xmrig | 783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
Size

1.3MB
MD5

def6ce922d87ad7a078dd2eb71bfd850
SHA1

420280be91ac9b5e2b82fb820c19141220fcd53d
SHA256

783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2
SHA512

1c6eb74af09231e20dfeca2d4793b7217a7c663d2a91614996f48ec6f1093e0c5179acb0d25f94a319630b94a1ea5bc61b79cf1429f551b50c763471001d28e2
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYVfp1cnAfSlWhdbOgU:Lz071uv4BPMkibTIA5VDSl+OgU

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 10236 created 4992	10236	WerFaultSecure.exe	80

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2908-43-0x00007FF6D97A0000-0x00007FF6D9B92000-memory.dmp	xmrig
behavioral2/memory/3864-654-0x00007FF67ED40000-0x00007FF67F132000-memory.dmp	xmrig
behavioral2/memory/4080-658-0x00007FF7033E0000-0x00007FF7037D2000-memory.dmp	xmrig
behavioral2/memory/4792-661-0x00007FF6589A0000-0x00007FF658D92000-memory.dmp	xmrig
behavioral2/memory/2316-665-0x00007FF612980000-0x00007FF612D72000-memory.dmp	xmrig
behavioral2/memory/4344-666-0x00007FF640960000-0x00007FF640D52000-memory.dmp	xmrig
behavioral2/memory/928-664-0x00007FF6DEEC0000-0x00007FF6DF2B2000-memory.dmp	xmrig
behavioral2/memory/2072-662-0x00007FF6F23C0000-0x00007FF6F27B2000-memory.dmp	xmrig
behavioral2/memory/2156-660-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	xmrig
behavioral2/memory/5088-659-0x00007FF7B7630000-0x00007FF7B7A22000-memory.dmp	xmrig
behavioral2/memory/4516-657-0x00007FF664420000-0x00007FF664812000-memory.dmp	xmrig
behavioral2/memory/3960-656-0x00007FF7349A0000-0x00007FF734D92000-memory.dmp	xmrig
behavioral2/memory/4212-655-0x00007FF60C380000-0x00007FF60C772000-memory.dmp	xmrig
behavioral2/memory/4064-653-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp	xmrig
behavioral2/memory/3504-481-0x00007FF69A310000-0x00007FF69A702000-memory.dmp	xmrig
behavioral2/memory/2820-393-0x00007FF708B50000-0x00007FF708F42000-memory.dmp	xmrig
behavioral2/memory/1692-347-0x00007FF6B4D00000-0x00007FF6B50F2000-memory.dmp	xmrig
behavioral2/memory/1108-289-0x00007FF65B840000-0x00007FF65BC32000-memory.dmp	xmrig
behavioral2/memory/1204-240-0x00007FF71F1E0000-0x00007FF71F5D2000-memory.dmp	xmrig
behavioral2/memory/4944-116-0x00007FF6990A0000-0x00007FF699492000-memory.dmp	xmrig
behavioral2/memory/2092-2598-0x00007FF713C20000-0x00007FF714012000-memory.dmp	xmrig
behavioral2/memory/2980-2607-0x00007FF650910000-0x00007FF650D02000-memory.dmp	xmrig
behavioral2/memory/1164-2619-0x00007FF69E0C0000-0x00007FF69E4B2000-memory.dmp	xmrig
behavioral2/memory/2324-2620-0x00007FF684200000-0x00007FF6845F2000-memory.dmp	xmrig
behavioral2/memory/824-2634-0x00007FF740F90000-0x00007FF741382000-memory.dmp	xmrig
behavioral2/memory/2980-2690-0x00007FF650910000-0x00007FF650D02000-memory.dmp	xmrig
behavioral2/memory/2908-2704-0x00007FF6D97A0000-0x00007FF6D9B92000-memory.dmp	xmrig
behavioral2/memory/1164-2715-0x00007FF69E0C0000-0x00007FF69E4B2000-memory.dmp	xmrig
behavioral2/memory/3504-2716-0x00007FF69A310000-0x00007FF69A702000-memory.dmp	xmrig
behavioral2/memory/4944-2720-0x00007FF6990A0000-0x00007FF699492000-memory.dmp	xmrig
behavioral2/memory/1204-2722-0x00007FF71F1E0000-0x00007FF71F5D2000-memory.dmp	xmrig
behavioral2/memory/2324-2724-0x00007FF684200000-0x00007FF6845F2000-memory.dmp	xmrig
behavioral2/memory/928-2718-0x00007FF6DEEC0000-0x00007FF6DF2B2000-memory.dmp	xmrig
behavioral2/memory/5088-2759-0x00007FF7B7630000-0x00007FF7B7A22000-memory.dmp	xmrig
behavioral2/memory/4080-2760-0x00007FF7033E0000-0x00007FF7037D2000-memory.dmp	xmrig
behavioral2/memory/2072-2767-0x00007FF6F23C0000-0x00007FF6F27B2000-memory.dmp	xmrig
behavioral2/memory/1692-2762-0x00007FF6B4D00000-0x00007FF6B50F2000-memory.dmp	xmrig
behavioral2/memory/4792-2757-0x00007FF6589A0000-0x00007FF658D92000-memory.dmp	xmrig
behavioral2/memory/2316-2754-0x00007FF612980000-0x00007FF612D72000-memory.dmp	xmrig
behavioral2/memory/4344-2752-0x00007FF640960000-0x00007FF640D52000-memory.dmp	xmrig
behavioral2/memory/4212-2750-0x00007FF60C380000-0x00007FF60C772000-memory.dmp	xmrig
behavioral2/memory/3960-2765-0x00007FF7349A0000-0x00007FF734D92000-memory.dmp	xmrig
behavioral2/memory/1108-2743-0x00007FF65B840000-0x00007FF65BC32000-memory.dmp	xmrig
behavioral2/memory/824-2742-0x00007FF740F90000-0x00007FF741382000-memory.dmp	xmrig
behavioral2/memory/2156-2738-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	xmrig
behavioral2/memory/4516-2748-0x00007FF664420000-0x00007FF664812000-memory.dmp	xmrig
behavioral2/memory/2820-2740-0x00007FF708B50000-0x00007FF708F42000-memory.dmp	xmrig
behavioral2/memory/3864-2736-0x00007FF67ED40000-0x00007FF67F132000-memory.dmp	xmrig
behavioral2/memory/4064-2775-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3428	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2980	bkyjjbH.exe
1164	getAYNF.exe
928	EkaCbQq.exe
2908	OaRorQM.exe
2324	eyDZUxa.exe
4944	ziAHUxy.exe
824	uAfkCYC.exe
2316	yAnbaDT.exe
1204	VXLgGFU.exe
1108	GtVQloQ.exe
1692	aqwiyZJ.exe
2820	vqJMyUG.exe
3504	KXgDXUu.exe
4344	GPocXbo.exe
4064	oXEdVGf.exe
3864	FRyHXiu.exe
4212	JIXRFva.exe
3960	GxCQGVa.exe
4516	ULHIZlr.exe
4080	rhUmYar.exe
5088	NXqynMB.exe
2156	IRujMaD.exe
4792	tAVYHTR.exe
2072	tSxRZvl.exe
3860	enKBtdq.exe
1348	ECfXYmE.exe
2460	tBKOsHh.exe
800	kldjoAd.exe
2136	IZGxmcb.exe
2904	LSLSROO.exe
2020	FRMkfup.exe
2792	fsvuqWS.exe
3900	vhRrxiP.exe
2232	qZUUASl.exe
4892	hmYYjlO.exe
3012	aWqGZnd.exe
3124	FLIJmyP.exe
2704	WcPXxYz.exe
3788	DcjDzwx.exe
2024	OppUMab.exe
232	DlZYQel.exe
2268	yDiBAub.exe
4616	HxEMxjP.exe
1436	tfrpJSw.exe
1792	GFeRKiK.exe
716	LygMmoh.exe
5096	ZrVKLko.exe
1772	sOYnDff.exe
4556	rZfaQDt.exe
3532	Yxhgbwm.exe
1848	mCwRhCq.exe
2028	UpGKSCc.exe
712	GHrmzfE.exe
2712	XiVvTDI.exe
3108	MUighGH.exe
1696	jEzENNS.exe
3980	MENRjxO.exe
3696	FXejvzt.exe
5032	vTZRLhJ.exe
4732	AqtucIt.exe
3736	tBlDRcT.exe
1628	JKSCHwt.exe
3976	RGKrKgO.exe
3260	RCVdFqH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2092-0-0x00007FF713C20000-0x00007FF714012000-memory.dmp	upx
behavioral2/files/0x0007000000023cc6-17.dat	upx
behavioral2/files/0x0007000000023cca-32.dat	upx
behavioral2/files/0x0008000000023cc2-8.dat	upx
behavioral2/files/0x0007000000023cc7-24.dat	upx
behavioral2/memory/2980-18-0x00007FF650910000-0x00007FF650D02000-memory.dmp	upx
behavioral2/memory/2908-43-0x00007FF6D97A0000-0x00007FF6D9B92000-memory.dmp	upx
behavioral2/files/0x0007000000023cd2-65.dat	upx
behavioral2/files/0x0007000000023cdb-162.dat	upx
behavioral2/memory/3864-654-0x00007FF67ED40000-0x00007FF67F132000-memory.dmp	upx
behavioral2/memory/4080-658-0x00007FF7033E0000-0x00007FF7037D2000-memory.dmp	upx
behavioral2/memory/4792-661-0x00007FF6589A0000-0x00007FF658D92000-memory.dmp	upx
behavioral2/memory/2316-665-0x00007FF612980000-0x00007FF612D72000-memory.dmp	upx
behavioral2/memory/4344-666-0x00007FF640960000-0x00007FF640D52000-memory.dmp	upx
behavioral2/memory/928-664-0x00007FF6DEEC0000-0x00007FF6DF2B2000-memory.dmp	upx
behavioral2/memory/2072-662-0x00007FF6F23C0000-0x00007FF6F27B2000-memory.dmp	upx
behavioral2/memory/2156-660-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp	upx
behavioral2/memory/5088-659-0x00007FF7B7630000-0x00007FF7B7A22000-memory.dmp	upx
behavioral2/memory/4516-657-0x00007FF664420000-0x00007FF664812000-memory.dmp	upx
behavioral2/memory/3960-656-0x00007FF7349A0000-0x00007FF734D92000-memory.dmp	upx
behavioral2/memory/4212-655-0x00007FF60C380000-0x00007FF60C772000-memory.dmp	upx
behavioral2/memory/4064-653-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp	upx
behavioral2/memory/3504-481-0x00007FF69A310000-0x00007FF69A702000-memory.dmp	upx
behavioral2/memory/2820-393-0x00007FF708B50000-0x00007FF708F42000-memory.dmp	upx
behavioral2/memory/1692-347-0x00007FF6B4D00000-0x00007FF6B50F2000-memory.dmp	upx
behavioral2/memory/1108-289-0x00007FF65B840000-0x00007FF65BC32000-memory.dmp	upx
behavioral2/files/0x0007000000023ce9-206.dat	upx
behavioral2/files/0x0007000000023ce8-200.dat	upx
behavioral2/files/0x0007000000023cdf-193.dat	upx
behavioral2/files/0x0007000000023ce0-192.dat	upx
behavioral2/files/0x0007000000023ce7-188.dat	upx
behavioral2/files/0x0007000000023ce6-182.dat	upx
behavioral2/files/0x0007000000023ce5-177.dat	upx
behavioral2/files/0x0007000000023cdd-176.dat	upx
behavioral2/files/0x0007000000023cdc-171.dat	upx
behavioral2/memory/1204-240-0x00007FF71F1E0000-0x00007FF71F5D2000-memory.dmp	upx
behavioral2/files/0x0007000000023cd9-152.dat	upx
behavioral2/files/0x0007000000023cd8-148.dat	upx
behavioral2/files/0x0007000000023cde-133.dat	upx
behavioral2/files/0x0007000000023ce4-173.dat	upx
behavioral2/files/0x0007000000023ccd-131.dat	upx
behavioral2/files/0x0007000000023cd3-130.dat	upx
behavioral2/files/0x0007000000023ce3-127.dat	upx
behavioral2/memory/824-150-0x00007FF740F90000-0x00007FF741382000-memory.dmp	upx
behavioral2/files/0x0007000000023ce2-126.dat	upx
behavioral2/files/0x0007000000023cd7-120.dat	upx
behavioral2/files/0x0007000000023cd5-118.dat	upx
behavioral2/memory/4944-116-0x00007FF6990A0000-0x00007FF699492000-memory.dmp	upx
behavioral2/files/0x0007000000023ccf-115.dat	upx
behavioral2/files/0x0007000000023cda-109.dat	upx
behavioral2/files/0x0007000000023ce1-125.dat	upx
behavioral2/files/0x0007000000023cd0-122.dat	upx
behavioral2/files/0x0007000000023ccc-95.dat	upx
behavioral2/files/0x0007000000023cd6-119.dat	upx
behavioral2/files/0x0007000000023cd4-87.dat	upx
behavioral2/files/0x0007000000023cc8-80.dat	upx
behavioral2/files/0x0007000000023cce-112.dat	upx
behavioral2/memory/2324-76-0x00007FF684200000-0x00007FF6845F2000-memory.dmp	upx
behavioral2/files/0x0007000000023cd1-99.dat	upx
behavioral2/files/0x0007000000023ccb-54.dat	upx
behavioral2/memory/1164-40-0x00007FF69E0C0000-0x00007FF69E4B2000-memory.dmp	upx
behavioral2/files/0x0007000000023cc9-29.dat	upx
behavioral2/memory/2092-2598-0x00007FF713C20000-0x00007FF714012000-memory.dmp	upx
behavioral2/memory/2980-2607-0x00007FF650910000-0x00007FF650D02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\djUZdch.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\oHVNRaj.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\xEHmaEF.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\qnWoqRV.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\vieSvBj.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\enKBtdq.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\CWVIUvI.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\hZCKaqU.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\VVChwlo.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\FbJuEpY.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\LhpARNw.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\uDEEVBE.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\wiLuKWH.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\NpOSfeV.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\ONRitSO.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\JKSCHwt.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\AAMYywS.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\RTnIEGn.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\NUaoosu.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\eQzOzxK.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\HNkOnkG.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\IjCrqqA.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\nvUCicf.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\ylfkDEb.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\pRBgtTz.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\IQmcMoa.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\IGTsYXJ.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\toccEqU.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\YPMGxLW.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\rbvNjKR.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\uNthiZA.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\kjjoxPi.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\CKLmPSa.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\luXHznt.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\SZudveY.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\UNeYyoc.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\QWYyvDI.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\oTthrte.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\nRwQKrK.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\QXvHGYh.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\RfCuZZf.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\PwPpGRt.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\xMMgWKn.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\OTnKnQk.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\WWMqcjT.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\svnSIgh.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\DcjDzwx.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\CNBtbgu.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\eqeeljW.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\XeoDegd.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\UgBygTQ.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\ywPxVlb.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\haFDGDV.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\EKTGAom.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\fjnzNMU.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\uVxacDt.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\DmRTAyP.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\GprqXwb.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\eBLEIKb.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\BRrFBFr.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\mbFDSKu.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\qCIDmvi.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\FXejvzt.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
File created	C:\Windows\System\JlCQQUV.exe	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe
3428	powershell.exe
6960	WerFaultSecure.exe
6960	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
Token: SeLockMemoryPrivilege	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
Token: SeDebugPrivilege	3428	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3428	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	84
PID 2092 wrote to memory of 3428	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	84
PID 2092 wrote to memory of 2980	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	85
PID 2092 wrote to memory of 2980	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	85
PID 2092 wrote to memory of 1164	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	86
PID 2092 wrote to memory of 1164	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	86
PID 2092 wrote to memory of 928	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	87
PID 2092 wrote to memory of 928	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	87
PID 2092 wrote to memory of 1204	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	88
PID 2092 wrote to memory of 1204	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	88
PID 2092 wrote to memory of 2908	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	89
PID 2092 wrote to memory of 2908	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	89
PID 2092 wrote to memory of 2324	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	90
PID 2092 wrote to memory of 2324	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	90
PID 2092 wrote to memory of 4944	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	91
PID 2092 wrote to memory of 4944	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	91
PID 2092 wrote to memory of 824	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	92
PID 2092 wrote to memory of 824	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	92
PID 2092 wrote to memory of 2316	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	93
PID 2092 wrote to memory of 2316	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	93
PID 2092 wrote to memory of 1108	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	94
PID 2092 wrote to memory of 1108	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	94
PID 2092 wrote to memory of 1692	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	95
PID 2092 wrote to memory of 1692	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	95
PID 2092 wrote to memory of 2820	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	96
PID 2092 wrote to memory of 2820	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	96
PID 2092 wrote to memory of 4516	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	97
PID 2092 wrote to memory of 4516	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	97
PID 2092 wrote to memory of 3504	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	98
PID 2092 wrote to memory of 3504	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	98
PID 2092 wrote to memory of 4344	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	99
PID 2092 wrote to memory of 4344	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	99
PID 2092 wrote to memory of 4064	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	100
PID 2092 wrote to memory of 4064	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	100
PID 2092 wrote to memory of 3864	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	101
PID 2092 wrote to memory of 3864	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	101
PID 2092 wrote to memory of 4212	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	102
PID 2092 wrote to memory of 4212	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	102
PID 2092 wrote to memory of 3960	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	103
PID 2092 wrote to memory of 3960	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	103
PID 2092 wrote to memory of 4080	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	104
PID 2092 wrote to memory of 4080	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	104
PID 2092 wrote to memory of 5088	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	105
PID 2092 wrote to memory of 5088	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	105
PID 2092 wrote to memory of 2156	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	106
PID 2092 wrote to memory of 2156	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	106
PID 2092 wrote to memory of 4792	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	107
PID 2092 wrote to memory of 4792	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	107
PID 2092 wrote to memory of 2072	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	108
PID 2092 wrote to memory of 2072	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	108
PID 2092 wrote to memory of 3860	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	109
PID 2092 wrote to memory of 3860	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	109
PID 2092 wrote to memory of 1348	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	110
PID 2092 wrote to memory of 1348	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	110
PID 2092 wrote to memory of 2020	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	111
PID 2092 wrote to memory of 2020	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	111
PID 2092 wrote to memory of 2460	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	112
PID 2092 wrote to memory of 2460	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	112
PID 2092 wrote to memory of 800	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	113
PID 2092 wrote to memory of 800	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	113
PID 2092 wrote to memory of 2136	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	114
PID 2092 wrote to memory of 2136	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	114
PID 2092 wrote to memory of 2904	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	115
PID 2092 wrote to memory of 2904	2092	783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe	115

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4992
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4992 -s 960
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:6960

C:\Users\Admin\AppData\Local\Temp\783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe
"C:\Users\Admin\AppData\Local\Temp\783f04b7d76cd3c56857e2f340e5274a513e516abc2a04679e5438727d2643e2N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3428
- C:\Windows\System\bkyjjbH.exe
  C:\Windows\System\bkyjjbH.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\getAYNF.exe
  C:\Windows\System\getAYNF.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\EkaCbQq.exe
  C:\Windows\System\EkaCbQq.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\VXLgGFU.exe
  C:\Windows\System\VXLgGFU.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\OaRorQM.exe
  C:\Windows\System\OaRorQM.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\eyDZUxa.exe
  C:\Windows\System\eyDZUxa.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\ziAHUxy.exe
  C:\Windows\System\ziAHUxy.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\uAfkCYC.exe
  C:\Windows\System\uAfkCYC.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\yAnbaDT.exe
  C:\Windows\System\yAnbaDT.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\GtVQloQ.exe
  C:\Windows\System\GtVQloQ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\aqwiyZJ.exe
  C:\Windows\System\aqwiyZJ.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\vqJMyUG.exe
  C:\Windows\System\vqJMyUG.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ULHIZlr.exe
  C:\Windows\System\ULHIZlr.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\KXgDXUu.exe
  C:\Windows\System\KXgDXUu.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\GPocXbo.exe
  C:\Windows\System\GPocXbo.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\oXEdVGf.exe
  C:\Windows\System\oXEdVGf.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\FRyHXiu.exe
  C:\Windows\System\FRyHXiu.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\JIXRFva.exe
  C:\Windows\System\JIXRFva.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\GxCQGVa.exe
  C:\Windows\System\GxCQGVa.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\rhUmYar.exe
  C:\Windows\System\rhUmYar.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\NXqynMB.exe
  C:\Windows\System\NXqynMB.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\IRujMaD.exe
  C:\Windows\System\IRujMaD.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\tAVYHTR.exe
  C:\Windows\System\tAVYHTR.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\tSxRZvl.exe
  C:\Windows\System\tSxRZvl.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\enKBtdq.exe
  C:\Windows\System\enKBtdq.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\ECfXYmE.exe
  C:\Windows\System\ECfXYmE.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\FRMkfup.exe
  C:\Windows\System\FRMkfup.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\tBKOsHh.exe
  C:\Windows\System\tBKOsHh.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\kldjoAd.exe
  C:\Windows\System\kldjoAd.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\IZGxmcb.exe
  C:\Windows\System\IZGxmcb.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\LSLSROO.exe
  C:\Windows\System\LSLSROO.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\fsvuqWS.exe
  C:\Windows\System\fsvuqWS.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\vhRrxiP.exe
  C:\Windows\System\vhRrxiP.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\qZUUASl.exe
  C:\Windows\System\qZUUASl.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\hmYYjlO.exe
  C:\Windows\System\hmYYjlO.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\aWqGZnd.exe
  C:\Windows\System\aWqGZnd.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\FLIJmyP.exe
  C:\Windows\System\FLIJmyP.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\WcPXxYz.exe
  C:\Windows\System\WcPXxYz.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\DcjDzwx.exe
  C:\Windows\System\DcjDzwx.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\OppUMab.exe
  C:\Windows\System\OppUMab.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\DlZYQel.exe
  C:\Windows\System\DlZYQel.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\yDiBAub.exe
  C:\Windows\System\yDiBAub.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\HxEMxjP.exe
  C:\Windows\System\HxEMxjP.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\tfrpJSw.exe
  C:\Windows\System\tfrpJSw.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\GFeRKiK.exe
  C:\Windows\System\GFeRKiK.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\LygMmoh.exe
  C:\Windows\System\LygMmoh.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\ZrVKLko.exe
  C:\Windows\System\ZrVKLko.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\sOYnDff.exe
  C:\Windows\System\sOYnDff.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\rZfaQDt.exe
  C:\Windows\System\rZfaQDt.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\Yxhgbwm.exe
  C:\Windows\System\Yxhgbwm.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\mCwRhCq.exe
  C:\Windows\System\mCwRhCq.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\UpGKSCc.exe
  C:\Windows\System\UpGKSCc.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\GHrmzfE.exe
  C:\Windows\System\GHrmzfE.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\XiVvTDI.exe
  C:\Windows\System\XiVvTDI.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\MUighGH.exe
  C:\Windows\System\MUighGH.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\jEzENNS.exe
  C:\Windows\System\jEzENNS.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\MENRjxO.exe
  C:\Windows\System\MENRjxO.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\FXejvzt.exe
  C:\Windows\System\FXejvzt.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\vTZRLhJ.exe
  C:\Windows\System\vTZRLhJ.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\AqtucIt.exe
  C:\Windows\System\AqtucIt.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\UNDKSBd.exe
  C:\Windows\System\UNDKSBd.exe
  2⤵
  PID:4696
- C:\Windows\System\tBlDRcT.exe
  C:\Windows\System\tBlDRcT.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\JKSCHwt.exe
  C:\Windows\System\JKSCHwt.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\RGKrKgO.exe
  C:\Windows\System\RGKrKgO.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\RCVdFqH.exe
  C:\Windows\System\RCVdFqH.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\sYmCIsn.exe
  C:\Windows\System\sYmCIsn.exe
  2⤵
  PID:4308
- C:\Windows\System\bZFLjCv.exe
  C:\Windows\System\bZFLjCv.exe
  2⤵
  PID:2576
- C:\Windows\System\JlSUehl.exe
  C:\Windows\System\JlSUehl.exe
  2⤵
  PID:2000
- C:\Windows\System\BwuyIgr.exe
  C:\Windows\System\BwuyIgr.exe
  2⤵
  PID:1396
- C:\Windows\System\NgBfrUk.exe
  C:\Windows\System\NgBfrUk.exe
  2⤵
  PID:4296
- C:\Windows\System\tQxSXqW.exe
  C:\Windows\System\tQxSXqW.exe
  2⤵
  PID:4584
- C:\Windows\System\toccEqU.exe
  C:\Windows\System\toccEqU.exe
  2⤵
  PID:3256
- C:\Windows\System\HfqTExp.exe
  C:\Windows\System\HfqTExp.exe
  2⤵
  PID:912
- C:\Windows\System\lDsokpc.exe
  C:\Windows\System\lDsokpc.exe
  2⤵
  PID:1644
- C:\Windows\System\cXtTINd.exe
  C:\Windows\System\cXtTINd.exe
  2⤵
  PID:4748
- C:\Windows\System\ZfgTdMg.exe
  C:\Windows\System\ZfgTdMg.exe
  2⤵
  PID:1368
- C:\Windows\System\lgckfPE.exe
  C:\Windows\System\lgckfPE.exe
  2⤵
  PID:4244
- C:\Windows\System\MNeKoOZ.exe
  C:\Windows\System\MNeKoOZ.exe
  2⤵
  PID:1928
- C:\Windows\System\plQrPOh.exe
  C:\Windows\System\plQrPOh.exe
  2⤵
  PID:1688
- C:\Windows\System\LChPzVS.exe
  C:\Windows\System\LChPzVS.exe
  2⤵
  PID:4084
- C:\Windows\System\yrnnMKK.exe
  C:\Windows\System\yrnnMKK.exe
  2⤵
  PID:2336
- C:\Windows\System\fcBuucS.exe
  C:\Windows\System\fcBuucS.exe
  2⤵
  PID:3568
- C:\Windows\System\WdHiROr.exe
  C:\Windows\System\WdHiROr.exe
  2⤵
  PID:2260
- C:\Windows\System\xGPJxhO.exe
  C:\Windows\System\xGPJxhO.exe
  2⤵
  PID:3792
- C:\Windows\System\JVeQLNS.exe
  C:\Windows\System\JVeQLNS.exe
  2⤵
  PID:4000
- C:\Windows\System\XUevmrO.exe
  C:\Windows\System\XUevmrO.exe
  2⤵
  PID:3480
- C:\Windows\System\HcNiSvr.exe
  C:\Windows\System\HcNiSvr.exe
  2⤵
  PID:5052
- C:\Windows\System\yXHEIrK.exe
  C:\Windows\System\yXHEIrK.exe
  2⤵
  PID:3112
- C:\Windows\System\IoNwiNt.exe
  C:\Windows\System\IoNwiNt.exe
  2⤵
  PID:2952
- C:\Windows\System\CmMHEVc.exe
  C:\Windows\System\CmMHEVc.exe
  2⤵
  PID:5124
- C:\Windows\System\yRzEvhF.exe
  C:\Windows\System\yRzEvhF.exe
  2⤵
  PID:5156
- C:\Windows\System\gwJweKt.exe
  C:\Windows\System\gwJweKt.exe
  2⤵
  PID:5172
- C:\Windows\System\THixGEZ.exe
  C:\Windows\System\THixGEZ.exe
  2⤵
  PID:5200
- C:\Windows\System\AwrYDoo.exe
  C:\Windows\System\AwrYDoo.exe
  2⤵
  PID:5232
- C:\Windows\System\mFtLTCL.exe
  C:\Windows\System\mFtLTCL.exe
  2⤵
  PID:5252
- C:\Windows\System\sfMxgGY.exe
  C:\Windows\System\sfMxgGY.exe
  2⤵
  PID:5272
- C:\Windows\System\SPSDCJK.exe
  C:\Windows\System\SPSDCJK.exe
  2⤵
  PID:5296
- C:\Windows\System\YPMGxLW.exe
  C:\Windows\System\YPMGxLW.exe
  2⤵
  PID:5312
- C:\Windows\System\bjuATbr.exe
  C:\Windows\System\bjuATbr.exe
  2⤵
  PID:5332
- C:\Windows\System\vUTLhbo.exe
  C:\Windows\System\vUTLhbo.exe
  2⤵
  PID:5352
- C:\Windows\System\BzyrEiA.exe
  C:\Windows\System\BzyrEiA.exe
  2⤵
  PID:5376
- C:\Windows\System\ohUgvck.exe
  C:\Windows\System\ohUgvck.exe
  2⤵
  PID:5392
- C:\Windows\System\QbIKPIi.exe
  C:\Windows\System\QbIKPIi.exe
  2⤵
  PID:5412
- C:\Windows\System\YWyjqhZ.exe
  C:\Windows\System\YWyjqhZ.exe
  2⤵
  PID:5432
- C:\Windows\System\LOBvWWc.exe
  C:\Windows\System\LOBvWWc.exe
  2⤵
  PID:5456
- C:\Windows\System\yHaKxSV.exe
  C:\Windows\System\yHaKxSV.exe
  2⤵
  PID:5476
- C:\Windows\System\JNFiJfo.exe
  C:\Windows\System\JNFiJfo.exe
  2⤵
  PID:5492
- C:\Windows\System\gqSkVZj.exe
  C:\Windows\System\gqSkVZj.exe
  2⤵
  PID:5508
- C:\Windows\System\JDCLHxb.exe
  C:\Windows\System\JDCLHxb.exe
  2⤵
  PID:5532
- C:\Windows\System\lhKLYse.exe
  C:\Windows\System\lhKLYse.exe
  2⤵
  PID:5548
- C:\Windows\System\yErueXH.exe
  C:\Windows\System\yErueXH.exe
  2⤵
  PID:5568
- C:\Windows\System\YgnNLRs.exe
  C:\Windows\System\YgnNLRs.exe
  2⤵
  PID:5584
- C:\Windows\System\ujCzIPE.exe
  C:\Windows\System\ujCzIPE.exe
  2⤵
  PID:5604
- C:\Windows\System\BpqPsvH.exe
  C:\Windows\System\BpqPsvH.exe
  2⤵
  PID:5624
- C:\Windows\System\pOIenwY.exe
  C:\Windows\System\pOIenwY.exe
  2⤵
  PID:5640
- C:\Windows\System\TZbjidO.exe
  C:\Windows\System\TZbjidO.exe
  2⤵
  PID:5680
- C:\Windows\System\TbUxhED.exe
  C:\Windows\System\TbUxhED.exe
  2⤵
  PID:5732
- C:\Windows\System\AHnycwG.exe
  C:\Windows\System\AHnycwG.exe
  2⤵
  PID:5752
- C:\Windows\System\pZGhMUS.exe
  C:\Windows\System\pZGhMUS.exe
  2⤵
  PID:5768
- C:\Windows\System\DOwdgxs.exe
  C:\Windows\System\DOwdgxs.exe
  2⤵
  PID:5792
- C:\Windows\System\OOczxMr.exe
  C:\Windows\System\OOczxMr.exe
  2⤵
  PID:5808
- C:\Windows\System\sFMfpaI.exe
  C:\Windows\System\sFMfpaI.exe
  2⤵
  PID:5824
- C:\Windows\System\ockSUfz.exe
  C:\Windows\System\ockSUfz.exe
  2⤵
  PID:5888
- C:\Windows\System\biTMnJd.exe
  C:\Windows\System\biTMnJd.exe
  2⤵
  PID:5908
- C:\Windows\System\dIjHETN.exe
  C:\Windows\System\dIjHETN.exe
  2⤵
  PID:5928
- C:\Windows\System\cuKNWuF.exe
  C:\Windows\System\cuKNWuF.exe
  2⤵
  PID:5952
- C:\Windows\System\mbqtoYF.exe
  C:\Windows\System\mbqtoYF.exe
  2⤵
  PID:5988
- C:\Windows\System\uIITNru.exe
  C:\Windows\System\uIITNru.exe
  2⤵
  PID:6024
- C:\Windows\System\ajYOFFV.exe
  C:\Windows\System\ajYOFFV.exe
  2⤵
  PID:6040
- C:\Windows\System\tbCOImI.exe
  C:\Windows\System\tbCOImI.exe
  2⤵
  PID:6088
- C:\Windows\System\DqOarhM.exe
  C:\Windows\System\DqOarhM.exe
  2⤵
  PID:6112
- C:\Windows\System\YHmrMZP.exe
  C:\Windows\System\YHmrMZP.exe
  2⤵
  PID:916
- C:\Windows\System\duEsHvy.exe
  C:\Windows\System\duEsHvy.exe
  2⤵
  PID:2824
- C:\Windows\System\UBjqwkA.exe
  C:\Windows\System\UBjqwkA.exe
  2⤵
  PID:1504
- C:\Windows\System\xZfJboF.exe
  C:\Windows\System\xZfJboF.exe
  2⤵
  PID:352
- C:\Windows\System\JxYuiHP.exe
  C:\Windows\System\JxYuiHP.exe
  2⤵
  PID:1084
- C:\Windows\System\PROyKUR.exe
  C:\Windows\System\PROyKUR.exe
  2⤵
  PID:5132
- C:\Windows\System\dRdiqxF.exe
  C:\Windows\System\dRdiqxF.exe
  2⤵
  PID:4256
- C:\Windows\System\fNAZBIs.exe
  C:\Windows\System\fNAZBIs.exe
  2⤵
  PID:2312
- C:\Windows\System\PLQtRmU.exe
  C:\Windows\System\PLQtRmU.exe
  2⤵
  PID:2936
- C:\Windows\System\qmLhjEl.exe
  C:\Windows\System\qmLhjEl.exe
  2⤵
  PID:4796
- C:\Windows\System\yBthnwH.exe
  C:\Windows\System\yBthnwH.exe
  2⤵
  PID:4676
- C:\Windows\System\fdwJMGT.exe
  C:\Windows\System\fdwJMGT.exe
  2⤵
  PID:4040
- C:\Windows\System\MmNKAyB.exe
  C:\Windows\System\MmNKAyB.exe
  2⤵
  PID:3580
- C:\Windows\System\mkIPmqx.exe
  C:\Windows\System\mkIPmqx.exe
  2⤵
  PID:3908
- C:\Windows\System\SYwgjQf.exe
  C:\Windows\System\SYwgjQf.exe
  2⤵
  PID:5404
- C:\Windows\System\DZTFsFF.exe
  C:\Windows\System\DZTFsFF.exe
  2⤵
  PID:724
- C:\Windows\System\NWqYzcX.exe
  C:\Windows\System\NWqYzcX.exe
  2⤵
  PID:2892
- C:\Windows\System\rvMtvJb.exe
  C:\Windows\System\rvMtvJb.exe
  2⤵
  PID:2956
- C:\Windows\System\GRDDBMz.exe
  C:\Windows\System\GRDDBMz.exe
  2⤵
  PID:5516
- C:\Windows\System\QjuLlDf.exe
  C:\Windows\System\QjuLlDf.exe
  2⤵
  PID:5192
- C:\Windows\System\pqwETlj.exe
  C:\Windows\System\pqwETlj.exe
  2⤵
  PID:4580
- C:\Windows\System\NzXKcCn.exe
  C:\Windows\System\NzXKcCn.exe
  2⤵
  PID:6156
- C:\Windows\System\RyWoQTd.exe
  C:\Windows\System\RyWoQTd.exe
  2⤵
  PID:6176
- C:\Windows\System\AlnOqfc.exe
  C:\Windows\System\AlnOqfc.exe
  2⤵
  PID:6204
- C:\Windows\System\npkFaZG.exe
  C:\Windows\System\npkFaZG.exe
  2⤵
  PID:6224
- C:\Windows\System\fuSFnXx.exe
  C:\Windows\System\fuSFnXx.exe
  2⤵
  PID:6240
- C:\Windows\System\eSdCVkz.exe
  C:\Windows\System\eSdCVkz.exe
  2⤵
  PID:6288
- C:\Windows\System\wxzfuCu.exe
  C:\Windows\System\wxzfuCu.exe
  2⤵
  PID:6308
- C:\Windows\System\JzDupYh.exe
  C:\Windows\System\JzDupYh.exe
  2⤵
  PID:6324
- C:\Windows\System\cOTPkhj.exe
  C:\Windows\System\cOTPkhj.exe
  2⤵
  PID:6348
- C:\Windows\System\PauIEeo.exe
  C:\Windows\System\PauIEeo.exe
  2⤵
  PID:6368
- C:\Windows\System\GteSuYX.exe
  C:\Windows\System\GteSuYX.exe
  2⤵
  PID:6396
- C:\Windows\System\zxhMdwZ.exe
  C:\Windows\System\zxhMdwZ.exe
  2⤵
  PID:6452
- C:\Windows\System\qTxzVIN.exe
  C:\Windows\System\qTxzVIN.exe
  2⤵
  PID:6472
- C:\Windows\System\QkIgiQo.exe
  C:\Windows\System\QkIgiQo.exe
  2⤵
  PID:6492
- C:\Windows\System\kaJAIQu.exe
  C:\Windows\System\kaJAIQu.exe
  2⤵
  PID:6516
- C:\Windows\System\GnEAnHE.exe
  C:\Windows\System\GnEAnHE.exe
  2⤵
  PID:6556
- C:\Windows\System\LgVSJPx.exe
  C:\Windows\System\LgVSJPx.exe
  2⤵
  PID:6588
- C:\Windows\System\OkcVwxI.exe
  C:\Windows\System\OkcVwxI.exe
  2⤵
  PID:6608
- C:\Windows\System\hFxdUte.exe
  C:\Windows\System\hFxdUte.exe
  2⤵
  PID:6660
- C:\Windows\System\RfCuZZf.exe
  C:\Windows\System\RfCuZZf.exe
  2⤵
  PID:6680
- C:\Windows\System\VRYsTMs.exe
  C:\Windows\System\VRYsTMs.exe
  2⤵
  PID:6700
- C:\Windows\System\PuVKbww.exe
  C:\Windows\System\PuVKbww.exe
  2⤵
  PID:6720
- C:\Windows\System\VYxvNKJ.exe
  C:\Windows\System\VYxvNKJ.exe
  2⤵
  PID:6744
- C:\Windows\System\pavpumN.exe
  C:\Windows\System\pavpumN.exe
  2⤵
  PID:6760
- C:\Windows\System\wHtdsEC.exe
  C:\Windows\System\wHtdsEC.exe
  2⤵
  PID:6780
- C:\Windows\System\eJApcgr.exe
  C:\Windows\System\eJApcgr.exe
  2⤵
  PID:6804
- C:\Windows\System\cmrspBW.exe
  C:\Windows\System\cmrspBW.exe
  2⤵
  PID:6824
- C:\Windows\System\htpwGFq.exe
  C:\Windows\System\htpwGFq.exe
  2⤵
  PID:6844
- C:\Windows\System\RMvCaTT.exe
  C:\Windows\System\RMvCaTT.exe
  2⤵
  PID:6864
- C:\Windows\System\lQaYZhy.exe
  C:\Windows\System\lQaYZhy.exe
  2⤵
  PID:6884
- C:\Windows\System\exvLobc.exe
  C:\Windows\System\exvLobc.exe
  2⤵
  PID:6900
- C:\Windows\System\sdfZipp.exe
  C:\Windows\System\sdfZipp.exe
  2⤵
  PID:6916
- C:\Windows\System\GPfxPbd.exe
  C:\Windows\System\GPfxPbd.exe
  2⤵
  PID:6936
- C:\Windows\System\bfAKmkP.exe
  C:\Windows\System\bfAKmkP.exe
  2⤵
  PID:6952
- C:\Windows\System\fXitRsw.exe
  C:\Windows\System\fXitRsw.exe
  2⤵
  PID:6976
- C:\Windows\System\SZudveY.exe
  C:\Windows\System\SZudveY.exe
  2⤵
  PID:6996
- C:\Windows\System\kDCuVzR.exe
  C:\Windows\System\kDCuVzR.exe
  2⤵
  PID:7016
- C:\Windows\System\mabyoFV.exe
  C:\Windows\System\mabyoFV.exe
  2⤵
  PID:7032
- C:\Windows\System\pTqvGpP.exe
  C:\Windows\System\pTqvGpP.exe
  2⤵
  PID:7060
- C:\Windows\System\hiAlYId.exe
  C:\Windows\System\hiAlYId.exe
  2⤵
  PID:7076
- C:\Windows\System\VaLcidF.exe
  C:\Windows\System\VaLcidF.exe
  2⤵
  PID:7104
- C:\Windows\System\rurcjvW.exe
  C:\Windows\System\rurcjvW.exe
  2⤵
  PID:7120
- C:\Windows\System\tvurlsl.exe
  C:\Windows\System\tvurlsl.exe
  2⤵
  PID:7140
- C:\Windows\System\trdqneX.exe
  C:\Windows\System\trdqneX.exe
  2⤵
  PID:7164
- C:\Windows\System\OsFNSVq.exe
  C:\Windows\System\OsFNSVq.exe
  2⤵
  PID:6032
- C:\Windows\System\rYWndUj.exe
  C:\Windows\System\rYWndUj.exe
  2⤵
  PID:540
- C:\Windows\System\xxUXVLB.exe
  C:\Windows\System\xxUXVLB.exe
  2⤵
  PID:1572
- C:\Windows\System\qDWhjaF.exe
  C:\Windows\System\qDWhjaF.exe
  2⤵
  PID:2628
- C:\Windows\System\PVClWkH.exe
  C:\Windows\System\PVClWkH.exe
  2⤵
  PID:5148
- C:\Windows\System\qwISXvC.exe
  C:\Windows\System\qwISXvC.exe
  2⤵
  PID:5184
- C:\Windows\System\TkdGFeo.exe
  C:\Windows\System\TkdGFeo.exe
  2⤵
  PID:5260
- C:\Windows\System\gFcXeLO.exe
  C:\Windows\System\gFcXeLO.exe
  2⤵
  PID:5308
- C:\Windows\System\NYdMTIi.exe
  C:\Windows\System\NYdMTIi.exe
  2⤵
  PID:2216
- C:\Windows\System\DMvEiyG.exe
  C:\Windows\System\DMvEiyG.exe
  2⤵
  PID:4596
- C:\Windows\System\YIQrGJM.exe
  C:\Windows\System\YIQrGJM.exe
  2⤵
  PID:1276
- C:\Windows\System\NreHZLp.exe
  C:\Windows\System\NreHZLp.exe
  2⤵
  PID:3044
- C:\Windows\System\aANiZMh.exe
  C:\Windows\System\aANiZMh.exe
  2⤵
  PID:3964
- C:\Windows\System\GcaULuk.exe
  C:\Windows\System\GcaULuk.exe
  2⤵
  PID:5408
- C:\Windows\System\Eipqtbr.exe
  C:\Windows\System\Eipqtbr.exe
  2⤵
  PID:2968
- C:\Windows\System\RpyfewO.exe
  C:\Windows\System\RpyfewO.exe
  2⤵
  PID:5340
- C:\Windows\System\ZmwHZfB.exe
  C:\Windows\System\ZmwHZfB.exe
  2⤵
  PID:5948
- C:\Windows\System\MMrHRli.exe
  C:\Windows\System\MMrHRli.exe
  2⤵
  PID:6172
- C:\Windows\System\oMSxOYV.exe
  C:\Windows\System\oMSxOYV.exe
  2⤵
  PID:6192
- C:\Windows\System\whSOAVx.exe
  C:\Windows\System\whSOAVx.exe
  2⤵
  PID:6232
- C:\Windows\System\NtGcrsS.exe
  C:\Windows\System\NtGcrsS.exe
  2⤵
  PID:5528
- C:\Windows\System\VvPjLgG.exe
  C:\Windows\System\VvPjLgG.exe
  2⤵
  PID:5576
- C:\Windows\System\oWdqAfQ.exe
  C:\Windows\System\oWdqAfQ.exe
  2⤵
  PID:5632
- C:\Windows\System\wqryiJS.exe
  C:\Windows\System\wqryiJS.exe
  2⤵
  PID:6316
- C:\Windows\System\cyHKkFN.exe
  C:\Windows\System\cyHKkFN.exe
  2⤵
  PID:6360
- C:\Windows\System\YPuPYls.exe
  C:\Windows\System\YPuPYls.exe
  2⤵
  PID:6408
- C:\Windows\System\ptFDboU.exe
  C:\Windows\System\ptFDboU.exe
  2⤵
  PID:5692
- C:\Windows\System\AAMYywS.exe
  C:\Windows\System\AAMYywS.exe
  2⤵
  PID:7176
- C:\Windows\System\ZxMOwSP.exe
  C:\Windows\System\ZxMOwSP.exe
  2⤵
  PID:7196
- C:\Windows\System\oyLRiEW.exe
  C:\Windows\System\oyLRiEW.exe
  2⤵
  PID:7212
- C:\Windows\System\uTcFkQc.exe
  C:\Windows\System\uTcFkQc.exe
  2⤵
  PID:7404
- C:\Windows\System\PwPpGRt.exe
  C:\Windows\System\PwPpGRt.exe
  2⤵
  PID:7420
- C:\Windows\System\XozUyFH.exe
  C:\Windows\System\XozUyFH.exe
  2⤵
  PID:7436
- C:\Windows\System\sLpIesp.exe
  C:\Windows\System\sLpIesp.exe
  2⤵
  PID:7452
- C:\Windows\System\LPDOetP.exe
  C:\Windows\System\LPDOetP.exe
  2⤵
  PID:7468
- C:\Windows\System\qRtiYbS.exe
  C:\Windows\System\qRtiYbS.exe
  2⤵
  PID:7488
- C:\Windows\System\mCFtlNt.exe
  C:\Windows\System\mCFtlNt.exe
  2⤵
  PID:7508
- C:\Windows\System\vlRRHCz.exe
  C:\Windows\System\vlRRHCz.exe
  2⤵
  PID:7528
- C:\Windows\System\VmDCCCT.exe
  C:\Windows\System\VmDCCCT.exe
  2⤵
  PID:7544
- C:\Windows\System\JnGEzxD.exe
  C:\Windows\System\JnGEzxD.exe
  2⤵
  PID:7564
- C:\Windows\System\uMAZaRp.exe
  C:\Windows\System\uMAZaRp.exe
  2⤵
  PID:7584
- C:\Windows\System\nDjwvFZ.exe
  C:\Windows\System\nDjwvFZ.exe
  2⤵
  PID:7604
- C:\Windows\System\AODXeLE.exe
  C:\Windows\System\AODXeLE.exe
  2⤵
  PID:7624
- C:\Windows\System\flSbwdL.exe
  C:\Windows\System\flSbwdL.exe
  2⤵
  PID:7640
- C:\Windows\System\ZvouGyi.exe
  C:\Windows\System\ZvouGyi.exe
  2⤵
  PID:7664
- C:\Windows\System\heNHLrA.exe
  C:\Windows\System\heNHLrA.exe
  2⤵
  PID:7680
- C:\Windows\System\kbAkiAY.exe
  C:\Windows\System\kbAkiAY.exe
  2⤵
  PID:7704
- C:\Windows\System\iTidgiY.exe
  C:\Windows\System\iTidgiY.exe
  2⤵
  PID:7720
- C:\Windows\System\wJddqhS.exe
  C:\Windows\System\wJddqhS.exe
  2⤵
  PID:7740
- C:\Windows\System\AbgeoXk.exe
  C:\Windows\System\AbgeoXk.exe
  2⤵
  PID:7756
- C:\Windows\System\OcDAJOL.exe
  C:\Windows\System\OcDAJOL.exe
  2⤵
  PID:7776
- C:\Windows\System\KMBFnLr.exe
  C:\Windows\System\KMBFnLr.exe
  2⤵
  PID:7792
- C:\Windows\System\muOvjXu.exe
  C:\Windows\System\muOvjXu.exe
  2⤵
  PID:7808
- C:\Windows\System\gKZtfkO.exe
  C:\Windows\System\gKZtfkO.exe
  2⤵
  PID:5900
- C:\Windows\System\nCllBEa.exe
  C:\Windows\System\nCllBEa.exe
  2⤵
  PID:5860
- C:\Windows\System\HfZKIxQ.exe
  C:\Windows\System\HfZKIxQ.exe
  2⤵
  PID:5820
- C:\Windows\System\zbXmpJp.exe
  C:\Windows\System\zbXmpJp.exe
  2⤵
  PID:5788
- C:\Windows\System\zEZMskv.exe
  C:\Windows\System\zEZMskv.exe
  2⤵
  PID:5760
- C:\Windows\System\oGaJxWo.exe
  C:\Windows\System\oGaJxWo.exe
  2⤵
  PID:4868
- C:\Windows\System\UNeYyoc.exe
  C:\Windows\System\UNeYyoc.exe
  2⤵
  PID:3596
- C:\Windows\System\koyAfaQ.exe
  C:\Windows\System\koyAfaQ.exe
  2⤵
  PID:2552
- C:\Windows\System\qmOzRmY.exe
  C:\Windows\System\qmOzRmY.exe
  2⤵
  PID:6340
- C:\Windows\System\gCfRLhi.exe
  C:\Windows\System\gCfRLhi.exe
  2⤵
  PID:6620
- C:\Windows\System\CNBtbgu.exe
  C:\Windows\System\CNBtbgu.exe
  2⤵
  PID:6672
- C:\Windows\System\xzIDUdh.exe
  C:\Windows\System\xzIDUdh.exe
  2⤵
  PID:6796
- C:\Windows\System\kBBJkFz.exe
  C:\Windows\System\kBBJkFz.exe
  2⤵
  PID:6960
- C:\Windows\System\HfhlPuU.exe
  C:\Windows\System\HfhlPuU.exe
  2⤵
  PID:5520
- C:\Windows\System\BaKLrvg.exe
  C:\Windows\System\BaKLrvg.exe
  2⤵
  PID:5360
- C:\Windows\System\hEabjsX.exe
  C:\Windows\System\hEabjsX.exe
  2⤵
  PID:1556
- C:\Windows\System\AvqHbMv.exe
  C:\Windows\System\AvqHbMv.exe
  2⤵
  PID:6836
- C:\Windows\System\AnfnBuQ.exe
  C:\Windows\System\AnfnBuQ.exe
  2⤵
  PID:6892
- C:\Windows\System\wbwhIGK.exe
  C:\Windows\System\wbwhIGK.exe
  2⤵
  PID:6964
- C:\Windows\System\hzMsdzj.exe
  C:\Windows\System\hzMsdzj.exe
  2⤵
  PID:7008
- C:\Windows\System\jGBafxk.exe
  C:\Windows\System\jGBafxk.exe
  2⤵
  PID:7052
- C:\Windows\System\NVURNmX.exe
  C:\Windows\System\NVURNmX.exe
  2⤵
  PID:7136
- C:\Windows\System\skeewdw.exe
  C:\Windows\System\skeewdw.exe
  2⤵
  PID:1352
- C:\Windows\System\JzvllWQ.exe
  C:\Windows\System\JzvllWQ.exe
  2⤵
  PID:5244
- C:\Windows\System\IVCiirB.exe
  C:\Windows\System\IVCiirB.exe
  2⤵
  PID:5920
- C:\Windows\System\rzVJuYl.exe
  C:\Windows\System\rzVJuYl.exe
  2⤵
  PID:2644
- C:\Windows\System\kuayeFP.exe
  C:\Windows\System\kuayeFP.exe
  2⤵
  PID:4228
- C:\Windows\System\lVqivUy.exe
  C:\Windows\System\lVqivUy.exe
  2⤵
  PID:4496
- C:\Windows\System\RrUfSDH.exe
  C:\Windows\System\RrUfSDH.exe
  2⤵
  PID:4900
- C:\Windows\System\kkPVHRN.exe
  C:\Windows\System\kkPVHRN.exe
  2⤵
  PID:6004
- C:\Windows\System\REDKRBf.exe
  C:\Windows\System\REDKRBf.exe
  2⤵
  PID:6488
- C:\Windows\System\FaBZbCs.exe
  C:\Windows\System\FaBZbCs.exe
  2⤵
  PID:6540
- C:\Windows\System\zdaolAD.exe
  C:\Windows\System\zdaolAD.exe
  2⤵
  PID:6580
- C:\Windows\System\IjCrqqA.exe
  C:\Windows\System\IjCrqqA.exe
  2⤵
  PID:6652
- C:\Windows\System\BcuTQKT.exe
  C:\Windows\System\BcuTQKT.exe
  2⤵
  PID:6752
- C:\Windows\System\yufFrFt.exe
  C:\Windows\System\yufFrFt.exe
  2⤵
  PID:6792
- C:\Windows\System\RTnIEGn.exe
  C:\Windows\System\RTnIEGn.exe
  2⤵
  PID:7092
- C:\Windows\System\drAfBVr.exe
  C:\Windows\System\drAfBVr.exe
  2⤵
  PID:4740
- C:\Windows\System\guHQJsg.exe
  C:\Windows\System\guHQJsg.exe
  2⤵
  PID:7412
- C:\Windows\System\CWVIUvI.exe
  C:\Windows\System\CWVIUvI.exe
  2⤵
  PID:7536
- C:\Windows\System\KqJeQQs.exe
  C:\Windows\System\KqJeQQs.exe
  2⤵
  PID:7616
- C:\Windows\System\flxSabG.exe
  C:\Windows\System\flxSabG.exe
  2⤵
  PID:7732
- C:\Windows\System\JCEZtfj.exe
  C:\Windows\System\JCEZtfj.exe
  2⤵
  PID:7804
- C:\Windows\System\KyXnVxk.exe
  C:\Windows\System\KyXnVxk.exe
  2⤵
  PID:8208
- C:\Windows\System\DcpvgSF.exe
  C:\Windows\System\DcpvgSF.exe
  2⤵
  PID:8232
- C:\Windows\System\JiogBnj.exe
  C:\Windows\System\JiogBnj.exe
  2⤵
  PID:8248
- C:\Windows\System\zoJOLud.exe
  C:\Windows\System\zoJOLud.exe
  2⤵
  PID:8272
- C:\Windows\System\YuBUTka.exe
  C:\Windows\System\YuBUTka.exe
  2⤵
  PID:8288
- C:\Windows\System\OaTvNDm.exe
  C:\Windows\System\OaTvNDm.exe
  2⤵
  PID:8312
- C:\Windows\System\rbvNjKR.exe
  C:\Windows\System\rbvNjKR.exe
  2⤵
  PID:8328
- C:\Windows\System\hZCKaqU.exe
  C:\Windows\System\hZCKaqU.exe
  2⤵
  PID:8352
- C:\Windows\System\pDPxNRX.exe
  C:\Windows\System\pDPxNRX.exe
  2⤵
  PID:8372
- C:\Windows\System\fWlKRLk.exe
  C:\Windows\System\fWlKRLk.exe
  2⤵
  PID:8392
- C:\Windows\System\qKteAUK.exe
  C:\Windows\System\qKteAUK.exe
  2⤵
  PID:8416
- C:\Windows\System\LlyDpHY.exe
  C:\Windows\System\LlyDpHY.exe
  2⤵
  PID:8432
- C:\Windows\System\lUEetMY.exe
  C:\Windows\System\lUEetMY.exe
  2⤵
  PID:8456
- C:\Windows\System\tPQceth.exe
  C:\Windows\System\tPQceth.exe
  2⤵
  PID:8472
- C:\Windows\System\KNbmaOi.exe
  C:\Windows\System\KNbmaOi.exe
  2⤵
  PID:8504
- C:\Windows\System\mvEdzjQ.exe
  C:\Windows\System\mvEdzjQ.exe
  2⤵
  PID:8524
- C:\Windows\System\AWQally.exe
  C:\Windows\System\AWQally.exe
  2⤵
  PID:8548
- C:\Windows\System\DMTXTZk.exe
  C:\Windows\System\DMTXTZk.exe
  2⤵
  PID:8564
- C:\Windows\System\dVgdsSs.exe
  C:\Windows\System\dVgdsSs.exe
  2⤵
  PID:8588
- C:\Windows\System\VoBEvTV.exe
  C:\Windows\System\VoBEvTV.exe
  2⤵
  PID:8604
- C:\Windows\System\JglgXIN.exe
  C:\Windows\System\JglgXIN.exe
  2⤵
  PID:8628
- C:\Windows\System\ayiCCTd.exe
  C:\Windows\System\ayiCCTd.exe
  2⤵
  PID:8656
- C:\Windows\System\kZnjrGQ.exe
  C:\Windows\System\kZnjrGQ.exe
  2⤵
  PID:8672
- C:\Windows\System\nvUCicf.exe
  C:\Windows\System\nvUCicf.exe
  2⤵
  PID:8692
- C:\Windows\System\gnRYorF.exe
  C:\Windows\System\gnRYorF.exe
  2⤵
  PID:8708
- C:\Windows\System\QgKVsof.exe
  C:\Windows\System\QgKVsof.exe
  2⤵
  PID:8732
- C:\Windows\System\hDOCJQi.exe
  C:\Windows\System\hDOCJQi.exe
  2⤵
  PID:8752
- C:\Windows\System\pxOdTTw.exe
  C:\Windows\System\pxOdTTw.exe
  2⤵
  PID:8776
- C:\Windows\System\OAyRrbc.exe
  C:\Windows\System\OAyRrbc.exe
  2⤵
  PID:8796
- C:\Windows\System\nncAfoq.exe
  C:\Windows\System\nncAfoq.exe
  2⤵
  PID:8812
- C:\Windows\System\MdDpAVf.exe
  C:\Windows\System\MdDpAVf.exe
  2⤵
  PID:8836
- C:\Windows\System\GjRDEOv.exe
  C:\Windows\System\GjRDEOv.exe
  2⤵
  PID:8856
- C:\Windows\System\EzEzRkZ.exe
  C:\Windows\System\EzEzRkZ.exe
  2⤵
  PID:8876
- C:\Windows\System\wlnWATq.exe
  C:\Windows\System\wlnWATq.exe
  2⤵
  PID:8900
- C:\Windows\System\RovbeCt.exe
  C:\Windows\System\RovbeCt.exe
  2⤵
  PID:8920
- C:\Windows\System\QNlFKbu.exe
  C:\Windows\System\QNlFKbu.exe
  2⤵
  PID:8948
- C:\Windows\System\nReuRgW.exe
  C:\Windows\System\nReuRgW.exe
  2⤵
  PID:8964
- C:\Windows\System\LLVNDPl.exe
  C:\Windows\System\LLVNDPl.exe
  2⤵
  PID:8988
- C:\Windows\System\qnRLLRg.exe
  C:\Windows\System\qnRLLRg.exe
  2⤵
  PID:9004
- C:\Windows\System\UiQCMtI.exe
  C:\Windows\System\UiQCMtI.exe
  2⤵
  PID:9028
- C:\Windows\System\arZjfEc.exe
  C:\Windows\System\arZjfEc.exe
  2⤵
  PID:9044
- C:\Windows\System\mqgYZJw.exe
  C:\Windows\System\mqgYZJw.exe
  2⤵
  PID:9068
- C:\Windows\System\ERRWWXr.exe
  C:\Windows\System\ERRWWXr.exe
  2⤵
  PID:9092
- C:\Windows\System\QWYyvDI.exe
  C:\Windows\System\QWYyvDI.exe
  2⤵
  PID:9116
- C:\Windows\System\aYsXjcB.exe
  C:\Windows\System\aYsXjcB.exe
  2⤵
  PID:9140
- C:\Windows\System\mTQxcqG.exe
  C:\Windows\System\mTQxcqG.exe
  2⤵
  PID:9160
- C:\Windows\System\AxnBdbL.exe
  C:\Windows\System\AxnBdbL.exe
  2⤵
  PID:7356
- C:\Windows\System\WuOQHTG.exe
  C:\Windows\System\WuOQHTG.exe
  2⤵
  PID:7484
- C:\Windows\System\ipfvUEU.exe
  C:\Windows\System\ipfvUEU.exe
  2⤵
  PID:7552
- C:\Windows\System\FklyUqK.exe
  C:\Windows\System\FklyUqK.exe
  2⤵
  PID:7620
- C:\Windows\System\vXbGyjk.exe
  C:\Windows\System\vXbGyjk.exe
  2⤵
  PID:7692
- C:\Windows\System\GJyjNGo.exe
  C:\Windows\System\GJyjNGo.exe
  2⤵
  PID:5880
- C:\Windows\System\jNIbwZk.exe
  C:\Windows\System\jNIbwZk.exe
  2⤵
  PID:6988
- C:\Windows\System\tLDCyit.exe
  C:\Windows\System\tLDCyit.exe
  2⤵
  PID:9256
- C:\Windows\System\ZdMBiYc.exe
  C:\Windows\System\ZdMBiYc.exe
  2⤵
  PID:9272
- C:\Windows\System\tGpvTXT.exe
  C:\Windows\System\tGpvTXT.exe
  2⤵
  PID:9288
- C:\Windows\System\dfpyuLi.exe
  C:\Windows\System\dfpyuLi.exe
  2⤵
  PID:9304
- C:\Windows\System\YpdxdsZ.exe
  C:\Windows\System\YpdxdsZ.exe
  2⤵
  PID:9320
- C:\Windows\System\AIienIY.exe
  C:\Windows\System\AIienIY.exe
  2⤵
  PID:9340
- C:\Windows\System\xkoqwOd.exe
  C:\Windows\System\xkoqwOd.exe
  2⤵
  PID:9360
- C:\Windows\System\CqnLyEb.exe
  C:\Windows\System\CqnLyEb.exe
  2⤵
  PID:9388
- C:\Windows\System\pnGelwi.exe
  C:\Windows\System\pnGelwi.exe
  2⤵
  PID:9408
- C:\Windows\System\RBUliAX.exe
  C:\Windows\System\RBUliAX.exe
  2⤵
  PID:9428
- C:\Windows\System\vXWVkem.exe
  C:\Windows\System\vXWVkem.exe
  2⤵
  PID:9452
- C:\Windows\System\DElXkLC.exe
  C:\Windows\System\DElXkLC.exe
  2⤵
  PID:9472
- C:\Windows\System\pXqGucv.exe
  C:\Windows\System\pXqGucv.exe
  2⤵
  PID:9492
- C:\Windows\System\bRWaxph.exe
  C:\Windows\System\bRWaxph.exe
  2⤵
  PID:9520
- C:\Windows\System\tMigOcQ.exe
  C:\Windows\System\tMigOcQ.exe
  2⤵
  PID:9540
- C:\Windows\System\ZRRexXi.exe
  C:\Windows\System\ZRRexXi.exe
  2⤵
  PID:9564
- C:\Windows\System\qxsyCZO.exe
  C:\Windows\System\qxsyCZO.exe
  2⤵
  PID:9584
- C:\Windows\System\eVlVLcD.exe
  C:\Windows\System\eVlVLcD.exe
  2⤵
  PID:9604
- C:\Windows\System\kSCbOHv.exe
  C:\Windows\System\kSCbOHv.exe
  2⤵
  PID:9620
- C:\Windows\System\sffOCjE.exe
  C:\Windows\System\sffOCjE.exe
  2⤵
  PID:9692
- C:\Windows\System\lzoQTRg.exe
  C:\Windows\System\lzoQTRg.exe
  2⤵
  PID:9708
- C:\Windows\System\veQlXpi.exe
  C:\Windows\System\veQlXpi.exe
  2⤵
  PID:9724
- C:\Windows\System\LBJACQW.exe
  C:\Windows\System\LBJACQW.exe
  2⤵
  PID:9740
- C:\Windows\System\AlzGYLw.exe
  C:\Windows\System\AlzGYLw.exe
  2⤵
  PID:9760
- C:\Windows\System\ipWmrSq.exe
  C:\Windows\System\ipWmrSq.exe
  2⤵
  PID:9784
- C:\Windows\System\pckherN.exe
  C:\Windows\System\pckherN.exe
  2⤵
  PID:9800
- C:\Windows\System\SmaZLhK.exe
  C:\Windows\System\SmaZLhK.exe
  2⤵
  PID:9836
- C:\Windows\System\JlCQQUV.exe
  C:\Windows\System\JlCQQUV.exe
  2⤵
  PID:9860
- C:\Windows\System\NUaoosu.exe
  C:\Windows\System\NUaoosu.exe
  2⤵
  PID:9880
- C:\Windows\System\MRxFviE.exe
  C:\Windows\System\MRxFviE.exe
  2⤵
  PID:9900
- C:\Windows\System\JVGYDCi.exe
  C:\Windows\System\JVGYDCi.exe
  2⤵
  PID:9920
- C:\Windows\System\LkQdltm.exe
  C:\Windows\System\LkQdltm.exe
  2⤵
  PID:9944
- C:\Windows\System\djUZdch.exe
  C:\Windows\System\djUZdch.exe
  2⤵
  PID:9964
- C:\Windows\System\eqeeljW.exe
  C:\Windows\System\eqeeljW.exe
  2⤵
  PID:9984
- C:\Windows\System\viTKFTM.exe
  C:\Windows\System\viTKFTM.exe
  2⤵
  PID:10008
- C:\Windows\System\xlCfafO.exe
  C:\Windows\System\xlCfafO.exe
  2⤵
  PID:10024
- C:\Windows\System\zwMJKct.exe
  C:\Windows\System\zwMJKct.exe
  2⤵
  PID:10052
- C:\Windows\System\uzvLbru.exe
  C:\Windows\System\uzvLbru.exe
  2⤵
  PID:10076
- C:\Windows\System\KVhjbAX.exe
  C:\Windows\System\KVhjbAX.exe
  2⤵
  PID:10092
- C:\Windows\System\oTthrte.exe
  C:\Windows\System\oTthrte.exe
  2⤵
  PID:10116
- C:\Windows\System\YwMmrcI.exe
  C:\Windows\System\YwMmrcI.exe
  2⤵
  PID:10136
- C:\Windows\System\tcsCkjw.exe
  C:\Windows\System\tcsCkjw.exe
  2⤵
  PID:10152
- C:\Windows\System\ePBdaBd.exe
  C:\Windows\System\ePBdaBd.exe
  2⤵
  PID:10172
- C:\Windows\System\tgAsimQ.exe
  C:\Windows\System\tgAsimQ.exe
  2⤵
  PID:10200
- C:\Windows\System\YQCvRJD.exe
  C:\Windows\System\YQCvRJD.exe
  2⤵
  PID:10220
- C:\Windows\System\WkxEPPU.exe
  C:\Windows\System\WkxEPPU.exe
  2⤵
  PID:7024
- C:\Windows\System\hYVqQyd.exe
  C:\Windows\System\hYVqQyd.exe
  2⤵
  PID:5468
- C:\Windows\System\kRiHQGq.exe
  C:\Windows\System\kRiHQGq.exe
  2⤵
  PID:6548
- C:\Windows\System\nvjClJW.exe
  C:\Windows\System\nvjClJW.exe
  2⤵
  PID:7088
- C:\Windows\System\BbcrVyo.exe
  C:\Windows\System\BbcrVyo.exe
  2⤵
  PID:8108
- C:\Windows\System\ydYbgho.exe
  C:\Windows\System\ydYbgho.exe
  2⤵
  PID:8532
- C:\Windows\System\IDdrUju.exe
  C:\Windows\System\IDdrUju.exe
  2⤵
  PID:8612
- C:\Windows\System\AVWKICi.exe
  C:\Windows\System\AVWKICi.exe
  2⤵
  PID:8688
- C:\Windows\System\HkxLjVO.exe
  C:\Windows\System\HkxLjVO.exe
  2⤵
  PID:8740
- C:\Windows\System\tRPchDf.exe
  C:\Windows\System\tRPchDf.exe
  2⤵
  PID:8832
- C:\Windows\System\HfphVbo.exe
  C:\Windows\System\HfphVbo.exe
  2⤵
  PID:8916
- C:\Windows\System\CudmhMr.exe
  C:\Windows\System\CudmhMr.exe
  2⤵
  PID:9124
- C:\Windows\System\xQffIuq.exe
  C:\Windows\System\xQffIuq.exe
  2⤵
  PID:9172
- C:\Windows\System\uNthiZA.exe
  C:\Windows\System\uNthiZA.exe
  2⤵
  PID:7896
- C:\Windows\System\MKNKcOO.exe
  C:\Windows\System\MKNKcOO.exe
  2⤵
  PID:7932
- C:\Windows\System\tbSVwlg.exe
  C:\Windows\System\tbSVwlg.exe
  2⤵
  PID:7972
- C:\Windows\System\QoIKqug.exe
  C:\Windows\System\QoIKqug.exe
  2⤵
  PID:8000
- C:\Windows\System\NxbCsXy.exe
  C:\Windows\System\NxbCsXy.exe
  2⤵
  PID:6248
- C:\Windows\System\ZysfuIe.exe
  C:\Windows\System\ZysfuIe.exe
  2⤵
  PID:6384
- C:\Windows\System\VmHWDGe.exe
  C:\Windows\System\VmHWDGe.exe
  2⤵
  PID:6788
- C:\Windows\System\gAFOxcA.exe
  C:\Windows\System\gAFOxcA.exe
  2⤵
  PID:7156
- C:\Windows\System\seMTepB.exe
  C:\Windows\System\seMTepB.exe
  2⤵
  PID:8060
- C:\Windows\System\pUFEoRC.exe
  C:\Windows\System\pUFEoRC.exe
  2⤵
  PID:10248
- C:\Windows\System\TJjNbvk.exe
  C:\Windows\System\TJjNbvk.exe
  2⤵
  PID:10268
- C:\Windows\System\rbpdXvk.exe
  C:\Windows\System\rbpdXvk.exe
  2⤵
  PID:10284
- C:\Windows\System\sWMhNyn.exe
  C:\Windows\System\sWMhNyn.exe
  2⤵
  PID:10300
- C:\Windows\System\AAMRBPt.exe
  C:\Windows\System\AAMRBPt.exe
  2⤵
  PID:10320
- C:\Windows\System\RpxzNtw.exe
  C:\Windows\System\RpxzNtw.exe
  2⤵
  PID:10344
- C:\Windows\System\hIoFSvY.exe
  C:\Windows\System\hIoFSvY.exe
  2⤵
  PID:10360
- C:\Windows\System\jWgxJtk.exe
  C:\Windows\System\jWgxJtk.exe
  2⤵
  PID:10376
- C:\Windows\System\grRyaAE.exe
  C:\Windows\System\grRyaAE.exe
  2⤵
  PID:10392
- C:\Windows\System\StXRGGH.exe
  C:\Windows\System\StXRGGH.exe
  2⤵
  PID:10408
- C:\Windows\System\XeoDegd.exe
  C:\Windows\System\XeoDegd.exe
  2⤵
  PID:10424
- C:\Windows\System\oEBvgQb.exe
  C:\Windows\System\oEBvgQb.exe
  2⤵
  PID:10444
- C:\Windows\System\Cipzhqb.exe
  C:\Windows\System\Cipzhqb.exe
  2⤵
  PID:10464
- C:\Windows\System\jzLziXB.exe
  C:\Windows\System\jzLziXB.exe
  2⤵
  PID:10480
- C:\Windows\System\lIdTqBZ.exe
  C:\Windows\System\lIdTqBZ.exe
  2⤵
  PID:10504
- C:\Windows\System\aSywvpk.exe
  C:\Windows\System\aSywvpk.exe
  2⤵
  PID:10528
- C:\Windows\System\NoGRWES.exe
  C:\Windows\System\NoGRWES.exe
  2⤵
  PID:10548
- C:\Windows\System\LwHtrsT.exe
  C:\Windows\System\LwHtrsT.exe
  2⤵
  PID:10568
- C:\Windows\System\rYiQHnc.exe
  C:\Windows\System\rYiQHnc.exe
  2⤵
  PID:10588
- C:\Windows\System\Jmeexrk.exe
  C:\Windows\System\Jmeexrk.exe
  2⤵
  PID:10608
- C:\Windows\System\LwbKtGO.exe
  C:\Windows\System\LwbKtGO.exe
  2⤵
  PID:10628
- C:\Windows\System\ZUhloeX.exe
  C:\Windows\System\ZUhloeX.exe
  2⤵
  PID:10644
- C:\Windows\System\srzdwfT.exe
  C:\Windows\System\srzdwfT.exe
  2⤵
  PID:10668
- C:\Windows\System\QcAFsnD.exe
  C:\Windows\System\QcAFsnD.exe
  2⤵
  PID:10684
- C:\Windows\System\AcVfGNR.exe
  C:\Windows\System\AcVfGNR.exe
  2⤵
  PID:10700
- C:\Windows\System\qHBUOkP.exe
  C:\Windows\System\qHBUOkP.exe
  2⤵
  PID:10716
- C:\Windows\System\lAFBEPx.exe
  C:\Windows\System\lAFBEPx.exe
  2⤵
  PID:10732
- C:\Windows\System\zCChtIE.exe
  C:\Windows\System\zCChtIE.exe
  2⤵
  PID:10752
- C:\Windows\System\QPvdErZ.exe
  C:\Windows\System\QPvdErZ.exe
  2⤵
  PID:10784
- C:\Windows\System\pUUGPwc.exe
  C:\Windows\System\pUUGPwc.exe
  2⤵
  PID:10800
- C:\Windows\System\prsLqGc.exe
  C:\Windows\System\prsLqGc.exe
  2⤵
  PID:10824
- C:\Windows\System\yLSiaTn.exe
  C:\Windows\System\yLSiaTn.exe
  2⤵
  PID:10844
- C:\Windows\System\sCekLpW.exe
  C:\Windows\System\sCekLpW.exe
  2⤵
  PID:10864
- C:\Windows\System\FpRqtZS.exe
  C:\Windows\System\FpRqtZS.exe
  2⤵
  PID:10884
- C:\Windows\System\yCrEpeF.exe
  C:\Windows\System\yCrEpeF.exe
  2⤵
  PID:10900
- C:\Windows\System\FeRTmIL.exe
  C:\Windows\System\FeRTmIL.exe
  2⤵
  PID:10920
- C:\Windows\System\oJhRIEz.exe
  C:\Windows\System\oJhRIEz.exe
  2⤵
  PID:10948
- C:\Windows\System\bqVGyPq.exe
  C:\Windows\System\bqVGyPq.exe
  2⤵
  PID:10964
- C:\Windows\System\TxMdnAa.exe
  C:\Windows\System\TxMdnAa.exe
  2⤵
  PID:10980
- C:\Windows\System\MxRutRu.exe
  C:\Windows\System\MxRutRu.exe
  2⤵
  PID:11004
- C:\Windows\System\rBNHNmA.exe
  C:\Windows\System\rBNHNmA.exe
  2⤵
  PID:11020
- C:\Windows\System\raxrzwa.exe
  C:\Windows\System\raxrzwa.exe
  2⤵
  PID:11044
- C:\Windows\System\iCDxdcV.exe
  C:\Windows\System\iCDxdcV.exe
  2⤵
  PID:11060
- C:\Windows\System\bxDgZAc.exe
  C:\Windows\System\bxDgZAc.exe
  2⤵
  PID:11076
- C:\Windows\System\skudMkZ.exe
  C:\Windows\System\skudMkZ.exe
  2⤵
  PID:11096
- C:\Windows\System\gprUfyr.exe
  C:\Windows\System\gprUfyr.exe
  2⤵
  PID:11116
- C:\Windows\System\WoJqSvU.exe
  C:\Windows\System\WoJqSvU.exe
  2⤵
  PID:11132
- C:\Windows\System\bKwouRf.exe
  C:\Windows\System\bKwouRf.exe
  2⤵
  PID:11152
- C:\Windows\System\rsjUgWz.exe
  C:\Windows\System\rsjUgWz.exe
  2⤵
  PID:11172
- C:\Windows\System\lvhTQjm.exe
  C:\Windows\System\lvhTQjm.exe
  2⤵
  PID:11192
- C:\Windows\System\RBSoWAc.exe
  C:\Windows\System\RBSoWAc.exe
  2⤵
  PID:11212
- C:\Windows\System\jElbiZz.exe
  C:\Windows\System\jElbiZz.exe
  2⤵
  PID:11236
- C:\Windows\System\bmbXBPB.exe
  C:\Windows\System\bmbXBPB.exe
  2⤵
  PID:11256
- C:\Windows\System\PpXMVBY.exe
  C:\Windows\System\PpXMVBY.exe
  2⤵
  PID:4972
- C:\Windows\System\zMNfGGc.exe
  C:\Windows\System\zMNfGGc.exe
  2⤵
  PID:6928
- C:\Windows\System\Lmmbxzb.exe
  C:\Windows\System\Lmmbxzb.exe
  2⤵
  PID:1704
- C:\Windows\System\nviPgzI.exe
  C:\Windows\System\nviPgzI.exe
  2⤵
  PID:9396
- C:\Windows\System\nZvPklL.exe
  C:\Windows\System\nZvPklL.exe
  2⤵
  PID:6568
- C:\Windows\System\dopyvZL.exe
  C:\Windows\System\dopyvZL.exe
  2⤵
  PID:9504
- C:\Windows\System\dvSmWiI.exe
  C:\Windows\System\dvSmWiI.exe
  2⤵
  PID:7188
- C:\Windows\System\VjvQOcG.exe
  C:\Windows\System\VjvQOcG.exe
  2⤵
  PID:8084
- C:\Windows\System\mhonCyP.exe
  C:\Windows\System\mhonCyP.exe
  2⤵
  PID:8168
- C:\Windows\System\QngoQHU.exe
  C:\Windows\System\QngoQHU.exe
  2⤵
  PID:8596
- C:\Windows\System\bFHPfDh.exe
  C:\Windows\System\bFHPfDh.exe
  2⤵
  PID:8664
- C:\Windows\System\TrXUsxX.exe
  C:\Windows\System\TrXUsxX.exe
  2⤵
  PID:8716
- C:\Windows\System\xQkNLSG.exe
  C:\Windows\System\xQkNLSG.exe
  2⤵
  PID:10004
- C:\Windows\System\sFHowiS.exe
  C:\Windows\System\sFHowiS.exe
  2⤵
  PID:8820
- C:\Windows\System\TiBqCFJ.exe
  C:\Windows\System\TiBqCFJ.exe
  2⤵
  PID:3612
- C:\Windows\System\atWiNCp.exe
  C:\Windows\System\atWiNCp.exe
  2⤵
  PID:10160
- C:\Windows\System\yPuOUqu.exe
  C:\Windows\System\yPuOUqu.exe
  2⤵
  PID:4260
- C:\Windows\System\SFTrkeG.exe
  C:\Windows\System\SFTrkeG.exe
  2⤵
  PID:9152
- C:\Windows\System\XUCMLNE.exe
  C:\Windows\System\XUCMLNE.exe
  2⤵
  PID:11280
- C:\Windows\System\mGLdHwe.exe
  C:\Windows\System\mGLdHwe.exe
  2⤵
  PID:11300
- C:\Windows\System\KGwfvlx.exe
  C:\Windows\System\KGwfvlx.exe
  2⤵
  PID:11320
- C:\Windows\System\LxSfYLz.exe
  C:\Windows\System\LxSfYLz.exe
  2⤵
  PID:11344
- C:\Windows\System\gUjIRHa.exe
  C:\Windows\System\gUjIRHa.exe
  2⤵
  PID:11360
- C:\Windows\System\JqOMGOX.exe
  C:\Windows\System\JqOMGOX.exe
  2⤵
  PID:11384
- C:\Windows\System\VLUaFrF.exe
  C:\Windows\System\VLUaFrF.exe
  2⤵
  PID:11424
- C:\Windows\System\ekPeYkk.exe
  C:\Windows\System\ekPeYkk.exe
  2⤵
  PID:11440
- C:\Windows\System\nwCYJgo.exe
  C:\Windows\System\nwCYJgo.exe
  2⤵
  PID:11456
- C:\Windows\System\ONjpWwb.exe
  C:\Windows\System\ONjpWwb.exe
  2⤵
  PID:11472
- C:\Windows\System\gvyKfbN.exe
  C:\Windows\System\gvyKfbN.exe
  2⤵
  PID:11488
- C:\Windows\System\vIhXoSY.exe
  C:\Windows\System\vIhXoSY.exe
  2⤵
  PID:11504
- C:\Windows\System\rHFjgJt.exe
  C:\Windows\System\rHFjgJt.exe
  2⤵
  PID:11520
- C:\Windows\System\lBmmIuq.exe
  C:\Windows\System\lBmmIuq.exe
  2⤵
  PID:11540
- C:\Windows\System\YvqywcF.exe
  C:\Windows\System\YvqywcF.exe
  2⤵
  PID:11560
- C:\Windows\System\FXRwuFu.exe
  C:\Windows\System\FXRwuFu.exe
  2⤵
  PID:11576
- C:\Windows\System\qROMOOd.exe
  C:\Windows\System\qROMOOd.exe
  2⤵
  PID:11600
- C:\Windows\System\EjPQKuh.exe
  C:\Windows\System\EjPQKuh.exe
  2⤵
  PID:11620
- C:\Windows\System\OFYsNYd.exe
  C:\Windows\System\OFYsNYd.exe
  2⤵
  PID:11640
- C:\Windows\System\VBWdNtt.exe
  C:\Windows\System\VBWdNtt.exe
  2⤵
  PID:11752
- C:\Windows\System\tAARPlT.exe
  C:\Windows\System\tAARPlT.exe
  2⤵
  PID:11772
- C:\Windows\System\UlfWglW.exe
  C:\Windows\System\UlfWglW.exe
  2⤵
  PID:11796
- C:\Windows\System\SliUovk.exe
  C:\Windows\System\SliUovk.exe
  2⤵
  PID:11816
- C:\Windows\System\FMQqaBT.exe
  C:\Windows\System\FMQqaBT.exe
  2⤵
  PID:11840
- C:\Windows\System\HnyhLgM.exe
  C:\Windows\System\HnyhLgM.exe
  2⤵
  PID:11856
- C:\Windows\System\MBvfgnH.exe
  C:\Windows\System\MBvfgnH.exe
  2⤵
  PID:11880
- C:\Windows\System\XerhBzA.exe
  C:\Windows\System\XerhBzA.exe
  2⤵
  PID:11896
- C:\Windows\System\FrYkAye.exe
  C:\Windows\System\FrYkAye.exe
  2⤵
  PID:11920
- C:\Windows\System\tYYFdTb.exe
  C:\Windows\System\tYYFdTb.exe
  2⤵
  PID:11948
- C:\Windows\System\nRwQKrK.exe
  C:\Windows\System\nRwQKrK.exe
  2⤵
  PID:11964
- C:\Windows\System\iEJQJxM.exe
  C:\Windows\System\iEJQJxM.exe
  2⤵
  PID:11984
- C:\Windows\System\qSmmdYn.exe
  C:\Windows\System\qSmmdYn.exe
  2⤵
  PID:12008
- C:\Windows\System\OiZHWNG.exe
  C:\Windows\System\OiZHWNG.exe
  2⤵
  PID:12028
- C:\Windows\System\yvoYIdE.exe
  C:\Windows\System\yvoYIdE.exe
  2⤵
  PID:12048
- C:\Windows\System\kugPXfr.exe
  C:\Windows\System\kugPXfr.exe
  2⤵
  PID:12072
- C:\Windows\System\tfpuIFo.exe
  C:\Windows\System\tfpuIFo.exe
  2⤵
  PID:12092
- C:\Windows\System\dekYWIA.exe
  C:\Windows\System\dekYWIA.exe
  2⤵
  PID:12108
- C:\Windows\System\HBbeJCC.exe
  C:\Windows\System\HBbeJCC.exe
  2⤵
  PID:12132
- C:\Windows\System\fWBPABt.exe
  C:\Windows\System\fWBPABt.exe
  2⤵
  PID:12160
- C:\Windows\System\HSsiitQ.exe
  C:\Windows\System\HSsiitQ.exe
  2⤵
  PID:12176
- C:\Windows\System\MCtcBCE.exe
  C:\Windows\System\MCtcBCE.exe
  2⤵
  PID:12192
- C:\Windows\System\rueHEOJ.exe
  C:\Windows\System\rueHEOJ.exe
  2⤵
  PID:12216
- C:\Windows\System\uDEEVBE.exe
  C:\Windows\System\uDEEVBE.exe
  2⤵
  PID:12236
- C:\Windows\System\lxjUarv.exe
  C:\Windows\System\lxjUarv.exe
  2⤵
  PID:12256
- C:\Windows\System\iwqpmKz.exe
  C:\Windows\System\iwqpmKz.exe
  2⤵
  PID:12272
- C:\Windows\System\zvFAOTp.exe
  C:\Windows\System\zvFAOTp.exe
  2⤵
  PID:4988
- C:\Windows\System\FMrgMVp.exe
  C:\Windows\System\FMrgMVp.exe
  2⤵
  PID:5800
- C:\Windows\System\HQOgXWr.exe
  C:\Windows\System\HQOgXWr.exe
  2⤵
  PID:6164
- C:\Windows\System\GdWsWPh.exe
  C:\Windows\System\GdWsWPh.exe
  2⤵
  PID:6656
- C:\Windows\System\jRBtueC.exe
  C:\Windows\System\jRBtueC.exe
  2⤵
  PID:4168
- C:\Windows\System\BGchyeF.exe
  C:\Windows\System\BGchyeF.exe
  2⤵
  PID:6832
- C:\Windows\System\JXWlFVI.exe
  C:\Windows\System\JXWlFVI.exe
  2⤵
  PID:3748
- C:\Windows\System\ylfkDEb.exe
  C:\Windows\System\ylfkDEb.exe
  2⤵
  PID:5372
- C:\Windows\System\pGjUmld.exe
  C:\Windows\System\pGjUmld.exe
  2⤵
  PID:10244
- C:\Windows\System\ThEaEkl.exe
  C:\Windows\System\ThEaEkl.exe
  2⤵
  PID:10476
- C:\Windows\System\RXhTKoc.exe
  C:\Windows\System\RXhTKoc.exe
  2⤵
  PID:9484
- C:\Windows\System\wiLuKWH.exe
  C:\Windows\System\wiLuKWH.exe
  2⤵
  PID:9572
- C:\Windows\System\NxwpgjI.exe
  C:\Windows\System\NxwpgjI.exe
  2⤵
  PID:7480
- C:\Windows\System\nSaVjuR.exe
  C:\Windows\System\nSaVjuR.exe
  2⤵
  PID:3576
- C:\Windows\System\NVuWqSV.exe
  C:\Windows\System\NVuWqSV.exe
  2⤵
  PID:5288
- C:\Windows\System\wWVZKDT.exe
  C:\Windows\System\wWVZKDT.exe
  2⤵
  PID:10740
- C:\Windows\System\fNQnmhX.exe
  C:\Windows\System\fNQnmhX.exe
  2⤵
  PID:8204
- C:\Windows\System\EqRjyVU.exe
  C:\Windows\System\EqRjyVU.exe
  2⤵
  PID:8244
- C:\Windows\System\fmsbyHn.exe
  C:\Windows\System\fmsbyHn.exe
  2⤵
  PID:8280
- C:\Windows\System\OMcrepK.exe
  C:\Windows\System\OMcrepK.exe
  2⤵
  PID:8324
- C:\Windows\System\uOXDPaA.exe
  C:\Windows\System\uOXDPaA.exe
  2⤵
  PID:8364
- C:\Windows\System\VNaBQtt.exe
  C:\Windows\System\VNaBQtt.exe
  2⤵
  PID:8404
- C:\Windows\System\GXsAQnw.exe
  C:\Windows\System\GXsAQnw.exe
  2⤵
  PID:8480
- C:\Windows\System\WBjDNoB.exe
  C:\Windows\System\WBjDNoB.exe
  2⤵
  PID:9828
- C:\Windows\System\AlShvnR.exe
  C:\Windows\System\AlShvnR.exe
  2⤵
  PID:9844
- C:\Windows\System\gHfjzlU.exe
  C:\Windows\System\gHfjzlU.exe
  2⤵
  PID:10880
- C:\Windows\System\JYEDGSS.exe
  C:\Windows\System\JYEDGSS.exe
  2⤵
  PID:10972
- C:\Windows\System\XdHglvC.exe
  C:\Windows\System\XdHglvC.exe
  2⤵
  PID:9972
- C:\Windows\System\ZnWzdiF.exe
  C:\Windows\System\ZnWzdiF.exe
  2⤵
  PID:2228
- C:\Windows\System\owZPVno.exe
  C:\Windows\System\owZPVno.exe
  2⤵
  PID:10088
- C:\Windows\System\xYglDlf.exe
  C:\Windows\System\xYglDlf.exe
  2⤵
  PID:12308
- C:\Windows\System\PFaxBZf.exe
  C:\Windows\System\PFaxBZf.exe
  2⤵
  PID:12336
- C:\Windows\System\dliJvTh.exe
  C:\Windows\System\dliJvTh.exe
  2⤵
  PID:12352
- C:\Windows\System\tbORzUe.exe
  C:\Windows\System\tbORzUe.exe
  2⤵
  PID:12368
- C:\Windows\System\rjwkqNc.exe
  C:\Windows\System\rjwkqNc.exe
  2⤵
  PID:12388
- C:\Windows\System\jUUuJCa.exe
  C:\Windows\System\jUUuJCa.exe
  2⤵
  PID:12404
- C:\Windows\System\QXvHGYh.exe
  C:\Windows\System\QXvHGYh.exe
  2⤵
  PID:12420
- C:\Windows\System\xFXAFJa.exe
  C:\Windows\System\xFXAFJa.exe
  2⤵
  PID:12440
- C:\Windows\System\lpfgMXz.exe
  C:\Windows\System\lpfgMXz.exe
  2⤵
  PID:12476
- C:\Windows\System\Jadicwp.exe
  C:\Windows\System\Jadicwp.exe
  2⤵
  PID:12492
- C:\Windows\System\gdSlpkO.exe
  C:\Windows\System\gdSlpkO.exe
  2⤵
  PID:12508
- C:\Windows\System\JAbMwAv.exe
  C:\Windows\System\JAbMwAv.exe
  2⤵
  PID:12524
- C:\Windows\System\TeKrmdR.exe
  C:\Windows\System\TeKrmdR.exe
  2⤵
  PID:12548
- C:\Windows\System\sepMyaD.exe
  C:\Windows\System\sepMyaD.exe
  2⤵
  PID:12568
- C:\Windows\System\ykuvnjM.exe
  C:\Windows\System\ykuvnjM.exe
  2⤵
  PID:12588
- C:\Windows\System\kxVpORd.exe
  C:\Windows\System\kxVpORd.exe
  2⤵
  PID:12612
- C:\Windows\System\jTlQxzV.exe
  C:\Windows\System\jTlQxzV.exe
  2⤵
  PID:12628
- C:\Windows\System\SuEYGAH.exe
  C:\Windows\System\SuEYGAH.exe
  2⤵
  PID:12648
- C:\Windows\System\moUDSXX.exe
  C:\Windows\System\moUDSXX.exe
  2⤵
  PID:12672
- C:\Windows\System\TzbnXtj.exe
  C:\Windows\System\TzbnXtj.exe
  2⤵
  PID:12688
- C:\Windows\System\SrKBLGJ.exe
  C:\Windows\System\SrKBLGJ.exe
  2⤵
  PID:12708
- C:\Windows\System\SuVgvSn.exe
  C:\Windows\System\SuVgvSn.exe
  2⤵
  PID:12724
- C:\Windows\System\SZpuNuU.exe
  C:\Windows\System\SZpuNuU.exe
  2⤵
  PID:12748
- C:\Windows\System\VlwbDze.exe
  C:\Windows\System\VlwbDze.exe
  2⤵
  PID:12768
- C:\Windows\System\EKTGAom.exe
  C:\Windows\System\EKTGAom.exe
  2⤵
  PID:12784
- C:\Windows\System\BLnVFzj.exe
  C:\Windows\System\BLnVFzj.exe
  2⤵
  PID:12800
- C:\Windows\System\ZBkvoZI.exe
  C:\Windows\System\ZBkvoZI.exe
  2⤵
  PID:12820
- C:\Windows\System\XZlUXrD.exe
  C:\Windows\System\XZlUXrD.exe
  2⤵
  PID:12840
- C:\Windows\System\egGMBbN.exe
  C:\Windows\System\egGMBbN.exe
  2⤵
  PID:12860
- C:\Windows\System\YIpsFYW.exe
  C:\Windows\System\YIpsFYW.exe
  2⤵
  PID:12880
- C:\Windows\System\xMMgWKn.exe
  C:\Windows\System\xMMgWKn.exe
  2⤵
  PID:12904
- C:\Windows\System\QeKXgvO.exe
  C:\Windows\System\QeKXgvO.exe
  2⤵
  PID:12456
- C:\Windows\System\teBOXfk.exe
  C:\Windows\System\teBOXfk.exe
  2⤵
  PID:8684
- C:\Windows\System\qYMJvYz.exe
  C:\Windows\System\qYMJvYz.exe
  2⤵
  PID:8788
- C:\Windows\System\bsfpsUZ.exe
  C:\Windows\System\bsfpsUZ.exe
  2⤵
  PID:12600
- C:\Windows\System\VbpNSmR.exe
  C:\Windows\System\VbpNSmR.exe
  2⤵
  PID:12704
- C:\Windows\System\SHdrDCp.exe
  C:\Windows\System\SHdrDCp.exe
  2⤵
  PID:3088
- C:\Windows\System\PTZbRJH.exe
  C:\Windows\System\PTZbRJH.exe
  2⤵
  PID:12872
- C:\Windows\System\CGGgEEA.exe
  C:\Windows\System\CGGgEEA.exe
  2⤵
  PID:13020
- C:\Windows\System\kkwATYx.exe
  C:\Windows\System\kkwATYx.exe
  2⤵
  PID:11672
- C:\Windows\System\DZQRaxX.exe
  C:\Windows\System\DZQRaxX.exe
  2⤵
  PID:13228
- C:\Windows\System\jxswuIm.exe
  C:\Windows\System\jxswuIm.exe
  2⤵
  PID:13268
- C:\Windows\System\daibqgT.exe
  C:\Windows\System\daibqgT.exe
  2⤵
  PID:13272
- C:\Windows\System\cvDOdvh.exe
  C:\Windows\System\cvDOdvh.exe
  2⤵
  PID:13304
- C:\Windows\System\fzBzQTl.exe
  C:\Windows\System\fzBzQTl.exe
  2⤵
  PID:9508
- C:\Windows\System\iaoKxwH.exe
  C:\Windows\System\iaoKxwH.exe
  2⤵
  PID:9556
- C:\Windows\System\zHyePPM.exe
  C:\Windows\System\zHyePPM.exe
  2⤵
  PID:10724
- C:\Windows\System\JXodUnm.exe
  C:\Windows\System\JXodUnm.exe
  2⤵
  PID:11312
- C:\Windows\System\gjcTPCW.exe
  C:\Windows\System\gjcTPCW.exe
  2⤵
  PID:9228
- C:\Windows\System\OIATCGd.exe
  C:\Windows\System\OIATCGd.exe
  2⤵
  PID:8768
- C:\Windows\System\uVIKMIr.exe
  C:\Windows\System\uVIKMIr.exe
  2⤵
  PID:11688
- C:\Windows\System\Qxwebik.exe
  C:\Windows\System\Qxwebik.exe
  2⤵
  PID:7084
- C:\Windows\System\aQxmuEE.exe
  C:\Windows\System\aQxmuEE.exe
  2⤵
  PID:7540
- C:\Windows\System\wBIvLds.exe
  C:\Windows\System\wBIvLds.exe
  2⤵
  PID:8348
- C:\Windows\System\liKCnuW.exe
  C:\Windows\System\liKCnuW.exe
  2⤵
  PID:1148
- C:\Windows\System\luXHznt.exe
  C:\Windows\System\luXHznt.exe
  2⤵
  PID:4896
- C:\Windows\System\zEqaNxI.exe
  C:\Windows\System\zEqaNxI.exe
  2⤵
  PID:12088
- C:\Windows\System\OGgAULO.exe
  C:\Windows\System\OGgAULO.exe
  2⤵
  PID:9732
- C:\Windows\System\wlcVZxa.exe
  C:\Windows\System\wlcVZxa.exe
  2⤵
  PID:620
- C:\Windows\System\uqxlJfE.exe
  C:\Windows\System\uqxlJfE.exe
  2⤵
  PID:10856
- C:\Windows\System\sLzXIyv.exe
  C:\Windows\System\sLzXIyv.exe
  2⤵
  PID:8224
- C:\Windows\System\tjqfpPl.exe
  C:\Windows\System\tjqfpPl.exe
  2⤵
  PID:10652
- C:\Windows\System\aSTJhoM.exe
  C:\Windows\System\aSTJhoM.exe
  2⤵
  PID:1880
- C:\Windows\System\UgBygTQ.exe
  C:\Windows\System\UgBygTQ.exe
  2⤵
  PID:11356
- C:\Windows\System\KegjPjU.exe
  C:\Windows\System\KegjPjU.exe
  2⤵
  PID:2960
- C:\Windows\System\gOSEphN.exe
  C:\Windows\System\gOSEphN.exe
  2⤵
  PID:3600
- C:\Windows\System\MxdkPeg.exe
  C:\Windows\System\MxdkPeg.exe
  2⤵
  PID:12400
- C:\Windows\System\zBmaNdX.exe
  C:\Windows\System\zBmaNdX.exe
  2⤵
  PID:10132
- C:\Windows\System\HEWBWbt.exe
  C:\Windows\System\HEWBWbt.exe
  2⤵
  PID:12580
- C:\Windows\System\xqCIjQR.exe
  C:\Windows\System\xqCIjQR.exe
  2⤵
  PID:12980
- C:\Windows\System\EDtuwDb.exe
  C:\Windows\System\EDtuwDb.exe
  2⤵
  PID:4352
- C:\Windows\System\BePdbfj.exe
  C:\Windows\System\BePdbfj.exe
  2⤵
  PID:7988
- C:\Windows\System\fjnzNMU.exe
  C:\Windows\System\fjnzNMU.exe
  2⤵
  PID:9156
- C:\Windows\System\ubMWBMQ.exe
  C:\Windows\System\ubMWBMQ.exe
  2⤵
  PID:13036
- C:\Windows\System\kYIPitR.exe
  C:\Windows\System\kYIPitR.exe
  2⤵
  PID:10332
- C:\Windows\System\ywPxVlb.exe
  C:\Windows\System\ywPxVlb.exe
  2⤵
  PID:12664
- C:\Windows\System\xFtLRvr.exe
  C:\Windows\System\xFtLRvr.exe
  2⤵
  PID:10460
- C:\Windows\System\mxrWjdm.exe
  C:\Windows\System\mxrWjdm.exe
  2⤵
  PID:10544
- C:\Windows\System\cdGVaXK.exe
  C:\Windows\System\cdGVaXK.exe
  2⤵
  PID:12224
- C:\Windows\System\yFdHdDi.exe
  C:\Windows\System\yFdHdDi.exe
  2⤵
  PID:5084
- C:\Windows\System\bWwNxqa.exe
  C:\Windows\System\bWwNxqa.exe
  2⤵
  PID:10840
- C:\Windows\System\jQNzaUw.exe
  C:\Windows\System\jQNzaUw.exe
  2⤵
  PID:12124
- C:\Windows\System\csJFNhC.exe
  C:\Windows\System\csJFNhC.exe
  2⤵
  PID:11032
- C:\Windows\System\lxqmZJJ.exe
  C:\Windows\System\lxqmZJJ.exe
  2⤵
  PID:12668
- C:\Windows\System\Fliifwh.exe
  C:\Windows\System\Fliifwh.exe
  2⤵
  PID:11392
- C:\Windows\System\Wtuyqzn.exe
  C:\Windows\System\Wtuyqzn.exe
  2⤵
  PID:11232
- C:\Windows\System\eBLEIKb.exe
  C:\Windows\System\eBLEIKb.exe
  2⤵
  PID:7992
- C:\Windows\System\NoEMqGq.exe
  C:\Windows\System\NoEMqGq.exe
  2⤵
  PID:10728
- C:\Windows\System\QsxKoyB.exe
  C:\Windows\System\QsxKoyB.exe
  2⤵
  PID:9548
- C:\Windows\System\PpdwIdL.exe
  C:\Windows\System\PpdwIdL.exe
  2⤵
  PID:13308
- C:\Windows\System\zRuvtIA.exe
  C:\Windows\System\zRuvtIA.exe
  2⤵
  PID:10452
- C:\Windows\System\ojdBGOy.exe
  C:\Windows\System\ojdBGOy.exe
  2⤵
  PID:12736
- C:\Windows\System\JXPotOw.exe
  C:\Windows\System\JXPotOw.exe
  2⤵
  PID:5968
- C:\Windows\System\HqSVZrV.exe
  C:\Windows\System\HqSVZrV.exe
  2⤵
  PID:8440
- C:\Windows\System\gCbHVgD.exe
  C:\Windows\System\gCbHVgD.exe
  2⤵
  PID:13108
- C:\Windows\System\TfxScYe.exe
  C:\Windows\System\TfxScYe.exe
  2⤵
  PID:11956
- C:\Windows\System\SVTaeBW.exe
  C:\Windows\System\SVTaeBW.exe
  2⤵
  PID:2104
- C:\Windows\System\ohWndOm.exe
  C:\Windows\System\ohWndOm.exe
  2⤵
  PID:1984
- C:\Windows\System\bDzGfrk.exe
  C:\Windows\System\bDzGfrk.exe
  2⤵
  PID:5048
- C:\Windows\System\PjJKMzg.exe
  C:\Windows\System\PjJKMzg.exe
  2⤵
  PID:9596
- C:\Windows\System\kvTGzYY.exe
  C:\Windows\System\kvTGzYY.exe
  2⤵
  PID:4824
- C:\Windows\System\wJZDRcJ.exe
  C:\Windows\System\wJZDRcJ.exe
  2⤵
  PID:13296
- C:\Windows\System\telMQpc.exe
  C:\Windows\System\telMQpc.exe
  2⤵
  PID:1924
- C:\Windows\System\KeBJcet.exe
  C:\Windows\System\KeBJcet.exe
  2⤵
  PID:12760
- C:\Windows\System\BofKPKd.exe
  C:\Windows\System\BofKPKd.exe
  2⤵
  PID:12892
- C:\Windows\System\tsVpRUr.exe
  C:\Windows\System\tsVpRUr.exe
  2⤵
  PID:12328
- C:\Windows\System\yMhWaBp.exe
  C:\Windows\System\yMhWaBp.exe
  2⤵
  PID:13044
- C:\Windows\System\WVCfpcs.exe
  C:\Windows\System\WVCfpcs.exe
  2⤵
  PID:11904
- C:\Windows\System\tLgFFpB.exe
  C:\Windows\System\tLgFFpB.exe
  2⤵
  PID:8960
- C:\Windows\System\EriSpfI.exe
  C:\Windows\System\EriSpfI.exe
  2⤵
  PID:13104
- C:\Windows\System\ljnIFbu.exe
  C:\Windows\System\ljnIFbu.exe
  2⤵
  PID:13168
- C:\Windows\System\BjevaEk.exe
  C:\Windows\System\BjevaEk.exe
  2⤵
  PID:11848
- C:\Windows\System\LoMBrWb.exe
  C:\Windows\System\LoMBrWb.exe
  2⤵
  PID:10944
- C:\Windows\System\NITgnuf.exe
  C:\Windows\System\NITgnuf.exe
  2⤵
  PID:4756
- C:\Windows\System\wyYjveF.exe
  C:\Windows\System\wyYjveF.exe
  2⤵
  PID:4460
- C:\Windows\System\lnFyvTn.exe
  C:\Windows\System\lnFyvTn.exe
  2⤵
  PID:4028
- C:\Windows\System\VnCdjTq.exe
  C:\Windows\System\VnCdjTq.exe
  2⤵
  PID:8700
- C:\Windows\System\CeQHEDK.exe
  C:\Windows\System\CeQHEDK.exe
  2⤵
  PID:9088
- C:\Windows\System\KkLhzlp.exe
  C:\Windows\System\KkLhzlp.exe
  2⤵
  PID:11836
- C:\Windows\System\iPqZTSR.exe
  C:\Windows\System\iPqZTSR.exe
  2⤵
  PID:10148
- C:\Windows\System\INPJxmF.exe
  C:\Windows\System\INPJxmF.exe
  2⤵
  PID:9532
- C:\Windows\System\UtaQfJs.exe
  C:\Windows\System\UtaQfJs.exe
  2⤵
  PID:9872
- C:\Windows\System\GkcbBam.exe
  C:\Windows\System\GkcbBam.exe
  2⤵
  PID:11632
- C:\Windows\System\fjmqRle.exe
  C:\Windows\System\fjmqRle.exe
  2⤵
  PID:12740
- C:\Windows\System\ofdeVhB.exe
  C:\Windows\System\ofdeVhB.exe
  2⤵
  PID:1240
- C:\Windows\System\SScBfIM.exe
  C:\Windows\System\SScBfIM.exe
  2⤵
  PID:7324
- C:\Windows\System\TEdyuuW.exe
  C:\Windows\System\TEdyuuW.exe
  2⤵
  PID:3028
- C:\Windows\System\HilDejk.exe
  C:\Windows\System\HilDejk.exe
  2⤵
  PID:11400
- C:\Windows\System\BYpvqtN.exe
  C:\Windows\System\BYpvqtN.exe
  2⤵
  PID:12364
- C:\Windows\System\kZcGjqx.exe
  C:\Windows\System\kZcGjqx.exe
  2⤵
  PID:11200
- C:\Windows\System\BoqSSEe.exe
  C:\Windows\System\BoqSSEe.exe
  2⤵
  PID:12056

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4992 -i 4992 -h 608 -j 484 -s 436 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:10236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gi4s44m5.ziw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CSutPYb.exe

Filesize
8B

MD5
3fa896e6e03a6c36944841b51d39e0d4

SHA1
4aefb55d27e72ef2d47403b0c8ce06d172004a35

SHA256
400669c3a4cce9fc0e15e111795da46968d6aa425fadb66d6e8c94b8a55f448d

SHA512
612aa9da451a214208d9de281e4424e86a677aa7a795a809d046b92d6bba85793ab2e58fb70475807546f0c1e5ee525dd22de24b67b42735f5d59a71d847dc4f

Download Submit
C:\Windows\System\ECfXYmE.exe

Filesize
1.3MB

MD5
ea02161c07c04b59b78e8b3072718fe5

SHA1
e90df225fdb68fb3878eeae4bcdcbfb55689026b

SHA256
ffdd160482653920cd5583bacf24d36342dec6ed33328223ebb86b48574f7f44

SHA512
f3dfaf67df611c1f1611ac630c65d76b5e8dff38e85e76fe69e0147bc89907df8a4da34dd7d04fa683c9c13e8df728f2ff0cd037b563dbc15d871ce44f13fa11

Download Submit
C:\Windows\System\EkaCbQq.exe

Filesize
1.3MB

MD5
4b896a13bd4fc45dcad8604af7ee3e7b

SHA1
9fbe2cb08b748e54f5ce8f356bf04d4ab87e2f6f

SHA256
959e87c8ee8e05848c1ba697ef08719b2391dc6ecbfa0e9732588f6efd00c500

SHA512
8869581d47f5802725e996fd047ff4e47ea0bece7c492f7cba64ccbdb30761fb5e0b5d91e6a8b58bcc815e9bff8ac8bb19b9355fb85b74bd91e0dcaf9beef306

Download Submit
C:\Windows\System\FLIJmyP.exe

Filesize
1.3MB

MD5
dd550c3c0877c9f50d8e4a3b121de882

SHA1
19164a79a91f8c2f8631335c82714d824ea629c5

SHA256
896b644754f1483ee8fb56c0c1c5567b600a05076f035fe813d8c1bce071cea9

SHA512
3e4adb96709cb1dabc681c737a3a1b3677b2410b8074c84a34bc805f77c7e808e76114b9292b813315a42e93c7928542b54b91261b3ae8b09361f9d4dbae9b6f

Download Submit
C:\Windows\System\FRMkfup.exe

Filesize
1.3MB

MD5
21de6c1b89bed52e2b853fe245a70d13

SHA1
f9afd6e4ff6c6f67eb2e8617b9ee629e746797ce

SHA256
bd4553d9e43a14d82d5c0257c8bfcaf28f3c4a42da5b13292aef1f2c58d4a41d

SHA512
d9cbefc14eb88d2ca93d5301c33d396b5dfbf6d7dd57a09262ca19560719e5715e156244fba637398a252037dd67d2ae3e9be76f8735630f043727ebb99bbcff

Download Submit
C:\Windows\System\FRyHXiu.exe

Filesize
1.3MB

MD5
3fed5d5dced7ad6a2913c8415d6cedbf

SHA1
069bb3d76abce46e47069a16e01bb6b4b3d545fb

SHA256
683117bee5851a7db08b87ae951b574181f1771740c936af1a59a8e5162648dd

SHA512
4f4af61ee11d3edfd44d54d04519f66fe82d1052b0ca99836262579fcd68d3f70acaac4b25c55e120d9f78202461fc40daffd9d5403a0c8c929dfe68546b9bfd

Download Submit
C:\Windows\System\GPocXbo.exe

Filesize
1.3MB

MD5
216713d497078a2bbc6238789b04720f

SHA1
6c047348d1d67a057d174fd3e2bfe22f67727e65

SHA256
f626aa7b1db1ac4887d82a85c2632891ad023b63ab522d1453e51f657b568649

SHA512
9056782926a5a985104373dedaf55e598a3226eafa37eeefb03bf8742f04f761bd4a7355313483c0406ff00c0dde0e2eac8881478b4863d7db9558bc5be13c92

Download Submit
C:\Windows\System\GtVQloQ.exe

Filesize
1.3MB

MD5
f3dce33fb3d5275d4fd4655616573969

SHA1
5bb1da4472a74a159ff6923a8d93d2ea5ff8a833

SHA256
b85091a9cd461598448b8422fa364138ac8e994cc02536de31134aefb97c3c2b

SHA512
8b228538788b1f8ba5266ba1befd5511e5883915b1647431c6fc45d3de2eb25c0cefeed62ee98e4bc4602d12904f6b3340e79246fa7c96865ae53bd1532c44cc

Download Submit
C:\Windows\System\GxCQGVa.exe

Filesize
1.3MB

MD5
2de8160e9c4b2df4097135b3c302096f

SHA1
cb33a098b2143caf7d4dd47605622a8f24d98978

SHA256
9c89b5cd8d31b3ea4e06ff7c1feab8c41081b4f41a88b8e7323d419a31f55210

SHA512
6a190d33c772b39fa55106f8a877fa70de5bf90459ab34122614097fbf7cb1c2b1ecb3c4cbc358eefaa2772967521de0e94336e1c3665b61a8130466db552e6f

Download Submit
C:\Windows\System\IRujMaD.exe

Filesize
1.3MB

MD5
4b714926f220e328e2e6e62f6be75f87

SHA1
407880331a917ed106bc2ea04f27e6355f98602e

SHA256
bddfb06d797dba534f68a75c49f976f44b7f82908d90889afaf7b5ff5fa71cc7

SHA512
e8e82b5f635d41ace39f06949de71036dc4a2bab01e20f1ef5d1599937bbbafd89c465e10470a0be89085c3fcfeea5045bc7ef2aa4837d925be668735847894d

Download Submit
C:\Windows\System\IZGxmcb.exe

Filesize
1.3MB

MD5
f5f0e7cf1517144ada84cef27c2132ea

SHA1
e2d98349ca7066dac410b7f00371ccb1b17a0511

SHA256
cb957e4fa5b9687e7dd7d3d2f208f3d9fcc67b778bcae8a5aec2fc4ea4c0019b

SHA512
1c3e13088de6e0e0f6ec80f3511e68bedaa8508139fd13623e5cb4f40a65c6616732448466e4db283f862b779d0963feba1e2a982bae805ac2713e8c63347806

Download Submit
C:\Windows\System\JIXRFva.exe

Filesize
1.3MB

MD5
137543b6cb458338e1a5a414d10f1f98

SHA1
ea333cc45ae60e077d9b04914931a77eaa76cb6f

SHA256
64c3712b7bac397beb660d317b64d23680bae7031dd316cff52d7dd3288a9cd2

SHA512
b15b5f18fbf4a4c3de48ad5addfa0f3a1f17919882dd0bf28dde490873bc04e2443fd8e756778b0bf52887b8b8c26b73952b0ca2c61d6882e80ade43ead5238b

Download Submit
C:\Windows\System\KXgDXUu.exe

Filesize
1.3MB

MD5
1f888f48f2cb9e79dffcd60e0366ef2c

SHA1
536003a01d1f6be4d81157516c2a6c70ed56aeda

SHA256
e153b55115231e40137f3ccc20b8adcf42b9fa1e18cc0127acdd0b974e8fb3c1

SHA512
c5d662e087a60316294ca52f2dbc91b974a11b9673660436e1c5a9e1b2e0303833bf37c6f85fec641614a991c7672d31e405e0e74b798f6b63fb0a15592e2b92

Download Submit
C:\Windows\System\LSLSROO.exe

Filesize
1.3MB

MD5
455543e5371a905a9c4ab5182d1153d6

SHA1
e051144bd4590a7292faa83bbdb7465bbd7ff494

SHA256
ad81533243bd46c25f5835aaccb10b84f8ea7433bebbc5890c5a261220f1e7e7

SHA512
246b8b94ff658ff89ea9ed1bab1dc753120035d06c11df28ab22eea891ac07a427243e509876bdcf147b0f4f39edd7acc69aa68e3783f821aece3924ceca53f9

Download Submit
C:\Windows\System\NXqynMB.exe

Filesize
1.3MB

MD5
5fad542a523cdb145afefaf2dd6e0ad6

SHA1
3db45703f170d0eb281e9a32112a8f4a899a656f

SHA256
a9a431fd2feb2d3d3466720b4c43fb0bc48f438fff45d2a91215bdd7be53b009

SHA512
daea33b25c62b1a67c56bf5b796da131e2db7d7dde3208741d24c309e329a0f6374d5fe86f0693b5f2ac95ec90595bd03f4d21e8cad71c173c24c68259021e3d

Download Submit
C:\Windows\System\OaRorQM.exe

Filesize
1.3MB

MD5
c2b4653a1ef1078a09567172aa1b8626

SHA1
fb25da2818c0c3eb3a4952d2c6e663f6106bfbdb

SHA256
3f61abfa04d60c501a502a6198c880eb48fc9a139775f0578b1d5fc4e103c4bc

SHA512
f3c602e1d4529227d2d851d96721cab2ffde6284cc327f7b42ceef010abb51ba9feabf08f94c65aac63511e4c3d7dc1805568750ae2f70d7ef4ef492816539c7

Download Submit
C:\Windows\System\ULHIZlr.exe

Filesize
1.3MB

MD5
03a78e6f71186acea6c96614e3b0f38b

SHA1
c7a1a35f86e54056c1b796293994e8ec055d9704

SHA256
b5e13b0c8ad20b5035eb73d8efc66483fd34b95c15d028403102fd79fb222c97

SHA512
eabd18c473790ad4553e83a06a58f64604dd3a6843673fe41cc179b09ea7555151e72fcfde5e08b87e21273a74bf8197553073fbd4e3e32045ff8a9a91130434

Download Submit
C:\Windows\System\VXLgGFU.exe

Filesize
1.3MB

MD5
3a00e4da61f75c77654cc16fc794e8b8

SHA1
b15a1c16a412c581b64961f64ad4b89c5d4bf1b8

SHA256
ddf9cef55b00a56acc59b10b72c95280eb12f810afab75142b913c7345ffc556

SHA512
abda69e1ccba7151d2ed11099189fcac478b98c76b0395d93eb283658d07be6453ef6366b922a292340cc0faa5dd601898f52f6ff38688a70cb8cce20535cb60

Download Submit
C:\Windows\System\aWqGZnd.exe

Filesize
1.3MB

MD5
8898107fa31d05ea969611da0d211bfb

SHA1
2089022f35680cfbb521eda4dadeb7b74580792e

SHA256
9d9a7a77ff9a65167103aa4b6394d84f6a5e0dd733f37106414664265ff939c6

SHA512
4d98d9c625d28df477d22d00137351086e3e08b872fe472fb37b15bce37d40402b4a96fc98f7845b49550b46115e4ee6b3249f92b90a8f27d61d0bf2a79bc067

Download Submit
C:\Windows\System\aqwiyZJ.exe

Filesize
1.3MB

MD5
3a2a4f91210aa36d3a37c704e3ea443c

SHA1
17ff3a145d0a22e0eb68f2d8e6c35347cfde7a39

SHA256
818c19ca68cd5c8791c972073062b4d5bfa8472c306468f16887dbf1fe94d28e

SHA512
e162bbf5f73be63f234c7f494777542592130cd457ae7f3cdbb020522d4372856cd4e9e76a95fb85d4ad5809a2554c63cfa1e40c8c48ea9dbf540eeb93444f06

Download Submit
C:\Windows\System\bkyjjbH.exe

Filesize
1.3MB

MD5
3d6788ec83a8f9dfaf99c7f9ee058991

SHA1
3bc4dc9180ff4381643313bdd5ff44b4a529c5e1

SHA256
d0f8767662795dd54b09e58fe3b4622bfdb0f82c5eceb696e5a05d949b20fa15

SHA512
bdaf30a4d28c72d731d384a280e09aee7b91f72ff2e70ff1e33942ee76fd74779d2d32350fb948a23180f2f869e6aef8fd7428baf489c37a272e94b95d665b10

Download Submit
C:\Windows\System\enKBtdq.exe

Filesize
1.3MB

MD5
0e9b334e43c3d8abf05fa657c3308ca0

SHA1
1d7f56273e925a23f750177f6e8dad03774c6036

SHA256
b0d7313a06d6aaab34cac7c798cc4a3f6a461ce8b074102f44a3adca3f76ae69

SHA512
408e796d7d0656aa273179d7c9904e8e7db681f9797b5f61edad669c865df16ff24f7690fc77c573d14da75771f064e33e427c3d2ffd2bb0b5eef91b5457cfaf

Download Submit
C:\Windows\System\eyDZUxa.exe

Filesize
1.3MB

MD5
41cfa41e43aa4212f573f5cf9bde82ed

SHA1
27f43d8be8b1591ea4eefa15b883fa458acd55e1

SHA256
2333a5f20bce19f1d8a1183ce737f71bb93e6223ff40b993527af3372643adc0

SHA512
0c7f705e227f56a4b286fe2f498ffff6ec76bd766cc7874e4b7f141816f6f646ebf347363f21bf0370403ff5da159769b8ae7b6782e593d31f7d97a4e264fdae

Download Submit
C:\Windows\System\fsvuqWS.exe

Filesize
1.3MB

MD5
145eb00340be0108dc0c995cf6158cab

SHA1
f56d6b5cc6eca892feae6decc87518ed5bf35f55

SHA256
1e120b4acdd9cbae7c28dd6091ac280fd9e0be55b5b4a67c7c561bf890fbfd3a

SHA512
923a710d9cae7b354e3426183950fc38932f801350638c45c7ee78045e1b8d46cfdfec9079077833b0fb08ae3e8f422f322f6c7df23296ec1c8f18a22fced0c8

Download Submit
C:\Windows\System\getAYNF.exe

Filesize
1.3MB

MD5
27807850fdd0e46eb719729100fba9db

SHA1
3cee2665e34e51b13b6bb9447e39945564cf89bc

SHA256
85bba073841430615ff99023b7a52b64f8ac03ebd7ea3d992afd5ddbf4c78482

SHA512
a5f7639efc719f385a389f94b413b5cafff85031a085a5ad4cbcef14a28d36c135548ff9b9f70a54ca996bb8ef70ed91585dda67246a404ac4ebab939e8866eb

Download Submit
C:\Windows\System\hmYYjlO.exe

Filesize
1.3MB

MD5
528724cdfa40f8d5da0e9e5b69007fb8

SHA1
97ced36e9a1b72d1c55e14abd1cc269b3e93086d

SHA256
1e8e0223aff9e6276e891a3a06ebd4970949fda094e45fed26f6ad084b333be2

SHA512
6e3b92ff82239afbd3ce4097a18c087b3d4c4667161365c9cb4f3f2b7d1ab24b13e243f6a491ee23e3262a217576169aa80c7fa86576206a6df929dbf01a8e3a

Download Submit
C:\Windows\System\kldjoAd.exe

Filesize
1.3MB

MD5
9d4bc265326d733e87c7db74837fb997

SHA1
d7353d0be5c360ec1365247b7a1459a2fe956310

SHA256
bdeac65e7d3956560d22bab662b919233eee21c0c8d484e24f06473969661461

SHA512
0443587b01b9ef70cc4f13abb3b830542e8e66292089258844c4c6c87575cf5275cce2fc6675273cceeb8699c9ffce2c3bb78961e4f0b9c6f15fcd185f89bb9b

Download Submit
C:\Windows\System\oXEdVGf.exe

Filesize
1.3MB

MD5
d0ba7a2bad6deb191da7c6b94985ff8a

SHA1
a42a28fefa8c0ddace3f6363f4b834ec2dba1f31

SHA256
520cff9d5d95e5d10d2ef1a07a2b5389a12f888cbed3b4eb4cc9b4f523c0244e

SHA512
80ba11713f32ba2c2138497abc7ab8dc6df68457db02ee33602885e8dbc044b9eb3575a44fe98c423b563ddc0076c66638e5ca7b52eb12a10d3a3cf641dae57f

Download Submit
C:\Windows\System\qZUUASl.exe

Filesize
1.3MB

MD5
ce1ec8187d50a2e2f83a4256bc688dd1

SHA1
27ad08475ff865e9af33a278fd170f6da033e6b6

SHA256
78caa796fa3300d13beee7ec984a4da260ff32287d4d1e8a6fc4b9b2a8812e2c

SHA512
22a4049362d83204f5494812f04dd3cdb0ed70fe4f59c3a2c802ae7441e7d675b6bc98438ec023e064500d95715a38b0f24b0a8627908e58cba48180fc457024

Download Submit
C:\Windows\System\rhUmYar.exe

Filesize
1.3MB

MD5
1e336e888579b4843a51962b1a746363

SHA1
45e93a76efe9afabc198b39aea00ff4f06c718a4

SHA256
417737735b593f0706fd43e896647ed34899c7e17a283588890d0556900b58b3

SHA512
54786c786d886cafc02c92dd4459a79b3122a456e96cf45ccda73b13969f1cc688d3e2722257769e51b4d377b7e14fdcc8de5539427e3df60cd430e536dd6056

Download Submit
C:\Windows\System\tAVYHTR.exe

Filesize
1.3MB

MD5
fc5911558420d6de6e496c111db980cd

SHA1
706bb422eddbf9fd0c3822208a511e3934af6266

SHA256
83ad4937fa1964039c214ceb3b9ff68c88e2a02931c22696413bb2048dc5c928

SHA512
719cf863f644d797b7654ccca64fa8cd06752dd9cc2dcf119de05da414d84613eaa5a57175f2b1590b82e6f2a5595ea7053f5cb839faf4b9cbc32e00018c8c01

Download Submit
C:\Windows\System\tBKOsHh.exe

Filesize
1.3MB

MD5
9a63381c04d01f6e0a6715b73b8c99af

SHA1
f3046aac75a7c539320dd83779ba85a1b0b4be98

SHA256
2c0165671bf81ac918e03db16c2f4a0e82d262d9a8b6b04786ad5c7417f724a6

SHA512
9a486eca37186a2937c378575b6562a763e07e8c851b44311ad5f1077a36b9a7877a3feb9431ded8d5f2e7eda44f587388b054bacc1e5b7e97df42e71745ece9

Download Submit
C:\Windows\System\tSxRZvl.exe

Filesize
1.3MB

MD5
907191999ddedfaa377274f0bcfdd1ee

SHA1
cde9f20cc27da1f939488151893ed19481b7c732

SHA256
8a60d3731c243ea739a8a5580763c7a5826b000c88b83bb9b7bfb30b48139561

SHA512
c90c937aee4e7dc382f8068064f866ce05880eb0b2ce6ebec7c8f759b681c0c27a63540bec587764152094557466f4a6a86fe4f1fd168d0de6b47960d60d0dd1

Download Submit
C:\Windows\System\uAfkCYC.exe

Filesize
1.3MB

MD5
b8168780b307f4cd3c0a9cd965ef3576

SHA1
2ca05c5c96b5fd7b723c40edfe69aab0becbd31e

SHA256
8e8e804d2c1ab41d4565bc4a4761dbb2fb7680a353b2d4319f580500688060fb

SHA512
bf1299701d2aff467797df599a582eb861b504f690b3308210858f754867a8eeca88688cede4ee3b59925943e49f9bf211c8c722ca7567b6f7d953a61464528b

Download Submit
C:\Windows\System\vhRrxiP.exe

Filesize
1.3MB

MD5
707bac31445da6c59c450f5e680e6607

SHA1
c43e61c823625b8c78ad065ded8e2b98dc14dd08

SHA256
766f86b6193ff5c70ce2c4d028c550049006495f76138f09b6dad584b8f74630

SHA512
66254f9cfa13ab34b82850f5287279dfe93a943406b776bf7a487914d62e022d570b7e4cfef55f19142fc060cda13465f440191390554d0b93feb0fb029f7b37

Download Submit
C:\Windows\System\vqJMyUG.exe

Filesize
1.3MB

MD5
26b616df875f850fd386064e6447e12c

SHA1
bf54d9ce5b3ea4febcbab9b7197f5dd519b784ee

SHA256
1f6322f85170b2eb43f7500ab62ee11812748bc55a421738ab714bf86bdccc38

SHA512
180a3149033ef6fe246ac28c2213f01ae68aba24d42a8435b0c2544a0b6886c31f3d02ca66763ef866445b99933a7cedff41b996b1951d7e8dad98e7e1a860a6

Download Submit
C:\Windows\System\yAnbaDT.exe

Filesize
1.3MB

MD5
927286ade41854317953c2288e245b47

SHA1
1fc009b0217a3bbfa3d87cd20c1dbbc92d900d60

SHA256
2a7aae20f8a121f537c7a659a2936b67e40db5240aa28a6753f89698b3d06f3f

SHA512
bd62d628e72dc547b3d7cb7a67ddab82f0ab1f1038fc50e0d0867f68b31954cd90b40a9da8e1207aaa909b41085acdfd2a2663461325dcb325cd006b6f89c399

Download Submit
C:\Windows\System\ziAHUxy.exe

Filesize
1.3MB

MD5
5088e1dc0496b872f9ea42acf9639827

SHA1
c43a44240d9edc79143e7a7b3192e4da2081ac0e

SHA256
30e8270be31d781646f16cbc10a0f6981a7c02cab25db6e2d92aa5827a61240d

SHA512
cf59b4f146507a99dfdbfd81cfbb2efb44b9e939ceeb56aae94e36b1feacc32ea16040754c1f26fcfe95a4b7f0da4f6d9aaee24955b186ef980140d85e7e70a9

Download Submit
memory/824-150-0x00007FF740F90000-0x00007FF741382000-memory.dmp

Filesize
3.9MB

Download
memory/824-2634-0x00007FF740F90000-0x00007FF741382000-memory.dmp

Filesize
3.9MB

Download
memory/824-2742-0x00007FF740F90000-0x00007FF741382000-memory.dmp

Filesize
3.9MB

Download
memory/928-2718-0x00007FF6DEEC0000-0x00007FF6DF2B2000-memory.dmp

Filesize
3.9MB

Download
memory/928-664-0x00007FF6DEEC0000-0x00007FF6DF2B2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-289-0x00007FF65B840000-0x00007FF65BC32000-memory.dmp

Filesize
3.9MB

Download
memory/1108-2743-0x00007FF65B840000-0x00007FF65BC32000-memory.dmp

Filesize
3.9MB

Download
memory/1164-2715-0x00007FF69E0C0000-0x00007FF69E4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1164-2619-0x00007FF69E0C0000-0x00007FF69E4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1164-40-0x00007FF69E0C0000-0x00007FF69E4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-240-0x00007FF71F1E0000-0x00007FF71F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1204-2722-0x00007FF71F1E0000-0x00007FF71F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-347-0x00007FF6B4D00000-0x00007FF6B50F2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-2762-0x00007FF6B4D00000-0x00007FF6B50F2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-662-0x00007FF6F23C0000-0x00007FF6F27B2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-2767-0x00007FF6F23C0000-0x00007FF6F27B2000-memory.dmp

Filesize
3.9MB

Download
memory/2092-0-0x00007FF713C20000-0x00007FF714012000-memory.dmp

Filesize
3.9MB

Download
memory/2092-2598-0x00007FF713C20000-0x00007FF714012000-memory.dmp

Filesize
3.9MB

Download
memory/2092-1-0x000001E7D4170000-0x000001E7D4180000-memory.dmp

Filesize
64KB

Download
memory/2156-660-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-2738-0x00007FF61E6C0000-0x00007FF61EAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2316-665-0x00007FF612980000-0x00007FF612D72000-memory.dmp

Filesize
3.9MB

Download
memory/2316-2754-0x00007FF612980000-0x00007FF612D72000-memory.dmp

Filesize
3.9MB

Download
memory/2324-2620-0x00007FF684200000-0x00007FF6845F2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-2724-0x00007FF684200000-0x00007FF6845F2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-76-0x00007FF684200000-0x00007FF6845F2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-2740-0x00007FF708B50000-0x00007FF708F42000-memory.dmp

Filesize
3.9MB

Download
memory/2820-393-0x00007FF708B50000-0x00007FF708F42000-memory.dmp

Filesize
3.9MB

Download
memory/2908-43-0x00007FF6D97A0000-0x00007FF6D9B92000-memory.dmp

Filesize
3.9MB

Download
memory/2908-2704-0x00007FF6D97A0000-0x00007FF6D9B92000-memory.dmp

Filesize
3.9MB

Download
memory/2980-18-0x00007FF650910000-0x00007FF650D02000-memory.dmp

Filesize
3.9MB

Download
memory/2980-2607-0x00007FF650910000-0x00007FF650D02000-memory.dmp

Filesize
3.9MB

Download
memory/2980-2690-0x00007FF650910000-0x00007FF650D02000-memory.dmp

Filesize
3.9MB

Download
memory/3428-663-0x00007FF887D13000-0x00007FF887D15000-memory.dmp

Filesize
8KB

Download
memory/3428-21-0x000001B219C80000-0x000001B219C90000-memory.dmp

Filesize
64KB

Download
memory/3428-507-0x000001B27FE70000-0x000001B27FE92000-memory.dmp

Filesize
136KB

Download
memory/3504-481-0x00007FF69A310000-0x00007FF69A702000-memory.dmp

Filesize
3.9MB

Download
memory/3504-2716-0x00007FF69A310000-0x00007FF69A702000-memory.dmp

Filesize
3.9MB

Download
memory/3864-2736-0x00007FF67ED40000-0x00007FF67F132000-memory.dmp

Filesize
3.9MB

Download
memory/3864-654-0x00007FF67ED40000-0x00007FF67F132000-memory.dmp

Filesize
3.9MB

Download
memory/3960-2765-0x00007FF7349A0000-0x00007FF734D92000-memory.dmp

Filesize
3.9MB

Download
memory/3960-656-0x00007FF7349A0000-0x00007FF734D92000-memory.dmp

Filesize
3.9MB

Download
memory/4064-653-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2775-0x00007FF6BBB40000-0x00007FF6BBF32000-memory.dmp

Filesize
3.9MB

Download
memory/4080-2760-0x00007FF7033E0000-0x00007FF7037D2000-memory.dmp

Filesize
3.9MB

Download
memory/4080-658-0x00007FF7033E0000-0x00007FF7037D2000-memory.dmp

Filesize
3.9MB

Download
memory/4212-655-0x00007FF60C380000-0x00007FF60C772000-memory.dmp

Filesize
3.9MB

Download
memory/4212-2750-0x00007FF60C380000-0x00007FF60C772000-memory.dmp

Filesize
3.9MB

Download
memory/4344-2752-0x00007FF640960000-0x00007FF640D52000-memory.dmp

Filesize
3.9MB

Download
memory/4344-666-0x00007FF640960000-0x00007FF640D52000-memory.dmp

Filesize
3.9MB

Download
memory/4516-2748-0x00007FF664420000-0x00007FF664812000-memory.dmp

Filesize
3.9MB

Download
memory/4516-657-0x00007FF664420000-0x00007FF664812000-memory.dmp

Filesize
3.9MB

Download
memory/4792-2757-0x00007FF6589A0000-0x00007FF658D92000-memory.dmp

Filesize
3.9MB

Download
memory/4792-661-0x00007FF6589A0000-0x00007FF658D92000-memory.dmp

Filesize
3.9MB

Download
memory/4944-2720-0x00007FF6990A0000-0x00007FF699492000-memory.dmp

Filesize
3.9MB

Download
memory/4944-116-0x00007FF6990A0000-0x00007FF699492000-memory.dmp

Filesize
3.9MB

Download
memory/5088-2759-0x00007FF7B7630000-0x00007FF7B7A22000-memory.dmp

Filesize
3.9MB

Download
memory/5088-659-0x00007FF7B7630000-0x00007FF7B7A22000-memory.dmp

Filesize
3.9MB

Download