xmrig | af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 00:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
Size

1.6MB
MD5

0a528b538c9a232f0bf1f0dd0fe82481
SHA1

67e2b2ca958b62925450594fc9826fa509c6be92
SHA256

af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced
SHA512

5be7f5daef5573d4845113ca6af20099729f242854c6b34fb0af6f545d1af724eb854abf20c1aaccf79ce452bfb58f8019f79fe09a0940733dbd7d795c5b8ed8
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxR9EurG1:GemTLkNdfE0pZy7

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 15780 created 3192	15780	WerFaultSecure.exe	80

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c5f-4.dat	xmrig
behavioral2/files/0x0008000000023cc9-10.dat	xmrig
behavioral2/files/0x0007000000023cca-15.dat	xmrig
behavioral2/files/0x0007000000023ccb-19.dat	xmrig
behavioral2/files/0x0007000000023ccc-24.dat	xmrig
behavioral2/files/0x0007000000023ccd-29.dat	xmrig
behavioral2/files/0x0007000000023cce-36.dat	xmrig
behavioral2/files/0x0007000000023cd0-40.dat	xmrig
behavioral2/files/0x0007000000023cd2-64.dat	xmrig
behavioral2/files/0x0007000000023cd6-72.dat	xmrig
behavioral2/files/0x0007000000023cd5-92.dat	xmrig
behavioral2/files/0x0007000000023ce2-128.dat	xmrig
behavioral2/files/0x0007000000023ce6-160.dat	xmrig
behavioral2/files/0x0007000000023ce5-158.dat	xmrig
behavioral2/files/0x0008000000023cc7-156.dat	xmrig
behavioral2/files/0x0007000000023cdf-154.dat	xmrig
behavioral2/files/0x0007000000023ce4-152.dat	xmrig
behavioral2/files/0x0007000000023ce3-150.dat	xmrig
behavioral2/files/0x0007000000023ce1-146.dat	xmrig
behavioral2/files/0x0007000000023ce0-144.dat	xmrig
behavioral2/files/0x0007000000023cdb-142.dat	xmrig
behavioral2/files/0x0007000000023cde-140.dat	xmrig
behavioral2/files/0x0007000000023cdd-138.dat	xmrig
behavioral2/files/0x0007000000023cdc-134.dat	xmrig
behavioral2/files/0x0007000000023cd9-126.dat	xmrig
behavioral2/files/0x0007000000023cd8-116.dat	xmrig
behavioral2/files/0x0007000000023cda-113.dat	xmrig
behavioral2/files/0x0007000000023cd7-112.dat	xmrig
behavioral2/files/0x0007000000023cd4-80.dat	xmrig
behavioral2/files/0x0007000000023cd3-66.dat	xmrig
behavioral2/files/0x0007000000023cd1-60.dat	xmrig
behavioral2/files/0x0007000000023ccf-43.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2984	qtLCLFf.exe
4752	XOncDNE.exe
388	HxkRHiN.exe
1688	UBrIqrv.exe
616	fFabQlj.exe
620	hEeWRoL.exe
2232	XzkWZBP.exe
692	fbzTIcE.exe
4424	iyGYExX.exe
1448	evdCaEN.exe
2796	QEuRalc.exe
3100	LcpcUAN.exe
2252	VCJmRAZ.exe
4916	kisrtNZ.exe
5036	OPGCMrK.exe
856	lYknNEX.exe
5056	UWXFyUi.exe
4716	azFyETj.exe
4664	LNgMkjW.exe
3032	xSHNJfk.exe
3592	CTAdwHE.exe
3272	zxKGJFK.exe
4640	SWxPzVx.exe
1904	rXwHSJt.exe
2564	CGmOUKx.exe
4448	lPwofiX.exe
1512	tUavydi.exe
1536	STUoarv.exe
3332	GxTDZFR.exe
3468	kjegIJQ.exe
3956	DyriRYk.exe
2756	xGfLAKP.exe
1368	NktzbiU.exe
2580	zrNIPnT.exe
1844	gfphOCe.exe
1636	mzIkgtx.exe
2460	RFvkQPl.exe
3360	RVYLonT.exe
4076	rkCVDae.exe
1596	GcScQDr.exe
4856	RkdAheH.exe
1236	VILnGJX.exe
3440	XBCXzKg.exe
648	IZPgMwW.exe
1528	GwivLnb.exe
2856	xmADGgK.exe
2688	chUtJDX.exe
4312	QhnrxmP.exe
376	PmABgYo.exe
4384	ljXJPMy.exe
2848	fSSHUDE.exe
968	qmHXDSE.exe
4308	WwOJjoE.exe
4464	RxeORoc.exe
4840	hiToXxs.exe
4484	XBXjmoN.exe
1936	aMLdOQX.exe
4480	eQxwcRt.exe
4272	TpZWRZx.exe
1608	ZQdhoyU.exe
3800	WfBxBBJ.exe
4460	fFysuus.exe
3016	ZJpZIqC.exe
3460	LdRZNXp.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FGqjvGQ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\aATAvqk.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\ZySTVYG.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\RDMdlNV.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\vZKiqiG.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\UJkdMEl.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\GLzvMpU.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\yuJKZMe.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\iyGYExX.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\VQvGlku.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\XZnUyzz.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\pHBxgqT.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\MgXqlAe.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\WvuvFDy.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\eQxwcRt.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\DWKPCrp.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\nBgNRJA.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\WDhBkDo.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\TXOfoaM.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\FcGTFlm.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\ZeSxsBH.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\ToXvSLx.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\GNyqLBR.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\gLplmmc.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\IBNNNuA.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\mDEkjJi.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\cDZTwOC.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\oZUOact.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\WWjTyHJ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\SmAlDgO.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\iEhSsVm.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\TrhBcHM.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\OPILjot.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\daxmDry.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\nJXoLzr.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\wctHoOB.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\cBMMMmc.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\oWrvTto.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\tEegMCU.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\efJhWIY.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\yyBQEPv.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\XOncDNE.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\pEESsTZ.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\zqZZXNk.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\RvFDYhx.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\tJvRgGB.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\STRsuVz.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\Dtulakv.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\hybcJgx.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\UdOfeuA.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\PzfTDZw.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\CmTQXrc.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\jvrKgEG.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\LNgMkjW.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\iRncwCU.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\jErEWPA.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\YCyfzMW.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\hEkiZpF.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\aGpYVgx.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\GcRuxni.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\CCrVFZf.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\eKwubpw.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\NktzbiU.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
File created	C:\Windows\System\fHDulfI.exe	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
15956	WerFaultSecure.exe
15956	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2984	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	84
PID 3264 wrote to memory of 2984	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	84
PID 3264 wrote to memory of 4752	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	85
PID 3264 wrote to memory of 4752	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	85
PID 3264 wrote to memory of 388	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	86
PID 3264 wrote to memory of 388	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	86
PID 3264 wrote to memory of 1688	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	87
PID 3264 wrote to memory of 1688	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	87
PID 3264 wrote to memory of 616	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	88
PID 3264 wrote to memory of 616	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	88
PID 3264 wrote to memory of 620	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	89
PID 3264 wrote to memory of 620	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	89
PID 3264 wrote to memory of 2232	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	90
PID 3264 wrote to memory of 2232	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	90
PID 3264 wrote to memory of 692	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	91
PID 3264 wrote to memory of 692	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	91
PID 3264 wrote to memory of 4424	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	92
PID 3264 wrote to memory of 4424	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	92
PID 3264 wrote to memory of 1448	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	93
PID 3264 wrote to memory of 1448	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	93
PID 3264 wrote to memory of 2796	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	94
PID 3264 wrote to memory of 2796	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	94
PID 3264 wrote to memory of 3100	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	95
PID 3264 wrote to memory of 3100	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	95
PID 3264 wrote to memory of 2252	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	96
PID 3264 wrote to memory of 2252	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	96
PID 3264 wrote to memory of 4916	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	97
PID 3264 wrote to memory of 4916	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	97
PID 3264 wrote to memory of 5036	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	98
PID 3264 wrote to memory of 5036	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	98
PID 3264 wrote to memory of 856	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	99
PID 3264 wrote to memory of 856	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	99
PID 3264 wrote to memory of 5056	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	100
PID 3264 wrote to memory of 5056	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	100
PID 3264 wrote to memory of 4716	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	101
PID 3264 wrote to memory of 4716	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	101
PID 3264 wrote to memory of 4664	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	102
PID 3264 wrote to memory of 4664	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	102
PID 3264 wrote to memory of 4640	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	103
PID 3264 wrote to memory of 4640	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	103
PID 3264 wrote to memory of 3032	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	104
PID 3264 wrote to memory of 3032	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	104
PID 3264 wrote to memory of 3592	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	105
PID 3264 wrote to memory of 3592	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	105
PID 3264 wrote to memory of 3272	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	106
PID 3264 wrote to memory of 3272	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	106
PID 3264 wrote to memory of 3332	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	107
PID 3264 wrote to memory of 3332	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	107
PID 3264 wrote to memory of 1904	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	108
PID 3264 wrote to memory of 1904	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	108
PID 3264 wrote to memory of 2564	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	109
PID 3264 wrote to memory of 2564	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	109
PID 3264 wrote to memory of 4448	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	110
PID 3264 wrote to memory of 4448	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	110
PID 3264 wrote to memory of 1512	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	111
PID 3264 wrote to memory of 1512	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	111
PID 3264 wrote to memory of 1536	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	112
PID 3264 wrote to memory of 1536	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	112
PID 3264 wrote to memory of 3468	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	113
PID 3264 wrote to memory of 3468	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	113
PID 3264 wrote to memory of 3956	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	114
PID 3264 wrote to memory of 3956	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	114
PID 3264 wrote to memory of 2756	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	115
PID 3264 wrote to memory of 2756	3264	af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe	115

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:3192
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 3192 -s 2128
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:15956

C:\Users\Admin\AppData\Local\Temp\af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe
"C:\Users\Admin\AppData\Local\Temp\af7ce970197323e1aecb37271ada8d8cce7ab3f2231f8771ac682041414d8ced.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\System\qtLCLFf.exe
  C:\Windows\System\qtLCLFf.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\XOncDNE.exe
  C:\Windows\System\XOncDNE.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\HxkRHiN.exe
  C:\Windows\System\HxkRHiN.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\UBrIqrv.exe
  C:\Windows\System\UBrIqrv.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\fFabQlj.exe
  C:\Windows\System\fFabQlj.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\hEeWRoL.exe
  C:\Windows\System\hEeWRoL.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\XzkWZBP.exe
  C:\Windows\System\XzkWZBP.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\fbzTIcE.exe
  C:\Windows\System\fbzTIcE.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\iyGYExX.exe
  C:\Windows\System\iyGYExX.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\evdCaEN.exe
  C:\Windows\System\evdCaEN.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\QEuRalc.exe
  C:\Windows\System\QEuRalc.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\LcpcUAN.exe
  C:\Windows\System\LcpcUAN.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\VCJmRAZ.exe
  C:\Windows\System\VCJmRAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\kisrtNZ.exe
  C:\Windows\System\kisrtNZ.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\OPGCMrK.exe
  C:\Windows\System\OPGCMrK.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\lYknNEX.exe
  C:\Windows\System\lYknNEX.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\UWXFyUi.exe
  C:\Windows\System\UWXFyUi.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\azFyETj.exe
  C:\Windows\System\azFyETj.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\LNgMkjW.exe
  C:\Windows\System\LNgMkjW.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\SWxPzVx.exe
  C:\Windows\System\SWxPzVx.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\xSHNJfk.exe
  C:\Windows\System\xSHNJfk.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\CTAdwHE.exe
  C:\Windows\System\CTAdwHE.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\zxKGJFK.exe
  C:\Windows\System\zxKGJFK.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\GxTDZFR.exe
  C:\Windows\System\GxTDZFR.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\rXwHSJt.exe
  C:\Windows\System\rXwHSJt.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\CGmOUKx.exe
  C:\Windows\System\CGmOUKx.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\lPwofiX.exe
  C:\Windows\System\lPwofiX.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\tUavydi.exe
  C:\Windows\System\tUavydi.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\STUoarv.exe
  C:\Windows\System\STUoarv.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\kjegIJQ.exe
  C:\Windows\System\kjegIJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\DyriRYk.exe
  C:\Windows\System\DyriRYk.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\xGfLAKP.exe
  C:\Windows\System\xGfLAKP.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\NktzbiU.exe
  C:\Windows\System\NktzbiU.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\zrNIPnT.exe
  C:\Windows\System\zrNIPnT.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\gfphOCe.exe
  C:\Windows\System\gfphOCe.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\mzIkgtx.exe
  C:\Windows\System\mzIkgtx.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\RFvkQPl.exe
  C:\Windows\System\RFvkQPl.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RVYLonT.exe
  C:\Windows\System\RVYLonT.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\rkCVDae.exe
  C:\Windows\System\rkCVDae.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\GcScQDr.exe
  C:\Windows\System\GcScQDr.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RkdAheH.exe
  C:\Windows\System\RkdAheH.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\VILnGJX.exe
  C:\Windows\System\VILnGJX.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\XBCXzKg.exe
  C:\Windows\System\XBCXzKg.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\IZPgMwW.exe
  C:\Windows\System\IZPgMwW.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\GwivLnb.exe
  C:\Windows\System\GwivLnb.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\xmADGgK.exe
  C:\Windows\System\xmADGgK.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\chUtJDX.exe
  C:\Windows\System\chUtJDX.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\QhnrxmP.exe
  C:\Windows\System\QhnrxmP.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\PmABgYo.exe
  C:\Windows\System\PmABgYo.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\ljXJPMy.exe
  C:\Windows\System\ljXJPMy.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\fSSHUDE.exe
  C:\Windows\System\fSSHUDE.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\qmHXDSE.exe
  C:\Windows\System\qmHXDSE.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\WwOJjoE.exe
  C:\Windows\System\WwOJjoE.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\RxeORoc.exe
  C:\Windows\System\RxeORoc.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\hiToXxs.exe
  C:\Windows\System\hiToXxs.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\XBXjmoN.exe
  C:\Windows\System\XBXjmoN.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\aMLdOQX.exe
  C:\Windows\System\aMLdOQX.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\eQxwcRt.exe
  C:\Windows\System\eQxwcRt.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\TpZWRZx.exe
  C:\Windows\System\TpZWRZx.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\ZQdhoyU.exe
  C:\Windows\System\ZQdhoyU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\WfBxBBJ.exe
  C:\Windows\System\WfBxBBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\fFysuus.exe
  C:\Windows\System\fFysuus.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\ZJpZIqC.exe
  C:\Windows\System\ZJpZIqC.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\LdRZNXp.exe
  C:\Windows\System\LdRZNXp.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\MifAAKT.exe
  C:\Windows\System\MifAAKT.exe
  2⤵
  PID:1076
- C:\Windows\System\lyBCfSA.exe
  C:\Windows\System\lyBCfSA.exe
  2⤵
  PID:1916
- C:\Windows\System\NjoyqCp.exe
  C:\Windows\System\NjoyqCp.exe
  2⤵
  PID:860
- C:\Windows\System\NUrbqlA.exe
  C:\Windows\System\NUrbqlA.exe
  2⤵
  PID:3680
- C:\Windows\System\zuBOsBw.exe
  C:\Windows\System\zuBOsBw.exe
  2⤵
  PID:1828
- C:\Windows\System\QiXwPUR.exe
  C:\Windows\System\QiXwPUR.exe
  2⤵
  PID:1044
- C:\Windows\System\yuJKZMe.exe
  C:\Windows\System\yuJKZMe.exe
  2⤵
  PID:400
- C:\Windows\System\zFyOsCn.exe
  C:\Windows\System\zFyOsCn.exe
  2⤵
  PID:3036
- C:\Windows\System\lHtKcbz.exe
  C:\Windows\System\lHtKcbz.exe
  2⤵
  PID:2264
- C:\Windows\System\ZQngsLh.exe
  C:\Windows\System\ZQngsLh.exe
  2⤵
  PID:2512
- C:\Windows\System\XXPtYCS.exe
  C:\Windows\System\XXPtYCS.exe
  2⤵
  PID:2560
- C:\Windows\System\TXOfoaM.exe
  C:\Windows\System\TXOfoaM.exe
  2⤵
  PID:2804
- C:\Windows\System\dTxrPSv.exe
  C:\Windows\System\dTxrPSv.exe
  2⤵
  PID:2604
- C:\Windows\System\XCvseue.exe
  C:\Windows\System\XCvseue.exe
  2⤵
  PID:3444
- C:\Windows\System\kcmvWeQ.exe
  C:\Windows\System\kcmvWeQ.exe
  2⤵
  PID:1060
- C:\Windows\System\kdiPHKO.exe
  C:\Windows\System\kdiPHKO.exe
  2⤵
  PID:432
- C:\Windows\System\LUVopUG.exe
  C:\Windows\System\LUVopUG.exe
  2⤵
  PID:316
- C:\Windows\System\iOujZtS.exe
  C:\Windows\System\iOujZtS.exe
  2⤵
  PID:2748
- C:\Windows\System\FoAWTaj.exe
  C:\Windows\System\FoAWTaj.exe
  2⤵
  PID:4724
- C:\Windows\System\vIJBasj.exe
  C:\Windows\System\vIJBasj.exe
  2⤵
  PID:2336
- C:\Windows\System\xCEDaoD.exe
  C:\Windows\System\xCEDaoD.exe
  2⤵
  PID:4736
- C:\Windows\System\iRncwCU.exe
  C:\Windows\System\iRncwCU.exe
  2⤵
  PID:3576
- C:\Windows\System\wBLvEpF.exe
  C:\Windows\System\wBLvEpF.exe
  2⤵
  PID:456
- C:\Windows\System\gTRtspo.exe
  C:\Windows\System\gTRtspo.exe
  2⤵
  PID:2780
- C:\Windows\System\MBzmSvG.exe
  C:\Windows\System\MBzmSvG.exe
  2⤵
  PID:3412
- C:\Windows\System\qjYPMYJ.exe
  C:\Windows\System\qjYPMYJ.exe
  2⤵
  PID:1224
- C:\Windows\System\zCiEtSa.exe
  C:\Windows\System\zCiEtSa.exe
  2⤵
  PID:4576
- C:\Windows\System\LFTwlzA.exe
  C:\Windows\System\LFTwlzA.exe
  2⤵
  PID:3908
- C:\Windows\System\QTOFTmg.exe
  C:\Windows\System\QTOFTmg.exe
  2⤵
  PID:4068
- C:\Windows\System\ONBXjRQ.exe
  C:\Windows\System\ONBXjRQ.exe
  2⤵
  PID:2308
- C:\Windows\System\TcdIsWl.exe
  C:\Windows\System\TcdIsWl.exe
  2⤵
  PID:4892
- C:\Windows\System\ltXNvII.exe
  C:\Windows\System\ltXNvII.exe
  2⤵
  PID:4072
- C:\Windows\System\CQHBafx.exe
  C:\Windows\System\CQHBafx.exe
  2⤵
  PID:1052
- C:\Windows\System\DTHKFVz.exe
  C:\Windows\System\DTHKFVz.exe
  2⤵
  PID:2032
- C:\Windows\System\TBpWLKj.exe
  C:\Windows\System\TBpWLKj.exe
  2⤵
  PID:1080
- C:\Windows\System\oNbXkLu.exe
  C:\Windows\System\oNbXkLu.exe
  2⤵
  PID:4516
- C:\Windows\System\pEESsTZ.exe
  C:\Windows\System\pEESsTZ.exe
  2⤵
  PID:3488
- C:\Windows\System\MuvJLzo.exe
  C:\Windows\System\MuvJLzo.exe
  2⤵
  PID:4012
- C:\Windows\System\sYFWDUr.exe
  C:\Windows\System\sYFWDUr.exe
  2⤵
  PID:4556
- C:\Windows\System\EqZcTLb.exe
  C:\Windows\System\EqZcTLb.exe
  2⤵
  PID:216
- C:\Windows\System\qClkpOW.exe
  C:\Windows\System\qClkpOW.exe
  2⤵
  PID:540
- C:\Windows\System\WcfHknW.exe
  C:\Windows\System\WcfHknW.exe
  2⤵
  PID:3108
- C:\Windows\System\KOFNNqh.exe
  C:\Windows\System\KOFNNqh.exe
  2⤵
  PID:872
- C:\Windows\System\uwJBoNj.exe
  C:\Windows\System\uwJBoNj.exe
  2⤵
  PID:4540
- C:\Windows\System\MBiVUtF.exe
  C:\Windows\System\MBiVUtF.exe
  2⤵
  PID:2316
- C:\Windows\System\nfUWTSs.exe
  C:\Windows\System\nfUWTSs.exe
  2⤵
  PID:5000
- C:\Windows\System\fdrPgCA.exe
  C:\Windows\System\fdrPgCA.exe
  2⤵
  PID:1264
- C:\Windows\System\GoEGjro.exe
  C:\Windows\System\GoEGjro.exe
  2⤵
  PID:2728
- C:\Windows\System\RPZfRon.exe
  C:\Windows\System\RPZfRon.exe
  2⤵
  PID:5132
- C:\Windows\System\SWoCLgK.exe
  C:\Windows\System\SWoCLgK.exe
  2⤵
  PID:5164
- C:\Windows\System\uOTehbS.exe
  C:\Windows\System\uOTehbS.exe
  2⤵
  PID:5180
- C:\Windows\System\KvysrFO.exe
  C:\Windows\System\KvysrFO.exe
  2⤵
  PID:5204
- C:\Windows\System\qCRVMoW.exe
  C:\Windows\System\qCRVMoW.exe
  2⤵
  PID:5240
- C:\Windows\System\qeHYuoo.exe
  C:\Windows\System\qeHYuoo.exe
  2⤵
  PID:5276
- C:\Windows\System\RslvebZ.exe
  C:\Windows\System\RslvebZ.exe
  2⤵
  PID:5296
- C:\Windows\System\OSBejNl.exe
  C:\Windows\System\OSBejNl.exe
  2⤵
  PID:5328
- C:\Windows\System\VQvGlku.exe
  C:\Windows\System\VQvGlku.exe
  2⤵
  PID:5352
- C:\Windows\System\GzREZWA.exe
  C:\Windows\System\GzREZWA.exe
  2⤵
  PID:5384
- C:\Windows\System\waNlfsm.exe
  C:\Windows\System\waNlfsm.exe
  2⤵
  PID:5412
- C:\Windows\System\CmTQXrc.exe
  C:\Windows\System\CmTQXrc.exe
  2⤵
  PID:5440
- C:\Windows\System\FTAuvJv.exe
  C:\Windows\System\FTAuvJv.exe
  2⤵
  PID:5476
- C:\Windows\System\PUFZlFS.exe
  C:\Windows\System\PUFZlFS.exe
  2⤵
  PID:5496
- C:\Windows\System\ZqqLlMN.exe
  C:\Windows\System\ZqqLlMN.exe
  2⤵
  PID:5520
- C:\Windows\System\TGzOZdR.exe
  C:\Windows\System\TGzOZdR.exe
  2⤵
  PID:5552
- C:\Windows\System\phQJQOc.exe
  C:\Windows\System\phQJQOc.exe
  2⤵
  PID:5584
- C:\Windows\System\OyLxvdt.exe
  C:\Windows\System\OyLxvdt.exe
  2⤵
  PID:5616
- C:\Windows\System\eprFSsz.exe
  C:\Windows\System\eprFSsz.exe
  2⤵
  PID:5640
- C:\Windows\System\nWFuXKd.exe
  C:\Windows\System\nWFuXKd.exe
  2⤵
  PID:5668
- C:\Windows\System\ukLrwUH.exe
  C:\Windows\System\ukLrwUH.exe
  2⤵
  PID:5688
- C:\Windows\System\kuhVQpu.exe
  C:\Windows\System\kuhVQpu.exe
  2⤵
  PID:5716
- C:\Windows\System\yHNMUgN.exe
  C:\Windows\System\yHNMUgN.exe
  2⤵
  PID:5752
- C:\Windows\System\qYcmleg.exe
  C:\Windows\System\qYcmleg.exe
  2⤵
  PID:5776
- C:\Windows\System\IOznIxc.exe
  C:\Windows\System\IOznIxc.exe
  2⤵
  PID:5808
- C:\Windows\System\BCVSiQu.exe
  C:\Windows\System\BCVSiQu.exe
  2⤵
  PID:5832
- C:\Windows\System\EioLLGm.exe
  C:\Windows\System\EioLLGm.exe
  2⤵
  PID:5864
- C:\Windows\System\oshRDMa.exe
  C:\Windows\System\oshRDMa.exe
  2⤵
  PID:5896
- C:\Windows\System\bYIWyFm.exe
  C:\Windows\System\bYIWyFm.exe
  2⤵
  PID:5916
- C:\Windows\System\cNghpCW.exe
  C:\Windows\System\cNghpCW.exe
  2⤵
  PID:5956
- C:\Windows\System\oHfoiWk.exe
  C:\Windows\System\oHfoiWk.exe
  2⤵
  PID:5980
- C:\Windows\System\CWgsmKy.exe
  C:\Windows\System\CWgsmKy.exe
  2⤵
  PID:6008
- C:\Windows\System\aHEBXgF.exe
  C:\Windows\System\aHEBXgF.exe
  2⤵
  PID:6036
- C:\Windows\System\xdKiAdX.exe
  C:\Windows\System\xdKiAdX.exe
  2⤵
  PID:6076
- C:\Windows\System\tXFiDLi.exe
  C:\Windows\System\tXFiDLi.exe
  2⤵
  PID:6104
- C:\Windows\System\cgfevuJ.exe
  C:\Windows\System\cgfevuJ.exe
  2⤵
  PID:6132
- C:\Windows\System\EZECgHg.exe
  C:\Windows\System\EZECgHg.exe
  2⤵
  PID:5148
- C:\Windows\System\TRviHFE.exe
  C:\Windows\System\TRviHFE.exe
  2⤵
  PID:5172
- C:\Windows\System\isefRxT.exe
  C:\Windows\System\isefRxT.exe
  2⤵
  PID:5292
- C:\Windows\System\JYvJraI.exe
  C:\Windows\System\JYvJraI.exe
  2⤵
  PID:5348
- C:\Windows\System\ByrJkZK.exe
  C:\Windows\System\ByrJkZK.exe
  2⤵
  PID:5376
- C:\Windows\System\yAGaWfY.exe
  C:\Windows\System\yAGaWfY.exe
  2⤵
  PID:5424
- C:\Windows\System\PaXpzwW.exe
  C:\Windows\System\PaXpzwW.exe
  2⤵
  PID:5512
- C:\Windows\System\STRsuVz.exe
  C:\Windows\System\STRsuVz.exe
  2⤵
  PID:5580
- C:\Windows\System\UrhzYTv.exe
  C:\Windows\System\UrhzYTv.exe
  2⤵
  PID:5652
- C:\Windows\System\ghdteRA.exe
  C:\Windows\System\ghdteRA.exe
  2⤵
  PID:5680
- C:\Windows\System\PfRKqww.exe
  C:\Windows\System\PfRKqww.exe
  2⤵
  PID:5820
- C:\Windows\System\McHMihr.exe
  C:\Windows\System\McHMihr.exe
  2⤵
  PID:5872
- C:\Windows\System\ROjlzwx.exe
  C:\Windows\System\ROjlzwx.exe
  2⤵
  PID:5972
- C:\Windows\System\uncuzZR.exe
  C:\Windows\System\uncuzZR.exe
  2⤵
  PID:6032
- C:\Windows\System\RDMdlNV.exe
  C:\Windows\System\RDMdlNV.exe
  2⤵
  PID:6084
- C:\Windows\System\rlYBbsO.exe
  C:\Windows\System\rlYBbsO.exe
  2⤵
  PID:6088
- C:\Windows\System\CYIZxsa.exe
  C:\Windows\System\CYIZxsa.exe
  2⤵
  PID:2752
- C:\Windows\System\oZUOact.exe
  C:\Windows\System\oZUOact.exe
  2⤵
  PID:904
- C:\Windows\System\imxGRuA.exe
  C:\Windows\System\imxGRuA.exe
  2⤵
  PID:5256
- C:\Windows\System\AhHkPkd.exe
  C:\Windows\System\AhHkPkd.exe
  2⤵
  PID:5460
- C:\Windows\System\XfzykyI.exe
  C:\Windows\System\XfzykyI.exe
  2⤵
  PID:5736
- C:\Windows\System\WjyECri.exe
  C:\Windows\System\WjyECri.exe
  2⤵
  PID:5904
- C:\Windows\System\TcoNVJA.exe
  C:\Windows\System\TcoNVJA.exe
  2⤵
  PID:5176
- C:\Windows\System\puBUCZb.exe
  C:\Windows\System\puBUCZb.exe
  2⤵
  PID:5408
- C:\Windows\System\vqdwxqW.exe
  C:\Windows\System\vqdwxqW.exe
  2⤵
  PID:5732
- C:\Windows\System\xzGEONy.exe
  C:\Windows\System\xzGEONy.exe
  2⤵
  PID:5708
- C:\Windows\System\yTHXmFV.exe
  C:\Windows\System\yTHXmFV.exe
  2⤵
  PID:6172
- C:\Windows\System\gAQlerE.exe
  C:\Windows\System\gAQlerE.exe
  2⤵
  PID:6192
- C:\Windows\System\MxXBonO.exe
  C:\Windows\System\MxXBonO.exe
  2⤵
  PID:6220
- C:\Windows\System\HFoNkdg.exe
  C:\Windows\System\HFoNkdg.exe
  2⤵
  PID:6244
- C:\Windows\System\LBTKTti.exe
  C:\Windows\System\LBTKTti.exe
  2⤵
  PID:6264
- C:\Windows\System\cmbdKQs.exe
  C:\Windows\System\cmbdKQs.exe
  2⤵
  PID:6292
- C:\Windows\System\IfHqSnO.exe
  C:\Windows\System\IfHqSnO.exe
  2⤵
  PID:6316
- C:\Windows\System\nuLqSHw.exe
  C:\Windows\System\nuLqSHw.exe
  2⤵
  PID:6332
- C:\Windows\System\JQJFOFh.exe
  C:\Windows\System\JQJFOFh.exe
  2⤵
  PID:6368
- C:\Windows\System\YceKEwG.exe
  C:\Windows\System\YceKEwG.exe
  2⤵
  PID:6400
- C:\Windows\System\MKkzDYA.exe
  C:\Windows\System\MKkzDYA.exe
  2⤵
  PID:6420
- C:\Windows\System\Bistqtl.exe
  C:\Windows\System\Bistqtl.exe
  2⤵
  PID:6444
- C:\Windows\System\AIXJFtJ.exe
  C:\Windows\System\AIXJFtJ.exe
  2⤵
  PID:6472
- C:\Windows\System\bRWtAns.exe
  C:\Windows\System\bRWtAns.exe
  2⤵
  PID:6508
- C:\Windows\System\unKIjgj.exe
  C:\Windows\System\unKIjgj.exe
  2⤵
  PID:6544
- C:\Windows\System\otCBWjk.exe
  C:\Windows\System\otCBWjk.exe
  2⤵
  PID:6572
- C:\Windows\System\tYJEdKF.exe
  C:\Windows\System\tYJEdKF.exe
  2⤵
  PID:6604
- C:\Windows\System\pLtgoNv.exe
  C:\Windows\System\pLtgoNv.exe
  2⤵
  PID:6628
- C:\Windows\System\IirBrjD.exe
  C:\Windows\System\IirBrjD.exe
  2⤵
  PID:6656
- C:\Windows\System\WmwlcWA.exe
  C:\Windows\System\WmwlcWA.exe
  2⤵
  PID:6684
- C:\Windows\System\RoukCnG.exe
  C:\Windows\System\RoukCnG.exe
  2⤵
  PID:6712
- C:\Windows\System\alQfQge.exe
  C:\Windows\System\alQfQge.exe
  2⤵
  PID:6732
- C:\Windows\System\Dtulakv.exe
  C:\Windows\System\Dtulakv.exe
  2⤵
  PID:6760
- C:\Windows\System\RPEWkty.exe
  C:\Windows\System\RPEWkty.exe
  2⤵
  PID:6792
- C:\Windows\System\WTeOdEr.exe
  C:\Windows\System\WTeOdEr.exe
  2⤵
  PID:6828
- C:\Windows\System\YCyfzMW.exe
  C:\Windows\System\YCyfzMW.exe
  2⤵
  PID:6860
- C:\Windows\System\wMVXiPA.exe
  C:\Windows\System\wMVXiPA.exe
  2⤵
  PID:6892
- C:\Windows\System\tHeWNgC.exe
  C:\Windows\System\tHeWNgC.exe
  2⤵
  PID:6912
- C:\Windows\System\BOhFTkL.exe
  C:\Windows\System\BOhFTkL.exe
  2⤵
  PID:6944
- C:\Windows\System\uvySFHY.exe
  C:\Windows\System\uvySFHY.exe
  2⤵
  PID:6976
- C:\Windows\System\wCnVpvQ.exe
  C:\Windows\System\wCnVpvQ.exe
  2⤵
  PID:7012
- C:\Windows\System\MujNcXG.exe
  C:\Windows\System\MujNcXG.exe
  2⤵
  PID:7048
- C:\Windows\System\ntWwBNR.exe
  C:\Windows\System\ntWwBNR.exe
  2⤵
  PID:7072
- C:\Windows\System\HgyWFBZ.exe
  C:\Windows\System\HgyWFBZ.exe
  2⤵
  PID:7092
- C:\Windows\System\dxVyLrH.exe
  C:\Windows\System\dxVyLrH.exe
  2⤵
  PID:7132
- C:\Windows\System\zQSFTTZ.exe
  C:\Windows\System\zQSFTTZ.exe
  2⤵
  PID:7164
- C:\Windows\System\AHZfTGz.exe
  C:\Windows\System\AHZfTGz.exe
  2⤵
  PID:5800
- C:\Windows\System\SuPCLtK.exe
  C:\Windows\System\SuPCLtK.exe
  2⤵
  PID:6180
- C:\Windows\System\ywweDIL.exe
  C:\Windows\System\ywweDIL.exe
  2⤵
  PID:6272
- C:\Windows\System\lQFMUJE.exe
  C:\Windows\System\lQFMUJE.exe
  2⤵
  PID:6288
- C:\Windows\System\FcGTFlm.exe
  C:\Windows\System\FcGTFlm.exe
  2⤵
  PID:6324
- C:\Windows\System\wNklbOC.exe
  C:\Windows\System\wNklbOC.exe
  2⤵
  PID:6532
- C:\Windows\System\DQJbpAe.exe
  C:\Windows\System\DQJbpAe.exe
  2⤵
  PID:6580
- C:\Windows\System\ciLycRX.exe
  C:\Windows\System\ciLycRX.exe
  2⤵
  PID:6624
- C:\Windows\System\nVnwGYH.exe
  C:\Windows\System\nVnwGYH.exe
  2⤵
  PID:6672
- C:\Windows\System\OHKfjwR.exe
  C:\Windows\System\OHKfjwR.exe
  2⤵
  PID:6800
- C:\Windows\System\fHDulfI.exe
  C:\Windows\System\fHDulfI.exe
  2⤵
  PID:6844
- C:\Windows\System\jobnryQ.exe
  C:\Windows\System\jobnryQ.exe
  2⤵
  PID:6960
- C:\Windows\System\otGSrGM.exe
  C:\Windows\System\otGSrGM.exe
  2⤵
  PID:6904
- C:\Windows\System\NzTdzww.exe
  C:\Windows\System\NzTdzww.exe
  2⤵
  PID:7056
- C:\Windows\System\zqZZXNk.exe
  C:\Windows\System\zqZZXNk.exe
  2⤵
  PID:5928
- C:\Windows\System\zTlyaDN.exe
  C:\Windows\System\zTlyaDN.exe
  2⤵
  PID:5816
- C:\Windows\System\SCXpgCB.exe
  C:\Windows\System\SCXpgCB.exe
  2⤵
  PID:6364
- C:\Windows\System\KcSCtun.exe
  C:\Windows\System\KcSCtun.exe
  2⤵
  PID:6252
- C:\Windows\System\DLsFyId.exe
  C:\Windows\System\DLsFyId.exe
  2⤵
  PID:6488
- C:\Windows\System\lWeOLgt.exe
  C:\Windows\System\lWeOLgt.exe
  2⤵
  PID:6652
- C:\Windows\System\lOPBygk.exe
  C:\Windows\System\lOPBygk.exe
  2⤵
  PID:6820
- C:\Windows\System\nXdyjTo.exe
  C:\Windows\System\nXdyjTo.exe
  2⤵
  PID:6928
- C:\Windows\System\ppGAuHG.exe
  C:\Windows\System\ppGAuHG.exe
  2⤵
  PID:7124
- C:\Windows\System\liVeVSY.exe
  C:\Windows\System\liVeVSY.exe
  2⤵
  PID:6496
- C:\Windows\System\XxTmpmM.exe
  C:\Windows\System\XxTmpmM.exe
  2⤵
  PID:6780
- C:\Windows\System\dGLjDqD.exe
  C:\Windows\System\dGLjDqD.exe
  2⤵
  PID:6756
- C:\Windows\System\WrYELNQ.exe
  C:\Windows\System\WrYELNQ.exe
  2⤵
  PID:7144
- C:\Windows\System\RFBWTMk.exe
  C:\Windows\System\RFBWTMk.exe
  2⤵
  PID:6744
- C:\Windows\System\iTMCnhF.exe
  C:\Windows\System\iTMCnhF.exe
  2⤵
  PID:7180
- C:\Windows\System\sXDyRYd.exe
  C:\Windows\System\sXDyRYd.exe
  2⤵
  PID:7208
- C:\Windows\System\oCDVRcw.exe
  C:\Windows\System\oCDVRcw.exe
  2⤵
  PID:7240
- C:\Windows\System\lUEJZQf.exe
  C:\Windows\System\lUEJZQf.exe
  2⤵
  PID:7268
- C:\Windows\System\UdOfeuA.exe
  C:\Windows\System\UdOfeuA.exe
  2⤵
  PID:7292
- C:\Windows\System\SHedTDp.exe
  C:\Windows\System\SHedTDp.exe
  2⤵
  PID:7324
- C:\Windows\System\hplVRXD.exe
  C:\Windows\System\hplVRXD.exe
  2⤵
  PID:7356
- C:\Windows\System\VfXTZan.exe
  C:\Windows\System\VfXTZan.exe
  2⤵
  PID:7388
- C:\Windows\System\GRCSGbp.exe
  C:\Windows\System\GRCSGbp.exe
  2⤵
  PID:7412
- C:\Windows\System\pFXPStc.exe
  C:\Windows\System\pFXPStc.exe
  2⤵
  PID:7436
- C:\Windows\System\NGnuHUh.exe
  C:\Windows\System\NGnuHUh.exe
  2⤵
  PID:7460
- C:\Windows\System\KunUpWP.exe
  C:\Windows\System\KunUpWP.exe
  2⤵
  PID:7480
- C:\Windows\System\rhGKMcp.exe
  C:\Windows\System\rhGKMcp.exe
  2⤵
  PID:7504
- C:\Windows\System\BGXWvUo.exe
  C:\Windows\System\BGXWvUo.exe
  2⤵
  PID:7532
- C:\Windows\System\qsLgvEF.exe
  C:\Windows\System\qsLgvEF.exe
  2⤵
  PID:7564
- C:\Windows\System\NppguWt.exe
  C:\Windows\System\NppguWt.exe
  2⤵
  PID:7596
- C:\Windows\System\jdZgnJc.exe
  C:\Windows\System\jdZgnJc.exe
  2⤵
  PID:7628
- C:\Windows\System\yQCThrn.exe
  C:\Windows\System\yQCThrn.exe
  2⤵
  PID:7656
- C:\Windows\System\jSQcoIT.exe
  C:\Windows\System\jSQcoIT.exe
  2⤵
  PID:7688
- C:\Windows\System\wCkmCJo.exe
  C:\Windows\System\wCkmCJo.exe
  2⤵
  PID:7716
- C:\Windows\System\PqtRfVH.exe
  C:\Windows\System\PqtRfVH.exe
  2⤵
  PID:7748
- C:\Windows\System\FyVMjim.exe
  C:\Windows\System\FyVMjim.exe
  2⤵
  PID:7772
- C:\Windows\System\yLDkzLJ.exe
  C:\Windows\System\yLDkzLJ.exe
  2⤵
  PID:7800
- C:\Windows\System\KQGeqxO.exe
  C:\Windows\System\KQGeqxO.exe
  2⤵
  PID:7816
- C:\Windows\System\HgUrqpt.exe
  C:\Windows\System\HgUrqpt.exe
  2⤵
  PID:7848
- C:\Windows\System\URsCppW.exe
  C:\Windows\System\URsCppW.exe
  2⤵
  PID:7868
- C:\Windows\System\wvOeXVj.exe
  C:\Windows\System\wvOeXVj.exe
  2⤵
  PID:7904
- C:\Windows\System\HlvuYpj.exe
  C:\Windows\System\HlvuYpj.exe
  2⤵
  PID:7928
- C:\Windows\System\slOUDQq.exe
  C:\Windows\System\slOUDQq.exe
  2⤵
  PID:7956
- C:\Windows\System\gskfttu.exe
  C:\Windows\System\gskfttu.exe
  2⤵
  PID:7980
- C:\Windows\System\EnyyiLb.exe
  C:\Windows\System\EnyyiLb.exe
  2⤵
  PID:8012
- C:\Windows\System\yFfclId.exe
  C:\Windows\System\yFfclId.exe
  2⤵
  PID:8052
- C:\Windows\System\EsKPbch.exe
  C:\Windows\System\EsKPbch.exe
  2⤵
  PID:8076
- C:\Windows\System\uhjJkdh.exe
  C:\Windows\System\uhjJkdh.exe
  2⤵
  PID:8104
- C:\Windows\System\ChsaCwi.exe
  C:\Windows\System\ChsaCwi.exe
  2⤵
  PID:8132
- C:\Windows\System\DYeCaUF.exe
  C:\Windows\System\DYeCaUF.exe
  2⤵
  PID:8160
- C:\Windows\System\KysggYl.exe
  C:\Windows\System\KysggYl.exe
  2⤵
  PID:7188
- C:\Windows\System\kqUymsT.exe
  C:\Windows\System\kqUymsT.exe
  2⤵
  PID:6596
- C:\Windows\System\GIAHKfX.exe
  C:\Windows\System\GIAHKfX.exe
  2⤵
  PID:7260
- C:\Windows\System\PBxUwYP.exe
  C:\Windows\System\PBxUwYP.exe
  2⤵
  PID:7332
- C:\Windows\System\YbsZIRT.exe
  C:\Windows\System\YbsZIRT.exe
  2⤵
  PID:7424
- C:\Windows\System\OPILjot.exe
  C:\Windows\System\OPILjot.exe
  2⤵
  PID:7472
- C:\Windows\System\aRVEgei.exe
  C:\Windows\System\aRVEgei.exe
  2⤵
  PID:7492
- C:\Windows\System\QHMXOJh.exe
  C:\Windows\System\QHMXOJh.exe
  2⤵
  PID:7576
- C:\Windows\System\UUPsVKb.exe
  C:\Windows\System\UUPsVKb.exe
  2⤵
  PID:7700
- C:\Windows\System\iWTViKa.exe
  C:\Windows\System\iWTViKa.exe
  2⤵
  PID:7796
- C:\Windows\System\cMQuQYK.exe
  C:\Windows\System\cMQuQYK.exe
  2⤵
  PID:7828
- C:\Windows\System\XZnUyzz.exe
  C:\Windows\System\XZnUyzz.exe
  2⤵
  PID:7844
- C:\Windows\System\JtZmnFf.exe
  C:\Windows\System\JtZmnFf.exe
  2⤵
  PID:7940
- C:\Windows\System\GHqiDJy.exe
  C:\Windows\System\GHqiDJy.exe
  2⤵
  PID:8032
- C:\Windows\System\PxcvpyL.exe
  C:\Windows\System\PxcvpyL.exe
  2⤵
  PID:8072
- C:\Windows\System\fcaYuHi.exe
  C:\Windows\System\fcaYuHi.exe
  2⤵
  PID:8100
- C:\Windows\System\VhpGDRH.exe
  C:\Windows\System\VhpGDRH.exe
  2⤵
  PID:8188
- C:\Windows\System\xxpiGse.exe
  C:\Windows\System\xxpiGse.exe
  2⤵
  PID:7256
- C:\Windows\System\aboXBCe.exe
  C:\Windows\System\aboXBCe.exe
  2⤵
  PID:7468
- C:\Windows\System\nhutCJt.exe
  C:\Windows\System\nhutCJt.exe
  2⤵
  PID:7432
- C:\Windows\System\MMSHxWv.exe
  C:\Windows\System\MMSHxWv.exe
  2⤵
  PID:7812
- C:\Windows\System\lOrRbVh.exe
  C:\Windows\System\lOrRbVh.exe
  2⤵
  PID:7892
- C:\Windows\System\YJkxeHP.exe
  C:\Windows\System\YJkxeHP.exe
  2⤵
  PID:7952
- C:\Windows\System\eCYetCM.exe
  C:\Windows\System\eCYetCM.exe
  2⤵
  PID:7216
- C:\Windows\System\JqRUhhN.exe
  C:\Windows\System\JqRUhhN.exe
  2⤵
  PID:8116
- C:\Windows\System\SIOBHWm.exe
  C:\Windows\System\SIOBHWm.exe
  2⤵
  PID:7400
- C:\Windows\System\jhmWeeQ.exe
  C:\Windows\System\jhmWeeQ.exe
  2⤵
  PID:7236
- C:\Windows\System\cKTWAat.exe
  C:\Windows\System\cKTWAat.exe
  2⤵
  PID:8224
- C:\Windows\System\XWoFyAl.exe
  C:\Windows\System\XWoFyAl.exe
  2⤵
  PID:8248
- C:\Windows\System\XefgBkE.exe
  C:\Windows\System\XefgBkE.exe
  2⤵
  PID:8276
- C:\Windows\System\tFhoREf.exe
  C:\Windows\System\tFhoREf.exe
  2⤵
  PID:8300
- C:\Windows\System\DXbDjqz.exe
  C:\Windows\System\DXbDjqz.exe
  2⤵
  PID:8328
- C:\Windows\System\PEWiBwz.exe
  C:\Windows\System\PEWiBwz.exe
  2⤵
  PID:8356
- C:\Windows\System\tCyQglt.exe
  C:\Windows\System\tCyQglt.exe
  2⤵
  PID:8380
- C:\Windows\System\ZeSxsBH.exe
  C:\Windows\System\ZeSxsBH.exe
  2⤵
  PID:8412
- C:\Windows\System\gDOjiWK.exe
  C:\Windows\System\gDOjiWK.exe
  2⤵
  PID:8444
- C:\Windows\System\PVtOECF.exe
  C:\Windows\System\PVtOECF.exe
  2⤵
  PID:8460
- C:\Windows\System\cnjhpsM.exe
  C:\Windows\System\cnjhpsM.exe
  2⤵
  PID:8488
- C:\Windows\System\aoMhxJT.exe
  C:\Windows\System\aoMhxJT.exe
  2⤵
  PID:8516
- C:\Windows\System\OhCDPtj.exe
  C:\Windows\System\OhCDPtj.exe
  2⤵
  PID:8540
- C:\Windows\System\QnQloaD.exe
  C:\Windows\System\QnQloaD.exe
  2⤵
  PID:8560
- C:\Windows\System\YyaCGEP.exe
  C:\Windows\System\YyaCGEP.exe
  2⤵
  PID:8576
- C:\Windows\System\lsRAIeM.exe
  C:\Windows\System\lsRAIeM.exe
  2⤵
  PID:8596
- C:\Windows\System\TDCmlRm.exe
  C:\Windows\System\TDCmlRm.exe
  2⤵
  PID:8628
- C:\Windows\System\gYiIHHf.exe
  C:\Windows\System\gYiIHHf.exe
  2⤵
  PID:8656
- C:\Windows\System\lmPHCfw.exe
  C:\Windows\System\lmPHCfw.exe
  2⤵
  PID:8688
- C:\Windows\System\fLqegVu.exe
  C:\Windows\System\fLqegVu.exe
  2⤵
  PID:8724
- C:\Windows\System\pHBxgqT.exe
  C:\Windows\System\pHBxgqT.exe
  2⤵
  PID:8756
- C:\Windows\System\kJXWsNt.exe
  C:\Windows\System\kJXWsNt.exe
  2⤵
  PID:8784
- C:\Windows\System\hybcJgx.exe
  C:\Windows\System\hybcJgx.exe
  2⤵
  PID:8804
- C:\Windows\System\RYRAyAJ.exe
  C:\Windows\System\RYRAyAJ.exe
  2⤵
  PID:8840
- C:\Windows\System\sCQRrWu.exe
  C:\Windows\System\sCQRrWu.exe
  2⤵
  PID:8868
- C:\Windows\System\pzMLYVX.exe
  C:\Windows\System\pzMLYVX.exe
  2⤵
  PID:8908
- C:\Windows\System\fHJtAQI.exe
  C:\Windows\System\fHJtAQI.exe
  2⤵
  PID:8936
- C:\Windows\System\dAQISEW.exe
  C:\Windows\System\dAQISEW.exe
  2⤵
  PID:8960
- C:\Windows\System\rWAkQBh.exe
  C:\Windows\System\rWAkQBh.exe
  2⤵
  PID:8996
- C:\Windows\System\uZqZgam.exe
  C:\Windows\System\uZqZgam.exe
  2⤵
  PID:9024
- C:\Windows\System\TrsKIEL.exe
  C:\Windows\System\TrsKIEL.exe
  2⤵
  PID:9060
- C:\Windows\System\SsgsnBX.exe
  C:\Windows\System\SsgsnBX.exe
  2⤵
  PID:9076
- C:\Windows\System\ceZaQYc.exe
  C:\Windows\System\ceZaQYc.exe
  2⤵
  PID:9112
- C:\Windows\System\BZRhfYx.exe
  C:\Windows\System\BZRhfYx.exe
  2⤵
  PID:9136
- C:\Windows\System\gnwqNYO.exe
  C:\Windows\System\gnwqNYO.exe
  2⤵
  PID:9160
- C:\Windows\System\GrplzAD.exe
  C:\Windows\System\GrplzAD.exe
  2⤵
  PID:9176
- C:\Windows\System\RTBgbHi.exe
  C:\Windows\System\RTBgbHi.exe
  2⤵
  PID:9196
- C:\Windows\System\WWjTyHJ.exe
  C:\Windows\System\WWjTyHJ.exe
  2⤵
  PID:8000
- C:\Windows\System\IIfNEHU.exe
  C:\Windows\System\IIfNEHU.exe
  2⤵
  PID:8220
- C:\Windows\System\hEkiZpF.exe
  C:\Windows\System\hEkiZpF.exe
  2⤵
  PID:8232
- C:\Windows\System\aHuwXIJ.exe
  C:\Windows\System\aHuwXIJ.exe
  2⤵
  PID:8320
- C:\Windows\System\UMYvKJl.exe
  C:\Windows\System\UMYvKJl.exe
  2⤵
  PID:7116
- C:\Windows\System\yNkWYJW.exe
  C:\Windows\System\yNkWYJW.exe
  2⤵
  PID:8312
- C:\Windows\System\pwbgaIx.exe
  C:\Windows\System\pwbgaIx.exe
  2⤵
  PID:8432
- C:\Windows\System\gFUxxYc.exe
  C:\Windows\System\gFUxxYc.exe
  2⤵
  PID:8400
- C:\Windows\System\JkTtRzn.exe
  C:\Windows\System\JkTtRzn.exe
  2⤵
  PID:8616
- C:\Windows\System\PzfTDZw.exe
  C:\Windows\System\PzfTDZw.exe
  2⤵
  PID:8712
- C:\Windows\System\sApPDTS.exe
  C:\Windows\System\sApPDTS.exe
  2⤵
  PID:8668
- C:\Windows\System\zPwbkwG.exe
  C:\Windows\System\zPwbkwG.exe
  2⤵
  PID:8792
- C:\Windows\System\IbVFloB.exe
  C:\Windows\System\IbVFloB.exe
  2⤵
  PID:8884
- C:\Windows\System\YaFZlkK.exe
  C:\Windows\System\YaFZlkK.exe
  2⤵
  PID:8988
- C:\Windows\System\DdZVXDC.exe
  C:\Windows\System\DdZVXDC.exe
  2⤵
  PID:9012
- C:\Windows\System\xUqvjtF.exe
  C:\Windows\System\xUqvjtF.exe
  2⤵
  PID:9072
- C:\Windows\System\LvXpXuy.exe
  C:\Windows\System\LvXpXuy.exe
  2⤵
  PID:9148
- C:\Windows\System\ZfruNqa.exe
  C:\Windows\System\ZfruNqa.exe
  2⤵
  PID:7788
- C:\Windows\System\LnLJTWF.exe
  C:\Windows\System\LnLJTWF.exe
  2⤵
  PID:8264
- C:\Windows\System\hOsohhV.exe
  C:\Windows\System\hOsohhV.exe
  2⤵
  PID:8240
- C:\Windows\System\URLhLlP.exe
  C:\Windows\System\URLhLlP.exe
  2⤵
  PID:8408
- C:\Windows\System\RVolcRv.exe
  C:\Windows\System\RVolcRv.exe
  2⤵
  PID:8536
- C:\Windows\System\ngTpwHE.exe
  C:\Windows\System\ngTpwHE.exe
  2⤵
  PID:8800
- C:\Windows\System\CaeSBRy.exe
  C:\Windows\System\CaeSBRy.exe
  2⤵
  PID:8500
- C:\Windows\System\CwjHuiY.exe
  C:\Windows\System\CwjHuiY.exe
  2⤵
  PID:9184
- C:\Windows\System\fgTKtTl.exe
  C:\Windows\System\fgTKtTl.exe
  2⤵
  PID:9168
- C:\Windows\System\zeUMNlJ.exe
  C:\Windows\System\zeUMNlJ.exe
  2⤵
  PID:9232
- C:\Windows\System\NEROSpC.exe
  C:\Windows\System\NEROSpC.exe
  2⤵
  PID:9268
- C:\Windows\System\BeRefsc.exe
  C:\Windows\System\BeRefsc.exe
  2⤵
  PID:9300
- C:\Windows\System\UexbyGo.exe
  C:\Windows\System\UexbyGo.exe
  2⤵
  PID:9320
- C:\Windows\System\WOcroYY.exe
  C:\Windows\System\WOcroYY.exe
  2⤵
  PID:9348
- C:\Windows\System\bnWJuCm.exe
  C:\Windows\System\bnWJuCm.exe
  2⤵
  PID:9380
- C:\Windows\System\sQdldNH.exe
  C:\Windows\System\sQdldNH.exe
  2⤵
  PID:9412
- C:\Windows\System\MDwrvxu.exe
  C:\Windows\System\MDwrvxu.exe
  2⤵
  PID:9436
- C:\Windows\System\fcsqYyj.exe
  C:\Windows\System\fcsqYyj.exe
  2⤵
  PID:9456
- C:\Windows\System\zZKeuFd.exe
  C:\Windows\System\zZKeuFd.exe
  2⤵
  PID:9484
- C:\Windows\System\anZxVMs.exe
  C:\Windows\System\anZxVMs.exe
  2⤵
  PID:9508
- C:\Windows\System\yJblFhS.exe
  C:\Windows\System\yJblFhS.exe
  2⤵
  PID:9532
- C:\Windows\System\rcCSPxw.exe
  C:\Windows\System\rcCSPxw.exe
  2⤵
  PID:9552
- C:\Windows\System\ldIYHut.exe
  C:\Windows\System\ldIYHut.exe
  2⤵
  PID:9572
- C:\Windows\System\TsCIEiT.exe
  C:\Windows\System\TsCIEiT.exe
  2⤵
  PID:9604
- C:\Windows\System\bUmYitb.exe
  C:\Windows\System\bUmYitb.exe
  2⤵
  PID:9636
- C:\Windows\System\iUCuFXZ.exe
  C:\Windows\System\iUCuFXZ.exe
  2⤵
  PID:9660
- C:\Windows\System\SSoHXoz.exe
  C:\Windows\System\SSoHXoz.exe
  2⤵
  PID:9700
- C:\Windows\System\vZKiqiG.exe
  C:\Windows\System\vZKiqiG.exe
  2⤵
  PID:9724
- C:\Windows\System\XfQgMde.exe
  C:\Windows\System\XfQgMde.exe
  2⤵
  PID:9760
- C:\Windows\System\nvNQaDw.exe
  C:\Windows\System\nvNQaDw.exe
  2⤵
  PID:9804
- C:\Windows\System\JjxYbpy.exe
  C:\Windows\System\JjxYbpy.exe
  2⤵
  PID:9840
- C:\Windows\System\rkNJabO.exe
  C:\Windows\System\rkNJabO.exe
  2⤵
  PID:9868
- C:\Windows\System\qETnemc.exe
  C:\Windows\System\qETnemc.exe
  2⤵
  PID:9896
- C:\Windows\System\JWiFZbO.exe
  C:\Windows\System\JWiFZbO.exe
  2⤵
  PID:9916
- C:\Windows\System\yiBfjbl.exe
  C:\Windows\System\yiBfjbl.exe
  2⤵
  PID:9940
- C:\Windows\System\rpuuClo.exe
  C:\Windows\System\rpuuClo.exe
  2⤵
  PID:9964
- C:\Windows\System\ZqiGkMX.exe
  C:\Windows\System\ZqiGkMX.exe
  2⤵
  PID:9992
- C:\Windows\System\bQcCcyR.exe
  C:\Windows\System\bQcCcyR.exe
  2⤵
  PID:10012
- C:\Windows\System\HYIbxvl.exe
  C:\Windows\System\HYIbxvl.exe
  2⤵
  PID:10036
- C:\Windows\System\mghrlGI.exe
  C:\Windows\System\mghrlGI.exe
  2⤵
  PID:10064
- C:\Windows\System\ioSpVPA.exe
  C:\Windows\System\ioSpVPA.exe
  2⤵
  PID:10084
- C:\Windows\System\jmevchZ.exe
  C:\Windows\System\jmevchZ.exe
  2⤵
  PID:10108
- C:\Windows\System\TOcfyVj.exe
  C:\Windows\System\TOcfyVj.exe
  2⤵
  PID:10136
- C:\Windows\System\Slgiywk.exe
  C:\Windows\System\Slgiywk.exe
  2⤵
  PID:10164
- C:\Windows\System\tsJXyBt.exe
  C:\Windows\System\tsJXyBt.exe
  2⤵
  PID:10196
- C:\Windows\System\ETXbXgN.exe
  C:\Windows\System\ETXbXgN.exe
  2⤵
  PID:10220
- C:\Windows\System\HfgeAfh.exe
  C:\Windows\System\HfgeAfh.exe
  2⤵
  PID:8896
- C:\Windows\System\NWSjUJG.exe
  C:\Windows\System\NWSjUJG.exe
  2⤵
  PID:8204
- C:\Windows\System\HosGISY.exe
  C:\Windows\System\HosGISY.exe
  2⤵
  PID:8456
- C:\Windows\System\HPHNqlN.exe
  C:\Windows\System\HPHNqlN.exe
  2⤵
  PID:8864
- C:\Windows\System\aENDcLU.exe
  C:\Windows\System\aENDcLU.exe
  2⤵
  PID:9220
- C:\Windows\System\EHhUiGq.exe
  C:\Windows\System\EHhUiGq.exe
  2⤵
  PID:9400
- C:\Windows\System\KrcmOrY.exe
  C:\Windows\System\KrcmOrY.exe
  2⤵
  PID:9312
- C:\Windows\System\tBqXLnX.exe
  C:\Windows\System\tBqXLnX.exe
  2⤵
  PID:9408
- C:\Windows\System\CrJsFwQ.exe
  C:\Windows\System\CrJsFwQ.exe
  2⤵
  PID:9332
- C:\Windows\System\zrbPeiO.exe
  C:\Windows\System\zrbPeiO.exe
  2⤵
  PID:9584
- C:\Windows\System\hagDPIg.exe
  C:\Windows\System\hagDPIg.exe
  2⤵
  PID:9720
- C:\Windows\System\LNKBedT.exe
  C:\Windows\System\LNKBedT.exe
  2⤵
  PID:9772
- C:\Windows\System\kAnqNtB.exe
  C:\Windows\System\kAnqNtB.exe
  2⤵
  PID:9628
- C:\Windows\System\erAHNGM.exe
  C:\Windows\System\erAHNGM.exe
  2⤵
  PID:9652
- C:\Windows\System\FKcBvSo.exe
  C:\Windows\System\FKcBvSo.exe
  2⤵
  PID:9884
- C:\Windows\System\HsDOmwx.exe
  C:\Windows\System\HsDOmwx.exe
  2⤵
  PID:9928
- C:\Windows\System\GlScwdC.exe
  C:\Windows\System\GlScwdC.exe
  2⤵
  PID:10000
- C:\Windows\System\oiZsXxz.exe
  C:\Windows\System\oiZsXxz.exe
  2⤵
  PID:10076
- C:\Windows\System\aoakzQV.exe
  C:\Windows\System\aoakzQV.exe
  2⤵
  PID:10152
- C:\Windows\System\jmmFvEh.exe
  C:\Windows\System\jmmFvEh.exe
  2⤵
  PID:10104
- C:\Windows\System\fujFaeE.exe
  C:\Windows\System\fujFaeE.exe
  2⤵
  PID:8836
- C:\Windows\System\FgOdgvq.exe
  C:\Windows\System\FgOdgvq.exe
  2⤵
  PID:10208
- C:\Windows\System\osdzSrb.exe
  C:\Windows\System\osdzSrb.exe
  2⤵
  PID:9260
- C:\Windows\System\nZnUOMV.exe
  C:\Windows\System\nZnUOMV.exe
  2⤵
  PID:9444
- C:\Windows\System\xRQgyel.exe
  C:\Windows\System\xRQgyel.exe
  2⤵
  PID:9600
- C:\Windows\System\CikPoRZ.exe
  C:\Windows\System\CikPoRZ.exe
  2⤵
  PID:9712
- C:\Windows\System\VfpaKUM.exe
  C:\Windows\System\VfpaKUM.exe
  2⤵
  PID:10052
- C:\Windows\System\tEegMCU.exe
  C:\Windows\System\tEegMCU.exe
  2⤵
  PID:9540
- C:\Windows\System\qoJcwoC.exe
  C:\Windows\System\qoJcwoC.exe
  2⤵
  PID:10176
- C:\Windows\System\aZTPjsw.exe
  C:\Windows\System\aZTPjsw.exe
  2⤵
  PID:10264
- C:\Windows\System\wdAXHBO.exe
  C:\Windows\System\wdAXHBO.exe
  2⤵
  PID:10288
- C:\Windows\System\YZVllMC.exe
  C:\Windows\System\YZVllMC.exe
  2⤵
  PID:10308
- C:\Windows\System\JSZctAS.exe
  C:\Windows\System\JSZctAS.exe
  2⤵
  PID:10332
- C:\Windows\System\kcbOSkG.exe
  C:\Windows\System\kcbOSkG.exe
  2⤵
  PID:10364
- C:\Windows\System\gzLocwa.exe
  C:\Windows\System\gzLocwa.exe
  2⤵
  PID:10392
- C:\Windows\System\ASdghVO.exe
  C:\Windows\System\ASdghVO.exe
  2⤵
  PID:10420
- C:\Windows\System\bFQVlBX.exe
  C:\Windows\System\bFQVlBX.exe
  2⤵
  PID:10440
- C:\Windows\System\cQPgEPL.exe
  C:\Windows\System\cQPgEPL.exe
  2⤵
  PID:10468
- C:\Windows\System\GnjNRtB.exe
  C:\Windows\System\GnjNRtB.exe
  2⤵
  PID:10488
- C:\Windows\System\FGqjvGQ.exe
  C:\Windows\System\FGqjvGQ.exe
  2⤵
  PID:10520
- C:\Windows\System\GNyqLBR.exe
  C:\Windows\System\GNyqLBR.exe
  2⤵
  PID:10556
- C:\Windows\System\pqvFxLc.exe
  C:\Windows\System\pqvFxLc.exe
  2⤵
  PID:10584
- C:\Windows\System\LMAqeOR.exe
  C:\Windows\System\LMAqeOR.exe
  2⤵
  PID:10620
- C:\Windows\System\yVutLij.exe
  C:\Windows\System\yVutLij.exe
  2⤵
  PID:10648
- C:\Windows\System\RkTEbbz.exe
  C:\Windows\System\RkTEbbz.exe
  2⤵
  PID:10672
- C:\Windows\System\ygbEQZg.exe
  C:\Windows\System\ygbEQZg.exe
  2⤵
  PID:10700
- C:\Windows\System\oxwPymX.exe
  C:\Windows\System\oxwPymX.exe
  2⤵
  PID:10740
- C:\Windows\System\ggjEbov.exe
  C:\Windows\System\ggjEbov.exe
  2⤵
  PID:10768
- C:\Windows\System\DcotymY.exe
  C:\Windows\System\DcotymY.exe
  2⤵
  PID:10792
- C:\Windows\System\hjrNFgr.exe
  C:\Windows\System\hjrNFgr.exe
  2⤵
  PID:10828
- C:\Windows\System\XYtxNID.exe
  C:\Windows\System\XYtxNID.exe
  2⤵
  PID:10844
- C:\Windows\System\BkLDBlh.exe
  C:\Windows\System\BkLDBlh.exe
  2⤵
  PID:10876
- C:\Windows\System\hVbwJbk.exe
  C:\Windows\System\hVbwJbk.exe
  2⤵
  PID:10908
- C:\Windows\System\ylmwmCx.exe
  C:\Windows\System\ylmwmCx.exe
  2⤵
  PID:10936
- C:\Windows\System\hBXAQTn.exe
  C:\Windows\System\hBXAQTn.exe
  2⤵
  PID:10968
- C:\Windows\System\NaJKRVs.exe
  C:\Windows\System\NaJKRVs.exe
  2⤵
  PID:11000
- C:\Windows\System\syQLeDz.exe
  C:\Windows\System\syQLeDz.exe
  2⤵
  PID:11028
- C:\Windows\System\VUYdbos.exe
  C:\Windows\System\VUYdbos.exe
  2⤵
  PID:11056
- C:\Windows\System\qUxbCaJ.exe
  C:\Windows\System\qUxbCaJ.exe
  2⤵
  PID:11080
- C:\Windows\System\ToXvSLx.exe
  C:\Windows\System\ToXvSLx.exe
  2⤵
  PID:11116
- C:\Windows\System\OPBfbud.exe
  C:\Windows\System\OPBfbud.exe
  2⤵
  PID:11144
- C:\Windows\System\VbKKMbv.exe
  C:\Windows\System\VbKKMbv.exe
  2⤵
  PID:11172
- C:\Windows\System\kSZSHAK.exe
  C:\Windows\System\kSZSHAK.exe
  2⤵
  PID:11192
- C:\Windows\System\udPcmxW.exe
  C:\Windows\System\udPcmxW.exe
  2⤵
  PID:11224
- C:\Windows\System\HWCmVyy.exe
  C:\Windows\System\HWCmVyy.exe
  2⤵
  PID:11256
- C:\Windows\System\SKBpLVe.exe
  C:\Windows\System\SKBpLVe.exe
  2⤵
  PID:9496
- C:\Windows\System\szWLbhD.exe
  C:\Windows\System\szWLbhD.exe
  2⤵
  PID:10144
- C:\Windows\System\HPhubye.exe
  C:\Windows\System\HPhubye.exe
  2⤵
  PID:9684
- C:\Windows\System\SHCBMnS.exe
  C:\Windows\System\SHCBMnS.exe
  2⤵
  PID:10316
- C:\Windows\System\lgowEHf.exe
  C:\Windows\System\lgowEHf.exe
  2⤵
  PID:10356
- C:\Windows\System\gFsnsXd.exe
  C:\Windows\System\gFsnsXd.exe
  2⤵
  PID:10412
- C:\Windows\System\pNSCqqS.exe
  C:\Windows\System\pNSCqqS.exe
  2⤵
  PID:10516
- C:\Windows\System\CVYxVKK.exe
  C:\Windows\System\CVYxVKK.exe
  2⤵
  PID:10596
- C:\Windows\System\ZruSzqq.exe
  C:\Windows\System\ZruSzqq.exe
  2⤵
  PID:10644
- C:\Windows\System\DWKPCrp.exe
  C:\Windows\System\DWKPCrp.exe
  2⤵
  PID:10696
- C:\Windows\System\klaFTpL.exe
  C:\Windows\System\klaFTpL.exe
  2⤵
  PID:10760
- C:\Windows\System\ZnoERWX.exe
  C:\Windows\System\ZnoERWX.exe
  2⤵
  PID:10816
- C:\Windows\System\qRnAMdu.exe
  C:\Windows\System\qRnAMdu.exe
  2⤵
  PID:10720
- C:\Windows\System\RxaKuNz.exe
  C:\Windows\System\RxaKuNz.exe
  2⤵
  PID:10948
- C:\Windows\System\BNzeBOv.exe
  C:\Windows\System\BNzeBOv.exe
  2⤵
  PID:11036
- C:\Windows\System\KtVZdII.exe
  C:\Windows\System\KtVZdII.exe
  2⤵
  PID:11104
- C:\Windows\System\PNuYgKG.exe
  C:\Windows\System\PNuYgKG.exe
  2⤵
  PID:10984
- C:\Windows\System\AHuyLGg.exe
  C:\Windows\System\AHuyLGg.exe
  2⤵
  PID:10840
- C:\Windows\System\KCVurhi.exe
  C:\Windows\System\KCVurhi.exe
  2⤵
  PID:11240
- C:\Windows\System\HbYahLz.exe
  C:\Windows\System\HbYahLz.exe
  2⤵
  PID:10340
- C:\Windows\System\SEOlnCQ.exe
  C:\Windows\System\SEOlnCQ.exe
  2⤵
  PID:9464
- C:\Windows\System\VHZVFOQ.exe
  C:\Windows\System\VHZVFOQ.exe
  2⤵
  PID:10576
- C:\Windows\System\sflmJNN.exe
  C:\Windows\System\sflmJNN.exe
  2⤵
  PID:10460
- C:\Windows\System\GJqWQFZ.exe
  C:\Windows\System\GJqWQFZ.exe
  2⤵
  PID:10920
- C:\Windows\System\gLplmmc.exe
  C:\Windows\System\gLplmmc.exe
  2⤵
  PID:11040
- C:\Windows\System\rjRGpZv.exe
  C:\Windows\System\rjRGpZv.exe
  2⤵
  PID:10864
- C:\Windows\System\GBDtVZI.exe
  C:\Windows\System\GBDtVZI.exe
  2⤵
  PID:11276
- C:\Windows\System\jvrKgEG.exe
  C:\Windows\System\jvrKgEG.exe
  2⤵
  PID:11308
- C:\Windows\System\pqLPGbq.exe
  C:\Windows\System\pqLPGbq.exe
  2⤵
  PID:11336
- C:\Windows\System\qVCEpnJ.exe
  C:\Windows\System\qVCEpnJ.exe
  2⤵
  PID:11356
- C:\Windows\System\yvUixJX.exe
  C:\Windows\System\yvUixJX.exe
  2⤵
  PID:11392
- C:\Windows\System\zKbFFAn.exe
  C:\Windows\System\zKbFFAn.exe
  2⤵
  PID:11408
- C:\Windows\System\PEyYLcy.exe
  C:\Windows\System\PEyYLcy.exe
  2⤵
  PID:11436
- C:\Windows\System\hEsQsPp.exe
  C:\Windows\System\hEsQsPp.exe
  2⤵
  PID:11460
- C:\Windows\System\LUtfSSO.exe
  C:\Windows\System\LUtfSSO.exe
  2⤵
  PID:11484
- C:\Windows\System\jDjmyJI.exe
  C:\Windows\System\jDjmyJI.exe
  2⤵
  PID:11512
- C:\Windows\System\wKzFCFJ.exe
  C:\Windows\System\wKzFCFJ.exe
  2⤵
  PID:11552
- C:\Windows\System\JtOHFym.exe
  C:\Windows\System\JtOHFym.exe
  2⤵
  PID:11568
- C:\Windows\System\wyTnJrE.exe
  C:\Windows\System\wyTnJrE.exe
  2⤵
  PID:11592
- C:\Windows\System\apvVAfu.exe
  C:\Windows\System\apvVAfu.exe
  2⤵
  PID:11612
- C:\Windows\System\KgomHvH.exe
  C:\Windows\System\KgomHvH.exe
  2⤵
  PID:11636
- C:\Windows\System\smbbcrg.exe
  C:\Windows\System\smbbcrg.exe
  2⤵
  PID:11672
- C:\Windows\System\ZKatZTH.exe
  C:\Windows\System\ZKatZTH.exe
  2⤵
  PID:11708
- C:\Windows\System\VUVDKCX.exe
  C:\Windows\System\VUVDKCX.exe
  2⤵
  PID:11736
- C:\Windows\System\aGpYVgx.exe
  C:\Windows\System\aGpYVgx.exe
  2⤵
  PID:11760
- C:\Windows\System\rnIKNwV.exe
  C:\Windows\System\rnIKNwV.exe
  2⤵
  PID:11796
- C:\Windows\System\ZcWgnuV.exe
  C:\Windows\System\ZcWgnuV.exe
  2⤵
  PID:11840
- C:\Windows\System\gBYTuen.exe
  C:\Windows\System\gBYTuen.exe
  2⤵
  PID:11864
- C:\Windows\System\VeYWtSL.exe
  C:\Windows\System\VeYWtSL.exe
  2⤵
  PID:11888
- C:\Windows\System\lapeuju.exe
  C:\Windows\System\lapeuju.exe
  2⤵
  PID:11920
- C:\Windows\System\renCdAl.exe
  C:\Windows\System\renCdAl.exe
  2⤵
  PID:11948
- C:\Windows\System\ltrsOAn.exe
  C:\Windows\System\ltrsOAn.exe
  2⤵
  PID:11972
- C:\Windows\System\SiTVcLB.exe
  C:\Windows\System\SiTVcLB.exe
  2⤵
  PID:11996
- C:\Windows\System\MgXqlAe.exe
  C:\Windows\System\MgXqlAe.exe
  2⤵
  PID:12020
- C:\Windows\System\weQKowi.exe
  C:\Windows\System\weQKowi.exe
  2⤵
  PID:12048
- C:\Windows\System\dszNMlv.exe
  C:\Windows\System\dszNMlv.exe
  2⤵
  PID:12076
- C:\Windows\System\CYTFewZ.exe
  C:\Windows\System\CYTFewZ.exe
  2⤵
  PID:12104
- C:\Windows\System\HNickNB.exe
  C:\Windows\System\HNickNB.exe
  2⤵
  PID:12124
- C:\Windows\System\FlBUVYi.exe
  C:\Windows\System\FlBUVYi.exe
  2⤵
  PID:12164
- C:\Windows\System\mbkeHcb.exe
  C:\Windows\System\mbkeHcb.exe
  2⤵
  PID:12192
- C:\Windows\System\geVOYfe.exe
  C:\Windows\System\geVOYfe.exe
  2⤵
  PID:12216
- C:\Windows\System\WsFaxdA.exe
  C:\Windows\System\WsFaxdA.exe
  2⤵
  PID:12252
- C:\Windows\System\lyINrJT.exe
  C:\Windows\System\lyINrJT.exe
  2⤵
  PID:12284
- C:\Windows\System\ZuUgTrx.exe
  C:\Windows\System\ZuUgTrx.exe
  2⤵
  PID:10632
- C:\Windows\System\POvfGPG.exe
  C:\Windows\System\POvfGPG.exe
  2⤵
  PID:10184
- C:\Windows\System\JPKPsZL.exe
  C:\Windows\System\JPKPsZL.exe
  2⤵
  PID:9672
- C:\Windows\System\CbADMGF.exe
  C:\Windows\System\CbADMGF.exe
  2⤵
  PID:10692
- C:\Windows\System\TgcqabL.exe
  C:\Windows\System\TgcqabL.exe
  2⤵
  PID:11344
- C:\Windows\System\bYUDhzP.exe
  C:\Windows\System\bYUDhzP.exe
  2⤵
  PID:11444
- C:\Windows\System\sffVbWS.exe
  C:\Windows\System\sffVbWS.exe
  2⤵
  PID:11328
- C:\Windows\System\WihbsJk.exe
  C:\Windows\System\WihbsJk.exe
  2⤵
  PID:11604
- C:\Windows\System\hTISejS.exe
  C:\Windows\System\hTISejS.exe
  2⤵
  PID:11544
- C:\Windows\System\FzdyVNw.exe
  C:\Windows\System\FzdyVNw.exe
  2⤵
  PID:11696
- C:\Windows\System\yKDpYuN.exe
  C:\Windows\System\yKDpYuN.exe
  2⤵
  PID:11500
- C:\Windows\System\omKFLzD.exe
  C:\Windows\System\omKFLzD.exe
  2⤵
  PID:11768
- C:\Windows\System\nwalrPd.exe
  C:\Windows\System\nwalrPd.exe
  2⤵
  PID:11720
- C:\Windows\System\CGpkCAT.exe
  C:\Windows\System\CGpkCAT.exe
  2⤵
  PID:11968
- C:\Windows\System\ItMkdzY.exe
  C:\Windows\System\ItMkdzY.exe
  2⤵
  PID:12036
- C:\Windows\System\efJhWIY.exe
  C:\Windows\System\efJhWIY.exe
  2⤵
  PID:12152
- C:\Windows\System\oGsXkAQ.exe
  C:\Windows\System\oGsXkAQ.exe
  2⤵
  PID:11884
- C:\Windows\System\QNfCCiS.exe
  C:\Windows\System\QNfCCiS.exe
  2⤵
  PID:12232
- C:\Windows\System\WIsTWRG.exe
  C:\Windows\System\WIsTWRG.exe
  2⤵
  PID:11184
- C:\Windows\System\QDLAQbh.exe
  C:\Windows\System\QDLAQbh.exe
  2⤵
  PID:11016
- C:\Windows\System\fbXufkd.exe
  C:\Windows\System\fbXufkd.exe
  2⤵
  PID:12236
- C:\Windows\System\wvIwJhr.exe
  C:\Windows\System\wvIwJhr.exe
  2⤵
  PID:12116
- C:\Windows\System\BOZsIVs.exe
  C:\Windows\System\BOZsIVs.exe
  2⤵
  PID:11388
- C:\Windows\System\lwFLoyR.exe
  C:\Windows\System\lwFLoyR.exe
  2⤵
  PID:11848
- C:\Windows\System\OiXeSKn.exe
  C:\Windows\System\OiXeSKn.exe
  2⤵
  PID:11472
- C:\Windows\System\hheXdKo.exe
  C:\Windows\System\hheXdKo.exe
  2⤵
  PID:11988
- C:\Windows\System\WqDsLOl.exe
  C:\Windows\System\WqDsLOl.exe
  2⤵
  PID:12396
- C:\Windows\System\Rbouqrv.exe
  C:\Windows\System\Rbouqrv.exe
  2⤵
  PID:12432
- C:\Windows\System\GLDnXHq.exe
  C:\Windows\System\GLDnXHq.exe
  2⤵
  PID:12496
- C:\Windows\System\kFtygTN.exe
  C:\Windows\System\kFtygTN.exe
  2⤵
  PID:12520
- C:\Windows\System\ExcnUoL.exe
  C:\Windows\System\ExcnUoL.exe
  2⤵
  PID:12552
- C:\Windows\System\FGAaQxn.exe
  C:\Windows\System\FGAaQxn.exe
  2⤵
  PID:12576
- C:\Windows\System\ayFPBGS.exe
  C:\Windows\System\ayFPBGS.exe
  2⤵
  PID:12604
- C:\Windows\System\xcTrJXz.exe
  C:\Windows\System\xcTrJXz.exe
  2⤵
  PID:12628
- C:\Windows\System\aATAvqk.exe
  C:\Windows\System\aATAvqk.exe
  2⤵
  PID:12656
- C:\Windows\System\KCpDAFH.exe
  C:\Windows\System\KCpDAFH.exe
  2⤵
  PID:12684
- C:\Windows\System\tDcjepC.exe
  C:\Windows\System\tDcjepC.exe
  2⤵
  PID:12712
- C:\Windows\System\IqgOzwY.exe
  C:\Windows\System\IqgOzwY.exe
  2⤵
  PID:12752
- C:\Windows\System\bnhyPOd.exe
  C:\Windows\System\bnhyPOd.exe
  2⤵
  PID:12780
- C:\Windows\System\DxHuiII.exe
  C:\Windows\System\DxHuiII.exe
  2⤵
  PID:12812
- C:\Windows\System\IBNNNuA.exe
  C:\Windows\System\IBNNNuA.exe
  2⤵
  PID:12840
- C:\Windows\System\CuxVVtk.exe
  C:\Windows\System\CuxVVtk.exe
  2⤵
  PID:12864
- C:\Windows\System\JegMBol.exe
  C:\Windows\System\JegMBol.exe
  2⤵
  PID:12896
- C:\Windows\System\WTKaRGI.exe
  C:\Windows\System\WTKaRGI.exe
  2⤵
  PID:12920
- C:\Windows\System\lDMOXdf.exe
  C:\Windows\System\lDMOXdf.exe
  2⤵
  PID:12948
- C:\Windows\System\qdScgfT.exe
  C:\Windows\System\qdScgfT.exe
  2⤵
  PID:12976
- C:\Windows\System\ltwrZtE.exe
  C:\Windows\System\ltwrZtE.exe
  2⤵
  PID:13004
- C:\Windows\System\geeetfu.exe
  C:\Windows\System\geeetfu.exe
  2⤵
  PID:13028
- C:\Windows\System\MCqOLsb.exe
  C:\Windows\System\MCqOLsb.exe
  2⤵
  PID:13064
- C:\Windows\System\oJdsJuo.exe
  C:\Windows\System\oJdsJuo.exe
  2⤵
  PID:13088
- C:\Windows\System\LKaXTVI.exe
  C:\Windows\System\LKaXTVI.exe
  2⤵
  PID:13116
- C:\Windows\System\kcLrClH.exe
  C:\Windows\System\kcLrClH.exe
  2⤵
  PID:13136
- C:\Windows\System\pEojRRZ.exe
  C:\Windows\System\pEojRRZ.exe
  2⤵
  PID:13160
- C:\Windows\System\KGtKdHh.exe
  C:\Windows\System\KGtKdHh.exe
  2⤵
  PID:13184
- C:\Windows\System\hXXKGXG.exe
  C:\Windows\System\hXXKGXG.exe
  2⤵
  PID:13212
- C:\Windows\System\fMotGjP.exe
  C:\Windows\System\fMotGjP.exe
  2⤵
  PID:13240
- C:\Windows\System\MSqDOds.exe
  C:\Windows\System\MSqDOds.exe
  2⤵
  PID:13264
- C:\Windows\System\bIuKlrs.exe
  C:\Windows\System\bIuKlrs.exe
  2⤵
  PID:13292
- C:\Windows\System\UNcAGcV.exe
  C:\Windows\System\UNcAGcV.exe
  2⤵
  PID:12268
- C:\Windows\System\yjZjYKd.exe
  C:\Windows\System\yjZjYKd.exe
  2⤵
  PID:11524
- C:\Windows\System\nBgNRJA.exe
  C:\Windows\System\nBgNRJA.exe
  2⤵
  PID:11352
- C:\Windows\System\rsZoGLs.exe
  C:\Windows\System\rsZoGLs.exe
  2⤵
  PID:12204
- C:\Windows\System\nGtrgsI.exe
  C:\Windows\System\nGtrgsI.exe
  2⤵
  PID:12260
- C:\Windows\System\IszETSL.exe
  C:\Windows\System\IszETSL.exe
  2⤵
  PID:12452
- C:\Windows\System\mKCeCHZ.exe
  C:\Windows\System\mKCeCHZ.exe
  2⤵
  PID:12384
- C:\Windows\System\FzkOrnh.exe
  C:\Windows\System\FzkOrnh.exe
  2⤵
  PID:12464
- C:\Windows\System\auTHQcG.exe
  C:\Windows\System\auTHQcG.exe
  2⤵
  PID:12616
- C:\Windows\System\XQNuyQF.exe
  C:\Windows\System\XQNuyQF.exe
  2⤵
  PID:12668
- C:\Windows\System\AfgeDTI.exe
  C:\Windows\System\AfgeDTI.exe
  2⤵
  PID:12696
- C:\Windows\System\BFeFtQT.exe
  C:\Windows\System\BFeFtQT.exe
  2⤵
  PID:12820
- C:\Windows\System\TNeIrrK.exe
  C:\Windows\System\TNeIrrK.exe
  2⤵
  PID:12916
- C:\Windows\System\gGpoBIx.exe
  C:\Windows\System\gGpoBIx.exe
  2⤵
  PID:12932
- C:\Windows\System\HFHhAKc.exe
  C:\Windows\System\HFHhAKc.exe
  2⤵
  PID:12908
- C:\Windows\System\YnTzTSv.exe
  C:\Windows\System\YnTzTSv.exe
  2⤵
  PID:13040
- C:\Windows\System\RvFDYhx.exe
  C:\Windows\System\RvFDYhx.exe
  2⤵
  PID:13080
- C:\Windows\System\WvuvFDy.exe
  C:\Windows\System\WvuvFDy.exe
  2⤵
  PID:13172
- C:\Windows\System\qgCCHAi.exe
  C:\Windows\System\qgCCHAi.exe
  2⤵
  PID:13248
- C:\Windows\System\rYYIbfU.exe
  C:\Windows\System\rYYIbfU.exe
  2⤵
  PID:13284
- C:\Windows\System\RlVPxKW.exe
  C:\Windows\System\RlVPxKW.exe
  2⤵
  PID:11756
- C:\Windows\System\pEVvlFW.exe
  C:\Windows\System\pEVvlFW.exe
  2⤵
  PID:11128
- C:\Windows\System\hfjbDbB.exe
  C:\Windows\System\hfjbDbB.exe
  2⤵
  PID:12148
- C:\Windows\System\FEAZMnY.exe
  C:\Windows\System\FEAZMnY.exe
  2⤵
  PID:10544
- C:\Windows\System\lbwfITA.exe
  C:\Windows\System\lbwfITA.exe
  2⤵
  PID:12676
- C:\Windows\System\ozZrhDa.exe
  C:\Windows\System\ozZrhDa.exe
  2⤵
  PID:12568
- C:\Windows\System\rcLZUBv.exe
  C:\Windows\System\rcLZUBv.exe
  2⤵
  PID:12992
- C:\Windows\System\TkbeaXB.exe
  C:\Windows\System\TkbeaXB.exe
  2⤵
  PID:12728
- C:\Windows\System\gphZoFV.exe
  C:\Windows\System\gphZoFV.exe
  2⤵
  PID:13108
- C:\Windows\System\THScVTV.exe
  C:\Windows\System\THScVTV.exe
  2⤵
  PID:13076
- C:\Windows\System\wWEfthb.exe
  C:\Windows\System\wWEfthb.exe
  2⤵
  PID:11012
- C:\Windows\System\wLqrBrW.exe
  C:\Windows\System\wLqrBrW.exe
  2⤵
  PID:13232
- C:\Windows\System\ZzqCoHK.exe
  C:\Windows\System\ZzqCoHK.exe
  2⤵
  PID:13180
- C:\Windows\System\vZEdoiW.exe
  C:\Windows\System\vZEdoiW.exe
  2⤵
  PID:13316
- C:\Windows\System\FOwnAaR.exe
  C:\Windows\System\FOwnAaR.exe
  2⤵
  PID:13348
- C:\Windows\System\gqpIokD.exe
  C:\Windows\System\gqpIokD.exe
  2⤵
  PID:13376
- C:\Windows\System\DtFqvCl.exe
  C:\Windows\System\DtFqvCl.exe
  2⤵
  PID:13412
- C:\Windows\System\hIKRRuv.exe
  C:\Windows\System\hIKRRuv.exe
  2⤵
  PID:13428
- C:\Windows\System\liLVqWX.exe
  C:\Windows\System\liLVqWX.exe
  2⤵
  PID:13456
- C:\Windows\System\FZNrnQP.exe
  C:\Windows\System\FZNrnQP.exe
  2⤵
  PID:13480
- C:\Windows\System\YWbTEiD.exe
  C:\Windows\System\YWbTEiD.exe
  2⤵
  PID:13508
- C:\Windows\System\KkhEDCL.exe
  C:\Windows\System\KkhEDCL.exe
  2⤵
  PID:13528
- C:\Windows\System\SBbeMZv.exe
  C:\Windows\System\SBbeMZv.exe
  2⤵
  PID:13552
- C:\Windows\System\cVXeiXl.exe
  C:\Windows\System\cVXeiXl.exe
  2⤵
  PID:13576
- C:\Windows\System\UJkdMEl.exe
  C:\Windows\System\UJkdMEl.exe
  2⤵
  PID:13608
- C:\Windows\System\fRjhSxA.exe
  C:\Windows\System\fRjhSxA.exe
  2⤵
  PID:13624
- C:\Windows\System\FhdWzsx.exe
  C:\Windows\System\FhdWzsx.exe
  2⤵
  PID:13660
- C:\Windows\System\oUpFMNy.exe
  C:\Windows\System\oUpFMNy.exe
  2⤵
  PID:13684
- C:\Windows\System\XcPToif.exe
  C:\Windows\System\XcPToif.exe
  2⤵
  PID:13700
- C:\Windows\System\OUBkYnA.exe
  C:\Windows\System\OUBkYnA.exe
  2⤵
  PID:13728
- C:\Windows\System\mDEkjJi.exe
  C:\Windows\System\mDEkjJi.exe
  2⤵
  PID:13768
- C:\Windows\System\frAzOaU.exe
  C:\Windows\System\frAzOaU.exe
  2⤵
  PID:13788
- C:\Windows\System\ZrzFdEl.exe
  C:\Windows\System\ZrzFdEl.exe
  2⤵
  PID:13808
- C:\Windows\System\KmIEeFn.exe
  C:\Windows\System\KmIEeFn.exe
  2⤵
  PID:13828
- C:\Windows\System\mThWkTW.exe
  C:\Windows\System\mThWkTW.exe
  2⤵
  PID:13856
- C:\Windows\System\etNTFtq.exe
  C:\Windows\System\etNTFtq.exe
  2⤵
  PID:13884
- C:\Windows\System\KYUyWAu.exe
  C:\Windows\System\KYUyWAu.exe
  2⤵
  PID:13904
- C:\Windows\System\LuzUERz.exe
  C:\Windows\System\LuzUERz.exe
  2⤵
  PID:13932
- C:\Windows\System\OVTuIjb.exe
  C:\Windows\System\OVTuIjb.exe
  2⤵
  PID:13952
- C:\Windows\System\joeVZYl.exe
  C:\Windows\System\joeVZYl.exe
  2⤵
  PID:13984
- C:\Windows\System\hnyAQBo.exe
  C:\Windows\System\hnyAQBo.exe
  2⤵
  PID:14012
- C:\Windows\System\bYOXuuN.exe
  C:\Windows\System\bYOXuuN.exe
  2⤵
  PID:14040
- C:\Windows\System\GcRuxni.exe
  C:\Windows\System\GcRuxni.exe
  2⤵
  PID:14064
- C:\Windows\System\xgwJJzZ.exe
  C:\Windows\System\xgwJJzZ.exe
  2⤵
  PID:14096
- C:\Windows\System\yjdfCQc.exe
  C:\Windows\System\yjdfCQc.exe
  2⤵
  PID:14124
- C:\Windows\System\GVWGcHe.exe
  C:\Windows\System\GVWGcHe.exe
  2⤵
  PID:14144
- C:\Windows\System\gEGWVKB.exe
  C:\Windows\System\gEGWVKB.exe
  2⤵
  PID:14168
- C:\Windows\System\boUaIIW.exe
  C:\Windows\System\boUaIIW.exe
  2⤵
  PID:14200
- C:\Windows\System\uEgBftS.exe
  C:\Windows\System\uEgBftS.exe
  2⤵
  PID:14224
- C:\Windows\System\ARkbeLD.exe
  C:\Windows\System\ARkbeLD.exe
  2⤵
  PID:14252
- C:\Windows\System\eWPNmcO.exe
  C:\Windows\System\eWPNmcO.exe
  2⤵
  PID:14280
- C:\Windows\System\LPaDzld.exe
  C:\Windows\System\LPaDzld.exe
  2⤵
  PID:14296
- C:\Windows\System\cHOJTIV.exe
  C:\Windows\System\cHOJTIV.exe
  2⤵
  PID:14328
- C:\Windows\System\DozWNUT.exe
  C:\Windows\System\DozWNUT.exe
  2⤵
  PID:13056
- C:\Windows\System\WBxpvbR.exe
  C:\Windows\System\WBxpvbR.exe
  2⤵
  PID:12372
- C:\Windows\System\Qxerghf.exe
  C:\Windows\System\Qxerghf.exe
  2⤵
  PID:13364
- C:\Windows\System\tzkpjJT.exe
  C:\Windows\System\tzkpjJT.exe
  2⤵
  PID:13344
- C:\Windows\System\qbCwgPP.exe
  C:\Windows\System\qbCwgPP.exe
  2⤵
  PID:13540
- C:\Windows\System\TnFdCmX.exe
  C:\Windows\System\TnFdCmX.exe
  2⤵
  PID:13492
- C:\Windows\System\ubNOWas.exe
  C:\Windows\System\ubNOWas.exe
  2⤵
  PID:13564
- C:\Windows\System\RGMUiZg.exe
  C:\Windows\System\RGMUiZg.exe
  2⤵
  PID:13740
- C:\Windows\System\ocxqXRm.exe
  C:\Windows\System\ocxqXRm.exe
  2⤵
  PID:13796
- C:\Windows\System\CxfhnuD.exe
  C:\Windows\System\CxfhnuD.exe
  2⤵
  PID:13824
- C:\Windows\System\MpdWWDt.exe
  C:\Windows\System\MpdWWDt.exe
  2⤵
  PID:13876
- C:\Windows\System\ZySTVYG.exe
  C:\Windows\System\ZySTVYG.exe
  2⤵
  PID:13976
- C:\Windows\System\YUatPnL.exe
  C:\Windows\System\YUatPnL.exe
  2⤵
  PID:14008
- C:\Windows\System\UYFHWkI.exe
  C:\Windows\System\UYFHWkI.exe
  2⤵
  PID:13916
- C:\Windows\System\svsVzHX.exe
  C:\Windows\System\svsVzHX.exe
  2⤵
  PID:14028
- C:\Windows\System\wdCuwad.exe
  C:\Windows\System\wdCuwad.exe
  2⤵
  PID:14112
- C:\Windows\System\Cnabneh.exe
  C:\Windows\System\Cnabneh.exe
  2⤵
  PID:14276
- C:\Windows\System\wctHoOB.exe
  C:\Windows\System\wctHoOB.exe
  2⤵
  PID:14160
- C:\Windows\System\OTAXhSe.exe
  C:\Windows\System\OTAXhSe.exe
  2⤵
  PID:14104
- C:\Windows\System\tFoTEfn.exe
  C:\Windows\System\tFoTEfn.exe
  2⤵
  PID:14076
- C:\Windows\System\NtxDxow.exe
  C:\Windows\System\NtxDxow.exe
  2⤵
  PID:14356
- C:\Windows\System\hCptkjx.exe
  C:\Windows\System\hCptkjx.exe
  2⤵
  PID:14392
- C:\Windows\System\amysNPR.exe
  C:\Windows\System\amysNPR.exe
  2⤵
  PID:14432
- C:\Windows\System\CFrSnVI.exe
  C:\Windows\System\CFrSnVI.exe
  2⤵
  PID:14448
- C:\Windows\System\UbtZGwE.exe
  C:\Windows\System\UbtZGwE.exe
  2⤵
  PID:14468
- C:\Windows\System\cHnSAGg.exe
  C:\Windows\System\cHnSAGg.exe
  2⤵
  PID:14492
- C:\Windows\System\VxaBPcx.exe
  C:\Windows\System\VxaBPcx.exe
  2⤵
  PID:14508
- C:\Windows\System\mBWfmmu.exe
  C:\Windows\System\mBWfmmu.exe
  2⤵
  PID:14532
- C:\Windows\System\xPFbRLv.exe
  C:\Windows\System\xPFbRLv.exe
  2⤵
  PID:14552
- C:\Windows\System\uuYVggO.exe
  C:\Windows\System\uuYVggO.exe
  2⤵
  PID:14572
- C:\Windows\System\nNioicr.exe
  C:\Windows\System\nNioicr.exe
  2⤵
  PID:14588
- C:\Windows\System\bGZxwmG.exe
  C:\Windows\System\bGZxwmG.exe
  2⤵
  PID:14616
- C:\Windows\System\qXAjyJb.exe
  C:\Windows\System\qXAjyJb.exe
  2⤵
  PID:14652
- C:\Windows\System\VeTRtGv.exe
  C:\Windows\System\VeTRtGv.exe
  2⤵
  PID:14668
- C:\Windows\System\SFcEYKj.exe
  C:\Windows\System\SFcEYKj.exe
  2⤵
  PID:14688
- C:\Windows\System\DUaGXUD.exe
  C:\Windows\System\DUaGXUD.exe
  2⤵
  PID:14712
- C:\Windows\System\UcKOlGr.exe
  C:\Windows\System\UcKOlGr.exe
  2⤵
  PID:14748
- C:\Windows\System\Ryichsz.exe
  C:\Windows\System\Ryichsz.exe
  2⤵
  PID:14764
- C:\Windows\System\daxmDry.exe
  C:\Windows\System\daxmDry.exe
  2⤵
  PID:14792
- C:\Windows\System\tBfGCDM.exe
  C:\Windows\System\tBfGCDM.exe
  2⤵
  PID:14808
- C:\Windows\System\ANVYNqs.exe
  C:\Windows\System\ANVYNqs.exe
  2⤵
  PID:14832
- C:\Windows\System\IZuVWId.exe
  C:\Windows\System\IZuVWId.exe
  2⤵
  PID:14860
- C:\Windows\System\lWvFeRw.exe
  C:\Windows\System\lWvFeRw.exe
  2⤵
  PID:14904
- C:\Windows\System\QJusaEI.exe
  C:\Windows\System\QJusaEI.exe
  2⤵
  PID:14928
- C:\Windows\System\GxsZZXE.exe
  C:\Windows\System\GxsZZXE.exe
  2⤵
  PID:14964
- C:\Windows\System\jcXniRp.exe
  C:\Windows\System\jcXniRp.exe
  2⤵
  PID:14980
- C:\Windows\System\OYRgmSX.exe
  C:\Windows\System\OYRgmSX.exe
  2⤵
  PID:15012
- C:\Windows\System\uRxpjyz.exe
  C:\Windows\System\uRxpjyz.exe
  2⤵
  PID:15040
- C:\Windows\System\VZCTqzw.exe
  C:\Windows\System\VZCTqzw.exe
  2⤵
  PID:15072
- C:\Windows\System\nYQTwIR.exe
  C:\Windows\System\nYQTwIR.exe
  2⤵
  PID:15096
- C:\Windows\System\cBMMMmc.exe
  C:\Windows\System\cBMMMmc.exe
  2⤵
  PID:15116
- C:\Windows\System\cCtyzcL.exe
  C:\Windows\System\cCtyzcL.exe
  2⤵
  PID:15136
- C:\Windows\System\cSeQFdS.exe
  C:\Windows\System\cSeQFdS.exe
  2⤵
  PID:15164
- C:\Windows\System\mnrzZPX.exe
  C:\Windows\System\mnrzZPX.exe
  2⤵
  PID:15188
- C:\Windows\System\nweMiOr.exe
  C:\Windows\System\nweMiOr.exe
  2⤵
  PID:15216
- C:\Windows\System\FfqJpTg.exe
  C:\Windows\System\FfqJpTg.exe
  2⤵
  PID:15248
- C:\Windows\System\cjhvJqM.exe
  C:\Windows\System\cjhvJqM.exe
  2⤵
  PID:15268
- C:\Windows\System\ueGXZMm.exe
  C:\Windows\System\ueGXZMm.exe
  2⤵
  PID:15296
- C:\Windows\System\Mvsjccz.exe
  C:\Windows\System\Mvsjccz.exe
  2⤵
  PID:15312
- C:\Windows\System\QursLpt.exe
  C:\Windows\System\QursLpt.exe
  2⤵
  PID:15336
- C:\Windows\System\oUydzYr.exe
  C:\Windows\System\oUydzYr.exe
  2⤵
  PID:15356
- C:\Windows\System\VysaWny.exe
  C:\Windows\System\VysaWny.exe
  2⤵
  PID:14240
- C:\Windows\System\rIztBlG.exe
  C:\Windows\System\rIztBlG.exe
  2⤵
  PID:14368
- C:\Windows\System\ruDmwsD.exe
  C:\Windows\System\ruDmwsD.exe
  2⤵
  PID:2540
- C:\Windows\System\WEAXsnr.exe
  C:\Windows\System\WEAXsnr.exe
  2⤵
  PID:14464
- C:\Windows\System\xAUjWwW.exe
  C:\Windows\System\xAUjWwW.exe
  2⤵
  PID:14520
- C:\Windows\System\wLQHpaW.exe
  C:\Windows\System\wLQHpaW.exe
  2⤵
  PID:14604
- C:\Windows\System\VCSWUGG.exe
  C:\Windows\System\VCSWUGG.exe
  2⤵
  PID:14404
- C:\Windows\System\hnRjNen.exe
  C:\Windows\System\hnRjNen.exe
  2⤵
  PID:14564
- C:\Windows\System\LGjdppA.exe
  C:\Windows\System\LGjdppA.exe
  2⤵
  PID:14584
- C:\Windows\System\ScvVqjL.exe
  C:\Windows\System\ScvVqjL.exe
  2⤵
  PID:14684
- C:\Windows\System\uUJoYMr.exe
  C:\Windows\System\uUJoYMr.exe
  2⤵
  PID:14896
- C:\Windows\System\TaoKGlH.exe
  C:\Windows\System\TaoKGlH.exe
  2⤵
  PID:14756
- C:\Windows\System\OoOQBEg.exe
  C:\Windows\System\OoOQBEg.exe
  2⤵
  PID:14648
- C:\Windows\System\iXroPGB.exe
  C:\Windows\System\iXroPGB.exe
  2⤵
  PID:15036
- C:\Windows\System\XKjVDQc.exe
  C:\Windows\System\XKjVDQc.exe
  2⤵
  PID:15092
- C:\Windows\System\QhsRUZL.exe
  C:\Windows\System\QhsRUZL.exe
  2⤵
  PID:15148
- C:\Windows\System\aRPBGHp.exe
  C:\Windows\System\aRPBGHp.exe
  2⤵
  PID:15264
- C:\Windows\System\irUCbJY.exe
  C:\Windows\System\irUCbJY.exe
  2⤵
  PID:15056
- C:\Windows\System\oYJwnlr.exe
  C:\Windows\System\oYJwnlr.exe
  2⤵
  PID:14960
- C:\Windows\System\kobQdDd.exe
  C:\Windows\System\kobQdDd.exe
  2⤵
  PID:15200
- C:\Windows\System\uGksmEi.exe
  C:\Windows\System\uGksmEi.exe
  2⤵
  PID:14992
- C:\Windows\System\tZLrDCD.exe
  C:\Windows\System\tZLrDCD.exe
  2⤵
  PID:14500
- C:\Windows\System\dcfxpAr.exe
  C:\Windows\System\dcfxpAr.exe
  2⤵
  PID:14632
- C:\Windows\System\YgOujlP.exe
  C:\Windows\System\YgOujlP.exe
  2⤵
  PID:15372
- C:\Windows\System\hjNAYqk.exe
  C:\Windows\System\hjNAYqk.exe
  2⤵
  PID:15400
- C:\Windows\System\vwiluhW.exe
  C:\Windows\System\vwiluhW.exe
  2⤵
  PID:15436
- C:\Windows\System\HmKSNmk.exe
  C:\Windows\System\HmKSNmk.exe
  2⤵
  PID:15452
- C:\Windows\System\oOEbxgX.exe
  C:\Windows\System\oOEbxgX.exe
  2⤵
  PID:15476
- C:\Windows\System\QOHJLNv.exe
  C:\Windows\System\QOHJLNv.exe
  2⤵
  PID:15504
- C:\Windows\System\qCJuYAm.exe
  C:\Windows\System\qCJuYAm.exe
  2⤵
  PID:15536
- C:\Windows\System\DanAjVI.exe
  C:\Windows\System\DanAjVI.exe
  2⤵
  PID:15552
- C:\Windows\System\WNOQEUP.exe
  C:\Windows\System\WNOQEUP.exe
  2⤵
  PID:15576
- C:\Windows\System\aytCWdG.exe
  C:\Windows\System\aytCWdG.exe
  2⤵
  PID:15596
- C:\Windows\System\FuDKypO.exe
  C:\Windows\System\FuDKypO.exe
  2⤵
  PID:15620
- C:\Windows\System\igwqnlg.exe
  C:\Windows\System\igwqnlg.exe
  2⤵
  PID:15648
- C:\Windows\System\wBzmxCK.exe
  C:\Windows\System\wBzmxCK.exe
  2⤵
  PID:15676
- C:\Windows\System\IctDtSw.exe
  C:\Windows\System\IctDtSw.exe
  2⤵
  PID:15712
- C:\Windows\System\koqusNs.exe
  C:\Windows\System\koqusNs.exe
  2⤵
  PID:15736
- C:\Windows\System\MGoBuCX.exe
  C:\Windows\System\MGoBuCX.exe
  2⤵
  PID:15756
- C:\Windows\System\xlCSiDB.exe
  C:\Windows\System\xlCSiDB.exe
  2⤵
  PID:15784
- C:\Windows\System\ceqYVWK.exe
  C:\Windows\System\ceqYVWK.exe
  2⤵
  PID:15816
- C:\Windows\System\cgAMDAH.exe
  C:\Windows\System\cgAMDAH.exe
  2⤵
  PID:15844
- C:\Windows\System\QnRfDdB.exe
  C:\Windows\System\QnRfDdB.exe
  2⤵
  PID:15860
- C:\Windows\System\tGrUCjP.exe
  C:\Windows\System\tGrUCjP.exe
  2⤵
  PID:15888
- C:\Windows\System\uauJXMT.exe
  C:\Windows\System\uauJXMT.exe
  2⤵
  PID:15904
- C:\Windows\System\bAgSdxM.exe
  C:\Windows\System\bAgSdxM.exe
  2⤵
  PID:15932
- C:\Windows\System\WXBIHHN.exe
  C:\Windows\System\WXBIHHN.exe
  2⤵
  PID:15960
- C:\Windows\System\StetEZA.exe
  C:\Windows\System\StetEZA.exe
  2⤵
  PID:15980
- C:\Windows\System\OdttsBH.exe
  C:\Windows\System\OdttsBH.exe
  2⤵
  PID:16000
- C:\Windows\System\lsxRAVo.exe
  C:\Windows\System\lsxRAVo.exe
  2⤵
  PID:16024
- C:\Windows\System\GLzvMpU.exe
  C:\Windows\System\GLzvMpU.exe
  2⤵
  PID:16052
- C:\Windows\System\iPFXRjb.exe
  C:\Windows\System\iPFXRjb.exe
  2⤵
  PID:16076
- C:\Windows\System\RlGMABC.exe
  C:\Windows\System\RlGMABC.exe
  2⤵
  PID:16104
- C:\Windows\System\iHHeRPf.exe
  C:\Windows\System\iHHeRPf.exe
  2⤵
  PID:16128
- C:\Windows\System\tmIhiKw.exe
  C:\Windows\System\tmIhiKw.exe
  2⤵
  PID:16156
- C:\Windows\System\SmAlDgO.exe
  C:\Windows\System\SmAlDgO.exe
  2⤵
  PID:16180
- C:\Windows\System\JFlZxGB.exe
  C:\Windows\System\JFlZxGB.exe
  2⤵
  PID:16200
- C:\Windows\System\nJXoLzr.exe
  C:\Windows\System\nJXoLzr.exe
  2⤵
  PID:16220
- C:\Windows\System\EZeOmbm.exe
  C:\Windows\System\EZeOmbm.exe
  2⤵
  PID:16248
- C:\Windows\System\IyhFOeM.exe
  C:\Windows\System\IyhFOeM.exe
  2⤵
  PID:16268
- C:\Windows\System\kmvvTOq.exe
  C:\Windows\System\kmvvTOq.exe
  2⤵
  PID:16296
- C:\Windows\System\NPpPDww.exe
  C:\Windows\System\NPpPDww.exe
  2⤵
  PID:16324
- C:\Windows\System\sIdkkyK.exe
  C:\Windows\System\sIdkkyK.exe
  2⤵
  PID:16344
- C:\Windows\System\KwKazti.exe
  C:\Windows\System\KwKazti.exe
  2⤵
  PID:14844
- C:\Windows\System\mqlrGpT.exe
  C:\Windows\System\mqlrGpT.exe
  2⤵
  PID:15132
- C:\Windows\System\donrPvi.exe
  C:\Windows\System\donrPvi.exe
  2⤵
  PID:14416
- C:\Windows\System\PLhzUfh.exe
  C:\Windows\System\PLhzUfh.exe
  2⤵
  PID:14164
- C:\Windows\System\PFhBoDA.exe
  C:\Windows\System\PFhBoDA.exe
  2⤵
  PID:14196
- C:\Windows\System\UqRZPUW.exe
  C:\Windows\System\UqRZPUW.exe
  2⤵
  PID:15332
- C:\Windows\System\YCbfVDR.exe
  C:\Windows\System\YCbfVDR.exe
  2⤵
  PID:14920
- C:\Windows\System\QtMdptS.exe
  C:\Windows\System\QtMdptS.exe
  2⤵
  PID:14736
- C:\Windows\System\QVatuNY.exe
  C:\Windows\System\QVatuNY.exe
  2⤵
  PID:2608
- C:\Windows\System\QoNLQGm.exe
  C:\Windows\System\QoNLQGm.exe
  2⤵
  PID:15604
- C:\Windows\System\IgwmmSf.exe
  C:\Windows\System\IgwmmSf.exe
  2⤵
  PID:15644
- C:\Windows\System\nDYjcAq.exe
  C:\Windows\System\nDYjcAq.exe
  2⤵
  PID:15444
- C:\Windows\System\WDSbRMz.exe
  C:\Windows\System\WDSbRMz.exe
  2⤵
  PID:15472
- C:\Windows\System\muzNNFI.exe
  C:\Windows\System\muzNNFI.exe
  2⤵
  PID:15804
- C:\Windows\System\soTIwFx.exe
  C:\Windows\System\soTIwFx.exe
  2⤵
  PID:15852
- C:\Windows\System\QeHfAij.exe
  C:\Windows\System\QeHfAij.exe
  2⤵
  PID:15928
- C:\Windows\System\owxZAnj.exe
  C:\Windows\System\owxZAnj.exe
  2⤵
  PID:15996
- C:\Windows\System\PXAcfQX.exe
  C:\Windows\System\PXAcfQX.exe
  2⤵
  PID:15836
- C:\Windows\System\WDLwXxT.exe
  C:\Windows\System\WDLwXxT.exe
  2⤵
  PID:16196
- C:\Windows\System\NWKhpwz.exe
  C:\Windows\System\NWKhpwz.exe
  2⤵
  PID:16240
- C:\Windows\System\wooLpiP.exe
  C:\Windows\System\wooLpiP.exe
  2⤵
  PID:16316
- C:\Windows\System\JHZEuNr.exe
  C:\Windows\System\JHZEuNr.exe
  2⤵
  PID:16360
- C:\Windows\System\iUQjjVk.exe
  C:\Windows\System\iUQjjVk.exe
  2⤵
  PID:12532
- C:\Windows\System\AUlBrKB.exe
  C:\Windows\System\AUlBrKB.exe
  2⤵
  PID:14820
- C:\Windows\System\wdUUESt.exe
  C:\Windows\System\wdUUESt.exe
  2⤵
  PID:15572
- C:\Windows\System\HfMAlwx.exe
  C:\Windows\System\HfMAlwx.exe
  2⤵
  PID:15428
- C:\Windows\System\iSlEwdV.exe
  C:\Windows\System\iSlEwdV.exe
  2⤵
  PID:16412
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16412 -s 220
    3⤵
    PID:17120
- C:\Windows\System\kqulisV.exe
  C:\Windows\System\kqulisV.exe
  2⤵
  PID:16440
- C:\Windows\System\CYMxAaY.exe
  C:\Windows\System\CYMxAaY.exe
  2⤵
  PID:16460
- C:\Windows\System\Jrdqspp.exe
  C:\Windows\System\Jrdqspp.exe
  2⤵
  PID:16492
- C:\Windows\System\rlRxkNb.exe
  C:\Windows\System\rlRxkNb.exe
  2⤵
  PID:16520
- C:\Windows\System\nqLLkBI.exe
  C:\Windows\System\nqLLkBI.exe
  2⤵
  PID:16540
- C:\Windows\System\wJxhRJq.exe
  C:\Windows\System\wJxhRJq.exe
  2⤵
  PID:16564
- C:\Windows\System\AXJYNbo.exe
  C:\Windows\System\AXJYNbo.exe
  2⤵
  PID:16600
- C:\Windows\System\pjLBTMe.exe
  C:\Windows\System\pjLBTMe.exe
  2⤵
  PID:16616
- C:\Windows\System\iEhSsVm.exe
  C:\Windows\System\iEhSsVm.exe
  2⤵
  PID:16648
- C:\Windows\System\AcyjyuK.exe
  C:\Windows\System\AcyjyuK.exe
  2⤵
  PID:16672
- C:\Windows\System\btYEbrY.exe
  C:\Windows\System\btYEbrY.exe
  2⤵
  PID:16696
- C:\Windows\System\aJCcDhQ.exe
  C:\Windows\System\aJCcDhQ.exe
  2⤵
  PID:16720
- C:\Windows\System\BBJkyKg.exe
  C:\Windows\System\BBJkyKg.exe
  2⤵
  PID:16744
- C:\Windows\System\vwreFkw.exe
  C:\Windows\System\vwreFkw.exe
  2⤵
  PID:16768
- C:\Windows\System\MnpsMef.exe
  C:\Windows\System\MnpsMef.exe
  2⤵
  PID:16792
- C:\Windows\System\mvXHUGm.exe
  C:\Windows\System\mvXHUGm.exe
  2⤵
  PID:16808
- C:\Windows\System\MsRAyeJ.exe
  C:\Windows\System\MsRAyeJ.exe
  2⤵
  PID:16836
- C:\Windows\System\hIqagnf.exe
  C:\Windows\System\hIqagnf.exe
  2⤵
  PID:16868
- C:\Windows\System\BFrcnYt.exe
  C:\Windows\System\BFrcnYt.exe
  2⤵
  PID:16900
- C:\Windows\System\mkHGXMM.exe
  C:\Windows\System\mkHGXMM.exe
  2⤵
  PID:16924
- C:\Windows\System\CCrVFZf.exe
  C:\Windows\System\CCrVFZf.exe
  2⤵
  PID:16944
- C:\Windows\System\TrhBcHM.exe
  C:\Windows\System\TrhBcHM.exe
  2⤵
  PID:16972
- C:\Windows\System\EeOhfra.exe
  C:\Windows\System\EeOhfra.exe
  2⤵
  PID:17000
- C:\Windows\System\nXcEjmg.exe
  C:\Windows\System\nXcEjmg.exe
  2⤵
  PID:17028
- C:\Windows\System\usOIRfn.exe
  C:\Windows\System\usOIRfn.exe
  2⤵
  PID:17284
- C:\Windows\System\jLPWnSw.exe
  C:\Windows\System\jLPWnSw.exe
  2⤵
  PID:14976
- C:\Windows\System\GmwZIBr.exe
  C:\Windows\System\GmwZIBr.exe
  2⤵
  PID:15720
- C:\Windows\System\wfwVPLE.exe
  C:\Windows\System\wfwVPLE.exe
  2⤵
  PID:16340
- C:\Windows\System\DIZgUbL.exe
  C:\Windows\System\DIZgUbL.exe
  2⤵
  PID:16552
- C:\Windows\System\pwzAFAh.exe
  C:\Windows\System\pwzAFAh.exe
  2⤵
  PID:15900
- C:\Windows\System\zcSweUT.exe
  C:\Windows\System\zcSweUT.exe
  2⤵
  PID:15420
- C:\Windows\System\tJvRgGB.exe
  C:\Windows\System\tJvRgGB.exe
  2⤵
  PID:15896
- C:\Windows\System\IkRCtgG.exe
  C:\Windows\System\IkRCtgG.exe
  2⤵
  PID:16452
- C:\Windows\System\HhuIRDD.exe
  C:\Windows\System\HhuIRDD.exe
  2⤵
  PID:16484
- C:\Windows\System\SbaNWme.exe
  C:\Windows\System\SbaNWme.exe
  2⤵
  PID:17276

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 3192 -i 3192 -h 512 -j 516 -s 632 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:15780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CGmOUKx.exe

Filesize
1.6MB

MD5
b21ca6bf4d4fa2a39475f224082d3ed1

SHA1
774bc5d8fe8c3f66f9fd1a9aafdaeb96463befae

SHA256
beb305bbc1b8081f30fa8e31aa4e90597772a94ddfb14ef2f00450943e45f0b8

SHA512
2a63f22ab9e8cf0a6ce3e40f1b085382fdf04a7e9dd2a1876a5af796cdc257535e5de89ac76c2864046de7055cf65c8ff36a10010350746e9a5abcb0b613dde7

Download Submit
C:\Windows\System\CTAdwHE.exe

Filesize
1.6MB

MD5
f3ed38aeac2dd295fd7a98f5e9574e3b

SHA1
0970d43c9576e6b1577512f08e1c3f4427348768

SHA256
1d3f3be0f80a7f42a61813610827322d3b188ca6b8cb6d9bbc25afb09d9e0f81

SHA512
6a27588f1012f37e9a4f25d0661c7a20a6b64e145364db14c5abff90f50d9c5e704cbfc799fa94746a94e763ff8db6a9bf9fb9c1cac126ed0c0d66381062d070

Download Submit
C:\Windows\System\DyriRYk.exe

Filesize
1.6MB

MD5
8b6519867e9d0586d37852569850ae94

SHA1
7486092336fadd9c8f178c2df3748da91076d63c

SHA256
ee31242dc21320e1aae1225fe6bf132aabdf1834b288048b75e4fecae513b010

SHA512
f0be0f75d9b18ac211a100b66ed03204a451fdd64adfbdcbe5175710e7297dfe0bea82d19ae4c54480aaab0310489844990f23d0fdb0aa3881a5de21bfaf8e80

Download Submit
C:\Windows\System\GxTDZFR.exe

Filesize
1.6MB

MD5
6a6f6727901145c9edca802172fb7e61

SHA1
52b9f6c5df2a8396edaa1d300130ce72df13f2f7

SHA256
a9937bf8c4289e68f5c7eb45e25308462a46f5cc3ce2b5248c190346c5c93205

SHA512
3ec42c3e8e212c54c7f4e8f1a034d7a2c4bed91595bfd7d80ade5454c61b393d6001fc52c56e6bdc203d8327133d85e362781cf387a8213da6b7dae6581dc5b4

Download Submit
C:\Windows\System\HxkRHiN.exe

Filesize
1.6MB

MD5
fb8e3a03d608b8c54d4a112394d81012

SHA1
a7f2de4b33256f58049b599c1e8739ddc662482b

SHA256
4a4899d0e65a7c26705c49e672eb16be743e405663ec33acdaa08cf11b4c1fc5

SHA512
2e4db4bb15b838a2b86892036434c1c1468f4ee5293bc584091ac10dcfe6186cc045ba3c52d703eabbb63f2d61a4da791955a424e0829db3f0ceda873a5fe166

Download Submit
C:\Windows\System\LNgMkjW.exe

Filesize
1.6MB

MD5
5f28e92c3079b2e0c02efcce37bddd9a

SHA1
16880c3efe166235299d43a7410b33e765ca8170

SHA256
11b231d2baed1814c9eb0318fc86331ee2a7f5943a0c59aeec5ffa83ebb9d142

SHA512
4ce2f885b16cf6ab473912ce4b62b1e33d03ab3b51033527dd0ffa8ba187d854d67eed5922fbb7f33f7adfd4602773d1325003df078313770409e64bf0397a45

Download Submit
C:\Windows\System\LcpcUAN.exe

Filesize
1.6MB

MD5
6b3285408a6a25162c8619c4dd2282bc

SHA1
4b93c0efce9060b64e3b6e2aa6bf1888fd531bf7

SHA256
98aa7114c8a4ae7e2290e29ae6dd601f155e16e954123f2dbdfc30bfdc7295d8

SHA512
3ff34ef3f4c53007bb0f9b4673e0fe80f985b1c783858578cbdb2ca02ff8ffc759ff9bf1eca6c21d3ada772da7eba643eb9eedbfa4b3d4b25f4a76d7e1726953

Download Submit
C:\Windows\System\OPGCMrK.exe

Filesize
1.6MB

MD5
1c46c5ef0f861df7fa3a8d7a000bf86f

SHA1
9c0caa9f29e567b74f788b894c8e3c52094b8023

SHA256
dce54bbfd2359dbfdf96e8fcc8d78bd6f72918878ce52d272dde2683be187bdc

SHA512
5f6f4155a2e60d93900635a1efa5f1b1dbe62ff63e6791bedaaa29d2115246ee6160cdcd6343f6daaf3547037c9e3b24435c862aa9dd75be95388ddc608cd4aa

Download Submit
C:\Windows\System\QEuRalc.exe

Filesize
1.6MB

MD5
35f5930bd4b641d73fe7beae5baa6f1e

SHA1
82df7dc64d2fac2c07402b47393d135a7515f4c7

SHA256
6fb060600d7a1bf0c4812c0b326adfd7fef0e51d81db06a1e81f570c43b68ee0

SHA512
cd6bc911d050a37a409eed5e1f6b60863cba00fce6c63d3e897e56e5823372a08be10f3da251a6adf515f3b150b72ccc532d0a0d0a006607fe7a351d3055531f

Download Submit
C:\Windows\System\STUoarv.exe

Filesize
1.6MB

MD5
fb12004821cce3a5d7e4ee35285d3edd

SHA1
3abc17759135453be38a0fdaa6cf125d63d9fd47

SHA256
9c7526896b581607b802b77cba2cf72f13af8bdedcd400da9347cd3e363d5426

SHA512
2213a3708ce4f569c409e74ca81b6f9c0f25624334989f3ce7841540e1b550e1b2b78723ed42cf3fac934243a4d0906288156d3ccbf4fdcecdf2dc76848734fd

Download Submit
C:\Windows\System\SWxPzVx.exe

Filesize
1.6MB

MD5
ab12fa2242511662b53dc93f4a5269e6

SHA1
9828b8025c7a5a29cc2b326b221e1c282e755c99

SHA256
c875d12e2d26488fd34df9dd510e8ef35e81aabfb1cc56650a52666cf67a0d9a

SHA512
3a2c63d53cca307aa304bb88ee275beda6a2a4047e0837ee9d086d2393fc7085161f18e377d358b5940ebb8f0ead12e960ee510ab63581c95ac0938a6c1dd997

Download Submit
C:\Windows\System\UBrIqrv.exe

Filesize
1.6MB

MD5
1594f49c0a9aa53d146418ad4403b87f

SHA1
2df26c94fb23f589e38adb83314cb4bb66c92895

SHA256
837471ca10929ef96d1521f90583c306a6979644dc57aedebae90244ae689cbc

SHA512
577d559f49ebda4f2bf7aea002d417753863112094f8051d4b5d3e52a6b6737eb22ccd96f0c623cfef449bd85e58bd75ded6d3e8689c75a8fcc593ab6d2691d5

Download Submit
C:\Windows\System\UWXFyUi.exe

Filesize
1.6MB

MD5
dc0f2ff71daaced03a79cf0da35595a1

SHA1
35d451f7f4493c0f1af7be9c985668383d9f3dea

SHA256
5e272d4a0e97954b61795cf5a2a29916b1e191e3cf43ca23d17a2d239e29f85d

SHA512
706ca2c3d5a7e7f42c5efa51fe0dc65cd712a7d30fcc241745c0528d01651b5ef9550c0a21261ca5c6e3ca12aa5135f4996b8d9f536739877ab296b1891bca3f

Download Submit
C:\Windows\System\VCJmRAZ.exe

Filesize
1.6MB

MD5
a37637aa63a718f672e6c3e1253d6672

SHA1
f43ed5962c6213185c433330e1685849adf6b171

SHA256
fa15fc58e569ecf5534f8f4ee0635771e3e26b4e5deb0a067d9f041429e2590a

SHA512
c8019d356f6b104bd0e8569f8c094b92b8922dd9d15418c5eedeaab9d1ca950ac702fb34c597a149ac9fa10066c88752412c4ba149b304e691653842f8fa6fd5

Download Submit
C:\Windows\System\XOncDNE.exe

Filesize
1.6MB

MD5
6618041446f0474103c5001d1d61a10b

SHA1
4f493a646b4dc015d1de94757122b3e6702d9852

SHA256
cdc1fcaee1ce72fc2ed06a01eefb95eae1206d55ad933dabb802a3920a3fcb25

SHA512
794d894dcb5090f2ff622935261530e5f0dcf2f0f306c229808cef83d67013132528dbde86a0cbddff9abb424331292f34558b6d5f85a4d92c6de326a980a8b2

Download Submit
C:\Windows\System\XzkWZBP.exe

Filesize
1.6MB

MD5
937f49d5552f61d070ca56e4516470b8

SHA1
97c979f04662a8403db83a3b113bc6d8ad30804f

SHA256
8f66805209e07eae43df97db7bdeebc18f7248fe357116b7ccd2d5b2754fc72b

SHA512
f47f056f456b3b7381828e8369c120d0d6f6509b329ee2e2f8efc4ed01633d6ae4db0f93ef61eee886c2eb4641b48102c62d5d3cc92304b756e453bcadc919a6

Download Submit
C:\Windows\System\azFyETj.exe

Filesize
1.6MB

MD5
4725f13d3fbebb8c023ac70e1d1e63c3

SHA1
ad92484e343833145ebf5aed0efc6f690e0c77ff

SHA256
07837a0b009dcf90d7b016c5734caedc457b12ac0c121f33999c7b94e5201914

SHA512
0f8ceb7d1f47805ecc76f4951bb4a59f38c44a56c4413f338abf5810a5a9ad9da9747a40743174c8b2694d022904aa0909b095bdcbd74727e9370cdd32b24690

Download Submit
C:\Windows\System\evdCaEN.exe

Filesize
1.6MB

MD5
d6b5ef3a7f1de7bb9ae802f10478aef2

SHA1
f0c65d09fc94df4637d4c450b0897362cd5ce436

SHA256
bc46abd804b9558780089a56784f19999252f76077120df5c2ecf421d4237229

SHA512
1ea2e9f2e58e44a2b5a5f1f3454c55fbf2a9b3b5e46d4ab1f498be4d27dc2ea97a56f9fc39fd51400895a0119a50d44905836164473cf388db27a4ce5d3634dd

Download Submit
C:\Windows\System\fFabQlj.exe

Filesize
1.6MB

MD5
8437b872dc14e6e2cf963409e8a7bd98

SHA1
7d37dbb1700577f9ffb84f6a7864e9ad6f95de47

SHA256
a9e4b5b7401eb68dda03dda59dd1b93bbff8b554710de2a92a0c9a00cf6f25a5

SHA512
234260251ae4f0ed0ec87258c3c65875e026fca57df478984c6a7ae39eabcede83326e67fc65aa63aecafa7ea57b547c78f5ea7540521306e572d24ff366b02e

Download Submit
C:\Windows\System\fbzTIcE.exe

Filesize
1.6MB

MD5
fe9c6b4a17aec2bbaa392b0dee606f18

SHA1
6adc2a5aa463ba64f87751b0f91f7f8f8db985a1

SHA256
87805f32e5ac66c539d6b82cd1524195d4790c4574f9b29045128e0c2a65c334

SHA512
55f3d211e139875057617ec1f5d9574a40d62e8decfec22ebb9e8bc21739ec91206cde65cd396ae476e61f1825bff8ce71a9842a07d237d6da42527d5e8f3329

Download Submit
C:\Windows\System\hEeWRoL.exe

Filesize
1.6MB

MD5
e2edb6eb7c9aa69b82c5a86157273e32

SHA1
e7996aa68a333d425190ce5cba694612d34f2379

SHA256
df2701da2decf8d8ac554a745bf30f2ce42ed6d4fe543b21e40f30655badfcfa

SHA512
2f277bf45c1970d351dc885c5a26064d421b5218a5802340b89fa8a583dbb37a3437b59f682ceb5c82f7d9130a6dc277cfa845f2a772d0c4402227f7c335564b

Download Submit
C:\Windows\System\iyGYExX.exe

Filesize
1.6MB

MD5
e590626bff1364762e0f9f597b3a8278

SHA1
18767ece4d83ecce85e876bdcb4b7a58abff7e70

SHA256
5e7efd6fd518a8dc1c4714c7cdeb54bf7414afc08d03cad4b3ac4a4466dc5f89

SHA512
f664abc7e1dbd31eb8b645fda837bcca44a0e4925b2eeedc9f0675309c1ba7f1bebffe7e17c371e51d05af125c9d03f31ab2d1df7db9277aba34359100b6308e

Download Submit
C:\Windows\System\kisrtNZ.exe

Filesize
1.6MB

MD5
b75d22906396bc9752a83acc57ec3bc6

SHA1
cb24ba0a13450b180bd9697c8a68a562b7b6cee2

SHA256
012806d5a570ecd28e99bc3a88555155a26c0d97affc70183e333734372f26d8

SHA512
eef45aa1ee1ba7e1fe3e2cb759a69007c0ad271869e736330bfd7c753f746b129231c1cff620acb42ab870ed9737ae3b816ff72e3c13f548d2ff4f9c3411221f

Download Submit
C:\Windows\System\kjegIJQ.exe

Filesize
1.6MB

MD5
326d441ae5724ae616acd4fea3444a97

SHA1
ebc4342d150c1c7ed1841d935a751c2cf08c996e

SHA256
7e3cf56403362a939268b9ed20ff54f450ddfd60e818a3a9bf488120bbedbdb0

SHA512
8b69af80a5f5dab1ca31df93c6a11461158d341c02c173b6f4bb1933020565034415b803f563da6f6b046f9242d9df70bc7fb3ed3de62dbf90665da583e0eb61

Download Submit
C:\Windows\System\lPwofiX.exe

Filesize
1.6MB

MD5
a739ea9eadc1476c630f129ad17d3cb5

SHA1
5bbf3955d799ccd3562bd8e168a3cb185bf1fec5

SHA256
28f704335265b34950bfc098924431e4044d2bb3491ec143fcdc51bbfc97ac84

SHA512
eee33e6a65947b4f0914766e4c3ba6c5f86e28b60382f0d8c9eabfa3530d42c577bd221c81b3e7a7504df67bd7c2a4372210f659d5f76f795a881124babbdb73

Download Submit
C:\Windows\System\lYknNEX.exe

Filesize
1.6MB

MD5
4fc9d0e8c3f3892c734b06aeb6bcf9ae

SHA1
e1480243a9476d464e832ca43e1e4dc8a2944661

SHA256
cb8b5ea258fdbfdc030cadad02d98ad8b2ca213be09648a044af8d2c82198303

SHA512
c2e384e9b04df45afa840a39f0c12facf15a23d4211690b99dbbf02cba7e1a7765e3c7cab35500d9937115de60dde214d45c82b42756c020d583249921a3415c

Download Submit
C:\Windows\System\qtLCLFf.exe

Filesize
1.6MB

MD5
48244018bfb056001a4cc66b130567f8

SHA1
dd7d735684417bafacb2f1906be04970c704c8e4

SHA256
9822817977f435daae3d49a8f3ea6201be846c44dc8d49d4740f74e258a6cadc

SHA512
68d09f5a1c2319571c1ae7e163d9a71ea38a0f2774589e0bbfa53f3e818642c739e5d5ac232ff2577e2e347e8e61da22429fb87e494657c1d62db9c56ae9a917

Download Submit
C:\Windows\System\rXwHSJt.exe

Filesize
1.6MB

MD5
b848365b89e84e40c088a04613119558

SHA1
2a52751879539cdd811fd365bbd858316f6f3a87

SHA256
09a27116959ec52bead25d1e7bf66fd5477c4d2fac4a55c7012c97c5aea1c2ad

SHA512
b3fbf7849196bee905e96bdd104f9041e935650219b21da46ca36eb0dddcabd585d48652ed918264abe2b575762a5a149d0a92df8965b837b3cc4f109fd15fb5

Download Submit
C:\Windows\System\tUavydi.exe

Filesize
1.6MB

MD5
0132776ff5e5743c77fa85053449f4a7

SHA1
8245c7cece43f527260d60362f558eee465faf1c

SHA256
e39ac6d68e1dda53a68fb1ab812c8222c8a6f9cf87dc2d0d1fb544c866912b2b

SHA512
e912fbfa22baa4876f1aac53678bf772c4f676b3071ce9aac7aa838039dea09ce9fe07d0c98c4fde4751db5338ea74b98344035fbdf39822754e2c4da22afa3d

Download Submit
C:\Windows\System\xGfLAKP.exe

Filesize
1.6MB

MD5
d79732bfe805570f0cd9124258eeca1e

SHA1
1f54abc01613360dd4574c400d25d0792055dc42

SHA256
abccd0f2ecef36adac426707827a919209fac38c43e15ac82ff87ce70724f01e

SHA512
6f654a50e6125a98716c981e3cea0fce284195f7f75474dfc04a39f8be38998f97f9c8451a0b3e435ab00f5bb8c825bbc5e8b512c5c2550dfda89e0e383e3bcf

Download Submit
C:\Windows\System\xSHNJfk.exe

Filesize
1.6MB

MD5
3537aba57048335b9e1137812f3fd570

SHA1
e286dd841212378357e555dd46d8a596593a778e

SHA256
2178a85a4f88f67542e1c608524a9a96a76855735558ec2a66c48c9bdef9f4ac

SHA512
232b8fbe78811234fb4539e6e5c710b38d7b60538ed0abdc23ac2599332f0a3c213099de473982a9cc2dd6de1c40f43f7bba10aa5b16e448fe574017f941095f

Download Submit
C:\Windows\System\zxKGJFK.exe

Filesize
1.6MB

MD5
51944b249157b702e3e698d6aa8369a1

SHA1
91cb12f7c7055f1ef726f9e6a0c74b8797fe3244

SHA256
c50339526485400731540fb35fd9c7e50f57dc029230c8663f0174c8eee86da6

SHA512
9c03090626ac6a955efeccd500d228572f0fd8cc0b5c2f8748f9e58fdd6e35baa50bb1cf42b75d6eed18a7cee97e5c737f6486d6bf67ff4b29f3026acd8296ab

Download Submit
memory/3264-0-0x00000179363B0000-0x00000179363C0000-memory.dmp

Filesize
64KB

Download