xmrig | ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
Size

1.4MB
MD5

69879056876c61e297d1ad54975ef968
SHA1

20ec100251dec77f6e8000302515747b4e279d8d
SHA256

ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43
SHA512

834f897da63195f0a0cb0f0c808137145b48cac946517bdad545345f8d22386c64cd04f5f89d46d740c05b7683e5a958030dfb769ced160cabb1061dfd6fcf09
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwW4kj:GezaTF8FcNkNdfE0pZ9ozttwIRx2VDH9

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c5a-4.dat	xmrig
behavioral2/files/0x0007000000023cae-6.dat	xmrig
behavioral2/files/0x0008000000023caa-7.dat	xmrig
behavioral2/files/0x0007000000023caf-17.dat	xmrig
behavioral2/files/0x0007000000023cb0-30.dat	xmrig
behavioral2/files/0x0007000000023cb5-49.dat	xmrig
behavioral2/files/0x0007000000023cba-72.dat	xmrig
behavioral2/files/0x0007000000023cc0-110.dat	xmrig
behavioral2/files/0x0007000000023cc6-140.dat	xmrig
behavioral2/files/0x0007000000023ccc-162.dat	xmrig
behavioral2/files/0x0007000000023cca-160.dat	xmrig
behavioral2/files/0x0007000000023ccb-157.dat	xmrig
behavioral2/files/0x0007000000023cc9-155.dat	xmrig
behavioral2/files/0x0007000000023cc8-150.dat	xmrig
behavioral2/files/0x0007000000023cc7-145.dat	xmrig
behavioral2/files/0x0007000000023cc5-135.dat	xmrig
behavioral2/files/0x0007000000023cc4-130.dat	xmrig
behavioral2/files/0x0007000000023cc3-125.dat	xmrig
behavioral2/files/0x0007000000023cc2-120.dat	xmrig
behavioral2/files/0x0007000000023cc1-115.dat	xmrig
behavioral2/files/0x0007000000023cbf-105.dat	xmrig
behavioral2/files/0x0007000000023cbe-100.dat	xmrig
behavioral2/files/0x0007000000023cbd-95.dat	xmrig
behavioral2/files/0x0007000000023cbc-90.dat	xmrig
behavioral2/files/0x0007000000023cbb-85.dat	xmrig
behavioral2/files/0x0007000000023cb9-75.dat	xmrig
behavioral2/files/0x0007000000023cb8-70.dat	xmrig
behavioral2/files/0x0007000000023cb7-65.dat	xmrig
behavioral2/files/0x0007000000023cb6-57.dat	xmrig
behavioral2/files/0x0007000000023cb4-47.dat	xmrig
behavioral2/files/0x0007000000023cb3-43.dat	xmrig
behavioral2/files/0x0007000000023cb2-38.dat	xmrig
behavioral2/files/0x0007000000023cb1-33.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1104	KcGBYbX.exe
4236	SaDcgRZ.exe
3596	PJunfEq.exe
4224	LsQOlco.exe
4144	yBWQZmM.exe
4744	SqEKSyk.exe
1456	pDwJCJU.exe
1240	WfwtGNf.exe
2016	JEtarNu.exe
3264	xczysNE.exe
4516	PSixeFy.exe
4616	TAsnbLH.exe
2356	qeOARNs.exe
2060	TBJQTJp.exe
2308	WusoFFd.exe
3636	kwwrMPo.exe
3976	UjdIYzT.exe
2884	XqzPsym.exe
3016	IIyBVNm.exe
2508	vgjacJg.exe
3484	saBdOnp.exe
4716	sEYgCoU.exe
1416	fNVpPVq.exe
1908	UCxsSvI.exe
228	tvzJfsT.exe
3472	fwRTiSR.exe
408	tZBNdIx.exe
2132	vyFJCyZ.exe
2200	vLNzlEW.exe
2624	MqOfHek.exe
4936	BkSEgLw.exe
2808	KPKkFDA.exe
1964	pTCgxQX.exe
2736	mMHxbba.exe
3808	hfNEzqV.exe
900	ZwXufNn.exe
776	owaZlXR.exe
4996	JxcHKvL.exe
1272	OGpOlca.exe
3132	KwkfWTw.exe
3376	oBKBCyY.exe
2360	cchOqhh.exe
772	tljNvHI.exe
3312	etAWkbc.exe
1020	hbInndl.exe
2204	PusvDRn.exe
1264	oKQKgvn.exe
4920	JCuZuGN.exe
2768	lkiSFnM.exe
1332	QJYLdab.exe
1560	rDzEMpA.exe
2372	bIfNvqi.exe
2912	IIDLmVw.exe
3996	hFFYect.exe
3300	MkcNwFH.exe
1504	JLRvciW.exe
1000	HdudLAi.exe
4292	GqkEzSj.exe
4312	ntTdFtp.exe
3676	BsqiEhn.exe
3316	GoHkOVI.exe
3988	MaACizi.exe
4764	sSvtnhC.exe
1464	BIWIbeT.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vEnzauU.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\IOoruQL.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\uxazZqW.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\CJYOQYo.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\azAESEt.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\gINJCvM.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\NxyLoCv.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\tmpDfmf.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\TvVkJfl.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\gxnxQPn.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\WhNVxXi.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\DaVUnEp.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\MYgStZF.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\XiabQSy.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VYaPvkM.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\euyScni.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\vnGZEkx.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\WusoFFd.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\DXFcgXJ.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\dAvYbFI.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\MvudwPo.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\kLoCiyc.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\JdejprO.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\prYJTJA.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\efVFNIT.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\EIJPXbp.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\fqSGxoh.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\qtduwEP.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\QFxaXOi.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\HLmUtct.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\BHYniCV.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\YBDojRv.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\PEtCOIf.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\sFiWUzP.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\UWJEotD.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\TnvhJsU.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\TaByVPv.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\NFBtJmj.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\sjDVTQI.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\FgsqXsv.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\wjeegcM.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\QJYLdab.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\OECUAne.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\xelVtdd.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\OGpOlca.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\pWrWoDV.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\XSJFWUQ.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\VovhSRO.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\AELWebD.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\FhklYSZ.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\pIvCxgI.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\WADcFYD.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\QFGpgCk.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\TbKTQUO.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\hjyocbW.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\yMRHKlX.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\cfrOYFu.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\KLTfTgy.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\PJunfEq.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\UuoYTDx.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\Cxuzjgl.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\wZhqGup.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\asmBhvY.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
File created	C:\Windows\System\BnCFIxr.exe	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16700	dwm.exe
Token: SeChangeNotifyPrivilege	16700	dwm.exe
Token: 33	16700	dwm.exe
Token: SeIncBasePriorityPrivilege	16700	dwm.exe
Token: SeShutdownPrivilege	16700	dwm.exe
Token: SeCreatePagefilePrivilege	16700	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 1104	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	86
PID 3648 wrote to memory of 1104	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	86
PID 3648 wrote to memory of 4236	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	87
PID 3648 wrote to memory of 4236	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	87
PID 3648 wrote to memory of 3596	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	88
PID 3648 wrote to memory of 3596	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	88
PID 3648 wrote to memory of 4224	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	89
PID 3648 wrote to memory of 4224	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	89
PID 3648 wrote to memory of 4144	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	90
PID 3648 wrote to memory of 4144	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	90
PID 3648 wrote to memory of 4744	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	91
PID 3648 wrote to memory of 4744	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	91
PID 3648 wrote to memory of 1456	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	92
PID 3648 wrote to memory of 1456	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	92
PID 3648 wrote to memory of 1240	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	93
PID 3648 wrote to memory of 1240	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	93
PID 3648 wrote to memory of 2016	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	94
PID 3648 wrote to memory of 2016	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	94
PID 3648 wrote to memory of 3264	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	95
PID 3648 wrote to memory of 3264	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	95
PID 3648 wrote to memory of 4516	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	96
PID 3648 wrote to memory of 4516	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	96
PID 3648 wrote to memory of 4616	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	97
PID 3648 wrote to memory of 4616	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	97
PID 3648 wrote to memory of 2356	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	98
PID 3648 wrote to memory of 2356	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	98
PID 3648 wrote to memory of 2060	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	99
PID 3648 wrote to memory of 2060	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	99
PID 3648 wrote to memory of 2308	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	100
PID 3648 wrote to memory of 2308	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	100
PID 3648 wrote to memory of 3636	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	101
PID 3648 wrote to memory of 3636	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	101
PID 3648 wrote to memory of 3976	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	102
PID 3648 wrote to memory of 3976	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	102
PID 3648 wrote to memory of 2884	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	103
PID 3648 wrote to memory of 2884	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	103
PID 3648 wrote to memory of 3016	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	104
PID 3648 wrote to memory of 3016	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	104
PID 3648 wrote to memory of 2508	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	105
PID 3648 wrote to memory of 2508	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	105
PID 3648 wrote to memory of 3484	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	106
PID 3648 wrote to memory of 3484	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	106
PID 3648 wrote to memory of 4716	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	107
PID 3648 wrote to memory of 4716	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	107
PID 3648 wrote to memory of 1416	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	108
PID 3648 wrote to memory of 1416	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	108
PID 3648 wrote to memory of 1908	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	109
PID 3648 wrote to memory of 1908	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	109
PID 3648 wrote to memory of 228	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	110
PID 3648 wrote to memory of 228	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	110
PID 3648 wrote to memory of 3472	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	111
PID 3648 wrote to memory of 3472	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	111
PID 3648 wrote to memory of 408	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	112
PID 3648 wrote to memory of 408	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	112
PID 3648 wrote to memory of 2132	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	113
PID 3648 wrote to memory of 2132	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	113
PID 3648 wrote to memory of 2200	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	114
PID 3648 wrote to memory of 2200	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	114
PID 3648 wrote to memory of 2624	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	115
PID 3648 wrote to memory of 2624	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	115
PID 3648 wrote to memory of 4936	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	116
PID 3648 wrote to memory of 4936	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	116
PID 3648 wrote to memory of 2808	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	117
PID 3648 wrote to memory of 2808	3648	ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe	117

C:\Users\Admin\AppData\Local\Temp\ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe
"C:\Users\Admin\AppData\Local\Temp\ef13320cc470ab58f587ea5d78d2c4879b84b02fa5fa63bcbffb642f8ad5dc43.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Windows\System\KcGBYbX.exe
  C:\Windows\System\KcGBYbX.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\SaDcgRZ.exe
  C:\Windows\System\SaDcgRZ.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\PJunfEq.exe
  C:\Windows\System\PJunfEq.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\LsQOlco.exe
  C:\Windows\System\LsQOlco.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\yBWQZmM.exe
  C:\Windows\System\yBWQZmM.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\SqEKSyk.exe
  C:\Windows\System\SqEKSyk.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\pDwJCJU.exe
  C:\Windows\System\pDwJCJU.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\WfwtGNf.exe
  C:\Windows\System\WfwtGNf.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\JEtarNu.exe
  C:\Windows\System\JEtarNu.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\xczysNE.exe
  C:\Windows\System\xczysNE.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\PSixeFy.exe
  C:\Windows\System\PSixeFy.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\TAsnbLH.exe
  C:\Windows\System\TAsnbLH.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\qeOARNs.exe
  C:\Windows\System\qeOARNs.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\TBJQTJp.exe
  C:\Windows\System\TBJQTJp.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\WusoFFd.exe
  C:\Windows\System\WusoFFd.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\kwwrMPo.exe
  C:\Windows\System\kwwrMPo.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\UjdIYzT.exe
  C:\Windows\System\UjdIYzT.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\XqzPsym.exe
  C:\Windows\System\XqzPsym.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\IIyBVNm.exe
  C:\Windows\System\IIyBVNm.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\vgjacJg.exe
  C:\Windows\System\vgjacJg.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\saBdOnp.exe
  C:\Windows\System\saBdOnp.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\sEYgCoU.exe
  C:\Windows\System\sEYgCoU.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\fNVpPVq.exe
  C:\Windows\System\fNVpPVq.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\UCxsSvI.exe
  C:\Windows\System\UCxsSvI.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\tvzJfsT.exe
  C:\Windows\System\tvzJfsT.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\fwRTiSR.exe
  C:\Windows\System\fwRTiSR.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\tZBNdIx.exe
  C:\Windows\System\tZBNdIx.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\vyFJCyZ.exe
  C:\Windows\System\vyFJCyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\vLNzlEW.exe
  C:\Windows\System\vLNzlEW.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\MqOfHek.exe
  C:\Windows\System\MqOfHek.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\BkSEgLw.exe
  C:\Windows\System\BkSEgLw.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\KPKkFDA.exe
  C:\Windows\System\KPKkFDA.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\pTCgxQX.exe
  C:\Windows\System\pTCgxQX.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\mMHxbba.exe
  C:\Windows\System\mMHxbba.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\hfNEzqV.exe
  C:\Windows\System\hfNEzqV.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\ZwXufNn.exe
  C:\Windows\System\ZwXufNn.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\owaZlXR.exe
  C:\Windows\System\owaZlXR.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\JxcHKvL.exe
  C:\Windows\System\JxcHKvL.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\OGpOlca.exe
  C:\Windows\System\OGpOlca.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\KwkfWTw.exe
  C:\Windows\System\KwkfWTw.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\oBKBCyY.exe
  C:\Windows\System\oBKBCyY.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\cchOqhh.exe
  C:\Windows\System\cchOqhh.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\tljNvHI.exe
  C:\Windows\System\tljNvHI.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\etAWkbc.exe
  C:\Windows\System\etAWkbc.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\hbInndl.exe
  C:\Windows\System\hbInndl.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\PusvDRn.exe
  C:\Windows\System\PusvDRn.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\oKQKgvn.exe
  C:\Windows\System\oKQKgvn.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\JCuZuGN.exe
  C:\Windows\System\JCuZuGN.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\lkiSFnM.exe
  C:\Windows\System\lkiSFnM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\QJYLdab.exe
  C:\Windows\System\QJYLdab.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\rDzEMpA.exe
  C:\Windows\System\rDzEMpA.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\bIfNvqi.exe
  C:\Windows\System\bIfNvqi.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\IIDLmVw.exe
  C:\Windows\System\IIDLmVw.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\hFFYect.exe
  C:\Windows\System\hFFYect.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\MkcNwFH.exe
  C:\Windows\System\MkcNwFH.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\JLRvciW.exe
  C:\Windows\System\JLRvciW.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\HdudLAi.exe
  C:\Windows\System\HdudLAi.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\GqkEzSj.exe
  C:\Windows\System\GqkEzSj.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\ntTdFtp.exe
  C:\Windows\System\ntTdFtp.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\BsqiEhn.exe
  C:\Windows\System\BsqiEhn.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\GoHkOVI.exe
  C:\Windows\System\GoHkOVI.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\MaACizi.exe
  C:\Windows\System\MaACizi.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\sSvtnhC.exe
  C:\Windows\System\sSvtnhC.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\BIWIbeT.exe
  C:\Windows\System\BIWIbeT.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\uoYiilN.exe
  C:\Windows\System\uoYiilN.exe
  2⤵
  PID:1528
- C:\Windows\System\TMybUhl.exe
  C:\Windows\System\TMybUhl.exe
  2⤵
  PID:4956
- C:\Windows\System\QSftcmX.exe
  C:\Windows\System\QSftcmX.exe
  2⤵
  PID:3628
- C:\Windows\System\jOXYxrp.exe
  C:\Windows\System\jOXYxrp.exe
  2⤵
  PID:3392
- C:\Windows\System\zCLyOvA.exe
  C:\Windows\System\zCLyOvA.exe
  2⤵
  PID:1684
- C:\Windows\System\xeaWDMJ.exe
  C:\Windows\System\xeaWDMJ.exe
  2⤵
  PID:1520
- C:\Windows\System\tjaIUnl.exe
  C:\Windows\System\tjaIUnl.exe
  2⤵
  PID:1612
- C:\Windows\System\GIkzNKq.exe
  C:\Windows\System\GIkzNKq.exe
  2⤵
  PID:4664
- C:\Windows\System\ZpjrbJl.exe
  C:\Windows\System\ZpjrbJl.exe
  2⤵
  PID:4532
- C:\Windows\System\ohfAoxF.exe
  C:\Windows\System\ohfAoxF.exe
  2⤵
  PID:800
- C:\Windows\System\MKpFRed.exe
  C:\Windows\System\MKpFRed.exe
  2⤵
  PID:5112
- C:\Windows\System\BnRLufu.exe
  C:\Windows\System\BnRLufu.exe
  2⤵
  PID:1840
- C:\Windows\System\Whozvgl.exe
  C:\Windows\System\Whozvgl.exe
  2⤵
  PID:4300
- C:\Windows\System\oheGcQx.exe
  C:\Windows\System\oheGcQx.exe
  2⤵
  PID:1804
- C:\Windows\System\UuoYTDx.exe
  C:\Windows\System\UuoYTDx.exe
  2⤵
  PID:3420
- C:\Windows\System\JdPBrtK.exe
  C:\Windows\System\JdPBrtK.exe
  2⤵
  PID:3908
- C:\Windows\System\iymZMCl.exe
  C:\Windows\System\iymZMCl.exe
  2⤵
  PID:2208
- C:\Windows\System\Diqseuy.exe
  C:\Windows\System\Diqseuy.exe
  2⤵
  PID:1324
- C:\Windows\System\xFVKHpi.exe
  C:\Windows\System\xFVKHpi.exe
  2⤵
  PID:1952
- C:\Windows\System\vLjdEzX.exe
  C:\Windows\System\vLjdEzX.exe
  2⤵
  PID:1608
- C:\Windows\System\OAAMlPU.exe
  C:\Windows\System\OAAMlPU.exe
  2⤵
  PID:4360
- C:\Windows\System\hXhQBTx.exe
  C:\Windows\System\hXhQBTx.exe
  2⤵
  PID:4188
- C:\Windows\System\qJLQkZI.exe
  C:\Windows\System\qJLQkZI.exe
  2⤵
  PID:616
- C:\Windows\System\ioLfMES.exe
  C:\Windows\System\ioLfMES.exe
  2⤵
  PID:3108
- C:\Windows\System\QlJuyPe.exe
  C:\Windows\System\QlJuyPe.exe
  2⤵
  PID:5144
- C:\Windows\System\FsIMGfT.exe
  C:\Windows\System\FsIMGfT.exe
  2⤵
  PID:5176
- C:\Windows\System\wbYPYmF.exe
  C:\Windows\System\wbYPYmF.exe
  2⤵
  PID:5200
- C:\Windows\System\AheOpNR.exe
  C:\Windows\System\AheOpNR.exe
  2⤵
  PID:5232
- C:\Windows\System\gQqgyvj.exe
  C:\Windows\System\gQqgyvj.exe
  2⤵
  PID:5260
- C:\Windows\System\YeTCYrN.exe
  C:\Windows\System\YeTCYrN.exe
  2⤵
  PID:5284
- C:\Windows\System\kzVQUjb.exe
  C:\Windows\System\kzVQUjb.exe
  2⤵
  PID:5316
- C:\Windows\System\cAEzCod.exe
  C:\Windows\System\cAEzCod.exe
  2⤵
  PID:5340
- C:\Windows\System\PLYalCC.exe
  C:\Windows\System\PLYalCC.exe
  2⤵
  PID:5368
- C:\Windows\System\ioPCieI.exe
  C:\Windows\System\ioPCieI.exe
  2⤵
  PID:5396
- C:\Windows\System\IiDDbuE.exe
  C:\Windows\System\IiDDbuE.exe
  2⤵
  PID:5424
- C:\Windows\System\XKGIVxB.exe
  C:\Windows\System\XKGIVxB.exe
  2⤵
  PID:5452
- C:\Windows\System\Cxuzjgl.exe
  C:\Windows\System\Cxuzjgl.exe
  2⤵
  PID:5480
- C:\Windows\System\ZRqnhlp.exe
  C:\Windows\System\ZRqnhlp.exe
  2⤵
  PID:5508
- C:\Windows\System\dAxQctO.exe
  C:\Windows\System\dAxQctO.exe
  2⤵
  PID:5540
- C:\Windows\System\MCEOoiE.exe
  C:\Windows\System\MCEOoiE.exe
  2⤵
  PID:5564
- C:\Windows\System\fgTsrlt.exe
  C:\Windows\System\fgTsrlt.exe
  2⤵
  PID:5592
- C:\Windows\System\nkHAEBN.exe
  C:\Windows\System\nkHAEBN.exe
  2⤵
  PID:5624
- C:\Windows\System\abBBrMk.exe
  C:\Windows\System\abBBrMk.exe
  2⤵
  PID:5652
- C:\Windows\System\buGqwPS.exe
  C:\Windows\System\buGqwPS.exe
  2⤵
  PID:5680
- C:\Windows\System\HvjTIiU.exe
  C:\Windows\System\HvjTIiU.exe
  2⤵
  PID:5708
- C:\Windows\System\HQjhcHH.exe
  C:\Windows\System\HQjhcHH.exe
  2⤵
  PID:5732
- C:\Windows\System\DucaRGs.exe
  C:\Windows\System\DucaRGs.exe
  2⤵
  PID:5760
- C:\Windows\System\mSQTykz.exe
  C:\Windows\System\mSQTykz.exe
  2⤵
  PID:5788
- C:\Windows\System\gLzcjbK.exe
  C:\Windows\System\gLzcjbK.exe
  2⤵
  PID:5816
- C:\Windows\System\ymDNjkR.exe
  C:\Windows\System\ymDNjkR.exe
  2⤵
  PID:5844
- C:\Windows\System\XlLDdnR.exe
  C:\Windows\System\XlLDdnR.exe
  2⤵
  PID:5872
- C:\Windows\System\xDLpVKB.exe
  C:\Windows\System\xDLpVKB.exe
  2⤵
  PID:5900
- C:\Windows\System\aqlNmdj.exe
  C:\Windows\System\aqlNmdj.exe
  2⤵
  PID:5928
- C:\Windows\System\LYiAnMu.exe
  C:\Windows\System\LYiAnMu.exe
  2⤵
  PID:5956
- C:\Windows\System\WmYXaYQ.exe
  C:\Windows\System\WmYXaYQ.exe
  2⤵
  PID:5988
- C:\Windows\System\FysgilW.exe
  C:\Windows\System\FysgilW.exe
  2⤵
  PID:6012
- C:\Windows\System\ZxGlaNk.exe
  C:\Windows\System\ZxGlaNk.exe
  2⤵
  PID:6044
- C:\Windows\System\ddesAnc.exe
  C:\Windows\System\ddesAnc.exe
  2⤵
  PID:6068
- C:\Windows\System\TvVkJfl.exe
  C:\Windows\System\TvVkJfl.exe
  2⤵
  PID:6096
- C:\Windows\System\UNMVXHy.exe
  C:\Windows\System\UNMVXHy.exe
  2⤵
  PID:6124
- C:\Windows\System\aSqLyCn.exe
  C:\Windows\System\aSqLyCn.exe
  2⤵
  PID:3076
- C:\Windows\System\PcjkzvW.exe
  C:\Windows\System\PcjkzvW.exe
  2⤵
  PID:4076
- C:\Windows\System\IZGleKW.exe
  C:\Windows\System\IZGleKW.exe
  2⤵
  PID:4268
- C:\Windows\System\PoXahIU.exe
  C:\Windows\System\PoXahIU.exe
  2⤵
  PID:1672
- C:\Windows\System\lgiNREN.exe
  C:\Windows\System\lgiNREN.exe
  2⤵
  PID:3856
- C:\Windows\System\aIKKWCx.exe
  C:\Windows\System\aIKKWCx.exe
  2⤵
  PID:392
- C:\Windows\System\eilSXcA.exe
  C:\Windows\System\eilSXcA.exe
  2⤵
  PID:1728
- C:\Windows\System\KtGmmow.exe
  C:\Windows\System\KtGmmow.exe
  2⤵
  PID:4464
- C:\Windows\System\cqmTOPT.exe
  C:\Windows\System\cqmTOPT.exe
  2⤵
  PID:3384
- C:\Windows\System\WCwLgfs.exe
  C:\Windows\System\WCwLgfs.exe
  2⤵
  PID:5164
- C:\Windows\System\krAMbHI.exe
  C:\Windows\System\krAMbHI.exe
  2⤵
  PID:5388
- C:\Windows\System\aXQAbDr.exe
  C:\Windows\System\aXQAbDr.exe
  2⤵
  PID:5436
- C:\Windows\System\DXFcgXJ.exe
  C:\Windows\System\DXFcgXJ.exe
  2⤵
  PID:5468
- C:\Windows\System\VovhSRO.exe
  C:\Windows\System\VovhSRO.exe
  2⤵
  PID:5500
- C:\Windows\System\MYFQKQQ.exe
  C:\Windows\System\MYFQKQQ.exe
  2⤵
  PID:5576
- C:\Windows\System\tOhJviX.exe
  C:\Windows\System\tOhJviX.exe
  2⤵
  PID:5640
- C:\Windows\System\liExvnO.exe
  C:\Windows\System\liExvnO.exe
  2⤵
  PID:5700
- C:\Windows\System\QRACzhH.exe
  C:\Windows\System\QRACzhH.exe
  2⤵
  PID:5776
- C:\Windows\System\kZDlqbr.exe
  C:\Windows\System\kZDlqbr.exe
  2⤵
  PID:5860
- C:\Windows\System\yccXJsw.exe
  C:\Windows\System\yccXJsw.exe
  2⤵
  PID:2748
- C:\Windows\System\ShrDeno.exe
  C:\Windows\System\ShrDeno.exe
  2⤵
  PID:5968
- C:\Windows\System\MIZlzPm.exe
  C:\Windows\System\MIZlzPm.exe
  2⤵
  PID:6024
- C:\Windows\System\HwFDvVI.exe
  C:\Windows\System\HwFDvVI.exe
  2⤵
  PID:6080
- C:\Windows\System\JPfptHz.exe
  C:\Windows\System\JPfptHz.exe
  2⤵
  PID:6140
- C:\Windows\System\NVRZqjy.exe
  C:\Windows\System\NVRZqjy.exe
  2⤵
  PID:1292
- C:\Windows\System\wteoVcb.exe
  C:\Windows\System\wteoVcb.exe
  2⤵
  PID:3112
- C:\Windows\System\HCYxuMT.exe
  C:\Windows\System\HCYxuMT.exe
  2⤵
  PID:4320
- C:\Windows\System\MtUuJZs.exe
  C:\Windows\System\MtUuJZs.exe
  2⤵
  PID:5156
- C:\Windows\System\JCAMGXv.exe
  C:\Windows\System\JCAMGXv.exe
  2⤵
  PID:5216
- C:\Windows\System\ZhtIoYY.exe
  C:\Windows\System\ZhtIoYY.exe
  2⤵
  PID:6164
- C:\Windows\System\YkNBUYp.exe
  C:\Windows\System\YkNBUYp.exe
  2⤵
  PID:6196
- C:\Windows\System\OECUAne.exe
  C:\Windows\System\OECUAne.exe
  2⤵
  PID:6220
- C:\Windows\System\OupYhyA.exe
  C:\Windows\System\OupYhyA.exe
  2⤵
  PID:6248
- C:\Windows\System\KqsGRLA.exe
  C:\Windows\System\KqsGRLA.exe
  2⤵
  PID:6276
- C:\Windows\System\KZEwlNk.exe
  C:\Windows\System\KZEwlNk.exe
  2⤵
  PID:6308
- C:\Windows\System\XkLhNei.exe
  C:\Windows\System\XkLhNei.exe
  2⤵
  PID:6336
- C:\Windows\System\DXqRTnf.exe
  C:\Windows\System\DXqRTnf.exe
  2⤵
  PID:6364
- C:\Windows\System\PlISwYu.exe
  C:\Windows\System\PlISwYu.exe
  2⤵
  PID:6396
- C:\Windows\System\QLauGZn.exe
  C:\Windows\System\QLauGZn.exe
  2⤵
  PID:6428
- C:\Windows\System\LxIbszx.exe
  C:\Windows\System\LxIbszx.exe
  2⤵
  PID:6448
- C:\Windows\System\Dcbzpto.exe
  C:\Windows\System\Dcbzpto.exe
  2⤵
  PID:6476
- C:\Windows\System\cxcZFyB.exe
  C:\Windows\System\cxcZFyB.exe
  2⤵
  PID:6500
- C:\Windows\System\vvIOfoI.exe
  C:\Windows\System\vvIOfoI.exe
  2⤵
  PID:6532
- C:\Windows\System\XmFRqtg.exe
  C:\Windows\System\XmFRqtg.exe
  2⤵
  PID:6556
- C:\Windows\System\xUDcEuM.exe
  C:\Windows\System\xUDcEuM.exe
  2⤵
  PID:6588
- C:\Windows\System\MNDQnZy.exe
  C:\Windows\System\MNDQnZy.exe
  2⤵
  PID:6612
- C:\Windows\System\jlszqVv.exe
  C:\Windows\System\jlszqVv.exe
  2⤵
  PID:6644
- C:\Windows\System\KHFONph.exe
  C:\Windows\System\KHFONph.exe
  2⤵
  PID:6668
- C:\Windows\System\VFbzwzD.exe
  C:\Windows\System\VFbzwzD.exe
  2⤵
  PID:6696
- C:\Windows\System\iePfrMU.exe
  C:\Windows\System\iePfrMU.exe
  2⤵
  PID:6724
- C:\Windows\System\otPQGXG.exe
  C:\Windows\System\otPQGXG.exe
  2⤵
  PID:6752
- C:\Windows\System\cAPsxbN.exe
  C:\Windows\System\cAPsxbN.exe
  2⤵
  PID:6788
- C:\Windows\System\ujkizdn.exe
  C:\Windows\System\ujkizdn.exe
  2⤵
  PID:6812
- C:\Windows\System\FloHTLb.exe
  C:\Windows\System\FloHTLb.exe
  2⤵
  PID:6836
- C:\Windows\System\Pabaltd.exe
  C:\Windows\System\Pabaltd.exe
  2⤵
  PID:6864
- C:\Windows\System\JSTtVrO.exe
  C:\Windows\System\JSTtVrO.exe
  2⤵
  PID:6896
- C:\Windows\System\FddXxVh.exe
  C:\Windows\System\FddXxVh.exe
  2⤵
  PID:6920
- C:\Windows\System\bXfFpTp.exe
  C:\Windows\System\bXfFpTp.exe
  2⤵
  PID:6948
- C:\Windows\System\XoXaxZO.exe
  C:\Windows\System\XoXaxZO.exe
  2⤵
  PID:6976
- C:\Windows\System\VEBJigy.exe
  C:\Windows\System\VEBJigy.exe
  2⤵
  PID:7008
- C:\Windows\System\VoGVXRM.exe
  C:\Windows\System\VoGVXRM.exe
  2⤵
  PID:7032
- C:\Windows\System\xBanwYa.exe
  C:\Windows\System\xBanwYa.exe
  2⤵
  PID:7060
- C:\Windows\System\rWMNfxh.exe
  C:\Windows\System\rWMNfxh.exe
  2⤵
  PID:7092
- C:\Windows\System\WODOTES.exe
  C:\Windows\System\WODOTES.exe
  2⤵
  PID:7120
- C:\Windows\System\iNloYce.exe
  C:\Windows\System\iNloYce.exe
  2⤵
  PID:7148
- C:\Windows\System\FCGGUGP.exe
  C:\Windows\System\FCGGUGP.exe
  2⤵
  PID:3616
- C:\Windows\System\wMEGltQ.exe
  C:\Windows\System\wMEGltQ.exe
  2⤵
  PID:5604
- C:\Windows\System\OPBAGpR.exe
  C:\Windows\System\OPBAGpR.exe
  2⤵
  PID:5728
- C:\Windows\System\akAcJqr.exe
  C:\Windows\System\akAcJqr.exe
  2⤵
  PID:5892
- C:\Windows\System\tzknTSp.exe
  C:\Windows\System\tzknTSp.exe
  2⤵
  PID:6052
- C:\Windows\System\wZhqGup.exe
  C:\Windows\System\wZhqGup.exe
  2⤵
  PID:4052
- C:\Windows\System\AfRSYjo.exe
  C:\Windows\System\AfRSYjo.exe
  2⤵
  PID:624
- C:\Windows\System\KAuncBL.exe
  C:\Windows\System\KAuncBL.exe
  2⤵
  PID:6152
- C:\Windows\System\WWKuGNU.exe
  C:\Windows\System\WWKuGNU.exe
  2⤵
  PID:6212
- C:\Windows\System\ZIRBrVd.exe
  C:\Windows\System\ZIRBrVd.exe
  2⤵
  PID:6292
- C:\Windows\System\LgzIkkh.exe
  C:\Windows\System\LgzIkkh.exe
  2⤵
  PID:6352
- C:\Windows\System\QcjDBbX.exe
  C:\Windows\System\QcjDBbX.exe
  2⤵
  PID:6412
- C:\Windows\System\VNWRfGS.exe
  C:\Windows\System\VNWRfGS.exe
  2⤵
  PID:3612
- C:\Windows\System\SocGuNT.exe
  C:\Windows\System\SocGuNT.exe
  2⤵
  PID:6496
- C:\Windows\System\AtlcXvZ.exe
  C:\Windows\System\AtlcXvZ.exe
  2⤵
  PID:6632
- C:\Windows\System\ylpyySb.exe
  C:\Windows\System\ylpyySb.exe
  2⤵
  PID:6712
- C:\Windows\System\eewnhYr.exe
  C:\Windows\System\eewnhYr.exe
  2⤵
  PID:3028
- C:\Windows\System\rRDLpKe.exe
  C:\Windows\System\rRDLpKe.exe
  2⤵
  PID:6852
- C:\Windows\System\UhWftaC.exe
  C:\Windows\System\UhWftaC.exe
  2⤵
  PID:6884
- C:\Windows\System\NEIFfmR.exe
  C:\Windows\System\NEIFfmR.exe
  2⤵
  PID:6964
- C:\Windows\System\JcTcXDx.exe
  C:\Windows\System\JcTcXDx.exe
  2⤵
  PID:3940
- C:\Windows\System\dqunahz.exe
  C:\Windows\System\dqunahz.exe
  2⤵
  PID:7048
- C:\Windows\System\HiDqbaR.exe
  C:\Windows\System\HiDqbaR.exe
  2⤵
  PID:3956
- C:\Windows\System\gDgaiDp.exe
  C:\Windows\System\gDgaiDp.exe
  2⤵
  PID:7088
- C:\Windows\System\Jsjupnb.exe
  C:\Windows\System\Jsjupnb.exe
  2⤵
  PID:1992
- C:\Windows\System\rKFeNwM.exe
  C:\Windows\System\rKFeNwM.exe
  2⤵
  PID:7164
- C:\Windows\System\DrhcYHC.exe
  C:\Windows\System\DrhcYHC.exe
  2⤵
  PID:4372
- C:\Windows\System\wYRoPuO.exe
  C:\Windows\System\wYRoPuO.exe
  2⤵
  PID:3496
- C:\Windows\System\ZRorISZ.exe
  C:\Windows\System\ZRorISZ.exe
  2⤵
  PID:1740
- C:\Windows\System\pWrWoDV.exe
  C:\Windows\System\pWrWoDV.exe
  2⤵
  PID:6264
- C:\Windows\System\wvyXYSB.exe
  C:\Windows\System\wvyXYSB.exe
  2⤵
  PID:4496
- C:\Windows\System\dHCbvqd.exe
  C:\Windows\System\dHCbvqd.exe
  2⤵
  PID:4872
- C:\Windows\System\TDNEHUw.exe
  C:\Windows\System\TDNEHUw.exe
  2⤵
  PID:4080
- C:\Windows\System\yYeuChm.exe
  C:\Windows\System\yYeuChm.exe
  2⤵
  PID:3696
- C:\Windows\System\OJovrrP.exe
  C:\Windows\System\OJovrrP.exe
  2⤵
  PID:4228
- C:\Windows\System\KzzmBFB.exe
  C:\Windows\System\KzzmBFB.exe
  2⤵
  PID:1580
- C:\Windows\System\gxnxQPn.exe
  C:\Windows\System\gxnxQPn.exe
  2⤵
  PID:4792
- C:\Windows\System\pqrzfOB.exe
  C:\Windows\System\pqrzfOB.exe
  2⤵
  PID:6740
- C:\Windows\System\OfvMYLi.exe
  C:\Windows\System\OfvMYLi.exe
  2⤵
  PID:6832
- C:\Windows\System\CVarwSn.exe
  C:\Windows\System\CVarwSn.exe
  2⤵
  PID:7024
- C:\Windows\System\VhmoZJO.exe
  C:\Windows\System\VhmoZJO.exe
  2⤵
  PID:7084
- C:\Windows\System\MpfavVc.exe
  C:\Windows\System\MpfavVc.exe
  2⤵
  PID:2196
- C:\Windows\System\yMRHKlX.exe
  C:\Windows\System\yMRHKlX.exe
  2⤵
  PID:3512
- C:\Windows\System\ZjSmVGZ.exe
  C:\Windows\System\ZjSmVGZ.exe
  2⤵
  PID:6268
- C:\Windows\System\hSIgWCC.exe
  C:\Windows\System\hSIgWCC.exe
  2⤵
  PID:3860
- C:\Windows\System\hwlJjiB.exe
  C:\Windows\System\hwlJjiB.exe
  2⤵
  PID:6936
- C:\Windows\System\JIbzGBD.exe
  C:\Windows\System\JIbzGBD.exe
  2⤵
  PID:6860
- C:\Windows\System\UxlOGpJ.exe
  C:\Windows\System\UxlOGpJ.exe
  2⤵
  PID:7000
- C:\Windows\System\AkdOuiy.exe
  C:\Windows\System\AkdOuiy.exe
  2⤵
  PID:6272
- C:\Windows\System\tVeHozK.exe
  C:\Windows\System\tVeHozK.exe
  2⤵
  PID:1976
- C:\Windows\System\zQxQXqT.exe
  C:\Windows\System\zQxQXqT.exe
  2⤵
  PID:4368
- C:\Windows\System\zukZXdZ.exe
  C:\Windows\System\zukZXdZ.exe
  2⤵
  PID:6720
- C:\Windows\System\oSOwWBh.exe
  C:\Windows\System\oSOwWBh.exe
  2⤵
  PID:7188
- C:\Windows\System\bViTTXJ.exe
  C:\Windows\System\bViTTXJ.exe
  2⤵
  PID:7212
- C:\Windows\System\rKGjpHJ.exe
  C:\Windows\System\rKGjpHJ.exe
  2⤵
  PID:7240
- C:\Windows\System\JbKnWBY.exe
  C:\Windows\System\JbKnWBY.exe
  2⤵
  PID:7264
- C:\Windows\System\ayPDkvm.exe
  C:\Windows\System\ayPDkvm.exe
  2⤵
  PID:7324
- C:\Windows\System\KbiVwxG.exe
  C:\Windows\System\KbiVwxG.exe
  2⤵
  PID:7340
- C:\Windows\System\frglEMV.exe
  C:\Windows\System\frglEMV.exe
  2⤵
  PID:7364
- C:\Windows\System\EIJPXbp.exe
  C:\Windows\System\EIJPXbp.exe
  2⤵
  PID:7380
- C:\Windows\System\xYwGOKv.exe
  C:\Windows\System\xYwGOKv.exe
  2⤵
  PID:7404
- C:\Windows\System\wIOSoYR.exe
  C:\Windows\System\wIOSoYR.exe
  2⤵
  PID:7424
- C:\Windows\System\PDNczzI.exe
  C:\Windows\System\PDNczzI.exe
  2⤵
  PID:7472
- C:\Windows\System\rfrkVtE.exe
  C:\Windows\System\rfrkVtE.exe
  2⤵
  PID:7504
- C:\Windows\System\pEFGufW.exe
  C:\Windows\System\pEFGufW.exe
  2⤵
  PID:7548
- C:\Windows\System\euaAhKD.exe
  C:\Windows\System\euaAhKD.exe
  2⤵
  PID:7576
- C:\Windows\System\yTQFVjO.exe
  C:\Windows\System\yTQFVjO.exe
  2⤵
  PID:7604
- C:\Windows\System\WVZJpGe.exe
  C:\Windows\System\WVZJpGe.exe
  2⤵
  PID:7620
- C:\Windows\System\YbYcrDI.exe
  C:\Windows\System\YbYcrDI.exe
  2⤵
  PID:7660
- C:\Windows\System\XxzBOYl.exe
  C:\Windows\System\XxzBOYl.exe
  2⤵
  PID:7684
- C:\Windows\System\pVHEaoq.exe
  C:\Windows\System\pVHEaoq.exe
  2⤵
  PID:7716
- C:\Windows\System\tBUiNWG.exe
  C:\Windows\System\tBUiNWG.exe
  2⤵
  PID:7732
- C:\Windows\System\EaPttVG.exe
  C:\Windows\System\EaPttVG.exe
  2⤵
  PID:7772
- C:\Windows\System\lImvfhH.exe
  C:\Windows\System\lImvfhH.exe
  2⤵
  PID:7800
- C:\Windows\System\EHXInqe.exe
  C:\Windows\System\EHXInqe.exe
  2⤵
  PID:7828
- C:\Windows\System\UWJEotD.exe
  C:\Windows\System\UWJEotD.exe
  2⤵
  PID:7856
- C:\Windows\System\PwSNbmm.exe
  C:\Windows\System\PwSNbmm.exe
  2⤵
  PID:7884
- C:\Windows\System\wnDQceF.exe
  C:\Windows\System\wnDQceF.exe
  2⤵
  PID:7912
- C:\Windows\System\NotEpaV.exe
  C:\Windows\System\NotEpaV.exe
  2⤵
  PID:7944
- C:\Windows\System\PeXSQSn.exe
  C:\Windows\System\PeXSQSn.exe
  2⤵
  PID:7972
- C:\Windows\System\PepxRxZ.exe
  C:\Windows\System\PepxRxZ.exe
  2⤵
  PID:8000
- C:\Windows\System\JdejprO.exe
  C:\Windows\System\JdejprO.exe
  2⤵
  PID:8024
- C:\Windows\System\fAufoBv.exe
  C:\Windows\System\fAufoBv.exe
  2⤵
  PID:8044
- C:\Windows\System\nQUVeLM.exe
  C:\Windows\System\nQUVeLM.exe
  2⤵
  PID:8072
- C:\Windows\System\fqSGxoh.exe
  C:\Windows\System\fqSGxoh.exe
  2⤵
  PID:8096
- C:\Windows\System\ECdOrJR.exe
  C:\Windows\System\ECdOrJR.exe
  2⤵
  PID:8116
- C:\Windows\System\nxmpNTx.exe
  C:\Windows\System\nxmpNTx.exe
  2⤵
  PID:8140
- C:\Windows\System\cwoaBfa.exe
  C:\Windows\System\cwoaBfa.exe
  2⤵
  PID:8168
- C:\Windows\System\FoHxmll.exe
  C:\Windows\System\FoHxmll.exe
  2⤵
  PID:7224
- C:\Windows\System\SnCgoHr.exe
  C:\Windows\System\SnCgoHr.exe
  2⤵
  PID:7204
- C:\Windows\System\PEtCOIf.exe
  C:\Windows\System\PEtCOIf.exe
  2⤵
  PID:7300
- C:\Windows\System\nlTAQLy.exe
  C:\Windows\System\nlTAQLy.exe
  2⤵
  PID:7392
- C:\Windows\System\lKpBcvu.exe
  C:\Windows\System\lKpBcvu.exe
  2⤵
  PID:7376
- C:\Windows\System\OTvTORM.exe
  C:\Windows\System\OTvTORM.exe
  2⤵
  PID:7500
- C:\Windows\System\oiuclwp.exe
  C:\Windows\System\oiuclwp.exe
  2⤵
  PID:7600
- C:\Windows\System\wuIdzNd.exe
  C:\Windows\System\wuIdzNd.exe
  2⤵
  PID:7676
- C:\Windows\System\jTymasm.exe
  C:\Windows\System\jTymasm.exe
  2⤵
  PID:7764
- C:\Windows\System\qzoBULH.exe
  C:\Windows\System\qzoBULH.exe
  2⤵
  PID:7848
- C:\Windows\System\qRqXnpL.exe
  C:\Windows\System\qRqXnpL.exe
  2⤵
  PID:7880
- C:\Windows\System\vkozzex.exe
  C:\Windows\System\vkozzex.exe
  2⤵
  PID:7928
- C:\Windows\System\amfjLOI.exe
  C:\Windows\System\amfjLOI.exe
  2⤵
  PID:7984
- C:\Windows\System\iQusrif.exe
  C:\Windows\System\iQusrif.exe
  2⤵
  PID:8056
- C:\Windows\System\cmRupWZ.exe
  C:\Windows\System\cmRupWZ.exe
  2⤵
  PID:8128
- C:\Windows\System\JobtzDi.exe
  C:\Windows\System\JobtzDi.exe
  2⤵
  PID:7200
- C:\Windows\System\dxndKNJ.exe
  C:\Windows\System\dxndKNJ.exe
  2⤵
  PID:7356
- C:\Windows\System\fwOOTYp.exe
  C:\Windows\System\fwOOTYp.exe
  2⤵
  PID:7612
- C:\Windows\System\SMdQlky.exe
  C:\Windows\System\SMdQlky.exe
  2⤵
  PID:7652
- C:\Windows\System\MvudwPo.exe
  C:\Windows\System\MvudwPo.exe
  2⤵
  PID:7908
- C:\Windows\System\TAHjLyG.exe
  C:\Windows\System\TAHjLyG.exe
  2⤵
  PID:7988
- C:\Windows\System\jJnyOoH.exe
  C:\Windows\System\jJnyOoH.exe
  2⤵
  PID:8112
- C:\Windows\System\xtkacXV.exe
  C:\Windows\System\xtkacXV.exe
  2⤵
  PID:7440
- C:\Windows\System\nYsrDOv.exe
  C:\Windows\System\nYsrDOv.exe
  2⤵
  PID:7812
- C:\Windows\System\wfcfGKv.exe
  C:\Windows\System\wfcfGKv.exe
  2⤵
  PID:7416
- C:\Windows\System\IFlzGJT.exe
  C:\Windows\System\IFlzGJT.exe
  2⤵
  PID:7180
- C:\Windows\System\SeXvroo.exe
  C:\Windows\System\SeXvroo.exe
  2⤵
  PID:8200
- C:\Windows\System\CJYOQYo.exe
  C:\Windows\System\CJYOQYo.exe
  2⤵
  PID:8220
- C:\Windows\System\cpKEQoy.exe
  C:\Windows\System\cpKEQoy.exe
  2⤵
  PID:8252
- C:\Windows\System\kCeEMlV.exe
  C:\Windows\System\kCeEMlV.exe
  2⤵
  PID:8276
- C:\Windows\System\lhVaFpB.exe
  C:\Windows\System\lhVaFpB.exe
  2⤵
  PID:8300
- C:\Windows\System\tfBbbht.exe
  C:\Windows\System\tfBbbht.exe
  2⤵
  PID:8320
- C:\Windows\System\zRzDTFk.exe
  C:\Windows\System\zRzDTFk.exe
  2⤵
  PID:8344
- C:\Windows\System\cVpiDPY.exe
  C:\Windows\System\cVpiDPY.exe
  2⤵
  PID:8368
- C:\Windows\System\gtUXWrw.exe
  C:\Windows\System\gtUXWrw.exe
  2⤵
  PID:8388
- C:\Windows\System\dURqxeI.exe
  C:\Windows\System\dURqxeI.exe
  2⤵
  PID:8416
- C:\Windows\System\yxTXOfY.exe
  C:\Windows\System\yxTXOfY.exe
  2⤵
  PID:8440
- C:\Windows\System\eEQFvOg.exe
  C:\Windows\System\eEQFvOg.exe
  2⤵
  PID:8464
- C:\Windows\System\HUCnEHP.exe
  C:\Windows\System\HUCnEHP.exe
  2⤵
  PID:8484
- C:\Windows\System\IrycxfS.exe
  C:\Windows\System\IrycxfS.exe
  2⤵
  PID:8540
- C:\Windows\System\gPfndlL.exe
  C:\Windows\System\gPfndlL.exe
  2⤵
  PID:8576
- C:\Windows\System\yBYMFxo.exe
  C:\Windows\System\yBYMFxo.exe
  2⤵
  PID:8600
- C:\Windows\System\mCNJjFu.exe
  C:\Windows\System\mCNJjFu.exe
  2⤵
  PID:8632
- C:\Windows\System\FBKfirj.exe
  C:\Windows\System\FBKfirj.exe
  2⤵
  PID:8660
- C:\Windows\System\BONcFoT.exe
  C:\Windows\System\BONcFoT.exe
  2⤵
  PID:8704
- C:\Windows\System\ivPcmyE.exe
  C:\Windows\System\ivPcmyE.exe
  2⤵
  PID:8732
- C:\Windows\System\kQkSBLW.exe
  C:\Windows\System\kQkSBLW.exe
  2⤵
  PID:8748
- C:\Windows\System\lbfINXQ.exe
  C:\Windows\System\lbfINXQ.exe
  2⤵
  PID:8764
- C:\Windows\System\eWgOErm.exe
  C:\Windows\System\eWgOErm.exe
  2⤵
  PID:8784
- C:\Windows\System\sFiWUzP.exe
  C:\Windows\System\sFiWUzP.exe
  2⤵
  PID:8808
- C:\Windows\System\SgpCNfv.exe
  C:\Windows\System\SgpCNfv.exe
  2⤵
  PID:8836
- C:\Windows\System\GguhySg.exe
  C:\Windows\System\GguhySg.exe
  2⤵
  PID:8908
- C:\Windows\System\hVsfpbm.exe
  C:\Windows\System\hVsfpbm.exe
  2⤵
  PID:8932
- C:\Windows\System\rXJktwb.exe
  C:\Windows\System\rXJktwb.exe
  2⤵
  PID:8956
- C:\Windows\System\ZHxtXcr.exe
  C:\Windows\System\ZHxtXcr.exe
  2⤵
  PID:8976
- C:\Windows\System\dSgKAFW.exe
  C:\Windows\System\dSgKAFW.exe
  2⤵
  PID:8996
- C:\Windows\System\fOpoNJM.exe
  C:\Windows\System\fOpoNJM.exe
  2⤵
  PID:9024
- C:\Windows\System\lNoUCtZ.exe
  C:\Windows\System\lNoUCtZ.exe
  2⤵
  PID:9048
- C:\Windows\System\aqYhFUU.exe
  C:\Windows\System\aqYhFUU.exe
  2⤵
  PID:9100
- C:\Windows\System\TTYLdjA.exe
  C:\Windows\System\TTYLdjA.exe
  2⤵
  PID:9124
- C:\Windows\System\timgWNj.exe
  C:\Windows\System\timgWNj.exe
  2⤵
  PID:9164
- C:\Windows\System\kkikbCm.exe
  C:\Windows\System\kkikbCm.exe
  2⤵
  PID:9180
- C:\Windows\System\BtAAoNG.exe
  C:\Windows\System\BtAAoNG.exe
  2⤵
  PID:9208
- C:\Windows\System\onKRvHI.exe
  C:\Windows\System\onKRvHI.exe
  2⤵
  PID:8208
- C:\Windows\System\sjDVTQI.exe
  C:\Windows\System\sjDVTQI.exe
  2⤵
  PID:8272
- C:\Windows\System\vHCgcwv.exe
  C:\Windows\System\vHCgcwv.exe
  2⤵
  PID:8316
- C:\Windows\System\fjKKrWr.exe
  C:\Windows\System\fjKKrWr.exe
  2⤵
  PID:8364
- C:\Windows\System\kLoCiyc.exe
  C:\Windows\System\kLoCiyc.exe
  2⤵
  PID:8428
- C:\Windows\System\TKDCOZL.exe
  C:\Windows\System\TKDCOZL.exe
  2⤵
  PID:8548
- C:\Windows\System\oCpmyYr.exe
  C:\Windows\System\oCpmyYr.exe
  2⤵
  PID:8608
- C:\Windows\System\XSJFWUQ.exe
  C:\Windows\System\XSJFWUQ.exe
  2⤵
  PID:8652
- C:\Windows\System\UrwOitw.exe
  C:\Windows\System\UrwOitw.exe
  2⤵
  PID:8740
- C:\Windows\System\doKVZmO.exe
  C:\Windows\System\doKVZmO.exe
  2⤵
  PID:8816
- C:\Windows\System\zKmlnfA.exe
  C:\Windows\System\zKmlnfA.exe
  2⤵
  PID:8876
- C:\Windows\System\KjyKDLv.exe
  C:\Windows\System\KjyKDLv.exe
  2⤵
  PID:8952
- C:\Windows\System\DItlSdv.exe
  C:\Windows\System\DItlSdv.exe
  2⤵
  PID:8992
- C:\Windows\System\xelVtdd.exe
  C:\Windows\System\xelVtdd.exe
  2⤵
  PID:9120
- C:\Windows\System\HHWkSCp.exe
  C:\Windows\System\HHWkSCp.exe
  2⤵
  PID:9148
- C:\Windows\System\MgSwGGi.exe
  C:\Windows\System\MgSwGGi.exe
  2⤵
  PID:9200
- C:\Windows\System\dSVXQJg.exe
  C:\Windows\System\dSVXQJg.exe
  2⤵
  PID:8336
- C:\Windows\System\nhYmHsp.exe
  C:\Windows\System\nhYmHsp.exe
  2⤵
  PID:8396
- C:\Windows\System\xLcUkmP.exe
  C:\Windows\System\xLcUkmP.exe
  2⤵
  PID:8596
- C:\Windows\System\azAESEt.exe
  C:\Windows\System\azAESEt.exe
  2⤵
  PID:8728
- C:\Windows\System\hHZQbuY.exe
  C:\Windows\System\hHZQbuY.exe
  2⤵
  PID:8920
- C:\Windows\System\FcoZiLB.exe
  C:\Windows\System\FcoZiLB.exe
  2⤵
  PID:8928
- C:\Windows\System\eZvGZaR.exe
  C:\Windows\System\eZvGZaR.exe
  2⤵
  PID:9136
- C:\Windows\System\tTmymwG.exe
  C:\Windows\System\tTmymwG.exe
  2⤵
  PID:8700
- C:\Windows\System\LYmEXUB.exe
  C:\Windows\System\LYmEXUB.exe
  2⤵
  PID:8772
- C:\Windows\System\HBhFSdh.exe
  C:\Windows\System\HBhFSdh.exe
  2⤵
  PID:9072
- C:\Windows\System\FFMYxAb.exe
  C:\Windows\System\FFMYxAb.exe
  2⤵
  PID:8832
- C:\Windows\System\pjUVKTd.exe
  C:\Windows\System\pjUVKTd.exe
  2⤵
  PID:9240
- C:\Windows\System\HNkwxwt.exe
  C:\Windows\System\HNkwxwt.exe
  2⤵
  PID:9264
- C:\Windows\System\hunXQbm.exe
  C:\Windows\System\hunXQbm.exe
  2⤵
  PID:9304
- C:\Windows\System\aZTbzXV.exe
  C:\Windows\System\aZTbzXV.exe
  2⤵
  PID:9328
- C:\Windows\System\JtniulT.exe
  C:\Windows\System\JtniulT.exe
  2⤵
  PID:9368
- C:\Windows\System\ulOVlCO.exe
  C:\Windows\System\ulOVlCO.exe
  2⤵
  PID:9392
- C:\Windows\System\vEnzauU.exe
  C:\Windows\System\vEnzauU.exe
  2⤵
  PID:9428
- C:\Windows\System\EgjIfaT.exe
  C:\Windows\System\EgjIfaT.exe
  2⤵
  PID:9456
- C:\Windows\System\XRmNqHq.exe
  C:\Windows\System\XRmNqHq.exe
  2⤵
  PID:9476
- C:\Windows\System\aEvyrkx.exe
  C:\Windows\System\aEvyrkx.exe
  2⤵
  PID:9520
- C:\Windows\System\jnQkJJc.exe
  C:\Windows\System\jnQkJJc.exe
  2⤵
  PID:9548
- C:\Windows\System\waBEdlG.exe
  C:\Windows\System\waBEdlG.exe
  2⤵
  PID:9568
- C:\Windows\System\lGbfGGE.exe
  C:\Windows\System\lGbfGGE.exe
  2⤵
  PID:9596
- C:\Windows\System\bBqHnMw.exe
  C:\Windows\System\bBqHnMw.exe
  2⤵
  PID:9620
- C:\Windows\System\WhNVxXi.exe
  C:\Windows\System\WhNVxXi.exe
  2⤵
  PID:9644
- C:\Windows\System\NUZoyer.exe
  C:\Windows\System\NUZoyer.exe
  2⤵
  PID:9668
- C:\Windows\System\TjUMPfJ.exe
  C:\Windows\System\TjUMPfJ.exe
  2⤵
  PID:9696
- C:\Windows\System\WauyAvZ.exe
  C:\Windows\System\WauyAvZ.exe
  2⤵
  PID:9728
- C:\Windows\System\aPQzqdK.exe
  C:\Windows\System\aPQzqdK.exe
  2⤵
  PID:9776
- C:\Windows\System\iAclwts.exe
  C:\Windows\System\iAclwts.exe
  2⤵
  PID:9792
- C:\Windows\System\BnCFIxr.exe
  C:\Windows\System\BnCFIxr.exe
  2⤵
  PID:9808
- C:\Windows\System\FgsqXsv.exe
  C:\Windows\System\FgsqXsv.exe
  2⤵
  PID:9832
- C:\Windows\System\tntQgjL.exe
  C:\Windows\System\tntQgjL.exe
  2⤵
  PID:9876
- C:\Windows\System\JGCfJzN.exe
  C:\Windows\System\JGCfJzN.exe
  2⤵
  PID:9896
- C:\Windows\System\hEUUOpn.exe
  C:\Windows\System\hEUUOpn.exe
  2⤵
  PID:9920
- C:\Windows\System\fxSzqcP.exe
  C:\Windows\System\fxSzqcP.exe
  2⤵
  PID:9952
- C:\Windows\System\oxPYObV.exe
  C:\Windows\System\oxPYObV.exe
  2⤵
  PID:9976
- C:\Windows\System\eWUAdRd.exe
  C:\Windows\System\eWUAdRd.exe
  2⤵
  PID:10020
- C:\Windows\System\AvAbeHm.exe
  C:\Windows\System\AvAbeHm.exe
  2⤵
  PID:10056
- C:\Windows\System\jfOIbda.exe
  C:\Windows\System\jfOIbda.exe
  2⤵
  PID:10076
- C:\Windows\System\tHJcJmN.exe
  C:\Windows\System\tHJcJmN.exe
  2⤵
  PID:10100
- C:\Windows\System\kJTxbmx.exe
  C:\Windows\System\kJTxbmx.exe
  2⤵
  PID:10120
- C:\Windows\System\CBHTqnZ.exe
  C:\Windows\System\CBHTqnZ.exe
  2⤵
  PID:10148
- C:\Windows\System\WHrxFAO.exe
  C:\Windows\System\WHrxFAO.exe
  2⤵
  PID:10168
- C:\Windows\System\wdtVdSa.exe
  C:\Windows\System\wdtVdSa.exe
  2⤵
  PID:10212
- C:\Windows\System\gcxZCiA.exe
  C:\Windows\System\gcxZCiA.exe
  2⤵
  PID:10228
- C:\Windows\System\XljJoKx.exe
  C:\Windows\System\XljJoKx.exe
  2⤵
  PID:8684
- C:\Windows\System\hYdnjsJ.exe
  C:\Windows\System\hYdnjsJ.exe
  2⤵
  PID:9292
- C:\Windows\System\huaKpCQ.exe
  C:\Windows\System\huaKpCQ.exe
  2⤵
  PID:9364
- C:\Windows\System\bMmsNvV.exe
  C:\Windows\System\bMmsNvV.exe
  2⤵
  PID:9436
- C:\Windows\System\gINJCvM.exe
  C:\Windows\System\gINJCvM.exe
  2⤵
  PID:9496
- C:\Windows\System\jNYEZPL.exe
  C:\Windows\System\jNYEZPL.exe
  2⤵
  PID:9532
- C:\Windows\System\AELWebD.exe
  C:\Windows\System\AELWebD.exe
  2⤵
  PID:9604
- C:\Windows\System\ajkcyCK.exe
  C:\Windows\System\ajkcyCK.exe
  2⤵
  PID:9684
- C:\Windows\System\AZAwgWX.exe
  C:\Windows\System\AZAwgWX.exe
  2⤵
  PID:9716
- C:\Windows\System\oiNWMJU.exe
  C:\Windows\System\oiNWMJU.exe
  2⤵
  PID:9824
- C:\Windows\System\mwJeVWL.exe
  C:\Windows\System\mwJeVWL.exe
  2⤵
  PID:9932
- C:\Windows\System\AZzWiiM.exe
  C:\Windows\System\AZzWiiM.exe
  2⤵
  PID:9940
- C:\Windows\System\sfwlQJm.exe
  C:\Windows\System\sfwlQJm.exe
  2⤵
  PID:10116
- C:\Windows\System\iFhFCSq.exe
  C:\Windows\System\iFhFCSq.exe
  2⤵
  PID:10136
- C:\Windows\System\YcRtpQR.exe
  C:\Windows\System\YcRtpQR.exe
  2⤵
  PID:10180
- C:\Windows\System\aFYXjzG.exe
  C:\Windows\System\aFYXjzG.exe
  2⤵
  PID:10220
- C:\Windows\System\DTfADoY.exe
  C:\Windows\System\DTfADoY.exe
  2⤵
  PID:9356
- C:\Windows\System\ZBZYkSy.exe
  C:\Windows\System\ZBZYkSy.exe
  2⤵
  PID:9388
- C:\Windows\System\QuUAWSo.exe
  C:\Windows\System\QuUAWSo.exe
  2⤵
  PID:9544
- C:\Windows\System\JqWvSZQ.exe
  C:\Windows\System\JqWvSZQ.exe
  2⤵
  PID:9676
- C:\Windows\System\fTcXqTf.exe
  C:\Windows\System\fTcXqTf.exe
  2⤵
  PID:9772
- C:\Windows\System\anTRKAa.exe
  C:\Windows\System\anTRKAa.exe
  2⤵
  PID:10040
- C:\Windows\System\wjeegcM.exe
  C:\Windows\System\wjeegcM.exe
  2⤵
  PID:9260
- C:\Windows\System\iuZphnK.exe
  C:\Windows\System\iuZphnK.exe
  2⤵
  PID:9464
- C:\Windows\System\TUjehew.exe
  C:\Windows\System\TUjehew.exe
  2⤵
  PID:9784
- C:\Windows\System\kLcIJJm.exe
  C:\Windows\System\kLcIJJm.exe
  2⤵
  PID:10108
- C:\Windows\System\dAvYbFI.exe
  C:\Windows\System\dAvYbFI.exe
  2⤵
  PID:9804
- C:\Windows\System\NxyLoCv.exe
  C:\Windows\System\NxyLoCv.exe
  2⤵
  PID:10260
- C:\Windows\System\mtuzAip.exe
  C:\Windows\System\mtuzAip.exe
  2⤵
  PID:10308
- C:\Windows\System\bFXuTPE.exe
  C:\Windows\System\bFXuTPE.exe
  2⤵
  PID:10332
- C:\Windows\System\PeONfSy.exe
  C:\Windows\System\PeONfSy.exe
  2⤵
  PID:10352
- C:\Windows\System\pGCmJic.exe
  C:\Windows\System\pGCmJic.exe
  2⤵
  PID:10380
- C:\Windows\System\vhusYXX.exe
  C:\Windows\System\vhusYXX.exe
  2⤵
  PID:10408
- C:\Windows\System\XZwXPyD.exe
  C:\Windows\System\XZwXPyD.exe
  2⤵
  PID:10444
- C:\Windows\System\yQapnMZ.exe
  C:\Windows\System\yQapnMZ.exe
  2⤵
  PID:10524
- C:\Windows\System\MblQAUH.exe
  C:\Windows\System\MblQAUH.exe
  2⤵
  PID:10540
- C:\Windows\System\GLaKgrk.exe
  C:\Windows\System\GLaKgrk.exe
  2⤵
  PID:10580
- C:\Windows\System\UEWvGQr.exe
  C:\Windows\System\UEWvGQr.exe
  2⤵
  PID:10608
- C:\Windows\System\CwrITjc.exe
  C:\Windows\System\CwrITjc.exe
  2⤵
  PID:10632
- C:\Windows\System\fKLSZkl.exe
  C:\Windows\System\fKLSZkl.exe
  2⤵
  PID:10652
- C:\Windows\System\Vzcgonu.exe
  C:\Windows\System\Vzcgonu.exe
  2⤵
  PID:10672
- C:\Windows\System\FhklYSZ.exe
  C:\Windows\System\FhklYSZ.exe
  2⤵
  PID:10692
- C:\Windows\System\OMmwZmG.exe
  C:\Windows\System\OMmwZmG.exe
  2⤵
  PID:10720
- C:\Windows\System\jHqGQqH.exe
  C:\Windows\System\jHqGQqH.exe
  2⤵
  PID:10748
- C:\Windows\System\IiximZp.exe
  C:\Windows\System\IiximZp.exe
  2⤵
  PID:10788
- C:\Windows\System\qHGmCKi.exe
  C:\Windows\System\qHGmCKi.exe
  2⤵
  PID:10832
- C:\Windows\System\HScJxaY.exe
  C:\Windows\System\HScJxaY.exe
  2⤵
  PID:10864
- C:\Windows\System\TOGuRvj.exe
  C:\Windows\System\TOGuRvj.exe
  2⤵
  PID:10892
- C:\Windows\System\ddTakEK.exe
  C:\Windows\System\ddTakEK.exe
  2⤵
  PID:10908
- C:\Windows\System\FifKIWc.exe
  C:\Windows\System\FifKIWc.exe
  2⤵
  PID:10948
- C:\Windows\System\ADdzcJG.exe
  C:\Windows\System\ADdzcJG.exe
  2⤵
  PID:10968
- C:\Windows\System\RLSkvmE.exe
  C:\Windows\System\RLSkvmE.exe
  2⤵
  PID:10992
- C:\Windows\System\wZFppPf.exe
  C:\Windows\System\wZFppPf.exe
  2⤵
  PID:11032
- C:\Windows\System\WcjTaBw.exe
  C:\Windows\System\WcjTaBw.exe
  2⤵
  PID:11052
- C:\Windows\System\rmMlSAw.exe
  C:\Windows\System\rmMlSAw.exe
  2⤵
  PID:11076
- C:\Windows\System\WiAqzLu.exe
  C:\Windows\System\WiAqzLu.exe
  2⤵
  PID:11108
- C:\Windows\System\dmaTZxj.exe
  C:\Windows\System\dmaTZxj.exe
  2⤵
  PID:11132
- C:\Windows\System\WbtCVhh.exe
  C:\Windows\System\WbtCVhh.exe
  2⤵
  PID:11160
- C:\Windows\System\GkAabib.exe
  C:\Windows\System\GkAabib.exe
  2⤵
  PID:11188
- C:\Windows\System\xhtYZhu.exe
  C:\Windows\System\xhtYZhu.exe
  2⤵
  PID:11228
- C:\Windows\System\LjwIkqh.exe
  C:\Windows\System\LjwIkqh.exe
  2⤵
  PID:11256
- C:\Windows\System\MTKcZEK.exe
  C:\Windows\System\MTKcZEK.exe
  2⤵
  PID:9288
- C:\Windows\System\INlkXjk.exe
  C:\Windows\System\INlkXjk.exe
  2⤵
  PID:10280
- C:\Windows\System\deZSsjh.exe
  C:\Windows\System\deZSsjh.exe
  2⤵
  PID:10388
- C:\Windows\System\vBkXkdB.exe
  C:\Windows\System\vBkXkdB.exe
  2⤵
  PID:10432
- C:\Windows\System\PjuwxEa.exe
  C:\Windows\System\PjuwxEa.exe
  2⤵
  PID:10536
- C:\Windows\System\hyVlPeH.exe
  C:\Windows\System\hyVlPeH.exe
  2⤵
  PID:10596
- C:\Windows\System\GFmaqfZ.exe
  C:\Windows\System\GFmaqfZ.exe
  2⤵
  PID:10628
- C:\Windows\System\xPpcwJk.exe
  C:\Windows\System\xPpcwJk.exe
  2⤵
  PID:10708
- C:\Windows\System\dLgMAWQ.exe
  C:\Windows\System\dLgMAWQ.exe
  2⤵
  PID:10764
- C:\Windows\System\jcwGVFT.exe
  C:\Windows\System\jcwGVFT.exe
  2⤵
  PID:10828
- C:\Windows\System\tehiQJM.exe
  C:\Windows\System\tehiQJM.exe
  2⤵
  PID:10900
- C:\Windows\System\sxbXmqV.exe
  C:\Windows\System\sxbXmqV.exe
  2⤵
  PID:10940
- C:\Windows\System\enkWUdv.exe
  C:\Windows\System\enkWUdv.exe
  2⤵
  PID:11068
- C:\Windows\System\axBYZtq.exe
  C:\Windows\System\axBYZtq.exe
  2⤵
  PID:11096
- C:\Windows\System\bwYoWux.exe
  C:\Windows\System\bwYoWux.exe
  2⤵
  PID:11168
- C:\Windows\System\ppbnJfd.exe
  C:\Windows\System\ppbnJfd.exe
  2⤵
  PID:11208
- C:\Windows\System\XqdWDRX.exe
  C:\Windows\System\XqdWDRX.exe
  2⤵
  PID:10248
- C:\Windows\System\oAGVwzx.exe
  C:\Windows\System\oAGVwzx.exe
  2⤵
  PID:10348
- C:\Windows\System\hMXNDPv.exe
  C:\Windows\System\hMXNDPv.exe
  2⤵
  PID:10576
- C:\Windows\System\sGoVOhT.exe
  C:\Windows\System\sGoVOhT.exe
  2⤵
  PID:9440
- C:\Windows\System\aLSMyQo.exe
  C:\Windows\System\aLSMyQo.exe
  2⤵
  PID:10880
- C:\Windows\System\kKwEQNj.exe
  C:\Windows\System\kKwEQNj.exe
  2⤵
  PID:11072
- C:\Windows\System\hFHTsee.exe
  C:\Windows\System\hFHTsee.exe
  2⤵
  PID:11204
- C:\Windows\System\ZiqhIjR.exe
  C:\Windows\System\ZiqhIjR.exe
  2⤵
  PID:10368
- C:\Windows\System\ADRXrIJ.exe
  C:\Windows\System\ADRXrIJ.exe
  2⤵
  PID:10712
- C:\Windows\System\wHtmhpX.exe
  C:\Windows\System\wHtmhpX.exe
  2⤵
  PID:11040
- C:\Windows\System\aKxcZVz.exe
  C:\Windows\System\aKxcZVz.exe
  2⤵
  PID:11124
- C:\Windows\System\bKbExrs.exe
  C:\Windows\System\bKbExrs.exe
  2⤵
  PID:11296
- C:\Windows\System\BTBgmXv.exe
  C:\Windows\System\BTBgmXv.exe
  2⤵
  PID:11312
- C:\Windows\System\lnIchYZ.exe
  C:\Windows\System\lnIchYZ.exe
  2⤵
  PID:11352
- C:\Windows\System\MFXeweO.exe
  C:\Windows\System\MFXeweO.exe
  2⤵
  PID:11372
- C:\Windows\System\nmVLoFR.exe
  C:\Windows\System\nmVLoFR.exe
  2⤵
  PID:11408
- C:\Windows\System\eNKyeDU.exe
  C:\Windows\System\eNKyeDU.exe
  2⤵
  PID:11424
- C:\Windows\System\cfrOYFu.exe
  C:\Windows\System\cfrOYFu.exe
  2⤵
  PID:11440
- C:\Windows\System\gZTUuQa.exe
  C:\Windows\System\gZTUuQa.exe
  2⤵
  PID:11456
- C:\Windows\System\MhLuHfc.exe
  C:\Windows\System\MhLuHfc.exe
  2⤵
  PID:11480
- C:\Windows\System\BbYsjTU.exe
  C:\Windows\System\BbYsjTU.exe
  2⤵
  PID:11516
- C:\Windows\System\XPBIglk.exe
  C:\Windows\System\XPBIglk.exe
  2⤵
  PID:11552
- C:\Windows\System\VCWYSkW.exe
  C:\Windows\System\VCWYSkW.exe
  2⤵
  PID:11592
- C:\Windows\System\Sbbihny.exe
  C:\Windows\System\Sbbihny.exe
  2⤵
  PID:11612
- C:\Windows\System\yIsqxPv.exe
  C:\Windows\System\yIsqxPv.exe
  2⤵
  PID:11640
- C:\Windows\System\MLDbQJb.exe
  C:\Windows\System\MLDbQJb.exe
  2⤵
  PID:11664
- C:\Windows\System\mcTTpHb.exe
  C:\Windows\System\mcTTpHb.exe
  2⤵
  PID:11692
- C:\Windows\System\QFxaXOi.exe
  C:\Windows\System\QFxaXOi.exe
  2⤵
  PID:11720
- C:\Windows\System\drcOTAS.exe
  C:\Windows\System\drcOTAS.exe
  2⤵
  PID:11744
- C:\Windows\System\trEQCHz.exe
  C:\Windows\System\trEQCHz.exe
  2⤵
  PID:11796
- C:\Windows\System\UPbAibR.exe
  C:\Windows\System\UPbAibR.exe
  2⤵
  PID:11816
- C:\Windows\System\abTHIPY.exe
  C:\Windows\System\abTHIPY.exe
  2⤵
  PID:11844
- C:\Windows\System\wcWfhyX.exe
  C:\Windows\System\wcWfhyX.exe
  2⤵
  PID:11860
- C:\Windows\System\xPuebnq.exe
  C:\Windows\System\xPuebnq.exe
  2⤵
  PID:11892
- C:\Windows\System\kHCCMKR.exe
  C:\Windows\System\kHCCMKR.exe
  2⤵
  PID:11940
- C:\Windows\System\UMzrkyL.exe
  C:\Windows\System\UMzrkyL.exe
  2⤵
  PID:11956
- C:\Windows\System\DXneMwe.exe
  C:\Windows\System\DXneMwe.exe
  2⤵
  PID:11976
- C:\Windows\System\ZspzNNz.exe
  C:\Windows\System\ZspzNNz.exe
  2⤵
  PID:12012
- C:\Windows\System\kYJTWal.exe
  C:\Windows\System\kYJTWal.exe
  2⤵
  PID:12032
- C:\Windows\System\YBDojRv.exe
  C:\Windows\System\YBDojRv.exe
  2⤵
  PID:12068
- C:\Windows\System\ISzTyEW.exe
  C:\Windows\System\ISzTyEW.exe
  2⤵
  PID:12092
- C:\Windows\System\rauBkhK.exe
  C:\Windows\System\rauBkhK.exe
  2⤵
  PID:12120
- C:\Windows\System\nJWQsVP.exe
  C:\Windows\System\nJWQsVP.exe
  2⤵
  PID:12156
- C:\Windows\System\NeZHxwO.exe
  C:\Windows\System\NeZHxwO.exe
  2⤵
  PID:12180
- C:\Windows\System\hBLilxU.exe
  C:\Windows\System\hBLilxU.exe
  2⤵
  PID:12220
- C:\Windows\System\WADcFYD.exe
  C:\Windows\System\WADcFYD.exe
  2⤵
  PID:12252
- C:\Windows\System\dCGQXmy.exe
  C:\Windows\System\dCGQXmy.exe
  2⤵
  PID:12276
- C:\Windows\System\UeeASVx.exe
  C:\Windows\System\UeeASVx.exe
  2⤵
  PID:10928
- C:\Windows\System\UfxZupP.exe
  C:\Windows\System\UfxZupP.exe
  2⤵
  PID:11308
- C:\Windows\System\QAujABq.exe
  C:\Windows\System\QAujABq.exe
  2⤵
  PID:11360
- C:\Windows\System\uKmpDfx.exe
  C:\Windows\System\uKmpDfx.exe
  2⤵
  PID:11416
- C:\Windows\System\ppShJKj.exe
  C:\Windows\System\ppShJKj.exe
  2⤵
  PID:11524
- C:\Windows\System\atpJDlS.exe
  C:\Windows\System\atpJDlS.exe
  2⤵
  PID:11548
- C:\Windows\System\oFcgrPn.exe
  C:\Windows\System\oFcgrPn.exe
  2⤵
  PID:11588
- C:\Windows\System\bKRRofm.exe
  C:\Windows\System\bKRRofm.exe
  2⤵
  PID:11628
- C:\Windows\System\QALNBnn.exe
  C:\Windows\System\QALNBnn.exe
  2⤵
  PID:11708
- C:\Windows\System\SFwNXbb.exe
  C:\Windows\System\SFwNXbb.exe
  2⤵
  PID:11784
- C:\Windows\System\aOjcjPW.exe
  C:\Windows\System\aOjcjPW.exe
  2⤵
  PID:11832
- C:\Windows\System\NwkywUx.exe
  C:\Windows\System\NwkywUx.exe
  2⤵
  PID:11936
- C:\Windows\System\TpZItor.exe
  C:\Windows\System\TpZItor.exe
  2⤵
  PID:11996
- C:\Windows\System\DaVUnEp.exe
  C:\Windows\System\DaVUnEp.exe
  2⤵
  PID:12052
- C:\Windows\System\oyPWORe.exe
  C:\Windows\System\oyPWORe.exe
  2⤵
  PID:12084
- C:\Windows\System\RzMjHxj.exe
  C:\Windows\System\RzMjHxj.exe
  2⤵
  PID:12172
- C:\Windows\System\ERwTYxw.exe
  C:\Windows\System\ERwTYxw.exe
  2⤵
  PID:12208
- C:\Windows\System\DjpTETi.exe
  C:\Windows\System\DjpTETi.exe
  2⤵
  PID:12248
- C:\Windows\System\wiBbRaR.exe
  C:\Windows\System\wiBbRaR.exe
  2⤵
  PID:11280
- C:\Windows\System\IOoruQL.exe
  C:\Windows\System\IOoruQL.exe
  2⤵
  PID:11340
- C:\Windows\System\FhVYNAh.exe
  C:\Windows\System\FhVYNAh.exe
  2⤵
  PID:11544
- C:\Windows\System\bjFLzeN.exe
  C:\Windows\System\bjFLzeN.exe
  2⤵
  PID:11684
- C:\Windows\System\ubHVMuB.exe
  C:\Windows\System\ubHVMuB.exe
  2⤵
  PID:11828
- C:\Windows\System\SsEobqB.exe
  C:\Windows\System\SsEobqB.exe
  2⤵
  PID:11808
- C:\Windows\System\DWRTdvO.exe
  C:\Windows\System\DWRTdvO.exe
  2⤵
  PID:12044
- C:\Windows\System\mnTbkdK.exe
  C:\Windows\System\mnTbkdK.exe
  2⤵
  PID:11608
- C:\Windows\System\QuDFpqx.exe
  C:\Windows\System\QuDFpqx.exe
  2⤵
  PID:12080
- C:\Windows\System\zwGNLXk.exe
  C:\Windows\System\zwGNLXk.exe
  2⤵
  PID:11396
- C:\Windows\System\XozjhxV.exe
  C:\Windows\System\XozjhxV.exe
  2⤵
  PID:12300
- C:\Windows\System\vKrOppD.exe
  C:\Windows\System\vKrOppD.exe
  2⤵
  PID:12340
- C:\Windows\System\wBdxzxY.exe
  C:\Windows\System\wBdxzxY.exe
  2⤵
  PID:12380
- C:\Windows\System\FKNHpFO.exe
  C:\Windows\System\FKNHpFO.exe
  2⤵
  PID:12412
- C:\Windows\System\AMnjepR.exe
  C:\Windows\System\AMnjepR.exe
  2⤵
  PID:12444
- C:\Windows\System\YVggBeu.exe
  C:\Windows\System\YVggBeu.exe
  2⤵
  PID:12468
- C:\Windows\System\DLeTopC.exe
  C:\Windows\System\DLeTopC.exe
  2⤵
  PID:12484
- C:\Windows\System\cuCVZnN.exe
  C:\Windows\System\cuCVZnN.exe
  2⤵
  PID:12508
- C:\Windows\System\QpFhydK.exe
  C:\Windows\System\QpFhydK.exe
  2⤵
  PID:12540
- C:\Windows\System\YQJwdUc.exe
  C:\Windows\System\YQJwdUc.exe
  2⤵
  PID:12564
- C:\Windows\System\DvLoVwN.exe
  C:\Windows\System\DvLoVwN.exe
  2⤵
  PID:12608
- C:\Windows\System\CZLigGi.exe
  C:\Windows\System\CZLigGi.exe
  2⤵
  PID:12648
- C:\Windows\System\iNVdBPr.exe
  C:\Windows\System\iNVdBPr.exe
  2⤵
  PID:12672
- C:\Windows\System\asmBhvY.exe
  C:\Windows\System\asmBhvY.exe
  2⤵
  PID:12700
- C:\Windows\System\UdFlTLv.exe
  C:\Windows\System\UdFlTLv.exe
  2⤵
  PID:12732
- C:\Windows\System\qpAbCuE.exe
  C:\Windows\System\qpAbCuE.exe
  2⤵
  PID:12756
- C:\Windows\System\mLJZOck.exe
  C:\Windows\System\mLJZOck.exe
  2⤵
  PID:12776
- C:\Windows\System\VUOeBWq.exe
  C:\Windows\System\VUOeBWq.exe
  2⤵
  PID:12800
- C:\Windows\System\rmMKnei.exe
  C:\Windows\System\rmMKnei.exe
  2⤵
  PID:12824
- C:\Windows\System\XWTcRLQ.exe
  C:\Windows\System\XWTcRLQ.exe
  2⤵
  PID:12864
- C:\Windows\System\RSinNlG.exe
  C:\Windows\System\RSinNlG.exe
  2⤵
  PID:12880
- C:\Windows\System\qtduwEP.exe
  C:\Windows\System\qtduwEP.exe
  2⤵
  PID:12900
- C:\Windows\System\syyGkJv.exe
  C:\Windows\System\syyGkJv.exe
  2⤵
  PID:12924
- C:\Windows\System\WGEUyVU.exe
  C:\Windows\System\WGEUyVU.exe
  2⤵
  PID:12952
- C:\Windows\System\SzMWmmF.exe
  C:\Windows\System\SzMWmmF.exe
  2⤵
  PID:13004
- C:\Windows\System\gCVVupP.exe
  C:\Windows\System\gCVVupP.exe
  2⤵
  PID:13036
- C:\Windows\System\IgwFbMB.exe
  C:\Windows\System\IgwFbMB.exe
  2⤵
  PID:13056
- C:\Windows\System\thcrpBD.exe
  C:\Windows\System\thcrpBD.exe
  2⤵
  PID:13084
- C:\Windows\System\BLnjjru.exe
  C:\Windows\System\BLnjjru.exe
  2⤵
  PID:13112
- C:\Windows\System\hAOFvpy.exe
  C:\Windows\System\hAOFvpy.exe
  2⤵
  PID:13128
- C:\Windows\System\ELjIMmw.exe
  C:\Windows\System\ELjIMmw.exe
  2⤵
  PID:13148
- C:\Windows\System\omqRDDP.exe
  C:\Windows\System\omqRDDP.exe
  2⤵
  PID:13168
- C:\Windows\System\YyrlBmi.exe
  C:\Windows\System\YyrlBmi.exe
  2⤵
  PID:13240
- C:\Windows\System\OwaSENu.exe
  C:\Windows\System\OwaSENu.exe
  2⤵
  PID:13268
- C:\Windows\System\YdWkXgV.exe
  C:\Windows\System\YdWkXgV.exe
  2⤵
  PID:13284
- C:\Windows\System\EGLBaJm.exe
  C:\Windows\System\EGLBaJm.exe
  2⤵
  PID:13300
- C:\Windows\System\SQDHaoY.exe
  C:\Windows\System\SQDHaoY.exe
  2⤵
  PID:11924
- C:\Windows\System\XPTKDBa.exe
  C:\Windows\System\XPTKDBa.exe
  2⤵
  PID:12296
- C:\Windows\System\RRhJQmz.exe
  C:\Windows\System\RRhJQmz.exe
  2⤵
  PID:12424
- C:\Windows\System\sJiQCsR.exe
  C:\Windows\System\sJiQCsR.exe
  2⤵
  PID:12456
- C:\Windows\System\aNbJOuH.exe
  C:\Windows\System\aNbJOuH.exe
  2⤵
  PID:12500
- C:\Windows\System\JYBASGy.exe
  C:\Windows\System\JYBASGy.exe
  2⤵
  PID:12640
- C:\Windows\System\BpipDbo.exe
  C:\Windows\System\BpipDbo.exe
  2⤵
  PID:12684
- C:\Windows\System\bbstWIh.exe
  C:\Windows\System\bbstWIh.exe
  2⤵
  PID:12728
- C:\Windows\System\eLCWwJq.exe
  C:\Windows\System\eLCWwJq.exe
  2⤵
  PID:12796
- C:\Windows\System\JAoDcSL.exe
  C:\Windows\System\JAoDcSL.exe
  2⤵
  PID:12852
- C:\Windows\System\SPIWIpZ.exe
  C:\Windows\System\SPIWIpZ.exe
  2⤵
  PID:12968
- C:\Windows\System\dPkGXDH.exe
  C:\Windows\System\dPkGXDH.exe
  2⤵
  PID:12988
- C:\Windows\System\skzKxok.exe
  C:\Windows\System\skzKxok.exe
  2⤵
  PID:13068
- C:\Windows\System\yPLuwBr.exe
  C:\Windows\System\yPLuwBr.exe
  2⤵
  PID:13144
- C:\Windows\System\BHyusLg.exe
  C:\Windows\System\BHyusLg.exe
  2⤵
  PID:13160
- C:\Windows\System\pLMUgGQ.exe
  C:\Windows\System\pLMUgGQ.exe
  2⤵
  PID:13280
- C:\Windows\System\TXeDGAe.exe
  C:\Windows\System\TXeDGAe.exe
  2⤵
  PID:13276
- C:\Windows\System\BIcylSS.exe
  C:\Windows\System\BIcylSS.exe
  2⤵
  PID:12536
- C:\Windows\System\ZjeZxOY.exe
  C:\Windows\System\ZjeZxOY.exe
  2⤵
  PID:12724
- C:\Windows\System\ACnvLhv.exe
  C:\Windows\System\ACnvLhv.exe
  2⤵
  PID:12768
- C:\Windows\System\TwpPUoA.exe
  C:\Windows\System\TwpPUoA.exe
  2⤵
  PID:12792
- C:\Windows\System\KROOSrG.exe
  C:\Windows\System\KROOSrG.exe
  2⤵
  PID:13076
- C:\Windows\System\LQHnIOw.exe
  C:\Windows\System\LQHnIOw.exe
  2⤵
  PID:13252
- C:\Windows\System\LbhOfgm.exe
  C:\Windows\System\LbhOfgm.exe
  2⤵
  PID:11676
- C:\Windows\System\ypqTlAb.exe
  C:\Windows\System\ypqTlAb.exe
  2⤵
  PID:12716
- C:\Windows\System\akALtZR.exe
  C:\Windows\System\akALtZR.exe
  2⤵
  PID:13184
- C:\Windows\System\BHyUXnr.exe
  C:\Windows\System\BHyUXnr.exe
  2⤵
  PID:12600
- C:\Windows\System\NogyMBU.exe
  C:\Windows\System\NogyMBU.exe
  2⤵
  PID:13332
- C:\Windows\System\oJrouuM.exe
  C:\Windows\System\oJrouuM.exe
  2⤵
  PID:13356
- C:\Windows\System\ODnLfsr.exe
  C:\Windows\System\ODnLfsr.exe
  2⤵
  PID:13380
- C:\Windows\System\WshPOoh.exe
  C:\Windows\System\WshPOoh.exe
  2⤵
  PID:13420
- C:\Windows\System\BOmcbpv.exe
  C:\Windows\System\BOmcbpv.exe
  2⤵
  PID:13436
- C:\Windows\System\uxyFMsM.exe
  C:\Windows\System\uxyFMsM.exe
  2⤵
  PID:13488
- C:\Windows\System\gpGGFvC.exe
  C:\Windows\System\gpGGFvC.exe
  2⤵
  PID:13524
- C:\Windows\System\uVOCTkR.exe
  C:\Windows\System\uVOCTkR.exe
  2⤵
  PID:13552
- C:\Windows\System\gqiFvef.exe
  C:\Windows\System\gqiFvef.exe
  2⤵
  PID:13576
- C:\Windows\System\DJuithr.exe
  C:\Windows\System\DJuithr.exe
  2⤵
  PID:13624
- C:\Windows\System\zyQXSoY.exe
  C:\Windows\System\zyQXSoY.exe
  2⤵
  PID:13652
- C:\Windows\System\qLVFbZc.exe
  C:\Windows\System\qLVFbZc.exe
  2⤵
  PID:13668
- C:\Windows\System\xVQYvDr.exe
  C:\Windows\System\xVQYvDr.exe
  2⤵
  PID:13684
- C:\Windows\System\rqyQYrQ.exe
  C:\Windows\System\rqyQYrQ.exe
  2⤵
  PID:13704
- C:\Windows\System\hgrmOlj.exe
  C:\Windows\System\hgrmOlj.exe
  2⤵
  PID:13736
- C:\Windows\System\MYgStZF.exe
  C:\Windows\System\MYgStZF.exe
  2⤵
  PID:13756
- C:\Windows\System\bvYTLxd.exe
  C:\Windows\System\bvYTLxd.exe
  2⤵
  PID:13772
- C:\Windows\System\jNsamPj.exe
  C:\Windows\System\jNsamPj.exe
  2⤵
  PID:13796
- C:\Windows\System\KyNJiky.exe
  C:\Windows\System\KyNJiky.exe
  2⤵
  PID:13848
- C:\Windows\System\jBxgtcL.exe
  C:\Windows\System\jBxgtcL.exe
  2⤵
  PID:13876
- C:\Windows\System\cKXNtll.exe
  C:\Windows\System\cKXNtll.exe
  2⤵
  PID:13896
- C:\Windows\System\FMoLgIY.exe
  C:\Windows\System\FMoLgIY.exe
  2⤵
  PID:13944
- C:\Windows\System\tOcNklM.exe
  C:\Windows\System\tOcNklM.exe
  2⤵
  PID:13968
- C:\Windows\System\LkclPaE.exe
  C:\Windows\System\LkclPaE.exe
  2⤵
  PID:14012
- C:\Windows\System\QLMeSwN.exe
  C:\Windows\System\QLMeSwN.exe
  2⤵
  PID:14040
- C:\Windows\System\OzIGYcJ.exe
  C:\Windows\System\OzIGYcJ.exe
  2⤵
  PID:14056
- C:\Windows\System\vLNenTY.exe
  C:\Windows\System\vLNenTY.exe
  2⤵
  PID:14076
- C:\Windows\System\OZDDtYp.exe
  C:\Windows\System\OZDDtYp.exe
  2⤵
  PID:14116
- C:\Windows\System\MenQNSv.exe
  C:\Windows\System\MenQNSv.exe
  2⤵
  PID:14164
- C:\Windows\System\muVmfdF.exe
  C:\Windows\System\muVmfdF.exe
  2⤵
  PID:14204
- C:\Windows\System\sKiAJYM.exe
  C:\Windows\System\sKiAJYM.exe
  2⤵
  PID:14220
- C:\Windows\System\FjRecYm.exe
  C:\Windows\System\FjRecYm.exe
  2⤵
  PID:14236
- C:\Windows\System\GVMiJZL.exe
  C:\Windows\System\GVMiJZL.exe
  2⤵
  PID:14252
- C:\Windows\System\JKYkPeU.exe
  C:\Windows\System\JKYkPeU.exe
  2⤵
  PID:14276
- C:\Windows\System\LmOhJBo.exe
  C:\Windows\System\LmOhJBo.exe
  2⤵
  PID:14320
- C:\Windows\System\RDUhGeU.exe
  C:\Windows\System\RDUhGeU.exe
  2⤵
  PID:12388
- C:\Windows\System\xTcECnJ.exe
  C:\Windows\System\xTcECnJ.exe
  2⤵
  PID:13368
- C:\Windows\System\NckNQoD.exe
  C:\Windows\System\NckNQoD.exe
  2⤵
  PID:13432
- C:\Windows\System\YrRtVLy.exe
  C:\Windows\System\YrRtVLy.exe
  2⤵
  PID:13480
- C:\Windows\System\rEOyycY.exe
  C:\Windows\System\rEOyycY.exe
  2⤵
  PID:13536
- C:\Windows\System\bxSufdF.exe
  C:\Windows\System\bxSufdF.exe
  2⤵
  PID:13620
- C:\Windows\System\SNMnUXI.exe
  C:\Windows\System\SNMnUXI.exe
  2⤵
  PID:13680
- C:\Windows\System\shrnpja.exe
  C:\Windows\System\shrnpja.exe
  2⤵
  PID:13732
- C:\Windows\System\BlwynVT.exe
  C:\Windows\System\BlwynVT.exe
  2⤵
  PID:13792
- C:\Windows\System\ZZeKRPJ.exe
  C:\Windows\System\ZZeKRPJ.exe
  2⤵
  PID:13888
- C:\Windows\System\OVYCFsB.exe
  C:\Windows\System\OVYCFsB.exe
  2⤵
  PID:13960
- C:\Windows\System\rePONwt.exe
  C:\Windows\System\rePONwt.exe
  2⤵
  PID:14032
- C:\Windows\System\CZSzffE.exe
  C:\Windows\System\CZSzffE.exe
  2⤵
  PID:14124
- C:\Windows\System\uFWpZaY.exe
  C:\Windows\System\uFWpZaY.exe
  2⤵
  PID:14156
- C:\Windows\System\gQcthvO.exe
  C:\Windows\System\gQcthvO.exe
  2⤵
  PID:14200
- C:\Windows\System\JLDDQFF.exe
  C:\Windows\System\JLDDQFF.exe
  2⤵
  PID:14232
- C:\Windows\System\AEgPuoI.exe
  C:\Windows\System\AEgPuoI.exe
  2⤵
  PID:13324
- C:\Windows\System\MrMtiYR.exe
  C:\Windows\System\MrMtiYR.exe
  2⤵
  PID:6684
- C:\Windows\System\uEfCuuA.exe
  C:\Windows\System\uEfCuuA.exe
  2⤵
  PID:13600
- C:\Windows\System\mtnKYIQ.exe
  C:\Windows\System\mtnKYIQ.exe
  2⤵
  PID:13784
- C:\Windows\System\jZUWcFP.exe
  C:\Windows\System\jZUWcFP.exe
  2⤵
  PID:13924
- C:\Windows\System\pcnzzSD.exe
  C:\Windows\System\pcnzzSD.exe
  2⤵
  PID:14048
- C:\Windows\System\FXMvAHh.exe
  C:\Windows\System\FXMvAHh.exe
  2⤵
  PID:14272
- C:\Windows\System\AxdzMJT.exe
  C:\Windows\System\AxdzMJT.exe
  2⤵
  PID:13592
- C:\Windows\System\TxGukXA.exe
  C:\Windows\System\TxGukXA.exe
  2⤵
  PID:13768
- C:\Windows\System\yitiDAB.exe
  C:\Windows\System\yitiDAB.exe
  2⤵
  PID:14300
- C:\Windows\System\lCdbkAo.exe
  C:\Windows\System\lCdbkAo.exe
  2⤵
  PID:14008
- C:\Windows\System\wwtMPrR.exe
  C:\Windows\System\wwtMPrR.exe
  2⤵
  PID:14352
- C:\Windows\System\jezZsMN.exe
  C:\Windows\System\jezZsMN.exe
  2⤵
  PID:14372
- C:\Windows\System\PKAhPvo.exe
  C:\Windows\System\PKAhPvo.exe
  2⤵
  PID:14396
- C:\Windows\System\dYSNPhp.exe
  C:\Windows\System\dYSNPhp.exe
  2⤵
  PID:14420
- C:\Windows\System\dCEIgCj.exe
  C:\Windows\System\dCEIgCj.exe
  2⤵
  PID:14452
- C:\Windows\System\iwxGxtb.exe
  C:\Windows\System\iwxGxtb.exe
  2⤵
  PID:14472
- C:\Windows\System\MfGXRfX.exe
  C:\Windows\System\MfGXRfX.exe
  2⤵
  PID:14516
- C:\Windows\System\RMefcoj.exe
  C:\Windows\System\RMefcoj.exe
  2⤵
  PID:14548
- C:\Windows\System\bxQhlCr.exe
  C:\Windows\System\bxQhlCr.exe
  2⤵
  PID:14568
- C:\Windows\System\aBXFwwI.exe
  C:\Windows\System\aBXFwwI.exe
  2⤵
  PID:14592
- C:\Windows\System\prYJTJA.exe
  C:\Windows\System\prYJTJA.exe
  2⤵
  PID:14620
- C:\Windows\System\kdSYuEl.exe
  C:\Windows\System\kdSYuEl.exe
  2⤵
  PID:14648
- C:\Windows\System\DzVNSdv.exe
  C:\Windows\System\DzVNSdv.exe
  2⤵
  PID:14692
- C:\Windows\System\DrLXyoo.exe
  C:\Windows\System\DrLXyoo.exe
  2⤵
  PID:14732
- C:\Windows\System\bkoUuFX.exe
  C:\Windows\System\bkoUuFX.exe
  2⤵
  PID:14748
- C:\Windows\System\tAUJdfl.exe
  C:\Windows\System\tAUJdfl.exe
  2⤵
  PID:14776
- C:\Windows\System\yVIQDCY.exe
  C:\Windows\System\yVIQDCY.exe
  2⤵
  PID:14812
- C:\Windows\System\dadHdQU.exe
  C:\Windows\System\dadHdQU.exe
  2⤵
  PID:14844
- C:\Windows\System\sUgtmQC.exe
  C:\Windows\System\sUgtmQC.exe
  2⤵
  PID:14860
- C:\Windows\System\ujcDfMk.exe
  C:\Windows\System\ujcDfMk.exe
  2⤵
  PID:14876
- C:\Windows\System\bDZbWmC.exe
  C:\Windows\System\bDZbWmC.exe
  2⤵
  PID:14892
- C:\Windows\System\ugdkcUm.exe
  C:\Windows\System\ugdkcUm.exe
  2⤵
  PID:14960
- C:\Windows\System\gVLzlFA.exe
  C:\Windows\System\gVLzlFA.exe
  2⤵
  PID:14976
- C:\Windows\System\ZDnyVya.exe
  C:\Windows\System\ZDnyVya.exe
  2⤵
  PID:14992
- C:\Windows\System\EnfOdDf.exe
  C:\Windows\System\EnfOdDf.exe
  2⤵
  PID:15016
- C:\Windows\System\HLmUtct.exe
  C:\Windows\System\HLmUtct.exe
  2⤵
  PID:15036
- C:\Windows\System\jKxoVbT.exe
  C:\Windows\System\jKxoVbT.exe
  2⤵
  PID:15060
- C:\Windows\System\IebLCoW.exe
  C:\Windows\System\IebLCoW.exe
  2⤵
  PID:15092
- C:\Windows\System\SeOXbFY.exe
  C:\Windows\System\SeOXbFY.exe
  2⤵
  PID:15140
- C:\Windows\System\jeqyYDK.exe
  C:\Windows\System\jeqyYDK.exe
  2⤵
  PID:15160
- C:\Windows\System\HcxydFd.exe
  C:\Windows\System\HcxydFd.exe
  2⤵
  PID:15188
- C:\Windows\System\AhFnoXD.exe
  C:\Windows\System\AhFnoXD.exe
  2⤵
  PID:15212
- C:\Windows\System\OdUsUBX.exe
  C:\Windows\System\OdUsUBX.exe
  2⤵
  PID:15248
- C:\Windows\System\nRMralP.exe
  C:\Windows\System\nRMralP.exe
  2⤵
  PID:15276
- C:\Windows\System\AOTdyvf.exe
  C:\Windows\System\AOTdyvf.exe
  2⤵
  PID:15300
- C:\Windows\System\dqNocET.exe
  C:\Windows\System\dqNocET.exe
  2⤵
  PID:15328
- C:\Windows\System\YHUsNdp.exe
  C:\Windows\System\YHUsNdp.exe
  2⤵
  PID:15348
- C:\Windows\System\UcmzSed.exe
  C:\Windows\System\UcmzSed.exe
  2⤵
  PID:14104
- C:\Windows\System\BHYniCV.exe
  C:\Windows\System\BHYniCV.exe
  2⤵
  PID:14348
- C:\Windows\System\YiEXagW.exe
  C:\Windows\System\YiEXagW.exe
  2⤵
  PID:14408
- C:\Windows\System\ojThIwM.exe
  C:\Windows\System\ojThIwM.exe
  2⤵
  PID:14508
- C:\Windows\System\NVIrmFM.exe
  C:\Windows\System\NVIrmFM.exe
  2⤵
  PID:14564
- C:\Windows\System\qYpvnms.exe
  C:\Windows\System\qYpvnms.exe
  2⤵
  PID:14640
- C:\Windows\System\gdQlTbL.exe
  C:\Windows\System\gdQlTbL.exe
  2⤵
  PID:14744
- C:\Windows\System\FdfxigF.exe
  C:\Windows\System\FdfxigF.exe
  2⤵
  PID:14804
- C:\Windows\System\QFGpgCk.exe
  C:\Windows\System\QFGpgCk.exe
  2⤵
  PID:14832
- C:\Windows\System\KaMhpVT.exe
  C:\Windows\System\KaMhpVT.exe
  2⤵
  PID:14932
- C:\Windows\System\SQelOqz.exe
  C:\Windows\System\SQelOqz.exe
  2⤵
  PID:15012
- C:\Windows\System\UhaSCsQ.exe
  C:\Windows\System\UhaSCsQ.exe
  2⤵
  PID:15084
- C:\Windows\System\XiabQSy.exe
  C:\Windows\System\XiabQSy.exe
  2⤵
  PID:14148
- C:\Windows\System\AcWDqKM.exe
  C:\Windows\System\AcWDqKM.exe
  2⤵
  PID:15196
- C:\Windows\System\eRmJyXe.exe
  C:\Windows\System\eRmJyXe.exe
  2⤵
  PID:15236
- C:\Windows\System\sJAbHVH.exe
  C:\Windows\System\sJAbHVH.exe
  2⤵
  PID:15260
- C:\Windows\System\eluqtzN.exe
  C:\Windows\System\eluqtzN.exe
  2⤵
  PID:15324
- C:\Windows\System\eGjAFNJ.exe
  C:\Windows\System\eGjAFNJ.exe
  2⤵
  PID:14340
- C:\Windows\System\jGQRhFW.exe
  C:\Windows\System\jGQRhFW.exe
  2⤵
  PID:14484
- C:\Windows\System\SPVYbTb.exe
  C:\Windows\System\SPVYbTb.exe
  2⤵
  PID:14660
- C:\Windows\System\VCsalth.exe
  C:\Windows\System\VCsalth.exe
  2⤵
  PID:14788
- C:\Windows\System\rkxtyzK.exe
  C:\Windows\System\rkxtyzK.exe
  2⤵
  PID:15072
- C:\Windows\System\RnsBNkL.exe
  C:\Windows\System\RnsBNkL.exe
  2⤵
  PID:15272
- C:\Windows\System\MHMwZAP.exe
  C:\Windows\System\MHMwZAP.exe
  2⤵
  PID:14636
- C:\Windows\System\RisSCLz.exe
  C:\Windows\System\RisSCLz.exe
  2⤵
  PID:14908
- C:\Windows\System\XSlqsmi.exe
  C:\Windows\System\XSlqsmi.exe
  2⤵
  PID:14412
- C:\Windows\System\eptGFEA.exe
  C:\Windows\System\eptGFEA.exe
  2⤵
  PID:15044
- C:\Windows\System\SpOHasf.exe
  C:\Windows\System\SpOHasf.exe
  2⤵
  PID:15364
- C:\Windows\System\tLhunKW.exe
  C:\Windows\System\tLhunKW.exe
  2⤵
  PID:15392
- C:\Windows\System\yaWEiSw.exe
  C:\Windows\System\yaWEiSw.exe
  2⤵
  PID:15416
- C:\Windows\System\UKVTOqf.exe
  C:\Windows\System\UKVTOqf.exe
  2⤵
  PID:15448
- C:\Windows\System\IvLAkkq.exe
  C:\Windows\System\IvLAkkq.exe
  2⤵
  PID:15468
- C:\Windows\System\VrJrNMr.exe
  C:\Windows\System\VrJrNMr.exe
  2⤵
  PID:15488
- C:\Windows\System\VYaPvkM.exe
  C:\Windows\System\VYaPvkM.exe
  2⤵
  PID:15528
- C:\Windows\System\ZhogWrB.exe
  C:\Windows\System\ZhogWrB.exe
  2⤵
  PID:15552
- C:\Windows\System\cqJamvi.exe
  C:\Windows\System\cqJamvi.exe
  2⤵
  PID:15572
- C:\Windows\System\TbKTQUO.exe
  C:\Windows\System\TbKTQUO.exe
  2⤵
  PID:15592
- C:\Windows\System\GbDjawB.exe
  C:\Windows\System\GbDjawB.exe
  2⤵
  PID:15620
- C:\Windows\System\vCyOjsB.exe
  C:\Windows\System\vCyOjsB.exe
  2⤵
  PID:15636
- C:\Windows\System\kJsylLm.exe
  C:\Windows\System\kJsylLm.exe
  2⤵
  PID:15660
- C:\Windows\System\rfFLpmB.exe
  C:\Windows\System\rfFLpmB.exe
  2⤵
  PID:15692
- C:\Windows\System\PkUZKGH.exe
  C:\Windows\System\PkUZKGH.exe
  2⤵
  PID:15708
- C:\Windows\System\PVUWwkZ.exe
  C:\Windows\System\PVUWwkZ.exe
  2⤵
  PID:15724
- C:\Windows\System\uqMOVpm.exe
  C:\Windows\System\uqMOVpm.exe
  2⤵
  PID:15748
- C:\Windows\System\ypQGoWK.exe
  C:\Windows\System\ypQGoWK.exe
  2⤵
  PID:15772
- C:\Windows\System\iaqTEnS.exe
  C:\Windows\System\iaqTEnS.exe
  2⤵
  PID:15792
- C:\Windows\System\INGiokL.exe
  C:\Windows\System\INGiokL.exe
  2⤵
  PID:15816
- C:\Windows\System\VZARIRl.exe
  C:\Windows\System\VZARIRl.exe
  2⤵
  PID:15832
- C:\Windows\System\jzgNrRG.exe
  C:\Windows\System\jzgNrRG.exe
  2⤵
  PID:15848
- C:\Windows\System\LBWTqzY.exe
  C:\Windows\System\LBWTqzY.exe
  2⤵
  PID:15864
- C:\Windows\System\VpHjZVU.exe
  C:\Windows\System\VpHjZVU.exe
  2⤵
  PID:15880
- C:\Windows\System\ZYxouYn.exe
  C:\Windows\System\ZYxouYn.exe
  2⤵
  PID:15908
- C:\Windows\System\cRLqyhF.exe
  C:\Windows\System\cRLqyhF.exe
  2⤵
  PID:15932
- C:\Windows\System\HboIzSk.exe
  C:\Windows\System\HboIzSk.exe
  2⤵
  PID:15948
- C:\Windows\System\GZaNNuG.exe
  C:\Windows\System\GZaNNuG.exe
  2⤵
  PID:15964
- C:\Windows\System\ivxodsk.exe
  C:\Windows\System\ivxodsk.exe
  2⤵
  PID:15988
- C:\Windows\System\znMbsQZ.exe
  C:\Windows\System\znMbsQZ.exe
  2⤵
  PID:16004
- C:\Windows\System\YNrpzyw.exe
  C:\Windows\System\YNrpzyw.exe
  2⤵
  PID:16020
- C:\Windows\System\uxazZqW.exe
  C:\Windows\System\uxazZqW.exe
  2⤵
  PID:16044
- C:\Windows\System\rIbxzQv.exe
  C:\Windows\System\rIbxzQv.exe
  2⤵
  PID:16064
- C:\Windows\System\dmtrDfE.exe
  C:\Windows\System\dmtrDfE.exe
  2⤵
  PID:16080
- C:\Windows\System\DRHvSWW.exe
  C:\Windows\System\DRHvSWW.exe
  2⤵
  PID:16112
- C:\Windows\System\LyeFHQw.exe
  C:\Windows\System\LyeFHQw.exe
  2⤵
  PID:16136
- C:\Windows\System\GVAtwCK.exe
  C:\Windows\System\GVAtwCK.exe
  2⤵
  PID:16164
- C:\Windows\System\GhnSacz.exe
  C:\Windows\System\GhnSacz.exe
  2⤵
  PID:16188
- C:\Windows\System\QcosnEn.exe
  C:\Windows\System\QcosnEn.exe
  2⤵
  PID:16204
- C:\Windows\System\EuhTiTQ.exe
  C:\Windows\System\EuhTiTQ.exe
  2⤵
  PID:16236
- C:\Windows\System\bgEiIOc.exe
  C:\Windows\System\bgEiIOc.exe
  2⤵
  PID:16260
- C:\Windows\System\UMRWNvM.exe
  C:\Windows\System\UMRWNvM.exe
  2⤵
  PID:16276
- C:\Windows\System\qVZzJHv.exe
  C:\Windows\System\qVZzJHv.exe
  2⤵
  PID:16292
- C:\Windows\System\xuUYSQj.exe
  C:\Windows\System\xuUYSQj.exe
  2⤵
  PID:16320
- C:\Windows\System\STgWaJk.exe
  C:\Windows\System\STgWaJk.exe
  2⤵
  PID:16340
- C:\Windows\System\RlTRqQn.exe
  C:\Windows\System\RlTRqQn.exe
  2⤵
  PID:16360
- C:\Windows\System\eoyQdET.exe
  C:\Windows\System\eoyQdET.exe
  2⤵
  PID:16380
- C:\Windows\System\mGbPBIJ.exe
  C:\Windows\System\mGbPBIJ.exe
  2⤵
  PID:15388
- C:\Windows\System\bkYolpG.exe
  C:\Windows\System\bkYolpG.exe
  2⤵
  PID:15444
- C:\Windows\System\pIvCxgI.exe
  C:\Windows\System\pIvCxgI.exe
  2⤵
  PID:15500
- C:\Windows\System\iaPkdBA.exe
  C:\Windows\System\iaPkdBA.exe
  2⤵
  PID:15548
- C:\Windows\System\zJGqMKb.exe
  C:\Windows\System\zJGqMKb.exe
  2⤵
  PID:15648
- C:\Windows\System\BMIWkeg.exe
  C:\Windows\System\BMIWkeg.exe
  2⤵
  PID:15716
- C:\Windows\System\TnvhJsU.exe
  C:\Windows\System\TnvhJsU.exe
  2⤵
  PID:15768
- C:\Windows\System\OySMchC.exe
  C:\Windows\System\OySMchC.exe
  2⤵
  PID:15764
- C:\Windows\System\cTQiXvL.exe
  C:\Windows\System\cTQiXvL.exe
  2⤵
  PID:3844
- C:\Windows\System\QsvGOtN.exe
  C:\Windows\System\QsvGOtN.exe
  2⤵
  PID:15856
- C:\Windows\System\gcNixJz.exe
  C:\Windows\System\gcNixJz.exe
  2⤵
  PID:15876
- C:\Windows\System\VXxTDEN.exe
  C:\Windows\System\VXxTDEN.exe
  2⤵
  PID:16072
- C:\Windows\System\TWbgvQT.exe
  C:\Windows\System\TWbgvQT.exe
  2⤵
  PID:15840
- C:\Windows\System\QTqLtKj.exe
  C:\Windows\System\QTqLtKj.exe
  2⤵
  PID:16220
- C:\Windows\System\hvyrfdq.exe
  C:\Windows\System\hvyrfdq.exe
  2⤵
  PID:15900
- C:\Windows\System\AtFApmo.exe
  C:\Windows\System\AtFApmo.exe
  2⤵
  PID:16348
- C:\Windows\System\GjbkgRc.exe
  C:\Windows\System\GjbkgRc.exe
  2⤵
  PID:15960
- C:\Windows\System\GmmPZqb.exe
  C:\Windows\System\GmmPZqb.exe
  2⤵
  PID:16196
- C:\Windows\System\TaByVPv.exe
  C:\Windows\System\TaByVPv.exe
  2⤵
  PID:15672
- C:\Windows\System\pgGeCcD.exe
  C:\Windows\System\pgGeCcD.exe
  2⤵
  PID:16256
- C:\Windows\System\uMwfsWf.exe
  C:\Windows\System\uMwfsWf.exe
  2⤵
  PID:16392
- C:\Windows\System\ZfTzKzp.exe
  C:\Windows\System\ZfTzKzp.exe
  2⤵
  PID:16408
- C:\Windows\System\iuUUKmg.exe
  C:\Windows\System\iuUUKmg.exe
  2⤵
  PID:16424
- C:\Windows\System\RNqQLma.exe
  C:\Windows\System\RNqQLma.exe
  2⤵
  PID:16440
- C:\Windows\System\tNUMsTj.exe
  C:\Windows\System\tNUMsTj.exe
  2⤵
  PID:16456
- C:\Windows\System\wmqbQTP.exe
  C:\Windows\System\wmqbQTP.exe
  2⤵
  PID:16480
- C:\Windows\System\wzfknfo.exe
  C:\Windows\System\wzfknfo.exe
  2⤵
  PID:16512
- C:\Windows\System\dNUxwjy.exe
  C:\Windows\System\dNUxwjy.exe
  2⤵
  PID:16536
- C:\Windows\System\euyScni.exe
  C:\Windows\System\euyScni.exe
  2⤵
  PID:16616
- C:\Windows\System\VmEHach.exe
  C:\Windows\System\VmEHach.exe
  2⤵
  PID:16632
- C:\Windows\System\tnCXBxF.exe
  C:\Windows\System\tnCXBxF.exe
  2⤵
  PID:16652
- C:\Windows\System\KLTfTgy.exe
  C:\Windows\System\KLTfTgy.exe
  2⤵
  PID:16672
- C:\Windows\System\KEpSHIt.exe
  C:\Windows\System\KEpSHIt.exe
  2⤵
  PID:16688
- C:\Windows\System\MeBuYGK.exe
  C:\Windows\System\MeBuYGK.exe
  2⤵
  PID:16704
- C:\Windows\System\EHgNGZY.exe
  C:\Windows\System\EHgNGZY.exe
  2⤵
  PID:16720
- C:\Windows\System\hjyocbW.exe
  C:\Windows\System\hjyocbW.exe
  2⤵
  PID:16736
- C:\Windows\System\LyUmwvs.exe
  C:\Windows\System\LyUmwvs.exe
  2⤵
  PID:17260
- C:\Windows\System\LTTOfdI.exe
  C:\Windows\System\LTTOfdI.exe
  2⤵
  PID:17276

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BkSEgLw.exe

Filesize
1.4MB

MD5
19f2a813377bfd6274ddebb57140c645

SHA1
b337e6f1dfdcf9bd62aee94361485e2c53f54b37

SHA256
e0e789de012005ce055c86dfbf1ef28c44556b27ab0ef3c7811cbf2ddd43a813

SHA512
fa52899a1b46da599c5fca1945da46b88b91fa9e1e5f8bd1baa758455a0c8fc45431ced38f82fc2da8cec41a786a826ae8251c12b238299d4598d0f0cb906480

Download Submit
C:\Windows\System\IIyBVNm.exe

Filesize
1.4MB

MD5
949497bbcf51c466350ff7da241086ea

SHA1
69a4d91495fa8c597ec1c26f99301b6bf46eba11

SHA256
32b17a9c7a021d9c63f98d5ea1f69e362516d13f53b3929bb69ed384e7b2e97d

SHA512
5a8b5b81be4f2044dab0ce2fe917bac31ae86dfa5e6fb56e0fa13c1614c1400609cc9f832f08ddfd8f8f77c61bc433097b44dd2855f2b5ed3b2df85631570e8a

Download Submit
C:\Windows\System\JEtarNu.exe

Filesize
1.4MB

MD5
207dafc3acc3f172fc0767bc34fc3631

SHA1
0d43cf6ac2a6ea272789eb435e0e8d6e9f01782b

SHA256
3f0fa4a529b2f5d16b3feb16e970fd9f2e7a131390b297ce759a83115fdc77a1

SHA512
383233f538811c358c7cbaf1a9f46fa05f0c6824db43ed2102d2d6036eafc7094e19b376e7fabc2cbd1d06c7edcbeb64e0f5b8f8a0fc1a12661a7d055a1a0a8d

Download Submit
C:\Windows\System\KPKkFDA.exe

Filesize
1.4MB

MD5
e971b4f1b71808dfbd5ef1202172f1e6

SHA1
a2da69554bbdf91521b54c031176c928c083d8a3

SHA256
53538da8c0cec73153c5ddec30167c856724e49f930d95c54c41dbab35d80667

SHA512
b591026c756aabd3acd589339e01b9918a8624c91fc4ede0d87704bbd8910207dbecb7e2d61402b68b87436004296ffb07a272e2cbacfbf70859b9dc06f4e9ea

Download Submit
C:\Windows\System\KcGBYbX.exe

Filesize
1.4MB

MD5
4c52bbddceeabe40b2fb4a608d57d352

SHA1
eb8eed9254dbb05062f8d28aee83a19786ff13a4

SHA256
948321c6c143b8b6fff846191371654d838ea5359b64804c2c24b7267922dc37

SHA512
bb8ddcbe276df1c83ae9f69cc6620744373c5fd8fd01ca442ddebd0dabc295d07c724521dab638a319b4d5a2513bf3b55357fa669d38dce8d07a8ff590ce8e03

Download Submit
C:\Windows\System\LsQOlco.exe

Filesize
1.4MB

MD5
7461c0fd61cb1f150aa5f69c772c5909

SHA1
f58f2165db3193991a60617add6e64582d50e55a

SHA256
d992da9fc70192e74637cb4455de7b259df4830b9a6c8d2b7f22ec6e07fac03c

SHA512
31b7c4e7991651c04d5b1403128d93ebca274d8dd1f37218aa703a1c8a65d67064ac2edbe7d9c8cc8055b0a9e3b23fe4059e3606966657256ad0fb333bf5bf4f

Download Submit
C:\Windows\System\MqOfHek.exe

Filesize
1.4MB

MD5
17abbe43e8019563ec1c8e909c9d6080

SHA1
22c51db7a1e9234519f4883daa9c56ac9733b0ec

SHA256
343c277a11c28fa5cdd7c03a52503176807112beec2cffa7cba853dc53ec6874

SHA512
32215e2bdae239423b065673d4c866fcb16fce2ca6b14d67457fad48b2b3c9856e45f68cb243f66ec1cb4f9e428f70833dc761f682e3335ce4f1d86e24c5165c

Download Submit
C:\Windows\System\PJunfEq.exe

Filesize
1.4MB

MD5
343ec222e504f5a2463426e6c6d46cac

SHA1
529e1c025d485aa3c051935fb1b8897febc13295

SHA256
249701c46afdd4aba6d7ed54f5af68abe221404bf876e50e18c918f6c6495cd2

SHA512
b27cd7e874d4552c3890cc1a0d55efecbf30bf2f0aaf2445b2732ee9d1dd704fffa253a3bd33ac29c85200378fc6b895782f3b66876f1f7c3aae5df803483fac

Download Submit
C:\Windows\System\PSixeFy.exe

Filesize
1.4MB

MD5
b78c5942449765e2c7bedcfd43aab07a

SHA1
d165b4cc7afda814106e1b6255de8b55ade322f2

SHA256
00fa394522a03072c37ca80a3bee4239f8c216f07138c038a00ec4e893e49449

SHA512
f19357b04f22fbf4527a0b4caecea90fc10385bd0d1de5c4eae46d504ec664f1dd0f9b07b20e960c73b070b8304bead2ea853cb46b50120933389a0931481214

Download Submit
C:\Windows\System\SaDcgRZ.exe

Filesize
1.4MB

MD5
6c12e720c42bca196d40b47f5fb21601

SHA1
a2cd4a03eee0b968ed623fee971f122d693c3dd2

SHA256
a00caaa7da03f31b2a7664b18d63235161f4b3228a21e1bb71c2fe7f9e0f2f00

SHA512
5f7e82e1ef76f82533334e48450499ed1e98315bd6c3880706308250ce8e5d710b369e3b977f90ac3a4a7dc0b9e133d2509a44193ca312c1a5eb11ab77c62020

Download Submit
C:\Windows\System\SqEKSyk.exe

Filesize
1.4MB

MD5
ea4176a01975a7e00fa40f88786adeb9

SHA1
a5e9f71abbae1bc9e6bb61add37c41b9e51ac888

SHA256
80bbbbacf08320e228456b95afb83b969599ed84b8129cc64f141fcb5b686521

SHA512
29eaac7f7dc84a22a9a163a7bbdcc678ba145bc3e28759ddae1b86dcf132b29342fff6808e61faef2d4892c083cb43b14a7107302b3f42992986f8b89e6378fb

Download Submit
C:\Windows\System\TAsnbLH.exe

Filesize
1.4MB

MD5
1daa25e61e0efdd21d24c6f1e6cf4610

SHA1
f1a5f6eca500f6de1305b61fecf7adb2cd0c36dd

SHA256
4867da884cf2fd47910b8fe6c1526d380c41f9b94fde3e53da908ea9023db92d

SHA512
af1a1e3b98c3996ecc622f90fccf2dc0ef351e56b2dbaf71d3160c83f3626502118987aee38c46c38f732fbb4e8218f2a1a3fcd0b2e235d734d9301ed5196f10

Download Submit
C:\Windows\System\TBJQTJp.exe

Filesize
1.4MB

MD5
c411cc8292cda934835f69f9872b9529

SHA1
d008c29d0a0d0b2ebf9c8d28a6255d7bb68b17dc

SHA256
e9acc7371c50bce845152e067937d7e88cc165eed217e65556c5a5eda9ffff4f

SHA512
273bb1b4e8b233e040afd066a7ac911df4c0e015da07accf0a42e9490f33c1ebbb68b036a1b2a6b7d2d49186810f3b2583e0852ee0e5c81345fa3484068b63a7

Download Submit
C:\Windows\System\UCxsSvI.exe

Filesize
1.4MB

MD5
6ecc3ab55089f9631d3b1904c3182264

SHA1
a1ee474a549308dc7a01b20658f59b0c2364390f

SHA256
0ccfaddb4c5d84042d50982385f8361d479c1041871521cc4f4916fb5e29fe82

SHA512
e4713baf8acf091f724d31975a3b601ca0f21ca51365f00fe7422d6f38a3b6898e42c07dcc24170bc7be11936a4bb8c3db3117c13e7c67e044abe0328c1a11d6

Download Submit
C:\Windows\System\UjdIYzT.exe

Filesize
1.4MB

MD5
2898abc860b6de02706422abb09ee623

SHA1
7b8bd50fa0beb52d86e507e972070c15c606a153

SHA256
11ee7e39035de53c200a427ffb7df85c92e02c1bff1f75eabb07ad3c33e9f94c

SHA512
510b52bfe9e65caffbd942094ad56301785fd571816c06e49081963df687c34a36b2bd1353a0c2a34bb0c0ebab842db73a510f5c859eea3187f09252f1e964e5

Download Submit
C:\Windows\System\WfwtGNf.exe

Filesize
1.4MB

MD5
9228d75333a5d12aad639c2bb73cae8b

SHA1
cf7e9457fd907a6928582e80aa814d79c82606be

SHA256
acd4cc9c7b6a02af4fd0e668bea85cbf4bc51e27845f62f2b975f343ef00d5d3

SHA512
2c7da29404f2a0d431c3d51115c2323e1f8f18600d0ae24ce25879417b80967d56b3668aeb15f2c3c91f3e8694775c69d2a8ee28b8c3856d2da52e32e662c2e3

Download Submit
C:\Windows\System\WusoFFd.exe

Filesize
1.4MB

MD5
a5e4a164cfe314b2b19f109caf1a5019

SHA1
68a0c6bea5745a0c6d2d6d81de2c3daadad25dd0

SHA256
44f8f2b48682b9e5f929023de4fdaa4d52f8371b7294edb191cc398c08c61a0f

SHA512
15c76904c4ce1c865c67255e5edff836bb36d349ed6384c91f4b6beb4b6251de36bcc6f9abd3b7853e74f2deb19e48caf94bc4a52df4edd8d6b3200da9c2bf4e

Download Submit
C:\Windows\System\XqzPsym.exe

Filesize
1.4MB

MD5
3459c9292cefcaa9cb3103b37f7427d7

SHA1
2f3d003678d3167560bce4e77ba43587d9f7eab1

SHA256
50ce652be26a7c43af05ab75b3f7288cf1fa6424336465e0989ea485aeff027f

SHA512
879441050c6206b5a962a82ea3fdd3aaa765cb9f0f87caf6e0cd732cc4334c649b931314e2623a506a62342643237c21db3378c1d7a81d4541622f20220587ac

Download Submit
C:\Windows\System\fNVpPVq.exe

Filesize
1.4MB

MD5
569b397adb9065c48537603292cc1814

SHA1
292bc5b7f53417c8e373aa0f4d6e8aba70781785

SHA256
5bf5bc8bad85d233b35826d3aa6f1b87cda91bff4f93d5de410386d89d4b7084

SHA512
5633166ba9551112ce9e1206b889d66cf4a7df9d4638c205795d4b40443e80c7a338174a5d0275b03fc1c44a51f297e35f7e38818bd2b480b1382f5ca98163e8

Download Submit
C:\Windows\System\fwRTiSR.exe

Filesize
1.4MB

MD5
39019d8d561e444411621de05ee42ed4

SHA1
c90b3e07340783f46d9e17a7820baf119eec4512

SHA256
eed6bd30363952cf51bdee0439a39305a8287f21db12ee120799d805dad0262d

SHA512
51e49f55a91ffc747d2844b717457194fd4d9724b91317fa4aac9a6e81e4882d00c98e1ac402e3fb59fe87f8d9e10d730cff90ba1d9594f20a8830f196916bbd

Download Submit
C:\Windows\System\kwwrMPo.exe

Filesize
1.4MB

MD5
d451a32a07c82f864fde32fa57b61fc1

SHA1
15682dc7f5df540480e561bb1cd51ac8600f5b81

SHA256
f0fe55ac442aed7fc04ee9f6d13442e79e1354e7482561e652be00d3a94d63f1

SHA512
0d58e5bdab7b5b65571f04c85e043479b5a74ff80eb761e8f7110c171b71f872868fc6ce59946b349fd69d7ddc03c95be3d84261c45feb7e1542a1a879626ab8

Download Submit
C:\Windows\System\pDwJCJU.exe

Filesize
1.4MB

MD5
f6b0dfc0e6d57d591d59bd7752e41e7d

SHA1
4cbcb8e7b60da3741e5c07048297f9abc9c4d190

SHA256
c58dd71a2853d53bcc8b1c89f77d12bf2d849c346cbd7aee6f4c3c0371cc4db3

SHA512
8a85de5f9d07f8bb284d7d4b9d145ba8ca3aad8606ec3508c09e577c6ca1f9b31ffebfbb301de870e2e747c16206a28a3435bb112706e387fff6cb5412df226a

Download Submit
C:\Windows\System\pTCgxQX.exe

Filesize
1.4MB

MD5
e3b4d8be6fb2f64919191aa752c6fd61

SHA1
598fe0292e6040dae1cf879fce338fb7c9718201

SHA256
8da6411aa20bfe66dba3e117b6b2a297e4f5ed0f7b9aa95658e4c914c783a2d7

SHA512
adb477cc7b4c68e4d4ec0ec67c5bd69c4a19e83455814119cd146e2804103a5df4f501eb53ea50ce752769689c5e07aa78111b29607d7f5da14b67dba2bfdbdf

Download Submit
C:\Windows\System\qeOARNs.exe

Filesize
1.4MB

MD5
d678d4a271cf0ef58bd232791da906ce

SHA1
2a5e92fcdad210e2f828b257b2375a61cb9fc697

SHA256
7914290165365473e43d83eab4f47ad4623f9c41dd97a59b579d2fb6cfd3d3db

SHA512
beee96db20d27ab4dae24bbbb2680db3c9a7cb56a095652d63b9c5d8e4bfbf81222d9c11ab391d066a983b019b15b7d34cc403e2060e746c9d08196fd83fa4c3

Download Submit
C:\Windows\System\sEYgCoU.exe

Filesize
1.4MB

MD5
a7607f13d3c1c71cd2af264b71995c08

SHA1
aabdccda151d2ebd502152642b689cca682cce80

SHA256
d103ba119efcbfa01570962b6c2852d4f418b6d8ece8d926c6c7a930cf571ef1

SHA512
2afbe2c981958862d0b133c9aed12ccf26e658a600ba772292aa615e43bdd1fc871f7538847c921123efd7f0d461c7cee961e2706b7e47206d07643dd7c41803

Download Submit
C:\Windows\System\saBdOnp.exe

Filesize
1.4MB

MD5
3600cd95d9f14d4ad777aed1239778bd

SHA1
f02a6d1bd2be181b610f44c617f4df8c63108666

SHA256
f4144b3e792abe34198dc7562e18062b2304478145299f463516b122a8ca15a2

SHA512
75b51972dedd092e394d01fd9373a942271436f1e0b080b96b3645697ab99f0de4446f5237f29a863f4b2c7fef0c40eecfd3145a5c23a5d54f8e5d6fef207b52

Download Submit
C:\Windows\System\tZBNdIx.exe

Filesize
1.4MB

MD5
b622830e3f81885784e4431b9d6dba0f

SHA1
27c4beca81fb5fbfb9d466597da0383c1b38ef67

SHA256
3b1067dab6fb78ed1d31b132159b82996185b26d2dce52e9776b517944cc377e

SHA512
c551e5cc33e7197225cb71bf3507a20442d2ecf6c33787cda366cc0b70212822a9b69a6c8da62d3b0033a92de7beebaed454b7da174f8d60eb3d36a595a61562

Download Submit
C:\Windows\System\tvzJfsT.exe

Filesize
1.4MB

MD5
e794cf3063161aa27e43cce2467d9fa8

SHA1
1ae81c51767a3b954490013add052a23c8c66334

SHA256
3147f2fbdca67c2ccf595df074b5883d82b457687398616ce9e7e0ef2579a015

SHA512
a0e072d2063ed942ca054c7c1dbfa094101e148d3e94938dc8b85b152d8d4a7af11525c71f95dcc27743af8c0914ee4ea61fb0aa2ad3fc5e1e295855a1ffb8b7

Download Submit
C:\Windows\System\vLNzlEW.exe

Filesize
1.4MB

MD5
c467bd8a974a17c644c11819aa16ac7f

SHA1
bf751c46fb274ae59c3882303c7559fc4a75599b

SHA256
6a0af60874cdb5ec908e1c65a103601c0f4c4fb0a110b3c358d24423c485399e

SHA512
ce16183527dd3ef49409bde021829839da49f4fc334e4dfc4f8285b60fbb71a32eb209f779a3fefce728f3f473d0bb4d44beb402703ead9b50b569c613209d13

Download Submit
C:\Windows\System\vgjacJg.exe

Filesize
1.4MB

MD5
6d1269d17eb2c7ce457d92da01b83f8c

SHA1
0924c31ade8fd402ff76207bbdd1094126de127d

SHA256
b6d664f9c2194e2595e1573fd379777169c42ee247297a409266bc729969c9d6

SHA512
820c620667ca0c95be9788ce99f53e495031f098337cf6a11bb7250a6534ca2a0ff7bd277809431eb95b292e3425bcf593aaf4595509bd3f5173a3ef09df643a

Download Submit
C:\Windows\System\vyFJCyZ.exe

Filesize
1.4MB

MD5
24f7467073b8f63232c91f5827af7c80

SHA1
0136d003ffeb7d0456aa76957a119f8a7a6dcaae

SHA256
3f8b98b80d0d749fda86f1f98ae1cd156ba7f034a10fba2cd78b0fc36ea7eebf

SHA512
554bd3be5c02c2f4a5480dfeeeff94681129e32d1f8da7f33ca256d91b8b0ff854f25d4167ba95e12055e3a53235ab7925e81a962863130d90a17ff612191869

Download Submit
C:\Windows\System\xczysNE.exe

Filesize
1.4MB

MD5
4e493e3bd537011a0760d985784cadf7

SHA1
f1bf7daf6fa24cf88ae239736ac2548f33a5f178

SHA256
f94d599663dff05fc86e92fa73fac38f58c9c79473335fb0b25483bfec7fe075

SHA512
e33c6778dbbb7da742cdc7ad7a30ca89ec96e7ec07875a86c18b4c13ecf9aa7e364a91a2bdb6e6ca10aa1a3a45a65f74bb76509e8a7ad959fca45d4b43340105

Download Submit
C:\Windows\System\yBWQZmM.exe

Filesize
1.4MB

MD5
dfa5a3ead02cabcde687e1ccbf6b7e13

SHA1
5ba48ddfb09a333b703dce9ab5272c7704fa9779

SHA256
87ececdb9b87b1821fc6c1f62780c2493d14b696eaae50129f41b3d42bf202dc

SHA512
2744583a6d583363741c2372e00eb35f4066f91b0a2af389e910c67c622a65896029fa3bd641a0c69e389e0bbdcee81594e43dd1185b4371a7643bfd1122ce37

Download Submit
memory/3648-0-0x000001EEF3590000-0x000001EEF35A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads