xmrig | ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979

Analysis

max time kernel
96s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
Size

1.1MB
MD5

a59e1bc8b4749e86e3466125e2f7c079
SHA1

a0e537054142e73fc14cf601143934cfa904ec71
SHA256

ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979
SHA512

ca1506ab4483ff23b93e873aac5d8c14cd79af6b26191681058bf575f070f73543ac1e475d83b50262acdcb0b5fd6f5d656036ad74adbfc140db0a1a676e087c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSP8U3KIz2Q+:GezaTF8FcNkNdfE0pZ9ozttwIRRKrw

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 17204 created 16728	17204	WerFaultSecure.exe	924

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b6d-4.dat	xmrig
behavioral2/files/0x000b000000023b73-9.dat	xmrig
behavioral2/files/0x000a000000023b79-20.dat	xmrig
behavioral2/files/0x000a000000023b7a-27.dat	xmrig
behavioral2/files/0x000a000000023b7c-35.dat	xmrig
behavioral2/files/0x000a000000023b7d-47.dat	xmrig
behavioral2/files/0x000a000000023b7f-58.dat	xmrig
behavioral2/files/0x000a000000023b86-87.dat	xmrig
behavioral2/files/0x000b000000023b94-157.dat	xmrig
behavioral2/files/0x000a000000023b7b-30.dat	xmrig
behavioral2/files/0x000a000000023b9c-162.dat	xmrig
behavioral2/files/0x000b000000023b93-160.dat	xmrig
behavioral2/files/0x000b000000023b92-155.dat	xmrig
behavioral2/files/0x000a000000023b91-150.dat	xmrig
behavioral2/files/0x000a000000023b90-145.dat	xmrig
behavioral2/files/0x000a000000023b8f-140.dat	xmrig
behavioral2/files/0x000a000000023b8e-135.dat	xmrig
behavioral2/files/0x000a000000023b8d-130.dat	xmrig
behavioral2/files/0x000a000000023b8c-125.dat	xmrig
behavioral2/files/0x000a000000023b8b-120.dat	xmrig
behavioral2/files/0x000a000000023b8a-115.dat	xmrig
behavioral2/files/0x000a000000023b89-110.dat	xmrig
behavioral2/files/0x000a000000023b88-105.dat	xmrig
behavioral2/files/0x000a000000023b87-100.dat	xmrig
behavioral2/files/0x000a000000023b85-90.dat	xmrig
behavioral2/files/0x000a000000023b84-85.dat	xmrig
behavioral2/files/0x000a000000023b83-80.dat	xmrig
behavioral2/files/0x000a000000023b82-75.dat	xmrig
behavioral2/files/0x000a000000023b81-67.dat	xmrig
behavioral2/files/0x000a000000023b80-63.dat	xmrig
behavioral2/files/0x000a000000023b7e-53.dat	xmrig
behavioral2/files/0x000a000000023b78-45.dat	xmrig
behavioral2/files/0x000a000000023b77-17.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
468	hxxpXaq.exe
4344	yRiLKiw.exe
1724	oYZoaaf.exe
4908	KsfzkQa.exe
4964	COEQiEx.exe
3528	pdUEFcF.exe
3908	BtSKiIa.exe
1660	IrDXZgv.exe
4840	zSgJWmJ.exe
2000	KIQwNDv.exe
3536	jftaJdg.exe
3568	SkRuNKC.exe
656	hTsUtmL.exe
4252	wTDNBms.exe
2732	mppBthR.exe
4480	LopHiLP.exe
4464	nDzObTZ.exe
1044	QHEoqLh.exe
3160	KOKDluS.exe
2376	ewtjwPy.exe
3624	oFNiaoC.exe
4484	KxTsPVQ.exe
4420	vZPnSXk.exe
3028	eHMdWvX.exe
2036	YXYbQpw.exe
1452	mUttlXV.exe
1400	YbvBXZH.exe
1976	OlFPsfn.exe
1604	clBjFXL.exe
4876	tCNpEBX.exe
5088	RoZBLKA.exe
4004	DGkZRXQ.exe
4740	CGGTcbl.exe
3656	UwffNaw.exe
2228	IdSTleR.exe
3408	nsvqtol.exe
492	XYMkbTT.exe
4768	KBbWLvI.exe
2492	zSFtrQb.exe
3904	RDKngyk.exe
3448	gTohEaV.exe
2268	caRYnLa.exe
2584	EEEqblT.exe
2680	HQujvlv.exe
744	mHTxxcS.exe
4272	fdnhFOZ.exe
1476	CbdTZZV.exe
3332	oDLZFzz.exe
4488	eLuTSus.exe
4624	tQZpQbv.exe
232	NGrnYbb.exe
2764	OQzeJVB.exe
4984	Isbaawc.exe
3024	BXoeUtX.exe
3048	pMmdElY.exe
4060	ccEhIyz.exe
3804	XgrVklj.exe
4296	bOjTCJW.exe
4388	fMlUYRh.exe
1772	mRQtJCM.exe
2992	TjoQbeF.exe
4832	EfFNZAO.exe
4948	LYUupcn.exe
436	UafckUz.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GIIYhRT.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\gfkCADl.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\iiGYqxZ.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\uqdCcoZ.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\UdSRjmw.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\VuzHZFn.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\UZCnEKc.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\qiBQUOf.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\vZPnSXk.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\gTohEaV.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\nepZAWX.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\MpsJkCF.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\FCoAZkR.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\mUuaGYt.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\bSHnNAw.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\pmKKYFB.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\uQuElht.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\QKAoIHj.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\JOTnWTq.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\PIhjXyr.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\rYKtZNR.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\vJEYHMg.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\UcLYZzh.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\RCKvIKt.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\IvJMziB.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\QyqlITD.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\QLuCBKW.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\jHtTfMR.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\sRHZieh.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\OrlGGKD.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\JSEKqPM.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\PzCSoQF.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\PESXWap.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\vhWhzJU.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\tdvseNp.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\PbWUtbd.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\YyrVWeF.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\sagKluz.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\caDCZYg.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\hQMSPkS.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\YbvBXZH.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\WEgGQmt.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\yQeAxRp.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\wryYEHg.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\lQWcMmr.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\JUiypXK.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\FpMsCsR.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\nCCiQXF.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\KxTsPVQ.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\bsaCVGT.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\pMmdElY.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\qeKNMRo.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\jpwOxKM.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\BjoTICy.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\JCnDECb.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\RQKcEES.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\RhWKHGU.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\GVaXrLF.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\HLaRygN.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\ucKTqNW.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\AbNfKOe.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\tGrtqPy.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\KKyJBZV.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
File created	C:\Windows\System\GtuizXT.exe	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
16992	WerFaultSecure.exe
16992	WerFaultSecure.exe
17260	WerFaultSecure.exe
17260	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 468	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	84
PID 716 wrote to memory of 468	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	84
PID 716 wrote to memory of 4344	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	85
PID 716 wrote to memory of 4344	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	85
PID 716 wrote to memory of 1724	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	86
PID 716 wrote to memory of 1724	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	86
PID 716 wrote to memory of 4908	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	87
PID 716 wrote to memory of 4908	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	87
PID 716 wrote to memory of 4964	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	88
PID 716 wrote to memory of 4964	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	88
PID 716 wrote to memory of 3528	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	89
PID 716 wrote to memory of 3528	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	89
PID 716 wrote to memory of 3908	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	90
PID 716 wrote to memory of 3908	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	90
PID 716 wrote to memory of 1660	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	91
PID 716 wrote to memory of 1660	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	91
PID 716 wrote to memory of 4840	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	92
PID 716 wrote to memory of 4840	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	92
PID 716 wrote to memory of 2000	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	93
PID 716 wrote to memory of 2000	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	93
PID 716 wrote to memory of 3536	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	94
PID 716 wrote to memory of 3536	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	94
PID 716 wrote to memory of 3568	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	95
PID 716 wrote to memory of 3568	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	95
PID 716 wrote to memory of 656	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	96
PID 716 wrote to memory of 656	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	96
PID 716 wrote to memory of 4252	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	97
PID 716 wrote to memory of 4252	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	97
PID 716 wrote to memory of 2732	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	98
PID 716 wrote to memory of 2732	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	98
PID 716 wrote to memory of 4480	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	99
PID 716 wrote to memory of 4480	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	99
PID 716 wrote to memory of 4464	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	100
PID 716 wrote to memory of 4464	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	100
PID 716 wrote to memory of 1044	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	101
PID 716 wrote to memory of 1044	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	101
PID 716 wrote to memory of 3160	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	102
PID 716 wrote to memory of 3160	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	102
PID 716 wrote to memory of 2376	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	103
PID 716 wrote to memory of 2376	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	103
PID 716 wrote to memory of 3624	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	104
PID 716 wrote to memory of 3624	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	104
PID 716 wrote to memory of 4484	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	105
PID 716 wrote to memory of 4484	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	105
PID 716 wrote to memory of 4420	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	106
PID 716 wrote to memory of 4420	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	106
PID 716 wrote to memory of 3028	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	107
PID 716 wrote to memory of 3028	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	107
PID 716 wrote to memory of 2036	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	108
PID 716 wrote to memory of 2036	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	108
PID 716 wrote to memory of 1452	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	109
PID 716 wrote to memory of 1452	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	109
PID 716 wrote to memory of 1400	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	110
PID 716 wrote to memory of 1400	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	110
PID 716 wrote to memory of 1976	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	111
PID 716 wrote to memory of 1976	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	111
PID 716 wrote to memory of 1604	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	112
PID 716 wrote to memory of 1604	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	112
PID 716 wrote to memory of 4876	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	113
PID 716 wrote to memory of 4876	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	113
PID 716 wrote to memory of 5088	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	114
PID 716 wrote to memory of 5088	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	114
PID 716 wrote to memory of 4004	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	115
PID 716 wrote to memory of 4004	716	ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe	115

C:\Users\Admin\AppData\Local\Temp\ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe
"C:\Users\Admin\AppData\Local\Temp\ac48d3a8a31682bef58cb17f107772180c54a18458b54165e9d17d89c8115979.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\System\hxxpXaq.exe
  C:\Windows\System\hxxpXaq.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\yRiLKiw.exe
  C:\Windows\System\yRiLKiw.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\oYZoaaf.exe
  C:\Windows\System\oYZoaaf.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\KsfzkQa.exe
  C:\Windows\System\KsfzkQa.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\COEQiEx.exe
  C:\Windows\System\COEQiEx.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\pdUEFcF.exe
  C:\Windows\System\pdUEFcF.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\BtSKiIa.exe
  C:\Windows\System\BtSKiIa.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\IrDXZgv.exe
  C:\Windows\System\IrDXZgv.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\zSgJWmJ.exe
  C:\Windows\System\zSgJWmJ.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\KIQwNDv.exe
  C:\Windows\System\KIQwNDv.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\jftaJdg.exe
  C:\Windows\System\jftaJdg.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\SkRuNKC.exe
  C:\Windows\System\SkRuNKC.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\hTsUtmL.exe
  C:\Windows\System\hTsUtmL.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\wTDNBms.exe
  C:\Windows\System\wTDNBms.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\mppBthR.exe
  C:\Windows\System\mppBthR.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\LopHiLP.exe
  C:\Windows\System\LopHiLP.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\nDzObTZ.exe
  C:\Windows\System\nDzObTZ.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\QHEoqLh.exe
  C:\Windows\System\QHEoqLh.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\KOKDluS.exe
  C:\Windows\System\KOKDluS.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ewtjwPy.exe
  C:\Windows\System\ewtjwPy.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\oFNiaoC.exe
  C:\Windows\System\oFNiaoC.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\KxTsPVQ.exe
  C:\Windows\System\KxTsPVQ.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\vZPnSXk.exe
  C:\Windows\System\vZPnSXk.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\eHMdWvX.exe
  C:\Windows\System\eHMdWvX.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\YXYbQpw.exe
  C:\Windows\System\YXYbQpw.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\mUttlXV.exe
  C:\Windows\System\mUttlXV.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\YbvBXZH.exe
  C:\Windows\System\YbvBXZH.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\OlFPsfn.exe
  C:\Windows\System\OlFPsfn.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\clBjFXL.exe
  C:\Windows\System\clBjFXL.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\tCNpEBX.exe
  C:\Windows\System\tCNpEBX.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\RoZBLKA.exe
  C:\Windows\System\RoZBLKA.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\DGkZRXQ.exe
  C:\Windows\System\DGkZRXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\CGGTcbl.exe
  C:\Windows\System\CGGTcbl.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\UwffNaw.exe
  C:\Windows\System\UwffNaw.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\IdSTleR.exe
  C:\Windows\System\IdSTleR.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\nsvqtol.exe
  C:\Windows\System\nsvqtol.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\XYMkbTT.exe
  C:\Windows\System\XYMkbTT.exe
  2⤵
  - Executes dropped EXE
  PID:492
- C:\Windows\System\KBbWLvI.exe
  C:\Windows\System\KBbWLvI.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\zSFtrQb.exe
  C:\Windows\System\zSFtrQb.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\RDKngyk.exe
  C:\Windows\System\RDKngyk.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\gTohEaV.exe
  C:\Windows\System\gTohEaV.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\caRYnLa.exe
  C:\Windows\System\caRYnLa.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\EEEqblT.exe
  C:\Windows\System\EEEqblT.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\HQujvlv.exe
  C:\Windows\System\HQujvlv.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\mHTxxcS.exe
  C:\Windows\System\mHTxxcS.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\fdnhFOZ.exe
  C:\Windows\System\fdnhFOZ.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\CbdTZZV.exe
  C:\Windows\System\CbdTZZV.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\oDLZFzz.exe
  C:\Windows\System\oDLZFzz.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\eLuTSus.exe
  C:\Windows\System\eLuTSus.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\tQZpQbv.exe
  C:\Windows\System\tQZpQbv.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\NGrnYbb.exe
  C:\Windows\System\NGrnYbb.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\OQzeJVB.exe
  C:\Windows\System\OQzeJVB.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\Isbaawc.exe
  C:\Windows\System\Isbaawc.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\BXoeUtX.exe
  C:\Windows\System\BXoeUtX.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\pMmdElY.exe
  C:\Windows\System\pMmdElY.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ccEhIyz.exe
  C:\Windows\System\ccEhIyz.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\XgrVklj.exe
  C:\Windows\System\XgrVklj.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\bOjTCJW.exe
  C:\Windows\System\bOjTCJW.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\fMlUYRh.exe
  C:\Windows\System\fMlUYRh.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\mRQtJCM.exe
  C:\Windows\System\mRQtJCM.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\TjoQbeF.exe
  C:\Windows\System\TjoQbeF.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\EfFNZAO.exe
  C:\Windows\System\EfFNZAO.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\LYUupcn.exe
  C:\Windows\System\LYUupcn.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\UafckUz.exe
  C:\Windows\System\UafckUz.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\LSkwjcg.exe
  C:\Windows\System\LSkwjcg.exe
  2⤵
  PID:2748
- C:\Windows\System\MjUyWzZ.exe
  C:\Windows\System\MjUyWzZ.exe
  2⤵
  PID:3860
- C:\Windows\System\arjXbAR.exe
  C:\Windows\System\arjXbAR.exe
  2⤵
  PID:4144
- C:\Windows\System\qKGUEHg.exe
  C:\Windows\System\qKGUEHg.exe
  2⤵
  PID:4784
- C:\Windows\System\MZZKAQd.exe
  C:\Windows\System\MZZKAQd.exe
  2⤵
  PID:3104
- C:\Windows\System\kmzEXhD.exe
  C:\Windows\System\kmzEXhD.exe
  2⤵
  PID:3912
- C:\Windows\System\hzsxATY.exe
  C:\Windows\System\hzsxATY.exe
  2⤵
  PID:976
- C:\Windows\System\UcorXlx.exe
  C:\Windows\System\UcorXlx.exe
  2⤵
  PID:5124
- C:\Windows\System\zeOmYXZ.exe
  C:\Windows\System\zeOmYXZ.exe
  2⤵
  PID:5156
- C:\Windows\System\psQjcqA.exe
  C:\Windows\System\psQjcqA.exe
  2⤵
  PID:5180
- C:\Windows\System\gUaUSzb.exe
  C:\Windows\System\gUaUSzb.exe
  2⤵
  PID:5212
- C:\Windows\System\gYRJlmf.exe
  C:\Windows\System\gYRJlmf.exe
  2⤵
  PID:5240
- C:\Windows\System\NfnAiZr.exe
  C:\Windows\System\NfnAiZr.exe
  2⤵
  PID:5264
- C:\Windows\System\XCQKQgD.exe
  C:\Windows\System\XCQKQgD.exe
  2⤵
  PID:5292
- C:\Windows\System\dQEQXUL.exe
  C:\Windows\System\dQEQXUL.exe
  2⤵
  PID:5320
- C:\Windows\System\sQXrOfx.exe
  C:\Windows\System\sQXrOfx.exe
  2⤵
  PID:5352
- C:\Windows\System\QOfdZnN.exe
  C:\Windows\System\QOfdZnN.exe
  2⤵
  PID:5380
- C:\Windows\System\JSEKqPM.exe
  C:\Windows\System\JSEKqPM.exe
  2⤵
  PID:5404
- C:\Windows\System\gnfjLtE.exe
  C:\Windows\System\gnfjLtE.exe
  2⤵
  PID:5436
- C:\Windows\System\VuzHZFn.exe
  C:\Windows\System\VuzHZFn.exe
  2⤵
  PID:5464
- C:\Windows\System\bsaCVGT.exe
  C:\Windows\System\bsaCVGT.exe
  2⤵
  PID:5488
- C:\Windows\System\qArNwCx.exe
  C:\Windows\System\qArNwCx.exe
  2⤵
  PID:5520
- C:\Windows\System\qajbHYt.exe
  C:\Windows\System\qajbHYt.exe
  2⤵
  PID:5544
- C:\Windows\System\sczMzfL.exe
  C:\Windows\System\sczMzfL.exe
  2⤵
  PID:5576
- C:\Windows\System\rqRdFcm.exe
  C:\Windows\System\rqRdFcm.exe
  2⤵
  PID:5604
- C:\Windows\System\dyczgSx.exe
  C:\Windows\System\dyczgSx.exe
  2⤵
  PID:5628
- C:\Windows\System\RSOrIUt.exe
  C:\Windows\System\RSOrIUt.exe
  2⤵
  PID:5656
- C:\Windows\System\HMfsgln.exe
  C:\Windows\System\HMfsgln.exe
  2⤵
  PID:5684
- C:\Windows\System\TiChxKm.exe
  C:\Windows\System\TiChxKm.exe
  2⤵
  PID:5716
- C:\Windows\System\jsUfCJF.exe
  C:\Windows\System\jsUfCJF.exe
  2⤵
  PID:5744
- C:\Windows\System\KNicgeT.exe
  C:\Windows\System\KNicgeT.exe
  2⤵
  PID:5768
- C:\Windows\System\WlnwPKv.exe
  C:\Windows\System\WlnwPKv.exe
  2⤵
  PID:5796
- C:\Windows\System\yWWoCVp.exe
  C:\Windows\System\yWWoCVp.exe
  2⤵
  PID:5824
- C:\Windows\System\RazWSoH.exe
  C:\Windows\System\RazWSoH.exe
  2⤵
  PID:5852
- C:\Windows\System\hIlCuQZ.exe
  C:\Windows\System\hIlCuQZ.exe
  2⤵
  PID:5884
- C:\Windows\System\UZCnEKc.exe
  C:\Windows\System\UZCnEKc.exe
  2⤵
  PID:5908
- C:\Windows\System\dIxYehr.exe
  C:\Windows\System\dIxYehr.exe
  2⤵
  PID:5940
- C:\Windows\System\mVSpwfo.exe
  C:\Windows\System\mVSpwfo.exe
  2⤵
  PID:5964
- C:\Windows\System\rYKtZNR.exe
  C:\Windows\System\rYKtZNR.exe
  2⤵
  PID:5992
- C:\Windows\System\HiViqkF.exe
  C:\Windows\System\HiViqkF.exe
  2⤵
  PID:6020
- C:\Windows\System\oMJvSdk.exe
  C:\Windows\System\oMJvSdk.exe
  2⤵
  PID:6044
- C:\Windows\System\FApgYZv.exe
  C:\Windows\System\FApgYZv.exe
  2⤵
  PID:6084
- C:\Windows\System\yScKKCT.exe
  C:\Windows\System\yScKKCT.exe
  2⤵
  PID:6112
- C:\Windows\System\VVYPTCT.exe
  C:\Windows\System\VVYPTCT.exe
  2⤵
  PID:6136
- C:\Windows\System\FCoAZkR.exe
  C:\Windows\System\FCoAZkR.exe
  2⤵
  PID:1608
- C:\Windows\System\hlivBKQ.exe
  C:\Windows\System\hlivBKQ.exe
  2⤵
  PID:4516
- C:\Windows\System\jEVlBET.exe
  C:\Windows\System\jEVlBET.exe
  2⤵
  PID:3040
- C:\Windows\System\eJRIKeJ.exe
  C:\Windows\System\eJRIKeJ.exe
  2⤵
  PID:3944
- C:\Windows\System\sZLtDxh.exe
  C:\Windows\System\sZLtDxh.exe
  2⤵
  PID:5280
- C:\Windows\System\cyDLcgF.exe
  C:\Windows\System\cyDLcgF.exe
  2⤵
  PID:5312
- C:\Windows\System\WPazuGj.exe
  C:\Windows\System\WPazuGj.exe
  2⤵
  PID:5372
- C:\Windows\System\PNZaQSI.exe
  C:\Windows\System\PNZaQSI.exe
  2⤵
  PID:5452
- C:\Windows\System\ApEQrEx.exe
  C:\Windows\System\ApEQrEx.exe
  2⤵
  PID:5504
- C:\Windows\System\zlYdHeJ.exe
  C:\Windows\System\zlYdHeJ.exe
  2⤵
  PID:5564
- C:\Windows\System\MuQSKjn.exe
  C:\Windows\System\MuQSKjn.exe
  2⤵
  PID:5668
- C:\Windows\System\FIckcTR.exe
  C:\Windows\System\FIckcTR.exe
  2⤵
  PID:5728
- C:\Windows\System\yQeAxRp.exe
  C:\Windows\System\yQeAxRp.exe
  2⤵
  PID:5780
- C:\Windows\System\rtdjbzD.exe
  C:\Windows\System\rtdjbzD.exe
  2⤵
  PID:5840
- C:\Windows\System\RwAIaCM.exe
  C:\Windows\System\RwAIaCM.exe
  2⤵
  PID:5892
- C:\Windows\System\jWMTRdL.exe
  C:\Windows\System\jWMTRdL.exe
  2⤵
  PID:5924
- C:\Windows\System\JTmHieG.exe
  C:\Windows\System\JTmHieG.exe
  2⤵
  PID:5980
- C:\Windows\System\uGecMZL.exe
  C:\Windows\System\uGecMZL.exe
  2⤵
  PID:6036
- C:\Windows\System\iTElEEz.exe
  C:\Windows\System\iTElEEz.exe
  2⤵
  PID:6100
- C:\Windows\System\kjOdvxe.exe
  C:\Windows\System\kjOdvxe.exe
  2⤵
  PID:3668
- C:\Windows\System\ZQYYIGB.exe
  C:\Windows\System\ZQYYIGB.exe
  2⤵
  PID:4012
- C:\Windows\System\LIutXKX.exe
  C:\Windows\System\LIutXKX.exe
  2⤵
  PID:1732
- C:\Windows\System\dJDmfjT.exe
  C:\Windows\System\dJDmfjT.exe
  2⤵
  PID:3864
- C:\Windows\System\wliEKQl.exe
  C:\Windows\System\wliEKQl.exe
  2⤵
  PID:4216
- C:\Windows\System\XjMjNse.exe
  C:\Windows\System\XjMjNse.exe
  2⤵
  PID:2192
- C:\Windows\System\dgSWTNN.exe
  C:\Windows\System\dgSWTNN.exe
  2⤵
  PID:3768
- C:\Windows\System\ENaajlR.exe
  C:\Windows\System\ENaajlR.exe
  2⤵
  PID:1768
- C:\Windows\System\CzQKNTo.exe
  C:\Windows\System\CzQKNTo.exe
  2⤵
  PID:6104
- C:\Windows\System\TDOMOPM.exe
  C:\Windows\System\TDOMOPM.exe
  2⤵
  PID:3424
- C:\Windows\System\jEjhvCt.exe
  C:\Windows\System\jEjhvCt.exe
  2⤵
  PID:4904
- C:\Windows\System\nrxWiDS.exe
  C:\Windows\System\nrxWiDS.exe
  2⤵
  PID:2632
- C:\Windows\System\SeSLWVX.exe
  C:\Windows\System\SeSLWVX.exe
  2⤵
  PID:4844
- C:\Windows\System\fCFHydE.exe
  C:\Windows\System\fCFHydE.exe
  2⤵
  PID:1692
- C:\Windows\System\KKyJBZV.exe
  C:\Windows\System\KKyJBZV.exe
  2⤵
  PID:5068
- C:\Windows\System\sXsBzeX.exe
  C:\Windows\System\sXsBzeX.exe
  2⤵
  PID:2960
- C:\Windows\System\nucAVgP.exe
  C:\Windows\System\nucAVgP.exe
  2⤵
  PID:5304
- C:\Windows\System\InsGANA.exe
  C:\Windows\System\InsGANA.exe
  2⤵
  PID:3460
- C:\Windows\System\GEDQBVk.exe
  C:\Windows\System\GEDQBVk.exe
  2⤵
  PID:5612
- C:\Windows\System\sAffclm.exe
  C:\Windows\System\sAffclm.exe
  2⤵
  PID:3420
- C:\Windows\System\ruaGrZg.exe
  C:\Windows\System\ruaGrZg.exe
  2⤵
  PID:3948
- C:\Windows\System\gSnJgJx.exe
  C:\Windows\System\gSnJgJx.exe
  2⤵
  PID:3124
- C:\Windows\System\yZzDCbE.exe
  C:\Windows\System\yZzDCbE.exe
  2⤵
  PID:5948
- C:\Windows\System\wgTaOgo.exe
  C:\Windows\System\wgTaOgo.exe
  2⤵
  PID:3928
- C:\Windows\System\oYBHghA.exe
  C:\Windows\System\oYBHghA.exe
  2⤵
  PID:5100
- C:\Windows\System\lSfxLWE.exe
  C:\Windows\System\lSfxLWE.exe
  2⤵
  PID:3016
- C:\Windows\System\CLyFaqB.exe
  C:\Windows\System\CLyFaqB.exe
  2⤵
  PID:1136
- C:\Windows\System\vbAZkYU.exe
  C:\Windows\System\vbAZkYU.exe
  2⤵
  PID:4380
- C:\Windows\System\MdmaZuN.exe
  C:\Windows\System\MdmaZuN.exe
  2⤵
  PID:4524
- C:\Windows\System\vSNkoip.exe
  C:\Windows\System\vSNkoip.exe
  2⤵
  PID:1572
- C:\Windows\System\dwUoSgi.exe
  C:\Windows\System\dwUoSgi.exe
  2⤵
  PID:2224
- C:\Windows\System\XKvGlNl.exe
  C:\Windows\System\XKvGlNl.exe
  2⤵
  PID:5416
- C:\Windows\System\KwEDghW.exe
  C:\Windows\System\KwEDghW.exe
  2⤵
  PID:1260
- C:\Windows\System\GTeAKzz.exe
  C:\Windows\System\GTeAKzz.exe
  2⤵
  PID:5696
- C:\Windows\System\vTGlOjn.exe
  C:\Windows\System\vTGlOjn.exe
  2⤵
  PID:3628
- C:\Windows\System\LZWpyfq.exe
  C:\Windows\System\LZWpyfq.exe
  2⤵
  PID:3276
- C:\Windows\System\lPCdlrm.exe
  C:\Windows\System\lPCdlrm.exe
  2⤵
  PID:2416
- C:\Windows\System\ewvEVks.exe
  C:\Windows\System\ewvEVks.exe
  2⤵
  PID:2272
- C:\Windows\System\GtuizXT.exe
  C:\Windows\System\GtuizXT.exe
  2⤵
  PID:1728
- C:\Windows\System\ibavekQ.exe
  C:\Windows\System\ibavekQ.exe
  2⤵
  PID:1844
- C:\Windows\System\rFemYum.exe
  C:\Windows\System\rFemYum.exe
  2⤵
  PID:1252
- C:\Windows\System\gZHideG.exe
  C:\Windows\System\gZHideG.exe
  2⤵
  PID:452
- C:\Windows\System\XRDRwrt.exe
  C:\Windows\System\XRDRwrt.exe
  2⤵
  PID:6008
- C:\Windows\System\tzyKIQW.exe
  C:\Windows\System\tzyKIQW.exe
  2⤵
  PID:4748
- C:\Windows\System\PvLRhvL.exe
  C:\Windows\System\PvLRhvL.exe
  2⤵
  PID:1812
- C:\Windows\System\WFfIBdB.exe
  C:\Windows\System\WFfIBdB.exe
  2⤵
  PID:6152
- C:\Windows\System\cFOrDZZ.exe
  C:\Windows\System\cFOrDZZ.exe
  2⤵
  PID:6176
- C:\Windows\System\EeVZwOl.exe
  C:\Windows\System\EeVZwOl.exe
  2⤵
  PID:6196
- C:\Windows\System\WZtnbZD.exe
  C:\Windows\System\WZtnbZD.exe
  2⤵
  PID:6224
- C:\Windows\System\iMcldbB.exe
  C:\Windows\System\iMcldbB.exe
  2⤵
  PID:6244
- C:\Windows\System\sYzZfjP.exe
  C:\Windows\System\sYzZfjP.exe
  2⤵
  PID:6300
- C:\Windows\System\NDvHzDU.exe
  C:\Windows\System\NDvHzDU.exe
  2⤵
  PID:6328
- C:\Windows\System\fflvKaK.exe
  C:\Windows\System\fflvKaK.exe
  2⤵
  PID:6352
- C:\Windows\System\ykXOMtU.exe
  C:\Windows\System\ykXOMtU.exe
  2⤵
  PID:6384
- C:\Windows\System\wQNykWl.exe
  C:\Windows\System\wQNykWl.exe
  2⤵
  PID:6412
- C:\Windows\System\qIbyVFi.exe
  C:\Windows\System\qIbyVFi.exe
  2⤵
  PID:6440
- C:\Windows\System\UkTTFFZ.exe
  C:\Windows\System\UkTTFFZ.exe
  2⤵
  PID:6468
- C:\Windows\System\BNmFdZm.exe
  C:\Windows\System\BNmFdZm.exe
  2⤵
  PID:6500
- C:\Windows\System\NkyMTCo.exe
  C:\Windows\System\NkyMTCo.exe
  2⤵
  PID:6556
- C:\Windows\System\cDiBEIL.exe
  C:\Windows\System\cDiBEIL.exe
  2⤵
  PID:6580
- C:\Windows\System\jHJnLcl.exe
  C:\Windows\System\jHJnLcl.exe
  2⤵
  PID:6620
- C:\Windows\System\cKrxlmL.exe
  C:\Windows\System\cKrxlmL.exe
  2⤵
  PID:6648
- C:\Windows\System\XCImtGz.exe
  C:\Windows\System\XCImtGz.exe
  2⤵
  PID:6676
- C:\Windows\System\VvReJmn.exe
  C:\Windows\System\VvReJmn.exe
  2⤵
  PID:6708
- C:\Windows\System\dPfCyDS.exe
  C:\Windows\System\dPfCyDS.exe
  2⤵
  PID:6724
- C:\Windows\System\PzNvebh.exe
  C:\Windows\System\PzNvebh.exe
  2⤵
  PID:6740
- C:\Windows\System\YticnWl.exe
  C:\Windows\System\YticnWl.exe
  2⤵
  PID:6764
- C:\Windows\System\DyaybLS.exe
  C:\Windows\System\DyaybLS.exe
  2⤵
  PID:6788
- C:\Windows\System\fNXiiNM.exe
  C:\Windows\System\fNXiiNM.exe
  2⤵
  PID:6812
- C:\Windows\System\oMuNKyL.exe
  C:\Windows\System\oMuNKyL.exe
  2⤵
  PID:6836
- C:\Windows\System\PzCSoQF.exe
  C:\Windows\System\PzCSoQF.exe
  2⤵
  PID:6884
- C:\Windows\System\LpmhhKY.exe
  C:\Windows\System\LpmhhKY.exe
  2⤵
  PID:6904
- C:\Windows\System\tVWyKSz.exe
  C:\Windows\System\tVWyKSz.exe
  2⤵
  PID:6952
- C:\Windows\System\qRmJjmd.exe
  C:\Windows\System\qRmJjmd.exe
  2⤵
  PID:6980
- C:\Windows\System\aipnNvn.exe
  C:\Windows\System\aipnNvn.exe
  2⤵
  PID:7004
- C:\Windows\System\AaXYKLL.exe
  C:\Windows\System\AaXYKLL.exe
  2⤵
  PID:7024
- C:\Windows\System\URPqVsm.exe
  C:\Windows\System\URPqVsm.exe
  2⤵
  PID:7052
- C:\Windows\System\ukFftXu.exe
  C:\Windows\System\ukFftXu.exe
  2⤵
  PID:7084
- C:\Windows\System\kzgSjFK.exe
  C:\Windows\System\kzgSjFK.exe
  2⤵
  PID:7104
- C:\Windows\System\zEMskzZ.exe
  C:\Windows\System\zEMskzZ.exe
  2⤵
  PID:7140
- C:\Windows\System\vcINYmy.exe
  C:\Windows\System\vcINYmy.exe
  2⤵
  PID:3828
- C:\Windows\System\LsOSNPV.exe
  C:\Windows\System\LsOSNPV.exe
  2⤵
  PID:2820
- C:\Windows\System\uqdCcoZ.exe
  C:\Windows\System\uqdCcoZ.exe
  2⤵
  PID:6164
- C:\Windows\System\ZEGUVOd.exe
  C:\Windows\System\ZEGUVOd.exe
  2⤵
  PID:6288
- C:\Windows\System\WvySrsP.exe
  C:\Windows\System\WvySrsP.exe
  2⤵
  PID:6320
- C:\Windows\System\WXldDdo.exe
  C:\Windows\System\WXldDdo.exe
  2⤵
  PID:6392
- C:\Windows\System\ZWcgmDS.exe
  C:\Windows\System\ZWcgmDS.exe
  2⤵
  PID:6428
- C:\Windows\System\mjBXPzq.exe
  C:\Windows\System\mjBXPzq.exe
  2⤵
  PID:6488
- C:\Windows\System\VbJCYbm.exe
  C:\Windows\System\VbJCYbm.exe
  2⤵
  PID:6568
- C:\Windows\System\ActXvbk.exe
  C:\Windows\System\ActXvbk.exe
  2⤵
  PID:6612
- C:\Windows\System\IUOwYDK.exe
  C:\Windows\System\IUOwYDK.exe
  2⤵
  PID:6696
- C:\Windows\System\vYpPQNw.exe
  C:\Windows\System\vYpPQNw.exe
  2⤵
  PID:6716
- C:\Windows\System\lDGLPaa.exe
  C:\Windows\System\lDGLPaa.exe
  2⤵
  PID:6752
- C:\Windows\System\VgTXaiR.exe
  C:\Windows\System\VgTXaiR.exe
  2⤵
  PID:1132
- C:\Windows\System\WEgGQmt.exe
  C:\Windows\System\WEgGQmt.exe
  2⤵
  PID:6912
- C:\Windows\System\oVshxPR.exe
  C:\Windows\System\oVshxPR.exe
  2⤵
  PID:6928
- C:\Windows\System\QKJCdqe.exe
  C:\Windows\System\QKJCdqe.exe
  2⤵
  PID:7020
- C:\Windows\System\xxnWbvs.exe
  C:\Windows\System\xxnWbvs.exe
  2⤵
  PID:7044
- C:\Windows\System\DfngZXU.exe
  C:\Windows\System\DfngZXU.exe
  2⤵
  PID:7132
- C:\Windows\System\bCHJCUv.exe
  C:\Windows\System\bCHJCUv.exe
  2⤵
  PID:6236
- C:\Windows\System\xarGwHH.exe
  C:\Windows\System\xarGwHH.exe
  2⤵
  PID:6344
- C:\Windows\System\bzFggxG.exe
  C:\Windows\System\bzFggxG.exe
  2⤵
  PID:6536
- C:\Windows\System\JLKxDCk.exe
  C:\Windows\System\JLKxDCk.exe
  2⤵
  PID:1064
- C:\Windows\System\EbMbAHP.exe
  C:\Windows\System\EbMbAHP.exe
  2⤵
  PID:6720
- C:\Windows\System\tfeLRew.exe
  C:\Windows\System\tfeLRew.exe
  2⤵
  PID:6644
- C:\Windows\System\TQtknnr.exe
  C:\Windows\System\TQtknnr.exe
  2⤵
  PID:6932
- C:\Windows\System\vZIxIXr.exe
  C:\Windows\System\vZIxIXr.exe
  2⤵
  PID:6080
- C:\Windows\System\DQgaCUv.exe
  C:\Windows\System\DQgaCUv.exe
  2⤵
  PID:6340
- C:\Windows\System\QufWtnA.exe
  C:\Windows\System\QufWtnA.exe
  2⤵
  PID:6512
- C:\Windows\System\QCcAwzl.exe
  C:\Windows\System\QCcAwzl.exe
  2⤵
  PID:6944
- C:\Windows\System\CXjBCut.exe
  C:\Windows\System\CXjBCut.exe
  2⤵
  PID:6876
- C:\Windows\System\gJWonLh.exe
  C:\Windows\System\gJWonLh.exe
  2⤵
  PID:7192
- C:\Windows\System\nlwqkKK.exe
  C:\Windows\System\nlwqkKK.exe
  2⤵
  PID:7220
- C:\Windows\System\ksWAkFo.exe
  C:\Windows\System\ksWAkFo.exe
  2⤵
  PID:7252
- C:\Windows\System\DVSnRqh.exe
  C:\Windows\System\DVSnRqh.exe
  2⤵
  PID:7284
- C:\Windows\System\lvDAYRl.exe
  C:\Windows\System\lvDAYRl.exe
  2⤵
  PID:7316
- C:\Windows\System\raJHQdW.exe
  C:\Windows\System\raJHQdW.exe
  2⤵
  PID:7340
- C:\Windows\System\VbFotEe.exe
  C:\Windows\System\VbFotEe.exe
  2⤵
  PID:7364
- C:\Windows\System\BwiGvmk.exe
  C:\Windows\System\BwiGvmk.exe
  2⤵
  PID:7396
- C:\Windows\System\TIHwPJL.exe
  C:\Windows\System\TIHwPJL.exe
  2⤵
  PID:7420
- C:\Windows\System\suQOFEh.exe
  C:\Windows\System\suQOFEh.exe
  2⤵
  PID:7476
- C:\Windows\System\PbWUtbd.exe
  C:\Windows\System\PbWUtbd.exe
  2⤵
  PID:7496
- C:\Windows\System\MmeIfet.exe
  C:\Windows\System\MmeIfet.exe
  2⤵
  PID:7528
- C:\Windows\System\NhaNGED.exe
  C:\Windows\System\NhaNGED.exe
  2⤵
  PID:7556
- C:\Windows\System\YyrVWeF.exe
  C:\Windows\System\YyrVWeF.exe
  2⤵
  PID:7580
- C:\Windows\System\phKofXK.exe
  C:\Windows\System\phKofXK.exe
  2⤵
  PID:7616
- C:\Windows\System\gzblsdW.exe
  C:\Windows\System\gzblsdW.exe
  2⤵
  PID:7640
- C:\Windows\System\HtzETso.exe
  C:\Windows\System\HtzETso.exe
  2⤵
  PID:7668
- C:\Windows\System\QLuCBKW.exe
  C:\Windows\System\QLuCBKW.exe
  2⤵
  PID:7700
- C:\Windows\System\YDakaDL.exe
  C:\Windows\System\YDakaDL.exe
  2⤵
  PID:7720
- C:\Windows\System\PsdDOjo.exe
  C:\Windows\System\PsdDOjo.exe
  2⤵
  PID:7744
- C:\Windows\System\FakBHkt.exe
  C:\Windows\System\FakBHkt.exe
  2⤵
  PID:7772
- C:\Windows\System\ZDAijBG.exe
  C:\Windows\System\ZDAijBG.exe
  2⤵
  PID:7788
- C:\Windows\System\PhnLTJx.exe
  C:\Windows\System\PhnLTJx.exe
  2⤵
  PID:7812
- C:\Windows\System\UwiIXjQ.exe
  C:\Windows\System\UwiIXjQ.exe
  2⤵
  PID:7856
- C:\Windows\System\eaVjDXK.exe
  C:\Windows\System\eaVjDXK.exe
  2⤵
  PID:7880
- C:\Windows\System\NToLUvw.exe
  C:\Windows\System\NToLUvw.exe
  2⤵
  PID:7908
- C:\Windows\System\xZqYdMN.exe
  C:\Windows\System\xZqYdMN.exe
  2⤵
  PID:7932
- C:\Windows\System\eMRmrGC.exe
  C:\Windows\System\eMRmrGC.exe
  2⤵
  PID:7956
- C:\Windows\System\CQUaGts.exe
  C:\Windows\System\CQUaGts.exe
  2⤵
  PID:8004
- C:\Windows\System\VtBEmZb.exe
  C:\Windows\System\VtBEmZb.exe
  2⤵
  PID:8048
- C:\Windows\System\jpwOxKM.exe
  C:\Windows\System\jpwOxKM.exe
  2⤵
  PID:8064
- C:\Windows\System\pZqFHNh.exe
  C:\Windows\System\pZqFHNh.exe
  2⤵
  PID:8084
- C:\Windows\System\RiZVXYv.exe
  C:\Windows\System\RiZVXYv.exe
  2⤵
  PID:8112
- C:\Windows\System\ZpCWjCF.exe
  C:\Windows\System\ZpCWjCF.exe
  2⤵
  PID:8136
- C:\Windows\System\jHtTfMR.exe
  C:\Windows\System\jHtTfMR.exe
  2⤵
  PID:8172
- C:\Windows\System\DyegOBV.exe
  C:\Windows\System\DyegOBV.exe
  2⤵
  PID:6992
- C:\Windows\System\ZXvIGYh.exe
  C:\Windows\System\ZXvIGYh.exe
  2⤵
  PID:7184
- C:\Windows\System\sEaddrd.exe
  C:\Windows\System\sEaddrd.exe
  2⤵
  PID:7240
- C:\Windows\System\qwzJOqD.exe
  C:\Windows\System\qwzJOqD.exe
  2⤵
  PID:7356
- C:\Windows\System\kteWoKy.exe
  C:\Windows\System\kteWoKy.exe
  2⤵
  PID:7436
- C:\Windows\System\HrqRtRe.exe
  C:\Windows\System\HrqRtRe.exe
  2⤵
  PID:7524
- C:\Windows\System\IVcNAnA.exe
  C:\Windows\System\IVcNAnA.exe
  2⤵
  PID:7548
- C:\Windows\System\KarTIni.exe
  C:\Windows\System\KarTIni.exe
  2⤵
  PID:7604
- C:\Windows\System\QTZeCKc.exe
  C:\Windows\System\QTZeCKc.exe
  2⤵
  PID:7660
- C:\Windows\System\poomXzM.exe
  C:\Windows\System\poomXzM.exe
  2⤵
  PID:7732
- C:\Windows\System\VqabHCm.exe
  C:\Windows\System\VqabHCm.exe
  2⤵
  PID:7780
- C:\Windows\System\UmvlMcy.exe
  C:\Windows\System\UmvlMcy.exe
  2⤵
  PID:7836
- C:\Windows\System\KtVvwfr.exe
  C:\Windows\System\KtVvwfr.exe
  2⤵
  PID:7900
- C:\Windows\System\IRnHyMg.exe
  C:\Windows\System\IRnHyMg.exe
  2⤵
  PID:8036
- C:\Windows\System\MnHsyfX.exe
  C:\Windows\System\MnHsyfX.exe
  2⤵
  PID:8076
- C:\Windows\System\hktSOXk.exe
  C:\Windows\System\hktSOXk.exe
  2⤵
  PID:8124
- C:\Windows\System\hibYxdx.exe
  C:\Windows\System\hibYxdx.exe
  2⤵
  PID:6824
- C:\Windows\System\xiuAOBN.exe
  C:\Windows\System\xiuAOBN.exe
  2⤵
  PID:7208
- C:\Windows\System\xyVawrm.exe
  C:\Windows\System\xyVawrm.exe
  2⤵
  PID:7520
- C:\Windows\System\HRZIail.exe
  C:\Windows\System\HRZIail.exe
  2⤵
  PID:7564
- C:\Windows\System\YqPbRrw.exe
  C:\Windows\System\YqPbRrw.exe
  2⤵
  PID:7716
- C:\Windows\System\vhWhzJU.exe
  C:\Windows\System\vhWhzJU.exe
  2⤵
  PID:7800
- C:\Windows\System\dYQHSbi.exe
  C:\Windows\System\dYQHSbi.exe
  2⤵
  PID:7976
- C:\Windows\System\qsocqru.exe
  C:\Windows\System\qsocqru.exe
  2⤵
  PID:6532
- C:\Windows\System\MIQSwMG.exe
  C:\Windows\System\MIQSwMG.exe
  2⤵
  PID:7332
- C:\Windows\System\ibsXbgY.exe
  C:\Windows\System\ibsXbgY.exe
  2⤵
  PID:7916
- C:\Windows\System\dPbwLut.exe
  C:\Windows\System\dPbwLut.exe
  2⤵
  PID:8060
- C:\Windows\System\MPcXvWN.exe
  C:\Windows\System\MPcXvWN.exe
  2⤵
  PID:8128
- C:\Windows\System\fmsZjTL.exe
  C:\Windows\System\fmsZjTL.exe
  2⤵
  PID:8224
- C:\Windows\System\MZfItrA.exe
  C:\Windows\System\MZfItrA.exe
  2⤵
  PID:8256
- C:\Windows\System\mXyFRka.exe
  C:\Windows\System\mXyFRka.exe
  2⤵
  PID:8288
- C:\Windows\System\llBMWpx.exe
  C:\Windows\System\llBMWpx.exe
  2⤵
  PID:8308
- C:\Windows\System\zRYKczh.exe
  C:\Windows\System\zRYKczh.exe
  2⤵
  PID:8332
- C:\Windows\System\HFSZUgv.exe
  C:\Windows\System\HFSZUgv.exe
  2⤵
  PID:8372
- C:\Windows\System\zGZMRbd.exe
  C:\Windows\System\zGZMRbd.exe
  2⤵
  PID:8400
- C:\Windows\System\SlOmRjW.exe
  C:\Windows\System\SlOmRjW.exe
  2⤵
  PID:8416
- C:\Windows\System\GNsMfUy.exe
  C:\Windows\System\GNsMfUy.exe
  2⤵
  PID:8448
- C:\Windows\System\ZVrAiJX.exe
  C:\Windows\System\ZVrAiJX.exe
  2⤵
  PID:8484
- C:\Windows\System\yMwmJJh.exe
  C:\Windows\System\yMwmJJh.exe
  2⤵
  PID:8520
- C:\Windows\System\kaPJQxb.exe
  C:\Windows\System\kaPJQxb.exe
  2⤵
  PID:8536
- C:\Windows\System\hTUZODj.exe
  C:\Windows\System\hTUZODj.exe
  2⤵
  PID:8564
- C:\Windows\System\LDMZPlX.exe
  C:\Windows\System\LDMZPlX.exe
  2⤵
  PID:8580
- C:\Windows\System\UdSRjmw.exe
  C:\Windows\System\UdSRjmw.exe
  2⤵
  PID:8600
- C:\Windows\System\zuIvlWJ.exe
  C:\Windows\System\zuIvlWJ.exe
  2⤵
  PID:8632
- C:\Windows\System\FJGTIMn.exe
  C:\Windows\System\FJGTIMn.exe
  2⤵
  PID:8664
- C:\Windows\System\lXqxHIF.exe
  C:\Windows\System\lXqxHIF.exe
  2⤵
  PID:8684
- C:\Windows\System\ARksQur.exe
  C:\Windows\System\ARksQur.exe
  2⤵
  PID:8712
- C:\Windows\System\RNkzMCI.exe
  C:\Windows\System\RNkzMCI.exe
  2⤵
  PID:8736
- C:\Windows\System\DPGrllb.exe
  C:\Windows\System\DPGrllb.exe
  2⤵
  PID:8756
- C:\Windows\System\aBIBfme.exe
  C:\Windows\System\aBIBfme.exe
  2⤵
  PID:8788
- C:\Windows\System\SZKUicn.exe
  C:\Windows\System\SZKUicn.exe
  2⤵
  PID:8820
- C:\Windows\System\TNzdfNE.exe
  C:\Windows\System\TNzdfNE.exe
  2⤵
  PID:8848
- C:\Windows\System\MFfcIAB.exe
  C:\Windows\System\MFfcIAB.exe
  2⤵
  PID:8912
- C:\Windows\System\cEyOESm.exe
  C:\Windows\System\cEyOESm.exe
  2⤵
  PID:8944
- C:\Windows\System\EvrjAAw.exe
  C:\Windows\System\EvrjAAw.exe
  2⤵
  PID:8960
- C:\Windows\System\MlPVZyM.exe
  C:\Windows\System\MlPVZyM.exe
  2⤵
  PID:8976
- C:\Windows\System\JxcNEdF.exe
  C:\Windows\System\JxcNEdF.exe
  2⤵
  PID:9004
- C:\Windows\System\KdzlZEZ.exe
  C:\Windows\System\KdzlZEZ.exe
  2⤵
  PID:9032
- C:\Windows\System\mJckAav.exe
  C:\Windows\System\mJckAav.exe
  2⤵
  PID:9060
- C:\Windows\System\ypWyHNk.exe
  C:\Windows\System\ypWyHNk.exe
  2⤵
  PID:9096
- C:\Windows\System\LxKaxPv.exe
  C:\Windows\System\LxKaxPv.exe
  2⤵
  PID:9120
- C:\Windows\System\rhXIXjX.exe
  C:\Windows\System\rhXIXjX.exe
  2⤵
  PID:9144
- C:\Windows\System\VSLrKiV.exe
  C:\Windows\System\VSLrKiV.exe
  2⤵
  PID:9172
- C:\Windows\System\CjwGQAc.exe
  C:\Windows\System\CjwGQAc.exe
  2⤵
  PID:9188
- C:\Windows\System\KpJXYGz.exe
  C:\Windows\System\KpJXYGz.exe
  2⤵
  PID:9208
- C:\Windows\System\FxfFuft.exe
  C:\Windows\System\FxfFuft.exe
  2⤵
  PID:8200
- C:\Windows\System\lHXJIhF.exe
  C:\Windows\System\lHXJIhF.exe
  2⤵
  PID:8268
- C:\Windows\System\oPLBEUf.exe
  C:\Windows\System\oPLBEUf.exe
  2⤵
  PID:8384
- C:\Windows\System\fhQfnwp.exe
  C:\Windows\System\fhQfnwp.exe
  2⤵
  PID:8508
- C:\Windows\System\YkpuVah.exe
  C:\Windows\System\YkpuVah.exe
  2⤵
  PID:8592
- C:\Windows\System\lflMAkT.exe
  C:\Windows\System\lflMAkT.exe
  2⤵
  PID:8648
- C:\Windows\System\fWLCzur.exe
  C:\Windows\System\fWLCzur.exe
  2⤵
  PID:8704
- C:\Windows\System\KCPdrSe.exe
  C:\Windows\System\KCPdrSe.exe
  2⤵
  PID:8772
- C:\Windows\System\omSAKiM.exe
  C:\Windows\System\omSAKiM.exe
  2⤵
  PID:8844
- C:\Windows\System\FfzAJcx.exe
  C:\Windows\System\FfzAJcx.exe
  2⤵
  PID:8880
- C:\Windows\System\RDLAaAT.exe
  C:\Windows\System\RDLAaAT.exe
  2⤵
  PID:8956
- C:\Windows\System\DwruZbH.exe
  C:\Windows\System\DwruZbH.exe
  2⤵
  PID:9024
- C:\Windows\System\AjdXBMe.exe
  C:\Windows\System\AjdXBMe.exe
  2⤵
  PID:9048
- C:\Windows\System\ZDNciCQ.exe
  C:\Windows\System\ZDNciCQ.exe
  2⤵
  PID:9116
- C:\Windows\System\bgTHPiy.exe
  C:\Windows\System\bgTHPiy.exe
  2⤵
  PID:8296
- C:\Windows\System\UUmbEbn.exe
  C:\Windows\System\UUmbEbn.exe
  2⤵
  PID:8252
- C:\Windows\System\gFrolwf.exe
  C:\Windows\System\gFrolwf.exe
  2⤵
  PID:8576
- C:\Windows\System\dffLhtA.exe
  C:\Windows\System\dffLhtA.exe
  2⤵
  PID:8620
- C:\Windows\System\gXEwIpk.exe
  C:\Windows\System\gXEwIpk.exe
  2⤵
  PID:8700
- C:\Windows\System\KiwmAEq.exe
  C:\Windows\System\KiwmAEq.exe
  2⤵
  PID:8972
- C:\Windows\System\VnFmhuw.exe
  C:\Windows\System\VnFmhuw.exe
  2⤵
  PID:8968
- C:\Windows\System\qENHKNB.exe
  C:\Windows\System\qENHKNB.exe
  2⤵
  PID:7632
- C:\Windows\System\gNkqihU.exe
  C:\Windows\System\gNkqihU.exe
  2⤵
  PID:8476
- C:\Windows\System\zPmbLGu.exe
  C:\Windows\System\zPmbLGu.exe
  2⤵
  PID:8804
- C:\Windows\System\muvPwqG.exe
  C:\Windows\System\muvPwqG.exe
  2⤵
  PID:9076
- C:\Windows\System\SAMJugA.exe
  C:\Windows\System\SAMJugA.exe
  2⤵
  PID:8732
- C:\Windows\System\lnLHGvv.exe
  C:\Windows\System\lnLHGvv.exe
  2⤵
  PID:9236
- C:\Windows\System\sOVwRgw.exe
  C:\Windows\System\sOVwRgw.exe
  2⤵
  PID:9280
- C:\Windows\System\IPpSsuB.exe
  C:\Windows\System\IPpSsuB.exe
  2⤵
  PID:9300
- C:\Windows\System\PNSkZfH.exe
  C:\Windows\System\PNSkZfH.exe
  2⤵
  PID:9336
- C:\Windows\System\BwwmppV.exe
  C:\Windows\System\BwwmppV.exe
  2⤵
  PID:9356
- C:\Windows\System\kgocJFx.exe
  C:\Windows\System\kgocJFx.exe
  2⤵
  PID:9392
- C:\Windows\System\LDfFJHm.exe
  C:\Windows\System\LDfFJHm.exe
  2⤵
  PID:9420
- C:\Windows\System\OrPMLUb.exe
  C:\Windows\System\OrPMLUb.exe
  2⤵
  PID:9448
- C:\Windows\System\MCSMtoe.exe
  C:\Windows\System\MCSMtoe.exe
  2⤵
  PID:9468
- C:\Windows\System\TonERay.exe
  C:\Windows\System\TonERay.exe
  2⤵
  PID:9492
- C:\Windows\System\RWMaeoN.exe
  C:\Windows\System\RWMaeoN.exe
  2⤵
  PID:9520
- C:\Windows\System\yRnBUOu.exe
  C:\Windows\System\yRnBUOu.exe
  2⤵
  PID:9540
- C:\Windows\System\WyNdApf.exe
  C:\Windows\System\WyNdApf.exe
  2⤵
  PID:9564
- C:\Windows\System\fLVylZS.exe
  C:\Windows\System\fLVylZS.exe
  2⤵
  PID:9588
- C:\Windows\System\XLWGUvM.exe
  C:\Windows\System\XLWGUvM.exe
  2⤵
  PID:9608
- C:\Windows\System\LytXtSK.exe
  C:\Windows\System\LytXtSK.exe
  2⤵
  PID:9628
- C:\Windows\System\TPginec.exe
  C:\Windows\System\TPginec.exe
  2⤵
  PID:9672
- C:\Windows\System\VAyviej.exe
  C:\Windows\System\VAyviej.exe
  2⤵
  PID:9704
- C:\Windows\System\TLJUwgA.exe
  C:\Windows\System\TLJUwgA.exe
  2⤵
  PID:9732
- C:\Windows\System\aDxJuXR.exe
  C:\Windows\System\aDxJuXR.exe
  2⤵
  PID:9752
- C:\Windows\System\CUKEnZQ.exe
  C:\Windows\System\CUKEnZQ.exe
  2⤵
  PID:9772
- C:\Windows\System\pdeqUQP.exe
  C:\Windows\System\pdeqUQP.exe
  2⤵
  PID:9808
- C:\Windows\System\EYfZeBm.exe
  C:\Windows\System\EYfZeBm.exe
  2⤵
  PID:9840
- C:\Windows\System\cxYFuOq.exe
  C:\Windows\System\cxYFuOq.exe
  2⤵
  PID:9864
- C:\Windows\System\JLxInmb.exe
  C:\Windows\System\JLxInmb.exe
  2⤵
  PID:9888
- C:\Windows\System\VMRnigh.exe
  C:\Windows\System\VMRnigh.exe
  2⤵
  PID:9948
- C:\Windows\System\qDbUmIN.exe
  C:\Windows\System\qDbUmIN.exe
  2⤵
  PID:9972
- C:\Windows\System\YXmPony.exe
  C:\Windows\System\YXmPony.exe
  2⤵
  PID:10008
- C:\Windows\System\SzxgqSl.exe
  C:\Windows\System\SzxgqSl.exe
  2⤵
  PID:10028
- C:\Windows\System\cZigNWt.exe
  C:\Windows\System\cZigNWt.exe
  2⤵
  PID:10048
- C:\Windows\System\PpZrAYn.exe
  C:\Windows\System\PpZrAYn.exe
  2⤵
  PID:10072
- C:\Windows\System\aAXVUCd.exe
  C:\Windows\System\aAXVUCd.exe
  2⤵
  PID:10104
- C:\Windows\System\CJyyqOz.exe
  C:\Windows\System\CJyyqOz.exe
  2⤵
  PID:10124
- C:\Windows\System\QliWYpw.exe
  C:\Windows\System\QliWYpw.exe
  2⤵
  PID:10144
- C:\Windows\System\cNBaxqB.exe
  C:\Windows\System\cNBaxqB.exe
  2⤵
  PID:10172
- C:\Windows\System\XFuIQsa.exe
  C:\Windows\System\XFuIQsa.exe
  2⤵
  PID:10196
- C:\Windows\System\UcLYZzh.exe
  C:\Windows\System\UcLYZzh.exe
  2⤵
  PID:10228
- C:\Windows\System\mUuaGYt.exe
  C:\Windows\System\mUuaGYt.exe
  2⤵
  PID:9260
- C:\Windows\System\AraimMS.exe
  C:\Windows\System\AraimMS.exe
  2⤵
  PID:9324
- C:\Windows\System\KnAwZug.exe
  C:\Windows\System\KnAwZug.exe
  2⤵
  PID:9408
- C:\Windows\System\DuCGqcr.exe
  C:\Windows\System\DuCGqcr.exe
  2⤵
  PID:9488
- C:\Windows\System\tSbuPeC.exe
  C:\Windows\System\tSbuPeC.exe
  2⤵
  PID:9532
- C:\Windows\System\BTItWSP.exe
  C:\Windows\System\BTItWSP.exe
  2⤵
  PID:9596
- C:\Windows\System\bPVIziL.exe
  C:\Windows\System\bPVIziL.exe
  2⤵
  PID:9656
- C:\Windows\System\UHrPQkD.exe
  C:\Windows\System\UHrPQkD.exe
  2⤵
  PID:9688
- C:\Windows\System\tobgMLF.exe
  C:\Windows\System\tobgMLF.exe
  2⤵
  PID:9764
- C:\Windows\System\BgTDtWu.exe
  C:\Windows\System\BgTDtWu.exe
  2⤵
  PID:9828
- C:\Windows\System\UYwvURG.exe
  C:\Windows\System\UYwvURG.exe
  2⤵
  PID:9920
- C:\Windows\System\McUXIAp.exe
  C:\Windows\System\McUXIAp.exe
  2⤵
  PID:9956
- C:\Windows\System\nslvrbu.exe
  C:\Windows\System\nslvrbu.exe
  2⤵
  PID:10024
- C:\Windows\System\rpVJRge.exe
  C:\Windows\System\rpVJRge.exe
  2⤵
  PID:10132
- C:\Windows\System\ouNvOuu.exe
  C:\Windows\System\ouNvOuu.exe
  2⤵
  PID:10220
- C:\Windows\System\WFyAdgn.exe
  C:\Windows\System\WFyAdgn.exe
  2⤵
  PID:10192
- C:\Windows\System\sCzLavN.exe
  C:\Windows\System\sCzLavN.exe
  2⤵
  PID:9228
- C:\Windows\System\pPoEwkz.exe
  C:\Windows\System\pPoEwkz.exe
  2⤵
  PID:9504
- C:\Windows\System\cpBCFzt.exe
  C:\Windows\System\cpBCFzt.exe
  2⤵
  PID:9796
- C:\Windows\System\fPpkyYn.exe
  C:\Windows\System\fPpkyYn.exe
  2⤵
  PID:9740
- C:\Windows\System\oXGjpAw.exe
  C:\Windows\System\oXGjpAw.exe
  2⤵
  PID:9928
- C:\Windows\System\ujkQbGW.exe
  C:\Windows\System\ujkQbGW.exe
  2⤵
  PID:9272
- C:\Windows\System\JfxIeVR.exe
  C:\Windows\System\JfxIeVR.exe
  2⤵
  PID:10216
- C:\Windows\System\abouArs.exe
  C:\Windows\System\abouArs.exe
  2⤵
  PID:9600
- C:\Windows\System\wsjgipG.exe
  C:\Windows\System\wsjgipG.exe
  2⤵
  PID:9352
- C:\Windows\System\JckQZwN.exe
  C:\Windows\System\JckQZwN.exe
  2⤵
  PID:9760
- C:\Windows\System\SHNETqW.exe
  C:\Windows\System\SHNETqW.exe
  2⤵
  PID:10256
- C:\Windows\System\BaNbIcN.exe
  C:\Windows\System\BaNbIcN.exe
  2⤵
  PID:10272
- C:\Windows\System\NzEEVPY.exe
  C:\Windows\System\NzEEVPY.exe
  2⤵
  PID:10300
- C:\Windows\System\PqsndwN.exe
  C:\Windows\System\PqsndwN.exe
  2⤵
  PID:10324
- C:\Windows\System\pORbBPo.exe
  C:\Windows\System\pORbBPo.exe
  2⤵
  PID:10368
- C:\Windows\System\STEvZLI.exe
  C:\Windows\System\STEvZLI.exe
  2⤵
  PID:10388
- C:\Windows\System\vuXLvAl.exe
  C:\Windows\System\vuXLvAl.exe
  2⤵
  PID:10412
- C:\Windows\System\McDmcFF.exe
  C:\Windows\System\McDmcFF.exe
  2⤵
  PID:10428
- C:\Windows\System\pagmbtL.exe
  C:\Windows\System\pagmbtL.exe
  2⤵
  PID:10444
- C:\Windows\System\sagKluz.exe
  C:\Windows\System\sagKluz.exe
  2⤵
  PID:10480
- C:\Windows\System\PLSyhnF.exe
  C:\Windows\System\PLSyhnF.exe
  2⤵
  PID:10508
- C:\Windows\System\SllqhFS.exe
  C:\Windows\System\SllqhFS.exe
  2⤵
  PID:10556
- C:\Windows\System\vJEYHMg.exe
  C:\Windows\System\vJEYHMg.exe
  2⤵
  PID:10584
- C:\Windows\System\XIjbxVr.exe
  C:\Windows\System\XIjbxVr.exe
  2⤵
  PID:10608
- C:\Windows\System\jXBjcVl.exe
  C:\Windows\System\jXBjcVl.exe
  2⤵
  PID:10628
- C:\Windows\System\NyeTwKy.exe
  C:\Windows\System\NyeTwKy.exe
  2⤵
  PID:10652
- C:\Windows\System\GIIYhRT.exe
  C:\Windows\System\GIIYhRT.exe
  2⤵
  PID:10692
- C:\Windows\System\ZDblseU.exe
  C:\Windows\System\ZDblseU.exe
  2⤵
  PID:10708
- C:\Windows\System\oQDFZfi.exe
  C:\Windows\System\oQDFZfi.exe
  2⤵
  PID:10732
- C:\Windows\System\oklRvDJ.exe
  C:\Windows\System\oklRvDJ.exe
  2⤵
  PID:10752
- C:\Windows\System\KPUyXGb.exe
  C:\Windows\System\KPUyXGb.exe
  2⤵
  PID:10804
- C:\Windows\System\WsVzgai.exe
  C:\Windows\System\WsVzgai.exe
  2⤵
  PID:10832
- C:\Windows\System\teJKqQc.exe
  C:\Windows\System\teJKqQc.exe
  2⤵
  PID:10856
- C:\Windows\System\HGNVExk.exe
  C:\Windows\System\HGNVExk.exe
  2⤵
  PID:10876
- C:\Windows\System\caHnEHI.exe
  C:\Windows\System\caHnEHI.exe
  2⤵
  PID:10908
- C:\Windows\System\BhFyeML.exe
  C:\Windows\System\BhFyeML.exe
  2⤵
  PID:10956
- C:\Windows\System\FonLyAP.exe
  C:\Windows\System\FonLyAP.exe
  2⤵
  PID:10976
- C:\Windows\System\PLYfZmr.exe
  C:\Windows\System\PLYfZmr.exe
  2⤵
  PID:11012
- C:\Windows\System\tenccHA.exe
  C:\Windows\System\tenccHA.exe
  2⤵
  PID:11032
- C:\Windows\System\URYFRWl.exe
  C:\Windows\System\URYFRWl.exe
  2⤵
  PID:11056
- C:\Windows\System\awCfabV.exe
  C:\Windows\System\awCfabV.exe
  2⤵
  PID:11080
- C:\Windows\System\aFiGeeG.exe
  C:\Windows\System\aFiGeeG.exe
  2⤵
  PID:11128
- C:\Windows\System\GHThyEa.exe
  C:\Windows\System\GHThyEa.exe
  2⤵
  PID:11156
- C:\Windows\System\kDkCccX.exe
  C:\Windows\System\kDkCccX.exe
  2⤵
  PID:11172
- C:\Windows\System\YrjbFuj.exe
  C:\Windows\System\YrjbFuj.exe
  2⤵
  PID:11192
- C:\Windows\System\VugRQYP.exe
  C:\Windows\System\VugRQYP.exe
  2⤵
  PID:11220
- C:\Windows\System\ywAVpOz.exe
  C:\Windows\System\ywAVpOz.exe
  2⤵
  PID:11260
- C:\Windows\System\KikItxl.exe
  C:\Windows\System\KikItxl.exe
  2⤵
  PID:10264
- C:\Windows\System\oCyEYkE.exe
  C:\Windows\System\oCyEYkE.exe
  2⤵
  PID:10288
- C:\Windows\System\Qbvvelc.exe
  C:\Windows\System\Qbvvelc.exe
  2⤵
  PID:10420
- C:\Windows\System\bgHhoCx.exe
  C:\Windows\System\bgHhoCx.exe
  2⤵
  PID:10440
- C:\Windows\System\QDPODcJ.exe
  C:\Windows\System\QDPODcJ.exe
  2⤵
  PID:10600
- C:\Windows\System\LwfzuuP.exe
  C:\Windows\System\LwfzuuP.exe
  2⤵
  PID:10636
- C:\Windows\System\xCoWJBn.exe
  C:\Windows\System\xCoWJBn.exe
  2⤵
  PID:10704
- C:\Windows\System\DzIPRtH.exe
  C:\Windows\System\DzIPRtH.exe
  2⤵
  PID:10780
- C:\Windows\System\Fhfdmhi.exe
  C:\Windows\System\Fhfdmhi.exe
  2⤵
  PID:10820
- C:\Windows\System\ChmzdsJ.exe
  C:\Windows\System\ChmzdsJ.exe
  2⤵
  PID:10868
- C:\Windows\System\XZulDMY.exe
  C:\Windows\System\XZulDMY.exe
  2⤵
  PID:10936
- C:\Windows\System\rvaltKB.exe
  C:\Windows\System\rvaltKB.exe
  2⤵
  PID:11000
- C:\Windows\System\QjteZxr.exe
  C:\Windows\System\QjteZxr.exe
  2⤵
  PID:11068
- C:\Windows\System\WdIakJU.exe
  C:\Windows\System\WdIakJU.exe
  2⤵
  PID:11112
- C:\Windows\System\uAFxHqJ.exe
  C:\Windows\System\uAFxHqJ.exe
  2⤵
  PID:11208
- C:\Windows\System\oUIyWjU.exe
  C:\Windows\System\oUIyWjU.exe
  2⤵
  PID:11244
- C:\Windows\System\gjBitNy.exe
  C:\Windows\System\gjBitNy.exe
  2⤵
  PID:10252
- C:\Windows\System\bSHnNAw.exe
  C:\Windows\System\bSHnNAw.exe
  2⤵
  PID:10424
- C:\Windows\System\XEiQrJq.exe
  C:\Windows\System\XEiQrJq.exe
  2⤵
  PID:10468
- C:\Windows\System\CghUibk.exe
  C:\Windows\System\CghUibk.exe
  2⤵
  PID:10596
- C:\Windows\System\LLxNXhP.exe
  C:\Windows\System\LLxNXhP.exe
  2⤵
  PID:10724
- C:\Windows\System\WxBbMYA.exe
  C:\Windows\System\WxBbMYA.exe
  2⤵
  PID:10872
- C:\Windows\System\cEEhYNj.exe
  C:\Windows\System\cEEhYNj.exe
  2⤵
  PID:11152
- C:\Windows\System\BingqBt.exe
  C:\Windows\System\BingqBt.exe
  2⤵
  PID:11216
- C:\Windows\System\EKpoMFH.exe
  C:\Windows\System\EKpoMFH.exe
  2⤵
  PID:10592
- C:\Windows\System\OlLtgpr.exe
  C:\Windows\System\OlLtgpr.exe
  2⤵
  PID:10824
- C:\Windows\System\lQQVhks.exe
  C:\Windows\System\lQQVhks.exe
  2⤵
  PID:10284
- C:\Windows\System\izfppeO.exe
  C:\Windows\System\izfppeO.exe
  2⤵
  PID:11276
- C:\Windows\System\FABwivz.exe
  C:\Windows\System\FABwivz.exe
  2⤵
  PID:11292
- C:\Windows\System\GxnPHlT.exe
  C:\Windows\System\GxnPHlT.exe
  2⤵
  PID:11368
- C:\Windows\System\OlzyPpP.exe
  C:\Windows\System\OlzyPpP.exe
  2⤵
  PID:11396
- C:\Windows\System\pmKKYFB.exe
  C:\Windows\System\pmKKYFB.exe
  2⤵
  PID:11416
- C:\Windows\System\eQduEpR.exe
  C:\Windows\System\eQduEpR.exe
  2⤵
  PID:11452
- C:\Windows\System\UrpOMUa.exe
  C:\Windows\System\UrpOMUa.exe
  2⤵
  PID:11476
- C:\Windows\System\fApToXh.exe
  C:\Windows\System\fApToXh.exe
  2⤵
  PID:11500
- C:\Windows\System\kinuAIu.exe
  C:\Windows\System\kinuAIu.exe
  2⤵
  PID:11536
- C:\Windows\System\ylgNshg.exe
  C:\Windows\System\ylgNshg.exe
  2⤵
  PID:11552
- C:\Windows\System\mceOmrj.exe
  C:\Windows\System\mceOmrj.exe
  2⤵
  PID:11568
- C:\Windows\System\eeosAaS.exe
  C:\Windows\System\eeosAaS.exe
  2⤵
  PID:11592
- C:\Windows\System\xMEwOUz.exe
  C:\Windows\System\xMEwOUz.exe
  2⤵
  PID:11624
- C:\Windows\System\kaGGEco.exe
  C:\Windows\System\kaGGEco.exe
  2⤵
  PID:11652
- C:\Windows\System\tdvseNp.exe
  C:\Windows\System\tdvseNp.exe
  2⤵
  PID:11680
- C:\Windows\System\IJMLNSQ.exe
  C:\Windows\System\IJMLNSQ.exe
  2⤵
  PID:11696
- C:\Windows\System\RTRWrsB.exe
  C:\Windows\System\RTRWrsB.exe
  2⤵
  PID:11748
- C:\Windows\System\QBtEZwt.exe
  C:\Windows\System\QBtEZwt.exe
  2⤵
  PID:11776
- C:\Windows\System\gWwFDbb.exe
  C:\Windows\System\gWwFDbb.exe
  2⤵
  PID:11804
- C:\Windows\System\BShYwJp.exe
  C:\Windows\System\BShYwJp.exe
  2⤵
  PID:11824
- C:\Windows\System\THXrltG.exe
  C:\Windows\System\THXrltG.exe
  2⤵
  PID:11844
- C:\Windows\System\GIJsPrb.exe
  C:\Windows\System\GIJsPrb.exe
  2⤵
  PID:11868
- C:\Windows\System\qiOeQqV.exe
  C:\Windows\System\qiOeQqV.exe
  2⤵
  PID:11900
- C:\Windows\System\UaRxTzm.exe
  C:\Windows\System\UaRxTzm.exe
  2⤵
  PID:11920
- C:\Windows\System\ZEXQYnV.exe
  C:\Windows\System\ZEXQYnV.exe
  2⤵
  PID:11952
- C:\Windows\System\aixcBrI.exe
  C:\Windows\System\aixcBrI.exe
  2⤵
  PID:11996
- C:\Windows\System\MIuysTw.exe
  C:\Windows\System\MIuysTw.exe
  2⤵
  PID:12020
- C:\Windows\System\UlrZHvH.exe
  C:\Windows\System\UlrZHvH.exe
  2⤵
  PID:12068
- C:\Windows\System\EsCJwwu.exe
  C:\Windows\System\EsCJwwu.exe
  2⤵
  PID:12264
- C:\Windows\System\iNTYmIL.exe
  C:\Windows\System\iNTYmIL.exe
  2⤵
  PID:11272
- C:\Windows\System\BOZGeyb.exe
  C:\Windows\System\BOZGeyb.exe
  2⤵
  PID:11308
- C:\Windows\System\vvVpgoR.exe
  C:\Windows\System\vvVpgoR.exe
  2⤵
  PID:11384
- C:\Windows\System\aPjIZiC.exe
  C:\Windows\System\aPjIZiC.exe
  2⤵
  PID:11508
- C:\Windows\System\IFqLeso.exe
  C:\Windows\System\IFqLeso.exe
  2⤵
  PID:11520
- C:\Windows\System\plAvDBo.exe
  C:\Windows\System\plAvDBo.exe
  2⤵
  PID:11620
- C:\Windows\System\CUAPKkz.exe
  C:\Windows\System\CUAPKkz.exe
  2⤵
  PID:11668
- C:\Windows\System\yVdreuF.exe
  C:\Windows\System\yVdreuF.exe
  2⤵
  PID:11740
- C:\Windows\System\sxsCaqX.exe
  C:\Windows\System\sxsCaqX.exe
  2⤵
  PID:11792
- C:\Windows\System\XHZzYxI.exe
  C:\Windows\System\XHZzYxI.exe
  2⤵
  PID:11860
- C:\Windows\System\ZvPUVUK.exe
  C:\Windows\System\ZvPUVUK.exe
  2⤵
  PID:11916
- C:\Windows\System\vOZsQlC.exe
  C:\Windows\System\vOZsQlC.exe
  2⤵
  PID:11972
- C:\Windows\System\vAjKoKS.exe
  C:\Windows\System\vAjKoKS.exe
  2⤵
  PID:12100
- C:\Windows\System\QfjGiyd.exe
  C:\Windows\System\QfjGiyd.exe
  2⤵
  PID:12064
- C:\Windows\System\dfUWeIC.exe
  C:\Windows\System\dfUWeIC.exe
  2⤵
  PID:12124
- C:\Windows\System\NmdbEJs.exe
  C:\Windows\System\NmdbEJs.exe
  2⤵
  PID:12168
- C:\Windows\System\KYIOGKT.exe
  C:\Windows\System\KYIOGKT.exe
  2⤵
  PID:12128
- C:\Windows\System\RhPSJod.exe
  C:\Windows\System\RhPSJod.exe
  2⤵
  PID:12004
- C:\Windows\System\LagIxje.exe
  C:\Windows\System\LagIxje.exe
  2⤵
  PID:12204
- C:\Windows\System\qiBQUOf.exe
  C:\Windows\System\qiBQUOf.exe
  2⤵
  PID:11332
- C:\Windows\System\ayMONca.exe
  C:\Windows\System\ayMONca.exe
  2⤵
  PID:11360
- C:\Windows\System\VXjXmnN.exe
  C:\Windows\System\VXjXmnN.exe
  2⤵
  PID:12236
- C:\Windows\System\VZmHLEe.exe
  C:\Windows\System\VZmHLEe.exe
  2⤵
  PID:11580
- C:\Windows\System\GZRyRtH.exe
  C:\Windows\System\GZRyRtH.exe
  2⤵
  PID:11876
- C:\Windows\System\ZflOjZY.exe
  C:\Windows\System\ZflOjZY.exe
  2⤵
  PID:11940
- C:\Windows\System\nCZruyo.exe
  C:\Windows\System\nCZruyo.exe
  2⤵
  PID:11984
- C:\Windows\System\bcskpfH.exe
  C:\Windows\System\bcskpfH.exe
  2⤵
  PID:12096
- C:\Windows\System\NBRrMLu.exe
  C:\Windows\System\NBRrMLu.exe
  2⤵
  PID:12200
- C:\Windows\System\VlUBozE.exe
  C:\Windows\System\VlUBozE.exe
  2⤵
  PID:12252
- C:\Windows\System\LxghVmW.exe
  C:\Windows\System\LxghVmW.exe
  2⤵
  PID:12232
- C:\Windows\System\YqsIKvf.exe
  C:\Windows\System\YqsIKvf.exe
  2⤵
  PID:11688
- C:\Windows\System\jTAJRfm.exe
  C:\Windows\System\jTAJRfm.exe
  2⤵
  PID:12164
- C:\Windows\System\SHalGVl.exe
  C:\Windows\System\SHalGVl.exe
  2⤵
  PID:12240
- C:\Windows\System\axVSmmk.exe
  C:\Windows\System\axVSmmk.exe
  2⤵
  PID:12196
- C:\Windows\System\uQKWBlz.exe
  C:\Windows\System\uQKWBlz.exe
  2⤵
  PID:12260
- C:\Windows\System\uQuElht.exe
  C:\Windows\System\uQuElht.exe
  2⤵
  PID:12304
- C:\Windows\System\QKAoIHj.exe
  C:\Windows\System\QKAoIHj.exe
  2⤵
  PID:12332
- C:\Windows\System\ekiDmbY.exe
  C:\Windows\System\ekiDmbY.exe
  2⤵
  PID:12356
- C:\Windows\System\BCLGvas.exe
  C:\Windows\System\BCLGvas.exe
  2⤵
  PID:12384
- C:\Windows\System\GpyKHLk.exe
  C:\Windows\System\GpyKHLk.exe
  2⤵
  PID:12436
- C:\Windows\System\RCKvIKt.exe
  C:\Windows\System\RCKvIKt.exe
  2⤵
  PID:12452
- C:\Windows\System\qAxtZlA.exe
  C:\Windows\System\qAxtZlA.exe
  2⤵
  PID:12492
- C:\Windows\System\PzSoHGq.exe
  C:\Windows\System\PzSoHGq.exe
  2⤵
  PID:12508
- C:\Windows\System\KjiszHU.exe
  C:\Windows\System\KjiszHU.exe
  2⤵
  PID:12528
- C:\Windows\System\NcozPVK.exe
  C:\Windows\System\NcozPVK.exe
  2⤵
  PID:12552
- C:\Windows\System\GNyEBCn.exe
  C:\Windows\System\GNyEBCn.exe
  2⤵
  PID:12592
- C:\Windows\System\ODmEiuo.exe
  C:\Windows\System\ODmEiuo.exe
  2⤵
  PID:12628
- C:\Windows\System\yTHkEVS.exe
  C:\Windows\System\yTHkEVS.exe
  2⤵
  PID:12652
- C:\Windows\System\YymMJSN.exe
  C:\Windows\System\YymMJSN.exe
  2⤵
  PID:12672
- C:\Windows\System\MbQhYLW.exe
  C:\Windows\System\MbQhYLW.exe
  2⤵
  PID:12696
- C:\Windows\System\pfZAcjb.exe
  C:\Windows\System\pfZAcjb.exe
  2⤵
  PID:12716
- C:\Windows\System\wPufjJX.exe
  C:\Windows\System\wPufjJX.exe
  2⤵
  PID:12752
- C:\Windows\System\ZzBfVPi.exe
  C:\Windows\System\ZzBfVPi.exe
  2⤵
  PID:12780
- C:\Windows\System\rwePJOO.exe
  C:\Windows\System\rwePJOO.exe
  2⤵
  PID:12820
- C:\Windows\System\RhWKHGU.exe
  C:\Windows\System\RhWKHGU.exe
  2⤵
  PID:12844
- C:\Windows\System\qCPNOiR.exe
  C:\Windows\System\qCPNOiR.exe
  2⤵
  PID:12868
- C:\Windows\System\OWqwDGr.exe
  C:\Windows\System\OWqwDGr.exe
  2⤵
  PID:12892
- C:\Windows\System\dhiuikD.exe
  C:\Windows\System\dhiuikD.exe
  2⤵
  PID:12924
- C:\Windows\System\HewtVNd.exe
  C:\Windows\System\HewtVNd.exe
  2⤵
  PID:12964
- C:\Windows\System\pfnfaPQ.exe
  C:\Windows\System\pfnfaPQ.exe
  2⤵
  PID:12984
- C:\Windows\System\dvjnQkl.exe
  C:\Windows\System\dvjnQkl.exe
  2⤵
  PID:13004
- C:\Windows\System\DiyDPFU.exe
  C:\Windows\System\DiyDPFU.exe
  2⤵
  PID:13040
- C:\Windows\System\tnRVFPy.exe
  C:\Windows\System\tnRVFPy.exe
  2⤵
  PID:13056
- C:\Windows\System\ZVdZjqe.exe
  C:\Windows\System\ZVdZjqe.exe
  2⤵
  PID:13076
- C:\Windows\System\zSGOsOs.exe
  C:\Windows\System\zSGOsOs.exe
  2⤵
  PID:13112
- C:\Windows\System\Ccmdiuo.exe
  C:\Windows\System\Ccmdiuo.exe
  2⤵
  PID:13144
- C:\Windows\System\ppbsmbl.exe
  C:\Windows\System\ppbsmbl.exe
  2⤵
  PID:13176
- C:\Windows\System\ploAyXo.exe
  C:\Windows\System\ploAyXo.exe
  2⤵
  PID:13204
- C:\Windows\System\hqavHcm.exe
  C:\Windows\System\hqavHcm.exe
  2⤵
  PID:13236
- C:\Windows\System\ZBilXBx.exe
  C:\Windows\System\ZBilXBx.exe
  2⤵
  PID:13264
- C:\Windows\System\KwknooN.exe
  C:\Windows\System\KwknooN.exe
  2⤵
  PID:13300
- C:\Windows\System\gGEULTM.exe
  C:\Windows\System\gGEULTM.exe
  2⤵
  PID:12312
- C:\Windows\System\lSeVtLl.exe
  C:\Windows\System\lSeVtLl.exe
  2⤵
  PID:12396
- C:\Windows\System\snTGxmo.exe
  C:\Windows\System\snTGxmo.exe
  2⤵
  PID:12484
- C:\Windows\System\FZZpAEp.exe
  C:\Windows\System\FZZpAEp.exe
  2⤵
  PID:12500
- C:\Windows\System\LqNWFTg.exe
  C:\Windows\System\LqNWFTg.exe
  2⤵
  PID:12564
- C:\Windows\System\jwyPRYt.exe
  C:\Windows\System\jwyPRYt.exe
  2⤵
  PID:12616
- C:\Windows\System\evrDDQX.exe
  C:\Windows\System\evrDDQX.exe
  2⤵
  PID:12664
- C:\Windows\System\lJlfsyE.exe
  C:\Windows\System\lJlfsyE.exe
  2⤵
  PID:12772
- C:\Windows\System\YThrijB.exe
  C:\Windows\System\YThrijB.exe
  2⤵
  PID:12764
- C:\Windows\System\yImlkhO.exe
  C:\Windows\System\yImlkhO.exe
  2⤵
  PID:12912
- C:\Windows\System\FInlFYu.exe
  C:\Windows\System\FInlFYu.exe
  2⤵
  PID:12972
- C:\Windows\System\FJZjHWd.exe
  C:\Windows\System\FJZjHWd.exe
  2⤵
  PID:13024
- C:\Windows\System\oDwCgtw.exe
  C:\Windows\System\oDwCgtw.exe
  2⤵
  PID:13064
- C:\Windows\System\aXiZezC.exe
  C:\Windows\System\aXiZezC.exe
  2⤵
  PID:13156
- C:\Windows\System\caDCZYg.exe
  C:\Windows\System\caDCZYg.exe
  2⤵
  PID:13216
- C:\Windows\System\XHbsghL.exe
  C:\Windows\System\XHbsghL.exe
  2⤵
  PID:13280
- C:\Windows\System\emtlTAH.exe
  C:\Windows\System\emtlTAH.exe
  2⤵
  PID:12340
- C:\Windows\System\HLaRygN.exe
  C:\Windows\System\HLaRygN.exe
  2⤵
  PID:12468
- C:\Windows\System\khvvAtw.exe
  C:\Windows\System\khvvAtw.exe
  2⤵
  PID:12624
- C:\Windows\System\BYYEXmo.exe
  C:\Windows\System\BYYEXmo.exe
  2⤵
  PID:12832
- C:\Windows\System\nepZAWX.exe
  C:\Windows\System\nepZAWX.exe
  2⤵
  PID:12980
- C:\Windows\System\dzRyVyW.exe
  C:\Windows\System\dzRyVyW.exe
  2⤵
  PID:13084
- C:\Windows\System\wZoETPb.exe
  C:\Windows\System\wZoETPb.exe
  2⤵
  PID:13200
- C:\Windows\System\dBGlCVZ.exe
  C:\Windows\System\dBGlCVZ.exe
  2⤵
  PID:12428
- C:\Windows\System\XMkyEJc.exe
  C:\Windows\System\XMkyEJc.exe
  2⤵
  PID:12548
- C:\Windows\System\jAYjhgJ.exe
  C:\Windows\System\jAYjhgJ.exe
  2⤵
  PID:13048
- C:\Windows\System\sjuXMxW.exe
  C:\Windows\System\sjuXMxW.exe
  2⤵
  PID:12448
- C:\Windows\System\RsXLwXM.exe
  C:\Windows\System\RsXLwXM.exe
  2⤵
  PID:13328
- C:\Windows\System\leeifkO.exe
  C:\Windows\System\leeifkO.exe
  2⤵
  PID:13356
- C:\Windows\System\MKJwBQu.exe
  C:\Windows\System\MKJwBQu.exe
  2⤵
  PID:13392
- C:\Windows\System\hxGSPfz.exe
  C:\Windows\System\hxGSPfz.exe
  2⤵
  PID:13424
- C:\Windows\System\rMfZNhU.exe
  C:\Windows\System\rMfZNhU.exe
  2⤵
  PID:13448
- C:\Windows\System\VTlNqrG.exe
  C:\Windows\System\VTlNqrG.exe
  2⤵
  PID:13472
- C:\Windows\System\IpsqtOj.exe
  C:\Windows\System\IpsqtOj.exe
  2⤵
  PID:13496
- C:\Windows\System\SHgItQm.exe
  C:\Windows\System\SHgItQm.exe
  2⤵
  PID:13532
- C:\Windows\System\VdautmL.exe
  C:\Windows\System\VdautmL.exe
  2⤵
  PID:13552
- C:\Windows\System\coaZrtc.exe
  C:\Windows\System\coaZrtc.exe
  2⤵
  PID:13572
- C:\Windows\System\eNSChrp.exe
  C:\Windows\System\eNSChrp.exe
  2⤵
  PID:13632
- C:\Windows\System\wwHklAa.exe
  C:\Windows\System\wwHklAa.exe
  2⤵
  PID:13664
- C:\Windows\System\BVSLZaF.exe
  C:\Windows\System\BVSLZaF.exe
  2⤵
  PID:13692
- C:\Windows\System\kkAIuXy.exe
  C:\Windows\System\kkAIuXy.exe
  2⤵
  PID:13712
- C:\Windows\System\wryYEHg.exe
  C:\Windows\System\wryYEHg.exe
  2⤵
  PID:13736
- C:\Windows\System\pPnuuqz.exe
  C:\Windows\System\pPnuuqz.exe
  2⤵
  PID:13764
- C:\Windows\System\DcdJIdG.exe
  C:\Windows\System\DcdJIdG.exe
  2⤵
  PID:13804
- C:\Windows\System\uZjmohH.exe
  C:\Windows\System\uZjmohH.exe
  2⤵
  PID:13820
- C:\Windows\System\XxwbCzs.exe
  C:\Windows\System\XxwbCzs.exe
  2⤵
  PID:13844
- C:\Windows\System\pwMgGdZ.exe
  C:\Windows\System\pwMgGdZ.exe
  2⤵
  PID:13868
- C:\Windows\System\iisNDjy.exe
  C:\Windows\System\iisNDjy.exe
  2⤵
  PID:13896
- C:\Windows\System\OEmiuQp.exe
  C:\Windows\System\OEmiuQp.exe
  2⤵
  PID:13920
- C:\Windows\System\lmnhRFp.exe
  C:\Windows\System\lmnhRFp.exe
  2⤵
  PID:13960
- C:\Windows\System\hQMSPkS.exe
  C:\Windows\System\hQMSPkS.exe
  2⤵
  PID:13980
- C:\Windows\System\ghFFGBQ.exe
  C:\Windows\System\ghFFGBQ.exe
  2⤵
  PID:14004
- C:\Windows\System\BjoTICy.exe
  C:\Windows\System\BjoTICy.exe
  2⤵
  PID:14024
- C:\Windows\System\lSLiqBr.exe
  C:\Windows\System\lSLiqBr.exe
  2⤵
  PID:14048
- C:\Windows\System\KaaOgef.exe
  C:\Windows\System\KaaOgef.exe
  2⤵
  PID:14076
- C:\Windows\System\pvJjCiz.exe
  C:\Windows\System\pvJjCiz.exe
  2⤵
  PID:14096
- C:\Windows\System\YRBimVa.exe
  C:\Windows\System\YRBimVa.exe
  2⤵
  PID:14140
- C:\Windows\System\gUvxAfM.exe
  C:\Windows\System\gUvxAfM.exe
  2⤵
  PID:14172
- C:\Windows\System\wougRXz.exe
  C:\Windows\System\wougRXz.exe
  2⤵
  PID:14192
- C:\Windows\System\xFYXPsO.exe
  C:\Windows\System\xFYXPsO.exe
  2⤵
  PID:14212
- C:\Windows\System\cviSEAx.exe
  C:\Windows\System\cviSEAx.exe
  2⤵
  PID:14228
- C:\Windows\System\AiVAEdw.exe
  C:\Windows\System\AiVAEdw.exe
  2⤵
  PID:14248
- C:\Windows\System\gicZBng.exe
  C:\Windows\System\gicZBng.exe
  2⤵
  PID:14312
- C:\Windows\System\CElxdcu.exe
  C:\Windows\System\CElxdcu.exe
  2⤵
  PID:13012
- C:\Windows\System\UKSKUBj.exe
  C:\Windows\System\UKSKUBj.exe
  2⤵
  PID:13320
- C:\Windows\System\GHIshfo.exe
  C:\Windows\System\GHIshfo.exe
  2⤵
  PID:13388
- C:\Windows\System\jSbtltQ.exe
  C:\Windows\System\jSbtltQ.exe
  2⤵
  PID:13464
- C:\Windows\System\unaOntg.exe
  C:\Windows\System\unaOntg.exe
  2⤵
  PID:13548
- C:\Windows\System\PedVVIq.exe
  C:\Windows\System\PedVVIq.exe
  2⤵
  PID:13628
- C:\Windows\System\RbHEdQM.exe
  C:\Windows\System\RbHEdQM.exe
  2⤵
  PID:13676
- C:\Windows\System\SANbriD.exe
  C:\Windows\System\SANbriD.exe
  2⤵
  PID:13732
- C:\Windows\System\EELfoak.exe
  C:\Windows\System\EELfoak.exe
  2⤵
  PID:13792
- C:\Windows\System\dAvnsBz.exe
  C:\Windows\System\dAvnsBz.exe
  2⤵
  PID:13832
- C:\Windows\System\GVJqvQx.exe
  C:\Windows\System\GVJqvQx.exe
  2⤵
  PID:13948
- C:\Windows\System\qeKNMRo.exe
  C:\Windows\System\qeKNMRo.exe
  2⤵
  PID:14060
- C:\Windows\System\gfkCADl.exe
  C:\Windows\System\gfkCADl.exe
  2⤵
  PID:14064
- C:\Windows\System\WVQiqzA.exe
  C:\Windows\System\WVQiqzA.exe
  2⤵
  PID:13172
- C:\Windows\System\HgiRisK.exe
  C:\Windows\System\HgiRisK.exe
  2⤵
  PID:14184
- C:\Windows\System\GmkcSIx.exe
  C:\Windows\System\GmkcSIx.exe
  2⤵
  PID:14224
- C:\Windows\System\xCVirhZ.exe
  C:\Windows\System\xCVirhZ.exe
  2⤵
  PID:14300
- C:\Windows\System\DlwRuFo.exe
  C:\Windows\System\DlwRuFo.exe
  2⤵
  PID:13456
- C:\Windows\System\sRHZieh.exe
  C:\Windows\System\sRHZieh.exe
  2⤵
  PID:13516
- C:\Windows\System\XmSHBhN.exe
  C:\Windows\System\XmSHBhN.exe
  2⤵
  PID:13752
- C:\Windows\System\MzLxsml.exe
  C:\Windows\System\MzLxsml.exe
  2⤵
  PID:13836
- C:\Windows\System\INCZiEy.exe
  C:\Windows\System\INCZiEy.exe
  2⤵
  PID:14028
- C:\Windows\System\CMNDNWk.exe
  C:\Windows\System\CMNDNWk.exe
  2⤵
  PID:14128
- C:\Windows\System\hPASaMT.exe
  C:\Windows\System\hPASaMT.exe
  2⤵
  PID:14244
- C:\Windows\System\hJPcPxW.exe
  C:\Windows\System\hJPcPxW.exe
  2⤵
  PID:2184
- C:\Windows\System\EwCXfpW.exe
  C:\Windows\System\EwCXfpW.exe
  2⤵
  PID:13744
- C:\Windows\System\PvLgRHg.exe
  C:\Windows\System\PvLgRHg.exe
  2⤵
  PID:14200
- C:\Windows\System\PGVINod.exe
  C:\Windows\System\PGVINod.exe
  2⤵
  PID:13932
- C:\Windows\System\emLUzOh.exe
  C:\Windows\System\emLUzOh.exe
  2⤵
  PID:14352
- C:\Windows\System\kpuVuWv.exe
  C:\Windows\System\kpuVuWv.exe
  2⤵
  PID:14400
- C:\Windows\System\yxxlWej.exe
  C:\Windows\System\yxxlWej.exe
  2⤵
  PID:14424
- C:\Windows\System\JOTnWTq.exe
  C:\Windows\System\JOTnWTq.exe
  2⤵
  PID:14456
- C:\Windows\System\JncqIIr.exe
  C:\Windows\System\JncqIIr.exe
  2⤵
  PID:14484
- C:\Windows\System\GJCVUre.exe
  C:\Windows\System\GJCVUre.exe
  2⤵
  PID:14508
- C:\Windows\System\PdybwdQ.exe
  C:\Windows\System\PdybwdQ.exe
  2⤵
  PID:14528
- C:\Windows\System\cypntjO.exe
  C:\Windows\System\cypntjO.exe
  2⤵
  PID:14556
- C:\Windows\System\hvJvAQB.exe
  C:\Windows\System\hvJvAQB.exe
  2⤵
  PID:14584
- C:\Windows\System\lLmvaWz.exe
  C:\Windows\System\lLmvaWz.exe
  2⤵
  PID:14600
- C:\Windows\System\FOSdzhc.exe
  C:\Windows\System\FOSdzhc.exe
  2⤵
  PID:14652
- C:\Windows\System\PIhjXyr.exe
  C:\Windows\System\PIhjXyr.exe
  2⤵
  PID:14668
- C:\Windows\System\oRyHWAc.exe
  C:\Windows\System\oRyHWAc.exe
  2⤵
  PID:14696
- C:\Windows\System\ohcQvuO.exe
  C:\Windows\System\ohcQvuO.exe
  2⤵
  PID:14732
- C:\Windows\System\zcnaAMd.exe
  C:\Windows\System\zcnaAMd.exe
  2⤵
  PID:14752
- C:\Windows\System\IvJMziB.exe
  C:\Windows\System\IvJMziB.exe
  2⤵
  PID:14780
- C:\Windows\System\QkcqrNC.exe
  C:\Windows\System\QkcqrNC.exe
  2⤵
  PID:14800
- C:\Windows\System\vrtvGNq.exe
  C:\Windows\System\vrtvGNq.exe
  2⤵
  PID:14824
- C:\Windows\System\fJeblxn.exe
  C:\Windows\System\fJeblxn.exe
  2⤵
  PID:14848
- C:\Windows\System\HZnKcSG.exe
  C:\Windows\System\HZnKcSG.exe
  2⤵
  PID:14872
- C:\Windows\System\tfCzcuW.exe
  C:\Windows\System\tfCzcuW.exe
  2⤵
  PID:14932
- C:\Windows\System\INYcafS.exe
  C:\Windows\System\INYcafS.exe
  2⤵
  PID:14960
- C:\Windows\System\TOEptPF.exe
  C:\Windows\System\TOEptPF.exe
  2⤵
  PID:14980
- C:\Windows\System\rNxqsZV.exe
  C:\Windows\System\rNxqsZV.exe
  2⤵
  PID:15012
- C:\Windows\System\qbpSMKc.exe
  C:\Windows\System\qbpSMKc.exe
  2⤵
  PID:15032
- C:\Windows\System\UNhKtHC.exe
  C:\Windows\System\UNhKtHC.exe
  2⤵
  PID:15056
- C:\Windows\System\rInpAkh.exe
  C:\Windows\System\rInpAkh.exe
  2⤵
  PID:15100
- C:\Windows\System\liHfSOE.exe
  C:\Windows\System\liHfSOE.exe
  2⤵
  PID:15132
- C:\Windows\System\pkpXEwk.exe
  C:\Windows\System\pkpXEwk.exe
  2⤵
  PID:15160
- C:\Windows\System\QoJzwxC.exe
  C:\Windows\System\QoJzwxC.exe
  2⤵
  PID:15184
- C:\Windows\System\Abwfhjm.exe
  C:\Windows\System\Abwfhjm.exe
  2⤵
  PID:15208
- C:\Windows\System\YINYIVe.exe
  C:\Windows\System\YINYIVe.exe
  2⤵
  PID:15228
- C:\Windows\System\TJzCYqX.exe
  C:\Windows\System\TJzCYqX.exe
  2⤵
  PID:15248
- C:\Windows\System\bHgXgzE.exe
  C:\Windows\System\bHgXgzE.exe
  2⤵
  PID:15264
- C:\Windows\System\kBSYlAv.exe
  C:\Windows\System\kBSYlAv.exe
  2⤵
  PID:15292
- C:\Windows\System\rQDflMJ.exe
  C:\Windows\System\rQDflMJ.exe
  2⤵
  PID:15316
- C:\Windows\System\KieJXye.exe
  C:\Windows\System\KieJXye.exe
  2⤵
  PID:14344
- C:\Windows\System\CJrYccH.exe
  C:\Windows\System\CJrYccH.exe
  2⤵
  PID:14436
- C:\Windows\System\vyvgLlX.exe
  C:\Windows\System\vyvgLlX.exe
  2⤵
  PID:14468
- C:\Windows\System\AomMNhK.exe
  C:\Windows\System\AomMNhK.exe
  2⤵
  PID:14516
- C:\Windows\System\osKINjI.exe
  C:\Windows\System\osKINjI.exe
  2⤵
  PID:14568
- C:\Windows\System\ucKTqNW.exe
  C:\Windows\System\ucKTqNW.exe
  2⤵
  PID:14624
- C:\Windows\System\YlDpZNb.exe
  C:\Windows\System\YlDpZNb.exe
  2⤵
  PID:14684
- C:\Windows\System\vDjADPG.exe
  C:\Windows\System\vDjADPG.exe
  2⤵
  PID:14796
- C:\Windows\System\jMdwyqj.exe
  C:\Windows\System\jMdwyqj.exe
  2⤵
  PID:14860
- C:\Windows\System\UJBHllK.exe
  C:\Windows\System\UJBHllK.exe
  2⤵
  PID:14900
- C:\Windows\System\FYItwuC.exe
  C:\Windows\System\FYItwuC.exe
  2⤵
  PID:14944
- C:\Windows\System\enjAXki.exe
  C:\Windows\System\enjAXki.exe
  2⤵
  PID:15008
- C:\Windows\System\dxJaRBB.exe
  C:\Windows\System\dxJaRBB.exe
  2⤵
  PID:15068
- C:\Windows\System\PAkktoi.exe
  C:\Windows\System\PAkktoi.exe
  2⤵
  PID:15180
- C:\Windows\System\mMJgRmz.exe
  C:\Windows\System\mMJgRmz.exe
  2⤵
  PID:15220
- C:\Windows\System\kwJrlry.exe
  C:\Windows\System\kwJrlry.exe
  2⤵
  PID:15304
- C:\Windows\System\qmYHfEP.exe
  C:\Windows\System\qmYHfEP.exe
  2⤵
  PID:15312
- C:\Windows\System\WItJkaR.exe
  C:\Windows\System\WItJkaR.exe
  2⤵
  PID:14384
- C:\Windows\System\QIlUVkT.exe
  C:\Windows\System\QIlUVkT.exe
  2⤵
  PID:14452
- C:\Windows\System\AbNfKOe.exe
  C:\Windows\System\AbNfKOe.exe
  2⤵
  PID:14708
- C:\Windows\System\tIEdZsc.exe
  C:\Windows\System\tIEdZsc.exe
  2⤵
  PID:14808
- C:\Windows\System\RZcvGev.exe
  C:\Windows\System\RZcvGev.exe
  2⤵
  PID:14988
- C:\Windows\System\BYIoVTj.exe
  C:\Windows\System\BYIoVTj.exe
  2⤵
  PID:15028
- C:\Windows\System\hSRqQgN.exe
  C:\Windows\System\hSRqQgN.exe
  2⤵
  PID:15152
- C:\Windows\System\VTaNOpN.exe
  C:\Windows\System\VTaNOpN.exe
  2⤵
  PID:14540
- C:\Windows\System\rDjYdKx.exe
  C:\Windows\System\rDjYdKx.exe
  2⤵
  PID:14788
- C:\Windows\System\LauuzoW.exe
  C:\Windows\System\LauuzoW.exe
  2⤵
  PID:14916
- C:\Windows\System\ozfymBQ.exe
  C:\Windows\System\ozfymBQ.exe
  2⤵
  PID:15380
- C:\Windows\System\gLGluPO.exe
  C:\Windows\System\gLGluPO.exe
  2⤵
  PID:15404
- C:\Windows\System\GVaXrLF.exe
  C:\Windows\System\GVaXrLF.exe
  2⤵
  PID:15440
- C:\Windows\System\BQwiqdU.exe
  C:\Windows\System\BQwiqdU.exe
  2⤵
  PID:15464
- C:\Windows\System\ABdyCar.exe
  C:\Windows\System\ABdyCar.exe
  2⤵
  PID:15480
- C:\Windows\System\aAqWtOg.exe
  C:\Windows\System\aAqWtOg.exe
  2⤵
  PID:15508
- C:\Windows\System\YxixWFi.exe
  C:\Windows\System\YxixWFi.exe
  2⤵
  PID:15532
- C:\Windows\System\SGSmpHo.exe
  C:\Windows\System\SGSmpHo.exe
  2⤵
  PID:15560
- C:\Windows\System\bQBeFwh.exe
  C:\Windows\System\bQBeFwh.exe
  2⤵
  PID:15584
- C:\Windows\System\urFlWDT.exe
  C:\Windows\System\urFlWDT.exe
  2⤵
  PID:15612
- C:\Windows\System\mwPUVCY.exe
  C:\Windows\System\mwPUVCY.exe
  2⤵
  PID:15636
- C:\Windows\System\NmJAVZQ.exe
  C:\Windows\System\NmJAVZQ.exe
  2⤵
  PID:15660
- C:\Windows\System\VFnDXOX.exe
  C:\Windows\System\VFnDXOX.exe
  2⤵
  PID:15696
- C:\Windows\System\PxOawFP.exe
  C:\Windows\System\PxOawFP.exe
  2⤵
  PID:15748
- C:\Windows\System\lQWcMmr.exe
  C:\Windows\System\lQWcMmr.exe
  2⤵
  PID:15768
- C:\Windows\System\OXAblPG.exe
  C:\Windows\System\OXAblPG.exe
  2⤵
  PID:15788
- C:\Windows\System\QyqlITD.exe
  C:\Windows\System\QyqlITD.exe
  2⤵
  PID:15848
- C:\Windows\System\NHBQllb.exe
  C:\Windows\System\NHBQllb.exe
  2⤵
  PID:15876
- C:\Windows\System\xvEWHsw.exe
  C:\Windows\System\xvEWHsw.exe
  2⤵
  PID:15904
- C:\Windows\System\JUiypXK.exe
  C:\Windows\System\JUiypXK.exe
  2⤵
  PID:15924
- C:\Windows\System\hXDnTzV.exe
  C:\Windows\System\hXDnTzV.exe
  2⤵
  PID:15948
- C:\Windows\System\pRpXAtg.exe
  C:\Windows\System\pRpXAtg.exe
  2⤵
  PID:15968
- C:\Windows\System\AaluavL.exe
  C:\Windows\System\AaluavL.exe
  2⤵
  PID:16004
- C:\Windows\System\ejCbyEZ.exe
  C:\Windows\System\ejCbyEZ.exe
  2⤵
  PID:16028
- C:\Windows\System\TCVOBih.exe
  C:\Windows\System\TCVOBih.exe
  2⤵
  PID:16048
- C:\Windows\System\qJYyQoE.exe
  C:\Windows\System\qJYyQoE.exe
  2⤵
  PID:16104
- C:\Windows\System\TXzTvwV.exe
  C:\Windows\System\TXzTvwV.exe
  2⤵
  PID:16132
- C:\Windows\System\DKwUugk.exe
  C:\Windows\System\DKwUugk.exe
  2⤵
  PID:16148
- C:\Windows\System\vzkOihP.exe
  C:\Windows\System\vzkOihP.exe
  2⤵
  PID:16164
- C:\Windows\System\YWupMxO.exe
  C:\Windows\System\YWupMxO.exe
  2⤵
  PID:16188
- C:\Windows\System\JbbYqvf.exe
  C:\Windows\System\JbbYqvf.exe
  2⤵
  PID:16208
- C:\Windows\System\AwNjACD.exe
  C:\Windows\System\AwNjACD.exe
  2⤵
  PID:16232
- C:\Windows\System\myWjnst.exe
  C:\Windows\System\myWjnst.exe
  2⤵
  PID:16260
- C:\Windows\System\iAEBZJF.exe
  C:\Windows\System\iAEBZJF.exe
  2⤵
  PID:16292
- C:\Windows\System\JQPxehu.exe
  C:\Windows\System\JQPxehu.exe
  2⤵
  PID:16320
- C:\Windows\System\LDCBhQu.exe
  C:\Windows\System\LDCBhQu.exe
  2⤵
  PID:16356
- C:\Windows\System\CkrTOAq.exe
  C:\Windows\System\CkrTOAq.exe
  2⤵
  PID:15392
- C:\Windows\System\pJAgnTw.exe
  C:\Windows\System\pJAgnTw.exe
  2⤵
  PID:15428
- C:\Windows\System\FvuezFj.exe
  C:\Windows\System\FvuezFj.exe
  2⤵
  PID:15500
- C:\Windows\System\PFuiufY.exe
  C:\Windows\System\PFuiufY.exe
  2⤵
  PID:15596
- C:\Windows\System\KxfMEXg.exe
  C:\Windows\System\KxfMEXg.exe
  2⤵
  PID:15648
- C:\Windows\System\EQMZnLN.exe
  C:\Windows\System\EQMZnLN.exe
  2⤵
  PID:15720
- C:\Windows\System\hvTKZYZ.exe
  C:\Windows\System\hvTKZYZ.exe
  2⤵
  PID:15816
- C:\Windows\System\tLZicnT.exe
  C:\Windows\System\tLZicnT.exe
  2⤵
  PID:15864
- C:\Windows\System\PzxIirn.exe
  C:\Windows\System\PzxIirn.exe
  2⤵
  PID:15944
- C:\Windows\System\tBosRBc.exe
  C:\Windows\System\tBosRBc.exe
  2⤵
  PID:15964
- C:\Windows\System\cYEbiel.exe
  C:\Windows\System\cYEbiel.exe
  2⤵
  PID:16044
- C:\Windows\System\cbQjHjt.exe
  C:\Windows\System\cbQjHjt.exe
  2⤵
  PID:16116
- C:\Windows\System\jcPgSbB.exe
  C:\Windows\System\jcPgSbB.exe
  2⤵
  PID:16144
- C:\Windows\System\AKmlJQb.exe
  C:\Windows\System\AKmlJQb.exe
  2⤵
  PID:16252
- C:\Windows\System\sspMqwb.exe
  C:\Windows\System\sspMqwb.exe
  2⤵
  PID:16328
- C:\Windows\System\DXSQoRE.exe
  C:\Windows\System\DXSQoRE.exe
  2⤵
  PID:16348
- C:\Windows\System\yiXdiFE.exe
  C:\Windows\System\yiXdiFE.exe
  2⤵
  PID:15456
- C:\Windows\System\cLzidef.exe
  C:\Windows\System\cLzidef.exe
  2⤵
  PID:15632
- C:\Windows\System\KCxRtFG.exe
  C:\Windows\System\KCxRtFG.exe
  2⤵
  PID:14640
- C:\Windows\System\YQwNBEr.exe
  C:\Windows\System\YQwNBEr.exe
  2⤵
  PID:16016
- C:\Windows\System\PcWbqJY.exe
  C:\Windows\System\PcWbqJY.exe
  2⤵
  PID:16120
- C:\Windows\System\UFgKOyu.exe
  C:\Windows\System\UFgKOyu.exe
  2⤵
  PID:16316
- C:\Windows\System\SenfjiU.exe
  C:\Windows\System\SenfjiU.exe
  2⤵
  PID:15520
- C:\Windows\System\pfFNcSq.exe
  C:\Windows\System\pfFNcSq.exe
  2⤵
  PID:15840
- C:\Windows\System\tGrtqPy.exe
  C:\Windows\System\tGrtqPy.exe
  2⤵
  PID:16140
- C:\Windows\System\Uxlkyov.exe
  C:\Windows\System\Uxlkyov.exe
  2⤵
  PID:15576
- C:\Windows\System\LdeJzMc.exe
  C:\Windows\System\LdeJzMc.exe
  2⤵
  PID:16392
- C:\Windows\System\znyfnpe.exe
  C:\Windows\System\znyfnpe.exe
  2⤵
  PID:16416
- C:\Windows\System\ODnYrHM.exe
  C:\Windows\System\ODnYrHM.exe
  2⤵
  PID:16436
- C:\Windows\System\kwPOMoM.exe
  C:\Windows\System\kwPOMoM.exe
  2⤵
  PID:16464
- C:\Windows\System\IPAaZPL.exe
  C:\Windows\System\IPAaZPL.exe
  2⤵
  PID:16484
- C:\Windows\System\yeNeiNy.exe
  C:\Windows\System\yeNeiNy.exe
  2⤵
  PID:16504
- C:\Windows\System\yVfwwQe.exe
  C:\Windows\System\yVfwwQe.exe
  2⤵
  PID:16532
- C:\Windows\System\jZxbEjj.exe
  C:\Windows\System\jZxbEjj.exe
  2⤵
  PID:16556
- C:\Windows\System\sVMBYUv.exe
  C:\Windows\System\sVMBYUv.exe
  2⤵
  PID:16576
- C:\Windows\System\IgJvDdK.exe
  C:\Windows\System\IgJvDdK.exe
  2⤵
  PID:16612
- C:\Windows\System\MpsJkCF.exe
  C:\Windows\System\MpsJkCF.exe
  2⤵
  PID:16640
- C:\Windows\System\tfxOrXO.exe
  C:\Windows\System\tfxOrXO.exe
  2⤵
  PID:16660
- C:\Windows\System\LxdKHhM.exe
  C:\Windows\System\LxdKHhM.exe
  2⤵
  PID:16688
- C:\Windows\System\PJHLexJ.exe
  C:\Windows\System\PJHLexJ.exe
  2⤵
  PID:16720
- C:\Windows\System\TzeSIaG.exe
  C:\Windows\System\TzeSIaG.exe
  2⤵
  PID:16744
- C:\Windows\System\lXvzoGD.exe
  C:\Windows\System\lXvzoGD.exe
  2⤵
  PID:16764
- C:\Windows\System\ErXcdnB.exe
  C:\Windows\System\ErXcdnB.exe
  2⤵
  PID:16784
- C:\Windows\System\xcWJNRk.exe
  C:\Windows\System\xcWJNRk.exe
  2⤵
  PID:16812
- C:\Windows\System\WEVPUBT.exe
  C:\Windows\System\WEVPUBT.exe
  2⤵
  PID:16844
- C:\Windows\System\FJxZQzQ.exe
  C:\Windows\System\FJxZQzQ.exe
  2⤵
  PID:16860
- C:\Windows\System\OPUbcNw.exe
  C:\Windows\System\OPUbcNw.exe
  2⤵
  PID:16876
- C:\Windows\System\QvFyEXO.exe
  C:\Windows\System\QvFyEXO.exe
  2⤵
  PID:16900
- C:\Windows\System\vGjKtDD.exe
  C:\Windows\System\vGjKtDD.exe
  2⤵
  PID:16924
- C:\Windows\System\AtptFna.exe
  C:\Windows\System\AtptFna.exe
  2⤵
  PID:16944
- C:\Windows\System\FpMsCsR.exe
  C:\Windows\System\FpMsCsR.exe
  2⤵
  PID:16972
- C:\Windows\System\AuhXJUT.exe
  C:\Windows\System\AuhXJUT.exe
  2⤵
  PID:16996
- C:\Windows\System\cJvTdNt.exe
  C:\Windows\System\cJvTdNt.exe
  2⤵
  PID:17024
- C:\Windows\System\XBBfFPa.exe
  C:\Windows\System\XBBfFPa.exe
  2⤵
  PID:17048
- C:\Windows\System\yveXnwT.exe
  C:\Windows\System\yveXnwT.exe
  2⤵
  PID:17068
- C:\Windows\System\JCnDECb.exe
  C:\Windows\System\JCnDECb.exe
  2⤵
  PID:17284

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv qbFv6PijWEGvRT26SrWhhw.0.2
1⤵
PID:16728
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 16728 -s 1028
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:17260

C:\Windows\system32\WerFaultSecure.exe
C:\Windows\system32\WerFaultSecure.exe -u -p 4376 -s 2112
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:16992

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 16728 -i 16728 -h 468 -j 472 -s 480 -d 17156
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:17204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BtSKiIa.exe

Filesize
1.1MB

MD5
3d845057e8e4ad7e7bbe8928024e957d

SHA1
2ab9a8b54e2448d19cc2cda977deef43b4dfb819

SHA256
23174912a6ab519d9de329cb082abe8e6857e9f76e93ccea19669a252c72636c

SHA512
29601bf46e41078e8a72fc00456a47fe62ae694279af38565930f240a74443989beaafdae9b84a8989bf0f20782d82bee8a8d656efefb13fb26399776db372a7

Download Submit
C:\Windows\System\CGGTcbl.exe

Filesize
1.2MB

MD5
488801b910cc9b323c81e21fb27a1d6b

SHA1
5e8fe49fa7b4173ad75f7d409be50cf5e6bed45d

SHA256
80bcfec3004f34279249869f36c6d67a07387065ddc89b8e63473cf655ce97ab

SHA512
fab26e345ada7865a836b8614f6462471e26c5b900bd7e0aef292b16253fd834f5a3307943333bdf84cc8103b2f290d8d159bfb9608ec62c9ebfdf66534d5f01

Download Submit
C:\Windows\System\COEQiEx.exe

Filesize
1.1MB

MD5
2ef555ac9c0174b682ca79ce88010a35

SHA1
7b6bcd0684dff79ad6323cc1c5dde2533037d331

SHA256
19f39ebd664edb8cedc0612799882995d017972e247ea6ae4c96a78026b4fb2e

SHA512
82dc6caef1cab7b1aee3c7aa37350e19267caa6adf1dc9ff631fb6bfe7d9f718b75420abb7ae5c470e8da7a1ff865a1a16e4d94ce4262a65b793936d8b43a8e6

Download Submit
C:\Windows\System\DGkZRXQ.exe

Filesize
1.2MB

MD5
9a92323152fd7aea702c8c2b5775dd7b

SHA1
0a1700f7d9ba246dd1c241fe6b0a3f4a5e2ac08b

SHA256
31c3764fdc40c7e430bc87c397d4134c3844484a4f9bf8d30533c3a58a5c095c

SHA512
af0c57189869d2641f41d84aca8de314d0c974aed305e588947935e0a16022818ceb8700e06e297e4357bcdcbce85614ac119051c9a66d1f845bbd701c9a1464

Download Submit
C:\Windows\System\IrDXZgv.exe

Filesize
1.1MB

MD5
cea677141a05b7b55061380b7f51603d

SHA1
1564287402cfb8089fa8e5062ebee537136160d5

SHA256
603b12f7a2db40bf00c9da9dc587471ff7d5bc3ca81bee730aeb33ba248f017c

SHA512
561ce6a81b4b730d32d3327ba23831ec85bba97e7889956aadcc367d7631e2e6c6c2a05a41d95726aed1cf0dc53f7cc6bb0e54c9291fa051639cb98069471234

Download Submit
C:\Windows\System\KIQwNDv.exe

Filesize
1.1MB

MD5
3dfbebb7e977fd4776e3f415e03e2d69

SHA1
9233059f530b49f573ffa4b71d0a214bb28723e0

SHA256
ce2db2a9a3a9e93f376a0f098821f4e32eb0cddf9a7a1767eb5f1193f2ca503d

SHA512
7fa88b1c4dd8150719a83eb77ea78801cd4916650d3cd0d1c4e4caef6c900ee23cf0d02abb6614caa578f5c73241aecf87ad252b4a93adcde753bd8aba0cb00e

Download Submit
C:\Windows\System\KOKDluS.exe

Filesize
1.2MB

MD5
402efd637aa1bf798556bb9c62bfbbff

SHA1
e0aeb1bab1575f0e85bd7f7dc4f7cc7e979b24d1

SHA256
862bf7978dcbad9d67a38fa761afcc11e5fa8abbb5cceabe4acf00c078f14003

SHA512
5f2c718423c4c8927a2680240a73f5cbdd6ae356f937bdae54b0e9f19fb4160890a2afbf4bb813c737c00d8b3d2de2e33034d30e6590fc6cd5fed999f10b45c6

Download Submit
C:\Windows\System\KsfzkQa.exe

Filesize
1.1MB

MD5
d7b530b7cba3dbd260f2a3171ff0a894

SHA1
d76bbe928fde8cebad25c94edbb8c3d49932864b

SHA256
ef6a493e953c8ff5a9935c3276df21e00d2742eede85b163f2fa8cccc9fd87f2

SHA512
7fcaec23d0f31438ce0cb5ccf7aa5eb2b9dab12bcfa4985c70f1d42153add518b1498d49a27aafc34429592f9af2324da48c40b67ec6c28dc889280572eaf9f1

Download Submit
C:\Windows\System\KxTsPVQ.exe

Filesize
1.2MB

MD5
29e807931ba3febaec470988e04465c3

SHA1
3a98e0e4219496dbd46bde2b6e5800326710776d

SHA256
4a25428f34caab10899b77034f1a0fb38da2669426d7ac024bb12968b4d06b98

SHA512
a382d61caf590ba80670a179a52b3a523dab417d2994f51e8b1a44588d2c98c00aa1b3f62eb06d6c07f6a5d42ef6367a9e0808cf8a782c7308c98635754611fd

Download Submit
C:\Windows\System\LopHiLP.exe

Filesize
1.1MB

MD5
0a03a256f90a05129b66b95ba38a12ec

SHA1
9736fd6b86ce006813eb2f522168677fecabbcaf

SHA256
3e4633e765576af51da70eb5287021c7e3bafe6cf676d3a817e69a1b06432e80

SHA512
5c4da221c1e7fcfd18d0b1435c288a06924c3ae1f61cece64ba305fb678b164c1fa98946a371740eb42a033689e1703f451962ae4dfeeec6ccb6a8beac90ee62

Download Submit
C:\Windows\System\OlFPsfn.exe

Filesize
1.2MB

MD5
fc5f202ef7213f73e34554f7479df813

SHA1
79ead017a2815391b4199418ff2dfb4944cd9836

SHA256
d190316c590b7908b69b7a35a31eac9e74cee9e0dae2f80e738c59743d51423a

SHA512
835d7edcfdb075b43a25a036fd95ac6e420429dd20d720905a1ab7d8a66994a9bd631a1020c0bc7162d6f905ffeda731c0e5f10ae28ffd48aa6462e8611d2a34

Download Submit
C:\Windows\System\QHEoqLh.exe

Filesize
1.2MB

MD5
be37f566d4632e396aed58c4e18ef647

SHA1
e66b6b7c40ea948d055d5ca358d9900c8335ce8d

SHA256
96998b172a1eaec605428f6f4a814ff20bcdb6cd113830584a9e9fafd3b5d99e

SHA512
0396d93ad1aa77a886ada11eb659a0a15e12f71f0e283691d37213ac55f33456ca4cfa2199ad05a032419765e9a85883a370140e081b889cffb7e65dc0cade22

Download Submit
C:\Windows\System\RoZBLKA.exe

Filesize
1.2MB

MD5
8d97cb59443cb0f6828cf179c2ced9c0

SHA1
6be18b632ae0894439bd9f604db90641682a721b

SHA256
54270e4d9a42caf136691fee58990a6824e2808094308e2179371bfafc8e77aa

SHA512
b0540a7d78349c0870384bd65106fa26af22b6e36f3b3706e007a44171feccdad14c843e0543ed572e744c8625b7790742ab976738e278c8efb5df96f2cf8266

Download Submit
C:\Windows\System\SkRuNKC.exe

Filesize
1.1MB

MD5
d1d861e6815191d4b4dc411680441b9e

SHA1
e1fe409fb9a795c98e03bd318f99ad032c74c8b2

SHA256
6b6220df91218dae7bc8c75143d216d0d57b0db7eccd9acad6726bfc9bf4f959

SHA512
09d17d9ac3efc251f93fcf64edd2e2be7b48d728cd98df7158479211c535e4ed71c2cc2a3b57fd5d0496bed50634f7f1be62913ae86fe43fd27d009bdac0dce6

Download Submit
C:\Windows\System\YXYbQpw.exe

Filesize
1.2MB

MD5
46510d69b74444ac7439755393eff71a

SHA1
9b570952f1542dcd88d62fe0a56c851c1d7540ca

SHA256
7542177b65cc51b7fb08a1eea94c25a6a31287a13698f81bc3224293e762797f

SHA512
a3e0a21fb1b5f5741b97f49b8b3e16b0144476adbcf6f811147e2ed7ba4cd9b8174b918ce94b60f029e1b346d1ffc1cbe9890686192fbc786b4a15f36e28e1b7

Download Submit
C:\Windows\System\YbvBXZH.exe

Filesize
1.2MB

MD5
a501ba1ebbf976bbb9c0a52055f6b132

SHA1
b3d702c283b20fdece17214d70295ce8965c79e0

SHA256
58faf51145cf4b1650f61749c744e249efe363d24023171b7efa9b4ec755570a

SHA512
2de68ee88423e5002775e3638ba829137ff2b7f2ad5230ac05349c797fc104621fa20296870cd0027c681d05b415093eb0aaa273a97dc38c2dbcf66665251933

Download Submit
C:\Windows\System\clBjFXL.exe

Filesize
1.2MB

MD5
b3d5abd84cd9da94fbe1584f2aa1c6f6

SHA1
cad80641a4d2f263c09c81b452087e271eb8c353

SHA256
5d50d37b2179789f66db9204ae86e3f689c0b8c393136db0d968484b1ca883f8

SHA512
a483b860ee767fa3710be75b745526db64c9b98570dec6cade0dc67301dcbc365c52b6e03e06d9fb3ceb18ecd1040db11b22626b57ffa36be2e1902a414a2f12

Download Submit
C:\Windows\System\eHMdWvX.exe

Filesize
1.2MB

MD5
baffd5f57a91013a72aaea2c012f8438

SHA1
4d13b81b02e6b0315bdfcfc21ea0b96462b88f4f

SHA256
5d02cb0c1e787cfc4ec144cd7f71e198a2f0a92b85bbfd36f1c00a2ca99cb565

SHA512
44d7e640bb902eac149d98cca464a482c2fb5dd1867e3002068e027bc76cfc567bc8fee9a4ca076f2cc96a7bb8497f0442074d152449517d62c6e327f7a6045f

Download Submit
C:\Windows\System\ewtjwPy.exe

Filesize
1.2MB

MD5
c97cf685d8a4d858f31fd00fcd334a2c

SHA1
5c2b61aae89fa3f715a0826a07214161348b2b4e

SHA256
d8dc6547f08fd5f3b76cb00a9326b3317f194c2f6e839ed59f465e999af39555

SHA512
a36b761af1f851b97e0c6d2001e6afc626abd54172ce434a747657d9f5a1cec7a4446a6e25d738ffac6ca5282529fe46f271817d6dd0cb0d15db3389394bc446

Download Submit
C:\Windows\System\hTsUtmL.exe

Filesize
1.1MB

MD5
4d1f85fbb5c47119c77a1622ffb1f4b6

SHA1
0d9c6f98457f888c4813fab85156faba1a7518e9

SHA256
2f65844a8763ce2cfa902c202a5c000eaabe20fce938667a3909330dd9bba7ef

SHA512
a58534ccc4cb30b97bf21b89c5ece61ea62d54c0df2a6891e4655cb29392ac4688064e3f3fbb31fd8dfb76741d1e28d0022856aec8e1b643d366a2f719b51eb0

Download Submit
C:\Windows\System\hxxpXaq.exe

Filesize
1.1MB

MD5
d65be85f3f6c63c25fb04c4ec8564fba

SHA1
9701bf7375b402ed0b9adfc43fe7c4f4f7d92f0b

SHA256
97c377153eceaaaf5c8405e21362e58770598c2b2392430ad4d83afc80b5d043

SHA512
2b6dbbdb8fd514d5416a722ffd82fdcad7348d1d52ddc0f07ffdd604552eebdb765b6ae37cf0559d747598bbb4de8674e1fec8f2197a2d8da5fa39614c42f227

Download Submit
C:\Windows\System\jftaJdg.exe

Filesize
1.1MB

MD5
0a85c6f11c665c6defd8f072e0a43c7f

SHA1
6b438d9eef8a8d13ba09eb3fdc33897b57b1d3f7

SHA256
1eae4b1102056c08df9d2ce3f8baee87639a4b3f58f8447550aaa3ef4b8a165c

SHA512
3d8a9e2b5418a3c078c753335679720eca38da0780fd75ef9c9e1b9429410c3e5ccd28182510ba973e4b0df97ff68cbbea0591b3b4064507ff438a4bcf8b6158

Download Submit
C:\Windows\System\mUttlXV.exe

Filesize
1.2MB

MD5
122e91fca949d5c045b142aed0d8c264

SHA1
13389bb594e26d692d99eb42abc4cb8bbd27afa1

SHA256
7ca6b955de673e1e1d487481dd2da9a1fba825526a6219007e68972500ddde33

SHA512
dde938588ce47fb1de914614509e4ef6e6d0c9e6f7591691df8bfec74c0d8b94bb31d4cfa4fb6dd5c0cb9131a0beb6ab63186c73f198adf3b6132f259543cd76

Download Submit
C:\Windows\System\mppBthR.exe

Filesize
1.1MB

MD5
31fa607ad157073cb8e8838907319e54

SHA1
be7a085fa6ad703f7ad03b73224e0b89348af220

SHA256
6d9089bbd86f86febda305de2ee0b464fdc216517a873b3977c3cc1c82430fbc

SHA512
5729cd27098ebd8b54c96a9ee57585903d0778149b55bf4107bf7933e63a7d9f5a2a943e643593c1bdbe42dc7f22847cba78fb3b2ceca0268a4988fb6d988c09

Download Submit
C:\Windows\System\nDzObTZ.exe

Filesize
1.2MB

MD5
288aff060808cba24bd6a00e457dae8b

SHA1
1e491c1759703265bdfbc58558821d6053ad28b3

SHA256
66e8432bf09ae24794ccdde4e7baf6818a699beaada512411673f24429e58222

SHA512
ea26a0153ff05e98dcd3c679d5536fda9af8906c34558ef4fed95c36014edc1f1dd54980f819986081faa6b1a6869645ba38fefd2fe256516c57c501247d2f3b

Download Submit
C:\Windows\System\oFNiaoC.exe

Filesize
1.2MB

MD5
52b2069e881e703ea6368f01637d30c0

SHA1
447c7a977285dcda0aa78acd58b64971cfb9b733

SHA256
8233f21002f4fdbbed8ca7438b26c76720c10f9f8e080269e0e4a65d9f8a5354

SHA512
0ecb1cf958e735bee0dc393396c147c41a1953a7751499be60c4b4c6aad06da5e4cf08120b078901a7657278a376c7eb1ff4607578cb9f28e51bb2c3ac1e7543

Download Submit
C:\Windows\System\oYZoaaf.exe

Filesize
1.1MB

MD5
22c710afb3d27befc7e7f3f1db13254c

SHA1
c61fed7e870f6c6f10cdad4add91bf7e70421544

SHA256
8aadf8dda3de270f89ed8aed289f71621a4393541d0ba31e2733958289aec4ff

SHA512
a8804922c32b50d26c03b7d28e4286947a71e69a3dd5058ac28063d05609c79bd7ce033bca04f01654552b4650004c708360295723ed121decec7a5cfa05ff6f

Download Submit
C:\Windows\System\pdUEFcF.exe

Filesize
1.1MB

MD5
0cd1de5eb5eaf3f4d4a866a30ab712b7

SHA1
1175b10be270162ca3eb2f944b92b741e5b761cc

SHA256
cec347e472b1923dd26531c58cd65f7af89f46b06295c2e16ea7334448527f0d

SHA512
b230bcc758678046bfe429ce26ba9214a1d64ff1f93bb899b78a45ebf154a0581903406910923e88b35b9bfb29f4a1b73b2d9ca357aae52a9f8d26375970aeea

Download Submit
C:\Windows\System\tCNpEBX.exe

Filesize
1.2MB

MD5
a42c6b2b07c46aa9209aba5ca124f05f

SHA1
8d6b590b0992a789b832de2682cf1d9089e0013e

SHA256
ecdb3b19b97a73977456beb3fab41963f6502eb2d5ba0bef6557d42655c852d0

SHA512
375f4cff509c9cbb269639105ca59f43220920eaf0969a7db8e7c8694803aacfbc2ab44431a13018f7ec26da652949662e18a8a81fbf53e38b9e1c477ea33b31

Download Submit
C:\Windows\System\vZPnSXk.exe

Filesize
1.2MB

MD5
3af90e69038e45556dd64f93fe50be52

SHA1
eafe20fb21a601300341b157ab2f2d8dba6fa077

SHA256
cc3ee168019432f30ca6f0ca82a4b17b2f301a94655be48b9aea7d09c1b9859a

SHA512
23ea18d9b43fcc8620221193287c15e92a06d7a12d3c4294e4c51544a7491e6c2e2266076226524e3daec6f7927220591197168cf4d7bd1ae3de197dcd63dc22

Download Submit
C:\Windows\System\wTDNBms.exe

Filesize
1.1MB

MD5
e0f2e35a17141a83e03e1b7a56832189

SHA1
a3aa7b539489050ce7ea4e264a852b08faa8f822

SHA256
00c76b6744b64f0aee7db1b4de7e3616b0cb7c6de61a077166db00de5d94ae2d

SHA512
27f819000e333002f84c8fb86853a0d35707e6b56af03af349add02a5ce05f8e58b4069d7e6dc838dc2341fb3aaa2a3503aa508e1fc01ad6eb402f61525ebc5c

Download Submit
C:\Windows\System\yRiLKiw.exe

Filesize
1.1MB

MD5
9450bb3a6f15e6923879da19f0bd9c65

SHA1
a9a417de0c1b39f7beddedc130f93dfe0aaefa1a

SHA256
dd82bb90ba713224dfc4145c956c22583fa37ed67f43b84a41a4a75435cb80a6

SHA512
2748bb460eac9eeeb3ce5f6db4c8e362b34fb82fbe7af7f49bc346cd11e7f8f3400e9f47087bc2ebc7600564b9f3f2666f927be7fc9c5caacca14b3998359ced

Download Submit
C:\Windows\System\zSgJWmJ.exe

Filesize
1.1MB

MD5
0a36ba1a6e10321e1088c84d5b9d5143

SHA1
04f1ce3ef6d98bdca39960a44c49c2ad0ca840c8

SHA256
0b4a83dd4172a2c3e837f98c0560e2e40c70a075ad2c9c6f3f3408359bce8892

SHA512
21e2ce46e4d08e8f726666e5889b95c673eba6dbc5a02ee54ebd3a25f839ffe82e315e9cb486e87cf2bd34110dc6f1ae0767332856b2cd9ae7aa704d9cb19e8f

Download Submit
memory/716-0-0x0000022C554B0000-0x0000022C554C0000-memory.dmp

Filesize
64KB

Download