xmrig | ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f

Analysis

max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2024 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
Size

3.4MB
MD5

706b36c7feb12e615fce5084e2e5dba2
SHA1

865162ed6ab3304b6031b7918f7c43e5935e0322
SHA256

ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f
SHA512

099da8381fe1342f300d995682cd4916d10b434ebfe399e37e81e6dbecd883e4574b81e370bc84025ebf3a831e59d149ed504957195e7d933a4a5bfc110cdb5e
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:7bBeSFkd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4100-0-0x00007FF713BF0000-0x00007FF713FE6000-memory.dmp	xmrig
behavioral2/files/0x000700000002344f-11.dat	xmrig
behavioral2/files/0x0007000000023450-16.dat	xmrig
behavioral2/files/0x000800000002344b-17.dat	xmrig
behavioral2/files/0x0007000000023454-34.dat	xmrig
behavioral2/files/0x0007000000023455-43.dat	xmrig
behavioral2/files/0x0007000000023458-75.dat	xmrig
behavioral2/memory/1016-74-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp	xmrig
behavioral2/memory/3384-81-0x00007FF681470000-0x00007FF681866000-memory.dmp	xmrig
behavioral2/memory/1060-80-0x00007FF7EC540000-0x00007FF7EC936000-memory.dmp	xmrig
behavioral2/memory/4976-79-0x00007FF71CF10000-0x00007FF71D306000-memory.dmp	xmrig
behavioral2/files/0x0007000000023457-71.dat	xmrig
behavioral2/files/0x0007000000023456-69.dat	xmrig
behavioral2/memory/2160-68-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp	xmrig
behavioral2/memory/4640-63-0x00007FF6F1210000-0x00007FF6F1606000-memory.dmp	xmrig
behavioral2/memory/1728-60-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp	xmrig
behavioral2/files/0x0007000000023452-41.dat	xmrig
behavioral2/files/0x0007000000023453-37.dat	xmrig
behavioral2/memory/1928-35-0x00007FF7B6840000-0x00007FF7B6C36000-memory.dmp	xmrig
behavioral2/memory/3028-31-0x00007FF643030000-0x00007FF643426000-memory.dmp	xmrig
behavioral2/memory/1588-26-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp	xmrig
behavioral2/files/0x0007000000023451-20.dat	xmrig
behavioral2/memory/3952-8-0x00007FF712D20000-0x00007FF713116000-memory.dmp	xmrig
behavioral2/files/0x000700000002345b-84.dat	xmrig
behavioral2/files/0x000800000002344c-89.dat	xmrig
behavioral2/files/0x0008000000023459-92.dat	xmrig
behavioral2/memory/4608-98-0x00007FF7C1670000-0x00007FF7C1A66000-memory.dmp	xmrig
behavioral2/files/0x000800000002345a-101.dat	xmrig
behavioral2/memory/5012-99-0x00007FF6943C0000-0x00007FF6947B6000-memory.dmp	xmrig
behavioral2/memory/4716-93-0x00007FF688D20000-0x00007FF689116000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-110.dat	xmrig
behavioral2/memory/4452-112-0x00007FF634D70000-0x00007FF635166000-memory.dmp	xmrig
behavioral2/memory/2472-115-0x00007FF6A0130000-0x00007FF6A0526000-memory.dmp	xmrig
behavioral2/files/0x000700000002345c-113.dat	xmrig
behavioral2/memory/2656-111-0x00007FF638900000-0x00007FF638CF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023460-123.dat	xmrig
behavioral2/files/0x0007000000023461-135.dat	xmrig
behavioral2/memory/3936-142-0x00007FF69FDB0000-0x00007FF6A01A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023463-149.dat	xmrig
behavioral2/files/0x0007000000023464-154.dat	xmrig
behavioral2/files/0x0007000000023465-157.dat	xmrig
behavioral2/memory/3952-148-0x00007FF712D20000-0x00007FF713116000-memory.dmp	xmrig
behavioral2/memory/4100-147-0x00007FF713BF0000-0x00007FF713FE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023462-145.dat	xmrig
behavioral2/memory/8-136-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-171.dat	xmrig
behavioral2/files/0x0007000000023469-184.dat	xmrig
behavioral2/files/0x000700000002346b-192.dat	xmrig
behavioral2/files/0x000700000002346d-201.dat	xmrig
behavioral2/memory/4268-540-0x00007FF6DDB10000-0x00007FF6DDF06000-memory.dmp	xmrig
behavioral2/memory/3568-559-0x00007FF78EEF0000-0x00007FF78F2E6000-memory.dmp	xmrig
behavioral2/memory/2856-556-0x00007FF6EB120000-0x00007FF6EB516000-memory.dmp	xmrig
behavioral2/memory/1728-552-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp	xmrig
behavioral2/memory/2064-546-0x00007FF63C150000-0x00007FF63C546000-memory.dmp	xmrig
behavioral2/files/0x000700000002346c-197.dat	xmrig
behavioral2/files/0x000700000002346a-189.dat	xmrig
behavioral2/files/0x0007000000023467-174.dat	xmrig
behavioral2/files/0x0007000000023466-167.dat	xmrig
behavioral2/memory/2572-133-0x00007FF76DDB0000-0x00007FF76E1A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-127.dat	xmrig
behavioral2/memory/1016-826-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp	xmrig
behavioral2/memory/2160-824-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp	xmrig
behavioral2/memory/4452-1891-0x00007FF634D70000-0x00007FF635166000-memory.dmp	xmrig
behavioral2/memory/8-2062-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	860	powershell.exe
10	860	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
860	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3952	NwyYVfN.exe
1588	NOvwJYE.exe
3028	zhsvBaP.exe
1928	tHBaRwK.exe
1728	OHHJqkK.exe
4976	VnSctHo.exe
4640	CFKYRtV.exe
1060	EvDRpxU.exe
2160	iDsRnuz.exe
3384	NiEzOvz.exe
1016	vuqthtf.exe
4716	rbORfMr.exe
4608	oHlCUkC.exe
5012	toabVGp.exe
2656	lPOrrrT.exe
2472	DonUnEP.exe
4452	paflsHi.exe
2572	PvjTnFd.exe
8	ZuoflgG.exe
3936	vrcsCKT.exe
4268	aBNbaSS.exe
2856	NNTxwor.exe
3568	eZynisU.exe
2064	JjuoxTO.exe
3112	bBxZjSO.exe
1068	UHeGjZG.exe
4604	jiiBGWH.exe
3024	djxstRZ.exe
2896	fSVcWsX.exe
4464	KCNdirQ.exe
1252	PHgueDB.exe
4352	mMnZgFg.exe
3848	gsiiYrk.exe
1976	iTrHDas.exe
3668	XXYcSjh.exe
2152	IjlaHaN.exe
1880	RZAnIrl.exe
960	brcMiiU.exe
4188	MGtfLau.exe
2004	mdgJuQb.exe
5104	gGRyvZk.exe
3128	nGyvjzD.exe
4364	CgvPSix.exe
2524	JHzdXHD.exe
3640	lmTbuxK.exe
212	rvMXfJM.exe
4220	XJsXcdA.exe
3760	PwGSgTy.exe
3340	UCMXqxM.exe
4792	fFJOISE.exe
2808	RPbZGWp.exe
4336	PUvyUrr.exe
4308	wKJkXor.exe
1188	SIJEIsH.exe
1484	QbiKXhy.exe
4136	CMxTePv.exe
3664	LkaTZkx.exe
3520	QhdIhyA.exe
2316	nTMAUjv.exe
2720	NAylgCe.exe
2768	DHpJSlK.exe
3536	hEoMzuO.exe
4756	VEMTCEJ.exe
4372	FvnFwOe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4100-0-0x00007FF713BF0000-0x00007FF713FE6000-memory.dmp	upx
behavioral2/files/0x000700000002344f-11.dat	upx
behavioral2/files/0x0007000000023450-16.dat	upx
behavioral2/files/0x000800000002344b-17.dat	upx
behavioral2/files/0x0007000000023454-34.dat	upx
behavioral2/files/0x0007000000023455-43.dat	upx
behavioral2/files/0x0007000000023458-75.dat	upx
behavioral2/memory/1016-74-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp	upx
behavioral2/memory/3384-81-0x00007FF681470000-0x00007FF681866000-memory.dmp	upx
behavioral2/memory/1060-80-0x00007FF7EC540000-0x00007FF7EC936000-memory.dmp	upx
behavioral2/memory/4976-79-0x00007FF71CF10000-0x00007FF71D306000-memory.dmp	upx
behavioral2/files/0x0007000000023457-71.dat	upx
behavioral2/files/0x0007000000023456-69.dat	upx
behavioral2/memory/2160-68-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp	upx
behavioral2/memory/4640-63-0x00007FF6F1210000-0x00007FF6F1606000-memory.dmp	upx
behavioral2/memory/1728-60-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp	upx
behavioral2/files/0x0007000000023452-41.dat	upx
behavioral2/files/0x0007000000023453-37.dat	upx
behavioral2/memory/1928-35-0x00007FF7B6840000-0x00007FF7B6C36000-memory.dmp	upx
behavioral2/memory/3028-31-0x00007FF643030000-0x00007FF643426000-memory.dmp	upx
behavioral2/memory/1588-26-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp	upx
behavioral2/files/0x0007000000023451-20.dat	upx
behavioral2/memory/3952-8-0x00007FF712D20000-0x00007FF713116000-memory.dmp	upx
behavioral2/files/0x000700000002345b-84.dat	upx
behavioral2/files/0x000800000002344c-89.dat	upx
behavioral2/files/0x0008000000023459-92.dat	upx
behavioral2/memory/4608-98-0x00007FF7C1670000-0x00007FF7C1A66000-memory.dmp	upx
behavioral2/files/0x000800000002345a-101.dat	upx
behavioral2/memory/5012-99-0x00007FF6943C0000-0x00007FF6947B6000-memory.dmp	upx
behavioral2/memory/4716-93-0x00007FF688D20000-0x00007FF689116000-memory.dmp	upx
behavioral2/files/0x000700000002345e-110.dat	upx
behavioral2/memory/4452-112-0x00007FF634D70000-0x00007FF635166000-memory.dmp	upx
behavioral2/memory/2472-115-0x00007FF6A0130000-0x00007FF6A0526000-memory.dmp	upx
behavioral2/files/0x000700000002345c-113.dat	upx
behavioral2/memory/2656-111-0x00007FF638900000-0x00007FF638CF6000-memory.dmp	upx
behavioral2/files/0x0007000000023460-123.dat	upx
behavioral2/files/0x0007000000023461-135.dat	upx
behavioral2/memory/3936-142-0x00007FF69FDB0000-0x00007FF6A01A6000-memory.dmp	upx
behavioral2/files/0x0007000000023463-149.dat	upx
behavioral2/files/0x0007000000023464-154.dat	upx
behavioral2/files/0x0007000000023465-157.dat	upx
behavioral2/memory/3952-148-0x00007FF712D20000-0x00007FF713116000-memory.dmp	upx
behavioral2/memory/4100-147-0x00007FF713BF0000-0x00007FF713FE6000-memory.dmp	upx
behavioral2/files/0x0007000000023462-145.dat	upx
behavioral2/memory/8-136-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp	upx
behavioral2/files/0x0007000000023468-171.dat	upx
behavioral2/files/0x0007000000023469-184.dat	upx
behavioral2/files/0x000700000002346b-192.dat	upx
behavioral2/files/0x000700000002346d-201.dat	upx
behavioral2/memory/4268-540-0x00007FF6DDB10000-0x00007FF6DDF06000-memory.dmp	upx
behavioral2/memory/3568-559-0x00007FF78EEF0000-0x00007FF78F2E6000-memory.dmp	upx
behavioral2/memory/2856-556-0x00007FF6EB120000-0x00007FF6EB516000-memory.dmp	upx
behavioral2/memory/1728-552-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp	upx
behavioral2/memory/2064-546-0x00007FF63C150000-0x00007FF63C546000-memory.dmp	upx
behavioral2/files/0x000700000002346c-197.dat	upx
behavioral2/files/0x000700000002346a-189.dat	upx
behavioral2/files/0x0007000000023467-174.dat	upx
behavioral2/files/0x0007000000023466-167.dat	upx
behavioral2/memory/2572-133-0x00007FF76DDB0000-0x00007FF76E1A6000-memory.dmp	upx
behavioral2/files/0x000700000002345f-127.dat	upx
behavioral2/memory/1016-826-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp	upx
behavioral2/memory/2160-824-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp	upx
behavioral2/memory/4452-1891-0x00007FF634D70000-0x00007FF635166000-memory.dmp	upx
behavioral2/memory/8-2062-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
7	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NAylgCe.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\ANRUEQc.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\xCqFXAx.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\LVMgQdV.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\WWZkUBX.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\WjSfdFm.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\YJcmKJr.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\MMpRGaf.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\eVaGubj.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\JkzQsIZ.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\DEJUROE.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\QcGuWSh.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\LVSkbBr.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\cNrvaRo.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\cweGott.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\UCgKXJM.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\paflsHi.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\QxNqFsT.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\lxGZNTe.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\JlibqTK.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\TXSfZnK.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\tczUSby.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\MTHsACP.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\SAsEhlF.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\BjgkvWM.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\xTgCAbN.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\GcmhjcN.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\frZONeF.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\NmmOBQT.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\otPBlFt.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\LsCDkDX.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\rnjDWqp.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\VcyPYBu.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\IkicqjK.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\cdIYZme.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\pAOLeKP.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\jLJBfBD.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\eDesHKr.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\rZOEfbZ.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\eyxmARo.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\zVdNREF.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\qYvUGGz.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\YXeWxAN.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\JxTrlsf.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\RPbZGWp.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\mcqquTH.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\hqePYnh.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\miBdzPL.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\iNAHviC.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\pIyndeH.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\cKwdZbz.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\XVplPcT.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\zeDkXub.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\kUMbdJw.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\QWGsnAy.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\wtSiiPC.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\bVHDkNn.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\ehsYkkJ.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\CAUdyIY.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\fdUlhtR.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\vRTglED.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\qYgxIVM.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\PuXLdIl.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
File created	C:\Windows\System\SaBbJxA.exe	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
860	powershell.exe
860	powershell.exe
860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	860	powershell.exe
Token: SeLockMemoryPrivilege	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
Token: SeLockMemoryPrivilege	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 860	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	85
PID 4100 wrote to memory of 860	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	85
PID 4100 wrote to memory of 3952	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	86
PID 4100 wrote to memory of 3952	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	86
PID 4100 wrote to memory of 1588	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	87
PID 4100 wrote to memory of 1588	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	87
PID 4100 wrote to memory of 3028	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	88
PID 4100 wrote to memory of 3028	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	88
PID 4100 wrote to memory of 1928	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	89
PID 4100 wrote to memory of 1928	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	89
PID 4100 wrote to memory of 4976	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	90
PID 4100 wrote to memory of 4976	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	90
PID 4100 wrote to memory of 1728	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	91
PID 4100 wrote to memory of 1728	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	91
PID 4100 wrote to memory of 4640	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	92
PID 4100 wrote to memory of 4640	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	92
PID 4100 wrote to memory of 1060	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	93
PID 4100 wrote to memory of 1060	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	93
PID 4100 wrote to memory of 2160	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	94
PID 4100 wrote to memory of 2160	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	94
PID 4100 wrote to memory of 3384	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	95
PID 4100 wrote to memory of 3384	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	95
PID 4100 wrote to memory of 1016	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	96
PID 4100 wrote to memory of 1016	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	96
PID 4100 wrote to memory of 4716	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	97
PID 4100 wrote to memory of 4716	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	97
PID 4100 wrote to memory of 4608	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	98
PID 4100 wrote to memory of 4608	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	98
PID 4100 wrote to memory of 5012	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	99
PID 4100 wrote to memory of 5012	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	99
PID 4100 wrote to memory of 2656	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	100
PID 4100 wrote to memory of 2656	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	100
PID 4100 wrote to memory of 2472	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	101
PID 4100 wrote to memory of 2472	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	101
PID 4100 wrote to memory of 4452	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	102
PID 4100 wrote to memory of 4452	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	102
PID 4100 wrote to memory of 2572	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	103
PID 4100 wrote to memory of 2572	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	103
PID 4100 wrote to memory of 8	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	104
PID 4100 wrote to memory of 8	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	104
PID 4100 wrote to memory of 3936	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	105
PID 4100 wrote to memory of 3936	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	105
PID 4100 wrote to memory of 4268	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	106
PID 4100 wrote to memory of 4268	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	106
PID 4100 wrote to memory of 2856	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	107
PID 4100 wrote to memory of 2856	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	107
PID 4100 wrote to memory of 2064	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	108
PID 4100 wrote to memory of 2064	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	108
PID 4100 wrote to memory of 3568	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	109
PID 4100 wrote to memory of 3568	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	109
PID 4100 wrote to memory of 3112	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	110
PID 4100 wrote to memory of 3112	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	110
PID 4100 wrote to memory of 1068	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	111
PID 4100 wrote to memory of 1068	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	111
PID 4100 wrote to memory of 4604	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	112
PID 4100 wrote to memory of 4604	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	112
PID 4100 wrote to memory of 3024	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	113
PID 4100 wrote to memory of 3024	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	113
PID 4100 wrote to memory of 2896	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	114
PID 4100 wrote to memory of 2896	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	114
PID 4100 wrote to memory of 4464	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	115
PID 4100 wrote to memory of 4464	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	115
PID 4100 wrote to memory of 1252	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	116
PID 4100 wrote to memory of 1252	4100	ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe	116

C:\Users\Admin\AppData\Local\Temp\ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe
"C:\Users\Admin\AppData\Local\Temp\ac8b0549698257f5360216df6346048e37ef6d1c5dab52ad62e483f2a036520f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "860" "2956" "2896" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13468
- C:\Windows\System\NwyYVfN.exe
  C:\Windows\System\NwyYVfN.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\NOvwJYE.exe
  C:\Windows\System\NOvwJYE.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\zhsvBaP.exe
  C:\Windows\System\zhsvBaP.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\tHBaRwK.exe
  C:\Windows\System\tHBaRwK.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\VnSctHo.exe
  C:\Windows\System\VnSctHo.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\OHHJqkK.exe
  C:\Windows\System\OHHJqkK.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\CFKYRtV.exe
  C:\Windows\System\CFKYRtV.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\EvDRpxU.exe
  C:\Windows\System\EvDRpxU.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\iDsRnuz.exe
  C:\Windows\System\iDsRnuz.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\NiEzOvz.exe
  C:\Windows\System\NiEzOvz.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\vuqthtf.exe
  C:\Windows\System\vuqthtf.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\rbORfMr.exe
  C:\Windows\System\rbORfMr.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\oHlCUkC.exe
  C:\Windows\System\oHlCUkC.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\toabVGp.exe
  C:\Windows\System\toabVGp.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\lPOrrrT.exe
  C:\Windows\System\lPOrrrT.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\DonUnEP.exe
  C:\Windows\System\DonUnEP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\paflsHi.exe
  C:\Windows\System\paflsHi.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\PvjTnFd.exe
  C:\Windows\System\PvjTnFd.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ZuoflgG.exe
  C:\Windows\System\ZuoflgG.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\vrcsCKT.exe
  C:\Windows\System\vrcsCKT.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\aBNbaSS.exe
  C:\Windows\System\aBNbaSS.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\NNTxwor.exe
  C:\Windows\System\NNTxwor.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\JjuoxTO.exe
  C:\Windows\System\JjuoxTO.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\eZynisU.exe
  C:\Windows\System\eZynisU.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\bBxZjSO.exe
  C:\Windows\System\bBxZjSO.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\UHeGjZG.exe
  C:\Windows\System\UHeGjZG.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\jiiBGWH.exe
  C:\Windows\System\jiiBGWH.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\djxstRZ.exe
  C:\Windows\System\djxstRZ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\fSVcWsX.exe
  C:\Windows\System\fSVcWsX.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\KCNdirQ.exe
  C:\Windows\System\KCNdirQ.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\PHgueDB.exe
  C:\Windows\System\PHgueDB.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\mMnZgFg.exe
  C:\Windows\System\mMnZgFg.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\gsiiYrk.exe
  C:\Windows\System\gsiiYrk.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\iTrHDas.exe
  C:\Windows\System\iTrHDas.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\XXYcSjh.exe
  C:\Windows\System\XXYcSjh.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\IjlaHaN.exe
  C:\Windows\System\IjlaHaN.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\RZAnIrl.exe
  C:\Windows\System\RZAnIrl.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\brcMiiU.exe
  C:\Windows\System\brcMiiU.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\MGtfLau.exe
  C:\Windows\System\MGtfLau.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\mdgJuQb.exe
  C:\Windows\System\mdgJuQb.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\gGRyvZk.exe
  C:\Windows\System\gGRyvZk.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\nGyvjzD.exe
  C:\Windows\System\nGyvjzD.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\CgvPSix.exe
  C:\Windows\System\CgvPSix.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\JHzdXHD.exe
  C:\Windows\System\JHzdXHD.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\lmTbuxK.exe
  C:\Windows\System\lmTbuxK.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\rvMXfJM.exe
  C:\Windows\System\rvMXfJM.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\XJsXcdA.exe
  C:\Windows\System\XJsXcdA.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\PwGSgTy.exe
  C:\Windows\System\PwGSgTy.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\UCMXqxM.exe
  C:\Windows\System\UCMXqxM.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\fFJOISE.exe
  C:\Windows\System\fFJOISE.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\RPbZGWp.exe
  C:\Windows\System\RPbZGWp.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\PUvyUrr.exe
  C:\Windows\System\PUvyUrr.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\wKJkXor.exe
  C:\Windows\System\wKJkXor.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\SIJEIsH.exe
  C:\Windows\System\SIJEIsH.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\QbiKXhy.exe
  C:\Windows\System\QbiKXhy.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\CMxTePv.exe
  C:\Windows\System\CMxTePv.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\LkaTZkx.exe
  C:\Windows\System\LkaTZkx.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\QhdIhyA.exe
  C:\Windows\System\QhdIhyA.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\nTMAUjv.exe
  C:\Windows\System\nTMAUjv.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\NAylgCe.exe
  C:\Windows\System\NAylgCe.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\DHpJSlK.exe
  C:\Windows\System\DHpJSlK.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\hEoMzuO.exe
  C:\Windows\System\hEoMzuO.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\VEMTCEJ.exe
  C:\Windows\System\VEMTCEJ.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\FvnFwOe.exe
  C:\Windows\System\FvnFwOe.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\VVZhKXS.exe
  C:\Windows\System\VVZhKXS.exe
  2⤵
  PID:4064
- C:\Windows\System\LzosPwg.exe
  C:\Windows\System\LzosPwg.exe
  2⤵
  PID:2620
- C:\Windows\System\ylNyKIk.exe
  C:\Windows\System\ylNyKIk.exe
  2⤵
  PID:4500
- C:\Windows\System\IEKMxRr.exe
  C:\Windows\System\IEKMxRr.exe
  2⤵
  PID:1704
- C:\Windows\System\DeHPdbG.exe
  C:\Windows\System\DeHPdbG.exe
  2⤵
  PID:1608
- C:\Windows\System\FzYlCNP.exe
  C:\Windows\System\FzYlCNP.exe
  2⤵
  PID:4820
- C:\Windows\System\fDmbzrI.exe
  C:\Windows\System\fDmbzrI.exe
  2⤵
  PID:768
- C:\Windows\System\sxJQjlc.exe
  C:\Windows\System\sxJQjlc.exe
  2⤵
  PID:844
- C:\Windows\System\zKTSApp.exe
  C:\Windows\System\zKTSApp.exe
  2⤵
  PID:1312
- C:\Windows\System\PzOSgVh.exe
  C:\Windows\System\PzOSgVh.exe
  2⤵
  PID:4952
- C:\Windows\System\XHAxtbG.exe
  C:\Windows\System\XHAxtbG.exe
  2⤵
  PID:556
- C:\Windows\System\yTSFCWF.exe
  C:\Windows\System\yTSFCWF.exe
  2⤵
  PID:3036
- C:\Windows\System\wtSiiPC.exe
  C:\Windows\System\wtSiiPC.exe
  2⤵
  PID:1644
- C:\Windows\System\EsqGtKz.exe
  C:\Windows\System\EsqGtKz.exe
  2⤵
  PID:3632
- C:\Windows\System\NJgfTSh.exe
  C:\Windows\System\NJgfTSh.exe
  2⤵
  PID:2660
- C:\Windows\System\AFoftlD.exe
  C:\Windows\System\AFoftlD.exe
  2⤵
  PID:3488
- C:\Windows\System\zNPIFtq.exe
  C:\Windows\System\zNPIFtq.exe
  2⤵
  PID:4992
- C:\Windows\System\lxGZNTe.exe
  C:\Windows\System\lxGZNTe.exe
  2⤵
  PID:4492
- C:\Windows\System\POyLILq.exe
  C:\Windows\System\POyLILq.exe
  2⤵
  PID:2796
- C:\Windows\System\yHcTZGy.exe
  C:\Windows\System\yHcTZGy.exe
  2⤵
  PID:1376
- C:\Windows\System\rsBAlby.exe
  C:\Windows\System\rsBAlby.exe
  2⤵
  PID:5136
- C:\Windows\System\nmMzZDj.exe
  C:\Windows\System\nmMzZDj.exe
  2⤵
  PID:5168
- C:\Windows\System\uwrCFsl.exe
  C:\Windows\System\uwrCFsl.exe
  2⤵
  PID:5196
- C:\Windows\System\ioPVYqy.exe
  C:\Windows\System\ioPVYqy.exe
  2⤵
  PID:5220
- C:\Windows\System\ofueuZc.exe
  C:\Windows\System\ofueuZc.exe
  2⤵
  PID:5248
- C:\Windows\System\HaseAee.exe
  C:\Windows\System\HaseAee.exe
  2⤵
  PID:5276
- C:\Windows\System\YRsBKjo.exe
  C:\Windows\System\YRsBKjo.exe
  2⤵
  PID:5308
- C:\Windows\System\wdLMPlH.exe
  C:\Windows\System\wdLMPlH.exe
  2⤵
  PID:5336
- C:\Windows\System\MOxyTtY.exe
  C:\Windows\System\MOxyTtY.exe
  2⤵
  PID:5364
- C:\Windows\System\lQiDrpR.exe
  C:\Windows\System\lQiDrpR.exe
  2⤵
  PID:5392
- C:\Windows\System\JiLBewT.exe
  C:\Windows\System\JiLBewT.exe
  2⤵
  PID:5420
- C:\Windows\System\zFxilDA.exe
  C:\Windows\System\zFxilDA.exe
  2⤵
  PID:5444
- C:\Windows\System\HrAOMQR.exe
  C:\Windows\System\HrAOMQR.exe
  2⤵
  PID:5476
- C:\Windows\System\vpsiZQw.exe
  C:\Windows\System\vpsiZQw.exe
  2⤵
  PID:5504
- C:\Windows\System\KwJWAkP.exe
  C:\Windows\System\KwJWAkP.exe
  2⤵
  PID:5532
- C:\Windows\System\lsFvPIj.exe
  C:\Windows\System\lsFvPIj.exe
  2⤵
  PID:5556
- C:\Windows\System\MzwXUgv.exe
  C:\Windows\System\MzwXUgv.exe
  2⤵
  PID:5584
- C:\Windows\System\xvUvqVl.exe
  C:\Windows\System\xvUvqVl.exe
  2⤵
  PID:5620
- C:\Windows\System\mcqquTH.exe
  C:\Windows\System\mcqquTH.exe
  2⤵
  PID:5644
- C:\Windows\System\RMqMJmQ.exe
  C:\Windows\System\RMqMJmQ.exe
  2⤵
  PID:5672
- C:\Windows\System\RwGoKwU.exe
  C:\Windows\System\RwGoKwU.exe
  2⤵
  PID:5700
- C:\Windows\System\jqqYfZx.exe
  C:\Windows\System\jqqYfZx.exe
  2⤵
  PID:5728
- C:\Windows\System\uhrZZkC.exe
  C:\Windows\System\uhrZZkC.exe
  2⤵
  PID:5756
- C:\Windows\System\QxNqFsT.exe
  C:\Windows\System\QxNqFsT.exe
  2⤵
  PID:5784
- C:\Windows\System\cmEqxur.exe
  C:\Windows\System\cmEqxur.exe
  2⤵
  PID:5812
- C:\Windows\System\XSIjUsM.exe
  C:\Windows\System\XSIjUsM.exe
  2⤵
  PID:5840
- C:\Windows\System\uLJjQae.exe
  C:\Windows\System\uLJjQae.exe
  2⤵
  PID:5868
- C:\Windows\System\aMxHSdV.exe
  C:\Windows\System\aMxHSdV.exe
  2⤵
  PID:5896
- C:\Windows\System\NFnhjMA.exe
  C:\Windows\System\NFnhjMA.exe
  2⤵
  PID:5920
- C:\Windows\System\RxkseKS.exe
  C:\Windows\System\RxkseKS.exe
  2⤵
  PID:5948
- C:\Windows\System\frREuPq.exe
  C:\Windows\System\frREuPq.exe
  2⤵
  PID:5980
- C:\Windows\System\lNCnrBR.exe
  C:\Windows\System\lNCnrBR.exe
  2⤵
  PID:6008
- C:\Windows\System\PELCReh.exe
  C:\Windows\System\PELCReh.exe
  2⤵
  PID:6036
- C:\Windows\System\SddxQMr.exe
  C:\Windows\System\SddxQMr.exe
  2⤵
  PID:6060
- C:\Windows\System\WWZkUBX.exe
  C:\Windows\System\WWZkUBX.exe
  2⤵
  PID:6092
- C:\Windows\System\KZrlYXd.exe
  C:\Windows\System\KZrlYXd.exe
  2⤵
  PID:6120
- C:\Windows\System\ksMdJtR.exe
  C:\Windows\System\ksMdJtR.exe
  2⤵
  PID:5000
- C:\Windows\System\RfZNNnA.exe
  C:\Windows\System\RfZNNnA.exe
  2⤵
  PID:2148
- C:\Windows\System\WmkakRX.exe
  C:\Windows\System\WmkakRX.exe
  2⤵
  PID:4312
- C:\Windows\System\UwZtDym.exe
  C:\Windows\System\UwZtDym.exe
  2⤵
  PID:5160
- C:\Windows\System\TktHZos.exe
  C:\Windows\System\TktHZos.exe
  2⤵
  PID:5216
- C:\Windows\System\EMHnyXt.exe
  C:\Windows\System\EMHnyXt.exe
  2⤵
  PID:5292
- C:\Windows\System\qMpoSyu.exe
  C:\Windows\System\qMpoSyu.exe
  2⤵
  PID:5352
- C:\Windows\System\kUIksVi.exe
  C:\Windows\System\kUIksVi.exe
  2⤵
  PID:5432
- C:\Windows\System\qYvUGGz.exe
  C:\Windows\System\qYvUGGz.exe
  2⤵
  PID:5488
- C:\Windows\System\HLVPOdN.exe
  C:\Windows\System\HLVPOdN.exe
  2⤵
  PID:5552
- C:\Windows\System\ZHfcMYW.exe
  C:\Windows\System\ZHfcMYW.exe
  2⤵
  PID:5608
- C:\Windows\System\ANRUEQc.exe
  C:\Windows\System\ANRUEQc.exe
  2⤵
  PID:5684
- C:\Windows\System\jLJBfBD.exe
  C:\Windows\System\jLJBfBD.exe
  2⤵
  PID:5744
- C:\Windows\System\WnniatY.exe
  C:\Windows\System\WnniatY.exe
  2⤵
  PID:5800
- C:\Windows\System\azVnEjX.exe
  C:\Windows\System\azVnEjX.exe
  2⤵
  PID:5860
- C:\Windows\System\TubzKdW.exe
  C:\Windows\System\TubzKdW.exe
  2⤵
  PID:5916
- C:\Windows\System\KqxloHn.exe
  C:\Windows\System\KqxloHn.exe
  2⤵
  PID:5992
- C:\Windows\System\fmFliLt.exe
  C:\Windows\System\fmFliLt.exe
  2⤵
  PID:6028
- C:\Windows\System\xKHxWiv.exe
  C:\Windows\System\xKHxWiv.exe
  2⤵
  PID:6084
- C:\Windows\System\bnFbCyz.exe
  C:\Windows\System\bnFbCyz.exe
  2⤵
  PID:1784
- C:\Windows\System\gnbdeLg.exe
  C:\Windows\System\gnbdeLg.exe
  2⤵
  PID:5132
- C:\Windows\System\MlbuPgc.exe
  C:\Windows\System\MlbuPgc.exe
  2⤵
  PID:5268
- C:\Windows\System\CAUdyIY.exe
  C:\Windows\System\CAUdyIY.exe
  2⤵
  PID:2772
- C:\Windows\System\JIdNNjt.exe
  C:\Windows\System\JIdNNjt.exe
  2⤵
  PID:5580
- C:\Windows\System\bQUpOBa.exe
  C:\Windows\System\bQUpOBa.exe
  2⤵
  PID:5712
- C:\Windows\System\yyiPPNd.exe
  C:\Windows\System\yyiPPNd.exe
  2⤵
  PID:5912
- C:\Windows\System\QkFisrM.exe
  C:\Windows\System\QkFisrM.exe
  2⤵
  PID:4116
- C:\Windows\System\ykFHXls.exe
  C:\Windows\System\ykFHXls.exe
  2⤵
  PID:5208
- C:\Windows\System\rGMgJmn.exe
  C:\Windows\System\rGMgJmn.exe
  2⤵
  PID:5348
- C:\Windows\System\JLDHFUX.exe
  C:\Windows\System\JLDHFUX.exe
  2⤵
  PID:5720
- C:\Windows\System\gpvVjLh.exe
  C:\Windows\System\gpvVjLh.exe
  2⤵
  PID:5468
- C:\Windows\System\KiEDaNt.exe
  C:\Windows\System\KiEDaNt.exe
  2⤵
  PID:4032
- C:\Windows\System\Ztkwshj.exe
  C:\Windows\System\Ztkwshj.exe
  2⤵
  PID:1720
- C:\Windows\System\GcmhjcN.exe
  C:\Windows\System\GcmhjcN.exe
  2⤵
  PID:4636
- C:\Windows\System\IrXpQpI.exe
  C:\Windows\System\IrXpQpI.exe
  2⤵
  PID:2164
- C:\Windows\System\XYcBUQJ.exe
  C:\Windows\System\XYcBUQJ.exe
  2⤵
  PID:6168
- C:\Windows\System\IlFcirf.exe
  C:\Windows\System\IlFcirf.exe
  2⤵
  PID:6208
- C:\Windows\System\YnZLHuO.exe
  C:\Windows\System\YnZLHuO.exe
  2⤵
  PID:6252
- C:\Windows\System\kefRqYk.exe
  C:\Windows\System\kefRqYk.exe
  2⤵
  PID:6300
- C:\Windows\System\TGoLgSn.exe
  C:\Windows\System\TGoLgSn.exe
  2⤵
  PID:6328
- C:\Windows\System\rVFsIMe.exe
  C:\Windows\System\rVFsIMe.exe
  2⤵
  PID:6356
- C:\Windows\System\HylNdLz.exe
  C:\Windows\System\HylNdLz.exe
  2⤵
  PID:6384
- C:\Windows\System\srTcLxn.exe
  C:\Windows\System\srTcLxn.exe
  2⤵
  PID:6416
- C:\Windows\System\IeQOOtI.exe
  C:\Windows\System\IeQOOtI.exe
  2⤵
  PID:6440
- C:\Windows\System\iXLnMCH.exe
  C:\Windows\System\iXLnMCH.exe
  2⤵
  PID:6464
- C:\Windows\System\UjNTFZy.exe
  C:\Windows\System\UjNTFZy.exe
  2⤵
  PID:6500
- C:\Windows\System\xhxDYzY.exe
  C:\Windows\System\xhxDYzY.exe
  2⤵
  PID:6528
- C:\Windows\System\MqEKoEL.exe
  C:\Windows\System\MqEKoEL.exe
  2⤵
  PID:6556
- C:\Windows\System\UeIYYhx.exe
  C:\Windows\System\UeIYYhx.exe
  2⤵
  PID:6576
- C:\Windows\System\hsWZYMo.exe
  C:\Windows\System\hsWZYMo.exe
  2⤵
  PID:6612
- C:\Windows\System\qnXqhLm.exe
  C:\Windows\System\qnXqhLm.exe
  2⤵
  PID:6640
- C:\Windows\System\JggstsA.exe
  C:\Windows\System\JggstsA.exe
  2⤵
  PID:6668
- C:\Windows\System\vYldNsJ.exe
  C:\Windows\System\vYldNsJ.exe
  2⤵
  PID:6696
- C:\Windows\System\IJzgYtr.exe
  C:\Windows\System\IJzgYtr.exe
  2⤵
  PID:6724
- C:\Windows\System\uSVrORF.exe
  C:\Windows\System\uSVrORF.exe
  2⤵
  PID:6752
- C:\Windows\System\EnwPsrO.exe
  C:\Windows\System\EnwPsrO.exe
  2⤵
  PID:6780
- C:\Windows\System\TpsNbRY.exe
  C:\Windows\System\TpsNbRY.exe
  2⤵
  PID:6808
- C:\Windows\System\uLMmAEj.exe
  C:\Windows\System\uLMmAEj.exe
  2⤵
  PID:6824
- C:\Windows\System\wTwDSlJ.exe
  C:\Windows\System\wTwDSlJ.exe
  2⤵
  PID:6864
- C:\Windows\System\EdHWVpY.exe
  C:\Windows\System\EdHWVpY.exe
  2⤵
  PID:6880
- C:\Windows\System\lxYoLsK.exe
  C:\Windows\System\lxYoLsK.exe
  2⤵
  PID:6920
- C:\Windows\System\MTHsACP.exe
  C:\Windows\System\MTHsACP.exe
  2⤵
  PID:6948
- C:\Windows\System\sSuUIbB.exe
  C:\Windows\System\sSuUIbB.exe
  2⤵
  PID:6984
- C:\Windows\System\qEcWKkG.exe
  C:\Windows\System\qEcWKkG.exe
  2⤵
  PID:7020
- C:\Windows\System\SAsEhlF.exe
  C:\Windows\System\SAsEhlF.exe
  2⤵
  PID:7040
- C:\Windows\System\VsFOaxa.exe
  C:\Windows\System\VsFOaxa.exe
  2⤵
  PID:7068
- C:\Windows\System\PvobEXi.exe
  C:\Windows\System\PvobEXi.exe
  2⤵
  PID:7120
- C:\Windows\System\xNOzhoj.exe
  C:\Windows\System\xNOzhoj.exe
  2⤵
  PID:7156
- C:\Windows\System\fIhdgwF.exe
  C:\Windows\System\fIhdgwF.exe
  2⤵
  PID:6176
- C:\Windows\System\lFfHPrd.exe
  C:\Windows\System\lFfHPrd.exe
  2⤵
  PID:6080
- C:\Windows\System\IUxzljk.exe
  C:\Windows\System\IUxzljk.exe
  2⤵
  PID:6312
- C:\Windows\System\OjBSVUU.exe
  C:\Windows\System\OjBSVUU.exe
  2⤵
  PID:6376
- C:\Windows\System\BTWddbk.exe
  C:\Windows\System\BTWddbk.exe
  2⤵
  PID:6424
- C:\Windows\System\zpiVaWh.exe
  C:\Windows\System\zpiVaWh.exe
  2⤵
  PID:6512
- C:\Windows\System\nYgFYcj.exe
  C:\Windows\System\nYgFYcj.exe
  2⤵
  PID:6564
- C:\Windows\System\dfGOvSO.exe
  C:\Windows\System\dfGOvSO.exe
  2⤵
  PID:6632
- C:\Windows\System\PrSfCvK.exe
  C:\Windows\System\PrSfCvK.exe
  2⤵
  PID:6716
- C:\Windows\System\fMLBcTC.exe
  C:\Windows\System\fMLBcTC.exe
  2⤵
  PID:6772
- C:\Windows\System\JPZgXmb.exe
  C:\Windows\System\JPZgXmb.exe
  2⤵
  PID:6852
- C:\Windows\System\OttmavX.exe
  C:\Windows\System\OttmavX.exe
  2⤵
  PID:6900
- C:\Windows\System\lDMxEcJ.exe
  C:\Windows\System\lDMxEcJ.exe
  2⤵
  PID:6940
- C:\Windows\System\rorkpCI.exe
  C:\Windows\System\rorkpCI.exe
  2⤵
  PID:7028
- C:\Windows\System\mQhEcta.exe
  C:\Windows\System\mQhEcta.exe
  2⤵
  PID:7116
- C:\Windows\System\cweGott.exe
  C:\Windows\System\cweGott.exe
  2⤵
  PID:6216
- C:\Windows\System\WKRLuXo.exe
  C:\Windows\System\WKRLuXo.exe
  2⤵
  PID:6368
- C:\Windows\System\GCzEZUd.exe
  C:\Windows\System\GCzEZUd.exe
  2⤵
  PID:6492
- C:\Windows\System\FbjJUpq.exe
  C:\Windows\System\FbjJUpq.exe
  2⤵
  PID:6660
- C:\Windows\System\lrGEKZV.exe
  C:\Windows\System\lrGEKZV.exe
  2⤵
  PID:6764
- C:\Windows\System\IVUEGQC.exe
  C:\Windows\System\IVUEGQC.exe
  2⤵
  PID:6912
- C:\Windows\System\LamRKVi.exe
  C:\Windows\System\LamRKVi.exe
  2⤵
  PID:7152
- C:\Windows\System\NgPIMTR.exe
  C:\Windows\System\NgPIMTR.exe
  2⤵
  PID:6460
- C:\Windows\System\AthNoXj.exe
  C:\Windows\System\AthNoXj.exe
  2⤵
  PID:6708
- C:\Windows\System\biUkaRm.exe
  C:\Windows\System\biUkaRm.exe
  2⤵
  PID:2488
- C:\Windows\System\pFJkIHT.exe
  C:\Windows\System\pFJkIHT.exe
  2⤵
  PID:6684
- C:\Windows\System\uUFaRpY.exe
  C:\Windows\System\uUFaRpY.exe
  2⤵
  PID:3412
- C:\Windows\System\RDGQtkn.exe
  C:\Windows\System\RDGQtkn.exe
  2⤵
  PID:7188
- C:\Windows\System\ULNgdNN.exe
  C:\Windows\System\ULNgdNN.exe
  2⤵
  PID:7216
- C:\Windows\System\gVZjXCS.exe
  C:\Windows\System\gVZjXCS.exe
  2⤵
  PID:7236
- C:\Windows\System\nkRcDjh.exe
  C:\Windows\System\nkRcDjh.exe
  2⤵
  PID:7272
- C:\Windows\System\AjWfAuH.exe
  C:\Windows\System\AjWfAuH.exe
  2⤵
  PID:7300
- C:\Windows\System\bupNGtN.exe
  C:\Windows\System\bupNGtN.exe
  2⤵
  PID:7328
- C:\Windows\System\tbXcGxg.exe
  C:\Windows\System\tbXcGxg.exe
  2⤵
  PID:7356
- C:\Windows\System\hqePYnh.exe
  C:\Windows\System\hqePYnh.exe
  2⤵
  PID:7388
- C:\Windows\System\LoEHHeg.exe
  C:\Windows\System\LoEHHeg.exe
  2⤵
  PID:7416
- C:\Windows\System\gFTLqef.exe
  C:\Windows\System\gFTLqef.exe
  2⤵
  PID:7444
- C:\Windows\System\jhqTNWo.exe
  C:\Windows\System\jhqTNWo.exe
  2⤵
  PID:7472
- C:\Windows\System\KxYpbvp.exe
  C:\Windows\System\KxYpbvp.exe
  2⤵
  PID:7500
- C:\Windows\System\YxMfAIy.exe
  C:\Windows\System\YxMfAIy.exe
  2⤵
  PID:7528
- C:\Windows\System\PuXLdIl.exe
  C:\Windows\System\PuXLdIl.exe
  2⤵
  PID:7556
- C:\Windows\System\MQFdHNb.exe
  C:\Windows\System\MQFdHNb.exe
  2⤵
  PID:7584
- C:\Windows\System\dUTBxBO.exe
  C:\Windows\System\dUTBxBO.exe
  2⤵
  PID:7616
- C:\Windows\System\peaRVgB.exe
  C:\Windows\System\peaRVgB.exe
  2⤵
  PID:7644
- C:\Windows\System\IQYJUVR.exe
  C:\Windows\System\IQYJUVR.exe
  2⤵
  PID:7668
- C:\Windows\System\CFPOSHl.exe
  C:\Windows\System\CFPOSHl.exe
  2⤵
  PID:7688
- C:\Windows\System\lpMveLw.exe
  C:\Windows\System\lpMveLw.exe
  2⤵
  PID:7728
- C:\Windows\System\nXSAJfk.exe
  C:\Windows\System\nXSAJfk.exe
  2⤵
  PID:7760
- C:\Windows\System\JlibqTK.exe
  C:\Windows\System\JlibqTK.exe
  2⤵
  PID:7780
- C:\Windows\System\isobnZj.exe
  C:\Windows\System\isobnZj.exe
  2⤵
  PID:7812
- C:\Windows\System\fumiIvr.exe
  C:\Windows\System\fumiIvr.exe
  2⤵
  PID:7848
- C:\Windows\System\WQrLgJy.exe
  C:\Windows\System\WQrLgJy.exe
  2⤵
  PID:7872
- C:\Windows\System\TGDXLhM.exe
  C:\Windows\System\TGDXLhM.exe
  2⤵
  PID:7892
- C:\Windows\System\GsATcVh.exe
  C:\Windows\System\GsATcVh.exe
  2⤵
  PID:7912
- C:\Windows\System\sVbxnXr.exe
  C:\Windows\System\sVbxnXr.exe
  2⤵
  PID:7932
- C:\Windows\System\AvyDBAG.exe
  C:\Windows\System\AvyDBAG.exe
  2⤵
  PID:7948
- C:\Windows\System\OJKeLYY.exe
  C:\Windows\System\OJKeLYY.exe
  2⤵
  PID:8008
- C:\Windows\System\yKEsrfc.exe
  C:\Windows\System\yKEsrfc.exe
  2⤵
  PID:8052
- C:\Windows\System\rqwCLQO.exe
  C:\Windows\System\rqwCLQO.exe
  2⤵
  PID:8072
- C:\Windows\System\oWdPeFx.exe
  C:\Windows\System\oWdPeFx.exe
  2⤵
  PID:8096
- C:\Windows\System\ShigzgO.exe
  C:\Windows\System\ShigzgO.exe
  2⤵
  PID:8112
- C:\Windows\System\FkZyAIi.exe
  C:\Windows\System\FkZyAIi.exe
  2⤵
  PID:8160
- C:\Windows\System\IXtkVtG.exe
  C:\Windows\System\IXtkVtG.exe
  2⤵
  PID:7172
- C:\Windows\System\qKSCvdX.exe
  C:\Windows\System\qKSCvdX.exe
  2⤵
  PID:7224
- C:\Windows\System\JTWCJJv.exe
  C:\Windows\System\JTWCJJv.exe
  2⤵
  PID:7296
- C:\Windows\System\WfpFkGo.exe
  C:\Windows\System\WfpFkGo.exe
  2⤵
  PID:7368
- C:\Windows\System\nBPEHXx.exe
  C:\Windows\System\nBPEHXx.exe
  2⤵
  PID:3472
- C:\Windows\System\TBHQmYs.exe
  C:\Windows\System\TBHQmYs.exe
  2⤵
  PID:7484
- C:\Windows\System\wnUbLfx.exe
  C:\Windows\System\wnUbLfx.exe
  2⤵
  PID:7552
- C:\Windows\System\WmHHTYr.exe
  C:\Windows\System\WmHHTYr.exe
  2⤵
  PID:7608
- C:\Windows\System\kcKLkAS.exe
  C:\Windows\System\kcKLkAS.exe
  2⤵
  PID:7680
- C:\Windows\System\XKVxFDI.exe
  C:\Windows\System\XKVxFDI.exe
  2⤵
  PID:7752
- C:\Windows\System\aVsECBP.exe
  C:\Windows\System\aVsECBP.exe
  2⤵
  PID:7768
- C:\Windows\System\eVaGubj.exe
  C:\Windows\System\eVaGubj.exe
  2⤵
  PID:7836
- C:\Windows\System\mUPbOEG.exe
  C:\Windows\System\mUPbOEG.exe
  2⤵
  PID:7928
- C:\Windows\System\TaIMkoN.exe
  C:\Windows\System\TaIMkoN.exe
  2⤵
  PID:8024
- C:\Windows\System\tUdseEg.exe
  C:\Windows\System\tUdseEg.exe
  2⤵
  PID:8084
- C:\Windows\System\OoNOqWA.exe
  C:\Windows\System\OoNOqWA.exe
  2⤵
  PID:8124
- C:\Windows\System\bVHDkNn.exe
  C:\Windows\System\bVHDkNn.exe
  2⤵
  PID:7856
- C:\Windows\System\rVZqZno.exe
  C:\Windows\System\rVZqZno.exe
  2⤵
  PID:7284
- C:\Windows\System\fhyOQMS.exe
  C:\Windows\System\fhyOQMS.exe
  2⤵
  PID:7436
- C:\Windows\System\ootgikb.exe
  C:\Windows\System\ootgikb.exe
  2⤵
  PID:7576
- C:\Windows\System\UvLmtUh.exe
  C:\Windows\System\UvLmtUh.exe
  2⤵
  PID:7796
- C:\Windows\System\MfXhgEg.exe
  C:\Windows\System\MfXhgEg.exe
  2⤵
  PID:7992
- C:\Windows\System\ZpqtNBi.exe
  C:\Windows\System\ZpqtNBi.exe
  2⤵
  PID:8156
- C:\Windows\System\blbSrNq.exe
  C:\Windows\System\blbSrNq.exe
  2⤵
  PID:7376
- C:\Windows\System\JUCuCvn.exe
  C:\Windows\System\JUCuCvn.exe
  2⤵
  PID:8104
- C:\Windows\System\ajfhBLG.exe
  C:\Windows\System\ajfhBLG.exe
  2⤵
  PID:7884
- C:\Windows\System\xdLrcxE.exe
  C:\Windows\System\xdLrcxE.exe
  2⤵
  PID:8216
- C:\Windows\System\mMkjjyw.exe
  C:\Windows\System\mMkjjyw.exe
  2⤵
  PID:8244
- C:\Windows\System\uilZpFL.exe
  C:\Windows\System\uilZpFL.exe
  2⤵
  PID:8260
- C:\Windows\System\niLVCkf.exe
  C:\Windows\System\niLVCkf.exe
  2⤵
  PID:8300
- C:\Windows\System\cKwdZbz.exe
  C:\Windows\System\cKwdZbz.exe
  2⤵
  PID:8328
- C:\Windows\System\oMPVXZx.exe
  C:\Windows\System\oMPVXZx.exe
  2⤵
  PID:8356
- C:\Windows\System\qofHGqF.exe
  C:\Windows\System\qofHGqF.exe
  2⤵
  PID:8384
- C:\Windows\System\WianriS.exe
  C:\Windows\System\WianriS.exe
  2⤵
  PID:8412
- C:\Windows\System\dOKmrAA.exe
  C:\Windows\System\dOKmrAA.exe
  2⤵
  PID:8444
- C:\Windows\System\TXSfZnK.exe
  C:\Windows\System\TXSfZnK.exe
  2⤵
  PID:8472
- C:\Windows\System\HcrLiDv.exe
  C:\Windows\System\HcrLiDv.exe
  2⤵
  PID:8504
- C:\Windows\System\mezmvWb.exe
  C:\Windows\System\mezmvWb.exe
  2⤵
  PID:8532
- C:\Windows\System\ehsYkkJ.exe
  C:\Windows\System\ehsYkkJ.exe
  2⤵
  PID:8560
- C:\Windows\System\RDTdPnb.exe
  C:\Windows\System\RDTdPnb.exe
  2⤵
  PID:8588
- C:\Windows\System\yWOCUmJ.exe
  C:\Windows\System\yWOCUmJ.exe
  2⤵
  PID:8616
- C:\Windows\System\EYehFmk.exe
  C:\Windows\System\EYehFmk.exe
  2⤵
  PID:8644
- C:\Windows\System\rHGicXV.exe
  C:\Windows\System\rHGicXV.exe
  2⤵
  PID:8676
- C:\Windows\System\tubckvV.exe
  C:\Windows\System\tubckvV.exe
  2⤵
  PID:8704
- C:\Windows\System\uHGlirj.exe
  C:\Windows\System\uHGlirj.exe
  2⤵
  PID:8732
- C:\Windows\System\KNdnTgA.exe
  C:\Windows\System\KNdnTgA.exe
  2⤵
  PID:8748
- C:\Windows\System\JkzQsIZ.exe
  C:\Windows\System\JkzQsIZ.exe
  2⤵
  PID:8788
- C:\Windows\System\jFPuljF.exe
  C:\Windows\System\jFPuljF.exe
  2⤵
  PID:8816
- C:\Windows\System\vxwsQTU.exe
  C:\Windows\System\vxwsQTU.exe
  2⤵
  PID:8844
- C:\Windows\System\nDmhorR.exe
  C:\Windows\System\nDmhorR.exe
  2⤵
  PID:8872
- C:\Windows\System\uxAZlax.exe
  C:\Windows\System\uxAZlax.exe
  2⤵
  PID:8900
- C:\Windows\System\Vgzzpcu.exe
  C:\Windows\System\Vgzzpcu.exe
  2⤵
  PID:8936
- C:\Windows\System\RuSKkAa.exe
  C:\Windows\System\RuSKkAa.exe
  2⤵
  PID:8964
- C:\Windows\System\qkfHQRb.exe
  C:\Windows\System\qkfHQRb.exe
  2⤵
  PID:8984
- C:\Windows\System\rbQuFUs.exe
  C:\Windows\System\rbQuFUs.exe
  2⤵
  PID:9036
- C:\Windows\System\xolkxct.exe
  C:\Windows\System\xolkxct.exe
  2⤵
  PID:9088
- C:\Windows\System\PRFbWme.exe
  C:\Windows\System\PRFbWme.exe
  2⤵
  PID:9116
- C:\Windows\System\VVbqRRp.exe
  C:\Windows\System\VVbqRRp.exe
  2⤵
  PID:9144
- C:\Windows\System\mjoHoEh.exe
  C:\Windows\System\mjoHoEh.exe
  2⤵
  PID:9176
- C:\Windows\System\eMKutjg.exe
  C:\Windows\System\eMKutjg.exe
  2⤵
  PID:9208
- C:\Windows\System\IQFppsf.exe
  C:\Windows\System\IQFppsf.exe
  2⤵
  PID:8312
- C:\Windows\System\yzvsYwW.exe
  C:\Windows\System\yzvsYwW.exe
  2⤵
  PID:8460
- C:\Windows\System\WjSfdFm.exe
  C:\Windows\System\WjSfdFm.exe
  2⤵
  PID:8516
- C:\Windows\System\rzSWgzE.exe
  C:\Windows\System\rzSWgzE.exe
  2⤵
  PID:8576
- C:\Windows\System\QmJVDJp.exe
  C:\Windows\System\QmJVDJp.exe
  2⤵
  PID:6276
- C:\Windows\System\goPfjtw.exe
  C:\Windows\System\goPfjtw.exe
  2⤵
  PID:8688
- C:\Windows\System\rkyvGCI.exe
  C:\Windows\System\rkyvGCI.exe
  2⤵
  PID:6132
- C:\Windows\System\YlStsXo.exe
  C:\Windows\System\YlStsXo.exe
  2⤵
  PID:8780
- C:\Windows\System\sqDONBr.exe
  C:\Windows\System\sqDONBr.exe
  2⤵
  PID:8856
- C:\Windows\System\nmUGNwa.exe
  C:\Windows\System\nmUGNwa.exe
  2⤵
  PID:8948
- C:\Windows\System\hbbapRy.exe
  C:\Windows\System\hbbapRy.exe
  2⤵
  PID:9048
- C:\Windows\System\ItRhueL.exe
  C:\Windows\System\ItRhueL.exe
  2⤵
  PID:9136
- C:\Windows\System\gWIIKJj.exe
  C:\Windows\System\gWIIKJj.exe
  2⤵
  PID:9168
- C:\Windows\System\blfSJaq.exe
  C:\Windows\System\blfSJaq.exe
  2⤵
  PID:8348
- C:\Windows\System\rKONTga.exe
  C:\Windows\System\rKONTga.exe
  2⤵
  PID:3476
- C:\Windows\System\avYgqvg.exe
  C:\Windows\System\avYgqvg.exe
  2⤵
  PID:8500
- C:\Windows\System\LVMgQdV.exe
  C:\Windows\System\LVMgQdV.exe
  2⤵
  PID:8884
- C:\Windows\System\znyRmLG.exe
  C:\Windows\System\znyRmLG.exe
  2⤵
  PID:9112
- C:\Windows\System\PlJTkiK.exe
  C:\Windows\System\PlJTkiK.exe
  2⤵
  PID:8292
- C:\Windows\System\RXgoAur.exe
  C:\Windows\System\RXgoAur.exe
  2⤵
  PID:9100
- C:\Windows\System\LkmqVNa.exe
  C:\Windows\System\LkmqVNa.exe
  2⤵
  PID:9240
- C:\Windows\System\HnOxFru.exe
  C:\Windows\System\HnOxFru.exe
  2⤵
  PID:9276
- C:\Windows\System\oOMDzZC.exe
  C:\Windows\System\oOMDzZC.exe
  2⤵
  PID:9308
- C:\Windows\System\YOVFRuN.exe
  C:\Windows\System\YOVFRuN.exe
  2⤵
  PID:9332
- C:\Windows\System\NgCNxKD.exe
  C:\Windows\System\NgCNxKD.exe
  2⤵
  PID:9360
- C:\Windows\System\mPFPcgA.exe
  C:\Windows\System\mPFPcgA.exe
  2⤵
  PID:9404
- C:\Windows\System\sHqTrFL.exe
  C:\Windows\System\sHqTrFL.exe
  2⤵
  PID:9440
- C:\Windows\System\iOnKcGn.exe
  C:\Windows\System\iOnKcGn.exe
  2⤵
  PID:9472
- C:\Windows\System\kddwREE.exe
  C:\Windows\System\kddwREE.exe
  2⤵
  PID:9508
- C:\Windows\System\GVLOAyx.exe
  C:\Windows\System\GVLOAyx.exe
  2⤵
  PID:9548
- C:\Windows\System\rffODVn.exe
  C:\Windows\System\rffODVn.exe
  2⤵
  PID:9576
- C:\Windows\System\YbuwwvE.exe
  C:\Windows\System\YbuwwvE.exe
  2⤵
  PID:9604
- C:\Windows\System\nejhhAP.exe
  C:\Windows\System\nejhhAP.exe
  2⤵
  PID:9632
- C:\Windows\System\YkBKwcJ.exe
  C:\Windows\System\YkBKwcJ.exe
  2⤵
  PID:9652
- C:\Windows\System\hqlgQXK.exe
  C:\Windows\System\hqlgQXK.exe
  2⤵
  PID:9680
- C:\Windows\System\sRuvNNC.exe
  C:\Windows\System\sRuvNNC.exe
  2⤵
  PID:9720
- C:\Windows\System\DVGhXyi.exe
  C:\Windows\System\DVGhXyi.exe
  2⤵
  PID:9752
- C:\Windows\System\dbtpFBY.exe
  C:\Windows\System\dbtpFBY.exe
  2⤵
  PID:9768
- C:\Windows\System\PtCfCAq.exe
  C:\Windows\System\PtCfCAq.exe
  2⤵
  PID:9808
- C:\Windows\System\WjAYbjL.exe
  C:\Windows\System\WjAYbjL.exe
  2⤵
  PID:9836
- C:\Windows\System\ehmwDDl.exe
  C:\Windows\System\ehmwDDl.exe
  2⤵
  PID:9868
- C:\Windows\System\fyuGxrw.exe
  C:\Windows\System\fyuGxrw.exe
  2⤵
  PID:9896
- C:\Windows\System\xNiKVXy.exe
  C:\Windows\System\xNiKVXy.exe
  2⤵
  PID:9924
- C:\Windows\System\DccHCDw.exe
  C:\Windows\System\DccHCDw.exe
  2⤵
  PID:9952
- C:\Windows\System\KmkDbmX.exe
  C:\Windows\System\KmkDbmX.exe
  2⤵
  PID:9968
- C:\Windows\System\urrIRDd.exe
  C:\Windows\System\urrIRDd.exe
  2⤵
  PID:10008
- C:\Windows\System\bsaNAmb.exe
  C:\Windows\System\bsaNAmb.exe
  2⤵
  PID:10036
- C:\Windows\System\QtnVIXm.exe
  C:\Windows\System\QtnVIXm.exe
  2⤵
  PID:10068
- C:\Windows\System\NyMriCV.exe
  C:\Windows\System\NyMriCV.exe
  2⤵
  PID:10096
- C:\Windows\System\KvAgSES.exe
  C:\Windows\System\KvAgSES.exe
  2⤵
  PID:10120
- C:\Windows\System\jAEpTNG.exe
  C:\Windows\System\jAEpTNG.exe
  2⤵
  PID:10152
- C:\Windows\System\jbAaeIi.exe
  C:\Windows\System\jbAaeIi.exe
  2⤵
  PID:10180
- C:\Windows\System\FHFFbMb.exe
  C:\Windows\System\FHFFbMb.exe
  2⤵
  PID:10196
- C:\Windows\System\jbcBujJ.exe
  C:\Windows\System\jbcBujJ.exe
  2⤵
  PID:10224
- C:\Windows\System\yjRroev.exe
  C:\Windows\System\yjRroev.exe
  2⤵
  PID:9164
- C:\Windows\System\thIFGxK.exe
  C:\Windows\System\thIFGxK.exe
  2⤵
  PID:2464
- C:\Windows\System\UrnTcXB.exe
  C:\Windows\System\UrnTcXB.exe
  2⤵
  PID:9396
- C:\Windows\System\ijqKOJL.exe
  C:\Windows\System\ijqKOJL.exe
  2⤵
  PID:9412
- C:\Windows\System\FhXLXlp.exe
  C:\Windows\System\FhXLXlp.exe
  2⤵
  PID:9540
- C:\Windows\System\smJkwvo.exe
  C:\Windows\System\smJkwvo.exe
  2⤵
  PID:9600
- C:\Windows\System\OckBJuQ.exe
  C:\Windows\System\OckBJuQ.exe
  2⤵
  PID:9676
- C:\Windows\System\nceqpOM.exe
  C:\Windows\System\nceqpOM.exe
  2⤵
  PID:9744
- C:\Windows\System\toWEyIM.exe
  C:\Windows\System\toWEyIM.exe
  2⤵
  PID:9804
- C:\Windows\System\isXBaFR.exe
  C:\Windows\System\isXBaFR.exe
  2⤵
  PID:9864
- C:\Windows\System\ZRVrWqV.exe
  C:\Windows\System\ZRVrWqV.exe
  2⤵
  PID:9920
- C:\Windows\System\qedFOGp.exe
  C:\Windows\System\qedFOGp.exe
  2⤵
  PID:10000
- C:\Windows\System\YJcmKJr.exe
  C:\Windows\System\YJcmKJr.exe
  2⤵
  PID:10032
- C:\Windows\System\ozSGcfU.exe
  C:\Windows\System\ozSGcfU.exe
  2⤵
  PID:10108
- C:\Windows\System\HHmFHBK.exe
  C:\Windows\System\HHmFHBK.exe
  2⤵
  PID:10192
- C:\Windows\System\ArHdDLs.exe
  C:\Windows\System\ArHdDLs.exe
  2⤵
  PID:8928
- C:\Windows\System\AYXTdIT.exe
  C:\Windows\System\AYXTdIT.exe
  2⤵
  PID:9316
- C:\Windows\System\sMZbUDg.exe
  C:\Windows\System\sMZbUDg.exe
  2⤵
  PID:9484
- C:\Windows\System\JphqpqZ.exe
  C:\Windows\System\JphqpqZ.exe
  2⤵
  PID:9716
- C:\Windows\System\ipNvypy.exe
  C:\Windows\System\ipNvypy.exe
  2⤵
  PID:9852
- C:\Windows\System\DEJUROE.exe
  C:\Windows\System\DEJUROE.exe
  2⤵
  PID:9992
- C:\Windows\System\pfOKBWp.exe
  C:\Windows\System\pfOKBWp.exe
  2⤵
  PID:10092
- C:\Windows\System\vTislvD.exe
  C:\Windows\System\vTislvD.exe
  2⤵
  PID:9300
- C:\Windows\System\vRTglED.exe
  C:\Windows\System\vRTglED.exe
  2⤵
  PID:9668
- C:\Windows\System\EhYiBYP.exe
  C:\Windows\System\EhYiBYP.exe
  2⤵
  PID:10088
- C:\Windows\System\bOncaFS.exe
  C:\Windows\System\bOncaFS.exe
  2⤵
  PID:9628
- C:\Windows\System\SXDXpLh.exe
  C:\Windows\System\SXDXpLh.exe
  2⤵
  PID:9980
- C:\Windows\System\bypjOuM.exe
  C:\Windows\System\bypjOuM.exe
  2⤵
  PID:9372
- C:\Windows\System\GPTEEGJ.exe
  C:\Windows\System\GPTEEGJ.exe
  2⤵
  PID:10288
- C:\Windows\System\mROufjn.exe
  C:\Windows\System\mROufjn.exe
  2⤵
  PID:10320
- C:\Windows\System\Oixsvab.exe
  C:\Windows\System\Oixsvab.exe
  2⤵
  PID:10348
- C:\Windows\System\wORRdKF.exe
  C:\Windows\System\wORRdKF.exe
  2⤵
  PID:10380
- C:\Windows\System\zNJJPLk.exe
  C:\Windows\System\zNJJPLk.exe
  2⤵
  PID:10408
- C:\Windows\System\RZogMWz.exe
  C:\Windows\System\RZogMWz.exe
  2⤵
  PID:10436
- C:\Windows\System\fJKlhTG.exe
  C:\Windows\System\fJKlhTG.exe
  2⤵
  PID:10472
- C:\Windows\System\jluUcwb.exe
  C:\Windows\System\jluUcwb.exe
  2⤵
  PID:10500
- C:\Windows\System\tJZDgQf.exe
  C:\Windows\System\tJZDgQf.exe
  2⤵
  PID:10544
- C:\Windows\System\vtrCrHD.exe
  C:\Windows\System\vtrCrHD.exe
  2⤵
  PID:10584
- C:\Windows\System\qCMqWif.exe
  C:\Windows\System\qCMqWif.exe
  2⤵
  PID:10612
- C:\Windows\System\XVplPcT.exe
  C:\Windows\System\XVplPcT.exe
  2⤵
  PID:10640
- C:\Windows\System\oXHdgOJ.exe
  C:\Windows\System\oXHdgOJ.exe
  2⤵
  PID:10668
- C:\Windows\System\frZONeF.exe
  C:\Windows\System\frZONeF.exe
  2⤵
  PID:10696
- C:\Windows\System\VyvPMCe.exe
  C:\Windows\System\VyvPMCe.exe
  2⤵
  PID:10724
- C:\Windows\System\kFCaqVR.exe
  C:\Windows\System\kFCaqVR.exe
  2⤵
  PID:10752
- C:\Windows\System\fSNBTDV.exe
  C:\Windows\System\fSNBTDV.exe
  2⤵
  PID:10768
- C:\Windows\System\fdUlhtR.exe
  C:\Windows\System\fdUlhtR.exe
  2⤵
  PID:10808
- C:\Windows\System\AuBEymy.exe
  C:\Windows\System\AuBEymy.exe
  2⤵
  PID:10836
- C:\Windows\System\pIiwKHL.exe
  C:\Windows\System\pIiwKHL.exe
  2⤵
  PID:10864
- C:\Windows\System\XmTEhYG.exe
  C:\Windows\System\XmTEhYG.exe
  2⤵
  PID:10892
- C:\Windows\System\qgkibbR.exe
  C:\Windows\System\qgkibbR.exe
  2⤵
  PID:10920
- C:\Windows\System\KkEfrlj.exe
  C:\Windows\System\KkEfrlj.exe
  2⤵
  PID:10948
- C:\Windows\System\oIiBUcP.exe
  C:\Windows\System\oIiBUcP.exe
  2⤵
  PID:10976
- C:\Windows\System\STbXxyn.exe
  C:\Windows\System\STbXxyn.exe
  2⤵
  PID:11004
- C:\Windows\System\XjaAqtr.exe
  C:\Windows\System\XjaAqtr.exe
  2⤵
  PID:11032
- C:\Windows\System\pAOLeKP.exe
  C:\Windows\System\pAOLeKP.exe
  2⤵
  PID:11060
- C:\Windows\System\BTKuBeo.exe
  C:\Windows\System\BTKuBeo.exe
  2⤵
  PID:11088
- C:\Windows\System\JWagoeL.exe
  C:\Windows\System\JWagoeL.exe
  2⤵
  PID:11104
- C:\Windows\System\zASgMrY.exe
  C:\Windows\System\zASgMrY.exe
  2⤵
  PID:11144
- C:\Windows\System\cHwuAki.exe
  C:\Windows\System\cHwuAki.exe
  2⤵
  PID:11172
- C:\Windows\System\hPGVKWB.exe
  C:\Windows\System\hPGVKWB.exe
  2⤵
  PID:11200
- C:\Windows\System\DkinKlb.exe
  C:\Windows\System\DkinKlb.exe
  2⤵
  PID:11228
- C:\Windows\System\WwwtHti.exe
  C:\Windows\System\WwwtHti.exe
  2⤵
  PID:11244
- C:\Windows\System\JIGVrJr.exe
  C:\Windows\System\JIGVrJr.exe
  2⤵
  PID:10268
- C:\Windows\System\NEoVPhq.exe
  C:\Windows\System\NEoVPhq.exe
  2⤵
  PID:10336
- C:\Windows\System\xQfUpeq.exe
  C:\Windows\System\xQfUpeq.exe
  2⤵
  PID:10400
- C:\Windows\System\OabRDFa.exe
  C:\Windows\System\OabRDFa.exe
  2⤵
  PID:10464
- C:\Windows\System\AZLWvVA.exe
  C:\Windows\System\AZLWvVA.exe
  2⤵
  PID:10560
- C:\Windows\System\poOVdBw.exe
  C:\Windows\System\poOVdBw.exe
  2⤵
  PID:10624
- C:\Windows\System\gjEuoZV.exe
  C:\Windows\System\gjEuoZV.exe
  2⤵
  PID:10688
- C:\Windows\System\hvuYjSl.exe
  C:\Windows\System\hvuYjSl.exe
  2⤵
  PID:10748
- C:\Windows\System\fqDuyaY.exe
  C:\Windows\System\fqDuyaY.exe
  2⤵
  PID:10820
- C:\Windows\System\SDjIrcX.exe
  C:\Windows\System\SDjIrcX.exe
  2⤵
  PID:10884
- C:\Windows\System\PIUshtM.exe
  C:\Windows\System\PIUshtM.exe
  2⤵
  PID:10940
- C:\Windows\System\QcGuWSh.exe
  C:\Windows\System\QcGuWSh.exe
  2⤵
  PID:11020
- C:\Windows\System\sEKFrrH.exe
  C:\Windows\System\sEKFrrH.exe
  2⤵
  PID:11052
- C:\Windows\System\CwqtdeG.exe
  C:\Windows\System\CwqtdeG.exe
  2⤵
  PID:11136
- C:\Windows\System\urQwmQA.exe
  C:\Windows\System\urQwmQA.exe
  2⤵
  PID:11220
- C:\Windows\System\BfHxOPG.exe
  C:\Windows\System\BfHxOPG.exe
  2⤵
  PID:9348
- C:\Windows\System\lDjBgxA.exe
  C:\Windows\System\lDjBgxA.exe
  2⤵
  PID:10432
- C:\Windows\System\lqRGeoh.exe
  C:\Windows\System\lqRGeoh.exe
  2⤵
  PID:10596
- C:\Windows\System\EjAchjL.exe
  C:\Windows\System\EjAchjL.exe
  2⤵
  PID:10720
- C:\Windows\System\ckNWuio.exe
  C:\Windows\System\ckNWuio.exe
  2⤵
  PID:10876
- C:\Windows\System\oXCYJpH.exe
  C:\Windows\System\oXCYJpH.exe
  2⤵
  PID:11056
- C:\Windows\System\Vzbjnzs.exe
  C:\Windows\System\Vzbjnzs.exe
  2⤵
  PID:11212
- C:\Windows\System\yNxrFCB.exe
  C:\Windows\System\yNxrFCB.exe
  2⤵
  PID:10372
- C:\Windows\System\hgbruld.exe
  C:\Windows\System\hgbruld.exe
  2⤵
  PID:10860
- C:\Windows\System\qmgYFZo.exe
  C:\Windows\System\qmgYFZo.exe
  2⤵
  PID:11184
- C:\Windows\System\ZKoRMhm.exe
  C:\Windows\System\ZKoRMhm.exe
  2⤵
  PID:10716
- C:\Windows\System\RvuHZEj.exe
  C:\Windows\System\RvuHZEj.exe
  2⤵
  PID:10520
- C:\Windows\System\xpAeJRc.exe
  C:\Windows\System\xpAeJRc.exe
  2⤵
  PID:11284
- C:\Windows\System\OZnTqht.exe
  C:\Windows\System\OZnTqht.exe
  2⤵
  PID:11320
- C:\Windows\System\VbEAOld.exe
  C:\Windows\System\VbEAOld.exe
  2⤵
  PID:11348
- C:\Windows\System\ayDvAZU.exe
  C:\Windows\System\ayDvAZU.exe
  2⤵
  PID:11368
- C:\Windows\System\qpFvzBy.exe
  C:\Windows\System\qpFvzBy.exe
  2⤵
  PID:11404
- C:\Windows\System\UbgixQe.exe
  C:\Windows\System\UbgixQe.exe
  2⤵
  PID:11444
- C:\Windows\System\ymGCokY.exe
  C:\Windows\System\ymGCokY.exe
  2⤵
  PID:11484
- C:\Windows\System\OfPedyk.exe
  C:\Windows\System\OfPedyk.exe
  2⤵
  PID:11524
- C:\Windows\System\SZEYyNg.exe
  C:\Windows\System\SZEYyNg.exe
  2⤵
  PID:11552
- C:\Windows\System\hDhzLyt.exe
  C:\Windows\System\hDhzLyt.exe
  2⤵
  PID:11576
- C:\Windows\System\fdMQSxE.exe
  C:\Windows\System\fdMQSxE.exe
  2⤵
  PID:11596
- C:\Windows\System\aQxwZJk.exe
  C:\Windows\System\aQxwZJk.exe
  2⤵
  PID:11640
- C:\Windows\System\toIWrZd.exe
  C:\Windows\System\toIWrZd.exe
  2⤵
  PID:11672
- C:\Windows\System\nNvfXpn.exe
  C:\Windows\System\nNvfXpn.exe
  2⤵
  PID:11700
- C:\Windows\System\hAOmxYn.exe
  C:\Windows\System\hAOmxYn.exe
  2⤵
  PID:11728
- C:\Windows\System\gibTaXR.exe
  C:\Windows\System\gibTaXR.exe
  2⤵
  PID:11760
- C:\Windows\System\Ugjelpu.exe
  C:\Windows\System\Ugjelpu.exe
  2⤵
  PID:11788
- C:\Windows\System\pXNGmmO.exe
  C:\Windows\System\pXNGmmO.exe
  2⤵
  PID:11816
- C:\Windows\System\QkYiSTM.exe
  C:\Windows\System\QkYiSTM.exe
  2⤵
  PID:11844
- C:\Windows\System\inibIMo.exe
  C:\Windows\System\inibIMo.exe
  2⤵
  PID:11872
- C:\Windows\System\ugPeBeW.exe
  C:\Windows\System\ugPeBeW.exe
  2⤵
  PID:11900
- C:\Windows\System\AVgtBHE.exe
  C:\Windows\System\AVgtBHE.exe
  2⤵
  PID:11928
- C:\Windows\System\jdodbHG.exe
  C:\Windows\System\jdodbHG.exe
  2⤵
  PID:11956
- C:\Windows\System\KaYkeFc.exe
  C:\Windows\System\KaYkeFc.exe
  2⤵
  PID:11984
- C:\Windows\System\DGGqXZb.exe
  C:\Windows\System\DGGqXZb.exe
  2⤵
  PID:12012
- C:\Windows\System\rnjDWqp.exe
  C:\Windows\System\rnjDWqp.exe
  2⤵
  PID:12040
- C:\Windows\System\MypPfOU.exe
  C:\Windows\System\MypPfOU.exe
  2⤵
  PID:12072
- C:\Windows\System\bEOMgnh.exe
  C:\Windows\System\bEOMgnh.exe
  2⤵
  PID:12100
- C:\Windows\System\LFrhHvk.exe
  C:\Windows\System\LFrhHvk.exe
  2⤵
  PID:12128
- C:\Windows\System\iNAHviC.exe
  C:\Windows\System\iNAHviC.exe
  2⤵
  PID:12156
- C:\Windows\System\CkHBXUK.exe
  C:\Windows\System\CkHBXUK.exe
  2⤵
  PID:12184
- C:\Windows\System\nYSqGPq.exe
  C:\Windows\System\nYSqGPq.exe
  2⤵
  PID:12212
- C:\Windows\System\kzWEutS.exe
  C:\Windows\System\kzWEutS.exe
  2⤵
  PID:12228
- C:\Windows\System\tDOXWRw.exe
  C:\Windows\System\tDOXWRw.exe
  2⤵
  PID:12268
- C:\Windows\System\XGVCXMT.exe
  C:\Windows\System\XGVCXMT.exe
  2⤵
  PID:11240
- C:\Windows\System\LdPujjc.exe
  C:\Windows\System\LdPujjc.exe
  2⤵
  PID:11344
- C:\Windows\System\sUFABzY.exe
  C:\Windows\System\sUFABzY.exe
  2⤵
  PID:11396
- C:\Windows\System\pYPolfZ.exe
  C:\Windows\System\pYPolfZ.exe
  2⤵
  PID:752
- C:\Windows\System\zeDkXub.exe
  C:\Windows\System\zeDkXub.exe
  2⤵
  PID:11512
- C:\Windows\System\XAVJHfH.exe
  C:\Windows\System\XAVJHfH.exe
  2⤵
  PID:11588
- C:\Windows\System\tUdGvvG.exe
  C:\Windows\System\tUdGvvG.exe
  2⤵
  PID:11660
- C:\Windows\System\ejtrJdH.exe
  C:\Windows\System\ejtrJdH.exe
  2⤵
  PID:11744
- C:\Windows\System\OUFjReg.exe
  C:\Windows\System\OUFjReg.exe
  2⤵
  PID:11800
- C:\Windows\System\LKYWsgm.exe
  C:\Windows\System\LKYWsgm.exe
  2⤵
  PID:11868
- C:\Windows\System\eDesHKr.exe
  C:\Windows\System\eDesHKr.exe
  2⤵
  PID:11940
- C:\Windows\System\EbHDcDi.exe
  C:\Windows\System\EbHDcDi.exe
  2⤵
  PID:11996
- C:\Windows\System\bLOXoGK.exe
  C:\Windows\System\bLOXoGK.exe
  2⤵
  PID:12088
- C:\Windows\System\peWclnD.exe
  C:\Windows\System\peWclnD.exe
  2⤵
  PID:12208
- C:\Windows\System\nBTFFOG.exe
  C:\Windows\System\nBTFFOG.exe
  2⤵
  PID:11332
- C:\Windows\System\UXFpHPY.exe
  C:\Windows\System\UXFpHPY.exe
  2⤵
  PID:11464
- C:\Windows\System\FREoiKS.exe
  C:\Windows\System\FREoiKS.exe
  2⤵
  PID:11712
- C:\Windows\System\mTzjtNx.exe
  C:\Windows\System\mTzjtNx.exe
  2⤵
  PID:11804
- C:\Windows\System\ZZIMxMi.exe
  C:\Windows\System\ZZIMxMi.exe
  2⤵
  PID:11304
- C:\Windows\System\LdoRBud.exe
  C:\Windows\System\LdoRBud.exe
  2⤵
  PID:216
- C:\Windows\System\vqVwQHC.exe
  C:\Windows\System\vqVwQHC.exe
  2⤵
  PID:11668
- C:\Windows\System\TkoTGGy.exe
  C:\Windows\System\TkoTGGy.exe
  2⤵
  PID:12296
- C:\Windows\System\CAIaPHg.exe
  C:\Windows\System\CAIaPHg.exe
  2⤵
  PID:12316
- C:\Windows\System\HrEzwUN.exe
  C:\Windows\System\HrEzwUN.exe
  2⤵
  PID:12340
- C:\Windows\System\LMZcZNQ.exe
  C:\Windows\System\LMZcZNQ.exe
  2⤵
  PID:12368
- C:\Windows\System\qwTvYEr.exe
  C:\Windows\System\qwTvYEr.exe
  2⤵
  PID:12416
- C:\Windows\System\FPxsDqI.exe
  C:\Windows\System\FPxsDqI.exe
  2⤵
  PID:12432
- C:\Windows\System\XIqomos.exe
  C:\Windows\System\XIqomos.exe
  2⤵
  PID:12448
- C:\Windows\System\oTUKqQA.exe
  C:\Windows\System\oTUKqQA.exe
  2⤵
  PID:12472
- C:\Windows\System\kUMbdJw.exe
  C:\Windows\System\kUMbdJw.exe
  2⤵
  PID:12488
- C:\Windows\System\kuMVvFl.exe
  C:\Windows\System\kuMVvFl.exe
  2⤵
  PID:12548
- C:\Windows\System\HRuwRVw.exe
  C:\Windows\System\HRuwRVw.exe
  2⤵
  PID:12584
- C:\Windows\System\nDPMwJA.exe
  C:\Windows\System\nDPMwJA.exe
  2⤵
  PID:12600
- C:\Windows\System\PeNIbvn.exe
  C:\Windows\System\PeNIbvn.exe
  2⤵
  PID:12628
- C:\Windows\System\GwUwIHL.exe
  C:\Windows\System\GwUwIHL.exe
  2⤵
  PID:12652
- C:\Windows\System\pWDgOyo.exe
  C:\Windows\System\pWDgOyo.exe
  2⤵
  PID:12688
- C:\Windows\System\NmmOBQT.exe
  C:\Windows\System\NmmOBQT.exe
  2⤵
  PID:12732
- C:\Windows\System\kcBXjhf.exe
  C:\Windows\System\kcBXjhf.exe
  2⤵
  PID:12772
- C:\Windows\System\CdGGATD.exe
  C:\Windows\System\CdGGATD.exe
  2⤵
  PID:12800
- C:\Windows\System\phKDZcY.exe
  C:\Windows\System\phKDZcY.exe
  2⤵
  PID:12828
- C:\Windows\System\qpapcGW.exe
  C:\Windows\System\qpapcGW.exe
  2⤵
  PID:12856
- C:\Windows\System\wTILcdw.exe
  C:\Windows\System\wTILcdw.exe
  2⤵
  PID:12884
- C:\Windows\System\NZkagzN.exe
  C:\Windows\System\NZkagzN.exe
  2⤵
  PID:12916
- C:\Windows\System\PvWjRMa.exe
  C:\Windows\System\PvWjRMa.exe
  2⤵
  PID:12944
- C:\Windows\System\IJgwaLW.exe
  C:\Windows\System\IJgwaLW.exe
  2⤵
  PID:12972
- C:\Windows\System\TrvBwxX.exe
  C:\Windows\System\TrvBwxX.exe
  2⤵
  PID:13000
- C:\Windows\System\JVrMriO.exe
  C:\Windows\System\JVrMriO.exe
  2⤵
  PID:13028
- C:\Windows\System\VcyPYBu.exe
  C:\Windows\System\VcyPYBu.exe
  2⤵
  PID:13056
- C:\Windows\System\SuyVbas.exe
  C:\Windows\System\SuyVbas.exe
  2⤵
  PID:13084
- C:\Windows\System\uxOXdhT.exe
  C:\Windows\System\uxOXdhT.exe
  2⤵
  PID:13112
- C:\Windows\System\LaSnGHO.exe
  C:\Windows\System\LaSnGHO.exe
  2⤵
  PID:13140
- C:\Windows\System\yvbnRgM.exe
  C:\Windows\System\yvbnRgM.exe
  2⤵
  PID:13168
- C:\Windows\System\dfdcGql.exe
  C:\Windows\System\dfdcGql.exe
  2⤵
  PID:13196
- C:\Windows\System\BJRXfWU.exe
  C:\Windows\System\BJRXfWU.exe
  2⤵
  PID:13224
- C:\Windows\System\ldKHadJ.exe
  C:\Windows\System\ldKHadJ.exe
  2⤵
  PID:13252
- C:\Windows\System\ZvMBZmP.exe
  C:\Windows\System\ZvMBZmP.exe
  2⤵
  PID:13280
- C:\Windows\System\IiVpEVE.exe
  C:\Windows\System\IiVpEVE.exe
  2⤵
  PID:13308
- C:\Windows\System\ynXUXiL.exe
  C:\Windows\System\ynXUXiL.exe
  2⤵
  PID:12332
- C:\Windows\System\uGhheaY.exe
  C:\Windows\System\uGhheaY.exe
  2⤵
  PID:12444
- C:\Windows\System\sYuDoQy.exe
  C:\Windows\System\sYuDoQy.exe
  2⤵
  PID:12408
- C:\Windows\System\vemJpkA.exe
  C:\Windows\System\vemJpkA.exe
  2⤵
  PID:12504
- C:\Windows\System\gIzwJAy.exe
  C:\Windows\System\gIzwJAy.exe
  2⤵
  PID:12620
- C:\Windows\System\JwBOoRD.exe
  C:\Windows\System\JwBOoRD.exe
  2⤵
  PID:12668
- C:\Windows\System\uBWmvhC.exe
  C:\Windows\System\uBWmvhC.exe
  2⤵
  PID:12756
- C:\Windows\System\BfICpaL.exe
  C:\Windows\System\BfICpaL.exe
  2⤵
  PID:12812
- C:\Windows\System\xryAvpJ.exe
  C:\Windows\System\xryAvpJ.exe
  2⤵
  PID:12876
- C:\Windows\System\VOyTFiM.exe
  C:\Windows\System\VOyTFiM.exe
  2⤵
  PID:1336
- C:\Windows\System\nroAjey.exe
  C:\Windows\System\nroAjey.exe
  2⤵
  PID:12928
- C:\Windows\System\zQLoOWM.exe
  C:\Windows\System\zQLoOWM.exe
  2⤵
  PID:12984
- C:\Windows\System\tmLyeNL.exe
  C:\Windows\System\tmLyeNL.exe
  2⤵
  PID:13068
- C:\Windows\System\QvMxlZu.exe
  C:\Windows\System\QvMxlZu.exe
  2⤵
  PID:13132
- C:\Windows\System\gSdiaNi.exe
  C:\Windows\System\gSdiaNi.exe
  2⤵
  PID:13192
- C:\Windows\System\zzxhjwC.exe
  C:\Windows\System\zzxhjwC.exe
  2⤵
  PID:13264
- C:\Windows\System\MCBwDBz.exe
  C:\Windows\System\MCBwDBz.exe
  2⤵
  PID:12304
- C:\Windows\System\FZTHRHY.exe
  C:\Windows\System\FZTHRHY.exe
  2⤵
  PID:12532
- C:\Windows\System\QWGsnAy.exe
  C:\Windows\System\QWGsnAy.exe
  2⤵
  PID:12648
- C:\Windows\System\UUocxaC.exe
  C:\Windows\System\UUocxaC.exe
  2⤵
  PID:12840
- C:\Windows\System\BjgkvWM.exe
  C:\Windows\System\BjgkvWM.exe
  2⤵
  PID:1572
- C:\Windows\System\jbGOkAL.exe
  C:\Windows\System\jbGOkAL.exe
  2⤵
  PID:13048
- C:\Windows\System\BfHXFRi.exe
  C:\Windows\System\BfHXFRi.exe
  2⤵
  PID:3372
- C:\Windows\System\LUSwfWL.exe
  C:\Windows\System\LUSwfWL.exe
  2⤵
  PID:12324
- C:\Windows\System\jTfoXNW.exe
  C:\Windows\System\jTfoXNW.exe
  2⤵
  PID:12892
- C:\Windows\System\QaZepWJ.exe
  C:\Windows\System\QaZepWJ.exe
  2⤵
  PID:3540
- C:\Windows\System\HmpEYMA.exe
  C:\Windows\System\HmpEYMA.exe
  2⤵
  PID:13128
- C:\Windows\System\CmjvRGX.exe
  C:\Windows\System\CmjvRGX.exe
  2⤵
  PID:12592
- C:\Windows\System\pIyndeH.exe
  C:\Windows\System\pIyndeH.exe
  2⤵
  PID:13108
- C:\Windows\System\FNtVQDU.exe
  C:\Windows\System\FNtVQDU.exe
  2⤵
  PID:13336
- C:\Windows\System\ErtACcz.exe
  C:\Windows\System\ErtACcz.exe
  2⤵
  PID:13364
- C:\Windows\System\DDXcpYb.exe
  C:\Windows\System\DDXcpYb.exe
  2⤵
  PID:13392
- C:\Windows\System\LqLqJhN.exe
  C:\Windows\System\LqLqJhN.exe
  2⤵
  PID:13408
- C:\Windows\System\LtjgOHQ.exe
  C:\Windows\System\LtjgOHQ.exe
  2⤵
  PID:13448
- C:\Windows\System\klxXVYB.exe
  C:\Windows\System\klxXVYB.exe
  2⤵
  PID:13476
- C:\Windows\System\gpiusdK.exe
  C:\Windows\System\gpiusdK.exe
  2⤵
  PID:13492
- C:\Windows\System\ecSWXLo.exe
  C:\Windows\System\ecSWXLo.exe
  2⤵
  PID:13532
- C:\Windows\System\QiFNNWL.exe
  C:\Windows\System\QiFNNWL.exe
  2⤵
  PID:13560
- C:\Windows\System\tojccMk.exe
  C:\Windows\System\tojccMk.exe
  2⤵
  PID:13588
- C:\Windows\System\UeOEnyh.exe
  C:\Windows\System\UeOEnyh.exe
  2⤵
  PID:13608
- C:\Windows\System\ZedaBYG.exe
  C:\Windows\System\ZedaBYG.exe
  2⤵
  PID:13636
- C:\Windows\System\cxvMqym.exe
  C:\Windows\System\cxvMqym.exe
  2⤵
  PID:13660
- C:\Windows\System\xzetLZv.exe
  C:\Windows\System\xzetLZv.exe
  2⤵
  PID:13700
- C:\Windows\System\VqPPGjm.exe
  C:\Windows\System\VqPPGjm.exe
  2⤵
  PID:13728
- C:\Windows\System\xMHbbVg.exe
  C:\Windows\System\xMHbbVg.exe
  2⤵
  PID:13756
- C:\Windows\System\eGruUsp.exe
  C:\Windows\System\eGruUsp.exe
  2⤵
  PID:13784
- C:\Windows\System\LxlYZIL.exe
  C:\Windows\System\LxlYZIL.exe
  2⤵
  PID:13812
- C:\Windows\System\lSDFkIL.exe
  C:\Windows\System\lSDFkIL.exe
  2⤵
  PID:13840
- C:\Windows\System\ITocjYt.exe
  C:\Windows\System\ITocjYt.exe
  2⤵
  PID:13880
- C:\Windows\System\MMpRGaf.exe
  C:\Windows\System\MMpRGaf.exe
  2⤵
  PID:13908
- C:\Windows\System\WzWclsE.exe
  C:\Windows\System\WzWclsE.exe
  2⤵
  PID:13932
- C:\Windows\System\kCZcCUV.exe
  C:\Windows\System\kCZcCUV.exe
  2⤵
  PID:13956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqswvypa.3xs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CFKYRtV.exe

Filesize
3.4MB

MD5
f2430f1d02d8ef65754c5fcccc298749

SHA1
ca4d5cf518b03642f92cd4d212b037832365fe86

SHA256
cf4b1e061f52ae8573bdbfdc93a4ad6ab8ce1936d7f902fe43707249e5cbc485

SHA512
fc0ec51de15d8e91e1013f1ea5b2c575b360057fcd761e348be3e6c979cb79d1dbbd6f744c73ab26881ad92e88f5f2a8ba9e32c45b0704c76c072ee67984e86b

Download Submit
C:\Windows\System\DonUnEP.exe

Filesize
3.4MB

MD5
62d92c6b9b1fb781016de5f259ddc2f4

SHA1
19150aaf69c425ef5d446e60cd596159080df318

SHA256
238401958cb190f4e7076e105dd397501a713431fe6a0f4c8813f38093446a37

SHA512
804f4be285c1d703056f548d4fd488cc25adeafe3137f7e63c5f2e4059f31935615b1f2fe257d0548b63a4f9f439e72130e1581947d433bbe988ecab45a26c37

Download Submit
C:\Windows\System\EvDRpxU.exe

Filesize
3.4MB

MD5
343bce1d6c30b8f1533f764ee63ba7e2

SHA1
5cc12ab811b4f727308923af0ce6d99ab57d0edc

SHA256
ce21c2a459bcdacbb14077ecd1703c26fef9aa0d72b4b30b113de23bd204d90f

SHA512
ca9781357157774552cafc2d23459aeb369bc40683a27ca44c9ce1e8d752fa8184aaa0decdfc23596330436054b729c5700ae6992bc3355e6eda9ba92dab5e0d

Download Submit
C:\Windows\System\JjuoxTO.exe

Filesize
3.4MB

MD5
e55692e11f4be9c0a3f0f123bccc9c90

SHA1
27055f66f378dad5ddc8cb58477871138bbdfe14

SHA256
2a376b3285420e2d8cbefb91a29538d3c88fe6a8e0c2bcb0714d45f4c9196a40

SHA512
83d4fadef4f60e830a1f2a140c2214c8bae7d1a4d355233fdd2a3118421c097894d3f907648d3ec79c94513252581593f1b76834ded29bc476d938b92248db18

Download Submit
C:\Windows\System\KCNdirQ.exe

Filesize
3.4MB

MD5
0a8564e46c842fdbb7ed266788f1ccc4

SHA1
343202ebd91b470b80e2dc6e3fc4b1f81e768b9f

SHA256
71f91e5b9dabfff2ae5c93b29de67074d3821da998ce54f4686c8e85980636ec

SHA512
b4bef4287378c7f0c63ffa93cb140274fff47b17e08b1398f59366102ed6becd8b840eee09474063936466ec142cebe4a1b18526765413ef59cf1fc6cc925531

Download Submit
C:\Windows\System\NDjzClh.exe

Filesize
8B

MD5
3f9cfe8a165fbe5ed357bf4fb6550d1a

SHA1
d1f76cef8b11f404ce3021901f1968e523167625

SHA256
fe7331c05f745b95f5509c04136ec2be8073cae1c2054bbe90290f3a5e3a1c01

SHA512
7c297d93de1529b68ba232f55d08c5bdfcf13a5c3741f810e605eeec9da08911d3d07e6bd5c21436fbf2be3db2070f19515d3ae2f1e7604c2ff2f34139c616ce

Download Submit
C:\Windows\System\NNTxwor.exe

Filesize
3.4MB

MD5
ba8c52816729516d4825a8edb03a86a1

SHA1
a8febf5264fc671a6604313dbb3042b34a166560

SHA256
4ac1bf7f816234195cddebeabced7daba2c81702b4e2dd966f036447309a0aad

SHA512
c857f24b68650a79391f21a1cf0a9205dd000c49de2795b9fe8070639cb1356fd58bf099c55a0a0a366c7832489d7104219b930d555b37bd7563f9c2d0b31876

Download Submit
C:\Windows\System\NOvwJYE.exe

Filesize
3.4MB

MD5
97a17a7bc3ccbf91961d878b93a3007d

SHA1
f3c880dd5a729257f131327fa146eebb9d01d79d

SHA256
2f1a558e35f406f10d89884297b1d96641e40b52dfa974f5987eac8f74783108

SHA512
85453e4ce6d4013aa08e5ad3abbd8c5c2012feb3af871e86367bbff47b71ef3075956a03b2d1745c4ae682ba10f794b4461f35b7f85a009a78dd2da897bb3a2f

Download Submit
C:\Windows\System\NiEzOvz.exe

Filesize
3.4MB

MD5
c6669864b1b56dd899246e848076c6d7

SHA1
5913fc48e4e7d0fed53ff147d6bedb2ab5bc70fb

SHA256
a9079d54123371c6b165bc446b59a3ccfc762e7409fa79d598f4d82cd341e540

SHA512
000d21ca170995db209a0049b619ddea8c5f6152e205cd6fcebe3f6f115770b8142713c6b2ac1ff6cf702ecda32a7937d686bf933509de6dbfe172fbaed10e01

Download Submit
C:\Windows\System\NwyYVfN.exe

Filesize
3.4MB

MD5
a7ff23df2198e55780ba1a99bf470b48

SHA1
ab793c1df99b64c571084906f7f73164e0a88444

SHA256
cb3974942d565713c175a1902e5e72a85764c05e391e2ac19874943c32ec7fc8

SHA512
858d0aaed1945c90a247e0da041121d6cbf7096cf08128e5d0ce81034c066edf1c19ea8fa8cf313af8a2c218d3a44ee28c76b5ea820b16e9cde89708ad9e8ea7

Download Submit
C:\Windows\System\OHHJqkK.exe

Filesize
3.4MB

MD5
67613cd62b2e68e8889090f4f7e67054

SHA1
a5a0c9453a789509b24839e41904f0b085d98ce6

SHA256
dad7e934de23d21d1b87a28b14cc93e4bdab84c33d6db167199c2a221fe2817f

SHA512
7c6eaf5bd13a601d9da39110d8e910a1e6f16ebddbd8f962532e1306daf4e212554d1303e3d071e3144b19d0f1d0c3cdcb8404058441fadf81462e772b055909

Download Submit
C:\Windows\System\PHgueDB.exe

Filesize
3.4MB

MD5
89c9a900b3c1c3d8f44d35e54dfd924c

SHA1
5bcae70efcfce6c7264237c8514a5f766f391480

SHA256
c4281e35f957274a8e26412626e98406b6cac895a360b79635263293f2a6ff13

SHA512
3ca53ab81128911b14d00507b5642817097125a3a08f6c037195e51c6d0d5ca63b3b3cbd75b3bc56e810ce52c72daab6d2b31c9d288f7a1a19a4cb88ba705609

Download Submit
C:\Windows\System\PvjTnFd.exe

Filesize
3.4MB

MD5
d57b5fcecfc876342a59372a0e28f6f0

SHA1
6db781829525a13c19811e13f43e513a88a2b520

SHA256
5f45f8f10bbbdf7ae5b22de8a1f346b3adad170cf3287f85cb8ab4edbe76e88b

SHA512
d3b564843e8fe8140b219520faea2376087832102204efa9244d796a092b69cf9ea348ad6d0c67cd4ac27ee350b3835118b0303a16222d54c6368ca422b597e0

Download Submit
C:\Windows\System\UHeGjZG.exe

Filesize
3.4MB

MD5
0c2ec55b785468c9761fbc2cb07f9b69

SHA1
d670f94ddf24301ce5a06e08eee122474c90ab34

SHA256
118e9280547276c6788865ff7c9a677e53e61816b70f8b8edf25d049d0a0016a

SHA512
984f09d2c5769c2ab388b011a996387c43e53e6b1eddbc68147be5268bfb41188d2cc552a821822076d1228fea9c35cd7507970e388227302f2c722517f8c871

Download Submit
C:\Windows\System\VnSctHo.exe

Filesize
3.4MB

MD5
af25b65914deee3f7dfbc2c125d99735

SHA1
f9717fce91f705696bac6ed9b9a9960a4a08caa0

SHA256
0a57e34bc6d726f92978b4ba217a5040e5fbb555eb87f376486e2be0d9d47247

SHA512
c10c9b3135750b8b820c069b4bee269e810fc5e6be67104776c616177763308c14940a58d8d40e47b491d8655a46ca7a126a6ef9fa1b9574a82e254c257ab0a4

Download Submit
C:\Windows\System\ZuoflgG.exe

Filesize
3.4MB

MD5
7eefcb351014f8195393eb62c5b787ea

SHA1
4982cc0704e21f7632af7ddd5e0ec79578b34d5d

SHA256
75733198062c487d73eb326532ce420238da75777586568d10582747e53e9bff

SHA512
9130e2b2e521f3b2eb8639455cd422895537929263af3f455b74b164fdd8a6815e512d6988a3d81f6ce6d839da77d8813a5d122a55e8b324ee631ede776e36a4

Download Submit
C:\Windows\System\aBNbaSS.exe

Filesize
3.4MB

MD5
04643c6cd7a5fecc9586c2256bdbad58

SHA1
9209014488e07178ec56b45effaf5baf1accf960

SHA256
1de8ffdf829fe5caaaf9390e43aceff4f687e2b12e7e9484e71def69ac6219cb

SHA512
c825a19b5673a90596c42bd01a4a8eeeefc90974506ef1fdf913bb012265e9e906cd6652cc940e26d5b236e444e7a2d6bb78bd29b2e1f91b05e2b4499c3c0ced

Download Submit
C:\Windows\System\bBxZjSO.exe

Filesize
3.4MB

MD5
3c7d40ff4b8f98797091901f212919a4

SHA1
91185618d271ee172200eb545591a966f4eab1bb

SHA256
e7a36496ff0183ed4f6b485a0213025887cf083ee85c888a098e2931688a59a2

SHA512
87412b1edcd5f539dbd64339311acb9f2d08a64840b801aa2784c4ce1074c5ab31353efbb2a5e9f03bee1044b4f340f48640bb91fab72badf57836f19027a3e6

Download Submit
C:\Windows\System\djxstRZ.exe

Filesize
3.4MB

MD5
b4b847de6348c5b2e97b009755549ac4

SHA1
54af7ed8045de0bab6f5f33a15571b64e55d0a6b

SHA256
92c3ad846974284ccd527c07bf483f96ddfc52f4c5ac6069f5246a5cab188fa8

SHA512
92a824af1399c1543e91bd34bfdb97d04094c1b5649034c7c048eed8cc2756b801cdf033f12d87d4a71da661a6bd1e0b926e335ce0c5e8596777f2f927a6d0b9

Download Submit
C:\Windows\System\eZynisU.exe

Filesize
3.4MB

MD5
4323001dda2408a5242c2c072df2c48f

SHA1
ea14a81310ddbd300b131e57b921b1dc9fc3a9ba

SHA256
a857c9a4755eeaef939fa2d33c6f6ca831ac72b00059af9f27291e823008c7ad

SHA512
14f32ff6fdb6a35ed2d8a456778efed6021906a0abb0018445bd80d7936162f00688d0ef64dab01721d96909dec9434cfe7a248a49da9797b8993f2e982dc25b

Download Submit
C:\Windows\System\fSVcWsX.exe

Filesize
3.4MB

MD5
9d8be9d42c104fd97135d1c9c0b07bf8

SHA1
212c484595484dd2566f62bb4dd3db00e4667d0e

SHA256
e151fdb961e4808488dc02a7de91650e393e8a73cecb24d945465564b77c6c3c

SHA512
9b924109ea319809f0c3e1672fc7e941499547f462d1e00b385a40ed5ad0fe6dd7be6a01241dc7e4533653b0762b7420a5187cf5c142aef20912eb5d12c9b393

Download Submit
C:\Windows\System\iDsRnuz.exe

Filesize
3.4MB

MD5
3b0a28022c29f5d0c14c79860cddcb55

SHA1
2949d3bb1fe35e4e2b9ad786cb58a91a833f28e8

SHA256
bb3948fb1f3824055e6555ed990bc72c9e9077f331dc9e08377c2265cf161be9

SHA512
cdcca69f0d6e8c74f8f5bcb4f2584906badb5158d0054eed3fb81ec9a9f192eef4d06c8d8e53af6e6204f650c3a75291f99851d14d427eca92f880ce36ef5346

Download Submit
C:\Windows\System\jiiBGWH.exe

Filesize
3.4MB

MD5
a4bbe5a2f0c42ff702801057df298d67

SHA1
dda54988b2df70ed03e88c2fa5108ccc6923f308

SHA256
aec7e23a6b8312644aea267b0bded8fa7122e808a0f37ce1293f24d9ec680c6d

SHA512
9c4411c810a5734728fba6240eac46762457ec70d3dc6f276a3b8425ea4b455e190b83537da441abc62ecc9a36cfb81130ab6683f6e2a5193c2b76da7f5e6e8f

Download Submit
C:\Windows\System\lPOrrrT.exe

Filesize
3.4MB

MD5
a167fa108d95f3d7bb8bfe6a6dcdec11

SHA1
fe51d17c2798c091c977271ddb08779c156dafb7

SHA256
c3b1f15be6f8d19e3798e55242bd0c04d84aadd3451ad13ec88ace919981abad

SHA512
267d7e8baef66f7c218e6f751b682b1c5461ec5901d12e4cfab63c1bcdf0f6d435a741af1b08cb7295b22e04bd0ee0ccf959a1116c83ef04a1664725a302077c

Download Submit
C:\Windows\System\mMnZgFg.exe

Filesize
3.4MB

MD5
e4d17f0d2fa0257d564821ea2161e1dd

SHA1
763d9cbf4ca8fe36865442788d92c57ef78fb724

SHA256
a29056a246f2eb1fb2e16ac368ea6d306f69bc1b59321a1c8a3d9d701b63da63

SHA512
6d6c16c241edb8ba79b03580a6fe808019346a2cbe822c21176f565c66a100e41d2b4768fa96900dc0f307e6307e7d14ebfa2c40bd588c45d53418898238f2cb

Download Submit
C:\Windows\System\oHlCUkC.exe

Filesize
3.4MB

MD5
42316883d4a7f7126c963e0e9f3d575f

SHA1
efa35dc12a6a2a0cba08682f00ef42bfc6008946

SHA256
2280bf5c3ae8cf71f543136b6fb4a88e044b8723606a5aa84e5a5c700dfa660e

SHA512
f4ee2a4b7e33fcc26cd8df1a814fb61c5dcb5a4843bc0ebcb2d060acc82692aca8f4d9f5adbc7252d90e3511b1d6809c6500d76c4a44f82582133334a26e5bf4

Download Submit
C:\Windows\System\paflsHi.exe

Filesize
3.4MB

MD5
9c804b8610023d4a420309e2c3d8a354

SHA1
b61f736a94a27b10dc66886226e86dd93814f517

SHA256
1b98d4a49eba172a7ff97fff202fb70f9e6b6d0bbcdf22286a6697d0d2320429

SHA512
69a860be22751c878573978328195e7d5174f868aecfc538912d7056ac31de617855393dbf76b68cd3d3a99628ae1ce2d4467c2118501bf75727d04f3ac6c237

Download Submit
C:\Windows\System\rbORfMr.exe

Filesize
3.4MB

MD5
45c742fd035b47ef8498a0f0fe0cede4

SHA1
d936936beea547947fdb443f3badc93ad3409735

SHA256
d91d6da989da627c13cdd5f3abd38774e4d988535db7dc723d46c350ffd457c3

SHA512
9dc8b6c8c99bcdc0c7cf4387672b2291f7400277f00216745c71bc76ff93c3b712ca9da26849f5bb868db101ea899bc78825ffdb59fdee5dc6c8c809ee67cfb5

Download Submit
C:\Windows\System\tHBaRwK.exe

Filesize
3.4MB

MD5
23a287984672727563d8dcc417f1d080

SHA1
95a91cc33275507c8fb86096ead94538d82a6742

SHA256
01492a908804742b6b617d79f5f0d51b056dbf63055f70b751ccf37adac98bb6

SHA512
4936e17ece765729757f526a038b3c682c81520b190fe30006a3015b51f1d986f6038b302adc8d320e3cbfbeee7f83967e8a977cb6bbd03424ef80a282103ef4

Download Submit
C:\Windows\System\toabVGp.exe

Filesize
3.4MB

MD5
b1168bc22e9fef0f47be420e070eba1d

SHA1
5840355ac1c79c6c89d929b9f99d8fc362357d6b

SHA256
86aade172c1c7d3c287da066e8892703ff5ea1239206d66333e6a7692348303e

SHA512
5ee0c99217959cdc49df0f1c91f905e24f3287a4f7f08cc2b83037eecdefc1d705b07120ed4b50a8a3d8570463e0fe731add911015e11baef3232b2b87c05403

Download Submit
C:\Windows\System\vrcsCKT.exe

Filesize
3.4MB

MD5
29326fe8a983df5980b093c343b6db84

SHA1
83ffc2bbd4102c24212895c17894991b5ec992b6

SHA256
8ee0e3d0a653228a9e940c6250816d31e3c76218780066b25f88a507c4ac30ab

SHA512
c42b4f23fc962dbc5153f15d5edd3805a0864c3459b8e82c1c3084c509e986fb41a13b214873a3607820e12220ab589531b678374bbf96e9d34398cc0bfaea10

Download Submit
C:\Windows\System\vuqthtf.exe

Filesize
3.4MB

MD5
751de735b978a755f7e1692c6d54e8d2

SHA1
259f943455e1e4fc1d5cac2d68729907bb0c111b

SHA256
f28d072e3458513c9feda639abdb4d427a63963bb0a162bba6325ea86df24561

SHA512
0211193c74912d88721a908419573ac41b1d39b3a6282383d90def218bde53c8197a6469bcc798e271662e215131d13357df2edb1177758a82e028520fcf025d

Download Submit
C:\Windows\System\zhsvBaP.exe

Filesize
3.4MB

MD5
71a1c5182fc8056dcb3799b380899f60

SHA1
413ea3f8778dae53a9932c7c0c75328b30ed16d3

SHA256
620eb3fbbc885aaac515bfee997407eef412ec73c0b1e006e032c5b59e34da04

SHA512
b07d2208430c6128d5aeeef4ee9921177f9e4061b6dde098160484571f1d08191f4f0490ca3a7177b4549ae00d781d006f72b4e730a7cb47d7a3263a6d10dbcd

Download Submit
memory/8-2062-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp

Filesize
4.0MB

Download
memory/8-136-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp

Filesize
4.0MB

Download
memory/8-2169-0x00007FF6E8880000-0x00007FF6E8C76000-memory.dmp

Filesize
4.0MB

Download
memory/860-124-0x00000299467A0000-0x00000299469BC000-memory.dmp

Filesize
2.1MB

Download
memory/860-73-0x0000029946B20000-0x0000029946B42000-memory.dmp

Filesize
136KB

Download
memory/860-77-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/860-1080-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/860-30-0x00007FF9EC4E3000-0x00007FF9EC4E5000-memory.dmp

Filesize
8KB

Download
memory/860-816-0x00007FF9EC4E3000-0x00007FF9EC4E5000-memory.dmp

Filesize
8KB

Download
memory/860-129-0x0000029947770000-0x0000029947F16000-memory.dmp

Filesize
7.6MB

Download
memory/860-78-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/860-2165-0x00007FF9EC4E0000-0x00007FF9ECFA1000-memory.dmp

Filesize
10.8MB

Download
memory/1016-2156-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp

Filesize
4.0MB

Download
memory/1016-74-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp

Filesize
4.0MB

Download
memory/1016-826-0x00007FF77CE90000-0x00007FF77D286000-memory.dmp

Filesize
4.0MB

Download
memory/1060-2154-0x00007FF7EC540000-0x00007FF7EC936000-memory.dmp

Filesize
4.0MB

Download
memory/1060-80-0x00007FF7EC540000-0x00007FF7EC936000-memory.dmp

Filesize
4.0MB

Download
memory/1588-2146-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp

Filesize
4.0MB

Download
memory/1588-26-0x00007FF6CF840000-0x00007FF6CFC36000-memory.dmp

Filesize
4.0MB

Download
memory/1728-552-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp

Filesize
4.0MB

Download
memory/1728-2150-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp

Filesize
4.0MB

Download
memory/1728-60-0x00007FF6CEAA0000-0x00007FF6CEE96000-memory.dmp

Filesize
4.0MB

Download
memory/1928-35-0x00007FF7B6840000-0x00007FF7B6C36000-memory.dmp

Filesize
4.0MB

Download
memory/1928-2148-0x00007FF7B6840000-0x00007FF7B6C36000-memory.dmp

Filesize
4.0MB

Download
memory/2064-2172-0x00007FF63C150000-0x00007FF63C546000-memory.dmp

Filesize
4.0MB

Download
memory/2064-546-0x00007FF63C150000-0x00007FF63C546000-memory.dmp

Filesize
4.0MB

Download
memory/2160-68-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp

Filesize
4.0MB

Download
memory/2160-2153-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp

Filesize
4.0MB

Download
memory/2160-824-0x00007FF7CB4F0000-0x00007FF7CB8E6000-memory.dmp

Filesize
4.0MB

Download
memory/2472-115-0x00007FF6A0130000-0x00007FF6A0526000-memory.dmp

Filesize
4.0MB

Download
memory/2472-2166-0x00007FF6A0130000-0x00007FF6A0526000-memory.dmp

Filesize
4.0MB

Download
memory/2572-133-0x00007FF76DDB0000-0x00007FF76E1A6000-memory.dmp

Filesize
4.0MB

Download
memory/2572-2168-0x00007FF76DDB0000-0x00007FF76E1A6000-memory.dmp

Filesize
4.0MB

Download
memory/2572-2145-0x00007FF76DDB0000-0x00007FF76E1A6000-memory.dmp

Filesize
4.0MB

Download
memory/2656-111-0x00007FF638900000-0x00007FF638CF6000-memory.dmp

Filesize
4.0MB

Download
memory/2656-2160-0x00007FF638900000-0x00007FF638CF6000-memory.dmp

Filesize
4.0MB

Download
memory/2856-2171-0x00007FF6EB120000-0x00007FF6EB516000-memory.dmp

Filesize
4.0MB

Download
memory/2856-556-0x00007FF6EB120000-0x00007FF6EB516000-memory.dmp

Filesize
4.0MB

Download
memory/3028-31-0x00007FF643030000-0x00007FF643426000-memory.dmp

Filesize
4.0MB

Download
memory/3028-2149-0x00007FF643030000-0x00007FF643426000-memory.dmp

Filesize
4.0MB

Download
memory/3384-81-0x00007FF681470000-0x00007FF681866000-memory.dmp

Filesize
4.0MB

Download
memory/3384-2155-0x00007FF681470000-0x00007FF681866000-memory.dmp

Filesize
4.0MB

Download
memory/3568-2173-0x00007FF78EEF0000-0x00007FF78F2E6000-memory.dmp

Filesize
4.0MB

Download
memory/3568-559-0x00007FF78EEF0000-0x00007FF78F2E6000-memory.dmp

Filesize
4.0MB

Download
memory/3936-2170-0x00007FF69FDB0000-0x00007FF6A01A6000-memory.dmp

Filesize
4.0MB

Download
memory/3936-142-0x00007FF69FDB0000-0x00007FF6A01A6000-memory.dmp

Filesize
4.0MB

Download
memory/3952-8-0x00007FF712D20000-0x00007FF713116000-memory.dmp

Filesize
4.0MB

Download
memory/3952-2147-0x00007FF712D20000-0x00007FF713116000-memory.dmp

Filesize
4.0MB

Download
memory/3952-148-0x00007FF712D20000-0x00007FF713116000-memory.dmp

Filesize
4.0MB

Download
memory/4100-0-0x00007FF713BF0000-0x00007FF713FE6000-memory.dmp

Filesize
4.0MB

Download
memory/4100-147-0x00007FF713BF0000-0x00007FF713FE6000-memory.dmp

Filesize
4.0MB

Download
memory/4100-1-0x000001D06D7C0000-0x000001D06D7D0000-memory.dmp

Filesize
64KB

Download
memory/4268-2174-0x00007FF6DDB10000-0x00007FF6DDF06000-memory.dmp

Filesize
4.0MB

Download
memory/4268-540-0x00007FF6DDB10000-0x00007FF6DDF06000-memory.dmp

Filesize
4.0MB

Download
memory/4452-1891-0x00007FF634D70000-0x00007FF635166000-memory.dmp

Filesize
4.0MB

Download
memory/4452-2167-0x00007FF634D70000-0x00007FF635166000-memory.dmp

Filesize
4.0MB

Download
memory/4452-112-0x00007FF634D70000-0x00007FF635166000-memory.dmp

Filesize
4.0MB

Download
memory/4608-2158-0x00007FF7C1670000-0x00007FF7C1A66000-memory.dmp

Filesize
4.0MB

Download
memory/4608-98-0x00007FF7C1670000-0x00007FF7C1A66000-memory.dmp

Filesize
4.0MB

Download
memory/4640-2152-0x00007FF6F1210000-0x00007FF6F1606000-memory.dmp

Filesize
4.0MB

Download
memory/4640-63-0x00007FF6F1210000-0x00007FF6F1606000-memory.dmp

Filesize
4.0MB

Download
memory/4716-93-0x00007FF688D20000-0x00007FF689116000-memory.dmp

Filesize
4.0MB

Download
memory/4716-2157-0x00007FF688D20000-0x00007FF689116000-memory.dmp

Filesize
4.0MB

Download
memory/4976-79-0x00007FF71CF10000-0x00007FF71D306000-memory.dmp

Filesize
4.0MB

Download
memory/4976-2151-0x00007FF71CF10000-0x00007FF71D306000-memory.dmp

Filesize
4.0MB

Download
memory/5012-2159-0x00007FF6943C0000-0x00007FF6947B6000-memory.dmp

Filesize
4.0MB

Download
memory/5012-99-0x00007FF6943C0000-0x00007FF6947B6000-memory.dmp

Filesize
4.0MB

Download