xmrig | 51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827

Analysis

max time kernel
121s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
Size

1.4MB
MD5

5b179e95b402810bab90456876251914
SHA1

c436d4c6b87ce6f2a74d02c3e3e335e6aab2eb38
SHA256

51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827
SHA512

1e08b4329f2e7b16b78275f24ac34db52daf9a02a4da88f28efa2b7dc88b7aa982b5119250aca289bfbe096a7ea25368eaf40212a60e84c35d7e2417e77dbc07
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph7NAmE25m:GezaTF8FcNkNdfE0pZ9ozttwIRxHTS5

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2992 created 4764	2992	WerFaultSecure.exe	81

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bbd-4.dat	xmrig
behavioral2/files/0x0007000000023c92-6.dat	xmrig
behavioral2/files/0x0007000000023c91-7.dat	xmrig
behavioral2/files/0x0007000000023c93-19.dat	xmrig
behavioral2/files/0x0007000000023c94-24.dat	xmrig
behavioral2/files/0x0007000000023c95-30.dat	xmrig
behavioral2/files/0x0007000000023c96-34.dat	xmrig
behavioral2/files/0x0007000000023c98-44.dat	xmrig
behavioral2/files/0x0007000000023c9e-72.dat	xmrig
behavioral2/files/0x0007000000023c9f-77.dat	xmrig
behavioral2/files/0x0007000000023ca0-82.dat	xmrig
behavioral2/files/0x0007000000023ca3-97.dat	xmrig
behavioral2/files/0x0007000000023caa-132.dat	xmrig
behavioral2/files/0x0007000000023cad-147.dat	xmrig
behavioral2/files/0x0007000000023cae-160.dat	xmrig
behavioral2/files/0x0007000000023cb0-162.dat	xmrig
behavioral2/files/0x0007000000023caf-157.dat	xmrig
behavioral2/files/0x0007000000023cac-150.dat	xmrig
behavioral2/files/0x0007000000023cab-145.dat	xmrig
behavioral2/files/0x0007000000023ca9-135.dat	xmrig
behavioral2/files/0x0007000000023ca8-130.dat	xmrig
behavioral2/files/0x0007000000023ca7-125.dat	xmrig
behavioral2/files/0x0007000000023ca6-120.dat	xmrig
behavioral2/files/0x0007000000023ca5-115.dat	xmrig
behavioral2/files/0x0007000000023ca4-110.dat	xmrig
behavioral2/files/0x0007000000023ca2-100.dat	xmrig
behavioral2/files/0x0007000000023ca1-95.dat	xmrig
behavioral2/files/0x0007000000023c9d-75.dat	xmrig
behavioral2/files/0x0007000000023c9c-70.dat	xmrig
behavioral2/files/0x0007000000023c9b-65.dat	xmrig
behavioral2/files/0x0007000000023c9a-60.dat	xmrig
behavioral2/files/0x0007000000023c99-55.dat	xmrig
behavioral2/files/0x0007000000023c97-42.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4728	fXqfhJZ.exe
684	fgzRLye.exe
2108	gzQClfS.exe
2796	fBOloMH.exe
1400	sfjuTFV.exe
5016	ckZwGOD.exe
2768	yFGJUwC.exe
3416	mXfYvZI.exe
4048	XJlKdZo.exe
2416	WnqomKH.exe
4296	VBJDxQD.exe
720	mHTrDyj.exe
3556	TPzJxvw.exe
4860	iPUAwWa.exe
2800	Opipyya.exe
4288	nNpPDXr.exe
4244	qiRlzCP.exe
1624	vUsSsGd.exe
216	DFnOKmP.exe
2792	pIovEAF.exe
2784	YeHuIAq.exe
2676	AhNVKjO.exe
4980	MkeAois.exe
3336	SJYPtEj.exe
2388	AEVibYz.exe
3636	xBgmukg.exe
1136	pbycARm.exe
3832	CiBaovv.exe
3092	dlyJUfD.exe
1772	foPxpWt.exe
3952	DmBvIIQ.exe
2392	ITFyCbw.exe
4300	TxfyeSf.exe
1648	OjXFRyu.exe
4568	pxucJpa.exe
4912	FPIofHv.exe
2544	JPkZhmp.exe
4456	zFSrBfm.exe
4268	YsQVAdp.exe
2920	XhVUTOd.exe
1928	zdtFChR.exe
5036	NFdvGox.exe
3608	XwUMAOL.exe
2344	mNyPfKx.exe
3884	UIzQQkm.exe
1920	aoHhKsA.exe
2680	voAZpHy.exe
3360	SBKjLAF.exe
3820	PXFzZIx.exe
4196	qQFKeVe.exe
1424	SdlJDIW.exe
4720	GnqbFiu.exe
4356	JMbThyf.exe
2504	JNwzGOZ.exe
2976	gxYbVzT.exe
3584	fxviJER.exe
5088	EThWUSe.exe
3308	IUGuZmy.exe
2132	SMYKZne.exe
1452	mAyawFb.exe
3528	zLmwTIq.exe
4524	JKdQqsk.exe
2260	qEPTHfH.exe
2304	TCOzuSm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eFlezsQ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\HaaCxwZ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\HgHATgP.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\zhGQFEe.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\wzlIjSW.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\IJtwXPM.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\FYVfKNN.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\eNrrYrh.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\AopbfuM.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\UqVKAAk.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\DgmDTbL.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\weWDdEP.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\GnqbFiu.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\UFWYRid.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\jtiabgT.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\keORrvN.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\DxmWFkL.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\UOevWKX.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\pGQBcPW.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\ZoxrAOZ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\kvePSKw.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\UiexYoC.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\sjqcTXz.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\TMIPeeN.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\Mdhsqet.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\IUQBbDR.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\tOcqTRt.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\TBQswlT.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\EysQaNN.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\knEqnlo.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\qhneaQM.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\pioJJYD.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\SSYcbky.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\dakrofV.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\cwqXoEL.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\xcZgqdb.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\fausZFP.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\YbyhTiX.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\VpeDvbl.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\lBJQoBl.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\XXQAnoZ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\uGvhcaY.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\srJZohg.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\chAOCpO.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\wodNYFL.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\loubaVa.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\hKYlBWV.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\YMfXJGQ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\Oloywla.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\DegHUTt.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\wgSdUvP.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\YgdqBpI.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\kLnjdMx.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\BPaKTuO.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\IvBryiS.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\PnNijzZ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\zncpMmn.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\iPUAwWa.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\DmBvIIQ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\RRwUrzQ.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\HYfHBKP.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\muvbBqv.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\mxZBpLU.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
File created	C:\Windows\System\IgejXkl.exe	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4900	WerFaultSecure.exe
4900	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4728	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	84
PID 4856 wrote to memory of 4728	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	84
PID 4856 wrote to memory of 684	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	85
PID 4856 wrote to memory of 684	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	85
PID 4856 wrote to memory of 2108	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	86
PID 4856 wrote to memory of 2108	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	86
PID 4856 wrote to memory of 2796	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	87
PID 4856 wrote to memory of 2796	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	87
PID 4856 wrote to memory of 1400	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	88
PID 4856 wrote to memory of 1400	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	88
PID 4856 wrote to memory of 5016	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	89
PID 4856 wrote to memory of 5016	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	89
PID 4856 wrote to memory of 2768	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	90
PID 4856 wrote to memory of 2768	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	90
PID 4856 wrote to memory of 3416	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	91
PID 4856 wrote to memory of 3416	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	91
PID 4856 wrote to memory of 4048	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	92
PID 4856 wrote to memory of 4048	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	92
PID 4856 wrote to memory of 2416	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	93
PID 4856 wrote to memory of 2416	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	93
PID 4856 wrote to memory of 4296	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	94
PID 4856 wrote to memory of 4296	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	94
PID 4856 wrote to memory of 720	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	95
PID 4856 wrote to memory of 720	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	95
PID 4856 wrote to memory of 3556	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	96
PID 4856 wrote to memory of 3556	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	96
PID 4856 wrote to memory of 4860	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	97
PID 4856 wrote to memory of 4860	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	97
PID 4856 wrote to memory of 2800	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	98
PID 4856 wrote to memory of 2800	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	98
PID 4856 wrote to memory of 4288	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	99
PID 4856 wrote to memory of 4288	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	99
PID 4856 wrote to memory of 4244	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	100
PID 4856 wrote to memory of 4244	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	100
PID 4856 wrote to memory of 1624	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	101
PID 4856 wrote to memory of 1624	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	101
PID 4856 wrote to memory of 216	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	102
PID 4856 wrote to memory of 216	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	102
PID 4856 wrote to memory of 2792	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	103
PID 4856 wrote to memory of 2792	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	103
PID 4856 wrote to memory of 2784	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	104
PID 4856 wrote to memory of 2784	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	104
PID 4856 wrote to memory of 2676	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	105
PID 4856 wrote to memory of 2676	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	105
PID 4856 wrote to memory of 4980	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	106
PID 4856 wrote to memory of 4980	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	106
PID 4856 wrote to memory of 3336	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	107
PID 4856 wrote to memory of 3336	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	107
PID 4856 wrote to memory of 2388	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	108
PID 4856 wrote to memory of 2388	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	108
PID 4856 wrote to memory of 3636	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	109
PID 4856 wrote to memory of 3636	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	109
PID 4856 wrote to memory of 1136	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	110
PID 4856 wrote to memory of 1136	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	110
PID 4856 wrote to memory of 3832	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	111
PID 4856 wrote to memory of 3832	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	111
PID 4856 wrote to memory of 3092	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	112
PID 4856 wrote to memory of 3092	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	112
PID 4856 wrote to memory of 1772	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	113
PID 4856 wrote to memory of 1772	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	113
PID 4856 wrote to memory of 3952	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	114
PID 4856 wrote to memory of 3952	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	114
PID 4856 wrote to memory of 2392	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	115
PID 4856 wrote to memory of 2392	4856	51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe	115

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4764
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4764 -s 352
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Users\Admin\AppData\Local\Temp\51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe
"C:\Users\Admin\AppData\Local\Temp\51f6a0a8e05fb21c1a83125ca3150df641ffa90aab76225f4d28da3dc7336827.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\System\fXqfhJZ.exe
  C:\Windows\System\fXqfhJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\fgzRLye.exe
  C:\Windows\System\fgzRLye.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\gzQClfS.exe
  C:\Windows\System\gzQClfS.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\fBOloMH.exe
  C:\Windows\System\fBOloMH.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\sfjuTFV.exe
  C:\Windows\System\sfjuTFV.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\ckZwGOD.exe
  C:\Windows\System\ckZwGOD.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\yFGJUwC.exe
  C:\Windows\System\yFGJUwC.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\mXfYvZI.exe
  C:\Windows\System\mXfYvZI.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\XJlKdZo.exe
  C:\Windows\System\XJlKdZo.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\WnqomKH.exe
  C:\Windows\System\WnqomKH.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\VBJDxQD.exe
  C:\Windows\System\VBJDxQD.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\mHTrDyj.exe
  C:\Windows\System\mHTrDyj.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\TPzJxvw.exe
  C:\Windows\System\TPzJxvw.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\iPUAwWa.exe
  C:\Windows\System\iPUAwWa.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\Opipyya.exe
  C:\Windows\System\Opipyya.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\nNpPDXr.exe
  C:\Windows\System\nNpPDXr.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\qiRlzCP.exe
  C:\Windows\System\qiRlzCP.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\vUsSsGd.exe
  C:\Windows\System\vUsSsGd.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\DFnOKmP.exe
  C:\Windows\System\DFnOKmP.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\pIovEAF.exe
  C:\Windows\System\pIovEAF.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\YeHuIAq.exe
  C:\Windows\System\YeHuIAq.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\AhNVKjO.exe
  C:\Windows\System\AhNVKjO.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\MkeAois.exe
  C:\Windows\System\MkeAois.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\SJYPtEj.exe
  C:\Windows\System\SJYPtEj.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\AEVibYz.exe
  C:\Windows\System\AEVibYz.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\xBgmukg.exe
  C:\Windows\System\xBgmukg.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\pbycARm.exe
  C:\Windows\System\pbycARm.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\CiBaovv.exe
  C:\Windows\System\CiBaovv.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\dlyJUfD.exe
  C:\Windows\System\dlyJUfD.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\foPxpWt.exe
  C:\Windows\System\foPxpWt.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\DmBvIIQ.exe
  C:\Windows\System\DmBvIIQ.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\ITFyCbw.exe
  C:\Windows\System\ITFyCbw.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\TxfyeSf.exe
  C:\Windows\System\TxfyeSf.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\OjXFRyu.exe
  C:\Windows\System\OjXFRyu.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\pxucJpa.exe
  C:\Windows\System\pxucJpa.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\FPIofHv.exe
  C:\Windows\System\FPIofHv.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\JPkZhmp.exe
  C:\Windows\System\JPkZhmp.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\zFSrBfm.exe
  C:\Windows\System\zFSrBfm.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\YsQVAdp.exe
  C:\Windows\System\YsQVAdp.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\XhVUTOd.exe
  C:\Windows\System\XhVUTOd.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\zdtFChR.exe
  C:\Windows\System\zdtFChR.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\NFdvGox.exe
  C:\Windows\System\NFdvGox.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\XwUMAOL.exe
  C:\Windows\System\XwUMAOL.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\mNyPfKx.exe
  C:\Windows\System\mNyPfKx.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\UIzQQkm.exe
  C:\Windows\System\UIzQQkm.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\aoHhKsA.exe
  C:\Windows\System\aoHhKsA.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\voAZpHy.exe
  C:\Windows\System\voAZpHy.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\SBKjLAF.exe
  C:\Windows\System\SBKjLAF.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\PXFzZIx.exe
  C:\Windows\System\PXFzZIx.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\qQFKeVe.exe
  C:\Windows\System\qQFKeVe.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\SdlJDIW.exe
  C:\Windows\System\SdlJDIW.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\GnqbFiu.exe
  C:\Windows\System\GnqbFiu.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\JMbThyf.exe
  C:\Windows\System\JMbThyf.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\JNwzGOZ.exe
  C:\Windows\System\JNwzGOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\gxYbVzT.exe
  C:\Windows\System\gxYbVzT.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\fxviJER.exe
  C:\Windows\System\fxviJER.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\EThWUSe.exe
  C:\Windows\System\EThWUSe.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\IUGuZmy.exe
  C:\Windows\System\IUGuZmy.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\SMYKZne.exe
  C:\Windows\System\SMYKZne.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\mAyawFb.exe
  C:\Windows\System\mAyawFb.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\zLmwTIq.exe
  C:\Windows\System\zLmwTIq.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\JKdQqsk.exe
  C:\Windows\System\JKdQqsk.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\qEPTHfH.exe
  C:\Windows\System\qEPTHfH.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\TCOzuSm.exe
  C:\Windows\System\TCOzuSm.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\OifVFni.exe
  C:\Windows\System\OifVFni.exe
  2⤵
  PID:1460
- C:\Windows\System\EBdKFOZ.exe
  C:\Windows\System\EBdKFOZ.exe
  2⤵
  PID:3656
- C:\Windows\System\hvRjKGq.exe
  C:\Windows\System\hvRjKGq.exe
  2⤵
  PID:212
- C:\Windows\System\TsFfxig.exe
  C:\Windows\System\TsFfxig.exe
  2⤵
  PID:3340
- C:\Windows\System\goYhrSX.exe
  C:\Windows\System\goYhrSX.exe
  2⤵
  PID:2856
- C:\Windows\System\aRlZrAL.exe
  C:\Windows\System\aRlZrAL.exe
  2⤵
  PID:2160
- C:\Windows\System\BWchiEA.exe
  C:\Windows\System\BWchiEA.exe
  2⤵
  PID:3052
- C:\Windows\System\ImCujAf.exe
  C:\Windows\System\ImCujAf.exe
  2⤵
  PID:5056
- C:\Windows\System\YRLrKSQ.exe
  C:\Windows\System\YRLrKSQ.exe
  2⤵
  PID:3516
- C:\Windows\System\QvKwonj.exe
  C:\Windows\System\QvKwonj.exe
  2⤵
  PID:4744
- C:\Windows\System\bRoNTGT.exe
  C:\Windows\System\bRoNTGT.exe
  2⤵
  PID:3748
- C:\Windows\System\ZBLSdpm.exe
  C:\Windows\System\ZBLSdpm.exe
  2⤵
  PID:5008
- C:\Windows\System\IEtkROX.exe
  C:\Windows\System\IEtkROX.exe
  2⤵
  PID:2560
- C:\Windows\System\KQpfVew.exe
  C:\Windows\System\KQpfVew.exe
  2⤵
  PID:1456
- C:\Windows\System\eNrrYrh.exe
  C:\Windows\System\eNrrYrh.exe
  2⤵
  PID:556
- C:\Windows\System\tWpkZHQ.exe
  C:\Windows\System\tWpkZHQ.exe
  2⤵
  PID:4388
- C:\Windows\System\qBRIvhu.exe
  C:\Windows\System\qBRIvhu.exe
  2⤵
  PID:4384
- C:\Windows\System\HVkEwbN.exe
  C:\Windows\System\HVkEwbN.exe
  2⤵
  PID:3448
- C:\Windows\System\Nvnznsu.exe
  C:\Windows\System\Nvnznsu.exe
  2⤵
  PID:2616
- C:\Windows\System\dSFNHZC.exe
  C:\Windows\System\dSFNHZC.exe
  2⤵
  PID:1620
- C:\Windows\System\bPOytVf.exe
  C:\Windows\System\bPOytVf.exe
  2⤵
  PID:312
- C:\Windows\System\cqIzGyE.exe
  C:\Windows\System\cqIzGyE.exe
  2⤵
  PID:5076
- C:\Windows\System\BWJbbgt.exe
  C:\Windows\System\BWJbbgt.exe
  2⤵
  PID:3432
- C:\Windows\System\gkWbfUa.exe
  C:\Windows\System\gkWbfUa.exe
  2⤵
  PID:1924
- C:\Windows\System\QRDhSTK.exe
  C:\Windows\System\QRDhSTK.exe
  2⤵
  PID:3404
- C:\Windows\System\gKktAbq.exe
  C:\Windows\System\gKktAbq.exe
  2⤵
  PID:4796
- C:\Windows\System\nBUFVFb.exe
  C:\Windows\System\nBUFVFb.exe
  2⤵
  PID:4400
- C:\Windows\System\jSWLrXK.exe
  C:\Windows\System\jSWLrXK.exe
  2⤵
  PID:4780
- C:\Windows\System\JzSmqbj.exe
  C:\Windows\System\JzSmqbj.exe
  2⤵
  PID:4536
- C:\Windows\System\ZepawIq.exe
  C:\Windows\System\ZepawIq.exe
  2⤵
  PID:3236
- C:\Windows\System\MCGvOSw.exe
  C:\Windows\System\MCGvOSw.exe
  2⤵
  PID:4316
- C:\Windows\System\csWxazz.exe
  C:\Windows\System\csWxazz.exe
  2⤵
  PID:2808
- C:\Windows\System\SSYcbky.exe
  C:\Windows\System\SSYcbky.exe
  2⤵
  PID:3936
- C:\Windows\System\kTLQJut.exe
  C:\Windows\System\kTLQJut.exe
  2⤵
  PID:1596
- C:\Windows\System\TwJrxUq.exe
  C:\Windows\System\TwJrxUq.exe
  2⤵
  PID:4444
- C:\Windows\System\qZpvitO.exe
  C:\Windows\System\qZpvitO.exe
  2⤵
  PID:1204
- C:\Windows\System\pVxAeFj.exe
  C:\Windows\System\pVxAeFj.exe
  2⤵
  PID:180
- C:\Windows\System\GRHEfBM.exe
  C:\Windows\System\GRHEfBM.exe
  2⤵
  PID:4712
- C:\Windows\System\KRtJqSz.exe
  C:\Windows\System\KRtJqSz.exe
  2⤵
  PID:2084
- C:\Windows\System\rHHIypj.exe
  C:\Windows\System\rHHIypj.exe
  2⤵
  PID:4164
- C:\Windows\System\nVmpnYc.exe
  C:\Windows\System\nVmpnYc.exe
  2⤵
  PID:4280
- C:\Windows\System\WmCPBAm.exe
  C:\Windows\System\WmCPBAm.exe
  2⤵
  PID:4120
- C:\Windows\System\IKvmKRY.exe
  C:\Windows\System\IKvmKRY.exe
  2⤵
  PID:916
- C:\Windows\System\jfqJpeU.exe
  C:\Windows\System\jfqJpeU.exe
  2⤵
  PID:5124
- C:\Windows\System\aIUVjrl.exe
  C:\Windows\System\aIUVjrl.exe
  2⤵
  PID:5160
- C:\Windows\System\UBrLcCt.exe
  C:\Windows\System\UBrLcCt.exe
  2⤵
  PID:5180
- C:\Windows\System\zqKMgrC.exe
  C:\Windows\System\zqKMgrC.exe
  2⤵
  PID:5216
- C:\Windows\System\LweMlyf.exe
  C:\Windows\System\LweMlyf.exe
  2⤵
  PID:5236
- C:\Windows\System\DsSDWfq.exe
  C:\Windows\System\DsSDWfq.exe
  2⤵
  PID:5280
- C:\Windows\System\YUCuRzV.exe
  C:\Windows\System\YUCuRzV.exe
  2⤵
  PID:5296
- C:\Windows\System\GPgMnSk.exe
  C:\Windows\System\GPgMnSk.exe
  2⤵
  PID:5352
- C:\Windows\System\GPBpOGh.exe
  C:\Windows\System\GPBpOGh.exe
  2⤵
  PID:5372
- C:\Windows\System\IuabsSd.exe
  C:\Windows\System\IuabsSd.exe
  2⤵
  PID:5388
- C:\Windows\System\KFVOMAV.exe
  C:\Windows\System\KFVOMAV.exe
  2⤵
  PID:5412
- C:\Windows\System\srJZohg.exe
  C:\Windows\System\srJZohg.exe
  2⤵
  PID:5440
- C:\Windows\System\rHeZBMf.exe
  C:\Windows\System\rHeZBMf.exe
  2⤵
  PID:5460
- C:\Windows\System\SEvMSrR.exe
  C:\Windows\System\SEvMSrR.exe
  2⤵
  PID:5484
- C:\Windows\System\ajxhIcQ.exe
  C:\Windows\System\ajxhIcQ.exe
  2⤵
  PID:5504
- C:\Windows\System\FYVfKNN.exe
  C:\Windows\System\FYVfKNN.exe
  2⤵
  PID:5528
- C:\Windows\System\BPaKTuO.exe
  C:\Windows\System\BPaKTuO.exe
  2⤵
  PID:5544
- C:\Windows\System\NIRKYsS.exe
  C:\Windows\System\NIRKYsS.exe
  2⤵
  PID:5564
- C:\Windows\System\eFmwIPQ.exe
  C:\Windows\System\eFmwIPQ.exe
  2⤵
  PID:5620
- C:\Windows\System\nyxjHIm.exe
  C:\Windows\System\nyxjHIm.exe
  2⤵
  PID:5680
- C:\Windows\System\vQbiCUr.exe
  C:\Windows\System\vQbiCUr.exe
  2⤵
  PID:5704
- C:\Windows\System\GNlIgwr.exe
  C:\Windows\System\GNlIgwr.exe
  2⤵
  PID:5740
- C:\Windows\System\LofKYfL.exe
  C:\Windows\System\LofKYfL.exe
  2⤵
  PID:5768
- C:\Windows\System\NZtAtVx.exe
  C:\Windows\System\NZtAtVx.exe
  2⤵
  PID:5784
- C:\Windows\System\RxPjlLW.exe
  C:\Windows\System\RxPjlLW.exe
  2⤵
  PID:5812
- C:\Windows\System\wUCjtrq.exe
  C:\Windows\System\wUCjtrq.exe
  2⤵
  PID:5844
- C:\Windows\System\WbIEHVH.exe
  C:\Windows\System\WbIEHVH.exe
  2⤵
  PID:5872
- C:\Windows\System\BHYkvSK.exe
  C:\Windows\System\BHYkvSK.exe
  2⤵
  PID:5908
- C:\Windows\System\eTatwEg.exe
  C:\Windows\System\eTatwEg.exe
  2⤵
  PID:5924
- C:\Windows\System\KFPFznX.exe
  C:\Windows\System\KFPFznX.exe
  2⤵
  PID:5948
- C:\Windows\System\hJjIEtl.exe
  C:\Windows\System\hJjIEtl.exe
  2⤵
  PID:5992
- C:\Windows\System\UhKrKoV.exe
  C:\Windows\System\UhKrKoV.exe
  2⤵
  PID:6020
- C:\Windows\System\wsObPii.exe
  C:\Windows\System\wsObPii.exe
  2⤵
  PID:6036
- C:\Windows\System\zDIXGlZ.exe
  C:\Windows\System\zDIXGlZ.exe
  2⤵
  PID:6060
- C:\Windows\System\EysQaNN.exe
  C:\Windows\System\EysQaNN.exe
  2⤵
  PID:6084
- C:\Windows\System\DRPjNOn.exe
  C:\Windows\System\DRPjNOn.exe
  2⤵
  PID:6120
- C:\Windows\System\tKVCcHK.exe
  C:\Windows\System\tKVCcHK.exe
  2⤵
  PID:6140
- C:\Windows\System\HUXsWDV.exe
  C:\Windows\System\HUXsWDV.exe
  2⤵
  PID:5176
- C:\Windows\System\GZIKpNT.exe
  C:\Windows\System\GZIKpNT.exe
  2⤵
  PID:5248
- C:\Windows\System\jgwAmrL.exe
  C:\Windows\System\jgwAmrL.exe
  2⤵
  PID:5312
- C:\Windows\System\upxoNAz.exe
  C:\Windows\System\upxoNAz.exe
  2⤵
  PID:3700
- C:\Windows\System\pGQBcPW.exe
  C:\Windows\System\pGQBcPW.exe
  2⤵
  PID:5380
- C:\Windows\System\ewGfCAq.exe
  C:\Windows\System\ewGfCAq.exe
  2⤵
  PID:5452
- C:\Windows\System\URhMJMF.exe
  C:\Windows\System\URhMJMF.exe
  2⤵
  PID:5580
- C:\Windows\System\Bekbecs.exe
  C:\Windows\System\Bekbecs.exe
  2⤵
  PID:5616
- C:\Windows\System\weoGPBA.exe
  C:\Windows\System\weoGPBA.exe
  2⤵
  PID:5672
- C:\Windows\System\GmboHnh.exe
  C:\Windows\System\GmboHnh.exe
  2⤵
  PID:5700
- C:\Windows\System\FGdWbVn.exe
  C:\Windows\System\FGdWbVn.exe
  2⤵
  PID:5760
- C:\Windows\System\UeimRCc.exe
  C:\Windows\System\UeimRCc.exe
  2⤵
  PID:5836
- C:\Windows\System\hPvWJTa.exe
  C:\Windows\System\hPvWJTa.exe
  2⤵
  PID:5896
- C:\Windows\System\VFcOhpX.exe
  C:\Windows\System\VFcOhpX.exe
  2⤵
  PID:6008
- C:\Windows\System\CupAumA.exe
  C:\Windows\System\CupAumA.exe
  2⤵
  PID:6100
- C:\Windows\System\nsvHyMt.exe
  C:\Windows\System\nsvHyMt.exe
  2⤵
  PID:6052
- C:\Windows\System\GrcQIgJ.exe
  C:\Windows\System\GrcQIgJ.exe
  2⤵
  PID:5200
- C:\Windows\System\thTezjR.exe
  C:\Windows\System\thTezjR.exe
  2⤵
  PID:5320
- C:\Windows\System\xWLJWjP.exe
  C:\Windows\System\xWLJWjP.exe
  2⤵
  PID:2532
- C:\Windows\System\McUrUlW.exe
  C:\Windows\System\McUrUlW.exe
  2⤵
  PID:5480
- C:\Windows\System\AeLKIlw.exe
  C:\Windows\System\AeLKIlw.exe
  2⤵
  PID:5492
- C:\Windows\System\jxTIxxW.exe
  C:\Windows\System\jxTIxxW.exe
  2⤵
  PID:5764
- C:\Windows\System\kDMivVl.exe
  C:\Windows\System\kDMivVl.exe
  2⤵
  PID:5776
- C:\Windows\System\SgFYtBL.exe
  C:\Windows\System\SgFYtBL.exe
  2⤵
  PID:5884
- C:\Windows\System\ntZrPuM.exe
  C:\Windows\System\ntZrPuM.exe
  2⤵
  PID:5404
- C:\Windows\System\bhOresB.exe
  C:\Windows\System\bhOresB.exe
  2⤵
  PID:5648
- C:\Windows\System\VmWYdOI.exe
  C:\Windows\System\VmWYdOI.exe
  2⤵
  PID:5472
- C:\Windows\System\FygFiNM.exe
  C:\Windows\System\FygFiNM.exe
  2⤵
  PID:6160
- C:\Windows\System\EeBhOjO.exe
  C:\Windows\System\EeBhOjO.exe
  2⤵
  PID:6192
- C:\Windows\System\AXxKgaj.exe
  C:\Windows\System\AXxKgaj.exe
  2⤵
  PID:6216
- C:\Windows\System\IprtDWH.exe
  C:\Windows\System\IprtDWH.exe
  2⤵
  PID:6232
- C:\Windows\System\TFGthZm.exe
  C:\Windows\System\TFGthZm.exe
  2⤵
  PID:6260
- C:\Windows\System\VqJMjET.exe
  C:\Windows\System\VqJMjET.exe
  2⤵
  PID:6296
- C:\Windows\System\tDUupZL.exe
  C:\Windows\System\tDUupZL.exe
  2⤵
  PID:6340
- C:\Windows\System\NUbGAlU.exe
  C:\Windows\System\NUbGAlU.exe
  2⤵
  PID:6364
- C:\Windows\System\cUZlZth.exe
  C:\Windows\System\cUZlZth.exe
  2⤵
  PID:6396
- C:\Windows\System\urUyjCV.exe
  C:\Windows\System\urUyjCV.exe
  2⤵
  PID:6412
- C:\Windows\System\QhoihSR.exe
  C:\Windows\System\QhoihSR.exe
  2⤵
  PID:6440
- C:\Windows\System\JaxFeWx.exe
  C:\Windows\System\JaxFeWx.exe
  2⤵
  PID:6460
- C:\Windows\System\OcabLxQ.exe
  C:\Windows\System\OcabLxQ.exe
  2⤵
  PID:6484
- C:\Windows\System\BaCEnKc.exe
  C:\Windows\System\BaCEnKc.exe
  2⤵
  PID:6504
- C:\Windows\System\AopbfuM.exe
  C:\Windows\System\AopbfuM.exe
  2⤵
  PID:6528
- C:\Windows\System\yWjfFLG.exe
  C:\Windows\System\yWjfFLG.exe
  2⤵
  PID:6568
- C:\Windows\System\dYtUILp.exe
  C:\Windows\System\dYtUILp.exe
  2⤵
  PID:6592
- C:\Windows\System\iXohSRv.exe
  C:\Windows\System\iXohSRv.exe
  2⤵
  PID:6620
- C:\Windows\System\gIESRtR.exe
  C:\Windows\System\gIESRtR.exe
  2⤵
  PID:6648
- C:\Windows\System\mxZBpLU.exe
  C:\Windows\System\mxZBpLU.exe
  2⤵
  PID:6676
- C:\Windows\System\WhUoeza.exe
  C:\Windows\System\WhUoeza.exe
  2⤵
  PID:6708
- C:\Windows\System\zdSYXIc.exe
  C:\Windows\System\zdSYXIc.exe
  2⤵
  PID:6740
- C:\Windows\System\CyMioQH.exe
  C:\Windows\System\CyMioQH.exe
  2⤵
  PID:6764
- C:\Windows\System\gDmoAZp.exe
  C:\Windows\System\gDmoAZp.exe
  2⤵
  PID:6780
- C:\Windows\System\QuzIdqX.exe
  C:\Windows\System\QuzIdqX.exe
  2⤵
  PID:6804
- C:\Windows\System\uGvhcaY.exe
  C:\Windows\System\uGvhcaY.exe
  2⤵
  PID:6832
- C:\Windows\System\XmEsyZf.exe
  C:\Windows\System\XmEsyZf.exe
  2⤵
  PID:6852
- C:\Windows\System\PpCgovz.exe
  C:\Windows\System\PpCgovz.exe
  2⤵
  PID:6876
- C:\Windows\System\erGDdEn.exe
  C:\Windows\System\erGDdEn.exe
  2⤵
  PID:6932
- C:\Windows\System\aGtxnyP.exe
  C:\Windows\System\aGtxnyP.exe
  2⤵
  PID:6976
- C:\Windows\System\ZGscFIl.exe
  C:\Windows\System\ZGscFIl.exe
  2⤵
  PID:7000
- C:\Windows\System\MSxJRjp.exe
  C:\Windows\System\MSxJRjp.exe
  2⤵
  PID:7028
- C:\Windows\System\JrzVvOe.exe
  C:\Windows\System\JrzVvOe.exe
  2⤵
  PID:7060
- C:\Windows\System\ClfJERq.exe
  C:\Windows\System\ClfJERq.exe
  2⤵
  PID:7100
- C:\Windows\System\OUdqeDD.exe
  C:\Windows\System\OUdqeDD.exe
  2⤵
  PID:7128
- C:\Windows\System\kawtSQS.exe
  C:\Windows\System\kawtSQS.exe
  2⤵
  PID:7148
- C:\Windows\System\hoZLogj.exe
  C:\Windows\System\hoZLogj.exe
  2⤵
  PID:5428
- C:\Windows\System\VIPPoPo.exe
  C:\Windows\System\VIPPoPo.exe
  2⤵
  PID:6172
- C:\Windows\System\YogYwHM.exe
  C:\Windows\System\YogYwHM.exe
  2⤵
  PID:6276
- C:\Windows\System\UcRouSv.exe
  C:\Windows\System\UcRouSv.exe
  2⤵
  PID:6348
- C:\Windows\System\YgiByep.exe
  C:\Windows\System\YgiByep.exe
  2⤵
  PID:6432
- C:\Windows\System\zcnIAWz.exe
  C:\Windows\System\zcnIAWz.exe
  2⤵
  PID:6456
- C:\Windows\System\gjuQFtw.exe
  C:\Windows\System\gjuQFtw.exe
  2⤵
  PID:6544
- C:\Windows\System\fAwrCCO.exe
  C:\Windows\System\fAwrCCO.exe
  2⤵
  PID:6632
- C:\Windows\System\xGCfCar.exe
  C:\Windows\System\xGCfCar.exe
  2⤵
  PID:6664
- C:\Windows\System\lEOhoOf.exe
  C:\Windows\System\lEOhoOf.exe
  2⤵
  PID:6720
- C:\Windows\System\Pdvuwwa.exe
  C:\Windows\System\Pdvuwwa.exe
  2⤵
  PID:6868
- C:\Windows\System\GSjOWWN.exe
  C:\Windows\System\GSjOWWN.exe
  2⤵
  PID:6840
- C:\Windows\System\zmzTzYv.exe
  C:\Windows\System\zmzTzYv.exe
  2⤵
  PID:6948
- C:\Windows\System\chAOCpO.exe
  C:\Windows\System\chAOCpO.exe
  2⤵
  PID:7012
- C:\Windows\System\KkiXuQE.exe
  C:\Windows\System\KkiXuQE.exe
  2⤵
  PID:7088
- C:\Windows\System\SrrjGwB.exe
  C:\Windows\System\SrrjGwB.exe
  2⤵
  PID:7140
- C:\Windows\System\SCtdfxJ.exe
  C:\Windows\System\SCtdfxJ.exe
  2⤵
  PID:6252
- C:\Windows\System\TCKBQUw.exe
  C:\Windows\System\TCKBQUw.exe
  2⤵
  PID:6520
- C:\Windows\System\ZqzjiVI.exe
  C:\Windows\System\ZqzjiVI.exe
  2⤵
  PID:6564
- C:\Windows\System\ljScMAT.exe
  C:\Windows\System\ljScMAT.exe
  2⤵
  PID:6604
- C:\Windows\System\ELppBze.exe
  C:\Windows\System\ELppBze.exe
  2⤵
  PID:6920
- C:\Windows\System\GKEofme.exe
  C:\Windows\System\GKEofme.exe
  2⤵
  PID:6996
- C:\Windows\System\oxYUaZc.exe
  C:\Windows\System\oxYUaZc.exe
  2⤵
  PID:7116
- C:\Windows\System\UWtZDXS.exe
  C:\Windows\System\UWtZDXS.exe
  2⤵
  PID:6588
- C:\Windows\System\oPHAFRN.exe
  C:\Windows\System\oPHAFRN.exe
  2⤵
  PID:6944
- C:\Windows\System\xHaezSc.exe
  C:\Windows\System\xHaezSc.exe
  2⤵
  PID:7192
- C:\Windows\System\njbWvtK.exe
  C:\Windows\System\njbWvtK.exe
  2⤵
  PID:7208
- C:\Windows\System\JtBZKDF.exe
  C:\Windows\System\JtBZKDF.exe
  2⤵
  PID:7236
- C:\Windows\System\ASkCCuA.exe
  C:\Windows\System\ASkCCuA.exe
  2⤵
  PID:7264
- C:\Windows\System\cMxNnsN.exe
  C:\Windows\System\cMxNnsN.exe
  2⤵
  PID:7296
- C:\Windows\System\NRVQjlh.exe
  C:\Windows\System\NRVQjlh.exe
  2⤵
  PID:7316
- C:\Windows\System\fsSbJLP.exe
  C:\Windows\System\fsSbJLP.exe
  2⤵
  PID:7344
- C:\Windows\System\qhneaQM.exe
  C:\Windows\System\qhneaQM.exe
  2⤵
  PID:7372
- C:\Windows\System\fsejaAY.exe
  C:\Windows\System\fsejaAY.exe
  2⤵
  PID:7400
- C:\Windows\System\BVWxCXe.exe
  C:\Windows\System\BVWxCXe.exe
  2⤵
  PID:7428
- C:\Windows\System\kvegSEe.exe
  C:\Windows\System\kvegSEe.exe
  2⤵
  PID:7456
- C:\Windows\System\eCQTMyI.exe
  C:\Windows\System\eCQTMyI.exe
  2⤵
  PID:7484
- C:\Windows\System\fKnIgWj.exe
  C:\Windows\System\fKnIgWj.exe
  2⤵
  PID:7516
- C:\Windows\System\bOpBmxa.exe
  C:\Windows\System\bOpBmxa.exe
  2⤵
  PID:7548
- C:\Windows\System\ziPCXqC.exe
  C:\Windows\System\ziPCXqC.exe
  2⤵
  PID:7568
- C:\Windows\System\QcGcaTC.exe
  C:\Windows\System\QcGcaTC.exe
  2⤵
  PID:7616
- C:\Windows\System\twIFrwv.exe
  C:\Windows\System\twIFrwv.exe
  2⤵
  PID:7636
- C:\Windows\System\wodNYFL.exe
  C:\Windows\System\wodNYFL.exe
  2⤵
  PID:7656
- C:\Windows\System\vPlrdeF.exe
  C:\Windows\System\vPlrdeF.exe
  2⤵
  PID:7676
- C:\Windows\System\LFiTBGM.exe
  C:\Windows\System\LFiTBGM.exe
  2⤵
  PID:7692
- C:\Windows\System\GBXDpnv.exe
  C:\Windows\System\GBXDpnv.exe
  2⤵
  PID:7748
- C:\Windows\System\brRqdqe.exe
  C:\Windows\System\brRqdqe.exe
  2⤵
  PID:7776
- C:\Windows\System\Wozpnlv.exe
  C:\Windows\System\Wozpnlv.exe
  2⤵
  PID:7804
- C:\Windows\System\UVdWQWL.exe
  C:\Windows\System\UVdWQWL.exe
  2⤵
  PID:7832
- C:\Windows\System\dakrofV.exe
  C:\Windows\System\dakrofV.exe
  2⤵
  PID:7872
- C:\Windows\System\TzyJNql.exe
  C:\Windows\System\TzyJNql.exe
  2⤵
  PID:7888
- C:\Windows\System\yenklqc.exe
  C:\Windows\System\yenklqc.exe
  2⤵
  PID:7912
- C:\Windows\System\IgejXkl.exe
  C:\Windows\System\IgejXkl.exe
  2⤵
  PID:7932
- C:\Windows\System\crFGcpX.exe
  C:\Windows\System\crFGcpX.exe
  2⤵
  PID:7972
- C:\Windows\System\dZryIwf.exe
  C:\Windows\System\dZryIwf.exe
  2⤵
  PID:8000
- C:\Windows\System\FcStPiZ.exe
  C:\Windows\System\FcStPiZ.exe
  2⤵
  PID:8028
- C:\Windows\System\OFmgQxs.exe
  C:\Windows\System\OFmgQxs.exe
  2⤵
  PID:8056
- C:\Windows\System\uvyDSnr.exe
  C:\Windows\System\uvyDSnr.exe
  2⤵
  PID:8092
- C:\Windows\System\kWMTrvX.exe
  C:\Windows\System\kWMTrvX.exe
  2⤵
  PID:8112
- C:\Windows\System\bjdCzeD.exe
  C:\Windows\System\bjdCzeD.exe
  2⤵
  PID:8152
- C:\Windows\System\rjXxDIq.exe
  C:\Windows\System\rjXxDIq.exe
  2⤵
  PID:8168
- C:\Windows\System\wmVfDWI.exe
  C:\Windows\System\wmVfDWI.exe
  2⤵
  PID:6384
- C:\Windows\System\OLYjBct.exe
  C:\Windows\System\OLYjBct.exe
  2⤵
  PID:7056
- C:\Windows\System\jAEQJcw.exe
  C:\Windows\System\jAEQJcw.exe
  2⤵
  PID:7220
- C:\Windows\System\UFWYRid.exe
  C:\Windows\System\UFWYRid.exe
  2⤵
  PID:6148
- C:\Windows\System\YdFGByX.exe
  C:\Windows\System\YdFGByX.exe
  2⤵
  PID:7312
- C:\Windows\System\KdYOTuW.exe
  C:\Windows\System\KdYOTuW.exe
  2⤵
  PID:7380
- C:\Windows\System\QraUbFQ.exe
  C:\Windows\System\QraUbFQ.exe
  2⤵
  PID:7492
- C:\Windows\System\DgmDTbL.exe
  C:\Windows\System\DgmDTbL.exe
  2⤵
  PID:7468
- C:\Windows\System\AFRalFT.exe
  C:\Windows\System\AFRalFT.exe
  2⤵
  PID:7556
- C:\Windows\System\bSobDcW.exe
  C:\Windows\System\bSobDcW.exe
  2⤵
  PID:7644
- C:\Windows\System\gotPnvn.exe
  C:\Windows\System\gotPnvn.exe
  2⤵
  PID:7708
- C:\Windows\System\NSwbjMl.exe
  C:\Windows\System\NSwbjMl.exe
  2⤵
  PID:7716
- C:\Windows\System\wDXxANS.exe
  C:\Windows\System\wDXxANS.exe
  2⤵
  PID:7816
- C:\Windows\System\DmfIhdO.exe
  C:\Windows\System\DmfIhdO.exe
  2⤵
  PID:7852
- C:\Windows\System\msqSCIR.exe
  C:\Windows\System\msqSCIR.exe
  2⤵
  PID:7904
- C:\Windows\System\LTLRXUO.exe
  C:\Windows\System\LTLRXUO.exe
  2⤵
  PID:7992
- C:\Windows\System\VetyDPp.exe
  C:\Windows\System\VetyDPp.exe
  2⤵
  PID:8076
- C:\Windows\System\YQdxmbN.exe
  C:\Windows\System\YQdxmbN.exe
  2⤵
  PID:8100
- C:\Windows\System\iRGLhZS.exe
  C:\Windows\System\iRGLhZS.exe
  2⤵
  PID:7204
- C:\Windows\System\XiKjSSM.exe
  C:\Windows\System\XiKjSSM.exe
  2⤵
  PID:7276
- C:\Windows\System\iBZlPhX.exe
  C:\Windows\System\iBZlPhX.exe
  2⤵
  PID:7684
- C:\Windows\System\MCfUZfh.exe
  C:\Windows\System\MCfUZfh.exe
  2⤵
  PID:7800
- C:\Windows\System\xuBJLQR.exe
  C:\Windows\System\xuBJLQR.exe
  2⤵
  PID:7848
- C:\Windows\System\swgphIZ.exe
  C:\Windows\System\swgphIZ.exe
  2⤵
  PID:8044
- C:\Windows\System\wgSdUvP.exe
  C:\Windows\System\wgSdUvP.exe
  2⤵
  PID:8160
- C:\Windows\System\vHknuGL.exe
  C:\Windows\System\vHknuGL.exe
  2⤵
  PID:7856
- C:\Windows\System\yhFhawE.exe
  C:\Windows\System\yhFhawE.exe
  2⤵
  PID:7988
- C:\Windows\System\FxFDvCF.exe
  C:\Windows\System\FxFDvCF.exe
  2⤵
  PID:7604
- C:\Windows\System\YgdqBpI.exe
  C:\Windows\System\YgdqBpI.exe
  2⤵
  PID:8208
- C:\Windows\System\BUQReWd.exe
  C:\Windows\System\BUQReWd.exe
  2⤵
  PID:8224
- C:\Windows\System\knEqnlo.exe
  C:\Windows\System\knEqnlo.exe
  2⤵
  PID:8252
- C:\Windows\System\xrDNVSc.exe
  C:\Windows\System\xrDNVSc.exe
  2⤵
  PID:8280
- C:\Windows\System\AkqhJha.exe
  C:\Windows\System\AkqhJha.exe
  2⤵
  PID:8308
- C:\Windows\System\zoTveXH.exe
  C:\Windows\System\zoTveXH.exe
  2⤵
  PID:8340
- C:\Windows\System\eIfTiXs.exe
  C:\Windows\System\eIfTiXs.exe
  2⤵
  PID:8376
- C:\Windows\System\lzfzDYM.exe
  C:\Windows\System\lzfzDYM.exe
  2⤵
  PID:8392
- C:\Windows\System\rbRQNKl.exe
  C:\Windows\System\rbRQNKl.exe
  2⤵
  PID:8420
- C:\Windows\System\oaENofQ.exe
  C:\Windows\System\oaENofQ.exe
  2⤵
  PID:8460
- C:\Windows\System\lFlmmkz.exe
  C:\Windows\System\lFlmmkz.exe
  2⤵
  PID:8488
- C:\Windows\System\SQRiKOY.exe
  C:\Windows\System\SQRiKOY.exe
  2⤵
  PID:8516
- C:\Windows\System\gceLVgP.exe
  C:\Windows\System\gceLVgP.exe
  2⤵
  PID:8544
- C:\Windows\System\TrIRaIS.exe
  C:\Windows\System\TrIRaIS.exe
  2⤵
  PID:8560
- C:\Windows\System\zezBrpr.exe
  C:\Windows\System\zezBrpr.exe
  2⤵
  PID:8600
- C:\Windows\System\tfuaxhX.exe
  C:\Windows\System\tfuaxhX.exe
  2⤵
  PID:8628
- C:\Windows\System\KHcIqJu.exe
  C:\Windows\System\KHcIqJu.exe
  2⤵
  PID:8656
- C:\Windows\System\snRfehf.exe
  C:\Windows\System\snRfehf.exe
  2⤵
  PID:8684
- C:\Windows\System\uWoLmOu.exe
  C:\Windows\System\uWoLmOu.exe
  2⤵
  PID:8700
- C:\Windows\System\hGwpJHP.exe
  C:\Windows\System\hGwpJHP.exe
  2⤵
  PID:8728
- C:\Windows\System\hueYJZJ.exe
  C:\Windows\System\hueYJZJ.exe
  2⤵
  PID:8768
- C:\Windows\System\zwbwwWf.exe
  C:\Windows\System\zwbwwWf.exe
  2⤵
  PID:8796
- C:\Windows\System\qYoKfqW.exe
  C:\Windows\System\qYoKfqW.exe
  2⤵
  PID:8824
- C:\Windows\System\hTPYQmX.exe
  C:\Windows\System\hTPYQmX.exe
  2⤵
  PID:8840
- C:\Windows\System\cfpncYq.exe
  C:\Windows\System\cfpncYq.exe
  2⤵
  PID:8868
- C:\Windows\System\smVgHIF.exe
  C:\Windows\System\smVgHIF.exe
  2⤵
  PID:8888
- C:\Windows\System\nVgEfvB.exe
  C:\Windows\System\nVgEfvB.exe
  2⤵
  PID:8920
- C:\Windows\System\NSmMlkz.exe
  C:\Windows\System\NSmMlkz.exe
  2⤵
  PID:8952
- C:\Windows\System\BrPExUN.exe
  C:\Windows\System\BrPExUN.exe
  2⤵
  PID:8984
- C:\Windows\System\doQVWtr.exe
  C:\Windows\System\doQVWtr.exe
  2⤵
  PID:9008
- C:\Windows\System\dftpmpz.exe
  C:\Windows\System\dftpmpz.exe
  2⤵
  PID:9040
- C:\Windows\System\FuSBwiQ.exe
  C:\Windows\System\FuSBwiQ.exe
  2⤵
  PID:9072
- C:\Windows\System\fBQHIvj.exe
  C:\Windows\System\fBQHIvj.exe
  2⤵
  PID:9096
- C:\Windows\System\rYdNbfH.exe
  C:\Windows\System\rYdNbfH.exe
  2⤵
  PID:9112
- C:\Windows\System\WmErNWY.exe
  C:\Windows\System\WmErNWY.exe
  2⤵
  PID:9140
- C:\Windows\System\iUYrOiK.exe
  C:\Windows\System\iUYrOiK.exe
  2⤵
  PID:9168
- C:\Windows\System\RRwUrzQ.exe
  C:\Windows\System\RRwUrzQ.exe
  2⤵
  PID:9196
- C:\Windows\System\qOhEbHP.exe
  C:\Windows\System\qOhEbHP.exe
  2⤵
  PID:7328
- C:\Windows\System\nGGMTkf.exe
  C:\Windows\System\nGGMTkf.exe
  2⤵
  PID:8220
- C:\Windows\System\GReYIAm.exe
  C:\Windows\System\GReYIAm.exe
  2⤵
  PID:8264
- C:\Windows\System\YmaINQS.exe
  C:\Windows\System\YmaINQS.exe
  2⤵
  PID:8440
- C:\Windows\System\asUCMKT.exe
  C:\Windows\System\asUCMKT.exe
  2⤵
  PID:8452
- C:\Windows\System\HYfHBKP.exe
  C:\Windows\System\HYfHBKP.exe
  2⤵
  PID:8556
- C:\Windows\System\wdcLSmZ.exe
  C:\Windows\System\wdcLSmZ.exe
  2⤵
  PID:8592
- C:\Windows\System\bIAxUsw.exe
  C:\Windows\System\bIAxUsw.exe
  2⤵
  PID:8676
- C:\Windows\System\QiRstxd.exe
  C:\Windows\System\QiRstxd.exe
  2⤵
  PID:8712
- C:\Windows\System\KUAICLA.exe
  C:\Windows\System\KUAICLA.exe
  2⤵
  PID:8784
- C:\Windows\System\rXSSVWR.exe
  C:\Windows\System\rXSSVWR.exe
  2⤵
  PID:8832
- C:\Windows\System\MSWjDfN.exe
  C:\Windows\System\MSWjDfN.exe
  2⤵
  PID:8880
- C:\Windows\System\mSzCknM.exe
  C:\Windows\System\mSzCknM.exe
  2⤵
  PID:8948
- C:\Windows\System\KtsOUGn.exe
  C:\Windows\System\KtsOUGn.exe
  2⤵
  PID:9028
- C:\Windows\System\BptdHTN.exe
  C:\Windows\System\BptdHTN.exe
  2⤵
  PID:9080
- C:\Windows\System\WKuFaFS.exe
  C:\Windows\System\WKuFaFS.exe
  2⤵
  PID:9124
- C:\Windows\System\zBrlVvu.exe
  C:\Windows\System\zBrlVvu.exe
  2⤵
  PID:8204
- C:\Windows\System\XvcRItn.exe
  C:\Windows\System\XvcRItn.exe
  2⤵
  PID:7252
- C:\Windows\System\ISLMCFY.exe
  C:\Windows\System\ISLMCFY.exe
  2⤵
  PID:8536
- C:\Windows\System\aQjVxmO.exe
  C:\Windows\System\aQjVxmO.exe
  2⤵
  PID:8648
- C:\Windows\System\fZTRKKd.exe
  C:\Windows\System\fZTRKKd.exe
  2⤵
  PID:8852
- C:\Windows\System\oAQvnaR.exe
  C:\Windows\System\oAQvnaR.exe
  2⤵
  PID:9132
- C:\Windows\System\WsObIIx.exe
  C:\Windows\System\WsObIIx.exe
  2⤵
  PID:7744
- C:\Windows\System\cRYuVtq.exe
  C:\Windows\System\cRYuVtq.exe
  2⤵
  PID:9212
- C:\Windows\System\jJWHRjl.exe
  C:\Windows\System\jJWHRjl.exe
  2⤵
  PID:8764
- C:\Windows\System\cwqXoEL.exe
  C:\Windows\System\cwqXoEL.exe
  2⤵
  PID:8816
- C:\Windows\System\xdzOVAM.exe
  C:\Windows\System\xdzOVAM.exe
  2⤵
  PID:8864
- C:\Windows\System\wXekPOE.exe
  C:\Windows\System\wXekPOE.exe
  2⤵
  PID:8540
- C:\Windows\System\bsZAaYO.exe
  C:\Windows\System\bsZAaYO.exe
  2⤵
  PID:9248
- C:\Windows\System\mUzLynq.exe
  C:\Windows\System\mUzLynq.exe
  2⤵
  PID:9276
- C:\Windows\System\WgrRQEo.exe
  C:\Windows\System\WgrRQEo.exe
  2⤵
  PID:9296
- C:\Windows\System\eicwAWO.exe
  C:\Windows\System\eicwAWO.exe
  2⤵
  PID:9320
- C:\Windows\System\vMTLIcZ.exe
  C:\Windows\System\vMTLIcZ.exe
  2⤵
  PID:9348
- C:\Windows\System\LlGUSOZ.exe
  C:\Windows\System\LlGUSOZ.exe
  2⤵
  PID:9368
- C:\Windows\System\eQXruRN.exe
  C:\Windows\System\eQXruRN.exe
  2⤵
  PID:9400
- C:\Windows\System\wzXCXrb.exe
  C:\Windows\System\wzXCXrb.exe
  2⤵
  PID:9424
- C:\Windows\System\CNHbjfn.exe
  C:\Windows\System\CNHbjfn.exe
  2⤵
  PID:9440
- C:\Windows\System\ulInXFW.exe
  C:\Windows\System\ulInXFW.exe
  2⤵
  PID:9468
- C:\Windows\System\nzzPrYE.exe
  C:\Windows\System\nzzPrYE.exe
  2⤵
  PID:9496
- C:\Windows\System\zhUYEei.exe
  C:\Windows\System\zhUYEei.exe
  2⤵
  PID:9528
- C:\Windows\System\gNeuERC.exe
  C:\Windows\System\gNeuERC.exe
  2⤵
  PID:9572
- C:\Windows\System\fbBtOqY.exe
  C:\Windows\System\fbBtOqY.exe
  2⤵
  PID:9648
- C:\Windows\System\tkyPKkq.exe
  C:\Windows\System\tkyPKkq.exe
  2⤵
  PID:9664
- C:\Windows\System\ZDyJhsJ.exe
  C:\Windows\System\ZDyJhsJ.exe
  2⤵
  PID:9696
- C:\Windows\System\zYRxJZi.exe
  C:\Windows\System\zYRxJZi.exe
  2⤵
  PID:9720
- C:\Windows\System\ZcCvQvB.exe
  C:\Windows\System\ZcCvQvB.exe
  2⤵
  PID:9760
- C:\Windows\System\dxtrQPy.exe
  C:\Windows\System\dxtrQPy.exe
  2⤵
  PID:9776
- C:\Windows\System\stdZqQF.exe
  C:\Windows\System\stdZqQF.exe
  2⤵
  PID:9816
- C:\Windows\System\RMsnHoA.exe
  C:\Windows\System\RMsnHoA.exe
  2⤵
  PID:9844
- C:\Windows\System\MxSBPxg.exe
  C:\Windows\System\MxSBPxg.exe
  2⤵
  PID:9864
- C:\Windows\System\hrMdAHY.exe
  C:\Windows\System\hrMdAHY.exe
  2⤵
  PID:9892
- C:\Windows\System\QNsQszg.exe
  C:\Windows\System\QNsQszg.exe
  2⤵
  PID:9912
- C:\Windows\System\MXnXfXU.exe
  C:\Windows\System\MXnXfXU.exe
  2⤵
  PID:9928
- C:\Windows\System\QKhPqps.exe
  C:\Windows\System\QKhPqps.exe
  2⤵
  PID:9964
- C:\Windows\System\zpcSCsF.exe
  C:\Windows\System\zpcSCsF.exe
  2⤵
  PID:10016
- C:\Windows\System\dltIHUp.exe
  C:\Windows\System\dltIHUp.exe
  2⤵
  PID:10044
- C:\Windows\System\JsWSKMo.exe
  C:\Windows\System\JsWSKMo.exe
  2⤵
  PID:10072
- C:\Windows\System\CzlJwBm.exe
  C:\Windows\System\CzlJwBm.exe
  2⤵
  PID:10088
- C:\Windows\System\HaaCxwZ.exe
  C:\Windows\System\HaaCxwZ.exe
  2⤵
  PID:10116
- C:\Windows\System\CooEtGr.exe
  C:\Windows\System\CooEtGr.exe
  2⤵
  PID:10132
- C:\Windows\System\wZqMfLJ.exe
  C:\Windows\System\wZqMfLJ.exe
  2⤵
  PID:10176
- C:\Windows\System\zkrjozG.exe
  C:\Windows\System\zkrjozG.exe
  2⤵
  PID:10212
- C:\Windows\System\GNzWcJm.exe
  C:\Windows\System\GNzWcJm.exe
  2⤵
  PID:10228
- C:\Windows\System\mjEdFxX.exe
  C:\Windows\System\mjEdFxX.exe
  2⤵
  PID:9260
- C:\Windows\System\ACxQUFh.exe
  C:\Windows\System\ACxQUFh.exe
  2⤵
  PID:9316
- C:\Windows\System\tZWfZKq.exe
  C:\Windows\System\tZWfZKq.exe
  2⤵
  PID:9344
- C:\Windows\System\fIjETrB.exe
  C:\Windows\System\fIjETrB.exe
  2⤵
  PID:9464
- C:\Windows\System\WkkrVca.exe
  C:\Windows\System\WkkrVca.exe
  2⤵
  PID:9512
- C:\Windows\System\CjkDSeG.exe
  C:\Windows\System\CjkDSeG.exe
  2⤵
  PID:9608
- C:\Windows\System\VIwGQPB.exe
  C:\Windows\System\VIwGQPB.exe
  2⤵
  PID:9684
- C:\Windows\System\pioJJYD.exe
  C:\Windows\System\pioJJYD.exe
  2⤵
  PID:9772
- C:\Windows\System\uCvKHpg.exe
  C:\Windows\System\uCvKHpg.exe
  2⤵
  PID:9804
- C:\Windows\System\muvbBqv.exe
  C:\Windows\System\muvbBqv.exe
  2⤵
  PID:9852
- C:\Windows\System\leFAhFJ.exe
  C:\Windows\System\leFAhFJ.exe
  2⤵
  PID:9900
- C:\Windows\System\lEoYxtn.exe
  C:\Windows\System\lEoYxtn.exe
  2⤵
  PID:9984
- C:\Windows\System\lODLJjM.exe
  C:\Windows\System\lODLJjM.exe
  2⤵
  PID:10064
- C:\Windows\System\BAXXPez.exe
  C:\Windows\System\BAXXPez.exe
  2⤵
  PID:10124
- C:\Windows\System\YMalyRX.exe
  C:\Windows\System\YMalyRX.exe
  2⤵
  PID:10184
- C:\Windows\System\bYlTOkd.exe
  C:\Windows\System\bYlTOkd.exe
  2⤵
  PID:9232
- C:\Windows\System\yhzICkl.exe
  C:\Windows\System\yhzICkl.exe
  2⤵
  PID:9436
- C:\Windows\System\HObTnPn.exe
  C:\Windows\System\HObTnPn.exe
  2⤵
  PID:9492
- C:\Windows\System\CWXRFAj.exe
  C:\Windows\System\CWXRFAj.exe
  2⤵
  PID:9656
- C:\Windows\System\ooFJOAC.exe
  C:\Windows\System\ooFJOAC.exe
  2⤵
  PID:9832
- C:\Windows\System\OoLMOhS.exe
  C:\Windows\System\OoLMOhS.exe
  2⤵
  PID:9960
- C:\Windows\System\cyYGkNq.exe
  C:\Windows\System\cyYGkNq.exe
  2⤵
  PID:10152
- C:\Windows\System\uonUpMz.exe
  C:\Windows\System\uonUpMz.exe
  2⤵
  PID:9292
- C:\Windows\System\lKBKiTN.exe
  C:\Windows\System\lKBKiTN.exe
  2⤵
  PID:9884
- C:\Windows\System\YACTIXf.exe
  C:\Windows\System\YACTIXf.exe
  2⤵
  PID:10168
- C:\Windows\System\YbyhTiX.exe
  C:\Windows\System\YbyhTiX.exe
  2⤵
  PID:10200
- C:\Windows\System\fpqvmSp.exe
  C:\Windows\System\fpqvmSp.exe
  2⤵
  PID:10248
- C:\Windows\System\lkJldWE.exe
  C:\Windows\System\lkJldWE.exe
  2⤵
  PID:10264
- C:\Windows\System\ZauoIqk.exe
  C:\Windows\System\ZauoIqk.exe
  2⤵
  PID:10280
- C:\Windows\System\xWKiHTx.exe
  C:\Windows\System\xWKiHTx.exe
  2⤵
  PID:10296
- C:\Windows\System\PnLbWuO.exe
  C:\Windows\System\PnLbWuO.exe
  2⤵
  PID:10312
- C:\Windows\System\JFVfdtt.exe
  C:\Windows\System\JFVfdtt.exe
  2⤵
  PID:10336
- C:\Windows\System\MLdPIBD.exe
  C:\Windows\System\MLdPIBD.exe
  2⤵
  PID:10352
- C:\Windows\System\fhSasnU.exe
  C:\Windows\System\fhSasnU.exe
  2⤵
  PID:10380
- C:\Windows\System\VqbflnW.exe
  C:\Windows\System\VqbflnW.exe
  2⤵
  PID:10404
- C:\Windows\System\nUQLXqR.exe
  C:\Windows\System\nUQLXqR.exe
  2⤵
  PID:10448
- C:\Windows\System\mbSCMLQ.exe
  C:\Windows\System\mbSCMLQ.exe
  2⤵
  PID:10476
- C:\Windows\System\PnNijzZ.exe
  C:\Windows\System\PnNijzZ.exe
  2⤵
  PID:10540
- C:\Windows\System\esHMkSK.exe
  C:\Windows\System\esHMkSK.exe
  2⤵
  PID:10568
- C:\Windows\System\dmsxbJM.exe
  C:\Windows\System\dmsxbJM.exe
  2⤵
  PID:10596
- C:\Windows\System\dgPqcBi.exe
  C:\Windows\System\dgPqcBi.exe
  2⤵
  PID:10640
- C:\Windows\System\mMhFyor.exe
  C:\Windows\System\mMhFyor.exe
  2⤵
  PID:10660
- C:\Windows\System\ZoxrAOZ.exe
  C:\Windows\System\ZoxrAOZ.exe
  2⤵
  PID:10684
- C:\Windows\System\oEbvIPP.exe
  C:\Windows\System\oEbvIPP.exe
  2⤵
  PID:10712
- C:\Windows\System\kvePSKw.exe
  C:\Windows\System\kvePSKw.exe
  2⤵
  PID:10740
- C:\Windows\System\hclCBqL.exe
  C:\Windows\System\hclCBqL.exe
  2⤵
  PID:10768
- C:\Windows\System\XJEyjEq.exe
  C:\Windows\System\XJEyjEq.exe
  2⤵
  PID:10784
- C:\Windows\System\KvkgbCR.exe
  C:\Windows\System\KvkgbCR.exe
  2⤵
  PID:10800
- C:\Windows\System\duAKNbD.exe
  C:\Windows\System\duAKNbD.exe
  2⤵
  PID:10828
- C:\Windows\System\cePnIly.exe
  C:\Windows\System\cePnIly.exe
  2⤵
  PID:10852
- C:\Windows\System\fmzKKzY.exe
  C:\Windows\System\fmzKKzY.exe
  2⤵
  PID:10900
- C:\Windows\System\NTaBZEY.exe
  C:\Windows\System\NTaBZEY.exe
  2⤵
  PID:10952
- C:\Windows\System\NnlAXeR.exe
  C:\Windows\System\NnlAXeR.exe
  2⤵
  PID:10976
- C:\Windows\System\vodBPno.exe
  C:\Windows\System\vodBPno.exe
  2⤵
  PID:11004
- C:\Windows\System\jqOSuPq.exe
  C:\Windows\System\jqOSuPq.exe
  2⤵
  PID:11024
- C:\Windows\System\CFlSelL.exe
  C:\Windows\System\CFlSelL.exe
  2⤵
  PID:11048
- C:\Windows\System\ZuLFmVL.exe
  C:\Windows\System\ZuLFmVL.exe
  2⤵
  PID:11080
- C:\Windows\System\zlTIyDk.exe
  C:\Windows\System\zlTIyDk.exe
  2⤵
  PID:11108
- C:\Windows\System\UgIUtpE.exe
  C:\Windows\System\UgIUtpE.exe
  2⤵
  PID:11144
- C:\Windows\System\EUvCUbp.exe
  C:\Windows\System\EUvCUbp.exe
  2⤵
  PID:11164
- C:\Windows\System\efzuuDo.exe
  C:\Windows\System\efzuuDo.exe
  2⤵
  PID:11192
- C:\Windows\System\BkYmMwm.exe
  C:\Windows\System\BkYmMwm.exe
  2⤵
  PID:11244
- C:\Windows\System\AUrrQcT.exe
  C:\Windows\System\AUrrQcT.exe
  2⤵
  PID:11260
- C:\Windows\System\jLtrdcH.exe
  C:\Windows\System\jLtrdcH.exe
  2⤵
  PID:10256
- C:\Windows\System\ZvXeQEz.exe
  C:\Windows\System\ZvXeQEz.exe
  2⤵
  PID:10328
- C:\Windows\System\bDSlVlI.exe
  C:\Windows\System\bDSlVlI.exe
  2⤵
  PID:10396
- C:\Windows\System\TMIPeeN.exe
  C:\Windows\System\TMIPeeN.exe
  2⤵
  PID:10460
- C:\Windows\System\TIfwoiy.exe
  C:\Windows\System\TIfwoiy.exe
  2⤵
  PID:10556
- C:\Windows\System\ATdADTZ.exe
  C:\Windows\System\ATdADTZ.exe
  2⤵
  PID:10628
- C:\Windows\System\FsJfVPj.exe
  C:\Windows\System\FsJfVPj.exe
  2⤵
  PID:10680
- C:\Windows\System\nuxBkQp.exe
  C:\Windows\System\nuxBkQp.exe
  2⤵
  PID:10732
- C:\Windows\System\YoqsOER.exe
  C:\Windows\System\YoqsOER.exe
  2⤵
  PID:10780
- C:\Windows\System\gnaMMCZ.exe
  C:\Windows\System\gnaMMCZ.exe
  2⤵
  PID:10888
- C:\Windows\System\lHjHNta.exe
  C:\Windows\System\lHjHNta.exe
  2⤵
  PID:10964
- C:\Windows\System\SvQQvLT.exe
  C:\Windows\System\SvQQvLT.exe
  2⤵
  PID:10996
- C:\Windows\System\SDKnBtL.exe
  C:\Windows\System\SDKnBtL.exe
  2⤵
  PID:11016
- C:\Windows\System\fOioqeA.exe
  C:\Windows\System\fOioqeA.exe
  2⤵
  PID:11128
- C:\Windows\System\OSPMoFh.exe
  C:\Windows\System\OSPMoFh.exe
  2⤵
  PID:11208
- C:\Windows\System\yCRAWAp.exe
  C:\Windows\System\yCRAWAp.exe
  2⤵
  PID:11252
- C:\Windows\System\SHHWDko.exe
  C:\Windows\System\SHHWDko.exe
  2⤵
  PID:10304
- C:\Windows\System\JeUTXEC.exe
  C:\Windows\System\JeUTXEC.exe
  2⤵
  PID:10444
- C:\Windows\System\YYNjMtc.exe
  C:\Windows\System\YYNjMtc.exe
  2⤵
  PID:10764
- C:\Windows\System\hOZmxRl.exe
  C:\Windows\System\hOZmxRl.exe
  2⤵
  PID:10860
- C:\Windows\System\DYGCoPH.exe
  C:\Windows\System\DYGCoPH.exe
  2⤵
  PID:10972
- C:\Windows\System\Mdhsqet.exe
  C:\Windows\System\Mdhsqet.exe
  2⤵
  PID:11096
- C:\Windows\System\ZBgmIdp.exe
  C:\Windows\System\ZBgmIdp.exe
  2⤵
  PID:10288
- C:\Windows\System\jzKMPTU.exe
  C:\Windows\System\jzKMPTU.exe
  2⤵
  PID:10548
- C:\Windows\System\MwzyoYa.exe
  C:\Windows\System\MwzyoYa.exe
  2⤵
  PID:10932
- C:\Windows\System\TuUDMeG.exe
  C:\Windows\System\TuUDMeG.exe
  2⤵
  PID:10700
- C:\Windows\System\auskkLK.exe
  C:\Windows\System\auskkLK.exe
  2⤵
  PID:10960
- C:\Windows\System\MmDsiin.exe
  C:\Windows\System\MmDsiin.exe
  2⤵
  PID:11284
- C:\Windows\System\zGTnCxj.exe
  C:\Windows\System\zGTnCxj.exe
  2⤵
  PID:11308
- C:\Windows\System\QpcysFB.exe
  C:\Windows\System\QpcysFB.exe
  2⤵
  PID:11336
- C:\Windows\System\BTLQtDz.exe
  C:\Windows\System\BTLQtDz.exe
  2⤵
  PID:11368
- C:\Windows\System\fsubPpz.exe
  C:\Windows\System\fsubPpz.exe
  2⤵
  PID:11388
- C:\Windows\System\cYyXuhN.exe
  C:\Windows\System\cYyXuhN.exe
  2⤵
  PID:11448
- C:\Windows\System\xHShRsP.exe
  C:\Windows\System\xHShRsP.exe
  2⤵
  PID:11468
- C:\Windows\System\UiexYoC.exe
  C:\Windows\System\UiexYoC.exe
  2⤵
  PID:11492
- C:\Windows\System\sjqcTXz.exe
  C:\Windows\System\sjqcTXz.exe
  2⤵
  PID:11520
- C:\Windows\System\PGRqwws.exe
  C:\Windows\System\PGRqwws.exe
  2⤵
  PID:11540
- C:\Windows\System\FEgbQdS.exe
  C:\Windows\System\FEgbQdS.exe
  2⤵
  PID:11560
- C:\Windows\System\LfAExsh.exe
  C:\Windows\System\LfAExsh.exe
  2⤵
  PID:11616
- C:\Windows\System\Fyqhnkx.exe
  C:\Windows\System\Fyqhnkx.exe
  2⤵
  PID:11632
- C:\Windows\System\kWcFWJY.exe
  C:\Windows\System\kWcFWJY.exe
  2⤵
  PID:11660
- C:\Windows\System\HKzDJIV.exe
  C:\Windows\System\HKzDJIV.exe
  2⤵
  PID:11688
- C:\Windows\System\xTTqLfQ.exe
  C:\Windows\System\xTTqLfQ.exe
  2⤵
  PID:11704
- C:\Windows\System\cOjfJgO.exe
  C:\Windows\System\cOjfJgO.exe
  2⤵
  PID:11728
- C:\Windows\System\iSjDrPS.exe
  C:\Windows\System\iSjDrPS.exe
  2⤵
  PID:11784
- C:\Windows\System\JcAbfub.exe
  C:\Windows\System\JcAbfub.exe
  2⤵
  PID:11800
- C:\Windows\System\ieZzHfW.exe
  C:\Windows\System\ieZzHfW.exe
  2⤵
  PID:11816
- C:\Windows\System\EUDFHWt.exe
  C:\Windows\System\EUDFHWt.exe
  2⤵
  PID:11856
- C:\Windows\System\wLFWsrN.exe
  C:\Windows\System\wLFWsrN.exe
  2⤵
  PID:11876
- C:\Windows\System\OXHaQjX.exe
  C:\Windows\System\OXHaQjX.exe
  2⤵
  PID:11908
- C:\Windows\System\jgEdRIz.exe
  C:\Windows\System\jgEdRIz.exe
  2⤵
  PID:11952
- C:\Windows\System\IYxYQbD.exe
  C:\Windows\System\IYxYQbD.exe
  2⤵
  PID:11968
- C:\Windows\System\XBHawmN.exe
  C:\Windows\System\XBHawmN.exe
  2⤵
  PID:12008
- C:\Windows\System\YWsZpTb.exe
  C:\Windows\System\YWsZpTb.exe
  2⤵
  PID:12036
- C:\Windows\System\FPcjRbi.exe
  C:\Windows\System\FPcjRbi.exe
  2⤵
  PID:12064
- C:\Windows\System\yEggXiV.exe
  C:\Windows\System\yEggXiV.exe
  2⤵
  PID:12080
- C:\Windows\System\DtzjtOJ.exe
  C:\Windows\System\DtzjtOJ.exe
  2⤵
  PID:12096
- C:\Windows\System\jFlJyPI.exe
  C:\Windows\System\jFlJyPI.exe
  2⤵
  PID:12144
- C:\Windows\System\hPatFEJ.exe
  C:\Windows\System\hPatFEJ.exe
  2⤵
  PID:12164
- C:\Windows\System\PBxoJrS.exe
  C:\Windows\System\PBxoJrS.exe
  2⤵
  PID:12192
- C:\Windows\System\AFDWnuG.exe
  C:\Windows\System\AFDWnuG.exe
  2⤵
  PID:12220
- C:\Windows\System\rHQHdvk.exe
  C:\Windows\System\rHQHdvk.exe
  2⤵
  PID:12264
- C:\Windows\System\FKVfreo.exe
  C:\Windows\System\FKVfreo.exe
  2⤵
  PID:10708
- C:\Windows\System\Ybqfmei.exe
  C:\Windows\System\Ybqfmei.exe
  2⤵
  PID:11268
- C:\Windows\System\hKdBtNL.exe
  C:\Windows\System\hKdBtNL.exe
  2⤵
  PID:11300
- C:\Windows\System\oGCajLO.exe
  C:\Windows\System\oGCajLO.exe
  2⤵
  PID:11412
- C:\Windows\System\voqDQwm.exe
  C:\Windows\System\voqDQwm.exe
  2⤵
  PID:11504
- C:\Windows\System\zAJopBQ.exe
  C:\Windows\System\zAJopBQ.exe
  2⤵
  PID:11548
- C:\Windows\System\KsYXKGF.exe
  C:\Windows\System\KsYXKGF.exe
  2⤵
  PID:11612
- C:\Windows\System\oazmBpJ.exe
  C:\Windows\System\oazmBpJ.exe
  2⤵
  PID:11648
- C:\Windows\System\vodfRsK.exe
  C:\Windows\System\vodfRsK.exe
  2⤵
  PID:11720
- C:\Windows\System\XTuwmab.exe
  C:\Windows\System\XTuwmab.exe
  2⤵
  PID:11808
- C:\Windows\System\ruKlXwX.exe
  C:\Windows\System\ruKlXwX.exe
  2⤵
  PID:11896
- C:\Windows\System\taFNpXR.exe
  C:\Windows\System\taFNpXR.exe
  2⤵
  PID:11964
- C:\Windows\System\ZVaQjil.exe
  C:\Windows\System\ZVaQjil.exe
  2⤵
  PID:12032
- C:\Windows\System\nySTASY.exe
  C:\Windows\System\nySTASY.exe
  2⤵
  PID:12072
- C:\Windows\System\OxhRvyx.exe
  C:\Windows\System\OxhRvyx.exe
  2⤵
  PID:12136
- C:\Windows\System\qXHiKIP.exe
  C:\Windows\System\qXHiKIP.exe
  2⤵
  PID:12208
- C:\Windows\System\jFzJaNV.exe
  C:\Windows\System\jFzJaNV.exe
  2⤵
  PID:12276
- C:\Windows\System\mrnTDki.exe
  C:\Windows\System\mrnTDki.exe
  2⤵
  PID:11328
- C:\Windows\System\jvfjYPA.exe
  C:\Windows\System\jvfjYPA.exe
  2⤵
  PID:11396
- C:\Windows\System\ANmFVgS.exe
  C:\Windows\System\ANmFVgS.exe
  2⤵
  PID:11552
- C:\Windows\System\yOtwIqS.exe
  C:\Windows\System\yOtwIqS.exe
  2⤵
  PID:11840
- C:\Windows\System\iOFNhpu.exe
  C:\Windows\System\iOFNhpu.exe
  2⤵
  PID:11940
- C:\Windows\System\loQqrwe.exe
  C:\Windows\System\loQqrwe.exe
  2⤵
  PID:12116
- C:\Windows\System\fXyGWjR.exe
  C:\Windows\System\fXyGWjR.exe
  2⤵
  PID:12244
- C:\Windows\System\QcxGkub.exe
  C:\Windows\System\QcxGkub.exe
  2⤵
  PID:11296
- C:\Windows\System\QVaJrWC.exe
  C:\Windows\System\QVaJrWC.exe
  2⤵
  PID:11756
- C:\Windows\System\FyXtUQS.exe
  C:\Windows\System\FyXtUQS.exe
  2⤵
  PID:12108
- C:\Windows\System\dnaTZKj.exe
  C:\Windows\System\dnaTZKj.exe
  2⤵
  PID:11584
- C:\Windows\System\xGYxhwN.exe
  C:\Windows\System\xGYxhwN.exe
  2⤵
  PID:12316
- C:\Windows\System\ZnHzKCy.exe
  C:\Windows\System\ZnHzKCy.exe
  2⤵
  PID:12348
- C:\Windows\System\lyGNglH.exe
  C:\Windows\System\lyGNglH.exe
  2⤵
  PID:12372
- C:\Windows\System\TSTVvWh.exe
  C:\Windows\System\TSTVvWh.exe
  2⤵
  PID:12400
- C:\Windows\System\UWZJEWe.exe
  C:\Windows\System\UWZJEWe.exe
  2⤵
  PID:12432
- C:\Windows\System\WUGPNeb.exe
  C:\Windows\System\WUGPNeb.exe
  2⤵
  PID:12460
- C:\Windows\System\ZrdYqva.exe
  C:\Windows\System\ZrdYqva.exe
  2⤵
  PID:12500
- C:\Windows\System\JxMnnPB.exe
  C:\Windows\System\JxMnnPB.exe
  2⤵
  PID:12520
- C:\Windows\System\rTxLLxx.exe
  C:\Windows\System\rTxLLxx.exe
  2⤵
  PID:12556
- C:\Windows\System\cibDcNJ.exe
  C:\Windows\System\cibDcNJ.exe
  2⤵
  PID:12572
- C:\Windows\System\BbZZiKI.exe
  C:\Windows\System\BbZZiKI.exe
  2⤵
  PID:12588
- C:\Windows\System\mukPDGf.exe
  C:\Windows\System\mukPDGf.exe
  2⤵
  PID:12616
- C:\Windows\System\vWqRreb.exe
  C:\Windows\System\vWqRreb.exe
  2⤵
  PID:12668
- C:\Windows\System\ziSBvLm.exe
  C:\Windows\System\ziSBvLm.exe
  2⤵
  PID:12684
- C:\Windows\System\YTNvFcN.exe
  C:\Windows\System\YTNvFcN.exe
  2⤵
  PID:12716
- C:\Windows\System\cyKAgYS.exe
  C:\Windows\System\cyKAgYS.exe
  2⤵
  PID:12740
- C:\Windows\System\qTOlMog.exe
  C:\Windows\System\qTOlMog.exe
  2⤵
  PID:12764
- C:\Windows\System\ABTEiFA.exe
  C:\Windows\System\ABTEiFA.exe
  2⤵
  PID:12800
- C:\Windows\System\kbATIEj.exe
  C:\Windows\System\kbATIEj.exe
  2⤵
  PID:12824
- C:\Windows\System\mFwxPhz.exe
  C:\Windows\System\mFwxPhz.exe
  2⤵
  PID:12844
- C:\Windows\System\OLNLtdD.exe
  C:\Windows\System\OLNLtdD.exe
  2⤵
  PID:12872
- C:\Windows\System\weWDdEP.exe
  C:\Windows\System\weWDdEP.exe
  2⤵
  PID:12904
- C:\Windows\System\zPBpUvg.exe
  C:\Windows\System\zPBpUvg.exe
  2⤵
  PID:12944
- C:\Windows\System\SCfWNkK.exe
  C:\Windows\System\SCfWNkK.exe
  2⤵
  PID:12968
- C:\Windows\System\AjbhdqB.exe
  C:\Windows\System\AjbhdqB.exe
  2⤵
  PID:12992
- C:\Windows\System\FTGPpye.exe
  C:\Windows\System\FTGPpye.exe
  2⤵
  PID:13020
- C:\Windows\System\ZxNKnZB.exe
  C:\Windows\System\ZxNKnZB.exe
  2⤵
  PID:13060
- C:\Windows\System\rCOrhqN.exe
  C:\Windows\System\rCOrhqN.exe
  2⤵
  PID:13080
- C:\Windows\System\OwOhQsT.exe
  C:\Windows\System\OwOhQsT.exe
  2⤵
  PID:13104
- C:\Windows\System\QVBqpmu.exe
  C:\Windows\System\QVBqpmu.exe
  2⤵
  PID:13132
- C:\Windows\System\cegeXVs.exe
  C:\Windows\System\cegeXVs.exe
  2⤵
  PID:13156
- C:\Windows\System\IsXsQNm.exe
  C:\Windows\System\IsXsQNm.exe
  2⤵
  PID:13188
- C:\Windows\System\JFgirzy.exe
  C:\Windows\System\JFgirzy.exe
  2⤵
  PID:13228
- C:\Windows\System\bHEapbN.exe
  C:\Windows\System\bHEapbN.exe
  2⤵
  PID:13256
- C:\Windows\System\XNUKEWW.exe
  C:\Windows\System\XNUKEWW.exe
  2⤵
  PID:13284
- C:\Windows\System\JwDtsWM.exe
  C:\Windows\System\JwDtsWM.exe
  2⤵
  PID:13304
- C:\Windows\System\oveBrsN.exe
  C:\Windows\System\oveBrsN.exe
  2⤵
  PID:12160
- C:\Windows\System\DxmWFkL.exe
  C:\Windows\System\DxmWFkL.exe
  2⤵
  PID:12304
- C:\Windows\System\JlmWssE.exe
  C:\Windows\System\JlmWssE.exe
  2⤵
  PID:12420
- C:\Windows\System\xoSecfP.exe
  C:\Windows\System\xoSecfP.exe
  2⤵
  PID:12492
- C:\Windows\System\oGXQjul.exe
  C:\Windows\System\oGXQjul.exe
  2⤵
  PID:12540
- C:\Windows\System\zZjrYvQ.exe
  C:\Windows\System\zZjrYvQ.exe
  2⤵
  PID:12608
- C:\Windows\System\ZCRCFjj.exe
  C:\Windows\System\ZCRCFjj.exe
  2⤵
  PID:12652
- C:\Windows\System\diIaedJ.exe
  C:\Windows\System\diIaedJ.exe
  2⤵
  PID:12708
- C:\Windows\System\UOevWKX.exe
  C:\Windows\System\UOevWKX.exe
  2⤵
  PID:12808
- C:\Windows\System\vrQJghX.exe
  C:\Windows\System\vrQJghX.exe
  2⤵
  PID:12840
- C:\Windows\System\EZsoXFK.exe
  C:\Windows\System\EZsoXFK.exe
  2⤵
  PID:12896
- C:\Windows\System\mvlxoFn.exe
  C:\Windows\System\mvlxoFn.exe
  2⤵
  PID:12964
- C:\Windows\System\evXTpjP.exe
  C:\Windows\System\evXTpjP.exe
  2⤵
  PID:13100
- C:\Windows\System\utxTcJa.exe
  C:\Windows\System\utxTcJa.exe
  2⤵
  PID:12256
- C:\Windows\System\FJoiCTl.exe
  C:\Windows\System\FJoiCTl.exe
  2⤵
  PID:13184
- C:\Windows\System\Wtjvacb.exe
  C:\Windows\System\Wtjvacb.exe
  2⤵
  PID:13244
- C:\Windows\System\SYAxBpQ.exe
  C:\Windows\System\SYAxBpQ.exe
  2⤵
  PID:12176
- C:\Windows\System\OaWFVhI.exe
  C:\Windows\System\OaWFVhI.exe
  2⤵
  PID:12428
- C:\Windows\System\hnCNcsj.exe
  C:\Windows\System\hnCNcsj.exe
  2⤵
  PID:12632
- C:\Windows\System\NsnaEiD.exe
  C:\Windows\System\NsnaEiD.exe
  2⤵
  PID:12628
- C:\Windows\System\GpPefZo.exe
  C:\Windows\System\GpPefZo.exe
  2⤵
  PID:12832
- C:\Windows\System\YTTWkDb.exe
  C:\Windows\System\YTTWkDb.exe
  2⤵
  PID:12940
- C:\Windows\System\aFiZslL.exe
  C:\Windows\System\aFiZslL.exe
  2⤵
  PID:13056
- C:\Windows\System\PREhYWx.exe
  C:\Windows\System\PREhYWx.exe
  2⤵
  PID:13292
- C:\Windows\System\LtphNrz.exe
  C:\Windows\System\LtphNrz.exe
  2⤵
  PID:12700
- C:\Windows\System\nJdJIaq.exe
  C:\Windows\System\nJdJIaq.exe
  2⤵
  PID:12868
- C:\Windows\System\DFQwkae.exe
  C:\Windows\System\DFQwkae.exe
  2⤵
  PID:13216
- C:\Windows\System\mXkyjqX.exe
  C:\Windows\System\mXkyjqX.exe
  2⤵
  PID:12792
- C:\Windows\System\ynOAweQ.exe
  C:\Windows\System\ynOAweQ.exe
  2⤵
  PID:13320
- C:\Windows\System\EFhQlMw.exe
  C:\Windows\System\EFhQlMw.exe
  2⤵
  PID:13340
- C:\Windows\System\SpZKjpa.exe
  C:\Windows\System\SpZKjpa.exe
  2⤵
  PID:13368
- C:\Windows\System\UOJqFue.exe
  C:\Windows\System\UOJqFue.exe
  2⤵
  PID:13388
- C:\Windows\System\XkSqwzo.exe
  C:\Windows\System\XkSqwzo.exe
  2⤵
  PID:13412
- C:\Windows\System\FnyeEeJ.exe
  C:\Windows\System\FnyeEeJ.exe
  2⤵
  PID:13440
- C:\Windows\System\TqCHdcS.exe
  C:\Windows\System\TqCHdcS.exe
  2⤵
  PID:13476
- C:\Windows\System\YKJRjfJ.exe
  C:\Windows\System\YKJRjfJ.exe
  2⤵
  PID:13504
- C:\Windows\System\zRKaqwD.exe
  C:\Windows\System\zRKaqwD.exe
  2⤵
  PID:13544
- C:\Windows\System\hZfThmK.exe
  C:\Windows\System\hZfThmK.exe
  2⤵
  PID:13576
- C:\Windows\System\DyycWdi.exe
  C:\Windows\System\DyycWdi.exe
  2⤵
  PID:13620
- C:\Windows\System\jgqnteR.exe
  C:\Windows\System\jgqnteR.exe
  2⤵
  PID:13636
- C:\Windows\System\ybBnnEE.exe
  C:\Windows\System\ybBnnEE.exe
  2⤵
  PID:13656
- C:\Windows\System\odJdsax.exe
  C:\Windows\System\odJdsax.exe
  2⤵
  PID:13676
- C:\Windows\System\isACmxN.exe
  C:\Windows\System\isACmxN.exe
  2⤵
  PID:13704
- C:\Windows\System\LlRMTYN.exe
  C:\Windows\System\LlRMTYN.exe
  2⤵
  PID:13724
- C:\Windows\System\IUQBbDR.exe
  C:\Windows\System\IUQBbDR.exe
  2⤵
  PID:13748
- C:\Windows\System\loubaVa.exe
  C:\Windows\System\loubaVa.exe
  2⤵
  PID:13784
- C:\Windows\System\QGZOFNX.exe
  C:\Windows\System\QGZOFNX.exe
  2⤵
  PID:13804
- C:\Windows\System\NDjsmDS.exe
  C:\Windows\System\NDjsmDS.exe
  2⤵
  PID:13840
- C:\Windows\System\xfObtUu.exe
  C:\Windows\System\xfObtUu.exe
  2⤵
  PID:13888
- C:\Windows\System\EixVXTO.exe
  C:\Windows\System\EixVXTO.exe
  2⤵
  PID:13912
- C:\Windows\System\gwyrwaI.exe
  C:\Windows\System\gwyrwaI.exe
  2⤵
  PID:13932
- C:\Windows\System\FvHymBS.exe
  C:\Windows\System\FvHymBS.exe
  2⤵
  PID:13960
- C:\Windows\System\mWhHwGK.exe
  C:\Windows\System\mWhHwGK.exe
  2⤵
  PID:14000
- C:\Windows\System\fmdZNgh.exe
  C:\Windows\System\fmdZNgh.exe
  2⤵
  PID:14024
- C:\Windows\System\iAXRIEP.exe
  C:\Windows\System\iAXRIEP.exe
  2⤵
  PID:14048
- C:\Windows\System\oiFrScS.exe
  C:\Windows\System\oiFrScS.exe
  2⤵
  PID:14072
- C:\Windows\System\XlFCwuK.exe
  C:\Windows\System\XlFCwuK.exe
  2⤵
  PID:14096
- C:\Windows\System\xRDsYem.exe
  C:\Windows\System\xRDsYem.exe
  2⤵
  PID:14128
- C:\Windows\System\PoTzAHm.exe
  C:\Windows\System\PoTzAHm.exe
  2⤵
  PID:14156
- C:\Windows\System\dgSMivy.exe
  C:\Windows\System\dgSMivy.exe
  2⤵
  PID:14172
- C:\Windows\System\CnrOIdj.exe
  C:\Windows\System\CnrOIdj.exe
  2⤵
  PID:14204
- C:\Windows\System\lSNxfDs.exe
  C:\Windows\System\lSNxfDs.exe
  2⤵
  PID:14224
- C:\Windows\System\KPppVbw.exe
  C:\Windows\System\KPppVbw.exe
  2⤵
  PID:14256
- C:\Windows\System\MJgcyLZ.exe
  C:\Windows\System\MJgcyLZ.exe
  2⤵
  PID:14292
- C:\Windows\System\qmsSkfE.exe
  C:\Windows\System\qmsSkfE.exe
  2⤵
  PID:14328
- C:\Windows\System\VBGZIwW.exe
  C:\Windows\System\VBGZIwW.exe
  2⤵
  PID:13328
- C:\Windows\System\VpeDvbl.exe
  C:\Windows\System\VpeDvbl.exe
  2⤵
  PID:13396
- C:\Windows\System\uASRGAK.exe
  C:\Windows\System\uASRGAK.exe
  2⤵
  PID:13452
- C:\Windows\System\XVPSACg.exe
  C:\Windows\System\XVPSACg.exe
  2⤵
  PID:13432
- C:\Windows\System\lGAoCvL.exe
  C:\Windows\System\lGAoCvL.exe
  2⤵
  PID:13556
- C:\Windows\System\abyMtkC.exe
  C:\Windows\System\abyMtkC.exe
  2⤵
  PID:13604
- C:\Windows\System\fbbHSQl.exe
  C:\Windows\System\fbbHSQl.exe
  2⤵
  PID:13744
- C:\Windows\System\kffWMdK.exe
  C:\Windows\System\kffWMdK.exe
  2⤵
  PID:13772
- C:\Windows\System\uxtXkhF.exe
  C:\Windows\System\uxtXkhF.exe
  2⤵
  PID:13876
- C:\Windows\System\qJRweOk.exe
  C:\Windows\System\qJRweOk.exe
  2⤵
  PID:13900
- C:\Windows\System\JAQRAYb.exe
  C:\Windows\System\JAQRAYb.exe
  2⤵
  PID:13980
- C:\Windows\System\QKOwixW.exe
  C:\Windows\System\QKOwixW.exe
  2⤵
  PID:14056
- C:\Windows\System\hAfVHJA.exe
  C:\Windows\System\hAfVHJA.exe
  2⤵
  PID:14116
- C:\Windows\System\vMOjaEg.exe
  C:\Windows\System\vMOjaEg.exe
  2⤵
  PID:14200
- C:\Windows\System\ETQNYTG.exe
  C:\Windows\System\ETQNYTG.exe
  2⤵
  PID:14300
- C:\Windows\System\NlsJZKI.exe
  C:\Windows\System\NlsJZKI.exe
  2⤵
  PID:12340
- C:\Windows\System\pANzcup.exe
  C:\Windows\System\pANzcup.exe
  2⤵
  PID:13408
- C:\Windows\System\MMuKwwv.exe
  C:\Windows\System\MMuKwwv.exe
  2⤵
  PID:13700
- C:\Windows\System\eRFYAXm.exe
  C:\Windows\System\eRFYAXm.exe
  2⤵
  PID:13780
- C:\Windows\System\Stgryvp.exe
  C:\Windows\System\Stgryvp.exe
  2⤵
  PID:13828
- C:\Windows\System\bMbgywZ.exe
  C:\Windows\System\bMbgywZ.exe
  2⤵
  PID:14020
- C:\Windows\System\zeAlxKm.exe
  C:\Windows\System\zeAlxKm.exe
  2⤵
  PID:14136
- C:\Windows\System\FXJmKrJ.exe
  C:\Windows\System\FXJmKrJ.exe
  2⤵
  PID:13348
- C:\Windows\System\dcKoYBx.exe
  C:\Windows\System\dcKoYBx.exe
  2⤵
  PID:13668
- C:\Windows\System\FEBoeHt.exe
  C:\Windows\System\FEBoeHt.exe
  2⤵
  PID:13944
- C:\Windows\System\TtQaXrv.exe
  C:\Windows\System\TtQaXrv.exe
  2⤵
  PID:14088
- C:\Windows\System\mZrJaHU.exe
  C:\Windows\System\mZrJaHU.exe
  2⤵
  PID:13820
- C:\Windows\System\HgHATgP.exe
  C:\Windows\System\HgHATgP.exe
  2⤵
  PID:14344
- C:\Windows\System\IYtCHMf.exe
  C:\Windows\System\IYtCHMf.exe
  2⤵
  PID:14372
- C:\Windows\System\qjkTrGX.exe
  C:\Windows\System\qjkTrGX.exe
  2⤵
  PID:14396
- C:\Windows\System\JkhMSVP.exe
  C:\Windows\System\JkhMSVP.exe
  2⤵
  PID:14420
- C:\Windows\System\cxcHOQk.exe
  C:\Windows\System\cxcHOQk.exe
  2⤵
  PID:14460
- C:\Windows\System\zhGQFEe.exe
  C:\Windows\System\zhGQFEe.exe
  2⤵
  PID:14484
- C:\Windows\System\yiRzasn.exe
  C:\Windows\System\yiRzasn.exe
  2⤵
  PID:14520
- C:\Windows\System\Wajuzwj.exe
  C:\Windows\System\Wajuzwj.exe
  2⤵
  PID:14560
- C:\Windows\System\ssEHnla.exe
  C:\Windows\System\ssEHnla.exe
  2⤵
  PID:14588
- C:\Windows\System\vYBIZSj.exe
  C:\Windows\System\vYBIZSj.exe
  2⤵
  PID:14616
- C:\Windows\System\FEPuKRX.exe
  C:\Windows\System\FEPuKRX.exe
  2⤵
  PID:14644
- C:\Windows\System\qzGKPoD.exe
  C:\Windows\System\qzGKPoD.exe
  2⤵
  PID:14664
- C:\Windows\System\DkcckgK.exe
  C:\Windows\System\DkcckgK.exe
  2⤵
  PID:14700
- C:\Windows\System\wzlIjSW.exe
  C:\Windows\System\wzlIjSW.exe
  2⤵
  PID:14716
- C:\Windows\System\UOCPvwi.exe
  C:\Windows\System\UOCPvwi.exe
  2⤵
  PID:14744
- C:\Windows\System\erRIfVm.exe
  C:\Windows\System\erRIfVm.exe
  2⤵
  PID:14776
- C:\Windows\System\GxgGVRC.exe
  C:\Windows\System\GxgGVRC.exe
  2⤵
  PID:14800
- C:\Windows\System\rMrAYvz.exe
  C:\Windows\System\rMrAYvz.exe
  2⤵
  PID:14828
- C:\Windows\System\kFpJzzY.exe
  C:\Windows\System\kFpJzzY.exe
  2⤵
  PID:14852
- C:\Windows\System\VSnFUna.exe
  C:\Windows\System\VSnFUna.exe
  2⤵
  PID:14884
- C:\Windows\System\jJfuWoI.exe
  C:\Windows\System\jJfuWoI.exe
  2⤵
  PID:14920
- C:\Windows\System\qmkfHOU.exe
  C:\Windows\System\qmkfHOU.exe
  2⤵
  PID:14940
- C:\Windows\System\dJeGDnQ.exe
  C:\Windows\System\dJeGDnQ.exe
  2⤵
  PID:14968
- C:\Windows\System\vcKNtTt.exe
  C:\Windows\System\vcKNtTt.exe
  2⤵
  PID:14996
- C:\Windows\System\CmgSyyM.exe
  C:\Windows\System\CmgSyyM.exe
  2⤵
  PID:15024
- C:\Windows\System\zqDAZct.exe
  C:\Windows\System\zqDAZct.exe
  2⤵
  PID:15040
- C:\Windows\System\lOpoeUn.exe
  C:\Windows\System\lOpoeUn.exe
  2⤵
  PID:15060
- C:\Windows\System\eHvJJxA.exe
  C:\Windows\System\eHvJJxA.exe
  2⤵
  PID:15120
- C:\Windows\System\aMUrNMf.exe
  C:\Windows\System\aMUrNMf.exe
  2⤵
  PID:15148
- C:\Windows\System\xvAVVXw.exe
  C:\Windows\System\xvAVVXw.exe
  2⤵
  PID:15176
- C:\Windows\System\vqAJhHt.exe
  C:\Windows\System\vqAJhHt.exe
  2⤵
  PID:15196
- C:\Windows\System\lcQbCPt.exe
  C:\Windows\System\lcQbCPt.exe
  2⤵
  PID:15224
- C:\Windows\System\IrtfwCs.exe
  C:\Windows\System\IrtfwCs.exe
  2⤵
  PID:15264
- C:\Windows\System\TxEaZpm.exe
  C:\Windows\System\TxEaZpm.exe
  2⤵
  PID:15280
- C:\Windows\System\fohsgYE.exe
  C:\Windows\System\fohsgYE.exe
  2⤵
  PID:15296
- C:\Windows\System\gLzeazW.exe
  C:\Windows\System\gLzeazW.exe
  2⤵
  PID:15324
- C:\Windows\System\nItuqDZ.exe
  C:\Windows\System\nItuqDZ.exe
  2⤵
  PID:15356
- C:\Windows\System\qQiUxLz.exe
  C:\Windows\System\qQiUxLz.exe
  2⤵
  PID:14356
- C:\Windows\System\DegHUTt.exe
  C:\Windows\System\DegHUTt.exe
  2⤵
  PID:14384
- C:\Windows\System\iDRoFVb.exe
  C:\Windows\System\iDRoFVb.exe
  2⤵
  PID:14480
- C:\Windows\System\OcNhhVK.exe
  C:\Windows\System\OcNhhVK.exe
  2⤵
  PID:14532
- C:\Windows\System\EQGvvGX.exe
  C:\Windows\System\EQGvvGX.exe
  2⤵
  PID:14600
- C:\Windows\System\bDHmGOQ.exe
  C:\Windows\System\bDHmGOQ.exe
  2⤵
  PID:14652
- C:\Windows\System\GMoCZWN.exe
  C:\Windows\System\GMoCZWN.exe
  2⤵
  PID:14692
- C:\Windows\System\TGokzcr.exe
  C:\Windows\System\TGokzcr.exe
  2⤵
  PID:14844
- C:\Windows\System\rqnMhxh.exe
  C:\Windows\System\rqnMhxh.exe
  2⤵
  PID:14880
- C:\Windows\System\RJDyAZX.exe
  C:\Windows\System\RJDyAZX.exe
  2⤵
  PID:14960
- C:\Windows\System\PHwBNUx.exe
  C:\Windows\System\PHwBNUx.exe
  2⤵
  PID:15016
- C:\Windows\System\HBrHSzi.exe
  C:\Windows\System\HBrHSzi.exe
  2⤵
  PID:15052
- C:\Windows\System\ydyMBtt.exe
  C:\Windows\System\ydyMBtt.exe
  2⤵
  PID:13512
- C:\Windows\System\IJtwXPM.exe
  C:\Windows\System\IJtwXPM.exe
  2⤵
  PID:15276
- C:\Windows\System\ayogOVa.exe
  C:\Windows\System\ayogOVa.exe
  2⤵
  PID:15316
- C:\Windows\System\PIpwmwm.exe
  C:\Windows\System\PIpwmwm.exe
  2⤵
  PID:15336
- C:\Windows\System\rcgAgkQ.exe
  C:\Windows\System\rcgAgkQ.exe
  2⤵
  PID:14392
- C:\Windows\System\YypbSTj.exe
  C:\Windows\System\YypbSTj.exe
  2⤵
  PID:14612
- C:\Windows\System\xoLlKNU.exe
  C:\Windows\System\xoLlKNU.exe
  2⤵
  PID:14684
- C:\Windows\System\EGSpojr.exe
  C:\Windows\System\EGSpojr.exe
  2⤵
  PID:14956
- C:\Windows\System\zSVUPMq.exe
  C:\Windows\System\zSVUPMq.exe
  2⤵
  PID:15092
- C:\Windows\System\WxmkLIr.exe
  C:\Windows\System\WxmkLIr.exe
  2⤵
  PID:15164
- C:\Windows\System\DrzxrLh.exe
  C:\Windows\System\DrzxrLh.exe
  2⤵
  PID:14368
- C:\Windows\System\OqPLzXB.exe
  C:\Windows\System\OqPLzXB.exe
  2⤵
  PID:14572
- C:\Windows\System\HGVHhUq.exe
  C:\Windows\System\HGVHhUq.exe
  2⤵
  PID:14708
- C:\Windows\System\XyLthbf.exe
  C:\Windows\System\XyLthbf.exe
  2⤵
  PID:15140
- C:\Windows\System\pJlQGpk.exe
  C:\Windows\System\pJlQGpk.exe
  2⤵
  PID:14452
- C:\Windows\System\epNWhUa.exe
  C:\Windows\System\epNWhUa.exe
  2⤵
  PID:15368
- C:\Windows\System\twMegcy.exe
  C:\Windows\System\twMegcy.exe
  2⤵
  PID:15408
- C:\Windows\System\xniUYkq.exe
  C:\Windows\System\xniUYkq.exe
  2⤵
  PID:15432
- C:\Windows\System\YaTAuSX.exe
  C:\Windows\System\YaTAuSX.exe
  2⤵
  PID:15472
- C:\Windows\System\BgZjYKy.exe
  C:\Windows\System\BgZjYKy.exe
  2⤵
  PID:15504
- C:\Windows\System\zVWryyo.exe
  C:\Windows\System\zVWryyo.exe
  2⤵
  PID:15548
- C:\Windows\System\TnGxwWQ.exe
  C:\Windows\System\TnGxwWQ.exe
  2⤵
  PID:15564
- C:\Windows\System\YkNDpyf.exe
  C:\Windows\System\YkNDpyf.exe
  2⤵
  PID:15604
- C:\Windows\System\egJtrVJ.exe
  C:\Windows\System\egJtrVJ.exe
  2⤵
  PID:15632
- C:\Windows\System\XNYkLQh.exe
  C:\Windows\System\XNYkLQh.exe
  2⤵
  PID:15684
- C:\Windows\System\lBJQoBl.exe
  C:\Windows\System\lBJQoBl.exe
  2⤵
  PID:15716
- C:\Windows\System\tOcqTRt.exe
  C:\Windows\System\tOcqTRt.exe
  2⤵
  PID:15740
- C:\Windows\System\onvkafe.exe
  C:\Windows\System\onvkafe.exe
  2⤵
  PID:15780
- C:\Windows\System\IvBryiS.exe
  C:\Windows\System\IvBryiS.exe
  2⤵
  PID:15816
- C:\Windows\System\slJyyGj.exe
  C:\Windows\System\slJyyGj.exe
  2⤵
  PID:15840
- C:\Windows\System\wTgQVvx.exe
  C:\Windows\System\wTgQVvx.exe
  2⤵
  PID:15864
- C:\Windows\System\avuOLCM.exe
  C:\Windows\System\avuOLCM.exe
  2⤵
  PID:15900
- C:\Windows\System\qtxOGQx.exe
  C:\Windows\System\qtxOGQx.exe
  2⤵
  PID:15920
- C:\Windows\System\HNKYbiI.exe
  C:\Windows\System\HNKYbiI.exe
  2⤵
  PID:15952
- C:\Windows\System\uJiLtqu.exe
  C:\Windows\System\uJiLtqu.exe
  2⤵
  PID:15984
- C:\Windows\System\lqvWDwr.exe
  C:\Windows\System\lqvWDwr.exe
  2⤵
  PID:16012
- C:\Windows\System\sbTsnzE.exe
  C:\Windows\System\sbTsnzE.exe
  2⤵
  PID:16044
- C:\Windows\System\fnDSlbg.exe
  C:\Windows\System\fnDSlbg.exe
  2⤵
  PID:16068
- C:\Windows\System\YnGUtiZ.exe
  C:\Windows\System\YnGUtiZ.exe
  2⤵
  PID:16096
- C:\Windows\System\KHOPTIu.exe
  C:\Windows\System\KHOPTIu.exe
  2⤵
  PID:16140
- C:\Windows\System\keORrvN.exe
  C:\Windows\System\keORrvN.exe
  2⤵
  PID:16188
- C:\Windows\System\kLnjdMx.exe
  C:\Windows\System\kLnjdMx.exe
  2⤵
  PID:16216
- C:\Windows\System\RBqMPND.exe
  C:\Windows\System\RBqMPND.exe
  2⤵
  PID:16232
- C:\Windows\System\VhLbDLy.exe
  C:\Windows\System\VhLbDLy.exe
  2⤵
  PID:16272
- C:\Windows\System\gcSGndU.exe
  C:\Windows\System\gcSGndU.exe
  2⤵
  PID:16288
- C:\Windows\System\YlHlkuz.exe
  C:\Windows\System\YlHlkuz.exe
  2⤵
  PID:16320
- C:\Windows\System\EBPVbne.exe
  C:\Windows\System\EBPVbne.exe
  2⤵
  PID:16344
- C:\Windows\System\ffgKEuN.exe
  C:\Windows\System\ffgKEuN.exe
  2⤵
  PID:16372
- C:\Windows\System\nYBlVdh.exe
  C:\Windows\System\nYBlVdh.exe
  2⤵
  PID:15380
- C:\Windows\System\soufQqi.exe
  C:\Windows\System\soufQqi.exe
  2⤵
  PID:15464
- C:\Windows\System\xBEIeGz.exe
  C:\Windows\System\xBEIeGz.exe
  2⤵
  PID:15468
- C:\Windows\System\rxPWpDg.exe
  C:\Windows\System\rxPWpDg.exe
  2⤵
  PID:15560
- C:\Windows\System\jtiabgT.exe
  C:\Windows\System\jtiabgT.exe
  2⤵
  PID:15624
- C:\Windows\System\yjdHFbO.exe
  C:\Windows\System\yjdHFbO.exe
  2⤵
  PID:15724
- C:\Windows\System\hdtLeLG.exe
  C:\Windows\System\hdtLeLG.exe
  2⤵
  PID:15828
- C:\Windows\System\TMxqtOF.exe
  C:\Windows\System\TMxqtOF.exe
  2⤵
  PID:15836
- C:\Windows\System\QTXjIMe.exe
  C:\Windows\System\QTXjIMe.exe
  2⤵
  PID:15916
- C:\Windows\System\TBQswlT.exe
  C:\Windows\System\TBQswlT.exe
  2⤵
  PID:15960
- C:\Windows\System\SOUjHOB.exe
  C:\Windows\System\SOUjHOB.exe
  2⤵
  PID:16000
- C:\Windows\System\awtLAED.exe
  C:\Windows\System\awtLAED.exe
  2⤵
  PID:16036
- C:\Windows\System\IillrSU.exe
  C:\Windows\System\IillrSU.exe
  2⤵
  PID:16124
- C:\Windows\System\hKYlBWV.exe
  C:\Windows\System\hKYlBWV.exe
  2⤵
  PID:16252
- C:\Windows\System\hEDZDMZ.exe
  C:\Windows\System\hEDZDMZ.exe
  2⤵
  PID:16352
- C:\Windows\System\cFSHlbl.exe
  C:\Windows\System\cFSHlbl.exe
  2⤵
  PID:16356
- C:\Windows\System\AVAxvPH.exe
  C:\Windows\System\AVAxvPH.exe
  2⤵
  PID:15536
- C:\Windows\System\ZNoxxuL.exe
  C:\Windows\System\ZNoxxuL.exe
  2⤵
  PID:15808
- C:\Windows\System\CGqmSBq.exe
  C:\Windows\System\CGqmSBq.exe
  2⤵
  PID:15940
- C:\Windows\System\QiyjBej.exe
  C:\Windows\System\QiyjBej.exe
  2⤵
  PID:16064
- C:\Windows\System\UXTxZzM.exe
  C:\Windows\System\UXTxZzM.exe
  2⤵
  PID:16280
- C:\Windows\System\tctfXwn.exe
  C:\Windows\System\tctfXwn.exe
  2⤵
  PID:16328
- C:\Windows\System\UqVKAAk.exe
  C:\Windows\System\UqVKAAk.exe
  2⤵
  PID:15628
- C:\Windows\System\bKDYQyJ.exe
  C:\Windows\System\bKDYQyJ.exe
  2⤵
  PID:16080
- C:\Windows\System\wNBiPOA.exe
  C:\Windows\System\wNBiPOA.exe
  2⤵
  PID:15116
- C:\Windows\System\Vblajnu.exe
  C:\Windows\System\Vblajnu.exe
  2⤵
  PID:16360
- C:\Windows\System\bOMJeKZ.exe
  C:\Windows\System\bOMJeKZ.exe
  2⤵
  PID:16404
- C:\Windows\System\zncpMmn.exe
  C:\Windows\System\zncpMmn.exe
  2⤵
  PID:16440
- C:\Windows\System\cWNKdKV.exe
  C:\Windows\System\cWNKdKV.exe
  2⤵
  PID:16472
- C:\Windows\System\EbTGWxM.exe
  C:\Windows\System\EbTGWxM.exe
  2⤵
  PID:16488
- C:\Windows\System\EIEOwnm.exe
  C:\Windows\System\EIEOwnm.exe
  2⤵
  PID:16540
- C:\Windows\System\prWyGHp.exe
  C:\Windows\System\prWyGHp.exe
  2⤵
  PID:16556
- C:\Windows\System\HIgPQZd.exe
  C:\Windows\System\HIgPQZd.exe
  2⤵
  PID:16576
- C:\Windows\System\bCZgXCA.exe
  C:\Windows\System\bCZgXCA.exe
  2⤵
  PID:16600
- C:\Windows\System\oVgqCuM.exe
  C:\Windows\System\oVgqCuM.exe
  2⤵
  PID:16632
- C:\Windows\System\dSLDshi.exe
  C:\Windows\System\dSLDshi.exe
  2⤵
  PID:16664
- C:\Windows\System\PASJxJI.exe
  C:\Windows\System\PASJxJI.exe
  2⤵
  PID:16692
- C:\Windows\System\IwtRcDp.exe
  C:\Windows\System\IwtRcDp.exe
  2⤵
  PID:16712
- C:\Windows\System\cRvAcEF.exe
  C:\Windows\System\cRvAcEF.exe
  2⤵
  PID:16736
- C:\Windows\System\polJTIE.exe
  C:\Windows\System\polJTIE.exe
  2⤵
  PID:16772
- C:\Windows\System\fausZFP.exe
  C:\Windows\System\fausZFP.exe
  2⤵
  PID:16796
- C:\Windows\System\YJyazuG.exe
  C:\Windows\System\YJyazuG.exe
  2⤵
  PID:16824
- C:\Windows\System\OeMnTsI.exe
  C:\Windows\System\OeMnTsI.exe
  2⤵
  PID:16848
- C:\Windows\System\csiQNIx.exe
  C:\Windows\System\csiQNIx.exe
  2⤵
  PID:16892
- C:\Windows\System\GixKOfH.exe
  C:\Windows\System\GixKOfH.exe
  2⤵
  PID:16908
- C:\Windows\System\RALWtzP.exe
  C:\Windows\System\RALWtzP.exe
  2⤵
  PID:16952
- C:\Windows\System\iyQrEqS.exe
  C:\Windows\System\iyQrEqS.exe
  2⤵
  PID:16980
- C:\Windows\System\LRCTslF.exe
  C:\Windows\System\LRCTslF.exe
  2⤵
  PID:16996
- C:\Windows\System\XKyOzLL.exe
  C:\Windows\System\XKyOzLL.exe
  2⤵
  PID:17064
- C:\Windows\System\RRLyABK.exe
  C:\Windows\System\RRLyABK.exe
  2⤵
  PID:17080
- C:\Windows\System\EFHbuna.exe
  C:\Windows\System\EFHbuna.exe
  2⤵
  PID:17108
- C:\Windows\System\qacZeUp.exe
  C:\Windows\System\qacZeUp.exe
  2⤵
  PID:17124
- C:\Windows\System\MkqhtIa.exe
  C:\Windows\System\MkqhtIa.exe
  2⤵
  PID:17148
- C:\Windows\System\bRvgCdM.exe
  C:\Windows\System\bRvgCdM.exe
  2⤵
  PID:17204
- C:\Windows\System\ulSyUGI.exe
  C:\Windows\System\ulSyUGI.exe
  2⤵
  PID:17392

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4764 -i 4764 -h 404 -j 416 -s 420 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AEVibYz.exe

Filesize
1.4MB

MD5
4485a54232f8a333253537e9f247244e

SHA1
cc81e78df3f18f9c2ab7ced8771bc7a5c7c7c3b0

SHA256
aa4a449d1aaadddf5d23e717f7e6892e4916db6b356bbe51f58a2afa67ae3e2a

SHA512
1a3b81b4b9275b02d0d742ceb1e2eaacb33b86235446b04772589e6950fa182c8c8972e87869dea1d746101cb23be0b4c11d277859b6e02b25af0f8348d37662

Download Submit
C:\Windows\System\AhNVKjO.exe

Filesize
1.4MB

MD5
7c9b32bc7656683a12ef5663257ab4c5

SHA1
c180f586a8658f7ef0856d887b03df97a67bcd9e

SHA256
bb87c6447a5e7a20e8d277a7384bdaeb91a3545aa553b3887adf9c04e66c37f6

SHA512
c8027cb43aa5a26176daaab7629f8a61052e9d386f19842f7b9107f8695787370d5f73b508744e07144feff6dc43edb56462ccc6e0ee616960519e582d99236d

Download Submit
C:\Windows\System\CiBaovv.exe

Filesize
1.4MB

MD5
35541e575dd2d1ebbe4675daf3cce0f5

SHA1
4c19dd0092fcb7f814a59ba7bd395b2fcd4c5e6a

SHA256
b27a9870ea77effcf0a5d58b874cab88f5fd1d35b50405ed0f3a1c00713246d4

SHA512
8ba01fc496a148855f390e9a9285edb3af28ca5fc57c5ba180ece096f8c707cf0621c3cf49d64e8170fedf66a37ee9eac2a3eac502bda4d49b811d09a69e7fda

Download Submit
C:\Windows\System\DFnOKmP.exe

Filesize
1.4MB

MD5
9c75c5191260263d632645968b9aa7a9

SHA1
b03a38921d7eea3299cc76f4c4915d2087dd4fbd

SHA256
9049898dc4484442bf9e75512a3a2859c0c51eceb60bda50f51a8a2d3ae5ba12

SHA512
2ca7732cecbc1353c90d2857539cba1d82ea597c687a8d287a4b95cee14e5eb2f3ed14b8c33c782a9ea14888681fc93349c5e941abe1c5433f63967fdca48260

Download Submit
C:\Windows\System\DmBvIIQ.exe

Filesize
1.4MB

MD5
6ed613273ccd5c5183a0ffc9bf2fbcf6

SHA1
18d63571546cc175755ae746fadb03a8f69c2e2c

SHA256
b5207e64a96d0a78d12f0f4a92f9faa84a7ad92098baf22e6e30ac8f4c834a61

SHA512
9be70a77f48b989d79d16a55cf80dace060378a9a18b644f04d968643f5ab040fff6aeb5d484ae0f991c79d5d2e11d46e6465ac247bb0400d44c1be6abacb396

Download Submit
C:\Windows\System\ITFyCbw.exe

Filesize
1.4MB

MD5
fc16b310652c1ad6fabc75b60631ab6b

SHA1
36b23ff5b4f6e3c5ec9878846dc2d44798d6c06b

SHA256
f1ccd68edfd421e49091af8b2ae7ab049d645f1b2e61f63f65cb924d320b1f17

SHA512
ca25f98f276b39145006bc047f5c15f7c3858568bb07f3e30b17c3a6387055419cda47fd7ea39ba9e0a379bd86ffb5592d102b23ad5469628a24cf8191a179b8

Download Submit
C:\Windows\System\MkeAois.exe

Filesize
1.4MB

MD5
7521c548ae8eb94bdb20a985a4a05cdc

SHA1
64d9cc77892ab38f662d4a0ee50339d1a41ca417

SHA256
46e596b221a1b9aecd13f6a4d63a1e104c47d0d4442d9dc404bf2f2ee904d5af

SHA512
6a73c7820394742b659bc6a08ee0865a7678e440ad3130f17e31cfad0481c73032f414b8cda8c6f391260c8fbad995e5f87a891a995be43368b1f22deae1115b

Download Submit
C:\Windows\System\Opipyya.exe

Filesize
1.4MB

MD5
96fe042ae98079e563b65aad167bf7ce

SHA1
5153c6951ab8216292065e14ac89cfc28c6c5963

SHA256
1e4198a8aead9678c53b518a81b8b30043805d874ab0f7b3bb553aa01140726e

SHA512
91e2c2b393379c99fb92b554ab6b736e57007d538719b95da0624ffe8ed948b20fcd10c0528955c61e39e12985850e08bb6cd0e4f97552e7520047e3e213e8ed

Download Submit
C:\Windows\System\SJYPtEj.exe

Filesize
1.4MB

MD5
397fbed2be22b151c7e5a1242b209108

SHA1
9638ec086744a91a49d30dce8538494a0bfbda70

SHA256
0a2871c328ffeaa4f25914dca25e0e4d04e6ab5fecaba8470b4bceb965125b0e

SHA512
970d238c55a33eddb4ccb23af5019552965a4eb824215c096237c0982974b8b546d4e91bcba95ea97646399c5215b4d1972b7cdc08ab35c5f7ecfcfe9f9b6595

Download Submit
C:\Windows\System\TPzJxvw.exe

Filesize
1.4MB

MD5
4572e24c431b7119081a19d9b7c4ab99

SHA1
f4fa2d3704bab394d33c476ae8f8d5adbf390712

SHA256
4f6d209e95f8d17b5e2ec63be59cfc10284b266917a194c2d2fd762758e7c168

SHA512
a315800a14d781d7891fa965ae88c9e25cfe3e7e391d1ab9260f27c02ba5290ec81864a25efdd3ff129edea9d9f7fe6b6aa50d12fff89ceaabe6448125494d15

Download Submit
C:\Windows\System\TxfyeSf.exe

Filesize
1.4MB

MD5
085e32d9f50e06bdeba4ee1548feb48f

SHA1
f215ab24b0259cc2bda5cef0aee0ed119e227734

SHA256
42e0c3efbe2bdb56112d22d8f8d1be03518cba7ff8472f29f5f29b8149f57c68

SHA512
926802f35779d5e3fd0c4f3150a13de4e68f02c348c3ca4ff76e3ad08d561471b7b543ee43636cbb445eac651eef88f6f18aa4c624bcabd4ae2216de622d8369

Download Submit
C:\Windows\System\VBJDxQD.exe

Filesize
1.4MB

MD5
52750e1e42e313c231a6d01f11c59ae7

SHA1
7d56fe1c5402183cb54f25db79f905e24c432e3b

SHA256
2d0639b5e15d5d3c5cec28d4aa53db44f72cea120cb67a7c79d7ff649d73c9ef

SHA512
58dea647e493dbf461dae75eb2c04db834ebe1334980c4c117227f9beef01163fb764131ffecfb682ffb0b608bb5516b60d71eee1c0326df2cc183747c485152

Download Submit
C:\Windows\System\WnqomKH.exe

Filesize
1.4MB

MD5
bb0f567b7fd88eb2ec6a9e1c9457022d

SHA1
b6549ab329be95e49add6a53cf05308d41ab3b61

SHA256
2a738ff69b847d3251089dce42f3940a96e468cd1c65dbc040cc6ffb4aedf468

SHA512
ee8bc9bd8c122341f0edb61d8380c006d79ad5f12101bdf905f1a7dd4706600a877d6fe5b9018224706604e47f76d4411993fdabe7d8c4a0705c2b1df5c1b2be

Download Submit
C:\Windows\System\XJlKdZo.exe

Filesize
1.4MB

MD5
1e2a26b7e363738d59b84b199c9bacbd

SHA1
2469911dafd7688bc0fee41489260d7693a2565a

SHA256
9fed27f45f95e979ae6140c5b7f2db71640246e2232cb48a1f2375a8d812a69e

SHA512
140645e2890caf6d59812dbd981488e51ad57480452a243bb95c8ba4b9d45d34d074c9abb1fe2107b9867cce0aab3877e1726d9848798d62b9641eb2b53a94e0

Download Submit
C:\Windows\System\YeHuIAq.exe

Filesize
1.4MB

MD5
d69d7913970eb4c6fe2c5ee02dd1611b

SHA1
68c37b4939fabf225acfc1ff3312fbb5fdb5e51f

SHA256
082aa1a1f0bda299494ecb2958c5d06c3412dc672b55dc30df083a5b24926f8c

SHA512
17343e52fbf04fa6ba4256f4ac0e284df8ca37b66764b7e694da0e6e0c14be6541a9a3c1d2ec7e88f184722c4a306bde53d00f76e2c67abc6106c4f760970251

Download Submit
C:\Windows\System\ckZwGOD.exe

Filesize
1.4MB

MD5
324ca91d1022ce0ee4bddccbb5248a4a

SHA1
c046ba02dd11e18f7816b5d93cb52b684487ea54

SHA256
34c3be4903a48d0ec95af91b3880d5c88ea941ff83bed0c77be7481e6089c861

SHA512
cdd301383a8cfd0d52611e80352e9b2da3cbf49ea4d97d81ce8fca0f842c6403f2616b367ba1290117b1a7bcf25c4ca3810c47a53d103f4fe3d668fc18900b81

Download Submit
C:\Windows\System\dlyJUfD.exe

Filesize
1.4MB

MD5
39e419cda858206c04960fbd8f155259

SHA1
b4cad5876b0f0aa1b8ef4b3f09e98fa6e72e7bd1

SHA256
204a8ad50ecc615f246eff37ca98a87b8971f4ebe8bf640e3e78cfca15970a7f

SHA512
bd5ff1d62ee9918243654b7e4339fc8d47b4261681e349ba8bbd7c97da5737f887d4d4f3dadbb5e585062332da700d773a798c38b91a9cc59a4c345ba2902f2d

Download Submit
C:\Windows\System\fBOloMH.exe

Filesize
1.4MB

MD5
ceff3942ebac55518cfe4d5595cfe7dc

SHA1
6873fbba430b46985e2231cb2fb4fafa1dd66579

SHA256
f7e35147c49cdfcdd107e5735496f0079c35363e18b625381b1045eed3299c37

SHA512
542ffb05b2812e8b94a5fe9f26389e430144c53816ea447e071d8457b0389b897b9cd61ac75e3f0721bef22deb2eecdebe3cf43c4e5348b361f56f6ba20db37f

Download Submit
C:\Windows\System\fXqfhJZ.exe

Filesize
1.4MB

MD5
72fd1ff05f121f768ab38941b206eb51

SHA1
fe402204a06986052a24f3b61e65e179aba99556

SHA256
299981efaf054202ed64391ddae7d0a4708c51e1a4eefa92730ae88fb1a24c27

SHA512
fc668d022d8db9bd599c7e4d6054c9d75371d7fc7d9d46619ac3d727b074b9bbe8fa077a4766596d0eb273a84afac0792958c9fe6386173ec0299e195c4d129f

Download Submit
C:\Windows\System\fgzRLye.exe

Filesize
1.4MB

MD5
8a2c33b0a962e3512710bd279aa36c79

SHA1
b2d79c176b5d9fb03329653a55b757b373bd9af4

SHA256
ce682837f6b0e431ae5cc75df67cb88504ae0fb6719d42b84c04de8c9817275d

SHA512
facb540f677162fd843217e72ee73eb9a76510285ecc7b15cb4f5f848fbf780b09330399293c9671a3e8342611597fbc117eeb5b8545d62f9cf5adce2fbe7feb

Download Submit
C:\Windows\System\foPxpWt.exe

Filesize
1.4MB

MD5
a51003d1a630766b2d9944f813b42fc0

SHA1
c1d00a3f290c9760edfa31b74d193dbe450ebe8c

SHA256
bb5e442f067c18b2b1884c432c672f94df5bc28f9b7ba4662b1632bd950668d9

SHA512
fc8a06c54ce282536483072effc471b61c69afed975982e09dada58e66dde347396562ee6e7ee389c99200e027460e5c957a09e8c353f008fc4829c668d483fc

Download Submit
C:\Windows\System\gzQClfS.exe

Filesize
1.4MB

MD5
49500c9886651b46d170d56f9ba5f49f

SHA1
40155989ffefbf1aec2efab60ef43610865f635f

SHA256
ad6c7fa7c41132714e02347cbc9f72bf283f1f488cf63375085ac6d7c354f0a8

SHA512
de05c459eeacf92a33af88e960a70fcac5457384dedd25b49c2f4c46f5cbd9ece13ad5d6dedb9666d7561a0042456e1171376d0b34ff756e2d6569b51fce4a51

Download Submit
C:\Windows\System\iPUAwWa.exe

Filesize
1.4MB

MD5
685c0069fbd582748029317eb2934a8d

SHA1
62373866df1bd500e9d3fa2b24704d6c2269ae06

SHA256
08cdbd374f845a7aa07df5e5ee75c46063cef2bd947181297730c1900dc820a0

SHA512
72f703f9b46c44cd23497f9842cf86ad406a6d96489a37b40f63d6d1d291fad378affc92ac06807b675238afa300309d523d2ea9b8817ab3f32399360a2ce9d9

Download Submit
C:\Windows\System\mHTrDyj.exe

Filesize
1.4MB

MD5
ae5e3c3f2b27696e0fd67ec151ac6a27

SHA1
4ae9750f67bbd1c742c752baf5324daf5b069cd3

SHA256
aba657f3348727e8f724e7c3608ad6c9e1da8e26a079e01b43a3ac771308bfa9

SHA512
9897a520b1331c315f748255118e39150336808c63b1321d3767c1fccf2fde05f0fb355d36df72017f2de06283ac9b88585aaa3e4b10a3e8405a96346210a082

Download Submit
C:\Windows\System\mXfYvZI.exe

Filesize
1.4MB

MD5
033f81fb6c5a51ef8db514d585bfadd5

SHA1
51b57036bc2cc3579a3843af917bbb753df57317

SHA256
6f0a71b264cda088bb2749258aa716954192245211a4cc0fc1e199c65a222150

SHA512
a16ebc07b374271e5b2ba1b797311f8be9233ba2a3e200f594bd49d3caaa754dce3ead297312648f24b03929cc6db66ebe6697e20d77d83654754495da848ce1

Download Submit
C:\Windows\System\nNpPDXr.exe

Filesize
1.4MB

MD5
5e305e777b63976f8076c17f6ba60f73

SHA1
60ed81c8924e15d3b79dc93a29e026b1137525c6

SHA256
c293de5459a9a8b11611ccabc59af778ffab50d701add72b2c1584f969984377

SHA512
d302b1ddaeddcc37dd1a154ea4351757179d875c959600dd01ef3f62fcfb4099a87990a25d9549fc57f57fe31b25d7e82a72a2f4b81b29ce8498c333210ade4f

Download Submit
C:\Windows\System\pIovEAF.exe

Filesize
1.4MB

MD5
daae418de619e0d105ec51638f233a23

SHA1
0fe46146fce7282e915f1bd3a79641901c012a5c

SHA256
8fe3067c64f7ac8c1f72677ac411ad19a8a83235649d0cad57b6dfd3aeba74e1

SHA512
5e502b2ff6f8382f7b0f79f0b57d56cb6a0ee83894abb850b5c924de550ac890c17af77a0bcbc649eaf869e57c39b7d22d15ac298a011fe1c9b256d81cbc02d7

Download Submit
C:\Windows\System\pbycARm.exe

Filesize
1.4MB

MD5
66686709cef03eca9d7d58fca9de0c6e

SHA1
d51b403b146a743592567e045df2fd9128178a95

SHA256
4888f70dd3ec991aa76cb8819d8cd4ff5d84c6aea9da68f26350a189d81344d3

SHA512
2058a195e6fda9f99dba2f00eb86c0b7d5ed207d5074c65da0ae0f602a1b8bccdaabe12ed5669da5c37ce045c419a004b5f42ef7f8b8ad1def2df4b77d2226ec

Download Submit
C:\Windows\System\qiRlzCP.exe

Filesize
1.4MB

MD5
06c34670da7110f0d4be21bc9ae3a64b

SHA1
9040e8de7cbdc5aaf9c8e29230b7af2d2b907226

SHA256
442decc5071d314ace76793a3a7b7bb1334af69a7a499825aa57824d55f44191

SHA512
65ba85a52f758c52c2414b540d6694836ad1e1a4c1d83f86c8cfb35c373751bd107dec020ca5894a538072cf8c5678cc05e540b691ab7369b21b27c36ad32985

Download Submit
C:\Windows\System\sfjuTFV.exe

Filesize
1.4MB

MD5
7a0128a14fc3e3759fadc03bbf65f2f0

SHA1
0896dd4864ae2b9e020ac5595ffc4cd020c2223e

SHA256
fa0bb9970c369b3aea057ecbf31fa88c3fb9d2a5990eae834e1f14296779e0d6

SHA512
3c76cb0cab98ea24825bf53eea222bb039158de115ad4f54ef89682bcd04646b08b3fa9dfb923a5158c3c7f7463df92fa2210eb80d1f4918726724f29f307761

Download Submit
C:\Windows\System\vUsSsGd.exe

Filesize
1.4MB

MD5
fe07f687699be74654144ecb3be74b56

SHA1
cc183c1ab421ebe2789318ee928e30be481e584f

SHA256
2133b8edea0fc5e3876351648c06599db852913f790f5d59cc3e573a24f5e28c

SHA512
c40aa73722657a7e45c73a87fa5e12c43dc7e6085fc326c6b1f021e1f1321462e5e05069ac3bfc24120e00cddf1840ff38f9ebb83f255b103c40c820da602789

Download Submit
C:\Windows\System\xBgmukg.exe

Filesize
1.4MB

MD5
6f0d0023478a393a55395347d4dd42fd

SHA1
d7d2c619cb8ad1e9709f31bc2253a927d212cbc3

SHA256
18641d507c3444c46d4db04900276c0abda064f32afc2ad628887c164b10f6ba

SHA512
4617fae0a218b415f6f7d8f31941bf2c480e42924cdb8a2c5e591e26185f24e6146a198a51cd9aba01bffca81894dac554df6fa67cdafb4a672d022f6a76cebf

Download Submit
C:\Windows\System\yFGJUwC.exe

Filesize
1.4MB

MD5
5c48e6dbb6cdde562a854a30b1391862

SHA1
67931b66b74653f8413b97be946b994e5738f0e8

SHA256
faee86428db52868fc15fc4b7027515fa1020a38ebcdfa99a677c123b35284e5

SHA512
e43bbf2cef9b57da0761f86f8266804310bda386c32ac8a0e54f2cf923c760f25a52bb43f8ec92ce4f1e35d1087c0347fca5c30e921c149262b24357e9ae6c46

Download Submit
memory/4856-0-0x000001DC92B30000-0x000001DC92B40000-memory.dmp

Filesize
64KB

Download