xmrig | 3e825483c73471f4c51e85c5e69cf018281d10fdee275637116d20f50a03abbc

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
Size

1.9MB
MD5

f6a2f8ca9a76933e54bc45598ea3e4c0
SHA1

6daf24adedb0a014403a3854dc29e78b361ca61d
SHA256

3e825483c73471f4c51e85c5e69cf018281d10fdee275637116d20f50a03abbc
SHA512

1b67a4414844ae2989bdef9857894be0dbed7ea0ccc21e944ccce666fa4150bc99e29485e5b5a58e1f2895d42ed0b5c4c577d5d20baceae954a10315c0cb73fb
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+7RrTFl6hvVju:Lz071uv4BPMkyW10/w16BvZX71Fq8+A

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 13256 created 2328	13256	WerFaultSecure.exe	80

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/1488-22-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp	xmrig
behavioral2/memory/3584-80-0x00007FF64EAC0000-0x00007FF64EEB2000-memory.dmp	xmrig
behavioral2/memory/1764-92-0x00007FF6F0440000-0x00007FF6F0832000-memory.dmp	xmrig
behavioral2/memory/1488-142-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp	xmrig
behavioral2/memory/2780-166-0x00007FF6D2520000-0x00007FF6D2912000-memory.dmp	xmrig
behavioral2/memory/552-160-0x00007FF69B3B0000-0x00007FF69B7A2000-memory.dmp	xmrig
behavioral2/memory/3440-159-0x00007FF640ED0000-0x00007FF6412C2000-memory.dmp	xmrig
behavioral2/memory/716-134-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp	xmrig
behavioral2/memory/1656-124-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp	xmrig
behavioral2/memory/3996-123-0x00007FF689500000-0x00007FF6898F2000-memory.dmp	xmrig
behavioral2/memory/3024-93-0x00007FF63DFA0000-0x00007FF63E392000-memory.dmp	xmrig
behavioral2/memory/780-91-0x00007FF68A570000-0x00007FF68A962000-memory.dmp	xmrig
behavioral2/memory/2760-88-0x00007FF6F1060000-0x00007FF6F1452000-memory.dmp	xmrig
behavioral2/memory/3120-87-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp	xmrig
behavioral2/memory/1544-86-0x00007FF7D5360000-0x00007FF7D5752000-memory.dmp	xmrig
behavioral2/memory/3168-84-0x00007FF7D20C0000-0x00007FF7D24B2000-memory.dmp	xmrig
behavioral2/memory/4904-83-0x00007FF7ED440000-0x00007FF7ED832000-memory.dmp	xmrig
behavioral2/memory/2928-59-0x00007FF7B5560000-0x00007FF7B5952000-memory.dmp	xmrig
behavioral2/memory/4860-798-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp	xmrig
behavioral2/memory/4584-945-0x00007FF7E9C00000-0x00007FF7E9FF2000-memory.dmp	xmrig
behavioral2/memory/4596-1077-0x00007FF641970000-0x00007FF641D62000-memory.dmp	xmrig
behavioral2/memory/4428-1205-0x00007FF7886D0000-0x00007FF788AC2000-memory.dmp	xmrig
behavioral2/memory/4664-1328-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp	xmrig
behavioral2/memory/4320-1454-0x00007FF768300000-0x00007FF7686F2000-memory.dmp	xmrig
behavioral2/memory/1200-1451-0x00007FF7F9560000-0x00007FF7F9952000-memory.dmp	xmrig
behavioral2/memory/3176-1710-0x00007FF6A8B20000-0x00007FF6A8F12000-memory.dmp	xmrig
behavioral2/memory/1656-3177-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp	xmrig
behavioral2/memory/1488-3179-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp	xmrig
behavioral2/memory/716-3181-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp	xmrig
behavioral2/memory/2928-3183-0x00007FF7B5560000-0x00007FF7B5952000-memory.dmp	xmrig
behavioral2/memory/3120-3185-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp	xmrig
behavioral2/memory/1544-3187-0x00007FF7D5360000-0x00007FF7D5752000-memory.dmp	xmrig
behavioral2/memory/4904-3197-0x00007FF7ED440000-0x00007FF7ED832000-memory.dmp	xmrig
behavioral2/memory/3168-3215-0x00007FF7D20C0000-0x00007FF7D24B2000-memory.dmp	xmrig
behavioral2/memory/1764-3214-0x00007FF6F0440000-0x00007FF6F0832000-memory.dmp	xmrig
behavioral2/memory/780-3212-0x00007FF68A570000-0x00007FF68A962000-memory.dmp	xmrig
behavioral2/memory/2760-3209-0x00007FF6F1060000-0x00007FF6F1452000-memory.dmp	xmrig
behavioral2/memory/3584-3208-0x00007FF64EAC0000-0x00007FF64EEB2000-memory.dmp	xmrig
behavioral2/memory/4860-3219-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp	xmrig
behavioral2/memory/3024-3218-0x00007FF63DFA0000-0x00007FF63E392000-memory.dmp	xmrig
behavioral2/memory/4596-3247-0x00007FF641970000-0x00007FF641D62000-memory.dmp	xmrig
behavioral2/memory/4320-3254-0x00007FF768300000-0x00007FF7686F2000-memory.dmp	xmrig
behavioral2/memory/3440-3259-0x00007FF640ED0000-0x00007FF6412C2000-memory.dmp	xmrig
behavioral2/memory/2780-3264-0x00007FF6D2520000-0x00007FF6D2912000-memory.dmp	xmrig
behavioral2/memory/3176-3261-0x00007FF6A8B20000-0x00007FF6A8F12000-memory.dmp	xmrig
behavioral2/memory/1200-3258-0x00007FF7F9560000-0x00007FF7F9952000-memory.dmp	xmrig
behavioral2/memory/552-3257-0x00007FF69B3B0000-0x00007FF69B7A2000-memory.dmp	xmrig
behavioral2/memory/4428-3244-0x00007FF7886D0000-0x00007FF788AC2000-memory.dmp	xmrig
behavioral2/memory/4664-3239-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	3124	powershell.exe
12	3124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3124	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1656	uxggaYk.exe
716	NfaloPJ.exe
1488	fweYTWb.exe
1544	WvmDyxl.exe
3120	DsyZLvU.exe
2928	zhUmJKt.exe
2760	eROGOni.exe
3584	vLunOLk.exe
4904	mQKaxPh.exe
780	iiDFtGw.exe
1764	RmaPvfA.exe
3168	MFWomkI.exe
3024	KAWFKZQ.exe
4860	TiFKMUJ.exe
4584	WPfFVUF.exe
4596	CLskCRN.exe
4428	EijTMdC.exe
4664	MtHEAau.exe
1200	vRzsUqM.exe
4320	TbKbrQp.exe
3440	nLWNYgm.exe
552	PbUKxKd.exe
2780	ylMjjZA.exe
3176	OWDjtdT.exe
828	NzYVqdR.exe
4424	kefprAN.exe
4792	ZBKqUBm.exe
3952	lustCCr.exe
3728	OwKmrTQ.exe
3280	lJVuyMF.exe
3824	DkZFEwC.exe
2364	FOMPENb.exe
3992	FelbrTz.exe
4484	rZESALL.exe
496	cinrEff.exe
1424	TCszcKc.exe
4672	KmCfLvU.exe
4732	nctpcTc.exe
2292	sSkDfLt.exe
4896	gvyyGAo.exe
4996	SFUcqxx.exe
4580	AsBuics.exe
4248	dnQzHpW.exe
4148	pceZmes.exe
5088	PXydAXB.exe
4576	ZjXZGKc.exe
2104	TOYDUqC.exe
452	vQKmugV.exe
4552	rUOHbpi.exe
4152	EBtIYYj.exe
2456	zNaaFeY.exe
4252	SMncwPd.exe
4744	QASkLvV.exe
2572	NvehtUM.exe
3092	SuUjPkk.exe
4968	Wvctkcg.exe
2052	JFRsoGM.exe
1708	bmcpKsK.exe
5140	NRLxiZW.exe
5188	qeXefhu.exe
5216	VsidxPJ.exe
5236	EQMQjSk.exe
5252	NYDPKHP.exe
5280	vJSBXje.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3996-0-0x00007FF689500000-0x00007FF6898F2000-memory.dmp	upx
behavioral2/files/0x000700000002345e-7.dat	upx
behavioral2/files/0x00090000000233fd-10.dat	upx
behavioral2/files/0x000700000002345f-21.dat	upx
behavioral2/files/0x0007000000023461-31.dat	upx
behavioral2/files/0x0007000000023460-33.dat	upx
behavioral2/files/0x0007000000023464-46.dat	upx
behavioral2/files/0x0007000000023463-45.dat	upx
behavioral2/files/0x0007000000023462-44.dat	upx
behavioral2/memory/1488-22-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp	upx
behavioral2/files/0x000700000002345d-20.dat	upx
behavioral2/memory/716-18-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp	upx
behavioral2/memory/1656-11-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp	upx
behavioral2/files/0x0007000000023465-51.dat	upx
behavioral2/files/0x0007000000023466-62.dat	upx
behavioral2/memory/3584-80-0x00007FF64EAC0000-0x00007FF64EEB2000-memory.dmp	upx
behavioral2/files/0x0007000000023468-85.dat	upx
behavioral2/memory/1764-92-0x00007FF6F0440000-0x00007FF6F0832000-memory.dmp	upx
behavioral2/memory/4860-97-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp	upx
behavioral2/memory/4596-111-0x00007FF641970000-0x00007FF641D62000-memory.dmp	upx
behavioral2/files/0x000700000002346d-118.dat	upx
behavioral2/files/0x000700000002346e-125.dat	upx
behavioral2/memory/1488-142-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp	upx
behavioral2/files/0x0007000000023472-151.dat	upx
behavioral2/files/0x0007000000023474-163.dat	upx
behavioral2/files/0x000700000002347b-200.dat	upx
behavioral2/files/0x000700000002347c-205.dat	upx
behavioral2/files/0x000700000002347a-203.dat	upx
behavioral2/files/0x0007000000023479-198.dat	upx
behavioral2/files/0x0007000000023478-193.dat	upx
behavioral2/files/0x0007000000023477-188.dat	upx
behavioral2/files/0x0007000000023476-183.dat	upx
behavioral2/files/0x0007000000023475-178.dat	upx
behavioral2/memory/3176-172-0x00007FF6A8B20000-0x00007FF6A8F12000-memory.dmp	upx
behavioral2/files/0x0007000000023473-167.dat	upx
behavioral2/memory/2780-166-0x00007FF6D2520000-0x00007FF6D2912000-memory.dmp	upx
behavioral2/memory/552-160-0x00007FF69B3B0000-0x00007FF69B7A2000-memory.dmp	upx
behavioral2/memory/3440-159-0x00007FF640ED0000-0x00007FF6412C2000-memory.dmp	upx
behavioral2/files/0x0007000000023471-154.dat	upx
behavioral2/files/0x0007000000023470-149.dat	upx
behavioral2/files/0x000700000002346f-143.dat	upx
behavioral2/memory/4320-141-0x00007FF768300000-0x00007FF7686F2000-memory.dmp	upx
behavioral2/memory/1200-135-0x00007FF7F9560000-0x00007FF7F9952000-memory.dmp	upx
behavioral2/memory/716-134-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp	upx
behavioral2/memory/4664-128-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp	upx
behavioral2/memory/1656-124-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp	upx
behavioral2/memory/3996-123-0x00007FF689500000-0x00007FF6898F2000-memory.dmp	upx
behavioral2/files/0x000700000002346c-121.dat	upx
behavioral2/memory/4428-117-0x00007FF7886D0000-0x00007FF788AC2000-memory.dmp	upx
behavioral2/files/0x000700000002346b-115.dat	upx
behavioral2/files/0x0008000000023469-109.dat	upx
behavioral2/memory/4584-105-0x00007FF7E9C00000-0x00007FF7E9FF2000-memory.dmp	upx
behavioral2/files/0x000800000002346a-100.dat	upx
behavioral2/memory/3024-93-0x00007FF63DFA0000-0x00007FF63E392000-memory.dmp	upx
behavioral2/memory/780-91-0x00007FF68A570000-0x00007FF68A962000-memory.dmp	upx
behavioral2/memory/2760-88-0x00007FF6F1060000-0x00007FF6F1452000-memory.dmp	upx
behavioral2/memory/3120-87-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp	upx
behavioral2/memory/1544-86-0x00007FF7D5360000-0x00007FF7D5752000-memory.dmp	upx
behavioral2/memory/3168-84-0x00007FF7D20C0000-0x00007FF7D24B2000-memory.dmp	upx
behavioral2/memory/4904-83-0x00007FF7ED440000-0x00007FF7ED832000-memory.dmp	upx
behavioral2/files/0x0007000000023467-68.dat	upx
behavioral2/memory/2928-59-0x00007FF7B5560000-0x00007FF7B5952000-memory.dmp	upx
behavioral2/memory/4860-798-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp	upx
behavioral2/memory/4584-945-0x00007FF7E9C00000-0x00007FF7E9FF2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rovEUQN.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\qnUbhiB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\JpMRSHU.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\sUtYhIT.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ErQUVQq.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\xIcNROB.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\xUAeFWw.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\WdwAubK.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\elARPvr.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\LcJbACv.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\gjAdgVE.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\PDfGbQl.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\pxBLKGD.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\grXhgYr.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ApepRyI.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\XPVtiBk.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\WFLKbkm.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\JOjPUpe.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\aDXNaHW.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\YLYDYVJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\IzSFeCA.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\RzrXERJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\mbRBOwL.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\nsVghPI.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\vDjuGgZ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\YwSgKvJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\LkTVxkJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\AfPewvX.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\gRkgBvv.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\qGJcJdA.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\vKExoQM.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\jhtmGKV.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\LQbsfIH.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\rkeVeGg.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\hIZkuEQ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\aXmyyzh.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\YsYbLFg.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\bYUIWCM.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\azBKOxZ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\kEbCJGz.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\EwPbuOX.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\XcvYtAY.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\qAPzsWD.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\vRzmEhr.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\cPBhyhR.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\TcmuupU.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\vpaMINk.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ZRSkxtA.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\pmbMZzO.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ZnAGCWw.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\HSGpXzt.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\khvjSHg.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\OMJGzsp.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\JibZSxJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\IcnsDFo.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\WixSHsz.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\oAWjuhJ.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\KWmePAb.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\SgtnEUk.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\zwjTDcL.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\mZoYjHY.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\aYaXIzh.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\ByWuCVp.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
File created	C:\Windows\System\BIeVTHu.exe	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3124	powershell.exe
3124	powershell.exe
3124	powershell.exe
14316	WerFaultSecure.exe
14316	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
Token: SeLockMemoryPrivilege	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
Token: SeDebugPrivilege	3124	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 3124	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	85
PID 3996 wrote to memory of 3124	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	85
PID 3996 wrote to memory of 1656	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	86
PID 3996 wrote to memory of 1656	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	86
PID 3996 wrote to memory of 716	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	87
PID 3996 wrote to memory of 716	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	87
PID 3996 wrote to memory of 1488	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	88
PID 3996 wrote to memory of 1488	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	88
PID 3996 wrote to memory of 1544	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	89
PID 3996 wrote to memory of 1544	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	89
PID 3996 wrote to memory of 3120	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	90
PID 3996 wrote to memory of 3120	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	90
PID 3996 wrote to memory of 2928	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	91
PID 3996 wrote to memory of 2928	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	91
PID 3996 wrote to memory of 2760	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	92
PID 3996 wrote to memory of 2760	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	92
PID 3996 wrote to memory of 3584	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	93
PID 3996 wrote to memory of 3584	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	93
PID 3996 wrote to memory of 4904	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	94
PID 3996 wrote to memory of 4904	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	94
PID 3996 wrote to memory of 780	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	95
PID 3996 wrote to memory of 780	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	95
PID 3996 wrote to memory of 1764	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	96
PID 3996 wrote to memory of 1764	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	96
PID 3996 wrote to memory of 3168	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	97
PID 3996 wrote to memory of 3168	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	97
PID 3996 wrote to memory of 3024	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	98
PID 3996 wrote to memory of 3024	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	98
PID 3996 wrote to memory of 4860	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	99
PID 3996 wrote to memory of 4860	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	99
PID 3996 wrote to memory of 4584	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	100
PID 3996 wrote to memory of 4584	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	100
PID 3996 wrote to memory of 4596	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	101
PID 3996 wrote to memory of 4596	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	101
PID 3996 wrote to memory of 4428	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	102
PID 3996 wrote to memory of 4428	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	102
PID 3996 wrote to memory of 4664	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	103
PID 3996 wrote to memory of 4664	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	103
PID 3996 wrote to memory of 1200	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	104
PID 3996 wrote to memory of 1200	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	104
PID 3996 wrote to memory of 4320	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	105
PID 3996 wrote to memory of 4320	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	105
PID 3996 wrote to memory of 3440	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	106
PID 3996 wrote to memory of 3440	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	106
PID 3996 wrote to memory of 552	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	107
PID 3996 wrote to memory of 552	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	107
PID 3996 wrote to memory of 2780	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	108
PID 3996 wrote to memory of 2780	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	108
PID 3996 wrote to memory of 3176	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	109
PID 3996 wrote to memory of 3176	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	109
PID 3996 wrote to memory of 828	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	110
PID 3996 wrote to memory of 828	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	110
PID 3996 wrote to memory of 4424	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	111
PID 3996 wrote to memory of 4424	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	111
PID 3996 wrote to memory of 4792	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	112
PID 3996 wrote to memory of 4792	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	112
PID 3996 wrote to memory of 3952	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	113
PID 3996 wrote to memory of 3952	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	113
PID 3996 wrote to memory of 3728	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	114
PID 3996 wrote to memory of 3728	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	114
PID 3996 wrote to memory of 3280	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	115
PID 3996 wrote to memory of 3280	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	115
PID 3996 wrote to memory of 3824	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	116
PID 3996 wrote to memory of 3824	3996	f6a2f8ca9a76933e54bc45598ea3e4c0N.exe	116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:2328
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 2328 -s 1724
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:14316

C:\Users\Admin\AppData\Local\Temp\f6a2f8ca9a76933e54bc45598ea3e4c0N.exe
"C:\Users\Admin\AppData\Local\Temp\f6a2f8ca9a76933e54bc45598ea3e4c0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3124" "2976" "2908" "2980" "0" "0" "2984" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:14224
- C:\Windows\System\uxggaYk.exe
  C:\Windows\System\uxggaYk.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\NfaloPJ.exe
  C:\Windows\System\NfaloPJ.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\fweYTWb.exe
  C:\Windows\System\fweYTWb.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\WvmDyxl.exe
  C:\Windows\System\WvmDyxl.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DsyZLvU.exe
  C:\Windows\System\DsyZLvU.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\zhUmJKt.exe
  C:\Windows\System\zhUmJKt.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\eROGOni.exe
  C:\Windows\System\eROGOni.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vLunOLk.exe
  C:\Windows\System\vLunOLk.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\mQKaxPh.exe
  C:\Windows\System\mQKaxPh.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\iiDFtGw.exe
  C:\Windows\System\iiDFtGw.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\RmaPvfA.exe
  C:\Windows\System\RmaPvfA.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\MFWomkI.exe
  C:\Windows\System\MFWomkI.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\KAWFKZQ.exe
  C:\Windows\System\KAWFKZQ.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\TiFKMUJ.exe
  C:\Windows\System\TiFKMUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\WPfFVUF.exe
  C:\Windows\System\WPfFVUF.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\CLskCRN.exe
  C:\Windows\System\CLskCRN.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\EijTMdC.exe
  C:\Windows\System\EijTMdC.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\MtHEAau.exe
  C:\Windows\System\MtHEAau.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\vRzsUqM.exe
  C:\Windows\System\vRzsUqM.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\TbKbrQp.exe
  C:\Windows\System\TbKbrQp.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\nLWNYgm.exe
  C:\Windows\System\nLWNYgm.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\PbUKxKd.exe
  C:\Windows\System\PbUKxKd.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\ylMjjZA.exe
  C:\Windows\System\ylMjjZA.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\OWDjtdT.exe
  C:\Windows\System\OWDjtdT.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\NzYVqdR.exe
  C:\Windows\System\NzYVqdR.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\kefprAN.exe
  C:\Windows\System\kefprAN.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ZBKqUBm.exe
  C:\Windows\System\ZBKqUBm.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\lustCCr.exe
  C:\Windows\System\lustCCr.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\OwKmrTQ.exe
  C:\Windows\System\OwKmrTQ.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\lJVuyMF.exe
  C:\Windows\System\lJVuyMF.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\DkZFEwC.exe
  C:\Windows\System\DkZFEwC.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\FOMPENb.exe
  C:\Windows\System\FOMPENb.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\FelbrTz.exe
  C:\Windows\System\FelbrTz.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\rZESALL.exe
  C:\Windows\System\rZESALL.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\cinrEff.exe
  C:\Windows\System\cinrEff.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\TCszcKc.exe
  C:\Windows\System\TCszcKc.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\KmCfLvU.exe
  C:\Windows\System\KmCfLvU.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\nctpcTc.exe
  C:\Windows\System\nctpcTc.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\sSkDfLt.exe
  C:\Windows\System\sSkDfLt.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\gvyyGAo.exe
  C:\Windows\System\gvyyGAo.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\SFUcqxx.exe
  C:\Windows\System\SFUcqxx.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\AsBuics.exe
  C:\Windows\System\AsBuics.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\dnQzHpW.exe
  C:\Windows\System\dnQzHpW.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\pceZmes.exe
  C:\Windows\System\pceZmes.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\PXydAXB.exe
  C:\Windows\System\PXydAXB.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\ZjXZGKc.exe
  C:\Windows\System\ZjXZGKc.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\TOYDUqC.exe
  C:\Windows\System\TOYDUqC.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\vQKmugV.exe
  C:\Windows\System\vQKmugV.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\rUOHbpi.exe
  C:\Windows\System\rUOHbpi.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\EBtIYYj.exe
  C:\Windows\System\EBtIYYj.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\zNaaFeY.exe
  C:\Windows\System\zNaaFeY.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\SMncwPd.exe
  C:\Windows\System\SMncwPd.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\QASkLvV.exe
  C:\Windows\System\QASkLvV.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\NvehtUM.exe
  C:\Windows\System\NvehtUM.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SuUjPkk.exe
  C:\Windows\System\SuUjPkk.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\Wvctkcg.exe
  C:\Windows\System\Wvctkcg.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\JFRsoGM.exe
  C:\Windows\System\JFRsoGM.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\bmcpKsK.exe
  C:\Windows\System\bmcpKsK.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\NRLxiZW.exe
  C:\Windows\System\NRLxiZW.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\qeXefhu.exe
  C:\Windows\System\qeXefhu.exe
  2⤵
  - Executes dropped EXE
  PID:5188
- C:\Windows\System\VsidxPJ.exe
  C:\Windows\System\VsidxPJ.exe
  2⤵
  - Executes dropped EXE
  PID:5216
- C:\Windows\System\EQMQjSk.exe
  C:\Windows\System\EQMQjSk.exe
  2⤵
  - Executes dropped EXE
  PID:5236
- C:\Windows\System\NYDPKHP.exe
  C:\Windows\System\NYDPKHP.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\vJSBXje.exe
  C:\Windows\System\vJSBXje.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\PamkdFp.exe
  C:\Windows\System\PamkdFp.exe
  2⤵
  PID:5312
- C:\Windows\System\PDEalrw.exe
  C:\Windows\System\PDEalrw.exe
  2⤵
  PID:5336
- C:\Windows\System\uvOENgb.exe
  C:\Windows\System\uvOENgb.exe
  2⤵
  PID:5360
- C:\Windows\System\fkrhXTx.exe
  C:\Windows\System\fkrhXTx.exe
  2⤵
  PID:5388
- C:\Windows\System\zDcfzyT.exe
  C:\Windows\System\zDcfzyT.exe
  2⤵
  PID:5416
- C:\Windows\System\jRWSgbF.exe
  C:\Windows\System\jRWSgbF.exe
  2⤵
  PID:5444
- C:\Windows\System\wuRNpRN.exe
  C:\Windows\System\wuRNpRN.exe
  2⤵
  PID:5476
- C:\Windows\System\hMmzzPY.exe
  C:\Windows\System\hMmzzPY.exe
  2⤵
  PID:5504
- C:\Windows\System\GSOBZFr.exe
  C:\Windows\System\GSOBZFr.exe
  2⤵
  PID:5532
- C:\Windows\System\BXqDoLc.exe
  C:\Windows\System\BXqDoLc.exe
  2⤵
  PID:5560
- C:\Windows\System\QvDVbTT.exe
  C:\Windows\System\QvDVbTT.exe
  2⤵
  PID:5588
- C:\Windows\System\tgIyUJV.exe
  C:\Windows\System\tgIyUJV.exe
  2⤵
  PID:5616
- C:\Windows\System\BZoPWaC.exe
  C:\Windows\System\BZoPWaC.exe
  2⤵
  PID:5644
- C:\Windows\System\aXYfrlt.exe
  C:\Windows\System\aXYfrlt.exe
  2⤵
  PID:5672
- C:\Windows\System\WWOpbNP.exe
  C:\Windows\System\WWOpbNP.exe
  2⤵
  PID:5708
- C:\Windows\System\iBjYeFX.exe
  C:\Windows\System\iBjYeFX.exe
  2⤵
  PID:5736
- C:\Windows\System\UziKaua.exe
  C:\Windows\System\UziKaua.exe
  2⤵
  PID:5764
- C:\Windows\System\IjzkWfv.exe
  C:\Windows\System\IjzkWfv.exe
  2⤵
  PID:5784
- C:\Windows\System\fmwlRXz.exe
  C:\Windows\System\fmwlRXz.exe
  2⤵
  PID:5808
- C:\Windows\System\GSOGMAG.exe
  C:\Windows\System\GSOGMAG.exe
  2⤵
  PID:5836
- C:\Windows\System\oiJWArt.exe
  C:\Windows\System\oiJWArt.exe
  2⤵
  PID:5864
- C:\Windows\System\gwKtSMs.exe
  C:\Windows\System\gwKtSMs.exe
  2⤵
  PID:5892
- C:\Windows\System\dytDmEi.exe
  C:\Windows\System\dytDmEi.exe
  2⤵
  PID:5920
- C:\Windows\System\iIXSfWx.exe
  C:\Windows\System\iIXSfWx.exe
  2⤵
  PID:5948
- C:\Windows\System\qVtUKhk.exe
  C:\Windows\System\qVtUKhk.exe
  2⤵
  PID:5976
- C:\Windows\System\WVVHYvT.exe
  C:\Windows\System\WVVHYvT.exe
  2⤵
  PID:6004
- C:\Windows\System\DciQhTo.exe
  C:\Windows\System\DciQhTo.exe
  2⤵
  PID:6032
- C:\Windows\System\LOfnfgA.exe
  C:\Windows\System\LOfnfgA.exe
  2⤵
  PID:6060
- C:\Windows\System\LiCMktE.exe
  C:\Windows\System\LiCMktE.exe
  2⤵
  PID:6088
- C:\Windows\System\pOhrIfp.exe
  C:\Windows\System\pOhrIfp.exe
  2⤵
  PID:6116
- C:\Windows\System\arAUxJe.exe
  C:\Windows\System\arAUxJe.exe
  2⤵
  PID:2168
- C:\Windows\System\yOFBBNZ.exe
  C:\Windows\System\yOFBBNZ.exe
  2⤵
  PID:432
- C:\Windows\System\QhyQZbY.exe
  C:\Windows\System\QhyQZbY.exe
  2⤵
  PID:1452
- C:\Windows\System\UJJVFLG.exe
  C:\Windows\System\UJJVFLG.exe
  2⤵
  PID:4800
- C:\Windows\System\tYbEpcD.exe
  C:\Windows\System\tYbEpcD.exe
  2⤵
  PID:4184
- C:\Windows\System\TlYxEIc.exe
  C:\Windows\System\TlYxEIc.exe
  2⤵
  PID:940
- C:\Windows\System\rjGchAe.exe
  C:\Windows\System\rjGchAe.exe
  2⤵
  PID:5172
- C:\Windows\System\yGhuCDw.exe
  C:\Windows\System\yGhuCDw.exe
  2⤵
  PID:5232
- C:\Windows\System\qvdgDCZ.exe
  C:\Windows\System\qvdgDCZ.exe
  2⤵
  PID:5296
- C:\Windows\System\NKmzyot.exe
  C:\Windows\System\NKmzyot.exe
  2⤵
  PID:5352
- C:\Windows\System\yuoRrUV.exe
  C:\Windows\System\yuoRrUV.exe
  2⤵
  PID:5412
- C:\Windows\System\ojdvmDy.exe
  C:\Windows\System\ojdvmDy.exe
  2⤵
  PID:5488
- C:\Windows\System\NpaMdDw.exe
  C:\Windows\System\NpaMdDw.exe
  2⤵
  PID:5524
- C:\Windows\System\aCpVBHq.exe
  C:\Windows\System\aCpVBHq.exe
  2⤵
  PID:5600
- C:\Windows\System\xrfBNwA.exe
  C:\Windows\System\xrfBNwA.exe
  2⤵
  PID:5656
- C:\Windows\System\MnCVikl.exe
  C:\Windows\System\MnCVikl.exe
  2⤵
  PID:4488
- C:\Windows\System\ZzWHdGf.exe
  C:\Windows\System\ZzWHdGf.exe
  2⤵
  PID:5760
- C:\Windows\System\cefxYzi.exe
  C:\Windows\System\cefxYzi.exe
  2⤵
  PID:5828
- C:\Windows\System\eGfTQFZ.exe
  C:\Windows\System\eGfTQFZ.exe
  2⤵
  PID:5888
- C:\Windows\System\nJxaSlg.exe
  C:\Windows\System\nJxaSlg.exe
  2⤵
  PID:5936
- C:\Windows\System\FVyRGac.exe
  C:\Windows\System\FVyRGac.exe
  2⤵
  PID:5996
- C:\Windows\System\MNdYMHy.exe
  C:\Windows\System\MNdYMHy.exe
  2⤵
  PID:6056
- C:\Windows\System\uIzLtgL.exe
  C:\Windows\System\uIzLtgL.exe
  2⤵
  PID:6132
- C:\Windows\System\TFjRKJr.exe
  C:\Windows\System\TFjRKJr.exe
  2⤵
  PID:2336
- C:\Windows\System\BSixrNA.exe
  C:\Windows\System\BSixrNA.exe
  2⤵
  PID:2668
- C:\Windows\System\psHmisG.exe
  C:\Windows\System\psHmisG.exe
  2⤵
  PID:1384
- C:\Windows\System\uALVEKM.exe
  C:\Windows\System\uALVEKM.exe
  2⤵
  PID:5228
- C:\Windows\System\yucTNNe.exe
  C:\Windows\System\yucTNNe.exe
  2⤵
  PID:5404
- C:\Windows\System\EQdflNr.exe
  C:\Windows\System\EQdflNr.exe
  2⤵
  PID:5520
- C:\Windows\System\UCQXFUk.exe
  C:\Windows\System\UCQXFUk.exe
  2⤵
  PID:5636
- C:\Windows\System\yZlZyoZ.exe
  C:\Windows\System\yZlZyoZ.exe
  2⤵
  PID:5756
- C:\Windows\System\UVdomRa.exe
  C:\Windows\System\UVdomRa.exe
  2⤵
  PID:5884
- C:\Windows\System\XFJWNHr.exe
  C:\Windows\System\XFJWNHr.exe
  2⤵
  PID:6028
- C:\Windows\System\yKNzqGj.exe
  C:\Windows\System\yKNzqGj.exe
  2⤵
  PID:4740
- C:\Windows\System\EOFRDYJ.exe
  C:\Windows\System\EOFRDYJ.exe
  2⤵
  PID:4856
- C:\Windows\System\aWIetDN.exe
  C:\Windows\System\aWIetDN.exe
  2⤵
  PID:5348
- C:\Windows\System\aIJSidU.exe
  C:\Windows\System\aIJSidU.exe
  2⤵
  PID:6160
- C:\Windows\System\hIZkuEQ.exe
  C:\Windows\System\hIZkuEQ.exe
  2⤵
  PID:6188
- C:\Windows\System\glkrHVg.exe
  C:\Windows\System\glkrHVg.exe
  2⤵
  PID:6220
- C:\Windows\System\LiYjxCg.exe
  C:\Windows\System\LiYjxCg.exe
  2⤵
  PID:6248
- C:\Windows\System\mtataNT.exe
  C:\Windows\System\mtataNT.exe
  2⤵
  PID:6272
- C:\Windows\System\IyWNweF.exe
  C:\Windows\System\IyWNweF.exe
  2⤵
  PID:6300
- C:\Windows\System\yjzAXwx.exe
  C:\Windows\System\yjzAXwx.exe
  2⤵
  PID:6328
- C:\Windows\System\hOkfaAl.exe
  C:\Windows\System\hOkfaAl.exe
  2⤵
  PID:6356
- C:\Windows\System\JWGtGrE.exe
  C:\Windows\System\JWGtGrE.exe
  2⤵
  PID:6384
- C:\Windows\System\SvclTwA.exe
  C:\Windows\System\SvclTwA.exe
  2⤵
  PID:6416
- C:\Windows\System\TsoBvei.exe
  C:\Windows\System\TsoBvei.exe
  2⤵
  PID:6444
- C:\Windows\System\ZbUhscR.exe
  C:\Windows\System\ZbUhscR.exe
  2⤵
  PID:6468
- C:\Windows\System\SUnhDcv.exe
  C:\Windows\System\SUnhDcv.exe
  2⤵
  PID:6496
- C:\Windows\System\wEBerRG.exe
  C:\Windows\System\wEBerRG.exe
  2⤵
  PID:6524
- C:\Windows\System\pHtXilh.exe
  C:\Windows\System\pHtXilh.exe
  2⤵
  PID:6552
- C:\Windows\System\SJjksYA.exe
  C:\Windows\System\SJjksYA.exe
  2⤵
  PID:6580
- C:\Windows\System\YJrdKXb.exe
  C:\Windows\System\YJrdKXb.exe
  2⤵
  PID:6608
- C:\Windows\System\KUmaALa.exe
  C:\Windows\System\KUmaALa.exe
  2⤵
  PID:6636
- C:\Windows\System\HSsAkqS.exe
  C:\Windows\System\HSsAkqS.exe
  2⤵
  PID:6664
- C:\Windows\System\ksNBtTe.exe
  C:\Windows\System\ksNBtTe.exe
  2⤵
  PID:6692
- C:\Windows\System\EDfDSBw.exe
  C:\Windows\System\EDfDSBw.exe
  2⤵
  PID:6720
- C:\Windows\System\hDtYlaT.exe
  C:\Windows\System\hDtYlaT.exe
  2⤵
  PID:6748
- C:\Windows\System\cgjAwuN.exe
  C:\Windows\System\cgjAwuN.exe
  2⤵
  PID:6776
- C:\Windows\System\uKPcFea.exe
  C:\Windows\System\uKPcFea.exe
  2⤵
  PID:6808
- C:\Windows\System\IZRtPBD.exe
  C:\Windows\System\IZRtPBD.exe
  2⤵
  PID:6836
- C:\Windows\System\tqAiegj.exe
  C:\Windows\System\tqAiegj.exe
  2⤵
  PID:6860
- C:\Windows\System\DpdtSCY.exe
  C:\Windows\System\DpdtSCY.exe
  2⤵
  PID:6888
- C:\Windows\System\FfuylnU.exe
  C:\Windows\System\FfuylnU.exe
  2⤵
  PID:6916
- C:\Windows\System\yxJrHsS.exe
  C:\Windows\System\yxJrHsS.exe
  2⤵
  PID:6944
- C:\Windows\System\CVWaBRw.exe
  C:\Windows\System\CVWaBRw.exe
  2⤵
  PID:6972
- C:\Windows\System\zffVZIk.exe
  C:\Windows\System\zffVZIk.exe
  2⤵
  PID:7000
- C:\Windows\System\OKNmiOn.exe
  C:\Windows\System\OKNmiOn.exe
  2⤵
  PID:7028
- C:\Windows\System\hLVPvpt.exe
  C:\Windows\System\hLVPvpt.exe
  2⤵
  PID:7056
- C:\Windows\System\GTVAara.exe
  C:\Windows\System\GTVAara.exe
  2⤵
  PID:7088
- C:\Windows\System\OlccLMR.exe
  C:\Windows\System\OlccLMR.exe
  2⤵
  PID:7116
- C:\Windows\System\AkLvGIj.exe
  C:\Windows\System\AkLvGIj.exe
  2⤵
  PID:7140
- C:\Windows\System\kGSKlGZ.exe
  C:\Windows\System\kGSKlGZ.exe
  2⤵
  PID:5580
- C:\Windows\System\zwarrTn.exe
  C:\Windows\System\zwarrTn.exe
  2⤵
  PID:5752
- C:\Windows\System\bDauytU.exe
  C:\Windows\System\bDauytU.exe
  2⤵
  PID:5332
- C:\Windows\System\qDlfLeh.exe
  C:\Windows\System\qDlfLeh.exe
  2⤵
  PID:6268
- C:\Windows\System\fVDoyRQ.exe
  C:\Windows\System\fVDoyRQ.exe
  2⤵
  PID:6316
- C:\Windows\System\XRxCmPj.exe
  C:\Windows\System\XRxCmPj.exe
  2⤵
  PID:1264
- C:\Windows\System\OYjPWAI.exe
  C:\Windows\System\OYjPWAI.exe
  2⤵
  PID:6376
- C:\Windows\System\Xuqdwfa.exe
  C:\Windows\System\Xuqdwfa.exe
  2⤵
  PID:6432
- C:\Windows\System\TLaAMzc.exe
  C:\Windows\System\TLaAMzc.exe
  2⤵
  PID:6488
- C:\Windows\System\fWbffpz.exe
  C:\Windows\System\fWbffpz.exe
  2⤵
  PID:2984
- C:\Windows\System\xQNvjPY.exe
  C:\Windows\System\xQNvjPY.exe
  2⤵
  PID:6596
- C:\Windows\System\wvMavdn.exe
  C:\Windows\System\wvMavdn.exe
  2⤵
  PID:6628
- C:\Windows\System\KzlSHyl.exe
  C:\Windows\System\KzlSHyl.exe
  2⤵
  PID:6660
- C:\Windows\System\JFgozEZ.exe
  C:\Windows\System\JFgozEZ.exe
  2⤵
  PID:6708
- C:\Windows\System\jhvNrlT.exe
  C:\Windows\System\jhvNrlT.exe
  2⤵
  PID:5044
- C:\Windows\System\aLMNsDV.exe
  C:\Windows\System\aLMNsDV.exe
  2⤵
  PID:6740
- C:\Windows\System\knBbUif.exe
  C:\Windows\System\knBbUif.exe
  2⤵
  PID:6768
- C:\Windows\System\eRJhEcl.exe
  C:\Windows\System\eRJhEcl.exe
  2⤵
  PID:6848
- C:\Windows\System\QZuLXEb.exe
  C:\Windows\System\QZuLXEb.exe
  2⤵
  PID:6932
- C:\Windows\System\zMrrcCQ.exe
  C:\Windows\System\zMrrcCQ.exe
  2⤵
  PID:6988
- C:\Windows\System\KZFzJVR.exe
  C:\Windows\System\KZFzJVR.exe
  2⤵
  PID:7076
- C:\Windows\System\edFoSRR.exe
  C:\Windows\System\edFoSRR.exe
  2⤵
  PID:2856
- C:\Windows\System\wPwzotm.exe
  C:\Windows\System\wPwzotm.exe
  2⤵
  PID:7136
- C:\Windows\System\ZSytEGT.exe
  C:\Windows\System\ZSytEGT.exe
  2⤵
  PID:2732
- C:\Windows\System\lVVmjtO.exe
  C:\Windows\System\lVVmjtO.exe
  2⤵
  PID:1716
- C:\Windows\System\uSTnYgx.exe
  C:\Windows\System\uSTnYgx.exe
  2⤵
  PID:2224
- C:\Windows\System\kCtDSQR.exe
  C:\Windows\System\kCtDSQR.exe
  2⤵
  PID:3552
- C:\Windows\System\cGQgOGm.exe
  C:\Windows\System\cGQgOGm.exe
  2⤵
  PID:4144
- C:\Windows\System\xWnnsWS.exe
  C:\Windows\System\xWnnsWS.exe
  2⤵
  PID:6112
- C:\Windows\System\jIMXrdC.exe
  C:\Windows\System\jIMXrdC.exe
  2⤵
  PID:5092
- C:\Windows\System\coQWjbS.exe
  C:\Windows\System\coQWjbS.exe
  2⤵
  PID:6204
- C:\Windows\System\shElomH.exe
  C:\Windows\System\shElomH.exe
  2⤵
  PID:2708
- C:\Windows\System\BBkVVmn.exe
  C:\Windows\System\BBkVVmn.exe
  2⤵
  PID:6292
- C:\Windows\System\qTZOcdD.exe
  C:\Windows\System\qTZOcdD.exe
  2⤵
  PID:6408
- C:\Windows\System\DkNEQGp.exe
  C:\Windows\System\DkNEQGp.exe
  2⤵
  PID:3828
- C:\Windows\System\ILRuRxj.exe
  C:\Windows\System\ILRuRxj.exe
  2⤵
  PID:4776
- C:\Windows\System\JjsYOaK.exe
  C:\Windows\System\JjsYOaK.exe
  2⤵
  PID:1860
- C:\Windows\System\TxpoBET.exe
  C:\Windows\System\TxpoBET.exe
  2⤵
  PID:6764
- C:\Windows\System\aAIVAqW.exe
  C:\Windows\System\aAIVAqW.exe
  2⤵
  PID:4480
- C:\Windows\System\VelAfsb.exe
  C:\Windows\System\VelAfsb.exe
  2⤵
  PID:6824
- C:\Windows\System\KiVatIH.exe
  C:\Windows\System\KiVatIH.exe
  2⤵
  PID:6912
- C:\Windows\System\dQXXrBO.exe
  C:\Windows\System\dQXXrBO.exe
  2⤵
  PID:2612
- C:\Windows\System\WjuAzqz.exe
  C:\Windows\System\WjuAzqz.exe
  2⤵
  PID:7104
- C:\Windows\System\CuxOFUv.exe
  C:\Windows\System\CuxOFUv.exe
  2⤵
  PID:4044
- C:\Windows\System\raaoXXU.exe
  C:\Windows\System\raaoXXU.exe
  2⤵
  PID:376
- C:\Windows\System\KSwyarB.exe
  C:\Windows\System\KSwyarB.exe
  2⤵
  PID:4120
- C:\Windows\System\dhdiUsM.exe
  C:\Windows\System\dhdiUsM.exe
  2⤵
  PID:2444
- C:\Windows\System\ZbNirwX.exe
  C:\Windows\System\ZbNirwX.exe
  2⤵
  PID:3240
- C:\Windows\System\kneLtkQ.exe
  C:\Windows\System\kneLtkQ.exe
  2⤵
  PID:6908
- C:\Windows\System\JLHpDyj.exe
  C:\Windows\System\JLHpDyj.exe
  2⤵
  PID:6796
- C:\Windows\System\VFHwTwB.exe
  C:\Windows\System\VFHwTwB.exe
  2⤵
  PID:6964
- C:\Windows\System\RwrXWZO.exe
  C:\Windows\System\RwrXWZO.exe
  2⤵
  PID:7108
- C:\Windows\System\vrwdIaL.exe
  C:\Windows\System\vrwdIaL.exe
  2⤵
  PID:6184
- C:\Windows\System\nFClPCW.exe
  C:\Windows\System\nFClPCW.exe
  2⤵
  PID:6404
- C:\Windows\System\xmflkHK.exe
  C:\Windows\System\xmflkHK.exe
  2⤵
  PID:6856
- C:\Windows\System\SvcdDQq.exe
  C:\Windows\System\SvcdDQq.exe
  2⤵
  PID:7248
- C:\Windows\System\rPcPwVF.exe
  C:\Windows\System\rPcPwVF.exe
  2⤵
  PID:7272
- C:\Windows\System\YBRuupl.exe
  C:\Windows\System\YBRuupl.exe
  2⤵
  PID:7320
- C:\Windows\System\BtijQgL.exe
  C:\Windows\System\BtijQgL.exe
  2⤵
  PID:7360
- C:\Windows\System\PxdxeZK.exe
  C:\Windows\System\PxdxeZK.exe
  2⤵
  PID:7376
- C:\Windows\System\noWutqP.exe
  C:\Windows\System\noWutqP.exe
  2⤵
  PID:7412
- C:\Windows\System\eBLAuHQ.exe
  C:\Windows\System\eBLAuHQ.exe
  2⤵
  PID:7432
- C:\Windows\System\vddSttF.exe
  C:\Windows\System\vddSttF.exe
  2⤵
  PID:7448
- C:\Windows\System\nSFpMnd.exe
  C:\Windows\System\nSFpMnd.exe
  2⤵
  PID:7472
- C:\Windows\System\bSNtRAn.exe
  C:\Windows\System\bSNtRAn.exe
  2⤵
  PID:7536
- C:\Windows\System\MDEhAee.exe
  C:\Windows\System\MDEhAee.exe
  2⤵
  PID:7568
- C:\Windows\System\PkwNInG.exe
  C:\Windows\System\PkwNInG.exe
  2⤵
  PID:7584
- C:\Windows\System\aczNYoG.exe
  C:\Windows\System\aczNYoG.exe
  2⤵
  PID:7604
- C:\Windows\System\nHLSUqY.exe
  C:\Windows\System\nHLSUqY.exe
  2⤵
  PID:7628
- C:\Windows\System\AbCEBEI.exe
  C:\Windows\System\AbCEBEI.exe
  2⤵
  PID:7648
- C:\Windows\System\AbSQCMB.exe
  C:\Windows\System\AbSQCMB.exe
  2⤵
  PID:7668
- C:\Windows\System\KmIWYFb.exe
  C:\Windows\System\KmIWYFb.exe
  2⤵
  PID:7704
- C:\Windows\System\pHCBpyL.exe
  C:\Windows\System\pHCBpyL.exe
  2⤵
  PID:7752
- C:\Windows\System\pvunheO.exe
  C:\Windows\System\pvunheO.exe
  2⤵
  PID:7772
- C:\Windows\System\UGEIYHK.exe
  C:\Windows\System\UGEIYHK.exe
  2⤵
  PID:7788
- C:\Windows\System\ACSqVxC.exe
  C:\Windows\System\ACSqVxC.exe
  2⤵
  PID:7832
- C:\Windows\System\MSjKUJy.exe
  C:\Windows\System\MSjKUJy.exe
  2⤵
  PID:7852
- C:\Windows\System\fphhkfI.exe
  C:\Windows\System\fphhkfI.exe
  2⤵
  PID:7896
- C:\Windows\System\ZMqqBNT.exe
  C:\Windows\System\ZMqqBNT.exe
  2⤵
  PID:7924
- C:\Windows\System\QJfiVyt.exe
  C:\Windows\System\QJfiVyt.exe
  2⤵
  PID:7968
- C:\Windows\System\jflGwil.exe
  C:\Windows\System\jflGwil.exe
  2⤵
  PID:7996
- C:\Windows\System\tNKrqop.exe
  C:\Windows\System\tNKrqop.exe
  2⤵
  PID:8020
- C:\Windows\System\FrqCMPE.exe
  C:\Windows\System\FrqCMPE.exe
  2⤵
  PID:8044
- C:\Windows\System\vDRiLaj.exe
  C:\Windows\System\vDRiLaj.exe
  2⤵
  PID:8060
- C:\Windows\System\qYFKBsM.exe
  C:\Windows\System\qYFKBsM.exe
  2⤵
  PID:8088
- C:\Windows\System\QYgJsLh.exe
  C:\Windows\System\QYgJsLh.exe
  2⤵
  PID:8132
- C:\Windows\System\FKOYyyt.exe
  C:\Windows\System\FKOYyyt.exe
  2⤵
  PID:8148
- C:\Windows\System\VGhaDtv.exe
  C:\Windows\System\VGhaDtv.exe
  2⤵
  PID:656
- C:\Windows\System\TBKCaAR.exe
  C:\Windows\System\TBKCaAR.exe
  2⤵
  PID:4976
- C:\Windows\System\lXwajVU.exe
  C:\Windows\System\lXwajVU.exe
  2⤵
  PID:7196
- C:\Windows\System\VivBXCr.exe
  C:\Windows\System\VivBXCr.exe
  2⤵
  PID:7288
- C:\Windows\System\IvXdvdF.exe
  C:\Windows\System\IvXdvdF.exe
  2⤵
  PID:7308
- C:\Windows\System\GGIzaGp.exe
  C:\Windows\System\GGIzaGp.exe
  2⤵
  PID:7336
- C:\Windows\System\xQhDnxo.exe
  C:\Windows\System\xQhDnxo.exe
  2⤵
  PID:7384
- C:\Windows\System\iUnPXZQ.exe
  C:\Windows\System\iUnPXZQ.exe
  2⤵
  PID:7420
- C:\Windows\System\BpyvxgY.exe
  C:\Windows\System\BpyvxgY.exe
  2⤵
  PID:7524
- C:\Windows\System\XkfeatL.exe
  C:\Windows\System\XkfeatL.exe
  2⤵
  PID:7576
- C:\Windows\System\mgDNJAL.exe
  C:\Windows\System\mgDNJAL.exe
  2⤵
  PID:7656
- C:\Windows\System\MsEBONh.exe
  C:\Windows\System\MsEBONh.exe
  2⤵
  PID:7716
- C:\Windows\System\telvppC.exe
  C:\Windows\System\telvppC.exe
  2⤵
  PID:7820
- C:\Windows\System\apGqitJ.exe
  C:\Windows\System\apGqitJ.exe
  2⤵
  PID:7848
- C:\Windows\System\sniUpCl.exe
  C:\Windows\System\sniUpCl.exe
  2⤵
  PID:7880
- C:\Windows\System\YGyrNKQ.exe
  C:\Windows\System\YGyrNKQ.exe
  2⤵
  PID:7964
- C:\Windows\System\IpLQUaF.exe
  C:\Windows\System\IpLQUaF.exe
  2⤵
  PID:7956
- C:\Windows\System\SEwfJGD.exe
  C:\Windows\System\SEwfJGD.exe
  2⤵
  PID:8076
- C:\Windows\System\DjUKogM.exe
  C:\Windows\System\DjUKogM.exe
  2⤵
  PID:8168
- C:\Windows\System\TTDdwZw.exe
  C:\Windows\System\TTDdwZw.exe
  2⤵
  PID:3724
- C:\Windows\System\FrHqjQv.exe
  C:\Windows\System\FrHqjQv.exe
  2⤵
  PID:7304
- C:\Windows\System\AIMVcOb.exe
  C:\Windows\System\AIMVcOb.exe
  2⤵
  PID:7404
- C:\Windows\System\OcbkaBH.exe
  C:\Windows\System\OcbkaBH.exe
  2⤵
  PID:7352
- C:\Windows\System\AcCawez.exe
  C:\Windows\System\AcCawez.exe
  2⤵
  PID:7644
- C:\Windows\System\NTrjHmo.exe
  C:\Windows\System\NTrjHmo.exe
  2⤵
  PID:7612
- C:\Windows\System\bbfligE.exe
  C:\Windows\System\bbfligE.exe
  2⤵
  PID:7988
- C:\Windows\System\nucApOw.exe
  C:\Windows\System\nucApOw.exe
  2⤵
  PID:8160
- C:\Windows\System\bjnJOxB.exe
  C:\Windows\System\bjnJOxB.exe
  2⤵
  PID:7688
- C:\Windows\System\VwnhnrT.exe
  C:\Windows\System\VwnhnrT.exe
  2⤵
  PID:7388
- C:\Windows\System\gSdvunx.exe
  C:\Windows\System\gSdvunx.exe
  2⤵
  PID:4364
- C:\Windows\System\lImpnNL.exe
  C:\Windows\System\lImpnNL.exe
  2⤵
  PID:7300
- C:\Windows\System\BYpDaTx.exe
  C:\Windows\System\BYpDaTx.exe
  2⤵
  PID:8220
- C:\Windows\System\eHIIEYI.exe
  C:\Windows\System\eHIIEYI.exe
  2⤵
  PID:8248
- C:\Windows\System\XBbQfHe.exe
  C:\Windows\System\XBbQfHe.exe
  2⤵
  PID:8268
- C:\Windows\System\crPInEz.exe
  C:\Windows\System\crPInEz.exe
  2⤵
  PID:8292
- C:\Windows\System\YKGGgUV.exe
  C:\Windows\System\YKGGgUV.exe
  2⤵
  PID:8316
- C:\Windows\System\qBbwXcJ.exe
  C:\Windows\System\qBbwXcJ.exe
  2⤵
  PID:8336
- C:\Windows\System\HnfeXyD.exe
  C:\Windows\System\HnfeXyD.exe
  2⤵
  PID:8356
- C:\Windows\System\qaGgxSp.exe
  C:\Windows\System\qaGgxSp.exe
  2⤵
  PID:8388
- C:\Windows\System\GGGWTsT.exe
  C:\Windows\System\GGGWTsT.exe
  2⤵
  PID:8416
- C:\Windows\System\xbRzEoy.exe
  C:\Windows\System\xbRzEoy.exe
  2⤵
  PID:8436
- C:\Windows\System\ZIAhMQF.exe
  C:\Windows\System\ZIAhMQF.exe
  2⤵
  PID:8460
- C:\Windows\System\LEGmFQW.exe
  C:\Windows\System\LEGmFQW.exe
  2⤵
  PID:8480
- C:\Windows\System\kwYUnzP.exe
  C:\Windows\System\kwYUnzP.exe
  2⤵
  PID:8512
- C:\Windows\System\kYteSOj.exe
  C:\Windows\System\kYteSOj.exe
  2⤵
  PID:8544
- C:\Windows\System\SeGXaLm.exe
  C:\Windows\System\SeGXaLm.exe
  2⤵
  PID:8572
- C:\Windows\System\atFGWSH.exe
  C:\Windows\System\atFGWSH.exe
  2⤵
  PID:8608
- C:\Windows\System\dMQMcPD.exe
  C:\Windows\System\dMQMcPD.exe
  2⤵
  PID:8624
- C:\Windows\System\qRewCjK.exe
  C:\Windows\System\qRewCjK.exe
  2⤵
  PID:8652
- C:\Windows\System\gvwiJPq.exe
  C:\Windows\System\gvwiJPq.exe
  2⤵
  PID:8668
- C:\Windows\System\oWcWQvm.exe
  C:\Windows\System\oWcWQvm.exe
  2⤵
  PID:8692
- C:\Windows\System\fwQyfIG.exe
  C:\Windows\System\fwQyfIG.exe
  2⤵
  PID:8716
- C:\Windows\System\hTPLDND.exe
  C:\Windows\System\hTPLDND.exe
  2⤵
  PID:8752
- C:\Windows\System\ATcUtZl.exe
  C:\Windows\System\ATcUtZl.exe
  2⤵
  PID:8796
- C:\Windows\System\hseqDsq.exe
  C:\Windows\System\hseqDsq.exe
  2⤵
  PID:8812
- C:\Windows\System\CBZtEEJ.exe
  C:\Windows\System\CBZtEEJ.exe
  2⤵
  PID:8840
- C:\Windows\System\nSTsErx.exe
  C:\Windows\System\nSTsErx.exe
  2⤵
  PID:8880
- C:\Windows\System\TfWSWnK.exe
  C:\Windows\System\TfWSWnK.exe
  2⤵
  PID:8908
- C:\Windows\System\DSbTczr.exe
  C:\Windows\System\DSbTczr.exe
  2⤵
  PID:8948
- C:\Windows\System\fYHxvJx.exe
  C:\Windows\System\fYHxvJx.exe
  2⤵
  PID:8988
- C:\Windows\System\wXifeOL.exe
  C:\Windows\System\wXifeOL.exe
  2⤵
  PID:9012
- C:\Windows\System\gRkgBvv.exe
  C:\Windows\System\gRkgBvv.exe
  2⤵
  PID:9032
- C:\Windows\System\iPEUQLB.exe
  C:\Windows\System\iPEUQLB.exe
  2⤵
  PID:9048
- C:\Windows\System\dzrHwWU.exe
  C:\Windows\System\dzrHwWU.exe
  2⤵
  PID:9064
- C:\Windows\System\OORkJla.exe
  C:\Windows\System\OORkJla.exe
  2⤵
  PID:9080
- C:\Windows\System\OMArwpy.exe
  C:\Windows\System\OMArwpy.exe
  2⤵
  PID:9100
- C:\Windows\System\eREwOSE.exe
  C:\Windows\System\eREwOSE.exe
  2⤵
  PID:9124
- C:\Windows\System\ipRUPSt.exe
  C:\Windows\System\ipRUPSt.exe
  2⤵
  PID:9144
- C:\Windows\System\CiBpcbl.exe
  C:\Windows\System\CiBpcbl.exe
  2⤵
  PID:9168
- C:\Windows\System\NLYJoiB.exe
  C:\Windows\System\NLYJoiB.exe
  2⤵
  PID:9184
- C:\Windows\System\HDeskaM.exe
  C:\Windows\System\HDeskaM.exe
  2⤵
  PID:7800
- C:\Windows\System\KiBXzag.exe
  C:\Windows\System\KiBXzag.exe
  2⤵
  PID:3984
- C:\Windows\System\NAUxskV.exe
  C:\Windows\System\NAUxskV.exe
  2⤵
  PID:8256
- C:\Windows\System\qXEUmVG.exe
  C:\Windows\System\qXEUmVG.exe
  2⤵
  PID:8280
- C:\Windows\System\MQMrWyz.exe
  C:\Windows\System\MQMrWyz.exe
  2⤵
  PID:8508
- C:\Windows\System\FspKjVQ.exe
  C:\Windows\System\FspKjVQ.exe
  2⤵
  PID:8760
- C:\Windows\System\AywAAty.exe
  C:\Windows\System\AywAAty.exe
  2⤵
  PID:8688
- C:\Windows\System\udzidQS.exe
  C:\Windows\System\udzidQS.exe
  2⤵
  PID:8780
- C:\Windows\System\RExhbBO.exe
  C:\Windows\System\RExhbBO.exe
  2⤵
  PID:8876
- C:\Windows\System\TCoUudz.exe
  C:\Windows\System\TCoUudz.exe
  2⤵
  PID:8940
- C:\Windows\System\okSEXJq.exe
  C:\Windows\System\okSEXJq.exe
  2⤵
  PID:8960
- C:\Windows\System\WyYZXtt.exe
  C:\Windows\System\WyYZXtt.exe
  2⤵
  PID:8976
- C:\Windows\System\IyTBNvy.exe
  C:\Windows\System\IyTBNvy.exe
  2⤵
  PID:9076
- C:\Windows\System\gSqPWFB.exe
  C:\Windows\System\gSqPWFB.exe
  2⤵
  PID:9156
- C:\Windows\System\JbodJTQ.exe
  C:\Windows\System\JbodJTQ.exe
  2⤵
  PID:9192
- C:\Windows\System\EctNtVC.exe
  C:\Windows\System\EctNtVC.exe
  2⤵
  PID:7268
- C:\Windows\System\mVTtMww.exe
  C:\Windows\System\mVTtMww.exe
  2⤵
  PID:7960
- C:\Windows\System\uSGxAvb.exe
  C:\Windows\System\uSGxAvb.exe
  2⤵
  PID:8264
- C:\Windows\System\mWdpsaH.exe
  C:\Windows\System\mWdpsaH.exe
  2⤵
  PID:7244
- C:\Windows\System\jjUOYSD.exe
  C:\Windows\System\jjUOYSD.exe
  2⤵
  PID:8828
- C:\Windows\System\clryXtq.exe
  C:\Windows\System\clryXtq.exe
  2⤵
  PID:9044
- C:\Windows\System\lfhuqHT.exe
  C:\Windows\System\lfhuqHT.exe
  2⤵
  PID:3832
- C:\Windows\System\QJGmkEa.exe
  C:\Windows\System\QJGmkEa.exe
  2⤵
  PID:8196
- C:\Windows\System\DwukMQf.exe
  C:\Windows\System\DwukMQf.exe
  2⤵
  PID:9212
- C:\Windows\System\jSuiwCg.exe
  C:\Windows\System\jSuiwCg.exe
  2⤵
  PID:9056
- C:\Windows\System\zARgkPF.exe
  C:\Windows\System\zARgkPF.exe
  2⤵
  PID:8980
- C:\Windows\System\PvcpHZo.exe
  C:\Windows\System\PvcpHZo.exe
  2⤵
  PID:9060
- C:\Windows\System\PmvdYbL.exe
  C:\Windows\System\PmvdYbL.exe
  2⤵
  PID:9244
- C:\Windows\System\yyJdUPF.exe
  C:\Windows\System\yyJdUPF.exe
  2⤵
  PID:9268
- C:\Windows\System\gXjRfXa.exe
  C:\Windows\System\gXjRfXa.exe
  2⤵
  PID:9292
- C:\Windows\System\MjRwoDV.exe
  C:\Windows\System\MjRwoDV.exe
  2⤵
  PID:9308
- C:\Windows\System\JzjiCmM.exe
  C:\Windows\System\JzjiCmM.exe
  2⤵
  PID:9380
- C:\Windows\System\WfShFFp.exe
  C:\Windows\System\WfShFFp.exe
  2⤵
  PID:9396
- C:\Windows\System\jtWqKEF.exe
  C:\Windows\System\jtWqKEF.exe
  2⤵
  PID:9416
- C:\Windows\System\UASOmzW.exe
  C:\Windows\System\UASOmzW.exe
  2⤵
  PID:9436
- C:\Windows\System\EndFUFJ.exe
  C:\Windows\System\EndFUFJ.exe
  2⤵
  PID:9460
- C:\Windows\System\smWBGqP.exe
  C:\Windows\System\smWBGqP.exe
  2⤵
  PID:9504
- C:\Windows\System\tYRnlsX.exe
  C:\Windows\System\tYRnlsX.exe
  2⤵
  PID:9528
- C:\Windows\System\sZatzQK.exe
  C:\Windows\System\sZatzQK.exe
  2⤵
  PID:9544
- C:\Windows\System\GywrEgh.exe
  C:\Windows\System\GywrEgh.exe
  2⤵
  PID:9564
- C:\Windows\System\rGoZxPm.exe
  C:\Windows\System\rGoZxPm.exe
  2⤵
  PID:9620
- C:\Windows\System\brWfxiS.exe
  C:\Windows\System\brWfxiS.exe
  2⤵
  PID:9640
- C:\Windows\System\GHGvjMg.exe
  C:\Windows\System\GHGvjMg.exe
  2⤵
  PID:9656
- C:\Windows\System\KSWRiJw.exe
  C:\Windows\System\KSWRiJw.exe
  2⤵
  PID:9676
- C:\Windows\System\ybdXroT.exe
  C:\Windows\System\ybdXroT.exe
  2⤵
  PID:9716
- C:\Windows\System\mxJQYvO.exe
  C:\Windows\System\mxJQYvO.exe
  2⤵
  PID:9732
- C:\Windows\System\JNQwtwc.exe
  C:\Windows\System\JNQwtwc.exe
  2⤵
  PID:9764
- C:\Windows\System\nylOCfC.exe
  C:\Windows\System\nylOCfC.exe
  2⤵
  PID:9784
- C:\Windows\System\MDsVASG.exe
  C:\Windows\System\MDsVASG.exe
  2⤵
  PID:9804
- C:\Windows\System\tTejebz.exe
  C:\Windows\System\tTejebz.exe
  2⤵
  PID:9824
- C:\Windows\System\GrIKJOI.exe
  C:\Windows\System\GrIKJOI.exe
  2⤵
  PID:9848
- C:\Windows\System\rjgeeKL.exe
  C:\Windows\System\rjgeeKL.exe
  2⤵
  PID:9896
- C:\Windows\System\uUSyGGB.exe
  C:\Windows\System\uUSyGGB.exe
  2⤵
  PID:9928
- C:\Windows\System\ZVJYtHy.exe
  C:\Windows\System\ZVJYtHy.exe
  2⤵
  PID:9944
- C:\Windows\System\QmjzdCQ.exe
  C:\Windows\System\QmjzdCQ.exe
  2⤵
  PID:9980
- C:\Windows\System\YLeANqh.exe
  C:\Windows\System\YLeANqh.exe
  2⤵
  PID:9996
- C:\Windows\System\EVEvrlX.exe
  C:\Windows\System\EVEvrlX.exe
  2⤵
  PID:10032
- C:\Windows\System\SKPZyGp.exe
  C:\Windows\System\SKPZyGp.exe
  2⤵
  PID:10068
- C:\Windows\System\uaGCVHI.exe
  C:\Windows\System\uaGCVHI.exe
  2⤵
  PID:10088
- C:\Windows\System\grXhgYr.exe
  C:\Windows\System\grXhgYr.exe
  2⤵
  PID:10116
- C:\Windows\System\RJvgJPW.exe
  C:\Windows\System\RJvgJPW.exe
  2⤵
  PID:10152
- C:\Windows\System\UolEdTm.exe
  C:\Windows\System\UolEdTm.exe
  2⤵
  PID:10208
- C:\Windows\System\mXeTxOK.exe
  C:\Windows\System\mXeTxOK.exe
  2⤵
  PID:10228
- C:\Windows\System\CyfRrif.exe
  C:\Windows\System\CyfRrif.exe
  2⤵
  PID:9224
- C:\Windows\System\JqZFsEM.exe
  C:\Windows\System\JqZFsEM.exe
  2⤵
  PID:9284
- C:\Windows\System\NKfWAkd.exe
  C:\Windows\System\NKfWAkd.exe
  2⤵
  PID:9340
- C:\Windows\System\yXrRWRt.exe
  C:\Windows\System\yXrRWRt.exe
  2⤵
  PID:9432
- C:\Windows\System\URdKLHB.exe
  C:\Windows\System\URdKLHB.exe
  2⤵
  PID:9480
- C:\Windows\System\IdQsIIx.exe
  C:\Windows\System\IdQsIIx.exe
  2⤵
  PID:9560
- C:\Windows\System\aMiINru.exe
  C:\Windows\System\aMiINru.exe
  2⤵
  PID:9616
- C:\Windows\System\qMuiHor.exe
  C:\Windows\System\qMuiHor.exe
  2⤵
  PID:8864
- C:\Windows\System\HyDZZPf.exe
  C:\Windows\System\HyDZZPf.exe
  2⤵
  PID:9752
- C:\Windows\System\XdmijKH.exe
  C:\Windows\System\XdmijKH.exe
  2⤵
  PID:9776
- C:\Windows\System\xLJMPUL.exe
  C:\Windows\System\xLJMPUL.exe
  2⤵
  PID:9876
- C:\Windows\System\nqiwtfK.exe
  C:\Windows\System\nqiwtfK.exe
  2⤵
  PID:9916
- C:\Windows\System\Xrawsey.exe
  C:\Windows\System\Xrawsey.exe
  2⤵
  PID:9976
- C:\Windows\System\CweyOGa.exe
  C:\Windows\System\CweyOGa.exe
  2⤵
  PID:10020
- C:\Windows\System\pZSSWmI.exe
  C:\Windows\System\pZSSWmI.exe
  2⤵
  PID:10128
- C:\Windows\System\ocEHjKa.exe
  C:\Windows\System\ocEHjKa.exe
  2⤵
  PID:10216
- C:\Windows\System\yxJDqUb.exe
  C:\Windows\System\yxJDqUb.exe
  2⤵
  PID:8352
- C:\Windows\System\OKAYIRA.exe
  C:\Windows\System\OKAYIRA.exe
  2⤵
  PID:9368
- C:\Windows\System\edJmBUd.exe
  C:\Windows\System\edJmBUd.exe
  2⤵
  PID:9540
- C:\Windows\System\rglfAwa.exe
  C:\Windows\System\rglfAwa.exe
  2⤵
  PID:2828
- C:\Windows\System\nSjFpyl.exe
  C:\Windows\System\nSjFpyl.exe
  2⤵
  PID:9860
- C:\Windows\System\LDmGdIx.exe
  C:\Windows\System\LDmGdIx.exe
  2⤵
  PID:9972
- C:\Windows\System\vgAIcOp.exe
  C:\Windows\System\vgAIcOp.exe
  2⤵
  PID:10200
- C:\Windows\System\ptklJKV.exe
  C:\Windows\System\ptklJKV.exe
  2⤵
  PID:9476
- C:\Windows\System\gjJHWgz.exe
  C:\Windows\System\gjJHWgz.exe
  2⤵
  PID:9868
- C:\Windows\System\igLDMcs.exe
  C:\Windows\System\igLDMcs.exe
  2⤵
  PID:9936
- C:\Windows\System\sylXuDK.exe
  C:\Windows\System\sylXuDK.exe
  2⤵
  PID:10144
- C:\Windows\System\IyupkTs.exe
  C:\Windows\System\IyupkTs.exe
  2⤵
  PID:10264
- C:\Windows\System\EnZHXUs.exe
  C:\Windows\System\EnZHXUs.exe
  2⤵
  PID:10304
- C:\Windows\System\mDNcpaN.exe
  C:\Windows\System\mDNcpaN.exe
  2⤵
  PID:10324
- C:\Windows\System\HICVgvv.exe
  C:\Windows\System\HICVgvv.exe
  2⤵
  PID:10356
- C:\Windows\System\bLBstlP.exe
  C:\Windows\System\bLBstlP.exe
  2⤵
  PID:10380
- C:\Windows\System\txFkQKO.exe
  C:\Windows\System\txFkQKO.exe
  2⤵
  PID:10396
- C:\Windows\System\jgrrEHs.exe
  C:\Windows\System\jgrrEHs.exe
  2⤵
  PID:10420
- C:\Windows\System\aRgUEzp.exe
  C:\Windows\System\aRgUEzp.exe
  2⤵
  PID:10464
- C:\Windows\System\nwoabrN.exe
  C:\Windows\System\nwoabrN.exe
  2⤵
  PID:10484
- C:\Windows\System\PVfxnst.exe
  C:\Windows\System\PVfxnst.exe
  2⤵
  PID:10512
- C:\Windows\System\TOKQLwF.exe
  C:\Windows\System\TOKQLwF.exe
  2⤵
  PID:10532
- C:\Windows\System\eMXIVfj.exe
  C:\Windows\System\eMXIVfj.exe
  2⤵
  PID:10552
- C:\Windows\System\GXNrIRW.exe
  C:\Windows\System\GXNrIRW.exe
  2⤵
  PID:10576
- C:\Windows\System\ZpepWcM.exe
  C:\Windows\System\ZpepWcM.exe
  2⤵
  PID:10596
- C:\Windows\System\RXpUaZA.exe
  C:\Windows\System\RXpUaZA.exe
  2⤵
  PID:10620
- C:\Windows\System\sjmgixD.exe
  C:\Windows\System\sjmgixD.exe
  2⤵
  PID:10640
- C:\Windows\System\JpLWByi.exe
  C:\Windows\System\JpLWByi.exe
  2⤵
  PID:10656
- C:\Windows\System\ZRSkxtA.exe
  C:\Windows\System\ZRSkxtA.exe
  2⤵
  PID:10680
- C:\Windows\System\lZaPWhx.exe
  C:\Windows\System\lZaPWhx.exe
  2⤵
  PID:10744
- C:\Windows\System\JBwAjjG.exe
  C:\Windows\System\JBwAjjG.exe
  2⤵
  PID:10764
- C:\Windows\System\vRHvHLb.exe
  C:\Windows\System\vRHvHLb.exe
  2⤵
  PID:10788
- C:\Windows\System\cqERcmD.exe
  C:\Windows\System\cqERcmD.exe
  2⤵
  PID:10836
- C:\Windows\System\aWQnTmq.exe
  C:\Windows\System\aWQnTmq.exe
  2⤵
  PID:10860
- C:\Windows\System\BPfUJCP.exe
  C:\Windows\System\BPfUJCP.exe
  2⤵
  PID:10880
- C:\Windows\System\NLjlUvj.exe
  C:\Windows\System\NLjlUvj.exe
  2⤵
  PID:10924
- C:\Windows\System\KKXPICu.exe
  C:\Windows\System\KKXPICu.exe
  2⤵
  PID:10944
- C:\Windows\System\ghBYEdN.exe
  C:\Windows\System\ghBYEdN.exe
  2⤵
  PID:10964
- C:\Windows\System\fBppUQp.exe
  C:\Windows\System\fBppUQp.exe
  2⤵
  PID:11036
- C:\Windows\System\miWyNNO.exe
  C:\Windows\System\miWyNNO.exe
  2⤵
  PID:11080
- C:\Windows\System\iLjPxET.exe
  C:\Windows\System\iLjPxET.exe
  2⤵
  PID:11104
- C:\Windows\System\jzWmwYt.exe
  C:\Windows\System\jzWmwYt.exe
  2⤵
  PID:11120
- C:\Windows\System\xafSlSO.exe
  C:\Windows\System\xafSlSO.exe
  2⤵
  PID:11160
- C:\Windows\System\HZcyHid.exe
  C:\Windows\System\HZcyHid.exe
  2⤵
  PID:11184
- C:\Windows\System\Divnawq.exe
  C:\Windows\System\Divnawq.exe
  2⤵
  PID:11208
- C:\Windows\System\rnNLwzI.exe
  C:\Windows\System\rnNLwzI.exe
  2⤵
  PID:11252
- C:\Windows\System\lLmABWd.exe
  C:\Windows\System\lLmABWd.exe
  2⤵
  PID:10112
- C:\Windows\System\VqCvinc.exe
  C:\Windows\System\VqCvinc.exe
  2⤵
  PID:10256
- C:\Windows\System\ZTdJlpl.exe
  C:\Windows\System\ZTdJlpl.exe
  2⤵
  PID:10320
- C:\Windows\System\npVLFxS.exe
  C:\Windows\System\npVLFxS.exe
  2⤵
  PID:10428
- C:\Windows\System\VjfzAsL.exe
  C:\Windows\System\VjfzAsL.exe
  2⤵
  PID:10504
- C:\Windows\System\flUxhUo.exe
  C:\Windows\System\flUxhUo.exe
  2⤵
  PID:10508
- C:\Windows\System\nfUBHzK.exe
  C:\Windows\System\nfUBHzK.exe
  2⤵
  PID:10560
- C:\Windows\System\acwsRWM.exe
  C:\Windows\System\acwsRWM.exe
  2⤵
  PID:10612
- C:\Windows\System\XfdCKjn.exe
  C:\Windows\System\XfdCKjn.exe
  2⤵
  PID:10732
- C:\Windows\System\NznwHTW.exe
  C:\Windows\System\NznwHTW.exe
  2⤵
  PID:10812
- C:\Windows\System\DiKWadl.exe
  C:\Windows\System\DiKWadl.exe
  2⤵
  PID:10820
- C:\Windows\System\cmPXpVu.exe
  C:\Windows\System\cmPXpVu.exe
  2⤵
  PID:10920
- C:\Windows\System\BedCNWc.exe
  C:\Windows\System\BedCNWc.exe
  2⤵
  PID:11016
- C:\Windows\System\vkcqgxx.exe
  C:\Windows\System\vkcqgxx.exe
  2⤵
  PID:11140
- C:\Windows\System\vcgXfFj.exe
  C:\Windows\System\vcgXfFj.exe
  2⤵
  PID:11204
- C:\Windows\System\zrMpPwK.exe
  C:\Windows\System\zrMpPwK.exe
  2⤵
  PID:11248
- C:\Windows\System\mTvRMen.exe
  C:\Windows\System\mTvRMen.exe
  2⤵
  PID:10296
- C:\Windows\System\hDLgehe.exe
  C:\Windows\System\hDLgehe.exe
  2⤵
  PID:10548
- C:\Windows\System\ZowwLat.exe
  C:\Windows\System\ZowwLat.exe
  2⤵
  PID:10604
- C:\Windows\System\LqiPSAk.exe
  C:\Windows\System\LqiPSAk.exe
  2⤵
  PID:10760
- C:\Windows\System\YSvKZdH.exe
  C:\Windows\System\YSvKZdH.exe
  2⤵
  PID:11068
- C:\Windows\System\AniqGjD.exe
  C:\Windows\System\AniqGjD.exe
  2⤵
  PID:11056
- C:\Windows\System\mlroJja.exe
  C:\Windows\System\mlroJja.exe
  2⤵
  PID:10244
- C:\Windows\System\nCthrSt.exe
  C:\Windows\System\nCthrSt.exe
  2⤵
  PID:10416
- C:\Windows\System\hggvMcy.exe
  C:\Windows\System\hggvMcy.exe
  2⤵
  PID:10772
- C:\Windows\System\QhRDnzG.exe
  C:\Windows\System\QhRDnzG.exe
  2⤵
  PID:10980
- C:\Windows\System\bXgtsoo.exe
  C:\Windows\System\bXgtsoo.exe
  2⤵
  PID:11244
- C:\Windows\System\wyOVqZg.exe
  C:\Windows\System\wyOVqZg.exe
  2⤵
  PID:10476
- C:\Windows\System\OVIJlzR.exe
  C:\Windows\System\OVIJlzR.exe
  2⤵
  PID:11292
- C:\Windows\System\cZEDvAb.exe
  C:\Windows\System\cZEDvAb.exe
  2⤵
  PID:11316
- C:\Windows\System\QUwtYnP.exe
  C:\Windows\System\QUwtYnP.exe
  2⤵
  PID:11340
- C:\Windows\System\UlpOGcK.exe
  C:\Windows\System\UlpOGcK.exe
  2⤵
  PID:11364
- C:\Windows\System\aFtVrYa.exe
  C:\Windows\System\aFtVrYa.exe
  2⤵
  PID:11384
- C:\Windows\System\AclaTyl.exe
  C:\Windows\System\AclaTyl.exe
  2⤵
  PID:11448
- C:\Windows\System\TInQyRt.exe
  C:\Windows\System\TInQyRt.exe
  2⤵
  PID:11472
- C:\Windows\System\TMqVJKS.exe
  C:\Windows\System\TMqVJKS.exe
  2⤵
  PID:11500
- C:\Windows\System\cEGoLZx.exe
  C:\Windows\System\cEGoLZx.exe
  2⤵
  PID:11528
- C:\Windows\System\WwjeNEg.exe
  C:\Windows\System\WwjeNEg.exe
  2⤵
  PID:11584
- C:\Windows\System\aPqrnQQ.exe
  C:\Windows\System\aPqrnQQ.exe
  2⤵
  PID:11604
- C:\Windows\System\NLpkVhV.exe
  C:\Windows\System\NLpkVhV.exe
  2⤵
  PID:11620
- C:\Windows\System\zbuwHYC.exe
  C:\Windows\System\zbuwHYC.exe
  2⤵
  PID:11664
- C:\Windows\System\vnoAaWH.exe
  C:\Windows\System\vnoAaWH.exe
  2⤵
  PID:11688
- C:\Windows\System\qxiiEYl.exe
  C:\Windows\System\qxiiEYl.exe
  2⤵
  PID:11708
- C:\Windows\System\WLrExcl.exe
  C:\Windows\System\WLrExcl.exe
  2⤵
  PID:11736
- C:\Windows\System\PEGQXDN.exe
  C:\Windows\System\PEGQXDN.exe
  2⤵
  PID:11764
- C:\Windows\System\hfhJudi.exe
  C:\Windows\System\hfhJudi.exe
  2⤵
  PID:11792
- C:\Windows\System\HbXHHGY.exe
  C:\Windows\System\HbXHHGY.exe
  2⤵
  PID:11832
- C:\Windows\System\zpxmBxR.exe
  C:\Windows\System\zpxmBxR.exe
  2⤵
  PID:11856
- C:\Windows\System\xKfXRpQ.exe
  C:\Windows\System\xKfXRpQ.exe
  2⤵
  PID:11896
- C:\Windows\System\nrqBaNj.exe
  C:\Windows\System\nrqBaNj.exe
  2⤵
  PID:11912
- C:\Windows\System\TkrQVYh.exe
  C:\Windows\System\TkrQVYh.exe
  2⤵
  PID:11928
- C:\Windows\System\MgBfhQx.exe
  C:\Windows\System\MgBfhQx.exe
  2⤵
  PID:11952
- C:\Windows\System\MxDHzlQ.exe
  C:\Windows\System\MxDHzlQ.exe
  2⤵
  PID:11980
- C:\Windows\System\MXOQFRE.exe
  C:\Windows\System\MXOQFRE.exe
  2⤵
  PID:12008
- C:\Windows\System\SEPkocR.exe
  C:\Windows\System\SEPkocR.exe
  2⤵
  PID:12028
- C:\Windows\System\svmZqrl.exe
  C:\Windows\System\svmZqrl.exe
  2⤵
  PID:12048
- C:\Windows\System\RppCVeP.exe
  C:\Windows\System\RppCVeP.exe
  2⤵
  PID:12072
- C:\Windows\System\CDtrIHp.exe
  C:\Windows\System\CDtrIHp.exe
  2⤵
  PID:12104
- C:\Windows\System\zsgMxhq.exe
  C:\Windows\System\zsgMxhq.exe
  2⤵
  PID:12156
- C:\Windows\System\mIOjDxx.exe
  C:\Windows\System\mIOjDxx.exe
  2⤵
  PID:12196
- C:\Windows\System\PENhnVB.exe
  C:\Windows\System\PENhnVB.exe
  2⤵
  PID:12212
- C:\Windows\System\YXXtzXS.exe
  C:\Windows\System\YXXtzXS.exe
  2⤵
  PID:12236
- C:\Windows\System\dJwWvGJ.exe
  C:\Windows\System\dJwWvGJ.exe
  2⤵
  PID:12256
- C:\Windows\System\WOCEHDk.exe
  C:\Windows\System\WOCEHDk.exe
  2⤵
  PID:10960
- C:\Windows\System\GJvlLeU.exe
  C:\Windows\System\GJvlLeU.exe
  2⤵
  PID:11348
- C:\Windows\System\hKCTLpH.exe
  C:\Windows\System\hKCTLpH.exe
  2⤵
  PID:11376
- C:\Windows\System\nBvLccB.exe
  C:\Windows\System\nBvLccB.exe
  2⤵
  PID:11456
- C:\Windows\System\SHqNJbw.exe
  C:\Windows\System\SHqNJbw.exe
  2⤵
  PID:11512
- C:\Windows\System\nqTXFtX.exe
  C:\Windows\System\nqTXFtX.exe
  2⤵
  PID:11552
- C:\Windows\System\JHxVLMG.exe
  C:\Windows\System\JHxVLMG.exe
  2⤵
  PID:11636
- C:\Windows\System\GJnxUEy.exe
  C:\Windows\System\GJnxUEy.exe
  2⤵
  PID:11716
- C:\Windows\System\zIuGOvw.exe
  C:\Windows\System\zIuGOvw.exe
  2⤵
  PID:11784
- C:\Windows\System\gGYKNZr.exe
  C:\Windows\System\gGYKNZr.exe
  2⤵
  PID:11840
- C:\Windows\System\TwwQCOB.exe
  C:\Windows\System\TwwQCOB.exe
  2⤵
  PID:11848
- C:\Windows\System\FGgyqOt.exe
  C:\Windows\System\FGgyqOt.exe
  2⤵
  PID:11880
- C:\Windows\System\qGNqKVY.exe
  C:\Windows\System\qGNqKVY.exe
  2⤵
  PID:11944
- C:\Windows\System\zaUvqEO.exe
  C:\Windows\System\zaUvqEO.exe
  2⤵
  PID:12004
- C:\Windows\System\buyAOin.exe
  C:\Windows\System\buyAOin.exe
  2⤵
  PID:12128
- C:\Windows\System\ggMbPVy.exe
  C:\Windows\System\ggMbPVy.exe
  2⤵
  PID:12204
- C:\Windows\System\KYJTICc.exe
  C:\Windows\System\KYJTICc.exe
  2⤵
  PID:12228
- C:\Windows\System\whNZJWV.exe
  C:\Windows\System\whNZJWV.exe
  2⤵
  PID:11312
- C:\Windows\System\ksJnkPS.exe
  C:\Windows\System\ksJnkPS.exe
  2⤵
  PID:11592
- C:\Windows\System\TtiIdIc.exe
  C:\Windows\System\TtiIdIc.exe
  2⤵
  PID:11612
- C:\Windows\System\vfBDrgf.exe
  C:\Windows\System\vfBDrgf.exe
  2⤵
  PID:11748
- C:\Windows\System\wINtidj.exe
  C:\Windows\System\wINtidj.exe
  2⤵
  PID:11904
- C:\Windows\System\xcMerIs.exe
  C:\Windows\System\xcMerIs.exe
  2⤵
  PID:12000
- C:\Windows\System\uoIIiVi.exe
  C:\Windows\System\uoIIiVi.exe
  2⤵
  PID:12168
- C:\Windows\System\CneTigC.exe
  C:\Windows\System\CneTigC.exe
  2⤵
  PID:11556
- C:\Windows\System\bEVaPOO.exe
  C:\Windows\System\bEVaPOO.exe
  2⤵
  PID:11804
- C:\Windows\System\dcOopbI.exe
  C:\Windows\System\dcOopbI.exe
  2⤵
  PID:12056
- C:\Windows\System\pNqajUi.exe
  C:\Windows\System\pNqajUi.exe
  2⤵
  PID:12020
- C:\Windows\System\DvVLmey.exe
  C:\Windows\System\DvVLmey.exe
  2⤵
  PID:12308
- C:\Windows\System\jeSiXys.exe
  C:\Windows\System\jeSiXys.exe
  2⤵
  PID:12328
- C:\Windows\System\poERIBV.exe
  C:\Windows\System\poERIBV.exe
  2⤵
  PID:12352
- C:\Windows\System\hYvMboB.exe
  C:\Windows\System\hYvMboB.exe
  2⤵
  PID:12368
- C:\Windows\System\hiUrbNE.exe
  C:\Windows\System\hiUrbNE.exe
  2⤵
  PID:12404
- C:\Windows\System\qdVLAMN.exe
  C:\Windows\System\qdVLAMN.exe
  2⤵
  PID:12452
- C:\Windows\System\QzMfswV.exe
  C:\Windows\System\QzMfswV.exe
  2⤵
  PID:12480
- C:\Windows\System\IhcIZMV.exe
  C:\Windows\System\IhcIZMV.exe
  2⤵
  PID:12504
- C:\Windows\System\wktooXk.exe
  C:\Windows\System\wktooXk.exe
  2⤵
  PID:12520
- C:\Windows\System\bvvsCjD.exe
  C:\Windows\System\bvvsCjD.exe
  2⤵
  PID:12548
- C:\Windows\System\usnnSEd.exe
  C:\Windows\System\usnnSEd.exe
  2⤵
  PID:12568
- C:\Windows\System\JESxOzO.exe
  C:\Windows\System\JESxOzO.exe
  2⤵
  PID:12616
- C:\Windows\System\UWbYaOx.exe
  C:\Windows\System\UWbYaOx.exe
  2⤵
  PID:12636
- C:\Windows\System\kJPaHmn.exe
  C:\Windows\System\kJPaHmn.exe
  2⤵
  PID:12660
- C:\Windows\System\VFSLceJ.exe
  C:\Windows\System\VFSLceJ.exe
  2⤵
  PID:12680
- C:\Windows\System\NeSdXDw.exe
  C:\Windows\System\NeSdXDw.exe
  2⤵
  PID:12704
- C:\Windows\System\AUGVLJh.exe
  C:\Windows\System\AUGVLJh.exe
  2⤵
  PID:12740
- C:\Windows\System\IbYaNVf.exe
  C:\Windows\System\IbYaNVf.exe
  2⤵
  PID:12760
- C:\Windows\System\RBYZVzO.exe
  C:\Windows\System\RBYZVzO.exe
  2⤵
  PID:12780
- C:\Windows\System\KRFcTmk.exe
  C:\Windows\System\KRFcTmk.exe
  2⤵
  PID:12832
- C:\Windows\System\zLYIsMp.exe
  C:\Windows\System\zLYIsMp.exe
  2⤵
  PID:12852
- C:\Windows\System\ESITsZt.exe
  C:\Windows\System\ESITsZt.exe
  2⤵
  PID:12888
- C:\Windows\System\FushkIw.exe
  C:\Windows\System\FushkIw.exe
  2⤵
  PID:12940
- C:\Windows\System\UAJdDhl.exe
  C:\Windows\System\UAJdDhl.exe
  2⤵
  PID:12956
- C:\Windows\System\HebTQXM.exe
  C:\Windows\System\HebTQXM.exe
  2⤵
  PID:12976
- C:\Windows\System\VoxJafC.exe
  C:\Windows\System\VoxJafC.exe
  2⤵
  PID:13008
- C:\Windows\System\MHOsosQ.exe
  C:\Windows\System\MHOsosQ.exe
  2⤵
  PID:13036
- C:\Windows\System\CXFyyXf.exe
  C:\Windows\System\CXFyyXf.exe
  2⤵
  PID:13056
- C:\Windows\System\KCDQlNz.exe
  C:\Windows\System\KCDQlNz.exe
  2⤵
  PID:13104
- C:\Windows\System\cJLzpFl.exe
  C:\Windows\System\cJLzpFl.exe
  2⤵
  PID:13128
- C:\Windows\System\IXrnQSW.exe
  C:\Windows\System\IXrnQSW.exe
  2⤵
  PID:13152
- C:\Windows\System\ZTDYVLS.exe
  C:\Windows\System\ZTDYVLS.exe
  2⤵
  PID:13192
- C:\Windows\System\tuSPwkh.exe
  C:\Windows\System\tuSPwkh.exe
  2⤵
  PID:13212
- C:\Windows\System\aUmPekV.exe
  C:\Windows\System\aUmPekV.exe
  2⤵
  PID:13236
- C:\Windows\System\RaHSGKN.exe
  C:\Windows\System\RaHSGKN.exe
  2⤵
  PID:13260
- C:\Windows\System\ULaphpP.exe
  C:\Windows\System\ULaphpP.exe
  2⤵
  PID:13288
- C:\Windows\System\AHjQKvQ.exe
  C:\Windows\System\AHjQKvQ.exe
  2⤵
  PID:3512
- C:\Windows\System\gnaKfpv.exe
  C:\Windows\System\gnaKfpv.exe
  2⤵
  PID:1972
- C:\Windows\System\EzERpKn.exe
  C:\Windows\System\EzERpKn.exe
  2⤵
  PID:12460
- C:\Windows\System\CxMrqPK.exe
  C:\Windows\System\CxMrqPK.exe
  2⤵
  PID:12444
- C:\Windows\System\QtoNriF.exe
  C:\Windows\System\QtoNriF.exe
  2⤵
  PID:12492
- C:\Windows\System\gndSqBz.exe
  C:\Windows\System\gndSqBz.exe
  2⤵
  PID:12532
- C:\Windows\System\ucUTnGf.exe
  C:\Windows\System\ucUTnGf.exe
  2⤵
  PID:12596
- C:\Windows\System\ZywhoDy.exe
  C:\Windows\System\ZywhoDy.exe
  2⤵
  PID:12652
- C:\Windows\System\NasGUUZ.exe
  C:\Windows\System\NasGUUZ.exe
  2⤵
  PID:12748
- C:\Windows\System\BBxZHQC.exe
  C:\Windows\System\BBxZHQC.exe
  2⤵
  PID:12844
- C:\Windows\System\mLAKWsC.exe
  C:\Windows\System\mLAKWsC.exe
  2⤵
  PID:12880
- C:\Windows\System\ptFxOTO.exe
  C:\Windows\System\ptFxOTO.exe
  2⤵
  PID:12952
- C:\Windows\System\gCxRwHa.exe
  C:\Windows\System\gCxRwHa.exe
  2⤵
  PID:12996
- C:\Windows\System\bMuzoup.exe
  C:\Windows\System\bMuzoup.exe
  2⤵
  PID:13100
- C:\Windows\System\zPOmuwU.exe
  C:\Windows\System\zPOmuwU.exe
  2⤵
  PID:13168
- C:\Windows\System\tosUOLx.exe
  C:\Windows\System\tosUOLx.exe
  2⤵
  PID:13208
- C:\Windows\System\XmSMuEH.exe
  C:\Windows\System\XmSMuEH.exe
  2⤵
  PID:12324
- C:\Windows\System\tzQSMVK.exe
  C:\Windows\System\tzQSMVK.exe
  2⤵
  PID:12416
- C:\Windows\System\ZOuITls.exe
  C:\Windows\System\ZOuITls.exe
  2⤵
  PID:12448
- C:\Windows\System\TIgKPJM.exe
  C:\Windows\System\TIgKPJM.exe
  2⤵
  PID:12576
- C:\Windows\System\UuBbZWk.exe
  C:\Windows\System\UuBbZWk.exe
  2⤵
  PID:12720
- C:\Windows\System\mglinBv.exe
  C:\Windows\System\mglinBv.exe
  2⤵
  PID:12868
- C:\Windows\System\vavPdek.exe
  C:\Windows\System\vavPdek.exe
  2⤵
  PID:11180
- C:\Windows\System\HKGkdyO.exe
  C:\Windows\System\HKGkdyO.exe
  2⤵
  PID:12340
- C:\Windows\System\XNaDEGc.exe
  C:\Windows\System\XNaDEGc.exe
  2⤵
  PID:12396
- C:\Windows\System\yrzGIPV.exe
  C:\Windows\System\yrzGIPV.exe
  2⤵
  PID:12672
- C:\Windows\System\ooNrmTX.exe
  C:\Windows\System\ooNrmTX.exe
  2⤵
  PID:13320
- C:\Windows\System\cRbqBTF.exe
  C:\Windows\System\cRbqBTF.exe
  2⤵
  PID:13348
- C:\Windows\System\aMCjASH.exe
  C:\Windows\System\aMCjASH.exe
  2⤵
  PID:13368
- C:\Windows\System\lAjxWwd.exe
  C:\Windows\System\lAjxWwd.exe
  2⤵
  PID:13388
- C:\Windows\System\DONgUZe.exe
  C:\Windows\System\DONgUZe.exe
  2⤵
  PID:13424
- C:\Windows\System\uIYwAqz.exe
  C:\Windows\System\uIYwAqz.exe
  2⤵
  PID:13512
- C:\Windows\System\zEiHcPU.exe
  C:\Windows\System\zEiHcPU.exe
  2⤵
  PID:13544
- C:\Windows\System\RELgHhm.exe
  C:\Windows\System\RELgHhm.exe
  2⤵
  PID:13564
- C:\Windows\System\aHyquAK.exe
  C:\Windows\System\aHyquAK.exe
  2⤵
  PID:13592
- C:\Windows\System\GwVqgmT.exe
  C:\Windows\System\GwVqgmT.exe
  2⤵
  PID:13628
- C:\Windows\System\kQiLldE.exe
  C:\Windows\System\kQiLldE.exe
  2⤵
  PID:13652
- C:\Windows\System\pRoydVS.exe
  C:\Windows\System\pRoydVS.exe
  2⤵
  PID:13688
- C:\Windows\System\FAUwNFC.exe
  C:\Windows\System\FAUwNFC.exe
  2⤵
  PID:13708
- C:\Windows\System\giAfbGb.exe
  C:\Windows\System\giAfbGb.exe
  2⤵
  PID:13728
- C:\Windows\System\OTYKMDP.exe
  C:\Windows\System\OTYKMDP.exe
  2⤵
  PID:13752

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 2328 -i 2328 -h 456 -j 464 -s 472 -d 14268
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:13256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ajzrmsx.ao1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CLskCRN.exe

Filesize
1.9MB

MD5
0b43b09f8e97636db695e7717431b563

SHA1
2c15e4f1467b5f7a0a62708f01f7f5610c194f5a

SHA256
5a378894db37f52e4d2c61f5238ac2383505741f72be17006b55adcca67b70e2

SHA512
201d75fff6c4e8da817beb975c993516fc47ebc8cfaeaad7c8d135a6fb38143d99990eb42fe9a0edc242013e3e605ce3e4af4f462fd838f2f62ad5d7311d5f7e

Download Submit
C:\Windows\System\DkZFEwC.exe

Filesize
1.9MB

MD5
dcbd1c303d0aae31b386976f50273277

SHA1
69de5b8843375c8466284a83fd53e18d9273dd16

SHA256
6fe985329b596248a7ea86b39cfdb214e3e18fff861a3fa866f3fb7363d4e53f

SHA512
18b90f2d37b4abf64993ffc893287bc8071401c37b1c9c4a678fd6e7a654a18820861f6edb7fba43906ae4020e57a092b7b38f03fccaaeff1a12c53d7f86488c

Download Submit
C:\Windows\System\DsyZLvU.exe

Filesize
1.9MB

MD5
63b2916529c50890e2345d25a8634835

SHA1
d593cde6d76244e6c3fc2b90fb2719af78ab74fe

SHA256
5cf5e30db9db10052bb26cc45e7d9983e73f8d03bb8dc9d9df3f1efeeb827aff

SHA512
d1171f40e6cc8290031a0956dfac31bedde8f313106de7123e8f3daa07ac79a3311bd7b7504d50243ab80951ae09517d255c59ba0c6737b7cd5bf3559eb13cc6

Download Submit
C:\Windows\System\EijTMdC.exe

Filesize
1.9MB

MD5
50e6455e234a23ef67a95f3073e7a9fa

SHA1
b0261ab6a6be164e63aaa5dea228b904cbd0f5d6

SHA256
5bc3368e865d965a7617cc64794b6ac6221ddfccad07e3b1ebda92375eb324db

SHA512
977e832408b83819ebb2d69921f5526e3de21e830c7bf406ac8a4dc138e31df28ad92204ef7f1d8cfbb3de75d0fad9a5f0aa7fafc2b141a3041b6fec8637110d

Download Submit
C:\Windows\System\FOMPENb.exe

Filesize
1.9MB

MD5
7dfc2e0b2f88375220c248cf1a689427

SHA1
6302709943460c4d7d7eee89566e4e4d9b97368f

SHA256
11a7925dac5fccea33307d8e3652aaaa9fbf7e5ff7d4f5bbce5c52320af0a870

SHA512
481612fb55ec804606c2a5d1dcae2f6f9d7423d3fb64633bde3181b74266ade61baf45b16c84c06556e51cc11b7c5dfb34fa71296c10abd28cb6c26952f41be8

Download Submit
C:\Windows\System\FelbrTz.exe

Filesize
1.9MB

MD5
ce1abbb811ee044400b3e23eae9a41a3

SHA1
58d7e5c11315a279ce1fdac708a9bfd4fca790d4

SHA256
c3972dcecc90b8820be9213b3069346e3932dfc6a08ea553df2b88c57ed00455

SHA512
d8baa2f1ddb3199e4e8d849cc6624377514593be24095c742177f594108866a1c5354029d3643133540d6fd7074841cefba9139ce80f422e8eefc8269d17c4a0

Download Submit
C:\Windows\System\KAWFKZQ.exe

Filesize
1.9MB

MD5
f158ba1c1f13c79d212b54e0482af1e8

SHA1
c3e99d5243c67e545665be88fd160e371060e5ca

SHA256
a9d14340dbb5345993c6bf143a371fd2261fac3cdb90b0df774753e857b2eb9e

SHA512
108ddd6212ec6020b31c8933d62975397e30f8bf5202b8c0750a44b9eac70b7a13334b9f874a428a7fd3cc032d83b5011a2649cdb6558c8d97fe82991e1ac240

Download Submit
C:\Windows\System\MFWomkI.exe

Filesize
1.9MB

MD5
f15838767c9387f94d1d16c4accd18aa

SHA1
c4561dc479902ef239d693f38fe0280061b6c3fc

SHA256
aff8fead68d9a6b4afd86914dee77d58c3b1a88dab2a340e92bddfc36033f0bf

SHA512
d27e9d78b07288c7441828f05f4c717575d32010f28256a3bb82f8e5f32cbc6215a755afab86c0a65d60ecdcb0d1f603d4d17353a617c3a3cd7183959d71fa32

Download Submit
C:\Windows\System\MtHEAau.exe

Filesize
1.9MB

MD5
1d652d04a25048b748f6c4b5a966e578

SHA1
ea9610d85e29fdcdbc52be9b4f6772ab6fb35c91

SHA256
e2cd1d730ae66bb35130837177047dbe979c914a21c6b2632916ce821ed3317c

SHA512
3cfca9845f9bf5a2710f1d4826ac93747aff343c67a1a1e4a7539b6484122f2d2374cd8f3bcc660830ade5b3f11a957ec293a92307367160dd9e5c42ed006fab

Download Submit
C:\Windows\System\NfaloPJ.exe

Filesize
1.9MB

MD5
64560853f86ee02c54f0d13f1f2d5fda

SHA1
f0f0df34ca8aa9abe0071f03fec9aaeeb1f9b72b

SHA256
c858d1cee458f92d9f6a0b738c5cfba676b74f0554ac825cc4aecc2badd1e988

SHA512
aa4bddad1542cb4c813619f17cbf6155f07fa5a5c757741ec25695ee387af9acaa506b9051af736d2096ed37679d6d8f469ce4da4e284253d76f37b8bbc6f24c

Download Submit
C:\Windows\System\NzYVqdR.exe

Filesize
1.9MB

MD5
009c21fac0d2cb8846a1eb6c024c613a

SHA1
bf86442228121d4d2214fa62866298b83a1ca8a8

SHA256
8aa99b5106b1bc70b41f1e6ff7634a1a212e443139abb37aed971cc57cfd82bd

SHA512
6af8ad10a343ec83aca82a52725991a5b658e06eb17462a6a281c45803f5de15c5ddde0de30b7deb3da16ff8bfa92aa3940dff3c9d650331c4590c02095308e3

Download Submit
C:\Windows\System\OWDjtdT.exe

Filesize
1.9MB

MD5
a6054f67187cbe4ee65e89b8c5b07f39

SHA1
e29057397370b8650960e7adec563ff0a58b7d68

SHA256
bae26d74196c92a8ca560ebcc04ed4c5c5fbdd382937f7c060b932e150c705ff

SHA512
8c415585f993dd86cd4a73a73ad0e9ae8a251a5a6e5a2b2cc85e8cd2ce062706317f365192cb8c1425a4fee9b1564982073ba037153d61287d276a4f52f2dcf2

Download Submit
C:\Windows\System\OwKmrTQ.exe

Filesize
1.9MB

MD5
588d1b7382943035a62a0b67f62c3712

SHA1
9705311d3f207c2093c20171445fae3642555ec1

SHA256
a314a495af29b9448918bddce762c2b9162f9d5e175c6243ff7f1bb2ded05c94

SHA512
3f526678dca0aaf5d55cf1ab7dedfa874189db9727651a4a0a2182027fa8be8205090b220d9f846a14b32de6639f8583394101648a340b842e8156f43ab8d253

Download Submit
C:\Windows\System\PbUKxKd.exe

Filesize
1.9MB

MD5
7c7f43ce6885281fb108f201dd9a78cf

SHA1
2f5d3dd7fa83d23955c13a807afc44a9b2f8abce

SHA256
b15b0b4953bc52cf945a0f4579b57a7103d61885469bed015fa1bbb4f416ef94

SHA512
3d8b1b73343519384eb8286c510f0bfef86590d119be7b8fce0f9f13de07ce00b01f36e6b2a8503ccaf1c7453e2aff34342634839d50223e2bb72641c952c2b7

Download Submit
C:\Windows\System\RmaPvfA.exe

Filesize
1.9MB

MD5
1c25f599e9c9361d43441e29f46a66b9

SHA1
6f14fa3b69785d790211c0df0bc1fef9ac8ab820

SHA256
a6c6d37e0a579dc1fbbda896d9567807d7770278bf1b732bc6cbe949c7095fb7

SHA512
a7c964bd662bb0426d112c1a743a18fe80b0359bbd8e11ebf9af7493d14c51ba885b198dc9d99139f8f4ce41114cfb228e3230eee2b220bbba077542632a5a0f

Download Submit
C:\Windows\System\TbKbrQp.exe

Filesize
1.9MB

MD5
d014fe507179fe98f7a5aec177b2e3ed

SHA1
0b3eda5027952ebdd1b63260b71112cb776de441

SHA256
320ac50a0f0ccebcb0ff96834a63cf511e9d5af6067e0abe718f5ae6a8379210

SHA512
c785e9b8e0ba814b4c58a140947c51a8ae8ae6526708d300a73947ac12ca8250e1b82be49bb42895c02da074f009b147031fa76e706f86dfdf9bbab8a4a1fa7e

Download Submit
C:\Windows\System\TiFKMUJ.exe

Filesize
1.9MB

MD5
507190546ae1d6bc53fa8269b5d880c5

SHA1
6af4c6a60d28d08483e65b26a7100a50f18ccb3a

SHA256
4ebec27809dcbb6d6392a61074c14a7619e2629621ef72184fe7f95cc535084a

SHA512
9179e1f507d5b77a30477cbb2d8104ec1e4be403c89bb8016d90d688f1a8d7bbedfcb31a1b2fcf2e11a0d64b4008703dfc28e00ec4396a4b9dd350d4ea88a5e9

Download Submit
C:\Windows\System\WPfFVUF.exe

Filesize
1.9MB

MD5
f45f20f99beb721ca546128fafbed5cf

SHA1
5b49ae252602c205212d5628ea1026ab442d267e

SHA256
30868442e1b6f626a9da4478ba57f7af73f5cd844c0321daa989a5bdc37b4d0b

SHA512
61cf7cb011d145d0e0dc0defe14f58e3ac35c2bef7dabc8134181c202fd851e73781a6304b7851b94ad79e3e054889f38de2dbda762eb073e26fa2197f695d96

Download Submit
C:\Windows\System\WvmDyxl.exe

Filesize
1.9MB

MD5
7457d424d46a9233697cd2bbaadca9b1

SHA1
b4b2e85d5dc84d06c5f598d95993288dcf7d50a4

SHA256
175f20390b4ab5b906d0603eb2efe028ed48dd42263c47ffb3a54874e6ab0b96

SHA512
e88aa0f766c24513ddd709dd593c18a1963142b16f321a9966923979194bd9c625216885d457fc8c081ab8f58db4d3a313c1d8dfd95e43f736801a0235881cde

Download Submit
C:\Windows\System\ZBKqUBm.exe

Filesize
1.9MB

MD5
1a8eeabff8f2842769831befa831db95

SHA1
8ca910a34238c414772cd30fa5fec66ff8447d32

SHA256
787e6d5becd4ab6d3a0ec328a6e669647df312a1685fba932af3583c658813b4

SHA512
b7b64abbcbc266fe40c9d1716d0c8ae2673f310667970a125c1273f5c3a358b81e124be0c35d1237a470165a8112423d4153a12936f4b9260a6d1c4c7739f933

Download Submit
C:\Windows\System\eROGOni.exe

Filesize
1.9MB

MD5
d5e960b0ee00e12a1e2065c4fdb02524

SHA1
36245a9e74f8c46fb5fb585a604c5e54eba83087

SHA256
17cbb0a14db794734a5f867f24ac12287b56487e2e4509743009e166a8e880dc

SHA512
9886661e733d45118709d31f1dce368a28a48da0798727e4ada545b7b2bca72572a10f2224f3ad7a84eb525e9acfe89c151553c85524a054cc8890225c077b62

Download Submit
C:\Windows\System\fweYTWb.exe

Filesize
1.9MB

MD5
2913cd321d369df883262402102c0173

SHA1
a61d7e88c84f2e5eaada4b44c5a9b79bdc03e113

SHA256
5fcc7979761ef61e7df9d82fc563f24cc9bce19475e53ed2667f51758fb8af71

SHA512
26489901a817b2ea3b30d3b6cc5e399098f416cc3bbd7b9a79ca31cfa18be74da9daef14ec317fac6e1930391b5e7b21d503fb0a4ba8051763e7a1d48a07b741

Download Submit
C:\Windows\System\iiDFtGw.exe

Filesize
1.9MB

MD5
7e41336da381f5cc5d386180689d9864

SHA1
738e0dec60c2f2cda5366cd466733fc369bb3c4b

SHA256
b54745122551271328076df8ee3a8be0ed28efd8b51c16192b4b6c999c954fb6

SHA512
02e66d307fefc7b1d5223162727c89daa72ef8123dea1b912a4e2ecb79202323fd8980fa998bd747f119ffaf563d77648432fb155e4351b8834228db048c236e

Download Submit
C:\Windows\System\kefprAN.exe

Filesize
1.9MB

MD5
e0e9879311cba4e658d340798b048247

SHA1
30c40bf0949cea0b30b1cfe48e8cf55d812f773b

SHA256
369d546dcc3c0ad977e808f18a70063aaad452dcfef006abed6d218c1e3bdcc6

SHA512
888cfb6ff5406237f8c8def4f13909d6de1433ccc9492a0f3a27ce7a7651c1cd0dc7a27c81a43465a1bd19211a19920017573f274fc035acd44db0c9cebc26ff

Download Submit
C:\Windows\System\lJVuyMF.exe

Filesize
1.9MB

MD5
3b33112ac8952288a099d53e0d57090b

SHA1
cf982a08e2cbe35d454961398e622990cf639384

SHA256
28d46e38e4dfa31152362776171fe74c91e936c68965247098e1521a073a339b

SHA512
722d27ceed5c204de8b781aea6b671130475558ea3f9912bce78efa778f8518ae18df337d44158eab364b0c15bfd5746bb5044666c517e50a51f88fe52200f8b

Download Submit
C:\Windows\System\lustCCr.exe

Filesize
1.9MB

MD5
c35684654f7919909dcd6b2d25180d5c

SHA1
ed541a5c32c229dcd5f42e64619a20a7f97d2e4f

SHA256
b2e21d61f79ac8dc65c202f7be63c579f381772e7cad1e8e2c3a937c8f8ac012

SHA512
a23e700427a804383ce5878d3ca93748f895844e48875f36b053724c741a279327655e59ac8134483b64f470315096e8275354c9b06b296c1f563cba9e0a3e51

Download Submit
C:\Windows\System\mQKaxPh.exe

Filesize
1.9MB

MD5
d6e037974ef23b5ae374921c559ef4ac

SHA1
e6ed398335fdffda849e76aa10ba5e9ac7ae059a

SHA256
b51ab59d3505c5edbe93d2e2e44690f2679cda06c234fef6e4ed796f7df96460

SHA512
5892ba62bfa525e34a847a1cc4f334a0e4c1cb727508979d9da1759c1b201c51db42a503c36cd964ad84407e8476d2b82077e29be6bf8dcdc6ac8623bbb1f270

Download Submit
C:\Windows\System\nLWNYgm.exe

Filesize
1.9MB

MD5
7e8f1669993a98f535d7f39ab502e970

SHA1
028807f5f15ae1ae7a2893155c893c32724797ed

SHA256
63cbd5bea233b393c573b433e86f8252ae9088f5bcc82345063fe12412b48d9e

SHA512
9c3b1076abf574d452d0cfa33b1cc15c2c349f42b9e8e1de878f8a79e06f77db6c3fd3c1ceb1b670ab9156cd46d8565eed0b7fbe79826618124e1fd2f5be39e1

Download Submit
C:\Windows\System\ubgcBBc.exe

Filesize
8B

MD5
e1c0dcd3ccc7caba500dc7b5ec5c30ab

SHA1
9be0ea654569cf464b3e03471ea8e30f3dbe6d7c

SHA256
fd739ab62b39ab9475aca0f420f49c92b2489a700118e0ba4342e00823e753df

SHA512
49fed546b80fe0b4fdf75cd9b5f3a04de144667708ce473227c77aac085e673cf2fe9740bb7e8eebcd1ed2cd224a0b69dc4e3f6614ac9cf7079194e1c08239e5

Download Submit
C:\Windows\System\uxggaYk.exe

Filesize
1.9MB

MD5
a8e0a1d8df9bf6214168ef75688efd5e

SHA1
5d1f92dac01d44a5aba452e3284c3a3996cba9c4

SHA256
6b425adf5a5a138bcf252b49dc69269daa4eb6f4fdce2d550f2501dec2cf6a57

SHA512
b5c96eb88316682625dd23ffeb1dcf8279e54596491a27e1cfb5fcc2d0f35c5de934c6d2b25e1f13d26b4f4583922ffc4f5ca2e42ac17993a013d9b5808f9d1d

Download Submit
C:\Windows\System\vLunOLk.exe

Filesize
1.9MB

MD5
bc80748ecd302df67dc65c7421654912

SHA1
eec8885cc1dbe995fcede8f23f4452ebbcff6c84

SHA256
f35fc13632857edf51ab1d1118b4e29c53a40376b4edd9cf04af19a95c5fe117

SHA512
7a129735035098b1f5625f547bbe1fb26606af6a25e410947e4e9d92c3f9e4dfae0c467943191fd0873e909da890c987198bac48938b80ba51ab47b74bfb459e

Download Submit
C:\Windows\System\vRzsUqM.exe

Filesize
1.9MB

MD5
8913773a19de0f57f7a4f2e1d46538a9

SHA1
a135063c35e003bd25a7942fbf2c7fca7cf2e0e4

SHA256
f1edfdab848e78359ab3343364640fe5b2a8b6c7db417f4a30809c4aa848b1af

SHA512
f57254a064ff9ba17f995f703effdeade05072e308db5b26b72173a3dfc537501fb4b8301d83d3ab9623aaa695fdb2a1068b8409f9358b92365a5a95d9f4db23

Download Submit
C:\Windows\System\ylMjjZA.exe

Filesize
1.9MB

MD5
4aa7bc474565d9862fc3bc39e8f14200

SHA1
924a3b0d3072c9b7e6a5dacd81d4c88e624e3249

SHA256
010e9d7eb90da9c3587299278395e6d7a53a8069befc1c8ed34908f9d41a6451

SHA512
b2996726ae44ee6a1c777ae514c6b6ad7a020154387c0b975d59e41e68a7fa9719901466d747c32883398c4ab510f407cde705bd2a5b93108c8afffc0f2c0e99

Download Submit
C:\Windows\System\zhUmJKt.exe

Filesize
1.9MB

MD5
bd1c7d65ac17d85fe4a2bc7cca9c7c22

SHA1
0fa6d6783e93f1f4c1dec0e769a232392104178d

SHA256
9551e9effcd41029365e5557fab20b411d517b16305f7ad922b592dae70de154

SHA512
a36a582b6cbe69010c53c7ae19e3fe125d2f745474def96bfd298f3fd123385f12c5f5232aa7c8c5ec2211deef15ab865f45e202c92700ea606922f3c8ad9e9f

Download Submit
memory/552-160-0x00007FF69B3B0000-0x00007FF69B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/552-3257-0x00007FF69B3B0000-0x00007FF69B7A2000-memory.dmp

Filesize
3.9MB

Download
memory/716-18-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp

Filesize
3.9MB

Download
memory/716-3181-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp

Filesize
3.9MB

Download
memory/716-134-0x00007FF65DF10000-0x00007FF65E302000-memory.dmp

Filesize
3.9MB

Download
memory/780-3212-0x00007FF68A570000-0x00007FF68A962000-memory.dmp

Filesize
3.9MB

Download
memory/780-91-0x00007FF68A570000-0x00007FF68A962000-memory.dmp

Filesize
3.9MB

Download
memory/1200-3258-0x00007FF7F9560000-0x00007FF7F9952000-memory.dmp

Filesize
3.9MB

Download
memory/1200-1451-0x00007FF7F9560000-0x00007FF7F9952000-memory.dmp

Filesize
3.9MB

Download
memory/1200-135-0x00007FF7F9560000-0x00007FF7F9952000-memory.dmp

Filesize
3.9MB

Download
memory/1488-142-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp

Filesize
3.9MB

Download
memory/1488-3179-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp

Filesize
3.9MB

Download
memory/1488-22-0x00007FF7FE610000-0x00007FF7FEA02000-memory.dmp

Filesize
3.9MB

Download
memory/1544-86-0x00007FF7D5360000-0x00007FF7D5752000-memory.dmp

Filesize
3.9MB

Download
memory/1544-3187-0x00007FF7D5360000-0x00007FF7D5752000-memory.dmp

Filesize
3.9MB

Download
memory/1656-124-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-11-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp

Filesize
3.9MB

Download
memory/1656-3177-0x00007FF6191D0000-0x00007FF6195C2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-92-0x00007FF6F0440000-0x00007FF6F0832000-memory.dmp

Filesize
3.9MB

Download
memory/1764-3214-0x00007FF6F0440000-0x00007FF6F0832000-memory.dmp

Filesize
3.9MB

Download
memory/2760-88-0x00007FF6F1060000-0x00007FF6F1452000-memory.dmp

Filesize
3.9MB

Download
memory/2760-3209-0x00007FF6F1060000-0x00007FF6F1452000-memory.dmp

Filesize
3.9MB

Download
memory/2780-3264-0x00007FF6D2520000-0x00007FF6D2912000-memory.dmp

Filesize
3.9MB

Download
memory/2780-166-0x00007FF6D2520000-0x00007FF6D2912000-memory.dmp

Filesize
3.9MB

Download
memory/2928-3183-0x00007FF7B5560000-0x00007FF7B5952000-memory.dmp

Filesize
3.9MB

Download
memory/2928-59-0x00007FF7B5560000-0x00007FF7B5952000-memory.dmp

Filesize
3.9MB

Download
memory/3024-3218-0x00007FF63DFA0000-0x00007FF63E392000-memory.dmp

Filesize
3.9MB

Download
memory/3024-93-0x00007FF63DFA0000-0x00007FF63E392000-memory.dmp

Filesize
3.9MB

Download
memory/3120-87-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp

Filesize
3.9MB

Download
memory/3120-3185-0x00007FF6E2380000-0x00007FF6E2772000-memory.dmp

Filesize
3.9MB

Download
memory/3124-831-0x000002427A7A0000-0x000002427AF46000-memory.dmp

Filesize
7.6MB

Download
memory/3124-23-0x00007FF8B9233000-0x00007FF8B9235000-memory.dmp

Filesize
8KB

Download
memory/3124-79-0x0000024260BE0000-0x0000024260C02000-memory.dmp

Filesize
136KB

Download
memory/3124-50-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3124-148-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3124-41-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3124-3152-0x00007FF8B9230000-0x00007FF8B9CF1000-memory.dmp

Filesize
10.8MB

Download
memory/3168-3215-0x00007FF7D20C0000-0x00007FF7D24B2000-memory.dmp

Filesize
3.9MB

Download
memory/3168-84-0x00007FF7D20C0000-0x00007FF7D24B2000-memory.dmp

Filesize
3.9MB

Download
memory/3176-172-0x00007FF6A8B20000-0x00007FF6A8F12000-memory.dmp

Filesize
3.9MB

Download
memory/3176-3261-0x00007FF6A8B20000-0x00007FF6A8F12000-memory.dmp

Filesize
3.9MB

Download
memory/3176-1710-0x00007FF6A8B20000-0x00007FF6A8F12000-memory.dmp

Filesize
3.9MB

Download
memory/3440-159-0x00007FF640ED0000-0x00007FF6412C2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-3259-0x00007FF640ED0000-0x00007FF6412C2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-80-0x00007FF64EAC0000-0x00007FF64EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-3208-0x00007FF64EAC0000-0x00007FF64EEB2000-memory.dmp

Filesize
3.9MB

Download
memory/3996-123-0x00007FF689500000-0x00007FF6898F2000-memory.dmp

Filesize
3.9MB

Download
memory/3996-1-0x000001375F7B0000-0x000001375F7C0000-memory.dmp

Filesize
64KB

Download
memory/3996-0-0x00007FF689500000-0x00007FF6898F2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-141-0x00007FF768300000-0x00007FF7686F2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-1454-0x00007FF768300000-0x00007FF7686F2000-memory.dmp

Filesize
3.9MB

Download
memory/4320-3254-0x00007FF768300000-0x00007FF7686F2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-117-0x00007FF7886D0000-0x00007FF788AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-3244-0x00007FF7886D0000-0x00007FF788AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4428-1205-0x00007FF7886D0000-0x00007FF788AC2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-945-0x00007FF7E9C00000-0x00007FF7E9FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-105-0x00007FF7E9C00000-0x00007FF7E9FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4596-3247-0x00007FF641970000-0x00007FF641D62000-memory.dmp

Filesize
3.9MB

Download
memory/4596-111-0x00007FF641970000-0x00007FF641D62000-memory.dmp

Filesize
3.9MB

Download
memory/4596-1077-0x00007FF641970000-0x00007FF641D62000-memory.dmp

Filesize
3.9MB

Download
memory/4664-128-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp

Filesize
3.9MB

Download
memory/4664-1328-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp

Filesize
3.9MB

Download
memory/4664-3239-0x00007FF73ED60000-0x00007FF73F152000-memory.dmp

Filesize
3.9MB

Download
memory/4860-3219-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-798-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-97-0x00007FF6D1A00000-0x00007FF6D1DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4904-83-0x00007FF7ED440000-0x00007FF7ED832000-memory.dmp

Filesize
3.9MB

Download
memory/4904-3197-0x00007FF7ED440000-0x00007FF7ED832000-memory.dmp

Filesize
3.9MB

Download