xmrig | 8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
Size

1.6MB
MD5

db1916cd5e8e8dc9c513b573e5800693
SHA1

2c2dc0d32f44951ceb05130f5349b7e3eb1e67ec
SHA256

8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23
SHA512

839a3e1ca3ec7a623c74e6e655dd85eafd1325bfec19af159a531f8d3f1c6cf2223310efc7883b298f124179ca00ea1dba44f739216d82ad599971c47b64ae7e
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRegkvbAQl:GemTLkNdfE0pZyE

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b0e-4.dat	xmrig
behavioral2/files/0x000a000000023b63-12.dat	xmrig
behavioral2/files/0x000a000000023b65-18.dat	xmrig
behavioral2/files/0x000a000000023b66-31.dat	xmrig
behavioral2/files/0x000a000000023b68-35.dat	xmrig
behavioral2/files/0x000a000000023b67-33.dat	xmrig
behavioral2/files/0x000a000000023b64-20.dat	xmrig
behavioral2/files/0x000a000000023b69-39.dat	xmrig
behavioral2/files/0x000b000000023b60-45.dat	xmrig
behavioral2/files/0x000a000000023b6b-48.dat	xmrig
behavioral2/files/0x000a000000023b6c-54.dat	xmrig
behavioral2/files/0x000a000000023b6d-61.dat	xmrig
behavioral2/files/0x000a000000023b70-76.dat	xmrig
behavioral2/files/0x000a000000023b6f-81.dat	xmrig
behavioral2/files/0x000a000000023b74-88.dat	xmrig
behavioral2/files/0x000a000000023b71-96.dat	xmrig
behavioral2/files/0x000a000000023b79-126.dat	xmrig
behavioral2/files/0x000a000000023b7b-130.dat	xmrig
behavioral2/files/0x000a000000023b7a-128.dat	xmrig
behavioral2/files/0x000a000000023b78-124.dat	xmrig
behavioral2/files/0x0031000000023b77-122.dat	xmrig
behavioral2/files/0x000a000000023b72-119.dat	xmrig
behavioral2/files/0x0031000000023b75-117.dat	xmrig
behavioral2/files/0x000a000000023b73-106.dat	xmrig
behavioral2/files/0x0031000000023b76-100.dat	xmrig
behavioral2/files/0x000a000000023b6e-69.dat	xmrig
behavioral2/files/0x000a000000023b7c-133.dat	xmrig
behavioral2/files/0x000a000000023b7d-139.dat	xmrig
behavioral2/files/0x000a000000023b7e-144.dat	xmrig
behavioral2/files/0x000a000000023b7f-153.dat	xmrig
behavioral2/files/0x000a000000023b81-162.dat	xmrig
behavioral2/files/0x000a000000023b82-161.dat	xmrig
behavioral2/files/0x000a000000023b80-154.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1688	Cyxjdsq.exe
3544	MCVHJSF.exe
1664	aMQEeub.exe
4860	inLdevB.exe
2680	ZEJSzlB.exe
220	iTtUmuy.exe
2432	ksqIJhJ.exe
1740	twQwHsl.exe
2108	zSYTCIM.exe
4544	WUZknXu.exe
4444	IpfPMfG.exe
3116	DhuKAXN.exe
1656	QHoaZKC.exe
4968	sDjipKT.exe
3368	ZzDiKut.exe
3936	JRoCBVL.exe
3452	AVvTVtU.exe
3840	NbCRukf.exe
2968	yfSyTgh.exe
3220	TyoKUDK.exe
696	jflhpvK.exe
3596	cUccrZD.exe
4616	GUvGpVk.exe
4488	BmSHGnO.exe
4784	UmbnScU.exe
4516	PgwXKwM.exe
368	XFbxjrq.exe
4036	coBwPsT.exe
1092	vrElzjI.exe
4640	lgpHfMw.exe
3260	hKeZcEW.exe
3908	VElGYRX.exe
3952	cEwdaWR.exe
4056	hfmiPyP.exe
4536	dXECMNy.exe
4832	CjldLMC.exe
3680	eXhTBnW.exe
2408	gsHyTzv.exe
4624	NNYHZZr.exe
1368	AbgjmTh.exe
4324	DLHlkUl.exe
1136	msvUDhG.exe
720	kEIfVbi.exe
3996	bHSeZqG.exe
3272	CbdbjDF.exe
4368	xTQyuqq.exe
4356	GJSrTIF.exe
2500	mYmkUeg.exe
4060	FMJAlLw.exe
1020	CGSZnIx.exe
800	PZeztjh.exe
3716	DruyWKT.exe
3108	KLBDLfx.exe
540	gxZQpgb.exe
4512	EuHUVsw.exe
1588	WDSsQxl.exe
4100	feZJFQt.exe
2244	QtebCAp.exe
3400	YkYpIJy.exe
1100	zhZZWPk.exe
2360	yQJPIyG.exe
5060	otJuLLZ.exe
4300	kBEgucu.exe
1304	jMChyFg.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nzBIsDX.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\pCndqxW.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\kgTneiY.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\PRjJHjJ.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\eLcHrzC.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\rDlJhHN.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\bEAwpWf.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\sAOnYLu.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\hKeZcEW.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\pQuWLXD.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\VaIIuQN.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\PZeztjh.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\kammsZT.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\VgkLEyG.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\SbmUJKv.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\FxPEFYW.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\BMBJiMw.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\uxpjrNT.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\SLdYpSy.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\vmlVkdX.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\VwMqhPY.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\svQRSKe.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\WtHGjBH.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\RTSPtwk.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\vWpEYzL.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\PuCHrHv.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\apGtRgD.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\LhNRwdq.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\THeeDec.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\YjMznjp.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\RHNzLsY.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\nfTHcyQ.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\gYrvBfx.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\krUGxIk.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\WhraXqZ.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\HHOXoEZ.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\LOLzxGi.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\CjldLMC.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\cBtOyfE.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\VEXBLmU.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\aBTCJBD.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\zAiwJFp.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\EyzsiaY.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\XtHdCLh.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\pLJirNc.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\qSgWRsx.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\nLzJxaa.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\OwbQsYu.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\bGjOMKe.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\DhgpXKV.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\otJuLLZ.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\nMrEifF.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\QLSYTtG.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\bHwfnvW.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\BmQiHco.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\NnDKMJz.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\QxjiSwW.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\DlXpYRQ.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\bWlInvl.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\iXgehUt.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\rRSBDWH.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\ypQIxQH.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\PfnLYtY.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
File created	C:\Windows\System\uuOHLfe.exe	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16216	dwm.exe
Token: SeChangeNotifyPrivilege	16216	dwm.exe
Token: 33	16216	dwm.exe
Token: SeIncBasePriorityPrivilege	16216	dwm.exe
Token: SeShutdownPrivilege	16216	dwm.exe
Token: SeCreatePagefilePrivilege	16216	dwm.exe
Token: SeShutdownPrivilege	16216	dwm.exe
Token: SeCreatePagefilePrivilege	16216	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1688	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	84
PID 3540 wrote to memory of 1688	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	84
PID 3540 wrote to memory of 3544	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	85
PID 3540 wrote to memory of 3544	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	85
PID 3540 wrote to memory of 1664	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	86
PID 3540 wrote to memory of 1664	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	86
PID 3540 wrote to memory of 4860	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	87
PID 3540 wrote to memory of 4860	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	87
PID 3540 wrote to memory of 2680	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	88
PID 3540 wrote to memory of 2680	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	88
PID 3540 wrote to memory of 220	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	89
PID 3540 wrote to memory of 220	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	89
PID 3540 wrote to memory of 2432	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	90
PID 3540 wrote to memory of 2432	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	90
PID 3540 wrote to memory of 1740	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	91
PID 3540 wrote to memory of 1740	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	91
PID 3540 wrote to memory of 2108	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	92
PID 3540 wrote to memory of 2108	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	92
PID 3540 wrote to memory of 4544	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	93
PID 3540 wrote to memory of 4544	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	93
PID 3540 wrote to memory of 4444	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	94
PID 3540 wrote to memory of 4444	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	94
PID 3540 wrote to memory of 3116	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	95
PID 3540 wrote to memory of 3116	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	95
PID 3540 wrote to memory of 1656	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	96
PID 3540 wrote to memory of 1656	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	96
PID 3540 wrote to memory of 4968	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	97
PID 3540 wrote to memory of 4968	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	97
PID 3540 wrote to memory of 3368	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	98
PID 3540 wrote to memory of 3368	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	98
PID 3540 wrote to memory of 3936	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	99
PID 3540 wrote to memory of 3936	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	99
PID 3540 wrote to memory of 3452	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	100
PID 3540 wrote to memory of 3452	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	100
PID 3540 wrote to memory of 3840	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	101
PID 3540 wrote to memory of 3840	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	101
PID 3540 wrote to memory of 2968	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	102
PID 3540 wrote to memory of 2968	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	102
PID 3540 wrote to memory of 3220	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	103
PID 3540 wrote to memory of 3220	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	103
PID 3540 wrote to memory of 696	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	104
PID 3540 wrote to memory of 696	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	104
PID 3540 wrote to memory of 3596	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	105
PID 3540 wrote to memory of 3596	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	105
PID 3540 wrote to memory of 4616	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	106
PID 3540 wrote to memory of 4616	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	106
PID 3540 wrote to memory of 4488	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	107
PID 3540 wrote to memory of 4488	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	107
PID 3540 wrote to memory of 4784	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	108
PID 3540 wrote to memory of 4784	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	108
PID 3540 wrote to memory of 4516	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	109
PID 3540 wrote to memory of 4516	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	109
PID 3540 wrote to memory of 368	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	110
PID 3540 wrote to memory of 368	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	110
PID 3540 wrote to memory of 4036	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	111
PID 3540 wrote to memory of 4036	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	111
PID 3540 wrote to memory of 1092	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	112
PID 3540 wrote to memory of 1092	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	112
PID 3540 wrote to memory of 4640	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	113
PID 3540 wrote to memory of 4640	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	113
PID 3540 wrote to memory of 3260	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	114
PID 3540 wrote to memory of 3260	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	114
PID 3540 wrote to memory of 3952	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	115
PID 3540 wrote to memory of 3952	3540	8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe	115

C:\Users\Admin\AppData\Local\Temp\8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe
"C:\Users\Admin\AppData\Local\Temp\8a520ba6f7bc79108d2462487800df110d3435024ecf4c7d43e36ca5b974df23.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\System\Cyxjdsq.exe
  C:\Windows\System\Cyxjdsq.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\MCVHJSF.exe
  C:\Windows\System\MCVHJSF.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\aMQEeub.exe
  C:\Windows\System\aMQEeub.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\inLdevB.exe
  C:\Windows\System\inLdevB.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\ZEJSzlB.exe
  C:\Windows\System\ZEJSzlB.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\iTtUmuy.exe
  C:\Windows\System\iTtUmuy.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\ksqIJhJ.exe
  C:\Windows\System\ksqIJhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\twQwHsl.exe
  C:\Windows\System\twQwHsl.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\zSYTCIM.exe
  C:\Windows\System\zSYTCIM.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\WUZknXu.exe
  C:\Windows\System\WUZknXu.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\IpfPMfG.exe
  C:\Windows\System\IpfPMfG.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\DhuKAXN.exe
  C:\Windows\System\DhuKAXN.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\QHoaZKC.exe
  C:\Windows\System\QHoaZKC.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\sDjipKT.exe
  C:\Windows\System\sDjipKT.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\ZzDiKut.exe
  C:\Windows\System\ZzDiKut.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\JRoCBVL.exe
  C:\Windows\System\JRoCBVL.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\AVvTVtU.exe
  C:\Windows\System\AVvTVtU.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\NbCRukf.exe
  C:\Windows\System\NbCRukf.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\yfSyTgh.exe
  C:\Windows\System\yfSyTgh.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\TyoKUDK.exe
  C:\Windows\System\TyoKUDK.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\jflhpvK.exe
  C:\Windows\System\jflhpvK.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\cUccrZD.exe
  C:\Windows\System\cUccrZD.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\GUvGpVk.exe
  C:\Windows\System\GUvGpVk.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\BmSHGnO.exe
  C:\Windows\System\BmSHGnO.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\UmbnScU.exe
  C:\Windows\System\UmbnScU.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\PgwXKwM.exe
  C:\Windows\System\PgwXKwM.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\XFbxjrq.exe
  C:\Windows\System\XFbxjrq.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\coBwPsT.exe
  C:\Windows\System\coBwPsT.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\vrElzjI.exe
  C:\Windows\System\vrElzjI.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\lgpHfMw.exe
  C:\Windows\System\lgpHfMw.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\hKeZcEW.exe
  C:\Windows\System\hKeZcEW.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\cEwdaWR.exe
  C:\Windows\System\cEwdaWR.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\VElGYRX.exe
  C:\Windows\System\VElGYRX.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\hfmiPyP.exe
  C:\Windows\System\hfmiPyP.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\dXECMNy.exe
  C:\Windows\System\dXECMNy.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\CjldLMC.exe
  C:\Windows\System\CjldLMC.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\eXhTBnW.exe
  C:\Windows\System\eXhTBnW.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\gsHyTzv.exe
  C:\Windows\System\gsHyTzv.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\NNYHZZr.exe
  C:\Windows\System\NNYHZZr.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\AbgjmTh.exe
  C:\Windows\System\AbgjmTh.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\DLHlkUl.exe
  C:\Windows\System\DLHlkUl.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\msvUDhG.exe
  C:\Windows\System\msvUDhG.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\kEIfVbi.exe
  C:\Windows\System\kEIfVbi.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\bHSeZqG.exe
  C:\Windows\System\bHSeZqG.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\CbdbjDF.exe
  C:\Windows\System\CbdbjDF.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\xTQyuqq.exe
  C:\Windows\System\xTQyuqq.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\GJSrTIF.exe
  C:\Windows\System\GJSrTIF.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\mYmkUeg.exe
  C:\Windows\System\mYmkUeg.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\FMJAlLw.exe
  C:\Windows\System\FMJAlLw.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\CGSZnIx.exe
  C:\Windows\System\CGSZnIx.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\PZeztjh.exe
  C:\Windows\System\PZeztjh.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\DruyWKT.exe
  C:\Windows\System\DruyWKT.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\KLBDLfx.exe
  C:\Windows\System\KLBDLfx.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\gxZQpgb.exe
  C:\Windows\System\gxZQpgb.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\EuHUVsw.exe
  C:\Windows\System\EuHUVsw.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\WDSsQxl.exe
  C:\Windows\System\WDSsQxl.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\feZJFQt.exe
  C:\Windows\System\feZJFQt.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\QtebCAp.exe
  C:\Windows\System\QtebCAp.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\YkYpIJy.exe
  C:\Windows\System\YkYpIJy.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\zhZZWPk.exe
  C:\Windows\System\zhZZWPk.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\yQJPIyG.exe
  C:\Windows\System\yQJPIyG.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\otJuLLZ.exe
  C:\Windows\System\otJuLLZ.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\kBEgucu.exe
  C:\Windows\System\kBEgucu.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\jMChyFg.exe
  C:\Windows\System\jMChyFg.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\SwjaipL.exe
  C:\Windows\System\SwjaipL.exe
  2⤵
  PID:2260
- C:\Windows\System\IALthNj.exe
  C:\Windows\System\IALthNj.exe
  2⤵
  PID:5064
- C:\Windows\System\KHwlMGY.exe
  C:\Windows\System\KHwlMGY.exe
  2⤵
  PID:2480
- C:\Windows\System\ppZbulz.exe
  C:\Windows\System\ppZbulz.exe
  2⤵
  PID:2732
- C:\Windows\System\UBvHYtv.exe
  C:\Windows\System\UBvHYtv.exe
  2⤵
  PID:3212
- C:\Windows\System\NGjOekE.exe
  C:\Windows\System\NGjOekE.exe
  2⤵
  PID:1016
- C:\Windows\System\fHdTfBX.exe
  C:\Windows\System\fHdTfBX.exe
  2⤵
  PID:4228
- C:\Windows\System\cNyZlCS.exe
  C:\Windows\System\cNyZlCS.exe
  2⤵
  PID:1644
- C:\Windows\System\HDNltRn.exe
  C:\Windows\System\HDNltRn.exe
  2⤵
  PID:1276
- C:\Windows\System\JSyxgoz.exe
  C:\Windows\System\JSyxgoz.exe
  2⤵
  PID:4572
- C:\Windows\System\hRcOpkJ.exe
  C:\Windows\System\hRcOpkJ.exe
  2⤵
  PID:3704
- C:\Windows\System\caQHPkL.exe
  C:\Windows\System\caQHPkL.exe
  2⤵
  PID:732
- C:\Windows\System\nfTHcyQ.exe
  C:\Windows\System\nfTHcyQ.exe
  2⤵
  PID:3456
- C:\Windows\System\ilrGrcO.exe
  C:\Windows\System\ilrGrcO.exe
  2⤵
  PID:4280
- C:\Windows\System\bXfuUgw.exe
  C:\Windows\System\bXfuUgw.exe
  2⤵
  PID:3328
- C:\Windows\System\jwFwrSP.exe
  C:\Windows\System\jwFwrSP.exe
  2⤵
  PID:2904
- C:\Windows\System\mdVJyXF.exe
  C:\Windows\System\mdVJyXF.exe
  2⤵
  PID:2016
- C:\Windows\System\FPxgaky.exe
  C:\Windows\System\FPxgaky.exe
  2⤵
  PID:4436
- C:\Windows\System\ANNbwGe.exe
  C:\Windows\System\ANNbwGe.exe
  2⤵
  PID:4364
- C:\Windows\System\TFxRdTm.exe
  C:\Windows\System\TFxRdTm.exe
  2⤵
  PID:3728
- C:\Windows\System\tAHRRWd.exe
  C:\Windows\System\tAHRRWd.exe
  2⤵
  PID:4872
- C:\Windows\System\dKzpLlB.exe
  C:\Windows\System\dKzpLlB.exe
  2⤵
  PID:4112
- C:\Windows\System\hfsFbjA.exe
  C:\Windows\System\hfsFbjA.exe
  2⤵
  PID:3972
- C:\Windows\System\EcJedsI.exe
  C:\Windows\System\EcJedsI.exe
  2⤵
  PID:2988
- C:\Windows\System\oKpZGDt.exe
  C:\Windows\System\oKpZGDt.exe
  2⤵
  PID:1300
- C:\Windows\System\HZDCsOU.exe
  C:\Windows\System\HZDCsOU.exe
  2⤵
  PID:2668
- C:\Windows\System\MXdqNdz.exe
  C:\Windows\System\MXdqNdz.exe
  2⤵
  PID:4772
- C:\Windows\System\JMxsEvD.exe
  C:\Windows\System\JMxsEvD.exe
  2⤵
  PID:3532
- C:\Windows\System\eoHHSCH.exe
  C:\Windows\System\eoHHSCH.exe
  2⤵
  PID:2788
- C:\Windows\System\UurXpMx.exe
  C:\Windows\System\UurXpMx.exe
  2⤵
  PID:2560
- C:\Windows\System\NhWkKIu.exe
  C:\Windows\System\NhWkKIu.exe
  2⤵
  PID:1488
- C:\Windows\System\AnsHLtZ.exe
  C:\Windows\System\AnsHLtZ.exe
  2⤵
  PID:2436
- C:\Windows\System\BdNkDJH.exe
  C:\Windows\System\BdNkDJH.exe
  2⤵
  PID:4376
- C:\Windows\System\eCUUJPW.exe
  C:\Windows\System\eCUUJPW.exe
  2⤵
  PID:856
- C:\Windows\System\GzDopuA.exe
  C:\Windows\System\GzDopuA.exe
  2⤵
  PID:2228
- C:\Windows\System\uxpjrNT.exe
  C:\Windows\System\uxpjrNT.exe
  2⤵
  PID:3744
- C:\Windows\System\JeteOyz.exe
  C:\Windows\System\JeteOyz.exe
  2⤵
  PID:4768
- C:\Windows\System\LbDHdyA.exe
  C:\Windows\System\LbDHdyA.exe
  2⤵
  PID:4508
- C:\Windows\System\WWgzewi.exe
  C:\Windows\System\WWgzewi.exe
  2⤵
  PID:4428
- C:\Windows\System\hlqZmFC.exe
  C:\Windows\System\hlqZmFC.exe
  2⤵
  PID:3128
- C:\Windows\System\BFoYDPK.exe
  C:\Windows\System\BFoYDPK.exe
  2⤵
  PID:4044
- C:\Windows\System\UNWfoWe.exe
  C:\Windows\System\UNWfoWe.exe
  2⤵
  PID:3356
- C:\Windows\System\nZKZqLT.exe
  C:\Windows\System\nZKZqLT.exe
  2⤵
  PID:412
- C:\Windows\System\axlAktm.exe
  C:\Windows\System\axlAktm.exe
  2⤵
  PID:684
- C:\Windows\System\PjUVIMg.exe
  C:\Windows\System\PjUVIMg.exe
  2⤵
  PID:4176
- C:\Windows\System\OphUbKn.exe
  C:\Windows\System\OphUbKn.exe
  2⤵
  PID:4304
- C:\Windows\System\cBtOyfE.exe
  C:\Windows\System\cBtOyfE.exe
  2⤵
  PID:2880
- C:\Windows\System\rxlsyBX.exe
  C:\Windows\System\rxlsyBX.exe
  2⤵
  PID:1452
- C:\Windows\System\ADKVzJt.exe
  C:\Windows\System\ADKVzJt.exe
  2⤵
  PID:2288
- C:\Windows\System\AihtZAW.exe
  C:\Windows\System\AihtZAW.exe
  2⤵
  PID:5136
- C:\Windows\System\WUptkuy.exe
  C:\Windows\System\WUptkuy.exe
  2⤵
  PID:5188
- C:\Windows\System\vWpEYzL.exe
  C:\Windows\System\vWpEYzL.exe
  2⤵
  PID:5204
- C:\Windows\System\Uiieocy.exe
  C:\Windows\System\Uiieocy.exe
  2⤵
  PID:5236
- C:\Windows\System\yTixOQh.exe
  C:\Windows\System\yTixOQh.exe
  2⤵
  PID:5260
- C:\Windows\System\SadUygt.exe
  C:\Windows\System\SadUygt.exe
  2⤵
  PID:5280
- C:\Windows\System\ulVzoXA.exe
  C:\Windows\System\ulVzoXA.exe
  2⤵
  PID:5304
- C:\Windows\System\efshFBs.exe
  C:\Windows\System\efshFBs.exe
  2⤵
  PID:5332
- C:\Windows\System\DcvQQtM.exe
  C:\Windows\System\DcvQQtM.exe
  2⤵
  PID:5360
- C:\Windows\System\svQRSKe.exe
  C:\Windows\System\svQRSKe.exe
  2⤵
  PID:5388
- C:\Windows\System\CXmvhkS.exe
  C:\Windows\System\CXmvhkS.exe
  2⤵
  PID:5416
- C:\Windows\System\qKUWVbf.exe
  C:\Windows\System\qKUWVbf.exe
  2⤵
  PID:5436
- C:\Windows\System\EzHQlFA.exe
  C:\Windows\System\EzHQlFA.exe
  2⤵
  PID:5472
- C:\Windows\System\VPICdLS.exe
  C:\Windows\System\VPICdLS.exe
  2⤵
  PID:5500
- C:\Windows\System\fZlQDvr.exe
  C:\Windows\System\fZlQDvr.exe
  2⤵
  PID:5532
- C:\Windows\System\KjPcCKC.exe
  C:\Windows\System\KjPcCKC.exe
  2⤵
  PID:5568
- C:\Windows\System\vXpwdbe.exe
  C:\Windows\System\vXpwdbe.exe
  2⤵
  PID:5588
- C:\Windows\System\RTDbYRY.exe
  C:\Windows\System\RTDbYRY.exe
  2⤵
  PID:5616
- C:\Windows\System\xWVMQKA.exe
  C:\Windows\System\xWVMQKA.exe
  2⤵
  PID:5644
- C:\Windows\System\rzeEzQT.exe
  C:\Windows\System\rzeEzQT.exe
  2⤵
  PID:5676
- C:\Windows\System\gYrvBfx.exe
  C:\Windows\System\gYrvBfx.exe
  2⤵
  PID:5700
- C:\Windows\System\PxqZzRF.exe
  C:\Windows\System\PxqZzRF.exe
  2⤵
  PID:5732
- C:\Windows\System\Kikfwih.exe
  C:\Windows\System\Kikfwih.exe
  2⤵
  PID:5756
- C:\Windows\System\TdcvouO.exe
  C:\Windows\System\TdcvouO.exe
  2⤵
  PID:5772
- C:\Windows\System\LlPSBHb.exe
  C:\Windows\System\LlPSBHb.exe
  2⤵
  PID:5800
- C:\Windows\System\sQciiAJ.exe
  C:\Windows\System\sQciiAJ.exe
  2⤵
  PID:5828
- C:\Windows\System\qFwnWZB.exe
  C:\Windows\System\qFwnWZB.exe
  2⤵
  PID:5864
- C:\Windows\System\NzheLZs.exe
  C:\Windows\System\NzheLZs.exe
  2⤵
  PID:5884
- C:\Windows\System\kFkBrCd.exe
  C:\Windows\System\kFkBrCd.exe
  2⤵
  PID:5924
- C:\Windows\System\ZKNuFrX.exe
  C:\Windows\System\ZKNuFrX.exe
  2⤵
  PID:5948
- C:\Windows\System\DHhCeEM.exe
  C:\Windows\System\DHhCeEM.exe
  2⤵
  PID:5984
- C:\Windows\System\GcxKRlq.exe
  C:\Windows\System\GcxKRlq.exe
  2⤵
  PID:6020
- C:\Windows\System\zKfgedH.exe
  C:\Windows\System\zKfgedH.exe
  2⤵
  PID:6048
- C:\Windows\System\lQXlpCF.exe
  C:\Windows\System\lQXlpCF.exe
  2⤵
  PID:6064
- C:\Windows\System\UiSfQku.exe
  C:\Windows\System\UiSfQku.exe
  2⤵
  PID:6092
- C:\Windows\System\iSpDXGN.exe
  C:\Windows\System\iSpDXGN.exe
  2⤵
  PID:6120
- C:\Windows\System\oHnAiBb.exe
  C:\Windows\System\oHnAiBb.exe
  2⤵
  PID:3244
- C:\Windows\System\BEOjYyw.exe
  C:\Windows\System\BEOjYyw.exe
  2⤵
  PID:5156
- C:\Windows\System\eaUZPUI.exe
  C:\Windows\System\eaUZPUI.exe
  2⤵
  PID:5228
- C:\Windows\System\FARGhOy.exe
  C:\Windows\System\FARGhOy.exe
  2⤵
  PID:5268
- C:\Windows\System\hORFKWO.exe
  C:\Windows\System\hORFKWO.exe
  2⤵
  PID:5372
- C:\Windows\System\kMnlAtK.exe
  C:\Windows\System\kMnlAtK.exe
  2⤵
  PID:5464
- C:\Windows\System\SvuUKmD.exe
  C:\Windows\System\SvuUKmD.exe
  2⤵
  PID:5520
- C:\Windows\System\PVSbWUZ.exe
  C:\Windows\System\PVSbWUZ.exe
  2⤵
  PID:5600
- C:\Windows\System\CtNBWkG.exe
  C:\Windows\System\CtNBWkG.exe
  2⤵
  PID:5668
- C:\Windows\System\SrIqKfq.exe
  C:\Windows\System\SrIqKfq.exe
  2⤵
  PID:5716
- C:\Windows\System\rydRamr.exe
  C:\Windows\System\rydRamr.exe
  2⤵
  PID:5784
- C:\Windows\System\acEOsym.exe
  C:\Windows\System\acEOsym.exe
  2⤵
  PID:5852
- C:\Windows\System\vUFwAqX.exe
  C:\Windows\System\vUFwAqX.exe
  2⤵
  PID:5876
- C:\Windows\System\nXaHWGQ.exe
  C:\Windows\System\nXaHWGQ.exe
  2⤵
  PID:5936
- C:\Windows\System\ahTDXnM.exe
  C:\Windows\System\ahTDXnM.exe
  2⤵
  PID:5940
- C:\Windows\System\SulKhHG.exe
  C:\Windows\System\SulKhHG.exe
  2⤵
  PID:6056
- C:\Windows\System\zAiwJFp.exe
  C:\Windows\System\zAiwJFp.exe
  2⤵
  PID:6140
- C:\Windows\System\sRuvFSC.exe
  C:\Windows\System\sRuvFSC.exe
  2⤵
  PID:5148
- C:\Windows\System\EqkMPuu.exe
  C:\Windows\System\EqkMPuu.exe
  2⤵
  PID:5344
- C:\Windows\System\IovfoGP.exe
  C:\Windows\System\IovfoGP.exe
  2⤵
  PID:5484
- C:\Windows\System\JmpLGUo.exe
  C:\Windows\System\JmpLGUo.exe
  2⤵
  PID:5628
- C:\Windows\System\mjEMouq.exe
  C:\Windows\System\mjEMouq.exe
  2⤵
  PID:5908
- C:\Windows\System\iNCextO.exe
  C:\Windows\System\iNCextO.exe
  2⤵
  PID:5976
- C:\Windows\System\xblvhAR.exe
  C:\Windows\System\xblvhAR.exe
  2⤵
  PID:6132
- C:\Windows\System\qTfEHjM.exe
  C:\Windows\System\qTfEHjM.exe
  2⤵
  PID:5408
- C:\Windows\System\abWpEFH.exe
  C:\Windows\System\abWpEFH.exe
  2⤵
  PID:5956
- C:\Windows\System\uCzpiDP.exe
  C:\Windows\System\uCzpiDP.exe
  2⤵
  PID:5256
- C:\Windows\System\QglqsPl.exe
  C:\Windows\System\QglqsPl.exe
  2⤵
  PID:5692
- C:\Windows\System\ANXCUnY.exe
  C:\Windows\System\ANXCUnY.exe
  2⤵
  PID:6180
- C:\Windows\System\obzTEvq.exe
  C:\Windows\System\obzTEvq.exe
  2⤵
  PID:6196
- C:\Windows\System\cKpOpTr.exe
  C:\Windows\System\cKpOpTr.exe
  2⤵
  PID:6232
- C:\Windows\System\EummpcV.exe
  C:\Windows\System\EummpcV.exe
  2⤵
  PID:6252
- C:\Windows\System\NaxkyUX.exe
  C:\Windows\System\NaxkyUX.exe
  2⤵
  PID:6292
- C:\Windows\System\wNIsygP.exe
  C:\Windows\System\wNIsygP.exe
  2⤵
  PID:6320
- C:\Windows\System\JHjQtvV.exe
  C:\Windows\System\JHjQtvV.exe
  2⤵
  PID:6348
- C:\Windows\System\tapQHOT.exe
  C:\Windows\System\tapQHOT.exe
  2⤵
  PID:6372
- C:\Windows\System\xrzGvcU.exe
  C:\Windows\System\xrzGvcU.exe
  2⤵
  PID:6400
- C:\Windows\System\zXsihpv.exe
  C:\Windows\System\zXsihpv.exe
  2⤵
  PID:6420
- C:\Windows\System\KmUAPtk.exe
  C:\Windows\System\KmUAPtk.exe
  2⤵
  PID:6436
- C:\Windows\System\oLrSnGF.exe
  C:\Windows\System\oLrSnGF.exe
  2⤵
  PID:6460
- C:\Windows\System\xcSUOTb.exe
  C:\Windows\System\xcSUOTb.exe
  2⤵
  PID:6480
- C:\Windows\System\moRIKzG.exe
  C:\Windows\System\moRIKzG.exe
  2⤵
  PID:6508
- C:\Windows\System\NinleLn.exe
  C:\Windows\System\NinleLn.exe
  2⤵
  PID:6528
- C:\Windows\System\TJQuMve.exe
  C:\Windows\System\TJQuMve.exe
  2⤵
  PID:6560
- C:\Windows\System\payUqnc.exe
  C:\Windows\System\payUqnc.exe
  2⤵
  PID:6588
- C:\Windows\System\rrqnMFc.exe
  C:\Windows\System\rrqnMFc.exe
  2⤵
  PID:6616
- C:\Windows\System\FBOZMQY.exe
  C:\Windows\System\FBOZMQY.exe
  2⤵
  PID:6636
- C:\Windows\System\gIIrBUc.exe
  C:\Windows\System\gIIrBUc.exe
  2⤵
  PID:6664
- C:\Windows\System\EwYbHKp.exe
  C:\Windows\System\EwYbHKp.exe
  2⤵
  PID:6688
- C:\Windows\System\vJQeaWC.exe
  C:\Windows\System\vJQeaWC.exe
  2⤵
  PID:6724
- C:\Windows\System\bMZqPbl.exe
  C:\Windows\System\bMZqPbl.exe
  2⤵
  PID:6756
- C:\Windows\System\UiYftbt.exe
  C:\Windows\System\UiYftbt.exe
  2⤵
  PID:6776
- C:\Windows\System\LAzQbFY.exe
  C:\Windows\System\LAzQbFY.exe
  2⤵
  PID:6792
- C:\Windows\System\ZIwMNha.exe
  C:\Windows\System\ZIwMNha.exe
  2⤵
  PID:6820
- C:\Windows\System\UWiyqPu.exe
  C:\Windows\System\UWiyqPu.exe
  2⤵
  PID:6856
- C:\Windows\System\NbGRTFC.exe
  C:\Windows\System\NbGRTFC.exe
  2⤵
  PID:6888
- C:\Windows\System\HLPDiYM.exe
  C:\Windows\System\HLPDiYM.exe
  2⤵
  PID:6928
- C:\Windows\System\bjQkgeZ.exe
  C:\Windows\System\bjQkgeZ.exe
  2⤵
  PID:6952
- C:\Windows\System\GTFBlVn.exe
  C:\Windows\System\GTFBlVn.exe
  2⤵
  PID:6976
- C:\Windows\System\eEyWzXX.exe
  C:\Windows\System\eEyWzXX.exe
  2⤵
  PID:7008
- C:\Windows\System\NetuUpK.exe
  C:\Windows\System\NetuUpK.exe
  2⤵
  PID:7036
- C:\Windows\System\oDZnQIl.exe
  C:\Windows\System\oDZnQIl.exe
  2⤵
  PID:7072
- C:\Windows\System\JRWYjwS.exe
  C:\Windows\System\JRWYjwS.exe
  2⤵
  PID:7096
- C:\Windows\System\irHOVpr.exe
  C:\Windows\System\irHOVpr.exe
  2⤵
  PID:7128
- C:\Windows\System\XVIHnNB.exe
  C:\Windows\System\XVIHnNB.exe
  2⤵
  PID:7160
- C:\Windows\System\RgmkogL.exe
  C:\Windows\System\RgmkogL.exe
  2⤵
  PID:6156
- C:\Windows\System\rkyyvFq.exe
  C:\Windows\System\rkyyvFq.exe
  2⤵
  PID:6264
- C:\Windows\System\WtHGjBH.exe
  C:\Windows\System\WtHGjBH.exe
  2⤵
  PID:6316
- C:\Windows\System\iXgehUt.exe
  C:\Windows\System\iXgehUt.exe
  2⤵
  PID:6384
- C:\Windows\System\qCtNzfS.exe
  C:\Windows\System\qCtNzfS.exe
  2⤵
  PID:6472
- C:\Windows\System\lEhvExO.exe
  C:\Windows\System\lEhvExO.exe
  2⤵
  PID:6552
- C:\Windows\System\zmxYqYX.exe
  C:\Windows\System\zmxYqYX.exe
  2⤵
  PID:6604
- C:\Windows\System\RXuDapH.exe
  C:\Windows\System\RXuDapH.exe
  2⤵
  PID:6700
- C:\Windows\System\wnwTlzh.exe
  C:\Windows\System\wnwTlzh.exe
  2⤵
  PID:6676
- C:\Windows\System\QFJRcSf.exe
  C:\Windows\System\QFJRcSf.exe
  2⤵
  PID:6708
- C:\Windows\System\vgTjgcG.exe
  C:\Windows\System\vgTjgcG.exe
  2⤵
  PID:6844
- C:\Windows\System\GfCYYXV.exe
  C:\Windows\System\GfCYYXV.exe
  2⤵
  PID:6960
- C:\Windows\System\ezpPBkR.exe
  C:\Windows\System\ezpPBkR.exe
  2⤵
  PID:7024
- C:\Windows\System\iLXXxVZ.exe
  C:\Windows\System\iLXXxVZ.exe
  2⤵
  PID:7116
- C:\Windows\System\LqlXUaG.exe
  C:\Windows\System\LqlXUaG.exe
  2⤵
  PID:7124
- C:\Windows\System\HHOXoEZ.exe
  C:\Windows\System\HHOXoEZ.exe
  2⤵
  PID:6176
- C:\Windows\System\PqZGvJx.exe
  C:\Windows\System\PqZGvJx.exe
  2⤵
  PID:6240
- C:\Windows\System\LTNsQha.exe
  C:\Windows\System\LTNsQha.exe
  2⤵
  PID:6432
- C:\Windows\System\MCIhZxn.exe
  C:\Windows\System\MCIhZxn.exe
  2⤵
  PID:6392
- C:\Windows\System\QznYMZY.exe
  C:\Windows\System\QznYMZY.exe
  2⤵
  PID:6652
- C:\Windows\System\XsaXvua.exe
  C:\Windows\System\XsaXvua.exe
  2⤵
  PID:6840
- C:\Windows\System\uUsaBQx.exe
  C:\Windows\System\uUsaBQx.exe
  2⤵
  PID:7104
- C:\Windows\System\XjPzIFT.exe
  C:\Windows\System\XjPzIFT.exe
  2⤵
  PID:6160
- C:\Windows\System\MqbgFrt.exe
  C:\Windows\System\MqbgFrt.exe
  2⤵
  PID:6380
- C:\Windows\System\drUjhkJ.exe
  C:\Windows\System\drUjhkJ.exe
  2⤵
  PID:6656
- C:\Windows\System\VEZnZXB.exe
  C:\Windows\System\VEZnZXB.exe
  2⤵
  PID:6868
- C:\Windows\System\QTNxHBC.exe
  C:\Windows\System\QTNxHBC.exe
  2⤵
  PID:6964
- C:\Windows\System\eZpQcPL.exe
  C:\Windows\System\eZpQcPL.exe
  2⤵
  PID:7184
- C:\Windows\System\NNJSIqn.exe
  C:\Windows\System\NNJSIqn.exe
  2⤵
  PID:7220
- C:\Windows\System\KoASJAq.exe
  C:\Windows\System\KoASJAq.exe
  2⤵
  PID:7252
- C:\Windows\System\vKOnUSO.exe
  C:\Windows\System\vKOnUSO.exe
  2⤵
  PID:7276
- C:\Windows\System\IYtmFQc.exe
  C:\Windows\System\IYtmFQc.exe
  2⤵
  PID:7308
- C:\Windows\System\SaYuFhk.exe
  C:\Windows\System\SaYuFhk.exe
  2⤵
  PID:7332
- C:\Windows\System\jqJxzRT.exe
  C:\Windows\System\jqJxzRT.exe
  2⤵
  PID:7364
- C:\Windows\System\IYvRJol.exe
  C:\Windows\System\IYvRJol.exe
  2⤵
  PID:7388
- C:\Windows\System\pCndqxW.exe
  C:\Windows\System\pCndqxW.exe
  2⤵
  PID:7408
- C:\Windows\System\tyvwBqi.exe
  C:\Windows\System\tyvwBqi.exe
  2⤵
  PID:7436
- C:\Windows\System\OgbgwjZ.exe
  C:\Windows\System\OgbgwjZ.exe
  2⤵
  PID:7460
- C:\Windows\System\BklLSfQ.exe
  C:\Windows\System\BklLSfQ.exe
  2⤵
  PID:7488
- C:\Windows\System\nGoXNJS.exe
  C:\Windows\System\nGoXNJS.exe
  2⤵
  PID:7512
- C:\Windows\System\EPHdGXR.exe
  C:\Windows\System\EPHdGXR.exe
  2⤵
  PID:7552
- C:\Windows\System\SLdYpSy.exe
  C:\Windows\System\SLdYpSy.exe
  2⤵
  PID:7572
- C:\Windows\System\FJyyyUN.exe
  C:\Windows\System\FJyyyUN.exe
  2⤵
  PID:7604
- C:\Windows\System\lhTFERH.exe
  C:\Windows\System\lhTFERH.exe
  2⤵
  PID:7632
- C:\Windows\System\nvtQMof.exe
  C:\Windows\System\nvtQMof.exe
  2⤵
  PID:7656
- C:\Windows\System\COwssCd.exe
  C:\Windows\System\COwssCd.exe
  2⤵
  PID:7684
- C:\Windows\System\balSdCv.exe
  C:\Windows\System\balSdCv.exe
  2⤵
  PID:7708
- C:\Windows\System\cDvSfxN.exe
  C:\Windows\System\cDvSfxN.exe
  2⤵
  PID:7740
- C:\Windows\System\kYkbvKD.exe
  C:\Windows\System\kYkbvKD.exe
  2⤵
  PID:7776
- C:\Windows\System\XJqnPju.exe
  C:\Windows\System\XJqnPju.exe
  2⤵
  PID:7804
- C:\Windows\System\StNrZdH.exe
  C:\Windows\System\StNrZdH.exe
  2⤵
  PID:7840
- C:\Windows\System\OEboCUm.exe
  C:\Windows\System\OEboCUm.exe
  2⤵
  PID:7872
- C:\Windows\System\qUvOXNa.exe
  C:\Windows\System\qUvOXNa.exe
  2⤵
  PID:7908
- C:\Windows\System\yqhsesn.exe
  C:\Windows\System\yqhsesn.exe
  2⤵
  PID:7940
- C:\Windows\System\fsAOkbx.exe
  C:\Windows\System\fsAOkbx.exe
  2⤵
  PID:7968
- C:\Windows\System\vfowwzS.exe
  C:\Windows\System\vfowwzS.exe
  2⤵
  PID:7992
- C:\Windows\System\OCxKSAr.exe
  C:\Windows\System\OCxKSAr.exe
  2⤵
  PID:8020
- C:\Windows\System\HypFGoc.exe
  C:\Windows\System\HypFGoc.exe
  2⤵
  PID:8048
- C:\Windows\System\vmlVkdX.exe
  C:\Windows\System\vmlVkdX.exe
  2⤵
  PID:8068
- C:\Windows\System\gCnYyyr.exe
  C:\Windows\System\gCnYyyr.exe
  2⤵
  PID:8096
- C:\Windows\System\KGiPutH.exe
  C:\Windows\System\KGiPutH.exe
  2⤵
  PID:8132
- C:\Windows\System\PXTsXZZ.exe
  C:\Windows\System\PXTsXZZ.exe
  2⤵
  PID:8160
- C:\Windows\System\YVxiDKX.exe
  C:\Windows\System\YVxiDKX.exe
  2⤵
  PID:6496
- C:\Windows\System\aqjlDZG.exe
  C:\Windows\System\aqjlDZG.exe
  2⤵
  PID:7172
- C:\Windows\System\eaPgiry.exe
  C:\Windows\System\eaPgiry.exe
  2⤵
  PID:7236
- C:\Windows\System\pXoMXwh.exe
  C:\Windows\System\pXoMXwh.exe
  2⤵
  PID:7296
- C:\Windows\System\kfOhIxb.exe
  C:\Windows\System\kfOhIxb.exe
  2⤵
  PID:7372
- C:\Windows\System\BISoVwq.exe
  C:\Windows\System\BISoVwq.exe
  2⤵
  PID:7456
- C:\Windows\System\fIyxfsP.exe
  C:\Windows\System\fIyxfsP.exe
  2⤵
  PID:7452
- C:\Windows\System\HrSwMpl.exe
  C:\Windows\System\HrSwMpl.exe
  2⤵
  PID:7544
- C:\Windows\System\VEXBLmU.exe
  C:\Windows\System\VEXBLmU.exe
  2⤵
  PID:7536
- C:\Windows\System\piQkptb.exe
  C:\Windows\System\piQkptb.exe
  2⤵
  PID:7644
- C:\Windows\System\uwCgjzk.exe
  C:\Windows\System\uwCgjzk.exe
  2⤵
  PID:7752
- C:\Windows\System\IMkSIjQ.exe
  C:\Windows\System\IMkSIjQ.exe
  2⤵
  PID:7828
- C:\Windows\System\prNXGxI.exe
  C:\Windows\System\prNXGxI.exe
  2⤵
  PID:7856
- C:\Windows\System\XaXywWB.exe
  C:\Windows\System\XaXywWB.exe
  2⤵
  PID:7956
- C:\Windows\System\PbwYDLQ.exe
  C:\Windows\System\PbwYDLQ.exe
  2⤵
  PID:8036
- C:\Windows\System\zLVidKJ.exe
  C:\Windows\System\zLVidKJ.exe
  2⤵
  PID:8080
- C:\Windows\System\aBtRDIo.exe
  C:\Windows\System\aBtRDIo.exe
  2⤵
  PID:8180
- C:\Windows\System\PkrKhrt.exe
  C:\Windows\System\PkrKhrt.exe
  2⤵
  PID:8156
- C:\Windows\System\OxmgIzM.exe
  C:\Windows\System\OxmgIzM.exe
  2⤵
  PID:7268
- C:\Windows\System\zRWZOOR.exe
  C:\Windows\System\zRWZOOR.exe
  2⤵
  PID:7508
- C:\Windows\System\wCjfYZw.exe
  C:\Windows\System\wCjfYZw.exe
  2⤵
  PID:7588
- C:\Windows\System\TJRyPUt.exe
  C:\Windows\System\TJRyPUt.exe
  2⤵
  PID:7884
- C:\Windows\System\GmLBuFF.exe
  C:\Windows\System\GmLBuFF.exe
  2⤵
  PID:7924
- C:\Windows\System\rMMWAsE.exe
  C:\Windows\System\rMMWAsE.exe
  2⤵
  PID:7932
- C:\Windows\System\LoEtfBT.exe
  C:\Windows\System\LoEtfBT.exe
  2⤵
  PID:8112
- C:\Windows\System\ezNHObN.exe
  C:\Windows\System\ezNHObN.exe
  2⤵
  PID:7216
- C:\Windows\System\cpUsIPz.exe
  C:\Windows\System\cpUsIPz.exe
  2⤵
  PID:7600
- C:\Windows\System\JJeWypo.exe
  C:\Windows\System\JJeWypo.exe
  2⤵
  PID:7984
- C:\Windows\System\VpDYuTt.exe
  C:\Windows\System\VpDYuTt.exe
  2⤵
  PID:8196
- C:\Windows\System\zlWTAWw.exe
  C:\Windows\System\zlWTAWw.exe
  2⤵
  PID:8232
- C:\Windows\System\gQGTVAR.exe
  C:\Windows\System\gQGTVAR.exe
  2⤵
  PID:8264
- C:\Windows\System\MtgmPRJ.exe
  C:\Windows\System\MtgmPRJ.exe
  2⤵
  PID:8284
- C:\Windows\System\tNFSGes.exe
  C:\Windows\System\tNFSGes.exe
  2⤵
  PID:8320
- C:\Windows\System\QcbAiwN.exe
  C:\Windows\System\QcbAiwN.exe
  2⤵
  PID:8340
- C:\Windows\System\qIXAypw.exe
  C:\Windows\System\qIXAypw.exe
  2⤵
  PID:8372
- C:\Windows\System\jYDztWr.exe
  C:\Windows\System\jYDztWr.exe
  2⤵
  PID:8388
- C:\Windows\System\NnDKMJz.exe
  C:\Windows\System\NnDKMJz.exe
  2⤵
  PID:8420
- C:\Windows\System\QxjiSwW.exe
  C:\Windows\System\QxjiSwW.exe
  2⤵
  PID:8448
- C:\Windows\System\RyeUipq.exe
  C:\Windows\System\RyeUipq.exe
  2⤵
  PID:8480
- C:\Windows\System\IoNsLsF.exe
  C:\Windows\System\IoNsLsF.exe
  2⤵
  PID:8512
- C:\Windows\System\piDadKi.exe
  C:\Windows\System\piDadKi.exe
  2⤵
  PID:8536
- C:\Windows\System\RPbGGgw.exe
  C:\Windows\System\RPbGGgw.exe
  2⤵
  PID:8568
- C:\Windows\System\nnLBlHY.exe
  C:\Windows\System\nnLBlHY.exe
  2⤵
  PID:8596
- C:\Windows\System\NJavgOx.exe
  C:\Windows\System\NJavgOx.exe
  2⤵
  PID:8628
- C:\Windows\System\LXneZBo.exe
  C:\Windows\System\LXneZBo.exe
  2⤵
  PID:8652
- C:\Windows\System\kgTneiY.exe
  C:\Windows\System\kgTneiY.exe
  2⤵
  PID:8684
- C:\Windows\System\efjJKlT.exe
  C:\Windows\System\efjJKlT.exe
  2⤵
  PID:8720
- C:\Windows\System\rVhyezN.exe
  C:\Windows\System\rVhyezN.exe
  2⤵
  PID:8740
- C:\Windows\System\CwTrtjM.exe
  C:\Windows\System\CwTrtjM.exe
  2⤵
  PID:8768
- C:\Windows\System\dXPEKkN.exe
  C:\Windows\System\dXPEKkN.exe
  2⤵
  PID:8800
- C:\Windows\System\pQuWLXD.exe
  C:\Windows\System\pQuWLXD.exe
  2⤵
  PID:8844
- C:\Windows\System\EfnZLhW.exe
  C:\Windows\System\EfnZLhW.exe
  2⤵
  PID:8880
- C:\Windows\System\lisFbap.exe
  C:\Windows\System\lisFbap.exe
  2⤵
  PID:8916
- C:\Windows\System\nLzJxaa.exe
  C:\Windows\System\nLzJxaa.exe
  2⤵
  PID:8944
- C:\Windows\System\Zjaabvv.exe
  C:\Windows\System\Zjaabvv.exe
  2⤵
  PID:8972
- C:\Windows\System\CnuRwSX.exe
  C:\Windows\System\CnuRwSX.exe
  2⤵
  PID:9000
- C:\Windows\System\VUMgpIV.exe
  C:\Windows\System\VUMgpIV.exe
  2⤵
  PID:9028
- C:\Windows\System\klywANo.exe
  C:\Windows\System\klywANo.exe
  2⤵
  PID:9048
- C:\Windows\System\GkACGzd.exe
  C:\Windows\System\GkACGzd.exe
  2⤵
  PID:9084
- C:\Windows\System\rtInqxK.exe
  C:\Windows\System\rtInqxK.exe
  2⤵
  PID:9112
- C:\Windows\System\QryrATK.exe
  C:\Windows\System\QryrATK.exe
  2⤵
  PID:9140
- C:\Windows\System\PSgcMaR.exe
  C:\Windows\System\PSgcMaR.exe
  2⤵
  PID:9168
- C:\Windows\System\aFkYerm.exe
  C:\Windows\System\aFkYerm.exe
  2⤵
  PID:9200
- C:\Windows\System\yuqvPqE.exe
  C:\Windows\System\yuqvPqE.exe
  2⤵
  PID:7444
- C:\Windows\System\hPmTapU.exe
  C:\Windows\System\hPmTapU.exe
  2⤵
  PID:8248
- C:\Windows\System\OJAWRZq.exe
  C:\Windows\System\OJAWRZq.exe
  2⤵
  PID:8216
- C:\Windows\System\cOKvyVY.exe
  C:\Windows\System\cOKvyVY.exe
  2⤵
  PID:8368
- C:\Windows\System\XSWLbSh.exe
  C:\Windows\System\XSWLbSh.exe
  2⤵
  PID:8328
- C:\Windows\System\voaAncv.exe
  C:\Windows\System\voaAncv.exe
  2⤵
  PID:8476
- C:\Windows\System\XaLLWah.exe
  C:\Windows\System\XaLLWah.exe
  2⤵
  PID:8520
- C:\Windows\System\DKrfYir.exe
  C:\Windows\System\DKrfYir.exe
  2⤵
  PID:8612
- C:\Windows\System\vgctSVn.exe
  C:\Windows\System\vgctSVn.exe
  2⤵
  PID:8636
- C:\Windows\System\WVtlsiS.exe
  C:\Windows\System\WVtlsiS.exe
  2⤵
  PID:8664
- C:\Windows\System\CAksGur.exe
  C:\Windows\System\CAksGur.exe
  2⤵
  PID:8824
- C:\Windows\System\xkRznnP.exe
  C:\Windows\System\xkRznnP.exe
  2⤵
  PID:8812
- C:\Windows\System\zwLLIDy.exe
  C:\Windows\System\zwLLIDy.exe
  2⤵
  PID:8912
- C:\Windows\System\rhcGDCb.exe
  C:\Windows\System\rhcGDCb.exe
  2⤵
  PID:8932
- C:\Windows\System\XNHlEoS.exe
  C:\Windows\System\XNHlEoS.exe
  2⤵
  PID:9012
- C:\Windows\System\fjGfXFd.exe
  C:\Windows\System\fjGfXFd.exe
  2⤵
  PID:9076
- C:\Windows\System\lNIEsUo.exe
  C:\Windows\System\lNIEsUo.exe
  2⤵
  PID:9108
- C:\Windows\System\TlYFoIA.exe
  C:\Windows\System\TlYFoIA.exe
  2⤵
  PID:8220
- C:\Windows\System\dAfMtyd.exe
  C:\Windows\System\dAfMtyd.exe
  2⤵
  PID:7348
- C:\Windows\System\ODcdTGG.exe
  C:\Windows\System\ODcdTGG.exe
  2⤵
  PID:8380
- C:\Windows\System\SnOntFx.exe
  C:\Windows\System\SnOntFx.exe
  2⤵
  PID:8528
- C:\Windows\System\hUjrGgH.exe
  C:\Windows\System\hUjrGgH.exe
  2⤵
  PID:7564
- C:\Windows\System\TeytXoI.exe
  C:\Windows\System\TeytXoI.exe
  2⤵
  PID:9040
- C:\Windows\System\IYoXmiE.exe
  C:\Windows\System\IYoXmiE.exe
  2⤵
  PID:9056
- C:\Windows\System\JbiVVra.exe
  C:\Windows\System\JbiVVra.exe
  2⤵
  PID:9132
- C:\Windows\System\xclPmuM.exe
  C:\Windows\System\xclPmuM.exe
  2⤵
  PID:8400
- C:\Windows\System\IWopesl.exe
  C:\Windows\System\IWopesl.exe
  2⤵
  PID:9128
- C:\Windows\System\cSpUOSR.exe
  C:\Windows\System\cSpUOSR.exe
  2⤵
  PID:8996
- C:\Windows\System\paPenlJ.exe
  C:\Windows\System\paPenlJ.exe
  2⤵
  PID:8704
- C:\Windows\System\rJfqqiN.exe
  C:\Windows\System\rJfqqiN.exe
  2⤵
  PID:8792
- C:\Windows\System\nNvPlTX.exe
  C:\Windows\System\nNvPlTX.exe
  2⤵
  PID:9228
- C:\Windows\System\isrkjXB.exe
  C:\Windows\System\isrkjXB.exe
  2⤵
  PID:9256
- C:\Windows\System\bDhxcyI.exe
  C:\Windows\System\bDhxcyI.exe
  2⤵
  PID:9284
- C:\Windows\System\RFkGmso.exe
  C:\Windows\System\RFkGmso.exe
  2⤵
  PID:9316
- C:\Windows\System\FOrMehm.exe
  C:\Windows\System\FOrMehm.exe
  2⤵
  PID:9336
- C:\Windows\System\hlPFySd.exe
  C:\Windows\System\hlPFySd.exe
  2⤵
  PID:9364
- C:\Windows\System\CfUPkdk.exe
  C:\Windows\System\CfUPkdk.exe
  2⤵
  PID:9392
- C:\Windows\System\eNguSvd.exe
  C:\Windows\System\eNguSvd.exe
  2⤵
  PID:9408
- C:\Windows\System\RRKgTST.exe
  C:\Windows\System\RRKgTST.exe
  2⤵
  PID:9428
- C:\Windows\System\MSdoTTp.exe
  C:\Windows\System\MSdoTTp.exe
  2⤵
  PID:9448
- C:\Windows\System\VjsKRyy.exe
  C:\Windows\System\VjsKRyy.exe
  2⤵
  PID:9480
- C:\Windows\System\rDlJhHN.exe
  C:\Windows\System\rDlJhHN.exe
  2⤵
  PID:9504
- C:\Windows\System\oeDQjGm.exe
  C:\Windows\System\oeDQjGm.exe
  2⤵
  PID:9532
- C:\Windows\System\GipwPni.exe
  C:\Windows\System\GipwPni.exe
  2⤵
  PID:9552
- C:\Windows\System\XqXjtBD.exe
  C:\Windows\System\XqXjtBD.exe
  2⤵
  PID:9584
- C:\Windows\System\eXRAYzK.exe
  C:\Windows\System\eXRAYzK.exe
  2⤵
  PID:9712
- C:\Windows\System\RrXHtcq.exe
  C:\Windows\System\RrXHtcq.exe
  2⤵
  PID:9732
- C:\Windows\System\DvxwfIc.exe
  C:\Windows\System\DvxwfIc.exe
  2⤵
  PID:9756
- C:\Windows\System\lOzICtg.exe
  C:\Windows\System\lOzICtg.exe
  2⤵
  PID:9780
- C:\Windows\System\rZXxhCD.exe
  C:\Windows\System\rZXxhCD.exe
  2⤵
  PID:9800
- C:\Windows\System\nyRBncd.exe
  C:\Windows\System\nyRBncd.exe
  2⤵
  PID:9816
- C:\Windows\System\zyRZBkM.exe
  C:\Windows\System\zyRZBkM.exe
  2⤵
  PID:9844
- C:\Windows\System\RUbQgyT.exe
  C:\Windows\System\RUbQgyT.exe
  2⤵
  PID:9860
- C:\Windows\System\cFVzUcD.exe
  C:\Windows\System\cFVzUcD.exe
  2⤵
  PID:9904
- C:\Windows\System\nCavBiE.exe
  C:\Windows\System\nCavBiE.exe
  2⤵
  PID:9932
- C:\Windows\System\WrozDrt.exe
  C:\Windows\System\WrozDrt.exe
  2⤵
  PID:9964
- C:\Windows\System\mfIJcck.exe
  C:\Windows\System\mfIJcck.exe
  2⤵
  PID:9996
- C:\Windows\System\FZpLHLo.exe
  C:\Windows\System\FZpLHLo.exe
  2⤵
  PID:10024
- C:\Windows\System\NmmUTEW.exe
  C:\Windows\System\NmmUTEW.exe
  2⤵
  PID:10052
- C:\Windows\System\aDgmKmG.exe
  C:\Windows\System\aDgmKmG.exe
  2⤵
  PID:10068
- C:\Windows\System\OZPCQMS.exe
  C:\Windows\System\OZPCQMS.exe
  2⤵
  PID:10096
- C:\Windows\System\SmBxWqF.exe
  C:\Windows\System\SmBxWqF.exe
  2⤵
  PID:10124
- C:\Windows\System\kChxzoM.exe
  C:\Windows\System\kChxzoM.exe
  2⤵
  PID:10160
- C:\Windows\System\VUcSKEL.exe
  C:\Windows\System\VUcSKEL.exe
  2⤵
  PID:10180
- C:\Windows\System\ZIeOFXy.exe
  C:\Windows\System\ZIeOFXy.exe
  2⤵
  PID:10220
- C:\Windows\System\VxvZSve.exe
  C:\Windows\System\VxvZSve.exe
  2⤵
  PID:9180
- C:\Windows\System\TCHuiOX.exe
  C:\Windows\System\TCHuiOX.exe
  2⤵
  PID:8700
- C:\Windows\System\eHTiFgS.exe
  C:\Windows\System\eHTiFgS.exe
  2⤵
  PID:9332
- C:\Windows\System\bsjzlyI.exe
  C:\Windows\System\bsjzlyI.exe
  2⤵
  PID:9380
- C:\Windows\System\mClKAYK.exe
  C:\Windows\System\mClKAYK.exe
  2⤵
  PID:9468
- C:\Windows\System\YjMznjp.exe
  C:\Windows\System\YjMznjp.exe
  2⤵
  PID:9516
- C:\Windows\System\VwMqhPY.exe
  C:\Windows\System\VwMqhPY.exe
  2⤵
  PID:9548
- C:\Windows\System\jTIGEsR.exe
  C:\Windows\System\jTIGEsR.exe
  2⤵
  PID:9636
- C:\Windows\System\efKlSUe.exe
  C:\Windows\System\efKlSUe.exe
  2⤵
  PID:9708
- C:\Windows\System\XYhgpGz.exe
  C:\Windows\System\XYhgpGz.exe
  2⤵
  PID:9748
- C:\Windows\System\lShimXV.exe
  C:\Windows\System\lShimXV.exe
  2⤵
  PID:9808
- C:\Windows\System\UfSuEBv.exe
  C:\Windows\System\UfSuEBv.exe
  2⤵
  PID:9888
- C:\Windows\System\KkxMzXJ.exe
  C:\Windows\System\KkxMzXJ.exe
  2⤵
  PID:9952
- C:\Windows\System\SsnFCXy.exe
  C:\Windows\System\SsnFCXy.exe
  2⤵
  PID:9988
- C:\Windows\System\KzLybtI.exe
  C:\Windows\System\KzLybtI.exe
  2⤵
  PID:10088
- C:\Windows\System\cNBqqOQ.exe
  C:\Windows\System\cNBqqOQ.exe
  2⤵
  PID:10112
- C:\Windows\System\DdOdhNJ.exe
  C:\Windows\System\DdOdhNJ.exe
  2⤵
  PID:10208
- C:\Windows\System\DlXpYRQ.exe
  C:\Windows\System\DlXpYRQ.exe
  2⤵
  PID:9248
- C:\Windows\System\yGUldFY.exe
  C:\Windows\System\yGUldFY.exe
  2⤵
  PID:9440
- C:\Windows\System\gMKKJCb.exe
  C:\Windows\System\gMKKJCb.exe
  2⤵
  PID:9604
- C:\Windows\System\aNMKqEb.exe
  C:\Windows\System\aNMKqEb.exe
  2⤵
  PID:9788
- C:\Windows\System\XQTOTPl.exe
  C:\Windows\System\XQTOTPl.exe
  2⤵
  PID:9916
- C:\Windows\System\hqgSWJq.exe
  C:\Windows\System\hqgSWJq.exe
  2⤵
  PID:9976
- C:\Windows\System\XQpDNXY.exe
  C:\Windows\System\XQpDNXY.exe
  2⤵
  PID:10144
- C:\Windows\System\nBFaXKT.exe
  C:\Windows\System\nBFaXKT.exe
  2⤵
  PID:9388
- C:\Windows\System\EghaAdM.exe
  C:\Windows\System\EghaAdM.exe
  2⤵
  PID:9836
- C:\Windows\System\VoMsSdy.exe
  C:\Windows\System\VoMsSdy.exe
  2⤵
  PID:10016
- C:\Windows\System\jEYfFLI.exe
  C:\Windows\System\jEYfFLI.exe
  2⤵
  PID:9544
- C:\Windows\System\NqsXecQ.exe
  C:\Windows\System\NqsXecQ.exe
  2⤵
  PID:10264
- C:\Windows\System\ymkVHGk.exe
  C:\Windows\System\ymkVHGk.exe
  2⤵
  PID:10300
- C:\Windows\System\iHwjxRL.exe
  C:\Windows\System\iHwjxRL.exe
  2⤵
  PID:10324
- C:\Windows\System\DEgLDna.exe
  C:\Windows\System\DEgLDna.exe
  2⤵
  PID:10348
- C:\Windows\System\EVGveJy.exe
  C:\Windows\System\EVGveJy.exe
  2⤵
  PID:10372
- C:\Windows\System\qCkAktO.exe
  C:\Windows\System\qCkAktO.exe
  2⤵
  PID:10400
- C:\Windows\System\CkoNkTF.exe
  C:\Windows\System\CkoNkTF.exe
  2⤵
  PID:10432
- C:\Windows\System\zSpvsds.exe
  C:\Windows\System\zSpvsds.exe
  2⤵
  PID:10464
- C:\Windows\System\jVDOTgO.exe
  C:\Windows\System\jVDOTgO.exe
  2⤵
  PID:10488
- C:\Windows\System\NkRKshK.exe
  C:\Windows\System\NkRKshK.exe
  2⤵
  PID:10504
- C:\Windows\System\xCPGsqc.exe
  C:\Windows\System\xCPGsqc.exe
  2⤵
  PID:10528
- C:\Windows\System\srkgeYa.exe
  C:\Windows\System\srkgeYa.exe
  2⤵
  PID:10556
- C:\Windows\System\AxOeVqd.exe
  C:\Windows\System\AxOeVqd.exe
  2⤵
  PID:10588
- C:\Windows\System\vXeNJln.exe
  C:\Windows\System\vXeNJln.exe
  2⤵
  PID:10628
- C:\Windows\System\CjhynfM.exe
  C:\Windows\System\CjhynfM.exe
  2⤵
  PID:10660
- C:\Windows\System\MscBiWm.exe
  C:\Windows\System\MscBiWm.exe
  2⤵
  PID:10680
- C:\Windows\System\RqEmhgQ.exe
  C:\Windows\System\RqEmhgQ.exe
  2⤵
  PID:10712
- C:\Windows\System\ZazcJhW.exe
  C:\Windows\System\ZazcJhW.exe
  2⤵
  PID:10744
- C:\Windows\System\bXyYuFn.exe
  C:\Windows\System\bXyYuFn.exe
  2⤵
  PID:10776
- C:\Windows\System\cRalpIP.exe
  C:\Windows\System\cRalpIP.exe
  2⤵
  PID:10812
- C:\Windows\System\ysAAynf.exe
  C:\Windows\System\ysAAynf.exe
  2⤵
  PID:10836
- C:\Windows\System\xyRafvg.exe
  C:\Windows\System\xyRafvg.exe
  2⤵
  PID:10860
- C:\Windows\System\ODKfDJP.exe
  C:\Windows\System\ODKfDJP.exe
  2⤵
  PID:10888
- C:\Windows\System\MKrPyId.exe
  C:\Windows\System\MKrPyId.exe
  2⤵
  PID:10920
- C:\Windows\System\EbQIXts.exe
  C:\Windows\System\EbQIXts.exe
  2⤵
  PID:10944
- C:\Windows\System\SaBSBUP.exe
  C:\Windows\System\SaBSBUP.exe
  2⤵
  PID:10976
- C:\Windows\System\uPfBAtt.exe
  C:\Windows\System\uPfBAtt.exe
  2⤵
  PID:11004
- C:\Windows\System\WVEBnOM.exe
  C:\Windows\System\WVEBnOM.exe
  2⤵
  PID:11036
- C:\Windows\System\bmdqOwY.exe
  C:\Windows\System\bmdqOwY.exe
  2⤵
  PID:11064
- C:\Windows\System\qBwLFmj.exe
  C:\Windows\System\qBwLFmj.exe
  2⤵
  PID:11088
- C:\Windows\System\rRSBDWH.exe
  C:\Windows\System\rRSBDWH.exe
  2⤵
  PID:11116
- C:\Windows\System\XMWyWGE.exe
  C:\Windows\System\XMWyWGE.exe
  2⤵
  PID:11140
- C:\Windows\System\AXUVysI.exe
  C:\Windows\System\AXUVysI.exe
  2⤵
  PID:11176
- C:\Windows\System\kjdvHgu.exe
  C:\Windows\System\kjdvHgu.exe
  2⤵
  PID:11200
- C:\Windows\System\XkZuuuS.exe
  C:\Windows\System\XkZuuuS.exe
  2⤵
  PID:11216
- C:\Windows\System\BkwMOUc.exe
  C:\Windows\System\BkwMOUc.exe
  2⤵
  PID:11240
- C:\Windows\System\vHXJWqX.exe
  C:\Windows\System\vHXJWqX.exe
  2⤵
  PID:9772
- C:\Windows\System\ptDNSuz.exe
  C:\Windows\System\ptDNSuz.exe
  2⤵
  PID:10012
- C:\Windows\System\hQtTfvE.exe
  C:\Windows\System\hQtTfvE.exe
  2⤵
  PID:10340
- C:\Windows\System\uHwASME.exe
  C:\Windows\System\uHwASME.exe
  2⤵
  PID:10384
- C:\Windows\System\ibNKcEN.exe
  C:\Windows\System\ibNKcEN.exe
  2⤵
  PID:10448
- C:\Windows\System\nFpdAhT.exe
  C:\Windows\System\nFpdAhT.exe
  2⤵
  PID:10520
- C:\Windows\System\imgWnlq.exe
  C:\Windows\System\imgWnlq.exe
  2⤵
  PID:10608
- C:\Windows\System\QpRVzIf.exe
  C:\Windows\System\QpRVzIf.exe
  2⤵
  PID:10640
- C:\Windows\System\YhTutFX.exe
  C:\Windows\System\YhTutFX.exe
  2⤵
  PID:10760
- C:\Windows\System\JXIajPK.exe
  C:\Windows\System\JXIajPK.exe
  2⤵
  PID:10772
- C:\Windows\System\BGsjHPT.exe
  C:\Windows\System\BGsjHPT.exe
  2⤵
  PID:10856
- C:\Windows\System\EbpLVUl.exe
  C:\Windows\System\EbpLVUl.exe
  2⤵
  PID:10872
- C:\Windows\System\aBTCJBD.exe
  C:\Windows\System\aBTCJBD.exe
  2⤵
  PID:10932
- C:\Windows\System\DUOKIpO.exe
  C:\Windows\System\DUOKIpO.exe
  2⤵
  PID:10960
- C:\Windows\System\HIJzcjE.exe
  C:\Windows\System\HIJzcjE.exe
  2⤵
  PID:11024
- C:\Windows\System\PjbSnZz.exe
  C:\Windows\System\PjbSnZz.exe
  2⤵
  PID:11096
- C:\Windows\System\aFVLqFQ.exe
  C:\Windows\System\aFVLqFQ.exe
  2⤵
  PID:11188
- C:\Windows\System\tFCdhtf.exe
  C:\Windows\System\tFCdhtf.exe
  2⤵
  PID:11228
- C:\Windows\System\TUOBqca.exe
  C:\Windows\System\TUOBqca.exe
  2⤵
  PID:10256
- C:\Windows\System\huCXFGy.exe
  C:\Windows\System\huCXFGy.exe
  2⤵
  PID:10252
- C:\Windows\System\IncpNYK.exe
  C:\Windows\System\IncpNYK.exe
  2⤵
  PID:10472
- C:\Windows\System\ZFsDENT.exe
  C:\Windows\System\ZFsDENT.exe
  2⤵
  PID:10480
- C:\Windows\System\ZUsvceR.exe
  C:\Windows\System\ZUsvceR.exe
  2⤵
  PID:10796
- C:\Windows\System\yyusjvW.exe
  C:\Windows\System\yyusjvW.exe
  2⤵
  PID:10876
- C:\Windows\System\aqZrwwY.exe
  C:\Windows\System\aqZrwwY.exe
  2⤵
  PID:10832
- C:\Windows\System\QAbKBRH.exe
  C:\Windows\System\QAbKBRH.exe
  2⤵
  PID:10992
- C:\Windows\System\CxZCdIL.exe
  C:\Windows\System\CxZCdIL.exe
  2⤵
  PID:10572
- C:\Windows\System\HmkVnwp.exe
  C:\Windows\System\HmkVnwp.exe
  2⤵
  PID:11156
- C:\Windows\System\AevjUDr.exe
  C:\Windows\System\AevjUDr.exe
  2⤵
  PID:11288
- C:\Windows\System\bmYTRbS.exe
  C:\Windows\System\bmYTRbS.exe
  2⤵
  PID:11328
- C:\Windows\System\NGobEED.exe
  C:\Windows\System\NGobEED.exe
  2⤵
  PID:11360
- C:\Windows\System\XvhwRQU.exe
  C:\Windows\System\XvhwRQU.exe
  2⤵
  PID:11388
- C:\Windows\System\NtJsHzx.exe
  C:\Windows\System\NtJsHzx.exe
  2⤵
  PID:11416
- C:\Windows\System\ksnHZqe.exe
  C:\Windows\System\ksnHZqe.exe
  2⤵
  PID:11448
- C:\Windows\System\vJzAOIw.exe
  C:\Windows\System\vJzAOIw.exe
  2⤵
  PID:11472
- C:\Windows\System\IByVUUw.exe
  C:\Windows\System\IByVUUw.exe
  2⤵
  PID:11500
- C:\Windows\System\xXcYfOH.exe
  C:\Windows\System\xXcYfOH.exe
  2⤵
  PID:11524
- C:\Windows\System\YwkWafX.exe
  C:\Windows\System\YwkWafX.exe
  2⤵
  PID:11540
- C:\Windows\System\RmhpyUu.exe
  C:\Windows\System\RmhpyUu.exe
  2⤵
  PID:11576
- C:\Windows\System\rlDZBCd.exe
  C:\Windows\System\rlDZBCd.exe
  2⤵
  PID:11608
- C:\Windows\System\AjbUuQb.exe
  C:\Windows\System\AjbUuQb.exe
  2⤵
  PID:11624
- C:\Windows\System\LmJpfoQ.exe
  C:\Windows\System\LmJpfoQ.exe
  2⤵
  PID:11644
- C:\Windows\System\muSzWzm.exe
  C:\Windows\System\muSzWzm.exe
  2⤵
  PID:11680
- C:\Windows\System\rGcMbJv.exe
  C:\Windows\System\rGcMbJv.exe
  2⤵
  PID:11700
- C:\Windows\System\dSZDcqG.exe
  C:\Windows\System\dSZDcqG.exe
  2⤵
  PID:11728
- C:\Windows\System\QyqhVTH.exe
  C:\Windows\System\QyqhVTH.exe
  2⤵
  PID:11752
- C:\Windows\System\mAzpFkU.exe
  C:\Windows\System\mAzpFkU.exe
  2⤵
  PID:11776
- C:\Windows\System\fXvpDCO.exe
  C:\Windows\System\fXvpDCO.exe
  2⤵
  PID:11812
- C:\Windows\System\wOQMQmA.exe
  C:\Windows\System\wOQMQmA.exe
  2⤵
  PID:11828
- C:\Windows\System\YVaWGbu.exe
  C:\Windows\System\YVaWGbu.exe
  2⤵
  PID:11856
- C:\Windows\System\NVEzmaX.exe
  C:\Windows\System\NVEzmaX.exe
  2⤵
  PID:11920
- C:\Windows\System\OwbQsYu.exe
  C:\Windows\System\OwbQsYu.exe
  2⤵
  PID:11940
- C:\Windows\System\sqYACbl.exe
  C:\Windows\System\sqYACbl.exe
  2⤵
  PID:11976
- C:\Windows\System\XybqCMY.exe
  C:\Windows\System\XybqCMY.exe
  2⤵
  PID:12012
- C:\Windows\System\pIkgxBn.exe
  C:\Windows\System\pIkgxBn.exe
  2⤵
  PID:12040
- C:\Windows\System\LJaPtsT.exe
  C:\Windows\System\LJaPtsT.exe
  2⤵
  PID:12068
- C:\Windows\System\MGNQxLN.exe
  C:\Windows\System\MGNQxLN.exe
  2⤵
  PID:12100
- C:\Windows\System\IZvwhxg.exe
  C:\Windows\System\IZvwhxg.exe
  2⤵
  PID:12124
- C:\Windows\System\VAtzkRE.exe
  C:\Windows\System\VAtzkRE.exe
  2⤵
  PID:12152
- C:\Windows\System\bMUWlVv.exe
  C:\Windows\System\bMUWlVv.exe
  2⤵
  PID:12188
- C:\Windows\System\gCCJGzb.exe
  C:\Windows\System\gCCJGzb.exe
  2⤵
  PID:12212
- C:\Windows\System\OLWeIah.exe
  C:\Windows\System\OLWeIah.exe
  2⤵
  PID:12228
- C:\Windows\System\rrJCELq.exe
  C:\Windows\System\rrJCELq.exe
  2⤵
  PID:12256
- C:\Windows\System\RaQgJmu.exe
  C:\Windows\System\RaQgJmu.exe
  2⤵
  PID:11048
- C:\Windows\System\PRjJHjJ.exe
  C:\Windows\System\PRjJHjJ.exe
  2⤵
  PID:11148
- C:\Windows\System\zyQoYPO.exe
  C:\Windows\System\zyQoYPO.exe
  2⤵
  PID:10544
- C:\Windows\System\EeJYEGx.exe
  C:\Windows\System\EeJYEGx.exe
  2⤵
  PID:11444
- C:\Windows\System\oakSxPR.exe
  C:\Windows\System\oakSxPR.exe
  2⤵
  PID:11280
- C:\Windows\System\WmumbUQ.exe
  C:\Windows\System\WmumbUQ.exe
  2⤵
  PID:11480
- C:\Windows\System\duBnGeq.exe
  C:\Windows\System\duBnGeq.exe
  2⤵
  PID:11508
- C:\Windows\System\BQnUWGH.exe
  C:\Windows\System\BQnUWGH.exe
  2⤵
  PID:11532
- C:\Windows\System\dwEHKEE.exe
  C:\Windows\System\dwEHKEE.exe
  2⤵
  PID:11672
- C:\Windows\System\NvQIQnW.exe
  C:\Windows\System\NvQIQnW.exe
  2⤵
  PID:10216
- C:\Windows\System\PLNUoIl.exe
  C:\Windows\System\PLNUoIl.exe
  2⤵
  PID:11716
- C:\Windows\System\uEXAXLs.exe
  C:\Windows\System\uEXAXLs.exe
  2⤵
  PID:11724
- C:\Windows\System\HXTofCg.exe
  C:\Windows\System\HXTofCg.exe
  2⤵
  PID:11824
- C:\Windows\System\iRHeyvE.exe
  C:\Windows\System\iRHeyvE.exe
  2⤵
  PID:11844
- C:\Windows\System\jDJJKsl.exe
  C:\Windows\System\jDJJKsl.exe
  2⤵
  PID:11932
- C:\Windows\System\HQaclsF.exe
  C:\Windows\System\HQaclsF.exe
  2⤵
  PID:12052
- C:\Windows\System\OQfherN.exe
  C:\Windows\System\OQfherN.exe
  2⤵
  PID:12196
- C:\Windows\System\kBKCEfc.exe
  C:\Windows\System\kBKCEfc.exe
  2⤵
  PID:9812
- C:\Windows\System\dXykxJm.exe
  C:\Windows\System\dXykxJm.exe
  2⤵
  PID:12284
- C:\Windows\System\dYpjxvf.exe
  C:\Windows\System\dYpjxvf.exe
  2⤵
  PID:12268
- C:\Windows\System\QAxkJfj.exe
  C:\Windows\System\QAxkJfj.exe
  2⤵
  PID:11488
- C:\Windows\System\ToxGeQA.exe
  C:\Windows\System\ToxGeQA.exe
  2⤵
  PID:11324
- C:\Windows\System\VzoOFAD.exe
  C:\Windows\System\VzoOFAD.exe
  2⤵
  PID:11668
- C:\Windows\System\vewYlGx.exe
  C:\Windows\System\vewYlGx.exe
  2⤵
  PID:12024
- C:\Windows\System\KzMUZLT.exe
  C:\Windows\System\KzMUZLT.exe
  2⤵
  PID:11768
- C:\Windows\System\FfdRxwr.exe
  C:\Windows\System\FfdRxwr.exe
  2⤵
  PID:12280
- C:\Windows\System\oqHVRuW.exe
  C:\Windows\System\oqHVRuW.exe
  2⤵
  PID:12224
- C:\Windows\System\AEHQPgb.exe
  C:\Windows\System\AEHQPgb.exe
  2⤵
  PID:11740
- C:\Windows\System\OAwxeqC.exe
  C:\Windows\System\OAwxeqC.exe
  2⤵
  PID:12308
- C:\Windows\System\ToTbodV.exe
  C:\Windows\System\ToTbodV.exe
  2⤵
  PID:12336
- C:\Windows\System\aiUfYKK.exe
  C:\Windows\System\aiUfYKK.exe
  2⤵
  PID:12356
- C:\Windows\System\XuAAgyY.exe
  C:\Windows\System\XuAAgyY.exe
  2⤵
  PID:12396
- C:\Windows\System\gEssGJK.exe
  C:\Windows\System\gEssGJK.exe
  2⤵
  PID:12428
- C:\Windows\System\NtikUIW.exe
  C:\Windows\System\NtikUIW.exe
  2⤵
  PID:12460
- C:\Windows\System\mknhgqZ.exe
  C:\Windows\System\mknhgqZ.exe
  2⤵
  PID:12488
- C:\Windows\System\FpUSxxH.exe
  C:\Windows\System\FpUSxxH.exe
  2⤵
  PID:12512
- C:\Windows\System\igmUZdn.exe
  C:\Windows\System\igmUZdn.exe
  2⤵
  PID:12544
- C:\Windows\System\MTeJxcw.exe
  C:\Windows\System\MTeJxcw.exe
  2⤵
  PID:12600
- C:\Windows\System\RIirBPt.exe
  C:\Windows\System\RIirBPt.exe
  2⤵
  PID:12632
- C:\Windows\System\YznsFgx.exe
  C:\Windows\System\YznsFgx.exe
  2⤵
  PID:12668
- C:\Windows\System\mOCUvcd.exe
  C:\Windows\System\mOCUvcd.exe
  2⤵
  PID:12696
- C:\Windows\System\OFrvATD.exe
  C:\Windows\System\OFrvATD.exe
  2⤵
  PID:12720
- C:\Windows\System\cAvwXvF.exe
  C:\Windows\System\cAvwXvF.exe
  2⤵
  PID:12744
- C:\Windows\System\voVPDHP.exe
  C:\Windows\System\voVPDHP.exe
  2⤵
  PID:12772
- C:\Windows\System\BPMLxqh.exe
  C:\Windows\System\BPMLxqh.exe
  2⤵
  PID:12800
- C:\Windows\System\Ktcrvgj.exe
  C:\Windows\System\Ktcrvgj.exe
  2⤵
  PID:12828
- C:\Windows\System\hRJMqsm.exe
  C:\Windows\System\hRJMqsm.exe
  2⤵
  PID:12852
- C:\Windows\System\bEAwpWf.exe
  C:\Windows\System\bEAwpWf.exe
  2⤵
  PID:12884
- C:\Windows\System\DuiMrsg.exe
  C:\Windows\System\DuiMrsg.exe
  2⤵
  PID:12924
- C:\Windows\System\dcAabfn.exe
  C:\Windows\System\dcAabfn.exe
  2⤵
  PID:12940
- C:\Windows\System\bWlInvl.exe
  C:\Windows\System\bWlInvl.exe
  2⤵
  PID:12964
- C:\Windows\System\hOtLZjq.exe
  C:\Windows\System\hOtLZjq.exe
  2⤵
  PID:12984
- C:\Windows\System\PuCHrHv.exe
  C:\Windows\System\PuCHrHv.exe
  2⤵
  PID:13004
- C:\Windows\System\BIKPONR.exe
  C:\Windows\System\BIKPONR.exe
  2⤵
  PID:13036
- C:\Windows\System\jNhzUrr.exe
  C:\Windows\System\jNhzUrr.exe
  2⤵
  PID:13060
- C:\Windows\System\uwqkTEz.exe
  C:\Windows\System\uwqkTEz.exe
  2⤵
  PID:13096
- C:\Windows\System\hHhZqyi.exe
  C:\Windows\System\hHhZqyi.exe
  2⤵
  PID:13120
- C:\Windows\System\krUGxIk.exe
  C:\Windows\System\krUGxIk.exe
  2⤵
  PID:13148
- C:\Windows\System\TQMxggt.exe
  C:\Windows\System\TQMxggt.exe
  2⤵
  PID:13180
- C:\Windows\System\zuvIfMw.exe
  C:\Windows\System\zuvIfMw.exe
  2⤵
  PID:13204
- C:\Windows\System\VwCRgXk.exe
  C:\Windows\System\VwCRgXk.exe
  2⤵
  PID:13232
- C:\Windows\System\nbNQnCF.exe
  C:\Windows\System\nbNQnCF.exe
  2⤵
  PID:13256
- C:\Windows\System\fQpGRvJ.exe
  C:\Windows\System\fQpGRvJ.exe
  2⤵
  PID:13280
- C:\Windows\System\iXsEdOw.exe
  C:\Windows\System\iXsEdOw.exe
  2⤵
  PID:13296
- C:\Windows\System\aStgzXr.exe
  C:\Windows\System\aStgzXr.exe
  2⤵
  PID:11864
- C:\Windows\System\bPbTFbF.exe
  C:\Windows\System\bPbTFbF.exe
  2⤵
  PID:12064
- C:\Windows\System\ZmYhBQK.exe
  C:\Windows\System\ZmYhBQK.exe
  2⤵
  PID:12292
- C:\Windows\System\wCDUThy.exe
  C:\Windows\System\wCDUThy.exe
  2⤵
  PID:11400
- C:\Windows\System\ohIKgip.exe
  C:\Windows\System\ohIKgip.exe
  2⤵
  PID:12472
- C:\Windows\System\HfphRoG.exe
  C:\Windows\System\HfphRoG.exe
  2⤵
  PID:12624
- C:\Windows\System\yMlTlpv.exe
  C:\Windows\System\yMlTlpv.exe
  2⤵
  PID:12508
- C:\Windows\System\vqTGFFc.exe
  C:\Windows\System\vqTGFFc.exe
  2⤵
  PID:12612
- C:\Windows\System\DSJpvIm.exe
  C:\Windows\System\DSJpvIm.exe
  2⤵
  PID:12732
- C:\Windows\System\YFcMoMT.exe
  C:\Windows\System\YFcMoMT.exe
  2⤵
  PID:12760
- C:\Windows\System\yNncYJH.exe
  C:\Windows\System\yNncYJH.exe
  2⤵
  PID:12896
- C:\Windows\System\rFtYCEe.exe
  C:\Windows\System\rFtYCEe.exe
  2⤵
  PID:12952
- C:\Windows\System\sjxymTB.exe
  C:\Windows\System\sjxymTB.exe
  2⤵
  PID:12992
- C:\Windows\System\nOpyWhF.exe
  C:\Windows\System\nOpyWhF.exe
  2⤵
  PID:13028
- C:\Windows\System\yHkAVul.exe
  C:\Windows\System\yHkAVul.exe
  2⤵
  PID:13104
- C:\Windows\System\GpyzPGF.exe
  C:\Windows\System\GpyzPGF.exe
  2⤵
  PID:13200
- C:\Windows\System\XGloUFP.exe
  C:\Windows\System\XGloUFP.exe
  2⤵
  PID:13080
- C:\Windows\System\QekRDDK.exe
  C:\Windows\System\QekRDDK.exe
  2⤵
  PID:13224
- C:\Windows\System\JnAiQUA.exe
  C:\Windows\System\JnAiQUA.exe
  2⤵
  PID:12328
- C:\Windows\System\jJqdDuk.exe
  C:\Windows\System\jJqdDuk.exe
  2⤵
  PID:11880
- C:\Windows\System\eLcHrzC.exe
  C:\Windows\System\eLcHrzC.exe
  2⤵
  PID:12640
- C:\Windows\System\SOjPeov.exe
  C:\Windows\System\SOjPeov.exe
  2⤵
  PID:12616
- C:\Windows\System\khQeHhg.exe
  C:\Windows\System\khQeHhg.exe
  2⤵
  PID:12824
- C:\Windows\System\UFnzMXP.exe
  C:\Windows\System\UFnzMXP.exe
  2⤵
  PID:12880
- C:\Windows\System\uvszcXc.exe
  C:\Windows\System\uvszcXc.exe
  2⤵
  PID:12980
- C:\Windows\System\msIzbKf.exe
  C:\Windows\System\msIzbKf.exe
  2⤵
  PID:13016
- C:\Windows\System\BFlILjw.exe
  C:\Windows\System\BFlILjw.exe
  2⤵
  PID:13276
- C:\Windows\System\egTUTDD.exe
  C:\Windows\System\egTUTDD.exe
  2⤵
  PID:13348
- C:\Windows\System\IVUZqni.exe
  C:\Windows\System\IVUZqni.exe
  2⤵
  PID:13372
- C:\Windows\System\XwVxDwn.exe
  C:\Windows\System\XwVxDwn.exe
  2⤵
  PID:13392
- C:\Windows\System\lLcTzwf.exe
  C:\Windows\System\lLcTzwf.exe
  2⤵
  PID:13420
- C:\Windows\System\bGjOMKe.exe
  C:\Windows\System\bGjOMKe.exe
  2⤵
  PID:13452
- C:\Windows\System\xfwMpjz.exe
  C:\Windows\System\xfwMpjz.exe
  2⤵
  PID:13484
- C:\Windows\System\IqYMmyd.exe
  C:\Windows\System\IqYMmyd.exe
  2⤵
  PID:13520
- C:\Windows\System\BrKGfjA.exe
  C:\Windows\System\BrKGfjA.exe
  2⤵
  PID:13544
- C:\Windows\System\LCegkGq.exe
  C:\Windows\System\LCegkGq.exe
  2⤵
  PID:13564
- C:\Windows\System\gzGUiIf.exe
  C:\Windows\System\gzGUiIf.exe
  2⤵
  PID:13580
- C:\Windows\System\Idyqamw.exe
  C:\Windows\System\Idyqamw.exe
  2⤵
  PID:13612
- C:\Windows\System\xskJoUB.exe
  C:\Windows\System\xskJoUB.exe
  2⤵
  PID:13636
- C:\Windows\System\dTAJhuB.exe
  C:\Windows\System\dTAJhuB.exe
  2⤵
  PID:13664
- C:\Windows\System\nocHvKv.exe
  C:\Windows\System\nocHvKv.exe
  2⤵
  PID:13692
- C:\Windows\System\PffLCxB.exe
  C:\Windows\System\PffLCxB.exe
  2⤵
  PID:13712
- C:\Windows\System\CjeGiGF.exe
  C:\Windows\System\CjeGiGF.exe
  2⤵
  PID:13744
- C:\Windows\System\RHNzLsY.exe
  C:\Windows\System\RHNzLsY.exe
  2⤵
  PID:13764
- C:\Windows\System\FxIAUtp.exe
  C:\Windows\System\FxIAUtp.exe
  2⤵
  PID:13796
- C:\Windows\System\ftpSbeo.exe
  C:\Windows\System\ftpSbeo.exe
  2⤵
  PID:13816
- C:\Windows\System\RNvEIfD.exe
  C:\Windows\System\RNvEIfD.exe
  2⤵
  PID:13848
- C:\Windows\System\DFUfdJf.exe
  C:\Windows\System\DFUfdJf.exe
  2⤵
  PID:13868
- C:\Windows\System\IEnSejW.exe
  C:\Windows\System\IEnSejW.exe
  2⤵
  PID:13892
- C:\Windows\System\EyzsiaY.exe
  C:\Windows\System\EyzsiaY.exe
  2⤵
  PID:13908
- C:\Windows\System\IVSGXSL.exe
  C:\Windows\System\IVSGXSL.exe
  2⤵
  PID:13936
- C:\Windows\System\eVqPWoc.exe
  C:\Windows\System\eVqPWoc.exe
  2⤵
  PID:13952
- C:\Windows\System\SlRWrMf.exe
  C:\Windows\System\SlRWrMf.exe
  2⤵
  PID:13976
- C:\Windows\System\uHJeywR.exe
  C:\Windows\System\uHJeywR.exe
  2⤵
  PID:14000
- C:\Windows\System\ZdDOaXr.exe
  C:\Windows\System\ZdDOaXr.exe
  2⤵
  PID:14028
- C:\Windows\System\GZDBmYw.exe
  C:\Windows\System\GZDBmYw.exe
  2⤵
  PID:14060
- C:\Windows\System\IrymhoB.exe
  C:\Windows\System\IrymhoB.exe
  2⤵
  PID:14080
- C:\Windows\System\vlPhpbZ.exe
  C:\Windows\System\vlPhpbZ.exe
  2⤵
  PID:14112
- C:\Windows\System\XtHdCLh.exe
  C:\Windows\System\XtHdCLh.exe
  2⤵
  PID:14132
- C:\Windows\System\mGZNMMQ.exe
  C:\Windows\System\mGZNMMQ.exe
  2⤵
  PID:14156
- C:\Windows\System\fwrMQKm.exe
  C:\Windows\System\fwrMQKm.exe
  2⤵
  PID:14192
- C:\Windows\System\kammsZT.exe
  C:\Windows\System\kammsZT.exe
  2⤵
  PID:14208
- C:\Windows\System\DcVfGtn.exe
  C:\Windows\System\DcVfGtn.exe
  2⤵
  PID:14232
- C:\Windows\System\QHwKwXT.exe
  C:\Windows\System\QHwKwXT.exe
  2⤵
  PID:14256
- C:\Windows\System\EYIDIRw.exe
  C:\Windows\System\EYIDIRw.exe
  2⤵
  PID:14284
- C:\Windows\System\RuCaPRS.exe
  C:\Windows\System\RuCaPRS.exe
  2⤵
  PID:14308
- C:\Windows\System\hvBmxhM.exe
  C:\Windows\System\hvBmxhM.exe
  2⤵
  PID:13216
- C:\Windows\System\dIyfhFP.exe
  C:\Windows\System\dIyfhFP.exe
  2⤵
  PID:12316
- C:\Windows\System\DdQGgyN.exe
  C:\Windows\System\DdQGgyN.exe
  2⤵
  PID:11616
- C:\Windows\System\RTSPtwk.exe
  C:\Windows\System\RTSPtwk.exe
  2⤵
  PID:13472
- C:\Windows\System\RKlPpmq.exe
  C:\Windows\System\RKlPpmq.exe
  2⤵
  PID:13500
- C:\Windows\System\cVaqFeY.exe
  C:\Windows\System\cVaqFeY.exe
  2⤵
  PID:13332
- C:\Windows\System\uaDNHJG.exe
  C:\Windows\System\uaDNHJG.exe
  2⤵
  PID:13528
- C:\Windows\System\CXgAFLZ.exe
  C:\Windows\System\CXgAFLZ.exe
  2⤵
  PID:13596
- C:\Windows\System\yijomKV.exe
  C:\Windows\System\yijomKV.exe
  2⤵
  PID:13688
- C:\Windows\System\trYnvUS.exe
  C:\Windows\System\trYnvUS.exe
  2⤵
  PID:13752
- C:\Windows\System\MrOOBlg.exe
  C:\Windows\System\MrOOBlg.exe
  2⤵
  PID:13644
- C:\Windows\System\pGMFoLi.exe
  C:\Windows\System\pGMFoLi.exe
  2⤵
  PID:13924
- C:\Windows\System\jfWZNWS.exe
  C:\Windows\System\jfWZNWS.exe
  2⤵
  PID:13996
- C:\Windows\System\HhqHCfa.exe
  C:\Windows\System\HhqHCfa.exe
  2⤵
  PID:14040
- C:\Windows\System\cvUaUkZ.exe
  C:\Windows\System\cvUaUkZ.exe
  2⤵
  PID:14072
- C:\Windows\System\Gytania.exe
  C:\Windows\System\Gytania.exe
  2⤵
  PID:14120
- C:\Windows\System\FxPEFYW.exe
  C:\Windows\System\FxPEFYW.exe
  2⤵
  PID:14188
- C:\Windows\System\ixRpTNs.exe
  C:\Windows\System\ixRpTNs.exe
  2⤵
  PID:14320
- C:\Windows\System\qpDHxpS.exe
  C:\Windows\System\qpDHxpS.exe
  2⤵
  PID:14168
- C:\Windows\System\irnDBEQ.exe
  C:\Windows\System\irnDBEQ.exe
  2⤵
  PID:14204
- C:\Windows\System\GTTfOJj.exe
  C:\Windows\System\GTTfOJj.exe
  2⤵
  PID:13560
- C:\Windows\System\jvKnfnb.exe
  C:\Windows\System\jvKnfnb.exe
  2⤵
  PID:13676
- C:\Windows\System\OsGpXId.exe
  C:\Windows\System\OsGpXId.exe
  2⤵
  PID:13812
- C:\Windows\System\CFnfCWs.exe
  C:\Windows\System\CFnfCWs.exe
  2⤵
  PID:13076
- C:\Windows\System\jwgdMtK.exe
  C:\Windows\System\jwgdMtK.exe
  2⤵
  PID:12708
- C:\Windows\System\SPxMmfr.exe
  C:\Windows\System\SPxMmfr.exe
  2⤵
  PID:13532
- C:\Windows\System\xsnPSmT.exe
  C:\Windows\System\xsnPSmT.exe
  2⤵
  PID:13960
- C:\Windows\System\QvVzNTU.exe
  C:\Windows\System\QvVzNTU.exe
  2⤵
  PID:13740
- C:\Windows\System\lMvtTnC.exe
  C:\Windows\System\lMvtTnC.exe
  2⤵
  PID:14340
- C:\Windows\System\apGtRgD.exe
  C:\Windows\System\apGtRgD.exe
  2⤵
  PID:14364
- C:\Windows\System\HVFavIf.exe
  C:\Windows\System\HVFavIf.exe
  2⤵
  PID:14396
- C:\Windows\System\xCltxrp.exe
  C:\Windows\System\xCltxrp.exe
  2⤵
  PID:14416
- C:\Windows\System\NbRagUT.exe
  C:\Windows\System\NbRagUT.exe
  2⤵
  PID:14436
- C:\Windows\System\GRCkJkA.exe
  C:\Windows\System\GRCkJkA.exe
  2⤵
  PID:14476
- C:\Windows\System\oGldJyk.exe
  C:\Windows\System\oGldJyk.exe
  2⤵
  PID:14500
- C:\Windows\System\AtkCxVQ.exe
  C:\Windows\System\AtkCxVQ.exe
  2⤵
  PID:14520
- C:\Windows\System\TwJoQYC.exe
  C:\Windows\System\TwJoQYC.exe
  2⤵
  PID:14812
- C:\Windows\System\BUVfFis.exe
  C:\Windows\System\BUVfFis.exe
  2⤵
  PID:14828
- C:\Windows\System\AJfimIq.exe
  C:\Windows\System\AJfimIq.exe
  2⤵
  PID:14856
- C:\Windows\System\edrQthM.exe
  C:\Windows\System\edrQthM.exe
  2⤵
  PID:14876
- C:\Windows\System\DNDHXxB.exe
  C:\Windows\System\DNDHXxB.exe
  2⤵
  PID:14900
- C:\Windows\System\bNLpqNx.exe
  C:\Windows\System\bNLpqNx.exe
  2⤵
  PID:14920
- C:\Windows\System\QXzSUeL.exe
  C:\Windows\System\QXzSUeL.exe
  2⤵
  PID:14936
- C:\Windows\System\xsbJDYU.exe
  C:\Windows\System\xsbJDYU.exe
  2⤵
  PID:14952
- C:\Windows\System\wFidKIm.exe
  C:\Windows\System\wFidKIm.exe
  2⤵
  PID:14972
- C:\Windows\System\aScIibV.exe
  C:\Windows\System\aScIibV.exe
  2⤵
  PID:14996
- C:\Windows\System\xAdboZU.exe
  C:\Windows\System\xAdboZU.exe
  2⤵
  PID:15024
- C:\Windows\System\GdqIanT.exe
  C:\Windows\System\GdqIanT.exe
  2⤵
  PID:15056
- C:\Windows\System\kOoXJCc.exe
  C:\Windows\System\kOoXJCc.exe
  2⤵
  PID:15080
- C:\Windows\System\nqiJimj.exe
  C:\Windows\System\nqiJimj.exe
  2⤵
  PID:15100
- C:\Windows\System\DTXqHik.exe
  C:\Windows\System\DTXqHik.exe
  2⤵
  PID:15132
- C:\Windows\System\NRKfIGl.exe
  C:\Windows\System\NRKfIGl.exe
  2⤵
  PID:15160
- C:\Windows\System\rRMxtKV.exe
  C:\Windows\System\rRMxtKV.exe
  2⤵
  PID:15192
- C:\Windows\System\xpIQJvm.exe
  C:\Windows\System\xpIQJvm.exe
  2⤵
  PID:15216
- C:\Windows\System\vBYSKqv.exe
  C:\Windows\System\vBYSKqv.exe
  2⤵
  PID:15236
- C:\Windows\System\MeWCeoQ.exe
  C:\Windows\System\MeWCeoQ.exe
  2⤵
  PID:15268
- C:\Windows\System\nMrEifF.exe
  C:\Windows\System\nMrEifF.exe
  2⤵
  PID:15300
- C:\Windows\System\NUCUBsv.exe
  C:\Windows\System\NUCUBsv.exe
  2⤵
  PID:15324
- C:\Windows\System\CcskAMa.exe
  C:\Windows\System\CcskAMa.exe
  2⤵
  PID:15352
- C:\Windows\System\pjVbLcY.exe
  C:\Windows\System\pjVbLcY.exe
  2⤵
  PID:13480
- C:\Windows\System\ZJchtyD.exe
  C:\Windows\System\ZJchtyD.exe
  2⤵
  PID:14248
- C:\Windows\System\cyPWLmJ.exe
  C:\Windows\System\cyPWLmJ.exe
  2⤵
  PID:14360
- C:\Windows\System\DhgpXKV.exe
  C:\Windows\System\DhgpXKV.exe
  2⤵
  PID:13840
- C:\Windows\System\WchqOhl.exe
  C:\Windows\System\WchqOhl.exe
  2⤵
  PID:14512
- C:\Windows\System\pzDCnCH.exe
  C:\Windows\System\pzDCnCH.exe
  2⤵
  PID:14384
- C:\Windows\System\yFLtVgv.exe
  C:\Windows\System\yFLtVgv.exe
  2⤵
  PID:14392
- C:\Windows\System\IELIUMo.exe
  C:\Windows\System\IELIUMo.exe
  2⤵
  PID:14460
- C:\Windows\System\zgQFQEe.exe
  C:\Windows\System\zgQFQEe.exe
  2⤵
  PID:14580
- C:\Windows\System\PcoNFpG.exe
  C:\Windows\System\PcoNFpG.exe
  2⤵
  PID:14640
- C:\Windows\System\rHUatFl.exe
  C:\Windows\System\rHUatFl.exe
  2⤵
  PID:14756
- C:\Windows\System\dvfJJZi.exe
  C:\Windows\System\dvfJJZi.exe
  2⤵
  PID:14824
- C:\Windows\System\zZAmybl.exe
  C:\Windows\System\zZAmybl.exe
  2⤵
  PID:14892
- C:\Windows\System\yQdrbPz.exe
  C:\Windows\System\yQdrbPz.exe
  2⤵
  PID:14944
- C:\Windows\System\EUhJHxf.exe
  C:\Windows\System\EUhJHxf.exe
  2⤵
  PID:15032
- C:\Windows\System\STPmgZl.exe
  C:\Windows\System\STPmgZl.exe
  2⤵
  PID:15144
- C:\Windows\System\fkNvdBK.exe
  C:\Windows\System\fkNvdBK.exe
  2⤵
  PID:15120
- C:\Windows\System\PmQCiYZ.exe
  C:\Windows\System\PmQCiYZ.exe
  2⤵
  PID:15172
- C:\Windows\System\Hyawlpk.exe
  C:\Windows\System\Hyawlpk.exe
  2⤵
  PID:15224
- C:\Windows\System\NKBXnLX.exe
  C:\Windows\System\NKBXnLX.exe
  2⤵
  PID:15312
- C:\Windows\System\gfatTyb.exe
  C:\Windows\System\gfatTyb.exe
  2⤵
  PID:14448
- C:\Windows\System\ypQIxQH.exe
  C:\Windows\System\ypQIxQH.exe
  2⤵
  PID:13732
- C:\Windows\System\JbJtqZs.exe
  C:\Windows\System\JbJtqZs.exe
  2⤵
  PID:14516
- C:\Windows\System\lvVcLJo.exe
  C:\Windows\System\lvVcLJo.exe
  2⤵
  PID:14752
- C:\Windows\System\OOJiONy.exe
  C:\Windows\System\OOJiONy.exe
  2⤵
  PID:14484
- C:\Windows\System\HFGhBmg.exe
  C:\Windows\System\HFGhBmg.exe
  2⤵
  PID:15020
- C:\Windows\System\VaIIuQN.exe
  C:\Windows\System\VaIIuQN.exe
  2⤵
  PID:14844
- C:\Windows\System\MDZzkEd.exe
  C:\Windows\System\MDZzkEd.exe
  2⤵
  PID:15116
- C:\Windows\System\YLFAVJk.exe
  C:\Windows\System\YLFAVJk.exe
  2⤵
  PID:14432
- C:\Windows\System\GMpGLqw.exe
  C:\Windows\System\GMpGLqw.exe
  2⤵
  PID:15380
- C:\Windows\System\VgkLEyG.exe
  C:\Windows\System\VgkLEyG.exe
  2⤵
  PID:15404
- C:\Windows\System\IKuSLei.exe
  C:\Windows\System\IKuSLei.exe
  2⤵
  PID:15428
- C:\Windows\System\iLqPOWa.exe
  C:\Windows\System\iLqPOWa.exe
  2⤵
  PID:15444
- C:\Windows\System\JJWQgdf.exe
  C:\Windows\System\JJWQgdf.exe
  2⤵
  PID:15472
- C:\Windows\System\TFNtGEl.exe
  C:\Windows\System\TFNtGEl.exe
  2⤵
  PID:15504
- C:\Windows\System\KYlgQiw.exe
  C:\Windows\System\KYlgQiw.exe
  2⤵
  PID:15536
- C:\Windows\System\hTSXAuK.exe
  C:\Windows\System\hTSXAuK.exe
  2⤵
  PID:15552
- C:\Windows\System\JGbBrhN.exe
  C:\Windows\System\JGbBrhN.exe
  2⤵
  PID:15572
- C:\Windows\System\GPEUZha.exe
  C:\Windows\System\GPEUZha.exe
  2⤵
  PID:15600
- C:\Windows\System\XmYPPtg.exe
  C:\Windows\System\XmYPPtg.exe
  2⤵
  PID:15616
- C:\Windows\System\ADXEzzr.exe
  C:\Windows\System\ADXEzzr.exe
  2⤵
  PID:15652
- C:\Windows\System\UgGJkHR.exe
  C:\Windows\System\UgGJkHR.exe
  2⤵
  PID:15676
- C:\Windows\System\owJDWUs.exe
  C:\Windows\System\owJDWUs.exe
  2⤵
  PID:15704
- C:\Windows\System\VQsTIDg.exe
  C:\Windows\System\VQsTIDg.exe
  2⤵
  PID:15720
- C:\Windows\System\wMzXcDA.exe
  C:\Windows\System\wMzXcDA.exe
  2⤵
  PID:15740
- C:\Windows\System\yxdUgBM.exe
  C:\Windows\System\yxdUgBM.exe
  2⤵
  PID:15768
- C:\Windows\System\yseXDtx.exe
  C:\Windows\System\yseXDtx.exe
  2⤵
  PID:15796
- C:\Windows\System\uSmxkKa.exe
  C:\Windows\System\uSmxkKa.exe
  2⤵
  PID:15824
- C:\Windows\System\DtKGViM.exe
  C:\Windows\System\DtKGViM.exe
  2⤵
  PID:15860
- C:\Windows\System\xEDEVzG.exe
  C:\Windows\System\xEDEVzG.exe
  2⤵
  PID:15884
- C:\Windows\System\jzkVcyE.exe
  C:\Windows\System\jzkVcyE.exe
  2⤵
  PID:15928
- C:\Windows\System\PCIgYMJ.exe
  C:\Windows\System\PCIgYMJ.exe
  2⤵
  PID:15952
- C:\Windows\System\jXJJmjr.exe
  C:\Windows\System\jXJJmjr.exe
  2⤵
  PID:15988
- C:\Windows\System\uREfDLW.exe
  C:\Windows\System\uREfDLW.exe
  2⤵
  PID:16008
- C:\Windows\System\BtLqQbk.exe
  C:\Windows\System\BtLqQbk.exe
  2⤵
  PID:16036
- C:\Windows\System\QKpkYLL.exe
  C:\Windows\System\QKpkYLL.exe
  2⤵
  PID:16064
- C:\Windows\System\PZtQdUI.exe
  C:\Windows\System\PZtQdUI.exe
  2⤵
  PID:16084
- C:\Windows\System\iRVKZWc.exe
  C:\Windows\System\iRVKZWc.exe
  2⤵
  PID:16112
- C:\Windows\System\qqMvtfr.exe
  C:\Windows\System\qqMvtfr.exe
  2⤵
  PID:16128
- C:\Windows\System\iWdJLpJ.exe
  C:\Windows\System\iWdJLpJ.exe
  2⤵
  PID:16156
- C:\Windows\System\fHAjwco.exe
  C:\Windows\System\fHAjwco.exe
  2⤵
  PID:16188
- C:\Windows\System\smcPIqI.exe
  C:\Windows\System\smcPIqI.exe
  2⤵
  PID:16204
- C:\Windows\System\egoaEnv.exe
  C:\Windows\System\egoaEnv.exe
  2⤵
  PID:16224
- C:\Windows\System\BMBJiMw.exe
  C:\Windows\System\BMBJiMw.exe
  2⤵
  PID:16256
- C:\Windows\System\vjBzdbZ.exe
  C:\Windows\System\vjBzdbZ.exe
  2⤵
  PID:16288
- C:\Windows\System\OmmNUkt.exe
  C:\Windows\System\OmmNUkt.exe
  2⤵
  PID:16324
- C:\Windows\System\HiBXzPb.exe
  C:\Windows\System\HiBXzPb.exe
  2⤵
  PID:16344
- C:\Windows\System\WveKpUF.exe
  C:\Windows\System\WveKpUF.exe
  2⤵
  PID:16376
- C:\Windows\System\ZHPDiPF.exe
  C:\Windows\System\ZHPDiPF.exe
  2⤵
  PID:15232
- C:\Windows\System\FZztMbF.exe
  C:\Windows\System\FZztMbF.exe
  2⤵
  PID:14728
- C:\Windows\System\EoNmsYT.exe
  C:\Windows\System\EoNmsYT.exe
  2⤵
  PID:15288
- C:\Windows\System\coynVRM.exe
  C:\Windows\System\coynVRM.exe
  2⤵
  PID:13156
- C:\Windows\System\GXIdRZj.exe
  C:\Windows\System\GXIdRZj.exe
  2⤵
  PID:15496
- C:\Windows\System\vyfYiSk.exe
  C:\Windows\System\vyfYiSk.exe
  2⤵
  PID:14968
- C:\Windows\System\tGjsOCE.exe
  C:\Windows\System\tGjsOCE.exe
  2⤵
  PID:15368
- C:\Windows\System\FnBsSWe.exe
  C:\Windows\System\FnBsSWe.exe
  2⤵
  PID:15532
- C:\Windows\System\yQztsWW.exe
  C:\Windows\System\yQztsWW.exe
  2⤵
  PID:15608
- C:\Windows\System\fVEFqpY.exe
  C:\Windows\System\fVEFqpY.exe
  2⤵
  PID:15668
- C:\Windows\System\PmPjlCj.exe
  C:\Windows\System\PmPjlCj.exe
  2⤵
  PID:15564
- C:\Windows\System\zXLsFgv.exe
  C:\Windows\System\zXLsFgv.exe
  2⤵
  PID:15628
- C:\Windows\System\igLkwnC.exe
  C:\Windows\System\igLkwnC.exe
  2⤵
  PID:15916
- C:\Windows\System\OKilDZS.exe
  C:\Windows\System\OKilDZS.exe
  2⤵
  PID:15836
- C:\Windows\System\BXGiNmQ.exe
  C:\Windows\System\BXGiNmQ.exe
  2⤵
  PID:15912
- C:\Windows\System\PfnLYtY.exe
  C:\Windows\System\PfnLYtY.exe
  2⤵
  PID:16148
- C:\Windows\System\QLSYTtG.exe
  C:\Windows\System\QLSYTtG.exe
  2⤵
  PID:16172
- C:\Windows\System\sHDgvxA.exe
  C:\Windows\System\sHDgvxA.exe
  2⤵
  PID:16280
- C:\Windows\System\tEDkgUg.exe
  C:\Windows\System\tEDkgUg.exe
  2⤵
  PID:16336
- C:\Windows\System\fmfGKzv.exe
  C:\Windows\System\fmfGKzv.exe
  2⤵
  PID:16200
- C:\Windows\System\cjtsCRD.exe
  C:\Windows\System\cjtsCRD.exe
  2⤵
  PID:16236
- C:\Windows\System\mfJcZqu.exe
  C:\Windows\System\mfJcZqu.exe
  2⤵
  PID:14532
- C:\Windows\System\tZSWLEA.exe
  C:\Windows\System\tZSWLEA.exe
  2⤵
  PID:15440
- C:\Windows\System\eVGLnhx.exe
  C:\Windows\System\eVGLnhx.exe
  2⤵
  PID:15464
- C:\Windows\System\FsPrppo.exe
  C:\Windows\System\FsPrppo.exe
  2⤵
  PID:15816
- C:\Windows\System\xiYudfh.exe
  C:\Windows\System\xiYudfh.exe
  2⤵
  PID:15696
- C:\Windows\System\CEpRISR.exe
  C:\Windows\System\CEpRISR.exe
  2⤵
  PID:14820
- C:\Windows\System\msVOodv.exe
  C:\Windows\System\msVOodv.exe
  2⤵
  PID:16164
- C:\Windows\System\gWFXJCS.exe
  C:\Windows\System\gWFXJCS.exe
  2⤵
  PID:16392
- C:\Windows\System\TiFIlIl.exe
  C:\Windows\System\TiFIlIl.exe
  2⤵
  PID:16420
- C:\Windows\System\jpLXkTA.exe
  C:\Windows\System\jpLXkTA.exe
  2⤵
  PID:16444
- C:\Windows\System\VWdJPMs.exe
  C:\Windows\System\VWdJPMs.exe
  2⤵
  PID:16468
- C:\Windows\System\sAOnYLu.exe
  C:\Windows\System\sAOnYLu.exe
  2⤵
  PID:16492
- C:\Windows\System\SbmUJKv.exe
  C:\Windows\System\SbmUJKv.exe
  2⤵
  PID:16516
- C:\Windows\System\WfjTHnE.exe
  C:\Windows\System\WfjTHnE.exe
  2⤵
  PID:16540
- C:\Windows\System\AKnXnrJ.exe
  C:\Windows\System\AKnXnrJ.exe
  2⤵
  PID:16580
- C:\Windows\System\msASEVG.exe
  C:\Windows\System\msASEVG.exe
  2⤵
  PID:16604
- C:\Windows\System\woXOBjC.exe
  C:\Windows\System\woXOBjC.exe
  2⤵
  PID:16632
- C:\Windows\System\ddBjbAN.exe
  C:\Windows\System\ddBjbAN.exe
  2⤵
  PID:16660
- C:\Windows\System\vxyfguy.exe
  C:\Windows\System\vxyfguy.exe
  2⤵
  PID:16688
- C:\Windows\System\haqOkjH.exe
  C:\Windows\System\haqOkjH.exe
  2⤵
  PID:16720
- C:\Windows\System\haxLCwX.exe
  C:\Windows\System\haxLCwX.exe
  2⤵
  PID:16736
- C:\Windows\System\CqEoXaB.exe
  C:\Windows\System\CqEoXaB.exe
  2⤵
  PID:16764
- C:\Windows\System\rUAWovH.exe
  C:\Windows\System\rUAWovH.exe
  2⤵
  PID:16792
- C:\Windows\System\uUMvioo.exe
  C:\Windows\System\uUMvioo.exe
  2⤵
  PID:16816
- C:\Windows\System\pFpvMcb.exe
  C:\Windows\System\pFpvMcb.exe
  2⤵
  PID:16840
- C:\Windows\System\HEDYGcJ.exe
  C:\Windows\System\HEDYGcJ.exe
  2⤵
  PID:16868
- C:\Windows\System\uuOHLfe.exe
  C:\Windows\System\uuOHLfe.exe
  2⤵
  PID:16892
- C:\Windows\System\GqLGnUl.exe
  C:\Windows\System\GqLGnUl.exe
  2⤵
  PID:16924
- C:\Windows\System\YGZDenq.exe
  C:\Windows\System\YGZDenq.exe
  2⤵
  PID:16948
- C:\Windows\System\nTKHBla.exe
  C:\Windows\System\nTKHBla.exe
  2⤵
  PID:16984
- C:\Windows\System\fQaTCir.exe
  C:\Windows\System\fQaTCir.exe
  2⤵
  PID:17004
- C:\Windows\System\nzBIsDX.exe
  C:\Windows\System\nzBIsDX.exe
  2⤵
  PID:17028
- C:\Windows\System\ZyCDptB.exe
  C:\Windows\System\ZyCDptB.exe
  2⤵
  PID:17048
- C:\Windows\System\KXUgquJ.exe
  C:\Windows\System\KXUgquJ.exe
  2⤵
  PID:17072
- C:\Windows\System\nVYtifJ.exe
  C:\Windows\System\nVYtifJ.exe
  2⤵
  PID:17340
- C:\Windows\System\LhNRwdq.exe
  C:\Windows\System\LhNRwdq.exe
  2⤵
  PID:17376
- C:\Windows\System\LOLzxGi.exe
  C:\Windows\System\LOLzxGi.exe
  2⤵
  PID:5008
- C:\Windows\System\AckLYGj.exe
  C:\Windows\System\AckLYGj.exe
  2⤵
  PID:16596
- C:\Windows\System\iaRwsAu.exe
  C:\Windows\System\iaRwsAu.exe
  2⤵
  PID:16320
- C:\Windows\System\YMkGpHD.exe
  C:\Windows\System\YMkGpHD.exe
  2⤵
  PID:16512
- C:\Windows\System\gnNLZnG.exe
  C:\Windows\System\gnNLZnG.exe
  2⤵
  PID:16560
- C:\Windows\System\gXQZIKd.exe
  C:\Windows\System\gXQZIKd.exe
  2⤵
  PID:17268
- C:\Windows\System\pPQahgK.exe
  C:\Windows\System\pPQahgK.exe
  2⤵
  PID:17248

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AVvTVtU.exe

Filesize
1.6MB

MD5
c50ad47a9c031684d833a86b75b39cc0

SHA1
d1f94e651c9ff165fe7be7a59c809307b984f0df

SHA256
45ba368be72b9303844e631b94b03beb5bef7ffa58bf971fa6a9488f9dd142b3

SHA512
ec95d1924cc1e70bd3f49553be70810b98621b2b97a9210a795958fa22a14fcd01748066f2dfafc8e6b8cebe24590f13ff692327f3d76dd7a339d67675f1389f

Download Submit
C:\Windows\System\BmSHGnO.exe

Filesize
1.6MB

MD5
5932c42ff945968b143ceac144f1d382

SHA1
3ada237e81806449798e18266e6d622d81629f09

SHA256
74bcf2e75bb061b9a45341f7e806a8ba6ccda99e3b0fa272dcb0cf35f3bd1cf3

SHA512
abace629e660465cbea6848ed53103e7ce827e120d6e4fd17727ed6ab1114f66cedebad6d5aa77a7ef914e631c53f4a975803399859e5405d7ad633113340590

Download Submit
C:\Windows\System\Cyxjdsq.exe

Filesize
1.6MB

MD5
c9255fa629804126a6ae701f2172c6cd

SHA1
d02cd739c3dcbcf9bebeba0974bac80902e4585f

SHA256
2d0f59ede45afa2ec3edd2a5b364854c17c3ef2c4439b392d8fb88931673f762

SHA512
07e140edd568a8d210a127aa04e7e4e99b41f0a959948c7c4a64aded1caf36e596b25d46fe164619af2cabdbce791555cfee6a819c150f300de91a1ff1ce1b5b

Download Submit
C:\Windows\System\DhuKAXN.exe

Filesize
1.6MB

MD5
c90b94b7be7d55d2eba0e74a5fbafe31

SHA1
1e7bb014ac583b65895e2f4b371a468d8e8354ea

SHA256
8665bfe721691798301ff226c65a577f02f918d500cb4b2fb8c5c21511af1319

SHA512
f9ee43c4623a9dd6bca2fe912a9ad84a78507b643067f22d205ca771ca48b6bd6094c5cf9717455eb8c2bcb263562460816c5977212a10a48418f3a34e6e3aba

Download Submit
C:\Windows\System\GUvGpVk.exe

Filesize
1.6MB

MD5
bbfae785487729183887183f958c5b7c

SHA1
d20e5b053128b6c5d52309487a75845f4076d8e2

SHA256
d9411ccb7ce5a63df149eb7b08ced4235e03d6f26d85f765c6f781e8d222d280

SHA512
d048c1db89a5c986292327169edcee5500608c61d420e88bf82ff56951465f62c8b653be4c1d3b374a934841c2f2911c0ec89573e4221a73aee3c35be0dcc7a5

Download Submit
C:\Windows\System\IpfPMfG.exe

Filesize
1.6MB

MD5
9d4a3708af108de6cb2ce215bd2fb176

SHA1
68d44b7c138c133b92a7f2e1e4409b75a7256ccc

SHA256
3cd1d3b2822c36a20f93b2102252792291ddba78d880b3d2cdacceba4ac9b1ae

SHA512
a0964efc0789357909abb41be62d35756a797a52d44e9422c1bdcfcf973883b392be0e3c23a97a4de6027230eb28b75d94a46391ca618626b07300cadc1143f9

Download Submit
C:\Windows\System\JRoCBVL.exe

Filesize
1.6MB

MD5
0959c926336ab2de5a672a72974e691f

SHA1
e1b977facb9c8434351fbe89ceb6eb2a6dfa58db

SHA256
51e4c4a135ab72f2ab6815f46c9300dd3edf0a34cde5372d4e0c468c8ef529dd

SHA512
a5e50523b6e6ee6d9434a3f3b311b5befd4739e21937ad0d24de074f91bfaa3437c0643c02b666cad1b0e701d837c10b37121af212f16a12fb67aea66ed2f3cc

Download Submit
C:\Windows\System\MCVHJSF.exe

Filesize
1.6MB

MD5
efcbf90f85528830ac6583d5f2161949

SHA1
8f4ecc273b2493d1ed404923785b22856711d063

SHA256
1d2a0b8ada1e53d1c5de38405487fe8a394ff93672738ec84f60b17d55b68306

SHA512
df92bcc0c2db5209045c6ca62e90dbafd125674ce54bdab19f6c8222386bca6290601ff245d6c058e81821d0be048f90289364dd64bcc46aeb821457ec9097fa

Download Submit
C:\Windows\System\NbCRukf.exe

Filesize
1.6MB

MD5
812f4051b3ceae3af0f45084a9f51267

SHA1
0295e67d647d6a751a47c911b00b16b6573a1be2

SHA256
18097ba527ce241b727d4e5410252886891601ba1020c50dcbfa149fe63c9c2f

SHA512
88e04840eda6116b866a51b052f11a5fd6f53b568e50f963460dc3d298e391ba9d5377b6772f29e43a151aa536dccbb70838cbee3737b5d36a777c66910aeabf

Download Submit
C:\Windows\System\PgwXKwM.exe

Filesize
1.6MB

MD5
01656a3addca6457e190b8e9e9d7aa5e

SHA1
67e073c618a928dd5841525228771a51ef88678e

SHA256
3802545984c16373781ecb2c021fd5c79535cfe22a9bbdc5aa45f72894111cf8

SHA512
290b4209ede7a79cf357e758d1c5a1ade9bed833f1f6fbac88e1640dafb0cacd94a27a0079f3ab93ee392823ddd8e38b0691a144c528bd5a81fde4684e44bb60

Download Submit
C:\Windows\System\QHoaZKC.exe

Filesize
1.6MB

MD5
21ea234bc253b141f014d1e257da3a6d

SHA1
310f66552f3f35d7bffd3c88db559e69aef3e2ad

SHA256
6d09594fcfc81a1033fce0eb824a3d01ee120fc0f9b9602db2a7ffcc3f977bd6

SHA512
0451309e14ab26f871c5b5aba29f19ebbb0f62b2038ccf9fc42d4e6d220b4f5543a106c6bba2b4ef7ae2ed65fb3f72446fb9fd1a6604d72f247a98c73167265b

Download Submit
C:\Windows\System\TyoKUDK.exe

Filesize
1.6MB

MD5
69e7d907f72dae01c8678964501db04f

SHA1
9688abd00e1af55790157f3f6a46018e21420fd3

SHA256
cea2706ef97b3f4d9ee626bf9633fdd1d0435a1861c816be6d50a905ed3f972c

SHA512
c16808859e8626216c454d749478b1187227fb01d3f51cd4eead158496c27f5441fb8553cad6cfd48fddb9f5d802c947dce5f410bdb43bf43f54496bf87fc65d

Download Submit
C:\Windows\System\UmbnScU.exe

Filesize
1.6MB

MD5
9260ad9b6f0df53e005c111d90f365e3

SHA1
27c078be16595b478baff361dfaef8112e3014ec

SHA256
4356c84179b6317a95b484159b145eb0cf0eb09f0d82c0a0a9477fd436018b7f

SHA512
555ff9897aa335ab05ff64fc4d424f69cd332054b3f2a5c8d0957b9baf98c9866b03de3df4214dd3ff7fd2cd734b1d676f949f27da16873f27f8fe1c2fbbc0db

Download Submit
C:\Windows\System\VElGYRX.exe

Filesize
1.6MB

MD5
291eca84f1d10b605753ba2215f9cc9b

SHA1
347046a6659d6231e846f416d399cd3ba33b1622

SHA256
fa12faa8702cfcd6d09bbebebea51752c86e464a500030a397aa022b5bd0c9b4

SHA512
20d810078dd35f9b57e6864d976bb9ef90bed68facbfeb2018bd34a06d4d08a983176332312e94ef692d33d8c78a228458be3289dc49240e0245622b54c38156

Download Submit
C:\Windows\System\WUZknXu.exe

Filesize
1.6MB

MD5
02df852adb46613b7a1ddffd81948b94

SHA1
7766ee5f52a6729633e6b60364dd7a6b17ed17f0

SHA256
1c5737083678dfe6c91a747e924bbe4bcaf5df4895ccd81aa1279dfc3d01a3f2

SHA512
65349028f5870298c95b397d8dc7490b34d09385933151dd6993f76ec339be9b0309487f487a4fd3482b5ca3c1f505e06590de7a529628792950975baa90a488

Download Submit
C:\Windows\System\XFbxjrq.exe

Filesize
1.6MB

MD5
25191171cf51a10a32d41ec8c255ff12

SHA1
cf4b341ef982575a0e5a2bc9dced720501214fab

SHA256
ad2fae8799bbd35e5d177c92a79c86a9b6c931e1530b8d3d87152e777fbbff5e

SHA512
1bf6efb958d4d476e72b64c9b15ff54275634681b501a1b471de5b7d05173989e88c4c4b335a66d5af0a1712e1f20dda25f72ed3855d88e48af303f949c2c9f6

Download Submit
C:\Windows\System\ZEJSzlB.exe

Filesize
1.6MB

MD5
828733eff3d3522e07ff446a7a3858f8

SHA1
eaf1b8df8e303c2fd9bc39538657dcd82af09661

SHA256
338cfd08e4b2931c954eb72a797871695046de726e206b76236dad2021842cc4

SHA512
ee3624a33b90293b8c54511d28ae77e916078e22720232e189b6bfadae0769ab5bd226f4d2723a64971454f38c6461286e3a4159889a729920797147a51b820c

Download Submit
C:\Windows\System\ZzDiKut.exe

Filesize
1.6MB

MD5
7d88b565e4d670b4a66a8a6c519b3598

SHA1
b2c66e57159d6f486d3ed817f19f375fff7e8704

SHA256
0fd1f461d89fc798753c7ff446424137876ecba41479eead0186c3c7d59e91f5

SHA512
8f8344f74a6334ee2106234df27ec9092fcf45705755e0862c3631c124b3b0a011e7eea6f374a0e4db97a970bee75d519e5324c2a896bf828240c1f303f7eb25

Download Submit
C:\Windows\System\aMQEeub.exe

Filesize
1.6MB

MD5
d1da47cbd2d3d595ffaf827f0704e648

SHA1
8c79e1a695074e3957e68f51730a8874ad98dbbb

SHA256
5c2dfb4db16bd2892b5c94008dd92f6088ef5725ddee81ed6f0471cdcfbae402

SHA512
29397091e58adeeeb50ed1fa81a9ba91f7f16551a6d7c4f1c5857555cd5a822a49cbe245688f92572c077d2e2708fb96824b575d61be7015698c3cc795298552

Download Submit
C:\Windows\System\cEwdaWR.exe

Filesize
1.6MB

MD5
6a1374942a137f8adcc82ee5ce71a493

SHA1
63e5af2c9e93b7e50ca98a51ede236366f14fd81

SHA256
a57579496d471f92ac2e701b3b4c8f0ea7be22467bd557511f8e469282f72474

SHA512
e6a1b0146bec0574ab58d617c2dd414bb6a8cb306eb07e2c584f18557ccb3851074949fe37a340a6b0fce4469c65c13e17bca28bcb84af8c5d74088ccd530d89

Download Submit
C:\Windows\System\cUccrZD.exe

Filesize
1.6MB

MD5
b6c8da2848c591cbbfda7556f8834362

SHA1
04e75359e569977204f6e025d72fe9c5b8295967

SHA256
cc7760919f8e4e4f54b2d63ea86ba875d3ffd1c67e3c7cb8dac24fa246fbddde

SHA512
ee795f20e37b30924ebc17f5952d0cc0ba7b45d1494841de707cfaa555baf4f74d32465717652b6fe2686af4df817278104f82736c81e0f8eec8a1e0a3c51c55

Download Submit
C:\Windows\System\coBwPsT.exe

Filesize
1.6MB

MD5
d6659db7d72f01f50e1e44662a4e734e

SHA1
c90d8674dfb7bbaacbf86d5eb1374073db5eb10d

SHA256
c36ab018d8693c8ab85f790344af52ebc63b793cf53e5ea410f88f7c200ccf37

SHA512
aebcf3c3c4a35ae3919dd6994e8fa0ca3a3b36be8840bdf275ab0bd8968ac3f560802570856ec5587aca9694c7db8686022cf91600b1a41f428f71c06a7bc041

Download Submit
C:\Windows\System\hKeZcEW.exe

Filesize
1.6MB

MD5
36eccc4a85c29b3d61a339ff502f5a5a

SHA1
b45d363d58bd5f0c5b194a1573fb54a0be937274

SHA256
7d38269da77c1310b42d29b64c82d814cf8cefde920beb7dc9e8ca3022ee207c

SHA512
e14eac86f97eec788ed0f44d28c29ae9c46375a5dcea41ad75c87b4aecbc783586e951e3b979c067b1f5ad0b69fef2c3e2f25d5d6a9db5a846e82dbd81a507e0

Download Submit
C:\Windows\System\iTtUmuy.exe

Filesize
1.6MB

MD5
dbfb22345e4f3d328d9d29c0999be6c0

SHA1
0c8655a78580e853d668ab4a4e6b50557dc9dddd

SHA256
937a1bdf5f1ed7abe5f50679e1a845f333930fecca5883a51c8f77bf92df4523

SHA512
f7fbd1f89144340115f8801a0067940518ce64a7c8321cecb3a98ec6374b3aa2657e330137882c992ad895cb874d4de2c0a1217166d3a2308c1f32ea52fc0ece

Download Submit
C:\Windows\System\inLdevB.exe

Filesize
1.6MB

MD5
59b8a14c7fd42cc4d828b38cae135ad3

SHA1
78225fb3aa3c5828e58e98792e37e85c83d9cfbc

SHA256
47c131e0f94754ae463294054bcb61f9c3c2c9d103272debfd1a1f5514e805d3

SHA512
7ffe611a60d9b9127959c70d4938bb9eda0735703ea31f768da4576ea24b2bb217411560c4a0add1e1629b227c5b02986d7e65879edb7500135309fe695eff2f

Download Submit
C:\Windows\System\jflhpvK.exe

Filesize
1.6MB

MD5
393314e04fbb26e210ca59baab88c4e5

SHA1
d9007bc253424ceb0e76dab5920cdeed3f04162b

SHA256
0a828ed145ddca37987cbc762b0b13d50d6e532ba6fd5c238f5f64fc33d8a3e4

SHA512
afbd981fa913abce2c834f7ef4894c61bdf519e6f26dce63807032021dc2c9b55dd3d3aa58304c83e047a701c5e97f4c419ebad008b211824a162ea7180b67c8

Download Submit
C:\Windows\System\ksqIJhJ.exe

Filesize
1.6MB

MD5
c7f249e10bc3f17b6cf56a3da148f530

SHA1
44312453001a62887911fdcff50c181a9a56e7d0

SHA256
4e1d8c9444f18e5dad18b4564b88b3de6a22bfeb29ff6beafe0ec2f5b1e28ef4

SHA512
6010ed9313cfb139e7e7c198f65019ab67b99ae4b100c6a63f843fc8c0ad587c1dfee187a1f0320081d880fe8dba4172081937f04a332d755c5fe7bbe23c1f81

Download Submit
C:\Windows\System\lgpHfMw.exe

Filesize
1.6MB

MD5
a76cdec9ada5acb54c8bb1c64f498337

SHA1
0d16174d24591363a991367525fd49eee03f734c

SHA256
3736186336d54ff933b3b9348e19a1bca1eebacbaf7dcd648707ec66af71291c

SHA512
e777f8fd4784c9ba6c651f644a2c20253ba96098c18d4a65c4d99a8a68b139dd67d2fad7782342f8d6c9222a3f7f9faa9698c783aec7aba653ff0931ef02b1e1

Download Submit
C:\Windows\System\sDjipKT.exe

Filesize
1.6MB

MD5
c73f9e6bb5c3f98138eeb08350fa7081

SHA1
df4942ca7d80e489f5074daf690b686531cedb0b

SHA256
6c709b306818ab5e8a9451d0463b3ce9369a5f4371fb7a467021726c5d4691b8

SHA512
ff474c23f2a2de3d4408544c1df5a192e25dcd7a2d82aa1c359e7c34563d549e7c9365542c20da48b52f700bbef07e41e272bea70478ecb5a0b98681c5b4f91f

Download Submit
C:\Windows\System\twQwHsl.exe

Filesize
1.6MB

MD5
93daf2a4e47dfa602cf0bf3aeabafddd

SHA1
ea7c87e9b30599a69476b341cb7f0c46c519daff

SHA256
383cbc730584942676b196886cd5a7018cda99cb86264c48b3f2375f9c786d87

SHA512
24363b269d2b78e5bc8295622ab51c57525e098fe68ff4aacfded73d281ab63843055f59356f185701a43a38d3a8ff393a9d4b556073f4b96d4553632cc5075c

Download Submit
C:\Windows\System\vrElzjI.exe

Filesize
1.6MB

MD5
50e16c7819df3fc2e45a72d1b85f2cf7

SHA1
4e8d7a26fe9d12f304a180ed1ebe90c57244ea9d

SHA256
53502e23afcece9f6a82531142d79094d093396ddbecf38cb9673c753c71664c

SHA512
91c474b19749d32be75ca53653b252c42f2a3872a18b93a8b57dfe4463d656cdbeb1df88cb2452b80df8728fd8fc03429f3adc705cba599bb787bc93958ceb1a

Download Submit
C:\Windows\System\yfSyTgh.exe

Filesize
1.6MB

MD5
14ee39aa0a35497d1b49f981d876a4e3

SHA1
3af41c56ea549dc97f957833e65fe6c24ef4714b

SHA256
e32618a7bcd5929fde32b8bc6a76e251fad3095d7982130a20888bef30e7406a

SHA512
20e5176a297786b641ec0daba4b711eb37400591b6df005780d679d1937d49ca02101885ce106ab97ebe051f0be6a79e4ad8a7dcd7590ceb4a5c4185c2b0bca9

Download Submit
C:\Windows\System\zSYTCIM.exe

Filesize
1.6MB

MD5
698f9123bd4e176c2c2b72e20e80f77b

SHA1
d94968771a47b41ed2b6ce1f7275e3da910e85bc

SHA256
61109b66802c071135de79a3ca68fe7221137e0b435078554d825392554cf559

SHA512
7d981444550881a07631e0de5db604a595899da7b80b0fafce03e9dacc7a6ca26eec5645fc43a1672435b28e550db5b0ca445f55aa27a59262800c3299bba5a9

Download Submit
memory/3540-0-0x000001DD91400000-0x000001DD91410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads