cobaltstrike | 951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
Size 5.8MB
Sample260824-zbptssck21
SHA256 951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d
MD5 4c0c353fe319ba9de29ac0758731c622
SHA1 6ddfe5ed48babfafed6c2bfffe50ccd287915678
SHA512 7c774447f1b2bde75c69913cbde092b6876275ad306f6051dd54ee69751bd5b69032169f8377b013985ba88d8bc78b17de23215cb0c9cec4dd337b56bc046351
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUi:j+R56utgpPF8u/7i
TLSH
T16C565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor 0 cobaltstrike xmrig miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Cobalt Strike reflective loader 39 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00070000000243dd-10.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243de-24.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243df-29.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e1-38.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e5-66.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e4-63.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e2-60.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e3-57.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e0-39.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243dc-14.dat	cobalt_reflective_dll
behavioral1/files/0x000b000000024321-5.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e6-73.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243ef-111.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f9-169.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243ff-193.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000024400-205.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f2-195.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f1-190.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243fd-186.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243fc-184.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f0-181.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243eb-176.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243fb-175.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243fa-173.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f8-166.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f7-165.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f6-164.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f5-162.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243fe-189.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f4-160.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243f3-159.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243ed-152.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e7-144.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243ea-140.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e9-137.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243ee-124.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243e8-116.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000243ec-149.dat	cobalt_reflective_dll
behavioral1/files/0x0012000000024322-101.dat	cobalt_reflective_dll

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/5084-0-0x00007FF67A1D0000-0x00007FF67A51D000-memory.dmp	xmrig
behavioral1/files/0x00070000000243dd-10.dat	xmrig
behavioral1/files/0x00070000000243de-24.dat	xmrig
behavioral1/files/0x00070000000243df-29.dat	xmrig
behavioral1/files/0x00070000000243e1-38.dat	xmrig
behavioral1/memory/2932-67-0x00007FF77BF40000-0x00007FF77C28D000-memory.dmp	xmrig
behavioral1/files/0x00070000000243e5-66.dat	xmrig
behavioral1/memory/2040-64-0x00007FF652410000-0x00007FF65275D000-memory.dmp	xmrig
behavioral1/files/0x00070000000243e4-63.dat	xmrig
behavioral1/memory/2056-61-0x00007FF6DD9E0000-0x00007FF6DDD2D000-memory.dmp	xmrig
behavioral1/files/0x00070000000243e2-60.dat	xmrig
behavioral1/memory/376-58-0x00007FF7AECD0000-0x00007FF7AF01D000-memory.dmp	xmrig
behavioral1/files/0x00070000000243e3-57.dat	xmrig
behavioral1/memory/3040-55-0x00007FF64B670000-0x00007FF64B9BD000-memory.dmp	xmrig
behavioral1/memory/3116-47-0x00007FF642A70000-0x00007FF642DBD000-memory.dmp	xmrig
behavioral1/files/0x00070000000243e0-39.dat	xmrig
behavioral1/memory/2200-34-0x00007FF66BF10000-0x00007FF66C25D000-memory.dmp	xmrig
behavioral1/memory/1748-25-0x00007FF760370000-0x00007FF7606BD000-memory.dmp	xmrig
behavioral1/memory/3444-18-0x00007FF6C87B0000-0x00007FF6C8AFD000-memory.dmp	xmrig
behavioral1/memory/3964-15-0x00007FF7C3CC0000-0x00007FF7C400D000-memory.dmp	xmrig
behavioral1/files/0x00070000000243dc-14.dat	xmrig
behavioral1/memory/4908-7-0x00007FF6E1FF0000-0x00007FF6E233D000-memory.dmp	xmrig
behavioral1/files/0x000b000000024321-5.dat	xmrig
behavioral1/files/0x00070000000243e6-73.dat	xmrig
behavioral1/files/0x00070000000243ef-111.dat	xmrig
behavioral1/memory/1108-130-0x00007FF6C5790000-0x00007FF6C5ADD000-memory.dmp	xmrig
behavioral1/files/0x00070000000243f9-169.dat	xmrig
behavioral1/files/0x00070000000243ff-193.dat	xmrig
behavioral1/memory/3760-229-0x00007FF6FCCB0000-0x00007FF6FCFFD000-memory.dmp	xmrig
behavioral1/memory/1932-247-0x00007FF70F500000-0x00007FF70F84D000-memory.dmp	xmrig
behavioral1/memory/2800-281-0x00007FF77E630000-0x00007FF77E97D000-memory.dmp	xmrig
behavioral1/memory/2320-346-0x00007FF641580000-0x00007FF6418CD000-memory.dmp	xmrig
behavioral1/memory/2928-344-0x00007FF64D3A0000-0x00007FF64D6ED000-memory.dmp	xmrig
behavioral1/memory/3140-342-0x00007FF6795F0000-0x00007FF67993D000-memory.dmp	xmrig
behavioral1/memory/1532-340-0x00007FF6BA370000-0x00007FF6BA6BD000-memory.dmp	xmrig
behavioral1/memory/2024-338-0x00007FF6979B0000-0x00007FF697CFD000-memory.dmp	xmrig
behavioral1/memory/4276-336-0x00007FF655A50000-0x00007FF655D9D000-memory.dmp	xmrig
behavioral1/memory/220-334-0x00007FF744E10000-0x00007FF74515D000-memory.dmp	xmrig
behavioral1/memory/2960-332-0x00007FF6B41B0000-0x00007FF6B44FD000-memory.dmp	xmrig
behavioral1/memory/3552-279-0x00007FF7F3190000-0x00007FF7F34DD000-memory.dmp	xmrig
behavioral1/memory/3764-277-0x00007FF651FE0000-0x00007FF65232D000-memory.dmp	xmrig
behavioral1/memory/3468-275-0x00007FF7F15E0000-0x00007FF7F192D000-memory.dmp	xmrig
behavioral1/memory/4044-273-0x00007FF737120000-0x00007FF73746D000-memory.dmp	xmrig
behavioral1/memory/4596-271-0x00007FF696A50000-0x00007FF696D9D000-memory.dmp	xmrig
behavioral1/memory/1732-269-0x00007FF629860000-0x00007FF629BAD000-memory.dmp	xmrig
behavioral1/memory/2536-267-0x00007FF72E2D0000-0x00007FF72E61D000-memory.dmp	xmrig
behavioral1/memory/4480-265-0x00007FF7B9780000-0x00007FF7B9ACD000-memory.dmp	xmrig
behavioral1/memory/1992-263-0x00007FF686CD0000-0x00007FF68701D000-memory.dmp	xmrig
behavioral1/memory/1448-261-0x00007FF70E020000-0x00007FF70E36D000-memory.dmp	xmrig
behavioral1/memory/4960-259-0x00007FF7711B0000-0x00007FF7714FD000-memory.dmp	xmrig
behavioral1/memory/3104-257-0x00007FF71C7B0000-0x00007FF71CAFD000-memory.dmp	xmrig
behavioral1/memory/4964-253-0x00007FF601BA0000-0x00007FF601EED000-memory.dmp	xmrig
behavioral1/memory/4984-251-0x00007FF631DB0000-0x00007FF6320FD000-memory.dmp	xmrig
behavioral1/memory/3644-249-0x00007FF767310000-0x00007FF76765D000-memory.dmp	xmrig
behavioral1/memory/1136-241-0x00007FF68AB50000-0x00007FF68AE9D000-memory.dmp	xmrig
behavioral1/memory/4216-238-0x00007FF6888A0000-0x00007FF688BED000-memory.dmp	xmrig
behavioral1/memory/3152-235-0x00007FF643B70000-0x00007FF643EBD000-memory.dmp	xmrig
behavioral1/memory/4808-233-0x00007FF620BB0000-0x00007FF620EFD000-memory.dmp	xmrig
behavioral1/memory/1240-231-0x00007FF6BDA00000-0x00007FF6BDD4D000-memory.dmp	xmrig
behavioral1/memory/2020-226-0x00007FF6273E0000-0x00007FF62772D000-memory.dmp	xmrig
behavioral1/memory/3196-223-0x00007FF6024A0000-0x00007FF6027ED000-memory.dmp	xmrig
behavioral1/memory/4816-216-0x00007FF647AC0000-0x00007FF647E0D000-memory.dmp	xmrig
behavioral1/memory/1380-210-0x00007FF6FEA70000-0x00007FF6FEDBD000-memory.dmp	xmrig
behavioral1/memory/828-206-0x00007FF6DEAB0000-0x00007FF6DEDFD000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4908	APWgReA.exe
3964	RRcpbfW.exe
3444	rTgVsGd.exe
1748	lLErtyT.exe
2200	wafFGlZ.exe
3116	SyEcVju.exe
3040	uvrNHRO.exe
2056	vRYMtfv.exe
376	TReEePa.exe
2040	tvTjzPc.exe
2932	cVDGrBs.exe
2656	siWexiP.exe
4932	HiJaspb.exe
3944	uNtGXHP.exe
2824	dhbwNDG.exe
4952	dqLRDnZ.exe
1784	VTTnrOI.exe
2512	inqRZZL.exe
4340	zcSoCCg.exe
3384	LBKsaWi.exe
1108	BcOejmQ.exe
3232	lrbKeWs.exe
1540	uvvfmsU.exe
2028	KgzTIvM.exe
636	uOQFvsQ.exe
828	JpBXUfY.exe
4816	nUwPoui.exe
1380	LrdBCmh.exe
4628	KpeBqWD.exe
3196	KtMRUzr.exe
2020	UTlnJnb.exe
3760	IrFVhLd.exe
1240	imXzFnq.exe
4216	mVopJMO.exe
4808	LCUXLSR.exe
3152	kEKKdVY.exe
1136	UvkHTIf.exe
1932	wTfhkEm.exe
3644	FGyFKzp.exe
4984	DqOHtmL.exe
4964	mCHALgC.exe
3104	XkoJACA.exe
4960	JSVMFdR.exe
1448	vRBiyWb.exe
1992	AjwytqD.exe
4480	WHIbAol.exe
2536	QYvLGYL.exe
1732	bOtmjCo.exe
4596	hRHWbpg.exe
4044	yBvOunn.exe
3468	LXwQOtA.exe
3764	ROUZzwp.exe
3552	NTRtyeu.exe
2800	asgrstB.exe
1532	TaHEeFq.exe
2960	JbSsAYr.exe
220	ABooAOR.exe
4276	qvIAxmQ.exe
2024	bCEUTSa.exe
3140	RwADDYK.exe
2928	iFKPLJf.exe
2320	HPlvzoA.exe
1588	NVYyuXl.exe
1684	OxJbKUN.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UCmSmDS.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\QVdINBC.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\xRAsaXa.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\EVPzQMu.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\vWGiLtR.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\LwobjmB.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\cFHCeEd.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\YaitajY.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\aaWGybu.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\yUfvubY.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\qCqKkwl.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\rgPPhnC.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\DWMfrLo.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\hbdrjoC.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\juOiMzP.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\vyrPITd.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\kATWKUn.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\sYSuoiB.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\oggsdYF.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\mzJhSnN.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\oSKwWrJ.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\KVgRCHz.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\jbPPaqV.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\DdQzCMy.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\frouZuO.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\ocBRWBI.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\iZMUMXa.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\eWFugok.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\KCKtiyj.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\vdnRNbZ.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\XdgJncO.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\caqTFgQ.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\lcJBMZW.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\fxusbGE.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\tWAHRSf.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\pCRHyuf.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\nonEYrz.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\BAPRRnJ.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\uvrNHRO.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\vHhHLsz.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\sqJuZvO.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\QrLCxJH.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\vStAXfD.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\TReEePa.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\OxJbKUN.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\PFDZzPI.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\XeSMdbU.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\JsXMSJq.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\sEpQkow.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\MnAGCCQ.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\oBpEgNv.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\VGIwRPv.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\wWOTFkR.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\MuDztYp.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\RWvdTrR.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\RejMoXr.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\MOxQTLl.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\FaVyynF.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\gdOlgdE.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\pIlLOyp.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\BqxtYlU.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\qtktNnr.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\xpphzPg.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
File created	C:\Windows\System\TlBuCCj.exe	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4908	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	88
PID 5084 wrote to memory of 3964	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	89
PID 5084 wrote to memory of 3444	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	90
PID 5084 wrote to memory of 1748	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	91
PID 5084 wrote to memory of 2200	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	92
PID 5084 wrote to memory of 3116	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	93
PID 5084 wrote to memory of 3040	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	94
PID 5084 wrote to memory of 2056	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	95
PID 5084 wrote to memory of 376	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	96
PID 5084 wrote to memory of 2040	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	97
PID 5084 wrote to memory of 2932	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	98
PID 5084 wrote to memory of 2656	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	99
PID 5084 wrote to memory of 4932	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	100
PID 5084 wrote to memory of 3944	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	101
PID 5084 wrote to memory of 2824	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	102
PID 5084 wrote to memory of 4952	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	103
PID 5084 wrote to memory of 1784	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	104
PID 5084 wrote to memory of 2512	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	105
PID 5084 wrote to memory of 4340	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	106
PID 5084 wrote to memory of 3384	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	107
PID 5084 wrote to memory of 1108	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	108
PID 5084 wrote to memory of 3232	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	109
PID 5084 wrote to memory of 1540	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	110
PID 5084 wrote to memory of 2028	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	111
PID 5084 wrote to memory of 636	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	112
PID 5084 wrote to memory of 828	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	113
PID 5084 wrote to memory of 4816	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	114
PID 5084 wrote to memory of 1380	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	115
PID 5084 wrote to memory of 4628	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	116
PID 5084 wrote to memory of 3196	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	117
PID 5084 wrote to memory of 2020	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	118
PID 5084 wrote to memory of 3760	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	119
PID 5084 wrote to memory of 1240	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	120
PID 5084 wrote to memory of 4216	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	121
PID 5084 wrote to memory of 4808	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	122
PID 5084 wrote to memory of 3152	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	123
PID 5084 wrote to memory of 1136	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	124
PID 5084 wrote to memory of 1932	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	125
PID 5084 wrote to memory of 3644	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	126
PID 5084 wrote to memory of 4984	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	127
PID 5084 wrote to memory of 4964	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	128
PID 5084 wrote to memory of 3104	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	129
PID 5084 wrote to memory of 4960	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	130
PID 5084 wrote to memory of 1448	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	131
PID 5084 wrote to memory of 1992	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	132
PID 5084 wrote to memory of 4480	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	133
PID 5084 wrote to memory of 2536	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	134
PID 5084 wrote to memory of 1732	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	135
PID 5084 wrote to memory of 4596	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	136
PID 5084 wrote to memory of 4044	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	137
PID 5084 wrote to memory of 3468	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	138
PID 5084 wrote to memory of 3764	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	139
PID 5084 wrote to memory of 3552	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	140
PID 5084 wrote to memory of 2800	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	141
PID 5084 wrote to memory of 1532	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	142
PID 5084 wrote to memory of 2960	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	143
PID 5084 wrote to memory of 220	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	144
PID 5084 wrote to memory of 4276	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	145
PID 5084 wrote to memory of 2024	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	146
PID 5084 wrote to memory of 3140	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	147
PID 5084 wrote to memory of 2928	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	148
PID 5084 wrote to memory of 2320	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	149
PID 5084 wrote to memory of 1588	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	150
PID 5084 wrote to memory of 1684	5084	951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe	151

C:\Users\Admin\AppData\Local\Temp\951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe
"C:\Users\Admin\AppData\Local\Temp\951f4c3b3a69aaae9563aeaad57ff59ce4abe9b02a5c59b8f8c9c768722f679d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System\APWgReA.exe
  C:\Windows\System\APWgReA.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\RRcpbfW.exe
  C:\Windows\System\RRcpbfW.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\rTgVsGd.exe
  C:\Windows\System\rTgVsGd.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\lLErtyT.exe
  C:\Windows\System\lLErtyT.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\wafFGlZ.exe
  C:\Windows\System\wafFGlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\SyEcVju.exe
  C:\Windows\System\SyEcVju.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\uvrNHRO.exe
  C:\Windows\System\uvrNHRO.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\vRYMtfv.exe
  C:\Windows\System\vRYMtfv.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\TReEePa.exe
  C:\Windows\System\TReEePa.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\tvTjzPc.exe
  C:\Windows\System\tvTjzPc.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\cVDGrBs.exe
  C:\Windows\System\cVDGrBs.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\siWexiP.exe
  C:\Windows\System\siWexiP.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\HiJaspb.exe
  C:\Windows\System\HiJaspb.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\uNtGXHP.exe
  C:\Windows\System\uNtGXHP.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\dhbwNDG.exe
  C:\Windows\System\dhbwNDG.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\dqLRDnZ.exe
  C:\Windows\System\dqLRDnZ.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\VTTnrOI.exe
  C:\Windows\System\VTTnrOI.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\inqRZZL.exe
  C:\Windows\System\inqRZZL.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\zcSoCCg.exe
  C:\Windows\System\zcSoCCg.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\LBKsaWi.exe
  C:\Windows\System\LBKsaWi.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\BcOejmQ.exe
  C:\Windows\System\BcOejmQ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\lrbKeWs.exe
  C:\Windows\System\lrbKeWs.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\uvvfmsU.exe
  C:\Windows\System\uvvfmsU.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\KgzTIvM.exe
  C:\Windows\System\KgzTIvM.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\uOQFvsQ.exe
  C:\Windows\System\uOQFvsQ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\JpBXUfY.exe
  C:\Windows\System\JpBXUfY.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\nUwPoui.exe
  C:\Windows\System\nUwPoui.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\LrdBCmh.exe
  C:\Windows\System\LrdBCmh.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\KpeBqWD.exe
  C:\Windows\System\KpeBqWD.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\KtMRUzr.exe
  C:\Windows\System\KtMRUzr.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\UTlnJnb.exe
  C:\Windows\System\UTlnJnb.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\IrFVhLd.exe
  C:\Windows\System\IrFVhLd.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\imXzFnq.exe
  C:\Windows\System\imXzFnq.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\mVopJMO.exe
  C:\Windows\System\mVopJMO.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\LCUXLSR.exe
  C:\Windows\System\LCUXLSR.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\kEKKdVY.exe
  C:\Windows\System\kEKKdVY.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\UvkHTIf.exe
  C:\Windows\System\UvkHTIf.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\wTfhkEm.exe
  C:\Windows\System\wTfhkEm.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\FGyFKzp.exe
  C:\Windows\System\FGyFKzp.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\DqOHtmL.exe
  C:\Windows\System\DqOHtmL.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\mCHALgC.exe
  C:\Windows\System\mCHALgC.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\XkoJACA.exe
  C:\Windows\System\XkoJACA.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\JSVMFdR.exe
  C:\Windows\System\JSVMFdR.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\vRBiyWb.exe
  C:\Windows\System\vRBiyWb.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\AjwytqD.exe
  C:\Windows\System\AjwytqD.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\WHIbAol.exe
  C:\Windows\System\WHIbAol.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\QYvLGYL.exe
  C:\Windows\System\QYvLGYL.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\bOtmjCo.exe
  C:\Windows\System\bOtmjCo.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\hRHWbpg.exe
  C:\Windows\System\hRHWbpg.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\yBvOunn.exe
  C:\Windows\System\yBvOunn.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\LXwQOtA.exe
  C:\Windows\System\LXwQOtA.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\ROUZzwp.exe
  C:\Windows\System\ROUZzwp.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\NTRtyeu.exe
  C:\Windows\System\NTRtyeu.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\asgrstB.exe
  C:\Windows\System\asgrstB.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\TaHEeFq.exe
  C:\Windows\System\TaHEeFq.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\JbSsAYr.exe
  C:\Windows\System\JbSsAYr.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ABooAOR.exe
  C:\Windows\System\ABooAOR.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\qvIAxmQ.exe
  C:\Windows\System\qvIAxmQ.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\bCEUTSa.exe
  C:\Windows\System\bCEUTSa.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\RwADDYK.exe
  C:\Windows\System\RwADDYK.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\iFKPLJf.exe
  C:\Windows\System\iFKPLJf.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\HPlvzoA.exe
  C:\Windows\System\HPlvzoA.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\NVYyuXl.exe
  C:\Windows\System\NVYyuXl.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\OxJbKUN.exe
  C:\Windows\System\OxJbKUN.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\yVykYVz.exe
  C:\Windows\System\yVykYVz.exe
  2⤵
  PID:3656
- C:\Windows\System\ySTtKFK.exe
  C:\Windows\System\ySTtKFK.exe
  2⤵
  PID:4820
- C:\Windows\System\SjmIGLD.exe
  C:\Windows\System\SjmIGLD.exe
  2⤵
  PID:1664
- C:\Windows\System\BACTRNQ.exe
  C:\Windows\System\BACTRNQ.exe
  2⤵
  PID:2588
- C:\Windows\System\SliroiH.exe
  C:\Windows\System\SliroiH.exe
  2⤵
  PID:1372
- C:\Windows\System\wcfnOfV.exe
  C:\Windows\System\wcfnOfV.exe
  2⤵
  PID:4584
- C:\Windows\System\TcRCLeh.exe
  C:\Windows\System\TcRCLeh.exe
  2⤵
  PID:456
- C:\Windows\System\QqtlrLQ.exe
  C:\Windows\System\QqtlrLQ.exe
  2⤵
  PID:4692
- C:\Windows\System\EjHbAkJ.exe
  C:\Windows\System\EjHbAkJ.exe
  2⤵
  PID:2080
- C:\Windows\System\VLAzqzp.exe
  C:\Windows\System\VLAzqzp.exe
  2⤵
  PID:1616
- C:\Windows\System\HINwuAg.exe
  C:\Windows\System\HINwuAg.exe
  2⤵
  PID:2432
- C:\Windows\System\zvCpCHo.exe
  C:\Windows\System\zvCpCHo.exe
  2⤵
  PID:732
- C:\Windows\System\UCmSmDS.exe
  C:\Windows\System\UCmSmDS.exe
  2⤵
  PID:4564
- C:\Windows\System\WSfTOkP.exe
  C:\Windows\System\WSfTOkP.exe
  2⤵
  PID:4060
- C:\Windows\System\nwsihZp.exe
  C:\Windows\System\nwsihZp.exe
  2⤵
  PID:3560
- C:\Windows\System\IUGosjj.exe
  C:\Windows\System\IUGosjj.exe
  2⤵
  PID:5440
- C:\Windows\System\PFDZzPI.exe
  C:\Windows\System\PFDZzPI.exe
  2⤵
  PID:5464
- C:\Windows\System\Uqsqhgn.exe
  C:\Windows\System\Uqsqhgn.exe
  2⤵
  PID:5484
- C:\Windows\System\IxaCkTR.exe
  C:\Windows\System\IxaCkTR.exe
  2⤵
  PID:5500
- C:\Windows\System\QkelVFI.exe
  C:\Windows\System\QkelVFI.exe
  2⤵
  PID:5520
- C:\Windows\System\mYzgCrl.exe
  C:\Windows\System\mYzgCrl.exe
  2⤵
  PID:5536
- C:\Windows\System\zWtMLYH.exe
  C:\Windows\System\zWtMLYH.exe
  2⤵
  PID:5552
- C:\Windows\System\wieQLpc.exe
  C:\Windows\System\wieQLpc.exe
  2⤵
  PID:5572
- C:\Windows\System\PkfRzAm.exe
  C:\Windows\System\PkfRzAm.exe
  2⤵
  PID:5588
- C:\Windows\System\YGtTPZX.exe
  C:\Windows\System\YGtTPZX.exe
  2⤵
  PID:5604
- C:\Windows\System\ydftxpe.exe
  C:\Windows\System\ydftxpe.exe
  2⤵
  PID:5624
- C:\Windows\System\XzPfVPX.exe
  C:\Windows\System\XzPfVPX.exe
  2⤵
  PID:5640
- C:\Windows\System\PJBIcAr.exe
  C:\Windows\System\PJBIcAr.exe
  2⤵
  PID:5660
- C:\Windows\System\cBfaduX.exe
  C:\Windows\System\cBfaduX.exe
  2⤵
  PID:5676
- C:\Windows\System\yzDRJFo.exe
  C:\Windows\System\yzDRJFo.exe
  2⤵
  PID:5692
- C:\Windows\System\hbdrjoC.exe
  C:\Windows\System\hbdrjoC.exe
  2⤵
  PID:5708
- C:\Windows\System\GnXMqEa.exe
  C:\Windows\System\GnXMqEa.exe
  2⤵
  PID:5728
- C:\Windows\System\CnwqzoH.exe
  C:\Windows\System\CnwqzoH.exe
  2⤵
  PID:5752
- C:\Windows\System\SFEJUux.exe
  C:\Windows\System\SFEJUux.exe
  2⤵
  PID:5776
- C:\Windows\System\FqjpREB.exe
  C:\Windows\System\FqjpREB.exe
  2⤵
  PID:5800
- C:\Windows\System\pYJicTW.exe
  C:\Windows\System\pYJicTW.exe
  2⤵
  PID:5816
- C:\Windows\System\qrdSDch.exe
  C:\Windows\System\qrdSDch.exe
  2⤵
  PID:5840
- C:\Windows\System\zsqngPa.exe
  C:\Windows\System\zsqngPa.exe
  2⤵
  PID:5864
- C:\Windows\System\WsSjiCP.exe
  C:\Windows\System\WsSjiCP.exe
  2⤵
  PID:5892
- C:\Windows\System\ybUMsGv.exe
  C:\Windows\System\ybUMsGv.exe
  2⤵
  PID:5908
- C:\Windows\System\WdOUevo.exe
  C:\Windows\System\WdOUevo.exe
  2⤵
  PID:5924
- C:\Windows\System\vloqUBW.exe
  C:\Windows\System\vloqUBW.exe
  2⤵
  PID:5944
- C:\Windows\System\hXvYWfO.exe
  C:\Windows\System\hXvYWfO.exe
  2⤵
  PID:5960
- C:\Windows\System\uuEyYxj.exe
  C:\Windows\System\uuEyYxj.exe
  2⤵
  PID:5976
- C:\Windows\System\MTzSzdB.exe
  C:\Windows\System\MTzSzdB.exe
  2⤵
  PID:5996
- C:\Windows\System\JlNVsrx.exe
  C:\Windows\System\JlNVsrx.exe
  2⤵
  PID:6016
- C:\Windows\System\jessSKk.exe
  C:\Windows\System\jessSKk.exe
  2⤵
  PID:6040
- C:\Windows\System\uuDSmYG.exe
  C:\Windows\System\uuDSmYG.exe
  2⤵
  PID:6064
- C:\Windows\System\VOnfxxN.exe
  C:\Windows\System\VOnfxxN.exe
  2⤵
  PID:6096
- C:\Windows\System\eMerCHJ.exe
  C:\Windows\System\eMerCHJ.exe
  2⤵
  PID:6124
- C:\Windows\System\nPIWzHD.exe
  C:\Windows\System\nPIWzHD.exe
  2⤵
  PID:6140
- C:\Windows\System\QIkZcHs.exe
  C:\Windows\System\QIkZcHs.exe
  2⤵
  PID:2368
- C:\Windows\System\rdFYSWw.exe
  C:\Windows\System\rdFYSWw.exe
  2⤵
  PID:2992
- C:\Windows\System\JlCjgvR.exe
  C:\Windows\System\JlCjgvR.exe
  2⤵
  PID:2664
- C:\Windows\System\VZAaAEB.exe
  C:\Windows\System\VZAaAEB.exe
  2⤵
  PID:3780
- C:\Windows\System\tLjqTxr.exe
  C:\Windows\System\tLjqTxr.exe
  2⤵
  PID:5116
- C:\Windows\System\iBTzpkr.exe
  C:\Windows\System\iBTzpkr.exe
  2⤵
  PID:2668
- C:\Windows\System\cUBYTrD.exe
  C:\Windows\System\cUBYTrD.exe
  2⤵
  PID:3968
- C:\Windows\System\keOHxSl.exe
  C:\Windows\System\keOHxSl.exe
  2⤵
  PID:5100
- C:\Windows\System\xSWXOHz.exe
  C:\Windows\System\xSWXOHz.exe
  2⤵
  PID:2216
- C:\Windows\System\jgcAyVM.exe
  C:\Windows\System\jgcAyVM.exe
  2⤵
  PID:3280
- C:\Windows\System\XeSMdbU.exe
  C:\Windows\System\XeSMdbU.exe
  2⤵
  PID:5136
- C:\Windows\System\pLUSGzy.exe
  C:\Windows\System\pLUSGzy.exe
  2⤵
  PID:5160
- C:\Windows\System\daesFHy.exe
  C:\Windows\System\daesFHy.exe
  2⤵
  PID:5196
- C:\Windows\System\oAbuhOS.exe
  C:\Windows\System\oAbuhOS.exe
  2⤵
  PID:5232
- C:\Windows\System\VGIwRPv.exe
  C:\Windows\System\VGIwRPv.exe
  2⤵
  PID:5268
- C:\Windows\System\TubjkiS.exe
  C:\Windows\System\TubjkiS.exe
  2⤵
  PID:5292
- C:\Windows\System\MbVKbnT.exe
  C:\Windows\System\MbVKbnT.exe
  2⤵
  PID:5320
- C:\Windows\System\BTnkOVF.exe
  C:\Windows\System\BTnkOVF.exe
  2⤵
  PID:1412
- C:\Windows\System\lPLoJlO.exe
  C:\Windows\System\lPLoJlO.exe
  2⤵
  PID:4472
- C:\Windows\System\AfttQjL.exe
  C:\Windows\System\AfttQjL.exe
  2⤵
  PID:4308
- C:\Windows\System\mXoaucK.exe
  C:\Windows\System\mXoaucK.exe
  2⤵
  PID:2448
- C:\Windows\System\BmYMIde.exe
  C:\Windows\System\BmYMIde.exe
  2⤵
  PID:3592
- C:\Windows\System\mOYfEIb.exe
  C:\Windows\System\mOYfEIb.exe
  2⤵
  PID:3052
- C:\Windows\System\wWOTFkR.exe
  C:\Windows\System\wWOTFkR.exe
  2⤵
  PID:3732
- C:\Windows\System\TIzPAMz.exe
  C:\Windows\System\TIzPAMz.exe
  2⤵
  PID:1356
- C:\Windows\System\XSuGDaK.exe
  C:\Windows\System\XSuGDaK.exe
  2⤵
  PID:1428
- C:\Windows\System\lkGJHJS.exe
  C:\Windows\System\lkGJHJS.exe
  2⤵
  PID:1264
- C:\Windows\System\tRhiIas.exe
  C:\Windows\System\tRhiIas.exe
  2⤵
  PID:4312
- C:\Windows\System\RiMuNIR.exe
  C:\Windows\System\RiMuNIR.exe
  2⤵
  PID:4652
- C:\Windows\System\hsPlBLa.exe
  C:\Windows\System\hsPlBLa.exe
  2⤵
  PID:2016
- C:\Windows\System\rVVmxcd.exe
  C:\Windows\System\rVVmxcd.exe
  2⤵
  PID:2892
- C:\Windows\System\HRwMlhO.exe
  C:\Windows\System\HRwMlhO.exe
  2⤵
  PID:3028
- C:\Windows\System\ZYuEFUN.exe
  C:\Windows\System\ZYuEFUN.exe
  2⤵
  PID:3520
- C:\Windows\System\JcLJfqz.exe
  C:\Windows\System\JcLJfqz.exe
  2⤵
  PID:2480
- C:\Windows\System\ABcTHBT.exe
  C:\Windows\System\ABcTHBT.exe
  2⤵
  PID:4896
- C:\Windows\System\uJtWKxK.exe
  C:\Windows\System\uJtWKxK.exe
  2⤵
  PID:1724
- C:\Windows\System\WMOXLfY.exe
  C:\Windows\System\WMOXLfY.exe
  2⤵
  PID:4488
- C:\Windows\System\xCeHhlV.exe
  C:\Windows\System\xCeHhlV.exe
  2⤵
  PID:3412
- C:\Windows\System\NsoXlll.exe
  C:\Windows\System\NsoXlll.exe
  2⤵
  PID:4256
- C:\Windows\System\ipIcGma.exe
  C:\Windows\System\ipIcGma.exe
  2⤵
  PID:436
- C:\Windows\System\XgSkYsT.exe
  C:\Windows\System\XgSkYsT.exe
  2⤵
  PID:464
- C:\Windows\System\zLyoMHH.exe
  C:\Windows\System\zLyoMHH.exe
  2⤵
  PID:2252
- C:\Windows\System\uWCQzFH.exe
  C:\Windows\System\uWCQzFH.exe
  2⤵
  PID:1068
- C:\Windows\System\vvGaNQM.exe
  C:\Windows\System\vvGaNQM.exe
  2⤵
  PID:2540
- C:\Windows\System\WafLKRs.exe
  C:\Windows\System\WafLKRs.exe
  2⤵
  PID:2060
- C:\Windows\System\JUZPvJb.exe
  C:\Windows\System\JUZPvJb.exe
  2⤵
  PID:4048
- C:\Windows\System\ztbUzVo.exe
  C:\Windows\System\ztbUzVo.exe
  2⤵
  PID:1796
- C:\Windows\System\YUhsnvX.exe
  C:\Windows\System\YUhsnvX.exe
  2⤵
  PID:3160
- C:\Windows\System\eRsTRdn.exe
  C:\Windows\System\eRsTRdn.exe
  2⤵
  PID:4148
- C:\Windows\System\jTGyHlE.exe
  C:\Windows\System\jTGyHlE.exe
  2⤵
  PID:752
- C:\Windows\System\OaujmJZ.exe
  C:\Windows\System\OaujmJZ.exe
  2⤵
  PID:3720
- C:\Windows\System\zbcnUIo.exe
  C:\Windows\System\zbcnUIo.exe
  2⤵
  PID:804
- C:\Windows\System\gvBChAH.exe
  C:\Windows\System\gvBChAH.exe
  2⤵
  PID:4108
- C:\Windows\System\nwBeHtQ.exe
  C:\Windows\System\nwBeHtQ.exe
  2⤵
  PID:396
- C:\Windows\System\CCLgsVA.exe
  C:\Windows\System\CCLgsVA.exe
  2⤵
  PID:3976
- C:\Windows\System\COvxDGf.exe
  C:\Windows\System\COvxDGf.exe
  2⤵
  PID:4132
- C:\Windows\System\hADYrjS.exe
  C:\Windows\System\hADYrjS.exe
  2⤵
  PID:2524
- C:\Windows\System\iKsmExb.exe
  C:\Windows\System\iKsmExb.exe
  2⤵
  PID:2688
- C:\Windows\System\AXqBaOD.exe
  C:\Windows\System\AXqBaOD.exe
  2⤵
  PID:3516
- C:\Windows\System\nlubvLA.exe
  C:\Windows\System\nlubvLA.exe
  2⤵
  PID:1064
- C:\Windows\System\UxkfhUF.exe
  C:\Windows\System\UxkfhUF.exe
  2⤵
  PID:4444
- C:\Windows\System\ZYPDKJw.exe
  C:\Windows\System\ZYPDKJw.exe
  2⤵
  PID:4020
- C:\Windows\System\IClXNEJ.exe
  C:\Windows\System\IClXNEJ.exe
  2⤵
  PID:2112
- C:\Windows\System\MvooIpG.exe
  C:\Windows\System\MvooIpG.exe
  2⤵
  PID:5560
- C:\Windows\System\fjMPzhH.exe
  C:\Windows\System\fjMPzhH.exe
  2⤵
  PID:3360
- C:\Windows\System\HiIUSce.exe
  C:\Windows\System\HiIUSce.exe
  2⤵
  PID:5616
- C:\Windows\System\ojFCOcf.exe
  C:\Windows\System\ojFCOcf.exe
  2⤵
  PID:5656
- C:\Windows\System\uixNoRH.exe
  C:\Windows\System\uixNoRH.exe
  2⤵
  PID:4720
- C:\Windows\System\qOooWcU.exe
  C:\Windows\System\qOooWcU.exe
  2⤵
  PID:1080
- C:\Windows\System\beHUHWV.exe
  C:\Windows\System\beHUHWV.exe
  2⤵
  PID:5584
- C:\Windows\System\QVdINBC.exe
  C:\Windows\System\QVdINBC.exe
  2⤵
  PID:5648
- C:\Windows\System\juOiMzP.exe
  C:\Windows\System\juOiMzP.exe
  2⤵
  PID:4400
- C:\Windows\System\NNKQKxW.exe
  C:\Windows\System\NNKQKxW.exe
  2⤵
  PID:5544
- C:\Windows\System\lmJtUKP.exe
  C:\Windows\System\lmJtUKP.exe
  2⤵
  PID:5848
- C:\Windows\System\LejssRb.exe
  C:\Windows\System\LejssRb.exe
  2⤵
  PID:5876
- C:\Windows\System\EzhzALZ.exe
  C:\Windows\System\EzhzALZ.exe
  2⤵
  PID:5716
- C:\Windows\System\ezaxXXE.exe
  C:\Windows\System\ezaxXXE.exe
  2⤵
  PID:5744
- C:\Windows\System\hUdGwKH.exe
  C:\Windows\System\hUdGwKH.exe
  2⤵
  PID:5988
- C:\Windows\System\NtoUIbp.exe
  C:\Windows\System\NtoUIbp.exe
  2⤵
  PID:6012
- C:\Windows\System\lpaKiNK.exe
  C:\Windows\System\lpaKiNK.exe
  2⤵
  PID:6056
- C:\Windows\System\HWxyStl.exe
  C:\Windows\System\HWxyStl.exe
  2⤵
  PID:6136
- C:\Windows\System\Tciigwh.exe
  C:\Windows\System\Tciigwh.exe
  2⤵
  PID:548
- C:\Windows\System\KEXrGbO.exe
  C:\Windows\System\KEXrGbO.exe
  2⤵
  PID:1608
- C:\Windows\System\YaYyzGX.exe
  C:\Windows\System\YaYyzGX.exe
  2⤵
  PID:4460
- C:\Windows\System\WjaXXWV.exe
  C:\Windows\System\WjaXXWV.exe
  2⤵
  PID:5932
- C:\Windows\System\BiGLWMG.exe
  C:\Windows\System\BiGLWMG.exe
  2⤵
  PID:3312
- C:\Windows\System\BVqvmnZ.exe
  C:\Windows\System\BVqvmnZ.exe
  2⤵
  PID:4484
- C:\Windows\System\TrdWTiT.exe
  C:\Windows\System\TrdWTiT.exe
  2⤵
  PID:5124
- C:\Windows\System\SrMSEYa.exe
  C:\Windows\System\SrMSEYa.exe
  2⤵
  PID:5208
- C:\Windows\System\cIZHFLn.exe
  C:\Windows\System\cIZHFLn.exe
  2⤵
  PID:5244
- C:\Windows\System\HnpOBhs.exe
  C:\Windows\System\HnpOBhs.exe
  2⤵
  PID:5304
- C:\Windows\System\SWLAUzY.exe
  C:\Windows\System\SWLAUzY.exe
  2⤵
  PID:856
- C:\Windows\System\HqwVVyc.exe
  C:\Windows\System\HqwVVyc.exe
  2⤵
  PID:3812
- C:\Windows\System\eJoQQOD.exe
  C:\Windows\System\eJoQQOD.exe
  2⤵
  PID:3924
- C:\Windows\System\nrZHAJK.exe
  C:\Windows\System\nrZHAJK.exe
  2⤵
  PID:800
- C:\Windows\System\HFNONkc.exe
  C:\Windows\System\HFNONkc.exe
  2⤵
  PID:3748
- C:\Windows\System\aijhnix.exe
  C:\Windows\System\aijhnix.exe
  2⤵
  PID:4204
- C:\Windows\System\izVDVyx.exe
  C:\Windows\System\izVDVyx.exe
  2⤵
  PID:4092
- C:\Windows\System\BmLMsuX.exe
  C:\Windows\System\BmLMsuX.exe
  2⤵
  PID:1776
- C:\Windows\System\rCRDaoH.exe
  C:\Windows\System\rCRDaoH.exe
  2⤵
  PID:1760
- C:\Windows\System\qTEFNmP.exe
  C:\Windows\System\qTEFNmP.exe
  2⤵
  PID:4152
- C:\Windows\System\yPEaAUK.exe
  C:\Windows\System\yPEaAUK.exe
  2⤵
  PID:2636
- C:\Windows\System\ZyDkopZ.exe
  C:\Windows\System\ZyDkopZ.exe
  2⤵
  PID:2716
- C:\Windows\System\WNIcqiZ.exe
  C:\Windows\System\WNIcqiZ.exe
  2⤵
  PID:2556
- C:\Windows\System\TgYvtIx.exe
  C:\Windows\System\TgYvtIx.exe
  2⤵
  PID:2660
- C:\Windows\System\ocBRWBI.exe
  C:\Windows\System\ocBRWBI.exe
  2⤵
  PID:4056
- C:\Windows\System\WTZgrlZ.exe
  C:\Windows\System\WTZgrlZ.exe
  2⤵
  PID:864
- C:\Windows\System\cFHCeEd.exe
  C:\Windows\System\cFHCeEd.exe
  2⤵
  PID:3596
- C:\Windows\System\oIaCXnO.exe
  C:\Windows\System\oIaCXnO.exe
  2⤵
  PID:1840
- C:\Windows\System\VjnCwJW.exe
  C:\Windows\System\VjnCwJW.exe
  2⤵
  PID:4220
- C:\Windows\System\OgIcpWs.exe
  C:\Windows\System\OgIcpWs.exe
  2⤵
  PID:6160
- C:\Windows\System\lOeTIYB.exe
  C:\Windows\System\lOeTIYB.exe
  2⤵
  PID:6188
- C:\Windows\System\OSIfbGy.exe
  C:\Windows\System\OSIfbGy.exe
  2⤵
  PID:6208
- C:\Windows\System\xpphzPg.exe
  C:\Windows\System\xpphzPg.exe
  2⤵
  PID:6224
- C:\Windows\System\dZKpFXW.exe
  C:\Windows\System\dZKpFXW.exe
  2⤵
  PID:6240
- C:\Windows\System\bjKZoZU.exe
  C:\Windows\System\bjKZoZU.exe
  2⤵
  PID:6256
- C:\Windows\System\ODwLDfY.exe
  C:\Windows\System\ODwLDfY.exe
  2⤵
  PID:6272
- C:\Windows\System\TlBuCCj.exe
  C:\Windows\System\TlBuCCj.exe
  2⤵
  PID:6288
- C:\Windows\System\OWBaAGX.exe
  C:\Windows\System\OWBaAGX.exe
  2⤵
  PID:6312
- C:\Windows\System\CxVaHaO.exe
  C:\Windows\System\CxVaHaO.exe
  2⤵
  PID:6328
- C:\Windows\System\ssTwMRf.exe
  C:\Windows\System\ssTwMRf.exe
  2⤵
  PID:6344
- C:\Windows\System\eMJfdWi.exe
  C:\Windows\System\eMJfdWi.exe
  2⤵
  PID:6360
- C:\Windows\System\zbkbxHk.exe
  C:\Windows\System\zbkbxHk.exe
  2⤵
  PID:6380
- C:\Windows\System\xRAsaXa.exe
  C:\Windows\System\xRAsaXa.exe
  2⤵
  PID:6400
- C:\Windows\System\vnzdvtk.exe
  C:\Windows\System\vnzdvtk.exe
  2⤵
  PID:6416
- C:\Windows\System\EPoAIwm.exe
  C:\Windows\System\EPoAIwm.exe
  2⤵
  PID:6436
- C:\Windows\System\rEBENVZ.exe
  C:\Windows\System\rEBENVZ.exe
  2⤵
  PID:6456
- C:\Windows\System\XKGCMsi.exe
  C:\Windows\System\XKGCMsi.exe
  2⤵
  PID:6472
- C:\Windows\System\ePVfYPI.exe
  C:\Windows\System\ePVfYPI.exe
  2⤵
  PID:6488
- C:\Windows\System\pGqHtaZ.exe
  C:\Windows\System\pGqHtaZ.exe
  2⤵
  PID:6504
- C:\Windows\System\LaJDWgI.exe
  C:\Windows\System\LaJDWgI.exe
  2⤵
  PID:6528
- C:\Windows\System\LvALlSX.exe
  C:\Windows\System\LvALlSX.exe
  2⤵
  PID:6544
- C:\Windows\System\qgXiYth.exe
  C:\Windows\System\qgXiYth.exe
  2⤵
  PID:6560
- C:\Windows\System\oknwTnA.exe
  C:\Windows\System\oknwTnA.exe
  2⤵
  PID:6576
- C:\Windows\System\JsXMSJq.exe
  C:\Windows\System\JsXMSJq.exe
  2⤵
  PID:6592
- C:\Windows\System\QIeUiBn.exe
  C:\Windows\System\QIeUiBn.exe
  2⤵
  PID:6608
- C:\Windows\System\ZudEBmM.exe
  C:\Windows\System\ZudEBmM.exe
  2⤵
  PID:6632
- C:\Windows\System\xDhXWpO.exe
  C:\Windows\System\xDhXWpO.exe
  2⤵
  PID:6656
- C:\Windows\System\OTRBdKR.exe
  C:\Windows\System\OTRBdKR.exe
  2⤵
  PID:6684
- C:\Windows\System\vDLDLCL.exe
  C:\Windows\System\vDLDLCL.exe
  2⤵
  PID:6708
- C:\Windows\System\AHEmZcK.exe
  C:\Windows\System\AHEmZcK.exe
  2⤵
  PID:6732
- C:\Windows\System\bObUwiv.exe
  C:\Windows\System\bObUwiv.exe
  2⤵
  PID:6760
- C:\Windows\System\aUbcqJD.exe
  C:\Windows\System\aUbcqJD.exe
  2⤵
  PID:6780
- C:\Windows\System\AiwBfWm.exe
  C:\Windows\System\AiwBfWm.exe
  2⤵
  PID:6808
- C:\Windows\System\dOdJzpy.exe
  C:\Windows\System\dOdJzpy.exe
  2⤵
  PID:6832
- C:\Windows\System\hEAIxhB.exe
  C:\Windows\System\hEAIxhB.exe
  2⤵
  PID:6860
- C:\Windows\System\jhoAoEZ.exe
  C:\Windows\System\jhoAoEZ.exe
  2⤵
  PID:6876
- C:\Windows\System\gDldIVC.exe
  C:\Windows\System\gDldIVC.exe
  2⤵
  PID:6896
- C:\Windows\System\gCPFhGI.exe
  C:\Windows\System\gCPFhGI.exe
  2⤵
  PID:6920
- C:\Windows\System\IogclHw.exe
  C:\Windows\System\IogclHw.exe
  2⤵
  PID:6936
- C:\Windows\System\mGAHnSg.exe
  C:\Windows\System\mGAHnSg.exe
  2⤵
  PID:6960
- C:\Windows\System\jLrEVhm.exe
  C:\Windows\System\jLrEVhm.exe
  2⤵
  PID:6984
- C:\Windows\System\sHGnSKa.exe
  C:\Windows\System\sHGnSKa.exe
  2⤵
  PID:7000
- C:\Windows\System\CCmbKlE.exe
  C:\Windows\System\CCmbKlE.exe
  2⤵
  PID:7016
- C:\Windows\System\mENOJAw.exe
  C:\Windows\System\mENOJAw.exe
  2⤵
  PID:7036
- C:\Windows\System\aJqINvM.exe
  C:\Windows\System\aJqINvM.exe
  2⤵
  PID:7052
- C:\Windows\System\jWyJxFY.exe
  C:\Windows\System\jWyJxFY.exe
  2⤵
  PID:7068
- C:\Windows\System\HHFgpdO.exe
  C:\Windows\System\HHFgpdO.exe
  2⤵
  PID:7088
- C:\Windows\System\ZcDkrQh.exe
  C:\Windows\System\ZcDkrQh.exe
  2⤵
  PID:7108
- C:\Windows\System\tjgEVgu.exe
  C:\Windows\System\tjgEVgu.exe
  2⤵
  PID:7128
- C:\Windows\System\KVgRCHz.exe
  C:\Windows\System\KVgRCHz.exe
  2⤵
  PID:7144
- C:\Windows\System\woWlmvs.exe
  C:\Windows\System\woWlmvs.exe
  2⤵
  PID:7160
- C:\Windows\System\yQTkSyt.exe
  C:\Windows\System\yQTkSyt.exe
  2⤵
  PID:1620
- C:\Windows\System\UENGkmv.exe
  C:\Windows\System\UENGkmv.exe
  2⤵
  PID:4024
- C:\Windows\System\IYIUnXC.exe
  C:\Windows\System\IYIUnXC.exe
  2⤵
  PID:1212
- C:\Windows\System\vyrPITd.exe
  C:\Windows\System\vyrPITd.exe
  2⤵
  PID:5088
- C:\Windows\System\LXdjPnx.exe
  C:\Windows\System\LXdjPnx.exe
  2⤵
  PID:4620
- C:\Windows\System\nFfFaTx.exe
  C:\Windows\System\nFfFaTx.exe
  2⤵
  PID:2172
- C:\Windows\System\fBmYcKf.exe
  C:\Windows\System\fBmYcKf.exe
  2⤵
  PID:4360
- C:\Windows\System\XdKDUgl.exe
  C:\Windows\System\XdKDUgl.exe
  2⤵
  PID:5612
- C:\Windows\System\Jxafsgy.exe
  C:\Windows\System\Jxafsgy.exe
  2⤵
  PID:3344
- C:\Windows\System\IQBJUac.exe
  C:\Windows\System\IQBJUac.exe
  2⤵
  PID:5704
- C:\Windows\System\zmzdHnk.exe
  C:\Windows\System\zmzdHnk.exe
  2⤵
  PID:5668
- C:\Windows\System\vHhHLsz.exe
  C:\Windows\System\vHhHLsz.exe
  2⤵
  PID:5860
- C:\Windows\System\OiMUPLN.exe
  C:\Windows\System\OiMUPLN.exe
  2⤵
  PID:5904
- C:\Windows\System\jgxPZVn.exe
  C:\Windows\System\jgxPZVn.exe
  2⤵
  PID:5956
- C:\Windows\System\rNQBHSg.exe
  C:\Windows\System\rNQBHSg.exe
  2⤵
  PID:6004
- C:\Windows\System\YjChqrI.exe
  C:\Windows\System\YjChqrI.exe
  2⤵
  PID:6080
- C:\Windows\System\QdQdKLS.exe
  C:\Windows\System\QdQdKLS.exe
  2⤵
  PID:2488
- C:\Windows\System\rBBeCJC.exe
  C:\Windows\System\rBBeCJC.exe
  2⤵
  PID:3308
- C:\Windows\System\vxGYIba.exe
  C:\Windows\System\vxGYIba.exe
  2⤵
  PID:432
- C:\Windows\System\KrKAGTt.exe
  C:\Windows\System\KrKAGTt.exe
  2⤵
  PID:7172
- C:\Windows\System\jZyInQW.exe
  C:\Windows\System\jZyInQW.exe
  2⤵
  PID:7192
- C:\Windows\System\WKeGuvU.exe
  C:\Windows\System\WKeGuvU.exe
  2⤵
  PID:7208
- C:\Windows\System\qcTnCVX.exe
  C:\Windows\System\qcTnCVX.exe
  2⤵
  PID:7228
- C:\Windows\System\fZvwGMS.exe
  C:\Windows\System\fZvwGMS.exe
  2⤵
  PID:7244
- C:\Windows\System\NMqPesb.exe
  C:\Windows\System\NMqPesb.exe
  2⤵
  PID:7264
- C:\Windows\System\YisAaGT.exe
  C:\Windows\System\YisAaGT.exe
  2⤵
  PID:7280
- C:\Windows\System\QcNqNjk.exe
  C:\Windows\System\QcNqNjk.exe
  2⤵
  PID:7300
- C:\Windows\System\TAiMfSb.exe
  C:\Windows\System\TAiMfSb.exe
  2⤵
  PID:7320
- C:\Windows\System\YshFQUl.exe
  C:\Windows\System\YshFQUl.exe
  2⤵
  PID:7336
- C:\Windows\System\IQXUgZX.exe
  C:\Windows\System\IQXUgZX.exe
  2⤵
  PID:7356
- C:\Windows\System\kATWKUn.exe
  C:\Windows\System\kATWKUn.exe
  2⤵
  PID:7372
- C:\Windows\System\ciWHgmY.exe
  C:\Windows\System\ciWHgmY.exe
  2⤵
  PID:7388
- C:\Windows\System\dfNljHr.exe
  C:\Windows\System\dfNljHr.exe
  2⤵
  PID:7404
- C:\Windows\System\UCKLUSC.exe
  C:\Windows\System\UCKLUSC.exe
  2⤵
  PID:7424
- C:\Windows\System\OyglWey.exe
  C:\Windows\System\OyglWey.exe
  2⤵
  PID:7440
- C:\Windows\System\gTwCsLf.exe
  C:\Windows\System\gTwCsLf.exe
  2⤵
  PID:7456
- C:\Windows\System\IvocnFC.exe
  C:\Windows\System\IvocnFC.exe
  2⤵
  PID:7472
- C:\Windows\System\umgXfJr.exe
  C:\Windows\System\umgXfJr.exe
  2⤵
  PID:7488
- C:\Windows\System\sYSuoiB.exe
  C:\Windows\System\sYSuoiB.exe
  2⤵
  PID:7504
- C:\Windows\System\GXjMQhO.exe
  C:\Windows\System\GXjMQhO.exe
  2⤵
  PID:7524
- C:\Windows\System\JJslHzh.exe
  C:\Windows\System\JJslHzh.exe
  2⤵
  PID:7540
- C:\Windows\System\JIlxQsI.exe
  C:\Windows\System\JIlxQsI.exe
  2⤵
  PID:7556
- C:\Windows\System\BJIrTWB.exe
  C:\Windows\System\BJIrTWB.exe
  2⤵
  PID:7572
- C:\Windows\System\bAqIiht.exe
  C:\Windows\System\bAqIiht.exe
  2⤵
  PID:7588
- C:\Windows\System\iZMUMXa.exe
  C:\Windows\System\iZMUMXa.exe
  2⤵
  PID:7608
- C:\Windows\System\ivAQYYz.exe
  C:\Windows\System\ivAQYYz.exe
  2⤵
  PID:7624
- C:\Windows\System\ToySWYt.exe
  C:\Windows\System\ToySWYt.exe
  2⤵
  PID:7644
- C:\Windows\System\CfhaCbN.exe
  C:\Windows\System\CfhaCbN.exe
  2⤵
  PID:7672
- C:\Windows\System\nodzbQa.exe
  C:\Windows\System\nodzbQa.exe
  2⤵
  PID:7688
- C:\Windows\System\rRSjSyI.exe
  C:\Windows\System\rRSjSyI.exe
  2⤵
  PID:7708
- C:\Windows\System\XACyqOE.exe
  C:\Windows\System\XACyqOE.exe
  2⤵
  PID:7736
- C:\Windows\System\UurLShR.exe
  C:\Windows\System\UurLShR.exe
  2⤵
  PID:7752
- C:\Windows\System\kbfzgjM.exe
  C:\Windows\System\kbfzgjM.exe
  2⤵
  PID:7772
- C:\Windows\System\BGwrjop.exe
  C:\Windows\System\BGwrjop.exe
  2⤵
  PID:7792
- C:\Windows\System\aIVqxBm.exe
  C:\Windows\System\aIVqxBm.exe
  2⤵
  PID:7812
- C:\Windows\System\ynWYKYa.exe
  C:\Windows\System\ynWYKYa.exe
  2⤵
  PID:7836
- C:\Windows\System\kBmXHPT.exe
  C:\Windows\System\kBmXHPT.exe
  2⤵
  PID:7860
- C:\Windows\System\bpVrMte.exe
  C:\Windows\System\bpVrMte.exe
  2⤵
  PID:7876
- C:\Windows\System\FMcsFSo.exe
  C:\Windows\System\FMcsFSo.exe
  2⤵
  PID:7892
- C:\Windows\System\nqnTDGM.exe
  C:\Windows\System\nqnTDGM.exe
  2⤵
  PID:7908
- C:\Windows\System\hYIRCfr.exe
  C:\Windows\System\hYIRCfr.exe
  2⤵
  PID:7924
- C:\Windows\System\FwSCBth.exe
  C:\Windows\System\FwSCBth.exe
  2⤵
  PID:7940
- C:\Windows\System\GluqDfY.exe
  C:\Windows\System\GluqDfY.exe
  2⤵
  PID:7956
- C:\Windows\System\otZnbiY.exe
  C:\Windows\System\otZnbiY.exe
  2⤵
  PID:7976
- C:\Windows\System\mfseuZK.exe
  C:\Windows\System\mfseuZK.exe
  2⤵
  PID:7992
- C:\Windows\System\IfvngUF.exe
  C:\Windows\System\IfvngUF.exe
  2⤵
  PID:8008
- C:\Windows\System\QlLKpxi.exe
  C:\Windows\System\QlLKpxi.exe
  2⤵
  PID:8024
- C:\Windows\System\zyKpOQW.exe
  C:\Windows\System\zyKpOQW.exe
  2⤵
  PID:8044
- C:\Windows\System\vMppKyO.exe
  C:\Windows\System\vMppKyO.exe
  2⤵
  PID:8072
- C:\Windows\System\edEeGVV.exe
  C:\Windows\System\edEeGVV.exe
  2⤵
  PID:8092
- C:\Windows\System\WHBzZkn.exe
  C:\Windows\System\WHBzZkn.exe
  2⤵
  PID:8108
- C:\Windows\System\rMtQJgX.exe
  C:\Windows\System\rMtQJgX.exe
  2⤵
  PID:8132
- C:\Windows\System\owDbwGx.exe
  C:\Windows\System\owDbwGx.exe
  2⤵
  PID:8156
- C:\Windows\System\ccDOrES.exe
  C:\Windows\System\ccDOrES.exe
  2⤵
  PID:8172
- C:\Windows\System\kynZaEw.exe
  C:\Windows\System\kynZaEw.exe
  2⤵
  PID:8188
- C:\Windows\System\aYUmYXW.exe
  C:\Windows\System\aYUmYXW.exe
  2⤵
  PID:5252
- C:\Windows\System\JjLosqm.exe
  C:\Windows\System\JjLosqm.exe
  2⤵
  PID:2940
- C:\Windows\System\PQmOOXy.exe
  C:\Windows\System\PQmOOXy.exe
  2⤵
  PID:1832
- C:\Windows\System\SOJlMFB.exe
  C:\Windows\System\SOJlMFB.exe
  2⤵
  PID:2572
- C:\Windows\System\SAGhgDZ.exe
  C:\Windows\System\SAGhgDZ.exe
  2⤵
  PID:956
- C:\Windows\System\iyxjYjs.exe
  C:\Windows\System\iyxjYjs.exe
  2⤵
  PID:3724
- C:\Windows\System\SPUwFAf.exe
  C:\Windows\System\SPUwFAf.exe
  2⤵
  PID:4612
- C:\Windows\System\NjHCZss.exe
  C:\Windows\System\NjHCZss.exe
  2⤵
  PID:1384
- C:\Windows\System\dKgNzSR.exe
  C:\Windows\System\dKgNzSR.exe
  2⤵
  PID:6168
- C:\Windows\System\WvxeWTa.exe
  C:\Windows\System\WvxeWTa.exe
  2⤵
  PID:6216
- C:\Windows\System\tLyvSZw.exe
  C:\Windows\System\tLyvSZw.exe
  2⤵
  PID:6248
- C:\Windows\System\cVoTSBm.exe
  C:\Windows\System\cVoTSBm.exe
  2⤵
  PID:6284
- C:\Windows\System\huIcWDe.exe
  C:\Windows\System\huIcWDe.exe
  2⤵
  PID:6340
- C:\Windows\System\XTlVhUt.exe
  C:\Windows\System\XTlVhUt.exe
  2⤵
  PID:6392
- C:\Windows\System\WEnZgpa.exe
  C:\Windows\System\WEnZgpa.exe
  2⤵
  PID:2848
- C:\Windows\System\WYKrGmU.exe
  C:\Windows\System\WYKrGmU.exe
  2⤵
  PID:6468
- C:\Windows\System\BRIycPy.exe
  C:\Windows\System\BRIycPy.exe
  2⤵
  PID:6500
- C:\Windows\System\DYPCaYD.exe
  C:\Windows\System\DYPCaYD.exe
  2⤵
  PID:6552
- C:\Windows\System\zxqeofM.exe
  C:\Windows\System\zxqeofM.exe
  2⤵
  PID:6616
- C:\Windows\System\FaVyynF.exe
  C:\Windows\System\FaVyynF.exe
  2⤵
  PID:6648
- C:\Windows\System\gcpnXTw.exe
  C:\Windows\System\gcpnXTw.exe
  2⤵
  PID:6664
- C:\Windows\System\XoWGrux.exe
  C:\Windows\System\XoWGrux.exe
  2⤵
  PID:6700
- C:\Windows\System\gdOlgdE.exe
  C:\Windows\System\gdOlgdE.exe
  2⤵
  PID:8204
- C:\Windows\System\ZehzUIl.exe
  C:\Windows\System\ZehzUIl.exe
  2⤵
  PID:8220
- C:\Windows\System\kfyhTSL.exe
  C:\Windows\System\kfyhTSL.exe
  2⤵
  PID:8236
- C:\Windows\System\AFosMOX.exe
  C:\Windows\System\AFosMOX.exe
  2⤵
  PID:8252
- C:\Windows\System\qecuNar.exe
  C:\Windows\System\qecuNar.exe
  2⤵
  PID:8268
- C:\Windows\System\buXieVE.exe
  C:\Windows\System\buXieVE.exe
  2⤵
  PID:8284
- C:\Windows\System\ZSQyVpm.exe
  C:\Windows\System\ZSQyVpm.exe
  2⤵
  PID:8300
- C:\Windows\System\QIrzzOD.exe
  C:\Windows\System\QIrzzOD.exe
  2⤵
  PID:8316
- C:\Windows\System\bXIdiZv.exe
  C:\Windows\System\bXIdiZv.exe
  2⤵
  PID:8332
- C:\Windows\System\KYAdVBp.exe
  C:\Windows\System\KYAdVBp.exe
  2⤵
  PID:8348
- C:\Windows\System\DQpGSGi.exe
  C:\Windows\System\DQpGSGi.exe
  2⤵
  PID:8364
- C:\Windows\System\TuYsNiJ.exe
  C:\Windows\System\TuYsNiJ.exe
  2⤵
  PID:8380
- C:\Windows\System\EfrsUjN.exe
  C:\Windows\System\EfrsUjN.exe
  2⤵
  PID:8396
- C:\Windows\System\RyHxWrr.exe
  C:\Windows\System\RyHxWrr.exe
  2⤵
  PID:8412
- C:\Windows\System\gppIqaX.exe
  C:\Windows\System\gppIqaX.exe
  2⤵
  PID:8428
- C:\Windows\System\nArpFEN.exe
  C:\Windows\System\nArpFEN.exe
  2⤵
  PID:8444
- C:\Windows\System\ysgySnA.exe
  C:\Windows\System\ysgySnA.exe
  2⤵
  PID:8460
- C:\Windows\System\wxoYicB.exe
  C:\Windows\System\wxoYicB.exe
  2⤵
  PID:8476
- C:\Windows\System\jubBtaE.exe
  C:\Windows\System\jubBtaE.exe
  2⤵
  PID:8492
- C:\Windows\System\USenIxw.exe
  C:\Windows\System\USenIxw.exe
  2⤵
  PID:8512
- C:\Windows\System\gRjfshx.exe
  C:\Windows\System\gRjfshx.exe
  2⤵
  PID:8540
- C:\Windows\System\cyAANyo.exe
  C:\Windows\System\cyAANyo.exe
  2⤵
  PID:8556
- C:\Windows\System\YLVpOAd.exe
  C:\Windows\System\YLVpOAd.exe
  2⤵
  PID:8572
- C:\Windows\System\VoDKXYQ.exe
  C:\Windows\System\VoDKXYQ.exe
  2⤵
  PID:8592
- C:\Windows\System\ixxbhbL.exe
  C:\Windows\System\ixxbhbL.exe
  2⤵
  PID:8612
- C:\Windows\System\UiIjEbd.exe
  C:\Windows\System\UiIjEbd.exe
  2⤵
  PID:8636
- C:\Windows\System\MOxQTLl.exe
  C:\Windows\System\MOxQTLl.exe
  2⤵
  PID:8652
- C:\Windows\System\SkPSQIX.exe
  C:\Windows\System\SkPSQIX.exe
  2⤵
  PID:8668
- C:\Windows\System\SVXtcPd.exe
  C:\Windows\System\SVXtcPd.exe
  2⤵
  PID:8688
- C:\Windows\System\mNxeGzf.exe
  C:\Windows\System\mNxeGzf.exe
  2⤵
  PID:8712
- C:\Windows\System\lyLJrpp.exe
  C:\Windows\System\lyLJrpp.exe
  2⤵
  PID:8728
- C:\Windows\System\qPpSIPZ.exe
  C:\Windows\System\qPpSIPZ.exe
  2⤵
  PID:8752
- C:\Windows\System\gvcShoW.exe
  C:\Windows\System\gvcShoW.exe
  2⤵
  PID:8772
- C:\Windows\System\dBRhXMP.exe
  C:\Windows\System\dBRhXMP.exe
  2⤵
  PID:8792
- C:\Windows\System\bLemCpC.exe
  C:\Windows\System\bLemCpC.exe
  2⤵
  PID:8808
- C:\Windows\System\gfcbReD.exe
  C:\Windows\System\gfcbReD.exe
  2⤵
  PID:8824
- C:\Windows\System\vTYLBcG.exe
  C:\Windows\System\vTYLBcG.exe
  2⤵
  PID:8840
- C:\Windows\System\ByYALRJ.exe
  C:\Windows\System\ByYALRJ.exe
  2⤵
  PID:8856
- C:\Windows\System\Vjsazhq.exe
  C:\Windows\System\Vjsazhq.exe
  2⤵
  PID:8872
- C:\Windows\System\SMwiAzf.exe
  C:\Windows\System\SMwiAzf.exe
  2⤵
  PID:8892
- C:\Windows\System\QNLpdcK.exe
  C:\Windows\System\QNLpdcK.exe
  2⤵
  PID:8908
- C:\Windows\System\buWIGyg.exe
  C:\Windows\System\buWIGyg.exe
  2⤵
  PID:8928
- C:\Windows\System\Yvkwekl.exe
  C:\Windows\System\Yvkwekl.exe
  2⤵
  PID:8948
- C:\Windows\System\AnAUqyT.exe
  C:\Windows\System\AnAUqyT.exe
  2⤵
  PID:8964
- C:\Windows\System\VPPJivS.exe
  C:\Windows\System\VPPJivS.exe
  2⤵
  PID:8980
- C:\Windows\System\WvnbvDY.exe
  C:\Windows\System\WvnbvDY.exe
  2⤵
  PID:9000
- C:\Windows\System\RsNtXxO.exe
  C:\Windows\System\RsNtXxO.exe
  2⤵
  PID:9020
- C:\Windows\System\wxscVuZ.exe
  C:\Windows\System\wxscVuZ.exe
  2⤵
  PID:9040
- C:\Windows\System\dqAtCLi.exe
  C:\Windows\System\dqAtCLi.exe
  2⤵
  PID:9056
- C:\Windows\System\sXugReC.exe
  C:\Windows\System\sXugReC.exe
  2⤵
  PID:9076
- C:\Windows\System\QeqjPpQ.exe
  C:\Windows\System\QeqjPpQ.exe
  2⤵
  PID:9092
- C:\Windows\System\foGxMDK.exe
  C:\Windows\System\foGxMDK.exe
  2⤵
  PID:9108
- C:\Windows\System\tTVhdJk.exe
  C:\Windows\System\tTVhdJk.exe
  2⤵
  PID:9128
- C:\Windows\System\eAKCPbn.exe
  C:\Windows\System\eAKCPbn.exe
  2⤵
  PID:9144
- C:\Windows\System\WNAhGAn.exe
  C:\Windows\System\WNAhGAn.exe
  2⤵
  PID:9180
- C:\Windows\System\sqJuZvO.exe
  C:\Windows\System\sqJuZvO.exe
  2⤵
  PID:9212
- C:\Windows\System\AoDFEew.exe
  C:\Windows\System\AoDFEew.exe
  2⤵
  PID:6768
- C:\Windows\System\mPRNHKZ.exe
  C:\Windows\System\mPRNHKZ.exe
  2⤵
  PID:6792
- C:\Windows\System\rULSbnk.exe
  C:\Windows\System\rULSbnk.exe
  2⤵
  PID:6804
- C:\Windows\System\zTovkip.exe
  C:\Windows\System\zTovkip.exe
  2⤵
  PID:6868
- C:\Windows\System\bBQVfqK.exe
  C:\Windows\System\bBQVfqK.exe
  2⤵
  PID:4156
- C:\Windows\System\LqAFgOy.exe
  C:\Windows\System\LqAFgOy.exe
  2⤵
  PID:6916
- C:\Windows\System\fuSThZp.exe
  C:\Windows\System\fuSThZp.exe
  2⤵
  PID:6952
- C:\Windows\System\pnMtrfm.exe
  C:\Windows\System\pnMtrfm.exe
  2⤵
  PID:6996
- C:\Windows\System\YaitajY.exe
  C:\Windows\System\YaitajY.exe
  2⤵
  PID:7028
- C:\Windows\System\xCIyBsA.exe
  C:\Windows\System\xCIyBsA.exe
  2⤵
  PID:7064
- C:\Windows\System\QFovElf.exe
  C:\Windows\System\QFovElf.exe
  2⤵
  PID:5824
- C:\Windows\System\PiapsJF.exe
  C:\Windows\System\PiapsJF.exe
  2⤵
  PID:5740
- C:\Windows\System\UyjWGnx.exe
  C:\Windows\System\UyjWGnx.exe
  2⤵
  PID:1580
- C:\Windows\System\SOFkFci.exe
  C:\Windows\System\SOFkFci.exe
  2⤵
  PID:5128
- C:\Windows\System\eYUsCPb.exe
  C:\Windows\System\eYUsCPb.exe
  2⤵
  PID:5812
- C:\Windows\System\nZTjMlJ.exe
  C:\Windows\System\nZTjMlJ.exe
  2⤵
  PID:5952
- C:\Windows\System\UTzLaxI.exe
  C:\Windows\System\UTzLaxI.exe
  2⤵
  PID:5968
- C:\Windows\System\iBuiSRx.exe
  C:\Windows\System\iBuiSRx.exe
  2⤵
  PID:5096
- C:\Windows\System\DdJfnHO.exe
  C:\Windows\System\DdJfnHO.exe
  2⤵
  PID:1964
- C:\Windows\System\pRCAqjd.exe
  C:\Windows\System\pRCAqjd.exe
  2⤵
  PID:7188
- C:\Windows\System\VChTAPD.exe
  C:\Windows\System\VChTAPD.exe
  2⤵
  PID:9232
- C:\Windows\System\eWFugok.exe
  C:\Windows\System\eWFugok.exe
  2⤵
  PID:9256
- C:\Windows\System\YzvWiPA.exe
  C:\Windows\System\YzvWiPA.exe
  2⤵
  PID:9272
- C:\Windows\System\bdissKo.exe
  C:\Windows\System\bdissKo.exe
  2⤵
  PID:9296
- C:\Windows\System\FYqkLzn.exe
  C:\Windows\System\FYqkLzn.exe
  2⤵
  PID:9312
- C:\Windows\System\ylRGiXa.exe
  C:\Windows\System\ylRGiXa.exe
  2⤵
  PID:9328
- C:\Windows\System\VfHYZqP.exe
  C:\Windows\System\VfHYZqP.exe
  2⤵
  PID:9352
- C:\Windows\System\CJDotgt.exe
  C:\Windows\System\CJDotgt.exe
  2⤵
  PID:9376
- C:\Windows\System\ZzoWNPN.exe
  C:\Windows\System\ZzoWNPN.exe
  2⤵
  PID:9392
- C:\Windows\System\SJYQUWw.exe
  C:\Windows\System\SJYQUWw.exe
  2⤵
  PID:9408
- C:\Windows\System\HuKKCZg.exe
  C:\Windows\System\HuKKCZg.exe
  2⤵
  PID:9424
- C:\Windows\System\HQhgAtM.exe
  C:\Windows\System\HQhgAtM.exe
  2⤵
  PID:9440
- C:\Windows\System\qrOWoUW.exe
  C:\Windows\System\qrOWoUW.exe
  2⤵
  PID:9460
- C:\Windows\System\JzfbDqG.exe
  C:\Windows\System\JzfbDqG.exe
  2⤵
  PID:9488
- C:\Windows\System\vXxHMPc.exe
  C:\Windows\System\vXxHMPc.exe
  2⤵
  PID:9512
- C:\Windows\System\pCRHyuf.exe
  C:\Windows\System\pCRHyuf.exe
  2⤵
  PID:9536
- C:\Windows\System\xlmrzzx.exe
  C:\Windows\System\xlmrzzx.exe
  2⤵
  PID:9552
- C:\Windows\System\JwkHCJW.exe
  C:\Windows\System\JwkHCJW.exe
  2⤵
  PID:9580
- C:\Windows\System\gxYPDlS.exe
  C:\Windows\System\gxYPDlS.exe
  2⤵
  PID:9608
- C:\Windows\System\xcXgUUX.exe
  C:\Windows\System\xcXgUUX.exe
  2⤵
  PID:9636
- C:\Windows\System\EVPzQMu.exe
  C:\Windows\System\EVPzQMu.exe
  2⤵
  PID:9652
- C:\Windows\System\sEpQkow.exe
  C:\Windows\System\sEpQkow.exe
  2⤵
  PID:9676
- C:\Windows\System\LJrdwJN.exe
  C:\Windows\System\LJrdwJN.exe
  2⤵
  PID:9696
- C:\Windows\System\bOCWPnp.exe
  C:\Windows\System\bOCWPnp.exe
  2⤵
  PID:9712
- C:\Windows\System\JUutPEY.exe
  C:\Windows\System\JUutPEY.exe
  2⤵
  PID:9728
- C:\Windows\System\vLdrTpP.exe
  C:\Windows\System\vLdrTpP.exe
  2⤵
  PID:9744
- C:\Windows\System\plUIfLt.exe
  C:\Windows\System\plUIfLt.exe
  2⤵
  PID:9760
- C:\Windows\System\FVyvTIc.exe
  C:\Windows\System\FVyvTIc.exe
  2⤵
  PID:9776
- C:\Windows\System\gvmesQF.exe
  C:\Windows\System\gvmesQF.exe
  2⤵
  PID:9792
- C:\Windows\System\bgPAwdA.exe
  C:\Windows\System\bgPAwdA.exe
  2⤵
  PID:9820
- C:\Windows\System\KycTCVi.exe
  C:\Windows\System\KycTCVi.exe
  2⤵
  PID:9836
- C:\Windows\System\SiEcaPi.exe
  C:\Windows\System\SiEcaPi.exe
  2⤵
  PID:9852
- C:\Windows\System\oeGBSEu.exe
  C:\Windows\System\oeGBSEu.exe
  2⤵
  PID:9872
- C:\Windows\System\FNavIMu.exe
  C:\Windows\System\FNavIMu.exe
  2⤵
  PID:9896
- C:\Windows\System\hLXNBMx.exe
  C:\Windows\System\hLXNBMx.exe
  2⤵
  PID:9912
- C:\Windows\System\xgPWPwt.exe
  C:\Windows\System\xgPWPwt.exe
  2⤵
  PID:9928
- C:\Windows\System\ozZMoIp.exe
  C:\Windows\System\ozZMoIp.exe
  2⤵
  PID:9964
- C:\Windows\System\dLcNlFK.exe
  C:\Windows\System\dLcNlFK.exe
  2⤵
  PID:9984
- C:\Windows\System\TfwfUet.exe
  C:\Windows\System\TfwfUet.exe
  2⤵
  PID:10004
- C:\Windows\System\tdPHutY.exe
  C:\Windows\System\tdPHutY.exe
  2⤵
  PID:10024
- C:\Windows\System\vWGiLtR.exe
  C:\Windows\System\vWGiLtR.exe
  2⤵
  PID:10060
- C:\Windows\System\TYwmftX.exe
  C:\Windows\System\TYwmftX.exe
  2⤵
  PID:10076
- C:\Windows\System\YMPuqmg.exe
  C:\Windows\System\YMPuqmg.exe
  2⤵
  PID:10092
- C:\Windows\System\ZWdcTJd.exe
  C:\Windows\System\ZWdcTJd.exe
  2⤵
  PID:10112
- C:\Windows\System\BsQOFzV.exe
  C:\Windows\System\BsQOFzV.exe
  2⤵
  PID:10136
- C:\Windows\System\AurSUzL.exe
  C:\Windows\System\AurSUzL.exe
  2⤵
  PID:10152
- C:\Windows\System\dvaYzWR.exe
  C:\Windows\System\dvaYzWR.exe
  2⤵
  PID:10168
- C:\Windows\System\NdTAGAD.exe
  C:\Windows\System\NdTAGAD.exe
  2⤵
  PID:10184
- C:\Windows\System\pIlLOyp.exe
  C:\Windows\System\pIlLOyp.exe
  2⤵
  PID:10200
- C:\Windows\System\oWUmjYy.exe
  C:\Windows\System\oWUmjYy.exe
  2⤵
  PID:10216
- C:\Windows\System\WHqwzEu.exe
  C:\Windows\System\WHqwzEu.exe
  2⤵
  PID:10236
- C:\Windows\System\mPeqJUR.exe
  C:\Windows\System\mPeqJUR.exe
  2⤵
  PID:7252
- C:\Windows\System\Qknbmkn.exe
  C:\Windows\System\Qknbmkn.exe
  2⤵
  PID:7308
- C:\Windows\System\aoVlKwT.exe
  C:\Windows\System\aoVlKwT.exe
  2⤵
  PID:7384
- C:\Windows\System\jbPPaqV.exe
  C:\Windows\System\jbPPaqV.exe
  2⤵
  PID:7412
- C:\Windows\System\uuftwJb.exe
  C:\Windows\System\uuftwJb.exe
  2⤵
  PID:3680
- C:\Windows\System\bpttmqX.exe
  C:\Windows\System\bpttmqX.exe
  2⤵
  PID:7468
- C:\Windows\System\MDHhJur.exe
  C:\Windows\System\MDHhJur.exe
  2⤵
  PID:7500
- C:\Windows\System\MGiGKSV.exe
  C:\Windows\System\MGiGKSV.exe
  2⤵
  PID:7552
- C:\Windows\System\kfnRIjN.exe
  C:\Windows\System\kfnRIjN.exe
  2⤵
  PID:1948
- C:\Windows\System\GjfXMtV.exe
  C:\Windows\System\GjfXMtV.exe
  2⤵
  PID:2400
- C:\Windows\System\XJyQGza.exe
  C:\Windows\System\XJyQGza.exe
  2⤵
  PID:2256
- C:\Windows\System\rzWxKEo.exe
  C:\Windows\System\rzWxKEo.exe
  2⤵
  PID:7680
- C:\Windows\System\akbMPce.exe
  C:\Windows\System\akbMPce.exe
  2⤵
  PID:7724
- C:\Windows\System\nEtXQEV.exe
  C:\Windows\System\nEtXQEV.exe
  2⤵
  PID:7748
- C:\Windows\System\zDgScpP.exe
  C:\Windows\System\zDgScpP.exe
  2⤵
  PID:10248
- C:\Windows\System\FjQIWoH.exe
  C:\Windows\System\FjQIWoH.exe
  2⤵
  PID:10272
- C:\Windows\System\KvBqlQp.exe
  C:\Windows\System\KvBqlQp.exe
  2⤵
  PID:10288
- C:\Windows\System\ghZIfSg.exe
  C:\Windows\System\ghZIfSg.exe
  2⤵
  PID:10304
- C:\Windows\System\KdYryfH.exe
  C:\Windows\System\KdYryfH.exe
  2⤵
  PID:10320
- C:\Windows\System\McESThX.exe
  C:\Windows\System\McESThX.exe
  2⤵
  PID:10336
- C:\Windows\System\NTiEwki.exe
  C:\Windows\System\NTiEwki.exe
  2⤵
  PID:10364
- C:\Windows\System\LXZtFmG.exe
  C:\Windows\System\LXZtFmG.exe
  2⤵
  PID:10380
- C:\Windows\System\LlZCoRP.exe
  C:\Windows\System\LlZCoRP.exe
  2⤵
  PID:10400
- C:\Windows\System\wkejOPI.exe
  C:\Windows\System\wkejOPI.exe
  2⤵
  PID:10416
- C:\Windows\System\DdQzCMy.exe
  C:\Windows\System\DdQzCMy.exe
  2⤵
  PID:10444
- C:\Windows\System\xmzrgtQ.exe
  C:\Windows\System\xmzrgtQ.exe
  2⤵
  PID:10464
- C:\Windows\System\MnAGCCQ.exe
  C:\Windows\System\MnAGCCQ.exe
  2⤵
  PID:10484
- C:\Windows\System\LxsYkNW.exe
  C:\Windows\System\LxsYkNW.exe
  2⤵
  PID:10500
- C:\Windows\System\qUaUkZY.exe
  C:\Windows\System\qUaUkZY.exe
  2⤵
  PID:10516
- C:\Windows\System\WkUOajy.exe
  C:\Windows\System\WkUOajy.exe
  2⤵
  PID:7348
- C:\Windows\System\HLUbwju.exe
  C:\Windows\System\HLUbwju.exe
  2⤵
  PID:7696
- C:\Windows\System\RLYNDvn.exe
  C:\Windows\System\RLYNDvn.exe
  2⤵
  PID:10328
- C:\Windows\System\gHFwpMk.exe
  C:\Windows\System\gHFwpMk.exe
  2⤵
  PID:10372
- C:\Windows\System\jPqidns.exe
  C:\Windows\System\jPqidns.exe
  2⤵
  PID:10440
- C:\Windows\System\EygydVS.exe
  C:\Windows\System\EygydVS.exe
  2⤵
  PID:10532
- C:\Windows\System\OoESTsL.exe
  C:\Windows\System\OoESTsL.exe
  2⤵
  PID:8052
- C:\Windows\System\kICUpmQ.exe
  C:\Windows\System\kICUpmQ.exe
  2⤵
  PID:3048
- C:\Windows\System\FJbiCla.exe
  C:\Windows\System\FJbiCla.exe
  2⤵
  PID:6820
- C:\Windows\System\lcJBMZW.exe
  C:\Windows\System\lcJBMZW.exe
  2⤵
  PID:6888
- C:\Windows\System\uOECsrd.exe
  C:\Windows\System\uOECsrd.exe
  2⤵
  PID:8620
- C:\Windows\System\OzhXzzv.exe
  C:\Windows\System\OzhXzzv.exe
  2⤵
  PID:8664
- C:\Windows\System\LfXCULH.exe
  C:\Windows\System\LfXCULH.exe
  2⤵
  PID:10824
- C:\Windows\System\VCDDzNu.exe
  C:\Windows\System\VCDDzNu.exe
  2⤵
  PID:10848
- C:\Windows\System\vndtsQN.exe
  C:\Windows\System\vndtsQN.exe
  2⤵
  PID:9008
- C:\Windows\System\FouBrZJ.exe
  C:\Windows\System\FouBrZJ.exe
  2⤵
  PID:9052
- C:\Windows\System\hTTkKRP.exe
  C:\Windows\System\hTTkKRP.exe
  2⤵
  PID:6840
- C:\Windows\System\bNRWTAa.exe
  C:\Windows\System\bNRWTAa.exe
  2⤵
  PID:5600
- C:\Windows\System\PdTCOkD.exe
  C:\Windows\System\PdTCOkD.exe
  2⤵
  PID:9320
- C:\Windows\System\utqTORD.exe
  C:\Windows\System\utqTORD.exe
  2⤵
  PID:9384
- C:\Windows\System\GBqwolV.exe
  C:\Windows\System\GBqwolV.exe
  2⤵
  PID:9432
- C:\Windows\System\cSxDdqm.exe
  C:\Windows\System\cSxDdqm.exe
  2⤵
  PID:2452
- C:\Windows\System\RCQyibt.exe
  C:\Windows\System\RCQyibt.exe
  2⤵
  PID:9604
- C:\Windows\System\tUeGIPp.exe
  C:\Windows\System\tUeGIPp.exe
  2⤵
  PID:9768
- C:\Windows\System\KtqryXa.exe
  C:\Windows\System\KtqryXa.exe
  2⤵
  PID:9924
- C:\Windows\System\UJDdQGB.exe
  C:\Windows\System\UJDdQGB.exe
  2⤵
  PID:9992
- C:\Windows\System\DKcjtsa.exe
  C:\Windows\System\DKcjtsa.exe
  2⤵
  PID:7236
- C:\Windows\System\awKJCqz.exe
  C:\Windows\System\awKJCqz.exe
  2⤵
  PID:7652
- C:\Windows\System\KqKegmg.exe
  C:\Windows\System\KqKegmg.exe
  2⤵
  PID:11268
- C:\Windows\System\HsAQxNu.exe
  C:\Windows\System\HsAQxNu.exe
  2⤵
  PID:11296
- C:\Windows\System\mkLYNAw.exe
  C:\Windows\System\mkLYNAw.exe
  2⤵
  PID:11316
- C:\Windows\System\oylyPXC.exe
  C:\Windows\System\oylyPXC.exe
  2⤵
  PID:11336
- C:\Windows\System\knEmkXA.exe
  C:\Windows\System\knEmkXA.exe
  2⤵
  PID:11356
- C:\Windows\System\wwwdEBg.exe
  C:\Windows\System\wwwdEBg.exe
  2⤵
  PID:11380
- C:\Windows\System\guxYcEo.exe
  C:\Windows\System\guxYcEo.exe
  2⤵
  PID:11404
- C:\Windows\System\vABJBUj.exe
  C:\Windows\System\vABJBUj.exe
  2⤵
  PID:11424
- C:\Windows\System\DnIYMEk.exe
  C:\Windows\System\DnIYMEk.exe
  2⤵
  PID:11456
- C:\Windows\System\ZulcLaP.exe
  C:\Windows\System\ZulcLaP.exe
  2⤵
  PID:11476
- C:\Windows\System\mXuqmfG.exe
  C:\Windows\System\mXuqmfG.exe
  2⤵
  PID:11516
- C:\Windows\System\oSPqMai.exe
  C:\Windows\System\oSPqMai.exe
  2⤵
  PID:11540
- C:\Windows\System\cnxsSuR.exe
  C:\Windows\System\cnxsSuR.exe
  2⤵
  PID:11560
- C:\Windows\System\iKeHfie.exe
  C:\Windows\System\iKeHfie.exe
  2⤵
  PID:11580
- C:\Windows\System\gSXsraP.exe
  C:\Windows\System\gSXsraP.exe
  2⤵
  PID:11608
- C:\Windows\System\GewlUkj.exe
  C:\Windows\System\GewlUkj.exe
  2⤵
  PID:11632
- C:\Windows\System\HpYCnzs.exe
  C:\Windows\System\HpYCnzs.exe
  2⤵
  PID:11652
- C:\Windows\System\ekSaear.exe
  C:\Windows\System\ekSaear.exe
  2⤵
  PID:11676
- C:\Windows\System\mqzSmvN.exe
  C:\Windows\System\mqzSmvN.exe
  2⤵
  PID:11692
- C:\Windows\System\fqHVXnb.exe
  C:\Windows\System\fqHVXnb.exe
  2⤵
  PID:11708
- C:\Windows\System\LhgCvLB.exe
  C:\Windows\System\LhgCvLB.exe
  2⤵
  PID:11732
- C:\Windows\System\PxfLVRE.exe
  C:\Windows\System\PxfLVRE.exe
  2⤵
  PID:11760
- C:\Windows\System\cDDSNaC.exe
  C:\Windows\System\cDDSNaC.exe
  2⤵
  PID:11784
- C:\Windows\System\ZKdCvsZ.exe
  C:\Windows\System\ZKdCvsZ.exe
  2⤵
  PID:11808
- C:\Windows\System\mjQCLAA.exe
  C:\Windows\System\mjQCLAA.exe
  2⤵
  PID:11828
- C:\Windows\System\IPidiEG.exe
  C:\Windows\System\IPidiEG.exe
  2⤵
  PID:11848
- C:\Windows\System\dHmtSQX.exe
  C:\Windows\System\dHmtSQX.exe
  2⤵
  PID:11872
- C:\Windows\System\qUVpkVB.exe
  C:\Windows\System\qUVpkVB.exe
  2⤵
  PID:11892
- C:\Windows\System\kjIFVrY.exe
  C:\Windows\System\kjIFVrY.exe
  2⤵
  PID:11912
- C:\Windows\System\rTSmGYF.exe
  C:\Windows\System\rTSmGYF.exe
  2⤵
  PID:11932
- C:\Windows\System\KhcghOs.exe
  C:\Windows\System\KhcghOs.exe
  2⤵
  PID:11952
- C:\Windows\System\AfjtSrs.exe
  C:\Windows\System\AfjtSrs.exe
  2⤵
  PID:11980
- C:\Windows\System\gnpxSwB.exe
  C:\Windows\System\gnpxSwB.exe
  2⤵
  PID:12004
- C:\Windows\System\ErMCYDL.exe
  C:\Windows\System\ErMCYDL.exe
  2⤵
  PID:12024
- C:\Windows\System\WMlTsfr.exe
  C:\Windows\System\WMlTsfr.exe
  2⤵
  PID:12048
- C:\Windows\System\cRRqRRl.exe
  C:\Windows\System\cRRqRRl.exe
  2⤵
  PID:12072
- C:\Windows\System\oBpEgNv.exe
  C:\Windows\System\oBpEgNv.exe
  2⤵
  PID:12092
- C:\Windows\System\ObcNEwa.exe
  C:\Windows\System\ObcNEwa.exe
  2⤵
  PID:12112
- C:\Windows\System\nVGwGmJ.exe
  C:\Windows\System\nVGwGmJ.exe
  2⤵
  PID:12132
- C:\Windows\System\HykCHof.exe
  C:\Windows\System\HykCHof.exe
  2⤵
  PID:12164
- C:\Windows\System\eHKEfFY.exe
  C:\Windows\System\eHKEfFY.exe
  2⤵
  PID:12184
- C:\Windows\System\qwlxhXI.exe
  C:\Windows\System\qwlxhXI.exe
  2⤵
  PID:12204
- C:\Windows\System\JIOWECL.exe
  C:\Windows\System\JIOWECL.exe
  2⤵
  PID:12224
- C:\Windows\System\qkJnOFD.exe
  C:\Windows\System\qkJnOFD.exe
  2⤵
  PID:12244
- C:\Windows\System\zIvEcUB.exe
  C:\Windows\System\zIvEcUB.exe
  2⤵
  PID:12276
- C:\Windows\System\ejnUTnh.exe
  C:\Windows\System\ejnUTnh.exe
  2⤵
  PID:7780
- C:\Windows\System\dCGcYcS.exe
  C:\Windows\System\dCGcYcS.exe
  2⤵
  PID:10300
- C:\Windows\System\gegowSJ.exe
  C:\Windows\System\gegowSJ.exe
  2⤵
  PID:11224
- C:\Windows\System\xjIviNH.exe
  C:\Windows\System\xjIviNH.exe
  2⤵
  PID:7888
- C:\Windows\System\tPinRuD.exe
  C:\Windows\System\tPinRuD.exe
  2⤵
  PID:10560
- C:\Windows\System\oYLMnDr.exe
  C:\Windows\System\oYLMnDr.exe
  2⤵
  PID:7848
- C:\Windows\System\xqvlrpM.exe
  C:\Windows\System\xqvlrpM.exe
  2⤵
  PID:7916
- C:\Windows\System\oggsdYF.exe
  C:\Windows\System\oggsdYF.exe
  2⤵
  PID:664
- C:\Windows\System\exQaPot.exe
  C:\Windows\System\exQaPot.exe
  2⤵
  PID:7988
- C:\Windows\System\PuNGXRj.exe
  C:\Windows\System\PuNGXRj.exe
  2⤵
  PID:10720
- C:\Windows\System\WfeuLNU.exe
  C:\Windows\System\WfeuLNU.exe
  2⤵
  PID:8100
- C:\Windows\System\ooQfpIh.exe
  C:\Windows\System\ooQfpIh.exe
  2⤵
  PID:6324
- C:\Windows\System\NIAxooL.exe
  C:\Windows\System\NIAxooL.exe
  2⤵
  PID:8216
- C:\Windows\System\KJTXWTI.exe
  C:\Windows\System\KJTXWTI.exe
  2⤵
  PID:8248
- C:\Windows\System\PTHNBPI.exe
  C:\Windows\System\PTHNBPI.exe
  2⤵
  PID:8280
- C:\Windows\System\nukRQGU.exe
  C:\Windows\System\nukRQGU.exe
  2⤵
  PID:8312
- C:\Windows\System\trGaeCv.exe
  C:\Windows\System\trGaeCv.exe
  2⤵
  PID:8344
- C:\Windows\System\kfUscoh.exe
  C:\Windows\System\kfUscoh.exe
  2⤵
  PID:8420
- C:\Windows\System\meYUfbU.exe
  C:\Windows\System\meYUfbU.exe
  2⤵
  PID:12292
- C:\Windows\System\TlEwtxu.exe
  C:\Windows\System\TlEwtxu.exe
  2⤵
  PID:12312
- C:\Windows\System\kAvOpRY.exe
  C:\Windows\System\kAvOpRY.exe
  2⤵
  PID:12328
- C:\Windows\System\fKXylCC.exe
  C:\Windows\System\fKXylCC.exe
  2⤵
  PID:12344
- C:\Windows\System\WLGHssW.exe
  C:\Windows\System\WLGHssW.exe
  2⤵
  PID:12360
- C:\Windows\System\hImFmlI.exe
  C:\Windows\System\hImFmlI.exe
  2⤵
  PID:12376
- C:\Windows\System\MjZSySh.exe
  C:\Windows\System\MjZSySh.exe
  2⤵
  PID:12392
- C:\Windows\System\nSKodBT.exe
  C:\Windows\System\nSKodBT.exe
  2⤵
  PID:12408
- C:\Windows\System\YGsvDHE.exe
  C:\Windows\System\YGsvDHE.exe
  2⤵
  PID:12424
- C:\Windows\System\qnGyvok.exe
  C:\Windows\System\qnGyvok.exe
  2⤵
  PID:12440
- C:\Windows\System\aLwDjVE.exe
  C:\Windows\System\aLwDjVE.exe
  2⤵
  PID:12460
- C:\Windows\System\hMWuoeR.exe
  C:\Windows\System\hMWuoeR.exe
  2⤵
  PID:12476
- C:\Windows\System\jMtXvQW.exe
  C:\Windows\System\jMtXvQW.exe
  2⤵
  PID:12500
- C:\Windows\System\ucosavg.exe
  C:\Windows\System\ucosavg.exe
  2⤵
  PID:12532
- C:\Windows\System\fxusbGE.exe
  C:\Windows\System\fxusbGE.exe
  2⤵
  PID:12556
- C:\Windows\System\aaWGybu.exe
  C:\Windows\System\aaWGybu.exe
  2⤵
  PID:12572
- C:\Windows\System\DxCHLgg.exe
  C:\Windows\System\DxCHLgg.exe
  2⤵
  PID:12588
- C:\Windows\System\XEqmslF.exe
  C:\Windows\System\XEqmslF.exe
  2⤵
  PID:12616
- C:\Windows\System\uPokGJe.exe
  C:\Windows\System\uPokGJe.exe
  2⤵
  PID:12636
- C:\Windows\System\BqxtYlU.exe
  C:\Windows\System\BqxtYlU.exe
  2⤵
  PID:12656
- C:\Windows\System\vXNhbHl.exe
  C:\Windows\System\vXNhbHl.exe
  2⤵
  PID:12676
- C:\Windows\System\QRaCKKN.exe
  C:\Windows\System\QRaCKKN.exe
  2⤵
  PID:12704
- C:\Windows\System\rAfbsAt.exe
  C:\Windows\System\rAfbsAt.exe
  2⤵
  PID:12724
- C:\Windows\System\wKxBYqS.exe
  C:\Windows\System\wKxBYqS.exe
  2⤵
  PID:12748
- C:\Windows\System\TKGnbMz.exe
  C:\Windows\System\TKGnbMz.exe
  2⤵
  PID:12772
- C:\Windows\System\LzUeeNz.exe
  C:\Windows\System\LzUeeNz.exe
  2⤵
  PID:12796
- C:\Windows\System\jdWcFCp.exe
  C:\Windows\System\jdWcFCp.exe
  2⤵
  PID:12824
- C:\Windows\System\zDwTjld.exe
  C:\Windows\System\zDwTjld.exe
  2⤵
  PID:12848
- C:\Windows\System\AMmeTbL.exe
  C:\Windows\System\AMmeTbL.exe
  2⤵
  PID:12864
- C:\Windows\System\aGJMNgK.exe
  C:\Windows\System\aGJMNgK.exe
  2⤵
  PID:12892
- C:\Windows\System\gFkkJeK.exe
  C:\Windows\System\gFkkJeK.exe
  2⤵
  PID:12912
- C:\Windows\System\iiqVTTF.exe
  C:\Windows\System\iiqVTTF.exe
  2⤵
  PID:12932
- C:\Windows\System\sqXZART.exe
  C:\Windows\System\sqXZART.exe
  2⤵
  PID:12948
- C:\Windows\System\Sorfpug.exe
  C:\Windows\System\Sorfpug.exe
  2⤵
  PID:12972
- C:\Windows\System\FNKKeVW.exe
  C:\Windows\System\FNKKeVW.exe
  2⤵
  PID:13000
- C:\Windows\System\UFyZjoS.exe
  C:\Windows\System\UFyZjoS.exe
  2⤵
  PID:13028
- C:\Windows\System\UIvrFSc.exe
  C:\Windows\System\UIvrFSc.exe
  2⤵
  PID:13048
- C:\Windows\System\ETojSMZ.exe
  C:\Windows\System\ETojSMZ.exe
  2⤵
  PID:13068
- C:\Windows\System\kNCJhTI.exe
  C:\Windows\System\kNCJhTI.exe
  2⤵
  PID:13096
- C:\Windows\System\bdOytSI.exe
  C:\Windows\System\bdOytSI.exe
  2⤵
  PID:13120
- C:\Windows\System\hfEXkKh.exe
  C:\Windows\System\hfEXkKh.exe
  2⤵
  PID:13144
- C:\Windows\System\pUqXjKU.exe
  C:\Windows\System\pUqXjKU.exe
  2⤵
  PID:13164
- C:\Windows\System\mkmllfD.exe
  C:\Windows\System\mkmllfD.exe
  2⤵
  PID:13188
- C:\Windows\System\vpAjqjC.exe
  C:\Windows\System\vpAjqjC.exe
  2⤵
  PID:13208
- C:\Windows\System\qwDazuf.exe
  C:\Windows\System\qwDazuf.exe
  2⤵
  PID:13236
- C:\Windows\System\KjtRRUE.exe
  C:\Windows\System\KjtRRUE.exe
  2⤵
  PID:13256
- C:\Windows\System\EzpCsAK.exe
  C:\Windows\System\EzpCsAK.exe
  2⤵
  PID:13276
- C:\Windows\System\JZjXrhX.exe
  C:\Windows\System\JZjXrhX.exe
  2⤵
  PID:13292
- C:\Windows\System\xTMboLJ.exe
  C:\Windows\System\xTMboLJ.exe
  2⤵
  PID:8180
- C:\Windows\System\ABRDKme.exe
  C:\Windows\System\ABRDKme.exe
  2⤵
  PID:4884
- C:\Windows\System\SfLznMG.exe
  C:\Windows\System\SfLznMG.exe
  2⤵
  PID:8524
- C:\Windows\System\QnBicpQ.exe
  C:\Windows\System\QnBicpQ.exe
  2⤵
  PID:8564
- C:\Windows\System\EuHCLxZ.exe
  C:\Windows\System\EuHCLxZ.exe
  2⤵
  PID:10832
- C:\Windows\System\EQLIIgr.exe
  C:\Windows\System\EQLIIgr.exe
  2⤵
  PID:8868
- C:\Windows\System\IHBVUCH.exe
  C:\Windows\System\IHBVUCH.exe
  2⤵
  PID:10880
- C:\Windows\System\EaXzULz.exe
  C:\Windows\System\EaXzULz.exe
  2⤵
  PID:9072
- C:\Windows\System\PdrfOkw.exe
  C:\Windows\System\PdrfOkw.exe
  2⤵
  PID:9100
- C:\Windows\System\dkKwRHv.exe
  C:\Windows\System\dkKwRHv.exe
  2⤵
  PID:8788
- C:\Windows\System\nmCkvaI.exe
  C:\Windows\System\nmCkvaI.exe
  2⤵
  PID:13324
- C:\Windows\System\wKcycea.exe
  C:\Windows\System\wKcycea.exe
  2⤵
  PID:13344
- C:\Windows\System\eNQciIP.exe
  C:\Windows\System\eNQciIP.exe
  2⤵
  PID:13368
- C:\Windows\System\qftntqj.exe
  C:\Windows\System\qftntqj.exe
  2⤵
  PID:13392
- C:\Windows\System\liiBWWu.exe
  C:\Windows\System\liiBWWu.exe
  2⤵
  PID:13416
- C:\Windows\System\PrWaqpV.exe
  C:\Windows\System\PrWaqpV.exe
  2⤵
  PID:13432
- C:\Windows\System\KCKtiyj.exe
  C:\Windows\System\KCKtiyj.exe
  2⤵
  PID:13456
- C:\Windows\System\DxbwPHn.exe
  C:\Windows\System\DxbwPHn.exe
  2⤵
  PID:13480
- C:\Windows\System\bcJwECw.exe
  C:\Windows\System\bcJwECw.exe
  2⤵
  PID:13500
- C:\Windows\System\nlRjOna.exe
  C:\Windows\System\nlRjOna.exe
  2⤵
  PID:13524
- C:\Windows\System\oOdxhmK.exe
  C:\Windows\System\oOdxhmK.exe
  2⤵
  PID:13548
- C:\Windows\System\ElXgsEw.exe
  C:\Windows\System\ElXgsEw.exe
  2⤵
  PID:13576
- C:\Windows\System\oDCRmpI.exe
  C:\Windows\System\oDCRmpI.exe
  2⤵
  PID:13604
- C:\Windows\System\oEWpCkq.exe
  C:\Windows\System\oEWpCkq.exe
  2⤵
  PID:13624
- C:\Windows\System\cJgqeNr.exe
  C:\Windows\System\cJgqeNr.exe
  2⤵
  PID:13648
- C:\Windows\System\gwZvHzT.exe
  C:\Windows\System\gwZvHzT.exe
  2⤵
  PID:13664
- C:\Windows\System\pzWWrdO.exe
  C:\Windows\System\pzWWrdO.exe
  2⤵
  PID:13684
- C:\Windows\System\DGDEfVH.exe
  C:\Windows\System\DGDEfVH.exe
  2⤵
  PID:13700
- C:\Windows\System\TKyMePC.exe
  C:\Windows\System\TKyMePC.exe
  2⤵
  PID:13732
- C:\Windows\System\mxCMGmA.exe
  C:\Windows\System\mxCMGmA.exe
  2⤵
  PID:13756
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 13756 -s 252
    3⤵
    PID:9944
- C:\Windows\System\IpyOhZg.exe
  C:\Windows\System\IpyOhZg.exe
  2⤵
  PID:13780
- C:\Windows\System\pRkdKOe.exe
  C:\Windows\System\pRkdKOe.exe
  2⤵
  PID:13800
- C:\Windows\System\IGkQzvA.exe
  C:\Windows\System\IGkQzvA.exe
  2⤵
  PID:13820
- C:\Windows\System\DlfFXWy.exe
  C:\Windows\System\DlfFXWy.exe
  2⤵
  PID:13844
- C:\Windows\System\slMWSes.exe
  C:\Windows\System\slMWSes.exe
  2⤵
  PID:13868
- C:\Windows\System\HvjacLL.exe
  C:\Windows\System\HvjacLL.exe
  2⤵
  PID:13884
- C:\Windows\System\cvyeiEX.exe
  C:\Windows\System\cvyeiEX.exe
  2⤵
  PID:13900
- C:\Windows\System\HtiKhjZ.exe
  C:\Windows\System\HtiKhjZ.exe
  2⤵
  PID:13916
- C:\Windows\System\ntYskys.exe
  C:\Windows\System\ntYskys.exe
  2⤵
  PID:13932
- C:\Windows\System\DwGkPvK.exe
  C:\Windows\System\DwGkPvK.exe
  2⤵
  PID:13948
- C:\Windows\System\VQzHIjI.exe
  C:\Windows\System\VQzHIjI.exe
  2⤵
  PID:13964
- C:\Windows\System\BndUyuE.exe
  C:\Windows\System\BndUyuE.exe
  2⤵
  PID:13980
- C:\Windows\System\wSBKklE.exe
  C:\Windows\System\wSBKklE.exe
  2⤵
  PID:13996
- C:\Windows\System\ENHviCO.exe
  C:\Windows\System\ENHviCO.exe
  2⤵
  PID:14012
- C:\Windows\System\YIRfiCr.exe
  C:\Windows\System\YIRfiCr.exe
  2⤵
  PID:14028
- C:\Windows\System\tAiMYXx.exe
  C:\Windows\System\tAiMYXx.exe
  2⤵
  PID:14044
- C:\Windows\System\slOImXd.exe
  C:\Windows\System\slOImXd.exe
  2⤵
  PID:14060
- C:\Windows\System\YNNeycb.exe
  C:\Windows\System\YNNeycb.exe
  2⤵
  PID:14076
- C:\Windows\System\UKEPYWe.exe
  C:\Windows\System\UKEPYWe.exe
  2⤵
  PID:14092
- C:\Windows\System\Aajeqci.exe
  C:\Windows\System\Aajeqci.exe
  2⤵
  PID:14108
- C:\Windows\System\hCLSXwq.exe
  C:\Windows\System\hCLSXwq.exe
  2⤵
  PID:14124
- C:\Windows\System\TissnFD.exe
  C:\Windows\System\TissnFD.exe
  2⤵
  PID:14140
- C:\Windows\System\SfYFCcO.exe
  C:\Windows\System\SfYFCcO.exe
  2⤵
  PID:14156
- C:\Windows\System\ZzeeEvk.exe
  C:\Windows\System\ZzeeEvk.exe
  2⤵
  PID:14172
- C:\Windows\System\VnfEsSN.exe
  C:\Windows\System\VnfEsSN.exe
  2⤵
  PID:14188
- C:\Windows\System\BBaNLbo.exe
  C:\Windows\System\BBaNLbo.exe
  2⤵
  PID:14204
- C:\Windows\System\HcsxKEC.exe
  C:\Windows\System\HcsxKEC.exe
  2⤵
  PID:14220
- C:\Windows\System\zJXpUWm.exe
  C:\Windows\System\zJXpUWm.exe
  2⤵
  PID:14240
- C:\Windows\System\PkgUBAX.exe
  C:\Windows\System\PkgUBAX.exe
  2⤵
  PID:14264
- C:\Windows\System\dAzyCkL.exe
  C:\Windows\System\dAzyCkL.exe
  2⤵
  PID:14288
- C:\Windows\System\DoPVEfv.exe
  C:\Windows\System\DoPVEfv.exe
  2⤵
  PID:14312
- C:\Windows\System\nxyTPlQ.exe
  C:\Windows\System\nxyTPlQ.exe
  2⤵
  PID:8832
- C:\Windows\System\FkXFiJm.exe
  C:\Windows\System\FkXFiJm.exe
  2⤵
  PID:8848
- C:\Windows\System\LIWRaMx.exe
  C:\Windows\System\LIWRaMx.exe
  2⤵
  PID:10968
- C:\Windows\System\FMdZVMN.exe
  C:\Windows\System\FMdZVMN.exe
  2⤵
  PID:6748
- C:\Windows\System\SokArfA.exe
  C:\Windows\System\SokArfA.exe
  2⤵
  PID:10996
- C:\Windows\System\RPfbgQh.exe
  C:\Windows\System\RPfbgQh.exe
  2⤵
  PID:7180
- C:\Windows\System\xrMqLyg.exe
  C:\Windows\System\xrMqLyg.exe
  2⤵
  PID:9248
- C:\Windows\System\IStimbd.exe
  C:\Windows\System\IStimbd.exe
  2⤵
  PID:9284
- C:\Windows\System\CHsAuSm.exe
  C:\Windows\System\CHsAuSm.exe
  2⤵
  PID:9308
- C:\Windows\System\leeODEf.exe
  C:\Windows\System\leeODEf.exe
  2⤵
  PID:5784
- C:\Windows\System\fymbECE.exe
  C:\Windows\System\fymbECE.exe
  2⤵
  PID:7060
- C:\Windows\System\GJNayXa.exe
  C:\Windows\System\GJNayXa.exe
  2⤵
  PID:7084
- C:\Windows\System\SxFQidH.exe
  C:\Windows\System\SxFQidH.exe
  2⤵
  PID:14356
- C:\Windows\System\OSuSqSm.exe
  C:\Windows\System\OSuSqSm.exe
  2⤵
  PID:14380
- C:\Windows\System\UcJDMYS.exe
  C:\Windows\System\UcJDMYS.exe
  2⤵
  PID:14400
- C:\Windows\System\zumzeuz.exe
  C:\Windows\System\zumzeuz.exe
  2⤵
  PID:14432
- C:\Windows\System\CWUsuTK.exe
  C:\Windows\System\CWUsuTK.exe
  2⤵
  PID:14460
- C:\Windows\System\MSrzwkZ.exe
  C:\Windows\System\MSrzwkZ.exe
  2⤵
  PID:14480
- C:\Windows\System\MuDztYp.exe
  C:\Windows\System\MuDztYp.exe
  2⤵
  PID:14496
- C:\Windows\System\NTZcyJd.exe
  C:\Windows\System\NTZcyJd.exe
  2⤵
  PID:14516
- C:\Windows\System\bSeHrQi.exe
  C:\Windows\System\bSeHrQi.exe
  2⤵
  PID:14536
- C:\Windows\System\vzyWPrQ.exe
  C:\Windows\System\vzyWPrQ.exe
  2⤵
  PID:14560
- C:\Windows\System\vdnRNbZ.exe
  C:\Windows\System\vdnRNbZ.exe
  2⤵
  PID:14592
- C:\Windows\System\VdLLhln.exe
  C:\Windows\System\VdLLhln.exe
  2⤵
  PID:14616
- C:\Windows\System\kdaLthR.exe
  C:\Windows\System\kdaLthR.exe
  2⤵
  PID:14644
- C:\Windows\System\UIMygXa.exe
  C:\Windows\System\UIMygXa.exe
  2⤵
  PID:14664
- C:\Windows\System\SplyyPq.exe
  C:\Windows\System\SplyyPq.exe
  2⤵
  PID:14684
- C:\Windows\System\PJRQzaF.exe
  C:\Windows\System\PJRQzaF.exe
  2⤵
  PID:14704
- C:\Windows\System\GzYCNEo.exe
  C:\Windows\System\GzYCNEo.exe
  2⤵
  PID:14720
- C:\Windows\System\VuqyCao.exe
  C:\Windows\System\VuqyCao.exe
  2⤵
  PID:14736
- C:\Windows\System\xRcdAzo.exe
  C:\Windows\System\xRcdAzo.exe
  2⤵
  PID:14764
- C:\Windows\System\KuCxobr.exe
  C:\Windows\System\KuCxobr.exe
  2⤵
  PID:14784
- C:\Windows\System\MwGTVBA.exe
  C:\Windows\System\MwGTVBA.exe
  2⤵
  PID:14800
- C:\Windows\System\xvDnsrP.exe
  C:\Windows\System\xvDnsrP.exe
  2⤵
  PID:14816
- C:\Windows\System\CrdDJly.exe
  C:\Windows\System\CrdDJly.exe
  2⤵
  PID:14832
- C:\Windows\System\AdfyhKr.exe
  C:\Windows\System\AdfyhKr.exe
  2⤵
  PID:14856
- C:\Windows\System\zyyKPWd.exe
  C:\Windows\System\zyyKPWd.exe
  2⤵
  PID:14876
- C:\Windows\System\URHclkw.exe
  C:\Windows\System\URHclkw.exe
  2⤵
  PID:14892
- C:\Windows\System\ZKmthXj.exe
  C:\Windows\System\ZKmthXj.exe
  2⤵
  PID:14916
- C:\Windows\System\PvSPFCv.exe
  C:\Windows\System\PvSPFCv.exe
  2⤵
  PID:14936
- C:\Windows\System\MXtOXFy.exe
  C:\Windows\System\MXtOXFy.exe
  2⤵
  PID:14956
- C:\Windows\System\qOBoKUl.exe
  C:\Windows\System\qOBoKUl.exe
  2⤵
  PID:14972
- C:\Windows\System\yRxupNz.exe
  C:\Windows\System\yRxupNz.exe
  2⤵
  PID:15008
- C:\Windows\System\zmtJoRP.exe
  C:\Windows\System\zmtJoRP.exe
  2⤵
  PID:15024
- C:\Windows\System\ulfIAFg.exe
  C:\Windows\System\ulfIAFg.exe
  2⤵
  PID:15052
- C:\Windows\System\CqfYexR.exe
  C:\Windows\System\CqfYexR.exe
  2⤵
  PID:15080
- C:\Windows\System\ZvzpOtp.exe
  C:\Windows\System\ZvzpOtp.exe
  2⤵
  PID:15096
- C:\Windows\System\KCLAgTj.exe
  C:\Windows\System\KCLAgTj.exe
  2⤵
  PID:15124
- C:\Windows\System\WlRAzGR.exe
  C:\Windows\System\WlRAzGR.exe
  2⤵
  PID:15164
- C:\Windows\System\jSZyYaq.exe
  C:\Windows\System\jSZyYaq.exe
  2⤵
  PID:15184
- C:\Windows\System\DEwwbPF.exe
  C:\Windows\System\DEwwbPF.exe
  2⤵
  PID:15200
- C:\Windows\System\DgFrRer.exe
  C:\Windows\System\DgFrRer.exe
  2⤵
  PID:15228
- C:\Windows\System\aqWXpwL.exe
  C:\Windows\System\aqWXpwL.exe
  2⤵
  PID:15248
- C:\Windows\System\qrzWoUf.exe
  C:\Windows\System\qrzWoUf.exe
  2⤵
  PID:15268
- C:\Windows\System\xNeSNsM.exe
  C:\Windows\System\xNeSNsM.exe
  2⤵
  PID:15284
- C:\Windows\System\hlDjuPq.exe
  C:\Windows\System\hlDjuPq.exe
  2⤵
  PID:15300
- C:\Windows\System\gWepZoL.exe
  C:\Windows\System\gWepZoL.exe
  2⤵
  PID:15316
- C:\Windows\System\vreEJsQ.exe
  C:\Windows\System\vreEJsQ.exe
  2⤵
  PID:15332
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15332 -s 248
    3⤵
    PID:10416
- C:\Windows\System\oskIedI.exe
  C:\Windows\System\oskIedI.exe
  2⤵
  PID:15348
- C:\Windows\System\pzBaFVp.exe
  C:\Windows\System\pzBaFVp.exe
  2⤵
  PID:9448
- C:\Windows\System\BgQNbpG.exe
  C:\Windows\System\BgQNbpG.exe
  2⤵
  PID:9508
- C:\Windows\System\quiXMdo.exe
  C:\Windows\System\quiXMdo.exe
  2⤵
  PID:9372
- C:\Windows\System\nonEYrz.exe
  C:\Windows\System\nonEYrz.exe
  2⤵
  PID:11032
- C:\Windows\System\TyCMwuk.exe
  C:\Windows\System\TyCMwuk.exe
  2⤵
  PID:9532
- C:\Windows\System\CKeJQOR.exe
  C:\Windows\System\CKeJQOR.exe
  2⤵
  PID:9568
- C:\Windows\System\xCCDaJY.exe
  C:\Windows\System\xCCDaJY.exe
  2⤵
  PID:9724
- C:\Windows\System\HBgIhsQ.exe
  C:\Windows\System\HBgIhsQ.exe
  2⤵
  PID:9784
- C:\Windows\System\ivusDQe.exe
  C:\Windows\System\ivusDQe.exe
  2⤵
  PID:9816
- C:\Windows\System\rUjcOCI.exe
  C:\Windows\System\rUjcOCI.exe
  2⤵
  PID:9884
- C:\Windows\System\txBHxch.exe
  C:\Windows\System\txBHxch.exe
  2⤵
  PID:9944
- C:\Windows\System\pAzkjmW.exe
  C:\Windows\System\pAzkjmW.exe
  2⤵
  PID:10052
- C:\Windows\System\JVqvxJz.exe
  C:\Windows\System\JVqvxJz.exe
  2⤵
  PID:3264
- C:\Windows\System\VtosYcC.exe
  C:\Windows\System\VtosYcC.exe
  2⤵
  PID:11148
- C:\Windows\System\GmHAcpu.exe
  C:\Windows\System\GmHAcpu.exe
  2⤵
  PID:10120
- C:\Windows\System\wdNMAOh.exe
  C:\Windows\System\wdNMAOh.exe
  2⤵
  PID:11168
- C:\Windows\System\CHnHIkD.exe
  C:\Windows\System\CHnHIkD.exe
  2⤵
  PID:10048
- C:\Windows\System\rvpJwqL.exe
  C:\Windows\System\rvpJwqL.exe
  2⤵
  PID:7584
- C:\Windows\System\kppMgrM.exe
  C:\Windows\System\kppMgrM.exe
  2⤵
  PID:10148
- C:\Windows\System\RDHCxZw.exe
  C:\Windows\System\RDHCxZw.exe
  2⤵
  PID:7716
- C:\Windows\System\yiQKPVH.exe
  C:\Windows\System\yiQKPVH.exe
  2⤵
  PID:4552
- C:\Windows\System\UpLuTha.exe
  C:\Windows\System\UpLuTha.exe
  2⤵
  PID:10316
- C:\Windows\System\AjMqbaO.exe
  C:\Windows\System\AjMqbaO.exe
  2⤵
  PID:10396
- C:\Windows\System\ukDVWfZ.exe
  C:\Windows\System\ukDVWfZ.exe
  2⤵
  PID:10432
- C:\Windows\System\ZxAJseR.exe
  C:\Windows\System\ZxAJseR.exe
  2⤵
  PID:8032
- C:\Windows\System\OwinEgU.exe
  C:\Windows\System\OwinEgU.exe
  2⤵
  PID:10608
- C:\Windows\System\ZRpYKyB.exe
  C:\Windows\System\ZRpYKyB.exe
  2⤵
  PID:8080
- C:\Windows\System\fCNKKVf.exe
  C:\Windows\System\fCNKKVf.exe
  2⤵
  PID:15376
- C:\Windows\System\uiwNdNh.exe
  C:\Windows\System\uiwNdNh.exe
  2⤵
  PID:15392
- C:\Windows\System\afEyqWn.exe
  C:\Windows\System\afEyqWn.exe
  2⤵
  PID:15408
- C:\Windows\System\LvHhfde.exe
  C:\Windows\System\LvHhfde.exe
  2⤵
  PID:15424
- C:\Windows\System\KxanyYO.exe
  C:\Windows\System\KxanyYO.exe
  2⤵
  PID:15440
- C:\Windows\System\fXKPxHu.exe
  C:\Windows\System\fXKPxHu.exe
  2⤵
  PID:15456
- C:\Windows\System\wmoGRNE.exe
  C:\Windows\System\wmoGRNE.exe
  2⤵
  PID:15472
- C:\Windows\System\TcwZCJe.exe
  C:\Windows\System\TcwZCJe.exe
  2⤵
  PID:15488
- C:\Windows\System\WpaceMD.exe
  C:\Windows\System\WpaceMD.exe
  2⤵
  PID:15520
- C:\Windows\System\bZIAsJu.exe
  C:\Windows\System\bZIAsJu.exe
  2⤵
  PID:15660
- C:\Windows\System\mlyihAE.exe
  C:\Windows\System\mlyihAE.exe
  2⤵
  PID:15676
- C:\Windows\System\gavqgKZ.exe
  C:\Windows\System\gavqgKZ.exe
  2⤵
  PID:15700
- C:\Windows\System\WItWTgH.exe
  C:\Windows\System\WItWTgH.exe
  2⤵
  PID:15716
- C:\Windows\System\NeGECvx.exe
  C:\Windows\System\NeGECvx.exe
  2⤵
  PID:15752
- C:\Windows\System\MipyJPE.exe
  C:\Windows\System\MipyJPE.exe
  2⤵
  PID:15772
- C:\Windows\System\DpIlEqo.exe
  C:\Windows\System\DpIlEqo.exe
  2⤵
  PID:15876
- C:\Windows\System\CrzAaUQ.exe
  C:\Windows\System\CrzAaUQ.exe
  2⤵
  PID:15960
- C:\Windows\System\LDolFBn.exe
  C:\Windows\System\LDolFBn.exe
  2⤵
  PID:8784
- C:\Windows\System\UTDpfok.exe
  C:\Windows\System\UTDpfok.exe
  2⤵
  PID:8940
- C:\Windows\System\UUGKuCB.exe
  C:\Windows\System\UUGKuCB.exe
  2⤵
  PID:5496
- C:\Windows\System\pwEsyNm.exe
  C:\Windows\System\pwEsyNm.exe
  2⤵
  PID:10932
- C:\Windows\System\PIPnGDV.exe
  C:\Windows\System\PIPnGDV.exe
  2⤵
  PID:3784
- C:\Windows\System\oxltxwN.exe
  C:\Windows\System\oxltxwN.exe
  2⤵
  PID:9336
- C:\Windows\System\yokwbUo.exe
  C:\Windows\System\yokwbUo.exe
  2⤵
  PID:9416
- C:\Windows\System\jAuEjZP.exe
  C:\Windows\System\jAuEjZP.exe
  2⤵
  PID:11016
- C:\Windows\System\oMajNmI.exe
  C:\Windows\System\oMajNmI.exe
  2⤵
  PID:9616
- C:\Windows\System\pzSikSg.exe
  C:\Windows\System\pzSikSg.exe
  2⤵
  PID:9644
- C:\Windows\System\rlQsafK.exe
  C:\Windows\System\rlQsafK.exe
  2⤵
  PID:9880
- C:\Windows\System\iQttDRL.exe
  C:\Windows\System\iQttDRL.exe
  2⤵
  PID:11136
- C:\Windows\System\QXxwqCF.exe
  C:\Windows\System\QXxwqCF.exe
  2⤵
  PID:11288
- C:\Windows\System\iyhKztY.exe
  C:\Windows\System\iyhKztY.exe
  2⤵
  PID:11328
- C:\Windows\System\WcgQdDw.exe
  C:\Windows\System\WcgQdDw.exe
  2⤵
  PID:11332
- C:\Windows\System\kFkvPes.exe
  C:\Windows\System\kFkvPes.exe
  2⤵
  PID:11388
- C:\Windows\System\vwJNzfj.exe
  C:\Windows\System\vwJNzfj.exe
  2⤵
  PID:11416
- C:\Windows\System\qAVIagm.exe
  C:\Windows\System\qAVIagm.exe
  2⤵
  PID:11448
- C:\Windows\System\stKywby.exe
  C:\Windows\System\stKywby.exe
  2⤵
  PID:11484
- C:\Windows\System\rkrpRTU.exe
  C:\Windows\System\rkrpRTU.exe
  2⤵
  PID:11500
- C:\Windows\System\EbFZJhm.exe
  C:\Windows\System\EbFZJhm.exe
  2⤵
  PID:11528
- C:\Windows\System\WNDrGCp.exe
  C:\Windows\System\WNDrGCp.exe
  2⤵
  PID:11572
- C:\Windows\System\Dtbqfao.exe
  C:\Windows\System\Dtbqfao.exe
  2⤵
  PID:11532
- C:\Windows\System\QumITUs.exe
  C:\Windows\System\QumITUs.exe
  2⤵
  PID:11620
- C:\Windows\System\qoRUxEh.exe
  C:\Windows\System\qoRUxEh.exe
  2⤵
  PID:11648
- C:\Windows\System\CclFiVE.exe
  C:\Windows\System\CclFiVE.exe
  2⤵
  PID:11668
- C:\Windows\System\GFuqcPu.exe
  C:\Windows\System\GFuqcPu.exe
  2⤵
  PID:10472
- C:\Windows\System\TRZqjnr.exe
  C:\Windows\System\TRZqjnr.exe
  2⤵
  PID:11728
- C:\Windows\System\mcMSYsg.exe
  C:\Windows\System\mcMSYsg.exe
  2⤵
  PID:11752
- C:\Windows\System\QeJQxpp.exe
  C:\Windows\System\QeJQxpp.exe
  2⤵
  PID:10496
- C:\Windows\System\OFlxJIS.exe
  C:\Windows\System\OFlxJIS.exe
  2⤵
  PID:11792
- C:\Windows\System\BSVaDBu.exe
  C:\Windows\System\BSVaDBu.exe
  2⤵
  PID:11820
- C:\Windows\System\RsZSHkt.exe
  C:\Windows\System\RsZSHkt.exe
  2⤵
  PID:10544
- C:\Windows\System\yUfvubY.exe
  C:\Windows\System\yUfvubY.exe
  2⤵
  PID:11860
- C:\Windows\System\BVihEzB.exe
  C:\Windows\System\BVihEzB.exe
  2⤵
  PID:11920
- C:\Windows\System\TwixBYH.exe
  C:\Windows\System\TwixBYH.exe
  2⤵
  PID:11948
- C:\Windows\System\cUoMOir.exe
  C:\Windows\System\cUoMOir.exe
  2⤵
  PID:11992
- C:\Windows\System\mQlWrfp.exe
  C:\Windows\System\mQlWrfp.exe
  2⤵
  PID:12016
- C:\Windows\System\TKBSpse.exe
  C:\Windows\System\TKBSpse.exe
  2⤵
  PID:12100
- C:\Windows\System\XYjemiV.exe
  C:\Windows\System\XYjemiV.exe
  2⤵
  PID:12152
- C:\Windows\System\bJrhhmF.exe
  C:\Windows\System\bJrhhmF.exe
  2⤵
  PID:12200
- C:\Windows\System\qmveWaC.exe
  C:\Windows\System\qmveWaC.exe
  2⤵
  PID:12236
- C:\Windows\System\GcmJMDn.exe
  C:\Windows\System\GcmJMDn.exe
  2⤵
  PID:7732
- C:\Windows\System\rUSjurs.exe
  C:\Windows\System\rUSjurs.exe
  2⤵
  PID:10492
- C:\Windows\System\QrLCxJH.exe
  C:\Windows\System\QrLCxJH.exe
  2⤵
  PID:7904
- C:\Windows\System\XdgJncO.exe
  C:\Windows\System\XdgJncO.exe
  2⤵
  PID:10580
- C:\Windows\System\gqqqhWU.exe
  C:\Windows\System\gqqqhWU.exe
  2⤵
  PID:7984
- C:\Windows\System\GQTFRSZ.exe
  C:\Windows\System\GQTFRSZ.exe
  2⤵
  PID:8088
- C:\Windows\System\vgtNqkS.exe
  C:\Windows\System\vgtNqkS.exe
  2⤵
  PID:8276
- C:\Windows\System\BKJkDGZ.exe
  C:\Windows\System\BKJkDGZ.exe
  2⤵
  PID:8340
- C:\Windows\System\vStAXfD.exe
  C:\Windows\System\vStAXfD.exe
  2⤵
  PID:8440
- C:\Windows\System\CXmMjxe.exe
  C:\Windows\System\CXmMjxe.exe
  2⤵
  PID:12340
- C:\Windows\System\tzOLeCt.exe
  C:\Windows\System\tzOLeCt.exe
  2⤵
  PID:12372
- C:\Windows\System\uJwMjgE.exe
  C:\Windows\System\uJwMjgE.exe
  2⤵
  PID:12416
- C:\Windows\System\JYmDOOG.exe
  C:\Windows\System\JYmDOOG.exe
  2⤵
  PID:12448
- C:\Windows\System\VpNMUQO.exe
  C:\Windows\System\VpNMUQO.exe
  2⤵
  PID:12508
- C:\Windows\System\LUTcQGo.exe
  C:\Windows\System\LUTcQGo.exe
  2⤵
  PID:12564
- C:\Windows\System\HzOJVwF.exe
  C:\Windows\System\HzOJVwF.exe
  2⤵
  PID:12632
- C:\Windows\System\viIRYWp.exe
  C:\Windows\System\viIRYWp.exe
  2⤵
  PID:12628
- C:\Windows\System\cStluUE.exe
  C:\Windows\System\cStluUE.exe
  2⤵
  PID:12712
- C:\Windows\System\BqUsfDs.exe
  C:\Windows\System\BqUsfDs.exe
  2⤵
  PID:12792
- C:\Windows\System\GHwbtpl.exe
  C:\Windows\System\GHwbtpl.exe
  2⤵
  PID:6556
- C:\Windows\System\pMymFkv.exe
  C:\Windows\System\pMymFkv.exe
  2⤵
  PID:13360
- C:\Windows\System\kvOoSLB.exe
  C:\Windows\System\kvOoSLB.exe
  2⤵
  PID:13408
- C:\Windows\System\rswVEfc.exe
  C:\Windows\System\rswVEfc.exe
  2⤵
  PID:13588
- C:\Windows\System\roTMaiZ.exe
  C:\Windows\System\roTMaiZ.exe
  2⤵
  PID:13660
- C:\Windows\System\mJcOVle.exe
  C:\Windows\System\mJcOVle.exe
  2⤵
  PID:13716
- C:\Windows\System\nXjEyEj.exe
  C:\Windows\System\nXjEyEj.exe
  2⤵
  PID:13764
- C:\Windows\System\dwyNUwW.exe
  C:\Windows\System\dwyNUwW.exe
  2⤵
  PID:13792
- C:\Windows\System\mnVTBro.exe
  C:\Windows\System\mnVTBro.exe
  2⤵
  PID:13856
- C:\Windows\System\RPKxZVk.exe
  C:\Windows\System\RPKxZVk.exe
  2⤵
  PID:13940
- C:\Windows\System\qtktNnr.exe
  C:\Windows\System\qtktNnr.exe
  2⤵
  PID:13976
- C:\Windows\System\ifvOHJs.exe
  C:\Windows\System\ifvOHJs.exe
  2⤵
  PID:14036
- C:\Windows\System\IGzxZEl.exe
  C:\Windows\System\IGzxZEl.exe
  2⤵
  PID:14056
- C:\Windows\System\ZEUCijB.exe
  C:\Windows\System\ZEUCijB.exe
  2⤵
  PID:14088
- C:\Windows\System\QUwtQEl.exe
  C:\Windows\System\QUwtQEl.exe
  2⤵
  PID:14180
- C:\Windows\System\AfMlDUJ.exe
  C:\Windows\System\AfMlDUJ.exe
  2⤵
  PID:14216
- C:\Windows\System\XMOsgeq.exe
  C:\Windows\System\XMOsgeq.exe
  2⤵
  PID:14252
- C:\Windows\System\RfHTZxA.exe
  C:\Windows\System\RfHTZxA.exe
  2⤵
  PID:14300
- C:\Windows\System\oIAGJSV.exe
  C:\Windows\System\oIAGJSV.exe
  2⤵
  PID:8884
- C:\Windows\System\QAMYYuy.exe
  C:\Windows\System\QAMYYuy.exe
  2⤵
  PID:5856
- C:\Windows\System\ahwUtQT.exe
  C:\Windows\System\ahwUtQT.exe
  2⤵
  PID:9220
- C:\Windows\System\UHUlPcz.exe
  C:\Windows\System\UHUlPcz.exe
  2⤵
  PID:6856
- C:\Windows\System\YMLyTMb.exe
  C:\Windows\System\YMLyTMb.exe
  2⤵
  PID:7044
- C:\Windows\System\UEbhtwF.exe
  C:\Windows\System\UEbhtwF.exe
  2⤵
  PID:2176
- C:\Windows\System\YPNfYmY.exe
  C:\Windows\System\YPNfYmY.exe
  2⤵
  PID:14388
- C:\Windows\System\sZsCWkj.exe
  C:\Windows\System\sZsCWkj.exe
  2⤵
  PID:14468
- C:\Windows\System\OJkByPE.exe
  C:\Windows\System\OJkByPE.exe
  2⤵
  PID:14532
- C:\Windows\System\iQMurRg.exe
  C:\Windows\System\iQMurRg.exe
  2⤵
  PID:14528
- C:\Windows\System\yVrzGoo.exe
  C:\Windows\System\yVrzGoo.exe
  2⤵
  PID:14604
- C:\Windows\System\DRwcaxN.exe
  C:\Windows\System\DRwcaxN.exe
  2⤵
  PID:14628
- C:\Windows\System\Eqpmpyt.exe
  C:\Windows\System\Eqpmpyt.exe
  2⤵
  PID:15324
- C:\Windows\System\ZgZzdvw.exe
  C:\Windows\System\ZgZzdvw.exe
  2⤵
  PID:15644
- C:\Windows\System\XeYHOEA.exe
  C:\Windows\System\XeYHOEA.exe
  2⤵
  PID:15788
- C:\Windows\System\OINkTnt.exe
  C:\Windows\System\OINkTnt.exe
  2⤵
  PID:15804
- C:\Windows\System\uYgFExo.exe
  C:\Windows\System\uYgFExo.exe
  2⤵
  PID:15908
- C:\Windows\System\lSsPXZl.exe
  C:\Windows\System\lSsPXZl.exe
  2⤵
  PID:15928
- C:\Windows\System\NIjCcWO.exe
  C:\Windows\System\NIjCcWO.exe
  2⤵
  PID:9960
- C:\Windows\System\gPQQMaR.exe
  C:\Windows\System\gPQQMaR.exe
  2⤵
  PID:11276
- C:\Windows\System\BebPHMe.exe
  C:\Windows\System\BebPHMe.exe
  2⤵
  PID:16000
- C:\Windows\System\RWvdTrR.exe
  C:\Windows\System\RWvdTrR.exe
  2⤵
  PID:11368
- C:\Windows\System\YzdcxHr.exe
  C:\Windows\System\YzdcxHr.exe
  2⤵
  PID:16052
- C:\Windows\System\yJwSkVO.exe
  C:\Windows\System\yJwSkVO.exe
  2⤵
  PID:9668
- C:\Windows\System\ujNwdhE.exe
  C:\Windows\System\ujNwdhE.exe
  2⤵
  PID:11596
- C:\Windows\System\faclgZB.exe
  C:\Windows\System\faclgZB.exe
  2⤵
  PID:12044
- C:\Windows\System\FxKICzf.exe
  C:\Windows\System\FxKICzf.exe
  2⤵
  PID:12080
- C:\Windows\System\DqbovGA.exe
  C:\Windows\System\DqbovGA.exe
  2⤵
  PID:12148
- C:\Windows\System\DskZWqj.exe
  C:\Windows\System\DskZWqj.exe
  2⤵
  PID:12256
- C:\Windows\System\ukkxTzh.exe
  C:\Windows\System\ukkxTzh.exe
  2⤵
  PID:10424
- C:\Windows\System\frouZuO.exe
  C:\Windows\System\frouZuO.exe
  2⤵
  PID:8296
- C:\Windows\System\XDwJkSC.exe
  C:\Windows\System\XDwJkSC.exe
  2⤵
  PID:6624
- C:\Windows\System\aqtAiKI.exe
  C:\Windows\System\aqtAiKI.exe
  2⤵
  PID:12924
- C:\Windows\System\xrKMoLu.exe
  C:\Windows\System\xrKMoLu.exe
  2⤵
  PID:12984
- C:\Windows\System\QceIvKM.exe
  C:\Windows\System\QceIvKM.exe
  2⤵
  PID:13216
- C:\Windows\System\IEqwUKa.exe
  C:\Windows\System\IEqwUKa.exe
  2⤵
  PID:16236
- C:\Windows\System\OnuXcyA.exe
  C:\Windows\System\OnuXcyA.exe
  2⤵
  PID:1752
- C:\Windows\System\NAWafRU.exe
  C:\Windows\System\NAWafRU.exe
  2⤵
  PID:16280
- C:\Windows\System\jazCmlD.exe
  C:\Windows\System\jazCmlD.exe
  2⤵
  PID:8972
- C:\Windows\System\RejMoXr.exe
  C:\Windows\System\RejMoXr.exe
  2⤵
  PID:13536
- C:\Windows\System\FdWuYni.exe
  C:\Windows\System\FdWuYni.exe
  2⤵
  PID:13600
- C:\Windows\System\NwrPrUQ.exe
  C:\Windows\System\NwrPrUQ.exe
  2⤵
  PID:13644
- C:\Windows\System\fizKIsi.exe
  C:\Windows\System\fizKIsi.exe
  2⤵
  PID:13796
- C:\Windows\System\PBXzLkf.exe
  C:\Windows\System\PBXzLkf.exe
  2⤵
  PID:13864
- C:\Windows\System\PdhDUoY.exe
  C:\Windows\System\PdhDUoY.exe
  2⤵
  PID:14008
- C:\Windows\System\rgPPhnC.exe
  C:\Windows\System\rgPPhnC.exe
  2⤵
  PID:14472
- C:\Windows\System\EeFSvLX.exe
  C:\Windows\System\EeFSvLX.exe
  2⤵
  PID:14660
- C:\Windows\System\qlidwAd.exe
  C:\Windows\System\qlidwAd.exe
  2⤵
  PID:14716
- C:\Windows\System\xLZqCvq.exe
  C:\Windows\System\xLZqCvq.exe
  2⤵
  PID:9692
- C:\Windows\System\wjTcltB.exe
  C:\Windows\System\wjTcltB.exe
  2⤵
  PID:14772
- C:\Windows\System\pSHoOpB.exe
  C:\Windows\System\pSHoOpB.exe
  2⤵
  PID:14968
- C:\Windows\System\JTverFo.exe
  C:\Windows\System\JTverFo.exe
  2⤵
  PID:15160
- C:\Windows\System\fckuagB.exe
  C:\Windows\System\fckuagB.exe
  2⤵
  PID:15196
- C:\Windows\System\CFRbQkG.exe
  C:\Windows\System\CFRbQkG.exe
  2⤵
  PID:15224
- C:\Windows\System\QYLdGQw.exe
  C:\Windows\System\QYLdGQw.exe
  2⤵
  PID:15256
- C:\Windows\System\GbFhrxF.exe
  C:\Windows\System\GbFhrxF.exe
  2⤵
  PID:15280
- C:\Windows\System\rdwVRFd.exe
  C:\Windows\System\rdwVRFd.exe
  2⤵
  PID:10688
- C:\Windows\System\cAUaMeQ.exe
  C:\Windows\System\cAUaMeQ.exe
  2⤵
  PID:15356
- C:\Windows\System\GapnWnn.exe
  C:\Windows\System\GapnWnn.exe
  2⤵
  PID:9360
- C:\Windows\System\RrJaCxG.exe
  C:\Windows\System\RrJaCxG.exe
  2⤵
  PID:7400
- C:\Windows\System\ZWPUjTU.exe
  C:\Windows\System\ZWPUjTU.exe
  2⤵
  PID:2544
- C:\Windows\System\PSjyqhJ.exe
  C:\Windows\System\PSjyqhJ.exe
  2⤵
  PID:9808
- C:\Windows\System\NghIExE.exe
  C:\Windows\System\NghIExE.exe
  2⤵
  PID:9976
- C:\Windows\System\bvEddVq.exe
  C:\Windows\System\bvEddVq.exe
  2⤵
  PID:1012
- C:\Windows\System\SonsKBI.exe
  C:\Windows\System\SonsKBI.exe
  2⤵
  PID:11152
- C:\Windows\System\jOsXZwI.exe
  C:\Windows\System\jOsXZwI.exe
  2⤵
  PID:11180
- C:\Windows\System\knPHsvC.exe
  C:\Windows\System\knPHsvC.exe
  2⤵
  PID:7632
- C:\Windows\System\oCOyhec.exe
  C:\Windows\System\oCOyhec.exe
  2⤵
  PID:10212
- C:\Windows\System\NpssMJu.exe
  C:\Windows\System\NpssMJu.exe
  2⤵
  PID:10360
- C:\Windows\System\SSSesfm.exe
  C:\Windows\System\SSSesfm.exe
  2⤵
  PID:6268
- C:\Windows\System\LYLGiRg.exe
  C:\Windows\System\LYLGiRg.exe
  2⤵
  PID:8060
- C:\Windows\System\BumAUty.exe
  C:\Windows\System\BumAUty.exe
  2⤵
  PID:15384
- C:\Windows\System\vsxVCGY.exe
  C:\Windows\System\vsxVCGY.exe
  2⤵
  PID:15632
- C:\Windows\System\evWBOSO.exe
  C:\Windows\System\evWBOSO.exe
  2⤵
  PID:10884

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 564 -p 13756 -ip 13756
1⤵
PID:11180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:10688

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 764b7d04d267d1d27685f4206ef25a57 WMviaFYAW0a+OeSBnsu4mw.0.1.0.0.0
1⤵
PID:13796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

APWgReA.exe

Path C:\Windows\System\APWgReA.exe
Size 5.8MB
SHA256 befa4bf74adddd82a8f92353507545292ba37c8bed43f915ef096818a0cad8f4
MD5 ae617b9e944777bd539b200adb741045
SHA1 6888eb5d4d021a2430d22d2a0a3c306ebe2eccd2
SHA512 46c6008fd0f8a68d922b9f3512188fb046415e8432c80847f96b6eda23d867cc60807b2468189bfca2381dfa860f100469cf56cb88dc33c5c00c2b06afea8e1e
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUa:j+R56utgpPF8u/7a
TLSH
T1F7565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BcOejmQ.exe

Path C:\Windows\System\BcOejmQ.exe
Size 5.8MB
SHA256 5305af1ae2dcd399cc1f3581a7f62f214d2c022f0cef0b9a9b8d0958d9556649
MD5 ae3c955ec37e961ffc5a941f4f97649c
SHA1 d9fde50135da98297185e2a51d02936930da42b6
SHA512 92892ba73666ea6d0aa127397bd99c6455ab1a2be8b8acda15f83e4fdd9c56e52d3c3a43285b96e9f7dd26a61935f556ce36a715847effca564553d46b00389b
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUC:j+R56utgpPF8u/7C
TLSH
T10F565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FGyFKzp.exe

Path C:\Windows\System\FGyFKzp.exe
Size 5.8MB
SHA256 ec6f13111c1741e6ce5ca5650d41e0719ceb819d2818b38e12c00036d2ff858b
MD5 829561504db1273dde39ec7745bca0a1
SHA1 94140f278fb72ccca5ccec2ffd6a617184c5c80b
SHA512 04ae64d90ab0acd8b872e43e6a27baeffbac652bb5568da425e1720f2f00f7ddc148d0973685a50e6b12f98fe6a76fd57040eb9d34ae3670eb79c4c8ac029408
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUy:j+R56utgpPF8u/7y
TLSH
T16B565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HiJaspb.exe

Path C:\Windows\System\HiJaspb.exe
Size 5.8MB
SHA256 f1399517829ec658000755c29a45ab66a6d7cafc5a4fbe9a23b0414088055d1a
MD5 3ac8a70a3bd14b55d6d2afeb09e0b169
SHA1 b4d2b75c98b73c357a9dd7d32acca3713b2a8476
SHA512 f8a9d62b5b95b6e118f81e2d9d1b59dffd5a402f2eedd22a93e83ae2e179c59d188127f4bde39889dbbf396ee4152f51e012e4dde306b0bceff6038178f044b8
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUw:j+R56utgpPF8u/7w
TLSH
T1C0565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IrFVhLd.exe

Path C:\Windows\System\IrFVhLd.exe
Size 5.8MB
SHA256 e301a4153079f31a1cec6fbe87e3dd324dffcd5f7486ca6141ff4c425054b18b
MD5 e7b908a2a8eb89a4f0b11499c612b40e
SHA1 3e680132c44b7d5b200e02bd0c694e244f097a3c
SHA512 5795ef5257b9faf803ff11c50f649cc88eb9c9f064b722b6401f2efbbf33d27d61b207b83419f8dee2e63f23635d296ddd308f24b164704d27262f7ccdfc657d
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUx:j+R56utgpPF8u/7x
TLSH
T16B566D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JpBXUfY.exe

Path C:\Windows\System\JpBXUfY.exe
Size 5.8MB
SHA256 ef7f13b4e269fb4a288f00dd4e06f3b41af246085c21fe7b55846d55cd0698eb
MD5 4f0840dd2d955c6236ded3824137cc84
SHA1 ddc048e88f90f62ac9f6f32a3ca4ce818185dd4b
SHA512 a5569f05c7e8f6b5c512e5bdfbc4e704f61c84e946eea173ff61b6ec23f26a87fae5ab7659f115b629cf2158a1a3fbf0d6b4de2fea1dc11f012f462d56eb5f39
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUr:j+R56utgpPF8u/7r
TLSH
T1D2565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KgzTIvM.exe

Path C:\Windows\System\KgzTIvM.exe
Size 5.8MB
SHA256 d09f843d6bb96a2f617962109269b4715b4204efda1b35fefc1e1825c569d050
MD5 f6d2b33a72f81bfd107a6271cf5945e8
SHA1 5478510fcffc595b2c7ef91180da3d539ac238de
SHA512 e506e4a18f85b6d36514033e5731f0adbe8d58bca03a6bc11fbebca669d1877d7bc7161b92a5ab38027111f07df05542999f37ea15beb728ea332c8458700d9c
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUM:j+R56utgpPF8u/7M
TLSH
T1A9565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KpeBqWD.exe

Path C:\Windows\System\KpeBqWD.exe
Size 5.8MB
SHA256 80b02a89a938eb9e9330825c71b3642e2cd61f7f9935e3431b3427e9320f0dd5
MD5 8336d221fd5f4230e223628476a370a6
SHA1 a52777c01f5abc2980d19e42c561f5893bc933ab
SHA512 5403ecd50cf9271566819187e4657797e34bff1bace351e862f63cb97fc7c7e87d0a5b9d58813e7864e2ad4fa44005f279cfc6a3fd9fe426ce55f5282445f486
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUR:j+R56utgpPF8u/7R
TLSH
T103565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KtMRUzr.exe

Path C:\Windows\System\KtMRUzr.exe
Size 5.8MB
SHA256 e61fba49f5b5cce5dbe08686c05589ad63ec7e0bf012007f37fd04628942e042
MD5 f76d460e64713e9adf4836eaeef63cd1
SHA1 989633f19cd8c4eed1ca9cd9b593092cfd793b61
SHA512 9d2edc5562e77a48c8b126c68e0c16593fa256d99966c45a0eafae7aebd9653b7359c43bacf19491b7c7c1c0ae7ea61a9234876187ff90431c917d504a14abe1
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUm:j+R56utgpPF8u/7m
TLSH
T100565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LBKsaWi.exe

Path C:\Windows\System\LBKsaWi.exe
Size 5.8MB
SHA256 29b45c75c424c8bf5aa059de08cfb1b2cf3b117a3d70ef2d16f50a7d547b3028
MD5 1bda318b1112401603fb9342b5dfafcb
SHA1 7d54c41a66ffb7e2acbc7b17b82317e8cb7afdac
SHA512 67be8a1f8b4b82d090030a23b3edc49ff0890ca07d38dc6aca1e590a9f2a23859badb531d2e7a11b9ceaa2be3a4049705539b33079eae0ab361aad60b11941d6
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUt:j+R56utgpPF8u/7t
TLSH
T1C3565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LCUXLSR.exe

Path C:\Windows\System\LCUXLSR.exe
Size 5.8MB
SHA256 b7a5e6f428cc6833a95127bd2b899f5de9a372b5bb82076c2ab0b6fe3ca9fe4b
MD5 8b575d1c043dd9b99a96a29a281522fc
SHA1 1e76905de29f8c973c9a17fb1f92aaccb58f2228
SHA512 f202f8d0da63d7d6366fa35d34c9110fb098919c244803e32d2ebb13f57adca359d6c02ace3733686b59fe6f3359164b08e98fd9e7bdf208a004663448c7f7f5
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUv:j+R56utgpPF8u/7v
TLSH
T121565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LrdBCmh.exe

Path C:\Windows\System\LrdBCmh.exe
Size 5.8MB
SHA256 14d9c729fa196ad915ece978c5cb0a8edfdfcd9335425d6c373cd0c59b13786b
MD5 fc8aa48e09a793603e0f6531a0286f30
SHA1 701e1d261da1af818b33d45c6c63d560787aee13
SHA512 924f6b2b08238b68f17502250413661c8f988c93f7e1f322a8c84877242f89394dad044254d5953dedf011a5c5fd54a56d9122a27085d25e549d3c9d045099f1
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUA:j+R56utgpPF8u/7A
TLSH
T1CB565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RRcpbfW.exe

Path C:\Windows\System\RRcpbfW.exe
Size 5.8MB
SHA256 d4160c82242a48975a9bead6f1c3e724df004569812c651066be2838a84fe8ce
MD5 0ef81572f1f47166adb13f2ffeb26f7a
SHA1 137dadf88491f57fafd1f152f982d6c7ba70e7c2
SHA512 a6a43cef1a117d0affeff5cfa6a1e762df296d4f02177d40562c7dff89cde2b2cd68678bd4e05733bb83d40a2c871ff191515e7994d2f1b0fb3d5372448e5f64
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU7:j+R56utgpPF8u/77
TLSH
T1CF565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyEcVju.exe

Path C:\Windows\System\SyEcVju.exe
Size 5.8MB
SHA256 9ea1171785752507977e59de3e44b4d8424a407c70ba28f59aac760ddcc519d6
MD5 ed6c0a2a0b4ca8b7ab36a894eadd4180
SHA1 6937376663ba0bea441c4d12d91d9e1bb9787150
SHA512 1f48ce5fe4991c725df5b7b00f84acb8bf65485f8a26c518b55a0d46d4a681be07c9f18335b26e921ac64bfeadb115d02958ca57d1131fc0c3ae8e14afe6621b
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUb:j+R56utgpPF8u/7b
TLSH
T126565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TReEePa.exe

Path C:\Windows\System\TReEePa.exe
Size 5.8MB
SHA256 edf306ec5195faa408ccf3b3b5037852050ae2cf7fa337ba4b6aeb6a34f6626a
MD5 4730c83720eb0ff20c3b1151fe1ac454
SHA1 73b5919e8c76209e7e92558d2b43d9c7e88ed56c
SHA512 37358812a2f7441e5bbc13dd965cd7fc8a9357c950e0c30b0a6230a068d0c1157c479a302861a592db81ba3b5beb7e0890c3c080407084c81539d505f59e1f89
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUp:j+R56utgpPF8u/7p
TLSH
T149565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UTlnJnb.exe

Path C:\Windows\System\UTlnJnb.exe
Size 5.8MB
SHA256 8c23ea713a43011d119f1091135b96d3186a1256ab3572a4f63759ee076544d8
MD5 5351d7abcc89067bd2c36b41a81e6d38
SHA1 955b871d0b68c79dd92c3c5b4da72b02d2814f73
SHA512 e6a4f02f239ecd807f557500b3b5aad7f409500b37c7b2bce74cad01c7c1c0b6352d268abc2342e27ccba2eea49f421b7ea28f9a2c86a5397932d40ea17c2442
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU9:j+R56utgpPF8u/79
TLSH
T1EE565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UvkHTIf.exe

Path C:\Windows\System\UvkHTIf.exe
Size 5.8MB
SHA256 abd143f37b3602156520797bb1b03807f144e7b4a7b34c593576c654350f5ed5
MD5 7c27b8a380fe342713fefb0ef5ade6ab
SHA1 17eb27f4b4523f6ae2fd62e8b82521d3628c0fa4
SHA512 4b709c71c4c4361ed3fecda0b73d1f0d2197874022fe5a45512b05ec9ca0bad024ba7d5704fbfd32ff54501eae8d8944f8c490f3a5496e973db67baf884313be
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUm:j+R56utgpPF8u/7m
TLSH
T1E7565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VTTnrOI.exe

Path C:\Windows\System\VTTnrOI.exe
Size 5.8MB
SHA256 c9e38fcfdc361a8e0567ac97979de405921dc2a82feaf92a54f15d0929f0a5e3
MD5 fb153be16ec4ebc06dc149124f90accb
SHA1 c7945a55e215916c47b0b87cf7d138981c1cfe24
SHA512 f393084b8981060df334178198ff3d526f9c5eac7dc2a00021c24782f94ee689376b834fa578e2cc16c5fb654488b0117f6ef52228cfa4830915d44dfb24ed46
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU3:j+R56utgpPF8u/73
TLSH
T130565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cVDGrBs.exe

Path C:\Windows\System\cVDGrBs.exe
Size 5.8MB
SHA256 97a2a8b54bf1d7ef2b6423163e26d41d98f8be06145a1bea3216c511ba4a6c6f
MD5 286b788cc7542cc0491d49d61f2d5bc2
SHA1 2a4ffc4f87968cc08dc294b4df3feba8cd355d24
SHA512 a5fa67fff16965a2619c8b64b936b2665b60303708279827cff894e6566ba80223888f69c09a880296e106b1cd67f851856922e748eccb4d33b94ddc35880b17
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUM:j+R56utgpPF8u/7M
TLSH
T1C1565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhbwNDG.exe

Path C:\Windows\System\dhbwNDG.exe
Size 5.8MB
SHA256 4c27b16ff7373d50fa47cd6fdec5da88129f9ecff48c130be3343373476e715d
MD5 4d07aad96ca9d49d9896b89c74f5c8f7
SHA1 7547980e771da64d67eafa9b2ff4d1fcee746056
SHA512 bd46e6349a679de860c147b3eeb97635304724d9ff61a24f7c3e29610e3fbd886f3a9badcc696ce95bcc1214c213094873e7f0c26103989df723174ec5df01d3
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUn:j+R56utgpPF8u/7n
TLSH
T1EE565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dqLRDnZ.exe

Path C:\Windows\System\dqLRDnZ.exe
Size 5.8MB
SHA256 1f986771a0f42fc6f0799d571d4818ee54c22e6d52a1409fe3611399fcaf0e2d
MD5 afe48a536d5fa2dffdac857e4f4c833e
SHA1 ad28eaefdd5bc20c15106c01661422e1b3e412bf
SHA512 fb0fd364c815af0b5f58255171e94061a85d240afba40ebcc6ff02d43cb6e2008fd4892c978b0686f805236c625b96c62782ec658f3847089353b48dda871bf5
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUE:j+R56utgpPF8u/7E
TLSH
T1FD565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imXzFnq.exe

Path C:\Windows\System\imXzFnq.exe
Size 5.8MB
SHA256 6e9a3996bce50f3aefb949a3c29bf249099c14a23f2666a8b758f10b3120487d
MD5 cef943334c733cac87bf366b55bf833a
SHA1 616b21726cb9f510c02566fda6a8fc468d6a9e16
SHA512 a60161ca99c328ff9eb8da90ec2e6e02b82f5e502368737350de4a60a102c5910a4d474e33666d8712362abd72bb0139b68de486cb899be0ef1a8f8e058e3177
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUL:j+R56utgpPF8u/7L
TLSH
T103565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inqRZZL.exe

Path C:\Windows\System\inqRZZL.exe
Size 5.8MB
SHA256 93d8f18fcf4c60d011aa93efae1072bdc8a58a6b704952e611378e660b57d7d5
MD5 c5d9b41a171daaf2b70cdc64eacdf525
SHA1 6069c3e45d150549cbcd0c01e83b57da3e1e1ec5
SHA512 f0760085983bdc7dffece4d51aaf72bb2e97341092d448542e9972478c6075586dd8134483cb74600e35d143acb84f587bd23821df307d7d6dd2a45fd0b13fc2
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU4:j+R56utgpPF8u/74
TLSH
T195565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kEKKdVY.exe

Path C:\Windows\System\kEKKdVY.exe
Size 5.8MB
SHA256 656f09aab56a9ee99e0f93851a0fec82ba2672977e44df1de09d4056525f6536
MD5 d68db465ee2a33ae967f1b5f9433856a
SHA1 d5a3c7ee1fddbaa8bec431dc5d465b0a886bb574
SHA512 2b006a103624f7b94f298bb75f40ca89a6c12ec10ae22f93f87e67fc9119fde6ee0b8ddde0fa9a1628ac46721b6d360014bf9158852c4d449f6ec3a201f500a2
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUL:j+R56utgpPF8u/7L
TLSH
T133565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lLErtyT.exe

Path C:\Windows\System\lLErtyT.exe
Size 5.8MB
SHA256 22db7be316aa2cec5003636a0f9657dbebbe33abf0d0bcb8020e0933ef3de3a7
MD5 cd18356e22bc806b644fde16ea93aab2
SHA1 eef07594bf905e4c567b747e7e884b18b4096c3f
SHA512 e44210200baad931e5e966bd788157a0a051bc093c71e5dab034552eb9c3e7b4b1ffb3a9ecbc48036a0e6d8aac9629c95e0f3c395c572e04b0bbf159cc093116
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU9:j+R56utgpPF8u/79
TLSH
T10F565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lrbKeWs.exe

Path C:\Windows\System\lrbKeWs.exe
Size 5.8MB
SHA256 4e567ccc0a2692be40fd48fb036e883b502b424d0db193d1385f8d8daa0908b8
MD5 3fdfeaf227a4e89ac753e722066b6c69
SHA1 d237340450690bc7a1cac82e06376ae29ac9f208
SHA512 27b19419a6cfadd59b60c356af7f2e41ad8149742c43d8b320024cc8cd8024a15d6c2a01a483d3afa6799c6bc59832878bad9c36dd342cf6b1eb052922cfe081
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU8:j+R56utgpPF8u/78
TLSH
T110565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mVopJMO.exe

Path C:\Windows\System\mVopJMO.exe
Size 5.8MB
SHA256 6d55dec2d296bef0ed6f4cc023b500d0b546433a5f95293d35e124d8c993b9fd
MD5 a1e0268e87821c51f6445347daaf9afa
SHA1 344e7c713c19fb0032233995bab04ce543f9f72d
SHA512 3ace86812836c8e032d81b97e2cd3619564f9b551f1bc7fb85d3133265b7ac752f499c21468dc84810cee8be3a32f5050088c0d68df3a8252109acf9b7abeb6e
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUW:j+R56utgpPF8u/7W
TLSH
T112565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nUwPoui.exe

Path C:\Windows\System\nUwPoui.exe
Size 5.8MB
SHA256 bbb3ff48647b70a073cf106eef847f74587a98441654ca17b4844b5be0ea4499
MD5 bda63cb09ddc77c095c2ea0b3af2e103
SHA1 184627a45f66523a019e578a2a265365e647575d
SHA512 b79e623b5689b614f0951b81fe8d100583263af7c8a15c62f17a814556080ccd7945cc669956cfc00b9e0ef2dd56a22ad359a60e63b1c7c179cc7983862f1bf9
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUb:j+R56utgpPF8u/7b
TLSH
T13F565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rTgVsGd.exe

Path C:\Windows\System\rTgVsGd.exe
Size 5.8MB
SHA256 ce9aa3596985f576fc660e156ea1cc787f21b869c713ad731647994ecacf2db5
MD5 0cd4a9c3e2171c8cdad6dcacdd658bb5
SHA1 60ce52fb48c8ea8dadf329d7da98a826afe00c83
SHA512 6232e15eeac680661d182e043d7174b2342ef81ece665cc4559f2fd532c83683657867c086b06a709046a77360690a843ccd29995d1de089d9579c164e260974
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUU:j+R56utgpPF8u/7U
TLSH
T183565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

siWexiP.exe

Path C:\Windows\System\siWexiP.exe
Size 5.8MB
SHA256 febc37ef884026c9b52d48fa979901b4937f79b25a3e0644590a5a1c6177b867
MD5 ecb2a9c212ce39fa7474f025ea2ed4e9
SHA1 7ee8f07d06a312e93539c53fecfac1483a5a2dcc
SHA512 2e79db1998c382618b47d56e895011a6d49469b67e5b875b48ad1d47ba0c91707021c4ebd04d2abf8c2319f98d7784c1a3fb0ca5feacae7b03a14c0f04476560
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUM:j+R56utgpPF8u/7M
TLSH
T17A565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tvTjzPc.exe

Path C:\Windows\System\tvTjzPc.exe
Size 5.8MB
SHA256 79dd85c22c273cc611ba26ff01ce75dc3b5ad3a3336a451e23fa2cf410d1a64d
MD5 0f07e7a91cc88742fb04144cc18821bf
SHA1 f207e3c309230d1ad4d1890e31e2837b6c540bc6
SHA512 8aaa641de1836cab024d15bf75c04c7795ef79fcf1ddefd1ab9bf27e0d60dc3f5bdb1ba698c6f1ec3917c2add135f1f9b2d6269f90cb35247432d8f64c62ded5
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUW:j+R56utgpPF8u/7W
TLSH
T1CE565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uNtGXHP.exe

Path C:\Windows\System\uNtGXHP.exe
Size 5.8MB
SHA256 a74a658e0259d4e5122c1d1a07f3d70b63c6512bd312ea5976578c8a250a4f22
MD5 6562f4c3164ec72e74313f545a45bf61
SHA1 5d2ee1756fbe197987f829324111a53853a3c079
SHA512 1ff048f11a534e089abf48dc9f5545506f7381c3e14cbbcf3f57f9c53ffdc264342e7d7d00781c5c1caad337ae8da7109c28792610ebd51ca309fc9563407abd
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUw:j+R56utgpPF8u/7w
TLSH
T1E9565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uOQFvsQ.exe

Path C:\Windows\System\uOQFvsQ.exe
Size 5.8MB
SHA256 cd2eb58ab63abfd09f97444c642fdfb1cec8d8e587386820f28961a446918485
MD5 4cd554dd5d88463e9b582f25eade07e4
SHA1 5644b6f7f78da82be3992df9437196d2b1bb0e69
SHA512 63c41723080125bf9f2ef65e31da34be1957b70ef6e85de1061f77c4c9580aa1e690837b951538c780a0b385c0b290259672b5239ff3f2316b79f8887983a74c
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU2:j+R56utgpPF8u/72
TLSH
T12C565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uvrNHRO.exe

Path C:\Windows\System\uvrNHRO.exe
Size 5.8MB
SHA256 08ed0dc2ddc760214217519eeaf207ef26e2674892b34de7c8febf8fedbb8af6
MD5 662a4063523747d983893f44d99c02b0
SHA1 d4ad6c4f9390db2699d0ecabb0b8b13ebd6be3dd
SHA512 70d134924bf16af7dc644b27b63fc84accbc1c010a05bad50272bc4bdfc92b858989fd0082a8feac68ad8f0b08b46a829b834770fb8055c7076dfec2f6454f98
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU4:j+R56utgpPF8u/74
TLSH
T112565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uvvfmsU.exe

Path C:\Windows\System\uvvfmsU.exe
Size 5.8MB
SHA256 ff6137101ee5f7452cdd5ffb800e76ad6e6b8add206b09ade793e6412d2542a7
MD5 74973afc6b8062ad0b5958fe2811220e
SHA1 f27efd4cca6e2d02456484e73d2f99369c9258b5
SHA512 fcd90529e146bda3cfe9285cae85b4bc8187258fac5c1cce2064e42a100507f7e085bf7c40f665e4d42ecf82a6fad39f5c45fd3b084d336e13314fde4c7284d8
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUS:j+R56utgpPF8u/7S
TLSH
T160565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vRYMtfv.exe

Path C:\Windows\System\vRYMtfv.exe
Size 5.8MB
SHA256 4432d79f10992c18600d56372354a40f9d05d7ce0137d32928f531904ce09310
MD5 b1d249ddb074cc2fe54a2146bfadddb1
SHA1 268288f032f3a80e635f3ee1561637d3fdb80c15
SHA512 dbcc2506f6f14ff2bfbb56b018a35754e7e1bcf65de40f69e09a340c08ee9ce170c6337b9d176cd52fd31cbe7497a8e873dac217fbafb77ca1596b034c5cf69b
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUs:j+R56utgpPF8u/7s
TLSH
T19C565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wTfhkEm.exe

Path C:\Windows\System\wTfhkEm.exe
Size 5.8MB
SHA256 4c54671f665f495a545a7de4704490fa23af59942cdbbc2676d5e78f6bfc3221
MD5 a6f91c267ef2dc9be6837c228a45f695
SHA1 5704986370a723cb8084c8dc218a0dfff2e69fab
SHA512 770e6f87ce6a323bd20dd1f4a6209cb1c765e9d18bade15b4433ba56270d6276bff4e872f65af870647434a199ff9c54d8a99b6428e73a788d2b44de6d52caea
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUJ:j+R56utgpPF8u/7J
TLSH
T1A6565D41EDAB01F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E56A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wafFGlZ.exe

Path C:\Windows\System\wafFGlZ.exe
Size 5.8MB
SHA256 5b38ff07e920cebbad4d6cfa53fbd6f0852da348264ba6d25580f709599d5bc2
MD5 2ae0472abff7426f9a6679b4e66f498b
SHA1 3861d3ad8e387a762aa39ec3e6d0a578fcec600a
SHA512 ca7c41c4b879a0f374ad908555f8e6217f340fae7863f7cad1fd1df1a0544748275c840eeb15f5067061e9300555ae3ad9ea9a167c0ffefd419d22bd890552cf
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUY:j+R56utgpPF8u/7Y
TLSH
T12F565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zcSoCCg.exe

Path C:\Windows\System\zcSoCCg.exe
Size 5.8MB
SHA256 6c542fcc294d21fc729015fbefb941c7c22472cd4f8d10bdbb1b265165f02557
MD5 9946c4f955d1c51a6b360b8506668f23
SHA1 ab8fb3660bae0fec6d2d40ce35201296fd5c42fc
SHA512 bf2d41f969f57dfba3c6006e0d7d5552213f32fe8a3869fb8e37b0432051542e76e5d56c48736e5182b53634286ac67fb436566c1ac0997f567de0c2403afd0d
SSDEEP 98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUt:j+R56utgpPF8u/7t
TLSH
T178565D41EDAB05F2EB8712308CB74E5F633372190335EAC3DA650A6FE9176E46A36741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-334-0x00007FF744E10000-0x00007FF74515D000-memory.dmp

Download

memory/376-58-0x00007FF7AECD0000-0x00007FF7AF01D000-memory.dmp

Download

memory/636-201-0x00007FF66A420000-0x00007FF66A76D000-memory.dmp

Download

memory/828-206-0x00007FF6DEAB0000-0x00007FF6DEDFD000-memory.dmp

Download

memory/1108-130-0x00007FF6C5790000-0x00007FF6C5ADD000-memory.dmp

Download

memory/1136-241-0x00007FF68AB50000-0x00007FF68AE9D000-memory.dmp

Download

memory/1240-231-0x00007FF6BDA00000-0x00007FF6BDD4D000-memory.dmp

Download

memory/1380-210-0x00007FF6FEA70000-0x00007FF6FEDBD000-memory.dmp

Download

memory/1448-261-0x00007FF70E020000-0x00007FF70E36D000-memory.dmp

Download

memory/1532-340-0x00007FF6BA370000-0x00007FF6BA6BD000-memory.dmp

Download

memory/1540-182-0x00007FF7ED4B0000-0x00007FF7ED7FD000-memory.dmp

Download

memory/1732-269-0x00007FF629860000-0x00007FF629BAD000-memory.dmp

Download

memory/1748-25-0x00007FF760370000-0x00007FF7606BD000-memory.dmp

Download

memory/1784-141-0x00007FF6D88B0000-0x00007FF6D8BFD000-memory.dmp

Download

memory/1932-247-0x00007FF70F500000-0x00007FF70F84D000-memory.dmp

Download

memory/1992-263-0x00007FF686CD0000-0x00007FF68701D000-memory.dmp

Download

memory/2020-226-0x00007FF6273E0000-0x00007FF62772D000-memory.dmp

Download

memory/2024-338-0x00007FF6979B0000-0x00007FF697CFD000-memory.dmp

Download

memory/2028-191-0x00007FF7E39F0000-0x00007FF7E3D3D000-memory.dmp

Download

memory/2040-64-0x00007FF652410000-0x00007FF65275D000-memory.dmp

Download

memory/2056-61-0x00007FF6DD9E0000-0x00007FF6DDD2D000-memory.dmp

Download

memory/2200-34-0x00007FF66BF10000-0x00007FF66C25D000-memory.dmp

Download

memory/2320-346-0x00007FF641580000-0x00007FF6418CD000-memory.dmp

Download

memory/2512-177-0x00007FF774780000-0x00007FF774ACD000-memory.dmp

Download

memory/2536-267-0x00007FF72E2D0000-0x00007FF72E61D000-memory.dmp

Download

memory/2656-93-0x00007FF655AC0000-0x00007FF655E0D000-memory.dmp

Download

memory/2800-281-0x00007FF77E630000-0x00007FF77E97D000-memory.dmp

Download

memory/2824-119-0x00007FF6ADEB0000-0x00007FF6AE1FD000-memory.dmp

Download

memory/2928-344-0x00007FF64D3A0000-0x00007FF64D6ED000-memory.dmp

Download

memory/2932-67-0x00007FF77BF40000-0x00007FF77C28D000-memory.dmp

Download

memory/2960-332-0x00007FF6B41B0000-0x00007FF6B44FD000-memory.dmp

Download

memory/3040-55-0x00007FF64B670000-0x00007FF64B9BD000-memory.dmp

Download

memory/3104-257-0x00007FF71C7B0000-0x00007FF71CAFD000-memory.dmp

Download

memory/3116-47-0x00007FF642A70000-0x00007FF642DBD000-memory.dmp

Download

memory/3140-342-0x00007FF6795F0000-0x00007FF67993D000-memory.dmp

Download

memory/3152-235-0x00007FF643B70000-0x00007FF643EBD000-memory.dmp

Download

memory/3196-223-0x00007FF6024A0000-0x00007FF6027ED000-memory.dmp

Download

memory/3232-171-0x00007FF6C26A0000-0x00007FF6C29ED000-memory.dmp

Download

memory/3384-154-0x00007FF712AE0000-0x00007FF712E2D000-memory.dmp

Download

memory/3444-18-0x00007FF6C87B0000-0x00007FF6C8AFD000-memory.dmp

Download

memory/3468-275-0x00007FF7F15E0000-0x00007FF7F192D000-memory.dmp

Download

memory/3552-279-0x00007FF7F3190000-0x00007FF7F34DD000-memory.dmp

Download

memory/3644-249-0x00007FF767310000-0x00007FF76765D000-memory.dmp

Download

memory/3760-229-0x00007FF6FCCB0000-0x00007FF6FCFFD000-memory.dmp

Download

memory/3764-277-0x00007FF651FE0000-0x00007FF65232D000-memory.dmp

Download

memory/3944-145-0x00007FF787ED0000-0x00007FF78821D000-memory.dmp

Download

memory/3964-15-0x00007FF7C3CC0000-0x00007FF7C400D000-memory.dmp

Download

memory/4044-273-0x00007FF737120000-0x00007FF73746D000-memory.dmp

Download

memory/4216-238-0x00007FF6888A0000-0x00007FF688BED000-memory.dmp

Download

memory/4276-336-0x00007FF655A50000-0x00007FF655D9D000-memory.dmp

Download

memory/4340-150-0x00007FF7F5A00000-0x00007FF7F5D4D000-memory.dmp

Download

memory/4480-265-0x00007FF7B9780000-0x00007FF7B9ACD000-memory.dmp

Download

memory/4596-271-0x00007FF696A50000-0x00007FF696D9D000-memory.dmp

Download

memory/4628-213-0x00007FF730790000-0x00007FF730ADD000-memory.dmp

Download

memory/4808-233-0x00007FF620BB0000-0x00007FF620EFD000-memory.dmp

Download

memory/4816-216-0x00007FF647AC0000-0x00007FF647E0D000-memory.dmp

Download

memory/4908-7-0x00007FF6E1FF0000-0x00007FF6E233D000-memory.dmp

Download

memory/4932-104-0x00007FF7A5B50000-0x00007FF7A5E9D000-memory.dmp

Download

memory/4952-138-0x00007FF7E9030000-0x00007FF7E937D000-memory.dmp

Download

memory/4960-259-0x00007FF7711B0000-0x00007FF7714FD000-memory.dmp

Download

memory/4964-253-0x00007FF601BA0000-0x00007FF601EED000-memory.dmp

Download

memory/4984-251-0x00007FF631DB0000-0x00007FF6320FD000-memory.dmp

Download

memory/5084-0-0x00007FF67A1D0000-0x00007FF67A51D000-memory.dmp

Download

memory/5084-1-0x0000020597A60000-0x0000020597A70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads