xmrig | 727bac2d852985885875eace1c6ab6ca027fcc161323913ef03d077e924e086b

Analysis

max time kernel
100s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ac16a09437fcc8ee9079d79a0e103a0N.exe
Size

1.7MB
MD5

1ac16a09437fcc8ee9079d79a0e103a0
SHA1

df221f5b08322022d4f50a976e88c635d31f7225
SHA256

727bac2d852985885875eace1c6ab6ca027fcc161323913ef03d077e924e086b
SHA512

5d8bdb70ac702c0fdb4e46ee2775e8f5da981d6dd4b3490fa6c11dc0656b1c07e931661450377e64e786dfc525beed304afa964c4487f2c57d73b4e8fff221b1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9z6:Lz071uv4BPMkibTIA5lCx7kvRWa4pfY6

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1232-106-0x00007FF6A61E0000-0x00007FF6A65D2000-memory.dmp	xmrig
behavioral2/memory/3360-151-0x00007FF611380000-0x00007FF611772000-memory.dmp	xmrig
behavioral2/memory/4460-164-0x00007FF74C400000-0x00007FF74C7F2000-memory.dmp	xmrig
behavioral2/memory/2204-176-0x00007FF616020000-0x00007FF616412000-memory.dmp	xmrig
behavioral2/memory/3496-170-0x00007FF6B62F0000-0x00007FF6B66E2000-memory.dmp	xmrig
behavioral2/memory/4988-158-0x00007FF76F140000-0x00007FF76F532000-memory.dmp	xmrig
behavioral2/memory/4688-157-0x00007FF702840000-0x00007FF702C32000-memory.dmp	xmrig
behavioral2/memory/2428-145-0x00007FF61A080000-0x00007FF61A472000-memory.dmp	xmrig
behavioral2/memory/3796-139-0x00007FF7FC9D0000-0x00007FF7FCDC2000-memory.dmp	xmrig
behavioral2/memory/4068-138-0x00007FF6F2FE0000-0x00007FF6F33D2000-memory.dmp	xmrig
behavioral2/memory/872-128-0x00007FF730A70000-0x00007FF730E62000-memory.dmp	xmrig
behavioral2/memory/2368-124-0x00007FF68D880000-0x00007FF68DC72000-memory.dmp	xmrig
behavioral2/memory/2484-117-0x00007FF70A1C0000-0x00007FF70A5B2000-memory.dmp	xmrig
behavioral2/memory/1580-113-0x00007FF684B20000-0x00007FF684F12000-memory.dmp	xmrig
behavioral2/memory/3012-105-0x00007FF63E3F0000-0x00007FF63E7E2000-memory.dmp	xmrig
behavioral2/memory/4740-79-0x00007FF6A6CA0000-0x00007FF6A7092000-memory.dmp	xmrig
behavioral2/memory/3500-72-0x00007FF65E230000-0x00007FF65E622000-memory.dmp	xmrig
behavioral2/memory/224-66-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	xmrig
behavioral2/memory/1320-56-0x00007FF732B90000-0x00007FF732F82000-memory.dmp	xmrig
behavioral2/memory/2996-55-0x00007FF7F1B70000-0x00007FF7F1F62000-memory.dmp	xmrig
behavioral2/memory/3988-35-0x00007FF6074B0000-0x00007FF6078A2000-memory.dmp	xmrig
behavioral2/memory/2332-1065-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp	xmrig
behavioral2/memory/1344-1064-0x00007FF628240000-0x00007FF628632000-memory.dmp	xmrig
behavioral2/memory/1092-1307-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp	xmrig
behavioral2/memory/2052-1330-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp	xmrig
behavioral2/memory/2332-2147-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp	xmrig
behavioral2/memory/3988-2151-0x00007FF6074B0000-0x00007FF6078A2000-memory.dmp	xmrig
behavioral2/memory/2996-2150-0x00007FF7F1B70000-0x00007FF7F1F62000-memory.dmp	xmrig
behavioral2/memory/4740-2179-0x00007FF6A6CA0000-0x00007FF6A7092000-memory.dmp	xmrig
behavioral2/memory/3500-2181-0x00007FF65E230000-0x00007FF65E622000-memory.dmp	xmrig
behavioral2/memory/2484-2187-0x00007FF70A1C0000-0x00007FF70A5B2000-memory.dmp	xmrig
behavioral2/memory/2368-2189-0x00007FF68D880000-0x00007FF68DC72000-memory.dmp	xmrig
behavioral2/memory/1232-2185-0x00007FF6A61E0000-0x00007FF6A65D2000-memory.dmp	xmrig
behavioral2/memory/1580-2184-0x00007FF684B20000-0x00007FF684F12000-memory.dmp	xmrig
behavioral2/memory/3012-2177-0x00007FF63E3F0000-0x00007FF63E7E2000-memory.dmp	xmrig
behavioral2/memory/224-2172-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	xmrig
behavioral2/memory/1320-2170-0x00007FF732B90000-0x00007FF732F82000-memory.dmp	xmrig
behavioral2/memory/872-2195-0x00007FF730A70000-0x00007FF730E62000-memory.dmp	xmrig
behavioral2/memory/3796-2197-0x00007FF7FC9D0000-0x00007FF7FCDC2000-memory.dmp	xmrig
behavioral2/memory/1092-2193-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp	xmrig
behavioral2/memory/4068-2192-0x00007FF6F2FE0000-0x00007FF6F33D2000-memory.dmp	xmrig
behavioral2/memory/3496-2231-0x00007FF6B62F0000-0x00007FF6B66E2000-memory.dmp	xmrig
behavioral2/memory/2204-2239-0x00007FF616020000-0x00007FF616412000-memory.dmp	xmrig
behavioral2/memory/4460-2235-0x00007FF74C400000-0x00007FF74C7F2000-memory.dmp	xmrig
behavioral2/memory/4688-2230-0x00007FF702840000-0x00007FF702C32000-memory.dmp	xmrig
behavioral2/memory/4988-2227-0x00007FF76F140000-0x00007FF76F532000-memory.dmp	xmrig
behavioral2/memory/3360-2220-0x00007FF611380000-0x00007FF611772000-memory.dmp	xmrig
behavioral2/memory/2428-2226-0x00007FF61A080000-0x00007FF61A472000-memory.dmp	xmrig
behavioral2/memory/2052-2530-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	1948	powershell.exe
8	1948	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1948	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2332	hLcVVNS.exe
3988	BqlXnYm.exe
2996	HBgqSYv.exe
1320	uPvOWyv.exe
224	fBBiknz.exe
3012	Ralpoew.exe
1232	yHTrbne.exe
3500	gLoFIhL.exe
4740	NgzYGJZ.exe
1580	bxtFoPo.exe
2484	aZqGxgO.exe
2368	nzBuoww.exe
1092	tdZwPyg.exe
4068	ImZsXnL.exe
872	DiIFsLa.exe
2052	ieXsDsF.exe
3796	GXxemYN.exe
2428	ThLvwpv.exe
3360	RmebvdX.exe
4688	OiVXbTh.exe
4988	TqCDJKw.exe
4460	NneOjKn.exe
3496	bWfUgxi.exe
2204	YLWshOn.exe
1588	pVuxbsx.exe
4080	YLlvkUt.exe
1584	MWStDTl.exe
1772	soOHJME.exe
3976	UGSsrfH.exe
4300	UftWnvf.exe
4132	JcnumTI.exe
4364	IpTuReN.exe
4520	IUqUxMT.exe
4444	cFpydPU.exe
1628	mIGlvSG.exe
2748	tRMJkpF.exe
4424	hzOrAfp.exe
1792	PVCECqA.exe
2596	ETbSrzU.exe
4588	JaOPVdK.exe
3196	jcCrApc.exe
3744	NYwWWbW.exe
2256	WYeVcyA.exe
2092	vacGiWL.exe
3812	spAscED.exe
2220	kOHthFt.exe
4248	PSwIARU.exe
2260	NJQjDYC.exe
4880	TXHQiyz.exe
2592	yfNksxW.exe
3580	RKGMfFQ.exe
3800	HPcuqXd.exe
2736	WGhBciR.exe
2516	EMLkyCk.exe
2636	VsKujpz.exe
2148	NWtzATU.exe
4576	NpiFaVt.exe
4200	uFBlsso.exe
1596	YSvUEYo.exe
5132	akVTkxo.exe
5164	iZmVzKz.exe
5192	jWgzoQa.exe
5216	BOXtTdR.exe
5244	ToipIgk.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1344-0-0x00007FF628240000-0x00007FF628632000-memory.dmp	upx
behavioral2/files/0x0008000000023441-6.dat	upx
behavioral2/files/0x0007000000023445-14.dat	upx
behavioral2/memory/2332-10-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp	upx
behavioral2/files/0x0007000000023446-15.dat	upx
behavioral2/files/0x0007000000023447-19.dat	upx
behavioral2/files/0x0007000000023448-25.dat	upx
behavioral2/files/0x0007000000023449-31.dat	upx
behavioral2/files/0x000700000002344c-42.dat	upx
behavioral2/files/0x000700000002344d-61.dat	upx
behavioral2/files/0x0007000000023450-69.dat	upx
behavioral2/files/0x0007000000023451-78.dat	upx
behavioral2/memory/1092-84-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp	upx
behavioral2/memory/1232-106-0x00007FF6A61E0000-0x00007FF6A65D2000-memory.dmp	upx
behavioral2/files/0x0007000000023453-114.dat	upx
behavioral2/files/0x0007000000023455-122.dat	upx
behavioral2/files/0x0007000000023457-129.dat	upx
behavioral2/memory/3360-151-0x00007FF611380000-0x00007FF611772000-memory.dmp	upx
behavioral2/memory/4460-164-0x00007FF74C400000-0x00007FF74C7F2000-memory.dmp	upx
behavioral2/memory/2204-176-0x00007FF616020000-0x00007FF616412000-memory.dmp	upx
behavioral2/files/0x0007000000023460-192.dat	upx
behavioral2/files/0x0007000000023463-199.dat	upx
behavioral2/files/0x0007000000023461-197.dat	upx
behavioral2/files/0x0007000000023462-194.dat	upx
behavioral2/files/0x000700000002345f-187.dat	upx
behavioral2/files/0x000700000002345e-182.dat	upx
behavioral2/files/0x000700000002345d-177.dat	upx
behavioral2/files/0x000700000002345c-171.dat	upx
behavioral2/memory/3496-170-0x00007FF6B62F0000-0x00007FF6B66E2000-memory.dmp	upx
behavioral2/files/0x000700000002345b-165.dat	upx
behavioral2/files/0x000700000002345a-159.dat	upx
behavioral2/memory/4988-158-0x00007FF76F140000-0x00007FF76F532000-memory.dmp	upx
behavioral2/memory/4688-157-0x00007FF702840000-0x00007FF702C32000-memory.dmp	upx
behavioral2/files/0x0007000000023459-152.dat	upx
behavioral2/files/0x0007000000023458-146.dat	upx
behavioral2/memory/2428-145-0x00007FF61A080000-0x00007FF61A472000-memory.dmp	upx
behavioral2/memory/3796-139-0x00007FF7FC9D0000-0x00007FF7FCDC2000-memory.dmp	upx
behavioral2/memory/4068-138-0x00007FF6F2FE0000-0x00007FF6F33D2000-memory.dmp	upx
behavioral2/files/0x0007000000023456-133.dat	upx
behavioral2/memory/2052-132-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp	upx
behavioral2/memory/872-128-0x00007FF730A70000-0x00007FF730E62000-memory.dmp	upx
behavioral2/memory/2368-124-0x00007FF68D880000-0x00007FF68DC72000-memory.dmp	upx
behavioral2/files/0x0007000000023454-120.dat	upx
behavioral2/memory/2484-117-0x00007FF70A1C0000-0x00007FF70A5B2000-memory.dmp	upx
behavioral2/memory/1580-113-0x00007FF684B20000-0x00007FF684F12000-memory.dmp	upx
behavioral2/files/0x0007000000023452-109.dat	upx
behavioral2/files/0x000800000002344e-107.dat	upx
behavioral2/memory/3012-105-0x00007FF63E3F0000-0x00007FF63E7E2000-memory.dmp	upx
behavioral2/files/0x0008000000023442-100.dat	upx
behavioral2/files/0x000800000002344f-88.dat	upx
behavioral2/memory/4740-79-0x00007FF6A6CA0000-0x00007FF6A7092000-memory.dmp	upx
behavioral2/memory/3500-72-0x00007FF65E230000-0x00007FF65E622000-memory.dmp	upx
behavioral2/memory/224-66-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp	upx
behavioral2/files/0x000700000002344b-67.dat	upx
behavioral2/files/0x000700000002344a-60.dat	upx
behavioral2/memory/1320-56-0x00007FF732B90000-0x00007FF732F82000-memory.dmp	upx
behavioral2/memory/2996-55-0x00007FF7F1B70000-0x00007FF7F1F62000-memory.dmp	upx
behavioral2/memory/3988-35-0x00007FF6074B0000-0x00007FF6078A2000-memory.dmp	upx
behavioral2/memory/2332-1065-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp	upx
behavioral2/memory/1344-1064-0x00007FF628240000-0x00007FF628632000-memory.dmp	upx
behavioral2/memory/1092-1307-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp	upx
behavioral2/memory/2052-1330-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp	upx
behavioral2/memory/2332-2147-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp	upx
behavioral2/memory/3988-2151-0x00007FF6074B0000-0x00007FF6078A2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oBvCXjY.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\sqzSqgZ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\SPYmHfB.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\dpWzeYc.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\bxtFoPo.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\VofoIgp.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AzMIjxT.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AmfnBzd.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\jCgpgyv.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\hGnmWpD.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\sAgGKdz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\LAkhExh.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\regKqAs.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\wIsxvQU.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\BNAbVou.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\cVpyXdm.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\EQpnDDA.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AhEwztX.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\EtSBsVt.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\muIQhJo.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\HOYcnxK.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\NCbLWPk.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\KkDxyPw.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\JgyUZMT.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ZwIDMrQ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\BnhWjMk.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\sCSGnmh.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ThLvwpv.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\oennUOW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\QtaIufT.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\dnZhIuW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\NFOWrfG.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\QoQAjQZ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\PJjCVZl.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\epfyQwg.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\XyininX.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\FYwxNrN.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\cFphxZu.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\zkpegBL.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\iJjpgGm.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\LSeMZvJ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\EUhdqxJ.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\rfLlvvf.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\KBTvOzB.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\qyCzwRs.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\hbVMTgk.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\nEZmVqC.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\OiVXbTh.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\iZmVzKz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\qFIwKpa.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\FGhnwHS.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\dKKxXcr.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\bqCPgtz.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\kaNwkgA.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\oGeajtH.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\RxbpUEi.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AZnlipU.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ROyKoqa.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\tRrOsXW.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\IcGqqYa.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\RDLtYSB.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\SWHYHgj.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\ujieHTF.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe
File created	C:\Windows\System\AHAgwbH.exe	1ac16a09437fcc8ee9079d79a0e103a0N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe
Token: SeLockMemoryPrivilege	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe
Token: SeDebugPrivilege	1948	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 1948	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	84
PID 1344 wrote to memory of 1948	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	84
PID 1344 wrote to memory of 2332	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	85
PID 1344 wrote to memory of 2332	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	85
PID 1344 wrote to memory of 3988	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	86
PID 1344 wrote to memory of 3988	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	86
PID 1344 wrote to memory of 2996	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	87
PID 1344 wrote to memory of 2996	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	87
PID 1344 wrote to memory of 1320	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	88
PID 1344 wrote to memory of 1320	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	88
PID 1344 wrote to memory of 224	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	89
PID 1344 wrote to memory of 224	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	89
PID 1344 wrote to memory of 3012	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	90
PID 1344 wrote to memory of 3012	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	90
PID 1344 wrote to memory of 1232	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	91
PID 1344 wrote to memory of 1232	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	91
PID 1344 wrote to memory of 3500	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	92
PID 1344 wrote to memory of 3500	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	92
PID 1344 wrote to memory of 4740	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	93
PID 1344 wrote to memory of 4740	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	93
PID 1344 wrote to memory of 1580	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	94
PID 1344 wrote to memory of 1580	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	94
PID 1344 wrote to memory of 2484	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	95
PID 1344 wrote to memory of 2484	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	95
PID 1344 wrote to memory of 2368	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	96
PID 1344 wrote to memory of 2368	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	96
PID 1344 wrote to memory of 1092	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	97
PID 1344 wrote to memory of 1092	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	97
PID 1344 wrote to memory of 2052	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	98
PID 1344 wrote to memory of 2052	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	98
PID 1344 wrote to memory of 4068	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	99
PID 1344 wrote to memory of 4068	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	99
PID 1344 wrote to memory of 872	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	100
PID 1344 wrote to memory of 872	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	100
PID 1344 wrote to memory of 3796	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	101
PID 1344 wrote to memory of 3796	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	101
PID 1344 wrote to memory of 2428	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	102
PID 1344 wrote to memory of 2428	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	102
PID 1344 wrote to memory of 3360	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	103
PID 1344 wrote to memory of 3360	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	103
PID 1344 wrote to memory of 4688	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	104
PID 1344 wrote to memory of 4688	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	104
PID 1344 wrote to memory of 4988	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	105
PID 1344 wrote to memory of 4988	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	105
PID 1344 wrote to memory of 4460	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	106
PID 1344 wrote to memory of 4460	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	106
PID 1344 wrote to memory of 3496	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	107
PID 1344 wrote to memory of 3496	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	107
PID 1344 wrote to memory of 2204	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	108
PID 1344 wrote to memory of 2204	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	108
PID 1344 wrote to memory of 1588	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	109
PID 1344 wrote to memory of 1588	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	109
PID 1344 wrote to memory of 4080	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	110
PID 1344 wrote to memory of 4080	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	110
PID 1344 wrote to memory of 1584	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	111
PID 1344 wrote to memory of 1584	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	111
PID 1344 wrote to memory of 1772	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	112
PID 1344 wrote to memory of 1772	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	112
PID 1344 wrote to memory of 3976	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	113
PID 1344 wrote to memory of 3976	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	113
PID 1344 wrote to memory of 4300	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	114
PID 1344 wrote to memory of 4300	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	114
PID 1344 wrote to memory of 4132	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	115
PID 1344 wrote to memory of 4132	1344	1ac16a09437fcc8ee9079d79a0e103a0N.exe	115

C:\Users\Admin\AppData\Local\Temp\1ac16a09437fcc8ee9079d79a0e103a0N.exe
"C:\Users\Admin\AppData\Local\Temp\1ac16a09437fcc8ee9079d79a0e103a0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1948" "2956" "1244" "2960" "0" "0" "2964" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:14112
- C:\Windows\System\hLcVVNS.exe
  C:\Windows\System\hLcVVNS.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\BqlXnYm.exe
  C:\Windows\System\BqlXnYm.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\HBgqSYv.exe
  C:\Windows\System\HBgqSYv.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\uPvOWyv.exe
  C:\Windows\System\uPvOWyv.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\fBBiknz.exe
  C:\Windows\System\fBBiknz.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\Ralpoew.exe
  C:\Windows\System\Ralpoew.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\yHTrbne.exe
  C:\Windows\System\yHTrbne.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\gLoFIhL.exe
  C:\Windows\System\gLoFIhL.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\NgzYGJZ.exe
  C:\Windows\System\NgzYGJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\bxtFoPo.exe
  C:\Windows\System\bxtFoPo.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\aZqGxgO.exe
  C:\Windows\System\aZqGxgO.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\nzBuoww.exe
  C:\Windows\System\nzBuoww.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\tdZwPyg.exe
  C:\Windows\System\tdZwPyg.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ieXsDsF.exe
  C:\Windows\System\ieXsDsF.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ImZsXnL.exe
  C:\Windows\System\ImZsXnL.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\DiIFsLa.exe
  C:\Windows\System\DiIFsLa.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\GXxemYN.exe
  C:\Windows\System\GXxemYN.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\ThLvwpv.exe
  C:\Windows\System\ThLvwpv.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\RmebvdX.exe
  C:\Windows\System\RmebvdX.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\OiVXbTh.exe
  C:\Windows\System\OiVXbTh.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\TqCDJKw.exe
  C:\Windows\System\TqCDJKw.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\NneOjKn.exe
  C:\Windows\System\NneOjKn.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\bWfUgxi.exe
  C:\Windows\System\bWfUgxi.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\YLWshOn.exe
  C:\Windows\System\YLWshOn.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\pVuxbsx.exe
  C:\Windows\System\pVuxbsx.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\YLlvkUt.exe
  C:\Windows\System\YLlvkUt.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\MWStDTl.exe
  C:\Windows\System\MWStDTl.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\soOHJME.exe
  C:\Windows\System\soOHJME.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\UGSsrfH.exe
  C:\Windows\System\UGSsrfH.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\UftWnvf.exe
  C:\Windows\System\UftWnvf.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\JcnumTI.exe
  C:\Windows\System\JcnumTI.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\IpTuReN.exe
  C:\Windows\System\IpTuReN.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\IUqUxMT.exe
  C:\Windows\System\IUqUxMT.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\cFpydPU.exe
  C:\Windows\System\cFpydPU.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\mIGlvSG.exe
  C:\Windows\System\mIGlvSG.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\tRMJkpF.exe
  C:\Windows\System\tRMJkpF.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\hzOrAfp.exe
  C:\Windows\System\hzOrAfp.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\PVCECqA.exe
  C:\Windows\System\PVCECqA.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ETbSrzU.exe
  C:\Windows\System\ETbSrzU.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\JaOPVdK.exe
  C:\Windows\System\JaOPVdK.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\jcCrApc.exe
  C:\Windows\System\jcCrApc.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\NYwWWbW.exe
  C:\Windows\System\NYwWWbW.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\WYeVcyA.exe
  C:\Windows\System\WYeVcyA.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\vacGiWL.exe
  C:\Windows\System\vacGiWL.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\spAscED.exe
  C:\Windows\System\spAscED.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\kOHthFt.exe
  C:\Windows\System\kOHthFt.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\PSwIARU.exe
  C:\Windows\System\PSwIARU.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\NJQjDYC.exe
  C:\Windows\System\NJQjDYC.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\TXHQiyz.exe
  C:\Windows\System\TXHQiyz.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\yfNksxW.exe
  C:\Windows\System\yfNksxW.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\RKGMfFQ.exe
  C:\Windows\System\RKGMfFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\HPcuqXd.exe
  C:\Windows\System\HPcuqXd.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\WGhBciR.exe
  C:\Windows\System\WGhBciR.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\EMLkyCk.exe
  C:\Windows\System\EMLkyCk.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\VsKujpz.exe
  C:\Windows\System\VsKujpz.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\NWtzATU.exe
  C:\Windows\System\NWtzATU.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\NpiFaVt.exe
  C:\Windows\System\NpiFaVt.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\uFBlsso.exe
  C:\Windows\System\uFBlsso.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\YSvUEYo.exe
  C:\Windows\System\YSvUEYo.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\akVTkxo.exe
  C:\Windows\System\akVTkxo.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\iZmVzKz.exe
  C:\Windows\System\iZmVzKz.exe
  2⤵
  - Executes dropped EXE
  PID:5164
- C:\Windows\System\jWgzoQa.exe
  C:\Windows\System\jWgzoQa.exe
  2⤵
  - Executes dropped EXE
  PID:5192
- C:\Windows\System\BOXtTdR.exe
  C:\Windows\System\BOXtTdR.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\ToipIgk.exe
  C:\Windows\System\ToipIgk.exe
  2⤵
  - Executes dropped EXE
  PID:5244
- C:\Windows\System\XnxmOrj.exe
  C:\Windows\System\XnxmOrj.exe
  2⤵
  PID:5272
- C:\Windows\System\xcJSEcw.exe
  C:\Windows\System\xcJSEcw.exe
  2⤵
  PID:5304
- C:\Windows\System\eIXVBWD.exe
  C:\Windows\System\eIXVBWD.exe
  2⤵
  PID:5332
- C:\Windows\System\ktfXQoy.exe
  C:\Windows\System\ktfXQoy.exe
  2⤵
  PID:5364
- C:\Windows\System\ugksIlh.exe
  C:\Windows\System\ugksIlh.exe
  2⤵
  PID:5392
- C:\Windows\System\FVRZqzv.exe
  C:\Windows\System\FVRZqzv.exe
  2⤵
  PID:5420
- C:\Windows\System\toviUdK.exe
  C:\Windows\System\toviUdK.exe
  2⤵
  PID:5448
- C:\Windows\System\pzVHJpH.exe
  C:\Windows\System\pzVHJpH.exe
  2⤵
  PID:5476
- C:\Windows\System\jCgpgyv.exe
  C:\Windows\System\jCgpgyv.exe
  2⤵
  PID:5508
- C:\Windows\System\wtaeuHH.exe
  C:\Windows\System\wtaeuHH.exe
  2⤵
  PID:5532
- C:\Windows\System\VSPLKCI.exe
  C:\Windows\System\VSPLKCI.exe
  2⤵
  PID:5564
- C:\Windows\System\micilYg.exe
  C:\Windows\System\micilYg.exe
  2⤵
  PID:5592
- C:\Windows\System\LJxYPeg.exe
  C:\Windows\System\LJxYPeg.exe
  2⤵
  PID:5620
- C:\Windows\System\EVfeirL.exe
  C:\Windows\System\EVfeirL.exe
  2⤵
  PID:5648
- C:\Windows\System\QuXNYKG.exe
  C:\Windows\System\QuXNYKG.exe
  2⤵
  PID:5676
- C:\Windows\System\SKEiQde.exe
  C:\Windows\System\SKEiQde.exe
  2⤵
  PID:5704
- C:\Windows\System\LGYbtzN.exe
  C:\Windows\System\LGYbtzN.exe
  2⤵
  PID:5732
- C:\Windows\System\QYjAURV.exe
  C:\Windows\System\QYjAURV.exe
  2⤵
  PID:5760
- C:\Windows\System\QYPNTxV.exe
  C:\Windows\System\QYPNTxV.exe
  2⤵
  PID:5788
- C:\Windows\System\PJjCVZl.exe
  C:\Windows\System\PJjCVZl.exe
  2⤵
  PID:5840
- C:\Windows\System\DJjamea.exe
  C:\Windows\System\DJjamea.exe
  2⤵
  PID:5860
- C:\Windows\System\WtxmEsJ.exe
  C:\Windows\System\WtxmEsJ.exe
  2⤵
  PID:5888
- C:\Windows\System\oennUOW.exe
  C:\Windows\System\oennUOW.exe
  2⤵
  PID:5904
- C:\Windows\System\zlGTluP.exe
  C:\Windows\System\zlGTluP.exe
  2⤵
  PID:5932
- C:\Windows\System\OrPjlPn.exe
  C:\Windows\System\OrPjlPn.exe
  2⤵
  PID:5960
- C:\Windows\System\VGeDxNd.exe
  C:\Windows\System\VGeDxNd.exe
  2⤵
  PID:5984
- C:\Windows\System\qVzZYNI.exe
  C:\Windows\System\qVzZYNI.exe
  2⤵
  PID:6016
- C:\Windows\System\CvkPJXd.exe
  C:\Windows\System\CvkPJXd.exe
  2⤵
  PID:6044
- C:\Windows\System\jXSRKKb.exe
  C:\Windows\System\jXSRKKb.exe
  2⤵
  PID:6072
- C:\Windows\System\xqIVtAS.exe
  C:\Windows\System\xqIVtAS.exe
  2⤵
  PID:6100
- C:\Windows\System\mXhyNwd.exe
  C:\Windows\System\mXhyNwd.exe
  2⤵
  PID:6128
- C:\Windows\System\DeaQLrY.exe
  C:\Windows\System\DeaQLrY.exe
  2⤵
  PID:756
- C:\Windows\System\YxObwvJ.exe
  C:\Windows\System\YxObwvJ.exe
  2⤵
  PID:2376
- C:\Windows\System\uALDdBH.exe
  C:\Windows\System\uALDdBH.exe
  2⤵
  PID:2012
- C:\Windows\System\oMypBuz.exe
  C:\Windows\System\oMypBuz.exe
  2⤵
  PID:1336
- C:\Windows\System\MbJbMwZ.exe
  C:\Windows\System\MbJbMwZ.exe
  2⤵
  PID:372
- C:\Windows\System\sgQlNkH.exe
  C:\Windows\System\sgQlNkH.exe
  2⤵
  PID:5148
- C:\Windows\System\ooOQrwE.exe
  C:\Windows\System\ooOQrwE.exe
  2⤵
  PID:5208
- C:\Windows\System\emVnMAm.exe
  C:\Windows\System\emVnMAm.exe
  2⤵
  PID:5264
- C:\Windows\System\QbYORHY.exe
  C:\Windows\System\QbYORHY.exe
  2⤵
  PID:5344
- C:\Windows\System\BUNWzUs.exe
  C:\Windows\System\BUNWzUs.exe
  2⤵
  PID:5408
- C:\Windows\System\OYDDQzQ.exe
  C:\Windows\System\OYDDQzQ.exe
  2⤵
  PID:5464
- C:\Windows\System\tzadCnh.exe
  C:\Windows\System\tzadCnh.exe
  2⤵
  PID:5528
- C:\Windows\System\ZyUMQtL.exe
  C:\Windows\System\ZyUMQtL.exe
  2⤵
  PID:5604
- C:\Windows\System\shVpMmc.exe
  C:\Windows\System\shVpMmc.exe
  2⤵
  PID:5668
- C:\Windows\System\GfgeFei.exe
  C:\Windows\System\GfgeFei.exe
  2⤵
  PID:5720
- C:\Windows\System\YibGPpk.exe
  C:\Windows\System\YibGPpk.exe
  2⤵
  PID:5776
- C:\Windows\System\AVoUAua.exe
  C:\Windows\System\AVoUAua.exe
  2⤵
  PID:5852
- C:\Windows\System\VWmKwmw.exe
  C:\Windows\System\VWmKwmw.exe
  2⤵
  PID:5916
- C:\Windows\System\VciSnTN.exe
  C:\Windows\System\VciSnTN.exe
  2⤵
  PID:5976
- C:\Windows\System\XBwkuTX.exe
  C:\Windows\System\XBwkuTX.exe
  2⤵
  PID:6036
- C:\Windows\System\CSSKrSa.exe
  C:\Windows\System\CSSKrSa.exe
  2⤵
  PID:6092
- C:\Windows\System\PYlQrey.exe
  C:\Windows\System\PYlQrey.exe
  2⤵
  PID:3220
- C:\Windows\System\vzGfMdX.exe
  C:\Windows\System\vzGfMdX.exe
  2⤵
  PID:2976
- C:\Windows\System\BbcsHFC.exe
  C:\Windows\System\BbcsHFC.exe
  2⤵
  PID:4728
- C:\Windows\System\aluMHJV.exe
  C:\Windows\System\aluMHJV.exe
  2⤵
  PID:5184
- C:\Windows\System\yJwtoTu.exe
  C:\Windows\System\yJwtoTu.exe
  2⤵
  PID:5316
- C:\Windows\System\nbJxeoz.exe
  C:\Windows\System\nbJxeoz.exe
  2⤵
  PID:5436
- C:\Windows\System\yIfjGnv.exe
  C:\Windows\System\yIfjGnv.exe
  2⤵
  PID:5576
- C:\Windows\System\bMBylLM.exe
  C:\Windows\System\bMBylLM.exe
  2⤵
  PID:5696
- C:\Windows\System\UHmAZTw.exe
  C:\Windows\System\UHmAZTw.exe
  2⤵
  PID:5820
- C:\Windows\System\XbFcysn.exe
  C:\Windows\System\XbFcysn.exe
  2⤵
  PID:5952
- C:\Windows\System\MlMdoLc.exe
  C:\Windows\System\MlMdoLc.exe
  2⤵
  PID:6060
- C:\Windows\System\vckHjAe.exe
  C:\Windows\System\vckHjAe.exe
  2⤵
  PID:1224
- C:\Windows\System\JECZDDx.exe
  C:\Windows\System\JECZDDx.exe
  2⤵
  PID:3080
- C:\Windows\System\VofoIgp.exe
  C:\Windows\System\VofoIgp.exe
  2⤵
  PID:5380
- C:\Windows\System\CsQuzRi.exe
  C:\Windows\System\CsQuzRi.exe
  2⤵
  PID:5636
- C:\Windows\System\IfAZSlu.exe
  C:\Windows\System\IfAZSlu.exe
  2⤵
  PID:5804
- C:\Windows\System\aYBBeuf.exe
  C:\Windows\System\aYBBeuf.exe
  2⤵
  PID:6156
- C:\Windows\System\YEtWFKX.exe
  C:\Windows\System\YEtWFKX.exe
  2⤵
  PID:6184
- C:\Windows\System\mRbOpmI.exe
  C:\Windows\System\mRbOpmI.exe
  2⤵
  PID:6212
- C:\Windows\System\iKLYJSG.exe
  C:\Windows\System\iKLYJSG.exe
  2⤵
  PID:6240
- C:\Windows\System\kIcnkYW.exe
  C:\Windows\System\kIcnkYW.exe
  2⤵
  PID:6264
- C:\Windows\System\OTQHqLB.exe
  C:\Windows\System\OTQHqLB.exe
  2⤵
  PID:6292
- C:\Windows\System\BYCnCzB.exe
  C:\Windows\System\BYCnCzB.exe
  2⤵
  PID:6320
- C:\Windows\System\sYuYvSD.exe
  C:\Windows\System\sYuYvSD.exe
  2⤵
  PID:6348
- C:\Windows\System\hGnmWpD.exe
  C:\Windows\System\hGnmWpD.exe
  2⤵
  PID:6384
- C:\Windows\System\ONFxyvr.exe
  C:\Windows\System\ONFxyvr.exe
  2⤵
  PID:6408
- C:\Windows\System\rKKThyi.exe
  C:\Windows\System\rKKThyi.exe
  2⤵
  PID:6436
- C:\Windows\System\RdOrfvO.exe
  C:\Windows\System\RdOrfvO.exe
  2⤵
  PID:6464
- C:\Windows\System\mCQdVRH.exe
  C:\Windows\System\mCQdVRH.exe
  2⤵
  PID:6492
- C:\Windows\System\qFIwKpa.exe
  C:\Windows\System\qFIwKpa.exe
  2⤵
  PID:6520
- C:\Windows\System\oIZGqqq.exe
  C:\Windows\System\oIZGqqq.exe
  2⤵
  PID:6548
- C:\Windows\System\sgIBgBf.exe
  C:\Windows\System\sgIBgBf.exe
  2⤵
  PID:6576
- C:\Windows\System\QqPIyDP.exe
  C:\Windows\System\QqPIyDP.exe
  2⤵
  PID:6604
- C:\Windows\System\DsLCxBB.exe
  C:\Windows\System\DsLCxBB.exe
  2⤵
  PID:6632
- C:\Windows\System\cDzcZVQ.exe
  C:\Windows\System\cDzcZVQ.exe
  2⤵
  PID:6660
- C:\Windows\System\XBQWHbq.exe
  C:\Windows\System\XBQWHbq.exe
  2⤵
  PID:6684
- C:\Windows\System\RxbpUEi.exe
  C:\Windows\System\RxbpUEi.exe
  2⤵
  PID:6716
- C:\Windows\System\CbRWwqM.exe
  C:\Windows\System\CbRWwqM.exe
  2⤵
  PID:6744
- C:\Windows\System\VibXHwW.exe
  C:\Windows\System\VibXHwW.exe
  2⤵
  PID:6772
- C:\Windows\System\ypuhuAH.exe
  C:\Windows\System\ypuhuAH.exe
  2⤵
  PID:6800
- C:\Windows\System\ISzSwGq.exe
  C:\Windows\System\ISzSwGq.exe
  2⤵
  PID:6828
- C:\Windows\System\BquYMHO.exe
  C:\Windows\System\BquYMHO.exe
  2⤵
  PID:6856
- C:\Windows\System\nWivguR.exe
  C:\Windows\System\nWivguR.exe
  2⤵
  PID:6880
- C:\Windows\System\LFnWEEz.exe
  C:\Windows\System\LFnWEEz.exe
  2⤵
  PID:6912
- C:\Windows\System\epfyQwg.exe
  C:\Windows\System\epfyQwg.exe
  2⤵
  PID:6936
- C:\Windows\System\QltWcPf.exe
  C:\Windows\System\QltWcPf.exe
  2⤵
  PID:6964
- C:\Windows\System\GJQYfqI.exe
  C:\Windows\System\GJQYfqI.exe
  2⤵
  PID:6996
- C:\Windows\System\yEdixqC.exe
  C:\Windows\System\yEdixqC.exe
  2⤵
  PID:7024
- C:\Windows\System\dgYGYyx.exe
  C:\Windows\System\dgYGYyx.exe
  2⤵
  PID:7048
- C:\Windows\System\oThGMod.exe
  C:\Windows\System\oThGMod.exe
  2⤵
  PID:7076
- C:\Windows\System\GdfCmTD.exe
  C:\Windows\System\GdfCmTD.exe
  2⤵
  PID:7104
- C:\Windows\System\svbEAuF.exe
  C:\Windows\System\svbEAuF.exe
  2⤵
  PID:7152
- C:\Windows\System\VUXTjeq.exe
  C:\Windows\System\VUXTjeq.exe
  2⤵
  PID:5256
- C:\Windows\System\oBtAdPm.exe
  C:\Windows\System\oBtAdPm.exe
  2⤵
  PID:6148
- C:\Windows\System\AhEwztX.exe
  C:\Windows\System\AhEwztX.exe
  2⤵
  PID:6200
- C:\Windows\System\irQUCrk.exe
  C:\Windows\System\irQUCrk.exe
  2⤵
  PID:6284
- C:\Windows\System\UowdCMd.exe
  C:\Windows\System\UowdCMd.exe
  2⤵
  PID:6420
- C:\Windows\System\npZsVSs.exe
  C:\Windows\System\npZsVSs.exe
  2⤵
  PID:6452
- C:\Windows\System\ImFQWPc.exe
  C:\Windows\System\ImFQWPc.exe
  2⤵
  PID:2540
- C:\Windows\System\PCNQZwl.exe
  C:\Windows\System\PCNQZwl.exe
  2⤵
  PID:6508
- C:\Windows\System\BGJxidr.exe
  C:\Windows\System\BGJxidr.exe
  2⤵
  PID:4456
- C:\Windows\System\yqkIRRh.exe
  C:\Windows\System\yqkIRRh.exe
  2⤵
  PID:3420
- C:\Windows\System\xqHzAqe.exe
  C:\Windows\System\xqHzAqe.exe
  2⤵
  PID:6568
- C:\Windows\System\oBvCXjY.exe
  C:\Windows\System\oBvCXjY.exe
  2⤵
  PID:5004
- C:\Windows\System\oMMekjH.exe
  C:\Windows\System\oMMekjH.exe
  2⤵
  PID:4232
- C:\Windows\System\ZtwUcTU.exe
  C:\Windows\System\ZtwUcTU.exe
  2⤵
  PID:6644
- C:\Windows\System\FGhnwHS.exe
  C:\Windows\System\FGhnwHS.exe
  2⤵
  PID:6648
- C:\Windows\System\duMEkcO.exe
  C:\Windows\System\duMEkcO.exe
  2⤵
  PID:6756
- C:\Windows\System\BVzuXjI.exe
  C:\Windows\System\BVzuXjI.exe
  2⤵
  PID:6812
- C:\Windows\System\YTObrBG.exe
  C:\Windows\System\YTObrBG.exe
  2⤵
  PID:6984
- C:\Windows\System\pduJbCV.exe
  C:\Windows\System\pduJbCV.exe
  2⤵
  PID:2160
- C:\Windows\System\bRdCezS.exe
  C:\Windows\System\bRdCezS.exe
  2⤵
  PID:7044
- C:\Windows\System\LHJKitB.exe
  C:\Windows\System\LHJKitB.exe
  2⤵
  PID:4660
- C:\Windows\System\nJhmJKC.exe
  C:\Windows\System\nJhmJKC.exe
  2⤵
  PID:5112
- C:\Windows\System\eBVLCKE.exe
  C:\Windows\System\eBVLCKE.exe
  2⤵
  PID:3480
- C:\Windows\System\ouvsJSx.exe
  C:\Windows\System\ouvsJSx.exe
  2⤵
  PID:5036
- C:\Windows\System\ZhGehxV.exe
  C:\Windows\System\ZhGehxV.exe
  2⤵
  PID:2836
- C:\Windows\System\dKKxXcr.exe
  C:\Windows\System\dKKxXcr.exe
  2⤵
  PID:1608
- C:\Windows\System\vbnbAjB.exe
  C:\Windows\System\vbnbAjB.exe
  2⤵
  PID:3168
- C:\Windows\System\kYgJpvI.exe
  C:\Windows\System\kYgJpvI.exe
  2⤵
  PID:7124
- C:\Windows\System\HfEGvkt.exe
  C:\Windows\System\HfEGvkt.exe
  2⤵
  PID:5076
- C:\Windows\System\BoAYAvt.exe
  C:\Windows\System\BoAYAvt.exe
  2⤵
  PID:7096
- C:\Windows\System\SWHYHgj.exe
  C:\Windows\System\SWHYHgj.exe
  2⤵
  PID:7144
- C:\Windows\System\tWLPDHx.exe
  C:\Windows\System\tWLPDHx.exe
  2⤵
  PID:7136
- C:\Windows\System\riJvctK.exe
  C:\Windows\System\riJvctK.exe
  2⤵
  PID:2936
- C:\Windows\System\IIgakLL.exe
  C:\Windows\System\IIgakLL.exe
  2⤵
  PID:4700
- C:\Windows\System\YRzpYtC.exe
  C:\Windows\System\YRzpYtC.exe
  2⤵
  PID:820
- C:\Windows\System\QfHadzv.exe
  C:\Windows\System\QfHadzv.exe
  2⤵
  PID:3872
- C:\Windows\System\cirIkRi.exe
  C:\Windows\System\cirIkRi.exe
  2⤵
  PID:6364
- C:\Windows\System\ZUsRquV.exe
  C:\Windows\System\ZUsRquV.exe
  2⤵
  PID:6404
- C:\Windows\System\QOrWbxL.exe
  C:\Windows\System\QOrWbxL.exe
  2⤵
  PID:6624
- C:\Windows\System\ItafRVp.exe
  C:\Windows\System\ItafRVp.exe
  2⤵
  PID:6484
- C:\Windows\System\nGnFxor.exe
  C:\Windows\System\nGnFxor.exe
  2⤵
  PID:6536
- C:\Windows\System\NhHCLFP.exe
  C:\Windows\System\NhHCLFP.exe
  2⤵
  PID:6872
- C:\Windows\System\djBHHaz.exe
  C:\Windows\System\djBHHaz.exe
  2⤵
  PID:6676
- C:\Windows\System\PyZenbi.exe
  C:\Windows\System\PyZenbi.exe
  2⤵
  PID:6960
- C:\Windows\System\ehQJNTs.exe
  C:\Windows\System\ehQJNTs.exe
  2⤵
  PID:3808
- C:\Windows\System\CqFDmQT.exe
  C:\Windows\System\CqFDmQT.exe
  2⤵
  PID:964
- C:\Windows\System\LsLayac.exe
  C:\Windows\System\LsLayac.exe
  2⤵
  PID:3016
- C:\Windows\System\fbTbUQV.exe
  C:\Windows\System\fbTbUQV.exe
  2⤵
  PID:4580
- C:\Windows\System\rfLlvvf.exe
  C:\Windows\System\rfLlvvf.exe
  2⤵
  PID:7064
- C:\Windows\System\zeNdLXX.exe
  C:\Windows\System\zeNdLXX.exe
  2⤵
  PID:6028
- C:\Windows\System\sZUxhvw.exe
  C:\Windows\System\sZUxhvw.exe
  2⤵
  PID:5232
- C:\Windows\System\ZwIDMrQ.exe
  C:\Windows\System\ZwIDMrQ.exe
  2⤵
  PID:6172
- C:\Windows\System\JrOtAKZ.exe
  C:\Windows\System\JrOtAKZ.exe
  2⤵
  PID:6232
- C:\Windows\System\UGpRTlU.exe
  C:\Windows\System\UGpRTlU.exe
  2⤵
  PID:6344
- C:\Windows\System\iJjpgGm.exe
  C:\Windows\System\iJjpgGm.exe
  2⤵
  PID:6308
- C:\Windows\System\ACdGkBp.exe
  C:\Windows\System\ACdGkBp.exe
  2⤵
  PID:6540
- C:\Windows\System\nCjbMrh.exe
  C:\Windows\System\nCjbMrh.exe
  2⤵
  PID:3860
- C:\Windows\System\zMytmJa.exe
  C:\Windows\System\zMytmJa.exe
  2⤵
  PID:7172
- C:\Windows\System\JVLSfXl.exe
  C:\Windows\System\JVLSfXl.exe
  2⤵
  PID:7192
- C:\Windows\System\qiVaKVc.exe
  C:\Windows\System\qiVaKVc.exe
  2⤵
  PID:7220
- C:\Windows\System\uZFaHkf.exe
  C:\Windows\System\uZFaHkf.exe
  2⤵
  PID:7240
- C:\Windows\System\LDIwCDc.exe
  C:\Windows\System\LDIwCDc.exe
  2⤵
  PID:7304
- C:\Windows\System\ScMKQFB.exe
  C:\Windows\System\ScMKQFB.exe
  2⤵
  PID:7368
- C:\Windows\System\hQAFqhC.exe
  C:\Windows\System\hQAFqhC.exe
  2⤵
  PID:7392
- C:\Windows\System\LgtprxC.exe
  C:\Windows\System\LgtprxC.exe
  2⤵
  PID:7408
- C:\Windows\System\fNTXJzk.exe
  C:\Windows\System\fNTXJzk.exe
  2⤵
  PID:7432
- C:\Windows\System\RwbqiHM.exe
  C:\Windows\System\RwbqiHM.exe
  2⤵
  PID:7464
- C:\Windows\System\qwnVAGH.exe
  C:\Windows\System\qwnVAGH.exe
  2⤵
  PID:7480
- C:\Windows\System\xIksfGW.exe
  C:\Windows\System\xIksfGW.exe
  2⤵
  PID:7564
- C:\Windows\System\WTZztog.exe
  C:\Windows\System\WTZztog.exe
  2⤵
  PID:7580
- C:\Windows\System\XyininX.exe
  C:\Windows\System\XyininX.exe
  2⤵
  PID:7700
- C:\Windows\System\TWjsQGA.exe
  C:\Windows\System\TWjsQGA.exe
  2⤵
  PID:7716
- C:\Windows\System\cuMhoOz.exe
  C:\Windows\System\cuMhoOz.exe
  2⤵
  PID:7748
- C:\Windows\System\XrfIBzD.exe
  C:\Windows\System\XrfIBzD.exe
  2⤵
  PID:7784
- C:\Windows\System\kdQFZQB.exe
  C:\Windows\System\kdQFZQB.exe
  2⤵
  PID:7804
- C:\Windows\System\EwgfhSU.exe
  C:\Windows\System\EwgfhSU.exe
  2⤵
  PID:7832
- C:\Windows\System\yTMawHY.exe
  C:\Windows\System\yTMawHY.exe
  2⤵
  PID:7852
- C:\Windows\System\tAuukXi.exe
  C:\Windows\System\tAuukXi.exe
  2⤵
  PID:7872
- C:\Windows\System\KBTvOzB.exe
  C:\Windows\System\KBTvOzB.exe
  2⤵
  PID:7888
- C:\Windows\System\HNczFXr.exe
  C:\Windows\System\HNczFXr.exe
  2⤵
  PID:7904
- C:\Windows\System\uVNxGqU.exe
  C:\Windows\System\uVNxGqU.exe
  2⤵
  PID:7924
- C:\Windows\System\edxpPOV.exe
  C:\Windows\System\edxpPOV.exe
  2⤵
  PID:7940
- C:\Windows\System\dTZiyAv.exe
  C:\Windows\System\dTZiyAv.exe
  2⤵
  PID:7956
- C:\Windows\System\pyJgYxR.exe
  C:\Windows\System\pyJgYxR.exe
  2⤵
  PID:7976
- C:\Windows\System\mNEzGTu.exe
  C:\Windows\System\mNEzGTu.exe
  2⤵
  PID:7992
- C:\Windows\System\snlRNib.exe
  C:\Windows\System\snlRNib.exe
  2⤵
  PID:8044
- C:\Windows\System\jAqCYUK.exe
  C:\Windows\System\jAqCYUK.exe
  2⤵
  PID:8088
- C:\Windows\System\FaEMWDP.exe
  C:\Windows\System\FaEMWDP.exe
  2⤵
  PID:8108
- C:\Windows\System\bqCPgtz.exe
  C:\Windows\System\bqCPgtz.exe
  2⤵
  PID:8132
- C:\Windows\System\WybRkhv.exe
  C:\Windows\System\WybRkhv.exe
  2⤵
  PID:8152
- C:\Windows\System\kALezmM.exe
  C:\Windows\System\kALezmM.exe
  2⤵
  PID:8172
- C:\Windows\System\ieTdJoT.exe
  C:\Windows\System\ieTdJoT.exe
  2⤵
  PID:516
- C:\Windows\System\UTMyPtL.exe
  C:\Windows\System\UTMyPtL.exe
  2⤵
  PID:6260
- C:\Windows\System\pMfbkjB.exe
  C:\Windows\System\pMfbkjB.exe
  2⤵
  PID:7040
- C:\Windows\System\RXiWuBY.exe
  C:\Windows\System\RXiWuBY.exe
  2⤵
  PID:1480
- C:\Windows\System\UBRSkUk.exe
  C:\Windows\System\UBRSkUk.exe
  2⤵
  PID:6256
- C:\Windows\System\FkNfAog.exe
  C:\Windows\System\FkNfAog.exe
  2⤵
  PID:4888
- C:\Windows\System\LTydNfw.exe
  C:\Windows\System\LTydNfw.exe
  2⤵
  PID:1884
- C:\Windows\System\JUpPZXf.exe
  C:\Windows\System\JUpPZXf.exe
  2⤵
  PID:7416
- C:\Windows\System\bWhegqk.exe
  C:\Windows\System\bWhegqk.exe
  2⤵
  PID:7452
- C:\Windows\System\EbUlwFl.exe
  C:\Windows\System\EbUlwFl.exe
  2⤵
  PID:7344
- C:\Windows\System\YECPjfM.exe
  C:\Windows\System\YECPjfM.exe
  2⤵
  PID:7604
- C:\Windows\System\AHdmVuL.exe
  C:\Windows\System\AHdmVuL.exe
  2⤵
  PID:7648
- C:\Windows\System\sosmSMU.exe
  C:\Windows\System\sosmSMU.exe
  2⤵
  PID:7744
- C:\Windows\System\biRBGmA.exe
  C:\Windows\System\biRBGmA.exe
  2⤵
  PID:7796
- C:\Windows\System\IncIzag.exe
  C:\Windows\System\IncIzag.exe
  2⤵
  PID:7988
- C:\Windows\System\bfjWzfU.exe
  C:\Windows\System\bfjWzfU.exe
  2⤵
  PID:7884
- C:\Windows\System\QtaIufT.exe
  C:\Windows\System\QtaIufT.exe
  2⤵
  PID:8084
- C:\Windows\System\VujiKMU.exe
  C:\Windows\System\VujiKMU.exe
  2⤵
  PID:8120
- C:\Windows\System\fRbxIwN.exe
  C:\Windows\System\fRbxIwN.exe
  2⤵
  PID:8068
- C:\Windows\System\EtSBsVt.exe
  C:\Windows\System\EtSBsVt.exe
  2⤵
  PID:8164
- C:\Windows\System\hfAgfNE.exe
  C:\Windows\System\hfAgfNE.exe
  2⤵
  PID:7188
- C:\Windows\System\cVrGGMm.exe
  C:\Windows\System\cVrGGMm.exe
  2⤵
  PID:1984
- C:\Windows\System\tfPSHAx.exe
  C:\Windows\System\tfPSHAx.exe
  2⤵
  PID:6952
- C:\Windows\System\syyRCKO.exe
  C:\Windows\System\syyRCKO.exe
  2⤵
  PID:7440
- C:\Windows\System\fjBrWoC.exe
  C:\Windows\System\fjBrWoC.exe
  2⤵
  PID:7596
- C:\Windows\System\LmbkrOo.exe
  C:\Windows\System\LmbkrOo.exe
  2⤵
  PID:7576
- C:\Windows\System\tpvbnIT.exe
  C:\Windows\System\tpvbnIT.exe
  2⤵
  PID:7848
- C:\Windows\System\cRDBxBE.exe
  C:\Windows\System\cRDBxBE.exe
  2⤵
  PID:8032
- C:\Windows\System\SNdOaWi.exe
  C:\Windows\System\SNdOaWi.exe
  2⤵
  PID:8104
- C:\Windows\System\LbGZBUs.exe
  C:\Windows\System\LbGZBUs.exe
  2⤵
  PID:8188
- C:\Windows\System\udHSrLk.exe
  C:\Windows\System\udHSrLk.exe
  2⤵
  PID:7008
- C:\Windows\System\RDdodsu.exe
  C:\Windows\System\RDdodsu.exe
  2⤵
  PID:7328
- C:\Windows\System\VwkjsTd.exe
  C:\Windows\System\VwkjsTd.exe
  2⤵
  PID:7864
- C:\Windows\System\ThgVbdw.exe
  C:\Windows\System\ThgVbdw.exe
  2⤵
  PID:8016
- C:\Windows\System\cajcorE.exe
  C:\Windows\System\cajcorE.exe
  2⤵
  PID:7448
- C:\Windows\System\nDtknAk.exe
  C:\Windows\System\nDtknAk.exe
  2⤵
  PID:2804
- C:\Windows\System\KAmiaoy.exe
  C:\Windows\System\KAmiaoy.exe
  2⤵
  PID:8220
- C:\Windows\System\hoHRUfj.exe
  C:\Windows\System\hoHRUfj.exe
  2⤵
  PID:8260
- C:\Windows\System\yaYRsrx.exe
  C:\Windows\System\yaYRsrx.exe
  2⤵
  PID:8292
- C:\Windows\System\muIQhJo.exe
  C:\Windows\System\muIQhJo.exe
  2⤵
  PID:8316
- C:\Windows\System\wkvzcUj.exe
  C:\Windows\System\wkvzcUj.exe
  2⤵
  PID:8340
- C:\Windows\System\bbuOLYf.exe
  C:\Windows\System\bbuOLYf.exe
  2⤵
  PID:8372
- C:\Windows\System\ElxDvQW.exe
  C:\Windows\System\ElxDvQW.exe
  2⤵
  PID:8408
- C:\Windows\System\AzMIjxT.exe
  C:\Windows\System\AzMIjxT.exe
  2⤵
  PID:8436
- C:\Windows\System\sAgGKdz.exe
  C:\Windows\System\sAgGKdz.exe
  2⤵
  PID:8460
- C:\Windows\System\NaTKLpx.exe
  C:\Windows\System\NaTKLpx.exe
  2⤵
  PID:8480
- C:\Windows\System\wNJrRxm.exe
  C:\Windows\System\wNJrRxm.exe
  2⤵
  PID:8500
- C:\Windows\System\cDeeAbH.exe
  C:\Windows\System\cDeeAbH.exe
  2⤵
  PID:8520
- C:\Windows\System\nzwSfTe.exe
  C:\Windows\System\nzwSfTe.exe
  2⤵
  PID:8548
- C:\Windows\System\BnhWjMk.exe
  C:\Windows\System\BnhWjMk.exe
  2⤵
  PID:8612
- C:\Windows\System\wSEdYRy.exe
  C:\Windows\System\wSEdYRy.exe
  2⤵
  PID:8640
- C:\Windows\System\LAkhExh.exe
  C:\Windows\System\LAkhExh.exe
  2⤵
  PID:8660
- C:\Windows\System\rOulnCv.exe
  C:\Windows\System\rOulnCv.exe
  2⤵
  PID:8720
- C:\Windows\System\SanQmah.exe
  C:\Windows\System\SanQmah.exe
  2⤵
  PID:8744
- C:\Windows\System\gpmzBLr.exe
  C:\Windows\System\gpmzBLr.exe
  2⤵
  PID:8784
- C:\Windows\System\tXfWkrV.exe
  C:\Windows\System\tXfWkrV.exe
  2⤵
  PID:8800
- C:\Windows\System\SDwSqVG.exe
  C:\Windows\System\SDwSqVG.exe
  2⤵
  PID:8832
- C:\Windows\System\edCDQlu.exe
  C:\Windows\System\edCDQlu.exe
  2⤵
  PID:8856
- C:\Windows\System\BlhGFRl.exe
  C:\Windows\System\BlhGFRl.exe
  2⤵
  PID:8876
- C:\Windows\System\ujieHTF.exe
  C:\Windows\System\ujieHTF.exe
  2⤵
  PID:8896
- C:\Windows\System\PUzkGQI.exe
  C:\Windows\System\PUzkGQI.exe
  2⤵
  PID:8932
- C:\Windows\System\EDJVPka.exe
  C:\Windows\System\EDJVPka.exe
  2⤵
  PID:8956
- C:\Windows\System\AUioTZU.exe
  C:\Windows\System\AUioTZU.exe
  2⤵
  PID:8988
- C:\Windows\System\imVxloe.exe
  C:\Windows\System\imVxloe.exe
  2⤵
  PID:9020
- C:\Windows\System\agDzZPx.exe
  C:\Windows\System\agDzZPx.exe
  2⤵
  PID:9044
- C:\Windows\System\eCSYdrc.exe
  C:\Windows\System\eCSYdrc.exe
  2⤵
  PID:9068
- C:\Windows\System\EXZTVEu.exe
  C:\Windows\System\EXZTVEu.exe
  2⤵
  PID:9088
- C:\Windows\System\GgJuNMm.exe
  C:\Windows\System\GgJuNMm.exe
  2⤵
  PID:9128
- C:\Windows\System\HOYcnxK.exe
  C:\Windows\System\HOYcnxK.exe
  2⤵
  PID:9156
- C:\Windows\System\irMFxAg.exe
  C:\Windows\System\irMFxAg.exe
  2⤵
  PID:9180
- C:\Windows\System\DnZrRja.exe
  C:\Windows\System\DnZrRja.exe
  2⤵
  PID:9212
- C:\Windows\System\GANUpBc.exe
  C:\Windows\System\GANUpBc.exe
  2⤵
  PID:8248
- C:\Windows\System\hwCevmv.exe
  C:\Windows\System\hwCevmv.exe
  2⤵
  PID:8308
- C:\Windows\System\wbPhnZr.exe
  C:\Windows\System\wbPhnZr.exe
  2⤵
  PID:8324
- C:\Windows\System\ZUDOMOo.exe
  C:\Windows\System\ZUDOMOo.exe
  2⤵
  PID:8452
- C:\Windows\System\LHCHUyj.exe
  C:\Windows\System\LHCHUyj.exe
  2⤵
  PID:8608
- C:\Windows\System\pNrgJim.exe
  C:\Windows\System\pNrgJim.exe
  2⤵
  PID:8652
- C:\Windows\System\eWIHYaT.exe
  C:\Windows\System\eWIHYaT.exe
  2⤵
  PID:8656
- C:\Windows\System\oWSluyM.exe
  C:\Windows\System\oWSluyM.exe
  2⤵
  PID:8768
- C:\Windows\System\RlypxcI.exe
  C:\Windows\System\RlypxcI.exe
  2⤵
  PID:8816
- C:\Windows\System\MtWnvhe.exe
  C:\Windows\System\MtWnvhe.exe
  2⤵
  PID:8852
- C:\Windows\System\AZnlipU.exe
  C:\Windows\System\AZnlipU.exe
  2⤵
  PID:8920
- C:\Windows\System\MIsJLPS.exe
  C:\Windows\System\MIsJLPS.exe
  2⤵
  PID:8984
- C:\Windows\System\LXBxKKU.exe
  C:\Windows\System\LXBxKKU.exe
  2⤵
  PID:9084
- C:\Windows\System\KpbwBSy.exe
  C:\Windows\System\KpbwBSy.exe
  2⤵
  PID:9108
- C:\Windows\System\EnnMLfm.exe
  C:\Windows\System\EnnMLfm.exe
  2⤵
  PID:9148
- C:\Windows\System\ISXzPZP.exe
  C:\Windows\System\ISXzPZP.exe
  2⤵
  PID:1988
- C:\Windows\System\wCDlBxT.exe
  C:\Windows\System\wCDlBxT.exe
  2⤵
  PID:8360
- C:\Windows\System\LSeMZvJ.exe
  C:\Windows\System\LSeMZvJ.exe
  2⤵
  PID:8508
- C:\Windows\System\dnZhIuW.exe
  C:\Windows\System\dnZhIuW.exe
  2⤵
  PID:8700
- C:\Windows\System\xtoiohw.exe
  C:\Windows\System\xtoiohw.exe
  2⤵
  PID:8792
- C:\Windows\System\EIDdCKd.exe
  C:\Windows\System\EIDdCKd.exe
  2⤵
  PID:8872
- C:\Windows\System\UPjpCcU.exe
  C:\Windows\System\UPjpCcU.exe
  2⤵
  PID:8944
- C:\Windows\System\qspYfAo.exe
  C:\Windows\System\qspYfAo.exe
  2⤵
  PID:6316
- C:\Windows\System\nYPfKOa.exe
  C:\Windows\System\nYPfKOa.exe
  2⤵
  PID:8140
- C:\Windows\System\hfLETwe.exe
  C:\Windows\System\hfLETwe.exe
  2⤵
  PID:8588
- C:\Windows\System\HvTpDDf.exe
  C:\Windows\System\HvTpDDf.exe
  2⤵
  PID:8888
- C:\Windows\System\pXtjnvN.exe
  C:\Windows\System\pXtjnvN.exe
  2⤵
  PID:9236
- C:\Windows\System\kSdRDNG.exe
  C:\Windows\System\kSdRDNG.exe
  2⤵
  PID:9256
- C:\Windows\System\sCSGnmh.exe
  C:\Windows\System\sCSGnmh.exe
  2⤵
  PID:9272
- C:\Windows\System\gKuNNjP.exe
  C:\Windows\System\gKuNNjP.exe
  2⤵
  PID:9288
- C:\Windows\System\FYwxNrN.exe
  C:\Windows\System\FYwxNrN.exe
  2⤵
  PID:9308
- C:\Windows\System\eaWbdPa.exe
  C:\Windows\System\eaWbdPa.exe
  2⤵
  PID:9344
- C:\Windows\System\jqvQtvR.exe
  C:\Windows\System\jqvQtvR.exe
  2⤵
  PID:9380
- C:\Windows\System\BtNPTQV.exe
  C:\Windows\System\BtNPTQV.exe
  2⤵
  PID:9408
- C:\Windows\System\qceMlSr.exe
  C:\Windows\System\qceMlSr.exe
  2⤵
  PID:9432
- C:\Windows\System\cXIgAyW.exe
  C:\Windows\System\cXIgAyW.exe
  2⤵
  PID:9544
- C:\Windows\System\QvZGElo.exe
  C:\Windows\System\QvZGElo.exe
  2⤵
  PID:9560
- C:\Windows\System\lfOEKHl.exe
  C:\Windows\System\lfOEKHl.exe
  2⤵
  PID:9596
- C:\Windows\System\ySNcbqx.exe
  C:\Windows\System\ySNcbqx.exe
  2⤵
  PID:9616
- C:\Windows\System\regKqAs.exe
  C:\Windows\System\regKqAs.exe
  2⤵
  PID:9656
- C:\Windows\System\ASuuWqV.exe
  C:\Windows\System\ASuuWqV.exe
  2⤵
  PID:9704
- C:\Windows\System\IKsNKie.exe
  C:\Windows\System\IKsNKie.exe
  2⤵
  PID:9724
- C:\Windows\System\oRACEdU.exe
  C:\Windows\System\oRACEdU.exe
  2⤵
  PID:9740
- C:\Windows\System\ehdBthX.exe
  C:\Windows\System\ehdBthX.exe
  2⤵
  PID:9764
- C:\Windows\System\uEQrntG.exe
  C:\Windows\System\uEQrntG.exe
  2⤵
  PID:9784
- C:\Windows\System\PFiftRz.exe
  C:\Windows\System\PFiftRz.exe
  2⤵
  PID:9800
- C:\Windows\System\JWkBrwE.exe
  C:\Windows\System\JWkBrwE.exe
  2⤵
  PID:9832
- C:\Windows\System\zvpPWhZ.exe
  C:\Windows\System\zvpPWhZ.exe
  2⤵
  PID:9856
- C:\Windows\System\ROyKoqa.exe
  C:\Windows\System\ROyKoqa.exe
  2⤵
  PID:9884
- C:\Windows\System\NPuxlns.exe
  C:\Windows\System\NPuxlns.exe
  2⤵
  PID:9952
- C:\Windows\System\fcJWRHy.exe
  C:\Windows\System\fcJWRHy.exe
  2⤵
  PID:9968
- C:\Windows\System\EDcnONR.exe
  C:\Windows\System\EDcnONR.exe
  2⤵
  PID:9988
- C:\Windows\System\jbaznpu.exe
  C:\Windows\System\jbaznpu.exe
  2⤵
  PID:10036
- C:\Windows\System\FxjSgpl.exe
  C:\Windows\System\FxjSgpl.exe
  2⤵
  PID:10064
- C:\Windows\System\wIsxvQU.exe
  C:\Windows\System\wIsxvQU.exe
  2⤵
  PID:10088
- C:\Windows\System\qVyTiBI.exe
  C:\Windows\System\qVyTiBI.exe
  2⤵
  PID:10112
- C:\Windows\System\lvQrazk.exe
  C:\Windows\System\lvQrazk.exe
  2⤵
  PID:10128
- C:\Windows\System\NbSKujo.exe
  C:\Windows\System\NbSKujo.exe
  2⤵
  PID:10152
- C:\Windows\System\FHNKiRE.exe
  C:\Windows\System\FHNKiRE.exe
  2⤵
  PID:10184
- C:\Windows\System\tHDdqQR.exe
  C:\Windows\System\tHDdqQR.exe
  2⤵
  PID:9144
- C:\Windows\System\BNAbVou.exe
  C:\Windows\System\BNAbVou.exe
  2⤵
  PID:8892
- C:\Windows\System\DZBlCuQ.exe
  C:\Windows\System\DZBlCuQ.exe
  2⤵
  PID:8604
- C:\Windows\System\FtcoHDS.exe
  C:\Windows\System\FtcoHDS.exe
  2⤵
  PID:9364
- C:\Windows\System\zOOMnbO.exe
  C:\Windows\System\zOOMnbO.exe
  2⤵
  PID:9304
- C:\Windows\System\cXeIDjw.exe
  C:\Windows\System\cXeIDjw.exe
  2⤵
  PID:9376
- C:\Windows\System\FLeIQpk.exe
  C:\Windows\System\FLeIQpk.exe
  2⤵
  PID:9416
- C:\Windows\System\ZVTYoNF.exe
  C:\Windows\System\ZVTYoNF.exe
  2⤵
  PID:9512
- C:\Windows\System\xgAVHbD.exe
  C:\Windows\System\xgAVHbD.exe
  2⤵
  PID:9552
- C:\Windows\System\AEXdozm.exe
  C:\Windows\System\AEXdozm.exe
  2⤵
  PID:9460
- C:\Windows\System\fQQlOcI.exe
  C:\Windows\System\fQQlOcI.exe
  2⤵
  PID:9676
- C:\Windows\System\MeiaaIT.exe
  C:\Windows\System\MeiaaIT.exe
  2⤵
  PID:9796
- C:\Windows\System\YIKxHTs.exe
  C:\Windows\System\YIKxHTs.exe
  2⤵
  PID:9844
- C:\Windows\System\rObzrRn.exe
  C:\Windows\System\rObzrRn.exe
  2⤵
  PID:9944
- C:\Windows\System\TUubYii.exe
  C:\Windows\System\TUubYii.exe
  2⤵
  PID:9980
- C:\Windows\System\bDNAJuI.exe
  C:\Windows\System\bDNAJuI.exe
  2⤵
  PID:10020
- C:\Windows\System\HCJqPkc.exe
  C:\Windows\System\HCJqPkc.exe
  2⤵
  PID:10104
- C:\Windows\System\qczGtKU.exe
  C:\Windows\System\qczGtKU.exe
  2⤵
  PID:10124
- C:\Windows\System\NCbLWPk.exe
  C:\Windows\System\NCbLWPk.exe
  2⤵
  PID:10180
- C:\Windows\System\qyCzwRs.exe
  C:\Windows\System\qyCzwRs.exe
  2⤵
  PID:9252
- C:\Windows\System\zgYHVap.exe
  C:\Windows\System\zgYHVap.exe
  2⤵
  PID:9644
- C:\Windows\System\hbVMTgk.exe
  C:\Windows\System\hbVMTgk.exe
  2⤵
  PID:9636
- C:\Windows\System\yBeSMpS.exe
  C:\Windows\System\yBeSMpS.exe
  2⤵
  PID:9880
- C:\Windows\System\ofVSYWQ.exe
  C:\Windows\System\ofVSYWQ.exe
  2⤵
  PID:9964
- C:\Windows\System\zCZCVln.exe
  C:\Windows\System\zCZCVln.exe
  2⤵
  PID:8980
- C:\Windows\System\LULeQRO.exe
  C:\Windows\System\LULeQRO.exe
  2⤵
  PID:9232
- C:\Windows\System\SqmLeNB.exe
  C:\Windows\System\SqmLeNB.exe
  2⤵
  PID:9872
- C:\Windows\System\TmwgJpa.exe
  C:\Windows\System\TmwgJpa.exe
  2⤵
  PID:10080
- C:\Windows\System\LuYbLYQ.exe
  C:\Windows\System\LuYbLYQ.exe
  2⤵
  PID:10252
- C:\Windows\System\KZwLKNt.exe
  C:\Windows\System\KZwLKNt.exe
  2⤵
  PID:10316
- C:\Windows\System\cpKZONP.exe
  C:\Windows\System\cpKZONP.exe
  2⤵
  PID:10340
- C:\Windows\System\YPPldVm.exe
  C:\Windows\System\YPPldVm.exe
  2⤵
  PID:10368
- C:\Windows\System\jmbbPKy.exe
  C:\Windows\System\jmbbPKy.exe
  2⤵
  PID:10392
- C:\Windows\System\zhStDmw.exe
  C:\Windows\System\zhStDmw.exe
  2⤵
  PID:10416
- C:\Windows\System\CGEoumW.exe
  C:\Windows\System\CGEoumW.exe
  2⤵
  PID:10444
- C:\Windows\System\cVpyXdm.exe
  C:\Windows\System\cVpyXdm.exe
  2⤵
  PID:10460
- C:\Windows\System\aUFjtfr.exe
  C:\Windows\System\aUFjtfr.exe
  2⤵
  PID:10500
- C:\Windows\System\pIvAxNR.exe
  C:\Windows\System\pIvAxNR.exe
  2⤵
  PID:10544
- C:\Windows\System\dmQboCF.exe
  C:\Windows\System\dmQboCF.exe
  2⤵
  PID:10572
- C:\Windows\System\VDzAtcK.exe
  C:\Windows\System\VDzAtcK.exe
  2⤵
  PID:10600
- C:\Windows\System\fVzCfGn.exe
  C:\Windows\System\fVzCfGn.exe
  2⤵
  PID:10620
- C:\Windows\System\LIVVfYc.exe
  C:\Windows\System\LIVVfYc.exe
  2⤵
  PID:10660
- C:\Windows\System\LVFVpyP.exe
  C:\Windows\System\LVFVpyP.exe
  2⤵
  PID:10684
- C:\Windows\System\IeyQchO.exe
  C:\Windows\System\IeyQchO.exe
  2⤵
  PID:10704
- C:\Windows\System\JNEYbam.exe
  C:\Windows\System\JNEYbam.exe
  2⤵
  PID:10724
- C:\Windows\System\xkMaztf.exe
  C:\Windows\System\xkMaztf.exe
  2⤵
  PID:10748
- C:\Windows\System\IhnKdgP.exe
  C:\Windows\System\IhnKdgP.exe
  2⤵
  PID:10768
- C:\Windows\System\QmRYoCn.exe
  C:\Windows\System\QmRYoCn.exe
  2⤵
  PID:10796
- C:\Windows\System\aEWSTTa.exe
  C:\Windows\System\aEWSTTa.exe
  2⤵
  PID:10836
- C:\Windows\System\YfhvWjG.exe
  C:\Windows\System\YfhvWjG.exe
  2⤵
  PID:10860
- C:\Windows\System\knLLplr.exe
  C:\Windows\System\knLLplr.exe
  2⤵
  PID:10876
- C:\Windows\System\uDlTwdd.exe
  C:\Windows\System\uDlTwdd.exe
  2⤵
  PID:10892
- C:\Windows\System\nEZmVqC.exe
  C:\Windows\System\nEZmVqC.exe
  2⤵
  PID:10916
- C:\Windows\System\XeHsPuv.exe
  C:\Windows\System\XeHsPuv.exe
  2⤵
  PID:10936
- C:\Windows\System\XRxGNIM.exe
  C:\Windows\System\XRxGNIM.exe
  2⤵
  PID:10980
- C:\Windows\System\soaBMSO.exe
  C:\Windows\System\soaBMSO.exe
  2⤵
  PID:11000
- C:\Windows\System\GBXysgC.exe
  C:\Windows\System\GBXysgC.exe
  2⤵
  PID:11028
- C:\Windows\System\PyNdLBh.exe
  C:\Windows\System\PyNdLBh.exe
  2⤵
  PID:11056
- C:\Windows\System\sbBYkjG.exe
  C:\Windows\System\sbBYkjG.exe
  2⤵
  PID:11080
- C:\Windows\System\OVLRkPS.exe
  C:\Windows\System\OVLRkPS.exe
  2⤵
  PID:11100
- C:\Windows\System\dvwsrqv.exe
  C:\Windows\System\dvwsrqv.exe
  2⤵
  PID:11180
- C:\Windows\System\MnJUFOV.exe
  C:\Windows\System\MnJUFOV.exe
  2⤵
  PID:11204
- C:\Windows\System\zpQiPqY.exe
  C:\Windows\System\zpQiPqY.exe
  2⤵
  PID:11224
- C:\Windows\System\AmfnBzd.exe
  C:\Windows\System\AmfnBzd.exe
  2⤵
  PID:11256
- C:\Windows\System\BDBXIll.exe
  C:\Windows\System\BDBXIll.exe
  2⤵
  PID:10012
- C:\Windows\System\UTuxNns.exe
  C:\Windows\System\UTuxNns.exe
  2⤵
  PID:10360
- C:\Windows\System\sqzSqgZ.exe
  C:\Windows\System\sqzSqgZ.exe
  2⤵
  PID:10428
- C:\Windows\System\TEKcKhR.exe
  C:\Windows\System\TEKcKhR.exe
  2⤵
  PID:10452
- C:\Windows\System\AHAgwbH.exe
  C:\Windows\System\AHAgwbH.exe
  2⤵
  PID:10536
- C:\Windows\System\ztdssxf.exe
  C:\Windows\System\ztdssxf.exe
  2⤵
  PID:10640
- C:\Windows\System\UqmnUCO.exe
  C:\Windows\System\UqmnUCO.exe
  2⤵
  PID:10700
- C:\Windows\System\ChFOcav.exe
  C:\Windows\System\ChFOcav.exe
  2⤵
  PID:10764
- C:\Windows\System\jZxydSC.exe
  C:\Windows\System\jZxydSC.exe
  2⤵
  PID:10788
- C:\Windows\System\MwzogvO.exe
  C:\Windows\System\MwzogvO.exe
  2⤵
  PID:10852
- C:\Windows\System\NFOWrfG.exe
  C:\Windows\System\NFOWrfG.exe
  2⤵
  PID:10912
- C:\Windows\System\gfbeNUJ.exe
  C:\Windows\System\gfbeNUJ.exe
  2⤵
  PID:10988
- C:\Windows\System\KkDxyPw.exe
  C:\Windows\System\KkDxyPw.exe
  2⤵
  PID:11072
- C:\Windows\System\HgdjmKv.exe
  C:\Windows\System\HgdjmKv.exe
  2⤵
  PID:11092
- C:\Windows\System\ozBZuAU.exe
  C:\Windows\System\ozBZuAU.exe
  2⤵
  PID:11064
- C:\Windows\System\sLQiaLX.exe
  C:\Windows\System\sLQiaLX.exe
  2⤵
  PID:11216
- C:\Windows\System\QNGDTAg.exe
  C:\Windows\System\QNGDTAg.exe
  2⤵
  PID:9984
- C:\Windows\System\vNtIZLi.exe
  C:\Windows\System\vNtIZLi.exe
  2⤵
  PID:10404
- C:\Windows\System\EUhdqxJ.exe
  C:\Windows\System\EUhdqxJ.exe
  2⤵
  PID:10532
- C:\Windows\System\OUBfthU.exe
  C:\Windows\System\OUBfthU.exe
  2⤵
  PID:10616
- C:\Windows\System\jLDuuAq.exe
  C:\Windows\System\jLDuuAq.exe
  2⤵
  PID:10740
- C:\Windows\System\SPYmHfB.exe
  C:\Windows\System\SPYmHfB.exe
  2⤵
  PID:10832
- C:\Windows\System\LAeRIAt.exe
  C:\Windows\System\LAeRIAt.exe
  2⤵
  PID:10904
- C:\Windows\System\QhjKzON.exe
  C:\Windows\System\QhjKzON.exe
  2⤵
  PID:9912
- C:\Windows\System\YSynnPT.exe
  C:\Windows\System\YSynnPT.exe
  2⤵
  PID:11168
- C:\Windows\System\hnWlnOy.exe
  C:\Windows\System\hnWlnOy.exe
  2⤵
  PID:10872
- C:\Windows\System\SMOIMTV.exe
  C:\Windows\System\SMOIMTV.exe
  2⤵
  PID:11008
- C:\Windows\System\rXzxgBZ.exe
  C:\Windows\System\rXzxgBZ.exe
  2⤵
  PID:11268
- C:\Windows\System\tRrOsXW.exe
  C:\Windows\System\tRrOsXW.exe
  2⤵
  PID:11296
- C:\Windows\System\vNNKhqF.exe
  C:\Windows\System\vNNKhqF.exe
  2⤵
  PID:11340
- C:\Windows\System\ffsJOJg.exe
  C:\Windows\System\ffsJOJg.exe
  2⤵
  PID:11360
- C:\Windows\System\EFjZGne.exe
  C:\Windows\System\EFjZGne.exe
  2⤵
  PID:11384
- C:\Windows\System\UapGntj.exe
  C:\Windows\System\UapGntj.exe
  2⤵
  PID:11412
- C:\Windows\System\ANWSoch.exe
  C:\Windows\System\ANWSoch.exe
  2⤵
  PID:11436
- C:\Windows\System\RsbWKCu.exe
  C:\Windows\System\RsbWKCu.exe
  2⤵
  PID:11456
- C:\Windows\System\BCKVypM.exe
  C:\Windows\System\BCKVypM.exe
  2⤵
  PID:11488
- C:\Windows\System\AwjXHQH.exe
  C:\Windows\System\AwjXHQH.exe
  2⤵
  PID:11512
- C:\Windows\System\EQpnDDA.exe
  C:\Windows\System\EQpnDDA.exe
  2⤵
  PID:11528
- C:\Windows\System\fkaMNOC.exe
  C:\Windows\System\fkaMNOC.exe
  2⤵
  PID:11552
- C:\Windows\System\hQisRGW.exe
  C:\Windows\System\hQisRGW.exe
  2⤵
  PID:11584
- C:\Windows\System\hzeaKMF.exe
  C:\Windows\System\hzeaKMF.exe
  2⤵
  PID:11616
- C:\Windows\System\sRVERoZ.exe
  C:\Windows\System\sRVERoZ.exe
  2⤵
  PID:11652
- C:\Windows\System\FNWJbgV.exe
  C:\Windows\System\FNWJbgV.exe
  2⤵
  PID:11716
- C:\Windows\System\OfAEVyp.exe
  C:\Windows\System\OfAEVyp.exe
  2⤵
  PID:11748
- C:\Windows\System\FKyFdRH.exe
  C:\Windows\System\FKyFdRH.exe
  2⤵
  PID:11784
- C:\Windows\System\XoTwKUs.exe
  C:\Windows\System\XoTwKUs.exe
  2⤵
  PID:11800
- C:\Windows\System\fBPIBzJ.exe
  C:\Windows\System\fBPIBzJ.exe
  2⤵
  PID:11820
- C:\Windows\System\FlnxSXy.exe
  C:\Windows\System\FlnxSXy.exe
  2⤵
  PID:11868
- C:\Windows\System\BreNaDj.exe
  C:\Windows\System\BreNaDj.exe
  2⤵
  PID:11888
- C:\Windows\System\kjRMKAC.exe
  C:\Windows\System\kjRMKAC.exe
  2⤵
  PID:11920
- C:\Windows\System\ZStXQIa.exe
  C:\Windows\System\ZStXQIa.exe
  2⤵
  PID:11956
- C:\Windows\System\KzhRSEH.exe
  C:\Windows\System\KzhRSEH.exe
  2⤵
  PID:11972
- C:\Windows\System\HCqRLHP.exe
  C:\Windows\System\HCqRLHP.exe
  2⤵
  PID:12000
- C:\Windows\System\RhteZFv.exe
  C:\Windows\System\RhteZFv.exe
  2⤵
  PID:12024
- C:\Windows\System\YavUNbC.exe
  C:\Windows\System\YavUNbC.exe
  2⤵
  PID:12040
- C:\Windows\System\qnwySUx.exe
  C:\Windows\System\qnwySUx.exe
  2⤵
  PID:12076
- C:\Windows\System\iTaluhO.exe
  C:\Windows\System\iTaluhO.exe
  2⤵
  PID:12124
- C:\Windows\System\ueQMMPF.exe
  C:\Windows\System\ueQMMPF.exe
  2⤵
  PID:12148
- C:\Windows\System\wcBtchX.exe
  C:\Windows\System\wcBtchX.exe
  2⤵
  PID:12164
- C:\Windows\System\HnZXhbe.exe
  C:\Windows\System\HnZXhbe.exe
  2⤵
  PID:12184
- C:\Windows\System\hooFubP.exe
  C:\Windows\System\hooFubP.exe
  2⤵
  PID:12216
- C:\Windows\System\sYIxTVj.exe
  C:\Windows\System\sYIxTVj.exe
  2⤵
  PID:12236
- C:\Windows\System\vnejhQe.exe
  C:\Windows\System\vnejhQe.exe
  2⤵
  PID:12252
- C:\Windows\System\owVbbdN.exe
  C:\Windows\System\owVbbdN.exe
  2⤵
  PID:11248
- C:\Windows\System\LTObrFv.exe
  C:\Windows\System\LTObrFv.exe
  2⤵
  PID:11352
- C:\Windows\System\JsIoqYb.exe
  C:\Windows\System\JsIoqYb.exe
  2⤵
  PID:11408
- C:\Windows\System\CpTpyJL.exe
  C:\Windows\System\CpTpyJL.exe
  2⤵
  PID:11548
- C:\Windows\System\AOlRRAa.exe
  C:\Windows\System\AOlRRAa.exe
  2⤵
  PID:11580
- C:\Windows\System\dCwbcMz.exe
  C:\Windows\System\dCwbcMz.exe
  2⤵
  PID:11600
- C:\Windows\System\iUOObcL.exe
  C:\Windows\System\iUOObcL.exe
  2⤵
  PID:11632
- C:\Windows\System\lqKrite.exe
  C:\Windows\System\lqKrite.exe
  2⤵
  PID:11744
- C:\Windows\System\QcVfPqw.exe
  C:\Windows\System\QcVfPqw.exe
  2⤵
  PID:8280
- C:\Windows\System\wlqsdAg.exe
  C:\Windows\System\wlqsdAg.exe
  2⤵
  PID:11932
- C:\Windows\System\rNbRhIM.exe
  C:\Windows\System\rNbRhIM.exe
  2⤵
  PID:12008
- C:\Windows\System\QIitSqT.exe
  C:\Windows\System\QIitSqT.exe
  2⤵
  PID:11980
- C:\Windows\System\iPszAWZ.exe
  C:\Windows\System\iPszAWZ.exe
  2⤵
  PID:12072
- C:\Windows\System\rHOHYcz.exe
  C:\Windows\System\rHOHYcz.exe
  2⤵
  PID:12140
- C:\Windows\System\DhePJDm.exe
  C:\Windows\System\DhePJDm.exe
  2⤵
  PID:12192
- C:\Windows\System\kbUHwVn.exe
  C:\Windows\System\kbUHwVn.exe
  2⤵
  PID:12260
- C:\Windows\System\IcGqqYa.exe
  C:\Windows\System\IcGqqYa.exe
  2⤵
  PID:11112
- C:\Windows\System\sJmiTNm.exe
  C:\Windows\System\sJmiTNm.exe
  2⤵
  PID:11288
- C:\Windows\System\Lvzbtbi.exe
  C:\Windows\System\Lvzbtbi.exe
  2⤵
  PID:11380
- C:\Windows\System\LpMGsia.exe
  C:\Windows\System\LpMGsia.exe
  2⤵
  PID:11572
- C:\Windows\System\RDLtYSB.exe
  C:\Windows\System\RDLtYSB.exe
  2⤵
  PID:11848
- C:\Windows\System\UdjUZJb.exe
  C:\Windows\System\UdjUZJb.exe
  2⤵
  PID:12068
- C:\Windows\System\JpBHWrR.exe
  C:\Windows\System\JpBHWrR.exe
  2⤵
  PID:12136
- C:\Windows\System\jvqiRGO.exe
  C:\Windows\System\jvqiRGO.exe
  2⤵
  PID:12224
- C:\Windows\System\oUOhojm.exe
  C:\Windows\System\oUOhojm.exe
  2⤵
  PID:11704
- C:\Windows\System\gGGJqTJ.exe
  C:\Windows\System\gGGJqTJ.exe
  2⤵
  PID:11640
- C:\Windows\System\pnpBeRf.exe
  C:\Windows\System\pnpBeRf.exe
  2⤵
  PID:12308
- C:\Windows\System\ifZtshO.exe
  C:\Windows\System\ifZtshO.exe
  2⤵
  PID:12324
- C:\Windows\System\pUNfYrm.exe
  C:\Windows\System\pUNfYrm.exe
  2⤵
  PID:12344
- C:\Windows\System\CTrkGOv.exe
  C:\Windows\System\CTrkGOv.exe
  2⤵
  PID:12380
- C:\Windows\System\tHhkmwX.exe
  C:\Windows\System\tHhkmwX.exe
  2⤵
  PID:12420
- C:\Windows\System\oWenezz.exe
  C:\Windows\System\oWenezz.exe
  2⤵
  PID:12460
- C:\Windows\System\cFphxZu.exe
  C:\Windows\System\cFphxZu.exe
  2⤵
  PID:12500
- C:\Windows\System\MGmWkmW.exe
  C:\Windows\System\MGmWkmW.exe
  2⤵
  PID:12540
- C:\Windows\System\JgyUZMT.exe
  C:\Windows\System\JgyUZMT.exe
  2⤵
  PID:12568
- C:\Windows\System\VAQDZpU.exe
  C:\Windows\System\VAQDZpU.exe
  2⤵
  PID:12592
- C:\Windows\System\xmOFFIX.exe
  C:\Windows\System\xmOFFIX.exe
  2⤵
  PID:12608
- C:\Windows\System\FmZGwMK.exe
  C:\Windows\System\FmZGwMK.exe
  2⤵
  PID:12636
- C:\Windows\System\zbUhwKT.exe
  C:\Windows\System\zbUhwKT.exe
  2⤵
  PID:12656
- C:\Windows\System\TtTzrsZ.exe
  C:\Windows\System\TtTzrsZ.exe
  2⤵
  PID:12684
- C:\Windows\System\lsXvndZ.exe
  C:\Windows\System\lsXvndZ.exe
  2⤵
  PID:12704
- C:\Windows\System\NqgeWZi.exe
  C:\Windows\System\NqgeWZi.exe
  2⤵
  PID:12732
- C:\Windows\System\gmJCszX.exe
  C:\Windows\System\gmJCszX.exe
  2⤵
  PID:12768
- C:\Windows\System\cstwfnS.exe
  C:\Windows\System\cstwfnS.exe
  2⤵
  PID:12792
- C:\Windows\System\WTJSfpl.exe
  C:\Windows\System\WTJSfpl.exe
  2⤵
  PID:12816
- C:\Windows\System\ZpOVzQE.exe
  C:\Windows\System\ZpOVzQE.exe
  2⤵
  PID:12840
- C:\Windows\System\BlIGAHx.exe
  C:\Windows\System\BlIGAHx.exe
  2⤵
  PID:12864
- C:\Windows\System\EwljiBy.exe
  C:\Windows\System\EwljiBy.exe
  2⤵
  PID:12900
- C:\Windows\System\yVLirFR.exe
  C:\Windows\System\yVLirFR.exe
  2⤵
  PID:12948
- C:\Windows\System\qmaUliZ.exe
  C:\Windows\System\qmaUliZ.exe
  2⤵
  PID:12972
- C:\Windows\System\bWgySjV.exe
  C:\Windows\System\bWgySjV.exe
  2⤵
  PID:13000
- C:\Windows\System\ngNCdwV.exe
  C:\Windows\System\ngNCdwV.exe
  2⤵
  PID:13040
- C:\Windows\System\VwKZVFX.exe
  C:\Windows\System\VwKZVFX.exe
  2⤵
  PID:13076
- C:\Windows\System\MnuyYto.exe
  C:\Windows\System\MnuyYto.exe
  2⤵
  PID:13092
- C:\Windows\System\HydSpJD.exe
  C:\Windows\System\HydSpJD.exe
  2⤵
  PID:13112
- C:\Windows\System\IXUrejd.exe
  C:\Windows\System\IXUrejd.exe
  2⤵
  PID:13132
- C:\Windows\System\RoUvLjQ.exe
  C:\Windows\System\RoUvLjQ.exe
  2⤵
  PID:13196
- C:\Windows\System\ZOMytcC.exe
  C:\Windows\System\ZOMytcC.exe
  2⤵
  PID:13252
- C:\Windows\System\UeXwNDD.exe
  C:\Windows\System\UeXwNDD.exe
  2⤵
  PID:13280
- C:\Windows\System\USyQZDn.exe
  C:\Windows\System\USyQZDn.exe
  2⤵
  PID:13296
- C:\Windows\System\TkPWvWo.exe
  C:\Windows\System\TkPWvWo.exe
  2⤵
  PID:12272
- C:\Windows\System\drxhsYG.exe
  C:\Windows\System\drxhsYG.exe
  2⤵
  PID:12320
- C:\Windows\System\YnscvNz.exe
  C:\Windows\System\YnscvNz.exe
  2⤵
  PID:11332
- C:\Windows\System\OyQVYrK.exe
  C:\Windows\System\OyQVYrK.exe
  2⤵
  PID:12372
- C:\Windows\System\oXirEkY.exe
  C:\Windows\System\oXirEkY.exe
  2⤵
  PID:12408
- C:\Windows\System\RnLEmfz.exe
  C:\Windows\System\RnLEmfz.exe
  2⤵
  PID:12476
- C:\Windows\System\kaNwkgA.exe
  C:\Windows\System\kaNwkgA.exe
  2⤵
  PID:12552
- C:\Windows\System\MepbEbb.exe
  C:\Windows\System\MepbEbb.exe
  2⤵
  PID:12584
- C:\Windows\System\jFfvMNI.exe
  C:\Windows\System\jFfvMNI.exe
  2⤵
  PID:12620
- C:\Windows\System\LYeCaoq.exe
  C:\Windows\System\LYeCaoq.exe
  2⤵
  PID:12700
- C:\Windows\System\ZZkQZmG.exe
  C:\Windows\System\ZZkQZmG.exe
  2⤵
  PID:12748
- C:\Windows\System\ZdSkYLg.exe
  C:\Windows\System\ZdSkYLg.exe
  2⤵
  PID:12932
- C:\Windows\System\zcKnQrJ.exe
  C:\Windows\System\zcKnQrJ.exe
  2⤵
  PID:12964
- C:\Windows\System\UxaEhbn.exe
  C:\Windows\System\UxaEhbn.exe
  2⤵
  PID:13024
- C:\Windows\System\gyXnfQT.exe
  C:\Windows\System\gyXnfQT.exe
  2⤵
  PID:13088
- C:\Windows\System\LRUQXdQ.exe
  C:\Windows\System\LRUQXdQ.exe
  2⤵
  PID:13144
- C:\Windows\System\gAVBkju.exe
  C:\Windows\System\gAVBkju.exe
  2⤵
  PID:13216
- C:\Windows\System\SHTFdZC.exe
  C:\Windows\System\SHTFdZC.exe
  2⤵
  PID:13272
- C:\Windows\System\TwfPGYp.exe
  C:\Windows\System\TwfPGYp.exe
  2⤵
  PID:13228
- C:\Windows\System\rKXLbwI.exe
  C:\Windows\System\rKXLbwI.exe
  2⤵
  PID:11724
- C:\Windows\System\GcsSQBs.exe
  C:\Windows\System\GcsSQBs.exe
  2⤵
  PID:12352
- C:\Windows\System\fEamRFZ.exe
  C:\Windows\System\fEamRFZ.exe
  2⤵
  PID:12456
- C:\Windows\System\ZpgoSkb.exe
  C:\Windows\System\ZpgoSkb.exe
  2⤵
  PID:12652
- C:\Windows\System\DIJGIIj.exe
  C:\Windows\System\DIJGIIj.exe
  2⤵
  PID:12668
- C:\Windows\System\Xutjamz.exe
  C:\Windows\System\Xutjamz.exe
  2⤵
  PID:12828
- C:\Windows\System\pNtRrnj.exe
  C:\Windows\System\pNtRrnj.exe
  2⤵
  PID:13064
- C:\Windows\System\QZwnsWd.exe
  C:\Windows\System\QZwnsWd.exe
  2⤵
  PID:13212
- C:\Windows\System\auBnqWg.exe
  C:\Windows\System\auBnqWg.exe
  2⤵
  PID:12296
- C:\Windows\System\dyTvIjb.exe
  C:\Windows\System\dyTvIjb.exe
  2⤵
  PID:13292
- C:\Windows\System\WDfBRpF.exe
  C:\Windows\System\WDfBRpF.exe
  2⤵
  PID:12520
- C:\Windows\System\UvDepqm.exe
  C:\Windows\System\UvDepqm.exe
  2⤵
  PID:12824
- C:\Windows\System\iJFwbbC.exe
  C:\Windows\System\iJFwbbC.exe
  2⤵
  PID:13120
- C:\Windows\System\iuyXYHR.exe
  C:\Windows\System\iuyXYHR.exe
  2⤵
  PID:13164
- C:\Windows\System\JHKmABn.exe
  C:\Windows\System\JHKmABn.exe
  2⤵
  PID:13356
- C:\Windows\System\cIipuBy.exe
  C:\Windows\System\cIipuBy.exe
  2⤵
  PID:13400
- C:\Windows\System\lwAinfH.exe
  C:\Windows\System\lwAinfH.exe
  2⤵
  PID:13436
- C:\Windows\System\QoQAjQZ.exe
  C:\Windows\System\QoQAjQZ.exe
  2⤵
  PID:13452
- C:\Windows\System\GKODxpa.exe
  C:\Windows\System\GKODxpa.exe
  2⤵
  PID:13504
- C:\Windows\System\YUBOPOT.exe
  C:\Windows\System\YUBOPOT.exe
  2⤵
  PID:13528
- C:\Windows\System\ebWXWhT.exe
  C:\Windows\System\ebWXWhT.exe
  2⤵
  PID:13544
- C:\Windows\System\GnYYnvJ.exe
  C:\Windows\System\GnYYnvJ.exe
  2⤵
  PID:13620
- C:\Windows\System\oBDKoml.exe
  C:\Windows\System\oBDKoml.exe
  2⤵
  PID:13636
- C:\Windows\System\UoQXbJA.exe
  C:\Windows\System\UoQXbJA.exe
  2⤵
  PID:13660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opvxa1xt.gur.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BqlXnYm.exe

Filesize
1.7MB

MD5
3139b750ac5e71a3be879849ff8982a5

SHA1
d8d61e16714c8d7ddea645ce4e7128bac8dafb3e

SHA256
e4862eefcf84bb2c17620999b8088000a09fa58a901ea47a62008226123d2399

SHA512
b2292bc54c416949d90b6b8cc611424a50e36c04db7096b74601773b7fdf8fccb0028dbac3c5bdfe1353cdfe42add9d94cf3149e10cda631734e45201c945e6f

Download Submit
C:\Windows\System\DiIFsLa.exe

Filesize
1.7MB

MD5
65f6d0ca639aba7ea180986a309ee5d5

SHA1
7876b49c9110eb97bf039102089521d082279c29

SHA256
f1b86c4e83982fe81c229fd647f91307563b28611d34dde4389b13575cfeb3e5

SHA512
f320c9a848402ecd47189750ec2b29bc21968077d02dc0b36e361586d42a3982c28587caf557e51c1749b6fb23063aab2d35eab1bfadd68418480395113a5770

Download Submit
C:\Windows\System\GXxemYN.exe

Filesize
1.7MB

MD5
4d99621f722d45e388cf98b8945b36b8

SHA1
5d8a437cbec9622951528ad486b557f674a8d229

SHA256
f6c6998aaabeee4735dab97c9b66eabc6dc0b1102b532992b6608272be80148f

SHA512
c133b6f17207b73cf93ea98932f94e049b6f1000739543265116e0dbea7b1b0d736183a4458ba2794e0e30ae8cac1ea04a232593435a39e9786503c37a7a9dbf

Download Submit
C:\Windows\System\HBgqSYv.exe

Filesize
1.7MB

MD5
3e9b72be4006bb69b82247eb0e5f9e5c

SHA1
c6d151887cf7b8621bd39ff6e1bb4f66f66e9459

SHA256
2992ed3c9dd98a1efdcf1d67e9b7eacfdce0565defb4e9bfb2aef0567bb14e35

SHA512
cd2a6a8a30009217519c3a25da0dcc6fe78bea00a4d457597a6027bf700897b84e533e04ea7d5dd7c691199b89fc0372d2ab9528ebc9e5ecf82a0810058abf58

Download Submit
C:\Windows\System\IUqUxMT.exe

Filesize
1.7MB

MD5
375cc85b5d77c9fcd9bdf156f8235573

SHA1
b2462f794f1ab7465e29d0cc60a605ab839833fb

SHA256
46f9bc94efc5e10fe1604c1f9cf78e1feb8cd2a3d0ba606a5c285b3f2429d014

SHA512
11904b2484165e01187479cd68cbd8895a5d2efc27cc0792d6c49084b83aef8e77db5ef83aaf032ea68db6403e2b3bb775480a6d93190ab5507284978b571597

Download Submit
C:\Windows\System\ImZsXnL.exe

Filesize
1.7MB

MD5
e101689a0d66f7181ec4a348ae33512c

SHA1
737d93837367b1088549040468108d7fc7515923

SHA256
d13d9c08bbaf94a97493fe329cb9af4cbd6369ec1398a2e441ae78cedc79fbed

SHA512
1ae198da3b38953ead3713568bf6a5a13fd3760d2d625df338d7bd1aa9a612ef34e1db3911ee3c418883246475f65f3dda9fb8f0a2afb6a8cc2f499322c3e314

Download Submit
C:\Windows\System\IpTuReN.exe

Filesize
1.7MB

MD5
050cff37686a9594afce143a214e2c9b

SHA1
06daaf08c7fcc10994ad561c5aae2c1f9923a1c7

SHA256
b69b9c6546f0605972590665a280f5c1546b4526c5f555eba57497a757b55196

SHA512
644fe26cd95fe6b97136d2d601e4c36a3dff463ff6eb1823853a3b20fe63a505175385241d6c6814ba4b974e71a4264b54649450b124a089840b826892a192d1

Download Submit
C:\Windows\System\JcnumTI.exe

Filesize
1.7MB

MD5
a8069d2db72c029d72ca61d4d6ea3ea4

SHA1
7abdc71427e3805854cd5c57dc6d14ecaac61b8e

SHA256
a051c4f6d39eceb3f9dcff2219f4e9a5cbbc6468b6a08ce2f26ef45e3d477148

SHA512
c0253c422be319ab7b9e9a99105a4efed88e1f81203ead6b9e5ab57566f6f1b3bffd235581dc79e98e653b04dcf1d2fbec6bf15a3b42bcbf741817f2563033df

Download Submit
C:\Windows\System\MWStDTl.exe

Filesize
1.7MB

MD5
52e959e48041d867c202beb013647491

SHA1
bd47a26e2af9614faf92d50185c084e49beb34f9

SHA256
5243965e802eff26aa252c39376c56e0fa3ad755b771fc41965c1b50153c0201

SHA512
0ddf63e28036370814b5054ad0a04a69515e3bc49b4d73f57f6633bfeb51032b722a48a925e5415246d05aa232cd52a593d8860d754b0eaa763216a46761da11

Download Submit
C:\Windows\System\NgzYGJZ.exe

Filesize
1.7MB

MD5
3565e7c8ae976d5ba7eed31171d99694

SHA1
64aefa5d9cc49809fc3a2dd5ad5cd6fd34602a55

SHA256
363024bc70ca8b23c3d2535054cfdaca35a4e866e75e49eb214e09548cd30a20

SHA512
961380d6a52dda7cb77078cc3107f700333fdc96261fa61416ef87d6ea5aa5eb9dcaf515876ad994356deaac8816e7501b5df63c4557c31a2e8b5ff07bea18f5

Download Submit
C:\Windows\System\NneOjKn.exe

Filesize
1.7MB

MD5
dc9715f910f1cdb8ee7a06e2f7729422

SHA1
869094eb11ea42568b34df9f276c5ca3bcfa6129

SHA256
c70f206b9348a2e8ee91d49f509d7b77ce6913f83ca7e79fc949afc363591b78

SHA512
6a7db78f8fce7f9c819930b5253f075576ff93ee7281c0160cb5a570fd799b1d98596e74e18831c1ce39262695d50bd0c11dc308c1c96e10da6d5012d86b9e0b

Download Submit
C:\Windows\System\OiVXbTh.exe

Filesize
1.7MB

MD5
dd2259ac4a8cdea3f1ecc82c55e2b53f

SHA1
948a6e1f5b2d048dff4d5dcfc74b56c301e4fd63

SHA256
7ca0790be465974886beab02efc6080e124819257a660c8613b719af6d036ba4

SHA512
8e136ba487b478cde5698a9859908444f9f6910f25555dd7026947d3e48e70c768448c78487b53c90306f11d8856d8660bad0d200552d06eac3b336381bb9f5f

Download Submit
C:\Windows\System\Ralpoew.exe

Filesize
1.7MB

MD5
e94b827a7fd7b27d863b72a815f6b178

SHA1
990343af306ac2adb34f3933c81f7293547266e2

SHA256
147ec68690323df385e465ada18486c0e408fff43c8917cca146b269f5733940

SHA512
fc61bc86584ef98d4c5cd2702a9045da8416946f99b290286ca03b59e78c49c9658eebf8d3b67f80a926d0a55dddc06ce91bd8b9eda2ac1901beeb8416aba80d

Download Submit
C:\Windows\System\RmebvdX.exe

Filesize
1.7MB

MD5
548753f8aeb766724c70719f1f127545

SHA1
2969f80229890fc8110d565efedb7d407745f3ba

SHA256
f2100d40dcb89354bc843785e3c277b1198be11b34694e6175d5bdaaf6696fec

SHA512
87b36eb752a8b85718ef0b5b2a7c986f54c15c77b6946e786b219d77cc162249b75f6f75f119a9b8270b4ed8c1c2110b8d0e62de7261130b0e9b483168d4300c

Download Submit
C:\Windows\System\ThLvwpv.exe

Filesize
1.7MB

MD5
7508b399876a467e33dfdd95dc81a9cc

SHA1
1046ecfe2b6bbd84984738983e99bdc80339484f

SHA256
e9dd587d1c2186290fbd5fe52da87df57786258e66889aecbb9f896d2764ee8d

SHA512
854ee17b2b25636aefeea46ffab297183bb27b3d2e1338f8054e7872e0f1d7903c20ea41590e83e5685dc261bb0d8714fc33027055700ad609f363adf5a4acf7

Download Submit
C:\Windows\System\TqCDJKw.exe

Filesize
1.7MB

MD5
ad75b845ec13eaed65daeef64ba1967c

SHA1
a1895cce79b6fc6cb4d3e891900bc28e66744e33

SHA256
c0d067952f43a7f1609825e66e5f42803c2b95a48a3b8802dfa4e2527238bbec

SHA512
9a7505065a200352c60a19779f19e99edcc83e4bf6e66f3cb96e89f48c342409f2cedc0a95c5b21cea47f852f9d8b26fe6a3dcf6a8c37458a234b37441449d78

Download Submit
C:\Windows\System\UGSsrfH.exe

Filesize
1.7MB

MD5
52e0bafa3367dc7785984f6d13b6d9b3

SHA1
7cc34a734d1a39d8393f66995a2e0049dbe8a19e

SHA256
daf9edb9778fb330e2f1b2147fbd2e4cb9a23e8b8e93593891ca6c500d5be825

SHA512
7e90cd958ea0e20f28a22b8a73c0063b83a4e78de0cd92fd677620bac30dc3b5125483a917b817f4daab23a0a871b0877bcbddd373d35cd3f4a4088de4d3355f

Download Submit
C:\Windows\System\UftWnvf.exe

Filesize
1.7MB

MD5
9fdee4768a265f3942d53c2a5e9b20eb

SHA1
eb39b7a02e80d0eeeb215e1d31961eb3c759a732

SHA256
7ddac263d9d4da0b1a0e59b077344c97fd32acd6f6ab0017f4c2664791496d95

SHA512
97d6df95b2b76655e73076b8366fe210794bc7c1d602a9df33b7391d5cb993f16f7548af94a58720d45e735c7df1304752a448c2e988a06f4c1a565f2bf26952

Download Submit
C:\Windows\System\YLWshOn.exe

Filesize
1.7MB

MD5
859b8f2a547c36782388e6c9a18c92d8

SHA1
75af46a22456c7ffe317da7fee683672b47b3f33

SHA256
ab01638a08666b6ffbcee84cfdb0c54af29285c5071ddf4f59e09e5605f50e07

SHA512
856ab7f277d80ffa23f66f7df639cf72b6ff7d07bfaee35e78387368bb7aa13612641c856440452afa2564b024ed5131581f870f46bebf6ff43f11f6543ec5cf

Download Submit
C:\Windows\System\YLlvkUt.exe

Filesize
1.7MB

MD5
d73df4dee3edf086c8b297286d0f8ab5

SHA1
2a840ae9580072cc13aac242a3280c5358ffddd1

SHA256
1dd5d4a97b4630f8703b70b50f64e8f769b957d58f8e288bb6eac02218834a26

SHA512
bb3546913d48ac2194e7c853fafb05f811458543392d3ba86465331c03473ac765b15d205596df4d492f5d2c8fcfb621ecb5c3a93236fb3850e22347baf381ea

Download Submit
C:\Windows\System\aZqGxgO.exe

Filesize
1.7MB

MD5
d34c658208618897b1f9531070a95ffb

SHA1
2315febb2239325817adb0b4263f485f45e1fbaa

SHA256
641f933d54c7d9a7fd5b2633643d3e748379e9977d9bf9b1ae84b052edabe7a4

SHA512
733b54f478e58c0b4d7149a501319b7fd04558bc9cdd07ea998ce16508e7acc4927f1a89e5d2f951ab1514a1296a0b53df46cc8cd60e5bc9b11c1d91e35aa6c8

Download Submit
C:\Windows\System\bWfUgxi.exe

Filesize
1.7MB

MD5
530f952f6a3566378545f3cf931bbc31

SHA1
16f70e805d80fa26ec5f01a67dea762c5be1b5c9

SHA256
1cbdb1129633bb43a9199e05a9ba96919d02acc679f77e65c1430781649aa18f

SHA512
07a4f82895b32fee76ddf9c6c91895af6d7b3a611353ed2de02f0249b180adf0512171752bc34efd9744243a8052a33c0b7b8ae5e0875d936a331ff9c67a9fbb

Download Submit
C:\Windows\System\bxtFoPo.exe

Filesize
1.7MB

MD5
d49ede348f6c06c476e384bff0bf9b9d

SHA1
b79af1d53cf64bec3b928f501079ae2630af066b

SHA256
5b8d59ca5b5f61ceeba134eaafa1af52a4dad78e35e411a0653944fc2e791853

SHA512
d7129476c9c3704d9a7200e383059691f302676d611d9d0c2efeb2594775e16b51f9a702df7e2ac6db9207ab2448e908aed63c5ad4c6102781d932bca858f0a7

Download Submit
C:\Windows\System\fBBiknz.exe

Filesize
1.7MB

MD5
e2e5bce10b85eace892b1768616be453

SHA1
978c04860bc5b17ea15dd240e0cbb449901ae13f

SHA256
644dc4aa509e222db4f0f149b784b386671af9d2787982fafdac5405ba6a05e9

SHA512
452015f38ccaa11f7e2cd0d368dd2d103ec333b644ff437fc7498172b98604cf2194c6c146c39c2145f2387120987a4d13ec5a438cd266ee82ebf2ddc8a60829

Download Submit
C:\Windows\System\gLoFIhL.exe

Filesize
1.7MB

MD5
34b25cb1b7b26eabcd9bc95760c3e7b0

SHA1
5996173491b83a15276ba92c35478b78713bc146

SHA256
788be3cd5739c854120abc185b5d8fdb288ee181dcdbcaceb97226930b71be2d

SHA512
7bfd9a3fcea91a8eff2844d54349c66ed7f71749c6683625636910fe9cf87dd5ea28310c6d768c99a91f46c8a41f8b02bf1aa39486272d925a9c3859581d0233

Download Submit
C:\Windows\System\hLcVVNS.exe

Filesize
1.7MB

MD5
3c89f0cd4f09e45aabc8c218ff91a855

SHA1
6426777cb96ea0a04e990331eda8a3f6054a8b2f

SHA256
eabd6ac831ca8696d2c8629926bbdb56784dde56958c6f6fadac30cf67f32a1a

SHA512
3f8c0f213de531910e723ad1ec89c2dce20a9f4454c8ad8c18fc1af11676fb5576415678cc3152d92da4e0823666839755c473fe8cb4997f775cc98c9d957b48

Download Submit
C:\Windows\System\ieXsDsF.exe

Filesize
1.7MB

MD5
76e5c7559ac4c58767ef948f879764c8

SHA1
dac345433c6085170d6fb82c593e100fa6492d8f

SHA256
112c41b133a01c7611887a79d02de0a3cfafb531dc409b7d236999a44ec9485c

SHA512
74b060bd6488749d5cf7d44a3558b4f0f265b811d7a073f746090e4578870dc96cd6ebd3203e4a7d413b5c17f802f36aaf237160435f1bac269e8535e07ac6ec

Download Submit
C:\Windows\System\mbFyseu.exe

Filesize
8B

MD5
f2b11a4f1fcbad6fc157ed82f7f152ac

SHA1
efd8b13fa95cf7a990978754c7431419030beea2

SHA256
c66c195439731503f84c2b4f6c9e40bc2d1f58a7ceadcee90edb295c024bedca

SHA512
8356a3a53ced9e99c13fb82daf6e13a9457c73bcf69ce83b0f0d7a8124059e77c8bc13a33625a791446918ce6d26ec52b29a4b64baea3c5dd240bd295f547ada

Download Submit
C:\Windows\System\nzBuoww.exe

Filesize
1.7MB

MD5
58d4352f45860bcd107b130b44aba50d

SHA1
104aacb9a57cb4c54aadb7fda106daff25ab799c

SHA256
31e1b51d7e36ebc584a8ed7fe3fa19203c91569c28aad883fd8b71a82ef000e3

SHA512
7ecf905023918fa4bb6f9eda5296d888670e2e3312eeed21024dd1e85d47a5cb263d6d6fdef1c52c8e5579a948069b2c7d481e8a803a1f80cd6d19f30790a8a0

Download Submit
C:\Windows\System\pVuxbsx.exe

Filesize
1.7MB

MD5
582907d5492091e54dac120e8a060db8

SHA1
4135187f347491a67226f454c0a8c4aafc75692c

SHA256
c15a1f9dd66fb5b7705b2b0a2a54042fb5b86a6f61d104cb82704d4804d9c78b

SHA512
fc8c07bdc3e537b154d28d61a30b1b690328ac5473e595561c8bcb38d343ccf2947214696155f3f88e0bb0a5ca5bcdc6ff70d57789ce8ab675bbff9c05406e91

Download Submit
C:\Windows\System\soOHJME.exe

Filesize
1.7MB

MD5
8eecb52b73ec1ad7a049943046a66eac

SHA1
3b4f53e0843a01c5d004df80aa025e8ce750898b

SHA256
0a5500fb66103be4685f48fdf9f760cf93fdb5e6cf77d30d74ff9bb60744ec52

SHA512
cd4c4a23a0348bb55e8993192784ac8c0a9a5189341c88509860206a78930eadb9e24a044e5db7f3c89016a1857763ddbdb0166036387668c919de4d97034f65

Download Submit
C:\Windows\System\tdZwPyg.exe

Filesize
1.7MB

MD5
6f51f90b3947f2cde16afc431c5062ae

SHA1
7d6530f9a3905282884078e886601558d0d7b8c7

SHA256
f67f178f5e3fad23dc944c8d7fab0db3a99593058a464c0b13ffd07312028a71

SHA512
b216f6f4a485abb1b386d587b485694d950330cc03b7f012b493ce96143c9d331bc9ac1960199aea37256353f9bb0d61e5ce276d599457a1e08c195c37a495cf

Download Submit
C:\Windows\System\uPvOWyv.exe

Filesize
1.7MB

MD5
d91e74715604fbeeeb01b3a890b6097f

SHA1
81b09125e6fe4234b7654d1714adbfb1b209549b

SHA256
005d15708cdd18a21f1ff9c4f9646fe5488f29b2b4bba618294ce91628610a7b

SHA512
b281f20a602edbc54f005220d85087d0fb805c501a646ad239c964827bf402677cfb2d00b262e3c620ad681b950c1d5ec2cbb28e24de2c644ba04ca1dd91affe

Download Submit
C:\Windows\System\yHTrbne.exe

Filesize
1.7MB

MD5
402c020f2826c598ae841fbf4be39e75

SHA1
e0edf562e35eb51ceaef24b7a69c5899af1d88ba

SHA256
2a562f497a4676dfdc7b377ab2061fd87f3b5720d26d0fce5887320931b41980

SHA512
8d78890692452a6bd7b0888933f24136efeb647f6683f3f9803dc5cff46884f039937b8ce9d60bec2a1d7c5c379022c00b998c389f00c5b41b8c1f8819690c53

Download Submit
memory/224-2172-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp

Filesize
3.9MB

Download
memory/224-66-0x00007FF7881F0000-0x00007FF7885E2000-memory.dmp

Filesize
3.9MB

Download
memory/872-128-0x00007FF730A70000-0x00007FF730E62000-memory.dmp

Filesize
3.9MB

Download
memory/872-2195-0x00007FF730A70000-0x00007FF730E62000-memory.dmp

Filesize
3.9MB

Download
memory/1092-2193-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp

Filesize
3.9MB

Download
memory/1092-84-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp

Filesize
3.9MB

Download
memory/1092-1307-0x00007FF69D640000-0x00007FF69DA32000-memory.dmp

Filesize
3.9MB

Download
memory/1232-2185-0x00007FF6A61E0000-0x00007FF6A65D2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-106-0x00007FF6A61E0000-0x00007FF6A65D2000-memory.dmp

Filesize
3.9MB

Download
memory/1320-2170-0x00007FF732B90000-0x00007FF732F82000-memory.dmp

Filesize
3.9MB

Download
memory/1320-56-0x00007FF732B90000-0x00007FF732F82000-memory.dmp

Filesize
3.9MB

Download
memory/1344-1064-0x00007FF628240000-0x00007FF628632000-memory.dmp

Filesize
3.9MB

Download
memory/1344-1-0x0000017DE4E60000-0x0000017DE4E70000-memory.dmp

Filesize
64KB

Download
memory/1344-0-0x00007FF628240000-0x00007FF628632000-memory.dmp

Filesize
3.9MB

Download
memory/1580-2184-0x00007FF684B20000-0x00007FF684F12000-memory.dmp

Filesize
3.9MB

Download
memory/1580-113-0x00007FF684B20000-0x00007FF684F12000-memory.dmp

Filesize
3.9MB

Download
memory/1948-99-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-1319-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-1190-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-1182-0x00007FF9D4703000-0x00007FF9D4705000-memory.dmp

Filesize
8KB

Download
memory/1948-27-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-2137-0x00007FF9D4700000-0x00007FF9D51C1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-11-0x00007FF9D4703000-0x00007FF9D4705000-memory.dmp

Filesize
8KB

Download
memory/1948-608-0x0000013AADBB0000-0x0000013AAE356000-memory.dmp

Filesize
7.6MB

Download
memory/1948-51-0x0000013A927D0000-0x0000013A927F2000-memory.dmp

Filesize
136KB

Download
memory/2052-132-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp

Filesize
3.9MB

Download
memory/2052-1330-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp

Filesize
3.9MB

Download
memory/2052-2530-0x00007FF7E2C90000-0x00007FF7E3082000-memory.dmp

Filesize
3.9MB

Download
memory/2204-2239-0x00007FF616020000-0x00007FF616412000-memory.dmp

Filesize
3.9MB

Download
memory/2204-176-0x00007FF616020000-0x00007FF616412000-memory.dmp

Filesize
3.9MB

Download
memory/2332-10-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-2147-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-1065-0x00007FF6B8FF0000-0x00007FF6B93E2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-124-0x00007FF68D880000-0x00007FF68DC72000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2189-0x00007FF68D880000-0x00007FF68DC72000-memory.dmp

Filesize
3.9MB

Download
memory/2428-2226-0x00007FF61A080000-0x00007FF61A472000-memory.dmp

Filesize
3.9MB

Download
memory/2428-145-0x00007FF61A080000-0x00007FF61A472000-memory.dmp

Filesize
3.9MB

Download
memory/2484-117-0x00007FF70A1C0000-0x00007FF70A5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-2187-0x00007FF70A1C0000-0x00007FF70A5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-2150-0x00007FF7F1B70000-0x00007FF7F1F62000-memory.dmp

Filesize
3.9MB

Download
memory/2996-55-0x00007FF7F1B70000-0x00007FF7F1F62000-memory.dmp

Filesize
3.9MB

Download
memory/3012-2177-0x00007FF63E3F0000-0x00007FF63E7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3012-105-0x00007FF63E3F0000-0x00007FF63E7E2000-memory.dmp

Filesize
3.9MB

Download
memory/3360-151-0x00007FF611380000-0x00007FF611772000-memory.dmp

Filesize
3.9MB

Download
memory/3360-2220-0x00007FF611380000-0x00007FF611772000-memory.dmp

Filesize
3.9MB

Download
memory/3496-170-0x00007FF6B62F0000-0x00007FF6B66E2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-2231-0x00007FF6B62F0000-0x00007FF6B66E2000-memory.dmp

Filesize
3.9MB

Download
memory/3500-2181-0x00007FF65E230000-0x00007FF65E622000-memory.dmp

Filesize
3.9MB

Download
memory/3500-72-0x00007FF65E230000-0x00007FF65E622000-memory.dmp

Filesize
3.9MB

Download
memory/3796-2197-0x00007FF7FC9D0000-0x00007FF7FCDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3796-139-0x00007FF7FC9D0000-0x00007FF7FCDC2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-35-0x00007FF6074B0000-0x00007FF6078A2000-memory.dmp

Filesize
3.9MB

Download
memory/3988-2151-0x00007FF6074B0000-0x00007FF6078A2000-memory.dmp

Filesize
3.9MB

Download
memory/4068-138-0x00007FF6F2FE0000-0x00007FF6F33D2000-memory.dmp

Filesize
3.9MB

Download
memory/4068-2192-0x00007FF6F2FE0000-0x00007FF6F33D2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-164-0x00007FF74C400000-0x00007FF74C7F2000-memory.dmp

Filesize
3.9MB

Download
memory/4460-2235-0x00007FF74C400000-0x00007FF74C7F2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-157-0x00007FF702840000-0x00007FF702C32000-memory.dmp

Filesize
3.9MB

Download
memory/4688-2230-0x00007FF702840000-0x00007FF702C32000-memory.dmp

Filesize
3.9MB

Download
memory/4740-2179-0x00007FF6A6CA0000-0x00007FF6A7092000-memory.dmp

Filesize
3.9MB

Download
memory/4740-79-0x00007FF6A6CA0000-0x00007FF6A7092000-memory.dmp

Filesize
3.9MB

Download
memory/4988-158-0x00007FF76F140000-0x00007FF76F532000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2227-0x00007FF76F140000-0x00007FF76F532000-memory.dmp

Filesize
3.9MB

Download