xmrig | 5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687

Analysis

max time kernel
97s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
Size

1.7MB
MD5

e70d24529b08e0f784fed16cebbe4140
SHA1

beec23f9c5b7514a0103b27ffe8ba7724e6c1b82
SHA256

5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687
SHA512

dad38df0c0546fc51a6ef069c6831d9750b5f588174c1e875d4d9ebfbfcc1174bcbb77e990bd52625e203ec76b68d0c63ea3b9c73c5407f18aa50e8c8f8b95aa
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwV0L+ct:Lz071uv4BPMkFfdg6NsIRSwVmt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/2012-208-0x00007FF682B00000-0x00007FF682EF2000-memory.dmp	xmrig
behavioral2/memory/1604-556-0x00007FF784770000-0x00007FF784B62000-memory.dmp	xmrig
behavioral2/memory/4400-562-0x00007FF62EA80000-0x00007FF62EE72000-memory.dmp	xmrig
behavioral2/memory/3664-567-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp	xmrig
behavioral2/memory/1892-721-0x00007FF636D60000-0x00007FF637152000-memory.dmp	xmrig
behavioral2/memory/4224-756-0x00007FF63F350000-0x00007FF63F742000-memory.dmp	xmrig
behavioral2/memory/1064-566-0x00007FF6F6440000-0x00007FF6F6832000-memory.dmp	xmrig
behavioral2/memory/3884-565-0x00007FF75FBE0000-0x00007FF75FFD2000-memory.dmp	xmrig
behavioral2/memory/4472-564-0x00007FF616830000-0x00007FF616C22000-memory.dmp	xmrig
behavioral2/memory/4220-563-0x00007FF635120000-0x00007FF635512000-memory.dmp	xmrig
behavioral2/memory/4516-561-0x00007FF676EA0000-0x00007FF677292000-memory.dmp	xmrig
behavioral2/memory/3076-560-0x00007FF7075F0000-0x00007FF7079E2000-memory.dmp	xmrig
behavioral2/memory/3208-559-0x00007FF6D84B0000-0x00007FF6D88A2000-memory.dmp	xmrig
behavioral2/memory/2216-558-0x00007FF7F6D50000-0x00007FF7F7142000-memory.dmp	xmrig
behavioral2/memory/560-557-0x00007FF768310000-0x00007FF768702000-memory.dmp	xmrig
behavioral2/memory/2492-555-0x00007FF696D30000-0x00007FF697122000-memory.dmp	xmrig
behavioral2/memory/1628-554-0x00007FF6607F0000-0x00007FF660BE2000-memory.dmp	xmrig
behavioral2/memory/4696-553-0x00007FF656430000-0x00007FF656822000-memory.dmp	xmrig
behavioral2/memory/3104-551-0x00007FF725BD0000-0x00007FF725FC2000-memory.dmp	xmrig
behavioral2/memory/3320-518-0x00007FF7F1950000-0x00007FF7F1D42000-memory.dmp	xmrig
behavioral2/memory/3940-409-0x00007FF6A6250000-0x00007FF6A6642000-memory.dmp	xmrig
behavioral2/memory/4900-236-0x00007FF784C60000-0x00007FF785052000-memory.dmp	xmrig
behavioral2/memory/3292-146-0x00007FF7E83A0000-0x00007FF7E8792000-memory.dmp	xmrig
behavioral2/memory/1620-2798-0x00007FF6A34A0000-0x00007FF6A3892000-memory.dmp	xmrig
behavioral2/memory/1892-2818-0x00007FF636D60000-0x00007FF637152000-memory.dmp	xmrig
behavioral2/memory/4900-2819-0x00007FF784C60000-0x00007FF785052000-memory.dmp	xmrig
behavioral2/memory/3664-2821-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp	xmrig
behavioral2/memory/2012-2823-0x00007FF682B00000-0x00007FF682EF2000-memory.dmp	xmrig
behavioral2/memory/1628-2838-0x00007FF6607F0000-0x00007FF660BE2000-memory.dmp	xmrig
behavioral2/memory/3292-2841-0x00007FF7E83A0000-0x00007FF7E8792000-memory.dmp	xmrig
behavioral2/memory/4696-2845-0x00007FF656430000-0x00007FF656822000-memory.dmp	xmrig
behavioral2/memory/3208-2847-0x00007FF6D84B0000-0x00007FF6D88A2000-memory.dmp	xmrig
behavioral2/memory/4400-2851-0x00007FF62EA80000-0x00007FF62EE72000-memory.dmp	xmrig
behavioral2/memory/4220-2854-0x00007FF635120000-0x00007FF635512000-memory.dmp	xmrig
behavioral2/memory/1604-2849-0x00007FF784770000-0x00007FF784B62000-memory.dmp	xmrig
behavioral2/memory/2216-2843-0x00007FF7F6D50000-0x00007FF7F7142000-memory.dmp	xmrig
behavioral2/memory/3076-2840-0x00007FF7075F0000-0x00007FF7079E2000-memory.dmp	xmrig
behavioral2/memory/3940-2836-0x00007FF6A6250000-0x00007FF6A6642000-memory.dmp	xmrig
behavioral2/memory/560-2831-0x00007FF768310000-0x00007FF768702000-memory.dmp	xmrig
behavioral2/memory/3104-2830-0x00007FF725BD0000-0x00007FF725FC2000-memory.dmp	xmrig
behavioral2/memory/2492-2828-0x00007FF696D30000-0x00007FF697122000-memory.dmp	xmrig
behavioral2/memory/3320-2834-0x00007FF7F1950000-0x00007FF7F1D42000-memory.dmp	xmrig
behavioral2/memory/4516-2826-0x00007FF676EA0000-0x00007FF677292000-memory.dmp	xmrig
behavioral2/memory/4224-2912-0x00007FF63F350000-0x00007FF63F742000-memory.dmp	xmrig
behavioral2/memory/3884-2898-0x00007FF75FBE0000-0x00007FF75FFD2000-memory.dmp	xmrig
behavioral2/memory/1064-2882-0x00007FF6F6440000-0x00007FF6F6832000-memory.dmp	xmrig
behavioral2/memory/4472-2881-0x00007FF616830000-0x00007FF616C22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2728	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1620	aSLFBdk.exe
3664	sjiNlEf.exe
3292	qwscVVD.exe
1892	IrRwPfw.exe
2012	SCpgEHE.exe
4900	wNlvxBU.exe
3940	wFLqqYn.exe
3320	bBcIUfJ.exe
3104	etMbuPQ.exe
4696	TEKQsYc.exe
1628	NVlBSaH.exe
2492	PqkBxyy.exe
1604	nTdJtls.exe
560	isJMxcG.exe
2216	eMBpZWl.exe
3208	zbBupNM.exe
3076	wREQmFi.exe
4516	RWVhjtj.exe
4400	EMHocTY.exe
4220	sUIxxuX.exe
4472	TXtrZbZ.exe
4224	ELFHqtv.exe
3884	JsbRPjE.exe
1064	LdEepKU.exe
4800	ZrhnbIA.exe
2148	iQifaZE.exe
2488	aVxdKQb.exe
548	xBcXvTp.exe
3096	OkMHQgO.exe
3004	BupiAwe.exe
4540	xfWdyAO.exe
2272	pEhTtlq.exe
3900	WosKHym.exe
4152	aQQZnFA.exe
4588	ZPoNYkn.exe
4812	ChnfoTm.exe
2252	RmMoVPR.exe
3520	nEJfXYC.exe
4444	sGBonAj.exe
3720	aVbNkuu.exe
2896	bPFxUwe.exe
4172	aitbCFR.exe
2820	UKlmvWN.exe
2496	bmBCoIa.exe
4292	uuttgSp.exe
5096	ooPJSae.exe
2828	nJrtNwB.exe
3132	fXEKRrG.exe
1152	uvWPTTF.exe
1236	oMtwpMt.exe
4880	lqfbice.exe
1504	hOlwdAT.exe
4836	tqfqyQn.exe
3084	NfVjPuA.exe
4788	GibrWSC.exe
4764	MQMIQaN.exe
3312	dSJuGcY.exe
1652	xCmmdaJ.exe
3252	AZzedlp.exe
4736	gTnxeaz.exe
1340	cNPdlWS.exe
2740	cSjbdEq.exe
2612	jUGnUoP.exe
2584	hTQrYSK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2380-0-0x00007FF7BEBF0000-0x00007FF7BEFE2000-memory.dmp	upx
behavioral2/files/0x000800000002346a-5.dat	upx
behavioral2/files/0x000700000002346e-10.dat	upx
behavioral2/memory/2012-208-0x00007FF682B00000-0x00007FF682EF2000-memory.dmp	upx
behavioral2/memory/1604-556-0x00007FF784770000-0x00007FF784B62000-memory.dmp	upx
behavioral2/memory/4400-562-0x00007FF62EA80000-0x00007FF62EE72000-memory.dmp	upx
behavioral2/memory/3664-567-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp	upx
behavioral2/memory/1892-721-0x00007FF636D60000-0x00007FF637152000-memory.dmp	upx
behavioral2/memory/4224-756-0x00007FF63F350000-0x00007FF63F742000-memory.dmp	upx
behavioral2/memory/1064-566-0x00007FF6F6440000-0x00007FF6F6832000-memory.dmp	upx
behavioral2/memory/3884-565-0x00007FF75FBE0000-0x00007FF75FFD2000-memory.dmp	upx
behavioral2/memory/4472-564-0x00007FF616830000-0x00007FF616C22000-memory.dmp	upx
behavioral2/memory/4220-563-0x00007FF635120000-0x00007FF635512000-memory.dmp	upx
behavioral2/memory/4516-561-0x00007FF676EA0000-0x00007FF677292000-memory.dmp	upx
behavioral2/memory/3076-560-0x00007FF7075F0000-0x00007FF7079E2000-memory.dmp	upx
behavioral2/memory/3208-559-0x00007FF6D84B0000-0x00007FF6D88A2000-memory.dmp	upx
behavioral2/memory/2216-558-0x00007FF7F6D50000-0x00007FF7F7142000-memory.dmp	upx
behavioral2/memory/560-557-0x00007FF768310000-0x00007FF768702000-memory.dmp	upx
behavioral2/memory/2492-555-0x00007FF696D30000-0x00007FF697122000-memory.dmp	upx
behavioral2/memory/1628-554-0x00007FF6607F0000-0x00007FF660BE2000-memory.dmp	upx
behavioral2/memory/4696-553-0x00007FF656430000-0x00007FF656822000-memory.dmp	upx
behavioral2/memory/3104-551-0x00007FF725BD0000-0x00007FF725FC2000-memory.dmp	upx
behavioral2/memory/3320-518-0x00007FF7F1950000-0x00007FF7F1D42000-memory.dmp	upx
behavioral2/memory/3940-409-0x00007FF6A6250000-0x00007FF6A6642000-memory.dmp	upx
behavioral2/memory/4900-236-0x00007FF784C60000-0x00007FF785052000-memory.dmp	upx
behavioral2/files/0x0007000000023481-192.dat	upx
behavioral2/files/0x000700000002347a-188.dat	upx
behavioral2/files/0x0007000000023479-185.dat	upx
behavioral2/files/0x0007000000023493-184.dat	upx
behavioral2/files/0x0007000000023492-183.dat	upx
behavioral2/files/0x000700000002347d-176.dat	upx
behavioral2/files/0x0007000000023485-174.dat	upx
behavioral2/files/0x0007000000023491-171.dat	upx
behavioral2/files/0x0007000000023490-170.dat	upx
behavioral2/files/0x000700000002348f-169.dat	upx
behavioral2/files/0x000700000002348e-165.dat	upx
behavioral2/files/0x000700000002348c-158.dat	upx
behavioral2/files/0x000700000002348b-157.dat	upx
behavioral2/files/0x000700000002348a-154.dat	upx
behavioral2/files/0x000700000002347c-153.dat	upx
behavioral2/files/0x000700000002348d-152.dat	upx
behavioral2/memory/3292-146-0x00007FF7E83A0000-0x00007FF7E8792000-memory.dmp	upx
behavioral2/files/0x0007000000023489-142.dat	upx
behavioral2/files/0x0007000000023483-139.dat	upx
behavioral2/files/0x0007000000023482-138.dat	upx
behavioral2/files/0x0007000000023488-136.dat	upx
behavioral2/files/0x0007000000023480-132.dat	upx
behavioral2/files/0x0007000000023478-128.dat	upx
behavioral2/files/0x0007000000023486-126.dat	upx
behavioral2/files/0x000700000002347e-125.dat	upx
behavioral2/files/0x0007000000023487-182.dat	upx
behavioral2/files/0x0007000000023476-122.dat	upx
behavioral2/files/0x0007000000023475-119.dat	upx
behavioral2/files/0x0007000000023484-116.dat	upx
behavioral2/files/0x000700000002347b-107.dat	upx
behavioral2/files/0x0007000000023474-103.dat	upx
behavioral2/files/0x0007000000023473-100.dat	upx
behavioral2/files/0x0007000000023471-96.dat	upx
behavioral2/files/0x000700000002347f-83.dat	upx
behavioral2/files/0x0007000000023477-59.dat	upx
behavioral2/files/0x000700000002346f-48.dat	upx
behavioral2/files/0x0007000000023470-30.dat	upx
behavioral2/files/0x0007000000023472-28.dat	upx
behavioral2/memory/1620-14-0x00007FF6A34A0000-0x00007FF6A3892000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sGBonAj.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\FCZRPmI.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\gwFEnBJ.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\ifFOKyo.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\mmJsEZn.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\FlyAqst.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\WCmwHQS.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\uuttgSp.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\lDhToIJ.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\ogJWOuG.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\mBhbcPc.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\GjrcCAS.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\LxcixkT.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\xEUBpJX.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\MqkbZVp.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\uZgYoNQ.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\qppgVQu.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\jJzGHLw.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\xUGfYgb.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\yTOuOdq.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\KBeKbtS.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\ZxTuLuA.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\OlHoTyi.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\orwJXLl.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\mNGtPud.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\RjlROPk.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\vzcdSpH.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\CcjIGod.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\miJuMhz.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\pFdhZyS.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\MslTYuM.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\sVijMRa.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\QksEdxA.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\FegBmLQ.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\UopIfJJ.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\SQFOoId.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\aQIfGvH.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\HPvkXej.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\HpgpZwo.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\qujAqPH.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\ECuPOEu.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\jOWCwIL.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\XfFdfOW.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\etMbuPQ.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\aVxdKQb.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\OstTqjD.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\lqotRkm.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\BacqmAt.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\JzTnDDz.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\gMRvlPL.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\eQTlXof.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\YNnzDcO.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\AYlaaij.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\bKgEfTe.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\yWRxKNl.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\LWlruob.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\sepWkMU.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\XAvgzSF.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\xkvfqVV.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\DIEECaU.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\dkLnLVK.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\rCtlCmV.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\blfzkXq.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
File created	C:\Windows\System\pgpqmnH.exe	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2728	powershell.exe
2728	powershell.exe
2728	powershell.exe
2728	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeLockMemoryPrivilege	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
Token: SeLockMemoryPrivilege	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2728	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	83
PID 2380 wrote to memory of 2728	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	83
PID 2380 wrote to memory of 1620	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	84
PID 2380 wrote to memory of 1620	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	84
PID 2380 wrote to memory of 3664	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	85
PID 2380 wrote to memory of 3664	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	85
PID 2380 wrote to memory of 3292	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	86
PID 2380 wrote to memory of 3292	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	86
PID 2380 wrote to memory of 1892	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	87
PID 2380 wrote to memory of 1892	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	87
PID 2380 wrote to memory of 2012	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	88
PID 2380 wrote to memory of 2012	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	88
PID 2380 wrote to memory of 4900	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	89
PID 2380 wrote to memory of 4900	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	89
PID 2380 wrote to memory of 3940	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	90
PID 2380 wrote to memory of 3940	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	90
PID 2380 wrote to memory of 3320	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	91
PID 2380 wrote to memory of 3320	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	91
PID 2380 wrote to memory of 3104	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	92
PID 2380 wrote to memory of 3104	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	92
PID 2380 wrote to memory of 4696	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	93
PID 2380 wrote to memory of 4696	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	93
PID 2380 wrote to memory of 1628	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	94
PID 2380 wrote to memory of 1628	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	94
PID 2380 wrote to memory of 2492	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	95
PID 2380 wrote to memory of 2492	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	95
PID 2380 wrote to memory of 1604	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	96
PID 2380 wrote to memory of 1604	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	96
PID 2380 wrote to memory of 4400	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	97
PID 2380 wrote to memory of 4400	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	97
PID 2380 wrote to memory of 560	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	98
PID 2380 wrote to memory of 560	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	98
PID 2380 wrote to memory of 2216	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	99
PID 2380 wrote to memory of 2216	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	99
PID 2380 wrote to memory of 3208	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	100
PID 2380 wrote to memory of 3208	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	100
PID 2380 wrote to memory of 3884	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	101
PID 2380 wrote to memory of 3884	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	101
PID 2380 wrote to memory of 3076	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	102
PID 2380 wrote to memory of 3076	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	102
PID 2380 wrote to memory of 4516	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	103
PID 2380 wrote to memory of 4516	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	103
PID 2380 wrote to memory of 4220	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	104
PID 2380 wrote to memory of 4220	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	104
PID 2380 wrote to memory of 2148	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	105
PID 2380 wrote to memory of 2148	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	105
PID 2380 wrote to memory of 4472	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	106
PID 2380 wrote to memory of 4472	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	106
PID 2380 wrote to memory of 4224	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	107
PID 2380 wrote to memory of 4224	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	107
PID 2380 wrote to memory of 4812	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	108
PID 2380 wrote to memory of 4812	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	108
PID 2380 wrote to memory of 1064	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	109
PID 2380 wrote to memory of 1064	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	109
PID 2380 wrote to memory of 2252	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	110
PID 2380 wrote to memory of 2252	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	110
PID 2380 wrote to memory of 4800	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	111
PID 2380 wrote to memory of 4800	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	111
PID 2380 wrote to memory of 2488	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	112
PID 2380 wrote to memory of 2488	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	112
PID 2380 wrote to memory of 548	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	113
PID 2380 wrote to memory of 548	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	113
PID 2380 wrote to memory of 3096	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	114
PID 2380 wrote to memory of 3096	2380	5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe	114

C:\Users\Admin\AppData\Local\Temp\5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe
"C:\Users\Admin\AppData\Local\Temp\5562c77f686b8097798eef7b0aa9054034de3d5a39d2284cb4d6fa8a8e031687N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2728" "2104" "2000" "2108" "0" "0" "2112" "0" "0" "0" "0" "0"
    3⤵
    PID:13248
- C:\Windows\System\aSLFBdk.exe
  C:\Windows\System\aSLFBdk.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\sjiNlEf.exe
  C:\Windows\System\sjiNlEf.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\qwscVVD.exe
  C:\Windows\System\qwscVVD.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\IrRwPfw.exe
  C:\Windows\System\IrRwPfw.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\SCpgEHE.exe
  C:\Windows\System\SCpgEHE.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\wNlvxBU.exe
  C:\Windows\System\wNlvxBU.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\wFLqqYn.exe
  C:\Windows\System\wFLqqYn.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\bBcIUfJ.exe
  C:\Windows\System\bBcIUfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\etMbuPQ.exe
  C:\Windows\System\etMbuPQ.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\TEKQsYc.exe
  C:\Windows\System\TEKQsYc.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\NVlBSaH.exe
  C:\Windows\System\NVlBSaH.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\PqkBxyy.exe
  C:\Windows\System\PqkBxyy.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\nTdJtls.exe
  C:\Windows\System\nTdJtls.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\EMHocTY.exe
  C:\Windows\System\EMHocTY.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\isJMxcG.exe
  C:\Windows\System\isJMxcG.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\eMBpZWl.exe
  C:\Windows\System\eMBpZWl.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\zbBupNM.exe
  C:\Windows\System\zbBupNM.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\JsbRPjE.exe
  C:\Windows\System\JsbRPjE.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\wREQmFi.exe
  C:\Windows\System\wREQmFi.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\RWVhjtj.exe
  C:\Windows\System\RWVhjtj.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\sUIxxuX.exe
  C:\Windows\System\sUIxxuX.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\iQifaZE.exe
  C:\Windows\System\iQifaZE.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\TXtrZbZ.exe
  C:\Windows\System\TXtrZbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ELFHqtv.exe
  C:\Windows\System\ELFHqtv.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\ChnfoTm.exe
  C:\Windows\System\ChnfoTm.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\LdEepKU.exe
  C:\Windows\System\LdEepKU.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RmMoVPR.exe
  C:\Windows\System\RmMoVPR.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ZrhnbIA.exe
  C:\Windows\System\ZrhnbIA.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\aVxdKQb.exe
  C:\Windows\System\aVxdKQb.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\xBcXvTp.exe
  C:\Windows\System\xBcXvTp.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\OkMHQgO.exe
  C:\Windows\System\OkMHQgO.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\BupiAwe.exe
  C:\Windows\System\BupiAwe.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\xfWdyAO.exe
  C:\Windows\System\xfWdyAO.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\pEhTtlq.exe
  C:\Windows\System\pEhTtlq.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\WosKHym.exe
  C:\Windows\System\WosKHym.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\aQQZnFA.exe
  C:\Windows\System\aQQZnFA.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\ZPoNYkn.exe
  C:\Windows\System\ZPoNYkn.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\nEJfXYC.exe
  C:\Windows\System\nEJfXYC.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\sGBonAj.exe
  C:\Windows\System\sGBonAj.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\aVbNkuu.exe
  C:\Windows\System\aVbNkuu.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\tqfqyQn.exe
  C:\Windows\System\tqfqyQn.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\bPFxUwe.exe
  C:\Windows\System\bPFxUwe.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\aitbCFR.exe
  C:\Windows\System\aitbCFR.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\GibrWSC.exe
  C:\Windows\System\GibrWSC.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\MQMIQaN.exe
  C:\Windows\System\MQMIQaN.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\dSJuGcY.exe
  C:\Windows\System\dSJuGcY.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\UKlmvWN.exe
  C:\Windows\System\UKlmvWN.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\bmBCoIa.exe
  C:\Windows\System\bmBCoIa.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\uuttgSp.exe
  C:\Windows\System\uuttgSp.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\ooPJSae.exe
  C:\Windows\System\ooPJSae.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\nJrtNwB.exe
  C:\Windows\System\nJrtNwB.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\fXEKRrG.exe
  C:\Windows\System\fXEKRrG.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\uvWPTTF.exe
  C:\Windows\System\uvWPTTF.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\oMtwpMt.exe
  C:\Windows\System\oMtwpMt.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\lqfbice.exe
  C:\Windows\System\lqfbice.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\hOlwdAT.exe
  C:\Windows\System\hOlwdAT.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\NfVjPuA.exe
  C:\Windows\System\NfVjPuA.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\xCmmdaJ.exe
  C:\Windows\System\xCmmdaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\AZzedlp.exe
  C:\Windows\System\AZzedlp.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\gTnxeaz.exe
  C:\Windows\System\gTnxeaz.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\cNPdlWS.exe
  C:\Windows\System\cNPdlWS.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\cSjbdEq.exe
  C:\Windows\System\cSjbdEq.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\jUGnUoP.exe
  C:\Windows\System\jUGnUoP.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\hTQrYSK.exe
  C:\Windows\System\hTQrYSK.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\IxZPkJm.exe
  C:\Windows\System\IxZPkJm.exe
  2⤵
  PID:5116
- C:\Windows\System\mMxSxVY.exe
  C:\Windows\System\mMxSxVY.exe
  2⤵
  PID:4412
- C:\Windows\System\rDFMaqj.exe
  C:\Windows\System\rDFMaqj.exe
  2⤵
  PID:1760
- C:\Windows\System\PyNQbbJ.exe
  C:\Windows\System\PyNQbbJ.exe
  2⤵
  PID:3152
- C:\Windows\System\zzaVsHe.exe
  C:\Windows\System\zzaVsHe.exe
  2⤵
  PID:4356
- C:\Windows\System\WgzHMDG.exe
  C:\Windows\System\WgzHMDG.exe
  2⤵
  PID:4340
- C:\Windows\System\OmblHog.exe
  C:\Windows\System\OmblHog.exe
  2⤵
  PID:4968
- C:\Windows\System\TjofCVD.exe
  C:\Windows\System\TjofCVD.exe
  2⤵
  PID:824
- C:\Windows\System\RFYIURV.exe
  C:\Windows\System\RFYIURV.exe
  2⤵
  PID:4384
- C:\Windows\System\wDSnFUz.exe
  C:\Windows\System\wDSnFUz.exe
  2⤵
  PID:1028
- C:\Windows\System\aFyDWOM.exe
  C:\Windows\System\aFyDWOM.exe
  2⤵
  PID:1100
- C:\Windows\System\EaHwCIK.exe
  C:\Windows\System\EaHwCIK.exe
  2⤵
  PID:1584
- C:\Windows\System\MslTYuM.exe
  C:\Windows\System\MslTYuM.exe
  2⤵
  PID:3512
- C:\Windows\System\SKmhFGf.exe
  C:\Windows\System\SKmhFGf.exe
  2⤵
  PID:3260
- C:\Windows\System\kAYIPJk.exe
  C:\Windows\System\kAYIPJk.exe
  2⤵
  PID:1432
- C:\Windows\System\BhbHwpq.exe
  C:\Windows\System\BhbHwpq.exe
  2⤵
  PID:2448
- C:\Windows\System\SMljJpZ.exe
  C:\Windows\System\SMljJpZ.exe
  2⤵
  PID:3908
- C:\Windows\System\tlnOgkc.exe
  C:\Windows\System\tlnOgkc.exe
  2⤵
  PID:3392
- C:\Windows\System\AatvPPv.exe
  C:\Windows\System\AatvPPv.exe
  2⤵
  PID:1172
- C:\Windows\System\PKZKuPl.exe
  C:\Windows\System\PKZKuPl.exe
  2⤵
  PID:4700
- C:\Windows\System\xgqVGTO.exe
  C:\Windows\System\xgqVGTO.exe
  2⤵
  PID:2908
- C:\Windows\System\UAmFGIu.exe
  C:\Windows\System\UAmFGIu.exe
  2⤵
  PID:4644
- C:\Windows\System\jQDZRJa.exe
  C:\Windows\System\jQDZRJa.exe
  2⤵
  PID:2900
- C:\Windows\System\mdTGNGA.exe
  C:\Windows\System\mdTGNGA.exe
  2⤵
  PID:2468
- C:\Windows\System\fIyLMDG.exe
  C:\Windows\System\fIyLMDG.exe
  2⤵
  PID:3528
- C:\Windows\System\HuIyYvb.exe
  C:\Windows\System\HuIyYvb.exe
  2⤵
  PID:632
- C:\Windows\System\MEIMMyN.exe
  C:\Windows\System\MEIMMyN.exe
  2⤵
  PID:4528
- C:\Windows\System\oZrdyDg.exe
  C:\Windows\System\oZrdyDg.exe
  2⤵
  PID:1768
- C:\Windows\System\oLzDSYy.exe
  C:\Windows\System\oLzDSYy.exe
  2⤵
  PID:2736
- C:\Windows\System\FDuwrEs.exe
  C:\Windows\System\FDuwrEs.exe
  2⤵
  PID:888
- C:\Windows\System\QmhZIpu.exe
  C:\Windows\System\QmhZIpu.exe
  2⤵
  PID:4436
- C:\Windows\System\lPcgcNE.exe
  C:\Windows\System\lPcgcNE.exe
  2⤵
  PID:1824
- C:\Windows\System\KUKilrQ.exe
  C:\Windows\System\KUKilrQ.exe
  2⤵
  PID:1692
- C:\Windows\System\XgWQlrH.exe
  C:\Windows\System\XgWQlrH.exe
  2⤵
  PID:2824
- C:\Windows\System\XmQCujm.exe
  C:\Windows\System\XmQCujm.exe
  2⤵
  PID:3124
- C:\Windows\System\YZmpDoL.exe
  C:\Windows\System\YZmpDoL.exe
  2⤵
  PID:1444
- C:\Windows\System\NdevEem.exe
  C:\Windows\System\NdevEem.exe
  2⤵
  PID:5144
- C:\Windows\System\QAilKJc.exe
  C:\Windows\System\QAilKJc.exe
  2⤵
  PID:5160
- C:\Windows\System\wrILKqa.exe
  C:\Windows\System\wrILKqa.exe
  2⤵
  PID:5196
- C:\Windows\System\LWmHjAZ.exe
  C:\Windows\System\LWmHjAZ.exe
  2⤵
  PID:5220
- C:\Windows\System\NBaQbrR.exe
  C:\Windows\System\NBaQbrR.exe
  2⤵
  PID:5236
- C:\Windows\System\noeBkzn.exe
  C:\Windows\System\noeBkzn.exe
  2⤵
  PID:5272
- C:\Windows\System\RUfPunL.exe
  C:\Windows\System\RUfPunL.exe
  2⤵
  PID:5292
- C:\Windows\System\tFyidsH.exe
  C:\Windows\System\tFyidsH.exe
  2⤵
  PID:5316
- C:\Windows\System\NAPNAXQ.exe
  C:\Windows\System\NAPNAXQ.exe
  2⤵
  PID:5332
- C:\Windows\System\EZAQqkZ.exe
  C:\Windows\System\EZAQqkZ.exe
  2⤵
  PID:5356
- C:\Windows\System\tsdVWlN.exe
  C:\Windows\System\tsdVWlN.exe
  2⤵
  PID:5384
- C:\Windows\System\gxDiWZM.exe
  C:\Windows\System\gxDiWZM.exe
  2⤵
  PID:5400
- C:\Windows\System\jtXxkqp.exe
  C:\Windows\System\jtXxkqp.exe
  2⤵
  PID:5416
- C:\Windows\System\wNTWceC.exe
  C:\Windows\System\wNTWceC.exe
  2⤵
  PID:5432
- C:\Windows\System\XpTIcyy.exe
  C:\Windows\System\XpTIcyy.exe
  2⤵
  PID:5452
- C:\Windows\System\MQZxotm.exe
  C:\Windows\System\MQZxotm.exe
  2⤵
  PID:5476
- C:\Windows\System\aAlhXOa.exe
  C:\Windows\System\aAlhXOa.exe
  2⤵
  PID:5500
- C:\Windows\System\WTnRpyV.exe
  C:\Windows\System\WTnRpyV.exe
  2⤵
  PID:5524
- C:\Windows\System\PrBuIzI.exe
  C:\Windows\System\PrBuIzI.exe
  2⤵
  PID:5548
- C:\Windows\System\bTfLKyU.exe
  C:\Windows\System\bTfLKyU.exe
  2⤵
  PID:5568
- C:\Windows\System\LtfEFGl.exe
  C:\Windows\System\LtfEFGl.exe
  2⤵
  PID:5592
- C:\Windows\System\nQyNTha.exe
  C:\Windows\System\nQyNTha.exe
  2⤵
  PID:5620
- C:\Windows\System\ucInLTD.exe
  C:\Windows\System\ucInLTD.exe
  2⤵
  PID:5636
- C:\Windows\System\EGdTfyL.exe
  C:\Windows\System\EGdTfyL.exe
  2⤵
  PID:5656
- C:\Windows\System\HmsLqCV.exe
  C:\Windows\System\HmsLqCV.exe
  2⤵
  PID:5676
- C:\Windows\System\YbpMbSW.exe
  C:\Windows\System\YbpMbSW.exe
  2⤵
  PID:5724
- C:\Windows\System\xshwIUC.exe
  C:\Windows\System\xshwIUC.exe
  2⤵
  PID:5752
- C:\Windows\System\TRYnHxm.exe
  C:\Windows\System\TRYnHxm.exe
  2⤵
  PID:5772
- C:\Windows\System\sUnrTTD.exe
  C:\Windows\System\sUnrTTD.exe
  2⤵
  PID:5796
- C:\Windows\System\ZTENTvh.exe
  C:\Windows\System\ZTENTvh.exe
  2⤵
  PID:5820
- C:\Windows\System\EEAYWqL.exe
  C:\Windows\System\EEAYWqL.exe
  2⤵
  PID:5860
- C:\Windows\System\QdIavlH.exe
  C:\Windows\System\QdIavlH.exe
  2⤵
  PID:5876
- C:\Windows\System\ttRdbuW.exe
  C:\Windows\System\ttRdbuW.exe
  2⤵
  PID:5896
- C:\Windows\System\mmqwMbb.exe
  C:\Windows\System\mmqwMbb.exe
  2⤵
  PID:5912
- C:\Windows\System\MAlONmX.exe
  C:\Windows\System\MAlONmX.exe
  2⤵
  PID:5928
- C:\Windows\System\pPuNeIG.exe
  C:\Windows\System\pPuNeIG.exe
  2⤵
  PID:5948
- C:\Windows\System\HwnHfhb.exe
  C:\Windows\System\HwnHfhb.exe
  2⤵
  PID:5972
- C:\Windows\System\WgQtdde.exe
  C:\Windows\System\WgQtdde.exe
  2⤵
  PID:5992
- C:\Windows\System\wIIRlRn.exe
  C:\Windows\System\wIIRlRn.exe
  2⤵
  PID:6008
- C:\Windows\System\gpNongo.exe
  C:\Windows\System\gpNongo.exe
  2⤵
  PID:6036
- C:\Windows\System\enibBjf.exe
  C:\Windows\System\enibBjf.exe
  2⤵
  PID:6088
- C:\Windows\System\adFoXTN.exe
  C:\Windows\System\adFoXTN.exe
  2⤵
  PID:6104
- C:\Windows\System\MYGpnrj.exe
  C:\Windows\System\MYGpnrj.exe
  2⤵
  PID:6124
- C:\Windows\System\dNmZmQW.exe
  C:\Windows\System\dNmZmQW.exe
  2⤵
  PID:4860
- C:\Windows\System\HpgpZwo.exe
  C:\Windows\System\HpgpZwo.exe
  2⤵
  PID:5100
- C:\Windows\System\FFmvzAD.exe
  C:\Windows\System\FFmvzAD.exe
  2⤵
  PID:2020
- C:\Windows\System\UyJanZM.exe
  C:\Windows\System\UyJanZM.exe
  2⤵
  PID:4432
- C:\Windows\System\zpswlgM.exe
  C:\Windows\System\zpswlgM.exe
  2⤵
  PID:872
- C:\Windows\System\fCLhGEA.exe
  C:\Windows\System\fCLhGEA.exe
  2⤵
  PID:1140
- C:\Windows\System\GBCAjhs.exe
  C:\Windows\System\GBCAjhs.exe
  2⤵
  PID:3976
- C:\Windows\System\qANFhFA.exe
  C:\Windows\System\qANFhFA.exe
  2⤵
  PID:1772
- C:\Windows\System\ohYQfft.exe
  C:\Windows\System\ohYQfft.exe
  2⤵
  PID:2460
- C:\Windows\System\GDAVhks.exe
  C:\Windows\System\GDAVhks.exe
  2⤵
  PID:452
- C:\Windows\System\XplaScK.exe
  C:\Windows\System\XplaScK.exe
  2⤵
  PID:2264
- C:\Windows\System\FoOHRul.exe
  C:\Windows\System\FoOHRul.exe
  2⤵
  PID:772
- C:\Windows\System\potIRJh.exe
  C:\Windows\System\potIRJh.exe
  2⤵
  PID:2960
- C:\Windows\System\DmPctMg.exe
  C:\Windows\System\DmPctMg.exe
  2⤵
  PID:1224
- C:\Windows\System\HAYJPvF.exe
  C:\Windows\System\HAYJPvF.exe
  2⤵
  PID:3848
- C:\Windows\System\dgtwNID.exe
  C:\Windows\System\dgtwNID.exe
  2⤵
  PID:2232
- C:\Windows\System\tClhqCK.exe
  C:\Windows\System\tClhqCK.exe
  2⤵
  PID:5544
- C:\Windows\System\uVVNVML.exe
  C:\Windows\System\uVVNVML.exe
  2⤵
  PID:3264
- C:\Windows\System\SOwHtgw.exe
  C:\Windows\System\SOwHtgw.exe
  2⤵
  PID:5608
- C:\Windows\System\dOydjcO.exe
  C:\Windows\System\dOydjcO.exe
  2⤵
  PID:4792
- C:\Windows\System\UfbpAWx.exe
  C:\Windows\System\UfbpAWx.exe
  2⤵
  PID:5628
- C:\Windows\System\hQNNOvI.exe
  C:\Windows\System\hQNNOvI.exe
  2⤵
  PID:768
- C:\Windows\System\gBWUiVT.exe
  C:\Windows\System\gBWUiVT.exe
  2⤵
  PID:6172
- C:\Windows\System\CInsfNV.exe
  C:\Windows\System\CInsfNV.exe
  2⤵
  PID:6196
- C:\Windows\System\oViworn.exe
  C:\Windows\System\oViworn.exe
  2⤵
  PID:6212
- C:\Windows\System\MZuEEEY.exe
  C:\Windows\System\MZuEEEY.exe
  2⤵
  PID:6236
- C:\Windows\System\XmYtvyk.exe
  C:\Windows\System\XmYtvyk.exe
  2⤵
  PID:6260
- C:\Windows\System\mTStApp.exe
  C:\Windows\System\mTStApp.exe
  2⤵
  PID:6276
- C:\Windows\System\yxIPkdl.exe
  C:\Windows\System\yxIPkdl.exe
  2⤵
  PID:6304
- C:\Windows\System\niXRnYE.exe
  C:\Windows\System\niXRnYE.exe
  2⤵
  PID:6320
- C:\Windows\System\OPHzanD.exe
  C:\Windows\System\OPHzanD.exe
  2⤵
  PID:6344
- C:\Windows\System\MWCIarP.exe
  C:\Windows\System\MWCIarP.exe
  2⤵
  PID:6368
- C:\Windows\System\PRjYTSO.exe
  C:\Windows\System\PRjYTSO.exe
  2⤵
  PID:6388
- C:\Windows\System\UgkpJXG.exe
  C:\Windows\System\UgkpJXG.exe
  2⤵
  PID:6428
- C:\Windows\System\gnouVLd.exe
  C:\Windows\System\gnouVLd.exe
  2⤵
  PID:6452
- C:\Windows\System\bkKKgcv.exe
  C:\Windows\System\bkKKgcv.exe
  2⤵
  PID:6476
- C:\Windows\System\fOGRUls.exe
  C:\Windows\System\fOGRUls.exe
  2⤵
  PID:6496
- C:\Windows\System\yTOuOdq.exe
  C:\Windows\System\yTOuOdq.exe
  2⤵
  PID:6512
- C:\Windows\System\jFlOieT.exe
  C:\Windows\System\jFlOieT.exe
  2⤵
  PID:6528
- C:\Windows\System\HTOyTUL.exe
  C:\Windows\System\HTOyTUL.exe
  2⤵
  PID:6556
- C:\Windows\System\RbOJtfJ.exe
  C:\Windows\System\RbOJtfJ.exe
  2⤵
  PID:6572
- C:\Windows\System\EQdDFtU.exe
  C:\Windows\System\EQdDFtU.exe
  2⤵
  PID:6592
- C:\Windows\System\WAEaxAb.exe
  C:\Windows\System\WAEaxAb.exe
  2⤵
  PID:6612
- C:\Windows\System\QZSUwUp.exe
  C:\Windows\System\QZSUwUp.exe
  2⤵
  PID:6636
- C:\Windows\System\XEGjJom.exe
  C:\Windows\System\XEGjJom.exe
  2⤵
  PID:6660
- C:\Windows\System\WweQyyj.exe
  C:\Windows\System\WweQyyj.exe
  2⤵
  PID:6680
- C:\Windows\System\MwvjCSk.exe
  C:\Windows\System\MwvjCSk.exe
  2⤵
  PID:6868
- C:\Windows\System\hEreVOa.exe
  C:\Windows\System\hEreVOa.exe
  2⤵
  PID:6884
- C:\Windows\System\eRihsse.exe
  C:\Windows\System\eRihsse.exe
  2⤵
  PID:6900
- C:\Windows\System\jfQcDQh.exe
  C:\Windows\System\jfQcDQh.exe
  2⤵
  PID:6920
- C:\Windows\System\kJaMjQx.exe
  C:\Windows\System\kJaMjQx.exe
  2⤵
  PID:6936
- C:\Windows\System\GTRGADP.exe
  C:\Windows\System\GTRGADP.exe
  2⤵
  PID:6952
- C:\Windows\System\ctLRcqX.exe
  C:\Windows\System\ctLRcqX.exe
  2⤵
  PID:6968
- C:\Windows\System\oeugRdX.exe
  C:\Windows\System\oeugRdX.exe
  2⤵
  PID:6984
- C:\Windows\System\BRjdgaZ.exe
  C:\Windows\System\BRjdgaZ.exe
  2⤵
  PID:7000
- C:\Windows\System\DpsTsrg.exe
  C:\Windows\System\DpsTsrg.exe
  2⤵
  PID:7016
- C:\Windows\System\GNquxmg.exe
  C:\Windows\System\GNquxmg.exe
  2⤵
  PID:7032
- C:\Windows\System\LIijacn.exe
  C:\Windows\System\LIijacn.exe
  2⤵
  PID:7052
- C:\Windows\System\xwXKfax.exe
  C:\Windows\System\xwXKfax.exe
  2⤵
  PID:7076
- C:\Windows\System\yhUZXFz.exe
  C:\Windows\System\yhUZXFz.exe
  2⤵
  PID:7092
- C:\Windows\System\SdLlJaT.exe
  C:\Windows\System\SdLlJaT.exe
  2⤵
  PID:7116
- C:\Windows\System\VgZrxsK.exe
  C:\Windows\System\VgZrxsK.exe
  2⤵
  PID:7136
- C:\Windows\System\CvEouzT.exe
  C:\Windows\System\CvEouzT.exe
  2⤵
  PID:7160
- C:\Windows\System\XwczXwf.exe
  C:\Windows\System\XwczXwf.exe
  2⤵
  PID:1072
- C:\Windows\System\KmbFyzp.exe
  C:\Windows\System\KmbFyzp.exe
  2⤵
  PID:1992
- C:\Windows\System\HGjwnJM.exe
  C:\Windows\System\HGjwnJM.exe
  2⤵
  PID:5372
- C:\Windows\System\ZHxzNdb.exe
  C:\Windows\System\ZHxzNdb.exe
  2⤵
  PID:4304
- C:\Windows\System\BwOPtLR.exe
  C:\Windows\System\BwOPtLR.exe
  2⤵
  PID:4020
- C:\Windows\System\hFjrJvw.exe
  C:\Windows\System\hFjrJvw.exe
  2⤵
  PID:6140
- C:\Windows\System\OadYcJL.exe
  C:\Windows\System\OadYcJL.exe
  2⤵
  PID:5516
- C:\Windows\System\dNmkQMp.exe
  C:\Windows\System\dNmkQMp.exe
  2⤵
  PID:5152
- C:\Windows\System\QouZKEk.exe
  C:\Windows\System\QouZKEk.exe
  2⤵
  PID:5208
- C:\Windows\System\HcOacFa.exe
  C:\Windows\System\HcOacFa.exe
  2⤵
  PID:5248
- C:\Windows\System\Maeovck.exe
  C:\Windows\System\Maeovck.exe
  2⤵
  PID:5300
- C:\Windows\System\YiwdXpQ.exe
  C:\Windows\System\YiwdXpQ.exe
  2⤵
  PID:5348
- C:\Windows\System\NqFtVKM.exe
  C:\Windows\System\NqFtVKM.exe
  2⤵
  PID:5392
- C:\Windows\System\tvCpFcw.exe
  C:\Windows\System\tvCpFcw.exe
  2⤵
  PID:5440
- C:\Windows\System\jcNBWMO.exe
  C:\Windows\System\jcNBWMO.exe
  2⤵
  PID:5540
- C:\Windows\System\fFSoscr.exe
  C:\Windows\System\fFSoscr.exe
  2⤵
  PID:5668
- C:\Windows\System\xWpFuRa.exe
  C:\Windows\System\xWpFuRa.exe
  2⤵
  PID:5764
- C:\Windows\System\aXnJHgf.exe
  C:\Windows\System\aXnJHgf.exe
  2⤵
  PID:5832
- C:\Windows\System\ASssSvc.exe
  C:\Windows\System\ASssSvc.exe
  2⤵
  PID:5884
- C:\Windows\System\ifFOKyo.exe
  C:\Windows\System\ifFOKyo.exe
  2⤵
  PID:5924
- C:\Windows\System\HMNDPxe.exe
  C:\Windows\System\HMNDPxe.exe
  2⤵
  PID:5968
- C:\Windows\System\UQYuxlY.exe
  C:\Windows\System\UQYuxlY.exe
  2⤵
  PID:6028
- C:\Windows\System\COnRHES.exe
  C:\Windows\System\COnRHES.exe
  2⤵
  PID:6072
- C:\Windows\System\WxKkvuU.exe
  C:\Windows\System\WxKkvuU.exe
  2⤵
  PID:6096
- C:\Windows\System\vmFyUDj.exe
  C:\Windows\System\vmFyUDj.exe
  2⤵
  PID:2464
- C:\Windows\System\OSJJllQ.exe
  C:\Windows\System\OSJJllQ.exe
  2⤵
  PID:5092
- C:\Windows\System\CJoUezc.exe
  C:\Windows\System\CJoUezc.exe
  2⤵
  PID:6160
- C:\Windows\System\gWhgcNM.exe
  C:\Windows\System\gWhgcNM.exe
  2⤵
  PID:6328
- C:\Windows\System\CZDXxCy.exe
  C:\Windows\System\CZDXxCy.exe
  2⤵
  PID:6464
- C:\Windows\System\aNqhQEO.exe
  C:\Windows\System\aNqhQEO.exe
  2⤵
  PID:6784
- C:\Windows\System\mmJsEZn.exe
  C:\Windows\System\mmJsEZn.exe
  2⤵
  PID:4080
- C:\Windows\System\GVifHIv.exe
  C:\Windows\System\GVifHIv.exe
  2⤵
  PID:5128
- C:\Windows\System\HEiJGzr.exe
  C:\Windows\System\HEiJGzr.exe
  2⤵
  PID:3408
- C:\Windows\System\OstTqjD.exe
  C:\Windows\System\OstTqjD.exe
  2⤵
  PID:4416
- C:\Windows\System\XTtjnna.exe
  C:\Windows\System\XTtjnna.exe
  2⤵
  PID:6208
- C:\Windows\System\BoXBdUk.exe
  C:\Windows\System\BoXBdUk.exe
  2⤵
  PID:6352
- C:\Windows\System\gVFfcOb.exe
  C:\Windows\System\gVFfcOb.exe
  2⤵
  PID:7188
- C:\Windows\System\tnfjtrj.exe
  C:\Windows\System\tnfjtrj.exe
  2⤵
  PID:7204
- C:\Windows\System\zthOIhS.exe
  C:\Windows\System\zthOIhS.exe
  2⤵
  PID:7224
- C:\Windows\System\BQnRgMW.exe
  C:\Windows\System\BQnRgMW.exe
  2⤵
  PID:7244
- C:\Windows\System\BTUbKXQ.exe
  C:\Windows\System\BTUbKXQ.exe
  2⤵
  PID:7260
- C:\Windows\System\dkLnLVK.exe
  C:\Windows\System\dkLnLVK.exe
  2⤵
  PID:7284
- C:\Windows\System\fPrycSk.exe
  C:\Windows\System\fPrycSk.exe
  2⤵
  PID:7308
- C:\Windows\System\BesaNPT.exe
  C:\Windows\System\BesaNPT.exe
  2⤵
  PID:7324
- C:\Windows\System\XsPXkGC.exe
  C:\Windows\System\XsPXkGC.exe
  2⤵
  PID:7348
- C:\Windows\System\JLHkjtp.exe
  C:\Windows\System\JLHkjtp.exe
  2⤵
  PID:7364
- C:\Windows\System\WZqHhqx.exe
  C:\Windows\System\WZqHhqx.exe
  2⤵
  PID:7524
- C:\Windows\System\uCsmNkD.exe
  C:\Windows\System\uCsmNkD.exe
  2⤵
  PID:7548
- C:\Windows\System\IFlRHfI.exe
  C:\Windows\System\IFlRHfI.exe
  2⤵
  PID:7568
- C:\Windows\System\lDhToIJ.exe
  C:\Windows\System\lDhToIJ.exe
  2⤵
  PID:7592
- C:\Windows\System\tKVVEec.exe
  C:\Windows\System\tKVVEec.exe
  2⤵
  PID:7824
- C:\Windows\System\MwZTueR.exe
  C:\Windows\System\MwZTueR.exe
  2⤵
  PID:7840
- C:\Windows\System\INLEGAe.exe
  C:\Windows\System\INLEGAe.exe
  2⤵
  PID:7856
- C:\Windows\System\fBpJqQh.exe
  C:\Windows\System\fBpJqQh.exe
  2⤵
  PID:7876
- C:\Windows\System\zpUCtRz.exe
  C:\Windows\System\zpUCtRz.exe
  2⤵
  PID:7892
- C:\Windows\System\TrZgBXo.exe
  C:\Windows\System\TrZgBXo.exe
  2⤵
  PID:7908
- C:\Windows\System\SPWFbiC.exe
  C:\Windows\System\SPWFbiC.exe
  2⤵
  PID:7924
- C:\Windows\System\RRvZfVR.exe
  C:\Windows\System\RRvZfVR.exe
  2⤵
  PID:7940
- C:\Windows\System\yYFzGEU.exe
  C:\Windows\System\yYFzGEU.exe
  2⤵
  PID:7956
- C:\Windows\System\AlEiwXf.exe
  C:\Windows\System\AlEiwXf.exe
  2⤵
  PID:7972
- C:\Windows\System\aECQzdu.exe
  C:\Windows\System\aECQzdu.exe
  2⤵
  PID:8008
- C:\Windows\System\ctxgPmF.exe
  C:\Windows\System\ctxgPmF.exe
  2⤵
  PID:8044
- C:\Windows\System\AruZTZl.exe
  C:\Windows\System\AruZTZl.exe
  2⤵
  PID:8112
- C:\Windows\System\HVSMVhc.exe
  C:\Windows\System\HVSMVhc.exe
  2⤵
  PID:8168
- C:\Windows\System\MIGSPTB.exe
  C:\Windows\System\MIGSPTB.exe
  2⤵
  PID:6440
- C:\Windows\System\nCCNUHQ.exe
  C:\Windows\System\nCCNUHQ.exe
  2⤵
  PID:6584
- C:\Windows\System\BTCJZjm.exe
  C:\Windows\System\BTCJZjm.exe
  2⤵
  PID:6628
- C:\Windows\System\aPLqqeK.exe
  C:\Windows\System\aPLqqeK.exe
  2⤵
  PID:6568
- C:\Windows\System\iEMgOZZ.exe
  C:\Windows\System\iEMgOZZ.exe
  2⤵
  PID:6296
- C:\Windows\System\HBBDGcu.exe
  C:\Windows\System\HBBDGcu.exe
  2⤵
  PID:1700
- C:\Windows\System\yQsidrx.exe
  C:\Windows\System\yQsidrx.exe
  2⤵
  PID:4104
- C:\Windows\System\faOlihn.exe
  C:\Windows\System\faOlihn.exe
  2⤵
  PID:5908
- C:\Windows\System\YNnzDcO.exe
  C:\Windows\System\YNnzDcO.exe
  2⤵
  PID:6976
- C:\Windows\System\PJJLXDj.exe
  C:\Windows\System\PJJLXDj.exe
  2⤵
  PID:5068
- C:\Windows\System\AdMIlGF.exe
  C:\Windows\System\AdMIlGF.exe
  2⤵
  PID:3116
- C:\Windows\System\JBsDniW.exe
  C:\Windows\System\JBsDniW.exe
  2⤵
  PID:3744
- C:\Windows\System\zjyuYqP.exe
  C:\Windows\System\zjyuYqP.exe
  2⤵
  PID:5664
- C:\Windows\System\gCCaCmd.exe
  C:\Windows\System\gCCaCmd.exe
  2⤵
  PID:6268
- C:\Windows\System\HIUUWgI.exe
  C:\Windows\System\HIUUWgI.exe
  2⤵
  PID:6364
- C:\Windows\System\HaHkhTD.exe
  C:\Windows\System\HaHkhTD.exe
  2⤵
  PID:6444
- C:\Windows\System\HMFuYgv.exe
  C:\Windows\System\HMFuYgv.exe
  2⤵
  PID:7176
- C:\Windows\System\zmngqpk.exe
  C:\Windows\System\zmngqpk.exe
  2⤵
  PID:6652
- C:\Windows\System\BrbgzIC.exe
  C:\Windows\System\BrbgzIC.exe
  2⤵
  PID:6864
- C:\Windows\System\CtnHLQg.exe
  C:\Windows\System\CtnHLQg.exe
  2⤵
  PID:6948
- C:\Windows\System\NpmNRKh.exe
  C:\Windows\System\NpmNRKh.exe
  2⤵
  PID:7044
- C:\Windows\System\WOkpXns.exe
  C:\Windows\System\WOkpXns.exe
  2⤵
  PID:7100
- C:\Windows\System\DqeJjSg.exe
  C:\Windows\System\DqeJjSg.exe
  2⤵
  PID:3180
- C:\Windows\System\HahBwiW.exe
  C:\Windows\System\HahBwiW.exe
  2⤵
  PID:880
- C:\Windows\System\PDzdJzS.exe
  C:\Windows\System\PDzdJzS.exe
  2⤵
  PID:4756
- C:\Windows\System\pxBIcgW.exe
  C:\Windows\System\pxBIcgW.exe
  2⤵
  PID:5748
- C:\Windows\System\SZzVcxH.exe
  C:\Windows\System\SZzVcxH.exe
  2⤵
  PID:5648
- C:\Windows\System\WlzxJkQ.exe
  C:\Windows\System\WlzxJkQ.exe
  2⤵
  PID:5892
- C:\Windows\System\MpBkpcz.exe
  C:\Windows\System\MpBkpcz.exe
  2⤵
  PID:6016
- C:\Windows\System\UhkDBpo.exe
  C:\Windows\System\UhkDBpo.exe
  2⤵
  PID:4692
- C:\Windows\System\ZsEqTHR.exe
  C:\Windows\System\ZsEqTHR.exe
  2⤵
  PID:4876
- C:\Windows\System\NcsAlKc.exe
  C:\Windows\System\NcsAlKc.exe
  2⤵
  PID:6152
- C:\Windows\System\DjRDngQ.exe
  C:\Windows\System\DjRDngQ.exe
  2⤵
  PID:7240
- C:\Windows\System\lAFwwtM.exe
  C:\Windows\System\lAFwwtM.exe
  2⤵
  PID:5412
- C:\Windows\System\JmCqdVP.exe
  C:\Windows\System\JmCqdVP.exe
  2⤵
  PID:5228
- C:\Windows\System\CnTUnMr.exe
  C:\Windows\System\CnTUnMr.exe
  2⤵
  PID:4272
- C:\Windows\System\iofbyMf.exe
  C:\Windows\System\iofbyMf.exe
  2⤵
  PID:7128
- C:\Windows\System\GRvaiPA.exe
  C:\Windows\System\GRvaiPA.exe
  2⤵
  PID:6928
- C:\Windows\System\Boxygkm.exe
  C:\Windows\System\Boxygkm.exe
  2⤵
  PID:7320
- C:\Windows\System\jTsQjQf.exe
  C:\Windows\System\jTsQjQf.exe
  2⤵
  PID:8200
- C:\Windows\System\HsUNZpG.exe
  C:\Windows\System\HsUNZpG.exe
  2⤵
  PID:8224
- C:\Windows\System\hYtDwrC.exe
  C:\Windows\System\hYtDwrC.exe
  2⤵
  PID:8240
- C:\Windows\System\tWgnpBu.exe
  C:\Windows\System\tWgnpBu.exe
  2⤵
  PID:8260
- C:\Windows\System\pyhaIyH.exe
  C:\Windows\System\pyhaIyH.exe
  2⤵
  PID:8284
- C:\Windows\System\PKtaKQb.exe
  C:\Windows\System\PKtaKQb.exe
  2⤵
  PID:8312
- C:\Windows\System\BuHfGcP.exe
  C:\Windows\System\BuHfGcP.exe
  2⤵
  PID:8332
- C:\Windows\System\TkgOqWe.exe
  C:\Windows\System\TkgOqWe.exe
  2⤵
  PID:8352
- C:\Windows\System\XHRThVb.exe
  C:\Windows\System\XHRThVb.exe
  2⤵
  PID:8380
- C:\Windows\System\pViNpZf.exe
  C:\Windows\System\pViNpZf.exe
  2⤵
  PID:8396
- C:\Windows\System\FTasfvI.exe
  C:\Windows\System\FTasfvI.exe
  2⤵
  PID:8416
- C:\Windows\System\FxqJRKW.exe
  C:\Windows\System\FxqJRKW.exe
  2⤵
  PID:8436
- C:\Windows\System\paegMUB.exe
  C:\Windows\System\paegMUB.exe
  2⤵
  PID:8456
- C:\Windows\System\XAfBxKd.exe
  C:\Windows\System\XAfBxKd.exe
  2⤵
  PID:8476
- C:\Windows\System\cErOsdo.exe
  C:\Windows\System\cErOsdo.exe
  2⤵
  PID:8496
- C:\Windows\System\nmcLIQD.exe
  C:\Windows\System\nmcLIQD.exe
  2⤵
  PID:8512
- C:\Windows\System\nmegjlJ.exe
  C:\Windows\System\nmegjlJ.exe
  2⤵
  PID:8528
- C:\Windows\System\DsrBrnq.exe
  C:\Windows\System\DsrBrnq.exe
  2⤵
  PID:8556
- C:\Windows\System\IPCtDwq.exe
  C:\Windows\System\IPCtDwq.exe
  2⤵
  PID:8572
- C:\Windows\System\LYTRbOg.exe
  C:\Windows\System\LYTRbOg.exe
  2⤵
  PID:8592
- C:\Windows\System\UpnNvUt.exe
  C:\Windows\System\UpnNvUt.exe
  2⤵
  PID:8608
- C:\Windows\System\xBtzeJt.exe
  C:\Windows\System\xBtzeJt.exe
  2⤵
  PID:8640
- C:\Windows\System\TVSnqIj.exe
  C:\Windows\System\TVSnqIj.exe
  2⤵
  PID:8660
- C:\Windows\System\vxAbICH.exe
  C:\Windows\System\vxAbICH.exe
  2⤵
  PID:8676
- C:\Windows\System\IYgWBoO.exe
  C:\Windows\System\IYgWBoO.exe
  2⤵
  PID:8700
- C:\Windows\System\gYvTZYR.exe
  C:\Windows\System\gYvTZYR.exe
  2⤵
  PID:8724
- C:\Windows\System\BcCnumH.exe
  C:\Windows\System\BcCnumH.exe
  2⤵
  PID:8748
- C:\Windows\System\KBVmPUu.exe
  C:\Windows\System\KBVmPUu.exe
  2⤵
  PID:8768
- C:\Windows\System\ghCYSXY.exe
  C:\Windows\System\ghCYSXY.exe
  2⤵
  PID:8796
- C:\Windows\System\EWdXlPp.exe
  C:\Windows\System\EWdXlPp.exe
  2⤵
  PID:8816
- C:\Windows\System\OUrYIIO.exe
  C:\Windows\System\OUrYIIO.exe
  2⤵
  PID:8836
- C:\Windows\System\CZxvFQS.exe
  C:\Windows\System\CZxvFQS.exe
  2⤵
  PID:8860
- C:\Windows\System\AvJbdwS.exe
  C:\Windows\System\AvJbdwS.exe
  2⤵
  PID:8880
- C:\Windows\System\yxICdeN.exe
  C:\Windows\System\yxICdeN.exe
  2⤵
  PID:8908
- C:\Windows\System\nzCDpwH.exe
  C:\Windows\System\nzCDpwH.exe
  2⤵
  PID:8928
- C:\Windows\System\AoNBgSv.exe
  C:\Windows\System\AoNBgSv.exe
  2⤵
  PID:8952
- C:\Windows\System\nmTkxfI.exe
  C:\Windows\System\nmTkxfI.exe
  2⤵
  PID:8976
- C:\Windows\System\ROVjKKy.exe
  C:\Windows\System\ROVjKKy.exe
  2⤵
  PID:8996
- C:\Windows\System\yNqNTSj.exe
  C:\Windows\System\yNqNTSj.exe
  2⤵
  PID:9044
- C:\Windows\System\MqkbZVp.exe
  C:\Windows\System\MqkbZVp.exe
  2⤵
  PID:9104
- C:\Windows\System\FUQFnAE.exe
  C:\Windows\System\FUQFnAE.exe
  2⤵
  PID:9128
- C:\Windows\System\fLQdGWR.exe
  C:\Windows\System\fLQdGWR.exe
  2⤵
  PID:9152
- C:\Windows\System\NvhPwnh.exe
  C:\Windows\System\NvhPwnh.exe
  2⤵
  PID:9172
- C:\Windows\System\ldpyMMC.exe
  C:\Windows\System\ldpyMMC.exe
  2⤵
  PID:9196
- C:\Windows\System\jOaQaOo.exe
  C:\Windows\System\jOaQaOo.exe
  2⤵
  PID:9220
- C:\Windows\System\RjlROPk.exe
  C:\Windows\System\RjlROPk.exe
  2⤵
  PID:9236
- C:\Windows\System\iAokqLu.exe
  C:\Windows\System\iAokqLu.exe
  2⤵
  PID:9256
- C:\Windows\System\CYOcdYK.exe
  C:\Windows\System\CYOcdYK.exe
  2⤵
  PID:9276
- C:\Windows\System\LPAMaMC.exe
  C:\Windows\System\LPAMaMC.exe
  2⤵
  PID:9296
- C:\Windows\System\tlkVHhT.exe
  C:\Windows\System\tlkVHhT.exe
  2⤵
  PID:9312
- C:\Windows\System\JCGHlPX.exe
  C:\Windows\System\JCGHlPX.exe
  2⤵
  PID:9332
- C:\Windows\System\RNZIjcj.exe
  C:\Windows\System\RNZIjcj.exe
  2⤵
  PID:9352
- C:\Windows\System\sdKizAo.exe
  C:\Windows\System\sdKizAo.exe
  2⤵
  PID:9368
- C:\Windows\System\aDScnKP.exe
  C:\Windows\System\aDScnKP.exe
  2⤵
  PID:9384
- C:\Windows\System\ZJNLTtH.exe
  C:\Windows\System\ZJNLTtH.exe
  2⤵
  PID:9404
- C:\Windows\System\FBdcqAs.exe
  C:\Windows\System\FBdcqAs.exe
  2⤵
  PID:9452
- C:\Windows\System\bmhjzPb.exe
  C:\Windows\System\bmhjzPb.exe
  2⤵
  PID:9472
- C:\Windows\System\TxImYgC.exe
  C:\Windows\System\TxImYgC.exe
  2⤵
  PID:9488
- C:\Windows\System\inWUViB.exe
  C:\Windows\System\inWUViB.exe
  2⤵
  PID:9504
- C:\Windows\System\hyaVMtF.exe
  C:\Windows\System\hyaVMtF.exe
  2⤵
  PID:9520
- C:\Windows\System\khpZImZ.exe
  C:\Windows\System\khpZImZ.exe
  2⤵
  PID:9536
- C:\Windows\System\NpSiHyz.exe
  C:\Windows\System\NpSiHyz.exe
  2⤵
  PID:9552
- C:\Windows\System\lzfyTFj.exe
  C:\Windows\System\lzfyTFj.exe
  2⤵
  PID:9568
- C:\Windows\System\DqbsnkC.exe
  C:\Windows\System\DqbsnkC.exe
  2⤵
  PID:9588
- C:\Windows\System\rCtlCmV.exe
  C:\Windows\System\rCtlCmV.exe
  2⤵
  PID:9604
- C:\Windows\System\KZBleku.exe
  C:\Windows\System\KZBleku.exe
  2⤵
  PID:9620
- C:\Windows\System\hiRCbQi.exe
  C:\Windows\System\hiRCbQi.exe
  2⤵
  PID:9636
- C:\Windows\System\lhxouyN.exe
  C:\Windows\System\lhxouyN.exe
  2⤵
  PID:9668
- C:\Windows\System\ZEwVhiG.exe
  C:\Windows\System\ZEwVhiG.exe
  2⤵
  PID:9696
- C:\Windows\System\zioIHKj.exe
  C:\Windows\System\zioIHKj.exe
  2⤵
  PID:9724
- C:\Windows\System\LlfKycy.exe
  C:\Windows\System\LlfKycy.exe
  2⤵
  PID:9740
- C:\Windows\System\clEluPQ.exe
  C:\Windows\System\clEluPQ.exe
  2⤵
  PID:9760
- C:\Windows\System\ihmwlrO.exe
  C:\Windows\System\ihmwlrO.exe
  2⤵
  PID:9776
- C:\Windows\System\ZxTuLuA.exe
  C:\Windows\System\ZxTuLuA.exe
  2⤵
  PID:9792
- C:\Windows\System\FaogULv.exe
  C:\Windows\System\FaogULv.exe
  2⤵
  PID:9812
- C:\Windows\System\UtaRnxN.exe
  C:\Windows\System\UtaRnxN.exe
  2⤵
  PID:9840
- C:\Windows\System\aqwUNWw.exe
  C:\Windows\System\aqwUNWw.exe
  2⤵
  PID:9860
- C:\Windows\System\KWBlcrg.exe
  C:\Windows\System\KWBlcrg.exe
  2⤵
  PID:9880
- C:\Windows\System\YoZArgJ.exe
  C:\Windows\System\YoZArgJ.exe
  2⤵
  PID:9904
- C:\Windows\System\HFJPOci.exe
  C:\Windows\System\HFJPOci.exe
  2⤵
  PID:9924
- C:\Windows\System\yNTFBCQ.exe
  C:\Windows\System\yNTFBCQ.exe
  2⤵
  PID:9952
- C:\Windows\System\OWhyvKA.exe
  C:\Windows\System\OWhyvKA.exe
  2⤵
  PID:9976
- C:\Windows\System\IfKjWKf.exe
  C:\Windows\System\IfKjWKf.exe
  2⤵
  PID:10008
- C:\Windows\System\HcBoQLh.exe
  C:\Windows\System\HcBoQLh.exe
  2⤵
  PID:10036
- C:\Windows\System\BTPspiy.exe
  C:\Windows\System\BTPspiy.exe
  2⤵
  PID:10056
- C:\Windows\System\CEORYdP.exe
  C:\Windows\System\CEORYdP.exe
  2⤵
  PID:10076
- C:\Windows\System\upXAaUA.exe
  C:\Windows\System\upXAaUA.exe
  2⤵
  PID:10100
- C:\Windows\System\wIsscIi.exe
  C:\Windows\System\wIsscIi.exe
  2⤵
  PID:10116
- C:\Windows\System\zHNBOuO.exe
  C:\Windows\System\zHNBOuO.exe
  2⤵
  PID:10144
- C:\Windows\System\LlAEmfn.exe
  C:\Windows\System\LlAEmfn.exe
  2⤵
  PID:10160
- C:\Windows\System\XHgdqie.exe
  C:\Windows\System\XHgdqie.exe
  2⤵
  PID:10188
- C:\Windows\System\qujAqPH.exe
  C:\Windows\System\qujAqPH.exe
  2⤵
  PID:10216
- C:\Windows\System\HxnREIS.exe
  C:\Windows\System\HxnREIS.exe
  2⤵
  PID:10236
- C:\Windows\System\fOjmTdU.exe
  C:\Windows\System\fOjmTdU.exe
  2⤵
  PID:8120
- C:\Windows\System\lkFXKFv.exe
  C:\Windows\System\lkFXKFv.exe
  2⤵
  PID:4036
- C:\Windows\System\OboLDKg.exe
  C:\Windows\System\OboLDKg.exe
  2⤵
  PID:7560
- C:\Windows\System\IcYWQmv.exe
  C:\Windows\System\IcYWQmv.exe
  2⤵
  PID:7624
- C:\Windows\System\rWcugXC.exe
  C:\Windows\System\rWcugXC.exe
  2⤵
  PID:7684
- C:\Windows\System\ogJWOuG.exe
  C:\Windows\System\ogJWOuG.exe
  2⤵
  PID:7724
- C:\Windows\System\tvxEfoE.exe
  C:\Windows\System\tvxEfoE.exe
  2⤵
  PID:6488
- C:\Windows\System\KdaAJdK.exe
  C:\Windows\System\KdaAJdK.exe
  2⤵
  PID:5060
- C:\Windows\System\DqVeyuU.exe
  C:\Windows\System\DqVeyuU.exe
  2⤵
  PID:532
- C:\Windows\System\eUqxZgX.exe
  C:\Windows\System\eUqxZgX.exe
  2⤵
  PID:6312
- C:\Windows\System\WezAetC.exe
  C:\Windows\System\WezAetC.exe
  2⤵
  PID:7652
- C:\Windows\System\piYoKgg.exe
  C:\Windows\System\piYoKgg.exe
  2⤵
  PID:7132
- C:\Windows\System\DdzphpB.exe
  C:\Windows\System\DdzphpB.exe
  2⤵
  PID:5232
- C:\Windows\System\gLUEMQt.exe
  C:\Windows\System\gLUEMQt.exe
  2⤵
  PID:5956
- C:\Windows\System\XqflbFM.exe
  C:\Windows\System\XqflbFM.exe
  2⤵
  PID:2424
- C:\Windows\System\FtMQMor.exe
  C:\Windows\System\FtMQMor.exe
  2⤵
  PID:7268
- C:\Windows\System\NcFxmJG.exe
  C:\Windows\System\NcFxmJG.exe
  2⤵
  PID:7024
- C:\Windows\System\lqotRkm.exe
  C:\Windows\System\lqotRkm.exe
  2⤵
  PID:2172
- C:\Windows\System\gYBxCRP.exe
  C:\Windows\System\gYBxCRP.exe
  2⤵
  PID:1980
- C:\Windows\System\tgrAgUw.exe
  C:\Windows\System\tgrAgUw.exe
  2⤵
  PID:8304
- C:\Windows\System\yHdmClZ.exe
  C:\Windows\System\yHdmClZ.exe
  2⤵
  PID:8404
- C:\Windows\System\pCmNpaL.exe
  C:\Windows\System\pCmNpaL.exe
  2⤵
  PID:10256
- C:\Windows\System\yWafXCB.exe
  C:\Windows\System\yWafXCB.exe
  2⤵
  PID:10276
- C:\Windows\System\nYnCNvT.exe
  C:\Windows\System\nYnCNvT.exe
  2⤵
  PID:10556
- C:\Windows\System\hcjYwYX.exe
  C:\Windows\System\hcjYwYX.exe
  2⤵
  PID:11236
- C:\Windows\System\hJSBtSZ.exe
  C:\Windows\System\hJSBtSZ.exe
  2⤵
  PID:8520
- C:\Windows\System\CjAUTml.exe
  C:\Windows\System\CjAUTml.exe
  2⤵
  PID:8588
- C:\Windows\System\DhLSqaT.exe
  C:\Windows\System\DhLSqaT.exe
  2⤵
  PID:8672
- C:\Windows\System\FcLGmSK.exe
  C:\Windows\System\FcLGmSK.exe
  2⤵
  PID:8756
- C:\Windows\System\qAoLQAx.exe
  C:\Windows\System\qAoLQAx.exe
  2⤵
  PID:9136
- C:\Windows\System\wtymbbx.exe
  C:\Windows\System\wtymbbx.exe
  2⤵
  PID:7816
- C:\Windows\System\HEUqLDX.exe
  C:\Windows\System\HEUqLDX.exe
  2⤵
  PID:8020
- C:\Windows\System\kMjguIq.exe
  C:\Windows\System\kMjguIq.exe
  2⤵
  PID:7936
- C:\Windows\System\DhGPGCb.exe
  C:\Windows\System\DhGPGCb.exe
  2⤵
  PID:7904
- C:\Windows\System\ipzytUh.exe
  C:\Windows\System\ipzytUh.exe
  2⤵
  PID:7864
- C:\Windows\System\SJhHljN.exe
  C:\Windows\System\SJhHljN.exe
  2⤵
  PID:9644
- C:\Windows\System\FCZRPmI.exe
  C:\Windows\System\FCZRPmI.exe
  2⤵
  PID:9080
- C:\Windows\System\iqzVJCd.exe
  C:\Windows\System\iqzVJCd.exe
  2⤵
  PID:9720
- C:\Windows\System\sVijMRa.exe
  C:\Windows\System\sVijMRa.exe
  2⤵
  PID:6524
- C:\Windows\System\CoFLFVy.exe
  C:\Windows\System\CoFLFVy.exe
  2⤵
  PID:10024
- C:\Windows\System\UjpdCAL.exe
  C:\Windows\System\UjpdCAL.exe
  2⤵
  PID:10180
- C:\Windows\System\JxrSqve.exe
  C:\Windows\System\JxrSqve.exe
  2⤵
  PID:8212
- C:\Windows\System\OstqZEU.exe
  C:\Windows\System\OstqZEU.exe
  2⤵
  PID:8232
- C:\Windows\System\MfWfyfq.exe
  C:\Windows\System\MfWfyfq.exe
  2⤵
  PID:4556
- C:\Windows\System\EmEFncj.exe
  C:\Windows\System\EmEFncj.exe
  2⤵
  PID:7088
- C:\Windows\System\iyIHgrx.exe
  C:\Windows\System\iyIHgrx.exe
  2⤵
  PID:5560
- C:\Windows\System\KsJmmJN.exe
  C:\Windows\System\KsJmmJN.exe
  2⤵
  PID:7184
- C:\Windows\System\wfQwAAH.exe
  C:\Windows\System\wfQwAAH.exe
  2⤵
  PID:8208
- C:\Windows\System\LWMQpwC.exe
  C:\Windows\System\LWMQpwC.exe
  2⤵
  PID:8504
- C:\Windows\System\aIfXThc.exe
  C:\Windows\System\aIfXThc.exe
  2⤵
  PID:8844
- C:\Windows\System\RqYaWkN.exe
  C:\Windows\System\RqYaWkN.exe
  2⤵
  PID:9040
- C:\Windows\System\sgDjIVh.exe
  C:\Windows\System\sgDjIVh.exe
  2⤵
  PID:9264
- C:\Windows\System\AICLIPD.exe
  C:\Windows\System\AICLIPD.exe
  2⤵
  PID:8136
- C:\Windows\System\kusUPlj.exe
  C:\Windows\System\kusUPlj.exe
  2⤵
  PID:8184
- C:\Windows\System\KBWxSeD.exe
  C:\Windows\System\KBWxSeD.exe
  2⤵
  PID:7196
- C:\Windows\System\qGxJajD.exe
  C:\Windows\System\qGxJajD.exe
  2⤵
  PID:6052
- C:\Windows\System\fVdNUxN.exe
  C:\Windows\System\fVdNUxN.exe
  2⤵
  PID:9896
- C:\Windows\System\DeguyzW.exe
  C:\Windows\System\DeguyzW.exe
  2⤵
  PID:10660
- C:\Windows\System\hWZgqVr.exe
  C:\Windows\System\hWZgqVr.exe
  2⤵
  PID:10692
- C:\Windows\System\YdatHSf.exe
  C:\Windows\System\YdatHSf.exe
  2⤵
  PID:10084
- C:\Windows\System\Aitvhsa.exe
  C:\Windows\System\Aitvhsa.exe
  2⤵
  PID:10736
- C:\Windows\System\fZHSEmE.exe
  C:\Windows\System\fZHSEmE.exe
  2⤵
  PID:7280
- C:\Windows\System\ggIgyBC.exe
  C:\Windows\System\ggIgyBC.exe
  2⤵
  PID:5364
- C:\Windows\System\CMdNNBU.exe
  C:\Windows\System\CMdNNBU.exe
  2⤵
  PID:9804
- C:\Windows\System\rMmMAMM.exe
  C:\Windows\System\rMmMAMM.exe
  2⤵
  PID:9992
- C:\Windows\System\SgayQkK.exe
  C:\Windows\System\SgayQkK.exe
  2⤵
  PID:7060
- C:\Windows\System\kYxWggQ.exe
  C:\Windows\System\kYxWggQ.exe
  2⤵
  PID:10564
- C:\Windows\System\aRqTQtK.exe
  C:\Windows\System\aRqTQtK.exe
  2⤵
  PID:8424
- C:\Windows\System\XHEfDFt.exe
  C:\Windows\System\XHEfDFt.exe
  2⤵
  PID:10272
- C:\Windows\System\FrKQdEK.exe
  C:\Windows\System\FrKQdEK.exe
  2⤵
  PID:10296
- C:\Windows\System\iamPQAB.exe
  C:\Windows\System\iamPQAB.exe
  2⤵
  PID:8776
- C:\Windows\System\tqAwdmb.exe
  C:\Windows\System\tqAwdmb.exe
  2⤵
  PID:8852
- C:\Windows\System\GJDNZmS.exe
  C:\Windows\System\GJDNZmS.exe
  2⤵
  PID:10416
- C:\Windows\System\tDmKcAo.exe
  C:\Windows\System\tDmKcAo.exe
  2⤵
  PID:9160
- C:\Windows\System\MsiVymK.exe
  C:\Windows\System\MsiVymK.exe
  2⤵
  PID:10496
- C:\Windows\System\RwwntVY.exe
  C:\Windows\System\RwwntVY.exe
  2⤵
  PID:1440
- C:\Windows\System\pUSmRDS.exe
  C:\Windows\System\pUSmRDS.exe
  2⤵
  PID:11268
- C:\Windows\System\PAtBwKB.exe
  C:\Windows\System\PAtBwKB.exe
  2⤵
  PID:11292
- C:\Windows\System\gsFNKBj.exe
  C:\Windows\System\gsFNKBj.exe
  2⤵
  PID:11316
- C:\Windows\System\HeCnkKx.exe
  C:\Windows\System\HeCnkKx.exe
  2⤵
  PID:11332
- C:\Windows\System\pvLnACA.exe
  C:\Windows\System\pvLnACA.exe
  2⤵
  PID:11356
- C:\Windows\System\TwzLppv.exe
  C:\Windows\System\TwzLppv.exe
  2⤵
  PID:11380
- C:\Windows\System\gCUCWDY.exe
  C:\Windows\System\gCUCWDY.exe
  2⤵
  PID:11404
- C:\Windows\System\GRBMgWX.exe
  C:\Windows\System\GRBMgWX.exe
  2⤵
  PID:11424
- C:\Windows\System\FBupWHh.exe
  C:\Windows\System\FBupWHh.exe
  2⤵
  PID:11448
- C:\Windows\System\tXaNAlv.exe
  C:\Windows\System\tXaNAlv.exe
  2⤵
  PID:11472
- C:\Windows\System\SqsYHek.exe
  C:\Windows\System\SqsYHek.exe
  2⤵
  PID:11492
- C:\Windows\System\jZKhBLa.exe
  C:\Windows\System\jZKhBLa.exe
  2⤵
  PID:11512
- C:\Windows\System\UKHqDvX.exe
  C:\Windows\System\UKHqDvX.exe
  2⤵
  PID:11536
- C:\Windows\System\POCDTOX.exe
  C:\Windows\System\POCDTOX.exe
  2⤵
  PID:11556
- C:\Windows\System\XcMkGfv.exe
  C:\Windows\System\XcMkGfv.exe
  2⤵
  PID:11572
- C:\Windows\System\eEsPprK.exe
  C:\Windows\System\eEsPprK.exe
  2⤵
  PID:11592
- C:\Windows\System\dyGLhXo.exe
  C:\Windows\System\dyGLhXo.exe
  2⤵
  PID:11616
- C:\Windows\System\kjBaGal.exe
  C:\Windows\System\kjBaGal.exe
  2⤵
  PID:11636
- C:\Windows\System\CtJVrbL.exe
  C:\Windows\System\CtJVrbL.exe
  2⤵
  PID:11652
- C:\Windows\System\ipqCFYF.exe
  C:\Windows\System\ipqCFYF.exe
  2⤵
  PID:11720
- C:\Windows\System\YupuAPx.exe
  C:\Windows\System\YupuAPx.exe
  2⤵
  PID:11736
- C:\Windows\System\PfxRVwB.exe
  C:\Windows\System\PfxRVwB.exe
  2⤵
  PID:11832
- C:\Windows\System\ePUvpcT.exe
  C:\Windows\System\ePUvpcT.exe
  2⤵
  PID:11860
- C:\Windows\System\AYlaaij.exe
  C:\Windows\System\AYlaaij.exe
  2⤵
  PID:11876
- C:\Windows\System\GzsXgiz.exe
  C:\Windows\System\GzsXgiz.exe
  2⤵
  PID:11896
- C:\Windows\System\sQiDJBY.exe
  C:\Windows\System\sQiDJBY.exe
  2⤵
  PID:11920
- C:\Windows\System\mQiLaCB.exe
  C:\Windows\System\mQiLaCB.exe
  2⤵
  PID:11940
- C:\Windows\System\EvHXEhR.exe
  C:\Windows\System\EvHXEhR.exe
  2⤵
  PID:11956
- C:\Windows\System\CDQVJvX.exe
  C:\Windows\System\CDQVJvX.exe
  2⤵
  PID:11972
- C:\Windows\System\BsCgnMB.exe
  C:\Windows\System\BsCgnMB.exe
  2⤵
  PID:11988
- C:\Windows\System\gFzWeoJ.exe
  C:\Windows\System\gFzWeoJ.exe
  2⤵
  PID:12004
- C:\Windows\System\wBqToCH.exe
  C:\Windows\System\wBqToCH.exe
  2⤵
  PID:12020
- C:\Windows\System\ZfAAvZf.exe
  C:\Windows\System\ZfAAvZf.exe
  2⤵
  PID:12036
- C:\Windows\System\wJyGzLX.exe
  C:\Windows\System\wJyGzLX.exe
  2⤵
  PID:12060
- C:\Windows\System\yohQVUT.exe
  C:\Windows\System\yohQVUT.exe
  2⤵
  PID:12084
- C:\Windows\System\eXmSufG.exe
  C:\Windows\System\eXmSufG.exe
  2⤵
  PID:12120
- C:\Windows\System\UsgTMyw.exe
  C:\Windows\System\UsgTMyw.exe
  2⤵
  PID:12148
- C:\Windows\System\UpEkbkM.exe
  C:\Windows\System\UpEkbkM.exe
  2⤵
  PID:12172
- C:\Windows\System\yNRlRgv.exe
  C:\Windows\System\yNRlRgv.exe
  2⤵
  PID:12196
- C:\Windows\System\kzvrDGP.exe
  C:\Windows\System\kzvrDGP.exe
  2⤵
  PID:12216
- C:\Windows\System\tuGWeuv.exe
  C:\Windows\System\tuGWeuv.exe
  2⤵
  PID:12232
- C:\Windows\System\xXEdUNb.exe
  C:\Windows\System\xXEdUNb.exe
  2⤵
  PID:12256
- C:\Windows\System\XNfmBGv.exe
  C:\Windows\System\XNfmBGv.exe
  2⤵
  PID:9364
- C:\Windows\System\MMdeNlE.exe
  C:\Windows\System\MMdeNlE.exe
  2⤵
  PID:9516
- C:\Windows\System\RFFFOdO.exe
  C:\Windows\System\RFFFOdO.exe
  2⤵
  PID:9616
- C:\Windows\System\bKgEfTe.exe
  C:\Windows\System\bKgEfTe.exe
  2⤵
  PID:9656
- C:\Windows\System\WikHHrE.exe
  C:\Windows\System\WikHHrE.exe
  2⤵
  PID:9360
- C:\Windows\System\kInPlNa.exe
  C:\Windows\System\kInPlNa.exe
  2⤵
  PID:9628
- C:\Windows\System\ICdroTS.exe
  C:\Windows\System\ICdroTS.exe
  2⤵
  PID:9460
- C:\Windows\System\qiQudiC.exe
  C:\Windows\System\qiQudiC.exe
  2⤵
  PID:9228
- C:\Windows\System\NWdpWUr.exe
  C:\Windows\System\NWdpWUr.exe
  2⤵
  PID:8916
- C:\Windows\System\ZIhEEjG.exe
  C:\Windows\System\ZIhEEjG.exe
  2⤵
  PID:8784
- C:\Windows\System\vdLpXaO.exe
  C:\Windows\System\vdLpXaO.exe
  2⤵
  PID:8668
- C:\Windows\System\OZbHMKP.exe
  C:\Windows\System\OZbHMKP.exe
  2⤵
  PID:9692
- C:\Windows\System\prjMzyd.exe
  C:\Windows\System\prjMzyd.exe
  2⤵
  PID:9920
- C:\Windows\System\PewVtfL.exe
  C:\Windows\System\PewVtfL.exe
  2⤵
  PID:11136
- C:\Windows\System\awvBzWh.exe
  C:\Windows\System\awvBzWh.exe
  2⤵
  PID:10124
- C:\Windows\System\HgsFybR.exe
  C:\Windows\System\HgsFybR.exe
  2⤵
  PID:7404
- C:\Windows\System\FCCMoXp.exe
  C:\Windows\System\FCCMoXp.exe
  2⤵
  PID:8568
- C:\Windows\System\hCPWvkb.exe
  C:\Windows\System\hCPWvkb.exe
  2⤵
  PID:10152
- C:\Windows\System\GKLOqWr.exe
  C:\Windows\System\GKLOqWr.exe
  2⤵
  PID:9868
- C:\Windows\System\GzpYjWH.exe
  C:\Windows\System\GzpYjWH.exe
  2⤵
  PID:9092
- C:\Windows\System\eMIJVzD.exe
  C:\Windows\System\eMIJVzD.exe
  2⤵
  PID:8252
- C:\Windows\System\iKkQZRT.exe
  C:\Windows\System\iKkQZRT.exe
  2⤵
  PID:8984
- C:\Windows\System\JHgkhvx.exe
  C:\Windows\System\JHgkhvx.exe
  2⤵
  PID:12296
- C:\Windows\System\TcTBZEZ.exe
  C:\Windows\System\TcTBZEZ.exe
  2⤵
  PID:12320
- C:\Windows\System\Mqqiljk.exe
  C:\Windows\System\Mqqiljk.exe
  2⤵
  PID:12344
- C:\Windows\System\CFjRvVo.exe
  C:\Windows\System\CFjRvVo.exe
  2⤵
  PID:12364
- C:\Windows\System\uYrBFIm.exe
  C:\Windows\System\uYrBFIm.exe
  2⤵
  PID:12388
- C:\Windows\System\AayqdnC.exe
  C:\Windows\System\AayqdnC.exe
  2⤵
  PID:12404
- C:\Windows\System\QGKSUpA.exe
  C:\Windows\System\QGKSUpA.exe
  2⤵
  PID:12432
- C:\Windows\System\JCrWzmk.exe
  C:\Windows\System\JCrWzmk.exe
  2⤵
  PID:12456
- C:\Windows\System\YDicmTG.exe
  C:\Windows\System\YDicmTG.exe
  2⤵
  PID:12480
- C:\Windows\System\PjhBykP.exe
  C:\Windows\System\PjhBykP.exe
  2⤵
  PID:12508
- C:\Windows\System\dDoeAcJ.exe
  C:\Windows\System\dDoeAcJ.exe
  2⤵
  PID:12532
- C:\Windows\System\XcicTyh.exe
  C:\Windows\System\XcicTyh.exe
  2⤵
  PID:12556
- C:\Windows\System\UKwrNBK.exe
  C:\Windows\System\UKwrNBK.exe
  2⤵
  PID:12584
- C:\Windows\System\EWqGbjg.exe
  C:\Windows\System\EWqGbjg.exe
  2⤵
  PID:12608
- C:\Windows\System\lnmjtxg.exe
  C:\Windows\System\lnmjtxg.exe
  2⤵
  PID:12624
- C:\Windows\System\DXslJGJ.exe
  C:\Windows\System\DXslJGJ.exe
  2⤵
  PID:12648
- C:\Windows\System\kRguJlw.exe
  C:\Windows\System\kRguJlw.exe
  2⤵
  PID:12668
- C:\Windows\System\yMzUaop.exe
  C:\Windows\System\yMzUaop.exe
  2⤵
  PID:12696
- C:\Windows\System\iZwQkya.exe
  C:\Windows\System\iZwQkya.exe
  2⤵
  PID:12716
- C:\Windows\System\Gpdtipu.exe
  C:\Windows\System\Gpdtipu.exe
  2⤵
  PID:12740
- C:\Windows\System\sxtqBiU.exe
  C:\Windows\System\sxtqBiU.exe
  2⤵
  PID:12764
- C:\Windows\System\uZgYoNQ.exe
  C:\Windows\System\uZgYoNQ.exe
  2⤵
  PID:12784
- C:\Windows\System\yrPKgoV.exe
  C:\Windows\System\yrPKgoV.exe
  2⤵
  PID:12800
- C:\Windows\System\ojpavWm.exe
  C:\Windows\System\ojpavWm.exe
  2⤵
  PID:12824
- C:\Windows\System\qsUFHLQ.exe
  C:\Windows\System\qsUFHLQ.exe
  2⤵
  PID:12844
- C:\Windows\System\fUbLwDr.exe
  C:\Windows\System\fUbLwDr.exe
  2⤵
  PID:12860
- C:\Windows\System\GUmRdyF.exe
  C:\Windows\System\GUmRdyF.exe
  2⤵
  PID:12876
- C:\Windows\System\KfPwNIH.exe
  C:\Windows\System\KfPwNIH.exe
  2⤵
  PID:12892
- C:\Windows\System\gJggltm.exe
  C:\Windows\System\gJggltm.exe
  2⤵
  PID:12912
- C:\Windows\System\EMRTYMR.exe
  C:\Windows\System\EMRTYMR.exe
  2⤵
  PID:12928
- C:\Windows\System\TJwamFV.exe
  C:\Windows\System\TJwamFV.exe
  2⤵
  PID:12944
- C:\Windows\System\zfxAOTr.exe
  C:\Windows\System\zfxAOTr.exe
  2⤵
  PID:12960
- C:\Windows\System\VIcNbEZ.exe
  C:\Windows\System\VIcNbEZ.exe
  2⤵
  PID:12976
- C:\Windows\System\mBhbcPc.exe
  C:\Windows\System\mBhbcPc.exe
  2⤵
  PID:12996
- C:\Windows\System\FwIoxxf.exe
  C:\Windows\System\FwIoxxf.exe
  2⤵
  PID:13016
- C:\Windows\System\utFMiFo.exe
  C:\Windows\System\utFMiFo.exe
  2⤵
  PID:13032
- C:\Windows\System\nUAFMVC.exe
  C:\Windows\System\nUAFMVC.exe
  2⤵
  PID:9676
- C:\Windows\System\EduRaee.exe
  C:\Windows\System\EduRaee.exe
  2⤵
  PID:9944
- C:\Windows\System\thVZaYH.exe
  C:\Windows\System\thVZaYH.exe
  2⤵
  PID:7644
- C:\Windows\System\XZkRpuH.exe
  C:\Windows\System\XZkRpuH.exe
  2⤵
  PID:10940
- C:\Windows\System\FlyAqst.exe
  C:\Windows\System\FlyAqst.exe
  2⤵
  PID:12792
- C:\Windows\System\EfSLuHm.exe
  C:\Windows\System\EfSLuHm.exe
  2⤵
  PID:12872
- C:\Windows\System\YAyIVvd.exe
  C:\Windows\System\YAyIVvd.exe
  2⤵
  PID:12940
- C:\Windows\System\oKEoWIX.exe
  C:\Windows\System\oKEoWIX.exe
  2⤵
  PID:13012
- C:\Windows\System\KMBVFtZ.exe
  C:\Windows\System\KMBVFtZ.exe
  2⤵
  PID:13060
- C:\Windows\System\BQGouOo.exe
  C:\Windows\System\BQGouOo.exe
  2⤵
  PID:13088
- C:\Windows\System\dhfEFqz.exe
  C:\Windows\System\dhfEFqz.exe
  2⤵
  PID:10504
- C:\Windows\System\TiFvJjD.exe
  C:\Windows\System\TiFvJjD.exe
  2⤵
  PID:13176
- C:\Windows\System\tPyisIS.exe
  C:\Windows\System\tPyisIS.exe
  2⤵
  PID:11416
- C:\Windows\System\gAupdkV.exe
  C:\Windows\System\gAupdkV.exe
  2⤵
  PID:11528
- C:\Windows\System\LxcixkT.exe
  C:\Windows\System\LxcixkT.exe
  2⤵
  PID:11080
- C:\Windows\System\GyNskZj.exe
  C:\Windows\System\GyNskZj.exe
  2⤵
  PID:11180
- C:\Windows\System\glidhjL.exe
  C:\Windows\System\glidhjL.exe
  2⤵
  PID:11256
- C:\Windows\System\yHBbuJx.exe
  C:\Windows\System\yHBbuJx.exe
  2⤵
  PID:7884
- C:\Windows\System\FTVHBrv.exe
  C:\Windows\System\FTVHBrv.exe
  2⤵
  PID:6540
- C:\Windows\System\tyUDdIp.exe
  C:\Windows\System\tyUDdIp.exe
  2⤵
  PID:6980
- C:\Windows\System\jWyTFkF.exe
  C:\Windows\System\jWyTFkF.exe
  2⤵
  PID:5496
- C:\Windows\System\xLkOaJO.exe
  C:\Windows\System\xLkOaJO.exe
  2⤵
  PID:2196
- C:\Windows\System\ruOdleg.exe
  C:\Windows\System\ruOdleg.exe
  2⤵
  PID:2816
- C:\Windows\System\ldoWNaM.exe
  C:\Windows\System\ldoWNaM.exe
  2⤵
  PID:8828
- C:\Windows\System\QBYvAxR.exe
  C:\Windows\System\QBYvAxR.exe
  2⤵
  PID:1664
- C:\Windows\System\tgOgwDB.exe
  C:\Windows\System\tgOgwDB.exe
  2⤵
  PID:7252
- C:\Windows\System\HsOtqsQ.exe
  C:\Windows\System\HsOtqsQ.exe
  2⤵
  PID:9808
- C:\Windows\System\JKypVEG.exe
  C:\Windows\System\JKypVEG.exe
  2⤵
  PID:6064
- C:\Windows\System\rCPQgNz.exe
  C:\Windows\System\rCPQgNz.exe
  2⤵
  PID:7356
- C:\Windows\System\qppgVQu.exe
  C:\Windows\System\qppgVQu.exe
  2⤵
  PID:8464
- C:\Windows\System\wWvUvob.exe
  C:\Windows\System\wWvUvob.exe
  2⤵
  PID:9192
- C:\Windows\System\MuOlAHA.exe
  C:\Windows\System\MuOlAHA.exe
  2⤵
  PID:11372
- C:\Windows\System\rWCHUfu.exe
  C:\Windows\System\rWCHUfu.exe
  2⤵
  PID:11504
- C:\Windows\System\lmAXQLm.exe
  C:\Windows\System\lmAXQLm.exe
  2⤵
  PID:11660
- C:\Windows\System\ybgUgOg.exe
  C:\Windows\System\ybgUgOg.exe
  2⤵
  PID:11704
- C:\Windows\System\OLJJIIQ.exe
  C:\Windows\System\OLJJIIQ.exe
  2⤵
  PID:7556
- C:\Windows\System\eSmPwiI.exe
  C:\Windows\System\eSmPwiI.exe
  2⤵
  PID:10336
- C:\Windows\System\GzXKTfK.exe
  C:\Windows\System\GzXKTfK.exe
  2⤵
  PID:10916
- C:\Windows\System\PsoHpTK.exe
  C:\Windows\System\PsoHpTK.exe
  2⤵
  PID:6908
- C:\Windows\System\RibIOnR.exe
  C:\Windows\System\RibIOnR.exe
  2⤵
  PID:11852
- C:\Windows\System\gwhuUAd.exe
  C:\Windows\System\gwhuUAd.exe
  2⤵
  PID:11888
- C:\Windows\System\IMAsIWA.exe
  C:\Windows\System\IMAsIWA.exe
  2⤵
  PID:11932
- C:\Windows\System\TtHhldF.exe
  C:\Windows\System\TtHhldF.exe
  2⤵
  PID:11996
- C:\Windows\System\HsSlHCT.exe
  C:\Windows\System\HsSlHCT.exe
  2⤵
  PID:12076
- C:\Windows\System\lUylWwX.exe
  C:\Windows\System\lUylWwX.exe
  2⤵
  PID:12212
- C:\Windows\System\dpQcsoF.exe
  C:\Windows\System\dpQcsoF.exe
  2⤵
  PID:9304
- C:\Windows\System\vDUiGvt.exe
  C:\Windows\System\vDUiGvt.exe
  2⤵
  PID:8736
- C:\Windows\System\AMjPIJh.exe
  C:\Windows\System\AMjPIJh.exe
  2⤵
  PID:7360
- C:\Windows\System\HyBFBya.exe
  C:\Windows\System\HyBFBya.exe
  2⤵
  PID:12316
- C:\Windows\System\tRVtKXx.exe
  C:\Windows\System\tRVtKXx.exe
  2⤵
  PID:12412
- C:\Windows\System\jdBscmt.exe
  C:\Windows\System\jdBscmt.exe
  2⤵
  PID:12504
- C:\Windows\System\PvSNHUj.exe
  C:\Windows\System\PvSNHUj.exe
  2⤵
  PID:11728
- C:\Windows\System\gSPTtHF.exe
  C:\Windows\System\gSPTtHF.exe
  2⤵
  PID:9544
- C:\Windows\System\kWuUHwr.exe
  C:\Windows\System\kWuUHwr.exe
  2⤵
  PID:8812
- C:\Windows\System\SvAreZq.exe
  C:\Windows\System\SvAreZq.exe
  2⤵
  PID:10620
- C:\Windows\System\WKuMvTN.exe
  C:\Windows\System\WKuMvTN.exe
  2⤵
  PID:4780
- C:\Windows\System\eZDErUx.exe
  C:\Windows\System\eZDErUx.exe
  2⤵
  PID:8696
- C:\Windows\System\RpJCZcX.exe
  C:\Windows\System\RpJCZcX.exe
  2⤵
  PID:13208
- C:\Windows\System\XeHXWJD.exe
  C:\Windows\System\XeHXWJD.exe
  2⤵
  PID:13008
- C:\Windows\System\FlNHNCD.exe
  C:\Windows\System\FlNHNCD.exe
  2⤵
  PID:12552
- C:\Windows\System\KgbaLDI.exe
  C:\Windows\System\KgbaLDI.exe
  2⤵
  PID:9648
- C:\Windows\System\UbKbchx.exe
  C:\Windows\System\UbKbchx.exe
  2⤵
  PID:11340
- C:\Windows\System\WpWAcSM.exe
  C:\Windows\System\WpWAcSM.exe
  2⤵
  PID:13144
- C:\Windows\System\clGYZQJ.exe
  C:\Windows\System\clGYZQJ.exe
  2⤵
  PID:8628
- C:\Windows\System\YuIaOSW.exe
  C:\Windows\System\YuIaOSW.exe
  2⤵
  PID:920
- C:\Windows\System\huhSNNf.exe
  C:\Windows\System\huhSNNf.exe
  2⤵
  PID:12640
- C:\Windows\System\VnGKSEn.exe
  C:\Windows\System\VnGKSEn.exe
  2⤵
  PID:1904
- C:\Windows\System\DrwOhDb.exe
  C:\Windows\System\DrwOhDb.exe
  2⤵
  PID:10892
- C:\Windows\System\VfLNcwn.exe
  C:\Windows\System\VfLNcwn.exe
  2⤵
  PID:10524
- C:\Windows\System\WoiQDWf.exe
  C:\Windows\System\WoiQDWf.exe
  2⤵
  PID:11840
- C:\Windows\System\lfyXRYl.exe
  C:\Windows\System\lfyXRYl.exe
  2⤵
  PID:640
- C:\Windows\System\DyVSafD.exe
  C:\Windows\System\DyVSafD.exe
  2⤵
  PID:2916
- C:\Windows\System\ivLuAfm.exe
  C:\Windows\System\ivLuAfm.exe
  2⤵
  PID:12264
- C:\Windows\System\lmrSSUq.exe
  C:\Windows\System\lmrSSUq.exe
  2⤵
  PID:2400
- C:\Windows\System\gBNUyzy.exe
  C:\Windows\System\gBNUyzy.exe
  2⤵
  PID:12184
- C:\Windows\System\vAFqDRX.exe
  C:\Windows\System\vAFqDRX.exe
  2⤵
  PID:12748
- C:\Windows\System\espJmKL.exe
  C:\Windows\System\espJmKL.exe
  2⤵
  PID:12656
- C:\Windows\System\KCwMTHn.exe
  C:\Windows\System\KCwMTHn.exe
  2⤵
  PID:4264
- C:\Windows\System\LuwkHaD.exe
  C:\Windows\System\LuwkHaD.exe
  2⤵
  PID:13280
- C:\Windows\System\TAtHpoJ.exe
  C:\Windows\System\TAtHpoJ.exe
  2⤵
  PID:13112
- C:\Windows\System\gphcZTv.exe
  C:\Windows\System\gphcZTv.exe
  2⤵
  PID:11796
- C:\Windows\System\vMmuTJX.exe
  C:\Windows\System\vMmuTJX.exe
  2⤵
  PID:9348
- C:\Windows\System\wRVVoHt.exe
  C:\Windows\System\wRVVoHt.exe
  2⤵
  PID:11744
- C:\Windows\System\vXIBEtV.exe
  C:\Windows\System\vXIBEtV.exe
  2⤵
  PID:11672
- C:\Windows\System\ZDanbWs.exe
  C:\Windows\System\ZDanbWs.exe
  2⤵
  PID:10616
- C:\Windows\System\tYfIevd.exe
  C:\Windows\System\tYfIevd.exe
  2⤵
  PID:756
- C:\Windows\System\RMfsyii.exe
  C:\Windows\System\RMfsyii.exe
  2⤵
  PID:9344
- C:\Windows\System\bugYuRK.exe
  C:\Windows\System\bugYuRK.exe
  2⤵
  PID:1516
- C:\Windows\System\tWvNmAx.exe
  C:\Windows\System\tWvNmAx.exe
  2⤵
  PID:10252
- C:\Windows\System\HVgVVay.exe
  C:\Windows\System\HVgVVay.exe
  2⤵
  PID:12616
- C:\Windows\System\RXuxJKA.exe
  C:\Windows\System\RXuxJKA.exe
  2⤵
  PID:13192
- C:\Windows\System\ToXlHDa.exe
  C:\Windows\System\ToXlHDa.exe
  2⤵
  PID:12476
- C:\Windows\System\kWnhuzM.exe
  C:\Windows\System\kWnhuzM.exe
  2⤵
  PID:3220
- C:\Windows\System\Ovwrhbk.exe
  C:\Windows\System\Ovwrhbk.exe
  2⤵
  PID:13324
- C:\Windows\System\NacoZYr.exe
  C:\Windows\System\NacoZYr.exe
  2⤵
  PID:13352
- C:\Windows\System\nciumNE.exe
  C:\Windows\System\nciumNE.exe
  2⤵
  PID:13368
- C:\Windows\System\tuDYjdm.exe
  C:\Windows\System\tuDYjdm.exe
  2⤵
  PID:13396
- C:\Windows\System\jgwFlbd.exe
  C:\Windows\System\jgwFlbd.exe
  2⤵
  PID:13444
- C:\Windows\System\eVtQwnW.exe
  C:\Windows\System\eVtQwnW.exe
  2⤵
  PID:13596
- C:\Windows\System\WJaYjLk.exe
  C:\Windows\System\WJaYjLk.exe
  2⤵
  PID:13640
- C:\Windows\System\jwshmMC.exe
  C:\Windows\System\jwshmMC.exe
  2⤵
  PID:13656
- C:\Windows\System\NptqvBt.exe
  C:\Windows\System\NptqvBt.exe
  2⤵
  PID:13672
- C:\Windows\System\iPbqKtZ.exe
  C:\Windows\System\iPbqKtZ.exe
  2⤵
  PID:13696
- C:\Windows\System\vOHWfnp.exe
  C:\Windows\System\vOHWfnp.exe
  2⤵
  PID:13784
- C:\Windows\System\oCPVGhl.exe
  C:\Windows\System\oCPVGhl.exe
  2⤵
  PID:13804
- C:\Windows\System\agsKEzP.exe
  C:\Windows\System\agsKEzP.exe
  2⤵
  PID:13916
- C:\Windows\System\VlaWDXA.exe
  C:\Windows\System\VlaWDXA.exe
  2⤵
  PID:13940
- C:\Windows\System\goPzzqo.exe
  C:\Windows\System\goPzzqo.exe
  2⤵
  PID:14136
- C:\Windows\System\jOWCwIL.exe
  C:\Windows\System\jOWCwIL.exe
  2⤵
  PID:14164
- C:\Windows\System\MoFKFus.exe
  C:\Windows\System\MoFKFus.exe
  2⤵
  PID:14216
- C:\Windows\System\dONNMQa.exe
  C:\Windows\System\dONNMQa.exe
  2⤵
  PID:14272
- C:\Windows\System\syMhfqx.exe
  C:\Windows\System\syMhfqx.exe
  2⤵
  PID:14296
- C:\Windows\System\wwrFvzy.exe
  C:\Windows\System\wwrFvzy.exe
  2⤵
  PID:14316
- C:\Windows\System\uruzhmh.exe
  C:\Windows\System\uruzhmh.exe
  2⤵
  PID:10284
- C:\Windows\System\vlNAFBu.exe
  C:\Windows\System\vlNAFBu.exe
  2⤵
  PID:12028
- C:\Windows\System\TowURJG.exe
  C:\Windows\System\TowURJG.exe
  2⤵
  PID:4824
- C:\Windows\System\OPlqghZ.exe
  C:\Windows\System\OPlqghZ.exe
  2⤵
  PID:3772
- C:\Windows\System\VfJnrNW.exe
  C:\Windows\System\VfJnrNW.exe
  2⤵
  PID:8964
- C:\Windows\System\FegBmLQ.exe
  C:\Windows\System\FegBmLQ.exe
  2⤵
  PID:10832
- C:\Windows\System\ojfVmwi.exe
  C:\Windows\System\ojfVmwi.exe
  2⤵
  PID:11488
- C:\Windows\System\QNRrUXD.exe
  C:\Windows\System\QNRrUXD.exe
  2⤵
  PID:1996
- C:\Windows\System\HiDrxjA.exe
  C:\Windows\System\HiDrxjA.exe
  2⤵
  PID:13344
- C:\Windows\System\MoyVeeW.exe
  C:\Windows\System\MoyVeeW.exe
  2⤵
  PID:13384
- C:\Windows\System\JginaLZ.exe
  C:\Windows\System\JginaLZ.exe
  2⤵
  PID:3960
- C:\Windows\System\REDcGpZ.exe
  C:\Windows\System\REDcGpZ.exe
  2⤵
  PID:13620
- C:\Windows\System\aVwUzFG.exe
  C:\Windows\System\aVwUzFG.exe
  2⤵
  PID:13568
- C:\Windows\System\JlJtwqJ.exe
  C:\Windows\System\JlJtwqJ.exe
  2⤵
  PID:13736
- C:\Windows\System\YgHInUT.exe
  C:\Windows\System\YgHInUT.exe
  2⤵
  PID:11872
- C:\Windows\System\XCSXemm.exe
  C:\Windows\System\XCSXemm.exe
  2⤵
  PID:13516
- C:\Windows\System\izTvbgN.exe
  C:\Windows\System\izTvbgN.exe
  2⤵
  PID:13820
- C:\Windows\System\vQLIORn.exe
  C:\Windows\System\vQLIORn.exe
  2⤵
  PID:14108
- C:\Windows\System\gNcoJkG.exe
  C:\Windows\System\gNcoJkG.exe
  2⤵
  PID:6836
- C:\Windows\System\ENsgtat.exe
  C:\Windows\System\ENsgtat.exe
  2⤵
  PID:6824
- C:\Windows\System\UhaPgsH.exe
  C:\Windows\System\UhaPgsH.exe
  2⤵
  PID:13800
- C:\Windows\System\zLTWuTo.exe
  C:\Windows\System\zLTWuTo.exe
  2⤵
  PID:14184
- C:\Windows\System\gMRvlPL.exe
  C:\Windows\System\gMRvlPL.exe
  2⤵
  PID:14288
- C:\Windows\System\jJWwyES.exe
  C:\Windows\System\jJWwyES.exe
  2⤵
  PID:8364
- C:\Windows\System\duLLBqr.exe
  C:\Windows\System\duLLBqr.exe
  2⤵
  PID:13972
- C:\Windows\System\pnqWQif.exe
  C:\Windows\System\pnqWQif.exe
  2⤵
  PID:14160
- C:\Windows\System\SCoGZkR.exe
  C:\Windows\System\SCoGZkR.exe
  2⤵
  PID:10528
- C:\Windows\System\MTbTtod.exe
  C:\Windows\System\MTbTtod.exe
  2⤵
  PID:14256
- C:\Windows\System\UopIfJJ.exe
  C:\Windows\System\UopIfJJ.exe
  2⤵
  PID:13304
- C:\Windows\System\XHfVEwA.exe
  C:\Windows\System\XHfVEwA.exe
  2⤵
  PID:12780
- C:\Windows\System\cAkNVSL.exe
  C:\Windows\System\cAkNVSL.exe
  2⤵
  PID:13616
- C:\Windows\System\cPZWSiP.exe
  C:\Windows\System\cPZWSiP.exe
  2⤵
  PID:432
- C:\Windows\System\hfQohzO.exe
  C:\Windows\System\hfQohzO.exe
  2⤵
  PID:11844
- C:\Windows\System\jSkzXiv.exe
  C:\Windows\System\jSkzXiv.exe
  2⤵
  PID:13424
- C:\Windows\System\IgRLSrw.exe
  C:\Windows\System\IgRLSrw.exe
  2⤵
  PID:13436
- C:\Windows\System\CipFHgR.exe
  C:\Windows\System\CipFHgR.exe
  2⤵
  PID:13348
- C:\Windows\System\donaMNP.exe
  C:\Windows\System\donaMNP.exe
  2⤵
  PID:13708
- C:\Windows\System\XZJHQfh.exe
  C:\Windows\System\XZJHQfh.exe
  2⤵
  PID:13828
- C:\Windows\System\kErcxRV.exe
  C:\Windows\System\kErcxRV.exe
  2⤵
  PID:13848
- C:\Windows\System\jJzGHLw.exe
  C:\Windows\System\jJzGHLw.exe
  2⤵
  PID:13840
- C:\Windows\System\BRlfwsY.exe
  C:\Windows\System\BRlfwsY.exe
  2⤵
  PID:14072
- C:\Windows\System\fplZGHc.exe
  C:\Windows\System\fplZGHc.exe
  2⤵
  PID:14024
- C:\Windows\System\xJHIoBk.exe
  C:\Windows\System\xJHIoBk.exe
  2⤵
  PID:14152
- C:\Windows\System\izdqmhf.exe
  C:\Windows\System\izdqmhf.exe
  2⤵
  PID:13712
- C:\Windows\System\QDFpqTh.exe
  C:\Windows\System\QDFpqTh.exe
  2⤵
  PID:14312
- C:\Windows\System\ADXFiYl.exe
  C:\Windows\System\ADXFiYl.exe
  2⤵
  PID:1304
- C:\Windows\System\pzHiLuE.exe
  C:\Windows\System\pzHiLuE.exe
  2⤵
  PID:14280
- C:\Windows\System\WoDOTVN.exe
  C:\Windows\System\WoDOTVN.exe
  2⤵
  PID:13560
- C:\Windows\System\gqakfHz.exe
  C:\Windows\System\gqakfHz.exe
  2⤵
  PID:11916
- C:\Windows\System\aBNJjym.exe
  C:\Windows\System\aBNJjym.exe
  2⤵
  PID:11824

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 776 -p 9896 -ip 9896
1⤵
PID:11840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 756 -p 12388 -ip 12388
1⤵
PID:12656

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 660 -p 12456 -ip 12456
1⤵
PID:13112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qyo0iywe.dy3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BupiAwe.exe

Filesize
1.8MB

MD5
d77e2f1f9ecb59963de4e5fe5673b57f

SHA1
b51817e44176146330de2840e1c27f44a27af183

SHA256
4cd737bb9a49671d284814169f88e142f2de6c68e0ccd4713fa0793de34b6eae

SHA512
95512178ca09c26e121f1db255ad4ffb631c17c0ae8bc49f60f148f95d8bb7f775af1f583d915b31cfb2ac32dd9c2dba00d2645b19f5c1dcc41d00393676608b

Download Submit
C:\Windows\System\ChnfoTm.exe

Filesize
1.8MB

MD5
7af23bf42d854cd8f14da5b3e471c1a4

SHA1
1903858886778c6c6128113152496b3676742973

SHA256
86849d47f1e10e13f38101e5cfc716a7f42c0c5697348d9700aec18b74865118

SHA512
92b3b0c61c0afa686f134ee2d51b9e4597f82acfe4e10304e6e7d034c289f3021b0fb2ee7c6d2ff7958217cc89526cb70b1172e2d0ef64657f7f3e43940e49b3

Download Submit
C:\Windows\System\ELFHqtv.exe

Filesize
1.8MB

MD5
60b5e16312429e0cfb64dbe24b9b99e7

SHA1
ce3961827cdfd75b70f6c952d8749c2f3c6fcbc7

SHA256
f3d32537ce1a2104994187874d56f0e859cc95f664df0aacd2b78f6e7dfc6983

SHA512
e2b3717eb285a01f522f08d4c97f416be4287a12f5cb06d893b4058790f2e716690008a2045dedd81aa8a8036547b3fea47d944cb683e6f9889ecf29b3982eb0

Download Submit
C:\Windows\System\EMHocTY.exe

Filesize
1.8MB

MD5
4c39bfda4a5c04d0491a19a2375873e4

SHA1
a080a1ade81bb34e2f9e3f12eb61ab6f6e2c059f

SHA256
339c7cd597e14decfd2d36adfbc311ff5047c34543374cf083c2ca73bbba92b9

SHA512
e7af185136171929152bc14a710ba61dd34779ec95c7f3cf6918f3b084c88ba84475e4934f7ad811567e665204fea08a189a375a897223e760152dd86c2cdf68

Download Submit
C:\Windows\System\GpgMefC.exe

Filesize
8B

MD5
35b23d571bbad4492faca789c3ae9e51

SHA1
adce24f573b6f217562802fd70c52d63ff8f138a

SHA256
3a560e0248da85dda9072e5a99566240ff722f60e9e834efc9c2c23440409d68

SHA512
9c03280067c140373673e9c5ab78127be909959b13e02da8c3ebcce17541a63329fa3cb35a4d2a7b2bb1a50a364108f4e9b1ca429acacd7bf3a5a9d83fb6ba39

Download Submit
C:\Windows\System\IrRwPfw.exe

Filesize
1.7MB

MD5
22f2cf2e770996889b2c4282394cd718

SHA1
bfd442ebf43b3d406b4fee0b59de8ec0078b68ae

SHA256
9eef926d1db99614e3f5603dffb55f5d6fc56fa9f7ff6066112d6c3595285d9a

SHA512
2f1e20845efb26cc9115c3ddee4b1ab515db291a0162b9075405813efb8442adbe0875281cf1b96603ec0d388f9f28783a305c36619bf2bc9aa5d0367a140204

Download Submit
C:\Windows\System\JsbRPjE.exe

Filesize
1.8MB

MD5
a177ab658185ab5139c71ec430014c1d

SHA1
727c718ef24d962040609136deb54c7421705cc7

SHA256
6d4302c85d0ff5b91fe5771b6c60600aa2d44a703897016515fe5fc876da1196

SHA512
7c91bc441b0c5c59f528e550ff88fa28aa46b0f8dc22c9fcec7990d8ab4a8f2eb0215eb97c84420de1ddd1e6fd5a37149f9348c8adaa2cbc60ba8b774c51a71c

Download Submit
C:\Windows\System\LdEepKU.exe

Filesize
1.8MB

MD5
baeb67c7fe9e3d886e5a87da749dabf1

SHA1
d5ff9502a811f92efb5c7d0418070575e8ae0a1e

SHA256
e8c3d90bebf1bd01f0659a143a31910803e33de94a678f54580930cfca9aaa25

SHA512
fd8db93ff138fbeb6b1539b1906f8d5e64caee01a9b1fcfcbd2b35d6f51b347a4ba22c41425881547e858c763fc7246253ac3fcdc0279b87d7ca6852ef072621

Download Submit
C:\Windows\System\NVlBSaH.exe

Filesize
1.7MB

MD5
b27760ca8e8f6c50eb0ecc74aadfb025

SHA1
287ebea46e09d19c26a7a78a9473040683b30b64

SHA256
918deb6d18ed3c26a3d0636e266e3532a013ac1b388604af17979a8d924b14a2

SHA512
0286c2066ab679049b1d128678e8ac6234512d463e8b771e7f1ba364fad1ed5e15c61ed9cf648724cb82aa1537ce2e5027988c1443f7ff3a0bc1e810799a4282

Download Submit
C:\Windows\System\OkMHQgO.exe

Filesize
1.8MB

MD5
ad1ea7bafac2fa178156cd5e05303b81

SHA1
9f1a3bd8f37fcde86316b9b3985adc6ab6419999

SHA256
2a46b3b87964e54dcfed3efde9358e0eb7b8df9a7bda854d9675f5f773d3e407

SHA512
3bd7c711635762a09a14deb6cebb0e28a326a172c6910c0d98abe7895c3f68b4e57322bc8d2fd398e470ae3e736fe501b39be12814b2ad3078f306479c47e6b2

Download Submit
C:\Windows\System\PqkBxyy.exe

Filesize
1.7MB

MD5
7ad2dddd599798fe8536672563971f32

SHA1
377e8028a9f7358e36825a0a4e967585493a86e1

SHA256
0b8275b1bf8b3b6cc11090bf479f863757103c77f24cb8798f1e689d0f0063c4

SHA512
40abb2320540d99ad8b7f29d1877abfd3991cd8c745a141ded28c5d92bb253ce5b7df70626c95955dcbdb37531bf0452d6a483ea1e4a74c83e15d66bcd5a79c7

Download Submit
C:\Windows\System\RWVhjtj.exe

Filesize
1.8MB

MD5
0e2ed4ea8a8557e359b8933c170a43bf

SHA1
cee1b56efd70a1448d87e5e5899fbda9bbf57239

SHA256
83e42125e0fb854f6a6cf38cca7ea6cffe2392894051169d56d1e60fdea1f1c3

SHA512
dd1d9cebef87b38bb013c54015b73c0211f4f06615ed156d0909321fc631143b456da5e2d371d1b1ffab9d4a3015b80266897f421da2f5c55ea0d3c303c30e3e

Download Submit
C:\Windows\System\RmMoVPR.exe

Filesize
1.8MB

MD5
662413d97a2201bfe938ea991722ddcf

SHA1
f888b5eef14d289c7f708888bd78c83098d6fc58

SHA256
7e2687b0c63ba7fd28fe5cdaeba3e1d2afc2972f816955a6070bd59397b5db0e

SHA512
5285ed89cf10ef1c5558d09a615ca3b4c77911c43c20c2b4eac405257313c9ccb23dd573dd94e5bc6e07c5abdc6567a932596c3f758e64e850d0a0ae158cfdf7

Download Submit
C:\Windows\System\SCpgEHE.exe

Filesize
1.7MB

MD5
2d2d30ae0ed470a9e3cd1a57bc7a7357

SHA1
b579713c19b0ccab6123df8e3989f60abbe7d7c1

SHA256
c59c559a8a6c229e01ce86bd9024ea1db7ffb17cd3fd6f1787fb7c7e866b2440

SHA512
05ed09aced30cf960b2577f758f7024a6d8adf0ccef36d2e391e5a995b895ac474260d35edf90f4db3fba55b6335cada3e7becd9afd0b1202280cf8192abcf81

Download Submit
C:\Windows\System\TEKQsYc.exe

Filesize
1.7MB

MD5
722dad3efa2c60c740c397f738d1b4b9

SHA1
3069306561bcb84944afad2516976d8980d6eb0b

SHA256
79a2d0ef9c41a6ae1073b0890dee1a0081104105aac80e7f9080d4caadd645fa

SHA512
bcf5b4f970b84891ffd7cf1dcafe55f64d6dc26dfa5ec72999553261edf68ed4bce017695cde8124640a00be0c11239b4133a3cf8969d3a62f3277e311131bc6

Download Submit
C:\Windows\System\TXtrZbZ.exe

Filesize
1.8MB

MD5
3b1b122e27c14338a79f8cdffd35bec5

SHA1
6bf57eb952dda3c126f602f4a10cf76124047434

SHA256
a777489db9c1a4427d23a7bd0f61de3f50a2fb82a0ce9df7975b9e7557360ca0

SHA512
3a9b077da013634d649f8dfd3e4780249b54f2c64840c4488a63846a2a55ef5bb0928759fc3d8311bdf1e1369c42ec4b071836cbbaa941009f9bb5874f369fe8

Download Submit
C:\Windows\System\WosKHym.exe

Filesize
1.8MB

MD5
ef04f4f6c51c0a54a6c001de9ea60643

SHA1
a89f05242a97b1010e670c2e19499c3def83c7d7

SHA256
04d66433d2be874440802f459c0cbfc9ba45a75fd2a418d4a7030c976a802bd1

SHA512
1dc91635743507a515444145065ce8627a21a834dffd5e8be094f9ed312994da21e80f1b709be16e7fc080a53d661414218e94f6e4830b5bdaad457f76e1361d

Download Submit
C:\Windows\System\ZPoNYkn.exe

Filesize
1.8MB

MD5
0fc9a1f8ecbc99294f99fdc4b6ee59b4

SHA1
e232f6b68bfa1285e0365cc146cb02560f6b2d5f

SHA256
f0e652834eb776f5ed2858eaabbaf78c28c0102efb1eaed4c675310116f6a742

SHA512
b7a7f4e7c49d6fb27b43c7be891023303f10b50c264492a588128ea53fd2e7682ca1f0792af309a2bd43b1a411de0203910adc6d860fc945ecfe7959dd75d664

Download Submit
C:\Windows\System\ZrhnbIA.exe

Filesize
1.8MB

MD5
6c80c57142fc7ecef7a58d4fed2b4e86

SHA1
191c1204e89be9b40f9a4ede61791df64344f969

SHA256
85a67f0d59c1675654e02e33651106e729cc1bee7d9b65ef359d743073035810

SHA512
bb82edbeffdb9cef30bf1916209e30d697a306803a592bc008870e5afec4f459210e0cf460be2939e7d04ace4a2fbb47babf1e158da0c5a4de09d0fa39ae658f

Download Submit
C:\Windows\System\aQQZnFA.exe

Filesize
1.8MB

MD5
be003c8d1c70210fce388a61a9979bdc

SHA1
02a9692cf37e61541e9ee629c2c9c76316af5362

SHA256
ac13aba69c3c4ae9243f6fb493f60f78d98c0cb113826ff7bc5b8115ca64fab4

SHA512
e1d1af76254531409ad607aa385e921ec09210d5b83c25a3aaf63502643d6902f40bbbe807632660462486ace5b8034d92fe033be4ebaa4f624bf0f358e88e1f

Download Submit
C:\Windows\System\aSLFBdk.exe

Filesize
1.7MB

MD5
5821716dc6f2fa6d5def08dbe665ba03

SHA1
5fe99e9823b5099c7e6c45c20f26666e514c75e1

SHA256
d024817264a788eb4c42e02b7a47accf718cc01c864272e8669f2df002ff227a

SHA512
fc6cb3b1677c1d3f6639650aa0e61d4fd8b954f2dd71b97556461e272bf9f4ecfc3a6a0de0185921c647ecbcd9e70de062fc852a571415a1659383944074ab88

Download Submit
C:\Windows\System\aVxdKQb.exe

Filesize
1.8MB

MD5
f8d69e4906424ff05868d7561d78c74f

SHA1
5cd27e5c44aaee4425f293570866afeba0b47475

SHA256
86ffd45558376f28fdb77a7d8fdd2db934400a8b81d1194d4067fcaa8e0ae449

SHA512
8b20a879576c06b04414ac20309b8cb9f97744d9efcaf961ba27a118276802e05c5b4b48869249b65bddb94eb5e6468fdbc855445fcf532e7b0ef8599805e073

Download Submit
C:\Windows\System\bBcIUfJ.exe

Filesize
1.7MB

MD5
8eb86c256aed3aa370f81db36b69e6ce

SHA1
8a6c6d61935a2906d465afa1e453cd9e047dba95

SHA256
d994c0d7b0ffd542341ddece5449c721aac3b2040d2fd82b1338e03e4c81274f

SHA512
ca0033514bc5a82270a3c9aa752b8927580d3acc08ac15fba42dc19ae1d1ceb56791b340b60d45ccca3231722f9d91fecae52c1d4370f24ca33c4ef0f20afaf2

Download Submit
C:\Windows\System\eMBpZWl.exe

Filesize
1.8MB

MD5
d59fd5a23eb9ba3e57336641677ff648

SHA1
af2a7ca2be3a0c563c4012beee1ddba9206add9f

SHA256
9379a7497c5936e266e4bdb1ba0dc6b727cedcb35d69ac51cae02aeb9fa4ba70

SHA512
ac63909deb3f29ad85bec1d9e8a0f0a2a05201a85c5378de6a89fef20fa3bbde1994164f2db9fa9c77b6224f320387ba2e8d5b5f2ca79a1b49764a48ba0ced95

Download Submit
C:\Windows\System\etMbuPQ.exe

Filesize
1.7MB

MD5
9d8937ab5b325a0926cb8d65b8a2147a

SHA1
22e3cfbd7f19611ff510a78160902d4acd6734b3

SHA256
427c40943d67a9af5c21daf0eb9f3ca09151d2b2a586b2265978ec3e3377dfe3

SHA512
8f49e3f3b421d9cfb138b78eb6d6bcf664b8471e66e8dab4f41d00ec9635f56723745423ba8f74e5bbf13e29845a34756a2b7edd1b71060880f2ae836e45f9cb

Download Submit
C:\Windows\System\iQifaZE.exe

Filesize
1.8MB

MD5
5041033e077fc37af1779528862633c9

SHA1
b20cdab4e556fd8f71ca1c3842fc451fe9d90ce8

SHA256
72dc6ec0dde18b0ca5390d082dea8e0bfae621b840aa1eae806f9ca670cdccf7

SHA512
544c9814a379f4cc7a7e252bdef11f098748e932f3a8959690edba84de970d235d27bc6925e4b690ceda629015a131f326df9689d147d29662cf00788138f266

Download Submit
C:\Windows\System\isJMxcG.exe

Filesize
1.8MB

MD5
71310947ca54519cd2761c126711f15b

SHA1
16c632be0ae495792fba7b69a224d59a3f4b4f6c

SHA256
6600b5db80850412fa59c0d0b547f361b750870e172c1970c93c6291596641ca

SHA512
a68d36f71fc7dcd12f05b1285113337ac68813e0d35653b5a22a7eaf0feb42fbfb94dd80d687455e8345187f61256cb80c3f0094bfa0a02ea4a40144bf6f5ff4

Download Submit
C:\Windows\System\nEJfXYC.exe

Filesize
1.8MB

MD5
c03a31caaf578c400e249e4ce6207fd8

SHA1
b4b49c7e754bf090c2847dcec74d8a4bddac2e8a

SHA256
fce220578d6497531a2302b11e2391a9bd0a266c8598a9f6a8876f9605f9b84d

SHA512
e9c8410cf1b5d244f14d81313136279eba975618cd47ded44985be392ec7bb407d6bfb84b356c007dee93c0a0e236eb1aa313f809c4a2c7370a0db930d2ab7c5

Download Submit
C:\Windows\System\nTdJtls.exe

Filesize
1.7MB

MD5
b2c59c149324695254ce23f14955c0be

SHA1
55f75dccef3926a94c120e37e9a6eeb1742f8332

SHA256
e650bb6373c81865167a7a831282c32c0b8f46cfb3e02755935b8d777442bcb7

SHA512
6364c1db5e1cdeee96e80dd63c406fd41589f94a02939fb6888244380c640fe04d0bef3d7837d4fcac607e41f03a6974d9fbb4bdea3872e9a08a771a81f3e64b

Download Submit
C:\Windows\System\pEhTtlq.exe

Filesize
1.8MB

MD5
8deb3c29139008bf323881a40f391793

SHA1
23f6cfbfa55bdb7eda7423bbcb2900d71412a18a

SHA256
55da75316109d2e3e3ffcaaaec427d947af31fae71087e8586e2c0cdf8b71766

SHA512
15744e464f365b754ec9b258c10fc32379e5ba40c37ea7f4bc62a3cd945218f5d8706ab6dcbeedd08e4a6748346e58169154e7fbcc1810806739762c7d485a73

Download Submit
C:\Windows\System\qwscVVD.exe

Filesize
1.7MB

MD5
170c8ad9d417fee5d88aee09ed54d9ae

SHA1
0966069062f05f7bf9112b277e5c0646b6e69190

SHA256
4fda241b7dfad2ba81ad46036d282840f02b070aeaa5f8784bf81764e14ebda3

SHA512
7834b576dfcea7aceb8b944d667dab48e0ae0edd4e72ab847ee1a5b0e6bb87cb3f2017948d44dea3f925bfd0b1f90feb8d91ce744085a273d1e4abfbe0dcc0f1

Download Submit
C:\Windows\System\sGBonAj.exe

Filesize
1.8MB

MD5
18cebbd3a14a6676129342a6edcf317c

SHA1
d6f72326c06c7a635bbca77d0a73e2bb03fe81df

SHA256
6f134602f4bc018ac60e319e9171cdcb695b1b8b5461a73a2761fa8b518bb8a1

SHA512
048415370a4dd13df8440d3e6dedfdcdf756397c45bf44cfee7b5327e8c4a391334a1add334f79336d5f4f8c23c64eef6cb6bcf8818e46951d4f1b3fe4541f0c

Download Submit
C:\Windows\System\sUIxxuX.exe

Filesize
1.8MB

MD5
c4eda827a9714f91fa5cfc06eb053948

SHA1
34734235f695e77ea86687038d4a874084ec20ca

SHA256
870828a33eb542a3633d817d4359fc1bda02679b32a686f1f51c42bce6331781

SHA512
1ba64b96721895d6654091278f33a1ea2d8d07d0cc72c50cef3ec2cfb70dad36e075c89ac10b1ada7a12b8833a14b239bd130e795c44a725dccbf4fce19588d0

Download Submit
C:\Windows\System\sjiNlEf.exe

Filesize
1.7MB

MD5
a0df9c536e0274729373e81cbc286a1d

SHA1
f6135851c3ce99ca29a743e5ac11e2cc5d295850

SHA256
c2bc68d81bdf919077a526509ed5aaebc55c466dbf2730092f9d49114db39a6b

SHA512
1fd262466f93f7c12c3d9d4c86b9aefaae20aca50478a32bc8449bc815c7fae5ff5fa7258944e07c8f2ce59659a550c823b7601e6cb84060f90f8d324aa6c702

Download Submit
C:\Windows\System\wFLqqYn.exe

Filesize
1.7MB

MD5
10ec530964c2e367cbd0248f54bcb4ff

SHA1
044905934c2e332813b9e667d95f6fb4f102e5ec

SHA256
1825e68bdf279eb98e505b87b55e3b4b1be17cb8f3c8d242ce6bedf7c12752d2

SHA512
480b7a1e260e63c4396bb5828718d7b5b256e8703bfd0c40aff3c33a4914cb6f2de3309b7cb7435aead668c2afee63833ffdd553d694955b7f629b0656c86714

Download Submit
C:\Windows\System\wNlvxBU.exe

Filesize
1.7MB

MD5
fcfbd098ed72c7d0417dc98105a0d181

SHA1
6d6a1f79e6e1c1a3ff8b612be27f8e5892dad2c8

SHA256
a9e696ec573474a3f9d395ef9bd68aeaaa5cd66ff254e246c7bf6699d86e87c0

SHA512
36d61eefef6f7827c5823ea8939fd3427a2a977577ca0b2cf12bdbfaca919e3df8f024cedf470471c4460efc96f20fb72431e57a469336a5ad0655d542372a9b

Download Submit
C:\Windows\System\wREQmFi.exe

Filesize
1.8MB

MD5
05d38cf669bc78e51535c09f222c1370

SHA1
bc5d49af0786a11e8a9a8bcf4ff661187cb4ff35

SHA256
979a8f75e69991ced8f962da1bf9f9a49a0f77cf0c46b69321c0e7b5260789c5

SHA512
ec518dfc6b8b367969dfda35dfa780f92f6296628056bdd6858b42e7e12ed62a4b2ceb5e51c472614f95cc110729da25f4a39bcdd87ffd4e003252d861aae74c

Download Submit
C:\Windows\System\xBcXvTp.exe

Filesize
1.8MB

MD5
106465f1adebe563be6a54dec3ea07f9

SHA1
1dcd8358b463400778fb5d000bbddebafb26ac8d

SHA256
738bf4489dbd76ae20db50e71a8d666f70b524da0a1603237cf0cd5cb086038c

SHA512
dad56bc40630ea0d8876b9f6f844e20362bd1f68f377fa0c43427f41920dfaf1735576807b012ab7804d369527b8f1d33c57e75497a9aebe4fe61c23704180ce

Download Submit
C:\Windows\System\xfWdyAO.exe

Filesize
1.8MB

MD5
213d3b0e0cb5ddd6e75ba93c7b741138

SHA1
894e75300260dfe919096a116bc31952eb894b50

SHA256
8b4a70d7cbe2f88a5f132152d76f4d50e5093f36f7e08c989d38c5d46a617093

SHA512
520fc31d4bd893ddbf698b3be21310272690b9e3fb4d9202de6229debcc039c2c63be8e758e20fa97fdf66b58d53be3f94fbeffa46da241e4b3fde3cbdb37770

Download Submit
C:\Windows\System\zbBupNM.exe

Filesize
1.8MB

MD5
e91328a26da685a78ec5e5688af503df

SHA1
73d8e8d36a7bfaf92ad2edc0dcf792bb50d8a404

SHA256
020736520f1acdb76407eafaed1633c895b713a3694afb0a8313fc9002e0afd6

SHA512
e3ae638faf28dd2d473bac7998c07e4e50e1c36c83671bb6547f185a4a6aea4d1dde5d38078fa01e2366a5fc1551b7f6c9463dcc86296d2ea6d2b79efd7fef59

Download Submit
memory/560-2831-0x00007FF768310000-0x00007FF768702000-memory.dmp

Filesize
3.9MB

Download
memory/560-557-0x00007FF768310000-0x00007FF768702000-memory.dmp

Filesize
3.9MB

Download
memory/1064-2882-0x00007FF6F6440000-0x00007FF6F6832000-memory.dmp

Filesize
3.9MB

Download
memory/1064-566-0x00007FF6F6440000-0x00007FF6F6832000-memory.dmp

Filesize
3.9MB

Download
memory/1604-556-0x00007FF784770000-0x00007FF784B62000-memory.dmp

Filesize
3.9MB

Download
memory/1604-2849-0x00007FF784770000-0x00007FF784B62000-memory.dmp

Filesize
3.9MB

Download
memory/1620-2798-0x00007FF6A34A0000-0x00007FF6A3892000-memory.dmp

Filesize
3.9MB

Download
memory/1620-14-0x00007FF6A34A0000-0x00007FF6A3892000-memory.dmp

Filesize
3.9MB

Download
memory/1628-2838-0x00007FF6607F0000-0x00007FF660BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1628-554-0x00007FF6607F0000-0x00007FF660BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1892-2818-0x00007FF636D60000-0x00007FF637152000-memory.dmp

Filesize
3.9MB

Download
memory/1892-721-0x00007FF636D60000-0x00007FF637152000-memory.dmp

Filesize
3.9MB

Download
memory/2012-208-0x00007FF682B00000-0x00007FF682EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2823-0x00007FF682B00000-0x00007FF682EF2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-558-0x00007FF7F6D50000-0x00007FF7F7142000-memory.dmp

Filesize
3.9MB

Download
memory/2216-2843-0x00007FF7F6D50000-0x00007FF7F7142000-memory.dmp

Filesize
3.9MB

Download
memory/2380-1-0x00000232025C0000-0x00000232025D0000-memory.dmp

Filesize
64KB

Download
memory/2380-0-0x00007FF7BEBF0000-0x00007FF7BEFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-2828-0x00007FF696D30000-0x00007FF697122000-memory.dmp

Filesize
3.9MB

Download
memory/2492-555-0x00007FF696D30000-0x00007FF697122000-memory.dmp

Filesize
3.9MB

Download
memory/2728-17-0x00007FFB44253000-0x00007FFB44255000-memory.dmp

Filesize
8KB

Download
memory/2728-536-0x000002BAB2F30000-0x000002BAB2F52000-memory.dmp

Filesize
136KB

Download
memory/2728-356-0x00007FFB44250000-0x00007FFB44D11000-memory.dmp

Filesize
10.8MB

Download
memory/2728-97-0x00007FFB44250000-0x00007FFB44D11000-memory.dmp

Filesize
10.8MB

Download
memory/3076-2840-0x00007FF7075F0000-0x00007FF7079E2000-memory.dmp

Filesize
3.9MB

Download
memory/3076-560-0x00007FF7075F0000-0x00007FF7079E2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-2830-0x00007FF725BD0000-0x00007FF725FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3104-551-0x00007FF725BD0000-0x00007FF725FC2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-2847-0x00007FF6D84B0000-0x00007FF6D88A2000-memory.dmp

Filesize
3.9MB

Download
memory/3208-559-0x00007FF6D84B0000-0x00007FF6D88A2000-memory.dmp

Filesize
3.9MB

Download
memory/3292-146-0x00007FF7E83A0000-0x00007FF7E8792000-memory.dmp

Filesize
3.9MB

Download
memory/3292-2841-0x00007FF7E83A0000-0x00007FF7E8792000-memory.dmp

Filesize
3.9MB

Download
memory/3320-2834-0x00007FF7F1950000-0x00007FF7F1D42000-memory.dmp

Filesize
3.9MB

Download
memory/3320-518-0x00007FF7F1950000-0x00007FF7F1D42000-memory.dmp

Filesize
3.9MB

Download
memory/3664-2821-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp

Filesize
3.9MB

Download
memory/3664-567-0x00007FF7362F0000-0x00007FF7366E2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-2898-0x00007FF75FBE0000-0x00007FF75FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3884-565-0x00007FF75FBE0000-0x00007FF75FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-2836-0x00007FF6A6250000-0x00007FF6A6642000-memory.dmp

Filesize
3.9MB

Download
memory/3940-409-0x00007FF6A6250000-0x00007FF6A6642000-memory.dmp

Filesize
3.9MB

Download
memory/4220-563-0x00007FF635120000-0x00007FF635512000-memory.dmp

Filesize
3.9MB

Download
memory/4220-2854-0x00007FF635120000-0x00007FF635512000-memory.dmp

Filesize
3.9MB

Download
memory/4224-2912-0x00007FF63F350000-0x00007FF63F742000-memory.dmp

Filesize
3.9MB

Download
memory/4224-756-0x00007FF63F350000-0x00007FF63F742000-memory.dmp

Filesize
3.9MB

Download
memory/4400-2851-0x00007FF62EA80000-0x00007FF62EE72000-memory.dmp

Filesize
3.9MB

Download
memory/4400-562-0x00007FF62EA80000-0x00007FF62EE72000-memory.dmp

Filesize
3.9MB

Download
memory/4472-564-0x00007FF616830000-0x00007FF616C22000-memory.dmp

Filesize
3.9MB

Download
memory/4472-2881-0x00007FF616830000-0x00007FF616C22000-memory.dmp

Filesize
3.9MB

Download
memory/4516-561-0x00007FF676EA0000-0x00007FF677292000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2826-0x00007FF676EA0000-0x00007FF677292000-memory.dmp

Filesize
3.9MB

Download
memory/4696-553-0x00007FF656430000-0x00007FF656822000-memory.dmp

Filesize
3.9MB

Download
memory/4696-2845-0x00007FF656430000-0x00007FF656822000-memory.dmp

Filesize
3.9MB

Download
memory/4900-2819-0x00007FF784C60000-0x00007FF785052000-memory.dmp

Filesize
3.9MB

Download
memory/4900-236-0x00007FF784C60000-0x00007FF785052000-memory.dmp

Filesize
3.9MB

Download