xmrig | d0cf74549e1f691778c65e0874731a11abd9ec0808565267ea6de797963b4437

Analysis

max time kernel
120s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fc789be06aa80496c29eb1cb6f3fbb0N.exe
Size

2.0MB
MD5

7fc789be06aa80496c29eb1cb6f3fbb0
SHA1

15ce920eabef0f6d12575d816d553985ea095c85
SHA256

d0cf74549e1f691778c65e0874731a11abd9ec0808565267ea6de797963b4437
SHA512

ccf114ca4d85ec2dcc4be71efaed66b410356ce147887215ef566ceec99ee5a34c908a2cc749e4985571ea70dc7acbe1f3df1c4e7fe2124f855df95d87c63f09
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjFkTVnfuDPFFWqreoYtgW+hVkVoC2NCNF:Lz071uv4BPMkHC0IEFToF3aWlClB1

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral2/memory/4544-397-0x00007FF7507F0000-0x00007FF750BE2000-memory.dmp	xmrig
behavioral2/memory/2552-491-0x00007FF661910000-0x00007FF661D02000-memory.dmp	xmrig
behavioral2/memory/3264-525-0x00007FF741310000-0x00007FF741702000-memory.dmp	xmrig
behavioral2/memory/2192-529-0x00007FF6EC920000-0x00007FF6ECD12000-memory.dmp	xmrig
behavioral2/memory/3880-531-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp	xmrig
behavioral2/memory/2536-534-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	xmrig
behavioral2/memory/3528-537-0x00007FF7DD1C0000-0x00007FF7DD5B2000-memory.dmp	xmrig
behavioral2/memory/1708-540-0x00007FF7E2F50000-0x00007FF7E3342000-memory.dmp	xmrig
behavioral2/memory/3068-770-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp	xmrig
behavioral2/memory/4964-702-0x00007FF6E79B0000-0x00007FF6E7DA2000-memory.dmp	xmrig
behavioral2/memory/3316-541-0x00007FF788150000-0x00007FF788542000-memory.dmp	xmrig
behavioral2/memory/560-539-0x00007FF6FCF30000-0x00007FF6FD322000-memory.dmp	xmrig
behavioral2/memory/980-538-0x00007FF68BCF0000-0x00007FF68C0E2000-memory.dmp	xmrig
behavioral2/memory/2500-536-0x00007FF7B4890000-0x00007FF7B4C82000-memory.dmp	xmrig
behavioral2/memory/216-535-0x00007FF6969A0000-0x00007FF696D92000-memory.dmp	xmrig
behavioral2/memory/3768-533-0x00007FF7C6940000-0x00007FF7C6D32000-memory.dmp	xmrig
behavioral2/memory/4000-532-0x00007FF6397A0000-0x00007FF639B92000-memory.dmp	xmrig
behavioral2/memory/4936-530-0x00007FF7FC450000-0x00007FF7FC842000-memory.dmp	xmrig
behavioral2/memory/4724-528-0x00007FF6DFE40000-0x00007FF6E0232000-memory.dmp	xmrig
behavioral2/memory/3688-524-0x00007FF631CA0000-0x00007FF632092000-memory.dmp	xmrig
behavioral2/memory/4028-341-0x00007FF7F10C0000-0x00007FF7F14B2000-memory.dmp	xmrig
behavioral2/memory/1040-281-0x00007FF742D20000-0x00007FF743112000-memory.dmp	xmrig
behavioral2/memory/2900-2687-0x00007FF7D2080000-0x00007FF7D2472000-memory.dmp	xmrig
behavioral2/memory/1044-2692-0x00007FF71DA50000-0x00007FF71DE42000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3240	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4276	KiwIWKM.exe
1044	ZfgVNEy.exe
3316	vwpfaoX.exe
1040	gCyXuzL.exe
4964	AmqEyUd.exe
4028	pqgcslc.exe
4544	ezKgqmx.exe
3068	SqwGTja.exe
2552	QzGvxLc.exe
3688	tOdZHYK.exe
3264	fLuaBUM.exe
4724	xMvGQeN.exe
2192	AnhIZlU.exe
4936	BvuNLYR.exe
3880	Wtpitzr.exe
4000	mKtKkfs.exe
3768	CAgrfEd.exe
2536	srRfzgP.exe
216	MNWiyQZ.exe
2500	akynuGL.exe
3528	ruIcEzd.exe
980	SAzojki.exe
560	ubBQLIN.exe
1708	EASfNnZ.exe
2524	SHhcQkp.exe
3640	iiRupxR.exe
4808	dLcZXPh.exe
1656	IJXWhDh.exe
3004	ZwqzZhk.exe
2824	UnvwVCc.exe
4520	OcBXopl.exe
4892	ACrKShX.exe
320	asYYQCf.exe
1460	KbDVtqQ.exe
396	jmXmDef.exe
1016	sojGtJS.exe
3964	UqRUNkN.exe
2200	SVUOoAm.exe
3976	KYtkain.exe
1996	oaGCsCN.exe
4504	cnCTkmA.exe
3564	RCwKdko.exe
4568	MGQrxrj.exe
3084	rsUjiTP.exe
4460	mIBwMZF.exe
684	lMgyeqr.exe
4044	kzFZykq.exe
1736	eLiQcsr.exe
3944	pWwTrYX.exe
3612	kRgvDTn.exe
4488	GJEkrwH.exe
3676	uJoUNMD.exe
1928	DWjzRgA.exe
3016	ZKKMxyb.exe
4800	lShLcZE.exe
2064	JSrvDdc.exe
2444	UwAEPIX.exe
4696	xwXyebJ.exe
4844	XRmlbEr.exe
4508	rkAYdqR.exe
3576	itgvwxg.exe
2516	rvLoIdO.exe
2120	aDtQmPZ.exe
4024	KdMkeov.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2900-0-0x00007FF7D2080000-0x00007FF7D2472000-memory.dmp	upx
behavioral2/files/0x0009000000023426-7.dat	upx
behavioral2/files/0x0007000000023432-30.dat	upx
behavioral2/files/0x000700000002342f-84.dat	upx
behavioral2/files/0x0007000000023439-166.dat	upx
behavioral2/memory/4544-397-0x00007FF7507F0000-0x00007FF750BE2000-memory.dmp	upx
behavioral2/memory/2552-491-0x00007FF661910000-0x00007FF661D02000-memory.dmp	upx
behavioral2/memory/3264-525-0x00007FF741310000-0x00007FF741702000-memory.dmp	upx
behavioral2/memory/2192-529-0x00007FF6EC920000-0x00007FF6ECD12000-memory.dmp	upx
behavioral2/memory/3880-531-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp	upx
behavioral2/memory/2536-534-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp	upx
behavioral2/memory/3528-537-0x00007FF7DD1C0000-0x00007FF7DD5B2000-memory.dmp	upx
behavioral2/memory/1708-540-0x00007FF7E2F50000-0x00007FF7E3342000-memory.dmp	upx
behavioral2/memory/3068-770-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp	upx
behavioral2/memory/4964-702-0x00007FF6E79B0000-0x00007FF6E7DA2000-memory.dmp	upx
behavioral2/memory/3316-541-0x00007FF788150000-0x00007FF788542000-memory.dmp	upx
behavioral2/memory/560-539-0x00007FF6FCF30000-0x00007FF6FD322000-memory.dmp	upx
behavioral2/memory/980-538-0x00007FF68BCF0000-0x00007FF68C0E2000-memory.dmp	upx
behavioral2/memory/2500-536-0x00007FF7B4890000-0x00007FF7B4C82000-memory.dmp	upx
behavioral2/memory/216-535-0x00007FF6969A0000-0x00007FF696D92000-memory.dmp	upx
behavioral2/memory/3768-533-0x00007FF7C6940000-0x00007FF7C6D32000-memory.dmp	upx
behavioral2/memory/4000-532-0x00007FF6397A0000-0x00007FF639B92000-memory.dmp	upx
behavioral2/memory/4936-530-0x00007FF7FC450000-0x00007FF7FC842000-memory.dmp	upx
behavioral2/memory/4724-528-0x00007FF6DFE40000-0x00007FF6E0232000-memory.dmp	upx
behavioral2/memory/3688-524-0x00007FF631CA0000-0x00007FF632092000-memory.dmp	upx
behavioral2/memory/4028-341-0x00007FF7F10C0000-0x00007FF7F14B2000-memory.dmp	upx
behavioral2/memory/1040-281-0x00007FF742D20000-0x00007FF743112000-memory.dmp	upx
behavioral2/files/0x0007000000023453-187.dat	upx
behavioral2/files/0x0007000000023452-184.dat	upx
behavioral2/files/0x0007000000023451-183.dat	upx
behavioral2/files/0x0007000000023450-180.dat	upx
behavioral2/files/0x0007000000023447-176.dat	upx
behavioral2/files/0x000700000002344f-175.dat	upx
behavioral2/files/0x0007000000023446-173.dat	upx
behavioral2/files/0x000700000002344e-172.dat	upx
behavioral2/files/0x000700000002344d-171.dat	upx
behavioral2/files/0x000700000002344c-170.dat	upx
behavioral2/files/0x000700000002344b-169.dat	upx
behavioral2/files/0x0007000000023448-149.dat	upx
behavioral2/files/0x0007000000023435-141.dat	upx
behavioral2/files/0x0007000000023443-137.dat	upx
behavioral2/files/0x000700000002343d-136.dat	upx
behavioral2/files/0x0007000000023442-124.dat	upx
behavioral2/files/0x0007000000023441-120.dat	upx
behavioral2/files/0x000700000002343b-116.dat	upx
behavioral2/files/0x000700000002343a-113.dat	upx
behavioral2/files/0x0007000000023445-111.dat	upx
behavioral2/files/0x0007000000023440-108.dat	upx
behavioral2/files/0x000700000002344a-168.dat	upx
behavioral2/files/0x0007000000023449-165.dat	upx
behavioral2/files/0x0007000000023438-106.dat	upx
behavioral2/files/0x0007000000023436-161.dat	upx
behavioral2/files/0x0007000000023444-105.dat	upx
behavioral2/files/0x000700000002343f-155.dat	upx
behavioral2/files/0x000700000002343c-94.dat	upx
behavioral2/files/0x000700000002343e-81.dat	upx
behavioral2/files/0x0007000000023433-101.dat	upx
behavioral2/files/0x0007000000023431-71.dat	upx
behavioral2/files/0x0007000000023437-64.dat	upx
behavioral2/files/0x0007000000023434-35.dat	upx
behavioral2/memory/1044-34-0x00007FF71DA50000-0x00007FF71DE42000-memory.dmp	upx
behavioral2/files/0x0007000000023430-19.dat	upx
behavioral2/memory/4276-18-0x00007FF77F280000-0x00007FF77F672000-memory.dmp	upx
behavioral2/files/0x000700000002342e-14.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EnXgIbr.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\IclJFlP.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\bsJGRUM.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\Hebkxbk.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\ISfGVqA.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\JbjTOIu.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\cxtDMmD.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\hCXPyIe.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\njCSzUN.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\RbMXbob.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\UsmbiSz.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\VzXaypc.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\eGncKUr.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\rOmOzIJ.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\VXlFasO.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\kanRTnH.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\wjTFJdh.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\eYrJTWb.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\PYBCsfI.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\KYhlQgu.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\pqXOBPR.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\XcNLYRl.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\hGXEbCS.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\aBTmjho.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\eZalafX.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\RYOYjVk.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\aVBmGNG.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\dXOTSCj.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\zuTFfhN.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\omhOGKl.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\QMFZyKw.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\xdgMqCq.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\EvLyXiC.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\IbqPytA.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\lgabLit.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\ketMjcY.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\sZOXErv.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\rvLoIdO.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\YFCnION.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\bzYqAVp.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\VVmozGA.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\phkaMPz.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\RzNWcgt.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\FumBhod.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\yodOIAe.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\OmcZUnx.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\xyrZDpQ.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\KhaIjLM.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\CtGcWne.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\aKGJliG.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\hISiCGF.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\TcccjqT.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\CHkHTBZ.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\sVQdMDa.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\PBdwVlw.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\WSVStkS.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\PQFeuML.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\KfnZdLU.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\LTNXyDa.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\rfyGqHn.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\NVSKfHG.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\FeUbaWD.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\XRmlbEr.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
File created	C:\Windows\System\vdAjlQV.exe	7fc789be06aa80496c29eb1cb6f3fbb0N.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
5924	Process not Found
6072	Process not Found
8000	Process not Found
7840	Process not Found
4840	Process not Found
7360	Process not Found
7432	Process not Found
2036	Process not Found
7136	Process not Found
8552	Process not Found
3680	Process not Found
7464	Process not Found
8800	Process not Found
5204	Process not Found
5400	Process not Found
5344	Process not Found
460	Process not Found
9068	Process not Found
9144	Process not Found
6212	Process not Found
9200	Process not Found
7916	Process not Found
6280	Process not Found
5140	Process not Found
9868	Process not Found
6324	Process not Found
7304	Process not Found
912	Process not Found
6368	Process not Found
7728	Process not Found
12212	Process not Found
6444	Process not Found
5360	Process not Found
7836	Process not Found
6608	Process not Found
8240	Process not Found
12652	Process not Found
6672	Process not Found
7908	Process not Found
10296	Process not Found
6972	Process not Found
8496	Process not Found
8556	Process not Found
7004	Process not Found
8572	Process not Found
9688	Process not Found
7064	Process not Found
8708	Process not Found
10304	Process not Found
9760	Process not Found
5244	Process not Found
8960	Process not Found
10348	Process not Found
5944	Process not Found
7656	Process not Found
9900	Process not Found
1512	Process not Found
5884	Process not Found
9908	Process not Found
5112	Process not Found
2816	Process not Found
3048	Process not Found
1480	Process not Found
3172	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	powershell.exe
Token: SeLockMemoryPrivilege	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
Token: SeLockMemoryPrivilege	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe
Token: SeCreateGlobalPrivilege	14044	dwm.exe
Token: SeChangeNotifyPrivilege	14044	dwm.exe
Token: 33	14044	dwm.exe
Token: SeIncBasePriorityPrivilege	14044	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3240	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	85
PID 2900 wrote to memory of 3240	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	85
PID 2900 wrote to memory of 4276	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	86
PID 2900 wrote to memory of 4276	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	86
PID 2900 wrote to memory of 1044	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	87
PID 2900 wrote to memory of 1044	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	87
PID 2900 wrote to memory of 3316	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	88
PID 2900 wrote to memory of 3316	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	88
PID 2900 wrote to memory of 1040	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	89
PID 2900 wrote to memory of 1040	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	89
PID 2900 wrote to memory of 4964	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	90
PID 2900 wrote to memory of 4964	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	90
PID 2900 wrote to memory of 4028	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	91
PID 2900 wrote to memory of 4028	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	91
PID 2900 wrote to memory of 2552	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	92
PID 2900 wrote to memory of 2552	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	92
PID 2900 wrote to memory of 4544	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	93
PID 2900 wrote to memory of 4544	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	93
PID 2900 wrote to memory of 3068	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	94
PID 2900 wrote to memory of 3068	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	94
PID 2900 wrote to memory of 3688	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	95
PID 2900 wrote to memory of 3688	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	95
PID 2900 wrote to memory of 3264	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	96
PID 2900 wrote to memory of 3264	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	96
PID 2900 wrote to memory of 216	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	97
PID 2900 wrote to memory of 216	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	97
PID 2900 wrote to memory of 4724	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	98
PID 2900 wrote to memory of 4724	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	98
PID 2900 wrote to memory of 2192	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	99
PID 2900 wrote to memory of 2192	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	99
PID 2900 wrote to memory of 4936	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	100
PID 2900 wrote to memory of 4936	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	100
PID 2900 wrote to memory of 3880	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	101
PID 2900 wrote to memory of 3880	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	101
PID 2900 wrote to memory of 4000	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	102
PID 2900 wrote to memory of 4000	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	102
PID 2900 wrote to memory of 3768	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	103
PID 2900 wrote to memory of 3768	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	103
PID 2900 wrote to memory of 2536	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	104
PID 2900 wrote to memory of 2536	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	104
PID 2900 wrote to memory of 2500	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	105
PID 2900 wrote to memory of 2500	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	105
PID 2900 wrote to memory of 3528	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	106
PID 2900 wrote to memory of 3528	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	106
PID 2900 wrote to memory of 980	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	107
PID 2900 wrote to memory of 980	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	107
PID 2900 wrote to memory of 4808	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	108
PID 2900 wrote to memory of 4808	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	108
PID 2900 wrote to memory of 560	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	109
PID 2900 wrote to memory of 560	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	109
PID 2900 wrote to memory of 1708	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	110
PID 2900 wrote to memory of 1708	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	110
PID 2900 wrote to memory of 2524	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	111
PID 2900 wrote to memory of 2524	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	111
PID 2900 wrote to memory of 3640	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	112
PID 2900 wrote to memory of 3640	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	112
PID 2900 wrote to memory of 1656	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	113
PID 2900 wrote to memory of 1656	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	113
PID 2900 wrote to memory of 3004	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	114
PID 2900 wrote to memory of 3004	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	114
PID 2900 wrote to memory of 2824	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	115
PID 2900 wrote to memory of 2824	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	115
PID 2900 wrote to memory of 4520	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	116
PID 2900 wrote to memory of 4520	2900	7fc789be06aa80496c29eb1cb6f3fbb0N.exe	116

C:\Users\Admin\AppData\Local\Temp\7fc789be06aa80496c29eb1cb6f3fbb0N.exe
"C:\Users\Admin\AppData\Local\Temp\7fc789be06aa80496c29eb1cb6f3fbb0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\System\KiwIWKM.exe
  C:\Windows\System\KiwIWKM.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\ZfgVNEy.exe
  C:\Windows\System\ZfgVNEy.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\vwpfaoX.exe
  C:\Windows\System\vwpfaoX.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\gCyXuzL.exe
  C:\Windows\System\gCyXuzL.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\AmqEyUd.exe
  C:\Windows\System\AmqEyUd.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\pqgcslc.exe
  C:\Windows\System\pqgcslc.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\QzGvxLc.exe
  C:\Windows\System\QzGvxLc.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ezKgqmx.exe
  C:\Windows\System\ezKgqmx.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\SqwGTja.exe
  C:\Windows\System\SqwGTja.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\tOdZHYK.exe
  C:\Windows\System\tOdZHYK.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\fLuaBUM.exe
  C:\Windows\System\fLuaBUM.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\MNWiyQZ.exe
  C:\Windows\System\MNWiyQZ.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\xMvGQeN.exe
  C:\Windows\System\xMvGQeN.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\AnhIZlU.exe
  C:\Windows\System\AnhIZlU.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\BvuNLYR.exe
  C:\Windows\System\BvuNLYR.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\Wtpitzr.exe
  C:\Windows\System\Wtpitzr.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\mKtKkfs.exe
  C:\Windows\System\mKtKkfs.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\CAgrfEd.exe
  C:\Windows\System\CAgrfEd.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\srRfzgP.exe
  C:\Windows\System\srRfzgP.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\akynuGL.exe
  C:\Windows\System\akynuGL.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\ruIcEzd.exe
  C:\Windows\System\ruIcEzd.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\SAzojki.exe
  C:\Windows\System\SAzojki.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\dLcZXPh.exe
  C:\Windows\System\dLcZXPh.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\ubBQLIN.exe
  C:\Windows\System\ubBQLIN.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\EASfNnZ.exe
  C:\Windows\System\EASfNnZ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\SHhcQkp.exe
  C:\Windows\System\SHhcQkp.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\iiRupxR.exe
  C:\Windows\System\iiRupxR.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\IJXWhDh.exe
  C:\Windows\System\IJXWhDh.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\ZwqzZhk.exe
  C:\Windows\System\ZwqzZhk.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\UnvwVCc.exe
  C:\Windows\System\UnvwVCc.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\OcBXopl.exe
  C:\Windows\System\OcBXopl.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\ACrKShX.exe
  C:\Windows\System\ACrKShX.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\asYYQCf.exe
  C:\Windows\System\asYYQCf.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\KbDVtqQ.exe
  C:\Windows\System\KbDVtqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\jmXmDef.exe
  C:\Windows\System\jmXmDef.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\sojGtJS.exe
  C:\Windows\System\sojGtJS.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\UqRUNkN.exe
  C:\Windows\System\UqRUNkN.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\SVUOoAm.exe
  C:\Windows\System\SVUOoAm.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KYtkain.exe
  C:\Windows\System\KYtkain.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\oaGCsCN.exe
  C:\Windows\System\oaGCsCN.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\cnCTkmA.exe
  C:\Windows\System\cnCTkmA.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\RCwKdko.exe
  C:\Windows\System\RCwKdko.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\MGQrxrj.exe
  C:\Windows\System\MGQrxrj.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\rsUjiTP.exe
  C:\Windows\System\rsUjiTP.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\mIBwMZF.exe
  C:\Windows\System\mIBwMZF.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\lMgyeqr.exe
  C:\Windows\System\lMgyeqr.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\kzFZykq.exe
  C:\Windows\System\kzFZykq.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\eLiQcsr.exe
  C:\Windows\System\eLiQcsr.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\pWwTrYX.exe
  C:\Windows\System\pWwTrYX.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\kRgvDTn.exe
  C:\Windows\System\kRgvDTn.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\itgvwxg.exe
  C:\Windows\System\itgvwxg.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\GJEkrwH.exe
  C:\Windows\System\GJEkrwH.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\uJoUNMD.exe
  C:\Windows\System\uJoUNMD.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\DWjzRgA.exe
  C:\Windows\System\DWjzRgA.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\ZKKMxyb.exe
  C:\Windows\System\ZKKMxyb.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\lShLcZE.exe
  C:\Windows\System\lShLcZE.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\JSrvDdc.exe
  C:\Windows\System\JSrvDdc.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\UwAEPIX.exe
  C:\Windows\System\UwAEPIX.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\xwXyebJ.exe
  C:\Windows\System\xwXyebJ.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\XRmlbEr.exe
  C:\Windows\System\XRmlbEr.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\rkAYdqR.exe
  C:\Windows\System\rkAYdqR.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\ePQHBgh.exe
  C:\Windows\System\ePQHBgh.exe
  2⤵
  PID:4392
- C:\Windows\System\rvLoIdO.exe
  C:\Windows\System\rvLoIdO.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\aDtQmPZ.exe
  C:\Windows\System\aDtQmPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\KdMkeov.exe
  C:\Windows\System\KdMkeov.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\flERWUQ.exe
  C:\Windows\System\flERWUQ.exe
  2⤵
  PID:4292
- C:\Windows\System\mkCOkoV.exe
  C:\Windows\System\mkCOkoV.exe
  2⤵
  PID:1684
- C:\Windows\System\PUNgTLB.exe
  C:\Windows\System\PUNgTLB.exe
  2⤵
  PID:5096
- C:\Windows\System\qKHZUru.exe
  C:\Windows\System\qKHZUru.exe
  2⤵
  PID:3064
- C:\Windows\System\TyoXURt.exe
  C:\Windows\System\TyoXURt.exe
  2⤵
  PID:3272
- C:\Windows\System\rBbjHED.exe
  C:\Windows\System\rBbjHED.exe
  2⤵
  PID:3544
- C:\Windows\System\IZNUsXv.exe
  C:\Windows\System\IZNUsXv.exe
  2⤵
  PID:3112
- C:\Windows\System\qegTWAk.exe
  C:\Windows\System\qegTWAk.exe
  2⤵
  PID:748
- C:\Windows\System\Sjcytwc.exe
  C:\Windows\System\Sjcytwc.exe
  2⤵
  PID:2216
- C:\Windows\System\bWNlVoT.exe
  C:\Windows\System\bWNlVoT.exe
  2⤵
  PID:4652
- C:\Windows\System\xoSdgyZ.exe
  C:\Windows\System\xoSdgyZ.exe
  2⤵
  PID:1812
- C:\Windows\System\mgwyQnT.exe
  C:\Windows\System\mgwyQnT.exe
  2⤵
  PID:2420
- C:\Windows\System\vwgUjKA.exe
  C:\Windows\System\vwgUjKA.exe
  2⤵
  PID:5076
- C:\Windows\System\gkhtvih.exe
  C:\Windows\System\gkhtvih.exe
  2⤵
  PID:3956
- C:\Windows\System\uTEscyJ.exe
  C:\Windows\System\uTEscyJ.exe
  2⤵
  PID:1472
- C:\Windows\System\CfuGYgl.exe
  C:\Windows\System\CfuGYgl.exe
  2⤵
  PID:3504
- C:\Windows\System\ccOFZsR.exe
  C:\Windows\System\ccOFZsR.exe
  2⤵
  PID:3056
- C:\Windows\System\VzfPDvp.exe
  C:\Windows\System\VzfPDvp.exe
  2⤵
  PID:928
- C:\Windows\System\bHhWily.exe
  C:\Windows\System\bHhWily.exe
  2⤵
  PID:4944
- C:\Windows\System\BajeWqH.exe
  C:\Windows\System\BajeWqH.exe
  2⤵
  PID:2152
- C:\Windows\System\EklnUCR.exe
  C:\Windows\System\EklnUCR.exe
  2⤵
  PID:5104
- C:\Windows\System\phkaMPz.exe
  C:\Windows\System\phkaMPz.exe
  2⤵
  PID:4020
- C:\Windows\System\YPyfKOR.exe
  C:\Windows\System\YPyfKOR.exe
  2⤵
  PID:4620
- C:\Windows\System\ZAwZxbz.exe
  C:\Windows\System\ZAwZxbz.exe
  2⤵
  PID:5144
- C:\Windows\System\lCzYJqG.exe
  C:\Windows\System\lCzYJqG.exe
  2⤵
  PID:5184
- C:\Windows\System\bzXswOv.exe
  C:\Windows\System\bzXswOv.exe
  2⤵
  PID:5216
- C:\Windows\System\nFyJtYr.exe
  C:\Windows\System\nFyJtYr.exe
  2⤵
  PID:5236
- C:\Windows\System\HLSEirk.exe
  C:\Windows\System\HLSEirk.exe
  2⤵
  PID:5264
- C:\Windows\System\TBoUMvb.exe
  C:\Windows\System\TBoUMvb.exe
  2⤵
  PID:5280
- C:\Windows\System\gNyvAWf.exe
  C:\Windows\System\gNyvAWf.exe
  2⤵
  PID:5304
- C:\Windows\System\ElLtJHq.exe
  C:\Windows\System\ElLtJHq.exe
  2⤵
  PID:5328
- C:\Windows\System\sTZODDs.exe
  C:\Windows\System\sTZODDs.exe
  2⤵
  PID:5348
- C:\Windows\System\LzlvXJV.exe
  C:\Windows\System\LzlvXJV.exe
  2⤵
  PID:5376
- C:\Windows\System\ZAbcFhA.exe
  C:\Windows\System\ZAbcFhA.exe
  2⤵
  PID:5392
- C:\Windows\System\JjoRReK.exe
  C:\Windows\System\JjoRReK.exe
  2⤵
  PID:5416
- C:\Windows\System\nJadREP.exe
  C:\Windows\System\nJadREP.exe
  2⤵
  PID:5436
- C:\Windows\System\LeBXLGt.exe
  C:\Windows\System\LeBXLGt.exe
  2⤵
  PID:5492
- C:\Windows\System\OgVvCTu.exe
  C:\Windows\System\OgVvCTu.exe
  2⤵
  PID:5508
- C:\Windows\System\iSoFqCK.exe
  C:\Windows\System\iSoFqCK.exe
  2⤵
  PID:5528
- C:\Windows\System\kNQgQgf.exe
  C:\Windows\System\kNQgQgf.exe
  2⤵
  PID:5544
- C:\Windows\System\DSXYqJn.exe
  C:\Windows\System\DSXYqJn.exe
  2⤵
  PID:5568
- C:\Windows\System\YFrbEMT.exe
  C:\Windows\System\YFrbEMT.exe
  2⤵
  PID:5588
- C:\Windows\System\xCnNFVD.exe
  C:\Windows\System\xCnNFVD.exe
  2⤵
  PID:5604
- C:\Windows\System\nKtKsFe.exe
  C:\Windows\System\nKtKsFe.exe
  2⤵
  PID:5628
- C:\Windows\System\AMNGdgr.exe
  C:\Windows\System\AMNGdgr.exe
  2⤵
  PID:5652
- C:\Windows\System\tykmBEg.exe
  C:\Windows\System\tykmBEg.exe
  2⤵
  PID:5668
- C:\Windows\System\bydSBoR.exe
  C:\Windows\System\bydSBoR.exe
  2⤵
  PID:5696
- C:\Windows\System\nxbAeiW.exe
  C:\Windows\System\nxbAeiW.exe
  2⤵
  PID:5728
- C:\Windows\System\qHvcaPi.exe
  C:\Windows\System\qHvcaPi.exe
  2⤵
  PID:5748
- C:\Windows\System\XzkJVqt.exe
  C:\Windows\System\XzkJVqt.exe
  2⤵
  PID:5772
- C:\Windows\System\SWcdyaI.exe
  C:\Windows\System\SWcdyaI.exe
  2⤵
  PID:5792
- C:\Windows\System\dVnmZEG.exe
  C:\Windows\System\dVnmZEG.exe
  2⤵
  PID:5820
- C:\Windows\System\LfJTwch.exe
  C:\Windows\System\LfJTwch.exe
  2⤵
  PID:5840
- C:\Windows\System\qMMAHys.exe
  C:\Windows\System\qMMAHys.exe
  2⤵
  PID:5868
- C:\Windows\System\nMRHYOs.exe
  C:\Windows\System\nMRHYOs.exe
  2⤵
  PID:5896
- C:\Windows\System\ndUZhyO.exe
  C:\Windows\System\ndUZhyO.exe
  2⤵
  PID:5920
- C:\Windows\System\IcuJaGJ.exe
  C:\Windows\System\IcuJaGJ.exe
  2⤵
  PID:5936
- C:\Windows\System\LlppSlI.exe
  C:\Windows\System\LlppSlI.exe
  2⤵
  PID:5960
- C:\Windows\System\ukzsjlK.exe
  C:\Windows\System\ukzsjlK.exe
  2⤵
  PID:5980
- C:\Windows\System\JImgavn.exe
  C:\Windows\System\JImgavn.exe
  2⤵
  PID:6000
- C:\Windows\System\qYATaVM.exe
  C:\Windows\System\qYATaVM.exe
  2⤵
  PID:6068
- C:\Windows\System\sVQdMDa.exe
  C:\Windows\System\sVQdMDa.exe
  2⤵
  PID:6092
- C:\Windows\System\EDFofqh.exe
  C:\Windows\System\EDFofqh.exe
  2⤵
  PID:6108
- C:\Windows\System\yBuzEri.exe
  C:\Windows\System\yBuzEri.exe
  2⤵
  PID:6128
- C:\Windows\System\bfDHUiH.exe
  C:\Windows\System\bfDHUiH.exe
  2⤵
  PID:2460
- C:\Windows\System\sJMbOeQ.exe
  C:\Windows\System\sJMbOeQ.exe
  2⤵
  PID:4692
- C:\Windows\System\nYOVPvI.exe
  C:\Windows\System\nYOVPvI.exe
  2⤵
  PID:4040
- C:\Windows\System\XFdyWIp.exe
  C:\Windows\System\XFdyWIp.exe
  2⤵
  PID:2748
- C:\Windows\System\aRqyTpK.exe
  C:\Windows\System\aRqyTpK.exe
  2⤵
  PID:740
- C:\Windows\System\UhumkCx.exe
  C:\Windows\System\UhumkCx.exe
  2⤵
  PID:4444
- C:\Windows\System\pnBtPKj.exe
  C:\Windows\System\pnBtPKj.exe
  2⤵
  PID:872
- C:\Windows\System\PAmwnqn.exe
  C:\Windows\System\PAmwnqn.exe
  2⤵
  PID:4648
- C:\Windows\System\lAfkEmg.exe
  C:\Windows\System\lAfkEmg.exe
  2⤵
  PID:5256
- C:\Windows\System\psguKew.exe
  C:\Windows\System\psguKew.exe
  2⤵
  PID:5312
- C:\Windows\System\vdAjlQV.exe
  C:\Windows\System\vdAjlQV.exe
  2⤵
  PID:776
- C:\Windows\System\CNijUzu.exe
  C:\Windows\System\CNijUzu.exe
  2⤵
  PID:4836
- C:\Windows\System\BvUnEMj.exe
  C:\Windows\System\BvUnEMj.exe
  2⤵
  PID:3896
- C:\Windows\System\jcusFVl.exe
  C:\Windows\System\jcusFVl.exe
  2⤵
  PID:5636
- C:\Windows\System\JGvrorI.exe
  C:\Windows\System\JGvrorI.exe
  2⤵
  PID:5196
- C:\Windows\System\GzOgmsG.exe
  C:\Windows\System\GzOgmsG.exe
  2⤵
  PID:5764
- C:\Windows\System\GYntUTL.exe
  C:\Windows\System\GYntUTL.exe
  2⤵
  PID:5836
- C:\Windows\System\NPsHUYd.exe
  C:\Windows\System\NPsHUYd.exe
  2⤵
  PID:4680
- C:\Windows\System\FRhstRk.exe
  C:\Windows\System\FRhstRk.exe
  2⤵
  PID:5952
- C:\Windows\System\tiEYxeo.exe
  C:\Windows\System\tiEYxeo.exe
  2⤵
  PID:6168
- C:\Windows\System\oigVDZU.exe
  C:\Windows\System\oigVDZU.exe
  2⤵
  PID:6192
- C:\Windows\System\viqSmzI.exe
  C:\Windows\System\viqSmzI.exe
  2⤵
  PID:6208
- C:\Windows\System\ynkOuFk.exe
  C:\Windows\System\ynkOuFk.exe
  2⤵
  PID:6232
- C:\Windows\System\jfkWUMM.exe
  C:\Windows\System\jfkWUMM.exe
  2⤵
  PID:6256
- C:\Windows\System\GCRGeVp.exe
  C:\Windows\System\GCRGeVp.exe
  2⤵
  PID:6276
- C:\Windows\System\HhtgDVM.exe
  C:\Windows\System\HhtgDVM.exe
  2⤵
  PID:6300
- C:\Windows\System\yWWLHZG.exe
  C:\Windows\System\yWWLHZG.exe
  2⤵
  PID:6320
- C:\Windows\System\AlFHLIu.exe
  C:\Windows\System\AlFHLIu.exe
  2⤵
  PID:6340
- C:\Windows\System\rEbMzYZ.exe
  C:\Windows\System\rEbMzYZ.exe
  2⤵
  PID:6364
- C:\Windows\System\LwUdDyl.exe
  C:\Windows\System\LwUdDyl.exe
  2⤵
  PID:6392
- C:\Windows\System\noGalTH.exe
  C:\Windows\System\noGalTH.exe
  2⤵
  PID:6408
- C:\Windows\System\HxsuQcQ.exe
  C:\Windows\System\HxsuQcQ.exe
  2⤵
  PID:6424
- C:\Windows\System\vXGvxiP.exe
  C:\Windows\System\vXGvxiP.exe
  2⤵
  PID:6440
- C:\Windows\System\quObHfm.exe
  C:\Windows\System\quObHfm.exe
  2⤵
  PID:6460
- C:\Windows\System\PgVfEYe.exe
  C:\Windows\System\PgVfEYe.exe
  2⤵
  PID:6508
- C:\Windows\System\tUvLqyP.exe
  C:\Windows\System\tUvLqyP.exe
  2⤵
  PID:6532
- C:\Windows\System\EiwPtBU.exe
  C:\Windows\System\EiwPtBU.exe
  2⤵
  PID:6556
- C:\Windows\System\XDfypsw.exe
  C:\Windows\System\XDfypsw.exe
  2⤵
  PID:6584
- C:\Windows\System\lWhEBox.exe
  C:\Windows\System\lWhEBox.exe
  2⤵
  PID:6604
- C:\Windows\System\qKIomNZ.exe
  C:\Windows\System\qKIomNZ.exe
  2⤵
  PID:6628
- C:\Windows\System\QvuaEQP.exe
  C:\Windows\System\QvuaEQP.exe
  2⤵
  PID:6644
- C:\Windows\System\oQBgzzR.exe
  C:\Windows\System\oQBgzzR.exe
  2⤵
  PID:6668
- C:\Windows\System\oSESvLm.exe
  C:\Windows\System\oSESvLm.exe
  2⤵
  PID:6692
- C:\Windows\System\qwoFogg.exe
  C:\Windows\System\qwoFogg.exe
  2⤵
  PID:6712
- C:\Windows\System\bOYAzey.exe
  C:\Windows\System\bOYAzey.exe
  2⤵
  PID:6736
- C:\Windows\System\SaGuGkZ.exe
  C:\Windows\System\SaGuGkZ.exe
  2⤵
  PID:6936
- C:\Windows\System\UAjSzuu.exe
  C:\Windows\System\UAjSzuu.exe
  2⤵
  PID:6952
- C:\Windows\System\qSXdspU.exe
  C:\Windows\System\qSXdspU.exe
  2⤵
  PID:6968
- C:\Windows\System\jVGuBMP.exe
  C:\Windows\System\jVGuBMP.exe
  2⤵
  PID:6984
- C:\Windows\System\SijYGaA.exe
  C:\Windows\System\SijYGaA.exe
  2⤵
  PID:7000
- C:\Windows\System\qdBVIrw.exe
  C:\Windows\System\qdBVIrw.exe
  2⤵
  PID:7016
- C:\Windows\System\qxcFCCb.exe
  C:\Windows\System\qxcFCCb.exe
  2⤵
  PID:7040
- C:\Windows\System\BaNLzEy.exe
  C:\Windows\System\BaNLzEy.exe
  2⤵
  PID:7060
- C:\Windows\System\gbVknLZ.exe
  C:\Windows\System\gbVknLZ.exe
  2⤵
  PID:7080
- C:\Windows\System\MyoNAMR.exe
  C:\Windows\System\MyoNAMR.exe
  2⤵
  PID:7108
- C:\Windows\System\VaOVlWv.exe
  C:\Windows\System\VaOVlWv.exe
  2⤵
  PID:7124
- C:\Windows\System\DEormHt.exe
  C:\Windows\System\DEormHt.exe
  2⤵
  PID:7148
- C:\Windows\System\wfquQmJ.exe
  C:\Windows\System\wfquQmJ.exe
  2⤵
  PID:6016
- C:\Windows\System\qJHuvKQ.exe
  C:\Windows\System\qJHuvKQ.exe
  2⤵
  PID:220
- C:\Windows\System\pJjuHGA.exe
  C:\Windows\System\pJjuHGA.exe
  2⤵
  PID:2836
- C:\Windows\System\uihzWSG.exe
  C:\Windows\System\uihzWSG.exe
  2⤵
  PID:3992
- C:\Windows\System\mtTdqRR.exe
  C:\Windows\System\mtTdqRR.exe
  2⤵
  PID:1868
- C:\Windows\System\IOoNibe.exe
  C:\Windows\System\IOoNibe.exe
  2⤵
  PID:5660
- C:\Windows\System\DfWYsqY.exe
  C:\Windows\System\DfWYsqY.exe
  2⤵
  PID:5128
- C:\Windows\System\fZClOSY.exe
  C:\Windows\System\fZClOSY.exe
  2⤵
  PID:5156
- C:\Windows\System\QZlEYbp.exe
  C:\Windows\System\QZlEYbp.exe
  2⤵
  PID:5232
- C:\Windows\System\TqJsyTO.exe
  C:\Windows\System\TqJsyTO.exe
  2⤵
  PID:5272
- C:\Windows\System\iEllNTN.exe
  C:\Windows\System\iEllNTN.exe
  2⤵
  PID:5384
- C:\Windows\System\mWxbQhW.exe
  C:\Windows\System\mWxbQhW.exe
  2⤵
  PID:5448
- C:\Windows\System\EnXgIbr.exe
  C:\Windows\System\EnXgIbr.exe
  2⤵
  PID:5504
- C:\Windows\System\IlUTeYx.exe
  C:\Windows\System\IlUTeYx.exe
  2⤵
  PID:5536
- C:\Windows\System\pEhzOTo.exe
  C:\Windows\System\pEhzOTo.exe
  2⤵
  PID:5584
- C:\Windows\System\YFCnION.exe
  C:\Windows\System\YFCnION.exe
  2⤵
  PID:5648
- C:\Windows\System\hbujjSa.exe
  C:\Windows\System\hbujjSa.exe
  2⤵
  PID:5720
- C:\Windows\System\eljDAOE.exe
  C:\Windows\System\eljDAOE.exe
  2⤵
  PID:5812
- C:\Windows\System\xpDFtNX.exe
  C:\Windows\System\xpDFtNX.exe
  2⤵
  PID:5932
- C:\Windows\System\ZoWVTCL.exe
  C:\Windows\System\ZoWVTCL.exe
  2⤵
  PID:5972
- C:\Windows\System\eVEOVDN.exe
  C:\Windows\System\eVEOVDN.exe
  2⤵
  PID:6008
- C:\Windows\System\XcNLYRl.exe
  C:\Windows\System\XcNLYRl.exe
  2⤵
  PID:6104
- C:\Windows\System\PtnufhW.exe
  C:\Windows\System\PtnufhW.exe
  2⤵
  PID:2612
- C:\Windows\System\hoQKUHK.exe
  C:\Windows\System\hoQKUHK.exe
  2⤵
  PID:1236
- C:\Windows\System\YERRmXn.exe
  C:\Windows\System\YERRmXn.exe
  2⤵
  PID:2488
- C:\Windows\System\QtfKOBW.exe
  C:\Windows\System\QtfKOBW.exe
  2⤵
  PID:2996
- C:\Windows\System\wbusYpt.exe
  C:\Windows\System\wbusYpt.exe
  2⤵
  PID:6180
- C:\Windows\System\PnBqsba.exe
  C:\Windows\System\PnBqsba.exe
  2⤵
  PID:6372
- C:\Windows\System\JExdPAk.exe
  C:\Windows\System\JExdPAk.exe
  2⤵
  PID:6652
- C:\Windows\System\lXVaqnA.exe
  C:\Windows\System\lXVaqnA.exe
  2⤵
  PID:5192
- C:\Windows\System\yPNWJxN.exe
  C:\Windows\System\yPNWJxN.exe
  2⤵
  PID:5300
- C:\Windows\System\uqDgsHd.exe
  C:\Windows\System\uqDgsHd.exe
  2⤵
  PID:4136
- C:\Windows\System\FjOhGPJ.exe
  C:\Windows\System\FjOhGPJ.exe
  2⤵
  PID:5912
- C:\Windows\System\Oeohgyo.exe
  C:\Windows\System\Oeohgyo.exe
  2⤵
  PID:6264
- C:\Windows\System\PwUYdOt.exe
  C:\Windows\System\PwUYdOt.exe
  2⤵
  PID:6356
- C:\Windows\System\UyfPTFP.exe
  C:\Windows\System\UyfPTFP.exe
  2⤵
  PID:6404
- C:\Windows\System\TdzvgqT.exe
  C:\Windows\System\TdzvgqT.exe
  2⤵
  PID:6496
- C:\Windows\System\YgiYlCS.exe
  C:\Windows\System\YgiYlCS.exe
  2⤵
  PID:6616
- C:\Windows\System\KQoeccM.exe
  C:\Windows\System\KQoeccM.exe
  2⤵
  PID:7192
- C:\Windows\System\aMjckJD.exe
  C:\Windows\System\aMjckJD.exe
  2⤵
  PID:7208
- C:\Windows\System\FhVaOuO.exe
  C:\Windows\System\FhVaOuO.exe
  2⤵
  PID:7232
- C:\Windows\System\KbxwSWG.exe
  C:\Windows\System\KbxwSWG.exe
  2⤵
  PID:7252
- C:\Windows\System\hgzqXLU.exe
  C:\Windows\System\hgzqXLU.exe
  2⤵
  PID:7272
- C:\Windows\System\CIMCWHK.exe
  C:\Windows\System\CIMCWHK.exe
  2⤵
  PID:7296
- C:\Windows\System\QYisZWW.exe
  C:\Windows\System\QYisZWW.exe
  2⤵
  PID:7312
- C:\Windows\System\YiSNhgd.exe
  C:\Windows\System\YiSNhgd.exe
  2⤵
  PID:7336
- C:\Windows\System\gRmfLDa.exe
  C:\Windows\System\gRmfLDa.exe
  2⤵
  PID:7364
- C:\Windows\System\ssomatV.exe
  C:\Windows\System\ssomatV.exe
  2⤵
  PID:7384
- C:\Windows\System\amnrvIQ.exe
  C:\Windows\System\amnrvIQ.exe
  2⤵
  PID:7404
- C:\Windows\System\bhymTxB.exe
  C:\Windows\System\bhymTxB.exe
  2⤵
  PID:7496
- C:\Windows\System\gTulmpg.exe
  C:\Windows\System\gTulmpg.exe
  2⤵
  PID:7520
- C:\Windows\System\bKlqLZV.exe
  C:\Windows\System\bKlqLZV.exe
  2⤵
  PID:7544
- C:\Windows\System\wJlWqdf.exe
  C:\Windows\System\wJlWqdf.exe
  2⤵
  PID:7568
- C:\Windows\System\PuxDyOT.exe
  C:\Windows\System\PuxDyOT.exe
  2⤵
  PID:7584
- C:\Windows\System\xdhchYK.exe
  C:\Windows\System\xdhchYK.exe
  2⤵
  PID:7608
- C:\Windows\System\WjFhVYB.exe
  C:\Windows\System\WjFhVYB.exe
  2⤵
  PID:7632
- C:\Windows\System\cMeUUIc.exe
  C:\Windows\System\cMeUUIc.exe
  2⤵
  PID:7660
- C:\Windows\System\fCIoVRv.exe
  C:\Windows\System\fCIoVRv.exe
  2⤵
  PID:7676
- C:\Windows\System\memdcmu.exe
  C:\Windows\System\memdcmu.exe
  2⤵
  PID:7692
- C:\Windows\System\XkzqwVa.exe
  C:\Windows\System\XkzqwVa.exe
  2⤵
  PID:7720
- C:\Windows\System\SdfyxzC.exe
  C:\Windows\System\SdfyxzC.exe
  2⤵
  PID:7740
- C:\Windows\System\XVbwVxw.exe
  C:\Windows\System\XVbwVxw.exe
  2⤵
  PID:7772
- C:\Windows\System\kanRTnH.exe
  C:\Windows\System\kanRTnH.exe
  2⤵
  PID:7792
- C:\Windows\System\UEOGSCe.exe
  C:\Windows\System\UEOGSCe.exe
  2⤵
  PID:7820
- C:\Windows\System\HdDvWsE.exe
  C:\Windows\System\HdDvWsE.exe
  2⤵
  PID:7844
- C:\Windows\System\mIjPZnC.exe
  C:\Windows\System\mIjPZnC.exe
  2⤵
  PID:7876
- C:\Windows\System\LunFeUm.exe
  C:\Windows\System\LunFeUm.exe
  2⤵
  PID:7900
- C:\Windows\System\fjkhMUE.exe
  C:\Windows\System\fjkhMUE.exe
  2⤵
  PID:7928
- C:\Windows\System\oXkIDUx.exe
  C:\Windows\System\oXkIDUx.exe
  2⤵
  PID:7948
- C:\Windows\System\vZnHwrm.exe
  C:\Windows\System\vZnHwrm.exe
  2⤵
  PID:7972
- C:\Windows\System\QYTSnMK.exe
  C:\Windows\System\QYTSnMK.exe
  2⤵
  PID:7988
- C:\Windows\System\wfRslkv.exe
  C:\Windows\System\wfRslkv.exe
  2⤵
  PID:8012
- C:\Windows\System\aOGWERs.exe
  C:\Windows\System\aOGWERs.exe
  2⤵
  PID:8044
- C:\Windows\System\QPRLTTn.exe
  C:\Windows\System\QPRLTTn.exe
  2⤵
  PID:8060
- C:\Windows\System\LDKQFRf.exe
  C:\Windows\System\LDKQFRf.exe
  2⤵
  PID:8080
- C:\Windows\System\SBOgbqS.exe
  C:\Windows\System\SBOgbqS.exe
  2⤵
  PID:8100
- C:\Windows\System\KTdSKNA.exe
  C:\Windows\System\KTdSKNA.exe
  2⤵
  PID:8180
- C:\Windows\System\KPHSWzs.exe
  C:\Windows\System\KPHSWzs.exe
  2⤵
  PID:6676
- C:\Windows\System\fmdKJZm.exe
  C:\Windows\System\fmdKJZm.exe
  2⤵
  PID:6728
- C:\Windows\System\AWpUYVD.exe
  C:\Windows\System\AWpUYVD.exe
  2⤵
  PID:5444
- C:\Windows\System\oeQqlUq.exe
  C:\Windows\System\oeQqlUq.exe
  2⤵
  PID:5560
- C:\Windows\System\NaNzyUf.exe
  C:\Windows\System\NaNzyUf.exe
  2⤵
  PID:6164
- C:\Windows\System\SeXYqNq.exe
  C:\Windows\System\SeXYqNq.exe
  2⤵
  PID:6244
- C:\Windows\System\xARrtpp.exe
  C:\Windows\System\xARrtpp.exe
  2⤵
  PID:5968
- C:\Windows\System\bVMTtVk.exe
  C:\Windows\System\bVMTtVk.exe
  2⤵
  PID:4484
- C:\Windows\System\jXHFFeg.exe
  C:\Windows\System\jXHFFeg.exe
  2⤵
  PID:6476
- C:\Windows\System\AdNTvSp.exe
  C:\Windows\System\AdNTvSp.exe
  2⤵
  PID:6744
- C:\Windows\System\cxtDMmD.exe
  C:\Windows\System\cxtDMmD.exe
  2⤵
  PID:1092
- C:\Windows\System\VgifdIG.exe
  C:\Windows\System\VgifdIG.exe
  2⤵
  PID:6400
- C:\Windows\System\rzTuOJv.exe
  C:\Windows\System\rzTuOJv.exe
  2⤵
  PID:7176
- C:\Windows\System\xXrNMed.exe
  C:\Windows\System\xXrNMed.exe
  2⤵
  PID:6636
- C:\Windows\System\MJnalxw.exe
  C:\Windows\System\MJnalxw.exe
  2⤵
  PID:7332
- C:\Windows\System\btuTXxB.exe
  C:\Windows\System\btuTXxB.exe
  2⤵
  PID:7420
- C:\Windows\System\kDGDMbl.exe
  C:\Windows\System\kDGDMbl.exe
  2⤵
  PID:4388
- C:\Windows\System\hCgylFt.exe
  C:\Windows\System\hCgylFt.exe
  2⤵
  PID:7536
- C:\Windows\System\ACgwPnb.exe
  C:\Windows\System\ACgwPnb.exe
  2⤵
  PID:5928
- C:\Windows\System\SNfXvrN.exe
  C:\Windows\System\SNfXvrN.exe
  2⤵
  PID:5992
- C:\Windows\System\OMgefrC.exe
  C:\Windows\System\OMgefrC.exe
  2⤵
  PID:7652
- C:\Windows\System\hGOxQvm.exe
  C:\Windows\System\hGOxQvm.exe
  2⤵
  PID:7748
- C:\Windows\System\dulVfeF.exe
  C:\Windows\System\dulVfeF.exe
  2⤵
  PID:7784
- C:\Windows\System\gAcMsPQ.exe
  C:\Windows\System\gAcMsPQ.exe
  2⤵
  PID:6540
- C:\Windows\System\cDJXSiO.exe
  C:\Windows\System\cDJXSiO.exe
  2⤵
  PID:8204
- C:\Windows\System\BKiUTFo.exe
  C:\Windows\System\BKiUTFo.exe
  2⤵
  PID:8220
- C:\Windows\System\Twcuzyl.exe
  C:\Windows\System\Twcuzyl.exe
  2⤵
  PID:8244
- C:\Windows\System\LwPPdgj.exe
  C:\Windows\System\LwPPdgj.exe
  2⤵
  PID:8260
- C:\Windows\System\theZbkZ.exe
  C:\Windows\System\theZbkZ.exe
  2⤵
  PID:8280
- C:\Windows\System\ETkeVhT.exe
  C:\Windows\System\ETkeVhT.exe
  2⤵
  PID:8308
- C:\Windows\System\ZUNUxSE.exe
  C:\Windows\System\ZUNUxSE.exe
  2⤵
  PID:8332
- C:\Windows\System\efAlVYf.exe
  C:\Windows\System\efAlVYf.exe
  2⤵
  PID:8348
- C:\Windows\System\NzXCtPH.exe
  C:\Windows\System\NzXCtPH.exe
  2⤵
  PID:8380
- C:\Windows\System\qutBDpQ.exe
  C:\Windows\System\qutBDpQ.exe
  2⤵
  PID:8400
- C:\Windows\System\yxnXkpQ.exe
  C:\Windows\System\yxnXkpQ.exe
  2⤵
  PID:8420
- C:\Windows\System\ClNKXzZ.exe
  C:\Windows\System\ClNKXzZ.exe
  2⤵
  PID:8440
- C:\Windows\System\SZCiurM.exe
  C:\Windows\System\SZCiurM.exe
  2⤵
  PID:8460
- C:\Windows\System\sCBjvMl.exe
  C:\Windows\System\sCBjvMl.exe
  2⤵
  PID:8500
- C:\Windows\System\XVXPPHI.exe
  C:\Windows\System\XVXPPHI.exe
  2⤵
  PID:8516
- C:\Windows\System\PBdwVlw.exe
  C:\Windows\System\PBdwVlw.exe
  2⤵
  PID:8536
- C:\Windows\System\oJnZBAv.exe
  C:\Windows\System\oJnZBAv.exe
  2⤵
  PID:8608
- C:\Windows\System\xWMeITw.exe
  C:\Windows\System\xWMeITw.exe
  2⤵
  PID:8632
- C:\Windows\System\TRDBVGJ.exe
  C:\Windows\System\TRDBVGJ.exe
  2⤵
  PID:8656
- C:\Windows\System\IfIizNG.exe
  C:\Windows\System\IfIizNG.exe
  2⤵
  PID:8680
- C:\Windows\System\cJQegHr.exe
  C:\Windows\System\cJQegHr.exe
  2⤵
  PID:8696
- C:\Windows\System\hCXPyIe.exe
  C:\Windows\System\hCXPyIe.exe
  2⤵
  PID:8732
- C:\Windows\System\eTeEXJS.exe
  C:\Windows\System\eTeEXJS.exe
  2⤵
  PID:8748
- C:\Windows\System\dAOMSYi.exe
  C:\Windows\System\dAOMSYi.exe
  2⤵
  PID:8764
- C:\Windows\System\gnlgmoc.exe
  C:\Windows\System\gnlgmoc.exe
  2⤵
  PID:8780
- C:\Windows\System\sXUMBgT.exe
  C:\Windows\System\sXUMBgT.exe
  2⤵
  PID:8804
- C:\Windows\System\AsLWfjJ.exe
  C:\Windows\System\AsLWfjJ.exe
  2⤵
  PID:8832
- C:\Windows\System\SPkecNQ.exe
  C:\Windows\System\SPkecNQ.exe
  2⤵
  PID:8852
- C:\Windows\System\rxCkulP.exe
  C:\Windows\System\rxCkulP.exe
  2⤵
  PID:8876
- C:\Windows\System\BmMkFHO.exe
  C:\Windows\System\BmMkFHO.exe
  2⤵
  PID:8892
- C:\Windows\System\NalrAhK.exe
  C:\Windows\System\NalrAhK.exe
  2⤵
  PID:8916
- C:\Windows\System\fLemeWw.exe
  C:\Windows\System\fLemeWw.exe
  2⤵
  PID:8940
- C:\Windows\System\YByCkED.exe
  C:\Windows\System\YByCkED.exe
  2⤵
  PID:8984
- C:\Windows\System\CiSeZXn.exe
  C:\Windows\System\CiSeZXn.exe
  2⤵
  PID:9000
- C:\Windows\System\lyTVdEz.exe
  C:\Windows\System\lyTVdEz.exe
  2⤵
  PID:9016
- C:\Windows\System\TGGGYGo.exe
  C:\Windows\System\TGGGYGo.exe
  2⤵
  PID:9036
- C:\Windows\System\mFHlfnM.exe
  C:\Windows\System\mFHlfnM.exe
  2⤵
  PID:9056
- C:\Windows\System\kjFhlkn.exe
  C:\Windows\System\kjFhlkn.exe
  2⤵
  PID:9084
- C:\Windows\System\fmBPOve.exe
  C:\Windows\System\fmBPOve.exe
  2⤵
  PID:9100
- C:\Windows\System\AJhCvXh.exe
  C:\Windows\System\AJhCvXh.exe
  2⤵
  PID:9120
- C:\Windows\System\SVxSDUt.exe
  C:\Windows\System\SVxSDUt.exe
  2⤵
  PID:9148
- C:\Windows\System\ayrQFHL.exe
  C:\Windows\System\ayrQFHL.exe
  2⤵
  PID:9172
- C:\Windows\System\IfrdVFQ.exe
  C:\Windows\System\IfrdVFQ.exe
  2⤵
  PID:9192
- C:\Windows\System\GZSmQIk.exe
  C:\Windows\System\GZSmQIk.exe
  2⤵
  PID:9212
- C:\Windows\System\RuYSqPV.exe
  C:\Windows\System\RuYSqPV.exe
  2⤵
  PID:7328
- C:\Windows\System\OzfARbK.exe
  C:\Windows\System\OzfARbK.exe
  2⤵
  PID:8068
- C:\Windows\System\SdOnNHM.exe
  C:\Windows\System\SdOnNHM.exe
  2⤵
  PID:7412
- C:\Windows\System\kORHDYf.exe
  C:\Windows\System\kORHDYf.exe
  2⤵
  PID:5080
- C:\Windows\System\yNJoSZU.exe
  C:\Windows\System\yNJoSZU.exe
  2⤵
  PID:6992
- C:\Windows\System\vfpnizN.exe
  C:\Windows\System\vfpnizN.exe
  2⤵
  PID:7024
- C:\Windows\System\lBZqVHi.exe
  C:\Windows\System\lBZqVHi.exe
  2⤵
  PID:7072
- C:\Windows\System\tRmnQLi.exe
  C:\Windows\System\tRmnQLi.exe
  2⤵
  PID:7120
- C:\Windows\System\bzYqAVp.exe
  C:\Windows\System\bzYqAVp.exe
  2⤵
  PID:6012
- C:\Windows\System\FIIPsNK.exe
  C:\Windows\System\FIIPsNK.exe
  2⤵
  PID:3744
- C:\Windows\System\lmzqgwu.exe
  C:\Windows\System\lmzqgwu.exe
  2⤵
  PID:2212
- C:\Windows\System\rXMxKBR.exe
  C:\Windows\System\rXMxKBR.exe
  2⤵
  PID:6124
- C:\Windows\System\JkaqlBJ.exe
  C:\Windows\System\JkaqlBJ.exe
  2⤵
  PID:5172
- C:\Windows\System\hKABjal.exe
  C:\Windows\System\hKABjal.exe
  2⤵
  PID:5468
- C:\Windows\System\RCppahz.exe
  C:\Windows\System\RCppahz.exe
  2⤵
  PID:5876
- C:\Windows\System\aDbOXAa.exe
  C:\Windows\System\aDbOXAa.exe
  2⤵
  PID:6348
- C:\Windows\System\EIphtxj.exe
  C:\Windows\System\EIphtxj.exe
  2⤵
  PID:6612
- C:\Windows\System\mZQnvld.exe
  C:\Windows\System\mZQnvld.exe
  2⤵
  PID:3136
- C:\Windows\System\zgsKpEW.exe
  C:\Windows\System\zgsKpEW.exe
  2⤵
  PID:7708
- C:\Windows\System\FBPYXLc.exe
  C:\Windows\System\FBPYXLc.exe
  2⤵
  PID:6384
- C:\Windows\System\jLTTQRo.exe
  C:\Windows\System\jLTTQRo.exe
  2⤵
  PID:7760
- C:\Windows\System\GBaGkzf.exe
  C:\Windows\System\GBaGkzf.exe
  2⤵
  PID:9248
- C:\Windows\System\OgoljmY.exe
  C:\Windows\System\OgoljmY.exe
  2⤵
  PID:9268
- C:\Windows\System\QehZqAq.exe
  C:\Windows\System\QehZqAq.exe
  2⤵
  PID:9292
- C:\Windows\System\xkoUmeU.exe
  C:\Windows\System\xkoUmeU.exe
  2⤵
  PID:9316
- C:\Windows\System\mTDswqI.exe
  C:\Windows\System\mTDswqI.exe
  2⤵
  PID:9340
- C:\Windows\System\Qilqikp.exe
  C:\Windows\System\Qilqikp.exe
  2⤵
  PID:9364
- C:\Windows\System\AgitHuk.exe
  C:\Windows\System\AgitHuk.exe
  2⤵
  PID:9384
- C:\Windows\System\ZPPVqIb.exe
  C:\Windows\System\ZPPVqIb.exe
  2⤵
  PID:9408
- C:\Windows\System\NJjbFLJ.exe
  C:\Windows\System\NJjbFLJ.exe
  2⤵
  PID:9428
- C:\Windows\System\PjspsOt.exe
  C:\Windows\System\PjspsOt.exe
  2⤵
  PID:9452
- C:\Windows\System\JAKCUIY.exe
  C:\Windows\System\JAKCUIY.exe
  2⤵
  PID:9476
- C:\Windows\System\HAksUeq.exe
  C:\Windows\System\HAksUeq.exe
  2⤵
  PID:9500
- C:\Windows\System\AxnCaVc.exe
  C:\Windows\System\AxnCaVc.exe
  2⤵
  PID:9524
- C:\Windows\System\URzToFm.exe
  C:\Windows\System\URzToFm.exe
  2⤵
  PID:9548
- C:\Windows\System\uMwKqOI.exe
  C:\Windows\System\uMwKqOI.exe
  2⤵
  PID:9568
- C:\Windows\System\pMMoZcI.exe
  C:\Windows\System\pMMoZcI.exe
  2⤵
  PID:9592
- C:\Windows\System\BtFEJyB.exe
  C:\Windows\System\BtFEJyB.exe
  2⤵
  PID:9608
- C:\Windows\System\UsmbiSz.exe
  C:\Windows\System\UsmbiSz.exe
  2⤵
  PID:9628
- C:\Windows\System\EeyYLzi.exe
  C:\Windows\System\EeyYLzi.exe
  2⤵
  PID:9648
- C:\Windows\System\ryeneCu.exe
  C:\Windows\System\ryeneCu.exe
  2⤵
  PID:9980
- C:\Windows\System\arrJUYA.exe
  C:\Windows\System\arrJUYA.exe
  2⤵
  PID:10000
- C:\Windows\System\NdjNmKl.exe
  C:\Windows\System\NdjNmKl.exe
  2⤵
  PID:10016
- C:\Windows\System\UyLpSla.exe
  C:\Windows\System\UyLpSla.exe
  2⤵
  PID:10036
- C:\Windows\System\tNLdANS.exe
  C:\Windows\System\tNLdANS.exe
  2⤵
  PID:10084
- C:\Windows\System\AjUHZQL.exe
  C:\Windows\System\AjUHZQL.exe
  2⤵
  PID:10104
- C:\Windows\System\mcLfsaF.exe
  C:\Windows\System\mcLfsaF.exe
  2⤵
  PID:10124
- C:\Windows\System\ONgZMAe.exe
  C:\Windows\System\ONgZMAe.exe
  2⤵
  PID:10144
- C:\Windows\System\wYiTJOc.exe
  C:\Windows\System\wYiTJOc.exe
  2⤵
  PID:10164
- C:\Windows\System\gnXFkBn.exe
  C:\Windows\System\gnXFkBn.exe
  2⤵
  PID:10180
- C:\Windows\System\XbbrwGL.exe
  C:\Windows\System\XbbrwGL.exe
  2⤵
  PID:10200
- C:\Windows\System\CxlgcxW.exe
  C:\Windows\System\CxlgcxW.exe
  2⤵
  PID:10220
- C:\Windows\System\wZALwsl.exe
  C:\Windows\System\wZALwsl.exe
  2⤵
  PID:10236
- C:\Windows\System\ATStSbY.exe
  C:\Windows\System\ATStSbY.exe
  2⤵
  PID:6332
- C:\Windows\System\wUdnxbB.exe
  C:\Windows\System\wUdnxbB.exe
  2⤵
  PID:7248
- C:\Windows\System\rfuKENO.exe
  C:\Windows\System\rfuKENO.exe
  2⤵
  PID:8236
- C:\Windows\System\UGeWVHl.exe
  C:\Windows\System\UGeWVHl.exe
  2⤵
  PID:7896
- C:\Windows\System\PbxPOSo.exe
  C:\Windows\System\PbxPOSo.exe
  2⤵
  PID:7940
- C:\Windows\System\gFpianC.exe
  C:\Windows\System\gFpianC.exe
  2⤵
  PID:8008
- C:\Windows\System\fNXqGBK.exe
  C:\Windows\System\fNXqGBK.exe
  2⤵
  PID:8392
- C:\Windows\System\ZkjIEsw.exe
  C:\Windows\System\ZkjIEsw.exe
  2⤵
  PID:8468
- C:\Windows\System\VUXhtoE.exe
  C:\Windows\System\VUXhtoE.exe
  2⤵
  PID:2784
- C:\Windows\System\ukEIDIl.exe
  C:\Windows\System\ukEIDIl.exe
  2⤵
  PID:6184
- C:\Windows\System\fIbfrfs.exe
  C:\Windows\System\fIbfrfs.exe
  2⤵
  PID:9236
- C:\Windows\System\ujooNJL.exe
  C:\Windows\System\ujooNJL.exe
  2⤵
  PID:9288
- C:\Windows\System\NsfpbfH.exe
  C:\Windows\System\NsfpbfH.exe
  2⤵
  PID:10412
- C:\Windows\System\DdlmkKO.exe
  C:\Windows\System\DdlmkKO.exe
  2⤵
  PID:10428
- C:\Windows\System\xKkeTfh.exe
  C:\Windows\System\xKkeTfh.exe
  2⤵
  PID:10444
- C:\Windows\System\oImrQiu.exe
  C:\Windows\System\oImrQiu.exe
  2⤵
  PID:10460
- C:\Windows\System\hzfCrIs.exe
  C:\Windows\System\hzfCrIs.exe
  2⤵
  PID:10476
- C:\Windows\System\EGhKaGX.exe
  C:\Windows\System\EGhKaGX.exe
  2⤵
  PID:10492
- C:\Windows\System\wGegIAJ.exe
  C:\Windows\System\wGegIAJ.exe
  2⤵
  PID:10508
- C:\Windows\System\rxTFZNt.exe
  C:\Windows\System\rxTFZNt.exe
  2⤵
  PID:10528
- C:\Windows\System\oQNKKzp.exe
  C:\Windows\System\oQNKKzp.exe
  2⤵
  PID:10544
- C:\Windows\System\WUdtRXX.exe
  C:\Windows\System\WUdtRXX.exe
  2⤵
  PID:10564
- C:\Windows\System\qkoVXSc.exe
  C:\Windows\System\qkoVXSc.exe
  2⤵
  PID:10584
- C:\Windows\System\ckKiAde.exe
  C:\Windows\System\ckKiAde.exe
  2⤵
  PID:10608
- C:\Windows\System\CNveEHF.exe
  C:\Windows\System\CNveEHF.exe
  2⤵
  PID:10628
- C:\Windows\System\lfCDSZI.exe
  C:\Windows\System\lfCDSZI.exe
  2⤵
  PID:10648
- C:\Windows\System\AtTfNsh.exe
  C:\Windows\System\AtTfNsh.exe
  2⤵
  PID:10664
- C:\Windows\System\JncIius.exe
  C:\Windows\System\JncIius.exe
  2⤵
  PID:10684
- C:\Windows\System\xACbfGR.exe
  C:\Windows\System\xACbfGR.exe
  2⤵
  PID:10708
- C:\Windows\System\lQdexpX.exe
  C:\Windows\System\lQdexpX.exe
  2⤵
  PID:10728
- C:\Windows\System\SMIrcsl.exe
  C:\Windows\System\SMIrcsl.exe
  2⤵
  PID:10748
- C:\Windows\System\YnVoaVX.exe
  C:\Windows\System\YnVoaVX.exe
  2⤵
  PID:10772
- C:\Windows\System\aTHrTkq.exe
  C:\Windows\System\aTHrTkq.exe
  2⤵
  PID:10796
- C:\Windows\System\RVbtwgt.exe
  C:\Windows\System\RVbtwgt.exe
  2⤵
  PID:10820
- C:\Windows\System\DNTZvuv.exe
  C:\Windows\System\DNTZvuv.exe
  2⤵
  PID:10840
- C:\Windows\System\SydjAJH.exe
  C:\Windows\System\SydjAJH.exe
  2⤵
  PID:10856
- C:\Windows\System\KqHiLNG.exe
  C:\Windows\System\KqHiLNG.exe
  2⤵
  PID:10872
- C:\Windows\System\ECWWSbr.exe
  C:\Windows\System\ECWWSbr.exe
  2⤵
  PID:10900
- C:\Windows\System\rcnkoQo.exe
  C:\Windows\System\rcnkoQo.exe
  2⤵
  PID:10916
- C:\Windows\System\PELJgek.exe
  C:\Windows\System\PELJgek.exe
  2⤵
  PID:10936
- C:\Windows\System\VWljOoh.exe
  C:\Windows\System\VWljOoh.exe
  2⤵
  PID:10956
- C:\Windows\System\qkmAEKI.exe
  C:\Windows\System\qkmAEKI.exe
  2⤵
  PID:10976
- C:\Windows\System\HkTEaAw.exe
  C:\Windows\System\HkTEaAw.exe
  2⤵
  PID:10996
- C:\Windows\System\gxPGtUA.exe
  C:\Windows\System\gxPGtUA.exe
  2⤵
  PID:11016
- C:\Windows\System\ZYgqpwc.exe
  C:\Windows\System\ZYgqpwc.exe
  2⤵
  PID:11036
- C:\Windows\System\SsYmlII.exe
  C:\Windows\System\SsYmlII.exe
  2⤵
  PID:11064
- C:\Windows\System\OpTfCDt.exe
  C:\Windows\System\OpTfCDt.exe
  2⤵
  PID:11084
- C:\Windows\System\PONZJqH.exe
  C:\Windows\System\PONZJqH.exe
  2⤵
  PID:11108
- C:\Windows\System\WWQZehh.exe
  C:\Windows\System\WWQZehh.exe
  2⤵
  PID:11128
- C:\Windows\System\HLzpgoe.exe
  C:\Windows\System\HLzpgoe.exe
  2⤵
  PID:11144
- C:\Windows\System\GxYQLPX.exe
  C:\Windows\System\GxYQLPX.exe
  2⤵
  PID:11164
- C:\Windows\System\tlWbysc.exe
  C:\Windows\System\tlWbysc.exe
  2⤵
  PID:11184
- C:\Windows\System\WUsxoqQ.exe
  C:\Windows\System\WUsxoqQ.exe
  2⤵
  PID:11204
- C:\Windows\System\NMRlHDs.exe
  C:\Windows\System\NMRlHDs.exe
  2⤵
  PID:11228
- C:\Windows\System\FCCNlal.exe
  C:\Windows\System\FCCNlal.exe
  2⤵
  PID:11252
- C:\Windows\System\QIxnvhS.exe
  C:\Windows\System\QIxnvhS.exe
  2⤵
  PID:7964
- C:\Windows\System\hppILVT.exe
  C:\Windows\System\hppILVT.exe
  2⤵
  PID:8076
- C:\Windows\System\XVcaDXD.exe
  C:\Windows\System\XVcaDXD.exe
  2⤵
  PID:2876
- C:\Windows\System\ODAqXJC.exe
  C:\Windows\System\ODAqXJC.exe
  2⤵
  PID:6640
- C:\Windows\System\GBTZXgh.exe
  C:\Windows\System\GBTZXgh.exe
  2⤵
  PID:6292
- C:\Windows\System\vMXYgZW.exe
  C:\Windows\System\vMXYgZW.exe
  2⤵
  PID:5432
- C:\Windows\System\BbzvCwo.exe
  C:\Windows\System\BbzvCwo.exe
  2⤵
  PID:7320
- C:\Windows\System\uiHFMoo.exe
  C:\Windows\System\uiHFMoo.exe
  2⤵
  PID:5788
- C:\Windows\System\CBOZQuJ.exe
  C:\Windows\System\CBOZQuJ.exe
  2⤵
  PID:6088
- C:\Windows\System\QKoUxmB.exe
  C:\Windows\System\QKoUxmB.exe
  2⤵
  PID:9512
- C:\Windows\System\FjjSmIN.exe
  C:\Windows\System\FjjSmIN.exe
  2⤵
  PID:9620
- C:\Windows\System\iEZQtui.exe
  C:\Windows\System\iEZQtui.exe
  2⤵
  PID:10044
- C:\Windows\System\bxcqaDe.exe
  C:\Windows\System\bxcqaDe.exe
  2⤵
  PID:10076
- C:\Windows\System\YuYqQaL.exe
  C:\Windows\System\YuYqQaL.exe
  2⤵
  PID:10120
- C:\Windows\System\SKjUSQJ.exe
  C:\Windows\System\SKjUSQJ.exe
  2⤵
  PID:10196
- C:\Windows\System\ioKdZrS.exe
  C:\Windows\System\ioKdZrS.exe
  2⤵
  PID:6240
- C:\Windows\System\TvhySqE.exe
  C:\Windows\System\TvhySqE.exe
  2⤵
  PID:8296
- C:\Windows\System\BkhpvPk.exe
  C:\Windows\System\BkhpvPk.exe
  2⤵
  PID:8200
- C:\Windows\System\jGxnZIV.exe
  C:\Windows\System\jGxnZIV.exe
  2⤵
  PID:8212
- C:\Windows\System\WzsxzLF.exe
  C:\Windows\System\WzsxzLF.exe
  2⤵
  PID:8268
- C:\Windows\System\njCSzUN.exe
  C:\Windows\System\njCSzUN.exe
  2⤵
  PID:9448
- C:\Windows\System\ulGDrlr.exe
  C:\Windows\System\ulGDrlr.exe
  2⤵
  PID:9392
- C:\Windows\System\lnhBWcc.exe
  C:\Windows\System\lnhBWcc.exe
  2⤵
  PID:9516
- C:\Windows\System\LMtJPlj.exe
  C:\Windows\System\LMtJPlj.exe
  2⤵
  PID:8484
- C:\Windows\System\MXvYXuO.exe
  C:\Windows\System\MXvYXuO.exe
  2⤵
  PID:8512
- C:\Windows\System\hGXEbCS.exe
  C:\Windows\System\hGXEbCS.exe
  2⤵
  PID:11272
- C:\Windows\System\fuUrsHF.exe
  C:\Windows\System\fuUrsHF.exe
  2⤵
  PID:11296
- C:\Windows\System\RzNWcgt.exe
  C:\Windows\System\RzNWcgt.exe
  2⤵
  PID:11320
- C:\Windows\System\MlLHRmO.exe
  C:\Windows\System\MlLHRmO.exe
  2⤵
  PID:11344
- C:\Windows\System\BJFOnmJ.exe
  C:\Windows\System\BJFOnmJ.exe
  2⤵
  PID:11368
- C:\Windows\System\dlIedGU.exe
  C:\Windows\System\dlIedGU.exe
  2⤵
  PID:11392
- C:\Windows\System\DrilTTo.exe
  C:\Windows\System\DrilTTo.exe
  2⤵
  PID:11416
- C:\Windows\System\vBpzXYA.exe
  C:\Windows\System\vBpzXYA.exe
  2⤵
  PID:11440
- C:\Windows\System\TWnjMwk.exe
  C:\Windows\System\TWnjMwk.exe
  2⤵
  PID:11460
- C:\Windows\System\rfyGqHn.exe
  C:\Windows\System\rfyGqHn.exe
  2⤵
  PID:11484
- C:\Windows\System\JfjEnid.exe
  C:\Windows\System\JfjEnid.exe
  2⤵
  PID:11504
- C:\Windows\System\QfYORww.exe
  C:\Windows\System\QfYORww.exe
  2⤵
  PID:11528
- C:\Windows\System\LrfvYRv.exe
  C:\Windows\System\LrfvYRv.exe
  2⤵
  PID:11552
- C:\Windows\System\MasaFbM.exe
  C:\Windows\System\MasaFbM.exe
  2⤵
  PID:11656
- C:\Windows\System\VCutMFZ.exe
  C:\Windows\System\VCutMFZ.exe
  2⤵
  PID:11680
- C:\Windows\System\UXfWFAo.exe
  C:\Windows\System\UXfWFAo.exe
  2⤵
  PID:11704
- C:\Windows\System\IbqPytA.exe
  C:\Windows\System\IbqPytA.exe
  2⤵
  PID:11728
- C:\Windows\System\GOfvlvr.exe
  C:\Windows\System\GOfvlvr.exe
  2⤵
  PID:11748
- C:\Windows\System\ZktpQGh.exe
  C:\Windows\System\ZktpQGh.exe
  2⤵
  PID:11776
- C:\Windows\System\HefsEXB.exe
  C:\Windows\System\HefsEXB.exe
  2⤵
  PID:11796
- C:\Windows\System\xOmuzix.exe
  C:\Windows\System\xOmuzix.exe
  2⤵
  PID:11816
- C:\Windows\System\EgNJVqf.exe
  C:\Windows\System\EgNJVqf.exe
  2⤵
  PID:11836
- C:\Windows\System\bxJzYyo.exe
  C:\Windows\System\bxJzYyo.exe
  2⤵
  PID:11860
- C:\Windows\System\sESOyrP.exe
  C:\Windows\System\sESOyrP.exe
  2⤵
  PID:11888
- C:\Windows\System\tiljZXp.exe
  C:\Windows\System\tiljZXp.exe
  2⤵
  PID:11908
- C:\Windows\System\sNHdMjc.exe
  C:\Windows\System\sNHdMjc.exe
  2⤵
  PID:11932
- C:\Windows\System\bHQjUxS.exe
  C:\Windows\System\bHQjUxS.exe
  2⤵
  PID:11960
- C:\Windows\System\lLQDPjl.exe
  C:\Windows\System\lLQDPjl.exe
  2⤵
  PID:11976
- C:\Windows\System\mzRulqH.exe
  C:\Windows\System\mzRulqH.exe
  2⤵
  PID:12000
- C:\Windows\System\MREobWh.exe
  C:\Windows\System\MREobWh.exe
  2⤵
  PID:12024
- C:\Windows\System\mYtztfk.exe
  C:\Windows\System\mYtztfk.exe
  2⤵
  PID:12048
- C:\Windows\System\JdmuSOH.exe
  C:\Windows\System\JdmuSOH.exe
  2⤵
  PID:12072
- C:\Windows\System\IeIlJlu.exe
  C:\Windows\System\IeIlJlu.exe
  2⤵
  PID:12092
- C:\Windows\System\oZENXgf.exe
  C:\Windows\System\oZENXgf.exe
  2⤵
  PID:12112
- C:\Windows\System\GYBYzCe.exe
  C:\Windows\System\GYBYzCe.exe
  2⤵
  PID:12136
- C:\Windows\System\hyTTRai.exe
  C:\Windows\System\hyTTRai.exe
  2⤵
  PID:12164
- C:\Windows\System\JAcSEvp.exe
  C:\Windows\System\JAcSEvp.exe
  2⤵
  PID:12184
- C:\Windows\System\NaJgaIT.exe
  C:\Windows\System\NaJgaIT.exe
  2⤵
  PID:12216
- C:\Windows\System\pEvUazA.exe
  C:\Windows\System\pEvUazA.exe
  2⤵
  PID:12236
- C:\Windows\System\xTrfLGI.exe
  C:\Windows\System\xTrfLGI.exe
  2⤵
  PID:12260
- C:\Windows\System\bZUAUva.exe
  C:\Windows\System\bZUAUva.exe
  2⤵
  PID:12280
- C:\Windows\System\bRgJFeb.exe
  C:\Windows\System\bRgJFeb.exe
  2⤵
  PID:8592
- C:\Windows\System\ghgEQYD.exe
  C:\Windows\System\ghgEQYD.exe
  2⤵
  PID:8624
- C:\Windows\System\RUnTkSq.exe
  C:\Windows\System\RUnTkSq.exe
  2⤵
  PID:8652
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 8652 -s 28
    3⤵
    PID:11640
- C:\Windows\System\clarJjL.exe
  C:\Windows\System\clarJjL.exe
  2⤵
  PID:8692
- C:\Windows\System\pgYWuiI.exe
  C:\Windows\System\pgYWuiI.exe
  2⤵
  PID:8720
- C:\Windows\System\bkiwkfi.exe
  C:\Windows\System\bkiwkfi.exe
  2⤵
  PID:8772
- C:\Windows\System\UhYLpVb.exe
  C:\Windows\System\UhYLpVb.exe
  2⤵
  PID:8812
- C:\Windows\System\IHUhStp.exe
  C:\Windows\System\IHUhStp.exe
  2⤵
  PID:8844
- C:\Windows\System\Wmwiwey.exe
  C:\Windows\System\Wmwiwey.exe
  2⤵
  PID:8888
- C:\Windows\System\nVNHPJz.exe
  C:\Windows\System\nVNHPJz.exe
  2⤵
  PID:8936
- C:\Windows\System\SOCxmIe.exe
  C:\Windows\System\SOCxmIe.exe
  2⤵
  PID:8980
- C:\Windows\System\UGnimcE.exe
  C:\Windows\System\UGnimcE.exe
  2⤵
  PID:9028
- C:\Windows\System\pRGpQRH.exe
  C:\Windows\System\pRGpQRH.exe
  2⤵
  PID:9080
- C:\Windows\System\GkjrRFy.exe
  C:\Windows\System\GkjrRFy.exe
  2⤵
  PID:9128
- C:\Windows\System\vRyyMOJ.exe
  C:\Windows\System\vRyyMOJ.exe
  2⤵
  PID:9184
- C:\Windows\System\KTkwgpk.exe
  C:\Windows\System\KTkwgpk.exe
  2⤵
  PID:7980
- C:\Windows\System\KjCIYra.exe
  C:\Windows\System\KjCIYra.exe
  2⤵
  PID:6928
- C:\Windows\System\ETUdIWT.exe
  C:\Windows\System\ETUdIWT.exe
  2⤵
  PID:7008
- C:\Windows\System\NVSKfHG.exe
  C:\Windows\System\NVSKfHG.exe
  2⤵
  PID:7100
- C:\Windows\System\ailHPOc.exe
  C:\Windows\System\ailHPOc.exe
  2⤵
  PID:2776
- C:\Windows\System\TGDvWvR.exe
  C:\Windows\System\TGDvWvR.exe
  2⤵
  PID:4156
- C:\Windows\System\SQbGQsF.exe
  C:\Windows\System\SQbGQsF.exe
  2⤵
  PID:5744
- C:\Windows\System\XOTOeXr.exe
  C:\Windows\System\XOTOeXr.exe
  2⤵
  PID:6316
- C:\Windows\System\taYWpLg.exe
  C:\Windows\System\taYWpLg.exe
  2⤵
  PID:7604
- C:\Windows\System\sLvuvnw.exe
  C:\Windows\System\sLvuvnw.exe
  2⤵
  PID:6456
- C:\Windows\System\doYpJSS.exe
  C:\Windows\System\doYpJSS.exe
  2⤵
  PID:10604
- C:\Windows\System\qMVEfuu.exe
  C:\Windows\System\qMVEfuu.exe
  2⤵
  PID:10788
- C:\Windows\System\tyIYSEz.exe
  C:\Windows\System\tyIYSEz.exe
  2⤵
  PID:10152
- C:\Windows\System\rQZLolx.exe
  C:\Windows\System\rQZLolx.exe
  2⤵
  PID:10864
- C:\Windows\System\IQRnNpv.exe
  C:\Windows\System\IQRnNpv.exe
  2⤵
  PID:10964
- C:\Windows\System\ketMjcY.exe
  C:\Windows\System\ketMjcY.exe
  2⤵
  PID:7280
- C:\Windows\System\hJgzLNf.exe
  C:\Windows\System\hJgzLNf.exe
  2⤵
  PID:12304
- C:\Windows\System\EgOmvvA.exe
  C:\Windows\System\EgOmvvA.exe
  2⤵
  PID:12324
- C:\Windows\System\YSezeCr.exe
  C:\Windows\System\YSezeCr.exe
  2⤵
  PID:12340
- C:\Windows\System\vFfAnhB.exe
  C:\Windows\System\vFfAnhB.exe
  2⤵
  PID:12364
- C:\Windows\System\LrYlhmm.exe
  C:\Windows\System\LrYlhmm.exe
  2⤵
  PID:12384
- C:\Windows\System\Ijoondg.exe
  C:\Windows\System\Ijoondg.exe
  2⤵
  PID:12408
- C:\Windows\System\ApGmjqs.exe
  C:\Windows\System\ApGmjqs.exe
  2⤵
  PID:12428
- C:\Windows\System\yjAtxBH.exe
  C:\Windows\System\yjAtxBH.exe
  2⤵
  PID:12448
- C:\Windows\System\udqqnvn.exe
  C:\Windows\System\udqqnvn.exe
  2⤵
  PID:12472
- C:\Windows\System\NviVXdv.exe
  C:\Windows\System\NviVXdv.exe
  2⤵
  PID:12492
- C:\Windows\System\xzmfiIZ.exe
  C:\Windows\System\xzmfiIZ.exe
  2⤵
  PID:12512
- C:\Windows\System\JgihLJP.exe
  C:\Windows\System\JgihLJP.exe
  2⤵
  PID:12536
- C:\Windows\System\ayIOMxr.exe
  C:\Windows\System\ayIOMxr.exe
  2⤵
  PID:12560
- C:\Windows\System\lNlYzpg.exe
  C:\Windows\System\lNlYzpg.exe
  2⤵
  PID:12588
- C:\Windows\System\PhdsGUQ.exe
  C:\Windows\System\PhdsGUQ.exe
  2⤵
  PID:12608
- C:\Windows\System\DZhMpqn.exe
  C:\Windows\System\DZhMpqn.exe
  2⤵
  PID:12632
- C:\Windows\System\WnDizBx.exe
  C:\Windows\System\WnDizBx.exe
  2⤵
  PID:12656
- C:\Windows\System\VjEuJDq.exe
  C:\Windows\System\VjEuJDq.exe
  2⤵
  PID:12680
- C:\Windows\System\OSgPDpF.exe
  C:\Windows\System\OSgPDpF.exe
  2⤵
  PID:12704
- C:\Windows\System\rsPPJKP.exe
  C:\Windows\System\rsPPJKP.exe
  2⤵
  PID:12724
- C:\Windows\System\ZCuIBZr.exe
  C:\Windows\System\ZCuIBZr.exe
  2⤵
  PID:12744
- C:\Windows\System\ncoFpZe.exe
  C:\Windows\System\ncoFpZe.exe
  2⤵
  PID:12768
- C:\Windows\System\btAaGsE.exe
  C:\Windows\System\btAaGsE.exe
  2⤵
  PID:12788
- C:\Windows\System\RAONYVx.exe
  C:\Windows\System\RAONYVx.exe
  2⤵
  PID:12812
- C:\Windows\System\SraLHES.exe
  C:\Windows\System\SraLHES.exe
  2⤵
  PID:12840
- C:\Windows\System\dopSWyJ.exe
  C:\Windows\System\dopSWyJ.exe
  2⤵
  PID:12860
- C:\Windows\System\ZTqutTm.exe
  C:\Windows\System\ZTqutTm.exe
  2⤵
  PID:12888
- C:\Windows\System\RCqtrNo.exe
  C:\Windows\System\RCqtrNo.exe
  2⤵
  PID:12912
- C:\Windows\System\WtPodlE.exe
  C:\Windows\System\WtPodlE.exe
  2⤵
  PID:12936
- C:\Windows\System\nijXMlJ.exe
  C:\Windows\System\nijXMlJ.exe
  2⤵
  PID:12960
- C:\Windows\System\PQFeuML.exe
  C:\Windows\System\PQFeuML.exe
  2⤵
  PID:12976
- C:\Windows\System\eiEfbia.exe
  C:\Windows\System\eiEfbia.exe
  2⤵
  PID:12996
- C:\Windows\System\djYUUIw.exe
  C:\Windows\System\djYUUIw.exe
  2⤵
  PID:13012
- C:\Windows\System\ZCjyxfl.exe
  C:\Windows\System\ZCjyxfl.exe
  2⤵
  PID:13028
- C:\Windows\System\ZczERlq.exe
  C:\Windows\System\ZczERlq.exe
  2⤵
  PID:13044
- C:\Windows\System\oOMknfi.exe
  C:\Windows\System\oOMknfi.exe
  2⤵
  PID:13076
- C:\Windows\System\ZvqTsOO.exe
  C:\Windows\System\ZvqTsOO.exe
  2⤵
  PID:12580
- C:\Windows\System\HivEQvR.exe
  C:\Windows\System\HivEQvR.exe
  2⤵
  PID:13104
- C:\Windows\System\NWgrnkr.exe
  C:\Windows\System\NWgrnkr.exe
  2⤵
  PID:3720
- C:\Windows\System\tkghxYl.exe
  C:\Windows\System\tkghxYl.exe
  2⤵
  PID:11400
- C:\Windows\System\UFEwPNR.exe
  C:\Windows\System\UFEwPNR.exe
  2⤵
  PID:8148
- C:\Windows\System\PynmxSW.exe
  C:\Windows\System\PynmxSW.exe
  2⤵
  PID:12956
- C:\Windows\System\AtzNbdd.exe
  C:\Windows\System\AtzNbdd.exe
  2⤵
  PID:6228
- C:\Windows\System\VBinCJF.exe
  C:\Windows\System\VBinCJF.exe
  2⤵
  PID:9264
- C:\Windows\System\FumBhod.exe
  C:\Windows\System\FumBhod.exe
  2⤵
  PID:13100
- C:\Windows\System\wrKtPjS.exe
  C:\Windows\System\wrKtPjS.exe
  2⤵
  PID:11268
- C:\Windows\System\FGUTfVH.exe
  C:\Windows\System\FGUTfVH.exe
  2⤵
  PID:13156
- C:\Windows\System\ylPbpbw.exe
  C:\Windows\System\ylPbpbw.exe
  2⤵
  PID:8712
- C:\Windows\System\adCVCCf.exe
  C:\Windows\System\adCVCCf.exe
  2⤵
  PID:7264
- C:\Windows\System\bDcAYUE.exe
  C:\Windows\System\bDcAYUE.exe
  2⤵
  PID:7700
- C:\Windows\System\jIdBGxT.exe
  C:\Windows\System\jIdBGxT.exe
  2⤵
  PID:12300
- C:\Windows\System\UHhkcjy.exe
  C:\Windows\System\UHhkcjy.exe
  2⤵
  PID:8316
- C:\Windows\System\OCqZqDh.exe
  C:\Windows\System\OCqZqDh.exe
  2⤵
  PID:4876
- C:\Windows\System\BcMWgLr.exe
  C:\Windows\System\BcMWgLr.exe
  2⤵
  PID:12732
- C:\Windows\System\JfdSkfX.exe
  C:\Windows\System\JfdSkfX.exe
  2⤵
  PID:12676
- C:\Windows\System\YnKFoqo.exe
  C:\Windows\System\YnKFoqo.exe
  2⤵
  PID:10140
- C:\Windows\System\TCKPRBu.exe
  C:\Windows\System\TCKPRBu.exe
  2⤵
  PID:8252
- C:\Windows\System\HxKUlGd.exe
  C:\Windows\System\HxKUlGd.exe
  2⤵
  PID:13160
- C:\Windows\System\yNonGie.exe
  C:\Windows\System\yNonGie.exe
  2⤵
  PID:11384
- C:\Windows\System\yWnmGSx.exe
  C:\Windows\System\yWnmGSx.exe
  2⤵
  PID:3236
- C:\Windows\System\PjkAALO.exe
  C:\Windows\System\PjkAALO.exe
  2⤵
  PID:640
- C:\Windows\System\TMauhdw.exe
  C:\Windows\System\TMauhdw.exe
  2⤵
  PID:1264
- C:\Windows\System\CZJrSYo.exe
  C:\Windows\System\CZJrSYo.exe
  2⤵
  PID:11884
- C:\Windows\System\pXYEZRU.exe
  C:\Windows\System\pXYEZRU.exe
  2⤵
  PID:9008
- C:\Windows\System\rAiSvCC.exe
  C:\Windows\System\rAiSvCC.exe
  2⤵
  PID:13232
- C:\Windows\System\CtGcWne.exe
  C:\Windows\System\CtGcWne.exe
  2⤵
  PID:12528
- C:\Windows\System\RNStfwm.exe
  C:\Windows\System\RNStfwm.exe
  2⤵
  PID:7668
- C:\Windows\System\kMuiSAV.exe
  C:\Windows\System\kMuiSAV.exe
  2⤵
  PID:12180
- C:\Windows\System\reYWPuZ.exe
  C:\Windows\System\reYWPuZ.exe
  2⤵
  PID:12400
- C:\Windows\System\tYofAQk.exe
  C:\Windows\System\tYofAQk.exe
  2⤵
  PID:12104
- C:\Windows\System\jZJpaip.exe
  C:\Windows\System\jZJpaip.exe
  2⤵
  PID:8796
- C:\Windows\System\FQZlNmh.exe
  C:\Windows\System\FQZlNmh.exe
  2⤵
  PID:8884
- C:\Windows\System\avdupku.exe
  C:\Windows\System\avdupku.exe
  2⤵
  PID:2464
- C:\Windows\System\ZptdgeJ.exe
  C:\Windows\System\ZptdgeJ.exe
  2⤵
  PID:8072
- C:\Windows\System\FDozipu.exe
  C:\Windows\System\FDozipu.exe
  2⤵
  PID:7140
- C:\Windows\System\LQOiLhQ.exe
  C:\Windows\System\LQOiLhQ.exe
  2⤵
  PID:7224
- C:\Windows\System\zPIjOdP.exe
  C:\Windows\System\zPIjOdP.exe
  2⤵
  PID:12420
- C:\Windows\System\maGNVfM.exe
  C:\Windows\System\maGNVfM.exe
  2⤵
  PID:2268
- C:\Windows\System\BlgoWoU.exe
  C:\Windows\System\BlgoWoU.exe
  2⤵
  PID:2188
- C:\Windows\System\coCtIuK.exe
  C:\Windows\System\coCtIuK.exe
  2⤵
  PID:12856
- C:\Windows\System\iPZeByu.exe
  C:\Windows\System\iPZeByu.exe
  2⤵
  PID:9052
- C:\Windows\System\ziHBkNr.exe
  C:\Windows\System\ziHBkNr.exe
  2⤵
  PID:6224
- C:\Windows\System\ffzpLlt.exe
  C:\Windows\System\ffzpLlt.exe
  2⤵
  PID:8508
- C:\Windows\System\WnGfNdi.exe
  C:\Windows\System\WnGfNdi.exe
  2⤵
  PID:3988
- C:\Windows\System\CnFHiuq.exe
  C:\Windows\System\CnFHiuq.exe
  2⤵
  PID:5716
- C:\Windows\System\RrABnkl.exe
  C:\Windows\System\RrABnkl.exe
  2⤵
  PID:8860
- C:\Windows\System\XEHqrub.exe
  C:\Windows\System\XEHqrub.exe
  2⤵
  PID:10984
- C:\Windows\System\VaiwyHC.exe
  C:\Windows\System\VaiwyHC.exe
  2⤵
  PID:7484
- C:\Windows\System\FqcobIz.exe
  C:\Windows\System\FqcobIz.exe
  2⤵
  PID:12720
- C:\Windows\System\joYXHQW.exe
  C:\Windows\System\joYXHQW.exe
  2⤵
  PID:12604
- C:\Windows\System\bLKOnRj.exe
  C:\Windows\System\bLKOnRj.exe
  2⤵
  PID:11720
- C:\Windows\System\NiaBZQI.exe
  C:\Windows\System\NiaBZQI.exe
  2⤵
  PID:8688
- C:\Windows\System\LjbEwEu.exe
  C:\Windows\System\LjbEwEu.exe
  2⤵
  PID:11048
- C:\Windows\System\RNIlBfr.exe
  C:\Windows\System\RNIlBfr.exe
  2⤵
  PID:11688
- C:\Windows\System\JdxBdEZ.exe
  C:\Windows\System\JdxBdEZ.exe
  2⤵
  PID:13144
- C:\Windows\System\sMMGgsz.exe
  C:\Windows\System\sMMGgsz.exe
  2⤵
  PID:12360
- C:\Windows\System\IRHZPNX.exe
  C:\Windows\System\IRHZPNX.exe
  2⤵
  PID:11496
- C:\Windows\System\zSGgPvI.exe
  C:\Windows\System\zSGgPvI.exe
  2⤵
  PID:12380
- C:\Windows\System\FNzVelm.exe
  C:\Windows\System\FNzVelm.exe
  2⤵
  PID:4360
- C:\Windows\System\pxLMmAl.exe
  C:\Windows\System\pxLMmAl.exe
  2⤵
  PID:8932
- C:\Windows\System\cRvHNVW.exe
  C:\Windows\System\cRvHNVW.exe
  2⤵
  PID:10816
- C:\Windows\System\JpCpMTN.exe
  C:\Windows\System\JpCpMTN.exe
  2⤵
  PID:11724
- C:\Windows\System\iPjZPBt.exe
  C:\Windows\System\iPjZPBt.exe
  2⤵
  PID:10912
- C:\Windows\System\eUwxhoL.exe
  C:\Windows\System\eUwxhoL.exe
  2⤵
  PID:11492
- C:\Windows\System\PBPgvcI.exe
  C:\Windows\System\PBPgvcI.exe
  2⤵
  PID:12228
- C:\Windows\System\CaDDbiF.exe
  C:\Windows\System\CaDDbiF.exe
  2⤵
  PID:12568
- C:\Windows\System\gnxakHw.exe
  C:\Windows\System\gnxakHw.exe
  2⤵
  PID:12736
- C:\Windows\System\VSyBOyI.exe
  C:\Windows\System\VSyBOyI.exe
  2⤵
  PID:6816
- C:\Windows\System\wzvLBmc.exe
  C:\Windows\System\wzvLBmc.exe
  2⤵
  PID:6908
- C:\Windows\System\ZhuVYSC.exe
  C:\Windows\System\ZhuVYSC.exe
  2⤵
  PID:11640
- C:\Windows\System\PCHvOUv.exe
  C:\Windows\System\PCHvOUv.exe
  2⤵
  PID:11224
- C:\Windows\System\FQzPSRx.exe
  C:\Windows\System\FQzPSRx.exe
  2⤵
  PID:12752
- C:\Windows\System\zHvhIzV.exe
  C:\Windows\System\zHvhIzV.exe
  2⤵
  PID:7812
- C:\Windows\System\GyUPZzk.exe
  C:\Windows\System\GyUPZzk.exe
  2⤵
  PID:10804
- C:\Windows\System\KnBNmgK.exe
  C:\Windows\System\KnBNmgK.exe
  2⤵
  PID:4336
- C:\Windows\System\lWVDgVi.exe
  C:\Windows\System\lWVDgVi.exe
  2⤵
  PID:2684
- C:\Windows\System\nYEWQRI.exe
  C:\Windows\System\nYEWQRI.exe
  2⤵
  PID:13260
- C:\Windows\System\eKNUxAk.exe
  C:\Windows\System\eKNUxAk.exe
  2⤵
  PID:10300
- C:\Windows\System\PPsxzzF.exe
  C:\Windows\System\PPsxzzF.exe
  2⤵
  PID:12692
- C:\Windows\System\KppKNct.exe
  C:\Windows\System\KppKNct.exe
  2⤵
  PID:11996
- C:\Windows\System\hDXieaa.exe
  C:\Windows\System\hDXieaa.exe
  2⤵
  PID:9072
- C:\Windows\System\mIeeiHN.exe
  C:\Windows\System\mIeeiHN.exe
  2⤵
  PID:12520
- C:\Windows\System\gzUtojX.exe
  C:\Windows\System\gzUtojX.exe
  2⤵
  PID:12444
- C:\Windows\System\pbqyDYp.exe
  C:\Windows\System\pbqyDYp.exe
  2⤵
  PID:8828
- C:\Windows\System\AgBOgMB.exe
  C:\Windows\System\AgBOgMB.exe
  2⤵
  PID:6892
- C:\Windows\System\yoNsxep.exe
  C:\Windows\System\yoNsxep.exe
  2⤵
  PID:2288
- C:\Windows\System\vKHxTKc.exe
  C:\Windows\System\vKHxTKc.exe
  2⤵
  PID:6700
- C:\Windows\System\djHIHXh.exe
  C:\Windows\System\djHIHXh.exe
  2⤵
  PID:2296
- C:\Windows\System\XdgGOuc.exe
  C:\Windows\System\XdgGOuc.exe
  2⤵
  PID:10868
- C:\Windows\System\osxsauB.exe
  C:\Windows\System\osxsauB.exe
  2⤵
  PID:6900
- C:\Windows\System\mRbJzZF.exe
  C:\Windows\System\mRbJzZF.exe
  2⤵
  PID:10504
- C:\Windows\System\TcsOYmu.exe
  C:\Windows\System\TcsOYmu.exe
  2⤵
  PID:2712
- C:\Windows\System\kyKkOja.exe
  C:\Windows\System\kyKkOja.exe
  2⤵
  PID:4604
- C:\Windows\System\PYBCsfI.exe
  C:\Windows\System\PYBCsfI.exe
  2⤵
  PID:1700
- C:\Windows\System\ivOdeqK.exe
  C:\Windows\System\ivOdeqK.exe
  2⤵
  PID:11220
- C:\Windows\System\YUYmLMJ.exe
  C:\Windows\System\YUYmLMJ.exe
  2⤵
  PID:3480
- C:\Windows\System\yaXMNZn.exe
  C:\Windows\System\yaXMNZn.exe
  2⤵
  PID:13524
- C:\Windows\System\BsMMEqx.exe
  C:\Windows\System\BsMMEqx.exe
  2⤵
  PID:13572
- C:\Windows\System\yDVTRMg.exe
  C:\Windows\System\yDVTRMg.exe
  2⤵
  PID:13588
- C:\Windows\System\xMfABgT.exe
  C:\Windows\System\xMfABgT.exe
  2⤵
  PID:13648
- C:\Windows\System\PoxgDfC.exe
  C:\Windows\System\PoxgDfC.exe
  2⤵
  PID:13680
- C:\Windows\System\uchofFa.exe
  C:\Windows\System\uchofFa.exe
  2⤵
  PID:13700
- C:\Windows\System\oTSkrle.exe
  C:\Windows\System\oTSkrle.exe
  2⤵
  PID:13736
- C:\Windows\System\KvgvXEe.exe
  C:\Windows\System\KvgvXEe.exe
  2⤵
  PID:13756
- C:\Windows\System\QwhQEtl.exe
  C:\Windows\System\QwhQEtl.exe
  2⤵
  PID:13832
- C:\Windows\System\cRsrOnx.exe
  C:\Windows\System\cRsrOnx.exe
  2⤵
  PID:13860
- C:\Windows\System\LGGYtfO.exe
  C:\Windows\System\LGGYtfO.exe
  2⤵
  PID:13976
- C:\Windows\System\BONwuDN.exe
  C:\Windows\System\BONwuDN.exe
  2⤵
  PID:14312
- C:\Windows\System\RfvBdBh.exe
  C:\Windows\System\RfvBdBh.exe
  2⤵
  PID:6888
- C:\Windows\System\PWOHlaE.exe
  C:\Windows\System\PWOHlaE.exe
  2⤵
  PID:4852
- C:\Windows\System\BPHOMxL.exe
  C:\Windows\System\BPHOMxL.exe
  2⤵
  PID:5296
- C:\Windows\System\SMNIACg.exe
  C:\Windows\System\SMNIACg.exe
  2⤵
  PID:13356
- C:\Windows\System\BOYsfzJ.exe
  C:\Windows\System\BOYsfzJ.exe
  2⤵
  PID:13088
- C:\Windows\System\ThIiHKN.exe
  C:\Windows\System\ThIiHKN.exe
  2⤵
  PID:13360
- C:\Windows\System\spEXsLd.exe
  C:\Windows\System\spEXsLd.exe
  2⤵
  PID:13396
- C:\Windows\System\daMjkpo.exe
  C:\Windows\System\daMjkpo.exe
  2⤵
  PID:13364
- C:\Windows\System\RjrnyeZ.exe
  C:\Windows\System\RjrnyeZ.exe
  2⤵
  PID:13368
- C:\Windows\System\eYrJTWb.exe
  C:\Windows\System\eYrJTWb.exe
  2⤵
  PID:13484
- C:\Windows\System\FFdIfJb.exe
  C:\Windows\System\FFdIfJb.exe
  2⤵
  PID:13492
- C:\Windows\System\pgfmeRE.exe
  C:\Windows\System\pgfmeRE.exe
  2⤵
  PID:13464
- C:\Windows\System\qfYNyYd.exe
  C:\Windows\System\qfYNyYd.exe
  2⤵
  PID:13416
- C:\Windows\System\lYbjgSo.exe
  C:\Windows\System\lYbjgSo.exe
  2⤵
  PID:13556
- C:\Windows\System\VXekDjh.exe
  C:\Windows\System\VXekDjh.exe
  2⤵
  PID:13604
- C:\Windows\System\YaieYSa.exe
  C:\Windows\System\YaieYSa.exe
  2⤵
  PID:13660
- C:\Windows\System\yfOnVOs.exe
  C:\Windows\System\yfOnVOs.exe
  2⤵
  PID:13672
- C:\Windows\System\zpsZefD.exe
  C:\Windows\System\zpsZefD.exe
  2⤵
  PID:13712
- C:\Windows\System\hAnRgvA.exe
  C:\Windows\System\hAnRgvA.exe
  2⤵
  PID:13728
- C:\Windows\System\XKHGYWf.exe
  C:\Windows\System\XKHGYWf.exe
  2⤵
  PID:13764
- C:\Windows\System\JBzHIoi.exe
  C:\Windows\System\JBzHIoi.exe
  2⤵
  PID:13788
- C:\Windows\System\UrcxLhe.exe
  C:\Windows\System\UrcxLhe.exe
  2⤵
  PID:13812
- C:\Windows\System\sJsxxKZ.exe
  C:\Windows\System\sJsxxKZ.exe
  2⤵
  PID:13856
- C:\Windows\System\rXEIdUE.exe
  C:\Windows\System\rXEIdUE.exe
  2⤵
  PID:13892
- C:\Windows\System\zfCZEby.exe
  C:\Windows\System\zfCZEby.exe
  2⤵
  PID:13912
- C:\Windows\System\oETbOpT.exe
  C:\Windows\System\oETbOpT.exe
  2⤵
  PID:13956
- C:\Windows\System\VQRAtjG.exe
  C:\Windows\System\VQRAtjG.exe
  2⤵
  PID:14000
- C:\Windows\System\xIBLzeN.exe
  C:\Windows\System\xIBLzeN.exe
  2⤵
  PID:14212
- C:\Windows\System\GwnntIh.exe
  C:\Windows\System\GwnntIh.exe
  2⤵
  PID:14236
- C:\Windows\System\oppGNqC.exe
  C:\Windows\System\oppGNqC.exe
  2⤵
  PID:14252
- C:\Windows\System\WRidQDf.exe
  C:\Windows\System\WRidQDf.exe
  2⤵
  PID:14280
- C:\Windows\System\tLRMYGh.exe
  C:\Windows\System\tLRMYGh.exe
  2⤵
  PID:14300
- C:\Windows\System\GgghTSh.exe
  C:\Windows\System\GgghTSh.exe
  2⤵
  PID:3188
- C:\Windows\System\CeAMTRw.exe
  C:\Windows\System\CeAMTRw.exe
  2⤵
  PID:13340
- C:\Windows\System\lMfSWBi.exe
  C:\Windows\System\lMfSWBi.exe
  2⤵
  PID:13608
- C:\Windows\System\uMnXtCF.exe
  C:\Windows\System\uMnXtCF.exe
  2⤵
  PID:14072
- C:\Windows\System\bvOgpaZ.exe
  C:\Windows\System\bvOgpaZ.exe
  2⤵
  PID:14060
- C:\Windows\System\eHuHZaQ.exe
  C:\Windows\System\eHuHZaQ.exe
  2⤵
  PID:14108
- C:\Windows\System\ICKBGrH.exe
  C:\Windows\System\ICKBGrH.exe
  2⤵
  PID:14152
- C:\Windows\System\ZshnGXq.exe
  C:\Windows\System\ZshnGXq.exe
  2⤵
  PID:14168
- C:\Windows\System\ZIZLXBP.exe
  C:\Windows\System\ZIZLXBP.exe
  2⤵
  PID:14228
- C:\Windows\System\IrXLJoJ.exe
  C:\Windows\System\IrXLJoJ.exe
  2⤵
  PID:14244
- C:\Windows\System\UMiUVul.exe
  C:\Windows\System\UMiUVul.exe
  2⤵
  PID:14272
- C:\Windows\System\RnkxGcZ.exe
  C:\Windows\System\RnkxGcZ.exe
  2⤵
  PID:14308
- C:\Windows\System\FbKGSil.exe
  C:\Windows\System\FbKGSil.exe
  2⤵
  PID:9532
- C:\Windows\System\VdxhXUT.exe
  C:\Windows\System\VdxhXUT.exe
  2⤵
  PID:668
- C:\Windows\System\wKIPNxP.exe
  C:\Windows\System\wKIPNxP.exe
  2⤵
  PID:1200
- C:\Windows\System\gRQNdwP.exe
  C:\Windows\System\gRQNdwP.exe
  2⤵
  PID:14220
- C:\Windows\System\WxzIIQu.exe
  C:\Windows\System\WxzIIQu.exe
  2⤵
  PID:13632
- C:\Windows\System\DKBVJNW.exe
  C:\Windows\System\DKBVJNW.exe
  2⤵
  PID:14056
- C:\Windows\System\qKyYJQz.exe
  C:\Windows\System\qKyYJQz.exe
  2⤵
  PID:3144
- C:\Windows\System\ACNRywd.exe
  C:\Windows\System\ACNRywd.exe
  2⤵
  PID:804
- C:\Windows\System\FeUbaWD.exe
  C:\Windows\System\FeUbaWD.exe
  2⤵
  PID:4396
- C:\Windows\System\YPmjRZT.exe
  C:\Windows\System\YPmjRZT.exe
  2⤵
  PID:14076
- C:\Windows\System\agAPiFs.exe
  C:\Windows\System\agAPiFs.exe
  2⤵
  PID:13620
- C:\Windows\System\IANyOXH.exe
  C:\Windows\System\IANyOXH.exe
  2⤵
  PID:14184
- C:\Windows\System\GgfetRg.exe
  C:\Windows\System\GgfetRg.exe
  2⤵
  PID:13900
- C:\Windows\System\VCZGTeC.exe
  C:\Windows\System\VCZGTeC.exe
  2⤵
  PID:3996
- C:\Windows\System\cBuQFKv.exe
  C:\Windows\System\cBuQFKv.exe
  2⤵
  PID:13724
- C:\Windows\System\MuWwDrr.exe
  C:\Windows\System\MuWwDrr.exe
  2⤵
  PID:4548
- C:\Windows\System\rZWSshL.exe
  C:\Windows\System\rZWSshL.exe
  2⤵
  PID:13744
- C:\Windows\System\cRAavrT.exe
  C:\Windows\System\cRAavrT.exe
  2⤵
  PID:13816
- C:\Windows\System\qSwAlek.exe
  C:\Windows\System\qSwAlek.exe
  2⤵
  PID:13444
- C:\Windows\System\xXRLcLR.exe
  C:\Windows\System\xXRLcLR.exe
  2⤵
  PID:12988
- C:\Windows\System\hWuTmPR.exe
  C:\Windows\System\hWuTmPR.exe
  2⤵
  PID:13872
- C:\Windows\System\ZHAPPoQ.exe
  C:\Windows\System\ZHAPPoQ.exe
  2⤵
  PID:2308
- C:\Windows\System\MjtmIGo.exe
  C:\Windows\System\MjtmIGo.exe
  2⤵
  PID:2124
- C:\Windows\System\kgjemPR.exe
  C:\Windows\System\kgjemPR.exe
  2⤵
  PID:13780
- C:\Windows\System\aUeICid.exe
  C:\Windows\System\aUeICid.exe
  2⤵
  PID:3812
- C:\Windows\System\zzQfdJI.exe
  C:\Windows\System\zzQfdJI.exe
  2⤵
  PID:3596
- C:\Windows\System\mEefhBg.exe
  C:\Windows\System\mEefhBg.exe
  2⤵
  PID:4256
- C:\Windows\System\oGdWxFO.exe
  C:\Windows\System\oGdWxFO.exe
  2⤵
  PID:13904
- C:\Windows\System\zEGWpWv.exe
  C:\Windows\System\zEGWpWv.exe
  2⤵
  PID:13936
- C:\Windows\System\SivbmHX.exe
  C:\Windows\System\SivbmHX.exe
  2⤵
  PID:2728
- C:\Windows\System\FWORaYS.exe
  C:\Windows\System\FWORaYS.exe
  2⤵
  PID:4320
- C:\Windows\System\KRSCAZH.exe
  C:\Windows\System\KRSCAZH.exe
  2⤵
  PID:1548
- C:\Windows\System\VRHdiZb.exe
  C:\Windows\System\VRHdiZb.exe
  2⤵
  PID:4344
- C:\Windows\System\UswQbDY.exe
  C:\Windows\System\UswQbDY.exe
  2⤵
  PID:4288
- C:\Windows\System\JJkykpQ.exe
  C:\Windows\System\JJkykpQ.exe
  2⤵
  PID:5036
- C:\Windows\System\EhoipZB.exe
  C:\Windows\System\EhoipZB.exe
  2⤵
  PID:568
- C:\Windows\System\UFghSpx.exe
  C:\Windows\System\UFghSpx.exe
  2⤵
  PID:4512
- C:\Windows\System\PTkRJyV.exe
  C:\Windows\System\PTkRJyV.exe
  2⤵
  PID:1160
- C:\Windows\System\eIPBvjl.exe
  C:\Windows\System\eIPBvjl.exe
  2⤵
  PID:4016
- C:\Windows\System\fsBdTvv.exe
  C:\Windows\System\fsBdTvv.exe
  2⤵
  PID:4332
- C:\Windows\System\gvMkbWo.exe
  C:\Windows\System\gvMkbWo.exe
  2⤵
  PID:8
- C:\Windows\System\RYOYjVk.exe
  C:\Windows\System\RYOYjVk.exe
  2⤵
  PID:4208
- C:\Windows\System\rrQuCgr.exe
  C:\Windows\System\rrQuCgr.exe
  2⤵
  PID:2364
- C:\Windows\System\IabNMkk.exe
  C:\Windows\System\IabNMkk.exe
  2⤵
  PID:856
- C:\Windows\System\BibGdcM.exe
  C:\Windows\System\BibGdcM.exe
  2⤵
  PID:1012
- C:\Windows\System\PkrlRBh.exe
  C:\Windows\System\PkrlRBh.exe
  2⤵
  PID:13828
- C:\Windows\System\iRANigU.exe
  C:\Windows\System\iRANigU.exe
  2⤵
  PID:3252
- C:\Windows\System\YBUYdNJ.exe
  C:\Windows\System\YBUYdNJ.exe
  2⤵
  PID:4212
- C:\Windows\System\ZUDjFTy.exe
  C:\Windows\System\ZUDjFTy.exe
  2⤵
  PID:13808
- C:\Windows\System\dUjahut.exe
  C:\Windows\System\dUjahut.exe
  2⤵
  PID:1852
- C:\Windows\System\tlZLJGm.exe
  C:\Windows\System\tlZLJGm.exe
  2⤵
  PID:4188
- C:\Windows\System\fSyZIVo.exe
  C:\Windows\System\fSyZIVo.exe
  2⤵
  PID:1224
- C:\Windows\System\fHnmNGz.exe
  C:\Windows\System\fHnmNGz.exe
  2⤵
  PID:312
- C:\Windows\System\GavganG.exe
  C:\Windows\System\GavganG.exe
  2⤵
  PID:10524
- C:\Windows\System\njQfwUS.exe
  C:\Windows\System\njQfwUS.exe
  2⤵
  PID:1560
- C:\Windows\System\xAyrncG.exe
  C:\Windows\System\xAyrncG.exe
  2⤵
  PID:3368
- C:\Windows\System\oMWYZHZ.exe
  C:\Windows\System\oMWYZHZ.exe
  2⤵
  PID:3732
- C:\Windows\System\vJlhSPH.exe
  C:\Windows\System\vJlhSPH.exe
  2⤵
  PID:13884
- C:\Windows\System\omrPLoT.exe
  C:\Windows\System\omrPLoT.exe
  2⤵
  PID:1020
- C:\Windows\System\zxoclHW.exe
  C:\Windows\System\zxoclHW.exe
  2⤵
  PID:13532

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:10504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 432 -p 12408 -ip 12408
1⤵
PID:8932

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14044

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14016

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13872

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:1852

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3368

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14092

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:5148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3sdulnxh.mru.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACrKShX.exe

Filesize
2.0MB

MD5
4032a235e98198cc955beb19ee8ba1e7

SHA1
8c0e0a9ba0acbddffc9d5f153a11f2950e5de052

SHA256
4a5382172b92cb021824cb596e9c4f4157e3198601997586ab95b899d80aeef8

SHA512
8d14422c7b58b49087e22003b622655e967fe0e68454c809ec562649da08af524afe78e30fc31a97056af7c019e6a83e6687b87e27a459ee4c92ab3e86d4163a

Download Submit
C:\Windows\System\AmqEyUd.exe

Filesize
2.0MB

MD5
56ff8d52a67878c9d709375bfb551c14

SHA1
634ec2c2a7f1c673e7917a686db921bed757965b

SHA256
7d68b39c9460a4d92ec96d9cb8107a3606ca9d298e29f9243ab8a6ec926257e5

SHA512
656d9c9add73e35052ff01ae6f9da7e015067943343ff8a3b7a796f9a83b3debeab1493db025cafa912eaa3b90528a13b982e4efec31668ed6c1bbea52464c6c

Download Submit
C:\Windows\System\AnhIZlU.exe

Filesize
2.0MB

MD5
94aa20e0b1266e7ad36aceea7c3f17bb

SHA1
0aaa4749c3eb8c0d7c80fa9382b18ffa19ea8be5

SHA256
ef961802f0a91fb094ad7a0d6545dc016f9409ae3a19a6f73948d4b094117399

SHA512
e1faece55f90b2b25a2501c78b099fc51eb22d70486022bb53f03bff1bc22cd804233322b05f4ca3bda53c620cf8724943354890ece7d5a2308466fe2b7a4b6b

Download Submit
C:\Windows\System\BvuNLYR.exe

Filesize
2.0MB

MD5
00aafa39e2593892e48b30316292ccb7

SHA1
d667eae5c1a0de6a0e430c77eee4dd7a4922dd41

SHA256
85480de00806b1c3021b5622560cde140d3100410736fd4c171863a756d748ab

SHA512
88e96cbc83e30752e0be37da41cbf7a843c77f42086aa8b92d126c097c3b68c4de81a5808f467808d729081ca56fca2af89a2406513f1c5ef14455237dd904a1

Download Submit
C:\Windows\System\CAgrfEd.exe

Filesize
2.0MB

MD5
42b81af4ca2adab772a2e227febf9682

SHA1
1300dc2820f7cb2f585565d75b2d962639c27bb4

SHA256
66db0036872f5f84106bdade1a072090b1c4b89cc3af817003781fadae461528

SHA512
fa156bf4b644fa7f230347865a043402c4e0606d5220ccecfd2a35e079c6cf08fa183a76a1e423976e4ecffd1abbe79a438f8dc2040978fe89560ccb784e5f57

Download Submit
C:\Windows\System\EASfNnZ.exe

Filesize
2.0MB

MD5
9b287ae43dccd28b1b86ff9130f962d1

SHA1
7a30933ee0543face356d88a1473f0591c3b48d7

SHA256
107a7f6e99ed1695907781a78e8932b2d7f5208edaa4af8de05646dbb7b5bc76

SHA512
b3bda2e01ad06b990c2835ab6158cadba238a45cc7228d0b5c8e2a078c5c3ad972da08f8e1becb9d51a5c521fe8fc730f25bcf413f3d376564e378077b69a9c3

Download Submit
C:\Windows\System\IJXWhDh.exe

Filesize
2.0MB

MD5
089a65bc67702a1e1ee572c8a291a633

SHA1
ace0b8515aa13c324cd61f6bfcdfe297a036f098

SHA256
9b7f8a304e5a3e2b766c92c6d4e039d581e0962567221df1e1c7f5f4dea37094

SHA512
b20573eadd57038f6489df3c556eca67890a4e37281916f265c99f12a57a867bb2bfba5698137a9520729728137e080635ca503ca913bd9b45c6f4cd15075efd

Download Submit
C:\Windows\System\KYtkain.exe

Filesize
2.0MB

MD5
42bd70dbb74ee528beaa1fcbd5f37552

SHA1
18d7ca1aa33cb2f971f222f41b1687ab24605b18

SHA256
2a12f577cb77ea24a8e6d05a958575c3c2e60ede991c33829a1f7a0d19c6eac9

SHA512
71ef8c4d98781c722006b4a6a2183aaeeb032c25ff165385da3625a0a652f73411b742b8d23fb829585fd72bf8b28ce5d7dc021b683e10ecb1b7ac3a0dd77ce7

Download Submit
C:\Windows\System\KbDVtqQ.exe

Filesize
2.0MB

MD5
955b39769190bd768552bffae12a8a65

SHA1
66ccb3f2484861b38941686cab20be3f7ae1dbb8

SHA256
dc69c0a84adfee6d59cc4e31be2f8de624708ed6ef25c7e9a67c111528cc0df1

SHA512
231a8d0a6807df10c0f8382821a559f112fb6c730fd4ede00071daf135eac2b1870aacbfe10ea6c4297d7d44fc724065e65b750a4ad04ccd69eee5b3d574e626

Download Submit
C:\Windows\System\KiwIWKM.exe

Filesize
2.0MB

MD5
a11e2976cd7a4c71575017b25d9f7963

SHA1
7d837ce51d35f3082a8fa80bf90e89a770041e96

SHA256
55665cfced0bb5d719a838d4ee0253c9f5878d9df0e46b400a1b5ca8fab60e65

SHA512
8734d6eaae636b2cc4da18226caa0a91930b2403c4f28853046d9d518839537529a5e116b93717e2058db169ce28db2c0d4f9b12379aab279f0d3c842e274fa9

Download Submit
C:\Windows\System\MNWiyQZ.exe

Filesize
2.0MB

MD5
54d9f329c732007a643791402ff961a5

SHA1
de9ea425303f6597aef58a3982860f638bc15008

SHA256
f67c1a1cd325c5feedaac529fac0b0163163b36c165704f84adfaee90ea0f557

SHA512
efbed06e7357abde5076c9911acdf2d3ba6eac16c8bd4ee0661b597001521f3d4b5265251a35d12f330f4e644bb6af7cf94e886b3807a76041bdc56c5b1d2e4c

Download Submit
C:\Windows\System\OcBXopl.exe

Filesize
2.0MB

MD5
46fa50d35d53ae9d0f924dcc3d3a9acc

SHA1
e142e8eea4de3dbc29ff3eb09cc9b05eae68cf1f

SHA256
c3c4ae7866f8e8014eebc9731f012bc1dad7e189a0fe4d1ddb2066fcf4bfc956

SHA512
4e655892fa83ef2c8ec81ed0517ebdd9784c1fffe7074cc803ab8260422ecbd44d811fa9f1fe0fcadf9ffaa99bbae2f3b73cb77e777530d027bc718aa43befcb

Download Submit
C:\Windows\System\QzGvxLc.exe

Filesize
2.0MB

MD5
fe307accdb9246cd7dd27f996af73654

SHA1
f88e923c92d1ddf92933c564dee3ff08af55182a

SHA256
58a49832198cc03d8fe2673a342b4e36f834aed7421e462db17cbbe4db7172a7

SHA512
6a5356452d4b214cde62c9aca4db37e8e5f7eca6604f314dc4d68e79701eae453d26304abf4a810438ba86817208ee6aee55e78646da2e25047430abcc823ef7

Download Submit
C:\Windows\System\SAzojki.exe

Filesize
2.0MB

MD5
d1585df4a6bcf2e19ac9809dda974ebc

SHA1
292de623564b29d150d68bd8834b1128fbbbcad4

SHA256
1b9fa00989d0600a3988748429029930be6bbd7bbffa701adafb99222b1c1be6

SHA512
016ef79a03d401aa69aff075a8934da4eeefe7e1eea6fad44abf20c79e67109f1a95010176c5352938991a8117da3584f8b19c328c782432d428f4ef98ebddf7

Download Submit
C:\Windows\System\SHhcQkp.exe

Filesize
2.0MB

MD5
f93d21fae877a89b4be0a886a642defa

SHA1
e1c0222c5136a511588b9dc72103c974bee36f35

SHA256
22dda5fadd3678b28ab0c786add57b519ab6855b2a529915067697579d90af5d

SHA512
5f01d67c274fe52a969cb258e4bcf00a740a92c31068c0e6e1cb815727b66178a91c327aea3b15be4ef4c0d93ee5d21ce642cc094ea8d2b49b3f2b6acc27cac6

Download Submit
C:\Windows\System\SVUOoAm.exe

Filesize
2.0MB

MD5
4ad7324196a238be10b35f7e397f1b3e

SHA1
5144ca6add4d97e7fec869d2c3a29a31b04f4a48

SHA256
a8a0782269ea75d68cf71df110aeb4f48a8865b398afaa7045954db7c562ffc9

SHA512
652e27ab13c2a2d50b810c1b61eaeb29c6b94a1cc86814a679a7bb5ca524ad2cd408ea4ccfe626c86ed8fc13a3561a53714d1bec13df805c077e3270089ece1c

Download Submit
C:\Windows\System\SqwGTja.exe

Filesize
2.0MB

MD5
236ff13a8f8fb31e1848a95920a37e26

SHA1
5031e9c79fc3029236b930d128cb73cb2798c187

SHA256
6ebda8a7ac32362b01397e4cfae98d5cc360b32c0301661cee6f4cd57dc59214

SHA512
69d3d2739edc696b0f1e010af43a6c87194fcd5461367a9a539c4d0d99140b3fd86f5109e1d9bd74b1c96706cb1b5f3701f8044d670476b8ae3618a755b2a2f2

Download Submit
C:\Windows\System\UnvwVCc.exe

Filesize
2.0MB

MD5
db534634f7291bd439048a8a196c99db

SHA1
6c58dc916900d26353ad06f0b3f96d54660a4980

SHA256
a675eabfe2055f82987e3f2af04215948eab9ed3968cc1ef8bc81e23693b38a8

SHA512
4f3285d9daf9fca53b9f71a2159f034ada5c05ae565af73c4dabdab1f3c17765c912826e6306325a0a3df074caaaacabaaf02082f92e8b503c5208634584c6c5

Download Submit
C:\Windows\System\UqRUNkN.exe

Filesize
2.0MB

MD5
b29d63657b637a471b66905e500b2296

SHA1
3b8a76011ab73a44ac54cc263d8a5ca1a53dffea

SHA256
3d8d7d21b1cf1fcb77b5b8618699a2ee94a57ebaad6209a17262490b64d732f6

SHA512
8047781c6b38f88be50c0facf849777295298e39cc3737352926bd2fa3789a12e2ec130544bec7042e312d7479f6ff73161b48c3bd9f3a30928f554125af1ddb

Download Submit
C:\Windows\System\Wtpitzr.exe

Filesize
2.0MB

MD5
347676141d2a1e7b38cd1ded60e87725

SHA1
e2427d1a33ad192444fd0fab1b2fbf19938f191d

SHA256
d2acad7d8a401cd99401b94300dd0ce369810d860e1d2413fd287a21ddbce269

SHA512
d4aed681717941c4d690d22f9c36171745fdccb37d3959b0df51f413408682cab5b7998305ddbb2d7c638c0dd3c58e6dad154aac6aad5cd83aeee8876a96ef3c

Download Submit
C:\Windows\System\YDdXwbd.exe

Filesize
8B

MD5
89b49edfc15b320118dccc63dce276c0

SHA1
d6a182f9e8a009d8ebfef26a1c685fcf2b4f152a

SHA256
b80b4d5110187afa9e6d1cf3e2b0f3429a153e9d0c88c32cabdb6359e19204f1

SHA512
7177d9a15db58801e4f8b1c7970b405645f764452ade86d38cac06f6967fac62b12ef486104093e1892a28c57d2dd25b2fe393363d54d8f0cf2bd6688982c9c6

Download Submit
C:\Windows\System\ZfgVNEy.exe

Filesize
2.0MB

MD5
e8d57f1de5d668e76e48a1334a9e8562

SHA1
2cef83cb280cde2e831c8cb564ced08ef0b7ffa5

SHA256
f6b7b81841a7664572b4a886ac25287665d9e0cfb06975dfde97003ea313a38a

SHA512
ec3e65d02f77d30a43cd465ae5a6bb8a95c4a71de64c807e0889735dae51621e82b3682b0bc2383dcd54d292ae7cc5a8604bb65c811f3171b4c7558bbdf5d320

Download Submit
C:\Windows\System\ZwqzZhk.exe

Filesize
2.0MB

MD5
0db20104f5ec0ab0cf1c71f15a6bf870

SHA1
18d1637f2ca0a412cdb564b5b29ec8b5c23995c4

SHA256
0638b8f5b568fc548bf454f7626c0fe43c7b7f70cae6d7536fe4170f55e18c70

SHA512
2a57c9f0289a89287040ac2ecccd0350839ebbaf39eac62bdb8cfaca3adc21d5b02902cf458c3c0cb173a30955ecb30aaf00f5424ba5bedf54a02226227351cc

Download Submit
C:\Windows\System\akynuGL.exe

Filesize
2.0MB

MD5
cbc253e55035fb0545506d20acde83da

SHA1
b887285ae2ec1a9ff09c0e3901ea065be377dc10

SHA256
e2f983ad6aa4469a8f70c6a82c427226268161a056b2e864e633be0d44f488d5

SHA512
bcb6e5a2cf26c725c9feeb562397565df4b6445f44f0b595b01cdb12bac7e55accae0205339d3e56f4a798a737bfa752043eabbf7af51c15d010a132cedf7be8

Download Submit
C:\Windows\System\asYYQCf.exe

Filesize
2.0MB

MD5
551e0851dada99402203bd1268e11dd5

SHA1
8ee170e6f3de6317ce2236c45054583083f02591

SHA256
2c2163f321ddb20da5bfd093520cee7af00a1a476c45e0c9100a02b607269ac8

SHA512
f2a7c85ee20e1ef9e72f6b0dfed33670dd22ec792c2f95691db8b876895563b6dcb895910cff30e65366ad5a492a97dab339fccab484ce0fc94a2ab053e260c5

Download Submit
C:\Windows\System\dLcZXPh.exe

Filesize
2.0MB

MD5
810d28576ced79edae71f9383ce78c18

SHA1
e532fb2f41caf1aec4328bca1904b31bacff5613

SHA256
43262e763692029b7060512927bcf0b11ea057a27eb43ce531a300a65944bc0a

SHA512
fabf1e70ec8cf3a52156167892ed53797df518030e6f5f10076abc28d0cbd3588f85b054b4f141a555db88a3c4b2d76ae26887bb8d73ce40d3486bd190586692

Download Submit
C:\Windows\System\ezKgqmx.exe

Filesize
2.0MB

MD5
4beefb0381a09e220edad684f34af0dc

SHA1
93db0096a27d78a3238ecbdf38df90117590c3cf

SHA256
7e3e6072d0b973b48550f7433e4a4573f01a666473b7184cf059c95861434c15

SHA512
625b51837c8b0eb1fdbcbf8f0a1fc01afd814e2276426caf77cfb0503db3ea572e72419a0368b4640131f2471bd6de8dc3d9d32c0408703f09234165b218a6d0

Download Submit
C:\Windows\System\fLuaBUM.exe

Filesize
2.0MB

MD5
ccadc8584f9e220554172039ddea6a2b

SHA1
38c6c98c15f6dd14a59c202c570bbd355afa695e

SHA256
1a930e519c2ba19817771ecd0f8ffd789aaa705175fd8ea3678b42665d4b0759

SHA512
0c2e7ef73ab601ca6ef895c14c121d56a087d018536e7e7435911a25fc6c725d7d6eea03c6aa2b98500450c5625eff359167d6d2162cf84014ddf32660d58350

Download Submit
C:\Windows\System\gCyXuzL.exe

Filesize
2.0MB

MD5
69617f53254a8b4003b71e496e5d9afd

SHA1
224adf8f0ef91c30e5bfdbe3faa6f052a7443fa5

SHA256
082b44cc6a387c7618b07fad302c8c24d689f60ca4107e2905425d4ab89ce88b

SHA512
b115ce5529c4940fd26013e0aba54d28ea526ed69839544314e8c2a13645a57e5e4597a9007ac4c599c9e0ca0dab6bdfcb8a1cb7fe6eac614d3587d2cfd0cdae

Download Submit
C:\Windows\System\iiRupxR.exe

Filesize
2.0MB

MD5
10a2181456c861567744ce422f73c311

SHA1
554b6ec20850630cd8cdbd10fb6d6c25c4ffdbd1

SHA256
8f2527a4006ab3dc5c0607d403cd922be4473ef238e854cc8b2ee13092d325ab

SHA512
fca19b541b3494f884f9bfa216044dba732a7c823456e583f4755fcda0acd5a9529e7b81c7c651632579f652671748cccd0dba7bc2061b73195d7be3a902058b

Download Submit
C:\Windows\System\jmXmDef.exe

Filesize
2.0MB

MD5
fa3cef150f5c4ab3491f15c9869a3d00

SHA1
111f2c6d518a9db735e779d98eef9dbd68d01b48

SHA256
8334e20cb0e0d79ed908d90dedf678bd88935e7a47698ea7ffa79ad8bec9da8d

SHA512
375fa305768e74502bf1dcf4813cde65f068616a50d3e3bb78a2e3825c1dcac5a0aa168eafaf150a464fb05b93fa67db46a5e4ad1231fec8c0376cebf64149e0

Download Submit
C:\Windows\System\mKtKkfs.exe

Filesize
2.0MB

MD5
7cfd65600386175be1777074b3f78d2d

SHA1
dc18dcfe031e7a44e30e798f6f88c079eb0f8894

SHA256
4fbea0bad6d140af2dbcaa538483eb6825377fc6903ba24ac41ae80b7269d694

SHA512
2893a367af46f1f824ef12316fef20b09920eddc6c6d0b4c8d60af504611ab10a8c5cb87cc9b83ce23f31f3f5b91c97702e62ca0e150b6d6d177fe28e2e3dc15

Download Submit
C:\Windows\System\pqgcslc.exe

Filesize
2.0MB

MD5
9552c47881780e4befbb280cc408dc98

SHA1
6cab446bc08e30ad12037d7df03554ac8ee9002a

SHA256
d0a9918909816a7ae992a641472697fad03146f6d218454e0172f784134303c8

SHA512
2020138ca5c7fa47435ae22828ed7ef1b2ea87adf38529140b1699c227e3cda3a939082ab910a40ba14499c123c0eece3e28d040d3d16c61f9b27aa37bf5dc73

Download Submit
C:\Windows\System\ruIcEzd.exe

Filesize
2.0MB

MD5
74cf58942a11690bbe4354329f277f2d

SHA1
8f458ae0bee29c3a155ac6ac62e91f776b4d078a

SHA256
be7be63fce2ad7523f6591e83ffb5dcc45a4a6cc5c1bfa8ac2a1f9417f413de0

SHA512
af56b1298a8ceb20f1940008200955a2311abbbeaab187b0319a7c0d8a46635fb957e37c70dc5367662a44b7778979676d1c5dca84755b0ba8964b30070c594a

Download Submit
C:\Windows\System\sojGtJS.exe

Filesize
2.0MB

MD5
64fa44d4e16e760ddeef86ab40e3ca61

SHA1
bbcf160d8deaf8d0f56b1f6b3a009efb3605c05c

SHA256
91eb94619134299c16a4f377ec61de6c3d1f6f06ea6f0ccd27358b28d0358a7d

SHA512
08a8974499bf3ea4eb0031a103672f459307b6d3b3de2bcf377090e7b46c25adb90a9aa42b38c07cc4b397329b1c5d58e7d3100792da1f8e92bb1d446a9fb06e

Download Submit
C:\Windows\System\srRfzgP.exe

Filesize
2.0MB

MD5
ef708c15e54e875fd4a01ef2260ff7fe

SHA1
a59787f1d92565eb73df15787bc8f8f1a7f87833

SHA256
8ee46732867819a65270cba7e4c33c8ee90c52ee554c6e01e8054433d0f83b79

SHA512
136b99774a54191e616f67e33caae39f8e680f436087529b38a0f3ac40b50e6af32ee8004aa67f8d65d492f1de757f40765129fd86d43a8b498748eee69759ed

Download Submit
C:\Windows\System\tOdZHYK.exe

Filesize
2.0MB

MD5
88aaf1d923ad05940e6644e4c982b712

SHA1
e69f4ec429b77e2a444a77a972759d7365929938

SHA256
24675b98f0827858b0b4c0fd625adbc6e42896288e680556f98fb354328d4c1a

SHA512
b6ba5ecb3da919541e57f88deda754674731573520ead1d4d0b7808cb2ddcbea5fe6e5e7c2cdf817b5411f7c38b73f80ad8be1b92961c5c11be1a5e276b8d6fe

Download Submit
C:\Windows\System\ubBQLIN.exe

Filesize
2.0MB

MD5
a22633b7c315ca43ec97b2ea3d212f26

SHA1
74ce6219794e1e5352c292762005cd3ceb7ce6a1

SHA256
43cdc4c7198130320e9c0f583a22fc50b34d15f649c9282d3bbee79b3edc96cd

SHA512
0eccf9a8218fd7eb05ccc0c8f79f3e114938ad4181651037a07fe2d373b6a3345e945b6817c52dc5876070e7f3bb8861b41fb344156f2d6716b5c84efde63f75

Download Submit
C:\Windows\System\vwpfaoX.exe

Filesize
2.0MB

MD5
f1657f4a471cf189e78ba1f970e50ad8

SHA1
1449b928371e203663858eb333700a92a14b088b

SHA256
2197168adffee289c1e3b6959865680e81f0dd55970cc66b99565a73a8ae114e

SHA512
e6dd493987eb37277351a41984765fd81837bd33af75d98d4da135d4e62e165546fc9f95e3a94627d545a3bd43c9b13e219a77b42ec7384dd20db8cd2181eb8a

Download Submit
C:\Windows\System\xMvGQeN.exe

Filesize
2.0MB

MD5
132b4a69222fb6d90e55d1ac6481dd55

SHA1
e0845eae92f4c8d809ffd50c7db242ebf0a98a25

SHA256
359739ad8fa5bcd6880433bcc72ba6bef1a9212538374c28d2c3b05e1afb6529

SHA512
091d95a4fbb707619c985b361fb311c8f79cfc78c08f9562ddcddde793fe948a9772fad12a364aac5b9c25affaac31c73d87edc9da842790d8568bde2b6cbf99

Download Submit
memory/216-535-0x00007FF6969A0000-0x00007FF696D92000-memory.dmp

Filesize
3.9MB

Download
memory/560-539-0x00007FF6FCF30000-0x00007FF6FD322000-memory.dmp

Filesize
3.9MB

Download
memory/980-538-0x00007FF68BCF0000-0x00007FF68C0E2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-281-0x00007FF742D20000-0x00007FF743112000-memory.dmp

Filesize
3.9MB

Download
memory/1044-34-0x00007FF71DA50000-0x00007FF71DE42000-memory.dmp

Filesize
3.9MB

Download
memory/1044-2692-0x00007FF71DA50000-0x00007FF71DE42000-memory.dmp

Filesize
3.9MB

Download
memory/1708-540-0x00007FF7E2F50000-0x00007FF7E3342000-memory.dmp

Filesize
3.9MB

Download
memory/2192-529-0x00007FF6EC920000-0x00007FF6ECD12000-memory.dmp

Filesize
3.9MB

Download
memory/2500-536-0x00007FF7B4890000-0x00007FF7B4C82000-memory.dmp

Filesize
3.9MB

Download
memory/2536-534-0x00007FF7115B0000-0x00007FF7119A2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-491-0x00007FF661910000-0x00007FF661D02000-memory.dmp

Filesize
3.9MB

Download
memory/2900-1-0x0000026A6D8A0000-0x0000026A6D8B0000-memory.dmp

Filesize
64KB

Download
memory/2900-2687-0x00007FF7D2080000-0x00007FF7D2472000-memory.dmp

Filesize
3.9MB

Download
memory/2900-0-0x00007FF7D2080000-0x00007FF7D2472000-memory.dmp

Filesize
3.9MB

Download
memory/3068-770-0x00007FF7CE800000-0x00007FF7CEBF2000-memory.dmp

Filesize
3.9MB

Download
memory/3240-100-0x00007FFA10840000-0x00007FFA11301000-memory.dmp

Filesize
10.8MB

Download
memory/3240-2552-0x00007FFA10840000-0x00007FFA11301000-memory.dmp

Filesize
10.8MB

Download
memory/3240-300-0x0000020BB63F0000-0x0000020BB6412000-memory.dmp

Filesize
136KB

Download
memory/3240-223-0x00007FFA10840000-0x00007FFA11301000-memory.dmp

Filesize
10.8MB

Download
memory/3240-22-0x00007FFA10843000-0x00007FFA10845000-memory.dmp

Filesize
8KB

Download
memory/3264-525-0x00007FF741310000-0x00007FF741702000-memory.dmp

Filesize
3.9MB

Download
memory/3316-541-0x00007FF788150000-0x00007FF788542000-memory.dmp

Filesize
3.9MB

Download
memory/3528-537-0x00007FF7DD1C0000-0x00007FF7DD5B2000-memory.dmp

Filesize
3.9MB

Download
memory/3688-524-0x00007FF631CA0000-0x00007FF632092000-memory.dmp

Filesize
3.9MB

Download
memory/3768-533-0x00007FF7C6940000-0x00007FF7C6D32000-memory.dmp

Filesize
3.9MB

Download
memory/3880-531-0x00007FF7A9080000-0x00007FF7A9472000-memory.dmp

Filesize
3.9MB

Download
memory/4000-532-0x00007FF6397A0000-0x00007FF639B92000-memory.dmp

Filesize
3.9MB

Download
memory/4028-341-0x00007FF7F10C0000-0x00007FF7F14B2000-memory.dmp

Filesize
3.9MB

Download
memory/4276-18-0x00007FF77F280000-0x00007FF77F672000-memory.dmp

Filesize
3.9MB

Download
memory/4544-397-0x00007FF7507F0000-0x00007FF750BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4724-528-0x00007FF6DFE40000-0x00007FF6E0232000-memory.dmp

Filesize
3.9MB

Download
memory/4936-530-0x00007FF7FC450000-0x00007FF7FC842000-memory.dmp

Filesize
3.9MB

Download
memory/4964-702-0x00007FF6E79B0000-0x00007FF6E7DA2000-memory.dmp

Filesize
3.9MB

Download