xmrig | 6c2ae41dda327bc0d74ecb957e8311bb08bf22c7cf8ef6dcaef4635d13fde358

Analysis

max time kernel
95s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5651bd94340cb1b9533d4936c5d5f10N.exe
Size

1.4MB
MD5

b5651bd94340cb1b9533d4936c5d5f10
SHA1

b794739a74ca609497a3b2736e8e00848e3b8ae3
SHA256

6c2ae41dda327bc0d74ecb957e8311bb08bf22c7cf8ef6dcaef4635d13fde358
SHA512

a930218b6fae38164e7ef9eb99dcff1071c9beaa67d80cec01728b57b1073f1e03b34884336b803bd3b0ca98c52cb2e38af5374f3b74a3aa7c2efd088c092722
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGR+caMZnQ7:Lz071uv4BPMkHC0IlnASEx/RkI4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/5116-523-0x00007FF7029F0000-0x00007FF702DE2000-memory.dmp	xmrig
behavioral2/memory/1420-529-0x00007FF6AA3C0000-0x00007FF6AA7B2000-memory.dmp	xmrig
behavioral2/memory/1256-534-0x00007FF725890000-0x00007FF725C82000-memory.dmp	xmrig
behavioral2/memory/2112-539-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp	xmrig
behavioral2/memory/3660-718-0x00007FF791420000-0x00007FF791812000-memory.dmp	xmrig
behavioral2/memory/408-2842-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp	xmrig
behavioral2/memory/732-658-0x00007FF773350000-0x00007FF773742000-memory.dmp	xmrig
behavioral2/memory/4764-538-0x00007FF68AE40000-0x00007FF68B232000-memory.dmp	xmrig
behavioral2/memory/4224-537-0x00007FF662410000-0x00007FF662802000-memory.dmp	xmrig
behavioral2/memory/700-536-0x00007FF7B5610000-0x00007FF7B5A02000-memory.dmp	xmrig
behavioral2/memory/3528-535-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp	xmrig
behavioral2/memory/3364-533-0x00007FF6079F0000-0x00007FF607DE2000-memory.dmp	xmrig
behavioral2/memory/3600-532-0x00007FF7CCE20000-0x00007FF7CD212000-memory.dmp	xmrig
behavioral2/memory/2880-531-0x00007FF79EE10000-0x00007FF79F202000-memory.dmp	xmrig
behavioral2/memory/2188-530-0x00007FF613E80000-0x00007FF614272000-memory.dmp	xmrig
behavioral2/memory/4356-528-0x00007FF6FFE80000-0x00007FF700272000-memory.dmp	xmrig
behavioral2/memory/3420-527-0x00007FF64A700000-0x00007FF64AAF2000-memory.dmp	xmrig
behavioral2/memory/3148-526-0x00007FF6C0750000-0x00007FF6C0B42000-memory.dmp	xmrig
behavioral2/memory/3704-525-0x00007FF7B3120000-0x00007FF7B3512000-memory.dmp	xmrig
behavioral2/memory/872-460-0x00007FF72B050000-0x00007FF72B442000-memory.dmp	xmrig
behavioral2/memory/1320-256-0x00007FF7D7CD0000-0x00007FF7D80C2000-memory.dmp	xmrig
behavioral2/memory/4812-234-0x00007FF70AA40000-0x00007FF70AE32000-memory.dmp	xmrig
behavioral2/memory/1744-128-0x00007FF7C5F90000-0x00007FF7C6382000-memory.dmp	xmrig
behavioral2/memory/1548-4358-0x00007FF6FE840000-0x00007FF6FEC32000-memory.dmp	xmrig
behavioral2/memory/2112-4360-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp	xmrig
behavioral2/memory/4812-4362-0x00007FF70AA40000-0x00007FF70AE32000-memory.dmp	xmrig
behavioral2/memory/732-4364-0x00007FF773350000-0x00007FF773742000-memory.dmp	xmrig
behavioral2/memory/1744-4366-0x00007FF7C5F90000-0x00007FF7C6382000-memory.dmp	xmrig
behavioral2/memory/872-4368-0x00007FF72B050000-0x00007FF72B442000-memory.dmp	xmrig
behavioral2/memory/4356-4370-0x00007FF6FFE80000-0x00007FF700272000-memory.dmp	xmrig
behavioral2/memory/3148-4374-0x00007FF6C0750000-0x00007FF6C0B42000-memory.dmp	xmrig
behavioral2/memory/3420-4373-0x00007FF64A700000-0x00007FF64AAF2000-memory.dmp	xmrig
behavioral2/memory/2188-4376-0x00007FF613E80000-0x00007FF614272000-memory.dmp	xmrig
behavioral2/memory/5116-4378-0x00007FF7029F0000-0x00007FF702DE2000-memory.dmp	xmrig
behavioral2/memory/2880-4382-0x00007FF79EE10000-0x00007FF79F202000-memory.dmp	xmrig
behavioral2/memory/1420-4384-0x00007FF6AA3C0000-0x00007FF6AA7B2000-memory.dmp	xmrig
behavioral2/memory/1256-4388-0x00007FF725890000-0x00007FF725C82000-memory.dmp	xmrig
behavioral2/memory/3528-4390-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp	xmrig
behavioral2/memory/700-4395-0x00007FF7B5610000-0x00007FF7B5A02000-memory.dmp	xmrig
behavioral2/memory/1320-4414-0x00007FF7D7CD0000-0x00007FF7D80C2000-memory.dmp	xmrig
behavioral2/memory/4224-4412-0x00007FF662410000-0x00007FF662802000-memory.dmp	xmrig
behavioral2/memory/3600-4386-0x00007FF7CCE20000-0x00007FF7CD212000-memory.dmp	xmrig
behavioral2/memory/3704-4381-0x00007FF7B3120000-0x00007FF7B3512000-memory.dmp	xmrig
behavioral2/memory/3364-4426-0x00007FF6079F0000-0x00007FF607DE2000-memory.dmp	xmrig
behavioral2/memory/3660-4431-0x00007FF791420000-0x00007FF791812000-memory.dmp	xmrig
behavioral2/memory/408-4425-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp	xmrig
behavioral2/memory/4764-4423-0x00007FF68AE40000-0x00007FF68B232000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
936	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1548	URltTMm.exe
2112	qntxzqY.exe
732	xLqCjcy.exe
1744	qtnFrzT.exe
408	RFlsqTa.exe
4812	ZVSdYBb.exe
1320	IKCtOjd.exe
872	grSaUgt.exe
5116	inlbLYj.exe
3704	ciskslg.exe
3148	lrvZHAH.exe
3420	KkTIMGq.exe
4356	ukqcdFf.exe
1420	IVnWPkf.exe
2188	cThdTZI.exe
2880	EWhcVGK.exe
3600	sWcDwgE.exe
3364	rALrDRW.exe
1256	UCQZsAw.exe
3528	lkEEAnR.exe
700	xArSeAm.exe
3660	rahwdgd.exe
4224	zYFCWfw.exe
4764	MYQIhRq.exe
1652	IJNnQTM.exe
232	JKsIHRe.exe
2832	zUroMZQ.exe
4488	MjrEZRN.exe
2348	KoTfvdD.exe
4352	uprpwca.exe
1488	YwLfKxr.exe
4648	kqwfjnl.exe
4776	gBTrkbz.exe
3440	uxAwpyR.exe
1604	SMTREvc.exe
4160	QsbtirH.exe
5048	snukpsv.exe
380	tjWBiCH.exe
5076	HMYwndk.exe
4060	NFAmUxQ.exe
3156	MCcpHKA.exe
2912	NelQwzw.exe
4212	kZJKbgT.exe
3180	wtErozh.exe
4628	MrqTPbe.exe
1784	USJZWYH.exe
2356	wLpkjrz.exe
4332	WnCrerS.exe
4820	ZpwQraz.exe
2580	qhwCMSg.exe
456	jWZjdhX.exe
1112	GMmaqlq.exe
3604	fSeLWnz.exe
804	OlcaNNx.exe
5092	JcRiSTe.exe
2328	lBRjYYo.exe
2304	vuuEueD.exe
4700	PYVjMGC.exe
2728	uZWECzw.exe
1448	SbnQQfw.exe
2732	qpSvrBf.exe
3788	TZnYcTJ.exe
4684	iYBwFiM.exe
3760	DKMOhoZ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1124-0-0x00007FF7ECCA0000-0x00007FF7ED092000-memory.dmp	upx
behavioral2/files/0x000700000002342b-43.dat	upx
behavioral2/files/0x000700000002342e-53.dat	upx
behavioral2/files/0x000700000002342f-79.dat	upx
behavioral2/files/0x000700000002343c-125.dat	upx
behavioral2/files/0x0007000000023444-184.dat	upx
behavioral2/memory/5116-523-0x00007FF7029F0000-0x00007FF702DE2000-memory.dmp	upx
behavioral2/memory/1420-529-0x00007FF6AA3C0000-0x00007FF6AA7B2000-memory.dmp	upx
behavioral2/memory/1256-534-0x00007FF725890000-0x00007FF725C82000-memory.dmp	upx
behavioral2/memory/2112-539-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp	upx
behavioral2/memory/3660-718-0x00007FF791420000-0x00007FF791812000-memory.dmp	upx
behavioral2/memory/408-2842-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp	upx
behavioral2/memory/732-658-0x00007FF773350000-0x00007FF773742000-memory.dmp	upx
behavioral2/memory/4764-538-0x00007FF68AE40000-0x00007FF68B232000-memory.dmp	upx
behavioral2/memory/4224-537-0x00007FF662410000-0x00007FF662802000-memory.dmp	upx
behavioral2/memory/700-536-0x00007FF7B5610000-0x00007FF7B5A02000-memory.dmp	upx
behavioral2/memory/3528-535-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp	upx
behavioral2/memory/3364-533-0x00007FF6079F0000-0x00007FF607DE2000-memory.dmp	upx
behavioral2/memory/3600-532-0x00007FF7CCE20000-0x00007FF7CD212000-memory.dmp	upx
behavioral2/memory/2880-531-0x00007FF79EE10000-0x00007FF79F202000-memory.dmp	upx
behavioral2/memory/2188-530-0x00007FF613E80000-0x00007FF614272000-memory.dmp	upx
behavioral2/memory/4356-528-0x00007FF6FFE80000-0x00007FF700272000-memory.dmp	upx
behavioral2/memory/3420-527-0x00007FF64A700000-0x00007FF64AAF2000-memory.dmp	upx
behavioral2/memory/3148-526-0x00007FF6C0750000-0x00007FF6C0B42000-memory.dmp	upx
behavioral2/memory/3704-525-0x00007FF7B3120000-0x00007FF7B3512000-memory.dmp	upx
behavioral2/memory/872-460-0x00007FF72B050000-0x00007FF72B442000-memory.dmp	upx
behavioral2/memory/1320-256-0x00007FF7D7CD0000-0x00007FF7D80C2000-memory.dmp	upx
behavioral2/memory/4812-234-0x00007FF70AA40000-0x00007FF70AE32000-memory.dmp	upx
behavioral2/files/0x000700000002344a-214.dat	upx
behavioral2/files/0x0007000000023449-211.dat	upx
behavioral2/files/0x0007000000023445-203.dat	upx
behavioral2/files/0x0007000000023446-206.dat	upx
behavioral2/memory/408-195-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp	upx
behavioral2/files/0x0007000000023443-181.dat	upx
behavioral2/files/0x0007000000023442-174.dat	upx
behavioral2/files/0x0007000000023439-169.dat	upx
behavioral2/files/0x0007000000023441-168.dat	upx
behavioral2/files/0x0007000000023440-162.dat	upx
behavioral2/files/0x000700000002343f-158.dat	upx
behavioral2/files/0x000700000002343d-151.dat	upx
behavioral2/files/0x0007000000023437-145.dat	upx
behavioral2/files/0x0007000000023436-141.dat	upx
behavioral2/files/0x0007000000023447-207.dat	upx
behavioral2/memory/1744-128-0x00007FF7C5F90000-0x00007FF7C6382000-memory.dmp	upx
behavioral2/files/0x000700000002343a-122.dat	upx
behavioral2/files/0x000700000002343b-123.dat	upx
behavioral2/files/0x0007000000023431-115.dat	upx
behavioral2/files/0x0007000000023438-114.dat	upx
behavioral2/files/0x000700000002343e-157.dat	upx
behavioral2/files/0x0007000000023435-139.dat	upx
behavioral2/files/0x0007000000023433-101.dat	upx
behavioral2/files/0x0007000000023432-95.dat	upx
behavioral2/files/0x000700000002342d-87.dat	upx
behavioral2/files/0x0007000000023430-83.dat	upx
behavioral2/files/0x000700000002342c-81.dat	upx
behavioral2/files/0x0007000000023434-104.dat	upx
behavioral2/files/0x0007000000023429-71.dat	upx
behavioral2/files/0x0007000000023427-62.dat	upx
behavioral2/files/0x000700000002342a-73.dat	upx
behavioral2/files/0x0007000000023425-40.dat	upx
behavioral2/files/0x0007000000023428-48.dat	upx
behavioral2/files/0x0007000000023426-42.dat	upx
behavioral2/files/0x0007000000023424-29.dat	upx
behavioral2/files/0x0008000000023420-23.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rWCyCCa.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\PHNMUUq.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\zZXbBQp.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\hJuONMZ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\SqSnwnC.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\iZMYKtC.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\MrHjgsF.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\GatKwsR.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\qWlDbkE.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\QVcaSHU.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\vxiExde.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\OnMfEXY.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\uJEAAmB.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\umpqCTA.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\TInsenQ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\cqOMTxR.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\KBoGHsY.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\ubtJmaH.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\REBARsJ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\HilUDjq.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\sypHptT.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\YnMMGVo.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\ThyHACo.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\pkKlmkt.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\biQIVMS.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\UUKIiZp.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\qpuBvdJ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\OSLVqDZ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\eDGqXUt.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\atbYorR.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\HDXOIpj.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\NxdHBYb.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\nNFAKwM.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\iJQeziC.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\SycuwKp.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\zmFRvDX.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\CFqWqWw.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\QMYrMwx.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\dhiXuZC.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\gRVEUep.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\AUwATkY.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\yATbcjO.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\xcnHryV.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\MjveXYv.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\DvTHqnw.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\MMyJFio.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\mbeAPYf.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\sMQwuHZ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\IAxnodn.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\rGYNCCO.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\wncGDnO.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\DcOGKxQ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\equkILV.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\JlNxmmo.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\CyJYXaA.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\nHPmeMl.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\nQUznRm.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\AkGfPHA.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\DgwTkVM.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\BfFxuCy.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\uobFCBK.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\iNBBKEJ.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\AcfmqMq.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe
File created	C:\Windows\System\oqNNdBn.exe	b5651bd94340cb1b9533d4936c5d5f10N.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
936	powershell.exe
936	powershell.exe
936	powershell.exe
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe
Token: SeDebugPrivilege	936	powershell.exe
Token: SeLockMemoryPrivilege	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 936	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	85
PID 1124 wrote to memory of 936	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	85
PID 1124 wrote to memory of 1548	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	86
PID 1124 wrote to memory of 1548	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	86
PID 1124 wrote to memory of 2112	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	87
PID 1124 wrote to memory of 2112	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	87
PID 1124 wrote to memory of 732	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	88
PID 1124 wrote to memory of 732	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	88
PID 1124 wrote to memory of 1744	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	89
PID 1124 wrote to memory of 1744	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	89
PID 1124 wrote to memory of 408	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	90
PID 1124 wrote to memory of 408	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	90
PID 1124 wrote to memory of 4812	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	91
PID 1124 wrote to memory of 4812	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	91
PID 1124 wrote to memory of 1320	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	92
PID 1124 wrote to memory of 1320	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	92
PID 1124 wrote to memory of 872	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	93
PID 1124 wrote to memory of 872	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	93
PID 1124 wrote to memory of 5116	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	94
PID 1124 wrote to memory of 5116	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	94
PID 1124 wrote to memory of 3704	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	95
PID 1124 wrote to memory of 3704	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	95
PID 1124 wrote to memory of 3148	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	96
PID 1124 wrote to memory of 3148	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	96
PID 1124 wrote to memory of 3420	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	97
PID 1124 wrote to memory of 3420	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	97
PID 1124 wrote to memory of 3364	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	98
PID 1124 wrote to memory of 3364	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	98
PID 1124 wrote to memory of 4356	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	99
PID 1124 wrote to memory of 4356	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	99
PID 1124 wrote to memory of 1420	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	100
PID 1124 wrote to memory of 1420	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	100
PID 1124 wrote to memory of 2188	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	101
PID 1124 wrote to memory of 2188	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	101
PID 1124 wrote to memory of 2880	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	102
PID 1124 wrote to memory of 2880	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	102
PID 1124 wrote to memory of 3600	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	103
PID 1124 wrote to memory of 3600	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	103
PID 1124 wrote to memory of 1256	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	104
PID 1124 wrote to memory of 1256	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	104
PID 1124 wrote to memory of 3528	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	105
PID 1124 wrote to memory of 3528	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	105
PID 1124 wrote to memory of 700	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	106
PID 1124 wrote to memory of 700	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	106
PID 1124 wrote to memory of 3660	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	107
PID 1124 wrote to memory of 3660	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	107
PID 1124 wrote to memory of 4224	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	108
PID 1124 wrote to memory of 4224	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	108
PID 1124 wrote to memory of 4764	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	109
PID 1124 wrote to memory of 4764	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	109
PID 1124 wrote to memory of 1652	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	110
PID 1124 wrote to memory of 1652	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	110
PID 1124 wrote to memory of 232	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	111
PID 1124 wrote to memory of 232	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	111
PID 1124 wrote to memory of 2832	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	112
PID 1124 wrote to memory of 2832	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	112
PID 1124 wrote to memory of 4488	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	113
PID 1124 wrote to memory of 4488	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	113
PID 1124 wrote to memory of 2348	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	114
PID 1124 wrote to memory of 2348	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	114
PID 1124 wrote to memory of 4352	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	115
PID 1124 wrote to memory of 4352	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	115
PID 1124 wrote to memory of 1488	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	116
PID 1124 wrote to memory of 1488	1124	b5651bd94340cb1b9533d4936c5d5f10N.exe	116

C:\Users\Admin\AppData\Local\Temp\b5651bd94340cb1b9533d4936c5d5f10N.exe
"C:\Users\Admin\AppData\Local\Temp\b5651bd94340cb1b9533d4936c5d5f10N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\System\URltTMm.exe
  C:\Windows\System\URltTMm.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\qntxzqY.exe
  C:\Windows\System\qntxzqY.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\xLqCjcy.exe
  C:\Windows\System\xLqCjcy.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\qtnFrzT.exe
  C:\Windows\System\qtnFrzT.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\RFlsqTa.exe
  C:\Windows\System\RFlsqTa.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\ZVSdYBb.exe
  C:\Windows\System\ZVSdYBb.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\IKCtOjd.exe
  C:\Windows\System\IKCtOjd.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\grSaUgt.exe
  C:\Windows\System\grSaUgt.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\inlbLYj.exe
  C:\Windows\System\inlbLYj.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\ciskslg.exe
  C:\Windows\System\ciskslg.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\lrvZHAH.exe
  C:\Windows\System\lrvZHAH.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\KkTIMGq.exe
  C:\Windows\System\KkTIMGq.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\rALrDRW.exe
  C:\Windows\System\rALrDRW.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\ukqcdFf.exe
  C:\Windows\System\ukqcdFf.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\IVnWPkf.exe
  C:\Windows\System\IVnWPkf.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\cThdTZI.exe
  C:\Windows\System\cThdTZI.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\EWhcVGK.exe
  C:\Windows\System\EWhcVGK.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\sWcDwgE.exe
  C:\Windows\System\sWcDwgE.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\UCQZsAw.exe
  C:\Windows\System\UCQZsAw.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\lkEEAnR.exe
  C:\Windows\System\lkEEAnR.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\xArSeAm.exe
  C:\Windows\System\xArSeAm.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\rahwdgd.exe
  C:\Windows\System\rahwdgd.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\zYFCWfw.exe
  C:\Windows\System\zYFCWfw.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\MYQIhRq.exe
  C:\Windows\System\MYQIhRq.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\IJNnQTM.exe
  C:\Windows\System\IJNnQTM.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\JKsIHRe.exe
  C:\Windows\System\JKsIHRe.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\zUroMZQ.exe
  C:\Windows\System\zUroMZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\MjrEZRN.exe
  C:\Windows\System\MjrEZRN.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\KoTfvdD.exe
  C:\Windows\System\KoTfvdD.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\uprpwca.exe
  C:\Windows\System\uprpwca.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\YwLfKxr.exe
  C:\Windows\System\YwLfKxr.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\kqwfjnl.exe
  C:\Windows\System\kqwfjnl.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\gBTrkbz.exe
  C:\Windows\System\gBTrkbz.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\uxAwpyR.exe
  C:\Windows\System\uxAwpyR.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\SMTREvc.exe
  C:\Windows\System\SMTREvc.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\QsbtirH.exe
  C:\Windows\System\QsbtirH.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\snukpsv.exe
  C:\Windows\System\snukpsv.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\JcRiSTe.exe
  C:\Windows\System\JcRiSTe.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\tjWBiCH.exe
  C:\Windows\System\tjWBiCH.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\HMYwndk.exe
  C:\Windows\System\HMYwndk.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\NFAmUxQ.exe
  C:\Windows\System\NFAmUxQ.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\MCcpHKA.exe
  C:\Windows\System\MCcpHKA.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\NelQwzw.exe
  C:\Windows\System\NelQwzw.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\kZJKbgT.exe
  C:\Windows\System\kZJKbgT.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\wtErozh.exe
  C:\Windows\System\wtErozh.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\MrqTPbe.exe
  C:\Windows\System\MrqTPbe.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\USJZWYH.exe
  C:\Windows\System\USJZWYH.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\wLpkjrz.exe
  C:\Windows\System\wLpkjrz.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\iYBwFiM.exe
  C:\Windows\System\iYBwFiM.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\WnCrerS.exe
  C:\Windows\System\WnCrerS.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ZpwQraz.exe
  C:\Windows\System\ZpwQraz.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\qhwCMSg.exe
  C:\Windows\System\qhwCMSg.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\jWZjdhX.exe
  C:\Windows\System\jWZjdhX.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\GMmaqlq.exe
  C:\Windows\System\GMmaqlq.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\fSeLWnz.exe
  C:\Windows\System\fSeLWnz.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\DKMOhoZ.exe
  C:\Windows\System\DKMOhoZ.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\XxJUvnR.exe
  C:\Windows\System\XxJUvnR.exe
  2⤵
  PID:972
- C:\Windows\System\OlcaNNx.exe
  C:\Windows\System\OlcaNNx.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\lBRjYYo.exe
  C:\Windows\System\lBRjYYo.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\vuuEueD.exe
  C:\Windows\System\vuuEueD.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\PYVjMGC.exe
  C:\Windows\System\PYVjMGC.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\uZWECzw.exe
  C:\Windows\System\uZWECzw.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\SbnQQfw.exe
  C:\Windows\System\SbnQQfw.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\qpSvrBf.exe
  C:\Windows\System\qpSvrBf.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\yJCBtvr.exe
  C:\Windows\System\yJCBtvr.exe
  2⤵
  PID:3472
- C:\Windows\System\RhIQQMU.exe
  C:\Windows\System\RhIQQMU.exe
  2⤵
  PID:2260
- C:\Windows\System\TZnYcTJ.exe
  C:\Windows\System\TZnYcTJ.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\aDZQCAf.exe
  C:\Windows\System\aDZQCAf.exe
  2⤵
  PID:2076
- C:\Windows\System\vquDVyZ.exe
  C:\Windows\System\vquDVyZ.exe
  2⤵
  PID:5140
- C:\Windows\System\jBSaYqp.exe
  C:\Windows\System\jBSaYqp.exe
  2⤵
  PID:5160
- C:\Windows\System\CAZANJn.exe
  C:\Windows\System\CAZANJn.exe
  2⤵
  PID:5192
- C:\Windows\System\UAEBPZf.exe
  C:\Windows\System\UAEBPZf.exe
  2⤵
  PID:5212
- C:\Windows\System\NBVGOxO.exe
  C:\Windows\System\NBVGOxO.exe
  2⤵
  PID:5228
- C:\Windows\System\dhpVRly.exe
  C:\Windows\System\dhpVRly.exe
  2⤵
  PID:5244
- C:\Windows\System\gtSyXHi.exe
  C:\Windows\System\gtSyXHi.exe
  2⤵
  PID:5268
- C:\Windows\System\SdHQULA.exe
  C:\Windows\System\SdHQULA.exe
  2⤵
  PID:5292
- C:\Windows\System\VAVULWF.exe
  C:\Windows\System\VAVULWF.exe
  2⤵
  PID:5308
- C:\Windows\System\YFUolgm.exe
  C:\Windows\System\YFUolgm.exe
  2⤵
  PID:5332
- C:\Windows\System\AnmTKzR.exe
  C:\Windows\System\AnmTKzR.exe
  2⤵
  PID:5348
- C:\Windows\System\MNbVqYQ.exe
  C:\Windows\System\MNbVqYQ.exe
  2⤵
  PID:5364
- C:\Windows\System\YwgZnDf.exe
  C:\Windows\System\YwgZnDf.exe
  2⤵
  PID:5392
- C:\Windows\System\zaAcQNI.exe
  C:\Windows\System\zaAcQNI.exe
  2⤵
  PID:5420
- C:\Windows\System\rBleGMr.exe
  C:\Windows\System\rBleGMr.exe
  2⤵
  PID:5444
- C:\Windows\System\xWzemhx.exe
  C:\Windows\System\xWzemhx.exe
  2⤵
  PID:5460
- C:\Windows\System\uSouLZD.exe
  C:\Windows\System\uSouLZD.exe
  2⤵
  PID:5476
- C:\Windows\System\TkDvVME.exe
  C:\Windows\System\TkDvVME.exe
  2⤵
  PID:5512
- C:\Windows\System\EpikDlX.exe
  C:\Windows\System\EpikDlX.exe
  2⤵
  PID:5528
- C:\Windows\System\hrfZfUW.exe
  C:\Windows\System\hrfZfUW.exe
  2⤵
  PID:5552
- C:\Windows\System\GpMVdrY.exe
  C:\Windows\System\GpMVdrY.exe
  2⤵
  PID:5572
- C:\Windows\System\nQrUDZF.exe
  C:\Windows\System\nQrUDZF.exe
  2⤵
  PID:5592
- C:\Windows\System\nJUTwks.exe
  C:\Windows\System\nJUTwks.exe
  2⤵
  PID:5612
- C:\Windows\System\cXTmnBd.exe
  C:\Windows\System\cXTmnBd.exe
  2⤵
  PID:5640
- C:\Windows\System\hqJGaGd.exe
  C:\Windows\System\hqJGaGd.exe
  2⤵
  PID:5660
- C:\Windows\System\PEkfTan.exe
  C:\Windows\System\PEkfTan.exe
  2⤵
  PID:5676
- C:\Windows\System\GsIlliN.exe
  C:\Windows\System\GsIlliN.exe
  2⤵
  PID:5696
- C:\Windows\System\DJuXhzH.exe
  C:\Windows\System\DJuXhzH.exe
  2⤵
  PID:5712
- C:\Windows\System\ZnrfdIn.exe
  C:\Windows\System\ZnrfdIn.exe
  2⤵
  PID:5728
- C:\Windows\System\EeDNKsi.exe
  C:\Windows\System\EeDNKsi.exe
  2⤵
  PID:5752
- C:\Windows\System\fhgHlqz.exe
  C:\Windows\System\fhgHlqz.exe
  2⤵
  PID:5776
- C:\Windows\System\WPQYUSj.exe
  C:\Windows\System\WPQYUSj.exe
  2⤵
  PID:5796
- C:\Windows\System\zNpGKxp.exe
  C:\Windows\System\zNpGKxp.exe
  2⤵
  PID:5816
- C:\Windows\System\NyIvVzs.exe
  C:\Windows\System\NyIvVzs.exe
  2⤵
  PID:5832
- C:\Windows\System\rNICmFa.exe
  C:\Windows\System\rNICmFa.exe
  2⤵
  PID:5860
- C:\Windows\System\zricmxe.exe
  C:\Windows\System\zricmxe.exe
  2⤵
  PID:5876
- C:\Windows\System\AykzZDs.exe
  C:\Windows\System\AykzZDs.exe
  2⤵
  PID:5896
- C:\Windows\System\iWHiVUM.exe
  C:\Windows\System\iWHiVUM.exe
  2⤵
  PID:5916
- C:\Windows\System\lkyfasO.exe
  C:\Windows\System\lkyfasO.exe
  2⤵
  PID:5940
- C:\Windows\System\YuKwYxv.exe
  C:\Windows\System\YuKwYxv.exe
  2⤵
  PID:5968
- C:\Windows\System\KQhmgMY.exe
  C:\Windows\System\KQhmgMY.exe
  2⤵
  PID:6008
- C:\Windows\System\KQRNZzf.exe
  C:\Windows\System\KQRNZzf.exe
  2⤵
  PID:6036
- C:\Windows\System\SSDCopU.exe
  C:\Windows\System\SSDCopU.exe
  2⤵
  PID:6060
- C:\Windows\System\NiBfljZ.exe
  C:\Windows\System\NiBfljZ.exe
  2⤵
  PID:6084
- C:\Windows\System\UjrReux.exe
  C:\Windows\System\UjrReux.exe
  2⤵
  PID:6124
- C:\Windows\System\xlFRCMf.exe
  C:\Windows\System\xlFRCMf.exe
  2⤵
  PID:4348
- C:\Windows\System\czsqRuU.exe
  C:\Windows\System\czsqRuU.exe
  2⤵
  PID:1388
- C:\Windows\System\gFFwBmb.exe
  C:\Windows\System\gFFwBmb.exe
  2⤵
  PID:4496
- C:\Windows\System\Ztzmcbj.exe
  C:\Windows\System\Ztzmcbj.exe
  2⤵
  PID:4868
- C:\Windows\System\InrNyIc.exe
  C:\Windows\System\InrNyIc.exe
  2⤵
  PID:4652
- C:\Windows\System\XGpWIts.exe
  C:\Windows\System\XGpWIts.exe
  2⤵
  PID:1936
- C:\Windows\System\LEGcffG.exe
  C:\Windows\System\LEGcffG.exe
  2⤵
  PID:4076
- C:\Windows\System\aeAUhbH.exe
  C:\Windows\System\aeAUhbH.exe
  2⤵
  PID:4972
- C:\Windows\System\qwhdPzW.exe
  C:\Windows\System\qwhdPzW.exe
  2⤵
  PID:4424
- C:\Windows\System\KbIdKsv.exe
  C:\Windows\System\KbIdKsv.exe
  2⤵
  PID:2456
- C:\Windows\System\amvRNWM.exe
  C:\Windows\System\amvRNWM.exe
  2⤵
  PID:1828
- C:\Windows\System\VgzMkuF.exe
  C:\Windows\System\VgzMkuF.exe
  2⤵
  PID:3456
- C:\Windows\System\DwwQGmO.exe
  C:\Windows\System\DwwQGmO.exe
  2⤵
  PID:2520
- C:\Windows\System\zlHmKDW.exe
  C:\Windows\System\zlHmKDW.exe
  2⤵
  PID:5096
- C:\Windows\System\bipjTHM.exe
  C:\Windows\System\bipjTHM.exe
  2⤵
  PID:1236
- C:\Windows\System\QpcZIre.exe
  C:\Windows\System\QpcZIre.exe
  2⤵
  PID:224
- C:\Windows\System\mAqfueW.exe
  C:\Windows\System\mAqfueW.exe
  2⤵
  PID:3952
- C:\Windows\System\CNkPRas.exe
  C:\Windows\System\CNkPRas.exe
  2⤵
  PID:3332
- C:\Windows\System\iwwEGqf.exe
  C:\Windows\System\iwwEGqf.exe
  2⤵
  PID:3948
- C:\Windows\System\qgWRjdV.exe
  C:\Windows\System\qgWRjdV.exe
  2⤵
  PID:5620
- C:\Windows\System\BInceSz.exe
  C:\Windows\System\BInceSz.exe
  2⤵
  PID:5656
- C:\Windows\System\jtsAyZY.exe
  C:\Windows\System\jtsAyZY.exe
  2⤵
  PID:544
- C:\Windows\System\LGGKipV.exe
  C:\Windows\System\LGGKipV.exe
  2⤵
  PID:1156
- C:\Windows\System\QWKiUbQ.exe
  C:\Windows\System\QWKiUbQ.exe
  2⤵
  PID:5948
- C:\Windows\System\LaCgFlZ.exe
  C:\Windows\System\LaCgFlZ.exe
  2⤵
  PID:3908
- C:\Windows\System\FAtpHKX.exe
  C:\Windows\System\FAtpHKX.exe
  2⤵
  PID:3560
- C:\Windows\System\OGBsDRB.exe
  C:\Windows\System\OGBsDRB.exe
  2⤵
  PID:3216
- C:\Windows\System\aNmQrsK.exe
  C:\Windows\System\aNmQrsK.exe
  2⤵
  PID:3632
- C:\Windows\System\mpvIoQE.exe
  C:\Windows\System\mpvIoQE.exe
  2⤵
  PID:4080
- C:\Windows\System\gsfwfHG.exe
  C:\Windows\System\gsfwfHG.exe
  2⤵
  PID:4312
- C:\Windows\System\eNMLOqy.exe
  C:\Windows\System\eNMLOqy.exe
  2⤵
  PID:4712
- C:\Windows\System\YSczvFU.exe
  C:\Windows\System\YSczvFU.exe
  2⤵
  PID:6152
- C:\Windows\System\gQQgpal.exe
  C:\Windows\System\gQQgpal.exe
  2⤵
  PID:6168
- C:\Windows\System\WVFBkIA.exe
  C:\Windows\System\WVFBkIA.exe
  2⤵
  PID:6200
- C:\Windows\System\ZDaxFkP.exe
  C:\Windows\System\ZDaxFkP.exe
  2⤵
  PID:6216
- C:\Windows\System\NHkAPRe.exe
  C:\Windows\System\NHkAPRe.exe
  2⤵
  PID:6232
- C:\Windows\System\XhOxwqa.exe
  C:\Windows\System\XhOxwqa.exe
  2⤵
  PID:6252
- C:\Windows\System\FChSVkK.exe
  C:\Windows\System\FChSVkK.exe
  2⤵
  PID:6268
- C:\Windows\System\gPRodMI.exe
  C:\Windows\System\gPRodMI.exe
  2⤵
  PID:6292
- C:\Windows\System\xSkGYkY.exe
  C:\Windows\System\xSkGYkY.exe
  2⤵
  PID:6308
- C:\Windows\System\fBWKAJk.exe
  C:\Windows\System\fBWKAJk.exe
  2⤵
  PID:6328
- C:\Windows\System\SscIQDt.exe
  C:\Windows\System\SscIQDt.exe
  2⤵
  PID:6348
- C:\Windows\System\rvgIPGY.exe
  C:\Windows\System\rvgIPGY.exe
  2⤵
  PID:6368
- C:\Windows\System\yKPopix.exe
  C:\Windows\System\yKPopix.exe
  2⤵
  PID:6388
- C:\Windows\System\IvDRLyz.exe
  C:\Windows\System\IvDRLyz.exe
  2⤵
  PID:6408
- C:\Windows\System\gPHPfkL.exe
  C:\Windows\System\gPHPfkL.exe
  2⤵
  PID:6428
- C:\Windows\System\FibDnff.exe
  C:\Windows\System\FibDnff.exe
  2⤵
  PID:6452
- C:\Windows\System\Bsrwvjq.exe
  C:\Windows\System\Bsrwvjq.exe
  2⤵
  PID:6472
- C:\Windows\System\EzxtfGQ.exe
  C:\Windows\System\EzxtfGQ.exe
  2⤵
  PID:6492
- C:\Windows\System\dvgYPZX.exe
  C:\Windows\System\dvgYPZX.exe
  2⤵
  PID:6508
- C:\Windows\System\MiigAAb.exe
  C:\Windows\System\MiigAAb.exe
  2⤵
  PID:6532
- C:\Windows\System\AsbcWZY.exe
  C:\Windows\System\AsbcWZY.exe
  2⤵
  PID:6548
- C:\Windows\System\hDAhqWJ.exe
  C:\Windows\System\hDAhqWJ.exe
  2⤵
  PID:6572
- C:\Windows\System\UmNscJk.exe
  C:\Windows\System\UmNscJk.exe
  2⤵
  PID:6588
- C:\Windows\System\UkjjGeM.exe
  C:\Windows\System\UkjjGeM.exe
  2⤵
  PID:6612
- C:\Windows\System\njxZnqI.exe
  C:\Windows\System\njxZnqI.exe
  2⤵
  PID:6644
- C:\Windows\System\eYRBoKe.exe
  C:\Windows\System\eYRBoKe.exe
  2⤵
  PID:6660
- C:\Windows\System\IcqRQtl.exe
  C:\Windows\System\IcqRQtl.exe
  2⤵
  PID:6676
- C:\Windows\System\UmMPggC.exe
  C:\Windows\System\UmMPggC.exe
  2⤵
  PID:6692
- C:\Windows\System\xkaXddR.exe
  C:\Windows\System\xkaXddR.exe
  2⤵
  PID:6708
- C:\Windows\System\QAgoFoO.exe
  C:\Windows\System\QAgoFoO.exe
  2⤵
  PID:6728
- C:\Windows\System\VNuEMMp.exe
  C:\Windows\System\VNuEMMp.exe
  2⤵
  PID:6744
- C:\Windows\System\YirZrfx.exe
  C:\Windows\System\YirZrfx.exe
  2⤵
  PID:6764
- C:\Windows\System\nfGfVkl.exe
  C:\Windows\System\nfGfVkl.exe
  2⤵
  PID:6780
- C:\Windows\System\lJgaDNk.exe
  C:\Windows\System\lJgaDNk.exe
  2⤵
  PID:6796
- C:\Windows\System\hCHfoOB.exe
  C:\Windows\System\hCHfoOB.exe
  2⤵
  PID:6960
- C:\Windows\System\uEzfXIR.exe
  C:\Windows\System\uEzfXIR.exe
  2⤵
  PID:6976
- C:\Windows\System\OaZkeCo.exe
  C:\Windows\System\OaZkeCo.exe
  2⤵
  PID:6992
- C:\Windows\System\aGtEIsm.exe
  C:\Windows\System\aGtEIsm.exe
  2⤵
  PID:7008
- C:\Windows\System\Yncbrhk.exe
  C:\Windows\System\Yncbrhk.exe
  2⤵
  PID:7024
- C:\Windows\System\xrQslGg.exe
  C:\Windows\System\xrQslGg.exe
  2⤵
  PID:7040
- C:\Windows\System\URVAhqc.exe
  C:\Windows\System\URVAhqc.exe
  2⤵
  PID:7056
- C:\Windows\System\jelDClY.exe
  C:\Windows\System\jelDClY.exe
  2⤵
  PID:7072
- C:\Windows\System\GfKeURe.exe
  C:\Windows\System\GfKeURe.exe
  2⤵
  PID:7088
- C:\Windows\System\ytIZKUp.exe
  C:\Windows\System\ytIZKUp.exe
  2⤵
  PID:7104
- C:\Windows\System\tXgzruV.exe
  C:\Windows\System\tXgzruV.exe
  2⤵
  PID:7120
- C:\Windows\System\AfzdjzA.exe
  C:\Windows\System\AfzdjzA.exe
  2⤵
  PID:7136
- C:\Windows\System\TCghDwE.exe
  C:\Windows\System\TCghDwE.exe
  2⤵
  PID:7152
- C:\Windows\System\FHbOvha.exe
  C:\Windows\System\FHbOvha.exe
  2⤵
  PID:5200
- C:\Windows\System\HwseCJx.exe
  C:\Windows\System\HwseCJx.exe
  2⤵
  PID:5252
- C:\Windows\System\lAcDDAZ.exe
  C:\Windows\System\lAcDDAZ.exe
  2⤵
  PID:5888
- C:\Windows\System\wrwqmNN.exe
  C:\Windows\System\wrwqmNN.exe
  2⤵
  PID:1572
- C:\Windows\System\LBZcqHy.exe
  C:\Windows\System\LBZcqHy.exe
  2⤵
  PID:4816
- C:\Windows\System\UhKaeTz.exe
  C:\Windows\System\UhKaeTz.exe
  2⤵
  PID:5980
- C:\Windows\System\TrFzSzn.exe
  C:\Windows\System\TrFzSzn.exe
  2⤵
  PID:5380
- C:\Windows\System\VvpotaU.exe
  C:\Windows\System\VvpotaU.exe
  2⤵
  PID:5428
- C:\Windows\System\rRmbVlg.exe
  C:\Windows\System\rRmbVlg.exe
  2⤵
  PID:5456
- C:\Windows\System\ozMOfvJ.exe
  C:\Windows\System\ozMOfvJ.exe
  2⤵
  PID:4656
- C:\Windows\System\QEdjexG.exe
  C:\Windows\System\QEdjexG.exe
  2⤵
  PID:5724
- C:\Windows\System\oVauHUI.exe
  C:\Windows\System\oVauHUI.exe
  2⤵
  PID:992
- C:\Windows\System\CmAlwIe.exe
  C:\Windows\System\CmAlwIe.exe
  2⤵
  PID:5052
- C:\Windows\System\MgpPYVf.exe
  C:\Windows\System\MgpPYVf.exe
  2⤵
  PID:5600
- C:\Windows\System\gwAxCim.exe
  C:\Windows\System\gwAxCim.exe
  2⤵
  PID:5544
- C:\Windows\System\ppcOeMm.exe
  C:\Windows\System\ppcOeMm.exe
  2⤵
  PID:5520
- C:\Windows\System\SWYgWYE.exe
  C:\Windows\System\SWYgWYE.exe
  2⤵
  PID:5788
- C:\Windows\System\ZTWtdCk.exe
  C:\Windows\System\ZTWtdCk.exe
  2⤵
  PID:5812
- C:\Windows\System\Urivlrn.exe
  C:\Windows\System\Urivlrn.exe
  2⤵
  PID:1464
- C:\Windows\System\unDHHbi.exe
  C:\Windows\System\unDHHbi.exe
  2⤵
  PID:6004
- C:\Windows\System\uIDMfIJ.exe
  C:\Windows\System\uIDMfIJ.exe
  2⤵
  PID:6044
- C:\Windows\System\jAfNYNC.exe
  C:\Windows\System\jAfNYNC.exe
  2⤵
  PID:6112
- C:\Windows\System\vOzlleb.exe
  C:\Windows\System\vOzlleb.exe
  2⤵
  PID:1272
- C:\Windows\System\hqFlipQ.exe
  C:\Windows\System\hqFlipQ.exe
  2⤵
  PID:1832
- C:\Windows\System\hRTNbbL.exe
  C:\Windows\System\hRTNbbL.exe
  2⤵
  PID:3000
- C:\Windows\System\DNGZVkv.exe
  C:\Windows\System\DNGZVkv.exe
  2⤵
  PID:1396
- C:\Windows\System\WDHTUpd.exe
  C:\Windows\System\WDHTUpd.exe
  2⤵
  PID:2144
- C:\Windows\System\fgMsEhn.exe
  C:\Windows\System\fgMsEhn.exe
  2⤵
  PID:3476
- C:\Windows\System\ueCMFtX.exe
  C:\Windows\System\ueCMFtX.exe
  2⤵
  PID:4660
- C:\Windows\System\ZvQIlmC.exe
  C:\Windows\System\ZvQIlmC.exe
  2⤵
  PID:7392
- C:\Windows\System\laucOkv.exe
  C:\Windows\System\laucOkv.exe
  2⤵
  PID:7416
- C:\Windows\System\niXKWgQ.exe
  C:\Windows\System\niXKWgQ.exe
  2⤵
  PID:7444
- C:\Windows\System\IVzctTf.exe
  C:\Windows\System\IVzctTf.exe
  2⤵
  PID:7464
- C:\Windows\System\NddVYEQ.exe
  C:\Windows\System\NddVYEQ.exe
  2⤵
  PID:7488
- C:\Windows\System\CnLzhjA.exe
  C:\Windows\System\CnLzhjA.exe
  2⤵
  PID:7504
- C:\Windows\System\iEMQArx.exe
  C:\Windows\System\iEMQArx.exe
  2⤵
  PID:7524
- C:\Windows\System\yxRECfZ.exe
  C:\Windows\System\yxRECfZ.exe
  2⤵
  PID:7564
- C:\Windows\System\TyngTFg.exe
  C:\Windows\System\TyngTFg.exe
  2⤵
  PID:7580
- C:\Windows\System\OkVUpyR.exe
  C:\Windows\System\OkVUpyR.exe
  2⤵
  PID:7600
- C:\Windows\System\WPSzIoW.exe
  C:\Windows\System\WPSzIoW.exe
  2⤵
  PID:7616
- C:\Windows\System\wSftZNU.exe
  C:\Windows\System\wSftZNU.exe
  2⤵
  PID:7636
- C:\Windows\System\OgUgAjy.exe
  C:\Windows\System\OgUgAjy.exe
  2⤵
  PID:7652
- C:\Windows\System\AnnKnLh.exe
  C:\Windows\System\AnnKnLh.exe
  2⤵
  PID:7672
- C:\Windows\System\kmpOmJp.exe
  C:\Windows\System\kmpOmJp.exe
  2⤵
  PID:7692
- C:\Windows\System\FygGGZo.exe
  C:\Windows\System\FygGGZo.exe
  2⤵
  PID:7712
- C:\Windows\System\zpBrNyj.exe
  C:\Windows\System\zpBrNyj.exe
  2⤵
  PID:8008
- C:\Windows\System\aHJXTLt.exe
  C:\Windows\System\aHJXTLt.exe
  2⤵
  PID:8028
- C:\Windows\System\LcSaWEJ.exe
  C:\Windows\System\LcSaWEJ.exe
  2⤵
  PID:8048
- C:\Windows\System\hwxppXi.exe
  C:\Windows\System\hwxppXi.exe
  2⤵
  PID:8076
- C:\Windows\System\lBuBqLg.exe
  C:\Windows\System\lBuBqLg.exe
  2⤵
  PID:8092
- C:\Windows\System\cbiWDpz.exe
  C:\Windows\System\cbiWDpz.exe
  2⤵
  PID:8120
- C:\Windows\System\UDxmGBg.exe
  C:\Windows\System\UDxmGBg.exe
  2⤵
  PID:8136
- C:\Windows\System\YnOnEMe.exe
  C:\Windows\System\YnOnEMe.exe
  2⤵
  PID:8156
- C:\Windows\System\YZyRNoX.exe
  C:\Windows\System\YZyRNoX.exe
  2⤵
  PID:4492
- C:\Windows\System\gpAkrPW.exe
  C:\Windows\System\gpAkrPW.exe
  2⤵
  PID:5276
- C:\Windows\System\NfZgdPY.exe
  C:\Windows\System\NfZgdPY.exe
  2⤵
  PID:1932
- C:\Windows\System\hYVDztX.exe
  C:\Windows\System\hYVDztX.exe
  2⤵
  PID:6224
- C:\Windows\System\yVvtvmE.exe
  C:\Windows\System\yVvtvmE.exe
  2⤵
  PID:6304
- C:\Windows\System\jscnECX.exe
  C:\Windows\System\jscnECX.exe
  2⤵
  PID:6336
- C:\Windows\System\UYXxKlC.exe
  C:\Windows\System\UYXxKlC.exe
  2⤵
  PID:6436
- C:\Windows\System\xULrZsB.exe
  C:\Windows\System\xULrZsB.exe
  2⤵
  PID:6604
- C:\Windows\System\frFAfaj.exe
  C:\Windows\System\frFAfaj.exe
  2⤵
  PID:5704
- C:\Windows\System\pFrWHJo.exe
  C:\Windows\System\pFrWHJo.exe
  2⤵
  PID:6356
- C:\Windows\System\ouTUSKk.exe
  C:\Windows\System\ouTUSKk.exe
  2⤵
  PID:6716
- C:\Windows\System\qfFbvaW.exe
  C:\Windows\System\qfFbvaW.exe
  2⤵
  PID:7184
- C:\Windows\System\RHEUlpj.exe
  C:\Windows\System\RHEUlpj.exe
  2⤵
  PID:2272
- C:\Windows\System\uflvUll.exe
  C:\Windows\System\uflvUll.exe
  2⤵
  PID:2016
- C:\Windows\System\smHTMjH.exe
  C:\Windows\System\smHTMjH.exe
  2⤵
  PID:2448
- C:\Windows\System\jOuFXIY.exe
  C:\Windows\System\jOuFXIY.exe
  2⤵
  PID:4288
- C:\Windows\System\pjMpllK.exe
  C:\Windows\System\pjMpllK.exe
  2⤵
  PID:6176
- C:\Windows\System\VSxukGO.exe
  C:\Windows\System\VSxukGO.exe
  2⤵
  PID:6248
- C:\Windows\System\nInhiCT.exe
  C:\Windows\System\nInhiCT.exe
  2⤵
  PID:7520
- C:\Windows\System\enSpslt.exe
  C:\Windows\System\enSpslt.exe
  2⤵
  PID:6404
- C:\Windows\System\DvDnRAZ.exe
  C:\Windows\System\DvDnRAZ.exe
  2⤵
  PID:6504
- C:\Windows\System\fhoMuEj.exe
  C:\Windows\System\fhoMuEj.exe
  2⤵
  PID:6568
- C:\Windows\System\uXvCHyL.exe
  C:\Windows\System\uXvCHyL.exe
  2⤵
  PID:6776
- C:\Windows\System\XCQreKp.exe
  C:\Windows\System\XCQreKp.exe
  2⤵
  PID:6952
- C:\Windows\System\hMhMQGK.exe
  C:\Windows\System\hMhMQGK.exe
  2⤵
  PID:7000
- C:\Windows\System\uAJypiu.exe
  C:\Windows\System\uAJypiu.exe
  2⤵
  PID:7032
- C:\Windows\System\FBncPTN.exe
  C:\Windows\System\FBncPTN.exe
  2⤵
  PID:7080
- C:\Windows\System\JwzoGZY.exe
  C:\Windows\System\JwzoGZY.exe
  2⤵
  PID:7116
- C:\Windows\System\xXFwZkK.exe
  C:\Windows\System\xXFwZkK.exe
  2⤵
  PID:7148
- C:\Windows\System\ZXkMpzD.exe
  C:\Windows\System\ZXkMpzD.exe
  2⤵
  PID:6228
- C:\Windows\System\IqREZTN.exe
  C:\Windows\System\IqREZTN.exe
  2⤵
  PID:8200
- C:\Windows\System\OYJQPiB.exe
  C:\Windows\System\OYJQPiB.exe
  2⤵
  PID:8240
- C:\Windows\System\DYBhZNf.exe
  C:\Windows\System\DYBhZNf.exe
  2⤵
  PID:8260
- C:\Windows\System\svZNLDP.exe
  C:\Windows\System\svZNLDP.exe
  2⤵
  PID:8288
- C:\Windows\System\equkILV.exe
  C:\Windows\System\equkILV.exe
  2⤵
  PID:8308
- C:\Windows\System\IlvuqFe.exe
  C:\Windows\System\IlvuqFe.exe
  2⤵
  PID:8324
- C:\Windows\System\tFcQkVI.exe
  C:\Windows\System\tFcQkVI.exe
  2⤵
  PID:8344
- C:\Windows\System\SOMTtYK.exe
  C:\Windows\System\SOMTtYK.exe
  2⤵
  PID:8364
- C:\Windows\System\RambcHy.exe
  C:\Windows\System\RambcHy.exe
  2⤵
  PID:8380
- C:\Windows\System\WBWLVmo.exe
  C:\Windows\System\WBWLVmo.exe
  2⤵
  PID:8404
- C:\Windows\System\vGfzJmo.exe
  C:\Windows\System\vGfzJmo.exe
  2⤵
  PID:8724
- C:\Windows\System\CEjPvXZ.exe
  C:\Windows\System\CEjPvXZ.exe
  2⤵
  PID:8756
- C:\Windows\System\yAMCguo.exe
  C:\Windows\System\yAMCguo.exe
  2⤵
  PID:8776
- C:\Windows\System\atuBjKZ.exe
  C:\Windows\System\atuBjKZ.exe
  2⤵
  PID:8804
- C:\Windows\System\eRgzHuq.exe
  C:\Windows\System\eRgzHuq.exe
  2⤵
  PID:8820
- C:\Windows\System\WAnjCEY.exe
  C:\Windows\System\WAnjCEY.exe
  2⤵
  PID:8856
- C:\Windows\System\VlzyOFb.exe
  C:\Windows\System\VlzyOFb.exe
  2⤵
  PID:8876
- C:\Windows\System\xIVNrfq.exe
  C:\Windows\System\xIVNrfq.exe
  2⤵
  PID:8892
- C:\Windows\System\xlrqclB.exe
  C:\Windows\System\xlrqclB.exe
  2⤵
  PID:8924
- C:\Windows\System\yILXHnc.exe
  C:\Windows\System\yILXHnc.exe
  2⤵
  PID:8940
- C:\Windows\System\IwAvKYH.exe
  C:\Windows\System\IwAvKYH.exe
  2⤵
  PID:8960
- C:\Windows\System\GGyNYpu.exe
  C:\Windows\System\GGyNYpu.exe
  2⤵
  PID:8976
- C:\Windows\System\WIobiRU.exe
  C:\Windows\System\WIobiRU.exe
  2⤵
  PID:8992
- C:\Windows\System\McbvpBp.exe
  C:\Windows\System\McbvpBp.exe
  2⤵
  PID:9008
- C:\Windows\System\KxISRBe.exe
  C:\Windows\System\KxISRBe.exe
  2⤵
  PID:9028
- C:\Windows\System\lSMutDF.exe
  C:\Windows\System\lSMutDF.exe
  2⤵
  PID:9048
- C:\Windows\System\TJUeqfW.exe
  C:\Windows\System\TJUeqfW.exe
  2⤵
  PID:9068
- C:\Windows\System\EyPvDgw.exe
  C:\Windows\System\EyPvDgw.exe
  2⤵
  PID:9084
- C:\Windows\System\mGXZauj.exe
  C:\Windows\System\mGXZauj.exe
  2⤵
  PID:9108
- C:\Windows\System\MXuFLis.exe
  C:\Windows\System\MXuFLis.exe
  2⤵
  PID:9132
- C:\Windows\System\McjUqYO.exe
  C:\Windows\System\McjUqYO.exe
  2⤵
  PID:9152
- C:\Windows\System\obTQApP.exe
  C:\Windows\System\obTQApP.exe
  2⤵
  PID:9172
- C:\Windows\System\SRroAQL.exe
  C:\Windows\System\SRroAQL.exe
  2⤵
  PID:9192
- C:\Windows\System\PZLvbFq.exe
  C:\Windows\System\PZLvbFq.exe
  2⤵
  PID:9212
- C:\Windows\System\lNBoUxy.exe
  C:\Windows\System\lNBoUxy.exe
  2⤵
  PID:7384
- C:\Windows\System\KTlBJnm.exe
  C:\Windows\System\KTlBJnm.exe
  2⤵
  PID:7412
- C:\Windows\System\CmSNgeW.exe
  C:\Windows\System\CmSNgeW.exe
  2⤵
  PID:7472
- C:\Windows\System\rzplWPI.exe
  C:\Windows\System\rzplWPI.exe
  2⤵
  PID:7612
- C:\Windows\System\AISCEAH.exe
  C:\Windows\System\AISCEAH.exe
  2⤵
  PID:7660
- C:\Windows\System\QhqqvTX.exe
  C:\Windows\System\QhqqvTX.exe
  2⤵
  PID:5904
- C:\Windows\System\EnTDZsI.exe
  C:\Windows\System\EnTDZsI.exe
  2⤵
  PID:3976
- C:\Windows\System\tTndiSM.exe
  C:\Windows\System\tTndiSM.exe
  2⤵
  PID:8376
- C:\Windows\System\bJUxXlR.exe
  C:\Windows\System\bJUxXlR.exe
  2⤵
  PID:7976
- C:\Windows\System\CXQkhFw.exe
  C:\Windows\System\CXQkhFw.exe
  2⤵
  PID:8464
- C:\Windows\System\UTGIyfY.exe
  C:\Windows\System\UTGIyfY.exe
  2⤵
  PID:8064
- C:\Windows\System\lQhbzDC.exe
  C:\Windows\System\lQhbzDC.exe
  2⤵
  PID:8116
- C:\Windows\System\Yxlqjmc.exe
  C:\Windows\System\Yxlqjmc.exe
  2⤵
  PID:3356
- C:\Windows\System\BfFxuCy.exe
  C:\Windows\System\BfFxuCy.exe
  2⤵
  PID:2512
- C:\Windows\System\SfGCVpS.exe
  C:\Windows\System\SfGCVpS.exe
  2⤵
  PID:4084
- C:\Windows\System\bOFGeUV.exe
  C:\Windows\System\bOFGeUV.exe
  2⤵
  PID:6556
- C:\Windows\System\jvWbkWV.exe
  C:\Windows\System\jvWbkWV.exe
  2⤵
  PID:6468
- C:\Windows\System\YcGxhyl.exe
  C:\Windows\System\YcGxhyl.exe
  2⤵
  PID:6164
- C:\Windows\System\psiTdaB.exe
  C:\Windows\System\psiTdaB.exe
  2⤵
  PID:6656
- C:\Windows\System\fmUHgUj.exe
  C:\Windows\System\fmUHgUj.exe
  2⤵
  PID:4364
- C:\Windows\System\OPTQZIQ.exe
  C:\Windows\System\OPTQZIQ.exe
  2⤵
  PID:7500
- C:\Windows\System\hiGPbLe.exe
  C:\Windows\System\hiGPbLe.exe
  2⤵
  PID:6564
- C:\Windows\System\RIfJjkv.exe
  C:\Windows\System\RIfJjkv.exe
  2⤵
  PID:7780
- C:\Windows\System\kapBHdU.exe
  C:\Windows\System\kapBHdU.exe
  2⤵
  PID:7048
- C:\Windows\System\UXTYZOl.exe
  C:\Windows\System\UXTYZOl.exe
  2⤵
  PID:7112
- C:\Windows\System\czIYGXe.exe
  C:\Windows\System\czIYGXe.exe
  2⤵
  PID:8868
- C:\Windows\System\OKDfeQn.exe
  C:\Windows\System\OKDfeQn.exe
  2⤵
  PID:5808
- C:\Windows\System\xxBTmOg.exe
  C:\Windows\System\xxBTmOg.exe
  2⤵
  PID:8972
- C:\Windows\System\OnMfEXY.exe
  C:\Windows\System\OnMfEXY.exe
  2⤵
  PID:9076
- C:\Windows\System\tCMfCqT.exe
  C:\Windows\System\tCMfCqT.exe
  2⤵
  PID:9104
- C:\Windows\System\xHWzYNa.exe
  C:\Windows\System\xHWzYNa.exe
  2⤵
  PID:9188
- C:\Windows\System\uJEAAmB.exe
  C:\Windows\System\uJEAAmB.exe
  2⤵
  PID:7668
- C:\Windows\System\UxqQqpR.exe
  C:\Windows\System\UxqQqpR.exe
  2⤵
  PID:9260
- C:\Windows\System\kPUmsKO.exe
  C:\Windows\System\kPUmsKO.exe
  2⤵
  PID:9284
- C:\Windows\System\XRAIRwd.exe
  C:\Windows\System\XRAIRwd.exe
  2⤵
  PID:9300
- C:\Windows\System\aGGZEfD.exe
  C:\Windows\System\aGGZEfD.exe
  2⤵
  PID:9324
- C:\Windows\System\sMQwuHZ.exe
  C:\Windows\System\sMQwuHZ.exe
  2⤵
  PID:9348
- C:\Windows\System\lsIZSHF.exe
  C:\Windows\System\lsIZSHF.exe
  2⤵
  PID:9364
- C:\Windows\System\COgdsYK.exe
  C:\Windows\System\COgdsYK.exe
  2⤵
  PID:9380
- C:\Windows\System\uTCwUkw.exe
  C:\Windows\System\uTCwUkw.exe
  2⤵
  PID:9396
- C:\Windows\System\KPSJgxX.exe
  C:\Windows\System\KPSJgxX.exe
  2⤵
  PID:9416
- C:\Windows\System\fuBAaTC.exe
  C:\Windows\System\fuBAaTC.exe
  2⤵
  PID:9432
- C:\Windows\System\oeOiMtr.exe
  C:\Windows\System\oeOiMtr.exe
  2⤵
  PID:9456
- C:\Windows\System\CbMkVxw.exe
  C:\Windows\System\CbMkVxw.exe
  2⤵
  PID:9480
- C:\Windows\System\rSAJvuy.exe
  C:\Windows\System\rSAJvuy.exe
  2⤵
  PID:9496
- C:\Windows\System\QzCvwpK.exe
  C:\Windows\System\QzCvwpK.exe
  2⤵
  PID:9520
- C:\Windows\System\yBIfvDz.exe
  C:\Windows\System\yBIfvDz.exe
  2⤵
  PID:9548
- C:\Windows\System\vKijlSv.exe
  C:\Windows\System\vKijlSv.exe
  2⤵
  PID:9576
- C:\Windows\System\cNHnhJT.exe
  C:\Windows\System\cNHnhJT.exe
  2⤵
  PID:9592
- C:\Windows\System\GZmbaGK.exe
  C:\Windows\System\GZmbaGK.exe
  2⤵
  PID:9616
- C:\Windows\System\KgkHatO.exe
  C:\Windows\System\KgkHatO.exe
  2⤵
  PID:9636
- C:\Windows\System\uQkrMMw.exe
  C:\Windows\System\uQkrMMw.exe
  2⤵
  PID:9664
- C:\Windows\System\RgdbjtB.exe
  C:\Windows\System\RgdbjtB.exe
  2⤵
  PID:9688
- C:\Windows\System\mHuFUlW.exe
  C:\Windows\System\mHuFUlW.exe
  2⤵
  PID:9708
- C:\Windows\System\PiJALEF.exe
  C:\Windows\System\PiJALEF.exe
  2⤵
  PID:9724
- C:\Windows\System\mVGLXrd.exe
  C:\Windows\System\mVGLXrd.exe
  2⤵
  PID:9740
- C:\Windows\System\kKSnPLD.exe
  C:\Windows\System\kKSnPLD.exe
  2⤵
  PID:9756
- C:\Windows\System\mNuTCiV.exe
  C:\Windows\System\mNuTCiV.exe
  2⤵
  PID:9772
- C:\Windows\System\dQSgcpx.exe
  C:\Windows\System\dQSgcpx.exe
  2⤵
  PID:9788
- C:\Windows\System\udCmdlb.exe
  C:\Windows\System\udCmdlb.exe
  2⤵
  PID:9804
- C:\Windows\System\HuJgXaY.exe
  C:\Windows\System\HuJgXaY.exe
  2⤵
  PID:9824
- C:\Windows\System\rcfFEsk.exe
  C:\Windows\System\rcfFEsk.exe
  2⤵
  PID:9844
- C:\Windows\System\BhARbTg.exe
  C:\Windows\System\BhARbTg.exe
  2⤵
  PID:9860
- C:\Windows\System\tTIUIfG.exe
  C:\Windows\System\tTIUIfG.exe
  2⤵
  PID:9876
- C:\Windows\System\QfEebzv.exe
  C:\Windows\System\QfEebzv.exe
  2⤵
  PID:9896
- C:\Windows\System\hJuONMZ.exe
  C:\Windows\System\hJuONMZ.exe
  2⤵
  PID:9912
- C:\Windows\System\LqdPmfQ.exe
  C:\Windows\System\LqdPmfQ.exe
  2⤵
  PID:9936
- C:\Windows\System\YrEVklB.exe
  C:\Windows\System\YrEVklB.exe
  2⤵
  PID:9976
- C:\Windows\System\TTOwqby.exe
  C:\Windows\System\TTOwqby.exe
  2⤵
  PID:10000
- C:\Windows\System\AHojCgM.exe
  C:\Windows\System\AHojCgM.exe
  2⤵
  PID:10024
- C:\Windows\System\mbeAPYf.exe
  C:\Windows\System\mbeAPYf.exe
  2⤵
  PID:10056
- C:\Windows\System\VxskKRu.exe
  C:\Windows\System\VxskKRu.exe
  2⤵
  PID:10080
- C:\Windows\System\WIPYOko.exe
  C:\Windows\System\WIPYOko.exe
  2⤵
  PID:10096
- C:\Windows\System\whGjJCv.exe
  C:\Windows\System\whGjJCv.exe
  2⤵
  PID:10116
- C:\Windows\System\VTjABMH.exe
  C:\Windows\System\VTjABMH.exe
  2⤵
  PID:10140
- C:\Windows\System\uaVlgEL.exe
  C:\Windows\System\uaVlgEL.exe
  2⤵
  PID:10156
- C:\Windows\System\rrotHZQ.exe
  C:\Windows\System\rrotHZQ.exe
  2⤵
  PID:10184
- C:\Windows\System\DYcJkuA.exe
  C:\Windows\System\DYcJkuA.exe
  2⤵
  PID:10200
- C:\Windows\System\uRPpTaO.exe
  C:\Windows\System\uRPpTaO.exe
  2⤵
  PID:10224
- C:\Windows\System\QmtIAxp.exe
  C:\Windows\System\QmtIAxp.exe
  2⤵
  PID:8596
- C:\Windows\System\TgSbrgi.exe
  C:\Windows\System\TgSbrgi.exe
  2⤵
  PID:7276
- C:\Windows\System\iWTOzgy.exe
  C:\Windows\System\iWTOzgy.exe
  2⤵
  PID:8256
- C:\Windows\System\rgupKFG.exe
  C:\Windows\System\rgupKFG.exe
  2⤵
  PID:8296
- C:\Windows\System\CiyHjzp.exe
  C:\Windows\System\CiyHjzp.exe
  2⤵
  PID:8356
- C:\Windows\System\GHlbzQO.exe
  C:\Windows\System\GHlbzQO.exe
  2⤵
  PID:8208
- C:\Windows\System\EqvlECt.exe
  C:\Windows\System\EqvlECt.exe
  2⤵
  PID:8500
- C:\Windows\System\zdimMhM.exe
  C:\Windows\System\zdimMhM.exe
  2⤵
  PID:8112
- C:\Windows\System\pRbImpu.exe
  C:\Windows\System\pRbImpu.exe
  2⤵
  PID:5692
- C:\Windows\System\RGsbSqW.exe
  C:\Windows\System\RGsbSqW.exe
  2⤵
  PID:9004
- C:\Windows\System\quDrqCp.exe
  C:\Windows\System\quDrqCp.exe
  2⤵
  PID:7208
- C:\Windows\System\TCEPUiF.exe
  C:\Windows\System\TCEPUiF.exe
  2⤵
  PID:8968
- C:\Windows\System\rnTAjiS.exe
  C:\Windows\System\rnTAjiS.exe
  2⤵
  PID:9120
- C:\Windows\System\XrVXwUR.exe
  C:\Windows\System\XrVXwUR.exe
  2⤵
  PID:8620
- C:\Windows\System\jSABDGN.exe
  C:\Windows\System\jSABDGN.exe
  2⤵
  PID:9404
- C:\Windows\System\nKztSof.exe
  C:\Windows\System\nKztSof.exe
  2⤵
  PID:10264
- C:\Windows\System\LEIhIwg.exe
  C:\Windows\System\LEIhIwg.exe
  2⤵
  PID:10280
- C:\Windows\System\YkvJDQo.exe
  C:\Windows\System\YkvJDQo.exe
  2⤵
  PID:10296
- C:\Windows\System\ZXoMjSV.exe
  C:\Windows\System\ZXoMjSV.exe
  2⤵
  PID:10312
- C:\Windows\System\kwEUQpI.exe
  C:\Windows\System\kwEUQpI.exe
  2⤵
  PID:10328
- C:\Windows\System\hFhXDha.exe
  C:\Windows\System\hFhXDha.exe
  2⤵
  PID:10352
- C:\Windows\System\CytopnN.exe
  C:\Windows\System\CytopnN.exe
  2⤵
  PID:10376
- C:\Windows\System\ePCmDql.exe
  C:\Windows\System\ePCmDql.exe
  2⤵
  PID:10396
- C:\Windows\System\ZXptxCz.exe
  C:\Windows\System\ZXptxCz.exe
  2⤵
  PID:10416
- C:\Windows\System\hpLNgAg.exe
  C:\Windows\System\hpLNgAg.exe
  2⤵
  PID:10436
- C:\Windows\System\DRoRkcT.exe
  C:\Windows\System\DRoRkcT.exe
  2⤵
  PID:10456
- C:\Windows\System\okIMjOb.exe
  C:\Windows\System\okIMjOb.exe
  2⤵
  PID:10472
- C:\Windows\System\PIxjuuS.exe
  C:\Windows\System\PIxjuuS.exe
  2⤵
  PID:10500
- C:\Windows\System\smRmnQE.exe
  C:\Windows\System\smRmnQE.exe
  2⤵
  PID:10516
- C:\Windows\System\wpBlGEa.exe
  C:\Windows\System\wpBlGEa.exe
  2⤵
  PID:10532
- C:\Windows\System\hzpUiZB.exe
  C:\Windows\System\hzpUiZB.exe
  2⤵
  PID:10548
- C:\Windows\System\xexDNoP.exe
  C:\Windows\System\xexDNoP.exe
  2⤵
  PID:10564
- C:\Windows\System\ubtJmaH.exe
  C:\Windows\System\ubtJmaH.exe
  2⤵
  PID:10580
- C:\Windows\System\JDhbusz.exe
  C:\Windows\System\JDhbusz.exe
  2⤵
  PID:10600
- C:\Windows\System\TIegQDX.exe
  C:\Windows\System\TIegQDX.exe
  2⤵
  PID:10616
- C:\Windows\System\sEszJRp.exe
  C:\Windows\System\sEszJRp.exe
  2⤵
  PID:10632
- C:\Windows\System\QsKBDrb.exe
  C:\Windows\System\QsKBDrb.exe
  2⤵
  PID:10648
- C:\Windows\System\dATLmeg.exe
  C:\Windows\System\dATLmeg.exe
  2⤵
  PID:10664
- C:\Windows\System\fXhTXeA.exe
  C:\Windows\System\fXhTXeA.exe
  2⤵
  PID:10680
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10680 -s 240
    3⤵
    PID:10836
- C:\Windows\System\tNmsmPs.exe
  C:\Windows\System\tNmsmPs.exe
  2⤵
  PID:10696
- C:\Windows\System\zktYnUt.exe
  C:\Windows\System\zktYnUt.exe
  2⤵
  PID:10716
- C:\Windows\System\oICjouY.exe
  C:\Windows\System\oICjouY.exe
  2⤵
  PID:10732
- C:\Windows\System\UUKIiZp.exe
  C:\Windows\System\UUKIiZp.exe
  2⤵
  PID:10776
- C:\Windows\System\UuFEhKm.exe
  C:\Windows\System\UuFEhKm.exe
  2⤵
  PID:10800
- C:\Windows\System\BIxLHro.exe
  C:\Windows\System\BIxLHro.exe
  2⤵
  PID:10816
- C:\Windows\System\mMMEXig.exe
  C:\Windows\System\mMMEXig.exe
  2⤵
  PID:10840
- C:\Windows\System\cDPVtvq.exe
  C:\Windows\System\cDPVtvq.exe
  2⤵
  PID:10860
- C:\Windows\System\XHfYmJa.exe
  C:\Windows\System\XHfYmJa.exe
  2⤵
  PID:10884
- C:\Windows\System\sdTpfUs.exe
  C:\Windows\System\sdTpfUs.exe
  2⤵
  PID:10904
- C:\Windows\System\VneamAN.exe
  C:\Windows\System\VneamAN.exe
  2⤵
  PID:10924
- C:\Windows\System\UjZMrvb.exe
  C:\Windows\System\UjZMrvb.exe
  2⤵
  PID:10944
- C:\Windows\System\EcpqqGR.exe
  C:\Windows\System\EcpqqGR.exe
  2⤵
  PID:10968
- C:\Windows\System\mFiIbLY.exe
  C:\Windows\System\mFiIbLY.exe
  2⤵
  PID:10984
- C:\Windows\System\aZDTvgg.exe
  C:\Windows\System\aZDTvgg.exe
  2⤵
  PID:11008
- C:\Windows\System\KvIUlsT.exe
  C:\Windows\System\KvIUlsT.exe
  2⤵
  PID:11032
- C:\Windows\System\aFgjOmX.exe
  C:\Windows\System\aFgjOmX.exe
  2⤵
  PID:11056
- C:\Windows\System\gjCTXyj.exe
  C:\Windows\System\gjCTXyj.exe
  2⤵
  PID:11076
- C:\Windows\System\mxIhWDB.exe
  C:\Windows\System\mxIhWDB.exe
  2⤵
  PID:11100
- C:\Windows\System\ZiuGzip.exe
  C:\Windows\System\ZiuGzip.exe
  2⤵
  PID:11120
- C:\Windows\System\qydGakY.exe
  C:\Windows\System\qydGakY.exe
  2⤵
  PID:11136
- C:\Windows\System\VWcGMgW.exe
  C:\Windows\System\VWcGMgW.exe
  2⤵
  PID:11160
- C:\Windows\System\ypMMxtQ.exe
  C:\Windows\System\ypMMxtQ.exe
  2⤵
  PID:11176
- C:\Windows\System\aveYmGQ.exe
  C:\Windows\System\aveYmGQ.exe
  2⤵
  PID:11200
- C:\Windows\System\EFUaZbr.exe
  C:\Windows\System\EFUaZbr.exe
  2⤵
  PID:11224
- C:\Windows\System\QeqbLoM.exe
  C:\Windows\System\QeqbLoM.exe
  2⤵
  PID:11240
- C:\Windows\System\GfuKmss.exe
  C:\Windows\System\GfuKmss.exe
  2⤵
  PID:9428
- C:\Windows\System\VkKLszH.exe
  C:\Windows\System\VkKLszH.exe
  2⤵
  PID:9536
- C:\Windows\System\lUXsOVn.exe
  C:\Windows\System\lUXsOVn.exe
  2⤵
  PID:9612
- C:\Windows\System\DkvpbKZ.exe
  C:\Windows\System\DkvpbKZ.exe
  2⤵
  PID:9680
- C:\Windows\System\iGPJfXA.exe
  C:\Windows\System\iGPJfXA.exe
  2⤵
  PID:8664
- C:\Windows\System\OfcCpAW.exe
  C:\Windows\System\OfcCpAW.exe
  2⤵
  PID:8736
- C:\Windows\System\yVsSMOe.exe
  C:\Windows\System\yVsSMOe.exe
  2⤵
  PID:8796
- C:\Windows\System\pnubfjz.exe
  C:\Windows\System\pnubfjz.exe
  2⤵
  PID:8844
- C:\Windows\System\AkNQTxE.exe
  C:\Windows\System\AkNQTxE.exe
  2⤵
  PID:9764
- C:\Windows\System\RcEysPG.exe
  C:\Windows\System\RcEysPG.exe
  2⤵
  PID:9972
- C:\Windows\System\IdCHXaW.exe
  C:\Windows\System\IdCHXaW.exe
  2⤵
  PID:7968
- C:\Windows\System\YXwzHrl.exe
  C:\Windows\System\YXwzHrl.exe
  2⤵
  PID:10088
- C:\Windows\System\kfPszbB.exe
  C:\Windows\System\kfPszbB.exe
  2⤵
  PID:10112
- C:\Windows\System\fTXKYNL.exe
  C:\Windows\System\fTXKYNL.exe
  2⤵
  PID:9064
- C:\Windows\System\MTyWpaS.exe
  C:\Windows\System\MTyWpaS.exe
  2⤵
  PID:9164
- C:\Windows\System\AsRHzry.exe
  C:\Windows\System\AsRHzry.exe
  2⤵
  PID:7224
- C:\Windows\System\GwPBUCd.exe
  C:\Windows\System\GwPBUCd.exe
  2⤵
  PID:5236
- C:\Windows\System\VqtmJIu.exe
  C:\Windows\System\VqtmJIu.exe
  2⤵
  PID:8888
- C:\Windows\System\qXspxZu.exe
  C:\Windows\System\qXspxZu.exe
  2⤵
  PID:8452
- C:\Windows\System\XiXjVHZ.exe
  C:\Windows\System\XiXjVHZ.exe
  2⤵
  PID:6264
- C:\Windows\System\RQqFbtN.exe
  C:\Windows\System\RQqFbtN.exe
  2⤵
  PID:2540
- C:\Windows\System\RnAdscW.exe
  C:\Windows\System\RnAdscW.exe
  2⤵
  PID:4988
- C:\Windows\System\nqlbBOh.exe
  C:\Windows\System\nqlbBOh.exe
  2⤵
  PID:4280
- C:\Windows\System\BTOmHWH.exe
  C:\Windows\System\BTOmHWH.exe
  2⤵
  PID:11272
- C:\Windows\System\vpKYseU.exe
  C:\Windows\System\vpKYseU.exe
  2⤵
  PID:11300
- C:\Windows\System\qVoOyWz.exe
  C:\Windows\System\qVoOyWz.exe
  2⤵
  PID:11320
- C:\Windows\System\yhiIGkf.exe
  C:\Windows\System\yhiIGkf.exe
  2⤵
  PID:11336
- C:\Windows\System\sDlaqeB.exe
  C:\Windows\System\sDlaqeB.exe
  2⤵
  PID:11364
- C:\Windows\System\lRLkXzp.exe
  C:\Windows\System\lRLkXzp.exe
  2⤵
  PID:11388
- C:\Windows\System\bpCFURd.exe
  C:\Windows\System\bpCFURd.exe
  2⤵
  PID:11404
- C:\Windows\System\qpuBvdJ.exe
  C:\Windows\System\qpuBvdJ.exe
  2⤵
  PID:11428
- C:\Windows\System\YtQMEzW.exe
  C:\Windows\System\YtQMEzW.exe
  2⤵
  PID:11448
- C:\Windows\System\VLWRbST.exe
  C:\Windows\System\VLWRbST.exe
  2⤵
  PID:11468
- C:\Windows\System\AEbxYVf.exe
  C:\Windows\System\AEbxYVf.exe
  2⤵
  PID:11496
- C:\Windows\System\aAeNppL.exe
  C:\Windows\System\aAeNppL.exe
  2⤵
  PID:11520
- C:\Windows\System\YhKVzFg.exe
  C:\Windows\System\YhKVzFg.exe
  2⤵
  PID:11536
- C:\Windows\System\dbalnZj.exe
  C:\Windows\System\dbalnZj.exe
  2⤵
  PID:11560
- C:\Windows\System\JhDTSWT.exe
  C:\Windows\System\JhDTSWT.exe
  2⤵
  PID:11584
- C:\Windows\System\CJJMoSF.exe
  C:\Windows\System\CJJMoSF.exe
  2⤵
  PID:11608
- C:\Windows\System\gbQuCrL.exe
  C:\Windows\System\gbQuCrL.exe
  2⤵
  PID:11628
- C:\Windows\System\LUOuBmT.exe
  C:\Windows\System\LUOuBmT.exe
  2⤵
  PID:11648
- C:\Windows\System\jiEKljd.exe
  C:\Windows\System\jiEKljd.exe
  2⤵
  PID:11672
- C:\Windows\System\nrqBnFX.exe
  C:\Windows\System\nrqBnFX.exe
  2⤵
  PID:11688
- C:\Windows\System\rATaGFN.exe
  C:\Windows\System\rATaGFN.exe
  2⤵
  PID:11704
- C:\Windows\System\lxxhcww.exe
  C:\Windows\System\lxxhcww.exe
  2⤵
  PID:11732
- C:\Windows\System\DztzSGZ.exe
  C:\Windows\System\DztzSGZ.exe
  2⤵
  PID:11768
- C:\Windows\System\KOayhrN.exe
  C:\Windows\System\KOayhrN.exe
  2⤵
  PID:11788
- C:\Windows\System\eufvEuy.exe
  C:\Windows\System\eufvEuy.exe
  2⤵
  PID:11804
- C:\Windows\System\QUftWIM.exe
  C:\Windows\System\QUftWIM.exe
  2⤵
  PID:11828
- C:\Windows\System\WsQGnYQ.exe
  C:\Windows\System\WsQGnYQ.exe
  2⤵
  PID:11852
- C:\Windows\System\RvKiQCg.exe
  C:\Windows\System\RvKiQCg.exe
  2⤵
  PID:11868
- C:\Windows\System\XsTaeII.exe
  C:\Windows\System\XsTaeII.exe
  2⤵
  PID:11892
- C:\Windows\System\FnqidqA.exe
  C:\Windows\System\FnqidqA.exe
  2⤵
  PID:11924
- C:\Windows\System\uckuwcD.exe
  C:\Windows\System\uckuwcD.exe
  2⤵
  PID:11940
- C:\Windows\System\cNeJEds.exe
  C:\Windows\System\cNeJEds.exe
  2⤵
  PID:11968
- C:\Windows\System\EgNLnQf.exe
  C:\Windows\System\EgNLnQf.exe
  2⤵
  PID:11984
- C:\Windows\System\FIpFSlP.exe
  C:\Windows\System\FIpFSlP.exe
  2⤵
  PID:12008
- C:\Windows\System\qDKBjur.exe
  C:\Windows\System\qDKBjur.exe
  2⤵
  PID:12040
- C:\Windows\System\TqQvhZB.exe
  C:\Windows\System\TqQvhZB.exe
  2⤵
  PID:12068
- C:\Windows\System\eoiqkMS.exe
  C:\Windows\System\eoiqkMS.exe
  2⤵
  PID:12096
- C:\Windows\System\tKwVBzq.exe
  C:\Windows\System\tKwVBzq.exe
  2⤵
  PID:12112
- C:\Windows\System\cUzSwik.exe
  C:\Windows\System\cUzSwik.exe
  2⤵
  PID:12156
- C:\Windows\System\syXxfgt.exe
  C:\Windows\System\syXxfgt.exe
  2⤵
  PID:12172
- C:\Windows\System\hdUilgX.exe
  C:\Windows\System\hdUilgX.exe
  2⤵
  PID:12196
- C:\Windows\System\vDJAWts.exe
  C:\Windows\System\vDJAWts.exe
  2⤵
  PID:12224
- C:\Windows\System\YtqcTBf.exe
  C:\Windows\System\YtqcTBf.exe
  2⤵
  PID:12248
- C:\Windows\System\coRwHef.exe
  C:\Windows\System\coRwHef.exe
  2⤵
  PID:12272
- C:\Windows\System\SAPazcC.exe
  C:\Windows\System\SAPazcC.exe
  2⤵
  PID:10272
- C:\Windows\System\WBbpFPw.exe
  C:\Windows\System\WBbpFPw.exe
  2⤵
  PID:10432
- C:\Windows\System\paniCyw.exe
  C:\Windows\System\paniCyw.exe
  2⤵
  PID:1636
- C:\Windows\System\gOmJhaV.exe
  C:\Windows\System\gOmJhaV.exe
  2⤵
  PID:8300
- C:\Windows\System\myzveLv.exe
  C:\Windows\System\myzveLv.exe
  2⤵
  PID:1068
- C:\Windows\System\xboYoMf.exe
  C:\Windows\System\xboYoMf.exe
  2⤵
  PID:9796
- C:\Windows\System\TaOOflc.exe
  C:\Windows\System\TaOOflc.exe
  2⤵
  PID:10708
- C:\Windows\System\REBARsJ.exe
  C:\Windows\System\REBARsJ.exe
  2⤵
  PID:1384
- C:\Windows\System\rMzKUbR.exe
  C:\Windows\System\rMzKUbR.exe
  2⤵
  PID:10872
- C:\Windows\System\tuyprcw.exe
  C:\Windows\System\tuyprcw.exe
  2⤵
  PID:6396
- C:\Windows\System\VmBiZzn.exe
  C:\Windows\System\VmBiZzn.exe
  2⤵
  PID:6736
- C:\Windows\System\jhoRUjV.exe
  C:\Windows\System\jhoRUjV.exe
  2⤵
  PID:11236
- C:\Windows\System\MDjWbQw.exe
  C:\Windows\System\MDjWbQw.exe
  2⤵
  PID:9512
- C:\Windows\System\biVjyda.exe
  C:\Windows\System\biVjyda.exe
  2⤵
  PID:4924
- C:\Windows\System\GdblskH.exe
  C:\Windows\System\GdblskH.exe
  2⤵
  PID:9960
- C:\Windows\System\rVezImv.exe
  C:\Windows\System\rVezImv.exe
  2⤵
  PID:8948
- C:\Windows\System\vUsKkwd.exe
  C:\Windows\System\vUsKkwd.exe
  2⤵
  PID:1920
- C:\Windows\System\waJHCEj.exe
  C:\Windows\System\waJHCEj.exe
  2⤵
  PID:9276
- C:\Windows\System\KRyjtmA.exe
  C:\Windows\System\KRyjtmA.exe
  2⤵
  PID:9316
- C:\Windows\System\aWEQafZ.exe
  C:\Windows\System\aWEQafZ.exe
  2⤵
  PID:9092
- C:\Windows\System\ysSxkxR.exe
  C:\Windows\System\ysSxkxR.exe
  2⤵
  PID:2208
- C:\Windows\System\NCChFAG.exe
  C:\Windows\System\NCChFAG.exe
  2⤵
  PID:9448
- C:\Windows\System\HilUDjq.exe
  C:\Windows\System\HilUDjq.exe
  2⤵
  PID:9492
- C:\Windows\System\RqLnYwM.exe
  C:\Windows\System\RqLnYwM.exe
  2⤵
  PID:9564
- C:\Windows\System\bKtFgcv.exe
  C:\Windows\System\bKtFgcv.exe
  2⤵
  PID:9660
- C:\Windows\System\qEnxLsv.exe
  C:\Windows\System\qEnxLsv.exe
  2⤵
  PID:12304
- C:\Windows\System\sMPQOdm.exe
  C:\Windows\System\sMPQOdm.exe
  2⤵
  PID:12320
- C:\Windows\System\GxVShZE.exe
  C:\Windows\System\GxVShZE.exe
  2⤵
  PID:12336
- C:\Windows\System\LepYZGs.exe
  C:\Windows\System\LepYZGs.exe
  2⤵
  PID:12352
- C:\Windows\System\vEbaxAt.exe
  C:\Windows\System\vEbaxAt.exe
  2⤵
  PID:12384
- C:\Windows\System\dfyThtP.exe
  C:\Windows\System\dfyThtP.exe
  2⤵
  PID:12408
- C:\Windows\System\xDxTUgF.exe
  C:\Windows\System\xDxTUgF.exe
  2⤵
  PID:12432
- C:\Windows\System\GbqrHbt.exe
  C:\Windows\System\GbqrHbt.exe
  2⤵
  PID:12448
- C:\Windows\System\FhqiHqq.exe
  C:\Windows\System\FhqiHqq.exe
  2⤵
  PID:12476
- C:\Windows\System\CRcSqZg.exe
  C:\Windows\System\CRcSqZg.exe
  2⤵
  PID:12492
- C:\Windows\System\hTsmPkz.exe
  C:\Windows\System\hTsmPkz.exe
  2⤵
  PID:12520
- C:\Windows\System\JJxgmMR.exe
  C:\Windows\System\JJxgmMR.exe
  2⤵
  PID:12536
- C:\Windows\System\HaWnyda.exe
  C:\Windows\System\HaWnyda.exe
  2⤵
  PID:12560
- C:\Windows\System\FHKgKuL.exe
  C:\Windows\System\FHKgKuL.exe
  2⤵
  PID:12580
- C:\Windows\System\yQkOYee.exe
  C:\Windows\System\yQkOYee.exe
  2⤵
  PID:12604
- C:\Windows\System\fyAzgTw.exe
  C:\Windows\System\fyAzgTw.exe
  2⤵
  PID:12620
- C:\Windows\System\cOjPYbz.exe
  C:\Windows\System\cOjPYbz.exe
  2⤵
  PID:12652
- C:\Windows\System\YhSQzcy.exe
  C:\Windows\System\YhSQzcy.exe
  2⤵
  PID:12672
- C:\Windows\System\wnoeEAR.exe
  C:\Windows\System\wnoeEAR.exe
  2⤵
  PID:12696
- C:\Windows\System\dHEyXxT.exe
  C:\Windows\System\dHEyXxT.exe
  2⤵
  PID:12716
- C:\Windows\System\BSYThUs.exe
  C:\Windows\System\BSYThUs.exe
  2⤵
  PID:11436
- C:\Windows\System\JlNxmmo.exe
  C:\Windows\System\JlNxmmo.exe
  2⤵
  PID:10748
- C:\Windows\System\LREeNcT.exe
  C:\Windows\System\LREeNcT.exe
  2⤵
  PID:10756
- C:\Windows\System\SxgaMxZ.exe
  C:\Windows\System\SxgaMxZ.exe
  2⤵
  PID:11636
- C:\Windows\System\YNtGWLM.exe
  C:\Windows\System\YNtGWLM.exe
  2⤵
  PID:10784
- C:\Windows\System\QvCUIov.exe
  C:\Windows\System\QvCUIov.exe
  2⤵
  PID:10152
- C:\Windows\System\gqvGHji.exe
  C:\Windows\System\gqvGHji.exe
  2⤵
  PID:10208
- C:\Windows\System\MXZrrNH.exe
  C:\Windows\System\MXZrrNH.exe
  2⤵
  PID:12184
- C:\Windows\System\HWjfBqw.exe
  C:\Windows\System\HWjfBqw.exe
  2⤵
  PID:11532
- C:\Windows\System\JJxkLwu.exe
  C:\Windows\System\JJxkLwu.exe
  2⤵
  PID:11660
- C:\Windows\System\MYasvnU.exe
  C:\Windows\System\MYasvnU.exe
  2⤵
  PID:12108
- C:\Windows\System\crnnPdk.exe
  C:\Windows\System\crnnPdk.exe
  2⤵
  PID:4236
- C:\Windows\System\BIPnKDx.exe
  C:\Windows\System\BIPnKDx.exe
  2⤵
  PID:8772
- C:\Windows\System\aDcjzST.exe
  C:\Windows\System\aDcjzST.exe
  2⤵
  PID:10448
- C:\Windows\System\slAPQvB.exe
  C:\Windows\System\slAPQvB.exe
  2⤵
  PID:10076
- C:\Windows\System\jcvNAVX.exe
  C:\Windows\System\jcvNAVX.exe
  2⤵
  PID:6624
- C:\Windows\System\xtAKqMY.exe
  C:\Windows\System\xtAKqMY.exe
  2⤵
  PID:6488
- C:\Windows\System\LAAsgZJ.exe
  C:\Windows\System\LAAsgZJ.exe
  2⤵
  PID:860
- C:\Windows\System\MoKMEge.exe
  C:\Windows\System\MoKMEge.exe
  2⤵
  PID:9388
- C:\Windows\System\xLksOvi.exe
  C:\Windows\System\xLksOvi.exe
  2⤵
  PID:1136
- C:\Windows\System\oSWAMZo.exe
  C:\Windows\System\oSWAMZo.exe
  2⤵
  PID:12472
- C:\Windows\System\gsDDXaH.exe
  C:\Windows\System\gsDDXaH.exe
  2⤵
  PID:12440
- C:\Windows\System\IQcydRj.exe
  C:\Windows\System\IQcydRj.exe
  2⤵
  PID:12416
- C:\Windows\System\XuznRYj.exe
  C:\Windows\System\XuznRYj.exe
  2⤵
  PID:12376
- C:\Windows\System\BVUBXbd.exe
  C:\Windows\System\BVUBXbd.exe
  2⤵
  PID:12544
- C:\Windows\System\MjveXYv.exe
  C:\Windows\System\MjveXYv.exe
  2⤵
  PID:12576
- C:\Windows\System\xiWVCeS.exe
  C:\Windows\System\xiWVCeS.exe
  2⤵
  PID:12640
- C:\Windows\System\nQPEJOw.exe
  C:\Windows\System\nQPEJOw.exe
  2⤵
  PID:12680
- C:\Windows\System\CxfwCyJ.exe
  C:\Windows\System\CxfwCyJ.exe
  2⤵
  PID:12728
- C:\Windows\System\xQhMkyu.exe
  C:\Windows\System\xQhMkyu.exe
  2⤵
  PID:12800
- C:\Windows\System\pPPiWMa.exe
  C:\Windows\System\pPPiWMa.exe
  2⤵
  PID:12876
- C:\Windows\System\DysDYdH.exe
  C:\Windows\System\DysDYdH.exe
  2⤵
  PID:8768
- C:\Windows\System\hqQsMqL.exe
  C:\Windows\System\hqQsMqL.exe
  2⤵
  PID:10348
- C:\Windows\System\xOQjYhB.exe
  C:\Windows\System\xOQjYhB.exe
  2⤵
  PID:13068
- C:\Windows\System\EFDsiaB.exe
  C:\Windows\System\EFDsiaB.exe
  2⤵
  PID:2836
- C:\Windows\System\tNWWxaw.exe
  C:\Windows\System\tNWWxaw.exe
  2⤵
  PID:3940
- C:\Windows\System\jhQXeJW.exe
  C:\Windows\System\jhQXeJW.exe
  2⤵
  PID:13308
- C:\Windows\System\CZbGfUc.exe
  C:\Windows\System\CZbGfUc.exe
  2⤵
  PID:9696
- C:\Windows\System\ChgHixg.exe
  C:\Windows\System\ChgHixg.exe
  2⤵
  PID:11488
- C:\Windows\System\ICvPNCq.exe
  C:\Windows\System\ICvPNCq.exe
  2⤵
  PID:10128
- C:\Windows\System\ugAfVMA.exe
  C:\Windows\System\ugAfVMA.exe
  2⤵
  PID:4516
- C:\Windows\System\XuAobuB.exe
  C:\Windows\System\XuAobuB.exe
  2⤵
  PID:436
- C:\Windows\System\hWdrHtH.exe
  C:\Windows\System\hWdrHtH.exe
  2⤵
  PID:11680
- C:\Windows\System\lmnLMEE.exe
  C:\Windows\System\lmnLMEE.exe
  2⤵
  PID:11932
- C:\Windows\System\NSQKHNp.exe
  C:\Windows\System\NSQKHNp.exe
  2⤵
  PID:8700
- C:\Windows\System\UxqPCyh.exe
  C:\Windows\System\UxqPCyh.exe
  2⤵
  PID:12016
- C:\Windows\System\VeYoFkI.exe
  C:\Windows\System\VeYoFkI.exe
  2⤵
  PID:10540
- C:\Windows\System\uDwlqnE.exe
  C:\Windows\System\uDwlqnE.exe
  2⤵
  PID:10392
- C:\Windows\System\SqSnwnC.exe
  C:\Windows\System\SqSnwnC.exe
  2⤵
  PID:10304
- C:\Windows\System\srJiBYs.exe
  C:\Windows\System\srJiBYs.exe
  2⤵
  PID:10964
- C:\Windows\System\ATgszhC.exe
  C:\Windows\System\ATgszhC.exe
  2⤵
  PID:11116
- C:\Windows\System\tGmMJCp.exe
  C:\Windows\System\tGmMJCp.exe
  2⤵
  PID:11004
- C:\Windows\System\acGnUTp.exe
  C:\Windows\System\acGnUTp.exe
  2⤵
  PID:10960
- C:\Windows\System\qeUWgmq.exe
  C:\Windows\System\qeUWgmq.exe
  2⤵
  PID:8900
- C:\Windows\System\RbPeqSp.exe
  C:\Windows\System\RbPeqSp.exe
  2⤵
  PID:8372
- C:\Windows\System\EwqdztU.exe
  C:\Windows\System\EwqdztU.exe
  2⤵
  PID:9180
- C:\Windows\System\xNlzbsq.exe
  C:\Windows\System\xNlzbsq.exe
  2⤵
  PID:10364
- C:\Windows\System\pBQPDVA.exe
  C:\Windows\System\pBQPDVA.exe
  2⤵
  PID:2524
- C:\Windows\System\khYImrc.exe
  C:\Windows\System\khYImrc.exe
  2⤵
  PID:3680
- C:\Windows\System\OUEOGXF.exe
  C:\Windows\System\OUEOGXF.exe
  2⤵
  PID:5064
- C:\Windows\System\XldgyzG.exe
  C:\Windows\System\XldgyzG.exe
  2⤵
  PID:11656
- C:\Windows\System\OKOPsSr.exe
  C:\Windows\System\OKOPsSr.exe
  2⤵
  PID:12092
- C:\Windows\System\JTlqmuU.exe
  C:\Windows\System\JTlqmuU.exe
  2⤵
  PID:11992
- C:\Windows\System\JKyWbra.exe
  C:\Windows\System\JKyWbra.exe
  2⤵
  PID:4172
- C:\Windows\System\RjRxher.exe
  C:\Windows\System\RjRxher.exe
  2⤵
  PID:12740
- C:\Windows\System\FKHENSa.exe
  C:\Windows\System\FKHENSa.exe
  2⤵
  PID:4428
- C:\Windows\System\RrcITnF.exe
  C:\Windows\System\RrcITnF.exe
  2⤵
  PID:4140
- C:\Windows\System\oycAWdc.exe
  C:\Windows\System\oycAWdc.exe
  2⤵
  PID:3532
- C:\Windows\System\nEMpdvU.exe
  C:\Windows\System\nEMpdvU.exe
  2⤵
  PID:10836
- C:\Windows\System\VwAHegm.exe
  C:\Windows\System\VwAHegm.exe
  2⤵
  PID:11880
- C:\Windows\System\BwnyIDa.exe
  C:\Windows\System\BwnyIDa.exe
  2⤵
  PID:13128
- C:\Windows\System\LtINPIb.exe
  C:\Windows\System\LtINPIb.exe
  2⤵
  PID:12664
- C:\Windows\System\pcfCrgK.exe
  C:\Windows\System\pcfCrgK.exe
  2⤵
  PID:4464
- C:\Windows\System\KDnTbrz.exe
  C:\Windows\System\KDnTbrz.exe
  2⤵
  PID:12860
- C:\Windows\System\bTSPuoD.exe
  C:\Windows\System\bTSPuoD.exe
  2⤵
  PID:12488
- C:\Windows\System\NbGlDMV.exe
  C:\Windows\System\NbGlDMV.exe
  2⤵
  PID:948
- C:\Windows\System\zorOeYP.exe
  C:\Windows\System\zorOeYP.exe
  2⤵
  PID:12668
- C:\Windows\System\sGLiDQd.exe
  C:\Windows\System\sGLiDQd.exe
  2⤵
  PID:11696
- C:\Windows\System\IWmcFXv.exe
  C:\Windows\System\IWmcFXv.exe
  2⤵
  PID:10932
- C:\Windows\System\UZxvPhW.exe
  C:\Windows\System\UZxvPhW.exe
  2⤵
  PID:7648
- C:\Windows\System\TgfoJcK.exe
  C:\Windows\System\TgfoJcK.exe
  2⤵
  PID:916
- C:\Windows\System\jJpOLBP.exe
  C:\Windows\System\jJpOLBP.exe
  2⤵
  PID:3092
- C:\Windows\System\Ywwnvpl.exe
  C:\Windows\System\Ywwnvpl.exe
  2⤵
  PID:6948
- C:\Windows\System\HTCBIXr.exe
  C:\Windows\System\HTCBIXr.exe
  2⤵
  PID:12104
- C:\Windows\System\tXuMytf.exe
  C:\Windows\System\tXuMytf.exe
  2⤵
  PID:6276
- C:\Windows\System\VpCvYGZ.exe
  C:\Windows\System\VpCvYGZ.exe
  2⤵
  PID:896
- C:\Windows\System\BeyqLbU.exe
  C:\Windows\System\BeyqLbU.exe
  2⤵
  PID:9676
- C:\Windows\System\hPIhfCh.exe
  C:\Windows\System\hPIhfCh.exe
  2⤵
  PID:12852
- C:\Windows\System\MrHjgsF.exe
  C:\Windows\System\MrHjgsF.exe
  2⤵
  PID:10192
- C:\Windows\System\WcjIXsa.exe
  C:\Windows\System\WcjIXsa.exe
  2⤵
  PID:10728
- C:\Windows\System\cCTEdPt.exe
  C:\Windows\System\cCTEdPt.exe
  2⤵
  PID:12660
- C:\Windows\System\WvIfweU.exe
  C:\Windows\System\WvIfweU.exe
  2⤵
  PID:9856
- C:\Windows\System\LcHspkT.exe
  C:\Windows\System\LcHspkT.exe
  2⤵
  PID:13120
- C:\Windows\System\ryMxQNx.exe
  C:\Windows\System\ryMxQNx.exe
  2⤵
  PID:1960
- C:\Windows\System\ZTCFoFr.exe
  C:\Windows\System\ZTCFoFr.exe
  2⤵
  PID:12188
- C:\Windows\System\qplwpvb.exe
  C:\Windows\System\qplwpvb.exe
  2⤵
  PID:8816
- C:\Windows\System\gPMlyVx.exe
  C:\Windows\System\gPMlyVx.exe
  2⤵
  PID:13332
- C:\Windows\System\idLSfTm.exe
  C:\Windows\System\idLSfTm.exe
  2⤵
  PID:13380
- C:\Windows\System\xCoxrig.exe
  C:\Windows\System\xCoxrig.exe
  2⤵
  PID:13400
- C:\Windows\System\VdbQpqJ.exe
  C:\Windows\System\VdbQpqJ.exe
  2⤵
  PID:13416
- C:\Windows\System\SSbJRfp.exe
  C:\Windows\System\SSbJRfp.exe
  2⤵
  PID:13516
- C:\Windows\System\mQaSTob.exe
  C:\Windows\System\mQaSTob.exe
  2⤵
  PID:13540
- C:\Windows\System\iNBBKEJ.exe
  C:\Windows\System\iNBBKEJ.exe
  2⤵
  PID:13560
- C:\Windows\System\DuEdDCb.exe
  C:\Windows\System\DuEdDCb.exe
  2⤵
  PID:13580
- C:\Windows\System\EqJIACR.exe
  C:\Windows\System\EqJIACR.exe
  2⤵
  PID:13764
- C:\Windows\System\vZWLmbn.exe
  C:\Windows\System\vZWLmbn.exe
  2⤵
  PID:13948
- C:\Windows\System\HteeoPb.exe
  C:\Windows\System\HteeoPb.exe
  2⤵
  PID:13964
- C:\Windows\System\uvXitti.exe
  C:\Windows\System\uvXitti.exe
  2⤵
  PID:14008
- C:\Windows\System\NquOcAN.exe
  C:\Windows\System\NquOcAN.exe
  2⤵
  PID:14024
- C:\Windows\System\UwhcFDC.exe
  C:\Windows\System\UwhcFDC.exe
  2⤵
  PID:14048
- C:\Windows\System\lDcCnfb.exe
  C:\Windows\System\lDcCnfb.exe
  2⤵
  PID:14064
- C:\Windows\System\qxtDnMw.exe
  C:\Windows\System\qxtDnMw.exe
  2⤵
  PID:14088
- C:\Windows\System\uFMAYbw.exe
  C:\Windows\System\uFMAYbw.exe
  2⤵
  PID:14192
- C:\Windows\System\lukvDJW.exe
  C:\Windows\System\lukvDJW.exe
  2⤵
  PID:14208
- C:\Windows\System\PWuALEf.exe
  C:\Windows\System\PWuALEf.exe
  2⤵
  PID:14228
- C:\Windows\System\FqtlXqz.exe
  C:\Windows\System\FqtlXqz.exe
  2⤵
  PID:2684
- C:\Windows\System\IDEmQHn.exe
  C:\Windows\System\IDEmQHn.exe
  2⤵
  PID:5208
- C:\Windows\System\EFAyKSl.exe
  C:\Windows\System\EFAyKSl.exe
  2⤵
  PID:13576
- C:\Windows\System\slUyQTG.exe
  C:\Windows\System\slUyQTG.exe
  2⤵
  PID:14148
- C:\Windows\System\pygvSqp.exe
  C:\Windows\System\pygvSqp.exe
  2⤵
  PID:11024
- C:\Windows\System\MDPwqzs.exe
  C:\Windows\System\MDPwqzs.exe
  2⤵
  PID:6944
- C:\Windows\System\McxGiMm.exe
  C:\Windows\System\McxGiMm.exe
  2⤵
  PID:6072
- C:\Windows\System\TPlUpKE.exe
  C:\Windows\System\TPlUpKE.exe
  2⤵
  PID:9560
- C:\Windows\System\nmUOXPq.exe
  C:\Windows\System\nmUOXPq.exe
  2⤵
  PID:13328
- C:\Windows\System\SDOWnfd.exe
  C:\Windows\System\SDOWnfd.exe
  2⤵
  PID:4064
- C:\Windows\System\oQSALzR.exe
  C:\Windows\System\oQSALzR.exe
  2⤵
  PID:13148
- C:\Windows\System\CNbhwVf.exe
  C:\Windows\System\CNbhwVf.exe
  2⤵
  PID:452
- C:\Windows\System\MrKOuXY.exe
  C:\Windows\System\MrKOuXY.exe
  2⤵
  PID:6912
- C:\Windows\System\YwGhDmt.exe
  C:\Windows\System\YwGhDmt.exe
  2⤵
  PID:13396
- C:\Windows\System\QFXDruF.exe
  C:\Windows\System\QFXDruF.exe
  2⤵
  PID:13596
- C:\Windows\System\rRNLDcn.exe
  C:\Windows\System\rRNLDcn.exe
  2⤵
  PID:13464
- C:\Windows\System\UqIOyPl.exe
  C:\Windows\System\UqIOyPl.exe
  2⤵
  PID:13552
- C:\Windows\System\uiFiPma.exe
  C:\Windows\System\uiFiPma.exe
  2⤵
  PID:13620
- C:\Windows\System\QmKczyj.exe
  C:\Windows\System\QmKczyj.exe
  2⤵
  PID:13776
- C:\Windows\System\tiYOBCb.exe
  C:\Windows\System\tiYOBCb.exe
  2⤵
  PID:13956
- C:\Windows\System\HsWBKyN.exe
  C:\Windows\System\HsWBKyN.exe
  2⤵
  PID:13988
- C:\Windows\System\dutlIZT.exe
  C:\Windows\System\dutlIZT.exe
  2⤵
  PID:6940
- C:\Windows\System\pyYdfnL.exe
  C:\Windows\System\pyYdfnL.exe
  2⤵
  PID:7820
- C:\Windows\System\uFYyWzX.exe
  C:\Windows\System\uFYyWzX.exe
  2⤵
  PID:14220
- C:\Windows\System\gJAULBP.exe
  C:\Windows\System\gJAULBP.exe
  2⤵
  PID:14276
- C:\Windows\System\tbzFdTk.exe
  C:\Windows\System\tbzFdTk.exe
  2⤵
  PID:14284
- C:\Windows\System\HEizyFB.exe
  C:\Windows\System\HEizyFB.exe
  2⤵
  PID:14320
- C:\Windows\System\toLTwoE.exe
  C:\Windows\System\toLTwoE.exe
  2⤵
  PID:14332
- C:\Windows\System\tvFymMN.exe
  C:\Windows\System\tvFymMN.exe
  2⤵
  PID:6500
- C:\Windows\System\JeNStpp.exe
  C:\Windows\System\JeNStpp.exe
  2⤵
  PID:13820
- C:\Windows\System\HstnYDG.exe
  C:\Windows\System\HstnYDG.exe
  2⤵
  PID:13360
- C:\Windows\System\VPgyczD.exe
  C:\Windows\System\VPgyczD.exe
  2⤵
  PID:13556
- C:\Windows\System\IuFisYU.exe
  C:\Windows\System\IuFisYU.exe
  2⤵
  PID:13740
- C:\Windows\System\drRDPMG.exe
  C:\Windows\System\drRDPMG.exe
  2⤵
  PID:14272
- C:\Windows\System\gTrvHVU.exe
  C:\Windows\System\gTrvHVU.exe
  2⤵
  PID:412
- C:\Windows\System\oOvPjfy.exe
  C:\Windows\System\oOvPjfy.exe
  2⤵
  PID:13800

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 492 -p 8900 -ip 8900
1⤵
PID:10932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vw1znwkp.35i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EWhcVGK.exe

Filesize
1.4MB

MD5
d66d59f7ba11c7b6f63fd31ac7861473

SHA1
f04d98fd922eec0bba1f3a108c48a06a45f0d8d8

SHA256
35cb5244e087631d0b4fe4abc4b85d53f31981b7f7fa59e6547f9a112a1143a5

SHA512
5493f52ebf10380f0b92b252a41b607060c96ae0b5dc7e465d56be6c703ae8b3550f62a1479980798db7140cc5f5c0bd001aa1fc2ec7da4dc7427c3479992bf1

Download Submit
C:\Windows\System\HMYwndk.exe

Filesize
1.4MB

MD5
223716f2e6a51ad873bb1251bc7f7dc3

SHA1
d1d0820cbb4e70bdb38e22d748e2a00880b01263

SHA256
3655b54e85d274ff454423e34787da2c3bfaf2882e10283b50be6ec38de6eb0d

SHA512
b886215d7df5469f1adcacfd1dc12bb4f7cdce3073fa14c4ad991034f81c1c64afc6809ce81c61f6c8768f612f8a64a16fbea76cef0be512a312e96ef440e6f7

Download Submit
C:\Windows\System\IJNnQTM.exe

Filesize
1.4MB

MD5
03ead975c95168975597d15c5b88fd83

SHA1
3a8ea43ae3c83544f95925af3b7014fc4c3ccab0

SHA256
2b76ea57346f2b76522339e133a8da4a2119e44b17f07007cd50e337acf87d74

SHA512
08bc94650b51409fb66cbdd4325d425ceabf8cb44b857e24ba3416a215f1dd76aba45b5e540ff1974f24fc10a42c60bb29aeac8e058f468ca57ee651a63f1693

Download Submit
C:\Windows\System\IKCtOjd.exe

Filesize
1.4MB

MD5
a5603cfec8777542114b7c8982cdbb53

SHA1
22a069547e4bf496cb32c7671493d211ebd723ac

SHA256
de1f5cb9299dee2df386f74a8f9c87140446bc4cd077d7388b131656fa6cf427

SHA512
c1799b7bcf173355c93cd4d5a54b835949ed0fd76f9aaa8c46243ee908529e171f22905b58feb95c6a91ec06afcc87913e562c088259f3c3a5dc6aea44f619bf

Download Submit
C:\Windows\System\IVnWPkf.exe

Filesize
1.4MB

MD5
41690ea0f0335f30542bc64400ded605

SHA1
4feff6852469d00299deab591210bb0781098648

SHA256
711d2f317802ac365bac0880181d2249c5c666ae67915dde98a175ff8f8d8a57

SHA512
e2aa5c9823003768be2892ef5e998377f17ddada90343326b772a4b016441ac49ecff04cc10c4140baee433ce2e18675bb656a972724dbd2bc00cd45e7ab5ad7

Download Submit
C:\Windows\System\JKsIHRe.exe

Filesize
1.4MB

MD5
511f626776d8ba9ebb037eed7f2178d7

SHA1
e22a2b7569f8c297c268c10480ec9217d9510884

SHA256
0dd1285fadc4736e976287284388e1525f727dcfcfea9ab2fe0448ac3a9bc491

SHA512
9e9f338e579373d7a70c20648d604e94bb4bce1657ffa8425ff052d59c8770a0652b291e4b01adbcfa42c8e6a018d63f8198a05cc011434235dc03499ca22289

Download Submit
C:\Windows\System\KkTIMGq.exe

Filesize
1.4MB

MD5
4a7f42a27703b55570672c14351f853e

SHA1
af4b4c681719157f26eab26926e544dc87019b6d

SHA256
0b7b67e44a84eb112456138f4010d66381c268c0bccca0f20458f2305d029a56

SHA512
e047e75ca24445744bafb056f1430c2aec9b95bcf6e966e0fd78db05de7fbf41f161a9f3e8851ceffcefc32c9e1adb406c3ca246a1e7feb9a99071be37e1175e

Download Submit
C:\Windows\System\KoTfvdD.exe

Filesize
1.4MB

MD5
d13f8d7391be87800f4bca637a043b9e

SHA1
cb47ca791331a3375ff6f9f506d675f4b1499716

SHA256
e56d959206d89e788f381d8faee876763d1f2e0c7cdeb38b0aa528ea38524366

SHA512
87b751040c6fdcdea1e53dc9ccff4b720c4b0dcafc96853c2cd120465ec124e659f71544c31e584177f4f053c1b469872d1237700b764847d261fc8ad03f892e

Download Submit
C:\Windows\System\MYQIhRq.exe

Filesize
1.4MB

MD5
02099aa6f9fd6b250d62c9848a414730

SHA1
0412fca0cc252ca467f8f8e0a3fcc4b1d4138709

SHA256
ac6da104165d1865329000fb9f180d2a48fee1b1fefcc043e580ebf5ed6758aa

SHA512
a10ac57aede30a5e54916ac84e1a0485a5c19e2eab91f8b891a3944a36c24eb323811553696e1ac13327cf6616b590848e7edcaf1dd4be3f13b49138da5a3241

Download Submit
C:\Windows\System\MjrEZRN.exe

Filesize
1.4MB

MD5
235480bbda234608b2b93326ca79018a

SHA1
bcb12a00030f7e42bf1008fd38c4246553587130

SHA256
75161d61e97c3c9f4972c3be77be49fac92f4744f585c683e16b201800a21a81

SHA512
d2ee612f5972c0023ac3f50bed3ddc40b3164199220622e98b89fc6e149fb07a77a7579af9bb252dd73e0efea03b05d779cc34bdaff22249855f00f5605511aa

Download Submit
C:\Windows\System\QsbtirH.exe

Filesize
1.4MB

MD5
6f73a662aa7a53f8d3541cfd0a136ba5

SHA1
478da87408f9e4fbf9f461d9b9cab3e3f5719759

SHA256
8d9dc41c1086c9b7e2fccb2eb36c8fbb37984b3ffae54afa08bfa999fd2870d4

SHA512
00a577b599946225ba0799d04f2dc53b17e4dbce0820f2f41516058d552657324fff70436988290c1060b2e590a7722a12fbd1e69d011c2659e1ef8815634779

Download Submit
C:\Windows\System\RFlsqTa.exe

Filesize
1.4MB

MD5
98d659171a45a01592b23ba140e1d82c

SHA1
e99fcaa97c11a4906375b45c0ec24c35a8ce1e97

SHA256
a9427b16502bdb410dc5a6755c9f284f475be871d9b10dca4a1418dd53dc7c27

SHA512
a70cf02843ff60b9622ee454163e8125b079b5b5ff1c70dfc3e4d8c2456c84427d51c02daf416e4e2f24df784908a196f346092fe70f797622e406d366e4d8f7

Download Submit
C:\Windows\System\SMTREvc.exe

Filesize
1.4MB

MD5
ed7536e09acb283e82fb11d96c226969

SHA1
b61c54262351f77933831a4db58fec6b3d4da5c8

SHA256
5d231f9534286af3838a5697d84f8177bddcd27887148c25bcb3800604a0654e

SHA512
34bd7f6cd95fd0238b13392fcffca1a19d41676e554108e930b3f1f160711412756ee8048118c628c5b42b66ca0fd674db6e377701022ef69b712fa4eb594790

Download Submit
C:\Windows\System\SmIrluM.exe

Filesize
8B

MD5
07021ef5927fbdd44862664e10dc26d4

SHA1
94e4f712de1b0550ba7049ac9344458bdb764e6f

SHA256
10a0df8f787c8aee413275e38af5b062fa776af89dc791ba4079ab4e88965da2

SHA512
c9a13ebb01bc2c829334cb4c4ae72ab87a70e47ae792934298a490ab66c6442b28029fe1e9f18fb1fde574aa7378c68ec02786d13d9a94c03f37d551e1f4da19

Download Submit
C:\Windows\System\UCQZsAw.exe

Filesize
1.4MB

MD5
c3f6219dbf9e05db7ad1e19bf9daebde

SHA1
c44508058721c7253c6a8f1ccd012162adb90244

SHA256
8bd82a9ad4015edb18235d98a86d678d5fa17d2cfa47a53d4f57a5ee077dc655

SHA512
0c8a2d63f5b4d9d87902a909855a6fc2d96c69745bef91206fb6d51f2cb01242a177406315339bba17d7227c6caf9ddd205653889d7037cb1d2aef486b2837c9

Download Submit
C:\Windows\System\URltTMm.exe

Filesize
1.4MB

MD5
0856f7313e9560aa851f1d9ad9690d77

SHA1
d37eeeb774a77f079fb86a21631e8e49efbcbe3d

SHA256
a7e281dfd04495b281d8b712e6e3f10e1b2fe0a13cc8460e93d062b1497855b2

SHA512
900e3391e41dcb24dd9cfe882dfea295fde6f8e1ee2170b29d05a91e770afc10b14bac42c817e41d99741ec249670da7089cf4aca08797f8219d030379a1f174

Download Submit
C:\Windows\System\YwLfKxr.exe

Filesize
1.4MB

MD5
657a67906c209e999fe91c98e3267951

SHA1
af6d0d3998c42e2e564e5bb6e1813b537129b256

SHA256
cca52772c3a5720f8630223aaca1718bc9e4c2e3da34766ac503d07f4de19a95

SHA512
0ebf2804344091ce3097bbd06bb6920afca6c5f18389ee9ac42c08ebba4c290e41dedf7f992d8ccb654729affba4156883c6547b50ff1995075810a31be8bf37

Download Submit
C:\Windows\System\ZVSdYBb.exe

Filesize
1.4MB

MD5
9a32ecf40189ce583836b9162916dfb4

SHA1
1530d08ab9c2c3b621c8aa11069d8da3deeaa58a

SHA256
3e9da687b8d3d6e9f09aa1465caff16c199637a09228339231d9e08ef33ca93c

SHA512
7ed90ac276ae6e19ce95674edbaf31a318eb44e7bff4e4217ec37d84cd835b42629096fc15cc87e4b79e2a0a7d8f06182261751e0e611d2208e9b921b8378009

Download Submit
C:\Windows\System\cThdTZI.exe

Filesize
1.4MB

MD5
b3917513f52e5058cb997bc4364449c1

SHA1
c7acef3bb9827b3d585a08a0049ffbcbb6317270

SHA256
c0cb7b8dc8e0e6af3f9c9bf3e1344611584c5bc16cbbd0874f1a3082afb91a1f

SHA512
36525808257c0256914c8f0257a7f68d2db1b9491c0ee5ba5dd96e0b017357f37d098b9cf895efe338c7f3f5659e565e4a048debc8cfec03d406b05e808b5f16

Download Submit
C:\Windows\System\ciskslg.exe

Filesize
1.4MB

MD5
54a60b878ccdc7bc1acba99ff1778fab

SHA1
9f9f64e41d42a45c263b1eb308584520da7eec32

SHA256
9de5213bbe3aaeda972b47c99be303efef1494b852b0159a190f4afd6b7fa079

SHA512
5cc639cd29e8588f6e7858d780e9c1824949f6ff91578aa4fce50877b33c5a74828c19b2248cedd5720bb9e0d7e34aaae46905073f81e999a0d6e4d028f8a6e9

Download Submit
C:\Windows\System\gBTrkbz.exe

Filesize
1.4MB

MD5
8fc72c77f3de5758b8ca67268f5bb71a

SHA1
faf4943185ad40c4b77b5f8f15748104b5e4fdb0

SHA256
368dd8e15eeca0a5484164bbf2a621666ad95c16075e7f3db2acf84d58432d58

SHA512
f43f60b9a270febd772d2fd4b0f3af0aada69ffa59dd2b04f4dfe5f9e893834cd8e6a5a17e4f71ccfb9e75a8de72f0df72a891aa9dc0bab2bacf1536b924697f

Download Submit
C:\Windows\System\grSaUgt.exe

Filesize
1.4MB

MD5
b46df2ce2e4a556e9db17092414377d4

SHA1
c8fc3da0a4e636379e1fd4e538931383aea65736

SHA256
ac09d1806ad3f19c4580f5abdf1b07cddc3506f84a5b67fa97b8fc077e6e8422

SHA512
d8c5ad0e73e217df09ce9399985b78ff1068bdf2a330499514bdd5d34b049eee208185d6f3b5cd8a6f101fa01e739adc1113694831bfc4d90684fbce08b61425

Download Submit
C:\Windows\System\inlbLYj.exe

Filesize
1.4MB

MD5
11648db4955f07dabb4e7b823be14112

SHA1
abc6ff8b53f42b5134f2c52524893291b26b4654

SHA256
0309d6141e28e35a733c91235a84e5337c45a867edaf16e57a81e7bae3cf36e5

SHA512
001a8fb9eb73046efccbeb419960f68610d5b744332d7f410dab4e192e6025a18d25425734944eb78306bc1d2ddfe062b4073802a2fbbc8febc86d5b89c442bd

Download Submit
C:\Windows\System\kqwfjnl.exe

Filesize
1.4MB

MD5
2caadec5ef21a15b20d7e0a93b76946f

SHA1
dd24c624f7fbe677e0f3797d63d13eaf08b15e03

SHA256
40835729b11b35bdc4c1917963655a924d52f8c8a5f18e42609dc9c6ed256ab4

SHA512
8ae8a8c2996560f9f0215ad12aae48ee136c0b6ca9dbdb9773884fd712b79ea09c7834df2f599875db55493a2ebeea42b8bae7468fc1912e7ce142d09edafd55

Download Submit
C:\Windows\System\lkEEAnR.exe

Filesize
1.4MB

MD5
34c92fcf3d9982ecd092f4d60209ccc7

SHA1
d959f7fdc43d98f4b4468bc8d88e1d2f6a4f19f9

SHA256
34bb1afec40b2cd0e7d407ee9fc1fff10a3b9cd0c4d91606432d65ecb21618ed

SHA512
a64cc5f7a75739c45870b26fe227fbd2340a75424a49aa63f8cafc72299cce71cafcede35ccecd12988ace05bfbdb9b9461bdb926319f817b2dd1f77d036f4a4

Download Submit
C:\Windows\System\lrvZHAH.exe

Filesize
1.4MB

MD5
42fef88d30cc880d56c327a93e1e55e7

SHA1
5709fc81bcbd44d66fb1fa2af933b0113fa360d4

SHA256
96e4eeb5007972c8b480edc929cdf6113ea1e0bd75bfe40d0954df30c2cf63d5

SHA512
71200a65d0e29f2d8179ecca1cc0b9bae78a7afde74c3426082e800623492beaf950e11f42432729f87aa05d6ff9a9763a44c32a354fa57c9e0d738bc51f7cf5

Download Submit
C:\Windows\System\qntxzqY.exe

Filesize
1.4MB

MD5
068751e7ca64c0f85b1650d0630ed41a

SHA1
28b519f284bb1121cc000b7062ae88f6c2df5f89

SHA256
195ba9fd2b8618568600b268b4f27349a39cd747002cc1dcf7bfceb9fda73af8

SHA512
df6c0f2b9a0677d0049360671aafce151a46c7a29d356f4b7c59929e9a41d192b844bbb64698162e691d76a507bf9dbac944d77962089c6db0f3dde2f31126d0

Download Submit
C:\Windows\System\qtnFrzT.exe

Filesize
1.4MB

MD5
e89b0a895b0c755b1fbf8b87efed20f1

SHA1
787faf812a3948ce66341fdbca7449b3d6747ba4

SHA256
1474a15583ef7302bb36e5717670478425d9986e7d1979e139c733bbe156eef7

SHA512
09298319c478dee39a1e61a0e45ab0e6927f0c06fadafc60ce7e03baaaa624454a8064f40df3618fd94ae1644aa7469c2c7e6b6a7de04cfcd950faa1c622ce20

Download Submit
C:\Windows\System\rALrDRW.exe

Filesize
1.4MB

MD5
d95ca862fbd54196d1d1c534b9530f9a

SHA1
68793af559a90112694ada832b9607df75321cfa

SHA256
d1e8806beaea1f7b017bb2de1825269ddc3cc9466a018fb9b85b105b9454fdbb

SHA512
aa2b21cc32eaef5379207ce86b6cdf98adea3383edd130178ef64ff48f4f06c690bc421725938a718a081fee6d3f21a97c836d35a927db9c94ae268817c30e80

Download Submit
C:\Windows\System\rahwdgd.exe

Filesize
1.4MB

MD5
ce88fb0699cb63f6e2432dbf37581c2d

SHA1
1360b61a7c63704b24e56595495ac6162b105b80

SHA256
fb0542a573c9bff58d6d38d6cc92a15c82736b5aa758fa68608974c722e1764f

SHA512
ec8a0252fc90ab30346cc4481d2e541f9ec8c86f53b14b95ef3ad1db21243fd2bba2121ad3e70df5ef51bb5628b5825bdaeec0b687cdc2c3f20bc698622129a5

Download Submit
C:\Windows\System\sWcDwgE.exe

Filesize
1.4MB

MD5
3bdfc4b26eb86f1b5163446e5185bfd4

SHA1
9fea55ab5b19e34f8f1ae830d91f8b5315a9d555

SHA256
154709be584a7a1f9570ece6bdd96500951d2246be62ce22faed24c412d9806e

SHA512
34940395ab493123eac1f8a5573c66f666a8ce82a66055fb7819d604a724b8557721562676aa5cde6205fc1d6a030c087a05a5974eca8c3bb54a826b457cbbd1

Download Submit
C:\Windows\System\snukpsv.exe

Filesize
1.4MB

MD5
178f61824d82e349454365023973a2cc

SHA1
5088462f2915ea309a5f5138d7e5af6dbab264b6

SHA256
394d7e5a04f2080b346108c4932d3968eba48882b4ca15f77388db29c913c3d9

SHA512
68b1946928960a5f6f76c70c158776688dbfd9cfed484f3e26a9103d6fc7553ac35a9d074b11d26cbdaa4c203f2830fa6e1b7ed7d23d84e021730530b3e8d89b

Download Submit
C:\Windows\System\tjWBiCH.exe

Filesize
1.4MB

MD5
ec4673b7125d4db3af7aeb4c4599b48e

SHA1
072396cb96ee6ecde47c64eadc5b1830bef06d1c

SHA256
0457c90c3d122f8e3de8c711c698628c45d5cc8359ea6dd046b6cf72753941c2

SHA512
18f252a15476b7e38cc9106371e2a1772cf3592e9f1cf7ecbcdb2cb7779a2d4f4a61b29aae63d7bca1e265b4259de0453ef3512f048d5993b1b5654de106b411

Download Submit
C:\Windows\System\ukqcdFf.exe

Filesize
1.4MB

MD5
ba245f92c56a9542653c2823a894f16b

SHA1
fa1a290d8d58a7e301498ebb29d21ece1e2f4e66

SHA256
e8b2816ad6af49cb189837888b4357424c115f1e32345bd5fa0deb7bb2f18061

SHA512
856726d2d333e6bd726e182a5dedcc5f73e4c0f4343ccb438585e470677fcf58d558bde7915ccc0f67883079e08ae520e60b521c76cd8f506287dc26ca284988

Download Submit
C:\Windows\System\uprpwca.exe

Filesize
1.4MB

MD5
2434b4d6529d95d03cf855e0ecb9055d

SHA1
4bd610b10e69df7b0d892daf73969fa0549d4cc7

SHA256
342e90b65f2e7ebe40b27b002364b818f079bf8bfd3d3dab28a9f831c66255c2

SHA512
753758ef8f89629c7fba3cc7df665f8e9c0182b6c0bafb6ac603b593032b0a519d410bc629bfab5a87618a82a9f46b59b9015f05632242b1c2ad37f833ba60fc

Download Submit
C:\Windows\System\uxAwpyR.exe

Filesize
1.4MB

MD5
c147ed1a3b817c81d8b48c91e1bdf4af

SHA1
cc9223c06ddfa6335d89fed2ee9d86779ed8ce3d

SHA256
c9d80c0b637a098cf04607feab5888eff0893343ed1aa5f52fb7f6bf30f265a6

SHA512
aab01e1fc8c027043744b6f2cffd5983a9cd74a310a93f878b890d1f959f9a8a86c4fdb6661a90c4895c6496e7c500454d00c947f1ff91350ec37f5bcfabd3a1

Download Submit
C:\Windows\System\xArSeAm.exe

Filesize
1.4MB

MD5
339c81b9285999f5fe1a9270b347f330

SHA1
a3f2b2f86420ced759f6b37cb92ddb5950abc9ed

SHA256
4caef195f5ed5a8f3ee14a86ad581ceccdc7412f0f58fd15d36370e27ff6396e

SHA512
5179225d82bc01c659b0bd46cf99f19407c3bdbbd4b067c8d751fcdea28badcf5bb3314aabad9ad5cff33bc5b0518d1ae78b58c6ee3cb59429d6e3d6f615b762

Download Submit
C:\Windows\System\xLqCjcy.exe

Filesize
1.4MB

MD5
b3aa347041553a25cb46cc7f57a87d63

SHA1
99152d45ed59b59e0a6121bd96d1f92fe968ccce

SHA256
1784f150778c5827682af6ed64ca5b84d54e3de16db182d0ec9ee0aed7ea7e94

SHA512
f57ed22b5a327015c83f9402982bad5f3699b40af282c4a4a205d62c69dba709af02c15d8b3d122cb3f6cecba90212c49354c7e22df5129ec440facc19ceb732

Download Submit
C:\Windows\System\zUroMZQ.exe

Filesize
1.4MB

MD5
978782a7e7ebf0a6f3e6ed6b2ee72ac4

SHA1
a1064b623e9af505918f2cc713a9799832e2241e

SHA256
1e12ec5d7d6236652f38f1ccfff3a2f337e1859b583644ad0264eb9b8c69b2d1

SHA512
e43f47efed00435f9895af9da821aa131d622159ca249c7760fc95e8718c3e82743d1a924531a30c1eeab3f58a735619926ab2de4b6a471bc2cbaa5108e16f23

Download Submit
C:\Windows\System\zYFCWfw.exe

Filesize
1.4MB

MD5
11aca4be37b008c13b9b96160384e1ea

SHA1
d7647846ebf8cb0b9d595cc28c8872e8e5abf85c

SHA256
f270cd329ce5c4237881f09f011f88eccacfaf077b638a1aea5f448e2010b4cd

SHA512
90517bd88c32f6b6c9f34b8608b6b1cc865b4edc74b59cd6b6fa2b9dcc44f9390e7505e2c4cf59e05cd1e7a49323fd49d7cf05cd33669d8a2a8b261616f3a8f9

Download Submit
memory/408-195-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp

Filesize
3.9MB

Download
memory/408-2842-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp

Filesize
3.9MB

Download
memory/408-4425-0x00007FF6EEBD0000-0x00007FF6EEFC2000-memory.dmp

Filesize
3.9MB

Download
memory/700-4395-0x00007FF7B5610000-0x00007FF7B5A02000-memory.dmp

Filesize
3.9MB

Download
memory/700-536-0x00007FF7B5610000-0x00007FF7B5A02000-memory.dmp

Filesize
3.9MB

Download
memory/732-658-0x00007FF773350000-0x00007FF773742000-memory.dmp

Filesize
3.9MB

Download
memory/732-4364-0x00007FF773350000-0x00007FF773742000-memory.dmp

Filesize
3.9MB

Download
memory/872-460-0x00007FF72B050000-0x00007FF72B442000-memory.dmp

Filesize
3.9MB

Download
memory/872-4368-0x00007FF72B050000-0x00007FF72B442000-memory.dmp

Filesize
3.9MB

Download
memory/936-382-0x00007FFE2CE70000-0x00007FFE2D931000-memory.dmp

Filesize
10.8MB

Download
memory/936-10-0x00007FFE2CE73000-0x00007FFE2CE75000-memory.dmp

Filesize
8KB

Download
memory/936-353-0x0000022057850000-0x0000022057872000-memory.dmp

Filesize
136KB

Download
memory/936-93-0x00007FFE2CE70000-0x00007FFE2D931000-memory.dmp

Filesize
10.8MB

Download
memory/1124-1-0x0000013A6B400000-0x0000013A6B410000-memory.dmp

Filesize
64KB

Download
memory/1124-0-0x00007FF7ECCA0000-0x00007FF7ED092000-memory.dmp

Filesize
3.9MB

Download
memory/1256-534-0x00007FF725890000-0x00007FF725C82000-memory.dmp

Filesize
3.9MB

Download
memory/1256-4388-0x00007FF725890000-0x00007FF725C82000-memory.dmp

Filesize
3.9MB

Download
memory/1320-4414-0x00007FF7D7CD0000-0x00007FF7D80C2000-memory.dmp

Filesize
3.9MB

Download
memory/1320-256-0x00007FF7D7CD0000-0x00007FF7D80C2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-4384-0x00007FF6AA3C0000-0x00007FF6AA7B2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-529-0x00007FF6AA3C0000-0x00007FF6AA7B2000-memory.dmp

Filesize
3.9MB

Download
memory/1548-4358-0x00007FF6FE840000-0x00007FF6FEC32000-memory.dmp

Filesize
3.9MB

Download
memory/1548-16-0x00007FF6FE840000-0x00007FF6FEC32000-memory.dmp

Filesize
3.9MB

Download
memory/1744-128-0x00007FF7C5F90000-0x00007FF7C6382000-memory.dmp

Filesize
3.9MB

Download
memory/1744-4366-0x00007FF7C5F90000-0x00007FF7C6382000-memory.dmp

Filesize
3.9MB

Download
memory/2112-4360-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-539-0x00007FF7ECDB0000-0x00007FF7ED1A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-4376-0x00007FF613E80000-0x00007FF614272000-memory.dmp

Filesize
3.9MB

Download
memory/2188-530-0x00007FF613E80000-0x00007FF614272000-memory.dmp

Filesize
3.9MB

Download
memory/2880-4382-0x00007FF79EE10000-0x00007FF79F202000-memory.dmp

Filesize
3.9MB

Download
memory/2880-531-0x00007FF79EE10000-0x00007FF79F202000-memory.dmp

Filesize
3.9MB

Download
memory/3148-4374-0x00007FF6C0750000-0x00007FF6C0B42000-memory.dmp

Filesize
3.9MB

Download
memory/3148-526-0x00007FF6C0750000-0x00007FF6C0B42000-memory.dmp

Filesize
3.9MB

Download
memory/3364-4426-0x00007FF6079F0000-0x00007FF607DE2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-533-0x00007FF6079F0000-0x00007FF607DE2000-memory.dmp

Filesize
3.9MB

Download
memory/3420-527-0x00007FF64A700000-0x00007FF64AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3420-4373-0x00007FF64A700000-0x00007FF64AAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-535-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp

Filesize
3.9MB

Download
memory/3528-4390-0x00007FF6B0A60000-0x00007FF6B0E52000-memory.dmp

Filesize
3.9MB

Download
memory/3600-532-0x00007FF7CCE20000-0x00007FF7CD212000-memory.dmp

Filesize
3.9MB

Download
memory/3600-4386-0x00007FF7CCE20000-0x00007FF7CD212000-memory.dmp

Filesize
3.9MB

Download
memory/3660-4431-0x00007FF791420000-0x00007FF791812000-memory.dmp

Filesize
3.9MB

Download
memory/3660-718-0x00007FF791420000-0x00007FF791812000-memory.dmp

Filesize
3.9MB

Download
memory/3704-4381-0x00007FF7B3120000-0x00007FF7B3512000-memory.dmp

Filesize
3.9MB

Download
memory/3704-525-0x00007FF7B3120000-0x00007FF7B3512000-memory.dmp

Filesize
3.9MB

Download
memory/4224-4412-0x00007FF662410000-0x00007FF662802000-memory.dmp

Filesize
3.9MB

Download
memory/4224-537-0x00007FF662410000-0x00007FF662802000-memory.dmp

Filesize
3.9MB

Download
memory/4356-4370-0x00007FF6FFE80000-0x00007FF700272000-memory.dmp

Filesize
3.9MB

Download
memory/4356-528-0x00007FF6FFE80000-0x00007FF700272000-memory.dmp

Filesize
3.9MB

Download
memory/4764-538-0x00007FF68AE40000-0x00007FF68B232000-memory.dmp

Filesize
3.9MB

Download
memory/4764-4423-0x00007FF68AE40000-0x00007FF68B232000-memory.dmp

Filesize
3.9MB

Download
memory/4812-234-0x00007FF70AA40000-0x00007FF70AE32000-memory.dmp

Filesize
3.9MB

Download
memory/4812-4362-0x00007FF70AA40000-0x00007FF70AE32000-memory.dmp

Filesize
3.9MB

Download
memory/5116-4378-0x00007FF7029F0000-0x00007FF702DE2000-memory.dmp

Filesize
3.9MB

Download
memory/5116-523-0x00007FF7029F0000-0x00007FF702DE2000-memory.dmp

Filesize
3.9MB

Download