xmrig | ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
Size

1.1MB
MD5

1d4b3a0b3e8f3d31a3979d7b87b9adf2
SHA1

529bc82dc0135cf393f617538efd742012e81dc1
SHA256

ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8
SHA512

a8cdbc4d81bce2e8a766f53110b7cfe5de3dae5753b0ce0992dd3bdfc979c187781e0261a456df14b3bff3a2b82f36834e8c882be297a2b7bbfd009f4a6346e0
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensz8Zs0YrTqU9Fd:GezaTF8FcNkNdfE0pZ9ozttwIRbfN

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000e000000023b6b-4.dat	xmrig
behavioral2/files/0x000a000000023b78-7.dat	xmrig
behavioral2/files/0x000a000000023b79-6.dat	xmrig
behavioral2/files/0x000a000000023b7b-48.dat	xmrig
behavioral2/files/0x000a000000023b7c-62.dat	xmrig
behavioral2/files/0x000a000000023b84-86.dat	xmrig
behavioral2/files/0x0031000000023b8a-100.dat	xmrig
behavioral2/files/0x0031000000023b89-98.dat	xmrig
behavioral2/files/0x0031000000023b88-96.dat	xmrig
behavioral2/files/0x000a000000023b87-94.dat	xmrig
behavioral2/files/0x000a000000023b86-92.dat	xmrig
behavioral2/files/0x000a000000023b85-90.dat	xmrig
behavioral2/files/0x000a000000023b81-88.dat	xmrig
behavioral2/files/0x000a000000023b83-84.dat	xmrig
behavioral2/files/0x000a000000023b82-82.dat	xmrig
behavioral2/files/0x000a000000023b80-80.dat	xmrig
behavioral2/files/0x000a000000023b7d-76.dat	xmrig
behavioral2/files/0x000a000000023b7e-67.dat	xmrig
behavioral2/files/0x000a000000023b7a-51.dat	xmrig
behavioral2/files/0x000a000000023b7f-37.dat	xmrig
behavioral2/files/0x000d000000023b6c-113.dat	xmrig
behavioral2/files/0x000a000000023b8b-118.dat	xmrig
behavioral2/files/0x000a000000023b8d-112.dat	xmrig
behavioral2/files/0x000a000000023b8c-109.dat	xmrig
behavioral2/files/0x000a000000023b90-128.dat	xmrig
behavioral2/files/0x000a000000023b8f-124.dat	xmrig
behavioral2/files/0x000a000000023b8e-121.dat	xmrig
behavioral2/files/0x000a000000023b99-166.dat	xmrig
behavioral2/files/0x000a000000023b98-165.dat	xmrig
behavioral2/files/0x000a000000023b97-163.dat	xmrig
behavioral2/files/0x000a000000023b95-160.dat	xmrig
behavioral2/files/0x000a000000023b96-150.dat	xmrig
behavioral2/files/0x000a000000023b94-149.dat	xmrig
behavioral2/files/0x000a000000023b93-148.dat	xmrig
behavioral2/files/0x000a000000023b92-147.dat	xmrig
behavioral2/files/0x000a000000023b91-141.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4736	EvxBXwx.exe
1776	xAbsFZQ.exe
4436	pwYKaYY.exe
4520	xSdAGFX.exe
2096	dyhAdqt.exe
4784	qYCjOsB.exe
2904	pltLOCi.exe
980	wBUrqzw.exe
996	OWpJVxU.exe
3464	bRBJkHh.exe
3172	qJpGtOo.exe
1796	lVANVyk.exe
3024	yBFIJLT.exe
1428	ahpopxD.exe
2376	QMVxGgv.exe
5036	RaQiwLg.exe
4672	UMXLAEB.exe
1416	MFQhDNg.exe
3608	WWyXPrY.exe
3008	iJoNZUf.exe
212	cMDNprt.exe
4384	scjKiyH.exe
3044	kEVHmtX.exe
4468	yEzbsDA.exe
4180	sEyzpsf.exe
4032	wrWEmFw.exe
4896	tqXHtba.exe
4576	jqeguPv.exe
2768	bUXEexT.exe
1532	OPEMjwJ.exe
1516	tYwtfDd.exe
2156	NMmSHcD.exe
2428	YNZrAaF.exe
4052	uHvlBGo.exe
928	VIFLVKM.exe
640	uLzJiXv.exe
3744	wbHTDlg.exe
4640	VvArIqV.exe
3832	ZhntGTG.exe
3420	iEbzYcV.exe
4388	QpbiHvL.exe
1496	pXjBadz.exe
3660	WIojlis.exe
2896	PdUqWqB.exe
1064	UlswxRS.exe
1552	ATxCZlz.exe
4424	bZOjSok.exe
4984	IipfZwd.exe
2200	dlYYutq.exe
3988	GIgURnu.exe
4604	BrfHCjb.exe
4996	bfPaAfz.exe
2648	kSwcfcY.exe
3760	sVaQaxO.exe
2892	ezukYPp.exe
3964	ogEJNei.exe
1596	zoXmStJ.exe
244	SblnpRf.exe
1520	JxAHyLP.exe
3716	sugsrtW.exe
920	KBWGlHx.exe
1412	IzpMxnF.exe
1580	gOhnYUR.exe
116	HOVMvFw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FJNcWue.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\snXHobm.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\Qdfgpmg.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\WbuiXHL.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\jTaKSPX.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\cCwLPYW.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\vSWGOPl.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\fLheItb.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\RyvEaAS.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\NJQbTHL.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\OipihdQ.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\ucLwumr.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\sJFGyGa.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\NwXSyzo.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\hSARgAo.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\UbOffEc.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\gKyHcTH.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\zOETkdX.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\SLzJrvT.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\sugsrtW.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\EZvWZhq.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\qJpGtOo.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\GCNjNUV.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\fJsFrOT.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\hyzhuwj.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\AhqyrFz.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\sVbMAkm.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\IEOBOea.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\gvuGBZc.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\ySeuoVW.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\VpeqnBo.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\jeQUtzF.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\fjgMlqS.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\AZvieMJ.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\oWwtiHd.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\FGeHeTZ.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\eogvCHd.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\qBtXQDv.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\dLTRIxq.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\XwxzznR.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\edLFYqe.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\dQQHJRc.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\jnOiNXG.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\DcfcIJG.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\XgbjoHh.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\cyLtlij.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\XsvBkwq.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\lVANVyk.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\YEqqkYH.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\NsVykpg.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\aJRFuUd.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\kUcahVc.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\DGqPLuc.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\jGbngpm.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\rwmZiZl.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\NMmSHcD.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\ahtrmvI.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\dqKTiik.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\kSwcfcY.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\CDfMMwb.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\UbMCRXC.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\kmhkQhP.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\jQkmApm.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
File created	C:\Windows\System\rCKonix.exe	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 4736	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	83
PID 384 wrote to memory of 4736	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	83
PID 384 wrote to memory of 1776	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	84
PID 384 wrote to memory of 1776	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	84
PID 384 wrote to memory of 4436	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	85
PID 384 wrote to memory of 4436	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	85
PID 384 wrote to memory of 996	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	86
PID 384 wrote to memory of 996	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	86
PID 384 wrote to memory of 4520	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	87
PID 384 wrote to memory of 4520	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	87
PID 384 wrote to memory of 2096	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	88
PID 384 wrote to memory of 2096	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	88
PID 384 wrote to memory of 4784	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	89
PID 384 wrote to memory of 4784	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	89
PID 384 wrote to memory of 2904	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	90
PID 384 wrote to memory of 2904	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	90
PID 384 wrote to memory of 980	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	91
PID 384 wrote to memory of 980	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	91
PID 384 wrote to memory of 3464	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	92
PID 384 wrote to memory of 3464	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	92
PID 384 wrote to memory of 3172	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	93
PID 384 wrote to memory of 3172	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	93
PID 384 wrote to memory of 1796	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	94
PID 384 wrote to memory of 1796	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	94
PID 384 wrote to memory of 3024	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	95
PID 384 wrote to memory of 3024	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	95
PID 384 wrote to memory of 1428	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	96
PID 384 wrote to memory of 1428	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	96
PID 384 wrote to memory of 2376	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	97
PID 384 wrote to memory of 2376	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	97
PID 384 wrote to memory of 5036	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	98
PID 384 wrote to memory of 5036	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	98
PID 384 wrote to memory of 4672	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	99
PID 384 wrote to memory of 4672	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	99
PID 384 wrote to memory of 1416	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	100
PID 384 wrote to memory of 1416	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	100
PID 384 wrote to memory of 3608	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	101
PID 384 wrote to memory of 3608	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	101
PID 384 wrote to memory of 3008	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	102
PID 384 wrote to memory of 3008	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	102
PID 384 wrote to memory of 212	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	103
PID 384 wrote to memory of 212	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	103
PID 384 wrote to memory of 4384	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	104
PID 384 wrote to memory of 4384	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	104
PID 384 wrote to memory of 3044	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	105
PID 384 wrote to memory of 3044	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	105
PID 384 wrote to memory of 4468	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	106
PID 384 wrote to memory of 4468	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	106
PID 384 wrote to memory of 4180	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	107
PID 384 wrote to memory of 4180	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	107
PID 384 wrote to memory of 4032	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	108
PID 384 wrote to memory of 4032	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	108
PID 384 wrote to memory of 4896	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	109
PID 384 wrote to memory of 4896	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	109
PID 384 wrote to memory of 4576	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	110
PID 384 wrote to memory of 4576	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	110
PID 384 wrote to memory of 2768	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	111
PID 384 wrote to memory of 2768	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	111
PID 384 wrote to memory of 1532	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	112
PID 384 wrote to memory of 1532	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	112
PID 384 wrote to memory of 1516	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	113
PID 384 wrote to memory of 1516	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	113
PID 384 wrote to memory of 2428	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	114
PID 384 wrote to memory of 2428	384	ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe	114

C:\Users\Admin\AppData\Local\Temp\ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe
"C:\Users\Admin\AppData\Local\Temp\ef6f756ead5b9c3d7eec96b88957ffa6a1c8ac831c2fd026fd4cbef602fad9c8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\System\EvxBXwx.exe
  C:\Windows\System\EvxBXwx.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\xAbsFZQ.exe
  C:\Windows\System\xAbsFZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\pwYKaYY.exe
  C:\Windows\System\pwYKaYY.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\OWpJVxU.exe
  C:\Windows\System\OWpJVxU.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\xSdAGFX.exe
  C:\Windows\System\xSdAGFX.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\dyhAdqt.exe
  C:\Windows\System\dyhAdqt.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\qYCjOsB.exe
  C:\Windows\System\qYCjOsB.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\pltLOCi.exe
  C:\Windows\System\pltLOCi.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\wBUrqzw.exe
  C:\Windows\System\wBUrqzw.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\bRBJkHh.exe
  C:\Windows\System\bRBJkHh.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\qJpGtOo.exe
  C:\Windows\System\qJpGtOo.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\lVANVyk.exe
  C:\Windows\System\lVANVyk.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\yBFIJLT.exe
  C:\Windows\System\yBFIJLT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\ahpopxD.exe
  C:\Windows\System\ahpopxD.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\QMVxGgv.exe
  C:\Windows\System\QMVxGgv.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\RaQiwLg.exe
  C:\Windows\System\RaQiwLg.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\UMXLAEB.exe
  C:\Windows\System\UMXLAEB.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\MFQhDNg.exe
  C:\Windows\System\MFQhDNg.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\WWyXPrY.exe
  C:\Windows\System\WWyXPrY.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\iJoNZUf.exe
  C:\Windows\System\iJoNZUf.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\cMDNprt.exe
  C:\Windows\System\cMDNprt.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\scjKiyH.exe
  C:\Windows\System\scjKiyH.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\kEVHmtX.exe
  C:\Windows\System\kEVHmtX.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\yEzbsDA.exe
  C:\Windows\System\yEzbsDA.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\sEyzpsf.exe
  C:\Windows\System\sEyzpsf.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\wrWEmFw.exe
  C:\Windows\System\wrWEmFw.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\tqXHtba.exe
  C:\Windows\System\tqXHtba.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\jqeguPv.exe
  C:\Windows\System\jqeguPv.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\bUXEexT.exe
  C:\Windows\System\bUXEexT.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\OPEMjwJ.exe
  C:\Windows\System\OPEMjwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\tYwtfDd.exe
  C:\Windows\System\tYwtfDd.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\YNZrAaF.exe
  C:\Windows\System\YNZrAaF.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\NMmSHcD.exe
  C:\Windows\System\NMmSHcD.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\uHvlBGo.exe
  C:\Windows\System\uHvlBGo.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\VIFLVKM.exe
  C:\Windows\System\VIFLVKM.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\uLzJiXv.exe
  C:\Windows\System\uLzJiXv.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\wbHTDlg.exe
  C:\Windows\System\wbHTDlg.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\VvArIqV.exe
  C:\Windows\System\VvArIqV.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ZhntGTG.exe
  C:\Windows\System\ZhntGTG.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\iEbzYcV.exe
  C:\Windows\System\iEbzYcV.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\QpbiHvL.exe
  C:\Windows\System\QpbiHvL.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\pXjBadz.exe
  C:\Windows\System\pXjBadz.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\WIojlis.exe
  C:\Windows\System\WIojlis.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\PdUqWqB.exe
  C:\Windows\System\PdUqWqB.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\UlswxRS.exe
  C:\Windows\System\UlswxRS.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ATxCZlz.exe
  C:\Windows\System\ATxCZlz.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\bZOjSok.exe
  C:\Windows\System\bZOjSok.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\IipfZwd.exe
  C:\Windows\System\IipfZwd.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\dlYYutq.exe
  C:\Windows\System\dlYYutq.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\GIgURnu.exe
  C:\Windows\System\GIgURnu.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\BrfHCjb.exe
  C:\Windows\System\BrfHCjb.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\bfPaAfz.exe
  C:\Windows\System\bfPaAfz.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\kSwcfcY.exe
  C:\Windows\System\kSwcfcY.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\sVaQaxO.exe
  C:\Windows\System\sVaQaxO.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\ezukYPp.exe
  C:\Windows\System\ezukYPp.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\ogEJNei.exe
  C:\Windows\System\ogEJNei.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\zoXmStJ.exe
  C:\Windows\System\zoXmStJ.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\SblnpRf.exe
  C:\Windows\System\SblnpRf.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\JxAHyLP.exe
  C:\Windows\System\JxAHyLP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\sugsrtW.exe
  C:\Windows\System\sugsrtW.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\KBWGlHx.exe
  C:\Windows\System\KBWGlHx.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\IzpMxnF.exe
  C:\Windows\System\IzpMxnF.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\gOhnYUR.exe
  C:\Windows\System\gOhnYUR.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\HOVMvFw.exe
  C:\Windows\System\HOVMvFw.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\UKkvXTg.exe
  C:\Windows\System\UKkvXTg.exe
  2⤵
  PID:2392
- C:\Windows\System\qvXDLFx.exe
  C:\Windows\System\qvXDLFx.exe
  2⤵
  PID:2280
- C:\Windows\System\wAtIaeS.exe
  C:\Windows\System\wAtIaeS.exe
  2⤵
  PID:3652
- C:\Windows\System\ksVqmei.exe
  C:\Windows\System\ksVqmei.exe
  2⤵
  PID:2220
- C:\Windows\System\VUVWQGC.exe
  C:\Windows\System\VUVWQGC.exe
  2⤵
  PID:3828
- C:\Windows\System\idrOTeg.exe
  C:\Windows\System\idrOTeg.exe
  2⤵
  PID:3904
- C:\Windows\System\vZAvNiD.exe
  C:\Windows\System\vZAvNiD.exe
  2⤵
  PID:1800
- C:\Windows\System\FjmtffN.exe
  C:\Windows\System\FjmtffN.exe
  2⤵
  PID:3916
- C:\Windows\System\ascCZiE.exe
  C:\Windows\System\ascCZiE.exe
  2⤵
  PID:1992
- C:\Windows\System\MUKbjLV.exe
  C:\Windows\System\MUKbjLV.exe
  2⤵
  PID:4680
- C:\Windows\System\JXRIiOh.exe
  C:\Windows\System\JXRIiOh.exe
  2⤵
  PID:1564
- C:\Windows\System\lNVJhwh.exe
  C:\Windows\System\lNVJhwh.exe
  2⤵
  PID:4860
- C:\Windows\System\xTwCvYk.exe
  C:\Windows\System\xTwCvYk.exe
  2⤵
  PID:1128
- C:\Windows\System\dzcWKMp.exe
  C:\Windows\System\dzcWKMp.exe
  2⤵
  PID:2288
- C:\Windows\System\NKKBvQj.exe
  C:\Windows\System\NKKBvQj.exe
  2⤵
  PID:3240
- C:\Windows\System\rorjskY.exe
  C:\Windows\System\rorjskY.exe
  2⤵
  PID:4148
- C:\Windows\System\KZFuwxR.exe
  C:\Windows\System\KZFuwxR.exe
  2⤵
  PID:3108
- C:\Windows\System\izixccw.exe
  C:\Windows\System\izixccw.exe
  2⤵
  PID:3248
- C:\Windows\System\UedUAyX.exe
  C:\Windows\System\UedUAyX.exe
  2⤵
  PID:1464
- C:\Windows\System\UkdJgRg.exe
  C:\Windows\System\UkdJgRg.exe
  2⤵
  PID:1672
- C:\Windows\System\kHLUJpa.exe
  C:\Windows\System\kHLUJpa.exe
  2⤵
  PID:4792
- C:\Windows\System\nAslMgj.exe
  C:\Windows\System\nAslMgj.exe
  2⤵
  PID:4508
- C:\Windows\System\jTaKSPX.exe
  C:\Windows\System\jTaKSPX.exe
  2⤵
  PID:3032
- C:\Windows\System\qBtXQDv.exe
  C:\Windows\System\qBtXQDv.exe
  2⤵
  PID:3500
- C:\Windows\System\qhtBGzZ.exe
  C:\Windows\System\qhtBGzZ.exe
  2⤵
  PID:3948
- C:\Windows\System\qmQJxVc.exe
  C:\Windows\System\qmQJxVc.exe
  2⤵
  PID:1792
- C:\Windows\System\dHVkSbU.exe
  C:\Windows\System\dHVkSbU.exe
  2⤵
  PID:2444
- C:\Windows\System\DEJagtu.exe
  C:\Windows\System\DEJagtu.exe
  2⤵
  PID:1364
- C:\Windows\System\XprzXVI.exe
  C:\Windows\System\XprzXVI.exe
  2⤵
  PID:2712
- C:\Windows\System\DfiIuXp.exe
  C:\Windows\System\DfiIuXp.exe
  2⤵
  PID:1492
- C:\Windows\System\EZvWZhq.exe
  C:\Windows\System\EZvWZhq.exe
  2⤵
  PID:4264
- C:\Windows\System\pMQQHJz.exe
  C:\Windows\System\pMQQHJz.exe
  2⤵
  PID:5096
- C:\Windows\System\LhzUeOe.exe
  C:\Windows\System\LhzUeOe.exe
  2⤵
  PID:2672
- C:\Windows\System\ihDCzVp.exe
  C:\Windows\System\ihDCzVp.exe
  2⤵
  PID:2012
- C:\Windows\System\YyhSdYq.exe
  C:\Windows\System\YyhSdYq.exe
  2⤵
  PID:4600
- C:\Windows\System\vHJGxys.exe
  C:\Windows\System\vHJGxys.exe
  2⤵
  PID:1840
- C:\Windows\System\JBlVzrO.exe
  C:\Windows\System\JBlVzrO.exe
  2⤵
  PID:3920
- C:\Windows\System\cUhxpYo.exe
  C:\Windows\System\cUhxpYo.exe
  2⤵
  PID:4492
- C:\Windows\System\FJNcWue.exe
  C:\Windows\System\FJNcWue.exe
  2⤵
  PID:2256
- C:\Windows\System\BlUiKCB.exe
  C:\Windows\System\BlUiKCB.exe
  2⤵
  PID:2804
- C:\Windows\System\XgbjoHh.exe
  C:\Windows\System\XgbjoHh.exe
  2⤵
  PID:1652
- C:\Windows\System\zYNfnby.exe
  C:\Windows\System\zYNfnby.exe
  2⤵
  PID:736
- C:\Windows\System\eSmVonv.exe
  C:\Windows\System\eSmVonv.exe
  2⤵
  PID:1448
- C:\Windows\System\slGwPRM.exe
  C:\Windows\System\slGwPRM.exe
  2⤵
  PID:3860
- C:\Windows\System\myTojiw.exe
  C:\Windows\System\myTojiw.exe
  2⤵
  PID:3564
- C:\Windows\System\DVsvLdY.exe
  C:\Windows\System\DVsvLdY.exe
  2⤵
  PID:3324
- C:\Windows\System\fOtAeLY.exe
  C:\Windows\System\fOtAeLY.exe
  2⤵
  PID:1044
- C:\Windows\System\uUxQHjf.exe
  C:\Windows\System\uUxQHjf.exe
  2⤵
  PID:3400
- C:\Windows\System\dsgTBZO.exe
  C:\Windows\System\dsgTBZO.exe
  2⤵
  PID:1512
- C:\Windows\System\GhdqSVu.exe
  C:\Windows\System\GhdqSVu.exe
  2⤵
  PID:1212
- C:\Windows\System\GOKhfqb.exe
  C:\Windows\System\GOKhfqb.exe
  2⤵
  PID:2856
- C:\Windows\System\ILCzVDP.exe
  C:\Windows\System\ILCzVDP.exe
  2⤵
  PID:4884
- C:\Windows\System\VGeaNBY.exe
  C:\Windows\System\VGeaNBY.exe
  2⤵
  PID:3888
- C:\Windows\System\lLtwAzG.exe
  C:\Windows\System\lLtwAzG.exe
  2⤵
  PID:4368
- C:\Windows\System\aqwZdhK.exe
  C:\Windows\System\aqwZdhK.exe
  2⤵
  PID:5100
- C:\Windows\System\QrxqFet.exe
  C:\Windows\System\QrxqFet.exe
  2⤵
  PID:2908
- C:\Windows\System\pCrSsFc.exe
  C:\Windows\System\pCrSsFc.exe
  2⤵
  PID:4592
- C:\Windows\System\FyuQySn.exe
  C:\Windows\System\FyuQySn.exe
  2⤵
  PID:5144
- C:\Windows\System\PvHPNZD.exe
  C:\Windows\System\PvHPNZD.exe
  2⤵
  PID:5220
- C:\Windows\System\UslBdDm.exe
  C:\Windows\System\UslBdDm.exe
  2⤵
  PID:5248
- C:\Windows\System\dwlzKvX.exe
  C:\Windows\System\dwlzKvX.exe
  2⤵
  PID:5280
- C:\Windows\System\inrjpnH.exe
  C:\Windows\System\inrjpnH.exe
  2⤵
  PID:5308
- C:\Windows\System\KouZkFa.exe
  C:\Windows\System\KouZkFa.exe
  2⤵
  PID:5352
- C:\Windows\System\NmxRDON.exe
  C:\Windows\System\NmxRDON.exe
  2⤵
  PID:5384
- C:\Windows\System\cpMRpbD.exe
  C:\Windows\System\cpMRpbD.exe
  2⤵
  PID:5404
- C:\Windows\System\NcXldcs.exe
  C:\Windows\System\NcXldcs.exe
  2⤵
  PID:5452
- C:\Windows\System\qGskmUZ.exe
  C:\Windows\System\qGskmUZ.exe
  2⤵
  PID:5476
- C:\Windows\System\XirbgEi.exe
  C:\Windows\System\XirbgEi.exe
  2⤵
  PID:5508
- C:\Windows\System\AfQvXaT.exe
  C:\Windows\System\AfQvXaT.exe
  2⤵
  PID:5536
- C:\Windows\System\bEbhLcH.exe
  C:\Windows\System\bEbhLcH.exe
  2⤵
  PID:5568
- C:\Windows\System\gpbVmaI.exe
  C:\Windows\System\gpbVmaI.exe
  2⤵
  PID:5588
- C:\Windows\System\zLbyJYN.exe
  C:\Windows\System\zLbyJYN.exe
  2⤵
  PID:5612
- C:\Windows\System\JOlCrqn.exe
  C:\Windows\System\JOlCrqn.exe
  2⤵
  PID:5644
- C:\Windows\System\yhyJuyb.exe
  C:\Windows\System\yhyJuyb.exe
  2⤵
  PID:5672
- C:\Windows\System\mCpdDlT.exe
  C:\Windows\System\mCpdDlT.exe
  2⤵
  PID:5708
- C:\Windows\System\GUfyDDt.exe
  C:\Windows\System\GUfyDDt.exe
  2⤵
  PID:5732
- C:\Windows\System\SzmjRtm.exe
  C:\Windows\System\SzmjRtm.exe
  2⤵
  PID:5768
- C:\Windows\System\bwvxdof.exe
  C:\Windows\System\bwvxdof.exe
  2⤵
  PID:5804
- C:\Windows\System\PoENCuf.exe
  C:\Windows\System\PoENCuf.exe
  2⤵
  PID:5832
- C:\Windows\System\GrJfxpp.exe
  C:\Windows\System\GrJfxpp.exe
  2⤵
  PID:5856
- C:\Windows\System\jarlPgt.exe
  C:\Windows\System\jarlPgt.exe
  2⤵
  PID:5884
- C:\Windows\System\ZeyRFid.exe
  C:\Windows\System\ZeyRFid.exe
  2⤵
  PID:5920
- C:\Windows\System\EVwAlpr.exe
  C:\Windows\System\EVwAlpr.exe
  2⤵
  PID:5940
- C:\Windows\System\LCWCVcj.exe
  C:\Windows\System\LCWCVcj.exe
  2⤵
  PID:5964
- C:\Windows\System\eQyttjx.exe
  C:\Windows\System\eQyttjx.exe
  2⤵
  PID:6000
- C:\Windows\System\atqxBcG.exe
  C:\Windows\System\atqxBcG.exe
  2⤵
  PID:6028
- C:\Windows\System\LzkqJOi.exe
  C:\Windows\System\LzkqJOi.exe
  2⤵
  PID:6084
- C:\Windows\System\dTuVxHa.exe
  C:\Windows\System\dTuVxHa.exe
  2⤵
  PID:6128
- C:\Windows\System\ofpSCjS.exe
  C:\Windows\System\ofpSCjS.exe
  2⤵
  PID:4824
- C:\Windows\System\zPixoga.exe
  C:\Windows\System\zPixoga.exe
  2⤵
  PID:1696
- C:\Windows\System\cpiQLaW.exe
  C:\Windows\System\cpiQLaW.exe
  2⤵
  PID:4480
- C:\Windows\System\ziGVrUE.exe
  C:\Windows\System\ziGVrUE.exe
  2⤵
  PID:1148
- C:\Windows\System\crGWUxa.exe
  C:\Windows\System\crGWUxa.exe
  2⤵
  PID:4432
- C:\Windows\System\hMAdKvF.exe
  C:\Windows\System\hMAdKvF.exe
  2⤵
  PID:5244
- C:\Windows\System\oxDEouS.exe
  C:\Windows\System\oxDEouS.exe
  2⤵
  PID:5264
- C:\Windows\System\cEeBpIf.exe
  C:\Windows\System\cEeBpIf.exe
  2⤵
  PID:5360
- C:\Windows\System\lSGajCY.exe
  C:\Windows\System\lSGajCY.exe
  2⤵
  PID:5484
- C:\Windows\System\HVfptUY.exe
  C:\Windows\System\HVfptUY.exe
  2⤵
  PID:2800
- C:\Windows\System\orMjRiC.exe
  C:\Windows\System\orMjRiC.exe
  2⤵
  PID:5580
- C:\Windows\System\TfBtTXM.exe
  C:\Windows\System\TfBtTXM.exe
  2⤵
  PID:5548
- C:\Windows\System\dpSdPdd.exe
  C:\Windows\System\dpSdPdd.exe
  2⤵
  PID:5688
- C:\Windows\System\DcfcIJG.exe
  C:\Windows\System\DcfcIJG.exe
  2⤵
  PID:5628
- C:\Windows\System\aKdgkaN.exe
  C:\Windows\System\aKdgkaN.exe
  2⤵
  PID:5788
- C:\Windows\System\GkLILXG.exe
  C:\Windows\System\GkLILXG.exe
  2⤵
  PID:5868
- C:\Windows\System\JuhRnsh.exe
  C:\Windows\System\JuhRnsh.exe
  2⤵
  PID:5900
- C:\Windows\System\TtjkBMG.exe
  C:\Windows\System\TtjkBMG.exe
  2⤵
  PID:5984
- C:\Windows\System\guKJXxw.exe
  C:\Windows\System\guKJXxw.exe
  2⤵
  PID:6016
- C:\Windows\System\RYYfKuB.exe
  C:\Windows\System\RYYfKuB.exe
  2⤵
  PID:6040
- C:\Windows\System\usgOFWP.exe
  C:\Windows\System\usgOFWP.exe
  2⤵
  PID:6116
- C:\Windows\System\KylQziv.exe
  C:\Windows\System\KylQziv.exe
  2⤵
  PID:2044
- C:\Windows\System\WmWJQAv.exe
  C:\Windows\System\WmWJQAv.exe
  2⤵
  PID:5820
- C:\Windows\System\joZvdiL.exe
  C:\Windows\System\joZvdiL.exe
  2⤵
  PID:5272
- C:\Windows\System\JfFSvvZ.exe
  C:\Windows\System\JfFSvvZ.exe
  2⤵
  PID:5340
- C:\Windows\System\NzNjjPJ.exe
  C:\Windows\System\NzNjjPJ.exe
  2⤵
  PID:5460
- C:\Windows\System\pXveksE.exe
  C:\Windows\System\pXveksE.exe
  2⤵
  PID:5748
- C:\Windows\System\ofOAdoG.exe
  C:\Windows\System\ofOAdoG.exe
  2⤵
  PID:5636
- C:\Windows\System\kziqIMZ.exe
  C:\Windows\System\kziqIMZ.exe
  2⤵
  PID:5960
- C:\Windows\System\iGtwbap.exe
  C:\Windows\System\iGtwbap.exe
  2⤵
  PID:5912
- C:\Windows\System\qtvfBRP.exe
  C:\Windows\System\qtvfBRP.exe
  2⤵
  PID:5256
- C:\Windows\System\RMqZCOF.exe
  C:\Windows\System\RMqZCOF.exe
  2⤵
  PID:6152
- C:\Windows\System\PLcSNVa.exe
  C:\Windows\System\PLcSNVa.exe
  2⤵
  PID:6180
- C:\Windows\System\LMFnQvH.exe
  C:\Windows\System\LMFnQvH.exe
  2⤵
  PID:6208
- C:\Windows\System\GOdCACY.exe
  C:\Windows\System\GOdCACY.exe
  2⤵
  PID:6232
- C:\Windows\System\IOmqWHO.exe
  C:\Windows\System\IOmqWHO.exe
  2⤵
  PID:6268
- C:\Windows\System\xJALPqh.exe
  C:\Windows\System\xJALPqh.exe
  2⤵
  PID:6296
- C:\Windows\System\osKCCbV.exe
  C:\Windows\System\osKCCbV.exe
  2⤵
  PID:6328
- C:\Windows\System\jWBXjQK.exe
  C:\Windows\System\jWBXjQK.exe
  2⤵
  PID:6348
- C:\Windows\System\VrJArGb.exe
  C:\Windows\System\VrJArGb.exe
  2⤵
  PID:6376
- C:\Windows\System\MwlUxhR.exe
  C:\Windows\System\MwlUxhR.exe
  2⤵
  PID:6400
- C:\Windows\System\OjKBUvf.exe
  C:\Windows\System\OjKBUvf.exe
  2⤵
  PID:6424
- C:\Windows\System\ipXPaeN.exe
  C:\Windows\System\ipXPaeN.exe
  2⤵
  PID:6444
- C:\Windows\System\NMlClcC.exe
  C:\Windows\System\NMlClcC.exe
  2⤵
  PID:6472
- C:\Windows\System\gvuGBZc.exe
  C:\Windows\System\gvuGBZc.exe
  2⤵
  PID:6512
- C:\Windows\System\oKsUNvl.exe
  C:\Windows\System\oKsUNvl.exe
  2⤵
  PID:6536
- C:\Windows\System\YOPiFPN.exe
  C:\Windows\System\YOPiFPN.exe
  2⤵
  PID:6560
- C:\Windows\System\HEuVihD.exe
  C:\Windows\System\HEuVihD.exe
  2⤵
  PID:6584
- C:\Windows\System\AUvKgoJ.exe
  C:\Windows\System\AUvKgoJ.exe
  2⤵
  PID:6624
- C:\Windows\System\bkltuNV.exe
  C:\Windows\System\bkltuNV.exe
  2⤵
  PID:6652
- C:\Windows\System\dLTRIxq.exe
  C:\Windows\System\dLTRIxq.exe
  2⤵
  PID:6680
- C:\Windows\System\nHVfrRt.exe
  C:\Windows\System\nHVfrRt.exe
  2⤵
  PID:6704
- C:\Windows\System\NEDWfSS.exe
  C:\Windows\System\NEDWfSS.exe
  2⤵
  PID:6724
- C:\Windows\System\ehYcenQ.exe
  C:\Windows\System\ehYcenQ.exe
  2⤵
  PID:6756
- C:\Windows\System\kKjKbdh.exe
  C:\Windows\System\kKjKbdh.exe
  2⤵
  PID:6780
- C:\Windows\System\kEWZFVs.exe
  C:\Windows\System\kEWZFVs.exe
  2⤵
  PID:6804
- C:\Windows\System\GXTpQhH.exe
  C:\Windows\System\GXTpQhH.exe
  2⤵
  PID:6832
- C:\Windows\System\KIKrybw.exe
  C:\Windows\System\KIKrybw.exe
  2⤵
  PID:6848
- C:\Windows\System\XwxzznR.exe
  C:\Windows\System\XwxzznR.exe
  2⤵
  PID:6876
- C:\Windows\System\pjNAgIu.exe
  C:\Windows\System\pjNAgIu.exe
  2⤵
  PID:6904
- C:\Windows\System\mekRVlB.exe
  C:\Windows\System\mekRVlB.exe
  2⤵
  PID:6936
- C:\Windows\System\dFRtTyp.exe
  C:\Windows\System\dFRtTyp.exe
  2⤵
  PID:6960
- C:\Windows\System\HKQyVTZ.exe
  C:\Windows\System\HKQyVTZ.exe
  2⤵
  PID:6984
- C:\Windows\System\tvmqNrz.exe
  C:\Windows\System\tvmqNrz.exe
  2⤵
  PID:7012
- C:\Windows\System\KsjQvwV.exe
  C:\Windows\System\KsjQvwV.exe
  2⤵
  PID:7036
- C:\Windows\System\ptzYUfZ.exe
  C:\Windows\System\ptzYUfZ.exe
  2⤵
  PID:7056
- C:\Windows\System\ROWnYhB.exe
  C:\Windows\System\ROWnYhB.exe
  2⤵
  PID:7080
- C:\Windows\System\aoIclBV.exe
  C:\Windows\System\aoIclBV.exe
  2⤵
  PID:7104
- C:\Windows\System\wCbTFoY.exe
  C:\Windows\System\wCbTFoY.exe
  2⤵
  PID:7132
- C:\Windows\System\fLoXloL.exe
  C:\Windows\System\fLoXloL.exe
  2⤵
  PID:7156
- C:\Windows\System\DdhyCzK.exe
  C:\Windows\System\DdhyCzK.exe
  2⤵
  PID:6092
- C:\Windows\System\JGiUDir.exe
  C:\Windows\System\JGiUDir.exe
  2⤵
  PID:6168
- C:\Windows\System\vSWGOPl.exe
  C:\Windows\System\vSWGOPl.exe
  2⤵
  PID:6224
- C:\Windows\System\vftiAnk.exe
  C:\Windows\System\vftiAnk.exe
  2⤵
  PID:6068
- C:\Windows\System\vxKfGfT.exe
  C:\Windows\System\vxKfGfT.exe
  2⤵
  PID:6392
- C:\Windows\System\squbeig.exe
  C:\Windows\System\squbeig.exe
  2⤵
  PID:6416
- C:\Windows\System\rCKonix.exe
  C:\Windows\System\rCKonix.exe
  2⤵
  PID:6496
- C:\Windows\System\SUakFDH.exe
  C:\Windows\System\SUakFDH.exe
  2⤵
  PID:6456
- C:\Windows\System\LFyoMID.exe
  C:\Windows\System\LFyoMID.exe
  2⤵
  PID:6644
- C:\Windows\System\lcadlDg.exe
  C:\Windows\System\lcadlDg.exe
  2⤵
  PID:6528
- C:\Windows\System\IcoEQHJ.exe
  C:\Windows\System\IcoEQHJ.exe
  2⤵
  PID:6744
- C:\Windows\System\RpwLqxQ.exe
  C:\Windows\System\RpwLqxQ.exe
  2⤵
  PID:6632
- C:\Windows\System\lousOBe.exe
  C:\Windows\System\lousOBe.exe
  2⤵
  PID:6812
- C:\Windows\System\xHDKXcW.exe
  C:\Windows\System\xHDKXcW.exe
  2⤵
  PID:6972
- C:\Windows\System\csZfbbT.exe
  C:\Windows\System\csZfbbT.exe
  2⤵
  PID:6884
- C:\Windows\System\NHeSxBJ.exe
  C:\Windows\System\NHeSxBJ.exe
  2⤵
  PID:6820
- C:\Windows\System\OFrGMON.exe
  C:\Windows\System\OFrGMON.exe
  2⤵
  PID:7140
- C:\Windows\System\hSARgAo.exe
  C:\Windows\System\hSARgAo.exe
  2⤵
  PID:5660
- C:\Windows\System\FtfbWuD.exe
  C:\Windows\System\FtfbWuD.exe
  2⤵
  PID:6304
- C:\Windows\System\FzBqhoA.exe
  C:\Windows\System\FzBqhoA.exe
  2⤵
  PID:6200
- C:\Windows\System\OxUOiGK.exe
  C:\Windows\System\OxUOiGK.exe
  2⤵
  PID:6468
- C:\Windows\System\BOzKQDA.exe
  C:\Windows\System\BOzKQDA.exe
  2⤵
  PID:6284
- C:\Windows\System\pqiquss.exe
  C:\Windows\System\pqiquss.exe
  2⤵
  PID:6692
- C:\Windows\System\fMXARqr.exe
  C:\Windows\System\fMXARqr.exe
  2⤵
  PID:6856
- C:\Windows\System\ScrpavD.exe
  C:\Windows\System\ScrpavD.exe
  2⤵
  PID:7068
- C:\Windows\System\hPacPxv.exe
  C:\Windows\System\hPacPxv.exe
  2⤵
  PID:7052
- C:\Windows\System\YEqqkYH.exe
  C:\Windows\System\YEqqkYH.exe
  2⤵
  PID:7192
- C:\Windows\System\yHcBFUJ.exe
  C:\Windows\System\yHcBFUJ.exe
  2⤵
  PID:7220
- C:\Windows\System\orHkLXW.exe
  C:\Windows\System\orHkLXW.exe
  2⤵
  PID:7244
- C:\Windows\System\XwlrAJp.exe
  C:\Windows\System\XwlrAJp.exe
  2⤵
  PID:7264
- C:\Windows\System\EzxmMGA.exe
  C:\Windows\System\EzxmMGA.exe
  2⤵
  PID:7296
- C:\Windows\System\ivLKmWZ.exe
  C:\Windows\System\ivLKmWZ.exe
  2⤵
  PID:7316
- C:\Windows\System\BwVJoYZ.exe
  C:\Windows\System\BwVJoYZ.exe
  2⤵
  PID:7344
- C:\Windows\System\TurHcqO.exe
  C:\Windows\System\TurHcqO.exe
  2⤵
  PID:7372
- C:\Windows\System\wKgfrBm.exe
  C:\Windows\System\wKgfrBm.exe
  2⤵
  PID:7404
- C:\Windows\System\BAgwmBT.exe
  C:\Windows\System\BAgwmBT.exe
  2⤵
  PID:7432
- C:\Windows\System\YyokXPn.exe
  C:\Windows\System\YyokXPn.exe
  2⤵
  PID:7460
- C:\Windows\System\QNApvNl.exe
  C:\Windows\System\QNApvNl.exe
  2⤵
  PID:7488
- C:\Windows\System\DCAkfxb.exe
  C:\Windows\System\DCAkfxb.exe
  2⤵
  PID:7508
- C:\Windows\System\dEGAJgy.exe
  C:\Windows\System\dEGAJgy.exe
  2⤵
  PID:7536
- C:\Windows\System\VxBlmOt.exe
  C:\Windows\System\VxBlmOt.exe
  2⤵
  PID:7552
- C:\Windows\System\VbhvwBR.exe
  C:\Windows\System\VbhvwBR.exe
  2⤵
  PID:7584
- C:\Windows\System\rSKvCEi.exe
  C:\Windows\System\rSKvCEi.exe
  2⤵
  PID:7608
- C:\Windows\System\SUjLSrp.exe
  C:\Windows\System\SUjLSrp.exe
  2⤵
  PID:7640
- C:\Windows\System\nlknpbq.exe
  C:\Windows\System\nlknpbq.exe
  2⤵
  PID:7664
- C:\Windows\System\EqllFUf.exe
  C:\Windows\System\EqllFUf.exe
  2⤵
  PID:7692
- C:\Windows\System\WbTwtJq.exe
  C:\Windows\System\WbTwtJq.exe
  2⤵
  PID:7716
- C:\Windows\System\xyKwlqE.exe
  C:\Windows\System\xyKwlqE.exe
  2⤵
  PID:7744
- C:\Windows\System\ucLwumr.exe
  C:\Windows\System\ucLwumr.exe
  2⤵
  PID:7768
- C:\Windows\System\TqOixxX.exe
  C:\Windows\System\TqOixxX.exe
  2⤵
  PID:7788
- C:\Windows\System\oiDKWnt.exe
  C:\Windows\System\oiDKWnt.exe
  2⤵
  PID:7816
- C:\Windows\System\eaxUUto.exe
  C:\Windows\System\eaxUUto.exe
  2⤵
  PID:7840
- C:\Windows\System\bCqsQpU.exe
  C:\Windows\System\bCqsQpU.exe
  2⤵
  PID:7868
- C:\Windows\System\gotOZKj.exe
  C:\Windows\System\gotOZKj.exe
  2⤵
  PID:7892
- C:\Windows\System\UpxEKma.exe
  C:\Windows\System\UpxEKma.exe
  2⤵
  PID:7932
- C:\Windows\System\xRRuUxW.exe
  C:\Windows\System\xRRuUxW.exe
  2⤵
  PID:7960
- C:\Windows\System\jQkmApm.exe
  C:\Windows\System\jQkmApm.exe
  2⤵
  PID:7984
- C:\Windows\System\YklWaml.exe
  C:\Windows\System\YklWaml.exe
  2⤵
  PID:8004
- C:\Windows\System\zIhjffw.exe
  C:\Windows\System\zIhjffw.exe
  2⤵
  PID:8028
- C:\Windows\System\GFLFEdd.exe
  C:\Windows\System\GFLFEdd.exe
  2⤵
  PID:8056
- C:\Windows\System\cnJgdIO.exe
  C:\Windows\System\cnJgdIO.exe
  2⤵
  PID:8080
- C:\Windows\System\KuEYovR.exe
  C:\Windows\System\KuEYovR.exe
  2⤵
  PID:8100
- C:\Windows\System\CPUbGHg.exe
  C:\Windows\System\CPUbGHg.exe
  2⤵
  PID:8132
- C:\Windows\System\hjZpBcF.exe
  C:\Windows\System\hjZpBcF.exe
  2⤵
  PID:8164
- C:\Windows\System\bkfBRSg.exe
  C:\Windows\System\bkfBRSg.exe
  2⤵
  PID:6872
- C:\Windows\System\QGexuwN.exe
  C:\Windows\System\QGexuwN.exe
  2⤵
  PID:5852
- C:\Windows\System\lmvtARm.exe
  C:\Windows\System\lmvtARm.exe
  2⤵
  PID:7176
- C:\Windows\System\lOjrqhd.exe
  C:\Windows\System\lOjrqhd.exe
  2⤵
  PID:7000
- C:\Windows\System\AZvieMJ.exe
  C:\Windows\System\AZvieMJ.exe
  2⤵
  PID:6920
- C:\Windows\System\pBkeEey.exe
  C:\Windows\System\pBkeEey.exe
  2⤵
  PID:7336
- C:\Windows\System\uKRhcgO.exe
  C:\Windows\System\uKRhcgO.exe
  2⤵
  PID:7420
- C:\Windows\System\JobssHs.exe
  C:\Windows\System\JobssHs.exe
  2⤵
  PID:7472
- C:\Windows\System\kFspCgd.exe
  C:\Windows\System\kFspCgd.exe
  2⤵
  PID:7504
- C:\Windows\System\PuRwTjn.exe
  C:\Windows\System\PuRwTjn.exe
  2⤵
  PID:7528
- C:\Windows\System\nODbAQk.exe
  C:\Windows\System\nODbAQk.exe
  2⤵
  PID:7364
- C:\Windows\System\BaAxIxS.exe
  C:\Windows\System\BaAxIxS.exe
  2⤵
  PID:7636
- C:\Windows\System\HvJmGCE.exe
  C:\Windows\System\HvJmGCE.exe
  2⤵
  PID:7500
- C:\Windows\System\vVsOGwm.exe
  C:\Windows\System\vVsOGwm.exe
  2⤵
  PID:7804
- C:\Windows\System\cCsyhuQ.exe
  C:\Windows\System\cCsyhuQ.exe
  2⤵
  PID:7672
- C:\Windows\System\AbcYZif.exe
  C:\Windows\System\AbcYZif.exe
  2⤵
  PID:7740
- C:\Windows\System\VRKQmRn.exe
  C:\Windows\System\VRKQmRn.exe
  2⤵
  PID:7756
- C:\Windows\System\iVldWKu.exe
  C:\Windows\System\iVldWKu.exe
  2⤵
  PID:8020
- C:\Windows\System\NbqMQLZ.exe
  C:\Windows\System\NbqMQLZ.exe
  2⤵
  PID:8072
- C:\Windows\System\YdPMqBo.exe
  C:\Windows\System\YdPMqBo.exe
  2⤵
  PID:8144
- C:\Windows\System\yJgQbgW.exe
  C:\Windows\System\yJgQbgW.exe
  2⤵
  PID:8184
- C:\Windows\System\iBeYkQp.exe
  C:\Windows\System\iBeYkQp.exe
  2⤵
  PID:6736
- C:\Windows\System\EnxQgXD.exe
  C:\Windows\System\EnxQgXD.exe
  2⤵
  PID:8152
- C:\Windows\System\RtaatoU.exe
  C:\Windows\System\RtaatoU.exe
  2⤵
  PID:7276
- C:\Windows\System\uvkYCWK.exe
  C:\Windows\System\uvkYCWK.exe
  2⤵
  PID:6720
- C:\Windows\System\bHoRDER.exe
  C:\Windows\System\bHoRDER.exe
  2⤵
  PID:7208
- C:\Windows\System\jxZERks.exe
  C:\Windows\System\jxZERks.exe
  2⤵
  PID:8216
- C:\Windows\System\oftZjcn.exe
  C:\Windows\System\oftZjcn.exe
  2⤵
  PID:8236
- C:\Windows\System\oWwtiHd.exe
  C:\Windows\System\oWwtiHd.exe
  2⤵
  PID:8256
- C:\Windows\System\cxBlZge.exe
  C:\Windows\System\cxBlZge.exe
  2⤵
  PID:8280
- C:\Windows\System\ZHKblIZ.exe
  C:\Windows\System\ZHKblIZ.exe
  2⤵
  PID:8300
- C:\Windows\System\kOkDEmI.exe
  C:\Windows\System\kOkDEmI.exe
  2⤵
  PID:8328
- C:\Windows\System\LhCRWev.exe
  C:\Windows\System\LhCRWev.exe
  2⤵
  PID:8356
- C:\Windows\System\fjgMlqS.exe
  C:\Windows\System\fjgMlqS.exe
  2⤵
  PID:8380
- C:\Windows\System\snXHobm.exe
  C:\Windows\System\snXHobm.exe
  2⤵
  PID:8408
- C:\Windows\System\iqCuYrd.exe
  C:\Windows\System\iqCuYrd.exe
  2⤵
  PID:8432
- C:\Windows\System\MRFEPvx.exe
  C:\Windows\System\MRFEPvx.exe
  2⤵
  PID:8452
- C:\Windows\System\LuxMUxX.exe
  C:\Windows\System\LuxMUxX.exe
  2⤵
  PID:8476
- C:\Windows\System\EaExWbX.exe
  C:\Windows\System\EaExWbX.exe
  2⤵
  PID:8508
- C:\Windows\System\OFxInnO.exe
  C:\Windows\System\OFxInnO.exe
  2⤵
  PID:8532
- C:\Windows\System\WNzwhuT.exe
  C:\Windows\System\WNzwhuT.exe
  2⤵
  PID:8556
- C:\Windows\System\KoGQadJ.exe
  C:\Windows\System\KoGQadJ.exe
  2⤵
  PID:8584
- C:\Windows\System\WTXIeOy.exe
  C:\Windows\System\WTXIeOy.exe
  2⤵
  PID:8608
- C:\Windows\System\kLRBNFu.exe
  C:\Windows\System\kLRBNFu.exe
  2⤵
  PID:8632
- C:\Windows\System\qhxkHak.exe
  C:\Windows\System\qhxkHak.exe
  2⤵
  PID:8664
- C:\Windows\System\xgaDtgN.exe
  C:\Windows\System\xgaDtgN.exe
  2⤵
  PID:8692
- C:\Windows\System\SXCJsVs.exe
  C:\Windows\System\SXCJsVs.exe
  2⤵
  PID:8716
- C:\Windows\System\UCltyIT.exe
  C:\Windows\System\UCltyIT.exe
  2⤵
  PID:8740
- C:\Windows\System\EVFGUYw.exe
  C:\Windows\System\EVFGUYw.exe
  2⤵
  PID:8764
- C:\Windows\System\BKhyexc.exe
  C:\Windows\System\BKhyexc.exe
  2⤵
  PID:8792
- C:\Windows\System\WGhfvze.exe
  C:\Windows\System\WGhfvze.exe
  2⤵
  PID:8820
- C:\Windows\System\bPnfRNV.exe
  C:\Windows\System\bPnfRNV.exe
  2⤵
  PID:8844
- C:\Windows\System\ahtrmvI.exe
  C:\Windows\System\ahtrmvI.exe
  2⤵
  PID:8872
- C:\Windows\System\TtqxYeA.exe
  C:\Windows\System\TtqxYeA.exe
  2⤵
  PID:8904
- C:\Windows\System\pfyZWmw.exe
  C:\Windows\System\pfyZWmw.exe
  2⤵
  PID:8924
- C:\Windows\System\kkKTTOf.exe
  C:\Windows\System\kkKTTOf.exe
  2⤵
  PID:8952
- C:\Windows\System\XjGHVFv.exe
  C:\Windows\System\XjGHVFv.exe
  2⤵
  PID:8984
- C:\Windows\System\lXwsnRr.exe
  C:\Windows\System\lXwsnRr.exe
  2⤵
  PID:9004
- C:\Windows\System\KNRbRgq.exe
  C:\Windows\System\KNRbRgq.exe
  2⤵
  PID:9040
- C:\Windows\System\UuipfML.exe
  C:\Windows\System\UuipfML.exe
  2⤵
  PID:9060
- C:\Windows\System\ZHvLHmA.exe
  C:\Windows\System\ZHvLHmA.exe
  2⤵
  PID:9084
- C:\Windows\System\zTgASrR.exe
  C:\Windows\System\zTgASrR.exe
  2⤵
  PID:9108
- C:\Windows\System\aughklt.exe
  C:\Windows\System\aughklt.exe
  2⤵
  PID:9136
- C:\Windows\System\bacYIYq.exe
  C:\Windows\System\bacYIYq.exe
  2⤵
  PID:9156
- C:\Windows\System\DfjVjDG.exe
  C:\Windows\System\DfjVjDG.exe
  2⤵
  PID:9180
- C:\Windows\System\NsVykpg.exe
  C:\Windows\System\NsVykpg.exe
  2⤵
  PID:9208
- C:\Windows\System\kVdyDum.exe
  C:\Windows\System\kVdyDum.exe
  2⤵
  PID:7600
- C:\Windows\System\uXIiNXv.exe
  C:\Windows\System\uXIiNXv.exe
  2⤵
  PID:8068
- C:\Windows\System\LSXLvMc.exe
  C:\Windows\System\LSXLvMc.exe
  2⤵
  PID:7952
- C:\Windows\System\OUrycgs.exe
  C:\Windows\System\OUrycgs.exe
  2⤵
  PID:7728
- C:\Windows\System\UKDBxod.exe
  C:\Windows\System\UKDBxod.exe
  2⤵
  PID:8204
- C:\Windows\System\kTswSUL.exe
  C:\Windows\System\kTswSUL.exe
  2⤵
  PID:7688
- C:\Windows\System\hgXavpd.exe
  C:\Windows\System\hgXavpd.exe
  2⤵
  PID:8288
- C:\Windows\System\ORaGdjz.exe
  C:\Windows\System\ORaGdjz.exe
  2⤵
  PID:8316
- C:\Windows\System\GPAnlKh.exe
  C:\Windows\System\GPAnlKh.exe
  2⤵
  PID:8372
- C:\Windows\System\nxzSKBC.exe
  C:\Windows\System\nxzSKBC.exe
  2⤵
  PID:8424
- C:\Windows\System\cAjaNCo.exe
  C:\Windows\System\cAjaNCo.exe
  2⤵
  PID:8472
- C:\Windows\System\wTdrLRq.exe
  C:\Windows\System\wTdrLRq.exe
  2⤵
  PID:8548
- C:\Windows\System\PpfIgmC.exe
  C:\Windows\System\PpfIgmC.exe
  2⤵
  PID:8276
- C:\Windows\System\vTYfEME.exe
  C:\Windows\System\vTYfEME.exe
  2⤵
  PID:8312
- C:\Windows\System\drCrXLL.exe
  C:\Windows\System\drCrXLL.exe
  2⤵
  PID:8712
- C:\Windows\System\dmqsVPp.exe
  C:\Windows\System\dmqsVPp.exe
  2⤵
  PID:8760
- C:\Windows\System\mUrZQmR.exe
  C:\Windows\System\mUrZQmR.exe
  2⤵
  PID:8840
- C:\Windows\System\lIRJIqV.exe
  C:\Windows\System\lIRJIqV.exe
  2⤵
  PID:8892
- C:\Windows\System\rPktNSa.exe
  C:\Windows\System\rPktNSa.exe
  2⤵
  PID:8568
- C:\Windows\System\rAtbGOB.exe
  C:\Windows\System\rAtbGOB.exe
  2⤵
  PID:8604
- C:\Windows\System\iljcrls.exe
  C:\Windows\System\iljcrls.exe
  2⤵
  PID:8676
- C:\Windows\System\iKmnfcg.exe
  C:\Windows\System\iKmnfcg.exe
  2⤵
  PID:9096
- C:\Windows\System\eROwUPg.exe
  C:\Windows\System\eROwUPg.exe
  2⤵
  PID:6548
- C:\Windows\System\fdSwYHg.exe
  C:\Windows\System\fdSwYHg.exe
  2⤵
  PID:7400
- C:\Windows\System\dRRxspc.exe
  C:\Windows\System\dRRxspc.exe
  2⤵
  PID:9000
- C:\Windows\System\sCKFFIv.exe
  C:\Windows\System\sCKFFIv.exe
  2⤵
  PID:8296
- C:\Windows\System\qKcIyke.exe
  C:\Windows\System\qKcIyke.exe
  2⤵
  PID:8440
- C:\Windows\System\kmhkQhP.exe
  C:\Windows\System\kmhkQhP.exe
  2⤵
  PID:9148
- C:\Windows\System\sJFGyGa.exe
  C:\Windows\System\sJFGyGa.exe
  2⤵
  PID:9200
- C:\Windows\System\aRvgUwG.exe
  C:\Windows\System\aRvgUwG.exe
  2⤵
  PID:9224
- C:\Windows\System\wyxNrqJ.exe
  C:\Windows\System\wyxNrqJ.exe
  2⤵
  PID:9244
- C:\Windows\System\GVlDJRH.exe
  C:\Windows\System\GVlDJRH.exe
  2⤵
  PID:9268
- C:\Windows\System\QtcIaSx.exe
  C:\Windows\System\QtcIaSx.exe
  2⤵
  PID:9296
- C:\Windows\System\VpeqnBo.exe
  C:\Windows\System\VpeqnBo.exe
  2⤵
  PID:9320
- C:\Windows\System\OJlnYgl.exe
  C:\Windows\System\OJlnYgl.exe
  2⤵
  PID:9340
- C:\Windows\System\infgLxc.exe
  C:\Windows\System\infgLxc.exe
  2⤵
  PID:9364
- C:\Windows\System\PXsckuo.exe
  C:\Windows\System\PXsckuo.exe
  2⤵
  PID:9392
- C:\Windows\System\kOlZoLt.exe
  C:\Windows\System\kOlZoLt.exe
  2⤵
  PID:9420
- C:\Windows\System\bMzYqxF.exe
  C:\Windows\System\bMzYqxF.exe
  2⤵
  PID:9448
- C:\Windows\System\sqrDwhV.exe
  C:\Windows\System\sqrDwhV.exe
  2⤵
  PID:9468
- C:\Windows\System\hkUGJhd.exe
  C:\Windows\System\hkUGJhd.exe
  2⤵
  PID:9496
- C:\Windows\System\LSZsNrQ.exe
  C:\Windows\System\LSZsNrQ.exe
  2⤵
  PID:9524
- C:\Windows\System\gXIAgIu.exe
  C:\Windows\System\gXIAgIu.exe
  2⤵
  PID:9548
- C:\Windows\System\aiAmYrR.exe
  C:\Windows\System\aiAmYrR.exe
  2⤵
  PID:9576
- C:\Windows\System\fpEcSYX.exe
  C:\Windows\System\fpEcSYX.exe
  2⤵
  PID:9612
- C:\Windows\System\EWheuPx.exe
  C:\Windows\System\EWheuPx.exe
  2⤵
  PID:9636
- C:\Windows\System\mlzNHtk.exe
  C:\Windows\System\mlzNHtk.exe
  2⤵
  PID:9660
- C:\Windows\System\RQEQfkF.exe
  C:\Windows\System\RQEQfkF.exe
  2⤵
  PID:9680
- C:\Windows\System\EpQtCIS.exe
  C:\Windows\System\EpQtCIS.exe
  2⤵
  PID:9708
- C:\Windows\System\fJsFrOT.exe
  C:\Windows\System\fJsFrOT.exe
  2⤵
  PID:9740
- C:\Windows\System\KNMJcsJ.exe
  C:\Windows\System\KNMJcsJ.exe
  2⤵
  PID:9768
- C:\Windows\System\SuYcavI.exe
  C:\Windows\System\SuYcavI.exe
  2⤵
  PID:9800
- C:\Windows\System\HWFZLLD.exe
  C:\Windows\System\HWFZLLD.exe
  2⤵
  PID:9828
- C:\Windows\System\fLheItb.exe
  C:\Windows\System\fLheItb.exe
  2⤵
  PID:9852
- C:\Windows\System\PEFxADW.exe
  C:\Windows\System\PEFxADW.exe
  2⤵
  PID:9872
- C:\Windows\System\AIhhEjQ.exe
  C:\Windows\System\AIhhEjQ.exe
  2⤵
  PID:9912
- C:\Windows\System\ARmvxPA.exe
  C:\Windows\System\ARmvxPA.exe
  2⤵
  PID:9936
- C:\Windows\System\FdJoDJd.exe
  C:\Windows\System\FdJoDJd.exe
  2⤵
  PID:9964
- C:\Windows\System\UYluMgn.exe
  C:\Windows\System\UYluMgn.exe
  2⤵
  PID:9992
- C:\Windows\System\TnNRilz.exe
  C:\Windows\System\TnNRilz.exe
  2⤵
  PID:10020
- C:\Windows\System\onEuJAX.exe
  C:\Windows\System\onEuJAX.exe
  2⤵
  PID:10044
- C:\Windows\System\BBnPJnC.exe
  C:\Windows\System\BBnPJnC.exe
  2⤵
  PID:10072
- C:\Windows\System\HhQdDuD.exe
  C:\Windows\System\HhQdDuD.exe
  2⤵
  PID:10096
- C:\Windows\System\JrAlPXY.exe
  C:\Windows\System\JrAlPXY.exe
  2⤵
  PID:10120
- C:\Windows\System\eVEzNbM.exe
  C:\Windows\System\eVEzNbM.exe
  2⤵
  PID:10148
- C:\Windows\System\gBkzjgP.exe
  C:\Windows\System\gBkzjgP.exe
  2⤵
  PID:10176
- C:\Windows\System\QlHTcFg.exe
  C:\Windows\System\QlHTcFg.exe
  2⤵
  PID:10204
- C:\Windows\System\ffEvOsY.exe
  C:\Windows\System\ffEvOsY.exe
  2⤵
  PID:10232
- C:\Windows\System\olIPxlQ.exe
  C:\Windows\System\olIPxlQ.exe
  2⤵
  PID:8972
- C:\Windows\System\QenGVTS.exe
  C:\Windows\System\QenGVTS.exe
  2⤵
  PID:8292
- C:\Windows\System\ejnMdQN.exe
  C:\Windows\System\ejnMdQN.exe
  2⤵
  PID:7828
- C:\Windows\System\AqqyzWc.exe
  C:\Windows\System\AqqyzWc.exe
  2⤵
  PID:8484
- C:\Windows\System\aMmPBKi.exe
  C:\Windows\System\aMmPBKi.exe
  2⤵
  PID:8828
- C:\Windows\System\HqRlsRS.exe
  C:\Windows\System\HqRlsRS.exe
  2⤵
  PID:8224
- C:\Windows\System\GqkBRai.exe
  C:\Windows\System\GqkBRai.exe
  2⤵
  PID:9336
- C:\Windows\System\JYcQrAQ.exe
  C:\Windows\System\JYcQrAQ.exe
  2⤵
  PID:7440
- C:\Windows\System\HyJJGxG.exe
  C:\Windows\System\HyJJGxG.exe
  2⤵
  PID:9544
- C:\Windows\System\yzInIYj.exe
  C:\Windows\System\yzInIYj.exe
  2⤵
  PID:9604
- C:\Windows\System\pmjiRCz.exe
  C:\Windows\System\pmjiRCz.exe
  2⤵
  PID:8640
- C:\Windows\System\CFaFMcp.exe
  C:\Windows\System\CFaFMcp.exe
  2⤵
  PID:8684
- C:\Windows\System\GFIHyah.exe
  C:\Windows\System\GFIHyah.exe
  2⤵
  PID:9252
- C:\Windows\System\TlugCOM.exe
  C:\Windows\System\TlugCOM.exe
  2⤵
  PID:9816
- C:\Windows\System\LTKEjrX.exe
  C:\Windows\System\LTKEjrX.exe
  2⤵
  PID:8624
- C:\Windows\System\ImyvbGx.exe
  C:\Windows\System\ImyvbGx.exe
  2⤵
  PID:9928
- C:\Windows\System\dJEQaDW.exe
  C:\Windows\System\dJEQaDW.exe
  2⤵
  PID:10004
- C:\Windows\System\sTHqXZg.exe
  C:\Windows\System\sTHqXZg.exe
  2⤵
  PID:7308
- C:\Windows\System\OuKksdp.exe
  C:\Windows\System\OuKksdp.exe
  2⤵
  PID:9536
- C:\Windows\System\JgkqOhd.exe
  C:\Windows\System\JgkqOhd.exe
  2⤵
  PID:10160
- C:\Windows\System\PAvEVlq.exe
  C:\Windows\System\PAvEVlq.exe
  2⤵
  PID:9672
- C:\Windows\System\JRqmfjQ.exe
  C:\Windows\System\JRqmfjQ.exe
  2⤵
  PID:10248
- C:\Windows\System\SsqdRTj.exe
  C:\Windows\System\SsqdRTj.exe
  2⤵
  PID:10292
- C:\Windows\System\sDrIJzE.exe
  C:\Windows\System\sDrIJzE.exe
  2⤵
  PID:10312
- C:\Windows\System\VEIhUYl.exe
  C:\Windows\System\VEIhUYl.exe
  2⤵
  PID:10328
- C:\Windows\System\NwXSyzo.exe
  C:\Windows\System\NwXSyzo.exe
  2⤵
  PID:10348
- C:\Windows\System\PisxCzl.exe
  C:\Windows\System\PisxCzl.exe
  2⤵
  PID:10368
- C:\Windows\System\KpZiSYS.exe
  C:\Windows\System\KpZiSYS.exe
  2⤵
  PID:10392
- C:\Windows\System\VONlDGU.exe
  C:\Windows\System\VONlDGU.exe
  2⤵
  PID:10412
- C:\Windows\System\SHKBuaI.exe
  C:\Windows\System\SHKBuaI.exe
  2⤵
  PID:10436
- C:\Windows\System\qDwsZPq.exe
  C:\Windows\System\qDwsZPq.exe
  2⤵
  PID:10464
- C:\Windows\System\NPuBEgY.exe
  C:\Windows\System\NPuBEgY.exe
  2⤵
  PID:10488
- C:\Windows\System\IjXWTgi.exe
  C:\Windows\System\IjXWTgi.exe
  2⤵
  PID:10512
- C:\Windows\System\xryTmYn.exe
  C:\Windows\System\xryTmYn.exe
  2⤵
  PID:10540
- C:\Windows\System\RyvEaAS.exe
  C:\Windows\System\RyvEaAS.exe
  2⤵
  PID:10556
- C:\Windows\System\hyzhuwj.exe
  C:\Windows\System\hyzhuwj.exe
  2⤵
  PID:10584
- C:\Windows\System\wZXVFBo.exe
  C:\Windows\System\wZXVFBo.exe
  2⤵
  PID:10608
- C:\Windows\System\gPVnVFv.exe
  C:\Windows\System\gPVnVFv.exe
  2⤵
  PID:10628
- C:\Windows\System\guXauJy.exe
  C:\Windows\System\guXauJy.exe
  2⤵
  PID:10656
- C:\Windows\System\InwOErB.exe
  C:\Windows\System\InwOErB.exe
  2⤵
  PID:10688
- C:\Windows\System\TJuqVXr.exe
  C:\Windows\System\TJuqVXr.exe
  2⤵
  PID:10708
- C:\Windows\System\ThScLoa.exe
  C:\Windows\System\ThScLoa.exe
  2⤵
  PID:10732
- C:\Windows\System\cyLtlij.exe
  C:\Windows\System\cyLtlij.exe
  2⤵
  PID:10760
- C:\Windows\System\rLBRYTY.exe
  C:\Windows\System\rLBRYTY.exe
  2⤵
  PID:10788
- C:\Windows\System\jcQQfDV.exe
  C:\Windows\System\jcQQfDV.exe
  2⤵
  PID:10812
- C:\Windows\System\phtaRCm.exe
  C:\Windows\System\phtaRCm.exe
  2⤵
  PID:10836
- C:\Windows\System\FjKyihL.exe
  C:\Windows\System\FjKyihL.exe
  2⤵
  PID:10856
- C:\Windows\System\pyLEtCf.exe
  C:\Windows\System\pyLEtCf.exe
  2⤵
  PID:10880
- C:\Windows\System\MiAkwLI.exe
  C:\Windows\System\MiAkwLI.exe
  2⤵
  PID:10904
- C:\Windows\System\bCokrZS.exe
  C:\Windows\System\bCokrZS.exe
  2⤵
  PID:10928
- C:\Windows\System\nuxkBuN.exe
  C:\Windows\System\nuxkBuN.exe
  2⤵
  PID:10952
- C:\Windows\System\VyqkNBF.exe
  C:\Windows\System\VyqkNBF.exe
  2⤵
  PID:10980
- C:\Windows\System\yIAkDPc.exe
  C:\Windows\System\yIAkDPc.exe
  2⤵
  PID:11008
- C:\Windows\System\ICahrPl.exe
  C:\Windows\System\ICahrPl.exe
  2⤵
  PID:11032
- C:\Windows\System\peJnOBf.exe
  C:\Windows\System\peJnOBf.exe
  2⤵
  PID:11056
- C:\Windows\System\HUgTcMR.exe
  C:\Windows\System\HUgTcMR.exe
  2⤵
  PID:11080
- C:\Windows\System\AhqyrFz.exe
  C:\Windows\System\AhqyrFz.exe
  2⤵
  PID:11108
- C:\Windows\System\kHXjkTR.exe
  C:\Windows\System\kHXjkTR.exe
  2⤵
  PID:11128
- C:\Windows\System\zgVRNCj.exe
  C:\Windows\System\zgVRNCj.exe
  2⤵
  PID:11156
- C:\Windows\System\KopSOPx.exe
  C:\Windows\System\KopSOPx.exe
  2⤵
  PID:11180
- C:\Windows\System\FDQsYfS.exe
  C:\Windows\System\FDQsYfS.exe
  2⤵
  PID:11208
- C:\Windows\System\QdLEaxX.exe
  C:\Windows\System\QdLEaxX.exe
  2⤵
  PID:11232
- C:\Windows\System\TKSBUQG.exe
  C:\Windows\System\TKSBUQG.exe
  2⤵
  PID:11260
- C:\Windows\System\ktJoiNc.exe
  C:\Windows\System\ktJoiNc.exe
  2⤵
  PID:8576
- C:\Windows\System\aJRFuUd.exe
  C:\Windows\System\aJRFuUd.exe
  2⤵
  PID:9360
- C:\Windows\System\wxDInvA.exe
  C:\Windows\System\wxDInvA.exe
  2⤵
  PID:9960
- C:\Windows\System\PxobmRb.exe
  C:\Windows\System\PxobmRb.exe
  2⤵
  PID:9980
- C:\Windows\System\ntGxtFf.exe
  C:\Windows\System\ntGxtFf.exe
  2⤵
  PID:9480
- C:\Windows\System\tEGAafu.exe
  C:\Windows\System\tEGAafu.exe
  2⤵
  PID:9072
- C:\Windows\System\WsCjugQ.exe
  C:\Windows\System\WsCjugQ.exe
  2⤵
  PID:9196
- C:\Windows\System\XmYHUto.exe
  C:\Windows\System\XmYHUto.exe
  2⤵
  PID:9624
- C:\Windows\System\ymUSQlN.exe
  C:\Windows\System\ymUSQlN.exe
  2⤵
  PID:8524
- C:\Windows\System\ilOclnP.exe
  C:\Windows\System\ilOclnP.exe
  2⤵
  PID:10244
- C:\Windows\System\yyGrHmq.exe
  C:\Windows\System\yyGrHmq.exe
  2⤵
  PID:9776
- C:\Windows\System\mQVmqSZ.exe
  C:\Windows\System\mQVmqSZ.exe
  2⤵
  PID:9128
- C:\Windows\System\ZBZiPRq.exe
  C:\Windows\System\ZBZiPRq.exe
  2⤵
  PID:9864
- C:\Windows\System\jOvimQb.exe
  C:\Windows\System\jOvimQb.exe
  2⤵
  PID:9924
- C:\Windows\System\gUNqYCw.exe
  C:\Windows\System\gUNqYCw.exe
  2⤵
  PID:9400
- C:\Windows\System\dcHrZLq.exe
  C:\Windows\System\dcHrZLq.exe
  2⤵
  PID:8888
- C:\Windows\System\hIUDNcD.exe
  C:\Windows\System\hIUDNcD.exe
  2⤵
  PID:10052
- C:\Windows\System\nqIdZpZ.exe
  C:\Windows\System\nqIdZpZ.exe
  2⤵
  PID:10684
- C:\Windows\System\pwtBhQG.exe
  C:\Windows\System\pwtBhQG.exe
  2⤵
  PID:10748
- C:\Windows\System\DMqZGBG.exe
  C:\Windows\System\DMqZGBG.exe
  2⤵
  PID:10820
- C:\Windows\System\NJQbTHL.exe
  C:\Windows\System\NJQbTHL.exe
  2⤵
  PID:11296
- C:\Windows\System\NgFTMto.exe
  C:\Windows\System\NgFTMto.exe
  2⤵
  PID:11348
- C:\Windows\System\pnVLtDC.exe
  C:\Windows\System\pnVLtDC.exe
  2⤵
  PID:11364
- C:\Windows\System\lTRWhHZ.exe
  C:\Windows\System\lTRWhHZ.exe
  2⤵
  PID:11380
- C:\Windows\System\JLHoknL.exe
  C:\Windows\System\JLHoknL.exe
  2⤵
  PID:11408
- C:\Windows\System\MJeSuix.exe
  C:\Windows\System\MJeSuix.exe
  2⤵
  PID:11428
- C:\Windows\System\XWQwuwN.exe
  C:\Windows\System\XWQwuwN.exe
  2⤵
  PID:11444
- C:\Windows\System\NGkiIqJ.exe
  C:\Windows\System\NGkiIqJ.exe
  2⤵
  PID:11468
- C:\Windows\System\tiEanLt.exe
  C:\Windows\System\tiEanLt.exe
  2⤵
  PID:11500
- C:\Windows\System\yygfltB.exe
  C:\Windows\System\yygfltB.exe
  2⤵
  PID:11532
- C:\Windows\System\CuQHpTV.exe
  C:\Windows\System\CuQHpTV.exe
  2⤵
  PID:11564
- C:\Windows\System\wqrEirk.exe
  C:\Windows\System\wqrEirk.exe
  2⤵
  PID:11596
- C:\Windows\System\UbOffEc.exe
  C:\Windows\System\UbOffEc.exe
  2⤵
  PID:11636
- C:\Windows\System\HDFviGN.exe
  C:\Windows\System\HDFviGN.exe
  2⤵
  PID:11664
- C:\Windows\System\nHdFvQM.exe
  C:\Windows\System\nHdFvQM.exe
  2⤵
  PID:11708
- C:\Windows\System\eMJhIWv.exe
  C:\Windows\System\eMJhIWv.exe
  2⤵
  PID:11768
- C:\Windows\System\fjudQna.exe
  C:\Windows\System\fjudQna.exe
  2⤵
  PID:11796
- C:\Windows\System\sVbMAkm.exe
  C:\Windows\System\sVbMAkm.exe
  2⤵
  PID:11816
- C:\Windows\System\UGcQhSw.exe
  C:\Windows\System\UGcQhSw.exe
  2⤵
  PID:11832
- C:\Windows\System\VPhnQmj.exe
  C:\Windows\System\VPhnQmj.exe
  2⤵
  PID:11900
- C:\Windows\System\BgYqvYk.exe
  C:\Windows\System\BgYqvYk.exe
  2⤵
  PID:11928
- C:\Windows\System\xGHHLeQ.exe
  C:\Windows\System\xGHHLeQ.exe
  2⤵
  PID:11948
- C:\Windows\System\KUUPPyX.exe
  C:\Windows\System\KUUPPyX.exe
  2⤵
  PID:11972
- C:\Windows\System\edLFYqe.exe
  C:\Windows\System\edLFYqe.exe
  2⤵
  PID:11996
- C:\Windows\System\TQCsZCg.exe
  C:\Windows\System\TQCsZCg.exe
  2⤵
  PID:12028
- C:\Windows\System\uHtbnAA.exe
  C:\Windows\System\uHtbnAA.exe
  2⤵
  PID:12056
- C:\Windows\System\xKQxCyq.exe
  C:\Windows\System\xKQxCyq.exe
  2⤵
  PID:12076
- C:\Windows\System\GHPGAdW.exe
  C:\Windows\System\GHPGAdW.exe
  2⤵
  PID:12112
- C:\Windows\System\AiHALCZ.exe
  C:\Windows\System\AiHALCZ.exe
  2⤵
  PID:12144
- C:\Windows\System\qtJZJzh.exe
  C:\Windows\System\qtJZJzh.exe
  2⤵
  PID:12180
- C:\Windows\System\HsFcsXU.exe
  C:\Windows\System\HsFcsXU.exe
  2⤵
  PID:12200
- C:\Windows\System\gnGHgbD.exe
  C:\Windows\System\gnGHgbD.exe
  2⤵
  PID:12216
- C:\Windows\System\QqGiKLr.exe
  C:\Windows\System\QqGiKLr.exe
  2⤵
  PID:12232
- C:\Windows\System\lnzBbsn.exe
  C:\Windows\System\lnzBbsn.exe
  2⤵
  PID:12248
- C:\Windows\System\NIPJokN.exe
  C:\Windows\System\NIPJokN.exe
  2⤵
  PID:12272
- C:\Windows\System\FHRGEvc.exe
  C:\Windows\System\FHRGEvc.exe
  2⤵
  PID:11204
- C:\Windows\System\UMACEpa.exe
  C:\Windows\System\UMACEpa.exe
  2⤵
  PID:11172
- C:\Windows\System\iMLwlPb.exe
  C:\Windows\System\iMLwlPb.exe
  2⤵
  PID:11400
- C:\Windows\System\uRVQCJP.exe
  C:\Windows\System\uRVQCJP.exe
  2⤵
  PID:10456
- C:\Windows\System\zuwLCAq.exe
  C:\Windows\System\zuwLCAq.exe
  2⤵
  PID:11788
- C:\Windows\System\KqpipYf.exe
  C:\Windows\System\KqpipYf.exe
  2⤵
  PID:11548
- C:\Windows\System\TKqyuEH.exe
  C:\Windows\System\TKqyuEH.exe
  2⤵
  PID:11376
- C:\Windows\System\rrlOBWk.exe
  C:\Windows\System\rrlOBWk.exe
  2⤵
  PID:11464
- C:\Windows\System\pgPPeEM.exe
  C:\Windows\System\pgPPeEM.exe
  2⤵
  PID:11868
- C:\Windows\System\NSoekkz.exe
  C:\Windows\System\NSoekkz.exe
  2⤵
  PID:11624
- C:\Windows\System\vqIUXIT.exe
  C:\Windows\System\vqIUXIT.exe
  2⤵
  PID:11656
- C:\Windows\System\rrgezWl.exe
  C:\Windows\System\rrgezWl.exe
  2⤵
  PID:10288
- C:\Windows\System\hXXSYPB.exe
  C:\Windows\System\hXXSYPB.exe
  2⤵
  PID:9884
- C:\Windows\System\dRsjfAK.exe
  C:\Windows\System\dRsjfAK.exe
  2⤵
  PID:11716
- C:\Windows\System\IEOBOea.exe
  C:\Windows\System\IEOBOea.exe
  2⤵
  PID:8968
- C:\Windows\System\GfSDAXb.exe
  C:\Windows\System\GfSDAXb.exe
  2⤵
  PID:11888
- C:\Windows\System\SUwDsQv.exe
  C:\Windows\System\SUwDsQv.exe
  2⤵
  PID:11372
- C:\Windows\System\QKVJYfu.exe
  C:\Windows\System\QKVJYfu.exe
  2⤵
  PID:11440
- C:\Windows\System\fhDCwWw.exe
  C:\Windows\System\fhDCwWw.exe
  2⤵
  PID:12156
- C:\Windows\System\ppxUwdQ.exe
  C:\Windows\System\ppxUwdQ.exe
  2⤵
  PID:11508
- C:\Windows\System\CCtnhJb.exe
  C:\Windows\System\CCtnhJb.exe
  2⤵
  PID:12212
- C:\Windows\System\WKjsGxJ.exe
  C:\Windows\System\WKjsGxJ.exe
  2⤵
  PID:12268
- C:\Windows\System\UOGNJAR.exe
  C:\Windows\System\UOGNJAR.exe
  2⤵
  PID:11660
- C:\Windows\System\ogAyFqc.exe
  C:\Windows\System\ogAyFqc.exe
  2⤵
  PID:11840
- C:\Windows\System\NmETHXa.exe
  C:\Windows\System\NmETHXa.exe
  2⤵
  PID:12308
- C:\Windows\System\WeCQiPh.exe
  C:\Windows\System\WeCQiPh.exe
  2⤵
  PID:12332
- C:\Windows\System\rRkewDh.exe
  C:\Windows\System\rRkewDh.exe
  2⤵
  PID:12356
- C:\Windows\System\TAsFJlI.exe
  C:\Windows\System\TAsFJlI.exe
  2⤵
  PID:12380
- C:\Windows\System\DNAaOfF.exe
  C:\Windows\System\DNAaOfF.exe
  2⤵
  PID:12404
- C:\Windows\System\roTOcRu.exe
  C:\Windows\System\roTOcRu.exe
  2⤵
  PID:12420
- C:\Windows\System\grtLZIl.exe
  C:\Windows\System\grtLZIl.exe
  2⤵
  PID:12440
- C:\Windows\System\QeDOvFV.exe
  C:\Windows\System\QeDOvFV.exe
  2⤵
  PID:12460
- C:\Windows\System\psSUlFt.exe
  C:\Windows\System\psSUlFt.exe
  2⤵
  PID:12484
- C:\Windows\System\FmvBxhd.exe
  C:\Windows\System\FmvBxhd.exe
  2⤵
  PID:12508
- C:\Windows\System\tvTxTvG.exe
  C:\Windows\System\tvTxTvG.exe
  2⤵
  PID:12524
- C:\Windows\System\CUurEeB.exe
  C:\Windows\System\CUurEeB.exe
  2⤵
  PID:12552
- C:\Windows\System\zymUHHP.exe
  C:\Windows\System\zymUHHP.exe
  2⤵
  PID:12576
- C:\Windows\System\ySeuoVW.exe
  C:\Windows\System\ySeuoVW.exe
  2⤵
  PID:12596
- C:\Windows\System\CqkSapK.exe
  C:\Windows\System\CqkSapK.exe
  2⤵
  PID:12624
- C:\Windows\System\gKyHcTH.exe
  C:\Windows\System\gKyHcTH.exe
  2⤵
  PID:12644
- C:\Windows\System\RzImHGL.exe
  C:\Windows\System\RzImHGL.exe
  2⤵
  PID:12672
- C:\Windows\System\TKbJgOu.exe
  C:\Windows\System\TKbJgOu.exe
  2⤵
  PID:12688
- C:\Windows\System\VmyiRfO.exe
  C:\Windows\System\VmyiRfO.exe
  2⤵
  PID:12712
- C:\Windows\System\tXgoeJx.exe
  C:\Windows\System\tXgoeJx.exe
  2⤵
  PID:12740
- C:\Windows\System\kiYCgRy.exe
  C:\Windows\System\kiYCgRy.exe
  2⤵
  PID:12756
- C:\Windows\System\sDIoedS.exe
  C:\Windows\System\sDIoedS.exe
  2⤵
  PID:12784
- C:\Windows\System\jdbstce.exe
  C:\Windows\System\jdbstce.exe
  2⤵
  PID:12804
- C:\Windows\System\FjucqiN.exe
  C:\Windows\System\FjucqiN.exe
  2⤵
  PID:12828
- C:\Windows\System\FGeHeTZ.exe
  C:\Windows\System\FGeHeTZ.exe
  2⤵
  PID:12852
- C:\Windows\System\DJCbILD.exe
  C:\Windows\System\DJCbILD.exe
  2⤵
  PID:12876
- C:\Windows\System\QRmCSca.exe
  C:\Windows\System\QRmCSca.exe
  2⤵
  PID:12900
- C:\Windows\System\enoiZWv.exe
  C:\Windows\System\enoiZWv.exe
  2⤵
  PID:12924
- C:\Windows\System\oJFKunb.exe
  C:\Windows\System\oJFKunb.exe
  2⤵
  PID:12952
- C:\Windows\System\unOOywd.exe
  C:\Windows\System\unOOywd.exe
  2⤵
  PID:12972
- C:\Windows\System\IBnuEiB.exe
  C:\Windows\System\IBnuEiB.exe
  2⤵
  PID:13000
- C:\Windows\System\ztvvFJP.exe
  C:\Windows\System\ztvvFJP.exe
  2⤵
  PID:13020
- C:\Windows\System\ZFncWJa.exe
  C:\Windows\System\ZFncWJa.exe
  2⤵
  PID:13048
- C:\Windows\System\othGjsz.exe
  C:\Windows\System\othGjsz.exe
  2⤵
  PID:13068
- C:\Windows\System\rsqNuuY.exe
  C:\Windows\System\rsqNuuY.exe
  2⤵
  PID:13092
- C:\Windows\System\DKjYwSV.exe
  C:\Windows\System\DKjYwSV.exe
  2⤵
  PID:13112
- C:\Windows\System\kUcahVc.exe
  C:\Windows\System\kUcahVc.exe
  2⤵
  PID:13128
- C:\Windows\System\ZghDcVS.exe
  C:\Windows\System\ZghDcVS.exe
  2⤵
  PID:13156
- C:\Windows\System\vSrbiYW.exe
  C:\Windows\System\vSrbiYW.exe
  2⤵
  PID:13176
- C:\Windows\System\ocSHIoT.exe
  C:\Windows\System\ocSHIoT.exe
  2⤵
  PID:13200
- C:\Windows\System\mZckqXW.exe
  C:\Windows\System\mZckqXW.exe
  2⤵
  PID:13228
- C:\Windows\System\UbctrzS.exe
  C:\Windows\System\UbctrzS.exe
  2⤵
  PID:13244
- C:\Windows\System\eGwxWoV.exe
  C:\Windows\System\eGwxWoV.exe
  2⤵
  PID:13272
- C:\Windows\System\FfcVNId.exe
  C:\Windows\System\FfcVNId.exe
  2⤵
  PID:13300
- C:\Windows\System\QvlloTg.exe
  C:\Windows\System\QvlloTg.exe
  2⤵
  PID:11824
- C:\Windows\System\IeJdIIW.exe
  C:\Windows\System\IeJdIIW.exe
  2⤵
  PID:10852
- C:\Windows\System\qEolmfU.exe
  C:\Windows\System\qEolmfU.exe
  2⤵
  PID:12044
- C:\Windows\System\QLLAUqX.exe
  C:\Windows\System\QLLAUqX.exe
  2⤵
  PID:12088
- C:\Windows\System\UIQunvI.exe
  C:\Windows\System\UIQunvI.exe
  2⤵
  PID:9948
- C:\Windows\System\DLfoYxB.exe
  C:\Windows\System\DLfoYxB.exe
  2⤵
  PID:12224
- C:\Windows\System\NKbfYnW.exe
  C:\Windows\System\NKbfYnW.exe
  2⤵
  PID:11484
- C:\Windows\System\XJKSdVJ.exe
  C:\Windows\System\XJKSdVJ.exe
  2⤵
  PID:11512
- C:\Windows\System\HtSOlbO.exe
  C:\Windows\System\HtSOlbO.exe
  2⤵
  PID:11732
- C:\Windows\System\VTejymv.exe
  C:\Windows\System\VTejymv.exe
  2⤵
  PID:11456
- C:\Windows\System\wIDAgTY.exe
  C:\Windows\System\wIDAgTY.exe
  2⤵
  PID:11936
- C:\Windows\System\pduKuVf.exe
  C:\Windows\System\pduKuVf.exe
  2⤵
  PID:11988
- C:\Windows\System\zrCacXw.exe
  C:\Windows\System\zrCacXw.exe
  2⤵
  PID:9380
- C:\Windows\System\SjfIqLu.exe
  C:\Windows\System\SjfIqLu.exe
  2⤵
  PID:11144
- C:\Windows\System\SaCrzET.exe
  C:\Windows\System\SaCrzET.exe
  2⤵
  PID:12572
- C:\Windows\System\BvBBbKa.exe
  C:\Windows\System\BvBBbKa.exe
  2⤵
  PID:12172
- C:\Windows\System\GLNIFkY.exe
  C:\Windows\System\GLNIFkY.exe
  2⤵
  PID:9540
- C:\Windows\System\OipihdQ.exe
  C:\Windows\System\OipihdQ.exe
  2⤵
  PID:12284
- C:\Windows\System\QKntFFe.exe
  C:\Windows\System\QKntFFe.exe
  2⤵
  PID:11784
- C:\Windows\System\dOLRoRW.exe
  C:\Windows\System\dOLRoRW.exe
  2⤵
  PID:12892
- C:\Windows\System\baYHVTz.exe
  C:\Windows\System\baYHVTz.exe
  2⤵
  PID:12940
- C:\Windows\System\UbKmxsW.exe
  C:\Windows\System\UbKmxsW.exe
  2⤵
  PID:11676
- C:\Windows\System\leiNTou.exe
  C:\Windows\System\leiNTou.exe
  2⤵
  PID:12564
- C:\Windows\System\NztxYvN.exe
  C:\Windows\System\NztxYvN.exe
  2⤵
  PID:13320
- C:\Windows\System\Qdfgpmg.exe
  C:\Windows\System\Qdfgpmg.exe
  2⤵
  PID:13348
- C:\Windows\System\vBOcFqa.exe
  C:\Windows\System\vBOcFqa.exe
  2⤵
  PID:13376
- C:\Windows\System\GVpPFgV.exe
  C:\Windows\System\GVpPFgV.exe
  2⤵
  PID:13412
- C:\Windows\System\ovUUKgy.exe
  C:\Windows\System\ovUUKgy.exe
  2⤵
  PID:13436
- C:\Windows\System\QXCqBMK.exe
  C:\Windows\System\QXCqBMK.exe
  2⤵
  PID:13460
- C:\Windows\System\iewSNAP.exe
  C:\Windows\System\iewSNAP.exe
  2⤵
  PID:13484
- C:\Windows\System\xbfMxgo.exe
  C:\Windows\System\xbfMxgo.exe
  2⤵
  PID:13516
- C:\Windows\System\ItqPVbA.exe
  C:\Windows\System\ItqPVbA.exe
  2⤵
  PID:13540
- C:\Windows\System\FFpmUZp.exe
  C:\Windows\System\FFpmUZp.exe
  2⤵
  PID:13560
- C:\Windows\System\RezgRjY.exe
  C:\Windows\System\RezgRjY.exe
  2⤵
  PID:13584
- C:\Windows\System\DORxdid.exe
  C:\Windows\System\DORxdid.exe
  2⤵
  PID:13608
- C:\Windows\System\LAbSzXq.exe
  C:\Windows\System\LAbSzXq.exe
  2⤵
  PID:13640
- C:\Windows\System\zOETkdX.exe
  C:\Windows\System\zOETkdX.exe
  2⤵
  PID:13668
- C:\Windows\System\PxNUQNk.exe
  C:\Windows\System\PxNUQNk.exe
  2⤵
  PID:13688
- C:\Windows\System\EaywsMz.exe
  C:\Windows\System\EaywsMz.exe
  2⤵
  PID:13708
- C:\Windows\System\XzxjvTg.exe
  C:\Windows\System\XzxjvTg.exe
  2⤵
  PID:13736
- C:\Windows\System\BIEdNKE.exe
  C:\Windows\System\BIEdNKE.exe
  2⤵
  PID:13764
- C:\Windows\System\PfFWpPY.exe
  C:\Windows\System\PfFWpPY.exe
  2⤵
  PID:13792
- C:\Windows\System\bVFEQNS.exe
  C:\Windows\System\bVFEQNS.exe
  2⤵
  PID:13812
- C:\Windows\System\lJrWmvo.exe
  C:\Windows\System\lJrWmvo.exe
  2⤵
  PID:13840
- C:\Windows\System\MSuBUww.exe
  C:\Windows\System\MSuBUww.exe
  2⤵
  PID:13864
- C:\Windows\System\NlkIbcQ.exe
  C:\Windows\System\NlkIbcQ.exe
  2⤵
  PID:13884
- C:\Windows\System\qxVYBhO.exe
  C:\Windows\System\qxVYBhO.exe
  2⤵
  PID:13912
- C:\Windows\System\SFgmlEJ.exe
  C:\Windows\System\SFgmlEJ.exe
  2⤵
  PID:13928
- C:\Windows\System\joEIaFk.exe
  C:\Windows\System\joEIaFk.exe
  2⤵
  PID:13960
- C:\Windows\System\ubhvDOj.exe
  C:\Windows\System\ubhvDOj.exe
  2⤵
  PID:13992
- C:\Windows\System\vuvjPGN.exe
  C:\Windows\System\vuvjPGN.exe
  2⤵
  PID:14020
- C:\Windows\System\cCwLPYW.exe
  C:\Windows\System\cCwLPYW.exe
  2⤵
  PID:14044
- C:\Windows\System\ugCtYxU.exe
  C:\Windows\System\ugCtYxU.exe
  2⤵
  PID:14068
- C:\Windows\System\DEXQdQL.exe
  C:\Windows\System\DEXQdQL.exe
  2⤵
  PID:14092
- C:\Windows\System\mqOHjxo.exe
  C:\Windows\System\mqOHjxo.exe
  2⤵
  PID:14120
- C:\Windows\System\PEWZdTa.exe
  C:\Windows\System\PEWZdTa.exe
  2⤵
  PID:14140
- C:\Windows\System\dQQHJRc.exe
  C:\Windows\System\dQQHJRc.exe
  2⤵
  PID:14160
- C:\Windows\System\lvfWdCH.exe
  C:\Windows\System\lvfWdCH.exe
  2⤵
  PID:14184
- C:\Windows\System\Cswyqpz.exe
  C:\Windows\System\Cswyqpz.exe
  2⤵
  PID:14208
- C:\Windows\System\KCpkoAW.exe
  C:\Windows\System\KCpkoAW.exe
  2⤵
  PID:14236
- C:\Windows\System\KMdZwQJ.exe
  C:\Windows\System\KMdZwQJ.exe
  2⤵
  PID:14256
- C:\Windows\System\NuOMjAB.exe
  C:\Windows\System\NuOMjAB.exe
  2⤵
  PID:14284
- C:\Windows\System\ptPBEEb.exe
  C:\Windows\System\ptPBEEb.exe
  2⤵
  PID:14308
- C:\Windows\System\QMcbXtt.exe
  C:\Windows\System\QMcbXtt.exe
  2⤵
  PID:14332
- C:\Windows\System\oYWsAgu.exe
  C:\Windows\System\oYWsAgu.exe
  2⤵
  PID:13284
- C:\Windows\System\grQvTET.exe
  C:\Windows\System\grQvTET.exe
  2⤵
  PID:12004
- C:\Windows\System\VFwdcfz.exe
  C:\Windows\System\VFwdcfz.exe
  2⤵
  PID:10136
- C:\Windows\System\KIPAbyf.exe
  C:\Windows\System\KIPAbyf.exe
  2⤵
  PID:12820
- C:\Windows\System\ShMZwZs.exe
  C:\Windows\System\ShMZwZs.exe
  2⤵
  PID:11496
- C:\Windows\System\wMIHjPe.exe
  C:\Windows\System\wMIHjPe.exe
  2⤵
  PID:11924
- C:\Windows\System\WHVghGi.exe
  C:\Windows\System\WHVghGi.exe
  2⤵
  PID:12428
- C:\Windows\System\rSVhlHs.exe
  C:\Windows\System\rSVhlHs.exe
  2⤵
  PID:13028
- C:\Windows\System\kmDyIJy.exe
  C:\Windows\System\kmDyIJy.exe
  2⤵
  PID:13040
- C:\Windows\System\zXnuIcp.exe
  C:\Windows\System\zXnuIcp.exe
  2⤵
  PID:11524
- C:\Windows\System\EPCqolh.exe
  C:\Windows\System\EPCqolh.exe
  2⤵
  PID:12388
- C:\Windows\System\CEowlvE.exe
  C:\Windows\System\CEowlvE.exe
  2⤵
  PID:13168
- C:\Windows\System\yMscYZR.exe
  C:\Windows\System\yMscYZR.exe
  2⤵
  PID:13364
- C:\Windows\System\XzGYqRZ.exe
  C:\Windows\System\XzGYqRZ.exe
  2⤵
  PID:12728
- C:\Windows\System\beMeWtr.exe
  C:\Windows\System\beMeWtr.exe
  2⤵
  PID:13500
- C:\Windows\System\RJmYocy.exe
  C:\Windows\System\RJmYocy.exe
  2⤵
  PID:13548
- C:\Windows\System\fAzqgqI.exe
  C:\Windows\System\fAzqgqI.exe
  2⤵
  PID:13576
- C:\Windows\System\DrVaEFN.exe
  C:\Windows\System\DrVaEFN.exe
  2⤵
  PID:13720
- C:\Windows\System\RaVawUG.exe
  C:\Windows\System\RaVawUG.exe
  2⤵
  PID:13012
- C:\Windows\System\EFszKkV.exe
  C:\Windows\System\EFszKkV.exe
  2⤵
  PID:14344
- C:\Windows\System\LYmxDvh.exe
  C:\Windows\System\LYmxDvh.exe
  2⤵
  PID:14368
- C:\Windows\System\hMfUOni.exe
  C:\Windows\System\hMfUOni.exe
  2⤵
  PID:14388
- C:\Windows\System\dIUfaJN.exe
  C:\Windows\System\dIUfaJN.exe
  2⤵
  PID:14408
- C:\Windows\System\LfeOkHt.exe
  C:\Windows\System\LfeOkHt.exe
  2⤵
  PID:14424
- C:\Windows\System\tpLXRTG.exe
  C:\Windows\System\tpLXRTG.exe
  2⤵
  PID:14444
- C:\Windows\System\SLzJrvT.exe
  C:\Windows\System\SLzJrvT.exe
  2⤵
  PID:14460
- C:\Windows\System\pIjguCI.exe
  C:\Windows\System\pIjguCI.exe
  2⤵
  PID:14480
- C:\Windows\System\WtNsQOv.exe
  C:\Windows\System\WtNsQOv.exe
  2⤵
  PID:14500
- C:\Windows\System\gEGCBKE.exe
  C:\Windows\System\gEGCBKE.exe
  2⤵
  PID:14520
- C:\Windows\System\PJfsihD.exe
  C:\Windows\System\PJfsihD.exe
  2⤵
  PID:14544
- C:\Windows\System\aFGwDoD.exe
  C:\Windows\System\aFGwDoD.exe
  2⤵
  PID:14568
- C:\Windows\System\bGSXbcO.exe
  C:\Windows\System\bGSXbcO.exe
  2⤵
  PID:14584
- C:\Windows\System\cIAlsFK.exe
  C:\Windows\System\cIAlsFK.exe
  2⤵
  PID:14608
- C:\Windows\System\aZndjxb.exe
  C:\Windows\System\aZndjxb.exe
  2⤵
  PID:14628
- C:\Windows\System\oxYlGqs.exe
  C:\Windows\System\oxYlGqs.exe
  2⤵
  PID:14644
- C:\Windows\System\xAfvyvy.exe
  C:\Windows\System\xAfvyvy.exe
  2⤵
  PID:14672
- C:\Windows\System\UeATmvk.exe
  C:\Windows\System\UeATmvk.exe
  2⤵
  PID:14688
- C:\Windows\System\OwpHJuZ.exe
  C:\Windows\System\OwpHJuZ.exe
  2⤵
  PID:14704
- C:\Windows\System\CcyAIJS.exe
  C:\Windows\System\CcyAIJS.exe
  2⤵
  PID:14732
- C:\Windows\System\ZqfXyEz.exe
  C:\Windows\System\ZqfXyEz.exe
  2⤵
  PID:14756
- C:\Windows\System\DtavmkG.exe
  C:\Windows\System\DtavmkG.exe
  2⤵
  PID:14780
- C:\Windows\System\kuSabJG.exe
  C:\Windows\System\kuSabJG.exe
  2⤵
  PID:14800
- C:\Windows\System\bgBFtUt.exe
  C:\Windows\System\bgBFtUt.exe
  2⤵
  PID:14820
- C:\Windows\System\nBHjvHs.exe
  C:\Windows\System\nBHjvHs.exe
  2⤵
  PID:14840
- C:\Windows\System\QXtqSgw.exe
  C:\Windows\System\QXtqSgw.exe
  2⤵
  PID:14864
- C:\Windows\System\KxMrwqk.exe
  C:\Windows\System\KxMrwqk.exe
  2⤵
  PID:15244
- C:\Windows\System\rQfcgDS.exe
  C:\Windows\System\rQfcgDS.exe
  2⤵
  PID:15264
- C:\Windows\System\WbuiXHL.exe
  C:\Windows\System\WbuiXHL.exe
  2⤵
  PID:15288
- C:\Windows\System\pbsKkSP.exe
  C:\Windows\System\pbsKkSP.exe
  2⤵
  PID:15304
- C:\Windows\System\ZlfCwTO.exe
  C:\Windows\System\ZlfCwTO.exe
  2⤵
  PID:15320
- C:\Windows\System\esLkBsR.exe
  C:\Windows\System\esLkBsR.exe
  2⤵
  PID:15336
- C:\Windows\System\OcVKhjR.exe
  C:\Windows\System\OcVKhjR.exe
  2⤵
  PID:15352
- C:\Windows\System\BstkfES.exe
  C:\Windows\System\BstkfES.exe
  2⤵
  PID:13880
- C:\Windows\System\jzTOlxn.exe
  C:\Windows\System\jzTOlxn.exe
  2⤵
  PID:12752
- C:\Windows\System\zZeAInZ.exe
  C:\Windows\System\zZeAInZ.exe
  2⤵
  PID:12948
- C:\Windows\System\bdKyFqB.exe
  C:\Windows\System\bdKyFqB.exe
  2⤵
  PID:12584
- C:\Windows\System\GEEUqvA.exe
  C:\Windows\System\GEEUqvA.exe
  2⤵
  PID:14132
- C:\Windows\System\ukownmV.exe
  C:\Windows\System\ukownmV.exe
  2⤵
  PID:13236
- C:\Windows\System\JXrdZLg.exe
  C:\Windows\System\JXrdZLg.exe
  2⤵
  PID:14304
- C:\Windows\System\pFDYNIK.exe
  C:\Windows\System\pFDYNIK.exe
  2⤵
  PID:13532
- C:\Windows\System\MhOBiUG.exe
  C:\Windows\System\MhOBiUG.exe
  2⤵
  PID:13036
- C:\Windows\System\GRJpCBD.exe
  C:\Windows\System\GRJpCBD.exe
  2⤵
  PID:12864
- C:\Windows\System\GhqDGUv.exe
  C:\Windows\System\GhqDGUv.exe
  2⤵
  PID:14356
- C:\Windows\System\ndpOWkp.exe
  C:\Windows\System\ndpOWkp.exe
  2⤵
  PID:11576
- C:\Windows\System\hRUzvLS.exe
  C:\Windows\System\hRUzvLS.exe
  2⤵
  PID:14660
- C:\Windows\System\GrZDnLc.exe
  C:\Windows\System\GrZDnLc.exe
  2⤵
  PID:14204
- C:\Windows\System\UTJZMFV.exe
  C:\Windows\System\UTJZMFV.exe
  2⤵
  PID:14748
- C:\Windows\System\fefbbKo.exe
  C:\Windows\System\fefbbKo.exe
  2⤵
  PID:14300
- C:\Windows\System\WwIqVDe.exe
  C:\Windows\System\WwIqVDe.exe
  2⤵
  PID:13580
- C:\Windows\System\CZWXTef.exe
  C:\Windows\System\CZWXTef.exe
  2⤵
  PID:13592
- C:\Windows\System\UxaYTwf.exe
  C:\Windows\System\UxaYTwf.exe
  2⤵
  PID:14940
- C:\Windows\System\XHayjaC.exe
  C:\Windows\System\XHayjaC.exe
  2⤵
  PID:13696
- C:\Windows\System\SXFTRwF.exe
  C:\Windows\System\SXFTRwF.exe
  2⤵
  PID:12680
- C:\Windows\System\zgPoziM.exe
  C:\Windows\System\zgPoziM.exe
  2⤵
  PID:13472
- C:\Windows\System\sCeuehC.exe
  C:\Windows\System\sCeuehC.exe
  2⤵
  PID:13524
- C:\Windows\System\JQOELVS.exe
  C:\Windows\System\JQOELVS.exe
  2⤵
  PID:11488
- C:\Windows\System\cbpUMTg.exe
  C:\Windows\System\cbpUMTg.exe
  2⤵
  PID:13784
- C:\Windows\System\FjqwcUv.exe
  C:\Windows\System\FjqwcUv.exe
  2⤵
  PID:15008
- C:\Windows\System\KjmMJWg.exe
  C:\Windows\System\KjmMJWg.exe
  2⤵
  PID:13988
- C:\Windows\System\BnwinsZ.exe
  C:\Windows\System\BnwinsZ.exe
  2⤵
  PID:14536
- C:\Windows\System\PVBkyVQ.exe
  C:\Windows\System\PVBkyVQ.exe
  2⤵
  PID:15140
- C:\Windows\System\npxFcYX.exe
  C:\Windows\System\npxFcYX.exe
  2⤵
  PID:14264
- C:\Windows\System\DBAjgsa.exe
  C:\Windows\System\DBAjgsa.exe
  2⤵
  PID:15256
- C:\Windows\System\CKwkgKm.exe
  C:\Windows\System\CKwkgKm.exe
  2⤵
  PID:14012
- C:\Windows\System\RYAKymc.exe
  C:\Windows\System\RYAKymc.exe
  2⤵
  PID:13216
- C:\Windows\System\PsKGdTp.exe
  C:\Windows\System\PsKGdTp.exe
  2⤵
  PID:15064
- C:\Windows\System\rscHmpU.exe
  C:\Windows\System\rscHmpU.exe
  2⤵
  PID:15072
- C:\Windows\System\NKlkvgY.exe
  C:\Windows\System\NKlkvgY.exe
  2⤵
  PID:15104
- C:\Windows\System\RNYiQhT.exe
  C:\Windows\System\RNYiQhT.exe
  2⤵
  PID:14396
- C:\Windows\System\jeQUtzF.exe
  C:\Windows\System\jeQUtzF.exe
  2⤵
  PID:15364
- C:\Windows\System\MlyaaFz.exe
  C:\Windows\System\MlyaaFz.exe
  2⤵
  PID:15380
- C:\Windows\System\zVsHjje.exe
  C:\Windows\System\zVsHjje.exe
  2⤵
  PID:15412
- C:\Windows\System\DOsxNgr.exe
  C:\Windows\System\DOsxNgr.exe
  2⤵
  PID:15432
- C:\Windows\System\ULanKkX.exe
  C:\Windows\System\ULanKkX.exe
  2⤵
  PID:15468
- C:\Windows\System\KZkoZck.exe
  C:\Windows\System\KZkoZck.exe
  2⤵
  PID:15488
- C:\Windows\System\CDfMMwb.exe
  C:\Windows\System\CDfMMwb.exe
  2⤵
  PID:15524
- C:\Windows\System\jWlpibi.exe
  C:\Windows\System\jWlpibi.exe
  2⤵
  PID:15560
- C:\Windows\System\JVvocOv.exe
  C:\Windows\System\JVvocOv.exe
  2⤵
  PID:15580
- C:\Windows\System\lNPxiOe.exe
  C:\Windows\System\lNPxiOe.exe
  2⤵
  PID:15612
- C:\Windows\System\dqKTiik.exe
  C:\Windows\System\dqKTiik.exe
  2⤵
  PID:15644
- C:\Windows\System\zgrdfNH.exe
  C:\Windows\System\zgrdfNH.exe
  2⤵
  PID:15664
- C:\Windows\System\GCNjNUV.exe
  C:\Windows\System\GCNjNUV.exe
  2⤵
  PID:15684
- C:\Windows\System\NzkvTBi.exe
  C:\Windows\System\NzkvTBi.exe
  2⤵
  PID:15704
- C:\Windows\System\vVywjOd.exe
  C:\Windows\System\vVywjOd.exe
  2⤵
  PID:15720
- C:\Windows\System\ZdgLAAb.exe
  C:\Windows\System\ZdgLAAb.exe
  2⤵
  PID:15752
- C:\Windows\System\bCdpuuW.exe
  C:\Windows\System\bCdpuuW.exe
  2⤵
  PID:15776
- C:\Windows\System\XPdTslj.exe
  C:\Windows\System\XPdTslj.exe
  2⤵
  PID:15804
- C:\Windows\System\DGqPLuc.exe
  C:\Windows\System\DGqPLuc.exe
  2⤵
  PID:15836
- C:\Windows\System\irMNwIN.exe
  C:\Windows\System\irMNwIN.exe
  2⤵
  PID:15868
- C:\Windows\System\oollLOg.exe
  C:\Windows\System\oollLOg.exe
  2⤵
  PID:15892
- C:\Windows\System\RPAIDkQ.exe
  C:\Windows\System\RPAIDkQ.exe
  2⤵
  PID:15920
- C:\Windows\System\yFRwTkE.exe
  C:\Windows\System\yFRwTkE.exe
  2⤵
  PID:15936
- C:\Windows\System\gNWlEYW.exe
  C:\Windows\System\gNWlEYW.exe
  2⤵
  PID:15964
- C:\Windows\System\VwgwOUH.exe
  C:\Windows\System\VwgwOUH.exe
  2⤵
  PID:15988
- C:\Windows\System\ORBFZbs.exe
  C:\Windows\System\ORBFZbs.exe
  2⤵
  PID:16016
- C:\Windows\System\nIBUPlS.exe
  C:\Windows\System\nIBUPlS.exe
  2⤵
  PID:16044
- C:\Windows\System\jnOiNXG.exe
  C:\Windows\System\jnOiNXG.exe
  2⤵
  PID:16072
- C:\Windows\System\OpQlXMd.exe
  C:\Windows\System\OpQlXMd.exe
  2⤵
  PID:16096
- C:\Windows\System\nyYMqxP.exe
  C:\Windows\System\nyYMqxP.exe
  2⤵
  PID:16120
- C:\Windows\System\bKzoiis.exe
  C:\Windows\System\bKzoiis.exe
  2⤵
  PID:16156
- C:\Windows\System\jEuxWOa.exe
  C:\Windows\System\jEuxWOa.exe
  2⤵
  PID:16176
- C:\Windows\System\aqclVKf.exe
  C:\Windows\System\aqclVKf.exe
  2⤵
  PID:16204
- C:\Windows\System\ggStmUY.exe
  C:\Windows\System\ggStmUY.exe
  2⤵
  PID:16224
- C:\Windows\System\bqQWGMj.exe
  C:\Windows\System\bqQWGMj.exe
  2⤵
  PID:16248
- C:\Windows\System\UAbrwrD.exe
  C:\Windows\System\UAbrwrD.exe
  2⤵
  PID:16280
- C:\Windows\System\nMGqTJA.exe
  C:\Windows\System\nMGqTJA.exe
  2⤵
  PID:16300
- C:\Windows\System\MbcjJAA.exe
  C:\Windows\System\MbcjJAA.exe
  2⤵
  PID:16332
- C:\Windows\System\KNnJEQA.exe
  C:\Windows\System\KNnJEQA.exe
  2⤵
  PID:16356
- C:\Windows\System\JhUzoPO.exe
  C:\Windows\System\JhUzoPO.exe
  2⤵
  PID:16376
- C:\Windows\System\SUqhquP.exe
  C:\Windows\System\SUqhquP.exe
  2⤵
  PID:13848
- C:\Windows\System\gHfWbJf.exe
  C:\Windows\System\gHfWbJf.exe
  2⤵
  PID:11956
- C:\Windows\System\fzZQuJS.exe
  C:\Windows\System\fzZQuJS.exe
  2⤵
  PID:14036
- C:\Windows\System\UdiBrJp.exe
  C:\Windows\System\UdiBrJp.exe
  2⤵
  PID:12064
- C:\Windows\System\wZlTywa.exe
  C:\Windows\System\wZlTywa.exe
  2⤵
  PID:14616
- C:\Windows\System\BFayAvl.exe
  C:\Windows\System\BFayAvl.exe
  2⤵
  PID:12652
- C:\Windows\System\AQHbfvr.exe
  C:\Windows\System\AQHbfvr.exe
  2⤵
  PID:15216
- C:\Windows\System\gMnRtwX.exe
  C:\Windows\System\gMnRtwX.exe
  2⤵
  PID:15376
- C:\Windows\System\FHaAKLs.exe
  C:\Windows\System\FHaAKLs.exe
  2⤵
  PID:14232
- C:\Windows\System\sRauzbC.exe
  C:\Windows\System\sRauzbC.exe
  2⤵
  PID:15512
- C:\Windows\System\OTHTKqm.exe
  C:\Windows\System\OTHTKqm.exe
  2⤵
  PID:12416
- C:\Windows\System\nrZGpBE.exe
  C:\Windows\System\nrZGpBE.exe
  2⤵
  PID:9488
- C:\Windows\System\DKcZIpM.exe
  C:\Windows\System\DKcZIpM.exe
  2⤵
  PID:14004
- C:\Windows\System\jpTMQji.exe
  C:\Windows\System\jpTMQji.exe
  2⤵
  PID:13624
- C:\Windows\System\NgwCguo.exe
  C:\Windows\System\NgwCguo.exe
  2⤵
  PID:16400
- C:\Windows\System\gVdTduS.exe
  C:\Windows\System\gVdTduS.exe
  2⤵
  PID:16424
- C:\Windows\System\dakKfbW.exe
  C:\Windows\System\dakKfbW.exe
  2⤵
  PID:16444
- C:\Windows\System\QjBJjuc.exe
  C:\Windows\System\QjBJjuc.exe
  2⤵
  PID:16464
- C:\Windows\System\NBUbnMr.exe
  C:\Windows\System\NBUbnMr.exe
  2⤵
  PID:16484
- C:\Windows\System\iZhVgJQ.exe
  C:\Windows\System\iZhVgJQ.exe
  2⤵
  PID:16500
- C:\Windows\System\hUVGilv.exe
  C:\Windows\System\hUVGilv.exe
  2⤵
  PID:16520
- C:\Windows\System\zCYqVhR.exe
  C:\Windows\System\zCYqVhR.exe
  2⤵
  PID:16540
- C:\Windows\System\EAUWwHO.exe
  C:\Windows\System\EAUWwHO.exe
  2⤵
  PID:16568
- C:\Windows\System\eNemJCP.exe
  C:\Windows\System\eNemJCP.exe
  2⤵
  PID:16584
- C:\Windows\System\dbEqTXM.exe
  C:\Windows\System\dbEqTXM.exe
  2⤵
  PID:16616
- C:\Windows\System\HTGIYCI.exe
  C:\Windows\System\HTGIYCI.exe
  2⤵
  PID:16632
- C:\Windows\System\VLjNpxx.exe
  C:\Windows\System\VLjNpxx.exe
  2⤵
  PID:16660
- C:\Windows\System\whuuyKj.exe
  C:\Windows\System\whuuyKj.exe
  2⤵
  PID:16676
- C:\Windows\System\NafmocG.exe
  C:\Windows\System\NafmocG.exe
  2⤵
  PID:16704
- C:\Windows\System\oyuqcch.exe
  C:\Windows\System\oyuqcch.exe
  2⤵
  PID:16732
- C:\Windows\System\JnGyrRf.exe
  C:\Windows\System\JnGyrRf.exe
  2⤵
  PID:16756
- C:\Windows\System\BlsRhip.exe
  C:\Windows\System\BlsRhip.exe
  2⤵
  PID:16772
- C:\Windows\System\eDleCTs.exe
  C:\Windows\System\eDleCTs.exe
  2⤵
  PID:16788
- C:\Windows\System\DLnmvJP.exe
  C:\Windows\System\DLnmvJP.exe
  2⤵
  PID:16804
- C:\Windows\System\nFkmxlO.exe
  C:\Windows\System\nFkmxlO.exe
  2⤵
  PID:16828
- C:\Windows\System\QAlKRLq.exe
  C:\Windows\System\QAlKRLq.exe
  2⤵
  PID:16844
- C:\Windows\System\qwrjnsA.exe
  C:\Windows\System\qwrjnsA.exe
  2⤵
  PID:16860
- C:\Windows\System\Pomlztr.exe
  C:\Windows\System\Pomlztr.exe
  2⤵
  PID:16880
- C:\Windows\System\BAmmfNa.exe
  C:\Windows\System\BAmmfNa.exe
  2⤵
  PID:16904
- C:\Windows\System\jGbngpm.exe
  C:\Windows\System\jGbngpm.exe
  2⤵
  PID:16928
- C:\Windows\System\UbMCRXC.exe
  C:\Windows\System\UbMCRXC.exe
  2⤵
  PID:16948
- C:\Windows\System\XJSyqLh.exe
  C:\Windows\System\XJSyqLh.exe
  2⤵
  PID:16972
- C:\Windows\System\htNpYpm.exe
  C:\Windows\System\htNpYpm.exe
  2⤵
  PID:17000
- C:\Windows\System\vwtnaHY.exe
  C:\Windows\System\vwtnaHY.exe
  2⤵
  PID:17020
- C:\Windows\System\XsvBkwq.exe
  C:\Windows\System\XsvBkwq.exe
  2⤵
  PID:17040
- C:\Windows\System\tRpBPgX.exe
  C:\Windows\System\tRpBPgX.exe
  2⤵
  PID:17064
- C:\Windows\System\yWhJWKQ.exe
  C:\Windows\System\yWhJWKQ.exe
  2⤵
  PID:17084
- C:\Windows\System\XHUobvg.exe
  C:\Windows\System\XHUobvg.exe
  2⤵
  PID:17100
- C:\Windows\System\otkRvFc.exe
  C:\Windows\System\otkRvFc.exe
  2⤵
  PID:17116
- C:\Windows\System\xJobzcO.exe
  C:\Windows\System\xJobzcO.exe
  2⤵
  PID:17144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\EvxBXwx.exe

Filesize
1.1MB

MD5
b807aa035025021bb7dbc0e2b90bef88

SHA1
41cea4b46cdbd83b7747a3c9c804f730862b83fe

SHA256
4be4729c71da5a20839b7fa0388cbc1cb8625087ac71647e81f81891e31024e2

SHA512
347c8be2e1181f0d2e64ef394e1004fa564545eb682760853bef45db207ace5bb9b3bd62d2b9c0321ea945023c1e30c8b3fd5e61fe349a3d53740ce848b3e3c6

Download Submit
C:\Windows\System\MFQhDNg.exe

Filesize
1.1MB

MD5
29bba8b5b8768b5fc07bf6243ebee939

SHA1
41125cea59f6f294450fbde0e67d5bf1488449f0

SHA256
b097815c76a6f1801247c9826f4cbd4d22c94aba87c54b30f2183949725be25f

SHA512
72c1d8cccf34ec849b3188bad76bf7adac3ab9630bd68766605b11ef27bd1083199a63cff529d4bdff7ad2c2c129e63d222477c36e77af029c9e34570471924a

Download Submit
C:\Windows\System\NMmSHcD.exe

Filesize
1.1MB

MD5
5c79f5c8ca2a3ee014a0d88fc1f51327

SHA1
76635bf7c3e453fe3752029100f823f2c94e657c

SHA256
7be205a542f2b0b645331194e14f80190487a89db47aa82028fd102ae825c6f5

SHA512
cbee99d92f430d80f9f908703db228840ff5a199d796bd5b5052275c1489501dc975d5f441430032c9e77ca2e2add84fc68f2243657a4a469f72d9fcc37a56ea

Download Submit
C:\Windows\System\OPEMjwJ.exe

Filesize
1.1MB

MD5
ccd80342e17823541ee0967a63dd9366

SHA1
0b868398be03460a9ef04d99dd43467142f6d560

SHA256
fd24fb5ef30ff245c51d9f8800241c82d6bc7ea57eb66687a7decd5224d95d02

SHA512
74276ade1c49c5596795d967bd88f686aac9d10e5dadb952ee9ca42625df7c2502b82698de48d0a4a638e48fef0c1e65f3dcaffd65b9a6dc74a43d09fd6b3be4

Download Submit
C:\Windows\System\OWpJVxU.exe

Filesize
1.1MB

MD5
e322c836349b70c7ec40d4301759d792

SHA1
b9c49437366d78227f5e98faecf0c1d9286f29e5

SHA256
73a66fbbd1b582e7a951ebb0c743ff61c0b3b4318726a309e4eb8cc37626c9d3

SHA512
293785aed098d70a055ae5ae1d901cf65a00a51264053352d7d554f40c1d87e6b91e3cedb9246d3687d6820632a79e45981c9cc9dc5dc24a3e4e31c8d0a79ac9

Download Submit
C:\Windows\System\QMVxGgv.exe

Filesize
1.1MB

MD5
aef94a1a055590d7fc60a5872833c5f8

SHA1
06bc155d55210042342d7e773d8fab6d65be2410

SHA256
14844f2230200b95c60d6998b25dfea35553c5dca4456ba27295f0de770c0cc0

SHA512
e07f07acdda2bf59cf4ea847ddd828a9b2ab3599af9dcc090a5d90d600f66a0ff367f0b07a9293c7c78c2e91a4e3c4c702186d424988558856feaca742a3f42b

Download Submit
C:\Windows\System\RaQiwLg.exe

Filesize
1.1MB

MD5
c376b45716072ffcdcbf4660ed776eaf

SHA1
9e17da6da8a41a6aa5ad4cb67d421a3f68912e49

SHA256
08225e655f93910d7c5d63e2146085a81eef69fc4345557e478fe114afd04119

SHA512
271d0943469d40dcb3d8d70dd464d003a640aa8c30ad96c56c8ac6125fb60a264869729a5554ef3ac307306553efc0c80f2d135bc081f1913c415ab05d10621a

Download Submit
C:\Windows\System\UMXLAEB.exe

Filesize
1.1MB

MD5
4174f9c74dcb30101223b4ba5916eb30

SHA1
298d6b64b1dc813882f22b1f40bb669bc466e922

SHA256
202803272eaa1edec68990f0058431926647750de63436908a99bb44b7fe6135

SHA512
fd3b7efe7254a724aca2eb1aa3d9c4962dd9114eabc9f0fbef4177f502b1924be11ab387ba4ca079fcf458b18bfa3cd41fe1da15aa08131b51f4e808cf770289

Download Submit
C:\Windows\System\VIFLVKM.exe

Filesize
1.1MB

MD5
e81b6774ec3327672d1ddbed45da459a

SHA1
305f725bf9b800da006b4cb594ea0a650d48d011

SHA256
2b4f14c217d664899b8bed1f808501bf00f4c895d50f5e1eb24ef30ce2f57ea8

SHA512
379ce7cf8b225452d83d89180a7b6a00f3345ba262089e45cf54ca3b6bade8460ba077c774bbc596c5ed13ad456bf2c939d11ed4eb709d97d53ee70b43dbfa9b

Download Submit
C:\Windows\System\WWyXPrY.exe

Filesize
1.1MB

MD5
e4466a6304698667fafba446c38422ad

SHA1
616fbd5f27084add2debe4667c04fe7b121a1219

SHA256
6cd7dde50bcc66f345c223bf073aa51f480eccf3f39600f11aa06f06c3cafa9e

SHA512
b27643fd9806592d4719c0f596db60ceee985f72e2e1877560b50d888fd521181be2c64d39d85adb88dcec1762cced24ecc76f14ca12daf5df3f6bdf8540f852

Download Submit
C:\Windows\System\YNZrAaF.exe

Filesize
1.1MB

MD5
0a1b02c0f55ab9b065cdd3f134300932

SHA1
d91bbaa1f18f337b26968aee084c4b7d21e053c3

SHA256
72e56e9c9dc6d9ec8e7def16e6bf765a7cfdc443bb650288981387c695adaf41

SHA512
2cb998e6af23733cdcfd30edf37b7431c53dd0ad51596ab5fd423a2055c1442d7b0be797bfd1c9144513870c636253a3fed4385f73b33595fe94f12ebb34a3b2

Download Submit
C:\Windows\System\ahpopxD.exe

Filesize
1.1MB

MD5
fea0bda074c37e090b120c88325fd0af

SHA1
37214fc2aa323120264f4f9393622ad97dac2dae

SHA256
5366f348dc77308a7c89451a786d5ca58862c0b50e6f1282059684de9883a6d9

SHA512
8881600482823026e1534fcd5e5822527e027fde116d8e10888f53af671a4a983df2a10361a504fb7ea4a6876ba4382b2d90379b5fd8ac79142a25befb0e29cf

Download Submit
C:\Windows\System\bRBJkHh.exe

Filesize
1.1MB

MD5
e9283d1b8247f0e8a4ad60ba9478b4a0

SHA1
1056cc0c3084161953000d4c68826b28c412d2b6

SHA256
881b53cebd5aae24ce7ef1a2eb01d03b20532259f89c9ebfa037c2b7c037451b

SHA512
7e3a9b6fc0da4fc5ee1a865991442651ba8a941900e87cb6004193c45f9b894c0ab98f1d4eec85583080c88bb3d064d0b4f2d881731e314796a39f3666cd8ad5

Download Submit
C:\Windows\System\bUXEexT.exe

Filesize
1.1MB

MD5
be6d1d8d59e8848e4cc6e48335e4c679

SHA1
6d6c312bbd2aa1f369f3c70b845dd9b01ae03146

SHA256
87972be14061b646acee5da9456ed7c8f8a8efd0d0a04de1450c5bde9c22da2a

SHA512
8ca069dd6b682329baa7e6aa9583077289e2060882ebc35b3b2d47e58b86b41099482546e18b0e7e2dfa8f883a7022068a2250d8897676b8ee9c08f29af8084a

Download Submit
C:\Windows\System\cMDNprt.exe

Filesize
1.1MB

MD5
edbca2874715620bbd0da65ed595f755

SHA1
f003928a1546797133c8d515f33547262e0584cb

SHA256
d8020cbaea4e35466c3246aa9bac8103c26754dcb67fef7dfc34679f10d3a9b2

SHA512
4075495b996f855b59a03e5b0f964a5174b0267b8b42151fd3ababa99a4e8a84fffa84c74494fb113a3f69c1745e11f1856ddd367a2f597e6392965cc86e0942

Download Submit
C:\Windows\System\dyhAdqt.exe

Filesize
1.1MB

MD5
16fbde85ef36b5ca4c2e5aa747ab5c23

SHA1
9c27d82cacc185e047590e2f1ce5574bcf779d1f

SHA256
b0465e8fd67623a1c1db197f3ab3136f1851eb30837d0702b3e81238489e8216

SHA512
365f23c892e0210bce67887180709f1da85e6257c0d1e9971c408b9b26faa3918be8499dd39181ad1170821d11d06758f6ad6fca30fd9c36e2ee135cac52e11b

Download Submit
C:\Windows\System\iJoNZUf.exe

Filesize
1.1MB

MD5
31cadd703cf8602771e9ea6e0f332292

SHA1
2703fa8e1cba166bc0e9d333268e3a7685d40ed0

SHA256
6cefbf5bf577892286f02ba328e1c250c48141436f3d212745c3983a01c3eb50

SHA512
f3aa1dfdc775ff19da0a4eed82cccf5c0f08eefa175d2f5072fccfc1752e0e9706f48ef154976a13cf61dcb5a7c442bb888ce5dd0c510ad493f2f3d9318e0918

Download Submit
C:\Windows\System\jqeguPv.exe

Filesize
1.1MB

MD5
fdb7bb32125f9f1c5a59b001e3ea810f

SHA1
f0de83ae2257e19b9c3d3ff65fc3dff24f5d4125

SHA256
5af8b382e5826790fb41d4491619e0a8ee812d619edee624f8bd588ca8d70b7a

SHA512
29f6a4c5306c5f148f7d1e33b7ce1aa3741c4c652dfff6dd5d175a256ee562aa74e09064bab2e60755eeb7db03d6e2f04b552c0bf81091c71bb984fb3851b370

Download Submit
C:\Windows\System\kEVHmtX.exe

Filesize
1.1MB

MD5
f28830bf8264ea8c5638a07edf49d20d

SHA1
6705af416faa57e6b70eb6d68a1c88a745cf3848

SHA256
f43033bf59caf7a3bdaa5b4b4324d0d8e8934f13bf32a8df0148793df27c3f07

SHA512
d5f3a9fbf5787346616e6897f1c92cdf8640fa0745c5e24a4294b8d8d33a8a23724d66dee36119701df1624847c6ece5ed3e071e0f1d948eeee22ded796b55ac

Download Submit
C:\Windows\System\lVANVyk.exe

Filesize
1.1MB

MD5
1229ca39de38712c7e792b7d5de6552d

SHA1
bd680cebdd904377e10a72b89d98de1240ce8e61

SHA256
5e774f6f7cee22fb1f72efc0fb669babb2745af79e7ff43fc59a37826698e169

SHA512
66d4be944a02ef4994712c1f956468503b3ac91f88bb960d228380021ceed558da15305511953fbb31d14926084a6055b7f89b4a92fde6324793dff193bd8030

Download Submit
C:\Windows\System\pltLOCi.exe

Filesize
1.1MB

MD5
e8611d81b5b7104e333c3345e83155de

SHA1
3cf640446bb31098e02318b01a51b8787b91ec2e

SHA256
60c6c1a1aebe99599ce662f43f09e9c48b7f98bc3a0f2688ba4fb428d8b75c47

SHA512
a91b455beb699e6c91749d274fd093336dc334c045a3f4f4cf9c2e55011982ef88e5f5fc9dd29757c53ab1b117b2acf0b8f19a95d82e5ef9da5299a326821cfd

Download Submit
C:\Windows\System\pwYKaYY.exe

Filesize
1.1MB

MD5
b393d43177c64f75f473140067e570fe

SHA1
da4ceb8579a791e4f709b8b9e053c1a6c2acaa6c

SHA256
011c9dd2ead247d3506f29a89efe7861fa2b270909e87051ec787fd346c7cb5b

SHA512
7889606e38c5f7dea82dd820d8237afa38c3e5d911e8b5d8a2e02eed66c6eca1e2212ac96d289484459d5754e52c384ffbd4e8483c3e787b692dbd1ce5db0443

Download Submit
C:\Windows\System\qJpGtOo.exe

Filesize
1.1MB

MD5
8604f439a3b15697ad351d70547f69b4

SHA1
890fe475e8af581d919c251be24c3c861c10f4af

SHA256
0711b67bad009273a58cdbd0551cfca3177cccae1da704f70d57d97507453fbd

SHA512
a89301a502394d30eb034a74d1c0e1ae18007c29a0835222510e9e32aaea7d171f0ce5fe9338d57dcb5607eeb5506cbda4aa4e9e63351c0be0195ae47b126797

Download Submit
C:\Windows\System\qYCjOsB.exe

Filesize
1.1MB

MD5
4c9fa1f908c468706167b951a904fe6c

SHA1
8aecf3816c35292bd44128e8a90cee47cbcccd84

SHA256
0ad402e9731429e69d8f28fafc3cde29309fe2ca705cdac9270e99b557017d60

SHA512
e08dec03a9b40a4735a4cea48874dea9956e9c85dd09321b96fea1a7bb98a48e7e5c9d6481df61bbdf7a22143878f5588b2517756a41fe1e10dc5c0b06ffb3f5

Download Submit
C:\Windows\System\sEyzpsf.exe

Filesize
1.1MB

MD5
113d665de5d85c8ef84ae2e4f5ad5e92

SHA1
c7c067ec0bd84e9a6758440779cd50ec2c15bc50

SHA256
46b0c9e9aeef0deedf828145f1ab611d3f4b92bda2132442b977466deaf62c15

SHA512
e10ea1f37a5c694403d0b0c14bfbf608ed146d7f33aa33b8ee02fd64e586bc3aa9e2fea2cc2f54e615e49472d1ce6360cf14fa45ecf1fa7b7b372627f0e151c6

Download Submit
C:\Windows\System\scjKiyH.exe

Filesize
1.1MB

MD5
93b4893d9695b501e69a61185077d3e4

SHA1
0b14cc408694cdff3a9d995d202915401e011366

SHA256
3589285c5e1a9299fedc9e7c555a967ad8bb98d1436dfda4a33cb51152eedceb

SHA512
4d87a1c259c2852715c902cb5b2b3b1e4a011d7b02f51ee35b0b1bde613e8e561092fd871193c969a273146c049c6b71724ca68d2138c3a7456f7f8f50383c13

Download Submit
C:\Windows\System\tYwtfDd.exe

Filesize
1.1MB

MD5
9a7d77b31ad15fde49b565d3bd05ade0

SHA1
cf015aa213f75b455d47e90e590eb0d5291a4f73

SHA256
0afd2f0d700fd0ee94a36c3fa1520e2fa3e730eccc0ac81ea60ff8c25ded9502

SHA512
4ea2c25b8353a3a634d4a65841f524f8d9cd84570a3615c011e93d5b6e4fa981f569fb8ec484ccca81c17a9ddaadfadc4b9d0267563da119bd45a4042ba5302a

Download Submit
C:\Windows\System\tqXHtba.exe

Filesize
1.1MB

MD5
0c850a16942dfca2b7fb8785fb03b04b

SHA1
504b771fd7791d5a01092fa9d3be5616e8257143

SHA256
f60cc8cca227b7d3758b87bf208253074a4971bcef2572f02d33b560d75afcd0

SHA512
fb5b78b82be988dd5ae381f88407a5d7448773f0a161afb2fac21d6293d3d073ea8aba53a35d26023fc26f77e44d4d1efd8559747ac810684154ec9a03e84067

Download Submit
C:\Windows\System\uHvlBGo.exe

Filesize
1.1MB

MD5
ebb0c8df8d09c971c6fa232fc5a85de7

SHA1
76ad1c81853340f6ccae010403ddcecb0f832b21

SHA256
ba116a00d41ef78f3c199a7d7a53f1bdd50ef6e153642a6c4f2cf8c1054c90c4

SHA512
657bbb6cce9ba1a20554c4bf4eef641f182db20e72816229d1eacc26143e92ba83f6fc561464faea302dec111734f7856c7de02c644b01b51c7ef73e116fa501

Download Submit
C:\Windows\System\uLzJiXv.exe

Filesize
1.1MB

MD5
736577d2a3c544f11997d389e719d78d

SHA1
5f6176fcfc0cc970fc38e100b1e5bf0493545d76

SHA256
fb567b62ea4df3a0f6ad03c10005fe2a2abf0aa813a9afd7f277ee1842c64513

SHA512
801a824b8302bddfac6ac93cf2969ab678afff72cc229d2b95f9476b24fbcbe499fcf1f357317c49e82bd2f6a99c5ca7a0c796b9ed3aa7a1888bb46fb1475ee4

Download Submit
C:\Windows\System\wBUrqzw.exe

Filesize
1.1MB

MD5
bf1223631526cfa87ac731375ac1451e

SHA1
e135045e6ae77338758acb55e4290e57c4a74fe9

SHA256
0597d49c30840472a88e5efde514c3ef7917feb9209b5fb70021b43c0985fb0a

SHA512
a10d58d7c94c6f215a9352bb431b4af6296d1d264329336198dca10e71d9e9efb1c4a0142ec129dc5b7668502e89bfccb83979908418144603305cdd015e9944

Download Submit
C:\Windows\System\wrWEmFw.exe

Filesize
1.1MB

MD5
5398c25d5296129648bfc8c320c1997f

SHA1
674339843ba68afca3afb4a1aa2341b339a7d462

SHA256
8d4b5b1946df84d2ea84167da4279313d7efebd8adec5545aaab1c204b8b588e

SHA512
39a949f838d12242a6651a08be22f2f6cc6f657bf7d3ff6e622a8058ec352bf9de69840865e61cb1eade548890aaf5da03ab5a5cd34047a62cf04472570b955d

Download Submit
C:\Windows\System\xAbsFZQ.exe

Filesize
1.1MB

MD5
4f32a6ff04c89900d9bb65b49a3ab279

SHA1
8e6bba2a1698dedb234e98bdc908a4cb4f483b78

SHA256
04a840236c062e51f54b61f873e13c502a0854c54f92b43e940b9fad56b49de5

SHA512
222214be92c92712d0948c74edd724f6bd6791529de8a5a98572df2497ddf554200cbf33608ce4eb80af31b41e75ea25335daa7124b0ba74fc6b0aa9175b018e

Download Submit
C:\Windows\System\xSdAGFX.exe

Filesize
1.1MB

MD5
bb1aa56d02d6baa5e2a1c04b7018a863

SHA1
b90c19e35ce4566839191267980224509e02047a

SHA256
464eef444589d23817f078ca85343ab52cc7ee0f453734173783babad5469ce7

SHA512
ad1219a8d27d30c20714402b9080457411dddb5ef2bc98a1e1be52b0958e24b8d812e26d5a68fe331f2daad75aa685ddd0795d6df8591e07278bbc5408b67303

Download Submit
C:\Windows\System\yBFIJLT.exe

Filesize
1.1MB

MD5
799de3328a621bbd3594ea598d2b3ebc

SHA1
1d074d7e148f6fbb538328ef2cb3f02c29ea70ab

SHA256
c48eb7c6594d1de75521f25ed31a9bb1a230e271fe41249918f2c95e89e2d504

SHA512
01a6497eae7c098f89afb14e578815bcb5c03db6858dc7eb9f73f69783ed0c24e2a68db0e2371cd0d8b9403c4b80e3b607c9336bf14895d36c8386f68b2cc8e6

Download Submit
C:\Windows\System\yEzbsDA.exe

Filesize
1.1MB

MD5
29cf00d91c6a84f2434337c96135a44f

SHA1
883bb5a0034b3be021717787acec97ff20bed472

SHA256
83a01947714546852d2e8af44409160f1c8001335222204633e8997794ea4ff7

SHA512
844a4dea310429f1696c2dab3f13c1d801e035532062940a480fb3573a2a6ffe2f61ec9f48b660487655ad04916928bd47b1fb4b820077c9b15a7f4c0a8f03ba

Download Submit
memory/384-0-0x0000019035E60000-0x0000019035E70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads