xmrig | 7f99f57bfdc333de3e5a1493e6c4b9f83f23009cb66f8f00bc027e9f696908ab

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
Size

1.1MB
MD5

d3b2b67cd4d76e53b36d9ceab7ab0cf0
SHA1

075fe08d9001098c8931e9f871b773e3b66f2181
SHA256

7f99f57bfdc333de3e5a1493e6c4b9f83f23009cb66f8f00bc027e9f696908ab
SHA512

265e9d63c50e118460669244b2cdf131851a54be2bf004fa26e978e881f49b245a56ddbf3599b59eedc2d9ea057260813d1f99669036133e83a1eb731f644639
SSDEEP

24576:RVIl/WDGCi7/qkat6zqxG2/yKutApnTK1H4mo4N4V:ROdWCCi7/raWfaTUYmiV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 60 IoCs

miner

resource	yara_rule
behavioral2/memory/3564-29-0x00007FF759A40000-0x00007FF759D91000-memory.dmp	xmrig
behavioral2/memory/724-515-0x00007FF758510000-0x00007FF758861000-memory.dmp	xmrig
behavioral2/memory/2220-581-0x00007FF657580000-0x00007FF6578D1000-memory.dmp	xmrig
behavioral2/memory/3100-698-0x00007FF760A60000-0x00007FF760DB1000-memory.dmp	xmrig
behavioral2/memory/4108-706-0x00007FF7254B0000-0x00007FF725801000-memory.dmp	xmrig
behavioral2/memory/1428-705-0x00007FF6D3ED0000-0x00007FF6D4221000-memory.dmp	xmrig
behavioral2/memory/5112-704-0x00007FF712AD0000-0x00007FF712E21000-memory.dmp	xmrig
behavioral2/memory/3460-703-0x00007FF7AF660000-0x00007FF7AF9B1000-memory.dmp	xmrig
behavioral2/memory/3892-702-0x00007FF6F0FE0000-0x00007FF6F1331000-memory.dmp	xmrig
behavioral2/memory/3612-701-0x00007FF70FD10000-0x00007FF710061000-memory.dmp	xmrig
behavioral2/memory/4732-700-0x00007FF60B670000-0x00007FF60B9C1000-memory.dmp	xmrig
behavioral2/memory/1384-699-0x00007FF7AB6B0000-0x00007FF7ABA01000-memory.dmp	xmrig
behavioral2/memory/4292-697-0x00007FF68D720000-0x00007FF68DA71000-memory.dmp	xmrig
behavioral2/memory/4476-696-0x00007FF6B7700000-0x00007FF6B7A51000-memory.dmp	xmrig
behavioral2/memory/4932-497-0x00007FF78C8A0000-0x00007FF78CBF1000-memory.dmp	xmrig
behavioral2/memory/2508-438-0x00007FF79E540000-0x00007FF79E891000-memory.dmp	xmrig
behavioral2/memory/3752-356-0x00007FF745BC0000-0x00007FF745F11000-memory.dmp	xmrig
behavioral2/memory/5064-296-0x00007FF6C3270000-0x00007FF6C35C1000-memory.dmp	xmrig
behavioral2/memory/5048-295-0x00007FF6ECF10000-0x00007FF6ED261000-memory.dmp	xmrig
behavioral2/memory/432-267-0x00007FF648E50000-0x00007FF6491A1000-memory.dmp	xmrig
behavioral2/memory/1968-219-0x00007FF756B10000-0x00007FF756E61000-memory.dmp	xmrig
behavioral2/memory/4136-177-0x00007FF742B20000-0x00007FF742E71000-memory.dmp	xmrig
behavioral2/memory/4760-145-0x00007FF7414E0000-0x00007FF741831000-memory.dmp	xmrig
behavioral2/memory/3636-134-0x00007FF649320000-0x00007FF649671000-memory.dmp	xmrig
behavioral2/memory/3344-70-0x00007FF70DC40000-0x00007FF70DF91000-memory.dmp	xmrig
behavioral2/memory/2232-2197-0x00007FF642EB0000-0x00007FF643201000-memory.dmp	xmrig
behavioral2/memory/4644-2198-0x00007FF63B510000-0x00007FF63B861000-memory.dmp	xmrig
behavioral2/memory/3564-2199-0x00007FF759A40000-0x00007FF759D91000-memory.dmp	xmrig
behavioral2/memory/3304-2200-0x00007FF631710000-0x00007FF631A61000-memory.dmp	xmrig
behavioral2/memory/2648-2201-0x00007FF62B5A0000-0x00007FF62B8F1000-memory.dmp	xmrig
behavioral2/memory/392-2202-0x00007FF7A4DD0000-0x00007FF7A5121000-memory.dmp	xmrig
behavioral2/memory/4644-2276-0x00007FF63B510000-0x00007FF63B861000-memory.dmp	xmrig
behavioral2/memory/3564-2278-0x00007FF759A40000-0x00007FF759D91000-memory.dmp	xmrig
behavioral2/memory/3612-2282-0x00007FF70FD10000-0x00007FF710061000-memory.dmp	xmrig
behavioral2/memory/3892-2284-0x00007FF6F0FE0000-0x00007FF6F1331000-memory.dmp	xmrig
behavioral2/memory/3344-2280-0x00007FF70DC40000-0x00007FF70DF91000-memory.dmp	xmrig
behavioral2/memory/3636-2310-0x00007FF649320000-0x00007FF649671000-memory.dmp	xmrig
behavioral2/memory/4108-2315-0x00007FF7254B0000-0x00007FF725801000-memory.dmp	xmrig
behavioral2/memory/5064-2317-0x00007FF6C3270000-0x00007FF6C35C1000-memory.dmp	xmrig
behavioral2/memory/4732-2331-0x00007FF60B670000-0x00007FF60B9C1000-memory.dmp	xmrig
behavioral2/memory/2220-2328-0x00007FF657580000-0x00007FF6578D1000-memory.dmp	xmrig
behavioral2/memory/724-2326-0x00007FF758510000-0x00007FF758861000-memory.dmp	xmrig
behavioral2/memory/4476-2324-0x00007FF6B7700000-0x00007FF6B7A51000-memory.dmp	xmrig
behavioral2/memory/4932-2322-0x00007FF78C8A0000-0x00007FF78CBF1000-memory.dmp	xmrig
behavioral2/memory/5048-2320-0x00007FF6ECF10000-0x00007FF6ED261000-memory.dmp	xmrig
behavioral2/memory/1968-2314-0x00007FF756B10000-0x00007FF756E61000-memory.dmp	xmrig
behavioral2/memory/2508-2312-0x00007FF79E540000-0x00007FF79E891000-memory.dmp	xmrig
behavioral2/memory/4760-2306-0x00007FF7414E0000-0x00007FF741831000-memory.dmp	xmrig
behavioral2/memory/4136-2304-0x00007FF742B20000-0x00007FF742E71000-memory.dmp	xmrig
behavioral2/memory/392-2302-0x00007FF7A4DD0000-0x00007FF7A5121000-memory.dmp	xmrig
behavioral2/memory/3752-2300-0x00007FF745BC0000-0x00007FF745F11000-memory.dmp	xmrig
behavioral2/memory/432-2298-0x00007FF648E50000-0x00007FF6491A1000-memory.dmp	xmrig
behavioral2/memory/5112-2296-0x00007FF712AD0000-0x00007FF712E21000-memory.dmp	xmrig
behavioral2/memory/3304-2294-0x00007FF631710000-0x00007FF631A61000-memory.dmp	xmrig
behavioral2/memory/3460-2308-0x00007FF7AF660000-0x00007FF7AF9B1000-memory.dmp	xmrig
behavioral2/memory/2648-2292-0x00007FF62B5A0000-0x00007FF62B8F1000-memory.dmp	xmrig
behavioral2/memory/4292-2369-0x00007FF68D720000-0x00007FF68DA71000-memory.dmp	xmrig
behavioral2/memory/1384-2373-0x00007FF7AB6B0000-0x00007FF7ABA01000-memory.dmp	xmrig
behavioral2/memory/3100-2350-0x00007FF760A60000-0x00007FF760DB1000-memory.dmp	xmrig
behavioral2/memory/1428-2346-0x00007FF6D3ED0000-0x00007FF6D4221000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4644	yashtNJ.exe
3564	rIPxTmI.exe
3612	KGlNOiX.exe
3304	drQzkcV.exe
2648	SwhkdCV.exe
3344	rrqGSZh.exe
3892	JRCbXni.exe
392	JOgWIXv.exe
3636	JMuCEyh.exe
3460	Lqhaova.exe
4760	WHSAqwI.exe
4136	ESezokb.exe
1968	RjMcXSv.exe
432	NHxGrdZ.exe
5048	gHLQcgF.exe
5112	MNMxFty.exe
5064	CLmjwTq.exe
3752	XVYLIZz.exe
2508	dBaufoD.exe
1428	IYbdxDi.exe
4932	vkUCpiG.exe
724	DtaImmE.exe
2220	jFJpSYz.exe
4476	RnTkdyN.exe
4108	HtwqSlZ.exe
4292	xUjCzSi.exe
3100	qHzdUhk.exe
1384	cLNLBpE.exe
4732	HumrCBy.exe
3968	EAPIaEO.exe
64	TYkCMXQ.exe
1276	pRiWjen.exe
3348	iuETfXS.exe
4616	wEsFbmY.exe
5024	siJyUNl.exe
3880	gCtTace.exe
3628	jMRjYLo.exe
4444	jbsLcWl.exe
3756	wjJKBiQ.exe
452	oDQCEaV.exe
4804	Ckekeuf.exe
3676	gSnJEnt.exe
2144	oIIHyqM.exe
1280	erlNWAK.exe
216	xBBpDbS.exe
316	eLoSRCX.exe
4080	kwElfQQ.exe
4820	pInhfAz.exe
1304	OkqGfFw.exe
4216	eNCZOsz.exe
3060	TpdKKuV.exe
3692	tHDOpOI.exe
2472	vZvrVox.exe
3668	krJwBsO.exe
3596	wHTeUoI.exe
1528	VjzFckY.exe
4800	gUYpqoK.exe
4736	lmvWqOV.exe
4848	XsRZcCx.exe
4656	BEKDWtf.exe
4016	jWPAzDs.exe
3832	frNruIk.exe
312	fyYVxiO.exe
100	aVvaXll.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2232-0-0x00007FF642EB0000-0x00007FF643201000-memory.dmp	upx
behavioral2/memory/3564-29-0x00007FF759A40000-0x00007FF759D91000-memory.dmp	upx
behavioral2/memory/2648-58-0x00007FF62B5A0000-0x00007FF62B8F1000-memory.dmp	upx
behavioral2/memory/392-90-0x00007FF7A4DD0000-0x00007FF7A5121000-memory.dmp	upx
behavioral2/files/0x00070000000234fd-129.dat	upx
behavioral2/memory/724-515-0x00007FF758510000-0x00007FF758861000-memory.dmp	upx
behavioral2/memory/2220-581-0x00007FF657580000-0x00007FF6578D1000-memory.dmp	upx
behavioral2/memory/3100-698-0x00007FF760A60000-0x00007FF760DB1000-memory.dmp	upx
behavioral2/memory/4108-706-0x00007FF7254B0000-0x00007FF725801000-memory.dmp	upx
behavioral2/memory/1428-705-0x00007FF6D3ED0000-0x00007FF6D4221000-memory.dmp	upx
behavioral2/memory/5112-704-0x00007FF712AD0000-0x00007FF712E21000-memory.dmp	upx
behavioral2/memory/3460-703-0x00007FF7AF660000-0x00007FF7AF9B1000-memory.dmp	upx
behavioral2/memory/3892-702-0x00007FF6F0FE0000-0x00007FF6F1331000-memory.dmp	upx
behavioral2/memory/3612-701-0x00007FF70FD10000-0x00007FF710061000-memory.dmp	upx
behavioral2/memory/4732-700-0x00007FF60B670000-0x00007FF60B9C1000-memory.dmp	upx
behavioral2/memory/1384-699-0x00007FF7AB6B0000-0x00007FF7ABA01000-memory.dmp	upx
behavioral2/memory/4292-697-0x00007FF68D720000-0x00007FF68DA71000-memory.dmp	upx
behavioral2/memory/4476-696-0x00007FF6B7700000-0x00007FF6B7A51000-memory.dmp	upx
behavioral2/memory/4932-497-0x00007FF78C8A0000-0x00007FF78CBF1000-memory.dmp	upx
behavioral2/memory/2508-438-0x00007FF79E540000-0x00007FF79E891000-memory.dmp	upx
behavioral2/memory/3752-356-0x00007FF745BC0000-0x00007FF745F11000-memory.dmp	upx
behavioral2/memory/5064-296-0x00007FF6C3270000-0x00007FF6C35C1000-memory.dmp	upx
behavioral2/memory/5048-295-0x00007FF6ECF10000-0x00007FF6ED261000-memory.dmp	upx
behavioral2/memory/432-267-0x00007FF648E50000-0x00007FF6491A1000-memory.dmp	upx
behavioral2/memory/1968-219-0x00007FF756B10000-0x00007FF756E61000-memory.dmp	upx
behavioral2/files/0x000700000002350f-192.dat	upx
behavioral2/files/0x000700000002350e-191.dat	upx
behavioral2/files/0x00070000000234fa-186.dat	upx
behavioral2/files/0x00070000000234ff-183.dat	upx
behavioral2/files/0x000700000002350d-182.dat	upx
behavioral2/memory/4136-177-0x00007FF742B20000-0x00007FF742E71000-memory.dmp	upx
behavioral2/files/0x000700000002350a-175.dat	upx
behavioral2/files/0x0007000000023509-174.dat	upx
behavioral2/files/0x0007000000023508-173.dat	upx
behavioral2/files/0x0007000000023507-169.dat	upx
behavioral2/files/0x0007000000023506-168.dat	upx
behavioral2/files/0x0007000000023503-164.dat	upx
behavioral2/files/0x0007000000023502-163.dat	upx
behavioral2/files/0x00070000000234f4-154.dat	upx
behavioral2/files/0x000700000002350c-181.dat	upx
behavioral2/files/0x0007000000023500-147.dat	upx
behavioral2/memory/4760-145-0x00007FF7414E0000-0x00007FF741831000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-140.dat	upx
behavioral2/files/0x000700000002350b-176.dat	upx
behavioral2/memory/3636-134-0x00007FF649320000-0x00007FF649671000-memory.dmp	upx
behavioral2/files/0x00070000000234fc-128.dat	upx
behavioral2/files/0x00070000000234fb-124.dat	upx
behavioral2/files/0x00070000000234f8-120.dat	upx
behavioral2/files/0x0007000000023505-167.dat	upx
behavioral2/files/0x0007000000023504-166.dat	upx
behavioral2/files/0x00070000000234f5-116.dat	upx
behavioral2/files/0x00070000000234f7-109.dat	upx
behavioral2/files/0x00070000000234f6-150.dat	upx
behavioral2/files/0x00070000000234f2-107.dat	upx
behavioral2/files/0x00070000000234f9-103.dat	upx
behavioral2/files/0x00070000000234ed-100.dat	upx
behavioral2/files/0x00070000000234f1-96.dat	upx
behavioral2/files/0x00070000000234f3-111.dat	upx
behavioral2/files/0x00070000000234ef-81.dat	upx
behavioral2/files/0x00070000000234f0-88.dat	upx
behavioral2/memory/3344-70-0x00007FF70DC40000-0x00007FF70DF91000-memory.dmp	upx
behavioral2/files/0x00070000000234ee-76.dat	upx
behavioral2/files/0x00070000000234ea-53.dat	upx
behavioral2/memory/3304-50-0x00007FF631710000-0x00007FF631A61000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eqOgKSk.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\mjEoTXI.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\amCcnCb.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\HLxRqyi.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\GHZzcKa.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\odCvUZZ.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\DbLGsuX.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\xUjCzSi.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\IlPJxMU.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\sbZdENh.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\oIIHyqM.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\bIcGofV.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\FTWXglI.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\PcRzcGQ.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\jJIIZOI.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\PdBQRUU.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\twWErKZ.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\tYRGWDq.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\zKQiFfd.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\MSwzWpT.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\utvkAZj.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\TfiqPgz.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\BrkJhdN.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\UimwEfz.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\krJwBsO.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\tauLxXt.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\gBqfyVJ.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\jKttUEj.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\csSdZMr.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\pnOaOgP.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\jMccdBe.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\ucdYzMI.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\RjMcXSv.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\vYdURXg.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\IxiSAVW.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\KZHbDiS.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\tWNJRen.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\TBpBMMz.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\ZYvReLt.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\zGDbSNr.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\zkVEEZj.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\iOjSSJm.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\rHwihLD.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\MeMIjRo.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\JOgWIXv.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\ENMicEE.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\GZsShiG.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\XepAjFH.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\XnfDDpA.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\mUeBKtu.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\pdJrgrw.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\kiQJJie.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\vNZnkYI.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\djfNDFr.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\aVvaXll.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\vXsmZdy.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\GmiTOGS.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\LALvppF.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\wvyPwJV.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\iWasHmQ.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\hJpgurW.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\erlNWAK.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\kwElfQQ.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
File created	C:\Windows\System\GWIjvhg.exe	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4644	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	84
PID 2232 wrote to memory of 4644	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	84
PID 2232 wrote to memory of 3564	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	85
PID 2232 wrote to memory of 3564	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	85
PID 2232 wrote to memory of 3612	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	86
PID 2232 wrote to memory of 3612	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	86
PID 2232 wrote to memory of 3304	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	87
PID 2232 wrote to memory of 3304	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	87
PID 2232 wrote to memory of 2648	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	88
PID 2232 wrote to memory of 2648	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	88
PID 2232 wrote to memory of 3344	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	89
PID 2232 wrote to memory of 3344	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	89
PID 2232 wrote to memory of 3892	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	90
PID 2232 wrote to memory of 3892	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	90
PID 2232 wrote to memory of 392	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	91
PID 2232 wrote to memory of 392	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	91
PID 2232 wrote to memory of 3636	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	92
PID 2232 wrote to memory of 3636	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	92
PID 2232 wrote to memory of 3460	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	93
PID 2232 wrote to memory of 3460	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	93
PID 2232 wrote to memory of 4760	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	94
PID 2232 wrote to memory of 4760	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	94
PID 2232 wrote to memory of 4136	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	95
PID 2232 wrote to memory of 4136	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	95
PID 2232 wrote to memory of 1968	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	96
PID 2232 wrote to memory of 1968	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	96
PID 2232 wrote to memory of 432	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	97
PID 2232 wrote to memory of 432	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	97
PID 2232 wrote to memory of 5048	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	98
PID 2232 wrote to memory of 5048	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	98
PID 2232 wrote to memory of 5112	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	99
PID 2232 wrote to memory of 5112	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	99
PID 2232 wrote to memory of 5064	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	100
PID 2232 wrote to memory of 5064	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	100
PID 2232 wrote to memory of 3752	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	101
PID 2232 wrote to memory of 3752	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	101
PID 2232 wrote to memory of 2508	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	102
PID 2232 wrote to memory of 2508	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	102
PID 2232 wrote to memory of 1428	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	103
PID 2232 wrote to memory of 1428	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	103
PID 2232 wrote to memory of 4932	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	104
PID 2232 wrote to memory of 4932	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	104
PID 2232 wrote to memory of 724	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	105
PID 2232 wrote to memory of 724	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	105
PID 2232 wrote to memory of 2220	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	106
PID 2232 wrote to memory of 2220	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	106
PID 2232 wrote to memory of 4476	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	107
PID 2232 wrote to memory of 4476	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	107
PID 2232 wrote to memory of 4108	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	108
PID 2232 wrote to memory of 4108	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	108
PID 2232 wrote to memory of 3628	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	109
PID 2232 wrote to memory of 3628	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	109
PID 2232 wrote to memory of 4292	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	110
PID 2232 wrote to memory of 4292	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	110
PID 2232 wrote to memory of 3676	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	111
PID 2232 wrote to memory of 3676	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	111
PID 2232 wrote to memory of 3100	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	112
PID 2232 wrote to memory of 3100	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	112
PID 2232 wrote to memory of 1384	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	113
PID 2232 wrote to memory of 1384	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	113
PID 2232 wrote to memory of 4732	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	114
PID 2232 wrote to memory of 4732	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	114
PID 2232 wrote to memory of 3968	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	115
PID 2232 wrote to memory of 3968	2232	d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe	115

C:\Users\Admin\AppData\Local\Temp\d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe
"C:\Users\Admin\AppData\Local\Temp\d3b2b67cd4d76e53b36d9ceab7ab0cf0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System\yashtNJ.exe
  C:\Windows\System\yashtNJ.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\rIPxTmI.exe
  C:\Windows\System\rIPxTmI.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\KGlNOiX.exe
  C:\Windows\System\KGlNOiX.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\drQzkcV.exe
  C:\Windows\System\drQzkcV.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\SwhkdCV.exe
  C:\Windows\System\SwhkdCV.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\rrqGSZh.exe
  C:\Windows\System\rrqGSZh.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\JRCbXni.exe
  C:\Windows\System\JRCbXni.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\JOgWIXv.exe
  C:\Windows\System\JOgWIXv.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\JMuCEyh.exe
  C:\Windows\System\JMuCEyh.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\Lqhaova.exe
  C:\Windows\System\Lqhaova.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\WHSAqwI.exe
  C:\Windows\System\WHSAqwI.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\ESezokb.exe
  C:\Windows\System\ESezokb.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\RjMcXSv.exe
  C:\Windows\System\RjMcXSv.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\NHxGrdZ.exe
  C:\Windows\System\NHxGrdZ.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\gHLQcgF.exe
  C:\Windows\System\gHLQcgF.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\MNMxFty.exe
  C:\Windows\System\MNMxFty.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\CLmjwTq.exe
  C:\Windows\System\CLmjwTq.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\XVYLIZz.exe
  C:\Windows\System\XVYLIZz.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\dBaufoD.exe
  C:\Windows\System\dBaufoD.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\IYbdxDi.exe
  C:\Windows\System\IYbdxDi.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\vkUCpiG.exe
  C:\Windows\System\vkUCpiG.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\DtaImmE.exe
  C:\Windows\System\DtaImmE.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\jFJpSYz.exe
  C:\Windows\System\jFJpSYz.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\RnTkdyN.exe
  C:\Windows\System\RnTkdyN.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\HtwqSlZ.exe
  C:\Windows\System\HtwqSlZ.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\jMRjYLo.exe
  C:\Windows\System\jMRjYLo.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\xUjCzSi.exe
  C:\Windows\System\xUjCzSi.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\gSnJEnt.exe
  C:\Windows\System\gSnJEnt.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\qHzdUhk.exe
  C:\Windows\System\qHzdUhk.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\cLNLBpE.exe
  C:\Windows\System\cLNLBpE.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\HumrCBy.exe
  C:\Windows\System\HumrCBy.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\EAPIaEO.exe
  C:\Windows\System\EAPIaEO.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\TYkCMXQ.exe
  C:\Windows\System\TYkCMXQ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\pRiWjen.exe
  C:\Windows\System\pRiWjen.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\iuETfXS.exe
  C:\Windows\System\iuETfXS.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\wEsFbmY.exe
  C:\Windows\System\wEsFbmY.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\siJyUNl.exe
  C:\Windows\System\siJyUNl.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\gCtTace.exe
  C:\Windows\System\gCtTace.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\jbsLcWl.exe
  C:\Windows\System\jbsLcWl.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\wjJKBiQ.exe
  C:\Windows\System\wjJKBiQ.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\oDQCEaV.exe
  C:\Windows\System\oDQCEaV.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\Ckekeuf.exe
  C:\Windows\System\Ckekeuf.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\pInhfAz.exe
  C:\Windows\System\pInhfAz.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\oIIHyqM.exe
  C:\Windows\System\oIIHyqM.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\erlNWAK.exe
  C:\Windows\System\erlNWAK.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\xBBpDbS.exe
  C:\Windows\System\xBBpDbS.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\eLoSRCX.exe
  C:\Windows\System\eLoSRCX.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\kwElfQQ.exe
  C:\Windows\System\kwElfQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\OkqGfFw.exe
  C:\Windows\System\OkqGfFw.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\eNCZOsz.exe
  C:\Windows\System\eNCZOsz.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\TpdKKuV.exe
  C:\Windows\System\TpdKKuV.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\vZvrVox.exe
  C:\Windows\System\vZvrVox.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\tHDOpOI.exe
  C:\Windows\System\tHDOpOI.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\krJwBsO.exe
  C:\Windows\System\krJwBsO.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\wHTeUoI.exe
  C:\Windows\System\wHTeUoI.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\VjzFckY.exe
  C:\Windows\System\VjzFckY.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\gUYpqoK.exe
  C:\Windows\System\gUYpqoK.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\lmvWqOV.exe
  C:\Windows\System\lmvWqOV.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\XsRZcCx.exe
  C:\Windows\System\XsRZcCx.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\BEKDWtf.exe
  C:\Windows\System\BEKDWtf.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\jWPAzDs.exe
  C:\Windows\System\jWPAzDs.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\frNruIk.exe
  C:\Windows\System\frNruIk.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\QuKHPCi.exe
  C:\Windows\System\QuKHPCi.exe
  2⤵
  PID:2932
- C:\Windows\System\sQZSeNh.exe
  C:\Windows\System\sQZSeNh.exe
  2⤵
  PID:3456
- C:\Windows\System\fyYVxiO.exe
  C:\Windows\System\fyYVxiO.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\aVvaXll.exe
  C:\Windows\System\aVvaXll.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\bRJQwsx.exe
  C:\Windows\System\bRJQwsx.exe
  2⤵
  PID:4348
- C:\Windows\System\qNfNvLJ.exe
  C:\Windows\System\qNfNvLJ.exe
  2⤵
  PID:4588
- C:\Windows\System\XfjKTyR.exe
  C:\Windows\System\XfjKTyR.exe
  2⤵
  PID:3524
- C:\Windows\System\tlvjyWg.exe
  C:\Windows\System\tlvjyWg.exe
  2⤵
  PID:2520
- C:\Windows\System\nqIPCTY.exe
  C:\Windows\System\nqIPCTY.exe
  2⤵
  PID:2060
- C:\Windows\System\PNanQQU.exe
  C:\Windows\System\PNanQQU.exe
  2⤵
  PID:212
- C:\Windows\System\nGnebed.exe
  C:\Windows\System\nGnebed.exe
  2⤵
  PID:4224
- C:\Windows\System\QGNVFuJ.exe
  C:\Windows\System\QGNVFuJ.exe
  2⤵
  PID:4772
- C:\Windows\System\VKRUTrU.exe
  C:\Windows\System\VKRUTrU.exe
  2⤵
  PID:3952
- C:\Windows\System\eMMYunq.exe
  C:\Windows\System\eMMYunq.exe
  2⤵
  PID:1816
- C:\Windows\System\YiLloyN.exe
  C:\Windows\System\YiLloyN.exe
  2⤵
  PID:3204
- C:\Windows\System\ECpPVZG.exe
  C:\Windows\System\ECpPVZG.exe
  2⤵
  PID:2828
- C:\Windows\System\CUvDNVI.exe
  C:\Windows\System\CUvDNVI.exe
  2⤵
  PID:840
- C:\Windows\System\XjrYfJj.exe
  C:\Windows\System\XjrYfJj.exe
  2⤵
  PID:4396
- C:\Windows\System\bfvazwG.exe
  C:\Windows\System\bfvazwG.exe
  2⤵
  PID:4660
- C:\Windows\System\wTnTmRW.exe
  C:\Windows\System\wTnTmRW.exe
  2⤵
  PID:4628
- C:\Windows\System\buArslM.exe
  C:\Windows\System\buArslM.exe
  2⤵
  PID:1140
- C:\Windows\System\LAjdljP.exe
  C:\Windows\System\LAjdljP.exe
  2⤵
  PID:4792
- C:\Windows\System\xrQbfWb.exe
  C:\Windows\System\xrQbfWb.exe
  2⤵
  PID:1588
- C:\Windows\System\ercswzZ.exe
  C:\Windows\System\ercswzZ.exe
  2⤵
  PID:2056
- C:\Windows\System\WeJiZJF.exe
  C:\Windows\System\WeJiZJF.exe
  2⤵
  PID:2140
- C:\Windows\System\GbNAHLT.exe
  C:\Windows\System\GbNAHLT.exe
  2⤵
  PID:1972
- C:\Windows\System\HFCWFqV.exe
  C:\Windows\System\HFCWFqV.exe
  2⤵
  PID:2476
- C:\Windows\System\AVxjjQe.exe
  C:\Windows\System\AVxjjQe.exe
  2⤵
  PID:1220
- C:\Windows\System\EgSfmrN.exe
  C:\Windows\System\EgSfmrN.exe
  2⤵
  PID:4972
- C:\Windows\System\fVNFqcj.exe
  C:\Windows\System\fVNFqcj.exe
  2⤵
  PID:5132
- C:\Windows\System\fTdytee.exe
  C:\Windows\System\fTdytee.exe
  2⤵
  PID:5148
- C:\Windows\System\kMHEPGM.exe
  C:\Windows\System\kMHEPGM.exe
  2⤵
  PID:5172
- C:\Windows\System\kgeRJeg.exe
  C:\Windows\System\kgeRJeg.exe
  2⤵
  PID:5192
- C:\Windows\System\ENMicEE.exe
  C:\Windows\System\ENMicEE.exe
  2⤵
  PID:5216
- C:\Windows\System\iGMiYXB.exe
  C:\Windows\System\iGMiYXB.exe
  2⤵
  PID:5240
- C:\Windows\System\XhWEUJM.exe
  C:\Windows\System\XhWEUJM.exe
  2⤵
  PID:5256
- C:\Windows\System\aDpYZpV.exe
  C:\Windows\System\aDpYZpV.exe
  2⤵
  PID:5280
- C:\Windows\System\vYdURXg.exe
  C:\Windows\System\vYdURXg.exe
  2⤵
  PID:5296
- C:\Windows\System\afogEbQ.exe
  C:\Windows\System\afogEbQ.exe
  2⤵
  PID:5320
- C:\Windows\System\pqVRxQw.exe
  C:\Windows\System\pqVRxQw.exe
  2⤵
  PID:5336
- C:\Windows\System\VvbhZOU.exe
  C:\Windows\System\VvbhZOU.exe
  2⤵
  PID:5368
- C:\Windows\System\mAzkNju.exe
  C:\Windows\System\mAzkNju.exe
  2⤵
  PID:5388
- C:\Windows\System\DWZVpzX.exe
  C:\Windows\System\DWZVpzX.exe
  2⤵
  PID:5404
- C:\Windows\System\ptznpXl.exe
  C:\Windows\System\ptznpXl.exe
  2⤵
  PID:5428
- C:\Windows\System\GPsYnIF.exe
  C:\Windows\System\GPsYnIF.exe
  2⤵
  PID:5452
- C:\Windows\System\vRySGaJ.exe
  C:\Windows\System\vRySGaJ.exe
  2⤵
  PID:5492
- C:\Windows\System\zRjsqMs.exe
  C:\Windows\System\zRjsqMs.exe
  2⤵
  PID:5508
- C:\Windows\System\MgaUebl.exe
  C:\Windows\System\MgaUebl.exe
  2⤵
  PID:5532
- C:\Windows\System\ivntRNV.exe
  C:\Windows\System\ivntRNV.exe
  2⤵
  PID:5556
- C:\Windows\System\kKxXbmA.exe
  C:\Windows\System\kKxXbmA.exe
  2⤵
  PID:5572
- C:\Windows\System\JuWuNNP.exe
  C:\Windows\System\JuWuNNP.exe
  2⤵
  PID:5604
- C:\Windows\System\GaQzAgy.exe
  C:\Windows\System\GaQzAgy.exe
  2⤵
  PID:5632
- C:\Windows\System\QRnBXLD.exe
  C:\Windows\System\QRnBXLD.exe
  2⤵
  PID:5652
- C:\Windows\System\gnerEYV.exe
  C:\Windows\System\gnerEYV.exe
  2⤵
  PID:5680
- C:\Windows\System\wHLihIT.exe
  C:\Windows\System\wHLihIT.exe
  2⤵
  PID:5708
- C:\Windows\System\xTJpDpw.exe
  C:\Windows\System\xTJpDpw.exe
  2⤵
  PID:5736
- C:\Windows\System\vhrpYOQ.exe
  C:\Windows\System\vhrpYOQ.exe
  2⤵
  PID:5760
- C:\Windows\System\gZErlyD.exe
  C:\Windows\System\gZErlyD.exe
  2⤵
  PID:5776
- C:\Windows\System\EbikiHY.exe
  C:\Windows\System\EbikiHY.exe
  2⤵
  PID:5804
- C:\Windows\System\IkvqzQK.exe
  C:\Windows\System\IkvqzQK.exe
  2⤵
  PID:5824
- C:\Windows\System\XVykBVS.exe
  C:\Windows\System\XVykBVS.exe
  2⤵
  PID:5848
- C:\Windows\System\xSJypLj.exe
  C:\Windows\System\xSJypLj.exe
  2⤵
  PID:5872
- C:\Windows\System\jVEyVvv.exe
  C:\Windows\System\jVEyVvv.exe
  2⤵
  PID:5892
- C:\Windows\System\LTjSwuq.exe
  C:\Windows\System\LTjSwuq.exe
  2⤵
  PID:5920
- C:\Windows\System\UZJZlKH.exe
  C:\Windows\System\UZJZlKH.exe
  2⤵
  PID:5936
- C:\Windows\System\JJsPOSR.exe
  C:\Windows\System\JJsPOSR.exe
  2⤵
  PID:5972
- C:\Windows\System\IxiSAVW.exe
  C:\Windows\System\IxiSAVW.exe
  2⤵
  PID:5988
- C:\Windows\System\CwPdUho.exe
  C:\Windows\System\CwPdUho.exe
  2⤵
  PID:6008
- C:\Windows\System\jxuPBiV.exe
  C:\Windows\System\jxuPBiV.exe
  2⤵
  PID:6028
- C:\Windows\System\DWKpNTY.exe
  C:\Windows\System\DWKpNTY.exe
  2⤵
  PID:6044
- C:\Windows\System\mVHHNea.exe
  C:\Windows\System\mVHHNea.exe
  2⤵
  PID:6068
- C:\Windows\System\YyOxtZW.exe
  C:\Windows\System\YyOxtZW.exe
  2⤵
  PID:6084
- C:\Windows\System\xTHcQIx.exe
  C:\Windows\System\xTHcQIx.exe
  2⤵
  PID:6108
- C:\Windows\System\sJoXlsn.exe
  C:\Windows\System\sJoXlsn.exe
  2⤵
  PID:6128
- C:\Windows\System\GZJrxEY.exe
  C:\Windows\System\GZJrxEY.exe
  2⤵
  PID:4236
- C:\Windows\System\YkrICQJ.exe
  C:\Windows\System\YkrICQJ.exe
  2⤵
  PID:1452
- C:\Windows\System\vXsmZdy.exe
  C:\Windows\System\vXsmZdy.exe
  2⤵
  PID:4128
- C:\Windows\System\tNTlCjs.exe
  C:\Windows\System\tNTlCjs.exe
  2⤵
  PID:1736
- C:\Windows\System\lfhVVBD.exe
  C:\Windows\System\lfhVVBD.exe
  2⤵
  PID:920
- C:\Windows\System\gKToZqG.exe
  C:\Windows\System\gKToZqG.exe
  2⤵
  PID:2340
- C:\Windows\System\fiYiMze.exe
  C:\Windows\System\fiYiMze.exe
  2⤵
  PID:3384
- C:\Windows\System\YWOqFcW.exe
  C:\Windows\System\YWOqFcW.exe
  2⤵
  PID:4040
- C:\Windows\System\sWyKgIl.exe
  C:\Windows\System\sWyKgIl.exe
  2⤵
  PID:1192
- C:\Windows\System\sypeIpZ.exe
  C:\Windows\System\sypeIpZ.exe
  2⤵
  PID:4260
- C:\Windows\System\DJlPoSD.exe
  C:\Windows\System\DJlPoSD.exe
  2⤵
  PID:2184
- C:\Windows\System\fHZaXen.exe
  C:\Windows\System\fHZaXen.exe
  2⤵
  PID:4824
- C:\Windows\System\iEietac.exe
  C:\Windows\System\iEietac.exe
  2⤵
  PID:3048
- C:\Windows\System\NEHddjS.exe
  C:\Windows\System\NEHddjS.exe
  2⤵
  PID:5444
- C:\Windows\System\dQFLKAF.exe
  C:\Windows\System\dQFLKAF.exe
  2⤵
  PID:6172
- C:\Windows\System\VzhkwUr.exe
  C:\Windows\System\VzhkwUr.exe
  2⤵
  PID:6192
- C:\Windows\System\LERHeCc.exe
  C:\Windows\System\LERHeCc.exe
  2⤵
  PID:6212
- C:\Windows\System\MVreGwR.exe
  C:\Windows\System\MVreGwR.exe
  2⤵
  PID:6232
- C:\Windows\System\hutChnE.exe
  C:\Windows\System\hutChnE.exe
  2⤵
  PID:6248
- C:\Windows\System\LXOvaOt.exe
  C:\Windows\System\LXOvaOt.exe
  2⤵
  PID:6268
- C:\Windows\System\WEyekiu.exe
  C:\Windows\System\WEyekiu.exe
  2⤵
  PID:6288
- C:\Windows\System\YoWJmow.exe
  C:\Windows\System\YoWJmow.exe
  2⤵
  PID:6304
- C:\Windows\System\KRgjntN.exe
  C:\Windows\System\KRgjntN.exe
  2⤵
  PID:6336
- C:\Windows\System\OMcTmjO.exe
  C:\Windows\System\OMcTmjO.exe
  2⤵
  PID:6352
- C:\Windows\System\hrYzptk.exe
  C:\Windows\System\hrYzptk.exe
  2⤵
  PID:6384
- C:\Windows\System\jKttUEj.exe
  C:\Windows\System\jKttUEj.exe
  2⤵
  PID:6404
- C:\Windows\System\BuAsWXt.exe
  C:\Windows\System\BuAsWXt.exe
  2⤵
  PID:6424
- C:\Windows\System\eXDEiGr.exe
  C:\Windows\System\eXDEiGr.exe
  2⤵
  PID:6444
- C:\Windows\System\adfwNYg.exe
  C:\Windows\System\adfwNYg.exe
  2⤵
  PID:6464
- C:\Windows\System\GmiTOGS.exe
  C:\Windows\System\GmiTOGS.exe
  2⤵
  PID:6484
- C:\Windows\System\TIyAwoj.exe
  C:\Windows\System\TIyAwoj.exe
  2⤵
  PID:6500
- C:\Windows\System\VkdyybR.exe
  C:\Windows\System\VkdyybR.exe
  2⤵
  PID:6520
- C:\Windows\System\CMIofOA.exe
  C:\Windows\System\CMIofOA.exe
  2⤵
  PID:6536
- C:\Windows\System\uYTsgbs.exe
  C:\Windows\System\uYTsgbs.exe
  2⤵
  PID:6552
- C:\Windows\System\VZEKGtB.exe
  C:\Windows\System\VZEKGtB.exe
  2⤵
  PID:6600
- C:\Windows\System\tLShnfA.exe
  C:\Windows\System\tLShnfA.exe
  2⤵
  PID:6620
- C:\Windows\System\LYphMvC.exe
  C:\Windows\System\LYphMvC.exe
  2⤵
  PID:6640
- C:\Windows\System\IbcnTJD.exe
  C:\Windows\System\IbcnTJD.exe
  2⤵
  PID:6656
- C:\Windows\System\amCcnCb.exe
  C:\Windows\System\amCcnCb.exe
  2⤵
  PID:6680
- C:\Windows\System\SehgEHt.exe
  C:\Windows\System\SehgEHt.exe
  2⤵
  PID:6696
- C:\Windows\System\sHnSWPu.exe
  C:\Windows\System\sHnSWPu.exe
  2⤵
  PID:6720
- C:\Windows\System\lESvasG.exe
  C:\Windows\System\lESvasG.exe
  2⤵
  PID:6740
- C:\Windows\System\vyHiobu.exe
  C:\Windows\System\vyHiobu.exe
  2⤵
  PID:6764
- C:\Windows\System\mcyYuBZ.exe
  C:\Windows\System\mcyYuBZ.exe
  2⤵
  PID:6788
- C:\Windows\System\WlDtCBb.exe
  C:\Windows\System\WlDtCBb.exe
  2⤵
  PID:6804
- C:\Windows\System\hjymaTk.exe
  C:\Windows\System\hjymaTk.exe
  2⤵
  PID:6824
- C:\Windows\System\iiQsnVy.exe
  C:\Windows\System\iiQsnVy.exe
  2⤵
  PID:6844
- C:\Windows\System\axYPLrz.exe
  C:\Windows\System\axYPLrz.exe
  2⤵
  PID:6864
- C:\Windows\System\gCyQEHU.exe
  C:\Windows\System\gCyQEHU.exe
  2⤵
  PID:6884
- C:\Windows\System\wobgMef.exe
  C:\Windows\System\wobgMef.exe
  2⤵
  PID:6912
- C:\Windows\System\KIirTTQ.exe
  C:\Windows\System\KIirTTQ.exe
  2⤵
  PID:6932
- C:\Windows\System\ZhOCehS.exe
  C:\Windows\System\ZhOCehS.exe
  2⤵
  PID:6952
- C:\Windows\System\pNhqAPP.exe
  C:\Windows\System\pNhqAPP.exe
  2⤵
  PID:6976
- C:\Windows\System\sjTyxFE.exe
  C:\Windows\System\sjTyxFE.exe
  2⤵
  PID:6996
- C:\Windows\System\cMVcxzI.exe
  C:\Windows\System\cMVcxzI.exe
  2⤵
  PID:7012
- C:\Windows\System\ocabebO.exe
  C:\Windows\System\ocabebO.exe
  2⤵
  PID:7032
- C:\Windows\System\twBjJxB.exe
  C:\Windows\System\twBjJxB.exe
  2⤵
  PID:7048
- C:\Windows\System\JcBnhXb.exe
  C:\Windows\System\JcBnhXb.exe
  2⤵
  PID:7072
- C:\Windows\System\IPRwTUt.exe
  C:\Windows\System\IPRwTUt.exe
  2⤵
  PID:7124
- C:\Windows\System\lvvdRlf.exe
  C:\Windows\System\lvvdRlf.exe
  2⤵
  PID:7140
- C:\Windows\System\XwLyvpJ.exe
  C:\Windows\System\XwLyvpJ.exe
  2⤵
  PID:7164
- C:\Windows\System\LQybBmf.exe
  C:\Windows\System\LQybBmf.exe
  2⤵
  PID:5480
- C:\Windows\System\wDkWcPB.exe
  C:\Windows\System\wDkWcPB.exe
  2⤵
  PID:5200
- C:\Windows\System\WDNNVom.exe
  C:\Windows\System\WDNNVom.exe
  2⤵
  PID:5164
- C:\Windows\System\hKTxsva.exe
  C:\Windows\System\hKTxsva.exe
  2⤵
  PID:4780
- C:\Windows\System\mHpkfKb.exe
  C:\Windows\System\mHpkfKb.exe
  2⤵
  PID:1240
- C:\Windows\System\DFermPY.exe
  C:\Windows\System\DFermPY.exe
  2⤵
  PID:5228
- C:\Windows\System\IKXqRxx.exe
  C:\Windows\System\IKXqRxx.exe
  2⤵
  PID:5252
- C:\Windows\System\vpTbecS.exe
  C:\Windows\System\vpTbecS.exe
  2⤵
  PID:5384
- C:\Windows\System\DBpKjJK.exe
  C:\Windows\System\DBpKjJK.exe
  2⤵
  PID:1648
- C:\Windows\System\ZOeShTk.exe
  C:\Windows\System\ZOeShTk.exe
  2⤵
  PID:3624
- C:\Windows\System\zKTObKt.exe
  C:\Windows\System\zKTObKt.exe
  2⤵
  PID:208
- C:\Windows\System\xNZangv.exe
  C:\Windows\System\xNZangv.exe
  2⤵
  PID:6184
- C:\Windows\System\RvXEClh.exe
  C:\Windows\System\RvXEClh.exe
  2⤵
  PID:5500
- C:\Windows\System\VlZiFeH.exe
  C:\Windows\System\VlZiFeH.exe
  2⤵
  PID:6040
- C:\Windows\System\GeIjEqD.exe
  C:\Windows\System\GeIjEqD.exe
  2⤵
  PID:5552
- C:\Windows\System\kanYYxn.exe
  C:\Windows\System\kanYYxn.exe
  2⤵
  PID:5584
- C:\Windows\System\zqzLYsa.exe
  C:\Windows\System\zqzLYsa.exe
  2⤵
  PID:5640
- C:\Windows\System\shnFysd.exe
  C:\Windows\System\shnFysd.exe
  2⤵
  PID:5688
- C:\Windows\System\ySFmytY.exe
  C:\Windows\System\ySFmytY.exe
  2⤵
  PID:5744
- C:\Windows\System\HLxRqyi.exe
  C:\Windows\System\HLxRqyi.exe
  2⤵
  PID:5796
- C:\Windows\System\ZtwklEU.exe
  C:\Windows\System\ZtwklEU.exe
  2⤵
  PID:5844
- C:\Windows\System\tauLxXt.exe
  C:\Windows\System\tauLxXt.exe
  2⤵
  PID:5884
- C:\Windows\System\fOzkINa.exe
  C:\Windows\System\fOzkINa.exe
  2⤵
  PID:6648
- C:\Windows\System\sXeEeWS.exe
  C:\Windows\System\sXeEeWS.exe
  2⤵
  PID:6784
- C:\Windows\System\VkCfUIn.exe
  C:\Windows\System\VkCfUIn.exe
  2⤵
  PID:7176
- C:\Windows\System\gBqfyVJ.exe
  C:\Windows\System\gBqfyVJ.exe
  2⤵
  PID:7196
- C:\Windows\System\XccyRNm.exe
  C:\Windows\System\XccyRNm.exe
  2⤵
  PID:7216
- C:\Windows\System\csSdZMr.exe
  C:\Windows\System\csSdZMr.exe
  2⤵
  PID:7240
- C:\Windows\System\RNzoVDD.exe
  C:\Windows\System\RNzoVDD.exe
  2⤵
  PID:7260
- C:\Windows\System\BbPSAAG.exe
  C:\Windows\System\BbPSAAG.exe
  2⤵
  PID:7276
- C:\Windows\System\ayqkhPJ.exe
  C:\Windows\System\ayqkhPJ.exe
  2⤵
  PID:7296
- C:\Windows\System\oRAfpVh.exe
  C:\Windows\System\oRAfpVh.exe
  2⤵
  PID:7320
- C:\Windows\System\GZsShiG.exe
  C:\Windows\System\GZsShiG.exe
  2⤵
  PID:7344
- C:\Windows\System\mMzgNUg.exe
  C:\Windows\System\mMzgNUg.exe
  2⤵
  PID:7364
- C:\Windows\System\jpuReDF.exe
  C:\Windows\System\jpuReDF.exe
  2⤵
  PID:7384
- C:\Windows\System\hNPcMuU.exe
  C:\Windows\System\hNPcMuU.exe
  2⤵
  PID:7400
- C:\Windows\System\RAusLic.exe
  C:\Windows\System\RAusLic.exe
  2⤵
  PID:7420
- C:\Windows\System\uAoeyRm.exe
  C:\Windows\System\uAoeyRm.exe
  2⤵
  PID:7440
- C:\Windows\System\gwaBXCL.exe
  C:\Windows\System\gwaBXCL.exe
  2⤵
  PID:7456
- C:\Windows\System\RqaJtKK.exe
  C:\Windows\System\RqaJtKK.exe
  2⤵
  PID:7480
- C:\Windows\System\zGDbSNr.exe
  C:\Windows\System\zGDbSNr.exe
  2⤵
  PID:7504
- C:\Windows\System\SMTsPJo.exe
  C:\Windows\System\SMTsPJo.exe
  2⤵
  PID:7532
- C:\Windows\System\aTUUMrT.exe
  C:\Windows\System\aTUUMrT.exe
  2⤵
  PID:7548
- C:\Windows\System\bQNesjv.exe
  C:\Windows\System\bQNesjv.exe
  2⤵
  PID:7568
- C:\Windows\System\SLbWgzL.exe
  C:\Windows\System\SLbWgzL.exe
  2⤵
  PID:7748
- C:\Windows\System\kxfmUbW.exe
  C:\Windows\System\kxfmUbW.exe
  2⤵
  PID:7764
- C:\Windows\System\IlPJxMU.exe
  C:\Windows\System\IlPJxMU.exe
  2⤵
  PID:7780
- C:\Windows\System\CMOHuCt.exe
  C:\Windows\System\CMOHuCt.exe
  2⤵
  PID:7796
- C:\Windows\System\uClwoPT.exe
  C:\Windows\System\uClwoPT.exe
  2⤵
  PID:7812
- C:\Windows\System\qzakPqr.exe
  C:\Windows\System\qzakPqr.exe
  2⤵
  PID:7828
- C:\Windows\System\eGkHJkx.exe
  C:\Windows\System\eGkHJkx.exe
  2⤵
  PID:7844
- C:\Windows\System\kJPwcAg.exe
  C:\Windows\System\kJPwcAg.exe
  2⤵
  PID:7860
- C:\Windows\System\HxeRZol.exe
  C:\Windows\System\HxeRZol.exe
  2⤵
  PID:7876
- C:\Windows\System\zkVEEZj.exe
  C:\Windows\System\zkVEEZj.exe
  2⤵
  PID:7892
- C:\Windows\System\pSwSFyc.exe
  C:\Windows\System\pSwSFyc.exe
  2⤵
  PID:7908
- C:\Windows\System\yCEKavg.exe
  C:\Windows\System\yCEKavg.exe
  2⤵
  PID:7924
- C:\Windows\System\cTHSACU.exe
  C:\Windows\System\cTHSACU.exe
  2⤵
  PID:7940
- C:\Windows\System\kqCboST.exe
  C:\Windows\System\kqCboST.exe
  2⤵
  PID:7956
- C:\Windows\System\iZjGKLZ.exe
  C:\Windows\System\iZjGKLZ.exe
  2⤵
  PID:7972
- C:\Windows\System\DnaFnrP.exe
  C:\Windows\System\DnaFnrP.exe
  2⤵
  PID:7988
- C:\Windows\System\XCjYWeX.exe
  C:\Windows\System\XCjYWeX.exe
  2⤵
  PID:8004
- C:\Windows\System\YSDLldb.exe
  C:\Windows\System\YSDLldb.exe
  2⤵
  PID:8020
- C:\Windows\System\CwQdjgk.exe
  C:\Windows\System\CwQdjgk.exe
  2⤵
  PID:8036
- C:\Windows\System\SUqomko.exe
  C:\Windows\System\SUqomko.exe
  2⤵
  PID:8052
- C:\Windows\System\NxbiXhH.exe
  C:\Windows\System\NxbiXhH.exe
  2⤵
  PID:8068
- C:\Windows\System\iSJMuDw.exe
  C:\Windows\System\iSJMuDw.exe
  2⤵
  PID:8084
- C:\Windows\System\bbOqCoT.exe
  C:\Windows\System\bbOqCoT.exe
  2⤵
  PID:8108
- C:\Windows\System\EoQbyxA.exe
  C:\Windows\System\EoQbyxA.exe
  2⤵
  PID:8152
- C:\Windows\System\TQlMwYm.exe
  C:\Windows\System\TQlMwYm.exe
  2⤵
  PID:8180
- C:\Windows\System\ahXfURf.exe
  C:\Windows\System\ahXfURf.exe
  2⤵
  PID:6156
- C:\Windows\System\XvoBtFl.exe
  C:\Windows\System\XvoBtFl.exe
  2⤵
  PID:7080
- C:\Windows\System\MVzEbHf.exe
  C:\Windows\System\MVzEbHf.exe
  2⤵
  PID:4556
- C:\Windows\System\nHxEsJw.exe
  C:\Windows\System\nHxEsJw.exe
  2⤵
  PID:884
- C:\Windows\System\DjNPAMs.exe
  C:\Windows\System\DjNPAMs.exe
  2⤵
  PID:2344
- C:\Windows\System\Ipgdity.exe
  C:\Windows\System\Ipgdity.exe
  2⤵
  PID:6652
- C:\Windows\System\aUZrcDs.exe
  C:\Windows\System\aUZrcDs.exe
  2⤵
  PID:5332
- C:\Windows\System\ddXhQAz.exe
  C:\Windows\System\ddXhQAz.exe
  2⤵
  PID:5400
- C:\Windows\System\WXQHyef.exe
  C:\Windows\System\WXQHyef.exe
  2⤵
  PID:6240
- C:\Windows\System\uMosOAZ.exe
  C:\Windows\System\uMosOAZ.exe
  2⤵
  PID:6264
- C:\Windows\System\ZyUVuAb.exe
  C:\Windows\System\ZyUVuAb.exe
  2⤵
  PID:6376
- C:\Windows\System\SyUJkzh.exe
  C:\Windows\System\SyUJkzh.exe
  2⤵
  PID:6416
- C:\Windows\System\XdmrfSI.exe
  C:\Windows\System\XdmrfSI.exe
  2⤵
  PID:6456
- C:\Windows\System\NKgibKi.exe
  C:\Windows\System\NKgibKi.exe
  2⤵
  PID:6496
- C:\Windows\System\vxDAbJj.exe
  C:\Windows\System\vxDAbJj.exe
  2⤵
  PID:6532
- C:\Windows\System\NQBYNHe.exe
  C:\Windows\System\NQBYNHe.exe
  2⤵
  PID:6592
- C:\Windows\System\PbDcgby.exe
  C:\Windows\System\PbDcgby.exe
  2⤵
  PID:6616
- C:\Windows\System\GHZzcKa.exe
  C:\Windows\System\GHZzcKa.exe
  2⤵
  PID:6716
- C:\Windows\System\zDmtACA.exe
  C:\Windows\System\zDmtACA.exe
  2⤵
  PID:6796
- C:\Windows\System\WcbSMKa.exe
  C:\Windows\System\WcbSMKa.exe
  2⤵
  PID:6908
- C:\Windows\System\KmqSovE.exe
  C:\Windows\System\KmqSovE.exe
  2⤵
  PID:7068
- C:\Windows\System\eVqbfkv.exe
  C:\Windows\System\eVqbfkv.exe
  2⤵
  PID:5204
- C:\Windows\System\QZpLzFN.exe
  C:\Windows\System\QZpLzFN.exe
  2⤵
  PID:5612
- C:\Windows\System\GWIjvhg.exe
  C:\Windows\System\GWIjvhg.exe
  2⤵
  PID:7372
- C:\Windows\System\sJlviRU.exe
  C:\Windows\System\sJlviRU.exe
  2⤵
  PID:7084
- C:\Windows\System\mUeBKtu.exe
  C:\Windows\System\mUeBKtu.exe
  2⤵
  PID:6024
- C:\Windows\System\VyQICij.exe
  C:\Windows\System\VyQICij.exe
  2⤵
  PID:5044
- C:\Windows\System\fPAZPXi.exe
  C:\Windows\System\fPAZPXi.exe
  2⤵
  PID:5248
- C:\Windows\System\sbZdENh.exe
  C:\Windows\System\sbZdENh.exe
  2⤵
  PID:2752
- C:\Windows\System\uztTvWf.exe
  C:\Windows\System\uztTvWf.exe
  2⤵
  PID:5440
- C:\Windows\System\AaEdrAv.exe
  C:\Windows\System\AaEdrAv.exe
  2⤵
  PID:5580
- C:\Windows\System\vZgXvKJ.exe
  C:\Windows\System\vZgXvKJ.exe
  2⤵
  PID:5728
- C:\Windows\System\WRetJko.exe
  C:\Windows\System\WRetJko.exe
  2⤵
  PID:5868
- C:\Windows\System\bIcGofV.exe
  C:\Windows\System\bIcGofV.exe
  2⤵
  PID:6816
- C:\Windows\System\xsebqsP.exe
  C:\Windows\System\xsebqsP.exe
  2⤵
  PID:7224
- C:\Windows\System\LNXkACL.exe
  C:\Windows\System\LNXkACL.exe
  2⤵
  PID:7288
- C:\Windows\System\KalpRNY.exe
  C:\Windows\System\KalpRNY.exe
  2⤵
  PID:7356
- C:\Windows\System\IKbGknu.exe
  C:\Windows\System\IKbGknu.exe
  2⤵
  PID:7432
- C:\Windows\System\jhgQwwg.exe
  C:\Windows\System\jhgQwwg.exe
  2⤵
  PID:7476
- C:\Windows\System\gUXEiHV.exe
  C:\Windows\System\gUXEiHV.exe
  2⤵
  PID:7512
- C:\Windows\System\jeZVFbX.exe
  C:\Windows\System\jeZVFbX.exe
  2⤵
  PID:7564
- C:\Windows\System\FNivjlC.exe
  C:\Windows\System\FNivjlC.exe
  2⤵
  PID:8196
- C:\Windows\System\HdRvbrj.exe
  C:\Windows\System\HdRvbrj.exe
  2⤵
  PID:8212
- C:\Windows\System\nQdeoVu.exe
  C:\Windows\System\nQdeoVu.exe
  2⤵
  PID:8232
- C:\Windows\System\BbdReVw.exe
  C:\Windows\System\BbdReVw.exe
  2⤵
  PID:8248
- C:\Windows\System\VJaJeMb.exe
  C:\Windows\System\VJaJeMb.exe
  2⤵
  PID:8272
- C:\Windows\System\UvloHEL.exe
  C:\Windows\System\UvloHEL.exe
  2⤵
  PID:8288
- C:\Windows\System\YQYUrJJ.exe
  C:\Windows\System\YQYUrJJ.exe
  2⤵
  PID:8304
- C:\Windows\System\tWwPmSn.exe
  C:\Windows\System\tWwPmSn.exe
  2⤵
  PID:8328
- C:\Windows\System\RUXvegu.exe
  C:\Windows\System\RUXvegu.exe
  2⤵
  PID:8348
- C:\Windows\System\opDgUmz.exe
  C:\Windows\System\opDgUmz.exe
  2⤵
  PID:8368
- C:\Windows\System\xCpHVgk.exe
  C:\Windows\System\xCpHVgk.exe
  2⤵
  PID:8388
- C:\Windows\System\kwAHhnO.exe
  C:\Windows\System\kwAHhnO.exe
  2⤵
  PID:8404
- C:\Windows\System\OwrzrjQ.exe
  C:\Windows\System\OwrzrjQ.exe
  2⤵
  PID:8424
- C:\Windows\System\QSbvwzR.exe
  C:\Windows\System\QSbvwzR.exe
  2⤵
  PID:8444
- C:\Windows\System\GGPYrAt.exe
  C:\Windows\System\GGPYrAt.exe
  2⤵
  PID:8464
- C:\Windows\System\uHUhPtB.exe
  C:\Windows\System\uHUhPtB.exe
  2⤵
  PID:8484
- C:\Windows\System\IwnWvlp.exe
  C:\Windows\System\IwnWvlp.exe
  2⤵
  PID:8504
- C:\Windows\System\UuYpMHF.exe
  C:\Windows\System\UuYpMHF.exe
  2⤵
  PID:8524
- C:\Windows\System\QdoiUxL.exe
  C:\Windows\System\QdoiUxL.exe
  2⤵
  PID:8540
- C:\Windows\System\MSwzWpT.exe
  C:\Windows\System\MSwzWpT.exe
  2⤵
  PID:8556
- C:\Windows\System\VJZyCfd.exe
  C:\Windows\System\VJZyCfd.exe
  2⤵
  PID:8580
- C:\Windows\System\jlBqSbU.exe
  C:\Windows\System\jlBqSbU.exe
  2⤵
  PID:8600
- C:\Windows\System\RzpGyhe.exe
  C:\Windows\System\RzpGyhe.exe
  2⤵
  PID:8620
- C:\Windows\System\GODNyiY.exe
  C:\Windows\System\GODNyiY.exe
  2⤵
  PID:8636
- C:\Windows\System\ioKsYjh.exe
  C:\Windows\System\ioKsYjh.exe
  2⤵
  PID:8656
- C:\Windows\System\LbvwZVY.exe
  C:\Windows\System\LbvwZVY.exe
  2⤵
  PID:8672
- C:\Windows\System\jKmfCPi.exe
  C:\Windows\System\jKmfCPi.exe
  2⤵
  PID:8688
- C:\Windows\System\NDicxrY.exe
  C:\Windows\System\NDicxrY.exe
  2⤵
  PID:8704
- C:\Windows\System\bwAnEjj.exe
  C:\Windows\System\bwAnEjj.exe
  2⤵
  PID:8720
- C:\Windows\System\YqPBwzk.exe
  C:\Windows\System\YqPBwzk.exe
  2⤵
  PID:8736
- C:\Windows\System\PZWQabe.exe
  C:\Windows\System\PZWQabe.exe
  2⤵
  PID:8752
- C:\Windows\System\EuiHTGt.exe
  C:\Windows\System\EuiHTGt.exe
  2⤵
  PID:8768
- C:\Windows\System\ufNHrHu.exe
  C:\Windows\System\ufNHrHu.exe
  2⤵
  PID:8784
- C:\Windows\System\UIsMdTE.exe
  C:\Windows\System\UIsMdTE.exe
  2⤵
  PID:8804
- C:\Windows\System\JXiEfcT.exe
  C:\Windows\System\JXiEfcT.exe
  2⤵
  PID:8820
- C:\Windows\System\nhdWLND.exe
  C:\Windows\System\nhdWLND.exe
  2⤵
  PID:8836
- C:\Windows\System\eYOqhSN.exe
  C:\Windows\System\eYOqhSN.exe
  2⤵
  PID:8852
- C:\Windows\System\rXRzPtM.exe
  C:\Windows\System\rXRzPtM.exe
  2⤵
  PID:8868
- C:\Windows\System\fEwCwiA.exe
  C:\Windows\System\fEwCwiA.exe
  2⤵
  PID:8892
- C:\Windows\System\LqzDUyd.exe
  C:\Windows\System\LqzDUyd.exe
  2⤵
  PID:8912
- C:\Windows\System\rpBSSRx.exe
  C:\Windows\System\rpBSSRx.exe
  2⤵
  PID:8932
- C:\Windows\System\UlgEmpf.exe
  C:\Windows\System\UlgEmpf.exe
  2⤵
  PID:8952
- C:\Windows\System\ajNhChj.exe
  C:\Windows\System\ajNhChj.exe
  2⤵
  PID:8968
- C:\Windows\System\sqaSHuC.exe
  C:\Windows\System\sqaSHuC.exe
  2⤵
  PID:8988
- C:\Windows\System\yMccixZ.exe
  C:\Windows\System\yMccixZ.exe
  2⤵
  PID:9008
- C:\Windows\System\zVxWLwO.exe
  C:\Windows\System\zVxWLwO.exe
  2⤵
  PID:9028
- C:\Windows\System\YRIjAHy.exe
  C:\Windows\System\YRIjAHy.exe
  2⤵
  PID:9048
- C:\Windows\System\NdOCctj.exe
  C:\Windows\System\NdOCctj.exe
  2⤵
  PID:9068
- C:\Windows\System\iOjSSJm.exe
  C:\Windows\System\iOjSSJm.exe
  2⤵
  PID:9088
- C:\Windows\System\rJgwWHW.exe
  C:\Windows\System\rJgwWHW.exe
  2⤵
  PID:9104
- C:\Windows\System\keoJGKR.exe
  C:\Windows\System\keoJGKR.exe
  2⤵
  PID:9120
- C:\Windows\System\imcqNUd.exe
  C:\Windows\System\imcqNUd.exe
  2⤵
  PID:9144
- C:\Windows\System\QPUMUVF.exe
  C:\Windows\System\QPUMUVF.exe
  2⤵
  PID:9164
- C:\Windows\System\vDSGEvt.exe
  C:\Windows\System\vDSGEvt.exe
  2⤵
  PID:9184
- C:\Windows\System\athYuBE.exe
  C:\Windows\System\athYuBE.exe
  2⤵
  PID:9200
- C:\Windows\System\rHwihLD.exe
  C:\Windows\System\rHwihLD.exe
  2⤵
  PID:9220
- C:\Windows\System\mBijAxu.exe
  C:\Windows\System\mBijAxu.exe
  2⤵
  PID:9244
- C:\Windows\System\rhBsAyO.exe
  C:\Windows\System\rhBsAyO.exe
  2⤵
  PID:9264
- C:\Windows\System\TzVBXJO.exe
  C:\Windows\System\TzVBXJO.exe
  2⤵
  PID:9280
- C:\Windows\System\mwkjBfL.exe
  C:\Windows\System\mwkjBfL.exe
  2⤵
  PID:9296
- C:\Windows\System\tzwnBHe.exe
  C:\Windows\System\tzwnBHe.exe
  2⤵
  PID:9320
- C:\Windows\System\CtYCHzo.exe
  C:\Windows\System\CtYCHzo.exe
  2⤵
  PID:9340
- C:\Windows\System\RHGIMlN.exe
  C:\Windows\System\RHGIMlN.exe
  2⤵
  PID:9360
- C:\Windows\System\AoPimmy.exe
  C:\Windows\System\AoPimmy.exe
  2⤵
  PID:9376
- C:\Windows\System\DFpuLrT.exe
  C:\Windows\System\DFpuLrT.exe
  2⤵
  PID:9396
- C:\Windows\System\zHWBMHb.exe
  C:\Windows\System\zHWBMHb.exe
  2⤵
  PID:9416
- C:\Windows\System\wKNWawE.exe
  C:\Windows\System\wKNWawE.exe
  2⤵
  PID:9436
- C:\Windows\System\dniaPZc.exe
  C:\Windows\System\dniaPZc.exe
  2⤵
  PID:9456
- C:\Windows\System\tyYFYoP.exe
  C:\Windows\System\tyYFYoP.exe
  2⤵
  PID:9472
- C:\Windows\System\sNIyrIh.exe
  C:\Windows\System\sNIyrIh.exe
  2⤵
  PID:9492
- C:\Windows\System\LVhqoaa.exe
  C:\Windows\System\LVhqoaa.exe
  2⤵
  PID:9512
- C:\Windows\System\yiFOEvJ.exe
  C:\Windows\System\yiFOEvJ.exe
  2⤵
  PID:9532
- C:\Windows\System\pVbMJPf.exe
  C:\Windows\System\pVbMJPf.exe
  2⤵
  PID:9552
- C:\Windows\System\saxZPty.exe
  C:\Windows\System\saxZPty.exe
  2⤵
  PID:9568
- C:\Windows\System\utvkAZj.exe
  C:\Windows\System\utvkAZj.exe
  2⤵
  PID:9584
- C:\Windows\System\MeMIjRo.exe
  C:\Windows\System\MeMIjRo.exe
  2⤵
  PID:9608
- C:\Windows\System\nkaOzrh.exe
  C:\Windows\System\nkaOzrh.exe
  2⤵
  PID:9624
- C:\Windows\System\pQtXzsB.exe
  C:\Windows\System\pQtXzsB.exe
  2⤵
  PID:9644
- C:\Windows\System\bTLacRH.exe
  C:\Windows\System\bTLacRH.exe
  2⤵
  PID:9664
- C:\Windows\System\SaRSxlR.exe
  C:\Windows\System\SaRSxlR.exe
  2⤵
  PID:9684
- C:\Windows\System\KwjwFAl.exe
  C:\Windows\System\KwjwFAl.exe
  2⤵
  PID:9712
- C:\Windows\System\XepAjFH.exe
  C:\Windows\System\XepAjFH.exe
  2⤵
  PID:9736
- C:\Windows\System\QFMuGGd.exe
  C:\Windows\System\QFMuGGd.exe
  2⤵
  PID:9756
- C:\Windows\System\HBbixRs.exe
  C:\Windows\System\HBbixRs.exe
  2⤵
  PID:9776
- C:\Windows\System\Wcvwnms.exe
  C:\Windows\System\Wcvwnms.exe
  2⤵
  PID:9792
- C:\Windows\System\CyXtkPk.exe
  C:\Windows\System\CyXtkPk.exe
  2⤵
  PID:9812
- C:\Windows\System\hbcSvaL.exe
  C:\Windows\System\hbcSvaL.exe
  2⤵
  PID:9832
- C:\Windows\System\QKqGzXp.exe
  C:\Windows\System\QKqGzXp.exe
  2⤵
  PID:9848
- C:\Windows\System\ZUBfFyz.exe
  C:\Windows\System\ZUBfFyz.exe
  2⤵
  PID:9868
- C:\Windows\System\USWyCnX.exe
  C:\Windows\System\USWyCnX.exe
  2⤵
  PID:9884
- C:\Windows\System\DXornrW.exe
  C:\Windows\System\DXornrW.exe
  2⤵
  PID:9904
- C:\Windows\System\cSjywsS.exe
  C:\Windows\System\cSjywsS.exe
  2⤵
  PID:9924
- C:\Windows\System\perfXwa.exe
  C:\Windows\System\perfXwa.exe
  2⤵
  PID:9940
- C:\Windows\System\JEevdJH.exe
  C:\Windows\System\JEevdJH.exe
  2⤵
  PID:9960
- C:\Windows\System\fnFmZde.exe
  C:\Windows\System\fnFmZde.exe
  2⤵
  PID:9976
- C:\Windows\System\BjIlUBk.exe
  C:\Windows\System\BjIlUBk.exe
  2⤵
  PID:10000
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10000 -s 248
    3⤵
    PID:3716
- C:\Windows\System\mQTBOoH.exe
  C:\Windows\System\mQTBOoH.exe
  2⤵
  PID:10020
- C:\Windows\System\hrfikRq.exe
  C:\Windows\System\hrfikRq.exe
  2⤵
  PID:10040
- C:\Windows\System\wvmPROI.exe
  C:\Windows\System\wvmPROI.exe
  2⤵
  PID:10064
- C:\Windows\System\qFaFNCk.exe
  C:\Windows\System\qFaFNCk.exe
  2⤵
  PID:10084
- C:\Windows\System\xbTPzqR.exe
  C:\Windows\System\xbTPzqR.exe
  2⤵
  PID:10108
- C:\Windows\System\nFxCcSv.exe
  C:\Windows\System\nFxCcSv.exe
  2⤵
  PID:10124
- C:\Windows\System\fZDgolD.exe
  C:\Windows\System\fZDgolD.exe
  2⤵
  PID:10140
- C:\Windows\System\hHuIsdp.exe
  C:\Windows\System\hHuIsdp.exe
  2⤵
  PID:10156
- C:\Windows\System\nyRCKqP.exe
  C:\Windows\System\nyRCKqP.exe
  2⤵
  PID:10172
- C:\Windows\System\YpGuFYj.exe
  C:\Windows\System\YpGuFYj.exe
  2⤵
  PID:10192
- C:\Windows\System\LiUROWb.exe
  C:\Windows\System\LiUROWb.exe
  2⤵
  PID:10208
- C:\Windows\System\nxQfpfU.exe
  C:\Windows\System\nxQfpfU.exe
  2⤵
  PID:10224
- C:\Windows\System\pdJrgrw.exe
  C:\Windows\System\pdJrgrw.exe
  2⤵
  PID:10244
- C:\Windows\System\DBehJsm.exe
  C:\Windows\System\DBehJsm.exe
  2⤵
  PID:10260
- C:\Windows\System\sNsLpEV.exe
  C:\Windows\System\sNsLpEV.exe
  2⤵
  PID:10492
- C:\Windows\System\QWideJr.exe
  C:\Windows\System\QWideJr.exe
  2⤵
  PID:10512
- C:\Windows\System\twWErKZ.exe
  C:\Windows\System\twWErKZ.exe
  2⤵
  PID:10532
- C:\Windows\System\IGKmHvT.exe
  C:\Windows\System\IGKmHvT.exe
  2⤵
  PID:10548
- C:\Windows\System\GcGCYGj.exe
  C:\Windows\System\GcGCYGj.exe
  2⤵
  PID:10564
- C:\Windows\System\RNJHRwM.exe
  C:\Windows\System\RNJHRwM.exe
  2⤵
  PID:10580
- C:\Windows\System\IRKERwk.exe
  C:\Windows\System\IRKERwk.exe
  2⤵
  PID:10596
- C:\Windows\System\KApkzsG.exe
  C:\Windows\System\KApkzsG.exe
  2⤵
  PID:10612
- C:\Windows\System\bWyQOfD.exe
  C:\Windows\System\bWyQOfD.exe
  2⤵
  PID:10628
- C:\Windows\System\uDpnRen.exe
  C:\Windows\System\uDpnRen.exe
  2⤵
  PID:10656
- C:\Windows\System\ihqxWZq.exe
  C:\Windows\System\ihqxWZq.exe
  2⤵
  PID:10688
- C:\Windows\System\XfoAZoF.exe
  C:\Windows\System\XfoAZoF.exe
  2⤵
  PID:10704
- C:\Windows\System\LALvppF.exe
  C:\Windows\System\LALvppF.exe
  2⤵
  PID:10732
- C:\Windows\System\uWMtjix.exe
  C:\Windows\System\uWMtjix.exe
  2⤵
  PID:10764
- C:\Windows\System\PFpXmij.exe
  C:\Windows\System\PFpXmij.exe
  2⤵
  PID:10800
- C:\Windows\System\qsJUbQX.exe
  C:\Windows\System\qsJUbQX.exe
  2⤵
  PID:10840
- C:\Windows\System\sYEvXch.exe
  C:\Windows\System\sYEvXch.exe
  2⤵
  PID:10876
- C:\Windows\System\YkApHZZ.exe
  C:\Windows\System\YkApHZZ.exe
  2⤵
  PID:10900
- C:\Windows\System\FlSxQrP.exe
  C:\Windows\System\FlSxQrP.exe
  2⤵
  PID:10920
- C:\Windows\System\iHCmRbD.exe
  C:\Windows\System\iHCmRbD.exe
  2⤵
  PID:10960
- C:\Windows\System\GUvZiVp.exe
  C:\Windows\System\GUvZiVp.exe
  2⤵
  PID:10988
- C:\Windows\System\krrgqjP.exe
  C:\Windows\System\krrgqjP.exe
  2⤵
  PID:11016
- C:\Windows\System\bwBUiwT.exe
  C:\Windows\System\bwBUiwT.exe
  2⤵
  PID:11040
- C:\Windows\System\IGcIubS.exe
  C:\Windows\System\IGcIubS.exe
  2⤵
  PID:11076
- C:\Windows\System\kAFnKfM.exe
  C:\Windows\System\kAFnKfM.exe
  2⤵
  PID:11096
- C:\Windows\System\pnOaOgP.exe
  C:\Windows\System\pnOaOgP.exe
  2⤵
  PID:11116
- C:\Windows\System\ZmIyiMG.exe
  C:\Windows\System\ZmIyiMG.exe
  2⤵
  PID:11132
- C:\Windows\System\jpaMZoL.exe
  C:\Windows\System\jpaMZoL.exe
  2⤵
  PID:11152
- C:\Windows\System\fYvSljt.exe
  C:\Windows\System\fYvSljt.exe
  2⤵
  PID:11168
- C:\Windows\System\wzENslp.exe
  C:\Windows\System\wzENslp.exe
  2⤵
  PID:11184
- C:\Windows\System\HZccEqC.exe
  C:\Windows\System\HZccEqC.exe
  2⤵
  PID:11200
- C:\Windows\System\zZdWZzZ.exe
  C:\Windows\System\zZdWZzZ.exe
  2⤵
  PID:11216
- C:\Windows\System\fCWSunn.exe
  C:\Windows\System\fCWSunn.exe
  2⤵
  PID:11232
- C:\Windows\System\EONKjxu.exe
  C:\Windows\System\EONKjxu.exe
  2⤵
  PID:11248
- C:\Windows\System\EzcWWAY.exe
  C:\Windows\System\EzcWWAY.exe
  2⤵
  PID:3652
- C:\Windows\System\tYRGWDq.exe
  C:\Windows\System\tYRGWDq.exe
  2⤵
  PID:5328
- C:\Windows\System\TxQLbSz.exe
  C:\Windows\System\TxQLbSz.exe
  2⤵
  PID:6260
- C:\Windows\System\JzwyViB.exe
  C:\Windows\System\JzwyViB.exe
  2⤵
  PID:6608
- C:\Windows\System\lIpJgcs.exe
  C:\Windows\System\lIpJgcs.exe
  2⤵
  PID:7148
- C:\Windows\System\OOTtpNf.exe
  C:\Windows\System\OOTtpNf.exe
  2⤵
  PID:3856
- C:\Windows\System\EdeKJeB.exe
  C:\Windows\System\EdeKJeB.exe
  2⤵
  PID:5616
- C:\Windows\System\hGEFFUY.exe
  C:\Windows\System\hGEFFUY.exe
  2⤵
  PID:7256
- C:\Windows\System\sfqXUGh.exe
  C:\Windows\System\sfqXUGh.exe
  2⤵
  PID:5932
- C:\Windows\System\PXnrQlf.exe
  C:\Windows\System\PXnrQlf.exe
  2⤵
  PID:8280
- C:\Windows\System\LFfvywy.exe
  C:\Windows\System\LFfvywy.exe
  2⤵
  PID:8440
- C:\Windows\System\eqOgKSk.exe
  C:\Windows\System\eqOgKSk.exe
  2⤵
  PID:8612
- C:\Windows\System\QVZitdG.exe
  C:\Windows\System\QVZitdG.exe
  2⤵
  PID:8680
- C:\Windows\System\ziayxQS.exe
  C:\Windows\System\ziayxQS.exe
  2⤵
  PID:8760
- C:\Windows\System\tmTiLsj.exe
  C:\Windows\System\tmTiLsj.exe
  2⤵
  PID:11280
- C:\Windows\System\zKQiFfd.exe
  C:\Windows\System\zKQiFfd.exe
  2⤵
  PID:11296
- C:\Windows\System\OavVvjL.exe
  C:\Windows\System\OavVvjL.exe
  2⤵
  PID:11312
- C:\Windows\System\JYZmaLR.exe
  C:\Windows\System\JYZmaLR.exe
  2⤵
  PID:11332
- C:\Windows\System\wvyPwJV.exe
  C:\Windows\System\wvyPwJV.exe
  2⤵
  PID:11352
- C:\Windows\System\ahtCdBI.exe
  C:\Windows\System\ahtCdBI.exe
  2⤵
  PID:11380
- C:\Windows\System\jMccdBe.exe
  C:\Windows\System\jMccdBe.exe
  2⤵
  PID:11416
- C:\Windows\System\HaVqsqC.exe
  C:\Windows\System\HaVqsqC.exe
  2⤵
  PID:11440
- C:\Windows\System\xYBznIr.exe
  C:\Windows\System\xYBznIr.exe
  2⤵
  PID:11460
- C:\Windows\System\hJsowru.exe
  C:\Windows\System\hJsowru.exe
  2⤵
  PID:11480
- C:\Windows\System\vObmJYI.exe
  C:\Windows\System\vObmJYI.exe
  2⤵
  PID:11496
- C:\Windows\System\CGObUWA.exe
  C:\Windows\System\CGObUWA.exe
  2⤵
  PID:11516
- C:\Windows\System\ocUBpRT.exe
  C:\Windows\System\ocUBpRT.exe
  2⤵
  PID:11532
- C:\Windows\System\NcfJZWM.exe
  C:\Windows\System\NcfJZWM.exe
  2⤵
  PID:11552
- C:\Windows\System\ucdYzMI.exe
  C:\Windows\System\ucdYzMI.exe
  2⤵
  PID:11568
- C:\Windows\System\WwAFxNa.exe
  C:\Windows\System\WwAFxNa.exe
  2⤵
  PID:11584
- C:\Windows\System\byuxbhB.exe
  C:\Windows\System\byuxbhB.exe
  2⤵
  PID:11600
- C:\Windows\System\VZFRIdx.exe
  C:\Windows\System\VZFRIdx.exe
  2⤵
  PID:11616
- C:\Windows\System\iRxfSlM.exe
  C:\Windows\System\iRxfSlM.exe
  2⤵
  PID:11632
- C:\Windows\System\jwcAYiU.exe
  C:\Windows\System\jwcAYiU.exe
  2⤵
  PID:11648
- C:\Windows\System\vNZnkYI.exe
  C:\Windows\System\vNZnkYI.exe
  2⤵
  PID:11664
- C:\Windows\System\UfKeumO.exe
  C:\Windows\System\UfKeumO.exe
  2⤵
  PID:11696
- C:\Windows\System\ilryuKN.exe
  C:\Windows\System\ilryuKN.exe
  2⤵
  PID:11724
- C:\Windows\System\aIVKoXb.exe
  C:\Windows\System\aIVKoXb.exe
  2⤵
  PID:11744
- C:\Windows\System\joFjBWU.exe
  C:\Windows\System\joFjBWU.exe
  2⤵
  PID:11760
- C:\Windows\System\MQRVdkV.exe
  C:\Windows\System\MQRVdkV.exe
  2⤵
  PID:11780
- C:\Windows\System\VsfXGqJ.exe
  C:\Windows\System\VsfXGqJ.exe
  2⤵
  PID:11796
- C:\Windows\System\VbBCvxd.exe
  C:\Windows\System\VbBCvxd.exe
  2⤵
  PID:11812
- C:\Windows\System\LFTGhLa.exe
  C:\Windows\System\LFTGhLa.exe
  2⤵
  PID:11828
- C:\Windows\System\HnVbMfL.exe
  C:\Windows\System\HnVbMfL.exe
  2⤵
  PID:11844
- C:\Windows\System\kVddCZK.exe
  C:\Windows\System\kVddCZK.exe
  2⤵
  PID:11864
- C:\Windows\System\tQwsOeN.exe
  C:\Windows\System\tQwsOeN.exe
  2⤵
  PID:11884
- C:\Windows\System\tWNJRen.exe
  C:\Windows\System\tWNJRen.exe
  2⤵
  PID:11920
- C:\Windows\System\yNIchsG.exe
  C:\Windows\System\yNIchsG.exe
  2⤵
  PID:11952
- C:\Windows\System\ToUxJIW.exe
  C:\Windows\System\ToUxJIW.exe
  2⤵
  PID:11968
- C:\Windows\System\KxGqxTd.exe
  C:\Windows\System\KxGqxTd.exe
  2⤵
  PID:11984
- C:\Windows\System\DOmSBDJ.exe
  C:\Windows\System\DOmSBDJ.exe
  2⤵
  PID:12000
- C:\Windows\System\gKCOfPV.exe
  C:\Windows\System\gKCOfPV.exe
  2⤵
  PID:12016
- C:\Windows\System\QQVKsXJ.exe
  C:\Windows\System\QQVKsXJ.exe
  2⤵
  PID:12076
- C:\Windows\System\BrRirXq.exe
  C:\Windows\System\BrRirXq.exe
  2⤵
  PID:12092
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12092 -s 248
    3⤵
    PID:3920
- C:\Windows\System\roNuczr.exe
  C:\Windows\System\roNuczr.exe
  2⤵
  PID:12108
- C:\Windows\System\bmxicMD.exe
  C:\Windows\System\bmxicMD.exe
  2⤵
  PID:12124
- C:\Windows\System\piClCnx.exe
  C:\Windows\System\piClCnx.exe
  2⤵
  PID:12140
- C:\Windows\System\sVyuIGA.exe
  C:\Windows\System\sVyuIGA.exe
  2⤵
  PID:12156
- C:\Windows\System\kiQJJie.exe
  C:\Windows\System\kiQJJie.exe
  2⤵
  PID:12172
- C:\Windows\System\NcmfDut.exe
  C:\Windows\System\NcmfDut.exe
  2⤵
  PID:12188
- C:\Windows\System\FhCdZZd.exe
  C:\Windows\System\FhCdZZd.exe
  2⤵
  PID:12208
- C:\Windows\System\dHSXkXI.exe
  C:\Windows\System\dHSXkXI.exe
  2⤵
  PID:12224
- C:\Windows\System\dWsKHTA.exe
  C:\Windows\System\dWsKHTA.exe
  2⤵
  PID:12248
- C:\Windows\System\okwAiBU.exe
  C:\Windows\System\okwAiBU.exe
  2⤵
  PID:12264
- C:\Windows\System\iuKhMaW.exe
  C:\Windows\System\iuKhMaW.exe
  2⤵
  PID:8320
- C:\Windows\System\VHUvdZi.exe
  C:\Windows\System\VHUvdZi.exe
  2⤵
  PID:8844
- C:\Windows\System\KsFdGDs.exe
  C:\Windows\System\KsFdGDs.exe
  2⤵
  PID:8880
- C:\Windows\System\odCvUZZ.exe
  C:\Windows\System\odCvUZZ.exe
  2⤵
  PID:8920
- C:\Windows\System\OuGkhex.exe
  C:\Windows\System\OuGkhex.exe
  2⤵
  PID:8456
- C:\Windows\System\RCLizpN.exe
  C:\Windows\System\RCLizpN.exe
  2⤵
  PID:9252
- C:\Windows\System\NALAfCU.exe
  C:\Windows\System\NALAfCU.exe
  2⤵
  PID:9384
- C:\Windows\System\MFSbYYk.exe
  C:\Windows\System\MFSbYYk.exe
  2⤵
  PID:9432
- C:\Windows\System\APbgtVt.exe
  C:\Windows\System\APbgtVt.exe
  2⤵
  PID:9500
- C:\Windows\System\RiwvuGM.exe
  C:\Windows\System\RiwvuGM.exe
  2⤵
  PID:9540
- C:\Windows\System\XGvgDfx.exe
  C:\Windows\System\XGvgDfx.exe
  2⤵
  PID:8552
- C:\Windows\System\JRqvxWF.exe
  C:\Windows\System\JRqvxWF.exe
  2⤵
  PID:9720
- C:\Windows\System\aWHQAir.exe
  C:\Windows\System\aWHQAir.exe
  2⤵
  PID:9748
- C:\Windows\System\djfNDFr.exe
  C:\Windows\System\djfNDFr.exe
  2⤵
  PID:9804
- C:\Windows\System\NvANahh.exe
  C:\Windows\System\NvANahh.exe
  2⤵
  PID:9860
- C:\Windows\System\MCUuumq.exe
  C:\Windows\System\MCUuumq.exe
  2⤵
  PID:9896
- C:\Windows\System\iXfdGjR.exe
  C:\Windows\System\iXfdGjR.exe
  2⤵
  PID:10116
- C:\Windows\System\KOGaGwC.exe
  C:\Windows\System\KOGaGwC.exe
  2⤵
  PID:7772
- C:\Windows\System\jyostXQ.exe
  C:\Windows\System\jyostXQ.exe
  2⤵
  PID:4400
- C:\Windows\System\iQoGbRc.exe
  C:\Windows\System\iQoGbRc.exe
  2⤵
  PID:7840
- C:\Windows\System\uXffvUh.exe
  C:\Windows\System\uXffvUh.exe
  2⤵
  PID:7884
- C:\Windows\System\wzXjaHD.exe
  C:\Windows\System\wzXjaHD.exe
  2⤵
  PID:7920
- C:\Windows\System\pJqKLGZ.exe
  C:\Windows\System\pJqKLGZ.exe
  2⤵
  PID:7968
- C:\Windows\System\PcRzcGQ.exe
  C:\Windows\System\PcRzcGQ.exe
  2⤵
  PID:8012
- C:\Windows\System\nWCzujR.exe
  C:\Windows\System\nWCzujR.exe
  2⤵
  PID:8048
- C:\Windows\System\ClqOewj.exe
  C:\Windows\System\ClqOewj.exe
  2⤵
  PID:8096
- C:\Windows\System\KOuWphS.exe
  C:\Windows\System\KOuWphS.exe
  2⤵
  PID:8164
- C:\Windows\System\QHjDrOU.exe
  C:\Windows\System\QHjDrOU.exe
  2⤵
  PID:5996
- C:\Windows\System\FwIMuNh.exe
  C:\Windows\System\FwIMuNh.exe
  2⤵
  PID:4024
- C:\Windows\System\WrLKwpE.exe
  C:\Windows\System\WrLKwpE.exe
  2⤵
  PID:6344
- C:\Windows\System\sKEVkmD.exe
  C:\Windows\System\sKEVkmD.exe
  2⤵
  PID:5948
- C:\Windows\System\caoRjEP.exe
  C:\Windows\System\caoRjEP.exe
  2⤵
  PID:5212
- C:\Windows\System\GuWeMKF.exe
  C:\Windows\System\GuWeMKF.exe
  2⤵
  PID:7412
- C:\Windows\System\AUpPNWz.exe
  C:\Windows\System\AUpPNWz.exe
  2⤵
  PID:7560
- C:\Windows\System\UTVZugV.exe
  C:\Windows\System\UTVZugV.exe
  2⤵
  PID:8228
- C:\Windows\System\ndNdGSY.exe
  C:\Windows\System\ndNdGSY.exe
  2⤵
  PID:8364
- C:\Windows\System\WqwjLwr.exe
  C:\Windows\System\WqwjLwr.exe
  2⤵
  PID:8976
- C:\Windows\System\RMeJQzC.exe
  C:\Windows\System\RMeJQzC.exe
  2⤵
  PID:468
- C:\Windows\System\FhsgBgq.exe
  C:\Windows\System\FhsgBgq.exe
  2⤵
  PID:12300
- C:\Windows\System\UTgPNOL.exe
  C:\Windows\System\UTgPNOL.exe
  2⤵
  PID:12324
- C:\Windows\System\onhaExz.exe
  C:\Windows\System\onhaExz.exe
  2⤵
  PID:12340
- C:\Windows\System\eYmXtqD.exe
  C:\Windows\System\eYmXtqD.exe
  2⤵
  PID:12364
- C:\Windows\System\naflzHK.exe
  C:\Windows\System\naflzHK.exe
  2⤵
  PID:12388
- C:\Windows\System\Hzwveer.exe
  C:\Windows\System\Hzwveer.exe
  2⤵
  PID:12412
- C:\Windows\System\OnLKLgl.exe
  C:\Windows\System\OnLKLgl.exe
  2⤵
  PID:12436
- C:\Windows\System\FjDPPCy.exe
  C:\Windows\System\FjDPPCy.exe
  2⤵
  PID:12452
- C:\Windows\System\NBaJwfV.exe
  C:\Windows\System\NBaJwfV.exe
  2⤵
  PID:12468
- C:\Windows\System\CITlyaI.exe
  C:\Windows\System\CITlyaI.exe
  2⤵
  PID:12484
- C:\Windows\System\hTDZLjd.exe
  C:\Windows\System\hTDZLjd.exe
  2⤵
  PID:12500
- C:\Windows\System\UgpFHys.exe
  C:\Windows\System\UgpFHys.exe
  2⤵
  PID:12520
- C:\Windows\System\wbmXBzs.exe
  C:\Windows\System\wbmXBzs.exe
  2⤵
  PID:12536
- C:\Windows\System\cBGCiQO.exe
  C:\Windows\System\cBGCiQO.exe
  2⤵
  PID:12560
- C:\Windows\System\yKwDemc.exe
  C:\Windows\System\yKwDemc.exe
  2⤵
  PID:12584
- C:\Windows\System\JcIidFJ.exe
  C:\Windows\System\JcIidFJ.exe
  2⤵
  PID:12604
- C:\Windows\System\ctrMOTP.exe
  C:\Windows\System\ctrMOTP.exe
  2⤵
  PID:12624
- C:\Windows\System\OjUwGov.exe
  C:\Windows\System\OjUwGov.exe
  2⤵
  PID:12652
- C:\Windows\System\mmCcwsb.exe
  C:\Windows\System\mmCcwsb.exe
  2⤵
  PID:12688
- C:\Windows\System\TfiqPgz.exe
  C:\Windows\System\TfiqPgz.exe
  2⤵
  PID:12720
- C:\Windows\System\JYGQunW.exe
  C:\Windows\System\JYGQunW.exe
  2⤵
  PID:12744
- C:\Windows\System\WhAtABA.exe
  C:\Windows\System\WhAtABA.exe
  2⤵
  PID:12764
- C:\Windows\System\qCHpOXZ.exe
  C:\Windows\System\qCHpOXZ.exe
  2⤵
  PID:12784
- C:\Windows\System\rzvkdCi.exe
  C:\Windows\System\rzvkdCi.exe
  2⤵
  PID:12800
- C:\Windows\System\woFoNEO.exe
  C:\Windows\System\woFoNEO.exe
  2⤵
  PID:12820
- C:\Windows\System\WfRgEov.exe
  C:\Windows\System\WfRgEov.exe
  2⤵
  PID:12844
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12844 -s 248
    3⤵
    PID:14280
- C:\Windows\System\UhhVVZP.exe
  C:\Windows\System\UhhVVZP.exe
  2⤵
  PID:12868
- C:\Windows\System\DbLGsuX.exe
  C:\Windows\System\DbLGsuX.exe
  2⤵
  PID:12884
- C:\Windows\System\uvInLFI.exe
  C:\Windows\System\uvInLFI.exe
  2⤵
  PID:12904
- C:\Windows\System\TntkYaI.exe
  C:\Windows\System\TntkYaI.exe
  2⤵
  PID:12920
- C:\Windows\System\pSpmzUf.exe
  C:\Windows\System\pSpmzUf.exe
  2⤵
  PID:12940
- C:\Windows\System\RipzvqS.exe
  C:\Windows\System\RipzvqS.exe
  2⤵
  PID:12960
- C:\Windows\System\jJIIZOI.exe
  C:\Windows\System\jJIIZOI.exe
  2⤵
  PID:12980
- C:\Windows\System\dlWkWwN.exe
  C:\Windows\System\dlWkWwN.exe
  2⤵
  PID:13000
- C:\Windows\System\TueusUd.exe
  C:\Windows\System\TueusUd.exe
  2⤵
  PID:13020
- C:\Windows\System\keJlMPW.exe
  C:\Windows\System\keJlMPW.exe
  2⤵
  PID:13036
- C:\Windows\System\zrkpqzT.exe
  C:\Windows\System\zrkpqzT.exe
  2⤵
  PID:13056
- C:\Windows\System\DLHebPh.exe
  C:\Windows\System\DLHebPh.exe
  2⤵
  PID:13076
- C:\Windows\System\lgHQjDB.exe
  C:\Windows\System\lgHQjDB.exe
  2⤵
  PID:13096
- C:\Windows\System\fkdmnYI.exe
  C:\Windows\System\fkdmnYI.exe
  2⤵
  PID:13112
- C:\Windows\System\gpkPELE.exe
  C:\Windows\System\gpkPELE.exe
  2⤵
  PID:13132
- C:\Windows\System\PAaIoUc.exe
  C:\Windows\System\PAaIoUc.exe
  2⤵
  PID:13156
- C:\Windows\System\mPpyDZT.exe
  C:\Windows\System\mPpyDZT.exe
  2⤵
  PID:13172
- C:\Windows\System\JymvVtL.exe
  C:\Windows\System\JymvVtL.exe
  2⤵
  PID:13196
- C:\Windows\System\rRONZSv.exe
  C:\Windows\System\rRONZSv.exe
  2⤵
  PID:13216
- C:\Windows\System\KDAMnXb.exe
  C:\Windows\System\KDAMnXb.exe
  2⤵
  PID:13240
- C:\Windows\System\AfCRePA.exe
  C:\Windows\System\AfCRePA.exe
  2⤵
  PID:13260
- C:\Windows\System\dvOJWFA.exe
  C:\Windows\System\dvOJWFA.exe
  2⤵
  PID:13280
- C:\Windows\System\HcynLXk.exe
  C:\Windows\System\HcynLXk.exe
  2⤵
  PID:13300
- C:\Windows\System\ziulUnM.exe
  C:\Windows\System\ziulUnM.exe
  2⤵
  PID:2880
- C:\Windows\System\AiadMpo.exe
  C:\Windows\System\AiadMpo.exe
  2⤵
  PID:8460
- C:\Windows\System\suhYBGG.exe
  C:\Windows\System\suhYBGG.exe
  2⤵
  PID:8616
- C:\Windows\System\HwNsgzb.exe
  C:\Windows\System\HwNsgzb.exe
  2⤵
  PID:8696
- C:\Windows\System\KqtuDMn.exe
  C:\Windows\System\KqtuDMn.exe
  2⤵
  PID:8260
- C:\Windows\System\HSCHhdI.exe
  C:\Windows\System\HSCHhdI.exe
  2⤵
  PID:8796
- C:\Windows\System\qGTgIuB.exe
  C:\Windows\System\qGTgIuB.exe
  2⤵
  PID:11308
- C:\Windows\System\jbltiSR.exe
  C:\Windows\System\jbltiSR.exe
  2⤵
  PID:13340
- C:\Windows\System\echPNvv.exe
  C:\Windows\System\echPNvv.exe
  2⤵
  PID:13360
- C:\Windows\System\iTsaAou.exe
  C:\Windows\System\iTsaAou.exe
  2⤵
  PID:13380
- C:\Windows\System\HlVqiZv.exe
  C:\Windows\System\HlVqiZv.exe
  2⤵
  PID:13396
- C:\Windows\System\GDOfSZA.exe
  C:\Windows\System\GDOfSZA.exe
  2⤵
  PID:13420
- C:\Windows\System\mjEoTXI.exe
  C:\Windows\System\mjEoTXI.exe
  2⤵
  PID:13440
- C:\Windows\System\csTCQWy.exe
  C:\Windows\System\csTCQWy.exe
  2⤵
  PID:13460
- C:\Windows\System\BrkJhdN.exe
  C:\Windows\System\BrkJhdN.exe
  2⤵
  PID:13480
- C:\Windows\System\FnqcdhJ.exe
  C:\Windows\System\FnqcdhJ.exe
  2⤵
  PID:13500
- C:\Windows\System\uIGjRoL.exe
  C:\Windows\System\uIGjRoL.exe
  2⤵
  PID:13532
- C:\Windows\System\oqtOUOw.exe
  C:\Windows\System\oqtOUOw.exe
  2⤵
  PID:13552
- C:\Windows\System\cHFuzrJ.exe
  C:\Windows\System\cHFuzrJ.exe
  2⤵
  PID:13568
- C:\Windows\System\DHRtLcq.exe
  C:\Windows\System\DHRtLcq.exe
  2⤵
  PID:13584
- C:\Windows\System\AovrXOr.exe
  C:\Windows\System\AovrXOr.exe
  2⤵
  PID:13600
- C:\Windows\System\fuNiIOG.exe
  C:\Windows\System\fuNiIOG.exe
  2⤵
  PID:13620
- C:\Windows\System\pVYYWzu.exe
  C:\Windows\System\pVYYWzu.exe
  2⤵
  PID:13640
- C:\Windows\System\WDhQLQl.exe
  C:\Windows\System\WDhQLQl.exe
  2⤵
  PID:13656
- C:\Windows\System\TBpBMMz.exe
  C:\Windows\System\TBpBMMz.exe
  2⤵
  PID:13676
- C:\Windows\System\EVrSzQi.exe
  C:\Windows\System\EVrSzQi.exe
  2⤵
  PID:13692
- C:\Windows\System\JtqGcpc.exe
  C:\Windows\System\JtqGcpc.exe
  2⤵
  PID:13712
- C:\Windows\System\OMEYMFu.exe
  C:\Windows\System\OMEYMFu.exe
  2⤵
  PID:13732
- C:\Windows\System\EQnlLDm.exe
  C:\Windows\System\EQnlLDm.exe
  2⤵
  PID:13756
- C:\Windows\System\PNamNYl.exe
  C:\Windows\System\PNamNYl.exe
  2⤵
  PID:13776
- C:\Windows\System\SQHBbkg.exe
  C:\Windows\System\SQHBbkg.exe
  2⤵
  PID:13804
- C:\Windows\System\bstQgys.exe
  C:\Windows\System\bstQgys.exe
  2⤵
  PID:13820
- C:\Windows\System\jNupAzd.exe
  C:\Windows\System\jNupAzd.exe
  2⤵
  PID:13844
- C:\Windows\System\iWasHmQ.exe
  C:\Windows\System\iWasHmQ.exe
  2⤵
  PID:13876
- C:\Windows\System\UKgSCOr.exe
  C:\Windows\System\UKgSCOr.exe
  2⤵
  PID:13892
- C:\Windows\System\OBhseeR.exe
  C:\Windows\System\OBhseeR.exe
  2⤵
  PID:13908
- C:\Windows\System\iJsEMyL.exe
  C:\Windows\System\iJsEMyL.exe
  2⤵
  PID:13924
- C:\Windows\System\ggOnjaS.exe
  C:\Windows\System\ggOnjaS.exe
  2⤵
  PID:13940
- C:\Windows\System\ZoWZdNn.exe
  C:\Windows\System\ZoWZdNn.exe
  2⤵
  PID:13956
- C:\Windows\System\uEKEPAp.exe
  C:\Windows\System\uEKEPAp.exe
  2⤵
  PID:13972
- C:\Windows\System\TEDgnjv.exe
  C:\Windows\System\TEDgnjv.exe
  2⤵
  PID:13988
- C:\Windows\System\rXCJciP.exe
  C:\Windows\System\rXCJciP.exe
  2⤵
  PID:14004
- C:\Windows\System\XCoAUaO.exe
  C:\Windows\System\XCoAUaO.exe
  2⤵
  PID:14028
- C:\Windows\System\lezeGhv.exe
  C:\Windows\System\lezeGhv.exe
  2⤵
  PID:14048
- C:\Windows\System\ydVCrMe.exe
  C:\Windows\System\ydVCrMe.exe
  2⤵
  PID:14072
- C:\Windows\System\XAcLYlm.exe
  C:\Windows\System\XAcLYlm.exe
  2⤵
  PID:14092
- C:\Windows\System\xlEhiJO.exe
  C:\Windows\System\xlEhiJO.exe
  2⤵
  PID:14116
- C:\Windows\System\oIHfXVK.exe
  C:\Windows\System\oIHfXVK.exe
  2⤵
  PID:14136
- C:\Windows\System\UimwEfz.exe
  C:\Windows\System\UimwEfz.exe
  2⤵
  PID:14152
- C:\Windows\System\LkaEtWM.exe
  C:\Windows\System\LkaEtWM.exe
  2⤵
  PID:14176
- C:\Windows\System\SrAeqHJ.exe
  C:\Windows\System\SrAeqHJ.exe
  2⤵
  PID:14196
- C:\Windows\System\XnfDDpA.exe
  C:\Windows\System\XnfDDpA.exe
  2⤵
  PID:14216
- C:\Windows\System\qddvfmc.exe
  C:\Windows\System\qddvfmc.exe
  2⤵
  PID:14232
- C:\Windows\System\DETTDPd.exe
  C:\Windows\System\DETTDPd.exe
  2⤵
  PID:14252
- C:\Windows\System\hgwClMk.exe
  C:\Windows\System\hgwClMk.exe
  2⤵
  PID:14272
- C:\Windows\System\kdrfTUV.exe
  C:\Windows\System\kdrfTUV.exe
  2⤵
  PID:14288
- C:\Windows\System\QUkxuGE.exe
  C:\Windows\System\QUkxuGE.exe
  2⤵
  PID:14304
- C:\Windows\System\SAfjqAk.exe
  C:\Windows\System\SAfjqAk.exe
  2⤵
  PID:14324
- C:\Windows\System\LMpwIWy.exe
  C:\Windows\System\LMpwIWy.exe
  2⤵
  PID:8944
- C:\Windows\System\yTqHqeJ.exe
  C:\Windows\System\yTqHqeJ.exe
  2⤵
  PID:8380
- C:\Windows\System\WFqqFvM.exe
  C:\Windows\System\WFqqFvM.exe
  2⤵
  PID:11432
- C:\Windows\System\IpUNodB.exe
  C:\Windows\System\IpUNodB.exe
  2⤵
  PID:9000
- C:\Windows\System\FTWXglI.exe
  C:\Windows\System\FTWXglI.exe
  2⤵
  PID:9044
- C:\Windows\System\EwFTzQT.exe
  C:\Windows\System\EwFTzQT.exe
  2⤵
  PID:9076
- C:\Windows\System\uxtVRNA.exe
  C:\Windows\System\uxtVRNA.exe
  2⤵
  PID:9116
- C:\Windows\System\NWTfVoz.exe
  C:\Windows\System\NWTfVoz.exe
  2⤵
  PID:9160
- C:\Windows\System\cczQUHW.exe
  C:\Windows\System\cczQUHW.exe
  2⤵
  PID:9256
- C:\Windows\System\AVAyMbk.exe
  C:\Windows\System\AVAyMbk.exe
  2⤵
  PID:9292
- C:\Windows\System\ZYvReLt.exe
  C:\Windows\System\ZYvReLt.exe
  2⤵
  PID:9328
- C:\Windows\System\qRkNERj.exe
  C:\Windows\System\qRkNERj.exe
  2⤵
  PID:11772
- C:\Windows\System\WlZZnou.exe
  C:\Windows\System\WlZZnou.exe
  2⤵
  PID:11876
- C:\Windows\System\IRQTcOd.exe
  C:\Windows\System\IRQTcOd.exe
  2⤵
  PID:9828
- C:\Windows\System\VEibMGk.exe
  C:\Windows\System\VEibMGk.exe
  2⤵
  PID:9004
- C:\Windows\System\Gfniqcu.exe
  C:\Windows\System\Gfniqcu.exe
  2⤵
  PID:10048
- C:\Windows\System\UQEvEfI.exe
  C:\Windows\System\UQEvEfI.exe
  2⤵
  PID:10080
- C:\Windows\System\LwLiDcO.exe
  C:\Windows\System\LwLiDcO.exe
  2⤵
  PID:14212
- C:\Windows\System\cVszFzQ.exe
  C:\Windows\System\cVszFzQ.exe
  2⤵
  PID:11412
- C:\Windows\System\VJExYmh.exe
  C:\Windows\System\VJExYmh.exe
  2⤵
  PID:9084
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9084 -s 252
    3⤵
    PID:13724
- C:\Windows\System\RdaQUiK.exe
  C:\Windows\System\RdaQUiK.exe
  2⤵
  PID:9276
- C:\Windows\System\wEPuOfs.exe
  C:\Windows\System\wEPuOfs.exe
  2⤵
  PID:10672
- C:\Windows\System\jZoTINT.exe
  C:\Windows\System\jZoTINT.exe
  2⤵
  PID:10936
- C:\Windows\System\rkDyxld.exe
  C:\Windows\System\rkDyxld.exe
  2⤵
  PID:11024
- C:\Windows\System\daELPCS.exe
  C:\Windows\System\daELPCS.exe
  2⤵
  PID:11140
- C:\Windows\System\WPxSFqr.exe
  C:\Windows\System\WPxSFqr.exe
  2⤵
  PID:14128
- C:\Windows\System\zFDNUVK.exe
  C:\Windows\System\zFDNUVK.exe
  2⤵
  PID:6548
- C:\Windows\System\ODDXbsA.exe
  C:\Windows\System\ODDXbsA.exe
  2⤵
  PID:4968
- C:\Windows\System\dPpZGyF.exe
  C:\Windows\System\dPpZGyF.exe
  2⤵
  PID:12708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CLmjwTq.exe

Filesize
1.1MB

MD5
1f7b4e19a892d2db0c391da85657459a

SHA1
5b25a5e88e555e8e7d447b3753547d77af959e17

SHA256
4c114ede6cc66048bf49e61fc1b7f29e410403d7169ae804d911cc5929b14540

SHA512
088f326f38dd3d844073c0c5f6d4cc0b16ff71a9b3196701c4de543d4b0b4c551ffd72e2e1657d907da21bea35ff2f8327286b4fe6736d65f959bcbacb1927c4

Download Submit
C:\Windows\System\Ckekeuf.exe

Filesize
1.1MB

MD5
38b32266afce82a411b213bf2c3f6001

SHA1
8613e6c3320c6c04a5e7ffac8f5e6c2749e77945

SHA256
7cd60944ddf2a797c90f60f6a4ae2ade01c4e12c121e66dd4d41aca3a30072c4

SHA512
6be9d4558110fb30824b20a2d27a0545e5b275d3e64c24a6fd6ab28ae50db49f72c9a157d1f75bf94aec0ad53475dafddc5a7a068e878537c56ca1fcb527068a

Download Submit
C:\Windows\System\DtaImmE.exe

Filesize
1.1MB

MD5
98e56e42aa856abb98577de73588034e

SHA1
424b7c5f320dd288ad12e93ba0f08738e6ca31d9

SHA256
688054f08fdf977fea96d92546d6e0b3313ea3dbcbe76e778d452a56d6cb3e6a

SHA512
f661c1bda6c2cb6e4debeaec1ccfdf0e9ce40145952975529a108e02a88f4440aeae216adf94197c024752b2f1fc433e2e048855c1cfafeedb310fb3c9699a34

Download Submit
C:\Windows\System\EAPIaEO.exe

Filesize
1.1MB

MD5
08fb524e73fac77e4d2031392ad09c89

SHA1
7f0dffbef377b79848958f6664cd71039e26e4a7

SHA256
a5ed6b6c76055f29aa4f8670ab6ae4c66886ad0e728fd42a36b20e44d95bc906

SHA512
f61bcdef15c4521925c8b238a58cfe2b059f9594f8deb55c67c7719664b8ef05d764e45257b54a7643b08539c1134dcf58194d1b539027768f5d8f1e3d77f3f1

Download Submit
C:\Windows\System\ESezokb.exe

Filesize
1.1MB

MD5
53b58869860613a190a2c0d8eeb22931

SHA1
36f579332a991ed5c37cc18c5a15730eb6d85e41

SHA256
563905432deffac6f4a7f042b0f5715109c2e1a8eb24a6218c5967020b744ff8

SHA512
7473b2119e773a4b1e030e95f3cffb81cc8826e55a38cfca4b4849e953ee689e76466560bab446b6a3c60b8eb085954a352e63383e081a7946132c724b21ba98

Download Submit
C:\Windows\System\HtwqSlZ.exe

Filesize
1.1MB

MD5
93a821bb7753674e94c96cf81561c5ff

SHA1
e0a2d501b38785b24ebdd307b48280f138a99d96

SHA256
931d4c64e0fe3e1ab86a0aeec6ddc4cdf5cfad99258e8131f6f6e8f0051d180c

SHA512
7aa858e37a3d550067dbeafa3c9570c8a4a0569285a01353b76c5eec4470b755abb3b06e4fa3fbc9485933088a1462f41ebe72095b101b1d5d7543c693ff7d1a

Download Submit
C:\Windows\System\HumrCBy.exe

Filesize
1.1MB

MD5
89c97b3f18cbead8e649f05657e071ec

SHA1
c49f392370b7cda59964b6db210750f9e998b0fe

SHA256
9a5a41cc7d3f7ee68715ca62982a90b9a705219261b4d44d8328003b9b495a28

SHA512
be12d0fdb82aa40c1124f0c3764a49a60516c80d89f3980ae3aeabc69533b41e489dd37a922fc10839cc9f379fd47c8acd96068767e48fc226031579982a84cf

Download Submit
C:\Windows\System\IYbdxDi.exe

Filesize
1.1MB

MD5
4bc653eda8151d2daf2bb53f2fad8473

SHA1
3b123f2859ea28ab234267bb49e9170ee585a00e

SHA256
de1a757fb15b1edfceabf9751097575447f5608b1d59c1c5c465d2795f34ebc7

SHA512
519372ffe05d1179ff747c626d0ab13b2f321ff9e498878e8553b5ac6990821ec3b9bfcd42f8712ad905ab2d8aff2e2b5f62e6e899b446f5692cb6b8c593ba0b

Download Submit
C:\Windows\System\JMuCEyh.exe

Filesize
1.1MB

MD5
da0915a271904aa2735a8f311ec527ef

SHA1
abb6b429d81d56edf4ca10b114fb3d58b09f78c9

SHA256
6c1881068162939f933482717a249ac3343f5df2ae2da2dcc2425a1935f8b0f6

SHA512
fac431e1b1e3df326a4c698ba630aff1fb81924efada7588ba53cc0f74af8ae2605bd286ecd5af0c51c99cec0e7d0820b276ac85f3a71226dd574aff0a4160cb

Download Submit
C:\Windows\System\JOgWIXv.exe

Filesize
1.1MB

MD5
44fd51819fe80cdbd80c64f1f71ad3e4

SHA1
7e43977808a82e02ccf0fcaa7fcf1a25676a97fc

SHA256
359f0111e6d4a488dede99fe81366e5b00e5900dbabf61f96a86b6609e3adace

SHA512
96d93c6ad31d607f4d44f0b5955dd70b3c59035d4cabc1b12aa864cda47a1a04eb346a2e756729026ed2d16daa0aabb5f1a14829a75c4d1c3edb4e0aa01ba9c8

Download Submit
C:\Windows\System\JRCbXni.exe

Filesize
1.1MB

MD5
b2189fb35938e474dfd4cf7159c5abfd

SHA1
329d54396b36a901333aacb3d8b3edce73414f0d

SHA256
f07deb1f35505e4a1af915c9bb40f9d0588e3bf5e02119a689847925775bcd69

SHA512
8c1b440cab169db315583534dd4aecdd38772d4e2784abd073fc1271c131e53b9a647ae80bef3dfb9ede6486dc7c70df0c41a5501ce85eab033fbfcc65ffa7c2

Download Submit
C:\Windows\System\KGlNOiX.exe

Filesize
1.1MB

MD5
cbd6a2ca6ad508dd479f5fc2bb3c2eb6

SHA1
0c5b9ca80f1fa29dd9de1122504b4890d64173d8

SHA256
ef9c71c85b05e9edc4095466f180bd3479ce30112989d6327cd479b62e56ce59

SHA512
3e4cdae323a4e05cccef811c3f8a9fdce6484cbb46490f90228d3cfc59ad66c0f758540a3b6628101107c0664e95282484843e81b98204107f5ea85fdd4b585b

Download Submit
C:\Windows\System\Lqhaova.exe

Filesize
1.1MB

MD5
0dc09bc492531e731b76663125233af2

SHA1
57695bb5e04897227559d98f99c983964775f85e

SHA256
924ccde55c1254c571f774ef9cf611adf491ff9f00e77535939cee092fc80845

SHA512
e7453d663b46ecf35b154807bf81246af57e3a87eacbcc20fadc9dabf2280c5c14d997b1acbc6f5a4117ec1d2133a4df0468479e2ec2042b471d50a17de960df

Download Submit
C:\Windows\System\MNMxFty.exe

Filesize
1.1MB

MD5
5f67f5d8c010eb8c6e89b2bc169a0f8d

SHA1
0246374007f6c3dfbdae11b8672a0f8b7ae8b9d4

SHA256
4162e6cc3926d9981796299f1c2c781de40d92b4b6f64e3c656df53e6810b623

SHA512
227ece5af53d5c64f696d0a67656901a362d497d295e1bd84967160e0bac1ee375f9df3ca1606f7d608c17bf28d85f3bbb2a8115f8e788ebad6ed5330dbc52f6

Download Submit
C:\Windows\System\NHxGrdZ.exe

Filesize
1.1MB

MD5
bd51bfb93e388b1a3ab1801aef247830

SHA1
f02c9ce2f433cf955fb02a76665a90a3908b88e4

SHA256
682a74dae4ace3ffa3d0974f22aa8f6a9a48efb569b1b06d45513470457886f1

SHA512
b834190de42f38ff5a8dd25cfe3850107543d11ab863c8686c04330d47ba244426068f533cdd4ebf475faf5f981971264bd6db5ae2eaf32420c7197743e67a70

Download Submit
C:\Windows\System\RjMcXSv.exe

Filesize
1.1MB

MD5
214c1cd85a98d81b75fcbe3db988f389

SHA1
a0844a0b3e4a7da6b0d2782f3e6eb052e2cac875

SHA256
52fa9b008ec794969330df93b90197f07440a0f34477e2239fe904dcb76bf2b7

SHA512
d3e118731edd039b54dfb9be3a1f3ec65213e4dcf7dc2de59bf65fdd65643d62640158f5566790677c07bae4f3c295b662e1136321849595b9330dc91914dd72

Download Submit
C:\Windows\System\RnTkdyN.exe

Filesize
1.1MB

MD5
1cf4e1bfabb89e5b1c531c770944f39c

SHA1
a71a676c8add9487bbd97d093f437adb1a02b706

SHA256
aa58537a11895bff7ea1888c2bb903cd569e55d3623826df3290e8651f14106d

SHA512
9670f7aad7b2aaf52c346a7526f135c3c8e5929458b4d6ff58e949d4a82afc25acb5a82d7588fccd71fd2d5bfde3b34b6f430f6630000560e73fbcae03df9876

Download Submit
C:\Windows\System\SwhkdCV.exe

Filesize
1.1MB

MD5
9438730182091934a1d06bfc428e28a9

SHA1
ec7c0fc76ac7ce22b03acc93ec47f99281f58652

SHA256
36725c5bd890b7e0e1e4a25e771e7d666872fa81b919094be0297efdf74769bf

SHA512
fdc7cae3a3dec7a50bcd77b008dd947b8fdb70415afbf71de32de0d29d8d2f3ff0eadc0959f1785d9fa79e28b2cf5ce8351d7e41febd10afc5d003f4108035b0

Download Submit
C:\Windows\System\TYkCMXQ.exe

Filesize
1.1MB

MD5
159facc165ffefa2c2217dace9c7c461

SHA1
44d32ca2a85320292fddac2c27b3e2522e080c95

SHA256
1dfe518ac4a05e97e7bf2bbc8d8ffb0f3f1c8dcfb02565b59a10979972283d4b

SHA512
d3bf0de742bbc85ffc7d2d325d34fc6ab2d9b89159e49dd429d1604715c8027d758ba357d91dc676172eebe17193c701001431d31e8c857a54e166319cc45f6c

Download Submit
C:\Windows\System\WHSAqwI.exe

Filesize
1.1MB

MD5
108342c60789c6d78d9a7fac472682f3

SHA1
4b4b8d0fac44e98c6775decacb72beb60bc8d860

SHA256
204e68172614921d9221446664c2a8b752ac5277dad0d5f84db010ba398fda8d

SHA512
0f6586aef6f772216ce727080366a19b54e7a223680c15eaa1007aeb18d6b1bb609e1107256ea1d80e2d341193a243e90da5a9a2d7f5efdc7a6dcd484370db3d

Download Submit
C:\Windows\System\XVYLIZz.exe

Filesize
1.1MB

MD5
9d8766da4d1f7784c0e3451a3bc6493d

SHA1
7e1f33c2ec4bd1e087da479f802196ab4a4098e7

SHA256
44b8f3eb2e9869fc6ba348fd8714eb19148db14aaa95bc024ac6f0f1625f3d17

SHA512
828254a8d47ae10654a2bc116862832b764d26d7f2278f5de13544902845258789e44c1d17b3b652c53ab27baeeec49da3b222aabb6ab1125a13b839009130f2

Download Submit
C:\Windows\System\cLNLBpE.exe

Filesize
1.1MB

MD5
316fcf4f097b3f1b5f2699f302184f6c

SHA1
6144a03a233928e75e1dda2cdd4228b41df8b83c

SHA256
df11694844dbf58da92050e02765de3544e8ca6eb0e4904b02a26b3d252c6fc5

SHA512
b0b2294ca0c64925c134311d17aed821b275f7cd964c6d434b450d961abc1c312d83da58a8fcdf5658fdda0806e6ffaa15e70d50a291cc21d7f899472183bf21

Download Submit
C:\Windows\System\dBaufoD.exe

Filesize
1.1MB

MD5
ab14b6f4f15256ab6e91771a6dfa1408

SHA1
526b43017eaa93dc9e7f829a70794898996d4a1f

SHA256
46f4b8ba83a1e67ba983efe84a242ac272fe9fb73e4b8986b6de086688d370e1

SHA512
712177bfa9c8455818a95ee19359a80bd73dc8e9e536e76848773d8c55e6732920ea5d0cc9f8d6cf60ce0c8a6c77372d5ef3c8773dcdeed2c909bb8a1e2852ed

Download Submit
C:\Windows\System\drQzkcV.exe

Filesize
1.1MB

MD5
00a5a337df9128aaa12524ecb8e50daf

SHA1
de680fb4b7d66942518e2db4f5d166275be3d09b

SHA256
27926fa4cc71f669113b99a0f7dc9436da15b40f06d6db564e093a5a0fb8ea28

SHA512
6b5f7006a980ef55f3df3fbf702b7083e473bd66b48124c5ff65d7e1f0b13d19e92dfb4cd23c0ee0e3b635adff72f51fe1d69df45e57172478d48da117a84b94

Download Submit
C:\Windows\System\gCtTace.exe

Filesize
1.1MB

MD5
6b78d8f41664404464480153d0b97f14

SHA1
25be88c71cdb0a0f8a1eee741440501342dba020

SHA256
81f94ed651132c4748aa0f9e9cb47b738fea26609cc8576dedf5969292d83323

SHA512
a6955e1c379d0fd842a353feb67ef8031dfb1037f7364ffab76ad0ba39dee53576f602f94da7d0c53c0aa6438dc891bd25b4a118d6b6d4d4ca44e8bb62edfa49

Download Submit
C:\Windows\System\gHLQcgF.exe

Filesize
1.1MB

MD5
6a2904217d85cf5cfbe3144f45538a53

SHA1
ea13719a523e3b3bab26b6b1f4ce936638103cf8

SHA256
fa4f6cf93b8280c0cdc70b8b1d5c83642161951e612e6a36573242af848f2362

SHA512
fdcfeabb6c9233c3be34e9e2f2d0c80712ea76930a056b147cb071d19d1c3c6dfa76e59f402d26dbfa23d793d503385e5187b93d94a28f6235293b7d88536134

Download Submit
C:\Windows\System\iuETfXS.exe

Filesize
1.1MB

MD5
f1c432bfba5f2922e9933cb1049e86ab

SHA1
7c6ba9bdb8d58eb519538528f6349271172eb824

SHA256
79b8ffad2bbea1396b00badaaec4a5db56ad25475d6269d6ca91057a906d30a3

SHA512
f008b000bd3d8b0d09ede797650d8d5cbea0ffb092cade380f0c4e4ab96c6e5bdabb6ead0d8886222d7dd7656cca88ebec7c827820a1220d1a83015dd408c2c9

Download Submit
C:\Windows\System\jFJpSYz.exe

Filesize
1.1MB

MD5
3ee869dd7b4206e198f154e149d89a4b

SHA1
de203d163f0dd2b2950b4273463e71d2a204a606

SHA256
65c09ad8b7f40514bc734f4c2eb5076193fcf52fd3e2fec4999a417dade41b2b

SHA512
06a9dc9747dbe030551f06029bfaaec0b8d08f99317bb3ec5923e2cb25b59d4e8af02d60adc7c4745caa8b35462b238b65a2f5251a4f702d1e79b32dd66ac968

Download Submit
C:\Windows\System\jMRjYLo.exe

Filesize
1.1MB

MD5
8f7f45d0c578494685e1bea55280f691

SHA1
eb628ac56d69a35fcd368a50f238b6882410578f

SHA256
e6f66278eae213e176d1790f90f04abfc227d7514ca4612f05db83fd177fd74e

SHA512
502b5b4a9269accb427af4327a9138523641d04d32b715e05e72498b14b556447137714c25e6eeb9ae012b4a65fd89854f14a60a0ce2d95846f1c375c0405077

Download Submit
C:\Windows\System\jbsLcWl.exe

Filesize
1.1MB

MD5
781d0bbdc67af515ff5509fdbec34b2f

SHA1
f540927639b8b16e74846b480ff63a75b6275f01

SHA256
a66b912ea8e97a469de8ffbda7f361fdc0d02058cc7cd3a43eddf5bd5cebdc95

SHA512
d493b88e38cf1392ae430b3d9728f1729f3bdab34559cd59b1d2a50b812ddb9e3622500a63b9a5752068445aa4c674420fefbc19995c7ee9c58af43fd100c519

Download Submit
C:\Windows\System\oDQCEaV.exe

Filesize
1.1MB

MD5
7fa18cf33bf8a77bb162048e7fef91ea

SHA1
f361f955d0e7be0ffae87f8f8082990170775e87

SHA256
5ab49a7d8339f9c8e4a6cac2e97799b88e90b66911376f65acedf175d349d8ac

SHA512
738d132e8970e39d84e9a6188e600d2e33090562261e7633ed35bf4fe6875b993713da60c13cd77edf05e88ae3a8a7e4a9272d77f0c84a03b7e20d5cc2c6bab5

Download Submit
C:\Windows\System\pRiWjen.exe

Filesize
1.1MB

MD5
97ffa7ea1710d1b3f22d60d7e7931154

SHA1
757297df5dd3c9c2e5f4c0a73886e848d17b4443

SHA256
15bd832c04211c6f74a874e555d4d4b7aa7e8cdb6881411d77fdb1f9f50bcee4

SHA512
813ce14c94bc03d316ee2387e31aecad219dfefd8db6fb8c3f0058e680a4dfc545fc987a17f1cdc4596458e1a541347b5e7b12b9a22efbd77e4005fd7341ccd2

Download Submit
C:\Windows\System\qHzdUhk.exe

Filesize
1.1MB

MD5
10c3d70f254baed7b0e7d307128e9f78

SHA1
08058788a0fbadec1fb1b72f006f0ac82d135cb7

SHA256
27ba0509f61334b35e76b4d9f67e37139ba8ea2178790466916cb73f443f9d32

SHA512
495a88552ac0c4763d11b5ff6896c407de6a86c9478fb4e5974ea4e8844a52a9d2a8a59dcbb995174dd0dab6045a733227b718538663c0d7f7bbcd89bdde3bf5

Download Submit
C:\Windows\System\rIPxTmI.exe

Filesize
1.1MB

MD5
51c2f57eb2f589c9f8bb614513081d13

SHA1
88d598d753470ddaac5f84a894f1f3b5eb89bb29

SHA256
8393fb2b7270a45877e1232310ae0ecefacf0cffd2d9b96c206762fbacd7d44a

SHA512
7ecc68fdb3456df77ae4169976bce11f817921dabc8e06232ec6965a720be06116aa221cb2c3d7e9015e3f21f0f0bb1720b2f874d700c583316ad93a5a04f9c9

Download Submit
C:\Windows\System\rrqGSZh.exe

Filesize
1.1MB

MD5
174d9aeac45f0125e1045ea4ff41f771

SHA1
6a0ff7cfbaecad9935d27ad8a772e5f22e8446bd

SHA256
9f245aaef786bab8672794e10fdfb6e29f8924869f2645bd13ac9eb8740509a0

SHA512
281fd4abd229e3bd51a7c3cdc69fc5e2488082958bef5ec899e1675bb0fb7bffb065d04728ad7eafa89960982f5a21193fa8bf8c934260f4f12fbe082f9f50bc

Download Submit
C:\Windows\System\siJyUNl.exe

Filesize
1.1MB

MD5
00d2c59aa972cc65eb6339503caeda5e

SHA1
b3718c52ce5711fcf0ee875ed9be74c97ad8b97d

SHA256
bf4bb02b2f3b898243b5e16b07177f19ad650fb07d79e989887a73010162b364

SHA512
322eb6e78776d660fcfba6158c2285525afbc59bd1463091bebb16d536a69c6de94c6524a905d5531a6035bbea3fd04012142f8968ae99c25388b9b81b6453bd

Download Submit
C:\Windows\System\vkUCpiG.exe

Filesize
1.1MB

MD5
1ce6bf5a69ed6665e27a38a3dc5f9198

SHA1
98ae549a02f71408bc8ca015918d9de66e5cedac

SHA256
4546191b48e19e07a4cec0c62f65bb6a3c49b9c26b8e9be415847f390a8ad82a

SHA512
fdd39dde1683fa812c4cd268869315e60b2988d55b1ff56a8308a28dce67702e7c953c261525628c57951656dfca1dea8361be94592b308c33ee23efa0142d07

Download Submit
C:\Windows\System\wEsFbmY.exe

Filesize
1.1MB

MD5
701257de0861c34b17e839cdd73785f6

SHA1
bd4b05ea26056360074cacbbda97c6170fc112f4

SHA256
1e0ae313d238a60d002ba7ea044ad90160aaf7901cc21b350439443c83e8b058

SHA512
a9ea2b6cdef33d33c90dbe02e1f49bcbb36fd9d32ed024bf08c03e435cde76a781b4502317c1e6e7ce8dded3beaec439ad876fc3e1ddc0eacf74acd861123256

Download Submit
C:\Windows\System\wjJKBiQ.exe

Filesize
1.1MB

MD5
12f55dc829c7c8009f67096233cabc00

SHA1
ee5b7363cb5565d5c9f2133f292aeec2a21c06c6

SHA256
9c62ce46ec1d2644c4e00223d95c31c7e8792d685e6d99f2e8c1638053fb3a27

SHA512
d12b0667e104f5c952baf9372ff3c528c4c654ce0fda66d23561e2b8719d740e3de603cd2dabd1f59182322af8a867439b085e6411133d9d10ecce3b35e92bb0

Download Submit
C:\Windows\System\xUjCzSi.exe

Filesize
1.1MB

MD5
f9ba3e47e827c4107dcc4071ed82d6c0

SHA1
c422255bc86574ed81cbae4a1a4cd97265083574

SHA256
4bdb83bf52b91eabcc09805283d1a33f917f8d46a9466f29901f0b062b68841c

SHA512
d61da2d1427b6275c3001519394b4d83ae6202557cbfd57e01317d3a8a354281f9b8bfc53e8c1d2626604944d697347e4ede3632af7aae51786009cd7ab998d5

Download Submit
C:\Windows\System\yashtNJ.exe

Filesize
1.1MB

MD5
07da62da649a9fff8e6786355635f9a5

SHA1
5e3a025f9e139451f14763faa5ff3366c218d72a

SHA256
89ff67cd0b6021548735ee45efde411df16ac50f3dc9bf6d660e902947ae0946

SHA512
3fbcaedeae73b0b465eb951015ad05ee18f3a418a00dc77246a4d3b3cbba9fabdff12bb4f8ba3f3e45387915ca51417a50d17f0632b561af1868937b2ee470a8

Download Submit
memory/392-90-0x00007FF7A4DD0000-0x00007FF7A5121000-memory.dmp

Filesize
3.3MB

Download
memory/392-2302-0x00007FF7A4DD0000-0x00007FF7A5121000-memory.dmp

Filesize
3.3MB

Download
memory/392-2202-0x00007FF7A4DD0000-0x00007FF7A5121000-memory.dmp

Filesize
3.3MB

Download
memory/432-2298-0x00007FF648E50000-0x00007FF6491A1000-memory.dmp

Filesize
3.3MB

Download
memory/432-267-0x00007FF648E50000-0x00007FF6491A1000-memory.dmp

Filesize
3.3MB

Download
memory/724-2326-0x00007FF758510000-0x00007FF758861000-memory.dmp

Filesize
3.3MB

Download
memory/724-515-0x00007FF758510000-0x00007FF758861000-memory.dmp

Filesize
3.3MB

Download
memory/1384-699-0x00007FF7AB6B0000-0x00007FF7ABA01000-memory.dmp

Filesize
3.3MB

Download
memory/1384-2373-0x00007FF7AB6B0000-0x00007FF7ABA01000-memory.dmp

Filesize
3.3MB

Download
memory/1428-705-0x00007FF6D3ED0000-0x00007FF6D4221000-memory.dmp

Filesize
3.3MB

Download
memory/1428-2346-0x00007FF6D3ED0000-0x00007FF6D4221000-memory.dmp

Filesize
3.3MB

Download
memory/1968-2314-0x00007FF756B10000-0x00007FF756E61000-memory.dmp

Filesize
3.3MB

Download
memory/1968-219-0x00007FF756B10000-0x00007FF756E61000-memory.dmp

Filesize
3.3MB

Download
memory/2220-2328-0x00007FF657580000-0x00007FF6578D1000-memory.dmp

Filesize
3.3MB

Download
memory/2220-581-0x00007FF657580000-0x00007FF6578D1000-memory.dmp

Filesize
3.3MB

Download
memory/2232-2197-0x00007FF642EB0000-0x00007FF643201000-memory.dmp

Filesize
3.3MB

Download
memory/2232-1-0x0000025BAEB10000-0x0000025BAEB20000-memory.dmp

Filesize
64KB

Download
memory/2232-0-0x00007FF642EB0000-0x00007FF643201000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2312-0x00007FF79E540000-0x00007FF79E891000-memory.dmp

Filesize
3.3MB

Download
memory/2508-438-0x00007FF79E540000-0x00007FF79E891000-memory.dmp

Filesize
3.3MB

Download
memory/2648-2292-0x00007FF62B5A0000-0x00007FF62B8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2648-2201-0x00007FF62B5A0000-0x00007FF62B8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2648-58-0x00007FF62B5A0000-0x00007FF62B8F1000-memory.dmp

Filesize
3.3MB

Download
memory/3100-2350-0x00007FF760A60000-0x00007FF760DB1000-memory.dmp

Filesize
3.3MB

Download
memory/3100-698-0x00007FF760A60000-0x00007FF760DB1000-memory.dmp

Filesize
3.3MB

Download
memory/3304-2294-0x00007FF631710000-0x00007FF631A61000-memory.dmp

Filesize
3.3MB

Download
memory/3304-2200-0x00007FF631710000-0x00007FF631A61000-memory.dmp

Filesize
3.3MB

Download
memory/3304-50-0x00007FF631710000-0x00007FF631A61000-memory.dmp

Filesize
3.3MB

Download
memory/3344-70-0x00007FF70DC40000-0x00007FF70DF91000-memory.dmp

Filesize
3.3MB

Download
memory/3344-2280-0x00007FF70DC40000-0x00007FF70DF91000-memory.dmp

Filesize
3.3MB

Download
memory/3460-2308-0x00007FF7AF660000-0x00007FF7AF9B1000-memory.dmp

Filesize
3.3MB

Download
memory/3460-703-0x00007FF7AF660000-0x00007FF7AF9B1000-memory.dmp

Filesize
3.3MB

Download
memory/3564-2278-0x00007FF759A40000-0x00007FF759D91000-memory.dmp

Filesize
3.3MB

Download
memory/3564-2199-0x00007FF759A40000-0x00007FF759D91000-memory.dmp

Filesize
3.3MB

Download
memory/3564-29-0x00007FF759A40000-0x00007FF759D91000-memory.dmp

Filesize
3.3MB

Download
memory/3612-701-0x00007FF70FD10000-0x00007FF710061000-memory.dmp

Filesize
3.3MB

Download
memory/3612-2282-0x00007FF70FD10000-0x00007FF710061000-memory.dmp

Filesize
3.3MB

Download
memory/3636-134-0x00007FF649320000-0x00007FF649671000-memory.dmp

Filesize
3.3MB

Download
memory/3636-2310-0x00007FF649320000-0x00007FF649671000-memory.dmp

Filesize
3.3MB

Download
memory/3752-2300-0x00007FF745BC0000-0x00007FF745F11000-memory.dmp

Filesize
3.3MB

Download
memory/3752-356-0x00007FF745BC0000-0x00007FF745F11000-memory.dmp

Filesize
3.3MB

Download
memory/3892-2284-0x00007FF6F0FE0000-0x00007FF6F1331000-memory.dmp

Filesize
3.3MB

Download
memory/3892-702-0x00007FF6F0FE0000-0x00007FF6F1331000-memory.dmp

Filesize
3.3MB

Download
memory/4108-2315-0x00007FF7254B0000-0x00007FF725801000-memory.dmp

Filesize
3.3MB

Download
memory/4108-706-0x00007FF7254B0000-0x00007FF725801000-memory.dmp

Filesize
3.3MB

Download
memory/4136-2304-0x00007FF742B20000-0x00007FF742E71000-memory.dmp

Filesize
3.3MB

Download
memory/4136-177-0x00007FF742B20000-0x00007FF742E71000-memory.dmp

Filesize
3.3MB

Download
memory/4292-2369-0x00007FF68D720000-0x00007FF68DA71000-memory.dmp

Filesize
3.3MB

Download
memory/4292-697-0x00007FF68D720000-0x00007FF68DA71000-memory.dmp

Filesize
3.3MB

Download
memory/4476-2324-0x00007FF6B7700000-0x00007FF6B7A51000-memory.dmp

Filesize
3.3MB

Download
memory/4476-696-0x00007FF6B7700000-0x00007FF6B7A51000-memory.dmp

Filesize
3.3MB

Download
memory/4644-13-0x00007FF63B510000-0x00007FF63B861000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2276-0x00007FF63B510000-0x00007FF63B861000-memory.dmp

Filesize
3.3MB

Download
memory/4644-2198-0x00007FF63B510000-0x00007FF63B861000-memory.dmp

Filesize
3.3MB

Download
memory/4732-700-0x00007FF60B670000-0x00007FF60B9C1000-memory.dmp

Filesize
3.3MB

Download
memory/4732-2331-0x00007FF60B670000-0x00007FF60B9C1000-memory.dmp

Filesize
3.3MB

Download
memory/4760-2306-0x00007FF7414E0000-0x00007FF741831000-memory.dmp

Filesize
3.3MB

Download
memory/4760-145-0x00007FF7414E0000-0x00007FF741831000-memory.dmp

Filesize
3.3MB

Download
memory/4932-497-0x00007FF78C8A0000-0x00007FF78CBF1000-memory.dmp

Filesize
3.3MB

Download
memory/4932-2322-0x00007FF78C8A0000-0x00007FF78CBF1000-memory.dmp

Filesize
3.3MB

Download
memory/5048-295-0x00007FF6ECF10000-0x00007FF6ED261000-memory.dmp

Filesize
3.3MB

Download
memory/5048-2320-0x00007FF6ECF10000-0x00007FF6ED261000-memory.dmp

Filesize
3.3MB

Download
memory/5064-2317-0x00007FF6C3270000-0x00007FF6C35C1000-memory.dmp

Filesize
3.3MB

Download
memory/5064-296-0x00007FF6C3270000-0x00007FF6C35C1000-memory.dmp

Filesize
3.3MB

Download
memory/5112-2296-0x00007FF712AD0000-0x00007FF712E21000-memory.dmp

Filesize
3.3MB

Download
memory/5112-704-0x00007FF712AD0000-0x00007FF712E21000-memory.dmp

Filesize
3.3MB

Download