xmrig | d4e3cfc1d30c49046054d562d108e68c4589f8bd95daaf19e8ec5601f88f4154

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b10678bbe71a22d3608029e72412b4a0N.exe
Size

1.9MB
MD5

b10678bbe71a22d3608029e72412b4a0
SHA1

078073469a6166bb4747edacfe3c9177bf8d3885
SHA256

d4e3cfc1d30c49046054d562d108e68c4589f8bd95daaf19e8ec5601f88f4154
SHA512

32d8a5c4b59910777ef30fc120a750407c0851aff5697004271c10a21b7a7d243334ad71dad977710707844a5f7b324b12b3a9beaefd925a70ec75cf26677008
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+7RrTFl6hvVja:Lz071uv4BPMkyW10/w16BvZX71Fq8+g

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3936-44-0x00007FF791230000-0x00007FF791622000-memory.dmp	xmrig
behavioral2/memory/4016-76-0x00007FF73F170000-0x00007FF73F562000-memory.dmp	xmrig
behavioral2/memory/4736-307-0x00007FF79B6E0000-0x00007FF79BAD2000-memory.dmp	xmrig
behavioral2/memory/3776-316-0x00007FF6D7D50000-0x00007FF6D8142000-memory.dmp	xmrig
behavioral2/memory/2908-318-0x00007FF6AC770000-0x00007FF6ACB62000-memory.dmp	xmrig
behavioral2/memory/4500-313-0x00007FF6BD980000-0x00007FF6BDD72000-memory.dmp	xmrig
behavioral2/memory/4980-398-0x00007FF66CD60000-0x00007FF66D152000-memory.dmp	xmrig
behavioral2/memory/552-399-0x00007FF77A9D0000-0x00007FF77ADC2000-memory.dmp	xmrig
behavioral2/memory/2012-400-0x00007FF7299C0000-0x00007FF729DB2000-memory.dmp	xmrig
behavioral2/memory/5088-402-0x00007FF788890000-0x00007FF788C82000-memory.dmp	xmrig
behavioral2/memory/4856-401-0x00007FF7EED60000-0x00007FF7EF152000-memory.dmp	xmrig
behavioral2/memory/1948-403-0x00007FF7C9D10000-0x00007FF7CA102000-memory.dmp	xmrig
behavioral2/memory/1028-404-0x00007FF6C92E0000-0x00007FF6C96D2000-memory.dmp	xmrig
behavioral2/memory/2008-405-0x00007FF6CB9B0000-0x00007FF6CBDA2000-memory.dmp	xmrig
behavioral2/memory/392-415-0x00007FF693750000-0x00007FF693B42000-memory.dmp	xmrig
behavioral2/memory/1008-446-0x00007FF6F9770000-0x00007FF6F9B62000-memory.dmp	xmrig
behavioral2/memory/964-436-0x00007FF617480000-0x00007FF617872000-memory.dmp	xmrig
behavioral2/memory/2832-406-0x00007FF63EF60000-0x00007FF63F352000-memory.dmp	xmrig
behavioral2/memory/4132-95-0x00007FF71EA00000-0x00007FF71EDF2000-memory.dmp	xmrig
behavioral2/memory/1604-85-0x00007FF7ED660000-0x00007FF7EDA52000-memory.dmp	xmrig
behavioral2/memory/2404-69-0x00007FF766CE0000-0x00007FF7670D2000-memory.dmp	xmrig
behavioral2/memory/4448-51-0x00007FF60E6B0000-0x00007FF60EAA2000-memory.dmp	xmrig
behavioral2/memory/5000-23-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp	xmrig
behavioral2/memory/1896-1116-0x00007FF771A20000-0x00007FF771E12000-memory.dmp	xmrig
behavioral2/memory/4944-1113-0x00007FF7FA2E0000-0x00007FF7FA6D2000-memory.dmp	xmrig
behavioral2/memory/5000-1235-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp	xmrig
behavioral2/memory/5000-2093-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp	xmrig
behavioral2/memory/1896-2095-0x00007FF771A20000-0x00007FF771E12000-memory.dmp	xmrig
behavioral2/memory/3936-2097-0x00007FF791230000-0x00007FF791622000-memory.dmp	xmrig
behavioral2/memory/4736-2101-0x00007FF79B6E0000-0x00007FF79BAD2000-memory.dmp	xmrig
behavioral2/memory/4500-2103-0x00007FF6BD980000-0x00007FF6BDD72000-memory.dmp	xmrig
behavioral2/memory/2404-2105-0x00007FF766CE0000-0x00007FF7670D2000-memory.dmp	xmrig
behavioral2/memory/4448-2100-0x00007FF60E6B0000-0x00007FF60EAA2000-memory.dmp	xmrig
behavioral2/memory/4980-2140-0x00007FF66CD60000-0x00007FF66D152000-memory.dmp	xmrig
behavioral2/memory/4856-2146-0x00007FF7EED60000-0x00007FF7EF152000-memory.dmp	xmrig
behavioral2/memory/1008-2148-0x00007FF6F9770000-0x00007FF6F9B62000-memory.dmp	xmrig
behavioral2/memory/5088-2150-0x00007FF788890000-0x00007FF788C82000-memory.dmp	xmrig
behavioral2/memory/1948-2152-0x00007FF7C9D10000-0x00007FF7CA102000-memory.dmp	xmrig
behavioral2/memory/1028-2154-0x00007FF6C92E0000-0x00007FF6C96D2000-memory.dmp	xmrig
behavioral2/memory/552-2144-0x00007FF77A9D0000-0x00007FF77ADC2000-memory.dmp	xmrig
behavioral2/memory/2012-2142-0x00007FF7299C0000-0x00007FF729DB2000-memory.dmp	xmrig
behavioral2/memory/3776-2133-0x00007FF6D7D50000-0x00007FF6D8142000-memory.dmp	xmrig
behavioral2/memory/2908-2132-0x00007FF6AC770000-0x00007FF6ACB62000-memory.dmp	xmrig
behavioral2/memory/1604-2129-0x00007FF7ED660000-0x00007FF7EDA52000-memory.dmp	xmrig
behavioral2/memory/4132-2128-0x00007FF71EA00000-0x00007FF71EDF2000-memory.dmp	xmrig
behavioral2/memory/4016-2135-0x00007FF73F170000-0x00007FF73F562000-memory.dmp	xmrig
behavioral2/memory/2008-2156-0x00007FF6CB9B0000-0x00007FF6CBDA2000-memory.dmp	xmrig
behavioral2/memory/2832-2169-0x00007FF63EF60000-0x00007FF63F352000-memory.dmp	xmrig
behavioral2/memory/392-2167-0x00007FF693750000-0x00007FF693B42000-memory.dmp	xmrig
behavioral2/memory/964-2164-0x00007FF617480000-0x00007FF617872000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	4076	powershell.exe
13	4076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4076	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1896	PzHjibO.exe
5000	QQnARkH.exe
4736	ZLpMtXd.exe
3936	KCOIXXG.exe
4500	XsvaPpM.exe
4448	bfKvArz.exe
2404	DLDUADp.exe
3776	OmUKozi.exe
4016	qTmHEuW.exe
2908	hBQfkNB.exe
1604	olZDYnb.exe
4132	ySHGmdC.exe
4980	bNYWuma.exe
552	HTprrHY.exe
2012	sotZeDr.exe
1008	uFPukGE.exe
4856	tdpZjit.exe
5088	MXIwigk.exe
1948	dvrkFFB.exe
1028	SvTZrAR.exe
2008	xolUZWW.exe
2832	wotgJXZ.exe
392	FrFJLMY.exe
964	kVspACp.exe
1944	CsHGoYB.exe
2616	VDFpRsJ.exe
3476	MLQJUMu.exe
2592	JYWvyUv.exe
2468	PqoAZlN.exe
5044	meGeXQI.exe
2852	fDZViSf.exe
4272	MWbxtLW.exe
2384	GAjyCBN.exe
3616	GLJURLj.exe
1096	efPfPYc.exe
3640	FovHTBz.exe
1184	tmXKdxX.exe
4844	DooSwnD.exe
4424	gdwIFdP.exe
4292	lBLVBGi.exe
1636	LXxnHTQ.exe
2400	APRUOTH.exe
2524	HjqRLyh.exe
4324	zcfRYJq.exe
4360	axOZzkb.exe
5096	yOHVWXP.exe
3920	GggpQQi.exe
3632	waEDXRj.exe
1952	zPLzsUp.exe
2168	sIHYkJU.exe
4928	ctDJiIl.exe
1092	GrLDloE.exe
3604	EIxSotN.exe
4588	AKMVKYX.exe
2840	jsUuZFM.exe
2136	TZuzLLt.exe
1532	qSMCOlm.exe
2576	rSJHwXC.exe
4840	DmJIzJb.exe
3740	ATVBUpH.exe
2256	vqXwQde.exe
1668	goqsfoM.exe
1492	inWDdom.exe
2792	LpsYJMB.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4944-0-0x00007FF7FA2E0000-0x00007FF7FA6D2000-memory.dmp	upx
behavioral2/files/0x00080000000234cc-17.dat	upx
behavioral2/files/0x00070000000234d3-26.dat	upx
behavioral2/files/0x00070000000234d5-38.dat	upx
behavioral2/memory/3936-44-0x00007FF791230000-0x00007FF791622000-memory.dmp	upx
behavioral2/memory/4016-76-0x00007FF73F170000-0x00007FF73F562000-memory.dmp	upx
behavioral2/files/0x00070000000234db-91.dat	upx
behavioral2/files/0x00070000000234df-99.dat	upx
behavioral2/files/0x00080000000234de-110.dat	upx
behavioral2/files/0x00070000000234e2-119.dat	upx
behavioral2/files/0x00080000000234dd-132.dat	upx
behavioral2/files/0x00070000000234e4-142.dat	upx
behavioral2/files/0x00070000000234e8-154.dat	upx
behavioral2/files/0x00070000000234e9-167.dat	upx
behavioral2/files/0x00070000000234eb-177.dat	upx
behavioral2/memory/4736-307-0x00007FF79B6E0000-0x00007FF79BAD2000-memory.dmp	upx
behavioral2/memory/3776-316-0x00007FF6D7D50000-0x00007FF6D8142000-memory.dmp	upx
behavioral2/memory/2908-318-0x00007FF6AC770000-0x00007FF6ACB62000-memory.dmp	upx
behavioral2/memory/4500-313-0x00007FF6BD980000-0x00007FF6BDD72000-memory.dmp	upx
behavioral2/memory/4980-398-0x00007FF66CD60000-0x00007FF66D152000-memory.dmp	upx
behavioral2/memory/552-399-0x00007FF77A9D0000-0x00007FF77ADC2000-memory.dmp	upx
behavioral2/memory/2012-400-0x00007FF7299C0000-0x00007FF729DB2000-memory.dmp	upx
behavioral2/memory/5088-402-0x00007FF788890000-0x00007FF788C82000-memory.dmp	upx
behavioral2/memory/4856-401-0x00007FF7EED60000-0x00007FF7EF152000-memory.dmp	upx
behavioral2/memory/1948-403-0x00007FF7C9D10000-0x00007FF7CA102000-memory.dmp	upx
behavioral2/memory/1028-404-0x00007FF6C92E0000-0x00007FF6C96D2000-memory.dmp	upx
behavioral2/memory/2008-405-0x00007FF6CB9B0000-0x00007FF6CBDA2000-memory.dmp	upx
behavioral2/memory/392-415-0x00007FF693750000-0x00007FF693B42000-memory.dmp	upx
behavioral2/memory/1008-446-0x00007FF6F9770000-0x00007FF6F9B62000-memory.dmp	upx
behavioral2/memory/964-436-0x00007FF617480000-0x00007FF617872000-memory.dmp	upx
behavioral2/memory/2832-406-0x00007FF63EF60000-0x00007FF63F352000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-184.dat	upx
behavioral2/files/0x00070000000234ec-182.dat	upx
behavioral2/files/0x00070000000234ed-179.dat	upx
behavioral2/files/0x00070000000234ea-172.dat	upx
behavioral2/files/0x00070000000234e7-157.dat	upx
behavioral2/files/0x00070000000234e6-152.dat	upx
behavioral2/files/0x00070000000234e5-147.dat	upx
behavioral2/files/0x00070000000234e3-137.dat	upx
behavioral2/files/0x00070000000234e1-122.dat	upx
behavioral2/files/0x00070000000234e0-117.dat	upx
behavioral2/files/0x00080000000234cd-103.dat	upx
behavioral2/files/0x00070000000234dc-97.dat	upx
behavioral2/memory/4132-95-0x00007FF71EA00000-0x00007FF71EDF2000-memory.dmp	upx
behavioral2/memory/1604-85-0x00007FF7ED660000-0x00007FF7EDA52000-memory.dmp	upx
behavioral2/files/0x00070000000234da-70.dat	upx
behavioral2/memory/2404-69-0x00007FF766CE0000-0x00007FF7670D2000-memory.dmp	upx
behavioral2/files/0x00070000000234d8-63.dat	upx
behavioral2/files/0x00070000000234d9-65.dat	upx
behavioral2/files/0x00070000000234d6-58.dat	upx
behavioral2/files/0x00070000000234d7-56.dat	upx
behavioral2/memory/4448-51-0x00007FF60E6B0000-0x00007FF60EAA2000-memory.dmp	upx
behavioral2/files/0x00070000000234d4-36.dat	upx
behavioral2/files/0x00070000000234d1-32.dat	upx
behavioral2/memory/5000-23-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp	upx
behavioral2/files/0x00070000000234d2-22.dat	upx
behavioral2/files/0x00070000000234d0-11.dat	upx
behavioral2/memory/1896-10-0x00007FF771A20000-0x00007FF771E12000-memory.dmp	upx
behavioral2/memory/1896-1116-0x00007FF771A20000-0x00007FF771E12000-memory.dmp	upx
behavioral2/memory/4944-1113-0x00007FF7FA2E0000-0x00007FF7FA6D2000-memory.dmp	upx
behavioral2/memory/5000-1235-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp	upx
behavioral2/memory/5000-2093-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp	upx
behavioral2/memory/1896-2095-0x00007FF771A20000-0x00007FF771E12000-memory.dmp	upx
behavioral2/memory/3936-2097-0x00007FF791230000-0x00007FF791622000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tmXKdxX.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\sUzTgGL.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\htmYvwG.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\sZfPQfc.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\IPsvYLX.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\vKGgnIy.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\FjRVEZx.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\tZVmYvo.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\KCOIXXG.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\GAjyCBN.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\IdHlkOm.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\ssVZZcg.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\YMYflTY.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\DBHHvwO.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\pgscOZm.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\yCLCSQm.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\uFhtcfP.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\HAzsFWo.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\JCzZiVp.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\lbIoWDb.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\LXQtUhc.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\vGebYRt.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\iDgoyDw.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\FldKeus.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\VbvKGCj.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\QfKXZJx.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\bkSNZdD.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\TDHUYMi.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\aGDgGGW.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\LcUdWuT.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\RNXQLIt.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\ELypcVU.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\sFlZNMS.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\yqROJER.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\hZBrnqG.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\aOofoxD.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\AQXgRFl.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\hECFpMM.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\RDeXOXi.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\ekBzwqD.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\SXsnLsl.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\PzGAyuR.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\gePCvGE.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\TnWZaBn.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\UdABqJA.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\MIhWicA.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\eQGUXBf.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\VzQqmVC.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\GeComlU.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\NnUNLSA.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\GrLDloE.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\yophFSZ.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\aOQvKPK.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\lBrlSYQ.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\hwJiHLx.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\jpWkenI.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\IaaIyHk.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\ZvXrRQz.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\gDCqtCX.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\ViPCvmf.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\QNWTLPM.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\RBuSLds.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\rQjxgjk.exe	b10678bbe71a22d3608029e72412b4a0N.exe
File created	C:\Windows\System\umPlYfU.exe	b10678bbe71a22d3608029e72412b4a0N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4944	b10678bbe71a22d3608029e72412b4a0N.exe
Token: SeLockMemoryPrivilege	4944	b10678bbe71a22d3608029e72412b4a0N.exe
Token: SeDebugPrivilege	4076	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4076	4944	b10678bbe71a22d3608029e72412b4a0N.exe	84
PID 4944 wrote to memory of 4076	4944	b10678bbe71a22d3608029e72412b4a0N.exe	84
PID 4944 wrote to memory of 1896	4944	b10678bbe71a22d3608029e72412b4a0N.exe	85
PID 4944 wrote to memory of 1896	4944	b10678bbe71a22d3608029e72412b4a0N.exe	85
PID 4944 wrote to memory of 5000	4944	b10678bbe71a22d3608029e72412b4a0N.exe	86
PID 4944 wrote to memory of 5000	4944	b10678bbe71a22d3608029e72412b4a0N.exe	86
PID 4944 wrote to memory of 4736	4944	b10678bbe71a22d3608029e72412b4a0N.exe	87
PID 4944 wrote to memory of 4736	4944	b10678bbe71a22d3608029e72412b4a0N.exe	87
PID 4944 wrote to memory of 3936	4944	b10678bbe71a22d3608029e72412b4a0N.exe	88
PID 4944 wrote to memory of 3936	4944	b10678bbe71a22d3608029e72412b4a0N.exe	88
PID 4944 wrote to memory of 4500	4944	b10678bbe71a22d3608029e72412b4a0N.exe	89
PID 4944 wrote to memory of 4500	4944	b10678bbe71a22d3608029e72412b4a0N.exe	89
PID 4944 wrote to memory of 4448	4944	b10678bbe71a22d3608029e72412b4a0N.exe	90
PID 4944 wrote to memory of 4448	4944	b10678bbe71a22d3608029e72412b4a0N.exe	90
PID 4944 wrote to memory of 2404	4944	b10678bbe71a22d3608029e72412b4a0N.exe	91
PID 4944 wrote to memory of 2404	4944	b10678bbe71a22d3608029e72412b4a0N.exe	91
PID 4944 wrote to memory of 4016	4944	b10678bbe71a22d3608029e72412b4a0N.exe	92
PID 4944 wrote to memory of 4016	4944	b10678bbe71a22d3608029e72412b4a0N.exe	92
PID 4944 wrote to memory of 3776	4944	b10678bbe71a22d3608029e72412b4a0N.exe	93
PID 4944 wrote to memory of 3776	4944	b10678bbe71a22d3608029e72412b4a0N.exe	93
PID 4944 wrote to memory of 2908	4944	b10678bbe71a22d3608029e72412b4a0N.exe	94
PID 4944 wrote to memory of 2908	4944	b10678bbe71a22d3608029e72412b4a0N.exe	94
PID 4944 wrote to memory of 1604	4944	b10678bbe71a22d3608029e72412b4a0N.exe	95
PID 4944 wrote to memory of 1604	4944	b10678bbe71a22d3608029e72412b4a0N.exe	95
PID 4944 wrote to memory of 4132	4944	b10678bbe71a22d3608029e72412b4a0N.exe	96
PID 4944 wrote to memory of 4132	4944	b10678bbe71a22d3608029e72412b4a0N.exe	96
PID 4944 wrote to memory of 4980	4944	b10678bbe71a22d3608029e72412b4a0N.exe	97
PID 4944 wrote to memory of 4980	4944	b10678bbe71a22d3608029e72412b4a0N.exe	97
PID 4944 wrote to memory of 552	4944	b10678bbe71a22d3608029e72412b4a0N.exe	98
PID 4944 wrote to memory of 552	4944	b10678bbe71a22d3608029e72412b4a0N.exe	98
PID 4944 wrote to memory of 2012	4944	b10678bbe71a22d3608029e72412b4a0N.exe	99
PID 4944 wrote to memory of 2012	4944	b10678bbe71a22d3608029e72412b4a0N.exe	99
PID 4944 wrote to memory of 1008	4944	b10678bbe71a22d3608029e72412b4a0N.exe	100
PID 4944 wrote to memory of 1008	4944	b10678bbe71a22d3608029e72412b4a0N.exe	100
PID 4944 wrote to memory of 4856	4944	b10678bbe71a22d3608029e72412b4a0N.exe	101
PID 4944 wrote to memory of 4856	4944	b10678bbe71a22d3608029e72412b4a0N.exe	101
PID 4944 wrote to memory of 5088	4944	b10678bbe71a22d3608029e72412b4a0N.exe	102
PID 4944 wrote to memory of 5088	4944	b10678bbe71a22d3608029e72412b4a0N.exe	102
PID 4944 wrote to memory of 1948	4944	b10678bbe71a22d3608029e72412b4a0N.exe	103
PID 4944 wrote to memory of 1948	4944	b10678bbe71a22d3608029e72412b4a0N.exe	103
PID 4944 wrote to memory of 1028	4944	b10678bbe71a22d3608029e72412b4a0N.exe	104
PID 4944 wrote to memory of 1028	4944	b10678bbe71a22d3608029e72412b4a0N.exe	104
PID 4944 wrote to memory of 2008	4944	b10678bbe71a22d3608029e72412b4a0N.exe	105
PID 4944 wrote to memory of 2008	4944	b10678bbe71a22d3608029e72412b4a0N.exe	105
PID 4944 wrote to memory of 2832	4944	b10678bbe71a22d3608029e72412b4a0N.exe	106
PID 4944 wrote to memory of 2832	4944	b10678bbe71a22d3608029e72412b4a0N.exe	106
PID 4944 wrote to memory of 392	4944	b10678bbe71a22d3608029e72412b4a0N.exe	107
PID 4944 wrote to memory of 392	4944	b10678bbe71a22d3608029e72412b4a0N.exe	107
PID 4944 wrote to memory of 964	4944	b10678bbe71a22d3608029e72412b4a0N.exe	108
PID 4944 wrote to memory of 964	4944	b10678bbe71a22d3608029e72412b4a0N.exe	108
PID 4944 wrote to memory of 1944	4944	b10678bbe71a22d3608029e72412b4a0N.exe	109
PID 4944 wrote to memory of 1944	4944	b10678bbe71a22d3608029e72412b4a0N.exe	109
PID 4944 wrote to memory of 2616	4944	b10678bbe71a22d3608029e72412b4a0N.exe	110
PID 4944 wrote to memory of 2616	4944	b10678bbe71a22d3608029e72412b4a0N.exe	110
PID 4944 wrote to memory of 3476	4944	b10678bbe71a22d3608029e72412b4a0N.exe	111
PID 4944 wrote to memory of 3476	4944	b10678bbe71a22d3608029e72412b4a0N.exe	111
PID 4944 wrote to memory of 2592	4944	b10678bbe71a22d3608029e72412b4a0N.exe	112
PID 4944 wrote to memory of 2592	4944	b10678bbe71a22d3608029e72412b4a0N.exe	112
PID 4944 wrote to memory of 2468	4944	b10678bbe71a22d3608029e72412b4a0N.exe	113
PID 4944 wrote to memory of 2468	4944	b10678bbe71a22d3608029e72412b4a0N.exe	113
PID 4944 wrote to memory of 5044	4944	b10678bbe71a22d3608029e72412b4a0N.exe	114
PID 4944 wrote to memory of 5044	4944	b10678bbe71a22d3608029e72412b4a0N.exe	114
PID 4944 wrote to memory of 2852	4944	b10678bbe71a22d3608029e72412b4a0N.exe	115
PID 4944 wrote to memory of 2852	4944	b10678bbe71a22d3608029e72412b4a0N.exe	115

C:\Users\Admin\AppData\Local\Temp\b10678bbe71a22d3608029e72412b4a0N.exe
"C:\Users\Admin\AppData\Local\Temp\b10678bbe71a22d3608029e72412b4a0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4076" "2956" "2888" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:14216
- C:\Windows\System\PzHjibO.exe
  C:\Windows\System\PzHjibO.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\QQnARkH.exe
  C:\Windows\System\QQnARkH.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\ZLpMtXd.exe
  C:\Windows\System\ZLpMtXd.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\KCOIXXG.exe
  C:\Windows\System\KCOIXXG.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\XsvaPpM.exe
  C:\Windows\System\XsvaPpM.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\bfKvArz.exe
  C:\Windows\System\bfKvArz.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\DLDUADp.exe
  C:\Windows\System\DLDUADp.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\qTmHEuW.exe
  C:\Windows\System\qTmHEuW.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\OmUKozi.exe
  C:\Windows\System\OmUKozi.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\hBQfkNB.exe
  C:\Windows\System\hBQfkNB.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\olZDYnb.exe
  C:\Windows\System\olZDYnb.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ySHGmdC.exe
  C:\Windows\System\ySHGmdC.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\bNYWuma.exe
  C:\Windows\System\bNYWuma.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\HTprrHY.exe
  C:\Windows\System\HTprrHY.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\sotZeDr.exe
  C:\Windows\System\sotZeDr.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\uFPukGE.exe
  C:\Windows\System\uFPukGE.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\tdpZjit.exe
  C:\Windows\System\tdpZjit.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\MXIwigk.exe
  C:\Windows\System\MXIwigk.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\dvrkFFB.exe
  C:\Windows\System\dvrkFFB.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SvTZrAR.exe
  C:\Windows\System\SvTZrAR.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\xolUZWW.exe
  C:\Windows\System\xolUZWW.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\wotgJXZ.exe
  C:\Windows\System\wotgJXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\FrFJLMY.exe
  C:\Windows\System\FrFJLMY.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\kVspACp.exe
  C:\Windows\System\kVspACp.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\CsHGoYB.exe
  C:\Windows\System\CsHGoYB.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\VDFpRsJ.exe
  C:\Windows\System\VDFpRsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\MLQJUMu.exe
  C:\Windows\System\MLQJUMu.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\JYWvyUv.exe
  C:\Windows\System\JYWvyUv.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\PqoAZlN.exe
  C:\Windows\System\PqoAZlN.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\meGeXQI.exe
  C:\Windows\System\meGeXQI.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\fDZViSf.exe
  C:\Windows\System\fDZViSf.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\MWbxtLW.exe
  C:\Windows\System\MWbxtLW.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\GAjyCBN.exe
  C:\Windows\System\GAjyCBN.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\GLJURLj.exe
  C:\Windows\System\GLJURLj.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\efPfPYc.exe
  C:\Windows\System\efPfPYc.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\FovHTBz.exe
  C:\Windows\System\FovHTBz.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\tmXKdxX.exe
  C:\Windows\System\tmXKdxX.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\DooSwnD.exe
  C:\Windows\System\DooSwnD.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\gdwIFdP.exe
  C:\Windows\System\gdwIFdP.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\lBLVBGi.exe
  C:\Windows\System\lBLVBGi.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\LXxnHTQ.exe
  C:\Windows\System\LXxnHTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\APRUOTH.exe
  C:\Windows\System\APRUOTH.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\HjqRLyh.exe
  C:\Windows\System\HjqRLyh.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\zcfRYJq.exe
  C:\Windows\System\zcfRYJq.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\axOZzkb.exe
  C:\Windows\System\axOZzkb.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\yOHVWXP.exe
  C:\Windows\System\yOHVWXP.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\GggpQQi.exe
  C:\Windows\System\GggpQQi.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\waEDXRj.exe
  C:\Windows\System\waEDXRj.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\zPLzsUp.exe
  C:\Windows\System\zPLzsUp.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\sIHYkJU.exe
  C:\Windows\System\sIHYkJU.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ctDJiIl.exe
  C:\Windows\System\ctDJiIl.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\GrLDloE.exe
  C:\Windows\System\GrLDloE.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\EIxSotN.exe
  C:\Windows\System\EIxSotN.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\AKMVKYX.exe
  C:\Windows\System\AKMVKYX.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\jsUuZFM.exe
  C:\Windows\System\jsUuZFM.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\TZuzLLt.exe
  C:\Windows\System\TZuzLLt.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\qSMCOlm.exe
  C:\Windows\System\qSMCOlm.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\rSJHwXC.exe
  C:\Windows\System\rSJHwXC.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\DmJIzJb.exe
  C:\Windows\System\DmJIzJb.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\ATVBUpH.exe
  C:\Windows\System\ATVBUpH.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\vqXwQde.exe
  C:\Windows\System\vqXwQde.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\goqsfoM.exe
  C:\Windows\System\goqsfoM.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\inWDdom.exe
  C:\Windows\System\inWDdom.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\LpsYJMB.exe
  C:\Windows\System\LpsYJMB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\hAUnNOz.exe
  C:\Windows\System\hAUnNOz.exe
  2⤵
  PID:2872
- C:\Windows\System\cCjFXit.exe
  C:\Windows\System\cCjFXit.exe
  2⤵
  PID:4436
- C:\Windows\System\CaNlbFR.exe
  C:\Windows\System\CaNlbFR.exe
  2⤵
  PID:5112
- C:\Windows\System\wgmgfPY.exe
  C:\Windows\System\wgmgfPY.exe
  2⤵
  PID:3960
- C:\Windows\System\GFRzfIn.exe
  C:\Windows\System\GFRzfIn.exe
  2⤵
  PID:2784
- C:\Windows\System\woqGzbu.exe
  C:\Windows\System\woqGzbu.exe
  2⤵
  PID:3120
- C:\Windows\System\yVwtcgX.exe
  C:\Windows\System\yVwtcgX.exe
  2⤵
  PID:3824
- C:\Windows\System\ZYWTpDm.exe
  C:\Windows\System\ZYWTpDm.exe
  2⤵
  PID:3804
- C:\Windows\System\awoDSit.exe
  C:\Windows\System\awoDSit.exe
  2⤵
  PID:3444
- C:\Windows\System\qICjrYg.exe
  C:\Windows\System\qICjrYg.exe
  2⤵
  PID:2768
- C:\Windows\System\gztIifn.exe
  C:\Windows\System\gztIifn.exe
  2⤵
  PID:4720
- C:\Windows\System\rneMAvN.exe
  C:\Windows\System\rneMAvN.exe
  2⤵
  PID:4724
- C:\Windows\System\UTOPFeR.exe
  C:\Windows\System\UTOPFeR.exe
  2⤵
  PID:3944
- C:\Windows\System\Vwntpfl.exe
  C:\Windows\System\Vwntpfl.exe
  2⤵
  PID:3368
- C:\Windows\System\joKEPql.exe
  C:\Windows\System\joKEPql.exe
  2⤵
  PID:860
- C:\Windows\System\aTmDUoe.exe
  C:\Windows\System\aTmDUoe.exe
  2⤵
  PID:2272
- C:\Windows\System\kaThtoP.exe
  C:\Windows\System\kaThtoP.exe
  2⤵
  PID:4688
- C:\Windows\System\hRAJPfA.exe
  C:\Windows\System\hRAJPfA.exe
  2⤵
  PID:952
- C:\Windows\System\UgsjvVl.exe
  C:\Windows\System\UgsjvVl.exe
  2⤵
  PID:4564
- C:\Windows\System\wTbVkZJ.exe
  C:\Windows\System\wTbVkZJ.exe
  2⤵
  PID:544
- C:\Windows\System\gQBPWQn.exe
  C:\Windows\System\gQBPWQn.exe
  2⤵
  PID:1196
- C:\Windows\System\qAaSoLd.exe
  C:\Windows\System\qAaSoLd.exe
  2⤵
  PID:5136
- C:\Windows\System\qQRJDGD.exe
  C:\Windows\System\qQRJDGD.exe
  2⤵
  PID:5152
- C:\Windows\System\KnzrMgv.exe
  C:\Windows\System\KnzrMgv.exe
  2⤵
  PID:5168
- C:\Windows\System\BihvTMK.exe
  C:\Windows\System\BihvTMK.exe
  2⤵
  PID:5184
- C:\Windows\System\LXQtUhc.exe
  C:\Windows\System\LXQtUhc.exe
  2⤵
  PID:5200
- C:\Windows\System\qZiemSO.exe
  C:\Windows\System\qZiemSO.exe
  2⤵
  PID:5216
- C:\Windows\System\oRDARfL.exe
  C:\Windows\System\oRDARfL.exe
  2⤵
  PID:5232
- C:\Windows\System\YIzHySK.exe
  C:\Windows\System\YIzHySK.exe
  2⤵
  PID:5248
- C:\Windows\System\SHKnOdO.exe
  C:\Windows\System\SHKnOdO.exe
  2⤵
  PID:5264
- C:\Windows\System\USkffGd.exe
  C:\Windows\System\USkffGd.exe
  2⤵
  PID:5280
- C:\Windows\System\vaNYyQe.exe
  C:\Windows\System\vaNYyQe.exe
  2⤵
  PID:5296
- C:\Windows\System\YiNqrhQ.exe
  C:\Windows\System\YiNqrhQ.exe
  2⤵
  PID:5312
- C:\Windows\System\KknGjUA.exe
  C:\Windows\System\KknGjUA.exe
  2⤵
  PID:5328
- C:\Windows\System\lsNcABk.exe
  C:\Windows\System\lsNcABk.exe
  2⤵
  PID:5344
- C:\Windows\System\gDCqtCX.exe
  C:\Windows\System\gDCqtCX.exe
  2⤵
  PID:5360
- C:\Windows\System\sPVilJT.exe
  C:\Windows\System\sPVilJT.exe
  2⤵
  PID:5376
- C:\Windows\System\YLZkVdp.exe
  C:\Windows\System\YLZkVdp.exe
  2⤵
  PID:5392
- C:\Windows\System\etEaAtp.exe
  C:\Windows\System\etEaAtp.exe
  2⤵
  PID:5408
- C:\Windows\System\yophFSZ.exe
  C:\Windows\System\yophFSZ.exe
  2⤵
  PID:5424
- C:\Windows\System\LcUdWuT.exe
  C:\Windows\System\LcUdWuT.exe
  2⤵
  PID:5440
- C:\Windows\System\ViPCvmf.exe
  C:\Windows\System\ViPCvmf.exe
  2⤵
  PID:5456
- C:\Windows\System\PkjwafX.exe
  C:\Windows\System\PkjwafX.exe
  2⤵
  PID:5472
- C:\Windows\System\SPNAjGq.exe
  C:\Windows\System\SPNAjGq.exe
  2⤵
  PID:5488
- C:\Windows\System\tVmClwZ.exe
  C:\Windows\System\tVmClwZ.exe
  2⤵
  PID:5504
- C:\Windows\System\mNwwUSE.exe
  C:\Windows\System\mNwwUSE.exe
  2⤵
  PID:5520
- C:\Windows\System\rJvPzyy.exe
  C:\Windows\System\rJvPzyy.exe
  2⤵
  PID:5536
- C:\Windows\System\knfyIcD.exe
  C:\Windows\System\knfyIcD.exe
  2⤵
  PID:5552
- C:\Windows\System\bBHiMsl.exe
  C:\Windows\System\bBHiMsl.exe
  2⤵
  PID:5568
- C:\Windows\System\nAySUOs.exe
  C:\Windows\System\nAySUOs.exe
  2⤵
  PID:5584
- C:\Windows\System\dnDgcXR.exe
  C:\Windows\System\dnDgcXR.exe
  2⤵
  PID:5664
- C:\Windows\System\ZLZnFzf.exe
  C:\Windows\System\ZLZnFzf.exe
  2⤵
  PID:5744
- C:\Windows\System\XAmQrwz.exe
  C:\Windows\System\XAmQrwz.exe
  2⤵
  PID:5768
- C:\Windows\System\ubTGjCR.exe
  C:\Windows\System\ubTGjCR.exe
  2⤵
  PID:5792
- C:\Windows\System\vwfrVqT.exe
  C:\Windows\System\vwfrVqT.exe
  2⤵
  PID:6016
- C:\Windows\System\ocMeWwb.exe
  C:\Windows\System\ocMeWwb.exe
  2⤵
  PID:6064
- C:\Windows\System\MvyMeNL.exe
  C:\Windows\System\MvyMeNL.exe
  2⤵
  PID:5160
- C:\Windows\System\NuBNYUC.exe
  C:\Windows\System\NuBNYUC.exe
  2⤵
  PID:5260
- C:\Windows\System\twjTGDJ.exe
  C:\Windows\System\twjTGDJ.exe
  2⤵
  PID:5288
- C:\Windows\System\GOSbnoU.exe
  C:\Windows\System\GOSbnoU.exe
  2⤵
  PID:1200
- C:\Windows\System\OiADlNC.exe
  C:\Windows\System\OiADlNC.exe
  2⤵
  PID:5436
- C:\Windows\System\scabyQC.exe
  C:\Windows\System\scabyQC.exe
  2⤵
  PID:524
- C:\Windows\System\UbCEcCb.exe
  C:\Windows\System\UbCEcCb.exe
  2⤵
  PID:5500
- C:\Windows\System\edLNTif.exe
  C:\Windows\System\edLNTif.exe
  2⤵
  PID:5512
- C:\Windows\System\RzQfjIR.exe
  C:\Windows\System\RzQfjIR.exe
  2⤵
  PID:512
- C:\Windows\System\WoQUIyt.exe
  C:\Windows\System\WoQUIyt.exe
  2⤵
  PID:384
- C:\Windows\System\MIhWicA.exe
  C:\Windows\System\MIhWicA.exe
  2⤵
  PID:1656
- C:\Windows\System\lsqKqpr.exe
  C:\Windows\System\lsqKqpr.exe
  2⤵
  PID:1992
- C:\Windows\System\xKAaZFB.exe
  C:\Windows\System\xKAaZFB.exe
  2⤵
  PID:2856
- C:\Windows\System\SzMoCeH.exe
  C:\Windows\System\SzMoCeH.exe
  2⤵
  PID:1596
- C:\Windows\System\TYAonMi.exe
  C:\Windows\System\TYAonMi.exe
  2⤵
  PID:2904
- C:\Windows\System\QRezFmk.exe
  C:\Windows\System\QRezFmk.exe
  2⤵
  PID:4668
- C:\Windows\System\lTqKNZa.exe
  C:\Windows\System\lTqKNZa.exe
  2⤵
  PID:5804
- C:\Windows\System\LHNYRNZ.exe
  C:\Windows\System\LHNYRNZ.exe
  2⤵
  PID:5996
- C:\Windows\System\ZgPpuxb.exe
  C:\Windows\System\ZgPpuxb.exe
  2⤵
  PID:5936
- C:\Windows\System\RNXQLIt.exe
  C:\Windows\System\RNXQLIt.exe
  2⤵
  PID:5904
- C:\Windows\System\SteYTlu.exe
  C:\Windows\System\SteYTlu.exe
  2⤵
  PID:5788
- C:\Windows\System\hWzSzeb.exe
  C:\Windows\System\hWzSzeb.exe
  2⤵
  PID:4156
- C:\Windows\System\hdbVwSM.exe
  C:\Windows\System\hdbVwSM.exe
  2⤵
  PID:6132
- C:\Windows\System\GopVazf.exe
  C:\Windows\System\GopVazf.exe
  2⤵
  PID:5256
- C:\Windows\System\dMNLcCJ.exe
  C:\Windows\System\dMNLcCJ.exe
  2⤵
  PID:5324
- C:\Windows\System\aXZKSzE.exe
  C:\Windows\System\aXZKSzE.exe
  2⤵
  PID:5404
- C:\Windows\System\XMjRQuV.exe
  C:\Windows\System\XMjRQuV.exe
  2⤵
  PID:1372
- C:\Windows\System\oECJSqS.exe
  C:\Windows\System\oECJSqS.exe
  2⤵
  PID:1860
- C:\Windows\System\GscAKUa.exe
  C:\Windows\System\GscAKUa.exe
  2⤵
  PID:2620
- C:\Windows\System\NLvOkCO.exe
  C:\Windows\System\NLvOkCO.exe
  2⤵
  PID:5704
- C:\Windows\System\mPXkbfE.exe
  C:\Windows\System\mPXkbfE.exe
  2⤵
  PID:3820
- C:\Windows\System\lgETeXQ.exe
  C:\Windows\System\lgETeXQ.exe
  2⤵
  PID:5680
- C:\Windows\System\mGuWzwH.exe
  C:\Windows\System\mGuWzwH.exe
  2⤵
  PID:5244
- C:\Windows\System\tbsKhvt.exe
  C:\Windows\System\tbsKhvt.exe
  2⤵
  PID:5760
- C:\Windows\System\nPtPtVG.exe
  C:\Windows\System\nPtPtVG.exe
  2⤵
  PID:5032
- C:\Windows\System\dzkgFwB.exe
  C:\Windows\System\dzkgFwB.exe
  2⤵
  PID:2780
- C:\Windows\System\CSmEGxi.exe
  C:\Windows\System\CSmEGxi.exe
  2⤵
  PID:5608
- C:\Windows\System\QatYNNs.exe
  C:\Windows\System\QatYNNs.exe
  2⤵
  PID:6244
- C:\Windows\System\kDqioJQ.exe
  C:\Windows\System\kDqioJQ.exe
  2⤵
  PID:6328
- C:\Windows\System\KCUImXp.exe
  C:\Windows\System\KCUImXp.exe
  2⤵
  PID:6344
- C:\Windows\System\JSbJLlB.exe
  C:\Windows\System\JSbJLlB.exe
  2⤵
  PID:6360
- C:\Windows\System\lUHkPzw.exe
  C:\Windows\System\lUHkPzw.exe
  2⤵
  PID:6392
- C:\Windows\System\ZUgqfzG.exe
  C:\Windows\System\ZUgqfzG.exe
  2⤵
  PID:6408
- C:\Windows\System\qUrszzt.exe
  C:\Windows\System\qUrszzt.exe
  2⤵
  PID:6432
- C:\Windows\System\IPsvYLX.exe
  C:\Windows\System\IPsvYLX.exe
  2⤵
  PID:6448
- C:\Windows\System\EiFVWyx.exe
  C:\Windows\System\EiFVWyx.exe
  2⤵
  PID:6492
- C:\Windows\System\zTbSYSx.exe
  C:\Windows\System\zTbSYSx.exe
  2⤵
  PID:6516
- C:\Windows\System\uXgJoET.exe
  C:\Windows\System\uXgJoET.exe
  2⤵
  PID:6540
- C:\Windows\System\YSuuYUw.exe
  C:\Windows\System\YSuuYUw.exe
  2⤵
  PID:6560
- C:\Windows\System\iMPtWci.exe
  C:\Windows\System\iMPtWci.exe
  2⤵
  PID:6624
- C:\Windows\System\ERVfvlM.exe
  C:\Windows\System\ERVfvlM.exe
  2⤵
  PID:6644
- C:\Windows\System\MkqZqjb.exe
  C:\Windows\System\MkqZqjb.exe
  2⤵
  PID:6668
- C:\Windows\System\pgscOZm.exe
  C:\Windows\System\pgscOZm.exe
  2⤵
  PID:6692
- C:\Windows\System\BXAGGVy.exe
  C:\Windows\System\BXAGGVy.exe
  2⤵
  PID:6720
- C:\Windows\System\ZHxPSLX.exe
  C:\Windows\System\ZHxPSLX.exe
  2⤵
  PID:6740
- C:\Windows\System\YIAmPgu.exe
  C:\Windows\System\YIAmPgu.exe
  2⤵
  PID:6768
- C:\Windows\System\aUqjJsC.exe
  C:\Windows\System\aUqjJsC.exe
  2⤵
  PID:6820
- C:\Windows\System\SMuLPVH.exe
  C:\Windows\System\SMuLPVH.exe
  2⤵
  PID:6840
- C:\Windows\System\TmQHvbk.exe
  C:\Windows\System\TmQHvbk.exe
  2⤵
  PID:6860
- C:\Windows\System\qlSaImz.exe
  C:\Windows\System\qlSaImz.exe
  2⤵
  PID:6884
- C:\Windows\System\hPxXPxY.exe
  C:\Windows\System\hPxXPxY.exe
  2⤵
  PID:6916
- C:\Windows\System\LfFtZft.exe
  C:\Windows\System\LfFtZft.exe
  2⤵
  PID:6944
- C:\Windows\System\KKFfWcA.exe
  C:\Windows\System\KKFfWcA.exe
  2⤵
  PID:7000
- C:\Windows\System\ZyftrOU.exe
  C:\Windows\System\ZyftrOU.exe
  2⤵
  PID:7024
- C:\Windows\System\AiuAOZd.exe
  C:\Windows\System\AiuAOZd.exe
  2⤵
  PID:7048
- C:\Windows\System\PWaMDHF.exe
  C:\Windows\System\PWaMDHF.exe
  2⤵
  PID:7064
- C:\Windows\System\GybPHLB.exe
  C:\Windows\System\GybPHLB.exe
  2⤵
  PID:7092
- C:\Windows\System\eQGUXBf.exe
  C:\Windows\System\eQGUXBf.exe
  2⤵
  PID:7120
- C:\Windows\System\GuCEway.exe
  C:\Windows\System\GuCEway.exe
  2⤵
  PID:7148
- C:\Windows\System\lVptiYt.exe
  C:\Windows\System\lVptiYt.exe
  2⤵
  PID:5836
- C:\Windows\System\QNWTLPM.exe
  C:\Windows\System\QNWTLPM.exe
  2⤵
  PID:5852
- C:\Windows\System\VFLEAuL.exe
  C:\Windows\System\VFLEAuL.exe
  2⤵
  PID:6164
- C:\Windows\System\XwbAqat.exe
  C:\Windows\System\XwbAqat.exe
  2⤵
  PID:6204
- C:\Windows\System\LGKTPPl.exe
  C:\Windows\System\LGKTPPl.exe
  2⤵
  PID:6300
- C:\Windows\System\xTGkUty.exe
  C:\Windows\System\xTGkUty.exe
  2⤵
  PID:6336
- C:\Windows\System\UaMICIL.exe
  C:\Windows\System\UaMICIL.exe
  2⤵
  PID:6384
- C:\Windows\System\YmoJJje.exe
  C:\Windows\System\YmoJJje.exe
  2⤵
  PID:6464
- C:\Windows\System\ykqspJZ.exe
  C:\Windows\System\ykqspJZ.exe
  2⤵
  PID:6508
- C:\Windows\System\KIvxGpO.exe
  C:\Windows\System\KIvxGpO.exe
  2⤵
  PID:6552
- C:\Windows\System\aOQvKPK.exe
  C:\Windows\System\aOQvKPK.exe
  2⤵
  PID:6652
- C:\Windows\System\ZssUELb.exe
  C:\Windows\System\ZssUELb.exe
  2⤵
  PID:6700
- C:\Windows\System\ICtBlvq.exe
  C:\Windows\System\ICtBlvq.exe
  2⤵
  PID:6784
- C:\Windows\System\tgCftQu.exe
  C:\Windows\System\tgCftQu.exe
  2⤵
  PID:6852
- C:\Windows\System\GMwziMP.exe
  C:\Windows\System\GMwziMP.exe
  2⤵
  PID:6904
- C:\Windows\System\TnWZaBn.exe
  C:\Windows\System\TnWZaBn.exe
  2⤵
  PID:7128
- C:\Windows\System\DOWJJZV.exe
  C:\Windows\System\DOWJJZV.exe
  2⤵
  PID:3352
- C:\Windows\System\hECFpMM.exe
  C:\Windows\System\hECFpMM.exe
  2⤵
  PID:4316
- C:\Windows\System\epyjCkz.exe
  C:\Windows\System\epyjCkz.exe
  2⤵
  PID:6196
- C:\Windows\System\FstDDUZ.exe
  C:\Windows\System\FstDDUZ.exe
  2⤵
  PID:6340
- C:\Windows\System\bZIlfoC.exe
  C:\Windows\System\bZIlfoC.exe
  2⤵
  PID:6440
- C:\Windows\System\LQiVCmf.exe
  C:\Windows\System\LQiVCmf.exe
  2⤵
  PID:6556
- C:\Windows\System\yrpDIqt.exe
  C:\Windows\System\yrpDIqt.exe
  2⤵
  PID:6656
- C:\Windows\System\EDrhzSd.exe
  C:\Windows\System\EDrhzSd.exe
  2⤵
  PID:6932
- C:\Windows\System\vnOITlA.exe
  C:\Windows\System\vnOITlA.exe
  2⤵
  PID:7020
- C:\Windows\System\kUpxcoF.exe
  C:\Windows\System\kUpxcoF.exe
  2⤵
  PID:7040
- C:\Windows\System\wgSiqgl.exe
  C:\Windows\System\wgSiqgl.exe
  2⤵
  PID:1016
- C:\Windows\System\RDeXOXi.exe
  C:\Windows\System\RDeXOXi.exe
  2⤵
  PID:6288
- C:\Windows\System\LeGTQKS.exe
  C:\Windows\System\LeGTQKS.exe
  2⤵
  PID:6584
- C:\Windows\System\RttmHCA.exe
  C:\Windows\System\RttmHCA.exe
  2⤵
  PID:6980
- C:\Windows\System\Ifznpio.exe
  C:\Windows\System\Ifznpio.exe
  2⤵
  PID:6428
- C:\Windows\System\HfPUgNe.exe
  C:\Windows\System\HfPUgNe.exe
  2⤵
  PID:6896
- C:\Windows\System\ZGYaYll.exe
  C:\Windows\System\ZGYaYll.exe
  2⤵
  PID:6536
- C:\Windows\System\lBrlSYQ.exe
  C:\Windows\System\lBrlSYQ.exe
  2⤵
  PID:7192
- C:\Windows\System\KuQBfvb.exe
  C:\Windows\System\KuQBfvb.exe
  2⤵
  PID:7216
- C:\Windows\System\kXzGkJf.exe
  C:\Windows\System\kXzGkJf.exe
  2⤵
  PID:7244
- C:\Windows\System\MbYbovL.exe
  C:\Windows\System\MbYbovL.exe
  2⤵
  PID:7272
- C:\Windows\System\AUglgqY.exe
  C:\Windows\System\AUglgqY.exe
  2⤵
  PID:7300
- C:\Windows\System\umPlYfU.exe
  C:\Windows\System\umPlYfU.exe
  2⤵
  PID:7328
- C:\Windows\System\LXNItOt.exe
  C:\Windows\System\LXNItOt.exe
  2⤵
  PID:7360
- C:\Windows\System\BkUocPB.exe
  C:\Windows\System\BkUocPB.exe
  2⤵
  PID:7376
- C:\Windows\System\JPKxnKq.exe
  C:\Windows\System\JPKxnKq.exe
  2⤵
  PID:7400
- C:\Windows\System\nZsqtfh.exe
  C:\Windows\System\nZsqtfh.exe
  2⤵
  PID:7416
- C:\Windows\System\oePNHbC.exe
  C:\Windows\System\oePNHbC.exe
  2⤵
  PID:7472
- C:\Windows\System\LLotmHN.exe
  C:\Windows\System\LLotmHN.exe
  2⤵
  PID:7500
- C:\Windows\System\RpJgvpc.exe
  C:\Windows\System\RpJgvpc.exe
  2⤵
  PID:7532
- C:\Windows\System\suGVVIl.exe
  C:\Windows\System\suGVVIl.exe
  2⤵
  PID:7560
- C:\Windows\System\FMDSEkO.exe
  C:\Windows\System\FMDSEkO.exe
  2⤵
  PID:7580
- C:\Windows\System\alXWNwd.exe
  C:\Windows\System\alXWNwd.exe
  2⤵
  PID:7600
- C:\Windows\System\SbKuqrq.exe
  C:\Windows\System\SbKuqrq.exe
  2⤵
  PID:7648
- C:\Windows\System\dNBXAOs.exe
  C:\Windows\System\dNBXAOs.exe
  2⤵
  PID:7676
- C:\Windows\System\SZonqwl.exe
  C:\Windows\System\SZonqwl.exe
  2⤵
  PID:7704
- C:\Windows\System\FrLyXxV.exe
  C:\Windows\System\FrLyXxV.exe
  2⤵
  PID:7724
- C:\Windows\System\owqXVxD.exe
  C:\Windows\System\owqXVxD.exe
  2⤵
  PID:7748
- C:\Windows\System\lxmrwok.exe
  C:\Windows\System\lxmrwok.exe
  2⤵
  PID:7788
- C:\Windows\System\UGRqWMp.exe
  C:\Windows\System\UGRqWMp.exe
  2⤵
  PID:7804
- C:\Windows\System\WHufiwB.exe
  C:\Windows\System\WHufiwB.exe
  2⤵
  PID:7856
- C:\Windows\System\zebaOEG.exe
  C:\Windows\System\zebaOEG.exe
  2⤵
  PID:7896
- C:\Windows\System\StEtXmQ.exe
  C:\Windows\System\StEtXmQ.exe
  2⤵
  PID:7916
- C:\Windows\System\eCWPdso.exe
  C:\Windows\System\eCWPdso.exe
  2⤵
  PID:7932
- C:\Windows\System\FhUYrMj.exe
  C:\Windows\System\FhUYrMj.exe
  2⤵
  PID:7952
- C:\Windows\System\EPYDWNJ.exe
  C:\Windows\System\EPYDWNJ.exe
  2⤵
  PID:7972
- C:\Windows\System\YiyEbbO.exe
  C:\Windows\System\YiyEbbO.exe
  2⤵
  PID:7988
- C:\Windows\System\ultFVht.exe
  C:\Windows\System\ultFVht.exe
  2⤵
  PID:8004
- C:\Windows\System\ksmVVwu.exe
  C:\Windows\System\ksmVVwu.exe
  2⤵
  PID:8028
- C:\Windows\System\SApgTPb.exe
  C:\Windows\System\SApgTPb.exe
  2⤵
  PID:8076
- C:\Windows\System\UJMzbnf.exe
  C:\Windows\System\UJMzbnf.exe
  2⤵
  PID:8092
- C:\Windows\System\TmZZdbN.exe
  C:\Windows\System\TmZZdbN.exe
  2⤵
  PID:8112
- C:\Windows\System\snFyQGT.exe
  C:\Windows\System\snFyQGT.exe
  2⤵
  PID:8180
- C:\Windows\System\GVljEnj.exe
  C:\Windows\System\GVljEnj.exe
  2⤵
  PID:7264
- C:\Windows\System\cpqrqeY.exe
  C:\Windows\System\cpqrqeY.exe
  2⤵
  PID:7292
- C:\Windows\System\UqVsHwK.exe
  C:\Windows\System\UqVsHwK.exe
  2⤵
  PID:7344
- C:\Windows\System\oijyFoQ.exe
  C:\Windows\System\oijyFoQ.exe
  2⤵
  PID:7396
- C:\Windows\System\oedKyUQ.exe
  C:\Windows\System\oedKyUQ.exe
  2⤵
  PID:7456
- C:\Windows\System\CuOhmVP.exe
  C:\Windows\System\CuOhmVP.exe
  2⤵
  PID:7664
- C:\Windows\System\EDAYCtp.exe
  C:\Windows\System\EDAYCtp.exe
  2⤵
  PID:7696
- C:\Windows\System\NkCvXzq.exe
  C:\Windows\System\NkCvXzq.exe
  2⤵
  PID:7740
- C:\Windows\System\igWOxZH.exe
  C:\Windows\System\igWOxZH.exe
  2⤵
  PID:7852
- C:\Windows\System\JpMQtZC.exe
  C:\Windows\System\JpMQtZC.exe
  2⤵
  PID:7796
- C:\Windows\System\BETAwmD.exe
  C:\Windows\System\BETAwmD.exe
  2⤵
  PID:8024
- C:\Windows\System\zwZasjN.exe
  C:\Windows\System\zwZasjN.exe
  2⤵
  PID:7928
- C:\Windows\System\PFRbfPl.exe
  C:\Windows\System\PFRbfPl.exe
  2⤵
  PID:7872
- C:\Windows\System\nRZeJnr.exe
  C:\Windows\System\nRZeJnr.exe
  2⤵
  PID:7944
- C:\Windows\System\OptyKNO.exe
  C:\Windows\System\OptyKNO.exe
  2⤵
  PID:8148
- C:\Windows\System\dunTGof.exe
  C:\Windows\System\dunTGof.exe
  2⤵
  PID:8064
- C:\Windows\System\CYXlvip.exe
  C:\Windows\System\CYXlvip.exe
  2⤵
  PID:8088
- C:\Windows\System\jofjVuY.exe
  C:\Windows\System\jofjVuY.exe
  2⤵
  PID:7412
- C:\Windows\System\PGHmDir.exe
  C:\Windows\System\PGHmDir.exe
  2⤵
  PID:7424
- C:\Windows\System\vIJWbAg.exe
  C:\Windows\System\vIJWbAg.exe
  2⤵
  PID:7592
- C:\Windows\System\ELypcVU.exe
  C:\Windows\System\ELypcVU.exe
  2⤵
  PID:7848
- C:\Windows\System\bYxXtPk.exe
  C:\Windows\System\bYxXtPk.exe
  2⤵
  PID:7832
- C:\Windows\System\uyODmWp.exe
  C:\Windows\System\uyODmWp.exe
  2⤵
  PID:7824
- C:\Windows\System\VlcVabJ.exe
  C:\Windows\System\VlcVabJ.exe
  2⤵
  PID:8104
- C:\Windows\System\vKGgnIy.exe
  C:\Windows\System\vKGgnIy.exe
  2⤵
  PID:8172
- C:\Windows\System\FtCstLw.exe
  C:\Windows\System\FtCstLw.exe
  2⤵
  PID:7596
- C:\Windows\System\NIYOIrM.exe
  C:\Windows\System\NIYOIrM.exe
  2⤵
  PID:7644
- C:\Windows\System\DgBYkEC.exe
  C:\Windows\System\DgBYkEC.exe
  2⤵
  PID:7820
- C:\Windows\System\UxsKrKS.exe
  C:\Windows\System\UxsKrKS.exe
  2⤵
  PID:7392
- C:\Windows\System\RBuSLds.exe
  C:\Windows\System\RBuSLds.exe
  2⤵
  PID:1032
- C:\Windows\System\yCLCSQm.exe
  C:\Windows\System\yCLCSQm.exe
  2⤵
  PID:7876
- C:\Windows\System\vGebYRt.exe
  C:\Windows\System\vGebYRt.exe
  2⤵
  PID:8212
- C:\Windows\System\YMdcPoA.exe
  C:\Windows\System\YMdcPoA.exe
  2⤵
  PID:8236
- C:\Windows\System\riyAiLc.exe
  C:\Windows\System\riyAiLc.exe
  2⤵
  PID:8260
- C:\Windows\System\jDqtVbj.exe
  C:\Windows\System\jDqtVbj.exe
  2⤵
  PID:8276
- C:\Windows\System\srTuJcP.exe
  C:\Windows\System\srTuJcP.exe
  2⤵
  PID:8296
- C:\Windows\System\OLYPXRQ.exe
  C:\Windows\System\OLYPXRQ.exe
  2⤵
  PID:8336
- C:\Windows\System\ZzCjvAZ.exe
  C:\Windows\System\ZzCjvAZ.exe
  2⤵
  PID:8364
- C:\Windows\System\FbvTKwh.exe
  C:\Windows\System\FbvTKwh.exe
  2⤵
  PID:8384
- C:\Windows\System\sFlZNMS.exe
  C:\Windows\System\sFlZNMS.exe
  2⤵
  PID:8408
- C:\Windows\System\uFhtcfP.exe
  C:\Windows\System\uFhtcfP.exe
  2⤵
  PID:8456
- C:\Windows\System\RWmAUkt.exe
  C:\Windows\System\RWmAUkt.exe
  2⤵
  PID:8504
- C:\Windows\System\ROXEpct.exe
  C:\Windows\System\ROXEpct.exe
  2⤵
  PID:8532
- C:\Windows\System\xupNfuG.exe
  C:\Windows\System\xupNfuG.exe
  2⤵
  PID:8572
- C:\Windows\System\FIPghIa.exe
  C:\Windows\System\FIPghIa.exe
  2⤵
  PID:8596
- C:\Windows\System\tRUJQBV.exe
  C:\Windows\System\tRUJQBV.exe
  2⤵
  PID:8628
- C:\Windows\System\RfdVLHw.exe
  C:\Windows\System\RfdVLHw.exe
  2⤵
  PID:8668
- C:\Windows\System\FuRFFDC.exe
  C:\Windows\System\FuRFFDC.exe
  2⤵
  PID:8704
- C:\Windows\System\GGGTMRc.exe
  C:\Windows\System\GGGTMRc.exe
  2⤵
  PID:8728
- C:\Windows\System\efOfAiu.exe
  C:\Windows\System\efOfAiu.exe
  2⤵
  PID:8748
- C:\Windows\System\KBCWWEM.exe
  C:\Windows\System\KBCWWEM.exe
  2⤵
  PID:8764
- C:\Windows\System\TiLAshb.exe
  C:\Windows\System\TiLAshb.exe
  2⤵
  PID:8784
- C:\Windows\System\ODvDzZl.exe
  C:\Windows\System\ODvDzZl.exe
  2⤵
  PID:8856
- C:\Windows\System\nnmyoTL.exe
  C:\Windows\System\nnmyoTL.exe
  2⤵
  PID:8880
- C:\Windows\System\SINRRjd.exe
  C:\Windows\System\SINRRjd.exe
  2⤵
  PID:8900
- C:\Windows\System\HAzsFWo.exe
  C:\Windows\System\HAzsFWo.exe
  2⤵
  PID:8920
- C:\Windows\System\OYhcPAk.exe
  C:\Windows\System\OYhcPAk.exe
  2⤵
  PID:8960
- C:\Windows\System\gTELzUr.exe
  C:\Windows\System\gTELzUr.exe
  2⤵
  PID:8976
- C:\Windows\System\ekBzwqD.exe
  C:\Windows\System\ekBzwqD.exe
  2⤵
  PID:9000
- C:\Windows\System\qBHnsfw.exe
  C:\Windows\System\qBHnsfw.exe
  2⤵
  PID:9044
- C:\Windows\System\PVHhWPP.exe
  C:\Windows\System\PVHhWPP.exe
  2⤵
  PID:9068
- C:\Windows\System\EkuWkmS.exe
  C:\Windows\System\EkuWkmS.exe
  2⤵
  PID:9084
- C:\Windows\System\lRaohQf.exe
  C:\Windows\System\lRaohQf.exe
  2⤵
  PID:9108
- C:\Windows\System\OQiWPzl.exe
  C:\Windows\System\OQiWPzl.exe
  2⤵
  PID:9136
- C:\Windows\System\QGwTXIj.exe
  C:\Windows\System\QGwTXIj.exe
  2⤵
  PID:9180
- C:\Windows\System\DGPGWrP.exe
  C:\Windows\System\DGPGWrP.exe
  2⤵
  PID:9212
- C:\Windows\System\UpXoHFN.exe
  C:\Windows\System\UpXoHFN.exe
  2⤵
  PID:8204
- C:\Windows\System\JKvsJbQ.exe
  C:\Windows\System\JKvsJbQ.exe
  2⤵
  PID:8232
- C:\Windows\System\niitKoC.exe
  C:\Windows\System\niitKoC.exe
  2⤵
  PID:8284
- C:\Windows\System\xeOqYNL.exe
  C:\Windows\System\xeOqYNL.exe
  2⤵
  PID:8316
- C:\Windows\System\pbQQRrB.exe
  C:\Windows\System\pbQQRrB.exe
  2⤵
  PID:8448
- C:\Windows\System\eBRKzFd.exe
  C:\Windows\System\eBRKzFd.exe
  2⤵
  PID:8464
- C:\Windows\System\rQjxgjk.exe
  C:\Windows\System\rQjxgjk.exe
  2⤵
  PID:8480
- C:\Windows\System\GgUNkMi.exe
  C:\Windows\System\GgUNkMi.exe
  2⤵
  PID:8568
- C:\Windows\System\HwSXIVC.exe
  C:\Windows\System\HwSXIVC.exe
  2⤵
  PID:8592
- C:\Windows\System\xfzzaWa.exe
  C:\Windows\System\xfzzaWa.exe
  2⤵
  PID:8676
- C:\Windows\System\PTTIkpg.exe
  C:\Windows\System\PTTIkpg.exe
  2⤵
  PID:8756
- C:\Windows\System\HpgaBHF.exe
  C:\Windows\System\HpgaBHF.exe
  2⤵
  PID:8776
- C:\Windows\System\mFccSKQ.exe
  C:\Windows\System\mFccSKQ.exe
  2⤵
  PID:8916
- C:\Windows\System\enQfYhI.exe
  C:\Windows\System\enQfYhI.exe
  2⤵
  PID:9104
- C:\Windows\System\aoRhVBW.exe
  C:\Windows\System\aoRhVBW.exe
  2⤵
  PID:9124
- C:\Windows\System\ZOHqDaJ.exe
  C:\Windows\System\ZOHqDaJ.exe
  2⤵
  PID:9176
- C:\Windows\System\CoEdZDI.exe
  C:\Windows\System\CoEdZDI.exe
  2⤵
  PID:7744
- C:\Windows\System\xAfCSac.exe
  C:\Windows\System\xAfCSac.exe
  2⤵
  PID:8220
- C:\Windows\System\KnKsFdX.exe
  C:\Windows\System\KnKsFdX.exe
  2⤵
  PID:8424
- C:\Windows\System\mchoJfT.exe
  C:\Windows\System\mchoJfT.exe
  2⤵
  PID:8500
- C:\Windows\System\VzQqmVC.exe
  C:\Windows\System\VzQqmVC.exe
  2⤵
  PID:8812
- C:\Windows\System\LwAglOI.exe
  C:\Windows\System\LwAglOI.exe
  2⤵
  PID:8972
- C:\Windows\System\BnBEqUi.exe
  C:\Windows\System\BnBEqUi.exe
  2⤵
  PID:9080
- C:\Windows\System\dkosCYx.exe
  C:\Windows\System\dkosCYx.exe
  2⤵
  PID:1560
- C:\Windows\System\TsTMzLO.exe
  C:\Windows\System\TsTMzLO.exe
  2⤵
  PID:8848
- C:\Windows\System\kAyAvrw.exe
  C:\Windows\System\kAyAvrw.exe
  2⤵
  PID:7384
- C:\Windows\System\ejXtgQg.exe
  C:\Windows\System\ejXtgQg.exe
  2⤵
  PID:9064
- C:\Windows\System\FoIwBRF.exe
  C:\Windows\System\FoIwBRF.exe
  2⤵
  PID:9244
- C:\Windows\System\FHVMfjb.exe
  C:\Windows\System\FHVMfjb.exe
  2⤵
  PID:9264
- C:\Windows\System\nNNoesf.exe
  C:\Windows\System\nNNoesf.exe
  2⤵
  PID:9316
- C:\Windows\System\fovIgHI.exe
  C:\Windows\System\fovIgHI.exe
  2⤵
  PID:9340
- C:\Windows\System\DwliQDJ.exe
  C:\Windows\System\DwliQDJ.exe
  2⤵
  PID:9360
- C:\Windows\System\HmNoiWo.exe
  C:\Windows\System\HmNoiWo.exe
  2⤵
  PID:9388
- C:\Windows\System\SXsnLsl.exe
  C:\Windows\System\SXsnLsl.exe
  2⤵
  PID:9412
- C:\Windows\System\kOIfvUH.exe
  C:\Windows\System\kOIfvUH.exe
  2⤵
  PID:9444
- C:\Windows\System\GtIKYjx.exe
  C:\Windows\System\GtIKYjx.exe
  2⤵
  PID:9472
- C:\Windows\System\pSnLJWJ.exe
  C:\Windows\System\pSnLJWJ.exe
  2⤵
  PID:9492
- C:\Windows\System\xucuiub.exe
  C:\Windows\System\xucuiub.exe
  2⤵
  PID:9532
- C:\Windows\System\DRvOEGi.exe
  C:\Windows\System\DRvOEGi.exe
  2⤵
  PID:9572
- C:\Windows\System\hwJiHLx.exe
  C:\Windows\System\hwJiHLx.exe
  2⤵
  PID:9592
- C:\Windows\System\RBAPkGM.exe
  C:\Windows\System\RBAPkGM.exe
  2⤵
  PID:9616
- C:\Windows\System\OkCfVwH.exe
  C:\Windows\System\OkCfVwH.exe
  2⤵
  PID:9644
- C:\Windows\System\PfOUkfX.exe
  C:\Windows\System\PfOUkfX.exe
  2⤵
  PID:9668
- C:\Windows\System\tdsXRSp.exe
  C:\Windows\System\tdsXRSp.exe
  2⤵
  PID:9684
- C:\Windows\System\WzeaxpQ.exe
  C:\Windows\System\WzeaxpQ.exe
  2⤵
  PID:9720
- C:\Windows\System\lxAIqjy.exe
  C:\Windows\System\lxAIqjy.exe
  2⤵
  PID:9736
- C:\Windows\System\PzGAyuR.exe
  C:\Windows\System\PzGAyuR.exe
  2⤵
  PID:9764
- C:\Windows\System\eukpEDt.exe
  C:\Windows\System\eukpEDt.exe
  2⤵
  PID:9780
- C:\Windows\System\pbcyVmD.exe
  C:\Windows\System\pbcyVmD.exe
  2⤵
  PID:9796
- C:\Windows\System\WWWzeRG.exe
  C:\Windows\System\WWWzeRG.exe
  2⤵
  PID:9820
- C:\Windows\System\HGbXwNt.exe
  C:\Windows\System\HGbXwNt.exe
  2⤵
  PID:9872
- C:\Windows\System\FQQETmx.exe
  C:\Windows\System\FQQETmx.exe
  2⤵
  PID:9920
- C:\Windows\System\wLvxRBm.exe
  C:\Windows\System\wLvxRBm.exe
  2⤵
  PID:9948
- C:\Windows\System\JCzZiVp.exe
  C:\Windows\System\JCzZiVp.exe
  2⤵
  PID:9972
- C:\Windows\System\kRAmCEf.exe
  C:\Windows\System\kRAmCEf.exe
  2⤵
  PID:10008
- C:\Windows\System\zNWkYIY.exe
  C:\Windows\System\zNWkYIY.exe
  2⤵
  PID:10028
- C:\Windows\System\SqrFpFN.exe
  C:\Windows\System\SqrFpFN.exe
  2⤵
  PID:10072
- C:\Windows\System\FUjhMCv.exe
  C:\Windows\System\FUjhMCv.exe
  2⤵
  PID:10092
- C:\Windows\System\iDgoyDw.exe
  C:\Windows\System\iDgoyDw.exe
  2⤵
  PID:10128
- C:\Windows\System\rbdWjmA.exe
  C:\Windows\System\rbdWjmA.exe
  2⤵
  PID:10148
- C:\Windows\System\tPCGgIW.exe
  C:\Windows\System\tPCGgIW.exe
  2⤵
  PID:10164
- C:\Windows\System\HRTbIBG.exe
  C:\Windows\System\HRTbIBG.exe
  2⤵
  PID:10204
- C:\Windows\System\SsNDnVb.exe
  C:\Windows\System\SsNDnVb.exe
  2⤵
  PID:8612
- C:\Windows\System\MEPPONS.exe
  C:\Windows\System\MEPPONS.exe
  2⤵
  PID:8228
- C:\Windows\System\bkSNZdD.exe
  C:\Windows\System\bkSNZdD.exe
  2⤵
  PID:9276
- C:\Windows\System\QXefxFS.exe
  C:\Windows\System\QXefxFS.exe
  2⤵
  PID:3104
- C:\Windows\System\VzCOCDN.exe
  C:\Windows\System\VzCOCDN.exe
  2⤵
  PID:9384
- C:\Windows\System\IdHlkOm.exe
  C:\Windows\System\IdHlkOm.exe
  2⤵
  PID:8356
- C:\Windows\System\jlnJAAt.exe
  C:\Windows\System\jlnJAAt.exe
  2⤵
  PID:9568
- C:\Windows\System\kXwpFQL.exe
  C:\Windows\System\kXwpFQL.exe
  2⤵
  PID:9612
- C:\Windows\System\ssVZZcg.exe
  C:\Windows\System\ssVZZcg.exe
  2⤵
  PID:9656
- C:\Windows\System\RlWfUgL.exe
  C:\Windows\System\RlWfUgL.exe
  2⤵
  PID:9680
- C:\Windows\System\FldKeus.exe
  C:\Windows\System\FldKeus.exe
  2⤵
  PID:9828
- C:\Windows\System\ZYgOxvw.exe
  C:\Windows\System\ZYgOxvw.exe
  2⤵
  PID:9860
- C:\Windows\System\lbIoWDb.exe
  C:\Windows\System\lbIoWDb.exe
  2⤵
  PID:9884
- C:\Windows\System\IdgSQRX.exe
  C:\Windows\System\IdgSQRX.exe
  2⤵
  PID:9940
- C:\Windows\System\IiKIpOb.exe
  C:\Windows\System\IiKIpOb.exe
  2⤵
  PID:10000
- C:\Windows\System\cUavQbI.exe
  C:\Windows\System\cUavQbI.exe
  2⤵
  PID:10084
- C:\Windows\System\WbkuGVv.exe
  C:\Windows\System\WbkuGVv.exe
  2⤵
  PID:10116
- C:\Windows\System\OyHsNZH.exe
  C:\Windows\System\OyHsNZH.exe
  2⤵
  PID:10144
- C:\Windows\System\oyfDQys.exe
  C:\Windows\System\oyfDQys.exe
  2⤵
  PID:9228
- C:\Windows\System\xQscSkO.exe
  C:\Windows\System\xQscSkO.exe
  2⤵
  PID:9336
- C:\Windows\System\KZlpWtA.exe
  C:\Windows\System\KZlpWtA.exe
  2⤵
  PID:9580
- C:\Windows\System\GHfVEBJ.exe
  C:\Windows\System\GHfVEBJ.exe
  2⤵
  PID:9840
- C:\Windows\System\jpWkenI.exe
  C:\Windows\System\jpWkenI.exe
  2⤵
  PID:10112
- C:\Windows\System\dOAzHHO.exe
  C:\Windows\System\dOAzHHO.exe
  2⤵
  PID:8540
- C:\Windows\System\rTEkqZC.exe
  C:\Windows\System\rTEkqZC.exe
  2⤵
  PID:10172
- C:\Windows\System\ulNGGok.exe
  C:\Windows\System\ulNGGok.exe
  2⤵
  PID:9352
- C:\Windows\System\ZlbTfcr.exe
  C:\Windows\System\ZlbTfcr.exe
  2⤵
  PID:9776
- C:\Windows\System\LVpKDqL.exe
  C:\Windows\System\LVpKDqL.exe
  2⤵
  PID:10200
- C:\Windows\System\GeComlU.exe
  C:\Windows\System\GeComlU.exe
  2⤵
  PID:9436
- C:\Windows\System\EvISZOA.exe
  C:\Windows\System\EvISZOA.exe
  2⤵
  PID:9608
- C:\Windows\System\edHtUBQ.exe
  C:\Windows\System\edHtUBQ.exe
  2⤵
  PID:10268
- C:\Windows\System\rwxJiZz.exe
  C:\Windows\System\rwxJiZz.exe
  2⤵
  PID:10284
- C:\Windows\System\TnfUDjz.exe
  C:\Windows\System\TnfUDjz.exe
  2⤵
  PID:10308
- C:\Windows\System\VbvKGCj.exe
  C:\Windows\System\VbvKGCj.exe
  2⤵
  PID:10340
- C:\Windows\System\mlpLFWA.exe
  C:\Windows\System\mlpLFWA.exe
  2⤵
  PID:10392
- C:\Windows\System\yqROJER.exe
  C:\Windows\System\yqROJER.exe
  2⤵
  PID:10424
- C:\Windows\System\RuAWOPP.exe
  C:\Windows\System\RuAWOPP.exe
  2⤵
  PID:10440
- C:\Windows\System\PGYMLzD.exe
  C:\Windows\System\PGYMLzD.exe
  2⤵
  PID:10464
- C:\Windows\System\jPRWsvW.exe
  C:\Windows\System\jPRWsvW.exe
  2⤵
  PID:10516
- C:\Windows\System\DzkvGai.exe
  C:\Windows\System\DzkvGai.exe
  2⤵
  PID:10536
- C:\Windows\System\YIeZaHf.exe
  C:\Windows\System\YIeZaHf.exe
  2⤵
  PID:10560
- C:\Windows\System\DrzCWbX.exe
  C:\Windows\System\DrzCWbX.exe
  2⤵
  PID:10580
- C:\Windows\System\ZHiTFah.exe
  C:\Windows\System\ZHiTFah.exe
  2⤵
  PID:10612
- C:\Windows\System\tgLrQmS.exe
  C:\Windows\System\tgLrQmS.exe
  2⤵
  PID:10644
- C:\Windows\System\qMlnUbd.exe
  C:\Windows\System\qMlnUbd.exe
  2⤵
  PID:10672
- C:\Windows\System\uBxFhlQ.exe
  C:\Windows\System\uBxFhlQ.exe
  2⤵
  PID:10688
- C:\Windows\System\BlliCoi.exe
  C:\Windows\System\BlliCoi.exe
  2⤵
  PID:10708
- C:\Windows\System\ondVdFJ.exe
  C:\Windows\System\ondVdFJ.exe
  2⤵
  PID:10724
- C:\Windows\System\VIsJeFg.exe
  C:\Windows\System\VIsJeFg.exe
  2⤵
  PID:10744
- C:\Windows\System\EyRvYYa.exe
  C:\Windows\System\EyRvYYa.exe
  2⤵
  PID:10768
- C:\Windows\System\EprkyON.exe
  C:\Windows\System\EprkyON.exe
  2⤵
  PID:10820
- C:\Windows\System\DXxFUJW.exe
  C:\Windows\System\DXxFUJW.exe
  2⤵
  PID:10860
- C:\Windows\System\LnldsVT.exe
  C:\Windows\System\LnldsVT.exe
  2⤵
  PID:10880
- C:\Windows\System\eBoKhTP.exe
  C:\Windows\System\eBoKhTP.exe
  2⤵
  PID:10904
- C:\Windows\System\dVRPdzk.exe
  C:\Windows\System\dVRPdzk.exe
  2⤵
  PID:10928
- C:\Windows\System\YMYflTY.exe
  C:\Windows\System\YMYflTY.exe
  2⤵
  PID:10948
- C:\Windows\System\aFoRgvc.exe
  C:\Windows\System\aFoRgvc.exe
  2⤵
  PID:10984
- C:\Windows\System\LUuLowP.exe
  C:\Windows\System\LUuLowP.exe
  2⤵
  PID:11036
- C:\Windows\System\CMJoBld.exe
  C:\Windows\System\CMJoBld.exe
  2⤵
  PID:11052
- C:\Windows\System\bgLBoAf.exe
  C:\Windows\System\bgLBoAf.exe
  2⤵
  PID:11072
- C:\Windows\System\jXlJRTP.exe
  C:\Windows\System\jXlJRTP.exe
  2⤵
  PID:11112
- C:\Windows\System\TRdToBB.exe
  C:\Windows\System\TRdToBB.exe
  2⤵
  PID:11132
- C:\Windows\System\AyNuvZh.exe
  C:\Windows\System\AyNuvZh.exe
  2⤵
  PID:11164
- C:\Windows\System\JpSJvZu.exe
  C:\Windows\System\JpSJvZu.exe
  2⤵
  PID:11184
- C:\Windows\System\UwrIRJh.exe
  C:\Windows\System\UwrIRJh.exe
  2⤵
  PID:11216
- C:\Windows\System\fEPzSCD.exe
  C:\Windows\System\fEPzSCD.exe
  2⤵
  PID:11240
- C:\Windows\System\TjiOqKt.exe
  C:\Windows\System\TjiOqKt.exe
  2⤵
  PID:11260
- C:\Windows\System\ZmNyErA.exe
  C:\Windows\System\ZmNyErA.exe
  2⤵
  PID:10248
- C:\Windows\System\BCuyRZK.exe
  C:\Windows\System\BCuyRZK.exe
  2⤵
  PID:10388
- C:\Windows\System\QkBouNM.exe
  C:\Windows\System\QkBouNM.exe
  2⤵
  PID:10448
- C:\Windows\System\owtuEVv.exe
  C:\Windows\System\owtuEVv.exe
  2⤵
  PID:10452
- C:\Windows\System\FsJpRwI.exe
  C:\Windows\System\FsJpRwI.exe
  2⤵
  PID:10548
- C:\Windows\System\pfwVQxb.exe
  C:\Windows\System\pfwVQxb.exe
  2⤵
  PID:10596
- C:\Windows\System\Obvdnfp.exe
  C:\Windows\System\Obvdnfp.exe
  2⤵
  PID:10640
- C:\Windows\System\XUSKWpd.exe
  C:\Windows\System\XUSKWpd.exe
  2⤵
  PID:10680
- C:\Windows\System\nPQHfxY.exe
  C:\Windows\System\nPQHfxY.exe
  2⤵
  PID:10912
- C:\Windows\System\JtYqocz.exe
  C:\Windows\System\JtYqocz.exe
  2⤵
  PID:10920
- C:\Windows\System\AgKHsxk.exe
  C:\Windows\System\AgKHsxk.exe
  2⤵
  PID:11008
- C:\Windows\System\sUzTgGL.exe
  C:\Windows\System\sUzTgGL.exe
  2⤵
  PID:11080
- C:\Windows\System\KsFjxHP.exe
  C:\Windows\System\KsFjxHP.exe
  2⤵
  PID:11148
- C:\Windows\System\WqZURbO.exe
  C:\Windows\System\WqZURbO.exe
  2⤵
  PID:11248
- C:\Windows\System\gPqZwUS.exe
  C:\Windows\System\gPqZwUS.exe
  2⤵
  PID:8256
- C:\Windows\System\jozPLeY.exe
  C:\Windows\System\jozPLeY.exe
  2⤵
  PID:11212
- C:\Windows\System\ETMhKuk.exe
  C:\Windows\System\ETMhKuk.exe
  2⤵
  PID:10412
- C:\Windows\System\JUTVrwa.exe
  C:\Windows\System\JUTVrwa.exe
  2⤵
  PID:10700
- C:\Windows\System\lWFwQhC.exe
  C:\Windows\System\lWFwQhC.exe
  2⤵
  PID:10792
- C:\Windows\System\SRbsbpX.exe
  C:\Windows\System\SRbsbpX.exe
  2⤵
  PID:11016
- C:\Windows\System\sQKLDJv.exe
  C:\Windows\System\sQKLDJv.exe
  2⤵
  PID:11124
- C:\Windows\System\FjRVEZx.exe
  C:\Windows\System\FjRVEZx.exe
  2⤵
  PID:10300
- C:\Windows\System\GPFDaof.exe
  C:\Windows\System\GPFDaof.exe
  2⤵
  PID:10544
- C:\Windows\System\QIUiyHT.exe
  C:\Windows\System\QIUiyHT.exe
  2⤵
  PID:10976
- C:\Windows\System\HsswKIU.exe
  C:\Windows\System\HsswKIU.exe
  2⤵
  PID:10504
- C:\Windows\System\YLgRIvp.exe
  C:\Windows\System\YLgRIvp.exe
  2⤵
  PID:10080
- C:\Windows\System\gRJpnZf.exe
  C:\Windows\System\gRJpnZf.exe
  2⤵
  PID:11272
- C:\Windows\System\OxIderC.exe
  C:\Windows\System\OxIderC.exe
  2⤵
  PID:11300
- C:\Windows\System\veabNcb.exe
  C:\Windows\System\veabNcb.exe
  2⤵
  PID:11324
- C:\Windows\System\HJbNNdp.exe
  C:\Windows\System\HJbNNdp.exe
  2⤵
  PID:11364
- C:\Windows\System\iIvZlJm.exe
  C:\Windows\System\iIvZlJm.exe
  2⤵
  PID:11384
- C:\Windows\System\qDOavwr.exe
  C:\Windows\System\qDOavwr.exe
  2⤵
  PID:11412
- C:\Windows\System\MpVIjMu.exe
  C:\Windows\System\MpVIjMu.exe
  2⤵
  PID:11440
- C:\Windows\System\EcnjWZE.exe
  C:\Windows\System\EcnjWZE.exe
  2⤵
  PID:11460
- C:\Windows\System\pXoINNl.exe
  C:\Windows\System\pXoINNl.exe
  2⤵
  PID:11484
- C:\Windows\System\vNjwPwl.exe
  C:\Windows\System\vNjwPwl.exe
  2⤵
  PID:11540
- C:\Windows\System\QMZNDzx.exe
  C:\Windows\System\QMZNDzx.exe
  2⤵
  PID:11560
- C:\Windows\System\ZjBTqSw.exe
  C:\Windows\System\ZjBTqSw.exe
  2⤵
  PID:11592
- C:\Windows\System\EcMgSeJ.exe
  C:\Windows\System\EcMgSeJ.exe
  2⤵
  PID:11608
- C:\Windows\System\thNEQTi.exe
  C:\Windows\System\thNEQTi.exe
  2⤵
  PID:11636
- C:\Windows\System\HNSqfXK.exe
  C:\Windows\System\HNSqfXK.exe
  2⤵
  PID:11660
- C:\Windows\System\rmWRIKU.exe
  C:\Windows\System\rmWRIKU.exe
  2⤵
  PID:11680
- C:\Windows\System\LoHgCJv.exe
  C:\Windows\System\LoHgCJv.exe
  2⤵
  PID:11724
- C:\Windows\System\iMMowGN.exe
  C:\Windows\System\iMMowGN.exe
  2⤵
  PID:11756
- C:\Windows\System\gViCyoM.exe
  C:\Windows\System\gViCyoM.exe
  2⤵
  PID:11772
- C:\Windows\System\zBHjMCv.exe
  C:\Windows\System\zBHjMCv.exe
  2⤵
  PID:11792
- C:\Windows\System\vBiqclw.exe
  C:\Windows\System\vBiqclw.exe
  2⤵
  PID:11820
- C:\Windows\System\XOTtBjd.exe
  C:\Windows\System\XOTtBjd.exe
  2⤵
  PID:11840
- C:\Windows\System\Pvepmos.exe
  C:\Windows\System\Pvepmos.exe
  2⤵
  PID:11864
- C:\Windows\System\gFrWGId.exe
  C:\Windows\System\gFrWGId.exe
  2⤵
  PID:11900
- C:\Windows\System\QadIxdf.exe
  C:\Windows\System\QadIxdf.exe
  2⤵
  PID:11932
- C:\Windows\System\LDJlatk.exe
  C:\Windows\System\LDJlatk.exe
  2⤵
  PID:11956
- C:\Windows\System\iinpyiz.exe
  C:\Windows\System\iinpyiz.exe
  2⤵
  PID:12004
- C:\Windows\System\YpyATvR.exe
  C:\Windows\System\YpyATvR.exe
  2⤵
  PID:12040
- C:\Windows\System\ayGSdsT.exe
  C:\Windows\System\ayGSdsT.exe
  2⤵
  PID:12068
- C:\Windows\System\SeNQCSx.exe
  C:\Windows\System\SeNQCSx.exe
  2⤵
  PID:12084
- C:\Windows\System\vuBPnWU.exe
  C:\Windows\System\vuBPnWU.exe
  2⤵
  PID:12100
- C:\Windows\System\ptYOtqK.exe
  C:\Windows\System\ptYOtqK.exe
  2⤵
  PID:12116
- C:\Windows\System\nfyUPwh.exe
  C:\Windows\System\nfyUPwh.exe
  2⤵
  PID:12172
- C:\Windows\System\IzIFrQa.exe
  C:\Windows\System\IzIFrQa.exe
  2⤵
  PID:12192
- C:\Windows\System\zNCzMSC.exe
  C:\Windows\System\zNCzMSC.exe
  2⤵
  PID:12220
- C:\Windows\System\KVCpGiD.exe
  C:\Windows\System\KVCpGiD.exe
  2⤵
  PID:12236
- C:\Windows\System\RqdFCOx.exe
  C:\Windows\System\RqdFCOx.exe
  2⤵
  PID:12260
- C:\Windows\System\zRcEEcy.exe
  C:\Windows\System\zRcEEcy.exe
  2⤵
  PID:11268
- C:\Windows\System\vDmvRwv.exe
  C:\Windows\System\vDmvRwv.exe
  2⤵
  PID:11344
- C:\Windows\System\XfwFagM.exe
  C:\Windows\System\XfwFagM.exe
  2⤵
  PID:11376
- C:\Windows\System\zHhASeu.exe
  C:\Windows\System\zHhASeu.exe
  2⤵
  PID:11432
- C:\Windows\System\seaJPmK.exe
  C:\Windows\System\seaJPmK.exe
  2⤵
  PID:11508
- C:\Windows\System\XYepDnh.exe
  C:\Windows\System\XYepDnh.exe
  2⤵
  PID:11572
- C:\Windows\System\vtZXRFq.exe
  C:\Windows\System\vtZXRFq.exe
  2⤵
  PID:11676
- C:\Windows\System\BaENfKY.exe
  C:\Windows\System\BaENfKY.exe
  2⤵
  PID:11720
- C:\Windows\System\GIEfoll.exe
  C:\Windows\System\GIEfoll.exe
  2⤵
  PID:11856
- C:\Windows\System\oTrsSOg.exe
  C:\Windows\System\oTrsSOg.exe
  2⤵
  PID:11984
- C:\Windows\System\csTnNNd.exe
  C:\Windows\System\csTnNNd.exe
  2⤵
  PID:11992
- C:\Windows\System\NnUNLSA.exe
  C:\Windows\System\NnUNLSA.exe
  2⤵
  PID:12096
- C:\Windows\System\SQoJAWI.exe
  C:\Windows\System\SQoJAWI.exe
  2⤵
  PID:12200
- C:\Windows\System\Esdkthx.exe
  C:\Windows\System\Esdkthx.exe
  2⤵
  PID:12148
- C:\Windows\System\qQybSys.exe
  C:\Windows\System\qQybSys.exe
  2⤵
  PID:12228
- C:\Windows\System\FicAmqa.exe
  C:\Windows\System\FicAmqa.exe
  2⤵
  PID:12276
- C:\Windows\System\DBHHvwO.exe
  C:\Windows\System\DBHHvwO.exe
  2⤵
  PID:11404
- C:\Windows\System\ADPdeLU.exe
  C:\Windows\System\ADPdeLU.exe
  2⤵
  PID:11548
- C:\Windows\System\BJhfYEV.exe
  C:\Windows\System\BJhfYEV.exe
  2⤵
  PID:11716
- C:\Windows\System\hZBrnqG.exe
  C:\Windows\System\hZBrnqG.exe
  2⤵
  PID:11812
- C:\Windows\System\EnrDbST.exe
  C:\Windows\System\EnrDbST.exe
  2⤵
  PID:12036
- C:\Windows\System\DqlIVFr.exe
  C:\Windows\System\DqlIVFr.exe
  2⤵
  PID:12208
- C:\Windows\System\XmnahFT.exe
  C:\Windows\System\XmnahFT.exe
  2⤵
  PID:11308
- C:\Windows\System\QjErLYU.exe
  C:\Windows\System\QjErLYU.exe
  2⤵
  PID:11492
- C:\Windows\System\qAiqODW.exe
  C:\Windows\System\qAiqODW.exe
  2⤵
  PID:11924
- C:\Windows\System\GJWfKem.exe
  C:\Windows\System\GJWfKem.exe
  2⤵
  PID:12292
- C:\Windows\System\MpJcqYH.exe
  C:\Windows\System\MpJcqYH.exe
  2⤵
  PID:12328
- C:\Windows\System\knCZjqZ.exe
  C:\Windows\System\knCZjqZ.exe
  2⤵
  PID:12348
- C:\Windows\System\ovcbnhq.exe
  C:\Windows\System\ovcbnhq.exe
  2⤵
  PID:12392
- C:\Windows\System\iDBNhcW.exe
  C:\Windows\System\iDBNhcW.exe
  2⤵
  PID:12428
- C:\Windows\System\vctHMdy.exe
  C:\Windows\System\vctHMdy.exe
  2⤵
  PID:12468
- C:\Windows\System\YnPjfPX.exe
  C:\Windows\System\YnPjfPX.exe
  2⤵
  PID:12488
- C:\Windows\System\TxIrTHx.exe
  C:\Windows\System\TxIrTHx.exe
  2⤵
  PID:12520
- C:\Windows\System\MTQIBjI.exe
  C:\Windows\System\MTQIBjI.exe
  2⤵
  PID:12536
- C:\Windows\System\lkBEnQG.exe
  C:\Windows\System\lkBEnQG.exe
  2⤵
  PID:12596
- C:\Windows\System\KgmQowa.exe
  C:\Windows\System\KgmQowa.exe
  2⤵
  PID:12616
- C:\Windows\System\BVHwrsQ.exe
  C:\Windows\System\BVHwrsQ.exe
  2⤵
  PID:12652
- C:\Windows\System\CVIwWXL.exe
  C:\Windows\System\CVIwWXL.exe
  2⤵
  PID:12680
- C:\Windows\System\SOiHYCU.exe
  C:\Windows\System\SOiHYCU.exe
  2⤵
  PID:12700
- C:\Windows\System\ayICKoJ.exe
  C:\Windows\System\ayICKoJ.exe
  2⤵
  PID:12740
- C:\Windows\System\tyWNROW.exe
  C:\Windows\System\tyWNROW.exe
  2⤵
  PID:12756
- C:\Windows\System\agNgKgX.exe
  C:\Windows\System\agNgKgX.exe
  2⤵
  PID:12780
- C:\Windows\System\vCnJAhw.exe
  C:\Windows\System\vCnJAhw.exe
  2⤵
  PID:12820
- C:\Windows\System\IaaIyHk.exe
  C:\Windows\System\IaaIyHk.exe
  2⤵
  PID:12844
- C:\Windows\System\NxKhRft.exe
  C:\Windows\System\NxKhRft.exe
  2⤵
  PID:12864
- C:\Windows\System\kjFzhcS.exe
  C:\Windows\System\kjFzhcS.exe
  2⤵
  PID:12892
- C:\Windows\System\BBeuckR.exe
  C:\Windows\System\BBeuckR.exe
  2⤵
  PID:12940
- C:\Windows\System\JNqFZha.exe
  C:\Windows\System\JNqFZha.exe
  2⤵
  PID:12956
- C:\Windows\System\qvUULqt.exe
  C:\Windows\System\qvUULqt.exe
  2⤵
  PID:12980
- C:\Windows\System\YoTZQHe.exe
  C:\Windows\System\YoTZQHe.exe
  2⤵
  PID:13000
- C:\Windows\System\olAyDDZ.exe
  C:\Windows\System\olAyDDZ.exe
  2⤵
  PID:13040
- C:\Windows\System\ZjXnThT.exe
  C:\Windows\System\ZjXnThT.exe
  2⤵
  PID:13056
- C:\Windows\System\AYEFauN.exe
  C:\Windows\System\AYEFauN.exe
  2⤵
  PID:13092
- C:\Windows\System\hPakNWl.exe
  C:\Windows\System\hPakNWl.exe
  2⤵
  PID:13120
- C:\Windows\System\jIozdQM.exe
  C:\Windows\System\jIozdQM.exe
  2⤵
  PID:13156
- C:\Windows\System\jElbBog.exe
  C:\Windows\System\jElbBog.exe
  2⤵
  PID:13184
- C:\Windows\System\zDxomCb.exe
  C:\Windows\System\zDxomCb.exe
  2⤵
  PID:13208
- C:\Windows\System\htmYvwG.exe
  C:\Windows\System\htmYvwG.exe
  2⤵
  PID:13224
- C:\Windows\System\LgHsNAO.exe
  C:\Windows\System\LgHsNAO.exe
  2⤵
  PID:13240
- C:\Windows\System\vphzEiB.exe
  C:\Windows\System\vphzEiB.exe
  2⤵
  PID:13268
- C:\Windows\System\bZlvfQh.exe
  C:\Windows\System\bZlvfQh.exe
  2⤵
  PID:13288
- C:\Windows\System\BlPVgdw.exe
  C:\Windows\System\BlPVgdw.exe
  2⤵
  PID:11532
- C:\Windows\System\khiDQIA.exe
  C:\Windows\System\khiDQIA.exe
  2⤵
  PID:12136
- C:\Windows\System\gePCvGE.exe
  C:\Windows\System\gePCvGE.exe
  2⤵
  PID:12344
- C:\Windows\System\QfKXZJx.exe
  C:\Windows\System\QfKXZJx.exe
  2⤵
  PID:12480
- C:\Windows\System\NFbbNdQ.exe
  C:\Windows\System\NFbbNdQ.exe
  2⤵
  PID:12500
- C:\Windows\System\DpyfmFT.exe
  C:\Windows\System\DpyfmFT.exe
  2⤵
  PID:12644
- C:\Windows\System\rppoFwu.exe
  C:\Windows\System\rppoFwu.exe
  2⤵
  PID:12812
- C:\Windows\System\lUCvSmO.exe
  C:\Windows\System\lUCvSmO.exe
  2⤵
  PID:12856
- C:\Windows\System\tZVmYvo.exe
  C:\Windows\System\tZVmYvo.exe
  2⤵
  PID:12880
- C:\Windows\System\sgGwUCz.exe
  C:\Windows\System\sgGwUCz.exe
  2⤵
  PID:12924
- C:\Windows\System\uUrfWQA.exe
  C:\Windows\System\uUrfWQA.exe
  2⤵
  PID:12988
- C:\Windows\System\YfvVUnM.exe
  C:\Windows\System\YfvVUnM.exe
  2⤵
  PID:12972
- C:\Windows\System\uANiFyO.exe
  C:\Windows\System\uANiFyO.exe
  2⤵
  PID:13024
- C:\Windows\System\sgVmLCM.exe
  C:\Windows\System\sgVmLCM.exe
  2⤵
  PID:13100
- C:\Windows\System\aOofoxD.exe
  C:\Windows\System\aOofoxD.exe
  2⤵
  PID:13220
- C:\Windows\System\qajtsda.exe
  C:\Windows\System\qajtsda.exe
  2⤵
  PID:12380
- C:\Windows\System\mPWKPFm.exe
  C:\Windows\System\mPWKPFm.exe
  2⤵
  PID:12552
- C:\Windows\System\yysSFHK.exe
  C:\Windows\System\yysSFHK.exe
  2⤵
  PID:12660
- C:\Windows\System\sHedRxY.exe
  C:\Windows\System\sHedRxY.exe
  2⤵
  PID:12696
- C:\Windows\System\eexMBIU.exe
  C:\Windows\System\eexMBIU.exe
  2⤵
  PID:12716
- C:\Windows\System\rJysqkB.exe
  C:\Windows\System\rJysqkB.exe
  2⤵
  PID:12952
- C:\Windows\System\oApANmh.exe
  C:\Windows\System\oApANmh.exe
  2⤵
  PID:13108
- C:\Windows\System\xLhecEK.exe
  C:\Windows\System\xLhecEK.exe
  2⤵
  PID:13164
- C:\Windows\System\MuWMbzF.exe
  C:\Windows\System\MuWMbzF.exe
  2⤵
  PID:13236
- C:\Windows\System\RHxZFST.exe
  C:\Windows\System\RHxZFST.exe
  2⤵
  PID:12772
- C:\Windows\System\GClYkEE.exe
  C:\Windows\System\GClYkEE.exe
  2⤵
  PID:13180
- C:\Windows\System\IZrlsLB.exe
  C:\Windows\System\IZrlsLB.exe
  2⤵
  PID:11832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5wqmzx4s.ylb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AvUCOfg.exe

Filesize
8B

MD5
e1c0dcd3ccc7caba500dc7b5ec5c30ab

SHA1
9be0ea654569cf464b3e03471ea8e30f3dbe6d7c

SHA256
fd739ab62b39ab9475aca0f420f49c92b2489a700118e0ba4342e00823e753df

SHA512
49fed546b80fe0b4fdf75cd9b5f3a04de144667708ce473227c77aac085e673cf2fe9740bb7e8eebcd1ed2cd224a0b69dc4e3f6614ac9cf7079194e1c08239e5

Download Submit
C:\Windows\System\CsHGoYB.exe

Filesize
1.9MB

MD5
b2f9c3141460436e813a24b539bf9278

SHA1
5223e059a7cbefb2984e7847c268fd084cfac274

SHA256
11ba324a69d13f9a9e294a5a6796abcafa91265451a6311399d01f0575092c32

SHA512
a9af0727a53fb5270b0c7d5cc90f7653e8f3c286ca3c5e9f357aab4bc6dcab9f0bcc29f32df1c2923b51be992e1092e2f84bfd2dffd9a0fe74d314dd445621a7

Download Submit
C:\Windows\System\DLDUADp.exe

Filesize
1.9MB

MD5
012b4265996596634c4df23866964b64

SHA1
523abc9f7b177c7051666a577100f150ab0a25f5

SHA256
12626713547395f60254a72ac2eff5a8b788bbadbb64405ccabb36a1858d17b5

SHA512
2deaea3e979941c34adf4df509540d5cb2f1b924a1789e36d0f9542c35c3a858a63ca0d44f16447c3aef3596abd403c4dc59443090ec0c265c9e9480a9c1c065

Download Submit
C:\Windows\System\FrFJLMY.exe

Filesize
1.9MB

MD5
ec8d6eae57b58a464c833970bfefb00d

SHA1
d54f997ecbb127421396c3023add3419563b7e68

SHA256
4e834759ad04487dd305385f30cd28d002ecd640042e6d286431846029851b5d

SHA512
8024ad1c34917c03762389b2c3539756c803665b9da0b08f83ba653db2351fd8013f0788c26cc6096180bd334b01f73f5b83307359ad706e4469d1d248634376

Download Submit
C:\Windows\System\GAjyCBN.exe

Filesize
1.9MB

MD5
09ec0bcd01606b8337acad738cc2826d

SHA1
b6bfb814fab7620e312739acbbab7dd7fdc07a8e

SHA256
e66b71b83c710e3e0c3756fc485a8617f93c9a2db8aab118ec7494e279544072

SHA512
deb5a203250a2050c310e847b7a36a6387e4f1ffb5f9cb04fd289f32ca81e2ab5e52462c199969d83408683a09a06bc23e89d7b4812a20fffe125d8ac73dc12e

Download Submit
C:\Windows\System\HTprrHY.exe

Filesize
1.9MB

MD5
a782175f3c7f36f8b01758d9a25d739f

SHA1
60fdab5b6668d089f5b07003752ee85fbc5371a3

SHA256
f25e546037d641c553ede0e25c42f2c073d27f557757484e7da3e4ff044f5921

SHA512
b7d4c362761af3777d1d3c65bd675dba3bfaec6b1c110db1613f6c9f2689faaf3b0135537c219d724a7eef49d3559defb8929ea9f1bfa7b051d2fff1c42ac364

Download Submit
C:\Windows\System\JYWvyUv.exe

Filesize
1.9MB

MD5
90e873999bb5edfb802aa983e11583cb

SHA1
cbc275ffabe39f314297b41d5978b232593753e5

SHA256
47d6d77d8a62c8f532105454d42e9bce3107c6ffa458453ede3be6e2c70e4bd9

SHA512
fb8e86b27c58ddc682c34f25e8c9d5b4011b517cac7a951130684441d66d969b55df5a783e6f088fbaa350c38f7282297afd476341c73adbccb312de6c397015

Download Submit
C:\Windows\System\KCOIXXG.exe

Filesize
1.9MB

MD5
579655ca2673a4e6aa9b866d31c41c68

SHA1
2b40f2e19677739a033005205c610e89751de82e

SHA256
4d5a8012055393479c5352f48f01a12fcbc195997608340ab69e3071f54ff672

SHA512
253e4a847f937039e8eabc741fa8e996c2f58269459b208ed29ae446385624ef7a7113ff9d0c6e7e465c7d058d151adbd164a224864fbc7b402d22c9a1335100

Download Submit
C:\Windows\System\MLQJUMu.exe

Filesize
1.9MB

MD5
1f2a10e6ae564ede89594fa4b616fb19

SHA1
3d0cf1dd5dec56f312b20ee509b880369a486b74

SHA256
0ffc9e794266b4a3af8ff706c7ef0011cb709176f48e61ff76f385cb73f22117

SHA512
095ad7b6af7815367d086f9b53de355688dcb523360304f62f3e56b5e9ffb8f778143aea450524efc6083e6e3e306aa9d8d683d15b36ad82c7e053d307992277

Download Submit
C:\Windows\System\MWbxtLW.exe

Filesize
1.9MB

MD5
e82a85c5f7952d9bf06609a723705acb

SHA1
5e28b71eccaf1a30df81ad41fc93529384c378ec

SHA256
4029ec563fecbc83836a6a6804a99f04503163b1404949fb140186d47ea2b4d3

SHA512
f366972124f448edbd0e38e735646d76db7bc4111141d26c852b7e07d0a916b5b3f0b75ea4bbabbe24db3e2409ca416c84df3ef7bedad94a4200d029f06b84f4

Download Submit
C:\Windows\System\MXIwigk.exe

Filesize
1.9MB

MD5
417c908f81f1454feaeb2645bf95e9b7

SHA1
6dd6bcbf79b7b1aaffbd1285c6ba5421840b60f0

SHA256
cb8cb8e76393e1446dc8c862e8bb9c3c58158b790393aaec1c0e1aeab1115cd8

SHA512
6c6de575494942bd159d708d7f2f41469d1e80f0e871dd441b1a1ddbe620b23ccb630986dc24848868c85f7c0d25fe8d0d863dab22c8a5ba6d169bd729dbd979

Download Submit
C:\Windows\System\OmUKozi.exe

Filesize
1.9MB

MD5
d149d2e566f06df4be96ff32de5ceb9e

SHA1
d8907e7c6569638c67f69afe585ea1a65e46856f

SHA256
91db7857b96c17d748c75fcb9488282f174fbe5b77fa9c9e02f5e5875775a1a3

SHA512
c20bcef371cf0d08cf992aa8fc0731e281af3e47d16504ec8ff9e1572eeb7337e0b97a7be31f0f175d31665687c911ea655c264aa1bbb2ff01561e33e0493a9b

Download Submit
C:\Windows\System\PqoAZlN.exe

Filesize
1.9MB

MD5
cd7214c67cafb50a5dfa825fd394f35d

SHA1
ff4aaf757747d08f3297681bb35d988ca6236aca

SHA256
7800baa8c8cf8872184943ec70260df20135802df173a84ecdc89b10696495d6

SHA512
3a9f9b4b887eb985448cf25dbc514edb7229963232f77a80141a660d143b9a951c7cf55762bbfe1f05880ff27ec602143d998adfd113753d4898ab4b7221b924

Download Submit
C:\Windows\System\PzHjibO.exe

Filesize
1.9MB

MD5
26da97dd59e8e7c3f06a84c34288dd7e

SHA1
f3ef3f992e17e6ea913a3def60da0f40122247a0

SHA256
c90413e02b8f421ebc1d68bfc6a646aafa5b72cf2412846caa6be24857f39d56

SHA512
9fe407f0f7164f12ce85b46cf27586ef72c469053620d60460276583734cfcc0df69ccd930d7bf5d6ad6d9fcca6effc7d748139f1c8079f58eae69e94a18b9c2

Download Submit
C:\Windows\System\QQnARkH.exe

Filesize
1.9MB

MD5
b60d2c65370460ea068bdfea21cc764e

SHA1
ca3c243be0975b9f54cf3f51c0cf3a31ab348594

SHA256
06c4e478beba4954e4328cd2d8f82260308a329fe0ea6ec144a0f6729b0275b3

SHA512
8bb44ddf7ca083491089a0100674f35e0abf4131fca3fc0db164da74c37cf445ba1023b37d9654fc0fdce5edbbcff75aecbf01eecaacfaadebccce5394bfe1bb

Download Submit
C:\Windows\System\SvTZrAR.exe

Filesize
1.9MB

MD5
3808cf95f08cdc5af2b0975ef83c3a65

SHA1
0eec83cfbf3a89e49c4f203c8ac60cfa7f473d1e

SHA256
6e4c6e54c3305c759d0db7f1d14749a29083e6e5198e33b66a1e9668f12faf60

SHA512
3591ececefec715d2708547a604455abc8353929b4ba10528a9ffd56c73a33b31939a2e026a1f65acb42b618846d6373cc33f8415718af42e96e76251b9fad22

Download Submit
C:\Windows\System\VDFpRsJ.exe

Filesize
1.9MB

MD5
de0594e8ee25ce7a3045f054a8d6fc5f

SHA1
0fc4e03caeab06d0c238a71c8f7a59419a05a2f5

SHA256
fab8e14ed9a2d615a4d53362af0f9805a1b4abb5e805804c20398e05f2ad567d

SHA512
d5058c24b66d556116be755144ed2d739b79946859848cd44bf76db50df090c20e05c2dbc29df4d0105f54ca0051ecdb8c4f7c8e6f7a71fbbf1f2ba213eb8e3c

Download Submit
C:\Windows\System\XsvaPpM.exe

Filesize
1.9MB

MD5
2da4799ae5aa24b83547f1534b13fe74

SHA1
de137f116614ee3a4a0c0f51e40cea2efb194300

SHA256
96721f59f9baaa655238dda5d613401471f735344fc4425183a3ed0c545ebcc3

SHA512
629b3e8c0f41278d776f76ce894b05ff911027065466dbbf4b4198cfa6852b75c54833059893a80423bf6c6b7a985c2c1507cad2234b61b8ebc22611596638cb

Download Submit
C:\Windows\System\ZLpMtXd.exe

Filesize
1.9MB

MD5
e5d425a32701318751f0cb3e005e1468

SHA1
b8be2281cfc9f6e6e35879cda7c7876f7ae8f8cc

SHA256
964959da8c37cf10f6b06440a67d0bf475cf72406f87b40a511be4038f872806

SHA512
e0c8152c63d31b2155435f3ec5831bc16835416feb0c56c9050c6f601b5c64972886584dd87b4bf382f32b99eef32c66cf4a984fc399b5748bfe1ddc1ee6f6ed

Download Submit
C:\Windows\System\bNYWuma.exe

Filesize
1.9MB

MD5
e2c8d890a8b9a2fc9d502aaf5e369c80

SHA1
515c753199740553ef8b3c683344348ed5605568

SHA256
b8d54579194abbf7d930774d483851eda729200e3ea7436cda2212bbb5323d07

SHA512
a66dc79814cfe097d7aab1f78778bb355ebd60551482236c12270e9e8953ea60eda5056edb17f730c5e9468c56daf65368de14d7e048cb3cc97776258d616a77

Download Submit
C:\Windows\System\bfKvArz.exe

Filesize
1.9MB

MD5
326f3574e18e3d722c5e8ce089ed8482

SHA1
1f5f7ee402caee5961ada72ae03b7adbc22a00b4

SHA256
44bdb4eed457722318245d68d879148880cb009ef143e08831aa5b9dae1ac39b

SHA512
f68c57fa1c703d390fe87c22a5bdc3ca946dbc8993a0daa08fc5ce02a9fee1767350811f8237b7fdf8cdbbff61fe0467ec2b2752ad07ac62116246ac56bbc4bb

Download Submit
C:\Windows\System\dvrkFFB.exe

Filesize
1.9MB

MD5
2aa35f5c47e265e66d8e350f751017a1

SHA1
e5f415bfdbd3f4960f98f5319893931e1675ff52

SHA256
8b0002ccfe7ca1cbec2388497f25d7a7827b89853a646af5d19e44ab01e64160

SHA512
5289ce8d9eab6d5ebf5d38bc6830cf8854db2608e1d6b6224b0769b7d45b566500f9802bf73a970b9f95350736d969e1b151e7a6d061e70e30b0f6fa300cb77b

Download Submit
C:\Windows\System\fDZViSf.exe

Filesize
1.9MB

MD5
3654739408e02b587a18b8b7bd67a897

SHA1
d9ab425e05fc26558bceaa751707f5b737b93c29

SHA256
c774ff6211bc296ce66afc1035ff7b73c5a470c21f0c81954add395e62552d9a

SHA512
1821cdf266e4bcd1b5c1101f52865dba682e55f6b785b8e54b9ab24a9e71d35ad18795b5d26036dd2d49fcdf864c00deea934f6c92e4281b801a2a86fdbe5bac

Download Submit
C:\Windows\System\hBQfkNB.exe

Filesize
1.9MB

MD5
790a8057acd8a9d79781e6881d52d5a7

SHA1
5802792dbef734f6d6fdb845ef25808c0642f045

SHA256
857b31e6f821d63d0a198b2ea5e7354a17213b0253b460de9bbbc5db2d4acc5e

SHA512
f184122b55bd6c19adab55f494168c2831f4e01bfa5780fd0dcf9bf7fc54774bbf74d5ccef47efa36001e1fc19c972a603f0331e9003b25b15346c88e3528047

Download Submit
C:\Windows\System\kVspACp.exe

Filesize
1.9MB

MD5
1bee1599b5d354c3d48ac30b4f83f243

SHA1
a864de35362e629a09cd41d7f31a4571308ea7b3

SHA256
50eaebe65023308b36c663ef689c9997a19a412f0f686a3a161cba4b49f3620b

SHA512
f9d4266e1465b2d4e1ce741bc447e7969928ebad4f11a20d7f3dccdca370727e8c9c25b7903d4b7f07727e94d6daaa210efd3a9a977b00bdad398fc086beeb1d

Download Submit
C:\Windows\System\meGeXQI.exe

Filesize
1.9MB

MD5
bb7461130065fe31eabd7b7cdcb74aeb

SHA1
e3b353f0484d12391db03a9ce593866770b0f500

SHA256
b78507dbc1a356e236993fb70682185ba145f064473c1d2b5bad7ae9616e64d7

SHA512
026cff86796481a07112f3a26a42c038b121f520b92ada5f271bd59fe9e1132eda31d5f21d4261bd11e9388de8a6ffb10406451f2cbb02bfbd11314bf499689b

Download Submit
C:\Windows\System\olZDYnb.exe

Filesize
1.9MB

MD5
7e7a0a0a7b543d36630e28464eeadf6b

SHA1
bb119cdab505172afdf7f3d679a2b7405a49d05c

SHA256
52eca4ec253e00a991ff96e978c7d9af7794457b5346f912f03fbe60babb63cc

SHA512
c8992b0936bd9e302dd239f47931deb5453224480ca544f14c3fa063bc4bda19d0036d8894bd3737e2648d853fefdbedcce670d7fe122d4ebc4ed36348d5f156

Download Submit
C:\Windows\System\qTmHEuW.exe

Filesize
1.9MB

MD5
68bfb076c9b928f78b1531abaf1ee623

SHA1
1e9453fbf813a4d76a1f9523a19907fb36b7da61

SHA256
0094007587df6e9d59cb7003514b7746e77391a6f44cc95fa415b3a0dc5c4457

SHA512
3422fe1fd332d12bc997ba3e239d42fc9f1ab9e044d250e0c0b55536058e3f92dd25c8a86736327176835084f5143265a6e52afc4477942a0f9b6d8385137ebf

Download Submit
C:\Windows\System\sotZeDr.exe

Filesize
1.9MB

MD5
1ce1d00898b4cf43e8acaa4a42fe46c8

SHA1
49bf2bd878f4366de479ce0db4fb765353bcbddc

SHA256
87b3512c097924f5057f89af98b461a8f5a4ab819dfbe379f92a7622a9ecedc8

SHA512
3fa16f17132024ae287586c36339c982d7aa25b5dce6a2dd6399eb67e44f5e5078b06d333368821ab3d5a3aa4573f762f1a5ac3e35bf920e70baacce63964f20

Download Submit
C:\Windows\System\tdpZjit.exe

Filesize
1.9MB

MD5
4f58aafa90c3af24c1a9009a79420e19

SHA1
d1c805d3b1a52e8396a84439b36e8ba20c99ecf7

SHA256
22126552e87969cd38423e237110595701ef876b41351ead796eac089890e353

SHA512
a48fd583be0eecae332fc505f63f1b8c6001afb8c48fa3b4560b728531755230eca5816f596a2a83be4dc28727ccc1be757f9bafdc7580ba09a61744ba73b8f4

Download Submit
C:\Windows\System\uFPukGE.exe

Filesize
1.9MB

MD5
322dc662ce9c49b39c9555027715c787

SHA1
5ca1733a9c4724957de4e9de7dd40f04866e8521

SHA256
bb07a806727c2b5b8a2e269361615eaf14842db93055a8b7ae886c12a37d4501

SHA512
0ea9cd10ae513e44b6ed800a21a364b5e079f5a017b1962de6028123c77bba504f6ca0a2196483835dc39235e563961aab11d3fe8c52e003bccc75663aa56911

Download Submit
C:\Windows\System\wotgJXZ.exe

Filesize
1.9MB

MD5
4c921c78aaffa1b24e03d9b21c34aaf4

SHA1
fda7f7eb8a93c8902b92d2b0d8a2e7188e863f8a

SHA256
e15ce1f239ab242e709af3090c6891111ec27c6b1e7cc9856e76e39604279852

SHA512
809e807a7706013e2a7bcd33ade22972b46b57a23d7849c4400cc7f3bd76a1e7c4034c52975a1bf98521a8e0571d9f3bb2ef20b4e4cf8b25a19c6c82f201ad71

Download Submit
C:\Windows\System\xolUZWW.exe

Filesize
1.9MB

MD5
b951ddd579e1d055614775015b85ce47

SHA1
55d3d3597dadc9126312e13e05a7f329d3c17168

SHA256
81e8033298723d205c3d870da878138a8512440967709613fc926d86f5582413

SHA512
51adffc41870a42866f277388ad9d1e0ff0539687febf6cc5b352f9c483a53e34bb1517fe4178d2255a9a9ef99b644e06a770d9dba5b44ced01871b40c5fd47e

Download Submit
C:\Windows\System\ySHGmdC.exe

Filesize
1.9MB

MD5
b04f6889848c0464c50ac39446c57c2f

SHA1
d9abfe3aa8791a327572110be75c411ef319dd9a

SHA256
4f7e7054175f9d5c90dc4db3857ddb941f0ca3a914491aaa417c3b9c994b06df

SHA512
469651a41d9696669f8e5903969589fcd5773cc6561c881bb856723fc70e6df6fa091ba0d194d8b002ad6af4dbe9ecf5febae12cc1e1d29a631e7a312d09e5f2

Download Submit
memory/392-415-0x00007FF693750000-0x00007FF693B42000-memory.dmp

Filesize
3.9MB

Download
memory/392-2167-0x00007FF693750000-0x00007FF693B42000-memory.dmp

Filesize
3.9MB

Download
memory/552-2144-0x00007FF77A9D0000-0x00007FF77ADC2000-memory.dmp

Filesize
3.9MB

Download
memory/552-399-0x00007FF77A9D0000-0x00007FF77ADC2000-memory.dmp

Filesize
3.9MB

Download
memory/964-2164-0x00007FF617480000-0x00007FF617872000-memory.dmp

Filesize
3.9MB

Download
memory/964-436-0x00007FF617480000-0x00007FF617872000-memory.dmp

Filesize
3.9MB

Download
memory/1008-446-0x00007FF6F9770000-0x00007FF6F9B62000-memory.dmp

Filesize
3.9MB

Download
memory/1008-2148-0x00007FF6F9770000-0x00007FF6F9B62000-memory.dmp

Filesize
3.9MB

Download
memory/1028-404-0x00007FF6C92E0000-0x00007FF6C96D2000-memory.dmp

Filesize
3.9MB

Download
memory/1028-2154-0x00007FF6C92E0000-0x00007FF6C96D2000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2129-0x00007FF7ED660000-0x00007FF7EDA52000-memory.dmp

Filesize
3.9MB

Download
memory/1604-85-0x00007FF7ED660000-0x00007FF7EDA52000-memory.dmp

Filesize
3.9MB

Download
memory/1896-1116-0x00007FF771A20000-0x00007FF771E12000-memory.dmp

Filesize
3.9MB

Download
memory/1896-2095-0x00007FF771A20000-0x00007FF771E12000-memory.dmp

Filesize
3.9MB

Download
memory/1896-10-0x00007FF771A20000-0x00007FF771E12000-memory.dmp

Filesize
3.9MB

Download
memory/1948-403-0x00007FF7C9D10000-0x00007FF7CA102000-memory.dmp

Filesize
3.9MB

Download
memory/1948-2152-0x00007FF7C9D10000-0x00007FF7CA102000-memory.dmp

Filesize
3.9MB

Download
memory/2008-2156-0x00007FF6CB9B0000-0x00007FF6CBDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-405-0x00007FF6CB9B0000-0x00007FF6CBDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-400-0x00007FF7299C0000-0x00007FF729DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2142-0x00007FF7299C0000-0x00007FF729DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-2105-0x00007FF766CE0000-0x00007FF7670D2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-69-0x00007FF766CE0000-0x00007FF7670D2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-2169-0x00007FF63EF60000-0x00007FF63F352000-memory.dmp

Filesize
3.9MB

Download
memory/2832-406-0x00007FF63EF60000-0x00007FF63F352000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2132-0x00007FF6AC770000-0x00007FF6ACB62000-memory.dmp

Filesize
3.9MB

Download
memory/2908-318-0x00007FF6AC770000-0x00007FF6ACB62000-memory.dmp

Filesize
3.9MB

Download
memory/3776-316-0x00007FF6D7D50000-0x00007FF6D8142000-memory.dmp

Filesize
3.9MB

Download
memory/3776-2133-0x00007FF6D7D50000-0x00007FF6D8142000-memory.dmp

Filesize
3.9MB

Download
memory/3936-44-0x00007FF791230000-0x00007FF791622000-memory.dmp

Filesize
3.9MB

Download
memory/3936-2097-0x00007FF791230000-0x00007FF791622000-memory.dmp

Filesize
3.9MB

Download
memory/4016-76-0x00007FF73F170000-0x00007FF73F562000-memory.dmp

Filesize
3.9MB

Download
memory/4016-2135-0x00007FF73F170000-0x00007FF73F562000-memory.dmp

Filesize
3.9MB

Download
memory/4076-90-0x000001F7A7CA0000-0x000001F7A7CC2000-memory.dmp

Filesize
136KB

Download
memory/4076-1366-0x00007FFBA63E3000-0x00007FFBA63E5000-memory.dmp

Filesize
8KB

Download
memory/4076-1242-0x00007FFBA63E0000-0x00007FFBA6EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-2072-0x00007FFBA63E0000-0x00007FFBA6EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-41-0x00007FFBA63E0000-0x00007FFBA6EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-61-0x00007FFBA63E0000-0x00007FFBA6EA1000-memory.dmp

Filesize
10.8MB

Download
memory/4076-25-0x00007FFBA63E3000-0x00007FFBA63E5000-memory.dmp

Filesize
8KB

Download
memory/4076-325-0x000001F7A8A70000-0x000001F7A9216000-memory.dmp

Filesize
7.6MB

Download
memory/4132-2128-0x00007FF71EA00000-0x00007FF71EDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4132-95-0x00007FF71EA00000-0x00007FF71EDF2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-2100-0x00007FF60E6B0000-0x00007FF60EAA2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-51-0x00007FF60E6B0000-0x00007FF60EAA2000-memory.dmp

Filesize
3.9MB

Download
memory/4500-2103-0x00007FF6BD980000-0x00007FF6BDD72000-memory.dmp

Filesize
3.9MB

Download
memory/4500-313-0x00007FF6BD980000-0x00007FF6BDD72000-memory.dmp

Filesize
3.9MB

Download
memory/4736-2101-0x00007FF79B6E0000-0x00007FF79BAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4736-307-0x00007FF79B6E0000-0x00007FF79BAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4856-2146-0x00007FF7EED60000-0x00007FF7EF152000-memory.dmp

Filesize
3.9MB

Download
memory/4856-401-0x00007FF7EED60000-0x00007FF7EF152000-memory.dmp

Filesize
3.9MB

Download
memory/4944-1113-0x00007FF7FA2E0000-0x00007FF7FA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-0-0x00007FF7FA2E0000-0x00007FF7FA6D2000-memory.dmp

Filesize
3.9MB

Download
memory/4944-1-0x000002C301900000-0x000002C301910000-memory.dmp

Filesize
64KB

Download
memory/4980-2140-0x00007FF66CD60000-0x00007FF66D152000-memory.dmp

Filesize
3.9MB

Download
memory/4980-398-0x00007FF66CD60000-0x00007FF66D152000-memory.dmp

Filesize
3.9MB

Download
memory/5000-23-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp

Filesize
3.9MB

Download
memory/5000-1235-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp

Filesize
3.9MB

Download
memory/5000-2093-0x00007FF64C850000-0x00007FF64CC42000-memory.dmp

Filesize
3.9MB

Download
memory/5088-402-0x00007FF788890000-0x00007FF788C82000-memory.dmp

Filesize
3.9MB

Download
memory/5088-2150-0x00007FF788890000-0x00007FF788C82000-memory.dmp

Filesize
3.9MB

Download