xmrig | 7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
Size

2.2MB
MD5

b4fe8c4022e51724d2419ef6480b6db5
SHA1

04295da461461302ce28d3a73aef9531351b73ce
SHA256

7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e
SHA512

cd5d729a9d497785031c7f19e24c71294a55754b3f7c2c5099234aa86968f24a991e85b7ef996def03e722f4514f5848af196e1268c14878778f3e8ca8de1667
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6l+XPRUKC+e:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4892-0-0x00007FF6059E0000-0x00007FF605DD6000-memory.dmp	xmrig
behavioral2/files/0x0006000000023287-8.dat	xmrig
behavioral2/files/0x000a0000000234f9-7.dat	xmrig
behavioral2/files/0x00090000000234ec-12.dat	xmrig
behavioral2/files/0x00070000000234fe-25.dat	xmrig
behavioral2/files/0x0007000000023505-51.dat	xmrig
behavioral2/files/0x0007000000023502-52.dat	xmrig
behavioral2/files/0x0007000000023503-68.dat	xmrig
behavioral2/files/0x00070000000234ff-75.dat	xmrig
behavioral2/memory/4540-112-0x00007FF68CC60000-0x00007FF68D056000-memory.dmp	xmrig
behavioral2/files/0x0007000000023512-153.dat	xmrig
behavioral2/files/0x0007000000023517-152.dat	xmrig
behavioral2/files/0x0007000000023510-171.dat	xmrig
behavioral2/memory/3112-189-0x00007FF711BF0000-0x00007FF711FE6000-memory.dmp	xmrig
behavioral2/memory/636-193-0x00007FF721190000-0x00007FF721586000-memory.dmp	xmrig
behavioral2/memory/3952-198-0x00007FF699DE0000-0x00007FF69A1D6000-memory.dmp	xmrig
behavioral2/memory/2600-203-0x00007FF601840000-0x00007FF601C36000-memory.dmp	xmrig
behavioral2/memory/2828-208-0x00007FF670D70000-0x00007FF671166000-memory.dmp	xmrig
behavioral2/memory/3040-207-0x00007FF6B4AE0000-0x00007FF6B4ED6000-memory.dmp	xmrig
behavioral2/memory/4328-206-0x00007FF621850000-0x00007FF621C46000-memory.dmp	xmrig
behavioral2/memory/4360-205-0x00007FF761230000-0x00007FF761626000-memory.dmp	xmrig
behavioral2/memory/3400-204-0x00007FF7E59C0000-0x00007FF7E5DB6000-memory.dmp	xmrig
behavioral2/memory/4204-202-0x00007FF666190000-0x00007FF666586000-memory.dmp	xmrig
behavioral2/memory/948-201-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp	xmrig
behavioral2/memory/1956-200-0x00007FF6C1C70000-0x00007FF6C2066000-memory.dmp	xmrig
behavioral2/memory/4504-199-0x00007FF76ACB0000-0x00007FF76B0A6000-memory.dmp	xmrig
behavioral2/memory/2232-197-0x00007FF6C4AF0000-0x00007FF6C4EE6000-memory.dmp	xmrig
behavioral2/memory/4772-196-0x00007FF75E480000-0x00007FF75E876000-memory.dmp	xmrig
behavioral2/memory/4464-195-0x00007FF74C840000-0x00007FF74CC36000-memory.dmp	xmrig
behavioral2/memory/3236-194-0x00007FF628F80000-0x00007FF629376000-memory.dmp	xmrig
behavioral2/memory/4804-191-0x00007FF756430000-0x00007FF756826000-memory.dmp	xmrig
behavioral2/memory/4912-190-0x00007FF629570000-0x00007FF629966000-memory.dmp	xmrig
behavioral2/files/0x000800000002350d-183.dat	xmrig
behavioral2/files/0x000700000002351c-181.dat	xmrig
behavioral2/files/0x0007000000023516-177.dat	xmrig
behavioral2/files/0x000800000002350e-175.dat	xmrig
behavioral2/memory/3932-173-0x00007FF633080000-0x00007FF633476000-memory.dmp	xmrig
behavioral2/files/0x0007000000023511-167.dat	xmrig
behavioral2/files/0x0007000000023515-165.dat	xmrig
behavioral2/memory/4812-164-0x00007FF6DBC40000-0x00007FF6DC036000-memory.dmp	xmrig
behavioral2/files/0x0007000000023514-162.dat	xmrig
behavioral2/files/0x000700000002351b-161.dat	xmrig
behavioral2/files/0x000700000002351a-160.dat	xmrig
behavioral2/files/0x0007000000023519-159.dat	xmrig
behavioral2/files/0x0007000000023513-157.dat	xmrig
behavioral2/files/0x00090000000234f3-156.dat	xmrig
behavioral2/files/0x0007000000023518-155.dat	xmrig
behavioral2/memory/4740-143-0x00007FF6085C0000-0x00007FF6089B6000-memory.dmp	xmrig
behavioral2/files/0x000700000002350f-121.dat	xmrig
behavioral2/files/0x000700000002350c-117.dat	xmrig
behavioral2/files/0x000700000002350b-89.dat	xmrig
behavioral2/files/0x000700000002350a-87.dat	xmrig
behavioral2/files/0x0007000000023507-85.dat	xmrig
behavioral2/files/0x0007000000023509-83.dat	xmrig
behavioral2/files/0x0007000000023508-77.dat	xmrig
behavioral2/files/0x0007000000023506-74.dat	xmrig
behavioral2/files/0x0007000000023504-70.dat	xmrig
behavioral2/files/0x0007000000023501-61.dat	xmrig
behavioral2/files/0x0007000000023500-55.dat	xmrig
behavioral2/memory/2848-15-0x00007FF7E8D60000-0x00007FF7E9156000-memory.dmp	xmrig
behavioral2/memory/2848-1910-0x00007FF7E8D60000-0x00007FF7E9156000-memory.dmp	xmrig
behavioral2/memory/4540-1911-0x00007FF68CC60000-0x00007FF68D056000-memory.dmp	xmrig
behavioral2/memory/4360-1913-0x00007FF761230000-0x00007FF761626000-memory.dmp	xmrig
behavioral2/memory/4328-1912-0x00007FF621850000-0x00007FF621C46000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	4112	powershell.exe
7	4112	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4112	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2848	nCwevhg.exe
4360	gsDNCnN.exe
4328	eBUKSbZ.exe
4540	judVPnY.exe
4740	fyItUfo.exe
4812	kxoVnwo.exe
3932	Eixgxzg.exe
3112	HmoCBJe.exe
4912	yxKeKUb.exe
4804	FtCOSEM.exe
636	vTkoLnX.exe
3236	PGTLuAQ.exe
4464	hBqtvgF.exe
4772	WQTphFe.exe
3040	gRZnzUQ.exe
2232	EftzHjB.exe
3952	ennIGpe.exe
4504	qjtwnIm.exe
1956	AeyopeR.exe
2828	zIoYhCl.exe
948	SaeVtRC.exe
4204	lHvcMey.exe
2600	KCzJcEi.exe
3400	qJCaIRm.exe
4276	iuXcmIx.exe
2616	IwUopUg.exe
3964	bBAznEP.exe
4104	fdrNpWM.exe
452	EjYfYZk.exe
1152	LsvUZbM.exe
2236	rImjmYy.exe
920	wolDrHm.exe
1920	BzERzrB.exe
1936	aZgjBGU.exe
2448	vIEFdAi.exe
4704	BgnvSZp.exe
2200	nGrKLVh.exe
4232	AYCTLYt.exe
2744	iNrWEiI.exe
720	jmXzqeA.exe
3060	aIRrgYu.exe
3804	RYRptwI.exe
3724	nNxSSKg.exe
3588	hiiiIxy.exe
4692	yYdBwvy.exe
2152	EUfSWyR.exe
3628	qwZgYft.exe
3936	rTJglSp.exe
4612	hdOxSZa.exe
3892	ETdolMR.exe
4792	yUPdYRv.exe
3148	PpYIJZD.exe
400	XQmXqVt.exe
864	vYXkIBv.exe
1184	oGqVCSG.exe
2460	eUgPkKy.exe
3360	KVrjPLO.exe
964	vqxgGRv.exe
608	mLAnQJj.exe
3484	VmviGKM.exe
2196	lBzECdq.exe
4108	jTuRDJf.exe
1144	usvtgBK.exe
896	ygwqURD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4892-0-0x00007FF6059E0000-0x00007FF605DD6000-memory.dmp	upx
behavioral2/files/0x0006000000023287-8.dat	upx
behavioral2/files/0x000a0000000234f9-7.dat	upx
behavioral2/files/0x00090000000234ec-12.dat	upx
behavioral2/files/0x00070000000234fe-25.dat	upx
behavioral2/files/0x0007000000023505-51.dat	upx
behavioral2/files/0x0007000000023502-52.dat	upx
behavioral2/files/0x0007000000023503-68.dat	upx
behavioral2/files/0x00070000000234ff-75.dat	upx
behavioral2/memory/4540-112-0x00007FF68CC60000-0x00007FF68D056000-memory.dmp	upx
behavioral2/files/0x0007000000023512-153.dat	upx
behavioral2/files/0x0007000000023517-152.dat	upx
behavioral2/files/0x0007000000023510-171.dat	upx
behavioral2/memory/3112-189-0x00007FF711BF0000-0x00007FF711FE6000-memory.dmp	upx
behavioral2/memory/636-193-0x00007FF721190000-0x00007FF721586000-memory.dmp	upx
behavioral2/memory/3952-198-0x00007FF699DE0000-0x00007FF69A1D6000-memory.dmp	upx
behavioral2/memory/2600-203-0x00007FF601840000-0x00007FF601C36000-memory.dmp	upx
behavioral2/memory/2828-208-0x00007FF670D70000-0x00007FF671166000-memory.dmp	upx
behavioral2/memory/3040-207-0x00007FF6B4AE0000-0x00007FF6B4ED6000-memory.dmp	upx
behavioral2/memory/4328-206-0x00007FF621850000-0x00007FF621C46000-memory.dmp	upx
behavioral2/memory/4360-205-0x00007FF761230000-0x00007FF761626000-memory.dmp	upx
behavioral2/memory/3400-204-0x00007FF7E59C0000-0x00007FF7E5DB6000-memory.dmp	upx
behavioral2/memory/4204-202-0x00007FF666190000-0x00007FF666586000-memory.dmp	upx
behavioral2/memory/948-201-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp	upx
behavioral2/memory/1956-200-0x00007FF6C1C70000-0x00007FF6C2066000-memory.dmp	upx
behavioral2/memory/4504-199-0x00007FF76ACB0000-0x00007FF76B0A6000-memory.dmp	upx
behavioral2/memory/2232-197-0x00007FF6C4AF0000-0x00007FF6C4EE6000-memory.dmp	upx
behavioral2/memory/4772-196-0x00007FF75E480000-0x00007FF75E876000-memory.dmp	upx
behavioral2/memory/4464-195-0x00007FF74C840000-0x00007FF74CC36000-memory.dmp	upx
behavioral2/memory/3236-194-0x00007FF628F80000-0x00007FF629376000-memory.dmp	upx
behavioral2/memory/4804-191-0x00007FF756430000-0x00007FF756826000-memory.dmp	upx
behavioral2/memory/4912-190-0x00007FF629570000-0x00007FF629966000-memory.dmp	upx
behavioral2/files/0x000800000002350d-183.dat	upx
behavioral2/files/0x000700000002351c-181.dat	upx
behavioral2/files/0x0007000000023516-177.dat	upx
behavioral2/files/0x000800000002350e-175.dat	upx
behavioral2/memory/3932-173-0x00007FF633080000-0x00007FF633476000-memory.dmp	upx
behavioral2/files/0x0007000000023511-167.dat	upx
behavioral2/files/0x0007000000023515-165.dat	upx
behavioral2/memory/4812-164-0x00007FF6DBC40000-0x00007FF6DC036000-memory.dmp	upx
behavioral2/files/0x0007000000023514-162.dat	upx
behavioral2/files/0x000700000002351b-161.dat	upx
behavioral2/files/0x000700000002351a-160.dat	upx
behavioral2/files/0x0007000000023519-159.dat	upx
behavioral2/files/0x0007000000023513-157.dat	upx
behavioral2/files/0x00090000000234f3-156.dat	upx
behavioral2/files/0x0007000000023518-155.dat	upx
behavioral2/memory/4740-143-0x00007FF6085C0000-0x00007FF6089B6000-memory.dmp	upx
behavioral2/files/0x000700000002350f-121.dat	upx
behavioral2/files/0x000700000002350c-117.dat	upx
behavioral2/files/0x000700000002350b-89.dat	upx
behavioral2/files/0x000700000002350a-87.dat	upx
behavioral2/files/0x0007000000023507-85.dat	upx
behavioral2/files/0x0007000000023509-83.dat	upx
behavioral2/files/0x0007000000023508-77.dat	upx
behavioral2/files/0x0007000000023506-74.dat	upx
behavioral2/files/0x0007000000023504-70.dat	upx
behavioral2/files/0x0007000000023501-61.dat	upx
behavioral2/files/0x0007000000023500-55.dat	upx
behavioral2/memory/2848-15-0x00007FF7E8D60000-0x00007FF7E9156000-memory.dmp	upx
behavioral2/memory/2848-1910-0x00007FF7E8D60000-0x00007FF7E9156000-memory.dmp	upx
behavioral2/memory/4540-1911-0x00007FF68CC60000-0x00007FF68D056000-memory.dmp	upx
behavioral2/memory/4360-1913-0x00007FF761230000-0x00007FF761626000-memory.dmp	upx
behavioral2/memory/4328-1912-0x00007FF621850000-0x00007FF621C46000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BRnnPPc.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\TTNDeZk.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\yLmiDpg.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\KstEaub.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\qjQrRgY.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ytNeNjd.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\hiYmZKB.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\hgSClYP.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\geJIPKP.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ZofQsLT.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ZfKycFD.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\HwPhqAV.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ARBUKZL.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\pecrYPG.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\uJslYOj.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\XKTerbo.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\JPCuZSd.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\FzEUwaj.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ZKMzrRW.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\VGdhNfS.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\HEbgErp.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\URiiBpZ.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\HhRmUIh.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\MPAaZMd.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\NnRDCSj.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\RhWeeXU.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\PwLjSgF.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\QUIeHnC.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\mortQuw.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\CFwMbkx.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\kHqyTOd.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\UcVBzJV.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\QdewkKg.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\SazXxhG.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\tLVWUpU.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\oZCEtEn.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\XCldlDQ.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\QRddBlm.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\uLkjVSv.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\qUZnXyO.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\zfROoDi.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\BweGWcc.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\KoDNNBe.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\evyWlTq.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\aqWbOWp.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\euBVzeO.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\YqgtLHc.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\beUbROp.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\hYyBRKV.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\alzLawb.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\XLoayqi.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ZpjZvBy.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\xLdUPkQ.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\UzKTzjX.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ixsGrsI.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\ZgCjgVr.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\MtzzAQu.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\lOoSrFm.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\fjiBkmA.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\LRCFEjL.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\CgjuUbM.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\AFwLzHm.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\SsnSYUi.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
File created	C:\Windows\System\IOIgNZm.exe	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4112	powershell.exe
4112	powershell.exe
4112	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeLockMemoryPrivilege	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4112	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	81
PID 4892 wrote to memory of 4112	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	81
PID 4892 wrote to memory of 2848	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	82
PID 4892 wrote to memory of 2848	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	82
PID 4892 wrote to memory of 4360	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	83
PID 4892 wrote to memory of 4360	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	83
PID 4892 wrote to memory of 4328	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	84
PID 4892 wrote to memory of 4328	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	84
PID 4892 wrote to memory of 4540	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	85
PID 4892 wrote to memory of 4540	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	85
PID 4892 wrote to memory of 3112	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	87
PID 4892 wrote to memory of 3112	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	87
PID 4892 wrote to memory of 4740	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	88
PID 4892 wrote to memory of 4740	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	88
PID 4892 wrote to memory of 4812	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	89
PID 4892 wrote to memory of 4812	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	89
PID 4892 wrote to memory of 3932	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	90
PID 4892 wrote to memory of 3932	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	90
PID 4892 wrote to memory of 4912	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	91
PID 4892 wrote to memory of 4912	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	91
PID 4892 wrote to memory of 4804	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	92
PID 4892 wrote to memory of 4804	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	92
PID 4892 wrote to memory of 636	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	93
PID 4892 wrote to memory of 636	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	93
PID 4892 wrote to memory of 3236	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	94
PID 4892 wrote to memory of 3236	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	94
PID 4892 wrote to memory of 4464	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	95
PID 4892 wrote to memory of 4464	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	95
PID 4892 wrote to memory of 4772	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	96
PID 4892 wrote to memory of 4772	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	96
PID 4892 wrote to memory of 3040	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	97
PID 4892 wrote to memory of 3040	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	97
PID 4892 wrote to memory of 2232	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	98
PID 4892 wrote to memory of 2232	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	98
PID 4892 wrote to memory of 3952	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	99
PID 4892 wrote to memory of 3952	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	99
PID 4892 wrote to memory of 4504	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	100
PID 4892 wrote to memory of 4504	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	100
PID 4892 wrote to memory of 1956	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	101
PID 4892 wrote to memory of 1956	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	101
PID 4892 wrote to memory of 2600	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	102
PID 4892 wrote to memory of 2600	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	102
PID 4892 wrote to memory of 2828	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	103
PID 4892 wrote to memory of 2828	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	103
PID 4892 wrote to memory of 948	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	104
PID 4892 wrote to memory of 948	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	104
PID 4892 wrote to memory of 4204	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	105
PID 4892 wrote to memory of 4204	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	105
PID 4892 wrote to memory of 3400	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	106
PID 4892 wrote to memory of 3400	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	106
PID 4892 wrote to memory of 4276	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	107
PID 4892 wrote to memory of 4276	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	107
PID 4892 wrote to memory of 2616	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	108
PID 4892 wrote to memory of 2616	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	108
PID 4892 wrote to memory of 3964	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	109
PID 4892 wrote to memory of 3964	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	109
PID 4892 wrote to memory of 4104	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	110
PID 4892 wrote to memory of 4104	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	110
PID 4892 wrote to memory of 452	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	111
PID 4892 wrote to memory of 452	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	111
PID 4892 wrote to memory of 1152	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	112
PID 4892 wrote to memory of 1152	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	112
PID 4892 wrote to memory of 2236	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	113
PID 4892 wrote to memory of 2236	4892	7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe	113

C:\Users\Admin\AppData\Local\Temp\7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe
"C:\Users\Admin\AppData\Local\Temp\7e43daa7f5af7394e5c7d5e1dfa814212c893b58ccf13fb35de5e8224b18be8e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4112" "2956" "2880" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12936
- C:\Windows\System\nCwevhg.exe
  C:\Windows\System\nCwevhg.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\gsDNCnN.exe
  C:\Windows\System\gsDNCnN.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\eBUKSbZ.exe
  C:\Windows\System\eBUKSbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\judVPnY.exe
  C:\Windows\System\judVPnY.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\HmoCBJe.exe
  C:\Windows\System\HmoCBJe.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\fyItUfo.exe
  C:\Windows\System\fyItUfo.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\kxoVnwo.exe
  C:\Windows\System\kxoVnwo.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\Eixgxzg.exe
  C:\Windows\System\Eixgxzg.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\yxKeKUb.exe
  C:\Windows\System\yxKeKUb.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\FtCOSEM.exe
  C:\Windows\System\FtCOSEM.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\vTkoLnX.exe
  C:\Windows\System\vTkoLnX.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\PGTLuAQ.exe
  C:\Windows\System\PGTLuAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\hBqtvgF.exe
  C:\Windows\System\hBqtvgF.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\WQTphFe.exe
  C:\Windows\System\WQTphFe.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\gRZnzUQ.exe
  C:\Windows\System\gRZnzUQ.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\EftzHjB.exe
  C:\Windows\System\EftzHjB.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ennIGpe.exe
  C:\Windows\System\ennIGpe.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\qjtwnIm.exe
  C:\Windows\System\qjtwnIm.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\AeyopeR.exe
  C:\Windows\System\AeyopeR.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\KCzJcEi.exe
  C:\Windows\System\KCzJcEi.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\zIoYhCl.exe
  C:\Windows\System\zIoYhCl.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\SaeVtRC.exe
  C:\Windows\System\SaeVtRC.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\lHvcMey.exe
  C:\Windows\System\lHvcMey.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\qJCaIRm.exe
  C:\Windows\System\qJCaIRm.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\iuXcmIx.exe
  C:\Windows\System\iuXcmIx.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\IwUopUg.exe
  C:\Windows\System\IwUopUg.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\bBAznEP.exe
  C:\Windows\System\bBAznEP.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\fdrNpWM.exe
  C:\Windows\System\fdrNpWM.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\EjYfYZk.exe
  C:\Windows\System\EjYfYZk.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\LsvUZbM.exe
  C:\Windows\System\LsvUZbM.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\rImjmYy.exe
  C:\Windows\System\rImjmYy.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\wolDrHm.exe
  C:\Windows\System\wolDrHm.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\BzERzrB.exe
  C:\Windows\System\BzERzrB.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\aZgjBGU.exe
  C:\Windows\System\aZgjBGU.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\vIEFdAi.exe
  C:\Windows\System\vIEFdAi.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\BgnvSZp.exe
  C:\Windows\System\BgnvSZp.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\nGrKLVh.exe
  C:\Windows\System\nGrKLVh.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\AYCTLYt.exe
  C:\Windows\System\AYCTLYt.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\iNrWEiI.exe
  C:\Windows\System\iNrWEiI.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\jmXzqeA.exe
  C:\Windows\System\jmXzqeA.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\aIRrgYu.exe
  C:\Windows\System\aIRrgYu.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\RYRptwI.exe
  C:\Windows\System\RYRptwI.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\nNxSSKg.exe
  C:\Windows\System\nNxSSKg.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\hiiiIxy.exe
  C:\Windows\System\hiiiIxy.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\yYdBwvy.exe
  C:\Windows\System\yYdBwvy.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\EUfSWyR.exe
  C:\Windows\System\EUfSWyR.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\qwZgYft.exe
  C:\Windows\System\qwZgYft.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\rTJglSp.exe
  C:\Windows\System\rTJglSp.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\hdOxSZa.exe
  C:\Windows\System\hdOxSZa.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\ETdolMR.exe
  C:\Windows\System\ETdolMR.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\yUPdYRv.exe
  C:\Windows\System\yUPdYRv.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\PpYIJZD.exe
  C:\Windows\System\PpYIJZD.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\XQmXqVt.exe
  C:\Windows\System\XQmXqVt.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\vYXkIBv.exe
  C:\Windows\System\vYXkIBv.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\oGqVCSG.exe
  C:\Windows\System\oGqVCSG.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\eUgPkKy.exe
  C:\Windows\System\eUgPkKy.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\KVrjPLO.exe
  C:\Windows\System\KVrjPLO.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\vqxgGRv.exe
  C:\Windows\System\vqxgGRv.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\mLAnQJj.exe
  C:\Windows\System\mLAnQJj.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\VmviGKM.exe
  C:\Windows\System\VmviGKM.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\lBzECdq.exe
  C:\Windows\System\lBzECdq.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\jTuRDJf.exe
  C:\Windows\System\jTuRDJf.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\usvtgBK.exe
  C:\Windows\System\usvtgBK.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ygwqURD.exe
  C:\Windows\System\ygwqURD.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\CvLoPzB.exe
  C:\Windows\System\CvLoPzB.exe
  2⤵
  PID:1600
- C:\Windows\System\RppqYkd.exe
  C:\Windows\System\RppqYkd.exe
  2⤵
  PID:4880
- C:\Windows\System\BdUzIot.exe
  C:\Windows\System\BdUzIot.exe
  2⤵
  PID:2192
- C:\Windows\System\jHigUxF.exe
  C:\Windows\System\jHigUxF.exe
  2⤵
  PID:3516
- C:\Windows\System\LvyQprK.exe
  C:\Windows\System\LvyQprK.exe
  2⤵
  PID:3972
- C:\Windows\System\HsaswEK.exe
  C:\Windows\System\HsaswEK.exe
  2⤵
  PID:4252
- C:\Windows\System\mWjZFjv.exe
  C:\Windows\System\mWjZFjv.exe
  2⤵
  PID:5128
- C:\Windows\System\iGjlpbY.exe
  C:\Windows\System\iGjlpbY.exe
  2⤵
  PID:5144
- C:\Windows\System\SxmwoHi.exe
  C:\Windows\System\SxmwoHi.exe
  2⤵
  PID:5160
- C:\Windows\System\nyGIUAn.exe
  C:\Windows\System\nyGIUAn.exe
  2⤵
  PID:5176
- C:\Windows\System\whibJga.exe
  C:\Windows\System\whibJga.exe
  2⤵
  PID:5192
- C:\Windows\System\dnlsnEP.exe
  C:\Windows\System\dnlsnEP.exe
  2⤵
  PID:5208
- C:\Windows\System\hHQkaVu.exe
  C:\Windows\System\hHQkaVu.exe
  2⤵
  PID:5224
- C:\Windows\System\qbJkqip.exe
  C:\Windows\System\qbJkqip.exe
  2⤵
  PID:5240
- C:\Windows\System\VTMOUaQ.exe
  C:\Windows\System\VTMOUaQ.exe
  2⤵
  PID:5256
- C:\Windows\System\gDXGtla.exe
  C:\Windows\System\gDXGtla.exe
  2⤵
  PID:5272
- C:\Windows\System\BMYiRDw.exe
  C:\Windows\System\BMYiRDw.exe
  2⤵
  PID:5288
- C:\Windows\System\mQjSpqV.exe
  C:\Windows\System\mQjSpqV.exe
  2⤵
  PID:5304
- C:\Windows\System\IPNUiGT.exe
  C:\Windows\System\IPNUiGT.exe
  2⤵
  PID:5320
- C:\Windows\System\VoVdGrq.exe
  C:\Windows\System\VoVdGrq.exe
  2⤵
  PID:5336
- C:\Windows\System\OjdqxTM.exe
  C:\Windows\System\OjdqxTM.exe
  2⤵
  PID:5352
- C:\Windows\System\mHbpcBN.exe
  C:\Windows\System\mHbpcBN.exe
  2⤵
  PID:5620
- C:\Windows\System\UxyxThT.exe
  C:\Windows\System\UxyxThT.exe
  2⤵
  PID:5684
- C:\Windows\System\HZGoxZK.exe
  C:\Windows\System\HZGoxZK.exe
  2⤵
  PID:5700
- C:\Windows\System\cabULMK.exe
  C:\Windows\System\cabULMK.exe
  2⤵
  PID:5716
- C:\Windows\System\CWivVdk.exe
  C:\Windows\System\CWivVdk.exe
  2⤵
  PID:5732
- C:\Windows\System\voAYbum.exe
  C:\Windows\System\voAYbum.exe
  2⤵
  PID:5748
- C:\Windows\System\OKoraHR.exe
  C:\Windows\System\OKoraHR.exe
  2⤵
  PID:5764
- C:\Windows\System\vIzTByN.exe
  C:\Windows\System\vIzTByN.exe
  2⤵
  PID:5780
- C:\Windows\System\FbBlhUB.exe
  C:\Windows\System\FbBlhUB.exe
  2⤵
  PID:5796
- C:\Windows\System\VRnmrdv.exe
  C:\Windows\System\VRnmrdv.exe
  2⤵
  PID:5812
- C:\Windows\System\iLzhgUS.exe
  C:\Windows\System\iLzhgUS.exe
  2⤵
  PID:5828
- C:\Windows\System\OWGiiqq.exe
  C:\Windows\System\OWGiiqq.exe
  2⤵
  PID:5844
- C:\Windows\System\TLyMfxR.exe
  C:\Windows\System\TLyMfxR.exe
  2⤵
  PID:5868
- C:\Windows\System\ilFePEz.exe
  C:\Windows\System\ilFePEz.exe
  2⤵
  PID:5964
- C:\Windows\System\ANnQnVS.exe
  C:\Windows\System\ANnQnVS.exe
  2⤵
  PID:5980
- C:\Windows\System\BWzZivI.exe
  C:\Windows\System\BWzZivI.exe
  2⤵
  PID:5996
- C:\Windows\System\eObJPKj.exe
  C:\Windows\System\eObJPKj.exe
  2⤵
  PID:6012
- C:\Windows\System\kBoOQlZ.exe
  C:\Windows\System\kBoOQlZ.exe
  2⤵
  PID:6028
- C:\Windows\System\NPipSpp.exe
  C:\Windows\System\NPipSpp.exe
  2⤵
  PID:6052
- C:\Windows\System\zKiyuGn.exe
  C:\Windows\System\zKiyuGn.exe
  2⤵
  PID:1776
- C:\Windows\System\BcDQhlu.exe
  C:\Windows\System\BcDQhlu.exe
  2⤵
  PID:4056
- C:\Windows\System\xWiImYq.exe
  C:\Windows\System\xWiImYq.exe
  2⤵
  PID:3576
- C:\Windows\System\DtZwDoG.exe
  C:\Windows\System\DtZwDoG.exe
  2⤵
  PID:2976
- C:\Windows\System\qsjcsCp.exe
  C:\Windows\System\qsjcsCp.exe
  2⤵
  PID:3596
- C:\Windows\System\dyOjQFu.exe
  C:\Windows\System\dyOjQFu.exe
  2⤵
  PID:2936
- C:\Windows\System\yKKRZmI.exe
  C:\Windows\System\yKKRZmI.exe
  2⤵
  PID:5296
- C:\Windows\System\VzSQFpu.exe
  C:\Windows\System\VzSQFpu.exe
  2⤵
  PID:5360
- C:\Windows\System\CvKNAdQ.exe
  C:\Windows\System\CvKNAdQ.exe
  2⤵
  PID:5416
- C:\Windows\System\kNEKoIB.exe
  C:\Windows\System\kNEKoIB.exe
  2⤵
  PID:5472
- C:\Windows\System\qrOtOva.exe
  C:\Windows\System\qrOtOva.exe
  2⤵
  PID:5364
- C:\Windows\System\szlMGGX.exe
  C:\Windows\System\szlMGGX.exe
  2⤵
  PID:5792
- C:\Windows\System\bTiKeKG.exe
  C:\Windows\System\bTiKeKG.exe
  2⤵
  PID:4532
- C:\Windows\System\ymiDjmu.exe
  C:\Windows\System\ymiDjmu.exe
  2⤵
  PID:4548
- C:\Windows\System\YKOKmxx.exe
  C:\Windows\System\YKOKmxx.exe
  2⤵
  PID:4724
- C:\Windows\System\KVExJIL.exe
  C:\Windows\System\KVExJIL.exe
  2⤵
  PID:5724
- C:\Windows\System\twPcJWO.exe
  C:\Windows\System\twPcJWO.exe
  2⤵
  PID:5884
- C:\Windows\System\zfROoDi.exe
  C:\Windows\System\zfROoDi.exe
  2⤵
  PID:5916
- C:\Windows\System\vVqWTMe.exe
  C:\Windows\System\vVqWTMe.exe
  2⤵
  PID:5948
- C:\Windows\System\QxJwZjL.exe
  C:\Windows\System\QxJwZjL.exe
  2⤵
  PID:6004
- C:\Windows\System\QcWHHRI.exe
  C:\Windows\System\QcWHHRI.exe
  2⤵
  PID:3552
- C:\Windows\System\JsMnhVb.exe
  C:\Windows\System\JsMnhVb.exe
  2⤵
  PID:2336
- C:\Windows\System\ftwagED.exe
  C:\Windows\System\ftwagED.exe
  2⤵
  PID:648
- C:\Windows\System\yzZiYeS.exe
  C:\Windows\System\yzZiYeS.exe
  2⤵
  PID:4600
- C:\Windows\System\KSUfvkT.exe
  C:\Windows\System\KSUfvkT.exe
  2⤵
  PID:316
- C:\Windows\System\mkyqauz.exe
  C:\Windows\System\mkyqauz.exe
  2⤵
  PID:3672
- C:\Windows\System\wMFkbuA.exe
  C:\Windows\System\wMFkbuA.exe
  2⤵
  PID:2016
- C:\Windows\System\wpOnoWW.exe
  C:\Windows\System\wpOnoWW.exe
  2⤵
  PID:728
- C:\Windows\System\jmoNWZY.exe
  C:\Windows\System\jmoNWZY.exe
  2⤵
  PID:4152
- C:\Windows\System\kWGGvHI.exe
  C:\Windows\System\kWGGvHI.exe
  2⤵
  PID:868
- C:\Windows\System\NFNJvVe.exe
  C:\Windows\System\NFNJvVe.exe
  2⤵
  PID:5152
- C:\Windows\System\fxeiRPW.exe
  C:\Windows\System\fxeiRPW.exe
  2⤵
  PID:1396
- C:\Windows\System\EqMMINu.exe
  C:\Windows\System\EqMMINu.exe
  2⤵
  PID:2508
- C:\Windows\System\hCKqfph.exe
  C:\Windows\System\hCKqfph.exe
  2⤵
  PID:112
- C:\Windows\System\LykXLrA.exe
  C:\Windows\System\LykXLrA.exe
  2⤵
  PID:4956
- C:\Windows\System\swBCoDZ.exe
  C:\Windows\System\swBCoDZ.exe
  2⤵
  PID:5316
- C:\Windows\System\ALrPDmG.exe
  C:\Windows\System\ALrPDmG.exe
  2⤵
  PID:4424
- C:\Windows\System\wLNqxwE.exe
  C:\Windows\System\wLNqxwE.exe
  2⤵
  PID:5632
- C:\Windows\System\QSYetHj.exe
  C:\Windows\System\QSYetHj.exe
  2⤵
  PID:2384
- C:\Windows\System\wSSrPcR.exe
  C:\Windows\System\wSSrPcR.exe
  2⤵
  PID:5804
- C:\Windows\System\ZagKXPe.exe
  C:\Windows\System\ZagKXPe.exe
  2⤵
  PID:5976
- C:\Windows\System\ijqDJAy.exe
  C:\Windows\System\ijqDJAy.exe
  2⤵
  PID:6124
- C:\Windows\System\UMNoQuG.exe
  C:\Windows\System\UMNoQuG.exe
  2⤵
  PID:1056
- C:\Windows\System\srRsfSm.exe
  C:\Windows\System\srRsfSm.exe
  2⤵
  PID:3044
- C:\Windows\System\rKPfjlg.exe
  C:\Windows\System\rKPfjlg.exe
  2⤵
  PID:4920
- C:\Windows\System\rdxfmcw.exe
  C:\Windows\System\rdxfmcw.exe
  2⤵
  PID:3308
- C:\Windows\System\APgrYko.exe
  C:\Windows\System\APgrYko.exe
  2⤵
  PID:5232
- C:\Windows\System\uXKmSKb.exe
  C:\Windows\System\uXKmSKb.exe
  2⤵
  PID:3928
- C:\Windows\System\XvpCfSQ.exe
  C:\Windows\System\XvpCfSQ.exe
  2⤵
  PID:5464
- C:\Windows\System\IqMfmbe.exe
  C:\Windows\System\IqMfmbe.exe
  2⤵
  PID:1192
- C:\Windows\System\CSRCMqQ.exe
  C:\Windows\System\CSRCMqQ.exe
  2⤵
  PID:5972
- C:\Windows\System\uLQWXmO.exe
  C:\Windows\System\uLQWXmO.exe
  2⤵
  PID:4016
- C:\Windows\System\FRbqrYc.exe
  C:\Windows\System\FRbqrYc.exe
  2⤵
  PID:1652
- C:\Windows\System\sXEjhUP.exe
  C:\Windows\System\sXEjhUP.exe
  2⤵
  PID:1344
- C:\Windows\System\QXaCOdr.exe
  C:\Windows\System\QXaCOdr.exe
  2⤵
  PID:5744
- C:\Windows\System\XkObjWg.exe
  C:\Windows\System\XkObjWg.exe
  2⤵
  PID:5216
- C:\Windows\System\tMzgRhv.exe
  C:\Windows\System\tMzgRhv.exe
  2⤵
  PID:4716
- C:\Windows\System\jPHIOBQ.exe
  C:\Windows\System\jPHIOBQ.exe
  2⤵
  PID:6160
- C:\Windows\System\QpSqCAX.exe
  C:\Windows\System\QpSqCAX.exe
  2⤵
  PID:6180
- C:\Windows\System\kTuuzTH.exe
  C:\Windows\System\kTuuzTH.exe
  2⤵
  PID:6216
- C:\Windows\System\aZnkqRd.exe
  C:\Windows\System\aZnkqRd.exe
  2⤵
  PID:6232
- C:\Windows\System\CJiyGaV.exe
  C:\Windows\System\CJiyGaV.exe
  2⤵
  PID:6272
- C:\Windows\System\bSHsXWi.exe
  C:\Windows\System\bSHsXWi.exe
  2⤵
  PID:6304
- C:\Windows\System\pTklPfc.exe
  C:\Windows\System\pTklPfc.exe
  2⤵
  PID:6328
- C:\Windows\System\axxPgLF.exe
  C:\Windows\System\axxPgLF.exe
  2⤵
  PID:6344
- C:\Windows\System\snhILuH.exe
  C:\Windows\System\snhILuH.exe
  2⤵
  PID:6376
- C:\Windows\System\yCeJgjL.exe
  C:\Windows\System\yCeJgjL.exe
  2⤵
  PID:6404
- C:\Windows\System\jMtrizf.exe
  C:\Windows\System\jMtrizf.exe
  2⤵
  PID:6440
- C:\Windows\System\IpmqFiq.exe
  C:\Windows\System\IpmqFiq.exe
  2⤵
  PID:6468
- C:\Windows\System\YETNlLM.exe
  C:\Windows\System\YETNlLM.exe
  2⤵
  PID:6484
- C:\Windows\System\HJyUNMU.exe
  C:\Windows\System\HJyUNMU.exe
  2⤵
  PID:6516
- C:\Windows\System\SRXoGsc.exe
  C:\Windows\System\SRXoGsc.exe
  2⤵
  PID:6548
- C:\Windows\System\JJdcRLj.exe
  C:\Windows\System\JJdcRLj.exe
  2⤵
  PID:6584
- C:\Windows\System\HVfPMss.exe
  C:\Windows\System\HVfPMss.exe
  2⤵
  PID:6612
- C:\Windows\System\dZmAlOP.exe
  C:\Windows\System\dZmAlOP.exe
  2⤵
  PID:6640
- C:\Windows\System\uWcVDar.exe
  C:\Windows\System\uWcVDar.exe
  2⤵
  PID:6668
- C:\Windows\System\awCtGMx.exe
  C:\Windows\System\awCtGMx.exe
  2⤵
  PID:6688
- C:\Windows\System\SckAhPB.exe
  C:\Windows\System\SckAhPB.exe
  2⤵
  PID:6716
- C:\Windows\System\cLUJdzU.exe
  C:\Windows\System\cLUJdzU.exe
  2⤵
  PID:6744
- C:\Windows\System\lVEHALe.exe
  C:\Windows\System\lVEHALe.exe
  2⤵
  PID:6780
- C:\Windows\System\MvaCjgV.exe
  C:\Windows\System\MvaCjgV.exe
  2⤵
  PID:6808
- C:\Windows\System\ibdXwpD.exe
  C:\Windows\System\ibdXwpD.exe
  2⤵
  PID:6836
- C:\Windows\System\kCotusD.exe
  C:\Windows\System\kCotusD.exe
  2⤵
  PID:6864
- C:\Windows\System\JZpFEaC.exe
  C:\Windows\System\JZpFEaC.exe
  2⤵
  PID:6892
- C:\Windows\System\qaGHBVx.exe
  C:\Windows\System\qaGHBVx.exe
  2⤵
  PID:6920
- C:\Windows\System\lbBqOgW.exe
  C:\Windows\System\lbBqOgW.exe
  2⤵
  PID:6948
- C:\Windows\System\IrmuPJD.exe
  C:\Windows\System\IrmuPJD.exe
  2⤵
  PID:6976
- C:\Windows\System\NPuSxYz.exe
  C:\Windows\System\NPuSxYz.exe
  2⤵
  PID:7008
- C:\Windows\System\zRzIxMY.exe
  C:\Windows\System\zRzIxMY.exe
  2⤵
  PID:7032
- C:\Windows\System\ymgKOMn.exe
  C:\Windows\System\ymgKOMn.exe
  2⤵
  PID:7060
- C:\Windows\System\yBGczZc.exe
  C:\Windows\System\yBGczZc.exe
  2⤵
  PID:7080
- C:\Windows\System\jnPNDqn.exe
  C:\Windows\System\jnPNDqn.exe
  2⤵
  PID:7116
- C:\Windows\System\yFZqxkz.exe
  C:\Windows\System\yFZqxkz.exe
  2⤵
  PID:7144
- C:\Windows\System\OSMVqBO.exe
  C:\Windows\System\OSMVqBO.exe
  2⤵
  PID:7160
- C:\Windows\System\lEJYIFd.exe
  C:\Windows\System\lEJYIFd.exe
  2⤵
  PID:6188
- C:\Windows\System\TTxXDMr.exe
  C:\Windows\System\TTxXDMr.exe
  2⤵
  PID:6228
- C:\Windows\System\LfwebFJ.exe
  C:\Windows\System\LfwebFJ.exe
  2⤵
  PID:6252
- C:\Windows\System\aUGzHuA.exe
  C:\Windows\System\aUGzHuA.exe
  2⤵
  PID:6340
- C:\Windows\System\ZRverKv.exe
  C:\Windows\System\ZRverKv.exe
  2⤵
  PID:6424
- C:\Windows\System\gqjasIo.exe
  C:\Windows\System\gqjasIo.exe
  2⤵
  PID:6500
- C:\Windows\System\TmJRspk.exe
  C:\Windows\System\TmJRspk.exe
  2⤵
  PID:6568
- C:\Windows\System\vkANsyg.exe
  C:\Windows\System\vkANsyg.exe
  2⤵
  PID:6648
- C:\Windows\System\MFPTVVX.exe
  C:\Windows\System\MFPTVVX.exe
  2⤵
  PID:6684
- C:\Windows\System\CDttiQu.exe
  C:\Windows\System\CDttiQu.exe
  2⤵
  PID:6824
- C:\Windows\System\yMyzYLJ.exe
  C:\Windows\System\yMyzYLJ.exe
  2⤵
  PID:6860
- C:\Windows\System\wgdAmCC.exe
  C:\Windows\System\wgdAmCC.exe
  2⤵
  PID:6944
- C:\Windows\System\qrFDbzN.exe
  C:\Windows\System\qrFDbzN.exe
  2⤵
  PID:7016
- C:\Windows\System\FWjHXDv.exe
  C:\Windows\System\FWjHXDv.exe
  2⤵
  PID:7068
- C:\Windows\System\gCVXybC.exe
  C:\Windows\System\gCVXybC.exe
  2⤵
  PID:7136
- C:\Windows\System\yLSmXar.exe
  C:\Windows\System\yLSmXar.exe
  2⤵
  PID:6208
- C:\Windows\System\FqbPIJu.exe
  C:\Windows\System\FqbPIJu.exe
  2⤵
  PID:6292
- C:\Windows\System\BFaMhrn.exe
  C:\Windows\System\BFaMhrn.exe
  2⤵
  PID:6384
- C:\Windows\System\MEwlzTe.exe
  C:\Windows\System\MEwlzTe.exe
  2⤵
  PID:6676
- C:\Windows\System\VJmeBte.exe
  C:\Windows\System\VJmeBte.exe
  2⤵
  PID:6964
- C:\Windows\System\hphuuyI.exe
  C:\Windows\System\hphuuyI.exe
  2⤵
  PID:7088
- C:\Windows\System\rtlojwb.exe
  C:\Windows\System\rtlojwb.exe
  2⤵
  PID:6224
- C:\Windows\System\qcnZleV.exe
  C:\Windows\System\qcnZleV.exe
  2⤵
  PID:6664
- C:\Windows\System\AUKMHyw.exe
  C:\Windows\System\AUKMHyw.exe
  2⤵
  PID:6852
- C:\Windows\System\gJgwNAc.exe
  C:\Windows\System\gJgwNAc.exe
  2⤵
  PID:6636
- C:\Windows\System\sEtcvJY.exe
  C:\Windows\System\sEtcvJY.exe
  2⤵
  PID:7028
- C:\Windows\System\MgBHPGZ.exe
  C:\Windows\System\MgBHPGZ.exe
  2⤵
  PID:7184
- C:\Windows\System\qTVAWGt.exe
  C:\Windows\System\qTVAWGt.exe
  2⤵
  PID:7212
- C:\Windows\System\dziOrFI.exe
  C:\Windows\System\dziOrFI.exe
  2⤵
  PID:7228
- C:\Windows\System\RhWeeXU.exe
  C:\Windows\System\RhWeeXU.exe
  2⤵
  PID:7260
- C:\Windows\System\KqTaHRY.exe
  C:\Windows\System\KqTaHRY.exe
  2⤵
  PID:7288
- C:\Windows\System\iALDUOb.exe
  C:\Windows\System\iALDUOb.exe
  2⤵
  PID:7324
- C:\Windows\System\IzMnhCz.exe
  C:\Windows\System\IzMnhCz.exe
  2⤵
  PID:7356
- C:\Windows\System\lWYGhHG.exe
  C:\Windows\System\lWYGhHG.exe
  2⤵
  PID:7380
- C:\Windows\System\BdeFpfX.exe
  C:\Windows\System\BdeFpfX.exe
  2⤵
  PID:7412
- C:\Windows\System\LtLXFrV.exe
  C:\Windows\System\LtLXFrV.exe
  2⤵
  PID:7440
- C:\Windows\System\WdjJOuB.exe
  C:\Windows\System\WdjJOuB.exe
  2⤵
  PID:7468
- C:\Windows\System\jRssjMo.exe
  C:\Windows\System\jRssjMo.exe
  2⤵
  PID:7484
- C:\Windows\System\qelcjXs.exe
  C:\Windows\System\qelcjXs.exe
  2⤵
  PID:7512
- C:\Windows\System\fbedGkB.exe
  C:\Windows\System\fbedGkB.exe
  2⤵
  PID:7552
- C:\Windows\System\WZAssks.exe
  C:\Windows\System\WZAssks.exe
  2⤵
  PID:7580
- C:\Windows\System\OuLfgXI.exe
  C:\Windows\System\OuLfgXI.exe
  2⤵
  PID:7596
- C:\Windows\System\tjacWLh.exe
  C:\Windows\System\tjacWLh.exe
  2⤵
  PID:7624
- C:\Windows\System\RgpHCpt.exe
  C:\Windows\System\RgpHCpt.exe
  2⤵
  PID:7660
- C:\Windows\System\rBeXQhu.exe
  C:\Windows\System\rBeXQhu.exe
  2⤵
  PID:7692
- C:\Windows\System\pyljTJA.exe
  C:\Windows\System\pyljTJA.exe
  2⤵
  PID:7720
- C:\Windows\System\kgGPvmC.exe
  C:\Windows\System\kgGPvmC.exe
  2⤵
  PID:7740
- C:\Windows\System\rCjCORI.exe
  C:\Windows\System\rCjCORI.exe
  2⤵
  PID:7756
- C:\Windows\System\yEZGXjk.exe
  C:\Windows\System\yEZGXjk.exe
  2⤵
  PID:7784
- C:\Windows\System\vPQULGj.exe
  C:\Windows\System\vPQULGj.exe
  2⤵
  PID:7800
- C:\Windows\System\FnvSLoF.exe
  C:\Windows\System\FnvSLoF.exe
  2⤵
  PID:7816
- C:\Windows\System\RZWgZgi.exe
  C:\Windows\System\RZWgZgi.exe
  2⤵
  PID:7848
- C:\Windows\System\slfsfgC.exe
  C:\Windows\System\slfsfgC.exe
  2⤵
  PID:7880
- C:\Windows\System\WhEHFbF.exe
  C:\Windows\System\WhEHFbF.exe
  2⤵
  PID:7916
- C:\Windows\System\immegFD.exe
  C:\Windows\System\immegFD.exe
  2⤵
  PID:7960
- C:\Windows\System\mewIiZV.exe
  C:\Windows\System\mewIiZV.exe
  2⤵
  PID:7992
- C:\Windows\System\zqTuBhg.exe
  C:\Windows\System\zqTuBhg.exe
  2⤵
  PID:8012
- C:\Windows\System\DHLpbje.exe
  C:\Windows\System\DHLpbje.exe
  2⤵
  PID:8044
- C:\Windows\System\tRwuSqG.exe
  C:\Windows\System\tRwuSqG.exe
  2⤵
  PID:8080
- C:\Windows\System\FWiFvjN.exe
  C:\Windows\System\FWiFvjN.exe
  2⤵
  PID:8100
- C:\Windows\System\zhjYksP.exe
  C:\Windows\System\zhjYksP.exe
  2⤵
  PID:8132
- C:\Windows\System\aNXUWkF.exe
  C:\Windows\System\aNXUWkF.exe
  2⤵
  PID:8168
- C:\Windows\System\oRomNjx.exe
  C:\Windows\System\oRomNjx.exe
  2⤵
  PID:7196
- C:\Windows\System\ShQJwtE.exe
  C:\Windows\System\ShQJwtE.exe
  2⤵
  PID:7240
- C:\Windows\System\SPjoPUd.exe
  C:\Windows\System\SPjoPUd.exe
  2⤵
  PID:7308
- C:\Windows\System\yzYTtyd.exe
  C:\Windows\System\yzYTtyd.exe
  2⤵
  PID:7396
- C:\Windows\System\clTlucB.exe
  C:\Windows\System\clTlucB.exe
  2⤵
  PID:7428
- C:\Windows\System\yxuUwwa.exe
  C:\Windows\System\yxuUwwa.exe
  2⤵
  PID:7476
- C:\Windows\System\zLawIld.exe
  C:\Windows\System\zLawIld.exe
  2⤵
  PID:7564
- C:\Windows\System\hkPPnML.exe
  C:\Windows\System\hkPPnML.exe
  2⤵
  PID:7652
- C:\Windows\System\okUHWUU.exe
  C:\Windows\System\okUHWUU.exe
  2⤵
  PID:7716
- C:\Windows\System\zJshein.exe
  C:\Windows\System\zJshein.exe
  2⤵
  PID:7772
- C:\Windows\System\VppyQPj.exe
  C:\Windows\System\VppyQPj.exe
  2⤵
  PID:7844
- C:\Windows\System\sczCHcm.exe
  C:\Windows\System\sczCHcm.exe
  2⤵
  PID:7908
- C:\Windows\System\ZfKycFD.exe
  C:\Windows\System\ZfKycFD.exe
  2⤵
  PID:8000
- C:\Windows\System\akclsWs.exe
  C:\Windows\System\akclsWs.exe
  2⤵
  PID:8052
- C:\Windows\System\IshRwYx.exe
  C:\Windows\System\IshRwYx.exe
  2⤵
  PID:8064
- C:\Windows\System\LmnhGDr.exe
  C:\Windows\System\LmnhGDr.exe
  2⤵
  PID:8156
- C:\Windows\System\PuDXOxC.exe
  C:\Windows\System\PuDXOxC.exe
  2⤵
  PID:7224
- C:\Windows\System\RaVTgmm.exe
  C:\Windows\System\RaVTgmm.exe
  2⤵
  PID:7376
- C:\Windows\System\zShVUdv.exe
  C:\Windows\System\zShVUdv.exe
  2⤵
  PID:7608
- C:\Windows\System\fwWpVZF.exe
  C:\Windows\System\fwWpVZF.exe
  2⤵
  PID:7736
- C:\Windows\System\lbWChef.exe
  C:\Windows\System\lbWChef.exe
  2⤵
  PID:7868
- C:\Windows\System\FfYtsEY.exe
  C:\Windows\System\FfYtsEY.exe
  2⤵
  PID:7980
- C:\Windows\System\eoiLlDf.exe
  C:\Windows\System\eoiLlDf.exe
  2⤵
  PID:7180
- C:\Windows\System\iAxneJs.exe
  C:\Windows\System\iAxneJs.exe
  2⤵
  PID:7364
- C:\Windows\System\ytnEJJl.exe
  C:\Windows\System\ytnEJJl.exe
  2⤵
  PID:7840
- C:\Windows\System\eRqydut.exe
  C:\Windows\System\eRqydut.exe
  2⤵
  PID:7296
- C:\Windows\System\RIDwLxt.exe
  C:\Windows\System\RIDwLxt.exe
  2⤵
  PID:8152
- C:\Windows\System\zfXVzUq.exe
  C:\Windows\System\zfXVzUq.exe
  2⤵
  PID:7348
- C:\Windows\System\tgpMMVv.exe
  C:\Windows\System\tgpMMVv.exe
  2⤵
  PID:8228
- C:\Windows\System\BRnnPPc.exe
  C:\Windows\System\BRnnPPc.exe
  2⤵
  PID:8256
- C:\Windows\System\ixTelqo.exe
  C:\Windows\System\ixTelqo.exe
  2⤵
  PID:8276
- C:\Windows\System\TIhcgHF.exe
  C:\Windows\System\TIhcgHF.exe
  2⤵
  PID:8304
- C:\Windows\System\aSTMJsB.exe
  C:\Windows\System\aSTMJsB.exe
  2⤵
  PID:8332
- C:\Windows\System\ocLLhnp.exe
  C:\Windows\System\ocLLhnp.exe
  2⤵
  PID:8368
- C:\Windows\System\tADIikB.exe
  C:\Windows\System\tADIikB.exe
  2⤵
  PID:8400
- C:\Windows\System\zUDWATt.exe
  C:\Windows\System\zUDWATt.exe
  2⤵
  PID:8428
- C:\Windows\System\eZuSlxx.exe
  C:\Windows\System\eZuSlxx.exe
  2⤵
  PID:8456
- C:\Windows\System\hJqNFGW.exe
  C:\Windows\System\hJqNFGW.exe
  2⤵
  PID:8484
- C:\Windows\System\ZGgOWui.exe
  C:\Windows\System\ZGgOWui.exe
  2⤵
  PID:8512
- C:\Windows\System\xpBqoTF.exe
  C:\Windows\System\xpBqoTF.exe
  2⤵
  PID:8536
- C:\Windows\System\wFYSKEp.exe
  C:\Windows\System\wFYSKEp.exe
  2⤵
  PID:8568
- C:\Windows\System\IqIuJjS.exe
  C:\Windows\System\IqIuJjS.exe
  2⤵
  PID:8596
- C:\Windows\System\JNgazbD.exe
  C:\Windows\System\JNgazbD.exe
  2⤵
  PID:8624
- C:\Windows\System\VRwCDwH.exe
  C:\Windows\System\VRwCDwH.exe
  2⤵
  PID:8652
- C:\Windows\System\GOdlCPw.exe
  C:\Windows\System\GOdlCPw.exe
  2⤵
  PID:8672
- C:\Windows\System\vhlwlzI.exe
  C:\Windows\System\vhlwlzI.exe
  2⤵
  PID:8696
- C:\Windows\System\kASuJhk.exe
  C:\Windows\System\kASuJhk.exe
  2⤵
  PID:8736
- C:\Windows\System\qugwOOo.exe
  C:\Windows\System\qugwOOo.exe
  2⤵
  PID:8764
- C:\Windows\System\RnGFuRW.exe
  C:\Windows\System\RnGFuRW.exe
  2⤵
  PID:8792
- C:\Windows\System\ZCBeeDT.exe
  C:\Windows\System\ZCBeeDT.exe
  2⤵
  PID:8816
- C:\Windows\System\FyUNgiv.exe
  C:\Windows\System\FyUNgiv.exe
  2⤵
  PID:8840
- C:\Windows\System\pMkBbjG.exe
  C:\Windows\System\pMkBbjG.exe
  2⤵
  PID:8864
- C:\Windows\System\TzOMPjx.exe
  C:\Windows\System\TzOMPjx.exe
  2⤵
  PID:8884
- C:\Windows\System\KXqsXLQ.exe
  C:\Windows\System\KXqsXLQ.exe
  2⤵
  PID:8912
- C:\Windows\System\DLWCdpT.exe
  C:\Windows\System\DLWCdpT.exe
  2⤵
  PID:8948
- C:\Windows\System\VScnpTA.exe
  C:\Windows\System\VScnpTA.exe
  2⤵
  PID:8980
- C:\Windows\System\WxShUXH.exe
  C:\Windows\System\WxShUXH.exe
  2⤵
  PID:9012
- C:\Windows\System\oRsiZRp.exe
  C:\Windows\System\oRsiZRp.exe
  2⤵
  PID:9032
- C:\Windows\System\TxpJKcR.exe
  C:\Windows\System\TxpJKcR.exe
  2⤵
  PID:9060
- C:\Windows\System\glbMLPL.exe
  C:\Windows\System\glbMLPL.exe
  2⤵
  PID:9088
- C:\Windows\System\JNQSDrz.exe
  C:\Windows\System\JNQSDrz.exe
  2⤵
  PID:9116
- C:\Windows\System\TZIBUzK.exe
  C:\Windows\System\TZIBUzK.exe
  2⤵
  PID:9156
- C:\Windows\System\fPIbagr.exe
  C:\Windows\System\fPIbagr.exe
  2⤵
  PID:9184
- C:\Windows\System\TRgYPQe.exe
  C:\Windows\System\TRgYPQe.exe
  2⤵
  PID:9212
- C:\Windows\System\dxWeJMx.exe
  C:\Windows\System\dxWeJMx.exe
  2⤵
  PID:8216
- C:\Windows\System\KSTgYgS.exe
  C:\Windows\System\KSTgYgS.exe
  2⤵
  PID:8284
- C:\Windows\System\UfUWOqY.exe
  C:\Windows\System\UfUWOqY.exe
  2⤵
  PID:8364
- C:\Windows\System\AxHvNQy.exe
  C:\Windows\System\AxHvNQy.exe
  2⤵
  PID:8440
- C:\Windows\System\pIPacmF.exe
  C:\Windows\System\pIPacmF.exe
  2⤵
  PID:8496
- C:\Windows\System\CJOQfDu.exe
  C:\Windows\System\CJOQfDu.exe
  2⤵
  PID:8524
- C:\Windows\System\fnQOeyt.exe
  C:\Windows\System\fnQOeyt.exe
  2⤵
  PID:8636
- C:\Windows\System\DApvGXT.exe
  C:\Windows\System\DApvGXT.exe
  2⤵
  PID:8688
- C:\Windows\System\dpPRGny.exe
  C:\Windows\System\dpPRGny.exe
  2⤵
  PID:8756
- C:\Windows\System\daiHTcP.exe
  C:\Windows\System\daiHTcP.exe
  2⤵
  PID:8808
- C:\Windows\System\TxonSXi.exe
  C:\Windows\System\TxonSXi.exe
  2⤵
  PID:8872
- C:\Windows\System\NzeqgQE.exe
  C:\Windows\System\NzeqgQE.exe
  2⤵
  PID:8960
- C:\Windows\System\BuEGLVm.exe
  C:\Windows\System\BuEGLVm.exe
  2⤵
  PID:9028
- C:\Windows\System\LfHZrOo.exe
  C:\Windows\System\LfHZrOo.exe
  2⤵
  PID:9080
- C:\Windows\System\xopwJyf.exe
  C:\Windows\System\xopwJyf.exe
  2⤵
  PID:9152
- C:\Windows\System\eCJcFVT.exe
  C:\Windows\System\eCJcFVT.exe
  2⤵
  PID:8200
- C:\Windows\System\iUdPHdp.exe
  C:\Windows\System\iUdPHdp.exe
  2⤵
  PID:8292
- C:\Windows\System\uliyPQK.exe
  C:\Windows\System\uliyPQK.exe
  2⤵
  PID:8424
- C:\Windows\System\HKNwjzR.exe
  C:\Windows\System\HKNwjzR.exe
  2⤵
  PID:8668
- C:\Windows\System\EDSmmPN.exe
  C:\Windows\System\EDSmmPN.exe
  2⤵
  PID:8716
- C:\Windows\System\oVqcKxd.exe
  C:\Windows\System\oVqcKxd.exe
  2⤵
  PID:8940
- C:\Windows\System\oIrLFQR.exe
  C:\Windows\System\oIrLFQR.exe
  2⤵
  PID:9072
- C:\Windows\System\alzLawb.exe
  C:\Windows\System\alzLawb.exe
  2⤵
  PID:9208
- C:\Windows\System\lXGbMNN.exe
  C:\Windows\System\lXGbMNN.exe
  2⤵
  PID:8532
- C:\Windows\System\eZDnmFy.exe
  C:\Windows\System\eZDnmFy.exe
  2⤵
  PID:9020
- C:\Windows\System\IDghCSX.exe
  C:\Windows\System\IDghCSX.exe
  2⤵
  PID:8272
- C:\Windows\System\fwVtwhJ.exe
  C:\Windows\System\fwVtwhJ.exe
  2⤵
  PID:8836
- C:\Windows\System\yBKBBQW.exe
  C:\Windows\System\yBKBBQW.exe
  2⤵
  PID:9232
- C:\Windows\System\LAcHAQA.exe
  C:\Windows\System\LAcHAQA.exe
  2⤵
  PID:9252
- C:\Windows\System\vpRqSBK.exe
  C:\Windows\System\vpRqSBK.exe
  2⤵
  PID:9288
- C:\Windows\System\BEUlHZS.exe
  C:\Windows\System\BEUlHZS.exe
  2⤵
  PID:9316
- C:\Windows\System\uTpghVD.exe
  C:\Windows\System\uTpghVD.exe
  2⤵
  PID:9344
- C:\Windows\System\wVjSxJc.exe
  C:\Windows\System\wVjSxJc.exe
  2⤵
  PID:9372
- C:\Windows\System\XBQQBkg.exe
  C:\Windows\System\XBQQBkg.exe
  2⤵
  PID:9388
- C:\Windows\System\IDkrfRb.exe
  C:\Windows\System\IDkrfRb.exe
  2⤵
  PID:9424
- C:\Windows\System\tYuOgrD.exe
  C:\Windows\System\tYuOgrD.exe
  2⤵
  PID:9456
- C:\Windows\System\cyfvNmj.exe
  C:\Windows\System\cyfvNmj.exe
  2⤵
  PID:9484
- C:\Windows\System\NYYYaEZ.exe
  C:\Windows\System\NYYYaEZ.exe
  2⤵
  PID:9508
- C:\Windows\System\LmEuOPN.exe
  C:\Windows\System\LmEuOPN.exe
  2⤵
  PID:9532
- C:\Windows\System\TrFiktb.exe
  C:\Windows\System\TrFiktb.exe
  2⤵
  PID:9560
- C:\Windows\System\gLjriCs.exe
  C:\Windows\System\gLjriCs.exe
  2⤵
  PID:9580
- C:\Windows\System\mOrNIVk.exe
  C:\Windows\System\mOrNIVk.exe
  2⤵
  PID:9616
- C:\Windows\System\GFbGZIf.exe
  C:\Windows\System\GFbGZIf.exe
  2⤵
  PID:9656
- C:\Windows\System\UXJgzhs.exe
  C:\Windows\System\UXJgzhs.exe
  2⤵
  PID:9676
- C:\Windows\System\YmWoFof.exe
  C:\Windows\System\YmWoFof.exe
  2⤵
  PID:9704
- C:\Windows\System\bFgMolM.exe
  C:\Windows\System\bFgMolM.exe
  2⤵
  PID:9740
- C:\Windows\System\FhuEnJL.exe
  C:\Windows\System\FhuEnJL.exe
  2⤵
  PID:9756
- C:\Windows\System\HadlPVp.exe
  C:\Windows\System\HadlPVp.exe
  2⤵
  PID:9784
- C:\Windows\System\msOfBJg.exe
  C:\Windows\System\msOfBJg.exe
  2⤵
  PID:9808
- C:\Windows\System\kBxrlbO.exe
  C:\Windows\System\kBxrlbO.exe
  2⤵
  PID:9828
- C:\Windows\System\hxAJgzD.exe
  C:\Windows\System\hxAJgzD.exe
  2⤵
  PID:9864
- C:\Windows\System\FooSljv.exe
  C:\Windows\System\FooSljv.exe
  2⤵
  PID:9896
- C:\Windows\System\ipXXawt.exe
  C:\Windows\System\ipXXawt.exe
  2⤵
  PID:9924
- C:\Windows\System\XergarP.exe
  C:\Windows\System\XergarP.exe
  2⤵
  PID:9948
- C:\Windows\System\VzlwEbu.exe
  C:\Windows\System\VzlwEbu.exe
  2⤵
  PID:9968
- C:\Windows\System\dsjsNyz.exe
  C:\Windows\System\dsjsNyz.exe
  2⤵
  PID:9996
- C:\Windows\System\dCSXGRq.exe
  C:\Windows\System\dCSXGRq.exe
  2⤵
  PID:10016
- C:\Windows\System\TJgzvkU.exe
  C:\Windows\System\TJgzvkU.exe
  2⤵
  PID:10060
- C:\Windows\System\PJGRzBK.exe
  C:\Windows\System\PJGRzBK.exe
  2⤵
  PID:10092
- C:\Windows\System\kSQKbnS.exe
  C:\Windows\System\kSQKbnS.exe
  2⤵
  PID:10120
- C:\Windows\System\JKeoiHd.exe
  C:\Windows\System\JKeoiHd.exe
  2⤵
  PID:10144
- C:\Windows\System\gfbfkfA.exe
  C:\Windows\System\gfbfkfA.exe
  2⤵
  PID:10180
- C:\Windows\System\GcdCxEe.exe
  C:\Windows\System\GcdCxEe.exe
  2⤵
  PID:10216
- C:\Windows\System\tpMXkMo.exe
  C:\Windows\System\tpMXkMo.exe
  2⤵
  PID:10232
- C:\Windows\System\lDwJTIr.exe
  C:\Windows\System\lDwJTIr.exe
  2⤵
  PID:9224
- C:\Windows\System\EbXzsWd.exe
  C:\Windows\System\EbXzsWd.exe
  2⤵
  PID:9312
- C:\Windows\System\roGmAGM.exe
  C:\Windows\System\roGmAGM.exe
  2⤵
  PID:9400
- C:\Windows\System\CjTOiTI.exe
  C:\Windows\System\CjTOiTI.exe
  2⤵
  PID:9452
- C:\Windows\System\nnOZAyJ.exe
  C:\Windows\System\nnOZAyJ.exe
  2⤵
  PID:9500
- C:\Windows\System\gLDQymk.exe
  C:\Windows\System\gLDQymk.exe
  2⤵
  PID:9588
- C:\Windows\System\DjbQCuv.exe
  C:\Windows\System\DjbQCuv.exe
  2⤵
  PID:9664
- C:\Windows\System\KfRHTxy.exe
  C:\Windows\System\KfRHTxy.exe
  2⤵
  PID:9724
- C:\Windows\System\xgeiHTu.exe
  C:\Windows\System\xgeiHTu.exe
  2⤵
  PID:9804
- C:\Windows\System\zpznLWK.exe
  C:\Windows\System\zpznLWK.exe
  2⤵
  PID:9860
- C:\Windows\System\GmheXqW.exe
  C:\Windows\System\GmheXqW.exe
  2⤵
  PID:9916
- C:\Windows\System\FshrPhz.exe
  C:\Windows\System\FshrPhz.exe
  2⤵
  PID:9936
- C:\Windows\System\GKIkSwV.exe
  C:\Windows\System\GKIkSwV.exe
  2⤵
  PID:10008
- C:\Windows\System\ntuksma.exe
  C:\Windows\System\ntuksma.exe
  2⤵
  PID:10108
- C:\Windows\System\gnZmMdn.exe
  C:\Windows\System\gnZmMdn.exe
  2⤵
  PID:10176
- C:\Windows\System\WHFQCiw.exe
  C:\Windows\System\WHFQCiw.exe
  2⤵
  PID:9244
- C:\Windows\System\UNojtxi.exe
  C:\Windows\System\UNojtxi.exe
  2⤵
  PID:9340
- C:\Windows\System\QpdaCad.exe
  C:\Windows\System\QpdaCad.exe
  2⤵
  PID:6932
- C:\Windows\System\HDThlEP.exe
  C:\Windows\System\HDThlEP.exe
  2⤵
  PID:9628
- C:\Windows\System\AgayoiQ.exe
  C:\Windows\System\AgayoiQ.exe
  2⤵
  PID:9796
- C:\Windows\System\fdMojJE.exe
  C:\Windows\System\fdMojJE.exe
  2⤵
  PID:9940
- C:\Windows\System\inJtHkb.exe
  C:\Windows\System\inJtHkb.exe
  2⤵
  PID:10052
- C:\Windows\System\GFMebGJ.exe
  C:\Windows\System\GFMebGJ.exe
  2⤵
  PID:10200
- C:\Windows\System\OrmpdDq.exe
  C:\Windows\System\OrmpdDq.exe
  2⤵
  PID:8396
- C:\Windows\System\cEnNkxm.exe
  C:\Windows\System\cEnNkxm.exe
  2⤵
  PID:9568
- C:\Windows\System\cFAvtEt.exe
  C:\Windows\System\cFAvtEt.exe
  2⤵
  PID:10080
- C:\Windows\System\nwVQgjG.exe
  C:\Windows\System\nwVQgjG.exe
  2⤵
  PID:9612
- C:\Windows\System\oZilMYE.exe
  C:\Windows\System\oZilMYE.exe
  2⤵
  PID:10276
- C:\Windows\System\OKxoPsC.exe
  C:\Windows\System\OKxoPsC.exe
  2⤵
  PID:10312
- C:\Windows\System\PwERNwV.exe
  C:\Windows\System\PwERNwV.exe
  2⤵
  PID:10336
- C:\Windows\System\sXiQPTO.exe
  C:\Windows\System\sXiQPTO.exe
  2⤵
  PID:10372
- C:\Windows\System\LIkdVJN.exe
  C:\Windows\System\LIkdVJN.exe
  2⤵
  PID:10400
- C:\Windows\System\eaUDpmR.exe
  C:\Windows\System\eaUDpmR.exe
  2⤵
  PID:10416
- C:\Windows\System\fuYnZLC.exe
  C:\Windows\System\fuYnZLC.exe
  2⤵
  PID:10448
- C:\Windows\System\oCwfbEo.exe
  C:\Windows\System\oCwfbEo.exe
  2⤵
  PID:10484
- C:\Windows\System\STpJGYL.exe
  C:\Windows\System\STpJGYL.exe
  2⤵
  PID:10504
- C:\Windows\System\fMDrvVh.exe
  C:\Windows\System\fMDrvVh.exe
  2⤵
  PID:10520
- C:\Windows\System\FuzxAku.exe
  C:\Windows\System\FuzxAku.exe
  2⤵
  PID:10540
- C:\Windows\System\cNdVAkq.exe
  C:\Windows\System\cNdVAkq.exe
  2⤵
  PID:10572
- C:\Windows\System\TliPnCI.exe
  C:\Windows\System\TliPnCI.exe
  2⤵
  PID:10600
- C:\Windows\System\nYCFcwu.exe
  C:\Windows\System\nYCFcwu.exe
  2⤵
  PID:10648
- C:\Windows\System\FXhqJCu.exe
  C:\Windows\System\FXhqJCu.exe
  2⤵
  PID:10668
- C:\Windows\System\TfvPZVn.exe
  C:\Windows\System\TfvPZVn.exe
  2⤵
  PID:10696
- C:\Windows\System\FICKkqD.exe
  C:\Windows\System\FICKkqD.exe
  2⤵
  PID:10728
- C:\Windows\System\wHZxDBB.exe
  C:\Windows\System\wHZxDBB.exe
  2⤵
  PID:10752
- C:\Windows\System\PIXLtAQ.exe
  C:\Windows\System\PIXLtAQ.exe
  2⤵
  PID:10784
- C:\Windows\System\YRKOnuY.exe
  C:\Windows\System\YRKOnuY.exe
  2⤵
  PID:10812
- C:\Windows\System\mEplFUd.exe
  C:\Windows\System\mEplFUd.exe
  2⤵
  PID:10840
- C:\Windows\System\ZITIGpP.exe
  C:\Windows\System\ZITIGpP.exe
  2⤵
  PID:10868
- C:\Windows\System\JiYCfle.exe
  C:\Windows\System\JiYCfle.exe
  2⤵
  PID:10908
- C:\Windows\System\WsziYsj.exe
  C:\Windows\System\WsziYsj.exe
  2⤵
  PID:10924
- C:\Windows\System\lGROQVj.exe
  C:\Windows\System\lGROQVj.exe
  2⤵
  PID:10964
- C:\Windows\System\XeKAswZ.exe
  C:\Windows\System\XeKAswZ.exe
  2⤵
  PID:10992
- C:\Windows\System\uVPsecV.exe
  C:\Windows\System\uVPsecV.exe
  2⤵
  PID:11020
- C:\Windows\System\aTMuIlM.exe
  C:\Windows\System\aTMuIlM.exe
  2⤵
  PID:11048
- C:\Windows\System\uqUvUjb.exe
  C:\Windows\System\uqUvUjb.exe
  2⤵
  PID:11064
- C:\Windows\System\zbqxhTb.exe
  C:\Windows\System\zbqxhTb.exe
  2⤵
  PID:11092
- C:\Windows\System\bqtVdtg.exe
  C:\Windows\System\bqtVdtg.exe
  2⤵
  PID:11124
- C:\Windows\System\lShOilf.exe
  C:\Windows\System\lShOilf.exe
  2⤵
  PID:11156
- C:\Windows\System\ctikRvo.exe
  C:\Windows\System\ctikRvo.exe
  2⤵
  PID:11188
- C:\Windows\System\DspXpBL.exe
  C:\Windows\System\DspXpBL.exe
  2⤵
  PID:11216
- C:\Windows\System\dsdSUIt.exe
  C:\Windows\System\dsdSUIt.exe
  2⤵
  PID:11244
- C:\Windows\System\EYKNSOv.exe
  C:\Windows\System\EYKNSOv.exe
  2⤵
  PID:9980
- C:\Windows\System\QVmCwOx.exe
  C:\Windows\System\QVmCwOx.exe
  2⤵
  PID:10268
- C:\Windows\System\UorUamE.exe
  C:\Windows\System\UorUamE.exe
  2⤵
  PID:10308
- C:\Windows\System\KkaZnmb.exe
  C:\Windows\System\KkaZnmb.exe
  2⤵
  PID:10368
- C:\Windows\System\bRyjSNk.exe
  C:\Windows\System\bRyjSNk.exe
  2⤵
  PID:10456
- C:\Windows\System\aDymMDh.exe
  C:\Windows\System\aDymMDh.exe
  2⤵
  PID:10516
- C:\Windows\System\fPnVIRR.exe
  C:\Windows\System\fPnVIRR.exe
  2⤵
  PID:9556
- C:\Windows\System\ScXcXqo.exe
  C:\Windows\System\ScXcXqo.exe
  2⤵
  PID:10608
- C:\Windows\System\uwOpaoD.exe
  C:\Windows\System\uwOpaoD.exe
  2⤵
  PID:10688
- C:\Windows\System\CUzOHxN.exe
  C:\Windows\System\CUzOHxN.exe
  2⤵
  PID:10740
- C:\Windows\System\nKpbZEY.exe
  C:\Windows\System\nKpbZEY.exe
  2⤵
  PID:10848
- C:\Windows\System\fcOZOiK.exe
  C:\Windows\System\fcOZOiK.exe
  2⤵
  PID:10920
- C:\Windows\System\yEZqPwL.exe
  C:\Windows\System\yEZqPwL.exe
  2⤵
  PID:10988
- C:\Windows\System\AodOnTl.exe
  C:\Windows\System\AodOnTl.exe
  2⤵
  PID:11056
- C:\Windows\System\XXmofSM.exe
  C:\Windows\System\XXmofSM.exe
  2⤵
  PID:11112
- C:\Windows\System\ulikNbK.exe
  C:\Windows\System\ulikNbK.exe
  2⤵
  PID:11204
- C:\Windows\System\vMFfkcu.exe
  C:\Windows\System\vMFfkcu.exe
  2⤵
  PID:9752
- C:\Windows\System\TNAzPGR.exe
  C:\Windows\System\TNAzPGR.exe
  2⤵
  PID:10288
- C:\Windows\System\pwquANQ.exe
  C:\Windows\System\pwquANQ.exe
  2⤵
  PID:10384
- C:\Windows\System\nCyIcuZ.exe
  C:\Windows\System\nCyIcuZ.exe
  2⤵
  PID:10584
- C:\Windows\System\dwnIaTs.exe
  C:\Windows\System\dwnIaTs.exe
  2⤵
  PID:10748
- C:\Windows\System\DYjGniY.exe
  C:\Windows\System\DYjGniY.exe
  2⤵
  PID:10808
- C:\Windows\System\ExpCbJi.exe
  C:\Windows\System\ExpCbJi.exe
  2⤵
  PID:10976
- C:\Windows\System\LsceNdo.exe
  C:\Windows\System\LsceNdo.exe
  2⤵
  PID:11060
- C:\Windows\System\xUJWKJG.exe
  C:\Windows\System\xUJWKJG.exe
  2⤵
  PID:11228
- C:\Windows\System\LgYhRzo.exe
  C:\Windows\System\LgYhRzo.exe
  2⤵
  PID:10248
- C:\Windows\System\WWvLfuc.exe
  C:\Windows\System\WWvLfuc.exe
  2⤵
  PID:10680
- C:\Windows\System\pwGBkgL.exe
  C:\Windows\System\pwGBkgL.exe
  2⤵
  PID:10952
- C:\Windows\System\zVLwrRs.exe
  C:\Windows\System\zVLwrRs.exe
  2⤵
  PID:11240
- C:\Windows\System\IcZtcJN.exe
  C:\Windows\System\IcZtcJN.exe
  2⤵
  PID:11272
- C:\Windows\System\KAYOhQk.exe
  C:\Windows\System\KAYOhQk.exe
  2⤵
  PID:11312
- C:\Windows\System\HSuDWXj.exe
  C:\Windows\System\HSuDWXj.exe
  2⤵
  PID:11352
- C:\Windows\System\CgjuUbM.exe
  C:\Windows\System\CgjuUbM.exe
  2⤵
  PID:11392
- C:\Windows\System\gdZjBdO.exe
  C:\Windows\System\gdZjBdO.exe
  2⤵
  PID:11412
- C:\Windows\System\zmMQXkE.exe
  C:\Windows\System\zmMQXkE.exe
  2⤵
  PID:11448
- C:\Windows\System\EMGXgcV.exe
  C:\Windows\System\EMGXgcV.exe
  2⤵
  PID:11488
- C:\Windows\System\VGdhNfS.exe
  C:\Windows\System\VGdhNfS.exe
  2⤵
  PID:11516
- C:\Windows\System\KwBccmN.exe
  C:\Windows\System\KwBccmN.exe
  2⤵
  PID:11544
- C:\Windows\System\PyBYcTX.exe
  C:\Windows\System\PyBYcTX.exe
  2⤵
  PID:11572
- C:\Windows\System\cWtXbIl.exe
  C:\Windows\System\cWtXbIl.exe
  2⤵
  PID:11600
- C:\Windows\System\RaqcneN.exe
  C:\Windows\System\RaqcneN.exe
  2⤵
  PID:11616
- C:\Windows\System\AkxOVNy.exe
  C:\Windows\System\AkxOVNy.exe
  2⤵
  PID:11672
- C:\Windows\System\ifNpSzx.exe
  C:\Windows\System\ifNpSzx.exe
  2⤵
  PID:11688
- C:\Windows\System\RYpUeRI.exe
  C:\Windows\System\RYpUeRI.exe
  2⤵
  PID:11716
- C:\Windows\System\eZOSpbc.exe
  C:\Windows\System\eZOSpbc.exe
  2⤵
  PID:11744
- C:\Windows\System\uskwXYI.exe
  C:\Windows\System\uskwXYI.exe
  2⤵
  PID:11772
- C:\Windows\System\ssGccgB.exe
  C:\Windows\System\ssGccgB.exe
  2⤵
  PID:11800
- C:\Windows\System\FWzKzjZ.exe
  C:\Windows\System\FWzKzjZ.exe
  2⤵
  PID:11828
- C:\Windows\System\TQLnLcw.exe
  C:\Windows\System\TQLnLcw.exe
  2⤵
  PID:11856
- C:\Windows\System\iqWWtMW.exe
  C:\Windows\System\iqWWtMW.exe
  2⤵
  PID:11884
- C:\Windows\System\wzfBAyB.exe
  C:\Windows\System\wzfBAyB.exe
  2⤵
  PID:11912
- C:\Windows\System\SPUzBvi.exe
  C:\Windows\System\SPUzBvi.exe
  2⤵
  PID:11936
- C:\Windows\System\EYsKOXz.exe
  C:\Windows\System\EYsKOXz.exe
  2⤵
  PID:11968
- C:\Windows\System\wXVunfM.exe
  C:\Windows\System\wXVunfM.exe
  2⤵
  PID:11988
- C:\Windows\System\IJwyabW.exe
  C:\Windows\System\IJwyabW.exe
  2⤵
  PID:12012
- C:\Windows\System\hpMMINU.exe
  C:\Windows\System\hpMMINU.exe
  2⤵
  PID:12044
- C:\Windows\System\KoTLtcI.exe
  C:\Windows\System\KoTLtcI.exe
  2⤵
  PID:12080
- C:\Windows\System\UFHfyna.exe
  C:\Windows\System\UFHfyna.exe
  2⤵
  PID:12108
- C:\Windows\System\BlaDkWO.exe
  C:\Windows\System\BlaDkWO.exe
  2⤵
  PID:12136
- C:\Windows\System\VXkcRFo.exe
  C:\Windows\System\VXkcRFo.exe
  2⤵
  PID:12152
- C:\Windows\System\lLKCJfQ.exe
  C:\Windows\System\lLKCJfQ.exe
  2⤵
  PID:12188
- C:\Windows\System\eMjKbtv.exe
  C:\Windows\System\eMjKbtv.exe
  2⤵
  PID:12220
- C:\Windows\System\pKPUDqN.exe
  C:\Windows\System\pKPUDqN.exe
  2⤵
  PID:12248
- C:\Windows\System\wnXoRyI.exe
  C:\Windows\System\wnXoRyI.exe
  2⤵
  PID:12272
- C:\Windows\System\VWsHzPr.exe
  C:\Windows\System\VWsHzPr.exe
  2⤵
  PID:11180
- C:\Windows\System\IyaYbCv.exe
  C:\Windows\System\IyaYbCv.exe
  2⤵
  PID:11304
- C:\Windows\System\qzNzukK.exe
  C:\Windows\System\qzNzukK.exe
  2⤵
  PID:11376
- C:\Windows\System\eiTwKVS.exe
  C:\Windows\System\eiTwKVS.exe
  2⤵
  PID:11420
- C:\Windows\System\FntlyqE.exe
  C:\Windows\System\FntlyqE.exe
  2⤵
  PID:11484
- C:\Windows\System\aFKMXDU.exe
  C:\Windows\System\aFKMXDU.exe
  2⤵
  PID:11528
- C:\Windows\System\vcqXTuC.exe
  C:\Windows\System\vcqXTuC.exe
  2⤵
  PID:11608
- C:\Windows\System\SQADgey.exe
  C:\Windows\System\SQADgey.exe
  2⤵
  PID:11680
- C:\Windows\System\sVqGbyR.exe
  C:\Windows\System\sVqGbyR.exe
  2⤵
  PID:11728
- C:\Windows\System\oZImXTl.exe
  C:\Windows\System\oZImXTl.exe
  2⤵
  PID:11816
- C:\Windows\System\iSZnExI.exe
  C:\Windows\System\iSZnExI.exe
  2⤵
  PID:11876
- C:\Windows\System\rjaAAsK.exe
  C:\Windows\System\rjaAAsK.exe
  2⤵
  PID:11956
- C:\Windows\System\UyGzfEf.exe
  C:\Windows\System\UyGzfEf.exe
  2⤵
  PID:12024
- C:\Windows\System\arsOkOB.exe
  C:\Windows\System\arsOkOB.exe
  2⤵
  PID:12064
- C:\Windows\System\eQCREvz.exe
  C:\Windows\System\eQCREvz.exe
  2⤵
  PID:4856
- C:\Windows\System\wblTkpQ.exe
  C:\Windows\System\wblTkpQ.exe
  2⤵
  PID:12148
- C:\Windows\System\SESRMcX.exe
  C:\Windows\System\SESRMcX.exe
  2⤵
  PID:12208
- C:\Windows\System\ifULbER.exe
  C:\Windows\System\ifULbER.exe
  2⤵
  PID:12260
- C:\Windows\System\FWVcdCB.exe
  C:\Windows\System\FWVcdCB.exe
  2⤵
  PID:11332
- C:\Windows\System\TMVnFsg.exe
  C:\Windows\System\TMVnFsg.exe
  2⤵
  PID:11592
- C:\Windows\System\wLJEqRi.exe
  C:\Windows\System\wLJEqRi.exe
  2⤵
  PID:11704
- C:\Windows\System\iSnmUer.exe
  C:\Windows\System\iSnmUer.exe
  2⤵
  PID:11756
- C:\Windows\System\WOfhmXo.exe
  C:\Windows\System\WOfhmXo.exe
  2⤵
  PID:11952
- C:\Windows\System\IMvopfb.exe
  C:\Windows\System\IMvopfb.exe
  2⤵
  PID:12128
- C:\Windows\System\OdiNWIR.exe
  C:\Windows\System\OdiNWIR.exe
  2⤵
  PID:12164
- C:\Windows\System\aJEiZDB.exe
  C:\Windows\System\aJEiZDB.exe
  2⤵
  PID:11512
- C:\Windows\System\jGPAYoQ.exe
  C:\Windows\System\jGPAYoQ.exe
  2⤵
  PID:11904
- C:\Windows\System\XEGSvvZ.exe
  C:\Windows\System\XEGSvvZ.exe
  2⤵
  PID:12036
- C:\Windows\System\VSLqVkt.exe
  C:\Windows\System\VSLqVkt.exe
  2⤵
  PID:11564
- C:\Windows\System\tpMJCPL.exe
  C:\Windows\System\tpMJCPL.exe
  2⤵
  PID:3340
- C:\Windows\System\AmgJfam.exe
  C:\Windows\System\AmgJfam.exe
  2⤵
  PID:12244
- C:\Windows\System\aKBBIvT.exe
  C:\Windows\System\aKBBIvT.exe
  2⤵
  PID:12296
- C:\Windows\System\TQQECDc.exe
  C:\Windows\System\TQQECDc.exe
  2⤵
  PID:12320
- C:\Windows\System\nagkTvk.exe
  C:\Windows\System\nagkTvk.exe
  2⤵
  PID:12352
- C:\Windows\System\flRNFWi.exe
  C:\Windows\System\flRNFWi.exe
  2⤵
  PID:12388
- C:\Windows\System\nTqRplr.exe
  C:\Windows\System\nTqRplr.exe
  2⤵
  PID:12416
- C:\Windows\System\fuBEzkY.exe
  C:\Windows\System\fuBEzkY.exe
  2⤵
  PID:12432
- C:\Windows\System\FwETMJN.exe
  C:\Windows\System\FwETMJN.exe
  2⤵
  PID:12448
- C:\Windows\System\cJJulkx.exe
  C:\Windows\System\cJJulkx.exe
  2⤵
  PID:12472
- C:\Windows\System\LVsULFK.exe
  C:\Windows\System\LVsULFK.exe
  2⤵
  PID:12500
- C:\Windows\System\MKYTnMi.exe
  C:\Windows\System\MKYTnMi.exe
  2⤵
  PID:12528
- C:\Windows\System\CjHzinn.exe
  C:\Windows\System\CjHzinn.exe
  2⤵
  PID:12560
- C:\Windows\System\TwUhWHW.exe
  C:\Windows\System\TwUhWHW.exe
  2⤵
  PID:12592
- C:\Windows\System\WWDkyPG.exe
  C:\Windows\System\WWDkyPG.exe
  2⤵
  PID:12628
- C:\Windows\System\SreeYRQ.exe
  C:\Windows\System\SreeYRQ.exe
  2⤵
  PID:12656
- C:\Windows\System\SmldSfn.exe
  C:\Windows\System\SmldSfn.exe
  2⤵
  PID:12692
- C:\Windows\System\qlWksCw.exe
  C:\Windows\System\qlWksCw.exe
  2⤵
  PID:12716
- C:\Windows\System\juCBafc.exe
  C:\Windows\System\juCBafc.exe
  2⤵
  PID:12752
- C:\Windows\System\kRjgwOC.exe
  C:\Windows\System\kRjgwOC.exe
  2⤵
  PID:12792
- C:\Windows\System\bNWxUkn.exe
  C:\Windows\System\bNWxUkn.exe
  2⤵
  PID:12820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvnwwquv.2si.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AeyopeR.exe

Filesize
2.2MB

MD5
21061b3d061ff914df8ada8a6f5ebbd2

SHA1
77b4fc2c0a6ec3134615fadf298be46ed6f7e71f

SHA256
512907e35672812447e2e163b1df09edfb73450cb6ddde3bf6e29b867a6fa3cb

SHA512
2230c971437caa5faeaca85c05d16b19819894b11bef4c4a86c08875da65a51ec5d5feb1974b6ed8cd46e7128469c7225d37694702a6c923723d2c7ee202d916

Download Submit
C:\Windows\System\BzERzrB.exe

Filesize
2.2MB

MD5
29d1d173d3207998352083667d9eef75

SHA1
95efab9727cc634eae3835aec6262624ea98f782

SHA256
87224453007cc26bdd27f60cdb713453529a6787b143eb1e71b7afc4fbe1c0f3

SHA512
8a1b6caf76e6b108cc07e2d37c3568638d6cb19db1dc731d671d97f006761b2467acc817428679f41a434430af846ab32482fe3e57c5744cd964ed9f38cfdec5

Download Submit
C:\Windows\System\EftzHjB.exe

Filesize
2.2MB

MD5
6a0cce88f1a8438ea6df46a3761baa81

SHA1
9c33d83938818fcceaab9b4582b4c3803e156217

SHA256
16fc07aef5d0638d0396edb8bd98fa894fdd5119bf020d62d64f9e493128e305

SHA512
c94c0aea7040b0d7e10506569cc183062ab45b45d91e53867f4f3417178ce9e21f4c7f8ccf8ce6b655d72b42102284e065069894e9714e1540773e1ab780c8cf

Download Submit
C:\Windows\System\Eixgxzg.exe

Filesize
2.2MB

MD5
718c3c33dde9b3b722d65f3f8d8befb2

SHA1
d634fd6c584555185efbdae01ec645c0609879d8

SHA256
63c28b075a15ead474d418c27dc470c74ebaa2a011b7352c4b8aa63c48e1c557

SHA512
59f4b1c8c05698c6107ae151a726f3f8364e1572b910ecc0526ae483c50725ea75da0adf36d553eda76afd2af74c45bbf4c19c65d8126ce4a56869911691de40

Download Submit
C:\Windows\System\EjYfYZk.exe

Filesize
2.2MB

MD5
4244ed5426e9fafcb66da69b00b34a1e

SHA1
5e3a45d582b65839844e99c4541d15b67b9309be

SHA256
a27518afbed50385e36c67c1527db8c2e57f906f2edee6f3d9b7c04ca1109e97

SHA512
9a2535cd0f6bc0827d8b4a7d8ba54b259c911579c173a69feaf680d2e48901450f7879a92f3cb109af2b132959c93eb3bfa34eba75053bb883322fd5cd75f160

Download Submit
C:\Windows\System\FtCOSEM.exe

Filesize
2.2MB

MD5
45c26291ad75ddbe725d68d02c7eda99

SHA1
ba07678e474d72b71e10f7fba205d28821c72483

SHA256
7a9492d06def3b2b2cfb0b5c46d12f2ec727c93d821c246f748c154ea8847aa6

SHA512
be97c5e259472348fa2120ad5edabc52c082f97fc762c264a77c78fa4ac6ba04deab18d2a9538ebf7cc8e1203ab1de36746e93baddc8a17cd2017bddbf3279b9

Download Submit
C:\Windows\System\HmoCBJe.exe

Filesize
2.2MB

MD5
d4199953428e85493e047ce9b771aa80

SHA1
c9786d5483eb86328a6a5e8597a3415a52bb3941

SHA256
9d5a9ff951b3728dbf796958caac5ab3f59491a26d171887ba4115c66ac23539

SHA512
f9d4c532aed6937f9139ef8f5638a6e3d782cac3377503d1626054e14ca49064372f5d14d800a136e715dbf8cb9ea00bfad46438b40119816e0e0476e6cba134

Download Submit
C:\Windows\System\IwUopUg.exe

Filesize
2.2MB

MD5
22209bbea02fe42f15d992abfd7a39e3

SHA1
6daa6672b82fd85f4b6869ad02e1c8a7d7149a08

SHA256
200c06e7d8ba807a6801d5624093eb1a815338b65b5b23b1879b88577b819f32

SHA512
2f3a0315cd4c5834f359069c9bc9a4bb531072c8f45866867f073e3b10f422230c2f22cd094e077e667f867813f7cc73211fd4ba13e6ea3b80d3363ded60b680

Download Submit
C:\Windows\System\KCzJcEi.exe

Filesize
2.2MB

MD5
178b5f972ce880053bfe2faee11361b8

SHA1
a698b1c85b4158a13c943eaa6a58bdcbf6fd2d8b

SHA256
39f391082f244e517fbe544600bc42deb13373ae8091d6e6172732ae96048e1c

SHA512
375fb3073fd3a00a643ad1ed611d79ce77c306ff28bd283899fd6784705837477922f6869e4a3cb000d0989155e47d0c10dc32eb322b2c3949cd6a93761876ac

Download Submit
C:\Windows\System\LsvUZbM.exe

Filesize
2.2MB

MD5
3a4d27a1714bc6414e8f0e4ad8a8ef25

SHA1
27431f0c7a3d089acd6da6c1921b1dfd0f5cfaf9

SHA256
e67ec7f287c48a090e279c91af105e399ea57c666358b9f0a476b984a1bf18a4

SHA512
09c69127fce811193e921bf0382fb5102bba779e8872404ea84eb0b0ea6a0799265a34d654aed8cc8829bda249b66e426eec1fd1dd91499f29e3c4fd7bb9345c

Download Submit
C:\Windows\System\PGTLuAQ.exe

Filesize
2.2MB

MD5
2ad8009411273990ad2de3c29c83b7b7

SHA1
038a4937f49bd7505fd137d88a67c17dc0155bec

SHA256
8faa52608e0a735e4dd89c68dad7d71dbf9d4b9fcd1248e407dad3fc3e18abb9

SHA512
dc30bc0b3fbf5406d0064f8e86f2ecfdcf6cdf510bb5f1e29d9aa818cb172320e8fb73e445bd2edbb899a6b3bfa99e6729debcf40b1d73c3d051985a3adf9684

Download Submit
C:\Windows\System\SaeVtRC.exe

Filesize
2.2MB

MD5
85c49b2709c723ae94e3a30cde85ce56

SHA1
b7a89c364c07e5704aa01d057dac9a3ad4301afc

SHA256
f0f4297f48e5f06ca53755fb0f4269dad729520bdc58a30e5ae16431b3578010

SHA512
7fd2b94b067f4d87bbb93ce303f13e3d23587fb7f1f70be7d3eb7bb335dd232bc493e8f0c38f1bbab8b47aaa60a9924beb0e6ada39dc3351245211bc8521d5cf

Download Submit
C:\Windows\System\WQTphFe.exe

Filesize
2.2MB

MD5
f46c9bfed57c37348eb25762858c4fce

SHA1
cfa4155787ef63adbb58c70e109b40a3d7dcb5c6

SHA256
fe73e8799cd6f967225ca71388fa386fa13f5d4f67b5c8e4af1d85e0e52a9c75

SHA512
e4ccc91993a4eae332fabd0f35ecfb81594ff506f484836cf425355c2012cb9fa28dd8984c560f842fb0899fde8134427631af307d9b505a7d49e44bfb1e6e1c

Download Submit
C:\Windows\System\aZgjBGU.exe

Filesize
2.2MB

MD5
294687a4e547a88c74e406689b4b7c19

SHA1
08a1e49ad3c3f5d54ff2478a55df0a21a90ddaf3

SHA256
69412b3de49d70b54eb9849e609d9d129b2776db0c292f125413f79b218052a2

SHA512
81c89751dacc1c66a17e548fc2460df0ba9aa68299d4845874e1d6bf0dad0219bab2f94438de6275368ef0303eb46b060bc5d363df28be76018a53e076d3558f

Download Submit
C:\Windows\System\bBAznEP.exe

Filesize
2.2MB

MD5
2b26492332be3139dbb73f34a535bbf5

SHA1
0e0ab80ee6a77a8dc85363d0f213c23bd267aca1

SHA256
89e06e29cd8d152d402f9c338df093b8290e75020d7cea4035df1ab3b93495b4

SHA512
5556493a01f1cc946d7abc7eb27c763b03974034a6edf7d43952cd4bb18f1e1dffffe2cb5fa86815be62624b9279623d0d366d55bba0444dc2e266eafbc4cb25

Download Submit
C:\Windows\System\eBUKSbZ.exe

Filesize
2.2MB

MD5
5f23e4f1c583c1cb3e65d522e4e9cd2e

SHA1
b35d40afe931856fe36d96667f3a399c97d3f781

SHA256
464c94448adbe8259b640923738b5f02bcab49eff49b60fdca84096badb0787a

SHA512
b7ee83034e1131b360da6203a235fd9ec122d7c3b89ffef65058a46513c87157a150e75cf5416ab5a5134a2ebfc7805224626abcb83f8476e849fe1df6b1221d

Download Submit
C:\Windows\System\ennIGpe.exe

Filesize
2.2MB

MD5
85025a6e4462bae379b32c8748fdaebe

SHA1
be7d061ddbf65288c1dc03bec816986af52a9fa2

SHA256
21cd950551e05d3975533f4fc5688e6ce73208c59e953eba116101910be18119

SHA512
c10dc543fbc9464b9f6cf7050396e6a5924fe67ab3764cf9c02f7dfb36233d007870391357b875f3e754e54aabcdefab7c8cfe5967057d1f3217643a5aceb0af

Download Submit
C:\Windows\System\fdrNpWM.exe

Filesize
2.2MB

MD5
c8ca26c2250cbb98a0a628e5a84b3186

SHA1
ad98ab567bd163becec6f18a592b2506821d7bdc

SHA256
215b52c85f86cf8f8bbecce774753685227263373501791180272dfd791a0a54

SHA512
be3415978eb6410ff97f23c7399714b4cd34d7ed2794bddef8caabbabce21d722bde34830e5b5db76f65eda7e0836cc1db3ae25f801e191a0636439172c14e78

Download Submit
C:\Windows\System\fyItUfo.exe

Filesize
2.2MB

MD5
1fbfe221fe5150ae34fc2ee4c7e4a17e

SHA1
958c32bc267221b643ee8f405491162f1159982f

SHA256
df0f8da3a94162096f2631d7fbd8a836e548ca7d379714eed129485e07470569

SHA512
72b99efaf08002283dec59fa5078f7a59484def2b405b3ce00118452d243f8cb53e0f4d0231d81d0c998e7c029b3c1f896be6857ef9b29edec630cf87eef13ac

Download Submit
C:\Windows\System\gRZnzUQ.exe

Filesize
2.2MB

MD5
66e9a7d5852d96ed408b153b19517014

SHA1
550ac3927e02d6182429cb96364789765785ffb7

SHA256
9730871a02af34e93bdfb677f6e2944a2adb59e411c4321bb8633a1c1dbcd097

SHA512
1c029a3d9b2f06464768ac93c3747732fcdf57e0e5cf805d8767a1aa23e6ff9754bd266f4bd9d9e7726aaf4b0db3eacc0f5faf3dc59f7926ed9a33446c6275a2

Download Submit
C:\Windows\System\gsDNCnN.exe

Filesize
2.2MB

MD5
00c42601402f8291277b4d8c4b22242a

SHA1
e451809a15b8c9732e24079ebd888c4743257cd8

SHA256
f9f4d1e1e5079397f71903e4656b8ece70d57d5d25d3e73686a2cb76ac864869

SHA512
40f177621fdc7314bb61d67e88186ff5d0eaa5ba251776d72be9ecbe50682f67310e2bfbebd0eb5c1e65fc90ae287ec22cf0714afcad150d0ad020df410f5803

Download Submit
C:\Windows\System\hBqtvgF.exe

Filesize
2.2MB

MD5
267f8ecf0fc335d935fe4357c16aa6b8

SHA1
e6374755addde43c7c41703146a0d87bf2b1738d

SHA256
6c081a1a902984d928592045665247d3b849e1edcffddda596fe799620896653

SHA512
3c5931434fb8618bf788120947036e453624c6420975e781db7c709bafde1103840bbd5480643408200f9d1a71171b909c9cd2e7bbe382f0a355d2f9ae360bd7

Download Submit
C:\Windows\System\iuXcmIx.exe

Filesize
2.2MB

MD5
0de2e45f36b5c5b83eabad6640f5e448

SHA1
1aa29b76cc1e3b4c528d40f936d70310ed8d35e2

SHA256
d2e06a253f59c879945deeaf45bdb78f43db544af101e1dc7d05d784a6cbaed7

SHA512
286352a18575869a2a6f5f7eb94a6842969fa65b7f7c8d78cc4a6c83fc2865ed5c7c2910fb7d9c740c61d910f87c90a70eec1a2aad6633162c6c7eef976fb269

Download Submit
C:\Windows\System\judVPnY.exe

Filesize
2.2MB

MD5
3ea6f04a8af1cce18c7d502b98672d2b

SHA1
9e7574b5b6bf2cf929d57feda1d04d91150716c0

SHA256
94d300239a64772698695423d79021e99acb7c6d8e4fa2c2fd8282bb9a0438d4

SHA512
db1af81caf8e9b59d0619cf2ea663051300e9b44a619c3ee8de6ed89ea0e9f83dc9245abf4bc9983f637bbae1333ba07d4f14e745d4d4e2e76c700ceb7e61554

Download Submit
C:\Windows\System\kxoVnwo.exe

Filesize
2.2MB

MD5
74895122a77cbf7f22b3322eee623356

SHA1
f28320163d1ced75e5ae2a0c7e408ff7f2c1db5b

SHA256
0d784bc7678d85b27a9651e995d80391904cf491437214f50a9ce0ea8e3b803f

SHA512
198abad831ee6f48da36f7a2b97404b32611e87de1f6e6e98469378a79bc6c5c386c664614b4e9721a5128bbb4b087e3de364913c97df0c6fcc69eaeda2916d3

Download Submit
C:\Windows\System\lHvcMey.exe

Filesize
2.2MB

MD5
1991d25f42f7838bc32df8e00b352bef

SHA1
1201cac17a7063f2684ebecbf16d9dd2b50336ac

SHA256
86fbcdc8fd6e660dd90babd2612f76166168356d23f29a2dba4044d3c4fcf470

SHA512
faa331b85e49f603e331723431b23263b09f971de3c6e2d6e77794f3b43ca1d547e0adda742a3bb88774be070b34661e836d5349b6345b161ce86621192d7faf

Download Submit
C:\Windows\System\nCwevhg.exe

Filesize
2.2MB

MD5
8fd5b36c6537396d8de004d24d60e3de

SHA1
20d628d532ae3ff8f9c7283db3ba66050d02c367

SHA256
94ccdeb529d4f8ce548b0bb36163d8d01f8ece7b4e356815a61e8d34904384f5

SHA512
61b3fcf20686d2787abb61838eb6c2d70ad2369562edb6ec81f5cc800c3bef1c4976210bcdfb8e75e16b775b6c5dee21255edc52fc701d5d37b239a68f4bf85b

Download Submit
C:\Windows\System\qJCaIRm.exe

Filesize
2.2MB

MD5
612add9bebf03c566f104394d20b4e13

SHA1
1c9370142c8731c9a96ba7e75353d5c346fd4d28

SHA256
addb38795a37e631cdad970e13cf7888c7b1a6119a4e67a26ba9ded7bc0a4552

SHA512
8d75712223c568ed048bcffffe06b589fd787ad5e28a4eaad2432036d6a66db991d016572cb8288c166480cd5d856c9260c3c9a90d615278c07d5dffe3f1d4a4

Download Submit
C:\Windows\System\qjtwnIm.exe

Filesize
2.2MB

MD5
f5c07bdd6a253d405b8cfedeb69fb06f

SHA1
28c8bb04c7d378cf593b3a5b8bac4e6c4b71efec

SHA256
574c8bb0bd7ef6b14971d458caa96a5d7bb4e8c67858730a9df671eb974dc9f0

SHA512
fdba3741c38fdc1babe7af1f6b35d0eae12206318c65be70591618e872a8cbf8456889b607bc1f66be24a78c03310bb55619dda1f23e383eeb9a38f42a1b028c

Download Submit
C:\Windows\System\rImjmYy.exe

Filesize
2.2MB

MD5
a86e4e77b55320bab14fb7c04f9e960d

SHA1
d501211ae6b72d08e05e9674c2635ea5c2899680

SHA256
d4da6c69351a699004312f85f5a2e190fa6a731e1f6a9a6eb9c5f16299d43c21

SHA512
daff09611a90de0ce2c0ae583d1a376db877ec9eb4dfab8944ae0a90f3c83adb61d119e1247d129df268c54b6ae53211a2919fd68f8a5961d4614c4f3d004984

Download Submit
C:\Windows\System\vIEFdAi.exe

Filesize
2.2MB

MD5
5663048f18e9c1eb593ecdb3fd33f0f2

SHA1
f03af2f0f159e2309706098be1caa4bb436d0303

SHA256
367a768e563e449bacf4e9bf4550d84f3408e05fd4e82b227490fe6ccf91f66c

SHA512
69e34f5898fe02ae72513aeb9691561252ff89ad29a4487bc1a523f2f95beea42072e2155e525ad31a68da3f228b152923bdd82d7a099b45a2ce1b5f0968bff3

Download Submit
C:\Windows\System\vTkoLnX.exe

Filesize
2.2MB

MD5
936d976ebd718953aea21a6acc8c84ec

SHA1
2ede403d3dc5eb2d01379cf45088bfb93229c1fb

SHA256
25000a435743be20cf008914a129d5951f7440f6d7e011d399c17db6d2664ea6

SHA512
fc33ec683d7a0d1371a12439ae99aa22ecf4389cbfeb58befe242a416e6ee579ccc6173edd035c6c457bb71e9ab644a1d5383c86b62593fe1576d8c1f675488d

Download Submit
C:\Windows\System\wolDrHm.exe

Filesize
2.2MB

MD5
c2999b78d3545e97b87518e2bf75c889

SHA1
068f2d37f2fe6627898450ed7e0091590ff32185

SHA256
5df93266ff94001b18b1bda7d33d59ce2c402e3191db7d78bc21307900684885

SHA512
c9cd8e4d4bf203bb5338672a4e7b96f75ee5b2a910f4f8d61d8ba46fde7e9b0dc234c452ec710253fb82ea047d7c1daeee2fc253e7d2cd8060a51338b57d0573

Download Submit
C:\Windows\System\yxKeKUb.exe

Filesize
2.2MB

MD5
d38f3989266abadfd7f28a9d0f8ead36

SHA1
df638130292ae6d250e8de108aadd0907098f5b0

SHA256
798e99d607955ee8968d67f53c9ca20b95e0ff0e9acadd40277c5985138df3e5

SHA512
b11241be6a9839e6b1304ed6b1c71acc52465d0d7803bc1e0e1804b212b895baff02f3c0672623f9d7d3921fe61a76bdec572ed2abaf1884ae3142d2bf4a72b2

Download Submit
C:\Windows\System\zIoYhCl.exe

Filesize
2.2MB

MD5
763edf1a664a831cdb577a72726ace74

SHA1
7cfa8c07b93388664e32f4d46396b7feeac02d20

SHA256
a07f87b6c4ead27fb78ee8bc7d9e2a81d5e3795649a724adb20f73426d9ccb7e

SHA512
62067135733e0bb5f03300a6a6ffe007cf5587db26fd8c6400961e11d49498ef652848cbd5ffb86d435144e57631d4019731a4cad8d37a4b95fa64ef946f3112

Download Submit
memory/636-1916-0x00007FF721190000-0x00007FF721586000-memory.dmp

Filesize
4.0MB

Download
memory/636-193-0x00007FF721190000-0x00007FF721586000-memory.dmp

Filesize
4.0MB

Download
memory/948-201-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp

Filesize
4.0MB

Download
memory/948-1931-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp

Filesize
4.0MB

Download
memory/1956-200-0x00007FF6C1C70000-0x00007FF6C2066000-memory.dmp

Filesize
4.0MB

Download
memory/1956-1933-0x00007FF6C1C70000-0x00007FF6C2066000-memory.dmp

Filesize
4.0MB

Download
memory/2232-197-0x00007FF6C4AF0000-0x00007FF6C4EE6000-memory.dmp

Filesize
4.0MB

Download
memory/2232-1915-0x00007FF6C4AF0000-0x00007FF6C4EE6000-memory.dmp

Filesize
4.0MB

Download
memory/2600-203-0x00007FF601840000-0x00007FF601C36000-memory.dmp

Filesize
4.0MB

Download
memory/2600-1932-0x00007FF601840000-0x00007FF601C36000-memory.dmp

Filesize
4.0MB

Download
memory/2828-208-0x00007FF670D70000-0x00007FF671166000-memory.dmp

Filesize
4.0MB

Download
memory/2828-1928-0x00007FF670D70000-0x00007FF671166000-memory.dmp

Filesize
4.0MB

Download
memory/2848-15-0x00007FF7E8D60000-0x00007FF7E9156000-memory.dmp

Filesize
4.0MB

Download
memory/2848-1910-0x00007FF7E8D60000-0x00007FF7E9156000-memory.dmp

Filesize
4.0MB

Download
memory/3040-1922-0x00007FF6B4AE0000-0x00007FF6B4ED6000-memory.dmp

Filesize
4.0MB

Download
memory/3040-207-0x00007FF6B4AE0000-0x00007FF6B4ED6000-memory.dmp

Filesize
4.0MB

Download
memory/3112-1926-0x00007FF711BF0000-0x00007FF711FE6000-memory.dmp

Filesize
4.0MB

Download
memory/3112-189-0x00007FF711BF0000-0x00007FF711FE6000-memory.dmp

Filesize
4.0MB

Download
memory/3236-194-0x00007FF628F80000-0x00007FF629376000-memory.dmp

Filesize
4.0MB

Download
memory/3236-1923-0x00007FF628F80000-0x00007FF629376000-memory.dmp

Filesize
4.0MB

Download
memory/3400-1927-0x00007FF7E59C0000-0x00007FF7E5DB6000-memory.dmp

Filesize
4.0MB

Download
memory/3400-204-0x00007FF7E59C0000-0x00007FF7E5DB6000-memory.dmp

Filesize
4.0MB

Download
memory/3932-1919-0x00007FF633080000-0x00007FF633476000-memory.dmp

Filesize
4.0MB

Download
memory/3932-173-0x00007FF633080000-0x00007FF633476000-memory.dmp

Filesize
4.0MB

Download
memory/3952-198-0x00007FF699DE0000-0x00007FF69A1D6000-memory.dmp

Filesize
4.0MB

Download
memory/3952-1914-0x00007FF699DE0000-0x00007FF69A1D6000-memory.dmp

Filesize
4.0MB

Download
memory/4112-1901-0x00007FFF5D333000-0x00007FFF5D335000-memory.dmp

Filesize
8KB

Download
memory/4112-414-0x0000023A1D570000-0x0000023A1DD16000-memory.dmp

Filesize
7.6MB

Download
memory/4112-103-0x0000023A04000000-0x0000023A04022000-memory.dmp

Filesize
136KB

Download
memory/4112-16-0x00007FFF5D333000-0x00007FFF5D335000-memory.dmp

Filesize
8KB

Download
memory/4112-1900-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-107-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-1909-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4112-64-0x00007FFF5D330000-0x00007FFF5DDF1000-memory.dmp

Filesize
10.8MB

Download
memory/4204-202-0x00007FF666190000-0x00007FF666586000-memory.dmp

Filesize
4.0MB

Download
memory/4204-1929-0x00007FF666190000-0x00007FF666586000-memory.dmp

Filesize
4.0MB

Download
memory/4328-1912-0x00007FF621850000-0x00007FF621C46000-memory.dmp

Filesize
4.0MB

Download
memory/4328-206-0x00007FF621850000-0x00007FF621C46000-memory.dmp

Filesize
4.0MB

Download
memory/4360-205-0x00007FF761230000-0x00007FF761626000-memory.dmp

Filesize
4.0MB

Download
memory/4360-1913-0x00007FF761230000-0x00007FF761626000-memory.dmp

Filesize
4.0MB

Download
memory/4464-1921-0x00007FF74C840000-0x00007FF74CC36000-memory.dmp

Filesize
4.0MB

Download
memory/4464-195-0x00007FF74C840000-0x00007FF74CC36000-memory.dmp

Filesize
4.0MB

Download
memory/4504-1930-0x00007FF76ACB0000-0x00007FF76B0A6000-memory.dmp

Filesize
4.0MB

Download
memory/4504-199-0x00007FF76ACB0000-0x00007FF76B0A6000-memory.dmp

Filesize
4.0MB

Download
memory/4540-112-0x00007FF68CC60000-0x00007FF68D056000-memory.dmp

Filesize
4.0MB

Download
memory/4540-1911-0x00007FF68CC60000-0x00007FF68D056000-memory.dmp

Filesize
4.0MB

Download
memory/4740-1920-0x00007FF6085C0000-0x00007FF6089B6000-memory.dmp

Filesize
4.0MB

Download
memory/4740-143-0x00007FF6085C0000-0x00007FF6089B6000-memory.dmp

Filesize
4.0MB

Download
memory/4772-1925-0x00007FF75E480000-0x00007FF75E876000-memory.dmp

Filesize
4.0MB

Download
memory/4772-196-0x00007FF75E480000-0x00007FF75E876000-memory.dmp

Filesize
4.0MB

Download
memory/4804-191-0x00007FF756430000-0x00007FF756826000-memory.dmp

Filesize
4.0MB

Download
memory/4804-1924-0x00007FF756430000-0x00007FF756826000-memory.dmp

Filesize
4.0MB

Download
memory/4812-1917-0x00007FF6DBC40000-0x00007FF6DC036000-memory.dmp

Filesize
4.0MB

Download
memory/4812-164-0x00007FF6DBC40000-0x00007FF6DC036000-memory.dmp

Filesize
4.0MB

Download
memory/4892-0-0x00007FF6059E0000-0x00007FF605DD6000-memory.dmp

Filesize
4.0MB

Download
memory/4892-1-0x0000025AA7F90000-0x0000025AA7FA0000-memory.dmp

Filesize
64KB

Download
memory/4912-1918-0x00007FF629570000-0x00007FF629966000-memory.dmp

Filesize
4.0MB

Download
memory/4912-190-0x00007FF629570000-0x00007FF629966000-memory.dmp

Filesize
4.0MB

Download