xmrig | 3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
Size

1.4MB
MD5

fde8b008b271ff4f3fe6fc3c4c4988c7
SHA1

ec3f77096ec94beacef6f4b357af8106c67db647
SHA256

3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf
SHA512

fc1cb5b3039c5f964ee9d5dc5a640c86fc532150daecf3d269c75e1ae2302e150a0bbd1ba1a5b6bb53364bf1f80f40cda3b7cd2f040743a0f5d51d34d9070dfa
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84neZKTby:GezaTF8FcNkNdfE0pZ9ozttwIRxA1Mc1

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c92-4.dat	xmrig
behavioral2/files/0x0007000000023c97-6.dat	xmrig
behavioral2/files/0x0007000000023c96-7.dat	xmrig
behavioral2/files/0x0007000000023c98-21.dat	xmrig
behavioral2/files/0x0007000000023c99-27.dat	xmrig
behavioral2/files/0x0007000000023c9a-25.dat	xmrig
behavioral2/files/0x0007000000023c9b-32.dat	xmrig
behavioral2/files/0x0008000000023c93-37.dat	xmrig
behavioral2/files/0x0007000000023c9c-47.dat	xmrig
behavioral2/files/0x0007000000023c9d-52.dat	xmrig
behavioral2/files/0x0007000000023c9e-54.dat	xmrig
behavioral2/files/0x0007000000023c9f-59.dat	xmrig
behavioral2/files/0x0007000000023ca1-73.dat	xmrig
behavioral2/files/0x0007000000023ca2-72.dat	xmrig
behavioral2/files/0x0007000000023ca3-78.dat	xmrig
behavioral2/files/0x0007000000023ca0-67.dat	xmrig
behavioral2/files/0x0007000000023ca4-84.dat	xmrig
behavioral2/files/0x0007000000023ca5-87.dat	xmrig
behavioral2/files/0x0007000000023ca7-93.dat	xmrig
behavioral2/files/0x0007000000023ca8-97.dat	xmrig
behavioral2/files/0x0007000000023ca9-105.dat	xmrig
behavioral2/files/0x0007000000023caa-108.dat	xmrig
behavioral2/files/0x0007000000023cac-119.dat	xmrig
behavioral2/files/0x0007000000023cb3-148.dat	xmrig
behavioral2/files/0x0007000000023cb2-143.dat	xmrig
behavioral2/files/0x0007000000023cb5-163.dat	xmrig
behavioral2/files/0x0007000000023cb6-164.dat	xmrig
behavioral2/files/0x0007000000023cb1-160.dat	xmrig
behavioral2/files/0x0007000000023cad-158.dat	xmrig
behavioral2/files/0x0007000000023cb4-155.dat	xmrig
behavioral2/files/0x0007000000023cae-152.dat	xmrig
behavioral2/files/0x0007000000023cb0-140.dat	xmrig
behavioral2/files/0x0007000000023caf-131.dat	xmrig
behavioral2/files/0x0007000000023cab-118.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3716	MfwcAfc.exe
2056	AfafeYC.exe
216	ZZERcLO.exe
2720	LVMSqdK.exe
2580	OpyitTd.exe
4328	vDuoimc.exe
980	aRtvWMd.exe
4088	rhlWTNW.exe
1240	IFrSvmx.exe
4800	FqyspWj.exe
2964	wfXLUrx.exe
4132	yIOYcnu.exe
4092	WkztSML.exe
2972	hfyOEyN.exe
2740	xFknSvV.exe
4804	ovLqwPh.exe
4044	oOtNbVN.exe
2032	oNTXsiB.exe
4012	XOQZzGc.exe
1900	cQZrlWq.exe
3124	HNZJwdL.exe
4164	RAGgana.exe
2288	rIQGZZY.exe
1424	QGXvAzC.exe
3972	qCZtpBm.exe
2496	JxQnvtd.exe
3044	YhqXtid.exe
4460	zbQWGty.exe
4508	lBapzqZ.exe
4436	emWAsMu.exe
512	dMmlCEk.exe
4904	NdmbyLL.exe
4488	StpOeYk.exe
5116	wIVZBfG.exe
976	EOZKMMO.exe
3524	DSyoyuq.exe
3336	BEebWWK.exe
1804	pFFntQi.exe
3284	rMmxVYn.exe
3096	ZZXnhxX.exe
3564	wbgiaay.exe
3792	quBXrla.exe
4432	pLAykjA.exe
3052	adAJfvC.exe
2168	pAsPMtK.exe
3508	TOuuHDJ.exe
4112	pDkGcZD.exe
1796	GCTzTnp.exe
4524	FkIjjXY.exe
2072	CTYoYIM.exe
1100	ENIbgvg.exe
4780	BnPyQGB.exe
3100	GuhRTbk.exe
4880	GvfrnTP.exe
5068	tMihcjD.exe
4440	AQIMzJB.exe
3668	enGwTFy.exe
320	IixNMOc.exe
1624	VwBYYPf.exe
4492	HjuRUpJ.exe
4348	ajJWdSY.exe
3136	CKHNrrP.exe
4976	JjokWAE.exe
2684	bKODDCH.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VjynGLT.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\fERcrdn.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\GEBRHpH.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\krkonPn.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\oNRzwMI.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\ibQJbwn.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\pAhutgL.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\lmjhESz.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\oblGWHt.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\KBFIetF.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\YnPvcuc.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\BEebWWK.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\kKlGNfE.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\ksQETnG.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\iZnViiL.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\jYchkGk.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\GSdyoZw.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\snFBMLH.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\fxytfdo.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\DRjythk.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\yswoULV.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\JfzuWoZ.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\XIERsxp.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\gqtpJJd.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\rAHeZph.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\LNdiUsC.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\umoOscI.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\fclzvyR.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\DngkUuS.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\OvQjYum.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\YwLxzMa.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\dXxYLbQ.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\iGLijZx.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\beWACrn.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\DVcIkka.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\zlPIAAq.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\TngmvUG.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\kVoNaHB.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\FyvQWZK.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\TvYWCLr.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\NCRsWbG.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\NhOLWpN.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\YNmHjCM.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\BtFAGuI.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\SZrButc.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\egUprSx.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\xdhJLcP.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\rPGtHHg.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\YUJODDP.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\oOIvNuR.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\CgGImrp.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\ePWbSQW.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\JnaQKiB.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\hqnLOAB.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\Tdrhhmx.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\uvpEVEm.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\aeZOMfg.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\wfXLUrx.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\xFknSvV.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\ziSBQCa.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\MwzAxvv.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\ywhxrep.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\bXqtyRL.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
File created	C:\Windows\System\mXUWLCP.exe	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 3716	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	84
PID 3824 wrote to memory of 3716	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	84
PID 3824 wrote to memory of 2056	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	85
PID 3824 wrote to memory of 2056	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	85
PID 3824 wrote to memory of 216	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	86
PID 3824 wrote to memory of 216	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	86
PID 3824 wrote to memory of 2720	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	87
PID 3824 wrote to memory of 2720	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	87
PID 3824 wrote to memory of 2580	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	88
PID 3824 wrote to memory of 2580	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	88
PID 3824 wrote to memory of 4328	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	89
PID 3824 wrote to memory of 4328	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	89
PID 3824 wrote to memory of 980	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	90
PID 3824 wrote to memory of 980	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	90
PID 3824 wrote to memory of 4088	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	91
PID 3824 wrote to memory of 4088	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	91
PID 3824 wrote to memory of 1240	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	92
PID 3824 wrote to memory of 1240	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	92
PID 3824 wrote to memory of 4800	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	93
PID 3824 wrote to memory of 4800	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	93
PID 3824 wrote to memory of 2964	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	94
PID 3824 wrote to memory of 2964	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	94
PID 3824 wrote to memory of 4132	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	95
PID 3824 wrote to memory of 4132	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	95
PID 3824 wrote to memory of 4092	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	96
PID 3824 wrote to memory of 4092	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	96
PID 3824 wrote to memory of 2972	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	97
PID 3824 wrote to memory of 2972	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	97
PID 3824 wrote to memory of 2740	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	98
PID 3824 wrote to memory of 2740	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	98
PID 3824 wrote to memory of 4804	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	99
PID 3824 wrote to memory of 4804	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	99
PID 3824 wrote to memory of 4044	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	100
PID 3824 wrote to memory of 4044	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	100
PID 3824 wrote to memory of 2032	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	101
PID 3824 wrote to memory of 2032	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	101
PID 3824 wrote to memory of 4012	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	102
PID 3824 wrote to memory of 4012	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	102
PID 3824 wrote to memory of 1900	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	103
PID 3824 wrote to memory of 1900	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	103
PID 3824 wrote to memory of 3124	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	104
PID 3824 wrote to memory of 3124	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	104
PID 3824 wrote to memory of 4164	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	105
PID 3824 wrote to memory of 4164	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	105
PID 3824 wrote to memory of 2288	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	106
PID 3824 wrote to memory of 2288	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	106
PID 3824 wrote to memory of 1424	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	107
PID 3824 wrote to memory of 1424	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	107
PID 3824 wrote to memory of 3972	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	108
PID 3824 wrote to memory of 3972	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	108
PID 3824 wrote to memory of 3044	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	109
PID 3824 wrote to memory of 3044	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	109
PID 3824 wrote to memory of 2496	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	110
PID 3824 wrote to memory of 2496	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	110
PID 3824 wrote to memory of 4460	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	111
PID 3824 wrote to memory of 4460	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	111
PID 3824 wrote to memory of 4508	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	112
PID 3824 wrote to memory of 4508	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	112
PID 3824 wrote to memory of 4436	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	113
PID 3824 wrote to memory of 4436	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	113
PID 3824 wrote to memory of 512	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	114
PID 3824 wrote to memory of 512	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	114
PID 3824 wrote to memory of 4904	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	115
PID 3824 wrote to memory of 4904	3824	3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe	115

C:\Users\Admin\AppData\Local\Temp\3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe
"C:\Users\Admin\AppData\Local\Temp\3dc6e78d34dd047a3e42dd2ffdfd7d8bc0991f78292b496ff7a0ee2ab01caadf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System\MfwcAfc.exe
  C:\Windows\System\MfwcAfc.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\AfafeYC.exe
  C:\Windows\System\AfafeYC.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ZZERcLO.exe
  C:\Windows\System\ZZERcLO.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\LVMSqdK.exe
  C:\Windows\System\LVMSqdK.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\OpyitTd.exe
  C:\Windows\System\OpyitTd.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\vDuoimc.exe
  C:\Windows\System\vDuoimc.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\aRtvWMd.exe
  C:\Windows\System\aRtvWMd.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\rhlWTNW.exe
  C:\Windows\System\rhlWTNW.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\IFrSvmx.exe
  C:\Windows\System\IFrSvmx.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\FqyspWj.exe
  C:\Windows\System\FqyspWj.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\wfXLUrx.exe
  C:\Windows\System\wfXLUrx.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\yIOYcnu.exe
  C:\Windows\System\yIOYcnu.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\WkztSML.exe
  C:\Windows\System\WkztSML.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\hfyOEyN.exe
  C:\Windows\System\hfyOEyN.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\xFknSvV.exe
  C:\Windows\System\xFknSvV.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ovLqwPh.exe
  C:\Windows\System\ovLqwPh.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\oOtNbVN.exe
  C:\Windows\System\oOtNbVN.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\oNTXsiB.exe
  C:\Windows\System\oNTXsiB.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\XOQZzGc.exe
  C:\Windows\System\XOQZzGc.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\cQZrlWq.exe
  C:\Windows\System\cQZrlWq.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\HNZJwdL.exe
  C:\Windows\System\HNZJwdL.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\RAGgana.exe
  C:\Windows\System\RAGgana.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\rIQGZZY.exe
  C:\Windows\System\rIQGZZY.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\QGXvAzC.exe
  C:\Windows\System\QGXvAzC.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\qCZtpBm.exe
  C:\Windows\System\qCZtpBm.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\YhqXtid.exe
  C:\Windows\System\YhqXtid.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\JxQnvtd.exe
  C:\Windows\System\JxQnvtd.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\zbQWGty.exe
  C:\Windows\System\zbQWGty.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\lBapzqZ.exe
  C:\Windows\System\lBapzqZ.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\emWAsMu.exe
  C:\Windows\System\emWAsMu.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\dMmlCEk.exe
  C:\Windows\System\dMmlCEk.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\NdmbyLL.exe
  C:\Windows\System\NdmbyLL.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\StpOeYk.exe
  C:\Windows\System\StpOeYk.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\wIVZBfG.exe
  C:\Windows\System\wIVZBfG.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\EOZKMMO.exe
  C:\Windows\System\EOZKMMO.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\DSyoyuq.exe
  C:\Windows\System\DSyoyuq.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\BEebWWK.exe
  C:\Windows\System\BEebWWK.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\pFFntQi.exe
  C:\Windows\System\pFFntQi.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\rMmxVYn.exe
  C:\Windows\System\rMmxVYn.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\ZZXnhxX.exe
  C:\Windows\System\ZZXnhxX.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\wbgiaay.exe
  C:\Windows\System\wbgiaay.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\quBXrla.exe
  C:\Windows\System\quBXrla.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\pLAykjA.exe
  C:\Windows\System\pLAykjA.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\adAJfvC.exe
  C:\Windows\System\adAJfvC.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\pAsPMtK.exe
  C:\Windows\System\pAsPMtK.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\TOuuHDJ.exe
  C:\Windows\System\TOuuHDJ.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\pDkGcZD.exe
  C:\Windows\System\pDkGcZD.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\GCTzTnp.exe
  C:\Windows\System\GCTzTnp.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\FkIjjXY.exe
  C:\Windows\System\FkIjjXY.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\CTYoYIM.exe
  C:\Windows\System\CTYoYIM.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\ENIbgvg.exe
  C:\Windows\System\ENIbgvg.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\BnPyQGB.exe
  C:\Windows\System\BnPyQGB.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\GuhRTbk.exe
  C:\Windows\System\GuhRTbk.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\GvfrnTP.exe
  C:\Windows\System\GvfrnTP.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\tMihcjD.exe
  C:\Windows\System\tMihcjD.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\AQIMzJB.exe
  C:\Windows\System\AQIMzJB.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\enGwTFy.exe
  C:\Windows\System\enGwTFy.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\IixNMOc.exe
  C:\Windows\System\IixNMOc.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\VwBYYPf.exe
  C:\Windows\System\VwBYYPf.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\HjuRUpJ.exe
  C:\Windows\System\HjuRUpJ.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\ajJWdSY.exe
  C:\Windows\System\ajJWdSY.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\CKHNrrP.exe
  C:\Windows\System\CKHNrrP.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\JjokWAE.exe
  C:\Windows\System\JjokWAE.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\bKODDCH.exe
  C:\Windows\System\bKODDCH.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\wEASJdL.exe
  C:\Windows\System\wEASJdL.exe
  2⤵
  PID:380
- C:\Windows\System\NhOLWpN.exe
  C:\Windows\System\NhOLWpN.exe
  2⤵
  PID:1832
- C:\Windows\System\jzQbdgt.exe
  C:\Windows\System\jzQbdgt.exe
  2⤵
  PID:668
- C:\Windows\System\PymvvQD.exe
  C:\Windows\System\PymvvQD.exe
  2⤵
  PID:4124
- C:\Windows\System\NnHbgTp.exe
  C:\Windows\System\NnHbgTp.exe
  2⤵
  PID:1848
- C:\Windows\System\jtVQRvy.exe
  C:\Windows\System\jtVQRvy.exe
  2⤵
  PID:1568
- C:\Windows\System\TFAUTcT.exe
  C:\Windows\System\TFAUTcT.exe
  2⤵
  PID:2516
- C:\Windows\System\iQaLuug.exe
  C:\Windows\System\iQaLuug.exe
  2⤵
  PID:3428
- C:\Windows\System\WZpqngm.exe
  C:\Windows\System\WZpqngm.exe
  2⤵
  PID:1628
- C:\Windows\System\pcYwXFV.exe
  C:\Windows\System\pcYwXFV.exe
  2⤵
  PID:3236
- C:\Windows\System\HpHhEJt.exe
  C:\Windows\System\HpHhEJt.exe
  2⤵
  PID:1260
- C:\Windows\System\asbKzab.exe
  C:\Windows\System\asbKzab.exe
  2⤵
  PID:5036
- C:\Windows\System\qAjpowd.exe
  C:\Windows\System\qAjpowd.exe
  2⤵
  PID:4276
- C:\Windows\System\qcCtTOl.exe
  C:\Windows\System\qcCtTOl.exe
  2⤵
  PID:5092
- C:\Windows\System\VOEshGQ.exe
  C:\Windows\System\VOEshGQ.exe
  2⤵
  PID:2384
- C:\Windows\System\GMmRJaw.exe
  C:\Windows\System\GMmRJaw.exe
  2⤵
  PID:1632
- C:\Windows\System\pWDKaMH.exe
  C:\Windows\System\pWDKaMH.exe
  2⤵
  PID:964
- C:\Windows\System\LYKoKDY.exe
  C:\Windows\System\LYKoKDY.exe
  2⤵
  PID:632
- C:\Windows\System\BTJfxts.exe
  C:\Windows\System\BTJfxts.exe
  2⤵
  PID:2464
- C:\Windows\System\gmgSigM.exe
  C:\Windows\System\gmgSigM.exe
  2⤵
  PID:3152
- C:\Windows\System\bDkDMkh.exe
  C:\Windows\System\bDkDMkh.exe
  2⤵
  PID:4588
- C:\Windows\System\HqMPcOA.exe
  C:\Windows\System\HqMPcOA.exe
  2⤵
  PID:1872
- C:\Windows\System\CjLwKPm.exe
  C:\Windows\System\CjLwKPm.exe
  2⤵
  PID:5064
- C:\Windows\System\daImfHv.exe
  C:\Windows\System\daImfHv.exe
  2⤵
  PID:3976
- C:\Windows\System\iSvIlFw.exe
  C:\Windows\System\iSvIlFw.exe
  2⤵
  PID:1156
- C:\Windows\System\sWROfBc.exe
  C:\Windows\System\sWROfBc.exe
  2⤵
  PID:2044
- C:\Windows\System\cWcLnxt.exe
  C:\Windows\System\cWcLnxt.exe
  2⤵
  PID:2212
- C:\Windows\System\uPOgUyE.exe
  C:\Windows\System\uPOgUyE.exe
  2⤵
  PID:432
- C:\Windows\System\LzdTbuT.exe
  C:\Windows\System\LzdTbuT.exe
  2⤵
  PID:4604
- C:\Windows\System\tHmICDu.exe
  C:\Windows\System\tHmICDu.exe
  2⤵
  PID:212
- C:\Windows\System\CAwNsIG.exe
  C:\Windows\System\CAwNsIG.exe
  2⤵
  PID:4020
- C:\Windows\System\oOIvNuR.exe
  C:\Windows\System\oOIvNuR.exe
  2⤵
  PID:944
- C:\Windows\System\TqtsZOQ.exe
  C:\Windows\System\TqtsZOQ.exe
  2⤵
  PID:2028
- C:\Windows\System\ziSBQCa.exe
  C:\Windows\System\ziSBQCa.exe
  2⤵
  PID:1580
- C:\Windows\System\sZBNsDD.exe
  C:\Windows\System\sZBNsDD.exe
  2⤵
  PID:1256
- C:\Windows\System\FMYRquc.exe
  C:\Windows\System\FMYRquc.exe
  2⤵
  PID:3732
- C:\Windows\System\pBpfrax.exe
  C:\Windows\System\pBpfrax.exe
  2⤵
  PID:788
- C:\Windows\System\KDPPvGB.exe
  C:\Windows\System\KDPPvGB.exe
  2⤵
  PID:1440
- C:\Windows\System\CuLZyDk.exe
  C:\Windows\System\CuLZyDk.exe
  2⤵
  PID:440
- C:\Windows\System\eBVFkPR.exe
  C:\Windows\System\eBVFkPR.exe
  2⤵
  PID:2520
- C:\Windows\System\paggLjK.exe
  C:\Windows\System\paggLjK.exe
  2⤵
  PID:3608
- C:\Windows\System\DkrbiYP.exe
  C:\Windows\System\DkrbiYP.exe
  2⤵
  PID:2352
- C:\Windows\System\JszbCFX.exe
  C:\Windows\System\JszbCFX.exe
  2⤵
  PID:4484
- C:\Windows\System\JfYBCBR.exe
  C:\Windows\System\JfYBCBR.exe
  2⤵
  PID:4472
- C:\Windows\System\HeNVprr.exe
  C:\Windows\System\HeNVprr.exe
  2⤵
  PID:1660
- C:\Windows\System\jRMAxrQ.exe
  C:\Windows\System\jRMAxrQ.exe
  2⤵
  PID:3368
- C:\Windows\System\vowzeZa.exe
  C:\Windows\System\vowzeZa.exe
  2⤵
  PID:5132
- C:\Windows\System\JSgpOiQ.exe
  C:\Windows\System\JSgpOiQ.exe
  2⤵
  PID:5164
- C:\Windows\System\QMiZxDr.exe
  C:\Windows\System\QMiZxDr.exe
  2⤵
  PID:5188
- C:\Windows\System\vEljJPs.exe
  C:\Windows\System\vEljJPs.exe
  2⤵
  PID:5220
- C:\Windows\System\ZcuKxVC.exe
  C:\Windows\System\ZcuKxVC.exe
  2⤵
  PID:5244
- C:\Windows\System\qZyiQhg.exe
  C:\Windows\System\qZyiQhg.exe
  2⤵
  PID:5284
- C:\Windows\System\TLrXcaS.exe
  C:\Windows\System\TLrXcaS.exe
  2⤵
  PID:5304
- C:\Windows\System\Sggmnne.exe
  C:\Windows\System\Sggmnne.exe
  2⤵
  PID:5320
- C:\Windows\System\IiUShBY.exe
  C:\Windows\System\IiUShBY.exe
  2⤵
  PID:5360
- C:\Windows\System\zViIxUz.exe
  C:\Windows\System\zViIxUz.exe
  2⤵
  PID:5376
- C:\Windows\System\VthKgJq.exe
  C:\Windows\System\VthKgJq.exe
  2⤵
  PID:5404
- C:\Windows\System\QKrbSuK.exe
  C:\Windows\System\QKrbSuK.exe
  2⤵
  PID:5444
- C:\Windows\System\MwzAxvv.exe
  C:\Windows\System\MwzAxvv.exe
  2⤵
  PID:5464
- C:\Windows\System\BVFuipO.exe
  C:\Windows\System\BVFuipO.exe
  2⤵
  PID:5500
- C:\Windows\System\viSOJcg.exe
  C:\Windows\System\viSOJcg.exe
  2⤵
  PID:5528
- C:\Windows\System\hkxkZNS.exe
  C:\Windows\System\hkxkZNS.exe
  2⤵
  PID:5564
- C:\Windows\System\EfiMelH.exe
  C:\Windows\System\EfiMelH.exe
  2⤵
  PID:5584
- C:\Windows\System\SezqjcR.exe
  C:\Windows\System\SezqjcR.exe
  2⤵
  PID:5612
- C:\Windows\System\HxrlbAL.exe
  C:\Windows\System\HxrlbAL.exe
  2⤵
  PID:5632
- C:\Windows\System\adwhsun.exe
  C:\Windows\System\adwhsun.exe
  2⤵
  PID:5680
- C:\Windows\System\uIlYVNo.exe
  C:\Windows\System\uIlYVNo.exe
  2⤵
  PID:5696
- C:\Windows\System\TrLmqVW.exe
  C:\Windows\System\TrLmqVW.exe
  2⤵
  PID:5724
- C:\Windows\System\VjynGLT.exe
  C:\Windows\System\VjynGLT.exe
  2⤵
  PID:5752
- C:\Windows\System\ucnYVSS.exe
  C:\Windows\System\ucnYVSS.exe
  2⤵
  PID:5768
- C:\Windows\System\JsLnluD.exe
  C:\Windows\System\JsLnluD.exe
  2⤵
  PID:5796
- C:\Windows\System\hUdjRSk.exe
  C:\Windows\System\hUdjRSk.exe
  2⤵
  PID:5828
- C:\Windows\System\mlyiNEJ.exe
  C:\Windows\System\mlyiNEJ.exe
  2⤵
  PID:5852
- C:\Windows\System\ehhPvgW.exe
  C:\Windows\System\ehhPvgW.exe
  2⤵
  PID:5884
- C:\Windows\System\vqEuIcb.exe
  C:\Windows\System\vqEuIcb.exe
  2⤵
  PID:5912
- C:\Windows\System\EkdymTp.exe
  C:\Windows\System\EkdymTp.exe
  2⤵
  PID:5936
- C:\Windows\System\SHBpoED.exe
  C:\Windows\System\SHBpoED.exe
  2⤵
  PID:5964
- C:\Windows\System\KtdGeFS.exe
  C:\Windows\System\KtdGeFS.exe
  2⤵
  PID:5992
- C:\Windows\System\TPsuJjs.exe
  C:\Windows\System\TPsuJjs.exe
  2⤵
  PID:6008
- C:\Windows\System\lDujFWT.exe
  C:\Windows\System\lDujFWT.exe
  2⤵
  PID:6036
- C:\Windows\System\dWRAGpT.exe
  C:\Windows\System\dWRAGpT.exe
  2⤵
  PID:6064
- C:\Windows\System\yqDofAq.exe
  C:\Windows\System\yqDofAq.exe
  2⤵
  PID:6092
- C:\Windows\System\sDAEFRB.exe
  C:\Windows\System\sDAEFRB.exe
  2⤵
  PID:6120
- C:\Windows\System\DRjythk.exe
  C:\Windows\System\DRjythk.exe
  2⤵
  PID:5124
- C:\Windows\System\xApIbTb.exe
  C:\Windows\System\xApIbTb.exe
  2⤵
  PID:5204
- C:\Windows\System\IrdOuOY.exe
  C:\Windows\System\IrdOuOY.exe
  2⤵
  PID:5256
- C:\Windows\System\jrjrvga.exe
  C:\Windows\System\jrjrvga.exe
  2⤵
  PID:5312
- C:\Windows\System\HpCvQvr.exe
  C:\Windows\System\HpCvQvr.exe
  2⤵
  PID:5344
- C:\Windows\System\FGMVqoH.exe
  C:\Windows\System\FGMVqoH.exe
  2⤵
  PID:5392
- C:\Windows\System\kRecDZe.exe
  C:\Windows\System\kRecDZe.exe
  2⤵
  PID:5476
- C:\Windows\System\jQGPiEh.exe
  C:\Windows\System\jQGPiEh.exe
  2⤵
  PID:5552
- C:\Windows\System\nLXMLSb.exe
  C:\Windows\System\nLXMLSb.exe
  2⤵
  PID:5596
- C:\Windows\System\CgGImrp.exe
  C:\Windows\System\CgGImrp.exe
  2⤵
  PID:5692
- C:\Windows\System\UXFhskU.exe
  C:\Windows\System\UXFhskU.exe
  2⤵
  PID:5736
- C:\Windows\System\bMryKHu.exe
  C:\Windows\System\bMryKHu.exe
  2⤵
  PID:5792
- C:\Windows\System\oNzNiIz.exe
  C:\Windows\System\oNzNiIz.exe
  2⤵
  PID:5872
- C:\Windows\System\rDYwdLl.exe
  C:\Windows\System\rDYwdLl.exe
  2⤵
  PID:5972
- C:\Windows\System\OfFJxBr.exe
  C:\Windows\System\OfFJxBr.exe
  2⤵
  PID:6048
- C:\Windows\System\VPnoDbj.exe
  C:\Windows\System\VPnoDbj.exe
  2⤵
  PID:6060
- C:\Windows\System\VlNwmwn.exe
  C:\Windows\System\VlNwmwn.exe
  2⤵
  PID:6136
- C:\Windows\System\CcLLyCI.exe
  C:\Windows\System\CcLLyCI.exe
  2⤵
  PID:5292
- C:\Windows\System\zCFstie.exe
  C:\Windows\System\zCFstie.exe
  2⤵
  PID:5536
- C:\Windows\System\MQsPVwP.exe
  C:\Windows\System\MQsPVwP.exe
  2⤵
  PID:5708
- C:\Windows\System\AHRzKiY.exe
  C:\Windows\System\AHRzKiY.exe
  2⤵
  PID:5784
- C:\Windows\System\QoLXZOH.exe
  C:\Windows\System\QoLXZOH.exe
  2⤵
  PID:5780
- C:\Windows\System\UrmtXjw.exe
  C:\Windows\System\UrmtXjw.exe
  2⤵
  PID:6104
- C:\Windows\System\RHvgOYe.exe
  C:\Windows\System\RHvgOYe.exe
  2⤵
  PID:5296
- C:\Windows\System\vtLreNT.exe
  C:\Windows\System\vtLreNT.exe
  2⤵
  PID:5388
- C:\Windows\System\uSDCAFH.exe
  C:\Windows\System\uSDCAFH.exe
  2⤵
  PID:5760
- C:\Windows\System\eDREMlk.exe
  C:\Windows\System\eDREMlk.exe
  2⤵
  PID:4560
- C:\Windows\System\SFTucjf.exe
  C:\Windows\System\SFTucjf.exe
  2⤵
  PID:6112
- C:\Windows\System\YUUfviu.exe
  C:\Windows\System\YUUfviu.exe
  2⤵
  PID:6168
- C:\Windows\System\qIUovtv.exe
  C:\Windows\System\qIUovtv.exe
  2⤵
  PID:6188
- C:\Windows\System\ZimdZGM.exe
  C:\Windows\System\ZimdZGM.exe
  2⤵
  PID:6220
- C:\Windows\System\SZSghaw.exe
  C:\Windows\System\SZSghaw.exe
  2⤵
  PID:6248
- C:\Windows\System\vAgeZfl.exe
  C:\Windows\System\vAgeZfl.exe
  2⤵
  PID:6288
- C:\Windows\System\tifPhJz.exe
  C:\Windows\System\tifPhJz.exe
  2⤵
  PID:6312
- C:\Windows\System\EmpPQxq.exe
  C:\Windows\System\EmpPQxq.exe
  2⤵
  PID:6332
- C:\Windows\System\dcIHTZD.exe
  C:\Windows\System\dcIHTZD.exe
  2⤵
  PID:6364
- C:\Windows\System\vlAHtGC.exe
  C:\Windows\System\vlAHtGC.exe
  2⤵
  PID:6392
- C:\Windows\System\jYchkGk.exe
  C:\Windows\System\jYchkGk.exe
  2⤵
  PID:6420
- C:\Windows\System\kgKQfSc.exe
  C:\Windows\System\kgKQfSc.exe
  2⤵
  PID:6448
- C:\Windows\System\kaQwOab.exe
  C:\Windows\System\kaQwOab.exe
  2⤵
  PID:6476
- C:\Windows\System\iLIoJcz.exe
  C:\Windows\System\iLIoJcz.exe
  2⤵
  PID:6508
- C:\Windows\System\IsfZzKk.exe
  C:\Windows\System\IsfZzKk.exe
  2⤵
  PID:6540
- C:\Windows\System\arecXCL.exe
  C:\Windows\System\arecXCL.exe
  2⤵
  PID:6560
- C:\Windows\System\KvdXzlP.exe
  C:\Windows\System\KvdXzlP.exe
  2⤵
  PID:6588
- C:\Windows\System\fVMQOvO.exe
  C:\Windows\System\fVMQOvO.exe
  2⤵
  PID:6616
- C:\Windows\System\EzyVxOB.exe
  C:\Windows\System\EzyVxOB.exe
  2⤵
  PID:6648
- C:\Windows\System\YLnXBvF.exe
  C:\Windows\System\YLnXBvF.exe
  2⤵
  PID:6676
- C:\Windows\System\VmEMnLS.exe
  C:\Windows\System\VmEMnLS.exe
  2⤵
  PID:6696
- C:\Windows\System\VlJVIIy.exe
  C:\Windows\System\VlJVIIy.exe
  2⤵
  PID:6720
- C:\Windows\System\epibWba.exe
  C:\Windows\System\epibWba.exe
  2⤵
  PID:6740
- C:\Windows\System\YyNyeHY.exe
  C:\Windows\System\YyNyeHY.exe
  2⤵
  PID:6768
- C:\Windows\System\fkGbcOI.exe
  C:\Windows\System\fkGbcOI.exe
  2⤵
  PID:6792
- C:\Windows\System\FAtiyyJ.exe
  C:\Windows\System\FAtiyyJ.exe
  2⤵
  PID:6812
- C:\Windows\System\lijXrWx.exe
  C:\Windows\System\lijXrWx.exe
  2⤵
  PID:6844
- C:\Windows\System\QDWdeHu.exe
  C:\Windows\System\QDWdeHu.exe
  2⤵
  PID:6876
- C:\Windows\System\AEjCSWS.exe
  C:\Windows\System\AEjCSWS.exe
  2⤵
  PID:6904
- C:\Windows\System\lkKqKeK.exe
  C:\Windows\System\lkKqKeK.exe
  2⤵
  PID:6932
- C:\Windows\System\PEEIiRB.exe
  C:\Windows\System\PEEIiRB.exe
  2⤵
  PID:6964
- C:\Windows\System\cxlQtqN.exe
  C:\Windows\System\cxlQtqN.exe
  2⤵
  PID:6988
- C:\Windows\System\kMrCKeG.exe
  C:\Windows\System\kMrCKeG.exe
  2⤵
  PID:7016
- C:\Windows\System\loAQsNe.exe
  C:\Windows\System\loAQsNe.exe
  2⤵
  PID:7044
- C:\Windows\System\EaLwSkg.exe
  C:\Windows\System\EaLwSkg.exe
  2⤵
  PID:7072
- C:\Windows\System\qpKIbtU.exe
  C:\Windows\System\qpKIbtU.exe
  2⤵
  PID:7104
- C:\Windows\System\TRcvAkh.exe
  C:\Windows\System\TRcvAkh.exe
  2⤵
  PID:7124
- C:\Windows\System\JfByAkC.exe
  C:\Windows\System\JfByAkC.exe
  2⤵
  PID:7152
- C:\Windows\System\zjUIZiE.exe
  C:\Windows\System\zjUIZiE.exe
  2⤵
  PID:5576
- C:\Windows\System\zpqbJRN.exe
  C:\Windows\System\zpqbJRN.exe
  2⤵
  PID:6244
- C:\Windows\System\rLFbVjk.exe
  C:\Windows\System\rLFbVjk.exe
  2⤵
  PID:6212
- C:\Windows\System\ZNJEYED.exe
  C:\Windows\System\ZNJEYED.exe
  2⤵
  PID:6324
- C:\Windows\System\iLZfzAb.exe
  C:\Windows\System\iLZfzAb.exe
  2⤵
  PID:6340
- C:\Windows\System\BSMpBdf.exe
  C:\Windows\System\BSMpBdf.exe
  2⤵
  PID:6524
- C:\Windows\System\byNyEUI.exe
  C:\Windows\System\byNyEUI.exe
  2⤵
  PID:6580
- C:\Windows\System\CXwcOEz.exe
  C:\Windows\System\CXwcOEz.exe
  2⤵
  PID:6504
- C:\Windows\System\VGREDjT.exe
  C:\Windows\System\VGREDjT.exe
  2⤵
  PID:6640
- C:\Windows\System\BgUMzfs.exe
  C:\Windows\System\BgUMzfs.exe
  2⤵
  PID:6656
- C:\Windows\System\hwpBVXr.exe
  C:\Windows\System\hwpBVXr.exe
  2⤵
  PID:6836
- C:\Windows\System\ZzTHrDQ.exe
  C:\Windows\System\ZzTHrDQ.exe
  2⤵
  PID:6780
- C:\Windows\System\lcmMuVv.exe
  C:\Windows\System\lcmMuVv.exe
  2⤵
  PID:6884
- C:\Windows\System\LzBBmwC.exe
  C:\Windows\System\LzBBmwC.exe
  2⤵
  PID:6952
- C:\Windows\System\fCbBJmj.exe
  C:\Windows\System\fCbBJmj.exe
  2⤵
  PID:7032
- C:\Windows\System\xGGRwkk.exe
  C:\Windows\System\xGGRwkk.exe
  2⤵
  PID:7064
- C:\Windows\System\DdSKvWi.exe
  C:\Windows\System\DdSKvWi.exe
  2⤵
  PID:7112
- C:\Windows\System\iUbqkBd.exe
  C:\Windows\System\iUbqkBd.exe
  2⤵
  PID:7164
- C:\Windows\System\lGZNUIv.exe
  C:\Windows\System\lGZNUIv.exe
  2⤵
  PID:6204
- C:\Windows\System\ePWbSQW.exe
  C:\Windows\System\ePWbSQW.exe
  2⤵
  PID:6520
- C:\Windows\System\mfevzDy.exe
  C:\Windows\System\mfevzDy.exe
  2⤵
  PID:6272
- C:\Windows\System\CtuTXax.exe
  C:\Windows\System\CtuTXax.exe
  2⤵
  PID:6800
- C:\Windows\System\iZgEuPk.exe
  C:\Windows\System\iZgEuPk.exe
  2⤵
  PID:6688
- C:\Windows\System\rDiGPzS.exe
  C:\Windows\System\rDiGPzS.exe
  2⤵
  PID:6928
- C:\Windows\System\FUfOqHe.exe
  C:\Windows\System\FUfOqHe.exe
  2⤵
  PID:6356
- C:\Windows\System\cWywYAG.exe
  C:\Windows\System\cWywYAG.exe
  2⤵
  PID:6488
- C:\Windows\System\pKCOTfB.exe
  C:\Windows\System\pKCOTfB.exe
  2⤵
  PID:7188
- C:\Windows\System\wNxvXlt.exe
  C:\Windows\System\wNxvXlt.exe
  2⤵
  PID:7212
- C:\Windows\System\GRawNtV.exe
  C:\Windows\System\GRawNtV.exe
  2⤵
  PID:7236
- C:\Windows\System\bjKyMxk.exe
  C:\Windows\System\bjKyMxk.exe
  2⤵
  PID:7268
- C:\Windows\System\YwLxzMa.exe
  C:\Windows\System\YwLxzMa.exe
  2⤵
  PID:7288
- C:\Windows\System\aWGvavz.exe
  C:\Windows\System\aWGvavz.exe
  2⤵
  PID:7304
- C:\Windows\System\bUBrsQx.exe
  C:\Windows\System\bUBrsQx.exe
  2⤵
  PID:7332
- C:\Windows\System\MTistIQ.exe
  C:\Windows\System\MTistIQ.exe
  2⤵
  PID:7364
- C:\Windows\System\kKlGNfE.exe
  C:\Windows\System\kKlGNfE.exe
  2⤵
  PID:7392
- C:\Windows\System\UedFsJc.exe
  C:\Windows\System\UedFsJc.exe
  2⤵
  PID:7420
- C:\Windows\System\gDrJaeU.exe
  C:\Windows\System\gDrJaeU.exe
  2⤵
  PID:7448
- C:\Windows\System\NIvxfKB.exe
  C:\Windows\System\NIvxfKB.exe
  2⤵
  PID:7484
- C:\Windows\System\ISiylay.exe
  C:\Windows\System\ISiylay.exe
  2⤵
  PID:7516
- C:\Windows\System\hZHklNL.exe
  C:\Windows\System\hZHklNL.exe
  2⤵
  PID:7540
- C:\Windows\System\hDjDENX.exe
  C:\Windows\System\hDjDENX.exe
  2⤵
  PID:7572
- C:\Windows\System\HmjxKUt.exe
  C:\Windows\System\HmjxKUt.exe
  2⤵
  PID:7600
- C:\Windows\System\qLqWoOZ.exe
  C:\Windows\System\qLqWoOZ.exe
  2⤵
  PID:7628
- C:\Windows\System\wVEyIKM.exe
  C:\Windows\System\wVEyIKM.exe
  2⤵
  PID:7648
- C:\Windows\System\zsYSAtw.exe
  C:\Windows\System\zsYSAtw.exe
  2⤵
  PID:7668
- C:\Windows\System\CLsLgRv.exe
  C:\Windows\System\CLsLgRv.exe
  2⤵
  PID:7696
- C:\Windows\System\NnQjIsI.exe
  C:\Windows\System\NnQjIsI.exe
  2⤵
  PID:7712
- C:\Windows\System\taWmgJo.exe
  C:\Windows\System\taWmgJo.exe
  2⤵
  PID:7744
- C:\Windows\System\cdoJRXE.exe
  C:\Windows\System\cdoJRXE.exe
  2⤵
  PID:7772
- C:\Windows\System\clvQPnY.exe
  C:\Windows\System\clvQPnY.exe
  2⤵
  PID:7796
- C:\Windows\System\fERcrdn.exe
  C:\Windows\System\fERcrdn.exe
  2⤵
  PID:7824
- C:\Windows\System\eZvvyLE.exe
  C:\Windows\System\eZvvyLE.exe
  2⤵
  PID:7856
- C:\Windows\System\WnUCeWT.exe
  C:\Windows\System\WnUCeWT.exe
  2⤵
  PID:7888
- C:\Windows\System\iQaDbGH.exe
  C:\Windows\System\iQaDbGH.exe
  2⤵
  PID:7916
- C:\Windows\System\lpjVWBI.exe
  C:\Windows\System\lpjVWBI.exe
  2⤵
  PID:7948
- C:\Windows\System\loaUbss.exe
  C:\Windows\System\loaUbss.exe
  2⤵
  PID:7976
- C:\Windows\System\dQdVQFu.exe
  C:\Windows\System\dQdVQFu.exe
  2⤵
  PID:8012
- C:\Windows\System\dWrbJxC.exe
  C:\Windows\System\dWrbJxC.exe
  2⤵
  PID:8040
- C:\Windows\System\oBtCrjB.exe
  C:\Windows\System\oBtCrjB.exe
  2⤵
  PID:8068
- C:\Windows\System\pPIwNpw.exe
  C:\Windows\System\pPIwNpw.exe
  2⤵
  PID:8092
- C:\Windows\System\qPgQUZH.exe
  C:\Windows\System\qPgQUZH.exe
  2⤵
  PID:8112
- C:\Windows\System\THuGJbV.exe
  C:\Windows\System\THuGJbV.exe
  2⤵
  PID:8144
- C:\Windows\System\MSSaSUV.exe
  C:\Windows\System\MSSaSUV.exe
  2⤵
  PID:8168
- C:\Windows\System\VuHUDwh.exe
  C:\Windows\System\VuHUDwh.exe
  2⤵
  PID:6976
- C:\Windows\System\JLkUuNh.exe
  C:\Windows\System\JLkUuNh.exe
  2⤵
  PID:7176
- C:\Windows\System\ZWSdEKo.exe
  C:\Windows\System\ZWSdEKo.exe
  2⤵
  PID:6788
- C:\Windows\System\ibQJbwn.exe
  C:\Windows\System\ibQJbwn.exe
  2⤵
  PID:5956
- C:\Windows\System\YwHnucH.exe
  C:\Windows\System\YwHnucH.exe
  2⤵
  PID:7348
- C:\Windows\System\mbCVRfi.exe
  C:\Windows\System\mbCVRfi.exe
  2⤵
  PID:7220
- C:\Windows\System\iFgFGFY.exe
  C:\Windows\System\iFgFGFY.exe
  2⤵
  PID:7476
- C:\Windows\System\LhWYIcj.exe
  C:\Windows\System\LhWYIcj.exe
  2⤵
  PID:7508
- C:\Windows\System\lLZiubO.exe
  C:\Windows\System\lLZiubO.exe
  2⤵
  PID:7408
- C:\Windows\System\dXxYLbQ.exe
  C:\Windows\System\dXxYLbQ.exe
  2⤵
  PID:7624
- C:\Windows\System\oZHzSFF.exe
  C:\Windows\System\oZHzSFF.exe
  2⤵
  PID:7688
- C:\Windows\System\bxKNAOO.exe
  C:\Windows\System\bxKNAOO.exe
  2⤵
  PID:7768
- C:\Windows\System\KDiQmmR.exe
  C:\Windows\System\KDiQmmR.exe
  2⤵
  PID:7764
- C:\Windows\System\qeUuXqo.exe
  C:\Windows\System\qeUuXqo.exe
  2⤵
  PID:7928
- C:\Windows\System\HMCzkQO.exe
  C:\Windows\System\HMCzkQO.exe
  2⤵
  PID:7836
- C:\Windows\System\tYEupCb.exe
  C:\Windows\System\tYEupCb.exe
  2⤵
  PID:7868
- C:\Windows\System\jUrqxbH.exe
  C:\Windows\System\jUrqxbH.exe
  2⤵
  PID:7968
- C:\Windows\System\VlnIruY.exe
  C:\Windows\System\VlnIruY.exe
  2⤵
  PID:7148
- C:\Windows\System\jvcRMRJ.exe
  C:\Windows\System\jvcRMRJ.exe
  2⤵
  PID:7144
- C:\Windows\System\tQZRLtg.exe
  C:\Windows\System\tQZRLtg.exe
  2⤵
  PID:8180
- C:\Windows\System\thUzpnY.exe
  C:\Windows\System\thUzpnY.exe
  2⤵
  PID:8136
- C:\Windows\System\HFcgumv.exe
  C:\Windows\System\HFcgumv.exe
  2⤵
  PID:7500
- C:\Windows\System\gIMgudR.exe
  C:\Windows\System\gIMgudR.exe
  2⤵
  PID:7264
- C:\Windows\System\kdTHgua.exe
  C:\Windows\System\kdTHgua.exe
  2⤵
  PID:7552
- C:\Windows\System\OSkmEzD.exe
  C:\Windows\System\OSkmEzD.exe
  2⤵
  PID:7960
- C:\Windows\System\ywhxrep.exe
  C:\Windows\System\ywhxrep.exe
  2⤵
  PID:7908
- C:\Windows\System\oBnmBeC.exe
  C:\Windows\System\oBnmBeC.exe
  2⤵
  PID:5820
- C:\Windows\System\eQgvOpG.exe
  C:\Windows\System\eQgvOpG.exe
  2⤵
  PID:7400
- C:\Windows\System\szbzFlL.exe
  C:\Windows\System\szbzFlL.exe
  2⤵
  PID:8204
- C:\Windows\System\whbJZQx.exe
  C:\Windows\System\whbJZQx.exe
  2⤵
  PID:8232
- C:\Windows\System\iWLiFVv.exe
  C:\Windows\System\iWLiFVv.exe
  2⤵
  PID:8260
- C:\Windows\System\GSdyoZw.exe
  C:\Windows\System\GSdyoZw.exe
  2⤵
  PID:8284
- C:\Windows\System\PVkiUUL.exe
  C:\Windows\System\PVkiUUL.exe
  2⤵
  PID:8316
- C:\Windows\System\GcYuivl.exe
  C:\Windows\System\GcYuivl.exe
  2⤵
  PID:8344
- C:\Windows\System\YNmHjCM.exe
  C:\Windows\System\YNmHjCM.exe
  2⤵
  PID:8372
- C:\Windows\System\GsdSgfi.exe
  C:\Windows\System\GsdSgfi.exe
  2⤵
  PID:8400
- C:\Windows\System\hyDCiPS.exe
  C:\Windows\System\hyDCiPS.exe
  2⤵
  PID:8436
- C:\Windows\System\LpOXQgB.exe
  C:\Windows\System\LpOXQgB.exe
  2⤵
  PID:8460
- C:\Windows\System\fiuVGCu.exe
  C:\Windows\System\fiuVGCu.exe
  2⤵
  PID:8484
- C:\Windows\System\BtFAGuI.exe
  C:\Windows\System\BtFAGuI.exe
  2⤵
  PID:8516
- C:\Windows\System\LIuQhvo.exe
  C:\Windows\System\LIuQhvo.exe
  2⤵
  PID:8540
- C:\Windows\System\IhMInfG.exe
  C:\Windows\System\IhMInfG.exe
  2⤵
  PID:8568
- C:\Windows\System\BVkmqNa.exe
  C:\Windows\System\BVkmqNa.exe
  2⤵
  PID:8600
- C:\Windows\System\YIUidyh.exe
  C:\Windows\System\YIUidyh.exe
  2⤵
  PID:8636
- C:\Windows\System\lwNuQYU.exe
  C:\Windows\System\lwNuQYU.exe
  2⤵
  PID:8672
- C:\Windows\System\mBqQjzm.exe
  C:\Windows\System\mBqQjzm.exe
  2⤵
  PID:8704
- C:\Windows\System\ZtLzSCE.exe
  C:\Windows\System\ZtLzSCE.exe
  2⤵
  PID:8732
- C:\Windows\System\eumasCV.exe
  C:\Windows\System\eumasCV.exe
  2⤵
  PID:8748
- C:\Windows\System\VoSAopI.exe
  C:\Windows\System\VoSAopI.exe
  2⤵
  PID:8776
- C:\Windows\System\CEPXafa.exe
  C:\Windows\System\CEPXafa.exe
  2⤵
  PID:8800
- C:\Windows\System\DfkApYR.exe
  C:\Windows\System\DfkApYR.exe
  2⤵
  PID:8832
- C:\Windows\System\ysnWriD.exe
  C:\Windows\System\ysnWriD.exe
  2⤵
  PID:8856
- C:\Windows\System\IwWtcDs.exe
  C:\Windows\System\IwWtcDs.exe
  2⤵
  PID:8884
- C:\Windows\System\mjQqlUu.exe
  C:\Windows\System\mjQqlUu.exe
  2⤵
  PID:8912
- C:\Windows\System\hzvXzZz.exe
  C:\Windows\System\hzvXzZz.exe
  2⤵
  PID:8936
- C:\Windows\System\bAJAlgd.exe
  C:\Windows\System\bAJAlgd.exe
  2⤵
  PID:8960
- C:\Windows\System\rpzysTz.exe
  C:\Windows\System\rpzysTz.exe
  2⤵
  PID:8992
- C:\Windows\System\jhPuouX.exe
  C:\Windows\System\jhPuouX.exe
  2⤵
  PID:9016
- C:\Windows\System\JnaQKiB.exe
  C:\Windows\System\JnaQKiB.exe
  2⤵
  PID:9036
- C:\Windows\System\OiksBuq.exe
  C:\Windows\System\OiksBuq.exe
  2⤵
  PID:9068
- C:\Windows\System\BcOjNxq.exe
  C:\Windows\System\BcOjNxq.exe
  2⤵
  PID:9088
- C:\Windows\System\qztORpk.exe
  C:\Windows\System\qztORpk.exe
  2⤵
  PID:9120
- C:\Windows\System\UXUsBYm.exe
  C:\Windows\System\UXUsBYm.exe
  2⤵
  PID:9152
- C:\Windows\System\AUdwSEE.exe
  C:\Windows\System\AUdwSEE.exe
  2⤵
  PID:9184
- C:\Windows\System\ksQETnG.exe
  C:\Windows\System\ksQETnG.exe
  2⤵
  PID:9212
- C:\Windows\System\NieKtFS.exe
  C:\Windows\System\NieKtFS.exe
  2⤵
  PID:7816
- C:\Windows\System\NomMMJo.exe
  C:\Windows\System\NomMMJo.exe
  2⤵
  PID:8084
- C:\Windows\System\EzuDCDQ.exe
  C:\Windows\System\EzuDCDQ.exe
  2⤵
  PID:7708
- C:\Windows\System\gxmybpD.exe
  C:\Windows\System\gxmybpD.exe
  2⤵
  PID:7200
- C:\Windows\System\goyNEUW.exe
  C:\Windows\System\goyNEUW.exe
  2⤵
  PID:8332
- C:\Windows\System\QjpMqtF.exe
  C:\Windows\System\QjpMqtF.exe
  2⤵
  PID:8396
- C:\Windows\System\MWcenUC.exe
  C:\Windows\System\MWcenUC.exe
  2⤵
  PID:8492
- C:\Windows\System\OkhtTZi.exe
  C:\Windows\System\OkhtTZi.exe
  2⤵
  PID:8448
- C:\Windows\System\hqnLOAB.exe
  C:\Windows\System\hqnLOAB.exe
  2⤵
  PID:8656
- C:\Windows\System\eutXSEQ.exe
  C:\Windows\System\eutXSEQ.exe
  2⤵
  PID:8596
- C:\Windows\System\jBzmIyu.exe
  C:\Windows\System\jBzmIyu.exe
  2⤵
  PID:8716
- C:\Windows\System\wxlQvBy.exe
  C:\Windows\System\wxlQvBy.exe
  2⤵
  PID:8696
- C:\Windows\System\KDaJNpK.exe
  C:\Windows\System\KDaJNpK.exe
  2⤵
  PID:8820
- C:\Windows\System\lXWoaXt.exe
  C:\Windows\System\lXWoaXt.exe
  2⤵
  PID:8980
- C:\Windows\System\wkzeUpO.exe
  C:\Windows\System\wkzeUpO.exe
  2⤵
  PID:9024
- C:\Windows\System\PyLIofD.exe
  C:\Windows\System\PyLIofD.exe
  2⤵
  PID:9052
- C:\Windows\System\fmtSOqC.exe
  C:\Windows\System\fmtSOqC.exe
  2⤵
  PID:9096
- C:\Windows\System\PWKCUQb.exe
  C:\Windows\System\PWKCUQb.exe
  2⤵
  PID:9012
- C:\Windows\System\jmVRgxc.exe
  C:\Windows\System\jmVRgxc.exe
  2⤵
  PID:9108
- C:\Windows\System\ZCFRSFx.exe
  C:\Windows\System\ZCFRSFx.exe
  2⤵
  PID:8340
- C:\Windows\System\SMSKyYB.exe
  C:\Windows\System\SMSKyYB.exe
  2⤵
  PID:8380
- C:\Windows\System\gCgEsFs.exe
  C:\Windows\System\gCgEsFs.exe
  2⤵
  PID:9132
- C:\Windows\System\iTkFwBr.exe
  C:\Windows\System\iTkFwBr.exe
  2⤵
  PID:8680
- C:\Windows\System\YESwhKh.exe
  C:\Windows\System\YESwhKh.exe
  2⤵
  PID:8432
- C:\Windows\System\GmUkucs.exe
  C:\Windows\System\GmUkucs.exe
  2⤵
  PID:8228
- C:\Windows\System\HczNCiv.exe
  C:\Windows\System\HczNCiv.exe
  2⤵
  PID:8988
- C:\Windows\System\SZrButc.exe
  C:\Windows\System\SZrButc.exe
  2⤵
  PID:9208
- C:\Windows\System\pTbarZk.exe
  C:\Windows\System\pTbarZk.exe
  2⤵
  PID:7444
- C:\Windows\System\OqcXRAG.exe
  C:\Windows\System\OqcXRAG.exe
  2⤵
  PID:9240
- C:\Windows\System\SDGhxsS.exe
  C:\Windows\System\SDGhxsS.exe
  2⤵
  PID:9272
- C:\Windows\System\xROWIDN.exe
  C:\Windows\System\xROWIDN.exe
  2⤵
  PID:9300
- C:\Windows\System\gENhmUJ.exe
  C:\Windows\System\gENhmUJ.exe
  2⤵
  PID:9320
- C:\Windows\System\ZGpEKGm.exe
  C:\Windows\System\ZGpEKGm.exe
  2⤵
  PID:9348
- C:\Windows\System\SzGyVXV.exe
  C:\Windows\System\SzGyVXV.exe
  2⤵
  PID:9376
- C:\Windows\System\PONTbFe.exe
  C:\Windows\System\PONTbFe.exe
  2⤵
  PID:9400
- C:\Windows\System\vonniOX.exe
  C:\Windows\System\vonniOX.exe
  2⤵
  PID:9424
- C:\Windows\System\pEodvcQ.exe
  C:\Windows\System\pEodvcQ.exe
  2⤵
  PID:9456
- C:\Windows\System\iPaoXDX.exe
  C:\Windows\System\iPaoXDX.exe
  2⤵
  PID:9476
- C:\Windows\System\iZnViiL.exe
  C:\Windows\System\iZnViiL.exe
  2⤵
  PID:9536
- C:\Windows\System\nWvuioX.exe
  C:\Windows\System\nWvuioX.exe
  2⤵
  PID:9560
- C:\Windows\System\aNfgtKd.exe
  C:\Windows\System\aNfgtKd.exe
  2⤵
  PID:9596
- C:\Windows\System\TwUCGXv.exe
  C:\Windows\System\TwUCGXv.exe
  2⤵
  PID:9628
- C:\Windows\System\CMZfEAy.exe
  C:\Windows\System\CMZfEAy.exe
  2⤵
  PID:9652
- C:\Windows\System\XVrubLp.exe
  C:\Windows\System\XVrubLp.exe
  2⤵
  PID:9680
- C:\Windows\System\nvkwYrY.exe
  C:\Windows\System\nvkwYrY.exe
  2⤵
  PID:9708
- C:\Windows\System\tWnWvQF.exe
  C:\Windows\System\tWnWvQF.exe
  2⤵
  PID:9740
- C:\Windows\System\LXWfaoa.exe
  C:\Windows\System\LXWfaoa.exe
  2⤵
  PID:9764
- C:\Windows\System\bqObdWp.exe
  C:\Windows\System\bqObdWp.exe
  2⤵
  PID:9796
- C:\Windows\System\gYlcKrH.exe
  C:\Windows\System\gYlcKrH.exe
  2⤵
  PID:9836
- C:\Windows\System\dyRRUUD.exe
  C:\Windows\System\dyRRUUD.exe
  2⤵
  PID:9860
- C:\Windows\System\LNdiUsC.exe
  C:\Windows\System\LNdiUsC.exe
  2⤵
  PID:9892
- C:\Windows\System\yGjNJAz.exe
  C:\Windows\System\yGjNJAz.exe
  2⤵
  PID:9920
- C:\Windows\System\IocXFxo.exe
  C:\Windows\System\IocXFxo.exe
  2⤵
  PID:9948
- C:\Windows\System\ogNrmQm.exe
  C:\Windows\System\ogNrmQm.exe
  2⤵
  PID:9976
- C:\Windows\System\lpplrzX.exe
  C:\Windows\System\lpplrzX.exe
  2⤵
  PID:9996
- C:\Windows\System\IhXSOsc.exe
  C:\Windows\System\IhXSOsc.exe
  2⤵
  PID:10028
- C:\Windows\System\awYayqE.exe
  C:\Windows\System\awYayqE.exe
  2⤵
  PID:10048
- C:\Windows\System\XIERsxp.exe
  C:\Windows\System\XIERsxp.exe
  2⤵
  PID:10072
- C:\Windows\System\HciyfjF.exe
  C:\Windows\System\HciyfjF.exe
  2⤵
  PID:10100
- C:\Windows\System\vYRqPZD.exe
  C:\Windows\System\vYRqPZD.exe
  2⤵
  PID:10128
- C:\Windows\System\QYasYiG.exe
  C:\Windows\System\QYasYiG.exe
  2⤵
  PID:10156
- C:\Windows\System\KJAJlaX.exe
  C:\Windows\System\KJAJlaX.exe
  2⤵
  PID:10176
- C:\Windows\System\KkeKVLn.exe
  C:\Windows\System\KkeKVLn.exe
  2⤵
  PID:10200
- C:\Windows\System\OThsUAh.exe
  C:\Windows\System\OThsUAh.exe
  2⤵
  PID:10220
- C:\Windows\System\oPeYOcq.exe
  C:\Windows\System\oPeYOcq.exe
  2⤵
  PID:9180
- C:\Windows\System\liKlJGa.exe
  C:\Windows\System\liKlJGa.exe
  2⤵
  PID:8788
- C:\Windows\System\oEHHiYz.exe
  C:\Windows\System\oEHHiYz.exe
  2⤵
  PID:8276
- C:\Windows\System\UQWMymq.exe
  C:\Windows\System\UQWMymq.exe
  2⤵
  PID:9224
- C:\Windows\System\ylOjLrP.exe
  C:\Windows\System\ylOjLrP.exe
  2⤵
  PID:9192
- C:\Windows\System\bGonkSK.exe
  C:\Windows\System\bGonkSK.exe
  2⤵
  PID:9360
- C:\Windows\System\umoOscI.exe
  C:\Windows\System\umoOscI.exe
  2⤵
  PID:9332
- C:\Windows\System\GohhgZb.exe
  C:\Windows\System\GohhgZb.exe
  2⤵
  PID:9396
- C:\Windows\System\TzXIbBS.exe
  C:\Windows\System\TzXIbBS.exe
  2⤵
  PID:9312
- C:\Windows\System\zXzZPaQ.exe
  C:\Windows\System\zXzZPaQ.exe
  2⤵
  PID:9644
- C:\Windows\System\daUwwJc.exe
  C:\Windows\System\daUwwJc.exe
  2⤵
  PID:9756
- C:\Windows\System\npjXzQq.exe
  C:\Windows\System\npjXzQq.exe
  2⤵
  PID:9792
- C:\Windows\System\MlslnGR.exe
  C:\Windows\System\MlslnGR.exe
  2⤵
  PID:9884
- C:\Windows\System\PdPhWjn.exe
  C:\Windows\System\PdPhWjn.exe
  2⤵
  PID:9968
- C:\Windows\System\nKklyxF.exe
  C:\Windows\System\nKklyxF.exe
  2⤵
  PID:10008
- C:\Windows\System\PPTMXWt.exe
  C:\Windows\System\PPTMXWt.exe
  2⤵
  PID:9856
- C:\Windows\System\qxBSPHz.exe
  C:\Windows\System\qxBSPHz.exe
  2⤵
  PID:9700
- C:\Windows\System\qZyTtAi.exe
  C:\Windows\System\qZyTtAi.exe
  2⤵
  PID:10208
- C:\Windows\System\MAprkXV.exe
  C:\Windows\System\MAprkXV.exe
  2⤵
  PID:10068
- C:\Windows\System\VYzbPMu.exe
  C:\Windows\System\VYzbPMu.exe
  2⤵
  PID:10112
- C:\Windows\System\MrgqzfJ.exe
  C:\Windows\System\MrgqzfJ.exe
  2⤵
  PID:9616
- C:\Windows\System\viyfEQk.exe
  C:\Windows\System\viyfEQk.exe
  2⤵
  PID:10148
- C:\Windows\System\hTTGHQE.exe
  C:\Windows\System\hTTGHQE.exe
  2⤵
  PID:9488
- C:\Windows\System\gXQKsCZ.exe
  C:\Windows\System\gXQKsCZ.exe
  2⤵
  PID:8632
- C:\Windows\System\snFBMLH.exe
  C:\Windows\System\snFBMLH.exe
  2⤵
  PID:10140
- C:\Windows\System\sUHEwtK.exe
  C:\Windows\System\sUHEwtK.exe
  2⤵
  PID:9848
- C:\Windows\System\InsIfAH.exe
  C:\Windows\System\InsIfAH.exe
  2⤵
  PID:10088
- C:\Windows\System\HCpDWde.exe
  C:\Windows\System\HCpDWde.exe
  2⤵
  PID:10272
- C:\Windows\System\lOsqufZ.exe
  C:\Windows\System\lOsqufZ.exe
  2⤵
  PID:10304
- C:\Windows\System\KqeXssd.exe
  C:\Windows\System\KqeXssd.exe
  2⤵
  PID:10328
- C:\Windows\System\FyvQWZK.exe
  C:\Windows\System\FyvQWZK.exe
  2⤵
  PID:10352
- C:\Windows\System\feyWZOM.exe
  C:\Windows\System\feyWZOM.exe
  2⤵
  PID:10372
- C:\Windows\System\KWzxdOi.exe
  C:\Windows\System\KWzxdOi.exe
  2⤵
  PID:10412
- C:\Windows\System\KtKzQtI.exe
  C:\Windows\System\KtKzQtI.exe
  2⤵
  PID:10436
- C:\Windows\System\GEBRHpH.exe
  C:\Windows\System\GEBRHpH.exe
  2⤵
  PID:10468
- C:\Windows\System\aEsmFVY.exe
  C:\Windows\System\aEsmFVY.exe
  2⤵
  PID:10500
- C:\Windows\System\GfBJvGI.exe
  C:\Windows\System\GfBJvGI.exe
  2⤵
  PID:10524
- C:\Windows\System\lRUhCfn.exe
  C:\Windows\System\lRUhCfn.exe
  2⤵
  PID:10544
- C:\Windows\System\AkSpBed.exe
  C:\Windows\System\AkSpBed.exe
  2⤵
  PID:10572
- C:\Windows\System\GpREgjj.exe
  C:\Windows\System\GpREgjj.exe
  2⤵
  PID:10596
- C:\Windows\System\OvLXagn.exe
  C:\Windows\System\OvLXagn.exe
  2⤵
  PID:10624
- C:\Windows\System\TngmvUG.exe
  C:\Windows\System\TngmvUG.exe
  2⤵
  PID:10660
- C:\Windows\System\eVJqmkp.exe
  C:\Windows\System\eVJqmkp.exe
  2⤵
  PID:10680
- C:\Windows\System\yswoULV.exe
  C:\Windows\System\yswoULV.exe
  2⤵
  PID:10708
- C:\Windows\System\SphQgNt.exe
  C:\Windows\System\SphQgNt.exe
  2⤵
  PID:10728
- C:\Windows\System\xMJIixt.exe
  C:\Windows\System\xMJIixt.exe
  2⤵
  PID:10756
- C:\Windows\System\tKLAvaD.exe
  C:\Windows\System\tKLAvaD.exe
  2⤵
  PID:10788
- C:\Windows\System\XPKfiqg.exe
  C:\Windows\System\XPKfiqg.exe
  2⤵
  PID:10820
- C:\Windows\System\kSoARQI.exe
  C:\Windows\System\kSoARQI.exe
  2⤵
  PID:10860
- C:\Windows\System\xFZjzGr.exe
  C:\Windows\System\xFZjzGr.exe
  2⤵
  PID:10876
- C:\Windows\System\zlCWNlV.exe
  C:\Windows\System\zlCWNlV.exe
  2⤵
  PID:10904
- C:\Windows\System\AxKAsli.exe
  C:\Windows\System\AxKAsli.exe
  2⤵
  PID:10928
- C:\Windows\System\BFDBmDu.exe
  C:\Windows\System\BFDBmDu.exe
  2⤵
  PID:10960
- C:\Windows\System\ZnqasIh.exe
  C:\Windows\System\ZnqasIh.exe
  2⤵
  PID:10988
- C:\Windows\System\RsOSwST.exe
  C:\Windows\System\RsOSwST.exe
  2⤵
  PID:11012
- C:\Windows\System\EeObtgb.exe
  C:\Windows\System\EeObtgb.exe
  2⤵
  PID:11040
- C:\Windows\System\SCxdYDQ.exe
  C:\Windows\System\SCxdYDQ.exe
  2⤵
  PID:11068
- C:\Windows\System\ImFnaKS.exe
  C:\Windows\System\ImFnaKS.exe
  2⤵
  PID:11104
- C:\Windows\System\LmXqanp.exe
  C:\Windows\System\LmXqanp.exe
  2⤵
  PID:11128
- C:\Windows\System\FZBPMtA.exe
  C:\Windows\System\FZBPMtA.exe
  2⤵
  PID:11152
- C:\Windows\System\JFmAzex.exe
  C:\Windows\System\JFmAzex.exe
  2⤵
  PID:11176
- C:\Windows\System\NNJYjDT.exe
  C:\Windows\System\NNJYjDT.exe
  2⤵
  PID:11200
- C:\Windows\System\oblGWHt.exe
  C:\Windows\System\oblGWHt.exe
  2⤵
  PID:11228
- C:\Windows\System\iqKVSXV.exe
  C:\Windows\System\iqKVSXV.exe
  2⤵
  PID:11256
- C:\Windows\System\hqXULbG.exe
  C:\Windows\System\hqXULbG.exe
  2⤵
  PID:9880
- C:\Windows\System\OsxWDqm.exe
  C:\Windows\System\OsxWDqm.exe
  2⤵
  PID:9932
- C:\Windows\System\igVPign.exe
  C:\Windows\System\igVPign.exe
  2⤵
  PID:9936
- C:\Windows\System\xdsNxbZ.exe
  C:\Windows\System\xdsNxbZ.exe
  2⤵
  PID:10060
- C:\Windows\System\KeZlvQi.exe
  C:\Windows\System\KeZlvQi.exe
  2⤵
  PID:10368
- C:\Windows\System\qYZIxuC.exe
  C:\Windows\System\qYZIxuC.exe
  2⤵
  PID:10300
- C:\Windows\System\QLupIYm.exe
  C:\Windows\System\QLupIYm.exe
  2⤵
  PID:10340
- C:\Windows\System\UBMHmjG.exe
  C:\Windows\System\UBMHmjG.exe
  2⤵
  PID:10532
- C:\Windows\System\wmcxrJe.exe
  C:\Windows\System\wmcxrJe.exe
  2⤵
  PID:10560
- C:\Windows\System\nZtUsai.exe
  C:\Windows\System\nZtUsai.exe
  2⤵
  PID:10512
- C:\Windows\System\vCJjSCw.exe
  C:\Windows\System\vCJjSCw.exe
  2⤵
  PID:10776
- C:\Windows\System\enKNOPW.exe
  C:\Windows\System\enKNOPW.exe
  2⤵
  PID:10456
- C:\Windows\System\ZXFyvJK.exe
  C:\Windows\System\ZXFyvJK.exe
  2⤵
  PID:10648
- C:\Windows\System\RMtIwvK.exe
  C:\Windows\System\RMtIwvK.exe
  2⤵
  PID:10916
- C:\Windows\System\DmWPqJD.exe
  C:\Windows\System\DmWPqJD.exe
  2⤵
  PID:10536
- C:\Windows\System\UdLQiuZ.exe
  C:\Windows\System\UdLQiuZ.exe
  2⤵
  PID:11004
- C:\Windows\System\CrPNLvk.exe
  C:\Windows\System\CrPNLvk.exe
  2⤵
  PID:11056
- C:\Windows\System\IsmeHnL.exe
  C:\Windows\System\IsmeHnL.exe
  2⤵
  PID:10724
- C:\Windows\System\bPsWubI.exe
  C:\Windows\System\bPsWubI.exe
  2⤵
  PID:11164
- C:\Windows\System\uhyUaHf.exe
  C:\Windows\System\uhyUaHf.exe
  2⤵
  PID:11064
- C:\Windows\System\cSJuzZv.exe
  C:\Windows\System\cSJuzZv.exe
  2⤵
  PID:8480
- C:\Windows\System\cxxOKDX.exe
  C:\Windows\System\cxxOKDX.exe
  2⤵
  PID:10700
- C:\Windows\System\AZLGdPN.exe
  C:\Windows\System\AZLGdPN.exe
  2⤵
  PID:10428
- C:\Windows\System\PaZiHhS.exe
  C:\Windows\System\PaZiHhS.exe
  2⤵
  PID:9704
- C:\Windows\System\Ougehmh.exe
  C:\Windows\System\Ougehmh.exe
  2⤵
  PID:11284
- C:\Windows\System\YzTySBu.exe
  C:\Windows\System\YzTySBu.exe
  2⤵
  PID:11304
- C:\Windows\System\RgOJMkg.exe
  C:\Windows\System\RgOJMkg.exe
  2⤵
  PID:11340
- C:\Windows\System\BuRFpiC.exe
  C:\Windows\System\BuRFpiC.exe
  2⤵
  PID:11360
- C:\Windows\System\EfILTvO.exe
  C:\Windows\System\EfILTvO.exe
  2⤵
  PID:11384
- C:\Windows\System\KfwJZMb.exe
  C:\Windows\System\KfwJZMb.exe
  2⤵
  PID:11408
- C:\Windows\System\tyLmXXa.exe
  C:\Windows\System\tyLmXXa.exe
  2⤵
  PID:11432
- C:\Windows\System\QxCktbp.exe
  C:\Windows\System\QxCktbp.exe
  2⤵
  PID:11468
- C:\Windows\System\qsrFbBy.exe
  C:\Windows\System\qsrFbBy.exe
  2⤵
  PID:11492
- C:\Windows\System\ZnBhoxs.exe
  C:\Windows\System\ZnBhoxs.exe
  2⤵
  PID:11512
- C:\Windows\System\EbEdMEi.exe
  C:\Windows\System\EbEdMEi.exe
  2⤵
  PID:11544
- C:\Windows\System\FiTZmQQ.exe
  C:\Windows\System\FiTZmQQ.exe
  2⤵
  PID:11564
- C:\Windows\System\xeOOHSK.exe
  C:\Windows\System\xeOOHSK.exe
  2⤵
  PID:11596
- C:\Windows\System\ECnvFoj.exe
  C:\Windows\System\ECnvFoj.exe
  2⤵
  PID:11624
- C:\Windows\System\XMGYuOW.exe
  C:\Windows\System\XMGYuOW.exe
  2⤵
  PID:11644
- C:\Windows\System\ngWkGNt.exe
  C:\Windows\System\ngWkGNt.exe
  2⤵
  PID:11664
- C:\Windows\System\CHBCNTt.exe
  C:\Windows\System\CHBCNTt.exe
  2⤵
  PID:11700
- C:\Windows\System\CDzLRzb.exe
  C:\Windows\System\CDzLRzb.exe
  2⤵
  PID:11724
- C:\Windows\System\wyyiOmt.exe
  C:\Windows\System\wyyiOmt.exe
  2⤵
  PID:11748
- C:\Windows\System\qdiagml.exe
  C:\Windows\System\qdiagml.exe
  2⤵
  PID:11772
- C:\Windows\System\hvqGeJf.exe
  C:\Windows\System\hvqGeJf.exe
  2⤵
  PID:11796
- C:\Windows\System\aJwhsrV.exe
  C:\Windows\System\aJwhsrV.exe
  2⤵
  PID:11820
- C:\Windows\System\TTujWIf.exe
  C:\Windows\System\TTujWIf.exe
  2⤵
  PID:11848
- C:\Windows\System\KNSwojc.exe
  C:\Windows\System\KNSwojc.exe
  2⤵
  PID:11876
- C:\Windows\System\kvUfesd.exe
  C:\Windows\System\kvUfesd.exe
  2⤵
  PID:11904
- C:\Windows\System\fclzvyR.exe
  C:\Windows\System\fclzvyR.exe
  2⤵
  PID:11932
- C:\Windows\System\SObIzgz.exe
  C:\Windows\System\SObIzgz.exe
  2⤵
  PID:11956
- C:\Windows\System\LDyfOCQ.exe
  C:\Windows\System\LDyfOCQ.exe
  2⤵
  PID:11976
- C:\Windows\System\xGfgDEP.exe
  C:\Windows\System\xGfgDEP.exe
  2⤵
  PID:11996
- C:\Windows\System\FUTPgzs.exe
  C:\Windows\System\FUTPgzs.exe
  2⤵
  PID:12016
- C:\Windows\System\QRFuPOg.exe
  C:\Windows\System\QRFuPOg.exe
  2⤵
  PID:12040
- C:\Windows\System\eTFpsaf.exe
  C:\Windows\System\eTFpsaf.exe
  2⤵
  PID:12076
- C:\Windows\System\aqdjwgQ.exe
  C:\Windows\System\aqdjwgQ.exe
  2⤵
  PID:12104
- C:\Windows\System\LfbLptC.exe
  C:\Windows\System\LfbLptC.exe
  2⤵
  PID:12132
- C:\Windows\System\xTIrGQL.exe
  C:\Windows\System\xTIrGQL.exe
  2⤵
  PID:12156
- C:\Windows\System\jVsMQeN.exe
  C:\Windows\System\jVsMQeN.exe
  2⤵
  PID:12188
- C:\Windows\System\FWmhWfr.exe
  C:\Windows\System\FWmhWfr.exe
  2⤵
  PID:12212
- C:\Windows\System\cTELDdr.exe
  C:\Windows\System\cTELDdr.exe
  2⤵
  PID:12240
- C:\Windows\System\CUdhrDc.exe
  C:\Windows\System\CUdhrDc.exe
  2⤵
  PID:12260
- C:\Windows\System\JlqIgwb.exe
  C:\Windows\System\JlqIgwb.exe
  2⤵
  PID:12284
- C:\Windows\System\SDasiri.exe
  C:\Windows\System\SDasiri.exe
  2⤵
  PID:10492
- C:\Windows\System\DqwYNzT.exe
  C:\Windows\System\DqwYNzT.exe
  2⤵
  PID:10488
- C:\Windows\System\IBpVfRF.exe
  C:\Windows\System\IBpVfRF.exe
  2⤵
  PID:9940
- C:\Windows\System\qcoOpgz.exe
  C:\Windows\System\qcoOpgz.exe
  2⤵
  PID:10484
- C:\Windows\System\krkonPn.exe
  C:\Windows\System\krkonPn.exe
  2⤵
  PID:11088
- C:\Windows\System\ObvpdDB.exe
  C:\Windows\System\ObvpdDB.exe
  2⤵
  PID:10084
- C:\Windows\System\LvdMLdj.exe
  C:\Windows\System\LvdMLdj.exe
  2⤵
  PID:10772
- C:\Windows\System\laPZUQf.exe
  C:\Windows\System\laPZUQf.exe
  2⤵
  PID:11500
- C:\Windows\System\jjLVeqR.exe
  C:\Windows\System\jjLVeqR.exe
  2⤵
  PID:11296
- C:\Windows\System\NaWguPK.exe
  C:\Windows\System\NaWguPK.exe
  2⤵
  PID:11028
- C:\Windows\System\rvFLHxl.exe
  C:\Windows\System\rvFLHxl.exe
  2⤵
  PID:11732
- C:\Windows\System\NrPfHTh.exe
  C:\Windows\System\NrPfHTh.exe
  2⤵
  PID:10432
- C:\Windows\System\VhiEmOl.exe
  C:\Windows\System\VhiEmOl.exe
  2⤵
  PID:11832
- C:\Windows\System\pqSDRTw.exe
  C:\Windows\System\pqSDRTw.exe
  2⤵
  PID:11588
- C:\Windows\System\MshcxhC.exe
  C:\Windows\System\MshcxhC.exe
  2⤵
  PID:11636
- C:\Windows\System\lMWOXBm.exe
  C:\Windows\System\lMWOXBm.exe
  2⤵
  PID:11952
- C:\Windows\System\abuEewc.exe
  C:\Windows\System\abuEewc.exe
  2⤵
  PID:11488
- C:\Windows\System\YrmKdUG.exe
  C:\Windows\System\YrmKdUG.exe
  2⤵
  PID:12052
- C:\Windows\System\ZdbWIJc.exe
  C:\Windows\System\ZdbWIJc.exe
  2⤵
  PID:11560
- C:\Windows\System\AMrUrij.exe
  C:\Windows\System\AMrUrij.exe
  2⤵
  PID:11616
- C:\Windows\System\ohOQBtO.exe
  C:\Windows\System\ohOQBtO.exe
  2⤵
  PID:11692
- C:\Windows\System\FFuLATp.exe
  C:\Windows\System\FFuLATp.exe
  2⤵
  PID:7256
- C:\Windows\System\chNBJrx.exe
  C:\Windows\System\chNBJrx.exe
  2⤵
  PID:11812
- C:\Windows\System\ZwCaGie.exe
  C:\Windows\System\ZwCaGie.exe
  2⤵
  PID:11884
- C:\Windows\System\UOUmExS.exe
  C:\Windows\System\UOUmExS.exe
  2⤵
  PID:11660
- C:\Windows\System\nSyMdTR.exe
  C:\Windows\System\nSyMdTR.exe
  2⤵
  PID:11000
- C:\Windows\System\oKPaKfT.exe
  C:\Windows\System\oKPaKfT.exe
  2⤵
  PID:12316
- C:\Windows\System\gNuBaqH.exe
  C:\Windows\System\gNuBaqH.exe
  2⤵
  PID:12344
- C:\Windows\System\dwkUxOg.exe
  C:\Windows\System\dwkUxOg.exe
  2⤵
  PID:12364
- C:\Windows\System\cyUpxQR.exe
  C:\Windows\System\cyUpxQR.exe
  2⤵
  PID:12388
- C:\Windows\System\OsYfaNm.exe
  C:\Windows\System\OsYfaNm.exe
  2⤵
  PID:12420
- C:\Windows\System\sJerOJI.exe
  C:\Windows\System\sJerOJI.exe
  2⤵
  PID:12448
- C:\Windows\System\cUxpLNF.exe
  C:\Windows\System\cUxpLNF.exe
  2⤵
  PID:12476
- C:\Windows\System\DVcIkka.exe
  C:\Windows\System\DVcIkka.exe
  2⤵
  PID:12504
- C:\Windows\System\FpaphVH.exe
  C:\Windows\System\FpaphVH.exe
  2⤵
  PID:12536
- C:\Windows\System\EjYTOrw.exe
  C:\Windows\System\EjYTOrw.exe
  2⤵
  PID:12556
- C:\Windows\System\zlPIAAq.exe
  C:\Windows\System\zlPIAAq.exe
  2⤵
  PID:12580
- C:\Windows\System\MRFvmcG.exe
  C:\Windows\System\MRFvmcG.exe
  2⤵
  PID:12608
- C:\Windows\System\mbMqqPs.exe
  C:\Windows\System\mbMqqPs.exe
  2⤵
  PID:12632
- C:\Windows\System\InXxwQU.exe
  C:\Windows\System\InXxwQU.exe
  2⤵
  PID:12652
- C:\Windows\System\ziVLjmH.exe
  C:\Windows\System\ziVLjmH.exe
  2⤵
  PID:12684
- C:\Windows\System\HCSKbMi.exe
  C:\Windows\System\HCSKbMi.exe
  2⤵
  PID:12712
- C:\Windows\System\uvuyair.exe
  C:\Windows\System\uvuyair.exe
  2⤵
  PID:12732
- C:\Windows\System\WVtffVw.exe
  C:\Windows\System\WVtffVw.exe
  2⤵
  PID:12756
- C:\Windows\System\xFbZcYO.exe
  C:\Windows\System\xFbZcYO.exe
  2⤵
  PID:12784
- C:\Windows\System\AUdOkVh.exe
  C:\Windows\System\AUdOkVh.exe
  2⤵
  PID:12812
- C:\Windows\System\yKHekqX.exe
  C:\Windows\System\yKHekqX.exe
  2⤵
  PID:12836
- C:\Windows\System\EohqKzy.exe
  C:\Windows\System\EohqKzy.exe
  2⤵
  PID:12860
- C:\Windows\System\YeGlqJV.exe
  C:\Windows\System\YeGlqJV.exe
  2⤵
  PID:12892
- C:\Windows\System\tEdLoQx.exe
  C:\Windows\System\tEdLoQx.exe
  2⤵
  PID:12916
- C:\Windows\System\nGAiJBS.exe
  C:\Windows\System\nGAiJBS.exe
  2⤵
  PID:12948
- C:\Windows\System\DLIEvrn.exe
  C:\Windows\System\DLIEvrn.exe
  2⤵
  PID:12968
- C:\Windows\System\AgJgtjp.exe
  C:\Windows\System\AgJgtjp.exe
  2⤵
  PID:13000
- C:\Windows\System\njLQqHe.exe
  C:\Windows\System\njLQqHe.exe
  2⤵
  PID:13016
- C:\Windows\System\lVmdwVg.exe
  C:\Windows\System\lVmdwVg.exe
  2⤵
  PID:13048
- C:\Windows\System\zDgJMhd.exe
  C:\Windows\System\zDgJMhd.exe
  2⤵
  PID:13076
- C:\Windows\System\bXqtyRL.exe
  C:\Windows\System\bXqtyRL.exe
  2⤵
  PID:13100
- C:\Windows\System\phUQEzr.exe
  C:\Windows\System\phUQEzr.exe
  2⤵
  PID:13124
- C:\Windows\System\uJBZKsr.exe
  C:\Windows\System\uJBZKsr.exe
  2⤵
  PID:13144
- C:\Windows\System\GbcPyut.exe
  C:\Windows\System\GbcPyut.exe
  2⤵
  PID:13176
- C:\Windows\System\sLRLqfC.exe
  C:\Windows\System\sLRLqfC.exe
  2⤵
  PID:13200
- C:\Windows\System\TvYWCLr.exe
  C:\Windows\System\TvYWCLr.exe
  2⤵
  PID:13228
- C:\Windows\System\tPPEJwl.exe
  C:\Windows\System\tPPEJwl.exe
  2⤵
  PID:13244
- C:\Windows\System\yQSXDEy.exe
  C:\Windows\System\yQSXDEy.exe
  2⤵
  PID:13276
- C:\Windows\System\cfHXnLV.exe
  C:\Windows\System\cfHXnLV.exe
  2⤵
  PID:13296
- C:\Windows\System\KFvMfDm.exe
  C:\Windows\System\KFvMfDm.exe
  2⤵
  PID:9608
- C:\Windows\System\staIZBA.exe
  C:\Windows\System\staIZBA.exe
  2⤵
  PID:11420
- C:\Windows\System\gqtpJJd.exe
  C:\Windows\System\gqtpJJd.exe
  2⤵
  PID:11900
- C:\Windows\System\RkLhUtC.exe
  C:\Windows\System\RkLhUtC.exe
  2⤵
  PID:10116
- C:\Windows\System\Ppbwrch.exe
  C:\Windows\System\Ppbwrch.exe
  2⤵
  PID:11808
- C:\Windows\System\fVWekJM.exe
  C:\Windows\System\fVWekJM.exe
  2⤵
  PID:11992
- C:\Windows\System\kfCknip.exe
  C:\Windows\System\kfCknip.exe
  2⤵
  PID:11924
- C:\Windows\System\eODsvTV.exe
  C:\Windows\System\eODsvTV.exe
  2⤵
  PID:12028
- C:\Windows\System\povNYAP.exe
  C:\Windows\System\povNYAP.exe
  2⤵
  PID:12416
- C:\Windows\System\dcoACyI.exe
  C:\Windows\System\dcoACyI.exe
  2⤵
  PID:11140
- C:\Windows\System\CCFjjuR.exe
  C:\Windows\System\CCFjjuR.exe
  2⤵
  PID:12552
- C:\Windows\System\HnyMzaS.exe
  C:\Windows\System\HnyMzaS.exe
  2⤵
  PID:12660
- C:\Windows\System\wGYtpXl.exe
  C:\Windows\System\wGYtpXl.exe
  2⤵
  PID:11736
- C:\Windows\System\xFXNCqn.exe
  C:\Windows\System\xFXNCqn.exe
  2⤵
  PID:13012
- C:\Windows\System\oqdNLeR.exe
  C:\Windows\System\oqdNLeR.exe
  2⤵
  PID:13044
- C:\Windows\System\zRbCvpM.exe
  C:\Windows\System\zRbCvpM.exe
  2⤵
  PID:12724
- C:\Windows\System\TiaKYrq.exe
  C:\Windows\System\TiaKYrq.exe
  2⤵
  PID:12456
- C:\Windows\System\aYtMXRm.exe
  C:\Windows\System\aYtMXRm.exe
  2⤵
  PID:12512
- C:\Windows\System\uoODzZL.exe
  C:\Windows\System\uoODzZL.exe
  2⤵
  PID:12988
- C:\Windows\System\NJjLnuX.exe
  C:\Windows\System\NJjLnuX.exe
  2⤵
  PID:11760
- C:\Windows\System\fbIgDjE.exe
  C:\Windows\System\fbIgDjE.exe
  2⤵
  PID:12292
- C:\Windows\System\BcIsseJ.exe
  C:\Windows\System\BcIsseJ.exe
  2⤵
  PID:12748
- C:\Windows\System\hrrkuBa.exe
  C:\Windows\System\hrrkuBa.exe
  2⤵
  PID:13320
- C:\Windows\System\PtuRqsw.exe
  C:\Windows\System\PtuRqsw.exe
  2⤵
  PID:13344
- C:\Windows\System\MuhLFsI.exe
  C:\Windows\System\MuhLFsI.exe
  2⤵
  PID:13368
- C:\Windows\System\agzpRzn.exe
  C:\Windows\System\agzpRzn.exe
  2⤵
  PID:13392
- C:\Windows\System\zWFEuez.exe
  C:\Windows\System\zWFEuez.exe
  2⤵
  PID:13428
- C:\Windows\System\thfrfTc.exe
  C:\Windows\System\thfrfTc.exe
  2⤵
  PID:13448
- C:\Windows\System\aDFBXkG.exe
  C:\Windows\System\aDFBXkG.exe
  2⤵
  PID:13476
- C:\Windows\System\QMDvIDa.exe
  C:\Windows\System\QMDvIDa.exe
  2⤵
  PID:13492
- C:\Windows\System\vgeTrNY.exe
  C:\Windows\System\vgeTrNY.exe
  2⤵
  PID:13524
- C:\Windows\System\mfkzKhI.exe
  C:\Windows\System\mfkzKhI.exe
  2⤵
  PID:13548
- C:\Windows\System\TYiEhoi.exe
  C:\Windows\System\TYiEhoi.exe
  2⤵
  PID:13588
- C:\Windows\System\swVyHvd.exe
  C:\Windows\System\swVyHvd.exe
  2⤵
  PID:13608
- C:\Windows\System\pBmcFeQ.exe
  C:\Windows\System\pBmcFeQ.exe
  2⤵
  PID:13628
- C:\Windows\System\nhEjhpL.exe
  C:\Windows\System\nhEjhpL.exe
  2⤵
  PID:13644
- C:\Windows\System\BBHOphp.exe
  C:\Windows\System\BBHOphp.exe
  2⤵
  PID:13668
- C:\Windows\System\aMgnRPs.exe
  C:\Windows\System\aMgnRPs.exe
  2⤵
  PID:13692
- C:\Windows\System\SWwvARW.exe
  C:\Windows\System\SWwvARW.exe
  2⤵
  PID:13716
- C:\Windows\System\oqCwPJQ.exe
  C:\Windows\System\oqCwPJQ.exe
  2⤵
  PID:13740
- C:\Windows\System\jSlxSjK.exe
  C:\Windows\System\jSlxSjK.exe
  2⤵
  PID:13756
- C:\Windows\System\FQNEzgj.exe
  C:\Windows\System\FQNEzgj.exe
  2⤵
  PID:13788
- C:\Windows\System\qCKboVH.exe
  C:\Windows\System\qCKboVH.exe
  2⤵
  PID:13816
- C:\Windows\System\tXjNTcD.exe
  C:\Windows\System\tXjNTcD.exe
  2⤵
  PID:13840
- C:\Windows\System\KZUFYXE.exe
  C:\Windows\System\KZUFYXE.exe
  2⤵
  PID:13856
- C:\Windows\System\KUVApQq.exe
  C:\Windows\System\KUVApQq.exe
  2⤵
  PID:13884
- C:\Windows\System\tqDyWZO.exe
  C:\Windows\System\tqDyWZO.exe
  2⤵
  PID:13904
- C:\Windows\System\lLyyZyh.exe
  C:\Windows\System\lLyyZyh.exe
  2⤵
  PID:13932
- C:\Windows\System\FzVUNwa.exe
  C:\Windows\System\FzVUNwa.exe
  2⤵
  PID:13948
- C:\Windows\System\PvQGNZz.exe
  C:\Windows\System\PvQGNZz.exe
  2⤵
  PID:13976
- C:\Windows\System\UlkZvhQ.exe
  C:\Windows\System\UlkZvhQ.exe
  2⤵
  PID:13996
- C:\Windows\System\dVIpcAJ.exe
  C:\Windows\System\dVIpcAJ.exe
  2⤵
  PID:14024
- C:\Windows\System\pVAAvLd.exe
  C:\Windows\System\pVAAvLd.exe
  2⤵
  PID:14052
- C:\Windows\System\KqIzdVQ.exe
  C:\Windows\System\KqIzdVQ.exe
  2⤵
  PID:14076
- C:\Windows\System\eIahZXl.exe
  C:\Windows\System\eIahZXl.exe
  2⤵
  PID:14096
- C:\Windows\System\JjdlfCz.exe
  C:\Windows\System\JjdlfCz.exe
  2⤵
  PID:14120
- C:\Windows\System\GegWUvV.exe
  C:\Windows\System\GegWUvV.exe
  2⤵
  PID:14140
- C:\Windows\System\SvyUrKM.exe
  C:\Windows\System\SvyUrKM.exe
  2⤵
  PID:14172
- C:\Windows\System\eHBOLHN.exe
  C:\Windows\System\eHBOLHN.exe
  2⤵
  PID:14196
- C:\Windows\System\tQpSfZq.exe
  C:\Windows\System\tQpSfZq.exe
  2⤵
  PID:14228
- C:\Windows\System\YSeXwBS.exe
  C:\Windows\System\YSeXwBS.exe
  2⤵
  PID:14264
- C:\Windows\System\FsbOPsb.exe
  C:\Windows\System\FsbOPsb.exe
  2⤵
  PID:14280
- C:\Windows\System\qzekiNX.exe
  C:\Windows\System\qzekiNX.exe
  2⤵
  PID:14304
- C:\Windows\System\iwltPPT.exe
  C:\Windows\System\iwltPPT.exe
  2⤵
  PID:14332
- C:\Windows\System\ovxFLce.exe
  C:\Windows\System\ovxFLce.exe
  2⤵
  PID:12300
- C:\Windows\System\qKCAjXS.exe
  C:\Windows\System\qKCAjXS.exe
  2⤵
  PID:12708
- C:\Windows\System\rdsnvKS.exe
  C:\Windows\System\rdsnvKS.exe
  2⤵
  PID:12852
- C:\Windows\System\hKlSaAC.exe
  C:\Windows\System\hKlSaAC.exe
  2⤵
  PID:12884
- C:\Windows\System\oJtrYoo.exe
  C:\Windows\System\oJtrYoo.exe
  2⤵
  PID:9568
- C:\Windows\System\PhBTsKt.exe
  C:\Windows\System\PhBTsKt.exe
  2⤵
  PID:12624
- C:\Windows\System\egUprSx.exe
  C:\Windows\System\egUprSx.exe
  2⤵
  PID:12380
- C:\Windows\System\mIuiHAQ.exe
  C:\Windows\System\mIuiHAQ.exe
  2⤵
  PID:12960
- C:\Windows\System\gVvbnmK.exe
  C:\Windows\System\gVvbnmK.exe
  2⤵
  PID:12332
- C:\Windows\System\GZsbpOZ.exe
  C:\Windows\System\GZsbpOZ.exe
  2⤵
  PID:13164
- C:\Windows\System\rCdTuGL.exe
  C:\Windows\System\rCdTuGL.exe
  2⤵
  PID:13388
- C:\Windows\System\wRCUgzw.exe
  C:\Windows\System\wRCUgzw.exe
  2⤵
  PID:13472
- C:\Windows\System\NUDKIXC.exe
  C:\Windows\System\NUDKIXC.exe
  2⤵
  PID:13268
- C:\Windows\System\PPacyOx.exe
  C:\Windows\System\PPacyOx.exe
  2⤵
  PID:11652
- C:\Windows\System\OwMppNR.exe
  C:\Windows\System\OwMppNR.exe
  2⤵
  PID:11928
- C:\Windows\System\IxKjLOU.exe
  C:\Windows\System\IxKjLOU.exe
  2⤵
  PID:13684
- C:\Windows\System\ceNwDto.exe
  C:\Windows\System\ceNwDto.exe
  2⤵
  PID:12620
- C:\Windows\System\JfzuWoZ.exe
  C:\Windows\System\JfzuWoZ.exe
  2⤵
  PID:13800
- C:\Windows\System\pcGBetW.exe
  C:\Windows\System\pcGBetW.exe
  2⤵
  PID:11100
- C:\Windows\System\esTXyKx.exe
  C:\Windows\System\esTXyKx.exe
  2⤵
  PID:12596
- C:\Windows\System\BMMbeLh.exe
  C:\Windows\System\BMMbeLh.exe
  2⤵
  PID:13732
- C:\Windows\System\KIFqmaV.exe
  C:\Windows\System\KIFqmaV.exe
  2⤵
  PID:14384
- C:\Windows\System\knfzreV.exe
  C:\Windows\System\knfzreV.exe
  2⤵
  PID:14408
- C:\Windows\System\XiKnuzU.exe
  C:\Windows\System\XiKnuzU.exe
  2⤵
  PID:14428
- C:\Windows\System\UKbLlPW.exe
  C:\Windows\System\UKbLlPW.exe
  2⤵
  PID:14472
- C:\Windows\System\HeYEUWR.exe
  C:\Windows\System\HeYEUWR.exe
  2⤵
  PID:14500
- C:\Windows\System\flZegDD.exe
  C:\Windows\System\flZegDD.exe
  2⤵
  PID:14524
- C:\Windows\System\rWCzyKN.exe
  C:\Windows\System\rWCzyKN.exe
  2⤵
  PID:14556
- C:\Windows\System\hLAwpob.exe
  C:\Windows\System\hLAwpob.exe
  2⤵
  PID:14580
- C:\Windows\System\iWHvNGB.exe
  C:\Windows\System\iWHvNGB.exe
  2⤵
  PID:14600
- C:\Windows\System\IfmVAsi.exe
  C:\Windows\System\IfmVAsi.exe
  2⤵
  PID:14616
- C:\Windows\System\Qrpxwlb.exe
  C:\Windows\System\Qrpxwlb.exe
  2⤵
  PID:14640
- C:\Windows\System\qWAOnzb.exe
  C:\Windows\System\qWAOnzb.exe
  2⤵
  PID:14672
- C:\Windows\System\WDbpFAx.exe
  C:\Windows\System\WDbpFAx.exe
  2⤵
  PID:14696
- C:\Windows\System\CuGUzNI.exe
  C:\Windows\System\CuGUzNI.exe
  2⤵
  PID:14720
- C:\Windows\System\WssbrzC.exe
  C:\Windows\System\WssbrzC.exe
  2⤵
  PID:14736
- C:\Windows\System\nJMAQyQ.exe
  C:\Windows\System\nJMAQyQ.exe
  2⤵
  PID:14752
- C:\Windows\System\aTNYiIR.exe
  C:\Windows\System\aTNYiIR.exe
  2⤵
  PID:14772
- C:\Windows\System\gZsSIlw.exe
  C:\Windows\System\gZsSIlw.exe
  2⤵
  PID:14800
- C:\Windows\System\KBFIetF.exe
  C:\Windows\System\KBFIetF.exe
  2⤵
  PID:14828
- C:\Windows\System\GGvGxME.exe
  C:\Windows\System\GGvGxME.exe
  2⤵
  PID:14848
- C:\Windows\System\EhkfcoB.exe
  C:\Windows\System\EhkfcoB.exe
  2⤵
  PID:14876
- C:\Windows\System\kadaQkC.exe
  C:\Windows\System\kadaQkC.exe
  2⤵
  PID:14900
- C:\Windows\System\bZLeSra.exe
  C:\Windows\System\bZLeSra.exe
  2⤵
  PID:14916
- C:\Windows\System\FUgYtBT.exe
  C:\Windows\System\FUgYtBT.exe
  2⤵
  PID:14944
- C:\Windows\System\WbNhJTe.exe
  C:\Windows\System\WbNhJTe.exe
  2⤵
  PID:14968
- C:\Windows\System\gQCCRpD.exe
  C:\Windows\System\gQCCRpD.exe
  2⤵
  PID:14984
- C:\Windows\System\nivfmvh.exe
  C:\Windows\System\nivfmvh.exe
  2⤵
  PID:15012
- C:\Windows\System\QjHzHGN.exe
  C:\Windows\System\QjHzHGN.exe
  2⤵
  PID:15040
- C:\Windows\System\qEYHQaB.exe
  C:\Windows\System\qEYHQaB.exe
  2⤵
  PID:15072
- C:\Windows\System\dlRVxye.exe
  C:\Windows\System\dlRVxye.exe
  2⤵
  PID:15092
- C:\Windows\System\QWKwfXu.exe
  C:\Windows\System\QWKwfXu.exe
  2⤵
  PID:15116
- C:\Windows\System\rwTcLXi.exe
  C:\Windows\System\rwTcLXi.exe
  2⤵
  PID:15136
- C:\Windows\System\XqzQIdH.exe
  C:\Windows\System\XqzQIdH.exe
  2⤵
  PID:15172
- C:\Windows\System\ZmMuCwe.exe
  C:\Windows\System\ZmMuCwe.exe
  2⤵
  PID:15196
- C:\Windows\System\ndpZLHh.exe
  C:\Windows\System\ndpZLHh.exe
  2⤵
  PID:15220
- C:\Windows\System\tEIMoUp.exe
  C:\Windows\System\tEIMoUp.exe
  2⤵
  PID:15240
- C:\Windows\System\cBKNYlP.exe
  C:\Windows\System\cBKNYlP.exe
  2⤵
  PID:15268
- C:\Windows\System\PVAcPPE.exe
  C:\Windows\System\PVAcPPE.exe
  2⤵
  PID:15292
- C:\Windows\System\lBjTVpN.exe
  C:\Windows\System\lBjTVpN.exe
  2⤵
  PID:15324
- C:\Windows\System\xHCnVHx.exe
  C:\Windows\System\xHCnVHx.exe
  2⤵
  PID:15348
- C:\Windows\System\ejEPvdg.exe
  C:\Windows\System\ejEPvdg.exe
  2⤵
  PID:12648
- C:\Windows\System\FbpyKpu.exe
  C:\Windows\System\FbpyKpu.exe
  2⤵
  PID:13896
- C:\Windows\System\FgFfCbK.exe
  C:\Windows\System\FgFfCbK.exe
  2⤵
  PID:13460
- C:\Windows\System\YmbTuwF.exe
  C:\Windows\System\YmbTuwF.exe
  2⤵
  PID:13944
- C:\Windows\System\cbedufo.exe
  C:\Windows\System\cbedufo.exe
  2⤵
  PID:13256
- C:\Windows\System\qLldckM.exe
  C:\Windows\System\qLldckM.exe
  2⤵
  PID:14092
- C:\Windows\System\LbPlgyQ.exe
  C:\Windows\System\LbPlgyQ.exe
  2⤵
  PID:14148
- C:\Windows\System\incFQVe.exe
  C:\Windows\System\incFQVe.exe
  2⤵
  PID:13328
- C:\Windows\System\kbpbDux.exe
  C:\Windows\System\kbpbDux.exe
  2⤵
  PID:12360
- C:\Windows\System\vxKXjdT.exe
  C:\Windows\System\vxKXjdT.exe
  2⤵
  PID:13040
- C:\Windows\System\mItIRmm.exe
  C:\Windows\System\mItIRmm.exe
  2⤵
  PID:13656
- C:\Windows\System\mXUWLCP.exe
  C:\Windows\System\mXUWLCP.exe
  2⤵
  PID:13728
- C:\Windows\System\WOfShTv.exe
  C:\Windows\System\WOfShTv.exe
  2⤵
  PID:14324
- C:\Windows\System\gVXefpq.exe
  C:\Windows\System\gVXefpq.exe
  2⤵
  PID:12828
- C:\Windows\System\rTOeFbj.exe
  C:\Windows\System\rTOeFbj.exe
  2⤵
  PID:14464
- C:\Windows\System\KUwudTr.exe
  C:\Windows\System\KUwudTr.exe
  2⤵
  PID:13240
- C:\Windows\System\qEujNXu.exe
  C:\Windows\System\qEujNXu.exe
  2⤵
  PID:12876
- C:\Windows\System\ijmWTqn.exe
  C:\Windows\System\ijmWTqn.exe
  2⤵
  PID:14612
- C:\Windows\System\uTavhjf.exe
  C:\Windows\System\uTavhjf.exe
  2⤵
  PID:14704
- C:\Windows\System\olEsTIY.exe
  C:\Windows\System\olEsTIY.exe
  2⤵
  PID:13364
- C:\Windows\System\DiRNCQq.exe
  C:\Windows\System\DiRNCQq.exe
  2⤵
  PID:14108
- C:\Windows\System\wlkLvgS.exe
  C:\Windows\System\wlkLvgS.exe
  2⤵
  PID:14844
- C:\Windows\System\dQnsGZu.exe
  C:\Windows\System\dQnsGZu.exe
  2⤵
  PID:14892
- C:\Windows\System\MaBernz.exe
  C:\Windows\System\MaBernz.exe
  2⤵
  PID:14956
- C:\Windows\System\kjHiKBI.exe
  C:\Windows\System\kjHiKBI.exe
  2⤵
  PID:14368
- C:\Windows\System\dGHPxhV.exe
  C:\Windows\System\dGHPxhV.exe
  2⤵
  PID:15084
- C:\Windows\System\AFTsJut.exe
  C:\Windows\System\AFTsJut.exe
  2⤵
  PID:15184
- C:\Windows\System\fdBJqMh.exe
  C:\Windows\System\fdBJqMh.exe
  2⤵
  PID:15264
- C:\Windows\System\bJPxErt.exe
  C:\Windows\System\bJPxErt.exe
  2⤵
  PID:15312
- C:\Windows\System\gOnIZIW.exe
  C:\Windows\System\gOnIZIW.exe
  2⤵
  PID:14668
- C:\Windows\System\xkxPqzM.exe
  C:\Windows\System\xkxPqzM.exe
  2⤵
  PID:15364
- C:\Windows\System\wBFxAYU.exe
  C:\Windows\System\wBFxAYU.exe
  2⤵
  PID:15396
- C:\Windows\System\taxhQYY.exe
  C:\Windows\System\taxhQYY.exe
  2⤵
  PID:15820
- C:\Windows\System\MvFHXYa.exe
  C:\Windows\System\MvFHXYa.exe
  2⤵
  PID:15864
- C:\Windows\System\YSEisBl.exe
  C:\Windows\System\YSEisBl.exe
  2⤵
  PID:15900
- C:\Windows\System\kdCsNga.exe
  C:\Windows\System\kdCsNga.exe
  2⤵
  PID:15928
- C:\Windows\System\TygFBPr.exe
  C:\Windows\System\TygFBPr.exe
  2⤵
  PID:15948
- C:\Windows\System\LczfnlD.exe
  C:\Windows\System\LczfnlD.exe
  2⤵
  PID:15964
- C:\Windows\System\osckKQy.exe
  C:\Windows\System\osckKQy.exe
  2⤵
  PID:15992
- C:\Windows\System\xuyiozu.exe
  C:\Windows\System\xuyiozu.exe
  2⤵
  PID:16016
- C:\Windows\System\TMEXKZt.exe
  C:\Windows\System\TMEXKZt.exe
  2⤵
  PID:16056
- C:\Windows\System\wcMvEnB.exe
  C:\Windows\System\wcMvEnB.exe
  2⤵
  PID:16076
- C:\Windows\System\dJuTcgR.exe
  C:\Windows\System\dJuTcgR.exe
  2⤵
  PID:16100
- C:\Windows\System\zmhYdTr.exe
  C:\Windows\System\zmhYdTr.exe
  2⤵
  PID:16132
- C:\Windows\System\BmboyTs.exe
  C:\Windows\System\BmboyTs.exe
  2⤵
  PID:16168
- C:\Windows\System\iHJtPYg.exe
  C:\Windows\System\iHJtPYg.exe
  2⤵
  PID:16244
- C:\Windows\System\UHGIivb.exe
  C:\Windows\System\UHGIivb.exe
  2⤵
  PID:16272
- C:\Windows\System\QJWJuku.exe
  C:\Windows\System\QJWJuku.exe
  2⤵
  PID:16304
- C:\Windows\System\fxytfdo.exe
  C:\Windows\System\fxytfdo.exe
  2⤵
  PID:16324
- C:\Windows\System\VHIYaTS.exe
  C:\Windows\System\VHIYaTS.exe
  2⤵
  PID:16368
- C:\Windows\System\unueOEM.exe
  C:\Windows\System\unueOEM.exe
  2⤵
  PID:13384
- C:\Windows\System\lSunpOd.exe
  C:\Windows\System\lSunpOd.exe
  2⤵
  PID:14748
- C:\Windows\System\Tdrhhmx.exe
  C:\Windows\System\Tdrhhmx.exe
  2⤵
  PID:14816
- C:\Windows\System\DjgshES.exe
  C:\Windows\System\DjgshES.exe
  2⤵
  PID:13420
- C:\Windows\System\XUTfvAh.exe
  C:\Windows\System\XUTfvAh.exe
  2⤵
  PID:15080
- C:\Windows\System\zSzymLf.exe
  C:\Windows\System\zSzymLf.exe
  2⤵
  PID:15216
- C:\Windows\System\uvpEVEm.exe
  C:\Windows\System\uvpEVEm.exe
  2⤵
  PID:14628
- C:\Windows\System\BXGhsOV.exe
  C:\Windows\System\BXGhsOV.exe
  2⤵
  PID:15320
- C:\Windows\System\yKHvtZg.exe
  C:\Windows\System\yKHvtZg.exe
  2⤵
  PID:14012
- C:\Windows\System\jqYpWgb.exe
  C:\Windows\System\jqYpWgb.exe
  2⤵
  PID:14792
- C:\Windows\System\YUJODDP.exe
  C:\Windows\System\YUJODDP.exe
  2⤵
  PID:14160
- C:\Windows\System\kZJtxUb.exe
  C:\Windows\System\kZJtxUb.exe
  2⤵
  PID:14456
- C:\Windows\System\fumkfPZ.exe
  C:\Windows\System\fumkfPZ.exe
  2⤵
  PID:11464
- C:\Windows\System\KBEbQSg.exe
  C:\Windows\System\KBEbQSg.exe
  2⤵
  PID:13664
- C:\Windows\System\rAHeZph.exe
  C:\Windows\System\rAHeZph.exe
  2⤵
  PID:15228
- C:\Windows\System\CWcZWDW.exe
  C:\Windows\System\CWcZWDW.exe
  2⤵
  PID:12868
- C:\Windows\System\plOHsLo.exe
  C:\Windows\System\plOHsLo.exe
  2⤵
  PID:15376
- C:\Windows\System\LMFSPuc.exe
  C:\Windows\System\LMFSPuc.exe
  2⤵
  PID:15404
- C:\Windows\System\vYhwJBR.exe
  C:\Windows\System\vYhwJBR.exe
  2⤵
  PID:13636
- C:\Windows\System\iGLijZx.exe
  C:\Windows\System\iGLijZx.exe
  2⤵
  PID:14376
- C:\Windows\System\kNVRvNz.exe
  C:\Windows\System\kNVRvNz.exe
  2⤵
  PID:14032
- C:\Windows\System\AMhCCbs.exe
  C:\Windows\System\AMhCCbs.exe
  2⤵
  PID:14188
- C:\Windows\System\RnrSMvZ.exe
  C:\Windows\System\RnrSMvZ.exe
  2⤵
  PID:13208
- C:\Windows\System\ruASEuu.exe
  C:\Windows\System\ruASEuu.exe
  2⤵
  PID:15840
- C:\Windows\System\fdvMGrt.exe
  C:\Windows\System\fdvMGrt.exe
  2⤵
  PID:15892
- C:\Windows\System\ThvqsAZ.exe
  C:\Windows\System\ThvqsAZ.exe
  2⤵
  PID:15988
- C:\Windows\System\RUJnBTj.exe
  C:\Windows\System\RUJnBTj.exe
  2⤵
  PID:15488
- C:\Windows\System\HyWjvJo.exe
  C:\Windows\System\HyWjvJo.exe
  2⤵
  PID:16096
- C:\Windows\System\dFdZEMV.exe
  C:\Windows\System\dFdZEMV.exe
  2⤵
  PID:15744
- C:\Windows\System\oqPZczv.exe
  C:\Windows\System\oqPZczv.exe
  2⤵
  PID:15544
- C:\Windows\System\NCRsWbG.exe
  C:\Windows\System\NCRsWbG.exe
  2⤵
  PID:16300
- C:\Windows\System\VJXsKRX.exe
  C:\Windows\System\VJXsKRX.exe
  2⤵
  PID:16380
- C:\Windows\System\ZXEOOQi.exe
  C:\Windows\System\ZXEOOQi.exe
  2⤵
  PID:14488
- C:\Windows\System\WpuAINt.exe
  C:\Windows\System\WpuAINt.exe
  2⤵
  PID:16040
- C:\Windows\System\PtiajLJ.exe
  C:\Windows\System\PtiajLJ.exe
  2⤵
  PID:16108
- C:\Windows\System\gkYDbkw.exe
  C:\Windows\System\gkYDbkw.exe
  2⤵
  PID:13972
- C:\Windows\System\aXfqeRr.exe
  C:\Windows\System\aXfqeRr.exe
  2⤵
  PID:15704
- C:\Windows\System\MztozPs.exe
  C:\Windows\System\MztozPs.exe
  2⤵
  PID:15760
- C:\Windows\System\jrAmNdn.exe
  C:\Windows\System\jrAmNdn.exe
  2⤵
  PID:15808
- C:\Windows\System\xRGEDeS.exe
  C:\Windows\System\xRGEDeS.exe
  2⤵
  PID:14592
- C:\Windows\System\JDVcTGJ.exe
  C:\Windows\System\JDVcTGJ.exe
  2⤵
  PID:16376
- C:\Windows\System\sNyIzWZ.exe
  C:\Windows\System\sNyIzWZ.exe
  2⤵
  PID:11172
- C:\Windows\System\FjPvAqW.exe
  C:\Windows\System\FjPvAqW.exe
  2⤵
  PID:13504
- C:\Windows\System\OGnFExR.exe
  C:\Windows\System\OGnFExR.exe
  2⤵
  PID:16400
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16400 -s 248
    3⤵
    PID:16312
- C:\Windows\System\wpLxrmR.exe
  C:\Windows\System\wpLxrmR.exe
  2⤵
  PID:16428
- C:\Windows\System\okzjnFQ.exe
  C:\Windows\System\okzjnFQ.exe
  2⤵
  PID:16452
- C:\Windows\System\okJPmzK.exe
  C:\Windows\System\okJPmzK.exe
  2⤵
  PID:16472
- C:\Windows\System\nSzLBDz.exe
  C:\Windows\System\nSzLBDz.exe
  2⤵
  PID:16492
- C:\Windows\System\sbIuaZL.exe
  C:\Windows\System\sbIuaZL.exe
  2⤵
  PID:16516
- C:\Windows\System\UYbggLr.exe
  C:\Windows\System\UYbggLr.exe
  2⤵
  PID:16536
- C:\Windows\System\yNJCUEC.exe
  C:\Windows\System\yNJCUEC.exe
  2⤵
  PID:16556
- C:\Windows\System\yBCFxxh.exe
  C:\Windows\System\yBCFxxh.exe
  2⤵
  PID:16580
- C:\Windows\System\crHfFfV.exe
  C:\Windows\System\crHfFfV.exe
  2⤵
  PID:16612
- C:\Windows\System\oNRzwMI.exe
  C:\Windows\System\oNRzwMI.exe
  2⤵
  PID:16636
- C:\Windows\System\dghqlCB.exe
  C:\Windows\System\dghqlCB.exe
  2⤵
  PID:16664
- C:\Windows\System\HPzIGaH.exe
  C:\Windows\System\HPzIGaH.exe
  2⤵
  PID:16688
- C:\Windows\System\ckINkXZ.exe
  C:\Windows\System\ckINkXZ.exe
  2⤵
  PID:16708
- C:\Windows\System\nGWTaZM.exe
  C:\Windows\System\nGWTaZM.exe
  2⤵
  PID:16744
- C:\Windows\System\NzmpNzs.exe
  C:\Windows\System\NzmpNzs.exe
  2⤵
  PID:16772
- C:\Windows\System\AbnigUS.exe
  C:\Windows\System\AbnigUS.exe
  2⤵
  PID:16788
- C:\Windows\System\LixriCV.exe
  C:\Windows\System\LixriCV.exe
  2⤵
  PID:16804
- C:\Windows\System\csmKFWw.exe
  C:\Windows\System\csmKFWw.exe
  2⤵
  PID:16836
- C:\Windows\System\xdhJLcP.exe
  C:\Windows\System\xdhJLcP.exe
  2⤵
  PID:16860
- C:\Windows\System\ddBvXsb.exe
  C:\Windows\System\ddBvXsb.exe
  2⤵
  PID:16888
- C:\Windows\System\RSjJABv.exe
  C:\Windows\System\RSjJABv.exe
  2⤵
  PID:16912
- C:\Windows\System\tSkvcZb.exe
  C:\Windows\System\tSkvcZb.exe
  2⤵
  PID:16928
- C:\Windows\System\beWACrn.exe
  C:\Windows\System\beWACrn.exe
  2⤵
  PID:16948
- C:\Windows\System\tfVGhJH.exe
  C:\Windows\System\tfVGhJH.exe
  2⤵
  PID:16988
- C:\Windows\System\UWRgvnR.exe
  C:\Windows\System\UWRgvnR.exe
  2⤵
  PID:17016
- C:\Windows\System\zqJwnLs.exe
  C:\Windows\System\zqJwnLs.exe
  2⤵
  PID:17032
- C:\Windows\System\TBxJIjk.exe
  C:\Windows\System\TBxJIjk.exe
  2⤵
  PID:14272
- C:\Windows\System\xXTKqBm.exe
  C:\Windows\System\xXTKqBm.exe
  2⤵
  PID:16288
- C:\Windows\System\uOTdSZy.exe
  C:\Windows\System\uOTdSZy.exe
  2⤵
  PID:13444
- C:\Windows\System\zzXWSun.exe
  C:\Windows\System\zzXWSun.exe
  2⤵
  PID:14300
- C:\Windows\System\LrvQnMl.exe
  C:\Windows\System\LrvQnMl.exe
  2⤵
  PID:16764
- C:\Windows\System\tvxQeRS.exe
  C:\Windows\System\tvxQeRS.exe
  2⤵
  PID:17056
- C:\Windows\System\usSkKKr.exe
  C:\Windows\System\usSkKKr.exe
  2⤵
  PID:14316
- C:\Windows\System\OmfQpch.exe
  C:\Windows\System\OmfQpch.exe
  2⤵
  PID:2504
- C:\Windows\System\WwwiKXK.exe
  C:\Windows\System\WwwiKXK.exe
  2⤵
  PID:16984
- C:\Windows\System\RcBiDgb.exe
  C:\Windows\System\RcBiDgb.exe
  2⤵
  PID:16728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AfafeYC.exe

Filesize
1.4MB

MD5
cb3ad8ab423495cc3e19c86383315fd5

SHA1
49d5dfbdd33f0146d5bb7fcad9db0cba8b9eacf5

SHA256
778762e016cbf8a9fed58c3af1761465e7268fe3da2f14e9a30788d1c68e3d81

SHA512
aed6097e11fb8e28fe85be3769ad7dd82d756725b379552b5f4c6fd234eba5b357ddf4e2764db823c0342be942829b0c8f1dd7d851be61de291963683a1801c4

Download Submit
C:\Windows\System\FqyspWj.exe

Filesize
1.4MB

MD5
8bc06dddf362963709cb19572d4108c9

SHA1
887ed955dc6433678a7acc18a5ed87102ae0f3f5

SHA256
08bd8bbd599a7d406b504434c350ba5e5d3e9e13163dde1fa70477c28dc44249

SHA512
7f780a69f6222aeabe8b02b3cb3b7c715b4d06676bff04e6addfed32857be88c5884baa4caaed2586d5bb2879391f9d2b2e4044485083f458d53ad8557c1c3a0

Download Submit
C:\Windows\System\HNZJwdL.exe

Filesize
1.4MB

MD5
5166e604ddfd63b8b7b70306b451625d

SHA1
6ce91e10fd3b5c52d7a31cef486e36370a6daa61

SHA256
49729442b76d9a04c567a9d94620a156ec247b169b049042ee91624ac0b34890

SHA512
32ad574d63124de47f5104707fa8bb25faac67f38e0ab3eeae7f8c06c1dfd11a8202d2a4f570836fdd597d629e65859f7f373b532314a6494527c6680f752e51

Download Submit
C:\Windows\System\IFrSvmx.exe

Filesize
1.4MB

MD5
91877669e97cd17fdb7e6290674dcdc9

SHA1
2a83d32d589627a991a71a48dec9bc535c1c1a4e

SHA256
2f12cd127f98d20b39d57609303fbd8bc016e14edd46859984d7b0f6c8e637fb

SHA512
2d121b75478a4592ae0c705399eda1b5374e1d1fb08028fc893286b37c8b3e3a9e9bb2f3a9a3a62cc61fcc89b2199a8420337f5e1b60f00754c8874d17768f69

Download Submit
C:\Windows\System\JxQnvtd.exe

Filesize
1.4MB

MD5
9f39a46aa797f7c9eb8e07d606110c99

SHA1
b47369c2ab73adf7e436202db9dd08f26b97036a

SHA256
6baf887cf159d4d730b96036e47af7c1848b5e67e795a9438ca7e29f1cbe9224

SHA512
243c477053cdd0bf58df413cbbfa37c12286075df5afacab30aa1f08443aaa0cf6f78c437d76cb89c9729afa206c7dd7824447e335d2f3dd1234cdf083932e6e

Download Submit
C:\Windows\System\LVMSqdK.exe

Filesize
1.4MB

MD5
29e630e1905cdeac3bbf61e5b88377e9

SHA1
f9ded572e4c87bfcba6b052b2fe409fa52fcbc26

SHA256
e4a8ea9bd0c635a5ce2c4bc141ba6ff4253f40ba6a4ecdcb810d771b709487fe

SHA512
ba9e6bd583b4a971a3418b0d91fd1cf65cf2d709c02261c6fbab486a8bee4f0c454537fd36f91be5de31e7c60040c0a126ef4f73712a4bae381e3a26f4377c47

Download Submit
C:\Windows\System\MfwcAfc.exe

Filesize
1.4MB

MD5
f90390ec8339e677ae3690e19ec1e28b

SHA1
db96651c8830b4984cb1983c893f6a686334620a

SHA256
0c9b75e5674e9dd5cdf7d0495ba804384eb0d06cb3e48a0ec5dd0db9cacadfc4

SHA512
72a17e484587eb327876ef6b0b82e0c178a20ffbb9056a4e539c801122c26b34ca197dd601466f14ff3c86eff59ea06d2f478d4cd0b97aba1802e6c397f316b7

Download Submit
C:\Windows\System\NdmbyLL.exe

Filesize
1.4MB

MD5
23cfa6bae330a08203807e4b1f395268

SHA1
1d16658140df958d5e47bbfff683bd74c3022f61

SHA256
e6a29b3a2b35ee2418d9bfaa0761d5f205e6dd02587dbd05b0d4b2bd43d46231

SHA512
ee46e6957c7d1a4ec6a9553e37443f781d5dbb6a0fa41743a3190bb4a240e51cd917b581768fc22b2822195c11ecab92c6458e1279b2d8201c6d2e47b308d667

Download Submit
C:\Windows\System\OpyitTd.exe

Filesize
1.4MB

MD5
43684b19b60d49c2cd6d9072e61adf85

SHA1
1e7a3dfbd4df8969daf8fc1199816576635f2705

SHA256
4fc70adc30a1bfbcef385ebf48ad81009db81c820b6cfa8e0fcba0e9fdf2f4d6

SHA512
fcc82da7b3618a79e55f17bb4134a6ad1de0797f13eac2eaa81de59a278bfd9f3cdc8b468104a1bb88fd1b6b95089fd503c0752a07794b22420c180e4bbf9fe8

Download Submit
C:\Windows\System\QGXvAzC.exe

Filesize
1.4MB

MD5
64531806c4f38ca55721248f6483f354

SHA1
1887d0fbc12cdafd5b5edefebe6e654182aec1a9

SHA256
35d76f5153fe0392d176847574e138fc79dd0c5e335b03fa7203c672b9c53167

SHA512
4e425e5be48083223bbb6c7f1baa4411fffdf2e32a3337e2acce7d1ddfa56c324c003ec31c358361938fc9d58f4ff712f7e8a278724d3088aaece1c367e32362

Download Submit
C:\Windows\System\RAGgana.exe

Filesize
1.4MB

MD5
7edd6138fff130be84a3fb9d0c08e2e5

SHA1
1c4a208c8e2a26e6c2c26d118c04c6a9f0cddf79

SHA256
101d5777a1bf61b21b86d92b5461723d992fc0e686c7fe476dee67a31bb43ca3

SHA512
842cb331bb32073747a74b852cfa71a8e3c83887b5cb2b3bee8e9b79508cc2bb88bbe73e834ffbe61207ffb91f6c6de4f9164a42283adf2701b69ceae0d93b2e

Download Submit
C:\Windows\System\StpOeYk.exe

Filesize
1.4MB

MD5
5bb6339d726e14b996b6833995073037

SHA1
f4483f254f28441e7d0a1ea1df4ca9ff15c8a0dc

SHA256
b7750909963f74c67917b58921e2d8c21525e6a5a1ce4d23542e5d727b188752

SHA512
c1c99bea5df6ab4d27f246f581e975c02d26f372a77884b93edd946ab253cdf515cfe89652af36cc25d74883f350a21e71919c0a67706933a5af4ed5377c278f

Download Submit
C:\Windows\System\WkztSML.exe

Filesize
1.4MB

MD5
5ea87cfb5910185d101dbc1a0476f96d

SHA1
e229ae51c4ab99ed3db8cc5cbcadb38d60d1ed18

SHA256
953a566404c60bba586a4ae9a8f81869a88963b67637aaf8ae04aace1cdf6158

SHA512
b853c4cd17313810d849f08566e7da32d27e633e40e87989d72f81d1c4e517bca19f094c6e0dc7d1abe94834bb20d98742775e9c4b97430c899c26bd3571dffd

Download Submit
C:\Windows\System\XOQZzGc.exe

Filesize
1.4MB

MD5
269f4a2819dbf012cb5e533aa0dbb345

SHA1
23cc69e19295828e84976e0ae24cc7feae45fc32

SHA256
f68e3dd664ca949d3d8553452ff25ab9fb2617bfa5b5e10187c460b2dbde56cb

SHA512
e4d3ef8a9e731df298ccbdeda798d2597e0b32a042187f0daf30655a37288d207da4f20074ba738b469e9505dadbb6daf6a4d0720dad76a7addb967cc2c0e23f

Download Submit
C:\Windows\System\YhqXtid.exe

Filesize
1.4MB

MD5
baeb890c3e75efd998455cdee108783f

SHA1
20f7aaea121b408671f299fc4e8557a35b5145bd

SHA256
15f1937543eb62739b3ddd907a1c51651f6461afa05e7bcf497696cdccab14da

SHA512
0508db63f634d1967c2f26456cf6d43ce1bf9b91bc9285785ff84d714ff87fb9b8811b45e2af60d19b849e5742a4e4c594d0916ebe07939a17e106621c215f12

Download Submit
C:\Windows\System\ZZERcLO.exe

Filesize
1.4MB

MD5
95322b6d1b0fc4d22df5ce03a7f9c02d

SHA1
adf98d74b4a2456cf642f144dd37dbbd8bc31cce

SHA256
2aa969c155cd7080f74f961a4d0d633f7096b3a3d50f0b8189519f515afc07ae

SHA512
dcea347886598adb751b12c013f2a1608033ce367f723f77f9ca9850b4ed9a2ae9b4b33b7d6f377fc95245dff970b58e2eebd316ba1352a4d459a9d5d74973c9

Download Submit
C:\Windows\System\aRtvWMd.exe

Filesize
1.4MB

MD5
6de3e10c5d68628b913f356a64b8c9aa

SHA1
60901d2ac6025f05fe419a81567bf5404d9347b1

SHA256
a40cf492a30343f3d84ce99e3b3c9a7fb9471cf602410469269cb9ebe22ff7da

SHA512
a662cf43718b350c5f79463fc6aff5094fab5bb11f34e90441e246f3d22f6beb748f1e3e2013a3a850b728ab0f7ece14db981222206255a58df0ce13f46aa5ac

Download Submit
C:\Windows\System\cQZrlWq.exe

Filesize
1.4MB

MD5
e6c5bb6776dacb1728ea5211f8d1457c

SHA1
80a9b169cc564010ac1f4046fa3e1076bdc39f96

SHA256
493dc39f6634e11f9b4adcef8f2af9fc0bdae8c368eca178ecae8e4e140c038c

SHA512
8b52f98472754f38009fbd9a16b07c578f27f7abd351737507411917f48c9a16d10233f1ec68cfcda4057ccb87224ff27941f9eb797b9e90b3e7d8680109feb1

Download Submit
C:\Windows\System\dMmlCEk.exe

Filesize
1.4MB

MD5
3c515f0381465bedc4f3589d003668b0

SHA1
a09d8b75efb5e803e450de48065b39db8e70cf11

SHA256
26585c194137608e5e3b9087f567a522b25db7cd644077e643bd0453ba45e73d

SHA512
1761c12d928bc53c991a464a83c0ea297dd0354ee40b3bde871b788fee42e25fbc8b93aa9f1c16b94fa2c476cbd5ae43ed8323813630f48cbf107b1902b9d060

Download Submit
C:\Windows\System\emWAsMu.exe

Filesize
1.4MB

MD5
252393230de6877ba10177efa770b3e1

SHA1
31f72bf6ad885e288109dc3fc6bd1dfa66555066

SHA256
f6823b265474573cd9063dc3a06aee32bb1df1c9671718c69066970d94a93285

SHA512
4c43d9cd226dc608ebcbb75cc9e15ecc03623cc1123cded9abb5937fb4a6ab4f3795234cd54702634c5ebe7310eb82d25aab35767f1b054d275e5d653645dd20

Download Submit
C:\Windows\System\hfyOEyN.exe

Filesize
1.4MB

MD5
45963cd2ca67706e26284d79b2c8dff1

SHA1
b228706c81a25d34b884627a5df96949a823dfeb

SHA256
f9d7cdd44a3554d5b68f770fca20aafad8526c0419bca95dce770b0baf82ca30

SHA512
adbeba9032bd06f3731535d391512c0e12178f7119b71112b33327e926264979d66c47a7c619d31fc0e1b72c1803bf3f16ea9aa6b7d44f22727b7800375af8ef

Download Submit
C:\Windows\System\lBapzqZ.exe

Filesize
1.4MB

MD5
880f8b6204b6b8f1153d810652e54269

SHA1
f1794608011e89ceba8a6f1bc15aecceb717a2aa

SHA256
59687a7433caca21a1100ba6df065876351f12133d872e72e62d23b8a4112179

SHA512
5cd6dddee1766ebce42e672cbc7e13680eecb3e9ee5e5b1dfe946c89942cc29e9d748c60ce23030a1c4ad039654aebd2ef567e668ce0fc26a10836cde231fec8

Download Submit
C:\Windows\System\oNTXsiB.exe

Filesize
1.4MB

MD5
5981958f1642a465cd747ffc7911968d

SHA1
6dbe8168f1d3a313186756bfad70fd28c3fa7ee8

SHA256
dedca9fbbcb96cbe2820f87637e06eea09a5f6e9e126b827615b0a8451e85620

SHA512
3d5a142d966cbf6af83647e4b6ef0ffa3386b281b6b25c35cb15133729aa0ff9b33241fa26d354c37cc65b26f59c5f583db62328af445ff57860f2aad764d1f8

Download Submit
C:\Windows\System\oOtNbVN.exe

Filesize
1.4MB

MD5
27e587ad635f4c96cc1d92de92cb8eac

SHA1
db2c3d69327c0538aabf07617b49fa383ecab88f

SHA256
6cb7d48f2dd8523c440696571e386a5f76264b5388fe7e1e5b8bc8ef82894ed6

SHA512
f78de4f669a6abcd8366c8556d56f5934abfbc52620216143f924b74a784a73988b4430355634d0d6cf13e31f8af421c09b55a6a9fbe9d160b4e0de97d768235

Download Submit
C:\Windows\System\ovLqwPh.exe

Filesize
1.4MB

MD5
bdfdf25594ca072df9aa8915c7daa870

SHA1
5ef611567a40db0a5f94b77ff8e8500ab04b4f21

SHA256
74c6c3fde8575aecdb1d4916d2ef74e9b91fc9b63c89fbc3908962bef8ffd37f

SHA512
d7f9a4694538d5f6821876680f7c7294968863be840285e62b1ce95d927fdc25e58ecc8c6eae88edced9ba06d7ca28a0860606a2466b6c3e4b4762f3d9564647

Download Submit
C:\Windows\System\qCZtpBm.exe

Filesize
1.4MB

MD5
2f4c16cb99c77b8d60641d26b2b0d3d8

SHA1
e48cb805533a21a97283df13d19ae6f247187549

SHA256
a519b9f54aef764c6246dd9bf6d6acfe5f24b6b2e9bc6a1636b9c75a28c4cc4c

SHA512
b1e052e3634696b19eae2d8de364970003cb66224837185c63a7a7e0d8fc17f1719225caa39e15de7d10d1eafd64faa3ed18caeb8eb2e5ccae9f02c07c825046

Download Submit
C:\Windows\System\rIQGZZY.exe

Filesize
1.4MB

MD5
c22d70e29213359681450651dc596a20

SHA1
c7246a2ce46e4490ae0d906feade9508abb9f14a

SHA256
d70d896dfc7946ac157b4889f5244a2695f3b1561a2e11acc7d1c30b47e8b031

SHA512
e7faa3b55f68a78563ab7a66340db6b29460aa0fbc110cb04c1196b3f6d1aa74e562c5bdeb196cd681518b7f37763102a6a7eab66e6d83bdcfcb5d19833a112d

Download Submit
C:\Windows\System\rhlWTNW.exe

Filesize
1.4MB

MD5
9c07cb218b0eb06cb8adabc26bc32e28

SHA1
57a852de0477a0f9da5e1ca9e2ecf950667478b7

SHA256
2be6e78612bf1dc14fbc79872f0bed1919f34d7c4cab766b9a746ef595d7b3cc

SHA512
36090fd729476b8c4cb808c728d9bfd46693265e7a0f86fc6d10ef9c3916a98a46c05eb9555f0582e81289a5b1bad9bcfde0b907ab4386f2314ce6f959514ee0

Download Submit
C:\Windows\System\vDuoimc.exe

Filesize
1.4MB

MD5
d58e240e3c733e5a6f7a390f70a13f87

SHA1
f66210d34051c9c8c005771ee1f802d9b71cbab9

SHA256
9b3f013dc9ce03f0dfc12212f572e4c41ea917597625d23b163988dc67278d02

SHA512
7de8cf92312e036d447c600d29504f10c6d3959d56c8ed09ee6e86ca22d098807e0fcc73e13fa9c82d4a7d7db2791d059fb076966812eb884d9892757ee1d198

Download Submit
C:\Windows\System\wIVZBfG.exe

Filesize
1.4MB

MD5
a0d1cf82762faf1aeafdb1518746f447

SHA1
f96123b303070314fb5380373909c096fee18de5

SHA256
ac406be9d7cf74b34ed73304def0d4a09a7e24614884d56c0f658f3720905876

SHA512
611418a805c86b5965471a13290a66d537d46c8901c538633755791a7a2c31648c4966379e9e9c3f9e40101cad4d7710b7029086060bdeb51c962e29ed301a91

Download Submit
C:\Windows\System\wfXLUrx.exe

Filesize
1.4MB

MD5
770e1373184c0fa24598d5a6c8bd5b1e

SHA1
eef8a647881e5a3f49445eea106e64670975b4de

SHA256
3bce11d5ce6ba92a810fe671c26936a0a5b446de646c1f6295aefdfaea52b1b9

SHA512
f16f4da2cf4072f1444fbbf33d8ee83c2ae99fc2ee0264fc39bcb5de3839705571a7d45d557c68a85e0a6f1225990d5414be8247d9747df72e20d8b39293e092

Download Submit
C:\Windows\System\xFknSvV.exe

Filesize
1.4MB

MD5
86af8c074775ac13ea7c3a329ebad5b4

SHA1
5bffd13c59cb5cfa1c1cec3907002d72e923930a

SHA256
f66e767c18011ac77817e2d06b5503d9330da073affb1e8eb7509d5b8fd4ad45

SHA512
ade6bfd6de7d9aeba3daf22f0ac4c1f9f5a549803bbc71113e5f432ce56e1d92a936ea068e028f079d1f0894b59513436bed21b2866e032c3a04c3fbe1f9c9b6

Download Submit
C:\Windows\System\yIOYcnu.exe

Filesize
1.4MB

MD5
891a2b3cc7fe3147e67ad7f5bc56fbd8

SHA1
5d6b5580f899d6d5150ba6f9bda05647ccbc803f

SHA256
548203ff3bdf2c4e4d48db29cd0fea0d83a22862cd488521b54ab7a47ee39af9

SHA512
f18745de828289bb740803685591f69bbfa0a7d839201fc381b8c1eedd760b8e2f66b65d51204361939d78b630cd9d9004c81ccf9a7a409e884f96dd9a2ca6d7

Download Submit
C:\Windows\System\zbQWGty.exe

Filesize
1.4MB

MD5
40d96f12ab5583fe093efd23b9847a3c

SHA1
c25835df5ae958d766323fe4bec673ec1e1cf016

SHA256
d47b1ec7c5abc69ac4e54ad2d1ce61dc6e715dba95a3ac790fad04d59838be3a

SHA512
18c2f94b9c8a38669b7c66d973ee6c55be25d9c8b75dcfa3a3f55f9a18315e9f6fa6c7a1ffe512faa3560f22926ffd5722397ed1924eb412bc624d93acad8868

Download Submit
memory/3824-0-0x000001DBA2510000-0x000001DBA2520000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads