xmrig | 6434db06bdd96b933543bbf32c9fc5123ee7485be250eecc17a1de6588d97626

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f936101c73ab575fc23509da09a250N.exe
Size

1.7MB
MD5

c8f936101c73ab575fc23509da09a250
SHA1

4cc5b3a6e8b0694bb2744a7708c0df7933418a99
SHA256

6434db06bdd96b933543bbf32c9fc5123ee7485be250eecc17a1de6588d97626
SHA512

1028ac9f1ca19897f70b520001929abf9490929d109e3aecc39dffa9cd5fb61e1f35cf421e5f9aee407e7239a64beacb29edaa7d424173f0c3616d260ac57272
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwV0NQhcDa:Lz071uv4BPMkFfdg6NsIRSwVkxDa

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/2248-382-0x00007FF665A50000-0x00007FF665E42000-memory.dmp	xmrig
behavioral2/memory/2668-513-0x00007FF62F9E0000-0x00007FF62FDD2000-memory.dmp	xmrig
behavioral2/memory/4228-549-0x00007FF76B060000-0x00007FF76B452000-memory.dmp	xmrig
behavioral2/memory/3692-665-0x00007FF7E0780000-0x00007FF7E0B72000-memory.dmp	xmrig
behavioral2/memory/4772-671-0x00007FF66F430000-0x00007FF66F822000-memory.dmp	xmrig
behavioral2/memory/1132-670-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	xmrig
behavioral2/memory/1108-669-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp	xmrig
behavioral2/memory/972-668-0x00007FF691B50000-0x00007FF691F42000-memory.dmp	xmrig
behavioral2/memory/4400-667-0x00007FF712690000-0x00007FF712A82000-memory.dmp	xmrig
behavioral2/memory/3724-666-0x00007FF764010000-0x00007FF764402000-memory.dmp	xmrig
behavioral2/memory/3492-664-0x00007FF7AB740000-0x00007FF7ABB32000-memory.dmp	xmrig
behavioral2/memory/3004-663-0x00007FF787CE0000-0x00007FF7880D2000-memory.dmp	xmrig
behavioral2/memory/3100-662-0x00007FF6C6160000-0x00007FF6C6552000-memory.dmp	xmrig
behavioral2/memory/1404-661-0x00007FF7BC0B0000-0x00007FF7BC4A2000-memory.dmp	xmrig
behavioral2/memory/2572-660-0x00007FF7928A0000-0x00007FF792C92000-memory.dmp	xmrig
behavioral2/memory/968-508-0x00007FF737840000-0x00007FF737C32000-memory.dmp	xmrig
behavioral2/memory/4764-410-0x00007FF7C2E90000-0x00007FF7C3282000-memory.dmp	xmrig
behavioral2/memory/3836-409-0x00007FF7D5290000-0x00007FF7D5682000-memory.dmp	xmrig
behavioral2/memory/3056-317-0x00007FF66E730000-0x00007FF66EB22000-memory.dmp	xmrig
behavioral2/memory/2128-307-0x00007FF7B4C60000-0x00007FF7B5052000-memory.dmp	xmrig
behavioral2/memory/3712-257-0x00007FF7A6040000-0x00007FF7A6432000-memory.dmp	xmrig
behavioral2/memory/3924-260-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp	xmrig
behavioral2/memory/4988-215-0x00007FF7AB3B0000-0x00007FF7AB7A2000-memory.dmp	xmrig
behavioral2/memory/4040-2650-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp	xmrig
behavioral2/memory/1108-2716-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp	xmrig
behavioral2/memory/4040-2718-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp	xmrig
behavioral2/memory/1132-2722-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	xmrig
behavioral2/memory/4764-2726-0x00007FF7C2E90000-0x00007FF7C3282000-memory.dmp	xmrig
behavioral2/memory/2248-2724-0x00007FF665A50000-0x00007FF665E42000-memory.dmp	xmrig
behavioral2/memory/4988-2721-0x00007FF7AB3B0000-0x00007FF7AB7A2000-memory.dmp	xmrig
behavioral2/memory/3712-2730-0x00007FF7A6040000-0x00007FF7A6432000-memory.dmp	xmrig
behavioral2/memory/4228-2750-0x00007FF76B060000-0x00007FF76B452000-memory.dmp	xmrig
behavioral2/memory/972-2754-0x00007FF691B50000-0x00007FF691F42000-memory.dmp	xmrig
behavioral2/memory/1404-2760-0x00007FF7BC0B0000-0x00007FF7BC4A2000-memory.dmp	xmrig
behavioral2/memory/4772-2758-0x00007FF66F430000-0x00007FF66F822000-memory.dmp	xmrig
behavioral2/memory/2572-2757-0x00007FF7928A0000-0x00007FF792C92000-memory.dmp	xmrig
behavioral2/memory/2668-2751-0x00007FF62F9E0000-0x00007FF62FDD2000-memory.dmp	xmrig
behavioral2/memory/3492-2748-0x00007FF7AB740000-0x00007FF7ABB32000-memory.dmp	xmrig
behavioral2/memory/2128-2744-0x00007FF7B4C60000-0x00007FF7B5052000-memory.dmp	xmrig
behavioral2/memory/3836-2746-0x00007FF7D5290000-0x00007FF7D5682000-memory.dmp	xmrig
behavioral2/memory/968-2729-0x00007FF737840000-0x00007FF737C32000-memory.dmp	xmrig
behavioral2/memory/3924-2732-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp	xmrig
behavioral2/memory/3100-2764-0x00007FF6C6160000-0x00007FF6C6552000-memory.dmp	xmrig
behavioral2/memory/3724-2769-0x00007FF764010000-0x00007FF764402000-memory.dmp	xmrig
behavioral2/memory/3692-2766-0x00007FF7E0780000-0x00007FF7E0B72000-memory.dmp	xmrig
behavioral2/memory/3004-2762-0x00007FF787CE0000-0x00007FF7880D2000-memory.dmp	xmrig
behavioral2/memory/4400-2790-0x00007FF712690000-0x00007FF712A82000-memory.dmp	xmrig
behavioral2/memory/3056-2781-0x00007FF66E730000-0x00007FF66EB22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3848	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4040	IlGNlJt.exe
1108	VPIVWMu.exe
1132	DeNGflP.exe
4988	ONARgQs.exe
3712	JxbIlbP.exe
3924	BECVLzX.exe
2128	aPCjjyE.exe
3056	jCiSOzS.exe
2248	Fwwtqhp.exe
3836	NtBSAIG.exe
4764	JSYJpHM.exe
968	KAmCRME.exe
4772	RuHIPVh.exe
2668	RlwJUsS.exe
4228	pVAwoEY.exe
2572	iwyyTAS.exe
1404	SgGFoxW.exe
3100	LtScWGg.exe
3004	uNUyGLR.exe
3492	GRdFxiV.exe
3692	KDSiuXm.exe
3724	HFGKfjP.exe
4400	KxhJZhZ.exe
972	ljCZHcB.exe
4624	vWNeCJn.exe
3484	cIEjDZi.exe
4652	AxIELDN.exe
1060	XfXEElf.exe
3528	uWRUFim.exe
4048	GIvuMSY.exe
5008	vSjQIHU.exe
2712	ntIpzPq.exe
412	YyQQSGV.exe
928	IFyrQmo.exe
4940	HWyBzvl.exe
4112	vpXllyO.exe
4812	MnsJwWd.exe
3160	xpZpyPb.exe
3444	bnIemvI.exe
1292	LZTRZvF.exe
4884	BRAtZjF.exe
4292	EuPVwcL.exe
2276	BpFDZjq.exe
1628	QkbKDbk.exe
636	EvNeldK.exe
3500	bahMWEA.exe
3152	tAWGaRD.exe
1460	syUnRpE.exe
4944	QOvHFyv.exe
4516	whGQAqZ.exe
920	rEmYqoc.exe
1160	kKhNTDm.exe
1936	TINygBC.exe
2088	aDqXvXk.exe
4324	arDrfJo.exe
3808	kAcSpOk.exe
1972	LWFPyQx.exe
1448	VluPonY.exe
4328	syxZTyD.exe
4468	QyGbjax.exe
1500	UdxMOGW.exe
1908	XzfqoWc.exe
684	cIjvQja.exe
1252	ZaRojOE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/344-0-0x00007FF7F98B0000-0x00007FF7F9CA2000-memory.dmp	upx
behavioral2/files/0x00080000000233a2-5.dat	upx
behavioral2/files/0x00070000000233a7-7.dat	upx
behavioral2/files/0x00070000000233a6-8.dat	upx
behavioral2/files/0x00070000000233a8-22.dat	upx
behavioral2/files/0x00070000000233ab-32.dat	upx
behavioral2/files/0x00070000000233b3-79.dat	upx
behavioral2/files/0x00070000000233b2-141.dat	upx
behavioral2/files/0x00070000000233cb-198.dat	upx
behavioral2/memory/2248-382-0x00007FF665A50000-0x00007FF665E42000-memory.dmp	upx
behavioral2/memory/2668-513-0x00007FF62F9E0000-0x00007FF62FDD2000-memory.dmp	upx
behavioral2/memory/4228-549-0x00007FF76B060000-0x00007FF76B452000-memory.dmp	upx
behavioral2/memory/3692-665-0x00007FF7E0780000-0x00007FF7E0B72000-memory.dmp	upx
behavioral2/memory/4772-671-0x00007FF66F430000-0x00007FF66F822000-memory.dmp	upx
behavioral2/memory/1132-670-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp	upx
behavioral2/memory/1108-669-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp	upx
behavioral2/memory/972-668-0x00007FF691B50000-0x00007FF691F42000-memory.dmp	upx
behavioral2/memory/4400-667-0x00007FF712690000-0x00007FF712A82000-memory.dmp	upx
behavioral2/memory/3724-666-0x00007FF764010000-0x00007FF764402000-memory.dmp	upx
behavioral2/memory/3492-664-0x00007FF7AB740000-0x00007FF7ABB32000-memory.dmp	upx
behavioral2/memory/3004-663-0x00007FF787CE0000-0x00007FF7880D2000-memory.dmp	upx
behavioral2/memory/3100-662-0x00007FF6C6160000-0x00007FF6C6552000-memory.dmp	upx
behavioral2/memory/1404-661-0x00007FF7BC0B0000-0x00007FF7BC4A2000-memory.dmp	upx
behavioral2/memory/2572-660-0x00007FF7928A0000-0x00007FF792C92000-memory.dmp	upx
behavioral2/memory/968-508-0x00007FF737840000-0x00007FF737C32000-memory.dmp	upx
behavioral2/memory/4764-410-0x00007FF7C2E90000-0x00007FF7C3282000-memory.dmp	upx
behavioral2/memory/3836-409-0x00007FF7D5290000-0x00007FF7D5682000-memory.dmp	upx
behavioral2/memory/3056-317-0x00007FF66E730000-0x00007FF66EB22000-memory.dmp	upx
behavioral2/memory/2128-307-0x00007FF7B4C60000-0x00007FF7B5052000-memory.dmp	upx
behavioral2/memory/3712-257-0x00007FF7A6040000-0x00007FF7A6432000-memory.dmp	upx
behavioral2/memory/3924-260-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp	upx
behavioral2/files/0x00070000000233c2-195.dat	upx
behavioral2/files/0x00070000000233ca-187.dat	upx
behavioral2/files/0x00070000000233c9-185.dat	upx
behavioral2/files/0x00070000000233b9-183.dat	upx
behavioral2/files/0x00070000000233c0-181.dat	upx
behavioral2/files/0x00070000000233b7-179.dat	upx
behavioral2/files/0x00070000000233b5-174.dat	upx
behavioral2/files/0x00070000000233c7-170.dat	upx
behavioral2/files/0x00070000000233c6-167.dat	upx
behavioral2/files/0x00070000000233c5-166.dat	upx
behavioral2/files/0x00070000000233b4-162.dat	upx
behavioral2/files/0x00070000000233bc-159.dat	upx
behavioral2/memory/4988-215-0x00007FF7AB3B0000-0x00007FF7AB7A2000-memory.dmp	upx
behavioral2/files/0x00070000000233b1-145.dat	upx
behavioral2/files/0x00070000000233ba-188.dat	upx
behavioral2/files/0x00070000000233c1-133.dat	upx
behavioral2/files/0x00070000000233b8-130.dat	upx
behavioral2/files/0x00070000000233b6-177.dat	upx
behavioral2/files/0x00070000000233bf-129.dat	upx
behavioral2/files/0x00070000000233be-126.dat	upx
behavioral2/files/0x00070000000233bd-125.dat	upx
behavioral2/files/0x00070000000233ac-119.dat	upx
behavioral2/files/0x00070000000233c4-154.dat	upx
behavioral2/files/0x00070000000233c3-139.dat	upx
behavioral2/files/0x00070000000233ae-82.dat	upx
behavioral2/files/0x00070000000233bb-110.dat	upx
behavioral2/files/0x00070000000233b0-66.dat	upx
behavioral2/files/0x00070000000233af-65.dat	upx
behavioral2/files/0x00070000000233aa-56.dat	upx
behavioral2/files/0x00070000000233a9-55.dat	upx
behavioral2/files/0x00070000000233ad-37.dat	upx
behavioral2/memory/4040-12-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp	upx
behavioral2/memory/4040-2650-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lWbnBeq.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\htnftbw.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\RtuVDrw.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\hNgrSac.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\lRseykG.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\mXgrrQb.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\AZpOivg.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\wUkLCzW.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\FJHvxEW.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\zKepsOK.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\HYyicej.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\UfQzNBt.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\TfJunhn.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\kTVSplz.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\eThgYbK.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\MVQFIsp.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\oFDjftA.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\GmQPyhe.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\hKrgJtZ.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\jederDB.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\lSGFaUc.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\qkpsFYI.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\aPCjjyE.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\ADaioiu.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\VorSzmT.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\zFpmSud.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\ZESSrZX.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\lPsXKbD.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\aDqXvXk.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\ThyVNFk.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\EZSpBsp.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\ijvQmTY.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\ijxcyYk.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\lmyGGLN.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\MimAIuL.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\VluPonY.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\RLlXTdo.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\qKAnjqe.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\IFCPXMF.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\cKtoFnb.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\tNITQpm.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\mDeiaMt.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\OJSCZct.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\ZywRuMb.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\glqONaM.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\XnTSbsO.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\DHgaPio.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\tkBCNCS.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\PrykJfZ.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\mTrTlaz.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\dtLdxTg.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\bxOxEAD.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\hhFkEUt.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\LQaUINP.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\lgmZpHq.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\eyVTfQj.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\anJdAcv.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\SpdTCwC.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\qevcCUx.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\KZoYcmC.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\mawVFjr.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\NtwNAva.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\PUARkbW.exe	c8f936101c73ab575fc23509da09a250N.exe
File created	C:\Windows\System\BIRFeXu.exe	c8f936101c73ab575fc23509da09a250N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeLockMemoryPrivilege	344	c8f936101c73ab575fc23509da09a250N.exe
Token: SeLockMemoryPrivilege	344	c8f936101c73ab575fc23509da09a250N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 3848	344	c8f936101c73ab575fc23509da09a250N.exe	85
PID 344 wrote to memory of 3848	344	c8f936101c73ab575fc23509da09a250N.exe	85
PID 344 wrote to memory of 4040	344	c8f936101c73ab575fc23509da09a250N.exe	86
PID 344 wrote to memory of 4040	344	c8f936101c73ab575fc23509da09a250N.exe	86
PID 344 wrote to memory of 1108	344	c8f936101c73ab575fc23509da09a250N.exe	87
PID 344 wrote to memory of 1108	344	c8f936101c73ab575fc23509da09a250N.exe	87
PID 344 wrote to memory of 1132	344	c8f936101c73ab575fc23509da09a250N.exe	88
PID 344 wrote to memory of 1132	344	c8f936101c73ab575fc23509da09a250N.exe	88
PID 344 wrote to memory of 4988	344	c8f936101c73ab575fc23509da09a250N.exe	89
PID 344 wrote to memory of 4988	344	c8f936101c73ab575fc23509da09a250N.exe	89
PID 344 wrote to memory of 3712	344	c8f936101c73ab575fc23509da09a250N.exe	90
PID 344 wrote to memory of 3712	344	c8f936101c73ab575fc23509da09a250N.exe	90
PID 344 wrote to memory of 3924	344	c8f936101c73ab575fc23509da09a250N.exe	91
PID 344 wrote to memory of 3924	344	c8f936101c73ab575fc23509da09a250N.exe	91
PID 344 wrote to memory of 2128	344	c8f936101c73ab575fc23509da09a250N.exe	92
PID 344 wrote to memory of 2128	344	c8f936101c73ab575fc23509da09a250N.exe	92
PID 344 wrote to memory of 3056	344	c8f936101c73ab575fc23509da09a250N.exe	93
PID 344 wrote to memory of 3056	344	c8f936101c73ab575fc23509da09a250N.exe	93
PID 344 wrote to memory of 2248	344	c8f936101c73ab575fc23509da09a250N.exe	94
PID 344 wrote to memory of 2248	344	c8f936101c73ab575fc23509da09a250N.exe	94
PID 344 wrote to memory of 3836	344	c8f936101c73ab575fc23509da09a250N.exe	95
PID 344 wrote to memory of 3836	344	c8f936101c73ab575fc23509da09a250N.exe	95
PID 344 wrote to memory of 4764	344	c8f936101c73ab575fc23509da09a250N.exe	96
PID 344 wrote to memory of 4764	344	c8f936101c73ab575fc23509da09a250N.exe	96
PID 344 wrote to memory of 968	344	c8f936101c73ab575fc23509da09a250N.exe	97
PID 344 wrote to memory of 968	344	c8f936101c73ab575fc23509da09a250N.exe	97
PID 344 wrote to memory of 4772	344	c8f936101c73ab575fc23509da09a250N.exe	98
PID 344 wrote to memory of 4772	344	c8f936101c73ab575fc23509da09a250N.exe	98
PID 344 wrote to memory of 2668	344	c8f936101c73ab575fc23509da09a250N.exe	99
PID 344 wrote to memory of 2668	344	c8f936101c73ab575fc23509da09a250N.exe	99
PID 344 wrote to memory of 4228	344	c8f936101c73ab575fc23509da09a250N.exe	100
PID 344 wrote to memory of 4228	344	c8f936101c73ab575fc23509da09a250N.exe	100
PID 344 wrote to memory of 2572	344	c8f936101c73ab575fc23509da09a250N.exe	101
PID 344 wrote to memory of 2572	344	c8f936101c73ab575fc23509da09a250N.exe	101
PID 344 wrote to memory of 1404	344	c8f936101c73ab575fc23509da09a250N.exe	102
PID 344 wrote to memory of 1404	344	c8f936101c73ab575fc23509da09a250N.exe	102
PID 344 wrote to memory of 3100	344	c8f936101c73ab575fc23509da09a250N.exe	103
PID 344 wrote to memory of 3100	344	c8f936101c73ab575fc23509da09a250N.exe	103
PID 344 wrote to memory of 3004	344	c8f936101c73ab575fc23509da09a250N.exe	104
PID 344 wrote to memory of 3004	344	c8f936101c73ab575fc23509da09a250N.exe	104
PID 344 wrote to memory of 3492	344	c8f936101c73ab575fc23509da09a250N.exe	105
PID 344 wrote to memory of 3492	344	c8f936101c73ab575fc23509da09a250N.exe	105
PID 344 wrote to memory of 3692	344	c8f936101c73ab575fc23509da09a250N.exe	106
PID 344 wrote to memory of 3692	344	c8f936101c73ab575fc23509da09a250N.exe	106
PID 344 wrote to memory of 3724	344	c8f936101c73ab575fc23509da09a250N.exe	107
PID 344 wrote to memory of 3724	344	c8f936101c73ab575fc23509da09a250N.exe	107
PID 344 wrote to memory of 4400	344	c8f936101c73ab575fc23509da09a250N.exe	108
PID 344 wrote to memory of 4400	344	c8f936101c73ab575fc23509da09a250N.exe	108
PID 344 wrote to memory of 972	344	c8f936101c73ab575fc23509da09a250N.exe	109
PID 344 wrote to memory of 972	344	c8f936101c73ab575fc23509da09a250N.exe	109
PID 344 wrote to memory of 4624	344	c8f936101c73ab575fc23509da09a250N.exe	110
PID 344 wrote to memory of 4624	344	c8f936101c73ab575fc23509da09a250N.exe	110
PID 344 wrote to memory of 3484	344	c8f936101c73ab575fc23509da09a250N.exe	111
PID 344 wrote to memory of 3484	344	c8f936101c73ab575fc23509da09a250N.exe	111
PID 344 wrote to memory of 4652	344	c8f936101c73ab575fc23509da09a250N.exe	112
PID 344 wrote to memory of 4652	344	c8f936101c73ab575fc23509da09a250N.exe	112
PID 344 wrote to memory of 4940	344	c8f936101c73ab575fc23509da09a250N.exe	113
PID 344 wrote to memory of 4940	344	c8f936101c73ab575fc23509da09a250N.exe	113
PID 344 wrote to memory of 1060	344	c8f936101c73ab575fc23509da09a250N.exe	114
PID 344 wrote to memory of 1060	344	c8f936101c73ab575fc23509da09a250N.exe	114
PID 344 wrote to memory of 3528	344	c8f936101c73ab575fc23509da09a250N.exe	115
PID 344 wrote to memory of 3528	344	c8f936101c73ab575fc23509da09a250N.exe	115
PID 344 wrote to memory of 4048	344	c8f936101c73ab575fc23509da09a250N.exe	116
PID 344 wrote to memory of 4048	344	c8f936101c73ab575fc23509da09a250N.exe	116

C:\Users\Admin\AppData\Local\Temp\c8f936101c73ab575fc23509da09a250N.exe
"C:\Users\Admin\AppData\Local\Temp\c8f936101c73ab575fc23509da09a250N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\System\IlGNlJt.exe
  C:\Windows\System\IlGNlJt.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\VPIVWMu.exe
  C:\Windows\System\VPIVWMu.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\DeNGflP.exe
  C:\Windows\System\DeNGflP.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\ONARgQs.exe
  C:\Windows\System\ONARgQs.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\JxbIlbP.exe
  C:\Windows\System\JxbIlbP.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\BECVLzX.exe
  C:\Windows\System\BECVLzX.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\aPCjjyE.exe
  C:\Windows\System\aPCjjyE.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\jCiSOzS.exe
  C:\Windows\System\jCiSOzS.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\Fwwtqhp.exe
  C:\Windows\System\Fwwtqhp.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NtBSAIG.exe
  C:\Windows\System\NtBSAIG.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\JSYJpHM.exe
  C:\Windows\System\JSYJpHM.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\KAmCRME.exe
  C:\Windows\System\KAmCRME.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\RuHIPVh.exe
  C:\Windows\System\RuHIPVh.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\RlwJUsS.exe
  C:\Windows\System\RlwJUsS.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\pVAwoEY.exe
  C:\Windows\System\pVAwoEY.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\iwyyTAS.exe
  C:\Windows\System\iwyyTAS.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SgGFoxW.exe
  C:\Windows\System\SgGFoxW.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\LtScWGg.exe
  C:\Windows\System\LtScWGg.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\uNUyGLR.exe
  C:\Windows\System\uNUyGLR.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\GRdFxiV.exe
  C:\Windows\System\GRdFxiV.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\KDSiuXm.exe
  C:\Windows\System\KDSiuXm.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\HFGKfjP.exe
  C:\Windows\System\HFGKfjP.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\KxhJZhZ.exe
  C:\Windows\System\KxhJZhZ.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ljCZHcB.exe
  C:\Windows\System\ljCZHcB.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\vWNeCJn.exe
  C:\Windows\System\vWNeCJn.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\cIEjDZi.exe
  C:\Windows\System\cIEjDZi.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\AxIELDN.exe
  C:\Windows\System\AxIELDN.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\HWyBzvl.exe
  C:\Windows\System\HWyBzvl.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\XfXEElf.exe
  C:\Windows\System\XfXEElf.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\uWRUFim.exe
  C:\Windows\System\uWRUFim.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\GIvuMSY.exe
  C:\Windows\System\GIvuMSY.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\vSjQIHU.exe
  C:\Windows\System\vSjQIHU.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\ntIpzPq.exe
  C:\Windows\System\ntIpzPq.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\YyQQSGV.exe
  C:\Windows\System\YyQQSGV.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\IFyrQmo.exe
  C:\Windows\System\IFyrQmo.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\syUnRpE.exe
  C:\Windows\System\syUnRpE.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\vpXllyO.exe
  C:\Windows\System\vpXllyO.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\MnsJwWd.exe
  C:\Windows\System\MnsJwWd.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\xpZpyPb.exe
  C:\Windows\System\xpZpyPb.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\bnIemvI.exe
  C:\Windows\System\bnIemvI.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\LZTRZvF.exe
  C:\Windows\System\LZTRZvF.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\BRAtZjF.exe
  C:\Windows\System\BRAtZjF.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\EuPVwcL.exe
  C:\Windows\System\EuPVwcL.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\BpFDZjq.exe
  C:\Windows\System\BpFDZjq.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\QkbKDbk.exe
  C:\Windows\System\QkbKDbk.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\EvNeldK.exe
  C:\Windows\System\EvNeldK.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\bahMWEA.exe
  C:\Windows\System\bahMWEA.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\tAWGaRD.exe
  C:\Windows\System\tAWGaRD.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\QOvHFyv.exe
  C:\Windows\System\QOvHFyv.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\whGQAqZ.exe
  C:\Windows\System\whGQAqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\rEmYqoc.exe
  C:\Windows\System\rEmYqoc.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\kKhNTDm.exe
  C:\Windows\System\kKhNTDm.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\TINygBC.exe
  C:\Windows\System\TINygBC.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\aDqXvXk.exe
  C:\Windows\System\aDqXvXk.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\arDrfJo.exe
  C:\Windows\System\arDrfJo.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\kAcSpOk.exe
  C:\Windows\System\kAcSpOk.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\LWFPyQx.exe
  C:\Windows\System\LWFPyQx.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\VluPonY.exe
  C:\Windows\System\VluPonY.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\syxZTyD.exe
  C:\Windows\System\syxZTyD.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\QyGbjax.exe
  C:\Windows\System\QyGbjax.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\cueWSVA.exe
  C:\Windows\System\cueWSVA.exe
  2⤵
  PID:980
- C:\Windows\System\UdxMOGW.exe
  C:\Windows\System\UdxMOGW.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\XzfqoWc.exe
  C:\Windows\System\XzfqoWc.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\cIjvQja.exe
  C:\Windows\System\cIjvQja.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ZaRojOE.exe
  C:\Windows\System\ZaRojOE.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\cntiLRb.exe
  C:\Windows\System\cntiLRb.exe
  2⤵
  PID:3664
- C:\Windows\System\HEjVupk.exe
  C:\Windows\System\HEjVupk.exe
  2⤵
  PID:2216
- C:\Windows\System\upPLFSV.exe
  C:\Windows\System\upPLFSV.exe
  2⤵
  PID:4544
- C:\Windows\System\bgnoltn.exe
  C:\Windows\System\bgnoltn.exe
  2⤵
  PID:3020
- C:\Windows\System\EfDfsWU.exe
  C:\Windows\System\EfDfsWU.exe
  2⤵
  PID:4628
- C:\Windows\System\UyRJmxq.exe
  C:\Windows\System\UyRJmxq.exe
  2⤵
  PID:680
- C:\Windows\System\zDtGRuv.exe
  C:\Windows\System\zDtGRuv.exe
  2⤵
  PID:756
- C:\Windows\System\WgVtzLD.exe
  C:\Windows\System\WgVtzLD.exe
  2⤵
  PID:4608
- C:\Windows\System\oTNzQQw.exe
  C:\Windows\System\oTNzQQw.exe
  2⤵
  PID:1592
- C:\Windows\System\crhinZw.exe
  C:\Windows\System\crhinZw.exe
  2⤵
  PID:2084
- C:\Windows\System\mNFONJH.exe
  C:\Windows\System\mNFONJH.exe
  2⤵
  PID:2336
- C:\Windows\System\SEQJMPj.exe
  C:\Windows\System\SEQJMPj.exe
  2⤵
  PID:1680
- C:\Windows\System\oflLPBA.exe
  C:\Windows\System\oflLPBA.exe
  2⤵
  PID:5128
- C:\Windows\System\eqWUMcL.exe
  C:\Windows\System\eqWUMcL.exe
  2⤵
  PID:5156
- C:\Windows\System\jederDB.exe
  C:\Windows\System\jederDB.exe
  2⤵
  PID:5172
- C:\Windows\System\TSEoRbC.exe
  C:\Windows\System\TSEoRbC.exe
  2⤵
  PID:5192
- C:\Windows\System\xMZcRhm.exe
  C:\Windows\System\xMZcRhm.exe
  2⤵
  PID:5272
- C:\Windows\System\gjyfNkz.exe
  C:\Windows\System\gjyfNkz.exe
  2⤵
  PID:5288
- C:\Windows\System\hhFkEUt.exe
  C:\Windows\System\hhFkEUt.exe
  2⤵
  PID:5312
- C:\Windows\System\HXiUcOB.exe
  C:\Windows\System\HXiUcOB.exe
  2⤵
  PID:5392
- C:\Windows\System\PaSrXRR.exe
  C:\Windows\System\PaSrXRR.exe
  2⤵
  PID:5408
- C:\Windows\System\yjYLITe.exe
  C:\Windows\System\yjYLITe.exe
  2⤵
  PID:5428
- C:\Windows\System\sDrdEuq.exe
  C:\Windows\System\sDrdEuq.exe
  2⤵
  PID:5452
- C:\Windows\System\pxyBoLf.exe
  C:\Windows\System\pxyBoLf.exe
  2⤵
  PID:5468
- C:\Windows\System\DeTwedU.exe
  C:\Windows\System\DeTwedU.exe
  2⤵
  PID:5492
- C:\Windows\System\AubBYox.exe
  C:\Windows\System\AubBYox.exe
  2⤵
  PID:5508
- C:\Windows\System\FyqAfLD.exe
  C:\Windows\System\FyqAfLD.exe
  2⤵
  PID:5528
- C:\Windows\System\yXFgPNG.exe
  C:\Windows\System\yXFgPNG.exe
  2⤵
  PID:5552
- C:\Windows\System\azGqVyD.exe
  C:\Windows\System\azGqVyD.exe
  2⤵
  PID:5572
- C:\Windows\System\oKwNLsF.exe
  C:\Windows\System\oKwNLsF.exe
  2⤵
  PID:5592
- C:\Windows\System\nWyOUkO.exe
  C:\Windows\System\nWyOUkO.exe
  2⤵
  PID:5616
- C:\Windows\System\DbIBVSO.exe
  C:\Windows\System\DbIBVSO.exe
  2⤵
  PID:5636
- C:\Windows\System\HtreRyN.exe
  C:\Windows\System\HtreRyN.exe
  2⤵
  PID:5664
- C:\Windows\System\QNRCVWi.exe
  C:\Windows\System\QNRCVWi.exe
  2⤵
  PID:5680
- C:\Windows\System\kMXJHxS.exe
  C:\Windows\System\kMXJHxS.exe
  2⤵
  PID:5696
- C:\Windows\System\dcSwRgD.exe
  C:\Windows\System\dcSwRgD.exe
  2⤵
  PID:5716
- C:\Windows\System\XchTWYD.exe
  C:\Windows\System\XchTWYD.exe
  2⤵
  PID:5736
- C:\Windows\System\prOlXLx.exe
  C:\Windows\System\prOlXLx.exe
  2⤵
  PID:5756
- C:\Windows\System\YzoCnaP.exe
  C:\Windows\System\YzoCnaP.exe
  2⤵
  PID:5776
- C:\Windows\System\dgKDlBC.exe
  C:\Windows\System\dgKDlBC.exe
  2⤵
  PID:5800
- C:\Windows\System\aYDhtFu.exe
  C:\Windows\System\aYDhtFu.exe
  2⤵
  PID:5852
- C:\Windows\System\KkmFFOX.exe
  C:\Windows\System\KkmFFOX.exe
  2⤵
  PID:5868
- C:\Windows\System\XmHBzQY.exe
  C:\Windows\System\XmHBzQY.exe
  2⤵
  PID:5900
- C:\Windows\System\hIZvGZd.exe
  C:\Windows\System\hIZvGZd.exe
  2⤵
  PID:5916
- C:\Windows\System\wFdKHeI.exe
  C:\Windows\System\wFdKHeI.exe
  2⤵
  PID:5932
- C:\Windows\System\zUDYaaw.exe
  C:\Windows\System\zUDYaaw.exe
  2⤵
  PID:5952
- C:\Windows\System\xDVxxly.exe
  C:\Windows\System\xDVxxly.exe
  2⤵
  PID:5972
- C:\Windows\System\RtuVDrw.exe
  C:\Windows\System\RtuVDrw.exe
  2⤵
  PID:5988
- C:\Windows\System\PGzhBcw.exe
  C:\Windows\System\PGzhBcw.exe
  2⤵
  PID:6012
- C:\Windows\System\FtZujYI.exe
  C:\Windows\System\FtZujYI.exe
  2⤵
  PID:6036
- C:\Windows\System\PvtLykf.exe
  C:\Windows\System\PvtLykf.exe
  2⤵
  PID:6052
- C:\Windows\System\uQELRhl.exe
  C:\Windows\System\uQELRhl.exe
  2⤵
  PID:6076
- C:\Windows\System\KFuIzTI.exe
  C:\Windows\System\KFuIzTI.exe
  2⤵
  PID:6096
- C:\Windows\System\rkIfAMM.exe
  C:\Windows\System\rkIfAMM.exe
  2⤵
  PID:6116
- C:\Windows\System\buWiokY.exe
  C:\Windows\System\buWiokY.exe
  2⤵
  PID:6132
- C:\Windows\System\fgIUSiU.exe
  C:\Windows\System\fgIUSiU.exe
  2⤵
  PID:2400
- C:\Windows\System\aTHPLJz.exe
  C:\Windows\System\aTHPLJz.exe
  2⤵
  PID:1692
- C:\Windows\System\GfTdaVA.exe
  C:\Windows\System\GfTdaVA.exe
  2⤵
  PID:1588
- C:\Windows\System\zJoJyba.exe
  C:\Windows\System\zJoJyba.exe
  2⤵
  PID:2856
- C:\Windows\System\xnGjLVx.exe
  C:\Windows\System\xnGjLVx.exe
  2⤵
  PID:5124
- C:\Windows\System\KZoYcmC.exe
  C:\Windows\System\KZoYcmC.exe
  2⤵
  PID:4240
- C:\Windows\System\IqUxYye.exe
  C:\Windows\System\IqUxYye.exe
  2⤵
  PID:2352
- C:\Windows\System\qgBgIJI.exe
  C:\Windows\System\qgBgIJI.exe
  2⤵
  PID:1648
- C:\Windows\System\pNpPeHJ.exe
  C:\Windows\System\pNpPeHJ.exe
  2⤵
  PID:3608
- C:\Windows\System\AVNMUYZ.exe
  C:\Windows\System\AVNMUYZ.exe
  2⤵
  PID:1968
- C:\Windows\System\YHouBkM.exe
  C:\Windows\System\YHouBkM.exe
  2⤵
  PID:5864
- C:\Windows\System\GANtnRE.exe
  C:\Windows\System\GANtnRE.exe
  2⤵
  PID:4156
- C:\Windows\System\rwodFVw.exe
  C:\Windows\System\rwodFVw.exe
  2⤵
  PID:5140
- C:\Windows\System\WSNdmSH.exe
  C:\Windows\System\WSNdmSH.exe
  2⤵
  PID:1848
- C:\Windows\System\mEcDpZX.exe
  C:\Windows\System\mEcDpZX.exe
  2⤵
  PID:5628
- C:\Windows\System\ltWbUkp.exe
  C:\Windows\System\ltWbUkp.exe
  2⤵
  PID:3828
- C:\Windows\System\aCWoFmW.exe
  C:\Windows\System\aCWoFmW.exe
  2⤵
  PID:6148
- C:\Windows\System\rKXaYwN.exe
  C:\Windows\System\rKXaYwN.exe
  2⤵
  PID:6176
- C:\Windows\System\JJgpjZg.exe
  C:\Windows\System\JJgpjZg.exe
  2⤵
  PID:6192
- C:\Windows\System\xOZperM.exe
  C:\Windows\System\xOZperM.exe
  2⤵
  PID:6232
- C:\Windows\System\fSWYxAG.exe
  C:\Windows\System\fSWYxAG.exe
  2⤵
  PID:6248
- C:\Windows\System\ugnETyt.exe
  C:\Windows\System\ugnETyt.exe
  2⤵
  PID:6264
- C:\Windows\System\thEsBjH.exe
  C:\Windows\System\thEsBjH.exe
  2⤵
  PID:6280
- C:\Windows\System\NyCvSRs.exe
  C:\Windows\System\NyCvSRs.exe
  2⤵
  PID:6300
- C:\Windows\System\UzXKgPd.exe
  C:\Windows\System\UzXKgPd.exe
  2⤵
  PID:6328
- C:\Windows\System\pzXesbo.exe
  C:\Windows\System\pzXesbo.exe
  2⤵
  PID:6344
- C:\Windows\System\CeulTPa.exe
  C:\Windows\System\CeulTPa.exe
  2⤵
  PID:6360
- C:\Windows\System\jMUHHbM.exe
  C:\Windows\System\jMUHHbM.exe
  2⤵
  PID:6376
- C:\Windows\System\hYQRMnd.exe
  C:\Windows\System\hYQRMnd.exe
  2⤵
  PID:6404
- C:\Windows\System\PKDEofN.exe
  C:\Windows\System\PKDEofN.exe
  2⤵
  PID:6420
- C:\Windows\System\BjfdMmd.exe
  C:\Windows\System\BjfdMmd.exe
  2⤵
  PID:6440
- C:\Windows\System\FPCylrM.exe
  C:\Windows\System\FPCylrM.exe
  2⤵
  PID:6456
- C:\Windows\System\raHYClx.exe
  C:\Windows\System\raHYClx.exe
  2⤵
  PID:6476
- C:\Windows\System\ucoPwQD.exe
  C:\Windows\System\ucoPwQD.exe
  2⤵
  PID:6492
- C:\Windows\System\wjokncO.exe
  C:\Windows\System\wjokncO.exe
  2⤵
  PID:6508
- C:\Windows\System\ulRcwMT.exe
  C:\Windows\System\ulRcwMT.exe
  2⤵
  PID:6532
- C:\Windows\System\nPFKWlA.exe
  C:\Windows\System\nPFKWlA.exe
  2⤵
  PID:6548
- C:\Windows\System\lWbnBeq.exe
  C:\Windows\System\lWbnBeq.exe
  2⤵
  PID:6564
- C:\Windows\System\czuAjqX.exe
  C:\Windows\System\czuAjqX.exe
  2⤵
  PID:6584
- C:\Windows\System\rHcyIbM.exe
  C:\Windows\System\rHcyIbM.exe
  2⤵
  PID:6612
- C:\Windows\System\izwsVxA.exe
  C:\Windows\System\izwsVxA.exe
  2⤵
  PID:6636
- C:\Windows\System\MVQFIsp.exe
  C:\Windows\System\MVQFIsp.exe
  2⤵
  PID:6656
- C:\Windows\System\eazQJIh.exe
  C:\Windows\System\eazQJIh.exe
  2⤵
  PID:6676
- C:\Windows\System\zMmTaOr.exe
  C:\Windows\System\zMmTaOr.exe
  2⤵
  PID:6696
- C:\Windows\System\HomgwKT.exe
  C:\Windows\System\HomgwKT.exe
  2⤵
  PID:6720
- C:\Windows\System\NIqlcCv.exe
  C:\Windows\System\NIqlcCv.exe
  2⤵
  PID:6740
- C:\Windows\System\RlXdNjQ.exe
  C:\Windows\System\RlXdNjQ.exe
  2⤵
  PID:6756
- C:\Windows\System\GTDZTDv.exe
  C:\Windows\System\GTDZTDv.exe
  2⤵
  PID:6780
- C:\Windows\System\PWtIGJg.exe
  C:\Windows\System\PWtIGJg.exe
  2⤵
  PID:6808
- C:\Windows\System\wbpqkNc.exe
  C:\Windows\System\wbpqkNc.exe
  2⤵
  PID:6824
- C:\Windows\System\FeIKZEv.exe
  C:\Windows\System\FeIKZEv.exe
  2⤵
  PID:6852
- C:\Windows\System\zFsWvXY.exe
  C:\Windows\System\zFsWvXY.exe
  2⤵
  PID:6876
- C:\Windows\System\nkwvwEa.exe
  C:\Windows\System\nkwvwEa.exe
  2⤵
  PID:6908
- C:\Windows\System\zlUJWTD.exe
  C:\Windows\System\zlUJWTD.exe
  2⤵
  PID:6924
- C:\Windows\System\CRVwsoa.exe
  C:\Windows\System\CRVwsoa.exe
  2⤵
  PID:6944
- C:\Windows\System\dPNdQsB.exe
  C:\Windows\System\dPNdQsB.exe
  2⤵
  PID:6960
- C:\Windows\System\tXlnuBo.exe
  C:\Windows\System\tXlnuBo.exe
  2⤵
  PID:6980
- C:\Windows\System\jgtvZeE.exe
  C:\Windows\System\jgtvZeE.exe
  2⤵
  PID:6996
- C:\Windows\System\UWmFbCp.exe
  C:\Windows\System\UWmFbCp.exe
  2⤵
  PID:7012
- C:\Windows\System\lfIOyVj.exe
  C:\Windows\System\lfIOyVj.exe
  2⤵
  PID:7028
- C:\Windows\System\zBtGpUR.exe
  C:\Windows\System\zBtGpUR.exe
  2⤵
  PID:7068
- C:\Windows\System\lObIJzt.exe
  C:\Windows\System\lObIJzt.exe
  2⤵
  PID:7084
- C:\Windows\System\IExamvu.exe
  C:\Windows\System\IExamvu.exe
  2⤵
  PID:7100
- C:\Windows\System\IFuYuwv.exe
  C:\Windows\System\IFuYuwv.exe
  2⤵
  PID:7124
- C:\Windows\System\ecbJAIR.exe
  C:\Windows\System\ecbJAIR.exe
  2⤵
  PID:7140
- C:\Windows\System\kSjFRpt.exe
  C:\Windows\System\kSjFRpt.exe
  2⤵
  PID:7156
- C:\Windows\System\pRPXmSx.exe
  C:\Windows\System\pRPXmSx.exe
  2⤵
  PID:5220
- C:\Windows\System\hDJuWYh.exe
  C:\Windows\System\hDJuWYh.exe
  2⤵
  PID:5248
- C:\Windows\System\iyjmrgl.exe
  C:\Windows\System\iyjmrgl.exe
  2⤵
  PID:5280
- C:\Windows\System\DHgaPio.exe
  C:\Windows\System\DHgaPio.exe
  2⤵
  PID:5368
- C:\Windows\System\YFhIoWh.exe
  C:\Windows\System\YFhIoWh.exe
  2⤵
  PID:5404
- C:\Windows\System\pFuXXGC.exe
  C:\Windows\System\pFuXXGC.exe
  2⤵
  PID:5480
- C:\Windows\System\UShaetk.exe
  C:\Windows\System\UShaetk.exe
  2⤵
  PID:5544
- C:\Windows\System\GujwcGz.exe
  C:\Windows\System\GujwcGz.exe
  2⤵
  PID:4968
- C:\Windows\System\DmjAbpx.exe
  C:\Windows\System\DmjAbpx.exe
  2⤵
  PID:6124
- C:\Windows\System\YtcePgq.exe
  C:\Windows\System\YtcePgq.exe
  2⤵
  PID:5964
- C:\Windows\System\wgABgPs.exe
  C:\Windows\System\wgABgPs.exe
  2⤵
  PID:5808
- C:\Windows\System\MuKblro.exe
  C:\Windows\System\MuKblro.exe
  2⤵
  PID:5672
- C:\Windows\System\uZfcOmp.exe
  C:\Windows\System\uZfcOmp.exe
  2⤵
  PID:3996
- C:\Windows\System\bUdjyhe.exe
  C:\Windows\System\bUdjyhe.exe
  2⤵
  PID:1064
- C:\Windows\System\xHDbxOY.exe
  C:\Windows\System\xHDbxOY.exe
  2⤵
  PID:5704
- C:\Windows\System\YqkKOSj.exe
  C:\Windows\System\YqkKOSj.exe
  2⤵
  PID:5748
- C:\Windows\System\aAQxXog.exe
  C:\Windows\System\aAQxXog.exe
  2⤵
  PID:6244
- C:\Windows\System\osoktOE.exe
  C:\Windows\System\osoktOE.exe
  2⤵
  PID:5888
- C:\Windows\System\CQzARLl.exe
  C:\Windows\System\CQzARLl.exe
  2⤵
  PID:5984
- C:\Windows\System\Cnlcknv.exe
  C:\Windows\System\Cnlcknv.exe
  2⤵
  PID:6028
- C:\Windows\System\IzvnXcH.exe
  C:\Windows\System\IzvnXcH.exe
  2⤵
  PID:512
- C:\Windows\System\wGJaDlf.exe
  C:\Windows\System\wGJaDlf.exe
  2⤵
  PID:6432
- C:\Windows\System\gGOMviy.exe
  C:\Windows\System\gGOMviy.exe
  2⤵
  PID:6520
- C:\Windows\System\pLqJlIS.exe
  C:\Windows\System\pLqJlIS.exe
  2⤵
  PID:6620
- C:\Windows\System\KlYpVVl.exe
  C:\Windows\System\KlYpVVl.exe
  2⤵
  PID:5656
- C:\Windows\System\JFwpwOZ.exe
  C:\Windows\System\JFwpwOZ.exe
  2⤵
  PID:1268
- C:\Windows\System\ExYerjJ.exe
  C:\Windows\System\ExYerjJ.exe
  2⤵
  PID:7180
- C:\Windows\System\FRvRyqw.exe
  C:\Windows\System\FRvRyqw.exe
  2⤵
  PID:7204
- C:\Windows\System\wymewGS.exe
  C:\Windows\System\wymewGS.exe
  2⤵
  PID:7228
- C:\Windows\System\aortQGK.exe
  C:\Windows\System\aortQGK.exe
  2⤵
  PID:7248
- C:\Windows\System\gaBnqYJ.exe
  C:\Windows\System\gaBnqYJ.exe
  2⤵
  PID:7272
- C:\Windows\System\XLbYtqm.exe
  C:\Windows\System\XLbYtqm.exe
  2⤵
  PID:7288
- C:\Windows\System\ahjRmTD.exe
  C:\Windows\System\ahjRmTD.exe
  2⤵
  PID:7312
- C:\Windows\System\migTTCJ.exe
  C:\Windows\System\migTTCJ.exe
  2⤵
  PID:7328
- C:\Windows\System\VorSzmT.exe
  C:\Windows\System\VorSzmT.exe
  2⤵
  PID:7352
- C:\Windows\System\cERHfPX.exe
  C:\Windows\System\cERHfPX.exe
  2⤵
  PID:7376
- C:\Windows\System\EHfOsgs.exe
  C:\Windows\System\EHfOsgs.exe
  2⤵
  PID:7400
- C:\Windows\System\cgAgqJy.exe
  C:\Windows\System\cgAgqJy.exe
  2⤵
  PID:7420
- C:\Windows\System\pmoCOxN.exe
  C:\Windows\System\pmoCOxN.exe
  2⤵
  PID:7436
- C:\Windows\System\axruxBZ.exe
  C:\Windows\System\axruxBZ.exe
  2⤵
  PID:7624
- C:\Windows\System\lkvHBkY.exe
  C:\Windows\System\lkvHBkY.exe
  2⤵
  PID:7640
- C:\Windows\System\RLgEiYx.exe
  C:\Windows\System\RLgEiYx.exe
  2⤵
  PID:7656
- C:\Windows\System\iBlXbpo.exe
  C:\Windows\System\iBlXbpo.exe
  2⤵
  PID:7672
- C:\Windows\System\miwGHhR.exe
  C:\Windows\System\miwGHhR.exe
  2⤵
  PID:7688
- C:\Windows\System\DogYAIe.exe
  C:\Windows\System\DogYAIe.exe
  2⤵
  PID:7704
- C:\Windows\System\sAztnXX.exe
  C:\Windows\System\sAztnXX.exe
  2⤵
  PID:7720
- C:\Windows\System\AykNUZt.exe
  C:\Windows\System\AykNUZt.exe
  2⤵
  PID:7736
- C:\Windows\System\PXglCdW.exe
  C:\Windows\System\PXglCdW.exe
  2⤵
  PID:7752
- C:\Windows\System\ohcVdMv.exe
  C:\Windows\System\ohcVdMv.exe
  2⤵
  PID:7768
- C:\Windows\System\PvObkiH.exe
  C:\Windows\System\PvObkiH.exe
  2⤵
  PID:7784
- C:\Windows\System\OZWAWbf.exe
  C:\Windows\System\OZWAWbf.exe
  2⤵
  PID:7800
- C:\Windows\System\qHYjeht.exe
  C:\Windows\System\qHYjeht.exe
  2⤵
  PID:7816
- C:\Windows\System\wUkLCzW.exe
  C:\Windows\System\wUkLCzW.exe
  2⤵
  PID:7836
- C:\Windows\System\LLnjFZM.exe
  C:\Windows\System\LLnjFZM.exe
  2⤵
  PID:7852
- C:\Windows\System\wcYYSjq.exe
  C:\Windows\System\wcYYSjq.exe
  2⤵
  PID:7868
- C:\Windows\System\oCuUAJI.exe
  C:\Windows\System\oCuUAJI.exe
  2⤵
  PID:7888
- C:\Windows\System\QLNxqIh.exe
  C:\Windows\System\QLNxqIh.exe
  2⤵
  PID:7956
- C:\Windows\System\ySsoHXB.exe
  C:\Windows\System\ySsoHXB.exe
  2⤵
  PID:7972
- C:\Windows\System\gXxywuh.exe
  C:\Windows\System\gXxywuh.exe
  2⤵
  PID:8144
- C:\Windows\System\zKHNrBd.exe
  C:\Windows\System\zKHNrBd.exe
  2⤵
  PID:8164
- C:\Windows\System\gCOZGTz.exe
  C:\Windows\System\gCOZGTz.exe
  2⤵
  PID:7164
- C:\Windows\System\DcAzvij.exe
  C:\Windows\System\DcAzvij.exe
  2⤵
  PID:6372
- C:\Windows\System\hDjamrZ.exe
  C:\Windows\System\hDjamrZ.exe
  2⤵
  PID:6296
- C:\Windows\System\EBNAZkU.exe
  C:\Windows\System\EBNAZkU.exe
  2⤵
  PID:6256
- C:\Windows\System\WbBjkiC.exe
  C:\Windows\System\WbBjkiC.exe
  2⤵
  PID:6200
- C:\Windows\System\LEzPTyS.exe
  C:\Windows\System\LEzPTyS.exe
  2⤵
  PID:1440
- C:\Windows\System\MFWumBu.exe
  C:\Windows\System\MFWumBu.exe
  2⤵
  PID:3820
- C:\Windows\System\zVTNbvs.exe
  C:\Windows\System\zVTNbvs.exe
  2⤵
  PID:5320
- C:\Windows\System\LuPOOXf.exe
  C:\Windows\System\LuPOOXf.exe
  2⤵
  PID:6428
- C:\Windows\System\hLlfxto.exe
  C:\Windows\System\hLlfxto.exe
  2⤵
  PID:6472
- C:\Windows\System\yKhosXW.exe
  C:\Windows\System\yKhosXW.exe
  2⤵
  PID:6604
- C:\Windows\System\UhbqjGt.exe
  C:\Windows\System\UhbqjGt.exe
  2⤵
  PID:6672
- C:\Windows\System\WubcQZy.exe
  C:\Windows\System\WubcQZy.exe
  2⤵
  PID:6816
- C:\Windows\System\CebffcV.exe
  C:\Windows\System\CebffcV.exe
  2⤵
  PID:6848
- C:\Windows\System\OJSCZct.exe
  C:\Windows\System\OJSCZct.exe
  2⤵
  PID:6920
- C:\Windows\System\ZaLIpdT.exe
  C:\Windows\System\ZaLIpdT.exe
  2⤵
  PID:6968
- C:\Windows\System\uYaRsXG.exe
  C:\Windows\System\uYaRsXG.exe
  2⤵
  PID:7004
- C:\Windows\System\uDLgiYI.exe
  C:\Windows\System\uDLgiYI.exe
  2⤵
  PID:5420
- C:\Windows\System\fXIOWmg.exe
  C:\Windows\System\fXIOWmg.exe
  2⤵
  PID:5792
- C:\Windows\System\uKqcQyt.exe
  C:\Windows\System\uKqcQyt.exe
  2⤵
  PID:7192
- C:\Windows\System\cPjfGpk.exe
  C:\Windows\System\cPjfGpk.exe
  2⤵
  PID:7396
- C:\Windows\System\hucLYZV.exe
  C:\Windows\System\hucLYZV.exe
  2⤵
  PID:1416
- C:\Windows\System\prOmvBM.exe
  C:\Windows\System\prOmvBM.exe
  2⤵
  PID:7076
- C:\Windows\System\qVilKuc.exe
  C:\Windows\System\qVilKuc.exe
  2⤵
  PID:7132
- C:\Windows\System\Ckhnilk.exe
  C:\Windows\System\Ckhnilk.exe
  2⤵
  PID:5212
- C:\Windows\System\RaDnMsC.exe
  C:\Windows\System\RaDnMsC.exe
  2⤵
  PID:5356
- C:\Windows\System\OUpxIjk.exe
  C:\Windows\System\OUpxIjk.exe
  2⤵
  PID:6112
- C:\Windows\System\XsAyOPU.exe
  C:\Windows\System\XsAyOPU.exe
  2⤵
  PID:5688
- C:\Windows\System\HFpuSOD.exe
  C:\Windows\System\HFpuSOD.exe
  2⤵
  PID:5728
- C:\Windows\System\hNgrSac.exe
  C:\Windows\System\hNgrSac.exe
  2⤵
  PID:5708
- C:\Windows\System\oHDaySd.exe
  C:\Windows\System\oHDaySd.exe
  2⤵
  PID:5824
- C:\Windows\System\SqHtded.exe
  C:\Windows\System\SqHtded.exe
  2⤵
  PID:2344
- C:\Windows\System\WItzHPx.exe
  C:\Windows\System\WItzHPx.exe
  2⤵
  PID:6600
- C:\Windows\System\hVuFzUA.exe
  C:\Windows\System\hVuFzUA.exe
  2⤵
  PID:5236
- C:\Windows\System\oEmCzrH.exe
  C:\Windows\System\oEmCzrH.exe
  2⤵
  PID:7244
- C:\Windows\System\RnYulyZ.exe
  C:\Windows\System\RnYulyZ.exe
  2⤵
  PID:7308
- C:\Windows\System\FnxvUww.exe
  C:\Windows\System\FnxvUww.exe
  2⤵
  PID:7372
- C:\Windows\System\lmkpOhh.exe
  C:\Windows\System\lmkpOhh.exe
  2⤵
  PID:7416
- C:\Windows\System\IJADQXn.exe
  C:\Windows\System\IJADQXn.exe
  2⤵
  PID:8208
- C:\Windows\System\FJHvxEW.exe
  C:\Windows\System\FJHvxEW.exe
  2⤵
  PID:8232
- C:\Windows\System\PRRMDPy.exe
  C:\Windows\System\PRRMDPy.exe
  2⤵
  PID:8252
- C:\Windows\System\TGazAWI.exe
  C:\Windows\System\TGazAWI.exe
  2⤵
  PID:8276
- C:\Windows\System\TbMQsSz.exe
  C:\Windows\System\TbMQsSz.exe
  2⤵
  PID:8304
- C:\Windows\System\ECMkeNV.exe
  C:\Windows\System\ECMkeNV.exe
  2⤵
  PID:8320
- C:\Windows\System\lqlILDT.exe
  C:\Windows\System\lqlILDT.exe
  2⤵
  PID:8340
- C:\Windows\System\nVjZrqy.exe
  C:\Windows\System\nVjZrqy.exe
  2⤵
  PID:8368
- C:\Windows\System\CKSOkkp.exe
  C:\Windows\System\CKSOkkp.exe
  2⤵
  PID:8392
- C:\Windows\System\PWlPcRx.exe
  C:\Windows\System\PWlPcRx.exe
  2⤵
  PID:8416
- C:\Windows\System\ADZLgue.exe
  C:\Windows\System\ADZLgue.exe
  2⤵
  PID:8444
- C:\Windows\System\cembptv.exe
  C:\Windows\System\cembptv.exe
  2⤵
  PID:8464
- C:\Windows\System\jFEhjVk.exe
  C:\Windows\System\jFEhjVk.exe
  2⤵
  PID:8488
- C:\Windows\System\TQqmvKc.exe
  C:\Windows\System\TQqmvKc.exe
  2⤵
  PID:8512
- C:\Windows\System\pFSaPLb.exe
  C:\Windows\System\pFSaPLb.exe
  2⤵
  PID:8536
- C:\Windows\System\GgnoilT.exe
  C:\Windows\System\GgnoilT.exe
  2⤵
  PID:8556
- C:\Windows\System\nvCDugY.exe
  C:\Windows\System\nvCDugY.exe
  2⤵
  PID:8572
- C:\Windows\System\TAMVLAV.exe
  C:\Windows\System\TAMVLAV.exe
  2⤵
  PID:8588
- C:\Windows\System\quyqOuw.exe
  C:\Windows\System\quyqOuw.exe
  2⤵
  PID:8604
- C:\Windows\System\aMsrxhH.exe
  C:\Windows\System\aMsrxhH.exe
  2⤵
  PID:8624
- C:\Windows\System\jPHdfei.exe
  C:\Windows\System\jPHdfei.exe
  2⤵
  PID:8644
- C:\Windows\System\iRMlvwZ.exe
  C:\Windows\System\iRMlvwZ.exe
  2⤵
  PID:8660
- C:\Windows\System\uezDcvq.exe
  C:\Windows\System\uezDcvq.exe
  2⤵
  PID:8680
- C:\Windows\System\iToGFxV.exe
  C:\Windows\System\iToGFxV.exe
  2⤵
  PID:8700
- C:\Windows\System\XmKUCqE.exe
  C:\Windows\System\XmKUCqE.exe
  2⤵
  PID:8720
- C:\Windows\System\UcoRzmz.exe
  C:\Windows\System\UcoRzmz.exe
  2⤵
  PID:8736
- C:\Windows\System\zDbUSsl.exe
  C:\Windows\System\zDbUSsl.exe
  2⤵
  PID:8756
- C:\Windows\System\GcshjID.exe
  C:\Windows\System\GcshjID.exe
  2⤵
  PID:8776
- C:\Windows\System\SJOemHW.exe
  C:\Windows\System\SJOemHW.exe
  2⤵
  PID:8792
- C:\Windows\System\oJpqpZn.exe
  C:\Windows\System\oJpqpZn.exe
  2⤵
  PID:8812
- C:\Windows\System\vduktQD.exe
  C:\Windows\System\vduktQD.exe
  2⤵
  PID:8832
- C:\Windows\System\wPcvNxV.exe
  C:\Windows\System\wPcvNxV.exe
  2⤵
  PID:8852
- C:\Windows\System\otsUAZM.exe
  C:\Windows\System\otsUAZM.exe
  2⤵
  PID:8868
- C:\Windows\System\elnjtRT.exe
  C:\Windows\System\elnjtRT.exe
  2⤵
  PID:8888
- C:\Windows\System\OSIYVVz.exe
  C:\Windows\System\OSIYVVz.exe
  2⤵
  PID:8908
- C:\Windows\System\ypaZinG.exe
  C:\Windows\System\ypaZinG.exe
  2⤵
  PID:8924
- C:\Windows\System\zFpmSud.exe
  C:\Windows\System\zFpmSud.exe
  2⤵
  PID:8944
- C:\Windows\System\XApRJhY.exe
  C:\Windows\System\XApRJhY.exe
  2⤵
  PID:8964
- C:\Windows\System\LHOakrW.exe
  C:\Windows\System\LHOakrW.exe
  2⤵
  PID:8984
- C:\Windows\System\DViINVT.exe
  C:\Windows\System\DViINVT.exe
  2⤵
  PID:9000
- C:\Windows\System\VXmAKMm.exe
  C:\Windows\System\VXmAKMm.exe
  2⤵
  PID:9020
- C:\Windows\System\xIBNWzE.exe
  C:\Windows\System\xIBNWzE.exe
  2⤵
  PID:9040
- C:\Windows\System\ltxhaZR.exe
  C:\Windows\System\ltxhaZR.exe
  2⤵
  PID:9056
- C:\Windows\System\TnHueCa.exe
  C:\Windows\System\TnHueCa.exe
  2⤵
  PID:9076
- C:\Windows\System\xhaIgzq.exe
  C:\Windows\System\xhaIgzq.exe
  2⤵
  PID:9096
- C:\Windows\System\sLzTgJj.exe
  C:\Windows\System\sLzTgJj.exe
  2⤵
  PID:9116
- C:\Windows\System\kbkiYdE.exe
  C:\Windows\System\kbkiYdE.exe
  2⤵
  PID:9132
- C:\Windows\System\CFURphx.exe
  C:\Windows\System\CFURphx.exe
  2⤵
  PID:9152
- C:\Windows\System\qHntJtP.exe
  C:\Windows\System\qHntJtP.exe
  2⤵
  PID:9172
- C:\Windows\System\ZywRuMb.exe
  C:\Windows\System\ZywRuMb.exe
  2⤵
  PID:9192
- C:\Windows\System\nLsFWLX.exe
  C:\Windows\System\nLsFWLX.exe
  2⤵
  PID:9208
- C:\Windows\System\qsziIVh.exe
  C:\Windows\System\qsziIVh.exe
  2⤵
  PID:9232
- C:\Windows\System\JIgySMy.exe
  C:\Windows\System\JIgySMy.exe
  2⤵
  PID:9256
- C:\Windows\System\NpLZSAy.exe
  C:\Windows\System\NpLZSAy.exe
  2⤵
  PID:9272
- C:\Windows\System\hKDJtFu.exe
  C:\Windows\System\hKDJtFu.exe
  2⤵
  PID:9296
- C:\Windows\System\JXgMBDV.exe
  C:\Windows\System\JXgMBDV.exe
  2⤵
  PID:9316
- C:\Windows\System\paLyAIE.exe
  C:\Windows\System\paLyAIE.exe
  2⤵
  PID:9332
- C:\Windows\System\ThEoemg.exe
  C:\Windows\System\ThEoemg.exe
  2⤵
  PID:9576
- C:\Windows\System\GwhzGgC.exe
  C:\Windows\System\GwhzGgC.exe
  2⤵
  PID:9596
- C:\Windows\System\VDLfAZO.exe
  C:\Windows\System\VDLfAZO.exe
  2⤵
  PID:9612
- C:\Windows\System\vdDEKbw.exe
  C:\Windows\System\vdDEKbw.exe
  2⤵
  PID:9628
- C:\Windows\System\cHnOZVQ.exe
  C:\Windows\System\cHnOZVQ.exe
  2⤵
  PID:9648
- C:\Windows\System\QSETNMZ.exe
  C:\Windows\System\QSETNMZ.exe
  2⤵
  PID:9664
- C:\Windows\System\nBIUDIX.exe
  C:\Windows\System\nBIUDIX.exe
  2⤵
  PID:9680
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9680 -s 240
    3⤵
    PID:1952
- C:\Windows\System\ADaioiu.exe
  C:\Windows\System\ADaioiu.exe
  2⤵
  PID:9696
- C:\Windows\System\CAZzZuP.exe
  C:\Windows\System\CAZzZuP.exe
  2⤵
  PID:9712
- C:\Windows\System\ECqWWvD.exe
  C:\Windows\System\ECqWWvD.exe
  2⤵
  PID:9728
- C:\Windows\System\LwCwhNS.exe
  C:\Windows\System\LwCwhNS.exe
  2⤵
  PID:9752
- C:\Windows\System\PvYSzPI.exe
  C:\Windows\System\PvYSzPI.exe
  2⤵
  PID:9768
- C:\Windows\System\lvjMxfx.exe
  C:\Windows\System\lvjMxfx.exe
  2⤵
  PID:9788
- C:\Windows\System\HdRepVB.exe
  C:\Windows\System\HdRepVB.exe
  2⤵
  PID:9812
- C:\Windows\System\ThyVNFk.exe
  C:\Windows\System\ThyVNFk.exe
  2⤵
  PID:9844
- C:\Windows\System\IoVsQxO.exe
  C:\Windows\System\IoVsQxO.exe
  2⤵
  PID:9860
- C:\Windows\System\mWbAaFY.exe
  C:\Windows\System\mWbAaFY.exe
  2⤵
  PID:9880
- C:\Windows\System\hQXhKIj.exe
  C:\Windows\System\hQXhKIj.exe
  2⤵
  PID:9912
- C:\Windows\System\xoqCCPz.exe
  C:\Windows\System\xoqCCPz.exe
  2⤵
  PID:9940
- C:\Windows\System\SjHVceh.exe
  C:\Windows\System\SjHVceh.exe
  2⤵
  PID:9968
- C:\Windows\System\ZJOsAXK.exe
  C:\Windows\System\ZJOsAXK.exe
  2⤵
  PID:10008
- C:\Windows\System\UJKspQH.exe
  C:\Windows\System\UJKspQH.exe
  2⤵
  PID:10024
- C:\Windows\System\gjJANKi.exe
  C:\Windows\System\gjJANKi.exe
  2⤵
  PID:10056
- C:\Windows\System\YtATOgl.exe
  C:\Windows\System\YtATOgl.exe
  2⤵
  PID:10080
- C:\Windows\System\sUsLFzD.exe
  C:\Windows\System\sUsLFzD.exe
  2⤵
  PID:10104
- C:\Windows\System\qDtsfOZ.exe
  C:\Windows\System\qDtsfOZ.exe
  2⤵
  PID:10140
- C:\Windows\System\WarQlAP.exe
  C:\Windows\System\WarQlAP.exe
  2⤵
  PID:10156
- C:\Windows\System\glqONaM.exe
  C:\Windows\System\glqONaM.exe
  2⤵
  PID:10192
- C:\Windows\System\ZNhBMFZ.exe
  C:\Windows\System\ZNhBMFZ.exe
  2⤵
  PID:10216
- C:\Windows\System\AhWHFSH.exe
  C:\Windows\System\AhWHFSH.exe
  2⤵
  PID:10232
- C:\Windows\System\ZrUfhEE.exe
  C:\Windows\System\ZrUfhEE.exe
  2⤵
  PID:6308
- C:\Windows\System\zxiQDVJ.exe
  C:\Windows\System\zxiQDVJ.exe
  2⤵
  PID:5112
- C:\Windows\System\ERIkwVP.exe
  C:\Windows\System\ERIkwVP.exe
  2⤵
  PID:6632
- C:\Windows\System\CLBqsBN.exe
  C:\Windows\System\CLBqsBN.exe
  2⤵
  PID:7052
- C:\Windows\System\awmDSrb.exe
  C:\Windows\System\awmDSrb.exe
  2⤵
  PID:5692
- C:\Windows\System\TRiSTrO.exe
  C:\Windows\System\TRiSTrO.exe
  2⤵
  PID:7336
- C:\Windows\System\itsYtFG.exe
  C:\Windows\System\itsYtFG.exe
  2⤵
  PID:6024
- C:\Windows\System\dFwmWtg.exe
  C:\Windows\System\dFwmWtg.exe
  2⤵
  PID:7412
- C:\Windows\System\shCXVxq.exe
  C:\Windows\System\shCXVxq.exe
  2⤵
  PID:8380
- C:\Windows\System\ZpvoSvN.exe
  C:\Windows\System\ZpvoSvN.exe
  2⤵
  PID:8504
- C:\Windows\System\ZnfJTfX.exe
  C:\Windows\System\ZnfJTfX.exe
  2⤵
  PID:8636
- C:\Windows\System\LMidZnd.exe
  C:\Windows\System\LMidZnd.exe
  2⤵
  PID:8696
- C:\Windows\System\IEmpLnc.exe
  C:\Windows\System\IEmpLnc.exe
  2⤵
  PID:8752
- C:\Windows\System\zaekqqv.exe
  C:\Windows\System\zaekqqv.exe
  2⤵
  PID:8916
- C:\Windows\System\wUpNqTC.exe
  C:\Windows\System\wUpNqTC.exe
  2⤵
  PID:10260
- C:\Windows\System\lQkhTxf.exe
  C:\Windows\System\lQkhTxf.exe
  2⤵
  PID:10280
- C:\Windows\System\feJUHyT.exe
  C:\Windows\System\feJUHyT.exe
  2⤵
  PID:10296
- C:\Windows\System\hJwIqrn.exe
  C:\Windows\System\hJwIqrn.exe
  2⤵
  PID:10312
- C:\Windows\System\jobJchg.exe
  C:\Windows\System\jobJchg.exe
  2⤵
  PID:10328
- C:\Windows\System\zutmmXW.exe
  C:\Windows\System\zutmmXW.exe
  2⤵
  PID:10344
- C:\Windows\System\EUESJvg.exe
  C:\Windows\System\EUESJvg.exe
  2⤵
  PID:10364
- C:\Windows\System\pmnqzsS.exe
  C:\Windows\System\pmnqzsS.exe
  2⤵
  PID:10384
- C:\Windows\System\ctaJMDt.exe
  C:\Windows\System\ctaJMDt.exe
  2⤵
  PID:10400
- C:\Windows\System\dTDPKcA.exe
  C:\Windows\System\dTDPKcA.exe
  2⤵
  PID:10424
- C:\Windows\System\dIrnuCP.exe
  C:\Windows\System\dIrnuCP.exe
  2⤵
  PID:10444
- C:\Windows\System\osWrjob.exe
  C:\Windows\System\osWrjob.exe
  2⤵
  PID:10464
- C:\Windows\System\LhaAXkA.exe
  C:\Windows\System\LhaAXkA.exe
  2⤵
  PID:10484
- C:\Windows\System\bVCQARt.exe
  C:\Windows\System\bVCQARt.exe
  2⤵
  PID:10500
- C:\Windows\System\lSsiXZs.exe
  C:\Windows\System\lSsiXZs.exe
  2⤵
  PID:10528
- C:\Windows\System\CrQOFWB.exe
  C:\Windows\System\CrQOFWB.exe
  2⤵
  PID:10544
- C:\Windows\System\ZbhtBFh.exe
  C:\Windows\System\ZbhtBFh.exe
  2⤵
  PID:10564
- C:\Windows\System\UzAlMrF.exe
  C:\Windows\System\UzAlMrF.exe
  2⤵
  PID:10584
- C:\Windows\System\kpAyNVd.exe
  C:\Windows\System\kpAyNVd.exe
  2⤵
  PID:10604
- C:\Windows\System\QtOFcAB.exe
  C:\Windows\System\QtOFcAB.exe
  2⤵
  PID:10628
- C:\Windows\System\bYdMfLE.exe
  C:\Windows\System\bYdMfLE.exe
  2⤵
  PID:10652
- C:\Windows\System\GLQbKle.exe
  C:\Windows\System\GLQbKle.exe
  2⤵
  PID:10672
- C:\Windows\System\COSWBYQ.exe
  C:\Windows\System\COSWBYQ.exe
  2⤵
  PID:10700
- C:\Windows\System\hdBSRbT.exe
  C:\Windows\System\hdBSRbT.exe
  2⤵
  PID:10716
- C:\Windows\System\hDIgwCv.exe
  C:\Windows\System\hDIgwCv.exe
  2⤵
  PID:10732
- C:\Windows\System\JWGVNir.exe
  C:\Windows\System\JWGVNir.exe
  2⤵
  PID:10748
- C:\Windows\System\pmkBhUn.exe
  C:\Windows\System\pmkBhUn.exe
  2⤵
  PID:10764
- C:\Windows\System\CSfXTcB.exe
  C:\Windows\System\CSfXTcB.exe
  2⤵
  PID:10780
- C:\Windows\System\eKfrSVz.exe
  C:\Windows\System\eKfrSVz.exe
  2⤵
  PID:10800
- C:\Windows\System\RSUrnAW.exe
  C:\Windows\System\RSUrnAW.exe
  2⤵
  PID:10820
- C:\Windows\System\MLxPJSE.exe
  C:\Windows\System\MLxPJSE.exe
  2⤵
  PID:10844
- C:\Windows\System\TOVoble.exe
  C:\Windows\System\TOVoble.exe
  2⤵
  PID:10864
- C:\Windows\System\ypgFUsi.exe
  C:\Windows\System\ypgFUsi.exe
  2⤵
  PID:10884
- C:\Windows\System\dQrmVuh.exe
  C:\Windows\System\dQrmVuh.exe
  2⤵
  PID:10900
- C:\Windows\System\LoBpANN.exe
  C:\Windows\System\LoBpANN.exe
  2⤵
  PID:10920
- C:\Windows\System\veqbIlH.exe
  C:\Windows\System\veqbIlH.exe
  2⤵
  PID:10940
- C:\Windows\System\NjJYpuU.exe
  C:\Windows\System\NjJYpuU.exe
  2⤵
  PID:10956
- C:\Windows\System\cbMLkDz.exe
  C:\Windows\System\cbMLkDz.exe
  2⤵
  PID:10976
- C:\Windows\System\ELxrPaj.exe
  C:\Windows\System\ELxrPaj.exe
  2⤵
  PID:10992
- C:\Windows\System\BrrZpMQ.exe
  C:\Windows\System\BrrZpMQ.exe
  2⤵
  PID:11012
- C:\Windows\System\XrzIDis.exe
  C:\Windows\System\XrzIDis.exe
  2⤵
  PID:11028
- C:\Windows\System\jaYMycX.exe
  C:\Windows\System\jaYMycX.exe
  2⤵
  PID:11052
- C:\Windows\System\NRffRfX.exe
  C:\Windows\System\NRffRfX.exe
  2⤵
  PID:11072
- C:\Windows\System\rAktUqb.exe
  C:\Windows\System\rAktUqb.exe
  2⤵
  PID:11092
- C:\Windows\System\rnshQDv.exe
  C:\Windows\System\rnshQDv.exe
  2⤵
  PID:11108
- C:\Windows\System\eCMrVXn.exe
  C:\Windows\System\eCMrVXn.exe
  2⤵
  PID:11128
- C:\Windows\System\nAQfURC.exe
  C:\Windows\System\nAQfURC.exe
  2⤵
  PID:11148
- C:\Windows\System\xtJKRiU.exe
  C:\Windows\System\xtJKRiU.exe
  2⤵
  PID:11168
- C:\Windows\System\WVUGxFp.exe
  C:\Windows\System\WVUGxFp.exe
  2⤵
  PID:11188
- C:\Windows\System\gUgYyXw.exe
  C:\Windows\System\gUgYyXw.exe
  2⤵
  PID:11212
- C:\Windows\System\gdMEJQA.exe
  C:\Windows\System\gdMEJQA.exe
  2⤵
  PID:11228
- C:\Windows\System\kkfVjGJ.exe
  C:\Windows\System\kkfVjGJ.exe
  2⤵
  PID:11252
- C:\Windows\System\TpFHyQR.exe
  C:\Windows\System\TpFHyQR.exe
  2⤵
  PID:9012
- C:\Windows\System\HZCgHrI.exe
  C:\Windows\System\HZCgHrI.exe
  2⤵
  PID:9072
- C:\Windows\System\QxfoZmT.exe
  C:\Windows\System\QxfoZmT.exe
  2⤵
  PID:9112
- C:\Windows\System\zgByQYf.exe
  C:\Windows\System\zgByQYf.exe
  2⤵
  PID:9160
- C:\Windows\System\hmwhLAR.exe
  C:\Windows\System\hmwhLAR.exe
  2⤵
  PID:9224
- C:\Windows\System\FRVzttN.exe
  C:\Windows\System\FRVzttN.exe
  2⤵
  PID:9264
- C:\Windows\System\XxkLZpu.exe
  C:\Windows\System\XxkLZpu.exe
  2⤵
  PID:6788
- C:\Windows\System\zSFlKoW.exe
  C:\Windows\System\zSFlKoW.exe
  2⤵
  PID:3812
- C:\Windows\System\CsbeHey.exe
  C:\Windows\System\CsbeHey.exe
  2⤵
  PID:6896
- C:\Windows\System\TVkGfmh.exe
  C:\Windows\System\TVkGfmh.exe
  2⤵
  PID:8196
- C:\Windows\System\sHvaOqL.exe
  C:\Windows\System\sHvaOqL.exe
  2⤵
  PID:8264
- C:\Windows\System\jKalCGS.exe
  C:\Windows\System\jKalCGS.exe
  2⤵
  PID:8348
- C:\Windows\System\CsIwXzc.exe
  C:\Windows\System\CsIwXzc.exe
  2⤵
  PID:8404
- C:\Windows\System\ApfpFkV.exe
  C:\Windows\System\ApfpFkV.exe
  2⤵
  PID:8460
- C:\Windows\System\WSMIDgs.exe
  C:\Windows\System\WSMIDgs.exe
  2⤵
  PID:6592
- C:\Windows\System\CAkqRQE.exe
  C:\Windows\System\CAkqRQE.exe
  2⤵
  PID:8728
- C:\Windows\System\qbJdLtl.exe
  C:\Windows\System\qbJdLtl.exe
  2⤵
  PID:8808
- C:\Windows\System\gdkZgux.exe
  C:\Windows\System\gdkZgux.exe
  2⤵
  PID:8360
- C:\Windows\System\PVcYTiC.exe
  C:\Windows\System\PVcYTiC.exe
  2⤵
  PID:7320
- C:\Windows\System\tSNHHaI.exe
  C:\Windows\System\tSNHHaI.exe
  2⤵
  PID:8920
- C:\Windows\System\CrXfHAD.exe
  C:\Windows\System\CrXfHAD.exe
  2⤵
  PID:8744
- C:\Windows\System\GsVWqlp.exe
  C:\Windows\System\GsVWqlp.exe
  2⤵
  PID:3968
- C:\Windows\System\MNTdtfb.exe
  C:\Windows\System\MNTdtfb.exe
  2⤵
  PID:9036
- C:\Windows\System\fxXljqC.exe
  C:\Windows\System\fxXljqC.exe
  2⤵
  PID:10304
- C:\Windows\System\wjQMYYT.exe
  C:\Windows\System\wjQMYYT.exe
  2⤵
  PID:9188
- C:\Windows\System\TelamwA.exe
  C:\Windows\System\TelamwA.exe
  2⤵
  PID:1788
- C:\Windows\System\EYAUGsI.exe
  C:\Windows\System\EYAUGsI.exe
  2⤵
  PID:9220
- C:\Windows\System\iVrydwW.exe
  C:\Windows\System\iVrydwW.exe
  2⤵
  PID:10420
- C:\Windows\System\eyVTfQj.exe
  C:\Windows\System\eyVTfQj.exe
  2⤵
  PID:9312
- C:\Windows\System\EZnTWTF.exe
  C:\Windows\System\EZnTWTF.exe
  2⤵
  PID:9340
- C:\Windows\System\FgYmiXq.exe
  C:\Windows\System\FgYmiXq.exe
  2⤵
  PID:7636
- C:\Windows\System\vpTdkvl.exe
  C:\Windows\System\vpTdkvl.exe
  2⤵
  PID:7652
- C:\Windows\System\KwirWUE.exe
  C:\Windows\System\KwirWUE.exe
  2⤵
  PID:7684
- C:\Windows\System\FFgrXcr.exe
  C:\Windows\System\FFgrXcr.exe
  2⤵
  PID:7716
- C:\Windows\System\IyssBFO.exe
  C:\Windows\System\IyssBFO.exe
  2⤵
  PID:7764
- C:\Windows\System\zPLrlRD.exe
  C:\Windows\System\zPLrlRD.exe
  2⤵
  PID:7808
- C:\Windows\System\CFPPyDm.exe
  C:\Windows\System\CFPPyDm.exe
  2⤵
  PID:7860
- C:\Windows\System\vqiYMvY.exe
  C:\Windows\System\vqiYMvY.exe
  2⤵
  PID:7964
- C:\Windows\System\VuELEEa.exe
  C:\Windows\System\VuELEEa.exe
  2⤵
  PID:8152
- C:\Windows\System\EZSpBsp.exe
  C:\Windows\System\EZSpBsp.exe
  2⤵
  PID:8188
- C:\Windows\System\xmFuIwo.exe
  C:\Windows\System\xmFuIwo.exe
  2⤵
  PID:4828
- C:\Windows\System\lkGIFhL.exe
  C:\Windows\System\lkGIFhL.exe
  2⤵
  PID:872
- C:\Windows\System\BblTkbf.exe
  C:\Windows\System\BblTkbf.exe
  2⤵
  PID:6840
- C:\Windows\System\anJdAcv.exe
  C:\Windows\System\anJdAcv.exe
  2⤵
  PID:6952
- C:\Windows\System\YgsVugi.exe
  C:\Windows\System\YgsVugi.exe
  2⤵
  PID:7020
- C:\Windows\System\YgDbVBY.exe
  C:\Windows\System\YgDbVBY.exe
  2⤵
  PID:7152
- C:\Windows\System\FdZplhg.exe
  C:\Windows\System\FdZplhg.exe
  2⤵
  PID:5784
- C:\Windows\System\qluvPbg.exe
  C:\Windows\System\qluvPbg.exe
  2⤵
  PID:6068
- C:\Windows\System\OkXYEkD.exe
  C:\Windows\System\OkXYEkD.exe
  2⤵
  PID:2280
- C:\Windows\System\zKepsOK.exe
  C:\Windows\System\zKepsOK.exe
  2⤵
  PID:11288
- C:\Windows\System\TCiGLFb.exe
  C:\Windows\System\TCiGLFb.exe
  2⤵
  PID:11304
- C:\Windows\System\KSOIkCG.exe
  C:\Windows\System\KSOIkCG.exe
  2⤵
  PID:11328
- C:\Windows\System\bljaege.exe
  C:\Windows\System\bljaege.exe
  2⤵
  PID:11352
- C:\Windows\System\bPllinQ.exe
  C:\Windows\System\bPllinQ.exe
  2⤵
  PID:11368
- C:\Windows\System\SpdTCwC.exe
  C:\Windows\System\SpdTCwC.exe
  2⤵
  PID:11392
- C:\Windows\System\ijvQmTY.exe
  C:\Windows\System\ijvQmTY.exe
  2⤵
  PID:11408
- C:\Windows\System\WssCcXx.exe
  C:\Windows\System\WssCcXx.exe
  2⤵
  PID:11436
- C:\Windows\System\RgPsUQA.exe
  C:\Windows\System\RgPsUQA.exe
  2⤵
  PID:11456
- C:\Windows\System\BznoSpq.exe
  C:\Windows\System\BznoSpq.exe
  2⤵
  PID:11484
- C:\Windows\System\tkBCNCS.exe
  C:\Windows\System\tkBCNCS.exe
  2⤵
  PID:11508
- C:\Windows\System\TOhYAni.exe
  C:\Windows\System\TOhYAni.exe
  2⤵
  PID:11528
- C:\Windows\System\kBkXNva.exe
  C:\Windows\System\kBkXNva.exe
  2⤵
  PID:11548
- C:\Windows\System\taRpvkW.exe
  C:\Windows\System\taRpvkW.exe
  2⤵
  PID:11572
- C:\Windows\System\GADEbGF.exe
  C:\Windows\System\GADEbGF.exe
  2⤵
  PID:11596
- C:\Windows\System\mDeiaMt.exe
  C:\Windows\System\mDeiaMt.exe
  2⤵
  PID:11616
- C:\Windows\System\IqkpbyR.exe
  C:\Windows\System\IqkpbyR.exe
  2⤵
  PID:11636
- C:\Windows\System\KvtKKDg.exe
  C:\Windows\System\KvtKKDg.exe
  2⤵
  PID:11660
- C:\Windows\System\aOlxzWL.exe
  C:\Windows\System\aOlxzWL.exe
  2⤵
  PID:11680
- C:\Windows\System\RULzUiR.exe
  C:\Windows\System\RULzUiR.exe
  2⤵
  PID:11704
- C:\Windows\System\ltAgIrj.exe
  C:\Windows\System\ltAgIrj.exe
  2⤵
  PID:11728
- C:\Windows\System\ZESSrZX.exe
  C:\Windows\System\ZESSrZX.exe
  2⤵
  PID:11752
- C:\Windows\System\ijxcyYk.exe
  C:\Windows\System\ijxcyYk.exe
  2⤵
  PID:11772
- C:\Windows\System\rUjPrSq.exe
  C:\Windows\System\rUjPrSq.exe
  2⤵
  PID:11800
- C:\Windows\System\PQOjphf.exe
  C:\Windows\System\PQOjphf.exe
  2⤵
  PID:11816
- C:\Windows\System\MbDVJsd.exe
  C:\Windows\System\MbDVJsd.exe
  2⤵
  PID:11844
- C:\Windows\System\uVCCgLE.exe
  C:\Windows\System\uVCCgLE.exe
  2⤵
  PID:11860
- C:\Windows\System\AJwwmKT.exe
  C:\Windows\System\AJwwmKT.exe
  2⤵
  PID:11880
- C:\Windows\System\QIUQiDi.exe
  C:\Windows\System\QIUQiDi.exe
  2⤵
  PID:11896
- C:\Windows\System\YNfTEDo.exe
  C:\Windows\System\YNfTEDo.exe
  2⤵
  PID:11920
- C:\Windows\System\gnaOkEu.exe
  C:\Windows\System\gnaOkEu.exe
  2⤵
  PID:11944
- C:\Windows\System\PBiZIBl.exe
  C:\Windows\System\PBiZIBl.exe
  2⤵
  PID:11960
- C:\Windows\System\BSsBuGi.exe
  C:\Windows\System\BSsBuGi.exe
  2⤵
  PID:11984
- C:\Windows\System\PrykJfZ.exe
  C:\Windows\System\PrykJfZ.exe
  2⤵
  PID:12004
- C:\Windows\System\zUbkUBN.exe
  C:\Windows\System\zUbkUBN.exe
  2⤵
  PID:12024
- C:\Windows\System\UausGfi.exe
  C:\Windows\System\UausGfi.exe
  2⤵
  PID:12048
- C:\Windows\System\hiQeFxV.exe
  C:\Windows\System\hiQeFxV.exe
  2⤵
  PID:12068
- C:\Windows\System\SNvCZlF.exe
  C:\Windows\System\SNvCZlF.exe
  2⤵
  PID:12092
- C:\Windows\System\kqjmGWK.exe
  C:\Windows\System\kqjmGWK.exe
  2⤵
  PID:12116
- C:\Windows\System\tjyWfpc.exe
  C:\Windows\System\tjyWfpc.exe
  2⤵
  PID:12132
- C:\Windows\System\VFkbiQG.exe
  C:\Windows\System\VFkbiQG.exe
  2⤵
  PID:12156
- C:\Windows\System\FDevnJj.exe
  C:\Windows\System\FDevnJj.exe
  2⤵
  PID:12180
- C:\Windows\System\pJfqeXh.exe
  C:\Windows\System\pJfqeXh.exe
  2⤵
  PID:12200
- C:\Windows\System\MNHGpxG.exe
  C:\Windows\System\MNHGpxG.exe
  2⤵
  PID:12220
- C:\Windows\System\JjYDfik.exe
  C:\Windows\System\JjYDfik.exe
  2⤵
  PID:12248
- C:\Windows\System\KjxPcNh.exe
  C:\Windows\System\KjxPcNh.exe
  2⤵
  PID:12264
- C:\Windows\System\oeabXsN.exe
  C:\Windows\System\oeabXsN.exe
  2⤵
  PID:10020
- C:\Windows\System\MUOlGvZ.exe
  C:\Windows\System\MUOlGvZ.exe
  2⤵
  PID:7284
- C:\Windows\System\nBfiOLT.exe
  C:\Windows\System\nBfiOLT.exe
  2⤵
  PID:10040
- C:\Windows\System\rGDqgWI.exe
  C:\Windows\System\rGDqgWI.exe
  2⤵
  PID:10816
- C:\Windows\System\TARozre.exe
  C:\Windows\System\TARozre.exe
  2⤵
  PID:4756
- C:\Windows\System\FLlQyJu.exe
  C:\Windows\System\FLlQyJu.exe
  2⤵
  PID:8936
- C:\Windows\System\fDYNuTO.exe
  C:\Windows\System\fDYNuTO.exe
  2⤵
  PID:8960
- C:\Windows\System\VYcgYhi.exe
  C:\Windows\System\VYcgYhi.exe
  2⤵
  PID:10352
- C:\Windows\System\DBaxeLE.exe
  C:\Windows\System\DBaxeLE.exe
  2⤵
  PID:9200
- C:\Windows\System\rNjhbIc.exe
  C:\Windows\System\rNjhbIc.exe
  2⤵
  PID:10472
- C:\Windows\System\ltEgALT.exe
  C:\Windows\System\ltEgALT.exe
  2⤵
  PID:9348
- C:\Windows\System\pXUxmCG.exe
  C:\Windows\System\pXUxmCG.exe
  2⤵
  PID:11244
- C:\Windows\System\treVHXi.exe
  C:\Windows\System\treVHXi.exe
  2⤵
  PID:9108
- C:\Windows\System\vXllbSP.exe
  C:\Windows\System\vXllbSP.exe
  2⤵
  PID:12300
- C:\Windows\System\FBuPwrP.exe
  C:\Windows\System\FBuPwrP.exe
  2⤵
  PID:12316
- C:\Windows\System\nxkcOGF.exe
  C:\Windows\System\nxkcOGF.exe
  2⤵
  PID:12336
- C:\Windows\System\TZLRYYF.exe
  C:\Windows\System\TZLRYYF.exe
  2⤵
  PID:12360
- C:\Windows\System\Drxgyqf.exe
  C:\Windows\System\Drxgyqf.exe
  2⤵
  PID:12384
- C:\Windows\System\RzIKFCO.exe
  C:\Windows\System\RzIKFCO.exe
  2⤵
  PID:12400
- C:\Windows\System\TyJCxyL.exe
  C:\Windows\System\TyJCxyL.exe
  2⤵
  PID:12420
- C:\Windows\System\uQOrglJ.exe
  C:\Windows\System\uQOrglJ.exe
  2⤵
  PID:12440
- C:\Windows\System\AZFhTUx.exe
  C:\Windows\System\AZFhTUx.exe
  2⤵
  PID:12456
- C:\Windows\System\BtnhFEY.exe
  C:\Windows\System\BtnhFEY.exe
  2⤵
  PID:12476
- C:\Windows\System\tozGNqf.exe
  C:\Windows\System\tozGNqf.exe
  2⤵
  PID:12508
- C:\Windows\System\LzTdHbm.exe
  C:\Windows\System\LzTdHbm.exe
  2⤵
  PID:12524
- C:\Windows\System\ssQyiQl.exe
  C:\Windows\System\ssQyiQl.exe
  2⤵
  PID:12540
- C:\Windows\System\HYyicej.exe
  C:\Windows\System\HYyicej.exe
  2⤵
  PID:12564
- C:\Windows\System\kuYumMZ.exe
  C:\Windows\System\kuYumMZ.exe
  2⤵
  PID:12584
- C:\Windows\System\Mekafcj.exe
  C:\Windows\System\Mekafcj.exe
  2⤵
  PID:12612
- C:\Windows\System\yPQgHYn.exe
  C:\Windows\System\yPQgHYn.exe
  2⤵
  PID:12632
- C:\Windows\System\itGMcln.exe
  C:\Windows\System\itGMcln.exe
  2⤵
  PID:12652
- C:\Windows\System\iWBJGhL.exe
  C:\Windows\System\iWBJGhL.exe
  2⤵
  PID:12676
- C:\Windows\System\NFJpNhN.exe
  C:\Windows\System\NFJpNhN.exe
  2⤵
  PID:12696
- C:\Windows\System\LwbkeIT.exe
  C:\Windows\System\LwbkeIT.exe
  2⤵
  PID:12720
- C:\Windows\System\vCuSQtT.exe
  C:\Windows\System\vCuSQtT.exe
  2⤵
  PID:12740
- C:\Windows\System\topsddS.exe
  C:\Windows\System\topsddS.exe
  2⤵
  PID:13236
- C:\Windows\System\NIMfwRa.exe
  C:\Windows\System\NIMfwRa.exe
  2⤵
  PID:13260
- C:\Windows\System\tgAKMPo.exe
  C:\Windows\System\tgAKMPo.exe
  2⤵
  PID:13276
- C:\Windows\System\CeitTMd.exe
  C:\Windows\System\CeitTMd.exe
  2⤵
  PID:13292
- C:\Windows\System\Bwowrfb.exe
  C:\Windows\System\Bwowrfb.exe
  2⤵
  PID:13308
- C:\Windows\System\GnqzDjn.exe
  C:\Windows\System\GnqzDjn.exe
  2⤵
  PID:1536
- C:\Windows\System\sBzqOhO.exe
  C:\Windows\System\sBzqOhO.exe
  2⤵
  PID:5908
- C:\Windows\System\wxlHNOr.exe
  C:\Windows\System\wxlHNOr.exe
  2⤵
  PID:4964
- C:\Windows\System\njibZBG.exe
  C:\Windows\System\njibZBG.exe
  2⤵
  PID:1872
- C:\Windows\System\aqRNaOb.exe
  C:\Windows\System\aqRNaOb.exe
  2⤵
  PID:4552
- C:\Windows\System\hsXQtXG.exe
  C:\Windows\System\hsXQtXG.exe
  2⤵
  PID:9724
- C:\Windows\System\uXaJLMX.exe
  C:\Windows\System\uXaJLMX.exe
  2⤵
  PID:9808
- C:\Windows\System\grOtsiD.exe
  C:\Windows\System\grOtsiD.exe
  2⤵
  PID:9876
- C:\Windows\System\OTLXxTn.exe
  C:\Windows\System\OTLXxTn.exe
  2⤵
  PID:9052
- C:\Windows\System\LQaUINP.exe
  C:\Windows\System\LQaUINP.exe
  2⤵
  PID:7112
- C:\Windows\System\gnmASoJ.exe
  C:\Windows\System\gnmASoJ.exe
  2⤵
  PID:5788
- C:\Windows\System\qKAnjqe.exe
  C:\Windows\System\qKAnjqe.exe
  2⤵
  PID:11364
- C:\Windows\System\EYpvTQj.exe
  C:\Windows\System\EYpvTQj.exe
  2⤵
  PID:11768
- C:\Windows\System\QHfFjJo.exe
  C:\Windows\System\QHfFjJo.exe
  2⤵
  PID:11676
- C:\Windows\System\jvZErEm.exe
  C:\Windows\System\jvZErEm.exe
  2⤵
  PID:11876
- C:\Windows\System\XSPDFCv.exe
  C:\Windows\System\XSPDFCv.exe
  2⤵
  PID:10616
- C:\Windows\System\RpkMysP.exe
  C:\Windows\System\RpkMysP.exe
  2⤵
  PID:8424
- C:\Windows\System\kpcmvIP.exe
  C:\Windows\System\kpcmvIP.exe
  2⤵
  PID:8548
- C:\Windows\System\uHoyfjc.exe
  C:\Windows\System\uHoyfjc.exe
  2⤵
  PID:6228
- C:\Windows\System\eonJqEi.exe
  C:\Windows\System\eonJqEi.exe
  2⤵
  PID:8956
- C:\Windows\System\rSwlneI.exe
  C:\Windows\System\rSwlneI.exe
  2⤵
  PID:10456
- C:\Windows\System\aZxxMbm.exe
  C:\Windows\System\aZxxMbm.exe
  2⤵
  PID:4352
- C:\Windows\System\mMdotDy.exe
  C:\Windows\System\mMdotDy.exe
  2⤵
  PID:12328
- C:\Windows\System\UdFnobV.exe
  C:\Windows\System\UdFnobV.exe
  2⤵
  PID:12428
- C:\Windows\System\IOpCfWz.exe
  C:\Windows\System\IOpCfWz.exe
  2⤵
  PID:12472
- C:\Windows\System\aiHuHhu.exe
  C:\Windows\System\aiHuHhu.exe
  2⤵
  PID:12576
- C:\Windows\System\wbPWeWr.exe
  C:\Windows\System\wbPWeWr.exe
  2⤵
  PID:12672
- C:\Windows\System\kuAJZAT.exe
  C:\Windows\System\kuAJZAT.exe
  2⤵
  PID:12784
- C:\Windows\System\lgmZpHq.exe
  C:\Windows\System\lgmZpHq.exe
  2⤵
  PID:13000
- C:\Windows\System\aZiNxzq.exe
  C:\Windows\System\aZiNxzq.exe
  2⤵
  PID:10664
- C:\Windows\System\bvTHNWD.exe
  C:\Windows\System\bvTHNWD.exe
  2⤵
  PID:10712
- C:\Windows\System\dcHUbEn.exe
  C:\Windows\System\dcHUbEn.exe
  2⤵
  PID:10812
- C:\Windows\System\LMOLtjA.exe
  C:\Windows\System\LMOLtjA.exe
  2⤵
  PID:2396
- C:\Windows\System\UfAcOkf.exe
  C:\Windows\System\UfAcOkf.exe
  2⤵
  PID:6008
- C:\Windows\System\FRHGoBn.exe
  C:\Windows\System\FRHGoBn.exe
  2⤵
  PID:8992
- C:\Windows\System\CghoDvr.exe
  C:\Windows\System\CghoDvr.exe
  2⤵
  PID:12280
- C:\Windows\System\RfxpEwC.exe
  C:\Windows\System\RfxpEwC.exe
  2⤵
  PID:11176
- C:\Windows\System\cGSnIpG.exe
  C:\Windows\System\cGSnIpG.exe
  2⤵
  PID:8952
- C:\Windows\System\mTrTlaz.exe
  C:\Windows\System\mTrTlaz.exe
  2⤵
  PID:11856
- C:\Windows\System\HYSdnIr.exe
  C:\Windows\System\HYSdnIr.exe
  2⤵
  PID:11952
- C:\Windows\System\NtwNAva.exe
  C:\Windows\System\NtwNAva.exe
  2⤵
  PID:5092
- C:\Windows\System\axvMmae.exe
  C:\Windows\System\axvMmae.exe
  2⤵
  PID:12324
- C:\Windows\System\SEqqaAY.exe
  C:\Windows\System\SEqqaAY.exe
  2⤵
  PID:12868
- C:\Windows\System\htnftbw.exe
  C:\Windows\System\htnftbw.exe
  2⤵
  PID:8328
- C:\Windows\System\ICbjzXi.exe
  C:\Windows\System\ICbjzXi.exe
  2⤵
  PID:7240
- C:\Windows\System\xQEsqgm.exe
  C:\Windows\System\xQEsqgm.exe
  2⤵
  PID:3596
- C:\Windows\System\GejzMSS.exe
  C:\Windows\System\GejzMSS.exe
  2⤵
  PID:12520
- C:\Windows\System\NrPgVBJ.exe
  C:\Windows\System\NrPgVBJ.exe
  2⤵
  PID:12856
- C:\Windows\System\UOMtCSN.exe
  C:\Windows\System\UOMtCSN.exe
  2⤵
  PID:10016
- C:\Windows\System\tiMxIRT.exe
  C:\Windows\System\tiMxIRT.exe
  2⤵
  PID:468
- C:\Windows\System\VpfdSLv.exe
  C:\Windows\System\VpfdSLv.exe
  2⤵
  PID:3372
- C:\Windows\System\CXUiDJT.exe
  C:\Windows\System\CXUiDJT.exe
  2⤵
  PID:5588
- C:\Windows\System\cwKKMFv.exe
  C:\Windows\System\cwKKMFv.exe
  2⤵
  PID:11336
- C:\Windows\System\AEoYPVU.exe
  C:\Windows\System\AEoYPVU.exe
  2⤵
  PID:11648
- C:\Windows\System\DSjQPxi.exe
  C:\Windows\System\DSjQPxi.exe
  2⤵
  PID:11792
- C:\Windows\System\sWFLKmi.exe
  C:\Windows\System\sWFLKmi.exe
  2⤵
  PID:10876
- C:\Windows\System\PUARkbW.exe
  C:\Windows\System\PUARkbW.exe
  2⤵
  PID:11568
- C:\Windows\System\dkggmSx.exe
  C:\Windows\System\dkggmSx.exe
  2⤵
  PID:11064
- C:\Windows\System\VIGSUWV.exe
  C:\Windows\System\VIGSUWV.exe
  2⤵
  PID:9148
- C:\Windows\System\WDsXHmI.exe
  C:\Windows\System\WDsXHmI.exe
  2⤵
  PID:348
- C:\Windows\System\QJylBQf.exe
  C:\Windows\System\QJylBQf.exe
  2⤵
  PID:2672
- C:\Windows\System\YjXGqtd.exe
  C:\Windows\System\YjXGqtd.exe
  2⤵
  PID:5108
- C:\Windows\System\JZiWFKj.exe
  C:\Windows\System\JZiWFKj.exe
  2⤵
  PID:13028
- C:\Windows\System\wyPiRkj.exe
  C:\Windows\System\wyPiRkj.exe
  2⤵
  PID:9088
- C:\Windows\System\HWbyXir.exe
  C:\Windows\System\HWbyXir.exe
  2⤵
  PID:8248
- C:\Windows\System\TfJunhn.exe
  C:\Windows\System\TfJunhn.exe
  2⤵
  PID:2304
- C:\Windows\System\EZANRsl.exe
  C:\Windows\System\EZANRsl.exe
  2⤵
  PID:12940
- C:\Windows\System\GSFIUYY.exe
  C:\Windows\System\GSFIUYY.exe
  2⤵
  PID:12664
- C:\Windows\System\FdyxyOI.exe
  C:\Windows\System\FdyxyOI.exe
  2⤵
  PID:9184
- C:\Windows\System\GlynLwi.exe
  C:\Windows\System\GlynLwi.exe
  2⤵
  PID:12932
- C:\Windows\System\VmvCUTM.exe
  C:\Windows\System\VmvCUTM.exe
  2⤵
  PID:10912
- C:\Windows\System\ZdCGdnh.exe
  C:\Windows\System\ZdCGdnh.exe
  2⤵
  PID:11956
- C:\Windows\System\zIzcAgx.exe
  C:\Windows\System\zIzcAgx.exe
  2⤵
  PID:13160
- C:\Windows\System\aoYgfeu.exe
  C:\Windows\System\aoYgfeu.exe
  2⤵
  PID:11940
- C:\Windows\System\rShxHkt.exe
  C:\Windows\System\rShxHkt.exe
  2⤵
  PID:6140
- C:\Windows\System\fZrBecE.exe
  C:\Windows\System\fZrBecE.exe
  2⤵
  PID:1772
- C:\Windows\System\ZWsjDfK.exe
  C:\Windows\System\ZWsjDfK.exe
  2⤵
  PID:11912
- C:\Windows\System\qevcCUx.exe
  C:\Windows\System\qevcCUx.exe
  2⤵
  PID:11996
- C:\Windows\System\cOpXjCh.exe
  C:\Windows\System\cOpXjCh.exe
  2⤵
  PID:5600
- C:\Windows\System\wrAwDZJ.exe
  C:\Windows\System\wrAwDZJ.exe
  2⤵
  PID:1560
- C:\Windows\System\ULsjcuD.exe
  C:\Windows\System\ULsjcuD.exe
  2⤵
  PID:1256
- C:\Windows\System\IFCPXMF.exe
  C:\Windows\System\IFCPXMF.exe
  2⤵
  PID:10288
- C:\Windows\System\pUUsFTQ.exe
  C:\Windows\System\pUUsFTQ.exe
  2⤵
  PID:12688
- C:\Windows\System\wgIeLZK.exe
  C:\Windows\System\wgIeLZK.exe
  2⤵
  PID:12228
- C:\Windows\System\nyGAAjS.exe
  C:\Windows\System\nyGAAjS.exe
  2⤵
  PID:10948
- C:\Windows\System\mXgrrQb.exe
  C:\Windows\System\mXgrrQb.exe
  2⤵
  PID:5568
- C:\Windows\System\VFLlSjL.exe
  C:\Windows\System\VFLlSjL.exe
  2⤵
  PID:11904
- C:\Windows\System\pIFkvXF.exe
  C:\Windows\System\pIFkvXF.exe
  2⤵
  PID:3660
- C:\Windows\System\lNZZpCS.exe
  C:\Windows\System\lNZZpCS.exe
  2⤵
  PID:10792
- C:\Windows\System\glcFogQ.exe
  C:\Windows\System\glcFogQ.exe
  2⤵
  PID:12912
- C:\Windows\System\qPuhimC.exe
  C:\Windows\System\qPuhimC.exe
  2⤵
  PID:6156
- C:\Windows\System\dtLdxTg.exe
  C:\Windows\System\dtLdxTg.exe
  2⤵
  PID:4364
- C:\Windows\System\NNyKolr.exe
  C:\Windows\System\NNyKolr.exe
  2⤵
  PID:11808
- C:\Windows\System\MOkUpls.exe
  C:\Windows\System\MOkUpls.exe
  2⤵
  PID:12964
- C:\Windows\System\PpGEcWS.exe
  C:\Windows\System\PpGEcWS.exe
  2⤵
  PID:5240
- C:\Windows\System\YTekYjj.exe
  C:\Windows\System\YTekYjj.exe
  2⤵
  PID:2848
- C:\Windows\System\drkemYQ.exe
  C:\Windows\System\drkemYQ.exe
  2⤵
  PID:7588
- C:\Windows\System\qHpPFOc.exe
  C:\Windows\System\qHpPFOc.exe
  2⤵
  PID:4616
- C:\Windows\System\IXOakhC.exe
  C:\Windows\System\IXOakhC.exe
  2⤵
  PID:7460
- C:\Windows\System\tmwoFII.exe
  C:\Windows\System\tmwoFII.exe
  2⤵
  PID:12516
- C:\Windows\System\kTVSplz.exe
  C:\Windows\System\kTVSplz.exe
  2⤵
  PID:12760
- C:\Windows\System\moNQRjN.exe
  C:\Windows\System\moNQRjN.exe
  2⤵
  PID:116
- C:\Windows\System\hSrZJey.exe
  C:\Windows\System\hSrZJey.exe
  2⤵
  PID:8520
- C:\Windows\System\eThgYbK.exe
  C:\Windows\System\eThgYbK.exe
  2⤵
  PID:13016
- C:\Windows\System\sBAzTnK.exe
  C:\Windows\System\sBAzTnK.exe
  2⤵
  PID:9180
- C:\Windows\System\thKRGjL.exe
  C:\Windows\System\thKRGjL.exe
  2⤵
  PID:10052
- C:\Windows\System\yjyVztQ.exe
  C:\Windows\System\yjyVztQ.exe
  2⤵
  PID:228
- C:\Windows\System\GFypYWI.exe
  C:\Windows\System\GFypYWI.exe
  2⤵
  PID:7792
- C:\Windows\System\mWDiPHi.exe
  C:\Windows\System\mWDiPHi.exe
  2⤵
  PID:1952
- C:\Windows\System\hjCyYva.exe
  C:\Windows\System\hjCyYva.exe
  2⤵
  PID:2896
- C:\Windows\System\LyMagde.exe
  C:\Windows\System\LyMagde.exe
  2⤵
  PID:2988
- C:\Windows\System\bdSvQUe.exe
  C:\Windows\System\bdSvQUe.exe
  2⤵
  PID:13324
- C:\Windows\System\kqIgtwu.exe
  C:\Windows\System\kqIgtwu.exe
  2⤵
  PID:13356
- C:\Windows\System\XVxJCIw.exe
  C:\Windows\System\XVxJCIw.exe
  2⤵
  PID:13376
- C:\Windows\System\DXKVPEz.exe
  C:\Windows\System\DXKVPEz.exe
  2⤵
  PID:13392
- C:\Windows\System\kDqPGvo.exe
  C:\Windows\System\kDqPGvo.exe
  2⤵
  PID:13416
- C:\Windows\System\KaHwzjC.exe
  C:\Windows\System\KaHwzjC.exe
  2⤵
  PID:13444
- C:\Windows\System\IUxuVUW.exe
  C:\Windows\System\IUxuVUW.exe
  2⤵
  PID:13468
- C:\Windows\System\OxAqomg.exe
  C:\Windows\System\OxAqomg.exe
  2⤵
  PID:13492
- C:\Windows\System\lACKdYZ.exe
  C:\Windows\System\lACKdYZ.exe
  2⤵
  PID:13512
- C:\Windows\System\AZpOivg.exe
  C:\Windows\System\AZpOivg.exe
  2⤵
  PID:13536
- C:\Windows\System\hKrgJtZ.exe
  C:\Windows\System\hKrgJtZ.exe
  2⤵
  PID:13560
- C:\Windows\System\CWCHPkq.exe
  C:\Windows\System\CWCHPkq.exe
  2⤵
  PID:13580
- C:\Windows\System\uneOvfL.exe
  C:\Windows\System\uneOvfL.exe
  2⤵
  PID:13600
- C:\Windows\System\mWOPJSS.exe
  C:\Windows\System\mWOPJSS.exe
  2⤵
  PID:13628
- C:\Windows\System\brRakgS.exe
  C:\Windows\System\brRakgS.exe
  2⤵
  PID:13648
- C:\Windows\System\MxjrrQP.exe
  C:\Windows\System\MxjrrQP.exe
  2⤵
  PID:13672
- C:\Windows\System\lIhYWUn.exe
  C:\Windows\System\lIhYWUn.exe
  2⤵
  PID:13692
- C:\Windows\System\fuDTYJc.exe
  C:\Windows\System\fuDTYJc.exe
  2⤵
  PID:13712
- C:\Windows\System\dpkvxqB.exe
  C:\Windows\System\dpkvxqB.exe
  2⤵
  PID:13732
- C:\Windows\System\qkpsFYI.exe
  C:\Windows\System\qkpsFYI.exe
  2⤵
  PID:13752
- C:\Windows\System\tmAOZAn.exe
  C:\Windows\System\tmAOZAn.exe
  2⤵
  PID:13776
- C:\Windows\System\qfloKhA.exe
  C:\Windows\System\qfloKhA.exe
  2⤵
  PID:13800
- C:\Windows\System\VDyMmBK.exe
  C:\Windows\System\VDyMmBK.exe
  2⤵
  PID:13820
- C:\Windows\System\zwqFybP.exe
  C:\Windows\System\zwqFybP.exe
  2⤵
  PID:13844
- C:\Windows\System\XoHgXJJ.exe
  C:\Windows\System\XoHgXJJ.exe
  2⤵
  PID:13868
- C:\Windows\System\qjJdtUh.exe
  C:\Windows\System\qjJdtUh.exe
  2⤵
  PID:14048
- C:\Windows\System\PQOFbfp.exe
  C:\Windows\System\PQOFbfp.exe
  2⤵
  PID:12764
- C:\Windows\System\DpnnDeR.exe
  C:\Windows\System\DpnnDeR.exe
  2⤵
  PID:11968
- C:\Windows\System\rvwxyDX.exe
  C:\Windows\System\rvwxyDX.exe
  2⤵
  PID:13532
- C:\Windows\System\lCYzOof.exe
  C:\Windows\System\lCYzOof.exe
  2⤵
  PID:11992
- C:\Windows\System\XSIRZdI.exe
  C:\Windows\System\XSIRZdI.exe
  2⤵
  PID:13488
- C:\Windows\System\EcoBiVe.exe
  C:\Windows\System\EcoBiVe.exe
  2⤵
  PID:13568
- C:\Windows\System\FzGEysk.exe
  C:\Windows\System\FzGEysk.exe
  2⤵
  PID:13660
- C:\Windows\System\sPexeNS.exe
  C:\Windows\System\sPexeNS.exe
  2⤵
  PID:13348
- C:\Windows\System\FQTbFhC.exe
  C:\Windows\System\FQTbFhC.exe
  2⤵
  PID:13400
- C:\Windows\System\abxfDcH.exe
  C:\Windows\System\abxfDcH.exe
  2⤵
  PID:14092
- C:\Windows\System\YBZjSCR.exe
  C:\Windows\System\YBZjSCR.exe
  2⤵
  PID:14044
- C:\Windows\System\HXMiGeU.exe
  C:\Windows\System\HXMiGeU.exe
  2⤵
  PID:14068
- C:\Windows\System\MlcXeAk.exe
  C:\Windows\System\MlcXeAk.exe
  2⤵
  PID:14216
- C:\Windows\System\UupDAJv.exe
  C:\Windows\System\UupDAJv.exe
  2⤵
  PID:2316
- C:\Windows\System\jCwbCYL.exe
  C:\Windows\System\jCwbCYL.exe
  2⤵
  PID:14268
- C:\Windows\System\ZzDztfw.exe
  C:\Windows\System\ZzDztfw.exe
  2⤵
  PID:14324
- C:\Windows\System\uJMLlFH.exe
  C:\Windows\System\uJMLlFH.exe
  2⤵
  PID:13520
- C:\Windows\System\jBorKvt.exe
  C:\Windows\System\jBorKvt.exe
  2⤵
  PID:14332

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 652 -p 4552 -ip 4552
1⤵
PID:10792

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 680 -p 11920 -ip 11920
1⤵
PID:4616

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 660 -p 10352 -ip 10352
1⤵
PID:13016

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 736 -p 11636 -ip 11636
1⤵
PID:1772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 764 -p 11548 -ip 11548
1⤵
PID:11996

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 744 -p 11508 -ip 11508
1⤵
PID:5600

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 804 -p 7436 -ip 7436
1⤵
PID:12688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 7020 -ip 7020
1⤵
PID:12912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bs1dtgdk.azs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AxIELDN.exe

Filesize
1.7MB

MD5
0b572d9911161f57b5ec367d957f75fc

SHA1
fe4c551263b8b41d3b40db20d4d20e5885f36566

SHA256
3eec67ff5aefc01e13d89a48c90544f05aa55a1d9eb23dcdafbe01691b7b2555

SHA512
f1dad375c62dc0bd9df6a666e481c04988cc2191ecc81a1ab8fcba70177b8a37b984ce08faba7e9f864c1542f4c652a650ac36e0955872d7ace17f308e1488cc

Download Submit
C:\Windows\System\BECVLzX.exe

Filesize
1.7MB

MD5
6c5eab426f5482765f37f6aaca2eee84

SHA1
7c04e6cb7944957d3f7418c600cddb15199c6308

SHA256
19e3a34eae5219993309c1e07c360872a2d396689836ff8d852251c21c4a6900

SHA512
19d7a6d9cd5db82670c443eef7b9f9bd5a5599eb8101f7e83b822f374c1307873663579a369ca430f3a7e36d2b2b4f9b5761086eae3942e8f63ba843a06f3bb9

Download Submit
C:\Windows\System\DeNGflP.exe

Filesize
1.7MB

MD5
75d34ce0d122f2906e75ef965ee6ac91

SHA1
8f2d048081a989bb79e41af9462cd624b522be89

SHA256
588fcc245fc3c4cf58b45ae12b3a8e803cd5c7b0ad31e46cbf1e4303f582010c

SHA512
39518809e917ecffabdd4015dd64138ab73016597aafd10ed1e3dbbc4b5e0f053126417621d98598faf4fde4b3961d06ef3d241b2f2c3a8b6b2b859499a33536

Download Submit
C:\Windows\System\Fwwtqhp.exe

Filesize
1.7MB

MD5
07e5c22d6a48960ec18766a8bf2179f0

SHA1
b1e5f581d601ecd999d4b0d4c19e282a6abdc893

SHA256
d786079ba5c236e62365818126abef7618a93b686e0fd68708d2c66e86d11de9

SHA512
73f43193089b9b2d07183c16fc08ecb9a94c033f6995de943f8cb7837c6ada7c96595035f9e589dfaa817ef0e16a55ccc339ec15be2d1962e658f7c9fae60411

Download Submit
C:\Windows\System\GIvuMSY.exe

Filesize
1.7MB

MD5
187f092900643b61c2a8b893c0bed745

SHA1
dca7ba5e79f275c5f1831ccf3689dfa752181aa9

SHA256
b2304055a11aaf44d9d50ba2cc55e2af90313c19b4898759c8dde098d577f5d9

SHA512
7696080eb9ddc767a7a71a8fd87a646a181e905a41360347f0324808280f486daee9960dbd8439ab1ef71f360bcb5733f81efd733d663ffa99ac5d67968f93bd

Download Submit
C:\Windows\System\GRdFxiV.exe

Filesize
1.7MB

MD5
e967ee8850fd1f041307324996e6d95f

SHA1
a5a9691ee33a68a2e193ee731d8b374bedea0df8

SHA256
d2cf2a1b89496278f101149b6fc1c0a755faadcf7cd7ca40b2acb48dfb38aa40

SHA512
5a7617ae9bce633e9823e04d00a6afe95cbbbd0067684e915e3a35906b9073c7f1c71bc73a9f9ccd623bb4fcfc36520ba6327adda303e3ce45b50f7418436c90

Download Submit
C:\Windows\System\HFGKfjP.exe

Filesize
1.7MB

MD5
ca19754975c6577dfaa40261ec2a425e

SHA1
b09b7c24f6fcb1075053927dc0913a31d85bfe23

SHA256
8d8798727bdbf330c2a3f55f3d2c6c338f8d23566d4ca16a206f23540fd07318

SHA512
09715c7a11654219080d2e8395874e28dc17afcc6d67a50f47785425b9fc77d7947812ed0e985f324e6ce64205619e10a0b57d6411ad9972c86c844f7d11ba7b

Download Submit
C:\Windows\System\HWyBzvl.exe

Filesize
1.7MB

MD5
e3163ab02319fedea918e66823535df8

SHA1
eb9d0447ad0a1b8f73cb39a3b730edb35a9ccbb7

SHA256
21016c4d06359256b5f2e6339fd753cc2e48222eab53801df7c3abfe5ba0b041

SHA512
cdcaac526e47cbe7a14135ad87625df044b6e4a5fbb72e6b7ab101f545479625a6e30ea28e0f11bff02b27cbc7789b3a2055298231e4146ce5344f3750532c6b

Download Submit
C:\Windows\System\IFyrQmo.exe

Filesize
1.7MB

MD5
b244824c60e2af0a453ead76e505c9be

SHA1
ed128c4e1312b55ef3df63ee8920ebe88c417d48

SHA256
77b932895ed26f3fb7b7f855179813b684fc27f5bef5517ed13984e83ac69285

SHA512
845ef99ea2df7c86a7dd761a0ceebfbb9bc71e91ab7ffa17b47c4a518dc53a017e9a3bdc31e9a0e7ddc5514f5bc60a1444d3c129801a727de61a954ea9a9f226

Download Submit
C:\Windows\System\IlGNlJt.exe

Filesize
1.7MB

MD5
b3d4b06e710488df5bc7ce4af533bad9

SHA1
1362df26b3e183e29cc72bc7411e292c7d178b49

SHA256
c81410327713391b3b0f6460ebb0452b7b23facb3bf3f5927e7483dab0f59e54

SHA512
6e2cee53434ede68effe2e52eafdeacc70a867fda6dffcdcec9f04849ce794c106d071ee5873ef5961e9a98897b2fb8d27f9c28a64a7b61d44d6fb90046ea397

Download Submit
C:\Windows\System\JSYJpHM.exe

Filesize
1.7MB

MD5
f05d5175a874fddae1e7d7bdd444ef11

SHA1
dfbec29040bffd753a957c71bbfafc636f634c8d

SHA256
6d8dd94405eb795b1db5462442958476f701ac8ad7c3159d5bb1851a2a27b090

SHA512
5c55a22da7ad69b688a62fe3708d4fdb0a7a28b9fbbb18ed068083601d4677ca77c4db484584f21579e738ba8b08dc7e5e59d64d180c069f7f5ec1c2f8092a81

Download Submit
C:\Windows\System\JxbIlbP.exe

Filesize
1.7MB

MD5
93f57f33ae424f47d4a93e17c4352d4f

SHA1
415abfc76bb6cb10f9ca4b5b24696cae54c3c310

SHA256
605be8f3bd4a65f354c76de9877e64ebe41d32d527d9b7c5a39460436cdd3047

SHA512
1bb4d9e5f5743d096680e5e18cc52039bf2ff88713f6218234fcead79588c11528c041a6a924cfaa56ebb48662aaa4a9105036339c9dfc43cf15b2aa927b63fc

Download Submit
C:\Windows\System\KAmCRME.exe

Filesize
1.7MB

MD5
d660d6aa1440fadebd161058e1f393f3

SHA1
e4528c0d2b5e6bc54ec20c1bc94e384ba2839f80

SHA256
c104409d16ff79529c941c4851b264437e76cf746fc7aebc9152b505908b422d

SHA512
3620c02844e901c6976aea9996ddddfb234ac65cc08a92f00223b0db89cc050303e080c00de979df4e976e6a440d5d52dce3640738f21e35e5a47cf26faa28b4

Download Submit
C:\Windows\System\KDSiuXm.exe

Filesize
1.7MB

MD5
a9447a364f23ba1fb17b5cfe4ed9a047

SHA1
58130526e6b6d4f5e274a1d6f41c107a29f96e5d

SHA256
157721cb8da113187ee7a6400720156ceebf56b9d4a5ed312de52931852bb713

SHA512
848645b3ac885b66546740a968c576090ff92b9e5011b015d095b413d2dbaaa2241a91b0ae844cab815a6fb43d22805761fdcbdc3441f7d0bea6f230218c7fc2

Download Submit
C:\Windows\System\KxhJZhZ.exe

Filesize
1.7MB

MD5
4022737cc8e35b15cac6abc269d46707

SHA1
02636f0fbb5842f451f413e8c62e2a3aebda1346

SHA256
a67c69a351c75389d86d709e2a71f4b8d76cdf0f8fb71ad2b90aeea111cd8ac2

SHA512
7177badcc404d5007d90caa28184eb475f73a86e29a657e32070a3c40b86bdd5f73a8749c559d6889485a720c2692a1ec29213ffa0f75a3ee4c5c4df96cb3f44

Download Submit
C:\Windows\System\LtScWGg.exe

Filesize
1.7MB

MD5
f76ec223987cfb470bf60401b640b48d

SHA1
2078a2837e4c8e00fd87c13490fc8059b625ace8

SHA256
85782884fb68e1398d1947c03337f1b884c800274628bbc0f0ef583030338c41

SHA512
3afbea51c85955001d3d24bdf8c3e355f965cce96ab8fb5b4fad2a4081c3118e70f9455d8a3f156260266ea636170475ea3040638ab273594b84f0e3d2c3b314

Download Submit
C:\Windows\System\MnsJwWd.exe

Filesize
1.7MB

MD5
d21667814e5a555aa0462d2779816a37

SHA1
4690b7f199d651a570ec6181185f75eeb0759808

SHA256
f4b6025ebb5608b85c28d843a6839b8eb47c66b1061089f9933cfee78e995ffb

SHA512
3af402bbc2a7d1b9c15d8db999d222454fbfb389f1894c6300a6a4e6ff5453245191148f5d569abd76cf6f93b7e051b7339954884e0d4d71765326f020be6ea4

Download Submit
C:\Windows\System\NtBSAIG.exe

Filesize
1.7MB

MD5
dad4f1e42e469e46626096d5b2b87167

SHA1
79232587d8cbf2d6579b9354415d6720276ae220

SHA256
77a28f9069b2f1a6412b29fa8079d37beb010a4626de62772c2677674d00c57a

SHA512
7fcb5ae37563e45192b9a0f04c7aa832d89dd4bf6aab52f1e74bda244b6489a3308fc4047c34eeff64440d4aeaa1c8a367cbb209d2d7ae6eb61fff9938f3e9dd

Download Submit
C:\Windows\System\ONARgQs.exe

Filesize
1.7MB

MD5
126ef6f261e48ecec85ed6d839ac04a7

SHA1
51a7fbc6109c59800818e61cbcbe36471fe053ae

SHA256
f3a2489ed091e469b11d04707c34f71ce37058ed7692fae73b4c3b6f191079a7

SHA512
3f817d4eb01048d436436dd9a1f43caae2ab6160820e7c109a965adabffb619c304024c9c14954bc1ddb09e0baf01c86a47ebacaf26a5c1974b72fb875d46abe

Download Submit
C:\Windows\System\RlwJUsS.exe

Filesize
1.7MB

MD5
2a9684bfc2f9a03539e8adb7c1aa0f2a

SHA1
9dffdfd161b8482b9a584d9cea6eff82a84ef4e8

SHA256
1471d27b71e07b8f7f62714f59a43d4cf3ef0406d8d57e696b00dbbabeb4af29

SHA512
ae0dad3681428d3f78455df2fb61644972bd59cdfb72a0807ad561afe943a0665be17ae7b4c36783ac5ed40e2c62e8408523c4efcdb7b152d1cff28ef7ba7188

Download Submit
C:\Windows\System\RuHIPVh.exe

Filesize
1.7MB

MD5
e690be4452133036fd3b1e0bd1960c01

SHA1
9c37fc9c8c2fc4d6b19f4be63d347ac745afe74d

SHA256
cd751011d586825a327605195b0411ab526e6723436ca72c1bee661c40960b51

SHA512
acd1f53f917046bec9609b7f3843601c9139139f7432c2b5ca46bd56166238930b097dd92ec2831e3dfd8dbdb1ab61f9f6c7ab34f69cf43d0b1eca3678190722

Download Submit
C:\Windows\System\SgGFoxW.exe

Filesize
1.7MB

MD5
e320140dbdf2ce414da59bc450604f4f

SHA1
107224df250d47788ac0b03a6172dd47fa0a65c1

SHA256
94e0172b913196b58b3782e33e917b5502652ba31259e7811ee00ae46e8605ae

SHA512
8492564d5ad570f085807ac0693f425fc55fc766faeba35542c1909a103c2c7fb02478a18eabd742170c5198f16866d4653b507982ee6f4a394c04e2d3132b25

Download Submit
C:\Windows\System\VPIVWMu.exe

Filesize
1.7MB

MD5
37d433065ac2d51700bb68108ba4d9a6

SHA1
0fd8d29dd0374e01245ac0efeadf32ead5797d68

SHA256
54717fc0c5dbc5538d588ba665f38be8f01686418bb18cf87b6a791dd2f73ecb

SHA512
f6f141bdc73784b28a47619868478eeb687074d80734336bc2afd6329a755acb4d58b5aa63e805a42dfa8c233d7bf50d86b74ede677a836dbca6d2d373408015

Download Submit
C:\Windows\System\XfXEElf.exe

Filesize
1.7MB

MD5
aff690d9c796dfde7bfebd582a20217a

SHA1
07166a979e13fd6ea584c1503e5572053b6b1ce8

SHA256
f913eb64c44c25dc208d33f28e31fd9f7dcdc32d69049ff2608e05746aaf15d9

SHA512
787d0d797c16e429f5d0650f9241a6e0b6554c83399236172eec4238f69fe78408ec669b902142282950475b1462875366beda66773d136a9fc79b8d3da0923f

Download Submit
C:\Windows\System\YyQQSGV.exe

Filesize
1.7MB

MD5
da3b98168450617187e3c95da763d758

SHA1
4fb7e91e88287e8f295303af489499eb94f23110

SHA256
29762f3dce0f20938bcfb73ca19aad8dc72c49c0a9323a02916dc40034ef4593

SHA512
9f64c64b3cfc2e106793ff7a8ae4958424d1edcbcb6567d03fd1bfe9b4cb52158ec7a553d9df2c256fb66ce7f2668e41bfdc59b63acda677b57881acf8cbe71f

Download Submit
C:\Windows\System\aPCjjyE.exe

Filesize
1.7MB

MD5
72c2367e4680fd4ed2c5d791bf49443a

SHA1
72eef891f82bbd6255684cc76864c3c7afc2c4ce

SHA256
ee2056837f4081ec3814729f0cd72a53b935f0369f580f0a08162396ce1eac27

SHA512
002f82736473dc992da9bf03aaa254e1285a66382197f66223298f9a1872867f15fdf89f6581344abc7ec2358d5b2c0f5b932450afec07e565de6a9a472d593e

Download Submit
C:\Windows\System\cIEjDZi.exe

Filesize
1.7MB

MD5
7c729749da2d767368acb45a48cd43b9

SHA1
18907afede7ffe7e1c682608cdb9f192b1532314

SHA256
c9d9990035e781a603eacf510573a4666182a674b92bec3a96efebc4648f22ee

SHA512
6410f034496f2e4a5b8078630c72e55651c957436778eb65df6c09c697c7c66b1955eac19df4663f6ac8b7b4ab65dec06bbdb86a50605c606b2883fb31b7cbfc

Download Submit
C:\Windows\System\iwyyTAS.exe

Filesize
1.7MB

MD5
ee79011e3dcffb6c431a0cfdc013043b

SHA1
86224a774e83460f31a7795ec42aee31c6bc8cac

SHA256
2e3e99a949415ea33e3bdf6f4ea1d301b99e3fabed432c22dc11fbde82134207

SHA512
ef8f3f0775bcc0cb45247ea9d35d207ffafad6404ada54857e8e5436a580e6c324d88d86386977c83f56cc54cc33048e3787ce4443809849c7a88641dc19c19a

Download Submit
C:\Windows\System\jCiSOzS.exe

Filesize
1.7MB

MD5
a35ed31c6d4dae7d4e4085f37da600bd

SHA1
eb32f8e52d8617342a431ee4ca2be302a4adc780

SHA256
ef38b51036dda38be062b4ced7626b3b0e5e12695f44fd4de0115d2e4c2c651f

SHA512
07da1af5d72258a891fc6e66ea91a9ebc234a3121a187bb4f6b2dab7148ac6ef934df5e54092df232d06167a900e3403b75b6addfaca2cf980496b0411a71645

Download Submit
C:\Windows\System\ljCZHcB.exe

Filesize
1.7MB

MD5
5fcd28876ba97014fa3e8c884967a4f8

SHA1
24228da72330935276474aac0807498a80b64ea1

SHA256
f40b39dc386ea88026c9c78982b446f6594bb94025ca036625868215b5382030

SHA512
81fadfc8e024f8454d89aea3c4fcb42f070935c4922cabe63837687a026723220d75b9c79a100a114916c2229b5c75d0a1245191d23806249fdb80349be7f734

Download Submit
C:\Windows\System\ntIpzPq.exe

Filesize
1.7MB

MD5
39f3c4d93e8723bdc98eff4479678605

SHA1
a5f3a31e5cce0abf9d9e9794653b6a1095e1be19

SHA256
e44594426c4e092e9fbce192f6e63a7f6baae4f125bcb491ce3cd420c6133093

SHA512
266daa6d10b07a0fd4bdc1b5b4b63ade795b450f9c5994871102424b064a8bc2735a8b5e6de2717e9fd1faf054decc7b2bfb1388ac84a77b4acd613db4548440

Download Submit
C:\Windows\System\pHYShne.exe

Filesize
8B

MD5
35b23d571bbad4492faca789c3ae9e51

SHA1
adce24f573b6f217562802fd70c52d63ff8f138a

SHA256
3a560e0248da85dda9072e5a99566240ff722f60e9e834efc9c2c23440409d68

SHA512
9c03280067c140373673e9c5ab78127be909959b13e02da8c3ebcce17541a63329fa3cb35a4d2a7b2bb1a50a364108f4e9b1ca429acacd7bf3a5a9d83fb6ba39

Download Submit
C:\Windows\System\pVAwoEY.exe

Filesize
1.7MB

MD5
8cf98d9f089c2a61f14373aae9e673d6

SHA1
222183ef9e40dd2de50814be7a202800af23bdab

SHA256
cea059aeb468a4c405d40a4afb62ab137137f051f60026569c4496ec126a7e92

SHA512
fd7ba3446f912899a735a255a17fca2a3309bf2bcebd5d70fcb3bf8cfd23eb61cf9f42c29f88b1e947f79340c9ac9aa45ef9a1cb10b3a79c2162363b29323a10

Download Submit
C:\Windows\System\uNUyGLR.exe

Filesize
1.7MB

MD5
fa36e2cf5e282c4d3f6f8bc1cb0c444f

SHA1
54c4d18572e24ddb12ee51714ce71560dc6aaa1a

SHA256
51514f34c4e555e30b298ce53692fc1b9691ed2b29d08cec6394bb12011aaa9f

SHA512
8d94e0ecc2c1e74257eee23ac216a3d60d5a5ef3cd0b2291a68d6dbc0e8720827da3f314c1f9d7cbff17314f6458b29a57dce8ffd8c45a5b0056f78b6a022fd8

Download Submit
C:\Windows\System\uWRUFim.exe

Filesize
1.7MB

MD5
dd2db4952f1c8ff68be28250d8585222

SHA1
e9c85ee2135738886e95dce97410b21229acf81b

SHA256
4ffb091e718abb710a0c5caa5374d20cacb8644771aa76c71fcfd169bab27215

SHA512
a9a904e703ceeecc199b8abbfc33a1c1a96d83faf3a39b9d711c929b952a04339309c7c3425753e1b3d9e4bc72088df0110940a906b62d427ed1e1bab45ab375

Download Submit
C:\Windows\System\vSjQIHU.exe

Filesize
1.7MB

MD5
32dc5399e809ced0f51c822267801eea

SHA1
ff87def879c27018c97d80762cb44eefbacf5d79

SHA256
fba2a238fd98a815c4cd107040898e40480c70548b6a91aeb2ac55e5e7021268

SHA512
f2b9069388b7d9da6a75007ecadb8de74981029572f64ebe93909fdda258e9a236a5881c2306b02a39c59d3e92b50926a29eebc883b820924f9444da80685ec8

Download Submit
C:\Windows\System\vWNeCJn.exe

Filesize
1.7MB

MD5
8ec6f046406375826ea3e97c5461e465

SHA1
f75bc346bc32c8b5de12beae45ce8889722bdad6

SHA256
306aeffee81b8dbcaac6d2af29ecb81cad2f5de72e31054d9c3b1033c8bed418

SHA512
74e47fdc293dfec7243d2328dbbd6d3956297ed1a56383908fd1fcaf72d2db6c50c94a81b04e085faf316f0a1d20f6c4ce3cdd20598568042d0d116f8fff8b83

Download Submit
C:\Windows\System\vpXllyO.exe

Filesize
1.7MB

MD5
a57fea9ca0e9fb1afa0f9eb716ebebbd

SHA1
eacf87233f0c18115e6c4fa65cd27c5fcdc52a8f

SHA256
c148d5d3daba63f1c36aaec34b985d5b77310bc4f8bc145c8f7345e199c74ed8

SHA512
bbe52800e0c5f45b114b40878703a78b978029e5d000050fdacd6fa2ae8c40e84021afd64befc41a179a3d6fe27d493d1caabf72e54ed5936cbcd9526e92b72b

Download Submit
C:\Windows\System\xpZpyPb.exe

Filesize
1.7MB

MD5
3579c1513b99e8d7b1660343453cad7f

SHA1
e68a90a472a9e1a21a18007b831342cbbb05a33e

SHA256
b8df9265a2c9f779c9bc161e9eb1869903cf21e4f2d776d3caf0112ead8d18ea

SHA512
ce9011043ec0dd665964c06a385931e881112e8936403b89711516754d57ccf0a7c7821109a154cb9b1d5b432647688b16cc93253dd2ec00064c055d1a0e1121

Download Submit
memory/344-1-0x000001A54FAA0000-0x000001A54FAB0000-memory.dmp

Filesize
64KB

Download
memory/344-0-0x00007FF7F98B0000-0x00007FF7F9CA2000-memory.dmp

Filesize
3.9MB

Download
memory/968-508-0x00007FF737840000-0x00007FF737C32000-memory.dmp

Filesize
3.9MB

Download
memory/968-2729-0x00007FF737840000-0x00007FF737C32000-memory.dmp

Filesize
3.9MB

Download
memory/972-668-0x00007FF691B50000-0x00007FF691F42000-memory.dmp

Filesize
3.9MB

Download
memory/972-2754-0x00007FF691B50000-0x00007FF691F42000-memory.dmp

Filesize
3.9MB

Download
memory/1108-669-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-2716-0x00007FF7D7A00000-0x00007FF7D7DF2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-2722-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1132-670-0x00007FF69BDF0000-0x00007FF69C1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1404-2760-0x00007FF7BC0B0000-0x00007FF7BC4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1404-661-0x00007FF7BC0B0000-0x00007FF7BC4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2128-307-0x00007FF7B4C60000-0x00007FF7B5052000-memory.dmp

Filesize
3.9MB

Download
memory/2128-2744-0x00007FF7B4C60000-0x00007FF7B5052000-memory.dmp

Filesize
3.9MB

Download
memory/2248-382-0x00007FF665A50000-0x00007FF665E42000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2724-0x00007FF665A50000-0x00007FF665E42000-memory.dmp

Filesize
3.9MB

Download
memory/2572-2757-0x00007FF7928A0000-0x00007FF792C92000-memory.dmp

Filesize
3.9MB

Download
memory/2572-660-0x00007FF7928A0000-0x00007FF792C92000-memory.dmp

Filesize
3.9MB

Download
memory/2668-2751-0x00007FF62F9E0000-0x00007FF62FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-513-0x00007FF62F9E0000-0x00007FF62FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-2762-0x00007FF787CE0000-0x00007FF7880D2000-memory.dmp

Filesize
3.9MB

Download
memory/3004-663-0x00007FF787CE0000-0x00007FF7880D2000-memory.dmp

Filesize
3.9MB

Download
memory/3056-2781-0x00007FF66E730000-0x00007FF66EB22000-memory.dmp

Filesize
3.9MB

Download
memory/3056-317-0x00007FF66E730000-0x00007FF66EB22000-memory.dmp

Filesize
3.9MB

Download
memory/3100-2764-0x00007FF6C6160000-0x00007FF6C6552000-memory.dmp

Filesize
3.9MB

Download
memory/3100-662-0x00007FF6C6160000-0x00007FF6C6552000-memory.dmp

Filesize
3.9MB

Download
memory/3492-2748-0x00007FF7AB740000-0x00007FF7ABB32000-memory.dmp

Filesize
3.9MB

Download
memory/3492-664-0x00007FF7AB740000-0x00007FF7ABB32000-memory.dmp

Filesize
3.9MB

Download
memory/3692-2766-0x00007FF7E0780000-0x00007FF7E0B72000-memory.dmp

Filesize
3.9MB

Download
memory/3692-665-0x00007FF7E0780000-0x00007FF7E0B72000-memory.dmp

Filesize
3.9MB

Download
memory/3712-257-0x00007FF7A6040000-0x00007FF7A6432000-memory.dmp

Filesize
3.9MB

Download
memory/3712-2730-0x00007FF7A6040000-0x00007FF7A6432000-memory.dmp

Filesize
3.9MB

Download
memory/3724-2769-0x00007FF764010000-0x00007FF764402000-memory.dmp

Filesize
3.9MB

Download
memory/3724-666-0x00007FF764010000-0x00007FF764402000-memory.dmp

Filesize
3.9MB

Download
memory/3836-409-0x00007FF7D5290000-0x00007FF7D5682000-memory.dmp

Filesize
3.9MB

Download
memory/3836-2746-0x00007FF7D5290000-0x00007FF7D5682000-memory.dmp

Filesize
3.9MB

Download
memory/3848-146-0x00007FF8E8EF0000-0x00007FF8E99B1000-memory.dmp

Filesize
10.8MB

Download
memory/3848-285-0x00000203716B0000-0x00000203716D2000-memory.dmp

Filesize
136KB

Download
memory/3848-13-0x00007FF8E8EF3000-0x00007FF8E8EF5000-memory.dmp

Filesize
8KB

Download
memory/3848-74-0x00007FF8E8EF0000-0x00007FF8E99B1000-memory.dmp

Filesize
10.8MB

Download
memory/3924-260-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp

Filesize
3.9MB

Download
memory/3924-2732-0x00007FF693BE0000-0x00007FF693FD2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-2718-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-2650-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-12-0x00007FF77D9E0000-0x00007FF77DDD2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-2750-0x00007FF76B060000-0x00007FF76B452000-memory.dmp

Filesize
3.9MB

Download
memory/4228-549-0x00007FF76B060000-0x00007FF76B452000-memory.dmp

Filesize
3.9MB

Download
memory/4400-667-0x00007FF712690000-0x00007FF712A82000-memory.dmp

Filesize
3.9MB

Download
memory/4400-2790-0x00007FF712690000-0x00007FF712A82000-memory.dmp

Filesize
3.9MB

Download
memory/4764-410-0x00007FF7C2E90000-0x00007FF7C3282000-memory.dmp

Filesize
3.9MB

Download
memory/4764-2726-0x00007FF7C2E90000-0x00007FF7C3282000-memory.dmp

Filesize
3.9MB

Download
memory/4772-671-0x00007FF66F430000-0x00007FF66F822000-memory.dmp

Filesize
3.9MB

Download
memory/4772-2758-0x00007FF66F430000-0x00007FF66F822000-memory.dmp

Filesize
3.9MB

Download
memory/4988-2721-0x00007FF7AB3B0000-0x00007FF7AB7A2000-memory.dmp

Filesize
3.9MB

Download
memory/4988-215-0x00007FF7AB3B0000-0x00007FF7AB7A2000-memory.dmp

Filesize
3.9MB

Download