xmrig | d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0

Analysis

max time kernel
150s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
Size

1.3MB
MD5

18bba484a007b8c525a50ca2a4908834
SHA1

5b47eaf15b02514267b5c6a81113e7fda4debbc2
SHA256

d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0
SHA512

f89f75623709061dc08697faaa438f5038a5935365ab72afdd00d7e23972ea20dff755aabff45a45ea5037e1f5e33738b113776daf56c948ae5970e16f2fd710
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ2nywSUHN0:Lz071uv4BPMkibTIA5JnIyKN0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral2/memory/1652-694-0x00007FF62E330000-0x00007FF62E722000-memory.dmp	xmrig
behavioral2/memory/2808-693-0x00007FF6AFA30000-0x00007FF6AFE22000-memory.dmp	xmrig
behavioral2/memory/3264-698-0x00007FF71C170000-0x00007FF71C562000-memory.dmp	xmrig
behavioral2/memory/2304-977-0x00007FF680310000-0x00007FF680702000-memory.dmp	xmrig
behavioral2/memory/1800-1095-0x00007FF6AA8A0000-0x00007FF6AAC92000-memory.dmp	xmrig
behavioral2/memory/1928-1151-0x00007FF606CF0000-0x00007FF6070E2000-memory.dmp	xmrig
behavioral2/memory/1628-1094-0x00007FF6F0340000-0x00007FF6F0732000-memory.dmp	xmrig
behavioral2/memory/3512-1975-0x00007FF6B8AC0000-0x00007FF6B8EB2000-memory.dmp	xmrig
behavioral2/memory/2184-1974-0x00007FF74F080000-0x00007FF74F472000-memory.dmp	xmrig
behavioral2/memory/1424-1582-0x00007FF6DFCC0000-0x00007FF6E00B2000-memory.dmp	xmrig
behavioral2/memory/936-696-0x00007FF6043A0000-0x00007FF604792000-memory.dmp	xmrig
behavioral2/memory/1460-695-0x00007FF7801D0000-0x00007FF7805C2000-memory.dmp	xmrig
behavioral2/memory/1972-692-0x00007FF7AB4F0000-0x00007FF7AB8E2000-memory.dmp	xmrig
behavioral2/memory/4772-691-0x00007FF675FD0000-0x00007FF6763C2000-memory.dmp	xmrig
behavioral2/memory/664-690-0x00007FF76EDE0000-0x00007FF76F1D2000-memory.dmp	xmrig
behavioral2/memory/2500-688-0x00007FF6469C0000-0x00007FF646DB2000-memory.dmp	xmrig
behavioral2/memory/1716-687-0x00007FF6895E0000-0x00007FF6899D2000-memory.dmp	xmrig
behavioral2/memory/2052-582-0x00007FF7E91C0000-0x00007FF7E95B2000-memory.dmp	xmrig
behavioral2/memory/3292-396-0x00007FF657EB0000-0x00007FF6582A2000-memory.dmp	xmrig
behavioral2/memory/3996-316-0x00007FF67FDD0000-0x00007FF6801C2000-memory.dmp	xmrig
behavioral2/memory/4292-308-0x00007FF68F050000-0x00007FF68F442000-memory.dmp	xmrig
behavioral2/memory/4040-262-0x00007FF761D60000-0x00007FF762152000-memory.dmp	xmrig
behavioral2/memory/3104-195-0x00007FF7C3270000-0x00007FF7C3662000-memory.dmp	xmrig
behavioral2/memory/4256-4051-0x00007FF63F790000-0x00007FF63FB82000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4612	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4256	dPnRlYd.exe
1424	IqLmZoo.exe
2184	oXwGRCb.exe
3104	LpnUbmD.exe
4040	FmoXFxh.exe
4292	btPvlPc.exe
3996	VFPEnJS.exe
3292	ZJdcgNZ.exe
2052	uWuhVDb.exe
1716	HntFXSS.exe
3512	lgcFttZ.exe
2500	ughOjua.exe
664	Puiunxj.exe
4772	Ubfpunm.exe
1972	tgoTqgw.exe
2808	fazVflK.exe
1652	TuiKlCe.exe
1460	IpnyCqQ.exe
936	mUbIPRp.exe
3264	ItccABg.exe
2304	ZczsGQn.exe
1628	yiTaLGP.exe
1800	iuixsKR.exe
1928	EsSeajL.exe
3612	oEPHmHa.exe
1612	IHeGlyn.exe
1272	LmzGhtg.exe
4928	MROGCIC.exe
4608	PxbXuAD.exe
1644	zDLZnJP.exe
4788	bgYTpAo.exe
4752	Gdutchz.exe
1152	BWQgqXI.exe
1084	pGaTXSI.exe
4924	rzigOiq.exe
1420	WSmNFwL.exe
4116	gCLNazp.exe
3988	EtgoTMZ.exe
2068	VMtxUgv.exe
4080	UokBuUA.exe
3736	aIVmTcc.exe
2152	iNbteNS.exe
2984	cKERegG.exe
2020	cHWFjoJ.exe
5080	gsbvpCy.exe
1380	TglsNKi.exe
2396	vYFDNcE.exe
800	CUMvgJH.exe
756	bKuLQlw.exe
4128	NkUyXtG.exe
3620	xhHiGbt.exe
4920	unZyGcV.exe
1240	TGcievN.exe
636	YsYQgti.exe
2676	HwfIsuI.exe
3228	oTDuwrV.exe
2468	ABHcysM.exe
32	uhceNDs.exe
4644	eFyezDp.exe
4908	NBZcjFR.exe
4960	JitiMIy.exe
4420	YZArjxg.exe
4936	grSwgVd.exe
4260	LXNdKqK.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1136-0-0x00007FF768C60000-0x00007FF769052000-memory.dmp	upx
behavioral2/files/0x0009000000023290-5.dat	upx
behavioral2/memory/4256-12-0x00007FF63F790000-0x00007FF63FB82000-memory.dmp	upx
behavioral2/files/0x00070000000232f4-25.dat	upx
behavioral2/files/0x0007000000023303-95.dat	upx
behavioral2/files/0x00070000000232fc-98.dat	upx
behavioral2/memory/1652-694-0x00007FF62E330000-0x00007FF62E722000-memory.dmp	upx
behavioral2/memory/2808-693-0x00007FF6AFA30000-0x00007FF6AFE22000-memory.dmp	upx
behavioral2/memory/3264-698-0x00007FF71C170000-0x00007FF71C562000-memory.dmp	upx
behavioral2/memory/2304-977-0x00007FF680310000-0x00007FF680702000-memory.dmp	upx
behavioral2/memory/1800-1095-0x00007FF6AA8A0000-0x00007FF6AAC92000-memory.dmp	upx
behavioral2/memory/1928-1151-0x00007FF606CF0000-0x00007FF6070E2000-memory.dmp	upx
behavioral2/memory/1628-1094-0x00007FF6F0340000-0x00007FF6F0732000-memory.dmp	upx
behavioral2/memory/3512-1975-0x00007FF6B8AC0000-0x00007FF6B8EB2000-memory.dmp	upx
behavioral2/memory/2184-1974-0x00007FF74F080000-0x00007FF74F472000-memory.dmp	upx
behavioral2/memory/1424-1582-0x00007FF6DFCC0000-0x00007FF6E00B2000-memory.dmp	upx
behavioral2/memory/936-696-0x00007FF6043A0000-0x00007FF604792000-memory.dmp	upx
behavioral2/memory/1460-695-0x00007FF7801D0000-0x00007FF7805C2000-memory.dmp	upx
behavioral2/memory/1972-692-0x00007FF7AB4F0000-0x00007FF7AB8E2000-memory.dmp	upx
behavioral2/memory/4772-691-0x00007FF675FD0000-0x00007FF6763C2000-memory.dmp	upx
behavioral2/memory/664-690-0x00007FF76EDE0000-0x00007FF76F1D2000-memory.dmp	upx
behavioral2/memory/2500-688-0x00007FF6469C0000-0x00007FF646DB2000-memory.dmp	upx
behavioral2/memory/1716-687-0x00007FF6895E0000-0x00007FF6899D2000-memory.dmp	upx
behavioral2/memory/2052-582-0x00007FF7E91C0000-0x00007FF7E95B2000-memory.dmp	upx
behavioral2/memory/3292-396-0x00007FF657EB0000-0x00007FF6582A2000-memory.dmp	upx
behavioral2/memory/3996-316-0x00007FF67FDD0000-0x00007FF6801C2000-memory.dmp	upx
behavioral2/memory/4292-308-0x00007FF68F050000-0x00007FF68F442000-memory.dmp	upx
behavioral2/memory/4040-262-0x00007FF761D60000-0x00007FF762152000-memory.dmp	upx
behavioral2/files/0x000700000002331b-207.dat	upx
behavioral2/files/0x000700000002331a-206.dat	upx
behavioral2/files/0x0007000000023318-205.dat	upx
behavioral2/files/0x0007000000023316-201.dat	upx
behavioral2/memory/3104-195-0x00007FF7C3270000-0x00007FF7C3662000-memory.dmp	upx
behavioral2/files/0x0007000000023307-185.dat	upx
behavioral2/files/0x0007000000023313-186.dat	upx
behavioral2/files/0x0007000000023306-181.dat	upx
behavioral2/files/0x00070000000232fc-175.dat	upx
behavioral2/files/0x0007000000023305-172.dat	upx
behavioral2/files/0x0007000000023304-170.dat	upx
behavioral2/files/0x000700000002330a-157.dat	upx
behavioral2/files/0x0007000000023311-156.dat	upx
behavioral2/files/0x000700000002330f-152.dat	upx
behavioral2/files/0x000700000002331c-209.dat	upx
behavioral2/files/0x0007000000023309-146.dat	upx
behavioral2/files/0x00070000000232ff-143.dat	upx
behavioral2/files/0x00070000000232fe-136.dat	upx
behavioral2/files/0x0007000000023317-204.dat	upx
behavioral2/files/0x0007000000023315-200.dat	upx
behavioral2/files/0x0007000000023314-187.dat	upx
behavioral2/files/0x000700000002330e-120.dat	upx
behavioral2/files/0x0007000000023312-169.dat	upx
behavioral2/files/0x0007000000023302-163.dat	upx
behavioral2/files/0x0007000000023301-112.dat	upx
behavioral2/files/0x00070000000232fd-128.dat	upx
behavioral2/files/0x00070000000232fa-127.dat	upx
behavioral2/files/0x0007000000023308-101.dat	upx
behavioral2/files/0x000700000002330d-118.dat	upx
behavioral2/files/0x000700000002330c-117.dat	upx
behavioral2/files/0x000700000002330b-116.dat	upx
behavioral2/files/0x0007000000023300-79.dat	upx
behavioral2/files/0x00070000000232fb-85.dat	upx
behavioral2/files/0x00070000000232f9-82.dat	upx
behavioral2/files/0x00070000000232f7-41.dat	upx
behavioral2/files/0x00070000000232f6-37.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JyDXBQs.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\FqDRrBB.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\fCjZNUC.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\qPDWdqa.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\wZSnCyG.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\bnYmIKl.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\yuVFOjy.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\PbHcKAP.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\PtWgEEM.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\QdRKYdD.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\dPnRlYd.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\vOBnTRA.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\xaaydMz.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\sXkeinh.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\IoFREiR.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\FCfkDZY.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\fBXrTSb.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\JEIrIXk.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\RxNoOqa.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ZHMTPPC.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\sDEpTro.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\rFZFtGi.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\czZZXCO.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\EtNNJMF.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\MuNDUFP.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\UujglPM.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\VzKMpYm.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\vpuyCKO.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\lAUPwnv.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\fYmukVy.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\AymAbWj.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\oqNwBPf.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ngwktmD.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\hxyGKNE.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\xGPYQbP.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\YNqhOyp.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\lbccdrh.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\uOjNTgq.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\HkWpeUc.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\sCtbNee.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\ySsKfWr.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\mPUKdWU.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\VzedGiv.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\OPToaUc.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\XlzATiQ.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\gMCgZsX.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\AVunOyx.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\CjKLumF.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\PQSlccs.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\qWCfBHV.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\eJCLvaY.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\yiTaLGP.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\AiDXiRh.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\kMLvuOP.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\lPkxGlF.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\aeJqgmD.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\NMjvOwa.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\nAcRtRy.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\bOMhXoW.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\Yetojvo.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\EWKianL.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\YAmBEob.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\SgQQrOu.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
File created	C:\Windows\System\zLGYnbt.exe	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3760	Process not Found
3516	Process not Found
3584	Process not Found
1124	Process not Found
3776	Process not Found
1580	Process not Found
12408	Process not Found
13612	Process not Found
4340	Process not Found
2992	Process not Found
5416	Process not Found
12828	Process not Found
3608	Process not Found
13768	Process not Found
13560	Process not Found
616	Process not Found
1052	Process not Found
2636	Process not Found
4576	Process not Found
3840	Process not Found
1128	Process not Found
13532	Process not Found
4060	Process not Found
7968	Process not Found
3820	Process not Found
12956	Process not Found
7216	Process not Found
7956	Process not Found
13324	Process not Found
7964	Process not Found
13572	Process not Found
4104	Process not Found
4168	Process not Found
4832	Process not Found
1020	Process not Found
4064	Process not Found
4192	Process not Found
4160	Process not Found
4952	Process not Found
1392	Process not Found
13960	Process not Found
3052	Process not Found
3708	Process not Found
608	Process not Found
4764	Process not Found
6108	Process not Found
3956	Process not Found
7976	Process not Found
13620	Process not Found
4240	Process not Found
13548	Process not Found
13776	Process not Found
9288	Process not Found
4084	Process not Found
3084	Process not Found
3808	Process not Found
9948	Process not Found
9356	Process not Found
3580	Process not Found
3764	Process not Found
4916	Process not Found
2684	Process not Found
4140	Process not Found
2536	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
Token: SeLockMemoryPrivilege	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeCreateGlobalPrivilege	2380	dwm.exe
Token: SeChangeNotifyPrivilege	2380	dwm.exe
Token: 33	2380	dwm.exe
Token: SeIncBasePriorityPrivilege	2380	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4612	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	84
PID 1136 wrote to memory of 4612	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	84
PID 1136 wrote to memory of 4256	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	85
PID 1136 wrote to memory of 4256	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	85
PID 1136 wrote to memory of 1424	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	86
PID 1136 wrote to memory of 1424	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	86
PID 1136 wrote to memory of 3104	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	87
PID 1136 wrote to memory of 3104	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	87
PID 1136 wrote to memory of 2184	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	88
PID 1136 wrote to memory of 2184	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	88
PID 1136 wrote to memory of 4040	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	89
PID 1136 wrote to memory of 4040	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	89
PID 1136 wrote to memory of 4292	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	90
PID 1136 wrote to memory of 4292	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	90
PID 1136 wrote to memory of 3996	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	91
PID 1136 wrote to memory of 3996	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	91
PID 1136 wrote to memory of 3292	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	92
PID 1136 wrote to memory of 3292	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	92
PID 1136 wrote to memory of 2052	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	93
PID 1136 wrote to memory of 2052	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	93
PID 1136 wrote to memory of 1716	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	94
PID 1136 wrote to memory of 1716	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	94
PID 1136 wrote to memory of 936	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	95
PID 1136 wrote to memory of 936	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	95
PID 1136 wrote to memory of 1800	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	96
PID 1136 wrote to memory of 1800	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	96
PID 1136 wrote to memory of 3512	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	97
PID 1136 wrote to memory of 3512	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	97
PID 1136 wrote to memory of 2500	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	98
PID 1136 wrote to memory of 2500	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	98
PID 1136 wrote to memory of 664	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	99
PID 1136 wrote to memory of 664	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	99
PID 1136 wrote to memory of 4772	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	100
PID 1136 wrote to memory of 4772	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	100
PID 1136 wrote to memory of 1972	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	101
PID 1136 wrote to memory of 1972	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	101
PID 1136 wrote to memory of 2808	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	102
PID 1136 wrote to memory of 2808	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	102
PID 1136 wrote to memory of 1652	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	103
PID 1136 wrote to memory of 1652	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	103
PID 1136 wrote to memory of 1460	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	104
PID 1136 wrote to memory of 1460	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	104
PID 1136 wrote to memory of 3264	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	105
PID 1136 wrote to memory of 3264	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	105
PID 1136 wrote to memory of 2304	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	106
PID 1136 wrote to memory of 2304	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	106
PID 1136 wrote to memory of 1628	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	107
PID 1136 wrote to memory of 1628	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	107
PID 1136 wrote to memory of 1928	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	108
PID 1136 wrote to memory of 1928	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	108
PID 1136 wrote to memory of 3612	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	109
PID 1136 wrote to memory of 3612	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	109
PID 1136 wrote to memory of 1612	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	110
PID 1136 wrote to memory of 1612	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	110
PID 1136 wrote to memory of 1272	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	111
PID 1136 wrote to memory of 1272	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	111
PID 1136 wrote to memory of 4928	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	112
PID 1136 wrote to memory of 4928	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	112
PID 1136 wrote to memory of 4608	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	113
PID 1136 wrote to memory of 4608	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	113
PID 1136 wrote to memory of 1644	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	114
PID 1136 wrote to memory of 1644	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	114
PID 1136 wrote to memory of 2020	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	115
PID 1136 wrote to memory of 2020	1136	d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe	115

C:\Users\Admin\AppData\Local\Temp\d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe
"C:\Users\Admin\AppData\Local\Temp\d1a4330951f2900fba6fda507f031e748e26d4f10caa727636abbc4be26233c0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\System\dPnRlYd.exe
  C:\Windows\System\dPnRlYd.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\IqLmZoo.exe
  C:\Windows\System\IqLmZoo.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\LpnUbmD.exe
  C:\Windows\System\LpnUbmD.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\oXwGRCb.exe
  C:\Windows\System\oXwGRCb.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\FmoXFxh.exe
  C:\Windows\System\FmoXFxh.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\btPvlPc.exe
  C:\Windows\System\btPvlPc.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\VFPEnJS.exe
  C:\Windows\System\VFPEnJS.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\ZJdcgNZ.exe
  C:\Windows\System\ZJdcgNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\uWuhVDb.exe
  C:\Windows\System\uWuhVDb.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\HntFXSS.exe
  C:\Windows\System\HntFXSS.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\mUbIPRp.exe
  C:\Windows\System\mUbIPRp.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\iuixsKR.exe
  C:\Windows\System\iuixsKR.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\lgcFttZ.exe
  C:\Windows\System\lgcFttZ.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\ughOjua.exe
  C:\Windows\System\ughOjua.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\Puiunxj.exe
  C:\Windows\System\Puiunxj.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\Ubfpunm.exe
  C:\Windows\System\Ubfpunm.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\tgoTqgw.exe
  C:\Windows\System\tgoTqgw.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\fazVflK.exe
  C:\Windows\System\fazVflK.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\TuiKlCe.exe
  C:\Windows\System\TuiKlCe.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\IpnyCqQ.exe
  C:\Windows\System\IpnyCqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\ItccABg.exe
  C:\Windows\System\ItccABg.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\ZczsGQn.exe
  C:\Windows\System\ZczsGQn.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\yiTaLGP.exe
  C:\Windows\System\yiTaLGP.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\EsSeajL.exe
  C:\Windows\System\EsSeajL.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\oEPHmHa.exe
  C:\Windows\System\oEPHmHa.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\IHeGlyn.exe
  C:\Windows\System\IHeGlyn.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\LmzGhtg.exe
  C:\Windows\System\LmzGhtg.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\MROGCIC.exe
  C:\Windows\System\MROGCIC.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\PxbXuAD.exe
  C:\Windows\System\PxbXuAD.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\zDLZnJP.exe
  C:\Windows\System\zDLZnJP.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\cHWFjoJ.exe
  C:\Windows\System\cHWFjoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\bgYTpAo.exe
  C:\Windows\System\bgYTpAo.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\Gdutchz.exe
  C:\Windows\System\Gdutchz.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\BWQgqXI.exe
  C:\Windows\System\BWQgqXI.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\pGaTXSI.exe
  C:\Windows\System\pGaTXSI.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\rzigOiq.exe
  C:\Windows\System\rzigOiq.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\WSmNFwL.exe
  C:\Windows\System\WSmNFwL.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\gCLNazp.exe
  C:\Windows\System\gCLNazp.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\EtgoTMZ.exe
  C:\Windows\System\EtgoTMZ.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\uhceNDs.exe
  C:\Windows\System\uhceNDs.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\VMtxUgv.exe
  C:\Windows\System\VMtxUgv.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\UokBuUA.exe
  C:\Windows\System\UokBuUA.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\aIVmTcc.exe
  C:\Windows\System\aIVmTcc.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\iNbteNS.exe
  C:\Windows\System\iNbteNS.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\cKERegG.exe
  C:\Windows\System\cKERegG.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\gsbvpCy.exe
  C:\Windows\System\gsbvpCy.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\TglsNKi.exe
  C:\Windows\System\TglsNKi.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\vYFDNcE.exe
  C:\Windows\System\vYFDNcE.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\CUMvgJH.exe
  C:\Windows\System\CUMvgJH.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\bKuLQlw.exe
  C:\Windows\System\bKuLQlw.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\NkUyXtG.exe
  C:\Windows\System\NkUyXtG.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\xhHiGbt.exe
  C:\Windows\System\xhHiGbt.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\unZyGcV.exe
  C:\Windows\System\unZyGcV.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\TGcievN.exe
  C:\Windows\System\TGcievN.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\YsYQgti.exe
  C:\Windows\System\YsYQgti.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\HwfIsuI.exe
  C:\Windows\System\HwfIsuI.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\oTDuwrV.exe
  C:\Windows\System\oTDuwrV.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\ABHcysM.exe
  C:\Windows\System\ABHcysM.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\eFyezDp.exe
  C:\Windows\System\eFyezDp.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\NBZcjFR.exe
  C:\Windows\System\NBZcjFR.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\JitiMIy.exe
  C:\Windows\System\JitiMIy.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\YZArjxg.exe
  C:\Windows\System\YZArjxg.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\grSwgVd.exe
  C:\Windows\System\grSwgVd.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\LXNdKqK.exe
  C:\Windows\System\LXNdKqK.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\gpAedal.exe
  C:\Windows\System\gpAedal.exe
  2⤵
  PID:3636
- C:\Windows\System\JaSfpwJ.exe
  C:\Windows\System\JaSfpwJ.exe
  2⤵
  PID:1920
- C:\Windows\System\CjKLumF.exe
  C:\Windows\System\CjKLumF.exe
  2⤵
  PID:4076
- C:\Windows\System\BZPJhqM.exe
  C:\Windows\System\BZPJhqM.exe
  2⤵
  PID:2752
- C:\Windows\System\oEbbDEA.exe
  C:\Windows\System\oEbbDEA.exe
  2⤵
  PID:4328
- C:\Windows\System\DHTwiHy.exe
  C:\Windows\System\DHTwiHy.exe
  2⤵
  PID:988
- C:\Windows\System\oxfFVie.exe
  C:\Windows\System\oxfFVie.exe
  2⤵
  PID:2788
- C:\Windows\System\zTJHnCu.exe
  C:\Windows\System\zTJHnCu.exe
  2⤵
  PID:1032
- C:\Windows\System\nUMkjnN.exe
  C:\Windows\System\nUMkjnN.exe
  2⤵
  PID:4704
- C:\Windows\System\YFpGOKd.exe
  C:\Windows\System\YFpGOKd.exe
  2⤵
  PID:2568
- C:\Windows\System\kMFLiNS.exe
  C:\Windows\System\kMFLiNS.exe
  2⤵
  PID:2064
- C:\Windows\System\zBnNiMt.exe
  C:\Windows\System\zBnNiMt.exe
  2⤵
  PID:4604
- C:\Windows\System\FMcIiuj.exe
  C:\Windows\System\FMcIiuj.exe
  2⤵
  PID:4232
- C:\Windows\System\QGpUHjw.exe
  C:\Windows\System\QGpUHjw.exe
  2⤵
  PID:1548
- C:\Windows\System\eNFysCu.exe
  C:\Windows\System\eNFysCu.exe
  2⤵
  PID:4360
- C:\Windows\System\aRnCAtc.exe
  C:\Windows\System\aRnCAtc.exe
  2⤵
  PID:1264
- C:\Windows\System\iMhzGPJ.exe
  C:\Windows\System\iMhzGPJ.exe
  2⤵
  PID:4412
- C:\Windows\System\EzuvTVR.exe
  C:\Windows\System\EzuvTVR.exe
  2⤵
  PID:4992
- C:\Windows\System\YwcAiUQ.exe
  C:\Windows\System\YwcAiUQ.exe
  2⤵
  PID:2616
- C:\Windows\System\tEASTlc.exe
  C:\Windows\System\tEASTlc.exe
  2⤵
  PID:3964
- C:\Windows\System\KPvRRWQ.exe
  C:\Windows\System\KPvRRWQ.exe
  2⤵
  PID:3088
- C:\Windows\System\RcvUCNx.exe
  C:\Windows\System\RcvUCNx.exe
  2⤵
  PID:1592
- C:\Windows\System\RhgUSRF.exe
  C:\Windows\System\RhgUSRF.exe
  2⤵
  PID:1596
- C:\Windows\System\FXTvucq.exe
  C:\Windows\System\FXTvucq.exe
  2⤵
  PID:4296
- C:\Windows\System\taiyUaK.exe
  C:\Windows\System\taiyUaK.exe
  2⤵
  PID:5128
- C:\Windows\System\SnfNhuU.exe
  C:\Windows\System\SnfNhuU.exe
  2⤵
  PID:5144
- C:\Windows\System\ZorbFJc.exe
  C:\Windows\System\ZorbFJc.exe
  2⤵
  PID:5168
- C:\Windows\System\hQwCEMM.exe
  C:\Windows\System\hQwCEMM.exe
  2⤵
  PID:5184
- C:\Windows\System\IFYDYoW.exe
  C:\Windows\System\IFYDYoW.exe
  2⤵
  PID:5208
- C:\Windows\System\hRASclj.exe
  C:\Windows\System\hRASclj.exe
  2⤵
  PID:5236
- C:\Windows\System\qshgoGZ.exe
  C:\Windows\System\qshgoGZ.exe
  2⤵
  PID:5264
- C:\Windows\System\EiMdCpH.exe
  C:\Windows\System\EiMdCpH.exe
  2⤵
  PID:5280
- C:\Windows\System\YadeKjT.exe
  C:\Windows\System\YadeKjT.exe
  2⤵
  PID:5304
- C:\Windows\System\MmTFsYX.exe
  C:\Windows\System\MmTFsYX.exe
  2⤵
  PID:5320
- C:\Windows\System\mhdGsIj.exe
  C:\Windows\System\mhdGsIj.exe
  2⤵
  PID:5380
- C:\Windows\System\gEbzjOz.exe
  C:\Windows\System\gEbzjOz.exe
  2⤵
  PID:5396
- C:\Windows\System\YSrgjNZ.exe
  C:\Windows\System\YSrgjNZ.exe
  2⤵
  PID:5428
- C:\Windows\System\JfRSkPL.exe
  C:\Windows\System\JfRSkPL.exe
  2⤵
  PID:5444
- C:\Windows\System\xGobJfe.exe
  C:\Windows\System\xGobJfe.exe
  2⤵
  PID:5464
- C:\Windows\System\BrQGzZL.exe
  C:\Windows\System\BrQGzZL.exe
  2⤵
  PID:5484
- C:\Windows\System\IAvlpPX.exe
  C:\Windows\System\IAvlpPX.exe
  2⤵
  PID:5500
- C:\Windows\System\tUGoZfi.exe
  C:\Windows\System\tUGoZfi.exe
  2⤵
  PID:5524
- C:\Windows\System\jOYvPvg.exe
  C:\Windows\System\jOYvPvg.exe
  2⤵
  PID:5540
- C:\Windows\System\gttibFM.exe
  C:\Windows\System\gttibFM.exe
  2⤵
  PID:5584
- C:\Windows\System\dhZQdGk.exe
  C:\Windows\System\dhZQdGk.exe
  2⤵
  PID:5600
- C:\Windows\System\IPLzBha.exe
  C:\Windows\System\IPLzBha.exe
  2⤵
  PID:5628
- C:\Windows\System\GaCcPYQ.exe
  C:\Windows\System\GaCcPYQ.exe
  2⤵
  PID:5644
- C:\Windows\System\UbfnfaG.exe
  C:\Windows\System\UbfnfaG.exe
  2⤵
  PID:5660
- C:\Windows\System\HoEvKso.exe
  C:\Windows\System\HoEvKso.exe
  2⤵
  PID:5676
- C:\Windows\System\FWZWnpE.exe
  C:\Windows\System\FWZWnpE.exe
  2⤵
  PID:5696
- C:\Windows\System\XBCFCkQ.exe
  C:\Windows\System\XBCFCkQ.exe
  2⤵
  PID:5712
- C:\Windows\System\qzftRml.exe
  C:\Windows\System\qzftRml.exe
  2⤵
  PID:5736
- C:\Windows\System\PQSlccs.exe
  C:\Windows\System\PQSlccs.exe
  2⤵
  PID:5756
- C:\Windows\System\bmXaEog.exe
  C:\Windows\System\bmXaEog.exe
  2⤵
  PID:5780
- C:\Windows\System\NkiCHal.exe
  C:\Windows\System\NkiCHal.exe
  2⤵
  PID:5800
- C:\Windows\System\qjDCGUc.exe
  C:\Windows\System\qjDCGUc.exe
  2⤵
  PID:5816
- C:\Windows\System\PqjKlrW.exe
  C:\Windows\System\PqjKlrW.exe
  2⤵
  PID:5848
- C:\Windows\System\egWtCDs.exe
  C:\Windows\System\egWtCDs.exe
  2⤵
  PID:5864
- C:\Windows\System\IxEpQaE.exe
  C:\Windows\System\IxEpQaE.exe
  2⤵
  PID:5896
- C:\Windows\System\YBYaNHZ.exe
  C:\Windows\System\YBYaNHZ.exe
  2⤵
  PID:5924
- C:\Windows\System\bmKagtl.exe
  C:\Windows\System\bmKagtl.exe
  2⤵
  PID:5940
- C:\Windows\System\okeezfl.exe
  C:\Windows\System\okeezfl.exe
  2⤵
  PID:5956
- C:\Windows\System\KvEXCHU.exe
  C:\Windows\System\KvEXCHU.exe
  2⤵
  PID:5980
- C:\Windows\System\PzrBnGE.exe
  C:\Windows\System\PzrBnGE.exe
  2⤵
  PID:5996
- C:\Windows\System\vhGrZgB.exe
  C:\Windows\System\vhGrZgB.exe
  2⤵
  PID:6016
- C:\Windows\System\xeTAmuY.exe
  C:\Windows\System\xeTAmuY.exe
  2⤵
  PID:6032
- C:\Windows\System\QWheewt.exe
  C:\Windows\System\QWheewt.exe
  2⤵
  PID:6048
- C:\Windows\System\eFnTzSR.exe
  C:\Windows\System\eFnTzSR.exe
  2⤵
  PID:6068
- C:\Windows\System\WHZYuIx.exe
  C:\Windows\System\WHZYuIx.exe
  2⤵
  PID:6084
- C:\Windows\System\gMMVKDA.exe
  C:\Windows\System\gMMVKDA.exe
  2⤵
  PID:6112
- C:\Windows\System\sXkeinh.exe
  C:\Windows\System\sXkeinh.exe
  2⤵
  PID:6136
- C:\Windows\System\QBlbDlG.exe
  C:\Windows\System\QBlbDlG.exe
  2⤵
  PID:3628
- C:\Windows\System\gZLiLYu.exe
  C:\Windows\System\gZLiLYu.exe
  2⤵
  PID:2892
- C:\Windows\System\lbccdrh.exe
  C:\Windows\System\lbccdrh.exe
  2⤵
  PID:224
- C:\Windows\System\swDKKuB.exe
  C:\Windows\System\swDKKuB.exe
  2⤵
  PID:2972
- C:\Windows\System\LGWcqeZ.exe
  C:\Windows\System\LGWcqeZ.exe
  2⤵
  PID:4308
- C:\Windows\System\IndgQsi.exe
  C:\Windows\System\IndgQsi.exe
  2⤵
  PID:1752
- C:\Windows\System\raOIfMN.exe
  C:\Windows\System\raOIfMN.exe
  2⤵
  PID:5124
- C:\Windows\System\qqhSXbs.exe
  C:\Windows\System\qqhSXbs.exe
  2⤵
  PID:2632
- C:\Windows\System\nzkMmGd.exe
  C:\Windows\System\nzkMmGd.exe
  2⤵
  PID:5260
- C:\Windows\System\kfQTCXS.exe
  C:\Windows\System\kfQTCXS.exe
  2⤵
  PID:1528
- C:\Windows\System\rIFeryG.exe
  C:\Windows\System\rIFeryG.exe
  2⤵
  PID:4348
- C:\Windows\System\zxmDcEv.exe
  C:\Windows\System\zxmDcEv.exe
  2⤵
  PID:2996
- C:\Windows\System\wxPVvZw.exe
  C:\Windows\System\wxPVvZw.exe
  2⤵
  PID:5096
- C:\Windows\System\nKxSfhV.exe
  C:\Windows\System\nKxSfhV.exe
  2⤵
  PID:5492
- C:\Windows\System\RLokuig.exe
  C:\Windows\System\RLokuig.exe
  2⤵
  PID:1632
- C:\Windows\System\RiHQnoS.exe
  C:\Windows\System\RiHQnoS.exe
  2⤵
  PID:5204
- C:\Windows\System\OiEBmbD.exe
  C:\Windows\System\OiEBmbD.exe
  2⤵
  PID:5636
- C:\Windows\System\WbPwkkZ.exe
  C:\Windows\System\WbPwkkZ.exe
  2⤵
  PID:6168
- C:\Windows\System\ErcZRRU.exe
  C:\Windows\System\ErcZRRU.exe
  2⤵
  PID:6184
- C:\Windows\System\aHadyiZ.exe
  C:\Windows\System\aHadyiZ.exe
  2⤵
  PID:6208
- C:\Windows\System\OoAshAa.exe
  C:\Windows\System\OoAshAa.exe
  2⤵
  PID:6224
- C:\Windows\System\auVISKO.exe
  C:\Windows\System\auVISKO.exe
  2⤵
  PID:6244
- C:\Windows\System\IkqbQYj.exe
  C:\Windows\System\IkqbQYj.exe
  2⤵
  PID:6260
- C:\Windows\System\xTWLblQ.exe
  C:\Windows\System\xTWLblQ.exe
  2⤵
  PID:6288
- C:\Windows\System\nXZcrMw.exe
  C:\Windows\System\nXZcrMw.exe
  2⤵
  PID:6304
- C:\Windows\System\fBTTmJv.exe
  C:\Windows\System\fBTTmJv.exe
  2⤵
  PID:6332
- C:\Windows\System\FGQgvjj.exe
  C:\Windows\System\FGQgvjj.exe
  2⤵
  PID:6348
- C:\Windows\System\pTkfCTH.exe
  C:\Windows\System\pTkfCTH.exe
  2⤵
  PID:6364
- C:\Windows\System\lUidTSs.exe
  C:\Windows\System\lUidTSs.exe
  2⤵
  PID:6392
- C:\Windows\System\mHLEaJl.exe
  C:\Windows\System\mHLEaJl.exe
  2⤵
  PID:6408
- C:\Windows\System\Oepexzc.exe
  C:\Windows\System\Oepexzc.exe
  2⤵
  PID:6428
- C:\Windows\System\fcappjT.exe
  C:\Windows\System\fcappjT.exe
  2⤵
  PID:6448
- C:\Windows\System\XpIDVer.exe
  C:\Windows\System\XpIDVer.exe
  2⤵
  PID:6468
- C:\Windows\System\jKUJwxO.exe
  C:\Windows\System\jKUJwxO.exe
  2⤵
  PID:6492
- C:\Windows\System\hErtRDe.exe
  C:\Windows\System\hErtRDe.exe
  2⤵
  PID:6508
- C:\Windows\System\bFoFvXh.exe
  C:\Windows\System\bFoFvXh.exe
  2⤵
  PID:6524
- C:\Windows\System\oDxzDtp.exe
  C:\Windows\System\oDxzDtp.exe
  2⤵
  PID:6560
- C:\Windows\System\KBsRKVA.exe
  C:\Windows\System\KBsRKVA.exe
  2⤵
  PID:6584
- C:\Windows\System\BAZBowd.exe
  C:\Windows\System\BAZBowd.exe
  2⤵
  PID:6600
- C:\Windows\System\GJlzcFq.exe
  C:\Windows\System\GJlzcFq.exe
  2⤵
  PID:6624
- C:\Windows\System\oLlUONN.exe
  C:\Windows\System\oLlUONN.exe
  2⤵
  PID:6644
- C:\Windows\System\CJufKbF.exe
  C:\Windows\System\CJufKbF.exe
  2⤵
  PID:6660
- C:\Windows\System\mTzZJIS.exe
  C:\Windows\System\mTzZJIS.exe
  2⤵
  PID:6680
- C:\Windows\System\AbAIKtQ.exe
  C:\Windows\System\AbAIKtQ.exe
  2⤵
  PID:6700
- C:\Windows\System\BiMUKlt.exe
  C:\Windows\System\BiMUKlt.exe
  2⤵
  PID:6720
- C:\Windows\System\nFyROyY.exe
  C:\Windows\System\nFyROyY.exe
  2⤵
  PID:6736
- C:\Windows\System\nUvVxJO.exe
  C:\Windows\System\nUvVxJO.exe
  2⤵
  PID:6760
- C:\Windows\System\nXZEonQ.exe
  C:\Windows\System\nXZEonQ.exe
  2⤵
  PID:6776
- C:\Windows\System\gSgYFsG.exe
  C:\Windows\System\gSgYFsG.exe
  2⤵
  PID:6796
- C:\Windows\System\KkpaRQf.exe
  C:\Windows\System\KkpaRQf.exe
  2⤵
  PID:6812
- C:\Windows\System\ziJEbwO.exe
  C:\Windows\System\ziJEbwO.exe
  2⤵
  PID:6828
- C:\Windows\System\chhCxPf.exe
  C:\Windows\System\chhCxPf.exe
  2⤵
  PID:6848
- C:\Windows\System\PiRCVVI.exe
  C:\Windows\System\PiRCVVI.exe
  2⤵
  PID:6864
- C:\Windows\System\zvDYxQG.exe
  C:\Windows\System\zvDYxQG.exe
  2⤵
  PID:6892
- C:\Windows\System\ttJoPkX.exe
  C:\Windows\System\ttJoPkX.exe
  2⤵
  PID:6908
- C:\Windows\System\SpDNXCn.exe
  C:\Windows\System\SpDNXCn.exe
  2⤵
  PID:6928
- C:\Windows\System\NnNadbb.exe
  C:\Windows\System\NnNadbb.exe
  2⤵
  PID:6944
- C:\Windows\System\CrjgzGF.exe
  C:\Windows\System\CrjgzGF.exe
  2⤵
  PID:6964
- C:\Windows\System\UydTzSd.exe
  C:\Windows\System\UydTzSd.exe
  2⤵
  PID:6984
- C:\Windows\System\xIXPese.exe
  C:\Windows\System\xIXPese.exe
  2⤵
  PID:7008
- C:\Windows\System\nENVlim.exe
  C:\Windows\System\nENVlim.exe
  2⤵
  PID:7024
- C:\Windows\System\jSnvlPc.exe
  C:\Windows\System\jSnvlPc.exe
  2⤵
  PID:7056
- C:\Windows\System\GyqEQzZ.exe
  C:\Windows\System\GyqEQzZ.exe
  2⤵
  PID:7072
- C:\Windows\System\sznueRk.exe
  C:\Windows\System\sznueRk.exe
  2⤵
  PID:7096
- C:\Windows\System\TzUdQPT.exe
  C:\Windows\System\TzUdQPT.exe
  2⤵
  PID:7112
- C:\Windows\System\uVUHJgK.exe
  C:\Windows\System\uVUHJgK.exe
  2⤵
  PID:7128
- C:\Windows\System\oRSrNvg.exe
  C:\Windows\System\oRSrNvg.exe
  2⤵
  PID:7152
- C:\Windows\System\DMAXOpZ.exe
  C:\Windows\System\DMAXOpZ.exe
  2⤵
  PID:5176
- C:\Windows\System\xNuWpYA.exe
  C:\Windows\System\xNuWpYA.exe
  2⤵
  PID:2652
- C:\Windows\System\yjkWXtG.exe
  C:\Windows\System\yjkWXtG.exe
  2⤵
  PID:5764
- C:\Windows\System\ChAkxuH.exe
  C:\Windows\System\ChAkxuH.exe
  2⤵
  PID:4392
- C:\Windows\System\TZbkOhm.exe
  C:\Windows\System\TZbkOhm.exe
  2⤵
  PID:5272
- C:\Windows\System\WsgQpEr.exe
  C:\Windows\System\WsgQpEr.exe
  2⤵
  PID:672
- C:\Windows\System\PDgGbOS.exe
  C:\Windows\System\PDgGbOS.exe
  2⤵
  PID:5860
- C:\Windows\System\JhAupKA.exe
  C:\Windows\System\JhAupKA.exe
  2⤵
  PID:512
- C:\Windows\System\yDMHGGn.exe
  C:\Windows\System\yDMHGGn.exe
  2⤵
  PID:1248
- C:\Windows\System\SAvrSEg.exe
  C:\Windows\System\SAvrSEg.exe
  2⤵
  PID:3544
- C:\Windows\System\qZLxBOc.exe
  C:\Windows\System\qZLxBOc.exe
  2⤵
  PID:1772
- C:\Windows\System\OYrqIvO.exe
  C:\Windows\System\OYrqIvO.exe
  2⤵
  PID:3204
- C:\Windows\System\NqkfIsD.exe
  C:\Windows\System\NqkfIsD.exe
  2⤵
  PID:2840
- C:\Windows\System\wVcAPsd.exe
  C:\Windows\System\wVcAPsd.exe
  2⤵
  PID:5936
- C:\Windows\System\oFdVAjT.exe
  C:\Windows\System\oFdVAjT.exe
  2⤵
  PID:6028
- C:\Windows\System\rPxbKtM.exe
  C:\Windows\System\rPxbKtM.exe
  2⤵
  PID:6092
- C:\Windows\System\ddhwouj.exe
  C:\Windows\System\ddhwouj.exe
  2⤵
  PID:5440
- C:\Windows\System\ffmKNIf.exe
  C:\Windows\System\ffmKNIf.exe
  2⤵
  PID:2188
- C:\Windows\System\MOSnYmc.exe
  C:\Windows\System\MOSnYmc.exe
  2⤵
  PID:5516
- C:\Windows\System\nuujbXe.exe
  C:\Windows\System\nuujbXe.exe
  2⤵
  PID:7180
- C:\Windows\System\BBQcZrL.exe
  C:\Windows\System\BBQcZrL.exe
  2⤵
  PID:7204
- C:\Windows\System\xdNDhxe.exe
  C:\Windows\System\xdNDhxe.exe
  2⤵
  PID:7220
- C:\Windows\System\zbSqaTX.exe
  C:\Windows\System\zbSqaTX.exe
  2⤵
  PID:7248
- C:\Windows\System\leSHSgY.exe
  C:\Windows\System\leSHSgY.exe
  2⤵
  PID:7272
- C:\Windows\System\HeXAIkZ.exe
  C:\Windows\System\HeXAIkZ.exe
  2⤵
  PID:7288
- C:\Windows\System\vdDWtCU.exe
  C:\Windows\System\vdDWtCU.exe
  2⤵
  PID:7304
- C:\Windows\System\acTdiPG.exe
  C:\Windows\System\acTdiPG.exe
  2⤵
  PID:7328
- C:\Windows\System\MDvpVXx.exe
  C:\Windows\System\MDvpVXx.exe
  2⤵
  PID:7344
- C:\Windows\System\CtqWByw.exe
  C:\Windows\System\CtqWByw.exe
  2⤵
  PID:7368
- C:\Windows\System\LTfZkMB.exe
  C:\Windows\System\LTfZkMB.exe
  2⤵
  PID:7384
- C:\Windows\System\viWEyQA.exe
  C:\Windows\System\viWEyQA.exe
  2⤵
  PID:7408
- C:\Windows\System\DQnzNiv.exe
  C:\Windows\System\DQnzNiv.exe
  2⤵
  PID:7428
- C:\Windows\System\tTXYbxQ.exe
  C:\Windows\System\tTXYbxQ.exe
  2⤵
  PID:7444
- C:\Windows\System\PvOiOhO.exe
  C:\Windows\System\PvOiOhO.exe
  2⤵
  PID:7464
- C:\Windows\System\wMkrDzN.exe
  C:\Windows\System\wMkrDzN.exe
  2⤵
  PID:7488
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 7488 -s 176
    3⤵
    PID:6904
- C:\Windows\System\OAceJoc.exe
  C:\Windows\System\OAceJoc.exe
  2⤵
  PID:7508
- C:\Windows\System\rPSpIHQ.exe
  C:\Windows\System\rPSpIHQ.exe
  2⤵
  PID:7532
- C:\Windows\System\nXfKdDe.exe
  C:\Windows\System\nXfKdDe.exe
  2⤵
  PID:7548
- C:\Windows\System\QVlhtvZ.exe
  C:\Windows\System\QVlhtvZ.exe
  2⤵
  PID:7568
- C:\Windows\System\xAySdBd.exe
  C:\Windows\System\xAySdBd.exe
  2⤵
  PID:7588
- C:\Windows\System\AxVdLsB.exe
  C:\Windows\System\AxVdLsB.exe
  2⤵
  PID:7604
- C:\Windows\System\wJnGHxc.exe
  C:\Windows\System\wJnGHxc.exe
  2⤵
  PID:7628
- C:\Windows\System\pqaWQeu.exe
  C:\Windows\System\pqaWQeu.exe
  2⤵
  PID:7644
- C:\Windows\System\lzhTQXX.exe
  C:\Windows\System\lzhTQXX.exe
  2⤵
  PID:7660
- C:\Windows\System\mnmdoVq.exe
  C:\Windows\System\mnmdoVq.exe
  2⤵
  PID:7680
- C:\Windows\System\sBYnUed.exe
  C:\Windows\System\sBYnUed.exe
  2⤵
  PID:7708
- C:\Windows\System\DXUlUMD.exe
  C:\Windows\System\DXUlUMD.exe
  2⤵
  PID:7728
- C:\Windows\System\uEIsEPq.exe
  C:\Windows\System\uEIsEPq.exe
  2⤵
  PID:7752
- C:\Windows\System\CyabbCx.exe
  C:\Windows\System\CyabbCx.exe
  2⤵
  PID:7808
- C:\Windows\System\vWwNArz.exe
  C:\Windows\System\vWwNArz.exe
  2⤵
  PID:8012
- C:\Windows\System\hIPUytJ.exe
  C:\Windows\System\hIPUytJ.exe
  2⤵
  PID:8028
- C:\Windows\System\vISWdqs.exe
  C:\Windows\System\vISWdqs.exe
  2⤵
  PID:8044
- C:\Windows\System\iCEqKsq.exe
  C:\Windows\System\iCEqKsq.exe
  2⤵
  PID:8060
- C:\Windows\System\DLjEcMQ.exe
  C:\Windows\System\DLjEcMQ.exe
  2⤵
  PID:8076
- C:\Windows\System\OXUXQdU.exe
  C:\Windows\System\OXUXQdU.exe
  2⤵
  PID:8092
- C:\Windows\System\RuiXgJw.exe
  C:\Windows\System\RuiXgJw.exe
  2⤵
  PID:8108
- C:\Windows\System\QbiBCbd.exe
  C:\Windows\System\QbiBCbd.exe
  2⤵
  PID:8124
- C:\Windows\System\aZZNwHa.exe
  C:\Windows\System\aZZNwHa.exe
  2⤵
  PID:8140
- C:\Windows\System\CFlCVMs.exe
  C:\Windows\System\CFlCVMs.exe
  2⤵
  PID:8156
- C:\Windows\System\EOLDhDF.exe
  C:\Windows\System\EOLDhDF.exe
  2⤵
  PID:8176
- C:\Windows\System\ltoAhmm.exe
  C:\Windows\System\ltoAhmm.exe
  2⤵
  PID:4940
- C:\Windows\System\BhTkZfZ.exe
  C:\Windows\System\BhTkZfZ.exe
  2⤵
  PID:4588
- C:\Windows\System\UGznnhj.exe
  C:\Windows\System\UGznnhj.exe
  2⤵
  PID:5592
- C:\Windows\System\CIFcOZv.exe
  C:\Windows\System\CIFcOZv.exe
  2⤵
  PID:5152
- C:\Windows\System\IxZZXrD.exe
  C:\Windows\System\IxZZXrD.exe
  2⤵
  PID:632
- C:\Windows\System\HGovPKT.exe
  C:\Windows\System\HGovPKT.exe
  2⤵
  PID:1088
- C:\Windows\System\yWgsSgE.exe
  C:\Windows\System\yWgsSgE.exe
  2⤵
  PID:5536
- C:\Windows\System\hVoTNfr.exe
  C:\Windows\System\hVoTNfr.exe
  2⤵
  PID:6160
- C:\Windows\System\wePefyk.exe
  C:\Windows\System\wePefyk.exe
  2⤵
  PID:5288
- C:\Windows\System\oiDxxBW.exe
  C:\Windows\System\oiDxxBW.exe
  2⤵
  PID:5372
- C:\Windows\System\CqjckxC.exe
  C:\Windows\System\CqjckxC.exe
  2⤵
  PID:5412
- C:\Windows\System\OqWkzwc.exe
  C:\Windows\System\OqWkzwc.exe
  2⤵
  PID:5548
- C:\Windows\System\rFZFtGi.exe
  C:\Windows\System\rFZFtGi.exe
  2⤵
  PID:5652
- C:\Windows\System\mpFoQXz.exe
  C:\Windows\System\mpFoQXz.exe
  2⤵
  PID:6280
- C:\Windows\System\IoFREiR.exe
  C:\Windows\System\IoFREiR.exe
  2⤵
  PID:5840
- C:\Windows\System\HfAsJMz.exe
  C:\Windows\System\HfAsJMz.exe
  2⤵
  PID:5888
- C:\Windows\System\STumzzD.exe
  C:\Windows\System\STumzzD.exe
  2⤵
  PID:5952
- C:\Windows\System\ahIccXN.exe
  C:\Windows\System\ahIccXN.exe
  2⤵
  PID:5988
- C:\Windows\System\GalRJhm.exe
  C:\Windows\System\GalRJhm.exe
  2⤵
  PID:220
- C:\Windows\System\SUNVsnP.exe
  C:\Windows\System\SUNVsnP.exe
  2⤵
  PID:3524
- C:\Windows\System\rgwcuIQ.exe
  C:\Windows\System\rgwcuIQ.exe
  2⤵
  PID:5256
- C:\Windows\System\KDezXQk.exe
  C:\Windows\System\KDezXQk.exe
  2⤵
  PID:5532
- C:\Windows\System\rPWTodI.exe
  C:\Windows\System\rPWTodI.exe
  2⤵
  PID:2096
- C:\Windows\System\DqgpkDc.exe
  C:\Windows\System\DqgpkDc.exe
  2⤵
  PID:6180
- C:\Windows\System\JYUZamt.exe
  C:\Windows\System\JYUZamt.exe
  2⤵
  PID:6232
- C:\Windows\System\WTMUQEu.exe
  C:\Windows\System\WTMUQEu.exe
  2⤵
  PID:6268
- C:\Windows\System\zWWNcie.exe
  C:\Windows\System\zWWNcie.exe
  2⤵
  PID:6324
- C:\Windows\System\PmDkOYs.exe
  C:\Windows\System\PmDkOYs.exe
  2⤵
  PID:6484
- C:\Windows\System\wFVPLYF.exe
  C:\Windows\System\wFVPLYF.exe
  2⤵
  PID:6668
- C:\Windows\System\GduKOTI.exe
  C:\Windows\System\GduKOTI.exe
  2⤵
  PID:6880
- C:\Windows\System\AVunOyx.exe
  C:\Windows\System\AVunOyx.exe
  2⤵
  PID:7136
- C:\Windows\System\HzaHIgh.exe
  C:\Windows\System\HzaHIgh.exe
  2⤵
  PID:6388
- C:\Windows\System\JoUXKdQ.exe
  C:\Windows\System\JoUXKdQ.exe
  2⤵
  PID:6424
- C:\Windows\System\fZpdkds.exe
  C:\Windows\System\fZpdkds.exe
  2⤵
  PID:6536
- C:\Windows\System\ostmTza.exe
  C:\Windows\System\ostmTza.exe
  2⤵
  PID:6620
- C:\Windows\System\EJfqWrC.exe
  C:\Windows\System\EJfqWrC.exe
  2⤵
  PID:6688
- C:\Windows\System\NCWFhSl.exe
  C:\Windows\System\NCWFhSl.exe
  2⤵
  PID:6752
- C:\Windows\System\IlVRbFP.exe
  C:\Windows\System\IlVRbFP.exe
  2⤵
  PID:6804
- C:\Windows\System\SQvSQrc.exe
  C:\Windows\System\SQvSQrc.exe
  2⤵
  PID:6836
- C:\Windows\System\EVtLtzj.exe
  C:\Windows\System\EVtLtzj.exe
  2⤵
  PID:6900
- C:\Windows\System\pjMDCYy.exe
  C:\Windows\System\pjMDCYy.exe
  2⤵
  PID:6980
- C:\Windows\System\cbJBJiY.exe
  C:\Windows\System\cbJBJiY.exe
  2⤵
  PID:7040
- C:\Windows\System\gPqPTOd.exe
  C:\Windows\System\gPqPTOd.exe
  2⤵
  PID:7148
- C:\Windows\System\ryIYhMh.exe
  C:\Windows\System\ryIYhMh.exe
  2⤵
  PID:5752
- C:\Windows\System\SDSfcxR.exe
  C:\Windows\System\SDSfcxR.exe
  2⤵
  PID:4344
- C:\Windows\System\EVUrhgf.exe
  C:\Windows\System\EVUrhgf.exe
  2⤵
  PID:1520
- C:\Windows\System\uHtkgdJ.exe
  C:\Windows\System\uHtkgdJ.exe
  2⤵
  PID:8208
- C:\Windows\System\WVYkyEN.exe
  C:\Windows\System\WVYkyEN.exe
  2⤵
  PID:8224
- C:\Windows\System\ludNyus.exe
  C:\Windows\System\ludNyus.exe
  2⤵
  PID:8248
- C:\Windows\System\SgQQrOu.exe
  C:\Windows\System\SgQQrOu.exe
  2⤵
  PID:8268
- C:\Windows\System\PpZupln.exe
  C:\Windows\System\PpZupln.exe
  2⤵
  PID:8296
- C:\Windows\System\jXKZuZD.exe
  C:\Windows\System\jXKZuZD.exe
  2⤵
  PID:8324
- C:\Windows\System\svDuJzc.exe
  C:\Windows\System\svDuJzc.exe
  2⤵
  PID:8344
- C:\Windows\System\XvAgumq.exe
  C:\Windows\System\XvAgumq.exe
  2⤵
  PID:8360
- C:\Windows\System\KYjsHZJ.exe
  C:\Windows\System\KYjsHZJ.exe
  2⤵
  PID:8380
- C:\Windows\System\ZFAyljI.exe
  C:\Windows\System\ZFAyljI.exe
  2⤵
  PID:8396
- C:\Windows\System\qIPaEno.exe
  C:\Windows\System\qIPaEno.exe
  2⤵
  PID:8412
- C:\Windows\System\eHsQXqT.exe
  C:\Windows\System\eHsQXqT.exe
  2⤵
  PID:8432
- C:\Windows\System\jSQlXnH.exe
  C:\Windows\System\jSQlXnH.exe
  2⤵
  PID:8448
- C:\Windows\System\FCfkDZY.exe
  C:\Windows\System\FCfkDZY.exe
  2⤵
  PID:8468
- C:\Windows\System\KerYsEm.exe
  C:\Windows\System\KerYsEm.exe
  2⤵
  PID:8484
- C:\Windows\System\BfGxPXi.exe
  C:\Windows\System\BfGxPXi.exe
  2⤵
  PID:8500
- C:\Windows\System\ocSTtne.exe
  C:\Windows\System\ocSTtne.exe
  2⤵
  PID:8520
- C:\Windows\System\PZItlce.exe
  C:\Windows\System\PZItlce.exe
  2⤵
  PID:8536
- C:\Windows\System\SVuOeow.exe
  C:\Windows\System\SVuOeow.exe
  2⤵
  PID:8556
- C:\Windows\System\Nvagjwq.exe
  C:\Windows\System\Nvagjwq.exe
  2⤵
  PID:8576
- C:\Windows\System\fBXrTSb.exe
  C:\Windows\System\fBXrTSb.exe
  2⤵
  PID:8592
- C:\Windows\System\OuHtbxV.exe
  C:\Windows\System\OuHtbxV.exe
  2⤵
  PID:8620
- C:\Windows\System\kOpEpHy.exe
  C:\Windows\System\kOpEpHy.exe
  2⤵
  PID:8636
- C:\Windows\System\WZEQcIm.exe
  C:\Windows\System\WZEQcIm.exe
  2⤵
  PID:8656
- C:\Windows\System\BKbUmtY.exe
  C:\Windows\System\BKbUmtY.exe
  2⤵
  PID:8672
- C:\Windows\System\GYKRBpc.exe
  C:\Windows\System\GYKRBpc.exe
  2⤵
  PID:8692
- C:\Windows\System\WpAXyct.exe
  C:\Windows\System\WpAXyct.exe
  2⤵
  PID:8708
- C:\Windows\System\spnWpkv.exe
  C:\Windows\System\spnWpkv.exe
  2⤵
  PID:8724
- C:\Windows\System\uLKFPFq.exe
  C:\Windows\System\uLKFPFq.exe
  2⤵
  PID:8748
- C:\Windows\System\NbnCRst.exe
  C:\Windows\System\NbnCRst.exe
  2⤵
  PID:8764
- C:\Windows\System\OTSzMIS.exe
  C:\Windows\System\OTSzMIS.exe
  2⤵
  PID:8788
- C:\Windows\System\CwhpcHy.exe
  C:\Windows\System\CwhpcHy.exe
  2⤵
  PID:8804
- C:\Windows\System\MzeSoDH.exe
  C:\Windows\System\MzeSoDH.exe
  2⤵
  PID:8828
- C:\Windows\System\mguhAis.exe
  C:\Windows\System\mguhAis.exe
  2⤵
  PID:8844
- C:\Windows\System\gbtfZTb.exe
  C:\Windows\System\gbtfZTb.exe
  2⤵
  PID:8864
- C:\Windows\System\GwXlSUL.exe
  C:\Windows\System\GwXlSUL.exe
  2⤵
  PID:8884
- C:\Windows\System\mNDoaEQ.exe
  C:\Windows\System\mNDoaEQ.exe
  2⤵
  PID:8900
- C:\Windows\System\HgdRSkD.exe
  C:\Windows\System\HgdRSkD.exe
  2⤵
  PID:8920
- C:\Windows\System\YGzVdZe.exe
  C:\Windows\System\YGzVdZe.exe
  2⤵
  PID:8940
- C:\Windows\System\MmDktsw.exe
  C:\Windows\System\MmDktsw.exe
  2⤵
  PID:8964
- C:\Windows\System\yYerEFF.exe
  C:\Windows\System\yYerEFF.exe
  2⤵
  PID:8980
- C:\Windows\System\zoDbgfv.exe
  C:\Windows\System\zoDbgfv.exe
  2⤵
  PID:8996
- C:\Windows\System\iiCZxRr.exe
  C:\Windows\System\iiCZxRr.exe
  2⤵
  PID:9020
- C:\Windows\System\ZVPiwFM.exe
  C:\Windows\System\ZVPiwFM.exe
  2⤵
  PID:9040
- C:\Windows\System\APIroog.exe
  C:\Windows\System\APIroog.exe
  2⤵
  PID:9060
- C:\Windows\System\ECHtLpx.exe
  C:\Windows\System\ECHtLpx.exe
  2⤵
  PID:9080
- C:\Windows\System\zUiODqW.exe
  C:\Windows\System\zUiODqW.exe
  2⤵
  PID:9100
- C:\Windows\System\BvuqeXo.exe
  C:\Windows\System\BvuqeXo.exe
  2⤵
  PID:9120
- C:\Windows\System\JGBmTcK.exe
  C:\Windows\System\JGBmTcK.exe
  2⤵
  PID:9140
- C:\Windows\System\yIOdRYJ.exe
  C:\Windows\System\yIOdRYJ.exe
  2⤵
  PID:9160
- C:\Windows\System\tlbOPpQ.exe
  C:\Windows\System\tlbOPpQ.exe
  2⤵
  PID:9180
- C:\Windows\System\ckoJIgt.exe
  C:\Windows\System\ckoJIgt.exe
  2⤵
  PID:9200
- C:\Windows\System\phGnmqQ.exe
  C:\Windows\System\phGnmqQ.exe
  2⤵
  PID:7256
- C:\Windows\System\odTqUui.exe
  C:\Windows\System\odTqUui.exe
  2⤵
  PID:7380
- C:\Windows\System\UhkeTJb.exe
  C:\Windows\System\UhkeTJb.exe
  2⤵
  PID:7524
- C:\Windows\System\Jeyjiur.exe
  C:\Windows\System\Jeyjiur.exe
  2⤵
  PID:7616
- C:\Windows\System\mkeCuFl.exe
  C:\Windows\System\mkeCuFl.exe
  2⤵
  PID:7736
- C:\Windows\System\bRMScbJ.exe
  C:\Windows\System\bRMScbJ.exe
  2⤵
  PID:860
- C:\Windows\System\zVcXfKv.exe
  C:\Windows\System\zVcXfKv.exe
  2⤵
  PID:9232
- C:\Windows\System\onKxCso.exe
  C:\Windows\System\onKxCso.exe
  2⤵
  PID:9256
- C:\Windows\System\AXQvjCQ.exe
  C:\Windows\System\AXQvjCQ.exe
  2⤵
  PID:9272
- C:\Windows\System\IzhqCpQ.exe
  C:\Windows\System\IzhqCpQ.exe
  2⤵
  PID:9300
- C:\Windows\System\HNrOakx.exe
  C:\Windows\System\HNrOakx.exe
  2⤵
  PID:9316
- C:\Windows\System\ovfPeou.exe
  C:\Windows\System\ovfPeou.exe
  2⤵
  PID:9408
- C:\Windows\System\SwYYEBm.exe
  C:\Windows\System\SwYYEBm.exe
  2⤵
  PID:9424
- C:\Windows\System\VSVRPJW.exe
  C:\Windows\System\VSVRPJW.exe
  2⤵
  PID:9440
- C:\Windows\System\RWWUHwa.exe
  C:\Windows\System\RWWUHwa.exe
  2⤵
  PID:9456
- C:\Windows\System\UgzOAxc.exe
  C:\Windows\System\UgzOAxc.exe
  2⤵
  PID:9472
- C:\Windows\System\dBkzFOP.exe
  C:\Windows\System\dBkzFOP.exe
  2⤵
  PID:9488
- C:\Windows\System\wVEYZUu.exe
  C:\Windows\System\wVEYZUu.exe
  2⤵
  PID:9504
- C:\Windows\System\wPPGMix.exe
  C:\Windows\System\wPPGMix.exe
  2⤵
  PID:9520
- C:\Windows\System\tzaeTsI.exe
  C:\Windows\System\tzaeTsI.exe
  2⤵
  PID:9536
- C:\Windows\System\KNrNCaL.exe
  C:\Windows\System\KNrNCaL.exe
  2⤵
  PID:9552
- C:\Windows\System\HgkBppg.exe
  C:\Windows\System\HgkBppg.exe
  2⤵
  PID:9568
- C:\Windows\System\QZAdpWS.exe
  C:\Windows\System\QZAdpWS.exe
  2⤵
  PID:9588
- C:\Windows\System\VbBMzGw.exe
  C:\Windows\System\VbBMzGw.exe
  2⤵
  PID:9608
- C:\Windows\System\EeVjtyd.exe
  C:\Windows\System\EeVjtyd.exe
  2⤵
  PID:9624
- C:\Windows\System\jOjiSMS.exe
  C:\Windows\System\jOjiSMS.exe
  2⤵
  PID:9640
- C:\Windows\System\jtBEqWw.exe
  C:\Windows\System\jtBEqWw.exe
  2⤵
  PID:9656
- C:\Windows\System\AcxsrkV.exe
  C:\Windows\System\AcxsrkV.exe
  2⤵
  PID:9672
- C:\Windows\System\InHFfod.exe
  C:\Windows\System\InHFfod.exe
  2⤵
  PID:9692
- C:\Windows\System\rWQSrYF.exe
  C:\Windows\System\rWQSrYF.exe
  2⤵
  PID:9712
- C:\Windows\System\MzaPlVi.exe
  C:\Windows\System\MzaPlVi.exe
  2⤵
  PID:9740
- C:\Windows\System\kSUpqAg.exe
  C:\Windows\System\kSUpqAg.exe
  2⤵
  PID:9764
- C:\Windows\System\HHpyFzy.exe
  C:\Windows\System\HHpyFzy.exe
  2⤵
  PID:9788
- C:\Windows\System\dFtApPU.exe
  C:\Windows\System\dFtApPU.exe
  2⤵
  PID:9808
- C:\Windows\System\DmKkbgT.exe
  C:\Windows\System\DmKkbgT.exe
  2⤵
  PID:9824
- C:\Windows\System\VnBXjTE.exe
  C:\Windows\System\VnBXjTE.exe
  2⤵
  PID:9844
- C:\Windows\System\aWpsasl.exe
  C:\Windows\System\aWpsasl.exe
  2⤵
  PID:9860
- C:\Windows\System\zQumzDE.exe
  C:\Windows\System\zQumzDE.exe
  2⤵
  PID:9880
- C:\Windows\System\cmDndeG.exe
  C:\Windows\System\cmDndeG.exe
  2⤵
  PID:9900
- C:\Windows\System\rXqZKkO.exe
  C:\Windows\System\rXqZKkO.exe
  2⤵
  PID:9924
- C:\Windows\System\DGwqklV.exe
  C:\Windows\System\DGwqklV.exe
  2⤵
  PID:9940
- C:\Windows\System\HZVNQWN.exe
  C:\Windows\System\HZVNQWN.exe
  2⤵
  PID:9956
- C:\Windows\System\IRGeMIP.exe
  C:\Windows\System\IRGeMIP.exe
  2⤵
  PID:9976
- C:\Windows\System\PaacyvA.exe
  C:\Windows\System\PaacyvA.exe
  2⤵
  PID:9996
- C:\Windows\System\EWPwQbb.exe
  C:\Windows\System\EWPwQbb.exe
  2⤵
  PID:10016
- C:\Windows\System\cPWsyHZ.exe
  C:\Windows\System\cPWsyHZ.exe
  2⤵
  PID:10032
- C:\Windows\System\yQyYpaP.exe
  C:\Windows\System\yQyYpaP.exe
  2⤵
  PID:10052
- C:\Windows\System\hDmDpYG.exe
  C:\Windows\System\hDmDpYG.exe
  2⤵
  PID:10076
- C:\Windows\System\VOGTZLN.exe
  C:\Windows\System\VOGTZLN.exe
  2⤵
  PID:10096
- C:\Windows\System\WBtOJaU.exe
  C:\Windows\System\WBtOJaU.exe
  2⤵
  PID:10116
- C:\Windows\System\PNRcknB.exe
  C:\Windows\System\PNRcknB.exe
  2⤵
  PID:10136
- C:\Windows\System\wnevgFw.exe
  C:\Windows\System\wnevgFw.exe
  2⤵
  PID:10160
- C:\Windows\System\vhWxhwM.exe
  C:\Windows\System\vhWxhwM.exe
  2⤵
  PID:10176
- C:\Windows\System\BQQoTSZ.exe
  C:\Windows\System\BQQoTSZ.exe
  2⤵
  PID:10196
- C:\Windows\System\IeRzbwZ.exe
  C:\Windows\System\IeRzbwZ.exe
  2⤵
  PID:10216
- C:\Windows\System\jwmFcJr.exe
  C:\Windows\System\jwmFcJr.exe
  2⤵
  PID:5788
- C:\Windows\System\CPwAoPO.exe
  C:\Windows\System\CPwAoPO.exe
  2⤵
  PID:7228
- C:\Windows\System\suMAEVX.exe
  C:\Windows\System\suMAEVX.exe
  2⤵
  PID:7484
- C:\Windows\System\JvbTDGB.exe
  C:\Windows\System\JvbTDGB.exe
  2⤵
  PID:7800
- C:\Windows\System\ZLckEcL.exe
  C:\Windows\System\ZLckEcL.exe
  2⤵
  PID:6672
- C:\Windows\System\JTIvApA.exe
  C:\Windows\System\JTIvApA.exe
  2⤵
  PID:6012
- C:\Windows\System\iQxxUlF.exe
  C:\Windows\System\iQxxUlF.exe
  2⤵
  PID:8232
- C:\Windows\System\VtfBZQj.exe
  C:\Windows\System\VtfBZQj.exe
  2⤵
  PID:8276
- C:\Windows\System\xuWaltg.exe
  C:\Windows\System\xuWaltg.exe
  2⤵
  PID:7340
- C:\Windows\System\jPhHYxl.exe
  C:\Windows\System\jPhHYxl.exe
  2⤵
  PID:8388
- C:\Windows\System\mKfPqLs.exe
  C:\Windows\System\mKfPqLs.exe
  2⤵
  PID:8460
- C:\Windows\System\ijexlGD.exe
  C:\Windows\System\ijexlGD.exe
  2⤵
  PID:7476
- C:\Windows\System\TooslaP.exe
  C:\Windows\System\TooslaP.exe
  2⤵
  PID:7584
- C:\Windows\System\NckHlpv.exe
  C:\Windows\System\NckHlpv.exe
  2⤵
  PID:8568
- C:\Windows\System\GuMBpjj.exe
  C:\Windows\System\GuMBpjj.exe
  2⤵
  PID:8612
- C:\Windows\System\qWOTvIj.exe
  C:\Windows\System\qWOTvIj.exe
  2⤵
  PID:8700
- C:\Windows\System\GXKzvEi.exe
  C:\Windows\System\GXKzvEi.exe
  2⤵
  PID:7688
- C:\Windows\System\BFxfWKg.exe
  C:\Windows\System\BFxfWKg.exe
  2⤵
  PID:8796
- C:\Windows\System\HQCKTII.exe
  C:\Windows\System\HQCKTII.exe
  2⤵
  PID:8824
- C:\Windows\System\yTDqURQ.exe
  C:\Windows\System\yTDqURQ.exe
  2⤵
  PID:8856
- C:\Windows\System\JwvGOgQ.exe
  C:\Windows\System\JwvGOgQ.exe
  2⤵
  PID:7764
- C:\Windows\System\ddbNcQN.exe
  C:\Windows\System\ddbNcQN.exe
  2⤵
  PID:8948
- C:\Windows\System\UMsYKDC.exe
  C:\Windows\System\UMsYKDC.exe
  2⤵
  PID:9016
- C:\Windows\System\iVgLiWM.exe
  C:\Windows\System\iVgLiWM.exe
  2⤵
  PID:9136
- C:\Windows\System\EnqlhNZ.exe
  C:\Windows\System\EnqlhNZ.exe
  2⤵
  PID:9172
- C:\Windows\System\XLofHjy.exe
  C:\Windows\System\XLofHjy.exe
  2⤵
  PID:9196
- C:\Windows\System\rIBzcyu.exe
  C:\Windows\System\rIBzcyu.exe
  2⤵
  PID:7320
- C:\Windows\System\GYzXcDP.exe
  C:\Windows\System\GYzXcDP.exe
  2⤵
  PID:7560
- C:\Windows\System\Cdyvanq.exe
  C:\Windows\System\Cdyvanq.exe
  2⤵
  PID:7672
- C:\Windows\System\daGwleT.exe
  C:\Windows\System\daGwleT.exe
  2⤵
  PID:9224
- C:\Windows\System\rJCcijI.exe
  C:\Windows\System\rJCcijI.exe
  2⤵
  PID:9268
- C:\Windows\System\SQuAQZo.exe
  C:\Windows\System\SQuAQZo.exe
  2⤵
  PID:6444
- C:\Windows\System\ubeGjhy.exe
  C:\Windows\System\ubeGjhy.exe
  2⤵
  PID:6608
- C:\Windows\System\iVXTJtz.exe
  C:\Windows\System\iVXTJtz.exe
  2⤵
  PID:6840
- C:\Windows\System\EnAWdQR.exe
  C:\Windows\System\EnAWdQR.exe
  2⤵
  PID:6936
- C:\Windows\System\KMiKQbE.exe
  C:\Windows\System\KMiKQbE.exe
  2⤵
  PID:7080
- C:\Windows\System\YPpaHdt.exe
  C:\Windows\System\YPpaHdt.exe
  2⤵
  PID:1008
- C:\Windows\System\LuUMUfW.exe
  C:\Windows\System\LuUMUfW.exe
  2⤵
  PID:2588
- C:\Windows\System\HIdqEBx.exe
  C:\Windows\System\HIdqEBx.exe
  2⤵
  PID:1904
- C:\Windows\System\PTfHjDD.exe
  C:\Windows\System\PTfHjDD.exe
  2⤵
  PID:5436
- C:\Windows\System\ysyXBSz.exe
  C:\Windows\System\ysyXBSz.exe
  2⤵
  PID:7280
- C:\Windows\System\vCNHSMS.exe
  C:\Windows\System\vCNHSMS.exe
  2⤵
  PID:7360
- C:\Windows\System\jYavbjF.exe
  C:\Windows\System\jYavbjF.exe
  2⤵
  PID:7540
- C:\Windows\System\gLptmwS.exe
  C:\Windows\System\gLptmwS.exe
  2⤵
  PID:7692
- C:\Windows\System\ZaMaItS.exe
  C:\Windows\System\ZaMaItS.exe
  2⤵
  PID:9056
- C:\Windows\System\CyQeHZd.exe
  C:\Windows\System\CyQeHZd.exe
  2⤵
  PID:7996
- C:\Windows\System\UbXTfNg.exe
  C:\Windows\System\UbXTfNg.exe
  2⤵
  PID:8024
- C:\Windows\System\nBLfNAH.exe
  C:\Windows\System\nBLfNAH.exe
  2⤵
  PID:8052
- C:\Windows\System\VtsVMbz.exe
  C:\Windows\System\VtsVMbz.exe
  2⤵
  PID:8084
- C:\Windows\System\MXLpwFI.exe
  C:\Windows\System\MXLpwFI.exe
  2⤵
  PID:1932
- C:\Windows\System\gWWKMGp.exe
  C:\Windows\System\gWWKMGp.exe
  2⤵
  PID:8148
- C:\Windows\System\RfKfBHW.exe
  C:\Windows\System\RfKfBHW.exe
  2⤵
  PID:8184
- C:\Windows\System\UpVfXzi.exe
  C:\Windows\System\UpVfXzi.exe
  2⤵
  PID:684
- C:\Windows\System\tlbDJIY.exe
  C:\Windows\System\tlbDJIY.exe
  2⤵
  PID:5140
- C:\Windows\System\EMwrrhx.exe
  C:\Windows\System\EMwrrhx.exe
  2⤵
  PID:2424
- C:\Windows\System\NURAICm.exe
  C:\Windows\System\NURAICm.exe
  2⤵
  PID:5672
- C:\Windows\System\ObhCQNH.exe
  C:\Windows\System\ObhCQNH.exe
  2⤵
  PID:5908
- C:\Windows\System\KNPAPKm.exe
  C:\Windows\System\KNPAPKm.exe
  2⤵
  PID:6060
- C:\Windows\System\ZCUQFbb.exe
  C:\Windows\System\ZCUQFbb.exe
  2⤵
  PID:3424
- C:\Windows\System\JYGbUDW.exe
  C:\Windows\System\JYGbUDW.exe
  2⤵
  PID:4136
- C:\Windows\System\MaexrNY.exe
  C:\Windows\System\MaexrNY.exe
  2⤵
  PID:6220
- C:\Windows\System\vSpcKQA.exe
  C:\Windows\System\vSpcKQA.exe
  2⤵
  PID:6300
- C:\Windows\System\ubGwMWO.exe
  C:\Windows\System\ubGwMWO.exe
  2⤵
  PID:6612
- C:\Windows\System\eMKNPvD.exe
  C:\Windows\System\eMKNPvD.exe
  2⤵
  PID:7032
- C:\Windows\System\DyJukOA.exe
  C:\Windows\System\DyJukOA.exe
  2⤵
  PID:6420
- C:\Windows\System\UhaoaKQ.exe
  C:\Windows\System\UhaoaKQ.exe
  2⤵
  PID:6592
- C:\Windows\System\SjjEabb.exe
  C:\Windows\System\SjjEabb.exe
  2⤵
  PID:6728
- C:\Windows\System\BewhMHu.exe
  C:\Windows\System\BewhMHu.exe
  2⤵
  PID:6824
- C:\Windows\System\SlzSNFS.exe
  C:\Windows\System\SlzSNFS.exe
  2⤵
  PID:7020
- C:\Windows\System\TlGsjHs.exe
  C:\Windows\System\TlGsjHs.exe
  2⤵
  PID:7164
- C:\Windows\System\mKBtKNh.exe
  C:\Windows\System\mKBtKNh.exe
  2⤵
  PID:8284
- C:\Windows\System\ieKezUC.exe
  C:\Windows\System\ieKezUC.exe
  2⤵
  PID:8376
- C:\Windows\System\cBztKwM.exe
  C:\Windows\System\cBztKwM.exe
  2⤵
  PID:8428
- C:\Windows\System\uUVSEwL.exe
  C:\Windows\System\uUVSEwL.exe
  2⤵
  PID:8544
- C:\Windows\System\fDehMDX.exe
  C:\Windows\System\fDehMDX.exe
  2⤵
  PID:8632
- C:\Windows\System\HaockZB.exe
  C:\Windows\System\HaockZB.exe
  2⤵
  PID:8740
- C:\Windows\System\tpMkOPn.exe
  C:\Windows\System\tpMkOPn.exe
  2⤵
  PID:8896
- C:\Windows\System\HcqRhnX.exe
  C:\Windows\System\HcqRhnX.exe
  2⤵
  PID:8960
- C:\Windows\System\qWCfBHV.exe
  C:\Windows\System\qWCfBHV.exe
  2⤵
  PID:9004
- C:\Windows\System\FkVGRuQ.exe
  C:\Windows\System\FkVGRuQ.exe
  2⤵
  PID:9076
- C:\Windows\System\PYndRyd.exe
  C:\Windows\System\PYndRyd.exe
  2⤵
  PID:8404
- C:\Windows\System\ilWOryu.exe
  C:\Windows\System\ilWOryu.exe
  2⤵
  PID:8688
- C:\Windows\System\dqPUyNt.exe
  C:\Windows\System\dqPUyNt.exe
  2⤵
  PID:10260
- C:\Windows\System\YFXzDts.exe
  C:\Windows\System\YFXzDts.exe
  2⤵
  PID:10276
- C:\Windows\System\LalYhsK.exe
  C:\Windows\System\LalYhsK.exe
  2⤵
  PID:10300
- C:\Windows\System\ePJCOEt.exe
  C:\Windows\System\ePJCOEt.exe
  2⤵
  PID:10320
- C:\Windows\System\kcQbwdn.exe
  C:\Windows\System\kcQbwdn.exe
  2⤵
  PID:10344
- C:\Windows\System\HurkZHx.exe
  C:\Windows\System\HurkZHx.exe
  2⤵
  PID:10364
- C:\Windows\System\WLcpmwu.exe
  C:\Windows\System\WLcpmwu.exe
  2⤵
  PID:10384
- C:\Windows\System\aUVSoYJ.exe
  C:\Windows\System\aUVSoYJ.exe
  2⤵
  PID:10404
- C:\Windows\System\gHisYug.exe
  C:\Windows\System\gHisYug.exe
  2⤵
  PID:10428
- C:\Windows\System\PRHhMLz.exe
  C:\Windows\System\PRHhMLz.exe
  2⤵
  PID:10448
- C:\Windows\System\dBnXDRv.exe
  C:\Windows\System\dBnXDRv.exe
  2⤵
  PID:10468
- C:\Windows\System\OQFvYoI.exe
  C:\Windows\System\OQFvYoI.exe
  2⤵
  PID:10492
- C:\Windows\System\nZxJfdT.exe
  C:\Windows\System\nZxJfdT.exe
  2⤵
  PID:10508
- C:\Windows\System\EtNNJMF.exe
  C:\Windows\System\EtNNJMF.exe
  2⤵
  PID:10532
- C:\Windows\System\qYadABZ.exe
  C:\Windows\System\qYadABZ.exe
  2⤵
  PID:10556
- C:\Windows\System\luonZcp.exe
  C:\Windows\System\luonZcp.exe
  2⤵
  PID:10572
- C:\Windows\System\sbDGaHG.exe
  C:\Windows\System\sbDGaHG.exe
  2⤵
  PID:10600
- C:\Windows\System\kcPQDml.exe
  C:\Windows\System\kcPQDml.exe
  2⤵
  PID:10620
- C:\Windows\System\tYkXtiz.exe
  C:\Windows\System\tYkXtiz.exe
  2⤵
  PID:10636
- C:\Windows\System\BOQcbsp.exe
  C:\Windows\System\BOQcbsp.exe
  2⤵
  PID:10660
- C:\Windows\System\YREmwuY.exe
  C:\Windows\System\YREmwuY.exe
  2⤵
  PID:10684
- C:\Windows\System\bmeKQZU.exe
  C:\Windows\System\bmeKQZU.exe
  2⤵
  PID:10704
- C:\Windows\System\WTXuliQ.exe
  C:\Windows\System\WTXuliQ.exe
  2⤵
  PID:10724
- C:\Windows\System\QwWcyBQ.exe
  C:\Windows\System\QwWcyBQ.exe
  2⤵
  PID:10744
- C:\Windows\System\vzPkSmr.exe
  C:\Windows\System\vzPkSmr.exe
  2⤵
  PID:10764
- C:\Windows\System\gQdrJef.exe
  C:\Windows\System\gQdrJef.exe
  2⤵
  PID:10788
- C:\Windows\System\KIBsRMH.exe
  C:\Windows\System\KIBsRMH.exe
  2⤵
  PID:10808
- C:\Windows\System\pqJNJcR.exe
  C:\Windows\System\pqJNJcR.exe
  2⤵
  PID:10828
- C:\Windows\System\eUtOSDz.exe
  C:\Windows\System\eUtOSDz.exe
  2⤵
  PID:10852
- C:\Windows\System\fLdRFyv.exe
  C:\Windows\System\fLdRFyv.exe
  2⤵
  PID:10868
- C:\Windows\System\ZsqyKph.exe
  C:\Windows\System\ZsqyKph.exe
  2⤵
  PID:10892
- C:\Windows\System\lDrDzxX.exe
  C:\Windows\System\lDrDzxX.exe
  2⤵
  PID:10916
- C:\Windows\System\jAKUkJQ.exe
  C:\Windows\System\jAKUkJQ.exe
  2⤵
  PID:10932
- C:\Windows\System\IltdmDf.exe
  C:\Windows\System\IltdmDf.exe
  2⤵
  PID:10956
- C:\Windows\System\ynGRbrs.exe
  C:\Windows\System\ynGRbrs.exe
  2⤵
  PID:10972
- C:\Windows\System\yBrLrsH.exe
  C:\Windows\System\yBrLrsH.exe
  2⤵
  PID:10996
- C:\Windows\System\sYzZefl.exe
  C:\Windows\System\sYzZefl.exe
  2⤵
  PID:11020
- C:\Windows\System\wmqLVGV.exe
  C:\Windows\System\wmqLVGV.exe
  2⤵
  PID:11036
- C:\Windows\System\affDoNe.exe
  C:\Windows\System\affDoNe.exe
  2⤵
  PID:11060
- C:\Windows\System\jiuBvqT.exe
  C:\Windows\System\jiuBvqT.exe
  2⤵
  PID:11084
- C:\Windows\System\ZHjvNaY.exe
  C:\Windows\System\ZHjvNaY.exe
  2⤵
  PID:11104
- C:\Windows\System\hzoIlih.exe
  C:\Windows\System\hzoIlih.exe
  2⤵
  PID:11124
- C:\Windows\System\FjEzzSL.exe
  C:\Windows\System\FjEzzSL.exe
  2⤵
  PID:11144
- C:\Windows\System\BzEVojC.exe
  C:\Windows\System\BzEVojC.exe
  2⤵
  PID:11164
- C:\Windows\System\ZrfTQvA.exe
  C:\Windows\System\ZrfTQvA.exe
  2⤵
  PID:11188
- C:\Windows\System\RckjiKo.exe
  C:\Windows\System\RckjiKo.exe
  2⤵
  PID:11216
- C:\Windows\System\iZjfyOu.exe
  C:\Windows\System\iZjfyOu.exe
  2⤵
  PID:11232
- C:\Windows\System\rIlsyBa.exe
  C:\Windows\System\rIlsyBa.exe
  2⤵
  PID:11256
- C:\Windows\System\bMztkqV.exe
  C:\Windows\System\bMztkqV.exe
  2⤵
  PID:11280
- C:\Windows\System\MxJEqwU.exe
  C:\Windows\System\MxJEqwU.exe
  2⤵
  PID:11296
- C:\Windows\System\blIKQuh.exe
  C:\Windows\System\blIKQuh.exe
  2⤵
  PID:11320
- C:\Windows\System\kCEzJDh.exe
  C:\Windows\System\kCEzJDh.exe
  2⤵
  PID:11344
- C:\Windows\System\AymAbWj.exe
  C:\Windows\System\AymAbWj.exe
  2⤵
  PID:11360
- C:\Windows\System\wGyrHgt.exe
  C:\Windows\System\wGyrHgt.exe
  2⤵
  PID:11384
- C:\Windows\System\xHlFcdS.exe
  C:\Windows\System\xHlFcdS.exe
  2⤵
  PID:11408
- C:\Windows\System\tDjNXnr.exe
  C:\Windows\System\tDjNXnr.exe
  2⤵
  PID:11428
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11428 -s 28
    3⤵
    PID:12660
- C:\Windows\System\OQFoMUx.exe
  C:\Windows\System\OQFoMUx.exe
  2⤵
  PID:11448
- C:\Windows\System\KltJImk.exe
  C:\Windows\System\KltJImk.exe
  2⤵
  PID:11468
- C:\Windows\System\ofVwNoK.exe
  C:\Windows\System\ofVwNoK.exe
  2⤵
  PID:11488
- C:\Windows\System\HtklRkM.exe
  C:\Windows\System\HtklRkM.exe
  2⤵
  PID:11512
- C:\Windows\System\OsFsbHy.exe
  C:\Windows\System\OsFsbHy.exe
  2⤵
  PID:11528
- C:\Windows\System\pZqQSAQ.exe
  C:\Windows\System\pZqQSAQ.exe
  2⤵
  PID:11556
- C:\Windows\System\fwPdjqW.exe
  C:\Windows\System\fwPdjqW.exe
  2⤵
  PID:11572
- C:\Windows\System\MjWsAKh.exe
  C:\Windows\System\MjWsAKh.exe
  2⤵
  PID:11588
- C:\Windows\System\uIUKEJY.exe
  C:\Windows\System\uIUKEJY.exe
  2⤵
  PID:11604
- C:\Windows\System\NLmhbWF.exe
  C:\Windows\System\NLmhbWF.exe
  2⤵
  PID:11628
- C:\Windows\System\FfgyWMD.exe
  C:\Windows\System\FfgyWMD.exe
  2⤵
  PID:11652
- C:\Windows\System\dYfNILL.exe
  C:\Windows\System\dYfNILL.exe
  2⤵
  PID:11668
- C:\Windows\System\ojSQgnG.exe
  C:\Windows\System\ojSQgnG.exe
  2⤵
  PID:11692
- C:\Windows\System\tpVBipx.exe
  C:\Windows\System\tpVBipx.exe
  2⤵
  PID:11712
- C:\Windows\System\snGGBIS.exe
  C:\Windows\System\snGGBIS.exe
  2⤵
  PID:11732
- C:\Windows\System\VelBwOU.exe
  C:\Windows\System\VelBwOU.exe
  2⤵
  PID:11756
- C:\Windows\System\MWDZxAM.exe
  C:\Windows\System\MWDZxAM.exe
  2⤵
  PID:11772
- C:\Windows\System\zyCktBB.exe
  C:\Windows\System\zyCktBB.exe
  2⤵
  PID:11796
- C:\Windows\System\MsainAA.exe
  C:\Windows\System\MsainAA.exe
  2⤵
  PID:11820
- C:\Windows\System\CRocAbf.exe
  C:\Windows\System\CRocAbf.exe
  2⤵
  PID:11836
- C:\Windows\System\EWKianL.exe
  C:\Windows\System\EWKianL.exe
  2⤵
  PID:11860
- C:\Windows\System\voiaebe.exe
  C:\Windows\System\voiaebe.exe
  2⤵
  PID:11884
- C:\Windows\System\AAipFQH.exe
  C:\Windows\System\AAipFQH.exe
  2⤵
  PID:11912
- C:\Windows\System\QxBeOTS.exe
  C:\Windows\System\QxBeOTS.exe
  2⤵
  PID:11932
- C:\Windows\System\qUzoukI.exe
  C:\Windows\System\qUzoukI.exe
  2⤵
  PID:11956
- C:\Windows\System\QbTMfDg.exe
  C:\Windows\System\QbTMfDg.exe
  2⤵
  PID:11980
- C:\Windows\System\rELDKTa.exe
  C:\Windows\System\rELDKTa.exe
  2⤵
  PID:11996
- C:\Windows\System\RJQJekl.exe
  C:\Windows\System\RJQJekl.exe
  2⤵
  PID:12020
- C:\Windows\System\poIQGzf.exe
  C:\Windows\System\poIQGzf.exe
  2⤵
  PID:12040
- C:\Windows\System\rWrRMHJ.exe
  C:\Windows\System\rWrRMHJ.exe
  2⤵
  PID:12224
- C:\Windows\System\RaUupYH.exe
  C:\Windows\System\RaUupYH.exe
  2⤵
  PID:12244
- C:\Windows\System\KURIwuH.exe
  C:\Windows\System\KURIwuH.exe
  2⤵
  PID:12268
- C:\Windows\System\KWryeSj.exe
  C:\Windows\System\KWryeSj.exe
  2⤵
  PID:12292
- C:\Windows\System\OaYvpWJ.exe
  C:\Windows\System\OaYvpWJ.exe
  2⤵
  PID:12316
- C:\Windows\System\LbnYjTQ.exe
  C:\Windows\System\LbnYjTQ.exe
  2⤵
  PID:12332
- C:\Windows\System\zrDBriL.exe
  C:\Windows\System\zrDBriL.exe
  2⤵
  PID:12356
- C:\Windows\System\dnilExe.exe
  C:\Windows\System\dnilExe.exe
  2⤵
  PID:12380
- C:\Windows\System\LalaHkj.exe
  C:\Windows\System\LalaHkj.exe
  2⤵
  PID:12400
- C:\Windows\System\UeEhMgQ.exe
  C:\Windows\System\UeEhMgQ.exe
  2⤵
  PID:12420
- C:\Windows\System\kcqZZdJ.exe
  C:\Windows\System\kcqZZdJ.exe
  2⤵
  PID:12444
- C:\Windows\System\tVLGlho.exe
  C:\Windows\System\tVLGlho.exe
  2⤵
  PID:12464
- C:\Windows\System\SUFEMGe.exe
  C:\Windows\System\SUFEMGe.exe
  2⤵
  PID:12488
- C:\Windows\System\kTwqqbJ.exe
  C:\Windows\System\kTwqqbJ.exe
  2⤵
  PID:12508
- C:\Windows\System\RhXFROY.exe
  C:\Windows\System\RhXFROY.exe
  2⤵
  PID:12528
- C:\Windows\System\IBvvABd.exe
  C:\Windows\System\IBvvABd.exe
  2⤵
  PID:12552
- C:\Windows\System\kucdROz.exe
  C:\Windows\System\kucdROz.exe
  2⤵
  PID:12568
- C:\Windows\System\QfRVNDK.exe
  C:\Windows\System\QfRVNDK.exe
  2⤵
  PID:12592
- C:\Windows\System\EstLadV.exe
  C:\Windows\System\EstLadV.exe
  2⤵
  PID:10460
- C:\Windows\System\DfNQYQf.exe
  C:\Windows\System\DfNQYQf.exe
  2⤵
  PID:10712
- C:\Windows\System\DjBKdwT.exe
  C:\Windows\System\DjBKdwT.exe
  2⤵
  PID:10784
- C:\Windows\System\eqqHtSz.exe
  C:\Windows\System\eqqHtSz.exe
  2⤵
  PID:10820
- C:\Windows\System\mgPeIEU.exe
  C:\Windows\System\mgPeIEU.exe
  2⤵
  PID:10864
- C:\Windows\System\oNVzJmA.exe
  C:\Windows\System\oNVzJmA.exe
  2⤵
  PID:10900
- C:\Windows\System\wVsRAfl.exe
  C:\Windows\System\wVsRAfl.exe
  2⤵
  PID:10948
- C:\Windows\System\DDMEhWd.exe
  C:\Windows\System\DDMEhWd.exe
  2⤵
  PID:10992
- C:\Windows\System\pHhGYOP.exe
  C:\Windows\System\pHhGYOP.exe
  2⤵
  PID:11052
- C:\Windows\System\HtQUsIG.exe
  C:\Windows\System\HtQUsIG.exe
  2⤵
  PID:11080
- C:\Windows\System\GaOycEY.exe
  C:\Windows\System\GaOycEY.exe
  2⤵
  PID:11116
- C:\Windows\System\FHZDSvN.exe
  C:\Windows\System\FHZDSvN.exe
  2⤵
  PID:11292
- C:\Windows\System\VaEpXTF.exe
  C:\Windows\System\VaEpXTF.exe
  2⤵
  PID:11340
- C:\Windows\System\tqGkCIa.exe
  C:\Windows\System\tqGkCIa.exe
  2⤵
  PID:11392
- C:\Windows\System\YzWyUxU.exe
  C:\Windows\System\YzWyUxU.exe
  2⤵
  PID:11424
- C:\Windows\System\flBSzbs.exe
  C:\Windows\System\flBSzbs.exe
  2⤵
  PID:11464
- C:\Windows\System\gonPqGo.exe
  C:\Windows\System\gonPqGo.exe
  2⤵
  PID:11520
- C:\Windows\System\hSwQylr.exe
  C:\Windows\System\hSwQylr.exe
  2⤵
  PID:11568
- C:\Windows\System\haqjdgT.exe
  C:\Windows\System\haqjdgT.exe
  2⤵
  PID:11620
- C:\Windows\System\nAcRtRy.exe
  C:\Windows\System\nAcRtRy.exe
  2⤵
  PID:11664
- C:\Windows\System\iBTWgTj.exe
  C:\Windows\System\iBTWgTj.exe
  2⤵
  PID:11700
- C:\Windows\System\hfSKDhm.exe
  C:\Windows\System\hfSKDhm.exe
  2⤵
  PID:11744
- C:\Windows\System\QgEDeZf.exe
  C:\Windows\System\QgEDeZf.exe
  2⤵
  PID:11804
- C:\Windows\System\RdYmRtT.exe
  C:\Windows\System\RdYmRtT.exe
  2⤵
  PID:11832
- C:\Windows\System\NKvqveR.exe
  C:\Windows\System\NKvqveR.exe
  2⤵
  PID:11876
- C:\Windows\System\UzwffVp.exe
  C:\Windows\System\UzwffVp.exe
  2⤵
  PID:11940
- C:\Windows\System\NVuucDX.exe
  C:\Windows\System\NVuucDX.exe
  2⤵
  PID:11976
- C:\Windows\System\rqKKQsa.exe
  C:\Windows\System\rqKKQsa.exe
  2⤵
  PID:12012
- C:\Windows\System\uFUcgkf.exe
  C:\Windows\System\uFUcgkf.exe
  2⤵
  PID:12036
- C:\Windows\System\FlZLVYY.exe
  C:\Windows\System\FlZLVYY.exe
  2⤵
  PID:12080
- C:\Windows\System\EMWdNog.exe
  C:\Windows\System\EMWdNog.exe
  2⤵
  PID:12120
- C:\Windows\System\NPFxSLQ.exe
  C:\Windows\System\NPFxSLQ.exe
  2⤵
  PID:12152
- C:\Windows\System\YzUrGPu.exe
  C:\Windows\System\YzUrGPu.exe
  2⤵
  PID:12216
- C:\Windows\System\bOMhXoW.exe
  C:\Windows\System\bOMhXoW.exe
  2⤵
  PID:12300
- C:\Windows\System\FuVIjRb.exe
  C:\Windows\System\FuVIjRb.exe
  2⤵
  PID:9108
- C:\Windows\System\xnFfkFm.exe
  C:\Windows\System\xnFfkFm.exe
  2⤵
  PID:3076
- C:\Windows\System\TmnPWEA.exe
  C:\Windows\System\TmnPWEA.exe
  2⤵
  PID:3768
- C:\Windows\System\haBNunD.exe
  C:\Windows\System\haBNunD.exe
  2⤵
  PID:8352
- C:\Windows\System\NTsUbGo.exe
  C:\Windows\System\NTsUbGo.exe
  2⤵
  PID:8496
- C:\Windows\System\JXcWhwH.exe
  C:\Windows\System\JXcWhwH.exe
  2⤵
  PID:12904
- C:\Windows\System\GkjmfsO.exe
  C:\Windows\System\GkjmfsO.exe
  2⤵
  PID:8720
- C:\Windows\System\SwrLxkC.exe
  C:\Windows\System\SwrLxkC.exe
  2⤵
  PID:8840
- C:\Windows\System\rNvTiiQ.exe
  C:\Windows\System\rNvTiiQ.exe
  2⤵
  PID:9156
- C:\Windows\System\wyjZbVW.exe
  C:\Windows\System\wyjZbVW.exe
  2⤵
  PID:7500
- C:\Windows\System\JiXAFRY.exe
  C:\Windows\System\JiXAFRY.exe
  2⤵
  PID:7796
- C:\Windows\System\HkWpeUc.exe
  C:\Windows\System\HkWpeUc.exe
  2⤵
  PID:6556
- C:\Windows\System\KFGhCwC.exe
  C:\Windows\System\KFGhCwC.exe
  2⤵
  PID:12876
- C:\Windows\System\rYaTjSO.exe
  C:\Windows\System\rYaTjSO.exe
  2⤵
  PID:13156
- C:\Windows\System\EOokoae.exe
  C:\Windows\System\EOokoae.exe
  2⤵
  PID:13188
- C:\Windows\System\zRATvVU.exe
  C:\Windows\System\zRATvVU.exe
  2⤵
  PID:12632
- C:\Windows\System\XlzATiQ.exe
  C:\Windows\System\XlzATiQ.exe
  2⤵
  PID:7296
- C:\Windows\System\kJZyMiu.exe
  C:\Windows\System\kJZyMiu.exe
  2⤵
  PID:8008
- C:\Windows\System\SzceAlb.exe
  C:\Windows\System\SzceAlb.exe
  2⤵
  PID:6152
- C:\Windows\System\GyrBEla.exe
  C:\Windows\System\GyrBEla.exe
  2⤵
  PID:7084
- C:\Windows\System\HluubUK.exe
  C:\Windows\System\HluubUK.exe
  2⤵
  PID:7068
- C:\Windows\System\KryTPzu.exe
  C:\Windows\System\KryTPzu.exe
  2⤵
  PID:12388
- C:\Windows\System\OHjZnEo.exe
  C:\Windows\System\OHjZnEo.exe
  2⤵
  PID:12416
- C:\Windows\System\hQKynDi.exe
  C:\Windows\System\hQKynDi.exe
  2⤵
  PID:12456
- C:\Windows\System\CfOkeXh.exe
  C:\Windows\System\CfOkeXh.exe
  2⤵
  PID:12484
- C:\Windows\System\moTanyw.exe
  C:\Windows\System\moTanyw.exe
  2⤵
  PID:12520
- C:\Windows\System\aZDtGPV.exe
  C:\Windows\System\aZDtGPV.exe
  2⤵
  PID:12548
- C:\Windows\System\zXVSChk.exe
  C:\Windows\System\zXVSChk.exe
  2⤵
  PID:12584
- C:\Windows\System\CAKNCnr.exe
  C:\Windows\System\CAKNCnr.exe
  2⤵
  PID:12620
- C:\Windows\System\znMiXaS.exe
  C:\Windows\System\znMiXaS.exe
  2⤵
  PID:12644
- C:\Windows\System\oSYbNsM.exe
  C:\Windows\System\oSYbNsM.exe
  2⤵
  PID:12672
- C:\Windows\System\ytbKboF.exe
  C:\Windows\System\ytbKboF.exe
  2⤵
  PID:12692
- C:\Windows\System\ivzBIMW.exe
  C:\Windows\System\ivzBIMW.exe
  2⤵
  PID:4736
- C:\Windows\System\sPPkcKm.exe
  C:\Windows\System\sPPkcKm.exe
  2⤵
  PID:4480
- C:\Windows\System\IjRYdmg.exe
  C:\Windows\System\IjRYdmg.exe
  2⤵
  PID:9432
- C:\Windows\System\IpZcyEN.exe
  C:\Windows\System\IpZcyEN.exe
  2⤵
  PID:12616
- C:\Windows\System\PzVWoyV.exe
  C:\Windows\System\PzVWoyV.exe
  2⤵
  PID:13288
- C:\Windows\System\jesRYSg.exe
  C:\Windows\System\jesRYSg.exe
  2⤵
  PID:8648
- C:\Windows\System\LAOUoYp.exe
  C:\Windows\System\LAOUoYp.exe
  2⤵
  PID:10680
- C:\Windows\System\OpUKihK.exe
  C:\Windows\System\OpUKihK.exe
  2⤵
  PID:1220
- C:\Windows\System\zkjyQEm.exe
  C:\Windows\System\zkjyQEm.exe
  2⤵
  PID:10940
- C:\Windows\System\ZIvxTCH.exe
  C:\Windows\System\ZIvxTCH.exe
  2⤵
  PID:11016
- C:\Windows\System\bFStVKz.exe
  C:\Windows\System\bFStVKz.exe
  2⤵
  PID:9484
- C:\Windows\System\XrThkNA.exe
  C:\Windows\System\XrThkNA.exe
  2⤵
  PID:9544
- C:\Windows\System\GRWyQVP.exe
  C:\Windows\System\GRWyQVP.exe
  2⤵
  PID:13328
- C:\Windows\System\bPCNgyE.exe
  C:\Windows\System\bPCNgyE.exe
  2⤵
  PID:13348
- C:\Windows\System\kMLvuOP.exe
  C:\Windows\System\kMLvuOP.exe
  2⤵
  PID:13368
- C:\Windows\System\XDOPahE.exe
  C:\Windows\System\XDOPahE.exe
  2⤵
  PID:13392
- C:\Windows\System\LIBvsTq.exe
  C:\Windows\System\LIBvsTq.exe
  2⤵
  PID:13412
- C:\Windows\System\cGclJeP.exe
  C:\Windows\System\cGclJeP.exe
  2⤵
  PID:13428
- C:\Windows\System\DmHflpC.exe
  C:\Windows\System\DmHflpC.exe
  2⤵
  PID:13448
- C:\Windows\System\CnkfrOy.exe
  C:\Windows\System\CnkfrOy.exe
  2⤵
  PID:13784
- C:\Windows\System\HmRXvSM.exe
  C:\Windows\System\HmRXvSM.exe
  2⤵
  PID:13924
- C:\Windows\System\TQtMCXw.exe
  C:\Windows\System\TQtMCXw.exe
  2⤵
  PID:13948
- C:\Windows\System\YIYuxpw.exe
  C:\Windows\System\YIYuxpw.exe
  2⤵
  PID:8020
- C:\Windows\System\whRBWwP.exe
  C:\Windows\System\whRBWwP.exe
  2⤵
  PID:4512
- C:\Windows\System\JaZFujJ.exe
  C:\Windows\System\JaZFujJ.exe
  2⤵
  PID:1456
- C:\Windows\System\MOFPjFB.exe
  C:\Windows\System\MOFPjFB.exe
  2⤵
  PID:8584
- C:\Windows\System\DxxVjdW.exe
  C:\Windows\System\DxxVjdW.exe
  2⤵
  PID:10608
- C:\Windows\System\KwccFJq.exe
  C:\Windows\System\KwccFJq.exe
  2⤵
  PID:8820
- C:\Windows\System\dCKwKlv.exe
  C:\Windows\System\dCKwKlv.exe
  2⤵
  PID:13356
- C:\Windows\System\gxcBEDd.exe
  C:\Windows\System\gxcBEDd.exe
  2⤵
  PID:13656
- C:\Windows\System\hbOVSJb.exe
  C:\Windows\System\hbOVSJb.exe
  2⤵
  PID:13320
- C:\Windows\System\FBvjhxq.exe
  C:\Windows\System\FBvjhxq.exe
  2⤵
  PID:13420
- C:\Windows\System\uDdBLpQ.exe
  C:\Windows\System\uDdBLpQ.exe
  2⤵
  PID:13468
- C:\Windows\System\vphRmDP.exe
  C:\Windows\System\vphRmDP.exe
  2⤵
  PID:13508
- C:\Windows\System\wXIMVuh.exe
  C:\Windows\System\wXIMVuh.exe
  2⤵
  PID:13540
- C:\Windows\System\lhJjBbO.exe
  C:\Windows\System\lhJjBbO.exe
  2⤵
  PID:11196
- C:\Windows\System\kOkWaRU.exe
  C:\Windows\System\kOkWaRU.exe
  2⤵
  PID:14064
- C:\Windows\System\aiLpCDi.exe
  C:\Windows\System\aiLpCDi.exe
  2⤵
  PID:14108
- C:\Windows\System\cvZkfgF.exe
  C:\Windows\System\cvZkfgF.exe
  2⤵
  PID:1464
- C:\Windows\System\tfBvYdw.exe
  C:\Windows\System\tfBvYdw.exe
  2⤵
  PID:7392
- C:\Windows\System\YqjKyUN.exe
  C:\Windows\System\YqjKyUN.exe
  2⤵
  PID:8548
- C:\Windows\System\rBtUkEq.exe
  C:\Windows\System\rBtUkEq.exe
  2⤵
  PID:12612
- C:\Windows\System\XOOGlkX.exe
  C:\Windows\System\XOOGlkX.exe
  2⤵
  PID:2956
- C:\Windows\System\FeXynQu.exe
  C:\Windows\System\FeXynQu.exe
  2⤵
  PID:13748
- C:\Windows\System\DsSvjkF.exe
  C:\Windows\System\DsSvjkF.exe
  2⤵
  PID:13804
- C:\Windows\System\IJLhfYQ.exe
  C:\Windows\System\IJLhfYQ.exe
  2⤵
  PID:6480
- C:\Windows\System\vzmLmtQ.exe
  C:\Windows\System\vzmLmtQ.exe
  2⤵
  PID:12136
- C:\Windows\System\PLvQnnp.exe
  C:\Windows\System\PLvQnnp.exe
  2⤵
  PID:10528
- C:\Windows\System\UNchrsm.exe
  C:\Windows\System\UNchrsm.exe
  2⤵
  PID:14260
- C:\Windows\System\TJzFFit.exe
  C:\Windows\System\TJzFFit.exe
  2⤵
  PID:6516
- C:\Windows\System\JFeQyMU.exe
  C:\Windows\System\JFeQyMU.exe
  2⤵
  PID:14052
- C:\Windows\System\qZTCass.exe
  C:\Windows\System\qZTCass.exe
  2⤵
  PID:13644
- C:\Windows\System\QGfFjoJ.exe
  C:\Windows\System\QGfFjoJ.exe
  2⤵
  PID:9872
- C:\Windows\System\RpZlmQc.exe
  C:\Windows\System\RpZlmQc.exe
  2⤵
  PID:4756
- C:\Windows\System\vLZzJRb.exe
  C:\Windows\System\vLZzJRb.exe
  2⤵
  PID:1044
- C:\Windows\System\GUoNOqR.exe
  C:\Windows\System\GUoNOqR.exe
  2⤵
  PID:10412
- C:\Windows\System\LQHiKZZ.exe
  C:\Windows\System\LQHiKZZ.exe
  2⤵
  PID:14164
- C:\Windows\System\ZrLqSle.exe
  C:\Windows\System\ZrLqSle.exe
  2⤵
  PID:13208
- C:\Windows\System\tadpBNs.exe
  C:\Windows\System\tadpBNs.exe
  2⤵
  PID:8356
- C:\Windows\System\YkJxxgt.exe
  C:\Windows\System\YkJxxgt.exe
  2⤵
  PID:6904
- C:\Windows\System\IPPgnCU.exe
  C:\Windows\System\IPPgnCU.exe
  2⤵
  PID:10564
- C:\Windows\System\UDZJfMd.exe
  C:\Windows\System\UDZJfMd.exe
  2⤵
  PID:12608
- C:\Windows\System\AcyWiZN.exe
  C:\Windows\System\AcyWiZN.exe
  2⤵
  PID:12256
- C:\Windows\System\wqXMLwX.exe
  C:\Windows\System\wqXMLwX.exe
  2⤵
  PID:12348
- C:\Windows\System\AXxRWhe.exe
  C:\Windows\System\AXxRWhe.exe
  2⤵
  PID:7652
- C:\Windows\System\ZfZicBF.exe
  C:\Windows\System\ZfZicBF.exe
  2⤵
  PID:12604
- C:\Windows\System\XhRPdKZ.exe
  C:\Windows\System\XhRPdKZ.exe
  2⤵
  PID:12280
- C:\Windows\System\niZBMuO.exe
  C:\Windows\System\niZBMuO.exe
  2⤵
  PID:13456
- C:\Windows\System\lkBobiZ.exe
  C:\Windows\System\lkBobiZ.exe
  2⤵
  PID:13956
- C:\Windows\System\eWPLAOe.exe
  C:\Windows\System\eWPLAOe.exe
  2⤵
  PID:14168
- C:\Windows\System\mpBEqkt.exe
  C:\Windows\System\mpBEqkt.exe
  2⤵
  PID:1864
- C:\Windows\System\ugthiOd.exe
  C:\Windows\System\ugthiOd.exe
  2⤵
  PID:12192
- C:\Windows\System\KXsaqKT.exe
  C:\Windows\System\KXsaqKT.exe
  2⤵
  PID:12732
- C:\Windows\System\uwuLNSG.exe
  C:\Windows\System\uwuLNSG.exe
  2⤵
  PID:5224
- C:\Windows\System\SPEQUdl.exe
  C:\Windows\System\SPEQUdl.exe
  2⤵
  PID:9780
- C:\Windows\System\orAWZOW.exe
  C:\Windows\System\orAWZOW.exe
  2⤵
  PID:3872
- C:\Windows\System\SqJONmp.exe
  C:\Windows\System\SqJONmp.exe
  2⤵
  PID:12660
- C:\Windows\System\jgdJCOF.exe
  C:\Windows\System\jgdJCOF.exe
  2⤵
  PID:14012
- C:\Windows\System\teRfPLv.exe
  C:\Windows\System\teRfPLv.exe
  2⤵
  PID:4032
- C:\Windows\System\SauxFQr.exe
  C:\Windows\System\SauxFQr.exe
  2⤵
  PID:4464
- C:\Windows\System\NpkpsXx.exe
  C:\Windows\System\NpkpsXx.exe
  2⤵
  PID:13384
- C:\Windows\System\fHhmHeo.exe
  C:\Windows\System\fHhmHeo.exe
  2⤵
  PID:13488
- C:\Windows\System\IeWXEdr.exe
  C:\Windows\System\IeWXEdr.exe
  2⤵
  PID:14100
- C:\Windows\System\DSxbRcE.exe
  C:\Windows\System\DSxbRcE.exe
  2⤵
  PID:624
- C:\Windows\System\xJntDQW.exe
  C:\Windows\System\xJntDQW.exe
  2⤵
  PID:1552
- C:\Windows\System\aIJCUti.exe
  C:\Windows\System\aIJCUti.exe
  2⤵
  PID:9072
- C:\Windows\System\IFXlWXO.exe
  C:\Windows\System\IFXlWXO.exe
  2⤵
  PID:11720
- C:\Windows\System\NcPZhsV.exe
  C:\Windows\System\NcPZhsV.exe
  2⤵
  PID:12432
- C:\Windows\System\PajIVQW.exe
  C:\Windows\System\PajIVQW.exe
  2⤵
  PID:7776
- C:\Windows\System\ZnTfknL.exe
  C:\Windows\System\ZnTfknL.exe
  2⤵
  PID:3952
- C:\Windows\System\IPNTHRu.exe
  C:\Windows\System\IPNTHRu.exe
  2⤵
  PID:3680
- C:\Windows\System\LanUjkq.exe
  C:\Windows\System\LanUjkq.exe
  2⤵
  PID:10616
- C:\Windows\System\OeJjfbi.exe
  C:\Windows\System\OeJjfbi.exe
  2⤵
  PID:12096
- C:\Windows\System\qtRwgjv.exe
  C:\Windows\System\qtRwgjv.exe
  2⤵
  PID:10580
- C:\Windows\System\JFBRoqQ.exe
  C:\Windows\System\JFBRoqQ.exe
  2⤵
  PID:13584
- C:\Windows\System\sjBWDJx.exe
  C:\Windows\System\sjBWDJx.exe
  2⤵
  PID:13480
- C:\Windows\System\FGRdVwG.exe
  C:\Windows\System\FGRdVwG.exe
  2⤵
  PID:14200
- C:\Windows\System\FQPbJSX.exe
  C:\Windows\System\FQPbJSX.exe
  2⤵
  PID:7188
- C:\Windows\System\TUAAhdt.exe
  C:\Windows\System\TUAAhdt.exe
  2⤵
  PID:13460
- C:\Windows\System\fmrocPa.exe
  C:\Windows\System\fmrocPa.exe
  2⤵
  PID:1624
- C:\Windows\System\lwiHapb.exe
  C:\Windows\System\lwiHapb.exe
  2⤵
  PID:14144
- C:\Windows\System\QtzKFOM.exe
  C:\Windows\System\QtzKFOM.exe
  2⤵
  PID:12500
- C:\Windows\System\vGKmUya.exe
  C:\Windows\System\vGKmUya.exe
  2⤵
  PID:3108
- C:\Windows\System\rauJTyq.exe
  C:\Windows\System\rauJTyq.exe
  2⤵
  PID:3640
- C:\Windows\System\sNXbGNq.exe
  C:\Windows\System\sNXbGNq.exe
  2⤵
  PID:5076
- C:\Windows\System\deMRApY.exe
  C:\Windows\System\deMRApY.exe
  2⤵
  PID:9736
- C:\Windows\System\onKwQks.exe
  C:\Windows\System\onKwQks.exe
  2⤵
  PID:13272
- C:\Windows\System\fAbytNa.exe
  C:\Windows\System\fAbytNa.exe
  2⤵
  PID:9684
- C:\Windows\System\gCLMDmV.exe
  C:\Windows\System\gCLMDmV.exe
  2⤵
  PID:11536
- C:\Windows\System\eXZXlJi.exe
  C:\Windows\System\eXZXlJi.exe
  2⤵
  PID:8876
- C:\Windows\System\OJunurR.exe
  C:\Windows\System\OJunurR.exe
  2⤵
  PID:3080
- C:\Windows\System\suMkpeC.exe
  C:\Windows\System\suMkpeC.exe
  2⤵
  PID:13660
- C:\Windows\System\KkWuwFL.exe
  C:\Windows\System\KkWuwFL.exe
  2⤵
  PID:2764
- C:\Windows\System\lOieDol.exe
  C:\Windows\System\lOieDol.exe
  2⤵
  PID:13564
- C:\Windows\System\zHDCGgw.exe
  C:\Windows\System\zHDCGgw.exe
  2⤵
  PID:2232
- C:\Windows\System\OdVNBGR.exe
  C:\Windows\System\OdVNBGR.exe
  2⤵
  PID:9512
- C:\Windows\System\DywFKED.exe
  C:\Windows\System\DywFKED.exe
  2⤵
  PID:3344
- C:\Windows\System\QCLsOJH.exe
  C:\Windows\System\QCLsOJH.exe
  2⤵
  PID:3908
- C:\Windows\System\QZPlAJy.exe
  C:\Windows\System\QZPlAJy.exe
  2⤵
  PID:13648
- C:\Windows\System\YNqhOyp.exe
  C:\Windows\System\YNqhOyp.exe
  2⤵
  PID:3696
- C:\Windows\System\yNOLiko.exe
  C:\Windows\System\yNOLiko.exe
  2⤵
  PID:13568
- C:\Windows\System\gWycbOv.exe
  C:\Windows\System\gWycbOv.exe
  2⤵
  PID:12564
- C:\Windows\System\ffcuRZo.exe
  C:\Windows\System\ffcuRZo.exe
  2⤵
  PID:12680
- C:\Windows\System\JfYKytG.exe
  C:\Windows\System\JfYKytG.exe
  2⤵
  PID:13504
- C:\Windows\System\QTcyVNt.exe
  C:\Windows\System\QTcyVNt.exe
  2⤵
  PID:1996
- C:\Windows\System\ANhnMrY.exe
  C:\Windows\System\ANhnMrY.exe
  2⤵
  PID:3712
- C:\Windows\System\uJwwwQC.exe
  C:\Windows\System\uJwwwQC.exe
  2⤵
  PID:4056
- C:\Windows\System\DTFCXVA.exe
  C:\Windows\System\DTFCXVA.exe
  2⤵
  PID:1124
- C:\Windows\System\JGbzQOh.exe
  C:\Windows\System\JGbzQOh.exe
  2⤵
  PID:3776
- C:\Windows\System\aRbYaoM.exe
  C:\Windows\System\aRbYaoM.exe
  2⤵
  PID:1580
- C:\Windows\System\AOReGiQ.exe
  C:\Windows\System\AOReGiQ.exe
  2⤵
  PID:13464
- C:\Windows\System\VQMcixG.exe
  C:\Windows\System\VQMcixG.exe
  2⤵
  PID:1684
- C:\Windows\System\GUMCKvl.exe
  C:\Windows\System\GUMCKvl.exe
  2⤵
  PID:1852
- C:\Windows\System\qgYZlMj.exe
  C:\Windows\System\qgYZlMj.exe
  2⤵
  PID:1700
- C:\Windows\System\YJlXEiZ.exe
  C:\Windows\System\YJlXEiZ.exe
  2⤵
  PID:5732
- C:\Windows\System\oPMTHBl.exe
  C:\Windows\System\oPMTHBl.exe
  2⤵
  PID:5416
- C:\Windows\System\xOpVcmZ.exe
  C:\Windows\System\xOpVcmZ.exe
  2⤵
  PID:12472
- C:\Windows\System\eFjUJBn.exe
  C:\Windows\System\eFjUJBn.exe
  2⤵
  PID:12412
- C:\Windows\System\opiwllL.exe
  C:\Windows\System\opiwllL.exe
  2⤵
  PID:13768
- C:\Windows\System\hazZzSW.exe
  C:\Windows\System\hazZzSW.exe
  2⤵
  PID:14056
- C:\Windows\System\QHnnMZW.exe
  C:\Windows\System\QHnnMZW.exe
  2⤵
  PID:616
- C:\Windows\System\zpyJFqH.exe
  C:\Windows\System\zpyJFqH.exe
  2⤵
  PID:3748
- C:\Windows\System\SVpERgL.exe
  C:\Windows\System\SVpERgL.exe
  2⤵
  PID:13404
- C:\Windows\System\bNnKkFr.exe
  C:\Windows\System\bNnKkFr.exe
  2⤵
  PID:1204
- C:\Windows\System\gtMpaxw.exe
  C:\Windows\System\gtMpaxw.exe
  2⤵
  PID:1288
- C:\Windows\System\poBaHGy.exe
  C:\Windows\System\poBaHGy.exe
  2⤵
  PID:3780
- C:\Windows\System\DDrLALN.exe
  C:\Windows\System\DDrLALN.exe
  2⤵
  PID:3608
- C:\Windows\System\QutWbQa.exe
  C:\Windows\System\QutWbQa.exe
  2⤵
  PID:864
- C:\Windows\System\dcmunEF.exe
  C:\Windows\System\dcmunEF.exe
  2⤵
  PID:13712
- C:\Windows\System\mlheNyH.exe
  C:\Windows\System\mlheNyH.exe
  2⤵
  PID:3820
- C:\Windows\System\TjEOjVE.exe
  C:\Windows\System\TjEOjVE.exe
  2⤵
  PID:7968
- C:\Windows\System\Erixwhn.exe
  C:\Windows\System\Erixwhn.exe
  2⤵
  PID:4156
- C:\Windows\System\olxhnNM.exe
  C:\Windows\System\olxhnNM.exe
  2⤵
  PID:1472
- C:\Windows\System\dGDuSxa.exe
  C:\Windows\System\dGDuSxa.exe
  2⤵
  PID:7172
- C:\Windows\System\zohDfKj.exe
  C:\Windows\System\zohDfKj.exe
  2⤵
  PID:12752
- C:\Windows\System\jGnHqRS.exe
  C:\Windows\System\jGnHqRS.exe
  2⤵
  PID:10064
- C:\Windows\System\XMILeQr.exe
  C:\Windows\System\XMILeQr.exe
  2⤵
  PID:3968
- C:\Windows\System\FAkcrvK.exe
  C:\Windows\System\FAkcrvK.exe
  2⤵
  PID:4108
- C:\Windows\System\uFzLWVt.exe
  C:\Windows\System\uFzLWVt.exe
  2⤵
  PID:2220
- C:\Windows\System\QuLsMWM.exe
  C:\Windows\System\QuLsMWM.exe
  2⤵
  PID:4168
- C:\Windows\System\wuqrcid.exe
  C:\Windows\System\wuqrcid.exe
  2⤵
  PID:4028
- C:\Windows\System\KVRooob.exe
  C:\Windows\System\KVRooob.exe
  2⤵
  PID:1376
- C:\Windows\System\XpIoLho.exe
  C:\Windows\System\XpIoLho.exe
  2⤵
  PID:3452
- C:\Windows\System\uCuxbxw.exe
  C:\Windows\System\uCuxbxw.exe
  2⤵
  PID:4160
- C:\Windows\System\eYrgYgq.exe
  C:\Windows\System\eYrgYgq.exe
  2⤵
  PID:3604
- C:\Windows\System\jPbyLCt.exe
  C:\Windows\System\jPbyLCt.exe
  2⤵
  PID:10188
- C:\Windows\System\PcsTBzx.exe
  C:\Windows\System\PcsTBzx.exe
  2⤵
  PID:3824
- C:\Windows\System\sqeqGuo.exe
  C:\Windows\System\sqeqGuo.exe
  2⤵
  PID:1392
- C:\Windows\System\VAwxNDa.exe
  C:\Windows\System\VAwxNDa.exe
  2⤵
  PID:13360
- C:\Windows\System\tftemyA.exe
  C:\Windows\System\tftemyA.exe
  2⤵
  PID:9312
- C:\Windows\System\JiVJpgs.exe
  C:\Windows\System\JiVJpgs.exe
  2⤵
  PID:4764
- C:\Windows\System\IIvJjcz.exe
  C:\Windows\System\IIvJjcz.exe
  2⤵
  PID:3576
- C:\Windows\System\xvfabRQ.exe
  C:\Windows\System\xvfabRQ.exe
  2⤵
  PID:1168
- C:\Windows\System\GZyJlVK.exe
  C:\Windows\System\GZyJlVK.exe
  2⤵
  PID:428
- C:\Windows\System\ebSLQoZ.exe
  C:\Windows\System\ebSLQoZ.exe
  2⤵
  PID:4208
- C:\Windows\System\gVnEHJB.exe
  C:\Windows\System\gVnEHJB.exe
  2⤵
  PID:13548
- C:\Windows\System\IrMSGch.exe
  C:\Windows\System\IrMSGch.exe
  2⤵
  PID:996
- C:\Windows\System\vgEcgqt.exe
  C:\Windows\System\vgEcgqt.exe
  2⤵
  PID:13776
- C:\Windows\System\KNAeBjH.exe
  C:\Windows\System\KNAeBjH.exe
  2⤵
  PID:9288
- C:\Windows\System\oQLWVCf.exe
  C:\Windows\System\oQLWVCf.exe
  2⤵
  PID:3532
- C:\Windows\System\deXyqUz.exe
  C:\Windows\System\deXyqUz.exe
  2⤵
  PID:3084
- C:\Windows\System\KsxtGDG.exe
  C:\Windows\System\KsxtGDG.exe
  2⤵
  PID:3248
- C:\Windows\System\qyVBhxY.exe
  C:\Windows\System\qyVBhxY.exe
  2⤵
  PID:9948
- C:\Windows\System\ereBBOP.exe
  C:\Windows\System\ereBBOP.exe
  2⤵
  PID:9356
- C:\Windows\System\oJxvgVu.exe
  C:\Windows\System\oJxvgVu.exe
  2⤵
  PID:3580
- C:\Windows\System\taGJFIs.exe
  C:\Windows\System\taGJFIs.exe
  2⤵
  PID:3764
- C:\Windows\System\qpdUqdh.exe
  C:\Windows\System\qpdUqdh.exe
  2⤵
  PID:3004
- C:\Windows\System\AsRHyDa.exe
  C:\Windows\System\AsRHyDa.exe
  2⤵
  PID:2684
- C:\Windows\System\sTehKPL.exe
  C:\Windows\System\sTehKPL.exe
  2⤵
  PID:4140
- C:\Windows\System\cgDIEpB.exe
  C:\Windows\System\cgDIEpB.exe
  2⤵
  PID:4556

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 576 -p 12152 -ip 12152
1⤵
PID:8356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 568 -p 12904 -ip 12904
1⤵
PID:3680

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 11804 -ip 11804
1⤵
PID:12136

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 476 -p 10492 -ip 10492
1⤵
PID:14168

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 704 -p 10344 -ip 10344
1⤵
PID:12732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:384

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:13504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:12036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:8260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xe3scf4y.rio.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BWQgqXI.exe

Filesize
1.3MB

MD5
df0c5fdc69be70025b8277fbfac21887

SHA1
415db7d3f5742f9bbaa0226821e89cd0639fd2e0

SHA256
9b13d83433c452edcc07222adb28685ebf8505acf8aa01d6980ff0189754e6f8

SHA512
fb5f03fb928aefdbccf548efb1505aae44beb9b145f81b8b0ee15ad5cc83ea97eb0ece746afab447916631db247003da6fd3a60bba9334f065b2f8890bacd5ff

Download Submit
C:\Windows\System\EsSeajL.exe

Filesize
1.3MB

MD5
6632344e301cf2c7eb555184e467ee6c

SHA1
5eba00135a73c686ed87c707e9ca3e6e2333d5f2

SHA256
3b535afea01222f58862d451fe56f14e3a6d385b7bd1607edf11684ee2e68497

SHA512
4854fec1614acc56ff88a3eeb2e3648634f0587ac02e7cecc847efbc30d224017e1df4816774ddc5af22f432df100fbf6b32bb4df1332a235436dfea3a44d9ef

Download Submit
C:\Windows\System\EtgoTMZ.exe

Filesize
1.3MB

MD5
2dacc203516fc04ebcfe5b47f2d314e1

SHA1
0ae7e1b18c26b0a1fde0832e3cc6f7f02107dc6a

SHA256
2b29dd97a337b8cf51aba80269fd71a7c02971e8982b6458e30a4ac9904adba5

SHA512
77f4b45a3144751cfa16dcd6bfecc5e16af38dc6201bfe37debeed5d90c5d220d628fb72a42bc44f5c5c85560a78b391751fde5302439d566d70959fe4d9503c

Download Submit
C:\Windows\System\FmoXFxh.exe

Filesize
1.3MB

MD5
ddb18fec70c54fc6cd9a5ded51923461

SHA1
d2c4d2e5e3e7544cb60d15df6f96d3b8ed63cbf5

SHA256
768546c1c6561f5354706a60f8efd1c5c8d02d38d78ae0ecee1640caf40df0b9

SHA512
d9e50d1432cb091c318c4f3890283baec608899833b2d0a3a73cb40c6a0d73d9d22659e1551bcb6f2dd3c63ac11d5fa6c754f39af1a6924d444f37ed6057ab89

Download Submit
C:\Windows\System\Gdutchz.exe

Filesize
1.3MB

MD5
d821734b6d9810deacb2a738c18b1303

SHA1
12384c79d3b62681a33d7f36df363a665f9db927

SHA256
6573773cef157b086d624a7077acd23943639f4f774c0a295aac5b5c3d3a7fd3

SHA512
4bb615f73436283d63094eee8c00ba47d87dbf536bc1837e176673d64642356d8136f3a111cabb4bf2c83dd32c1acc965899021534633c32ddf72bd3ce9cfed1

Download Submit
C:\Windows\System\HntFXSS.exe

Filesize
1.3MB

MD5
6930e1c4bb21b391aefb571453180d06

SHA1
16d2145c2c2a90394566538d1bdc40310e067ef4

SHA256
1299de0d201e6410aea5ade22f64ff198021364f580c1f83b5cd6d4a977db7ee

SHA512
a2cbb146b84246d43427828014256b004d6cb488b7b1f906e61fa139d92ae86c44d2b37a6b3926459235765ef11c3dccfc5adcedf1490dee3c3080c2c452dcc5

Download Submit
C:\Windows\System\IHeGlyn.exe

Filesize
1.3MB

MD5
6ad00c8135e49407f4c14c2d65224c98

SHA1
a0457d135efb3fdd8d0f88608361447f41cad514

SHA256
e5bb50128c23af85ebc3dfbe63016af63bf167c6e2540f4be500f8475c4ca551

SHA512
a460b510208f688aa235e44e0a640561d8e2d02dfa52c13b075921fa413d7167d8414b333f44f1e44c0daa25419b5dbe0aeabc7cbedc3203c11912bb821f5f4e

Download Submit
C:\Windows\System\IpnyCqQ.exe

Filesize
1.3MB

MD5
b416424cf6874f458536905cabb93b9b

SHA1
f01fbbeb0fa270cfb4a70ecc9ce7595f0ca92285

SHA256
6a7f3de62f0a818b1d599aa01195b50439b43f83700134d96e261f48a6ed6f6a

SHA512
9bdf2c86dcadaacc61974ec86b6aa94a5acdc24f5ab6ae31e325f09ffb114e92a261aacab8fc7071a1b8d1606677796ee2c424f62f85bfa9353c71ca9bb3f6a1

Download Submit
C:\Windows\System\IqLmZoo.exe

Filesize
1.3MB

MD5
0c9afd8702579dd61594bf2cfd45518c

SHA1
65773cf6c7b10b06b569f0cb8a85c0e3e62c5817

SHA256
d5500f7a980991340fc526bd4996ab3ccc331483385ed2b1f8b28b8b94efb618

SHA512
daefc1abad188b04e6801738e45d7487d72588cabb6ad9d69d526184a991c03183d6da37277e111f205fe18d5e70edd512774a96bc7aa3736ace87c524b22df8

Download Submit
C:\Windows\System\ItccABg.exe

Filesize
1.3MB

MD5
685a2f67cb00631f325340192ca98247

SHA1
39464b839c1e84e6ce9ff96709f558d3c5aa38b9

SHA256
f5b399fd491f5c9afd452c545bdaaeb35124b5c450d313a2d9d77635820b0a07

SHA512
5d1702eba1ebaa11537d4670af789883980a45d60f5d76b14a3a0e6bcec2e98861b77c6e292797c97e3e4feb56aa1b1768a2d34fbd0cdc1502d69cedc77b330d

Download Submit
C:\Windows\System\LmzGhtg.exe

Filesize
1.3MB

MD5
f822b6e1b21c516b9bfe26aeb31cc488

SHA1
c26e85dc6ac43d17e13e44f079b4bd95835bcc30

SHA256
f4680d14f02ee4b7fc4935a9917c8a8436bfe168a28c1c33e6153bfa77d8b2c1

SHA512
98bcbae1c7c5c544a650304bed4ae028c6ef0ad1f7ee326bf12d99b422a55e0c7c438ed17382da42a8ed9efdfe925f9cda8bbbe0dd82c1b981deb680c241881c

Download Submit
C:\Windows\System\LpnUbmD.exe

Filesize
1.3MB

MD5
79fffc460a9d87ffbd3fafc4d67baddb

SHA1
ea1544a501408e0ba688f569e89c9dedda16a3d0

SHA256
9eeaca6da98fdb7944b0f2a08b647da40316319d69cc7399fc0f794d1616bb7b

SHA512
0b4b550bb26d7cadda2ffd7c85893d6b307512b2fae6375f0014f6ba251e16d548f15dd5bfe126955de4b0446648f1bf30879e0708d2267acba6d48f21e9eff9

Download Submit
C:\Windows\System\MROGCIC.exe

Filesize
1.3MB

MD5
60ec03b409fde1a9cc33b8372d9b9880

SHA1
038e6b025e5f63137bcd3605615a526818ab7e4f

SHA256
61f6e65bf62195967d28286e41aedc2b2da2c1a25d03e01290b2f435d47e8008

SHA512
f2dc77f4793ee6b1217b83cbcaa85d6b08c00406a131afa7afbbfbf0a92b726ddd08a2a3b4490839699083d12ab2d147ffdff87248ff142b0201a1144e921c0d

Download Submit
C:\Windows\System\MmYEDGD.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\System\Puiunxj.exe

Filesize
1.3MB

MD5
70c199ad3a533af4757fad8ff6631d65

SHA1
c993503780e7b86ee5064a639a2a0d7c5a837eb5

SHA256
b8bd0441c053fc03275753433acb292d5ff455fd715dc386a3f81f6783fa7df1

SHA512
2894ab80cae5bd456018b0b6f47ebb5bd1d52ff616d08f1145d2efc4780ed716007bae3536c4dbb65b7fb5ce1d585ad688d9dbff00d376c489cc1d8733c8f122

Download Submit
C:\Windows\System\PxbXuAD.exe

Filesize
1.3MB

MD5
f48646e494b2e599b4edd407f814ae06

SHA1
e4ec850136dfc219be0d4a62e934593da580ecab

SHA256
1d5f10e449df3a36022e5e33d0d2fdf2a184b3fd99989c3f403ceac3794e0ed2

SHA512
baf46b6091509ae90d7d3148e8c1667c9436e9e3966df531cf171e56761c7e7ab53a48dbdbca99f4f8c4d4b4b70d1a8c2b9019b5974f5c78a33a5db65c3b79c0

Download Submit
C:\Windows\System\TuiKlCe.exe

Filesize
1.3MB

MD5
c364004326eb3e5a649dd110b157b077

SHA1
88a3f3f94d40f0e56769a0aaabd099bdd29c4d92

SHA256
0df6c48e4a25823c11fee75b9facc85ee147d51358ddf201c9b299a37aa6f514

SHA512
8a2e7bfcf816db6430fbff6a791a09465ef7133d9eae62f49c0b628e541a040f67f4e20829cd15fbe273745c8c240c9069a5a1e12dfa414327592b741e226eff

Download Submit
C:\Windows\System\Ubfpunm.exe

Filesize
1.3MB

MD5
71d3ee513f3f33ce3690264f5f16fb5c

SHA1
cce7680d110a4d1848a20d3dc658398fcdc2c515

SHA256
10090431ace34d39c41a28b20c8ab02c631d856399b2c690dc89949a2ece7123

SHA512
202aded0569394d52defb275541d514e577746cc746c3d1e21d6cc7152af62921d44a87e5339d10d710c25544d67a589a5e5f22ac5cb5da012e962294482fb2d

Download Submit
C:\Windows\System\UokBuUA.exe

Filesize
1.3MB

MD5
aa47e68fa4011ab6fe4d02ede13f7218

SHA1
c7d192fad4208a64aae41a1ece054fa5e9b4ba95

SHA256
3f08700b8f3cc601d7d1240045a14224319319d672dfce000efe901d7db33aec

SHA512
b252eccef2368e6a06f25024c74901321526d32457ae136060e6689e377e125b92fc940ff2fa6dd5e8300bffbc169366cb46eb270c61945804c1244d5ef9aae2

Download Submit
C:\Windows\System\VFPEnJS.exe

Filesize
1.3MB

MD5
c7c02d001917a3f7fb8c56083378deb0

SHA1
3a099b4c70071cfff82016bbb4a1c647516c5034

SHA256
0047c1ba5c3306aa457741453f73f61fbde4dfcba96621ee709fcd3538cf72fd

SHA512
afff83886d39dd999fce63872543e7b30ab59d3a69710c65e06e81170abf51050b0ff9d0155b8a591a67e525b2c1db6869b1c30da44b693f2738920f50189170

Download Submit
C:\Windows\System\VMtxUgv.exe

Filesize
1.3MB

MD5
af30bb8e124a685b83b88df50ea7883a

SHA1
5599c1c0843f4a2819c9706d6abda2fbb9f49f53

SHA256
056fc2fd97c320833db941a6df764ec79e6c7bf3c9292376a0216b440996ce3a

SHA512
3b4a0da6de03f9b7fbd70a60b23b8f5022b5afa450c20892e019f38169a679d60f4035877ede421f69dd2ea0f92cbc22e992415a5671cd05cee2a9d078901ace

Download Submit
C:\Windows\System\WSmNFwL.exe

Filesize
1.3MB

MD5
7b414a8fdde9bcb3666fcff7e2a07523

SHA1
4de8df7f05436c53ed2204a4cdc0b5b8783eb95d

SHA256
486d2ebc02f848aec5c68326e18b5493f99f3ecdde82a92db4717be1519f49dd

SHA512
af7c18b30b23f1e8fd09fff413a1ecf86e6e36f61e745d0c0d6d3304b98cb573381abcc6cf8593431d74cf45dc58697fc1b62b1d5c0338e193d1d4cc2a7d0dcf

Download Submit
C:\Windows\System\ZJdcgNZ.exe

Filesize
1.3MB

MD5
c2b51c7b47db2aedce1c6aef15ae4a8c

SHA1
5b655cb0a2815a9cd94d9dc60020ab31312b3f1e

SHA256
69f8e87095dff18d60f4a735de1b4ef425700ed7d26ffbffd0273a3a40619e2a

SHA512
44eef8034d40eec343a17b71434c5deec8f5c7e6eb882b2b034992285fc8371bfb1ce90f38f3dea722a4069dbf25f52f08642d0ac3f1a4c329132eb72fcd77c4

Download Submit
C:\Windows\System\ZczsGQn.exe

Filesize
1.3MB

MD5
659a346a0b2085931554a2700d3cd7a7

SHA1
c9caf93e1dc592043320608ede0bf78af52346ae

SHA256
c2c2d2d89a123610843ce297fd5f822d44c8c46457a7aa1479f984d73c512299

SHA512
5bee2565063d6782dfda3f0faced47cef51d92add7f524144c8b1d8db48017a41dd8036d9872fcc114f28fd653c1ad11e8f28c077d97336b69aff612697f010a

Download Submit
C:\Windows\System\aIVmTcc.exe

Filesize
1.3MB

MD5
a275de5eaab21fb54f8ee9d6ded58aee

SHA1
0f797332dc1acf118d1fe3f3f0a99ff747cad67a

SHA256
ada5066031265c6639ce0c7d0076172279a118d590b2cbbedacd4b01be6867fb

SHA512
808363136de79b963d94c05e341d50fd8911b924a2493dafb4f42605cff225119b665afdba89d4879900a98774c516c6896f02099d5c00811eea3ec3346edfba

Download Submit
C:\Windows\System\bgYTpAo.exe

Filesize
1.3MB

MD5
145d666f4adaa6b5abde49389f398976

SHA1
25854d1991c4d30599a2843219f816170b7c16ef

SHA256
4511013e76e72752ba1e0edc24b4dd6aa2dbbfc83e1e6a5e8f4e3fd0663faed7

SHA512
078f2525451b97f255ab4b2bf79b9be497787033e2de4188646585b1c725b48b3ee8baf97169fecc143c7e94f1e0d9b11dcf580b052288268e64604b84eaa977

Download Submit
C:\Windows\System\btPvlPc.exe

Filesize
1.3MB

MD5
774d1f463b7512639f122d929f97a7e5

SHA1
4eb8fd2bc0f13ac694fa4fb5e1a7b2b873af0046

SHA256
a71b5572418b573742c0e32fa567251adc2145e40d5f94e03e761b6a4f726de2

SHA512
ebd31d7544505c8b93f85a7db97b229444595b9ca554de7b9e2de3a60d01b12c37c19b4e2386e8105207043a2b5956bcdc9a17892550406a9c57729c2557142c

Download Submit
C:\Windows\System\dPnRlYd.exe

Filesize
1.3MB

MD5
4ba05e01d327a20e71ba8f59922ec044

SHA1
5b6c0b7f5d0b7a38eeac6bb45e406cce0dd81aac

SHA256
76f4a9293706496529c25187bf5f5b28c2742bbfd10ea482d53f75734d7c0d3b

SHA512
46f91b641526ea879eb5d5fef03cb023ab9b8e409e9878b3897b928ecb5cc03b4f99ba07d7a70df220b4d4d34c256fc67686cdfcdd1e2cea6a25eec3b70ea017

Download Submit
C:\Windows\System\fazVflK.exe

Filesize
1.3MB

MD5
95a8be1f10e321896b5d56178765b4fe

SHA1
79e3e3be09ef0a50d36fc6a2088e0958a1eab6d6

SHA256
2080763bd4bf071f0242f64d8a41016f7ddf69c17a3a632bca928ef4f3a0f104

SHA512
779a28632d336b180e5848e5a3e8b072ea6a861f3be47e8cd150045d9b3733c18d524bea496bf95742cc890afafe24318a7ddcbd1a39205897b9953ab7e48620

Download Submit
C:\Windows\System\gCLNazp.exe

Filesize
1.3MB

MD5
31edfebcf48ac67e5856e56fe9c4f68b

SHA1
e4c06b147262a517a6b41e8fddad9136c71f7a5f

SHA256
e5a72bb24df75014a34a82479e32913dd71bb4fe16e062436d2fdae43fa9779d

SHA512
9104d5f03a8476a5a34e6921ec5c99eaf513c405385430332e0178464328034a5588ca0713e07b7c3bc47179747e1de6c7babefd8d95013baf599f4de46dfc9f

Download Submit
C:\Windows\System\iuixsKR.exe

Filesize
1.3MB

MD5
07535773b9516800805409d40fea989f

SHA1
4343912718568154e48bda79e3679039ca293202

SHA256
ea93f56c4a0e2d8be0c789639a734d05faee5fd8bd940a641920a000b03ee9ab

SHA512
19b74856e3fa84c4e11fccc307e675eedd65e6b8beb7debe381ec67080b89beb40bdaeb3f852b98a35b2d25f03955582139bd9533403947e95787b98c9dcf08c

Download Submit
C:\Windows\System\lgcFttZ.exe

Filesize
1.3MB

MD5
742ef2e8e7259d2d5c8293abeb6581c1

SHA1
5661b249417c3ec95f66e40e3dd88ef80f5edabb

SHA256
cfe716d73e8ed3e67a5dba705e051c244186effcd55e722c2025a3946dbd0fb5

SHA512
874db78bd59bf1002a8d6b1c950aaa5bba2862ab985bce5938075a32d58b21e32d307b2b9b36ba566c7e80b21523808dbd296c00b9a83a40a84476a441aee462

Download Submit
C:\Windows\System\mUbIPRp.exe

Filesize
576KB

MD5
c3d03a9d37f5edf2280ce6b2b3c5fbef

SHA1
f13d7156c1061252682d37ff0da0cac93c34953e

SHA256
87f048a961f73c31785d7e94921a9a359d719bf76105c9601eca055227d1c1db

SHA512
07bab652c526204ee9528b6d8bd65b22dc499a44c1267b60f71a7439366582f72e58adec4d23b764a0ff0478fd6ffd60597a561b86fe20b6db5ee2bd531950b5

Download Submit
C:\Windows\System\mUbIPRp.exe

Filesize
1.3MB

MD5
08b3d6d036fdc2555825abe9079bf03c

SHA1
2b8998e834aed3f6de15d76242eea66fd21752e6

SHA256
957e54d330aa3d910376d926b65bf520018b8ffae9e4c971fec488be40a19609

SHA512
2310587636e4aa8ff9429d05e37042ce3457c2097793f27ecaab35147396256ea9c8ebb086acd6c355427e01e3bccbab36ec75db7c33f775e7a6457aabb5c164

Download Submit
C:\Windows\System\oEPHmHa.exe

Filesize
1.3MB

MD5
64603eeb7e3657ae4f0575845af6289a

SHA1
d94a70fcde5e09e66c5703a4710b1a8cf8a81f2a

SHA256
81788a2a213fc2b770c184d9291d7ead3fc4ee7e86395cfd8faa3d93c587cbdb

SHA512
b526710721938e544ba4db0591e8eee2fcd5c25f06dd9a824df58b7463026fc78a5d7453f6d80d73df983f12fe457e79fcff4cc03f2178692c5e1000a4280404

Download Submit
C:\Windows\System\oXwGRCb.exe

Filesize
1.3MB

MD5
b387048b9ed19177c2bf8a6b64b797ff

SHA1
770d03d2bf9302b2a3d6567df7de9932b59651cb

SHA256
5d88f621a6b3ca606815e900995f1f26b4dc4bea5aa79a62c677c11216e4bebe

SHA512
9315d1c270fc861f3059cd9a8461fb98af7e575dcfd15dafaf99faf1a9c13c84e548adbc355fba3126bc2e6b137aecfe1f96b8db21ccae24572d3f1fda6a375e

Download Submit
C:\Windows\System\pGaTXSI.exe

Filesize
1.3MB

MD5
67888428d7ca7e7ed3516cacd9d09c36

SHA1
910c1fd029d30656136cac9c9c11610784b33ef9

SHA256
e7ce827cf38c0388ddae68c8a25459acb3e25f2f60da6ac91b5f3edbc5ca4e8d

SHA512
d75234b19b99aff6e286519e199f122351c4d09fbf38832ab768b824cd314afdb665b574fbde4779285e74f365d1238002716ff5916bc3fde9875aedb3075d8c

Download Submit
C:\Windows\System\rzigOiq.exe

Filesize
1.3MB

MD5
20ccd0a8b489d6fda590e1aeaa815649

SHA1
fd654be4b6687be18b3036d82af759a8587e1d11

SHA256
744bba4d950ee1beb886913ba012bc76bc242591e3243d56efc740430ba553e6

SHA512
a7a60f12734c5d54daf307d71ede00252e39c480299792ebcf7b0115d8b2d38fe77ea97b9493f03940fb6a463342e294c2041b91f02bc303f641a1244e96c8ef

Download Submit
C:\Windows\System\tgoTqgw.exe

Filesize
1.3MB

MD5
c0e5fe9feaa93cdd01855ea001b81ae4

SHA1
5e03995f11c24d10ffcff61a19db2d53ee7850d9

SHA256
80492d8179f977cc01e8c168b893a54e41e435b71fbcbb9a4fce869ebe0e7119

SHA512
701e1f6cf6c9febeb92da7e18b216234890cc1effea826f973483eb401a59f3bf14ea070ac1a50761936f2f6e650228e9d51b604a829ded1ab6a4415842af9b9

Download Submit
C:\Windows\System\uWuhVDb.exe

Filesize
1.3MB

MD5
492f308f944db469a948f1d7c44f6b23

SHA1
1d50dc43700e74df72c7b309289addea32ba7b3b

SHA256
0db765aaba5311c64edf8afcf398afaae269b7a2581954cac6a4dd1816b115fb

SHA512
c04e58fb56e51240a21b0b85de8da699c8c978b428eeca4b285e03f3b399a21086c3a46a675d5f4506419d1c7f2e81842c4d2dde50a03efd170c607859d1ef08

Download Submit
C:\Windows\System\ughOjua.exe

Filesize
1.3MB

MD5
e164e1e9c57c6218650150a5b367c1c6

SHA1
4a4a675013fe36e2128eacdd78bef875b6716004

SHA256
d8d5b009a94facb02e31ee0f96dee593a04c682bb3a51cc901fd655e9bc34374

SHA512
a20d2c2232a855588ceed5883c89bbcb2ed66bfea925c1e3f6f93d8718959648da20f1c284fb0ea1b51212512eeab56e6ca3321262a0ad35ab0a5884de0a23b0

Download Submit
C:\Windows\System\yiTaLGP.exe

Filesize
1.3MB

MD5
ac66da88d999964343e1c9bf384eae43

SHA1
09d0854c04acca628ed20e7d099f034d3b6fe41a

SHA256
a72ea03fd9f63e573b2cd35c749df19463cb10a9b21ff3d37ea1c3771db3784f

SHA512
686077bf51e977485930e620b1d7789ab3ba1489e400a0450f85b9a6126427e50fe70e9c431968119635f997c018c170616217f6ffafaeed8a0d0a5f94e2874f

Download Submit
C:\Windows\System\zDLZnJP.exe

Filesize
1.3MB

MD5
8c80b5914b3fc3c7140a43e8b27f9f7c

SHA1
2027c367ad781e2feb5c64fa80fb7798f6bf5c82

SHA256
cecddb43d083b87d6483864dcf5909b34558d197348e8762b5b7395df02eb422

SHA512
fc0e9ddbbd01ed98a0506b5dfbf062e815a7e0f5fc27c76a200e0bf55f15d4ad63683f13d01186ad2889c7685e1e286af0cea060e3d07be38783e7b0246ce510

Download Submit
memory/664-690-0x00007FF76EDE0000-0x00007FF76F1D2000-memory.dmp

Filesize
3.9MB

Download
memory/936-696-0x00007FF6043A0000-0x00007FF604792000-memory.dmp

Filesize
3.9MB

Download
memory/1136-0-0x00007FF768C60000-0x00007FF769052000-memory.dmp

Filesize
3.9MB

Download
memory/1136-1-0x000002B8A0DE0000-0x000002B8A0DF0000-memory.dmp

Filesize
64KB

Download
memory/1424-1582-0x00007FF6DFCC0000-0x00007FF6E00B2000-memory.dmp

Filesize
3.9MB

Download
memory/1460-695-0x00007FF7801D0000-0x00007FF7805C2000-memory.dmp

Filesize
3.9MB

Download
memory/1628-1094-0x00007FF6F0340000-0x00007FF6F0732000-memory.dmp

Filesize
3.9MB

Download
memory/1652-694-0x00007FF62E330000-0x00007FF62E722000-memory.dmp

Filesize
3.9MB

Download
memory/1716-687-0x00007FF6895E0000-0x00007FF6899D2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-1095-0x00007FF6AA8A0000-0x00007FF6AAC92000-memory.dmp

Filesize
3.9MB

Download
memory/1928-1151-0x00007FF606CF0000-0x00007FF6070E2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-692-0x00007FF7AB4F0000-0x00007FF7AB8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-582-0x00007FF7E91C0000-0x00007FF7E95B2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-1974-0x00007FF74F080000-0x00007FF74F472000-memory.dmp

Filesize
3.9MB

Download
memory/2304-977-0x00007FF680310000-0x00007FF680702000-memory.dmp

Filesize
3.9MB

Download
memory/2500-688-0x00007FF6469C0000-0x00007FF646DB2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-693-0x00007FF6AFA30000-0x00007FF6AFE22000-memory.dmp

Filesize
3.9MB

Download
memory/3104-195-0x00007FF7C3270000-0x00007FF7C3662000-memory.dmp

Filesize
3.9MB

Download
memory/3264-698-0x00007FF71C170000-0x00007FF71C562000-memory.dmp

Filesize
3.9MB

Download
memory/3292-396-0x00007FF657EB0000-0x00007FF6582A2000-memory.dmp

Filesize
3.9MB

Download
memory/3512-1975-0x00007FF6B8AC0000-0x00007FF6B8EB2000-memory.dmp

Filesize
3.9MB

Download
memory/3996-316-0x00007FF67FDD0000-0x00007FF6801C2000-memory.dmp

Filesize
3.9MB

Download
memory/4040-262-0x00007FF761D60000-0x00007FF762152000-memory.dmp

Filesize
3.9MB

Download
memory/4256-12-0x00007FF63F790000-0x00007FF63FB82000-memory.dmp

Filesize
3.9MB

Download
memory/4256-4051-0x00007FF63F790000-0x00007FF63FB82000-memory.dmp

Filesize
3.9MB

Download
memory/4292-308-0x00007FF68F050000-0x00007FF68F442000-memory.dmp

Filesize
3.9MB

Download
memory/4612-72-0x00007FFEDEF70000-0x00007FFEDFA31000-memory.dmp

Filesize
10.8MB

Download
memory/4612-689-0x0000024250C60000-0x0000024250C82000-memory.dmp

Filesize
136KB

Download
memory/4612-6-0x00007FFEDEF73000-0x00007FFEDEF75000-memory.dmp

Filesize
8KB

Download
memory/4772-691-0x00007FF675FD0000-0x00007FF6763C2000-memory.dmp

Filesize
3.9MB

Download