xmrig | 62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774

Analysis

max time kernel
91s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2024 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
Size

2.7MB
MD5

190b320811bf07e08c63691b0d9efba2
SHA1

e051fabb5ca2137dc4027da677452f411e83669f
SHA256

62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774
SHA512

45b65d81083d7f9add115acf84cca913d665a839e66692169d1e52c3a4f5be6dd6b8b201e065a89fd9d00023dbb768584f6a3da83f6f6088e6a72afb6f779900
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5O2:NABD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1740-214-0x00007FF704CE0000-0x00007FF7050D2000-memory.dmp	xmrig
behavioral2/memory/1224-246-0x00007FF7B9550000-0x00007FF7B9942000-memory.dmp	xmrig
behavioral2/memory/2596-262-0x00007FF7695C0000-0x00007FF7699B2000-memory.dmp	xmrig
behavioral2/memory/4888-261-0x00007FF7351B0000-0x00007FF7355A2000-memory.dmp	xmrig
behavioral2/memory/2748-289-0x00007FF727C10000-0x00007FF728002000-memory.dmp	xmrig
behavioral2/memory/736-294-0x00007FF656A20000-0x00007FF656E12000-memory.dmp	xmrig
behavioral2/memory/2256-288-0x00007FF7ABBF0000-0x00007FF7ABFE2000-memory.dmp	xmrig
behavioral2/memory/4628-287-0x00007FF698400000-0x00007FF6987F2000-memory.dmp	xmrig
behavioral2/memory/116-286-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp	xmrig
behavioral2/memory/3532-271-0x00007FF7B9AE0000-0x00007FF7B9ED2000-memory.dmp	xmrig
behavioral2/memory/5012-256-0x00007FF6A16E0000-0x00007FF6A1AD2000-memory.dmp	xmrig
behavioral2/memory/3696-255-0x00007FF7D79F0000-0x00007FF7D7DE2000-memory.dmp	xmrig
behavioral2/memory/2020-217-0x00007FF68A100000-0x00007FF68A4F2000-memory.dmp	xmrig
behavioral2/memory/1084-169-0x00007FF738000000-0x00007FF7383F2000-memory.dmp	xmrig
behavioral2/memory/5068-143-0x00007FF66CC90000-0x00007FF66D082000-memory.dmp	xmrig
behavioral2/memory/2844-141-0x00007FF737B80000-0x00007FF737F72000-memory.dmp	xmrig
behavioral2/memory/768-12-0x00007FF791A10000-0x00007FF791E02000-memory.dmp	xmrig
behavioral2/memory/3016-2709-0x00007FF741560000-0x00007FF741952000-memory.dmp	xmrig
behavioral2/memory/4328-2710-0x00007FF78EF70000-0x00007FF78F362000-memory.dmp	xmrig
behavioral2/memory/1176-2711-0x00007FF629F40000-0x00007FF62A332000-memory.dmp	xmrig
behavioral2/memory/1300-2712-0x00007FF6D7680000-0x00007FF6D7A72000-memory.dmp	xmrig
behavioral2/memory/4740-2713-0x00007FF6E7930000-0x00007FF6E7D22000-memory.dmp	xmrig
behavioral2/memory/768-2715-0x00007FF791A10000-0x00007FF791E02000-memory.dmp	xmrig
behavioral2/memory/3476-2751-0x00007FF7D70C0000-0x00007FF7D74B2000-memory.dmp	xmrig
behavioral2/memory/4328-2753-0x00007FF78EF70000-0x00007FF78F362000-memory.dmp	xmrig
behavioral2/memory/3016-2759-0x00007FF741560000-0x00007FF741952000-memory.dmp	xmrig
behavioral2/memory/3556-2757-0x00007FF6593A0000-0x00007FF659792000-memory.dmp	xmrig
behavioral2/memory/3532-2772-0x00007FF7B9AE0000-0x00007FF7B9ED2000-memory.dmp	xmrig
behavioral2/memory/2256-2777-0x00007FF7ABBF0000-0x00007FF7ABFE2000-memory.dmp	xmrig
behavioral2/memory/2844-2781-0x00007FF737B80000-0x00007FF737F72000-memory.dmp	xmrig
behavioral2/memory/3476-2783-0x00007FF7D70C0000-0x00007FF7D74B2000-memory.dmp	xmrig
behavioral2/memory/5068-2779-0x00007FF66CC90000-0x00007FF66D082000-memory.dmp	xmrig
behavioral2/memory/1176-2761-0x00007FF629F40000-0x00007FF62A332000-memory.dmp	xmrig
behavioral2/memory/4628-2825-0x00007FF698400000-0x00007FF6987F2000-memory.dmp	xmrig
behavioral2/memory/1300-2816-0x00007FF6D7680000-0x00007FF6D7A72000-memory.dmp	xmrig
behavioral2/memory/3696-2814-0x00007FF7D79F0000-0x00007FF7D7DE2000-memory.dmp	xmrig
behavioral2/memory/1224-2812-0x00007FF7B9550000-0x00007FF7B9942000-memory.dmp	xmrig
behavioral2/memory/1084-2808-0x00007FF738000000-0x00007FF7383F2000-memory.dmp	xmrig
behavioral2/memory/1740-2803-0x00007FF704CE0000-0x00007FF7050D2000-memory.dmp	xmrig
behavioral2/memory/2020-2801-0x00007FF68A100000-0x00007FF68A4F2000-memory.dmp	xmrig
behavioral2/memory/2596-2796-0x00007FF7695C0000-0x00007FF7699B2000-memory.dmp	xmrig
behavioral2/memory/3556-2792-0x00007FF6593A0000-0x00007FF659792000-memory.dmp	xmrig
behavioral2/memory/116-2788-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp	xmrig
behavioral2/memory/4740-2787-0x00007FF6E7930000-0x00007FF6E7D22000-memory.dmp	xmrig
behavioral2/memory/4888-2818-0x00007FF7351B0000-0x00007FF7355A2000-memory.dmp	xmrig
behavioral2/memory/2748-2807-0x00007FF727C10000-0x00007FF728002000-memory.dmp	xmrig
behavioral2/memory/5012-2799-0x00007FF6A16E0000-0x00007FF6A1AD2000-memory.dmp	xmrig
behavioral2/memory/736-2794-0x00007FF656A20000-0x00007FF656E12000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1184	powershell.exe
5	1184	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1184	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
768	MqycpDL.exe
3016	tGYcoDJ.exe
4328	aAGGzCF.exe
3532	rlfGcNW.exe
1176	viCldVp.exe
116	ZYnHdtr.exe
3476	atftYqY.exe
4628	EUoJrkZ.exe
1300	ZIttOFD.exe
4740	fzeIbdC.exe
2844	MznFsqs.exe
5068	kQIZPoA.exe
2256	PvJizwY.exe
2748	quqOHsi.exe
1084	uljpNzF.exe
3556	VlfxCJI.exe
736	XabhxEz.exe
1740	gMFXZod.exe
2020	QXkITvf.exe
1224	CZRTrLm.exe
3696	nhmsEqy.exe
5012	RqfbqAL.exe
4888	dtrTUpu.exe
2596	EBoOtBB.exe
4928	uLwPbjV.exe
3216	usWssaD.exe
1908	swMjdpq.exe
3608	vNUEglp.exe
696	yAoLgVJ.exe
3736	xwSAZyY.exe
4076	ZzJagYD.exe
3292	npLDOtg.exe
2852	HKetNrN.exe
3452	OVuLISQ.exe
2780	qRUYESL.exe
1280	JbhAyOa.exe
4672	BxoyUIq.exe
3744	ORzMyWY.exe
3712	zQlvemk.exe
1532	ZBAkqXS.exe
4852	YJmKZXJ.exe
3984	AYRPCgp.exe
1568	dGXcFFU.exe
4748	CcsyFbG.exe
224	aTKMouw.exe
3972	JeqTIyZ.exe
4828	UCvvAUB.exe
3052	tIxezFj.exe
1756	vrsvhnn.exe
4308	ncozokn.exe
1840	xXAXlmO.exe
4440	rQbxBJv.exe
4416	ZbSxZKo.exe
3448	nQTcRhH.exe
3352	TBlbLDD.exe
2044	OLQRmCd.exe
2128	MBzTmim.exe
3440	AgPHaaS.exe
812	MQSTVpU.exe
3828	bHOzAdY.exe
1996	nKfQmtM.exe
4800	XSsfZqm.exe
4784	MpNLzbW.exe
4912	rAwkjXT.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4040-0-0x00007FF623DB0000-0x00007FF6241A2000-memory.dmp	upx
behavioral2/files/0x0007000000023500-9.dat	upx
behavioral2/files/0x00080000000234ff-16.dat	upx
behavioral2/memory/4328-27-0x00007FF78EF70000-0x00007FF78F362000-memory.dmp	upx
behavioral2/files/0x0007000000023504-35.dat	upx
behavioral2/files/0x0007000000023509-51.dat	upx
behavioral2/files/0x0007000000023508-81.dat	upx
behavioral2/files/0x0007000000023513-115.dat	upx
behavioral2/files/0x0007000000023512-154.dat	upx
behavioral2/files/0x000700000002351e-182.dat	upx
behavioral2/memory/1740-214-0x00007FF704CE0000-0x00007FF7050D2000-memory.dmp	upx
behavioral2/memory/1224-246-0x00007FF7B9550000-0x00007FF7B9942000-memory.dmp	upx
behavioral2/memory/2596-262-0x00007FF7695C0000-0x00007FF7699B2000-memory.dmp	upx
behavioral2/memory/4888-261-0x00007FF7351B0000-0x00007FF7355A2000-memory.dmp	upx
behavioral2/memory/2748-289-0x00007FF727C10000-0x00007FF728002000-memory.dmp	upx
behavioral2/memory/736-294-0x00007FF656A20000-0x00007FF656E12000-memory.dmp	upx
behavioral2/memory/2256-288-0x00007FF7ABBF0000-0x00007FF7ABFE2000-memory.dmp	upx
behavioral2/memory/4628-287-0x00007FF698400000-0x00007FF6987F2000-memory.dmp	upx
behavioral2/memory/116-286-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp	upx
behavioral2/memory/3532-271-0x00007FF7B9AE0000-0x00007FF7B9ED2000-memory.dmp	upx
behavioral2/memory/5012-256-0x00007FF6A16E0000-0x00007FF6A1AD2000-memory.dmp	upx
behavioral2/memory/3696-255-0x00007FF7D79F0000-0x00007FF7D7DE2000-memory.dmp	upx
behavioral2/memory/2020-217-0x00007FF68A100000-0x00007FF68A4F2000-memory.dmp	upx
behavioral2/memory/3556-187-0x00007FF6593A0000-0x00007FF659792000-memory.dmp	upx
behavioral2/files/0x0007000000023525-186.dat	upx
behavioral2/files/0x0007000000023514-184.dat	upx
behavioral2/files/0x0007000000023524-181.dat	upx
behavioral2/files/0x000700000002351a-180.dat	upx
behavioral2/files/0x0007000000023510-176.dat	upx
behavioral2/files/0x0007000000023523-171.dat	upx
behavioral2/memory/1084-169-0x00007FF738000000-0x00007FF7383F2000-memory.dmp	upx
behavioral2/files/0x0007000000023519-168.dat	upx
behavioral2/files/0x0007000000023522-167.dat	upx
behavioral2/files/0x000700000002350b-164.dat	upx
behavioral2/files/0x0007000000023520-163.dat	upx
behavioral2/files/0x000700000002351f-162.dat	upx
behavioral2/files/0x000700000002350e-161.dat	upx
behavioral2/files/0x000700000002350d-156.dat	upx
behavioral2/files/0x000700000002351d-153.dat	upx
behavioral2/files/0x000700000002351c-152.dat	upx
behavioral2/files/0x0007000000023511-149.dat	upx
behavioral2/files/0x000700000002350c-174.dat	upx
behavioral2/memory/5068-143-0x00007FF66CC90000-0x00007FF66D082000-memory.dmp	upx
behavioral2/memory/2844-141-0x00007FF737B80000-0x00007FF737F72000-memory.dmp	upx
behavioral2/files/0x0007000000023518-135.dat	upx
behavioral2/files/0x0007000000023517-134.dat	upx
behavioral2/files/0x0007000000023516-126.dat	upx
behavioral2/files/0x0007000000023505-109.dat	upx
behavioral2/files/0x000700000002351b-148.dat	upx
behavioral2/memory/4740-96-0x00007FF6E7930000-0x00007FF6E7D22000-memory.dmp	upx
behavioral2/files/0x0007000000023515-125.dat	upx
behavioral2/files/0x0007000000023507-76.dat	upx
behavioral2/files/0x000700000002350f-101.dat	upx
behavioral2/files/0x0007000000023506-68.dat	upx
behavioral2/memory/1300-65-0x00007FF6D7680000-0x00007FF6D7A72000-memory.dmp	upx
behavioral2/files/0x0007000000023503-61.dat	upx
behavioral2/files/0x000700000002350a-70.dat	upx
behavioral2/memory/3476-52-0x00007FF7D70C0000-0x00007FF7D74B2000-memory.dmp	upx
behavioral2/files/0x0007000000023501-55.dat	upx
behavioral2/memory/1176-46-0x00007FF629F40000-0x00007FF62A332000-memory.dmp	upx
behavioral2/files/0x0007000000023502-31.dat	upx
behavioral2/memory/3016-21-0x00007FF741560000-0x00007FF741952000-memory.dmp	upx
behavioral2/memory/768-12-0x00007FF791A10000-0x00007FF791E02000-memory.dmp	upx
behavioral2/files/0x00080000000234fc-6.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RkUAMsl.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\dSEqsvt.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\sfsVcna.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\fzeIbdC.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\nIPHXMg.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\RcbfPiP.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\XecZkcG.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\hWMEYcw.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\OVuLISQ.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\iJbTSiH.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\fetmmaS.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\WnGAWxM.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\KIUsWbU.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\fbBmgxm.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\dHTQOPX.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\WPVMSek.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\ZFPPXgL.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\tUryKlb.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\gQqlAMI.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\BJnDgFb.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\xayHMlJ.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\KweTOoq.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\CZRTrLm.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\uuQqVFF.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\pvvMpDR.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\lXvRfGk.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\yNiVwvL.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\ZYOGSXU.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\RpQagtM.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\aVctLsw.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\rsvcHJo.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\XzbJONP.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\NmlrSmx.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\UBoZdOv.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\zJziUdY.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\vWiKDVK.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\IdBUvLz.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\JDpybxn.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\LhRulhd.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\NtNvkcl.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\KcuKYYb.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\OLpUcRV.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\QipYRqR.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\ZJJxsYw.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\tTlmjcq.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\gLwvYln.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\JlTJLlU.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\LDVtjnC.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\LiiTipt.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\wfPfwBJ.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\EsfGfyf.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\VAqXsQX.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\jKlnShD.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\CeccETo.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\CkhDvyn.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\DeKSQZC.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\jOzpXuv.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\FYcJxQn.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\DUfyrJA.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\RAmhYkq.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\fEWedYa.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\zHJioGU.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\SFfSQdF.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
File created	C:\Windows\System\hENixyD.exe	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1184	powershell.exe
1184	powershell.exe
1184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
Token: SeLockMemoryPrivilege	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
Token: SeDebugPrivilege	1184	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 1184	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	86
PID 4040 wrote to memory of 1184	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	86
PID 4040 wrote to memory of 768	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	87
PID 4040 wrote to memory of 768	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	87
PID 4040 wrote to memory of 4328	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	88
PID 4040 wrote to memory of 4328	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	88
PID 4040 wrote to memory of 3016	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	89
PID 4040 wrote to memory of 3016	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	89
PID 4040 wrote to memory of 3532	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	90
PID 4040 wrote to memory of 3532	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	90
PID 4040 wrote to memory of 1176	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	91
PID 4040 wrote to memory of 1176	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	91
PID 4040 wrote to memory of 116	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	92
PID 4040 wrote to memory of 116	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	92
PID 4040 wrote to memory of 3476	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	93
PID 4040 wrote to memory of 3476	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	93
PID 4040 wrote to memory of 4628	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	94
PID 4040 wrote to memory of 4628	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	94
PID 4040 wrote to memory of 1300	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	95
PID 4040 wrote to memory of 1300	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	95
PID 4040 wrote to memory of 4740	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	96
PID 4040 wrote to memory of 4740	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	96
PID 4040 wrote to memory of 2844	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	97
PID 4040 wrote to memory of 2844	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	97
PID 4040 wrote to memory of 5068	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	98
PID 4040 wrote to memory of 5068	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	98
PID 4040 wrote to memory of 2256	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	99
PID 4040 wrote to memory of 2256	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	99
PID 4040 wrote to memory of 2748	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	100
PID 4040 wrote to memory of 2748	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	100
PID 4040 wrote to memory of 1740	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	101
PID 4040 wrote to memory of 1740	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	101
PID 4040 wrote to memory of 1084	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	102
PID 4040 wrote to memory of 1084	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	102
PID 4040 wrote to memory of 3556	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	103
PID 4040 wrote to memory of 3556	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	103
PID 4040 wrote to memory of 736	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	104
PID 4040 wrote to memory of 736	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	104
PID 4040 wrote to memory of 2020	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	105
PID 4040 wrote to memory of 2020	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	105
PID 4040 wrote to memory of 696	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	106
PID 4040 wrote to memory of 696	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	106
PID 4040 wrote to memory of 1224	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	107
PID 4040 wrote to memory of 1224	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	107
PID 4040 wrote to memory of 3696	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	108
PID 4040 wrote to memory of 3696	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	108
PID 4040 wrote to memory of 5012	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	109
PID 4040 wrote to memory of 5012	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	109
PID 4040 wrote to memory of 4888	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	110
PID 4040 wrote to memory of 4888	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	110
PID 4040 wrote to memory of 2596	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	111
PID 4040 wrote to memory of 2596	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	111
PID 4040 wrote to memory of 4928	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	112
PID 4040 wrote to memory of 4928	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	112
PID 4040 wrote to memory of 3216	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	113
PID 4040 wrote to memory of 3216	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	113
PID 4040 wrote to memory of 1908	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	114
PID 4040 wrote to memory of 1908	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	114
PID 4040 wrote to memory of 4672	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	116
PID 4040 wrote to memory of 4672	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	116
PID 4040 wrote to memory of 3608	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	117
PID 4040 wrote to memory of 3608	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	117
PID 4040 wrote to memory of 3736	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	118
PID 4040 wrote to memory of 3736	4040	62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe	118

C:\Users\Admin\AppData\Local\Temp\62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe
"C:\Users\Admin\AppData\Local\Temp\62132844dcf5ac32e3265849eb498d4e43fdb3662a18b1731f1389afee186774.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1184" "2920" "2852" "2924" "0" "0" "2928" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12352
- C:\Windows\System\MqycpDL.exe
  C:\Windows\System\MqycpDL.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\aAGGzCF.exe
  C:\Windows\System\aAGGzCF.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\tGYcoDJ.exe
  C:\Windows\System\tGYcoDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\rlfGcNW.exe
  C:\Windows\System\rlfGcNW.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\viCldVp.exe
  C:\Windows\System\viCldVp.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\ZYnHdtr.exe
  C:\Windows\System\ZYnHdtr.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\atftYqY.exe
  C:\Windows\System\atftYqY.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\EUoJrkZ.exe
  C:\Windows\System\EUoJrkZ.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\ZIttOFD.exe
  C:\Windows\System\ZIttOFD.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\fzeIbdC.exe
  C:\Windows\System\fzeIbdC.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\MznFsqs.exe
  C:\Windows\System\MznFsqs.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\kQIZPoA.exe
  C:\Windows\System\kQIZPoA.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\PvJizwY.exe
  C:\Windows\System\PvJizwY.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\quqOHsi.exe
  C:\Windows\System\quqOHsi.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\gMFXZod.exe
  C:\Windows\System\gMFXZod.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\uljpNzF.exe
  C:\Windows\System\uljpNzF.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\VlfxCJI.exe
  C:\Windows\System\VlfxCJI.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\XabhxEz.exe
  C:\Windows\System\XabhxEz.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\QXkITvf.exe
  C:\Windows\System\QXkITvf.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\yAoLgVJ.exe
  C:\Windows\System\yAoLgVJ.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\CZRTrLm.exe
  C:\Windows\System\CZRTrLm.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\nhmsEqy.exe
  C:\Windows\System\nhmsEqy.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\RqfbqAL.exe
  C:\Windows\System\RqfbqAL.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\dtrTUpu.exe
  C:\Windows\System\dtrTUpu.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\EBoOtBB.exe
  C:\Windows\System\EBoOtBB.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uLwPbjV.exe
  C:\Windows\System\uLwPbjV.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\usWssaD.exe
  C:\Windows\System\usWssaD.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\swMjdpq.exe
  C:\Windows\System\swMjdpq.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\BxoyUIq.exe
  C:\Windows\System\BxoyUIq.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\vNUEglp.exe
  C:\Windows\System\vNUEglp.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\xwSAZyY.exe
  C:\Windows\System\xwSAZyY.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\ZzJagYD.exe
  C:\Windows\System\ZzJagYD.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\npLDOtg.exe
  C:\Windows\System\npLDOtg.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\HKetNrN.exe
  C:\Windows\System\HKetNrN.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\OVuLISQ.exe
  C:\Windows\System\OVuLISQ.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\ZBAkqXS.exe
  C:\Windows\System\ZBAkqXS.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\YJmKZXJ.exe
  C:\Windows\System\YJmKZXJ.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\qRUYESL.exe
  C:\Windows\System\qRUYESL.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JbhAyOa.exe
  C:\Windows\System\JbhAyOa.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\ORzMyWY.exe
  C:\Windows\System\ORzMyWY.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\zQlvemk.exe
  C:\Windows\System\zQlvemk.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\AYRPCgp.exe
  C:\Windows\System\AYRPCgp.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\dGXcFFU.exe
  C:\Windows\System\dGXcFFU.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\CcsyFbG.exe
  C:\Windows\System\CcsyFbG.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\aTKMouw.exe
  C:\Windows\System\aTKMouw.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\JeqTIyZ.exe
  C:\Windows\System\JeqTIyZ.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\UCvvAUB.exe
  C:\Windows\System\UCvvAUB.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\tIxezFj.exe
  C:\Windows\System\tIxezFj.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\vrsvhnn.exe
  C:\Windows\System\vrsvhnn.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\ncozokn.exe
  C:\Windows\System\ncozokn.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\xXAXlmO.exe
  C:\Windows\System\xXAXlmO.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\rQbxBJv.exe
  C:\Windows\System\rQbxBJv.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\ZbSxZKo.exe
  C:\Windows\System\ZbSxZKo.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\nQTcRhH.exe
  C:\Windows\System\nQTcRhH.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\TBlbLDD.exe
  C:\Windows\System\TBlbLDD.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\OLQRmCd.exe
  C:\Windows\System\OLQRmCd.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\MBzTmim.exe
  C:\Windows\System\MBzTmim.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\AgPHaaS.exe
  C:\Windows\System\AgPHaaS.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\MQSTVpU.exe
  C:\Windows\System\MQSTVpU.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\bHOzAdY.exe
  C:\Windows\System\bHOzAdY.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\nKfQmtM.exe
  C:\Windows\System\nKfQmtM.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\XSsfZqm.exe
  C:\Windows\System\XSsfZqm.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\MpNLzbW.exe
  C:\Windows\System\MpNLzbW.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\rAwkjXT.exe
  C:\Windows\System\rAwkjXT.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\BCRMMFZ.exe
  C:\Windows\System\BCRMMFZ.exe
  2⤵
  PID:4592
- C:\Windows\System\HCBbXDt.exe
  C:\Windows\System\HCBbXDt.exe
  2⤵
  PID:4524
- C:\Windows\System\luPBPIV.exe
  C:\Windows\System\luPBPIV.exe
  2⤵
  PID:3904
- C:\Windows\System\KAQZOoe.exe
  C:\Windows\System\KAQZOoe.exe
  2⤵
  PID:5076
- C:\Windows\System\uOJqdzT.exe
  C:\Windows\System\uOJqdzT.exe
  2⤵
  PID:5276
- C:\Windows\System\msHENKy.exe
  C:\Windows\System\msHENKy.exe
  2⤵
  PID:5292
- C:\Windows\System\RDrxdfw.exe
  C:\Windows\System\RDrxdfw.exe
  2⤵
  PID:5308
- C:\Windows\System\BncFEdk.exe
  C:\Windows\System\BncFEdk.exe
  2⤵
  PID:5324
- C:\Windows\System\GMfNkWK.exe
  C:\Windows\System\GMfNkWK.exe
  2⤵
  PID:5340
- C:\Windows\System\AUJopjw.exe
  C:\Windows\System\AUJopjw.exe
  2⤵
  PID:5356
- C:\Windows\System\HOSuZWm.exe
  C:\Windows\System\HOSuZWm.exe
  2⤵
  PID:5372
- C:\Windows\System\GkcFcPD.exe
  C:\Windows\System\GkcFcPD.exe
  2⤵
  PID:5388
- C:\Windows\System\QOffsje.exe
  C:\Windows\System\QOffsje.exe
  2⤵
  PID:5404
- C:\Windows\System\FZdBZPI.exe
  C:\Windows\System\FZdBZPI.exe
  2⤵
  PID:5420
- C:\Windows\System\tslwDpj.exe
  C:\Windows\System\tslwDpj.exe
  2⤵
  PID:5436
- C:\Windows\System\bucHiAo.exe
  C:\Windows\System\bucHiAo.exe
  2⤵
  PID:5452
- C:\Windows\System\yZASAqA.exe
  C:\Windows\System\yZASAqA.exe
  2⤵
  PID:5468
- C:\Windows\System\bvevmBP.exe
  C:\Windows\System\bvevmBP.exe
  2⤵
  PID:5484
- C:\Windows\System\BzrDFmp.exe
  C:\Windows\System\BzrDFmp.exe
  2⤵
  PID:5500
- C:\Windows\System\SHhBzhw.exe
  C:\Windows\System\SHhBzhw.exe
  2⤵
  PID:5604
- C:\Windows\System\DMZwMci.exe
  C:\Windows\System\DMZwMci.exe
  2⤵
  PID:5628
- C:\Windows\System\kkMhDIa.exe
  C:\Windows\System\kkMhDIa.exe
  2⤵
  PID:5648
- C:\Windows\System\JouMepF.exe
  C:\Windows\System\JouMepF.exe
  2⤵
  PID:5684
- C:\Windows\System\pwozjOF.exe
  C:\Windows\System\pwozjOF.exe
  2⤵
  PID:5700
- C:\Windows\System\KaWnfyC.exe
  C:\Windows\System\KaWnfyC.exe
  2⤵
  PID:5936
- C:\Windows\System\PYtpUyY.exe
  C:\Windows\System\PYtpUyY.exe
  2⤵
  PID:5960
- C:\Windows\System\EPDzAnh.exe
  C:\Windows\System\EPDzAnh.exe
  2⤵
  PID:5976
- C:\Windows\System\TBzUecr.exe
  C:\Windows\System\TBzUecr.exe
  2⤵
  PID:5996
- C:\Windows\System\sYfgKAT.exe
  C:\Windows\System\sYfgKAT.exe
  2⤵
  PID:6016
- C:\Windows\System\YYpduYW.exe
  C:\Windows\System\YYpduYW.exe
  2⤵
  PID:6036
- C:\Windows\System\CzJlKbL.exe
  C:\Windows\System\CzJlKbL.exe
  2⤵
  PID:6064
- C:\Windows\System\xmioekU.exe
  C:\Windows\System\xmioekU.exe
  2⤵
  PID:6088
- C:\Windows\System\aGZGsUP.exe
  C:\Windows\System\aGZGsUP.exe
  2⤵
  PID:6112
- C:\Windows\System\IBYySmK.exe
  C:\Windows\System\IBYySmK.exe
  2⤵
  PID:6132
- C:\Windows\System\pFxDfyp.exe
  C:\Windows\System\pFxDfyp.exe
  2⤵
  PID:4432
- C:\Windows\System\CEceQXV.exe
  C:\Windows\System\CEceQXV.exe
  2⤵
  PID:3116
- C:\Windows\System\tRjxIGm.exe
  C:\Windows\System\tRjxIGm.exe
  2⤵
  PID:4892
- C:\Windows\System\xZroMlW.exe
  C:\Windows\System\xZroMlW.exe
  2⤵
  PID:3108
- C:\Windows\System\gvhUsZw.exe
  C:\Windows\System\gvhUsZw.exe
  2⤵
  PID:5136
- C:\Windows\System\Ltmvwhp.exe
  C:\Windows\System\Ltmvwhp.exe
  2⤵
  PID:5176
- C:\Windows\System\MDwTKNl.exe
  C:\Windows\System\MDwTKNl.exe
  2⤵
  PID:2732
- C:\Windows\System\afaJHCm.exe
  C:\Windows\System\afaJHCm.exe
  2⤵
  PID:5064
- C:\Windows\System\JYUTUZg.exe
  C:\Windows\System\JYUTUZg.exe
  2⤵
  PID:5332
- C:\Windows\System\guYGjVY.exe
  C:\Windows\System\guYGjVY.exe
  2⤵
  PID:5368
- C:\Windows\System\fcIphYb.exe
  C:\Windows\System\fcIphYb.exe
  2⤵
  PID:5416
- C:\Windows\System\hjpTMsJ.exe
  C:\Windows\System\hjpTMsJ.exe
  2⤵
  PID:5492
- C:\Windows\System\vinqdjX.exe
  C:\Windows\System\vinqdjX.exe
  2⤵
  PID:5556
- C:\Windows\System\swAyjbJ.exe
  C:\Windows\System\swAyjbJ.exe
  2⤵
  PID:5596
- C:\Windows\System\yHhLqWf.exe
  C:\Windows\System\yHhLqWf.exe
  2⤵
  PID:5656
- C:\Windows\System\TWHBSss.exe
  C:\Windows\System\TWHBSss.exe
  2⤵
  PID:5708
- C:\Windows\System\NdrGckJ.exe
  C:\Windows\System\NdrGckJ.exe
  2⤵
  PID:5804
- C:\Windows\System\vffhoqq.exe
  C:\Windows\System\vffhoqq.exe
  2⤵
  PID:4272
- C:\Windows\System\XJoBgvk.exe
  C:\Windows\System\XJoBgvk.exe
  2⤵
  PID:4484
- C:\Windows\System\GUNYUjA.exe
  C:\Windows\System\GUNYUjA.exe
  2⤵
  PID:1308
- C:\Windows\System\ghitlfj.exe
  C:\Windows\System\ghitlfj.exe
  2⤵
  PID:2220
- C:\Windows\System\RnsBdKB.exe
  C:\Windows\System\RnsBdKB.exe
  2⤵
  PID:2136
- C:\Windows\System\moWhFTJ.exe
  C:\Windows\System\moWhFTJ.exe
  2⤵
  PID:3872
- C:\Windows\System\CRejVln.exe
  C:\Windows\System\CRejVln.exe
  2⤵
  PID:3272
- C:\Windows\System\MXFoHSh.exe
  C:\Windows\System\MXFoHSh.exe
  2⤵
  PID:1060
- C:\Windows\System\LdeRDjM.exe
  C:\Windows\System\LdeRDjM.exe
  2⤵
  PID:3936
- C:\Windows\System\KvVOZXn.exe
  C:\Windows\System\KvVOZXn.exe
  2⤵
  PID:3064
- C:\Windows\System\UEHQEBw.exe
  C:\Windows\System\UEHQEBw.exe
  2⤵
  PID:4356
- C:\Windows\System\YYzPrlp.exe
  C:\Windows\System\YYzPrlp.exe
  2⤵
  PID:5860
- C:\Windows\System\MHUDwQv.exe
  C:\Windows\System\MHUDwQv.exe
  2⤵
  PID:2344
- C:\Windows\System\zffzqaY.exe
  C:\Windows\System\zffzqaY.exe
  2⤵
  PID:5256
- C:\Windows\System\ziYghlj.exe
  C:\Windows\System\ziYghlj.exe
  2⤵
  PID:5272
- C:\Windows\System\kzbxTyX.exe
  C:\Windows\System\kzbxTyX.exe
  2⤵
  PID:5948
- C:\Windows\System\NDqirJh.exe
  C:\Windows\System\NDqirJh.exe
  2⤵
  PID:6032
- C:\Windows\System\pOwfWSX.exe
  C:\Windows\System\pOwfWSX.exe
  2⤵
  PID:6100
- C:\Windows\System\nkhHMqW.exe
  C:\Windows\System\nkhHMqW.exe
  2⤵
  PID:6080
- C:\Windows\System\hlIihtw.exe
  C:\Windows\System\hlIihtw.exe
  2⤵
  PID:3296
- C:\Windows\System\pMfwfXS.exe
  C:\Windows\System\pMfwfXS.exe
  2⤵
  PID:2840
- C:\Windows\System\rSwaRlJ.exe
  C:\Windows\System\rSwaRlJ.exe
  2⤵
  PID:2000
- C:\Windows\System\vOwMNaD.exe
  C:\Windows\System\vOwMNaD.exe
  2⤵
  PID:5204
- C:\Windows\System\AQtbDPB.exe
  C:\Windows\System\AQtbDPB.exe
  2⤵
  PID:5400
- C:\Windows\System\plNukQP.exe
  C:\Windows\System\plNukQP.exe
  2⤵
  PID:948
- C:\Windows\System\oJlsWXq.exe
  C:\Windows\System\oJlsWXq.exe
  2⤵
  PID:1924
- C:\Windows\System\mRBiKtT.exe
  C:\Windows\System\mRBiKtT.exe
  2⤵
  PID:5544
- C:\Windows\System\LhEGcld.exe
  C:\Windows\System\LhEGcld.exe
  2⤵
  PID:5644
- C:\Windows\System\kiFJxmF.exe
  C:\Windows\System\kiFJxmF.exe
  2⤵
  PID:5796
- C:\Windows\System\UBoZdOv.exe
  C:\Windows\System\UBoZdOv.exe
  2⤵
  PID:5100
- C:\Windows\System\eTCNhrh.exe
  C:\Windows\System\eTCNhrh.exe
  2⤵
  PID:2204
- C:\Windows\System\hvNqljF.exe
  C:\Windows\System\hvNqljF.exe
  2⤵
  PID:3500
- C:\Windows\System\krBAxQm.exe
  C:\Windows\System\krBAxQm.exe
  2⤵
  PID:5972
- C:\Windows\System\beEpdSV.exe
  C:\Windows\System\beEpdSV.exe
  2⤵
  PID:2092
- C:\Windows\System\mfxBgDn.exe
  C:\Windows\System\mfxBgDn.exe
  2⤵
  PID:1420
- C:\Windows\System\PGjfGQb.exe
  C:\Windows\System\PGjfGQb.exe
  2⤵
  PID:5508
- C:\Windows\System\LVArvAT.exe
  C:\Windows\System\LVArvAT.exe
  2⤵
  PID:4744
- C:\Windows\System\RTaNEyb.exe
  C:\Windows\System\RTaNEyb.exe
  2⤵
  PID:6168
- C:\Windows\System\ajqjmiA.exe
  C:\Windows\System\ajqjmiA.exe
  2⤵
  PID:6188
- C:\Windows\System\eKQysBc.exe
  C:\Windows\System\eKQysBc.exe
  2⤵
  PID:6220
- C:\Windows\System\rFEKGWx.exe
  C:\Windows\System\rFEKGWx.exe
  2⤵
  PID:6244
- C:\Windows\System\zaaCpUj.exe
  C:\Windows\System\zaaCpUj.exe
  2⤵
  PID:6268
- C:\Windows\System\asJLPzO.exe
  C:\Windows\System\asJLPzO.exe
  2⤵
  PID:6292
- C:\Windows\System\lXGomSO.exe
  C:\Windows\System\lXGomSO.exe
  2⤵
  PID:6320
- C:\Windows\System\DUcOFyo.exe
  C:\Windows\System\DUcOFyo.exe
  2⤵
  PID:6340
- C:\Windows\System\DryDqaN.exe
  C:\Windows\System\DryDqaN.exe
  2⤵
  PID:6360
- C:\Windows\System\QebioCi.exe
  C:\Windows\System\QebioCi.exe
  2⤵
  PID:6388
- C:\Windows\System\wYVjgSU.exe
  C:\Windows\System\wYVjgSU.exe
  2⤵
  PID:6408
- C:\Windows\System\YTOhdld.exe
  C:\Windows\System\YTOhdld.exe
  2⤵
  PID:6436
- C:\Windows\System\BMskUNF.exe
  C:\Windows\System\BMskUNF.exe
  2⤵
  PID:6460
- C:\Windows\System\laUyzjp.exe
  C:\Windows\System\laUyzjp.exe
  2⤵
  PID:6480
- C:\Windows\System\VoUDmjS.exe
  C:\Windows\System\VoUDmjS.exe
  2⤵
  PID:6508
- C:\Windows\System\yoSivBs.exe
  C:\Windows\System\yoSivBs.exe
  2⤵
  PID:6532
- C:\Windows\System\rTKJAsu.exe
  C:\Windows\System\rTKJAsu.exe
  2⤵
  PID:6556
- C:\Windows\System\jVzbFlk.exe
  C:\Windows\System\jVzbFlk.exe
  2⤵
  PID:6576
- C:\Windows\System\MWpKxKf.exe
  C:\Windows\System\MWpKxKf.exe
  2⤵
  PID:6596
- C:\Windows\System\ExuwJmd.exe
  C:\Windows\System\ExuwJmd.exe
  2⤵
  PID:6624
- C:\Windows\System\LUmikKk.exe
  C:\Windows\System\LUmikKk.exe
  2⤵
  PID:6648
- C:\Windows\System\LaLxraN.exe
  C:\Windows\System\LaLxraN.exe
  2⤵
  PID:6672
- C:\Windows\System\ffMouLG.exe
  C:\Windows\System\ffMouLG.exe
  2⤵
  PID:6692
- C:\Windows\System\PvIhAKx.exe
  C:\Windows\System\PvIhAKx.exe
  2⤵
  PID:6712
- C:\Windows\System\XXQsjgO.exe
  C:\Windows\System\XXQsjgO.exe
  2⤵
  PID:6740
- C:\Windows\System\OQPamAe.exe
  C:\Windows\System\OQPamAe.exe
  2⤵
  PID:6764
- C:\Windows\System\YNRtgiy.exe
  C:\Windows\System\YNRtgiy.exe
  2⤵
  PID:6788
- C:\Windows\System\zESvuqZ.exe
  C:\Windows\System\zESvuqZ.exe
  2⤵
  PID:6812
- C:\Windows\System\RzFTwit.exe
  C:\Windows\System\RzFTwit.exe
  2⤵
  PID:6836
- C:\Windows\System\DjdKpMQ.exe
  C:\Windows\System\DjdKpMQ.exe
  2⤵
  PID:6864
- C:\Windows\System\iiYFSiY.exe
  C:\Windows\System\iiYFSiY.exe
  2⤵
  PID:6880
- C:\Windows\System\ApdZNWv.exe
  C:\Windows\System\ApdZNWv.exe
  2⤵
  PID:6912
- C:\Windows\System\aYfsruk.exe
  C:\Windows\System\aYfsruk.exe
  2⤵
  PID:6936
- C:\Windows\System\bDtyGxy.exe
  C:\Windows\System\bDtyGxy.exe
  2⤵
  PID:6952
- C:\Windows\System\HZkoewD.exe
  C:\Windows\System\HZkoewD.exe
  2⤵
  PID:6980
- C:\Windows\System\XFUMcdP.exe
  C:\Windows\System\XFUMcdP.exe
  2⤵
  PID:7000
- C:\Windows\System\UGkcgWb.exe
  C:\Windows\System\UGkcgWb.exe
  2⤵
  PID:7024
- C:\Windows\System\mWcbrCL.exe
  C:\Windows\System\mWcbrCL.exe
  2⤵
  PID:7052
- C:\Windows\System\FMzhyJs.exe
  C:\Windows\System\FMzhyJs.exe
  2⤵
  PID:7068
- C:\Windows\System\coXjRmO.exe
  C:\Windows\System\coXjRmO.exe
  2⤵
  PID:7092
- C:\Windows\System\CZCijdf.exe
  C:\Windows\System\CZCijdf.exe
  2⤵
  PID:7112
- C:\Windows\System\rdbITnT.exe
  C:\Windows\System\rdbITnT.exe
  2⤵
  PID:7140
- C:\Windows\System\SgyRJNk.exe
  C:\Windows\System\SgyRJNk.exe
  2⤵
  PID:7164
- C:\Windows\System\aOYQwFR.exe
  C:\Windows\System\aOYQwFR.exe
  2⤵
  PID:5072
- C:\Windows\System\CTAItOR.exe
  C:\Windows\System\CTAItOR.exe
  2⤵
  PID:4388
- C:\Windows\System\epJbjVJ.exe
  C:\Windows\System\epJbjVJ.exe
  2⤵
  PID:4436
- C:\Windows\System\jEYmYLE.exe
  C:\Windows\System\jEYmYLE.exe
  2⤵
  PID:6124
- C:\Windows\System\YgHKqha.exe
  C:\Windows\System\YgHKqha.exe
  2⤵
  PID:2200
- C:\Windows\System\qMqtOLw.exe
  C:\Windows\System\qMqtOLw.exe
  2⤵
  PID:5512
- C:\Windows\System\KAIzCZd.exe
  C:\Windows\System\KAIzCZd.exe
  2⤵
  PID:6260
- C:\Windows\System\pVhDeky.exe
  C:\Windows\System\pVhDeky.exe
  2⤵
  PID:3028
- C:\Windows\System\lyNBvcm.exe
  C:\Windows\System\lyNBvcm.exe
  2⤵
  PID:6056
- C:\Windows\System\zFTkuIg.exe
  C:\Windows\System\zFTkuIg.exe
  2⤵
  PID:2152
- C:\Windows\System\spHkeSV.exe
  C:\Windows\System\spHkeSV.exe
  2⤵
  PID:5040
- C:\Windows\System\milOUnM.exe
  C:\Windows\System\milOUnM.exe
  2⤵
  PID:6432
- C:\Windows\System\gsziQdw.exe
  C:\Windows\System\gsziQdw.exe
  2⤵
  PID:1976
- C:\Windows\System\HmmdYVX.exe
  C:\Windows\System\HmmdYVX.exe
  2⤵
  PID:6552
- C:\Windows\System\xlWGcaV.exe
  C:\Windows\System\xlWGcaV.exe
  2⤵
  PID:6664
- C:\Windows\System\IFMBJDD.exe
  C:\Windows\System\IFMBJDD.exe
  2⤵
  PID:6704
- C:\Windows\System\vMaoaCB.exe
  C:\Windows\System\vMaoaCB.exe
  2⤵
  PID:6760
- C:\Windows\System\KTfScRi.exe
  C:\Windows\System\KTfScRi.exe
  2⤵
  PID:6856
- C:\Windows\System\toAJxev.exe
  C:\Windows\System\toAJxev.exe
  2⤵
  PID:6924
- C:\Windows\System\ZBroRjJ.exe
  C:\Windows\System\ZBroRjJ.exe
  2⤵
  PID:6448
- C:\Windows\System\pkVqofr.exe
  C:\Windows\System\pkVqofr.exe
  2⤵
  PID:7064
- C:\Windows\System\NRYlksc.exe
  C:\Windows\System\NRYlksc.exe
  2⤵
  PID:7108
- C:\Windows\System\FhzttnO.exe
  C:\Windows\System\FhzttnO.exe
  2⤵
  PID:6520
- C:\Windows\System\GPqIZHC.exe
  C:\Windows\System\GPqIZHC.exe
  2⤵
  PID:4072
- C:\Windows\System\IDLjpfj.exe
  C:\Windows\System\IDLjpfj.exe
  2⤵
  PID:6104
- C:\Windows\System\VSJbCBU.exe
  C:\Windows\System\VSJbCBU.exe
  2⤵
  PID:3228
- C:\Windows\System\VNHnDYn.exe
  C:\Windows\System\VNHnDYn.exe
  2⤵
  PID:3768
- C:\Windows\System\gUyEdjW.exe
  C:\Windows\System\gUyEdjW.exe
  2⤵
  PID:6252
- C:\Windows\System\NtNvkcl.exe
  C:\Windows\System\NtNvkcl.exe
  2⤵
  PID:7172
- C:\Windows\System\YpYZDvg.exe
  C:\Windows\System\YpYZDvg.exe
  2⤵
  PID:7196
- C:\Windows\System\vaLuPbX.exe
  C:\Windows\System\vaLuPbX.exe
  2⤵
  PID:7224
- C:\Windows\System\VegiyHa.exe
  C:\Windows\System\VegiyHa.exe
  2⤵
  PID:7252
- C:\Windows\System\LXmOZXN.exe
  C:\Windows\System\LXmOZXN.exe
  2⤵
  PID:7272
- C:\Windows\System\ERSnZFW.exe
  C:\Windows\System\ERSnZFW.exe
  2⤵
  PID:7296
- C:\Windows\System\GzkhUTE.exe
  C:\Windows\System\GzkhUTE.exe
  2⤵
  PID:7336
- C:\Windows\System\jxpTmQF.exe
  C:\Windows\System\jxpTmQF.exe
  2⤵
  PID:7356
- C:\Windows\System\xNFswmh.exe
  C:\Windows\System\xNFswmh.exe
  2⤵
  PID:7376
- C:\Windows\System\ibRBytv.exe
  C:\Windows\System\ibRBytv.exe
  2⤵
  PID:7400
- C:\Windows\System\zSdBEtl.exe
  C:\Windows\System\zSdBEtl.exe
  2⤵
  PID:7420
- C:\Windows\System\OFPwzHf.exe
  C:\Windows\System\OFPwzHf.exe
  2⤵
  PID:7448
- C:\Windows\System\ZNDsuJL.exe
  C:\Windows\System\ZNDsuJL.exe
  2⤵
  PID:7584
- C:\Windows\System\xugeQBz.exe
  C:\Windows\System\xugeQBz.exe
  2⤵
  PID:7616
- C:\Windows\System\VkuQVtG.exe
  C:\Windows\System\VkuQVtG.exe
  2⤵
  PID:7640
- C:\Windows\System\lRgCavQ.exe
  C:\Windows\System\lRgCavQ.exe
  2⤵
  PID:7664
- C:\Windows\System\gQDgOFb.exe
  C:\Windows\System\gQDgOFb.exe
  2⤵
  PID:7688
- C:\Windows\System\dQpnCoa.exe
  C:\Windows\System\dQpnCoa.exe
  2⤵
  PID:7712
- C:\Windows\System\QPswOJb.exe
  C:\Windows\System\QPswOJb.exe
  2⤵
  PID:7728
- C:\Windows\System\PMkntmg.exe
  C:\Windows\System\PMkntmg.exe
  2⤵
  PID:7752
- C:\Windows\System\ddHDzRw.exe
  C:\Windows\System\ddHDzRw.exe
  2⤵
  PID:7780
- C:\Windows\System\OWWaNll.exe
  C:\Windows\System\OWWaNll.exe
  2⤵
  PID:7800
- C:\Windows\System\AsHKyYw.exe
  C:\Windows\System\AsHKyYw.exe
  2⤵
  PID:7820
- C:\Windows\System\tTgKKro.exe
  C:\Windows\System\tTgKKro.exe
  2⤵
  PID:7840
- C:\Windows\System\hSNgLLA.exe
  C:\Windows\System\hSNgLLA.exe
  2⤵
  PID:7868
- C:\Windows\System\CIGNZMf.exe
  C:\Windows\System\CIGNZMf.exe
  2⤵
  PID:7892
- C:\Windows\System\vZVmImY.exe
  C:\Windows\System\vZVmImY.exe
  2⤵
  PID:7912
- C:\Windows\System\xJEZyuQ.exe
  C:\Windows\System\xJEZyuQ.exe
  2⤵
  PID:7940
- C:\Windows\System\FYcJxQn.exe
  C:\Windows\System\FYcJxQn.exe
  2⤵
  PID:7964
- C:\Windows\System\aokdOBC.exe
  C:\Windows\System\aokdOBC.exe
  2⤵
  PID:8000
- C:\Windows\System\yNPEFTJ.exe
  C:\Windows\System\yNPEFTJ.exe
  2⤵
  PID:8024
- C:\Windows\System\HdmEpgI.exe
  C:\Windows\System\HdmEpgI.exe
  2⤵
  PID:8056
- C:\Windows\System\zkKivgi.exe
  C:\Windows\System\zkKivgi.exe
  2⤵
  PID:8092
- C:\Windows\System\uzwIULe.exe
  C:\Windows\System\uzwIULe.exe
  2⤵
  PID:8116
- C:\Windows\System\iWmsmiO.exe
  C:\Windows\System\iWmsmiO.exe
  2⤵
  PID:8140
- C:\Windows\System\HWOobwq.exe
  C:\Windows\System\HWOobwq.exe
  2⤵
  PID:8160
- C:\Windows\System\wCHEDnd.exe
  C:\Windows\System\wCHEDnd.exe
  2⤵
  PID:8184
- C:\Windows\System\LgzQgeJ.exe
  C:\Windows\System\LgzQgeJ.exe
  2⤵
  PID:6312
- C:\Windows\System\uPEZkvg.exe
  C:\Windows\System\uPEZkvg.exe
  2⤵
  PID:6736
- C:\Windows\System\ZYOGSXU.exe
  C:\Windows\System\ZYOGSXU.exe
  2⤵
  PID:436
- C:\Windows\System\KnWIHAx.exe
  C:\Windows\System\KnWIHAx.exe
  2⤵
  PID:6804
- C:\Windows\System\WGXpFXr.exe
  C:\Windows\System\WGXpFXr.exe
  2⤵
  PID:7148
- C:\Windows\System\wAnnYph.exe
  C:\Windows\System\wAnnYph.exe
  2⤵
  PID:6828
- C:\Windows\System\NIEHOpy.exe
  C:\Windows\System\NIEHOpy.exe
  2⤵
  PID:6932
- C:\Windows\System\WwClJze.exe
  C:\Windows\System\WwClJze.exe
  2⤵
  PID:7088
- C:\Windows\System\tlNMeeY.exe
  C:\Windows\System\tlNMeeY.exe
  2⤵
  PID:7464
- C:\Windows\System\CWUwWME.exe
  C:\Windows\System\CWUwWME.exe
  2⤵
  PID:7368
- C:\Windows\System\yYkYvDu.exe
  C:\Windows\System\yYkYvDu.exe
  2⤵
  PID:7244
- C:\Windows\System\fcQzVNp.exe
  C:\Windows\System\fcQzVNp.exe
  2⤵
  PID:5384
- C:\Windows\System\IXDDTvn.exe
  C:\Windows\System\IXDDTvn.exe
  2⤵
  PID:6160
- C:\Windows\System\GSzvJZW.exe
  C:\Windows\System\GSzvJZW.exe
  2⤵
  PID:6748
- C:\Windows\System\iJyLTRP.exe
  C:\Windows\System\iJyLTRP.exe
  2⤵
  PID:7372
- C:\Windows\System\PJSjLKc.exe
  C:\Windows\System\PJSjLKc.exe
  2⤵
  PID:7456
- C:\Windows\System\ZGueYMw.exe
  C:\Windows\System\ZGueYMw.exe
  2⤵
  PID:7188
- C:\Windows\System\tAxMazr.exe
  C:\Windows\System\tAxMazr.exe
  2⤵
  PID:7684
- C:\Windows\System\NVkKXPn.exe
  C:\Windows\System\NVkKXPn.exe
  2⤵
  PID:7180
- C:\Windows\System\CfaBCSI.exe
  C:\Windows\System\CfaBCSI.exe
  2⤵
  PID:7260
- C:\Windows\System\eklHzhZ.exe
  C:\Windows\System\eklHzhZ.exe
  2⤵
  PID:7860
- C:\Windows\System\Wehulcb.exe
  C:\Windows\System\Wehulcb.exe
  2⤵
  PID:7320
- C:\Windows\System\SrnCsOq.exe
  C:\Windows\System\SrnCsOq.exe
  2⤵
  PID:7984
- C:\Windows\System\rVUALaA.exe
  C:\Windows\System\rVUALaA.exe
  2⤵
  PID:8016
- C:\Windows\System\CeccETo.exe
  C:\Windows\System\CeccETo.exe
  2⤵
  PID:8080
- C:\Windows\System\BGrkPXH.exe
  C:\Windows\System\BGrkPXH.exe
  2⤵
  PID:8128
- C:\Windows\System\wZPDPUG.exe
  C:\Windows\System\wZPDPUG.exe
  2⤵
  PID:6944
- C:\Windows\System\GEzoVyB.exe
  C:\Windows\System\GEzoVyB.exe
  2⤵
  PID:7636
- C:\Windows\System\zfhOSub.exe
  C:\Windows\System\zfhOSub.exe
  2⤵
  PID:7748
- C:\Windows\System\GNGyfoL.exe
  C:\Windows\System\GNGyfoL.exe
  2⤵
  PID:5148
- C:\Windows\System\uuQqVFF.exe
  C:\Windows\System\uuQqVFF.exe
  2⤵
  PID:7904
- C:\Windows\System\HPVZcet.exe
  C:\Windows\System\HPVZcet.exe
  2⤵
  PID:6300
- C:\Windows\System\aILRbVd.exe
  C:\Windows\System\aILRbVd.exe
  2⤵
  PID:8224
- C:\Windows\System\RRlaJRQ.exe
  C:\Windows\System\RRlaJRQ.exe
  2⤵
  PID:8248
- C:\Windows\System\lDAQyvj.exe
  C:\Windows\System\lDAQyvj.exe
  2⤵
  PID:8264
- C:\Windows\System\fFBKBIl.exe
  C:\Windows\System\fFBKBIl.exe
  2⤵
  PID:8296
- C:\Windows\System\DUfyrJA.exe
  C:\Windows\System\DUfyrJA.exe
  2⤵
  PID:8320
- C:\Windows\System\flyexdc.exe
  C:\Windows\System\flyexdc.exe
  2⤵
  PID:8348
- C:\Windows\System\kQQOmde.exe
  C:\Windows\System\kQQOmde.exe
  2⤵
  PID:8368
- C:\Windows\System\OhGJavh.exe
  C:\Windows\System\OhGJavh.exe
  2⤵
  PID:8388
- C:\Windows\System\TeiiNpw.exe
  C:\Windows\System\TeiiNpw.exe
  2⤵
  PID:8420
- C:\Windows\System\wQgVCLa.exe
  C:\Windows\System\wQgVCLa.exe
  2⤵
  PID:8444
- C:\Windows\System\ofajxRT.exe
  C:\Windows\System\ofajxRT.exe
  2⤵
  PID:8480
- C:\Windows\System\sMjLNpf.exe
  C:\Windows\System\sMjLNpf.exe
  2⤵
  PID:8512
- C:\Windows\System\gmEwZPu.exe
  C:\Windows\System\gmEwZPu.exe
  2⤵
  PID:8528
- C:\Windows\System\luUMnai.exe
  C:\Windows\System\luUMnai.exe
  2⤵
  PID:8560
- C:\Windows\System\ISjhXFi.exe
  C:\Windows\System\ISjhXFi.exe
  2⤵
  PID:8580
- C:\Windows\System\TiJErjD.exe
  C:\Windows\System\TiJErjD.exe
  2⤵
  PID:8604
- C:\Windows\System\KpAYjgD.exe
  C:\Windows\System\KpAYjgD.exe
  2⤵
  PID:8632
- C:\Windows\System\fVLXVWR.exe
  C:\Windows\System\fVLXVWR.exe
  2⤵
  PID:8656
- C:\Windows\System\hZHZirs.exe
  C:\Windows\System\hZHZirs.exe
  2⤵
  PID:8680
- C:\Windows\System\OySjWUL.exe
  C:\Windows\System\OySjWUL.exe
  2⤵
  PID:8704
- C:\Windows\System\wFswOkH.exe
  C:\Windows\System\wFswOkH.exe
  2⤵
  PID:8720
- C:\Windows\System\mhAJWrT.exe
  C:\Windows\System\mhAJWrT.exe
  2⤵
  PID:8744
- C:\Windows\System\OofkPJI.exe
  C:\Windows\System\OofkPJI.exe
  2⤵
  PID:8768
- C:\Windows\System\kxjQkvH.exe
  C:\Windows\System\kxjQkvH.exe
  2⤵
  PID:8792
- C:\Windows\System\DIXGwdv.exe
  C:\Windows\System\DIXGwdv.exe
  2⤵
  PID:8820
- C:\Windows\System\PogKGSQ.exe
  C:\Windows\System\PogKGSQ.exe
  2⤵
  PID:8840
- C:\Windows\System\eaKxWCP.exe
  C:\Windows\System\eaKxWCP.exe
  2⤵
  PID:8864
- C:\Windows\System\NTmgrHB.exe
  C:\Windows\System\NTmgrHB.exe
  2⤵
  PID:8888
- C:\Windows\System\PmcHXkl.exe
  C:\Windows\System\PmcHXkl.exe
  2⤵
  PID:8912
- C:\Windows\System\HTpITCq.exe
  C:\Windows\System\HTpITCq.exe
  2⤵
  PID:7704
- C:\Windows\System\TQuzagz.exe
  C:\Windows\System\TQuzagz.exe
  2⤵
  PID:7900
- C:\Windows\System\ajsGycJ.exe
  C:\Windows\System\ajsGycJ.exe
  2⤵
  PID:8628
- C:\Windows\System\PLOUNiH.exe
  C:\Windows\System\PLOUNiH.exe
  2⤵
  PID:8836
- C:\Windows\System\XxkNUHk.exe
  C:\Windows\System\XxkNUHk.exe
  2⤵
  PID:8884
- C:\Windows\System\wwSVTSV.exe
  C:\Windows\System\wwSVTSV.exe
  2⤵
  PID:8304
- C:\Windows\System\gISqBYN.exe
  C:\Windows\System\gISqBYN.exe
  2⤵
  PID:7856
- C:\Windows\System\DlarwOS.exe
  C:\Windows\System\DlarwOS.exe
  2⤵
  PID:9016
- C:\Windows\System\tWHSfdH.exe
  C:\Windows\System\tWHSfdH.exe
  2⤵
  PID:7428
- C:\Windows\System\EBQbwYP.exe
  C:\Windows\System\EBQbwYP.exe
  2⤵
  PID:8664
- C:\Windows\System\hHqnbwe.exe
  C:\Windows\System\hHqnbwe.exe
  2⤵
  PID:8788
- C:\Windows\System\nPwkbcz.exe
  C:\Windows\System\nPwkbcz.exe
  2⤵
  PID:8244
- C:\Windows\System\mIGWpKG.exe
  C:\Windows\System\mIGWpKG.exe
  2⤵
  PID:8328
- C:\Windows\System\naJnKnR.exe
  C:\Windows\System\naJnKnR.exe
  2⤵
  PID:9164
- C:\Windows\System\tbOUXpc.exe
  C:\Windows\System\tbOUXpc.exe
  2⤵
  PID:8524
- C:\Windows\System\BZViCDD.exe
  C:\Windows\System\BZViCDD.exe
  2⤵
  PID:8152
- C:\Windows\System\DazoDRf.exe
  C:\Windows\System\DazoDRf.exe
  2⤵
  PID:8624
- C:\Windows\System\PwhlCTN.exe
  C:\Windows\System\PwhlCTN.exe
  2⤵
  PID:7044
- C:\Windows\System\gncDWAk.exe
  C:\Windows\System\gncDWAk.exe
  2⤵
  PID:8732
- C:\Windows\System\qPyidEx.exe
  C:\Windows\System\qPyidEx.exe
  2⤵
  PID:8696
- C:\Windows\System\reAMBzM.exe
  C:\Windows\System\reAMBzM.exe
  2⤵
  PID:7540
- C:\Windows\System\JxwmIPm.exe
  C:\Windows\System\JxwmIPm.exe
  2⤵
  PID:7676
- C:\Windows\System\vTrAFaw.exe
  C:\Windows\System\vTrAFaw.exe
  2⤵
  PID:8572
- C:\Windows\System\gLLTlhH.exe
  C:\Windows\System\gLLTlhH.exe
  2⤵
  PID:8332
- C:\Windows\System\jpmDLBt.exe
  C:\Windows\System\jpmDLBt.exe
  2⤵
  PID:7548
- C:\Windows\System\pNdAglI.exe
  C:\Windows\System\pNdAglI.exe
  2⤵
  PID:928
- C:\Windows\System\eokkkMS.exe
  C:\Windows\System\eokkkMS.exe
  2⤵
  PID:9232
- C:\Windows\System\PTrtWtS.exe
  C:\Windows\System\PTrtWtS.exe
  2⤵
  PID:9248
- C:\Windows\System\aApfxlY.exe
  C:\Windows\System\aApfxlY.exe
  2⤵
  PID:9268
- C:\Windows\System\qqTeALl.exe
  C:\Windows\System\qqTeALl.exe
  2⤵
  PID:9284
- C:\Windows\System\tmAkPKD.exe
  C:\Windows\System\tmAkPKD.exe
  2⤵
  PID:9300
- C:\Windows\System\rDQQtYe.exe
  C:\Windows\System\rDQQtYe.exe
  2⤵
  PID:9332
- C:\Windows\System\zHJioGU.exe
  C:\Windows\System\zHJioGU.exe
  2⤵
  PID:9364
- C:\Windows\System\CRIUZrL.exe
  C:\Windows\System\CRIUZrL.exe
  2⤵
  PID:9388
- C:\Windows\System\FwhVSFV.exe
  C:\Windows\System\FwhVSFV.exe
  2⤵
  PID:9432
- C:\Windows\System\QzViaKz.exe
  C:\Windows\System\QzViaKz.exe
  2⤵
  PID:9460
- C:\Windows\System\EslAJnr.exe
  C:\Windows\System\EslAJnr.exe
  2⤵
  PID:9480
- C:\Windows\System\hiVYZpZ.exe
  C:\Windows\System\hiVYZpZ.exe
  2⤵
  PID:9508
- C:\Windows\System\gQNAfCm.exe
  C:\Windows\System\gQNAfCm.exe
  2⤵
  PID:9528
- C:\Windows\System\oKrZLXl.exe
  C:\Windows\System\oKrZLXl.exe
  2⤵
  PID:9552
- C:\Windows\System\djwmOCx.exe
  C:\Windows\System\djwmOCx.exe
  2⤵
  PID:9572
- C:\Windows\System\EIObZMW.exe
  C:\Windows\System\EIObZMW.exe
  2⤵
  PID:9592
- C:\Windows\System\xerIBbX.exe
  C:\Windows\System\xerIBbX.exe
  2⤵
  PID:9616
- C:\Windows\System\wOFeDRo.exe
  C:\Windows\System\wOFeDRo.exe
  2⤵
  PID:9632
- C:\Windows\System\NrrPyUv.exe
  C:\Windows\System\NrrPyUv.exe
  2⤵
  PID:9652
- C:\Windows\System\weupbJh.exe
  C:\Windows\System\weupbJh.exe
  2⤵
  PID:9676
- C:\Windows\System\QzCRiBV.exe
  C:\Windows\System\QzCRiBV.exe
  2⤵
  PID:9704
- C:\Windows\System\MINCikO.exe
  C:\Windows\System\MINCikO.exe
  2⤵
  PID:9728
- C:\Windows\System\xjANCkX.exe
  C:\Windows\System\xjANCkX.exe
  2⤵
  PID:9748
- C:\Windows\System\VPSXDuF.exe
  C:\Windows\System\VPSXDuF.exe
  2⤵
  PID:9776
- C:\Windows\System\XAmLmXu.exe
  C:\Windows\System\XAmLmXu.exe
  2⤵
  PID:9804
- C:\Windows\System\FKNqvIP.exe
  C:\Windows\System\FKNqvIP.exe
  2⤵
  PID:9824
- C:\Windows\System\TjdqIrN.exe
  C:\Windows\System\TjdqIrN.exe
  2⤵
  PID:9844
- C:\Windows\System\ysTOkOJ.exe
  C:\Windows\System\ysTOkOJ.exe
  2⤵
  PID:9864
- C:\Windows\System\xUTJhDs.exe
  C:\Windows\System\xUTJhDs.exe
  2⤵
  PID:9892
- C:\Windows\System\jXLINvG.exe
  C:\Windows\System\jXLINvG.exe
  2⤵
  PID:9916
- C:\Windows\System\czcHOZN.exe
  C:\Windows\System\czcHOZN.exe
  2⤵
  PID:9940
- C:\Windows\System\mlHMllp.exe
  C:\Windows\System\mlHMllp.exe
  2⤵
  PID:9964
- C:\Windows\System\xmfcHUL.exe
  C:\Windows\System\xmfcHUL.exe
  2⤵
  PID:9988
- C:\Windows\System\uzCybCW.exe
  C:\Windows\System\uzCybCW.exe
  2⤵
  PID:10012
- C:\Windows\System\osTOCHr.exe
  C:\Windows\System\osTOCHr.exe
  2⤵
  PID:10032
- C:\Windows\System\CkhDvyn.exe
  C:\Windows\System\CkhDvyn.exe
  2⤵
  PID:10060
- C:\Windows\System\PIWTnye.exe
  C:\Windows\System\PIWTnye.exe
  2⤵
  PID:10088
- C:\Windows\System\RZyMdbM.exe
  C:\Windows\System\RZyMdbM.exe
  2⤵
  PID:10112
- C:\Windows\System\MttXFKp.exe
  C:\Windows\System\MttXFKp.exe
  2⤵
  PID:10136
- C:\Windows\System\foSWnpi.exe
  C:\Windows\System\foSWnpi.exe
  2⤵
  PID:10156
- C:\Windows\System\PQTFsIh.exe
  C:\Windows\System\PQTFsIh.exe
  2⤵
  PID:10180
- C:\Windows\System\awKkCIE.exe
  C:\Windows\System\awKkCIE.exe
  2⤵
  PID:10200
- C:\Windows\System\lIXeclL.exe
  C:\Windows\System\lIXeclL.exe
  2⤵
  PID:10228
- C:\Windows\System\lQsxEft.exe
  C:\Windows\System\lQsxEft.exe
  2⤵
  PID:3508
- C:\Windows\System\kIuQcYD.exe
  C:\Windows\System\kIuQcYD.exe
  2⤵
  PID:8856
- C:\Windows\System\NdHDtAV.exe
  C:\Windows\System\NdHDtAV.exe
  2⤵
  PID:8948
- C:\Windows\System\tgqALqD.exe
  C:\Windows\System\tgqALqD.exe
  2⤵
  PID:8940
- C:\Windows\System\iJbTSiH.exe
  C:\Windows\System\iJbTSiH.exe
  2⤵
  PID:9280
- C:\Windows\System\kyEHXAm.exe
  C:\Windows\System\kyEHXAm.exe
  2⤵
  PID:8872
- C:\Windows\System\wUunaGP.exe
  C:\Windows\System\wUunaGP.exe
  2⤵
  PID:8404
- C:\Windows\System\HifFaWV.exe
  C:\Windows\System\HifFaWV.exe
  2⤵
  PID:8472
- C:\Windows\System\GZAMXws.exe
  C:\Windows\System\GZAMXws.exe
  2⤵
  PID:9116
- C:\Windows\System\OpsIeBO.exe
  C:\Windows\System\OpsIeBO.exe
  2⤵
  PID:9444
- C:\Windows\System\UQxfniL.exe
  C:\Windows\System\UQxfniL.exe
  2⤵
  PID:9324
- C:\Windows\System\uUPoqBp.exe
  C:\Windows\System\uUPoqBp.exe
  2⤵
  PID:9372
- C:\Windows\System\DGUviOJ.exe
  C:\Windows\System\DGUviOJ.exe
  2⤵
  PID:9356
- C:\Windows\System\DeQklin.exe
  C:\Windows\System\DeQklin.exe
  2⤵
  PID:9580
- C:\Windows\System\nEiCHVw.exe
  C:\Windows\System\nEiCHVw.exe
  2⤵
  PID:9684
- C:\Windows\System\xQaOvtI.exe
  C:\Windows\System\xQaOvtI.exe
  2⤵
  PID:9756
- C:\Windows\System\jWZjQRc.exe
  C:\Windows\System\jWZjQRc.exe
  2⤵
  PID:9820
- C:\Windows\System\mXgfWyq.exe
  C:\Windows\System\mXgfWyq.exe
  2⤵
  PID:9612
- C:\Windows\System\AjLQXvI.exe
  C:\Windows\System\AjLQXvI.exe
  2⤵
  PID:9880
- C:\Windows\System\jDgnJLK.exe
  C:\Windows\System\jDgnJLK.exe
  2⤵
  PID:9668
- C:\Windows\System\iiaJQtV.exe
  C:\Windows\System\iiaJQtV.exe
  2⤵
  PID:10008
- C:\Windows\System\vnVtdAk.exe
  C:\Windows\System\vnVtdAk.exe
  2⤵
  PID:10028
- C:\Windows\System\uwjBqwS.exe
  C:\Windows\System\uwjBqwS.exe
  2⤵
  PID:9816
- C:\Windows\System\RSGcDqp.exe
  C:\Windows\System\RSGcDqp.exe
  2⤵
  PID:10148
- C:\Windows\System\ZpkYEAJ.exe
  C:\Windows\System\ZpkYEAJ.exe
  2⤵
  PID:5844
- C:\Windows\System\sTCsLpX.exe
  C:\Windows\System\sTCsLpX.exe
  2⤵
  PID:9908
- C:\Windows\System\oShTbkZ.exe
  C:\Windows\System\oShTbkZ.exe
  2⤵
  PID:8588
- C:\Windows\System\HPppetM.exe
  C:\Windows\System\HPppetM.exe
  2⤵
  PID:10252
- C:\Windows\System\FaoTeqn.exe
  C:\Windows\System\FaoTeqn.exe
  2⤵
  PID:10276
- C:\Windows\System\DGnPEmy.exe
  C:\Windows\System\DGnPEmy.exe
  2⤵
  PID:10300
- C:\Windows\System\gwigScC.exe
  C:\Windows\System\gwigScC.exe
  2⤵
  PID:10320
- C:\Windows\System\BXPslbX.exe
  C:\Windows\System\BXPslbX.exe
  2⤵
  PID:10348
- C:\Windows\System\TBoIHCA.exe
  C:\Windows\System\TBoIHCA.exe
  2⤵
  PID:10368
- C:\Windows\System\kFZVfcF.exe
  C:\Windows\System\kFZVfcF.exe
  2⤵
  PID:10388
- C:\Windows\System\jcZdmQH.exe
  C:\Windows\System\jcZdmQH.exe
  2⤵
  PID:10416
- C:\Windows\System\jUGHtLR.exe
  C:\Windows\System\jUGHtLR.exe
  2⤵
  PID:10436
- C:\Windows\System\QscVrLJ.exe
  C:\Windows\System\QscVrLJ.exe
  2⤵
  PID:10460
- C:\Windows\System\FzCcHqt.exe
  C:\Windows\System\FzCcHqt.exe
  2⤵
  PID:10480
- C:\Windows\System\lEfBuWl.exe
  C:\Windows\System\lEfBuWl.exe
  2⤵
  PID:10504
- C:\Windows\System\yQVfBIk.exe
  C:\Windows\System\yQVfBIk.exe
  2⤵
  PID:10524
- C:\Windows\System\ZJJxsYw.exe
  C:\Windows\System\ZJJxsYw.exe
  2⤵
  PID:10544
- C:\Windows\System\jUWDvGi.exe
  C:\Windows\System\jUWDvGi.exe
  2⤵
  PID:10568
- C:\Windows\System\tTlmjcq.exe
  C:\Windows\System\tTlmjcq.exe
  2⤵
  PID:10596
- C:\Windows\System\AaFJZnb.exe
  C:\Windows\System\AaFJZnb.exe
  2⤵
  PID:10616
- C:\Windows\System\VeFcnrC.exe
  C:\Windows\System\VeFcnrC.exe
  2⤵
  PID:10640
- C:\Windows\System\UzVvsmJ.exe
  C:\Windows\System\UzVvsmJ.exe
  2⤵
  PID:10668
- C:\Windows\System\oZPTTRh.exe
  C:\Windows\System\oZPTTRh.exe
  2⤵
  PID:10696
- C:\Windows\System\cBKXiny.exe
  C:\Windows\System\cBKXiny.exe
  2⤵
  PID:10716
- C:\Windows\System\JzqEaTV.exe
  C:\Windows\System\JzqEaTV.exe
  2⤵
  PID:10736
- C:\Windows\System\kxkYChb.exe
  C:\Windows\System\kxkYChb.exe
  2⤵
  PID:10764
- C:\Windows\System\TJoiUph.exe
  C:\Windows\System\TJoiUph.exe
  2⤵
  PID:10784
- C:\Windows\System\SJYdTYI.exe
  C:\Windows\System\SJYdTYI.exe
  2⤵
  PID:10808
- C:\Windows\System\SqjntOE.exe
  C:\Windows\System\SqjntOE.exe
  2⤵
  PID:10836
- C:\Windows\System\KkaiVIT.exe
  C:\Windows\System\KkaiVIT.exe
  2⤵
  PID:10868
- C:\Windows\System\NROGYrf.exe
  C:\Windows\System\NROGYrf.exe
  2⤵
  PID:10888
- C:\Windows\System\PVNcRjy.exe
  C:\Windows\System\PVNcRjy.exe
  2⤵
  PID:10916
- C:\Windows\System\fvyQrdL.exe
  C:\Windows\System\fvyQrdL.exe
  2⤵
  PID:10936
- C:\Windows\System\nQmFBTp.exe
  C:\Windows\System\nQmFBTp.exe
  2⤵
  PID:10960
- C:\Windows\System\FqCmrkX.exe
  C:\Windows\System\FqCmrkX.exe
  2⤵
  PID:10984
- C:\Windows\System\MvsCIPl.exe
  C:\Windows\System\MvsCIPl.exe
  2⤵
  PID:11024
- C:\Windows\System\NTCgFue.exe
  C:\Windows\System\NTCgFue.exe
  2⤵
  PID:11040
- C:\Windows\System\gudiNua.exe
  C:\Windows\System\gudiNua.exe
  2⤵
  PID:11056
- C:\Windows\System\kxOPdCi.exe
  C:\Windows\System\kxOPdCi.exe
  2⤵
  PID:11072
- C:\Windows\System\xsYVzDv.exe
  C:\Windows\System\xsYVzDv.exe
  2⤵
  PID:11088
- C:\Windows\System\XeZWPzG.exe
  C:\Windows\System\XeZWPzG.exe
  2⤵
  PID:11104
- C:\Windows\System\EKudcJs.exe
  C:\Windows\System\EKudcJs.exe
  2⤵
  PID:11120
- C:\Windows\System\VOeUuEh.exe
  C:\Windows\System\VOeUuEh.exe
  2⤵
  PID:11136
- C:\Windows\System\QcqmQMu.exe
  C:\Windows\System\QcqmQMu.exe
  2⤵
  PID:11156
- C:\Windows\System\fgfdGON.exe
  C:\Windows\System\fgfdGON.exe
  2⤵
  PID:11184
- C:\Windows\System\JWAUrei.exe
  C:\Windows\System\JWAUrei.exe
  2⤵
  PID:11204
- C:\Windows\System\bnVWSye.exe
  C:\Windows\System\bnVWSye.exe
  2⤵
  PID:11232
- C:\Windows\System\GdOWHVI.exe
  C:\Windows\System\GdOWHVI.exe
  2⤵
  PID:11256
- C:\Windows\System\hVNTkNj.exe
  C:\Windows\System\hVNTkNj.exe
  2⤵
  PID:10084
- C:\Windows\System\ueuYmfa.exe
  C:\Windows\System\ueuYmfa.exe
  2⤵
  PID:9376
- C:\Windows\System\MroarfI.exe
  C:\Windows\System\MroarfI.exe
  2⤵
  PID:9628
- C:\Windows\System\JVADeWh.exe
  C:\Windows\System\JVADeWh.exe
  2⤵
  PID:10176
- C:\Windows\System\KLzgvxP.exe
  C:\Windows\System\KLzgvxP.exe
  2⤵
  PID:10000
- C:\Windows\System\mJiEPGy.exe
  C:\Windows\System\mJiEPGy.exe
  2⤵
  PID:10068
- C:\Windows\System\PqRxGON.exe
  C:\Windows\System\PqRxGON.exe
  2⤵
  PID:10108
- C:\Windows\System\xrpFdup.exe
  C:\Windows\System\xrpFdup.exe
  2⤵
  PID:8256
- C:\Windows\System\yMpmbRX.exe
  C:\Windows\System\yMpmbRX.exe
  2⤵
  PID:9548
- C:\Windows\System\slNxLEK.exe
  C:\Windows\System\slNxLEK.exe
  2⤵
  PID:10340
- C:\Windows\System\lgOOfke.exe
  C:\Windows\System\lgOOfke.exe
  2⤵
  PID:9960
- C:\Windows\System\iAmPByN.exe
  C:\Windows\System\iAmPByN.exe
  2⤵
  PID:10520
- C:\Windows\System\PRgquuP.exe
  C:\Windows\System\PRgquuP.exe
  2⤵
  PID:10584
- C:\Windows\System\xPRngjG.exe
  C:\Windows\System\xPRngjG.exe
  2⤵
  PID:10132
- C:\Windows\System\FvGlnnA.exe
  C:\Windows\System\FvGlnnA.exe
  2⤵
  PID:7604
- C:\Windows\System\UNomLSu.exe
  C:\Windows\System\UNomLSu.exe
  2⤵
  PID:9228
- C:\Windows\System\dzQXUMx.exe
  C:\Windows\System\dzQXUMx.exe
  2⤵
  PID:10296
- C:\Windows\System\zWMMvSF.exe
  C:\Windows\System\zWMMvSF.exe
  2⤵
  PID:10328
- C:\Windows\System\mvQIIjt.exe
  C:\Windows\System\mvQIIjt.exe
  2⤵
  PID:11268
- C:\Windows\System\XtwHmQW.exe
  C:\Windows\System\XtwHmQW.exe
  2⤵
  PID:11288
- C:\Windows\System\TmgdARh.exe
  C:\Windows\System\TmgdARh.exe
  2⤵
  PID:11316
- C:\Windows\System\nYsfAuS.exe
  C:\Windows\System\nYsfAuS.exe
  2⤵
  PID:11340
- C:\Windows\System\IzYtnio.exe
  C:\Windows\System\IzYtnio.exe
  2⤵
  PID:11364
- C:\Windows\System\jHnmbpX.exe
  C:\Windows\System\jHnmbpX.exe
  2⤵
  PID:11384
- C:\Windows\System\dUWzohD.exe
  C:\Windows\System\dUWzohD.exe
  2⤵
  PID:11404
- C:\Windows\System\TUWSUMb.exe
  C:\Windows\System\TUWSUMb.exe
  2⤵
  PID:11424
- C:\Windows\System\LPVHskg.exe
  C:\Windows\System\LPVHskg.exe
  2⤵
  PID:11452
- C:\Windows\System\obsOFdK.exe
  C:\Windows\System\obsOFdK.exe
  2⤵
  PID:11476
- C:\Windows\System\nSyJxzS.exe
  C:\Windows\System\nSyJxzS.exe
  2⤵
  PID:11500
- C:\Windows\System\upLiUAD.exe
  C:\Windows\System\upLiUAD.exe
  2⤵
  PID:11520
- C:\Windows\System\AtGXGUB.exe
  C:\Windows\System\AtGXGUB.exe
  2⤵
  PID:11544
- C:\Windows\System\BZVxMKp.exe
  C:\Windows\System\BZVxMKp.exe
  2⤵
  PID:11568
- C:\Windows\System\LNNykuL.exe
  C:\Windows\System\LNNykuL.exe
  2⤵
  PID:11596
- C:\Windows\System\FEWpmgV.exe
  C:\Windows\System\FEWpmgV.exe
  2⤵
  PID:11624
- C:\Windows\System\jXLXDPv.exe
  C:\Windows\System\jXLXDPv.exe
  2⤵
  PID:11644
- C:\Windows\System\GdpgCDo.exe
  C:\Windows\System\GdpgCDo.exe
  2⤵
  PID:11672
- C:\Windows\System\wgwlBBJ.exe
  C:\Windows\System\wgwlBBJ.exe
  2⤵
  PID:11700
- C:\Windows\System\KzmBhvh.exe
  C:\Windows\System\KzmBhvh.exe
  2⤵
  PID:11720
- C:\Windows\System\dndIhHZ.exe
  C:\Windows\System\dndIhHZ.exe
  2⤵
  PID:11744
- C:\Windows\System\OwYtrdj.exe
  C:\Windows\System\OwYtrdj.exe
  2⤵
  PID:11772
- C:\Windows\System\kXnwbfG.exe
  C:\Windows\System\kXnwbfG.exe
  2⤵
  PID:11800
- C:\Windows\System\GQOpEJk.exe
  C:\Windows\System\GQOpEJk.exe
  2⤵
  PID:11820
- C:\Windows\System\MwsRmBd.exe
  C:\Windows\System\MwsRmBd.exe
  2⤵
  PID:11836
- C:\Windows\System\OYjrxjq.exe
  C:\Windows\System\OYjrxjq.exe
  2⤵
  PID:11852
- C:\Windows\System\sZrmZft.exe
  C:\Windows\System\sZrmZft.exe
  2⤵
  PID:11868
- C:\Windows\System\UOuhiSD.exe
  C:\Windows\System\UOuhiSD.exe
  2⤵
  PID:11884
- C:\Windows\System\rhlyRVe.exe
  C:\Windows\System\rhlyRVe.exe
  2⤵
  PID:11900
- C:\Windows\System\zGQLXql.exe
  C:\Windows\System\zGQLXql.exe
  2⤵
  PID:11920
- C:\Windows\System\iGJBWWX.exe
  C:\Windows\System\iGJBWWX.exe
  2⤵
  PID:11948
- C:\Windows\System\zOuSkfm.exe
  C:\Windows\System\zOuSkfm.exe
  2⤵
  PID:11972
- C:\Windows\System\JScSgVO.exe
  C:\Windows\System\JScSgVO.exe
  2⤵
  PID:12000
- C:\Windows\System\kjUtIgI.exe
  C:\Windows\System\kjUtIgI.exe
  2⤵
  PID:12024
- C:\Windows\System\zYqmgEt.exe
  C:\Windows\System\zYqmgEt.exe
  2⤵
  PID:12048
- C:\Windows\System\aRtUFLK.exe
  C:\Windows\System\aRtUFLK.exe
  2⤵
  PID:12072
- C:\Windows\System\xfuWpsf.exe
  C:\Windows\System\xfuWpsf.exe
  2⤵
  PID:12100
- C:\Windows\System\pEXiNeT.exe
  C:\Windows\System\pEXiNeT.exe
  2⤵
  PID:12120
- C:\Windows\System\tUryKlb.exe
  C:\Windows\System\tUryKlb.exe
  2⤵
  PID:12144
- C:\Windows\System\PTDSWbv.exe
  C:\Windows\System\PTDSWbv.exe
  2⤵
  PID:12164
- C:\Windows\System\NPrLqnh.exe
  C:\Windows\System\NPrLqnh.exe
  2⤵
  PID:12196
- C:\Windows\System\queYPai.exe
  C:\Windows\System\queYPai.exe
  2⤵
  PID:12216
- C:\Windows\System\vSTsHit.exe
  C:\Windows\System\vSTsHit.exe
  2⤵
  PID:12248
- C:\Windows\System\GiaPCoC.exe
  C:\Windows\System\GiaPCoC.exe
  2⤵
  PID:12276
- C:\Windows\System\CljRrJq.exe
  C:\Windows\System\CljRrJq.exe
  2⤵
  PID:10968
- C:\Windows\System\xxrIPDz.exe
  C:\Windows\System\xxrIPDz.exe
  2⤵
  PID:11048
- C:\Windows\System\WpUvoUu.exe
  C:\Windows\System\WpUvoUu.exe
  2⤵
  PID:10496
- C:\Windows\System\OpMvvpP.exe
  C:\Windows\System\OpMvvpP.exe
  2⤵
  PID:10604
- C:\Windows\System\AfJKXXk.exe
  C:\Windows\System\AfJKXXk.exe
  2⤵
  PID:10236
- C:\Windows\System\HRtPowb.exe
  C:\Windows\System\HRtPowb.exe
  2⤵
  PID:8316
- C:\Windows\System\JKLxlBg.exe
  C:\Windows\System\JKLxlBg.exe
  2⤵
  PID:10732
- C:\Windows\System\rVCkERS.exe
  C:\Windows\System\rVCkERS.exe
  2⤵
  PID:9660
- C:\Windows\System\SYBgasA.exe
  C:\Windows\System\SYBgasA.exe
  2⤵
  PID:10652
- C:\Windows\System\FqWSFBq.exe
  C:\Windows\System\FqWSFBq.exe
  2⤵
  PID:10760
- C:\Windows\System\uqXfWIi.exe
  C:\Windows\System\uqXfWIi.exe
  2⤵
  PID:11280
- C:\Windows\System\aayqiBQ.exe
  C:\Windows\System\aayqiBQ.exe
  2⤵
  PID:10404
- C:\Windows\System\mdPHPUf.exe
  C:\Windows\System\mdPHPUf.exe
  2⤵
  PID:10444
- C:\Windows\System\EfAmZyy.exe
  C:\Windows\System\EfAmZyy.exe
  2⤵
  PID:11380
- C:\Windows\System\knimJzM.exe
  C:\Windows\System\knimJzM.exe
  2⤵
  PID:11096
- C:\Windows\System\AoGsDFJ.exe
  C:\Windows\System\AoGsDFJ.exe
  2⤵
  PID:11444
- C:\Windows\System\ScighTE.exe
  C:\Windows\System\ScighTE.exe
  2⤵
  PID:10540
- C:\Windows\System\xBZOTkn.exe
  C:\Windows\System\xBZOTkn.exe
  2⤵
  PID:11516
- C:\Windows\System\CrKPKPl.exe
  C:\Windows\System\CrKPKPl.exe
  2⤵
  PID:9400
- C:\Windows\System\cUGDwvh.exe
  C:\Windows\System\cUGDwvh.exe
  2⤵
  PID:8488
- C:\Windows\System\RkRDFpU.exe
  C:\Windows\System\RkRDFpU.exe
  2⤵
  PID:11712
- C:\Windows\System\emYOmQa.exe
  C:\Windows\System\emYOmQa.exe
  2⤵
  PID:11816
- C:\Windows\System\AJEfEeF.exe
  C:\Windows\System\AJEfEeF.exe
  2⤵
  PID:10708
- C:\Windows\System\crvQQMj.exe
  C:\Windows\System\crvQQMj.exe
  2⤵
  PID:11980
- C:\Windows\System\LNeSSNk.exe
  C:\Windows\System\LNeSSNk.exe
  2⤵
  PID:11324
- C:\Windows\System\urZZcST.exe
  C:\Windows\System\urZZcST.exe
  2⤵
  PID:12112
- C:\Windows\System\Extrkbu.exe
  C:\Windows\System\Extrkbu.exe
  2⤵
  PID:12292
- C:\Windows\System\SLmDOID.exe
  C:\Windows\System\SLmDOID.exe
  2⤵
  PID:12316
- C:\Windows\System\cGEzmia.exe
  C:\Windows\System\cGEzmia.exe
  2⤵
  PID:12336
- C:\Windows\System\cNeSSAm.exe
  C:\Windows\System\cNeSSAm.exe
  2⤵
  PID:12360
- C:\Windows\System\BbAqYQd.exe
  C:\Windows\System\BbAqYQd.exe
  2⤵
  PID:12384
- C:\Windows\System\hcumIFx.exe
  C:\Windows\System\hcumIFx.exe
  2⤵
  PID:12408
- C:\Windows\System\mMBKwuX.exe
  C:\Windows\System\mMBKwuX.exe
  2⤵
  PID:12424
- C:\Windows\System\xbHoJHq.exe
  C:\Windows\System\xbHoJHq.exe
  2⤵
  PID:12440
- C:\Windows\System\CGHVPXa.exe
  C:\Windows\System\CGHVPXa.exe
  2⤵
  PID:12456
- C:\Windows\System\yyqaWOl.exe
  C:\Windows\System\yyqaWOl.exe
  2⤵
  PID:12480
- C:\Windows\System\HDOnuUj.exe
  C:\Windows\System\HDOnuUj.exe
  2⤵
  PID:12496
- C:\Windows\System\MiGrsOv.exe
  C:\Windows\System\MiGrsOv.exe
  2⤵
  PID:12512
- C:\Windows\System\eYrSTvT.exe
  C:\Windows\System\eYrSTvT.exe
  2⤵
  PID:12528
- C:\Windows\System\BzeFGzd.exe
  C:\Windows\System\BzeFGzd.exe
  2⤵
  PID:12544
- C:\Windows\System\OYbwAJn.exe
  C:\Windows\System\OYbwAJn.exe
  2⤵
  PID:12564
- C:\Windows\System\mAJofCk.exe
  C:\Windows\System\mAJofCk.exe
  2⤵
  PID:12588
- C:\Windows\System\xQWaruf.exe
  C:\Windows\System\xQWaruf.exe
  2⤵
  PID:12612
- C:\Windows\System\MOXHXlT.exe
  C:\Windows\System\MOXHXlT.exe
  2⤵
  PID:12636
- C:\Windows\System\TgaqoAR.exe
  C:\Windows\System\TgaqoAR.exe
  2⤵
  PID:12660
- C:\Windows\System\eTPdQXi.exe
  C:\Windows\System\eTPdQXi.exe
  2⤵
  PID:12712
- C:\Windows\System\CCTUHIZ.exe
  C:\Windows\System\CCTUHIZ.exe
  2⤵
  PID:12732
- C:\Windows\System\ExFnezb.exe
  C:\Windows\System\ExFnezb.exe
  2⤵
  PID:12756
- C:\Windows\System\VYJxUvL.exe
  C:\Windows\System\VYJxUvL.exe
  2⤵
  PID:12788
- C:\Windows\System\lJNrrSB.exe
  C:\Windows\System\lJNrrSB.exe
  2⤵
  PID:11664
- C:\Windows\System\DCqoHei.exe
  C:\Windows\System\DCqoHei.exe
  2⤵
  PID:12520
- C:\Windows\System\pdaXjvZ.exe
  C:\Windows\System\pdaXjvZ.exe
  2⤵
  PID:12560
- C:\Windows\System\amqoXQb.exe
  C:\Windows\System\amqoXQb.exe
  2⤵
  PID:12604
- C:\Windows\System\xJlWcaY.exe
  C:\Windows\System\xJlWcaY.exe
  2⤵
  PID:12656
- C:\Windows\System\sLuuYyf.exe
  C:\Windows\System\sLuuYyf.exe
  2⤵
  PID:1596
- C:\Windows\System\homeFOC.exe
  C:\Windows\System\homeFOC.exe
  2⤵
  PID:12776
- C:\Windows\System\nIpcieG.exe
  C:\Windows\System\nIpcieG.exe
  2⤵
  PID:12840
- C:\Windows\System\NySkeOb.exe
  C:\Windows\System\NySkeOb.exe
  2⤵
  PID:11508
- C:\Windows\System\tVuqrFS.exe
  C:\Windows\System\tVuqrFS.exe
  2⤵
  PID:10428
- C:\Windows\System\vyCzPzR.exe
  C:\Windows\System\vyCzPzR.exe
  2⤵
  PID:2836
- C:\Windows\System\lkajsub.exe
  C:\Windows\System\lkajsub.exe
  2⤵
  PID:11832
- C:\Windows\System\AbHMpWN.exe
  C:\Windows\System\AbHMpWN.exe
  2⤵
  PID:11780
- C:\Windows\System\roYQotX.exe
  C:\Windows\System\roYQotX.exe
  2⤵
  PID:11936
- C:\Windows\System\apuZvQp.exe
  C:\Windows\System\apuZvQp.exe
  2⤵
  PID:9008
- C:\Windows\System\SILBhuS.exe
  C:\Windows\System\SILBhuS.exe
  2⤵
  PID:12728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k245yxba.nc0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BxoyUIq.exe

Filesize
2.7MB

MD5
c935023747ea01631ac59f2c1a5aa8d9

SHA1
7e7a84a0323b5fbf3be4973d81b67b133b716168

SHA256
95a8e4d81b58e1dc821d5886e5842beb1fa7dc7b5f9666a138fb5734bc3d9f0c

SHA512
361be793168b94b84f1c8a5e8eb3936acbbb87351b445eaedd3b37ddbd8e8604fa089e43e2f257cd757bf3db47ad4907d3104c864254357188038a657043b833

Download Submit
C:\Windows\System\CZRTrLm.exe

Filesize
2.7MB

MD5
b8ab10f1d7c89d58211d9f045e03e92b

SHA1
de78cd79bf8511257c8468561e70ad42982eba5a

SHA256
c3029157be9ee7f6e37cf649719e0687b9f9beb1e37c3b0f6e0301c612eb3a2a

SHA512
c2d8591a657063111c0b442dca73602bc6682f834254d337ca80d75eb3420956dc8575e137840d1cdfb8332de449561d757cf569c13a5b35a1a4730b14a83837

Download Submit
C:\Windows\System\EBoOtBB.exe

Filesize
2.7MB

MD5
b2d9b35c05654502f874a1948e835b08

SHA1
19fe8f046aed8767917d1b545d1376eb8aab96e7

SHA256
80cc61da4babce05304118bbfee42a2af969a1c148898f85a583e08e6e2e34f8

SHA512
ec8fd666fd4ab07785c1e460ec502c15892939af06d05f5c87a07ffc07514af7b0e81f4c2e5de00b23786bf2af25e6161ebe276a20ff83acde72e8d5dc0416ce

Download Submit
C:\Windows\System\EUoJrkZ.exe

Filesize
2.7MB

MD5
b2d0ed9b2c010bedfc412eb7b6b99c5d

SHA1
1fb32165b375810ccbc22392ed6a14d3ad66f56c

SHA256
b45cee770201013e69bab09b5af83111495524e450f71533ed2c6d9ab2c9e2cd

SHA512
1cbc39ab0ac45735c1861665c4633856150828602bb69d6fde513eaaa42e6c382e61c0b12a41f44869fa1b60972a7c0efa70aba63c773f770daee0477fa9acde

Download Submit
C:\Windows\System\HKetNrN.exe

Filesize
2.7MB

MD5
cd066861bdb472bb9d19cfb08c83cc8a

SHA1
da929c7bca157cdc920f64d861c4eeca8057c817

SHA256
d116c40e7b2ff82e094aa03905ed91018ec68dc87883b6ef276e01f1ef93abc9

SHA512
e98979d2f3e0415e042a1355d4cac6c218d83a9a08bbdde02ad9ef726ebbe1157fec4bf621d13c20ed0ee56edfff967f1d7f55378579e07e0705a6009dab8e0d

Download Submit
C:\Windows\System\HloaEDe.exe

Filesize
8B

MD5
084966f59f3ab1ef3498c31bc0d48c8f

SHA1
43ad5ff74be0c6cfb8d01865f4602ced2a1afc7e

SHA256
ef8c16bd7c7024f968d9b2636e189477ad9731786bb630a8fc216074ec1ad6f7

SHA512
8f91a6b79e95162659de6ed4b46b60f410f543f8b90874dc38a14fa83f5eb5a56b88baaaf220d09c2020729310b8dfc81da862d7270bf43afa793d5f65f1bb4c

Download Submit
C:\Windows\System\JbhAyOa.exe

Filesize
2.7MB

MD5
01ee8b923c75ee7a5d34277bf62faba8

SHA1
b44e2beb74af32ec1bcfcc5135c380dfd38dedd7

SHA256
6ab27a9435ffc8683372cb3daec4754ae51e51df665cd1f2554e20ad7e7c1717

SHA512
26503300de901cf46e762043310103f3c00481bd7f59293e87890258e6bc49c8a5f0c16b060e0ff621bf1b3f67a3e4a990ef9c76450782d1d59701fa4755d041

Download Submit
C:\Windows\System\MqycpDL.exe

Filesize
2.7MB

MD5
daca78ebe5a0f3f18891ba1cda26d446

SHA1
72a23096483eece4fbf72001505d910a81585c5c

SHA256
c51bf7edac23383f977cc7351c2339b0e4c5ad8f62cfe231106e6e48f677036c

SHA512
44e7e4ed8ec3a626304f6019e7fa54250f1048d46d1991332092290918b968644ae8382071a7a60f0bbb41a774310bca8c0a20cceca22a950876378fbe53b4c6

Download Submit
C:\Windows\System\MznFsqs.exe

Filesize
2.7MB

MD5
301e47d5d9b0adfea28497ff468bdceb

SHA1
116f2b837afc59e6c3ef644c5a170c6bf8abb300

SHA256
1e2c825ac0761efe097c8c9a12d9a0cc442d67c8bcdaa63928293cf9a2f2ccc0

SHA512
0df041197713dcc50e00e600225fe159452c175402b116623ebb40ec628b4302a6db7d005c5bb3f9c69bae6c50c02e546d9f2c5f69244b6465c170a9475e7f22

Download Submit
C:\Windows\System\ORzMyWY.exe

Filesize
2.7MB

MD5
414599ec6bf951d6a7fd10a123743e2a

SHA1
44453537af3049256043f5b2f8d61aefe42bc2b7

SHA256
a2e6606222f9c842fc7bbbb5c2e0179003263bc30478428a9cd98b3dcc94f2c5

SHA512
85595856293a58165b58fb657373ed047c32b965bae8a7e20a975b409d7abccc9d52a868695aee19e1f116a68d0a8b1facb7214da3c3ea353e64a167c65b4154

Download Submit
C:\Windows\System\OVuLISQ.exe

Filesize
2.7MB

MD5
72cec9481c8e21125497fa00dcfd77fe

SHA1
a3524854a0a143ecbcca3cf5b9ee27f14d75936d

SHA256
456fee885f62563fce04d22d05c13e3a4f99f6f8b3610c9b4dd71c64b4196414

SHA512
27452fc2abb6fffe181ebebeb37672a92a9fa06f814508b9fc655373cffd0c3b3c298e13f915c79acbf91dc99d2063ee5d6e3df9eeebb105e7dec6a3b04ab541

Download Submit
C:\Windows\System\PvJizwY.exe

Filesize
2.7MB

MD5
3350d490d903841487de436646ae2a2d

SHA1
50e0c5f844a82849ccbbb3ecea9bb80096a93d70

SHA256
a9888f5a85f01f40b2d4036d3a115de82f5c2eabaa1af54f27f4dba25e7ed395

SHA512
dc833a9c152087456eb03d2596b952996bdde4a69affdbb3636c4fdb675690405538f8adcf58bc3ea708aabf1b59c3a3fcec26269cbc2d6a756f629589045d07

Download Submit
C:\Windows\System\QXkITvf.exe

Filesize
2.7MB

MD5
596fe2df49b9ed0c56a3423ebe3d90f3

SHA1
4ec4772a596fbb68f9eac2601def7c61d8a003d6

SHA256
e27efecd1f0f9a56ed258ca8156c78cf93764d254eecb434fb59720155568e2a

SHA512
43549ed028258f181deca8c08a1a70cb161748fa511abda0facf53fc53c681c7cdd34f597e6c1b9a51b7243e608f836a83e29175a605697ffc3895e2348f0645

Download Submit
C:\Windows\System\RqfbqAL.exe

Filesize
2.7MB

MD5
79560ec7367eb07677d76c923aa5e768

SHA1
8d194278b17f576113696e351dc233a30a336dc4

SHA256
710a8bdf9bb31328d4b715868d0e4605f890f85f5f81bf67e34aa3c3b0657184

SHA512
1cf804bdaa187c1f2a6c959de34bc2763bc919a0183f3e4df267fde113a7ae9f4c6811dd270482fa3628e8e1d6c0440d7c219c5c070e0e78007b9d066d4917c6

Download Submit
C:\Windows\System\VlfxCJI.exe

Filesize
2.7MB

MD5
0fa44f9212fc7e7333a1679c627e81d0

SHA1
cbdf5593fa44c99efe25e91b8f1514ff4f1d87ae

SHA256
1835a96ecfb99ed5204114a603fbf73cc1eaac7846a1424b294cf68956d5a9d1

SHA512
55ae856eaf7454a340c2d41b0815069732fc64d81b4556ad2bdafecbc93d3fd570c9698907533afc05e7282d5d41ba9635c62502f5716655527506d74636dd3d

Download Submit
C:\Windows\System\XabhxEz.exe

Filesize
2.7MB

MD5
f7617ec77be88ffe6e4b0c78900b64db

SHA1
32db21a437fdab5f6c17157965fe4c5ed2ceefff

SHA256
d4e3f2d6e9b2cf20b3c0eba9efcb545a8c7d74789f9c3c5e7c497f9a71b10f74

SHA512
6012e230b8cbae1112a9e095209662a2c8c9d6fceade86220fe29e37cc068a567e1b46aae737ed0be10f490f38ce4592244dfa281bb7358db0821ed77fdedb44

Download Submit
C:\Windows\System\ZIttOFD.exe

Filesize
2.7MB

MD5
9f16281d38f950ddfb42f91fd6181bd0

SHA1
2bb4c57319f97471c50e9cb3f80a8ba3d82692f0

SHA256
74a6ab95eb056370510502f45bd6589d38b78b78a2767bdd800d0625db163f0c

SHA512
4b7974184893dfdf8083ab6f02e583ffe740e75bf3ee0b0d54a1d203372c07bbc0e6450d97bd074630832875513978100074a8c03f3c940f72966664a96d64e3

Download Submit
C:\Windows\System\ZYnHdtr.exe

Filesize
2.7MB

MD5
f9b7e8445fe9fcfc1cfa0473ac9a0e22

SHA1
2bdc2c6dda835fedfd7077fff6dc01a2413ed158

SHA256
b5cf5c5827a56238e1855227da6d1e8eeea060dedaa7953207b23b95f8d0e69b

SHA512
b0160412023212a96490ff4dfa5bb116ed3e06df5741ef12bf57b328b0eda9f0d6d922162ee11bf8efb233f94f1130bcfa2e2c71d9d23c2b6c688cb81946a90b

Download Submit
C:\Windows\System\ZzJagYD.exe

Filesize
2.7MB

MD5
2aa2415543e3ba7c038f876a7181c5b5

SHA1
7598b3d35b77b846d9773a87038a89ff19a6cbd8

SHA256
a1323f207f76e347ebaaafe8ca086939bcb230ae77b7bd815fa1b6eb721a5f73

SHA512
0a8ee36445722047dd94606da2125253a521c48519d6bcb30e45a1803c42d208167e03669cc47f4f5355123481f677d9dff7e5d234a46f98838bfa5045937bec

Download Submit
C:\Windows\System\aAGGzCF.exe

Filesize
2.7MB

MD5
04a5bb73847b00baca28cd82e5731bfc

SHA1
e1382201bc01ac5b78b4bde301df40f86379fb72

SHA256
ce74fa0df9e27b8b55bdbcac0b648faf5a5b4aa92f9dfe003d46ee3c2bbcbf90

SHA512
f96c25f8a40b7c4383d28d114ba16e1f28ea4dbcc7d90d9e781b7d0e48226797a92ab2c96cd3c9818113704a131b1b5eff48462e8c5a9e8b7ab27c01e2f0668b

Download Submit
C:\Windows\System\atftYqY.exe

Filesize
2.7MB

MD5
d6f92772640e50150c04bde0c19766c1

SHA1
d4ce339dd9b69fc25f1e6ec60e8630ed06e7f046

SHA256
ef69a6de29d9115011894921a85124d0624afeaf548244732f34c62e53ec7f24

SHA512
922da3640bcbd54cacbad61c00a0f98336a0f0d99d04ab6ab30900f57a83ed6c77d10879c9d96a0e91edb91a7fccd54a4aa7e6374ebc74691e8cb1ef8584da1d

Download Submit
C:\Windows\System\dtrTUpu.exe

Filesize
2.7MB

MD5
ef5ad7c69cadbab4f3eeb766553a87f1

SHA1
593072a6c4b464918792909462b2420e973e65bb

SHA256
aeccba646fe8a89ec355216bc83fd9ff5a17b4afb28542883f16a4a838e33820

SHA512
db6959920244b6c29c47005055acfeb7a71b610dea8c321dd1b3aead8d2b826df73a317e63ef6de209eb15d10df2bbe5ce19d50469bf31b4799204aeee0f3717

Download Submit
C:\Windows\System\fzeIbdC.exe

Filesize
2.7MB

MD5
fdd109176e6ed50974b8036cae4e912a

SHA1
4e2621b0102742b85d60dc6a5e5433fe974416c4

SHA256
e3984a1a72d9915c6af1eed186c5270e8a0cb0705ab45488880c1c4e819e1354

SHA512
86a0374f751c8b01cb6f1380ede98720a5ac24347f3b9c5abc4b78e07612717249f638ca5df1bef02c8c19f5f5d286e845ccf9a7f17482ca607ba555aeafa8bf

Download Submit
C:\Windows\System\gMFXZod.exe

Filesize
2.7MB

MD5
1449d4ae696f458eba344308599d888a

SHA1
f3c3475dfce47aeaff4564b7fb091d1fa3c33423

SHA256
ec353ccbf2344d30cfcf382640a76da704624c89e13e39907d061bcd5eb12bf9

SHA512
1dd7043fef1e143d4503cc55fec304ff1a01034c8c601728d49b49fa59ac0ae38dee062df90a2dff221c90999773982634072720cb1b35deada6da55b1ef9c4f

Download Submit
C:\Windows\System\kQIZPoA.exe

Filesize
2.7MB

MD5
c28b057b319ce0ba5b9e31e2d71be78a

SHA1
102106934caf3c4fc01f02fba402533a9019be81

SHA256
b4a71026c90f687524f715b3bbd1a296fcce63ebd1ae0a304b131ce97f087c3a

SHA512
1b8698d4a0c683e28bf874519b91792df00410ec6d9d5a263f26c4965fd413b413d9c40fa313d5ab914339c234794daf603f0bfc6d1f779372133c254458ee23

Download Submit
C:\Windows\System\nhmsEqy.exe

Filesize
2.7MB

MD5
df3c4e0c6f46d39c5056d6545535b093

SHA1
543c1513d2aad3878c494272fe1aa8790e89b438

SHA256
98a4eda53725843e4e0f9377135bfd24b0e20a2640c891727aa74f45551c887b

SHA512
66031102d3c3ce1edd50a914627e424f567a8ef166c4bc0c6514b22d37da053f9054b6ab84b2be24b39f5192524f0ae210bc711829ca35a3dfcd72c074313508

Download Submit
C:\Windows\System\npLDOtg.exe

Filesize
2.7MB

MD5
1c8e7338b569a2da65d80feaf4af9b1e

SHA1
ade5c33b0cebb320aa5d5f8d409dfbce8db8a010

SHA256
a6850f3451254801760280ace622785d3634b0f9a581831bc0372814b56b9cd5

SHA512
c7984cf85dc9daad015769a96ab315f260bcfbeb1843bdd63e658d66ec27f8a8a49775fae1835f96471aba3d8df3cc980bfb81b4636142720424580a38d31656

Download Submit
C:\Windows\System\qRUYESL.exe

Filesize
2.7MB

MD5
70f35e2a2d50a2f4d855911f1c25790a

SHA1
62fe0c1c86ad9a68e454b8b7652d7be0066a3d69

SHA256
4ea22f0a5fbfb5020391cae8d66d4aaf293b28d350d0a00de28f6abaf8bdbacb

SHA512
f3bf3bc5a192896d55a27fc9f24d4f042e2843b323977c869cbe1c9c0442f36b13cb0825f05c282477ce9a742a9b780deff7fd86fb76a6a0c6434ff0529a4227

Download Submit
C:\Windows\System\quqOHsi.exe

Filesize
2.7MB

MD5
659c184cb5349cac47f1de4284435c7c

SHA1
df4703c6d091ebe387b76e7abaeb1dd5ba72f132

SHA256
1562118e9dc2ad80c0d49efadff2a06e65c695c8b9ea0edd5e8142b31ac2ffc6

SHA512
bf12ba808c52ac1a6fbdc28967c9ff123daf9b7d6e45ce7adce8433c7ef96e7ebbb25791fbc228410f1c34e549947ec7053c99247b7e57382dbd86ed40cf6167

Download Submit
C:\Windows\System\rlfGcNW.exe

Filesize
2.7MB

MD5
feea03bab502a98730fe1d69026bceff

SHA1
a1dbbea65b29555e81dfa316b29fd228a495d746

SHA256
c2188613dc9b1bdaad6b44bd7642c9660141034727743504a4b4b01ff32e2e91

SHA512
a7302fd33951057cc65b47786a3c8d3c3dfd51912494d87999ba41b6e5956dfd4bfc9348337cd4fca8e2534fe59e0257dc705feb2957f88b3d554d18371d8e69

Download Submit
C:\Windows\System\swMjdpq.exe

Filesize
2.7MB

MD5
dc451b02eb997ad344603478ab5d9b18

SHA1
0c72dbd4c22f476acfe632d9e3b7aedced442019

SHA256
9b9de865bb22e89080918250578d0147e37b30a79c41aade8f0962ebb3ddcf87

SHA512
500cd612391d40dbcab9dc09aed61d3f5c95519f023435c2aac713fc3f37068e99a15baa01a30e0d488b97ea74540f9edf010df462f6a5ff8fb452cb26bb739b

Download Submit
C:\Windows\System\tGYcoDJ.exe

Filesize
2.7MB

MD5
983ac720893e63603aecaaed584860e4

SHA1
0a6527edbfead45af2346ea7f2001f199c92f586

SHA256
5e0add8b1c14a493b81f8e24163c0d31a649651ae41483955f00450b2bbded50

SHA512
e00178f8e481e98f3e69c4508694c4530b8d979a3ab1723d612901a94c56b47fd29d754fbfdc8dd2fd6c8b9d8d84c8d3790436c80339aca4f90924e29600646a

Download Submit
C:\Windows\System\uLwPbjV.exe

Filesize
2.7MB

MD5
717ef37215eb5e8a9c3dc4f65f95956a

SHA1
0094444f6dba6456769d2c80ac8ebe14a9ccf5fb

SHA256
a3358d4c024d674cd42ec547f79ac481e6a933e0787b3f340efab205d770c85d

SHA512
01b96e65ff65089d462cb87699a20a35acb89f798b133e076179dfb513272b9884bbc32b387d7c57aad0bf843aa1392a6d84259fb0e974b638d4e7e2f6b97ac6

Download Submit
C:\Windows\System\uljpNzF.exe

Filesize
2.7MB

MD5
739ec000c221e1876dd7d7a3c4d10216

SHA1
116288f876e37ab183df65668dfedeae0990d3dc

SHA256
f6ad3bcfb581cf9090661a867fba76c31641f8aa089147c926509ccc923bafec

SHA512
058f1834321cdee4fa2b8751840ae571831f00b4ac76dc03ab06ec734d9337f3823da7d6e64ffa73d2e42a0966e67295a17e238c397f34b09809a41ae57031d9

Download Submit
C:\Windows\System\usWssaD.exe

Filesize
2.7MB

MD5
a19c27178fd8485ed9cc5caab8557128

SHA1
796386d027be077f68b7bc721dfc8b274fdaca3f

SHA256
32fcaac3079809528d9672ef022085adec1b419b55115efd54cf2abf16431914

SHA512
b395cd5c93099fc53c26d2ab191a22c4a7799b87cf423f57305421be4aa2c6393430c5feb656d1bf420258e3b661db8af3df81b05367ef5de57c11f94eb4d715

Download Submit
C:\Windows\System\vNUEglp.exe

Filesize
2.7MB

MD5
855d7027b7cec9d9251faa4aca097bde

SHA1
3091deb91cd0298b361094cd651bb1dcc4d89049

SHA256
82683affe7485eb72086243bde21ef954a0cef0c96ca970258d5cb86fe0f99fd

SHA512
6432f60eca1f04b1664cd5acb71f7830dc0bb1cfb4487cee5a32d4e1eac7aeb81d139366d14cea42ce374960afbd5b70b4611ee0df97c0c4fc3aa72cebcb6b34

Download Submit
C:\Windows\System\viCldVp.exe

Filesize
2.7MB

MD5
218b204127c328896f6b5167ea990bdc

SHA1
8b288dc23a3ec6f8029658bd339097f7476e9bc8

SHA256
9b238f9ba962f27b772d8dd3a4621919db2f3d1b2585690f06c186ca1627956f

SHA512
e2b272afbc23cef240f1d8fa275603bc6300aaf1d525a4c102c65d13af7dceddddbadd68068e789c7a694580d015a5f48c14a569d4158e2ff2c053f486d12eb5

Download Submit
C:\Windows\System\xwSAZyY.exe

Filesize
2.7MB

MD5
9fa0b32d549b0adb8d6bcff523f84334

SHA1
03eb4a1dd75616e13eb101c8832673bec5e5695c

SHA256
d72be8ec9a96ccda2afd69ccf4c4e01957a732a155035044042f52214bf0e94c

SHA512
4b6c54b15b1c40d33f66f6b5f94ea7ecc8182f4d200adb7e47942a6f0c064c84ad0db68644516f720414f4d1354ffb509129cd7ad9b69b9cd31470ea78bda6ae

Download Submit
C:\Windows\System\yAoLgVJ.exe

Filesize
2.7MB

MD5
700ff1b858d3e9ad5872590bc03b1f0b

SHA1
d2f4e2683890b8ffc5b9f5dfb9e1ebdb485ceb78

SHA256
2c4e23380921c74ce0344685300270a4fe0d72d68ce20c093798af4f02accddb

SHA512
98ad9f9ccef2d7d074b04c49cea100adeeef01670696fc97113936d180c7f7e33b17ab90c4340a2e2c0d31ee9071373a20b0c2cb2d094089be7815a79be0e845

Download Submit
C:\Windows\System\zQlvemk.exe

Filesize
2.7MB

MD5
b08c173601c733a541c0872ecb22a371

SHA1
e6a5903ff3ab4447831ec562d08fbab5a11ebbcf

SHA256
f3a70ee517b1197e36ed84bd182c4b75f23cb94ff3157bebfe417c53084e92cf

SHA512
1d0353cf14d67b8f97cf2f8418de9aaab4a810be523bb59955ab4ab60e5aa54983f90e0f423053aef137b4941ca95bd04f1234eca1d4d3614063435e4a32f211

Download Submit
memory/116-286-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp

Filesize
3.9MB

Download
memory/116-2788-0x00007FF7748E0000-0x00007FF774CD2000-memory.dmp

Filesize
3.9MB

Download
memory/736-2794-0x00007FF656A20000-0x00007FF656E12000-memory.dmp

Filesize
3.9MB

Download
memory/736-294-0x00007FF656A20000-0x00007FF656E12000-memory.dmp

Filesize
3.9MB

Download
memory/768-12-0x00007FF791A10000-0x00007FF791E02000-memory.dmp

Filesize
3.9MB

Download
memory/768-2715-0x00007FF791A10000-0x00007FF791E02000-memory.dmp

Filesize
3.9MB

Download
memory/1084-169-0x00007FF738000000-0x00007FF7383F2000-memory.dmp

Filesize
3.9MB

Download
memory/1084-2808-0x00007FF738000000-0x00007FF7383F2000-memory.dmp

Filesize
3.9MB

Download
memory/1176-46-0x00007FF629F40000-0x00007FF62A332000-memory.dmp

Filesize
3.9MB

Download
memory/1176-2711-0x00007FF629F40000-0x00007FF62A332000-memory.dmp

Filesize
3.9MB

Download
memory/1176-2761-0x00007FF629F40000-0x00007FF62A332000-memory.dmp

Filesize
3.9MB

Download
memory/1184-449-0x00000208F1A20000-0x00000208F21C6000-memory.dmp

Filesize
7.6MB

Download
memory/1184-304-0x00000208F0EE0000-0x00000208F0F02000-memory.dmp

Filesize
136KB

Download
memory/1224-2812-0x00007FF7B9550000-0x00007FF7B9942000-memory.dmp

Filesize
3.9MB

Download
memory/1224-246-0x00007FF7B9550000-0x00007FF7B9942000-memory.dmp

Filesize
3.9MB

Download
memory/1300-2816-0x00007FF6D7680000-0x00007FF6D7A72000-memory.dmp

Filesize
3.9MB

Download
memory/1300-2712-0x00007FF6D7680000-0x00007FF6D7A72000-memory.dmp

Filesize
3.9MB

Download
memory/1300-65-0x00007FF6D7680000-0x00007FF6D7A72000-memory.dmp

Filesize
3.9MB

Download
memory/1740-214-0x00007FF704CE0000-0x00007FF7050D2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-2803-0x00007FF704CE0000-0x00007FF7050D2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-217-0x00007FF68A100000-0x00007FF68A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-2801-0x00007FF68A100000-0x00007FF68A4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-288-0x00007FF7ABBF0000-0x00007FF7ABFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-2777-0x00007FF7ABBF0000-0x00007FF7ABFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-2796-0x00007FF7695C0000-0x00007FF7699B2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-262-0x00007FF7695C0000-0x00007FF7699B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-2807-0x00007FF727C10000-0x00007FF728002000-memory.dmp

Filesize
3.9MB

Download
memory/2748-289-0x00007FF727C10000-0x00007FF728002000-memory.dmp

Filesize
3.9MB

Download
memory/2844-2781-0x00007FF737B80000-0x00007FF737F72000-memory.dmp

Filesize
3.9MB

Download
memory/2844-141-0x00007FF737B80000-0x00007FF737F72000-memory.dmp

Filesize
3.9MB

Download
memory/3016-21-0x00007FF741560000-0x00007FF741952000-memory.dmp

Filesize
3.9MB

Download
memory/3016-2709-0x00007FF741560000-0x00007FF741952000-memory.dmp

Filesize
3.9MB

Download
memory/3016-2759-0x00007FF741560000-0x00007FF741952000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2751-0x00007FF7D70C0000-0x00007FF7D74B2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-2783-0x00007FF7D70C0000-0x00007FF7D74B2000-memory.dmp

Filesize
3.9MB

Download
memory/3476-52-0x00007FF7D70C0000-0x00007FF7D74B2000-memory.dmp

Filesize
3.9MB

Download
memory/3532-2772-0x00007FF7B9AE0000-0x00007FF7B9ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3532-271-0x00007FF7B9AE0000-0x00007FF7B9ED2000-memory.dmp

Filesize
3.9MB

Download
memory/3556-2792-0x00007FF6593A0000-0x00007FF659792000-memory.dmp

Filesize
3.9MB

Download
memory/3556-2757-0x00007FF6593A0000-0x00007FF659792000-memory.dmp

Filesize
3.9MB

Download
memory/3556-187-0x00007FF6593A0000-0x00007FF659792000-memory.dmp

Filesize
3.9MB

Download
memory/3696-2814-0x00007FF7D79F0000-0x00007FF7D7DE2000-memory.dmp

Filesize
3.9MB

Download
memory/3696-255-0x00007FF7D79F0000-0x00007FF7D7DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-1-0x000002745D2D0000-0x000002745D2E0000-memory.dmp

Filesize
64KB

Download
memory/4040-0-0x00007FF623DB0000-0x00007FF6241A2000-memory.dmp

Filesize
3.9MB

Download
memory/4328-2753-0x00007FF78EF70000-0x00007FF78F362000-memory.dmp

Filesize
3.9MB

Download
memory/4328-27-0x00007FF78EF70000-0x00007FF78F362000-memory.dmp

Filesize
3.9MB

Download
memory/4328-2710-0x00007FF78EF70000-0x00007FF78F362000-memory.dmp

Filesize
3.9MB

Download
memory/4628-2825-0x00007FF698400000-0x00007FF6987F2000-memory.dmp

Filesize
3.9MB

Download
memory/4628-287-0x00007FF698400000-0x00007FF6987F2000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2787-0x00007FF6E7930000-0x00007FF6E7D22000-memory.dmp

Filesize
3.9MB

Download
memory/4740-96-0x00007FF6E7930000-0x00007FF6E7D22000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2713-0x00007FF6E7930000-0x00007FF6E7D22000-memory.dmp

Filesize
3.9MB

Download
memory/4888-261-0x00007FF7351B0000-0x00007FF7355A2000-memory.dmp

Filesize
3.9MB

Download
memory/4888-2818-0x00007FF7351B0000-0x00007FF7355A2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-256-0x00007FF6A16E0000-0x00007FF6A1AD2000-memory.dmp

Filesize
3.9MB

Download
memory/5012-2799-0x00007FF6A16E0000-0x00007FF6A1AD2000-memory.dmp

Filesize
3.9MB

Download
memory/5068-143-0x00007FF66CC90000-0x00007FF66D082000-memory.dmp

Filesize
3.9MB

Download
memory/5068-2779-0x00007FF66CC90000-0x00007FF66D082000-memory.dmp

Filesize
3.9MB

Download