xmrig | bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778

Analysis

max time kernel
121s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
Size

1.5MB
MD5

17fdb6994efdf5c6c98fa2bb98d94b4d
SHA1

0e90668269b4f1d51278c2f80605a611d30fb2e9
SHA256

bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778
SHA512

0a2b498cb569b7ab41e082bdc997fc7731b889bb59c612fef8c2e6d2aab856b168ccde19a52cd1ea6f574a3734e431ffb646eb09a041368c84e403e78d09658c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYeJfWMu3:GemTLkNdfE0pZyk

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 15236 created 4356	15236	WerFaultSecure.exe	80

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023ca3-4.dat	xmrig
behavioral2/files/0x0007000000023ca7-8.dat	xmrig
behavioral2/files/0x0007000000023ca8-9.dat	xmrig
behavioral2/files/0x0007000000023ca9-20.dat	xmrig
behavioral2/files/0x0007000000023caa-21.dat	xmrig
behavioral2/files/0x0007000000023cad-36.dat	xmrig
behavioral2/files/0x0007000000023caf-40.dat	xmrig
behavioral2/files/0x0007000000023cb1-48.dat	xmrig
behavioral2/files/0x0007000000023cb4-60.dat	xmrig
behavioral2/files/0x0007000000023cb7-72.dat	xmrig
behavioral2/files/0x0007000000023cbb-89.dat	xmrig
behavioral2/files/0x0007000000023cbf-109.dat	xmrig
behavioral2/files/0x0007000000023cc6-132.dat	xmrig
behavioral2/files/0x0007000000023cc5-129.dat	xmrig
behavioral2/files/0x0007000000023cc4-128.dat	xmrig
behavioral2/files/0x0007000000023cc3-125.dat	xmrig
behavioral2/files/0x0007000000023cc2-120.dat	xmrig
behavioral2/files/0x0007000000023cc1-117.dat	xmrig
behavioral2/files/0x0007000000023cc0-112.dat	xmrig
behavioral2/files/0x0007000000023cbe-104.dat	xmrig
behavioral2/files/0x0007000000023cbd-101.dat	xmrig
behavioral2/files/0x0007000000023cbc-96.dat	xmrig
behavioral2/files/0x0007000000023cba-88.dat	xmrig
behavioral2/files/0x0007000000023cb9-85.dat	xmrig
behavioral2/files/0x0007000000023cb8-80.dat	xmrig
behavioral2/files/0x0007000000023cb6-73.dat	xmrig
behavioral2/files/0x0007000000023cb5-68.dat	xmrig
behavioral2/files/0x0007000000023cb3-61.dat	xmrig
behavioral2/files/0x0007000000023cb2-59.dat	xmrig
behavioral2/files/0x0007000000023cb0-51.dat	xmrig
behavioral2/files/0x0007000000023cae-43.dat	xmrig
behavioral2/files/0x0007000000023cac-33.dat	xmrig
behavioral2/files/0x0007000000023cab-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1448	zxOsAHr.exe
4012	QEKXZIH.exe
2424	HMKxkZr.exe
4076	WzmnpRj.exe
5064	ltwUSqo.exe
1912	aipWpVW.exe
3484	xQchsxH.exe
1944	lbyUVpg.exe
3364	ahTOjzY.exe
824	rdPoNUM.exe
1272	jCuBeJq.exe
1460	uUZiXdD.exe
716	CFTwJzM.exe
764	dMolUvA.exe
1016	tzKPqik.exe
1072	KgcBHdz.exe
3888	GnhoIhe.exe
388	XRRyjbR.exe
3008	sNbmbKz.exe
2296	PlfMsow.exe
5052	ryZnYGj.exe
1336	fcvBtTJ.exe
3700	QENKjxA.exe
4368	coEUyYn.exe
4612	UBIjjNx.exe
4516	epUBBBk.exe
3004	eCteQqv.exe
2488	nqCCGzS.exe
1232	DQyBLOU.exe
3328	rIgHVMo.exe
1828	ZDwnqbz.exe
3660	gVEvYQO.exe
3592	zrJJJTH.exe
2568	EueeQRQ.exe
1172	orOgRxU.exe
1308	gkVXJdi.exe
1216	bkzornC.exe
4868	pAtTaYF.exe
1800	ufZNPOq.exe
1480	ewaIBop.exe
2436	gRoLMBp.exe
1868	zjsjwXv.exe
2044	AQqJWUA.exe
628	zFlisPG.exe
2696	jnERAcF.exe
2640	ONCAoAQ.exe
2840	elEdaRD.exe
2680	JYxKtpZ.exe
1980	jkrDcHH.exe
3124	TQBCBzc.exe
1240	lhxQkef.exe
732	PWeeWtJ.exe
2272	AjxbHlK.exe
2476	zwCUCTN.exe
2580	uASxSxM.exe
4608	ZGgVeyO.exe
2900	dJbqqse.exe
2196	FxwJhIg.exe
4940	pZhjGpN.exe
2192	LOgIhvA.exe
544	LiIrZrn.exe
4548	xieimZm.exe
2316	ycZLqMC.exe
640	mztPEdC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\epUBBBk.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\eBAkIBZ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\kyUptfl.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\orOgRxU.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\EblBRyt.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\FIOygOy.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\vRfvffr.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\XzWGOYZ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\IwgzBrf.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ailehTr.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\wLZskim.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\skYXMLJ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\dkXPqbU.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\QZKqxzK.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\hRSXNGK.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\Gsqcudh.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\qUVKsAa.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\SdkChEC.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\dWGTmHG.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\cKKJipz.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\etGzlpN.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\TKxvlJS.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\vELtAHh.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\mTuHjxI.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\emzxjUW.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\iWnPKRT.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ryzMCgb.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\tjhdOkm.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ElWzsZI.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\oIJGbUQ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\zHEOXDf.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\QeSEJSZ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ZPFffMQ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\KRHlmxr.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\rOQbZdg.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\QZtmtuB.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\qgdkyDP.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\qjEycVV.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\aZRanYT.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\YHhXXKI.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\YuwMiJX.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\KmushhH.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\uUZiXdD.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\VqIqFjr.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\EkBzXPu.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\EzUEEcW.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\BtULgRk.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\uKMUakp.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ksuXfkB.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ADCTxyZ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\sNbmbKz.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\KKLcASU.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\QYxAXYc.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\XMZUDjo.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\eivZBfG.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\TPjNuZJ.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\ufxGhSy.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\KVgtmLu.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\gUSSyhV.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\XaTmMfA.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\wAFQkak.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\NeGbZAd.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\pMBpSYT.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
File created	C:\Windows\System\LDqKUaf.exe	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
14392	WerFaultSecure.exe
14392	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1448	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	84
PID 2228 wrote to memory of 1448	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	84
PID 2228 wrote to memory of 4012	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	85
PID 2228 wrote to memory of 4012	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	85
PID 2228 wrote to memory of 2424	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	86
PID 2228 wrote to memory of 2424	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	86
PID 2228 wrote to memory of 4076	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	87
PID 2228 wrote to memory of 4076	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	87
PID 2228 wrote to memory of 5064	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	88
PID 2228 wrote to memory of 5064	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	88
PID 2228 wrote to memory of 1912	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	89
PID 2228 wrote to memory of 1912	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	89
PID 2228 wrote to memory of 3484	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	90
PID 2228 wrote to memory of 3484	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	90
PID 2228 wrote to memory of 1944	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	91
PID 2228 wrote to memory of 1944	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	91
PID 2228 wrote to memory of 3364	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	92
PID 2228 wrote to memory of 3364	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	92
PID 2228 wrote to memory of 824	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	93
PID 2228 wrote to memory of 824	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	93
PID 2228 wrote to memory of 1272	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	94
PID 2228 wrote to memory of 1272	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	94
PID 2228 wrote to memory of 1460	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	95
PID 2228 wrote to memory of 1460	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	95
PID 2228 wrote to memory of 716	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	96
PID 2228 wrote to memory of 716	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	96
PID 2228 wrote to memory of 764	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	97
PID 2228 wrote to memory of 764	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	97
PID 2228 wrote to memory of 1016	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	98
PID 2228 wrote to memory of 1016	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	98
PID 2228 wrote to memory of 1072	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	99
PID 2228 wrote to memory of 1072	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	99
PID 2228 wrote to memory of 3888	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	100
PID 2228 wrote to memory of 3888	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	100
PID 2228 wrote to memory of 388	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	101
PID 2228 wrote to memory of 388	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	101
PID 2228 wrote to memory of 3008	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	102
PID 2228 wrote to memory of 3008	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	102
PID 2228 wrote to memory of 2296	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	103
PID 2228 wrote to memory of 2296	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	103
PID 2228 wrote to memory of 5052	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	104
PID 2228 wrote to memory of 5052	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	104
PID 2228 wrote to memory of 1336	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	105
PID 2228 wrote to memory of 1336	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	105
PID 2228 wrote to memory of 3700	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	106
PID 2228 wrote to memory of 3700	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	106
PID 2228 wrote to memory of 4368	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	107
PID 2228 wrote to memory of 4368	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	107
PID 2228 wrote to memory of 4612	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	108
PID 2228 wrote to memory of 4612	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	108
PID 2228 wrote to memory of 4516	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	109
PID 2228 wrote to memory of 4516	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	109
PID 2228 wrote to memory of 3004	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	110
PID 2228 wrote to memory of 3004	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	110
PID 2228 wrote to memory of 2488	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	111
PID 2228 wrote to memory of 2488	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	111
PID 2228 wrote to memory of 1232	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	112
PID 2228 wrote to memory of 1232	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	112
PID 2228 wrote to memory of 3328	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	113
PID 2228 wrote to memory of 3328	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	113
PID 2228 wrote to memory of 1828	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	114
PID 2228 wrote to memory of 1828	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	114
PID 2228 wrote to memory of 3660	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	115
PID 2228 wrote to memory of 3660	2228	bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe	115

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:4356
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 4356 -s 920
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:14392

C:\Users\Admin\AppData\Local\Temp\bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe
"C:\Users\Admin\AppData\Local\Temp\bce4188127a8be6fd55f45a3631e9834dc6649cc79f2af1f0ec01d934fa54778.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System\zxOsAHr.exe
  C:\Windows\System\zxOsAHr.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\QEKXZIH.exe
  C:\Windows\System\QEKXZIH.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\HMKxkZr.exe
  C:\Windows\System\HMKxkZr.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\WzmnpRj.exe
  C:\Windows\System\WzmnpRj.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\ltwUSqo.exe
  C:\Windows\System\ltwUSqo.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\aipWpVW.exe
  C:\Windows\System\aipWpVW.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\xQchsxH.exe
  C:\Windows\System\xQchsxH.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\lbyUVpg.exe
  C:\Windows\System\lbyUVpg.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\ahTOjzY.exe
  C:\Windows\System\ahTOjzY.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\rdPoNUM.exe
  C:\Windows\System\rdPoNUM.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\jCuBeJq.exe
  C:\Windows\System\jCuBeJq.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\uUZiXdD.exe
  C:\Windows\System\uUZiXdD.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\CFTwJzM.exe
  C:\Windows\System\CFTwJzM.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\dMolUvA.exe
  C:\Windows\System\dMolUvA.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\tzKPqik.exe
  C:\Windows\System\tzKPqik.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\KgcBHdz.exe
  C:\Windows\System\KgcBHdz.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\GnhoIhe.exe
  C:\Windows\System\GnhoIhe.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\XRRyjbR.exe
  C:\Windows\System\XRRyjbR.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\sNbmbKz.exe
  C:\Windows\System\sNbmbKz.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\PlfMsow.exe
  C:\Windows\System\PlfMsow.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ryZnYGj.exe
  C:\Windows\System\ryZnYGj.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\fcvBtTJ.exe
  C:\Windows\System\fcvBtTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\QENKjxA.exe
  C:\Windows\System\QENKjxA.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\coEUyYn.exe
  C:\Windows\System\coEUyYn.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\UBIjjNx.exe
  C:\Windows\System\UBIjjNx.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\epUBBBk.exe
  C:\Windows\System\epUBBBk.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\eCteQqv.exe
  C:\Windows\System\eCteQqv.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\nqCCGzS.exe
  C:\Windows\System\nqCCGzS.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\DQyBLOU.exe
  C:\Windows\System\DQyBLOU.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\rIgHVMo.exe
  C:\Windows\System\rIgHVMo.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\ZDwnqbz.exe
  C:\Windows\System\ZDwnqbz.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\gVEvYQO.exe
  C:\Windows\System\gVEvYQO.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\zrJJJTH.exe
  C:\Windows\System\zrJJJTH.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\EueeQRQ.exe
  C:\Windows\System\EueeQRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\orOgRxU.exe
  C:\Windows\System\orOgRxU.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\gkVXJdi.exe
  C:\Windows\System\gkVXJdi.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\bkzornC.exe
  C:\Windows\System\bkzornC.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\pAtTaYF.exe
  C:\Windows\System\pAtTaYF.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\ufZNPOq.exe
  C:\Windows\System\ufZNPOq.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\ewaIBop.exe
  C:\Windows\System\ewaIBop.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\gRoLMBp.exe
  C:\Windows\System\gRoLMBp.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\zjsjwXv.exe
  C:\Windows\System\zjsjwXv.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\AQqJWUA.exe
  C:\Windows\System\AQqJWUA.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\zFlisPG.exe
  C:\Windows\System\zFlisPG.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\jnERAcF.exe
  C:\Windows\System\jnERAcF.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ONCAoAQ.exe
  C:\Windows\System\ONCAoAQ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\elEdaRD.exe
  C:\Windows\System\elEdaRD.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\JYxKtpZ.exe
  C:\Windows\System\JYxKtpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\jkrDcHH.exe
  C:\Windows\System\jkrDcHH.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\TQBCBzc.exe
  C:\Windows\System\TQBCBzc.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\lhxQkef.exe
  C:\Windows\System\lhxQkef.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\PWeeWtJ.exe
  C:\Windows\System\PWeeWtJ.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\AjxbHlK.exe
  C:\Windows\System\AjxbHlK.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\zwCUCTN.exe
  C:\Windows\System\zwCUCTN.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\uASxSxM.exe
  C:\Windows\System\uASxSxM.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ZGgVeyO.exe
  C:\Windows\System\ZGgVeyO.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\dJbqqse.exe
  C:\Windows\System\dJbqqse.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\FxwJhIg.exe
  C:\Windows\System\FxwJhIg.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\pZhjGpN.exe
  C:\Windows\System\pZhjGpN.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\LOgIhvA.exe
  C:\Windows\System\LOgIhvA.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\LiIrZrn.exe
  C:\Windows\System\LiIrZrn.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\xieimZm.exe
  C:\Windows\System\xieimZm.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\ycZLqMC.exe
  C:\Windows\System\ycZLqMC.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\mztPEdC.exe
  C:\Windows\System\mztPEdC.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\VUgqibi.exe
  C:\Windows\System\VUgqibi.exe
  2⤵
  PID:4632
- C:\Windows\System\FCsMGFi.exe
  C:\Windows\System\FCsMGFi.exe
  2⤵
  PID:216
- C:\Windows\System\tdkoskW.exe
  C:\Windows\System\tdkoskW.exe
  2⤵
  PID:1100
- C:\Windows\System\dkXPqbU.exe
  C:\Windows\System\dkXPqbU.exe
  2⤵
  PID:2372
- C:\Windows\System\IwgzBrf.exe
  C:\Windows\System\IwgzBrf.exe
  2⤵
  PID:1740
- C:\Windows\System\qcJhvSL.exe
  C:\Windows\System\qcJhvSL.exe
  2⤵
  PID:4760
- C:\Windows\System\LrRntQS.exe
  C:\Windows\System\LrRntQS.exe
  2⤵
  PID:2068
- C:\Windows\System\GieaiRM.exe
  C:\Windows\System\GieaiRM.exe
  2⤵
  PID:1464
- C:\Windows\System\FReByWP.exe
  C:\Windows\System\FReByWP.exe
  2⤵
  PID:4320
- C:\Windows\System\MuBDSTk.exe
  C:\Windows\System\MuBDSTk.exe
  2⤵
  PID:1544
- C:\Windows\System\gPkPVvV.exe
  C:\Windows\System\gPkPVvV.exe
  2⤵
  PID:848
- C:\Windows\System\qDHpkob.exe
  C:\Windows\System\qDHpkob.exe
  2⤵
  PID:2676
- C:\Windows\System\jLdtemX.exe
  C:\Windows\System\jLdtemX.exe
  2⤵
  PID:3092
- C:\Windows\System\NNVUeVI.exe
  C:\Windows\System\NNVUeVI.exe
  2⤵
  PID:4052
- C:\Windows\System\XszpBSt.exe
  C:\Windows\System\XszpBSt.exe
  2⤵
  PID:3140
- C:\Windows\System\tZZwWSB.exe
  C:\Windows\System\tZZwWSB.exe
  2⤵
  PID:2388
- C:\Windows\System\DeDnbWV.exe
  C:\Windows\System\DeDnbWV.exe
  2⤵
  PID:4828
- C:\Windows\System\RLuwsFC.exe
  C:\Windows\System\RLuwsFC.exe
  2⤵
  PID:2536
- C:\Windows\System\FbTlNoW.exe
  C:\Windows\System\FbTlNoW.exe
  2⤵
  PID:3400
- C:\Windows\System\CADehkf.exe
  C:\Windows\System\CADehkf.exe
  2⤵
  PID:4220
- C:\Windows\System\akzHaYL.exe
  C:\Windows\System\akzHaYL.exe
  2⤵
  PID:4784
- C:\Windows\System\apHZdYR.exe
  C:\Windows\System\apHZdYR.exe
  2⤵
  PID:2700
- C:\Windows\System\rfAiGOg.exe
  C:\Windows\System\rfAiGOg.exe
  2⤵
  PID:2704
- C:\Windows\System\SjXvYcJ.exe
  C:\Windows\System\SjXvYcJ.exe
  2⤵
  PID:1932
- C:\Windows\System\LmSEQWU.exe
  C:\Windows\System\LmSEQWU.exe
  2⤵
  PID:3836
- C:\Windows\System\uDiZrOT.exe
  C:\Windows\System\uDiZrOT.exe
  2⤵
  PID:5128
- C:\Windows\System\KgcifBh.exe
  C:\Windows\System\KgcifBh.exe
  2⤵
  PID:5152
- C:\Windows\System\ahrOhPS.exe
  C:\Windows\System\ahrOhPS.exe
  2⤵
  PID:5172
- C:\Windows\System\KKLcASU.exe
  C:\Windows\System\KKLcASU.exe
  2⤵
  PID:5196
- C:\Windows\System\DyjcuEQ.exe
  C:\Windows\System\DyjcuEQ.exe
  2⤵
  PID:5220
- C:\Windows\System\BLTiOvn.exe
  C:\Windows\System\BLTiOvn.exe
  2⤵
  PID:5244
- C:\Windows\System\ExjTqMd.exe
  C:\Windows\System\ExjTqMd.exe
  2⤵
  PID:5268
- C:\Windows\System\NIDTQGv.exe
  C:\Windows\System\NIDTQGv.exe
  2⤵
  PID:5292
- C:\Windows\System\imtrzph.exe
  C:\Windows\System\imtrzph.exe
  2⤵
  PID:5312
- C:\Windows\System\rqSMafl.exe
  C:\Windows\System\rqSMafl.exe
  2⤵
  PID:5344
- C:\Windows\System\TTyyXRo.exe
  C:\Windows\System\TTyyXRo.exe
  2⤵
  PID:5364
- C:\Windows\System\AzyOVSl.exe
  C:\Windows\System\AzyOVSl.exe
  2⤵
  PID:5388
- C:\Windows\System\VqIqFjr.exe
  C:\Windows\System\VqIqFjr.exe
  2⤵
  PID:5412
- C:\Windows\System\CEdlXBM.exe
  C:\Windows\System\CEdlXBM.exe
  2⤵
  PID:5436
- C:\Windows\System\UJKnJjq.exe
  C:\Windows\System\UJKnJjq.exe
  2⤵
  PID:5464
- C:\Windows\System\lhaUxEv.exe
  C:\Windows\System\lhaUxEv.exe
  2⤵
  PID:5488
- C:\Windows\System\zJUgEDX.exe
  C:\Windows\System\zJUgEDX.exe
  2⤵
  PID:5508
- C:\Windows\System\ElXBtgL.exe
  C:\Windows\System\ElXBtgL.exe
  2⤵
  PID:5536
- C:\Windows\System\lTNaQCF.exe
  C:\Windows\System\lTNaQCF.exe
  2⤵
  PID:5556
- C:\Windows\System\NHHeXLS.exe
  C:\Windows\System\NHHeXLS.exe
  2⤵
  PID:5580
- C:\Windows\System\gtxphPW.exe
  C:\Windows\System\gtxphPW.exe
  2⤵
  PID:5604
- C:\Windows\System\AwFSifJ.exe
  C:\Windows\System\AwFSifJ.exe
  2⤵
  PID:5628
- C:\Windows\System\TCNfIvD.exe
  C:\Windows\System\TCNfIvD.exe
  2⤵
  PID:5676
- C:\Windows\System\XtiCwKP.exe
  C:\Windows\System\XtiCwKP.exe
  2⤵
  PID:5692
- C:\Windows\System\uwkREkj.exe
  C:\Windows\System\uwkREkj.exe
  2⤵
  PID:5708
- C:\Windows\System\XSaXHXE.exe
  C:\Windows\System\XSaXHXE.exe
  2⤵
  PID:5724
- C:\Windows\System\uCWUaYp.exe
  C:\Windows\System\uCWUaYp.exe
  2⤵
  PID:5748
- C:\Windows\System\BdCddnO.exe
  C:\Windows\System\BdCddnO.exe
  2⤵
  PID:5772
- C:\Windows\System\tfmYnOi.exe
  C:\Windows\System\tfmYnOi.exe
  2⤵
  PID:5792
- C:\Windows\System\iqkoQiX.exe
  C:\Windows\System\iqkoQiX.exe
  2⤵
  PID:5820
- C:\Windows\System\EblBRyt.exe
  C:\Windows\System\EblBRyt.exe
  2⤵
  PID:5840
- C:\Windows\System\iNLVdpY.exe
  C:\Windows\System\iNLVdpY.exe
  2⤵
  PID:5864
- C:\Windows\System\TgRtnOv.exe
  C:\Windows\System\TgRtnOv.exe
  2⤵
  PID:5888
- C:\Windows\System\oreKZaL.exe
  C:\Windows\System\oreKZaL.exe
  2⤵
  PID:5916
- C:\Windows\System\IhOaTjM.exe
  C:\Windows\System\IhOaTjM.exe
  2⤵
  PID:5940
- C:\Windows\System\aLXmDuJ.exe
  C:\Windows\System\aLXmDuJ.exe
  2⤵
  PID:5964
- C:\Windows\System\qXDsNpN.exe
  C:\Windows\System\qXDsNpN.exe
  2⤵
  PID:5988
- C:\Windows\System\OxINHeT.exe
  C:\Windows\System\OxINHeT.exe
  2⤵
  PID:6012
- C:\Windows\System\oAnpleV.exe
  C:\Windows\System\oAnpleV.exe
  2⤵
  PID:6040
- C:\Windows\System\GftEFoP.exe
  C:\Windows\System\GftEFoP.exe
  2⤵
  PID:6060
- C:\Windows\System\fJgHHNB.exe
  C:\Windows\System\fJgHHNB.exe
  2⤵
  PID:6084
- C:\Windows\System\VSZozyR.exe
  C:\Windows\System\VSZozyR.exe
  2⤵
  PID:6108
- C:\Windows\System\nEkGIOn.exe
  C:\Windows\System\nEkGIOn.exe
  2⤵
  PID:6132
- C:\Windows\System\IgawXgv.exe
  C:\Windows\System\IgawXgv.exe
  2⤵
  PID:2848
- C:\Windows\System\JvwrbnJ.exe
  C:\Windows\System\JvwrbnJ.exe
  2⤵
  PID:560
- C:\Windows\System\ZsbOYQX.exe
  C:\Windows\System\ZsbOYQX.exe
  2⤵
  PID:1680
- C:\Windows\System\AVsqXPM.exe
  C:\Windows\System\AVsqXPM.exe
  2⤵
  PID:2628
- C:\Windows\System\ocWQlOL.exe
  C:\Windows\System\ocWQlOL.exe
  2⤵
  PID:3688
- C:\Windows\System\TfIuegc.exe
  C:\Windows\System\TfIuegc.exe
  2⤵
  PID:4296
- C:\Windows\System\ThYPTvl.exe
  C:\Windows\System\ThYPTvl.exe
  2⤵
  PID:4504
- C:\Windows\System\cteSSLh.exe
  C:\Windows\System\cteSSLh.exe
  2⤵
  PID:5188
- C:\Windows\System\qGgsqEy.exe
  C:\Windows\System\qGgsqEy.exe
  2⤵
  PID:5260
- C:\Windows\System\VUmTxpJ.exe
  C:\Windows\System\VUmTxpJ.exe
  2⤵
  PID:5352
- C:\Windows\System\wIxqCCU.exe
  C:\Windows\System\wIxqCCU.exe
  2⤵
  PID:5404
- C:\Windows\System\JKUIVRz.exe
  C:\Windows\System\JKUIVRz.exe
  2⤵
  PID:5452
- C:\Windows\System\bUaKTDi.exe
  C:\Windows\System\bUaKTDi.exe
  2⤵
  PID:5524
- C:\Windows\System\ZKBAYeU.exe
  C:\Windows\System\ZKBAYeU.exe
  2⤵
  PID:5596
- C:\Windows\System\TDGhSsF.exe
  C:\Windows\System\TDGhSsF.exe
  2⤵
  PID:5700
- C:\Windows\System\FZnEWhf.exe
  C:\Windows\System\FZnEWhf.exe
  2⤵
  PID:5768
- C:\Windows\System\CvcMTUM.exe
  C:\Windows\System\CvcMTUM.exe
  2⤵
  PID:5832
- C:\Windows\System\sRsoaWc.exe
  C:\Windows\System\sRsoaWc.exe
  2⤵
  PID:5904
- C:\Windows\System\ExkSnCK.exe
  C:\Windows\System\ExkSnCK.exe
  2⤵
  PID:5980
- C:\Windows\System\aqpspfz.exe
  C:\Windows\System\aqpspfz.exe
  2⤵
  PID:6052
- C:\Windows\System\KVgtmLu.exe
  C:\Windows\System\KVgtmLu.exe
  2⤵
  PID:4312
- C:\Windows\System\PWiAgIS.exe
  C:\Windows\System\PWiAgIS.exe
  2⤵
  PID:4340
- C:\Windows\System\nXIUKkD.exe
  C:\Windows\System\nXIUKkD.exe
  2⤵
  PID:1928
- C:\Windows\System\BAfqGDp.exe
  C:\Windows\System\BAfqGDp.exe
  2⤵
  PID:6160
- C:\Windows\System\ttPMDIp.exe
  C:\Windows\System\ttPMDIp.exe
  2⤵
  PID:6188
- C:\Windows\System\SqWUoZa.exe
  C:\Windows\System\SqWUoZa.exe
  2⤵
  PID:6208
- C:\Windows\System\layIoEC.exe
  C:\Windows\System\layIoEC.exe
  2⤵
  PID:6232
- C:\Windows\System\oZxcTXo.exe
  C:\Windows\System\oZxcTXo.exe
  2⤵
  PID:6252
- C:\Windows\System\GMgQvJS.exe
  C:\Windows\System\GMgQvJS.exe
  2⤵
  PID:6276
- C:\Windows\System\pHleJZn.exe
  C:\Windows\System\pHleJZn.exe
  2⤵
  PID:6300
- C:\Windows\System\emzxjUW.exe
  C:\Windows\System\emzxjUW.exe
  2⤵
  PID:6328
- C:\Windows\System\QgKNZiA.exe
  C:\Windows\System\QgKNZiA.exe
  2⤵
  PID:6348
- C:\Windows\System\ejverMk.exe
  C:\Windows\System\ejverMk.exe
  2⤵
  PID:6376
- C:\Windows\System\nbQMSPD.exe
  C:\Windows\System\nbQMSPD.exe
  2⤵
  PID:6396
- C:\Windows\System\NFEJUxB.exe
  C:\Windows\System\NFEJUxB.exe
  2⤵
  PID:6420
- C:\Windows\System\GKKnvZg.exe
  C:\Windows\System\GKKnvZg.exe
  2⤵
  PID:6444
- C:\Windows\System\BDwpzcr.exe
  C:\Windows\System\BDwpzcr.exe
  2⤵
  PID:6472
- C:\Windows\System\sODqspH.exe
  C:\Windows\System\sODqspH.exe
  2⤵
  PID:6492
- C:\Windows\System\yXGsStS.exe
  C:\Windows\System\yXGsStS.exe
  2⤵
  PID:6516
- C:\Windows\System\FIOygOy.exe
  C:\Windows\System\FIOygOy.exe
  2⤵
  PID:6540
- C:\Windows\System\MYUCdkm.exe
  C:\Windows\System\MYUCdkm.exe
  2⤵
  PID:6564
- C:\Windows\System\BwgNjHn.exe
  C:\Windows\System\BwgNjHn.exe
  2⤵
  PID:6588
- C:\Windows\System\QtHTAyt.exe
  C:\Windows\System\QtHTAyt.exe
  2⤵
  PID:6616
- C:\Windows\System\lDLvFsx.exe
  C:\Windows\System\lDLvFsx.exe
  2⤵
  PID:6640
- C:\Windows\System\DIUUxFR.exe
  C:\Windows\System\DIUUxFR.exe
  2⤵
  PID:6664
- C:\Windows\System\ONcRpBL.exe
  C:\Windows\System\ONcRpBL.exe
  2⤵
  PID:6684
- C:\Windows\System\aYdYJja.exe
  C:\Windows\System\aYdYJja.exe
  2⤵
  PID:6712
- C:\Windows\System\QZKqxzK.exe
  C:\Windows\System\QZKqxzK.exe
  2⤵
  PID:6736
- C:\Windows\System\kUFJJpX.exe
  C:\Windows\System\kUFJJpX.exe
  2⤵
  PID:6760
- C:\Windows\System\iMXHsCu.exe
  C:\Windows\System\iMXHsCu.exe
  2⤵
  PID:6784
- C:\Windows\System\FLlpTnw.exe
  C:\Windows\System\FLlpTnw.exe
  2⤵
  PID:6808
- C:\Windows\System\oQHTLwx.exe
  C:\Windows\System\oQHTLwx.exe
  2⤵
  PID:6828
- C:\Windows\System\qYbEJeB.exe
  C:\Windows\System\qYbEJeB.exe
  2⤵
  PID:6852
- C:\Windows\System\nrAiHaG.exe
  C:\Windows\System\nrAiHaG.exe
  2⤵
  PID:6880
- C:\Windows\System\UKFzDeJ.exe
  C:\Windows\System\UKFzDeJ.exe
  2⤵
  PID:6904
- C:\Windows\System\oWFfKrR.exe
  C:\Windows\System\oWFfKrR.exe
  2⤵
  PID:6928
- C:\Windows\System\XknTlQc.exe
  C:\Windows\System\XknTlQc.exe
  2⤵
  PID:6952
- C:\Windows\System\TaQfleC.exe
  C:\Windows\System\TaQfleC.exe
  2⤵
  PID:6968
- C:\Windows\System\iWnPKRT.exe
  C:\Windows\System\iWnPKRT.exe
  2⤵
  PID:6988
- C:\Windows\System\zZIxCKU.exe
  C:\Windows\System\zZIxCKU.exe
  2⤵
  PID:7016
- C:\Windows\System\HwHtquT.exe
  C:\Windows\System\HwHtquT.exe
  2⤵
  PID:7044
- C:\Windows\System\qAaqqMV.exe
  C:\Windows\System\qAaqqMV.exe
  2⤵
  PID:7072
- C:\Windows\System\tYofhKI.exe
  C:\Windows\System\tYofhKI.exe
  2⤵
  PID:7096
- C:\Windows\System\kaRRjyY.exe
  C:\Windows\System\kaRRjyY.exe
  2⤵
  PID:7116
- C:\Windows\System\osyXYXm.exe
  C:\Windows\System\osyXYXm.exe
  2⤵
  PID:7144
- C:\Windows\System\bqQhlVb.exe
  C:\Windows\System\bqQhlVb.exe
  2⤵
  PID:7164
- C:\Windows\System\iHhbTQD.exe
  C:\Windows\System\iHhbTQD.exe
  2⤵
  PID:5376
- C:\Windows\System\vxQLcJU.exe
  C:\Windows\System\vxQLcJU.exe
  2⤵
  PID:5504
- C:\Windows\System\lmiTyrq.exe
  C:\Windows\System\lmiTyrq.exe
  2⤵
  PID:5744
- C:\Windows\System\HVxotwA.exe
  C:\Windows\System\HVxotwA.exe
  2⤵
  PID:5956
- C:\Windows\System\YzxMcWA.exe
  C:\Windows\System\YzxMcWA.exe
  2⤵
  PID:4080
- C:\Windows\System\qVBoKmN.exe
  C:\Windows\System\qVBoKmN.exe
  2⤵
  PID:6156
- C:\Windows\System\yCPAyhU.exe
  C:\Windows\System\yCPAyhU.exe
  2⤵
  PID:6220
- C:\Windows\System\TPjNuZJ.exe
  C:\Windows\System\TPjNuZJ.exe
  2⤵
  PID:6292
- C:\Windows\System\wGPLYvp.exe
  C:\Windows\System\wGPLYvp.exe
  2⤵
  PID:6368
- C:\Windows\System\WJluavp.exe
  C:\Windows\System\WJluavp.exe
  2⤵
  PID:6436
- C:\Windows\System\fppIBlx.exe
  C:\Windows\System\fppIBlx.exe
  2⤵
  PID:3176
- C:\Windows\System\qZPVgJd.exe
  C:\Windows\System\qZPVgJd.exe
  2⤵
  PID:6560
- C:\Windows\System\rzOudcF.exe
  C:\Windows\System\rzOudcF.exe
  2⤵
  PID:4084
- C:\Windows\System\blDWJDu.exe
  C:\Windows\System\blDWJDu.exe
  2⤵
  PID:6680
- C:\Windows\System\bWCzfSc.exe
  C:\Windows\System\bWCzfSc.exe
  2⤵
  PID:6748
- C:\Windows\System\BzZfREw.exe
  C:\Windows\System\BzZfREw.exe
  2⤵
  PID:6800
- C:\Windows\System\hJMixUG.exe
  C:\Windows\System\hJMixUG.exe
  2⤵
  PID:6892
- C:\Windows\System\uqcaZpd.exe
  C:\Windows\System\uqcaZpd.exe
  2⤵
  PID:6940
- C:\Windows\System\zsCZZgR.exe
  C:\Windows\System\zsCZZgR.exe
  2⤵
  PID:4188
- C:\Windows\System\xdnrcSe.exe
  C:\Windows\System\xdnrcSe.exe
  2⤵
  PID:3716
- C:\Windows\System\JmaTEcC.exe
  C:\Windows\System\JmaTEcC.exe
  2⤵
  PID:7112
- C:\Windows\System\upYFXYB.exe
  C:\Windows\System\upYFXYB.exe
  2⤵
  PID:7472
- C:\Windows\System\uJEaHKa.exe
  C:\Windows\System\uJEaHKa.exe
  2⤵
  PID:7488
- C:\Windows\System\AFtImOq.exe
  C:\Windows\System\AFtImOq.exe
  2⤵
  PID:7512
- C:\Windows\System\wkMafdq.exe
  C:\Windows\System\wkMafdq.exe
  2⤵
  PID:7848
- C:\Windows\System\lSkWXYA.exe
  C:\Windows\System\lSkWXYA.exe
  2⤵
  PID:7864
- C:\Windows\System\aieBQde.exe
  C:\Windows\System\aieBQde.exe
  2⤵
  PID:7880
- C:\Windows\System\NoYLCvA.exe
  C:\Windows\System\NoYLCvA.exe
  2⤵
  PID:7956
- C:\Windows\System\ryzMCgb.exe
  C:\Windows\System\ryzMCgb.exe
  2⤵
  PID:7980
- C:\Windows\System\xDfkBMm.exe
  C:\Windows\System\xDfkBMm.exe
  2⤵
  PID:8008
- C:\Windows\System\aPCTfcI.exe
  C:\Windows\System\aPCTfcI.exe
  2⤵
  PID:8040
- C:\Windows\System\RnQiIfB.exe
  C:\Windows\System\RnQiIfB.exe
  2⤵
  PID:8064
- C:\Windows\System\onsEGmj.exe
  C:\Windows\System\onsEGmj.exe
  2⤵
  PID:8104
- C:\Windows\System\ekvJNeG.exe
  C:\Windows\System\ekvJNeG.exe
  2⤵
  PID:8132
- C:\Windows\System\gUSSyhV.exe
  C:\Windows\System\gUSSyhV.exe
  2⤵
  PID:8152
- C:\Windows\System\vRfvffr.exe
  C:\Windows\System\vRfvffr.exe
  2⤵
  PID:8168
- C:\Windows\System\tZHXfGu.exe
  C:\Windows\System\tZHXfGu.exe
  2⤵
  PID:8184
- C:\Windows\System\AvTFaCS.exe
  C:\Windows\System\AvTFaCS.exe
  2⤵
  PID:4848
- C:\Windows\System\UqPLuEP.exe
  C:\Windows\System\UqPLuEP.exe
  2⤵
  PID:7088
- C:\Windows\System\ZtjdKHW.exe
  C:\Windows\System\ZtjdKHW.exe
  2⤵
  PID:7584
- C:\Windows\System\kctoGOb.exe
  C:\Windows\System\kctoGOb.exe
  2⤵
  PID:7688
- C:\Windows\System\tGPcurU.exe
  C:\Windows\System\tGPcurU.exe
  2⤵
  PID:7720
- C:\Windows\System\aWDqDSd.exe
  C:\Windows\System\aWDqDSd.exe
  2⤵
  PID:7800
- C:\Windows\System\Ejebaju.exe
  C:\Windows\System\Ejebaju.exe
  2⤵
  PID:7180
- C:\Windows\System\qrHiHGH.exe
  C:\Windows\System\qrHiHGH.exe
  2⤵
  PID:7444
- C:\Windows\System\mSekwzC.exe
  C:\Windows\System\mSekwzC.exe
  2⤵
  PID:7620
- C:\Windows\System\bwLfgFn.exe
  C:\Windows\System\bwLfgFn.exe
  2⤵
  PID:7684
- C:\Windows\System\zHEOXDf.exe
  C:\Windows\System\zHEOXDf.exe
  2⤵
  PID:7784
- C:\Windows\System\gbTjrZI.exe
  C:\Windows\System\gbTjrZI.exe
  2⤵
  PID:5884
- C:\Windows\System\VTgiViB.exe
  C:\Windows\System\VTgiViB.exe
  2⤵
  PID:3736
- C:\Windows\System\VRTWXYD.exe
  C:\Windows\System\VRTWXYD.exe
  2⤵
  PID:6364
- C:\Windows\System\LSNsfst.exe
  C:\Windows\System\LSNsfst.exe
  2⤵
  PID:1264
- C:\Windows\System\sebNJYg.exe
  C:\Windows\System\sebNJYg.exe
  2⤵
  PID:3852
- C:\Windows\System\DnsIqRp.exe
  C:\Windows\System\DnsIqRp.exe
  2⤵
  PID:1664
- C:\Windows\System\ISyClJX.exe
  C:\Windows\System\ISyClJX.exe
  2⤵
  PID:3740
- C:\Windows\System\DhJdvst.exe
  C:\Windows\System\DhJdvst.exe
  2⤵
  PID:1388
- C:\Windows\System\MBWFNoc.exe
  C:\Windows\System\MBWFNoc.exe
  2⤵
  PID:4008
- C:\Windows\System\rKDCVhf.exe
  C:\Windows\System\rKDCVhf.exe
  2⤵
  PID:7196
- C:\Windows\System\PbxGXIV.exe
  C:\Windows\System\PbxGXIV.exe
  2⤵
  PID:7240
- C:\Windows\System\HsqEBJk.exe
  C:\Windows\System\HsqEBJk.exe
  2⤵
  PID:7272
- C:\Windows\System\qHxKChP.exe
  C:\Windows\System\qHxKChP.exe
  2⤵
  PID:7304
- C:\Windows\System\oryvgyn.exe
  C:\Windows\System\oryvgyn.exe
  2⤵
  PID:7332
- C:\Windows\System\uxUTIsS.exe
  C:\Windows\System\uxUTIsS.exe
  2⤵
  PID:7396
- C:\Windows\System\lfwDzAO.exe
  C:\Windows\System\lfwDzAO.exe
  2⤵
  PID:7484
- C:\Windows\System\WVWVQJR.exe
  C:\Windows\System\WVWVQJR.exe
  2⤵
  PID:7432
- C:\Windows\System\zZiyTgY.exe
  C:\Windows\System\zZiyTgY.exe
  2⤵
  PID:7580
- C:\Windows\System\CaGxMkM.exe
  C:\Windows\System\CaGxMkM.exe
  2⤵
  PID:7844
- C:\Windows\System\kcxvsSY.exe
  C:\Windows\System\kcxvsSY.exe
  2⤵
  PID:7752
- C:\Windows\System\xWljUUU.exe
  C:\Windows\System\xWljUUU.exe
  2⤵
  PID:7788
- C:\Windows\System\XQQRSrP.exe
  C:\Windows\System\XQQRSrP.exe
  2⤵
  PID:7820
- C:\Windows\System\embyAUX.exe
  C:\Windows\System\embyAUX.exe
  2⤵
  PID:7908
- C:\Windows\System\ZvcHvVu.exe
  C:\Windows\System\ZvcHvVu.exe
  2⤵
  PID:7904
- C:\Windows\System\zflbTtJ.exe
  C:\Windows\System\zflbTtJ.exe
  2⤵
  PID:8000
- C:\Windows\System\lbxuCbY.exe
  C:\Windows\System\lbxuCbY.exe
  2⤵
  PID:8060
- C:\Windows\System\JQUGoHG.exe
  C:\Windows\System\JQUGoHG.exe
  2⤵
  PID:8144
- C:\Windows\System\QhqkGff.exe
  C:\Windows\System\QhqkGff.exe
  2⤵
  PID:8128
- C:\Windows\System\bAAJcVo.exe
  C:\Windows\System\bAAJcVo.exe
  2⤵
  PID:7576
- C:\Windows\System\IjXrhhe.exe
  C:\Windows\System\IjXrhhe.exe
  2⤵
  PID:7676
- C:\Windows\System\ZCngukZ.exe
  C:\Windows\System\ZCngukZ.exe
  2⤵
  PID:7348
- C:\Windows\System\lUOaMTD.exe
  C:\Windows\System\lUOaMTD.exe
  2⤵
  PID:7668
- C:\Windows\System\hQfVEyQ.exe
  C:\Windows\System\hQfVEyQ.exe
  2⤵
  PID:3196
- C:\Windows\System\gTaLgqH.exe
  C:\Windows\System\gTaLgqH.exe
  2⤵
  PID:3616
- C:\Windows\System\QcoxdXn.exe
  C:\Windows\System\QcoxdXn.exe
  2⤵
  PID:6652
- C:\Windows\System\Vljpjqx.exe
  C:\Windows\System\Vljpjqx.exe
  2⤵
  PID:1516
- C:\Windows\System\pyPRJwQ.exe
  C:\Windows\System\pyPRJwQ.exe
  2⤵
  PID:7192
- C:\Windows\System\zMVkyys.exe
  C:\Windows\System\zMVkyys.exe
  2⤵
  PID:7228
- C:\Windows\System\xBUJFOz.exe
  C:\Windows\System\xBUJFOz.exe
  2⤵
  PID:7320
- C:\Windows\System\iiswSMh.exe
  C:\Windows\System\iiswSMh.exe
  2⤵
  PID:7392
- C:\Windows\System\CZXvUTR.exe
  C:\Windows\System\CZXvUTR.exe
  2⤵
  PID:7440
- C:\Windows\System\IoySyNn.exe
  C:\Windows\System\IoySyNn.exe
  2⤵
  PID:7604
- C:\Windows\System\RroCuul.exe
  C:\Windows\System\RroCuul.exe
  2⤵
  PID:7772
- C:\Windows\System\uqVtGPO.exe
  C:\Windows\System\uqVtGPO.exe
  2⤵
  PID:7840
- C:\Windows\System\tLZtNyY.exe
  C:\Windows\System\tLZtNyY.exe
  2⤵
  PID:8100
- C:\Windows\System\dZxKGff.exe
  C:\Windows\System\dZxKGff.exe
  2⤵
  PID:7108
- C:\Windows\System\Kovinbv.exe
  C:\Windows\System\Kovinbv.exe
  2⤵
  PID:5116
- C:\Windows\System\uKMUakp.exe
  C:\Windows\System\uKMUakp.exe
  2⤵
  PID:696
- C:\Windows\System\xZYwFjs.exe
  C:\Windows\System\xZYwFjs.exe
  2⤵
  PID:7172
- C:\Windows\System\HDqhaFg.exe
  C:\Windows\System\HDqhaFg.exe
  2⤵
  PID:7376
- C:\Windows\System\nTkiiTF.exe
  C:\Windows\System\nTkiiTF.exe
  2⤵
  PID:7572
- C:\Windows\System\GoaltSw.exe
  C:\Windows\System\GoaltSw.exe
  2⤵
  PID:7924
- C:\Windows\System\UlytjVB.exe
  C:\Windows\System\UlytjVB.exe
  2⤵
  PID:8148
- C:\Windows\System\yWnwZCX.exe
  C:\Windows\System\yWnwZCX.exe
  2⤵
  PID:3596
- C:\Windows\System\tppqCHI.exe
  C:\Windows\System\tppqCHI.exe
  2⤵
  PID:7224
- C:\Windows\System\IFOVGki.exe
  C:\Windows\System\IFOVGki.exe
  2⤵
  PID:852
- C:\Windows\System\eynoWqv.exe
  C:\Windows\System\eynoWqv.exe
  2⤵
  PID:7184
- C:\Windows\System\alxWukm.exe
  C:\Windows\System\alxWukm.exe
  2⤵
  PID:8208
- C:\Windows\System\oGekWGL.exe
  C:\Windows\System\oGekWGL.exe
  2⤵
  PID:8268
- C:\Windows\System\SVrXLsS.exe
  C:\Windows\System\SVrXLsS.exe
  2⤵
  PID:8296
- C:\Windows\System\DWSWPfY.exe
  C:\Windows\System\DWSWPfY.exe
  2⤵
  PID:8312
- C:\Windows\System\WmSJwkA.exe
  C:\Windows\System\WmSJwkA.exe
  2⤵
  PID:8332
- C:\Windows\System\ckPKHTQ.exe
  C:\Windows\System\ckPKHTQ.exe
  2⤵
  PID:8368
- C:\Windows\System\XthMfgD.exe
  C:\Windows\System\XthMfgD.exe
  2⤵
  PID:8392
- C:\Windows\System\pNRsJHh.exe
  C:\Windows\System\pNRsJHh.exe
  2⤵
  PID:8416
- C:\Windows\System\fCjXNVB.exe
  C:\Windows\System\fCjXNVB.exe
  2⤵
  PID:8440
- C:\Windows\System\PFrAyno.exe
  C:\Windows\System\PFrAyno.exe
  2⤵
  PID:8472
- C:\Windows\System\BSAJxid.exe
  C:\Windows\System\BSAJxid.exe
  2⤵
  PID:8488
- C:\Windows\System\viWJpoH.exe
  C:\Windows\System\viWJpoH.exe
  2⤵
  PID:8516
- C:\Windows\System\RxnBfHL.exe
  C:\Windows\System\RxnBfHL.exe
  2⤵
  PID:8540
- C:\Windows\System\nxnyRwa.exe
  C:\Windows\System\nxnyRwa.exe
  2⤵
  PID:8588
- C:\Windows\System\hRSXNGK.exe
  C:\Windows\System\hRSXNGK.exe
  2⤵
  PID:8612
- C:\Windows\System\yvBCGpA.exe
  C:\Windows\System\yvBCGpA.exe
  2⤵
  PID:8640
- C:\Windows\System\sRPVQbD.exe
  C:\Windows\System\sRPVQbD.exe
  2⤵
  PID:8668
- C:\Windows\System\ltLrtnk.exe
  C:\Windows\System\ltLrtnk.exe
  2⤵
  PID:8692
- C:\Windows\System\JEYfHtk.exe
  C:\Windows\System\JEYfHtk.exe
  2⤵
  PID:8744
- C:\Windows\System\AusoSnP.exe
  C:\Windows\System\AusoSnP.exe
  2⤵
  PID:8764
- C:\Windows\System\LKzlZfB.exe
  C:\Windows\System\LKzlZfB.exe
  2⤵
  PID:8788
- C:\Windows\System\VGIkwxZ.exe
  C:\Windows\System\VGIkwxZ.exe
  2⤵
  PID:8812
- C:\Windows\System\lHgMKrv.exe
  C:\Windows\System\lHgMKrv.exe
  2⤵
  PID:8844
- C:\Windows\System\ZOMFhrJ.exe
  C:\Windows\System\ZOMFhrJ.exe
  2⤵
  PID:8860
- C:\Windows\System\JOyClvE.exe
  C:\Windows\System\JOyClvE.exe
  2⤵
  PID:8876
- C:\Windows\System\qNXDTqb.exe
  C:\Windows\System\qNXDTqb.exe
  2⤵
  PID:8928
- C:\Windows\System\ejOQBLx.exe
  C:\Windows\System\ejOQBLx.exe
  2⤵
  PID:8952
- C:\Windows\System\PVfjQsv.exe
  C:\Windows\System\PVfjQsv.exe
  2⤵
  PID:8980
- C:\Windows\System\HhKCgUg.exe
  C:\Windows\System\HhKCgUg.exe
  2⤵
  PID:9012
- C:\Windows\System\oTliueW.exe
  C:\Windows\System\oTliueW.exe
  2⤵
  PID:9040
- C:\Windows\System\BDaYKei.exe
  C:\Windows\System\BDaYKei.exe
  2⤵
  PID:9060
- C:\Windows\System\qaDgHvq.exe
  C:\Windows\System\qaDgHvq.exe
  2⤵
  PID:9080
- C:\Windows\System\IXSTSCO.exe
  C:\Windows\System\IXSTSCO.exe
  2⤵
  PID:9124
- C:\Windows\System\KKTMEep.exe
  C:\Windows\System\KKTMEep.exe
  2⤵
  PID:9140
- C:\Windows\System\bewxsEI.exe
  C:\Windows\System\bewxsEI.exe
  2⤵
  PID:9180
- C:\Windows\System\dVhWyeb.exe
  C:\Windows\System\dVhWyeb.exe
  2⤵
  PID:9208
- C:\Windows\System\wczQuoh.exe
  C:\Windows\System\wczQuoh.exe
  2⤵
  PID:8248
- C:\Windows\System\cSGGIge.exe
  C:\Windows\System\cSGGIge.exe
  2⤵
  PID:8280
- C:\Windows\System\EjPIZzs.exe
  C:\Windows\System\EjPIZzs.exe
  2⤵
  PID:8320
- C:\Windows\System\UxbsrNp.exe
  C:\Windows\System\UxbsrNp.exe
  2⤵
  PID:8432
- C:\Windows\System\Gsqcudh.exe
  C:\Windows\System\Gsqcudh.exe
  2⤵
  PID:8512
- C:\Windows\System\TMWFiln.exe
  C:\Windows\System\TMWFiln.exe
  2⤵
  PID:8580
- C:\Windows\System\NWWchsQ.exe
  C:\Windows\System\NWWchsQ.exe
  2⤵
  PID:8624
- C:\Windows\System\VDJjNVb.exe
  C:\Windows\System\VDJjNVb.exe
  2⤵
  PID:8716
- C:\Windows\System\fCiHOQp.exe
  C:\Windows\System\fCiHOQp.exe
  2⤵
  PID:8756
- C:\Windows\System\QKiOaYs.exe
  C:\Windows\System\QKiOaYs.exe
  2⤵
  PID:8832
- C:\Windows\System\SmfAnCJ.exe
  C:\Windows\System\SmfAnCJ.exe
  2⤵
  PID:8856
- C:\Windows\System\nQnYBei.exe
  C:\Windows\System\nQnYBei.exe
  2⤵
  PID:8920
- C:\Windows\System\QbWEwvO.exe
  C:\Windows\System\QbWEwvO.exe
  2⤵
  PID:8976
- C:\Windows\System\TOerpXO.exe
  C:\Windows\System\TOerpXO.exe
  2⤵
  PID:9028
- C:\Windows\System\MZwaaKb.exe
  C:\Windows\System\MZwaaKb.exe
  2⤵
  PID:9076
- C:\Windows\System\EkBzXPu.exe
  C:\Windows\System\EkBzXPu.exe
  2⤵
  PID:9200
- C:\Windows\System\QeSEJSZ.exe
  C:\Windows\System\QeSEJSZ.exe
  2⤵
  PID:8244
- C:\Windows\System\EOfeiFr.exe
  C:\Windows\System\EOfeiFr.exe
  2⤵
  PID:8388
- C:\Windows\System\iPAFWOj.exe
  C:\Windows\System\iPAFWOj.exe
  2⤵
  PID:8648
- C:\Windows\System\yNoGVJb.exe
  C:\Windows\System\yNoGVJb.exe
  2⤵
  PID:8680
- C:\Windows\System\deLuBvD.exe
  C:\Windows\System\deLuBvD.exe
  2⤵
  PID:8780
- C:\Windows\System\AVWVsdo.exe
  C:\Windows\System\AVWVsdo.exe
  2⤵
  PID:9004
- C:\Windows\System\fvycidk.exe
  C:\Windows\System\fvycidk.exe
  2⤵
  PID:1700
- C:\Windows\System\lgbgmSJ.exe
  C:\Windows\System\lgbgmSJ.exe
  2⤵
  PID:8380
- C:\Windows\System\sCgyxAW.exe
  C:\Windows\System\sCgyxAW.exe
  2⤵
  PID:8600
- C:\Windows\System\IoYPNAR.exe
  C:\Windows\System\IoYPNAR.exe
  2⤵
  PID:9168
- C:\Windows\System\ioqJbVd.exe
  C:\Windows\System\ioqJbVd.exe
  2⤵
  PID:8508
- C:\Windows\System\EjNMOqC.exe
  C:\Windows\System\EjNMOqC.exe
  2⤵
  PID:9232
- C:\Windows\System\EJSyFZx.exe
  C:\Windows\System\EJSyFZx.exe
  2⤵
  PID:9256
- C:\Windows\System\dChabUI.exe
  C:\Windows\System\dChabUI.exe
  2⤵
  PID:9308
- C:\Windows\System\NkKNyAy.exe
  C:\Windows\System\NkKNyAy.exe
  2⤵
  PID:9348
- C:\Windows\System\xxAEvqG.exe
  C:\Windows\System\xxAEvqG.exe
  2⤵
  PID:9364
- C:\Windows\System\mASBBFc.exe
  C:\Windows\System\mASBBFc.exe
  2⤵
  PID:9384
- C:\Windows\System\ipxHRtl.exe
  C:\Windows\System\ipxHRtl.exe
  2⤵
  PID:9412
- C:\Windows\System\eWieJyB.exe
  C:\Windows\System\eWieJyB.exe
  2⤵
  PID:9436
- C:\Windows\System\GWjZfis.exe
  C:\Windows\System\GWjZfis.exe
  2⤵
  PID:9488
- C:\Windows\System\SdkChEC.exe
  C:\Windows\System\SdkChEC.exe
  2⤵
  PID:9512
- C:\Windows\System\kwcthOT.exe
  C:\Windows\System\kwcthOT.exe
  2⤵
  PID:9532
- C:\Windows\System\YHhXXKI.exe
  C:\Windows\System\YHhXXKI.exe
  2⤵
  PID:9572
- C:\Windows\System\CHobBjh.exe
  C:\Windows\System\CHobBjh.exe
  2⤵
  PID:9596
- C:\Windows\System\fLWxyFn.exe
  C:\Windows\System\fLWxyFn.exe
  2⤵
  PID:9620
- C:\Windows\System\LgaMMWt.exe
  C:\Windows\System\LgaMMWt.exe
  2⤵
  PID:9648
- C:\Windows\System\cxYohVd.exe
  C:\Windows\System\cxYohVd.exe
  2⤵
  PID:9672
- C:\Windows\System\ezIDAyK.exe
  C:\Windows\System\ezIDAyK.exe
  2⤵
  PID:9696
- C:\Windows\System\uDmyOju.exe
  C:\Windows\System\uDmyOju.exe
  2⤵
  PID:9720
- C:\Windows\System\zuJLpvi.exe
  C:\Windows\System\zuJLpvi.exe
  2⤵
  PID:9744
- C:\Windows\System\LVksgIo.exe
  C:\Windows\System\LVksgIo.exe
  2⤵
  PID:9772
- C:\Windows\System\oGZrePO.exe
  C:\Windows\System\oGZrePO.exe
  2⤵
  PID:9796
- C:\Windows\System\OEkbMQI.exe
  C:\Windows\System\OEkbMQI.exe
  2⤵
  PID:9840
- C:\Windows\System\tgaEaIp.exe
  C:\Windows\System\tgaEaIp.exe
  2⤵
  PID:9868
- C:\Windows\System\tREtbQe.exe
  C:\Windows\System\tREtbQe.exe
  2⤵
  PID:9908
- C:\Windows\System\sWOCcFr.exe
  C:\Windows\System\sWOCcFr.exe
  2⤵
  PID:9932
- C:\Windows\System\QYxAXYc.exe
  C:\Windows\System\QYxAXYc.exe
  2⤵
  PID:9956
- C:\Windows\System\hKzUvcs.exe
  C:\Windows\System\hKzUvcs.exe
  2⤵
  PID:9980
- C:\Windows\System\lnGmqft.exe
  C:\Windows\System\lnGmqft.exe
  2⤵
  PID:10020
- C:\Windows\System\TtgpiXX.exe
  C:\Windows\System\TtgpiXX.exe
  2⤵
  PID:10036
- C:\Windows\System\GpyyOSq.exe
  C:\Windows\System\GpyyOSq.exe
  2⤵
  PID:10060
- C:\Windows\System\rYlnOyB.exe
  C:\Windows\System\rYlnOyB.exe
  2⤵
  PID:10084
- C:\Windows\System\xNPuCwA.exe
  C:\Windows\System\xNPuCwA.exe
  2⤵
  PID:10108
- C:\Windows\System\TkxbYqm.exe
  C:\Windows\System\TkxbYqm.exe
  2⤵
  PID:10160
- C:\Windows\System\dHFmEkV.exe
  C:\Windows\System\dHFmEkV.exe
  2⤵
  PID:10188
- C:\Windows\System\PeSdEeT.exe
  C:\Windows\System\PeSdEeT.exe
  2⤵
  PID:10216
- C:\Windows\System\rjUrkjK.exe
  C:\Windows\System\rjUrkjK.exe
  2⤵
  PID:10236
- C:\Windows\System\gXEBwhr.exe
  C:\Windows\System\gXEBwhr.exe
  2⤵
  PID:9220
- C:\Windows\System\DEkBMfC.exe
  C:\Windows\System\DEkBMfC.exe
  2⤵
  PID:9248
- C:\Windows\System\xEvJNmi.exe
  C:\Windows\System\xEvJNmi.exe
  2⤵
  PID:9400
- C:\Windows\System\nKUyvLf.exe
  C:\Windows\System\nKUyvLf.exe
  2⤵
  PID:9448
- C:\Windows\System\iqnCUgL.exe
  C:\Windows\System\iqnCUgL.exe
  2⤵
  PID:9484
- C:\Windows\System\amwwfbz.exe
  C:\Windows\System\amwwfbz.exe
  2⤵
  PID:9552
- C:\Windows\System\WusVIBR.exe
  C:\Windows\System\WusVIBR.exe
  2⤵
  PID:9616
- C:\Windows\System\GnWtfaU.exe
  C:\Windows\System\GnWtfaU.exe
  2⤵
  PID:9668
- C:\Windows\System\zgakBCu.exe
  C:\Windows\System\zgakBCu.exe
  2⤵
  PID:9728
- C:\Windows\System\lLntTnA.exe
  C:\Windows\System\lLntTnA.exe
  2⤵
  PID:9792
- C:\Windows\System\kEiVjVN.exe
  C:\Windows\System\kEiVjVN.exe
  2⤵
  PID:9828
- C:\Windows\System\SBXHdJX.exe
  C:\Windows\System\SBXHdJX.exe
  2⤵
  PID:9904
- C:\Windows\System\UuqpnJZ.exe
  C:\Windows\System\UuqpnJZ.exe
  2⤵
  PID:10016
- C:\Windows\System\MmwjGRS.exe
  C:\Windows\System\MmwjGRS.exe
  2⤵
  PID:10048
- C:\Windows\System\VQkrdpJ.exe
  C:\Windows\System\VQkrdpJ.exe
  2⤵
  PID:10176
- C:\Windows\System\DhGLQkl.exe
  C:\Windows\System\DhGLQkl.exe
  2⤵
  PID:10228
- C:\Windows\System\caTTIHI.exe
  C:\Windows\System\caTTIHI.exe
  2⤵
  PID:9024
- C:\Windows\System\atfBMxe.exe
  C:\Windows\System\atfBMxe.exe
  2⤵
  PID:9336
- C:\Windows\System\GgYpsFf.exe
  C:\Windows\System\GgYpsFf.exe
  2⤵
  PID:9508
- C:\Windows\System\KPYyDUM.exe
  C:\Windows\System\KPYyDUM.exe
  2⤵
  PID:9584
- C:\Windows\System\OAQtOTM.exe
  C:\Windows\System\OAQtOTM.exe
  2⤵
  PID:9924
- C:\Windows\System\EOfJQTd.exe
  C:\Windows\System\EOfJQTd.exe
  2⤵
  PID:10052
- C:\Windows\System\ZKRtzzk.exe
  C:\Windows\System\ZKRtzzk.exe
  2⤵
  PID:10204
- C:\Windows\System\FvdxGih.exe
  C:\Windows\System\FvdxGih.exe
  2⤵
  PID:9464
- C:\Windows\System\TxKdgCJ.exe
  C:\Windows\System\TxKdgCJ.exe
  2⤵
  PID:9644
- C:\Windows\System\tauQyaM.exe
  C:\Windows\System\tauQyaM.exe
  2⤵
  PID:10004
- C:\Windows\System\DXpNroi.exe
  C:\Windows\System\DXpNroi.exe
  2⤵
  PID:9356
- C:\Windows\System\vxRcGTG.exe
  C:\Windows\System\vxRcGTG.exe
  2⤵
  PID:10212
- C:\Windows\System\NavMsge.exe
  C:\Windows\System\NavMsge.exe
  2⤵
  PID:10256
- C:\Windows\System\zZosnoL.exe
  C:\Windows\System\zZosnoL.exe
  2⤵
  PID:10280
- C:\Windows\System\VDALIOO.exe
  C:\Windows\System\VDALIOO.exe
  2⤵
  PID:10320
- C:\Windows\System\aYWIcHe.exe
  C:\Windows\System\aYWIcHe.exe
  2⤵
  PID:10340
- C:\Windows\System\xVsbBRn.exe
  C:\Windows\System\xVsbBRn.exe
  2⤵
  PID:10364
- C:\Windows\System\hJvCkTm.exe
  C:\Windows\System\hJvCkTm.exe
  2⤵
  PID:10416
- C:\Windows\System\tjhdOkm.exe
  C:\Windows\System\tjhdOkm.exe
  2⤵
  PID:10436
- C:\Windows\System\EuEkzxR.exe
  C:\Windows\System\EuEkzxR.exe
  2⤵
  PID:10464
- C:\Windows\System\RdJBLuW.exe
  C:\Windows\System\RdJBLuW.exe
  2⤵
  PID:10484
- C:\Windows\System\HxnOwVy.exe
  C:\Windows\System\HxnOwVy.exe
  2⤵
  PID:10520
- C:\Windows\System\lpMrayI.exe
  C:\Windows\System\lpMrayI.exe
  2⤵
  PID:10552
- C:\Windows\System\sAcCkQc.exe
  C:\Windows\System\sAcCkQc.exe
  2⤵
  PID:10576
- C:\Windows\System\ClvOYZk.exe
  C:\Windows\System\ClvOYZk.exe
  2⤵
  PID:10604
- C:\Windows\System\rTxFFkR.exe
  C:\Windows\System\rTxFFkR.exe
  2⤵
  PID:10632
- C:\Windows\System\IwvcqCI.exe
  C:\Windows\System\IwvcqCI.exe
  2⤵
  PID:10648
- C:\Windows\System\xjxFNoD.exe
  C:\Windows\System\xjxFNoD.exe
  2⤵
  PID:10668
- C:\Windows\System\aHgvPbq.exe
  C:\Windows\System\aHgvPbq.exe
  2⤵
  PID:10712
- C:\Windows\System\KLowPhO.exe
  C:\Windows\System\KLowPhO.exe
  2⤵
  PID:10740
- C:\Windows\System\ohXLurG.exe
  C:\Windows\System\ohXLurG.exe
  2⤵
  PID:10768
- C:\Windows\System\rbCvQJw.exe
  C:\Windows\System\rbCvQJw.exe
  2⤵
  PID:10812
- C:\Windows\System\pmojouW.exe
  C:\Windows\System\pmojouW.exe
  2⤵
  PID:10828
- C:\Windows\System\kdaYEum.exe
  C:\Windows\System\kdaYEum.exe
  2⤵
  PID:10844
- C:\Windows\System\vnTNAJJ.exe
  C:\Windows\System\vnTNAJJ.exe
  2⤵
  PID:10868
- C:\Windows\System\wvgGccc.exe
  C:\Windows\System\wvgGccc.exe
  2⤵
  PID:10920
- C:\Windows\System\NswWYYz.exe
  C:\Windows\System\NswWYYz.exe
  2⤵
  PID:10940
- C:\Windows\System\XWioHIR.exe
  C:\Windows\System\XWioHIR.exe
  2⤵
  PID:10968
- C:\Windows\System\XaTmMfA.exe
  C:\Windows\System\XaTmMfA.exe
  2⤵
  PID:11000
- C:\Windows\System\VsMSaZu.exe
  C:\Windows\System\VsMSaZu.exe
  2⤵
  PID:11024
- C:\Windows\System\LOCgowr.exe
  C:\Windows\System\LOCgowr.exe
  2⤵
  PID:11052
- C:\Windows\System\MoZuKMP.exe
  C:\Windows\System\MoZuKMP.exe
  2⤵
  PID:11080
- C:\Windows\System\AqoqylE.exe
  C:\Windows\System\AqoqylE.exe
  2⤵
  PID:11120
- C:\Windows\System\IFljLrc.exe
  C:\Windows\System\IFljLrc.exe
  2⤵
  PID:11136
- C:\Windows\System\QZkjayr.exe
  C:\Windows\System\QZkjayr.exe
  2⤵
  PID:11164
- C:\Windows\System\mTTrucs.exe
  C:\Windows\System\mTTrucs.exe
  2⤵
  PID:11184
- C:\Windows\System\DZVmryO.exe
  C:\Windows\System\DZVmryO.exe
  2⤵
  PID:11208
- C:\Windows\System\ElWzsZI.exe
  C:\Windows\System\ElWzsZI.exe
  2⤵
  PID:11244
- C:\Windows\System\cFcVsur.exe
  C:\Windows\System\cFcVsur.exe
  2⤵
  PID:9360
- C:\Windows\System\aLotXge.exe
  C:\Windows\System\aLotXge.exe
  2⤵
  PID:10272
- C:\Windows\System\GVenibX.exe
  C:\Windows\System\GVenibX.exe
  2⤵
  PID:10356
- C:\Windows\System\JONAqoA.exe
  C:\Windows\System\JONAqoA.exe
  2⤵
  PID:10428
- C:\Windows\System\bgfcTkk.exe
  C:\Windows\System\bgfcTkk.exe
  2⤵
  PID:10480
- C:\Windows\System\nsAlYLO.exe
  C:\Windows\System\nsAlYLO.exe
  2⤵
  PID:10564
- C:\Windows\System\AyrIYBp.exe
  C:\Windows\System\AyrIYBp.exe
  2⤵
  PID:10640
- C:\Windows\System\dggXfmY.exe
  C:\Windows\System\dggXfmY.exe
  2⤵
  PID:10656
- C:\Windows\System\WytqzNN.exe
  C:\Windows\System\WytqzNN.exe
  2⤵
  PID:10736
- C:\Windows\System\MbYnVql.exe
  C:\Windows\System\MbYnVql.exe
  2⤵
  PID:10808
- C:\Windows\System\FScRGxa.exe
  C:\Windows\System\FScRGxa.exe
  2⤵
  PID:10836
- C:\Windows\System\gGaiVRY.exe
  C:\Windows\System\gGaiVRY.exe
  2⤵
  PID:10996
- C:\Windows\System\TKlxXwa.exe
  C:\Windows\System\TKlxXwa.exe
  2⤵
  PID:11040
- C:\Windows\System\SqkUCMC.exe
  C:\Windows\System\SqkUCMC.exe
  2⤵
  PID:11172
- C:\Windows\System\CxCPfzq.exe
  C:\Windows\System\CxCPfzq.exe
  2⤵
  PID:11228
- C:\Windows\System\khpiOdf.exe
  C:\Windows\System\khpiOdf.exe
  2⤵
  PID:11200
- C:\Windows\System\eBAkIBZ.exe
  C:\Windows\System\eBAkIBZ.exe
  2⤵
  PID:10332
- C:\Windows\System\rbNyUao.exe
  C:\Windows\System\rbNyUao.exe
  2⤵
  PID:10472
- C:\Windows\System\OfQYdMn.exe
  C:\Windows\System\OfQYdMn.exe
  2⤵
  PID:10592
- C:\Windows\System\QZJiZfa.exe
  C:\Windows\System\QZJiZfa.exe
  2⤵
  PID:10764
- C:\Windows\System\RWMPNaX.exe
  C:\Windows\System\RWMPNaX.exe
  2⤵
  PID:10904
- C:\Windows\System\BbFJPyf.exe
  C:\Windows\System\BbFJPyf.exe
  2⤵
  PID:11020
- C:\Windows\System\glDPKPH.exe
  C:\Windows\System\glDPKPH.exe
  2⤵
  PID:11152
- C:\Windows\System\foOERNi.exe
  C:\Windows\System\foOERNi.exe
  2⤵
  PID:11240
- C:\Windows\System\OCjfdpR.exe
  C:\Windows\System\OCjfdpR.exe
  2⤵
  PID:9608
- C:\Windows\System\UobGhAI.exe
  C:\Windows\System\UobGhAI.exe
  2⤵
  PID:10748
- C:\Windows\System\wAFQkak.exe
  C:\Windows\System\wAFQkak.exe
  2⤵
  PID:10960
- C:\Windows\System\QZtmtuB.exe
  C:\Windows\System\QZtmtuB.exe
  2⤵
  PID:11180
- C:\Windows\System\qtaHPGJ.exe
  C:\Windows\System\qtaHPGJ.exe
  2⤵
  PID:11288
- C:\Windows\System\TKxvlJS.exe
  C:\Windows\System\TKxvlJS.exe
  2⤵
  PID:11336
- C:\Windows\System\BwMLjYX.exe
  C:\Windows\System\BwMLjYX.exe
  2⤵
  PID:11364
- C:\Windows\System\IgpAxMK.exe
  C:\Windows\System\IgpAxMK.exe
  2⤵
  PID:11388
- C:\Windows\System\ZCOobph.exe
  C:\Windows\System\ZCOobph.exe
  2⤵
  PID:11416
- C:\Windows\System\HVbmUFC.exe
  C:\Windows\System\HVbmUFC.exe
  2⤵
  PID:11456
- C:\Windows\System\hRHyqnz.exe
  C:\Windows\System\hRHyqnz.exe
  2⤵
  PID:11496
- C:\Windows\System\pMBpSYT.exe
  C:\Windows\System\pMBpSYT.exe
  2⤵
  PID:11512
- C:\Windows\System\ALjZAuC.exe
  C:\Windows\System\ALjZAuC.exe
  2⤵
  PID:11528
- C:\Windows\System\YuwMiJX.exe
  C:\Windows\System\YuwMiJX.exe
  2⤵
  PID:11544
- C:\Windows\System\chNcQeD.exe
  C:\Windows\System\chNcQeD.exe
  2⤵
  PID:11568
- C:\Windows\System\NiurAmQ.exe
  C:\Windows\System\NiurAmQ.exe
  2⤵
  PID:11604
- C:\Windows\System\TXtnOKz.exe
  C:\Windows\System\TXtnOKz.exe
  2⤵
  PID:11656
- C:\Windows\System\naYRycJ.exe
  C:\Windows\System\naYRycJ.exe
  2⤵
  PID:11676
- C:\Windows\System\eoCJfNT.exe
  C:\Windows\System\eoCJfNT.exe
  2⤵
  PID:11696
- C:\Windows\System\JrDhPwH.exe
  C:\Windows\System\JrDhPwH.exe
  2⤵
  PID:11720
- C:\Windows\System\dMDLHpN.exe
  C:\Windows\System\dMDLHpN.exe
  2⤵
  PID:11776
- C:\Windows\System\mLvIXum.exe
  C:\Windows\System\mLvIXum.exe
  2⤵
  PID:11796
- C:\Windows\System\QkNGULQ.exe
  C:\Windows\System\QkNGULQ.exe
  2⤵
  PID:11820
- C:\Windows\System\oZTTvxA.exe
  C:\Windows\System\oZTTvxA.exe
  2⤵
  PID:11836
- C:\Windows\System\rrSeOAS.exe
  C:\Windows\System\rrSeOAS.exe
  2⤵
  PID:11876
- C:\Windows\System\ksTdxcu.exe
  C:\Windows\System\ksTdxcu.exe
  2⤵
  PID:11904
- C:\Windows\System\tCifBNx.exe
  C:\Windows\System\tCifBNx.exe
  2⤵
  PID:11944
- C:\Windows\System\yelSLxc.exe
  C:\Windows\System\yelSLxc.exe
  2⤵
  PID:11972
- C:\Windows\System\aFKKJXJ.exe
  C:\Windows\System\aFKKJXJ.exe
  2⤵
  PID:11988
- C:\Windows\System\INAxbKl.exe
  C:\Windows\System\INAxbKl.exe
  2⤵
  PID:12012
- C:\Windows\System\sJcKmza.exe
  C:\Windows\System\sJcKmza.exe
  2⤵
  PID:12032
- C:\Windows\System\TJknFSD.exe
  C:\Windows\System\TJknFSD.exe
  2⤵
  PID:12076
- C:\Windows\System\RoGWZxb.exe
  C:\Windows\System\RoGWZxb.exe
  2⤵
  PID:12104
- C:\Windows\System\OekpjvS.exe
  C:\Windows\System\OekpjvS.exe
  2⤵
  PID:12128
- C:\Windows\System\ptFHRLQ.exe
  C:\Windows\System\ptFHRLQ.exe
  2⤵
  PID:12168
- C:\Windows\System\ateXpSe.exe
  C:\Windows\System\ateXpSe.exe
  2⤵
  PID:12184
- C:\Windows\System\TdyOmGf.exe
  C:\Windows\System\TdyOmGf.exe
  2⤵
  PID:12204
- C:\Windows\System\RtrprPG.exe
  C:\Windows\System\RtrprPG.exe
  2⤵
  PID:12232
- C:\Windows\System\yrMuOvg.exe
  C:\Windows\System\yrMuOvg.exe
  2⤵
  PID:12280
- C:\Windows\System\WYWgHVe.exe
  C:\Windows\System\WYWgHVe.exe
  2⤵
  PID:10560
- C:\Windows\System\ppPOfyX.exe
  C:\Windows\System\ppPOfyX.exe
  2⤵
  PID:10980
- C:\Windows\System\PPpZrkf.exe
  C:\Windows\System\PPpZrkf.exe
  2⤵
  PID:11372
- C:\Windows\System\JAfOBDR.exe
  C:\Windows\System\JAfOBDR.exe
  2⤵
  PID:11408
- C:\Windows\System\tezhqxz.exe
  C:\Windows\System\tezhqxz.exe
  2⤵
  PID:11488
- C:\Windows\System\kqwGikL.exe
  C:\Windows\System\kqwGikL.exe
  2⤵
  PID:11536
- C:\Windows\System\qfvnfuw.exe
  C:\Windows\System\qfvnfuw.exe
  2⤵
  PID:11672
- C:\Windows\System\tWduwuj.exe
  C:\Windows\System\tWduwuj.exe
  2⤵
  PID:11692
- C:\Windows\System\ZPFffMQ.exe
  C:\Windows\System\ZPFffMQ.exe
  2⤵
  PID:11772
- C:\Windows\System\GkKFhnY.exe
  C:\Windows\System\GkKFhnY.exe
  2⤵
  PID:11812
- C:\Windows\System\pVSQciN.exe
  C:\Windows\System\pVSQciN.exe
  2⤵
  PID:11892
- C:\Windows\System\oIgXBXo.exe
  C:\Windows\System\oIgXBXo.exe
  2⤵
  PID:11960
- C:\Windows\System\KmushhH.exe
  C:\Windows\System\KmushhH.exe
  2⤵
  PID:12044
- C:\Windows\System\hhFVMth.exe
  C:\Windows\System\hhFVMth.exe
  2⤵
  PID:12112
- C:\Windows\System\piPLSPO.exe
  C:\Windows\System\piPLSPO.exe
  2⤵
  PID:10956
- C:\Windows\System\NFZONLp.exe
  C:\Windows\System\NFZONLp.exe
  2⤵
  PID:12192
- C:\Windows\System\hlzbPAW.exe
  C:\Windows\System\hlzbPAW.exe
  2⤵
  PID:11148
- C:\Windows\System\ksGnfKL.exe
  C:\Windows\System\ksGnfKL.exe
  2⤵
  PID:11280
- C:\Windows\System\PIuLOax.exe
  C:\Windows\System\PIuLOax.exe
  2⤵
  PID:11448
- C:\Windows\System\bjBCSNz.exe
  C:\Windows\System\bjBCSNz.exe
  2⤵
  PID:11540
- C:\Windows\System\ailehTr.exe
  C:\Windows\System\ailehTr.exe
  2⤵
  PID:11816
- C:\Windows\System\TGsUYWo.exe
  C:\Windows\System\TGsUYWo.exe
  2⤵
  PID:11924
- C:\Windows\System\OwdvEcK.exe
  C:\Windows\System\OwdvEcK.exe
  2⤵
  PID:12124
- C:\Windows\System\vXeuzHM.exe
  C:\Windows\System\vXeuzHM.exe
  2⤵
  PID:12224
- C:\Windows\System\baNIwLz.exe
  C:\Windows\System\baNIwLz.exe
  2⤵
  PID:11312
- C:\Windows\System\XPrnCLN.exe
  C:\Windows\System\XPrnCLN.exe
  2⤵
  PID:11584
- C:\Windows\System\jRQDAoh.exe
  C:\Windows\System\jRQDAoh.exe
  2⤵
  PID:12176
- C:\Windows\System\OVbKtLF.exe
  C:\Windows\System\OVbKtLF.exe
  2⤵
  PID:11872
- C:\Windows\System\bQFJGuD.exe
  C:\Windows\System\bQFJGuD.exe
  2⤵
  PID:11752
- C:\Windows\System\BdQCLYy.exe
  C:\Windows\System\BdQCLYy.exe
  2⤵
  PID:12324
- C:\Windows\System\QnAoVOF.exe
  C:\Windows\System\QnAoVOF.exe
  2⤵
  PID:12348
- C:\Windows\System\XXnHfgN.exe
  C:\Windows\System\XXnHfgN.exe
  2⤵
  PID:12368
- C:\Windows\System\jxOnmAG.exe
  C:\Windows\System\jxOnmAG.exe
  2⤵
  PID:12396
- C:\Windows\System\zMOfMRD.exe
  C:\Windows\System\zMOfMRD.exe
  2⤵
  PID:12412
- C:\Windows\System\EHUZVMM.exe
  C:\Windows\System\EHUZVMM.exe
  2⤵
  PID:12432
- C:\Windows\System\irXbJUg.exe
  C:\Windows\System\irXbJUg.exe
  2⤵
  PID:12452
- C:\Windows\System\BESqLTn.exe
  C:\Windows\System\BESqLTn.exe
  2⤵
  PID:12516
- C:\Windows\System\qgdkyDP.exe
  C:\Windows\System\qgdkyDP.exe
  2⤵
  PID:12536
- C:\Windows\System\bfYrnnD.exe
  C:\Windows\System\bfYrnnD.exe
  2⤵
  PID:12556
- C:\Windows\System\XMZUDjo.exe
  C:\Windows\System\XMZUDjo.exe
  2⤵
  PID:12576
- C:\Windows\System\YFFmfVM.exe
  C:\Windows\System\YFFmfVM.exe
  2⤵
  PID:12596
- C:\Windows\System\Omhxbpy.exe
  C:\Windows\System\Omhxbpy.exe
  2⤵
  PID:12644
- C:\Windows\System\BLEcfAL.exe
  C:\Windows\System\BLEcfAL.exe
  2⤵
  PID:12664
- C:\Windows\System\paPYLDT.exe
  C:\Windows\System\paPYLDT.exe
  2⤵
  PID:12708
- C:\Windows\System\ULAhSoQ.exe
  C:\Windows\System\ULAhSoQ.exe
  2⤵
  PID:12728
- C:\Windows\System\nsXfkAx.exe
  C:\Windows\System\nsXfkAx.exe
  2⤵
  PID:12748
- C:\Windows\System\QQcZCuW.exe
  C:\Windows\System\QQcZCuW.exe
  2⤵
  PID:12800
- C:\Windows\System\QAgRrxx.exe
  C:\Windows\System\QAgRrxx.exe
  2⤵
  PID:12820
- C:\Windows\System\LkxAtPo.exe
  C:\Windows\System\LkxAtPo.exe
  2⤵
  PID:12844
- C:\Windows\System\aRlaTwe.exe
  C:\Windows\System\aRlaTwe.exe
  2⤵
  PID:12880
- C:\Windows\System\oaVlXsz.exe
  C:\Windows\System\oaVlXsz.exe
  2⤵
  PID:12904
- C:\Windows\System\NeGbZAd.exe
  C:\Windows\System\NeGbZAd.exe
  2⤵
  PID:12928
- C:\Windows\System\bplODLV.exe
  C:\Windows\System\bplODLV.exe
  2⤵
  PID:12968
- C:\Windows\System\yIpWDbZ.exe
  C:\Windows\System\yIpWDbZ.exe
  2⤵
  PID:12988
- C:\Windows\System\uUFgKbu.exe
  C:\Windows\System\uUFgKbu.exe
  2⤵
  PID:13020
- C:\Windows\System\ByxbZPF.exe
  C:\Windows\System\ByxbZPF.exe
  2⤵
  PID:13052
- C:\Windows\System\ZTKTrRo.exe
  C:\Windows\System\ZTKTrRo.exe
  2⤵
  PID:13076
- C:\Windows\System\kqxRsfX.exe
  C:\Windows\System\kqxRsfX.exe
  2⤵
  PID:13096
- C:\Windows\System\mGExdiT.exe
  C:\Windows\System\mGExdiT.exe
  2⤵
  PID:13120
- C:\Windows\System\PsvJjLD.exe
  C:\Windows\System\PsvJjLD.exe
  2⤵
  PID:13152
- C:\Windows\System\brIvYey.exe
  C:\Windows\System\brIvYey.exe
  2⤵
  PID:13168
- C:\Windows\System\qKdUCbB.exe
  C:\Windows\System\qKdUCbB.exe
  2⤵
  PID:13192
- C:\Windows\System\tWZdDRN.exe
  C:\Windows\System\tWZdDRN.exe
  2⤵
  PID:13252
- C:\Windows\System\QjEWyJc.exe
  C:\Windows\System\QjEWyJc.exe
  2⤵
  PID:13268
- C:\Windows\System\ircDiUB.exe
  C:\Windows\System\ircDiUB.exe
  2⤵
  PID:13288
- C:\Windows\System\rsgqeBu.exe
  C:\Windows\System\rsgqeBu.exe
  2⤵
  PID:12140
- C:\Windows\System\wLZskim.exe
  C:\Windows\System\wLZskim.exe
  2⤵
  PID:12356
- C:\Windows\System\NbGycmq.exe
  C:\Windows\System\NbGycmq.exe
  2⤵
  PID:12380
- C:\Windows\System\VQsijzI.exe
  C:\Windows\System\VQsijzI.exe
  2⤵
  PID:12472
- C:\Windows\System\riYriag.exe
  C:\Windows\System\riYriag.exe
  2⤵
  PID:12588
- C:\Windows\System\ZvncOHf.exe
  C:\Windows\System\ZvncOHf.exe
  2⤵
  PID:12636
- C:\Windows\System\xYUliTX.exe
  C:\Windows\System\xYUliTX.exe
  2⤵
  PID:12684
- C:\Windows\System\SSTcmds.exe
  C:\Windows\System\SSTcmds.exe
  2⤵
  PID:12768
- C:\Windows\System\nslXFbz.exe
  C:\Windows\System\nslXFbz.exe
  2⤵
  PID:12836
- C:\Windows\System\xFrBgXS.exe
  C:\Windows\System\xFrBgXS.exe
  2⤵
  PID:12888
- C:\Windows\System\ksuXfkB.exe
  C:\Windows\System\ksuXfkB.exe
  2⤵
  PID:12984
- C:\Windows\System\bRKmrKD.exe
  C:\Windows\System\bRKmrKD.exe
  2⤵
  PID:13040
- C:\Windows\System\nLYhVGD.exe
  C:\Windows\System\nLYhVGD.exe
  2⤵
  PID:13060
- C:\Windows\System\FfvXVAa.exe
  C:\Windows\System\FfvXVAa.exe
  2⤵
  PID:13136
- C:\Windows\System\szXpxWL.exe
  C:\Windows\System\szXpxWL.exe
  2⤵
  PID:13160
- C:\Windows\System\sHWOzaI.exe
  C:\Windows\System\sHWOzaI.exe
  2⤵
  PID:13284
- C:\Windows\System\HwXwJCR.exe
  C:\Windows\System\HwXwJCR.exe
  2⤵
  PID:4696
- C:\Windows\System\fTwXwUk.exe
  C:\Windows\System\fTwXwUk.exe
  2⤵
  PID:12532
- C:\Windows\System\ZjNJpRM.exe
  C:\Windows\System\ZjNJpRM.exe
  2⤵
  PID:12652
- C:\Windows\System\KGeeBDC.exe
  C:\Windows\System\KGeeBDC.exe
  2⤵
  PID:12760
- C:\Windows\System\xwdKFuQ.exe
  C:\Windows\System\xwdKFuQ.exe
  2⤵
  PID:12872
- C:\Windows\System\BaqjYYR.exe
  C:\Windows\System\BaqjYYR.exe
  2⤵
  PID:12964
- C:\Windows\System\xINARvC.exe
  C:\Windows\System\xINARvC.exe
  2⤵
  PID:13112
- C:\Windows\System\RgOSlAQ.exe
  C:\Windows\System\RgOSlAQ.exe
  2⤵
  PID:12308
- C:\Windows\System\kyUptfl.exe
  C:\Windows\System\kyUptfl.exe
  2⤵
  PID:12948
- C:\Windows\System\poqMBzV.exe
  C:\Windows\System\poqMBzV.exe
  2⤵
  PID:13072
- C:\Windows\System\FCLVEXH.exe
  C:\Windows\System\FCLVEXH.exe
  2⤵
  PID:12724
- C:\Windows\System\uxxeQKi.exe
  C:\Windows\System\uxxeQKi.exe
  2⤵
  PID:13324
- C:\Windows\System\vELtAHh.exe
  C:\Windows\System\vELtAHh.exe
  2⤵
  PID:13356
- C:\Windows\System\raZLtUM.exe
  C:\Windows\System\raZLtUM.exe
  2⤵
  PID:13384
- C:\Windows\System\NgzPofG.exe
  C:\Windows\System\NgzPofG.exe
  2⤵
  PID:13420
- C:\Windows\System\fKeKKWO.exe
  C:\Windows\System\fKeKKWO.exe
  2⤵
  PID:13444
- C:\Windows\System\KacjoHJ.exe
  C:\Windows\System\KacjoHJ.exe
  2⤵
  PID:13468
- C:\Windows\System\sgdwuQR.exe
  C:\Windows\System\sgdwuQR.exe
  2⤵
  PID:13500
- C:\Windows\System\drBjLMN.exe
  C:\Windows\System\drBjLMN.exe
  2⤵
  PID:13524
- C:\Windows\System\tIszhIq.exe
  C:\Windows\System\tIszhIq.exe
  2⤵
  PID:13552
- C:\Windows\System\nXgjdAr.exe
  C:\Windows\System\nXgjdAr.exe
  2⤵
  PID:13572
- C:\Windows\System\jFpgfcg.exe
  C:\Windows\System\jFpgfcg.exe
  2⤵
  PID:13612
- C:\Windows\System\tNiAopU.exe
  C:\Windows\System\tNiAopU.exe
  2⤵
  PID:13636
- C:\Windows\System\fIreOgc.exe
  C:\Windows\System\fIreOgc.exe
  2⤵
  PID:13664
- C:\Windows\System\yxjBPzy.exe
  C:\Windows\System\yxjBPzy.exe
  2⤵
  PID:13684
- C:\Windows\System\LLfLqhc.exe
  C:\Windows\System\LLfLqhc.exe
  2⤵
  PID:13720
- C:\Windows\System\RfeQTrO.exe
  C:\Windows\System\RfeQTrO.exe
  2⤵
  PID:13744
- C:\Windows\System\TEqJCuA.exe
  C:\Windows\System\TEqJCuA.exe
  2⤵
  PID:13760
- C:\Windows\System\kXabfHn.exe
  C:\Windows\System\kXabfHn.exe
  2⤵
  PID:13780
- C:\Windows\System\eloUdle.exe
  C:\Windows\System\eloUdle.exe
  2⤵
  PID:13828
- C:\Windows\System\iEnwPfv.exe
  C:\Windows\System\iEnwPfv.exe
  2⤵
  PID:13848
- C:\Windows\System\yMeATwI.exe
  C:\Windows\System\yMeATwI.exe
  2⤵
  PID:13892
- C:\Windows\System\aHfLzjK.exe
  C:\Windows\System\aHfLzjK.exe
  2⤵
  PID:13908
- C:\Windows\System\rrPVanL.exe
  C:\Windows\System\rrPVanL.exe
  2⤵
  PID:13928
- C:\Windows\System\FydJcFK.exe
  C:\Windows\System\FydJcFK.exe
  2⤵
  PID:13960
- C:\Windows\System\fyWOYOB.exe
  C:\Windows\System\fyWOYOB.exe
  2⤵
  PID:13980
- C:\Windows\System\QyvtaEw.exe
  C:\Windows\System\QyvtaEw.exe
  2⤵
  PID:14008
- C:\Windows\System\JVsYEjb.exe
  C:\Windows\System\JVsYEjb.exe
  2⤵
  PID:14064
- C:\Windows\System\cqSfmQT.exe
  C:\Windows\System\cqSfmQT.exe
  2⤵
  PID:14080
- C:\Windows\System\VJOnYfl.exe
  C:\Windows\System\VJOnYfl.exe
  2⤵
  PID:14116
- C:\Windows\System\kUBtjVc.exe
  C:\Windows\System\kUBtjVc.exe
  2⤵
  PID:14152
- C:\Windows\System\WIjDcPS.exe
  C:\Windows\System\WIjDcPS.exe
  2⤵
  PID:14168
- C:\Windows\System\DAIBcCf.exe
  C:\Windows\System\DAIBcCf.exe
  2⤵
  PID:14188
- C:\Windows\System\ADCTxyZ.exe
  C:\Windows\System\ADCTxyZ.exe
  2⤵
  PID:14236
- C:\Windows\System\QbErkRZ.exe
  C:\Windows\System\QbErkRZ.exe
  2⤵
  PID:14256
- C:\Windows\System\yVteqto.exe
  C:\Windows\System\yVteqto.exe
  2⤵
  PID:14288
- C:\Windows\System\FOPGnrx.exe
  C:\Windows\System\FOPGnrx.exe
  2⤵
  PID:14332
- C:\Windows\System\SHgkjuX.exe
  C:\Windows\System\SHgkjuX.exe
  2⤵
  PID:12568
- C:\Windows\System\LVcvMDn.exe
  C:\Windows\System\LVcvMDn.exe
  2⤵
  PID:13404
- C:\Windows\System\IFWDLYM.exe
  C:\Windows\System\IFWDLYM.exe
  2⤵
  PID:13436
- C:\Windows\System\yTQlmTr.exe
  C:\Windows\System\yTQlmTr.exe
  2⤵
  PID:13508
- C:\Windows\System\gQeOhmM.exe
  C:\Windows\System\gQeOhmM.exe
  2⤵
  PID:13540
- C:\Windows\System\WMtQoPH.exe
  C:\Windows\System\WMtQoPH.exe
  2⤵
  PID:13568
- C:\Windows\System\NXOiPcm.exe
  C:\Windows\System\NXOiPcm.exe
  2⤵
  PID:13600
- C:\Windows\System\JgrmlFC.exe
  C:\Windows\System\JgrmlFC.exe
  2⤵
  PID:13712
- C:\Windows\System\sVYYUVg.exe
  C:\Windows\System\sVYYUVg.exe
  2⤵
  PID:13820
- C:\Windows\System\pbOmpOW.exe
  C:\Windows\System\pbOmpOW.exe
  2⤵
  PID:13968
- C:\Windows\System\MRRKREt.exe
  C:\Windows\System\MRRKREt.exe
  2⤵
  PID:14004
- C:\Windows\System\pYjAkcr.exe
  C:\Windows\System\pYjAkcr.exe
  2⤵
  PID:14052
- C:\Windows\System\bGOYxHy.exe
  C:\Windows\System\bGOYxHy.exe
  2⤵
  PID:14092
- C:\Windows\System\EzUEEcW.exe
  C:\Windows\System\EzUEEcW.exe
  2⤵
  PID:14200
- C:\Windows\System\HJqVawS.exe
  C:\Windows\System\HJqVawS.exe
  2⤵
  PID:14228
- C:\Windows\System\iHSklXS.exe
  C:\Windows\System\iHSklXS.exe
  2⤵
  PID:14284
- C:\Windows\System\gogWCyi.exe
  C:\Windows\System\gogWCyi.exe
  2⤵
  PID:14312
- C:\Windows\System\MJZbrYn.exe
  C:\Windows\System\MJZbrYn.exe
  2⤵
  PID:13516
- C:\Windows\System\NdiDset.exe
  C:\Windows\System\NdiDset.exe
  2⤵
  PID:13624
- C:\Windows\System\AcnJYII.exe
  C:\Windows\System\AcnJYII.exe
  2⤵
  PID:13740
- C:\Windows\System\qgylrIT.exe
  C:\Windows\System\qgylrIT.exe
  2⤵
  PID:13880
- C:\Windows\System\tCxLLfN.exe
  C:\Windows\System\tCxLLfN.exe
  2⤵
  PID:14148
- C:\Windows\System\IgnUQjI.exe
  C:\Windows\System\IgnUQjI.exe
  2⤵
  PID:14280
- C:\Windows\System\mDjyMgX.exe
  C:\Windows\System\mDjyMgX.exe
  2⤵
  PID:13352
- C:\Windows\System\XzWGOYZ.exe
  C:\Windows\System\XzWGOYZ.exe
  2⤵
  PID:13564
- C:\Windows\System\rxswQNG.exe
  C:\Windows\System\rxswQNG.exe
  2⤵
  PID:14276
- C:\Windows\System\bSnNOkL.exe
  C:\Windows\System\bSnNOkL.exe
  2⤵
  PID:13948
- C:\Windows\System\hkJNLFY.exe
  C:\Windows\System\hkJNLFY.exe
  2⤵
  PID:13696
- C:\Windows\System\kBlUrmT.exe
  C:\Windows\System\kBlUrmT.exe
  2⤵
  PID:14352
- C:\Windows\System\dWGTmHG.exe
  C:\Windows\System\dWGTmHG.exe
  2⤵
  PID:14368
- C:\Windows\System\qgwPLuD.exe
  C:\Windows\System\qgwPLuD.exe
  2⤵
  PID:14400
- C:\Windows\System\ZVuvuUh.exe
  C:\Windows\System\ZVuvuUh.exe
  2⤵
  PID:14432
- C:\Windows\System\QcXsxvn.exe
  C:\Windows\System\QcXsxvn.exe
  2⤵
  PID:14484
- C:\Windows\System\mxshoQv.exe
  C:\Windows\System\mxshoQv.exe
  2⤵
  PID:14500
- C:\Windows\System\PnSvKAL.exe
  C:\Windows\System\PnSvKAL.exe
  2⤵
  PID:14520
- C:\Windows\System\cXmEMqv.exe
  C:\Windows\System\cXmEMqv.exe
  2⤵
  PID:14544
- C:\Windows\System\TJGvAZC.exe
  C:\Windows\System\TJGvAZC.exe
  2⤵
  PID:14568
- C:\Windows\System\PJyydPZ.exe
  C:\Windows\System\PJyydPZ.exe
  2⤵
  PID:14604
- C:\Windows\System\oUBXzHN.exe
  C:\Windows\System\oUBXzHN.exe
  2⤵
  PID:14632
- C:\Windows\System\mNbUdUV.exe
  C:\Windows\System\mNbUdUV.exe
  2⤵
  PID:14656
- C:\Windows\System\LUHkPJw.exe
  C:\Windows\System\LUHkPJw.exe
  2⤵
  PID:14676
- C:\Windows\System\euwLXXt.exe
  C:\Windows\System\euwLXXt.exe
  2⤵
  PID:14720
- C:\Windows\System\sCjuKPf.exe
  C:\Windows\System\sCjuKPf.exe
  2⤵
  PID:14740
- C:\Windows\System\iKAiZSy.exe
  C:\Windows\System\iKAiZSy.exe
  2⤵
  PID:14756
- C:\Windows\System\JpYJYjq.exe
  C:\Windows\System\JpYJYjq.exe
  2⤵
  PID:14820
- C:\Windows\System\RVyWuHE.exe
  C:\Windows\System\RVyWuHE.exe
  2⤵
  PID:14836
- C:\Windows\System\CXhZqOC.exe
  C:\Windows\System\CXhZqOC.exe
  2⤵
  PID:14852
- C:\Windows\System\oRRLAGo.exe
  C:\Windows\System\oRRLAGo.exe
  2⤵
  PID:14884
- C:\Windows\System\yAJFwUN.exe
  C:\Windows\System\yAJFwUN.exe
  2⤵
  PID:14908
- C:\Windows\System\vereCUK.exe
  C:\Windows\System\vereCUK.exe
  2⤵
  PID:14940
- C:\Windows\System\RGxRmoZ.exe
  C:\Windows\System\RGxRmoZ.exe
  2⤵
  PID:14968
- C:\Windows\System\fwetyFG.exe
  C:\Windows\System\fwetyFG.exe
  2⤵
  PID:14984
- C:\Windows\System\KRHlmxr.exe
  C:\Windows\System\KRHlmxr.exe
  2⤵
  PID:15000
- C:\Windows\System\mTuHjxI.exe
  C:\Windows\System\mTuHjxI.exe
  2⤵
  PID:15032
- C:\Windows\System\JhdSpRg.exe
  C:\Windows\System\JhdSpRg.exe
  2⤵
  PID:15092
- C:\Windows\System\fwmuMFX.exe
  C:\Windows\System\fwmuMFX.exe
  2⤵
  PID:15112
- C:\Windows\System\qUVKsAa.exe
  C:\Windows\System\qUVKsAa.exe
  2⤵
  PID:15136
- C:\Windows\System\xjUniZg.exe
  C:\Windows\System\xjUniZg.exe
  2⤵
  PID:15156
- C:\Windows\System\MFTSYbb.exe
  C:\Windows\System\MFTSYbb.exe
  2⤵
  PID:15184
- C:\Windows\System\bovmpUX.exe
  C:\Windows\System\bovmpUX.exe
  2⤵
  PID:15204
- C:\Windows\System\LmUqanV.exe
  C:\Windows\System\LmUqanV.exe
  2⤵
  PID:15220
- C:\Windows\System\diKZTvX.exe
  C:\Windows\System\diKZTvX.exe
  2⤵
  PID:15240
- C:\Windows\System\cMjmEgE.exe
  C:\Windows\System\cMjmEgE.exe
  2⤵
  PID:15264
- C:\Windows\System\hgrFKGe.exe
  C:\Windows\System\hgrFKGe.exe
  2⤵
  PID:15280
- C:\Windows\System\czmaDaJ.exe
  C:\Windows\System\czmaDaJ.exe
  2⤵
  PID:15300
- C:\Windows\System\rqhlkbz.exe
  C:\Windows\System\rqhlkbz.exe
  2⤵
  PID:15316
- C:\Windows\System\XOLuSqb.exe
  C:\Windows\System\XOLuSqb.exe
  2⤵
  PID:15332
- C:\Windows\System\YHPIXip.exe
  C:\Windows\System\YHPIXip.exe
  2⤵
  PID:15348
- C:\Windows\System\qjEycVV.exe
  C:\Windows\System\qjEycVV.exe
  2⤵
  PID:14364
- C:\Windows\System\wuhJPqw.exe
  C:\Windows\System\wuhJPqw.exe
  2⤵
  PID:14420
- C:\Windows\System\rwGtwXh.exe
  C:\Windows\System\rwGtwXh.exe
  2⤵
  PID:14492
- C:\Windows\System\HneAtgm.exe
  C:\Windows\System\HneAtgm.exe
  2⤵
  PID:14536
- C:\Windows\System\TNjUZIQ.exe
  C:\Windows\System\TNjUZIQ.exe
  2⤵
  PID:14624
- C:\Windows\System\NgtqYkC.exe
  C:\Windows\System\NgtqYkC.exe
  2⤵
  PID:14664
- C:\Windows\System\LDqKUaf.exe
  C:\Windows\System\LDqKUaf.exe
  2⤵
  PID:14772
- C:\Windows\System\noZnMaQ.exe
  C:\Windows\System\noZnMaQ.exe
  2⤵
  PID:14804
- C:\Windows\System\fWqlZWD.exe
  C:\Windows\System\fWqlZWD.exe
  2⤵
  PID:14876
- C:\Windows\System\waIDIOc.exe
  C:\Windows\System\waIDIOc.exe
  2⤵
  PID:14896
- C:\Windows\System\NXuIvKO.exe
  C:\Windows\System\NXuIvKO.exe
  2⤵
  PID:14976
- C:\Windows\System\zGhujQI.exe
  C:\Windows\System\zGhujQI.exe
  2⤵
  PID:14980
- C:\Windows\System\hnMIcdV.exe
  C:\Windows\System\hnMIcdV.exe
  2⤵
  PID:15076
- C:\Windows\System\iuunrlN.exe
  C:\Windows\System\iuunrlN.exe
  2⤵
  PID:15128
- C:\Windows\System\rOQbZdg.exe
  C:\Windows\System\rOQbZdg.exe
  2⤵
  PID:15152
- C:\Windows\System\VBzcahV.exe
  C:\Windows\System\VBzcahV.exe
  2⤵
  PID:15216
- C:\Windows\System\ddHUBly.exe
  C:\Windows\System\ddHUBly.exe
  2⤵
  PID:15212
- C:\Windows\System\QiSHmJp.exe
  C:\Windows\System\QiSHmJp.exe
  2⤵
  PID:15340
- C:\Windows\System\NEtrLsL.exe
  C:\Windows\System\NEtrLsL.exe
  2⤵
  PID:14340
- C:\Windows\System\ftyDkmT.exe
  C:\Windows\System\ftyDkmT.exe
  2⤵
  PID:15260
- C:\Windows\System\GOvfKey.exe
  C:\Windows\System\GOvfKey.exe
  2⤵
  PID:14628
- C:\Windows\System\OIexFDO.exe
  C:\Windows\System\OIexFDO.exe
  2⤵
  PID:15020
- C:\Windows\System\vnNZVBQ.exe
  C:\Windows\System\vnNZVBQ.exe
  2⤵
  PID:15148
- C:\Windows\System\uLNDlSu.exe
  C:\Windows\System\uLNDlSu.exe
  2⤵
  PID:15376
- C:\Windows\System\tDNJDEX.exe
  C:\Windows\System\tDNJDEX.exe
  2⤵
  PID:15400
- C:\Windows\System\BvRYVwt.exe
  C:\Windows\System\BvRYVwt.exe
  2⤵
  PID:15424
- C:\Windows\System\zMJdJmK.exe
  C:\Windows\System\zMJdJmK.exe
  2⤵
  PID:15448
- C:\Windows\System\FUeuRpC.exe
  C:\Windows\System\FUeuRpC.exe
  2⤵
  PID:15472
- C:\Windows\System\WniLLHL.exe
  C:\Windows\System\WniLLHL.exe
  2⤵
  PID:15492
- C:\Windows\System\rgysuvR.exe
  C:\Windows\System\rgysuvR.exe
  2⤵
  PID:15512
- C:\Windows\System\qeLyyRY.exe
  C:\Windows\System\qeLyyRY.exe
  2⤵
  PID:15784
- C:\Windows\System\pncDFzc.exe
  C:\Windows\System\pncDFzc.exe
  2⤵
  PID:15808
- C:\Windows\System\xOsTQax.exe
  C:\Windows\System\xOsTQax.exe
  2⤵
  PID:15828
- C:\Windows\System\TatVaBS.exe
  C:\Windows\System\TatVaBS.exe
  2⤵
  PID:15848
- C:\Windows\System\CbeYFVO.exe
  C:\Windows\System\CbeYFVO.exe
  2⤵
  PID:15864
- C:\Windows\System\iTYnIeJ.exe
  C:\Windows\System\iTYnIeJ.exe
  2⤵
  PID:15888
- C:\Windows\System\xJloMJE.exe
  C:\Windows\System\xJloMJE.exe
  2⤵
  PID:15904
- C:\Windows\System\semqRCF.exe
  C:\Windows\System\semqRCF.exe
  2⤵
  PID:15928
- C:\Windows\System\ArHEbFf.exe
  C:\Windows\System\ArHEbFf.exe
  2⤵
  PID:15948
- C:\Windows\System\tlzSjgq.exe
  C:\Windows\System\tlzSjgq.exe
  2⤵
  PID:15980
- C:\Windows\System\BQvUWeO.exe
  C:\Windows\System\BQvUWeO.exe
  2⤵
  PID:16000
- C:\Windows\System\ktSQzkb.exe
  C:\Windows\System\ktSQzkb.exe
  2⤵
  PID:16024
- C:\Windows\System\LaVzXCu.exe
  C:\Windows\System\LaVzXCu.exe
  2⤵
  PID:16040
- C:\Windows\System\UKQlfNy.exe
  C:\Windows\System\UKQlfNy.exe
  2⤵
  PID:16060
- C:\Windows\System\cxOzPKm.exe
  C:\Windows\System\cxOzPKm.exe
  2⤵
  PID:16080
- C:\Windows\System\JVJTMFm.exe
  C:\Windows\System\JVJTMFm.exe
  2⤵
  PID:16096
- C:\Windows\System\eInsQJq.exe
  C:\Windows\System\eInsQJq.exe
  2⤵
  PID:16112
- C:\Windows\System\aZRanYT.exe
  C:\Windows\System\aZRanYT.exe
  2⤵
  PID:16140
- C:\Windows\System\NvcbRlH.exe
  C:\Windows\System\NvcbRlH.exe
  2⤵
  PID:16156
- C:\Windows\System\TOlmkTH.exe
  C:\Windows\System\TOlmkTH.exe
  2⤵
  PID:16172
- C:\Windows\System\PPReFOt.exe
  C:\Windows\System\PPReFOt.exe
  2⤵
  PID:16192
- C:\Windows\System\JZwxmbl.exe
  C:\Windows\System\JZwxmbl.exe
  2⤵
  PID:16220
- C:\Windows\System\oIJGbUQ.exe
  C:\Windows\System\oIJGbUQ.exe
  2⤵
  PID:16248
- C:\Windows\System\XThvXrN.exe
  C:\Windows\System\XThvXrN.exe
  2⤵
  PID:16264
- C:\Windows\System\GZLQlpe.exe
  C:\Windows\System\GZLQlpe.exe
  2⤵
  PID:16284
- C:\Windows\System\VlwBgsa.exe
  C:\Windows\System\VlwBgsa.exe
  2⤵
  PID:16308
- C:\Windows\System\OYepxxo.exe
  C:\Windows\System\OYepxxo.exe
  2⤵
  PID:16336
- C:\Windows\System\RctyCyD.exe
  C:\Windows\System\RctyCyD.exe
  2⤵
  PID:16352
- C:\Windows\System\vYPSaVT.exe
  C:\Windows\System\vYPSaVT.exe
  2⤵
  PID:16380
- C:\Windows\System\xcvwitY.exe
  C:\Windows\System\xcvwitY.exe
  2⤵
  PID:14416
- C:\Windows\System\HsjWDtA.exe
  C:\Windows\System\HsjWDtA.exe
  2⤵
  PID:14672
- C:\Windows\System\BkQJMqn.exe
  C:\Windows\System\BkQJMqn.exe
  2⤵
  PID:15124
- C:\Windows\System\FyEYHCd.exe
  C:\Windows\System\FyEYHCd.exe
  2⤵
  PID:15144
- C:\Windows\System\DApqvtW.exe
  C:\Windows\System\DApqvtW.exe
  2⤵
  PID:15388
- C:\Windows\System\DVyaddJ.exe
  C:\Windows\System\DVyaddJ.exe
  2⤵
  PID:15028
- C:\Windows\System\cKKJipz.exe
  C:\Windows\System\cKKJipz.exe
  2⤵
  PID:14468
- C:\Windows\System\ZGlCsYY.exe
  C:\Windows\System\ZGlCsYY.exe
  2⤵
  PID:15276
- C:\Windows\System\ZRBFCfR.exe
  C:\Windows\System\ZRBFCfR.exe
  2⤵
  PID:15484
- C:\Windows\System\DSobJBx.exe
  C:\Windows\System\DSobJBx.exe
  2⤵
  PID:15364
- C:\Windows\System\ZNzAOQJ.exe
  C:\Windows\System\ZNzAOQJ.exe
  2⤵
  PID:15392
- C:\Windows\System\pXciQFD.exe
  C:\Windows\System\pXciQFD.exe
  2⤵
  PID:15500
- C:\Windows\System\SGSXDTm.exe
  C:\Windows\System\SGSXDTm.exe
  2⤵
  PID:15676
- C:\Windows\System\FYWSCsH.exe
  C:\Windows\System\FYWSCsH.exe
  2⤵
  PID:15760
- C:\Windows\System\fbwladA.exe
  C:\Windows\System\fbwladA.exe
  2⤵
  PID:15792
- C:\Windows\System\BmxGgre.exe
  C:\Windows\System\BmxGgre.exe
  2⤵
  PID:15836
- C:\Windows\System\TkbkWFn.exe
  C:\Windows\System\TkbkWFn.exe
  2⤵
  PID:15860
- C:\Windows\System\ziajFDP.exe
  C:\Windows\System\ziajFDP.exe
  2⤵
  PID:15880
- C:\Windows\System\xcxoDcU.exe
  C:\Windows\System\xcxoDcU.exe
  2⤵
  PID:15920
- C:\Windows\System\chuaPMS.exe
  C:\Windows\System\chuaPMS.exe
  2⤵
  PID:16016
- C:\Windows\System\CsNPOFJ.exe
  C:\Windows\System\CsNPOFJ.exe
  2⤵
  PID:16036
- C:\Windows\System\HsEjVnH.exe
  C:\Windows\System\HsEjVnH.exe
  2⤵
  PID:16076
- C:\Windows\System\DMybKHf.exe
  C:\Windows\System\DMybKHf.exe
  2⤵
  PID:16328
- C:\Windows\System\DHtskkS.exe
  C:\Windows\System\DHtskkS.exe
  2⤵
  PID:14992
- C:\Windows\System\iNesOJQ.exe
  C:\Windows\System\iNesOJQ.exe
  2⤵
  PID:16236
- C:\Windows\System\XenOZuj.exe
  C:\Windows\System\XenOZuj.exe
  2⤵
  PID:16256
- C:\Windows\System\vcGEGHL.exe
  C:\Windows\System\vcGEGHL.exe
  2⤵
  PID:16200
- C:\Windows\System\eivZBfG.exe
  C:\Windows\System\eivZBfG.exe
  2⤵
  PID:16344
- C:\Windows\System\hHzfGCg.exe
  C:\Windows\System\hHzfGCg.exe
  2⤵
  PID:15532
- C:\Windows\System\hMZekiJ.exe
  C:\Windows\System\hMZekiJ.exe
  2⤵
  PID:15688
- C:\Windows\System\lCsqStW.exe
  C:\Windows\System\lCsqStW.exe
  2⤵
  PID:15756
- C:\Windows\System\pYJtmBq.exe
  C:\Windows\System\pYJtmBq.exe
  2⤵
  PID:15824
- C:\Windows\System\ANCVRja.exe
  C:\Windows\System\ANCVRja.exe
  2⤵
  PID:15440
- C:\Windows\System\ayYowRU.exe
  C:\Windows\System\ayYowRU.exe
  2⤵
  PID:16400
- C:\Windows\System\tYHhvlA.exe
  C:\Windows\System\tYHhvlA.exe
  2⤵
  PID:16416
- C:\Windows\System\fCIcLvb.exe
  C:\Windows\System\fCIcLvb.exe
  2⤵
  PID:16440
- C:\Windows\System\SlZvNDK.exe
  C:\Windows\System\SlZvNDK.exe
  2⤵
  PID:16472
- C:\Windows\System\etGzlpN.exe
  C:\Windows\System\etGzlpN.exe
  2⤵
  PID:16488
- C:\Windows\System\BtULgRk.exe
  C:\Windows\System\BtULgRk.exe
  2⤵
  PID:16504
- C:\Windows\System\JzyOHej.exe
  C:\Windows\System\JzyOHej.exe
  2⤵
  PID:16520
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16520 -s 248
    3⤵
    PID:16228
- C:\Windows\System\NVxKLSL.exe
  C:\Windows\System\NVxKLSL.exe
  2⤵
  PID:16536
- C:\Windows\System\ECVNAzp.exe
  C:\Windows\System\ECVNAzp.exe
  2⤵
  PID:16564
- C:\Windows\System\zsrDLsY.exe
  C:\Windows\System\zsrDLsY.exe
  2⤵
  PID:16584
- C:\Windows\System\vLPyFsW.exe
  C:\Windows\System\vLPyFsW.exe
  2⤵
  PID:16616
- C:\Windows\System\xkhDMQa.exe
  C:\Windows\System\xkhDMQa.exe
  2⤵
  PID:16636
- C:\Windows\System\FyVmhtx.exe
  C:\Windows\System\FyVmhtx.exe
  2⤵
  PID:16656
- C:\Windows\System\jEyKldD.exe
  C:\Windows\System\jEyKldD.exe
  2⤵
  PID:16680
- C:\Windows\System\dpbXyMS.exe
  C:\Windows\System\dpbXyMS.exe
  2⤵
  PID:16704
- C:\Windows\System\YlTiGtv.exe
  C:\Windows\System\YlTiGtv.exe
  2⤵
  PID:16720
- C:\Windows\System\bqdQqfe.exe
  C:\Windows\System\bqdQqfe.exe
  2⤵
  PID:16744
- C:\Windows\System\JyFGNXe.exe
  C:\Windows\System\JyFGNXe.exe
  2⤵
  PID:16768
- C:\Windows\System\nIZPbbo.exe
  C:\Windows\System\nIZPbbo.exe
  2⤵
  PID:16784
- C:\Windows\System\qgXsURg.exe
  C:\Windows\System\qgXsURg.exe
  2⤵
  PID:16800
- C:\Windows\System\awVGCFi.exe
  C:\Windows\System\awVGCFi.exe
  2⤵
  PID:16828
- C:\Windows\System\tPzdaui.exe
  C:\Windows\System\tPzdaui.exe
  2⤵
  PID:17252
- C:\Windows\System\sKufubX.exe
  C:\Windows\System\sKufubX.exe
  2⤵
  PID:16320
- C:\Windows\System\EabcnuP.exe
  C:\Windows\System\EabcnuP.exe
  2⤵
  PID:15944
- C:\Windows\System\fgdtYJY.exe
  C:\Windows\System\fgdtYJY.exe
  2⤵
  PID:16464
- C:\Windows\System\fFmCooW.exe
  C:\Windows\System\fFmCooW.exe
  2⤵
  PID:16148
- C:\Windows\System\NZewxit.exe
  C:\Windows\System\NZewxit.exe
  2⤵
  PID:16908
- C:\Windows\System\teOfvMv.exe
  C:\Windows\System\teOfvMv.exe
  2⤵
  PID:16940

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 4356 -i 4356 -h 464 -j 552 -s 560 -d 16532
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:15236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CFTwJzM.exe

Filesize
1.5MB

MD5
76ab17020c421beb063371022f157639

SHA1
e46fd8452da82004ca48a82e1ccebc2afa6e2f76

SHA256
51e447dbbd4358e7e7a917ae50a19078329f8f534fdf9172a06bedeb6d1bf8c3

SHA512
de33332b7fb002581070f0e8f2b3db602889a4c964c408b1e99232de6203544e04a9de6eb11b6ccaf733500e9ef911fa83adc26cddcf54b40422bfa67f97628f

Download Submit
C:\Windows\System\DQyBLOU.exe

Filesize
1.5MB

MD5
033d12ff4c70aaa6d798b35cb14d3558

SHA1
4689c37f9629938c296b946df1f91e3bc803fc28

SHA256
d4a38367c54545a7e8edde3b2f14fbe2107416167b7cbeb799d0372fff8e65a3

SHA512
1d7914f4e515992779904d253a713c2d7eb9c6a1172bd085c860e59cd8dbc031d68cf840912a3c1e2f7b2031d9d522d450e1f9c551797a5190341f6c251ae09f

Download Submit
C:\Windows\System\GnhoIhe.exe

Filesize
1.5MB

MD5
4246b81ef6326ff57a5823c56f790312

SHA1
809e8961ce049fb1c3c0b9e0e4ff7ed8ca8116bd

SHA256
d9adddc0b3cd7bf541dc9b4da964f861c0b06146c7ca7d95f3626d0f1ac1e360

SHA512
2915a7600317828780fd1183a88ea13d218de42651730bff5cb5275e0e5eaa633a36d5a562a9f621ae3609c95850e26fef89d3eae139ebd20afe49736c68fb9f

Download Submit
C:\Windows\System\HMKxkZr.exe

Filesize
1.5MB

MD5
a4a6d4ddbb1b3ea7dcd60d1085e16c38

SHA1
4dc4f0287435389f0db4c660d286eea2c41af512

SHA256
84e6c673590b0cfe51ac0e50007e9e2f97066bb15efe1cfcd4a268c0a3b1afa1

SHA512
68d3387d21011426364bad81a6345e6aaf7980e94756147496d52d2b7954d551b3a15ce4c22145ffbf406b07fa92f1d14ba9743140278a271a418bcc41882169

Download Submit
C:\Windows\System\KgcBHdz.exe

Filesize
1.5MB

MD5
4617d69ce57449b37a9192d0833852a8

SHA1
9e0209f74bd1fa3577400e7390e22cdbe31680e1

SHA256
493b3b3e7f2bf32b580c00ba40e11f9cf3bb41615c1f33293994cc772a6fe50a

SHA512
fd3d9a2f840c512f87aaa27f03d64506c8124dcac55ad6373653eac869ed2fb11cd1870f75730a3e454f8b86ed1dd798767aca5f99cb2836246fd84af4ab7d83

Download Submit
C:\Windows\System\PlfMsow.exe

Filesize
1.5MB

MD5
29488b5e921cd16075b15bf2f70f7cbb

SHA1
9a5983a41ca2fa67882a377c40e1e116b179a4b0

SHA256
8b48b601d7ea7f775b0c586370fb07d471ddebd5b0acb5359060bdc5276f413c

SHA512
7a4769f7123fde76f4ae692b67badb8a3947bb19d0ab8d549d0397df42da5549e6675318d10045af10ffff4c89cbcbba2ebd4deb98b0a5eb575f1d1ef07a6509

Download Submit
C:\Windows\System\QEKXZIH.exe

Filesize
1.5MB

MD5
abed42f502154c5cfb544e0de8e4c837

SHA1
e22c2790fcdfc3fac55582a02167521b7592a307

SHA256
7c1d292caf1925e9a328fcb520b9b2120b34183020ade52bc83ea4c9335c404b

SHA512
0267d91d8e7a530353686454986f37668314af5ae8648e54b18339b20d41fb1bb77c13ac98ff455d0f776d7ba33d0ce5776506c929ec8104535b8b5027b7b544

Download Submit
C:\Windows\System\QENKjxA.exe

Filesize
1.5MB

MD5
6bee8f9b459586f4601d646cacfaf1d2

SHA1
05968b9e048644bcd6955398651724cafeb9d21b

SHA256
b9c1f5cbd04bc4ac0b656b90ed93236efc2e05c8547aeddace697f2098d9d780

SHA512
f36d696a830b9fb68d5f03694193f05d3389286521a6031feba24185a0b0f7a8f3e9b0ef76b6305fd367ca65455f44442752adc4393ade43fafcd561874ba0e6

Download Submit
C:\Windows\System\UBIjjNx.exe

Filesize
1.5MB

MD5
2ed0925d20ab09c4a3eb592fcee34ba4

SHA1
0392ba8163b536aa8b5785d7126cdd3319f93601

SHA256
c56ba4bb27f1ba90ce72e0e5dab4c8f1ac9465e83bacaa9a47465a1a24c9c314

SHA512
e8d727849e87306ac672ee4d0d954fca8eb8de685376badb06bdd1f629a55ba325a91fdcf904a8323e9df2974844f99040afe7f821fc82e5da17ad8b7b234a1f

Download Submit
C:\Windows\System\WzmnpRj.exe

Filesize
1.5MB

MD5
9999cfecba63f7e87bde8260a6147f60

SHA1
b3eb99e9de8324aa9ece0e15f6c3ceddaeb29b5c

SHA256
82237c623d24ab610b28e918e7294ebb486aa03878329f23c65b064ac478febb

SHA512
ef50cd99c355c174e8b1e32d865595e5d80fb684897fdc0d36065e1a41eb5de8354249775e0da25b984e8894f84e4dcbd73fda3511eeee593986635dc8213802

Download Submit
C:\Windows\System\XRRyjbR.exe

Filesize
1.5MB

MD5
9dc935d7fe9adedaebc1e90997ae3baa

SHA1
b2d643186862ead4a354dc7802ef8ecdcee33748

SHA256
69d7a3a2606b0142612fd336ed85c2ca845249b63d054c574902b8d199ae148e

SHA512
04c530af74f47af484d1c7354ffd2813acb07c2545f923e8d7e5e21184df0c9920473d3684f91f3b33d150f187ec7b1360d527df812db26354869e2b260b45fd

Download Submit
C:\Windows\System\ZDwnqbz.exe

Filesize
1.5MB

MD5
3f9689382a238981b8352a63666758c1

SHA1
b864f29de8a4a5fbba3049cc58570e7162ac9563

SHA256
1db8b0d187c7805f739a78df3c518598dc3da44ebfc708e341c124cdf9ebd657

SHA512
c307ab41e548d33e5fc7075929b0b7e8bc91481c7a734ea11a5a044b895bfde48eb9df25ce4145b84c720b89b5db5600d728d4ca1e95256a6ea2c3c5273f5626

Download Submit
C:\Windows\System\ahTOjzY.exe

Filesize
1.5MB

MD5
0dbf2690fc5083e8f0d0ca37461853bf

SHA1
09968e1de78dd7c09be53456439b449bef310a63

SHA256
c8b2b712484f912e930ae8c979e29bddda4a4efb2bca06a40b330f384e59a05b

SHA512
18240dce61a1220d121dcc7175c1fd16ddb446bc7f9e9483e623a3a99129cba6f7ccc738a1e423acd99b9c4c08790d53f087cea18bb632384931c472e8173838

Download Submit
C:\Windows\System\aipWpVW.exe

Filesize
1.5MB

MD5
1f6024052dac2602945b8d85305d6059

SHA1
5be44f37f2b4c7522a193580bc710925a023e6e9

SHA256
cdc98c531078059c7ccd4d4d9baaa2f627eecf1747a6db1e6bce508857f85250

SHA512
4c0001dbe0ed30a597342f4169bc2e06c9530528b955f6ca32e2e9c53a4e4c4cb0ca4c03af23ecdcadbdf48b3931452c6f660e059430d33966137069e7750ad3

Download Submit
C:\Windows\System\coEUyYn.exe

Filesize
1.5MB

MD5
66815407dddcd2e248f4e3b2bc1a195e

SHA1
e766eb3ce1a768977ed17e48e502a0321060cd5b

SHA256
b89da88a0b8890c606d77e2dfe0be2a11615ccc14965b88db15e873d25cb637d

SHA512
402e9cd09d7707ad13d021cf29ad482f20191b5c6a5dc716e0cb5b13418868007a471e7e8beddd5cba4b8177d4af91292748544fecc2c72b4bdcbf205a034b81

Download Submit
C:\Windows\System\dMolUvA.exe

Filesize
1.5MB

MD5
62514b398ad435d93267a35b3265d5cc

SHA1
713a3b8e3057f853032ed21004606da397c3e28c

SHA256
34bf4c9bc5dd997c826a0b341c08fab4bcb77d780511a93ee4efa0ac56ea6340

SHA512
48a5bcfedd01d2fe04c8c7c29a15c23befaaf92525b81ca74fa54cfa12d6f7bf6878b196d3ba0e0182a483aa25c9655c4da20de2086049326072aa8abb42ce0c

Download Submit
C:\Windows\System\eCteQqv.exe

Filesize
1.5MB

MD5
f0a16e31fcab95347e2742590ae66db2

SHA1
21fc2d2118ff1b0638441f305499442f0e1b73b2

SHA256
f59b7e40bddbab8db9ab50e11652de908d2dd4604791e477b97c400516256870

SHA512
403493f14c401df0a8625198ccb9d33d653cdc1014815ffe52101409ccb3b542b1cde71326aa061a2df2464bae679a8308b304f49feaf158347b7d0c41d9a5f7

Download Submit
C:\Windows\System\epUBBBk.exe

Filesize
1.5MB

MD5
48dd0b851db5a5ee5748c9e8255a8827

SHA1
1d78bba43bfebd984ee717bc322f45e96502757c

SHA256
fb775df05f92b06eb02bfdf861da4db0fc04749e14b18922fcdb1c8892349cbb

SHA512
0fb1af890e83fbe1e38b99ac28bbd0b302f49265dc3a9004b0b2e26a514ae50a12772c04ae6e8ebca49d7a377e2e91b47d1a8a7b8fb0ccec6fabe9d6f80b9d99

Download Submit
C:\Windows\System\fcvBtTJ.exe

Filesize
1.5MB

MD5
792558ef1b2aa9dc5e78beb18c8c6811

SHA1
56c476af48d8713e2f9a7c927083fde093312582

SHA256
7c1653cd7bf131bbebdf98ec34cca71ae670b619d6291d7d44099cc3678f40c0

SHA512
da14f69f1d5cdd88d1953134d8d07c7a2cea1d15a1c85912753b99bf07cd29f64b73d837d124d4664bbd19531ad7d30dc351825bcc386cc47068f07423e2f5c5

Download Submit
C:\Windows\System\gVEvYQO.exe

Filesize
1.5MB

MD5
f1f59a0f22be07b9931b0f417884aad9

SHA1
f02ab70d9dbb7739a600ec65e081a0dfd7caf508

SHA256
8a214ca89a39066ecab44f78f9b01aecef3df2cf4ca5606dce800835c24c2150

SHA512
8c8cb5ee19fabf9daaf9e12c1d43231664c17384ec48130c4739b8d0d57269eb8213662c1cd3a4a553f7ac9273dd335ac58e60e2e7f319d86487706912f6c507

Download Submit
C:\Windows\System\jCuBeJq.exe

Filesize
1.5MB

MD5
775778669c3528c62866e46244d65543

SHA1
769bfe737e9329ccc3519665d3724e7b6a4c90fe

SHA256
900703948050eae26812a2345e97f83f291fd1d25fb294c63cda1c3241c07186

SHA512
8b61ec1b99391e6d39d3545e205d325646d5485b897887b3eee7c15b1658824aabde1edcabc3bfa83003b2569c4a41f140e83352e3c961f01b08cd419fb06c01

Download Submit
C:\Windows\System\lbyUVpg.exe

Filesize
1.5MB

MD5
00ff3911c121ad8edd5a5a4e80599763

SHA1
47621d786a9d66cfebe02b74ccd6d72a1ac11de3

SHA256
489512402dd95ce67713998dbbb4d2e80a23c7a4cc50c1868907c0a99daaecc4

SHA512
2d0000b8894b7a854e6c1ddcc5bca4112f9f362f7cbe631888e7dd4fa5b46abdb1acad2f41aed0221ee09969fb299f5c4239c2c43c3095a924be7c06e6ccee4f

Download Submit
C:\Windows\System\ltwUSqo.exe

Filesize
1.5MB

MD5
708b720717f5a2006f47c7fd8f1878b6

SHA1
a62aab2b24543f17f0b4788e4ead45f20d87b10c

SHA256
a21d9777ef6a25f3dd34e9584a5a06f931f3325e061a4ef23f121b154e4f9be7

SHA512
6fe0e2b67570f0250f3cf361442fdb8571a009c432a6a3642c1fdab5c4c71d7f8eb23ce5f34c780fbc974b1ec9f59175998c631648acb47983649f52995dd461

Download Submit
C:\Windows\System\nqCCGzS.exe

Filesize
1.5MB

MD5
65b97f5ef72f6e180ddfa0bc4d554686

SHA1
6f5425a7df5dc3e8216b63a6fa5c581d736e81dd

SHA256
b299f111eae6dac1e16c1da1ca9cf112c6f462601ec25092c3ca6f2c64dc7bc4

SHA512
0236458cd8f42554920032ac048e385c34d5cb98bdf6f62e01c25a2af33cd8cf8c7e92119d92e484b69e7166ea802627b6c36f71965fd3daf81c6644e239e6ac

Download Submit
C:\Windows\System\rIgHVMo.exe

Filesize
1.5MB

MD5
bff6944728a7821477c91b2a0f40489c

SHA1
c3f0e7a229547b793e1237f693631cfd44b335e7

SHA256
4b210e0dbbdec6e90f2c880757feff2c08e26405a3753003653659c780457c8a

SHA512
925e4bcf0d5e4b6d5360d7436d53a107cec71db0a9f7b1a5da93b81bf387019235019523824c1bd19770fda80e7dc383aec2c79b0cc6f2a4e3a9b9d127cea5e3

Download Submit
C:\Windows\System\rdPoNUM.exe

Filesize
1.5MB

MD5
348492e4e81c25706d116153aacc814c

SHA1
ea9f77ac9054556e4b598de458f78df2b6eeb344

SHA256
db77bda41b50a1416b9c4b1b0aba54de002eee3ed5fbc4154367d7440e530ec2

SHA512
59bfbdb4190385440b5a9a971071d29ba82c7f0095e97eab23baba2f00b35f799dfe05a9a09367e44618383da88c2299ab6aee8ef470e34e59e95c4b87809ed1

Download Submit
C:\Windows\System\ryZnYGj.exe

Filesize
1.5MB

MD5
839f95fa025cdfb322e1df1ec3930597

SHA1
fc155f5e7a120505953d1e491b072f55d565c9ac

SHA256
5042e5d649f2b7c22da504455b50ae4c7843d2b17baf8656ceb9f7a0e6441a93

SHA512
bbfee12fabb809486a64e524abdbf98cd0df142a754e9f4f32c2067acbca0ed7740c5d013b85cd92392b2481926ca7044d7cfdfcb48bd41fb53be48d9a4f15ed

Download Submit
C:\Windows\System\sNbmbKz.exe

Filesize
1.5MB

MD5
5d06cd4cef2bf2288f808662e791a764

SHA1
612774f81c11a209c5eb6fc8b0cb26c135997307

SHA256
f238804cee11de1c6d0da2564f8cdac873e278f844e1be65e158be295ec35812

SHA512
098fcf08cf15ef6a5a1c78a69876dc4d3553a1a6d334d262439d9b6db0e471951a45f4de24b69d8c924dcb9e035af4e3349401f51f6bf17b6a4a0d76371135fa

Download Submit
C:\Windows\System\tzKPqik.exe

Filesize
1.5MB

MD5
5236c99f0a52133f6a164a2be6ce6ad3

SHA1
fab6503045ec9f5db83791e075c66143dc08abd4

SHA256
02928bbd6449b165620d0d384fac1bdfee5fda2f2b3bec70cc1386c9e1943921

SHA512
e6eb9575bc257fed44259f7b0aa0807c878d6f6c6c19d33bb9b40d9dbe8b42ca4628619654ad12a21be15352607a5b21646158253082d3082c47dab647021b9e

Download Submit
C:\Windows\System\uUZiXdD.exe

Filesize
1.5MB

MD5
649fbb607ff87537e9324c1efc23b4c1

SHA1
ee87db96d5d7909d326dc1c44ce0b773ad6907b2

SHA256
9a009d789eba01936f1fd647bacc00b82711da52f6e523d56db014f50d8018d2

SHA512
9c0d79c213d1758f9bec5e771d303a62c3ca37b6b3cc13d0fae160f73befc63697e55f3ed9be03590d3bf04b482d7f6364f8d6da00a2078c22fe3cd9d9deaee1

Download Submit
C:\Windows\System\xQchsxH.exe

Filesize
1.5MB

MD5
a406e8b82091ea611511c52afef80226

SHA1
887562941452417378e87b90ea8df2490a13b09b

SHA256
14b9ebae4d329b5fd2b51a5f5298e45f53e46e836554b2ae467dc4e6d07d13cb

SHA512
d8286f3d44258555bab6fee5123983427f3a54a48182d6e8ed3b918f2579302851205d75dcc1d99a5b159445a19804b147e194bf9b9e3f416be8fbf45bae5cb2

Download Submit
C:\Windows\System\zrJJJTH.exe

Filesize
1.5MB

MD5
f7ca8e61dc98388c91071b580b457e38

SHA1
50d7c6a15b53e53f4f015c6ca5815d48b6dc6bf3

SHA256
cd6e385a79e89d841dc985f1779b5bb97b2a00fbc34550dd1cb80f824fe70096

SHA512
28e43f9dcdfc1f9107eda418be26a09bc35488f70900a325e83c66b8b0e91fa10f0fee0f4bd8d4e9a9a1f8335c51d9a06a3ad6354d2e6d470804792a6408b7ed

Download Submit
C:\Windows\System\zxOsAHr.exe

Filesize
1.5MB

MD5
a38719334e4c07acb37d997d371dd804

SHA1
72b713cb0703c9a62cb284f109bbf9f7d54c13eb

SHA256
cf7924cd580feceb5d45a236295335ab319d1d1681be355941507afb8d6a96b6

SHA512
fb8ba9b3048f10271dc574044d0b58b7336d83c30f9effab3dacdcf219f9b24a4056a27489ce289597376c7c2136b896eb9ac5ceac048182da79e2091c8bf8ad

Download Submit
memory/2228-0-0x0000014661C30000-0x0000014661C40000-memory.dmp

Filesize
64KB

Download