xmrig | 3d4f3014a829a1a3ececb1bebf864e9e08f83162e6d97d09aff0780f3818f413

Analysis

max time kernel
96s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7926e919626e5d4efaf59657ec758630N.exe
Size

1.2MB
MD5

7926e919626e5d4efaf59657ec758630
SHA1

cd767d6305590b340599b1664e7ec2cc7d577832
SHA256

3d4f3014a829a1a3ececb1bebf864e9e08f83162e6d97d09aff0780f3818f413
SHA512

d3aeb7db8e8f71d16fe59363775c6fb588946d570b102f6ff209f11a01a7c244172f8d4f98d077a0b4afeee8d986436e0e1a63aa80e01622f1753d63abc6163b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMzjkE4OpYOjh2ee70e3/XI:Lz071uv4BPMzsOpSe7

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3200-281-0x00007FF73ABD0000-0x00007FF73AFC2000-memory.dmp	xmrig
behavioral2/memory/4404-490-0x00007FF728190000-0x00007FF728582000-memory.dmp	xmrig
behavioral2/memory/2412-578-0x00007FF7C8A10000-0x00007FF7C8E02000-memory.dmp	xmrig
behavioral2/memory/3828-651-0x00007FF73C090000-0x00007FF73C482000-memory.dmp	xmrig
behavioral2/memory/4160-713-0x00007FF6F25E0000-0x00007FF6F29D2000-memory.dmp	xmrig
behavioral2/memory/2556-820-0x00007FF773080000-0x00007FF773472000-memory.dmp	xmrig
behavioral2/memory/2584-817-0x00007FF66FD20000-0x00007FF670112000-memory.dmp	xmrig
behavioral2/memory/208-816-0x00007FF64D470000-0x00007FF64D862000-memory.dmp	xmrig
behavioral2/memory/2040-799-0x00007FF690CB0000-0x00007FF6910A2000-memory.dmp	xmrig
behavioral2/memory/1124-778-0x00007FF6B0EE0000-0x00007FF6B12D2000-memory.dmp	xmrig
behavioral2/memory/1680-650-0x00007FF713610000-0x00007FF713A02000-memory.dmp	xmrig
behavioral2/memory/1944-285-0x00007FF653050000-0x00007FF653442000-memory.dmp	xmrig
behavioral2/memory/316-284-0x00007FF73ADB0000-0x00007FF73B1A2000-memory.dmp	xmrig
behavioral2/memory/220-283-0x00007FF695550000-0x00007FF695942000-memory.dmp	xmrig
behavioral2/memory/4852-282-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp	xmrig
behavioral2/memory/1368-280-0x00007FF69E860000-0x00007FF69EC52000-memory.dmp	xmrig
behavioral2/memory/2700-1995-0x00007FF765850000-0x00007FF765C42000-memory.dmp	xmrig
behavioral2/memory/368-1996-0x00007FF7E87B0000-0x00007FF7E8BA2000-memory.dmp	xmrig
behavioral2/memory/4960-1997-0x00007FF63AD40000-0x00007FF63B132000-memory.dmp	xmrig
behavioral2/memory/4148-1998-0x00007FF74BEB0000-0x00007FF74C2A2000-memory.dmp	xmrig
behavioral2/memory/4984-1999-0x00007FF780E20000-0x00007FF781212000-memory.dmp	xmrig
behavioral2/memory/3096-2000-0x00007FF605770000-0x00007FF605B62000-memory.dmp	xmrig
behavioral2/memory/932-2001-0x00007FF6436E0000-0x00007FF643AD2000-memory.dmp	xmrig
behavioral2/memory/2060-2002-0x00007FF628D60000-0x00007FF629152000-memory.dmp	xmrig
behavioral2/memory/2700-2008-0x00007FF765850000-0x00007FF765C42000-memory.dmp	xmrig
behavioral2/memory/368-2010-0x00007FF7E87B0000-0x00007FF7E8BA2000-memory.dmp	xmrig
behavioral2/memory/4960-2012-0x00007FF63AD40000-0x00007FF63B132000-memory.dmp	xmrig
behavioral2/memory/2040-2014-0x00007FF690CB0000-0x00007FF6910A2000-memory.dmp	xmrig
behavioral2/memory/3096-2016-0x00007FF605770000-0x00007FF605B62000-memory.dmp	xmrig
behavioral2/memory/4984-2028-0x00007FF780E20000-0x00007FF781212000-memory.dmp	xmrig
behavioral2/memory/4852-2027-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp	xmrig
behavioral2/memory/4148-2024-0x00007FF74BEB0000-0x00007FF74C2A2000-memory.dmp	xmrig
behavioral2/memory/2584-2023-0x00007FF66FD20000-0x00007FF670112000-memory.dmp	xmrig
behavioral2/memory/316-2020-0x00007FF73ADB0000-0x00007FF73B1A2000-memory.dmp	xmrig
behavioral2/memory/220-2019-0x00007FF695550000-0x00007FF695942000-memory.dmp	xmrig
behavioral2/memory/3828-2031-0x00007FF73C090000-0x00007FF73C482000-memory.dmp	xmrig
behavioral2/memory/3200-2032-0x00007FF73ABD0000-0x00007FF73AFC2000-memory.dmp	xmrig
behavioral2/memory/1680-2045-0x00007FF713610000-0x00007FF713A02000-memory.dmp	xmrig
behavioral2/memory/1368-2050-0x00007FF69E860000-0x00007FF69EC52000-memory.dmp	xmrig
behavioral2/memory/4160-2049-0x00007FF6F25E0000-0x00007FF6F29D2000-memory.dmp	xmrig
behavioral2/memory/2060-2052-0x00007FF628D60000-0x00007FF629152000-memory.dmp	xmrig
behavioral2/memory/1944-2048-0x00007FF653050000-0x00007FF653442000-memory.dmp	xmrig
behavioral2/memory/4404-2047-0x00007FF728190000-0x00007FF728582000-memory.dmp	xmrig
behavioral2/memory/208-2046-0x00007FF64D470000-0x00007FF64D862000-memory.dmp	xmrig
behavioral2/memory/932-2064-0x00007FF6436E0000-0x00007FF643AD2000-memory.dmp	xmrig
behavioral2/memory/2412-2071-0x00007FF7C8A10000-0x00007FF7C8E02000-memory.dmp	xmrig
behavioral2/memory/1124-2081-0x00007FF6B0EE0000-0x00007FF6B12D2000-memory.dmp	xmrig
behavioral2/memory/2556-2072-0x00007FF773080000-0x00007FF773472000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	4772	powershell.exe
12	4772	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4772	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2700	slqTGCg.exe
368	qvXrMYY.exe
2040	WZaZlom.exe
3096	eMzpLLX.exe
4960	HFGRosa.exe
208	oqMLdmI.exe
4148	SgdpyMg.exe
4984	OVuzfRA.exe
1368	uzzMIFw.exe
3200	btTdFgL.exe
4852	MUobzax.exe
2584	LvocqpW.exe
220	zReikSf.exe
316	PcgjzmB.exe
1944	rhPRetA.exe
932	OnDOzdw.exe
2060	VmXhROu.exe
2556	ZcrHZlH.exe
4404	NUpWuCj.exe
2412	JlycaqH.exe
1680	HkekybR.exe
3828	VEALyhE.exe
4160	emAurvz.exe
1124	qcfEjiF.exe
4208	xjlPTXj.exe
3596	rrgWSEO.exe
812	phaPzre.exe
4132	YGWRwlS.exe
3888	ACjPQFW.exe
876	qXPfAbO.exe
1684	RDyCQay.exe
436	TDjVaUj.exe
5044	rKYArEw.exe
4440	wBcOJmv.exe
2156	kERzchH.exe
4008	nVArgsU.exe
4016	zBFnTET.exe
4924	KXRhXSk.exe
4556	cNDKnII.exe
872	eljcGRs.exe
4948	CAEYvEV.exe
4916	OMaJArg.exe
3220	kSHIhYh.exe
4476	VdOJFNv.exe
5092	qUOFxRq.exe
2624	fIETTbd.exe
448	PODbEpL.exe
3196	VKlsXwx.exe
1516	otvXkUX.exe
1376	zJtxxPD.exe
2840	WOPMOLZ.exe
1316	jakHhuq.exe
1384	mnjsHKP.exe
4888	mREUxsR.exe
1700	RaDUpPo.exe
1180	obPfMgK.exe
3640	ALJtukb.exe
3760	NOjiCMf.exe
1456	XzHMptJ.exe
3852	uWrhSdc.exe
3880	kZGArhq.exe
4788	dTBiWqo.exe
1240	PlYlrOC.exe
1948	nYnRjBs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4508-0-0x00007FF65E9F0000-0x00007FF65EDE2000-memory.dmp	upx
behavioral2/memory/368-29-0x00007FF7E87B0000-0x00007FF7E8BA2000-memory.dmp	upx
behavioral2/files/0x00070000000234cc-47.dat	upx
behavioral2/files/0x00070000000234c6-68.dat	upx
behavioral2/files/0x00070000000234cd-107.dat	upx
behavioral2/files/0x00070000000234f1-229.dat	upx
behavioral2/memory/3200-281-0x00007FF73ABD0000-0x00007FF73AFC2000-memory.dmp	upx
behavioral2/memory/4404-490-0x00007FF728190000-0x00007FF728582000-memory.dmp	upx
behavioral2/memory/2412-578-0x00007FF7C8A10000-0x00007FF7C8E02000-memory.dmp	upx
behavioral2/memory/3828-651-0x00007FF73C090000-0x00007FF73C482000-memory.dmp	upx
behavioral2/memory/4160-713-0x00007FF6F25E0000-0x00007FF6F29D2000-memory.dmp	upx
behavioral2/memory/2556-820-0x00007FF773080000-0x00007FF773472000-memory.dmp	upx
behavioral2/memory/2584-817-0x00007FF66FD20000-0x00007FF670112000-memory.dmp	upx
behavioral2/memory/208-816-0x00007FF64D470000-0x00007FF64D862000-memory.dmp	upx
behavioral2/memory/2040-799-0x00007FF690CB0000-0x00007FF6910A2000-memory.dmp	upx
behavioral2/memory/1124-778-0x00007FF6B0EE0000-0x00007FF6B12D2000-memory.dmp	upx
behavioral2/memory/1680-650-0x00007FF713610000-0x00007FF713A02000-memory.dmp	upx
behavioral2/memory/2060-287-0x00007FF628D60000-0x00007FF629152000-memory.dmp	upx
behavioral2/memory/932-286-0x00007FF6436E0000-0x00007FF643AD2000-memory.dmp	upx
behavioral2/memory/1944-285-0x00007FF653050000-0x00007FF653442000-memory.dmp	upx
behavioral2/memory/316-284-0x00007FF73ADB0000-0x00007FF73B1A2000-memory.dmp	upx
behavioral2/memory/220-283-0x00007FF695550000-0x00007FF695942000-memory.dmp	upx
behavioral2/memory/4852-282-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp	upx
behavioral2/memory/1368-280-0x00007FF69E860000-0x00007FF69EC52000-memory.dmp	upx
behavioral2/files/0x00070000000234df-226.dat	upx
behavioral2/files/0x00070000000234ef-220.dat	upx
behavioral2/files/0x00070000000234f0-219.dat	upx
behavioral2/files/0x00070000000234de-210.dat	upx
behavioral2/files/0x00070000000234ee-209.dat	upx
behavioral2/files/0x00070000000234ed-208.dat	upx
behavioral2/files/0x00070000000234ec-207.dat	upx
behavioral2/files/0x00070000000234eb-206.dat	upx
behavioral2/files/0x00070000000234ea-205.dat	upx
behavioral2/files/0x00070000000234e9-204.dat	upx
behavioral2/files/0x00070000000234e8-200.dat	upx
behavioral2/files/0x00070000000234d1-196.dat	upx
behavioral2/files/0x00070000000234e6-188.dat	upx
behavioral2/files/0x00070000000234e4-184.dat	upx
behavioral2/files/0x00070000000234e1-172.dat	upx
behavioral2/files/0x00070000000234e0-171.dat	upx
behavioral2/memory/4984-163-0x00007FF780E20000-0x00007FF781212000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-154.dat	upx
behavioral2/files/0x00070000000234cf-137.dat	upx
behavioral2/files/0x00070000000234ce-132.dat	upx
behavioral2/files/0x00070000000234dd-130.dat	upx
behavioral2/files/0x00070000000234db-123.dat	upx
behavioral2/files/0x00070000000234c8-122.dat	upx
behavioral2/files/0x00070000000234da-121.dat	upx
behavioral2/files/0x00070000000234d9-119.dat	upx
behavioral2/files/0x00070000000234d8-118.dat	upx
behavioral2/files/0x00070000000234e7-189.dat	upx
behavioral2/files/0x00070000000234cb-108.dat	upx
behavioral2/files/0x00070000000234d7-106.dat	upx
behavioral2/files/0x00070000000234e3-177.dat	upx
behavioral2/files/0x00070000000234d6-103.dat	upx
behavioral2/files/0x00070000000234e2-175.dat	upx
behavioral2/files/0x00070000000234ca-96.dat	upx
behavioral2/files/0x00070000000234dc-127.dat	upx
behavioral2/files/0x00070000000234c9-84.dat	upx
behavioral2/memory/4148-80-0x00007FF74BEB0000-0x00007FF74C2A2000-memory.dmp	upx
behavioral2/files/0x00070000000234d3-79.dat	upx
behavioral2/files/0x00070000000234d2-76.dat	upx
behavioral2/files/0x00070000000234d5-102.dat	upx
behavioral2/files/0x00070000000234d4-94.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jmVbVZT.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\APNRFwn.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\NrDqQtF.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\VqUglgj.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\kquaNdm.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\wtUnOTm.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\BkZNoNW.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\iLurOPc.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\zFFYUWA.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\WOPMOLZ.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\QyVgtXW.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\XGmyIHe.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\MiJlfoj.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\XYfjcAT.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\LKqINvw.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\bpWmZcT.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\lEGmOzX.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\lRYtISw.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\ZzFkAxH.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\pQjoVwf.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\WkbHXxm.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\RlJOjLe.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\quWoULT.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\xfxXfUH.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\Cvdzfwt.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\obPfMgK.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\McLTliH.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\UyFsssS.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\vIfCMvp.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\DLLxnUP.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\fdLDdls.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\TqzyXwa.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\fulVYWX.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\zluCxJb.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\ohQMYKX.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\XlCDpUo.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\phaPzre.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\eFoKAgD.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\ZACEPlA.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\owdAgOF.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\koXtXqZ.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\nYnRjBs.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\IvAySQm.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\xRRVByX.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\fgZLnpn.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\bnewOEk.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\nIHbNXY.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\NTiNOwh.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\emAurvz.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\XzHMptJ.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\flUKUyB.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\gjbopvy.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\pYIoQLh.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\qcOOTvG.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\EVhZErB.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\nVArgsU.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\LbezUek.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\iakZuJp.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\vvWVCCX.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\vzZXzuG.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\ygdeYZL.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\qLIGycL.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\xFsjXIW.exe	7926e919626e5d4efaf59657ec758630N.exe
File created	C:\Windows\System\kqlEoxn.exe	7926e919626e5d4efaf59657ec758630N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4772	powershell.exe
4772	powershell.exe
4772	powershell.exe
4772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4508	7926e919626e5d4efaf59657ec758630N.exe
Token: SeLockMemoryPrivilege	4508	7926e919626e5d4efaf59657ec758630N.exe
Token: SeDebugPrivilege	4772	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4772	4508	7926e919626e5d4efaf59657ec758630N.exe	86
PID 4508 wrote to memory of 4772	4508	7926e919626e5d4efaf59657ec758630N.exe	86
PID 4508 wrote to memory of 2700	4508	7926e919626e5d4efaf59657ec758630N.exe	87
PID 4508 wrote to memory of 2700	4508	7926e919626e5d4efaf59657ec758630N.exe	87
PID 4508 wrote to memory of 368	4508	7926e919626e5d4efaf59657ec758630N.exe	88
PID 4508 wrote to memory of 368	4508	7926e919626e5d4efaf59657ec758630N.exe	88
PID 4508 wrote to memory of 2040	4508	7926e919626e5d4efaf59657ec758630N.exe	89
PID 4508 wrote to memory of 2040	4508	7926e919626e5d4efaf59657ec758630N.exe	89
PID 4508 wrote to memory of 3096	4508	7926e919626e5d4efaf59657ec758630N.exe	90
PID 4508 wrote to memory of 3096	4508	7926e919626e5d4efaf59657ec758630N.exe	90
PID 4508 wrote to memory of 4960	4508	7926e919626e5d4efaf59657ec758630N.exe	91
PID 4508 wrote to memory of 4960	4508	7926e919626e5d4efaf59657ec758630N.exe	91
PID 4508 wrote to memory of 208	4508	7926e919626e5d4efaf59657ec758630N.exe	92
PID 4508 wrote to memory of 208	4508	7926e919626e5d4efaf59657ec758630N.exe	92
PID 4508 wrote to memory of 4148	4508	7926e919626e5d4efaf59657ec758630N.exe	93
PID 4508 wrote to memory of 4148	4508	7926e919626e5d4efaf59657ec758630N.exe	93
PID 4508 wrote to memory of 4984	4508	7926e919626e5d4efaf59657ec758630N.exe	94
PID 4508 wrote to memory of 4984	4508	7926e919626e5d4efaf59657ec758630N.exe	94
PID 4508 wrote to memory of 1368	4508	7926e919626e5d4efaf59657ec758630N.exe	95
PID 4508 wrote to memory of 1368	4508	7926e919626e5d4efaf59657ec758630N.exe	95
PID 4508 wrote to memory of 3200	4508	7926e919626e5d4efaf59657ec758630N.exe	96
PID 4508 wrote to memory of 3200	4508	7926e919626e5d4efaf59657ec758630N.exe	96
PID 4508 wrote to memory of 4852	4508	7926e919626e5d4efaf59657ec758630N.exe	97
PID 4508 wrote to memory of 4852	4508	7926e919626e5d4efaf59657ec758630N.exe	97
PID 4508 wrote to memory of 2584	4508	7926e919626e5d4efaf59657ec758630N.exe	98
PID 4508 wrote to memory of 2584	4508	7926e919626e5d4efaf59657ec758630N.exe	98
PID 4508 wrote to memory of 220	4508	7926e919626e5d4efaf59657ec758630N.exe	99
PID 4508 wrote to memory of 220	4508	7926e919626e5d4efaf59657ec758630N.exe	99
PID 4508 wrote to memory of 316	4508	7926e919626e5d4efaf59657ec758630N.exe	100
PID 4508 wrote to memory of 316	4508	7926e919626e5d4efaf59657ec758630N.exe	100
PID 4508 wrote to memory of 1944	4508	7926e919626e5d4efaf59657ec758630N.exe	101
PID 4508 wrote to memory of 1944	4508	7926e919626e5d4efaf59657ec758630N.exe	101
PID 4508 wrote to memory of 932	4508	7926e919626e5d4efaf59657ec758630N.exe	102
PID 4508 wrote to memory of 932	4508	7926e919626e5d4efaf59657ec758630N.exe	102
PID 4508 wrote to memory of 2060	4508	7926e919626e5d4efaf59657ec758630N.exe	103
PID 4508 wrote to memory of 2060	4508	7926e919626e5d4efaf59657ec758630N.exe	103
PID 4508 wrote to memory of 2556	4508	7926e919626e5d4efaf59657ec758630N.exe	104
PID 4508 wrote to memory of 2556	4508	7926e919626e5d4efaf59657ec758630N.exe	104
PID 4508 wrote to memory of 4404	4508	7926e919626e5d4efaf59657ec758630N.exe	105
PID 4508 wrote to memory of 4404	4508	7926e919626e5d4efaf59657ec758630N.exe	105
PID 4508 wrote to memory of 2412	4508	7926e919626e5d4efaf59657ec758630N.exe	106
PID 4508 wrote to memory of 2412	4508	7926e919626e5d4efaf59657ec758630N.exe	106
PID 4508 wrote to memory of 1680	4508	7926e919626e5d4efaf59657ec758630N.exe	107
PID 4508 wrote to memory of 1680	4508	7926e919626e5d4efaf59657ec758630N.exe	107
PID 4508 wrote to memory of 3828	4508	7926e919626e5d4efaf59657ec758630N.exe	108
PID 4508 wrote to memory of 3828	4508	7926e919626e5d4efaf59657ec758630N.exe	108
PID 4508 wrote to memory of 4160	4508	7926e919626e5d4efaf59657ec758630N.exe	109
PID 4508 wrote to memory of 4160	4508	7926e919626e5d4efaf59657ec758630N.exe	109
PID 4508 wrote to memory of 1124	4508	7926e919626e5d4efaf59657ec758630N.exe	110
PID 4508 wrote to memory of 1124	4508	7926e919626e5d4efaf59657ec758630N.exe	110
PID 4508 wrote to memory of 4208	4508	7926e919626e5d4efaf59657ec758630N.exe	111
PID 4508 wrote to memory of 4208	4508	7926e919626e5d4efaf59657ec758630N.exe	111
PID 4508 wrote to memory of 3596	4508	7926e919626e5d4efaf59657ec758630N.exe	112
PID 4508 wrote to memory of 3596	4508	7926e919626e5d4efaf59657ec758630N.exe	112
PID 4508 wrote to memory of 812	4508	7926e919626e5d4efaf59657ec758630N.exe	113
PID 4508 wrote to memory of 812	4508	7926e919626e5d4efaf59657ec758630N.exe	113
PID 4508 wrote to memory of 4132	4508	7926e919626e5d4efaf59657ec758630N.exe	114
PID 4508 wrote to memory of 4132	4508	7926e919626e5d4efaf59657ec758630N.exe	114
PID 4508 wrote to memory of 3888	4508	7926e919626e5d4efaf59657ec758630N.exe	115
PID 4508 wrote to memory of 3888	4508	7926e919626e5d4efaf59657ec758630N.exe	115
PID 4508 wrote to memory of 876	4508	7926e919626e5d4efaf59657ec758630N.exe	116
PID 4508 wrote to memory of 876	4508	7926e919626e5d4efaf59657ec758630N.exe	116
PID 4508 wrote to memory of 1684	4508	7926e919626e5d4efaf59657ec758630N.exe	117
PID 4508 wrote to memory of 1684	4508	7926e919626e5d4efaf59657ec758630N.exe	117

C:\Users\Admin\AppData\Local\Temp\7926e919626e5d4efaf59657ec758630N.exe
"C:\Users\Admin\AppData\Local\Temp\7926e919626e5d4efaf59657ec758630N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4772" "2984" "2912" "2988" "0" "0" "2992" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13192
- C:\Windows\System\slqTGCg.exe
  C:\Windows\System\slqTGCg.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\qvXrMYY.exe
  C:\Windows\System\qvXrMYY.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\WZaZlom.exe
  C:\Windows\System\WZaZlom.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\eMzpLLX.exe
  C:\Windows\System\eMzpLLX.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\HFGRosa.exe
  C:\Windows\System\HFGRosa.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\oqMLdmI.exe
  C:\Windows\System\oqMLdmI.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\SgdpyMg.exe
  C:\Windows\System\SgdpyMg.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\OVuzfRA.exe
  C:\Windows\System\OVuzfRA.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\uzzMIFw.exe
  C:\Windows\System\uzzMIFw.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\btTdFgL.exe
  C:\Windows\System\btTdFgL.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\MUobzax.exe
  C:\Windows\System\MUobzax.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\LvocqpW.exe
  C:\Windows\System\LvocqpW.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\zReikSf.exe
  C:\Windows\System\zReikSf.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\PcgjzmB.exe
  C:\Windows\System\PcgjzmB.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\rhPRetA.exe
  C:\Windows\System\rhPRetA.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\OnDOzdw.exe
  C:\Windows\System\OnDOzdw.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\VmXhROu.exe
  C:\Windows\System\VmXhROu.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ZcrHZlH.exe
  C:\Windows\System\ZcrHZlH.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\NUpWuCj.exe
  C:\Windows\System\NUpWuCj.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\JlycaqH.exe
  C:\Windows\System\JlycaqH.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\HkekybR.exe
  C:\Windows\System\HkekybR.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\VEALyhE.exe
  C:\Windows\System\VEALyhE.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\emAurvz.exe
  C:\Windows\System\emAurvz.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\qcfEjiF.exe
  C:\Windows\System\qcfEjiF.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\xjlPTXj.exe
  C:\Windows\System\xjlPTXj.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\rrgWSEO.exe
  C:\Windows\System\rrgWSEO.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\phaPzre.exe
  C:\Windows\System\phaPzre.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\YGWRwlS.exe
  C:\Windows\System\YGWRwlS.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\ACjPQFW.exe
  C:\Windows\System\ACjPQFW.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\qXPfAbO.exe
  C:\Windows\System\qXPfAbO.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\RDyCQay.exe
  C:\Windows\System\RDyCQay.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\TDjVaUj.exe
  C:\Windows\System\TDjVaUj.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\rKYArEw.exe
  C:\Windows\System\rKYArEw.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\wBcOJmv.exe
  C:\Windows\System\wBcOJmv.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\uWrhSdc.exe
  C:\Windows\System\uWrhSdc.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\kERzchH.exe
  C:\Windows\System\kERzchH.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\nVArgsU.exe
  C:\Windows\System\nVArgsU.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\zBFnTET.exe
  C:\Windows\System\zBFnTET.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\KXRhXSk.exe
  C:\Windows\System\KXRhXSk.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\cNDKnII.exe
  C:\Windows\System\cNDKnII.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\eljcGRs.exe
  C:\Windows\System\eljcGRs.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\CAEYvEV.exe
  C:\Windows\System\CAEYvEV.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\OMaJArg.exe
  C:\Windows\System\OMaJArg.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\kSHIhYh.exe
  C:\Windows\System\kSHIhYh.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\VdOJFNv.exe
  C:\Windows\System\VdOJFNv.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\qUOFxRq.exe
  C:\Windows\System\qUOFxRq.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\fIETTbd.exe
  C:\Windows\System\fIETTbd.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\PODbEpL.exe
  C:\Windows\System\PODbEpL.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\VKlsXwx.exe
  C:\Windows\System\VKlsXwx.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\otvXkUX.exe
  C:\Windows\System\otvXkUX.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\zJtxxPD.exe
  C:\Windows\System\zJtxxPD.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\WOPMOLZ.exe
  C:\Windows\System\WOPMOLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\jakHhuq.exe
  C:\Windows\System\jakHhuq.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\mnjsHKP.exe
  C:\Windows\System\mnjsHKP.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\mREUxsR.exe
  C:\Windows\System\mREUxsR.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\RaDUpPo.exe
  C:\Windows\System\RaDUpPo.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\obPfMgK.exe
  C:\Windows\System\obPfMgK.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ALJtukb.exe
  C:\Windows\System\ALJtukb.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\NOjiCMf.exe
  C:\Windows\System\NOjiCMf.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\XzHMptJ.exe
  C:\Windows\System\XzHMptJ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\kZGArhq.exe
  C:\Windows\System\kZGArhq.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\dTBiWqo.exe
  C:\Windows\System\dTBiWqo.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\PlYlrOC.exe
  C:\Windows\System\PlYlrOC.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\nYnRjBs.exe
  C:\Windows\System\nYnRjBs.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ZzFkAxH.exe
  C:\Windows\System\ZzFkAxH.exe
  2⤵
  PID:4444
- C:\Windows\System\xKYdMMO.exe
  C:\Windows\System\xKYdMMO.exe
  2⤵
  PID:3100
- C:\Windows\System\fvTGrjW.exe
  C:\Windows\System\fvTGrjW.exe
  2⤵
  PID:744
- C:\Windows\System\fdLDdls.exe
  C:\Windows\System\fdLDdls.exe
  2⤵
  PID:224
- C:\Windows\System\bKQVHdB.exe
  C:\Windows\System\bKQVHdB.exe
  2⤵
  PID:4336
- C:\Windows\System\HcexaRD.exe
  C:\Windows\System\HcexaRD.exe
  2⤵
  PID:4820
- C:\Windows\System\oZbEQua.exe
  C:\Windows\System\oZbEQua.exe
  2⤵
  PID:4812
- C:\Windows\System\fOqnyWX.exe
  C:\Windows\System\fOqnyWX.exe
  2⤵
  PID:4004
- C:\Windows\System\cpMNTFs.exe
  C:\Windows\System\cpMNTFs.exe
  2⤵
  PID:1328
- C:\Windows\System\rMRgOut.exe
  C:\Windows\System\rMRgOut.exe
  2⤵
  PID:1192
- C:\Windows\System\oKzoMka.exe
  C:\Windows\System\oKzoMka.exe
  2⤵
  PID:3280
- C:\Windows\System\TRJOntW.exe
  C:\Windows\System\TRJOntW.exe
  2⤵
  PID:5144
- C:\Windows\System\ZgZNORG.exe
  C:\Windows\System\ZgZNORG.exe
  2⤵
  PID:5160
- C:\Windows\System\GWMrNkH.exe
  C:\Windows\System\GWMrNkH.exe
  2⤵
  PID:5192
- C:\Windows\System\AVdBnhl.exe
  C:\Windows\System\AVdBnhl.exe
  2⤵
  PID:5208
- C:\Windows\System\MkoHHSS.exe
  C:\Windows\System\MkoHHSS.exe
  2⤵
  PID:5224
- C:\Windows\System\DYdKsmy.exe
  C:\Windows\System\DYdKsmy.exe
  2⤵
  PID:5240
- C:\Windows\System\luczeiz.exe
  C:\Windows\System\luczeiz.exe
  2⤵
  PID:5260
- C:\Windows\System\hnALUWG.exe
  C:\Windows\System\hnALUWG.exe
  2⤵
  PID:5280
- C:\Windows\System\kqlEoxn.exe
  C:\Windows\System\kqlEoxn.exe
  2⤵
  PID:5296
- C:\Windows\System\oTjMHmM.exe
  C:\Windows\System\oTjMHmM.exe
  2⤵
  PID:5316
- C:\Windows\System\pQjoVwf.exe
  C:\Windows\System\pQjoVwf.exe
  2⤵
  PID:5340
- C:\Windows\System\uubRQpz.exe
  C:\Windows\System\uubRQpz.exe
  2⤵
  PID:5356
- C:\Windows\System\koEeNVa.exe
  C:\Windows\System\koEeNVa.exe
  2⤵
  PID:5376
- C:\Windows\System\tnUpRrc.exe
  C:\Windows\System\tnUpRrc.exe
  2⤵
  PID:5404
- C:\Windows\System\NWkYStu.exe
  C:\Windows\System\NWkYStu.exe
  2⤵
  PID:5428
- C:\Windows\System\XfuCrcx.exe
  C:\Windows\System\XfuCrcx.exe
  2⤵
  PID:5552
- C:\Windows\System\qqUrbKA.exe
  C:\Windows\System\qqUrbKA.exe
  2⤵
  PID:5568
- C:\Windows\System\TgvgctZ.exe
  C:\Windows\System\TgvgctZ.exe
  2⤵
  PID:5584
- C:\Windows\System\TTAvoTC.exe
  C:\Windows\System\TTAvoTC.exe
  2⤵
  PID:5600
- C:\Windows\System\goZCbJj.exe
  C:\Windows\System\goZCbJj.exe
  2⤵
  PID:5616
- C:\Windows\System\OLrsAyd.exe
  C:\Windows\System\OLrsAyd.exe
  2⤵
  PID:5632
- C:\Windows\System\QAFjtFK.exe
  C:\Windows\System\QAFjtFK.exe
  2⤵
  PID:5648
- C:\Windows\System\TqzyXwa.exe
  C:\Windows\System\TqzyXwa.exe
  2⤵
  PID:5664
- C:\Windows\System\gieTdro.exe
  C:\Windows\System\gieTdro.exe
  2⤵
  PID:5680
- C:\Windows\System\FDcHHAU.exe
  C:\Windows\System\FDcHHAU.exe
  2⤵
  PID:5696
- C:\Windows\System\mVrrneV.exe
  C:\Windows\System\mVrrneV.exe
  2⤵
  PID:5716
- C:\Windows\System\qEyxFBh.exe
  C:\Windows\System\qEyxFBh.exe
  2⤵
  PID:5732
- C:\Windows\System\WXDDIbn.exe
  C:\Windows\System\WXDDIbn.exe
  2⤵
  PID:5748
- C:\Windows\System\uHTvkjo.exe
  C:\Windows\System\uHTvkjo.exe
  2⤵
  PID:5764
- C:\Windows\System\mqNZsEl.exe
  C:\Windows\System\mqNZsEl.exe
  2⤵
  PID:5780
- C:\Windows\System\hzHqIDK.exe
  C:\Windows\System\hzHqIDK.exe
  2⤵
  PID:5796
- C:\Windows\System\pxSqAJL.exe
  C:\Windows\System\pxSqAJL.exe
  2⤵
  PID:5820
- C:\Windows\System\pbEJlQa.exe
  C:\Windows\System\pbEJlQa.exe
  2⤵
  PID:5840
- C:\Windows\System\QFIhJid.exe
  C:\Windows\System\QFIhJid.exe
  2⤵
  PID:5856
- C:\Windows\System\ftOgSbZ.exe
  C:\Windows\System\ftOgSbZ.exe
  2⤵
  PID:5876
- C:\Windows\System\sQRQmLx.exe
  C:\Windows\System\sQRQmLx.exe
  2⤵
  PID:5904
- C:\Windows\System\HrhVpuX.exe
  C:\Windows\System\HrhVpuX.exe
  2⤵
  PID:5920
- C:\Windows\System\rteebJo.exe
  C:\Windows\System\rteebJo.exe
  2⤵
  PID:5936
- C:\Windows\System\VpDFgYE.exe
  C:\Windows\System\VpDFgYE.exe
  2⤵
  PID:5960
- C:\Windows\System\QbTrpZK.exe
  C:\Windows\System\QbTrpZK.exe
  2⤵
  PID:5976
- C:\Windows\System\lAUpcgQ.exe
  C:\Windows\System\lAUpcgQ.exe
  2⤵
  PID:5992
- C:\Windows\System\qYjAuZP.exe
  C:\Windows\System\qYjAuZP.exe
  2⤵
  PID:6008
- C:\Windows\System\ynzeSrl.exe
  C:\Windows\System\ynzeSrl.exe
  2⤵
  PID:6032
- C:\Windows\System\wXzSFuN.exe
  C:\Windows\System\wXzSFuN.exe
  2⤵
  PID:6048
- C:\Windows\System\woDQxwo.exe
  C:\Windows\System\woDQxwo.exe
  2⤵
  PID:6068
- C:\Windows\System\OuKgYAR.exe
  C:\Windows\System\OuKgYAR.exe
  2⤵
  PID:6084
- C:\Windows\System\qulfyTd.exe
  C:\Windows\System\qulfyTd.exe
  2⤵
  PID:6104
- C:\Windows\System\STlVuKQ.exe
  C:\Windows\System\STlVuKQ.exe
  2⤵
  PID:6120
- C:\Windows\System\aGhxXic.exe
  C:\Windows\System\aGhxXic.exe
  2⤵
  PID:6136
- C:\Windows\System\gghnoNm.exe
  C:\Windows\System\gghnoNm.exe
  2⤵
  PID:3260
- C:\Windows\System\kquaNdm.exe
  C:\Windows\System\kquaNdm.exe
  2⤵
  PID:1448
- C:\Windows\System\RjtJbeL.exe
  C:\Windows\System\RjtJbeL.exe
  2⤵
  PID:4492
- C:\Windows\System\wYhXFsV.exe
  C:\Windows\System\wYhXFsV.exe
  2⤵
  PID:4340
- C:\Windows\System\upMYvIp.exe
  C:\Windows\System\upMYvIp.exe
  2⤵
  PID:4420
- C:\Windows\System\WkbHXxm.exe
  C:\Windows\System\WkbHXxm.exe
  2⤵
  PID:4600
- C:\Windows\System\NMJGQci.exe
  C:\Windows\System\NMJGQci.exe
  2⤵
  PID:2904
- C:\Windows\System\XEoUxRM.exe
  C:\Windows\System\XEoUxRM.exe
  2⤵
  PID:1668
- C:\Windows\System\IxYVrcE.exe
  C:\Windows\System\IxYVrcE.exe
  2⤵
  PID:2780
- C:\Windows\System\ZkZoBUE.exe
  C:\Windows\System\ZkZoBUE.exe
  2⤵
  PID:3936
- C:\Windows\System\eYKQMHu.exe
  C:\Windows\System\eYKQMHu.exe
  2⤵
  PID:2352
- C:\Windows\System\mFRelcL.exe
  C:\Windows\System\mFRelcL.exe
  2⤵
  PID:3240
- C:\Windows\System\uIKErXj.exe
  C:\Windows\System\uIKErXj.exe
  2⤵
  PID:2364
- C:\Windows\System\FRlHsek.exe
  C:\Windows\System\FRlHsek.exe
  2⤵
  PID:4768
- C:\Windows\System\FKcIUjb.exe
  C:\Windows\System\FKcIUjb.exe
  2⤵
  PID:5060
- C:\Windows\System\OseeWdN.exe
  C:\Windows\System\OseeWdN.exe
  2⤵
  PID:1200
- C:\Windows\System\wZrvAVN.exe
  C:\Windows\System\wZrvAVN.exe
  2⤵
  PID:4724
- C:\Windows\System\lRYtISw.exe
  C:\Windows\System\lRYtISw.exe
  2⤵
  PID:5392
- C:\Windows\System\uqJrvns.exe
  C:\Windows\System\uqJrvns.exe
  2⤵
  PID:2368
- C:\Windows\System\oJXdMVZ.exe
  C:\Windows\System\oJXdMVZ.exe
  2⤵
  PID:1172
- C:\Windows\System\gAYWVsA.exe
  C:\Windows\System\gAYWVsA.exe
  2⤵
  PID:5180
- C:\Windows\System\XcUDYZX.exe
  C:\Windows\System\XcUDYZX.exe
  2⤵
  PID:5216
- C:\Windows\System\PvdrJXV.exe
  C:\Windows\System\PvdrJXV.exe
  2⤵
  PID:6148
- C:\Windows\System\gwAfXLO.exe
  C:\Windows\System\gwAfXLO.exe
  2⤵
  PID:6168
- C:\Windows\System\iNzxDmr.exe
  C:\Windows\System\iNzxDmr.exe
  2⤵
  PID:6184
- C:\Windows\System\RlpUhbF.exe
  C:\Windows\System\RlpUhbF.exe
  2⤵
  PID:6204
- C:\Windows\System\myHjKTJ.exe
  C:\Windows\System\myHjKTJ.exe
  2⤵
  PID:6220
- C:\Windows\System\wDvzqhb.exe
  C:\Windows\System\wDvzqhb.exe
  2⤵
  PID:6244
- C:\Windows\System\NQrdYit.exe
  C:\Windows\System\NQrdYit.exe
  2⤵
  PID:6260
- C:\Windows\System\KUuePAn.exe
  C:\Windows\System\KUuePAn.exe
  2⤵
  PID:6284
- C:\Windows\System\XIpWWKx.exe
  C:\Windows\System\XIpWWKx.exe
  2⤵
  PID:6300
- C:\Windows\System\LbezUek.exe
  C:\Windows\System\LbezUek.exe
  2⤵
  PID:6324
- C:\Windows\System\sKBVEYJ.exe
  C:\Windows\System\sKBVEYJ.exe
  2⤵
  PID:6340
- C:\Windows\System\UgSKutJ.exe
  C:\Windows\System\UgSKutJ.exe
  2⤵
  PID:6360
- C:\Windows\System\uTkMozb.exe
  C:\Windows\System\uTkMozb.exe
  2⤵
  PID:6384
- C:\Windows\System\iPuXhus.exe
  C:\Windows\System\iPuXhus.exe
  2⤵
  PID:6400
- C:\Windows\System\IPCARKT.exe
  C:\Windows\System\IPCARKT.exe
  2⤵
  PID:6420
- C:\Windows\System\IaqqkrC.exe
  C:\Windows\System\IaqqkrC.exe
  2⤵
  PID:6436
- C:\Windows\System\flUKUyB.exe
  C:\Windows\System\flUKUyB.exe
  2⤵
  PID:6460
- C:\Windows\System\ZOvkTOs.exe
  C:\Windows\System\ZOvkTOs.exe
  2⤵
  PID:6476
- C:\Windows\System\yYkDGBu.exe
  C:\Windows\System\yYkDGBu.exe
  2⤵
  PID:6500
- C:\Windows\System\cAbWdma.exe
  C:\Windows\System\cAbWdma.exe
  2⤵
  PID:6520
- C:\Windows\System\OYivXkM.exe
  C:\Windows\System\OYivXkM.exe
  2⤵
  PID:6540
- C:\Windows\System\tMZoVkg.exe
  C:\Windows\System\tMZoVkg.exe
  2⤵
  PID:6556
- C:\Windows\System\WbTzYWl.exe
  C:\Windows\System\WbTzYWl.exe
  2⤵
  PID:6576
- C:\Windows\System\uMEpxDv.exe
  C:\Windows\System\uMEpxDv.exe
  2⤵
  PID:6600
- C:\Windows\System\RdJPJBO.exe
  C:\Windows\System\RdJPJBO.exe
  2⤵
  PID:6616
- C:\Windows\System\SAOwGjO.exe
  C:\Windows\System\SAOwGjO.exe
  2⤵
  PID:6656
- C:\Windows\System\tUpLoMt.exe
  C:\Windows\System\tUpLoMt.exe
  2⤵
  PID:6672
- C:\Windows\System\MajpAIY.exe
  C:\Windows\System\MajpAIY.exe
  2⤵
  PID:6704
- C:\Windows\System\VKCXWfg.exe
  C:\Windows\System\VKCXWfg.exe
  2⤵
  PID:6724
- C:\Windows\System\CXenJtQ.exe
  C:\Windows\System\CXenJtQ.exe
  2⤵
  PID:6772
- C:\Windows\System\MdbqQFu.exe
  C:\Windows\System\MdbqQFu.exe
  2⤵
  PID:6788
- C:\Windows\System\YIbPvad.exe
  C:\Windows\System\YIbPvad.exe
  2⤵
  PID:6808
- C:\Windows\System\LXoCYtu.exe
  C:\Windows\System\LXoCYtu.exe
  2⤵
  PID:6828
- C:\Windows\System\UyFsssS.exe
  C:\Windows\System\UyFsssS.exe
  2⤵
  PID:6852
- C:\Windows\System\fKYoulZ.exe
  C:\Windows\System\fKYoulZ.exe
  2⤵
  PID:6872
- C:\Windows\System\RlJOjLe.exe
  C:\Windows\System\RlJOjLe.exe
  2⤵
  PID:6892
- C:\Windows\System\drTbyLB.exe
  C:\Windows\System\drTbyLB.exe
  2⤵
  PID:6908
- C:\Windows\System\xNCLUjW.exe
  C:\Windows\System\xNCLUjW.exe
  2⤵
  PID:6928
- C:\Windows\System\jJdDSjb.exe
  C:\Windows\System\jJdDSjb.exe
  2⤵
  PID:6944
- C:\Windows\System\RYBNGaB.exe
  C:\Windows\System\RYBNGaB.exe
  2⤵
  PID:6960
- C:\Windows\System\VgltVZe.exe
  C:\Windows\System\VgltVZe.exe
  2⤵
  PID:6984
- C:\Windows\System\gKskjud.exe
  C:\Windows\System\gKskjud.exe
  2⤵
  PID:7000
- C:\Windows\System\GHDiKOb.exe
  C:\Windows\System\GHDiKOb.exe
  2⤵
  PID:7024
- C:\Windows\System\mOkMKHa.exe
  C:\Windows\System\mOkMKHa.exe
  2⤵
  PID:7040
- C:\Windows\System\TuvcxiT.exe
  C:\Windows\System\TuvcxiT.exe
  2⤵
  PID:7060
- C:\Windows\System\HbhWici.exe
  C:\Windows\System\HbhWici.exe
  2⤵
  PID:7080
- C:\Windows\System\mxbmYaV.exe
  C:\Windows\System\mxbmYaV.exe
  2⤵
  PID:7096
- C:\Windows\System\kStRfKm.exe
  C:\Windows\System\kStRfKm.exe
  2⤵
  PID:7116
- C:\Windows\System\tlfjxmD.exe
  C:\Windows\System\tlfjxmD.exe
  2⤵
  PID:7132
- C:\Windows\System\fAWPmxj.exe
  C:\Windows\System\fAWPmxj.exe
  2⤵
  PID:7160
- C:\Windows\System\EALJCLs.exe
  C:\Windows\System\EALJCLs.exe
  2⤵
  PID:5872
- C:\Windows\System\XFIKJyX.exe
  C:\Windows\System\XFIKJyX.exe
  2⤵
  PID:6040
- C:\Windows\System\AIRjenZ.exe
  C:\Windows\System\AIRjenZ.exe
  2⤵
  PID:5288
- C:\Windows\System\qUWywfE.exe
  C:\Windows\System\qUWywfE.exe
  2⤵
  PID:6064
- C:\Windows\System\nsQlKhd.exe
  C:\Windows\System\nsQlKhd.exe
  2⤵
  PID:404
- C:\Windows\System\xeEpdCz.exe
  C:\Windows\System\xeEpdCz.exe
  2⤵
  PID:5364
- C:\Windows\System\smUlhnd.exe
  C:\Windows\System\smUlhnd.exe
  2⤵
  PID:7184
- C:\Windows\System\UXszSDW.exe
  C:\Windows\System\UXszSDW.exe
  2⤵
  PID:7200
- C:\Windows\System\FabvlKt.exe
  C:\Windows\System\FabvlKt.exe
  2⤵
  PID:7220
- C:\Windows\System\nFGZteo.exe
  C:\Windows\System\nFGZteo.exe
  2⤵
  PID:7240
- C:\Windows\System\iAFkYcC.exe
  C:\Windows\System\iAFkYcC.exe
  2⤵
  PID:7260
- C:\Windows\System\lJVjcMd.exe
  C:\Windows\System\lJVjcMd.exe
  2⤵
  PID:7288
- C:\Windows\System\pFwbHKJ.exe
  C:\Windows\System\pFwbHKJ.exe
  2⤵
  PID:7308
- C:\Windows\System\TdvLlxN.exe
  C:\Windows\System\TdvLlxN.exe
  2⤵
  PID:7332
- C:\Windows\System\qNxgupd.exe
  C:\Windows\System\qNxgupd.exe
  2⤵
  PID:7348
- C:\Windows\System\OjHzcNA.exe
  C:\Windows\System\OjHzcNA.exe
  2⤵
  PID:7364
- C:\Windows\System\SnuODTj.exe
  C:\Windows\System\SnuODTj.exe
  2⤵
  PID:7408
- C:\Windows\System\AjlZbll.exe
  C:\Windows\System\AjlZbll.exe
  2⤵
  PID:7432
- C:\Windows\System\RZriunt.exe
  C:\Windows\System\RZriunt.exe
  2⤵
  PID:7448
- C:\Windows\System\KyxNuCJ.exe
  C:\Windows\System\KyxNuCJ.exe
  2⤵
  PID:7488
- C:\Windows\System\YqirsNY.exe
  C:\Windows\System\YqirsNY.exe
  2⤵
  PID:7508
- C:\Windows\System\MCGIOsV.exe
  C:\Windows\System\MCGIOsV.exe
  2⤵
  PID:7524
- C:\Windows\System\MsSiVOJ.exe
  C:\Windows\System\MsSiVOJ.exe
  2⤵
  PID:7544
- C:\Windows\System\zdtBbij.exe
  C:\Windows\System\zdtBbij.exe
  2⤵
  PID:7560
- C:\Windows\System\zSPuDvu.exe
  C:\Windows\System\zSPuDvu.exe
  2⤵
  PID:7580
- C:\Windows\System\UToLBSW.exe
  C:\Windows\System\UToLBSW.exe
  2⤵
  PID:7604
- C:\Windows\System\DSUsegS.exe
  C:\Windows\System\DSUsegS.exe
  2⤵
  PID:7620
- C:\Windows\System\DFTyqPn.exe
  C:\Windows\System\DFTyqPn.exe
  2⤵
  PID:7640
- C:\Windows\System\IjwfjNT.exe
  C:\Windows\System\IjwfjNT.exe
  2⤵
  PID:7660
- C:\Windows\System\rcHiNzu.exe
  C:\Windows\System\rcHiNzu.exe
  2⤵
  PID:7676
- C:\Windows\System\kDpwDzW.exe
  C:\Windows\System\kDpwDzW.exe
  2⤵
  PID:7692
- C:\Windows\System\gjbopvy.exe
  C:\Windows\System\gjbopvy.exe
  2⤵
  PID:7708
- C:\Windows\System\RWgzldQ.exe
  C:\Windows\System\RWgzldQ.exe
  2⤵
  PID:7732
- C:\Windows\System\iakZuJp.exe
  C:\Windows\System\iakZuJp.exe
  2⤵
  PID:7748
- C:\Windows\System\BLSpAvN.exe
  C:\Windows\System\BLSpAvN.exe
  2⤵
  PID:7772
- C:\Windows\System\KgBGGFR.exe
  C:\Windows\System\KgBGGFR.exe
  2⤵
  PID:7788
- C:\Windows\System\ZWKbJrs.exe
  C:\Windows\System\ZWKbJrs.exe
  2⤵
  PID:7804
- C:\Windows\System\sEBceQx.exe
  C:\Windows\System\sEBceQx.exe
  2⤵
  PID:7828
- C:\Windows\System\jAODsSO.exe
  C:\Windows\System\jAODsSO.exe
  2⤵
  PID:6608
- C:\Windows\System\yCQVCVF.exe
  C:\Windows\System\yCQVCVF.exe
  2⤵
  PID:1540
- C:\Windows\System\nWtovAR.exe
  C:\Windows\System\nWtovAR.exe
  2⤵
  PID:4120
- C:\Windows\System\AFkEEYJ.exe
  C:\Windows\System\AFkEEYJ.exe
  2⤵
  PID:3568
- C:\Windows\System\aNRVASp.exe
  C:\Windows\System\aNRVASp.exe
  2⤵
  PID:1868
- C:\Windows\System\yyBRpty.exe
  C:\Windows\System\yyBRpty.exe
  2⤵
  PID:4072
- C:\Windows\System\NbZBboS.exe
  C:\Windows\System\NbZBboS.exe
  2⤵
  PID:7232
- C:\Windows\System\IvAySQm.exe
  C:\Windows\System\IvAySQm.exe
  2⤵
  PID:6312
- C:\Windows\System\zzfwSRi.exe
  C:\Windows\System\zzfwSRi.exe
  2⤵
  PID:5436
- C:\Windows\System\PqDelHH.exe
  C:\Windows\System\PqDelHH.exe
  2⤵
  PID:6176
- C:\Windows\System\dXIRmWz.exe
  C:\Windows\System\dXIRmWz.exe
  2⤵
  PID:7212
- C:\Windows\System\IrCMCfK.exe
  C:\Windows\System\IrCMCfK.exe
  2⤵
  PID:5848
- C:\Windows\System\jXINYPn.exe
  C:\Windows\System\jXINYPn.exe
  2⤵
  PID:6512
- C:\Windows\System\HxfnyHk.exe
  C:\Windows\System\HxfnyHk.exe
  2⤵
  PID:7284
- C:\Windows\System\gqFomRQ.exe
  C:\Windows\System\gqFomRQ.exe
  2⤵
  PID:7056
- C:\Windows\System\Suivubt.exe
  C:\Windows\System\Suivubt.exe
  2⤵
  PID:6940
- C:\Windows\System\BAAtUNw.exe
  C:\Windows\System\BAAtUNw.exe
  2⤵
  PID:1748
- C:\Windows\System\rWrJcRq.exe
  C:\Windows\System\rWrJcRq.exe
  2⤵
  PID:2740
- C:\Windows\System\GZwpLPw.exe
  C:\Windows\System\GZwpLPw.exe
  2⤵
  PID:6528
- C:\Windows\System\QzDvUzN.exe
  C:\Windows\System\QzDvUzN.exe
  2⤵
  PID:8196
- C:\Windows\System\ICtBUxp.exe
  C:\Windows\System\ICtBUxp.exe
  2⤵
  PID:8224
- C:\Windows\System\TVkxjlQ.exe
  C:\Windows\System\TVkxjlQ.exe
  2⤵
  PID:8252
- C:\Windows\System\WuXaiPY.exe
  C:\Windows\System\WuXaiPY.exe
  2⤵
  PID:8288
- C:\Windows\System\jmVbVZT.exe
  C:\Windows\System\jmVbVZT.exe
  2⤵
  PID:8316
- C:\Windows\System\Lwubelx.exe
  C:\Windows\System\Lwubelx.exe
  2⤵
  PID:8344
- C:\Windows\System\mFcEtvs.exe
  C:\Windows\System\mFcEtvs.exe
  2⤵
  PID:8372
- C:\Windows\System\VVkFAQE.exe
  C:\Windows\System\VVkFAQE.exe
  2⤵
  PID:8412
- C:\Windows\System\hXouvPa.exe
  C:\Windows\System\hXouvPa.exe
  2⤵
  PID:8440
- C:\Windows\System\xRRVByX.exe
  C:\Windows\System\xRRVByX.exe
  2⤵
  PID:8468
- C:\Windows\System\oGKlrnJ.exe
  C:\Windows\System\oGKlrnJ.exe
  2⤵
  PID:8496
- C:\Windows\System\UtzpxGp.exe
  C:\Windows\System\UtzpxGp.exe
  2⤵
  PID:8524
- C:\Windows\System\CCqwVon.exe
  C:\Windows\System\CCqwVon.exe
  2⤵
  PID:8552
- C:\Windows\System\FwrmkQr.exe
  C:\Windows\System\FwrmkQr.exe
  2⤵
  PID:8588
- C:\Windows\System\CQjrYpy.exe
  C:\Windows\System\CQjrYpy.exe
  2⤵
  PID:8612
- C:\Windows\System\MGCSeUB.exe
  C:\Windows\System\MGCSeUB.exe
  2⤵
  PID:8640
- C:\Windows\System\SujDkaH.exe
  C:\Windows\System\SujDkaH.exe
  2⤵
  PID:8672
- C:\Windows\System\fgZLnpn.exe
  C:\Windows\System\fgZLnpn.exe
  2⤵
  PID:8700
- C:\Windows\System\UUxBkQJ.exe
  C:\Windows\System\UUxBkQJ.exe
  2⤵
  PID:8716
- C:\Windows\System\irIbPDh.exe
  C:\Windows\System\irIbPDh.exe
  2⤵
  PID:8752
- C:\Windows\System\wtUnOTm.exe
  C:\Windows\System\wtUnOTm.exe
  2⤵
  PID:8780
- C:\Windows\System\nifYCBO.exe
  C:\Windows\System\nifYCBO.exe
  2⤵
  PID:8808
- C:\Windows\System\JTwhGZc.exe
  C:\Windows\System\JTwhGZc.exe
  2⤵
  PID:8840
- C:\Windows\System\jXjbegs.exe
  C:\Windows\System\jXjbegs.exe
  2⤵
  PID:8868
- C:\Windows\System\PuFULpE.exe
  C:\Windows\System\PuFULpE.exe
  2⤵
  PID:8896
- C:\Windows\System\pYIoQLh.exe
  C:\Windows\System\pYIoQLh.exe
  2⤵
  PID:8920
- C:\Windows\System\JwOybor.exe
  C:\Windows\System\JwOybor.exe
  2⤵
  PID:8948
- C:\Windows\System\zeOTHWS.exe
  C:\Windows\System\zeOTHWS.exe
  2⤵
  PID:8976
- C:\Windows\System\XDJuWZn.exe
  C:\Windows\System\XDJuWZn.exe
  2⤵
  PID:9008
- C:\Windows\System\vIfCMvp.exe
  C:\Windows\System\vIfCMvp.exe
  2⤵
  PID:9036
- C:\Windows\System\DpxFDRh.exe
  C:\Windows\System\DpxFDRh.exe
  2⤵
  PID:9068
- C:\Windows\System\LKqINvw.exe
  C:\Windows\System\LKqINvw.exe
  2⤵
  PID:9096
- C:\Windows\System\gerGSfK.exe
  C:\Windows\System\gerGSfK.exe
  2⤵
  PID:9124
- C:\Windows\System\hvNyaYn.exe
  C:\Windows\System\hvNyaYn.exe
  2⤵
  PID:9152
- C:\Windows\System\LHQJLUY.exe
  C:\Windows\System\LHQJLUY.exe
  2⤵
  PID:9176
- C:\Windows\System\AYiceMl.exe
  C:\Windows\System\AYiceMl.exe
  2⤵
  PID:9208
- C:\Windows\System\IOjiCJs.exe
  C:\Windows\System\IOjiCJs.exe
  2⤵
  PID:5576
- C:\Windows\System\KIAHBEQ.exe
  C:\Windows\System\KIAHBEQ.exe
  2⤵
  PID:5132
- C:\Windows\System\IQgCdLa.exe
  C:\Windows\System\IQgCdLa.exe
  2⤵
  PID:5268
- C:\Windows\System\UDvvILb.exe
  C:\Windows\System\UDvvILb.exe
  2⤵
  PID:7504
- C:\Windows\System\wcmRxIq.exe
  C:\Windows\System\wcmRxIq.exe
  2⤵
  PID:7920
- C:\Windows\System\kiyBSOH.exe
  C:\Windows\System\kiyBSOH.exe
  2⤵
  PID:8244
- C:\Windows\System\dQtMSAP.exe
  C:\Windows\System\dQtMSAP.exe
  2⤵
  PID:8308
- C:\Windows\System\kdlSPwm.exe
  C:\Windows\System\kdlSPwm.exe
  2⤵
  PID:2976
- C:\Windows\System\AwPLGqL.exe
  C:\Windows\System\AwPLGqL.exe
  2⤵
  PID:8428
- C:\Windows\System\quWoULT.exe
  C:\Windows\System\quWoULT.exe
  2⤵
  PID:8464
- C:\Windows\System\CWHLyPq.exe
  C:\Windows\System\CWHLyPq.exe
  2⤵
  PID:3064
- C:\Windows\System\eQghuBd.exe
  C:\Windows\System\eQghuBd.exe
  2⤵
  PID:4156
- C:\Windows\System\URKStkZ.exe
  C:\Windows\System\URKStkZ.exe
  2⤵
  PID:8608
- C:\Windows\System\KpAhrAN.exe
  C:\Windows\System\KpAhrAN.exe
  2⤵
  PID:4580
- C:\Windows\System\TZrnQqQ.exe
  C:\Windows\System\TZrnQqQ.exe
  2⤵
  PID:8728
- C:\Windows\System\OaABMzl.exe
  C:\Windows\System\OaABMzl.exe
  2⤵
  PID:8796
- C:\Windows\System\ChZQpUt.exe
  C:\Windows\System\ChZQpUt.exe
  2⤵
  PID:8852
- C:\Windows\System\NixjJvc.exe
  C:\Windows\System\NixjJvc.exe
  2⤵
  PID:8912
- C:\Windows\System\pjSJFBa.exe
  C:\Windows\System\pjSJFBa.exe
  2⤵
  PID:8944
- C:\Windows\System\eLuuVNK.exe
  C:\Windows\System\eLuuVNK.exe
  2⤵
  PID:9024
- C:\Windows\System\fHdIKRw.exe
  C:\Windows\System\fHdIKRw.exe
  2⤵
  PID:2416
- C:\Windows\System\TRlqlTb.exe
  C:\Windows\System\TRlqlTb.exe
  2⤵
  PID:9060
- C:\Windows\System\XYfjcAT.exe
  C:\Windows\System\XYfjcAT.exe
  2⤵
  PID:9088
- C:\Windows\System\VsNjrOz.exe
  C:\Windows\System\VsNjrOz.exe
  2⤵
  PID:9116
- C:\Windows\System\keflBAN.exe
  C:\Windows\System\keflBAN.exe
  2⤵
  PID:244
- C:\Windows\System\vvWVCCX.exe
  C:\Windows\System\vvWVCCX.exe
  2⤵
  PID:5020
- C:\Windows\System\sgbBboo.exe
  C:\Windows\System\sgbBboo.exe
  2⤵
  PID:6624
- C:\Windows\System\XbPNDOW.exe
  C:\Windows\System\XbPNDOW.exe
  2⤵
  PID:5756
- C:\Windows\System\ORqZMLu.exe
  C:\Windows\System\ORqZMLu.exe
  2⤵
  PID:6356
- C:\Windows\System\BXAxJTd.exe
  C:\Windows\System\BXAxJTd.exe
  2⤵
  PID:5152
- C:\Windows\System\ZXysDEn.exe
  C:\Windows\System\ZXysDEn.exe
  2⤵
  PID:8280
- C:\Windows\System\evUkDwO.exe
  C:\Windows\System\evUkDwO.exe
  2⤵
  PID:4436
- C:\Windows\System\tVoyQhc.exe
  C:\Windows\System\tVoyQhc.exe
  2⤵
  PID:8488
- C:\Windows\System\efdwyRX.exe
  C:\Windows\System\efdwyRX.exe
  2⤵
  PID:4824
- C:\Windows\System\pHTPihw.exe
  C:\Windows\System\pHTPihw.exe
  2⤵
  PID:2148
- C:\Windows\System\fShVfWl.exe
  C:\Windows\System\fShVfWl.exe
  2⤵
  PID:9192
- C:\Windows\System\rCMorDr.exe
  C:\Windows\System\rCMorDr.exe
  2⤵
  PID:9200
- C:\Windows\System\SDZcqYr.exe
  C:\Windows\System\SDZcqYr.exe
  2⤵
  PID:8484
- C:\Windows\System\APNRFwn.exe
  C:\Windows\System\APNRFwn.exe
  2⤵
  PID:8216
- C:\Windows\System\VjXrjaP.exe
  C:\Windows\System\VjXrjaP.exe
  2⤵
  PID:4196
- C:\Windows\System\BtqcBnI.exe
  C:\Windows\System\BtqcBnI.exe
  2⤵
  PID:3088
- C:\Windows\System\XmQzIfO.exe
  C:\Windows\System\XmQzIfO.exe
  2⤵
  PID:5012
- C:\Windows\System\QPSRwyZ.exe
  C:\Windows\System\QPSRwyZ.exe
  2⤵
  PID:4792
- C:\Windows\System\ltUBCXS.exe
  C:\Windows\System\ltUBCXS.exe
  2⤵
  PID:8004
- C:\Windows\System\bJaTopE.exe
  C:\Windows\System\bJaTopE.exe
  2⤵
  PID:8336
- C:\Windows\System\XUnLLNe.exe
  C:\Windows\System\XUnLLNe.exe
  2⤵
  PID:2224
- C:\Windows\System\UigfPKJ.exe
  C:\Windows\System\UigfPKJ.exe
  2⤵
  PID:2292
- C:\Windows\System\bqlwozH.exe
  C:\Windows\System\bqlwozH.exe
  2⤵
  PID:4992
- C:\Windows\System\LZTQWFZ.exe
  C:\Windows\System\LZTQWFZ.exe
  2⤵
  PID:4416
- C:\Windows\System\GStZGBT.exe
  C:\Windows\System\GStZGBT.exe
  2⤵
  PID:7668
- C:\Windows\System\zJdSyNG.exe
  C:\Windows\System\zJdSyNG.exe
  2⤵
  PID:7300
- C:\Windows\System\qvSQlwh.exe
  C:\Windows\System\qvSQlwh.exe
  2⤵
  PID:7372
- C:\Windows\System\BuqRMVm.exe
  C:\Windows\System\BuqRMVm.exe
  2⤵
  PID:9228
- C:\Windows\System\zIGcTaC.exe
  C:\Windows\System\zIGcTaC.exe
  2⤵
  PID:9244
- C:\Windows\System\SkRozoO.exe
  C:\Windows\System\SkRozoO.exe
  2⤵
  PID:9292
- C:\Windows\System\qeDVeLq.exe
  C:\Windows\System\qeDVeLq.exe
  2⤵
  PID:9324
- C:\Windows\System\YjjgdLC.exe
  C:\Windows\System\YjjgdLC.exe
  2⤵
  PID:9340
- C:\Windows\System\YCRuiIa.exe
  C:\Windows\System\YCRuiIa.exe
  2⤵
  PID:9360
- C:\Windows\System\TRVshKd.exe
  C:\Windows\System\TRVshKd.exe
  2⤵
  PID:9400
- C:\Windows\System\BkZNoNW.exe
  C:\Windows\System\BkZNoNW.exe
  2⤵
  PID:9428
- C:\Windows\System\QDTPxyp.exe
  C:\Windows\System\QDTPxyp.exe
  2⤵
  PID:9456
- C:\Windows\System\KgvegAf.exe
  C:\Windows\System\KgvegAf.exe
  2⤵
  PID:9504
- C:\Windows\System\UgqsbLx.exe
  C:\Windows\System\UgqsbLx.exe
  2⤵
  PID:9532
- C:\Windows\System\vzZXzuG.exe
  C:\Windows\System\vzZXzuG.exe
  2⤵
  PID:9560
- C:\Windows\System\ivVmmHp.exe
  C:\Windows\System\ivVmmHp.exe
  2⤵
  PID:9580
- C:\Windows\System\qcOOTvG.exe
  C:\Windows\System\qcOOTvG.exe
  2⤵
  PID:9600
- C:\Windows\System\frBOrqm.exe
  C:\Windows\System\frBOrqm.exe
  2⤵
  PID:9628
- C:\Windows\System\qvZPqtf.exe
  C:\Windows\System\qvZPqtf.exe
  2⤵
  PID:9680
- C:\Windows\System\pnNoOOP.exe
  C:\Windows\System\pnNoOOP.exe
  2⤵
  PID:9716
- C:\Windows\System\zXXstvt.exe
  C:\Windows\System\zXXstvt.exe
  2⤵
  PID:9744
- C:\Windows\System\VKbGGst.exe
  C:\Windows\System\VKbGGst.exe
  2⤵
  PID:9764
- C:\Windows\System\LClPkre.exe
  C:\Windows\System\LClPkre.exe
  2⤵
  PID:9792
- C:\Windows\System\GrJWuOy.exe
  C:\Windows\System\GrJWuOy.exe
  2⤵
  PID:9812
- C:\Windows\System\TEoSreN.exe
  C:\Windows\System\TEoSreN.exe
  2⤵
  PID:9828
- C:\Windows\System\xLXMBrS.exe
  C:\Windows\System\xLXMBrS.exe
  2⤵
  PID:9852
- C:\Windows\System\AkhOQOL.exe
  C:\Windows\System\AkhOQOL.exe
  2⤵
  PID:9872
- C:\Windows\System\LexFcqP.exe
  C:\Windows\System\LexFcqP.exe
  2⤵
  PID:9888
- C:\Windows\System\OKraRCM.exe
  C:\Windows\System\OKraRCM.exe
  2⤵
  PID:9948
- C:\Windows\System\DLLxnUP.exe
  C:\Windows\System\DLLxnUP.exe
  2⤵
  PID:9964
- C:\Windows\System\iFvQmQr.exe
  C:\Windows\System\iFvQmQr.exe
  2⤵
  PID:9984
- C:\Windows\System\CmkarJH.exe
  C:\Windows\System\CmkarJH.exe
  2⤵
  PID:10000
- C:\Windows\System\tkKmyGt.exe
  C:\Windows\System\tkKmyGt.exe
  2⤵
  PID:10044
- C:\Windows\System\LtBTFmo.exe
  C:\Windows\System\LtBTFmo.exe
  2⤵
  PID:10072
- C:\Windows\System\LWDkwJK.exe
  C:\Windows\System\LWDkwJK.exe
  2⤵
  PID:10088
- C:\Windows\System\RYEHwWh.exe
  C:\Windows\System\RYEHwWh.exe
  2⤵
  PID:10108
- C:\Windows\System\UEzZfpu.exe
  C:\Windows\System\UEzZfpu.exe
  2⤵
  PID:10144
- C:\Windows\System\NbyPmmu.exe
  C:\Windows\System\NbyPmmu.exe
  2⤵
  PID:10180
- C:\Windows\System\ujzYmuI.exe
  C:\Windows\System\ujzYmuI.exe
  2⤵
  PID:10200
- C:\Windows\System\QdGrYHK.exe
  C:\Windows\System\QdGrYHK.exe
  2⤵
  PID:10224
- C:\Windows\System\SFqVsNn.exe
  C:\Windows\System\SFqVsNn.exe
  2⤵
  PID:5544
- C:\Windows\System\KbYeQhy.exe
  C:\Windows\System\KbYeQhy.exe
  2⤵
  PID:7576
- C:\Windows\System\ajgoraU.exe
  C:\Windows\System\ajgoraU.exe
  2⤵
  PID:9268
- C:\Windows\System\wAmNVTO.exe
  C:\Windows\System\wAmNVTO.exe
  2⤵
  PID:9336
- C:\Windows\System\euIegIs.exe
  C:\Windows\System\euIegIs.exe
  2⤵
  PID:9396
- C:\Windows\System\hTajvvW.exe
  C:\Windows\System\hTajvvW.exe
  2⤵
  PID:9412
- C:\Windows\System\lClsULC.exe
  C:\Windows\System\lClsULC.exe
  2⤵
  PID:9468
- C:\Windows\System\AQCgWXK.exe
  C:\Windows\System\AQCgWXK.exe
  2⤵
  PID:9640
- C:\Windows\System\nxeNZye.exe
  C:\Windows\System\nxeNZye.exe
  2⤵
  PID:9700
- C:\Windows\System\MvKgYSv.exe
  C:\Windows\System\MvKgYSv.exe
  2⤵
  PID:9780
- C:\Windows\System\wCnhFpP.exe
  C:\Windows\System\wCnhFpP.exe
  2⤵
  PID:9840
- C:\Windows\System\QyVgtXW.exe
  C:\Windows\System\QyVgtXW.exe
  2⤵
  PID:5512
- C:\Windows\System\GCSNYFq.exe
  C:\Windows\System\GCSNYFq.exe
  2⤵
  PID:9916
- C:\Windows\System\dfmZCjl.exe
  C:\Windows\System\dfmZCjl.exe
  2⤵
  PID:10008
- C:\Windows\System\pHjeaxR.exe
  C:\Windows\System\pHjeaxR.exe
  2⤵
  PID:10068
- C:\Windows\System\VoZrxTJ.exe
  C:\Windows\System\VoZrxTJ.exe
  2⤵
  PID:10084
- C:\Windows\System\zvQsfmq.exe
  C:\Windows\System\zvQsfmq.exe
  2⤵
  PID:10168
- C:\Windows\System\ySSpVqW.exe
  C:\Windows\System\ySSpVqW.exe
  2⤵
  PID:10236
- C:\Windows\System\jvhNunr.exe
  C:\Windows\System\jvhNunr.exe
  2⤵
  PID:9664
- C:\Windows\System\lkFGGXf.exe
  C:\Windows\System\lkFGGXf.exe
  2⤵
  PID:9672
- C:\Windows\System\WVRyBoU.exe
  C:\Windows\System\WVRyBoU.exe
  2⤵
  PID:9864
- C:\Windows\System\iTChutH.exe
  C:\Windows\System\iTChutH.exe
  2⤵
  PID:9836
- C:\Windows\System\LznQnio.exe
  C:\Windows\System\LznQnio.exe
  2⤵
  PID:10132
- C:\Windows\System\bnewOEk.exe
  C:\Windows\System\bnewOEk.exe
  2⤵
  PID:9940
- C:\Windows\System\GylaSqN.exe
  C:\Windows\System\GylaSqN.exe
  2⤵
  PID:10104
- C:\Windows\System\UceIncA.exe
  C:\Windows\System\UceIncA.exe
  2⤵
  PID:7572
- C:\Windows\System\axJpcEn.exe
  C:\Windows\System\axJpcEn.exe
  2⤵
  PID:9844
- C:\Windows\System\DYvFPwe.exe
  C:\Windows\System\DYvFPwe.exe
  2⤵
  PID:10192
- C:\Windows\System\eFoKAgD.exe
  C:\Windows\System\eFoKAgD.exe
  2⤵
  PID:9440
- C:\Windows\System\IozOuBq.exe
  C:\Windows\System\IozOuBq.exe
  2⤵
  PID:10252
- C:\Windows\System\QIAFYHh.exe
  C:\Windows\System\QIAFYHh.exe
  2⤵
  PID:10296
- C:\Windows\System\TSTyQfu.exe
  C:\Windows\System\TSTyQfu.exe
  2⤵
  PID:10316
- C:\Windows\System\aEXyUrY.exe
  C:\Windows\System\aEXyUrY.exe
  2⤵
  PID:10332
- C:\Windows\System\ummVJvw.exe
  C:\Windows\System\ummVJvw.exe
  2⤵
  PID:10372
- C:\Windows\System\hGCyyXR.exe
  C:\Windows\System\hGCyyXR.exe
  2⤵
  PID:10396
- C:\Windows\System\LtfihBu.exe
  C:\Windows\System\LtfihBu.exe
  2⤵
  PID:10420
- C:\Windows\System\KPldHbS.exe
  C:\Windows\System\KPldHbS.exe
  2⤵
  PID:10452
- C:\Windows\System\KAkfTrO.exe
  C:\Windows\System\KAkfTrO.exe
  2⤵
  PID:10480
- C:\Windows\System\iKpUSbu.exe
  C:\Windows\System\iKpUSbu.exe
  2⤵
  PID:10504
- C:\Windows\System\iLurOPc.exe
  C:\Windows\System\iLurOPc.exe
  2⤵
  PID:10540
- C:\Windows\System\kAqxxXV.exe
  C:\Windows\System\kAqxxXV.exe
  2⤵
  PID:10584
- C:\Windows\System\RrDsqdA.exe
  C:\Windows\System\RrDsqdA.exe
  2⤵
  PID:10604
- C:\Windows\System\xfxXfUH.exe
  C:\Windows\System\xfxXfUH.exe
  2⤵
  PID:10620
- C:\Windows\System\eMhxkmC.exe
  C:\Windows\System\eMhxkmC.exe
  2⤵
  PID:10668
- C:\Windows\System\lAYYish.exe
  C:\Windows\System\lAYYish.exe
  2⤵
  PID:10696
- C:\Windows\System\jIXYWtb.exe
  C:\Windows\System\jIXYWtb.exe
  2⤵
  PID:10712
- C:\Windows\System\BEVOuCY.exe
  C:\Windows\System\BEVOuCY.exe
  2⤵
  PID:10736
- C:\Windows\System\BMdNqDq.exe
  C:\Windows\System\BMdNqDq.exe
  2⤵
  PID:10768
- C:\Windows\System\CoZzCPD.exe
  C:\Windows\System\CoZzCPD.exe
  2⤵
  PID:10816
- C:\Windows\System\lAvwZrR.exe
  C:\Windows\System\lAvwZrR.exe
  2⤵
  PID:10836
- C:\Windows\System\LUYQOVY.exe
  C:\Windows\System\LUYQOVY.exe
  2⤵
  PID:10852
- C:\Windows\System\bAEzprk.exe
  C:\Windows\System\bAEzprk.exe
  2⤵
  PID:10876
- C:\Windows\System\xsjGTCt.exe
  C:\Windows\System\xsjGTCt.exe
  2⤵
  PID:10928
- C:\Windows\System\EwSLeMn.exe
  C:\Windows\System\EwSLeMn.exe
  2⤵
  PID:10948
- C:\Windows\System\mybNCVP.exe
  C:\Windows\System\mybNCVP.exe
  2⤵
  PID:10964
- C:\Windows\System\reNdtLH.exe
  C:\Windows\System\reNdtLH.exe
  2⤵
  PID:10984
- C:\Windows\System\GFVtQeU.exe
  C:\Windows\System\GFVtQeU.exe
  2⤵
  PID:11024
- C:\Windows\System\kUNCQal.exe
  C:\Windows\System\kUNCQal.exe
  2⤵
  PID:11048
- C:\Windows\System\PgvFuRW.exe
  C:\Windows\System\PgvFuRW.exe
  2⤵
  PID:11068
- C:\Windows\System\bWLgcTd.exe
  C:\Windows\System\bWLgcTd.exe
  2⤵
  PID:11084
- C:\Windows\System\UQJynHw.exe
  C:\Windows\System\UQJynHw.exe
  2⤵
  PID:11108
- C:\Windows\System\kcPLQBO.exe
  C:\Windows\System\kcPLQBO.exe
  2⤵
  PID:11128
- C:\Windows\System\qEAEGKp.exe
  C:\Windows\System\qEAEGKp.exe
  2⤵
  PID:11148
- C:\Windows\System\mgAtjzc.exe
  C:\Windows\System\mgAtjzc.exe
  2⤵
  PID:11208
- C:\Windows\System\oetZCsD.exe
  C:\Windows\System\oetZCsD.exe
  2⤵
  PID:11224
- C:\Windows\System\jDpKOVq.exe
  C:\Windows\System\jDpKOVq.exe
  2⤵
  PID:11248
- C:\Windows\System\maZYLDn.exe
  C:\Windows\System\maZYLDn.exe
  2⤵
  PID:9384
- C:\Windows\System\FQCfRFB.exe
  C:\Windows\System\FQCfRFB.exe
  2⤵
  PID:10268
- C:\Windows\System\ONctsQe.exe
  C:\Windows\System\ONctsQe.exe
  2⤵
  PID:10328
- C:\Windows\System\Cvdzfwt.exe
  C:\Windows\System\Cvdzfwt.exe
  2⤵
  PID:10380
- C:\Windows\System\cfAvkmJ.exe
  C:\Windows\System\cfAvkmJ.exe
  2⤵
  PID:10476
- C:\Windows\System\wSSrAhp.exe
  C:\Windows\System\wSSrAhp.exe
  2⤵
  PID:10516
- C:\Windows\System\dBGahUR.exe
  C:\Windows\System\dBGahUR.exe
  2⤵
  PID:10612
- C:\Windows\System\CHKXUyk.exe
  C:\Windows\System\CHKXUyk.exe
  2⤵
  PID:10744
- C:\Windows\System\VRVtGtB.exe
  C:\Windows\System\VRVtGtB.exe
  2⤵
  PID:10792
- C:\Windows\System\NrDqQtF.exe
  C:\Windows\System\NrDqQtF.exe
  2⤵
  PID:10824
- C:\Windows\System\DOoFEJP.exe
  C:\Windows\System\DOoFEJP.exe
  2⤵
  PID:10888
- C:\Windows\System\wKCRseE.exe
  C:\Windows\System\wKCRseE.exe
  2⤵
  PID:10960
- C:\Windows\System\xDkIvfV.exe
  C:\Windows\System\xDkIvfV.exe
  2⤵
  PID:11004
- C:\Windows\System\bpWmZcT.exe
  C:\Windows\System\bpWmZcT.exe
  2⤵
  PID:11172
- C:\Windows\System\cPiddfS.exe
  C:\Windows\System\cPiddfS.exe
  2⤵
  PID:9236
- C:\Windows\System\PuussyK.exe
  C:\Windows\System\PuussyK.exe
  2⤵
  PID:10308
- C:\Windows\System\HYUIiZe.exe
  C:\Windows\System\HYUIiZe.exe
  2⤵
  PID:11256
- C:\Windows\System\atgrdoi.exe
  C:\Windows\System\atgrdoi.exe
  2⤵
  PID:10632
- C:\Windows\System\KkPLQew.exe
  C:\Windows\System\KkPLQew.exe
  2⤵
  PID:10804
- C:\Windows\System\eETzsdp.exe
  C:\Windows\System\eETzsdp.exe
  2⤵
  PID:10924
- C:\Windows\System\ygdeYZL.exe
  C:\Windows\System\ygdeYZL.exe
  2⤵
  PID:10940
- C:\Windows\System\FhjlqhQ.exe
  C:\Windows\System\FhjlqhQ.exe
  2⤵
  PID:10944
- C:\Windows\System\oRPDtxQ.exe
  C:\Windows\System\oRPDtxQ.exe
  2⤵
  PID:11232
- C:\Windows\System\eHBVvhP.exe
  C:\Windows\System\eHBVvhP.exe
  2⤵
  PID:10724
- C:\Windows\System\VHmzvZO.exe
  C:\Windows\System\VHmzvZO.exe
  2⤵
  PID:11080
- C:\Windows\System\VulHvnd.exe
  C:\Windows\System\VulHvnd.exe
  2⤵
  PID:11220
- C:\Windows\System\IgrKiNG.exe
  C:\Windows\System\IgrKiNG.exe
  2⤵
  PID:10872
- C:\Windows\System\tnXYSWi.exe
  C:\Windows\System\tnXYSWi.exe
  2⤵
  PID:11292
- C:\Windows\System\GrWcjuD.exe
  C:\Windows\System\GrWcjuD.exe
  2⤵
  PID:11320
- C:\Windows\System\IwPcazK.exe
  C:\Windows\System\IwPcazK.exe
  2⤵
  PID:11340
- C:\Windows\System\CJXLJDT.exe
  C:\Windows\System\CJXLJDT.exe
  2⤵
  PID:11384
- C:\Windows\System\RlIbSnR.exe
  C:\Windows\System\RlIbSnR.exe
  2⤵
  PID:11408
- C:\Windows\System\WHNwzzk.exe
  C:\Windows\System\WHNwzzk.exe
  2⤵
  PID:11432
- C:\Windows\System\WEbTrfK.exe
  C:\Windows\System\WEbTrfK.exe
  2⤵
  PID:11452
- C:\Windows\System\izHpIoL.exe
  C:\Windows\System\izHpIoL.exe
  2⤵
  PID:11488
- C:\Windows\System\ebkeSwE.exe
  C:\Windows\System\ebkeSwE.exe
  2⤵
  PID:11524
- C:\Windows\System\xPtcqvg.exe
  C:\Windows\System\xPtcqvg.exe
  2⤵
  PID:11548
- C:\Windows\System\TTigKAa.exe
  C:\Windows\System\TTigKAa.exe
  2⤵
  PID:11564
- C:\Windows\System\TGlUqvZ.exe
  C:\Windows\System\TGlUqvZ.exe
  2⤵
  PID:11588
- C:\Windows\System\jwtcGfY.exe
  C:\Windows\System\jwtcGfY.exe
  2⤵
  PID:11608
- C:\Windows\System\JRXLlVH.exe
  C:\Windows\System\JRXLlVH.exe
  2⤵
  PID:11688
- C:\Windows\System\fulVYWX.exe
  C:\Windows\System\fulVYWX.exe
  2⤵
  PID:11708
- C:\Windows\System\XfSvNkw.exe
  C:\Windows\System\XfSvNkw.exe
  2⤵
  PID:11736
- C:\Windows\System\PpyORvz.exe
  C:\Windows\System\PpyORvz.exe
  2⤵
  PID:11760
- C:\Windows\System\nPuHRUO.exe
  C:\Windows\System\nPuHRUO.exe
  2⤵
  PID:11780
- C:\Windows\System\qdMxdQi.exe
  C:\Windows\System\qdMxdQi.exe
  2⤵
  PID:11796
- C:\Windows\System\yotUwsR.exe
  C:\Windows\System\yotUwsR.exe
  2⤵
  PID:11828
- C:\Windows\System\YXjpCKW.exe
  C:\Windows\System\YXjpCKW.exe
  2⤵
  PID:11844
- C:\Windows\System\XvqeXNf.exe
  C:\Windows\System\XvqeXNf.exe
  2⤵
  PID:11868
- C:\Windows\System\NDEyfUI.exe
  C:\Windows\System\NDEyfUI.exe
  2⤵
  PID:11884
- C:\Windows\System\kXAoEqV.exe
  C:\Windows\System\kXAoEqV.exe
  2⤵
  PID:11952
- C:\Windows\System\yrcBcAD.exe
  C:\Windows\System\yrcBcAD.exe
  2⤵
  PID:11976
- C:\Windows\System\RkIIMlW.exe
  C:\Windows\System\RkIIMlW.exe
  2⤵
  PID:11996
- C:\Windows\System\mhawKWf.exe
  C:\Windows\System\mhawKWf.exe
  2⤵
  PID:12024
- C:\Windows\System\llbAxnP.exe
  C:\Windows\System\llbAxnP.exe
  2⤵
  PID:12048
- C:\Windows\System\hVmwwFE.exe
  C:\Windows\System\hVmwwFE.exe
  2⤵
  PID:12092
- C:\Windows\System\sWduxXf.exe
  C:\Windows\System\sWduxXf.exe
  2⤵
  PID:12144
- C:\Windows\System\cxUehvL.exe
  C:\Windows\System\cxUehvL.exe
  2⤵
  PID:12164
- C:\Windows\System\EVhZErB.exe
  C:\Windows\System\EVhZErB.exe
  2⤵
  PID:12188
- C:\Windows\System\ppnfhlm.exe
  C:\Windows\System\ppnfhlm.exe
  2⤵
  PID:12204
- C:\Windows\System\ipLdkkM.exe
  C:\Windows\System\ipLdkkM.exe
  2⤵
  PID:12228
- C:\Windows\System\VqUglgj.exe
  C:\Windows\System\VqUglgj.exe
  2⤵
  PID:12264
- C:\Windows\System\OvyCXts.exe
  C:\Windows\System\OvyCXts.exe
  2⤵
  PID:11348
- C:\Windows\System\McbomdV.exe
  C:\Windows\System\McbomdV.exe
  2⤵
  PID:11356
- C:\Windows\System\gJEfSqH.exe
  C:\Windows\System\gJEfSqH.exe
  2⤵
  PID:11368
- C:\Windows\System\hmTYJWy.exe
  C:\Windows\System\hmTYJWy.exe
  2⤵
  PID:11396
- C:\Windows\System\yFdnlbX.exe
  C:\Windows\System\yFdnlbX.exe
  2⤵
  PID:11428
- C:\Windows\System\ZiOGOFi.exe
  C:\Windows\System\ZiOGOFi.exe
  2⤵
  PID:11500
- C:\Windows\System\iUaDhrb.exe
  C:\Windows\System\iUaDhrb.exe
  2⤵
  PID:11560
- C:\Windows\System\XvZRJoE.exe
  C:\Windows\System\XvZRJoE.exe
  2⤵
  PID:11600
- C:\Windows\System\iVJjwYl.exe
  C:\Windows\System\iVJjwYl.exe
  2⤵
  PID:11660
- C:\Windows\System\ItzYtec.exe
  C:\Windows\System\ItzYtec.exe
  2⤵
  PID:11788
- C:\Windows\System\FrNCfes.exe
  C:\Windows\System\FrNCfes.exe
  2⤵
  PID:11864
- C:\Windows\System\FZmuYzJ.exe
  C:\Windows\System\FZmuYzJ.exe
  2⤵
  PID:11948
- C:\Windows\System\WEyyuhz.exe
  C:\Windows\System\WEyyuhz.exe
  2⤵
  PID:11988
- C:\Windows\System\wAoVdLk.exe
  C:\Windows\System\wAoVdLk.exe
  2⤵
  PID:8936
- C:\Windows\System\RZVkpYL.exe
  C:\Windows\System\RZVkpYL.exe
  2⤵
  PID:12072
- C:\Windows\System\XGmyIHe.exe
  C:\Windows\System\XGmyIHe.exe
  2⤵
  PID:12160
- C:\Windows\System\EGjHLFj.exe
  C:\Windows\System\EGjHLFj.exe
  2⤵
  PID:12176
- C:\Windows\System\bgTosYI.exe
  C:\Windows\System\bgTosYI.exe
  2⤵
  PID:11092
- C:\Windows\System\AUZElrQ.exe
  C:\Windows\System\AUZElrQ.exe
  2⤵
  PID:11484
- C:\Windows\System\qLIGycL.exe
  C:\Windows\System\qLIGycL.exe
  2⤵
  PID:11444
- C:\Windows\System\ZwaqxPg.exe
  C:\Windows\System\ZwaqxPg.exe
  2⤵
  PID:11648
- C:\Windows\System\zzOmaOz.exe
  C:\Windows\System\zzOmaOz.exe
  2⤵
  PID:11596
- C:\Windows\System\GLEeqGK.exe
  C:\Windows\System\GLEeqGK.exe
  2⤵
  PID:12016
- C:\Windows\System\hFChZPk.exe
  C:\Windows\System\hFChZPk.exe
  2⤵
  PID:12064
- C:\Windows\System\AGQogRD.exe
  C:\Windows\System\AGQogRD.exe
  2⤵
  PID:12124
- C:\Windows\System\yAIIPOC.exe
  C:\Windows\System\yAIIPOC.exe
  2⤵
  PID:11336
- C:\Windows\System\JIKApkp.exe
  C:\Windows\System\JIKApkp.exe
  2⤵
  PID:11300
- C:\Windows\System\WWjbRsX.exe
  C:\Windows\System\WWjbRsX.exe
  2⤵
  PID:12040
- C:\Windows\System\ZACEPlA.exe
  C:\Windows\System\ZACEPlA.exe
  2⤵
  PID:11584
- C:\Windows\System\qhSjldv.exe
  C:\Windows\System\qhSjldv.exe
  2⤵
  PID:12308
- C:\Windows\System\UfFcMAf.exe
  C:\Windows\System\UfFcMAf.exe
  2⤵
  PID:12328
- C:\Windows\System\mpAfYlX.exe
  C:\Windows\System\mpAfYlX.exe
  2⤵
  PID:12352
- C:\Windows\System\cJuHXUC.exe
  C:\Windows\System\cJuHXUC.exe
  2⤵
  PID:12400
- C:\Windows\System\IpKYUCt.exe
  C:\Windows\System\IpKYUCt.exe
  2⤵
  PID:12420
- C:\Windows\System\xbkmlUE.exe
  C:\Windows\System\xbkmlUE.exe
  2⤵
  PID:12440
- C:\Windows\System\ckpGXIx.exe
  C:\Windows\System\ckpGXIx.exe
  2⤵
  PID:12460
- C:\Windows\System\CcOgfRb.exe
  C:\Windows\System\CcOgfRb.exe
  2⤵
  PID:12500
- C:\Windows\System\oCbOdHT.exe
  C:\Windows\System\oCbOdHT.exe
  2⤵
  PID:12536
- C:\Windows\System\XxmhQSN.exe
  C:\Windows\System\XxmhQSN.exe
  2⤵
  PID:12580
- C:\Windows\System\OBwoFmS.exe
  C:\Windows\System\OBwoFmS.exe
  2⤵
  PID:12600
- C:\Windows\System\cYfjjOm.exe
  C:\Windows\System\cYfjjOm.exe
  2⤵
  PID:12624
- C:\Windows\System\ZOkXovP.exe
  C:\Windows\System\ZOkXovP.exe
  2⤵
  PID:12640
- C:\Windows\System\kPFoGXB.exe
  C:\Windows\System\kPFoGXB.exe
  2⤵
  PID:12660
- C:\Windows\System\zluCxJb.exe
  C:\Windows\System\zluCxJb.exe
  2⤵
  PID:12684
- C:\Windows\System\kvxHOTx.exe
  C:\Windows\System\kvxHOTx.exe
  2⤵
  PID:12736
- C:\Windows\System\ohQMYKX.exe
  C:\Windows\System\ohQMYKX.exe
  2⤵
  PID:12760
- C:\Windows\System\IgIiDAG.exe
  C:\Windows\System\IgIiDAG.exe
  2⤵
  PID:12800
- C:\Windows\System\lJFYMvr.exe
  C:\Windows\System\lJFYMvr.exe
  2⤵
  PID:12832
- C:\Windows\System\sunuSuw.exe
  C:\Windows\System\sunuSuw.exe
  2⤵
  PID:12872
- C:\Windows\System\OHNAhkJ.exe
  C:\Windows\System\OHNAhkJ.exe
  2⤵
  PID:12932
- C:\Windows\System\mszLMOu.exe
  C:\Windows\System\mszLMOu.exe
  2⤵
  PID:12988
- C:\Windows\System\IbRYjUC.exe
  C:\Windows\System\IbRYjUC.exe
  2⤵
  PID:13008
- C:\Windows\System\PHKBRkk.exe
  C:\Windows\System\PHKBRkk.exe
  2⤵
  PID:13024
- C:\Windows\System\uOkcCCI.exe
  C:\Windows\System\uOkcCCI.exe
  2⤵
  PID:13040
- C:\Windows\System\sfBFncX.exe
  C:\Windows\System\sfBFncX.exe
  2⤵
  PID:13056
- C:\Windows\System\OnBiDOo.exe
  C:\Windows\System\OnBiDOo.exe
  2⤵
  PID:13080
- C:\Windows\System\vunSEUI.exe
  C:\Windows\System\vunSEUI.exe
  2⤵
  PID:13208
- C:\Windows\System\LwiImkS.exe
  C:\Windows\System\LwiImkS.exe
  2⤵
  PID:13224
- C:\Windows\System\owdAgOF.exe
  C:\Windows\System\owdAgOF.exe
  2⤵
  PID:13244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jfv5k5qk.3em.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACjPQFW.exe

Filesize
1.2MB

MD5
cc1b0d91ff2a98607409fd03c55aa7d1

SHA1
223fc9621cdd8aa1698baf732a00c2138fa716aa

SHA256
67cfa01e7d745eee2ad5cc53668f4f778575d40bbb53793a7325eea32b3bbd1f

SHA512
e7514d9bd920a48316e14a14713951510af7dd4323ca76598c18c9749d1beabb539efa04e91214074e085b2e9f912ca56e02cb830f5eb73e4ca071b355848b1c

Download Submit
C:\Windows\System\CAEYvEV.exe

Filesize
1.2MB

MD5
255697d7797861eac6df97ff87bd22b9

SHA1
f15d58b393a7f126ae95f5e360206151bb849ada

SHA256
3242234e83ff0288143f743c2682a5da4bfa8894b060139a5f373f37ed56aa15

SHA512
24db3556419c92a12956fafb0e0f63ee93cf0d403c51f37a20a29a7fec0c3b496624bd57aed83d89c800dd5be7f822af404f616307b0e412bedf4d4e0b2b374f

Download Submit
C:\Windows\System\HFGRosa.exe

Filesize
1.2MB

MD5
403117557c001a582a4b1abe2f2bcae4

SHA1
c6103a9f97b2baff0db03bb2a3502eeb3344954f

SHA256
498c21a4e6dcca496e7aeafa5dbfbae75389f874b16e3ded476b3e95a0e12e76

SHA512
df01eeb14e892caa7ff8f1569125b46b9c491218343fd53bdcbd2c68ade2612c7cf4422b8fa9578894290b0c78c40571f2a0ec06584765abd5450448714b0a58

Download Submit
C:\Windows\System\HkekybR.exe

Filesize
1.2MB

MD5
89fb51b9090699b922854b5ae6493f9a

SHA1
8823d313dd4076dcfc20a076cf50c98836a079ed

SHA256
d953cc248eeee01d2c6706e3c1ee99f2c9ff9e56f8fe125f6d2646f09a592484

SHA512
7b19f10d1ba5a47049bda09071059ba14bbea696647c2318ddd1c8e1b60209708e9de92d9366c8a3640a396df6dd52e59ca1d838877615595a2a8b524e34490a

Download Submit
C:\Windows\System\JlycaqH.exe

Filesize
1.2MB

MD5
8f13e43869a98c40f0a4af6bb3219b59

SHA1
4293e65e1fa8517c5cb8d1a3663838fa0cca2baf

SHA256
757cd284afe6b24c8485e36f90c433dad491e3852053db4be91118ba67b03929

SHA512
f5df9ed45a1c7b252bfff166a3e41e9a35ee6de07e0695068bce9b8ad6227efeab47cad37a9a7c0b5e527563772a49638dd846942af1ff6a1912b11849fac49a

Download Submit
C:\Windows\System\KXRhXSk.exe

Filesize
1.2MB

MD5
f6dd3dfc371a4b4a034c5880e0604eab

SHA1
21a3a9d34eceeda8dfd53e82923fbdcff8d77dbf

SHA256
1caa6f6aa3f216a9f1646c9d6f9e47b263f6ab205dd35aa326876c083719bff7

SHA512
e3d76fa7fa51c09ee15dee9a80a60fb314eba0b74fe1f9bf140ba4e1b84b2a6ab58443c74ee004847588f44bf08dcf5c5647bf7e6bc794200387f238ce18bc9c

Download Submit
C:\Windows\System\LvocqpW.exe

Filesize
1.2MB

MD5
165aa85b6c52203b77b8e52da76a5d4e

SHA1
0d3cefebd1850825e740270c498ed9fcab0181d8

SHA256
6f6195100c5e1aca53ac6bee4908acd7431c9d1db7d279d39a044d182cbd5d32

SHA512
63cc3559636af48953695ab9a3d43e668f4bde990d392b1a53a011a1ced4c3d60a4af9de899d73084246129e009267d8b9fc52d658e8b53bd18eb192497f6377

Download Submit
C:\Windows\System\MUobzax.exe

Filesize
1.2MB

MD5
513123dc19a99972238afadcc3495acb

SHA1
e2aa5fb1a32a728efe223846fbd37f1e01c6a2e2

SHA256
e327824524bb3856a20897e65016a3e74be49dc03cc160f0bcd28075692bfebc

SHA512
f782c536b4ba3c37e7b3b8b267ab986a902b08b724a08cde3ace3f320930bc7c7b87e84c2541ade2aa4044342a081ce2dccaca9afc70ab9a33dc9505dcfcc50a

Download Submit
C:\Windows\System\NTiNOwh.exe

Filesize
8B

MD5
e3c8eaf01ea47855ef01e4afbd9ff2af

SHA1
f88c6ddff490f20bfa8b414c9581ed4ccfb4583f

SHA256
5227c4e85df1fae15e78a32417ecb84023de36174c33eda1c82b9517821d0324

SHA512
59ee7be82a43b6155f70fadf82a88435324d76e31a43534f13f04b9ba4f717b7f9cd9c80a23a71490e49c11cc8942f4ac231ab31e930a55caf7de8e553cfc8e8

Download Submit
C:\Windows\System\NUpWuCj.exe

Filesize
1.2MB

MD5
cbabc3f6ccf1118b8df6a528e10907bc

SHA1
ad44a10f7c0ec01bd90562126bbf73c02cc33276

SHA256
bed49e1ccd7299b65832c39c31ddd765afe84217a64f00d8efa82666d81f0283

SHA512
d5ddbe5e25bd6d8befedbdd69fea4b5b90439a101bd6f022afa974952db165c8d66e208c8d662e8a1783b880936e12dd065133137c672ca923d7a11aee240407

Download Submit
C:\Windows\System\OMaJArg.exe

Filesize
1.2MB

MD5
295d29fc74a9f1c5d3b2e4ffb1953e28

SHA1
1dccc45210b67879553374a6d3f64a8a6b2586b0

SHA256
23010610274f7b6a4856e5baa3faea01126f59c11acfcdbcd2f174d490458f36

SHA512
804d56c521201c947a5dedd3700baabba5fb6438c892cfa3803e53b54b72441ca5000cb054cddea667fec8f508634c6bf1ef26620159401e9d845ecbb8a0a4be

Download Submit
C:\Windows\System\OVuzfRA.exe

Filesize
1.2MB

MD5
874c030e0f55b4d9617ab9142cb3aabb

SHA1
3de9c592e061fcf9799ca839230a9f19a50603dd

SHA256
4604d3d323a092e0213d00af03380984b6c9b5eb050fbd7faa54295dd9a23ddf

SHA512
9a905ca98500b831e86f02ba4f87a5bf0aaf5070c95eaf1410d17a7f3721ebe24f29a4675f068fdb3dcdb95a3bfffefa1cb2e9b060f536e22fdb5c78f05f4a4d

Download Submit
C:\Windows\System\OnDOzdw.exe

Filesize
1.2MB

MD5
57a4fe09493af5c74b876fddea9ff8be

SHA1
1ff330b084a2a3d90ee7f983b05402f4dec5b6c5

SHA256
0c765d6be1e3a34941580030bdb06c614b9b435606d797d51efa4ebae5155997

SHA512
66482cc89ecd9104dd1081cf8748c86098099f31314542ba14045696d515a678919605381a5f20dd86421a85c0ae2df0524dfd3fd4ebb307f1ca0ebd79a97ec9

Download Submit
C:\Windows\System\PcgjzmB.exe

Filesize
1.2MB

MD5
8242643e08138d39febf794758d6d1a1

SHA1
07e977820d74166d964f5fdecfd8e392c053d884

SHA256
447b2759421b7c4a923faf32e33303b98d3cd69984f7fc472416cdd41be9881c

SHA512
31f0ff792b8e4e45267ddf50e6b5be751e74cd0d94a7dbea33146f126c2ad13ddbe2ec309de8e3deb422b1d50982c502e56786c453b56fde03cd92aa04389ca2

Download Submit
C:\Windows\System\RDyCQay.exe

Filesize
1.2MB

MD5
0ce6f11d4d17ef004087decb8dafe155

SHA1
f661fa5a17de80bfc0ded071c691498114362098

SHA256
5c18bbe03ba7f36e95bfd6221c679a503f393ea954df4d7ebc25c2dd11e36beb

SHA512
14fb4292296c15fa51de6dcc78f575f28f3bdc9eb2f6120e9b15fb1ebc19184984f8dddd65431b87b717ac4cb863208401c3a29fe830becb2e43216a72f76490

Download Submit
C:\Windows\System\SgdpyMg.exe

Filesize
1.2MB

MD5
516097731b63333075259a16a3b440da

SHA1
de5d6110a76874c69ca7ee87317a0c73cc509224

SHA256
5c06354d9783dee144ad73416056d24fee76863c5fc538849e5e712d49b09d73

SHA512
7270838010823de56d05a1955a53e1fbfe45d3e8ca130275933e08d3590f2e4b6141fba58a10e2b6ec23c34b6f1443e3b00fd47506e04101802a997d1ceedc25

Download Submit
C:\Windows\System\TDjVaUj.exe

Filesize
1.2MB

MD5
dae7b37a14e928052959d24b5e5ba144

SHA1
02c923391c0640e296843035c5453e86552ced7a

SHA256
d1beebce7e294a4ba5dbd2623cccf7ab37e053a079a990e4105ec8e30ce050e6

SHA512
052c43b458c848cadf13db4e1f8d9656a77d21b28a0bbbcb14ef0568d9f0698a8b5ca1c12ce2a8eb035dba65ce7267d97a8e976b9f1bb512de66999ad7540482

Download Submit
C:\Windows\System\VEALyhE.exe

Filesize
1.2MB

MD5
7dcf20f117fa0781211d8ff143560f90

SHA1
0b8b1f67c9cc8dc0399139ff659612365c9a984a

SHA256
ca21105e3e280a01027455662e033184b3ce9ab8b7710fd399cf9af94f5acd69

SHA512
d39147a198a20898efef5ea405f3d863a9d72322c7d0e479c3a659c50888b2eb5b028537b3cbb90ab0d09225214d6e55edba3ce3593ed7232d65475a052a3acc

Download Submit
C:\Windows\System\VdOJFNv.exe

Filesize
1.2MB

MD5
fed636e3c88eb071be96fc59a71c7be3

SHA1
492d5fa11b1d2f9c76d7045c944f1826db6556f7

SHA256
6b7e4dfab88fb0a631e21b6d6be7ce11c341b9d57cc1bbb8f693c35a00a70385

SHA512
bc2701ccfa973e89ed6d3b72fa61e8f0078e14b966e2d35b4c202d6714605259f43cc7bd916a0fadcd30736bac19408ebb4e31e7654f15a59375794b8a1ecea5

Download Submit
C:\Windows\System\VmXhROu.exe

Filesize
1.2MB

MD5
f72db4a85ef684d372064c606f7a640c

SHA1
d6970d9980432e790d0013d925e4e04c9c526080

SHA256
28547225ff2631fde72b44dfa5fb2c3e07d49ab2601d8eb90c5583004db97330

SHA512
e800b543d81c6d1be8d767d84b5fe80940a3e376515c856fdc6ec6ec28e7712671ae04dc1ced99ca12fc3a938fc1f857fe3056aeefb2abd21926d0dfd9a2b124

Download Submit
C:\Windows\System\WZaZlom.exe

Filesize
1.2MB

MD5
f4dbe8f92051fb357427676b42f0cd4c

SHA1
73683ac0a09b3c9cf06563d0a0047284631e1a43

SHA256
2b8d2ffedd2df1fbb6592f151878ea3546e2c240d17b838bce86ab6d78442181

SHA512
f7190ce7c93432f790d15dd9cfd208adc74d5d31ac81b5bdd5f4f913747596f978724faf9775c079f347b88e14cd39030fee1b2dd680bd42294160c136cb3022

Download Submit
C:\Windows\System\YGWRwlS.exe

Filesize
1.2MB

MD5
67eab1ecf9d5dbb5006655254de2c8a0

SHA1
ff8604f75f21892b09079bb82f0618ed9ca06715

SHA256
c72c4a2526364e7749b350f2f2107860d7af227895b9ba14745b4feb3c3eb01f

SHA512
d92fcd5ba63c9abfe933e0954f621dcfb47f13e8f785accc3386d90f826321d1386d2d8fba87023e35a9141e000bcd4dfdf92599545e89fff299876a941e88bc

Download Submit
C:\Windows\System\ZcrHZlH.exe

Filesize
1.2MB

MD5
e49ed1567e78d5bb9496dc317e54ef66

SHA1
e46b3a914a41bd611f88b3a75b402d0ac8bc100e

SHA256
54d227630e8cbbebba2ce34e7fc00f37eda69e38474a76e8c0541dddc9f0d39a

SHA512
4c743c067473884ef1a7d2a9d82f9c79428b36a76e4d6434dd7cfbfc397760f6dee7258c38185d1d00c77c3c98b43d2fd7a2c135e0b7749ac7911f1854c8c9c9

Download Submit
C:\Windows\System\btTdFgL.exe

Filesize
1.2MB

MD5
36deec11767eb83a6fcbc1ef1a18ea9f

SHA1
9ec8f8bc42910802839411c257477f15a392b19c

SHA256
d7c2e1601c175cb211b539123b16cf0a0da46da695c0cb22e9a2f27ab6c9635c

SHA512
b62e8c860448c3062c1d8f7ab7ed43e5cc8c164f7384991a5700b0db5e178293fc8edf848312c6151f185c457f05eb4bc5770e2f0af82bbcc566523e254bdbf2

Download Submit
C:\Windows\System\cNDKnII.exe

Filesize
1.2MB

MD5
66e01bf824962ab78c6a18d05822d3c4

SHA1
9e527c8d1f1c3ea2872878762a8a96cb4164520f

SHA256
9f458e8d7963f8ed4e635edd666a4b52904917e4adb1aa4bc8721aaf6f8d177b

SHA512
e53e39fc88be9209f5d868e40f632396a68643b2e0005df8a630f9d1fca3bfae46783555216712397eec7847d2cfb0040534652256e435e45a287ca3bf18b15c

Download Submit
C:\Windows\System\eMzpLLX.exe

Filesize
1.2MB

MD5
3caaa87a3f6c261d086349c55508df81

SHA1
1c26647cda4906f65b6dcc1f04bab06ae80a72c2

SHA256
2dfc1b54c1e1bf514bed50fb4cbeb115c39e98b3a5fc406cac0acc6878ded2fa

SHA512
a7a52979b21a67f200b166aef3917fa99dd0dce19b82eee6f030ae440d78a74514015fb7f95c0c1d129b66ea888c7bf9ab6f855cf8f50783aaee14891e28863b

Download Submit
C:\Windows\System\eljcGRs.exe

Filesize
1.2MB

MD5
f5a60f9c62ea0f2e591dead234c34305

SHA1
c76fbb405e6fe61302118050e7ec0d6b123e8b12

SHA256
c5e82c96c5ac622fbfff2623caa617ad85f87363318f2c3ade56410f3d48c69b

SHA512
336058fc8de0fc194f25445d687f7e1654e940e0a63fb4e273693af1416d447464fc0f6679a173cee2aaa7ff3cb3ede37bf620f9c23ce6b447dbcfa908c366c1

Download Submit
C:\Windows\System\emAurvz.exe

Filesize
1.2MB

MD5
c02b449687ea10e81aa433a26340a455

SHA1
fe72e40f83a986ebac595856776286fe264efadd

SHA256
60d9481a7b86a9da8cc7143a2f2f301db1eee0c9e1716ff5b872c47a4dd58a8c

SHA512
e50be2a5642022b8e37edb60132964008fe35687252c0cb18f70840ce5be6f9fcf13eaab4d14eede27988151aaf97319cfc9604a470b5a36d6247958e23674c3

Download Submit
C:\Windows\System\fIETTbd.exe

Filesize
1.2MB

MD5
022a8000d0c6f82d11189c78517fee25

SHA1
a9f743ebdcddc21567ef699a4397300ab38d4535

SHA256
fb84cf5448a7e42bd2435064565ff229d3320cd214ebc5e22f0ba3f013682d0d

SHA512
25a2e63a2bba7ff0f5dd323a35dd718cdf24b57820d7fded0204cb26d715c810948248cc809775488c011d2d9bc901b143f31d73ed5eb38a4d9bdd7ca851401c

Download Submit
C:\Windows\System\kERzchH.exe

Filesize
1.2MB

MD5
fa382422ba4d0a5d35b0c3ff7afb0f4e

SHA1
4eda33af0a6cfbfdb3e40578a24299723f106cc8

SHA256
05e81f6c4b723782157629648469eaf6bf8b1b50ee13ac8cda385464a2c87010

SHA512
647bbd0bccc30059216973a7e2b75bec4bfdfac5b9705e01187e3fa0113ed605157246987b3a9cc06ef98b001bdc1cb0fd928d020fd7f3fba6ffc737a42375e5

Download Submit
C:\Windows\System\kSHIhYh.exe

Filesize
1.2MB

MD5
3893d850a6142ceaa4fa4789ea9726c7

SHA1
e118c266ef948a9fd2186e19c7cda472a7e684f4

SHA256
8b029670b31ef1bce64e0d11b82cd44d0b7d300e319d3a2f2f7e3662c8db0f8e

SHA512
6baf139af5062fdcf8d249a386179cd7db6a6a7f82648e836b00e2301ff596e0eb2cdefe71dd08d392601f60a8017c295fb5946025753fe71aec788bcf3cbd17

Download Submit
C:\Windows\System\nVArgsU.exe

Filesize
1.2MB

MD5
e1ff28c4438cf4f5985fc751a4ea3a18

SHA1
6db86c8941e81370e5d6dc918ff56bca41abf73e

SHA256
1336a5dcd92cbd4a4bbbf0ef373c9eedda55ad7ba01ab50bce92f84da96b810d

SHA512
8599841cf29235798eb59bde5481956c6794ea61026d28699819170b769e59bb008ac1dd13760a3816e1161f53d81bd9d7ff3a820d600a6282738aa8e4cf54ff

Download Submit
C:\Windows\System\oqMLdmI.exe

Filesize
1.2MB

MD5
677d1179d43adfe624763b60ff31031d

SHA1
b4d711aa9b34f6557eea8bc81c8572f3713419e6

SHA256
75cb5e06d246eabfcea7fa8e4c40ec86bb9628fdf26fcae58d83312765b73dd2

SHA512
d597c4435bd6552276dd8f67e4c47f1a63f6acf7775909fe6174fbde2529a26642c0966a81d63f6ec31b7b949933a5fce8c95fc4cd4370ca8bfbec4b37a6727f

Download Submit
C:\Windows\System\phaPzre.exe

Filesize
1.2MB

MD5
b89f1caa55e9c65b7c3e1f6a1bf3f05f

SHA1
67308f903ea2f3db2546cc4018d5ea53c185f540

SHA256
5cdb6038cdaebda4bca32f5a1b8562560ba66fa8aba4bb066aef109e85a94e83

SHA512
23b5bedbebbb306443545eaa843dc83b90517f92160e2b16614ed9e15329768dc030d9910894355a7425b01f33f7ce098a7888765bade7184d1a7610c46460cf

Download Submit
C:\Windows\System\qUOFxRq.exe

Filesize
1.2MB

MD5
1eaed2f510a61e3d87b9472df44ed1c8

SHA1
20d5cbf0328e690b1aa5596dcf8f447576eb4668

SHA256
76ccb5997ca0b022fbdbe2862605ae30bd768fc87ac7ef74eaa602d215a70bc4

SHA512
81448c43e639d9a3c6e5845c1446952d1258d3957dcd2fe640019ad879460c5a57b8f0c801eee548ca63ca8f891d9d425aba37a1c52be5a0a9126cd186949617

Download Submit
C:\Windows\System\qXPfAbO.exe

Filesize
1.2MB

MD5
a08cbff4f578128513fb5ab20c16848e

SHA1
20963f2cb8610998bcb1684ef22d18fefe5f2b46

SHA256
dee471f0f0f7c001de8f5b6941c691eb04f7526ae35a0d899e0f0ddce740a2b4

SHA512
a3d6d4e482c20b65aa5ff41b261ad28b85b48882e9c3dacd64354d3d7f84f2bae8b2975cd564478ba11bfdc04a90f7695e3c46f671a69717a9c2412e0de09332

Download Submit
C:\Windows\System\qcfEjiF.exe

Filesize
1.2MB

MD5
44fdfcb418dcf7b6c8d8d544ff8e741e

SHA1
c1d468e32d5ce7dcd0f880f03aea8e8344863d97

SHA256
01e29dd56e497184f0024775466e5b15c6dd4400e366b011699da8705bae73be

SHA512
57209a6b7dee03c2ebb34f2ad977b16e7fabb0a8dc24c8c840fd18b03559b1c2c9bd3531f6ab3aec82afbb76b9106d380eb9fc1b37ad9184691c180319ddf89a

Download Submit
C:\Windows\System\qvXrMYY.exe

Filesize
1.2MB

MD5
845fc0022b4092664fc92d6940e69608

SHA1
f62a325ecce432a807d3f7618b7fef0f57766485

SHA256
81bff086fea82f64f4105574ded876f7f4edc7403fb345025d6a8eb7ca6780e7

SHA512
5ea2ea332eb010b8166eef09d54b124e73860778629590262d060afd9d2d9687e2fe529f825563809cece859eba29e64eba87712a172ae38824aafb210249adc

Download Submit
C:\Windows\System\rKYArEw.exe

Filesize
1.2MB

MD5
f00c04ecc6afa7692de61dbda430dfc0

SHA1
aab24fb568c7245ace8f099f4e22c1bcec31e04a

SHA256
0a49f1a74f5b915b8471915d9c644db97a59a1ce1dead73291ff2a403c50f1e2

SHA512
2f31caedf004746562a884814658260064c5969dec4d7a0912aafc93de6214cdd84f148e2e930e92999eec001b6da36fdee39b2600b4d6551e672b58301ffa34

Download Submit
C:\Windows\System\rhPRetA.exe

Filesize
1.2MB

MD5
9adbae3a1739e54919552f21db85ab26

SHA1
7522078ee5bd9eab8e25f5b4878289190331fed5

SHA256
60ef99c26167d626bd9e13c23f8ae26ec21cd16910803fc4c4268db8c0507a58

SHA512
75830ea6d64595773b0113d7dfc241567f4a60f159f057a9c5a9015b69dd7642305b3eb332a8820130fa171d4698cb9999f2ef530131b013194fd44c7728a2d3

Download Submit
C:\Windows\System\rrgWSEO.exe

Filesize
1.2MB

MD5
90862ee1e57000a75b76b84cd34b749f

SHA1
3963ddb2f7f2688f89982236daaebb8b30b4f57c

SHA256
5e56a65bb64a6bcd1f7872691584332695bc3808f0c4057b16935ef7661e19a2

SHA512
8d3fdbfb5c1858011f88efb603f7b70f35b73082e6f4cfce73fe9f304dc9b8480a54c24906a8e5f39933c96793102eab9ba989156a03247b27d150fa9596ae01

Download Submit
C:\Windows\System\slqTGCg.exe

Filesize
1.2MB

MD5
d53019c22b8ba4018cc552f266e66673

SHA1
ad7aa7325d083f7cccf66a1d501e62500efedde7

SHA256
3273d084ff454516e85f193049ffcc985afee2f5770c220e284a8d20e7f13d3f

SHA512
3379035b84780ebed836cf29ed9fc11ee689c7f5445130c6aa8086bb085bbad17f39d3902c338f35fd0d1a79366be4785e7f414d6cb5dc75d8a15b534066d738

Download Submit
C:\Windows\System\uzzMIFw.exe

Filesize
1.2MB

MD5
2860e189ac5de4d76f330035c46f6ec6

SHA1
67bff48494581303229e261ba9b04ed0e2d8a0c9

SHA256
7327da502720b7ce1e75a73c507c3bae4663ef066cca2fc27bd3cf3c4c116826

SHA512
b9f43e00189d6e20492e10f11004063904d36702af645ffcdd8c770685d7ce7890aab4b112cac672191def346caa61510c5fe8638f375703c5e03bf01821aa97

Download Submit
C:\Windows\System\wBcOJmv.exe

Filesize
1.2MB

MD5
dd2aa7877ef88259f4cc2a36ca4edb8d

SHA1
7c34f2f0f470d26413e7d294c87e0d9d4b2da0bf

SHA256
4fff60d327eca9c7642ec2a6ef0dd513318d6fbfc6e1764e6c22b8aa7e8d3b40

SHA512
0b07f5167d7c7929c17b94c4cec3ea95f3f04ce55c04038c10c6e122318afbf7f5d3cda30ddd10e2e1159b50f6b7ee940f84ff11c4b3172f13958ab5577ac768

Download Submit
C:\Windows\System\xjlPTXj.exe

Filesize
1.2MB

MD5
49f09d5ecc8a9deb8d2d6b54b2cf3c6c

SHA1
d94d1451083e05322860d746b731ac30ec46328c

SHA256
b74dccbcb729088db98d7c99172540ac2ad01cab009e3b29deb6639ae4c1ab67

SHA512
98188ddd854d885f0400bb777e0510a3e067c8bf11b72caf326766badf463118ebffc765ab57b4fd29249f880de386a78b7757eef8bc7a8cc714160b298a01a2

Download Submit
C:\Windows\System\zBFnTET.exe

Filesize
1.2MB

MD5
08cbac48eeddee07a21bc1d169644716

SHA1
73e7ff57eb96c09a06b93a42ddd523415bb83033

SHA256
616311c31a64477e5b78f6d973ae6f339c81f53657b08941bca073ff0f2fe06e

SHA512
b3af4030f75a0faa45d4dd7994e1a8b27b156255d1bff28ec1a4e61a37bb757ca98e9bbd506ff08c2698fb203cf26b9fb26cbcdc71057155bdc359b43baba681

Download Submit
C:\Windows\System\zReikSf.exe

Filesize
1.2MB

MD5
a73c51aa6d44fbd4df6ed8106539d181

SHA1
29c4354f8e6788be59e000345bae02ec86c56d5e

SHA256
344b23062029511dd524a80180cd78784b9e71fe646fa28a27b6acddbc7d5f76

SHA512
51866bd2bf4f7ad773b2f50b9396f14c9a7c1fa853d5d76086d7c599b4701c0c22f17f150dd0b96f1b9d4dad6e5aa34aab37a1816e4996fdaa6fee198e09a635

Download Submit
memory/208-2046-0x00007FF64D470000-0x00007FF64D862000-memory.dmp

Filesize
3.9MB

Download
memory/208-816-0x00007FF64D470000-0x00007FF64D862000-memory.dmp

Filesize
3.9MB

Download
memory/220-283-0x00007FF695550000-0x00007FF695942000-memory.dmp

Filesize
3.9MB

Download
memory/220-2019-0x00007FF695550000-0x00007FF695942000-memory.dmp

Filesize
3.9MB

Download
memory/316-284-0x00007FF73ADB0000-0x00007FF73B1A2000-memory.dmp

Filesize
3.9MB

Download
memory/316-2020-0x00007FF73ADB0000-0x00007FF73B1A2000-memory.dmp

Filesize
3.9MB

Download
memory/368-1996-0x00007FF7E87B0000-0x00007FF7E8BA2000-memory.dmp

Filesize
3.9MB

Download
memory/368-2010-0x00007FF7E87B0000-0x00007FF7E8BA2000-memory.dmp

Filesize
3.9MB

Download
memory/368-29-0x00007FF7E87B0000-0x00007FF7E8BA2000-memory.dmp

Filesize
3.9MB

Download
memory/932-2064-0x00007FF6436E0000-0x00007FF643AD2000-memory.dmp

Filesize
3.9MB

Download
memory/932-286-0x00007FF6436E0000-0x00007FF643AD2000-memory.dmp

Filesize
3.9MB

Download
memory/932-2001-0x00007FF6436E0000-0x00007FF643AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-778-0x00007FF6B0EE0000-0x00007FF6B12D2000-memory.dmp

Filesize
3.9MB

Download
memory/1124-2081-0x00007FF6B0EE0000-0x00007FF6B12D2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-2050-0x00007FF69E860000-0x00007FF69EC52000-memory.dmp

Filesize
3.9MB

Download
memory/1368-280-0x00007FF69E860000-0x00007FF69EC52000-memory.dmp

Filesize
3.9MB

Download
memory/1680-650-0x00007FF713610000-0x00007FF713A02000-memory.dmp

Filesize
3.9MB

Download
memory/1680-2045-0x00007FF713610000-0x00007FF713A02000-memory.dmp

Filesize
3.9MB

Download
memory/1944-285-0x00007FF653050000-0x00007FF653442000-memory.dmp

Filesize
3.9MB

Download
memory/1944-2048-0x00007FF653050000-0x00007FF653442000-memory.dmp

Filesize
3.9MB

Download
memory/2040-799-0x00007FF690CB0000-0x00007FF6910A2000-memory.dmp

Filesize
3.9MB

Download
memory/2040-2014-0x00007FF690CB0000-0x00007FF6910A2000-memory.dmp

Filesize
3.9MB

Download
memory/2060-2002-0x00007FF628D60000-0x00007FF629152000-memory.dmp

Filesize
3.9MB

Download
memory/2060-2052-0x00007FF628D60000-0x00007FF629152000-memory.dmp

Filesize
3.9MB

Download
memory/2060-287-0x00007FF628D60000-0x00007FF629152000-memory.dmp

Filesize
3.9MB

Download
memory/2412-578-0x00007FF7C8A10000-0x00007FF7C8E02000-memory.dmp

Filesize
3.9MB

Download
memory/2412-2071-0x00007FF7C8A10000-0x00007FF7C8E02000-memory.dmp

Filesize
3.9MB

Download
memory/2556-2072-0x00007FF773080000-0x00007FF773472000-memory.dmp

Filesize
3.9MB

Download
memory/2556-820-0x00007FF773080000-0x00007FF773472000-memory.dmp

Filesize
3.9MB

Download
memory/2584-2023-0x00007FF66FD20000-0x00007FF670112000-memory.dmp

Filesize
3.9MB

Download
memory/2584-817-0x00007FF66FD20000-0x00007FF670112000-memory.dmp

Filesize
3.9MB

Download
memory/2700-11-0x00007FF765850000-0x00007FF765C42000-memory.dmp

Filesize
3.9MB

Download
memory/2700-1995-0x00007FF765850000-0x00007FF765C42000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2008-0x00007FF765850000-0x00007FF765C42000-memory.dmp

Filesize
3.9MB

Download
memory/3096-2016-0x00007FF605770000-0x00007FF605B62000-memory.dmp

Filesize
3.9MB

Download
memory/3096-34-0x00007FF605770000-0x00007FF605B62000-memory.dmp

Filesize
3.9MB

Download
memory/3096-2000-0x00007FF605770000-0x00007FF605B62000-memory.dmp

Filesize
3.9MB

Download
memory/3200-281-0x00007FF73ABD0000-0x00007FF73AFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3200-2032-0x00007FF73ABD0000-0x00007FF73AFC2000-memory.dmp

Filesize
3.9MB

Download
memory/3828-651-0x00007FF73C090000-0x00007FF73C482000-memory.dmp

Filesize
3.9MB

Download
memory/3828-2031-0x00007FF73C090000-0x00007FF73C482000-memory.dmp

Filesize
3.9MB

Download
memory/4148-1998-0x00007FF74BEB0000-0x00007FF74C2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4148-80-0x00007FF74BEB0000-0x00007FF74C2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4148-2024-0x00007FF74BEB0000-0x00007FF74C2A2000-memory.dmp

Filesize
3.9MB

Download
memory/4160-713-0x00007FF6F25E0000-0x00007FF6F29D2000-memory.dmp

Filesize
3.9MB

Download
memory/4160-2049-0x00007FF6F25E0000-0x00007FF6F29D2000-memory.dmp

Filesize
3.9MB

Download
memory/4404-490-0x00007FF728190000-0x00007FF728582000-memory.dmp

Filesize
3.9MB

Download
memory/4404-2047-0x00007FF728190000-0x00007FF728582000-memory.dmp

Filesize
3.9MB

Download
memory/4508-1-0x000002B37CFB0000-0x000002B37CFC0000-memory.dmp

Filesize
64KB

Download
memory/4508-0-0x00007FF65E9F0000-0x00007FF65EDE2000-memory.dmp

Filesize
3.9MB

Download
memory/4772-83-0x00007FF9EF7C3000-0x00007FF9EF7C5000-memory.dmp

Filesize
8KB

Download
memory/4772-1128-0x000001F1DFCB0000-0x000001F1E0456000-memory.dmp

Filesize
7.6MB

Download
memory/4772-278-0x00007FF9EF7C0000-0x00007FF9F0281000-memory.dmp

Filesize
10.8MB

Download
memory/4772-474-0x000001F1C68E0000-0x000001F1C6902000-memory.dmp

Filesize
136KB

Download
memory/4772-279-0x00007FF9EF7C0000-0x00007FF9F0281000-memory.dmp

Filesize
10.8MB

Download
memory/4772-1928-0x00007FF9EF7C0000-0x00007FF9F0281000-memory.dmp

Filesize
10.8MB

Download
memory/4852-282-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp

Filesize
3.9MB

Download
memory/4852-2027-0x00007FF7E41A0000-0x00007FF7E4592000-memory.dmp

Filesize
3.9MB

Download
memory/4960-51-0x00007FF63AD40000-0x00007FF63B132000-memory.dmp

Filesize
3.9MB

Download
memory/4960-1997-0x00007FF63AD40000-0x00007FF63B132000-memory.dmp

Filesize
3.9MB

Download
memory/4960-2012-0x00007FF63AD40000-0x00007FF63B132000-memory.dmp

Filesize
3.9MB

Download
memory/4984-163-0x00007FF780E20000-0x00007FF781212000-memory.dmp

Filesize
3.9MB

Download
memory/4984-2028-0x00007FF780E20000-0x00007FF781212000-memory.dmp

Filesize
3.9MB

Download
memory/4984-1999-0x00007FF780E20000-0x00007FF781212000-memory.dmp

Filesize
3.9MB

Download