xmrig | c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 04:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
Size

1.3MB
MD5

06dcce64efee0bfadb2dd4db42c8c247
SHA1

52589889e1e92fee49341d3df3ac853207cf5a7e
SHA256

c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a
SHA512

39e7f4a241a847aa88829605d3b88c300f1f83ff80d596de33a3c86b2aa1e3f3ccf0d1ac0a1f22abec293b3b8acb6ba1519ee51a7377a58dfd1221165951f19d
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrP5+pNo6aepH8OGE:GezaTF8FcNkNdfE0pZ9ozttwIRQlXaHL

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

WerFaultSecure.exe

description pid process target process

PID 13424 created 4320 13424 WerFaultSecure.exe svchost.exe
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

description	pid	process	target process
PID 13424 created 4320	13424	WerFaultSecure.exe	svchost.exe

XMRig Miner payload 34 IoCs

miner

Processes:

resource	yara_rule
C:\Windows\System\YlapaLV.exe	xmrig
C:\Windows\System\RtyfSbk.exe	xmrig
C:\Windows\System\mFPhrmU.exe	xmrig
C:\Windows\System\CJyVtNF.exe	xmrig
C:\Windows\System\WFeoBLi.exe	xmrig
C:\Windows\System\THesjMn.exe	xmrig
C:\Windows\System\LoQjakY.exe	xmrig
C:\Windows\System\pjMWiMA.exe	xmrig
C:\Windows\System\UoyghNb.exe	xmrig
C:\Windows\System\PZFbDFi.exe	xmrig
C:\Windows\System\XgbKsbD.exe	xmrig
C:\Windows\System\oWyGnhy.exe	xmrig
C:\Windows\System\BTgJTHB.exe	xmrig
C:\Windows\System\CjiiTNj.exe	xmrig
C:\Windows\System\BPQRQHG.exe	xmrig
C:\Windows\System\dejympz.exe	xmrig
C:\Windows\System\gEBiZYp.exe	xmrig
C:\Windows\System\mfehLAl.exe	xmrig
C:\Windows\System\XNjNyQz.exe	xmrig
C:\Windows\System\uaiduYW.exe	xmrig
C:\Windows\System\hnYoIav.exe	xmrig
C:\Windows\System\PWYHAiF.exe	xmrig
C:\Windows\System\AkNUArH.exe	xmrig
C:\Windows\System\cJKAejm.exe	xmrig
C:\Windows\System\aqqCgWw.exe	xmrig
C:\Windows\System\CbAoIia.exe	xmrig
C:\Windows\System\SKUAtAN.exe	xmrig
C:\Windows\System\QMgWHVU.exe	xmrig
C:\Windows\System\IsJWIeu.exe	xmrig
C:\Windows\System\suVRXSO.exe	xmrig
C:\Windows\System\TEtAPbj.exe	xmrig
C:\Windows\System\Jhwcvmq.exe	xmrig
C:\Windows\System\ktGKJMQ.exe	xmrig
C:\Windows\System\fkRJMMy.exe	xmrig

Executes dropped EXE 64 IoCs

Processes:

RtyfSbk.exeSKUAtAN.exeYlapaLV.exeCbAoIia.exePWYHAiF.exeaqqCgWw.exemFPhrmU.exeWFeoBLi.execJKAejm.exedejympz.exehnYoIav.exeuaiduYW.exeCJyVtNF.exeXNjNyQz.exemfehLAl.exeTHesjMn.exegEBiZYp.exeBPQRQHG.exeCjiiTNj.exeBTgJTHB.exeoWyGnhy.exeAkNUArH.exeXgbKsbD.exePZFbDFi.exeUoyghNb.exepjMWiMA.exeLoQjakY.exefkRJMMy.exeQMgWHVU.exeJhwcvmq.exeIsJWIeu.exesuVRXSO.exeTEtAPbj.exektGKJMQ.exejkJUIkU.exeCgeREsM.exeALYTvAV.exepXQDhhn.exeilkDYoY.exepncuPGu.exeAhJtQqI.exegwgOnkB.exeRjMBius.exeYJSkLWJ.exeQMEQxNw.exeOCjutJe.exezPlxjzu.exefipIGfW.exeYpsWIbq.exetwsWfpJ.exephLZkQr.exengmhyRO.exeYUqYWIo.exepbzTPkL.exeUkWGKDL.exeQJDUjBd.exeGyVCZNw.exeeinPxaU.exeZTSJLgx.exeiEkBXur.exeUhMZyrW.exekadjDeq.exenvTkuaN.exewDbTVOu.exe

pid	process
3124	RtyfSbk.exe
4072	SKUAtAN.exe
3396	YlapaLV.exe
2016	CbAoIia.exe
1496	PWYHAiF.exe
4824	aqqCgWw.exe
4172	mFPhrmU.exe
3356	WFeoBLi.exe
924	cJKAejm.exe
2672	dejympz.exe
2020	hnYoIav.exe
1116	uaiduYW.exe
3360	CJyVtNF.exe
2604	XNjNyQz.exe
4508	mfehLAl.exe
5056	THesjMn.exe
3256	gEBiZYp.exe
3644	BPQRQHG.exe
2072	CjiiTNj.exe
3064	BTgJTHB.exe
736	oWyGnhy.exe
4688	AkNUArH.exe
2532	XgbKsbD.exe
2392	PZFbDFi.exe
4260	UoyghNb.exe
1176	pjMWiMA.exe
3804	LoQjakY.exe
2952	fkRJMMy.exe
2432	QMgWHVU.exe
3620	Jhwcvmq.exe
3276	IsJWIeu.exe
3248	suVRXSO.exe
1684	TEtAPbj.exe
1608	ktGKJMQ.exe
2916	jkJUIkU.exe
5080	CgeREsM.exe
4420	ALYTvAV.exe
1372	pXQDhhn.exe
2592	ilkDYoY.exe
2732	pncuPGu.exe
3584	AhJtQqI.exe
3856	gwgOnkB.exe
432	RjMBius.exe
2256	YJSkLWJ.exe
776	QMEQxNw.exe
832	OCjutJe.exe
4368	zPlxjzu.exe
5012	fipIGfW.exe
3764	YpsWIbq.exe
2184	twsWfpJ.exe
3512	phLZkQr.exe
2204	ngmhyRO.exe
4164	YUqYWIo.exe
3552	pbzTPkL.exe
3204	UkWGKDL.exe
1412	QJDUjBd.exe
2116	GyVCZNw.exe
4980	einPxaU.exe
3812	ZTSJLgx.exe
3784	iEkBXur.exe
2948	UhMZyrW.exe
1636	kadjDeq.exe
4832	nvTkuaN.exe
4476	wDbTVOu.exe

Drops file in Windows directory 64 IoCs

Processes:

c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe

description	ioc	process
File created	C:\Windows\System\YYhqEgb.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\PgBTHnI.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\uhhUoDb.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\KCmUyVf.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\XQPxznt.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\lcikLov.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\DifLXOY.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\EfTOWyN.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\wffrHxV.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\ITeDCGk.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\ADLqXvC.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\rqGnBWQ.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\YJSkLWJ.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\SZkLMFT.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\igfKuIi.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\XjrOfmU.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\rqSXFop.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\OncGWJq.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\YvQDrVf.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\xJNIIac.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\sdmLBmb.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\mrhDjfQ.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\jfXoqcL.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\XgpWOSq.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\HALoJGv.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\zWVCruX.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\PAKTlLP.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\StWMZBG.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\NyQJKPL.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\ketZxuL.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\dBVEYoE.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\Obptlwl.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\pMfCBWm.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\mdtXFdT.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\CXIqPZv.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\LjdSbyz.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\ktGKJMQ.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\RjMBius.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\MXvjjjK.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\tRpfVAF.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\CxSNeYV.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\aMWKRBO.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\XQwcqeB.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\VtdzxhE.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\NnvJdyU.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\mPxutVV.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\zHToPAI.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\NTzdOfB.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\evKCzrQ.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\rkaRIgp.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\cZrapYw.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\ALYTvAV.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\gjTcJxE.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\zAHFjms.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\kyXBdvJ.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\WAOdOcI.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\SvPYKLW.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\XAttSyc.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\zLHsHZb.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\JjOIkTx.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\HSJBjNN.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\qWtpdQP.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\SMQorPU.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
File created	C:\Windows\System\vzwPdMq.exe	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFaultSecure.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exeWerFaultSecure.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WerFaultSecure.exe

pid process

16496 WerFaultSecure.exe
16496 WerFaultSecure.exe

pid	process
16496	WerFaultSecure.exe
16496	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	process
Token: SeCreateGlobalPrivilege	11568	dwm.exe
Token: SeChangeNotifyPrivilege	11568	dwm.exe
Token: 33	11568	dwm.exe
Token: SeIncBasePriorityPrivilege	11568	dwm.exe
Token: SeShutdownPrivilege	11568	dwm.exe
Token: SeCreatePagefilePrivilege	11568	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe

description	pid	process	target process
PID 320 wrote to memory of 3124	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	RtyfSbk.exe
PID 320 wrote to memory of 3124	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	RtyfSbk.exe
PID 320 wrote to memory of 4072	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	SKUAtAN.exe
PID 320 wrote to memory of 4072	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	SKUAtAN.exe
PID 320 wrote to memory of 3396	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	YlapaLV.exe
PID 320 wrote to memory of 3396	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	YlapaLV.exe
PID 320 wrote to memory of 2016	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	CbAoIia.exe
PID 320 wrote to memory of 2016	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	CbAoIia.exe
PID 320 wrote to memory of 1496	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	PWYHAiF.exe
PID 320 wrote to memory of 1496	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	PWYHAiF.exe
PID 320 wrote to memory of 4824	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	aqqCgWw.exe
PID 320 wrote to memory of 4824	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	aqqCgWw.exe
PID 320 wrote to memory of 4172	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	mFPhrmU.exe
PID 320 wrote to memory of 4172	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	mFPhrmU.exe
PID 320 wrote to memory of 3356	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	WFeoBLi.exe
PID 320 wrote to memory of 3356	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	WFeoBLi.exe
PID 320 wrote to memory of 924	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	cJKAejm.exe
PID 320 wrote to memory of 924	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	cJKAejm.exe
PID 320 wrote to memory of 2672	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	dejympz.exe
PID 320 wrote to memory of 2672	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	dejympz.exe
PID 320 wrote to memory of 2020	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	hnYoIav.exe
PID 320 wrote to memory of 2020	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	hnYoIav.exe
PID 320 wrote to memory of 1116	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	uaiduYW.exe
PID 320 wrote to memory of 1116	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	uaiduYW.exe
PID 320 wrote to memory of 3360	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	CJyVtNF.exe
PID 320 wrote to memory of 3360	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	CJyVtNF.exe
PID 320 wrote to memory of 2604	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	XNjNyQz.exe
PID 320 wrote to memory of 2604	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	XNjNyQz.exe
PID 320 wrote to memory of 4508	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	mfehLAl.exe
PID 320 wrote to memory of 4508	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	mfehLAl.exe
PID 320 wrote to memory of 5056	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	THesjMn.exe
PID 320 wrote to memory of 5056	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	THesjMn.exe
PID 320 wrote to memory of 3256	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	gEBiZYp.exe
PID 320 wrote to memory of 3256	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	gEBiZYp.exe
PID 320 wrote to memory of 3644	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	BPQRQHG.exe
PID 320 wrote to memory of 3644	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	BPQRQHG.exe
PID 320 wrote to memory of 2072	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	CjiiTNj.exe
PID 320 wrote to memory of 2072	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	CjiiTNj.exe
PID 320 wrote to memory of 3064	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	BTgJTHB.exe
PID 320 wrote to memory of 3064	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	BTgJTHB.exe
PID 320 wrote to memory of 736	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	oWyGnhy.exe
PID 320 wrote to memory of 736	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	oWyGnhy.exe
PID 320 wrote to memory of 4688	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	AkNUArH.exe
PID 320 wrote to memory of 4688	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	AkNUArH.exe
PID 320 wrote to memory of 2532	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	XgbKsbD.exe
PID 320 wrote to memory of 2532	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	XgbKsbD.exe
PID 320 wrote to memory of 2392	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	PZFbDFi.exe
PID 320 wrote to memory of 2392	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	PZFbDFi.exe
PID 320 wrote to memory of 4260	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	UoyghNb.exe
PID 320 wrote to memory of 4260	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	UoyghNb.exe
PID 320 wrote to memory of 1176	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	pjMWiMA.exe
PID 320 wrote to memory of 1176	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	pjMWiMA.exe
PID 320 wrote to memory of 3804	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	LoQjakY.exe
PID 320 wrote to memory of 3804	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	LoQjakY.exe
PID 320 wrote to memory of 2952	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	fkRJMMy.exe
PID 320 wrote to memory of 2952	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	fkRJMMy.exe
PID 320 wrote to memory of 2432	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	QMgWHVU.exe
PID 320 wrote to memory of 2432	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	QMgWHVU.exe
PID 320 wrote to memory of 3620	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	Jhwcvmq.exe
PID 320 wrote to memory of 3620	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	Jhwcvmq.exe
PID 320 wrote to memory of 3276	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	IsJWIeu.exe
PID 320 wrote to memory of 3276	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	IsJWIeu.exe
PID 320 wrote to memory of 3248	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	suVRXSO.exe
PID 320 wrote to memory of 3248	320	c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe	suVRXSO.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4320
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4320 -s 920
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:16496

C:\Users\Admin\AppData\Local\Temp\c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe
"C:\Users\Admin\AppData\Local\Temp\c04a5bb7dad9a616df542ba56c01774f9d1472b5f07263cec6364242b3f30f9a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:320
- C:\Windows\System\RtyfSbk.exe
  C:\Windows\System\RtyfSbk.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\SKUAtAN.exe
  C:\Windows\System\SKUAtAN.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\YlapaLV.exe
  C:\Windows\System\YlapaLV.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\CbAoIia.exe
  C:\Windows\System\CbAoIia.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\PWYHAiF.exe
  C:\Windows\System\PWYHAiF.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\aqqCgWw.exe
  C:\Windows\System\aqqCgWw.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\mFPhrmU.exe
  C:\Windows\System\mFPhrmU.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\WFeoBLi.exe
  C:\Windows\System\WFeoBLi.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\cJKAejm.exe
  C:\Windows\System\cJKAejm.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\dejympz.exe
  C:\Windows\System\dejympz.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\hnYoIav.exe
  C:\Windows\System\hnYoIav.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\uaiduYW.exe
  C:\Windows\System\uaiduYW.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\CJyVtNF.exe
  C:\Windows\System\CJyVtNF.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\XNjNyQz.exe
  C:\Windows\System\XNjNyQz.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\mfehLAl.exe
  C:\Windows\System\mfehLAl.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\THesjMn.exe
  C:\Windows\System\THesjMn.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\gEBiZYp.exe
  C:\Windows\System\gEBiZYp.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\BPQRQHG.exe
  C:\Windows\System\BPQRQHG.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\CjiiTNj.exe
  C:\Windows\System\CjiiTNj.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\BTgJTHB.exe
  C:\Windows\System\BTgJTHB.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\oWyGnhy.exe
  C:\Windows\System\oWyGnhy.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\AkNUArH.exe
  C:\Windows\System\AkNUArH.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\XgbKsbD.exe
  C:\Windows\System\XgbKsbD.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\PZFbDFi.exe
  C:\Windows\System\PZFbDFi.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\UoyghNb.exe
  C:\Windows\System\UoyghNb.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\pjMWiMA.exe
  C:\Windows\System\pjMWiMA.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\LoQjakY.exe
  C:\Windows\System\LoQjakY.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\fkRJMMy.exe
  C:\Windows\System\fkRJMMy.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\QMgWHVU.exe
  C:\Windows\System\QMgWHVU.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\Jhwcvmq.exe
  C:\Windows\System\Jhwcvmq.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\IsJWIeu.exe
  C:\Windows\System\IsJWIeu.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\suVRXSO.exe
  C:\Windows\System\suVRXSO.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\TEtAPbj.exe
  C:\Windows\System\TEtAPbj.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\ktGKJMQ.exe
  C:\Windows\System\ktGKJMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\jkJUIkU.exe
  C:\Windows\System\jkJUIkU.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\CgeREsM.exe
  C:\Windows\System\CgeREsM.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\ALYTvAV.exe
  C:\Windows\System\ALYTvAV.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\pXQDhhn.exe
  C:\Windows\System\pXQDhhn.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ilkDYoY.exe
  C:\Windows\System\ilkDYoY.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\pncuPGu.exe
  C:\Windows\System\pncuPGu.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\AhJtQqI.exe
  C:\Windows\System\AhJtQqI.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\gwgOnkB.exe
  C:\Windows\System\gwgOnkB.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\RjMBius.exe
  C:\Windows\System\RjMBius.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\YJSkLWJ.exe
  C:\Windows\System\YJSkLWJ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\QMEQxNw.exe
  C:\Windows\System\QMEQxNw.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\OCjutJe.exe
  C:\Windows\System\OCjutJe.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\zPlxjzu.exe
  C:\Windows\System\zPlxjzu.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\fipIGfW.exe
  C:\Windows\System\fipIGfW.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\YpsWIbq.exe
  C:\Windows\System\YpsWIbq.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\twsWfpJ.exe
  C:\Windows\System\twsWfpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\phLZkQr.exe
  C:\Windows\System\phLZkQr.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\ngmhyRO.exe
  C:\Windows\System\ngmhyRO.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\YUqYWIo.exe
  C:\Windows\System\YUqYWIo.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\pbzTPkL.exe
  C:\Windows\System\pbzTPkL.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\UkWGKDL.exe
  C:\Windows\System\UkWGKDL.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\QJDUjBd.exe
  C:\Windows\System\QJDUjBd.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\GyVCZNw.exe
  C:\Windows\System\GyVCZNw.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\einPxaU.exe
  C:\Windows\System\einPxaU.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\ZTSJLgx.exe
  C:\Windows\System\ZTSJLgx.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\iEkBXur.exe
  C:\Windows\System\iEkBXur.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\UhMZyrW.exe
  C:\Windows\System\UhMZyrW.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\kadjDeq.exe
  C:\Windows\System\kadjDeq.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\nvTkuaN.exe
  C:\Windows\System\nvTkuaN.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\wDbTVOu.exe
  C:\Windows\System\wDbTVOu.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\ZlcnaIP.exe
  C:\Windows\System\ZlcnaIP.exe
  2⤵
  PID:4648
- C:\Windows\System\LdwbDkb.exe
  C:\Windows\System\LdwbDkb.exe
  2⤵
  PID:4608
- C:\Windows\System\IxlfHUU.exe
  C:\Windows\System\IxlfHUU.exe
  2⤵
  PID:3908
- C:\Windows\System\igfKuIi.exe
  C:\Windows\System\igfKuIi.exe
  2⤵
  PID:4192
- C:\Windows\System\ZQtUDpV.exe
  C:\Windows\System\ZQtUDpV.exe
  2⤵
  PID:1416
- C:\Windows\System\Qdeqbhh.exe
  C:\Windows\System\Qdeqbhh.exe
  2⤵
  PID:576
- C:\Windows\System\rDUBmyH.exe
  C:\Windows\System\rDUBmyH.exe
  2⤵
  PID:2796
- C:\Windows\System\zNbZgjU.exe
  C:\Windows\System\zNbZgjU.exe
  2⤵
  PID:4116
- C:\Windows\System\lxsUjgo.exe
  C:\Windows\System\lxsUjgo.exe
  2⤵
  PID:2700
- C:\Windows\System\cofOPTq.exe
  C:\Windows\System\cofOPTq.exe
  2⤵
  PID:1840
- C:\Windows\System\xKHgdRl.exe
  C:\Windows\System\xKHgdRl.exe
  2⤵
  PID:208
- C:\Windows\System\MqMDbgr.exe
  C:\Windows\System\MqMDbgr.exe
  2⤵
  PID:2324
- C:\Windows\System\eQXHeNH.exe
  C:\Windows\System\eQXHeNH.exe
  2⤵
  PID:1664
- C:\Windows\System\ujXValS.exe
  C:\Windows\System\ujXValS.exe
  2⤵
  PID:3404
- C:\Windows\System\jveoBNO.exe
  C:\Windows\System\jveoBNO.exe
  2⤵
  PID:1888
- C:\Windows\System\iQSYHrS.exe
  C:\Windows\System\iQSYHrS.exe
  2⤵
  PID:4468
- C:\Windows\System\aMscHUx.exe
  C:\Windows\System\aMscHUx.exe
  2⤵
  PID:4628
- C:\Windows\System\xcyQFwW.exe
  C:\Windows\System\xcyQFwW.exe
  2⤵
  PID:4820
- C:\Windows\System\yjraQxl.exe
  C:\Windows\System\yjraQxl.exe
  2⤵
  PID:2492
- C:\Windows\System\baNgUpY.exe
  C:\Windows\System\baNgUpY.exe
  2⤵
  PID:2496
- C:\Windows\System\LpQLLsP.exe
  C:\Windows\System\LpQLLsP.exe
  2⤵
  PID:1380
- C:\Windows\System\wfCdAIO.exe
  C:\Windows\System\wfCdAIO.exe
  2⤵
  PID:2352
- C:\Windows\System\ijJgKmc.exe
  C:\Windows\System\ijJgKmc.exe
  2⤵
  PID:116
- C:\Windows\System\GDTMwNR.exe
  C:\Windows\System\GDTMwNR.exe
  2⤵
  PID:4448
- C:\Windows\System\YpmIFUf.exe
  C:\Windows\System\YpmIFUf.exe
  2⤵
  PID:2224
- C:\Windows\System\XYhcpfa.exe
  C:\Windows\System\XYhcpfa.exe
  2⤵
  PID:768
- C:\Windows\System\pFRsCwx.exe
  C:\Windows\System\pFRsCwx.exe
  2⤵
  PID:3600
- C:\Windows\System\YJMnQjZ.exe
  C:\Windows\System\YJMnQjZ.exe
  2⤵
  PID:3024
- C:\Windows\System\zFGxfWQ.exe
  C:\Windows\System\zFGxfWQ.exe
  2⤵
  PID:680
- C:\Windows\System\SEmCKSg.exe
  C:\Windows\System\SEmCKSg.exe
  2⤵
  PID:2740
- C:\Windows\System\aMBzkhM.exe
  C:\Windows\System\aMBzkhM.exe
  2⤵
  PID:4952
- C:\Windows\System\ssFxghh.exe
  C:\Windows\System\ssFxghh.exe
  2⤵
  PID:1952
- C:\Windows\System\MVKShzC.exe
  C:\Windows\System\MVKShzC.exe
  2⤵
  PID:740
- C:\Windows\System\wuDresH.exe
  C:\Windows\System\wuDresH.exe
  2⤵
  PID:3020
- C:\Windows\System\hnMRwUI.exe
  C:\Windows\System\hnMRwUI.exe
  2⤵
  PID:912
- C:\Windows\System\qaUxMJN.exe
  C:\Windows\System\qaUxMJN.exe
  2⤵
  PID:4676
- C:\Windows\System\yhYBrVF.exe
  C:\Windows\System\yhYBrVF.exe
  2⤵
  PID:1852
- C:\Windows\System\UjoVKCU.exe
  C:\Windows\System\UjoVKCU.exe
  2⤵
  PID:3900
- C:\Windows\System\WuaznsF.exe
  C:\Windows\System\WuaznsF.exe
  2⤵
  PID:3560
- C:\Windows\System\Eehegad.exe
  C:\Windows\System\Eehegad.exe
  2⤵
  PID:5140
- C:\Windows\System\QohRlLB.exe
  C:\Windows\System\QohRlLB.exe
  2⤵
  PID:5164
- C:\Windows\System\jPGPwbw.exe
  C:\Windows\System\jPGPwbw.exe
  2⤵
  PID:5196
- C:\Windows\System\IOZtIeh.exe
  C:\Windows\System\IOZtIeh.exe
  2⤵
  PID:5224
- C:\Windows\System\BkNrQjw.exe
  C:\Windows\System\BkNrQjw.exe
  2⤵
  PID:5260
- C:\Windows\System\qWtpdQP.exe
  C:\Windows\System\qWtpdQP.exe
  2⤵
  PID:5348
- C:\Windows\System\QYAVEeI.exe
  C:\Windows\System\QYAVEeI.exe
  2⤵
  PID:5364
- C:\Windows\System\wIUeLab.exe
  C:\Windows\System\wIUeLab.exe
  2⤵
  PID:5392
- C:\Windows\System\OgHqXEE.exe
  C:\Windows\System\OgHqXEE.exe
  2⤵
  PID:5420
- C:\Windows\System\KrJJcJW.exe
  C:\Windows\System\KrJJcJW.exe
  2⤵
  PID:5444
- C:\Windows\System\PwqoCpR.exe
  C:\Windows\System\PwqoCpR.exe
  2⤵
  PID:5468
- C:\Windows\System\eMxYIbL.exe
  C:\Windows\System\eMxYIbL.exe
  2⤵
  PID:5500
- C:\Windows\System\nMLuOdp.exe
  C:\Windows\System\nMLuOdp.exe
  2⤵
  PID:5528
- C:\Windows\System\zoamvxE.exe
  C:\Windows\System\zoamvxE.exe
  2⤵
  PID:5552
- C:\Windows\System\ScrvRcC.exe
  C:\Windows\System\ScrvRcC.exe
  2⤵
  PID:5580
- C:\Windows\System\uqVBITS.exe
  C:\Windows\System\uqVBITS.exe
  2⤵
  PID:5612
- C:\Windows\System\ROWInBe.exe
  C:\Windows\System\ROWInBe.exe
  2⤵
  PID:5644
- C:\Windows\System\leCFhNW.exe
  C:\Windows\System\leCFhNW.exe
  2⤵
  PID:5676
- C:\Windows\System\oPHGicR.exe
  C:\Windows\System\oPHGicR.exe
  2⤵
  PID:5712
- C:\Windows\System\nWRDTGJ.exe
  C:\Windows\System\nWRDTGJ.exe
  2⤵
  PID:5732
- C:\Windows\System\uhQjraw.exe
  C:\Windows\System\uhQjraw.exe
  2⤵
  PID:5764
- C:\Windows\System\wtmKYTk.exe
  C:\Windows\System\wtmKYTk.exe
  2⤵
  PID:5788
- C:\Windows\System\EUElVzS.exe
  C:\Windows\System\EUElVzS.exe
  2⤵
  PID:5816
- C:\Windows\System\loyXEEn.exe
  C:\Windows\System\loyXEEn.exe
  2⤵
  PID:5840
- C:\Windows\System\zxhtjzl.exe
  C:\Windows\System\zxhtjzl.exe
  2⤵
  PID:5876
- C:\Windows\System\HBYyRnW.exe
  C:\Windows\System\HBYyRnW.exe
  2⤵
  PID:5904
- C:\Windows\System\tVBzjXz.exe
  C:\Windows\System\tVBzjXz.exe
  2⤵
  PID:5932
- C:\Windows\System\XqcbqYC.exe
  C:\Windows\System\XqcbqYC.exe
  2⤵
  PID:5964
- C:\Windows\System\nINRHLL.exe
  C:\Windows\System\nINRHLL.exe
  2⤵
  PID:5992
- C:\Windows\System\jDSwAco.exe
  C:\Windows\System\jDSwAco.exe
  2⤵
  PID:6012
- C:\Windows\System\VIpZGQL.exe
  C:\Windows\System\VIpZGQL.exe
  2⤵
  PID:6044
- C:\Windows\System\dIjZwfj.exe
  C:\Windows\System\dIjZwfj.exe
  2⤵
  PID:6072
- C:\Windows\System\zSVMwqB.exe
  C:\Windows\System\zSVMwqB.exe
  2⤵
  PID:6096
- C:\Windows\System\gASoUta.exe
  C:\Windows\System\gASoUta.exe
  2⤵
  PID:6124
- C:\Windows\System\HzftdMI.exe
  C:\Windows\System\HzftdMI.exe
  2⤵
  PID:1432
- C:\Windows\System\ABzNrfm.exe
  C:\Windows\System\ABzNrfm.exe
  2⤵
  PID:1120
- C:\Windows\System\FFIawat.exe
  C:\Windows\System\FFIawat.exe
  2⤵
  PID:2056
- C:\Windows\System\mJcTJIk.exe
  C:\Windows\System\mJcTJIk.exe
  2⤵
  PID:1292
- C:\Windows\System\PkyUFWe.exe
  C:\Windows\System\PkyUFWe.exe
  2⤵
  PID:5240
- C:\Windows\System\lWQDXHj.exe
  C:\Windows\System\lWQDXHj.exe
  2⤵
  PID:5156
- C:\Windows\System\zyqftSE.exe
  C:\Windows\System\zyqftSE.exe
  2⤵
  PID:5204
- C:\Windows\System\VnVmApt.exe
  C:\Windows\System\VnVmApt.exe
  2⤵
  PID:5276
- C:\Windows\System\kesdPID.exe
  C:\Windows\System\kesdPID.exe
  2⤵
  PID:5404
- C:\Windows\System\uQdozwL.exe
  C:\Windows\System\uQdozwL.exe
  2⤵
  PID:5508
- C:\Windows\System\kkhDORw.exe
  C:\Windows\System\kkhDORw.exe
  2⤵
  PID:5656
- C:\Windows\System\idOxVTq.exe
  C:\Windows\System\idOxVTq.exe
  2⤵
  PID:5776
- C:\Windows\System\edhDpWl.exe
  C:\Windows\System\edhDpWl.exe
  2⤵
  PID:5916
- C:\Windows\System\zVmMMSO.exe
  C:\Windows\System\zVmMMSO.exe
  2⤵
  PID:6000
- C:\Windows\System\ZzZInFs.exe
  C:\Windows\System\ZzZInFs.exe
  2⤵
  PID:6052
- C:\Windows\System\VtdzxhE.exe
  C:\Windows\System\VtdzxhE.exe
  2⤵
  PID:1600
- C:\Windows\System\gHwIjGr.exe
  C:\Windows\System\gHwIjGr.exe
  2⤵
  PID:6064
- C:\Windows\System\HoHPLgU.exe
  C:\Windows\System\HoHPLgU.exe
  2⤵
  PID:3792
- C:\Windows\System\iVStIYg.exe
  C:\Windows\System\iVStIYg.exe
  2⤵
  PID:4056
- C:\Windows\System\pEMdhSC.exe
  C:\Windows\System\pEMdhSC.exe
  2⤵
  PID:2096
- C:\Windows\System\uiiUUzX.exe
  C:\Windows\System\uiiUUzX.exe
  2⤵
  PID:5380
- C:\Windows\System\ZDLnxtK.exe
  C:\Windows\System\ZDLnxtK.exe
  2⤵
  PID:5188
- C:\Windows\System\mrhDjfQ.exe
  C:\Windows\System\mrhDjfQ.exe
  2⤵
  PID:5356
- C:\Windows\System\LCWgmsa.exe
  C:\Windows\System\LCWgmsa.exe
  2⤵
  PID:5828
- C:\Windows\System\exMXlKc.exe
  C:\Windows\System\exMXlKc.exe
  2⤵
  PID:6008
- C:\Windows\System\jfXoqcL.exe
  C:\Windows\System\jfXoqcL.exe
  2⤵
  PID:2320
- C:\Windows\System\EclWraq.exe
  C:\Windows\System\EclWraq.exe
  2⤵
  PID:6132
- C:\Windows\System\oxMxBRz.exe
  C:\Windows\System\oxMxBRz.exe
  2⤵
  PID:4620
- C:\Windows\System\SjRHrAL.exe
  C:\Windows\System\SjRHrAL.exe
  2⤵
  PID:5272
- C:\Windows\System\fLSLpeD.exe
  C:\Windows\System\fLSLpeD.exe
  2⤵
  PID:5852
- C:\Windows\System\GSrcnwD.exe
  C:\Windows\System\GSrcnwD.exe
  2⤵
  PID:5176
- C:\Windows\System\ebDCWJh.exe
  C:\Windows\System\ebDCWJh.exe
  2⤵
  PID:6164
- C:\Windows\System\NKtrLSp.exe
  C:\Windows\System\NKtrLSp.exe
  2⤵
  PID:6192
- C:\Windows\System\nSrczuO.exe
  C:\Windows\System\nSrczuO.exe
  2⤵
  PID:6216
- C:\Windows\System\oTiCwlw.exe
  C:\Windows\System\oTiCwlw.exe
  2⤵
  PID:6248
- C:\Windows\System\URbornW.exe
  C:\Windows\System\URbornW.exe
  2⤵
  PID:6276
- C:\Windows\System\AIQljhO.exe
  C:\Windows\System\AIQljhO.exe
  2⤵
  PID:6308
- C:\Windows\System\PgBTHnI.exe
  C:\Windows\System\PgBTHnI.exe
  2⤵
  PID:6332
- C:\Windows\System\ruKJdMh.exe
  C:\Windows\System\ruKJdMh.exe
  2⤵
  PID:6360
- C:\Windows\System\mQZhDEf.exe
  C:\Windows\System\mQZhDEf.exe
  2⤵
  PID:6384
- C:\Windows\System\EJYcAwo.exe
  C:\Windows\System\EJYcAwo.exe
  2⤵
  PID:6404
- C:\Windows\System\QEbeiCx.exe
  C:\Windows\System\QEbeiCx.exe
  2⤵
  PID:6428
- C:\Windows\System\oMiDlrN.exe
  C:\Windows\System\oMiDlrN.exe
  2⤵
  PID:6452
- C:\Windows\System\OIuCWhz.exe
  C:\Windows\System\OIuCWhz.exe
  2⤵
  PID:6472
- C:\Windows\System\IstaPEG.exe
  C:\Windows\System\IstaPEG.exe
  2⤵
  PID:6500
- C:\Windows\System\WAXAZMS.exe
  C:\Windows\System\WAXAZMS.exe
  2⤵
  PID:6520
- C:\Windows\System\GEdzgVy.exe
  C:\Windows\System\GEdzgVy.exe
  2⤵
  PID:6548
- C:\Windows\System\duHldiB.exe
  C:\Windows\System\duHldiB.exe
  2⤵
  PID:6572
- C:\Windows\System\tSQvMQE.exe
  C:\Windows\System\tSQvMQE.exe
  2⤵
  PID:6608
- C:\Windows\System\FFGfens.exe
  C:\Windows\System\FFGfens.exe
  2⤵
  PID:6628
- C:\Windows\System\zcbJHoi.exe
  C:\Windows\System\zcbJHoi.exe
  2⤵
  PID:6652
- C:\Windows\System\ketZxuL.exe
  C:\Windows\System\ketZxuL.exe
  2⤵
  PID:6672
- C:\Windows\System\iZGEnoS.exe
  C:\Windows\System\iZGEnoS.exe
  2⤵
  PID:6704
- C:\Windows\System\qgsBKXp.exe
  C:\Windows\System\qgsBKXp.exe
  2⤵
  PID:6724
- C:\Windows\System\uZAgHzq.exe
  C:\Windows\System\uZAgHzq.exe
  2⤵
  PID:6744
- C:\Windows\System\CvfWMaK.exe
  C:\Windows\System\CvfWMaK.exe
  2⤵
  PID:6772
- C:\Windows\System\xanuBtO.exe
  C:\Windows\System\xanuBtO.exe
  2⤵
  PID:6796
- C:\Windows\System\PknhiQO.exe
  C:\Windows\System\PknhiQO.exe
  2⤵
  PID:6824
- C:\Windows\System\uzZYQfo.exe
  C:\Windows\System\uzZYQfo.exe
  2⤵
  PID:6852
- C:\Windows\System\pfppqRS.exe
  C:\Windows\System\pfppqRS.exe
  2⤵
  PID:6872
- C:\Windows\System\jhqNIhO.exe
  C:\Windows\System\jhqNIhO.exe
  2⤵
  PID:6896
- C:\Windows\System\ZAclKRf.exe
  C:\Windows\System\ZAclKRf.exe
  2⤵
  PID:6916
- C:\Windows\System\MpHBqok.exe
  C:\Windows\System\MpHBqok.exe
  2⤵
  PID:6944
- C:\Windows\System\dqyRtnC.exe
  C:\Windows\System\dqyRtnC.exe
  2⤵
  PID:6976
- C:\Windows\System\OHspItg.exe
  C:\Windows\System\OHspItg.exe
  2⤵
  PID:6996
- C:\Windows\System\quDlrwd.exe
  C:\Windows\System\quDlrwd.exe
  2⤵
  PID:7016
- C:\Windows\System\GvrhAIT.exe
  C:\Windows\System\GvrhAIT.exe
  2⤵
  PID:7044
- C:\Windows\System\SSOlquo.exe
  C:\Windows\System\SSOlquo.exe
  2⤵
  PID:7064
- C:\Windows\System\yMfMctT.exe
  C:\Windows\System\yMfMctT.exe
  2⤵
  PID:7092
- C:\Windows\System\AYQphuA.exe
  C:\Windows\System\AYQphuA.exe
  2⤵
  PID:7116
- C:\Windows\System\txDcoIM.exe
  C:\Windows\System\txDcoIM.exe
  2⤵
  PID:7140
- C:\Windows\System\iRscxHK.exe
  C:\Windows\System\iRscxHK.exe
  2⤵
  PID:7164
- C:\Windows\System\WirIjTU.exe
  C:\Windows\System\WirIjTU.exe
  2⤵
  PID:6148
- C:\Windows\System\tfsxgSr.exe
  C:\Windows\System\tfsxgSr.exe
  2⤵
  PID:6240
- C:\Windows\System\SMoWvhI.exe
  C:\Windows\System\SMoWvhI.exe
  2⤵
  PID:6176
- C:\Windows\System\UGUexEN.exe
  C:\Windows\System\UGUexEN.exe
  2⤵
  PID:6228
- C:\Windows\System\NnvJdyU.exe
  C:\Windows\System\NnvJdyU.exe
  2⤵
  PID:6356
- C:\Windows\System\JGxzpQo.exe
  C:\Windows\System\JGxzpQo.exe
  2⤵
  PID:6444
- C:\Windows\System\nXQNzQx.exe
  C:\Windows\System\nXQNzQx.exe
  2⤵
  PID:6420
- C:\Windows\System\ZAHLFvp.exe
  C:\Windows\System\ZAHLFvp.exe
  2⤵
  PID:6620
- C:\Windows\System\iiPeixK.exe
  C:\Windows\System\iiPeixK.exe
  2⤵
  PID:6680
- C:\Windows\System\QMtMrDu.exe
  C:\Windows\System\QMtMrDu.exe
  2⤵
  PID:6756
- C:\Windows\System\iQuzzmp.exe
  C:\Windows\System\iQuzzmp.exe
  2⤵
  PID:6716
- C:\Windows\System\CEofcdT.exe
  C:\Windows\System\CEofcdT.exe
  2⤵
  PID:6664
- C:\Windows\System\PjBfaOe.exe
  C:\Windows\System\PjBfaOe.exe
  2⤵
  PID:6868
- C:\Windows\System\akhEYaJ.exe
  C:\Windows\System\akhEYaJ.exe
  2⤵
  PID:6964
- C:\Windows\System\xPyfIFp.exe
  C:\Windows\System\xPyfIFp.exe
  2⤵
  PID:6992
- C:\Windows\System\XvwCHay.exe
  C:\Windows\System\XvwCHay.exe
  2⤵
  PID:6892
- C:\Windows\System\BBuweoc.exe
  C:\Windows\System\BBuweoc.exe
  2⤵
  PID:6908
- C:\Windows\System\IorpZbV.exe
  C:\Windows\System\IorpZbV.exe
  2⤵
  PID:5952
- C:\Windows\System\oItbmZT.exe
  C:\Windows\System\oItbmZT.exe
  2⤵
  PID:6272
- C:\Windows\System\dBVEYoE.exe
  C:\Windows\System\dBVEYoE.exe
  2⤵
  PID:7060
- C:\Windows\System\xueQPUZ.exe
  C:\Windows\System\xueQPUZ.exe
  2⤵
  PID:6348
- C:\Windows\System\uDBXXte.exe
  C:\Windows\System\uDBXXte.exe
  2⤵
  PID:6512
- C:\Windows\System\QLVkouz.exe
  C:\Windows\System\QLVkouz.exe
  2⤵
  PID:6156
- C:\Windows\System\SZpKeMn.exe
  C:\Windows\System\SZpKeMn.exe
  2⤵
  PID:7196
- C:\Windows\System\AfgQUEx.exe
  C:\Windows\System\AfgQUEx.exe
  2⤵
  PID:7220
- C:\Windows\System\hfOcPAY.exe
  C:\Windows\System\hfOcPAY.exe
  2⤵
  PID:7240
- C:\Windows\System\AlWhUsd.exe
  C:\Windows\System\AlWhUsd.exe
  2⤵
  PID:7268
- C:\Windows\System\txWhGVD.exe
  C:\Windows\System\txWhGVD.exe
  2⤵
  PID:7288
- C:\Windows\System\RcjQKwy.exe
  C:\Windows\System\RcjQKwy.exe
  2⤵
  PID:7312
- C:\Windows\System\fEBTXEe.exe
  C:\Windows\System\fEBTXEe.exe
  2⤵
  PID:7336
- C:\Windows\System\tRpfVAF.exe
  C:\Windows\System\tRpfVAF.exe
  2⤵
  PID:7356
- C:\Windows\System\oQsdBkM.exe
  C:\Windows\System\oQsdBkM.exe
  2⤵
  PID:7376
- C:\Windows\System\ADLqXvC.exe
  C:\Windows\System\ADLqXvC.exe
  2⤵
  PID:7400
- C:\Windows\System\BNyGykT.exe
  C:\Windows\System\BNyGykT.exe
  2⤵
  PID:7420
- C:\Windows\System\bOgTAmO.exe
  C:\Windows\System\bOgTAmO.exe
  2⤵
  PID:7440
- C:\Windows\System\sOPwWcA.exe
  C:\Windows\System\sOPwWcA.exe
  2⤵
  PID:7464
- C:\Windows\System\tiXeViK.exe
  C:\Windows\System\tiXeViK.exe
  2⤵
  PID:7488
- C:\Windows\System\vITvqqL.exe
  C:\Windows\System\vITvqqL.exe
  2⤵
  PID:7508
- C:\Windows\System\SMQorPU.exe
  C:\Windows\System\SMQorPU.exe
  2⤵
  PID:7528
- C:\Windows\System\rkaRIgp.exe
  C:\Windows\System\rkaRIgp.exe
  2⤵
  PID:7544
- C:\Windows\System\OKVmUMn.exe
  C:\Windows\System\OKVmUMn.exe
  2⤵
  PID:7568
- C:\Windows\System\qemFmPJ.exe
  C:\Windows\System\qemFmPJ.exe
  2⤵
  PID:7588
- C:\Windows\System\KftTWmg.exe
  C:\Windows\System\KftTWmg.exe
  2⤵
  PID:7616
- C:\Windows\System\QMNnnxW.exe
  C:\Windows\System\QMNnnxW.exe
  2⤵
  PID:7644
- C:\Windows\System\GWaeJro.exe
  C:\Windows\System\GWaeJro.exe
  2⤵
  PID:7664
- C:\Windows\System\XvRUAGI.exe
  C:\Windows\System\XvRUAGI.exe
  2⤵
  PID:7692
- C:\Windows\System\wNQdRCP.exe
  C:\Windows\System\wNQdRCP.exe
  2⤵
  PID:7712
- C:\Windows\System\TVUiTTi.exe
  C:\Windows\System\TVUiTTi.exe
  2⤵
  PID:7728
- C:\Windows\System\GRZzobI.exe
  C:\Windows\System\GRZzobI.exe
  2⤵
  PID:7748
- C:\Windows\System\ioTVYGd.exe
  C:\Windows\System\ioTVYGd.exe
  2⤵
  PID:7776
- C:\Windows\System\GRczlwS.exe
  C:\Windows\System\GRczlwS.exe
  2⤵
  PID:7796
- C:\Windows\System\iYURSuy.exe
  C:\Windows\System\iYURSuy.exe
  2⤵
  PID:7820
- C:\Windows\System\DyaFOXJ.exe
  C:\Windows\System\DyaFOXJ.exe
  2⤵
  PID:7848
- C:\Windows\System\PAQxsYg.exe
  C:\Windows\System\PAQxsYg.exe
  2⤵
  PID:7876
- C:\Windows\System\UUldlRi.exe
  C:\Windows\System\UUldlRi.exe
  2⤵
  PID:7904
- C:\Windows\System\UHIaVXd.exe
  C:\Windows\System\UHIaVXd.exe
  2⤵
  PID:7936
- C:\Windows\System\gBhoiEz.exe
  C:\Windows\System\gBhoiEz.exe
  2⤵
  PID:8084
- C:\Windows\System\AIoOYQT.exe
  C:\Windows\System\AIoOYQT.exe
  2⤵
  PID:8112
- C:\Windows\System\yQchEcW.exe
  C:\Windows\System\yQchEcW.exe
  2⤵
  PID:8136
- C:\Windows\System\ddtRwEm.exe
  C:\Windows\System\ddtRwEm.exe
  2⤵
  PID:8168
- C:\Windows\System\CbjbulB.exe
  C:\Windows\System\CbjbulB.exe
  2⤵
  PID:6788
- C:\Windows\System\ZZPInmX.exe
  C:\Windows\System\ZZPInmX.exe
  2⤵
  PID:6644
- C:\Windows\System\mdtXFdT.exe
  C:\Windows\System\mdtXFdT.exe
  2⤵
  PID:7036
- C:\Windows\System\YHSmJlI.exe
  C:\Windows\System\YHSmJlI.exe
  2⤵
  PID:7056
- C:\Windows\System\lXGqpxP.exe
  C:\Windows\System\lXGqpxP.exe
  2⤵
  PID:6540
- C:\Windows\System\QvTgrXd.exe
  C:\Windows\System\QvTgrXd.exe
  2⤵
  PID:7228
- C:\Windows\System\mgmcfqN.exe
  C:\Windows\System\mgmcfqN.exe
  2⤵
  PID:6288
- C:\Windows\System\upnBedZ.exe
  C:\Windows\System\upnBedZ.exe
  2⤵
  PID:7008
- C:\Windows\System\ifoPNiJ.exe
  C:\Windows\System\ifoPNiJ.exe
  2⤵
  PID:7364
- C:\Windows\System\amKONiT.exe
  C:\Windows\System\amKONiT.exe
  2⤵
  PID:6480
- C:\Windows\System\FpUdpaY.exe
  C:\Windows\System\FpUdpaY.exe
  2⤵
  PID:7260
- C:\Windows\System\VSPjkmL.exe
  C:\Windows\System\VSPjkmL.exe
  2⤵
  PID:7556
- C:\Windows\System\XjrOfmU.exe
  C:\Windows\System\XjrOfmU.exe
  2⤵
  PID:7704
- C:\Windows\System\SZkLMFT.exe
  C:\Windows\System\SZkLMFT.exe
  2⤵
  PID:7804
- C:\Windows\System\IyVJWZx.exe
  C:\Windows\System\IyVJWZx.exe
  2⤵
  PID:7604
- C:\Windows\System\UgYkxnn.exe
  C:\Windows\System\UgYkxnn.exe
  2⤵
  PID:7660
- C:\Windows\System\VDaCvxV.exe
  C:\Windows\System\VDaCvxV.exe
  2⤵
  PID:7724
- C:\Windows\System\NBApEkg.exe
  C:\Windows\System\NBApEkg.exe
  2⤵
  PID:7832
- C:\Windows\System\rQkCmGI.exe
  C:\Windows\System\rQkCmGI.exe
  2⤵
  PID:7524
- C:\Windows\System\ouxsDNP.exe
  C:\Windows\System\ouxsDNP.exe
  2⤵
  PID:6580
- C:\Windows\System\HmhMwpb.exe
  C:\Windows\System\HmhMwpb.exe
  2⤵
  PID:8108
- C:\Windows\System\ViHRWNN.exe
  C:\Windows\System\ViHRWNN.exe
  2⤵
  PID:7652
- C:\Windows\System\hsnoRVl.exe
  C:\Windows\System\hsnoRVl.exe
  2⤵
  PID:7516
- C:\Windows\System\GDicgjf.exe
  C:\Windows\System\GDicgjf.exe
  2⤵
  PID:8204
- C:\Windows\System\dgpWugt.exe
  C:\Windows\System\dgpWugt.exe
  2⤵
  PID:8248
- C:\Windows\System\rqSXFop.exe
  C:\Windows\System\rqSXFop.exe
  2⤵
  PID:8280
- C:\Windows\System\utwramL.exe
  C:\Windows\System\utwramL.exe
  2⤵
  PID:8316
- C:\Windows\System\vxNzuQx.exe
  C:\Windows\System\vxNzuQx.exe
  2⤵
  PID:8340
- C:\Windows\System\qhgUWRz.exe
  C:\Windows\System\qhgUWRz.exe
  2⤵
  PID:8368
- C:\Windows\System\zVNPKeN.exe
  C:\Windows\System\zVNPKeN.exe
  2⤵
  PID:8384
- C:\Windows\System\zqtAsEy.exe
  C:\Windows\System\zqtAsEy.exe
  2⤵
  PID:8420
- C:\Windows\System\maZwQeK.exe
  C:\Windows\System\maZwQeK.exe
  2⤵
  PID:8440
- C:\Windows\System\oygAYlN.exe
  C:\Windows\System\oygAYlN.exe
  2⤵
  PID:8456
- C:\Windows\System\NTzdOfB.exe
  C:\Windows\System\NTzdOfB.exe
  2⤵
  PID:8476
- C:\Windows\System\CKBDbuj.exe
  C:\Windows\System\CKBDbuj.exe
  2⤵
  PID:8504
- C:\Windows\System\TfyJYKW.exe
  C:\Windows\System\TfyJYKW.exe
  2⤵
  PID:8528
- C:\Windows\System\wafPfRr.exe
  C:\Windows\System\wafPfRr.exe
  2⤵
  PID:8556
- C:\Windows\System\ugGHnkK.exe
  C:\Windows\System\ugGHnkK.exe
  2⤵
  PID:8580
- C:\Windows\System\oYxQCaT.exe
  C:\Windows\System\oYxQCaT.exe
  2⤵
  PID:8596
- C:\Windows\System\OBUABeY.exe
  C:\Windows\System\OBUABeY.exe
  2⤵
  PID:8612
- C:\Windows\System\jsnyXZK.exe
  C:\Windows\System\jsnyXZK.exe
  2⤵
  PID:8632
- C:\Windows\System\eEWHfNd.exe
  C:\Windows\System\eEWHfNd.exe
  2⤵
  PID:8664
- C:\Windows\System\BUgHwxZ.exe
  C:\Windows\System\BUgHwxZ.exe
  2⤵
  PID:8680
- C:\Windows\System\fKHIzPV.exe
  C:\Windows\System\fKHIzPV.exe
  2⤵
  PID:8712
- C:\Windows\System\fPXoWXU.exe
  C:\Windows\System\fPXoWXU.exe
  2⤵
  PID:8732
- C:\Windows\System\fjIKkLh.exe
  C:\Windows\System\fjIKkLh.exe
  2⤵
  PID:8756
- C:\Windows\System\jcKtshg.exe
  C:\Windows\System\jcKtshg.exe
  2⤵
  PID:8772
- C:\Windows\System\bMRTmrL.exe
  C:\Windows\System\bMRTmrL.exe
  2⤵
  PID:8800
- C:\Windows\System\PNRZyPO.exe
  C:\Windows\System\PNRZyPO.exe
  2⤵
  PID:8824
- C:\Windows\System\PeYrNfk.exe
  C:\Windows\System\PeYrNfk.exe
  2⤵
  PID:8848
- C:\Windows\System\uHgZMIC.exe
  C:\Windows\System\uHgZMIC.exe
  2⤵
  PID:8880
- C:\Windows\System\SuYaVpr.exe
  C:\Windows\System\SuYaVpr.exe
  2⤵
  PID:8900
- C:\Windows\System\ucsZxvw.exe
  C:\Windows\System\ucsZxvw.exe
  2⤵
  PID:8928
- C:\Windows\System\IRsjUwi.exe
  C:\Windows\System\IRsjUwi.exe
  2⤵
  PID:8956
- C:\Windows\System\QmmuRSR.exe
  C:\Windows\System\QmmuRSR.exe
  2⤵
  PID:8980
- C:\Windows\System\qOXGTaV.exe
  C:\Windows\System\qOXGTaV.exe
  2⤵
  PID:9000
- C:\Windows\System\QFwFvTV.exe
  C:\Windows\System\QFwFvTV.exe
  2⤵
  PID:9024
- C:\Windows\System\SiDZahC.exe
  C:\Windows\System\SiDZahC.exe
  2⤵
  PID:9048
- C:\Windows\System\jxViWSa.exe
  C:\Windows\System\jxViWSa.exe
  2⤵
  PID:9076
- C:\Windows\System\YHWrFEq.exe
  C:\Windows\System\YHWrFEq.exe
  2⤵
  PID:9104
- C:\Windows\System\xXAhJzN.exe
  C:\Windows\System\xXAhJzN.exe
  2⤵
  PID:9120
- C:\Windows\System\evKCzrQ.exe
  C:\Windows\System\evKCzrQ.exe
  2⤵
  PID:9152
- C:\Windows\System\LlYMAsx.exe
  C:\Windows\System\LlYMAsx.exe
  2⤵
  PID:9176
- C:\Windows\System\AMhjoYT.exe
  C:\Windows\System\AMhjoYT.exe
  2⤵
  PID:9200
- C:\Windows\System\kNWLQOD.exe
  C:\Windows\System\kNWLQOD.exe
  2⤵
  PID:7124
- C:\Windows\System\AlRMELu.exe
  C:\Windows\System\AlRMELu.exe
  2⤵
  PID:6468
- C:\Windows\System\TSDokRk.exe
  C:\Windows\System\TSDokRk.exe
  2⤵
  PID:7632
- C:\Windows\System\ojrARmi.exe
  C:\Windows\System\ojrARmi.exe
  2⤵
  PID:8288
- C:\Windows\System\ipGBNKF.exe
  C:\Windows\System\ipGBNKF.exe
  2⤵
  PID:7624
- C:\Windows\System\SsrcLAi.exe
  C:\Windows\System\SsrcLAi.exe
  2⤵
  PID:8152
- C:\Windows\System\QYWMUhf.exe
  C:\Windows\System\QYWMUhf.exe
  2⤵
  PID:8492
- C:\Windows\System\EojTNdB.exe
  C:\Windows\System\EojTNdB.exe
  2⤵
  PID:8348
- C:\Windows\System\hmvhEgi.exe
  C:\Windows\System\hmvhEgi.exe
  2⤵
  PID:4284
- C:\Windows\System\rKHBKGH.exe
  C:\Windows\System\rKHBKGH.exe
  2⤵
  PID:8468
- C:\Windows\System\jMZfMLW.exe
  C:\Windows\System\jMZfMLW.exe
  2⤵
  PID:8524
- C:\Windows\System\EfqGXBO.exe
  C:\Windows\System\EfqGXBO.exe
  2⤵
  PID:8588
- C:\Windows\System\rgXQleQ.exe
  C:\Windows\System\rgXQleQ.exe
  2⤵
  PID:8628
- C:\Windows\System\GwoxmiO.exe
  C:\Windows\System\GwoxmiO.exe
  2⤵
  PID:8972
- C:\Windows\System\TjvXhtz.exe
  C:\Windows\System\TjvXhtz.exe
  2⤵
  PID:8792
- C:\Windows\System\AiAzvsm.exe
  C:\Windows\System\AiAzvsm.exe
  2⤵
  PID:8608
- C:\Windows\System\xuXggVy.exe
  C:\Windows\System\xuXggVy.exe
  2⤵
  PID:8640
- C:\Windows\System\pJDzTgg.exe
  C:\Windows\System\pJDzTgg.exe
  2⤵
  PID:9212
- C:\Windows\System\dvayuBv.exe
  C:\Windows\System\dvayuBv.exe
  2⤵
  PID:7216
- C:\Windows\System\QoQizJI.exe
  C:\Windows\System\QoQizJI.exe
  2⤵
  PID:8968
- C:\Windows\System\hkcmYJB.exe
  C:\Windows\System\hkcmYJB.exe
  2⤵
  PID:9036
- C:\Windows\System\RtECkng.exe
  C:\Windows\System\RtECkng.exe
  2⤵
  PID:9060
- C:\Windows\System\UvghDmo.exe
  C:\Windows\System\UvghDmo.exe
  2⤵
  PID:9164
- C:\Windows\System\LyMzHsR.exe
  C:\Windows\System\LyMzHsR.exe
  2⤵
  PID:6204
- C:\Windows\System\LxbRVSh.exe
  C:\Windows\System\LxbRVSh.exe
  2⤵
  PID:7436
- C:\Windows\System\pIqUGRZ.exe
  C:\Windows\System\pIqUGRZ.exe
  2⤵
  PID:9116
- C:\Windows\System\zggbiiU.exe
  C:\Windows\System\zggbiiU.exe
  2⤵
  PID:7840
- C:\Windows\System\GVbQWhA.exe
  C:\Windows\System\GVbQWhA.exe
  2⤵
  PID:8364
- C:\Windows\System\HIoWyxU.exe
  C:\Windows\System\HIoWyxU.exe
  2⤵
  PID:9240
- C:\Windows\System\tdZwpfp.exe
  C:\Windows\System\tdZwpfp.exe
  2⤵
  PID:9264
- C:\Windows\System\uCOQkVP.exe
  C:\Windows\System\uCOQkVP.exe
  2⤵
  PID:9280
- C:\Windows\System\XAttSyc.exe
  C:\Windows\System\XAttSyc.exe
  2⤵
  PID:9304
- C:\Windows\System\RIooCCu.exe
  C:\Windows\System\RIooCCu.exe
  2⤵
  PID:9328
- C:\Windows\System\ZgQepXw.exe
  C:\Windows\System\ZgQepXw.exe
  2⤵
  PID:9356
- C:\Windows\System\SIilmUA.exe
  C:\Windows\System\SIilmUA.exe
  2⤵
  PID:9372
- C:\Windows\System\shipekc.exe
  C:\Windows\System\shipekc.exe
  2⤵
  PID:9392
- C:\Windows\System\QqAFaZa.exe
  C:\Windows\System\QqAFaZa.exe
  2⤵
  PID:9416
- C:\Windows\System\abafaMN.exe
  C:\Windows\System\abafaMN.exe
  2⤵
  PID:9448
- C:\Windows\System\qYFyQnN.exe
  C:\Windows\System\qYFyQnN.exe
  2⤵
  PID:9472
- C:\Windows\System\ryHaUEb.exe
  C:\Windows\System\ryHaUEb.exe
  2⤵
  PID:9500
- C:\Windows\System\uNxiQhI.exe
  C:\Windows\System\uNxiQhI.exe
  2⤵
  PID:9524
- C:\Windows\System\CXIqPZv.exe
  C:\Windows\System\CXIqPZv.exe
  2⤵
  PID:9556
- C:\Windows\System\pKNAmBc.exe
  C:\Windows\System\pKNAmBc.exe
  2⤵
  PID:9580
- C:\Windows\System\wCrcmkm.exe
  C:\Windows\System\wCrcmkm.exe
  2⤵
  PID:9608
- C:\Windows\System\LqOztpg.exe
  C:\Windows\System\LqOztpg.exe
  2⤵
  PID:9632
- C:\Windows\System\oSewLKA.exe
  C:\Windows\System\oSewLKA.exe
  2⤵
  PID:9652
- C:\Windows\System\VBhwHGz.exe
  C:\Windows\System\VBhwHGz.exe
  2⤵
  PID:9676
- C:\Windows\System\lcikLov.exe
  C:\Windows\System\lcikLov.exe
  2⤵
  PID:9692
- C:\Windows\System\WUfwDYQ.exe
  C:\Windows\System\WUfwDYQ.exe
  2⤵
  PID:9716
- C:\Windows\System\IAObWtt.exe
  C:\Windows\System\IAObWtt.exe
  2⤵
  PID:9736
- C:\Windows\System\HeUaYpn.exe
  C:\Windows\System\HeUaYpn.exe
  2⤵
  PID:9760
- C:\Windows\System\uRfvfbt.exe
  C:\Windows\System\uRfvfbt.exe
  2⤵
  PID:9776
- C:\Windows\System\NFoGoLK.exe
  C:\Windows\System\NFoGoLK.exe
  2⤵
  PID:9796
- C:\Windows\System\TWJItBK.exe
  C:\Windows\System\TWJItBK.exe
  2⤵
  PID:9996
- C:\Windows\System\QPSpVSg.exe
  C:\Windows\System\QPSpVSg.exe
  2⤵
  PID:10048
- C:\Windows\System\fGAarNG.exe
  C:\Windows\System\fGAarNG.exe
  2⤵
  PID:10072
- C:\Windows\System\DExtUXR.exe
  C:\Windows\System\DExtUXR.exe
  2⤵
  PID:10104
- C:\Windows\System\DAwanOE.exe
  C:\Windows\System\DAwanOE.exe
  2⤵
  PID:10128
- C:\Windows\System\mPxutVV.exe
  C:\Windows\System\mPxutVV.exe
  2⤵
  PID:10168
- C:\Windows\System\FPNodZn.exe
  C:\Windows\System\FPNodZn.exe
  2⤵
  PID:10184
- C:\Windows\System\jHekpRt.exe
  C:\Windows\System\jHekpRt.exe
  2⤵
  PID:10204
- C:\Windows\System\kfEwINr.exe
  C:\Windows\System\kfEwINr.exe
  2⤵
  PID:10228
- C:\Windows\System\FJbzbuZ.exe
  C:\Windows\System\FJbzbuZ.exe
  2⤵
  PID:8964
- C:\Windows\System\PpdLWEq.exe
  C:\Windows\System\PpdLWEq.exe
  2⤵
  PID:8576
- C:\Windows\System\vPrreIq.exe
  C:\Windows\System\vPrreIq.exe
  2⤵
  PID:8604
- C:\Windows\System\AcFvhhB.exe
  C:\Windows\System\AcFvhhB.exe
  2⤵
  PID:8996
- C:\Windows\System\HQCDUYV.exe
  C:\Windows\System\HQCDUYV.exe
  2⤵
  PID:9248
- C:\Windows\System\OjKWVfl.exe
  C:\Windows\System\OjKWVfl.exe
  2⤵
  PID:9044
- C:\Windows\System\EfTOWyN.exe
  C:\Windows\System\EfTOWyN.exe
  2⤵
  PID:9440
- C:\Windows\System\lufHwPq.exe
  C:\Windows\System\lufHwPq.exe
  2⤵
  PID:9096
- C:\Windows\System\veNPAtJ.exe
  C:\Windows\System\veNPAtJ.exe
  2⤵
  PID:9672
- C:\Windows\System\RNjaaPL.exe
  C:\Windows\System\RNjaaPL.exe
  2⤵
  PID:9320
- C:\Windows\System\ddhjjKL.exe
  C:\Windows\System\ddhjjKL.exe
  2⤵
  PID:9772
- C:\Windows\System\zYqdqqE.exe
  C:\Windows\System\zYqdqqE.exe
  2⤵
  PID:9172
- C:\Windows\System\EZeDVfX.exe
  C:\Windows\System\EZeDVfX.exe
  2⤵
  PID:9576
- C:\Windows\System\IgQWVvt.exe
  C:\Windows\System\IgQWVvt.exe
  2⤵
  PID:9220
- C:\Windows\System\nLMFtyf.exe
  C:\Windows\System\nLMFtyf.exe
  2⤵
  PID:9688
- C:\Windows\System\bzxsWSU.exe
  C:\Windows\System\bzxsWSU.exe
  2⤵
  PID:9768
- C:\Windows\System\gLjerWZ.exe
  C:\Windows\System\gLjerWZ.exe
  2⤵
  PID:9412
- C:\Windows\System\ZmqwzdT.exe
  C:\Windows\System\ZmqwzdT.exe
  2⤵
  PID:9464
- C:\Windows\System\PAKTlLP.exe
  C:\Windows\System\PAKTlLP.exe
  2⤵
  PID:9508
- C:\Windows\System\TgMEpAJ.exe
  C:\Windows\System\TgMEpAJ.exe
  2⤵
  PID:10032
- C:\Windows\System\WGhBLAT.exe
  C:\Windows\System\WGhBLAT.exe
  2⤵
  PID:9916
- C:\Windows\System\hCaAXnC.exe
  C:\Windows\System\hCaAXnC.exe
  2⤵
  PID:9932
- C:\Windows\System\WnUOxMV.exe
  C:\Windows\System\WnUOxMV.exe
  2⤵
  PID:10216
- C:\Windows\System\FVypgTd.exe
  C:\Windows\System\FVypgTd.exe
  2⤵
  PID:8452
- C:\Windows\System\cZrapYw.exe
  C:\Windows\System\cZrapYw.exe
  2⤵
  PID:9980
- C:\Windows\System\bemkDFO.exe
  C:\Windows\System\bemkDFO.exe
  2⤵
  PID:9856
- C:\Windows\System\XyDLshG.exe
  C:\Windows\System\XyDLshG.exe
  2⤵
  PID:9020
- C:\Windows\System\tWFwLbS.exe
  C:\Windows\System\tWFwLbS.exe
  2⤵
  PID:8448
- C:\Windows\System\gVEebtJ.exe
  C:\Windows\System\gVEebtJ.exe
  2⤵
  PID:10148
- C:\Windows\System\asABJIH.exe
  C:\Windows\System\asABJIH.exe
  2⤵
  PID:9380
- C:\Windows\System\oMKabJA.exe
  C:\Windows\System\oMKabJA.exe
  2⤵
  PID:9292
- C:\Windows\System\WuyvvHM.exe
  C:\Windows\System\WuyvvHM.exe
  2⤵
  PID:10260
- C:\Windows\System\EJCnbcC.exe
  C:\Windows\System\EJCnbcC.exe
  2⤵
  PID:10288
- C:\Windows\System\UwFdvtl.exe
  C:\Windows\System\UwFdvtl.exe
  2⤵
  PID:10308
- C:\Windows\System\zNrQQxf.exe
  C:\Windows\System\zNrQQxf.exe
  2⤵
  PID:10328
- C:\Windows\System\aZAzznk.exe
  C:\Windows\System\aZAzznk.exe
  2⤵
  PID:10348
- C:\Windows\System\GirdLcL.exe
  C:\Windows\System\GirdLcL.exe
  2⤵
  PID:10364
- C:\Windows\System\KKNaHUo.exe
  C:\Windows\System\KKNaHUo.exe
  2⤵
  PID:10392
- C:\Windows\System\bUZmlFP.exe
  C:\Windows\System\bUZmlFP.exe
  2⤵
  PID:10412
- C:\Windows\System\eEjJeYa.exe
  C:\Windows\System\eEjJeYa.exe
  2⤵
  PID:10428
- C:\Windows\System\KwTXiOo.exe
  C:\Windows\System\KwTXiOo.exe
  2⤵
  PID:10452
- C:\Windows\System\trFCWgc.exe
  C:\Windows\System\trFCWgc.exe
  2⤵
  PID:10472
- C:\Windows\System\HByfFqN.exe
  C:\Windows\System\HByfFqN.exe
  2⤵
  PID:10500
- C:\Windows\System\UpYGCuu.exe
  C:\Windows\System\UpYGCuu.exe
  2⤵
  PID:10520
- C:\Windows\System\csfjuZO.exe
  C:\Windows\System\csfjuZO.exe
  2⤵
  PID:10536
- C:\Windows\System\rqackqL.exe
  C:\Windows\System\rqackqL.exe
  2⤵
  PID:10556
- C:\Windows\System\HFtJCSC.exe
  C:\Windows\System\HFtJCSC.exe
  2⤵
  PID:10580
- C:\Windows\System\UugBsnl.exe
  C:\Windows\System\UugBsnl.exe
  2⤵
  PID:10604
- C:\Windows\System\ZZqqhEo.exe
  C:\Windows\System\ZZqqhEo.exe
  2⤵
  PID:10620
- C:\Windows\System\gOzsywB.exe
  C:\Windows\System\gOzsywB.exe
  2⤵
  PID:10656
- C:\Windows\System\DifLXOY.exe
  C:\Windows\System\DifLXOY.exe
  2⤵
  PID:10684
- C:\Windows\System\SsqSyIK.exe
  C:\Windows\System\SsqSyIK.exe
  2⤵
  PID:10700
- C:\Windows\System\EqhOraH.exe
  C:\Windows\System\EqhOraH.exe
  2⤵
  PID:10720
- C:\Windows\System\ARZzcLv.exe
  C:\Windows\System\ARZzcLv.exe
  2⤵
  PID:10748
- C:\Windows\System\gXAtUeA.exe
  C:\Windows\System\gXAtUeA.exe
  2⤵
  PID:10768
- C:\Windows\System\ltTioZR.exe
  C:\Windows\System\ltTioZR.exe
  2⤵
  PID:10940
- C:\Windows\System\BCAsVmw.exe
  C:\Windows\System\BCAsVmw.exe
  2⤵
  PID:10960
- C:\Windows\System\fWEovXq.exe
  C:\Windows\System\fWEovXq.exe
  2⤵
  PID:10984
- C:\Windows\System\vKBNJpH.exe
  C:\Windows\System\vKBNJpH.exe
  2⤵
  PID:11012
- C:\Windows\System\iRkvXFL.exe
  C:\Windows\System\iRkvXFL.exe
  2⤵
  PID:11036
- C:\Windows\System\dCpwtwn.exe
  C:\Windows\System\dCpwtwn.exe
  2⤵
  PID:11064
- C:\Windows\System\ReMtwst.exe
  C:\Windows\System\ReMtwst.exe
  2⤵
  PID:11088
- C:\Windows\System\MTedjFs.exe
  C:\Windows\System\MTedjFs.exe
  2⤵
  PID:11104
- C:\Windows\System\BoToCXZ.exe
  C:\Windows\System\BoToCXZ.exe
  2⤵
  PID:11160
- C:\Windows\System\CXwTWVd.exe
  C:\Windows\System\CXwTWVd.exe
  2⤵
  PID:11200
- C:\Windows\System\pTJptzg.exe
  C:\Windows\System\pTJptzg.exe
  2⤵
  PID:11220
- C:\Windows\System\cvrnrQR.exe
  C:\Windows\System\cvrnrQR.exe
  2⤵
  PID:11236
- C:\Windows\System\ajVCFRh.exe
  C:\Windows\System\ajVCFRh.exe
  2⤵
  PID:11252
- C:\Windows\System\fbVYheP.exe
  C:\Windows\System\fbVYheP.exe
  2⤵
  PID:9988
- C:\Windows\System\xqBEgtI.exe
  C:\Windows\System\xqBEgtI.exe
  2⤵
  PID:8896
- C:\Windows\System\FEoCYqo.exe
  C:\Windows\System\FEoCYqo.exe
  2⤵
  PID:9324
- C:\Windows\System\KNdMouF.exe
  C:\Windows\System\KNdMouF.exe
  2⤵
  PID:10220
- C:\Windows\System\DHKuDyI.exe
  C:\Windows\System\DHKuDyI.exe
  2⤵
  PID:9408
- C:\Windows\System\SzIvYNX.exe
  C:\Windows\System\SzIvYNX.exe
  2⤵
  PID:9496
- C:\Windows\System\HXhxqWa.exe
  C:\Windows\System\HXhxqWa.exe
  2⤵
  PID:9400
- C:\Windows\System\kOTNZoF.exe
  C:\Windows\System\kOTNZoF.exe
  2⤵
  PID:10384
- C:\Windows\System\dWUaALq.exe
  C:\Windows\System\dWUaALq.exe
  2⤵
  PID:10444
- C:\Windows\System\WDkvvxd.exe
  C:\Windows\System\WDkvvxd.exe
  2⤵
  PID:10480
- C:\Windows\System\njqXjcI.exe
  C:\Windows\System\njqXjcI.exe
  2⤵
  PID:10632
- C:\Windows\System\HICeYtA.exe
  C:\Windows\System\HICeYtA.exe
  2⤵
  PID:10668
- C:\Windows\System\vviVoIc.exe
  C:\Windows\System\vviVoIc.exe
  2⤵
  PID:10776
- C:\Windows\System\ZOfLtJq.exe
  C:\Windows\System\ZOfLtJq.exe
  2⤵
  PID:11080
- C:\Windows\System\qFvzlhE.exe
  C:\Windows\System\qFvzlhE.exe
  2⤵
  PID:10532
- C:\Windows\System\CHoFciC.exe
  C:\Windows\System\CHoFciC.exe
  2⤵
  PID:10872
- C:\Windows\System\LjdSbyz.exe
  C:\Windows\System\LjdSbyz.exe
  2⤵
  PID:10784
- C:\Windows\System\PGjDqVV.exe
  C:\Windows\System\PGjDqVV.exe
  2⤵
  PID:10376
- C:\Windows\System\DroAgbf.exe
  C:\Windows\System\DroAgbf.exe
  2⤵
  PID:10836
- C:\Windows\System\hagDGSi.exe
  C:\Windows\System\hagDGSi.exe
  2⤵
  PID:10140
- C:\Windows\System\eeVcCvQ.exe
  C:\Windows\System\eeVcCvQ.exe
  2⤵
  PID:11008
- C:\Windows\System\njCrEhh.exe
  C:\Windows\System\njCrEhh.exe
  2⤵
  PID:11276
- C:\Windows\System\oJalbJz.exe
  C:\Windows\System\oJalbJz.exe
  2⤵
  PID:11304
- C:\Windows\System\WuStHiH.exe
  C:\Windows\System\WuStHiH.exe
  2⤵
  PID:11332
- C:\Windows\System\liBHCMc.exe
  C:\Windows\System\liBHCMc.exe
  2⤵
  PID:11364
- C:\Windows\System\UncCQXD.exe
  C:\Windows\System\UncCQXD.exe
  2⤵
  PID:11396
- C:\Windows\System\dJPgenG.exe
  C:\Windows\System\dJPgenG.exe
  2⤵
  PID:11420
- C:\Windows\System\XvbkaGd.exe
  C:\Windows\System\XvbkaGd.exe
  2⤵
  PID:11456
- C:\Windows\System\DHNLZPU.exe
  C:\Windows\System\DHNLZPU.exe
  2⤵
  PID:11480
- C:\Windows\System\gMOKtkA.exe
  C:\Windows\System\gMOKtkA.exe
  2⤵
  PID:11500
- C:\Windows\System\ftEUZVF.exe
  C:\Windows\System\ftEUZVF.exe
  2⤵
  PID:11528
- C:\Windows\System\VBPceJR.exe
  C:\Windows\System\VBPceJR.exe
  2⤵
  PID:11548
- C:\Windows\System\WWoImst.exe
  C:\Windows\System\WWoImst.exe
  2⤵
  PID:11572
- C:\Windows\System\amaGJFD.exe
  C:\Windows\System\amaGJFD.exe
  2⤵
  PID:11600
- C:\Windows\System\KWOgHwg.exe
  C:\Windows\System\KWOgHwg.exe
  2⤵
  PID:11632
- C:\Windows\System\CVkdQee.exe
  C:\Windows\System\CVkdQee.exe
  2⤵
  PID:11660
- C:\Windows\System\zLHsHZb.exe
  C:\Windows\System\zLHsHZb.exe
  2⤵
  PID:11684
- C:\Windows\System\VtBNFDQ.exe
  C:\Windows\System\VtBNFDQ.exe
  2⤵
  PID:11704
- C:\Windows\System\KFiLFRE.exe
  C:\Windows\System\KFiLFRE.exe
  2⤵
  PID:11720
- C:\Windows\System\wOvNKkl.exe
  C:\Windows\System\wOvNKkl.exe
  2⤵
  PID:11740
- C:\Windows\System\akJoAAf.exe
  C:\Windows\System\akJoAAf.exe
  2⤵
  PID:11776
- C:\Windows\System\bRcJSQS.exe
  C:\Windows\System\bRcJSQS.exe
  2⤵
  PID:11796
- C:\Windows\System\fypEIeP.exe
  C:\Windows\System\fypEIeP.exe
  2⤵
  PID:11816
- C:\Windows\System\gHMzKEF.exe
  C:\Windows\System\gHMzKEF.exe
  2⤵
  PID:11848
- C:\Windows\System\bMjxaGh.exe
  C:\Windows\System\bMjxaGh.exe
  2⤵
  PID:11872
- C:\Windows\System\BNqmnLy.exe
  C:\Windows\System\BNqmnLy.exe
  2⤵
  PID:11896
- C:\Windows\System\dDSOXxA.exe
  C:\Windows\System\dDSOXxA.exe
  2⤵
  PID:11912
- C:\Windows\System\uApGudz.exe
  C:\Windows\System\uApGudz.exe
  2⤵
  PID:11948
- C:\Windows\System\lHfETlq.exe
  C:\Windows\System\lHfETlq.exe
  2⤵
  PID:11968
- C:\Windows\System\LDhDxJK.exe
  C:\Windows\System\LDhDxJK.exe
  2⤵
  PID:11984
- C:\Windows\System\zdtDeLo.exe
  C:\Windows\System\zdtDeLo.exe
  2⤵
  PID:12016
- C:\Windows\System\epOzNoT.exe
  C:\Windows\System\epOzNoT.exe
  2⤵
  PID:12032
- C:\Windows\System\oFqcgsU.exe
  C:\Windows\System\oFqcgsU.exe
  2⤵
  PID:12052
- C:\Windows\System\mQiEalc.exe
  C:\Windows\System\mQiEalc.exe
  2⤵
  PID:12068
- C:\Windows\System\JTziFLk.exe
  C:\Windows\System\JTziFLk.exe
  2⤵
  PID:12092
- C:\Windows\System\KdTfEgS.exe
  C:\Windows\System\KdTfEgS.exe
  2⤵
  PID:12108
- C:\Windows\System\MeTzrZP.exe
  C:\Windows\System\MeTzrZP.exe
  2⤵
  PID:12132
- C:\Windows\System\hIBynkv.exe
  C:\Windows\System\hIBynkv.exe
  2⤵
  PID:12148
- C:\Windows\System\IhKQXVJ.exe
  C:\Windows\System\IhKQXVJ.exe
  2⤵
  PID:12172
- C:\Windows\System\lbiGywV.exe
  C:\Windows\System\lbiGywV.exe
  2⤵
  PID:12188
- C:\Windows\System\QhEvNtj.exe
  C:\Windows\System\QhEvNtj.exe
  2⤵
  PID:12208
- C:\Windows\System\DKzOGdd.exe
  C:\Windows\System\DKzOGdd.exe
  2⤵
  PID:12224
- C:\Windows\System\fvNXUwh.exe
  C:\Windows\System\fvNXUwh.exe
  2⤵
  PID:12244
- C:\Windows\System\aMWKRBO.exe
  C:\Windows\System\aMWKRBO.exe
  2⤵
  PID:12268
- C:\Windows\System\nIRjVTZ.exe
  C:\Windows\System\nIRjVTZ.exe
  2⤵
  PID:11128
- C:\Windows\System\OIFnwdp.exe
  C:\Windows\System\OIFnwdp.exe
  2⤵
  PID:9616
- C:\Windows\System\StWMZBG.exe
  C:\Windows\System\StWMZBG.exe
  2⤵
  PID:10112
- C:\Windows\System\EBesUsC.exe
  C:\Windows\System\EBesUsC.exe
  2⤵
  PID:10180
- C:\Windows\System\WAOdOcI.exe
  C:\Windows\System\WAOdOcI.exe
  2⤵
  PID:9484
- C:\Windows\System\yGWLQiD.exe
  C:\Windows\System\yGWLQiD.exe
  2⤵
  PID:10316
- C:\Windows\System\nLwkMXV.exe
  C:\Windows\System\nLwkMXV.exe
  2⤵
  PID:10424
- C:\Windows\System\evwIQDC.exe
  C:\Windows\System\evwIQDC.exe
  2⤵
  PID:10616
- C:\Windows\System\hoiykBU.exe
  C:\Windows\System\hoiykBU.exe
  2⤵
  PID:10972
- C:\Windows\System\tKqDpEJ.exe
  C:\Windows\System\tKqDpEJ.exe
  2⤵
  PID:10572
- C:\Windows\System\XQwcqeB.exe
  C:\Windows\System\XQwcqeB.exe
  2⤵
  PID:10564
- C:\Windows\System\aZfJfoX.exe
  C:\Windows\System\aZfJfoX.exe
  2⤵
  PID:11380
- C:\Windows\System\XBwbiXL.exe
  C:\Windows\System\XBwbiXL.exe
  2⤵
  PID:10744
- C:\Windows\System\JjOIkTx.exe
  C:\Windows\System\JjOIkTx.exe
  2⤵
  PID:11468
- C:\Windows\System\nibaltO.exe
  C:\Windows\System\nibaltO.exe
  2⤵
  PID:9460
- C:\Windows\System\nwGPCVM.exe
  C:\Windows\System\nwGPCVM.exe
  2⤵
  PID:10648
- C:\Windows\System\rRVUXfB.exe
  C:\Windows\System\rRVUXfB.exe
  2⤵
  PID:11268
- C:\Windows\System\kaCBlRY.exe
  C:\Windows\System\kaCBlRY.exe
  2⤵
  PID:11056
- C:\Windows\System\IVBcxwB.exe
  C:\Windows\System\IVBcxwB.exe
  2⤵
  PID:11348
- C:\Windows\System\YFvXJlw.exe
  C:\Windows\System\YFvXJlw.exe
  2⤵
  PID:11700
- C:\Windows\System\iCixPno.exe
  C:\Windows\System\iCixPno.exe
  2⤵
  PID:11748
- C:\Windows\System\uhhUoDb.exe
  C:\Windows\System\uhhUoDb.exe
  2⤵
  PID:11656
- C:\Windows\System\PossVit.exe
  C:\Windows\System\PossVit.exe
  2⤵
  PID:12232
- C:\Windows\System\VqqaAiN.exe
  C:\Windows\System\VqqaAiN.exe
  2⤵
  PID:12264
- C:\Windows\System\BBiqHZK.exe
  C:\Windows\System\BBiqHZK.exe
  2⤵
  PID:11812
- C:\Windows\System\woywfYo.exe
  C:\Windows\System\woywfYo.exe
  2⤵
  PID:12320
- C:\Windows\System\NsmFTtf.exe
  C:\Windows\System\NsmFTtf.exe
  2⤵
  PID:12344
- C:\Windows\System\YOcbvcR.exe
  C:\Windows\System\YOcbvcR.exe
  2⤵
  PID:12380
- C:\Windows\System\EtmmIwg.exe
  C:\Windows\System\EtmmIwg.exe
  2⤵
  PID:12428
- C:\Windows\System\POsWhVG.exe
  C:\Windows\System\POsWhVG.exe
  2⤵
  PID:12464
- C:\Windows\System\cxgYiCr.exe
  C:\Windows\System\cxgYiCr.exe
  2⤵
  PID:12480
- C:\Windows\System\pgIGDpu.exe
  C:\Windows\System\pgIGDpu.exe
  2⤵
  PID:12500
- C:\Windows\System\SvPYKLW.exe
  C:\Windows\System\SvPYKLW.exe
  2⤵
  PID:12524
- C:\Windows\System\UeSntbM.exe
  C:\Windows\System\UeSntbM.exe
  2⤵
  PID:12560
- C:\Windows\System\NyQJKPL.exe
  C:\Windows\System\NyQJKPL.exe
  2⤵
  PID:12592
- C:\Windows\System\FwOMovY.exe
  C:\Windows\System\FwOMovY.exe
  2⤵
  PID:12624
- C:\Windows\System\iFbuMmP.exe
  C:\Windows\System\iFbuMmP.exe
  2⤵
  PID:12652
- C:\Windows\System\mNxltCr.exe
  C:\Windows\System\mNxltCr.exe
  2⤵
  PID:12804
- C:\Windows\System\ubocFQT.exe
  C:\Windows\System\ubocFQT.exe
  2⤵
  PID:12828
- C:\Windows\System\Obptlwl.exe
  C:\Windows\System\Obptlwl.exe
  2⤵
  PID:12852
- C:\Windows\System\MxXYXCq.exe
  C:\Windows\System\MxXYXCq.exe
  2⤵
  PID:12872
- C:\Windows\System\OAYJwwQ.exe
  C:\Windows\System\OAYJwwQ.exe
  2⤵
  PID:12892
- C:\Windows\System\WbmyEZq.exe
  C:\Windows\System\WbmyEZq.exe
  2⤵
  PID:12924
- C:\Windows\System\TJAIaIX.exe
  C:\Windows\System\TJAIaIX.exe
  2⤵
  PID:12956
- C:\Windows\System\SeWQfmT.exe
  C:\Windows\System\SeWQfmT.exe
  2⤵
  PID:12992
- C:\Windows\System\fNoONhu.exe
  C:\Windows\System\fNoONhu.exe
  2⤵
  PID:13008
- C:\Windows\System\BDztbJI.exe
  C:\Windows\System\BDztbJI.exe
  2⤵
  PID:13040
- C:\Windows\System\gLrhiea.exe
  C:\Windows\System\gLrhiea.exe
  2⤵
  PID:13056
- C:\Windows\System\Kqmwosw.exe
  C:\Windows\System\Kqmwosw.exe
  2⤵
  PID:13076
- C:\Windows\System\gwLICbi.exe
  C:\Windows\System\gwLICbi.exe
  2⤵
  PID:13104
- C:\Windows\System\OdqWKwS.exe
  C:\Windows\System\OdqWKwS.exe
  2⤵
  PID:13128
- C:\Windows\System\zWVCruX.exe
  C:\Windows\System\zWVCruX.exe
  2⤵
  PID:13144
- C:\Windows\System\NLObHLR.exe
  C:\Windows\System\NLObHLR.exe
  2⤵
  PID:13160
- C:\Windows\System\OncGWJq.exe
  C:\Windows\System\OncGWJq.exe
  2⤵
  PID:13188
- C:\Windows\System\JrIiJXv.exe
  C:\Windows\System\JrIiJXv.exe
  2⤵
  PID:13264
- C:\Windows\System\ngcYXlS.exe
  C:\Windows\System\ngcYXlS.exe
  2⤵
  PID:13280
- C:\Windows\System\yTcRbSa.exe
  C:\Windows\System\yTcRbSa.exe
  2⤵
  PID:13296
- C:\Windows\System\ckFXZuy.exe
  C:\Windows\System\ckFXZuy.exe
  2⤵
  PID:10468
- C:\Windows\System\YQXSNBu.exe
  C:\Windows\System\YQXSNBu.exe
  2⤵
  PID:12144
- C:\Windows\System\KWefIYQ.exe
  C:\Windows\System\KWefIYQ.exe
  2⤵
  PID:12236
- C:\Windows\System\XKHuLvM.exe
  C:\Windows\System\XKHuLvM.exe
  2⤵
  PID:11496
- C:\Windows\System\MGxpZeE.exe
  C:\Windows\System\MGxpZeE.exe
  2⤵
  PID:10196
- C:\Windows\System\PamDVui.exe
  C:\Windows\System\PamDVui.exe
  2⤵
  PID:11960
- C:\Windows\System\rlyxtHU.exe
  C:\Windows\System\rlyxtHU.exe
  2⤵
  PID:10512
- C:\Windows\System\CxSNeYV.exe
  C:\Windows\System\CxSNeYV.exe
  2⤵
  PID:11596
- C:\Windows\System\sNohGZB.exe
  C:\Windows\System\sNohGZB.exe
  2⤵
  PID:11432
- C:\Windows\System\aDNMfmG.exe
  C:\Windows\System\aDNMfmG.exe
  2⤵
  PID:11488
- C:\Windows\System\BSxdPJd.exe
  C:\Windows\System\BSxdPJd.exe
  2⤵
  PID:11696
- C:\Windows\System\yHNpJnE.exe
  C:\Windows\System\yHNpJnE.exe
  2⤵
  PID:12312
- C:\Windows\System\zGYBZTk.exe
  C:\Windows\System\zGYBZTk.exe
  2⤵
  PID:12864
- C:\Windows\System\YTCaGtU.exe
  C:\Windows\System\YTCaGtU.exe
  2⤵
  PID:12936
- C:\Windows\System\qHHoLnl.exe
  C:\Windows\System\qHHoLnl.exe
  2⤵
  PID:12392
- C:\Windows\System\lIlBOzF.exe
  C:\Windows\System\lIlBOzF.exe
  2⤵
  PID:12456
- C:\Windows\System\CjcLypv.exe
  C:\Windows\System\CjcLypv.exe
  2⤵
  PID:12760
- C:\Windows\System\Crvbnjw.exe
  C:\Windows\System\Crvbnjw.exe
  2⤵
  PID:13052
- C:\Windows\System\yEJDARB.exe
  C:\Windows\System\yEJDARB.exe
  2⤵
  PID:12632
- C:\Windows\System\lvsaHsL.exe
  C:\Windows\System\lvsaHsL.exe
  2⤵
  PID:13176
- C:\Windows\System\YyJHNRq.exe
  C:\Windows\System\YyJHNRq.exe
  2⤵
  PID:13100
- C:\Windows\System\SNuxxqd.exe
  C:\Windows\System\SNuxxqd.exe
  2⤵
  PID:12084
- C:\Windows\System\GtLMHhT.exe
  C:\Windows\System\GtLMHhT.exe
  2⤵
  PID:11728
- C:\Windows\System\AnOtmAS.exe
  C:\Windows\System\AnOtmAS.exe
  2⤵
  PID:11680
- C:\Windows\System\OZAoAyg.exe
  C:\Windows\System\OZAoAyg.exe
  2⤵
  PID:13324
- C:\Windows\System\wffrHxV.exe
  C:\Windows\System\wffrHxV.exe
  2⤵
  PID:13340
- C:\Windows\System\bRLBePi.exe
  C:\Windows\System\bRLBePi.exe
  2⤵
  PID:13384
- C:\Windows\System\HeJnkAG.exe
  C:\Windows\System\HeJnkAG.exe
  2⤵
  PID:13416
- C:\Windows\System\dxuLkZw.exe
  C:\Windows\System\dxuLkZw.exe
  2⤵
  PID:13468
- C:\Windows\System\cKAqbNI.exe
  C:\Windows\System\cKAqbNI.exe
  2⤵
  PID:13496
- C:\Windows\System\mMgjzoH.exe
  C:\Windows\System\mMgjzoH.exe
  2⤵
  PID:13540
- C:\Windows\System\NRhfCZC.exe
  C:\Windows\System\NRhfCZC.exe
  2⤵
  PID:13568
- C:\Windows\System\ZpEFpiV.exe
  C:\Windows\System\ZpEFpiV.exe
  2⤵
  PID:13592
- C:\Windows\System\dPFTRdG.exe
  C:\Windows\System\dPFTRdG.exe
  2⤵
  PID:13616
- C:\Windows\System\UWnFxqL.exe
  C:\Windows\System\UWnFxqL.exe
  2⤵
  PID:13636
- C:\Windows\System\epSmOGc.exe
  C:\Windows\System\epSmOGc.exe
  2⤵
  PID:13660
- C:\Windows\System\WkaPmOj.exe
  C:\Windows\System\WkaPmOj.exe
  2⤵
  PID:13684
- C:\Windows\System\rjeFKgu.exe
  C:\Windows\System\rjeFKgu.exe
  2⤵
  PID:13708
- C:\Windows\System\gjTcJxE.exe
  C:\Windows\System\gjTcJxE.exe
  2⤵
  PID:13732
- C:\Windows\System\VKiDsZZ.exe
  C:\Windows\System\VKiDsZZ.exe
  2⤵
  PID:13756
- C:\Windows\System\jsJDKaJ.exe
  C:\Windows\System\jsJDKaJ.exe
  2⤵
  PID:13776
- C:\Windows\System\zHToPAI.exe
  C:\Windows\System\zHToPAI.exe
  2⤵
  PID:13796
- C:\Windows\System\EsJwxwB.exe
  C:\Windows\System\EsJwxwB.exe
  2⤵
  PID:13816
- C:\Windows\System\nKZHFPH.exe
  C:\Windows\System\nKZHFPH.exe
  2⤵
  PID:13832
- C:\Windows\System\KZZgkwo.exe
  C:\Windows\System\KZZgkwo.exe
  2⤵
  PID:13852
- C:\Windows\System\kttgVlr.exe
  C:\Windows\System\kttgVlr.exe
  2⤵
  PID:13880
- C:\Windows\System\lWZFXtG.exe
  C:\Windows\System\lWZFXtG.exe
  2⤵
  PID:13920
- C:\Windows\System\mfPtYzo.exe
  C:\Windows\System\mfPtYzo.exe
  2⤵
  PID:13944
- C:\Windows\System\BteVRBU.exe
  C:\Windows\System\BteVRBU.exe
  2⤵
  PID:13960
- C:\Windows\System\dKDiCAo.exe
  C:\Windows\System\dKDiCAo.exe
  2⤵
  PID:13976
- C:\Windows\System\iZMPETw.exe
  C:\Windows\System\iZMPETw.exe
  2⤵
  PID:13996
- C:\Windows\System\SkvjQTd.exe
  C:\Windows\System\SkvjQTd.exe
  2⤵
  PID:14024
- C:\Windows\System\EqANsjg.exe
  C:\Windows\System\EqANsjg.exe
  2⤵
  PID:14056
- C:\Windows\System\auDtKzp.exe
  C:\Windows\System\auDtKzp.exe
  2⤵
  PID:14084
- C:\Windows\System\MFnRFVl.exe
  C:\Windows\System\MFnRFVl.exe
  2⤵
  PID:14100
- C:\Windows\System\OhJyEuA.exe
  C:\Windows\System\OhJyEuA.exe
  2⤵
  PID:14116
- C:\Windows\System\TABNXWG.exe
  C:\Windows\System\TABNXWG.exe
  2⤵
  PID:14140
- C:\Windows\System\YvQDrVf.exe
  C:\Windows\System\YvQDrVf.exe
  2⤵
  PID:14164
- C:\Windows\System\IkZvrLd.exe
  C:\Windows\System\IkZvrLd.exe
  2⤵
  PID:14192
- C:\Windows\System\jAUzCzj.exe
  C:\Windows\System\jAUzCzj.exe
  2⤵
  PID:14216
- C:\Windows\System\AjHCHhV.exe
  C:\Windows\System\AjHCHhV.exe
  2⤵
  PID:14244
- C:\Windows\System\vzwPdMq.exe
  C:\Windows\System\vzwPdMq.exe
  2⤵
  PID:14264
- C:\Windows\System\rKgtXzH.exe
  C:\Windows\System\rKgtXzH.exe
  2⤵
  PID:14280
- C:\Windows\System\IhjSESg.exe
  C:\Windows\System\IhjSESg.exe
  2⤵
  PID:14308
- C:\Windows\System\IMLBnYd.exe
  C:\Windows\System\IMLBnYd.exe
  2⤵
  PID:14328
- C:\Windows\System\EIMZULg.exe
  C:\Windows\System\EIMZULg.exe
  2⤵
  PID:13004
- C:\Windows\System\OTnpPCe.exe
  C:\Windows\System\OTnpPCe.exe
  2⤵
  PID:4124
- C:\Windows\System\suwWohL.exe
  C:\Windows\System\suwWohL.exe
  2⤵
  PID:10360
- C:\Windows\System\pMfCBWm.exe
  C:\Windows\System\pMfCBWm.exe
  2⤵
  PID:12308
- C:\Windows\System\ZEqstRL.exe
  C:\Windows\System\ZEqstRL.exe
  2⤵
  PID:13292
- C:\Windows\System\KRFpMCK.exe
  C:\Windows\System\KRFpMCK.exe
  2⤵
  PID:12520
- C:\Windows\System\FgDlALE.exe
  C:\Windows\System\FgDlALE.exe
  2⤵
  PID:12364
- C:\Windows\System\EBaooLP.exe
  C:\Windows\System\EBaooLP.exe
  2⤵
  PID:12400
- C:\Windows\System\KysmeTZ.exe
  C:\Windows\System\KysmeTZ.exe
  2⤵
  PID:12360
- C:\Windows\System\GFsIHlg.exe
  C:\Windows\System\GFsIHlg.exe
  2⤵
  PID:13408
- C:\Windows\System\LGuREDZ.exe
  C:\Windows\System\LGuREDZ.exe
  2⤵
  PID:13332
- C:\Windows\System\qbTYMWx.exe
  C:\Windows\System\qbTYMWx.exe
  2⤵
  PID:13432
- C:\Windows\System\bSiFDoE.exe
  C:\Windows\System\bSiFDoE.exe
  2⤵
  PID:13700
- C:\Windows\System\sKEgGEY.exe
  C:\Windows\System\sKEgGEY.exe
  2⤵
  PID:13464
- C:\Windows\System\VEFdCvM.exe
  C:\Windows\System\VEFdCvM.exe
  2⤵
  PID:13868
- C:\Windows\System\AYAYTag.exe
  C:\Windows\System\AYAYTag.exe
  2⤵
  PID:13892
- C:\Windows\System\tmColrt.exe
  C:\Windows\System\tmColrt.exe
  2⤵
  PID:13588
- C:\Windows\System\sEQnzel.exe
  C:\Windows\System\sEQnzel.exe
  2⤵
  PID:13644
- C:\Windows\System\tUfhzds.exe
  C:\Windows\System\tUfhzds.exe
  2⤵
  PID:13844
- C:\Windows\System\HRFQPOt.exe
  C:\Windows\System\HRFQPOt.exe
  2⤵
  PID:13812
- C:\Windows\System\KIvIAkF.exe
  C:\Windows\System\KIvIAkF.exe
  2⤵
  PID:13784
- C:\Windows\System\CwKyAiq.exe
  C:\Windows\System\CwKyAiq.exe
  2⤵
  PID:14156
- C:\Windows\System\bHnFSTJ.exe
  C:\Windows\System\bHnFSTJ.exe
  2⤵
  PID:14212
- C:\Windows\System\RvxbCId.exe
  C:\Windows\System\RvxbCId.exe
  2⤵
  PID:13928
- C:\Windows\System\sbpDTMr.exe
  C:\Windows\System\sbpDTMr.exe
  2⤵
  PID:14260
- C:\Windows\System\CVLRAAW.exe
  C:\Windows\System\CVLRAAW.exe
  2⤵
  PID:13936
- C:\Windows\System\qIDkgLM.exe
  C:\Windows\System\qIDkgLM.exe
  2⤵
  PID:14316
- C:\Windows\System\kFLYLTT.exe
  C:\Windows\System\kFLYLTT.exe
  2⤵
  PID:12880
- C:\Windows\System\Oujdkcr.exe
  C:\Windows\System\Oujdkcr.exe
  2⤵
  PID:12196
- C:\Windows\System\ICmQnaK.exe
  C:\Windows\System\ICmQnaK.exe
  2⤵
  PID:12948
- C:\Windows\System\xRvaulF.exe
  C:\Windows\System\xRvaulF.exe
  2⤵
  PID:14252
- C:\Windows\System\sYfHXZn.exe
  C:\Windows\System\sYfHXZn.exe
  2⤵
  PID:14292
- C:\Windows\System\pQlkVpk.exe
  C:\Windows\System\pQlkVpk.exe
  2⤵
  PID:14352
- C:\Windows\System\ggawpyE.exe
  C:\Windows\System\ggawpyE.exe
  2⤵
  PID:14372
- C:\Windows\System\OdtyHxJ.exe
  C:\Windows\System\OdtyHxJ.exe
  2⤵
  PID:14400
- C:\Windows\System\hcJXRyW.exe
  C:\Windows\System\hcJXRyW.exe
  2⤵
  PID:14420
- C:\Windows\System\cpDRmbm.exe
  C:\Windows\System\cpDRmbm.exe
  2⤵
  PID:14444
- C:\Windows\System\XgpWOSq.exe
  C:\Windows\System\XgpWOSq.exe
  2⤵
  PID:14472
- C:\Windows\System\gdNzbmP.exe
  C:\Windows\System\gdNzbmP.exe
  2⤵
  PID:14492
- C:\Windows\System\omykOXP.exe
  C:\Windows\System\omykOXP.exe
  2⤵
  PID:14512
- C:\Windows\System\RlDVtAE.exe
  C:\Windows\System\RlDVtAE.exe
  2⤵
  PID:14532
- C:\Windows\System\KRYWobV.exe
  C:\Windows\System\KRYWobV.exe
  2⤵
  PID:14552
- C:\Windows\System\aPBRxao.exe
  C:\Windows\System\aPBRxao.exe
  2⤵
  PID:14572
- C:\Windows\System\xPaVXRE.exe
  C:\Windows\System\xPaVXRE.exe
  2⤵
  PID:14588
- C:\Windows\System\YhdxIen.exe
  C:\Windows\System\YhdxIen.exe
  2⤵
  PID:14604
- C:\Windows\System\lFQJGWf.exe
  C:\Windows\System\lFQJGWf.exe
  2⤵
  PID:14628
- C:\Windows\System\QeLBCXd.exe
  C:\Windows\System\QeLBCXd.exe
  2⤵
  PID:14812
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 14812 -s 248
    3⤵
    PID:14224
- C:\Windows\System\bJUamPk.exe
  C:\Windows\System\bJUamPk.exe
  2⤵
  PID:14828
- C:\Windows\System\kCJQdBZ.exe
  C:\Windows\System\kCJQdBZ.exe
  2⤵
  PID:14848
- C:\Windows\System\xJNIIac.exe
  C:\Windows\System\xJNIIac.exe
  2⤵
  PID:14864
- C:\Windows\System\JMzCFSg.exe
  C:\Windows\System\JMzCFSg.exe
  2⤵
  PID:14880
- C:\Windows\System\VkEFuHV.exe
  C:\Windows\System\VkEFuHV.exe
  2⤵
  PID:14896
- C:\Windows\System\pYmopZr.exe
  C:\Windows\System\pYmopZr.exe
  2⤵
  PID:14948
- C:\Windows\System\NCupwIk.exe
  C:\Windows\System\NCupwIk.exe
  2⤵
  PID:14964
- C:\Windows\System\tmRCUDy.exe
  C:\Windows\System\tmRCUDy.exe
  2⤵
  PID:14980
- C:\Windows\System\HcgBXDP.exe
  C:\Windows\System\HcgBXDP.exe
  2⤵
  PID:14996
- C:\Windows\System\ClbbCQT.exe
  C:\Windows\System\ClbbCQT.exe
  2⤵
  PID:15012
- C:\Windows\System\woBOIkX.exe
  C:\Windows\System\woBOIkX.exe
  2⤵
  PID:15032
- C:\Windows\System\TMSXIUJ.exe
  C:\Windows\System\TMSXIUJ.exe
  2⤵
  PID:15060
- C:\Windows\System\HoKdXPo.exe
  C:\Windows\System\HoKdXPo.exe
  2⤵
  PID:15092
- C:\Windows\System\ixWwgKx.exe
  C:\Windows\System\ixWwgKx.exe
  2⤵
  PID:15108
- C:\Windows\System\YsCemCd.exe
  C:\Windows\System\YsCemCd.exe
  2⤵
  PID:15124
- C:\Windows\System\FdOgnts.exe
  C:\Windows\System\FdOgnts.exe
  2⤵
  PID:15144
- C:\Windows\System\CYIehHm.exe
  C:\Windows\System\CYIehHm.exe
  2⤵
  PID:15172
- C:\Windows\System\AZOvdMG.exe
  C:\Windows\System\AZOvdMG.exe
  2⤵
  PID:15188
- C:\Windows\System\tdIqQMu.exe
  C:\Windows\System\tdIqQMu.exe
  2⤵
  PID:15204
- C:\Windows\System\zBcaGky.exe
  C:\Windows\System\zBcaGky.exe
  2⤵
  PID:15220
- C:\Windows\System\KCmUyVf.exe
  C:\Windows\System\KCmUyVf.exe
  2⤵
  PID:15236
- C:\Windows\System\chwUZVp.exe
  C:\Windows\System\chwUZVp.exe
  2⤵
  PID:15260
- C:\Windows\System\zAHFjms.exe
  C:\Windows\System\zAHFjms.exe
  2⤵
  PID:15284
- C:\Windows\System\QoxWVid.exe
  C:\Windows\System\QoxWVid.exe
  2⤵
  PID:15304
- C:\Windows\System\CcbTqGF.exe
  C:\Windows\System\CcbTqGF.exe
  2⤵
  PID:15320
- C:\Windows\System\qfAuPjC.exe
  C:\Windows\System\qfAuPjC.exe
  2⤵
  PID:15348
- C:\Windows\System\mBDuFcF.exe
  C:\Windows\System\mBDuFcF.exe
  2⤵
  PID:13140
- C:\Windows\System\qgmZGQC.exe
  C:\Windows\System\qgmZGQC.exe
  2⤵
  PID:11860
- C:\Windows\System\mFfuxkw.exe
  C:\Windows\System\mFfuxkw.exe
  2⤵
  PID:13352
- C:\Windows\System\rVtAwUp.exe
  C:\Windows\System\rVtAwUp.exe
  2⤵
  PID:14360
- C:\Windows\System\AQQwYLn.exe
  C:\Windows\System\AQQwYLn.exe
  2⤵
  PID:13608
- C:\Windows\System\AmtcTnq.exe
  C:\Windows\System\AmtcTnq.exe
  2⤵
  PID:13788
- C:\Windows\System\wwywclH.exe
  C:\Windows\System\wwywclH.exe
  2⤵
  PID:12140
- C:\Windows\System\zSrLJyt.exe
  C:\Windows\System\zSrLJyt.exe
  2⤵
  PID:14040
- C:\Windows\System\LtMlLCU.exe
  C:\Windows\System\LtMlLCU.exe
  2⤵
  PID:14228
- C:\Windows\System\GQAAUsF.exe
  C:\Windows\System\GQAAUsF.exe
  2⤵
  PID:14344
- C:\Windows\System\WiRwLKP.exe
  C:\Windows\System\WiRwLKP.exe
  2⤵
  PID:14712
- C:\Windows\System\ceHMHvd.exe
  C:\Windows\System\ceHMHvd.exe
  2⤵
  PID:14736
- C:\Windows\System\sHtARwC.exe
  C:\Windows\System\sHtARwC.exe
  2⤵
  PID:14392
- C:\Windows\System\XtRmwRH.exe
  C:\Windows\System\XtRmwRH.exe
  2⤵
  PID:14432
- C:\Windows\System\qwQhQvW.exe
  C:\Windows\System\qwQhQvW.exe
  2⤵
  PID:3760
- C:\Windows\System\kogydng.exe
  C:\Windows\System\kogydng.exe
  2⤵
  PID:14560
- C:\Windows\System\gXIDxII.exe
  C:\Windows\System\gXIDxII.exe
  2⤵
  PID:14068
- C:\Windows\System\rCsaADa.exe
  C:\Windows\System\rCsaADa.exe
  2⤵
  PID:12496
- C:\Windows\System\aHtUbXp.exe
  C:\Windows\System\aHtUbXp.exe
  2⤵
  PID:12944
- C:\Windows\System\eOZMZhH.exe
  C:\Windows\System\eOZMZhH.exe
  2⤵
  PID:14856
- C:\Windows\System\YDFtuCO.exe
  C:\Windows\System\YDFtuCO.exe
  2⤵
  PID:14956
- C:\Windows\System\MXvjjjK.exe
  C:\Windows\System\MXvjjjK.exe
  2⤵
  PID:15072
- C:\Windows\System\JbpAFFB.exe
  C:\Windows\System\JbpAFFB.exe
  2⤵
  PID:15100
- C:\Windows\System\YldGfcd.exe
  C:\Windows\System\YldGfcd.exe
  2⤵
  PID:14660
- C:\Windows\System\XCBijus.exe
  C:\Windows\System\XCBijus.exe
  2⤵
  PID:15372
- C:\Windows\System\bYCqYpG.exe
  C:\Windows\System\bYCqYpG.exe
  2⤵
  PID:15404
- C:\Windows\System\sJgJdNo.exe
  C:\Windows\System\sJgJdNo.exe
  2⤵
  PID:15420
- C:\Windows\System\KVDiCQO.exe
  C:\Windows\System\KVDiCQO.exe
  2⤵
  PID:15436
- C:\Windows\System\ppmEmBh.exe
  C:\Windows\System\ppmEmBh.exe
  2⤵
  PID:15464
- C:\Windows\System\OFCyUbw.exe
  C:\Windows\System\OFCyUbw.exe
  2⤵
  PID:15480
- C:\Windows\System\XvmBisd.exe
  C:\Windows\System\XvmBisd.exe
  2⤵
  PID:15704
- C:\Windows\System\yQHUBwv.exe
  C:\Windows\System\yQHUBwv.exe
  2⤵
  PID:15720
- C:\Windows\System\oDwXpqP.exe
  C:\Windows\System\oDwXpqP.exe
  2⤵
  PID:15740
- C:\Windows\System\SqonNKC.exe
  C:\Windows\System\SqonNKC.exe
  2⤵
  PID:15768
- C:\Windows\System\QeUMJRm.exe
  C:\Windows\System\QeUMJRm.exe
  2⤵
  PID:15784
- C:\Windows\System\RRDijpc.exe
  C:\Windows\System\RRDijpc.exe
  2⤵
  PID:15800
- C:\Windows\System\HSJBjNN.exe
  C:\Windows\System\HSJBjNN.exe
  2⤵
  PID:15816
- C:\Windows\System\tfjniLY.exe
  C:\Windows\System\tfjniLY.exe
  2⤵
  PID:15832
- C:\Windows\System\iJYjijF.exe
  C:\Windows\System\iJYjijF.exe
  2⤵
  PID:15852
- C:\Windows\System\OTzNOWh.exe
  C:\Windows\System\OTzNOWh.exe
  2⤵
  PID:15868
- C:\Windows\System\nLbzdLG.exe
  C:\Windows\System\nLbzdLG.exe
  2⤵
  PID:15884
- C:\Windows\System\xUOtxZD.exe
  C:\Windows\System\xUOtxZD.exe
  2⤵
  PID:15900
- C:\Windows\System\VHdgpbt.exe
  C:\Windows\System\VHdgpbt.exe
  2⤵
  PID:15920
- C:\Windows\System\yZvUkhV.exe
  C:\Windows\System\yZvUkhV.exe
  2⤵
  PID:15936
- C:\Windows\System\UPPJPhQ.exe
  C:\Windows\System\UPPJPhQ.exe
  2⤵
  PID:15960
- C:\Windows\System\dgpsjvH.exe
  C:\Windows\System\dgpsjvH.exe
  2⤵
  PID:15976
- C:\Windows\System\tPXiyNx.exe
  C:\Windows\System\tPXiyNx.exe
  2⤵
  PID:15992
- C:\Windows\System\bMOpOeK.exe
  C:\Windows\System\bMOpOeK.exe
  2⤵
  PID:16008
- C:\Windows\System\MIGHjzC.exe
  C:\Windows\System\MIGHjzC.exe
  2⤵
  PID:16024
- C:\Windows\System\ITeDCGk.exe
  C:\Windows\System\ITeDCGk.exe
  2⤵
  PID:16040
- C:\Windows\System\piuJkxJ.exe
  C:\Windows\System\piuJkxJ.exe
  2⤵
  PID:16060
- C:\Windows\System\GnnZLVp.exe
  C:\Windows\System\GnnZLVp.exe
  2⤵
  PID:16084
- C:\Windows\System\HALoJGv.exe
  C:\Windows\System\HALoJGv.exe
  2⤵
  PID:16100
- C:\Windows\System\qtWMvfT.exe
  C:\Windows\System\qtWMvfT.exe
  2⤵
  PID:16116
- C:\Windows\System\peosSIe.exe
  C:\Windows\System\peosSIe.exe
  2⤵
  PID:16132
- C:\Windows\System\HsZCLJe.exe
  C:\Windows\System\HsZCLJe.exe
  2⤵
  PID:16148
- C:\Windows\System\BXGACGR.exe
  C:\Windows\System\BXGACGR.exe
  2⤵
  PID:16172
- C:\Windows\System\jEuDPpK.exe
  C:\Windows\System\jEuDPpK.exe
  2⤵
  PID:16196
- C:\Windows\System\qKiVmgy.exe
  C:\Windows\System\qKiVmgy.exe
  2⤵
  PID:16216
- C:\Windows\System\VJZtFKE.exe
  C:\Windows\System\VJZtFKE.exe
  2⤵
  PID:16232
- C:\Windows\System\lerpdTg.exe
  C:\Windows\System\lerpdTg.exe
  2⤵
  PID:16260
- C:\Windows\System\uxbaDIh.exe
  C:\Windows\System\uxbaDIh.exe
  2⤵
  PID:16284
- C:\Windows\System\BnuOceX.exe
  C:\Windows\System\BnuOceX.exe
  2⤵
  PID:16308
- C:\Windows\System\htQAKqb.exe
  C:\Windows\System\htQAKqb.exe
  2⤵
  PID:16332
- C:\Windows\System\ilUOMyY.exe
  C:\Windows\System\ilUOMyY.exe
  2⤵
  PID:16348
- C:\Windows\System\LBRBTjo.exe
  C:\Windows\System\LBRBTjo.exe
  2⤵
  PID:16368
- C:\Windows\System\dxXWPiq.exe
  C:\Windows\System\dxXWPiq.exe
  2⤵
  PID:15272
- C:\Windows\System\ZmSbJmy.exe
  C:\Windows\System\ZmSbJmy.exe
  2⤵
  PID:13584
- C:\Windows\System\FRHBBGr.exe
  C:\Windows\System\FRHBBGr.exe
  2⤵
  PID:14704
- C:\Windows\System\fRStiuv.exe
  C:\Windows\System\fRStiuv.exe
  2⤵
  PID:15212
- C:\Windows\System\izUVkVy.exe
  C:\Windows\System\izUVkVy.exe
  2⤵
  PID:15168
- C:\Windows\System\lsTcDIE.exe
  C:\Windows\System\lsTcDIE.exe
  2⤵
  PID:15292
- C:\Windows\System\FbAVJRC.exe
  C:\Windows\System\FbAVJRC.exe
  2⤵
  PID:15452
- C:\Windows\System\VrIDIov.exe
  C:\Windows\System\VrIDIov.exe
  2⤵
  PID:15492
- C:\Windows\System\QAOZlBA.exe
  C:\Windows\System\QAOZlBA.exe
  2⤵
  PID:15340
- C:\Windows\System\sbCghXx.exe
  C:\Windows\System\sbCghXx.exe
  2⤵
  PID:13808
- C:\Windows\System\IlBypbX.exe
  C:\Windows\System\IlBypbX.exe
  2⤵
  PID:14272
- C:\Windows\System\iLEZLHM.exe
  C:\Windows\System\iLEZLHM.exe
  2⤵
  PID:13580
- C:\Windows\System\pMOEFDA.exe
  C:\Windows\System\pMOEFDA.exe
  2⤵
  PID:14460
- C:\Windows\System\nSEjUNk.exe
  C:\Windows\System\nSEjUNk.exe
  2⤵
  PID:14500
- C:\Windows\System\SmdTunZ.exe
  C:\Windows\System\SmdTunZ.exe
  2⤵
  PID:15024
- C:\Windows\System\dfLosnZ.exe
  C:\Windows\System\dfLosnZ.exe
  2⤵
  PID:15556
- C:\Windows\System\cxfhtmZ.exe
  C:\Windows\System\cxfhtmZ.exe
  2⤵
  PID:15152
- C:\Windows\System\TmxDWmE.exe
  C:\Windows\System\TmxDWmE.exe
  2⤵
  PID:14384
- C:\Windows\System\xncSATe.exe
  C:\Windows\System\xncSATe.exe
  2⤵
  PID:13652
- C:\Windows\System\nPLrulP.exe
  C:\Windows\System\nPLrulP.exe
  2⤵
  PID:14544
- C:\Windows\System\rZSyKqZ.exe
  C:\Windows\System\rZSyKqZ.exe
  2⤵
  PID:14112
- C:\Windows\System\fgGTiiU.exe
  C:\Windows\System\fgGTiiU.exe
  2⤵
  PID:15196
- C:\Windows\System\GtOeCMK.exe
  C:\Windows\System\GtOeCMK.exe
  2⤵
  PID:15160
- C:\Windows\System\rqGnBWQ.exe
  C:\Windows\System\rqGnBWQ.exe
  2⤵
  PID:15248
- C:\Windows\System\WXcFbzo.exe
  C:\Windows\System\WXcFbzo.exe
  2⤵
  PID:15412
- C:\Windows\System\CtBeBxj.exe
  C:\Windows\System\CtBeBxj.exe
  2⤵
  PID:15312
- C:\Windows\System\LEuCjkB.exe
  C:\Windows\System\LEuCjkB.exe
  2⤵
  PID:15676
- C:\Windows\System\IjOvnWb.exe
  C:\Windows\System\IjOvnWb.exe
  2⤵
  PID:15760
- C:\Windows\System\bTwaFyA.exe
  C:\Windows\System\bTwaFyA.exe
  2⤵
  PID:15808
- C:\Windows\System\rhoRvOF.exe
  C:\Windows\System\rhoRvOF.exe
  2⤵
  PID:14596
- C:\Windows\System\eXZavoU.exe
  C:\Windows\System\eXZavoU.exe
  2⤵
  PID:14568
- C:\Windows\System\PwaxBTN.exe
  C:\Windows\System\PwaxBTN.exe
  2⤵
  PID:16000
- C:\Windows\System\LSnFcEX.exe
  C:\Windows\System\LSnFcEX.exe
  2⤵
  PID:16156
- C:\Windows\System\AccrqBa.exe
  C:\Windows\System\AccrqBa.exe
  2⤵
  PID:16240
- C:\Windows\System\HDFiNJf.exe
  C:\Windows\System\HDFiNJf.exe
  2⤵
  PID:15684
- C:\Windows\System\ZEALoda.exe
  C:\Windows\System\ZEALoda.exe
  2⤵
  PID:16304
- C:\Windows\System\ufScKbS.exe
  C:\Windows\System\ufScKbS.exe
  2⤵
  PID:16400
- C:\Windows\System\sdmLBmb.exe
  C:\Windows\System\sdmLBmb.exe
  2⤵
  PID:16420
- C:\Windows\System\tSuoDUT.exe
  C:\Windows\System\tSuoDUT.exe
  2⤵
  PID:16440
- C:\Windows\System\urbAEFw.exe
  C:\Windows\System\urbAEFw.exe
  2⤵
  PID:16456
- C:\Windows\System\pQywhCj.exe
  C:\Windows\System\pQywhCj.exe
  2⤵
  PID:16472
- C:\Windows\System\RGnkmSs.exe
  C:\Windows\System\RGnkmSs.exe
  2⤵
  PID:16488
- C:\Windows\System\kyXBdvJ.exe
  C:\Windows\System\kyXBdvJ.exe
  2⤵
  PID:16788
- C:\Windows\System\HumNjiL.exe
  C:\Windows\System\HumNjiL.exe
  2⤵
  PID:16808
- C:\Windows\System\JAAEFjT.exe
  C:\Windows\System\JAAEFjT.exe
  2⤵
  PID:16824
- C:\Windows\System\cFekown.exe
  C:\Windows\System\cFekown.exe
  2⤵
  PID:16840
- C:\Windows\System\oqQyfqp.exe
  C:\Windows\System\oqQyfqp.exe
  2⤵
  PID:16856
- C:\Windows\System\XdQnfWD.exe
  C:\Windows\System\XdQnfWD.exe
  2⤵
  PID:16888
- C:\Windows\System\LtfQOyp.exe
  C:\Windows\System\LtfQOyp.exe
  2⤵
  PID:16904
- C:\Windows\System\JXnGldm.exe
  C:\Windows\System\JXnGldm.exe
  2⤵
  PID:16920
- C:\Windows\System\XQPxznt.exe
  C:\Windows\System\XQPxznt.exe
  2⤵
  PID:16936
- C:\Windows\System\KnmzNZB.exe
  C:\Windows\System\KnmzNZB.exe
  2⤵
  PID:16952
- C:\Windows\System\uPeWDWw.exe
  C:\Windows\System\uPeWDWw.exe
  2⤵
  PID:16972
- C:\Windows\System\BXwsPsl.exe
  C:\Windows\System\BXwsPsl.exe
  2⤵
  PID:17004
- C:\Windows\System\HLpFyiX.exe
  C:\Windows\System\HLpFyiX.exe
  2⤵
  PID:17024
- C:\Windows\System\RBLnLDm.exe
  C:\Windows\System\RBLnLDm.exe
  2⤵
  PID:17040

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4320 -i 4320 -h 520 -j 524 -s 532 -d 14428
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:13424

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:11568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AkNUArH.exe

Filesize
1.3MB

MD5
b0ecc1f13e219de832055a7ecf757bc9

SHA1
41aee1b45cc489730d80862b94396c388fa5a826

SHA256
123e538694c988d1e924b1f7074b0c6dfeb62315bff709e26d2de3bc14bc0fc2

SHA512
743ebc4769b79fee3a7f4d21d09d480ce2fbf79ee044cc4994912a8096d47ac83dbcf7d8e2561fbe8ad01abfbd80150310c1a65e12b14b842649f956ee8d7a06

Download Submit
C:\Windows\System\BPQRQHG.exe

Filesize
1.3MB

MD5
5a225462d83753716cfc9f4138bd5652

SHA1
3165a3af0de7446434051fcc79b0e4726abec9a2

SHA256
97be937ab733fb96cf630091c7e4e4e6a906f859f841568f40c2f5be1bc43d09

SHA512
a551164d4c4b35091c3539ea69c7581fed04fa46c61f23e5a6bfb1530d87be056dbe359f73cad05eac099c5334951e25d936a640c6e5f9ab459c0c7992f4f8c1

Download Submit
C:\Windows\System\BTgJTHB.exe

Filesize
1.3MB

MD5
d7dcfee5d6e6642bc5a13234c8fe9403

SHA1
bda4bb10b15bd25dce56ecefb6f1708c66df825f

SHA256
84f843b175aef21eaeaca08b424076c25684aa2bda3a34b2bd761197a1583ae9

SHA512
82090512f5d95aacb9e29b889ab8cebd2ad5b6a266ef55fabab0df0629c6a293c39220405553b6fd62e1a0dd1bff9e75d85f9177de2eaa7572cba79431b3461b

Download Submit
C:\Windows\System\CJyVtNF.exe

Filesize
1.3MB

MD5
16d761e00cba92bd6680600b9b032434

SHA1
ad827a99e8c476e668b7588c80d73e9df098c90f

SHA256
5dd52813db7ebd22fd9200662d04d6f6acee760a3ca987bd8662320f3ce23a56

SHA512
29562ce931e602e12eb4e0a0e9d8a894b2fac39474b34ce0e9020469cf3487b9ae56c3ca601a61edb75ab44dee024428c7232d99be6be3c5e3ccf8dd924cb7fb

Download Submit
C:\Windows\System\CbAoIia.exe

Filesize
1.3MB

MD5
fafe0009a9533bff2c654eb957ccd235

SHA1
3e2d1045ba9a93df68555dcf1fd9cce7c6c55828

SHA256
17968d5b4fa39c0940e91c77f3176b4f96733e447943b5ede7c68424b20991ff

SHA512
82ab8756e34bb34181642c9a9131d379d8702c687b75a3b739689565202b0d3aa658b8e554d44b0378e8646254066c6cabf37cb46fdd9359740557361c7616f4

Download Submit
C:\Windows\System\CjiiTNj.exe

Filesize
1.3MB

MD5
216dce22c3b0ab2893fc29aa4ea20cea

SHA1
9c5f0e0c60ac975f3b8747b9ade844fa06224ad5

SHA256
407001672a218eda91d578a5b2eda7ab38cd3b44101885eb2289b05139ef00f6

SHA512
4163382ea72e4c2a2fe84eb48df3f10c801946e95e6a237392e4ddce4cbece6e48c966bbac9526e287875f2117124de09920822003b87cad390c712f1a9284fe

Download Submit
C:\Windows\System\IsJWIeu.exe

Filesize
1.3MB

MD5
ebf455e66971db5ab7a114e4c50c53ca

SHA1
073d6a5685a91f551e8c276c8d5566a5142f52ce

SHA256
8f9ccbbb1758f442dc85e203b1cc99f2be215bb808583fd30301b3338f6add2b

SHA512
ae82bf363e162ca07f16d5503298ce93cfbce367ed54d5bcaad2e3421c875c3caac1f20ba6e3106ced3c9f4ec31bae3f1174a500d4d16e8492f4beb1b4d421cb

Download Submit
C:\Windows\System\Jhwcvmq.exe

Filesize
1.3MB

MD5
57c5853456cbdee78094e67f589bd1a3

SHA1
2363f3913bb3eaa80e533260e8f622b414369640

SHA256
ac070cafa6e10f87d570857a01ec8a79d900f2afecb2df989ebeb2720b3cd3d6

SHA512
3ab073d2e7f23870493a75fbcd9c2c06be2f5d7e7a3b38d6d044240c9a4e4cb418aa724bf4d681bb7bb2c195cba22ebf11c7d07384f28d90a2cceee770b75012

Download Submit
C:\Windows\System\LoQjakY.exe

Filesize
1.3MB

MD5
c3b585d861190ae3fd73f0eb9a0adb0f

SHA1
a127894f62037ed78816cc068489886f3d100572

SHA256
73b9e0b583cca763ed02ec4518c1c9a5dfbf461dce40a93ec8c338c2db0ab117

SHA512
061db70db23c5313b7a22908d78eb8cf1098f42be931b6fd95722f95fea23c5348e712bbe16061e551afa1a5267678441de392fec7b8e512689f7c0d570ec1b8

Download Submit
C:\Windows\System\PWYHAiF.exe

Filesize
1.3MB

MD5
0116e746f81fc013331d250a007fe5da

SHA1
167de6130cb0f1554f111d482d92f620a16f8e41

SHA256
0596bc03274473d882342d63dfe0aba163197ac8373c8434391d377d876031cd

SHA512
f38fa8872605d5685630afe89cd16fe80e1a4c572fcf6f7b584c6d05b12742a2fc75d3e4583da74c9af4a86bc6f39ea7956b6b78ce4cff94487f2da8d678f30a

Download Submit
C:\Windows\System\PZFbDFi.exe

Filesize
1.3MB

MD5
af4771089947bb3cacdf685b4cfb25b7

SHA1
3916e41d28a560599a7c02713d0c68e4e5b715ce

SHA256
43953d868ab9d901b152c397a7b74913756c562be391d7a92f8949116af84aaf

SHA512
29b1e81613441625a1b37c0203c6b382eb4387b8c2a9ff86d6c4bc48795789cce8b4887095899531413e2ccdf1e578cb6b8b2be448339b65f986dee5a99767ab

Download Submit
C:\Windows\System\QMgWHVU.exe

Filesize
1.3MB

MD5
713af0fe1e1a1ac1d811cdf379b4ca7a

SHA1
926b5d796ae8dddbc1f9f1536ee61a1b7ba87628

SHA256
33374f1872e202abb4adfff6a2fed56a85067a67090a55780e30673199adb5ad

SHA512
b1678b25d65917a689868c37ebfd441a1da0620f3db9ff27d10a61ac503f840eecde6c3adcba46eb012f2e285e2acf896a84ee4918e42beba71836f343ca1441

Download Submit
C:\Windows\System\RtyfSbk.exe

Filesize
1.3MB

MD5
321d0967c597f3a49bc9406a8586e251

SHA1
d437fae84c0c3cb5923cf6b9fab4af128afbd234

SHA256
306eee43c0be9ae374d45cb5ae33559abba094ef537f461e6ae46d8324e467e3

SHA512
f5dcc78afac3095eb0624786c5ea7766bf452a146ff0117bb0b8a95513a5c887229940305d90b91516c5a5b8425e74cc1d39e4ad9e726a5ab34c0b3acafa2154

Download Submit
C:\Windows\System\SKUAtAN.exe

Filesize
1.3MB

MD5
a9b47f03c7a9329d38c77a9c62bc9da0

SHA1
e6f7db912c373cec275c9d2547a05c8e212a97cb

SHA256
bc368a0908aaf35b486eb2e5121be886f43e0484cd6dd7600c0e7dceb8e24d83

SHA512
b3dab3d2ce25afac8386304ef7cc7093391f189267079a6d26c17469dfcf7346d7f487eca10fa4eeb69b014cce91f5b566b588ad9f2a9d40d54795b3f576b494

Download Submit
C:\Windows\System\TEtAPbj.exe

Filesize
1.3MB

MD5
fb25eac6ab25d1f94e9de00483f279b8

SHA1
185cee467f72a29a01b057d8f74b6d39e9751b8a

SHA256
88adb20050821202e86c98093b852ccb5c5e8aa46bd287a65c90e87843a09325

SHA512
0e5ba4f4c35edf7b84c464e3b98ee795136abd4feae04d4a5143902b90dcdec42410870bdca2743b6c058365438901bdbc1446b169335de126c6349fd35c0c0a

Download Submit
C:\Windows\System\THesjMn.exe

Filesize
1.3MB

MD5
7e3762b677db58912ab2bc33d0c2d9bc

SHA1
d51f25cd98e6d9b02e88709abb2fef9ec22ae8db

SHA256
bb725de74030304a23e4d36bbf681a7dc8363d4f6afaef25f54a8b3f8396ad71

SHA512
cbefa4c5dd063811b3d6b4c8d8e60943af9d2d3d9d43dee77598584b2d65c582f4a1e24e206c16259eb954adab1caf22d975ccdeb13deed3de3d142714825799

Download Submit
C:\Windows\System\UoyghNb.exe

Filesize
1.3MB

MD5
91bf33d09be89648b229f5afaa6fbaca

SHA1
c95438bf038323fe4da5e06c815648015e2c3edc

SHA256
c7cac893cea0ebf067525859918146f8fc39f9b2a61760b50dc5f502f05f8815

SHA512
5e0f41b7b365c87d10b875cc1d9d1f847b17cc66b82e562c8b3b9363d00d704a7cb5e6300e74fb19ec65709d3cfb7e2e88b128792030555aa495b485032b7e34

Download Submit
C:\Windows\System\WFeoBLi.exe

Filesize
1.3MB

MD5
20e249a526ce5a23188b6fdbbda69709

SHA1
aa80fc8028a81045f2df3ad97dc9bc972895ea8d

SHA256
3c0f5778603162aade01b4995597602fc2c836a606421dc41218ee7fe38b570e

SHA512
b534570fba5655cd0968b71f2e7b14b89241d069b9f669144d0de8a57dc4d8fe2ff7712129b00d20dedb4bf28d5374c79b65368d9ff945f531a266420cec76d7

Download Submit
C:\Windows\System\XNjNyQz.exe

Filesize
1.3MB

MD5
1c9227756c786d7bdd2f34836105a404

SHA1
7cd89bdec2f271be13d0d0204eea23047ea8e8fd

SHA256
b48127376e7d72f76996fdee094b233145904572ed05d5ee52d19b708ea1677c

SHA512
7ae2d56403eee0ef1d6e24991081be961a7a2f3faecdeefa709e7362878e2809c59adc5fcdc8b59a272ee8c4e9a8e662d17624f54a1f1a62d11a3eec3aa352f0

Download Submit
C:\Windows\System\XgbKsbD.exe

Filesize
1.3MB

MD5
77ec7327fcbd82b46620ab34c7a8ef12

SHA1
6c9434a19594a69875759495e6152f42e95d06db

SHA256
a8b936f794f7e810d637afa7f053af45c60f5d24924ebc7cfc7fa548b1f3c238

SHA512
d00978e4f7d432509bc6da7967c96c214916e43664e6ee291deceab66de9d44a4c814435dfb2939a37b98015000ae07a541bd083528b85dbd75b803f41aa426d

Download Submit
C:\Windows\System\YlapaLV.exe

Filesize
1.3MB

MD5
e9cf2493690d40add615745561baffcb

SHA1
c349ff4773f15400770e25d10d358a30a42972b8

SHA256
63d2096574f234063604c14316d1d92471e153017b02d827e66d8c0bb4efb8f5

SHA512
0914ed21af4d73f341836efe475d6e3705e6978c92744e51b739f66caa83da1ef9408c05c8c912287d3cd1002d88649d531cc094580fd9d74acc02ab96304da4

Download Submit
C:\Windows\System\aqqCgWw.exe

Filesize
1.3MB

MD5
80bbc567fa56062dcc78e17db9ab749d

SHA1
a4aa8430deeb7805c599aaa3591cd15d7375b4ec

SHA256
12b8eeffd75787a1fcb97a80cdec14b5e0591aae19bf5c7ab75af662af17ff21

SHA512
b2f886e1f0b0b0d38d1f8c9015fa25e34b27c3fb36c7641da3def6e5ee941b1c319a55c07b8a4b5d7680902631bcb105842d1372e0da154f1ab60fd3528adebe

Download Submit
C:\Windows\System\cJKAejm.exe

Filesize
1.3MB

MD5
54e25cb8914ec21826507333742d1d7b

SHA1
77b4c77d5ebdc87b028c8ef9d1c71bd02a857ce2

SHA256
84933ec7158178846f260f1d587300b45aa879249a4904fbdf2d02409dc1bfb6

SHA512
565abc15f277b6085115de06173d5627539f3e6a1df8eefb58cecff98dd929a271841f9d4a802ba30485734a1d225b45d08a6f1dd6f87fa251a058c472b4d52c

Download Submit
C:\Windows\System\dejympz.exe

Filesize
1.3MB

MD5
b1e7bab4516e8a11730d28818d745a2e

SHA1
f5755639468be8fc65b14148d3f8298ff662378b

SHA256
f13d141358100cb0545eec2b3d40d92748cabf63cb80a8281f40decdfaa7be76

SHA512
bcd8148aa75e4824eeb133f1328e25cf517caa26870bb3d5c05e0028d0939a2393935b014c47496babf256e96652c3692d1ccf1b9ea2b1862caf979460b923c0

Download Submit
C:\Windows\System\fkRJMMy.exe

Filesize
1.3MB

MD5
d3852582f7faceba69e2d136a8608d37

SHA1
01f2c416934acdba6cdefc4631bbc16a22911843

SHA256
ac2f87ba6a566e9890cd45bab81d5d94c227740cc87509172178419731512347

SHA512
555205554ade43f18666ca4d5f770c68c04ad026996b50e5cadf35ef0255f7a93446744f34b3cc01ea27c5b850cf5126ee287da333860dd60d8e132fb076135b

Download Submit
C:\Windows\System\gEBiZYp.exe

Filesize
1.3MB

MD5
f7090f75f57207c1bc48722d7ffdfebb

SHA1
9ea0bde2ddcd4f76199fb3b10c16b9ba91e95fda

SHA256
ea4aa94556097ed2e44ecbcf4df1b809a6d8987f24f3ecfab0fe22d38dd79a98

SHA512
5f8c951917deb2594ccc71d152d94714673be28eeed0d5c088d0542cb1da2c7842c115a4978662cb18a635dbf79e68f0c096123d8ea05cf33f33b57ddf30d54e

Download Submit
C:\Windows\System\hnYoIav.exe

Filesize
1.3MB

MD5
3ecf81a1517fc3a3aaac6d8ffdd9607b

SHA1
5890af4fb911c4020c73e867497817290276c0fd

SHA256
4a980d2d72422e7175065e91c743a0ea5def62229c04c94ce6c9e6f5752d6e2a

SHA512
226a5f3eebc8ece8821770fdf3acaf3823bb094fd5c35ed15b33133cf0d637cbb3e50addaa43a99922ac752d434f9877e3afbd8f734841158bd145a2884c616e

Download Submit
C:\Windows\System\ktGKJMQ.exe

Filesize
1.3MB

MD5
a91510db2f45fb98feea65b9cafc10a6

SHA1
c63ff6effb82bd0e76d41bf3f8b27d0eadde7c1b

SHA256
b6a978c535873984f0f1ca775b1201782c62ffcd46f6160ad453e7d27632ec94

SHA512
e4cfa1a02b0ced0ba96a5201e6c9126b15dc4b8e383707bda3b7e34d9a62df2088a4dd08616767883810100d59df2075154aa77e563a819225118a0b99877237

Download Submit
C:\Windows\System\mFPhrmU.exe

Filesize
1.3MB

MD5
94210df1e85e6a845f1ed65e4301a86c

SHA1
801cbc1782ca2ad457f35652b607f6ba87c5446a

SHA256
675b09bdb2a70d9cd20c4d912e0338096a1dc7e2005aa5d80485583cbde94b2b

SHA512
d2e066a66e5a2326980fd0fc071981c3469559c2f2adff9d6c500bff388992d84303952efbef1eef8d067ef9055e84cb17dcd12bc6d870ae3a8f48a7c705b997

Download Submit
C:\Windows\System\mfehLAl.exe

Filesize
1.3MB

MD5
bfc7285fc3aba9e1bf0545e1ba9e0aa4

SHA1
aa8c870d07d4f75ad80282b98b77c9980de7e0c3

SHA256
d0ee47aa49552f7b94872d76459bfa013edb09ce656dbf271c9c0217141c1dc9

SHA512
81207b621cab37b7359e1f81f8fd3d141eadf9287d7108033dd401bdf4c2d36d6f6d3f6db3361b3983b16e828ee827f27fce680681fb011ba198a0e92dd4245b

Download Submit
C:\Windows\System\oWyGnhy.exe

Filesize
1.3MB

MD5
76cc3aa9dba2ac2d534d90619bdabe36

SHA1
bf92cf835b601057d0224600defd999d1ea1cfbd

SHA256
4bb539df43388c3f9d50afc1870be2414e0aaa65ea91ad81c4380ddb90da19bb

SHA512
01eb207d8810226ece223cdd73014a2148721080b1ab1d7779c0437a81f4b1645563b6687a7980b0a88df3abb8a078f73c930153c956997d9eb8a2f6fcb72e7a

Download Submit
C:\Windows\System\pjMWiMA.exe

Filesize
1.3MB

MD5
22ac9ddc4cddd7ad5132979d6e22ce22

SHA1
b02ccb584ab8991951d25c00e73e90eaca61178f

SHA256
1852d72166126e5b8cd9a767b77282f075c969fa89dc59b0a89d4a7f67f6a094

SHA512
c81c7e9f4422597445cae379d3c963a5c860b08b0ee7ae2d019c79a905aa9e4a508cb6c75666a3c2e2bcb0f7841cee4421c2cb143c1a4ecc88aa5ffe2e49bccd

Download Submit
C:\Windows\System\suVRXSO.exe

Filesize
1.3MB

MD5
e4013bfd461ec4c893218119cd60bd3c

SHA1
a4cbe44f9b7ed6e24c2df22f0bad32b476ee05a6

SHA256
4e0e11ae42a04bf393e50923b803c959d4374531070a5402c0e130beef29c940

SHA512
04e8b219e3b1c7e3f9ef8898c4355e166eff6fb0681287208fa64ee826a2a1147648c0e6fcf48de46f949ae7cd620ecc8e0b4c9f3ade7ba7cd5ad31bae9cf8f5

Download Submit
C:\Windows\System\uaiduYW.exe

Filesize
1.3MB

MD5
e56101b876a2f1f434099e65e9c1d2f0

SHA1
f62780c3af88ef7966f201efdb62b2af6571ef3e

SHA256
9d4cb26028bac88258ac7840c4298b829f5f746d7378fca2a0a62fba6086ba28

SHA512
49cd7dc0a060993620d5fd216fb0279ade1c0af7e2efafaaf76331d701c0731450384e2934e77caf659df51b931251e466fbde5f2038440c55500864506be224

Download Submit
memory/320-0-0x0000027D64550000-0x0000027D64560000-memory.dmp

Filesize
64KB

Download