF79BD92000-memory.dmp	upx
behavioral2/memory/2340-82-0x00007FF7F5DA0000-0x00007FF7F6192000-memory.dmp	upx
behavioral2/memory/1124-81-0x00007FF765620000-0x00007FF765A12000-memory.dmp	upx
behavioral2/files/0x000700000002342f-77.dat	upx
behavioral2/files/0x000800000002342d-72.dat	upx
behavioral2/files/0x000800000002342e-73.dat	upx
behavioral2/memory/3128-66-0x00007FF7157C0000-0x00007FF715BB2000-memory.dmp	upx
behavioral2/memory/4324-57-0x00007FF7B57D0000-0x00007FF7B5BC2000-memory.dmp	upx
behavioral2/memory/5096-2001-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp	upx
behavioral2/memory/4324-2017-0x00007FF7B57D0000-0x00007FF7B5BC2000-memory.dmp	upx
behavioral2/memory/3348-2019-0x00007FF769F40000-0x00007FF76A332000-memory.dmp	upx
behavioral2/memory/3128-2021-0x00007FF7157C0000-0x00007FF715BB2000-memory.dmp	upx
behavioral2/memory/1124-2023-0x00007FF765620000-0x00007FF765A12000-memory.dmp	upx
behavioral2/memory/2340-2027-0x00007FF7F5DA0000-0x00007FF7F6192000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PBlkORd.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\yOmeInq.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\DmPaNML.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\YNAaCiT.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\pgevYke.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\NzcQmOA.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\ontlmba.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\wuRpoyJ.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\fJJNfUe.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\emYaAuS.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\tIvXHVR.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\VVhrJeM.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\QATMUWc.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\MnEBCQz.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\QGiqDeS.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\vNIBJcC.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\UvLpqhj.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\ArUFghm.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\PMPafAR.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\ROLmdbS.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\wwyGCBH.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\FKYYuaR.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\XYmtOiJ.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\UvsnFbC.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\UGCIRZg.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\ZxyLmYk.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\HVFiyDo.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\qBYnwPp.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\CoxCHeS.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\Epeepji.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\TwtYNEf.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\wltAbcu.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\JBjaRwe.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\eUwTjZm.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\VhvIxAp.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\KJNmtgo.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\pZlHKjB.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\jPkipUI.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\ssUPKjZ.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\orNvZNP.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\GzvUucN.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\wIZJask.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\RBiirbi.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\uDFAEqs.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\QdFsTNA.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\nzDkamX.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\AyGFhmy.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\gIFpdCb.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\yLLnAtE.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\mjlUjlB.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\YFWxvjv.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\AyYyAsd.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\SSuGWHD.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\BXldQeJ.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\iLjvKtz.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\xURybQj.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\cNVssuP.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\AEdtsmu.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\YLsTnKy.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\gBoHpSf.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\TETMnOQ.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\kVFqAXX.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\lQJZxCn.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
File created	C:\Windows\System\BCdQDqX.exe	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4988	powershell.exe
4988	powershell.exe
4988	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
Token: SeLockMemoryPrivilege	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
Token: SeDebugPrivilege	4988	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 4988	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	81
PID 564 wrote to memory of 4988	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	81
PID 564 wrote to memory of 3348	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	82
PID 564 wrote to memory of 3348	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	82
PID 564 wrote to memory of 4324	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	83
PID 564 wrote to memory of 4324	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	83
PID 564 wrote to memory of 3128	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	84
PID 564 wrote to memory of 3128	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	84
PID 564 wrote to memory of 1124	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	85
PID 564 wrote to memory of 1124	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	85
PID 564 wrote to memory of 2340	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	86
PID 564 wrote to memory of 2340	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	86
PID 564 wrote to memory of 1864	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	87
PID 564 wrote to memory of 1864	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	87
PID 564 wrote to memory of 2388	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	88
PID 564 wrote to memory of 2388	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	88
PID 564 wrote to memory of 1960	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	89
PID 564 wrote to memory of 1960	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	89
PID 564 wrote to memory of 4072	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	90
PID 564 wrote to memory of 4072	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	90
PID 564 wrote to memory of 3208	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	91
PID 564 wrote to memory of 3208	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	91
PID 564 wrote to memory of 3628	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	92
PID 564 wrote to memory of 3628	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	92
PID 564 wrote to memory of 5096	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	93
PID 564 wrote to memory of 5096	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	93
PID 564 wrote to memory of 1948	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	94
PID 564 wrote to memory of 1948	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	94
PID 564 wrote to memory of 2436	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	95
PID 564 wrote to memory of 2436	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	95
PID 564 wrote to memory of 3176	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	96
PID 564 wrote to memory of 3176	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	96
PID 564 wrote to memory of 3912	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	97
PID 564 wrote to memory of 3912	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	97
PID 564 wrote to memory of 3228	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	98
PID 564 wrote to memory of 3228	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	98
PID 564 wrote to memory of 4592	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	99
PID 564 wrote to memory of 4592	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	99
PID 564 wrote to memory of 4628	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	100
PID 564 wrote to memory of 4628	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	100
PID 564 wrote to memory of 528	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	101
PID 564 wrote to memory of 528	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	101
PID 564 wrote to memory of 3876	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	102
PID 564 wrote to memory of 3876	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	102
PID 564 wrote to memory of 3444	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	103
PID 564 wrote to memory of 3444	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	103
PID 564 wrote to memory of 928	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	104
PID 564 wrote to memory of 928	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	104
PID 564 wrote to memory of 4580	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	105
PID 564 wrote to memory of 4580	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	105
PID 564 wrote to memory of 3952	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	106
PID 564 wrote to memory of 3952	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	106
PID 564 wrote to memory of 3112	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	107
PID 564 wrote to memory of 3112	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	107
PID 564 wrote to memory of 4684	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	108
PID 564 wrote to memory of 4684	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	108
PID 564 wrote to memory of 3216	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	109
PID 564 wrote to memory of 3216	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	109
PID 564 wrote to memory of 2696	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	110
PID 564 wrote to memory of 2696	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	110
PID 564 wrote to memory of 4112	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	111
PID 564 wrote to memory of 4112	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	111
PID 564 wrote to memory of 4744	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	112
PID 564 wrote to memory of 4744	564	51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe	112

C:\Users\Admin\AppData\Local\Temp\51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe
"C:\Users\Admin\AppData\Local\Temp\51baed0def12493e8dd6d0bf3c28ca36ef49ff71774c871156c33d6072033ac1.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4988" "2968" "2936" "2972" "0" "0" "2976" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12772
- C:\Windows\System\btRoXtY.exe
  C:\Windows\System\btRoXtY.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\lrHYCao.exe
  C:\Windows\System\lrHYCao.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\wCJHHLy.exe
  C:\Windows\System\wCJHHLy.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\SOCpcWr.exe
  C:\Windows\System\SOCpcWr.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\KmtiVHJ.exe
  C:\Windows\System\KmtiVHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\OtaLAPg.exe
  C:\Windows\System\OtaLAPg.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\OvQwtqA.exe
  C:\Windows\System\OvQwtqA.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\TwvjqcJ.exe
  C:\Windows\System\TwvjqcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\SJsfPJJ.exe
  C:\Windows\System\SJsfPJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\oTYBeSB.exe
  C:\Windows\System\oTYBeSB.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\KJNmtgo.exe
  C:\Windows\System\KJNmtgo.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\JodVugm.exe
  C:\Windows\System\JodVugm.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\LzYGMwd.exe
  C:\Windows\System\LzYGMwd.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\mlSmXaF.exe
  C:\Windows\System\mlSmXaF.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\wZxVmXH.exe
  C:\Windows\System\wZxVmXH.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\YuZTePT.exe
  C:\Windows\System\YuZTePT.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\gEFYwXz.exe
  C:\Windows\System\gEFYwXz.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\RBiirbi.exe
  C:\Windows\System\RBiirbi.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\KYMPzLS.exe
  C:\Windows\System\KYMPzLS.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\YOHUhJJ.exe
  C:\Windows\System\YOHUhJJ.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\ZxyLmYk.exe
  C:\Windows\System\ZxyLmYk.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\YlolbJw.exe
  C:\Windows\System\YlolbJw.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\ynVKmSm.exe
  C:\Windows\System\ynVKmSm.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\hWJbpzi.exe
  C:\Windows\System\hWJbpzi.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\rSrhjuI.exe
  C:\Windows\System\rSrhjuI.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\awsJMpA.exe
  C:\Windows\System\awsJMpA.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\vAvGvZp.exe
  C:\Windows\System\vAvGvZp.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\rlNRqYL.exe
  C:\Windows\System\rlNRqYL.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\UEGvTnA.exe
  C:\Windows\System\UEGvTnA.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\bIHBPly.exe
  C:\Windows\System\bIHBPly.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\gguzyks.exe
  C:\Windows\System\gguzyks.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\JpaaSwL.exe
  C:\Windows\System\JpaaSwL.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\fMrPsLa.exe
  C:\Windows\System\fMrPsLa.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\guFFrlF.exe
  C:\Windows\System\guFFrlF.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\RxeaCUf.exe
  C:\Windows\System\RxeaCUf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\unFYXqf.exe
  C:\Windows\System\unFYXqf.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\TwtYNEf.exe
  C:\Windows\System\TwtYNEf.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\OyOAhAH.exe
  C:\Windows\System\OyOAhAH.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\SIqjZAd.exe
  C:\Windows\System\SIqjZAd.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\NYLNjmf.exe
  C:\Windows\System\NYLNjmf.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\mbdGOdr.exe
  C:\Windows\System\mbdGOdr.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\soqMOat.exe
  C:\Windows\System\soqMOat.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\ALLJgmO.exe
  C:\Windows\System\ALLJgmO.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ikZTmsL.exe
  C:\Windows\System\ikZTmsL.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\eAmGIUQ.exe
  C:\Windows\System\eAmGIUQ.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\CQHLjFB.exe
  C:\Windows\System\CQHLjFB.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\AEUDiKW.exe
  C:\Windows\System\AEUDiKW.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\ZvLugQC.exe
  C:\Windows\System\ZvLugQC.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\gmQjGKI.exe
  C:\Windows\System\gmQjGKI.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\saGRhfQ.exe
  C:\Windows\System\saGRhfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\NCgoAiS.exe
  C:\Windows\System\NCgoAiS.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\xLcXJcp.exe
  C:\Windows\System\xLcXJcp.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\AZyqEVl.exe
  C:\Windows\System\AZyqEVl.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\RJVqiYC.exe
  C:\Windows\System\RJVqiYC.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\qXxJNnI.exe
  C:\Windows\System\qXxJNnI.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\YAEGwTM.exe
  C:\Windows\System\YAEGwTM.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\pZlHKjB.exe
  C:\Windows\System\pZlHKjB.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\vrFkaAF.exe
  C:\Windows\System\vrFkaAF.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\XaYUzjh.exe
  C:\Windows\System\XaYUzjh.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ZuqiXkf.exe
  C:\Windows\System\ZuqiXkf.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\oyrhQQz.exe
  C:\Windows\System\oyrhQQz.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\CDWrvvP.exe
  C:\Windows\System\CDWrvvP.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\llUYeNB.exe
  C:\Windows\System\llUYeNB.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\VPMazpl.exe
  C:\Windows\System\VPMazpl.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\MNLinti.exe
  C:\Windows\System\MNLinti.exe
  2⤵
  PID:912
- C:\Windows\System\QpRFjYU.exe
  C:\Windows\System\QpRFjYU.exe
  2⤵
  PID:2564
- C:\Windows\System\pgQYMJn.exe
  C:\Windows\System\pgQYMJn.exe
  2⤵
  PID:2296
- C:\Windows\System\DRyjovZ.exe
  C:\Windows\System\DRyjovZ.exe
  2⤵
  PID:1612
- C:\Windows\System\ZzSrHCG.exe
  C:\Windows\System\ZzSrHCG.exe
  2⤵
  PID:4620
- C:\Windows\System\RpFCdGA.exe
  C:\Windows\System\RpFCdGA.exe
  2⤵
  PID:4316
- C:\Windows\System\EyENyrL.exe
  C:\Windows\System\EyENyrL.exe
  2⤵
  PID:3600
- C:\Windows\System\sTDYyGZ.exe
  C:\Windows\System\sTDYyGZ.exe
  2⤵
  PID:4856
- C:\Windows\System\egIvsHb.exe
  C:\Windows\System\egIvsHb.exe
  2⤵
  PID:724
- C:\Windows\System\TUfKzhN.exe
  C:\Windows\System\TUfKzhN.exe
  2⤵
  PID:2496
- C:\Windows\System\wxWyIrK.exe
  C:\Windows\System\wxWyIrK.exe
  2⤵
  PID:436
- C:\Windows\System\cqhlncN.exe
  C:\Windows\System\cqhlncN.exe
  2⤵
  PID:4908
- C:\Windows\System\fJJNfUe.exe
  C:\Windows\System\fJJNfUe.exe
  2⤵
  PID:4408
- C:\Windows\System\AzyqHjA.exe
  C:\Windows\System\AzyqHjA.exe
  2⤵
  PID:2548
- C:\Windows\System\wSlKqxs.exe
  C:\Windows\System\wSlKqxs.exe
  2⤵
  PID:5132
- C:\Windows\System\tyUYGVM.exe
  C:\Windows\System\tyUYGVM.exe
  2⤵
  PID:5160
- C:\Windows\System\DYSAoIk.exe
  C:\Windows\System\DYSAoIk.exe
  2⤵
  PID:5188
- C:\Windows\System\PVaozxG.exe
  C:\Windows\System\PVaozxG.exe
  2⤵
  PID:5212
- C:\Windows\System\MLbOyDJ.exe
  C:\Windows\System\MLbOyDJ.exe
  2⤵
  PID:5240
- C:\Windows\System\SzgdhmI.exe
  C:\Windows\System\SzgdhmI.exe
  2⤵
  PID:5268
- C:\Windows\System\WDZMSuc.exe
  C:\Windows\System\WDZMSuc.exe
  2⤵
  PID:5300
- C:\Windows\System\ecZNMez.exe
  C:\Windows\System\ecZNMez.exe
  2⤵
  PID:5328
- C:\Windows\System\MvMhgyd.exe
  C:\Windows\System\MvMhgyd.exe
  2⤵
  PID:5352
- C:\Windows\System\WPIUGBF.exe
  C:\Windows\System\WPIUGBF.exe
  2⤵
  PID:5388
- C:\Windows\System\kdqUEPX.exe
  C:\Windows\System\kdqUEPX.exe
  2⤵
  PID:5412
- C:\Windows\System\uEicKWr.exe
  C:\Windows\System\uEicKWr.exe
  2⤵
  PID:5444
- C:\Windows\System\OPvyfZP.exe
  C:\Windows\System\OPvyfZP.exe
  2⤵
  PID:5472
- C:\Windows\System\uLUkAiy.exe
  C:\Windows\System\uLUkAiy.exe
  2⤵
  PID:5500
- C:\Windows\System\TDXjCaf.exe
  C:\Windows\System\TDXjCaf.exe
  2⤵
  PID:5528
- C:\Windows\System\ZWuYpsU.exe
  C:\Windows\System\ZWuYpsU.exe
  2⤵
  PID:5556
- C:\Windows\System\LAEGRLs.exe
  C:\Windows\System\LAEGRLs.exe
  2⤵
  PID:5580
- C:\Windows\System\lRTzOlX.exe
  C:\Windows\System\lRTzOlX.exe
  2⤵
  PID:5608
- C:\Windows\System\uVjeVoc.exe
  C:\Windows\System\uVjeVoc.exe
  2⤵
  PID:5640
- C:\Windows\System\AyGFhmy.exe
  C:\Windows\System\AyGFhmy.exe
  2⤵
  PID:5660
- C:\Windows\System\vNIBJcC.exe
  C:\Windows\System\vNIBJcC.exe
  2⤵
  PID:5692
- C:\Windows\System\vmMnfYE.exe
  C:\Windows\System\vmMnfYE.exe
  2⤵
  PID:5724
- C:\Windows\System\tQgpbLT.exe
  C:\Windows\System\tQgpbLT.exe
  2⤵
  PID:5756
- C:\Windows\System\ZioMUNz.exe
  C:\Windows\System\ZioMUNz.exe
  2⤵
  PID:5788
- C:\Windows\System\iSLaxVC.exe
  C:\Windows\System\iSLaxVC.exe
  2⤵
  PID:5816
- C:\Windows\System\cluPaPX.exe
  C:\Windows\System\cluPaPX.exe
  2⤵
  PID:5844
- C:\Windows\System\pVWOVza.exe
  C:\Windows\System\pVWOVza.exe
  2⤵
  PID:5872
- C:\Windows\System\atOdDOv.exe
  C:\Windows\System\atOdDOv.exe
  2⤵
  PID:5900
- C:\Windows\System\OjZxneO.exe
  C:\Windows\System\OjZxneO.exe
  2⤵
  PID:5928
- C:\Windows\System\HVFiyDo.exe
  C:\Windows\System\HVFiyDo.exe
  2⤵
  PID:5956
- C:\Windows\System\ivDsUqh.exe
  C:\Windows\System\ivDsUqh.exe
  2⤵
  PID:5988
- C:\Windows\System\mkrrvOJ.exe
  C:\Windows\System\mkrrvOJ.exe
  2⤵
  PID:6012
- C:\Windows\System\HBKFCWq.exe
  C:\Windows\System\HBKFCWq.exe
  2⤵
  PID:6044
- C:\Windows\System\FuPPFqx.exe
  C:\Windows\System\FuPPFqx.exe
  2⤵
  PID:6068
- C:\Windows\System\vCrcKRw.exe
  C:\Windows\System\vCrcKRw.exe
  2⤵
  PID:6096
- C:\Windows\System\zvuwPPU.exe
  C:\Windows\System\zvuwPPU.exe
  2⤵
  PID:6124
- C:\Windows\System\cCPIVJJ.exe
  C:\Windows\System\cCPIVJJ.exe
  2⤵
  PID:4036
- C:\Windows\System\vbbmOyf.exe
  C:\Windows\System\vbbmOyf.exe
  2⤵
  PID:5124
- C:\Windows\System\sOqyVMS.exe
  C:\Windows\System\sOqyVMS.exe
  2⤵
  PID:5176
- C:\Windows\System\eEJLTeQ.exe
  C:\Windows\System\eEJLTeQ.exe
  2⤵
  PID:5232
- C:\Windows\System\VVhrJeM.exe
  C:\Windows\System\VVhrJeM.exe
  2⤵
  PID:5260
- C:\Windows\System\GrxYCHT.exe
  C:\Windows\System\GrxYCHT.exe
  2⤵
  PID:5372
- C:\Windows\System\DrcFqkZ.exe
  C:\Windows\System\DrcFqkZ.exe
  2⤵
  PID:5432
- C:\Windows\System\emYaAuS.exe
  C:\Windows\System\emYaAuS.exe
  2⤵
  PID:5484
- C:\Windows\System\ZBVFHol.exe
  C:\Windows\System\ZBVFHol.exe
  2⤵
  PID:5104
- C:\Windows\System\uDFAEqs.exe
  C:\Windows\System\uDFAEqs.exe
  2⤵
  PID:5576
- C:\Windows\System\TryuxOn.exe
  C:\Windows\System\TryuxOn.exe
  2⤵
  PID:5628
- C:\Windows\System\ObdxXKD.exe
  C:\Windows\System\ObdxXKD.exe
  2⤵
  PID:5672
- C:\Windows\System\jCkYuCc.exe
  C:\Windows\System\jCkYuCc.exe
  2⤵
  PID:5716
- C:\Windows\System\fHOKSee.exe
  C:\Windows\System\fHOKSee.exe
  2⤵
  PID:3416
- C:\Windows\System\zDZaZgf.exe
  C:\Windows\System\zDZaZgf.exe
  2⤵
  PID:4080
- C:\Windows\System\RbJzHje.exe
  C:\Windows\System\RbJzHje.exe
  2⤵
  PID:1620
- C:\Windows\System\zKhEpbG.exe
  C:\Windows\System\zKhEpbG.exe
  2⤵
  PID:5920
- C:\Windows\System\kFTHBHS.exe
  C:\Windows\System\kFTHBHS.exe
  2⤵
  PID:5948
- C:\Windows\System\xmmBkiU.exe
  C:\Windows\System\xmmBkiU.exe
  2⤵
  PID:5976
- C:\Windows\System\DBoakQL.exe
  C:\Windows\System\DBoakQL.exe
  2⤵
  PID:1004
- C:\Windows\System\VHtvpTV.exe
  C:\Windows\System\VHtvpTV.exe
  2⤵
  PID:1388
- C:\Windows\System\PBlkORd.exe
  C:\Windows\System\PBlkORd.exe
  2⤵
  PID:6064
- C:\Windows\System\SlViapQ.exe
  C:\Windows\System\SlViapQ.exe
  2⤵
  PID:464
- C:\Windows\System\QATMUWc.exe
  C:\Windows\System\QATMUWc.exe
  2⤵
  PID:6140
- C:\Windows\System\YtNSjTw.exe
  C:\Windows\System\YtNSjTw.exe
  2⤵
  PID:3412
- C:\Windows\System\bhmjmSQ.exe
  C:\Windows\System\bhmjmSQ.exe
  2⤵
  PID:4840
- C:\Windows\System\EiOtBEH.exe
  C:\Windows\System\EiOtBEH.exe
  2⤵
  PID:5256
- C:\Windows\System\GGmFWXN.exe
  C:\Windows\System\GGmFWXN.exe
  2⤵
  PID:228
- C:\Windows\System\nUqtTtE.exe
  C:\Windows\System\nUqtTtE.exe
  2⤵
  PID:5464
- C:\Windows\System\UcSezTO.exe
  C:\Windows\System\UcSezTO.exe
  2⤵
  PID:5520
- C:\Windows\System\GgLalxE.exe
  C:\Windows\System\GgLalxE.exe
  2⤵
  PID:5652
- C:\Windows\System\TMeerUi.exe
  C:\Windows\System\TMeerUi.exe
  2⤵
  PID:5712
- C:\Windows\System\YIxMFoh.exe
  C:\Windows\System\YIxMFoh.exe
  2⤵
  PID:4452
- C:\Windows\System\EwFxQWy.exe
  C:\Windows\System\EwFxQWy.exe
  2⤵
  PID:5868
- C:\Windows\System\NrmRXOA.exe
  C:\Windows\System\NrmRXOA.exe
  2⤵
  PID:4960
- C:\Windows\System\TETMnOQ.exe
  C:\Windows\System\TETMnOQ.exe
  2⤵
  PID:6088
- C:\Windows\System\JQAWPVq.exe
  C:\Windows\System\JQAWPVq.exe
  2⤵
  PID:5396
- C:\Windows\System\wbJUSFg.exe
  C:\Windows\System\wbJUSFg.exe
  2⤵
  PID:4004
- C:\Windows\System\LSWBaoE.exe
  C:\Windows\System\LSWBaoE.exe
  2⤵
  PID:3224
- C:\Windows\System\EjquoQn.exe
  C:\Windows\System\EjquoQn.exe
  2⤵
  PID:1112
- C:\Windows\System\HiRrmTW.exe
  C:\Windows\System\HiRrmTW.exe
  2⤵
  PID:5200
- C:\Windows\System\VaElnjQ.exe
  C:\Windows\System\VaElnjQ.exe
  2⤵
  PID:5428
- C:\Windows\System\gmRTNTj.exe
  C:\Windows\System\gmRTNTj.exe
  2⤵
  PID:5748
- C:\Windows\System\vqBZTje.exe
  C:\Windows\System\vqBZTje.exe
  2⤵
  PID:5840
- C:\Windows\System\aOmWRGq.exe
  C:\Windows\System\aOmWRGq.exe
  2⤵
  PID:6000
- C:\Windows\System\LceAROz.exe
  C:\Windows\System\LceAROz.exe
  2⤵
  PID:6112
- C:\Windows\System\qXpLgZU.exe
  C:\Windows\System\qXpLgZU.exe
  2⤵
  PID:1180
- C:\Windows\System\ZhWMzPM.exe
  C:\Windows\System\ZhWMzPM.exe
  2⤵
  PID:1576
- C:\Windows\System\escfbKw.exe
  C:\Windows\System\escfbKw.exe
  2⤵
  PID:2272
- C:\Windows\System\EzXslet.exe
  C:\Windows\System\EzXslet.exe
  2⤵
  PID:5836
- C:\Windows\System\cQxfIgn.exe
  C:\Windows\System\cQxfIgn.exe
  2⤵
  PID:2500
- C:\Windows\System\XrGenFw.exe
  C:\Windows\System\XrGenFw.exe
  2⤵
  PID:4300
- C:\Windows\System\JZoYSFJ.exe
  C:\Windows\System\JZoYSFJ.exe
  2⤵
  PID:1396
- C:\Windows\System\LBQKMwf.exe
  C:\Windows\System\LBQKMwf.exe
  2⤵
  PID:1136
- C:\Windows\System\eILUuNh.exe
  C:\Windows\System\eILUuNh.exe
  2⤵
  PID:6164
- C:\Windows\System\qBYnwPp.exe
  C:\Windows\System\qBYnwPp.exe
  2⤵
  PID:6180
- C:\Windows\System\JrtVuSb.exe
  C:\Windows\System\JrtVuSb.exe
  2⤵
  PID:6204
- C:\Windows\System\guuMkFw.exe
  C:\Windows\System\guuMkFw.exe
  2⤵
  PID:6264
- C:\Windows\System\AlGqhZa.exe
  C:\Windows\System\AlGqhZa.exe
  2⤵
  PID:6292
- C:\Windows\System\xWTYAJI.exe
  C:\Windows\System\xWTYAJI.exe
  2⤵
  PID:6332
- C:\Windows\System\jgplQcO.exe
  C:\Windows\System\jgplQcO.exe
  2⤵
  PID:6348
- C:\Windows\System\DgXNZNJ.exe
  C:\Windows\System\DgXNZNJ.exe
  2⤵
  PID:6400
- C:\Windows\System\dPmXkMn.exe
  C:\Windows\System\dPmXkMn.exe
  2⤵
  PID:6420
- C:\Windows\System\ModUFdN.exe
  C:\Windows\System\ModUFdN.exe
  2⤵
  PID:6444
- C:\Windows\System\UdMBhot.exe
  C:\Windows\System\UdMBhot.exe
  2⤵
  PID:6484
- C:\Windows\System\BtPjeUI.exe
  C:\Windows\System\BtPjeUI.exe
  2⤵
  PID:6520
- C:\Windows\System\CCdTBEV.exe
  C:\Windows\System\CCdTBEV.exe
  2⤵
  PID:6536
- C:\Windows\System\nVtLbQo.exe
  C:\Windows\System\nVtLbQo.exe
  2⤵
  PID:6580
- C:\Windows\System\AplLTxb.exe
  C:\Windows\System\AplLTxb.exe
  2⤵
  PID:6600
- C:\Windows\System\xseHsBf.exe
  C:\Windows\System\xseHsBf.exe
  2⤵
  PID:6628
- C:\Windows\System\hPQxQYP.exe
  C:\Windows\System\hPQxQYP.exe
  2⤵
  PID:6660
- C:\Windows\System\qpZRuMR.exe
  C:\Windows\System\qpZRuMR.exe
  2⤵
  PID:6688
- C:\Windows\System\QUhamqZ.exe
  C:\Windows\System\QUhamqZ.exe
  2⤵
  PID:6716
- C:\Windows\System\jxlveST.exe
  C:\Windows\System\jxlveST.exe
  2⤵
  PID:6736
- C:\Windows\System\NzcQmOA.exe
  C:\Windows\System\NzcQmOA.exe
  2⤵
  PID:6756
- C:\Windows\System\FBFNZwF.exe
  C:\Windows\System\FBFNZwF.exe
  2⤵
  PID:6784
- C:\Windows\System\CoxCHeS.exe
  C:\Windows\System\CoxCHeS.exe
  2⤵
  PID:6808
- C:\Windows\System\fyfrixV.exe
  C:\Windows\System\fyfrixV.exe
  2⤵
  PID:6828
- C:\Windows\System\TpFtpbv.exe
  C:\Windows\System\TpFtpbv.exe
  2⤵
  PID:6860
- C:\Windows\System\nAEtzyI.exe
  C:\Windows\System\nAEtzyI.exe
  2⤵
  PID:6880
- C:\Windows\System\zvBJZzl.exe
  C:\Windows\System\zvBJZzl.exe
  2⤵
  PID:6908
- C:\Windows\System\BXldQeJ.exe
  C:\Windows\System\BXldQeJ.exe
  2⤵
  PID:6924
- C:\Windows\System\fJAbuQv.exe
  C:\Windows\System\fJAbuQv.exe
  2⤵
  PID:6968
- C:\Windows\System\dHItRqk.exe
  C:\Windows\System\dHItRqk.exe
  2⤵
  PID:7000
- C:\Windows\System\OdGcpOZ.exe
  C:\Windows\System\OdGcpOZ.exe
  2⤵
  PID:7028
- C:\Windows\System\EnuBOhu.exe
  C:\Windows\System\EnuBOhu.exe
  2⤵
  PID:7068
- C:\Windows\System\yTmTqmU.exe
  C:\Windows\System\yTmTqmU.exe
  2⤵
  PID:7092
- C:\Windows\System\znuBsUp.exe
  C:\Windows\System\znuBsUp.exe
  2⤵
  PID:7144
- C:\Windows\System\aEiqycj.exe
  C:\Windows\System\aEiqycj.exe
  2⤵
  PID:7164
- C:\Windows\System\qxjnnQd.exe
  C:\Windows\System\qxjnnQd.exe
  2⤵
  PID:6248
- C:\Windows\System\rmEVYqw.exe
  C:\Windows\System\rmEVYqw.exe
  2⤵
  PID:6172
- C:\Windows\System\bWHNyKW.exe
  C:\Windows\System\bWHNyKW.exe
  2⤵
  PID:6312
- C:\Windows\System\iLjvKtz.exe
  C:\Windows\System\iLjvKtz.exe
  2⤵
  PID:6344
- C:\Windows\System\dmCEHbY.exe
  C:\Windows\System\dmCEHbY.exe
  2⤵
  PID:6440
- C:\Windows\System\keEaQte.exe
  C:\Windows\System\keEaQte.exe
  2⤵
  PID:6464
- C:\Windows\System\FPXULcY.exe
  C:\Windows\System\FPXULcY.exe
  2⤵
  PID:6560
- C:\Windows\System\ZtSbPqV.exe
  C:\Windows\System\ZtSbPqV.exe
  2⤵
  PID:6596
- C:\Windows\System\KjPHYZW.exe
  C:\Windows\System\KjPHYZW.exe
  2⤵
  PID:6644
- C:\Windows\System\pTedPSJ.exe
  C:\Windows\System\pTedPSJ.exe
  2⤵
  PID:6732
- C:\Windows\System\QdFsTNA.exe
  C:\Windows\System\QdFsTNA.exe
  2⤵
  PID:6752
- C:\Windows\System\qashvjr.exe
  C:\Windows\System\qashvjr.exe
  2⤵
  PID:6820
- C:\Windows\System\ouMpNFM.exe
  C:\Windows\System\ouMpNFM.exe
  2⤵
  PID:6872
- C:\Windows\System\XAzZrfP.exe
  C:\Windows\System\XAzZrfP.exe
  2⤵
  PID:6948
- C:\Windows\System\PKxlCzc.exe
  C:\Windows\System\PKxlCzc.exe
  2⤵
  PID:3480
- C:\Windows\System\JXjIyVF.exe
  C:\Windows\System\JXjIyVF.exe
  2⤵
  PID:6996
- C:\Windows\System\nuIToYp.exe
  C:\Windows\System\nuIToYp.exe
  2⤵
  PID:1924
- C:\Windows\System\CPnnTBI.exe
  C:\Windows\System\CPnnTBI.exe
  2⤵
  PID:7128
- C:\Windows\System\MmJUAlO.exe
  C:\Windows\System\MmJUAlO.exe
  2⤵
  PID:7156
- C:\Windows\System\oMllMnc.exe
  C:\Windows\System\oMllMnc.exe
  2⤵
  PID:6232
- C:\Windows\System\KfQtoVk.exe
  C:\Windows\System\KfQtoVk.exe
  2⤵
  PID:6368
- C:\Windows\System\RmarQhg.exe
  C:\Windows\System\RmarQhg.exe
  2⤵
  PID:6556
- C:\Windows\System\QvQAlJm.exe
  C:\Windows\System\QvQAlJm.exe
  2⤵
  PID:6592
- C:\Windows\System\jPkipUI.exe
  C:\Windows\System\jPkipUI.exe
  2⤵
  PID:6620
- C:\Windows\System\oJMrZzn.exe
  C:\Windows\System\oJMrZzn.exe
  2⤵
  PID:6156
- C:\Windows\System\UeMFhKQ.exe
  C:\Windows\System\UeMFhKQ.exe
  2⤵
  PID:6284
- C:\Windows\System\plYyFEh.exe
  C:\Windows\System\plYyFEh.exe
  2⤵
  PID:6436
- C:\Windows\System\IRVYSkf.exe
  C:\Windows\System\IRVYSkf.exe
  2⤵
  PID:7048
- C:\Windows\System\xsEUtjk.exe
  C:\Windows\System\xsEUtjk.exe
  2⤵
  PID:7060
- C:\Windows\System\QQAANNu.exe
  C:\Windows\System\QQAANNu.exe
  2⤵
  PID:6956
- C:\Windows\System\QsIcFxQ.exe
  C:\Windows\System\QsIcFxQ.exe
  2⤵
  PID:7184
- C:\Windows\System\tNYZEwo.exe
  C:\Windows\System\tNYZEwo.exe
  2⤵
  PID:7224
- C:\Windows\System\oNnjPSO.exe
  C:\Windows\System\oNnjPSO.exe
  2⤵
  PID:7272
- C:\Windows\System\sLwIpSQ.exe
  C:\Windows\System\sLwIpSQ.exe
  2⤵
  PID:7300
- C:\Windows\System\wltAbcu.exe
  C:\Windows\System\wltAbcu.exe
  2⤵
  PID:7316
- C:\Windows\System\yHITQWE.exe
  C:\Windows\System\yHITQWE.exe
  2⤵
  PID:7340
- C:\Windows\System\KNtnRxq.exe
  C:\Windows\System\KNtnRxq.exe
  2⤵
  PID:7360
- C:\Windows\System\fReAASR.exe
  C:\Windows\System\fReAASR.exe
  2⤵
  PID:7380
- C:\Windows\System\DEiELIC.exe
  C:\Windows\System\DEiELIC.exe
  2⤵
  PID:7420
- C:\Windows\System\OjMmVly.exe
  C:\Windows\System\OjMmVly.exe
  2⤵
  PID:7444
- C:\Windows\System\OgjWvFj.exe
  C:\Windows\System\OgjWvFj.exe
  2⤵
  PID:7504
- C:\Windows\System\FFuQRhU.exe
  C:\Windows\System\FFuQRhU.exe
  2⤵
  PID:7532
- C:\Windows\System\IClsAVr.exe
  C:\Windows\System\IClsAVr.exe
  2⤵
  PID:7548
- C:\Windows\System\bRFJHbB.exe
  C:\Windows\System\bRFJHbB.exe
  2⤵
  PID:7572
- C:\Windows\System\iRVKFAf.exe
  C:\Windows\System\iRVKFAf.exe
  2⤵
  PID:7592
- C:\Windows\System\uDdYHPA.exe
  C:\Windows\System\uDdYHPA.exe
  2⤵
  PID:7652
- C:\Windows\System\sCavHnA.exe
  C:\Windows\System\sCavHnA.exe
  2⤵
  PID:7680
- C:\Windows\System\pFnLZFr.exe
  C:\Windows\System\pFnLZFr.exe
  2⤵
  PID:7724
- C:\Windows\System\XYmtOiJ.exe
  C:\Windows\System\XYmtOiJ.exe
  2⤵
  PID:7744
- C:\Windows\System\kiNzaSp.exe
  C:\Windows\System\kiNzaSp.exe
  2⤵
  PID:7776
- C:\Windows\System\EUOjESn.exe
  C:\Windows\System\EUOjESn.exe
  2⤵
  PID:7800
- C:\Windows\System\UvLpqhj.exe
  C:\Windows\System\UvLpqhj.exe
  2⤵
  PID:7824
- C:\Windows\System\pIOoQow.exe
  C:\Windows\System\pIOoQow.exe
  2⤵
  PID:7844
- C:\Windows\System\qRNdSYS.exe
  C:\Windows\System\qRNdSYS.exe
  2⤵
  PID:7872
- C:\Windows\System\TfCPSLj.exe
  C:\Windows\System\TfCPSLj.exe
  2⤵
  PID:7896
- C:\Windows\System\hHYaRUV.exe
  C:\Windows\System\hHYaRUV.exe
  2⤵
  PID:7924
- C:\Windows\System\BJXGcVv.exe
  C:\Windows\System\BJXGcVv.exe
  2⤵
  PID:7948
- C:\Windows\System\nDdZaSy.exe
  C:\Windows\System\nDdZaSy.exe
  2⤵
  PID:7968
- C:\Windows\System\OSRGbCk.exe
  C:\Windows\System\OSRGbCk.exe
  2⤵
  PID:7988
- C:\Windows\System\iDczXRx.exe
  C:\Windows\System\iDczXRx.exe
  2⤵
  PID:8044
- C:\Windows\System\CgatVfP.exe
  C:\Windows\System\CgatVfP.exe
  2⤵
  PID:8064
- C:\Windows\System\ddwWven.exe
  C:\Windows\System\ddwWven.exe
  2⤵
  PID:8084
- C:\Windows\System\rmobRzG.exe
  C:\Windows\System\rmobRzG.exe
  2⤵
  PID:8108
- C:\Windows\System\yOmeInq.exe
  C:\Windows\System\yOmeInq.exe
  2⤵
  PID:8144
- C:\Windows\System\omouFQo.exe
  C:\Windows\System\omouFQo.exe
  2⤵
  PID:8160
- C:\Windows\System\rhyuFRS.exe
  C:\Windows\System\rhyuFRS.exe
  2⤵
  PID:7120
- C:\Windows\System\kbJwAwx.exe
  C:\Windows\System\kbJwAwx.exe
  2⤵
  PID:7180
- C:\Windows\System\lglGOAQ.exe
  C:\Windows\System\lglGOAQ.exe
  2⤵
  PID:7280
- C:\Windows\System\bvdCCQM.exe
  C:\Windows\System\bvdCCQM.exe
  2⤵
  PID:7220
- C:\Windows\System\ehGQoJP.exe
  C:\Windows\System\ehGQoJP.exe
  2⤵
  PID:7356
- C:\Windows\System\IFoKLhx.exe
  C:\Windows\System\IFoKLhx.exe
  2⤵
  PID:7544
- C:\Windows\System\IpVudpO.exe
  C:\Windows\System\IpVudpO.exe
  2⤵
  PID:7620
- C:\Windows\System\neSrqPc.exe
  C:\Windows\System\neSrqPc.exe
  2⤵
  PID:7628
- C:\Windows\System\nhtCaID.exe
  C:\Windows\System\nhtCaID.exe
  2⤵
  PID:7676
- C:\Windows\System\UvsnFbC.exe
  C:\Windows\System\UvsnFbC.exe
  2⤵
  PID:7736
- C:\Windows\System\GFJLSwN.exe
  C:\Windows\System\GFJLSwN.exe
  2⤵
  PID:7784
- C:\Windows\System\eNyZRPA.exe
  C:\Windows\System\eNyZRPA.exe
  2⤵
  PID:7932
- C:\Windows\System\OzUyVyh.exe
  C:\Windows\System\OzUyVyh.exe
  2⤵
  PID:8000
- C:\Windows\System\jXTgbbF.exe
  C:\Windows\System\jXTgbbF.exe
  2⤵
  PID:8016
- C:\Windows\System\dIauRhg.exe
  C:\Windows\System\dIauRhg.exe
  2⤵
  PID:8104
- C:\Windows\System\dEFoPXU.exe
  C:\Windows\System\dEFoPXU.exe
  2⤵
  PID:8152
- C:\Windows\System\CYHXVox.exe
  C:\Windows\System\CYHXVox.exe
  2⤵
  PID:7336
- C:\Windows\System\EQeBeKY.exe
  C:\Windows\System\EQeBeKY.exe
  2⤵
  PID:7428
- C:\Windows\System\xURybQj.exe
  C:\Windows\System\xURybQj.exe
  2⤵
  PID:7556
- C:\Windows\System\SMpmGZp.exe
  C:\Windows\System\SMpmGZp.exe
  2⤵
  PID:7768
- C:\Windows\System\IyFMmwR.exe
  C:\Windows\System\IyFMmwR.exe
  2⤵
  PID:7812
- C:\Windows\System\xlecOdB.exe
  C:\Windows\System\xlecOdB.exe
  2⤵
  PID:7868
- C:\Windows\System\FoSJnrE.exe
  C:\Windows\System\FoSJnrE.exe
  2⤵
  PID:7980
- C:\Windows\System\hIQFqnF.exe
  C:\Windows\System\hIQFqnF.exe
  2⤵
  PID:8136
- C:\Windows\System\LPmTdZG.exe
  C:\Windows\System\LPmTdZG.exe
  2⤵
  PID:7496
- C:\Windows\System\WZHUMSo.exe
  C:\Windows\System\WZHUMSo.exe
  2⤵
  PID:7892
- C:\Windows\System\KfHOCqz.exe
  C:\Windows\System\KfHOCqz.exe
  2⤵
  PID:8056
- C:\Windows\System\YeDTuHy.exe
  C:\Windows\System\YeDTuHy.exe
  2⤵
  PID:8212
- C:\Windows\System\hGGelRe.exe
  C:\Windows\System\hGGelRe.exe
  2⤵
  PID:8248
- C:\Windows\System\DmPaNML.exe
  C:\Windows\System\DmPaNML.exe
  2⤵
  PID:8268
- C:\Windows\System\ontlmba.exe
  C:\Windows\System\ontlmba.exe
  2⤵
  PID:8296
- C:\Windows\System\cNVssuP.exe
  C:\Windows\System\cNVssuP.exe
  2⤵
  PID:8332
- C:\Windows\System\dnlKdvP.exe
  C:\Windows\System\dnlKdvP.exe
  2⤵
  PID:8360
- C:\Windows\System\KtnNkaS.exe
  C:\Windows\System\KtnNkaS.exe
  2⤵
  PID:8388
- C:\Windows\System\oAwPxSg.exe
  C:\Windows\System\oAwPxSg.exe
  2⤵
  PID:8412
- C:\Windows\System\rCJNsHk.exe
  C:\Windows\System\rCJNsHk.exe
  2⤵
  PID:8432
- C:\Windows\System\NgaLlKF.exe
  C:\Windows\System\NgaLlKF.exe
  2⤵
  PID:8492
- C:\Windows\System\zcecQvx.exe
  C:\Windows\System\zcecQvx.exe
  2⤵
  PID:8512
- C:\Windows\System\OtCHBLT.exe
  C:\Windows\System\OtCHBLT.exe
  2⤵
  PID:8532
- C:\Windows\System\MJInRcF.exe
  C:\Windows\System\MJInRcF.exe
  2⤵
  PID:8556
- C:\Windows\System\ZPKxQLE.exe
  C:\Windows\System\ZPKxQLE.exe
  2⤵
  PID:8580
- C:\Windows\System\wNegexF.exe
  C:\Windows\System\wNegexF.exe
  2⤵
  PID:8608
- C:\Windows\System\tvDWInZ.exe
  C:\Windows\System\tvDWInZ.exe
  2⤵
  PID:8628
- C:\Windows\System\ENyknJQ.exe
  C:\Windows\System\ENyknJQ.exe
  2⤵
  PID:8672
- C:\Windows\System\vdeEQBP.exe
  C:\Windows\System\vdeEQBP.exe
  2⤵
  PID:8700
- C:\Windows\System\YzxSAwv.exe
  C:\Windows\System\YzxSAwv.exe
  2⤵
  PID:8716
- C:\Windows\System\sWoYYJx.exe
  C:\Windows\System\sWoYYJx.exe
  2⤵
  PID:8740
- C:\Windows\System\yUbVzpG.exe
  C:\Windows\System\yUbVzpG.exe
  2⤵
  PID:8760
- C:\Windows\System\RRBJFUW.exe
  C:\Windows\System\RRBJFUW.exe
  2⤵
  PID:8820
- C:\Windows\System\GgnbByK.exe
  C:\Windows\System\GgnbByK.exe
  2⤵
  PID:8848
- C:\Windows\System\JDpXLgi.exe
  C:\Windows\System\JDpXLgi.exe
  2⤵
  PID:8868
- C:\Windows\System\JBlpzVH.exe
  C:\Windows\System\JBlpzVH.exe
  2⤵
  PID:8892
- C:\Windows\System\otxsMUP.exe
  C:\Windows\System\otxsMUP.exe
  2⤵
  PID:8908
- C:\Windows\System\BGHZRBq.exe
  C:\Windows\System\BGHZRBq.exe
  2⤵
  PID:8940
- C:\Windows\System\wiRzUKl.exe
  C:\Windows\System\wiRzUKl.exe
  2⤵
  PID:8992
- C:\Windows\System\NBiAauw.exe
  C:\Windows\System\NBiAauw.exe
  2⤵
  PID:9016
- C:\Windows\System\IMsvXqG.exe
  C:\Windows\System\IMsvXqG.exe
  2⤵
  PID:9036
- C:\Windows\System\IqPGTmK.exe
  C:\Windows\System\IqPGTmK.exe
  2⤵
  PID:9056
- C:\Windows\System\PfzQDWa.exe
  C:\Windows\System\PfzQDWa.exe
  2⤵
  PID:9076
- C:\Windows\System\KXQCIRJ.exe
  C:\Windows\System\KXQCIRJ.exe
  2⤵
  PID:9100
- C:\Windows\System\EFCnixk.exe
  C:\Windows\System\EFCnixk.exe
  2⤵
  PID:9132
- C:\Windows\System\FMNdlTn.exe
  C:\Windows\System\FMNdlTn.exe
  2⤵
  PID:9168
- C:\Windows\System\bkFSBmv.exe
  C:\Windows\System\bkFSBmv.exe
  2⤵
  PID:7568
- C:\Windows\System\JBjaRwe.exe
  C:\Windows\System\JBjaRwe.exe
  2⤵
  PID:7796
- C:\Windows\System\tLKmjVJ.exe
  C:\Windows\System\tLKmjVJ.exe
  2⤵
  PID:8260
- C:\Windows\System\wpHcvpC.exe
  C:\Windows\System\wpHcvpC.exe
  2⤵
  PID:8256
- C:\Windows\System\rxTvEjw.exe
  C:\Windows\System\rxTvEjw.exe
  2⤵
  PID:8340
- C:\Windows\System\nzDkamX.exe
  C:\Windows\System\nzDkamX.exe
  2⤵
  PID:8404
- C:\Windows\System\whZQGXX.exe
  C:\Windows\System\whZQGXX.exe
  2⤵
  PID:8500
- C:\Windows\System\ptrwifA.exe
  C:\Windows\System\ptrwifA.exe
  2⤵
  PID:7712
- C:\Windows\System\MUzNSFo.exe
  C:\Windows\System\MUzNSFo.exe
  2⤵
  PID:8648
- C:\Windows\System\oftJVxi.exe
  C:\Windows\System\oftJVxi.exe
  2⤵
  PID:8708
- C:\Windows\System\nDirCnt.exe
  C:\Windows\System\nDirCnt.exe
  2⤵
  PID:8840
- C:\Windows\System\MrILoND.exe
  C:\Windows\System\MrILoND.exe
  2⤵
  PID:8956
- C:\Windows\System\zlrqeoz.exe
  C:\Windows\System\zlrqeoz.exe
  2⤵
  PID:8936
- C:\Windows\System\VurmvOt.exe
  C:\Windows\System\VurmvOt.exe
  2⤵
  PID:9008
- C:\Windows\System\hYlWskG.exe
  C:\Windows\System\hYlWskG.exe
  2⤵
  PID:9024
- C:\Windows\System\CrLzccC.exe
  C:\Windows\System\CrLzccC.exe
  2⤵
  PID:9072
- C:\Windows\System\GgJLXyZ.exe
  C:\Windows\System\GgJLXyZ.exe
  2⤵
  PID:9124
- C:\Windows\System\zvjnnVm.exe
  C:\Windows\System\zvjnnVm.exe
  2⤵
  PID:9164
- C:\Windows\System\QISMaID.exe
  C:\Windows\System\QISMaID.exe
  2⤵
  PID:8752
- C:\Windows\System\hWcYmqR.exe
  C:\Windows\System\hWcYmqR.exe
  2⤵
  PID:8812
- C:\Windows\System\LgGJRcm.exe
  C:\Windows\System\LgGJRcm.exe
  2⤵
  PID:8552
- C:\Windows\System\lRZfxHD.exe
  C:\Windows\System\lRZfxHD.exe
  2⤵
  PID:8688
- C:\Windows\System\CTTgpSC.exe
  C:\Windows\System\CTTgpSC.exe
  2⤵
  PID:9064
- C:\Windows\System\XxhxLFZ.exe
  C:\Windows\System\XxhxLFZ.exe
  2⤵
  PID:9156
- C:\Windows\System\dhyIgUM.exe
  C:\Windows\System\dhyIgUM.exe
  2⤵
  PID:9224
- C:\Windows\System\wQyUsyB.exe
  C:\Windows\System\wQyUsyB.exe
  2⤵
  PID:9240
- C:\Windows\System\vsnRSFI.exe
  C:\Windows\System\vsnRSFI.exe
  2⤵
  PID:9260
- C:\Windows\System\zFzEJTi.exe
  C:\Windows\System\zFzEJTi.exe
  2⤵
  PID:9332
- C:\Windows\System\Epeepji.exe
  C:\Windows\System\Epeepji.exe
  2⤵
  PID:9452
- C:\Windows\System\BTQuvIo.exe
  C:\Windows\System\BTQuvIo.exe
  2⤵
  PID:9488
- C:\Windows\System\RwduvLI.exe
  C:\Windows\System\RwduvLI.exe
  2⤵
  PID:9504
- C:\Windows\System\fDpQIRP.exe
  C:\Windows\System\fDpQIRP.exe
  2⤵
  PID:9528
- C:\Windows\System\jsJpPnA.exe
  C:\Windows\System\jsJpPnA.exe
  2⤵
  PID:9572
- C:\Windows\System\UqcUjpm.exe
  C:\Windows\System\UqcUjpm.exe
  2⤵
  PID:9588
- C:\Windows\System\ArUFghm.exe
  C:\Windows\System\ArUFghm.exe
  2⤵
  PID:9616
- C:\Windows\System\suhtmLB.exe
  C:\Windows\System\suhtmLB.exe
  2⤵
  PID:9644
- C:\Windows\System\CWpugyT.exe
  C:\Windows\System\CWpugyT.exe
  2⤵
  PID:9668
- C:\Windows\System\mxUXDFa.exe
  C:\Windows\System\mxUXDFa.exe
  2⤵
  PID:9688
- C:\Windows\System\OdzcIyU.exe
  C:\Windows\System\OdzcIyU.exe
  2⤵
  PID:9736
- C:\Windows\System\YmcgVMn.exe
  C:\Windows\System\YmcgVMn.exe
  2⤵
  PID:9772
- C:\Windows\System\TxXkcdJ.exe
  C:\Windows\System\TxXkcdJ.exe
  2⤵
  PID:9792
- C:\Windows\System\wOZapfW.exe
  C:\Windows\System\wOZapfW.exe
  2⤵
  PID:9824
- C:\Windows\System\cxEyPTg.exe
  C:\Windows\System\cxEyPTg.exe
  2⤵
  PID:9864
- C:\Windows\System\MBMuSwh.exe
  C:\Windows\System\MBMuSwh.exe
  2⤵
  PID:9884
- C:\Windows\System\jCJMPfg.exe
  C:\Windows\System\jCJMPfg.exe
  2⤵
  PID:9924
- C:\Windows\System\csSfzat.exe
  C:\Windows\System\csSfzat.exe
  2⤵
  PID:9940
- C:\Windows\System\ssUPKjZ.exe
  C:\Windows\System\ssUPKjZ.exe
  2⤵
  PID:9960
- C:\Windows\System\tfGtZuf.exe
  C:\Windows\System\tfGtZuf.exe
  2⤵
  PID:9988
- C:\Windows\System\YNAaCiT.exe
  C:\Windows\System\YNAaCiT.exe
  2⤵
  PID:10008
- C:\Windows\System\qhNjyvF.exe
  C:\Windows\System\qhNjyvF.exe
  2⤵
  PID:10068
- C:\Windows\System\DCfrAOZ.exe
  C:\Windows\System\DCfrAOZ.exe
  2⤵
  PID:10088
- C:\Windows\System\wuRpoyJ.exe
  C:\Windows\System\wuRpoyJ.exe
  2⤵
  PID:10112
- C:\Windows\System\mYQTRRw.exe
  C:\Windows\System\mYQTRRw.exe
  2⤵
  PID:10148
- C:\Windows\System\uhBOcfI.exe
  C:\Windows\System\uhBOcfI.exe
  2⤵
  PID:10164
- C:\Windows\System\zjvUpEO.exe
  C:\Windows\System\zjvUpEO.exe
  2⤵
  PID:10188
- C:\Windows\System\IJmvody.exe
  C:\Windows\System\IJmvody.exe
  2⤵
  PID:10212
- C:\Windows\System\dgJsjtC.exe
  C:\Windows\System\dgJsjtC.exe
  2⤵
  PID:10232
- C:\Windows\System\RRWNRTD.exe
  C:\Windows\System\RRWNRTD.exe
  2⤵
  PID:8724
- C:\Windows\System\DQCpHmX.exe
  C:\Windows\System\DQCpHmX.exe
  2⤵
  PID:8984
- C:\Windows\System\orNvZNP.exe
  C:\Windows\System\orNvZNP.exe
  2⤵
  PID:8228
- C:\Windows\System\ypyPwHb.exe
  C:\Windows\System\ypyPwHb.exe
  2⤵
  PID:8396
- C:\Windows\System\sCtjfxA.exe
  C:\Windows\System\sCtjfxA.exe
  2⤵
  PID:8732
- C:\Windows\System\OrquPHz.exe
  C:\Windows\System\OrquPHz.exe
  2⤵
  PID:9048
- C:\Windows\System\pEgzQEW.exe
  C:\Windows\System\pEgzQEW.exe
  2⤵
  PID:9304
- C:\Windows\System\aYiHvrP.exe
  C:\Windows\System\aYiHvrP.exe
  2⤵
  PID:9280
- C:\Windows\System\LIOVbnD.exe
  C:\Windows\System\LIOVbnD.exe
  2⤵
  PID:9500
- C:\Windows\System\BUtqACM.exe
  C:\Windows\System\BUtqACM.exe
  2⤵
  PID:9512
- C:\Windows\System\UhujgWC.exe
  C:\Windows\System\UhujgWC.exe
  2⤵
  PID:9684
- C:\Windows\System\pgevYke.exe
  C:\Windows\System\pgevYke.exe
  2⤵
  PID:9712
- C:\Windows\System\ICEqcNQ.exe
  C:\Windows\System\ICEqcNQ.exe
  2⤵
  PID:9744
- C:\Windows\System\xOgSagt.exe
  C:\Windows\System\xOgSagt.exe
  2⤵
  PID:9784
- C:\Windows\System\kVFqAXX.exe
  C:\Windows\System\kVFqAXX.exe
  2⤵
  PID:9848
- C:\Windows\System\yuXQjzS.exe
  C:\Windows\System\yuXQjzS.exe
  2⤵
  PID:9920
- C:\Windows\System\wxhVWpq.exe
  C:\Windows\System\wxhVWpq.exe
  2⤵
  PID:10000
- C:\Windows\System\UIGtcjr.exe
  C:\Windows\System\UIGtcjr.exe
  2⤵
  PID:10084
- C:\Windows\System\UHIaxZv.exe
  C:\Windows\System\UHIaxZv.exe
  2⤵
  PID:10160
- C:\Windows\System\mWdQIAb.exe
  C:\Windows\System\mWdQIAb.exe
  2⤵
  PID:10196
- C:\Windows\System\GTjHeOb.exe
  C:\Windows\System\GTjHeOb.exe
  2⤵
  PID:10228
- C:\Windows\System\TljgJxR.exe
  C:\Windows\System\TljgJxR.exe
  2⤵
  PID:8408
- C:\Windows\System\SjySoul.exe
  C:\Windows\System\SjySoul.exe
  2⤵
  PID:8528
- C:\Windows\System\lUSkGzy.exe
  C:\Windows\System\lUSkGzy.exe
  2⤵
  PID:8932
- C:\Windows\System\UmppBbX.exe
  C:\Windows\System\UmppBbX.exe
  2⤵
  PID:9236
- C:\Windows\System\znXUPKm.exe
  C:\Windows\System\znXUPKm.exe
  2⤵
  PID:9428
- C:\Windows\System\AyWKDBV.exe
  C:\Windows\System\AyWKDBV.exe
  2⤵
  PID:9596
- C:\Windows\System\zKbycDD.exe
  C:\Windows\System\zKbycDD.exe
  2⤵
  PID:9764
- C:\Windows\System\sZjYqVS.exe
  C:\Windows\System\sZjYqVS.exe
  2⤵
  PID:9876
- C:\Windows\System\JRrSing.exe
  C:\Windows\System\JRrSing.exe
  2⤵
  PID:10076
- C:\Windows\System\rRcFAPp.exe
  C:\Windows\System\rRcFAPp.exe
  2⤵
  PID:8236
- C:\Windows\System\ztRDBiS.exe
  C:\Windows\System\ztRDBiS.exe
  2⤵
  PID:9384
- C:\Windows\System\MZjyRln.exe
  C:\Windows\System\MZjyRln.exe
  2⤵
  PID:9660
- C:\Windows\System\cErnReX.exe
  C:\Windows\System\cErnReX.exe
  2⤵
  PID:10124
- C:\Windows\System\wvHqXMy.exe
  C:\Windows\System\wvHqXMy.exe
  2⤵
  PID:10180
- C:\Windows\System\eFOwBrI.exe
  C:\Windows\System\eFOwBrI.exe
  2⤵
  PID:10256
- C:\Windows\System\HgZxQKP.exe
  C:\Windows\System\HgZxQKP.exe
  2⤵
  PID:10308
- C:\Windows\System\usEMbNt.exe
  C:\Windows\System\usEMbNt.exe
  2⤵
  PID:10332
- C:\Windows\System\OHyGcPj.exe
  C:\Windows\System\OHyGcPj.exe
  2⤵
  PID:10356
- C:\Windows\System\tokCIYn.exe
  C:\Windows\System\tokCIYn.exe
  2⤵
  PID:10396
- C:\Windows\System\PMPafAR.exe
  C:\Windows\System\PMPafAR.exe
  2⤵
  PID:10412
- C:\Windows\System\ZqibHNJ.exe
  C:\Windows\System\ZqibHNJ.exe
  2⤵
  PID:10432
- C:\Windows\System\yktXunm.exe
  C:\Windows\System\yktXunm.exe
  2⤵
  PID:10460
- C:\Windows\System\cNaHFJF.exe
  C:\Windows\System\cNaHFJF.exe
  2⤵
  PID:10480
- C:\Windows\System\igmZepB.exe
  C:\Windows\System\igmZepB.exe
  2⤵
  PID:10504
- C:\Windows\System\rHxjUBO.exe
  C:\Windows\System\rHxjUBO.exe
  2⤵
  PID:10532
- C:\Windows\System\gIFpdCb.exe
  C:\Windows\System\gIFpdCb.exe
  2⤵
  PID:10560
- C:\Windows\System\itftzSH.exe
  C:\Windows\System\itftzSH.exe
  2⤵
  PID:10608
- C:\Windows\System\tIvXHVR.exe
  C:\Windows\System\tIvXHVR.exe
  2⤵
  PID:10628
- C:\Windows\System\IVuLevl.exe
  C:\Windows\System\IVuLevl.exe
  2⤵
  PID:10652
- C:\Windows\System\EKLCwug.exe
  C:\Windows\System\EKLCwug.exe
  2⤵
  PID:10668
- C:\Windows\System\kSrFwyB.exe
  C:\Windows\System\kSrFwyB.exe
  2⤵
  PID:10688
- C:\Windows\System\yqBSkpP.exe
  C:\Windows\System\yqBSkpP.exe
  2⤵
  PID:10716
- C:\Windows\System\UQDwevK.exe
  C:\Windows\System\UQDwevK.exe
  2⤵
  PID:10768
- C:\Windows\System\UGCIRZg.exe
  C:\Windows\System\UGCIRZg.exe
  2⤵
  PID:10784
- C:\Windows\System\GIeHIJL.exe
  C:\Windows\System\GIeHIJL.exe
  2⤵
  PID:10812
- C:\Windows\System\JbDobZD.exe
  C:\Windows\System\JbDobZD.exe
  2⤵
  PID:10840
- C:\Windows\System\PrjyHWP.exe
  C:\Windows\System\PrjyHWP.exe
  2⤵
  PID:10860
- C:\Windows\System\GMjlEpe.exe
  C:\Windows\System\GMjlEpe.exe
  2⤵
  PID:10908
- C:\Windows\System\LbfaJqY.exe
  C:\Windows\System\LbfaJqY.exe
  2⤵
  PID:10932
- C:\Windows\System\kYFsetB.exe
  C:\Windows\System\kYFsetB.exe
  2⤵
  PID:10952
- C:\Windows\System\sOdzqPY.exe
  C:\Windows\System\sOdzqPY.exe
  2⤵
  PID:10988
- C:\Windows\System\QyLmXRS.exe
  C:\Windows\System\QyLmXRS.exe
  2⤵
  PID:11016
- C:\Windows\System\Tejxqqv.exe
  C:\Windows\System\Tejxqqv.exe
  2⤵
  PID:11052
- C:\Windows\System\cregzbJ.exe
  C:\Windows\System\cregzbJ.exe
  2⤵
  PID:11088
- C:\Windows\System\rrjrKIU.exe
  C:\Windows\System\rrjrKIU.exe
  2⤵
  PID:11112
- C:\Windows\System\RBnyYvb.exe
  C:\Windows\System\RBnyYvb.exe
  2⤵
  PID:11144
- C:\Windows\System\GPKoDzO.exe
  C:\Windows\System\GPKoDzO.exe
  2⤵
  PID:11176
- C:\Windows\System\voswxVL.exe
  C:\Windows\System\voswxVL.exe
  2⤵
  PID:11196
- C:\Windows\System\ItlYdhK.exe
  C:\Windows\System\ItlYdhK.exe
  2⤵
  PID:11212
- C:\Windows\System\iUiFLCY.exe
  C:\Windows\System\iUiFLCY.exe
  2⤵
  PID:11236
- C:\Windows\System\WneTMkF.exe
  C:\Windows\System\WneTMkF.exe
  2⤵
  PID:10304
- C:\Windows\System\UtFWydn.exe
  C:\Windows\System\UtFWydn.exe
  2⤵
  PID:10348
- C:\Windows\System\itmzlQM.exe
  C:\Windows\System\itmzlQM.exe
  2⤵
  PID:10384
- C:\Windows\System\MuVMbtB.exe
  C:\Windows\System\MuVMbtB.exe
  2⤵
  PID:10440
- C:\Windows\System\LvKFdEk.exe
  C:\Windows\System\LvKFdEk.exe
  2⤵
  PID:10496
- C:\Windows\System\rkrZfVR.exe
  C:\Windows\System\rkrZfVR.exe
  2⤵
  PID:10548
- C:\Windows\System\eUwTjZm.exe
  C:\Windows\System\eUwTjZm.exe
  2⤵
  PID:10640
- C:\Windows\System\YUVErTH.exe
  C:\Windows\System\YUVErTH.exe
  2⤵
  PID:10712
- C:\Windows\System\yLLnAtE.exe
  C:\Windows\System\yLLnAtE.exe
  2⤵
  PID:10764
- C:\Windows\System\hUBbdZw.exe
  C:\Windows\System\hUBbdZw.exe
  2⤵
  PID:10876
- C:\Windows\System\fkMmnUr.exe
  C:\Windows\System\fkMmnUr.exe
  2⤵
  PID:10904
- C:\Windows\System\zJxbfJt.exe
  C:\Windows\System\zJxbfJt.exe
  2⤵
  PID:10976
- C:\Windows\System\OZMHnGe.exe
  C:\Windows\System\OZMHnGe.exe
  2⤵
  PID:11032
- C:\Windows\System\NHVQIna.exe
  C:\Windows\System\NHVQIna.exe
  2⤵
  PID:11104
- C:\Windows\System\loGIwFD.exe
  C:\Windows\System\loGIwFD.exe
  2⤵
  PID:11132
- C:\Windows\System\DOPVMac.exe
  C:\Windows\System\DOPVMac.exe
  2⤵
  PID:11172
- C:\Windows\System\emZSfuL.exe
  C:\Windows\System\emZSfuL.exe
  2⤵
  PID:11228
- C:\Windows\System\dXzsRMe.exe
  C:\Windows\System\dXzsRMe.exe
  2⤵
  PID:10344
- C:\Windows\System\slDVkwt.exe
  C:\Windows\System\slDVkwt.exe
  2⤵
  PID:10404
- C:\Windows\System\MnEBCQz.exe
  C:\Windows\System\MnEBCQz.exe
  2⤵
  PID:10568
- C:\Windows\System\IphxNOj.exe
  C:\Windows\System\IphxNOj.exe
  2⤵
  PID:10588
- C:\Windows\System\OUXBMoR.exe
  C:\Windows\System\OUXBMoR.exe
  2⤵
  PID:10744
- C:\Windows\System\SxvedbK.exe
  C:\Windows\System\SxvedbK.exe
  2⤵
  PID:10824
- C:\Windows\System\AEdtsmu.exe
  C:\Windows\System\AEdtsmu.exe
  2⤵
  PID:10944
- C:\Windows\System\mUfHKFY.exe
  C:\Windows\System\mUfHKFY.exe
  2⤵
  PID:11080
- C:\Windows\System\HnKWPuk.exe
  C:\Windows\System\HnKWPuk.exe
  2⤵
  PID:11192
- C:\Windows\System\IKRWVEC.exe
  C:\Windows\System\IKRWVEC.exe
  2⤵
  PID:10552
- C:\Windows\System\cGIvfHl.exe
  C:\Windows\System\cGIvfHl.exe
  2⤵
  PID:11004
- C:\Windows\System\zOioXHg.exe
  C:\Windows\System\zOioXHg.exe
  2⤵
  PID:11272
- C:\Windows\System\HPTkQaD.exe
  C:\Windows\System\HPTkQaD.exe
  2⤵
  PID:11292
- C:\Windows\System\hpodwWF.exe
  C:\Windows\System\hpodwWF.exe
  2⤵
  PID:11352
- C:\Windows\System\mjlUjlB.exe
  C:\Windows\System\mjlUjlB.exe
  2⤵
  PID:11380
- C:\Windows\System\srtLhvn.exe
  C:\Windows\System\srtLhvn.exe
  2⤵
  PID:11396
- C:\Windows\System\KPPZVFd.exe
  C:\Windows\System\KPPZVFd.exe
  2⤵
  PID:11420
- C:\Windows\System\XsvimmC.exe
  C:\Windows\System\XsvimmC.exe
  2⤵
  PID:11448
- C:\Windows\System\YLsTnKy.exe
  C:\Windows\System\YLsTnKy.exe
  2⤵
  PID:11476
- C:\Windows\System\uiQlXTq.exe
  C:\Windows\System\uiQlXTq.exe
  2⤵
  PID:11500
- C:\Windows\System\YKOEkJk.exe
  C:\Windows\System\YKOEkJk.exe
  2⤵
  PID:11524
- C:\Windows\System\QlXFSTy.exe
  C:\Windows\System\QlXFSTy.exe
  2⤵
  PID:11556
- C:\Windows\System\lQJZxCn.exe
  C:\Windows\System\lQJZxCn.exe
  2⤵
  PID:11584
- C:\Windows\System\rTynlvC.exe
  C:\Windows\System\rTynlvC.exe
  2⤵
  PID:11616
- C:\Windows\System\VgayfzX.exe
  C:\Windows\System\VgayfzX.exe
  2⤵
  PID:11640
- C:\Windows\System\ltpdUFz.exe
  C:\Windows\System\ltpdUFz.exe
  2⤵
  PID:11672
- C:\Windows\System\PcycfXq.exe
  C:\Windows\System\PcycfXq.exe
  2⤵
  PID:11688
- C:\Windows\System\GzvUucN.exe
  C:\Windows\System\GzvUucN.exe
  2⤵
  PID:11724
- C:\Windows\System\OojtAUS.exe
  C:\Windows\System\OojtAUS.exe
  2⤵
  PID:11772
- C:\Windows\System\YlinfnJ.exe
  C:\Windows\System\YlinfnJ.exe
  2⤵
  PID:11808
- C:\Windows\System\wRdUFJB.exe
  C:\Windows\System\wRdUFJB.exe
  2⤵
  PID:11836
- C:\Windows\System\aqTlCEj.exe
  C:\Windows\System\aqTlCEj.exe
  2⤵
  PID:11860
- C:\Windows\System\cbWyqhD.exe
  C:\Windows\System\cbWyqhD.exe
  2⤵
  PID:11880
- C:\Windows\System\dnaJefD.exe
  C:\Windows\System\dnaJefD.exe
  2⤵
  PID:11908
- C:\Windows\System\vwOYODO.exe
  C:\Windows\System\vwOYODO.exe
  2⤵
  PID:11940
- C:\Windows\System\vmXafav.exe
  C:\Windows\System\vmXafav.exe
  2⤵
  PID:11964
- C:\Windows\System\dHjNnJe.exe
  C:\Windows\System\dHjNnJe.exe
  2⤵
  PID:12004
- C:\Windows\System\KWzQeRJ.exe
  C:\Windows\System\KWzQeRJ.exe
  2⤵
  PID:12024
- C:\Windows\System\reccJWM.exe
  C:\Windows\System\reccJWM.exe
  2⤵
  PID:12048
- C:\Windows\System\fOEPovO.exe
  C:\Windows\System\fOEPovO.exe
  2⤵
  PID:12076
- C:\Windows\System\fePEaKt.exe
  C:\Windows\System\fePEaKt.exe
  2⤵
  PID:12096
- C:\Windows\System\ROLmdbS.exe
  C:\Windows\System\ROLmdbS.exe
  2⤵
  PID:12140
- C:\Windows\System\VhvIxAp.exe
  C:\Windows\System\VhvIxAp.exe
  2⤵
  PID:12176
- C:\Windows\System\NamIYOw.exe
  C:\Windows\System\NamIYOw.exe
  2⤵
  PID:12196
- C:\Windows\System\YFWxvjv.exe
  C:\Windows\System\YFWxvjv.exe
  2⤵
  PID:12220
- C:\Windows\System\yEGjJNb.exe
  C:\Windows\System\yEGjJNb.exe
  2⤵
  PID:12236
- C:\Windows\System\tvibOdQ.exe
  C:\Windows\System\tvibOdQ.exe
  2⤵
  PID:12256
- C:\Windows\System\YiZkAHb.exe
  C:\Windows\System\YiZkAHb.exe
  2⤵
  PID:12280
- C:\Windows\System\QalhbWp.exe
  C:\Windows\System\QalhbWp.exe
  2⤵
  PID:11284
- C:\Windows\System\hcGENfp.exe
  C:\Windows\System\hcGENfp.exe
  2⤵
  PID:11344
- C:\Windows\System\HzxjDUi.exe
  C:\Windows\System\HzxjDUi.exe
  2⤵
  PID:11496
- C:\Windows\System\kAWtEgj.exe
  C:\Windows\System\kAWtEgj.exe
  2⤵
  PID:11532
- C:\Windows\System\gBoHpSf.exe
  C:\Windows\System\gBoHpSf.exe
  2⤵
  PID:11708
- C:\Windows\System\qLRZWIS.exe
  C:\Windows\System\qLRZWIS.exe
  2⤵
  PID:11664
- C:\Windows\System\iLMndJf.exe
  C:\Windows\System\iLMndJf.exe
  2⤵
  PID:11752
- C:\Windows\System\QjYfkRg.exe
  C:\Windows\System\QjYfkRg.exe
  2⤵
  PID:11832
- C:\Windows\System\skmoBnt.exe
  C:\Windows\System\skmoBnt.exe
  2⤵
  PID:11872
- C:\Windows\System\DbxDxer.exe
  C:\Windows\System\DbxDxer.exe
  2⤵
  PID:11936
- C:\Windows\System\ujaOsAa.exe
  C:\Windows\System\ujaOsAa.exe
  2⤵
  PID:11996
- C:\Windows\System\gtQpgsL.exe
  C:\Windows\System\gtQpgsL.exe
  2⤵
  PID:12060
- C:\Windows\System\VGiCGhl.exe
  C:\Windows\System\VGiCGhl.exe
  2⤵
  PID:12116
- C:\Windows\System\XfSykJM.exe
  C:\Windows\System\XfSykJM.exe
  2⤵
  PID:12160
- C:\Windows\System\nzLgQOs.exe
  C:\Windows\System\nzLgQOs.exe
  2⤵
  PID:12204
- C:\Windows\System\kHQgtuN.exe
  C:\Windows\System\kHQgtuN.exe
  2⤵
  PID:11392
- C:\Windows\System\pNPFGkb.exe
  C:\Windows\System\pNPFGkb.exe
  2⤵
  PID:11368
- C:\Windows\System\SfKdMUh.exe
  C:\Windows\System\SfKdMUh.exe
  2⤵
  PID:1616
- C:\Windows\System\zFgDHdI.exe
  C:\Windows\System\zFgDHdI.exe
  2⤵
  PID:4632
- C:\Windows\System\sNnjDjF.exe
  C:\Windows\System\sNnjDjF.exe
  2⤵
  PID:11768
- C:\Windows\System\hKvHFJp.exe
  C:\Windows\System\hKvHFJp.exe
  2⤵
  PID:11888
- C:\Windows\System\cFcUVLW.exe
  C:\Windows\System\cFcUVLW.exe
  2⤵
  PID:12032
- C:\Windows\System\sqkGoqz.exe
  C:\Windows\System\sqkGoqz.exe
  2⤵
  PID:12168
- C:\Windows\System\fGDOONi.exe
  C:\Windows\System\fGDOONi.exe
  2⤵
  PID:11304
- C:\Windows\System\GbxsDPM.exe
  C:\Windows\System\GbxsDPM.exe
  2⤵
  PID:11668
- C:\Windows\System\UwVEAAO.exe
  C:\Windows\System\UwVEAAO.exe
  2⤵
  PID:11804
- C:\Windows\System\IqClJaH.exe
  C:\Windows\System\IqClJaH.exe
  2⤵
  PID:12276
- C:\Windows\System\wwyGCBH.exe
  C:\Windows\System\wwyGCBH.exe
  2⤵
  PID:12296
- C:\Windows\System\BCdQDqX.exe
  C:\Windows\System\BCdQDqX.exe
  2⤵
  PID:12316
- C:\Windows\System\BjtTvuT.exe
  C:\Windows\System\BjtTvuT.exe
  2⤵
  PID:12332
- C:\Windows\System\IKCDFRO.exe
  C:\Windows\System\IKCDFRO.exe
  2⤵
  PID:12348
- C:\Windows\System\dJRvxqA.exe
  C:\Windows\System\dJRvxqA.exe
  2⤵
  PID:12364
- C:\Windows\System\kPYnluZ.exe
  C:\Windows\System\kPYnluZ.exe
  2⤵
  PID:12384
- C:\Windows\System\HJKsYYf.exe
  C:\Windows\System\HJKsYYf.exe
  2⤵
  PID:12408
- C:\Windows\System\VHRBWwF.exe
  C:\Windows\System\VHRBWwF.exe
  2⤵
  PID:12456
- C:\Windows\System\TTbCPEd.exe
  C:\Windows\System\TTbCPEd.exe
  2⤵
  PID:12484
- C:\Windows\System\cytmivE.exe
  C:\Windows\System\cytmivE.exe
  2⤵
  PID:12504
- C:\Windows\System\gBKkawB.exe
  C:\Windows\System\gBKkawB.exe
  2⤵
  PID:12528
- C:\Windows\System\bIryJCH.exe
  C:\Windows\System\bIryJCH.exe
  2⤵
  PID:12548
- C:\Windows\System\pZrkIVa.exe
  C:\Windows\System\pZrkIVa.exe
  2⤵
  PID:12564
- C:\Windows\System\ENdkMjb.exe
  C:\Windows\System\ENdkMjb.exe
  2⤵
  PID:12648
- C:\Windows\System\pUoSGnt.exe
  C:\Windows\System\pUoSGnt.exe
  2⤵
  PID:12676
- C:\Windows\System\WrCMAMK.exe
  C:\Windows\System\WrCMAMK.exe
  2⤵
  PID:12712
- C:\Windows\System\aRnBNKY.exe
  C:\Windows\System\aRnBNKY.exe
  2⤵
  PID:12740
- C:\Windows\System\zcjhTFh.exe
  C:\Windows\System\zcjhTFh.exe
  2⤵
  PID:12760
- C:\Windows\System\bzWQbWH.exe
  C:\Windows\System\bzWQbWH.exe
  2⤵
  PID:12792
- C:\Windows\System\iKizceT.exe
  C:\Windows\System\iKizceT.exe
  2⤵
  PID:12836
- C:\Windows\System\vrLaHZj.exe
  C:\Windows\System\vrLaHZj.exe
  2⤵
  PID:12868
- C:\Windows\System\uDmuCcq.exe
  C:\Windows\System\uDmuCcq.exe
  2⤵
  PID:12896
- C:\Windows\System\ASsXkBn.exe
  C:\Windows\System\ASsXkBn.exe
  2⤵
  PID:12912
- C:\Windows\System\wIZJask.exe
  C:\Windows\System\wIZJask.exe
  2⤵
  PID:12936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3ec1bta.sjx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\FGUHRuQ.exe

Filesize
8B

MD5
68703642e5faeaf00b4b9f791a04a7f5

SHA1
2e8f5d51bda54b6b227caed2cb4535020c7a482c

SHA256
76bc446e18daed4e6417440c778e757728762c893f014de08ffa5f0fe98668bd

SHA512
0c1919485a30576b5fdf963204dc04b356f524c23dfb4ffaecdbb8a8ea4a0993cf3ac05bee011edf07b5b637ac7455499983eac22f5cdd87cd869e7a046115a5

Download Submit
C:\Windows\System\JodVugm.exe

Filesize
1.8MB

MD5
700db17b18729e79b814573d733cc1d8

SHA1
43876b44086d4ce912d7d51957363a76f0151c57

SHA256
d3558ab9a1b2d333ef8928c8add91343fc03538a274ad64454abbb2a9f50ec39

SHA512
3f36ab0a3492b5cedd977f06c007fbe4c5a329f50cee8284f0c17280306ac4cc291968d90a62224106231b58a89cfe6812bed73bb9f803a2f0ddac2f1cdbb55c

Download Submit
C:\Windows\System\JpaaSwL.exe

Filesize
1.8MB

MD5
d9cb2d3556e69ed1f26490f6ebb7560b

SHA1
3e3a6aa9a900d720460560fcedbf767889614af5

SHA256
f800ddaa8a52393e026893b1eb11a4c24960c73b76dd51cbb96d533322299075

SHA512
3e0d2119425f7cc8705a853f37e173829abab125d70adb97843c8b2b480cd10a8f16fb298b364b1982956f936cf5c760368bf3c25dbb452815590e59759394b3

Download Submit
C:\Windows\System\KJNmtgo.exe

Filesize
1.8MB

MD5
f5bf32ca4e60498ee68e89716299f1f4

SHA1
33e08af2aeb34ac97068d70396f7cd090a2323dd

SHA256
40b984d9fee5aac3c24ada5004cb125ffe6da203dc764ad5b389c55e509fba64

SHA512
d547e55081fa96bd0d60967d0295d4dc5146b2295eeb92a9b117d8614a83f75009d2b5b3e1d4ebf614e907e9c13622dc42205bf45c7cac4996260cefb2a5bea9

Download Submit
C:\Windows\System\KYMPzLS.exe

Filesize
1.8MB

MD5
c635bfa55d6642e1c2df1d30da1066e9

SHA1
0341d7a907934d7fdd7010394ae14bd37c297da4

SHA256
d89bab688507b3855f13195219b09c8a71714fd453d326ab81abf8ed6a1d3877

SHA512
9d82811f3f1c90c50732bf6078839f1978f17b4d681624ee242e4759f9da7ebc86a1d91403920965291e5dcec693eac5c146370b67dc267378acfd83d4d12e80

Download Submit
C:\Windows\System\KmtiVHJ.exe

Filesize
1.8MB

MD5
23e8cc04ae61732fbf8c5967f1f217bc

SHA1
0984e766320108b9d44aab85122be78382cd938e

SHA256
b40a96079ac41767317e796b84a35569a1b112cc5b53a2e3716024750409d30a

SHA512
b12f9a25249bd33d71c83bf2e4aad3c8289117e0df17639bb5377485c0feef0be55f30381422bc0ff80e2d46311533e41dfcce52dde412c9c3c1d8cbfed97aa0

Download Submit
C:\Windows\System\LzYGMwd.exe

Filesize
1.8MB

MD5
aee0fe41cbd2a468ffc8c8ea6402e58f

SHA1
a5a24d89b3bf3de65ceddc6cde635dae1da2a118

SHA256
bfc31cc2090174ddf7b354fc674bf28cc45989751840a4d4ad1fe298f7075eb8

SHA512
dcae782d1df959531249108e62c86117f308e9cbf1d0474a201b7413ee7ebcb8539d3068554595edfce240ba5d268dce165a08e51649e0589c2a417d8299e9e5

Download Submit
C:\Windows\System\OtaLAPg.exe

Filesize
1.8MB

MD5
377f5c01dd109a32f130cf7a2c53f5c7

SHA1
e2d9418e25c8dd786b73b8a2a50776998e394a6f

SHA256
7f7f886e40d9c5fc894ae8cfd321256e9c5c228cf2c7cc83552264741f00f9a7

SHA512
7685697400795e72dc96a5d47c2d02623b716015add99b8ec2e462933d749bed86c9e4434dede356a0eef33b81050d4756ddd6ce4d84a06788b990162e0918e0

Download Submit
C:\Windows\System\OvQwtqA.exe

Filesize
1.8MB

MD5
024adf5330647da699619c297caec115

SHA1
732df588f4692f54b2f70d3c94b6d6aeae0856b6

SHA256
344ef078beeea47b86ce5f41713f52c998f7f9a20659eed01a29c1f69ad4f4b4

SHA512
83d580db2591d0c132a0ec38f8f1dda9be895c95ecd76a6dc81a48a704a5818f4dea6a4bba98217b49cb6ce06da4f62db9b5b9ff7c095f4d0c1559b8c1afeb63

Download Submit
C:\Windows\System\RBiirbi.exe

Filesize
1.8MB

MD5
e8ada1df444048e8a14f15f9383e839a

SHA1
2590586cf036e54dbaf7c629b917972c624f8756

SHA256
d618d9852e348e2d98120746ed0fe66268a288399b5433685a9d886ee0aafb15

SHA512
fa38f2a885a2581361a5cc1c7809e68f6b30b77ca812af090c6e6a0bca5bde1e5f20dc229c4ac3fe81137c6af41f096f3af816867f3990d5ad1b39510ad997c9

Download Submit
C:\Windows\System\SJsfPJJ.exe

Filesize
1.8MB

MD5
dc09a0c14d6606de42f2d8bf7fb178d8

SHA1
6f9594628fdddda06faf69b8fd7c87f41a72fd66

SHA256
e8c1b41224f2e52f9bbea362e2876c85b8a44d59d7e51c62bdf3fc0ca7e6607a

SHA512
b6cc57619ba08d6f5d999ba341ef8fc702daf0e2a4afd78d1b1c3844fc2c05bcd0f7d3dcc2f10a930782a42fd81f686c12f0c1f0e56eec2453c0cf110df0ebe7

Download Submit
C:\Windows\System\SOCpcWr.exe

Filesize
1.8MB

MD5
76b09d96292ae69d59b948943947a939

SHA1
31938446a11f75f16573a16064b328d2d75540f6

SHA256
ade726276bd1951e53728af54a60174aea09636944fc310b1eddc3cad2b923c3

SHA512
b985cff5e5878b19b368523edd2876a952ceb9e0da24bdbf2b16472b27b3301de40d3406c6af78c877c3814b0dc9e637b01edbb5066a83188e116dbd551ec295

Download Submit
C:\Windows\System\TwvjqcJ.exe

Filesize
1.8MB

MD5
467cad9b09ce931d36c454da50f5c869

SHA1
c066482e6768422247adb00a7be9e0741f624477

SHA256
2811ffdf45a1664a0a3bc9921a48c834f3b70a00ed2b539aa551c50c153fd8e6

SHA512
a025b2a2e3a0aeda4c9b46de455992d5671097180794e9396b52deceab471163abd7b12560de871314ede9c3fe4d318f69122b8e120630fd8d58ea5e9524698f

Download Submit
C:\Windows\System\UEGvTnA.exe

Filesize
1.8MB

MD5
849934e24cb439a7d43737606ba16c55

SHA1
5cc52b480e9932726e2052804b761581362381af

SHA256
564fed2dd4f06a6e1709e67c034881cbac2fcd3dea39a44422ca2d0312c6d964

SHA512
e0fdf8342cf8061ceefba9b3d8c0368377ba33d489680db5fffdaf8bc9b5606c90f5d4f3753b9afd04eee5673a35fda111496d3c1d1b64c017c7e97ebc5e4d57

Download Submit
C:\Windows\System\YOHUhJJ.exe

Filesize
1.8MB

MD5
a803bbbc5272740cee93dc85a1e26cbe

SHA1
aa69ebbe212ade134b5eed0b45d45d80eb16df1c

SHA256
1d77955c1857d0ffc637ece10a5e05909d6197030ef43633c3eb4c2542cf538d

SHA512
eb0fe598862ace01117c5d32ae0d100b610e75800f4bafd97dffdf4aaa5c877bbadb574c43ec6a8ee93221bf624a3ee6507e3fbe65d95c2011bb7fac10b0c865

Download Submit
C:\Windows\System\YlolbJw.exe

Filesize
1.8MB

MD5
52e0ada8b14863dd638ce268598852b8

SHA1
08065c62030efcb9d9e882b6969449137a09e06f

SHA256
de42399a2908774350fe443d8bef7d191f03a31866722f0f37192d6ce41ff7a5

SHA512
566d0ee276f52bfd5189a840f44cb8e067679aab4f536f49b0db1a2d166cdf6290bd24f958f9af88cfc24ed5a9613b9945f8e9709f1c1cd67d3d27d245e1b055

Download Submit
C:\Windows\System\YuZTePT.exe

Filesize
1.8MB

MD5
4ae4537670c61da5142212fa1a480ca7

SHA1
03fad42ddcd280e874589beb43d252732582c4c4

SHA256
6c07f32df4c781a4ad88dd8d63da8156fffeb65ec964b1d657f25d9362d6ad3a

SHA512
bac74196b2b37979bec7cfce64553d3e2d36d258df72153a0330fb6158eb879421507c05cbf46d3413bec7f5e5843de85ce6cf7b51f8199e9c584214a6d5ee83

Download Submit
C:\Windows\System\ZxyLmYk.exe

Filesize
1.8MB

MD5
b0d9bd3448a7e931a9e57d8e8b58771e

SHA1
e229e6a2d2c025e59d4e5ee8c5db5e35334d5381

SHA256
45c79579cf822d5f4245ad3b512e72361856f084921f65f1f1636b07acf9d1fc

SHA512
0d3d198951150b96a440b69217d52296fd05c3cf13b08069ab4323f4796ffee83ef61cde89e2f1eb220ed5d4445a5fffd8dd701b8386f6eff1a34ddfa50c3d1c

Download Submit
C:\Windows\System\awsJMpA.exe

Filesize
1.8MB

MD5
dd0e96b8ab44cbd88863aefb37b9a181

SHA1
b97e105d83a465aa8f48056809e752109029ad6a

SHA256
7887a87e504bf5e1e39912dc64fd377c2fe15012c0caa17e521edd1f6cd9e6d2

SHA512
edefb7608fcf2cb5071d2d4def53c6158bdbe0c43847af812191ed431e25b750279239969f926d1d1c89dd1e76e8c5d056011b6c0319b0a382faf15fb713eaa5

Download Submit
C:\Windows\System\bIHBPly.exe

Filesize
1.8MB

MD5
0a2aaa3b147f8a7665fb69a0560be8e6

SHA1
97a06cc094e390697234f8a24f02eec04a817033

SHA256
fb73f10ef84a7c0bfd72b9101c709f28ad6125cee198764f39e0537e9f27329a

SHA512
a0af375b780aa35188d0d0bc509d7bb0478103d6166c4f9aa25dd20cbfc26e23242a8feff542cf343f7b6ed1f645cc236e1bf825d77ae8693fac38fb72e294eb

Download Submit
C:\Windows\System\btRoXtY.exe

Filesize
1.8MB

MD5
5ed8b946d8e3cf7b5132563d16ce57da

SHA1
43778cf9214472f285d9bd81e4a742f95431c585

SHA256
b27f9825b737f98b808508f42caf72aa229500830b38cf464ede7aef14df57a0

SHA512
b5263ab4bec187c660addcb8c947e28308fdb78f91ca145fe4789e8cf1665b04ffc1bddc81158a292106c759cf572e8c70ce2cd5f643b3949d9248297d17038b

Download Submit
C:\Windows\System\fMrPsLa.exe

Filesize
1.8MB

MD5
72c2ff17325bc41b2d10c28abc719938

SHA1
ae80161722b57039afc79661dbe93e291c402487

SHA256
7c60553d2fa5840e992e4ea9566b6e7f2766b8d57ec0b81077c179d08221c56b

SHA512
aa90d05d7d87e84c9dc86584eda8661eeb0f7d4db399b5b4a51281fa08f267d6f72f233fc8ead743fed96e0b8101166ad152965f23a8b5fcb0ac8a1bcdfa8d2d

Download Submit
C:\Windows\System\gEFYwXz.exe

Filesize
1.8MB

MD5
8ea8514d8b9f392314ec72452182e3b4

SHA1
772049d2f9dd80d2bd489383f652b24707259daf

SHA256
b61620d0b8175c2b00a3c002cc6ade7e92f77ca2cfc81bb8812f08f867917c9c

SHA512
2c378eaa10f697d766dda700c2605ac59e5512f7c431d2494fec664aae0440f6ee6bfef2f0e24ab39a9b06c1e17fc052cf9f892df8cd59599052d16198e03da9

Download Submit
C:\Windows\System\gguzyks.exe

Filesize
1.8MB

MD5
91015e842b0811a0d07c30c35465a0d4

SHA1
fce69d0e63fa48545305d30f0ec6d989633ef441

SHA256
dfeb81b17744d01bd439fa4bcd3adab36e49ea9b249c8a02c09008a849ca23ae

SHA512
5cc0d642f06164519f8038c65863476b96f7e7decc256d51dad366b1a174d800fb089c3ed8cd7e4f15ebb21e4ccac8ee933ef823461e4971cca782281f1b778d

Download Submit
C:\Windows\System\hWJbpzi.exe

Filesize
1.8MB

MD5
09ca9334ffcc0890c8c68b42f4639c08

SHA1
e8ad1041a54ba1e347bbbbfab40696c766d4a443

SHA256
d0c2a31cffbc2478cb5497b33f4d57606caea1ec672cb40358e3a89818f92e08

SHA512
bb4ffa24766ba40f15168dfc7fb9e3d8d068f4e1b57136bb3bf46fd15fcb7f16121ca3d4f382cbbbc571aded5e0497c7f83b8ca299f489d6cac0023ee04dfc67

Download Submit
C:\Windows\System\lrHYCao.exe

Filesize
1.8MB

MD5
0aba509a6bc8f830f0efe6eb42220a51

SHA1
079dd287358c189b3b8e8848b2b191e6f661c052

SHA256
921a29ccfd53aa54b405b8a9bcf097e7185fa87d945a68f27a7eecc69579bcbd

SHA512
208c8dd8bc71b0a9a98f1460c410d7890e8b90a8af17c30642e2fe9a7e7a254f4188937cd8d96e240d5543b7468330ec4019c36ea177ad158c5f508b9b96a721

Download Submit
C:\Windows\System\mlSmXaF.exe

Filesize
1.8MB

MD5
a0242cb282eb44ccfc4cb3471ec393ff

SHA1
39a82888464ce6957cf8a05deff144e3a0b828c1

SHA256
46a1096db348015f3bea60c8545dd60afb4a842be8c627ea54085a04d9cf75be

SHA512
a88d0c8060009d5486a25d277a1d5dda19b6b1394cf5c2d9b1f718fd078eb99d593540c5202b03997cb1657c17bc8fd785c73a114c015c66976bfda4f335c8e7

Download Submit
C:\Windows\System\oTYBeSB.exe

Filesize
1.8MB

MD5
4e21a3dcff81291db6982eb99a9843a6

SHA1
8755103b147354175b44dd8616617225a82d1c30

SHA256
2d19b14cb4277bfcc82b2f8799801dd34eae9aedf562ab9041260ea53f11a084

SHA512
a4e577b77e6e4f9364fdd8477b3488ee3c3dac6b567dd28934ce6d0e97bd643292157d02dbb4255de356db12072b2ff002b8c86d6fdc7c9c116f218d2b7f1cde

Download Submit
C:\Windows\System\rSrhjuI.exe

Filesize
1.8MB

MD5
fea370d1ed247ae193758410a45f2a89

SHA1
2d1385a4fca8d26c029474e92bfa2c37644a38ec

SHA256
29b415e756243b183c42c3e4563c156f45ed07631137ec0fde0fffdd58995eb1

SHA512
c4c89ba3ebc3b99ab1a38eb02b8e1ecaec507d486142aa752f219f5ab147c30b4df28414085d5198e3b47e49a5a7fc0cd26bb6f8bf845f017897cb94a0810742

Download Submit
C:\Windows\System\rlNRqYL.exe

Filesize
1.8MB

MD5
50b4339126a3e2e187c669c8bddd417f

SHA1
a04a7c1c12212c030815fe2cd2d196e816379376

SHA256
85ab7de0af3834edd23b9a09fb4bd548f4b8733961fbcf58542a874c975d8f36

SHA512
1513f6ee9e9a5cca088ae1a45bbab6383a129cd9a848f8c8935e0380a4d32fbec9bd31b783100bdd293e6f0f1b55079369efc3fcc64edcfb1f849de0a42074a6

Download Submit
C:\Windows\System\vAvGvZp.exe

Filesize
1.8MB

MD5
c9f641eee6fd028f242d8453b2ebe613

SHA1
0b135a0cd875e785ea568374c7b00d604dd937e2

SHA256
58c076f58e892e6d641e49dbba4ee9d8b02ff04995c0ac89d40e5df4035210db

SHA512
94cd4665e9bb25f122e2fafba52db38188d8a3529b9faca68c5775c0e64dfdf37a8f34d52080ac7f47dfed2836b6ddae78067bd0578ce6d16c85661f2aacc347

Download Submit
C:\Windows\System\wCJHHLy.exe

Filesize
1.8MB

MD5
4cecde3b6bee3ab1a4bcd27449518672

SHA1
8e652137988dfd691c7a9bd790f330607a35c387

SHA256
acfd86d3c6a767be402a57a79e6bffec9d673fe7dac968636e5d1e881cee86ef

SHA512
4442c38b8414540b7a45a56d1f19cdbb9a0744dfd330a5cef17138a72cd8898f7a4f26f81827e4c0108b730c87f97988864cf3a700b108e0557098a0d73f9264

Download Submit
C:\Windows\System\wZxVmXH.exe

Filesize
1.8MB

MD5
02c81a10698b7a1cc33e91875e237d4b

SHA1
1e1ae1ef6ae31ca81ecda940204b7711fb5c569b

SHA256
1740be0ce14bdc02d01e46e10bec8f57ad730a32102ff5eaf1bf79e1ce7a8237

SHA512
d22905bb59e9d6e1e4db4b6f2a3383103ec062f02bb74ca297113e534cfc0105b257a0ec3880c0599c9af0d4000e00b6177568ae12350796949231da02070263

Download Submit
C:\Windows\System\ynVKmSm.exe

Filesize
1.8MB

MD5
780f23ae1eca45aad67a5f22413331d7

SHA1
b96da920c7503c39e9273e933f50acf7ae9bc726

SHA256
193850eb81ffeac16577ad3358b8ae201468f1ca94baf7ce1a38f1223d7085b9

SHA512
6ee650db0ad7a872374555030976752a2aec75ceee0221d20f79cb9af040ded44a57b9e5b699cd0e0de7a59863ad2f5c4cf59f59a9c0afc7a3c26ad0e4436799

Download Submit
memory/528-2047-0x00007FF7869B0000-0x00007FF786DA2000-memory.dmp

Filesize
3.9MB

Download
memory/528-437-0x00007FF7869B0000-0x00007FF786DA2000-memory.dmp

Filesize
3.9MB

Download
memory/564-1-0x0000025B373F0000-0x0000025B37400000-memory.dmp

Filesize
64KB

Download
memory/564-0-0x00007FF7FC640000-0x00007FF7FCA32000-memory.dmp

Filesize
3.9MB

Download
memory/928-445-0x00007FF696460000-0x00007FF696852000-memory.dmp

Filesize
3.9MB

Download
memory/928-2042-0x00007FF696460000-0x00007FF696852000-memory.dmp

Filesize
3.9MB

Download
memory/1124-81-0x00007FF765620000-0x00007FF765A12000-memory.dmp

Filesize
3.9MB

Download
memory/1124-2023-0x00007FF765620000-0x00007FF765A12000-memory.dmp

Filesize
3.9MB

Download
memory/1864-452-0x00007FF7C4B90000-0x00007FF7C4F82000-memory.dmp

Filesize
3.9MB

Download
memory/1864-2035-0x00007FF7C4B90000-0x00007FF7C4F82000-memory.dmp

Filesize
3.9MB

Download
memory/1948-429-0x00007FF649650000-0x00007FF649A42000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2037-0x00007FF649650000-0x00007FF649A42000-memory.dmp

Filesize
3.9MB

Download
memory/1960-2026-0x00007FF614F70000-0x00007FF615362000-memory.dmp

Filesize
3.9MB

Download
memory/1960-93-0x00007FF614F70000-0x00007FF615362000-memory.dmp

Filesize
3.9MB

Download
memory/2340-82-0x00007FF7F5DA0000-0x00007FF7F6192000-memory.dmp

Filesize
3.9MB

Download
memory/2340-2027-0x00007FF7F5DA0000-0x00007FF7F6192000-memory.dmp

Filesize
3.9MB

Download
memory/2388-88-0x00007FF79B9A0000-0x00007FF79BD92000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2039-0x00007FF79B9A0000-0x00007FF79BD92000-memory.dmp

Filesize
3.9MB

Download
memory/2436-457-0x00007FF7A0740000-0x00007FF7A0B32000-memory.dmp

Filesize
3.9MB

Download
memory/2436-2061-0x00007FF7A0740000-0x00007FF7A0B32000-memory.dmp

Filesize
3.9MB

Download
memory/3128-66-0x00007FF7157C0000-0x00007FF715BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-2021-0x00007FF7157C0000-0x00007FF715BB2000-memory.dmp

Filesize
3.9MB

Download
memory/3176-460-0x00007FF7F6B50000-0x00007FF7F6F42000-memory.dmp

Filesize
3.9MB

Download
memory/3176-2060-0x00007FF7F6B50000-0x00007FF7F6F42000-memory.dmp

Filesize
3.9MB

Download
memory/3208-455-0x00007FF79D8B0000-0x00007FF79DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-2030-0x00007FF79D8B0000-0x00007FF79DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/3228-2056-0x00007FF7C24A0000-0x00007FF7C2892000-memory.dmp

Filesize
3.9MB

Download
memory/3228-475-0x00007FF7C24A0000-0x00007FF7C2892000-memory.dmp

Filesize
3.9MB

Download
memory/3348-2019-0x00007FF769F40000-0x00007FF76A332000-memory.dmp

Filesize
3.9MB

Download
memory/3348-450-0x00007FF769F40000-0x00007FF76A332000-memory.dmp

Filesize
3.9MB

Download
memory/3444-444-0x00007FF751390000-0x00007FF751782000-memory.dmp

Filesize
3.9MB

Download
memory/3444-2046-0x00007FF751390000-0x00007FF751782000-memory.dmp

Filesize
3.9MB

Download
memory/3628-94-0x00007FF629EB0000-0x00007FF62A2A2000-memory.dmp

Filesize
3.9MB

Download
memory/3628-2031-0x00007FF629EB0000-0x00007FF62A2A2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-2050-0x00007FF78FBC0000-0x00007FF78FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3876-440-0x00007FF78FBC0000-0x00007FF78FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-2058-0x00007FF74EB20000-0x00007FF74EF12000-memory.dmp

Filesize
3.9MB

Download
memory/3912-467-0x00007FF74EB20000-0x00007FF74EF12000-memory.dmp

Filesize
3.9MB

Download
memory/4072-456-0x00007FF6DDA00000-0x00007FF6DDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4072-2034-0x00007FF6DDA00000-0x00007FF6DDDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4324-57-0x00007FF7B57D0000-0x00007FF7B5BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4324-2017-0x00007FF7B57D0000-0x00007FF7B5BC2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-449-0x00007FF76C5C0000-0x00007FF76C9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-2064-0x00007FF76C5C0000-0x00007FF76C9B2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-434-0x00007FF742BF0000-0x00007FF742FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-2054-0x00007FF742BF0000-0x00007FF742FE2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2051-0x00007FF783E70000-0x00007FF784262000-memory.dmp

Filesize
3.9MB

Download
memory/4628-435-0x00007FF783E70000-0x00007FF784262000-memory.dmp

Filesize
3.9MB

Download
memory/4988-5-0x00007FFF322C3000-0x00007FFF322C5000-memory.dmp

Filesize
8KB

Download
memory/4988-30-0x00007FFF322C0000-0x00007FFF32D81000-memory.dmp

Filesize
10.8MB

Download
memory/4988-38-0x000002A1B9160000-0x000002A1B9182000-memory.dmp

Filesize
136KB

Download
memory/4988-2009-0x00007FFF322C0000-0x00007FFF32D81000-memory.dmp

Filesize
10.8MB

Download
memory/4988-379-0x000002A1B9DF0000-0x000002A1BA596000-memory.dmp

Filesize
7.6MB

Download
memory/4988-49-0x00007FFF322C0000-0x00007FFF32D81000-memory.dmp

Filesize
10.8MB

Download
memory/4988-2000-0x00007FFF322C0000-0x00007FFF32D81000-memory.dmp

Filesize
10.8MB

Download
memory/5096-99-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2043-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp

Filesize
3.9MB

Download
memory/5096-2001-0x00007FF77B000000-0x00007FF77B3F2000-memory.dmp

Filesize
3.9MB

Download