xmrig | 82659d40d8edc66c6507acca5e61452d9e620aaf6f9a49812c2db6584bb83ef7

Analysis

max time kernel
117s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2f7c4baa4c02f1e8f993076fdf7d210N.exe
Size

1.0MB
MD5

f2f7c4baa4c02f1e8f993076fdf7d210
SHA1

83a766ec37efa805f56ee09afc6359a0a3f68938
SHA256

82659d40d8edc66c6507acca5e61452d9e620aaf6f9a49812c2db6584bb83ef7
SHA512

8f5222a9642aaecf5a5a55d0fec39c7d23940e22efb1657d433e2d143e503236284fe0bae89b15bd4a0f79b8ae179f12a2b151871df0101c372c3da3fc631102
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMCfZZdbXz8XYZMUyU2ei:Lz071uv4BPMCiXYZ5i

Score

10^/10

xmrig execution miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/396-105-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp	xmrig
behavioral2/memory/384-120-0x00007FF6A1C80000-0x00007FF6A2072000-memory.dmp	xmrig
behavioral2/memory/4820-139-0x00007FF7D65A0000-0x00007FF7D6992000-memory.dmp	xmrig
behavioral2/memory/2472-774-0x00007FF687B80000-0x00007FF687F72000-memory.dmp	xmrig
behavioral2/memory/2332-904-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp	xmrig
behavioral2/memory/2692-919-0x00007FF628930000-0x00007FF628D22000-memory.dmp	xmrig
behavioral2/memory/2560-938-0x00007FF695050000-0x00007FF695442000-memory.dmp	xmrig
behavioral2/memory/2948-1089-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp	xmrig
behavioral2/memory/3904-912-0x00007FF647550000-0x00007FF647942000-memory.dmp	xmrig
behavioral2/memory/4036-891-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp	xmrig
behavioral2/memory/3832-182-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp	xmrig
behavioral2/memory/1812-176-0x00007FF7E32D0000-0x00007FF7E36C2000-memory.dmp	xmrig
behavioral2/memory/2388-170-0x00007FF79C050000-0x00007FF79C442000-memory.dmp	xmrig
behavioral2/memory/2352-164-0x00007FF6FE0A0000-0x00007FF6FE492000-memory.dmp	xmrig
behavioral2/memory/3404-163-0x00007FF7D8740000-0x00007FF7D8B32000-memory.dmp	xmrig
behavioral2/memory/1596-157-0x00007FF73F150000-0x00007FF73F542000-memory.dmp	xmrig
behavioral2/memory/788-151-0x00007FF7E68C0000-0x00007FF7E6CB2000-memory.dmp	xmrig
behavioral2/memory/1732-145-0x00007FF7803C0000-0x00007FF7807B2000-memory.dmp	xmrig
behavioral2/memory/2708-135-0x00007FF78B690000-0x00007FF78BA82000-memory.dmp	xmrig
behavioral2/memory/3352-127-0x00007FF7E1350000-0x00007FF7E1742000-memory.dmp	xmrig
behavioral2/memory/3012-126-0x00007FF704FD0000-0x00007FF7053C2000-memory.dmp	xmrig
behavioral2/memory/1120-115-0x00007FF7DC6B0000-0x00007FF7DCAA2000-memory.dmp	xmrig
behavioral2/memory/1116-106-0x00007FF6A7150000-0x00007FF6A7542000-memory.dmp	xmrig
behavioral2/memory/1096-96-0x00007FF7BA2A0000-0x00007FF7BA692000-memory.dmp	xmrig
behavioral2/memory/2560-83-0x00007FF695050000-0x00007FF695442000-memory.dmp	xmrig
behavioral2/memory/784-72-0x00007FF6820F0000-0x00007FF6824E2000-memory.dmp	xmrig
behavioral2/memory/4036-2367-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp	xmrig
behavioral2/memory/2332-2369-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp	xmrig
behavioral2/memory/3904-2373-0x00007FF647550000-0x00007FF647942000-memory.dmp	xmrig
behavioral2/memory/1120-2372-0x00007FF7DC6B0000-0x00007FF7DCAA2000-memory.dmp	xmrig
behavioral2/memory/784-2375-0x00007FF6820F0000-0x00007FF6824E2000-memory.dmp	xmrig
behavioral2/memory/2948-2377-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp	xmrig
behavioral2/memory/2560-2412-0x00007FF695050000-0x00007FF695442000-memory.dmp	xmrig
behavioral2/memory/4820-2416-0x00007FF7D65A0000-0x00007FF7D6992000-memory.dmp	xmrig
behavioral2/memory/1732-2418-0x00007FF7803C0000-0x00007FF7807B2000-memory.dmp	xmrig
behavioral2/memory/2708-2414-0x00007FF78B690000-0x00007FF78BA82000-memory.dmp	xmrig
behavioral2/memory/1116-2410-0x00007FF6A7150000-0x00007FF6A7542000-memory.dmp	xmrig
behavioral2/memory/1096-2409-0x00007FF7BA2A0000-0x00007FF7BA692000-memory.dmp	xmrig
behavioral2/memory/3012-2399-0x00007FF704FD0000-0x00007FF7053C2000-memory.dmp	xmrig
behavioral2/memory/396-2398-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp	xmrig
behavioral2/memory/384-2405-0x00007FF6A1C80000-0x00007FF6A2072000-memory.dmp	xmrig
behavioral2/memory/2692-2404-0x00007FF628930000-0x00007FF628D22000-memory.dmp	xmrig
behavioral2/memory/3352-2402-0x00007FF7E1350000-0x00007FF7E1742000-memory.dmp	xmrig
behavioral2/memory/788-2424-0x00007FF7E68C0000-0x00007FF7E6CB2000-memory.dmp	xmrig
behavioral2/memory/3404-2421-0x00007FF7D8740000-0x00007FF7D8B32000-memory.dmp	xmrig
behavioral2/memory/1596-2423-0x00007FF73F150000-0x00007FF73F542000-memory.dmp	xmrig
behavioral2/memory/1812-2429-0x00007FF7E32D0000-0x00007FF7E36C2000-memory.dmp	xmrig
behavioral2/memory/2388-2430-0x00007FF79C050000-0x00007FF79C442000-memory.dmp	xmrig
behavioral2/memory/2352-2427-0x00007FF6FE0A0000-0x00007FF6FE492000-memory.dmp	xmrig
behavioral2/memory/3832-2432-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	3624	powershell.exe
9	3624	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4036	NxOqgrD.exe
2332	eVsvgfM.exe
3904	JOXoRIs.exe
1120	tmLSEek.exe
2948	GNfnGuW.exe
384	qylCAHc.exe
2692	PHqRYam.exe
784	dkGjtkl.exe
2560	DbiKTxS.exe
1096	IKAOLVM.exe
396	PyQvJQr.exe
3012	mHzIQxO.exe
3352	JlmnCbH.exe
1116	fKjeEvG.exe
2708	NImltOf.exe
4820	EmuGAqE.exe
1732	BuIOrAT.exe
788	MKBuTJs.exe
1596	SoyrqSa.exe
3404	BfIvlhY.exe
2352	DQNMVKW.exe
2388	POQzonH.exe
1812	mfakbLG.exe
3832	kBZtSSs.exe
4920	FiBizSi.exe
3700	BFnSkRO.exe
3836	cbWBjLB.exe
820	KfUocGm.exe
2228	VTwETOp.exe
4136	ABfkxjX.exe
1264	lklPkoN.exe
3536	iLknLoG.exe
4364	qDaSDeR.exe
5092	SpkNgGb.exe
2112	XRBntaU.exe
4756	dieLZvg.exe
2012	xaTDTQJ.exe
4428	UMckILW.exe
1792	jjVUGlV.exe
3560	iGmqoyJ.exe
2596	EsVyWTd.exe
3908	rJCdqXf.exe
1912	uQZlEnl.exe
2108	pWsnNzC.exe
3172	ryclkjN.exe
2688	qGNzyOj.exe
2796	FuhzcZY.exe
1788	aZjADOW.exe
4988	BWHPMbt.exe
3616	fDxlNOU.exe
3788	oTpTSGN.exe
744	ypGDxKA.exe
1968	wCBmbpF.exe
4276	MGSZeLA.exe
516	CfgqQtQ.exe
4340	sPIlnGa.exe
1828	FmAViAX.exe
4424	SgBTXOq.exe
2996	rCStVrF.exe
4588	fyQVJig.exe
1572	SYWmHpY.exe
2144	zNjkONR.exe
336	gwnVacJ.exe
2076	CTgSYIQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2472-0-0x00007FF687B80000-0x00007FF687F72000-memory.dmp	upx
behavioral2/files/0x0008000000023441-5.dat	upx
behavioral2/files/0x0007000000023446-9.dat	upx
behavioral2/memory/4036-6-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp	upx
behavioral2/files/0x0007000000023445-15.dat	upx
behavioral2/memory/2332-24-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp	upx
behavioral2/files/0x000700000002344b-56.dat	upx
behavioral2/files/0x000700000002344c-75.dat	upx
behavioral2/files/0x000700000002344e-79.dat	upx
behavioral2/files/0x0007000000023453-89.dat	upx
behavioral2/memory/396-105-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp	upx
behavioral2/memory/384-120-0x00007FF6A1C80000-0x00007FF6A2072000-memory.dmp	upx
behavioral2/files/0x0007000000023458-129.dat	upx
behavioral2/memory/4820-139-0x00007FF7D65A0000-0x00007FF7D6992000-memory.dmp	upx
behavioral2/files/0x000700000002345a-148.dat	upx
behavioral2/files/0x000700000002345d-177.dat	upx
behavioral2/memory/2472-774-0x00007FF687B80000-0x00007FF687F72000-memory.dmp	upx
behavioral2/memory/2332-904-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp	upx
behavioral2/memory/2692-919-0x00007FF628930000-0x00007FF628D22000-memory.dmp	upx
behavioral2/memory/2560-938-0x00007FF695050000-0x00007FF695442000-memory.dmp	upx
behavioral2/memory/2948-1089-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp	upx
behavioral2/memory/3904-912-0x00007FF647550000-0x00007FF647942000-memory.dmp	upx
behavioral2/memory/4036-891-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp	upx
behavioral2/files/0x0007000000023463-200.dat	upx
behavioral2/files/0x0007000000023461-198.dat	upx
behavioral2/files/0x0007000000023462-195.dat	upx
behavioral2/files/0x0007000000023460-193.dat	upx
behavioral2/files/0x000700000002345f-188.dat	upx
behavioral2/files/0x000700000002345e-183.dat	upx
behavioral2/memory/3832-182-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp	upx
behavioral2/memory/1812-176-0x00007FF7E32D0000-0x00007FF7E36C2000-memory.dmp	upx
behavioral2/files/0x000700000002345c-171.dat	upx
behavioral2/memory/2388-170-0x00007FF79C050000-0x00007FF79C442000-memory.dmp	upx
behavioral2/files/0x000700000002345b-165.dat	upx
behavioral2/memory/2352-164-0x00007FF6FE0A0000-0x00007FF6FE492000-memory.dmp	upx
behavioral2/memory/3404-163-0x00007FF7D8740000-0x00007FF7D8B32000-memory.dmp	upx
behavioral2/memory/1596-157-0x00007FF73F150000-0x00007FF73F542000-memory.dmp	upx
behavioral2/files/0x0008000000023456-152.dat	upx
behavioral2/memory/788-151-0x00007FF7E68C0000-0x00007FF7E6CB2000-memory.dmp	upx
behavioral2/files/0x0007000000023459-146.dat	upx
behavioral2/memory/1732-145-0x00007FF7803C0000-0x00007FF7807B2000-memory.dmp	upx
behavioral2/files/0x0008000000023457-140.dat	upx
behavioral2/memory/2708-135-0x00007FF78B690000-0x00007FF78BA82000-memory.dmp	upx
behavioral2/files/0x0008000000023442-131.dat	upx
behavioral2/memory/3352-127-0x00007FF7E1350000-0x00007FF7E1742000-memory.dmp	upx
behavioral2/memory/3012-126-0x00007FF704FD0000-0x00007FF7053C2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-121.dat	upx
behavioral2/memory/1120-115-0x00007FF7DC6B0000-0x00007FF7DCAA2000-memory.dmp	upx
behavioral2/files/0x0007000000023454-110.dat	upx
behavioral2/memory/1116-106-0x00007FF6A7150000-0x00007FF6A7542000-memory.dmp	upx
behavioral2/files/0x0007000000023452-101.dat	upx
behavioral2/memory/1096-96-0x00007FF7BA2A0000-0x00007FF7BA692000-memory.dmp	upx
behavioral2/memory/2560-83-0x00007FF695050000-0x00007FF695442000-memory.dmp	upx
behavioral2/files/0x000700000002344d-77.dat	upx
behavioral2/memory/784-72-0x00007FF6820F0000-0x00007FF6824E2000-memory.dmp	upx
behavioral2/files/0x0007000000023451-84.dat	upx
behavioral2/files/0x000700000002344a-65.dat	upx
behavioral2/files/0x0007000000023450-67.dat	upx
behavioral2/memory/2692-60-0x00007FF628930000-0x00007FF628D22000-memory.dmp	upx
behavioral2/files/0x000700000002344f-59.dat	upx
behavioral2/files/0x0007000000023449-53.dat	upx
behavioral2/files/0x0007000000023448-52.dat	upx
behavioral2/memory/2948-39-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp	upx
behavioral2/files/0x0007000000023447-31.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\veaLrfX.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\EsRdUiZ.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\RkIhzZz.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\BFnSkRO.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\fcOCLiW.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\bpJxMvn.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\zYWMeSl.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\ZiSntuW.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\AUdAfoe.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\DsXNWDK.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\soiPqNc.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\sGZNHTS.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\cGCCTbc.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\Rzrgsma.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\mIexDhn.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\mfakbLG.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\sEILSgs.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\dvVbuLz.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\HfVjoWz.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\dIZvaVA.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\ohKZPxx.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\DMOoulO.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\rJCdqXf.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\CTgSYIQ.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\rHJHWKs.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\twEOBSr.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\QDokHAr.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\aIoIVpe.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\aZjADOW.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\mSyyXym.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\aMeJVSs.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\vtGTVsu.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\BuvjDrO.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\gQxNADV.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\RKNxhCi.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\RtSVfNS.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\hrHUdOT.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\oTSfmJr.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\oVpopFb.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\FcIfBHT.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\ukLGEEn.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\rFnoBbF.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\DBtcufp.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\adkULli.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\rOxkpzv.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\olBIZZa.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\lnZIhpa.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\AYyqhYP.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\obzQmnO.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\QRElkJx.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\qGNzyOj.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\TgQdJtJ.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\gXqdQIV.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\LOLwpsS.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\fLoDTzZ.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\fqIBfgD.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\BjkKjHU.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\cALHDLQ.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\BqERFCM.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\XjcSlnO.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\NuOxztM.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\xuLyipX.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\IbOLqmQ.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
File created	C:\Windows\System\ZnLQzgW.exe	f2f7c4baa4c02f1e8f993076fdf7d210N.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
Token: SeLockMemoryPrivilege	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe
Token: SeDebugPrivilege	3624	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 3624	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	84
PID 2472 wrote to memory of 3624	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	84
PID 2472 wrote to memory of 4036	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	85
PID 2472 wrote to memory of 4036	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	85
PID 2472 wrote to memory of 2332	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	86
PID 2472 wrote to memory of 2332	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	86
PID 2472 wrote to memory of 1120	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	87
PID 2472 wrote to memory of 1120	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	87
PID 2472 wrote to memory of 3904	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	88
PID 2472 wrote to memory of 3904	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	88
PID 2472 wrote to memory of 2948	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	89
PID 2472 wrote to memory of 2948	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	89
PID 2472 wrote to memory of 384	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	90
PID 2472 wrote to memory of 384	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	90
PID 2472 wrote to memory of 2692	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	91
PID 2472 wrote to memory of 2692	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	91
PID 2472 wrote to memory of 784	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	92
PID 2472 wrote to memory of 784	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	92
PID 2472 wrote to memory of 3012	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	93
PID 2472 wrote to memory of 3012	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	93
PID 2472 wrote to memory of 2560	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	94
PID 2472 wrote to memory of 2560	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	94
PID 2472 wrote to memory of 1096	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	95
PID 2472 wrote to memory of 1096	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	95
PID 2472 wrote to memory of 396	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	96
PID 2472 wrote to memory of 396	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	96
PID 2472 wrote to memory of 3352	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	97
PID 2472 wrote to memory of 3352	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	97
PID 2472 wrote to memory of 1116	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	98
PID 2472 wrote to memory of 1116	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	98
PID 2472 wrote to memory of 2708	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	99
PID 2472 wrote to memory of 2708	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	99
PID 2472 wrote to memory of 4820	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	100
PID 2472 wrote to memory of 4820	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	100
PID 2472 wrote to memory of 1732	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	101
PID 2472 wrote to memory of 1732	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	101
PID 2472 wrote to memory of 788	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	102
PID 2472 wrote to memory of 788	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	102
PID 2472 wrote to memory of 1596	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	103
PID 2472 wrote to memory of 1596	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	103
PID 2472 wrote to memory of 3404	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	104
PID 2472 wrote to memory of 3404	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	104
PID 2472 wrote to memory of 2352	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	105
PID 2472 wrote to memory of 2352	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	105
PID 2472 wrote to memory of 2388	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	106
PID 2472 wrote to memory of 2388	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	106
PID 2472 wrote to memory of 1812	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	107
PID 2472 wrote to memory of 1812	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	107
PID 2472 wrote to memory of 3832	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	108
PID 2472 wrote to memory of 3832	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	108
PID 2472 wrote to memory of 4920	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	109
PID 2472 wrote to memory of 4920	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	109
PID 2472 wrote to memory of 3700	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	110
PID 2472 wrote to memory of 3700	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	110
PID 2472 wrote to memory of 3836	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	111
PID 2472 wrote to memory of 3836	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	111
PID 2472 wrote to memory of 820	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	112
PID 2472 wrote to memory of 820	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	112
PID 2472 wrote to memory of 2228	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	113
PID 2472 wrote to memory of 2228	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	113
PID 2472 wrote to memory of 4136	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	114
PID 2472 wrote to memory of 4136	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	114
PID 2472 wrote to memory of 1264	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	115
PID 2472 wrote to memory of 1264	2472	f2f7c4baa4c02f1e8f993076fdf7d210N.exe	115

C:\Users\Admin\AppData\Local\Temp\f2f7c4baa4c02f1e8f993076fdf7d210N.exe
"C:\Users\Admin\AppData\Local\Temp\f2f7c4baa4c02f1e8f993076fdf7d210N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3624" "2940" "2872" "2944" "0" "0" "2948" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13528
- C:\Windows\System\NxOqgrD.exe
  C:\Windows\System\NxOqgrD.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\eVsvgfM.exe
  C:\Windows\System\eVsvgfM.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\tmLSEek.exe
  C:\Windows\System\tmLSEek.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\JOXoRIs.exe
  C:\Windows\System\JOXoRIs.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\GNfnGuW.exe
  C:\Windows\System\GNfnGuW.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\qylCAHc.exe
  C:\Windows\System\qylCAHc.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\PHqRYam.exe
  C:\Windows\System\PHqRYam.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\dkGjtkl.exe
  C:\Windows\System\dkGjtkl.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\mHzIQxO.exe
  C:\Windows\System\mHzIQxO.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\DbiKTxS.exe
  C:\Windows\System\DbiKTxS.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\IKAOLVM.exe
  C:\Windows\System\IKAOLVM.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\PyQvJQr.exe
  C:\Windows\System\PyQvJQr.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\JlmnCbH.exe
  C:\Windows\System\JlmnCbH.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\fKjeEvG.exe
  C:\Windows\System\fKjeEvG.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\NImltOf.exe
  C:\Windows\System\NImltOf.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\EmuGAqE.exe
  C:\Windows\System\EmuGAqE.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\BuIOrAT.exe
  C:\Windows\System\BuIOrAT.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\MKBuTJs.exe
  C:\Windows\System\MKBuTJs.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\SoyrqSa.exe
  C:\Windows\System\SoyrqSa.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\BfIvlhY.exe
  C:\Windows\System\BfIvlhY.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\DQNMVKW.exe
  C:\Windows\System\DQNMVKW.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\POQzonH.exe
  C:\Windows\System\POQzonH.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\mfakbLG.exe
  C:\Windows\System\mfakbLG.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\kBZtSSs.exe
  C:\Windows\System\kBZtSSs.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\FiBizSi.exe
  C:\Windows\System\FiBizSi.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\BFnSkRO.exe
  C:\Windows\System\BFnSkRO.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\cbWBjLB.exe
  C:\Windows\System\cbWBjLB.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\KfUocGm.exe
  C:\Windows\System\KfUocGm.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\VTwETOp.exe
  C:\Windows\System\VTwETOp.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\ABfkxjX.exe
  C:\Windows\System\ABfkxjX.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\lklPkoN.exe
  C:\Windows\System\lklPkoN.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\iLknLoG.exe
  C:\Windows\System\iLknLoG.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\qDaSDeR.exe
  C:\Windows\System\qDaSDeR.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\SpkNgGb.exe
  C:\Windows\System\SpkNgGb.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\XRBntaU.exe
  C:\Windows\System\XRBntaU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\dieLZvg.exe
  C:\Windows\System\dieLZvg.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\xaTDTQJ.exe
  C:\Windows\System\xaTDTQJ.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\UMckILW.exe
  C:\Windows\System\UMckILW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\jjVUGlV.exe
  C:\Windows\System\jjVUGlV.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\iGmqoyJ.exe
  C:\Windows\System\iGmqoyJ.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\EsVyWTd.exe
  C:\Windows\System\EsVyWTd.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\rJCdqXf.exe
  C:\Windows\System\rJCdqXf.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\uQZlEnl.exe
  C:\Windows\System\uQZlEnl.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\pWsnNzC.exe
  C:\Windows\System\pWsnNzC.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ryclkjN.exe
  C:\Windows\System\ryclkjN.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\qGNzyOj.exe
  C:\Windows\System\qGNzyOj.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FuhzcZY.exe
  C:\Windows\System\FuhzcZY.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\aZjADOW.exe
  C:\Windows\System\aZjADOW.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\BWHPMbt.exe
  C:\Windows\System\BWHPMbt.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\fDxlNOU.exe
  C:\Windows\System\fDxlNOU.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\oTpTSGN.exe
  C:\Windows\System\oTpTSGN.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\ypGDxKA.exe
  C:\Windows\System\ypGDxKA.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\wCBmbpF.exe
  C:\Windows\System\wCBmbpF.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\MGSZeLA.exe
  C:\Windows\System\MGSZeLA.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\CfgqQtQ.exe
  C:\Windows\System\CfgqQtQ.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\sPIlnGa.exe
  C:\Windows\System\sPIlnGa.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\FmAViAX.exe
  C:\Windows\System\FmAViAX.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\SgBTXOq.exe
  C:\Windows\System\SgBTXOq.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\rCStVrF.exe
  C:\Windows\System\rCStVrF.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\fyQVJig.exe
  C:\Windows\System\fyQVJig.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\SYWmHpY.exe
  C:\Windows\System\SYWmHpY.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\zNjkONR.exe
  C:\Windows\System\zNjkONR.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\gwnVacJ.exe
  C:\Windows\System\gwnVacJ.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\CTgSYIQ.exe
  C:\Windows\System\CTgSYIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\iqtJsST.exe
  C:\Windows\System\iqtJsST.exe
  2⤵
  PID:3116
- C:\Windows\System\uysdxeS.exe
  C:\Windows\System\uysdxeS.exe
  2⤵
  PID:4280
- C:\Windows\System\QUkzwDk.exe
  C:\Windows\System\QUkzwDk.exe
  2⤵
  PID:712
- C:\Windows\System\NWGLILd.exe
  C:\Windows\System\NWGLILd.exe
  2⤵
  PID:3100
- C:\Windows\System\OPbIXAN.exe
  C:\Windows\System\OPbIXAN.exe
  2⤵
  PID:2936
- C:\Windows\System\RASgivX.exe
  C:\Windows\System\RASgivX.exe
  2⤵
  PID:2504
- C:\Windows\System\CLpjlRP.exe
  C:\Windows\System\CLpjlRP.exe
  2⤵
  PID:5132
- C:\Windows\System\LfBCFzj.exe
  C:\Windows\System\LfBCFzj.exe
  2⤵
  PID:5164
- C:\Windows\System\rLivvyl.exe
  C:\Windows\System\rLivvyl.exe
  2⤵
  PID:5192
- C:\Windows\System\TOocrEg.exe
  C:\Windows\System\TOocrEg.exe
  2⤵
  PID:5220
- C:\Windows\System\aietZss.exe
  C:\Windows\System\aietZss.exe
  2⤵
  PID:5248
- C:\Windows\System\fLoDTzZ.exe
  C:\Windows\System\fLoDTzZ.exe
  2⤵
  PID:5276
- C:\Windows\System\HxfJXRB.exe
  C:\Windows\System\HxfJXRB.exe
  2⤵
  PID:5304
- C:\Windows\System\ZfRnIku.exe
  C:\Windows\System\ZfRnIku.exe
  2⤵
  PID:5332
- C:\Windows\System\fqIBfgD.exe
  C:\Windows\System\fqIBfgD.exe
  2⤵
  PID:5360
- C:\Windows\System\TyJhERg.exe
  C:\Windows\System\TyJhERg.exe
  2⤵
  PID:5388
- C:\Windows\System\akJPCRB.exe
  C:\Windows\System\akJPCRB.exe
  2⤵
  PID:5416
- C:\Windows\System\jiSkeKt.exe
  C:\Windows\System\jiSkeKt.exe
  2⤵
  PID:5444
- C:\Windows\System\LtyuKUx.exe
  C:\Windows\System\LtyuKUx.exe
  2⤵
  PID:5472
- C:\Windows\System\QaZrmxE.exe
  C:\Windows\System\QaZrmxE.exe
  2⤵
  PID:5500
- C:\Windows\System\JzyfWSg.exe
  C:\Windows\System\JzyfWSg.exe
  2⤵
  PID:5528
- C:\Windows\System\qdJAtVb.exe
  C:\Windows\System\qdJAtVb.exe
  2⤵
  PID:5556
- C:\Windows\System\rGRXAtl.exe
  C:\Windows\System\rGRXAtl.exe
  2⤵
  PID:5592
- C:\Windows\System\euUTsrr.exe
  C:\Windows\System\euUTsrr.exe
  2⤵
  PID:5620
- C:\Windows\System\QBBxiiP.exe
  C:\Windows\System\QBBxiiP.exe
  2⤵
  PID:5648
- C:\Windows\System\VPERiwR.exe
  C:\Windows\System\VPERiwR.exe
  2⤵
  PID:5680
- C:\Windows\System\ajfNUJR.exe
  C:\Windows\System\ajfNUJR.exe
  2⤵
  PID:5708
- C:\Windows\System\ILskmkj.exe
  C:\Windows\System\ILskmkj.exe
  2⤵
  PID:5736
- C:\Windows\System\DNDKGjH.exe
  C:\Windows\System\DNDKGjH.exe
  2⤵
  PID:5756
- C:\Windows\System\QksltrG.exe
  C:\Windows\System\QksltrG.exe
  2⤵
  PID:5776
- C:\Windows\System\PcyGexH.exe
  C:\Windows\System\PcyGexH.exe
  2⤵
  PID:5808
- C:\Windows\System\XEPMkkl.exe
  C:\Windows\System\XEPMkkl.exe
  2⤵
  PID:5832
- C:\Windows\System\WdtRXny.exe
  C:\Windows\System\WdtRXny.exe
  2⤵
  PID:5856
- C:\Windows\System\fQpgzkb.exe
  C:\Windows\System\fQpgzkb.exe
  2⤵
  PID:5872
- C:\Windows\System\vEjJDTb.exe
  C:\Windows\System\vEjJDTb.exe
  2⤵
  PID:5900
- C:\Windows\System\hjhVtJd.exe
  C:\Windows\System\hjhVtJd.exe
  2⤵
  PID:5936
- C:\Windows\System\kjHHfbw.exe
  C:\Windows\System\kjHHfbw.exe
  2⤵
  PID:5956
- C:\Windows\System\qYVVuNG.exe
  C:\Windows\System\qYVVuNG.exe
  2⤵
  PID:5980
- C:\Windows\System\oDeAuQg.exe
  C:\Windows\System\oDeAuQg.exe
  2⤵
  PID:5996
- C:\Windows\System\BntelAu.exe
  C:\Windows\System\BntelAu.exe
  2⤵
  PID:6016
- C:\Windows\System\rvvPYsa.exe
  C:\Windows\System\rvvPYsa.exe
  2⤵
  PID:6056
- C:\Windows\System\VlojloR.exe
  C:\Windows\System\VlojloR.exe
  2⤵
  PID:6076
- C:\Windows\System\DlLDinR.exe
  C:\Windows\System\DlLDinR.exe
  2⤵
  PID:6092
- C:\Windows\System\HHWRmfM.exe
  C:\Windows\System\HHWRmfM.exe
  2⤵
  PID:6112
- C:\Windows\System\SkvALFc.exe
  C:\Windows\System\SkvALFc.exe
  2⤵
  PID:4336
- C:\Windows\System\ZWgatvj.exe
  C:\Windows\System\ZWgatvj.exe
  2⤵
  PID:2040
- C:\Windows\System\GxDbPeG.exe
  C:\Windows\System\GxDbPeG.exe
  2⤵
  PID:4520
- C:\Windows\System\DKINeye.exe
  C:\Windows\System\DKINeye.exe
  2⤵
  PID:5148
- C:\Windows\System\WmIsAef.exe
  C:\Windows\System\WmIsAef.exe
  2⤵
  PID:5288
- C:\Windows\System\bYbXpng.exe
  C:\Windows\System\bYbXpng.exe
  2⤵
  PID:5344
- C:\Windows\System\dLuKErt.exe
  C:\Windows\System\dLuKErt.exe
  2⤵
  PID:5380
- C:\Windows\System\YybzOMd.exe
  C:\Windows\System\YybzOMd.exe
  2⤵
  PID:2960
- C:\Windows\System\SBdgbJj.exe
  C:\Windows\System\SBdgbJj.exe
  2⤵
  PID:5516
- C:\Windows\System\CfrigbV.exe
  C:\Windows\System\CfrigbV.exe
  2⤵
  PID:5084
- C:\Windows\System\hWZeMTW.exe
  C:\Windows\System\hWZeMTW.exe
  2⤵
  PID:1240
- C:\Windows\System\KWFQiWv.exe
  C:\Windows\System\KWFQiWv.exe
  2⤵
  PID:3052
- C:\Windows\System\VQWaQgD.exe
  C:\Windows\System\VQWaQgD.exe
  2⤵
  PID:3224
- C:\Windows\System\lyZxlyl.exe
  C:\Windows\System\lyZxlyl.exe
  2⤵
  PID:3632
- C:\Windows\System\wOuMGzq.exe
  C:\Windows\System\wOuMGzq.exe
  2⤵
  PID:1600
- C:\Windows\System\HRXbqUA.exe
  C:\Windows\System\HRXbqUA.exe
  2⤵
  PID:1608
- C:\Windows\System\cculoBj.exe
  C:\Windows\System\cculoBj.exe
  2⤵
  PID:2892
- C:\Windows\System\XAzztdv.exe
  C:\Windows\System\XAzztdv.exe
  2⤵
  PID:4668
- C:\Windows\System\etQdUPF.exe
  C:\Windows\System\etQdUPF.exe
  2⤵
  PID:4880
- C:\Windows\System\qNqCEJr.exe
  C:\Windows\System\qNqCEJr.exe
  2⤵
  PID:5576
- C:\Windows\System\qBvHVBZ.exe
  C:\Windows\System\qBvHVBZ.exe
  2⤵
  PID:5600
- C:\Windows\System\HYStRsE.exe
  C:\Windows\System\HYStRsE.exe
  2⤵
  PID:3128
- C:\Windows\System\cGCCTbc.exe
  C:\Windows\System\cGCCTbc.exe
  2⤵
  PID:5716
- C:\Windows\System\hJiFhsT.exe
  C:\Windows\System\hJiFhsT.exe
  2⤵
  PID:1772
- C:\Windows\System\IxGrKsl.exe
  C:\Windows\System\IxGrKsl.exe
  2⤵
  PID:964
- C:\Windows\System\GUHJZII.exe
  C:\Windows\System\GUHJZII.exe
  2⤵
  PID:4884
- C:\Windows\System\YqgxgAF.exe
  C:\Windows\System\YqgxgAF.exe
  2⤵
  PID:5816
- C:\Windows\System\ufZyHxq.exe
  C:\Windows\System\ufZyHxq.exe
  2⤵
  PID:5880
- C:\Windows\System\zuqyzjF.exe
  C:\Windows\System\zuqyzjF.exe
  2⤵
  PID:5916
- C:\Windows\System\DOVlhqi.exe
  C:\Windows\System\DOVlhqi.exe
  2⤵
  PID:6008
- C:\Windows\System\tQjSjqM.exe
  C:\Windows\System\tQjSjqM.exe
  2⤵
  PID:6048
- C:\Windows\System\iOtLeTe.exe
  C:\Windows\System\iOtLeTe.exe
  2⤵
  PID:6108
- C:\Windows\System\jxHZsyP.exe
  C:\Windows\System\jxHZsyP.exe
  2⤵
  PID:5176
- C:\Windows\System\qOXQdRJ.exe
  C:\Windows\System\qOXQdRJ.exe
  2⤵
  PID:5124
- C:\Windows\System\rfOJrMC.exe
  C:\Windows\System\rfOJrMC.exe
  2⤵
  PID:5324
- C:\Windows\System\LvRBSWk.exe
  C:\Windows\System\LvRBSWk.exe
  2⤵
  PID:5352
- C:\Windows\System\rtzdWOg.exe
  C:\Windows\System\rtzdWOg.exe
  2⤵
  PID:5540
- C:\Windows\System\veaLrfX.exe
  C:\Windows\System\veaLrfX.exe
  2⤵
  PID:1712
- C:\Windows\System\UrwzpFf.exe
  C:\Windows\System\UrwzpFf.exe
  2⤵
  PID:4844
- C:\Windows\System\fcOCLiW.exe
  C:\Windows\System\fcOCLiW.exe
  2⤵
  PID:4744
- C:\Windows\System\BiJdyEn.exe
  C:\Windows\System\BiJdyEn.exe
  2⤵
  PID:4212
- C:\Windows\System\AUdAfoe.exe
  C:\Windows\System\AUdAfoe.exe
  2⤵
  PID:1652
- C:\Windows\System\csUFnzB.exe
  C:\Windows\System\csUFnzB.exe
  2⤵
  PID:5568
- C:\Windows\System\UwyvEbO.exe
  C:\Windows\System\UwyvEbO.exe
  2⤵
  PID:5668
- C:\Windows\System\prhEfna.exe
  C:\Windows\System\prhEfna.exe
  2⤵
  PID:5768
- C:\Windows\System\GaOyPJf.exe
  C:\Windows\System\GaOyPJf.exe
  2⤵
  PID:5864
- C:\Windows\System\tzOixTO.exe
  C:\Windows\System\tzOixTO.exe
  2⤵
  PID:5912
- C:\Windows\System\tVcMGPu.exe
  C:\Windows\System\tVcMGPu.exe
  2⤵
  PID:6128
- C:\Windows\System\BjoZxHV.exe
  C:\Windows\System\BjoZxHV.exe
  2⤵
  PID:3388
- C:\Windows\System\emaSnUD.exe
  C:\Windows\System\emaSnUD.exe
  2⤵
  PID:5408
- C:\Windows\System\AuHJFTX.exe
  C:\Windows\System\AuHJFTX.exe
  2⤵
  PID:3956
- C:\Windows\System\xqkeHLs.exe
  C:\Windows\System\xqkeHLs.exe
  2⤵
  PID:4084
- C:\Windows\System\VxUDFlx.exe
  C:\Windows\System\VxUDFlx.exe
  2⤵
  PID:5800
- C:\Windows\System\lZAoAij.exe
  C:\Windows\System\lZAoAij.exe
  2⤵
  PID:5672
- C:\Windows\System\cVKhMSh.exe
  C:\Windows\System\cVKhMSh.exe
  2⤵
  PID:5944
- C:\Windows\System\BHpryAd.exe
  C:\Windows\System\BHpryAd.exe
  2⤵
  PID:1524
- C:\Windows\System\waIxhZT.exe
  C:\Windows\System\waIxhZT.exe
  2⤵
  PID:4592
- C:\Windows\System\DqvbGQk.exe
  C:\Windows\System\DqvbGQk.exe
  2⤵
  PID:2304
- C:\Windows\System\MSrETIV.exe
  C:\Windows\System\MSrETIV.exe
  2⤵
  PID:5688
- C:\Windows\System\htbflRb.exe
  C:\Windows\System\htbflRb.exe
  2⤵
  PID:3636
- C:\Windows\System\UmRnSRG.exe
  C:\Windows\System\UmRnSRG.exe
  2⤵
  PID:6164
- C:\Windows\System\EJHKDLX.exe
  C:\Windows\System\EJHKDLX.exe
  2⤵
  PID:6184
- C:\Windows\System\QrObDOo.exe
  C:\Windows\System\QrObDOo.exe
  2⤵
  PID:6216
- C:\Windows\System\MOBzEfz.exe
  C:\Windows\System\MOBzEfz.exe
  2⤵
  PID:6232
- C:\Windows\System\KLjppRQ.exe
  C:\Windows\System\KLjppRQ.exe
  2⤵
  PID:6252
- C:\Windows\System\TgQdJtJ.exe
  C:\Windows\System\TgQdJtJ.exe
  2⤵
  PID:6268
- C:\Windows\System\mPxHLEp.exe
  C:\Windows\System\mPxHLEp.exe
  2⤵
  PID:6292
- C:\Windows\System\GvQJgYS.exe
  C:\Windows\System\GvQJgYS.exe
  2⤵
  PID:6308
- C:\Windows\System\aMeJVSs.exe
  C:\Windows\System\aMeJVSs.exe
  2⤵
  PID:6328
- C:\Windows\System\ITXDkXA.exe
  C:\Windows\System\ITXDkXA.exe
  2⤵
  PID:6400
- C:\Windows\System\brFHBDW.exe
  C:\Windows\System\brFHBDW.exe
  2⤵
  PID:6440
- C:\Windows\System\OmcmxHk.exe
  C:\Windows\System\OmcmxHk.exe
  2⤵
  PID:6456
- C:\Windows\System\sFXlrpG.exe
  C:\Windows\System\sFXlrpG.exe
  2⤵
  PID:6476
- C:\Windows\System\QXziPxF.exe
  C:\Windows\System\QXziPxF.exe
  2⤵
  PID:6496
- C:\Windows\System\PTCONKa.exe
  C:\Windows\System\PTCONKa.exe
  2⤵
  PID:6516
- C:\Windows\System\FmoocCX.exe
  C:\Windows\System\FmoocCX.exe
  2⤵
  PID:6536
- C:\Windows\System\YxQbLpV.exe
  C:\Windows\System\YxQbLpV.exe
  2⤵
  PID:6552
- C:\Windows\System\YRfEhpY.exe
  C:\Windows\System\YRfEhpY.exe
  2⤵
  PID:6568
- C:\Windows\System\ezMoSNK.exe
  C:\Windows\System\ezMoSNK.exe
  2⤵
  PID:6600
- C:\Windows\System\NbddoQG.exe
  C:\Windows\System\NbddoQG.exe
  2⤵
  PID:6644
- C:\Windows\System\DxkZUwj.exe
  C:\Windows\System\DxkZUwj.exe
  2⤵
  PID:6664
- C:\Windows\System\QFmZyCb.exe
  C:\Windows\System\QFmZyCb.exe
  2⤵
  PID:6680
- C:\Windows\System\ntVQQPi.exe
  C:\Windows\System\ntVQQPi.exe
  2⤵
  PID:6756
- C:\Windows\System\boikTxy.exe
  C:\Windows\System\boikTxy.exe
  2⤵
  PID:6812
- C:\Windows\System\RnuJDtd.exe
  C:\Windows\System\RnuJDtd.exe
  2⤵
  PID:6836
- C:\Windows\System\pCSmsJO.exe
  C:\Windows\System\pCSmsJO.exe
  2⤵
  PID:6872
- C:\Windows\System\ygbTKuJ.exe
  C:\Windows\System\ygbTKuJ.exe
  2⤵
  PID:6900
- C:\Windows\System\ceuPqxn.exe
  C:\Windows\System\ceuPqxn.exe
  2⤵
  PID:6916
- C:\Windows\System\mnCsJTY.exe
  C:\Windows\System\mnCsJTY.exe
  2⤵
  PID:6940
- C:\Windows\System\rooeZOj.exe
  C:\Windows\System\rooeZOj.exe
  2⤵
  PID:6960
- C:\Windows\System\CIXTvwB.exe
  C:\Windows\System\CIXTvwB.exe
  2⤵
  PID:7024
- C:\Windows\System\rHzwpZh.exe
  C:\Windows\System\rHzwpZh.exe
  2⤵
  PID:7040
- C:\Windows\System\yTykNRY.exe
  C:\Windows\System\yTykNRY.exe
  2⤵
  PID:7060
- C:\Windows\System\hObznGX.exe
  C:\Windows\System\hObznGX.exe
  2⤵
  PID:7076
- C:\Windows\System\FqVRzyT.exe
  C:\Windows\System\FqVRzyT.exe
  2⤵
  PID:7096
- C:\Windows\System\hVKHnLg.exe
  C:\Windows\System\hVKHnLg.exe
  2⤵
  PID:7136
- C:\Windows\System\zSUfvlI.exe
  C:\Windows\System\zSUfvlI.exe
  2⤵
  PID:7156
- C:\Windows\System\GIYEAre.exe
  C:\Windows\System\GIYEAre.exe
  2⤵
  PID:3448
- C:\Windows\System\rGsZMvT.exe
  C:\Windows\System\rGsZMvT.exe
  2⤵
  PID:6228
- C:\Windows\System\kJsvclg.exe
  C:\Windows\System\kJsvclg.exe
  2⤵
  PID:6344
- C:\Windows\System\qRZawZa.exe
  C:\Windows\System\qRZawZa.exe
  2⤵
  PID:6260
- C:\Windows\System\Rzrgsma.exe
  C:\Windows\System\Rzrgsma.exe
  2⤵
  PID:6524
- C:\Windows\System\rKIxLVe.exe
  C:\Windows\System\rKIxLVe.exe
  2⤵
  PID:6452
- C:\Windows\System\gVitCbu.exe
  C:\Windows\System\gVitCbu.exe
  2⤵
  PID:6488
- C:\Windows\System\eayMRYF.exe
  C:\Windows\System\eayMRYF.exe
  2⤵
  PID:6548
- C:\Windows\System\KBZUyYu.exe
  C:\Windows\System\KBZUyYu.exe
  2⤵
  PID:6692
- C:\Windows\System\DQTujqs.exe
  C:\Windows\System\DQTujqs.exe
  2⤵
  PID:6676
- C:\Windows\System\wCKswmg.exe
  C:\Windows\System\wCKswmg.exe
  2⤵
  PID:6660
- C:\Windows\System\qvVqZAj.exe
  C:\Windows\System\qvVqZAj.exe
  2⤵
  PID:6796
- C:\Windows\System\sJLEAZa.exe
  C:\Windows\System\sJLEAZa.exe
  2⤵
  PID:6932
- C:\Windows\System\CQfBQyL.exe
  C:\Windows\System\CQfBQyL.exe
  2⤵
  PID:6924
- C:\Windows\System\quFAeif.exe
  C:\Windows\System\quFAeif.exe
  2⤵
  PID:6984
- C:\Windows\System\xuLyipX.exe
  C:\Windows\System\xuLyipX.exe
  2⤵
  PID:7016
- C:\Windows\System\InMyWBT.exe
  C:\Windows\System\InMyWBT.exe
  2⤵
  PID:7084
- C:\Windows\System\lnZIhpa.exe
  C:\Windows\System\lnZIhpa.exe
  2⤵
  PID:7164
- C:\Windows\System\xRnracT.exe
  C:\Windows\System\xRnracT.exe
  2⤵
  PID:6224
- C:\Windows\System\QtrhnPG.exe
  C:\Windows\System\QtrhnPG.exe
  2⤵
  PID:6264
- C:\Windows\System\MFBLRpM.exe
  C:\Windows\System\MFBLRpM.exe
  2⤵
  PID:6436
- C:\Windows\System\iqQDJgE.exe
  C:\Windows\System\iqQDJgE.exe
  2⤵
  PID:4984
- C:\Windows\System\LRhxcnW.exe
  C:\Windows\System\LRhxcnW.exe
  2⤵
  PID:4032
- C:\Windows\System\eVQlQpr.exe
  C:\Windows\System\eVQlQpr.exe
  2⤵
  PID:4248
- C:\Windows\System\jaYkOsk.exe
  C:\Windows\System\jaYkOsk.exe
  2⤵
  PID:6172
- C:\Windows\System\PHsPlUp.exe
  C:\Windows\System\PHsPlUp.exe
  2⤵
  PID:6316
- C:\Windows\System\ygTdYpo.exe
  C:\Windows\System\ygTdYpo.exe
  2⤵
  PID:4688
- C:\Windows\System\dqXQvXz.exe
  C:\Windows\System\dqXQvXz.exe
  2⤵
  PID:7128
- C:\Windows\System\JxNvkhg.exe
  C:\Windows\System\JxNvkhg.exe
  2⤵
  PID:7184
- C:\Windows\System\LdMYHzE.exe
  C:\Windows\System\LdMYHzE.exe
  2⤵
  PID:7204
- C:\Windows\System\UDXIHzJ.exe
  C:\Windows\System\UDXIHzJ.exe
  2⤵
  PID:7228
- C:\Windows\System\XGmLWIE.exe
  C:\Windows\System\XGmLWIE.exe
  2⤵
  PID:7288
- C:\Windows\System\ZeInSIc.exe
  C:\Windows\System\ZeInSIc.exe
  2⤵
  PID:7308
- C:\Windows\System\BAcjBmf.exe
  C:\Windows\System\BAcjBmf.exe
  2⤵
  PID:7324
- C:\Windows\System\SdVhuVr.exe
  C:\Windows\System\SdVhuVr.exe
  2⤵
  PID:7364
- C:\Windows\System\ddoSjvG.exe
  C:\Windows\System\ddoSjvG.exe
  2⤵
  PID:7404
- C:\Windows\System\yOOVLNk.exe
  C:\Windows\System\yOOVLNk.exe
  2⤵
  PID:7448
- C:\Windows\System\aweeJai.exe
  C:\Windows\System\aweeJai.exe
  2⤵
  PID:7468
- C:\Windows\System\EsRdUiZ.exe
  C:\Windows\System\EsRdUiZ.exe
  2⤵
  PID:7488
- C:\Windows\System\otvnObh.exe
  C:\Windows\System\otvnObh.exe
  2⤵
  PID:7504
- C:\Windows\System\tBwmeWT.exe
  C:\Windows\System\tBwmeWT.exe
  2⤵
  PID:7532
- C:\Windows\System\sDTdMJY.exe
  C:\Windows\System\sDTdMJY.exe
  2⤵
  PID:7548
- C:\Windows\System\FrxvdIQ.exe
  C:\Windows\System\FrxvdIQ.exe
  2⤵
  PID:7564
- C:\Windows\System\rUmnzPZ.exe
  C:\Windows\System\rUmnzPZ.exe
  2⤵
  PID:7584
- C:\Windows\System\lVPVlfv.exe
  C:\Windows\System\lVPVlfv.exe
  2⤵
  PID:7604
- C:\Windows\System\twEOBSr.exe
  C:\Windows\System\twEOBSr.exe
  2⤵
  PID:7672
- C:\Windows\System\fbAaMTi.exe
  C:\Windows\System\fbAaMTi.exe
  2⤵
  PID:7708
- C:\Windows\System\MXEPHyf.exe
  C:\Windows\System\MXEPHyf.exe
  2⤵
  PID:7724
- C:\Windows\System\XtubHkR.exe
  C:\Windows\System\XtubHkR.exe
  2⤵
  PID:7768
- C:\Windows\System\TLKKBre.exe
  C:\Windows\System\TLKKBre.exe
  2⤵
  PID:7788
- C:\Windows\System\dvAfpEJ.exe
  C:\Windows\System\dvAfpEJ.exe
  2⤵
  PID:7816
- C:\Windows\System\rHJHWKs.exe
  C:\Windows\System\rHJHWKs.exe
  2⤵
  PID:7848
- C:\Windows\System\BekCqIU.exe
  C:\Windows\System\BekCqIU.exe
  2⤵
  PID:7868
- C:\Windows\System\gQxNADV.exe
  C:\Windows\System\gQxNADV.exe
  2⤵
  PID:7912
- C:\Windows\System\WaCBRSq.exe
  C:\Windows\System\WaCBRSq.exe
  2⤵
  PID:7932
- C:\Windows\System\WidWStY.exe
  C:\Windows\System\WidWStY.exe
  2⤵
  PID:7956
- C:\Windows\System\LGmTWcN.exe
  C:\Windows\System\LGmTWcN.exe
  2⤵
  PID:7992
- C:\Windows\System\XVqsAVc.exe
  C:\Windows\System\XVqsAVc.exe
  2⤵
  PID:8040
- C:\Windows\System\sEILSgs.exe
  C:\Windows\System\sEILSgs.exe
  2⤵
  PID:8064
- C:\Windows\System\cjXCwwV.exe
  C:\Windows\System\cjXCwwV.exe
  2⤵
  PID:8080
- C:\Windows\System\ofImICK.exe
  C:\Windows\System\ofImICK.exe
  2⤵
  PID:8104
- C:\Windows\System\mIexDhn.exe
  C:\Windows\System\mIexDhn.exe
  2⤵
  PID:8120
- C:\Windows\System\iOiWwwx.exe
  C:\Windows\System\iOiWwwx.exe
  2⤵
  PID:8140
- C:\Windows\System\toImaAK.exe
  C:\Windows\System\toImaAK.exe
  2⤵
  PID:8164
- C:\Windows\System\lRiYzip.exe
  C:\Windows\System\lRiYzip.exe
  2⤵
  PID:6276
- C:\Windows\System\ugvhakq.exe
  C:\Windows\System\ugvhakq.exe
  2⤵
  PID:6632
- C:\Windows\System\rnAbVMl.exe
  C:\Windows\System\rnAbVMl.exe
  2⤵
  PID:7304
- C:\Windows\System\BHPaukC.exe
  C:\Windows\System\BHPaukC.exe
  2⤵
  PID:7384
- C:\Windows\System\swvzUYM.exe
  C:\Windows\System\swvzUYM.exe
  2⤵
  PID:7432
- C:\Windows\System\eFqcRCs.exe
  C:\Windows\System\eFqcRCs.exe
  2⤵
  PID:7456
- C:\Windows\System\JpPgyxE.exe
  C:\Windows\System\JpPgyxE.exe
  2⤵
  PID:7576
- C:\Windows\System\YKFBgQs.exe
  C:\Windows\System\YKFBgQs.exe
  2⤵
  PID:7720
- C:\Windows\System\PIqkHsl.exe
  C:\Windows\System\PIqkHsl.exe
  2⤵
  PID:7760
- C:\Windows\System\VjKfISV.exe
  C:\Windows\System\VjKfISV.exe
  2⤵
  PID:7828
- C:\Windows\System\FNJDygn.exe
  C:\Windows\System\FNJDygn.exe
  2⤵
  PID:7860
- C:\Windows\System\WuxQbOm.exe
  C:\Windows\System\WuxQbOm.exe
  2⤵
  PID:7976
- C:\Windows\System\jNTwrMB.exe
  C:\Windows\System\jNTwrMB.exe
  2⤵
  PID:8008
- C:\Windows\System\XiiuDdI.exe
  C:\Windows\System\XiiuDdI.exe
  2⤵
  PID:8132
- C:\Windows\System\lpuTETi.exe
  C:\Windows\System\lpuTETi.exe
  2⤵
  PID:8172
- C:\Windows\System\qaMpDuF.exe
  C:\Windows\System\qaMpDuF.exe
  2⤵
  PID:7256
- C:\Windows\System\hmqyNLo.exe
  C:\Windows\System\hmqyNLo.exe
  2⤵
  PID:7296
- C:\Windows\System\sLCeWnC.exe
  C:\Windows\System\sLCeWnC.exe
  2⤵
  PID:7400
- C:\Windows\System\WtQswkC.exe
  C:\Windows\System\WtQswkC.exe
  2⤵
  PID:7484
- C:\Windows\System\xqKjnOF.exe
  C:\Windows\System\xqKjnOF.exe
  2⤵
  PID:7656
- C:\Windows\System\oLIzNkk.exe
  C:\Windows\System\oLIzNkk.exe
  2⤵
  PID:7716
- C:\Windows\System\xTAWAku.exe
  C:\Windows\System\xTAWAku.exe
  2⤵
  PID:7840
- C:\Windows\System\EDlXbzi.exe
  C:\Windows\System\EDlXbzi.exe
  2⤵
  PID:8024
- C:\Windows\System\AYyqhYP.exe
  C:\Windows\System\AYyqhYP.exe
  2⤵
  PID:7700
- C:\Windows\System\jmKwIkS.exe
  C:\Windows\System\jmKwIkS.exe
  2⤵
  PID:7440
- C:\Windows\System\JrJqMpO.exe
  C:\Windows\System\JrJqMpO.exe
  2⤵
  PID:7780
- C:\Windows\System\cbgSPrB.exe
  C:\Windows\System\cbgSPrB.exe
  2⤵
  PID:8208
- C:\Windows\System\MKNrMOT.exe
  C:\Windows\System\MKNrMOT.exe
  2⤵
  PID:8228
- C:\Windows\System\uvYZpJj.exe
  C:\Windows\System\uvYZpJj.exe
  2⤵
  PID:8248
- C:\Windows\System\zcwDXDA.exe
  C:\Windows\System\zcwDXDA.exe
  2⤵
  PID:8312
- C:\Windows\System\fkSJvNd.exe
  C:\Windows\System\fkSJvNd.exe
  2⤵
  PID:8332
- C:\Windows\System\FODnflw.exe
  C:\Windows\System\FODnflw.exe
  2⤵
  PID:8364
- C:\Windows\System\FZUNYHG.exe
  C:\Windows\System\FZUNYHG.exe
  2⤵
  PID:8396
- C:\Windows\System\UneOzVY.exe
  C:\Windows\System\UneOzVY.exe
  2⤵
  PID:8416
- C:\Windows\System\vvpwCJD.exe
  C:\Windows\System\vvpwCJD.exe
  2⤵
  PID:8444
- C:\Windows\System\bkSbmAL.exe
  C:\Windows\System\bkSbmAL.exe
  2⤵
  PID:8464
- C:\Windows\System\KdrgwiR.exe
  C:\Windows\System\KdrgwiR.exe
  2⤵
  PID:8480
- C:\Windows\System\KSxbErL.exe
  C:\Windows\System\KSxbErL.exe
  2⤵
  PID:8500
- C:\Windows\System\cFyDwSp.exe
  C:\Windows\System\cFyDwSp.exe
  2⤵
  PID:8552
- C:\Windows\System\YytiIjP.exe
  C:\Windows\System\YytiIjP.exe
  2⤵
  PID:8584
- C:\Windows\System\eCoGrxW.exe
  C:\Windows\System\eCoGrxW.exe
  2⤵
  PID:8608
- C:\Windows\System\Qicgnpo.exe
  C:\Windows\System\Qicgnpo.exe
  2⤵
  PID:8648
- C:\Windows\System\PdoWNVZ.exe
  C:\Windows\System\PdoWNVZ.exe
  2⤵
  PID:8676
- C:\Windows\System\MqsKxBb.exe
  C:\Windows\System\MqsKxBb.exe
  2⤵
  PID:8720
- C:\Windows\System\imGIJfm.exe
  C:\Windows\System\imGIJfm.exe
  2⤵
  PID:8748
- C:\Windows\System\VmWlPSI.exe
  C:\Windows\System\VmWlPSI.exe
  2⤵
  PID:8796
- C:\Windows\System\YqbnkUo.exe
  C:\Windows\System\YqbnkUo.exe
  2⤵
  PID:8812
- C:\Windows\System\NZbrdGr.exe
  C:\Windows\System\NZbrdGr.exe
  2⤵
  PID:8828
- C:\Windows\System\ZLKNhWm.exe
  C:\Windows\System\ZLKNhWm.exe
  2⤵
  PID:8844
- C:\Windows\System\qgwgakX.exe
  C:\Windows\System\qgwgakX.exe
  2⤵
  PID:8860
- C:\Windows\System\MTkredR.exe
  C:\Windows\System\MTkredR.exe
  2⤵
  PID:8884
- C:\Windows\System\wawUzfA.exe
  C:\Windows\System\wawUzfA.exe
  2⤵
  PID:8904
- C:\Windows\System\JtAaUVn.exe
  C:\Windows\System\JtAaUVn.exe
  2⤵
  PID:8920
- C:\Windows\System\bUiFRjO.exe
  C:\Windows\System\bUiFRjO.exe
  2⤵
  PID:8936
- C:\Windows\System\voqOExz.exe
  C:\Windows\System\voqOExz.exe
  2⤵
  PID:8960
- C:\Windows\System\DiSWjto.exe
  C:\Windows\System\DiSWjto.exe
  2⤵
  PID:9004
- C:\Windows\System\KuQcwuo.exe
  C:\Windows\System\KuQcwuo.exe
  2⤵
  PID:9020
- C:\Windows\System\LYFBWyF.exe
  C:\Windows\System\LYFBWyF.exe
  2⤵
  PID:9108
- C:\Windows\System\vpHNeCr.exe
  C:\Windows\System\vpHNeCr.exe
  2⤵
  PID:9132
- C:\Windows\System\BGXQLXv.exe
  C:\Windows\System\BGXQLXv.exe
  2⤵
  PID:9184
- C:\Windows\System\cALHDLQ.exe
  C:\Windows\System\cALHDLQ.exe
  2⤵
  PID:8240
- C:\Windows\System\dvVbuLz.exe
  C:\Windows\System\dvVbuLz.exe
  2⤵
  PID:7808
- C:\Windows\System\vlfhvKg.exe
  C:\Windows\System\vlfhvKg.exe
  2⤵
  PID:8264
- C:\Windows\System\kuKfkkY.exe
  C:\Windows\System\kuKfkkY.exe
  2⤵
  PID:8328
- C:\Windows\System\TUUkkaB.exe
  C:\Windows\System\TUUkkaB.exe
  2⤵
  PID:8392
- C:\Windows\System\oVpopFb.exe
  C:\Windows\System\oVpopFb.exe
  2⤵
  PID:8412
- C:\Windows\System\ierEZRp.exe
  C:\Windows\System\ierEZRp.exe
  2⤵
  PID:8492
- C:\Windows\System\zItzGPc.exe
  C:\Windows\System\zItzGPc.exe
  2⤵
  PID:8460
- C:\Windows\System\oGtPfIi.exe
  C:\Windows\System\oGtPfIi.exe
  2⤵
  PID:8688
- C:\Windows\System\bOrSurX.exe
  C:\Windows\System\bOrSurX.exe
  2⤵
  PID:8640
- C:\Windows\System\BjkKjHU.exe
  C:\Windows\System\BjkKjHU.exe
  2⤵
  PID:8716
- C:\Windows\System\brrrpdr.exe
  C:\Windows\System\brrrpdr.exe
  2⤵
  PID:8696
- C:\Windows\System\SHHjcNW.exe
  C:\Windows\System\SHHjcNW.exe
  2⤵
  PID:8820
- C:\Windows\System\nRRsmjx.exe
  C:\Windows\System\nRRsmjx.exe
  2⤵
  PID:8916
- C:\Windows\System\LNNcocj.exe
  C:\Windows\System\LNNcocj.exe
  2⤵
  PID:9076
- C:\Windows\System\lbhOIkw.exe
  C:\Windows\System\lbhOIkw.exe
  2⤵
  PID:9068
- C:\Windows\System\TuISyyI.exe
  C:\Windows\System\TuISyyI.exe
  2⤵
  PID:9128
- C:\Windows\System\mVkUNKx.exe
  C:\Windows\System\mVkUNKx.exe
  2⤵
  PID:7052
- C:\Windows\System\DoTeLDz.exe
  C:\Windows\System\DoTeLDz.exe
  2⤵
  PID:8432
- C:\Windows\System\MicBGZD.exe
  C:\Windows\System\MicBGZD.exe
  2⤵
  PID:8620
- C:\Windows\System\UActuKX.exe
  C:\Windows\System\UActuKX.exe
  2⤵
  PID:8592
- C:\Windows\System\vWAkZmJ.exe
  C:\Windows\System\vWAkZmJ.exe
  2⤵
  PID:8932
- C:\Windows\System\rFnoBbF.exe
  C:\Windows\System\rFnoBbF.exe
  2⤵
  PID:8836
- C:\Windows\System\OjFscOH.exe
  C:\Windows\System\OjFscOH.exe
  2⤵
  PID:8876
- C:\Windows\System\RZBMPdg.exe
  C:\Windows\System\RZBMPdg.exe
  2⤵
  PID:9080
- C:\Windows\System\RZeiyQB.exe
  C:\Windows\System\RZeiyQB.exe
  2⤵
  PID:8296
- C:\Windows\System\RiJUUIE.exe
  C:\Windows\System\RiJUUIE.exe
  2⤵
  PID:8644
- C:\Windows\System\jwaUFuv.exe
  C:\Windows\System\jwaUFuv.exe
  2⤵
  PID:8732
- C:\Windows\System\RkIhzZz.exe
  C:\Windows\System\RkIhzZz.exe
  2⤵
  PID:8988
- C:\Windows\System\DBeRlDy.exe
  C:\Windows\System\DBeRlDy.exe
  2⤵
  PID:8704
- C:\Windows\System\rbkEUwq.exe
  C:\Windows\System\rbkEUwq.exe
  2⤵
  PID:9232
- C:\Windows\System\nYUvquV.exe
  C:\Windows\System\nYUvquV.exe
  2⤵
  PID:9256
- C:\Windows\System\JFilwUt.exe
  C:\Windows\System\JFilwUt.exe
  2⤵
  PID:9304
- C:\Windows\System\EbiMdCA.exe
  C:\Windows\System\EbiMdCA.exe
  2⤵
  PID:9332
- C:\Windows\System\tyNGwHi.exe
  C:\Windows\System\tyNGwHi.exe
  2⤵
  PID:9364
- C:\Windows\System\xTSRaBw.exe
  C:\Windows\System\xTSRaBw.exe
  2⤵
  PID:9384
- C:\Windows\System\BwganrC.exe
  C:\Windows\System\BwganrC.exe
  2⤵
  PID:9404
- C:\Windows\System\ZBMhPku.exe
  C:\Windows\System\ZBMhPku.exe
  2⤵
  PID:9424
- C:\Windows\System\ZrXjSrP.exe
  C:\Windows\System\ZrXjSrP.exe
  2⤵
  PID:9472
- C:\Windows\System\VusTaSy.exe
  C:\Windows\System\VusTaSy.exe
  2⤵
  PID:9496
- C:\Windows\System\mZOVlip.exe
  C:\Windows\System\mZOVlip.exe
  2⤵
  PID:9512
- C:\Windows\System\MoHBSng.exe
  C:\Windows\System\MoHBSng.exe
  2⤵
  PID:9544
- C:\Windows\System\DsXNWDK.exe
  C:\Windows\System\DsXNWDK.exe
  2⤵
  PID:9576
- C:\Windows\System\yDGHByC.exe
  C:\Windows\System\yDGHByC.exe
  2⤵
  PID:9592
- C:\Windows\System\tWVtyQE.exe
  C:\Windows\System\tWVtyQE.exe
  2⤵
  PID:9624
- C:\Windows\System\HfVjoWz.exe
  C:\Windows\System\HfVjoWz.exe
  2⤵
  PID:9644
- C:\Windows\System\BzmoIwr.exe
  C:\Windows\System\BzmoIwr.exe
  2⤵
  PID:9712
- C:\Windows\System\FnfOTbM.exe
  C:\Windows\System\FnfOTbM.exe
  2⤵
  PID:9732
- C:\Windows\System\JbCpDtd.exe
  C:\Windows\System\JbCpDtd.exe
  2⤵
  PID:9776
- C:\Windows\System\utnuAhJ.exe
  C:\Windows\System\utnuAhJ.exe
  2⤵
  PID:9792
- C:\Windows\System\gzyMCFA.exe
  C:\Windows\System\gzyMCFA.exe
  2⤵
  PID:9832
- C:\Windows\System\InnoaNv.exe
  C:\Windows\System\InnoaNv.exe
  2⤵
  PID:9860
- C:\Windows\System\zYaGtxY.exe
  C:\Windows\System\zYaGtxY.exe
  2⤵
  PID:9876
- C:\Windows\System\EMhypun.exe
  C:\Windows\System\EMhypun.exe
  2⤵
  PID:9912
- C:\Windows\System\YfOaDhk.exe
  C:\Windows\System\YfOaDhk.exe
  2⤵
  PID:9948
- C:\Windows\System\oEbFsJO.exe
  C:\Windows\System\oEbFsJO.exe
  2⤵
  PID:9980
- C:\Windows\System\vqvtYyd.exe
  C:\Windows\System\vqvtYyd.exe
  2⤵
  PID:10016
- C:\Windows\System\UENSdSv.exe
  C:\Windows\System\UENSdSv.exe
  2⤵
  PID:10032
- C:\Windows\System\vtGTVsu.exe
  C:\Windows\System\vtGTVsu.exe
  2⤵
  PID:10060
- C:\Windows\System\NPhsjYI.exe
  C:\Windows\System\NPhsjYI.exe
  2⤵
  PID:10088
- C:\Windows\System\YquYkaG.exe
  C:\Windows\System\YquYkaG.exe
  2⤵
  PID:10108
- C:\Windows\System\RSYqBYL.exe
  C:\Windows\System\RSYqBYL.exe
  2⤵
  PID:10128
- C:\Windows\System\zwMLtSy.exe
  C:\Windows\System\zwMLtSy.exe
  2⤵
  PID:10148
- C:\Windows\System\SPHtkTY.exe
  C:\Windows\System\SPHtkTY.exe
  2⤵
  PID:10168
- C:\Windows\System\trXOOcm.exe
  C:\Windows\System\trXOOcm.exe
  2⤵
  PID:10188
- C:\Windows\System\cXWmIjz.exe
  C:\Windows\System\cXWmIjz.exe
  2⤵
  PID:10228
- C:\Windows\System\vLoAPkZ.exe
  C:\Windows\System\vLoAPkZ.exe
  2⤵
  PID:9252
- C:\Windows\System\oxGRZYn.exe
  C:\Windows\System\oxGRZYn.exe
  2⤵
  PID:9224
- C:\Windows\System\cmarmyF.exe
  C:\Windows\System\cmarmyF.exe
  2⤵
  PID:9440
- C:\Windows\System\FcIfBHT.exe
  C:\Windows\System\FcIfBHT.exe
  2⤵
  PID:9380
- C:\Windows\System\nlYnNZB.exe
  C:\Windows\System\nlYnNZB.exe
  2⤵
  PID:9416
- C:\Windows\System\obbDLzE.exe
  C:\Windows\System\obbDLzE.exe
  2⤵
  PID:9508
- C:\Windows\System\hYtQBDp.exe
  C:\Windows\System\hYtQBDp.exe
  2⤵
  PID:9684
- C:\Windows\System\RKNxhCi.exe
  C:\Windows\System\RKNxhCi.exe
  2⤵
  PID:9764
- C:\Windows\System\fcSchWq.exe
  C:\Windows\System\fcSchWq.exe
  2⤵
  PID:9788
- C:\Windows\System\UtejiaC.exe
  C:\Windows\System\UtejiaC.exe
  2⤵
  PID:9872
- C:\Windows\System\NIwmHuR.exe
  C:\Windows\System\NIwmHuR.exe
  2⤵
  PID:9908
- C:\Windows\System\sGhddYu.exe
  C:\Windows\System\sGhddYu.exe
  2⤵
  PID:9936
- C:\Windows\System\SFjuxHK.exe
  C:\Windows\System\SFjuxHK.exe
  2⤵
  PID:9992
- C:\Windows\System\nDqfdvb.exe
  C:\Windows\System\nDqfdvb.exe
  2⤵
  PID:10028
- C:\Windows\System\gTrNwWc.exe
  C:\Windows\System\gTrNwWc.exe
  2⤵
  PID:10080
- C:\Windows\System\yvLECGi.exe
  C:\Windows\System\yvLECGi.exe
  2⤵
  PID:10204
- C:\Windows\System\RsYEvxH.exe
  C:\Windows\System\RsYEvxH.exe
  2⤵
  PID:10220
- C:\Windows\System\fnpfJfV.exe
  C:\Windows\System\fnpfJfV.exe
  2⤵
  PID:9312
- C:\Windows\System\rEGYoNx.exe
  C:\Windows\System\rEGYoNx.exe
  2⤵
  PID:3252
- C:\Windows\System\FqluoGW.exe
  C:\Windows\System\FqluoGW.exe
  2⤵
  PID:9612
- C:\Windows\System\elxpRwR.exe
  C:\Windows\System\elxpRwR.exe
  2⤵
  PID:9928
- C:\Windows\System\yeEdWaa.exe
  C:\Windows\System\yeEdWaa.exe
  2⤵
  PID:9968
- C:\Windows\System\XodLVgZ.exe
  C:\Windows\System\XodLVgZ.exe
  2⤵
  PID:10056
- C:\Windows\System\qEyhQqI.exe
  C:\Windows\System\qEyhQqI.exe
  2⤵
  PID:9412
- C:\Windows\System\JtNUdds.exe
  C:\Windows\System\JtNUdds.exe
  2⤵
  PID:9540
- C:\Windows\System\kxIhZiL.exe
  C:\Windows\System\kxIhZiL.exe
  2⤵
  PID:10140
- C:\Windows\System\XMSQPXN.exe
  C:\Windows\System\XMSQPXN.exe
  2⤵
  PID:9144
- C:\Windows\System\nqMLSpA.exe
  C:\Windows\System\nqMLSpA.exe
  2⤵
  PID:10248
- C:\Windows\System\DoabxXL.exe
  C:\Windows\System\DoabxXL.exe
  2⤵
  PID:10308
- C:\Windows\System\VVKCiyB.exe
  C:\Windows\System\VVKCiyB.exe
  2⤵
  PID:10332
- C:\Windows\System\YDGHLyn.exe
  C:\Windows\System\YDGHLyn.exe
  2⤵
  PID:10356
- C:\Windows\System\KjCOjgZ.exe
  C:\Windows\System\KjCOjgZ.exe
  2⤵
  PID:10372
- C:\Windows\System\vcYLCtq.exe
  C:\Windows\System\vcYLCtq.exe
  2⤵
  PID:10392
- C:\Windows\System\pIzAxsA.exe
  C:\Windows\System\pIzAxsA.exe
  2⤵
  PID:10420
- C:\Windows\System\QhsjvzU.exe
  C:\Windows\System\QhsjvzU.exe
  2⤵
  PID:10476
- C:\Windows\System\iifgsYe.exe
  C:\Windows\System\iifgsYe.exe
  2⤵
  PID:10500
- C:\Windows\System\MqTxhkQ.exe
  C:\Windows\System\MqTxhkQ.exe
  2⤵
  PID:10536
- C:\Windows\System\pDeOXYr.exe
  C:\Windows\System\pDeOXYr.exe
  2⤵
  PID:10552
- C:\Windows\System\LOLwpsS.exe
  C:\Windows\System\LOLwpsS.exe
  2⤵
  PID:10576
- C:\Windows\System\enaFHhN.exe
  C:\Windows\System\enaFHhN.exe
  2⤵
  PID:10592
- C:\Windows\System\SykSthm.exe
  C:\Windows\System\SykSthm.exe
  2⤵
  PID:10616
- C:\Windows\System\BNUKJgZ.exe
  C:\Windows\System\BNUKJgZ.exe
  2⤵
  PID:10632
- C:\Windows\System\jseDtIZ.exe
  C:\Windows\System\jseDtIZ.exe
  2⤵
  PID:10656
- C:\Windows\System\FObtRbX.exe
  C:\Windows\System\FObtRbX.exe
  2⤵
  PID:10712
- C:\Windows\System\htZnTzQ.exe
  C:\Windows\System\htZnTzQ.exe
  2⤵
  PID:10752
- C:\Windows\System\sGZNHTS.exe
  C:\Windows\System\sGZNHTS.exe
  2⤵
  PID:10772
- C:\Windows\System\NIMbkjA.exe
  C:\Windows\System\NIMbkjA.exe
  2⤵
  PID:10800
- C:\Windows\System\dwhhFOz.exe
  C:\Windows\System\dwhhFOz.exe
  2⤵
  PID:10824
- C:\Windows\System\LXhEonL.exe
  C:\Windows\System\LXhEonL.exe
  2⤵
  PID:10844
- C:\Windows\System\rjemTGM.exe
  C:\Windows\System\rjemTGM.exe
  2⤵
  PID:10880
- C:\Windows\System\XUKzZtd.exe
  C:\Windows\System\XUKzZtd.exe
  2⤵
  PID:10896
- C:\Windows\System\RebYKIJ.exe
  C:\Windows\System\RebYKIJ.exe
  2⤵
  PID:10916
- C:\Windows\System\OEzOHEs.exe
  C:\Windows\System\OEzOHEs.exe
  2⤵
  PID:10940
- C:\Windows\System\rFrebQD.exe
  C:\Windows\System\rFrebQD.exe
  2⤵
  PID:10976
- C:\Windows\System\SvfNrNU.exe
  C:\Windows\System\SvfNrNU.exe
  2⤵
  PID:11016
- C:\Windows\System\WJSOITM.exe
  C:\Windows\System\WJSOITM.exe
  2⤵
  PID:11044
- C:\Windows\System\OtTEvHr.exe
  C:\Windows\System\OtTEvHr.exe
  2⤵
  PID:11092
- C:\Windows\System\soiPqNc.exe
  C:\Windows\System\soiPqNc.exe
  2⤵
  PID:11116
- C:\Windows\System\tzMbMGq.exe
  C:\Windows\System\tzMbMGq.exe
  2⤵
  PID:11132
- C:\Windows\System\PawiNys.exe
  C:\Windows\System\PawiNys.exe
  2⤵
  PID:11172
- C:\Windows\System\kHXAIIR.exe
  C:\Windows\System\kHXAIIR.exe
  2⤵
  PID:11192
- C:\Windows\System\RzgyGPg.exe
  C:\Windows\System\RzgyGPg.exe
  2⤵
  PID:11232
- C:\Windows\System\PCOHFbA.exe
  C:\Windows\System\PCOHFbA.exe
  2⤵
  PID:11260
- C:\Windows\System\dIZvaVA.exe
  C:\Windows\System\dIZvaVA.exe
  2⤵
  PID:8576
- C:\Windows\System\pUJykLg.exe
  C:\Windows\System\pUJykLg.exe
  2⤵
  PID:10288
- C:\Windows\System\RMkOZqF.exe
  C:\Windows\System\RMkOZqF.exe
  2⤵
  PID:10324
- C:\Windows\System\wCkytHq.exe
  C:\Windows\System\wCkytHq.exe
  2⤵
  PID:10364
- C:\Windows\System\NuOxztM.exe
  C:\Windows\System\NuOxztM.exe
  2⤵
  PID:10468
- C:\Windows\System\BuvjDrO.exe
  C:\Windows\System\BuvjDrO.exe
  2⤵
  PID:10508
- C:\Windows\System\wVlWFYS.exe
  C:\Windows\System\wVlWFYS.exe
  2⤵
  PID:10572
- C:\Windows\System\LDjofND.exe
  C:\Windows\System\LDjofND.exe
  2⤵
  PID:10604
- C:\Windows\System\gXqdQIV.exe
  C:\Windows\System\gXqdQIV.exe
  2⤵
  PID:10624
- C:\Windows\System\GfXZVqf.exe
  C:\Windows\System\GfXZVqf.exe
  2⤵
  PID:10768
- C:\Windows\System\FzIcKJJ.exe
  C:\Windows\System\FzIcKJJ.exe
  2⤵
  PID:10892
- C:\Windows\System\rLtZXxP.exe
  C:\Windows\System\rLtZXxP.exe
  2⤵
  PID:10876
- C:\Windows\System\nFAJFhG.exe
  C:\Windows\System\nFAJFhG.exe
  2⤵
  PID:11012
- C:\Windows\System\KqMCdkB.exe
  C:\Windows\System\KqMCdkB.exe
  2⤵
  PID:11144
- C:\Windows\System\QKyfbjx.exe
  C:\Windows\System\QKyfbjx.exe
  2⤵
  PID:11128
- C:\Windows\System\jJxKpBD.exe
  C:\Windows\System\jJxKpBD.exe
  2⤵
  PID:11180
- C:\Windows\System\LnFhGUD.exe
  C:\Windows\System\LnFhGUD.exe
  2⤵
  PID:10180
- C:\Windows\System\aIZnYHA.exe
  C:\Windows\System\aIZnYHA.exe
  2⤵
  PID:10532
- C:\Windows\System\UtdKvoz.exe
  C:\Windows\System\UtdKvoz.exe
  2⤵
  PID:10344
- C:\Windows\System\qYQrAJB.exe
  C:\Windows\System\qYQrAJB.exe
  2⤵
  PID:10436
- C:\Windows\System\qOXLFDZ.exe
  C:\Windows\System\qOXLFDZ.exe
  2⤵
  PID:10668
- C:\Windows\System\OjwwgMg.exe
  C:\Windows\System\OjwwgMg.exe
  2⤵
  PID:10932
- C:\Windows\System\FsfVdrg.exe
  C:\Windows\System\FsfVdrg.exe
  2⤵
  PID:11080
- C:\Windows\System\DXGouPm.exe
  C:\Windows\System\DXGouPm.exe
  2⤵
  PID:9808
- C:\Windows\System\cMMhseH.exe
  C:\Windows\System\cMMhseH.exe
  2⤵
  PID:10888
- C:\Windows\System\HaGRcHi.exe
  C:\Windows\System\HaGRcHi.exe
  2⤵
  PID:10748
- C:\Windows\System\KDAHvxv.exe
  C:\Windows\System\KDAHvxv.exe
  2⤵
  PID:10568
- C:\Windows\System\wPQUwtO.exe
  C:\Windows\System\wPQUwtO.exe
  2⤵
  PID:11292
- C:\Windows\System\TiZRdUE.exe
  C:\Windows\System\TiZRdUE.exe
  2⤵
  PID:11312
- C:\Windows\System\NFOhBZp.exe
  C:\Windows\System\NFOhBZp.exe
  2⤵
  PID:11328
- C:\Windows\System\iMZkmbT.exe
  C:\Windows\System\iMZkmbT.exe
  2⤵
  PID:11352
- C:\Windows\System\JuAucOe.exe
  C:\Windows\System\JuAucOe.exe
  2⤵
  PID:11368
- C:\Windows\System\tYQqYAx.exe
  C:\Windows\System\tYQqYAx.exe
  2⤵
  PID:11412
- C:\Windows\System\jQTPiAd.exe
  C:\Windows\System\jQTPiAd.exe
  2⤵
  PID:11428
- C:\Windows\System\PiihihF.exe
  C:\Windows\System\PiihihF.exe
  2⤵
  PID:11448
- C:\Windows\System\SJQYFYF.exe
  C:\Windows\System\SJQYFYF.exe
  2⤵
  PID:11468
- C:\Windows\System\SxuuulB.exe
  C:\Windows\System\SxuuulB.exe
  2⤵
  PID:11500
- C:\Windows\System\FTVQjgs.exe
  C:\Windows\System\FTVQjgs.exe
  2⤵
  PID:11520
- C:\Windows\System\dKZWarL.exe
  C:\Windows\System\dKZWarL.exe
  2⤵
  PID:11536
- C:\Windows\System\CsmEfFq.exe
  C:\Windows\System\CsmEfFq.exe
  2⤵
  PID:11560
- C:\Windows\System\GrwiQuO.exe
  C:\Windows\System\GrwiQuO.exe
  2⤵
  PID:11612
- C:\Windows\System\XXeQNij.exe
  C:\Windows\System\XXeQNij.exe
  2⤵
  PID:11628
- C:\Windows\System\prJqsxU.exe
  C:\Windows\System\prJqsxU.exe
  2⤵
  PID:11704
- C:\Windows\System\xhvSFsz.exe
  C:\Windows\System\xhvSFsz.exe
  2⤵
  PID:11732
- C:\Windows\System\XRgHIBa.exe
  C:\Windows\System\XRgHIBa.exe
  2⤵
  PID:11760
- C:\Windows\System\hNbLkfJ.exe
  C:\Windows\System\hNbLkfJ.exe
  2⤵
  PID:11780
- C:\Windows\System\XEYPUjn.exe
  C:\Windows\System\XEYPUjn.exe
  2⤵
  PID:11808
- C:\Windows\System\SfJahvI.exe
  C:\Windows\System\SfJahvI.exe
  2⤵
  PID:11848
- C:\Windows\System\sEaNkJg.exe
  C:\Windows\System\sEaNkJg.exe
  2⤵
  PID:11880
- C:\Windows\System\NWUcYJf.exe
  C:\Windows\System\NWUcYJf.exe
  2⤵
  PID:11900
- C:\Windows\System\IbOLqmQ.exe
  C:\Windows\System\IbOLqmQ.exe
  2⤵
  PID:11928
- C:\Windows\System\LjvAjls.exe
  C:\Windows\System\LjvAjls.exe
  2⤵
  PID:11952
- C:\Windows\System\KjVJXLp.exe
  C:\Windows\System\KjVJXLp.exe
  2⤵
  PID:11976
- C:\Windows\System\UKSHFBn.exe
  C:\Windows\System\UKSHFBn.exe
  2⤵
  PID:12000
- C:\Windows\System\yMmuqrO.exe
  C:\Windows\System\yMmuqrO.exe
  2⤵
  PID:12016
- C:\Windows\System\KsiKaOe.exe
  C:\Windows\System\KsiKaOe.exe
  2⤵
  PID:12036
- C:\Windows\System\hviiyDR.exe
  C:\Windows\System\hviiyDR.exe
  2⤵
  PID:12084
- C:\Windows\System\obzQmnO.exe
  C:\Windows\System\obzQmnO.exe
  2⤵
  PID:12120
- C:\Windows\System\QGRcghU.exe
  C:\Windows\System\QGRcghU.exe
  2⤵
  PID:12148
- C:\Windows\System\esqHmWn.exe
  C:\Windows\System\esqHmWn.exe
  2⤵
  PID:12180
- C:\Windows\System\tpbCmZP.exe
  C:\Windows\System\tpbCmZP.exe
  2⤵
  PID:12200
- C:\Windows\System\WGgupmR.exe
  C:\Windows\System\WGgupmR.exe
  2⤵
  PID:12220
- C:\Windows\System\Yulmdoh.exe
  C:\Windows\System\Yulmdoh.exe
  2⤵
  PID:12244
- C:\Windows\System\KxcZudr.exe
  C:\Windows\System\KxcZudr.exe
  2⤵
  PID:12260
- C:\Windows\System\LVmWCjI.exe
  C:\Windows\System\LVmWCjI.exe
  2⤵
  PID:12280
- C:\Windows\System\zYWMeSl.exe
  C:\Windows\System\zYWMeSl.exe
  2⤵
  PID:11288
- C:\Windows\System\LgMHNjH.exe
  C:\Windows\System\LgMHNjH.exe
  2⤵
  PID:11424
- C:\Windows\System\wlLIZQd.exe
  C:\Windows\System\wlLIZQd.exe
  2⤵
  PID:11420
- C:\Windows\System\MbVLJAg.exe
  C:\Windows\System\MbVLJAg.exe
  2⤵
  PID:11516
- C:\Windows\System\kmsRxoD.exe
  C:\Windows\System\kmsRxoD.exe
  2⤵
  PID:11672
- C:\Windows\System\DmIZEae.exe
  C:\Windows\System\DmIZEae.exe
  2⤵
  PID:11744
- C:\Windows\System\OzrFfxO.exe
  C:\Windows\System\OzrFfxO.exe
  2⤵
  PID:11752
- C:\Windows\System\kNJjOgw.exe
  C:\Windows\System\kNJjOgw.exe
  2⤵
  PID:11820
- C:\Windows\System\zpZexCu.exe
  C:\Windows\System\zpZexCu.exe
  2⤵
  PID:11872
- C:\Windows\System\QWIwtXw.exe
  C:\Windows\System\QWIwtXw.exe
  2⤵
  PID:11992
- C:\Windows\System\cVKzAHS.exe
  C:\Windows\System\cVKzAHS.exe
  2⤵
  PID:11060
- C:\Windows\System\mGMBzor.exe
  C:\Windows\System\mGMBzor.exe
  2⤵
  PID:12056
- C:\Windows\System\jUHToYl.exe
  C:\Windows\System\jUHToYl.exe
  2⤵
  PID:12100
- C:\Windows\System\BfzAGbB.exe
  C:\Windows\System\BfzAGbB.exe
  2⤵
  PID:12196
- C:\Windows\System\XABoBaz.exe
  C:\Windows\System\XABoBaz.exe
  2⤵
  PID:12272
- C:\Windows\System\pHpZVpd.exe
  C:\Windows\System\pHpZVpd.exe
  2⤵
  PID:11436
- C:\Windows\System\tiKgLts.exe
  C:\Windows\System\tiKgLts.exe
  2⤵
  PID:11348
- C:\Windows\System\prCbYDe.exe
  C:\Windows\System\prCbYDe.exe
  2⤵
  PID:11756
- C:\Windows\System\fBmCoGj.exe
  C:\Windows\System\fBmCoGj.exe
  2⤵
  PID:11712
- C:\Windows\System\uUZoTgy.exe
  C:\Windows\System\uUZoTgy.exe
  2⤵
  PID:12028
- C:\Windows\System\IxGYGPo.exe
  C:\Windows\System\IxGYGPo.exe
  2⤵
  PID:12092
- C:\Windows\System\XkDNqxY.exe
  C:\Windows\System\XkDNqxY.exe
  2⤵
  PID:11344
- C:\Windows\System\HDWbPYW.exe
  C:\Windows\System\HDWbPYW.exe
  2⤵
  PID:11648
- C:\Windows\System\IsoKYtO.exe
  C:\Windows\System\IsoKYtO.exe
  2⤵
  PID:11800
- C:\Windows\System\RtSVfNS.exe
  C:\Windows\System\RtSVfNS.exe
  2⤵
  PID:12048
- C:\Windows\System\MRyGROr.exe
  C:\Windows\System\MRyGROr.exe
  2⤵
  PID:11496
- C:\Windows\System\HVyDCAp.exe
  C:\Windows\System\HVyDCAp.exe
  2⤵
  PID:12304
- C:\Windows\System\ZIXnQPG.exe
  C:\Windows\System\ZIXnQPG.exe
  2⤵
  PID:12348
- C:\Windows\System\XegfYSG.exe
  C:\Windows\System\XegfYSG.exe
  2⤵
  PID:12368
- C:\Windows\System\aSPLoAE.exe
  C:\Windows\System\aSPLoAE.exe
  2⤵
  PID:12384
- C:\Windows\System\TakbNtY.exe
  C:\Windows\System\TakbNtY.exe
  2⤵
  PID:12428
- C:\Windows\System\WJsbkuV.exe
  C:\Windows\System\WJsbkuV.exe
  2⤵
  PID:12460
- C:\Windows\System\XjHuzct.exe
  C:\Windows\System\XjHuzct.exe
  2⤵
  PID:12488
- C:\Windows\System\hcnwzFh.exe
  C:\Windows\System\hcnwzFh.exe
  2⤵
  PID:12512
- C:\Windows\System\Hzgsouz.exe
  C:\Windows\System\Hzgsouz.exe
  2⤵
  PID:12544
- C:\Windows\System\RzxkxGR.exe
  C:\Windows\System\RzxkxGR.exe
  2⤵
  PID:12576
- C:\Windows\System\CoVVAid.exe
  C:\Windows\System\CoVVAid.exe
  2⤵
  PID:12592
- C:\Windows\System\ksrpyvU.exe
  C:\Windows\System\ksrpyvU.exe
  2⤵
  PID:12616
- C:\Windows\System\OGvKZdD.exe
  C:\Windows\System\OGvKZdD.exe
  2⤵
  PID:12644
- C:\Windows\System\XDMNXer.exe
  C:\Windows\System\XDMNXer.exe
  2⤵
  PID:12660
- C:\Windows\System\ombFGFf.exe
  C:\Windows\System\ombFGFf.exe
  2⤵
  PID:12692
- C:\Windows\System\uzEoDoc.exe
  C:\Windows\System\uzEoDoc.exe
  2⤵
  PID:12748
- C:\Windows\System\KYwojlb.exe
  C:\Windows\System\KYwojlb.exe
  2⤵
  PID:12764
- C:\Windows\System\jiKRMEG.exe
  C:\Windows\System\jiKRMEG.exe
  2⤵
  PID:12796
- C:\Windows\System\LZTqZjH.exe
  C:\Windows\System\LZTqZjH.exe
  2⤵
  PID:12828
- C:\Windows\System\ZhDxqDe.exe
  C:\Windows\System\ZhDxqDe.exe
  2⤵
  PID:12844
- C:\Windows\System\MBMkEZU.exe
  C:\Windows\System\MBMkEZU.exe
  2⤵
  PID:12864
- C:\Windows\System\phdPjAi.exe
  C:\Windows\System\phdPjAi.exe
  2⤵
  PID:12884
- C:\Windows\System\DwTrRMK.exe
  C:\Windows\System\DwTrRMK.exe
  2⤵
  PID:12916
- C:\Windows\System\uXJNhxE.exe
  C:\Windows\System\uXJNhxE.exe
  2⤵
  PID:12944
- C:\Windows\System\ewfkKqp.exe
  C:\Windows\System\ewfkKqp.exe
  2⤵
  PID:12968
- C:\Windows\System\mWDCpav.exe
  C:\Windows\System\mWDCpav.exe
  2⤵
  PID:12988
- C:\Windows\System\kAeXftz.exe
  C:\Windows\System\kAeXftz.exe
  2⤵
  PID:13020
- C:\Windows\System\HhyyvDH.exe
  C:\Windows\System\HhyyvDH.exe
  2⤵
  PID:13044
- C:\Windows\System\DnCCkDp.exe
  C:\Windows\System\DnCCkDp.exe
  2⤵
  PID:13080
- C:\Windows\System\BljRLdW.exe
  C:\Windows\System\BljRLdW.exe
  2⤵
  PID:13124
- C:\Windows\System\OkcnLwv.exe
  C:\Windows\System\OkcnLwv.exe
  2⤵
  PID:13152
- C:\Windows\System\KIfqNIY.exe
  C:\Windows\System\KIfqNIY.exe
  2⤵
  PID:13168
- C:\Windows\System\JbAZYLz.exe
  C:\Windows\System\JbAZYLz.exe
  2⤵
  PID:13192
- C:\Windows\System\NbvFchV.exe
  C:\Windows\System\NbvFchV.exe
  2⤵
  PID:13232
- C:\Windows\System\hSnJxWk.exe
  C:\Windows\System\hSnJxWk.exe
  2⤵
  PID:13248
- C:\Windows\System\ubJuiSo.exe
  C:\Windows\System\ubJuiSo.exe
  2⤵
  PID:13268
- C:\Windows\System\TVDIett.exe
  C:\Windows\System\TVDIett.exe
  2⤵
  PID:13288
- C:\Windows\System\yGiOiHZ.exe
  C:\Windows\System\yGiOiHZ.exe
  2⤵
  PID:13308
- C:\Windows\System\BqERFCM.exe
  C:\Windows\System\BqERFCM.exe
  2⤵
  PID:12340
- C:\Windows\System\aZnLjqi.exe
  C:\Windows\System\aZnLjqi.exe
  2⤵
  PID:12396
- C:\Windows\System\qPRDGeP.exe
  C:\Windows\System\qPRDGeP.exe
  2⤵
  PID:12504
- C:\Windows\System\DygpRQC.exe
  C:\Windows\System\DygpRQC.exe
  2⤵
  PID:12568
- C:\Windows\System\cozoFLE.exe
  C:\Windows\System\cozoFLE.exe
  2⤵
  PID:12612
- C:\Windows\System\elXkokI.exe
  C:\Windows\System\elXkokI.exe
  2⤵
  PID:12632
- C:\Windows\System\CIVsvwx.exe
  C:\Windows\System\CIVsvwx.exe
  2⤵
  PID:12856
- C:\Windows\System\OAyLHQn.exe
  C:\Windows\System\OAyLHQn.exe
  2⤵
  PID:12940
- C:\Windows\System\LyKfqLP.exe
  C:\Windows\System\LyKfqLP.exe
  2⤵
  PID:12980
- C:\Windows\System\vhmcDrj.exe
  C:\Windows\System\vhmcDrj.exe
  2⤵
  PID:13036
- C:\Windows\System\teDdqbH.exe
  C:\Windows\System\teDdqbH.exe
  2⤵
  PID:13112
- C:\Windows\System\hrHUdOT.exe
  C:\Windows\System\hrHUdOT.exe
  2⤵
  PID:13224
- C:\Windows\System\amHOrTg.exe
  C:\Windows\System\amHOrTg.exe
  2⤵
  PID:13216
- C:\Windows\System\QDokHAr.exe
  C:\Windows\System\QDokHAr.exe
  2⤵
  PID:13280
- C:\Windows\System\fzSUIaq.exe
  C:\Windows\System\fzSUIaq.exe
  2⤵
  PID:12356
- C:\Windows\System\UADNbFy.exe
  C:\Windows\System\UADNbFy.exe
  2⤵
  PID:12476
- C:\Windows\System\QDgaeMy.exe
  C:\Windows\System\QDgaeMy.exe
  2⤵
  PID:12608
- C:\Windows\System\AaaCUhU.exe
  C:\Windows\System\AaaCUhU.exe
  2⤵
  PID:12684
- C:\Windows\System\rOxkpzv.exe
  C:\Windows\System\rOxkpzv.exe
  2⤵
  PID:12932
- C:\Windows\System\ZdTRyqB.exe
  C:\Windows\System\ZdTRyqB.exe
  2⤵
  PID:13040
- C:\Windows\System\CTumQYE.exe
  C:\Windows\System\CTumQYE.exe
  2⤵
  PID:13244
- C:\Windows\System\MDehPXq.exe
  C:\Windows\System\MDehPXq.exe
  2⤵
  PID:12292
- C:\Windows\System\NjoPivj.exe
  C:\Windows\System\NjoPivj.exe
  2⤵
  PID:12556
- C:\Windows\System\MUfxvvS.exe
  C:\Windows\System\MUfxvvS.exe
  2⤵
  PID:12924
- C:\Windows\System\ywzUoQR.exe
  C:\Windows\System\ywzUoQR.exe
  2⤵
  PID:13276
- C:\Windows\System\kLzAOWT.exe
  C:\Windows\System\kLzAOWT.exe
  2⤵
  PID:13316
- C:\Windows\System\GCoedsa.exe
  C:\Windows\System\GCoedsa.exe
  2⤵
  PID:13336
- C:\Windows\System\jhFspXn.exe
  C:\Windows\System\jhFspXn.exe
  2⤵
  PID:13376
- C:\Windows\System\bVhQudY.exe
  C:\Windows\System\bVhQudY.exe
  2⤵
  PID:13396
- C:\Windows\System\GuypvKy.exe
  C:\Windows\System\GuypvKy.exe
  2⤵
  PID:13424
- C:\Windows\System\SyzBtzP.exe
  C:\Windows\System\SyzBtzP.exe
  2⤵
  PID:13440
- C:\Windows\System\zkbCbUS.exe
  C:\Windows\System\zkbCbUS.exe
  2⤵
  PID:13496
- C:\Windows\System\ThGQBPi.exe
  C:\Windows\System\ThGQBPi.exe
  2⤵
  PID:13640
- C:\Windows\System\ZuOqSSp.exe
  C:\Windows\System\ZuOqSSp.exe
  2⤵
  PID:13676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_112inje2.n1i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABfkxjX.exe

Filesize
1.0MB

MD5
78700bcab9acf41a8d782d9d7474eaa3

SHA1
b28b1f4da9dae822a8c5cdaf8d57a5ca3486fd04

SHA256
fc5c80902d354a76133960846467c7dd5f7936972fa8ef003c2c00822061fd55

SHA512
3cef287516832784a19bbe6abdc47fe8dcae0cfe01ee34e486419b1f491c7d55592c508d140200bd164add6202e496b436b8e4dec164fc252196288bb7eb4ea4

Download Submit
C:\Windows\System\BFnSkRO.exe

Filesize
1.0MB

MD5
15e12153ddb897e583a5ecc4aa258604

SHA1
ccab96c982d69c72a27602fdcc80d72113b6cda5

SHA256
8bfba8400e94d4236af2634424f9f3b8daf37befd743719a34c7f9aadfa5e3a3

SHA512
5b37eae33dc56dfe1c00b5c2313f80d669139f94a9b042bab123c81c8132d73f963abec797b09337b4a3257da83d0456fb2ee32deb1e0a811dd18388a9e8aa7e

Download Submit
C:\Windows\System\BfIvlhY.exe

Filesize
1.0MB

MD5
0a060bbed05de79208a770b972306a9c

SHA1
d0b0a15be0393d233ea4a26cba8aa52b6179086f

SHA256
5f9e6c3f19f1f0f9a14ddda140c81fe9ba8e074325a12c3c023eb02fbb9d341a

SHA512
6c2891925e902783537ca0a264e4574f011eb189192b4e2fb82db03fe27f299fdadd2205069739f6d3eda592d3dd9ab598eab195aff8ca7bddc720c162d9822e

Download Submit
C:\Windows\System\BuIOrAT.exe

Filesize
1.0MB

MD5
0c6773b476c536aa77e07b0612d9caa6

SHA1
afdabc4957fa2dc894c467da50bf0a85ec0dd0b1

SHA256
e43603f6eef5f12fd22b98ce7f8643e7cbd87e7f6460acd17362b66458ff9df3

SHA512
c9c8656b3b4ee93f9d660ef19f815080ffea7fc6cda6d5081ef11f33133558baf6abb7de2e91155cecc80d67e97e5d4f719a2ba62ffc45c9a957dc4e4dd10604

Download Submit
C:\Windows\System\DQNMVKW.exe

Filesize
1.0MB

MD5
372625c84dacce245239028cc3062b7c

SHA1
dda6eea3813fffaa4b298854220bed007bfb8a67

SHA256
3508230bf95901ac2e5ad4d80b4945e4fa000d7aac1bb202cf623b9b7aad4a5b

SHA512
031ef27160e96aa8a4bd557cfcf6fcc3270bc1d9d436f69cdfba382e6c79eefba51ab1c0029bc497ba207611c33d2833dc4ef45db2277f31a750bcb965d89d4f

Download Submit
C:\Windows\System\DbiKTxS.exe

Filesize
1.0MB

MD5
eacf396398732154e38ad32a2b1f1aa0

SHA1
c36cc6c7dd74ba6250499b9c781cb5419df60dc7

SHA256
1639df772f51cf8e26f8e845c23b99f1042705c76dac212e71fd21216b024575

SHA512
0d0ec8a9e531d29e2d8dbc578c687df59f4682b2901bb4707f9a05691d3c3805c8a06bbc3990cdcf13b159d2c2a5fcba09c761887ba58ee6fa7edf1d1147a31b

Download Submit
C:\Windows\System\EmuGAqE.exe

Filesize
1.0MB

MD5
71453279083506b45a5aed19e3ed0616

SHA1
80bdf30a53415bd4fe4e406339e27310e5802a01

SHA256
851702cb628bf1f6ce1305a6917bfdb1c949d836b9b2782c4a247558026631db

SHA512
02a4c1fd080081aa9973a79a09924cbbf9ba81c488dc5babf3f91de531f3d3000eb4ba781848caeadb11bd6712e18501af0ee5abbfee988892bb6d5aa96a6134

Download Submit
C:\Windows\System\FiBizSi.exe

Filesize
1.0MB

MD5
079b050556442519c520adf8e6a3509c

SHA1
1b31c4aef3bd7e22088f7b0af95ccf615314d763

SHA256
f7fe0be8f9e506ca5445e465f465de34f074e726e1303f6d9df9d77baa27499c

SHA512
22e8cd7f0698d42f675d14a61eb0cf109cd0fa4a04de42c8271452dd71cfd47c1849b6f6710a0da99b9fea1d67412fbf7b178d72578ea8cc557391d461838a97

Download Submit
C:\Windows\System\GNfnGuW.exe

Filesize
1.0MB

MD5
06a2be4323d24b357dc0711475893b04

SHA1
2ba8c7ddf36336be39aed465ff4bca07c10b07bb

SHA256
bdcd1fec833bdfd0619bd2bc6fc3ade7755d3779216f0711ecffc7d3f7a3bc99

SHA512
9dd552743f77a9f98c9e787364d249dba232a3bcdc06cfaa897cd1d33ed6a924e3ef2e76e96dbd92486a9cf2f996945aa939fddf8cc3b686a381939248cbf85d

Download Submit
C:\Windows\System\IKAOLVM.exe

Filesize
1.0MB

MD5
47f5d1d661cdf8040d5ee52a2238dfc5

SHA1
e92153b8e2905340966595033da9522f7af76e4d

SHA256
8f8f4ff045ef21c83ead7226cc0fe0b2b92a0a734a28ee260e40355809345144

SHA512
0f1cdaed20b3ad49a1d408d490a9874817bf5b67d07c9038067ed4f03a1891a8663bd1593cedfb5d73bbbdaf3531ba13696c4fa0108feb7b22e5c716fd18274d

Download Submit
C:\Windows\System\JOXoRIs.exe

Filesize
1.0MB

MD5
f76d340a6059238447c134af33a88fbf

SHA1
f9ab73789b68492deed608283b859c3948b3ea43

SHA256
d7f6d9c7c7a73a7e9e3ecba01a6147f5a0e074f7192e1856e92a179877be4f81

SHA512
fdec79fb890ccf6a8979fce9b4e2c9140a7982c4ef145e8324c49480d4f9862cbfe0b6f3919611af5eb7e95467b1a3f36021836c8872f7d7c65e7de1ce045888

Download Submit
C:\Windows\System\JlmnCbH.exe

Filesize
1.0MB

MD5
b47c688e505743f93bbc720530ee6bbf

SHA1
bdbceee95ce76705cd7eb2dc5e28a0d627cc8aaf

SHA256
6217680c908d80474cf5709000e2fc2daa2d16ee98044a79a0da7d5abf4a9691

SHA512
a11b593ecfe294a7e82dea58444ea8bef4a53cb80e13c7b3c9664fe8f69a066d16daea53c40dadfe3dc4749f96b0bdd7ddfeed3357b3cb0145b02c89bd7ea42e

Download Submit
C:\Windows\System\KfUocGm.exe

Filesize
1.0MB

MD5
c61029e369d530d992a33ff911bdf83c

SHA1
16feb87ad7b1a4587e5fa3f397ea19decb1ab354

SHA256
2e80ea9eba8ea99176fe66b6c54cc12aa614b1ec25dfa3e919fad08f1b72527f

SHA512
eacbc12d1e32f11895424e404592f24bd2429eb801a3dbdac085da5fda58af93e9a2d36c042b8e1272aae69c4f4a12c0994a2ad22278facdfa7a366d6e7d755a

Download Submit
C:\Windows\System\KtIniiq.exe

Filesize
8B

MD5
e3c8eaf01ea47855ef01e4afbd9ff2af

SHA1
f88c6ddff490f20bfa8b414c9581ed4ccfb4583f

SHA256
5227c4e85df1fae15e78a32417ecb84023de36174c33eda1c82b9517821d0324

SHA512
59ee7be82a43b6155f70fadf82a88435324d76e31a43534f13f04b9ba4f717b7f9cd9c80a23a71490e49c11cc8942f4ac231ab31e930a55caf7de8e553cfc8e8

Download Submit
C:\Windows\System\MKBuTJs.exe

Filesize
1.0MB

MD5
a29ad5db5b28fe5154f4e0868da4f06c

SHA1
8159efd05878bf6db5cbce085facd7b9e25c900b

SHA256
8dbde5ba2d05fdef2ac7d9557263e63d6029b5b477b634c4e80049f96c73adb3

SHA512
43d4e7cbe4bc7936f66916532218b7ee426b31248099af1688c2c6e45d10b082f44dba1a388d22f8465858d2162a71b7f19ff553b5beb4d0804ec515943d337e

Download Submit
C:\Windows\System\NImltOf.exe

Filesize
1.0MB

MD5
44b13f3c6cd2e06171c73fc49f050455

SHA1
25aef140187024358ee7c2bc93c17f0f0989c239

SHA256
b6f5428cd3f331577eed093a9265900ca0e7df1a213a45242173e3d5f5f0c6ab

SHA512
b11d732c28de4ceb6ce5e7a7b9e051b51711f1a8204141fa1a1444ac4b685f2d33bd410cdd00a2c37c75d45d8eab799ed25760800b3f9530db9bb03014f2fe09

Download Submit
C:\Windows\System\NxOqgrD.exe

Filesize
1.0MB

MD5
ea73b98327850ff2f73c886930842633

SHA1
6eb306ff3ee90503102f590ae8b70732edbc38e5

SHA256
905cb3f4ad2752784da07eb72799398e2b900bcf1f82ac32eff482a3fc903d94

SHA512
f444af342c7839468fc0916112d63bd2307eafe310171548416b50a557fb34ddd12c54a0c5ac6b765876561bc8505e2ffc024bbb9b59fc122a2d98321ef2232d

Download Submit
C:\Windows\System\PHqRYam.exe

Filesize
1.0MB

MD5
72e4fe5caf657001b17e2e8ade783bca

SHA1
5bf45b0ec6eaf67460e5bfb1a35eba76ff12ed34

SHA256
157cdad5ab6d1b52804c6ea4c2db9c7596bb6a0704542f03fc48753c1a3a0f2a

SHA512
fc39604fb81e99e6f51572da884d661c59b7912607716890ace2f2b32c6901fdef9b7351aaede200ccb5dd4430dd808f24aba68ceec3301b24210c2e8144d51a

Download Submit
C:\Windows\System\POQzonH.exe

Filesize
1.0MB

MD5
8194134a21c5c787fb4437f969a84e1c

SHA1
05b3bdbdca881bf116552aa74413ce8794e0811c

SHA256
1674ecdefd6c5771c2887d95347f6285412e6830a8448fdd9a53a27f0612feaa

SHA512
0882389900bc3a0bc7166cfbe7ce63842f1d11b435bba2a14acddd2026407fec868522164a5eccca2f8e6600440780e5d5000c5ac0d853e96f4fe691ecd8fcc5

Download Submit
C:\Windows\System\PyQvJQr.exe

Filesize
1.0MB

MD5
d68ee0da0539d55449cf0f9acd063e60

SHA1
b1700d263a135521e4c152ca377294b573b6e2ad

SHA256
34bfb4a305755b4505c47f3dc60b99a3d17e9d1a3ae9403399a0a1bc099f6b87

SHA512
f326a8e0cc57b54564cb0bd3e11eea3ec62fb6b6413e792fb3c67d6815ae67d8c97a4da606928887c7db707b7a573ff553ac9cfb9629f80a6c1bf0532a4b37f0

Download Submit
C:\Windows\System\SoyrqSa.exe

Filesize
1.0MB

MD5
deaf12d4ae66fbd7d22084e9fb2ab174

SHA1
edeb2d98d80376492283a2bb459cece59fe1d5a2

SHA256
41cea6ed38731e5c48d78060c037d838859779243b8458187ae54f139ced3988

SHA512
735203b812a2fb3d3b58dd70c5925df9482ee0abfb0ac4c51b97bbbf1a80e1704a1be6506e1f57ff3b2e1fec852ce7f9f2a573ec49ad1c2fd21854055164517f

Download Submit
C:\Windows\System\VTwETOp.exe

Filesize
1.0MB

MD5
dc04032adb35026235eb2a34fc1c4ad9

SHA1
6dd65c903629912d082fd30a3fd61053d480d27a

SHA256
2e652b54443241627217f2b168f1ccc4918b9fe093305172bca7e13f5c4e22a4

SHA512
7b8d7351fc7a24a790e73a15cb8e9380894611b88619ea0ae8539eeb0f297f3c3b86097e7889362ee25eff00c3d3caece72f192f8753c836ba90311606c7e080

Download Submit
C:\Windows\System\cbWBjLB.exe

Filesize
1.0MB

MD5
17bcb90038c1752d5ef1e914790b3d2d

SHA1
17ff4f90e70a1108bd29bb96fb4faaf8cc19278e

SHA256
2073793fcc2efacb26133b18acc3f484dfe7279094e83752e3029a0e16d9356b

SHA512
17b53b242e690981f7d9c43619c71043236099dccaed9ea65e3030cda8f970da111e4c131537d4985487acee6703fe2969b078528708ef008183730734350fd4

Download Submit
C:\Windows\System\dkGjtkl.exe

Filesize
1.0MB

MD5
c4a53d14524baf82c721db7ed119f64f

SHA1
0ef9657613ada736556f492435c51a61ee392eee

SHA256
6a546c31405b8555e50ee4cd416b4f7fe848619fcd4e5f56a51e0718f5f0753d

SHA512
0b63bd3124d56e44e66e11b8fa6b3c1edf60611c96da2ae89e4837e72890dfe3bb9dccc8e97a9d510533c1aa2359b5331b3f4d9307167b871c6322c54ca4544b

Download Submit
C:\Windows\System\eVsvgfM.exe

Filesize
1.0MB

MD5
2042e2f03925296bbfeed9aab42e2999

SHA1
ce64fbf16741be16b7a03e679f7f230b0d5378f7

SHA256
610f75ef746cb7d65fd61055903d22ab864f18e3754202c6677f3d697708678a

SHA512
757e94e276eaddd4f5939c20432381034bffeb75aef5de35bbd80806318f07673a873e36a76cdb8f789cd91541281014314b8a9073527effc1e1bd8325ac77a3

Download Submit
C:\Windows\System\fKjeEvG.exe

Filesize
1.0MB

MD5
7bfe9189a2835490808f87bcde1410a5

SHA1
3cc31b223cd8ca03caa1364f87908ae26b297461

SHA256
b29f522f86bd6db65d173966a78481c255aaef21a539e8c7f526d79a2aa316f6

SHA512
8aed956a2858cb4c9af6db2bec5922c50e80e2e99b7d64ebe3322bd27aeaa9593c135ea03fd52f7c6b78eb0a4c16ddd23bbf4f58dbf18493269846e111d987ce

Download Submit
C:\Windows\System\iLknLoG.exe

Filesize
1.0MB

MD5
4c2a8472bebb583e3195c11b696489fd

SHA1
ee08682abea8d0e2ea1ac5db0657f466f544223d

SHA256
017a02fcf3d9474fb93e48b6c5bedd1932c530e805a259c54ab932f1e6a1be2d

SHA512
13c87b517f70cadd782da3bb0c642b2619f34983c23a198f8aa610abe4981da68794419ab2aa5993cce43cd9e9c672876110792d69e9a9bcef8fb4812d4d0d69

Download Submit
C:\Windows\System\kBZtSSs.exe

Filesize
1.0MB

MD5
45516f92b5e85edb5b6ac827916c9c5a

SHA1
c5ad0f3de2ff2edbbe9239df69f95c496b97228c

SHA256
0df40a666099127e4d295064d8872e46db91fcb2946a08a182e7c13f625e2caa

SHA512
fcdc75cdf6a6424cf0ed3842ad895f3c9382108bd10a6dac2d638495865c58936d48f04b5b1d7dfbdbc42a106f8241a627430451a6231f6920aa91c7d48de276

Download Submit
C:\Windows\System\lklPkoN.exe

Filesize
1.0MB

MD5
f2e76874ffe15b8321538956fe761ab5

SHA1
2ae8d2ff592b05e245337cacef563c4bbdfc12fe

SHA256
e58b137e91ddd1a1d58d6d500484337125e4210beee8b850b32cd8977896da79

SHA512
63bd6a6cc250f84c5fb2d8c51ddf439cd7aeaed9f6b9062631838f476cb2f0f17fb5454726fb132de820c25cbcef5aa78b4a6c6af3cdd5bb53e03de243a00ad6

Download Submit
C:\Windows\System\mHzIQxO.exe

Filesize
1.0MB

MD5
db6ff3d1e8499ddb37dca1e2f9683047

SHA1
eeeddf07f70086e5a93b4a7d8bb14fd0e51f08e8

SHA256
8b8dda9166d1094c8ebdb2eb00d2ff7eda25f821b1cbc819c6468fbaf9378304

SHA512
ace60acf8c5ab2be25fe53bdf4a8e24ca10226229aaaf94cbc01fd8faea0860a75e9c5476832b75108f113d58734a03b839f7c6452a5043128a2ed3665cd9aef

Download Submit
C:\Windows\System\mfakbLG.exe

Filesize
1.0MB

MD5
bd6fe48ed8170284dc0aaa8c58882b40

SHA1
e20132f7429d21ec14f324c1abde39c8c3e4f3d9

SHA256
e6c638714bab78be94667ca26306be86a2c5f2e4fc32537d1a2a7b5e84ea22f8

SHA512
22212417465d19b5760606d637fffdf44cb2c6267fa4d290960f78e1b21ad21e2027cbdea4dd1b58751c43e4bac44eb7bd3ad0c4d995a96314ee6c0859440fa7

Download Submit
C:\Windows\System\qDaSDeR.exe

Filesize
1.0MB

MD5
2e6ff4b72fa7aefcc9a95bca34825576

SHA1
e54a91cafd80734a397647484195941e3af84b9b

SHA256
f199b0ce12fe03efe65f597df63e33e7bf0c3f26d5b8b355d93287596b3ad461

SHA512
d13245339a394984645c92ff013ee33c2742662f992f24ac10b1dcfe5d1d265fb9e0d2bc2c2f4e4a2f7f4d461f4e580557dfd5d526bbf94b57567d510ac70c57

Download Submit
C:\Windows\System\qylCAHc.exe

Filesize
1.0MB

MD5
c374e1615db8df8c79ab211790e3dedd

SHA1
3c1c13e3f6b739423a3a93420ded74eff2353e0c

SHA256
600e43453775e9e0b8bcc91d328eb5cda1844c6af03a7873d4e0f230049df0fb

SHA512
7021bf542a5092d400332019f3e5ceb703c7e40c6ce9cc4bcb3840b5a63a20914bdbd34fe43e47f709e19974193c30686f9d0e63872121189f82e390a9072e59

Download Submit
C:\Windows\System\tmLSEek.exe

Filesize
1.0MB

MD5
17952af557862e8b95bfa82a7b25acdf

SHA1
2f7506dbffdd98cd3343fb85a1d8094bce7cfa5e

SHA256
224e039ab49c02359422609236c880c00e6460c9c9388b07c0f825267e7d1038

SHA512
4ff3d4dc29f0d2361276cd804399468acc7dc8287eb36eb62738d206cede16d539a167b221ec12749342326a8e74966702e53572ab4e3928d95e9feb54fb0f3d

Download Submit
memory/384-120-0x00007FF6A1C80000-0x00007FF6A2072000-memory.dmp

Filesize
3.9MB

Download
memory/384-2405-0x00007FF6A1C80000-0x00007FF6A2072000-memory.dmp

Filesize
3.9MB

Download
memory/396-105-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp

Filesize
3.9MB

Download
memory/396-2398-0x00007FF7152C0000-0x00007FF7156B2000-memory.dmp

Filesize
3.9MB

Download
memory/784-2375-0x00007FF6820F0000-0x00007FF6824E2000-memory.dmp

Filesize
3.9MB

Download
memory/784-72-0x00007FF6820F0000-0x00007FF6824E2000-memory.dmp

Filesize
3.9MB

Download
memory/788-151-0x00007FF7E68C0000-0x00007FF7E6CB2000-memory.dmp

Filesize
3.9MB

Download
memory/788-2424-0x00007FF7E68C0000-0x00007FF7E6CB2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-2409-0x00007FF7BA2A0000-0x00007FF7BA692000-memory.dmp

Filesize
3.9MB

Download
memory/1096-96-0x00007FF7BA2A0000-0x00007FF7BA692000-memory.dmp

Filesize
3.9MB

Download
memory/1116-2410-0x00007FF6A7150000-0x00007FF6A7542000-memory.dmp

Filesize
3.9MB

Download
memory/1116-106-0x00007FF6A7150000-0x00007FF6A7542000-memory.dmp

Filesize
3.9MB

Download
memory/1120-115-0x00007FF7DC6B0000-0x00007FF7DCAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1120-2372-0x00007FF7DC6B0000-0x00007FF7DCAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1596-157-0x00007FF73F150000-0x00007FF73F542000-memory.dmp

Filesize
3.9MB

Download
memory/1596-2423-0x00007FF73F150000-0x00007FF73F542000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2418-0x00007FF7803C0000-0x00007FF7807B2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-145-0x00007FF7803C0000-0x00007FF7807B2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-176-0x00007FF7E32D0000-0x00007FF7E36C2000-memory.dmp

Filesize
3.9MB

Download
memory/1812-2429-0x00007FF7E32D0000-0x00007FF7E36C2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-24-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-2369-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-904-0x00007FF7F7FC0000-0x00007FF7F83B2000-memory.dmp

Filesize
3.9MB

Download
memory/2352-2427-0x00007FF6FE0A0000-0x00007FF6FE492000-memory.dmp

Filesize
3.9MB

Download
memory/2352-164-0x00007FF6FE0A0000-0x00007FF6FE492000-memory.dmp

Filesize
3.9MB

Download
memory/2388-170-0x00007FF79C050000-0x00007FF79C442000-memory.dmp

Filesize
3.9MB

Download
memory/2388-2430-0x00007FF79C050000-0x00007FF79C442000-memory.dmp

Filesize
3.9MB

Download
memory/2472-774-0x00007FF687B80000-0x00007FF687F72000-memory.dmp

Filesize
3.9MB

Download
memory/2472-0-0x00007FF687B80000-0x00007FF687F72000-memory.dmp

Filesize
3.9MB

Download
memory/2472-1-0x000001D1E96F0000-0x000001D1E9700000-memory.dmp

Filesize
64KB

Download
memory/2560-2412-0x00007FF695050000-0x00007FF695442000-memory.dmp

Filesize
3.9MB

Download
memory/2560-938-0x00007FF695050000-0x00007FF695442000-memory.dmp

Filesize
3.9MB

Download
memory/2560-83-0x00007FF695050000-0x00007FF695442000-memory.dmp

Filesize
3.9MB

Download
memory/2692-2404-0x00007FF628930000-0x00007FF628D22000-memory.dmp

Filesize
3.9MB

Download
memory/2692-60-0x00007FF628930000-0x00007FF628D22000-memory.dmp

Filesize
3.9MB

Download
memory/2692-919-0x00007FF628930000-0x00007FF628D22000-memory.dmp

Filesize
3.9MB

Download
memory/2708-2414-0x00007FF78B690000-0x00007FF78BA82000-memory.dmp

Filesize
3.9MB

Download
memory/2708-135-0x00007FF78B690000-0x00007FF78BA82000-memory.dmp

Filesize
3.9MB

Download
memory/2948-39-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-2377-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-1089-0x00007FF6D24C0000-0x00007FF6D28B2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2399-0x00007FF704FD0000-0x00007FF7053C2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-126-0x00007FF704FD0000-0x00007FF7053C2000-memory.dmp

Filesize
3.9MB

Download
memory/3352-127-0x00007FF7E1350000-0x00007FF7E1742000-memory.dmp

Filesize
3.9MB

Download
memory/3352-2402-0x00007FF7E1350000-0x00007FF7E1742000-memory.dmp

Filesize
3.9MB

Download
memory/3404-2421-0x00007FF7D8740000-0x00007FF7D8B32000-memory.dmp

Filesize
3.9MB

Download
memory/3404-163-0x00007FF7D8740000-0x00007FF7D8B32000-memory.dmp

Filesize
3.9MB

Download
memory/3624-1302-0x000001BAC08E0000-0x000001BAC1086000-memory.dmp

Filesize
7.6MB

Download
memory/3624-40-0x000001BABDA40000-0x000001BABDA50000-memory.dmp

Filesize
64KB

Download
memory/3624-41-0x000001BABDA40000-0x000001BABDA50000-memory.dmp

Filesize
64KB

Download
memory/3624-1236-0x00007FF9D4703000-0x00007FF9D4705000-memory.dmp

Filesize
8KB

Download
memory/3624-95-0x000001BABD990000-0x000001BABD9B2000-memory.dmp

Filesize
136KB

Download
memory/3624-116-0x00007FF9D4703000-0x00007FF9D4705000-memory.dmp

Filesize
8KB

Download
memory/3832-2432-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3832-182-0x00007FF65D4E0000-0x00007FF65D8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3904-28-0x00007FF647550000-0x00007FF647942000-memory.dmp

Filesize
3.9MB

Download
memory/3904-912-0x00007FF647550000-0x00007FF647942000-memory.dmp

Filesize
3.9MB

Download
memory/3904-2373-0x00007FF647550000-0x00007FF647942000-memory.dmp

Filesize
3.9MB

Download
memory/4036-6-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp

Filesize
3.9MB

Download
memory/4036-891-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp

Filesize
3.9MB

Download
memory/4036-2367-0x00007FF6AC820000-0x00007FF6ACC12000-memory.dmp

Filesize
3.9MB

Download
memory/4820-139-0x00007FF7D65A0000-0x00007FF7D6992000-memory.dmp

Filesize
3.9MB

Download
memory/4820-2416-0x00007FF7D65A0000-0x00007FF7D6992000-memory.dmp

Filesize
3.9MB

Download