xmrig | c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af

Analysis

max time kernel
135s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
Size

1.7MB
MD5

0d429bb7db14db9a2555843abb237e84
SHA1

a02cbaad610299c993882b6bf61a4541bc678942
SHA256

c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af
SHA512

35bc149d2ef792e06576487a7f759e33ca3706bba4a8bb23c19c1da27824712f7515fbe0871a971f8fc6dc7197551007d65d0961da1d85f2b12c020b47b64fe8
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFte:Lz071uv4BPMkibTIA5I4TNrpDGK/J

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 21 IoCs

miner

resource	yara_rule
behavioral2/memory/2028-393-0x00007FF7F6330000-0x00007FF7F6722000-memory.dmp	xmrig
behavioral2/memory/100-394-0x00007FF7EDEF0000-0x00007FF7EE2E2000-memory.dmp	xmrig
behavioral2/memory/592-1707-0x00007FF603C60000-0x00007FF604052000-memory.dmp	xmrig
behavioral2/memory/212-1622-0x00007FF653460000-0x00007FF653852000-memory.dmp	xmrig
behavioral2/memory/4908-856-0x00007FF6E3C20000-0x00007FF6E4012000-memory.dmp	xmrig
behavioral2/memory/2688-717-0x00007FF697F90000-0x00007FF698382000-memory.dmp	xmrig
behavioral2/memory/5016-574-0x00007FF608690000-0x00007FF608A82000-memory.dmp	xmrig
behavioral2/memory/216-569-0x00007FF615700000-0x00007FF615AF2000-memory.dmp	xmrig
behavioral2/memory/2264-313-0x00007FF678050000-0x00007FF678442000-memory.dmp	xmrig
behavioral2/memory/812-236-0x00007FF653590000-0x00007FF653982000-memory.dmp	xmrig
behavioral2/memory/3460-2943-0x00007FF66D920000-0x00007FF66DD12000-memory.dmp	xmrig
behavioral2/memory/812-2956-0x00007FF653590000-0x00007FF653982000-memory.dmp	xmrig
behavioral2/memory/2264-2955-0x00007FF678050000-0x00007FF678442000-memory.dmp	xmrig
behavioral2/memory/100-2959-0x00007FF7EDEF0000-0x00007FF7EE2E2000-memory.dmp	xmrig
behavioral2/memory/216-2961-0x00007FF615700000-0x00007FF615AF2000-memory.dmp	xmrig
behavioral2/memory/5016-2963-0x00007FF608690000-0x00007FF608A82000-memory.dmp	xmrig
behavioral2/memory/4908-2967-0x00007FF6E3C20000-0x00007FF6E4012000-memory.dmp	xmrig
behavioral2/memory/212-2969-0x00007FF653460000-0x00007FF653852000-memory.dmp	xmrig
behavioral2/memory/592-2974-0x00007FF603C60000-0x00007FF604052000-memory.dmp	xmrig
behavioral2/memory/2688-2976-0x00007FF697F90000-0x00007FF698382000-memory.dmp	xmrig
behavioral2/memory/2028-2972-0x00007FF7F6330000-0x00007FF7F6722000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3624	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3460	cbcesxD.exe
3544	AgXGacn.exe
3200	ROOYtcF.exe
812	BXnwQbx.exe
2264	JvGjkjy.exe
2028	DQWGmcr.exe
100	hZbCNJq.exe
216	IeVIURD.exe
5016	auWuCfC.exe
2688	axvmNva.exe
4908	sznWaAm.exe
212	ywElQVN.exe
592	EYPdBTL.exe
1716	btTPJWx.exe
3520	HIqeFqn.exe
1460	lZpiUfH.exe
4532	VIrCVkc.exe
2144	fPoSNSy.exe
2584	RbBOuOC.exe
2444	LPstoGb.exe
3416	ZPZWRWr.exe
4284	JFRFoEi.exe
220	zpczxXU.exe
2760	BeGMFKC.exe
3952	ACwELBb.exe
3132	pKeuUdy.exe
4796	LoDzfXS.exe
2172	kInJqXJ.exe
1608	igKKzNz.exe
972	lbwEfrw.exe
2352	QdDlQwh.exe
3592	SvakAsx.exe
4740	KLbWzgV.exe
4000	khdOXmr.exe
1924	KNUPrrH.exe
692	DjtXUZu.exe
320	iasWXxG.exe
1840	MQcFQHu.exe
1616	hhmclkB.exe
1424	TyLwQJT.exe
1284	YrPrlxg.exe
4236	NbvlZjD.exe
2504	HMKAycr.exe
4088	KxYUuqM.exe
4136	NIXixuY.exe
556	bGRivxp.exe
3588	zCkHqMK.exe
1764	pSPfAlI.exe
2240	ZvtYRHY.exe
1628	tTzkwjz.exe
4004	PwXdMjo.exe
4856	Pvjhjam.exe
2868	HQcfZYG.exe
412	dDjrxcC.exe
1484	IxPFznm.exe
4516	XgCeutd.exe
1876	WMTDWcQ.exe
4472	oLlJLWE.exe
4052	nbhBTXy.exe
2724	CQUZxNe.exe
1712	zHolOyk.exe
2120	PgWZtCE.exe
1396	xNcEEij.exe
3760	PDurrQZ.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3344-0-0x00007FF6310E0000-0x00007FF6314D2000-memory.dmp	upx
behavioral2/files/0x00070000000234a8-33.dat	upx
behavioral2/files/0x00070000000234ac-45.dat	upx
behavioral2/files/0x00070000000234ae-55.dat	upx
behavioral2/memory/2028-393-0x00007FF7F6330000-0x00007FF7F6722000-memory.dmp	upx
behavioral2/memory/100-394-0x00007FF7EDEF0000-0x00007FF7EE2E2000-memory.dmp	upx
behavioral2/memory/592-1707-0x00007FF603C60000-0x00007FF604052000-memory.dmp	upx
behavioral2/memory/212-1622-0x00007FF653460000-0x00007FF653852000-memory.dmp	upx
behavioral2/memory/4908-856-0x00007FF6E3C20000-0x00007FF6E4012000-memory.dmp	upx
behavioral2/memory/2688-717-0x00007FF697F90000-0x00007FF698382000-memory.dmp	upx
behavioral2/memory/5016-574-0x00007FF608690000-0x00007FF608A82000-memory.dmp	upx
behavioral2/memory/216-569-0x00007FF615700000-0x00007FF615AF2000-memory.dmp	upx
behavioral2/memory/2264-313-0x00007FF678050000-0x00007FF678442000-memory.dmp	upx
behavioral2/files/0x00070000000234bc-213.dat	upx
behavioral2/files/0x00070000000234ca-210.dat	upx
behavioral2/files/0x00070000000234c9-204.dat	upx
behavioral2/files/0x00080000000234a5-199.dat	upx
behavioral2/files/0x00070000000234c8-198.dat	upx
behavioral2/memory/812-236-0x00007FF653590000-0x00007FF653982000-memory.dmp	upx
behavioral2/files/0x00070000000234ba-184.dat	upx
behavioral2/files/0x00070000000234b9-181.dat	upx
behavioral2/files/0x00070000000234b7-174.dat	upx
behavioral2/files/0x00070000000234bf-170.dat	upx
behavioral2/files/0x00070000000234c6-165.dat	upx
behavioral2/files/0x00070000000234bd-162.dat	upx
behavioral2/files/0x00070000000234c4-136.dat	upx
behavioral2/files/0x00070000000234c3-135.dat	upx
behavioral2/files/0x00070000000234c2-134.dat	upx
behavioral2/files/0x00070000000234c5-132.dat	upx
behavioral2/files/0x00070000000234c1-126.dat	upx
behavioral2/files/0x00070000000234c0-125.dat	upx
behavioral2/files/0x00070000000234bb-191.dat	upx
behavioral2/files/0x00070000000234b8-177.dat	upx
behavioral2/files/0x00070000000234b3-103.dat	upx
behavioral2/files/0x00070000000234b2-97.dat	upx
behavioral2/files/0x00070000000234b1-93.dat	upx
behavioral2/files/0x00070000000234b5-123.dat	upx
behavioral2/files/0x00070000000234b6-122.dat	upx
behavioral2/files/0x00070000000234be-118.dat	upx
behavioral2/files/0x00070000000234ad-74.dat	upx
behavioral2/files/0x00070000000234b4-77.dat	upx
behavioral2/files/0x00070000000234b0-76.dat	upx
behavioral2/files/0x00070000000234af-49.dat	upx
behavioral2/files/0x00070000000234ab-39.dat	upx
behavioral2/files/0x00070000000234aa-27.dat	upx
behavioral2/files/0x000900000002344c-19.dat	upx
behavioral2/files/0x00070000000234a9-16.dat	upx
behavioral2/memory/3460-11-0x00007FF66D920000-0x00007FF66DD12000-memory.dmp	upx
behavioral2/memory/3460-2943-0x00007FF66D920000-0x00007FF66DD12000-memory.dmp	upx
behavioral2/memory/812-2956-0x00007FF653590000-0x00007FF653982000-memory.dmp	upx
behavioral2/memory/2264-2955-0x00007FF678050000-0x00007FF678442000-memory.dmp	upx
behavioral2/memory/100-2959-0x00007FF7EDEF0000-0x00007FF7EE2E2000-memory.dmp	upx
behavioral2/memory/216-2961-0x00007FF615700000-0x00007FF615AF2000-memory.dmp	upx
behavioral2/memory/5016-2963-0x00007FF608690000-0x00007FF608A82000-memory.dmp	upx
behavioral2/memory/4908-2967-0x00007FF6E3C20000-0x00007FF6E4012000-memory.dmp	upx
behavioral2/memory/212-2969-0x00007FF653460000-0x00007FF653852000-memory.dmp	upx
behavioral2/memory/592-2974-0x00007FF603C60000-0x00007FF604052000-memory.dmp	upx
behavioral2/memory/2688-2976-0x00007FF697F90000-0x00007FF698382000-memory.dmp	upx
behavioral2/memory/2028-2972-0x00007FF7F6330000-0x00007FF7F6722000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BDFYSOq.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\rsnpogh.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\zEXMzcB.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\DoPYsNk.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\WQKzgfx.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\svOFfoP.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\ZRKnDiY.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\CFlZZjb.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\veHPsgQ.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\pZElPgZ.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\yNYJnRb.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\RrOIxtZ.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\afkJCMG.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\wVxdJgD.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\cKtdqYt.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\aPnJzhn.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\nxzCrpK.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\GwvTUrA.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\FzdYwLc.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\BQOFnul.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\zpczxXU.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\RmeVEeP.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\EvvLicS.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\wDWyWBD.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\hGmajAY.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\DzCPfQA.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\IKImLII.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\uoWpWEk.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\sFSfCyX.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\zwwBQTV.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\MAESdXy.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\zCuuKDq.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\IHnldlO.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\msRTDWq.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\CBdRntm.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\zTfwjOO.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\Wmecgpa.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\HJHDaRc.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\UlMUndv.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\LGWLnjW.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\paWsGhM.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\jtSbfeK.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\pSPfAlI.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\mwJjuUP.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\xtVLkfy.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\NEfdHnE.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\VZbtWwa.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\GQasDxU.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\dyadxeM.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\muBerwZ.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\HSZVZXr.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\ytOCNlh.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\kkRRloO.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\ToiKYHU.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\cKzdrJb.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\KCkQYTA.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\oHdIZXa.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\pOkZleh.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\SEZzeQg.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\BeGMFKC.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\KxYUuqM.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\xXssycL.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\AmFoSqV.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
File created	C:\Windows\System\cvBggCG.exe	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeLockMemoryPrivilege	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
Token: SeLockMemoryPrivilege	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3624	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	85
PID 3344 wrote to memory of 3624	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	85
PID 3344 wrote to memory of 3460	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	86
PID 3344 wrote to memory of 3460	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	86
PID 3344 wrote to memory of 3544	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	87
PID 3344 wrote to memory of 3544	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	87
PID 3344 wrote to memory of 3200	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	88
PID 3344 wrote to memory of 3200	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	88
PID 3344 wrote to memory of 812	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	89
PID 3344 wrote to memory of 812	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	89
PID 3344 wrote to memory of 2264	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	90
PID 3344 wrote to memory of 2264	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	90
PID 3344 wrote to memory of 2028	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	91
PID 3344 wrote to memory of 2028	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	91
PID 3344 wrote to memory of 216	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	92
PID 3344 wrote to memory of 216	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	92
PID 3344 wrote to memory of 4908	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	93
PID 3344 wrote to memory of 4908	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	93
PID 3344 wrote to memory of 100	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	94
PID 3344 wrote to memory of 100	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	94
PID 3344 wrote to memory of 5016	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	95
PID 3344 wrote to memory of 5016	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	95
PID 3344 wrote to memory of 2688	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	96
PID 3344 wrote to memory of 2688	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	96
PID 3344 wrote to memory of 1716	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	97
PID 3344 wrote to memory of 1716	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	97
PID 3344 wrote to memory of 3520	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	98
PID 3344 wrote to memory of 3520	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	98
PID 3344 wrote to memory of 212	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	99
PID 3344 wrote to memory of 212	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	99
PID 3344 wrote to memory of 592	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	100
PID 3344 wrote to memory of 592	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	100
PID 3344 wrote to memory of 3952	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	101
PID 3344 wrote to memory of 3952	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	101
PID 3344 wrote to memory of 1460	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	102
PID 3344 wrote to memory of 1460	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	102
PID 3344 wrote to memory of 4532	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	103
PID 3344 wrote to memory of 4532	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	103
PID 3344 wrote to memory of 2144	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	104
PID 3344 wrote to memory of 2144	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	104
PID 3344 wrote to memory of 2584	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	105
PID 3344 wrote to memory of 2584	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	105
PID 3344 wrote to memory of 2444	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	106
PID 3344 wrote to memory of 2444	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	106
PID 3344 wrote to memory of 3416	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	107
PID 3344 wrote to memory of 3416	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	107
PID 3344 wrote to memory of 4284	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	108
PID 3344 wrote to memory of 4284	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	108
PID 3344 wrote to memory of 220	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	109
PID 3344 wrote to memory of 220	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	109
PID 3344 wrote to memory of 2760	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	110
PID 3344 wrote to memory of 2760	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	110
PID 3344 wrote to memory of 3132	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	111
PID 3344 wrote to memory of 3132	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	111
PID 3344 wrote to memory of 4796	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	112
PID 3344 wrote to memory of 4796	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	112
PID 3344 wrote to memory of 2172	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	113
PID 3344 wrote to memory of 2172	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	113
PID 3344 wrote to memory of 1608	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	114
PID 3344 wrote to memory of 1608	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	114
PID 3344 wrote to memory of 972	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	115
PID 3344 wrote to memory of 972	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	115
PID 3344 wrote to memory of 2352	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	116
PID 3344 wrote to memory of 2352	3344	c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe	116

C:\Users\Admin\AppData\Local\Temp\c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe
"C:\Users\Admin\AppData\Local\Temp\c68e2a81056c4061356cc160030ea99fcc875674eedcb9780d720570f32d63af.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\System\cbcesxD.exe
  C:\Windows\System\cbcesxD.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\AgXGacn.exe
  C:\Windows\System\AgXGacn.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\ROOYtcF.exe
  C:\Windows\System\ROOYtcF.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\BXnwQbx.exe
  C:\Windows\System\BXnwQbx.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\JvGjkjy.exe
  C:\Windows\System\JvGjkjy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\DQWGmcr.exe
  C:\Windows\System\DQWGmcr.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\IeVIURD.exe
  C:\Windows\System\IeVIURD.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\sznWaAm.exe
  C:\Windows\System\sznWaAm.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\hZbCNJq.exe
  C:\Windows\System\hZbCNJq.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\auWuCfC.exe
  C:\Windows\System\auWuCfC.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\axvmNva.exe
  C:\Windows\System\axvmNva.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\btTPJWx.exe
  C:\Windows\System\btTPJWx.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\HIqeFqn.exe
  C:\Windows\System\HIqeFqn.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\ywElQVN.exe
  C:\Windows\System\ywElQVN.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\EYPdBTL.exe
  C:\Windows\System\EYPdBTL.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ACwELBb.exe
  C:\Windows\System\ACwELBb.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\lZpiUfH.exe
  C:\Windows\System\lZpiUfH.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\VIrCVkc.exe
  C:\Windows\System\VIrCVkc.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\fPoSNSy.exe
  C:\Windows\System\fPoSNSy.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\RbBOuOC.exe
  C:\Windows\System\RbBOuOC.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\LPstoGb.exe
  C:\Windows\System\LPstoGb.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ZPZWRWr.exe
  C:\Windows\System\ZPZWRWr.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\JFRFoEi.exe
  C:\Windows\System\JFRFoEi.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\zpczxXU.exe
  C:\Windows\System\zpczxXU.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\BeGMFKC.exe
  C:\Windows\System\BeGMFKC.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\pKeuUdy.exe
  C:\Windows\System\pKeuUdy.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\LoDzfXS.exe
  C:\Windows\System\LoDzfXS.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\kInJqXJ.exe
  C:\Windows\System\kInJqXJ.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\igKKzNz.exe
  C:\Windows\System\igKKzNz.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\lbwEfrw.exe
  C:\Windows\System\lbwEfrw.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\QdDlQwh.exe
  C:\Windows\System\QdDlQwh.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\SvakAsx.exe
  C:\Windows\System\SvakAsx.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\NbvlZjD.exe
  C:\Windows\System\NbvlZjD.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\KLbWzgV.exe
  C:\Windows\System\KLbWzgV.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\khdOXmr.exe
  C:\Windows\System\khdOXmr.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\KNUPrrH.exe
  C:\Windows\System\KNUPrrH.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\DjtXUZu.exe
  C:\Windows\System\DjtXUZu.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\iasWXxG.exe
  C:\Windows\System\iasWXxG.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\MQcFQHu.exe
  C:\Windows\System\MQcFQHu.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\hhmclkB.exe
  C:\Windows\System\hhmclkB.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\TyLwQJT.exe
  C:\Windows\System\TyLwQJT.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\YrPrlxg.exe
  C:\Windows\System\YrPrlxg.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\HMKAycr.exe
  C:\Windows\System\HMKAycr.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\KxYUuqM.exe
  C:\Windows\System\KxYUuqM.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\WMTDWcQ.exe
  C:\Windows\System\WMTDWcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\NIXixuY.exe
  C:\Windows\System\NIXixuY.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\bGRivxp.exe
  C:\Windows\System\bGRivxp.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\zCkHqMK.exe
  C:\Windows\System\zCkHqMK.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\pSPfAlI.exe
  C:\Windows\System\pSPfAlI.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\zHolOyk.exe
  C:\Windows\System\zHolOyk.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ZvtYRHY.exe
  C:\Windows\System\ZvtYRHY.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tTzkwjz.exe
  C:\Windows\System\tTzkwjz.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\PwXdMjo.exe
  C:\Windows\System\PwXdMjo.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\Pvjhjam.exe
  C:\Windows\System\Pvjhjam.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\HQcfZYG.exe
  C:\Windows\System\HQcfZYG.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\dDjrxcC.exe
  C:\Windows\System\dDjrxcC.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\IxPFznm.exe
  C:\Windows\System\IxPFznm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\XgCeutd.exe
  C:\Windows\System\XgCeutd.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\oLlJLWE.exe
  C:\Windows\System\oLlJLWE.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\nbhBTXy.exe
  C:\Windows\System\nbhBTXy.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\CQUZxNe.exe
  C:\Windows\System\CQUZxNe.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\PgWZtCE.exe
  C:\Windows\System\PgWZtCE.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\xNcEEij.exe
  C:\Windows\System\xNcEEij.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\PDurrQZ.exe
  C:\Windows\System\PDurrQZ.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\gPWyfGW.exe
  C:\Windows\System\gPWyfGW.exe
  2⤵
  PID:116
- C:\Windows\System\PeRoKyh.exe
  C:\Windows\System\PeRoKyh.exe
  2⤵
  PID:408
- C:\Windows\System\wNqTUlr.exe
  C:\Windows\System\wNqTUlr.exe
  2⤵
  PID:2092
- C:\Windows\System\xGpjSTE.exe
  C:\Windows\System\xGpjSTE.exe
  2⤵
  PID:3232
- C:\Windows\System\oXBQOUu.exe
  C:\Windows\System\oXBQOUu.exe
  2⤵
  PID:3964
- C:\Windows\System\ODfATKi.exe
  C:\Windows\System\ODfATKi.exe
  2⤵
  PID:1696
- C:\Windows\System\frCiqoW.exe
  C:\Windows\System\frCiqoW.exe
  2⤵
  PID:4592
- C:\Windows\System\HSZVZXr.exe
  C:\Windows\System\HSZVZXr.exe
  2⤵
  PID:1784
- C:\Windows\System\rMbYHLo.exe
  C:\Windows\System\rMbYHLo.exe
  2⤵
  PID:3236
- C:\Windows\System\TCjvQwI.exe
  C:\Windows\System\TCjvQwI.exe
  2⤵
  PID:4884
- C:\Windows\System\areQNmk.exe
  C:\Windows\System\areQNmk.exe
  2⤵
  PID:2568
- C:\Windows\System\NZDuZtL.exe
  C:\Windows\System\NZDuZtL.exe
  2⤵
  PID:2912
- C:\Windows\System\EtvRPze.exe
  C:\Windows\System\EtvRPze.exe
  2⤵
  PID:1532
- C:\Windows\System\faWIvoS.exe
  C:\Windows\System\faWIvoS.exe
  2⤵
  PID:4760
- C:\Windows\System\sLwDbSg.exe
  C:\Windows\System\sLwDbSg.exe
  2⤵
  PID:5132
- C:\Windows\System\PbLJgyu.exe
  C:\Windows\System\PbLJgyu.exe
  2⤵
  PID:5172
- C:\Windows\System\fanUQlN.exe
  C:\Windows\System\fanUQlN.exe
  2⤵
  PID:5192
- C:\Windows\System\AMMHQkX.exe
  C:\Windows\System\AMMHQkX.exe
  2⤵
  PID:5216
- C:\Windows\System\gpxyRzI.exe
  C:\Windows\System\gpxyRzI.exe
  2⤵
  PID:5236
- C:\Windows\System\JdqGbib.exe
  C:\Windows\System\JdqGbib.exe
  2⤵
  PID:5260
- C:\Windows\System\HvNMkrz.exe
  C:\Windows\System\HvNMkrz.exe
  2⤵
  PID:5276
- C:\Windows\System\XoDXTBV.exe
  C:\Windows\System\XoDXTBV.exe
  2⤵
  PID:5300
- C:\Windows\System\booGYmJ.exe
  C:\Windows\System\booGYmJ.exe
  2⤵
  PID:5324
- C:\Windows\System\LahtzLb.exe
  C:\Windows\System\LahtzLb.exe
  2⤵
  PID:5340
- C:\Windows\System\XPfOcjQ.exe
  C:\Windows\System\XPfOcjQ.exe
  2⤵
  PID:5364
- C:\Windows\System\UMfLuxv.exe
  C:\Windows\System\UMfLuxv.exe
  2⤵
  PID:5388
- C:\Windows\System\RkZFrkb.exe
  C:\Windows\System\RkZFrkb.exe
  2⤵
  PID:5504
- C:\Windows\System\NuEvIRb.exe
  C:\Windows\System\NuEvIRb.exe
  2⤵
  PID:5524
- C:\Windows\System\jjiscEb.exe
  C:\Windows\System\jjiscEb.exe
  2⤵
  PID:5544
- C:\Windows\System\hfAiXgh.exe
  C:\Windows\System\hfAiXgh.exe
  2⤵
  PID:5564
- C:\Windows\System\LchxDIM.exe
  C:\Windows\System\LchxDIM.exe
  2⤵
  PID:5592
- C:\Windows\System\xbLDDvc.exe
  C:\Windows\System\xbLDDvc.exe
  2⤵
  PID:5608
- C:\Windows\System\IHgkoJu.exe
  C:\Windows\System\IHgkoJu.exe
  2⤵
  PID:5636
- C:\Windows\System\AaRtgsx.exe
  C:\Windows\System\AaRtgsx.exe
  2⤵
  PID:5652
- C:\Windows\System\qpBZThj.exe
  C:\Windows\System\qpBZThj.exe
  2⤵
  PID:5668
- C:\Windows\System\QgddRwz.exe
  C:\Windows\System\QgddRwz.exe
  2⤵
  PID:5684
- C:\Windows\System\oOWtNCB.exe
  C:\Windows\System\oOWtNCB.exe
  2⤵
  PID:5704
- C:\Windows\System\wdFjvEA.exe
  C:\Windows\System\wdFjvEA.exe
  2⤵
  PID:5724
- C:\Windows\System\LgrUcFk.exe
  C:\Windows\System\LgrUcFk.exe
  2⤵
  PID:5744
- C:\Windows\System\kKsGwkn.exe
  C:\Windows\System\kKsGwkn.exe
  2⤵
  PID:5764
- C:\Windows\System\qrAXnmj.exe
  C:\Windows\System\qrAXnmj.exe
  2⤵
  PID:5788
- C:\Windows\System\OebCJuW.exe
  C:\Windows\System\OebCJuW.exe
  2⤵
  PID:5816
- C:\Windows\System\NhfRZDU.exe
  C:\Windows\System\NhfRZDU.exe
  2⤵
  PID:5832
- C:\Windows\System\MAIAbMw.exe
  C:\Windows\System\MAIAbMw.exe
  2⤵
  PID:5852
- C:\Windows\System\mHUWlvs.exe
  C:\Windows\System\mHUWlvs.exe
  2⤵
  PID:5876
- C:\Windows\System\nkWatPf.exe
  C:\Windows\System\nkWatPf.exe
  2⤵
  PID:5896
- C:\Windows\System\pNlHlNC.exe
  C:\Windows\System\pNlHlNC.exe
  2⤵
  PID:5920
- C:\Windows\System\ERlFuGQ.exe
  C:\Windows\System\ERlFuGQ.exe
  2⤵
  PID:5936
- C:\Windows\System\lHZVfYy.exe
  C:\Windows\System\lHZVfYy.exe
  2⤵
  PID:5960
- C:\Windows\System\qjBuutN.exe
  C:\Windows\System\qjBuutN.exe
  2⤵
  PID:5980
- C:\Windows\System\WTFXCOC.exe
  C:\Windows\System\WTFXCOC.exe
  2⤵
  PID:6000
- C:\Windows\System\IJrvYYz.exe
  C:\Windows\System\IJrvYYz.exe
  2⤵
  PID:6024
- C:\Windows\System\AnGVHNv.exe
  C:\Windows\System\AnGVHNv.exe
  2⤵
  PID:6040
- C:\Windows\System\XsoYoPf.exe
  C:\Windows\System\XsoYoPf.exe
  2⤵
  PID:6064
- C:\Windows\System\yNYJnRb.exe
  C:\Windows\System\yNYJnRb.exe
  2⤵
  PID:6088
- C:\Windows\System\RJMtrTx.exe
  C:\Windows\System\RJMtrTx.exe
  2⤵
  PID:6108
- C:\Windows\System\GgWAErq.exe
  C:\Windows\System\GgWAErq.exe
  2⤵
  PID:1112
- C:\Windows\System\LNudWiF.exe
  C:\Windows\System\LNudWiF.exe
  2⤵
  PID:4356
- C:\Windows\System\cHNdOYY.exe
  C:\Windows\System\cHNdOYY.exe
  2⤵
  PID:2464
- C:\Windows\System\xbXQxQW.exe
  C:\Windows\System\xbXQxQW.exe
  2⤵
  PID:1228
- C:\Windows\System\KkwTvCz.exe
  C:\Windows\System\KkwTvCz.exe
  2⤵
  PID:3788
- C:\Windows\System\ACvsbKb.exe
  C:\Windows\System\ACvsbKb.exe
  2⤵
  PID:4920
- C:\Windows\System\mYWbjwH.exe
  C:\Windows\System\mYWbjwH.exe
  2⤵
  PID:1856
- C:\Windows\System\bbNPNjv.exe
  C:\Windows\System\bbNPNjv.exe
  2⤵
  PID:4956
- C:\Windows\System\RrOIxtZ.exe
  C:\Windows\System\RrOIxtZ.exe
  2⤵
  PID:5780
- C:\Windows\System\sbkrXwl.exe
  C:\Windows\System\sbkrXwl.exe
  2⤵
  PID:1812
- C:\Windows\System\dmSuIHb.exe
  C:\Windows\System\dmSuIHb.exe
  2⤵
  PID:1592
- C:\Windows\System\RilwLWz.exe
  C:\Windows\System\RilwLWz.exe
  2⤵
  PID:5892
- C:\Windows\System\jUgodUf.exe
  C:\Windows\System\jUgodUf.exe
  2⤵
  PID:2296
- C:\Windows\System\zHSnoyd.exe
  C:\Windows\System\zHSnoyd.exe
  2⤵
  PID:5416
- C:\Windows\System\YsaKcKi.exe
  C:\Windows\System\YsaKcKi.exe
  2⤵
  PID:5496
- C:\Windows\System\CgHYchy.exe
  C:\Windows\System\CgHYchy.exe
  2⤵
  PID:5532
- C:\Windows\System\zHBMnUe.exe
  C:\Windows\System\zHBMnUe.exe
  2⤵
  PID:3596
- C:\Windows\System\bEhLenR.exe
  C:\Windows\System\bEhLenR.exe
  2⤵
  PID:5580
- C:\Windows\System\iHgrqEc.exe
  C:\Windows\System\iHgrqEc.exe
  2⤵
  PID:5620
- C:\Windows\System\kmZmTbS.exe
  C:\Windows\System\kmZmTbS.exe
  2⤵
  PID:5660
- C:\Windows\System\flMduwv.exe
  C:\Windows\System\flMduwv.exe
  2⤵
  PID:5700
- C:\Windows\System\ZUCNwhn.exe
  C:\Windows\System\ZUCNwhn.exe
  2⤵
  PID:5796
- C:\Windows\System\OecKRvV.exe
  C:\Windows\System\OecKRvV.exe
  2⤵
  PID:5848
- C:\Windows\System\JpaVrsE.exe
  C:\Windows\System\JpaVrsE.exe
  2⤵
  PID:5952
- C:\Windows\System\GzoFwuz.exe
  C:\Windows\System\GzoFwuz.exe
  2⤵
  PID:5996
- C:\Windows\System\nOSxkRp.exe
  C:\Windows\System\nOSxkRp.exe
  2⤵
  PID:6036
- C:\Windows\System\JemdvlE.exe
  C:\Windows\System\JemdvlE.exe
  2⤵
  PID:6076
- C:\Windows\System\mwJjuUP.exe
  C:\Windows\System\mwJjuUP.exe
  2⤵
  PID:6124
- C:\Windows\System\ytOCNlh.exe
  C:\Windows\System\ytOCNlh.exe
  2⤵
  PID:6148
- C:\Windows\System\WxCpIrS.exe
  C:\Windows\System\WxCpIrS.exe
  2⤵
  PID:6168
- C:\Windows\System\HIdlriF.exe
  C:\Windows\System\HIdlriF.exe
  2⤵
  PID:6192
- C:\Windows\System\fBCvpgg.exe
  C:\Windows\System\fBCvpgg.exe
  2⤵
  PID:6212
- C:\Windows\System\yhHWGLS.exe
  C:\Windows\System\yhHWGLS.exe
  2⤵
  PID:6240
- C:\Windows\System\xtVLkfy.exe
  C:\Windows\System\xtVLkfy.exe
  2⤵
  PID:6264
- C:\Windows\System\mLUMxqS.exe
  C:\Windows\System\mLUMxqS.exe
  2⤵
  PID:6296
- C:\Windows\System\XRLjoxd.exe
  C:\Windows\System\XRLjoxd.exe
  2⤵
  PID:6312
- C:\Windows\System\vseuzrh.exe
  C:\Windows\System\vseuzrh.exe
  2⤵
  PID:6332
- C:\Windows\System\jsJOiwm.exe
  C:\Windows\System\jsJOiwm.exe
  2⤵
  PID:6352
- C:\Windows\System\eYlLWXg.exe
  C:\Windows\System\eYlLWXg.exe
  2⤵
  PID:6372
- C:\Windows\System\bbwJIGa.exe
  C:\Windows\System\bbwJIGa.exe
  2⤵
  PID:6388
- C:\Windows\System\LLPlCip.exe
  C:\Windows\System\LLPlCip.exe
  2⤵
  PID:6408
- C:\Windows\System\JYAfpRa.exe
  C:\Windows\System\JYAfpRa.exe
  2⤵
  PID:6432
- C:\Windows\System\IoJYQFo.exe
  C:\Windows\System\IoJYQFo.exe
  2⤵
  PID:6448
- C:\Windows\System\kkRRloO.exe
  C:\Windows\System\kkRRloO.exe
  2⤵
  PID:6464
- C:\Windows\System\lzPMabC.exe
  C:\Windows\System\lzPMabC.exe
  2⤵
  PID:6612
- C:\Windows\System\vivRPmX.exe
  C:\Windows\System\vivRPmX.exe
  2⤵
  PID:6632
- C:\Windows\System\UAYQneh.exe
  C:\Windows\System\UAYQneh.exe
  2⤵
  PID:6652
- C:\Windows\System\WJKxQBU.exe
  C:\Windows\System\WJKxQBU.exe
  2⤵
  PID:6680
- C:\Windows\System\yoXXVzD.exe
  C:\Windows\System\yoXXVzD.exe
  2⤵
  PID:6704
- C:\Windows\System\YHTYuFC.exe
  C:\Windows\System\YHTYuFC.exe
  2⤵
  PID:6720
- C:\Windows\System\FNvJNCA.exe
  C:\Windows\System\FNvJNCA.exe
  2⤵
  PID:6740
- C:\Windows\System\szjVLFE.exe
  C:\Windows\System\szjVLFE.exe
  2⤵
  PID:6760
- C:\Windows\System\dglJZve.exe
  C:\Windows\System\dglJZve.exe
  2⤵
  PID:6784
- C:\Windows\System\WpjnILq.exe
  C:\Windows\System\WpjnILq.exe
  2⤵
  PID:6800
- C:\Windows\System\JwMRWkH.exe
  C:\Windows\System\JwMRWkH.exe
  2⤵
  PID:6820
- C:\Windows\System\DzCPfQA.exe
  C:\Windows\System\DzCPfQA.exe
  2⤵
  PID:6840
- C:\Windows\System\PRAMKeU.exe
  C:\Windows\System\PRAMKeU.exe
  2⤵
  PID:6856
- C:\Windows\System\knfDbcY.exe
  C:\Windows\System\knfDbcY.exe
  2⤵
  PID:6876
- C:\Windows\System\qNiPoOr.exe
  C:\Windows\System\qNiPoOr.exe
  2⤵
  PID:6896
- C:\Windows\System\vpgDHnY.exe
  C:\Windows\System\vpgDHnY.exe
  2⤵
  PID:6912
- C:\Windows\System\cliGPjU.exe
  C:\Windows\System\cliGPjU.exe
  2⤵
  PID:6932
- C:\Windows\System\MpPlhCh.exe
  C:\Windows\System\MpPlhCh.exe
  2⤵
  PID:6948
- C:\Windows\System\KHjhQdd.exe
  C:\Windows\System\KHjhQdd.exe
  2⤵
  PID:6968
- C:\Windows\System\wuaSiqr.exe
  C:\Windows\System\wuaSiqr.exe
  2⤵
  PID:6996
- C:\Windows\System\uwrkgOP.exe
  C:\Windows\System\uwrkgOP.exe
  2⤵
  PID:7012
- C:\Windows\System\ypiHwwH.exe
  C:\Windows\System\ypiHwwH.exe
  2⤵
  PID:7072
- C:\Windows\System\uqexqOZ.exe
  C:\Windows\System\uqexqOZ.exe
  2⤵
  PID:7092
- C:\Windows\System\sgwsHMn.exe
  C:\Windows\System\sgwsHMn.exe
  2⤵
  PID:7108
- C:\Windows\System\afkJCMG.exe
  C:\Windows\System\afkJCMG.exe
  2⤵
  PID:7124
- C:\Windows\System\ihutMdS.exe
  C:\Windows\System\ihutMdS.exe
  2⤵
  PID:7140
- C:\Windows\System\QJNgBIz.exe
  C:\Windows\System\QJNgBIz.exe
  2⤵
  PID:7156
- C:\Windows\System\vGcDkic.exe
  C:\Windows\System\vGcDkic.exe
  2⤵
  PID:4364
- C:\Windows\System\DrgcDbE.exe
  C:\Windows\System\DrgcDbE.exe
  2⤵
  PID:5020
- C:\Windows\System\ZSqYVfn.exe
  C:\Windows\System\ZSqYVfn.exe
  2⤵
  PID:5944
- C:\Windows\System\inqcKJB.exe
  C:\Windows\System\inqcKJB.exe
  2⤵
  PID:6200
- C:\Windows\System\DvfXffX.exe
  C:\Windows\System\DvfXffX.exe
  2⤵
  PID:6812
- C:\Windows\System\hdwUdSH.exe
  C:\Windows\System\hdwUdSH.exe
  2⤵
  PID:6324
- C:\Windows\System\QgXtDtD.exe
  C:\Windows\System\QgXtDtD.exe
  2⤵
  PID:7176
- C:\Windows\System\xiAXROu.exe
  C:\Windows\System\xiAXROu.exe
  2⤵
  PID:7196
- C:\Windows\System\nAeypdI.exe
  C:\Windows\System\nAeypdI.exe
  2⤵
  PID:7216
- C:\Windows\System\sPuFHjI.exe
  C:\Windows\System\sPuFHjI.exe
  2⤵
  PID:7232
- C:\Windows\System\KcfbWyo.exe
  C:\Windows\System\KcfbWyo.exe
  2⤵
  PID:7256
- C:\Windows\System\oLDxBsH.exe
  C:\Windows\System\oLDxBsH.exe
  2⤵
  PID:7272
- C:\Windows\System\QzEIxHc.exe
  C:\Windows\System\QzEIxHc.exe
  2⤵
  PID:7288
- C:\Windows\System\erFbCOF.exe
  C:\Windows\System\erFbCOF.exe
  2⤵
  PID:7312
- C:\Windows\System\pnJDNsE.exe
  C:\Windows\System\pnJDNsE.exe
  2⤵
  PID:7332
- C:\Windows\System\gZGHOPt.exe
  C:\Windows\System\gZGHOPt.exe
  2⤵
  PID:7360
- C:\Windows\System\GDNheLj.exe
  C:\Windows\System\GDNheLj.exe
  2⤵
  PID:7392
- C:\Windows\System\LtvXGJZ.exe
  C:\Windows\System\LtvXGJZ.exe
  2⤵
  PID:7408
- C:\Windows\System\oaPJKWZ.exe
  C:\Windows\System\oaPJKWZ.exe
  2⤵
  PID:7432
- C:\Windows\System\EeHsNLZ.exe
  C:\Windows\System\EeHsNLZ.exe
  2⤵
  PID:7452
- C:\Windows\System\ggSGVlA.exe
  C:\Windows\System\ggSGVlA.exe
  2⤵
  PID:7472
- C:\Windows\System\DSoEoYt.exe
  C:\Windows\System\DSoEoYt.exe
  2⤵
  PID:7496
- C:\Windows\System\KDIxQMY.exe
  C:\Windows\System\KDIxQMY.exe
  2⤵
  PID:7524
- C:\Windows\System\XIxSGto.exe
  C:\Windows\System\XIxSGto.exe
  2⤵
  PID:7544
- C:\Windows\System\ZjjsNBL.exe
  C:\Windows\System\ZjjsNBL.exe
  2⤵
  PID:7560
- C:\Windows\System\WDJzYNw.exe
  C:\Windows\System\WDJzYNw.exe
  2⤵
  PID:7588
- C:\Windows\System\GYDbgNU.exe
  C:\Windows\System\GYDbgNU.exe
  2⤵
  PID:7632
- C:\Windows\System\XRjCDQL.exe
  C:\Windows\System\XRjCDQL.exe
  2⤵
  PID:7656
- C:\Windows\System\zEVwDsk.exe
  C:\Windows\System\zEVwDsk.exe
  2⤵
  PID:7672
- C:\Windows\System\fNOYiPi.exe
  C:\Windows\System\fNOYiPi.exe
  2⤵
  PID:7696
- C:\Windows\System\JRtgBKn.exe
  C:\Windows\System\JRtgBKn.exe
  2⤵
  PID:7720
- C:\Windows\System\jVkyDlA.exe
  C:\Windows\System\jVkyDlA.exe
  2⤵
  PID:7736
- C:\Windows\System\IFFneiS.exe
  C:\Windows\System\IFFneiS.exe
  2⤵
  PID:7760
- C:\Windows\System\PgtADRM.exe
  C:\Windows\System\PgtADRM.exe
  2⤵
  PID:7780
- C:\Windows\System\JMDYACR.exe
  C:\Windows\System\JMDYACR.exe
  2⤵
  PID:7796
- C:\Windows\System\oqBCKCf.exe
  C:\Windows\System\oqBCKCf.exe
  2⤵
  PID:7812
- C:\Windows\System\YRGuhre.exe
  C:\Windows\System\YRGuhre.exe
  2⤵
  PID:7832
- C:\Windows\System\hyduVRg.exe
  C:\Windows\System\hyduVRg.exe
  2⤵
  PID:7848
- C:\Windows\System\nTXqnSu.exe
  C:\Windows\System\nTXqnSu.exe
  2⤵
  PID:7872
- C:\Windows\System\SUWOByP.exe
  C:\Windows\System\SUWOByP.exe
  2⤵
  PID:7888
- C:\Windows\System\jfhLSfy.exe
  C:\Windows\System\jfhLSfy.exe
  2⤵
  PID:7912
- C:\Windows\System\UHtSOdc.exe
  C:\Windows\System\UHtSOdc.exe
  2⤵
  PID:7936
- C:\Windows\System\UPuqUEv.exe
  C:\Windows\System\UPuqUEv.exe
  2⤵
  PID:7952
- C:\Windows\System\hwYheqp.exe
  C:\Windows\System\hwYheqp.exe
  2⤵
  PID:7976
- C:\Windows\System\syEbChZ.exe
  C:\Windows\System\syEbChZ.exe
  2⤵
  PID:7996
- C:\Windows\System\vnzkNbG.exe
  C:\Windows\System\vnzkNbG.exe
  2⤵
  PID:8016
- C:\Windows\System\KmLSqCN.exe
  C:\Windows\System\KmLSqCN.exe
  2⤵
  PID:8036
- C:\Windows\System\OgNBrFQ.exe
  C:\Windows\System\OgNBrFQ.exe
  2⤵
  PID:8060
- C:\Windows\System\OkbhJHf.exe
  C:\Windows\System\OkbhJHf.exe
  2⤵
  PID:8084
- C:\Windows\System\WzmJgTS.exe
  C:\Windows\System\WzmJgTS.exe
  2⤵
  PID:8100
- C:\Windows\System\yRQndbV.exe
  C:\Windows\System\yRQndbV.exe
  2⤵
  PID:8120
- C:\Windows\System\BugyPze.exe
  C:\Windows\System\BugyPze.exe
  2⤵
  PID:8144
- C:\Windows\System\oZIldCg.exe
  C:\Windows\System\oZIldCg.exe
  2⤵
  PID:8168
- C:\Windows\System\jRppAOY.exe
  C:\Windows\System\jRppAOY.exe
  2⤵
  PID:1124
- C:\Windows\System\vTogFov.exe
  C:\Windows\System\vTogFov.exe
  2⤵
  PID:2412
- C:\Windows\System\DSHGkrP.exe
  C:\Windows\System\DSHGkrP.exe
  2⤵
  PID:5032
- C:\Windows\System\uxbLzWz.exe
  C:\Windows\System\uxbLzWz.exe
  2⤵
  PID:1172
- C:\Windows\System\KdOGLbX.exe
  C:\Windows\System\KdOGLbX.exe
  2⤵
  PID:5912
- C:\Windows\System\FnWJqaI.exe
  C:\Windows\System\FnWJqaI.exe
  2⤵
  PID:5468
- C:\Windows\System\QbnlkZZ.exe
  C:\Windows\System\QbnlkZZ.exe
  2⤵
  PID:5556
- C:\Windows\System\EyKXIur.exe
  C:\Windows\System\EyKXIur.exe
  2⤵
  PID:5644
- C:\Windows\System\FBNbyGo.exe
  C:\Windows\System\FBNbyGo.exe
  2⤵
  PID:5720
- C:\Windows\System\VgbvEyp.exe
  C:\Windows\System\VgbvEyp.exe
  2⤵
  PID:5824
- C:\Windows\System\TyqGenv.exe
  C:\Windows\System\TyqGenv.exe
  2⤵
  PID:5928
- C:\Windows\System\JffDVmv.exe
  C:\Windows\System\JffDVmv.exe
  2⤵
  PID:600
- C:\Windows\System\aBFlgbH.exe
  C:\Windows\System\aBFlgbH.exe
  2⤵
  PID:6180
- C:\Windows\System\hXRCJPY.exe
  C:\Windows\System\hXRCJPY.exe
  2⤵
  PID:6308
- C:\Windows\System\atWSRfG.exe
  C:\Windows\System\atWSRfG.exe
  2⤵
  PID:6348
- C:\Windows\System\GkQLCXH.exe
  C:\Windows\System\GkQLCXH.exe
  2⤵
  PID:6852
- C:\Windows\System\zEXMzcB.exe
  C:\Windows\System\zEXMzcB.exe
  2⤵
  PID:6884
- C:\Windows\System\Lifgizy.exe
  C:\Windows\System\Lifgizy.exe
  2⤵
  PID:6920
- C:\Windows\System\ohYONFZ.exe
  C:\Windows\System\ohYONFZ.exe
  2⤵
  PID:6924
- C:\Windows\System\ofIInFj.exe
  C:\Windows\System\ofIInFj.exe
  2⤵
  PID:7132
- C:\Windows\System\CscFWFK.exe
  C:\Windows\System\CscFWFK.exe
  2⤵
  PID:6444
- C:\Windows\System\cDhDCJt.exe
  C:\Windows\System\cDhDCJt.exe
  2⤵
  PID:7384
- C:\Windows\System\Wkaescz.exe
  C:\Windows\System\Wkaescz.exe
  2⤵
  PID:8204
- C:\Windows\System\ttWryOr.exe
  C:\Windows\System\ttWryOr.exe
  2⤵
  PID:8228
- C:\Windows\System\YUqqTVG.exe
  C:\Windows\System\YUqqTVG.exe
  2⤵
  PID:8252
- C:\Windows\System\iztzJCB.exe
  C:\Windows\System\iztzJCB.exe
  2⤵
  PID:8276
- C:\Windows\System\jRlCSxu.exe
  C:\Windows\System\jRlCSxu.exe
  2⤵
  PID:8300
- C:\Windows\System\HDEknaU.exe
  C:\Windows\System\HDEknaU.exe
  2⤵
  PID:8348
- C:\Windows\System\obcjrQX.exe
  C:\Windows\System\obcjrQX.exe
  2⤵
  PID:8372
- C:\Windows\System\pKtCwAH.exe
  C:\Windows\System\pKtCwAH.exe
  2⤵
  PID:8392
- C:\Windows\System\HJQfpKp.exe
  C:\Windows\System\HJQfpKp.exe
  2⤵
  PID:8416
- C:\Windows\System\PUhjfBJ.exe
  C:\Windows\System\PUhjfBJ.exe
  2⤵
  PID:8432
- C:\Windows\System\omWGAHw.exe
  C:\Windows\System\omWGAHw.exe
  2⤵
  PID:8456
- C:\Windows\System\zWwCEXW.exe
  C:\Windows\System\zWwCEXW.exe
  2⤵
  PID:8480
- C:\Windows\System\FZisHXs.exe
  C:\Windows\System\FZisHXs.exe
  2⤵
  PID:8496
- C:\Windows\System\vYphnMU.exe
  C:\Windows\System\vYphnMU.exe
  2⤵
  PID:8520
- C:\Windows\System\jaNFIlT.exe
  C:\Windows\System\jaNFIlT.exe
  2⤵
  PID:8544
- C:\Windows\System\umVLNsr.exe
  C:\Windows\System\umVLNsr.exe
  2⤵
  PID:8568
- C:\Windows\System\SqOPnoq.exe
  C:\Windows\System\SqOPnoq.exe
  2⤵
  PID:8588
- C:\Windows\System\TcwDWuu.exe
  C:\Windows\System\TcwDWuu.exe
  2⤵
  PID:8608
- C:\Windows\System\RnHZPYk.exe
  C:\Windows\System\RnHZPYk.exe
  2⤵
  PID:8632
- C:\Windows\System\VfjbOCE.exe
  C:\Windows\System\VfjbOCE.exe
  2⤵
  PID:8652
- C:\Windows\System\kDQwspI.exe
  C:\Windows\System\kDQwspI.exe
  2⤵
  PID:8672
- C:\Windows\System\tmboJvo.exe
  C:\Windows\System\tmboJvo.exe
  2⤵
  PID:8692
- C:\Windows\System\ZSQcouz.exe
  C:\Windows\System\ZSQcouz.exe
  2⤵
  PID:8716
- C:\Windows\System\JHBNEYr.exe
  C:\Windows\System\JHBNEYr.exe
  2⤵
  PID:8732
- C:\Windows\System\sGJkRjx.exe
  C:\Windows\System\sGJkRjx.exe
  2⤵
  PID:8756
- C:\Windows\System\hiJFkcm.exe
  C:\Windows\System\hiJFkcm.exe
  2⤵
  PID:8772
- C:\Windows\System\fEjzZMh.exe
  C:\Windows\System\fEjzZMh.exe
  2⤵
  PID:8792
- C:\Windows\System\cMOHFhl.exe
  C:\Windows\System\cMOHFhl.exe
  2⤵
  PID:8808
- C:\Windows\System\tJHqfUl.exe
  C:\Windows\System\tJHqfUl.exe
  2⤵
  PID:8832
- C:\Windows\System\LHbZMun.exe
  C:\Windows\System\LHbZMun.exe
  2⤵
  PID:8856
- C:\Windows\System\uqQmTHQ.exe
  C:\Windows\System\uqQmTHQ.exe
  2⤵
  PID:8872
- C:\Windows\System\QOKLXAb.exe
  C:\Windows\System\QOKLXAb.exe
  2⤵
  PID:8888
- C:\Windows\System\tZlBYqV.exe
  C:\Windows\System\tZlBYqV.exe
  2⤵
  PID:8908
- C:\Windows\System\iSDsgbZ.exe
  C:\Windows\System\iSDsgbZ.exe
  2⤵
  PID:8924
- C:\Windows\System\IKImLII.exe
  C:\Windows\System\IKImLII.exe
  2⤵
  PID:8944
- C:\Windows\System\fMsbgwg.exe
  C:\Windows\System\fMsbgwg.exe
  2⤵
  PID:8960
- C:\Windows\System\QFAPOpl.exe
  C:\Windows\System\QFAPOpl.exe
  2⤵
  PID:8976
- C:\Windows\System\ovsLwjn.exe
  C:\Windows\System\ovsLwjn.exe
  2⤵
  PID:8996
- C:\Windows\System\ByKQdXc.exe
  C:\Windows\System\ByKQdXc.exe
  2⤵
  PID:9016
- C:\Windows\System\iVmQEjs.exe
  C:\Windows\System\iVmQEjs.exe
  2⤵
  PID:9036
- C:\Windows\System\rWhJwor.exe
  C:\Windows\System\rWhJwor.exe
  2⤵
  PID:9056
- C:\Windows\System\BRqULLB.exe
  C:\Windows\System\BRqULLB.exe
  2⤵
  PID:9076
- C:\Windows\System\ysJZqmZ.exe
  C:\Windows\System\ysJZqmZ.exe
  2⤵
  PID:9100
- C:\Windows\System\qWHMgtJ.exe
  C:\Windows\System\qWHMgtJ.exe
  2⤵
  PID:9132
- C:\Windows\System\VSNpfgJ.exe
  C:\Windows\System\VSNpfgJ.exe
  2⤵
  PID:9200
- C:\Windows\System\rrVkEqd.exe
  C:\Windows\System\rrVkEqd.exe
  2⤵
  PID:6596
- C:\Windows\System\sanlJbr.exe
  C:\Windows\System\sanlJbr.exe
  2⤵
  PID:6624
- C:\Windows\System\qUSGOFm.exe
  C:\Windows\System\qUSGOFm.exe
  2⤵
  PID:6792
- C:\Windows\System\xXssycL.exe
  C:\Windows\System\xXssycL.exe
  2⤵
  PID:6752
- C:\Windows\System\VIXKUPM.exe
  C:\Windows\System\VIXKUPM.exe
  2⤵
  PID:6696
- C:\Windows\System\fRlIDdP.exe
  C:\Windows\System\fRlIDdP.exe
  2⤵
  PID:6832
- C:\Windows\System\KIabzew.exe
  C:\Windows\System\KIabzew.exe
  2⤵
  PID:7948
- C:\Windows\System\HnmGCkP.exe
  C:\Windows\System\HnmGCkP.exe
  2⤵
  PID:6964
- C:\Windows\System\HHjiKbU.exe
  C:\Windows\System\HHjiKbU.exe
  2⤵
  PID:7008
- C:\Windows\System\ejvAPau.exe
  C:\Windows\System\ejvAPau.exe
  2⤵
  PID:7152
- C:\Windows\System\AvAfRHC.exe
  C:\Windows\System\AvAfRHC.exe
  2⤵
  PID:948
- C:\Windows\System\VzCTQrc.exe
  C:\Windows\System\VzCTQrc.exe
  2⤵
  PID:996
- C:\Windows\System\aZnxpar.exe
  C:\Windows\System\aZnxpar.exe
  2⤵
  PID:8132
- C:\Windows\System\PZvbhDN.exe
  C:\Windows\System\PZvbhDN.exe
  2⤵
  PID:7224
- C:\Windows\System\fHJQoHt.exe
  C:\Windows\System\fHJQoHt.exe
  2⤵
  PID:7300
- C:\Windows\System\DZCucSN.exe
  C:\Windows\System\DZCucSN.exe
  2⤵
  PID:5460
- C:\Windows\System\gdPtKNl.exe
  C:\Windows\System\gdPtKNl.exe
  2⤵
  PID:7468
- C:\Windows\System\RZdOIOt.exe
  C:\Windows\System\RZdOIOt.exe
  2⤵
  PID:7508
- C:\Windows\System\NlPioRY.exe
  C:\Windows\System\NlPioRY.exe
  2⤵
  PID:6368
- C:\Windows\System\SRdItMq.exe
  C:\Windows\System\SRdItMq.exe
  2⤵
  PID:7032
- C:\Windows\System\jbiBKgp.exe
  C:\Windows\System\jbiBKgp.exe
  2⤵
  PID:7840
- C:\Windows\System\FgkgeMB.exe
  C:\Windows\System\FgkgeMB.exe
  2⤵
  PID:7880
- C:\Windows\System\rfQxvvj.exe
  C:\Windows\System\rfQxvvj.exe
  2⤵
  PID:8584
- C:\Windows\System\kmPnlTU.exe
  C:\Windows\System\kmPnlTU.exe
  2⤵
  PID:8048
- C:\Windows\System\SWwEFuU.exe
  C:\Windows\System\SWwEFuU.exe
  2⤵
  PID:8784
- C:\Windows\System\ezPwkwB.exe
  C:\Windows\System\ezPwkwB.exe
  2⤵
  PID:6364
- C:\Windows\System\dEzWQWH.exe
  C:\Windows\System\dEzWQWH.exe
  2⤵
  PID:9224
- C:\Windows\System\hOSqWtM.exe
  C:\Windows\System\hOSqWtM.exe
  2⤵
  PID:9248
- C:\Windows\System\DRGdsPy.exe
  C:\Windows\System\DRGdsPy.exe
  2⤵
  PID:9276
- C:\Windows\System\IonjwnA.exe
  C:\Windows\System\IonjwnA.exe
  2⤵
  PID:9292
- C:\Windows\System\RFjVidY.exe
  C:\Windows\System\RFjVidY.exe
  2⤵
  PID:9308
- C:\Windows\System\IvVkobo.exe
  C:\Windows\System\IvVkobo.exe
  2⤵
  PID:9324
- C:\Windows\System\wzzppqD.exe
  C:\Windows\System\wzzppqD.exe
  2⤵
  PID:9344
- C:\Windows\System\FRbmMVx.exe
  C:\Windows\System\FRbmMVx.exe
  2⤵
  PID:9368
- C:\Windows\System\FuHOHHB.exe
  C:\Windows\System\FuHOHHB.exe
  2⤵
  PID:9384
- C:\Windows\System\UZdAgLr.exe
  C:\Windows\System\UZdAgLr.exe
  2⤵
  PID:9400
- C:\Windows\System\RVmAEaN.exe
  C:\Windows\System\RVmAEaN.exe
  2⤵
  PID:9420
- C:\Windows\System\bVHmEdh.exe
  C:\Windows\System\bVHmEdh.exe
  2⤵
  PID:9440
- C:\Windows\System\CVEMHaJ.exe
  C:\Windows\System\CVEMHaJ.exe
  2⤵
  PID:9460
- C:\Windows\System\bBXvcQo.exe
  C:\Windows\System\bBXvcQo.exe
  2⤵
  PID:9484
- C:\Windows\System\MNYCFgI.exe
  C:\Windows\System\MNYCFgI.exe
  2⤵
  PID:9508
- C:\Windows\System\AsOafTD.exe
  C:\Windows\System\AsOafTD.exe
  2⤵
  PID:9528
- C:\Windows\System\MAESdXy.exe
  C:\Windows\System\MAESdXy.exe
  2⤵
  PID:9552
- C:\Windows\System\uoWpWEk.exe
  C:\Windows\System\uoWpWEk.exe
  2⤵
  PID:9572
- C:\Windows\System\wQzKuAy.exe
  C:\Windows\System\wQzKuAy.exe
  2⤵
  PID:9596
- C:\Windows\System\NdEAabh.exe
  C:\Windows\System\NdEAabh.exe
  2⤵
  PID:9620
- C:\Windows\System\bXXnGeQ.exe
  C:\Windows\System\bXXnGeQ.exe
  2⤵
  PID:9644
- C:\Windows\System\JjifzFj.exe
  C:\Windows\System\JjifzFj.exe
  2⤵
  PID:9660
- C:\Windows\System\neGuzMh.exe
  C:\Windows\System\neGuzMh.exe
  2⤵
  PID:9684
- C:\Windows\System\uZqwaHN.exe
  C:\Windows\System\uZqwaHN.exe
  2⤵
  PID:9700
- C:\Windows\System\bjrUEVy.exe
  C:\Windows\System\bjrUEVy.exe
  2⤵
  PID:9724
- C:\Windows\System\PZmwHTu.exe
  C:\Windows\System\PZmwHTu.exe
  2⤵
  PID:9748
- C:\Windows\System\xzcCuYO.exe
  C:\Windows\System\xzcCuYO.exe
  2⤵
  PID:9772
- C:\Windows\System\JDeQeNA.exe
  C:\Windows\System\JDeQeNA.exe
  2⤵
  PID:9792
- C:\Windows\System\aXcJgoc.exe
  C:\Windows\System\aXcJgoc.exe
  2⤵
  PID:9812
- C:\Windows\System\bSpCBPK.exe
  C:\Windows\System\bSpCBPK.exe
  2⤵
  PID:9836
- C:\Windows\System\VFOAxri.exe
  C:\Windows\System\VFOAxri.exe
  2⤵
  PID:9860
- C:\Windows\System\WFxYtBm.exe
  C:\Windows\System\WFxYtBm.exe
  2⤵
  PID:9880
- C:\Windows\System\dJQDwUZ.exe
  C:\Windows\System\dJQDwUZ.exe
  2⤵
  PID:9900
- C:\Windows\System\wsentCO.exe
  C:\Windows\System\wsentCO.exe
  2⤵
  PID:9932
- C:\Windows\System\AODNMCm.exe
  C:\Windows\System\AODNMCm.exe
  2⤵
  PID:9952
- C:\Windows\System\AmFoSqV.exe
  C:\Windows\System\AmFoSqV.exe
  2⤵
  PID:9968
- C:\Windows\System\recyiIz.exe
  C:\Windows\System\recyiIz.exe
  2⤵
  PID:9988
- C:\Windows\System\ttaSSPD.exe
  C:\Windows\System\ttaSSPD.exe
  2⤵
  PID:10012
- C:\Windows\System\IEvIjrd.exe
  C:\Windows\System\IEvIjrd.exe
  2⤵
  PID:10032
- C:\Windows\System\PMuqqaQ.exe
  C:\Windows\System\PMuqqaQ.exe
  2⤵
  PID:10064
- C:\Windows\System\HEerqVz.exe
  C:\Windows\System\HEerqVz.exe
  2⤵
  PID:10088
- C:\Windows\System\lldvVgw.exe
  C:\Windows\System\lldvVgw.exe
  2⤵
  PID:10104
- C:\Windows\System\rzZsEDV.exe
  C:\Windows\System\rzZsEDV.exe
  2⤵
  PID:10128
- C:\Windows\System\BXSJiRZ.exe
  C:\Windows\System\BXSJiRZ.exe
  2⤵
  PID:10152
- C:\Windows\System\fRYdphg.exe
  C:\Windows\System\fRYdphg.exe
  2⤵
  PID:10176
- C:\Windows\System\pCTUqUn.exe
  C:\Windows\System\pCTUqUn.exe
  2⤵
  PID:10200
- C:\Windows\System\UGWdtMb.exe
  C:\Windows\System\UGWdtMb.exe
  2⤵
  PID:10216
- C:\Windows\System\bNMpqkx.exe
  C:\Windows\System\bNMpqkx.exe
  2⤵
  PID:10236
- C:\Windows\System\TaTHvAz.exe
  C:\Windows\System\TaTHvAz.exe
  2⤵
  PID:7228
- C:\Windows\System\PDbRZnt.exe
  C:\Windows\System\PDbRZnt.exe
  2⤵
  PID:7344
- C:\Windows\System\vEXcSLv.exe
  C:\Windows\System\vEXcSLv.exe
  2⤵
  PID:4408
- C:\Windows\System\OVryxzD.exe
  C:\Windows\System\OVryxzD.exe
  2⤵
  PID:8968
- C:\Windows\System\kygrMGQ.exe
  C:\Windows\System\kygrMGQ.exe
  2⤵
  PID:7428
- C:\Windows\System\AFOsSTZ.exe
  C:\Windows\System\AFOsSTZ.exe
  2⤵
  PID:9024
- C:\Windows\System\zNSPiHE.exe
  C:\Windows\System\zNSPiHE.exe
  2⤵
  PID:6104
- C:\Windows\System\JHTsJpA.exe
  C:\Windows\System\JHTsJpA.exe
  2⤵
  PID:7568
- C:\Windows\System\dONxXCt.exe
  C:\Windows\System\dONxXCt.exe
  2⤵
  PID:7584
- C:\Windows\System\eoppzaC.exe
  C:\Windows\System\eoppzaC.exe
  2⤵
  PID:7624
- C:\Windows\System\LSBrNIQ.exe
  C:\Windows\System\LSBrNIQ.exe
  2⤵
  PID:7792
- C:\Windows\System\xGuhNUv.exe
  C:\Windows\System\xGuhNUv.exe
  2⤵
  PID:7732
- C:\Windows\System\WcZsOCg.exe
  C:\Windows\System\WcZsOCg.exe
  2⤵
  PID:7692
- C:\Windows\System\SosxHqF.exe
  C:\Windows\System\SosxHqF.exe
  2⤵
  PID:8388
- C:\Windows\System\RzfiAfK.exe
  C:\Windows\System\RzfiAfK.exe
  2⤵
  PID:7884
- C:\Windows\System\OScDYkI.exe
  C:\Windows\System\OScDYkI.exe
  2⤵
  PID:7972
- C:\Windows\System\sMRtVFB.exe
  C:\Windows\System\sMRtVFB.exe
  2⤵
  PID:6776
- C:\Windows\System\WFzwRxw.exe
  C:\Windows\System\WFzwRxw.exe
  2⤵
  PID:8688
- C:\Windows\System\waZwVsn.exe
  C:\Windows\System\waZwVsn.exe
  2⤵
  PID:8700
- C:\Windows\System\wpJgSIv.exe
  C:\Windows\System\wpJgSIv.exe
  2⤵
  PID:8740
- C:\Windows\System\MFbCMZK.exe
  C:\Windows\System\MFbCMZK.exe
  2⤵
  PID:8128
- C:\Windows\System\QFvOgmo.exe
  C:\Windows\System\QFvOgmo.exe
  2⤵
  PID:5000
- C:\Windows\System\LBBtYSQ.exe
  C:\Windows\System\LBBtYSQ.exe
  2⤵
  PID:860
- C:\Windows\System\NpDfHrU.exe
  C:\Windows\System\NpDfHrU.exe
  2⤵
  PID:10248
- C:\Windows\System\jStpiXV.exe
  C:\Windows\System\jStpiXV.exe
  2⤵
  PID:10268
- C:\Windows\System\ejUZGMm.exe
  C:\Windows\System\ejUZGMm.exe
  2⤵
  PID:10288
- C:\Windows\System\oiiKFRw.exe
  C:\Windows\System\oiiKFRw.exe
  2⤵
  PID:10324
- C:\Windows\System\ItcffTX.exe
  C:\Windows\System\ItcffTX.exe
  2⤵
  PID:10360
- C:\Windows\System\VIWXHAn.exe
  C:\Windows\System\VIWXHAn.exe
  2⤵
  PID:10392
- C:\Windows\System\PrfvfxU.exe
  C:\Windows\System\PrfvfxU.exe
  2⤵
  PID:10408
- C:\Windows\System\rneGmNe.exe
  C:\Windows\System\rneGmNe.exe
  2⤵
  PID:10432
- C:\Windows\System\EnNxSCa.exe
  C:\Windows\System\EnNxSCa.exe
  2⤵
  PID:10460
- C:\Windows\System\VlrTDyw.exe
  C:\Windows\System\VlrTDyw.exe
  2⤵
  PID:10480
- C:\Windows\System\Ieyijme.exe
  C:\Windows\System\Ieyijme.exe
  2⤵
  PID:10512
- C:\Windows\System\zTfwjOO.exe
  C:\Windows\System\zTfwjOO.exe
  2⤵
  PID:10528
- C:\Windows\System\itOBlWy.exe
  C:\Windows\System\itOBlWy.exe
  2⤵
  PID:10548
- C:\Windows\System\CaGcnmj.exe
  C:\Windows\System\CaGcnmj.exe
  2⤵
  PID:10576
- C:\Windows\System\rGACTMt.exe
  C:\Windows\System\rGACTMt.exe
  2⤵
  PID:10600
- C:\Windows\System\KLhfkEm.exe
  C:\Windows\System\KLhfkEm.exe
  2⤵
  PID:10816
- C:\Windows\System\veNHFxF.exe
  C:\Windows\System\veNHFxF.exe
  2⤵
  PID:10832
- C:\Windows\System\lOvJxim.exe
  C:\Windows\System\lOvJxim.exe
  2⤵
  PID:10856
- C:\Windows\System\cXwTDoi.exe
  C:\Windows\System\cXwTDoi.exe
  2⤵
  PID:10876
- C:\Windows\System\hsERPwv.exe
  C:\Windows\System\hsERPwv.exe
  2⤵
  PID:10904
- C:\Windows\System\leDNKHK.exe
  C:\Windows\System\leDNKHK.exe
  2⤵
  PID:10932
- C:\Windows\System\RmeVEeP.exe
  C:\Windows\System\RmeVEeP.exe
  2⤵
  PID:10956
- C:\Windows\System\nAQnLwI.exe
  C:\Windows\System\nAQnLwI.exe
  2⤵
  PID:10984
- C:\Windows\System\yiQkCYr.exe
  C:\Windows\System\yiQkCYr.exe
  2⤵
  PID:11012
- C:\Windows\System\dBBJoph.exe
  C:\Windows\System\dBBJoph.exe
  2⤵
  PID:11048
- C:\Windows\System\sGaLqKA.exe
  C:\Windows\System\sGaLqKA.exe
  2⤵
  PID:11084
- C:\Windows\System\ttgxMQw.exe
  C:\Windows\System\ttgxMQw.exe
  2⤵
  PID:11100
- C:\Windows\System\ssVfvEP.exe
  C:\Windows\System\ssVfvEP.exe
  2⤵
  PID:11140
- C:\Windows\System\AqJWSzP.exe
  C:\Windows\System\AqJWSzP.exe
  2⤵
  PID:11164
- C:\Windows\System\NCrlXll.exe
  C:\Windows\System\NCrlXll.exe
  2⤵
  PID:11188
- C:\Windows\System\uOBgbKR.exe
  C:\Windows\System\uOBgbKR.exe
  2⤵
  PID:11216
- C:\Windows\System\Hvhgftk.exe
  C:\Windows\System\Hvhgftk.exe
  2⤵
  PID:11236
- C:\Windows\System\rSDRHHN.exe
  C:\Windows\System\rSDRHHN.exe
  2⤵
  PID:11252
- C:\Windows\System\eDOPMhW.exe
  C:\Windows\System\eDOPMhW.exe
  2⤵
  PID:8116
- C:\Windows\System\caCemBy.exe
  C:\Windows\System\caCemBy.exe
  2⤵
  PID:8180
- C:\Windows\System\yjSPGxu.exe
  C:\Windows\System\yjSPGxu.exe
  2⤵
  PID:2884
- C:\Windows\System\pcqNxtN.exe
  C:\Windows\System\pcqNxtN.exe
  2⤵
  PID:9496
- C:\Windows\System\KGbETWj.exe
  C:\Windows\System\KGbETWj.exe
  2⤵
  PID:6176
- C:\Windows\System\fVzjsrY.exe
  C:\Windows\System\fVzjsrY.exe
  2⤵
  PID:6328
- C:\Windows\System\snGoFrV.exe
  C:\Windows\System\snGoFrV.exe
  2⤵
  PID:9720
- C:\Windows\System\VBzjcoV.exe
  C:\Windows\System\VBzjcoV.exe
  2⤵
  PID:6892
- C:\Windows\System\YAGgduW.exe
  C:\Windows\System\YAGgduW.exe
  2⤵
  PID:6400
- C:\Windows\System\MFPNzjg.exe
  C:\Windows\System\MFPNzjg.exe
  2⤵
  PID:6940
- C:\Windows\System\taKJrDj.exe
  C:\Windows\System\taKJrDj.exe
  2⤵
  PID:7192
- C:\Windows\System\dQPVeXA.exe
  C:\Windows\System\dQPVeXA.exe
  2⤵
  PID:8224
- C:\Windows\System\adGOEfc.exe
  C:\Windows\System\adGOEfc.exe
  2⤵
  PID:9780
- C:\Windows\System\aKwcbxl.exe
  C:\Windows\System\aKwcbxl.exe
  2⤵
  PID:9808
- C:\Windows\System\Owdrnha.exe
  C:\Windows\System\Owdrnha.exe
  2⤵
  PID:8272
- C:\Windows\System\CeckBLW.exe
  C:\Windows\System\CeckBLW.exe
  2⤵
  PID:8296
- C:\Windows\System\pRcnPfk.exe
  C:\Windows\System\pRcnPfk.exe
  2⤵
  PID:8360
- C:\Windows\System\peUtZMJ.exe
  C:\Windows\System\peUtZMJ.exe
  2⤵
  PID:8400
- C:\Windows\System\nOZYnbz.exe
  C:\Windows\System\nOZYnbz.exe
  2⤵
  PID:8428
- C:\Windows\System\EvvLicS.exe
  C:\Windows\System\EvvLicS.exe
  2⤵
  PID:8464
- C:\Windows\System\yRQpvkl.exe
  C:\Windows\System\yRQpvkl.exe
  2⤵
  PID:8536
- C:\Windows\System\QeuIthm.exe
  C:\Windows\System\QeuIthm.exe
  2⤵
  PID:8596
- C:\Windows\System\LzvlEUq.exe
  C:\Windows\System\LzvlEUq.exe
  2⤵
  PID:11272
- C:\Windows\System\HHfXHCy.exe
  C:\Windows\System\HHfXHCy.exe
  2⤵
  PID:11292
- C:\Windows\System\KHXALVy.exe
  C:\Windows\System\KHXALVy.exe
  2⤵
  PID:11312
- C:\Windows\System\WQFSAaC.exe
  C:\Windows\System\WQFSAaC.exe
  2⤵
  PID:11332
- C:\Windows\System\ToiKYHU.exe
  C:\Windows\System\ToiKYHU.exe
  2⤵
  PID:11352
- C:\Windows\System\yIDoyVk.exe
  C:\Windows\System\yIDoyVk.exe
  2⤵
  PID:11368
- C:\Windows\System\RZlopQY.exe
  C:\Windows\System\RZlopQY.exe
  2⤵
  PID:11392
- C:\Windows\System\NEfdHnE.exe
  C:\Windows\System\NEfdHnE.exe
  2⤵
  PID:11412
- C:\Windows\System\uOrBRuv.exe
  C:\Windows\System\uOrBRuv.exe
  2⤵
  PID:11428
- C:\Windows\System\ZSBflzP.exe
  C:\Windows\System\ZSBflzP.exe
  2⤵
  PID:11448
- C:\Windows\System\grMXPTm.exe
  C:\Windows\System\grMXPTm.exe
  2⤵
  PID:11476
- C:\Windows\System\rLEWxlP.exe
  C:\Windows\System\rLEWxlP.exe
  2⤵
  PID:11496
- C:\Windows\System\LofKdXb.exe
  C:\Windows\System\LofKdXb.exe
  2⤵
  PID:11516
- C:\Windows\System\InBLfuA.exe
  C:\Windows\System\InBLfuA.exe
  2⤵
  PID:11540
- C:\Windows\System\wYaLedQ.exe
  C:\Windows\System\wYaLedQ.exe
  2⤵
  PID:11560
- C:\Windows\System\gymJVBZ.exe
  C:\Windows\System\gymJVBZ.exe
  2⤵
  PID:11580
- C:\Windows\System\EIrnFUP.exe
  C:\Windows\System\EIrnFUP.exe
  2⤵
  PID:11604
- C:\Windows\System\RWDSHst.exe
  C:\Windows\System\RWDSHst.exe
  2⤵
  PID:11628
- C:\Windows\System\evKTemQ.exe
  C:\Windows\System\evKTemQ.exe
  2⤵
  PID:11644
- C:\Windows\System\xebjOdW.exe
  C:\Windows\System\xebjOdW.exe
  2⤵
  PID:11668
- C:\Windows\System\cuJILcG.exe
  C:\Windows\System\cuJILcG.exe
  2⤵
  PID:11688
- C:\Windows\System\izcxkDB.exe
  C:\Windows\System\izcxkDB.exe
  2⤵
  PID:11708
- C:\Windows\System\XVHWCpy.exe
  C:\Windows\System\XVHWCpy.exe
  2⤵
  PID:11732
- C:\Windows\System\hprDueb.exe
  C:\Windows\System\hprDueb.exe
  2⤵
  PID:11760
- C:\Windows\System\XgQUCcZ.exe
  C:\Windows\System\XgQUCcZ.exe
  2⤵
  PID:11776
- C:\Windows\System\QTLIyim.exe
  C:\Windows\System\QTLIyim.exe
  2⤵
  PID:11796
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11796 -s 240
    3⤵
    PID:9880
- C:\Windows\System\OdXhcPc.exe
  C:\Windows\System\OdXhcPc.exe
  2⤵
  PID:11820
- C:\Windows\System\xwNxVDk.exe
  C:\Windows\System\xwNxVDk.exe
  2⤵
  PID:11840
- C:\Windows\System\GeFLOac.exe
  C:\Windows\System\GeFLOac.exe
  2⤵
  PID:11856
- C:\Windows\System\nVZuAum.exe
  C:\Windows\System\nVZuAum.exe
  2⤵
  PID:11872
- C:\Windows\System\mGyriQX.exe
  C:\Windows\System\mGyriQX.exe
  2⤵
  PID:11888
- C:\Windows\System\tmhJAoB.exe
  C:\Windows\System\tmhJAoB.exe
  2⤵
  PID:11904
- C:\Windows\System\NhBhROy.exe
  C:\Windows\System\NhBhROy.exe
  2⤵
  PID:11924
- C:\Windows\System\cKzdrJb.exe
  C:\Windows\System\cKzdrJb.exe
  2⤵
  PID:11940
- C:\Windows\System\mzUioIm.exe
  C:\Windows\System\mzUioIm.exe
  2⤵
  PID:11956
- C:\Windows\System\MhpeQjT.exe
  C:\Windows\System\MhpeQjT.exe
  2⤵
  PID:11976
- C:\Windows\System\VKJcOJB.exe
  C:\Windows\System\VKJcOJB.exe
  2⤵
  PID:11992
- C:\Windows\System\QZVBYFu.exe
  C:\Windows\System\QZVBYFu.exe
  2⤵
  PID:12016
- C:\Windows\System\UOxOMOA.exe
  C:\Windows\System\UOxOMOA.exe
  2⤵
  PID:12036
- C:\Windows\System\bHSgESP.exe
  C:\Windows\System\bHSgESP.exe
  2⤵
  PID:12052
- C:\Windows\System\CxLTMkg.exe
  C:\Windows\System\CxLTMkg.exe
  2⤵
  PID:12068
- C:\Windows\System\oVCBGfK.exe
  C:\Windows\System\oVCBGfK.exe
  2⤵
  PID:12084
- C:\Windows\System\NMjEjiL.exe
  C:\Windows\System\NMjEjiL.exe
  2⤵
  PID:12100
- C:\Windows\System\WaQwYna.exe
  C:\Windows\System\WaQwYna.exe
  2⤵
  PID:12116
- C:\Windows\System\rfVrQSj.exe
  C:\Windows\System\rfVrQSj.exe
  2⤵
  PID:12132
- C:\Windows\System\ZILVGCK.exe
  C:\Windows\System\ZILVGCK.exe
  2⤵
  PID:12148
- C:\Windows\System\iQURzCv.exe
  C:\Windows\System\iQURzCv.exe
  2⤵
  PID:12164
- C:\Windows\System\TsJQagY.exe
  C:\Windows\System\TsJQagY.exe
  2⤵
  PID:12184
- C:\Windows\System\LDqmatE.exe
  C:\Windows\System\LDqmatE.exe
  2⤵
  PID:12200
- C:\Windows\System\JIPGunc.exe
  C:\Windows\System\JIPGunc.exe
  2⤵
  PID:12216
- C:\Windows\System\sAFchQH.exe
  C:\Windows\System\sAFchQH.exe
  2⤵
  PID:12236
- C:\Windows\System\FrQeesx.exe
  C:\Windows\System\FrQeesx.exe
  2⤵
  PID:12272
- C:\Windows\System\xaTcyxb.exe
  C:\Windows\System\xaTcyxb.exe
  2⤵
  PID:8644
- C:\Windows\System\qebXYzW.exe
  C:\Windows\System\qebXYzW.exe
  2⤵
  PID:8680
- C:\Windows\System\BZKcovr.exe
  C:\Windows\System\BZKcovr.exe
  2⤵
  PID:3524
- C:\Windows\System\hTYBjPm.exe
  C:\Windows\System\hTYBjPm.exe
  2⤵
  PID:8032
- C:\Windows\System\HmkQdny.exe
  C:\Windows\System\HmkQdny.exe
  2⤵
  PID:7708
- C:\Windows\System\xBnSVwd.exe
  C:\Windows\System\xBnSVwd.exe
  2⤵
  PID:8788
- C:\Windows\System\vSmVoRm.exe
  C:\Windows\System\vSmVoRm.exe
  2⤵
  PID:6700
- C:\Windows\System\fqbdFiO.exe
  C:\Windows\System\fqbdFiO.exe
  2⤵
  PID:8824
- C:\Windows\System\JGIyIQK.exe
  C:\Windows\System\JGIyIQK.exe
  2⤵
  PID:8240
- C:\Windows\System\ybFEUhz.exe
  C:\Windows\System\ybFEUhz.exe
  2⤵
  PID:8852
- C:\Windows\System\HoFLrBT.exe
  C:\Windows\System\HoFLrBT.exe
  2⤵
  PID:10440
- C:\Windows\System\EcKGNiU.exe
  C:\Windows\System\EcKGNiU.exe
  2⤵
  PID:10524
- C:\Windows\System\MJjnNeg.exe
  C:\Windows\System\MJjnNeg.exe
  2⤵
  PID:10612
- C:\Windows\System\YUdeZuV.exe
  C:\Windows\System\YUdeZuV.exe
  2⤵
  PID:10632
- C:\Windows\System\jdhTWdU.exe
  C:\Windows\System\jdhTWdU.exe
  2⤵
  PID:10656
- C:\Windows\System\FZSjcfL.exe
  C:\Windows\System\FZSjcfL.exe
  2⤵
  PID:10680
- C:\Windows\System\CPSlqVx.exe
  C:\Windows\System\CPSlqVx.exe
  2⤵
  PID:10704
- C:\Windows\System\zzZwKjz.exe
  C:\Windows\System\zzZwKjz.exe
  2⤵
  PID:9380
- C:\Windows\System\CqKYFaj.exe
  C:\Windows\System\CqKYFaj.exe
  2⤵
  PID:12300
- C:\Windows\System\IcpOlTk.exe
  C:\Windows\System\IcpOlTk.exe
  2⤵
  PID:12328
- C:\Windows\System\RhdsquZ.exe
  C:\Windows\System\RhdsquZ.exe
  2⤵
  PID:12348
- C:\Windows\System\vACMyvu.exe
  C:\Windows\System\vACMyvu.exe
  2⤵
  PID:12372
- C:\Windows\System\xgOJsNG.exe
  C:\Windows\System\xgOJsNG.exe
  2⤵
  PID:12388
- C:\Windows\System\TqDyBnf.exe
  C:\Windows\System\TqDyBnf.exe
  2⤵
  PID:12408
- C:\Windows\System\gTHDMTm.exe
  C:\Windows\System\gTHDMTm.exe
  2⤵
  PID:12432
- C:\Windows\System\rUiPYhj.exe
  C:\Windows\System\rUiPYhj.exe
  2⤵
  PID:12452
- C:\Windows\System\kMpxoQK.exe
  C:\Windows\System\kMpxoQK.exe
  2⤵
  PID:12488
- C:\Windows\System\XijdbwZ.exe
  C:\Windows\System\XijdbwZ.exe
  2⤵
  PID:12520
- C:\Windows\System\dzdPMvR.exe
  C:\Windows\System\dzdPMvR.exe
  2⤵
  PID:12536
- C:\Windows\System\rPvcgsh.exe
  C:\Windows\System\rPvcgsh.exe
  2⤵
  PID:12552
- C:\Windows\System\OJOqifC.exe
  C:\Windows\System\OJOqifC.exe
  2⤵
  PID:12568
- C:\Windows\System\FMwjJJc.exe
  C:\Windows\System\FMwjJJc.exe
  2⤵
  PID:12584
- C:\Windows\System\quRNKfa.exe
  C:\Windows\System\quRNKfa.exe
  2⤵
  PID:12612
- C:\Windows\System\SIvZlUL.exe
  C:\Windows\System\SIvZlUL.exe
  2⤵
  PID:12632
- C:\Windows\System\lxWLByO.exe
  C:\Windows\System\lxWLByO.exe
  2⤵
  PID:12664
- C:\Windows\System\NYMtQzN.exe
  C:\Windows\System\NYMtQzN.exe
  2⤵
  PID:12688
- C:\Windows\System\QyDQxZi.exe
  C:\Windows\System\QyDQxZi.exe
  2⤵
  PID:12704
- C:\Windows\System\DIXWLGf.exe
  C:\Windows\System\DIXWLGf.exe
  2⤵
  PID:12724
- C:\Windows\System\ayMxYed.exe
  C:\Windows\System\ayMxYed.exe
  2⤵
  PID:12740
- C:\Windows\System\IIfLLCA.exe
  C:\Windows\System\IIfLLCA.exe
  2⤵
  PID:12756
- C:\Windows\System\QxBhJPN.exe
  C:\Windows\System\QxBhJPN.exe
  2⤵
  PID:12788
- C:\Windows\System\xirHilB.exe
  C:\Windows\System\xirHilB.exe
  2⤵
  PID:12804
- C:\Windows\System\faYKkYu.exe
  C:\Windows\System\faYKkYu.exe
  2⤵
  PID:12836
- C:\Windows\System\fBdhIqj.exe
  C:\Windows\System\fBdhIqj.exe
  2⤵
  PID:12856
- C:\Windows\System\oLbsZAX.exe
  C:\Windows\System\oLbsZAX.exe
  2⤵
  PID:13148
- C:\Windows\System\sAgeEni.exe
  C:\Windows\System\sAgeEni.exe
  2⤵
  PID:13172
- C:\Windows\System\OWKMkaN.exe
  C:\Windows\System\OWKMkaN.exe
  2⤵
  PID:13192
- C:\Windows\System\TTDYhDV.exe
  C:\Windows\System\TTDYhDV.exe
  2⤵
  PID:13216
- C:\Windows\System\zRIpIge.exe
  C:\Windows\System\zRIpIge.exe
  2⤵
  PID:13232
- C:\Windows\System\zSxDHDs.exe
  C:\Windows\System\zSxDHDs.exe
  2⤵
  PID:13256
- C:\Windows\System\QcYVzVy.exe
  C:\Windows\System\QcYVzVy.exe
  2⤵
  PID:13276
- C:\Windows\System\SRFeUyN.exe
  C:\Windows\System\SRFeUyN.exe
  2⤵
  PID:13300
- C:\Windows\System\jtFCOeL.exe
  C:\Windows\System\jtFCOeL.exe
  2⤵
  PID:8988
- C:\Windows\System\OpEvpCL.exe
  C:\Windows\System\OpEvpCL.exe
  2⤵
  PID:9500
- C:\Windows\System\fbzPrLK.exe
  C:\Windows\System\fbzPrLK.exe
  2⤵
  PID:11004
- C:\Windows\System\oUViLZd.exe
  C:\Windows\System\oUViLZd.exe
  2⤵
  PID:9064
- C:\Windows\System\UEqSspI.exe
  C:\Windows\System\UEqSspI.exe
  2⤵
  PID:9680
- C:\Windows\System\TDEEDvr.exe
  C:\Windows\System\TDEEDvr.exe
  2⤵
  PID:9696
- C:\Windows\System\HXIUXBn.exe
  C:\Windows\System\HXIUXBn.exe
  2⤵
  PID:9124
- C:\Windows\System\IApvrol.exe
  C:\Windows\System\IApvrol.exe
  2⤵
  PID:9856
- C:\Windows\System\Wmecgpa.exe
  C:\Windows\System\Wmecgpa.exe
  2⤵
  PID:4176
- C:\Windows\System\WVykCxI.exe
  C:\Windows\System\WVykCxI.exe
  2⤵
  PID:11248
- C:\Windows\System\oHEreHa.exe
  C:\Windows\System\oHEreHa.exe
  2⤵
  PID:9212
- C:\Windows\System\UvZmmOI.exe
  C:\Windows\System\UvZmmOI.exe
  2⤵
  PID:6648
- C:\Windows\System\hmOkBGY.exe
  C:\Windows\System\hmOkBGY.exe
  2⤵
  PID:6872
- C:\Windows\System\DWnlPdP.exe
  C:\Windows\System\DWnlPdP.exe
  2⤵
  PID:9788
- C:\Windows\System\CSQHKeS.exe
  C:\Windows\System\CSQHKeS.exe
  2⤵
  PID:8312
- C:\Windows\System\xBXMvny.exe
  C:\Windows\System\xBXMvny.exe
  2⤵
  PID:8448
- C:\Windows\System\bSzMNCs.exe
  C:\Windows\System\bSzMNCs.exe
  2⤵
  PID:11468
- C:\Windows\System\IJUlLDM.exe
  C:\Windows\System\IJUlLDM.exe
  2⤵
  PID:7576
- C:\Windows\System\BjpHmkh.exe
  C:\Windows\System\BjpHmkh.exe
  2⤵
  PID:7616
- C:\Windows\System\gBbpndl.exe
  C:\Windows\System\gBbpndl.exe
  2⤵
  PID:4816
- C:\Windows\System\oDkqZwN.exe
  C:\Windows\System\oDkqZwN.exe
  2⤵
  PID:7864
- C:\Windows\System\cdjsTPf.exe
  C:\Windows\System\cdjsTPf.exe
  2⤵
  PID:11916
- C:\Windows\System\FuknKMJ.exe
  C:\Windows\System\FuknKMJ.exe
  2⤵
  PID:8752
- C:\Windows\System\NUxBJRx.exe
  C:\Windows\System\NUxBJRx.exe
  2⤵
  PID:5976
- C:\Windows\System\UXvpzkA.exe
  C:\Windows\System\UXvpzkA.exe
  2⤵
  PID:6032
- C:\Windows\System\vRUNaGH.exe
  C:\Windows\System\vRUNaGH.exe
  2⤵
  PID:10260
- C:\Windows\System\wFUWyip.exe
  C:\Windows\System\wFUWyip.exe
  2⤵
  PID:11984
- C:\Windows\System\PcEkORh.exe
  C:\Windows\System\PcEkORh.exe
  2⤵
  PID:12108
- C:\Windows\System\zizZcCP.exe
  C:\Windows\System\zizZcCP.exe
  2⤵
  PID:7052
- C:\Windows\System\gbckfFk.exe
  C:\Windows\System\gbckfFk.exe
  2⤵
  PID:10376
- C:\Windows\System\pjoxwqV.exe
  C:\Windows\System\pjoxwqV.exe
  2⤵
  PID:10384
- C:\Windows\System\vYBgvqR.exe
  C:\Windows\System\vYBgvqR.exe
  2⤵
  PID:9468
- C:\Windows\System\yDrzZUh.exe
  C:\Windows\System\yDrzZUh.exe
  2⤵
  PID:10308
- C:\Windows\System\miMPmQZ.exe
  C:\Windows\System\miMPmQZ.exe
  2⤵
  PID:13316
- C:\Windows\System\UPdLfKo.exe
  C:\Windows\System\UPdLfKo.exe
  2⤵
  PID:13336
- C:\Windows\System\CQPRjFs.exe
  C:\Windows\System\CQPRjFs.exe
  2⤵
  PID:13356
- C:\Windows\System\DqmOuhB.exe
  C:\Windows\System\DqmOuhB.exe
  2⤵
  PID:13376
- C:\Windows\System\hYjmjdI.exe
  C:\Windows\System\hYjmjdI.exe
  2⤵
  PID:13400
- C:\Windows\System\qhqcpic.exe
  C:\Windows\System\qhqcpic.exe
  2⤵
  PID:13420
- C:\Windows\System\qDOGvha.exe
  C:\Windows\System\qDOGvha.exe
  2⤵
  PID:13436
- C:\Windows\System\auBcbKr.exe
  C:\Windows\System\auBcbKr.exe
  2⤵
  PID:14272
- C:\Windows\System\MMxSphv.exe
  C:\Windows\System\MMxSphv.exe
  2⤵
  PID:14304
- C:\Windows\System\vUzVnaa.exe
  C:\Windows\System\vUzVnaa.exe
  2⤵
  PID:9976
- C:\Windows\System\pMLlJwN.exe
  C:\Windows\System\pMLlJwN.exe
  2⤵
  PID:12748
- C:\Windows\System\mMsryIx.exe
  C:\Windows\System\mMsryIx.exe
  2⤵
  PID:13684
- C:\Windows\System\vSnkpMX.exe
  C:\Windows\System\vSnkpMX.exe
  2⤵
  PID:12900
- C:\Windows\System\SSJHHKE.exe
  C:\Windows\System\SSJHHKE.exe
  2⤵
  PID:12920
- C:\Windows\System\RiRELfc.exe
  C:\Windows\System\RiRELfc.exe
  2⤵
  PID:12940
- C:\Windows\System\yeSqyHw.exe
  C:\Windows\System\yeSqyHw.exe
  2⤵
  PID:12964
- C:\Windows\System\DoPYsNk.exe
  C:\Windows\System\DoPYsNk.exe
  2⤵
  PID:13024
- C:\Windows\System\AobiJsv.exe
  C:\Windows\System\AobiJsv.exe
  2⤵
  PID:13044
- C:\Windows\System\TBajrsD.exe
  C:\Windows\System\TBajrsD.exe
  2⤵
  PID:13716
- C:\Windows\System\rEAgIbh.exe
  C:\Windows\System\rEAgIbh.exe
  2⤵
  PID:13724
- C:\Windows\System\yNpjOXH.exe
  C:\Windows\System\yNpjOXH.exe
  2⤵
  PID:13184
- C:\Windows\System\qqLesWg.exe
  C:\Windows\System\qqLesWg.exe
  2⤵
  PID:13164
- C:\Windows\System\BhozLML.exe
  C:\Windows\System\BhozLML.exe
  2⤵
  PID:13224
- C:\Windows\System\IpwbqZq.exe
  C:\Windows\System\IpwbqZq.exe
  2⤵
  PID:9412
- C:\Windows\System\jmLDcxy.exe
  C:\Windows\System\jmLDcxy.exe
  2⤵
  PID:9524
- C:\Windows\System\EdpWDrS.exe
  C:\Windows\System\EdpWDrS.exe
  2⤵
  PID:11036
- C:\Windows\System\RRrUWlF.exe
  C:\Windows\System\RRrUWlF.exe
  2⤵
  PID:11176
- C:\Windows\System\SCuJWhH.exe
  C:\Windows\System\SCuJWhH.exe
  2⤵
  PID:9188
- C:\Windows\System\foLtbQg.exe
  C:\Windows\System\foLtbQg.exe
  2⤵
  PID:3408
- C:\Windows\System\RBLaYSu.exe
  C:\Windows\System\RBLaYSu.exe
  2⤵
  PID:13352
- C:\Windows\System\GCcrkBd.exe
  C:\Windows\System\GCcrkBd.exe
  2⤵
  PID:13384
- C:\Windows\System\AHVIDKB.exe
  C:\Windows\System\AHVIDKB.exe
  2⤵
  PID:13456
- C:\Windows\System\CIvNHVN.exe
  C:\Windows\System\CIvNHVN.exe
  2⤵
  PID:13480
- C:\Windows\System\elccZDJ.exe
  C:\Windows\System\elccZDJ.exe
  2⤵
  PID:13500
- C:\Windows\System\YFJHouh.exe
  C:\Windows\System\YFJHouh.exe
  2⤵
  PID:13540
- C:\Windows\System\tvXofrK.exe
  C:\Windows\System\tvXofrK.exe
  2⤵
  PID:13844
- C:\Windows\System\OqYhyZR.exe
  C:\Windows\System\OqYhyZR.exe
  2⤵
  PID:13856
- C:\Windows\System\QuAjzZL.exe
  C:\Windows\System\QuAjzZL.exe
  2⤵
  PID:1732
- C:\Windows\System\yxgjWSe.exe
  C:\Windows\System\yxgjWSe.exe
  2⤵
  PID:644
- C:\Windows\System\oHdIZXa.exe
  C:\Windows\System\oHdIZXa.exe
  2⤵
  PID:13952
- C:\Windows\System\MqMaSjb.exe
  C:\Windows\System\MqMaSjb.exe
  2⤵
  PID:13572
- C:\Windows\System\fQDWSfJ.exe
  C:\Windows\System\fQDWSfJ.exe
  2⤵
  PID:13884
- C:\Windows\System\nnVAHBW.exe
  C:\Windows\System\nnVAHBW.exe
  2⤵
  PID:1188
- C:\Windows\System\HJHDaRc.exe
  C:\Windows\System\HJHDaRc.exe
  2⤵
  PID:10712
- C:\Windows\System\gHYuthd.exe
  C:\Windows\System\gHYuthd.exe
  2⤵
  PID:12564
- C:\Windows\System\PqZhExj.exe
  C:\Windows\System\PqZhExj.exe
  2⤵
  PID:14160
- C:\Windows\System\oyDgpOe.exe
  C:\Windows\System\oyDgpOe.exe
  2⤵
  PID:1068
- C:\Windows\System\KEYblPv.exe
  C:\Windows\System\KEYblPv.exe
  2⤵
  PID:9924
- C:\Windows\System\cgnrOWE.exe
  C:\Windows\System\cgnrOWE.exe
  2⤵
  PID:14020
- C:\Windows\System\cPJaVba.exe
  C:\Windows\System\cPJaVba.exe
  2⤵
  PID:14044
- C:\Windows\System\qPVakNI.exe
  C:\Windows\System\qPVakNI.exe
  2⤵
  PID:9548
- C:\Windows\System\LQRJfpq.exe
  C:\Windows\System\LQRJfpq.exe
  2⤵
  PID:14116
- C:\Windows\System\NgnfSgn.exe
  C:\Windows\System\NgnfSgn.exe
  2⤵
  PID:13000
- C:\Windows\System\AEJKwHo.exe
  C:\Windows\System\AEJKwHo.exe
  2⤵
  PID:8904
- C:\Windows\System\HrqxxrH.exe
  C:\Windows\System\HrqxxrH.exe
  2⤵
  PID:6232
- C:\Windows\System\wXHZAcC.exe
  C:\Windows\System\wXHZAcC.exe
  2⤵
  PID:10040
- C:\Windows\System\Potvosr.exe
  C:\Windows\System\Potvosr.exe
  2⤵
  PID:10004
- C:\Windows\System\KsXALgX.exe
  C:\Windows\System\KsXALgX.exe
  2⤵
  PID:13080
- C:\Windows\System\niSZrFx.exe
  C:\Windows\System\niSZrFx.exe
  2⤵
  PID:14324
- C:\Windows\System\EZRgwcA.exe
  C:\Windows\System\EZRgwcA.exe
  2⤵
  PID:3160
- C:\Windows\System\bUyuUIv.exe
  C:\Windows\System\bUyuUIv.exe
  2⤵
  PID:9844
- C:\Windows\System\SFuXuBE.exe
  C:\Windows\System\SFuXuBE.exe
  2⤵
  PID:9668
- C:\Windows\System\IFcvfSM.exe
  C:\Windows\System\IFcvfSM.exe
  2⤵
  PID:13292
- C:\Windows\System\xoroIYA.exe
  C:\Windows\System\xoroIYA.exe
  2⤵
  PID:6256
- C:\Windows\System\moFYxnu.exe
  C:\Windows\System\moFYxnu.exe
  2⤵
  PID:10380
- C:\Windows\System\Xddqvqa.exe
  C:\Windows\System\Xddqvqa.exe
  2⤵
  PID:9744
- C:\Windows\System\QIWbVpk.exe
  C:\Windows\System\QIWbVpk.exe
  2⤵
  PID:7992
- C:\Windows\System\LQDPceq.exe
  C:\Windows\System\LQDPceq.exe
  2⤵
  PID:13580
- C:\Windows\System\vpjKRmx.exe
  C:\Windows\System\vpjKRmx.exe
  2⤵
  PID:10148
- C:\Windows\System\pWJpFYy.exe
  C:\Windows\System\pWJpFYy.exe
  2⤵
  PID:10072
- C:\Windows\System\BDDmQbX.exe
  C:\Windows\System\BDDmQbX.exe
  2⤵
  PID:7668
- C:\Windows\System\pclUhaW.exe
  C:\Windows\System\pclUhaW.exe
  2⤵
  PID:12360
- C:\Windows\System\iWfhket.exe
  C:\Windows\System\iWfhket.exe
  2⤵
  PID:12080
- C:\Windows\System\kTTdEQQ.exe
  C:\Windows\System\kTTdEQQ.exe
  2⤵
  PID:13508
- C:\Windows\System\iqNoCpf.exe
  C:\Windows\System\iqNoCpf.exe
  2⤵
  PID:2448
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2448 -s 240
    3⤵
    PID:9836
- C:\Windows\System\LTBLrwa.exe
  C:\Windows\System\LTBLrwa.exe
  2⤵
  PID:10788
- C:\Windows\System\mJqgcQb.exe
  C:\Windows\System\mJqgcQb.exe
  2⤵
  PID:10740
- C:\Windows\System\UOOxNmb.exe
  C:\Windows\System\UOOxNmb.exe
  2⤵
  PID:12832
- C:\Windows\System\ojpJvyW.exe
  C:\Windows\System\ojpJvyW.exe
  2⤵
  PID:2096
- C:\Windows\System\ZkmJiCp.exe
  C:\Windows\System\ZkmJiCp.exe
  2⤵
  PID:13032
- C:\Windows\System\BiJgRVR.exe
  C:\Windows\System\BiJgRVR.exe
  2⤵
  PID:2932
- C:\Windows\System\XUjfmQl.exe
  C:\Windows\System\XUjfmQl.exe
  2⤵
  PID:13816
- C:\Windows\System\qLnuimk.exe
  C:\Windows\System\qLnuimk.exe
  2⤵
  PID:4352
- C:\Windows\System\UeILKBc.exe
  C:\Windows\System\UeILKBc.exe
  2⤵
  PID:13848
- C:\Windows\System\nGOxxIs.exe
  C:\Windows\System\nGOxxIs.exe
  2⤵
  PID:3644
- C:\Windows\System\BPeFAOn.exe
  C:\Windows\System\BPeFAOn.exe
  2⤵
  PID:14032
- C:\Windows\System\PbeUjvQ.exe
  C:\Windows\System\PbeUjvQ.exe
  2⤵
  PID:10160
- C:\Windows\System\LVjblIQ.exe
  C:\Windows\System\LVjblIQ.exe
  2⤵
  PID:13608
- C:\Windows\System\fnkOJhx.exe
  C:\Windows\System\fnkOJhx.exe
  2⤵
  PID:9996
- C:\Windows\System\xfYqMuI.exe
  C:\Windows\System\xfYqMuI.exe
  2⤵
  PID:12984
- C:\Windows\System\uQlXUHF.exe
  C:\Windows\System\uQlXUHF.exe
  2⤵
  PID:12264
- C:\Windows\System\ZWyCUTA.exe
  C:\Windows\System\ZWyCUTA.exe
  2⤵
  PID:7104
- C:\Windows\System\FdaAGUk.exe
  C:\Windows\System\FdaAGUk.exe
  2⤵
  PID:8804
- C:\Windows\System\SpeJiAB.exe
  C:\Windows\System\SpeJiAB.exe
  2⤵
  PID:14040
- C:\Windows\System\DwUnmcV.exe
  C:\Windows\System\DwUnmcV.exe
  2⤵
  PID:10188
- C:\Windows\System\xJsfdal.exe
  C:\Windows\System\xJsfdal.exe
  2⤵
  PID:8604
- C:\Windows\System\OXibzng.exe
  C:\Windows\System\OXibzng.exe
  2⤵
  PID:10628
- C:\Windows\System\NgsBZsm.exe
  C:\Windows\System\NgsBZsm.exe
  2⤵
  PID:2608
- C:\Windows\System\pKhWFoi.exe
  C:\Windows\System\pKhWFoi.exe
  2⤵
  PID:7324
- C:\Windows\System\ByTCCKV.exe
  C:\Windows\System\ByTCCKV.exe
  2⤵
  PID:11684
- C:\Windows\System\rFfwlWD.exe
  C:\Windows\System\rFfwlWD.exe
  2⤵
  PID:12720
- C:\Windows\System\KmeYvar.exe
  C:\Windows\System\KmeYvar.exe
  2⤵
  PID:10804
- C:\Windows\System\vzRisZp.exe
  C:\Windows\System\vzRisZp.exe
  2⤵
  PID:4940
- C:\Windows\System\IIyKBpR.exe
  C:\Windows\System\IIyKBpR.exe
  2⤵
  PID:9172
- C:\Windows\System\OgLdnlu.exe
  C:\Windows\System\OgLdnlu.exe
  2⤵
  PID:6276
- C:\Windows\System\LNCCDEt.exe
  C:\Windows\System\LNCCDEt.exe
  2⤵
  PID:14220
- C:\Windows\System\AlfSMGa.exe
  C:\Windows\System\AlfSMGa.exe
  2⤵
  PID:8940
- C:\Windows\System\ynBUztF.exe
  C:\Windows\System\ynBUztF.exe
  2⤵
  PID:10800
- C:\Windows\System\GHYfKUa.exe
  C:\Windows\System\GHYfKUa.exe
  2⤵
  PID:13920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_myamrba0.r5k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ACwELBb.exe

Filesize
1.7MB

MD5
5caccc7256d004efb03ebfadcf0aa62c

SHA1
6d4eb1e8db0e8920a1b68b9fc736ff4885b28677

SHA256
4385923ce615816e2e641bfcf36f8176757aa60f97471ff191b05b74f7b6a79f

SHA512
9fd80127098bec0db5674051160a3268b0468c689bbea3aa579d7d0576b1feab17a2fc30a71696cf6f703332570a2e6af68c780974e1c02ca9d1d41e41c86656

Download Submit
C:\Windows\System\AgXGacn.exe

Filesize
1.7MB

MD5
7fc3ca9517640c138adcd3928266b7c9

SHA1
682baacba0efd4dc56a73c77e0480babdca1b7d1

SHA256
429ae9f0601c3fd4e4383a803946970cc159b925ce3e640b2635ad76977b6255

SHA512
1e653a23a39eb615f6979d9602027e23539a958190ac8846daa9d5c195d4be04a108a3a9e222be5114bf3cfc4593140ef3fc4bf6c2239a96257b1a361ab3d043

Download Submit
C:\Windows\System\BXnwQbx.exe

Filesize
1.7MB

MD5
88ddf1711a1e722254ac8d78a5220629

SHA1
a4695f2aceae1c9fca5979290ebb012156236185

SHA256
b705a6bddd12c594ceef64af9f7ce778a614c7b56660644f2f7ecdf5fab3cc1e

SHA512
d5a3b40b51ad657ba210c61e48e051d62b09a641fa7e00ee7f158e32b5cbb73eaaec83acb471172cbe94f7ec1ad0dd0ed854ba46c1c3ad10ac5b03f3803a6160

Download Submit
C:\Windows\System\BeGMFKC.exe

Filesize
1.7MB

MD5
d2f0194dbf71d1f23f3378811fb2fcd1

SHA1
b3fa39097a02b776e67d9423fd99b003f4dcfd26

SHA256
49ac3a01b84020067f62886ba49bd8e8382237d80234df34745be9a752102038

SHA512
d42aad9800e22537b6e23f6ccf4ce3e1295643bf8a026d31b3dae77c036b01360f8b387dfacf9756679e201414bbf13ff2b3332e0a72d81f1b81d9553a4b4b1b

Download Submit
C:\Windows\System\DQWGmcr.exe

Filesize
1.7MB

MD5
592f266984df650df908eb3fe2c1de9a

SHA1
10421df4ff08743b6a60a048dae7c994d86595df

SHA256
c48fdda9600cc16ecd65fbf732972d4896e57e6b5411c2b28729af3286a9fc44

SHA512
ecb90aaf550c2d3eca8cf5d27c181dba15891081b965ab2762bf878ac514d4b095035f01f40f9e229efcfff4d23c620e42f3ac118e5222a15ed9d8c768703a94

Download Submit
C:\Windows\System\DjtXUZu.exe

Filesize
1.7MB

MD5
ac84ab4f65ab2773b5b5aeeb8fe53ba2

SHA1
ff2573f52d8301407b685dbb91079ae7be1ae992

SHA256
2e26c8e75a440fe5858ae069ac01664807c9139984829538ba6d46d147f26217

SHA512
d2ddf045dae4b53e21948993745d4403379a7e4fb8aa506ccb5431c6f29814ca33a8fdf356683b0a8e17931d862f5aa480f7092e999c06fe0fe4b1164bfdcb2e

Download Submit
C:\Windows\System\EYPdBTL.exe

Filesize
1.7MB

MD5
fc27e004113795007fadd2e1d9489880

SHA1
96a73e15a9931537ae24fa9ba0bdf2760f950056

SHA256
23a3bbbac2793665906bc8b860d6cde8b8808d5d17ce7fc1f9c9068beafe02d9

SHA512
6a79af66282034e2c3a888c1bf8d0f1f1a60187fc71df7349f936ee046a7e2c628846ddc07e2b85d71a7be14dea7c22d187ae2bc8a1013acb9e1a7085aa40a02

Download Submit
C:\Windows\System\HIqeFqn.exe

Filesize
1.7MB

MD5
929c758162c9d730e122c22a8ba7275c

SHA1
e0cfdd3add88e72edf793d2ec12db7b2f7b86d03

SHA256
335898f43a265a59710267dde079f669e7af48674290ae3776d0174f7f151a23

SHA512
5a66fc97b660b94cad647933c4deddd244a9613c2841fd194b9ccd44eb90d0cea71c3f4c2c6b1da7da476df3647f3b49c18898c1eddd3b552021901747518b72

Download Submit
C:\Windows\System\IeVIURD.exe

Filesize
1.7MB

MD5
96f7b20ae5ff87e9f9660e9d22dc4dd7

SHA1
d19de15f37d2c3c791934bc175136af5ec497c04

SHA256
65391728da45249fe17fe20267cc0a3e2a94ff4824763187a53a0af910955594

SHA512
a78fd6f0114e18d08f3a83415a259f26f60de2579f19462bc87f7af4581a26584ade8f4c3bc6b30b1de957028edfdfc346371bffd4cdf53fc66c28b3272e7324

Download Submit
C:\Windows\System\JFRFoEi.exe

Filesize
1.7MB

MD5
e0b17601550b1adb1138485a1d34efd4

SHA1
4b2b66dc255f893fbbfc077a7fb975b80fdca68b

SHA256
75e55aff51389ba20183053b4328663e514c7eae2e238b70902a7fe466de0caf

SHA512
dba7999e41f48a17aafa4af7ccfbcd7dbbc25d73ad1c2653c816cfe35d55ab4d3ff3acca19f86011b25d9cbbcdb7df7a8f7b528f6939132e44c48f85088b7972

Download Submit
C:\Windows\System\JvGjkjy.exe

Filesize
1.7MB

MD5
d1fb153f26ad0a83c418a4242525e2b4

SHA1
bce5b30dae52c47c8e862fd03beebe89ea064b26

SHA256
6609a235ed0443e9c9f4626a0ff8d980a4c4d182da437a752c4431d19df61bbd

SHA512
c786eb2971106be98ab01c4e1da4c793b1aeeb701a3ffe5cfe0e19b0ac03e7e1e6bf5ade429d6359bfdb470fcb04b1d623d67034897647d10ac34c60a1595a52

Download Submit
C:\Windows\System\KLbWzgV.exe

Filesize
1.7MB

MD5
86b7b33c1152ec10123f1c918dbcb02c

SHA1
01460134443169b2cc56a88c9e3d4ced34fa7a9e

SHA256
f6b9f4d8300b039d55ba7ce0d2476621bc5ab7f352e6adafc739e867a4c7d457

SHA512
0d8fd52ae10ff3783b2152676cf01ef5aa34809a7d4c74feac288646d8dbb921544602baf36a9b7363182564988895ab068b61f6e569e99bf5a6fcf40fe87a20

Download Submit
C:\Windows\System\KNUPrrH.exe

Filesize
1.7MB

MD5
122dd54b8de2a07b78cc5e576b624080

SHA1
9deeee3a811477764c445b65011029242f55be05

SHA256
bda467499113e5284d518380410a67f0d1e4fb7efea886d4b3a9e3ed6d7f2b2f

SHA512
a178fba76ce0afeadca700cf724414e0a797e7ba09f9216a48e077f882023b5fdf1a8224a8b6824619e6e290955f60a56df1836421e5c4b364a1858e4b1d6ffa

Download Submit
C:\Windows\System\LPstoGb.exe

Filesize
1.7MB

MD5
a5e5082ea8b226920c0c79be8d3fca4a

SHA1
cee6ed8b57f332b0e9fd199fdebb613abd68be4d

SHA256
4674a04ffd50d50d31249e0bc34f4dacea547c009685a2dbdabad3b338be9579

SHA512
0c40e87b9bf74c3ff760ca204270f9dd89beb69198b1c9cb9fe70ec2169a8679a27b62488509c05cf3f836518715465b859aec2743dfd551887205e659ec14bd

Download Submit
C:\Windows\System\LoDzfXS.exe

Filesize
1.7MB

MD5
f81c6e1dcf675aec03f7b32f43276ea2

SHA1
648dd15e82875d33b074f11eac8e8a515e7156f2

SHA256
101c161ae3a2ec17c540ceb15fbd6d2b83d9f5a1d049096540c22447c1f665a3

SHA512
74b2118274f80d20c9bb8dab524730df57ddc0898d6665023dae6231179917b19ca42b18751ac7d0e2261c3eb795b2891dabc6217a250b2b3baaf33fc8e21c3c

Download Submit
C:\Windows\System\QdDlQwh.exe

Filesize
1.7MB

MD5
8deb43986768edf23b203b4a79f60450

SHA1
8a2ec5dc017f98c03830f65b276e392d5eb9f641

SHA256
ae2b75bac3a07fa1beb0ed8b5ee532cf568d259eb5ecec3710f35c96e0bf0b17

SHA512
044ff69c8f192e07d0c7e90cf026c189d6dc24eb18b88b67e03cd27e0636da31faff7a845679ab7e2ee569539630b2658cee00a07bc4a91c48b2dbe3d9adb151

Download Submit
C:\Windows\System\ROOYtcF.exe

Filesize
1.7MB

MD5
cc1447ace49a35fbb6735c87eb7bb6b8

SHA1
0ba109776303af12c84914418217e3beb229bde4

SHA256
6d703db9f1d2fdd91b1805773f1d72cb0a0d9d78c47275cacc20cf13db3a380d

SHA512
0d5d116df559197e3818b5b5d0297cbf76fe9bfef2ad5f6863c495114083e078b145cc25dabd66e656bc4d36a26d12c17de41cff65e4c68ac4dbb7c3cd8c0c14

Download Submit
C:\Windows\System\RbBOuOC.exe

Filesize
1.7MB

MD5
b280cffe3728f9ad6322740345a82588

SHA1
e0754a8a099e55736fdf6e6df2335e6908ab4fa9

SHA256
5cfb9a4f8ec7d67a4ca1a1f3b257f4105ce90ff31f69f8b3f39804fbef999211

SHA512
6fed15aba46a4b7c3083ce4e75ca08dcf2031a58c4e68061f4946010321073aa344e509d4625afbae997edf5bbd5a2eace051e748c880745216eade3b5ac00c6

Download Submit
C:\Windows\System\SvakAsx.exe

Filesize
1.7MB

MD5
02b6511d051675dddec6f6a73579f2ac

SHA1
3390dc361451aa324f81cc87410f8eb63669875f

SHA256
98a31a34cf73e972bc7548c5c83c2e1562079d7c823b72276bad467ac3611f89

SHA512
42e2b4d30c3f1113a12a332cb4cb3b66d098ad42b3ff65b52fba6d67e16417d26e824e1323eba56cb8e2968e43e894dfca9db97e86f81d7ceff22d5374e938f4

Download Submit
C:\Windows\System\VIrCVkc.exe

Filesize
1.7MB

MD5
963a744d6f5e96299bdbb8c4def467c7

SHA1
f7f3c4506874a8dbb8cc9e94ae496d90bf93061a

SHA256
e80f4c555b58e4156a8a2b79bbc8d8f59527296ad267c9cb92aaf6ffddb6587b

SHA512
750dc605475f10a550549789f9dec60c370a9348571cfeab6017aff689818ed922a8ea631a578e933a6b3bf111937bb907c8b2d410a960251dd335984a583041

Download Submit
C:\Windows\System\ZPZWRWr.exe

Filesize
1.7MB

MD5
a25eafbceb91eb80eea88a358a3b3f21

SHA1
eff57bd0668539f5a4d68b4829f1c31e87f87105

SHA256
e0e7c04fa017200c6f68479890d6ecb6e494f43f86075281fc439fc6a74f8c68

SHA512
276ae32859c019ed420964e3a227f12e6831402657f778d2165a2c080fd1ae7807cc047b1de15818cf0b6a658396f2954e524b47fcb74b6225498304947eac86

Download Submit
C:\Windows\System\auWuCfC.exe

Filesize
1.7MB

MD5
b90f62db36ed41fed06079d79cf733b3

SHA1
d9c10ca5de1664375d8d7f04ba4ec2b064b06893

SHA256
229ce50d8c7f7ac4b773864e4d47e64dd376452a7c23f2b2f866b1aa31ffc594

SHA512
e542e8bce8d7e2fc6508b84d2cd2dbd00b494c6a1ddf7fd9779ed93b30ceda368a51fb877a86ebae0d656460716790703906000ec6ad549d73cc3fc78c44555a

Download Submit
C:\Windows\System\axvmNva.exe

Filesize
1.7MB

MD5
8890554f3e075e31061aec02edfa047d

SHA1
0d45f606acac69d29977aade97b36b83ecfe229f

SHA256
34d2d2e82c751f411d6db325f3a66e05ff351cdcab7b2ce2dfc7980df09d5738

SHA512
1de706e7a9e291ca677821092985d8b06058f9b7973598c3e42deffc99b58cdc61ff9fb5a8f30492bdc6255906165e238d13414281d1adcdc62b9f45e1e41d12

Download Submit
C:\Windows\System\btTPJWx.exe

Filesize
1.7MB

MD5
4fb9771e5a012fdd071346ac8e14be6b

SHA1
84b87fce99f953f66c7cb7eaf7be92a99da39d79

SHA256
4fae125bd85a02528d64d8c49967656d1c9de2715e3b5c2a906582fdea26ca73

SHA512
6c8f7ff47f5ad9e89c0659eda225ca759256efcf6799e811026a34babeb28e5c7b6130f646de60ab62a975592efca8b4a27e6ff0853737ae1802bc5cf5e1f818

Download Submit
C:\Windows\System\cbcesxD.exe

Filesize
1.7MB

MD5
de590b85b1c70173733a976ad1dc536e

SHA1
cec27c0e7d7baef09f1a9058bbfa6e32e46eecee

SHA256
d01b9f89d56cd48f51c2d35bf3d172b4ea4f7023e5e9e0e8e68901078909e450

SHA512
796ba64c7712a33677682e5ab132712719669ce2cc9fa4858699f22fae2a5fac79c2286bd88998fcaba7c424ae543649f33c492c7ee4580624431dd06ef4d3d7

Download Submit
C:\Windows\System\fPoSNSy.exe

Filesize
1.7MB

MD5
1d0c8331533f57526393489a5e9c9d6f

SHA1
f7c7fd9f1fda8301527b98823cd908e62f1093a7

SHA256
524b41b906b184ac00f59aec296b43368dbf1908196e4b85d674b45737e615ea

SHA512
3dab8dd7550f27e8df6bd1ae696587bb82e54923e5fd0e50ce61d26502cf3137a5aebe2fcd06d3dd7234acb86839241b581471f4528461955fc5667970e55aa9

Download Submit
C:\Windows\System\gozthxb.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\hZbCNJq.exe

Filesize
1.7MB

MD5
3a7ac9b5b361f0b7fba996ad6380e6d9

SHA1
92968be792b22672662a80f8f36a5bad3b4e2322

SHA256
fea01f03434a855c6e8d917f3867a00ed677a1d3d64d32b83b840ac7be5d9993

SHA512
78b1d4877c702a8f59faef8b8a105153bae2db4e5c7c61c831bfb8a637f6305a485abc03e4bf5b5fe14a2707c979d640d0cdf7a40f15a3a6999159e6a9b29882

Download Submit
C:\Windows\System\igKKzNz.exe

Filesize
1.7MB

MD5
2955c2ef62eb7efa268a73af194027ca

SHA1
9a7a7f61f485b806f9c41b3378c97fc441d980f9

SHA256
ee3f2d2d80c5ece529193c18b0ac799e028644fe90b5e5ab2478af3de5223959

SHA512
4e977a7ba702e9da9c542c00d60469fda38ff5178e6c49b8515c9b8737fad03e8d7ff066d063d1176ec59ea2b279cd69f31afa452d72b80ceee8c42b81449595

Download Submit
C:\Windows\System\kInJqXJ.exe

Filesize
1.7MB

MD5
3b28dcbe48df227d02c0f23db8a2658c

SHA1
30bc9370613918e8a2aa9ed62379318f3f498eec

SHA256
80c6c4f9a2f1d7d5f12941ce38e2b0886b6d1da8722c1b5804ecbb114670fd7c

SHA512
af2804c80593cc7395b181c228bf73fbb339aaff70a2accd499108bfc9e129d8fb377dd173cc8846c79d0f2fc3cdd8eecff1cdf6dee081f48cbe9b6c2f0cb39b

Download Submit
C:\Windows\System\khdOXmr.exe

Filesize
1.7MB

MD5
65fb8339e91ed29d6cb315837dd2c53f

SHA1
d4d478431f3488959b2b8045bc969f1a166d26ff

SHA256
106d17e80a4548501d1fc654233b96486868fb2451b99e9bc3906b1b4da74d4e

SHA512
bc7eabfa0f5fece7155bd286d7478156b17b39a64d301fd78bf81c92787292de243301fd3e875a52d43aa78d48946a4983d9a8aef6b6be99bfe5f98eea037c07

Download Submit
C:\Windows\System\lZpiUfH.exe

Filesize
1.7MB

MD5
536ed973f05543486b806cc4e8d1c331

SHA1
b243fb5581ee6c2190c0fe8d163ce3e4608d3b46

SHA256
6d7ceb15fde983b0fe90a61bbbcbda9f4ae013e38dac374ba2635187c993e673

SHA512
6eabaf84b484654982c4bfa323a544fda9e492e054ecc16dd1fac56e26ca47892950c3c7e165970176fbfce0716afb5e67006355ccf51fd33a6c11efe7ca5181

Download Submit
C:\Windows\System\lbwEfrw.exe

Filesize
1.7MB

MD5
b6bb7f3605532fdba0f35faf5cffb819

SHA1
1416c5ad27110cbcc9b60fc4b55f3ec87b091176

SHA256
e611bb361d1c1c68375aae824c419e35e75ea1421afc15c3b7bfd84834b891cf

SHA512
8563642349a9e7bbb59cc943b1d51f289f8fd87480ecb83acffc0752d9eb12dc47f6fb4136a02a51bcf3203e7d53ba22cc3b4a1935b34a4adf5dafe72fd0b79b

Download Submit
C:\Windows\System\pKeuUdy.exe

Filesize
1.7MB

MD5
280f0bbb4665d3250473cfa98c7a0ded

SHA1
f5234bca964fd855d0211b0aa731302c03445b6e

SHA256
89d061ddb224326de2e475f5bbb45847fd49b80e845fc8fa4c7605d217f8afc7

SHA512
b1f902634b8771278acae0d2e939b445a7f7f95f21a2bf2fd8287dee08e29535d513c931040de22df0ab6ac3c2aadbff7dbcdc01175c9293d2e0d578850f971c

Download Submit
C:\Windows\System\sznWaAm.exe

Filesize
1.7MB

MD5
359f839953233075fa30cf77cdf9c4aa

SHA1
88c9f341988ee5d47e5a5f543e4d3b3badb9c17b

SHA256
0b5aae74a7f20c3845dc4951c7b3fc30d16815ecfa32b899df91e1e1928b4d8d

SHA512
2ef4d6d58b93b6ea37cf5c5a54256a855603f4dc1b12fbedd83ef6183cdb4822a2fa1347bd2b47803771939d1c8e8422a2feaf6ab4f6d0e01b8236b6bccda956

Download Submit
C:\Windows\System\ywElQVN.exe

Filesize
1.7MB

MD5
baaf8638ad84e0ae87b159bc6fb16b55

SHA1
47779212244a6a80a5134e2ac828c133d3412834

SHA256
ac0abdf3531afd5373cc5993beb94f7b359506b9313264c3dc023a3ce9c1a796

SHA512
c5b8249d22ddeddaa7d7983a474aff41c3d9f3d10cdd7c96c148b55c0ce8e73808c071d7838e82a5f6d606a5b7839d07c280849ee57f048d58878de69c3aa41e

Download Submit
C:\Windows\System\zpczxXU.exe

Filesize
1.7MB

MD5
25e6b3e848483da7ae8195704a210a7a

SHA1
68dd2f39d527ccf4b0adf1307fad097cfac2d11a

SHA256
a0575b479d519b467f07bf96f147c85b4169cf42594033ad868210f7b07a1336

SHA512
ba99c38e7a88245f48ea21fcf70e64e49b7b4a5328c2a24ba4df75f75b57f98b9b04a60b7e2e559684170411c80b9033e2bd7fc381f37f2b262e1925b84bd579

Download Submit
memory/100-2959-0x00007FF7EDEF0000-0x00007FF7EE2E2000-memory.dmp

Filesize
3.9MB

Download
memory/100-394-0x00007FF7EDEF0000-0x00007FF7EE2E2000-memory.dmp

Filesize
3.9MB

Download
memory/212-1622-0x00007FF653460000-0x00007FF653852000-memory.dmp

Filesize
3.9MB

Download
memory/212-2969-0x00007FF653460000-0x00007FF653852000-memory.dmp

Filesize
3.9MB

Download
memory/216-569-0x00007FF615700000-0x00007FF615AF2000-memory.dmp

Filesize
3.9MB

Download
memory/216-2961-0x00007FF615700000-0x00007FF615AF2000-memory.dmp

Filesize
3.9MB

Download
memory/592-1707-0x00007FF603C60000-0x00007FF604052000-memory.dmp

Filesize
3.9MB

Download
memory/592-2974-0x00007FF603C60000-0x00007FF604052000-memory.dmp

Filesize
3.9MB

Download
memory/812-236-0x00007FF653590000-0x00007FF653982000-memory.dmp

Filesize
3.9MB

Download
memory/812-2956-0x00007FF653590000-0x00007FF653982000-memory.dmp

Filesize
3.9MB

Download
memory/2028-2972-0x00007FF7F6330000-0x00007FF7F6722000-memory.dmp

Filesize
3.9MB

Download
memory/2028-393-0x00007FF7F6330000-0x00007FF7F6722000-memory.dmp

Filesize
3.9MB

Download
memory/2264-2955-0x00007FF678050000-0x00007FF678442000-memory.dmp

Filesize
3.9MB

Download
memory/2264-313-0x00007FF678050000-0x00007FF678442000-memory.dmp

Filesize
3.9MB

Download
memory/2688-717-0x00007FF697F90000-0x00007FF698382000-memory.dmp

Filesize
3.9MB

Download
memory/2688-2976-0x00007FF697F90000-0x00007FF698382000-memory.dmp

Filesize
3.9MB

Download
memory/3344-1-0x0000027E98270000-0x0000027E98280000-memory.dmp

Filesize
64KB

Download
memory/3344-0-0x00007FF6310E0000-0x00007FF6314D2000-memory.dmp

Filesize
3.9MB

Download
memory/3460-11-0x00007FF66D920000-0x00007FF66DD12000-memory.dmp

Filesize
3.9MB

Download
memory/3460-2943-0x00007FF66D920000-0x00007FF66DD12000-memory.dmp

Filesize
3.9MB

Download
memory/3624-13-0x00007FFACC5F3000-0x00007FFACC5F5000-memory.dmp

Filesize
8KB

Download
memory/3624-159-0x000002C270F10000-0x000002C270F32000-memory.dmp

Filesize
136KB

Download
memory/3624-197-0x00007FFACC5F0000-0x00007FFACD0B1000-memory.dmp

Filesize
10.8MB

Download
memory/3624-69-0x00007FFACC5F0000-0x00007FFACD0B1000-memory.dmp

Filesize
10.8MB

Download
memory/4908-2967-0x00007FF6E3C20000-0x00007FF6E4012000-memory.dmp

Filesize
3.9MB

Download
memory/4908-856-0x00007FF6E3C20000-0x00007FF6E4012000-memory.dmp

Filesize
3.9MB

Download
memory/5016-2963-0x00007FF608690000-0x00007FF608A82000-memory.dmp

Filesize
3.9MB

Download
memory/5016-574-0x00007FF608690000-0x00007FF608A82000-memory.dmp

Filesize
3.9MB

Download