xmrig | fbfd354c3f23fabddffa383313ed145235404365146d14f59369b704ad404c6a

Analysis

max time kernel
93s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1001b2d2e95604a4283b8709833a8ec0N.exe
Size

1.8MB
MD5

1001b2d2e95604a4283b8709833a8ec0
SHA1

a6224b3c7c7e6b0a35a01fd216099ed57118d9a5
SHA256

fbfd354c3f23fabddffa383313ed145235404365146d14f59369b704ad404c6a
SHA512

ff8ca44de0be73f1f3379adbe326aeb7301328408083f0020396adb83625c18d045e16d42491d506c8070c735693d0b32d7c3fedfbd1a357b82d8d0bf4c1470b
SSDEEP

49152:ROdWCCi7/rahFD2P6QV8Nq8AgmUtBrdHa61ZK:RWWBibas

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 58 IoCs

miner

resource	yara_rule
behavioral2/memory/4232-207-0x00007FF7A0DD0000-0x00007FF7A1121000-memory.dmp	xmrig
behavioral2/memory/2000-213-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp	xmrig
behavioral2/memory/3128-220-0x00007FF7B6400000-0x00007FF7B6751000-memory.dmp	xmrig
behavioral2/memory/1300-222-0x00007FF6F2170000-0x00007FF6F24C1000-memory.dmp	xmrig
behavioral2/memory/3104-221-0x00007FF79B140000-0x00007FF79B491000-memory.dmp	xmrig
behavioral2/memory/380-219-0x00007FF7C7CD0000-0x00007FF7C8021000-memory.dmp	xmrig
behavioral2/memory/3680-218-0x00007FF6B9430000-0x00007FF6B9781000-memory.dmp	xmrig
behavioral2/memory/5104-217-0x00007FF7B1870000-0x00007FF7B1BC1000-memory.dmp	xmrig
behavioral2/memory/3468-212-0x00007FF7DB6C0000-0x00007FF7DBA11000-memory.dmp	xmrig
behavioral2/memory/3712-211-0x00007FF6E9EA0000-0x00007FF6EA1F1000-memory.dmp	xmrig
behavioral2/memory/4756-210-0x00007FF6B72A0000-0x00007FF6B75F1000-memory.dmp	xmrig
behavioral2/memory/4852-209-0x00007FF7661F0000-0x00007FF766541000-memory.dmp	xmrig
behavioral2/memory/5036-208-0x00007FF78F9C0000-0x00007FF78FD11000-memory.dmp	xmrig
behavioral2/memory/3560-206-0x00007FF7CC6B0000-0x00007FF7CCA01000-memory.dmp	xmrig
behavioral2/memory/2188-205-0x00007FF60E730000-0x00007FF60EA81000-memory.dmp	xmrig
behavioral2/memory/1992-201-0x00007FF71E700000-0x00007FF71EA51000-memory.dmp	xmrig
behavioral2/memory/5072-151-0x00007FF7B19D0000-0x00007FF7B1D21000-memory.dmp	xmrig
behavioral2/memory/4168-148-0x00007FF7AE290000-0x00007FF7AE5E1000-memory.dmp	xmrig
behavioral2/memory/4060-115-0x00007FF7AD640000-0x00007FF7AD991000-memory.dmp	xmrig
behavioral2/memory/2192-42-0x00007FF6DA0D0000-0x00007FF6DA421000-memory.dmp	xmrig
behavioral2/memory/3004-1891-0x00007FF6B51C0000-0x00007FF6B5511000-memory.dmp	xmrig
behavioral2/memory/1004-2412-0x00007FF760270000-0x00007FF7605C1000-memory.dmp	xmrig
behavioral2/memory/2508-2443-0x00007FF79AEA0000-0x00007FF79B1F1000-memory.dmp	xmrig
behavioral2/memory/1100-2442-0x00007FF6040D0000-0x00007FF604421000-memory.dmp	xmrig
behavioral2/memory/1080-2473-0x00007FF644EF0000-0x00007FF645241000-memory.dmp	xmrig
behavioral2/memory/2836-2625-0x00007FF74CAF0000-0x00007FF74CE41000-memory.dmp	xmrig
behavioral2/memory/3520-2689-0x00007FF606B00000-0x00007FF606E51000-memory.dmp	xmrig
behavioral2/memory/3652-2688-0x00007FF764D30000-0x00007FF765081000-memory.dmp	xmrig
behavioral2/memory/2332-2662-0x00007FF643DD0000-0x00007FF644121000-memory.dmp	xmrig
behavioral2/memory/2792-2887-0x00007FF7A3CD0000-0x00007FF7A4021000-memory.dmp	xmrig
behavioral2/memory/2192-2889-0x00007FF6DA0D0000-0x00007FF6DA421000-memory.dmp	xmrig
behavioral2/memory/5104-2891-0x00007FF7B1870000-0x00007FF7B1BC1000-memory.dmp	xmrig
behavioral2/memory/1004-2917-0x00007FF760270000-0x00007FF7605C1000-memory.dmp	xmrig
behavioral2/memory/4168-2920-0x00007FF7AE290000-0x00007FF7AE5E1000-memory.dmp	xmrig
behavioral2/memory/3680-2919-0x00007FF6B9430000-0x00007FF6B9781000-memory.dmp	xmrig
behavioral2/memory/2836-2924-0x00007FF74CAF0000-0x00007FF74CE41000-memory.dmp	xmrig
behavioral2/memory/2508-2923-0x00007FF79AEA0000-0x00007FF79B1F1000-memory.dmp	xmrig
behavioral2/memory/1100-2926-0x00007FF6040D0000-0x00007FF604421000-memory.dmp	xmrig
behavioral2/memory/3560-2949-0x00007FF7CC6B0000-0x00007FF7CCA01000-memory.dmp	xmrig
behavioral2/memory/5036-2954-0x00007FF78F9C0000-0x00007FF78FD11000-memory.dmp	xmrig
behavioral2/memory/4852-2960-0x00007FF7661F0000-0x00007FF766541000-memory.dmp	xmrig
behavioral2/memory/2000-2956-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp	xmrig
behavioral2/memory/3468-2953-0x00007FF7DB6C0000-0x00007FF7DBA11000-memory.dmp	xmrig
behavioral2/memory/1992-2950-0x00007FF71E700000-0x00007FF71EA51000-memory.dmp	xmrig
behavioral2/memory/2188-2946-0x00007FF60E730000-0x00007FF60EA81000-memory.dmp	xmrig
behavioral2/memory/3128-2958-0x00007FF7B6400000-0x00007FF7B6751000-memory.dmp	xmrig
behavioral2/memory/380-2942-0x00007FF7C7CD0000-0x00007FF7C8021000-memory.dmp	xmrig
behavioral2/memory/5072-2941-0x00007FF7B19D0000-0x00007FF7B1D21000-memory.dmp	xmrig
behavioral2/memory/4756-2938-0x00007FF6B72A0000-0x00007FF6B75F1000-memory.dmp	xmrig
behavioral2/memory/3104-2937-0x00007FF79B140000-0x00007FF79B491000-memory.dmp	xmrig
behavioral2/memory/3712-2934-0x00007FF6E9EA0000-0x00007FF6EA1F1000-memory.dmp	xmrig
behavioral2/memory/4232-2933-0x00007FF7A0DD0000-0x00007FF7A1121000-memory.dmp	xmrig
behavioral2/memory/1300-2929-0x00007FF6F2170000-0x00007FF6F24C1000-memory.dmp	xmrig
behavioral2/memory/4060-2945-0x00007FF7AD640000-0x00007FF7AD991000-memory.dmp	xmrig
behavioral2/memory/1080-2930-0x00007FF644EF0000-0x00007FF645241000-memory.dmp	xmrig
behavioral2/memory/3652-3078-0x00007FF764D30000-0x00007FF765081000-memory.dmp	xmrig
behavioral2/memory/2332-3087-0x00007FF643DD0000-0x00007FF644121000-memory.dmp	xmrig
behavioral2/memory/3520-3085-0x00007FF606B00000-0x00007FF606E51000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2792	nHfLCAs.exe
1004	KCzTAJx.exe
2192	LbdTDCC.exe
5104	MOKvjfO.exe
3680	vuCghjc.exe
2836	soTJvce.exe
1100	TIGZrWV.exe
2508	YNLHrpy.exe
380	AcWdDLT.exe
1080	ucOOgti.exe
4060	OTvUFDe.exe
4168	lfoVcZO.exe
5072	TTDvFtw.exe
3128	nTzjbCw.exe
1992	vjjbnRl.exe
2188	bepCsHr.exe
3560	ssEWvcT.exe
3104	QXgZnxH.exe
4232	LrhTlWG.exe
5036	cpYwBgo.exe
4852	uojRMpm.exe
4756	GSyxUTo.exe
1300	CvrQshZ.exe
3712	yMsbDDW.exe
3468	yZqsyNu.exe
2000	ejDXrTL.exe
2332	ZNNPeYx.exe
3652	LbneTMR.exe
3520	PskdYQP.exe
2760	yLLaSLZ.exe
2592	wrNdMZS.exe
4440	vuARLZJ.exe
3568	koybUHR.exe
744	qKfnVSH.exe
2540	faOOGXP.exe
4996	myAoxYr.exe
3368	fYOsHkX.exe
3320	qdxwQYA.exe
4100	RCWzmqe.exe
2940	YnQgvXL.exe
5028	BVqaDQU.exe
3508	wyfjItW.exe
3672	GLdQBim.exe
2304	ceDwBnk.exe
1656	ftgnQii.exe
1536	KXTOgcQ.exe
4176	eBWcecq.exe
4972	YCsJdcL.exe
5116	LKrswtf.exe
1232	vlouxqQ.exe
4480	kyLYzMf.exe
5112	QQysOJC.exe
2604	eQgCYan.exe
1560	VAUKEBe.exe
1844	UaFxogl.exe
1104	ZFdNANa.exe
2140	ApxJOcg.exe
1244	PLdPlWI.exe
2368	UbzvcxV.exe
1948	LOutMDs.exe
1616	iAhiUlm.exe
3628	kZJbdTD.exe
2896	QhYhPSi.exe
3240	RwtYiQl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x00007FF6B51C0000-0x00007FF6B5511000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-7.dat	upx
behavioral2/files/0x00070000000233fd-19.dat	upx
behavioral2/files/0x0007000000023400-32.dat	upx
behavioral2/files/0x0007000000023405-60.dat	upx
behavioral2/files/0x000700000002340d-103.dat	upx
behavioral2/files/0x000700000002340a-134.dat	upx
behavioral2/files/0x000700000002340e-187.dat	upx
behavioral2/memory/4232-207-0x00007FF7A0DD0000-0x00007FF7A1121000-memory.dmp	upx
behavioral2/memory/2000-213-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp	upx
behavioral2/memory/3128-220-0x00007FF7B6400000-0x00007FF7B6751000-memory.dmp	upx
behavioral2/memory/1300-222-0x00007FF6F2170000-0x00007FF6F24C1000-memory.dmp	upx
behavioral2/memory/3104-221-0x00007FF79B140000-0x00007FF79B491000-memory.dmp	upx
behavioral2/memory/380-219-0x00007FF7C7CD0000-0x00007FF7C8021000-memory.dmp	upx
behavioral2/memory/3680-218-0x00007FF6B9430000-0x00007FF6B9781000-memory.dmp	upx
behavioral2/memory/5104-217-0x00007FF7B1870000-0x00007FF7B1BC1000-memory.dmp	upx
behavioral2/memory/3520-216-0x00007FF606B00000-0x00007FF606E51000-memory.dmp	upx
behavioral2/memory/3652-215-0x00007FF764D30000-0x00007FF765081000-memory.dmp	upx
behavioral2/memory/2332-214-0x00007FF643DD0000-0x00007FF644121000-memory.dmp	upx
behavioral2/memory/3468-212-0x00007FF7DB6C0000-0x00007FF7DBA11000-memory.dmp	upx
behavioral2/memory/3712-211-0x00007FF6E9EA0000-0x00007FF6EA1F1000-memory.dmp	upx
behavioral2/memory/4756-210-0x00007FF6B72A0000-0x00007FF6B75F1000-memory.dmp	upx
behavioral2/memory/4852-209-0x00007FF7661F0000-0x00007FF766541000-memory.dmp	upx
behavioral2/memory/5036-208-0x00007FF78F9C0000-0x00007FF78FD11000-memory.dmp	upx
behavioral2/memory/3560-206-0x00007FF7CC6B0000-0x00007FF7CCA01000-memory.dmp	upx
behavioral2/memory/2188-205-0x00007FF60E730000-0x00007FF60EA81000-memory.dmp	upx
behavioral2/memory/1992-201-0x00007FF71E700000-0x00007FF71EA51000-memory.dmp	upx
behavioral2/files/0x000700000002341e-200.dat	upx
behavioral2/files/0x0007000000023414-199.dat	upx
behavioral2/files/0x0007000000023413-190.dat	upx
behavioral2/files/0x000700000002341d-189.dat	upx
behavioral2/files/0x000700000002341c-185.dat	upx
behavioral2/files/0x000700000002341b-180.dat	upx
behavioral2/files/0x0007000000023412-177.dat	upx
behavioral2/files/0x000700000002341a-175.dat	upx
behavioral2/files/0x0007000000023419-169.dat	upx
behavioral2/files/0x0007000000023409-163.dat	upx
behavioral2/files/0x0007000000023418-161.dat	upx
behavioral2/files/0x0007000000023410-158.dat	upx
behavioral2/files/0x0007000000023417-155.dat	upx
behavioral2/memory/5072-151-0x00007FF7B19D0000-0x00007FF7B1D21000-memory.dmp	upx
behavioral2/memory/4168-148-0x00007FF7AE290000-0x00007FF7AE5E1000-memory.dmp	upx
behavioral2/files/0x0007000000023416-147.dat	upx
behavioral2/files/0x0007000000023411-132.dat	upx
behavioral2/files/0x0007000000023408-126.dat	upx
behavioral2/memory/4060-115-0x00007FF7AD640000-0x00007FF7AD991000-memory.dmp	upx
behavioral2/files/0x000700000002340f-111.dat	upx
behavioral2/files/0x0007000000023415-146.dat	upx
behavioral2/files/0x000700000002340c-138.dat	upx
behavioral2/files/0x0007000000023406-100.dat	upx
behavioral2/files/0x0007000000023407-125.dat	upx
behavioral2/files/0x000700000002340b-92.dat	upx
behavioral2/files/0x0007000000023404-91.dat	upx
behavioral2/memory/1080-88-0x00007FF644EF0000-0x00007FF645241000-memory.dmp	upx
behavioral2/files/0x0007000000023402-86.dat	upx
behavioral2/memory/2508-83-0x00007FF79AEA0000-0x00007FF79B1F1000-memory.dmp	upx
behavioral2/files/0x0007000000023403-90.dat	upx
behavioral2/memory/1100-66-0x00007FF6040D0000-0x00007FF604421000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-51.dat	upx
behavioral2/files/0x0007000000023401-68.dat	upx
behavioral2/memory/2836-45-0x00007FF74CAF0000-0x00007FF74CE41000-memory.dmp	upx
behavioral2/memory/2192-42-0x00007FF6DA0D0000-0x00007FF6DA421000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-53.dat	upx
behavioral2/memory/1004-27-0x00007FF760270000-0x00007FF7605C1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zmFBTDF.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\QUIspWQ.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\qOfZQPM.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\mUYxYEi.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\NfjpOhW.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\vlouxqQ.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\xlrNULM.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\hggJZZe.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\HuDWKpN.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\lvYdprV.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\PKWfdGC.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\OIErqQX.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\wYOSiGb.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\vcBMxvT.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\dlHPvAt.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\UYHvGxW.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\UFgeMnK.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\yZqsyNu.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\kZJbdTD.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\hvleeLp.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\OAyMCuD.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\hjHQdXT.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\ERLXedW.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\VnPOxIM.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\hVpsMGx.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\xrcyzFV.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\pMYSMaA.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\uIDycNq.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\EuUHNoh.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\KqDOSXt.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\fqCBpfp.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\RLZfHxx.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\myXFhcM.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\CVJEtkO.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\wrNdMZS.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\srqLXzG.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\ivJQWKk.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\DqHUThy.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\XWDIxKx.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\KLcholv.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\zvioliO.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\KFAsAOe.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\ZfEWWos.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\CFTkwku.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\mfoucwH.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\SFXTYUd.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\PCLvdqe.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\hKrXaIZ.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\VnSkInL.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\agsYZwc.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\udvHMzb.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\pwRdWYT.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\NPvlWXV.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\QemxVEy.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\EnUWKip.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\JvAUwBT.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\NyosnVn.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\hZitmUT.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\DQTrlbj.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\cQrrNLY.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\OTPOQng.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\ZzxQmtb.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\VeCOvYf.exe	1001b2d2e95604a4283b8709833a8ec0N.exe
File created	C:\Windows\System\zYsCnBl.exe	1001b2d2e95604a4283b8709833a8ec0N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2792	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	85
PID 3004 wrote to memory of 2792	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	85
PID 3004 wrote to memory of 1004	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	86
PID 3004 wrote to memory of 1004	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	86
PID 3004 wrote to memory of 2192	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	87
PID 3004 wrote to memory of 2192	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	87
PID 3004 wrote to memory of 5104	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	88
PID 3004 wrote to memory of 5104	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	88
PID 3004 wrote to memory of 3680	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	89
PID 3004 wrote to memory of 3680	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	89
PID 3004 wrote to memory of 2836	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	90
PID 3004 wrote to memory of 2836	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	90
PID 3004 wrote to memory of 1100	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	91
PID 3004 wrote to memory of 1100	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	91
PID 3004 wrote to memory of 2508	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	92
PID 3004 wrote to memory of 2508	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	92
PID 3004 wrote to memory of 380	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	93
PID 3004 wrote to memory of 380	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	93
PID 3004 wrote to memory of 1080	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	94
PID 3004 wrote to memory of 1080	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	94
PID 3004 wrote to memory of 4060	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	95
PID 3004 wrote to memory of 4060	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	95
PID 3004 wrote to memory of 4168	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	96
PID 3004 wrote to memory of 4168	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	96
PID 3004 wrote to memory of 5072	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	97
PID 3004 wrote to memory of 5072	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	97
PID 3004 wrote to memory of 3128	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	98
PID 3004 wrote to memory of 3128	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	98
PID 3004 wrote to memory of 1992	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	99
PID 3004 wrote to memory of 1992	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	99
PID 3004 wrote to memory of 2188	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	100
PID 3004 wrote to memory of 2188	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	100
PID 3004 wrote to memory of 3560	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	101
PID 3004 wrote to memory of 3560	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	101
PID 3004 wrote to memory of 3104	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	102
PID 3004 wrote to memory of 3104	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	102
PID 3004 wrote to memory of 4232	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	103
PID 3004 wrote to memory of 4232	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	103
PID 3004 wrote to memory of 5036	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	104
PID 3004 wrote to memory of 5036	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	104
PID 3004 wrote to memory of 4852	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	105
PID 3004 wrote to memory of 4852	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	105
PID 3004 wrote to memory of 4756	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	106
PID 3004 wrote to memory of 4756	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	106
PID 3004 wrote to memory of 1300	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	107
PID 3004 wrote to memory of 1300	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	107
PID 3004 wrote to memory of 3712	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	108
PID 3004 wrote to memory of 3712	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	108
PID 3004 wrote to memory of 3468	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	109
PID 3004 wrote to memory of 3468	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	109
PID 3004 wrote to memory of 2000	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	110
PID 3004 wrote to memory of 2000	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	110
PID 3004 wrote to memory of 2332	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	111
PID 3004 wrote to memory of 2332	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	111
PID 3004 wrote to memory of 3652	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	112
PID 3004 wrote to memory of 3652	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	112
PID 3004 wrote to memory of 3520	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	113
PID 3004 wrote to memory of 3520	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	113
PID 3004 wrote to memory of 2760	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	114
PID 3004 wrote to memory of 2760	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	114
PID 3004 wrote to memory of 2592	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	115
PID 3004 wrote to memory of 2592	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	115
PID 3004 wrote to memory of 4440	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	116
PID 3004 wrote to memory of 4440	3004	1001b2d2e95604a4283b8709833a8ec0N.exe	116

C:\Users\Admin\AppData\Local\Temp\1001b2d2e95604a4283b8709833a8ec0N.exe
"C:\Users\Admin\AppData\Local\Temp\1001b2d2e95604a4283b8709833a8ec0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\System\nHfLCAs.exe
  C:\Windows\System\nHfLCAs.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\KCzTAJx.exe
  C:\Windows\System\KCzTAJx.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\LbdTDCC.exe
  C:\Windows\System\LbdTDCC.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\MOKvjfO.exe
  C:\Windows\System\MOKvjfO.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\vuCghjc.exe
  C:\Windows\System\vuCghjc.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\soTJvce.exe
  C:\Windows\System\soTJvce.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\TIGZrWV.exe
  C:\Windows\System\TIGZrWV.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\YNLHrpy.exe
  C:\Windows\System\YNLHrpy.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\AcWdDLT.exe
  C:\Windows\System\AcWdDLT.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ucOOgti.exe
  C:\Windows\System\ucOOgti.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\OTvUFDe.exe
  C:\Windows\System\OTvUFDe.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\lfoVcZO.exe
  C:\Windows\System\lfoVcZO.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\TTDvFtw.exe
  C:\Windows\System\TTDvFtw.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\nTzjbCw.exe
  C:\Windows\System\nTzjbCw.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\vjjbnRl.exe
  C:\Windows\System\vjjbnRl.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\bepCsHr.exe
  C:\Windows\System\bepCsHr.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\ssEWvcT.exe
  C:\Windows\System\ssEWvcT.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\QXgZnxH.exe
  C:\Windows\System\QXgZnxH.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\LrhTlWG.exe
  C:\Windows\System\LrhTlWG.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\cpYwBgo.exe
  C:\Windows\System\cpYwBgo.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\uojRMpm.exe
  C:\Windows\System\uojRMpm.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\GSyxUTo.exe
  C:\Windows\System\GSyxUTo.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\CvrQshZ.exe
  C:\Windows\System\CvrQshZ.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\yMsbDDW.exe
  C:\Windows\System\yMsbDDW.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\yZqsyNu.exe
  C:\Windows\System\yZqsyNu.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\ejDXrTL.exe
  C:\Windows\System\ejDXrTL.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ZNNPeYx.exe
  C:\Windows\System\ZNNPeYx.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\LbneTMR.exe
  C:\Windows\System\LbneTMR.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\PskdYQP.exe
  C:\Windows\System\PskdYQP.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\yLLaSLZ.exe
  C:\Windows\System\yLLaSLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\wrNdMZS.exe
  C:\Windows\System\wrNdMZS.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\vuARLZJ.exe
  C:\Windows\System\vuARLZJ.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\koybUHR.exe
  C:\Windows\System\koybUHR.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\qKfnVSH.exe
  C:\Windows\System\qKfnVSH.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\faOOGXP.exe
  C:\Windows\System\faOOGXP.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\myAoxYr.exe
  C:\Windows\System\myAoxYr.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\fYOsHkX.exe
  C:\Windows\System\fYOsHkX.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\qdxwQYA.exe
  C:\Windows\System\qdxwQYA.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\RCWzmqe.exe
  C:\Windows\System\RCWzmqe.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\YnQgvXL.exe
  C:\Windows\System\YnQgvXL.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\BVqaDQU.exe
  C:\Windows\System\BVqaDQU.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\wyfjItW.exe
  C:\Windows\System\wyfjItW.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\GLdQBim.exe
  C:\Windows\System\GLdQBim.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\ceDwBnk.exe
  C:\Windows\System\ceDwBnk.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\ftgnQii.exe
  C:\Windows\System\ftgnQii.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\KXTOgcQ.exe
  C:\Windows\System\KXTOgcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\eBWcecq.exe
  C:\Windows\System\eBWcecq.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\YCsJdcL.exe
  C:\Windows\System\YCsJdcL.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\LKrswtf.exe
  C:\Windows\System\LKrswtf.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\vlouxqQ.exe
  C:\Windows\System\vlouxqQ.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\kyLYzMf.exe
  C:\Windows\System\kyLYzMf.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\QQysOJC.exe
  C:\Windows\System\QQysOJC.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\eQgCYan.exe
  C:\Windows\System\eQgCYan.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\VAUKEBe.exe
  C:\Windows\System\VAUKEBe.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\UaFxogl.exe
  C:\Windows\System\UaFxogl.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ZFdNANa.exe
  C:\Windows\System\ZFdNANa.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\ApxJOcg.exe
  C:\Windows\System\ApxJOcg.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\PLdPlWI.exe
  C:\Windows\System\PLdPlWI.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\UbzvcxV.exe
  C:\Windows\System\UbzvcxV.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\LOutMDs.exe
  C:\Windows\System\LOutMDs.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\iAhiUlm.exe
  C:\Windows\System\iAhiUlm.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\kZJbdTD.exe
  C:\Windows\System\kZJbdTD.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\MjQDSEy.exe
  C:\Windows\System\MjQDSEy.exe
  2⤵
  PID:4556
- C:\Windows\System\QhYhPSi.exe
  C:\Windows\System\QhYhPSi.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\RwtYiQl.exe
  C:\Windows\System\RwtYiQl.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ZRYzSlh.exe
  C:\Windows\System\ZRYzSlh.exe
  2⤵
  PID:4984
- C:\Windows\System\PMUsatc.exe
  C:\Windows\System\PMUsatc.exe
  2⤵
  PID:4124
- C:\Windows\System\vGLJODF.exe
  C:\Windows\System\vGLJODF.exe
  2⤵
  PID:4764
- C:\Windows\System\tHJuwVG.exe
  C:\Windows\System\tHJuwVG.exe
  2⤵
  PID:704
- C:\Windows\System\PCLvdqe.exe
  C:\Windows\System\PCLvdqe.exe
  2⤵
  PID:3564
- C:\Windows\System\deNMran.exe
  C:\Windows\System\deNMran.exe
  2⤵
  PID:4944
- C:\Windows\System\dSffEpW.exe
  C:\Windows\System\dSffEpW.exe
  2⤵
  PID:4004
- C:\Windows\System\tmrssNP.exe
  C:\Windows\System\tmrssNP.exe
  2⤵
  PID:2652
- C:\Windows\System\qIqQxLZ.exe
  C:\Windows\System\qIqQxLZ.exe
  2⤵
  PID:3584
- C:\Windows\System\MNfGBYK.exe
  C:\Windows\System\MNfGBYK.exe
  2⤵
  PID:4880
- C:\Windows\System\YTNVVaG.exe
  C:\Windows\System\YTNVVaG.exe
  2⤵
  PID:4384
- C:\Windows\System\zQSijUu.exe
  C:\Windows\System\zQSijUu.exe
  2⤵
  PID:3144
- C:\Windows\System\sgpXJhm.exe
  C:\Windows\System\sgpXJhm.exe
  2⤵
  PID:2932
- C:\Windows\System\OqnHGAh.exe
  C:\Windows\System\OqnHGAh.exe
  2⤵
  PID:2640
- C:\Windows\System\AFkhQfR.exe
  C:\Windows\System\AFkhQfR.exe
  2⤵
  PID:3704
- C:\Windows\System\qjTsjkR.exe
  C:\Windows\System\qjTsjkR.exe
  2⤵
  PID:2656
- C:\Windows\System\HxWVlqM.exe
  C:\Windows\System\HxWVlqM.exe
  2⤵
  PID:4368
- C:\Windows\System\tKPebhg.exe
  C:\Windows\System\tKPebhg.exe
  2⤵
  PID:1208
- C:\Windows\System\AgLiZdy.exe
  C:\Windows\System\AgLiZdy.exe
  2⤵
  PID:3160
- C:\Windows\System\rgebyQh.exe
  C:\Windows\System\rgebyQh.exe
  2⤵
  PID:844
- C:\Windows\System\xQYlmkd.exe
  C:\Windows\System\xQYlmkd.exe
  2⤵
  PID:392
- C:\Windows\System\RCoOxKK.exe
  C:\Windows\System\RCoOxKK.exe
  2⤵
  PID:4296
- C:\Windows\System\vAaLhUb.exe
  C:\Windows\System\vAaLhUb.exe
  2⤵
  PID:4408
- C:\Windows\System\TtgmUgJ.exe
  C:\Windows\System\TtgmUgJ.exe
  2⤵
  PID:2648
- C:\Windows\System\TYyphwB.exe
  C:\Windows\System\TYyphwB.exe
  2⤵
  PID:3112
- C:\Windows\System\EwLqHkj.exe
  C:\Windows\System\EwLqHkj.exe
  2⤵
  PID:3780
- C:\Windows\System\fayRdWP.exe
  C:\Windows\System\fayRdWP.exe
  2⤵
  PID:1360
- C:\Windows\System\TZIXbJb.exe
  C:\Windows\System\TZIXbJb.exe
  2⤵
  PID:3256
- C:\Windows\System\XWDIxKx.exe
  C:\Windows\System\XWDIxKx.exe
  2⤵
  PID:1428
- C:\Windows\System\HIKSncK.exe
  C:\Windows\System\HIKSncK.exe
  2⤵
  PID:4792
- C:\Windows\System\olbjCiY.exe
  C:\Windows\System\olbjCiY.exe
  2⤵
  PID:4668
- C:\Windows\System\MNjxHwq.exe
  C:\Windows\System\MNjxHwq.exe
  2⤵
  PID:1348
- C:\Windows\System\vuZxeQg.exe
  C:\Windows\System\vuZxeQg.exe
  2⤵
  PID:4588
- C:\Windows\System\BcOttcv.exe
  C:\Windows\System\BcOttcv.exe
  2⤵
  PID:876
- C:\Windows\System\GepfSkn.exe
  C:\Windows\System\GepfSkn.exe
  2⤵
  PID:3412
- C:\Windows\System\uAMafZV.exe
  C:\Windows\System\uAMafZV.exe
  2⤵
  PID:2136
- C:\Windows\System\zbtvovA.exe
  C:\Windows\System\zbtvovA.exe
  2⤵
  PID:1072
- C:\Windows\System\fVblORH.exe
  C:\Windows\System\fVblORH.exe
  2⤵
  PID:4736
- C:\Windows\System\rtECjFQ.exe
  C:\Windows\System\rtECjFQ.exe
  2⤵
  PID:3260
- C:\Windows\System\VlsQodL.exe
  C:\Windows\System\VlsQodL.exe
  2⤵
  PID:1280
- C:\Windows\System\oqLIyzx.exe
  C:\Windows\System\oqLIyzx.exe
  2⤵
  PID:4456
- C:\Windows\System\VAQSanS.exe
  C:\Windows\System\VAQSanS.exe
  2⤵
  PID:620
- C:\Windows\System\tMeCLiP.exe
  C:\Windows\System\tMeCLiP.exe
  2⤵
  PID:3288
- C:\Windows\System\qPUQdXW.exe
  C:\Windows\System\qPUQdXW.exe
  2⤵
  PID:5128
- C:\Windows\System\CGERuVN.exe
  C:\Windows\System\CGERuVN.exe
  2⤵
  PID:5148
- C:\Windows\System\PpKJbNm.exe
  C:\Windows\System\PpKJbNm.exe
  2⤵
  PID:5176
- C:\Windows\System\pkBcnES.exe
  C:\Windows\System\pkBcnES.exe
  2⤵
  PID:5196
- C:\Windows\System\mlBfHXu.exe
  C:\Windows\System\mlBfHXu.exe
  2⤵
  PID:5224
- C:\Windows\System\oRTAziT.exe
  C:\Windows\System\oRTAziT.exe
  2⤵
  PID:5248
- C:\Windows\System\UeyxpVL.exe
  C:\Windows\System\UeyxpVL.exe
  2⤵
  PID:5268
- C:\Windows\System\hvleeLp.exe
  C:\Windows\System\hvleeLp.exe
  2⤵
  PID:5292
- C:\Windows\System\gTmDwgF.exe
  C:\Windows\System\gTmDwgF.exe
  2⤵
  PID:5312
- C:\Windows\System\NjhnBsP.exe
  C:\Windows\System\NjhnBsP.exe
  2⤵
  PID:5332
- C:\Windows\System\ibcRSMo.exe
  C:\Windows\System\ibcRSMo.exe
  2⤵
  PID:5356
- C:\Windows\System\hKrXaIZ.exe
  C:\Windows\System\hKrXaIZ.exe
  2⤵
  PID:5384
- C:\Windows\System\IHquoaB.exe
  C:\Windows\System\IHquoaB.exe
  2⤵
  PID:5404
- C:\Windows\System\RGHFAfZ.exe
  C:\Windows\System\RGHFAfZ.exe
  2⤵
  PID:5428
- C:\Windows\System\kxEFnhb.exe
  C:\Windows\System\kxEFnhb.exe
  2⤵
  PID:5456
- C:\Windows\System\KqDOSXt.exe
  C:\Windows\System\KqDOSXt.exe
  2⤵
  PID:5472
- C:\Windows\System\YOKOSEE.exe
  C:\Windows\System\YOKOSEE.exe
  2⤵
  PID:5504
- C:\Windows\System\JSMwUee.exe
  C:\Windows\System\JSMwUee.exe
  2⤵
  PID:5524
- C:\Windows\System\AQRhfEb.exe
  C:\Windows\System\AQRhfEb.exe
  2⤵
  PID:5548
- C:\Windows\System\xuSCMiK.exe
  C:\Windows\System\xuSCMiK.exe
  2⤵
  PID:5568
- C:\Windows\System\KipGGHA.exe
  C:\Windows\System\KipGGHA.exe
  2⤵
  PID:5600
- C:\Windows\System\EmLausQ.exe
  C:\Windows\System\EmLausQ.exe
  2⤵
  PID:5616
- C:\Windows\System\nrQRYEm.exe
  C:\Windows\System\nrQRYEm.exe
  2⤵
  PID:5648
- C:\Windows\System\MzrsdQJ.exe
  C:\Windows\System\MzrsdQJ.exe
  2⤵
  PID:5676
- C:\Windows\System\sLOUZWE.exe
  C:\Windows\System\sLOUZWE.exe
  2⤵
  PID:5696
- C:\Windows\System\JcTbDyv.exe
  C:\Windows\System\JcTbDyv.exe
  2⤵
  PID:5736
- C:\Windows\System\ujgpANj.exe
  C:\Windows\System\ujgpANj.exe
  2⤵
  PID:5756
- C:\Windows\System\DsYOQgB.exe
  C:\Windows\System\DsYOQgB.exe
  2⤵
  PID:5780
- C:\Windows\System\AArURVh.exe
  C:\Windows\System\AArURVh.exe
  2⤵
  PID:5808
- C:\Windows\System\TzFgQtD.exe
  C:\Windows\System\TzFgQtD.exe
  2⤵
  PID:5824
- C:\Windows\System\jtwYDVF.exe
  C:\Windows\System\jtwYDVF.exe
  2⤵
  PID:5852
- C:\Windows\System\JgWHqkX.exe
  C:\Windows\System\JgWHqkX.exe
  2⤵
  PID:5872
- C:\Windows\System\nwzYLnM.exe
  C:\Windows\System\nwzYLnM.exe
  2⤵
  PID:5896
- C:\Windows\System\QlDIvhi.exe
  C:\Windows\System\QlDIvhi.exe
  2⤵
  PID:5936
- C:\Windows\System\MinEeKG.exe
  C:\Windows\System\MinEeKG.exe
  2⤵
  PID:5952
- C:\Windows\System\avoTafA.exe
  C:\Windows\System\avoTafA.exe
  2⤵
  PID:5972
- C:\Windows\System\Smobsyd.exe
  C:\Windows\System\Smobsyd.exe
  2⤵
  PID:5992
- C:\Windows\System\CJTQSQZ.exe
  C:\Windows\System\CJTQSQZ.exe
  2⤵
  PID:6020
- C:\Windows\System\YrrcgQS.exe
  C:\Windows\System\YrrcgQS.exe
  2⤵
  PID:6040
- C:\Windows\System\zAuZDhi.exe
  C:\Windows\System\zAuZDhi.exe
  2⤵
  PID:6060
- C:\Windows\System\WOIbivI.exe
  C:\Windows\System\WOIbivI.exe
  2⤵
  PID:6084
- C:\Windows\System\ffpSkkM.exe
  C:\Windows\System\ffpSkkM.exe
  2⤵
  PID:6108
- C:\Windows\System\vBwlztM.exe
  C:\Windows\System\vBwlztM.exe
  2⤵
  PID:6128
- C:\Windows\System\dyYSaGQ.exe
  C:\Windows\System\dyYSaGQ.exe
  2⤵
  PID:2416
- C:\Windows\System\rduQqdZ.exe
  C:\Windows\System\rduQqdZ.exe
  2⤵
  PID:1440
- C:\Windows\System\AnXTKiu.exe
  C:\Windows\System\AnXTKiu.exe
  2⤵
  PID:3572
- C:\Windows\System\EZisckR.exe
  C:\Windows\System\EZisckR.exe
  2⤵
  PID:432
- C:\Windows\System\kwVIIlX.exe
  C:\Windows\System\kwVIIlX.exe
  2⤵
  PID:4848
- C:\Windows\System\nDPxgWL.exe
  C:\Windows\System\nDPxgWL.exe
  2⤵
  PID:2376
- C:\Windows\System\ruLDVzP.exe
  C:\Windows\System\ruLDVzP.exe
  2⤵
  PID:1500
- C:\Windows\System\kArAPSN.exe
  C:\Windows\System\kArAPSN.exe
  2⤵
  PID:5420
- C:\Windows\System\RRoYArb.exe
  C:\Windows\System\RRoYArb.exe
  2⤵
  PID:2692
- C:\Windows\System\qjcvpYp.exe
  C:\Windows\System\qjcvpYp.exe
  2⤵
  PID:3332
- C:\Windows\System\hkZitBl.exe
  C:\Windows\System\hkZitBl.exe
  2⤵
  PID:5348
- C:\Windows\System\ENfPmtn.exe
  C:\Windows\System\ENfPmtn.exe
  2⤵
  PID:5368
- C:\Windows\System\QzRikzA.exe
  C:\Windows\System\QzRikzA.exe
  2⤵
  PID:804
- C:\Windows\System\dKQIZLa.exe
  C:\Windows\System\dKQIZLa.exe
  2⤵
  PID:5136
- C:\Windows\System\epBXJIi.exe
  C:\Windows\System\epBXJIi.exe
  2⤵
  PID:5172
- C:\Windows\System\vUIUzOK.exe
  C:\Windows\System\vUIUzOK.exe
  2⤵
  PID:5216
- C:\Windows\System\bAHHbGt.exe
  C:\Windows\System\bAHHbGt.exe
  2⤵
  PID:5256
- C:\Windows\System\kZWWuxk.exe
  C:\Windows\System\kZWWuxk.exe
  2⤵
  PID:5288
- C:\Windows\System\JzIZapA.exe
  C:\Windows\System\JzIZapA.exe
  2⤵
  PID:6156
- C:\Windows\System\kIQbmAt.exe
  C:\Windows\System\kIQbmAt.exe
  2⤵
  PID:6180
- C:\Windows\System\eWBqQsT.exe
  C:\Windows\System\eWBqQsT.exe
  2⤵
  PID:6200
- C:\Windows\System\sLGjNgK.exe
  C:\Windows\System\sLGjNgK.exe
  2⤵
  PID:6224
- C:\Windows\System\VlMEBBr.exe
  C:\Windows\System\VlMEBBr.exe
  2⤵
  PID:6248
- C:\Windows\System\eJRaZwg.exe
  C:\Windows\System\eJRaZwg.exe
  2⤵
  PID:6268
- C:\Windows\System\YdtCyYM.exe
  C:\Windows\System\YdtCyYM.exe
  2⤵
  PID:6292
- C:\Windows\System\wYOSiGb.exe
  C:\Windows\System\wYOSiGb.exe
  2⤵
  PID:6312
- C:\Windows\System\WGcQnVm.exe
  C:\Windows\System\WGcQnVm.exe
  2⤵
  PID:6332
- C:\Windows\System\NsCohSL.exe
  C:\Windows\System\NsCohSL.exe
  2⤵
  PID:6356
- C:\Windows\System\BTUdVnq.exe
  C:\Windows\System\BTUdVnq.exe
  2⤵
  PID:6384
- C:\Windows\System\LEuHSbw.exe
  C:\Windows\System\LEuHSbw.exe
  2⤵
  PID:6404
- C:\Windows\System\UquYukb.exe
  C:\Windows\System\UquYukb.exe
  2⤵
  PID:6428
- C:\Windows\System\fhuCEuN.exe
  C:\Windows\System\fhuCEuN.exe
  2⤵
  PID:6452
- C:\Windows\System\FJyfusE.exe
  C:\Windows\System\FJyfusE.exe
  2⤵
  PID:6468
- C:\Windows\System\ApBvbGc.exe
  C:\Windows\System\ApBvbGc.exe
  2⤵
  PID:6496
- C:\Windows\System\iEyGKUj.exe
  C:\Windows\System\iEyGKUj.exe
  2⤵
  PID:6520
- C:\Windows\System\QlaLlxt.exe
  C:\Windows\System\QlaLlxt.exe
  2⤵
  PID:6540
- C:\Windows\System\HHrUiOD.exe
  C:\Windows\System\HHrUiOD.exe
  2⤵
  PID:6580
- C:\Windows\System\zmFBTDF.exe
  C:\Windows\System\zmFBTDF.exe
  2⤵
  PID:6596
- C:\Windows\System\IkpuMuH.exe
  C:\Windows\System\IkpuMuH.exe
  2⤵
  PID:6628
- C:\Windows\System\fItwtub.exe
  C:\Windows\System\fItwtub.exe
  2⤵
  PID:6652
- C:\Windows\System\WRiDITJ.exe
  C:\Windows\System\WRiDITJ.exe
  2⤵
  PID:6676
- C:\Windows\System\dkqFssA.exe
  C:\Windows\System\dkqFssA.exe
  2⤵
  PID:6696
- C:\Windows\System\cRLAwcK.exe
  C:\Windows\System\cRLAwcK.exe
  2⤵
  PID:6716
- C:\Windows\System\QxWsYzI.exe
  C:\Windows\System\QxWsYzI.exe
  2⤵
  PID:6740
- C:\Windows\System\LfGlNgU.exe
  C:\Windows\System\LfGlNgU.exe
  2⤵
  PID:6760
- C:\Windows\System\kQgxkcx.exe
  C:\Windows\System\kQgxkcx.exe
  2⤵
  PID:6784
- C:\Windows\System\muXgakq.exe
  C:\Windows\System\muXgakq.exe
  2⤵
  PID:6808
- C:\Windows\System\qQGCpVk.exe
  C:\Windows\System\qQGCpVk.exe
  2⤵
  PID:6828
- C:\Windows\System\RhHcLUc.exe
  C:\Windows\System\RhHcLUc.exe
  2⤵
  PID:6848
- C:\Windows\System\eDyqrsE.exe
  C:\Windows\System\eDyqrsE.exe
  2⤵
  PID:6872
- C:\Windows\System\EHcwBkm.exe
  C:\Windows\System\EHcwBkm.exe
  2⤵
  PID:6900
- C:\Windows\System\yMHsgOo.exe
  C:\Windows\System\yMHsgOo.exe
  2⤵
  PID:6924
- C:\Windows\System\oYaFNZm.exe
  C:\Windows\System\oYaFNZm.exe
  2⤵
  PID:6948
- C:\Windows\System\klJFqyF.exe
  C:\Windows\System\klJFqyF.exe
  2⤵
  PID:6968
- C:\Windows\System\GfBeqAz.exe
  C:\Windows\System\GfBeqAz.exe
  2⤵
  PID:6996
- C:\Windows\System\oFeqSeZ.exe
  C:\Windows\System\oFeqSeZ.exe
  2⤵
  PID:7016
- C:\Windows\System\pnCBDvq.exe
  C:\Windows\System\pnCBDvq.exe
  2⤵
  PID:7040
- C:\Windows\System\OJeslCH.exe
  C:\Windows\System\OJeslCH.exe
  2⤵
  PID:7076
- C:\Windows\System\XoAeBVV.exe
  C:\Windows\System\XoAeBVV.exe
  2⤵
  PID:4136
- C:\Windows\System\XiIVvXz.exe
  C:\Windows\System\XiIVvXz.exe
  2⤵
  PID:5748
- C:\Windows\System\QUIspWQ.exe
  C:\Windows\System\QUIspWQ.exe
  2⤵
  PID:5816
- C:\Windows\System\ERLXedW.exe
  C:\Windows\System\ERLXedW.exe
  2⤵
  PID:5844
- C:\Windows\System\zCVgwKU.exe
  C:\Windows\System\zCVgwKU.exe
  2⤵
  PID:5576
- C:\Windows\System\TFUJxab.exe
  C:\Windows\System\TFUJxab.exe
  2⤵
  PID:5612
- C:\Windows\System\wKBUBvs.exe
  C:\Windows\System\wKBUBvs.exe
  2⤵
  PID:5988
- C:\Windows\System\OVMMmoX.exe
  C:\Windows\System\OVMMmoX.exe
  2⤵
  PID:2952
- C:\Windows\System\vcBMxvT.exe
  C:\Windows\System\vcBMxvT.exe
  2⤵
  PID:6276
- C:\Windows\System\cEjiakn.exe
  C:\Windows\System\cEjiakn.exe
  2⤵
  PID:5396
- C:\Windows\System\xWrFXSl.exe
  C:\Windows\System\xWrFXSl.exe
  2⤵
  PID:6400
- C:\Windows\System\EcDOIby.exe
  C:\Windows\System\EcDOIby.exe
  2⤵
  PID:4840
- C:\Windows\System\ylnQJmj.exe
  C:\Windows\System\ylnQJmj.exe
  2⤵
  PID:1676
- C:\Windows\System\gNfIfBl.exe
  C:\Windows\System\gNfIfBl.exe
  2⤵
  PID:5324
- C:\Windows\System\yLGAtAG.exe
  C:\Windows\System\yLGAtAG.exe
  2⤵
  PID:5236
- C:\Windows\System\TRUnNaO.exe
  C:\Windows\System\TRUnNaO.exe
  2⤵
  PID:5944
- C:\Windows\System\bcSxjrh.exe
  C:\Windows\System\bcSxjrh.exe
  2⤵
  PID:6032
- C:\Windows\System\vElkuiG.exe
  C:\Windows\System\vElkuiG.exe
  2⤵
  PID:6212
- C:\Windows\System\NkYoqwX.exe
  C:\Windows\System\NkYoqwX.exe
  2⤵
  PID:6288
- C:\Windows\System\ZzxQmtb.exe
  C:\Windows\System\ZzxQmtb.exe
  2⤵
  PID:6352
- C:\Windows\System\ILJpfXW.exe
  C:\Windows\System\ILJpfXW.exe
  2⤵
  PID:6528
- C:\Windows\System\ykAYpCq.exe
  C:\Windows\System\ykAYpCq.exe
  2⤵
  PID:5764
- C:\Windows\System\QGrntgh.exe
  C:\Windows\System\QGrntgh.exe
  2⤵
  PID:5376
- C:\Windows\System\BFQmoCG.exe
  C:\Windows\System\BFQmoCG.exe
  2⤵
  PID:6172
- C:\Windows\System\mDCMdgG.exe
  C:\Windows\System\mDCMdgG.exe
  2⤵
  PID:7176
- C:\Windows\System\zKFfFdz.exe
  C:\Windows\System\zKFfFdz.exe
  2⤵
  PID:7208
- C:\Windows\System\dlHPvAt.exe
  C:\Windows\System\dlHPvAt.exe
  2⤵
  PID:7228
- C:\Windows\System\YeNOTJF.exe
  C:\Windows\System\YeNOTJF.exe
  2⤵
  PID:7248
- C:\Windows\System\SlXdkDs.exe
  C:\Windows\System\SlXdkDs.exe
  2⤵
  PID:7272
- C:\Windows\System\DkpZwNk.exe
  C:\Windows\System\DkpZwNk.exe
  2⤵
  PID:7300
- C:\Windows\System\SMJPVEx.exe
  C:\Windows\System\SMJPVEx.exe
  2⤵
  PID:7324
- C:\Windows\System\QTXLyzN.exe
  C:\Windows\System\QTXLyzN.exe
  2⤵
  PID:7344
- C:\Windows\System\xeXEVRc.exe
  C:\Windows\System\xeXEVRc.exe
  2⤵
  PID:7368
- C:\Windows\System\mBUzjPe.exe
  C:\Windows\System\mBUzjPe.exe
  2⤵
  PID:7392
- C:\Windows\System\kOnyShU.exe
  C:\Windows\System\kOnyShU.exe
  2⤵
  PID:7408
- C:\Windows\System\eDEXaym.exe
  C:\Windows\System\eDEXaym.exe
  2⤵
  PID:7428
- C:\Windows\System\mBmzHPQ.exe
  C:\Windows\System\mBmzHPQ.exe
  2⤵
  PID:7452
- C:\Windows\System\DWQtfen.exe
  C:\Windows\System\DWQtfen.exe
  2⤵
  PID:7480
- C:\Windows\System\NCwTQsy.exe
  C:\Windows\System\NCwTQsy.exe
  2⤵
  PID:7504
- C:\Windows\System\yQhhKrd.exe
  C:\Windows\System\yQhhKrd.exe
  2⤵
  PID:7524
- C:\Windows\System\hRLXXqo.exe
  C:\Windows\System\hRLXXqo.exe
  2⤵
  PID:7544
- C:\Windows\System\FLqEJlG.exe
  C:\Windows\System\FLqEJlG.exe
  2⤵
  PID:7576
- C:\Windows\System\OfjHxKs.exe
  C:\Windows\System\OfjHxKs.exe
  2⤵
  PID:7596
- C:\Windows\System\bDewOGe.exe
  C:\Windows\System\bDewOGe.exe
  2⤵
  PID:7616
- C:\Windows\System\uBjVIEW.exe
  C:\Windows\System\uBjVIEW.exe
  2⤵
  PID:7640
- C:\Windows\System\QlNUQjc.exe
  C:\Windows\System\QlNUQjc.exe
  2⤵
  PID:7660
- C:\Windows\System\ZrfjiEf.exe
  C:\Windows\System\ZrfjiEf.exe
  2⤵
  PID:7684
- C:\Windows\System\fqCBpfp.exe
  C:\Windows\System\fqCBpfp.exe
  2⤵
  PID:7708
- C:\Windows\System\lKpOyXI.exe
  C:\Windows\System\lKpOyXI.exe
  2⤵
  PID:7728
- C:\Windows\System\qBdeXCV.exe
  C:\Windows\System\qBdeXCV.exe
  2⤵
  PID:7752
- C:\Windows\System\mAOjKqj.exe
  C:\Windows\System\mAOjKqj.exe
  2⤵
  PID:7776
- C:\Windows\System\IrlleqG.exe
  C:\Windows\System\IrlleqG.exe
  2⤵
  PID:7792
- C:\Windows\System\ZkieaFa.exe
  C:\Windows\System\ZkieaFa.exe
  2⤵
  PID:7808
- C:\Windows\System\EectPQD.exe
  C:\Windows\System\EectPQD.exe
  2⤵
  PID:7824
- C:\Windows\System\scMmkHu.exe
  C:\Windows\System\scMmkHu.exe
  2⤵
  PID:7844
- C:\Windows\System\TRWsSgl.exe
  C:\Windows\System\TRWsSgl.exe
  2⤵
  PID:7872
- C:\Windows\System\JGyXCOM.exe
  C:\Windows\System\JGyXCOM.exe
  2⤵
  PID:7892
- C:\Windows\System\CFTkwku.exe
  C:\Windows\System\CFTkwku.exe
  2⤵
  PID:7908
- C:\Windows\System\DtGZHAT.exe
  C:\Windows\System\DtGZHAT.exe
  2⤵
  PID:7932
- C:\Windows\System\SNSWUBy.exe
  C:\Windows\System\SNSWUBy.exe
  2⤵
  PID:7948
- C:\Windows\System\eUidWZS.exe
  C:\Windows\System\eUidWZS.exe
  2⤵
  PID:7964
- C:\Windows\System\XhJCnct.exe
  C:\Windows\System\XhJCnct.exe
  2⤵
  PID:7980
- C:\Windows\System\MFKBjzn.exe
  C:\Windows\System\MFKBjzn.exe
  2⤵
  PID:7996
- C:\Windows\System\HcvBXVa.exe
  C:\Windows\System\HcvBXVa.exe
  2⤵
  PID:8012
- C:\Windows\System\MZMPzfR.exe
  C:\Windows\System\MZMPzfR.exe
  2⤵
  PID:8068
- C:\Windows\System\HLeBxyc.exe
  C:\Windows\System\HLeBxyc.exe
  2⤵
  PID:8088
- C:\Windows\System\QPPpcBv.exe
  C:\Windows\System\QPPpcBv.exe
  2⤵
  PID:8108
- C:\Windows\System\cfninsb.exe
  C:\Windows\System\cfninsb.exe
  2⤵
  PID:8140
- C:\Windows\System\itpsEVC.exe
  C:\Windows\System\itpsEVC.exe
  2⤵
  PID:8164
- C:\Windows\System\qUwSpJs.exe
  C:\Windows\System\qUwSpJs.exe
  2⤵
  PID:8188
- C:\Windows\System\vRjFPJJ.exe
  C:\Windows\System\vRjFPJJ.exe
  2⤵
  PID:6240
- C:\Windows\System\fRRFNBm.exe
  C:\Windows\System\fRRFNBm.exe
  2⤵
  PID:6420
- C:\Windows\System\VzZvXlg.exe
  C:\Windows\System\VzZvXlg.exe
  2⤵
  PID:6444
- C:\Windows\System\diyiAUc.exe
  C:\Windows\System\diyiAUc.exe
  2⤵
  PID:7060
- C:\Windows\System\sVNjTuk.exe
  C:\Windows\System\sVNjTuk.exe
  2⤵
  PID:6512
- C:\Windows\System\SDwKeot.exe
  C:\Windows\System\SDwKeot.exe
  2⤵
  PID:5556
- C:\Windows\System\oIiNyko.exe
  C:\Windows\System\oIiNyko.exe
  2⤵
  PID:6392
- C:\Windows\System\rGrkwPr.exe
  C:\Windows\System\rGrkwPr.exe
  2⤵
  PID:5124
- C:\Windows\System\JUzjpVw.exe
  C:\Windows\System\JUzjpVw.exe
  2⤵
  PID:6880
- C:\Windows\System\iAQUhCt.exe
  C:\Windows\System\iAQUhCt.exe
  2⤵
  PID:7420
- C:\Windows\System\WqFAwRt.exe
  C:\Windows\System\WqFAwRt.exe
  2⤵
  PID:7488
- C:\Windows\System\vwlUQnx.exe
  C:\Windows\System\vwlUQnx.exe
  2⤵
  PID:7520
- C:\Windows\System\JsXqtDY.exe
  C:\Windows\System\JsXqtDY.exe
  2⤵
  PID:7588
- C:\Windows\System\qVgcJzM.exe
  C:\Windows\System\qVgcJzM.exe
  2⤵
  PID:7012
- C:\Windows\System\klUHlVH.exe
  C:\Windows\System\klUHlVH.exe
  2⤵
  PID:8208
- C:\Windows\System\onvlTjT.exe
  C:\Windows\System\onvlTjT.exe
  2⤵
  PID:8236
- C:\Windows\System\ZyIyVaJ.exe
  C:\Windows\System\ZyIyVaJ.exe
  2⤵
  PID:8256
- C:\Windows\System\ZGhYrGS.exe
  C:\Windows\System\ZGhYrGS.exe
  2⤵
  PID:8276
- C:\Windows\System\YMHPPun.exe
  C:\Windows\System\YMHPPun.exe
  2⤵
  PID:8296
- C:\Windows\System\XxQCqfp.exe
  C:\Windows\System\XxQCqfp.exe
  2⤵
  PID:8316
- C:\Windows\System\uzlFimE.exe
  C:\Windows\System\uzlFimE.exe
  2⤵
  PID:8332
- C:\Windows\System\kaeMIqo.exe
  C:\Windows\System\kaeMIqo.exe
  2⤵
  PID:8356
- C:\Windows\System\CwCbwDV.exe
  C:\Windows\System\CwCbwDV.exe
  2⤵
  PID:8376
- C:\Windows\System\fQQZrsJ.exe
  C:\Windows\System\fQQZrsJ.exe
  2⤵
  PID:8392
- C:\Windows\System\GRAregD.exe
  C:\Windows\System\GRAregD.exe
  2⤵
  PID:8408
- C:\Windows\System\LqIdivd.exe
  C:\Windows\System\LqIdivd.exe
  2⤵
  PID:8424
- C:\Windows\System\UYHvGxW.exe
  C:\Windows\System\UYHvGxW.exe
  2⤵
  PID:8440
- C:\Windows\System\sXbxwEx.exe
  C:\Windows\System\sXbxwEx.exe
  2⤵
  PID:8456
- C:\Windows\System\lGpDvqw.exe
  C:\Windows\System\lGpDvqw.exe
  2⤵
  PID:8472
- C:\Windows\System\KwXJtlj.exe
  C:\Windows\System\KwXJtlj.exe
  2⤵
  PID:8488
- C:\Windows\System\WQaLdUv.exe
  C:\Windows\System\WQaLdUv.exe
  2⤵
  PID:8504
- C:\Windows\System\pwRdWYT.exe
  C:\Windows\System\pwRdWYT.exe
  2⤵
  PID:8524
- C:\Windows\System\naHOKTs.exe
  C:\Windows\System\naHOKTs.exe
  2⤵
  PID:8548
- C:\Windows\System\miIpLoT.exe
  C:\Windows\System\miIpLoT.exe
  2⤵
  PID:8568
- C:\Windows\System\UjGqmsQ.exe
  C:\Windows\System\UjGqmsQ.exe
  2⤵
  PID:8588
- C:\Windows\System\SQHovqQ.exe
  C:\Windows\System\SQHovqQ.exe
  2⤵
  PID:8612
- C:\Windows\System\hIPIGdm.exe
  C:\Windows\System\hIPIGdm.exe
  2⤵
  PID:8632
- C:\Windows\System\PUQBYVn.exe
  C:\Windows\System\PUQBYVn.exe
  2⤵
  PID:8656
- C:\Windows\System\zmIVJRm.exe
  C:\Windows\System\zmIVJRm.exe
  2⤵
  PID:8680
- C:\Windows\System\kGpVbRO.exe
  C:\Windows\System\kGpVbRO.exe
  2⤵
  PID:8696
- C:\Windows\System\fqCafFV.exe
  C:\Windows\System\fqCafFV.exe
  2⤵
  PID:8716
- C:\Windows\System\QVaTQoA.exe
  C:\Windows\System\QVaTQoA.exe
  2⤵
  PID:8740
- C:\Windows\System\rlJOhzi.exe
  C:\Windows\System\rlJOhzi.exe
  2⤵
  PID:8764
- C:\Windows\System\EPaUhtC.exe
  C:\Windows\System\EPaUhtC.exe
  2⤵
  PID:8788
- C:\Windows\System\SxUBjOt.exe
  C:\Windows\System\SxUBjOt.exe
  2⤵
  PID:8808
- C:\Windows\System\dVWcPcu.exe
  C:\Windows\System\dVWcPcu.exe
  2⤵
  PID:8832
- C:\Windows\System\TqpFOHx.exe
  C:\Windows\System\TqpFOHx.exe
  2⤵
  PID:8856
- C:\Windows\System\loaFqgr.exe
  C:\Windows\System\loaFqgr.exe
  2⤵
  PID:8876
- C:\Windows\System\DNauMbo.exe
  C:\Windows\System\DNauMbo.exe
  2⤵
  PID:8900
- C:\Windows\System\yEBAhXA.exe
  C:\Windows\System\yEBAhXA.exe
  2⤵
  PID:8920
- C:\Windows\System\nTJihNl.exe
  C:\Windows\System\nTJihNl.exe
  2⤵
  PID:8940
- C:\Windows\System\HcluCpo.exe
  C:\Windows\System\HcluCpo.exe
  2⤵
  PID:8964
- C:\Windows\System\cpehXJd.exe
  C:\Windows\System\cpehXJd.exe
  2⤵
  PID:8988
- C:\Windows\System\gCHBoYP.exe
  C:\Windows\System\gCHBoYP.exe
  2⤵
  PID:9008
- C:\Windows\System\WZDSqoC.exe
  C:\Windows\System\WZDSqoC.exe
  2⤵
  PID:9028
- C:\Windows\System\FxIGskP.exe
  C:\Windows\System\FxIGskP.exe
  2⤵
  PID:9056
- C:\Windows\System\MljBWXY.exe
  C:\Windows\System\MljBWXY.exe
  2⤵
  PID:9076
- C:\Windows\System\UjXAGWq.exe
  C:\Windows\System\UjXAGWq.exe
  2⤵
  PID:9096
- C:\Windows\System\RLZfHxx.exe
  C:\Windows\System\RLZfHxx.exe
  2⤵
  PID:9124
- C:\Windows\System\TvLJRZN.exe
  C:\Windows\System\TvLJRZN.exe
  2⤵
  PID:9144
- C:\Windows\System\HTIHzvc.exe
  C:\Windows\System\HTIHzvc.exe
  2⤵
  PID:9168
- C:\Windows\System\AcVEEXd.exe
  C:\Windows\System\AcVEEXd.exe
  2⤵
  PID:9192
- C:\Windows\System\vlNkgzK.exe
  C:\Windows\System\vlNkgzK.exe
  2⤵
  PID:9208
- C:\Windows\System\UoIEYKz.exe
  C:\Windows\System\UoIEYKz.exe
  2⤵
  PID:7760
- C:\Windows\System\qOfZQPM.exe
  C:\Windows\System\qOfZQPM.exe
  2⤵
  PID:5452
- C:\Windows\System\TmWDSsn.exe
  C:\Windows\System\TmWDSsn.exe
  2⤵
  PID:7064
- C:\Windows\System\JQKGAKA.exe
  C:\Windows\System\JQKGAKA.exe
  2⤵
  PID:6888
- C:\Windows\System\LFWVYFd.exe
  C:\Windows\System\LFWVYFd.exe
  2⤵
  PID:6752
- C:\Windows\System\NsKeATV.exe
  C:\Windows\System\NsKeATV.exe
  2⤵
  PID:6616
- C:\Windows\System\RMjxnZA.exe
  C:\Windows\System\RMjxnZA.exe
  2⤵
  PID:7960
- C:\Windows\System\wYBoLfn.exe
  C:\Windows\System\wYBoLfn.exe
  2⤵
  PID:7988
- C:\Windows\System\IDzmmDi.exe
  C:\Windows\System\IDzmmDi.exe
  2⤵
  PID:8008
- C:\Windows\System\wqIaHua.exe
  C:\Windows\System\wqIaHua.exe
  2⤵
  PID:1804
- C:\Windows\System\NivOOUB.exe
  C:\Windows\System\NivOOUB.exe
  2⤵
  PID:6396
- C:\Windows\System\WTZbrXQ.exe
  C:\Windows\System\WTZbrXQ.exe
  2⤵
  PID:5968
- C:\Windows\System\oLLfKAM.exe
  C:\Windows\System\oLLfKAM.exe
  2⤵
  PID:6348
- C:\Windows\System\vlmpQsi.exe
  C:\Windows\System\vlmpQsi.exe
  2⤵
  PID:7204
- C:\Windows\System\zmUDUNs.exe
  C:\Windows\System\zmUDUNs.exe
  2⤵
  PID:7356
- C:\Windows\System\fnOTPIq.exe
  C:\Windows\System\fnOTPIq.exe
  2⤵
  PID:7404
- C:\Windows\System\AnXUSbz.exe
  C:\Windows\System\AnXUSbz.exe
  2⤵
  PID:7656
- C:\Windows\System\LQzIEUB.exe
  C:\Windows\System\LQzIEUB.exe
  2⤵
  PID:5480
- C:\Windows\System\sepGDfY.exe
  C:\Windows\System\sepGDfY.exe
  2⤵
  PID:4896
- C:\Windows\System\LctsXVR.exe
  C:\Windows\System\LctsXVR.exe
  2⤵
  PID:8324
- C:\Windows\System\wfZUxsP.exe
  C:\Windows\System\wfZUxsP.exe
  2⤵
  PID:5664
- C:\Windows\System\zKOtmWt.exe
  C:\Windows\System\zKOtmWt.exe
  2⤵
  PID:5708
- C:\Windows\System\IhlpULy.exe
  C:\Windows\System\IhlpULy.exe
  2⤵
  PID:6504
- C:\Windows\System\VYZmwJJ.exe
  C:\Windows\System\VYZmwJJ.exe
  2⤵
  PID:8156
- C:\Windows\System\aoqSbRr.exe
  C:\Windows\System\aoqSbRr.exe
  2⤵
  PID:6804
- C:\Windows\System\OQEGWQM.exe
  C:\Windows\System\OQEGWQM.exe
  2⤵
  PID:6440
- C:\Windows\System\FeBRzhG.exe
  C:\Windows\System\FeBRzhG.exe
  2⤵
  PID:6592
- C:\Windows\System\sYxxmVb.exe
  C:\Windows\System\sYxxmVb.exe
  2⤵
  PID:6188
- C:\Windows\System\nzpOcts.exe
  C:\Windows\System\nzpOcts.exe
  2⤵
  PID:8748
- C:\Windows\System\pauecxi.exe
  C:\Windows\System\pauecxi.exe
  2⤵
  PID:7244
- C:\Windows\System\uPoTPUE.exe
  C:\Windows\System\uPoTPUE.exe
  2⤵
  PID:7292
- C:\Windows\System\VnSkInL.exe
  C:\Windows\System\VnSkInL.exe
  2⤵
  PID:9232
- C:\Windows\System\CqjRmYN.exe
  C:\Windows\System\CqjRmYN.exe
  2⤵
  PID:9252
- C:\Windows\System\BMzfdzS.exe
  C:\Windows\System\BMzfdzS.exe
  2⤵
  PID:9276
- C:\Windows\System\mxiVTmH.exe
  C:\Windows\System\mxiVTmH.exe
  2⤵
  PID:9296
- C:\Windows\System\wrSMopE.exe
  C:\Windows\System\wrSMopE.exe
  2⤵
  PID:9320
- C:\Windows\System\oOmfVaY.exe
  C:\Windows\System\oOmfVaY.exe
  2⤵
  PID:9344
- C:\Windows\System\CYuJONJ.exe
  C:\Windows\System\CYuJONJ.exe
  2⤵
  PID:9368
- C:\Windows\System\cKQuMNH.exe
  C:\Windows\System\cKQuMNH.exe
  2⤵
  PID:9392
- C:\Windows\System\KQVqLjY.exe
  C:\Windows\System\KQVqLjY.exe
  2⤵
  PID:9416
- C:\Windows\System\vfpDbyC.exe
  C:\Windows\System\vfpDbyC.exe
  2⤵
  PID:9436
- C:\Windows\System\OAyMCuD.exe
  C:\Windows\System\OAyMCuD.exe
  2⤵
  PID:9456
- C:\Windows\System\YfVdHDx.exe
  C:\Windows\System\YfVdHDx.exe
  2⤵
  PID:9480
- C:\Windows\System\VviWIfU.exe
  C:\Windows\System\VviWIfU.exe
  2⤵
  PID:9512
- C:\Windows\System\THpBqsS.exe
  C:\Windows\System\THpBqsS.exe
  2⤵
  PID:9532
- C:\Windows\System\myXFhcM.exe
  C:\Windows\System\myXFhcM.exe
  2⤵
  PID:9552
- C:\Windows\System\fVCPfae.exe
  C:\Windows\System\fVCPfae.exe
  2⤵
  PID:9576
- C:\Windows\System\DAPtjkI.exe
  C:\Windows\System\DAPtjkI.exe
  2⤵
  PID:9600
- C:\Windows\System\RlfKVHV.exe
  C:\Windows\System\RlfKVHV.exe
  2⤵
  PID:9624
- C:\Windows\System\LYSaaPl.exe
  C:\Windows\System\LYSaaPl.exe
  2⤵
  PID:9644
- C:\Windows\System\guPNxEw.exe
  C:\Windows\System\guPNxEw.exe
  2⤵
  PID:9668
- C:\Windows\System\eyqTGUq.exe
  C:\Windows\System\eyqTGUq.exe
  2⤵
  PID:9692
- C:\Windows\System\AhAwLjq.exe
  C:\Windows\System\AhAwLjq.exe
  2⤵
  PID:9720
- C:\Windows\System\fSVXjsZ.exe
  C:\Windows\System\fSVXjsZ.exe
  2⤵
  PID:9744
- C:\Windows\System\jSnfjAf.exe
  C:\Windows\System\jSnfjAf.exe
  2⤵
  PID:9768
- C:\Windows\System\wzobTFc.exe
  C:\Windows\System\wzobTFc.exe
  2⤵
  PID:9784
- C:\Windows\System\xFWDqDm.exe
  C:\Windows\System\xFWDqDm.exe
  2⤵
  PID:9816
- C:\Windows\System\MDOIDXR.exe
  C:\Windows\System\MDOIDXR.exe
  2⤵
  PID:9836
- C:\Windows\System\riQkFEZ.exe
  C:\Windows\System\riQkFEZ.exe
  2⤵
  PID:9864
- C:\Windows\System\rsIbXTU.exe
  C:\Windows\System\rsIbXTU.exe
  2⤵
  PID:9884
- C:\Windows\System\YklXQVN.exe
  C:\Windows\System\YklXQVN.exe
  2⤵
  PID:9908
- C:\Windows\System\srqLXzG.exe
  C:\Windows\System\srqLXzG.exe
  2⤵
  PID:9936
- C:\Windows\System\FepNLuK.exe
  C:\Windows\System\FepNLuK.exe
  2⤵
  PID:9960
- C:\Windows\System\PMwVpEj.exe
  C:\Windows\System\PMwVpEj.exe
  2⤵
  PID:9980
- C:\Windows\System\sYbAZeM.exe
  C:\Windows\System\sYbAZeM.exe
  2⤵
  PID:10008
- C:\Windows\System\qQERvRU.exe
  C:\Windows\System\qQERvRU.exe
  2⤵
  PID:10028
- C:\Windows\System\ODyeDdO.exe
  C:\Windows\System\ODyeDdO.exe
  2⤵
  PID:10056
- C:\Windows\System\dYygPQM.exe
  C:\Windows\System\dYygPQM.exe
  2⤵
  PID:10076
- C:\Windows\System\NzYISOG.exe
  C:\Windows\System\NzYISOG.exe
  2⤵
  PID:10100
- C:\Windows\System\iyPalLn.exe
  C:\Windows\System\iyPalLn.exe
  2⤵
  PID:10120
- C:\Windows\System\EMksDjS.exe
  C:\Windows\System\EMksDjS.exe
  2⤵
  PID:10140
- C:\Windows\System\CfMIJZI.exe
  C:\Windows\System\CfMIJZI.exe
  2⤵
  PID:10168
- C:\Windows\System\MMKoUgr.exe
  C:\Windows\System\MMKoUgr.exe
  2⤵
  PID:10136
- C:\Windows\System\nbPTITA.exe
  C:\Windows\System\nbPTITA.exe
  2⤵
  PID:10376
- C:\Windows\System\pwvtLFe.exe
  C:\Windows\System\pwvtLFe.exe
  2⤵
  PID:10392
- C:\Windows\System\CJMcJVI.exe
  C:\Windows\System\CJMcJVI.exe
  2⤵
  PID:10408
- C:\Windows\System\BQzFJuW.exe
  C:\Windows\System\BQzFJuW.exe
  2⤵
  PID:10424
- C:\Windows\System\AOAaEjC.exe
  C:\Windows\System\AOAaEjC.exe
  2⤵
  PID:10444
- C:\Windows\System\xlrNULM.exe
  C:\Windows\System\xlrNULM.exe
  2⤵
  PID:10468
- C:\Windows\System\BJYfmGX.exe
  C:\Windows\System\BJYfmGX.exe
  2⤵
  PID:10488
- C:\Windows\System\jLykGFs.exe
  C:\Windows\System\jLykGFs.exe
  2⤵
  PID:10508
- C:\Windows\System\VZwxaCA.exe
  C:\Windows\System\VZwxaCA.exe
  2⤵
  PID:10528
- C:\Windows\System\hDuxnXD.exe
  C:\Windows\System\hDuxnXD.exe
  2⤵
  PID:10564
- C:\Windows\System\GOQVCcG.exe
  C:\Windows\System\GOQVCcG.exe
  2⤵
  PID:10584
- C:\Windows\System\WfvmYWN.exe
  C:\Windows\System\WfvmYWN.exe
  2⤵
  PID:10604
- C:\Windows\System\yFDJmcQ.exe
  C:\Windows\System\yFDJmcQ.exe
  2⤵
  PID:10624
- C:\Windows\System\uxJhKxM.exe
  C:\Windows\System\uxJhKxM.exe
  2⤵
  PID:10648
- C:\Windows\System\GDweldG.exe
  C:\Windows\System\GDweldG.exe
  2⤵
  PID:10668
- C:\Windows\System\YgoUbNo.exe
  C:\Windows\System\YgoUbNo.exe
  2⤵
  PID:10688
- C:\Windows\System\ThKVEcg.exe
  C:\Windows\System\ThKVEcg.exe
  2⤵
  PID:10708
- C:\Windows\System\lBlFIst.exe
  C:\Windows\System\lBlFIst.exe
  2⤵
  PID:10728
- C:\Windows\System\oyZeNBQ.exe
  C:\Windows\System\oyZeNBQ.exe
  2⤵
  PID:10748
- C:\Windows\System\OGbySPm.exe
  C:\Windows\System\OGbySPm.exe
  2⤵
  PID:10772
- C:\Windows\System\LObiORt.exe
  C:\Windows\System\LObiORt.exe
  2⤵
  PID:10792
- C:\Windows\System\DIrLzHd.exe
  C:\Windows\System\DIrLzHd.exe
  2⤵
  PID:10808
- C:\Windows\System\aHdykgB.exe
  C:\Windows\System\aHdykgB.exe
  2⤵
  PID:10828
- C:\Windows\System\WrcnnDQ.exe
  C:\Windows\System\WrcnnDQ.exe
  2⤵
  PID:10852
- C:\Windows\System\PXJgggf.exe
  C:\Windows\System\PXJgggf.exe
  2⤵
  PID:10872
- C:\Windows\System\EAJDZyF.exe
  C:\Windows\System\EAJDZyF.exe
  2⤵
  PID:10892
- C:\Windows\System\weAOVvQ.exe
  C:\Windows\System\weAOVvQ.exe
  2⤵
  PID:10912
- C:\Windows\System\TnndNXh.exe
  C:\Windows\System\TnndNXh.exe
  2⤵
  PID:10932
- C:\Windows\System\NBxcEgC.exe
  C:\Windows\System\NBxcEgC.exe
  2⤵
  PID:10956
- C:\Windows\System\VeCOvYf.exe
  C:\Windows\System\VeCOvYf.exe
  2⤵
  PID:10976
- C:\Windows\System\smBJxEf.exe
  C:\Windows\System\smBJxEf.exe
  2⤵
  PID:10996
- C:\Windows\System\IYMSwNU.exe
  C:\Windows\System\IYMSwNU.exe
  2⤵
  PID:11016
- C:\Windows\System\iUIRogN.exe
  C:\Windows\System\iUIRogN.exe
  2⤵
  PID:11036
- C:\Windows\System\iaEFLUk.exe
  C:\Windows\System\iaEFLUk.exe
  2⤵
  PID:11060
- C:\Windows\System\bKZJJoh.exe
  C:\Windows\System\bKZJJoh.exe
  2⤵
  PID:11084
- C:\Windows\System\CVJEtkO.exe
  C:\Windows\System\CVJEtkO.exe
  2⤵
  PID:11104
- C:\Windows\System\EjJirlg.exe
  C:\Windows\System\EjJirlg.exe
  2⤵
  PID:11128
- C:\Windows\System\ZODYVsG.exe
  C:\Windows\System\ZODYVsG.exe
  2⤵
  PID:11148
- C:\Windows\System\CDxaxqq.exe
  C:\Windows\System\CDxaxqq.exe
  2⤵
  PID:11180
- C:\Windows\System\XjYghId.exe
  C:\Windows\System\XjYghId.exe
  2⤵
  PID:11204
- C:\Windows\System\MWYBoLK.exe
  C:\Windows\System\MWYBoLK.exe
  2⤵
  PID:11232
- C:\Windows\System\JddDqCW.exe
  C:\Windows\System\JddDqCW.exe
  2⤵
  PID:11260
- C:\Windows\System\mnkzaaT.exe
  C:\Windows\System\mnkzaaT.exe
  2⤵
  PID:10040
- C:\Windows\System\OcCRDdH.exe
  C:\Windows\System\OcCRDdH.exe
  2⤵
  PID:9876
- C:\Windows\System\mvMykqH.exe
  C:\Windows\System\mvMykqH.exe
  2⤵
  PID:1432
- C:\Windows\System\LEoJlHz.exe
  C:\Windows\System\LEoJlHz.exe
  2⤵
  PID:7156
- C:\Windows\System\IBkOUEk.exe
  C:\Windows\System\IBkOUEk.exe
  2⤵
  PID:6644
- C:\Windows\System\jdYSNHE.exe
  C:\Windows\System\jdYSNHE.exe
  2⤵
  PID:9660
- C:\Windows\System\NPvlWXV.exe
  C:\Windows\System\NPvlWXV.exe
  2⤵
  PID:11292
- C:\Windows\System\IanJxpM.exe
  C:\Windows\System\IanJxpM.exe
  2⤵
  PID:11328
- C:\Windows\System\KLcholv.exe
  C:\Windows\System\KLcholv.exe
  2⤵
  PID:11352
- C:\Windows\System\OUsNacR.exe
  C:\Windows\System\OUsNacR.exe
  2⤵
  PID:11380
- C:\Windows\System\kzXTbVi.exe
  C:\Windows\System\kzXTbVi.exe
  2⤵
  PID:11400
- C:\Windows\System\amGRxWG.exe
  C:\Windows\System\amGRxWG.exe
  2⤵
  PID:11424
- C:\Windows\System\yIjAnCB.exe
  C:\Windows\System\yIjAnCB.exe
  2⤵
  PID:11448
- C:\Windows\System\LEZsiLK.exe
  C:\Windows\System\LEZsiLK.exe
  2⤵
  PID:11476
- C:\Windows\System\rFDXlTT.exe
  C:\Windows\System\rFDXlTT.exe
  2⤵
  PID:11500
- C:\Windows\System\vkGrNlP.exe
  C:\Windows\System\vkGrNlP.exe
  2⤵
  PID:11520
- C:\Windows\System\BxiGtqM.exe
  C:\Windows\System\BxiGtqM.exe
  2⤵
  PID:11540
- C:\Windows\System\QGsaYam.exe
  C:\Windows\System\QGsaYam.exe
  2⤵
  PID:11564
- C:\Windows\System\gZAbLtj.exe
  C:\Windows\System\gZAbLtj.exe
  2⤵
  PID:11580
- C:\Windows\System\HJixNQo.exe
  C:\Windows\System\HJixNQo.exe
  2⤵
  PID:11604
- C:\Windows\System\jXSBzsa.exe
  C:\Windows\System\jXSBzsa.exe
  2⤵
  PID:11628
- C:\Windows\System\mtJAfse.exe
  C:\Windows\System\mtJAfse.exe
  2⤵
  PID:11652
- C:\Windows\System\IKsgrMB.exe
  C:\Windows\System\IKsgrMB.exe
  2⤵
  PID:11676
- C:\Windows\System\RThJdPa.exe
  C:\Windows\System\RThJdPa.exe
  2⤵
  PID:11700
- C:\Windows\System\TunUlDH.exe
  C:\Windows\System\TunUlDH.exe
  2⤵
  PID:11724
- C:\Windows\System\vbAvIPc.exe
  C:\Windows\System\vbAvIPc.exe
  2⤵
  PID:11740
- C:\Windows\System\LfqDdlz.exe
  C:\Windows\System\LfqDdlz.exe
  2⤵
  PID:11756
- C:\Windows\System\DyeuMyD.exe
  C:\Windows\System\DyeuMyD.exe
  2⤵
  PID:11776
- C:\Windows\System\lEWZiud.exe
  C:\Windows\System\lEWZiud.exe
  2⤵
  PID:11796
- C:\Windows\System\lLIwyZm.exe
  C:\Windows\System\lLIwyZm.exe
  2⤵
  PID:11816
- C:\Windows\System\knudbEv.exe
  C:\Windows\System\knudbEv.exe
  2⤵
  PID:11836
- C:\Windows\System\dICuUxz.exe
  C:\Windows\System\dICuUxz.exe
  2⤵
  PID:11864
- C:\Windows\System\CCRxLrK.exe
  C:\Windows\System\CCRxLrK.exe
  2⤵
  PID:11900
- C:\Windows\System\gujKMsC.exe
  C:\Windows\System\gujKMsC.exe
  2⤵
  PID:11920
- C:\Windows\System\zYsCnBl.exe
  C:\Windows\System\zYsCnBl.exe
  2⤵
  PID:11936
- C:\Windows\System\LojkPiG.exe
  C:\Windows\System\LojkPiG.exe
  2⤵
  PID:11960
- C:\Windows\System\ynSnTfU.exe
  C:\Windows\System\ynSnTfU.exe
  2⤵
  PID:11980
- C:\Windows\System\QEivIqm.exe
  C:\Windows\System\QEivIqm.exe
  2⤵
  PID:12008
- C:\Windows\System\kZdiNVA.exe
  C:\Windows\System\kZdiNVA.exe
  2⤵
  PID:12024
- C:\Windows\System\QZIqTCW.exe
  C:\Windows\System\QZIqTCW.exe
  2⤵
  PID:12040
- C:\Windows\System\pOWWSth.exe
  C:\Windows\System\pOWWSth.exe
  2⤵
  PID:12056
- C:\Windows\System\OHwdnwI.exe
  C:\Windows\System\OHwdnwI.exe
  2⤵
  PID:12076
- C:\Windows\System\QLAjRcO.exe
  C:\Windows\System\QLAjRcO.exe
  2⤵
  PID:12092
- C:\Windows\System\BAPHnWJ.exe
  C:\Windows\System\BAPHnWJ.exe
  2⤵
  PID:12108
- C:\Windows\System\KWsJkcw.exe
  C:\Windows\System\KWsJkcw.exe
  2⤵
  PID:12124
- C:\Windows\System\IJYyYLl.exe
  C:\Windows\System\IJYyYLl.exe
  2⤵
  PID:12140
- C:\Windows\System\atVhJIA.exe
  C:\Windows\System\atVhJIA.exe
  2⤵
  PID:12156
- C:\Windows\System\EebirtI.exe
  C:\Windows\System\EebirtI.exe
  2⤵
  PID:12176
- C:\Windows\System\VSgjIxY.exe
  C:\Windows\System\VSgjIxY.exe
  2⤵
  PID:12200
- C:\Windows\System\ixyCnkd.exe
  C:\Windows\System\ixyCnkd.exe
  2⤵
  PID:12220
- C:\Windows\System\DKQcmNd.exe
  C:\Windows\System\DKQcmNd.exe
  2⤵
  PID:12240
- C:\Windows\System\XoVllMf.exe
  C:\Windows\System\XoVllMf.exe
  2⤵
  PID:12264
- C:\Windows\System\lMlAAjU.exe
  C:\Windows\System\lMlAAjU.exe
  2⤵
  PID:10316
- C:\Windows\System\QKGPFuQ.exe
  C:\Windows\System\QKGPFuQ.exe
  2⤵
  PID:9776
- C:\Windows\System\HiMBZdS.exe
  C:\Windows\System\HiMBZdS.exe
  2⤵
  PID:10404
- C:\Windows\System\eMjFvgI.exe
  C:\Windows\System\eMjFvgI.exe
  2⤵
  PID:10440
- C:\Windows\System\fESrdEx.exe
  C:\Windows\System\fESrdEx.exe
  2⤵
  PID:10516
- C:\Windows\System\iNDHeMO.exe
  C:\Windows\System\iNDHeMO.exe
  2⤵
  PID:10540
- C:\Windows\System\FIXUyHH.exe
  C:\Windows\System\FIXUyHH.exe
  2⤵
  PID:10684
- C:\Windows\System\UqZpdDl.exe
  C:\Windows\System\UqZpdDl.exe
  2⤵
  PID:10740
- C:\Windows\System\kpLhvzZ.exe
  C:\Windows\System\kpLhvzZ.exe
  2⤵
  PID:10768
- C:\Windows\System\kNEoljD.exe
  C:\Windows\System\kNEoljD.exe
  2⤵
  PID:10848
- C:\Windows\System\WZrnXgj.exe
  C:\Windows\System\WZrnXgj.exe
  2⤵
  PID:10908
- C:\Windows\System\YMrOnzO.exe
  C:\Windows\System\YMrOnzO.exe
  2⤵
  PID:10972
- C:\Windows\System\qGAHNKj.exe
  C:\Windows\System\qGAHNKj.exe
  2⤵
  PID:11028
- C:\Windows\System\sxYJhGk.exe
  C:\Windows\System\sxYJhGk.exe
  2⤵
  PID:11096
- C:\Windows\System\CMamRde.exe
  C:\Windows\System\CMamRde.exe
  2⤵
  PID:5788
- C:\Windows\System\HgyWJPe.exe
  C:\Windows\System\HgyWJPe.exe
  2⤵
  PID:11248
- C:\Windows\System\fPEieuq.exe
  C:\Windows\System\fPEieuq.exe
  2⤵
  PID:5188
- C:\Windows\System\xSemIey.exe
  C:\Windows\System\xSemIey.exe
  2⤵
  PID:11308
- C:\Windows\System\TeNfpQV.exe
  C:\Windows\System\TeNfpQV.exe
  2⤵
  PID:11360
- C:\Windows\System\JijfZMG.exe
  C:\Windows\System\JijfZMG.exe
  2⤵
  PID:11376
- C:\Windows\System\CRCvpAS.exe
  C:\Windows\System\CRCvpAS.exe
  2⤵
  PID:9588
- C:\Windows\System\IWaGawR.exe
  C:\Windows\System\IWaGawR.exe
  2⤵
  PID:9472
- C:\Windows\System\agsYZwc.exe
  C:\Windows\System\agsYZwc.exe
  2⤵
  PID:9384
- C:\Windows\System\oZNllNq.exe
  C:\Windows\System\oZNllNq.exe
  2⤵
  PID:12296
- C:\Windows\System\zvioliO.exe
  C:\Windows\System\zvioliO.exe
  2⤵
  PID:12312
- C:\Windows\System\EQceXvS.exe
  C:\Windows\System\EQceXvS.exe
  2⤵
  PID:12344
- C:\Windows\System\hggJZZe.exe
  C:\Windows\System\hggJZZe.exe
  2⤵
  PID:12368
- C:\Windows\System\XEOoXWJ.exe
  C:\Windows\System\XEOoXWJ.exe
  2⤵
  PID:12396
- C:\Windows\System\bxpeWMz.exe
  C:\Windows\System\bxpeWMz.exe
  2⤵
  PID:12416
- C:\Windows\System\QkhPXTm.exe
  C:\Windows\System\QkhPXTm.exe
  2⤵
  PID:12444
- C:\Windows\System\OYlJytt.exe
  C:\Windows\System\OYlJytt.exe
  2⤵
  PID:12472
- C:\Windows\System\EEeOKOB.exe
  C:\Windows\System\EEeOKOB.exe
  2⤵
  PID:12496
- C:\Windows\System\zfQXvSa.exe
  C:\Windows\System\zfQXvSa.exe
  2⤵
  PID:12516
- C:\Windows\System\HeEdmqS.exe
  C:\Windows\System\HeEdmqS.exe
  2⤵
  PID:12544
- C:\Windows\System\cbDctWC.exe
  C:\Windows\System\cbDctWC.exe
  2⤵
  PID:12568
- C:\Windows\System\eWgasTT.exe
  C:\Windows\System\eWgasTT.exe
  2⤵
  PID:12588
- C:\Windows\System\ZEZwEVx.exe
  C:\Windows\System\ZEZwEVx.exe
  2⤵
  PID:12604
- C:\Windows\System\pBSTpRt.exe
  C:\Windows\System\pBSTpRt.exe
  2⤵
  PID:12620
- C:\Windows\System\JNgSGAW.exe
  C:\Windows\System\JNgSGAW.exe
  2⤵
  PID:12640
- C:\Windows\System\fNAaesy.exe
  C:\Windows\System\fNAaesy.exe
  2⤵
  PID:12660
- C:\Windows\System\cDgoHft.exe
  C:\Windows\System\cDgoHft.exe
  2⤵
  PID:12688
- C:\Windows\System\NfHyHzW.exe
  C:\Windows\System\NfHyHzW.exe
  2⤵
  PID:12708
- C:\Windows\System\woyhCiC.exe
  C:\Windows\System\woyhCiC.exe
  2⤵
  PID:12728
- C:\Windows\System\DVFICBa.exe
  C:\Windows\System\DVFICBa.exe
  2⤵
  PID:12752
- C:\Windows\System\KFAsAOe.exe
  C:\Windows\System\KFAsAOe.exe
  2⤵
  PID:12772
- C:\Windows\System\vqFqEpO.exe
  C:\Windows\System\vqFqEpO.exe
  2⤵
  PID:12792
- C:\Windows\System\jPIFBHD.exe
  C:\Windows\System\jPIFBHD.exe
  2⤵
  PID:12816
- C:\Windows\System\ixSqXQn.exe
  C:\Windows\System\ixSqXQn.exe
  2⤵
  PID:12832
- C:\Windows\System\ZfEWWos.exe
  C:\Windows\System\ZfEWWos.exe
  2⤵
  PID:12856
- C:\Windows\System\fhnHiSJ.exe
  C:\Windows\System\fhnHiSJ.exe
  2⤵
  PID:12876
- C:\Windows\System\eGCztxI.exe
  C:\Windows\System\eGCztxI.exe
  2⤵
  PID:12900
- C:\Windows\System\eJAFVmQ.exe
  C:\Windows\System\eJAFVmQ.exe
  2⤵
  PID:12924
- C:\Windows\System\rkkhdtq.exe
  C:\Windows\System\rkkhdtq.exe
  2⤵
  PID:12948
- C:\Windows\System\XNCrnSN.exe
  C:\Windows\System\XNCrnSN.exe
  2⤵
  PID:12972
- C:\Windows\System\sblZpBE.exe
  C:\Windows\System\sblZpBE.exe
  2⤵
  PID:12992
- C:\Windows\System\vxlCEWh.exe
  C:\Windows\System\vxlCEWh.exe
  2⤵
  PID:13012
- C:\Windows\System\JuCxopW.exe
  C:\Windows\System\JuCxopW.exe
  2⤵
  PID:13032
- C:\Windows\System\NUkHyKg.exe
  C:\Windows\System\NUkHyKg.exe
  2⤵
  PID:13052
- C:\Windows\System\yVPMJkg.exe
  C:\Windows\System\yVPMJkg.exe
  2⤵
  PID:13072
- C:\Windows\System\jdgGpRJ.exe
  C:\Windows\System\jdgGpRJ.exe
  2⤵
  PID:13088
- C:\Windows\System\vNFfevf.exe
  C:\Windows\System\vNFfevf.exe
  2⤵
  PID:13108
- C:\Windows\System\CyKTwpw.exe
  C:\Windows\System\CyKTwpw.exe
  2⤵
  PID:13132
- C:\Windows\System\kzSRZIh.exe
  C:\Windows\System\kzSRZIh.exe
  2⤵
  PID:13152
- C:\Windows\System\mdirVEW.exe
  C:\Windows\System\mdirVEW.exe
  2⤵
  PID:13180
- C:\Windows\System\gmZpnIb.exe
  C:\Windows\System\gmZpnIb.exe
  2⤵
  PID:13204
- C:\Windows\System\WrRYjhJ.exe
  C:\Windows\System\WrRYjhJ.exe
  2⤵
  PID:13232
- C:\Windows\System\YKVZsfa.exe
  C:\Windows\System\YKVZsfa.exe
  2⤵
  PID:13260
- C:\Windows\System\hvVfMJa.exe
  C:\Windows\System\hvVfMJa.exe
  2⤵
  PID:13280
- C:\Windows\System\KoQorMS.exe
  C:\Windows\System\KoQorMS.exe
  2⤵
  PID:13300
- C:\Windows\System\HPWdGnF.exe
  C:\Windows\System\HPWdGnF.exe
  2⤵
  PID:11512
- C:\Windows\System\YtYomgK.exe
  C:\Windows\System\YtYomgK.exe
  2⤵
  PID:11588
- C:\Windows\System\XhqRJFw.exe
  C:\Windows\System\XhqRJFw.exe
  2⤵
  PID:11644
- C:\Windows\System\QQMIKCx.exe
  C:\Windows\System\QQMIKCx.exe
  2⤵
  PID:11748
- C:\Windows\System\XPosuYq.exe
  C:\Windows\System\XPosuYq.exe
  2⤵
  PID:9264
- C:\Windows\System\PDoAWwM.exe
  C:\Windows\System\PDoAWwM.exe
  2⤵
  PID:8584
- C:\Windows\System\yrhCNGP.exe
  C:\Windows\System\yrhCNGP.exe
  2⤵
  PID:10400
- C:\Windows\System\XjGqvtX.exe
  C:\Windows\System\XjGqvtX.exe
  2⤵
  PID:11872
- C:\Windows\System\DgpEeUh.exe
  C:\Windows\System\DgpEeUh.exe
  2⤵
  PID:10460
- C:\Windows\System\itgrLvP.exe
  C:\Windows\System\itgrLvP.exe
  2⤵
  PID:10548
- C:\Windows\System\weuKoje.exe
  C:\Windows\System\weuKoje.exe
  2⤵
  PID:11968
- C:\Windows\System\Btsvxtd.exe
  C:\Windows\System\Btsvxtd.exe
  2⤵
  PID:11992
- C:\Windows\System\VaDPsaz.exe
  C:\Windows\System\VaDPsaz.exe
  2⤵
  PID:12004
- C:\Windows\System\RCJDCBp.exe
  C:\Windows\System\RCJDCBp.exe
  2⤵
  PID:10632
- C:\Windows\System\YxGCbRp.exe
  C:\Windows\System\YxGCbRp.exe
  2⤵
  PID:10780
- C:\Windows\System\qEhswSo.exe
  C:\Windows\System\qEhswSo.exe
  2⤵
  PID:12100
- C:\Windows\System\HCpJxAs.exe
  C:\Windows\System\HCpJxAs.exe
  2⤵
  PID:12152
- C:\Windows\System\zsQDiHb.exe
  C:\Windows\System\zsQDiHb.exe
  2⤵
  PID:12164
- C:\Windows\System\bhuTwhm.exe
  C:\Windows\System\bhuTwhm.exe
  2⤵
  PID:12188
- C:\Windows\System\TjUYUFg.exe
  C:\Windows\System\TjUYUFg.exe
  2⤵
  PID:12228
- C:\Windows\System\BkaBGYb.exe
  C:\Windows\System\BkaBGYb.exe
  2⤵
  PID:12260
- C:\Windows\System\vJGCgQU.exe
  C:\Windows\System\vJGCgQU.exe
  2⤵
  PID:12276
- C:\Windows\System\FClGWik.exe
  C:\Windows\System\FClGWik.exe
  2⤵
  PID:9612
- C:\Windows\System\ZfNZJPy.exe
  C:\Windows\System\ZfNZJPy.exe
  2⤵
  PID:10432
- C:\Windows\System\UYQvyUJ.exe
  C:\Windows\System\UYQvyUJ.exe
  2⤵
  PID:10680
- C:\Windows\System\yXRddDs.exe
  C:\Windows\System\yXRddDs.exe
  2⤵
  PID:10804
- C:\Windows\System\hiodNEm.exe
  C:\Windows\System\hiodNEm.exe
  2⤵
  PID:10868
- C:\Windows\System\SrJaeeT.exe
  C:\Windows\System\SrJaeeT.exe
  2⤵
  PID:11012
- C:\Windows\System\bcmUKzg.exe
  C:\Windows\System\bcmUKzg.exe
  2⤵
  PID:11048
- C:\Windows\System\SCHPSsn.exe
  C:\Windows\System\SCHPSsn.exe
  2⤵
  PID:10308
- C:\Windows\System\TgGtTKt.exe
  C:\Windows\System\TgGtTKt.exe
  2⤵
  PID:9684
- C:\Windows\System\PRkSuwb.exe
  C:\Windows\System\PRkSuwb.exe
  2⤵
  PID:11416
- C:\Windows\System\YcffQbr.exe
  C:\Windows\System\YcffQbr.exe
  2⤵
  PID:12424
- C:\Windows\System\qyVqweT.exe
  C:\Windows\System\qyVqweT.exe
  2⤵
  PID:12484
- C:\Windows\System\yubNSrl.exe
  C:\Windows\System\yubNSrl.exe
  2⤵
  PID:11536
- C:\Windows\System\OxJsQze.exe
  C:\Windows\System\OxJsQze.exe
  2⤵
  PID:12584
- C:\Windows\System\wTwlofc.exe
  C:\Windows\System\wTwlofc.exe
  2⤵
  PID:11692
- C:\Windows\System\QKAvzVw.exe
  C:\Windows\System\QKAvzVw.exe
  2⤵
  PID:11768
- C:\Windows\System\YGBaMLK.exe
  C:\Windows\System\YGBaMLK.exe
  2⤵
  PID:13332
- C:\Windows\System\fZBvSRC.exe
  C:\Windows\System\fZBvSRC.exe
  2⤵
  PID:13356
- C:\Windows\System\qEohWgT.exe
  C:\Windows\System\qEohWgT.exe
  2⤵
  PID:13376
- C:\Windows\System\GqkRDcW.exe
  C:\Windows\System\GqkRDcW.exe
  2⤵
  PID:13404
- C:\Windows\System\RRbQxWg.exe
  C:\Windows\System\RRbQxWg.exe
  2⤵
  PID:13424
- C:\Windows\System\yjhtZSa.exe
  C:\Windows\System\yjhtZSa.exe
  2⤵
  PID:13456
- C:\Windows\System\IVcIssv.exe
  C:\Windows\System\IVcIssv.exe
  2⤵
  PID:13480
- C:\Windows\System\xOZKLGY.exe
  C:\Windows\System\xOZKLGY.exe
  2⤵
  PID:13500
- C:\Windows\System\awvVFFE.exe
  C:\Windows\System\awvVFFE.exe
  2⤵
  PID:13524
- C:\Windows\System\tIdngeK.exe
  C:\Windows\System\tIdngeK.exe
  2⤵
  PID:13548
- C:\Windows\System\QemxVEy.exe
  C:\Windows\System\QemxVEy.exe
  2⤵
  PID:13568
- C:\Windows\System\KjlYRko.exe
  C:\Windows\System\KjlYRko.exe
  2⤵
  PID:13592
- C:\Windows\System\GlVgdOp.exe
  C:\Windows\System\GlVgdOp.exe
  2⤵
  PID:13616
- C:\Windows\System\uWACKFM.exe
  C:\Windows\System\uWACKFM.exe
  2⤵
  PID:13640
- C:\Windows\System\wiIIheY.exe
  C:\Windows\System\wiIIheY.exe
  2⤵
  PID:13664
- C:\Windows\System\LPOmDtQ.exe
  C:\Windows\System\LPOmDtQ.exe
  2⤵
  PID:13688
- C:\Windows\System\xVxLxgz.exe
  C:\Windows\System\xVxLxgz.exe
  2⤵
  PID:13712
- C:\Windows\System\pGkWmau.exe
  C:\Windows\System\pGkWmau.exe
  2⤵
  PID:13736
- C:\Windows\System\KpDiwWc.exe
  C:\Windows\System\KpDiwWc.exe
  2⤵
  PID:13760
- C:\Windows\System\kxcLRpI.exe
  C:\Windows\System\kxcLRpI.exe
  2⤵
  PID:13784
- C:\Windows\System\dsIcArZ.exe
  C:\Windows\System\dsIcArZ.exe
  2⤵
  PID:13804
- C:\Windows\System\CwQzsHL.exe
  C:\Windows\System\CwQzsHL.exe
  2⤵
  PID:13824
- C:\Windows\System\DQTrlbj.exe
  C:\Windows\System\DQTrlbj.exe
  2⤵
  PID:13848
- C:\Windows\System\ykkDSVL.exe
  C:\Windows\System\ykkDSVL.exe
  2⤵
  PID:13872
- C:\Windows\System\HuDWKpN.exe
  C:\Windows\System\HuDWKpN.exe
  2⤵
  PID:13896
- C:\Windows\System\XiwwchC.exe
  C:\Windows\System\XiwwchC.exe
  2⤵
  PID:13920
- C:\Windows\System\cQrrNLY.exe
  C:\Windows\System\cQrrNLY.exe
  2⤵
  PID:13948
- C:\Windows\System\ivJQWKk.exe
  C:\Windows\System\ivJQWKk.exe
  2⤵
  PID:13972
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13972 -s 220
    3⤵
    PID:13160
- C:\Windows\System\XBYvzIm.exe
  C:\Windows\System\XBYvzIm.exe
  2⤵
  PID:14000
- C:\Windows\System\rLJpZDL.exe
  C:\Windows\System\rLJpZDL.exe
  2⤵
  PID:14016
- C:\Windows\System\lKcmoQW.exe
  C:\Windows\System\lKcmoQW.exe
  2⤵
  PID:14036
- C:\Windows\System\qmagvRE.exe
  C:\Windows\System\qmagvRE.exe
  2⤵
  PID:14060
- C:\Windows\System\OCewnoC.exe
  C:\Windows\System\OCewnoC.exe
  2⤵
  PID:14084
- C:\Windows\System\EvZTfsr.exe
  C:\Windows\System\EvZTfsr.exe
  2⤵
  PID:14108
- C:\Windows\System\LSTfRrl.exe
  C:\Windows\System\LSTfRrl.exe
  2⤵
  PID:14136
- C:\Windows\System\gyqKOmN.exe
  C:\Windows\System\gyqKOmN.exe
  2⤵
  PID:14160
- C:\Windows\System\FuElOTk.exe
  C:\Windows\System\FuElOTk.exe
  2⤵
  PID:14180
- C:\Windows\System\WDflcbh.exe
  C:\Windows\System\WDflcbh.exe
  2⤵
  PID:14200
- C:\Windows\System\crMdJZh.exe
  C:\Windows\System\crMdJZh.exe
  2⤵
  PID:14228
- C:\Windows\System\Idiatdk.exe
  C:\Windows\System\Idiatdk.exe
  2⤵
  PID:14248
- C:\Windows\System\VtdaQwu.exe
  C:\Windows\System\VtdaQwu.exe
  2⤵
  PID:14272
- C:\Windows\System\yNHkplu.exe
  C:\Windows\System\yNHkplu.exe
  2⤵
  PID:14300
- C:\Windows\System\ewVYzbf.exe
  C:\Windows\System\ewVYzbf.exe
  2⤵
  PID:14316
- C:\Windows\System\fhUbpvE.exe
  C:\Windows\System\fhUbpvE.exe
  2⤵
  PID:11772
- C:\Windows\System\eMYVagO.exe
  C:\Windows\System\eMYVagO.exe
  2⤵
  PID:12784
- C:\Windows\System\trmCstX.exe
  C:\Windows\System\trmCstX.exe
  2⤵
  PID:12848
- C:\Windows\System\XkbAwQC.exe
  C:\Windows\System\XkbAwQC.exe
  2⤵
  PID:12908
- C:\Windows\System\KwmSamq.exe
  C:\Windows\System\KwmSamq.exe
  2⤵
  PID:12020
- C:\Windows\System\HjwCSTB.exe
  C:\Windows\System\HjwCSTB.exe
  2⤵
  PID:10836
- C:\Windows\System\TjuYaNl.exe
  C:\Windows\System\TjuYaNl.exe
  2⤵
  PID:13020
- C:\Windows\System\BKoyjdw.exe
  C:\Windows\System\BKoyjdw.exe
  2⤵
  PID:11072
- C:\Windows\System\lvYdprV.exe
  C:\Windows\System\lvYdprV.exe
  2⤵
  PID:13296
- C:\Windows\System\iurkcmH.exe
  C:\Windows\System\iurkcmH.exe
  2⤵
  PID:6844
- C:\Windows\System\fjeCzpS.exe
  C:\Windows\System\fjeCzpS.exe
  2⤵
  PID:10520
- C:\Windows\System\RNcTLRr.exe
  C:\Windows\System\RNcTLRr.exe
  2⤵
  PID:10700
- C:\Windows\System\QzFBlVT.exe
  C:\Windows\System\QzFBlVT.exe
  2⤵
  PID:14344
- C:\Windows\System\uzDEHrN.exe
  C:\Windows\System\uzDEHrN.exe
  2⤵
  PID:14360
- C:\Windows\System\WAgIWTx.exe
  C:\Windows\System\WAgIWTx.exe
  2⤵
  PID:14376
- C:\Windows\System\ASQdOlb.exe
  C:\Windows\System\ASQdOlb.exe
  2⤵
  PID:14392
- C:\Windows\System\pYezPJR.exe
  C:\Windows\System\pYezPJR.exe
  2⤵
  PID:14408
- C:\Windows\System\LZMcCxc.exe
  C:\Windows\System\LZMcCxc.exe
  2⤵
  PID:14424
- C:\Windows\System\WIOOWqV.exe
  C:\Windows\System\WIOOWqV.exe
  2⤵
  PID:14440
- C:\Windows\System\VPaFiOs.exe
  C:\Windows\System\VPaFiOs.exe
  2⤵
  PID:14456
- C:\Windows\System\pTrdEHy.exe
  C:\Windows\System\pTrdEHy.exe
  2⤵
  PID:14476
- C:\Windows\System\kLTmiQM.exe
  C:\Windows\System\kLTmiQM.exe
  2⤵
  PID:14492
- C:\Windows\System\ZUzEAhO.exe
  C:\Windows\System\ZUzEAhO.exe
  2⤵
  PID:14516
- C:\Windows\System\mtBHnuX.exe
  C:\Windows\System\mtBHnuX.exe
  2⤵
  PID:14540
- C:\Windows\System\rdveKTf.exe
  C:\Windows\System\rdveKTf.exe
  2⤵
  PID:14564
- C:\Windows\System\peOsSoR.exe
  C:\Windows\System\peOsSoR.exe
  2⤵
  PID:14588
- C:\Windows\System\xjCKUfu.exe
  C:\Windows\System\xjCKUfu.exe
  2⤵
  PID:14604
- C:\Windows\System\EatrzLC.exe
  C:\Windows\System\EatrzLC.exe
  2⤵
  PID:14624
- C:\Windows\System\swZFQbf.exe
  C:\Windows\System\swZFQbf.exe
  2⤵
  PID:14648
- C:\Windows\System\VANtJJC.exe
  C:\Windows\System\VANtJJC.exe
  2⤵
  PID:14668
- C:\Windows\System\qyGnPjH.exe
  C:\Windows\System\qyGnPjH.exe
  2⤵
  PID:11640
- C:\Windows\System\mUYxYEi.exe
  C:\Windows\System\mUYxYEi.exe
  2⤵
  PID:11596
- C:\Windows\System\rTKnPsp.exe
  C:\Windows\System\rTKnPsp.exe
  2⤵
  PID:13420
- C:\Windows\System\twGLRuV.exe
  C:\Windows\System\twGLRuV.exe
  2⤵
  PID:13128
- C:\Windows\System\kxQlnHR.exe
  C:\Windows\System\kxQlnHR.exe
  2⤵
  PID:10340
- C:\Windows\System\qjjllEU.exe
  C:\Windows\System\qjjllEU.exe
  2⤵
  PID:10356
- C:\Windows\System\qhduzcE.exe
  C:\Windows\System\qhduzcE.exe
  2⤵
  PID:11736
- C:\Windows\System\XuFmfjH.exe
  C:\Windows\System\XuFmfjH.exe
  2⤵
  PID:10416
- C:\Windows\System\zmzZBVE.exe
  C:\Windows\System\zmzZBVE.exe
  2⤵
  PID:10580
- C:\Windows\System\hhqeaoa.exe
  C:\Windows\System\hhqeaoa.exe
  2⤵
  PID:14656
- C:\Windows\System\rrvrfAE.exe
  C:\Windows\System\rrvrfAE.exe
  2⤵
  PID:11140
- C:\Windows\System\ALtYkrl.exe
  C:\Windows\System\ALtYkrl.exe
  2⤵
  PID:10992
- C:\Windows\System\DIDsAwL.exe
  C:\Windows\System\DIDsAwL.exe
  2⤵
  PID:11492
- C:\Windows\System\BwXTJPK.exe
  C:\Windows\System\BwXTJPK.exe
  2⤵
  PID:11720
- C:\Windows\System\bgJfdhf.exe
  C:\Windows\System\bgJfdhf.exe
  2⤵
  PID:13368
- C:\Windows\System\cMajrHS.exe
  C:\Windows\System\cMajrHS.exe
  2⤵
  PID:13508
- C:\Windows\System\LfNPvdf.exe
  C:\Windows\System\LfNPvdf.exe
  2⤵
  PID:13608
- C:\Windows\System\NqBoeAx.exe
  C:\Windows\System\NqBoeAx.exe
  2⤵
  PID:13696
- C:\Windows\System\lZulEGh.exe
  C:\Windows\System\lZulEGh.exe
  2⤵
  PID:13780
- C:\Windows\System\EuUHNoh.exe
  C:\Windows\System\EuUHNoh.exe
  2⤵
  PID:13856
- C:\Windows\System\JtgJQfF.exe
  C:\Windows\System\JtgJQfF.exe
  2⤵
  PID:15128
- C:\Windows\System\wNuutNn.exe
  C:\Windows\System\wNuutNn.exe
  2⤵
  PID:15220
- C:\Windows\System\pFvQuHx.exe
  C:\Windows\System\pFvQuHx.exe
  2⤵
  PID:11732
- C:\Windows\System\OctFknK.exe
  C:\Windows\System\OctFknK.exe
  2⤵
  PID:14356
- C:\Windows\System\lKLjAZI.exe
  C:\Windows\System\lKLjAZI.exe
  2⤵
  PID:10704
- C:\Windows\System\XsjppTl.exe
  C:\Windows\System\XsjppTl.exe
  2⤵
  PID:12612
- C:\Windows\System\fqMkrWX.exe
  C:\Windows\System\fqMkrWX.exe
  2⤵
  PID:12932
- C:\Windows\System\xBAuQEC.exe
  C:\Windows\System\xBAuQEC.exe
  2⤵
  PID:13060
- C:\Windows\System\BbadZoy.exe
  C:\Windows\System\BbadZoy.exe
  2⤵
  PID:14288
- C:\Windows\System\VKdGLCc.exe
  C:\Windows\System\VKdGLCc.exe
  2⤵
  PID:14264
- C:\Windows\System\hefvtyc.exe
  C:\Windows\System\hefvtyc.exe
  2⤵
  PID:14452
- C:\Windows\System\adMPUhP.exe
  C:\Windows\System\adMPUhP.exe
  2⤵
  PID:10900
- C:\Windows\System\RaQhoJI.exe
  C:\Windows\System\RaQhoJI.exe
  2⤵
  PID:15316
- C:\Windows\System\DtnMULH.exe
  C:\Windows\System\DtnMULH.exe
  2⤵
  PID:13964
- C:\Windows\System\AlhXNKN.exe
  C:\Windows\System\AlhXNKN.exe
  2⤵
  PID:14032
- C:\Windows\System\hPmaMgS.exe
  C:\Windows\System\hPmaMgS.exe
  2⤵
  PID:15076
- C:\Windows\System\KxlgDWN.exe
  C:\Windows\System\KxlgDWN.exe
  2⤵
  PID:13196
- C:\Windows\System\Ewhubts.exe
  C:\Windows\System\Ewhubts.exe
  2⤵
  PID:13104
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13104 -s 248
    3⤵
    PID:13752
- C:\Windows\System\xhQEdpY.exe
  C:\Windows\System\xhQEdpY.exe
  2⤵
  PID:12940
- C:\Windows\System\xrcyzFV.exe
  C:\Windows\System\xrcyzFV.exe
  2⤵
  PID:13028
- C:\Windows\System\kxKIsKJ.exe
  C:\Windows\System\kxKIsKJ.exe
  2⤵
  PID:10556
- C:\Windows\System\xEHyMmw.exe
  C:\Windows\System\xEHyMmw.exe
  2⤵
  PID:10724
- C:\Windows\System\mfoucwH.exe
  C:\Windows\System\mfoucwH.exe
  2⤵
  PID:14504
- C:\Windows\System\kgqXDwE.exe
  C:\Windows\System\kgqXDwE.exe
  2⤵
  PID:15200
- C:\Windows\System\bANxmVx.exe
  C:\Windows\System\bANxmVx.exe
  2⤵
  PID:13648
- C:\Windows\System\hlxcBbi.exe
  C:\Windows\System\hlxcBbi.exe
  2⤵
  PID:15328
- C:\Windows\System\TzfVNeQ.exe
  C:\Windows\System\TzfVNeQ.exe
  2⤵
  PID:14152
- C:\Windows\System\kFnrFoQ.exe
  C:\Windows\System\kFnrFoQ.exe
  2⤵
  PID:15280
- C:\Windows\System\mPQUOkv.exe
  C:\Windows\System\mPQUOkv.exe
  2⤵
  PID:15080
- C:\Windows\System\DGQOpXL.exe
  C:\Windows\System\DGQOpXL.exe
  2⤵
  PID:14212
- C:\Windows\System\OYYNfGu.exe
  C:\Windows\System\OYYNfGu.exe
  2⤵
  PID:12492
- C:\Windows\System\vhlHigs.exe
  C:\Windows\System\vhlHigs.exe
  2⤵
  PID:4304
- C:\Windows\System\ENgOVVW.exe
  C:\Windows\System\ENgOVVW.exe
  2⤵
  PID:14744
- C:\Windows\System\YtfcxwI.exe
  C:\Windows\System\YtfcxwI.exe
  2⤵
  PID:14400
- C:\Windows\System\Yskqppe.exe
  C:\Windows\System\Yskqppe.exe
  2⤵
  PID:13580
- C:\Windows\System\tleEUvu.exe
  C:\Windows\System\tleEUvu.exe
  2⤵
  PID:11716
- C:\Windows\System\QrzZIox.exe
  C:\Windows\System\QrzZIox.exe
  2⤵
  PID:13144
- C:\Windows\System\HaLLPiG.exe
  C:\Windows\System\HaLLPiG.exe
  2⤵
  PID:11620
- C:\Windows\System\UPZuXQB.exe
  C:\Windows\System\UPZuXQB.exe
  2⤵
  PID:13600
- C:\Windows\System\KJwfaRe.exe
  C:\Windows\System\KJwfaRe.exe
  2⤵
  PID:14976
- C:\Windows\System\hXAdvYx.exe
  C:\Windows\System\hXAdvYx.exe
  2⤵
  PID:11460
- C:\Windows\System\cKQhdUd.exe
  C:\Windows\System\cKQhdUd.exe
  2⤵
  PID:13844
- C:\Windows\System\rMmbDHr.exe
  C:\Windows\System\rMmbDHr.exe
  2⤵
  PID:13680
- C:\Windows\System\aJhkTQU.exe
  C:\Windows\System\aJhkTQU.exe
  2⤵
  PID:12384
- C:\Windows\System\MoUEHHR.exe
  C:\Windows\System\MoUEHHR.exe
  2⤵
  PID:14912
- C:\Windows\System\pVMosvM.exe
  C:\Windows\System\pVMosvM.exe
  2⤵
  PID:14044
- C:\Windows\System\OTPOQng.exe
  C:\Windows\System\OTPOQng.exe
  2⤵
  PID:15180
- C:\Windows\System\FkkcECN.exe
  C:\Windows\System\FkkcECN.exe
  2⤵
  PID:12408
- C:\Windows\System\bgbSjzX.exe
  C:\Windows\System\bgbSjzX.exe
  2⤵
  PID:11116
- C:\Windows\System\YqPxObw.exe
  C:\Windows\System\YqPxObw.exe
  2⤵
  PID:11420
- C:\Windows\System\hENwAQK.exe
  C:\Windows\System\hENwAQK.exe
  2⤵
  PID:11880
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11880 -s 252
    3⤵
    PID:15712
- C:\Windows\System\MZSexwV.exe
  C:\Windows\System\MZSexwV.exe
  2⤵
  PID:11188
- C:\Windows\System\CFXRVWx.exe
  C:\Windows\System\CFXRVWx.exe
  2⤵
  PID:14384
- C:\Windows\System\vIsZKJE.exe
  C:\Windows\System\vIsZKJE.exe
  2⤵
  PID:11928
- C:\Windows\System\hGzrkDT.exe
  C:\Windows\System\hGzrkDT.exe
  2⤵
  PID:14580
- C:\Windows\System\AzvgItM.exe
  C:\Windows\System\AzvgItM.exe
  2⤵
  PID:15340
- C:\Windows\System\XpJvFLv.exe
  C:\Windows\System\XpJvFLv.exe
  2⤵
  PID:11860
- C:\Windows\System\QkIXXFk.exe
  C:\Windows\System\QkIXXFk.exe
  2⤵
  PID:13768
- C:\Windows\System\KJseeFX.exe
  C:\Windows\System\KJseeFX.exe
  2⤵
  PID:13252
- C:\Windows\System\qTOyMNV.exe
  C:\Windows\System\qTOyMNV.exe
  2⤵
  PID:14784
- C:\Windows\System\HSzsWeL.exe
  C:\Windows\System\HSzsWeL.exe
  2⤵
  PID:15248
- C:\Windows\System\VvZRmjq.exe
  C:\Windows\System\VvZRmjq.exe
  2⤵
  PID:11560
- C:\Windows\System\DfYJqcK.exe
  C:\Windows\System\DfYJqcK.exe
  2⤵
  PID:15376
- C:\Windows\System\amqLjru.exe
  C:\Windows\System\amqLjru.exe
  2⤵
  PID:15400
- C:\Windows\System\YDXmCSI.exe
  C:\Windows\System\YDXmCSI.exe
  2⤵
  PID:15424
- C:\Windows\System\ZDCUepA.exe
  C:\Windows\System\ZDCUepA.exe
  2⤵
  PID:15444
- C:\Windows\System\PzmRKTz.exe
  C:\Windows\System\PzmRKTz.exe
  2⤵
  PID:15460
- C:\Windows\System\JZEVeYj.exe
  C:\Windows\System\JZEVeYj.exe
  2⤵
  PID:15476
- C:\Windows\System\MkbOiEb.exe
  C:\Windows\System\MkbOiEb.exe
  2⤵
  PID:15492
- C:\Windows\System\jVVpyoe.exe
  C:\Windows\System\jVVpyoe.exe
  2⤵
  PID:15508
- C:\Windows\System\MizwGGm.exe
  C:\Windows\System\MizwGGm.exe
  2⤵
  PID:15532
- C:\Windows\System\DqHUThy.exe
  C:\Windows\System\DqHUThy.exe
  2⤵
  PID:15572
- C:\Windows\System\qnPMyGP.exe
  C:\Windows\System\qnPMyGP.exe
  2⤵
  PID:15596
- C:\Windows\System\RDTyCLT.exe
  C:\Windows\System\RDTyCLT.exe
  2⤵
  PID:15616
- C:\Windows\System\oocghXk.exe
  C:\Windows\System\oocghXk.exe
  2⤵
  PID:15636
- C:\Windows\System\OMNujJh.exe
  C:\Windows\System\OMNujJh.exe
  2⤵
  PID:15780
- C:\Windows\System\bCBXDGk.exe
  C:\Windows\System\bCBXDGk.exe
  2⤵
  PID:15976
- C:\Windows\System\AlywdiK.exe
  C:\Windows\System\AlywdiK.exe
  2⤵
  PID:15996
- C:\Windows\System\lqgQndI.exe
  C:\Windows\System\lqgQndI.exe
  2⤵
  PID:16020
- C:\Windows\System\ydRcXdw.exe
  C:\Windows\System\ydRcXdw.exe
  2⤵
  PID:16044
- C:\Windows\System\sCCeFTg.exe
  C:\Windows\System\sCCeFTg.exe
  2⤵
  PID:16076
- C:\Windows\System\LQEPCBo.exe
  C:\Windows\System\LQEPCBo.exe
  2⤵
  PID:16264
- C:\Windows\System\wBbmAlm.exe
  C:\Windows\System\wBbmAlm.exe
  2⤵
  PID:16280
- C:\Windows\System\pwvHvpe.exe
  C:\Windows\System\pwvHvpe.exe
  2⤵
  PID:16296
- C:\Windows\System\FgCteeU.exe
  C:\Windows\System\FgCteeU.exe
  2⤵
  PID:16312
- C:\Windows\System\sPYFYhC.exe
  C:\Windows\System\sPYFYhC.exe
  2⤵
  PID:16328
- C:\Windows\System\HHxfiBZ.exe
  C:\Windows\System\HHxfiBZ.exe
  2⤵
  PID:16344
- C:\Windows\System\MWcKCiP.exe
  C:\Windows\System\MWcKCiP.exe
  2⤵
  PID:16360
- C:\Windows\System\IIMoeTg.exe
  C:\Windows\System\IIMoeTg.exe
  2⤵
  PID:16380
- C:\Windows\System\yfZjhin.exe
  C:\Windows\System\yfZjhin.exe
  2⤵
  PID:13916
- C:\Windows\System\naMTYdh.exe
  C:\Windows\System\naMTYdh.exe
  2⤵
  PID:11668
- C:\Windows\System\oqGPbLF.exe
  C:\Windows\System\oqGPbLF.exe
  2⤵
  PID:10844
- C:\Windows\System\KvOuBrs.exe
  C:\Windows\System\KvOuBrs.exe
  2⤵
  PID:10948
- C:\Windows\System\okYmsiT.exe
  C:\Windows\System\okYmsiT.exe
  2⤵
  PID:15500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AcWdDLT.exe

Filesize
1.8MB

MD5
9252fc3daaa43176178f8888a960eee2

SHA1
12944112e599be01a7ecd796ad3ea78c5ba4f89c

SHA256
59d81af527f4434abfea1f9afbbc83832e3d372e9288cc65ac8a97b18c7d9b4b

SHA512
40b1b1094f22a2a4874fc3a75784e4170fe1c727cb03aa565f6151b5693c10007ace4698d1d0f545c90e6395d64831eaf094fa06fec78c2cf95d55f3ecc06199

Download Submit
C:\Windows\System\CvrQshZ.exe

Filesize
1.8MB

MD5
a0cad37ce4891d9ef59f35844f98ebcf

SHA1
4530a2cb773b47fa9b535f7693b4397db0488f3b

SHA256
04c33732687e5a404910547ad24df11a9d395bec9df0672c7b98cd393dcb8c3f

SHA512
1bf38fb6e9c2a38e5f490cccf44f99c64106b30041d7f3830e16c260c29b49c9cbe61bd3534bda6659c0aa58d8bf49a5a2b74604314ce630125bd63070631cbc

Download Submit
C:\Windows\System\GSyxUTo.exe

Filesize
1.8MB

MD5
d7024ca8675a250707d19f875063805e

SHA1
7a5eb7585b202c761128523abb47ae3e47d46809

SHA256
7d096f4a83c7f2f99a95e7aa069c52ca2ac3159d38756fdee2b288d485843735

SHA512
0d4496922704ff1ad7cc4fa31ad8e9bcef7b28bb85d36629bd74a9cdc4240e8fb59469e615374f4b4b0c58c9e252a596b35ee498c080dbed87b2d9cd3831f98b

Download Submit
C:\Windows\System\KCzTAJx.exe

Filesize
1.8MB

MD5
1a6716db59e6f8e3efd30779ad21ee90

SHA1
1f2f979ea352943e89524c5d2a533d606a06a515

SHA256
8b7f4a6281036d371de59f90d50c6da39fb6af1bb96a5de996ed1eb9a5dea226

SHA512
05a3fdcd706fac3ca9a1bb6396fed5e4faa3ef87631f913979b1ef0ab94949968b35e046c3feb7ad2f6f203ddfa109dcdc02e9cb764cad3fe24557a89d2cb3e6

Download Submit
C:\Windows\System\LbdTDCC.exe

Filesize
1.8MB

MD5
9b0df688265962fa2fb4bbe63abbf821

SHA1
427382d78539b63a88138fe50cc7efc744791616

SHA256
9c8d7ed130c2412772c33d1fa2d150d6c650f5a2251b0e2d3632c35846f2212f

SHA512
c1066f07fddaa61a80442911b67dce00e0dcede34e3d229adffa8ea2ea200c2000de57cfe383b22fe3cf9faf123c56e8561b00839ee2e6dc046fea6a00a0a1f4

Download Submit
C:\Windows\System\LbneTMR.exe

Filesize
1.8MB

MD5
e084ab21447e59cf8863591cecb7d69c

SHA1
cbe60b9395ca036d9d13c9e946adc93a93229151

SHA256
d0e7024b59054f43b3bac0696af77322a6b4a6d011e7bd0f8011a936f1812b1e

SHA512
048e011a534fceedbf33f10e25ce668871ef256d17f5ec2b95623f499b0bb681e538060422dc4c98e43afa6b90912e071e73ac4a5f058062aef901606223cd3d

Download Submit
C:\Windows\System\LrhTlWG.exe

Filesize
1.8MB

MD5
1e53e7b6e9330c69a71ca006cb454044

SHA1
8275b94e529b2078af6c930c21fe61b90382d76d

SHA256
a15974f3b86955ad9d893818ad9d1208c995cbed1c27717882aef44702aad4ac

SHA512
23e14a14e263ce02870234ead06dc328ebd8958c2fcb6bcbaa6694363abe71bea0e4632a5f84e3a4750bb35dc812022b451caa92e3e462eb2f19e2ed394a3e6e

Download Submit
C:\Windows\System\MOKvjfO.exe

Filesize
1.8MB

MD5
0af72dbce0959d7117049beb11146c4f

SHA1
330ba6b04e577d3fe252604fda4de62a574b5b71

SHA256
8ca4e6a70670027d76c9b38f8b554684d772615bf0f469b9823761070d6bb79e

SHA512
c962446f032320c3dbf73b7de69b963d5509675c9e60cb461277dc010ec81992dc62f00f54096949c5df439687e4ea20889ab24cbd2ebbd2828b3a60c026d7e6

Download Submit
C:\Windows\System\OTvUFDe.exe

Filesize
1.8MB

MD5
fa9004950c5d46fcdb4b5908186d5996

SHA1
46d6c1e551c4fae2a680d8ee4c38b87edb265b7b

SHA256
2b231cc0a67e562cee4a439b56cb308146e142b74ab3666aebe5ac0c674a701c

SHA512
2a14f5ff334b343e5c3bf0514677538db2b5ddeacd8246f8af21e4344774c14bdf1568c7027e0038a48e1bb419ccd8bd3c7e357f627b5197158176606a3acc27

Download Submit
C:\Windows\System\PskdYQP.exe

Filesize
1.8MB

MD5
f1d608cbead54387593742942d28e1bd

SHA1
2f1cc7042ffa4b68e670c8a5349596b5f4d6f035

SHA256
59af4972299f3f61cb52a6dce8a8faac950c550e8b0e7450bbbc808921e24773

SHA512
bd1042243a49fe00903e9217f1c3ca47fef476c53b5963b3198ac2932b9f19dcadc22ab128dae591e389d6236f43a8d7153b7dc0b2c0e4eb75eb59aefd3262dd

Download Submit
C:\Windows\System\QXgZnxH.exe

Filesize
1.8MB

MD5
ba56683ac1dcd09a415e4689005174ab

SHA1
7bb1ba0c4d46ec9c924b35bf4268b89a69ca0a4e

SHA256
1c99a9828d7cdf521aa98698195bff40c1779c7c0fb8031fa8f1c97ee283f888

SHA512
77045fd3667fc44c739d09b42c90532b42d9e41a026d2d8cd768abc63e43c4337acaa29f5d379e3561fed3eb1c68af1e4ff4e4825f1c00fdea44e98b48def360

Download Submit
C:\Windows\System\TIGZrWV.exe

Filesize
1.8MB

MD5
8a5edc2187a47994338cc0479bcac978

SHA1
60b4b7e70e1c4b823af8bb237cb4cf7fbc3f8bfe

SHA256
510117d8b178c97a7cb5bce2d7776419bd1dee0a8918f618254c0fc678ac496c

SHA512
a3f40390ec46ebca9ed16422135776b618e5c84eeeedab2086758b3c63fc68443525a6f3719dbf285d54e66366b4c188a25871f8e891ef93ff7775487e84d1d8

Download Submit
C:\Windows\System\TTDvFtw.exe

Filesize
1.8MB

MD5
8f9136413ac81111b5b2c9ae53fc3083

SHA1
9de94f80232cc9b8b0c3644c253e6da5821d6fb5

SHA256
8bb081427947ecdf555ce7254dd27083267fdee8c533b3716fddbc4083dc9c21

SHA512
eed0c78393639491f8ed2c9bde9dc463f499ee3ea4870513dfac7e08614737c9677df09325374e5f44114078bf0f2662990799bb2c4ece30288758fd94decfbc

Download Submit
C:\Windows\System\YNLHrpy.exe

Filesize
1.8MB

MD5
79dee7188e1074695b8ebdc7b27b186e

SHA1
8a8cff27a4d204152018259b788173d4088daf6f

SHA256
8b50aaed1302779835358dd9a207a3767ded7a31a06435e386cc6e410d5a68ff

SHA512
56000650db957cfbc8897676d8b8daa70b3cec12a51fee0c0ba6ecfb76104ff9e788d9c943ad3241db842ae18ec75410eb75e745d2f991a3ca0b61cca00925b0

Download Submit
C:\Windows\System\ZNNPeYx.exe

Filesize
1.8MB

MD5
3b474c790c481d256e50b80f149e6b0d

SHA1
fc70f790c0b9a4a457f014c40b18565afbc81bfa

SHA256
c89d10a73d7a5834b04d71121d25d6129ac7320841d62bf638e4d388440aae6b

SHA512
c69935fc44a8449af43c31b4491cd0a4791e03dbf42e35bf75c839f5caabdcfbe676efb41a38b035b44e0ca541709ebd7af3999b05d889b1ebb5ee5e2a419cf7

Download Submit
C:\Windows\System\bepCsHr.exe

Filesize
1.8MB

MD5
55de702bef6c3d4b5181284d0201d9d2

SHA1
e0ec6b3dc0d5ba5d5551d439f2493e8ca4fdfca5

SHA256
95e395e67f7a1612ebb22891c703694fe8b10c0608e8c36d5bd3a30fd99367ab

SHA512
79cfaca86144ce25ce9b351d1b99203f668023bc4bc88064b84e478620167066ccc1f73706754681d154675d8c1843ebcfd99d94fb96440e4a1b7d3881d9a588

Download Submit
C:\Windows\System\cpYwBgo.exe

Filesize
1.8MB

MD5
fb9b30c56fabbb2334302a7500fd84b7

SHA1
b9dc1a0b32974640e98a95b82d8cddd03765e57b

SHA256
0b2910e1e54a7fa2596db9c604d74dca9dd6234da422186966608726a0d2d246

SHA512
f956b8ac2a27f2e3411c536afa74a574dc281661111730e965bbff534b95cd9f7cbdcfafc74e2de8861fb3debb383c3390fba208907a3bc35deaca396e570cac

Download Submit
C:\Windows\System\ejDXrTL.exe

Filesize
1.8MB

MD5
69d78b5f9130298732dc71d431ebcf99

SHA1
4d618265f57081642f3ff628a1deca1105598b1e

SHA256
a73c7901c031ae4312e85afe25cc109013e97546f39c962b2cf3e24a01209284

SHA512
6ee9c1d52ccc30ce89be1bb4ace107f1156bd0f11beebe02ba1e391d5c4698fdb51ca2a4b87ffc7f740ba8f039ffe0511a9a711dcb73c9545b90ed6a6a645f71

Download Submit
C:\Windows\System\fYOsHkX.exe

Filesize
1.8MB

MD5
6dbb87efa3fd9f3d4a5d883eceb2d9f4

SHA1
a71f362f4347514e4970d85fd667a1309e3948de

SHA256
47cfb88aa0d222b8a8309b3363fa914c51ca6f7c866cc9e4e0f6c62432666dc5

SHA512
6a30f7bc62f302aa55e7835981a2b9ef7b43c2783fee043d6ecaf5e930a285445e0b5cfe66cf74b9bac2a9a7101cb1f3bbacc77e7317e11a25ced3ea2027f00d

Download Submit
C:\Windows\System\faOOGXP.exe

Filesize
1.8MB

MD5
99743c8df4b7e1fb755225e55ec4ed58

SHA1
6d43b8cce41c2e9ff42e271a6dce7ccefb180dbf

SHA256
bc4209293bffeb97fba719573ee4eca457f543716d6c9c01495f2242ace50b4f

SHA512
fcc0fa4b4b5b13b35012b63e68136755c6e1a8ba1d9ae1d32aa49c45120c25dd3c0aaffb7bb98ebb66e83dbade315c7013cc6ab27247c1a4af516f3eda372b54

Download Submit
C:\Windows\System\koybUHR.exe

Filesize
1.8MB

MD5
29448e0e73785bb642e68527abb307a8

SHA1
67f8f2a2dc3533b0ee4f3b9b111d9077204a4054

SHA256
abf308cb9ff22efdfdce327991f971d0c4be72b3d312f1eb1a208ef2ad6ffb4c

SHA512
99a514d3c87f78aedaeb57528a64ef26c2901f358a9921c41c4ee9f42e54891fd0ce676b9b1c1003430f76e6af106c31db1371a40bbafa469c595d0e859a8304

Download Submit
C:\Windows\System\lfoVcZO.exe

Filesize
1.8MB

MD5
a0d34d02880161cdd5e16c7c263d7298

SHA1
c58b26f42e84117cbaba4a09c453d44abf953a2d

SHA256
a5e266f5e573870ea0b8259aa9ceebe338e3b907fb9ca8e39ae9fdbefdd5ef02

SHA512
32411008a15cac9373839485fb7817f4cad426cfd5ae830c825b71e4e04ef1a333f828efdb9138ab9cf32d6e939074962939460d72dcf2c01109e37bc30be87f

Download Submit
C:\Windows\System\myAoxYr.exe

Filesize
1.8MB

MD5
83dd5074a5ff3050fc330b54320dd9fe

SHA1
81cf7f1e0f0863b8c0a6b90948db14a291ef55f7

SHA256
94328434d1fc53beb5b9585bae7f8e7b6c86d6485dda683351410d5785fd3014

SHA512
480400c49326e0cb111d2b7c1609040eba3e342ac6447b63e95fbabc46800392f451f0ca7fc283436df2654ca95424cfeaa14575a7c493eba7f712b67f469262

Download Submit
C:\Windows\System\nHfLCAs.exe

Filesize
1.8MB

MD5
6879ea824474d77575522448e60d9127

SHA1
d2979495834e88bd2ba7307c526a9b11d3e25887

SHA256
e21b271b169b111ed266ff316c0977c3143ec731667dd14cd76093a035135070

SHA512
fbb1e6bbeb1a34468291fa5a7184f2e97f39e6c1abc8f8f90a3a716f73b1b5d69eee1758d9a9a0e5a3c0a1bc23a848e7c42b4c768a69c80323ff9ee40588ee71

Download Submit
C:\Windows\System\nTzjbCw.exe

Filesize
1.8MB

MD5
d671d7ce377c282db01a170ce8ef80b4

SHA1
34b9f3006a187aa203dc8420a2ed3f07a714e6fe

SHA256
c27f09f98f2ba182fda4c50f7329412c0b244327524cca58b22ab07ff7f73a18

SHA512
bc454c8522a12e2502eabde1cbecc47258b489a910a77570d4500142c9cdcfb949c795a747b52ed5fd4192af958ff73634f30e06f963ec90b542a871330fdd03

Download Submit
C:\Windows\System\qKfnVSH.exe

Filesize
1.8MB

MD5
848dfa33f251cd43604baddd576b182c

SHA1
c38c512b38e3dad748176fe892b0222df9793a14

SHA256
17217fd9ee679ca7c323f0d5f31eb7cc3a997b1d8023f640fbf07cf37e359dd6

SHA512
091f967225d40998ce651b70a392007fb483a7afe018c8b77ed84de0a7a67effa9b49b22bd6893c3a9e95c1b2287b0b32b55c565fbcc3ab5a2489c380e38bba5

Download Submit
C:\Windows\System\soTJvce.exe

Filesize
1.8MB

MD5
3df1abf81b3cb53c53159c18f2a6bf8f

SHA1
a6e97d4d1d969c9cab87df0d57aa7dc18f6d485a

SHA256
2e09a072387cd668cd489cf4c18141b3668abe3e96670fe45fe5fe73fa6a39a4

SHA512
e5d5d890239031ce6a5f794969ceb43bf629e79d2f15abadd0d5db86a9b5393b4ef327ac0a0395a1c4a6de1ed0ff5d2bf845af6d3c3958a3ed3e46586a20eb61

Download Submit
C:\Windows\System\ssEWvcT.exe

Filesize
1.8MB

MD5
1f7a69a5c50a45db2531f2b67da1ee77

SHA1
9d3243f96799cff83cee0c28feac729687bb60e2

SHA256
dc6c2cf939a26ec96b51bcc5d1faf710b186f39034fee491f61fdac46bf957e0

SHA512
f9fbc14945b2d6dd73b80fef304c5521b15cf3dddd7ec32a695c0afcfa74ea5e9c314f06a5b0807a20a9ecd61161055b64fccba8d1c909439d6d1a9bd178e136

Download Submit
C:\Windows\System\ucOOgti.exe

Filesize
1.8MB

MD5
037e72f451ffd560f513d97a5e59f9b0

SHA1
135cff47444c430d0e25fc6d9d3345ef510f49e9

SHA256
9f33706431dceac99997e8a6c00ecc941826507ab05363ca097c176b0932c305

SHA512
a840ce9b1408d057f5307c3fff698c0f450ebb241fd98dbcead3c4329d3d7fdd65fa68e2903c1cc3a77b1c652bfb2b16c3e785e73ad8836c978e4582ed80f081

Download Submit
C:\Windows\System\uojRMpm.exe

Filesize
1.8MB

MD5
c7303e8fb1b656b6fbe9fc32be8818aa

SHA1
efb2372cf949e142acf11c1b730f47afaad35adc

SHA256
e259216ccfdcb4f177dbe72a1624efca32d85e653dbe4de2b480a34224af9c9d

SHA512
da9745e943253f8642cf83c46f5a9fb794130e013a0107cf72c3998b2ff4ef7fa03288605a60a509e8de4ed444a44a29dd3e9fe3fe4d8f22d702a4c5d494c4c8

Download Submit
C:\Windows\System\vjjbnRl.exe

Filesize
1.8MB

MD5
3471dadbda28f7952a8e62c235946741

SHA1
6fcaacd4ea2ca1730f75bb9f2c6800918a78c757

SHA256
2480e7838c6eeb7aefd2d5226056a5c7da490ca1fb60eb9033f83807899cadcd

SHA512
8e799ef1a48d46c43924e1f4d6056eb786bfc4cf993e6fe2d58ce5f7b40cf8d45cd370e76ad59dcf6651d2f2dc8184dbf305e161d810f5514aea3f49a6a15ce9

Download Submit
C:\Windows\System\vuARLZJ.exe

Filesize
1.8MB

MD5
4347a4264824718431e386cd8630b533

SHA1
306e583cd33f600f90958ec4b993792637836ae9

SHA256
735571e13b9fc6b0ba18ca19967f394665134395e886479438dc447b62a122b5

SHA512
7e5ff6a0bbc93e68c13fae3c691a686ae2796b59916a1985c1db7def13b780cc54e9b465a066cc781e0febb554e91c64b876c757a9c067d0d9763eedd374527c

Download Submit
C:\Windows\System\vuCghjc.exe

Filesize
1.8MB

MD5
c0d84e1d7e11438479fcaf556d7f24ce

SHA1
67bc62a7426e37757729615e71f7411f2e2f09c4

SHA256
faf263f2c0c05b86cf50a9b13802a60e889b478d2058361284c8e6c88e2a0071

SHA512
0b02315d0bf52a91a26054be75d0e5d6c86356daf89a78665b467cd6a5608ca7918b90d7667a4b38750daacea58438df4ff557f36ad6dc4182160fe71a59163a

Download Submit
C:\Windows\System\wrNdMZS.exe

Filesize
1.8MB

MD5
7fe52a2fb3daf7908db5f29a402db370

SHA1
741038c29620a9363dde4fc30c3c203cf310e242

SHA256
0b93bc07c46da6baf00a79b87c0bcf22557fccbe475c1d9d0c77845d6cc0d592

SHA512
6b20788cf166d1c5be09df003885bfe7e25b4f6fd9a58cf78921fd2c43ce0fa9973904ed69891a40226d2c5377a905095b0e832fb8e26b9712309c34810910be

Download Submit
C:\Windows\System\yLLaSLZ.exe

Filesize
1.8MB

MD5
af48543b297c88766352e6c34ab71e9b

SHA1
60da134326e3da0ea7bba593545e956a66f9c379

SHA256
050fe04981de43bdbe295c79883e63fcca371285e2689843b1ae4ca54d46535b

SHA512
6bee27e6a20b783678e9711e8e2f842c4804890f32a91cab4ac1b1bc4ad3cf61816d571c6d8201e029bb54edb29c45dcc8d285edb0fadc4716b1feff1fd555f0

Download Submit
C:\Windows\System\yMsbDDW.exe

Filesize
1.8MB

MD5
c713a44831690eb56660bf9efed264d3

SHA1
860cd6d21d6ab1a8bd7cee91f6abe74d1f18dbdb

SHA256
33a8552b6f3e3c215215bd6adab1d27b51100411be6068906d24408ce2facf62

SHA512
d9910886fe901a279c9b2aa5b01ccb2c113fd04df72b265297c7acb965d8ae30adafcce9b160c9e3522536cd1887446ae466dba9159f5b27791e3dcf6db83552

Download Submit
C:\Windows\System\yZqsyNu.exe

Filesize
1.8MB

MD5
5615abd567b47e6a40c130fd9e53d14d

SHA1
3e0008b9a5763f41ead229f71b25df41fb025272

SHA256
4f6880dcb5b537638a977a9c6c47afa9467cadcd4bae9625a23fd2952e780fe9

SHA512
6dadf0766536512ee7fae8a26dd9a5190dce54e1f6f5bb9a22924fe46494f6d534ed843794b2e17f7e7064f95b143d73505be8c798a2a082708dab0568fc26ed

Download Submit
memory/380-219-0x00007FF7C7CD0000-0x00007FF7C8021000-memory.dmp

Filesize
3.3MB

Download
memory/380-2942-0x00007FF7C7CD0000-0x00007FF7C8021000-memory.dmp

Filesize
3.3MB

Download
memory/1004-27-0x00007FF760270000-0x00007FF7605C1000-memory.dmp

Filesize
3.3MB

Download
memory/1004-2412-0x00007FF760270000-0x00007FF7605C1000-memory.dmp

Filesize
3.3MB

Download
memory/1004-2917-0x00007FF760270000-0x00007FF7605C1000-memory.dmp

Filesize
3.3MB

Download
memory/1080-2930-0x00007FF644EF0000-0x00007FF645241000-memory.dmp

Filesize
3.3MB

Download
memory/1080-88-0x00007FF644EF0000-0x00007FF645241000-memory.dmp

Filesize
3.3MB

Download
memory/1080-2473-0x00007FF644EF0000-0x00007FF645241000-memory.dmp

Filesize
3.3MB

Download
memory/1100-2442-0x00007FF6040D0000-0x00007FF604421000-memory.dmp

Filesize
3.3MB

Download
memory/1100-2926-0x00007FF6040D0000-0x00007FF604421000-memory.dmp

Filesize
3.3MB

Download
memory/1100-66-0x00007FF6040D0000-0x00007FF604421000-memory.dmp

Filesize
3.3MB

Download
memory/1300-222-0x00007FF6F2170000-0x00007FF6F24C1000-memory.dmp

Filesize
3.3MB

Download
memory/1300-2929-0x00007FF6F2170000-0x00007FF6F24C1000-memory.dmp

Filesize
3.3MB

Download
memory/1992-2950-0x00007FF71E700000-0x00007FF71EA51000-memory.dmp

Filesize
3.3MB

Download
memory/1992-201-0x00007FF71E700000-0x00007FF71EA51000-memory.dmp

Filesize
3.3MB

Download
memory/2000-2956-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp

Filesize
3.3MB

Download
memory/2000-213-0x00007FF6052A0000-0x00007FF6055F1000-memory.dmp

Filesize
3.3MB

Download
memory/2188-205-0x00007FF60E730000-0x00007FF60EA81000-memory.dmp

Filesize
3.3MB

Download
memory/2188-2946-0x00007FF60E730000-0x00007FF60EA81000-memory.dmp

Filesize
3.3MB

Download
memory/2192-2889-0x00007FF6DA0D0000-0x00007FF6DA421000-memory.dmp

Filesize
3.3MB

Download
memory/2192-42-0x00007FF6DA0D0000-0x00007FF6DA421000-memory.dmp

Filesize
3.3MB

Download
memory/2332-3087-0x00007FF643DD0000-0x00007FF644121000-memory.dmp

Filesize
3.3MB

Download
memory/2332-214-0x00007FF643DD0000-0x00007FF644121000-memory.dmp

Filesize
3.3MB

Download
memory/2332-2662-0x00007FF643DD0000-0x00007FF644121000-memory.dmp

Filesize
3.3MB

Download
memory/2508-83-0x00007FF79AEA0000-0x00007FF79B1F1000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2443-0x00007FF79AEA0000-0x00007FF79B1F1000-memory.dmp

Filesize
3.3MB

Download
memory/2508-2923-0x00007FF79AEA0000-0x00007FF79B1F1000-memory.dmp

Filesize
3.3MB

Download
memory/2792-8-0x00007FF7A3CD0000-0x00007FF7A4021000-memory.dmp

Filesize
3.3MB

Download
memory/2792-2887-0x00007FF7A3CD0000-0x00007FF7A4021000-memory.dmp

Filesize
3.3MB

Download
memory/2836-2924-0x00007FF74CAF0000-0x00007FF74CE41000-memory.dmp

Filesize
3.3MB

Download
memory/2836-2625-0x00007FF74CAF0000-0x00007FF74CE41000-memory.dmp

Filesize
3.3MB

Download
memory/2836-45-0x00007FF74CAF0000-0x00007FF74CE41000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1891-0x00007FF6B51C0000-0x00007FF6B5511000-memory.dmp

Filesize
3.3MB

Download
memory/3004-0-0x00007FF6B51C0000-0x00007FF6B5511000-memory.dmp

Filesize
3.3MB

Download
memory/3004-1-0x00000232EF6E0000-0x00000232EF6F0000-memory.dmp

Filesize
64KB

Download
memory/3104-221-0x00007FF79B140000-0x00007FF79B491000-memory.dmp

Filesize
3.3MB

Download
memory/3104-2937-0x00007FF79B140000-0x00007FF79B491000-memory.dmp

Filesize
3.3MB

Download
memory/3128-2958-0x00007FF7B6400000-0x00007FF7B6751000-memory.dmp

Filesize
3.3MB

Download
memory/3128-220-0x00007FF7B6400000-0x00007FF7B6751000-memory.dmp

Filesize
3.3MB

Download
memory/3468-212-0x00007FF7DB6C0000-0x00007FF7DBA11000-memory.dmp

Filesize
3.3MB

Download
memory/3468-2953-0x00007FF7DB6C0000-0x00007FF7DBA11000-memory.dmp

Filesize
3.3MB

Download
memory/3520-3085-0x00007FF606B00000-0x00007FF606E51000-memory.dmp

Filesize
3.3MB

Download
memory/3520-2689-0x00007FF606B00000-0x00007FF606E51000-memory.dmp

Filesize
3.3MB

Download
memory/3520-216-0x00007FF606B00000-0x00007FF606E51000-memory.dmp

Filesize
3.3MB

Download
memory/3560-2949-0x00007FF7CC6B0000-0x00007FF7CCA01000-memory.dmp

Filesize
3.3MB

Download
memory/3560-206-0x00007FF7CC6B0000-0x00007FF7CCA01000-memory.dmp

Filesize
3.3MB

Download
memory/3652-2688-0x00007FF764D30000-0x00007FF765081000-memory.dmp

Filesize
3.3MB

Download
memory/3652-3078-0x00007FF764D30000-0x00007FF765081000-memory.dmp

Filesize
3.3MB

Download
memory/3652-215-0x00007FF764D30000-0x00007FF765081000-memory.dmp

Filesize
3.3MB

Download
memory/3680-218-0x00007FF6B9430000-0x00007FF6B9781000-memory.dmp

Filesize
3.3MB

Download
memory/3680-2919-0x00007FF6B9430000-0x00007FF6B9781000-memory.dmp

Filesize
3.3MB

Download
memory/3712-211-0x00007FF6E9EA0000-0x00007FF6EA1F1000-memory.dmp

Filesize
3.3MB

Download
memory/3712-2934-0x00007FF6E9EA0000-0x00007FF6EA1F1000-memory.dmp

Filesize
3.3MB

Download
memory/4060-2945-0x00007FF7AD640000-0x00007FF7AD991000-memory.dmp

Filesize
3.3MB

Download
memory/4060-115-0x00007FF7AD640000-0x00007FF7AD991000-memory.dmp

Filesize
3.3MB

Download
memory/4168-2920-0x00007FF7AE290000-0x00007FF7AE5E1000-memory.dmp

Filesize
3.3MB

Download
memory/4168-148-0x00007FF7AE290000-0x00007FF7AE5E1000-memory.dmp

Filesize
3.3MB

Download
memory/4232-2933-0x00007FF7A0DD0000-0x00007FF7A1121000-memory.dmp

Filesize
3.3MB

Download
memory/4232-207-0x00007FF7A0DD0000-0x00007FF7A1121000-memory.dmp

Filesize
3.3MB

Download
memory/4756-2938-0x00007FF6B72A0000-0x00007FF6B75F1000-memory.dmp

Filesize
3.3MB

Download
memory/4756-210-0x00007FF6B72A0000-0x00007FF6B75F1000-memory.dmp

Filesize
3.3MB

Download
memory/4852-209-0x00007FF7661F0000-0x00007FF766541000-memory.dmp

Filesize
3.3MB

Download
memory/4852-2960-0x00007FF7661F0000-0x00007FF766541000-memory.dmp

Filesize
3.3MB

Download
memory/5036-2954-0x00007FF78F9C0000-0x00007FF78FD11000-memory.dmp

Filesize
3.3MB

Download
memory/5036-208-0x00007FF78F9C0000-0x00007FF78FD11000-memory.dmp

Filesize
3.3MB

Download
memory/5072-2941-0x00007FF7B19D0000-0x00007FF7B1D21000-memory.dmp

Filesize
3.3MB

Download
memory/5072-151-0x00007FF7B19D0000-0x00007FF7B1D21000-memory.dmp

Filesize
3.3MB

Download
memory/5104-2891-0x00007FF7B1870000-0x00007FF7B1BC1000-memory.dmp

Filesize
3.3MB

Download
memory/5104-217-0x00007FF7B1870000-0x00007FF7B1BC1000-memory.dmp

Filesize
3.3MB

Download