xmrig | c35da0b6bd0705268353be92e99deb5e38fbb426503afab13fc2153c85680f7a

Analysis

max time kernel
94s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c6b128386699fc0db2bb6c98ce64c190N.exe
Size

2.0MB
MD5

c6b128386699fc0db2bb6c98ce64c190
SHA1

251753fdc001e3459c20262f846594760563cece
SHA256

c35da0b6bd0705268353be92e99deb5e38fbb426503afab13fc2153c85680f7a
SHA512

d895af94c054d49373d2f70eaafb43d249de27cba5e148b4cc7d0c369ae4552875f1594796c4cccfcbaf5270dc7f5cb8d44b4083f04b69a7b1eedce7e437c937
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p1HzDgU7yZzt/+:NABF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/404-56-0x00007FF7DE570000-0x00007FF7DE962000-memory.dmp	xmrig
behavioral2/memory/2460-80-0x00007FF6358F0000-0x00007FF635CE2000-memory.dmp	xmrig
behavioral2/memory/4592-146-0x00007FF7EE720000-0x00007FF7EEB12000-memory.dmp	xmrig
behavioral2/memory/3184-166-0x00007FF7B3410000-0x00007FF7B3802000-memory.dmp	xmrig
behavioral2/memory/2348-894-0x00007FF665730000-0x00007FF665B22000-memory.dmp	xmrig
behavioral2/memory/536-1189-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp	xmrig
behavioral2/memory/3452-1188-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp	xmrig
behavioral2/memory/4656-1182-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp	xmrig
behavioral2/memory/4516-1293-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp	xmrig
behavioral2/memory/2328-1433-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp	xmrig
behavioral2/memory/964-168-0x00007FF7AB4B0000-0x00007FF7AB8A2000-memory.dmp	xmrig
behavioral2/memory/3128-165-0x00007FF632780000-0x00007FF632B72000-memory.dmp	xmrig
behavioral2/memory/2292-164-0x00007FF6865B0000-0x00007FF6869A2000-memory.dmp	xmrig
behavioral2/memory/4816-163-0x00007FF602320000-0x00007FF602712000-memory.dmp	xmrig
behavioral2/memory/3408-162-0x00007FF622770000-0x00007FF622B62000-memory.dmp	xmrig
behavioral2/memory/4252-159-0x00007FF62E060000-0x00007FF62E452000-memory.dmp	xmrig
behavioral2/memory/8-156-0x00007FF6A5290000-0x00007FF6A5682000-memory.dmp	xmrig
behavioral2/memory/4968-155-0x00007FF76C490000-0x00007FF76C882000-memory.dmp	xmrig
behavioral2/memory/996-151-0x00007FF6A38F0000-0x00007FF6A3CE2000-memory.dmp	xmrig
behavioral2/memory/752-140-0x00007FF6A0280000-0x00007FF6A0672000-memory.dmp	xmrig
behavioral2/memory/4956-136-0x00007FF6F6910000-0x00007FF6F6D02000-memory.dmp	xmrig
behavioral2/memory/2240-90-0x00007FF7FF880000-0x00007FF7FFC72000-memory.dmp	xmrig
behavioral2/memory/2816-86-0x00007FF6DF5D0000-0x00007FF6DF9C2000-memory.dmp	xmrig
behavioral2/memory/1704-73-0x00007FF78FD80000-0x00007FF790172000-memory.dmp	xmrig
behavioral2/memory/4860-65-0x00007FF77EB30000-0x00007FF77EF22000-memory.dmp	xmrig
behavioral2/memory/4592-3011-0x00007FF7EE720000-0x00007FF7EEB12000-memory.dmp	xmrig
behavioral2/memory/996-3013-0x00007FF6A38F0000-0x00007FF6A3CE2000-memory.dmp	xmrig
behavioral2/memory/404-3015-0x00007FF7DE570000-0x00007FF7DE962000-memory.dmp	xmrig
behavioral2/memory/1704-3017-0x00007FF78FD80000-0x00007FF790172000-memory.dmp	xmrig
behavioral2/memory/4860-3019-0x00007FF77EB30000-0x00007FF77EF22000-memory.dmp	xmrig
behavioral2/memory/4252-3050-0x00007FF62E060000-0x00007FF62E452000-memory.dmp	xmrig
behavioral2/memory/752-3071-0x00007FF6A0280000-0x00007FF6A0672000-memory.dmp	xmrig
behavioral2/memory/3184-3073-0x00007FF7B3410000-0x00007FF7B3802000-memory.dmp	xmrig
behavioral2/memory/964-3075-0x00007FF7AB4B0000-0x00007FF7AB8A2000-memory.dmp	xmrig
behavioral2/memory/4956-3069-0x00007FF6F6910000-0x00007FF6F6D02000-memory.dmp	xmrig
behavioral2/memory/4516-3067-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp	xmrig
behavioral2/memory/3452-3064-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp	xmrig
behavioral2/memory/2292-3062-0x00007FF6865B0000-0x00007FF6869A2000-memory.dmp	xmrig
behavioral2/memory/536-3065-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp	xmrig
behavioral2/memory/3128-3060-0x00007FF632780000-0x00007FF632B72000-memory.dmp	xmrig
behavioral2/memory/4816-3049-0x00007FF602320000-0x00007FF602712000-memory.dmp	xmrig
behavioral2/memory/8-3045-0x00007FF6A5290000-0x00007FF6A5682000-memory.dmp	xmrig
behavioral2/memory/4656-3042-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp	xmrig
behavioral2/memory/2816-3054-0x00007FF6DF5D0000-0x00007FF6DF9C2000-memory.dmp	xmrig
behavioral2/memory/2240-3053-0x00007FF7FF880000-0x00007FF7FFC72000-memory.dmp	xmrig
behavioral2/memory/2460-3047-0x00007FF6358F0000-0x00007FF635CE2000-memory.dmp	xmrig
behavioral2/memory/3408-3041-0x00007FF622770000-0x00007FF622B62000-memory.dmp	xmrig
behavioral2/memory/4968-3038-0x00007FF76C490000-0x00007FF76C882000-memory.dmp	xmrig
behavioral2/memory/2328-3363-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	4208	powershell.exe
10	4208	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4208	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4592	ehRFtPd.exe
996	dvSdkYn.exe
404	YrXmuCo.exe
4860	PCeeECX.exe
4968	yInvwyp.exe
1704	BLBSOWN.exe
2460	QcHcSZf.exe
8	LxwIHlr.exe
2816	XYGvUfD.exe
2240	nTgsqVq.exe
4252	ycgcKHx.exe
3408	sEXFCcF.exe
4656	PSzQrNu.exe
4816	CgXybCg.exe
2292	iivyPbU.exe
3452	NQhJcPc.exe
3128	vecQlAb.exe
4516	WFSEzSN.exe
536	hcgwaAe.exe
4956	lRwQOcT.exe
752	AzrmJAQ.exe
3184	CVpzvgO.exe
2328	zQOPsRK.exe
964	DRCHAUE.exe
736	wBSHPEp.exe
4992	iNwnXQs.exe
4276	Gyresef.exe
1596	BpccVeD.exe
1988	ocgHhZM.exe
4572	kFKKnsX.exe
2884	XcWnOyf.exe
2192	ZGenbmf.exe
3612	AVDFxFg.exe
3224	yGxdLkx.exe
1440	FoHKLVL.exe
2588	zQEEDYM.exe
4404	IpCraPc.exe
4552	HADesKh.exe
1428	ErLUsTP.exe
4692	yvHOxhz.exe
4668	ktxRQmC.exe
2580	YsfAXNc.exe
1464	rdXLHhr.exe
2940	fpHNSBS.exe
4880	CKKZirs.exe
4504	wVcYKDK.exe
4548	bPCHaxe.exe
5044	OYINrud.exe
1940	RyGuUXL.exe
1208	dJyhmbo.exe
4256	leTGVSW.exe
3136	qvglkce.exe
2832	aZMjRPR.exe
4576	sqnpwGH.exe
3272	ijVVLtZ.exe
3980	LxuqTKV.exe
2868	pAuSpDx.exe
4948	KFFzVUs.exe
4644	zXNvCUf.exe
3524	OxgaTEW.exe
2020	SIAIpqk.exe
4384	wamnkWE.exe
2548	IFCGXJC.exe
3968	mOYMtzy.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2348-0-0x00007FF665730000-0x00007FF665B22000-memory.dmp	upx
behavioral2/files/0x00070000000234c8-14.dat	upx
behavioral2/files/0x00070000000234c9-15.dat	upx
behavioral2/files/0x00070000000234cc-31.dat	upx
behavioral2/files/0x00070000000234ce-57.dat	upx
behavioral2/memory/404-56-0x00007FF7DE570000-0x00007FF7DE962000-memory.dmp	upx
behavioral2/files/0x00080000000234d2-81.dat	upx
behavioral2/memory/2460-80-0x00007FF6358F0000-0x00007FF635CE2000-memory.dmp	upx
behavioral2/files/0x00070000000234d0-76.dat	upx
behavioral2/files/0x00070000000234d5-96.dat	upx
behavioral2/files/0x00070000000234d3-95.dat	upx
behavioral2/files/0x00070000000234d8-111.dat	upx
behavioral2/memory/4516-118-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp	upx
behavioral2/files/0x00070000000234dc-141.dat	upx
behavioral2/memory/4592-146-0x00007FF7EE720000-0x00007FF7EEB12000-memory.dmp	upx
behavioral2/files/0x00080000000234c5-153.dat	upx
behavioral2/files/0x00070000000234df-160.dat	upx
behavioral2/memory/3184-166-0x00007FF7B3410000-0x00007FF7B3802000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-184.dat	upx
behavioral2/files/0x00070000000234e6-199.dat	upx
behavioral2/memory/2348-894-0x00007FF665730000-0x00007FF665B22000-memory.dmp	upx
behavioral2/memory/536-1189-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp	upx
behavioral2/memory/3452-1188-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp	upx
behavioral2/memory/4656-1182-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp	upx
behavioral2/memory/4516-1293-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp	upx
behavioral2/memory/2328-1433-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp	upx
behavioral2/files/0x00070000000234e4-197.dat	upx
behavioral2/files/0x00070000000234e5-194.dat	upx
behavioral2/files/0x00070000000234e2-187.dat	upx
behavioral2/files/0x00070000000234e1-180.dat	upx
behavioral2/files/0x00070000000234e0-174.dat	upx
behavioral2/memory/964-168-0x00007FF7AB4B0000-0x00007FF7AB8A2000-memory.dmp	upx
behavioral2/memory/2328-167-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp	upx
behavioral2/memory/3128-165-0x00007FF632780000-0x00007FF632B72000-memory.dmp	upx
behavioral2/memory/2292-164-0x00007FF6865B0000-0x00007FF6869A2000-memory.dmp	upx
behavioral2/memory/4816-163-0x00007FF602320000-0x00007FF602712000-memory.dmp	upx
behavioral2/memory/3408-162-0x00007FF622770000-0x00007FF622B62000-memory.dmp	upx
behavioral2/memory/4252-159-0x00007FF62E060000-0x00007FF62E452000-memory.dmp	upx
behavioral2/files/0x00070000000234de-157.dat	upx
behavioral2/memory/8-156-0x00007FF6A5290000-0x00007FF6A5682000-memory.dmp	upx
behavioral2/memory/4968-155-0x00007FF76C490000-0x00007FF76C882000-memory.dmp	upx
behavioral2/memory/996-151-0x00007FF6A38F0000-0x00007FF6A3CE2000-memory.dmp	upx
behavioral2/files/0x00070000000234dd-147.dat	upx
behavioral2/memory/752-140-0x00007FF6A0280000-0x00007FF6A0672000-memory.dmp	upx
behavioral2/memory/4956-136-0x00007FF6F6910000-0x00007FF6F6D02000-memory.dmp	upx
behavioral2/files/0x00070000000234db-131.dat	upx
behavioral2/files/0x00070000000234da-129.dat	upx
behavioral2/files/0x00070000000234d9-127.dat	upx
behavioral2/files/0x00070000000234d6-122.dat	upx
behavioral2/memory/536-119-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp	upx
behavioral2/memory/3452-115-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp	upx
behavioral2/files/0x00070000000234d7-120.dat	upx
behavioral2/memory/4656-106-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp	upx
behavioral2/files/0x00080000000234d1-91.dat	upx
behavioral2/memory/2240-90-0x00007FF7FF880000-0x00007FF7FFC72000-memory.dmp	upx
behavioral2/memory/2816-86-0x00007FF6DF5D0000-0x00007FF6DF9C2000-memory.dmp	upx
behavioral2/files/0x00070000000234d4-87.dat	upx
behavioral2/memory/1704-73-0x00007FF78FD80000-0x00007FF790172000-memory.dmp	upx
behavioral2/files/0x00070000000234cf-71.dat	upx
behavioral2/files/0x00070000000234cb-68.dat	upx
behavioral2/memory/4860-65-0x00007FF77EB30000-0x00007FF77EF22000-memory.dmp	upx
behavioral2/files/0x00070000000234cd-52.dat	upx
behavioral2/files/0x00070000000234ca-34.dat	upx
behavioral2/files/0x000a0000000234c4-6.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PKIJoaP.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\mxXLAXp.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\aNYuBBl.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\PuiAwly.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\qQmpIlK.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\repkchi.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\ozEosrh.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\QJZDmoq.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\OEBbXKN.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\JuNqaYN.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\zPSYfmQ.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\vXAYKry.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\IpCraPc.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\PzpxEOa.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\hBDFkHv.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\apyoLsT.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\NEQsPlv.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\fVZDihb.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\PhQaWxX.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\pIuRVKj.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\WuzXoLW.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\CmVlDIq.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\pdcovtt.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\xYKkBVy.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\kmjEbWj.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\AjbpOpE.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\sQRZmVq.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\mBWeqQw.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\OkQdZtB.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\YJywxng.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\ZnAemUe.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\qMgFAJB.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\JXgbfBV.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\CWthmnz.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\juCOYFS.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\ykmZbQp.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\CmuCMZS.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\jwMBClu.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\sWwFFmC.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\oTqynDq.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\KtuQxtH.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\SnXbIMq.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\hlEoSQd.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\BWjPSty.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\YSFvKOY.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\XgUWytp.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\GAvIkcu.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\CmQsCzQ.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\rHcymfn.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\GVoPsUY.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\oWCiSPq.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\UYNkOwo.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\unnGckv.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\FxOMPiE.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\BtsnHdO.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\CvKTmUJ.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\NBjlWvx.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\bSbXhbi.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\TSKpayC.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\ZyQSKhb.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\MectvUN.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\pYnGAfS.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\FHzoeXu.exe	c6b128386699fc0db2bb6c98ce64c190N.exe
File created	C:\Windows\System\oZmWyjV.exe	c6b128386699fc0db2bb6c98ce64c190N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2348	c6b128386699fc0db2bb6c98ce64c190N.exe
Token: SeLockMemoryPrivilege	2348	c6b128386699fc0db2bb6c98ce64c190N.exe
Token: SeDebugPrivilege	4208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 4208	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	84
PID 2348 wrote to memory of 4208	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	84
PID 2348 wrote to memory of 4592	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	85
PID 2348 wrote to memory of 4592	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	85
PID 2348 wrote to memory of 996	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	86
PID 2348 wrote to memory of 996	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	86
PID 2348 wrote to memory of 404	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	87
PID 2348 wrote to memory of 404	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	87
PID 2348 wrote to memory of 4860	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	88
PID 2348 wrote to memory of 4860	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	88
PID 2348 wrote to memory of 4968	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	89
PID 2348 wrote to memory of 4968	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	89
PID 2348 wrote to memory of 1704	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	90
PID 2348 wrote to memory of 1704	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	90
PID 2348 wrote to memory of 2460	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	91
PID 2348 wrote to memory of 2460	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	91
PID 2348 wrote to memory of 8	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	92
PID 2348 wrote to memory of 8	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	92
PID 2348 wrote to memory of 2816	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	93
PID 2348 wrote to memory of 2816	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	93
PID 2348 wrote to memory of 2240	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	94
PID 2348 wrote to memory of 2240	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	94
PID 2348 wrote to memory of 3408	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	95
PID 2348 wrote to memory of 3408	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	95
PID 2348 wrote to memory of 4252	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	96
PID 2348 wrote to memory of 4252	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	96
PID 2348 wrote to memory of 4656	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	97
PID 2348 wrote to memory of 4656	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	97
PID 2348 wrote to memory of 4816	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	98
PID 2348 wrote to memory of 4816	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	98
PID 2348 wrote to memory of 2292	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	99
PID 2348 wrote to memory of 2292	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	99
PID 2348 wrote to memory of 3452	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	100
PID 2348 wrote to memory of 3452	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	100
PID 2348 wrote to memory of 3128	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	101
PID 2348 wrote to memory of 3128	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	101
PID 2348 wrote to memory of 4516	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	102
PID 2348 wrote to memory of 4516	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	102
PID 2348 wrote to memory of 536	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	103
PID 2348 wrote to memory of 536	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	103
PID 2348 wrote to memory of 4956	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	104
PID 2348 wrote to memory of 4956	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	104
PID 2348 wrote to memory of 752	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	105
PID 2348 wrote to memory of 752	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	105
PID 2348 wrote to memory of 3184	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	106
PID 2348 wrote to memory of 3184	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	106
PID 2348 wrote to memory of 2328	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	107
PID 2348 wrote to memory of 2328	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	107
PID 2348 wrote to memory of 964	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	108
PID 2348 wrote to memory of 964	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	108
PID 2348 wrote to memory of 736	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	109
PID 2348 wrote to memory of 736	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	109
PID 2348 wrote to memory of 4992	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	110
PID 2348 wrote to memory of 4992	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	110
PID 2348 wrote to memory of 4276	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	111
PID 2348 wrote to memory of 4276	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	111
PID 2348 wrote to memory of 1596	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	112
PID 2348 wrote to memory of 1596	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	112
PID 2348 wrote to memory of 1988	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	113
PID 2348 wrote to memory of 1988	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	113
PID 2348 wrote to memory of 4572	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	114
PID 2348 wrote to memory of 4572	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	114
PID 2348 wrote to memory of 2884	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	115
PID 2348 wrote to memory of 2884	2348	c6b128386699fc0db2bb6c98ce64c190N.exe	115

C:\Users\Admin\AppData\Local\Temp\c6b128386699fc0db2bb6c98ce64c190N.exe
"C:\Users\Admin\AppData\Local\Temp\c6b128386699fc0db2bb6c98ce64c190N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "4208" "2928" "2892" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13408
- C:\Windows\System\ehRFtPd.exe
  C:\Windows\System\ehRFtPd.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\dvSdkYn.exe
  C:\Windows\System\dvSdkYn.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\YrXmuCo.exe
  C:\Windows\System\YrXmuCo.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\PCeeECX.exe
  C:\Windows\System\PCeeECX.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\yInvwyp.exe
  C:\Windows\System\yInvwyp.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\BLBSOWN.exe
  C:\Windows\System\BLBSOWN.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\QcHcSZf.exe
  C:\Windows\System\QcHcSZf.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\LxwIHlr.exe
  C:\Windows\System\LxwIHlr.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\XYGvUfD.exe
  C:\Windows\System\XYGvUfD.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\nTgsqVq.exe
  C:\Windows\System\nTgsqVq.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\sEXFCcF.exe
  C:\Windows\System\sEXFCcF.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\ycgcKHx.exe
  C:\Windows\System\ycgcKHx.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\PSzQrNu.exe
  C:\Windows\System\PSzQrNu.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\CgXybCg.exe
  C:\Windows\System\CgXybCg.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\iivyPbU.exe
  C:\Windows\System\iivyPbU.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\NQhJcPc.exe
  C:\Windows\System\NQhJcPc.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\vecQlAb.exe
  C:\Windows\System\vecQlAb.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\WFSEzSN.exe
  C:\Windows\System\WFSEzSN.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\hcgwaAe.exe
  C:\Windows\System\hcgwaAe.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\lRwQOcT.exe
  C:\Windows\System\lRwQOcT.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\AzrmJAQ.exe
  C:\Windows\System\AzrmJAQ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CVpzvgO.exe
  C:\Windows\System\CVpzvgO.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\zQOPsRK.exe
  C:\Windows\System\zQOPsRK.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\DRCHAUE.exe
  C:\Windows\System\DRCHAUE.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\wBSHPEp.exe
  C:\Windows\System\wBSHPEp.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\iNwnXQs.exe
  C:\Windows\System\iNwnXQs.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\Gyresef.exe
  C:\Windows\System\Gyresef.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\BpccVeD.exe
  C:\Windows\System\BpccVeD.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ocgHhZM.exe
  C:\Windows\System\ocgHhZM.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\kFKKnsX.exe
  C:\Windows\System\kFKKnsX.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\XcWnOyf.exe
  C:\Windows\System\XcWnOyf.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ZGenbmf.exe
  C:\Windows\System\ZGenbmf.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\AVDFxFg.exe
  C:\Windows\System\AVDFxFg.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\yGxdLkx.exe
  C:\Windows\System\yGxdLkx.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\FoHKLVL.exe
  C:\Windows\System\FoHKLVL.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\zQEEDYM.exe
  C:\Windows\System\zQEEDYM.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\IpCraPc.exe
  C:\Windows\System\IpCraPc.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\HADesKh.exe
  C:\Windows\System\HADesKh.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\ErLUsTP.exe
  C:\Windows\System\ErLUsTP.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\yvHOxhz.exe
  C:\Windows\System\yvHOxhz.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\ktxRQmC.exe
  C:\Windows\System\ktxRQmC.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\YsfAXNc.exe
  C:\Windows\System\YsfAXNc.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\rdXLHhr.exe
  C:\Windows\System\rdXLHhr.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\fpHNSBS.exe
  C:\Windows\System\fpHNSBS.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\CKKZirs.exe
  C:\Windows\System\CKKZirs.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\wVcYKDK.exe
  C:\Windows\System\wVcYKDK.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\bPCHaxe.exe
  C:\Windows\System\bPCHaxe.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\OYINrud.exe
  C:\Windows\System\OYINrud.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\RyGuUXL.exe
  C:\Windows\System\RyGuUXL.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\dJyhmbo.exe
  C:\Windows\System\dJyhmbo.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\leTGVSW.exe
  C:\Windows\System\leTGVSW.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\qvglkce.exe
  C:\Windows\System\qvglkce.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\aZMjRPR.exe
  C:\Windows\System\aZMjRPR.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\sqnpwGH.exe
  C:\Windows\System\sqnpwGH.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ijVVLtZ.exe
  C:\Windows\System\ijVVLtZ.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\LxuqTKV.exe
  C:\Windows\System\LxuqTKV.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\pAuSpDx.exe
  C:\Windows\System\pAuSpDx.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\KFFzVUs.exe
  C:\Windows\System\KFFzVUs.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\zXNvCUf.exe
  C:\Windows\System\zXNvCUf.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\OxgaTEW.exe
  C:\Windows\System\OxgaTEW.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\SIAIpqk.exe
  C:\Windows\System\SIAIpqk.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\wamnkWE.exe
  C:\Windows\System\wamnkWE.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\IFCGXJC.exe
  C:\Windows\System\IFCGXJC.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\mOYMtzy.exe
  C:\Windows\System\mOYMtzy.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\vWDOfCe.exe
  C:\Windows\System\vWDOfCe.exe
  2⤵
  PID:3456
- C:\Windows\System\llrJctu.exe
  C:\Windows\System\llrJctu.exe
  2⤵
  PID:1436
- C:\Windows\System\TQfaxKF.exe
  C:\Windows\System\TQfaxKF.exe
  2⤵
  PID:3472
- C:\Windows\System\QyJnrNk.exe
  C:\Windows\System\QyJnrNk.exe
  2⤵
  PID:2896
- C:\Windows\System\jcqyxQM.exe
  C:\Windows\System\jcqyxQM.exe
  2⤵
  PID:3604
- C:\Windows\System\POnPopg.exe
  C:\Windows\System\POnPopg.exe
  2⤵
  PID:1072
- C:\Windows\System\hlEoSQd.exe
  C:\Windows\System\hlEoSQd.exe
  2⤵
  PID:2184
- C:\Windows\System\wHHyQMs.exe
  C:\Windows\System\wHHyQMs.exe
  2⤵
  PID:1752
- C:\Windows\System\fDImWex.exe
  C:\Windows\System\fDImWex.exe
  2⤵
  PID:4072
- C:\Windows\System\kMqBcTK.exe
  C:\Windows\System\kMqBcTK.exe
  2⤵
  PID:4428
- C:\Windows\System\yMhPhHo.exe
  C:\Windows\System\yMhPhHo.exe
  2⤵
  PID:2524
- C:\Windows\System\HlIXDNg.exe
  C:\Windows\System\HlIXDNg.exe
  2⤵
  PID:5124
- C:\Windows\System\IoPwvPP.exe
  C:\Windows\System\IoPwvPP.exe
  2⤵
  PID:5156
- C:\Windows\System\oMpFMoT.exe
  C:\Windows\System\oMpFMoT.exe
  2⤵
  PID:5180
- C:\Windows\System\DLuKdwZ.exe
  C:\Windows\System\DLuKdwZ.exe
  2⤵
  PID:5212
- C:\Windows\System\ZnAemUe.exe
  C:\Windows\System\ZnAemUe.exe
  2⤵
  PID:5240
- C:\Windows\System\moBOifD.exe
  C:\Windows\System\moBOifD.exe
  2⤵
  PID:5268
- C:\Windows\System\RmjwCBZ.exe
  C:\Windows\System\RmjwCBZ.exe
  2⤵
  PID:5296
- C:\Windows\System\pCeanYx.exe
  C:\Windows\System\pCeanYx.exe
  2⤵
  PID:5324
- C:\Windows\System\jwMBClu.exe
  C:\Windows\System\jwMBClu.exe
  2⤵
  PID:5348
- C:\Windows\System\iytIgsX.exe
  C:\Windows\System\iytIgsX.exe
  2⤵
  PID:5380
- C:\Windows\System\WVeSZkJ.exe
  C:\Windows\System\WVeSZkJ.exe
  2⤵
  PID:5416
- C:\Windows\System\MPXlNBB.exe
  C:\Windows\System\MPXlNBB.exe
  2⤵
  PID:5440
- C:\Windows\System\qrhhztq.exe
  C:\Windows\System\qrhhztq.exe
  2⤵
  PID:5468
- C:\Windows\System\eeIJIcL.exe
  C:\Windows\System\eeIJIcL.exe
  2⤵
  PID:5496
- C:\Windows\System\HjPaRha.exe
  C:\Windows\System\HjPaRha.exe
  2⤵
  PID:5524
- C:\Windows\System\jbCFsxb.exe
  C:\Windows\System\jbCFsxb.exe
  2⤵
  PID:5548
- C:\Windows\System\BiIiBJI.exe
  C:\Windows\System\BiIiBJI.exe
  2⤵
  PID:5572
- C:\Windows\System\IuEPUil.exe
  C:\Windows\System\IuEPUil.exe
  2⤵
  PID:5604
- C:\Windows\System\FbsEhDT.exe
  C:\Windows\System\FbsEhDT.exe
  2⤵
  PID:5636
- C:\Windows\System\bjNpfvo.exe
  C:\Windows\System\bjNpfvo.exe
  2⤵
  PID:5664
- C:\Windows\System\rUkgzRM.exe
  C:\Windows\System\rUkgzRM.exe
  2⤵
  PID:5696
- C:\Windows\System\sPNzunS.exe
  C:\Windows\System\sPNzunS.exe
  2⤵
  PID:5724
- C:\Windows\System\OmoTPkv.exe
  C:\Windows\System\OmoTPkv.exe
  2⤵
  PID:5756
- C:\Windows\System\YqJpeIT.exe
  C:\Windows\System\YqJpeIT.exe
  2⤵
  PID:5784
- C:\Windows\System\XxbKtlz.exe
  C:\Windows\System\XxbKtlz.exe
  2⤵
  PID:5812
- C:\Windows\System\itJbRmE.exe
  C:\Windows\System\itJbRmE.exe
  2⤵
  PID:5840
- C:\Windows\System\zMSYisu.exe
  C:\Windows\System\zMSYisu.exe
  2⤵
  PID:5872
- C:\Windows\System\WrCLWWl.exe
  C:\Windows\System\WrCLWWl.exe
  2⤵
  PID:5908
- C:\Windows\System\RLgSKbf.exe
  C:\Windows\System\RLgSKbf.exe
  2⤵
  PID:5936
- C:\Windows\System\zKeULVH.exe
  C:\Windows\System\zKeULVH.exe
  2⤵
  PID:5956
- C:\Windows\System\OlhWsUp.exe
  C:\Windows\System\OlhWsUp.exe
  2⤵
  PID:5980
- C:\Windows\System\pFNVMOX.exe
  C:\Windows\System\pFNVMOX.exe
  2⤵
  PID:6008
- C:\Windows\System\IdKskLd.exe
  C:\Windows\System\IdKskLd.exe
  2⤵
  PID:6036
- C:\Windows\System\fiAniQw.exe
  C:\Windows\System\fiAniQw.exe
  2⤵
  PID:6064
- C:\Windows\System\LYFalls.exe
  C:\Windows\System\LYFalls.exe
  2⤵
  PID:6096
- C:\Windows\System\iJikAYB.exe
  C:\Windows\System\iJikAYB.exe
  2⤵
  PID:6124
- C:\Windows\System\LDwzwgo.exe
  C:\Windows\System\LDwzwgo.exe
  2⤵
  PID:3360
- C:\Windows\System\LBURzFZ.exe
  C:\Windows\System\LBURzFZ.exe
  2⤵
  PID:4360
- C:\Windows\System\MoFcpuv.exe
  C:\Windows\System\MoFcpuv.exe
  2⤵
  PID:32
- C:\Windows\System\BLGLNFs.exe
  C:\Windows\System\BLGLNFs.exe
  2⤵
  PID:3220
- C:\Windows\System\yDgPzSq.exe
  C:\Windows\System\yDgPzSq.exe
  2⤵
  PID:3528
- C:\Windows\System\pUSCScx.exe
  C:\Windows\System\pUSCScx.exe
  2⤵
  PID:5144
- C:\Windows\System\nrOdRnj.exe
  C:\Windows\System\nrOdRnj.exe
  2⤵
  PID:5200
- C:\Windows\System\PdVDRBw.exe
  C:\Windows\System\PdVDRBw.exe
  2⤵
  PID:5256
- C:\Windows\System\CZHzWCC.exe
  C:\Windows\System\CZHzWCC.exe
  2⤵
  PID:5316
- C:\Windows\System\EYznknX.exe
  C:\Windows\System\EYznknX.exe
  2⤵
  PID:5368
- C:\Windows\System\wfrWurS.exe
  C:\Windows\System\wfrWurS.exe
  2⤵
  PID:5436
- C:\Windows\System\GgQKMlo.exe
  C:\Windows\System\GgQKMlo.exe
  2⤵
  PID:5512
- C:\Windows\System\ygYbpzG.exe
  C:\Windows\System\ygYbpzG.exe
  2⤵
  PID:5584
- C:\Windows\System\hoyfIFQ.exe
  C:\Windows\System\hoyfIFQ.exe
  2⤵
  PID:5628
- C:\Windows\System\CsvMGeL.exe
  C:\Windows\System\CsvMGeL.exe
  2⤵
  PID:5688
- C:\Windows\System\GpFlEUo.exe
  C:\Windows\System\GpFlEUo.exe
  2⤵
  PID:5748
- C:\Windows\System\JNiVvTw.exe
  C:\Windows\System\JNiVvTw.exe
  2⤵
  PID:5800
- C:\Windows\System\RUWRfWe.exe
  C:\Windows\System\RUWRfWe.exe
  2⤵
  PID:5856
- C:\Windows\System\xiEBkAP.exe
  C:\Windows\System\xiEBkAP.exe
  2⤵
  PID:5900
- C:\Windows\System\CQPLBTE.exe
  C:\Windows\System\CQPLBTE.exe
  2⤵
  PID:5948
- C:\Windows\System\iMAjZUl.exe
  C:\Windows\System\iMAjZUl.exe
  2⤵
  PID:6112
- C:\Windows\System\BoZHGph.exe
  C:\Windows\System\BoZHGph.exe
  2⤵
  PID:244
- C:\Windows\System\BWjPSty.exe
  C:\Windows\System\BWjPSty.exe
  2⤵
  PID:2080
- C:\Windows\System\vEqCxrS.exe
  C:\Windows\System\vEqCxrS.exe
  2⤵
  PID:444
- C:\Windows\System\fdmwgRr.exe
  C:\Windows\System\fdmwgRr.exe
  2⤵
  PID:4268
- C:\Windows\System\KgnoWJi.exe
  C:\Windows\System\KgnoWJi.exe
  2⤵
  PID:5236
- C:\Windows\System\rScvqTQ.exe
  C:\Windows\System\rScvqTQ.exe
  2⤵
  PID:5344
- C:\Windows\System\iMzJERh.exe
  C:\Windows\System\iMzJERh.exe
  2⤵
  PID:5432
- C:\Windows\System\ExSpuAz.exe
  C:\Windows\System\ExSpuAz.exe
  2⤵
  PID:5620
- C:\Windows\System\bLnxXDt.exe
  C:\Windows\System\bLnxXDt.exe
  2⤵
  PID:5104
- C:\Windows\System\ISwOFXl.exe
  C:\Windows\System\ISwOFXl.exe
  2⤵
  PID:5776
- C:\Windows\System\JKWhnpl.exe
  C:\Windows\System\JKWhnpl.exe
  2⤵
  PID:5836
- C:\Windows\System\AHngxLB.exe
  C:\Windows\System\AHngxLB.exe
  2⤵
  PID:5884
- C:\Windows\System\icoHVnL.exe
  C:\Windows\System\icoHVnL.exe
  2⤵
  PID:2212
- C:\Windows\System\nIEJdmq.exe
  C:\Windows\System\nIEJdmq.exe
  2⤵
  PID:3888
- C:\Windows\System\AFchoeF.exe
  C:\Windows\System\AFchoeF.exe
  2⤵
  PID:3264
- C:\Windows\System\dxZIclU.exe
  C:\Windows\System\dxZIclU.exe
  2⤵
  PID:3116
- C:\Windows\System\TZzkUuX.exe
  C:\Windows\System\TZzkUuX.exe
  2⤵
  PID:3716
- C:\Windows\System\uDyXNUL.exe
  C:\Windows\System\uDyXNUL.exe
  2⤵
  PID:3568
- C:\Windows\System\hMNuHFj.exe
  C:\Windows\System\hMNuHFj.exe
  2⤵
  PID:1904
- C:\Windows\System\bZAEXVt.exe
  C:\Windows\System\bZAEXVt.exe
  2⤵
  PID:5428
- C:\Windows\System\JGwakcp.exe
  C:\Windows\System\JGwakcp.exe
  2⤵
  PID:4176
- C:\Windows\System\WRmNcdx.exe
  C:\Windows\System\WRmNcdx.exe
  2⤵
  PID:5892
- C:\Windows\System\rElITHG.exe
  C:\Windows\System\rElITHG.exe
  2⤵
  PID:3160
- C:\Windows\System\dAzfERH.exe
  C:\Windows\System\dAzfERH.exe
  2⤵
  PID:1776
- C:\Windows\System\ygAYLwY.exe
  C:\Windows\System\ygAYLwY.exe
  2⤵
  PID:6088
- C:\Windows\System\LgUIVCK.exe
  C:\Windows\System\LgUIVCK.exe
  2⤵
  PID:5564
- C:\Windows\System\mvwKfgs.exe
  C:\Windows\System\mvwKfgs.exe
  2⤵
  PID:1932
- C:\Windows\System\DTaNwCD.exe
  C:\Windows\System\DTaNwCD.exe
  2⤵
  PID:2948
- C:\Windows\System\IytkmUU.exe
  C:\Windows\System\IytkmUU.exe
  2⤵
  PID:5228
- C:\Windows\System\xNPGvKe.exe
  C:\Windows\System\xNPGvKe.exe
  2⤵
  PID:5996
- C:\Windows\System\ypjQSUo.exe
  C:\Windows\System\ypjQSUo.exe
  2⤵
  PID:1608
- C:\Windows\System\PwwkGau.exe
  C:\Windows\System\PwwkGau.exe
  2⤵
  PID:6160
- C:\Windows\System\CpHUAQW.exe
  C:\Windows\System\CpHUAQW.exe
  2⤵
  PID:6208
- C:\Windows\System\glmuLZG.exe
  C:\Windows\System\glmuLZG.exe
  2⤵
  PID:6232
- C:\Windows\System\IwbZuJG.exe
  C:\Windows\System\IwbZuJG.exe
  2⤵
  PID:6256
- C:\Windows\System\UYBcfzM.exe
  C:\Windows\System\UYBcfzM.exe
  2⤵
  PID:6272
- C:\Windows\System\AXwZQpg.exe
  C:\Windows\System\AXwZQpg.exe
  2⤵
  PID:6300
- C:\Windows\System\fSrlwBf.exe
  C:\Windows\System\fSrlwBf.exe
  2⤵
  PID:6328
- C:\Windows\System\PJfjuhd.exe
  C:\Windows\System\PJfjuhd.exe
  2⤵
  PID:6356
- C:\Windows\System\FYnlIGI.exe
  C:\Windows\System\FYnlIGI.exe
  2⤵
  PID:6380
- C:\Windows\System\lWVGizB.exe
  C:\Windows\System\lWVGizB.exe
  2⤵
  PID:6400
- C:\Windows\System\SFPQDcS.exe
  C:\Windows\System\SFPQDcS.exe
  2⤵
  PID:6436
- C:\Windows\System\WyrlViT.exe
  C:\Windows\System\WyrlViT.exe
  2⤵
  PID:6464
- C:\Windows\System\nePexlU.exe
  C:\Windows\System\nePexlU.exe
  2⤵
  PID:6484
- C:\Windows\System\ZyvwiGn.exe
  C:\Windows\System\ZyvwiGn.exe
  2⤵
  PID:6508
- C:\Windows\System\hsQDVye.exe
  C:\Windows\System\hsQDVye.exe
  2⤵
  PID:6532
- C:\Windows\System\AIKsOiQ.exe
  C:\Windows\System\AIKsOiQ.exe
  2⤵
  PID:6548
- C:\Windows\System\WWmociv.exe
  C:\Windows\System\WWmociv.exe
  2⤵
  PID:6572
- C:\Windows\System\zjvWAPG.exe
  C:\Windows\System\zjvWAPG.exe
  2⤵
  PID:6592
- C:\Windows\System\JSuxUlv.exe
  C:\Windows\System\JSuxUlv.exe
  2⤵
  PID:6644
- C:\Windows\System\BVygJRq.exe
  C:\Windows\System\BVygJRq.exe
  2⤵
  PID:6704
- C:\Windows\System\zpMRvRg.exe
  C:\Windows\System\zpMRvRg.exe
  2⤵
  PID:6736
- C:\Windows\System\HPOkhHd.exe
  C:\Windows\System\HPOkhHd.exe
  2⤵
  PID:6760
- C:\Windows\System\IBqzzHi.exe
  C:\Windows\System\IBqzzHi.exe
  2⤵
  PID:6780
- C:\Windows\System\zFPeqHn.exe
  C:\Windows\System\zFPeqHn.exe
  2⤵
  PID:6816
- C:\Windows\System\OCNIxmJ.exe
  C:\Windows\System\OCNIxmJ.exe
  2⤵
  PID:6860
- C:\Windows\System\mljiXbW.exe
  C:\Windows\System\mljiXbW.exe
  2⤵
  PID:6876
- C:\Windows\System\NsCgkRS.exe
  C:\Windows\System\NsCgkRS.exe
  2⤵
  PID:6904
- C:\Windows\System\IfGkzHS.exe
  C:\Windows\System\IfGkzHS.exe
  2⤵
  PID:6944
- C:\Windows\System\OvogiFY.exe
  C:\Windows\System\OvogiFY.exe
  2⤵
  PID:6968
- C:\Windows\System\sVqgmpO.exe
  C:\Windows\System\sVqgmpO.exe
  2⤵
  PID:6988
- C:\Windows\System\HoVnpdl.exe
  C:\Windows\System\HoVnpdl.exe
  2⤵
  PID:7020
- C:\Windows\System\TxaFBzD.exe
  C:\Windows\System\TxaFBzD.exe
  2⤵
  PID:7052
- C:\Windows\System\dYKClrh.exe
  C:\Windows\System\dYKClrh.exe
  2⤵
  PID:7076
- C:\Windows\System\PEnoQzw.exe
  C:\Windows\System\PEnoQzw.exe
  2⤵
  PID:7092
- C:\Windows\System\YlEuSZI.exe
  C:\Windows\System\YlEuSZI.exe
  2⤵
  PID:7116
- C:\Windows\System\hlRgXiQ.exe
  C:\Windows\System\hlRgXiQ.exe
  2⤵
  PID:7136
- C:\Windows\System\IvooaUn.exe
  C:\Windows\System\IvooaUn.exe
  2⤵
  PID:1572
- C:\Windows\System\bPwdJMK.exe
  C:\Windows\System\bPwdJMK.exe
  2⤵
  PID:3000
- C:\Windows\System\JbFHlxP.exe
  C:\Windows\System\JbFHlxP.exe
  2⤵
  PID:6216
- C:\Windows\System\hwxIJxT.exe
  C:\Windows\System\hwxIJxT.exe
  2⤵
  PID:6420
- C:\Windows\System\mnBuvWW.exe
  C:\Windows\System\mnBuvWW.exe
  2⤵
  PID:6372
- C:\Windows\System\lJbbUxF.exe
  C:\Windows\System\lJbbUxF.exe
  2⤵
  PID:6480
- C:\Windows\System\rWZHMRX.exe
  C:\Windows\System\rWZHMRX.exe
  2⤵
  PID:6504
- C:\Windows\System\bQMAuBB.exe
  C:\Windows\System\bQMAuBB.exe
  2⤵
  PID:6540
- C:\Windows\System\VuyUUtu.exe
  C:\Windows\System\VuyUUtu.exe
  2⤵
  PID:6656
- C:\Windows\System\HaMDqSv.exe
  C:\Windows\System\HaMDqSv.exe
  2⤵
  PID:6632
- C:\Windows\System\cFgmpGY.exe
  C:\Windows\System\cFgmpGY.exe
  2⤵
  PID:6748
- C:\Windows\System\CohZlWA.exe
  C:\Windows\System\CohZlWA.exe
  2⤵
  PID:6756
- C:\Windows\System\zxEDVvC.exe
  C:\Windows\System\zxEDVvC.exe
  2⤵
  PID:6796
- C:\Windows\System\acUJAvt.exe
  C:\Windows\System\acUJAvt.exe
  2⤵
  PID:1384
- C:\Windows\System\DcqETjd.exe
  C:\Windows\System\DcqETjd.exe
  2⤵
  PID:6920
- C:\Windows\System\OYiDxNl.exe
  C:\Windows\System\OYiDxNl.exe
  2⤵
  PID:6956
- C:\Windows\System\koaBgSG.exe
  C:\Windows\System\koaBgSG.exe
  2⤵
  PID:7072
- C:\Windows\System\FXVZvQO.exe
  C:\Windows\System\FXVZvQO.exe
  2⤵
  PID:7128
- C:\Windows\System\ggEqvbx.exe
  C:\Windows\System\ggEqvbx.exe
  2⤵
  PID:6268
- C:\Windows\System\FCcBQCO.exe
  C:\Windows\System\FCcBQCO.exe
  2⤵
  PID:6240
- C:\Windows\System\epmLZYv.exe
  C:\Windows\System\epmLZYv.exe
  2⤵
  PID:6472
- C:\Windows\System\KOseflp.exe
  C:\Windows\System\KOseflp.exe
  2⤵
  PID:6348
- C:\Windows\System\enxYLWg.exe
  C:\Windows\System\enxYLWg.exe
  2⤵
  PID:6752
- C:\Windows\System\vqqWxAk.exe
  C:\Windows\System\vqqWxAk.exe
  2⤵
  PID:6872
- C:\Windows\System\yVsMGFT.exe
  C:\Windows\System\yVsMGFT.exe
  2⤵
  PID:7068
- C:\Windows\System\NIqIMKu.exe
  C:\Windows\System\NIqIMKu.exe
  2⤵
  PID:3144
- C:\Windows\System\axVatCf.exe
  C:\Windows\System\axVatCf.exe
  2⤵
  PID:6320
- C:\Windows\System\OkUZXHj.exe
  C:\Windows\System\OkUZXHj.exe
  2⤵
  PID:6428
- C:\Windows\System\wxesdLI.exe
  C:\Windows\System\wxesdLI.exe
  2⤵
  PID:6676
- C:\Windows\System\pVJOJzh.exe
  C:\Windows\System\pVJOJzh.exe
  2⤵
  PID:7112
- C:\Windows\System\ptRfCfu.exe
  C:\Windows\System\ptRfCfu.exe
  2⤵
  PID:6228
- C:\Windows\System\fJZuxET.exe
  C:\Windows\System\fJZuxET.exe
  2⤵
  PID:7212
- C:\Windows\System\hgNmtRQ.exe
  C:\Windows\System\hgNmtRQ.exe
  2⤵
  PID:7252
- C:\Windows\System\QtEKlEY.exe
  C:\Windows\System\QtEKlEY.exe
  2⤵
  PID:7268
- C:\Windows\System\egYRugn.exe
  C:\Windows\System\egYRugn.exe
  2⤵
  PID:7296
- C:\Windows\System\HNJjoGo.exe
  C:\Windows\System\HNJjoGo.exe
  2⤵
  PID:7316
- C:\Windows\System\fSFCrIS.exe
  C:\Windows\System\fSFCrIS.exe
  2⤵
  PID:7344
- C:\Windows\System\LnnXXsk.exe
  C:\Windows\System\LnnXXsk.exe
  2⤵
  PID:7368
- C:\Windows\System\acXYLic.exe
  C:\Windows\System\acXYLic.exe
  2⤵
  PID:7388
- C:\Windows\System\nsKpMFJ.exe
  C:\Windows\System\nsKpMFJ.exe
  2⤵
  PID:7412
- C:\Windows\System\BOdmWnF.exe
  C:\Windows\System\BOdmWnF.exe
  2⤵
  PID:7464
- C:\Windows\System\oxcCHEw.exe
  C:\Windows\System\oxcCHEw.exe
  2⤵
  PID:7512
- C:\Windows\System\NUyvpVQ.exe
  C:\Windows\System\NUyvpVQ.exe
  2⤵
  PID:7536
- C:\Windows\System\ZlJTwFh.exe
  C:\Windows\System\ZlJTwFh.exe
  2⤵
  PID:7564
- C:\Windows\System\rTuVUdv.exe
  C:\Windows\System\rTuVUdv.exe
  2⤵
  PID:7584
- C:\Windows\System\rWMzXQd.exe
  C:\Windows\System\rWMzXQd.exe
  2⤵
  PID:7604
- C:\Windows\System\JEDXWvH.exe
  C:\Windows\System\JEDXWvH.exe
  2⤵
  PID:7624
- C:\Windows\System\TIBscJo.exe
  C:\Windows\System\TIBscJo.exe
  2⤵
  PID:7664
- C:\Windows\System\zJAMEZL.exe
  C:\Windows\System\zJAMEZL.exe
  2⤵
  PID:7716
- C:\Windows\System\fXWLFsm.exe
  C:\Windows\System\fXWLFsm.exe
  2⤵
  PID:7736
- C:\Windows\System\IwwwQKr.exe
  C:\Windows\System\IwwwQKr.exe
  2⤵
  PID:7784
- C:\Windows\System\HOFYMAM.exe
  C:\Windows\System\HOFYMAM.exe
  2⤵
  PID:7808
- C:\Windows\System\ktTUwKA.exe
  C:\Windows\System\ktTUwKA.exe
  2⤵
  PID:7836
- C:\Windows\System\OZpTcCB.exe
  C:\Windows\System\OZpTcCB.exe
  2⤵
  PID:7860
- C:\Windows\System\AZGjgBN.exe
  C:\Windows\System\AZGjgBN.exe
  2⤵
  PID:7880
- C:\Windows\System\XnQthxY.exe
  C:\Windows\System\XnQthxY.exe
  2⤵
  PID:7940
- C:\Windows\System\jWtrqNR.exe
  C:\Windows\System\jWtrqNR.exe
  2⤵
  PID:7968
- C:\Windows\System\nzcFcZl.exe
  C:\Windows\System\nzcFcZl.exe
  2⤵
  PID:7984
- C:\Windows\System\nRBNOch.exe
  C:\Windows\System\nRBNOch.exe
  2⤵
  PID:8004
- C:\Windows\System\PnpgeAd.exe
  C:\Windows\System\PnpgeAd.exe
  2⤵
  PID:8028
- C:\Windows\System\culwUOh.exe
  C:\Windows\System\culwUOh.exe
  2⤵
  PID:8048
- C:\Windows\System\PcNTeEQ.exe
  C:\Windows\System\PcNTeEQ.exe
  2⤵
  PID:8072
- C:\Windows\System\varMwBu.exe
  C:\Windows\System\varMwBu.exe
  2⤵
  PID:8092
- C:\Windows\System\JknAwds.exe
  C:\Windows\System\JknAwds.exe
  2⤵
  PID:8144
- C:\Windows\System\hmaispx.exe
  C:\Windows\System\hmaispx.exe
  2⤵
  PID:8160
- C:\Windows\System\UkLpnkO.exe
  C:\Windows\System\UkLpnkO.exe
  2⤵
  PID:8184
- C:\Windows\System\eFCDlZM.exe
  C:\Windows\System\eFCDlZM.exe
  2⤵
  PID:7196
- C:\Windows\System\ChedRfb.exe
  C:\Windows\System\ChedRfb.exe
  2⤵
  PID:7224
- C:\Windows\System\ZPOKUMc.exe
  C:\Windows\System\ZPOKUMc.exe
  2⤵
  PID:7356
- C:\Windows\System\OvmuBlf.exe
  C:\Windows\System\OvmuBlf.exe
  2⤵
  PID:7332
- C:\Windows\System\oggPJQo.exe
  C:\Windows\System\oggPJQo.exe
  2⤵
  PID:7432
- C:\Windows\System\eHUVBqh.exe
  C:\Windows\System\eHUVBqh.exe
  2⤵
  PID:7492
- C:\Windows\System\VCIkMoJ.exe
  C:\Windows\System\VCIkMoJ.exe
  2⤵
  PID:7596
- C:\Windows\System\FvVLvmj.exe
  C:\Windows\System\FvVLvmj.exe
  2⤵
  PID:7652
- C:\Windows\System\vHJxygF.exe
  C:\Windows\System\vHJxygF.exe
  2⤵
  PID:7692
- C:\Windows\System\jniHnkA.exe
  C:\Windows\System\jniHnkA.exe
  2⤵
  PID:7776
- C:\Windows\System\LbIBskk.exe
  C:\Windows\System\LbIBskk.exe
  2⤵
  PID:7824
- C:\Windows\System\UYhbtZd.exe
  C:\Windows\System\UYhbtZd.exe
  2⤵
  PID:7936
- C:\Windows\System\RaVRgrb.exe
  C:\Windows\System\RaVRgrb.exe
  2⤵
  PID:7916
- C:\Windows\System\RibGxFj.exe
  C:\Windows\System\RibGxFj.exe
  2⤵
  PID:8084
- C:\Windows\System\PaIChys.exe
  C:\Windows\System\PaIChys.exe
  2⤵
  PID:8056
- C:\Windows\System\JDMNklk.exe
  C:\Windows\System\JDMNklk.exe
  2⤵
  PID:8156
- C:\Windows\System\cKyQHGb.exe
  C:\Windows\System\cKyQHGb.exe
  2⤵
  PID:7188
- C:\Windows\System\mLifIUr.exe
  C:\Windows\System\mLifIUr.exe
  2⤵
  PID:7336
- C:\Windows\System\fzoKBbK.exe
  C:\Windows\System\fzoKBbK.exe
  2⤵
  PID:7476
- C:\Windows\System\OlbBwwf.exe
  C:\Windows\System\OlbBwwf.exe
  2⤵
  PID:7708
- C:\Windows\System\akMWdSb.exe
  C:\Windows\System\akMWdSb.exe
  2⤵
  PID:7816
- C:\Windows\System\coRtPFj.exe
  C:\Windows\System\coRtPFj.exe
  2⤵
  PID:7912
- C:\Windows\System\soZIAuh.exe
  C:\Windows\System\soZIAuh.exe
  2⤵
  PID:8088
- C:\Windows\System\PQVnRnj.exe
  C:\Windows\System\PQVnRnj.exe
  2⤵
  PID:8180
- C:\Windows\System\atjgeUi.exe
  C:\Windows\System\atjgeUi.exe
  2⤵
  PID:7700
- C:\Windows\System\FgtTYLf.exe
  C:\Windows\System\FgtTYLf.exe
  2⤵
  PID:7760
- C:\Windows\System\BoaAPZV.exe
  C:\Windows\System\BoaAPZV.exe
  2⤵
  PID:7260
- C:\Windows\System\uKHxiFW.exe
  C:\Windows\System\uKHxiFW.exe
  2⤵
  PID:8200
- C:\Windows\System\DDIjwhJ.exe
  C:\Windows\System\DDIjwhJ.exe
  2⤵
  PID:8232
- C:\Windows\System\KLJyDos.exe
  C:\Windows\System\KLJyDos.exe
  2⤵
  PID:8256
- C:\Windows\System\sotqHls.exe
  C:\Windows\System\sotqHls.exe
  2⤵
  PID:8276
- C:\Windows\System\uttKYgo.exe
  C:\Windows\System\uttKYgo.exe
  2⤵
  PID:8304
- C:\Windows\System\wxJSExg.exe
  C:\Windows\System\wxJSExg.exe
  2⤵
  PID:8332
- C:\Windows\System\KielPpZ.exe
  C:\Windows\System\KielPpZ.exe
  2⤵
  PID:8352
- C:\Windows\System\yxNqVfI.exe
  C:\Windows\System\yxNqVfI.exe
  2⤵
  PID:8396
- C:\Windows\System\LrQIlEF.exe
  C:\Windows\System\LrQIlEF.exe
  2⤵
  PID:8428
- C:\Windows\System\DOAMyZN.exe
  C:\Windows\System\DOAMyZN.exe
  2⤵
  PID:8448
- C:\Windows\System\gJvQisK.exe
  C:\Windows\System\gJvQisK.exe
  2⤵
  PID:8476
- C:\Windows\System\nKLXxMl.exe
  C:\Windows\System\nKLXxMl.exe
  2⤵
  PID:8500
- C:\Windows\System\AfPXalq.exe
  C:\Windows\System\AfPXalq.exe
  2⤵
  PID:8556
- C:\Windows\System\czcJCqD.exe
  C:\Windows\System\czcJCqD.exe
  2⤵
  PID:8580
- C:\Windows\System\QzQDKOE.exe
  C:\Windows\System\QzQDKOE.exe
  2⤵
  PID:8600
- C:\Windows\System\BdTkjYG.exe
  C:\Windows\System\BdTkjYG.exe
  2⤵
  PID:8644
- C:\Windows\System\bdVWaMN.exe
  C:\Windows\System\bdVWaMN.exe
  2⤵
  PID:8664
- C:\Windows\System\ZTTdztb.exe
  C:\Windows\System\ZTTdztb.exe
  2⤵
  PID:8732
- C:\Windows\System\FNhPdBq.exe
  C:\Windows\System\FNhPdBq.exe
  2⤵
  PID:8748
- C:\Windows\System\FaQkFcl.exe
  C:\Windows\System\FaQkFcl.exe
  2⤵
  PID:8772
- C:\Windows\System\cCUeAUL.exe
  C:\Windows\System\cCUeAUL.exe
  2⤵
  PID:8800
- C:\Windows\System\VHiyjjK.exe
  C:\Windows\System\VHiyjjK.exe
  2⤵
  PID:8828
- C:\Windows\System\pYnGAfS.exe
  C:\Windows\System\pYnGAfS.exe
  2⤵
  PID:8848
- C:\Windows\System\aXgmphT.exe
  C:\Windows\System\aXgmphT.exe
  2⤵
  PID:8868
- C:\Windows\System\VqJhgsq.exe
  C:\Windows\System\VqJhgsq.exe
  2⤵
  PID:8896
- C:\Windows\System\oJsluhr.exe
  C:\Windows\System\oJsluhr.exe
  2⤵
  PID:8940
- C:\Windows\System\KZwmyhh.exe
  C:\Windows\System\KZwmyhh.exe
  2⤵
  PID:8960
- C:\Windows\System\ZxyzHwQ.exe
  C:\Windows\System\ZxyzHwQ.exe
  2⤵
  PID:8980
- C:\Windows\System\bsEigdU.exe
  C:\Windows\System\bsEigdU.exe
  2⤵
  PID:9008
- C:\Windows\System\PzpxEOa.exe
  C:\Windows\System\PzpxEOa.exe
  2⤵
  PID:9036
- C:\Windows\System\VksQYgY.exe
  C:\Windows\System\VksQYgY.exe
  2⤵
  PID:9052
- C:\Windows\System\gSGdFyx.exe
  C:\Windows\System\gSGdFyx.exe
  2⤵
  PID:9104
- C:\Windows\System\CNvqmDi.exe
  C:\Windows\System\CNvqmDi.exe
  2⤵
  PID:9136
- C:\Windows\System\YVwSRVr.exe
  C:\Windows\System\YVwSRVr.exe
  2⤵
  PID:9156
- C:\Windows\System\kJmMTUh.exe
  C:\Windows\System\kJmMTUh.exe
  2⤵
  PID:9176
- C:\Windows\System\ccIwzgt.exe
  C:\Windows\System\ccIwzgt.exe
  2⤵
  PID:9204
- C:\Windows\System\ibTIbDq.exe
  C:\Windows\System\ibTIbDq.exe
  2⤵
  PID:8268
- C:\Windows\System\lijFmIy.exe
  C:\Windows\System\lijFmIy.exe
  2⤵
  PID:8272
- C:\Windows\System\WFvLLgp.exe
  C:\Windows\System\WFvLLgp.exe
  2⤵
  PID:8340
- C:\Windows\System\kiBWPva.exe
  C:\Windows\System\kiBWPva.exe
  2⤵
  PID:8456
- C:\Windows\System\FSAKDYe.exe
  C:\Windows\System\FSAKDYe.exe
  2⤵
  PID:8512
- C:\Windows\System\JtwGWHB.exe
  C:\Windows\System\JtwGWHB.exe
  2⤵
  PID:8540
- C:\Windows\System\mRORurY.exe
  C:\Windows\System\mRORurY.exe
  2⤵
  PID:8616
- C:\Windows\System\LmmKZOR.exe
  C:\Windows\System\LmmKZOR.exe
  2⤵
  PID:8676
- C:\Windows\System\nBlNiau.exe
  C:\Windows\System\nBlNiau.exe
  2⤵
  PID:8680
- C:\Windows\System\dxgazAW.exe
  C:\Windows\System\dxgazAW.exe
  2⤵
  PID:8816
- C:\Windows\System\iLXRCwd.exe
  C:\Windows\System\iLXRCwd.exe
  2⤵
  PID:8864
- C:\Windows\System\muDSWxW.exe
  C:\Windows\System\muDSWxW.exe
  2⤵
  PID:8908
- C:\Windows\System\IDJuONq.exe
  C:\Windows\System\IDJuONq.exe
  2⤵
  PID:8988
- C:\Windows\System\ACRckYE.exe
  C:\Windows\System\ACRckYE.exe
  2⤵
  PID:9080
- C:\Windows\System\strhUGp.exe
  C:\Windows\System\strhUGp.exe
  2⤵
  PID:9128
- C:\Windows\System\cdysLQB.exe
  C:\Windows\System\cdysLQB.exe
  2⤵
  PID:8248
- C:\Windows\System\eRhjshw.exe
  C:\Windows\System\eRhjshw.exe
  2⤵
  PID:8300
- C:\Windows\System\HdvzvoH.exe
  C:\Windows\System\HdvzvoH.exe
  2⤵
  PID:8436
- C:\Windows\System\yFgKKsW.exe
  C:\Windows\System\yFgKKsW.exe
  2⤵
  PID:8652
- C:\Windows\System\KcPwMTh.exe
  C:\Windows\System\KcPwMTh.exe
  2⤵
  PID:8744
- C:\Windows\System\wfNqVZG.exe
  C:\Windows\System\wfNqVZG.exe
  2⤵
  PID:8892
- C:\Windows\System\aPFAxCl.exe
  C:\Windows\System\aPFAxCl.exe
  2⤵
  PID:8976
- C:\Windows\System\GbivGfa.exe
  C:\Windows\System\GbivGfa.exe
  2⤵
  PID:9088
- C:\Windows\System\MTKdOBV.exe
  C:\Windows\System\MTKdOBV.exe
  2⤵
  PID:8444
- C:\Windows\System\ZqSxdhk.exe
  C:\Windows\System\ZqSxdhk.exe
  2⤵
  PID:8196
- C:\Windows\System\ZRdClBm.exe
  C:\Windows\System\ZRdClBm.exe
  2⤵
  PID:8588
- C:\Windows\System\PfeduOR.exe
  C:\Windows\System\PfeduOR.exe
  2⤵
  PID:9232
- C:\Windows\System\vFEXIij.exe
  C:\Windows\System\vFEXIij.exe
  2⤵
  PID:9252
- C:\Windows\System\mqJqjpZ.exe
  C:\Windows\System\mqJqjpZ.exe
  2⤵
  PID:9280
- C:\Windows\System\BXmqMjU.exe
  C:\Windows\System\BXmqMjU.exe
  2⤵
  PID:9312
- C:\Windows\System\zrzKvXo.exe
  C:\Windows\System\zrzKvXo.exe
  2⤵
  PID:9356
- C:\Windows\System\TpUbmPD.exe
  C:\Windows\System\TpUbmPD.exe
  2⤵
  PID:9412
- C:\Windows\System\ofBtVfQ.exe
  C:\Windows\System\ofBtVfQ.exe
  2⤵
  PID:9448
- C:\Windows\System\hzhkLVk.exe
  C:\Windows\System\hzhkLVk.exe
  2⤵
  PID:9468
- C:\Windows\System\HOLHrjP.exe
  C:\Windows\System\HOLHrjP.exe
  2⤵
  PID:9492
- C:\Windows\System\NyfRtVl.exe
  C:\Windows\System\NyfRtVl.exe
  2⤵
  PID:9516
- C:\Windows\System\losHzZT.exe
  C:\Windows\System\losHzZT.exe
  2⤵
  PID:9540
- C:\Windows\System\sVHqAYC.exe
  C:\Windows\System\sVHqAYC.exe
  2⤵
  PID:9572
- C:\Windows\System\iMxyuMT.exe
  C:\Windows\System\iMxyuMT.exe
  2⤵
  PID:9600
- C:\Windows\System\zWJNgni.exe
  C:\Windows\System\zWJNgni.exe
  2⤵
  PID:9616
- C:\Windows\System\smLvRzK.exe
  C:\Windows\System\smLvRzK.exe
  2⤵
  PID:9644
- C:\Windows\System\FnyAMVP.exe
  C:\Windows\System\FnyAMVP.exe
  2⤵
  PID:9664
- C:\Windows\System\nIDBGCY.exe
  C:\Windows\System\nIDBGCY.exe
  2⤵
  PID:9692
- C:\Windows\System\TqmXBLe.exe
  C:\Windows\System\TqmXBLe.exe
  2⤵
  PID:9712
- C:\Windows\System\IRZuVpz.exe
  C:\Windows\System\IRZuVpz.exe
  2⤵
  PID:9760
- C:\Windows\System\FAweKPK.exe
  C:\Windows\System\FAweKPK.exe
  2⤵
  PID:9784
- C:\Windows\System\Ybfptmj.exe
  C:\Windows\System\Ybfptmj.exe
  2⤵
  PID:9804
- C:\Windows\System\KnXZDhg.exe
  C:\Windows\System\KnXZDhg.exe
  2⤵
  PID:9828
- C:\Windows\System\JvYbdFL.exe
  C:\Windows\System\JvYbdFL.exe
  2⤵
  PID:9852
- C:\Windows\System\BVnaZui.exe
  C:\Windows\System\BVnaZui.exe
  2⤵
  PID:9924
- C:\Windows\System\KqlecAC.exe
  C:\Windows\System\KqlecAC.exe
  2⤵
  PID:9948
- C:\Windows\System\gHWgFJG.exe
  C:\Windows\System\gHWgFJG.exe
  2⤵
  PID:9968
- C:\Windows\System\aKWQqoM.exe
  C:\Windows\System\aKWQqoM.exe
  2⤵
  PID:9996
- C:\Windows\System\krDrfxl.exe
  C:\Windows\System\krDrfxl.exe
  2⤵
  PID:10016
- C:\Windows\System\GpKmpQO.exe
  C:\Windows\System\GpKmpQO.exe
  2⤵
  PID:10040
- C:\Windows\System\HgnNMAo.exe
  C:\Windows\System\HgnNMAo.exe
  2⤵
  PID:10072
- C:\Windows\System\cvaGPJj.exe
  C:\Windows\System\cvaGPJj.exe
  2⤵
  PID:10112
- C:\Windows\System\ApoSThZ.exe
  C:\Windows\System\ApoSThZ.exe
  2⤵
  PID:10132
- C:\Windows\System\SNumqeF.exe
  C:\Windows\System\SNumqeF.exe
  2⤵
  PID:10160
- C:\Windows\System\ENgSRdA.exe
  C:\Windows\System\ENgSRdA.exe
  2⤵
  PID:10184
- C:\Windows\System\XxMzmEq.exe
  C:\Windows\System\XxMzmEq.exe
  2⤵
  PID:10212
- C:\Windows\System\EWKGFpU.exe
  C:\Windows\System\EWKGFpU.exe
  2⤵
  PID:10236
- C:\Windows\System\VsSnsUp.exe
  C:\Windows\System\VsSnsUp.exe
  2⤵
  PID:8320
- C:\Windows\System\hnCfWqW.exe
  C:\Windows\System\hnCfWqW.exe
  2⤵
  PID:9352
- C:\Windows\System\wddnKzx.exe
  C:\Windows\System\wddnKzx.exe
  2⤵
  PID:9404
- C:\Windows\System\fADkLcO.exe
  C:\Windows\System\fADkLcO.exe
  2⤵
  PID:9460
- C:\Windows\System\hOsZFSE.exe
  C:\Windows\System\hOsZFSE.exe
  2⤵
  PID:9532
- C:\Windows\System\bqxsoOb.exe
  C:\Windows\System\bqxsoOb.exe
  2⤵
  PID:9588
- C:\Windows\System\jlPbeMX.exe
  C:\Windows\System\jlPbeMX.exe
  2⤵
  PID:9612
- C:\Windows\System\qvNQsmG.exe
  C:\Windows\System\qvNQsmG.exe
  2⤵
  PID:9660
- C:\Windows\System\iVwNuRX.exe
  C:\Windows\System\iVwNuRX.exe
  2⤵
  PID:9756
- C:\Windows\System\xGIVayX.exe
  C:\Windows\System\xGIVayX.exe
  2⤵
  PID:9796
- C:\Windows\System\xyuLHqA.exe
  C:\Windows\System\xyuLHqA.exe
  2⤵
  PID:9820
- C:\Windows\System\dbcPhqa.exe
  C:\Windows\System\dbcPhqa.exe
  2⤵
  PID:9892
- C:\Windows\System\XeXFVfF.exe
  C:\Windows\System\XeXFVfF.exe
  2⤵
  PID:10008
- C:\Windows\System\fMyDjzb.exe
  C:\Windows\System\fMyDjzb.exe
  2⤵
  PID:10064
- C:\Windows\System\TSBeEkV.exe
  C:\Windows\System\TSBeEkV.exe
  2⤵
  PID:10148
- C:\Windows\System\WpbebcV.exe
  C:\Windows\System\WpbebcV.exe
  2⤵
  PID:10180
- C:\Windows\System\bfHndiW.exe
  C:\Windows\System\bfHndiW.exe
  2⤵
  PID:9148
- C:\Windows\System\VEbYGHi.exe
  C:\Windows\System\VEbYGHi.exe
  2⤵
  PID:9388
- C:\Windows\System\olAcvGx.exe
  C:\Windows\System\olAcvGx.exe
  2⤵
  PID:9500
- C:\Windows\System\pAMDpsQ.exe
  C:\Windows\System\pAMDpsQ.exe
  2⤵
  PID:9680
- C:\Windows\System\IyNKwWf.exe
  C:\Windows\System\IyNKwWf.exe
  2⤵
  PID:9776
- C:\Windows\System\hHMGpfv.exe
  C:\Windows\System\hHMGpfv.exe
  2⤵
  PID:9876
- C:\Windows\System\YKoXTYE.exe
  C:\Windows\System\YKoXTYE.exe
  2⤵
  PID:10004
- C:\Windows\System\fMLNjWe.exe
  C:\Windows\System\fMLNjWe.exe
  2⤵
  PID:9244
- C:\Windows\System\sogdxMV.exe
  C:\Windows\System\sogdxMV.exe
  2⤵
  PID:8536
- C:\Windows\System\TGCfuXu.exe
  C:\Windows\System\TGCfuXu.exe
  2⤵
  PID:9684
- C:\Windows\System\oOkrnfd.exe
  C:\Windows\System\oOkrnfd.exe
  2⤵
  PID:9984
- C:\Windows\System\SJWicbU.exe
  C:\Windows\System\SJWicbU.exe
  2⤵
  PID:9308
- C:\Windows\System\LKKxIDV.exe
  C:\Windows\System\LKKxIDV.exe
  2⤵
  PID:10244
- C:\Windows\System\uFvtrDA.exe
  C:\Windows\System\uFvtrDA.exe
  2⤵
  PID:10268
- C:\Windows\System\xGmXJnF.exe
  C:\Windows\System\xGmXJnF.exe
  2⤵
  PID:10296
- C:\Windows\System\MlFsfyv.exe
  C:\Windows\System\MlFsfyv.exe
  2⤵
  PID:10316
- C:\Windows\System\LZrAiKM.exe
  C:\Windows\System\LZrAiKM.exe
  2⤵
  PID:10336
- C:\Windows\System\kmQNmEv.exe
  C:\Windows\System\kmQNmEv.exe
  2⤵
  PID:10388
- C:\Windows\System\yAVXODn.exe
  C:\Windows\System\yAVXODn.exe
  2⤵
  PID:10428
- C:\Windows\System\MFpkqSA.exe
  C:\Windows\System\MFpkqSA.exe
  2⤵
  PID:10448
- C:\Windows\System\rLjCnKP.exe
  C:\Windows\System\rLjCnKP.exe
  2⤵
  PID:10476
- C:\Windows\System\dWuPkcr.exe
  C:\Windows\System\dWuPkcr.exe
  2⤵
  PID:10508
- C:\Windows\System\bZgbCxH.exe
  C:\Windows\System\bZgbCxH.exe
  2⤵
  PID:10544
- C:\Windows\System\yLzMMLe.exe
  C:\Windows\System\yLzMMLe.exe
  2⤵
  PID:10564
- C:\Windows\System\NNhXNDY.exe
  C:\Windows\System\NNhXNDY.exe
  2⤵
  PID:10596
- C:\Windows\System\tuqtfYA.exe
  C:\Windows\System\tuqtfYA.exe
  2⤵
  PID:10624
- C:\Windows\System\BkZSVZT.exe
  C:\Windows\System\BkZSVZT.exe
  2⤵
  PID:10656
- C:\Windows\System\pnjLGmW.exe
  C:\Windows\System\pnjLGmW.exe
  2⤵
  PID:10672
- C:\Windows\System\gpRHhzW.exe
  C:\Windows\System\gpRHhzW.exe
  2⤵
  PID:10696
- C:\Windows\System\CxDlZDJ.exe
  C:\Windows\System\CxDlZDJ.exe
  2⤵
  PID:10712
- C:\Windows\System\VQJmiBL.exe
  C:\Windows\System\VQJmiBL.exe
  2⤵
  PID:10740
- C:\Windows\System\bQGuPhs.exe
  C:\Windows\System\bQGuPhs.exe
  2⤵
  PID:10764
- C:\Windows\System\wwLSsiM.exe
  C:\Windows\System\wwLSsiM.exe
  2⤵
  PID:10808
- C:\Windows\System\ZXSXuYU.exe
  C:\Windows\System\ZXSXuYU.exe
  2⤵
  PID:10852
- C:\Windows\System\bqZARCE.exe
  C:\Windows\System\bqZARCE.exe
  2⤵
  PID:10892
- C:\Windows\System\MEwjVnN.exe
  C:\Windows\System\MEwjVnN.exe
  2⤵
  PID:10908
- C:\Windows\System\eTiCAfg.exe
  C:\Windows\System\eTiCAfg.exe
  2⤵
  PID:10944
- C:\Windows\System\fxBVjNw.exe
  C:\Windows\System\fxBVjNw.exe
  2⤵
  PID:10976
- C:\Windows\System\iDSkoiE.exe
  C:\Windows\System\iDSkoiE.exe
  2⤵
  PID:10996
- C:\Windows\System\ygATflS.exe
  C:\Windows\System\ygATflS.exe
  2⤵
  PID:11024
- C:\Windows\System\HclFujX.exe
  C:\Windows\System\HclFujX.exe
  2⤵
  PID:11044
- C:\Windows\System\DzrLhGW.exe
  C:\Windows\System\DzrLhGW.exe
  2⤵
  PID:11072
- C:\Windows\System\BAlBpVF.exe
  C:\Windows\System\BAlBpVF.exe
  2⤵
  PID:11104
- C:\Windows\System\FHzoeXu.exe
  C:\Windows\System\FHzoeXu.exe
  2⤵
  PID:11124
- C:\Windows\System\OLoINiU.exe
  C:\Windows\System\OLoINiU.exe
  2⤵
  PID:11144
- C:\Windows\System\lFctQlH.exe
  C:\Windows\System\lFctQlH.exe
  2⤵
  PID:11172
- C:\Windows\System\rehFyrL.exe
  C:\Windows\System\rehFyrL.exe
  2⤵
  PID:11208
- C:\Windows\System\eFCiXdx.exe
  C:\Windows\System\eFCiXdx.exe
  2⤵
  PID:11236
- C:\Windows\System\SakJFPR.exe
  C:\Windows\System\SakJFPR.exe
  2⤵
  PID:11260
- C:\Windows\System\eePoWNR.exe
  C:\Windows\System\eePoWNR.exe
  2⤵
  PID:10356
- C:\Windows\System\HJRFErV.exe
  C:\Windows\System\HJRFErV.exe
  2⤵
  PID:10380
- C:\Windows\System\gSTkgHk.exe
  C:\Windows\System\gSTkgHk.exe
  2⤵
  PID:10444
- C:\Windows\System\KiUtHvF.exe
  C:\Windows\System\KiUtHvF.exe
  2⤵
  PID:10484
- C:\Windows\System\YtnCJgk.exe
  C:\Windows\System\YtnCJgk.exe
  2⤵
  PID:10524
- C:\Windows\System\coNeBbK.exe
  C:\Windows\System\coNeBbK.exe
  2⤵
  PID:10604
- C:\Windows\System\xohmqhK.exe
  C:\Windows\System\xohmqhK.exe
  2⤵
  PID:9032
- C:\Windows\System\nHJkwWR.exe
  C:\Windows\System\nHJkwWR.exe
  2⤵
  PID:10788
- C:\Windows\System\MmtxYAm.exe
  C:\Windows\System\MmtxYAm.exe
  2⤵
  PID:9268
- C:\Windows\System\VcEYXyC.exe
  C:\Windows\System\VcEYXyC.exe
  2⤵
  PID:10868
- C:\Windows\System\QZTxzmb.exe
  C:\Windows\System\QZTxzmb.exe
  2⤵
  PID:10904
- C:\Windows\System\UqbqlPm.exe
  C:\Windows\System\UqbqlPm.exe
  2⤵
  PID:10108
- C:\Windows\System\EokGuIH.exe
  C:\Windows\System\EokGuIH.exe
  2⤵
  PID:11040
- C:\Windows\System\hCNfbEF.exe
  C:\Windows\System\hCNfbEF.exe
  2⤵
  PID:11164
- C:\Windows\System\aGWYYYJ.exe
  C:\Windows\System\aGWYYYJ.exe
  2⤵
  PID:11228
- C:\Windows\System\HbGnNzi.exe
  C:\Windows\System\HbGnNzi.exe
  2⤵
  PID:11256
- C:\Windows\System\sWwFFmC.exe
  C:\Windows\System\sWwFFmC.exe
  2⤵
  PID:10384
- C:\Windows\System\qPgwkXk.exe
  C:\Windows\System\qPgwkXk.exe
  2⤵
  PID:10496
- C:\Windows\System\VXRUyCT.exe
  C:\Windows\System\VXRUyCT.exe
  2⤵
  PID:10636
- C:\Windows\System\xEqbPmp.exe
  C:\Windows\System\xEqbPmp.exe
  2⤵
  PID:10800
- C:\Windows\System\MMuitDF.exe
  C:\Windows\System\MMuitDF.exe
  2⤵
  PID:10900
- C:\Windows\System\YtuyZJH.exe
  C:\Windows\System\YtuyZJH.exe
  2⤵
  PID:11120
- C:\Windows\System\sPjtQij.exe
  C:\Windows\System\sPjtQij.exe
  2⤵
  PID:11168
- C:\Windows\System\DEUpqRf.exe
  C:\Windows\System\DEUpqRf.exe
  2⤵
  PID:10924
- C:\Windows\System\UpuaOuF.exe
  C:\Windows\System\UpuaOuF.exe
  2⤵
  PID:10992
- C:\Windows\System\zYEjEtp.exe
  C:\Windows\System\zYEjEtp.exe
  2⤵
  PID:10776
- C:\Windows\System\aJfqLQX.exe
  C:\Windows\System\aJfqLQX.exe
  2⤵
  PID:10616
- C:\Windows\System\OWenYiO.exe
  C:\Windows\System\OWenYiO.exe
  2⤵
  PID:11272
- C:\Windows\System\BWrWphQ.exe
  C:\Windows\System\BWrWphQ.exe
  2⤵
  PID:11292
- C:\Windows\System\izmGAzn.exe
  C:\Windows\System\izmGAzn.exe
  2⤵
  PID:11320
- C:\Windows\System\sNmpFYG.exe
  C:\Windows\System\sNmpFYG.exe
  2⤵
  PID:11336
- C:\Windows\System\ZeDKkKg.exe
  C:\Windows\System\ZeDKkKg.exe
  2⤵
  PID:11360
- C:\Windows\System\fruYCet.exe
  C:\Windows\System\fruYCet.exe
  2⤵
  PID:11384
- C:\Windows\System\SLMYhnq.exe
  C:\Windows\System\SLMYhnq.exe
  2⤵
  PID:11404
- C:\Windows\System\GjlkOGf.exe
  C:\Windows\System\GjlkOGf.exe
  2⤵
  PID:11436
- C:\Windows\System\RIDfIkh.exe
  C:\Windows\System\RIDfIkh.exe
  2⤵
  PID:11456
- C:\Windows\System\WHGVSzL.exe
  C:\Windows\System\WHGVSzL.exe
  2⤵
  PID:11476
- C:\Windows\System\CmQsCzQ.exe
  C:\Windows\System\CmQsCzQ.exe
  2⤵
  PID:11500
- C:\Windows\System\xHWZvqO.exe
  C:\Windows\System\xHWZvqO.exe
  2⤵
  PID:11556
- C:\Windows\System\AsaLbOU.exe
  C:\Windows\System\AsaLbOU.exe
  2⤵
  PID:11576
- C:\Windows\System\OazZzbZ.exe
  C:\Windows\System\OazZzbZ.exe
  2⤵
  PID:11640
- C:\Windows\System\jzEEVID.exe
  C:\Windows\System\jzEEVID.exe
  2⤵
  PID:11700
- C:\Windows\System\DkQwRZl.exe
  C:\Windows\System\DkQwRZl.exe
  2⤵
  PID:11724
- C:\Windows\System\HvyWRni.exe
  C:\Windows\System\HvyWRni.exe
  2⤵
  PID:11752
- C:\Windows\System\pOpefjj.exe
  C:\Windows\System\pOpefjj.exe
  2⤵
  PID:11792
- C:\Windows\System\sQZkLbY.exe
  C:\Windows\System\sQZkLbY.exe
  2⤵
  PID:11816
- C:\Windows\System\NSqVAET.exe
  C:\Windows\System\NSqVAET.exe
  2⤵
  PID:11836
- C:\Windows\System\dDMfFXY.exe
  C:\Windows\System\dDMfFXY.exe
  2⤵
  PID:11876
- C:\Windows\System\MgNKeBi.exe
  C:\Windows\System\MgNKeBi.exe
  2⤵
  PID:11904
- C:\Windows\System\VQcgYbP.exe
  C:\Windows\System\VQcgYbP.exe
  2⤵
  PID:11944
- C:\Windows\System\qTEoVSl.exe
  C:\Windows\System\qTEoVSl.exe
  2⤵
  PID:11960
- C:\Windows\System\cFDQVEj.exe
  C:\Windows\System\cFDQVEj.exe
  2⤵
  PID:11976
- C:\Windows\System\jFSRBxW.exe
  C:\Windows\System\jFSRBxW.exe
  2⤵
  PID:12008
- C:\Windows\System\tgypLve.exe
  C:\Windows\System\tgypLve.exe
  2⤵
  PID:12032
- C:\Windows\System\TmTLahD.exe
  C:\Windows\System\TmTLahD.exe
  2⤵
  PID:12052
- C:\Windows\System\gouTPbb.exe
  C:\Windows\System\gouTPbb.exe
  2⤵
  PID:12084
- C:\Windows\System\WuzXoLW.exe
  C:\Windows\System\WuzXoLW.exe
  2⤵
  PID:12104
- C:\Windows\System\jouLRFr.exe
  C:\Windows\System\jouLRFr.exe
  2⤵
  PID:12120
- C:\Windows\System\sumTmSc.exe
  C:\Windows\System\sumTmSc.exe
  2⤵
  PID:12148
- C:\Windows\System\oYqgocQ.exe
  C:\Windows\System\oYqgocQ.exe
  2⤵
  PID:12164
- C:\Windows\System\XsVEdwV.exe
  C:\Windows\System\XsVEdwV.exe
  2⤵
  PID:12228
- C:\Windows\System\CmVlDIq.exe
  C:\Windows\System\CmVlDIq.exe
  2⤵
  PID:12252
- C:\Windows\System\oSQJwyl.exe
  C:\Windows\System\oSQJwyl.exe
  2⤵
  PID:12268
- C:\Windows\System\TdcmkrU.exe
  C:\Windows\System\TdcmkrU.exe
  2⤵
  PID:10492
- C:\Windows\System\cxjNPfG.exe
  C:\Windows\System\cxjNPfG.exe
  2⤵
  PID:11308
- C:\Windows\System\bquFoDT.exe
  C:\Windows\System\bquFoDT.exe
  2⤵
  PID:11344
- C:\Windows\System\HkbRyIz.exe
  C:\Windows\System\HkbRyIz.exe
  2⤵
  PID:11444
- C:\Windows\System\arAKTVQ.exe
  C:\Windows\System\arAKTVQ.exe
  2⤵
  PID:11492
- C:\Windows\System\FRDrjDt.exe
  C:\Windows\System\FRDrjDt.exe
  2⤵
  PID:11572
- C:\Windows\System\nPPNFwi.exe
  C:\Windows\System\nPPNFwi.exe
  2⤵
  PID:11652
- C:\Windows\System\kjKiuEu.exe
  C:\Windows\System\kjKiuEu.exe
  2⤵
  PID:11708
- C:\Windows\System\kPvtFIg.exe
  C:\Windows\System\kPvtFIg.exe
  2⤵
  PID:11736
- C:\Windows\System\rWiKqcv.exe
  C:\Windows\System\rWiKqcv.exe
  2⤵
  PID:11828
- C:\Windows\System\ltkcyqc.exe
  C:\Windows\System\ltkcyqc.exe
  2⤵
  PID:11936
- C:\Windows\System\unhJawu.exe
  C:\Windows\System\unhJawu.exe
  2⤵
  PID:11972
- C:\Windows\System\vpzMaqU.exe
  C:\Windows\System\vpzMaqU.exe
  2⤵
  PID:12112
- C:\Windows\System\ybDNsyM.exe
  C:\Windows\System\ybDNsyM.exe
  2⤵
  PID:12116
- C:\Windows\System\FixFSnP.exe
  C:\Windows\System\FixFSnP.exe
  2⤵
  PID:12188
- C:\Windows\System\GdrwzBF.exe
  C:\Windows\System\GdrwzBF.exe
  2⤵
  PID:12276
- C:\Windows\System\UBCHgDP.exe
  C:\Windows\System\UBCHgDP.exe
  2⤵
  PID:11312
- C:\Windows\System\VRNDdaH.exe
  C:\Windows\System\VRNDdaH.exe
  2⤵
  PID:11464
- C:\Windows\System\FERIMYY.exe
  C:\Windows\System\FERIMYY.exe
  2⤵
  PID:11716
- C:\Windows\System\EOSjlrc.exe
  C:\Windows\System\EOSjlrc.exe
  2⤵
  PID:11852
- C:\Windows\System\dqHpacV.exe
  C:\Windows\System\dqHpacV.exe
  2⤵
  PID:12060
- C:\Windows\System\oTqynDq.exe
  C:\Windows\System\oTqynDq.exe
  2⤵
  PID:12080
- C:\Windows\System\pAvOIcf.exe
  C:\Windows\System\pAvOIcf.exe
  2⤵
  PID:12260
- C:\Windows\System\GgQlkWM.exe
  C:\Windows\System\GgQlkWM.exe
  2⤵
  PID:11612
- C:\Windows\System\zBidtXB.exe
  C:\Windows\System\zBidtXB.exe
  2⤵
  PID:12160
- C:\Windows\System\QIWWOsJ.exe
  C:\Windows\System\QIWWOsJ.exe
  2⤵
  PID:11696
- C:\Windows\System\zkCzHop.exe
  C:\Windows\System\zkCzHop.exe
  2⤵
  PID:11788
- C:\Windows\System\ANIADLA.exe
  C:\Windows\System\ANIADLA.exe
  2⤵
  PID:12304
- C:\Windows\System\cWFdDnB.exe
  C:\Windows\System\cWFdDnB.exe
  2⤵
  PID:12324
- C:\Windows\System\dyeriTZ.exe
  C:\Windows\System\dyeriTZ.exe
  2⤵
  PID:12372
- C:\Windows\System\WwnFjCj.exe
  C:\Windows\System\WwnFjCj.exe
  2⤵
  PID:12392
- C:\Windows\System\FcEdtvE.exe
  C:\Windows\System\FcEdtvE.exe
  2⤵
  PID:12416
- C:\Windows\System\KQSHIWb.exe
  C:\Windows\System\KQSHIWb.exe
  2⤵
  PID:12436
- C:\Windows\System\lAFcjrI.exe
  C:\Windows\System\lAFcjrI.exe
  2⤵
  PID:12464
- C:\Windows\System\KsIkGbw.exe
  C:\Windows\System\KsIkGbw.exe
  2⤵
  PID:12488
- C:\Windows\System\qdIqakb.exe
  C:\Windows\System\qdIqakb.exe
  2⤵
  PID:12508
- C:\Windows\System\TxbYyTU.exe
  C:\Windows\System\TxbYyTU.exe
  2⤵
  PID:12528
- C:\Windows\System\rrlZCSg.exe
  C:\Windows\System\rrlZCSg.exe
  2⤵
  PID:12552
- C:\Windows\System\BPgyKGf.exe
  C:\Windows\System\BPgyKGf.exe
  2⤵
  PID:12616
- C:\Windows\System\UZFJQhS.exe
  C:\Windows\System\UZFJQhS.exe
  2⤵
  PID:12636
- C:\Windows\System\ABdKbaY.exe
  C:\Windows\System\ABdKbaY.exe
  2⤵
  PID:12660
- C:\Windows\System\WeUbkMe.exe
  C:\Windows\System\WeUbkMe.exe
  2⤵
  PID:12700
- C:\Windows\System\dpNenGH.exe
  C:\Windows\System\dpNenGH.exe
  2⤵
  PID:12724
- C:\Windows\System\gsAeYHX.exe
  C:\Windows\System\gsAeYHX.exe
  2⤵
  PID:12756
- C:\Windows\System\OxEPCcf.exe
  C:\Windows\System\OxEPCcf.exe
  2⤵
  PID:12788
- C:\Windows\System\GRZioip.exe
  C:\Windows\System\GRZioip.exe
  2⤵
  PID:12832
- C:\Windows\System\RgkrQGH.exe
  C:\Windows\System\RgkrQGH.exe
  2⤵
  PID:12912
- C:\Windows\System\nSEzLyV.exe
  C:\Windows\System\nSEzLyV.exe
  2⤵
  PID:12960
- C:\Windows\System\KpzOBEd.exe
  C:\Windows\System\KpzOBEd.exe
  2⤵
  PID:12984
- C:\Windows\System\EZLXasa.exe
  C:\Windows\System\EZLXasa.exe
  2⤵
  PID:13000
- C:\Windows\System\YzwrxYz.exe
  C:\Windows\System\YzwrxYz.exe
  2⤵
  PID:13016
- C:\Windows\System\qqpnyom.exe
  C:\Windows\System\qqpnyom.exe
  2⤵
  PID:13048
- C:\Windows\System\BrHLvXE.exe
  C:\Windows\System\BrHLvXE.exe
  2⤵
  PID:13100
- C:\Windows\System\PHtgkxD.exe
  C:\Windows\System\PHtgkxD.exe
  2⤵
  PID:13124
- C:\Windows\System\yNtguBO.exe
  C:\Windows\System\yNtguBO.exe
  2⤵
  PID:13140
- C:\Windows\System\OWLSzFI.exe
  C:\Windows\System\OWLSzFI.exe
  2⤵
  PID:13160
- C:\Windows\System\azAEOWX.exe
  C:\Windows\System\azAEOWX.exe
  2⤵
  PID:13196
- C:\Windows\System\nJXcmeL.exe
  C:\Windows\System\nJXcmeL.exe
  2⤵
  PID:13216
- C:\Windows\System\pdcovtt.exe
  C:\Windows\System\pdcovtt.exe
  2⤵
  PID:13252
- C:\Windows\System\ystUzUo.exe
  C:\Windows\System\ystUzUo.exe
  2⤵
  PID:13272
- C:\Windows\System\BezZkoR.exe
  C:\Windows\System\BezZkoR.exe
  2⤵
  PID:12316
- C:\Windows\System\pRRmxkf.exe
  C:\Windows\System\pRRmxkf.exe
  2⤵
  PID:8708
- C:\Windows\System\PvCVRYi.exe
  C:\Windows\System\PvCVRYi.exe
  2⤵
  PID:12404
- C:\Windows\System\HKDjAyx.exe
  C:\Windows\System\HKDjAyx.exe
  2⤵
  PID:12480
- C:\Windows\System\OvFrRjj.exe
  C:\Windows\System\OvFrRjj.exe
  2⤵
  PID:12504
- C:\Windows\System\qwPksno.exe
  C:\Windows\System\qwPksno.exe
  2⤵
  PID:12572
- C:\Windows\System\XeNBLnJ.exe
  C:\Windows\System\XeNBLnJ.exe
  2⤵
  PID:12652
- C:\Windows\System\VuKDtPU.exe
  C:\Windows\System\VuKDtPU.exe
  2⤵
  PID:12732
- C:\Windows\System\oELJnmU.exe
  C:\Windows\System\oELJnmU.exe
  2⤵
  PID:12780
- C:\Windows\System\aAAnNvt.exe
  C:\Windows\System\aAAnNvt.exe
  2⤵
  PID:12804
- C:\Windows\System\FusyBvw.exe
  C:\Windows\System\FusyBvw.exe
  2⤵
  PID:12840
- C:\Windows\System\HcQCNrS.exe
  C:\Windows\System\HcQCNrS.exe
  2⤵
  PID:12876
- C:\Windows\System\ONvytVl.exe
  C:\Windows\System\ONvytVl.exe
  2⤵
  PID:12848
- C:\Windows\System\QmmIZXG.exe
  C:\Windows\System\QmmIZXG.exe
  2⤵
  PID:12952
- C:\Windows\System\ZQqzbry.exe
  C:\Windows\System\ZQqzbry.exe
  2⤵
  PID:12924
- C:\Windows\System\uecBidS.exe
  C:\Windows\System\uecBidS.exe
  2⤵
  PID:13060
- C:\Windows\System\sNCbfjM.exe
  C:\Windows\System\sNCbfjM.exe
  2⤵
  PID:13116
- C:\Windows\System\ALfGRYU.exe
  C:\Windows\System\ALfGRYU.exe
  2⤵
  PID:13152
- C:\Windows\System\QdgZOkH.exe
  C:\Windows\System\QdgZOkH.exe
  2⤵
  PID:13308
- C:\Windows\System\XWmgKRt.exe
  C:\Windows\System\XWmgKRt.exe
  2⤵
  PID:12352
- C:\Windows\System\mdMONwS.exe
  C:\Windows\System\mdMONwS.exe
  2⤵
  PID:12452
- C:\Windows\System\tRJOtEN.exe
  C:\Windows\System\tRJOtEN.exe
  2⤵
  PID:12632
- C:\Windows\System\AONzOZz.exe
  C:\Windows\System\AONzOZz.exe
  2⤵
  PID:12716
- C:\Windows\System\NBCqMpq.exe
  C:\Windows\System\NBCqMpq.exe
  2⤵
  PID:12872
- C:\Windows\System\fkAVTUX.exe
  C:\Windows\System\fkAVTUX.exe
  2⤵
  PID:13012
- C:\Windows\System\hBDFkHv.exe
  C:\Windows\System\hBDFkHv.exe
  2⤵
  PID:13192
- C:\Windows\System\ijgLkmW.exe
  C:\Windows\System\ijgLkmW.exe
  2⤵
  PID:13180
- C:\Windows\System\ZwDDCah.exe
  C:\Windows\System\ZwDDCah.exe
  2⤵
  PID:13284
- C:\Windows\System\PxFgMgn.exe
  C:\Windows\System\PxFgMgn.exe
  2⤵
  PID:12812
- C:\Windows\System\DsNQAwv.exe
  C:\Windows\System\DsNQAwv.exe
  2⤵
  PID:13268
- C:\Windows\System\MvNSBaA.exe
  C:\Windows\System\MvNSBaA.exe
  2⤵
  PID:12868
- C:\Windows\System\ZiELwEn.exe
  C:\Windows\System\ZiELwEn.exe
  2⤵
  PID:13324
- C:\Windows\System\MqoUsTx.exe
  C:\Windows\System\MqoUsTx.exe
  2⤵
  PID:13352
- C:\Windows\System\CwmmRJI.exe
  C:\Windows\System\CwmmRJI.exe
  2⤵
  PID:13372
- C:\Windows\System\IhvMsdB.exe
  C:\Windows\System\IhvMsdB.exe
  2⤵
  PID:13472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dctwxokm.rjy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AVDFxFg.exe

Filesize
2.0MB

MD5
f3fcaa2f333f213edf245df8356e9d97

SHA1
0e2f8a1413d1e64bf58887d047482b350abf2517

SHA256
29244c562911cf499587c00b2a231d218f10d98128cf9497d526293af8d70aca

SHA512
7daa63bc1e8bfa94a61774ece0cf7d7812edac634fad5c735ebc10030c2a91da1f25984ffed07dc53f2b209f39c528d89bcb1bc5edf7b8ea79abeb2040d032c9

Download Submit
C:\Windows\System\AzrmJAQ.exe

Filesize
2.0MB

MD5
60539f112bea0d10bf687ff0d072a796

SHA1
8d4788e54289a342bd82f1f80dd6b746e6157a91

SHA256
b2c3564d1137543c4d92e7813b4c769fe07bdf769baac74247cfec93147c1cff

SHA512
c3a44b3e3a73419b28c8fc44392fe1f17885046b5b0ac1b6f3871852b34aec1e2d013ae6d844ccc38270576031d7b9841141dfcfe2d1073d7442835a16a2a56b

Download Submit
C:\Windows\System\BLBSOWN.exe

Filesize
2.0MB

MD5
5a384ceafe16a247738dd67d68ff2e60

SHA1
44662b56e9a7d6912cee2703b9f9b09d98fa22ad

SHA256
5dc99704f2967acf2d52fbda11d97e1e888302e5110372cd6b750348e2980d5d

SHA512
c2b7f9516a22f3b79606a21356ad2c817bbda6f1f445d051ccb11367340ced1082af4e7b8dab911a57bf084b5e6699de50fc4eb4fbbe9bc73541c91591cdb5ff

Download Submit
C:\Windows\System\BpccVeD.exe

Filesize
2.0MB

MD5
28fd5196147892c14c6394493237ab0d

SHA1
a9416ac52a01743f70dbf813057924b09b5cfd1d

SHA256
59c43aeb16066f90ec958be949393b8be941bbe9d670d67642141fb576bdeda2

SHA512
ef65bcf190d43167ddf562d31d7af05a16bbc6358465293e2951c52dfa79b18739e87bfba0f93f170bdd2377c2cd5d0d667517d1e206d91ce480c7efb6890a26

Download Submit
C:\Windows\System\CVpzvgO.exe

Filesize
2.0MB

MD5
d9f67ce1fe50441079b405a1ae4186df

SHA1
f341b14525c2d0c90ebc18eda423eabda5bb25a4

SHA256
f32ce944e7a69a2ed249e2f217b8cc8af48f4a099f6212bf9705f6fed1bfb07e

SHA512
24e8d05e83e6e07e40cda92a0c3b8321fe9460ffedf8c6b6db270092db0ffc8e1a19e340649bada8bbaa3dd6c6bd34e8126c42012adfc577c9333b8075fda9e7

Download Submit
C:\Windows\System\CgXybCg.exe

Filesize
2.0MB

MD5
5cdede050250b3cd2a9a87e80c08f7a0

SHA1
bb022f180a5734ab6276d8fd0f5d97e83dd6ea58

SHA256
f919fcf34c3e0e7c529a9df951121aa30e8758e8f28a5ea14bcb6b2036facf0b

SHA512
19cf89ae8d32637ca4bb614d62c4c2183810a464b6d76a0d9fb7162f1fde1a4e183f897511a19d9875150720e14c5e14e7c31426fde7309b1f1b6c74a0aa107c

Download Submit
C:\Windows\System\DRCHAUE.exe

Filesize
2.0MB

MD5
42041317dfe69dccb20f381d52ffab95

SHA1
54a79bb386ddc0c492730844c1f90abd185462a9

SHA256
e35ef4d9898802e5fe5438a7da0c33ffb2119631c2f0166d1d196b7fdf6ed24f

SHA512
f428f49f7ee2567f295cf93e8959cf944c75a2ae3a6a336f32319608bd04d98e208cdcc8b9cba4a32eea5e7179e8ff4ded071e3babcc972c237bd56a1d062c3e

Download Submit
C:\Windows\System\Gyresef.exe

Filesize
2.0MB

MD5
12b337f09b65d9504026a9eefafb4b38

SHA1
e8656e5303a8a7224d85f16cd9d7bdbbe120e6ca

SHA256
5b641910538a67d169168d4cc8a0fe189c1048fa8d151d3462c065168a7fb105

SHA512
5ca0cf356792da6aa08f409fd2fee48815c80cd4f36be1e3e2dd3a4c29246159beb4d89e537dd649fc02e65b9e30348adc444d337a43655de42570eb0a848a7f

Download Submit
C:\Windows\System\LxwIHlr.exe

Filesize
2.0MB

MD5
c0d990c22956bfc786309b3298e0a60b

SHA1
34cd5da5e7787a9aea7c9e43717397b09ef5f3f0

SHA256
a612c3323ef9c2621a30f00c363d7bf21e82656c91b3683e1cae772eaa6ebe27

SHA512
72cd5cdb76618da19541caee3f0bd8063d029fa50bd422fad58e1abc20f9ebed42321bd0833e2a0124b543c2bedbb03094b3299393cf7e7331031a4b8134e22b

Download Submit
C:\Windows\System\NQhJcPc.exe

Filesize
2.0MB

MD5
e21d707187345cbeb456a6b9c163c746

SHA1
ad4a485d8de7f8c34926d9bfbc9d461d681a91e7

SHA256
92e3e894edc9fa35b8605d319ff006f060d845beb32c66c9ec5a8eda66f4b7aa

SHA512
77b38f6805097d688251edb2d16553906b8465a1dada9abc4da22d2c62d43053222c15ec90722a3701a80c9d4937db23e01e113829c71ca26b78dcd63d2718dc

Download Submit
C:\Windows\System\PCeeECX.exe

Filesize
2.0MB

MD5
1a1e8319d80e3e416b8d6af99ec01c0d

SHA1
e0884a6bef1c91d006ec5a3958af2f50d4ad90b9

SHA256
c97c6bb659c7025291dc84c9f2f6f1f346add18de346eaac8e9594c6c2a1af15

SHA512
0fc9dc1741637a327502b1fdf198ced91eeec056f0677bb098a583cc22c7dfcd91bfd943915d9f69d1a1e5e766b5f8ce934e58704fe5f194e89d3fe0344d7b0b

Download Submit
C:\Windows\System\PSzQrNu.exe

Filesize
2.0MB

MD5
d89523ad952d1156ab1ea0d7a5572fb9

SHA1
94b57834ebc731d8d501856b3ba1e8b5006e564a

SHA256
dd8cba7ec161e2d1b05e397f2e18dcfe8171b17dbbdaa9e07fed37cef0ea086c

SHA512
2d0a5ce60883aa037b8c640297ff836cc15bfe80661cc59ad29fdcb228ca2b31214be21c69eaa1a9c0d5266135e2e85d49310d31a54229fe0bddbd300753333b

Download Submit
C:\Windows\System\QcHcSZf.exe

Filesize
2.0MB

MD5
0f89fe5bcabb132c60d0c48f911045a5

SHA1
587533062c5d46238de2b1340f96016f5276e947

SHA256
a23c78933f658209f05049636600c9d31ab987752d3c13b980aa8e6143e5b963

SHA512
0426a576b2cdc48b52d3191b436c19875bed0193bc7929bc6d758fb08d6740e3993a6b38d2c890a79eeb1947a708bc100c075bc18dc4c74f4a4aa7bdda201a8a

Download Submit
C:\Windows\System\WFSEzSN.exe

Filesize
2.0MB

MD5
17b8a85c472e84f056c99d98ec44e813

SHA1
e5385cfacd18dbe9e96119aefb19bad7ad1426e1

SHA256
197ace2e1ad158c01425846be22d57b1297e1969466ab69afda419bd2bfcc36d

SHA512
1563281ff524922f84a79e1c8175d10aa08c2a4950775fdae7becfa47aebc4bf8159e6175e8c843f05104dc3eaf405c171215985f0ccc3e5172d4e8673068a95

Download Submit
C:\Windows\System\XYGvUfD.exe

Filesize
2.0MB

MD5
b6a065f8ce191fa86446747e30852d19

SHA1
d806b52a562c8d9b41b2dc0729687da36572cba7

SHA256
6fc88acf17f9f1dd66af88bb83b90915a37d813e703ddc68cee73c3f896bd0dc

SHA512
551a47aaa956242ce043dc661b490c2a7d166e7eaad2cc7f32e8d05d46531065b13cb9b9f89dd5d65ac8f69af9504b41733fef912e96a9dfd8527a2fa8f21f7e

Download Submit
C:\Windows\System\XcWnOyf.exe

Filesize
2.0MB

MD5
2370d8effbdb474f89dc00cf57fc72f0

SHA1
cb8006f0c83772da77a69ea9425e7778988308f7

SHA256
eba6f7ab5cc9530d27ec6be4c2f318d493138ea3feaf14b03332f931a523c17c

SHA512
983ca52e894f95bc339ad707c50133eb2f4df688835a434fb02379b52ffb7d87f295be646bf730fa7e22fd923078bd151ee57c7f30c267f4537574554e56c117

Download Submit
C:\Windows\System\YrXmuCo.exe

Filesize
2.0MB

MD5
02a6666f5a40645359e08f738931e1f1

SHA1
0983a92b652f191eed5df665973765a8d7300ca3

SHA256
7e8cfb273c6c9123c8992bcd0ddb541aaa48f1eb1e58de820cbc6b53d8dcbe31

SHA512
a3f676839975df0a0b3c61fba0ffeeb51194e2acad230d10f7f416d802a94134877e08c2833f7f49081c8f71db3470d71e09f3576f8b4c799a31a5b25a6c3d4f

Download Submit
C:\Windows\System\ZGenbmf.exe

Filesize
2.0MB

MD5
200204504385cf4d2fb9fba044f13d9b

SHA1
aaeaaff5533662e98abeb23e147163eac6f938ef

SHA256
884f89855c13a67ecdaa86cfcba74dbc1db7d41fd65baa0e99465475915a97b6

SHA512
9eb507ec481ebd3b712d0e269347b31d27e25ebed87a608f29545ee37a94b65f255ea0e7168780b9c21f284aecbde5d6d910a2483e5809210592172cddc6a0c5

Download Submit
C:\Windows\System\dvSdkYn.exe

Filesize
2.0MB

MD5
75102b04ffd95dfd8921fc6bc9a7cb0a

SHA1
c2f16873a32fb4d3b0d922678f713b388ba6e8d2

SHA256
09953806b87f755369191d047a1dde0df8e117d2274fe895871dded93acc7dd8

SHA512
63900fb92821f7c08d03ab7c4fc50ba9e13dd2877093e955c380ba1cf6bf7555144d799891b6ce0a39ac039cd6c31364040dab4668ae4177fbf4803ab508aae0

Download Submit
C:\Windows\System\ehRFtPd.exe

Filesize
2.0MB

MD5
b69ade045999d997548788489182c893

SHA1
47b611202ada9cb6573639d338964aef719df8dc

SHA256
2b34bb9e19bfb4cb59c960d7a66e37a448637c1459b62f3fdfb194bcbd1c3d9c

SHA512
e514b8c720ab7b081530fa25ddb1073382b3482efd592cfe3c8bceb735831cc5c937b4368b074ab41422118cad32861f9d67b3360d7834d23e1d3203c22007cf

Download Submit
C:\Windows\System\hcgwaAe.exe

Filesize
2.0MB

MD5
db82f9ebc4e8b8d887edb11ebbf1d98e

SHA1
5ab4a2e12321a6bd40f8ecac44138dac6ee46d76

SHA256
350bc742147b365911efb533aa7fb6973928bdf9737d594fc9a1f92dafafd73c

SHA512
744f0223f40ade6a960fd24731f4da203237a5168141e8fcf5956707e96a895b8f85c97602bbeedabd9d925ff75b65c035323e774f27e2c72334c731397b88b3

Download Submit
C:\Windows\System\iNwnXQs.exe

Filesize
2.0MB

MD5
59f3f411aa15b3699f4163085dbedfb7

SHA1
cb7349e990aea1f97f4b65567e08c36a0923c905

SHA256
8ff284142fb2b32b399500ff4ad8c47b66e4221d0a68e0e486cf907827c7b15d

SHA512
0bcd66fbb4abc29c4f44aab6faa703290f8619b17c54c854480cd2c33d562332329fce1ee3d5857c697327813292f690fc19f5f3e833e47e1ecec16d345a16ff

Download Submit
C:\Windows\System\iivyPbU.exe

Filesize
2.0MB

MD5
13c400af411bc236df562404b5c18ab4

SHA1
2c887d38e31d03630cd0513ce3d601f92c8f40e5

SHA256
e5d21af566d8182c37ed4764da5ff80a330e1440c9a81df426407c5b78222f9a

SHA512
eec96271c2ab34779b4f7b4ef1e02fa2cc4ee92bf28a1652203613b647ce6e95516356c5ed7189f667e16b65862f23679317b1266be81a19fcd5c779f7b5381b

Download Submit
C:\Windows\System\kFKKnsX.exe

Filesize
2.0MB

MD5
b41002232438c5c237c04f318a431123

SHA1
cc6246d86a098315887d3e962c354b8dfbd5c16d

SHA256
62a4a8b7032b14d3dfd7cfdb7eee8bb0a3de3a991001547ec917c2ad84012010

SHA512
f809cc7b0a788f26cfa1c94075f00ad966fbed04c92f2d2b5611cd106cc785e1a4556e6e36c1557d27902f594ae87d127d85d75abc7b58b464508cc8addc5797

Download Submit
C:\Windows\System\lRwQOcT.exe

Filesize
2.0MB

MD5
e14dc5dbaa75bdb644d8c7b6477735f7

SHA1
18a33b520dd7e5752e27284202d15fc6d9097af4

SHA256
7ab69f19065ef773c72e7c10ef4a0537c7151a2c470ff8b76bd3ae4ce807b332

SHA512
fa12ea7ef59cd413b75e6a593bb12c22d827f0737f7836c4981914d8eee6680201beb568627997409f9fe203cbd0f0e3263af6dab6053666c09611774b262c1f

Download Submit
C:\Windows\System\nTgsqVq.exe

Filesize
2.0MB

MD5
7eeaafc9c03c4060e805645193dfc521

SHA1
f66690116d9b34b9ff7835fde6dd56026289de9b

SHA256
bb2184ca877a755ec9e4ea64536aa487ec41618226e651e116cae569045d9b7c

SHA512
3cc8cf43e6f5abe721e33527d448a63745dd0ea68003d5c68f7adaf5daae9a2b597567c90fe07a505bdf1e922384551bc3266f7c07bb28af68dda45940c61634

Download Submit
C:\Windows\System\ocgHhZM.exe

Filesize
2.0MB

MD5
d22bde8b5a6d920e2703e2759e4ecf15

SHA1
909279f8d4773104ff257706843e7b041fedeada

SHA256
34a16525d23821bfa1ab3be6823865eea77c7a69e9baf9e21274c339480c37d0

SHA512
6be329010a35944dfcb7645aa7f941cfb2e9de67089e3e9f07846d2da501ac7c996b3c3b358a9941da85925178bebddf7d8f2af99edc3e1c291e07bc18407a1f

Download Submit
C:\Windows\System\sEXFCcF.exe

Filesize
2.0MB

MD5
5968d3861bd28c0984f9b399e5322c76

SHA1
2b716bb76ee3de99b5c1e390f9bc0bd4aafffaaf

SHA256
c8f7e5923bf2598ea37c7226b7965dc2270663ace747ca08b01ebe2f18be5ffd

SHA512
0cd16981aa6315e983578713940f518c6951453c3165e5ae3b89af4868e04d0e048dbb7f35d99b194928b2b04b41ed54098f90c59c1ab611f9e05f023ac63231

Download Submit
C:\Windows\System\vecQlAb.exe

Filesize
2.0MB

MD5
9d8fde5a458f1008c6c42cb6491cc32a

SHA1
8f7fa7ea3b32b66db1f0faf2061109b17a204b13

SHA256
ed01b514002ac696dc2f84832d5eabede55e93ad4e86d158cf3fa9086639da0b

SHA512
aaa0e7c35e86fd45b873bfc2a25e73625f7049352a31a9a268e0dc6a784a3467fbfcde62ca039683f85e3524cc33a63ef9f8652f97e0dc32fad50eaa7c6e8955

Download Submit
C:\Windows\System\wBSHPEp.exe

Filesize
2.0MB

MD5
d7a4e0686bc3c716828c191b4cf9c426

SHA1
d470eae9166042931e4f9cd5968cdfd79f1bb3a2

SHA256
41eb3505787139923886d0abf9a5b15e71332a1e1c3f66da981628839a90f372

SHA512
6204d74b6f7bfb8819a4d55365582e5b9b2ae4d80bd21ffe021ab10838ed6b94808dff13375a0573c43422278cc38ae9cf955e0d31321d85f07a62134a1938bd

Download Submit
C:\Windows\System\yInvwyp.exe

Filesize
2.0MB

MD5
f5cb9ac31988d11f7dd77c66bfb74f90

SHA1
6adb006b898a0a48423def181ad7b3d684241afd

SHA256
a75d12c8c50ce29c670890f541c9e2f236052050258398ef4b3b11ca1f01dfdf

SHA512
ba6e22c2d76d695efb94e7bd014213f9e986a11b669d9f50fab2aa870cce15e268344d521ee4ec122dbca2e034bc703261a8176aea7df9b01f908309e9fe98be

Download Submit
C:\Windows\System\ycgcKHx.exe

Filesize
2.0MB

MD5
1c2803db4b61b586ba5eb48f23326bea

SHA1
e02216cb41315048bd7ed5a348a065ff0e82ef84

SHA256
4fe3eb4730caa1f7fb47883fd7a1eb61caff2eb7d3f517cd3804654cc7f1adb5

SHA512
11278cb65796da3d5a9004fe740a09423f58d1efdd85555f49ac6ce4443ed8bd80e38953e278b2d3828c67a8c5bdb8530ef5c0ce46d4421452e37dfbba6f0360

Download Submit
C:\Windows\System\zQOPsRK.exe

Filesize
2.0MB

MD5
32ef4af1e75d2fe9b2b4fcdbbaf00dfd

SHA1
81a714dc79f28854a672087c23fc562d3a816eb2

SHA256
76c53a2ca781b740cab04cc97a4af1d03387ee49740067fea4afab8d918ab32b

SHA512
66492191e7a045e855dbd647f0bcae66784f2ab850cb3c5dedebc741b944920c72f6cc2d8afa3fe225a1bfeb73a32a744975938a69e872d500a333da7096d197

Download Submit
memory/8-3045-0x00007FF6A5290000-0x00007FF6A5682000-memory.dmp

Filesize
3.9MB

Download
memory/8-156-0x00007FF6A5290000-0x00007FF6A5682000-memory.dmp

Filesize
3.9MB

Download
memory/404-3015-0x00007FF7DE570000-0x00007FF7DE962000-memory.dmp

Filesize
3.9MB

Download
memory/404-56-0x00007FF7DE570000-0x00007FF7DE962000-memory.dmp

Filesize
3.9MB

Download
memory/536-119-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp

Filesize
3.9MB

Download
memory/536-1189-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp

Filesize
3.9MB

Download
memory/536-3065-0x00007FF79ED50000-0x00007FF79F142000-memory.dmp

Filesize
3.9MB

Download
memory/752-140-0x00007FF6A0280000-0x00007FF6A0672000-memory.dmp

Filesize
3.9MB

Download
memory/752-3071-0x00007FF6A0280000-0x00007FF6A0672000-memory.dmp

Filesize
3.9MB

Download
memory/964-168-0x00007FF7AB4B0000-0x00007FF7AB8A2000-memory.dmp

Filesize
3.9MB

Download
memory/964-3075-0x00007FF7AB4B0000-0x00007FF7AB8A2000-memory.dmp

Filesize
3.9MB

Download
memory/996-151-0x00007FF6A38F0000-0x00007FF6A3CE2000-memory.dmp

Filesize
3.9MB

Download
memory/996-3013-0x00007FF6A38F0000-0x00007FF6A3CE2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-73-0x00007FF78FD80000-0x00007FF790172000-memory.dmp

Filesize
3.9MB

Download
memory/1704-3017-0x00007FF78FD80000-0x00007FF790172000-memory.dmp

Filesize
3.9MB

Download
memory/2240-3053-0x00007FF7FF880000-0x00007FF7FFC72000-memory.dmp

Filesize
3.9MB

Download
memory/2240-90-0x00007FF7FF880000-0x00007FF7FFC72000-memory.dmp

Filesize
3.9MB

Download
memory/2292-3062-0x00007FF6865B0000-0x00007FF6869A2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-164-0x00007FF6865B0000-0x00007FF6869A2000-memory.dmp

Filesize
3.9MB

Download
memory/2328-167-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp

Filesize
3.9MB

Download
memory/2328-1433-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp

Filesize
3.9MB

Download
memory/2328-3363-0x00007FF64EE10000-0x00007FF64F202000-memory.dmp

Filesize
3.9MB

Download
memory/2348-0-0x00007FF665730000-0x00007FF665B22000-memory.dmp

Filesize
3.9MB

Download
memory/2348-894-0x00007FF665730000-0x00007FF665B22000-memory.dmp

Filesize
3.9MB

Download
memory/2348-1-0x0000021204960000-0x0000021204970000-memory.dmp

Filesize
64KB

Download
memory/2460-80-0x00007FF6358F0000-0x00007FF635CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-3047-0x00007FF6358F0000-0x00007FF635CE2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-86-0x00007FF6DF5D0000-0x00007FF6DF9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-3054-0x00007FF6DF5D0000-0x00007FF6DF9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3128-3060-0x00007FF632780000-0x00007FF632B72000-memory.dmp

Filesize
3.9MB

Download
memory/3128-165-0x00007FF632780000-0x00007FF632B72000-memory.dmp

Filesize
3.9MB

Download
memory/3184-3073-0x00007FF7B3410000-0x00007FF7B3802000-memory.dmp

Filesize
3.9MB

Download
memory/3184-166-0x00007FF7B3410000-0x00007FF7B3802000-memory.dmp

Filesize
3.9MB

Download
memory/3408-3041-0x00007FF622770000-0x00007FF622B62000-memory.dmp

Filesize
3.9MB

Download
memory/3408-162-0x00007FF622770000-0x00007FF622B62000-memory.dmp

Filesize
3.9MB

Download
memory/3452-115-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-1188-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp

Filesize
3.9MB

Download
memory/3452-3064-0x00007FF792EC0000-0x00007FF7932B2000-memory.dmp

Filesize
3.9MB

Download
memory/4208-377-0x00000133D44C0000-0x00000133D4C66000-memory.dmp

Filesize
7.6MB

Download
memory/4208-2994-0x00007FFD39AA0000-0x00007FFD3A561000-memory.dmp

Filesize
10.8MB

Download
memory/4208-1171-0x00007FFD39AA0000-0x00007FFD3A561000-memory.dmp

Filesize
10.8MB

Download
memory/4208-3-0x00007FFD39AA3000-0x00007FFD39AA5000-memory.dmp

Filesize
8KB

Download
memory/4208-23-0x00007FFD39AA0000-0x00007FFD3A561000-memory.dmp

Filesize
10.8MB

Download
memory/4208-50-0x00000133BAD00000-0x00000133BAD22000-memory.dmp

Filesize
136KB

Download
memory/4208-53-0x00007FFD39AA0000-0x00007FFD3A561000-memory.dmp

Filesize
10.8MB

Download
memory/4208-1164-0x00007FFD39AA3000-0x00007FFD39AA5000-memory.dmp

Filesize
8KB

Download
memory/4252-3050-0x00007FF62E060000-0x00007FF62E452000-memory.dmp

Filesize
3.9MB

Download
memory/4252-159-0x00007FF62E060000-0x00007FF62E452000-memory.dmp

Filesize
3.9MB

Download
memory/4516-118-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp

Filesize
3.9MB

Download
memory/4516-3067-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp

Filesize
3.9MB

Download
memory/4516-1293-0x00007FF7B1B90000-0x00007FF7B1F82000-memory.dmp

Filesize
3.9MB

Download
memory/4592-146-0x00007FF7EE720000-0x00007FF7EEB12000-memory.dmp

Filesize
3.9MB

Download
memory/4592-3011-0x00007FF7EE720000-0x00007FF7EEB12000-memory.dmp

Filesize
3.9MB

Download
memory/4656-1182-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp

Filesize
3.9MB

Download
memory/4656-106-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp

Filesize
3.9MB

Download
memory/4656-3042-0x00007FF6B9910000-0x00007FF6B9D02000-memory.dmp

Filesize
3.9MB

Download
memory/4816-3049-0x00007FF602320000-0x00007FF602712000-memory.dmp

Filesize
3.9MB

Download
memory/4816-163-0x00007FF602320000-0x00007FF602712000-memory.dmp

Filesize
3.9MB

Download
memory/4860-65-0x00007FF77EB30000-0x00007FF77EF22000-memory.dmp

Filesize
3.9MB

Download
memory/4860-3019-0x00007FF77EB30000-0x00007FF77EF22000-memory.dmp

Filesize
3.9MB

Download
memory/4956-3069-0x00007FF6F6910000-0x00007FF6F6D02000-memory.dmp

Filesize
3.9MB

Download
memory/4956-136-0x00007FF6F6910000-0x00007FF6F6D02000-memory.dmp

Filesize
3.9MB

Download
memory/4968-155-0x00007FF76C490000-0x00007FF76C882000-memory.dmp

Filesize
3.9MB

Download
memory/4968-3038-0x00007FF76C490000-0x00007FF76C882000-memory.dmp

Filesize
3.9MB

Download