xmrig | e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
Size

1.8MB
MD5

897578c7d562dd823ddfd8eca5d1bd80
SHA1

6938de563da57cdc26b87e74db721d6356ef2dd0
SHA256

e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8
SHA512

e6cdddb9829600f37dafb8cd9724be6a95345599f8a8151f4408f18a9173a21854a8bbe10d2f1ead498d3e4d5e320dea5122dfc035e4e0e928521d417c7280dd
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NDcOzzZi2Uq:GemTLkNdfE0pZah

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023468-4.dat	xmrig
behavioral2/files/0x000700000002346f-7.dat	xmrig
behavioral2/files/0x000800000002346b-9.dat	xmrig
behavioral2/files/0x0007000000023470-19.dat	xmrig
behavioral2/files/0x0007000000023471-24.dat	xmrig
behavioral2/files/0x0007000000023473-29.dat	xmrig
behavioral2/files/0x0007000000023474-34.dat	xmrig
behavioral2/files/0x0007000000023475-37.dat	xmrig
behavioral2/files/0x000800000002346c-44.dat	xmrig
behavioral2/files/0x0007000000023476-50.dat	xmrig
behavioral2/files/0x0007000000023477-53.dat	xmrig
behavioral2/files/0x0007000000023478-59.dat	xmrig
behavioral2/files/0x0007000000023479-62.dat	xmrig
behavioral2/files/0x000700000002347a-69.dat	xmrig
behavioral2/files/0x000700000002347b-72.dat	xmrig
behavioral2/files/0x000700000002347c-81.dat	xmrig
behavioral2/files/0x000700000002347d-82.dat	xmrig
behavioral2/files/0x000700000002347e-89.dat	xmrig
behavioral2/files/0x000700000002347f-94.dat	xmrig
behavioral2/files/0x0007000000023480-98.dat	xmrig
behavioral2/files/0x0007000000023481-101.dat	xmrig
behavioral2/files/0x0007000000023482-109.dat	xmrig
behavioral2/files/0x0007000000023483-115.dat	xmrig
behavioral2/files/0x0007000000023485-123.dat	xmrig
behavioral2/files/0x0007000000023484-122.dat	xmrig
behavioral2/files/0x0007000000023487-132.dat	xmrig
behavioral2/files/0x0007000000023486-133.dat	xmrig
behavioral2/files/0x0007000000023488-139.dat	xmrig
behavioral2/files/0x000400000001da3a-144.dat	xmrig
behavioral2/files/0x000700000002348d-148.dat	xmrig
behavioral2/files/0x000800000002348e-154.dat	xmrig
behavioral2/files/0x000800000002348a-159.dat	xmrig
behavioral2/files/0x0007000000023490-162.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3768	InfhuOW.exe
796	tRhIoVO.exe
3012	WbjpUoJ.exe
4012	gqyrIdR.exe
3788	FMhbcum.exe
1520	kXWbviP.exe
4396	YJMgOOG.exe
5116	YEIOdDI.exe
3568	cJMFSqB.exe
2764	LxrjcqB.exe
2888	CRLtplP.exe
1444	vsLHNjM.exe
464	WrltdGN.exe
3868	PKsXnMH.exe
2120	abpibSW.exe
2896	SFELAKq.exe
2828	UOOiJto.exe
2988	SxxzJIV.exe
3104	BPauSDI.exe
3780	lIyPypu.exe
4656	ONNlxlG.exe
212	IBTAeFc.exe
4120	wXCbAaM.exe
2420	VtxUjei.exe
2112	uDieRAw.exe
644	FjJqhUb.exe
2720	MrLHHVL.exe
1048	yfMiXVt.exe
4676	qFzfQsL.exe
4688	GrceTdF.exe
3396	ZWqEauY.exe
1568	bUfeXaV.exe
2800	KSUvRZz.exe
3832	aViDmsP.exe
2584	tLpfKWF.exe
4968	Xdxhypn.exe
4116	JJBAfaA.exe
2224	RCMgKQx.exe
1700	CKawXkR.exe
404	zDVbixR.exe
4436	RkGPJMu.exe
1632	YIsehYS.exe
4332	ClQfLwS.exe
4528	adKxosw.exe
1068	ldevUMJ.exe
4916	jDmdZaA.exe
2016	KqiLHsi.exe
4492	QpRUDCb.exe
3884	cIQtIhb.exe
3972	RJkTLdV.exe
3736	OIcSARh.exe
1904	zXPLCvX.exe
4144	isjlNhw.exe
5044	fDSmOQI.exe
1624	BVJuanJ.exe
2696	aVovkWO.exe
2432	zlwlUKC.exe
1908	aGGelNW.exe
4276	oAhyQEo.exe
1064	VWXdZzm.exe
4248	CTKOkFv.exe
4960	shIQYTM.exe
1692	yXIGTNX.exe
2668	xHZOhaJ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IONRpXY.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\xjDfVJx.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\EidKTLx.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\DWOOVYR.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\TZwOrez.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\cCcfdyr.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\zRKKAfj.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\xwjLKSs.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\mWxtdmC.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\EyTAXcY.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\ULSLSmg.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\lCkgulb.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\ReVDMox.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\zUcKhKu.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\TPfItLN.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\yDDQcrQ.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\TqOilAo.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\aldvulk.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\gFPtnEJ.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\PqnSjPd.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\WQNJLZw.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\QmfJDEB.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\NAiNZjO.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\HhFdZwo.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\ICvCPCo.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\XzwnGal.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\vxJqqKv.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\PskRlCK.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\uFGeppq.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\CTKOkFv.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\AjTpJpN.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\AiibYMN.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\ldevUMJ.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\icaWkID.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\FalqSDY.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\nIceRmJ.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\aViDmsP.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\FxqrRul.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\cLtdOZf.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\gIuOnuE.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\zJXOFkl.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\eJYIuPa.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\lYDGnGK.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\IpTiIXC.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\hgqNwRG.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\kUpPetJ.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\gHWWvZg.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\aWzHoue.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\rljbYkn.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\nMSOLcL.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\OlTLMaD.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\iSagcyJ.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\BjPijjB.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\VcexWLW.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\EAHHOdi.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\iMNpneU.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\FKpHgGA.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\qnUJxtc.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\QkZSkmz.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\rkxfNaF.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\eWEyWIA.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\bmmmjvV.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\gSEXFsb.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
File created	C:\Windows\System\yfpMMHt.exe	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17316	dwm.exe
Token: SeChangeNotifyPrivilege	17316	dwm.exe
Token: 33	17316	dwm.exe
Token: SeIncBasePriorityPrivilege	17316	dwm.exe
Token: SeShutdownPrivilege	17316	dwm.exe
Token: SeCreatePagefilePrivilege	17316	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3768	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	85
PID 2336 wrote to memory of 3768	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	85
PID 2336 wrote to memory of 796	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	86
PID 2336 wrote to memory of 796	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	86
PID 2336 wrote to memory of 3012	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	87
PID 2336 wrote to memory of 3012	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	87
PID 2336 wrote to memory of 4012	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	88
PID 2336 wrote to memory of 4012	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	88
PID 2336 wrote to memory of 3788	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	89
PID 2336 wrote to memory of 3788	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	89
PID 2336 wrote to memory of 1520	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	90
PID 2336 wrote to memory of 1520	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	90
PID 2336 wrote to memory of 4396	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	91
PID 2336 wrote to memory of 4396	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	91
PID 2336 wrote to memory of 5116	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	92
PID 2336 wrote to memory of 5116	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	92
PID 2336 wrote to memory of 3568	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	93
PID 2336 wrote to memory of 3568	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	93
PID 2336 wrote to memory of 2764	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	94
PID 2336 wrote to memory of 2764	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	94
PID 2336 wrote to memory of 2888	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	95
PID 2336 wrote to memory of 2888	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	95
PID 2336 wrote to memory of 1444	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	99
PID 2336 wrote to memory of 1444	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	99
PID 2336 wrote to memory of 464	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	100
PID 2336 wrote to memory of 464	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	100
PID 2336 wrote to memory of 3868	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	101
PID 2336 wrote to memory of 3868	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	101
PID 2336 wrote to memory of 2120	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	102
PID 2336 wrote to memory of 2120	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	102
PID 2336 wrote to memory of 2896	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	103
PID 2336 wrote to memory of 2896	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	103
PID 2336 wrote to memory of 2828	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	104
PID 2336 wrote to memory of 2828	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	104
PID 2336 wrote to memory of 2988	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	105
PID 2336 wrote to memory of 2988	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	105
PID 2336 wrote to memory of 3104	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	106
PID 2336 wrote to memory of 3104	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	106
PID 2336 wrote to memory of 3780	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	107
PID 2336 wrote to memory of 3780	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	107
PID 2336 wrote to memory of 4656	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	108
PID 2336 wrote to memory of 4656	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	108
PID 2336 wrote to memory of 212	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	109
PID 2336 wrote to memory of 212	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	109
PID 2336 wrote to memory of 4120	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	110
PID 2336 wrote to memory of 4120	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	110
PID 2336 wrote to memory of 2420	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	111
PID 2336 wrote to memory of 2420	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	111
PID 2336 wrote to memory of 2112	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	112
PID 2336 wrote to memory of 2112	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	112
PID 2336 wrote to memory of 644	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	113
PID 2336 wrote to memory of 644	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	113
PID 2336 wrote to memory of 2720	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	114
PID 2336 wrote to memory of 2720	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	114
PID 2336 wrote to memory of 1048	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	115
PID 2336 wrote to memory of 1048	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	115
PID 2336 wrote to memory of 4676	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	116
PID 2336 wrote to memory of 4676	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	116
PID 2336 wrote to memory of 4688	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	117
PID 2336 wrote to memory of 4688	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	117
PID 2336 wrote to memory of 3396	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	118
PID 2336 wrote to memory of 3396	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	118
PID 2336 wrote to memory of 1568	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	119
PID 2336 wrote to memory of 1568	2336	e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe	119

C:\Users\Admin\AppData\Local\Temp\e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe
"C:\Users\Admin\AppData\Local\Temp\e4bb8b8c3087d744e7bd07535d9663ead7c70434b2e4a5cd24c73ea29bd0c6d8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System\InfhuOW.exe
  C:\Windows\System\InfhuOW.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\tRhIoVO.exe
  C:\Windows\System\tRhIoVO.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\WbjpUoJ.exe
  C:\Windows\System\WbjpUoJ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\gqyrIdR.exe
  C:\Windows\System\gqyrIdR.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\FMhbcum.exe
  C:\Windows\System\FMhbcum.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\kXWbviP.exe
  C:\Windows\System\kXWbviP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\YJMgOOG.exe
  C:\Windows\System\YJMgOOG.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\YEIOdDI.exe
  C:\Windows\System\YEIOdDI.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\cJMFSqB.exe
  C:\Windows\System\cJMFSqB.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\LxrjcqB.exe
  C:\Windows\System\LxrjcqB.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\CRLtplP.exe
  C:\Windows\System\CRLtplP.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\vsLHNjM.exe
  C:\Windows\System\vsLHNjM.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WrltdGN.exe
  C:\Windows\System\WrltdGN.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\PKsXnMH.exe
  C:\Windows\System\PKsXnMH.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\abpibSW.exe
  C:\Windows\System\abpibSW.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\SFELAKq.exe
  C:\Windows\System\SFELAKq.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\UOOiJto.exe
  C:\Windows\System\UOOiJto.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\SxxzJIV.exe
  C:\Windows\System\SxxzJIV.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\BPauSDI.exe
  C:\Windows\System\BPauSDI.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\lIyPypu.exe
  C:\Windows\System\lIyPypu.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\ONNlxlG.exe
  C:\Windows\System\ONNlxlG.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\IBTAeFc.exe
  C:\Windows\System\IBTAeFc.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\wXCbAaM.exe
  C:\Windows\System\wXCbAaM.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\VtxUjei.exe
  C:\Windows\System\VtxUjei.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\uDieRAw.exe
  C:\Windows\System\uDieRAw.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\FjJqhUb.exe
  C:\Windows\System\FjJqhUb.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\MrLHHVL.exe
  C:\Windows\System\MrLHHVL.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\yfMiXVt.exe
  C:\Windows\System\yfMiXVt.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\qFzfQsL.exe
  C:\Windows\System\qFzfQsL.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\GrceTdF.exe
  C:\Windows\System\GrceTdF.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\ZWqEauY.exe
  C:\Windows\System\ZWqEauY.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\bUfeXaV.exe
  C:\Windows\System\bUfeXaV.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\KSUvRZz.exe
  C:\Windows\System\KSUvRZz.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\aViDmsP.exe
  C:\Windows\System\aViDmsP.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\tLpfKWF.exe
  C:\Windows\System\tLpfKWF.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\Xdxhypn.exe
  C:\Windows\System\Xdxhypn.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\JJBAfaA.exe
  C:\Windows\System\JJBAfaA.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\RCMgKQx.exe
  C:\Windows\System\RCMgKQx.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\CKawXkR.exe
  C:\Windows\System\CKawXkR.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\zDVbixR.exe
  C:\Windows\System\zDVbixR.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\RkGPJMu.exe
  C:\Windows\System\RkGPJMu.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\YIsehYS.exe
  C:\Windows\System\YIsehYS.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ClQfLwS.exe
  C:\Windows\System\ClQfLwS.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\adKxosw.exe
  C:\Windows\System\adKxosw.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\ldevUMJ.exe
  C:\Windows\System\ldevUMJ.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\jDmdZaA.exe
  C:\Windows\System\jDmdZaA.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\KqiLHsi.exe
  C:\Windows\System\KqiLHsi.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\QpRUDCb.exe
  C:\Windows\System\QpRUDCb.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\cIQtIhb.exe
  C:\Windows\System\cIQtIhb.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\RJkTLdV.exe
  C:\Windows\System\RJkTLdV.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\OIcSARh.exe
  C:\Windows\System\OIcSARh.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\zXPLCvX.exe
  C:\Windows\System\zXPLCvX.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\isjlNhw.exe
  C:\Windows\System\isjlNhw.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\fDSmOQI.exe
  C:\Windows\System\fDSmOQI.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\BVJuanJ.exe
  C:\Windows\System\BVJuanJ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\aVovkWO.exe
  C:\Windows\System\aVovkWO.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\zlwlUKC.exe
  C:\Windows\System\zlwlUKC.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\aGGelNW.exe
  C:\Windows\System\aGGelNW.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\oAhyQEo.exe
  C:\Windows\System\oAhyQEo.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\VWXdZzm.exe
  C:\Windows\System\VWXdZzm.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\CTKOkFv.exe
  C:\Windows\System\CTKOkFv.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\shIQYTM.exe
  C:\Windows\System\shIQYTM.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\yXIGTNX.exe
  C:\Windows\System\yXIGTNX.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\xHZOhaJ.exe
  C:\Windows\System\xHZOhaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\WKojXSN.exe
  C:\Windows\System\WKojXSN.exe
  2⤵
  PID:2064
- C:\Windows\System\qnUJxtc.exe
  C:\Windows\System\qnUJxtc.exe
  2⤵
  PID:2360
- C:\Windows\System\MopQFKK.exe
  C:\Windows\System\MopQFKK.exe
  2⤵
  PID:2464
- C:\Windows\System\PqnSjPd.exe
  C:\Windows\System\PqnSjPd.exe
  2⤵
  PID:2912
- C:\Windows\System\DTWsYEu.exe
  C:\Windows\System\DTWsYEu.exe
  2⤵
  PID:2840
- C:\Windows\System\LvMAkEv.exe
  C:\Windows\System\LvMAkEv.exe
  2⤵
  PID:1584
- C:\Windows\System\BrxYLnI.exe
  C:\Windows\System\BrxYLnI.exe
  2⤵
  PID:544
- C:\Windows\System\niNebfI.exe
  C:\Windows\System\niNebfI.exe
  2⤵
  PID:5068
- C:\Windows\System\dhJclNu.exe
  C:\Windows\System\dhJclNu.exe
  2⤵
  PID:5008
- C:\Windows\System\ypfxGip.exe
  C:\Windows\System\ypfxGip.exe
  2⤵
  PID:4776
- C:\Windows\System\xmpvmpR.exe
  C:\Windows\System\xmpvmpR.exe
  2⤵
  PID:1096
- C:\Windows\System\UOjQVpY.exe
  C:\Windows\System\UOjQVpY.exe
  2⤵
  PID:4236
- C:\Windows\System\fUtwRgW.exe
  C:\Windows\System\fUtwRgW.exe
  2⤵
  PID:412
- C:\Windows\System\gSEXFsb.exe
  C:\Windows\System\gSEXFsb.exe
  2⤵
  PID:4792
- C:\Windows\System\cUAtkjC.exe
  C:\Windows\System\cUAtkjC.exe
  2⤵
  PID:3008
- C:\Windows\System\htISQeJ.exe
  C:\Windows\System\htISQeJ.exe
  2⤵
  PID:4844
- C:\Windows\System\kxzZOse.exe
  C:\Windows\System\kxzZOse.exe
  2⤵
  PID:220
- C:\Windows\System\kBikMrw.exe
  C:\Windows\System\kBikMrw.exe
  2⤵
  PID:1932
- C:\Windows\System\RJQfLmz.exe
  C:\Windows\System\RJQfLmz.exe
  2⤵
  PID:1928
- C:\Windows\System\jthsbUn.exe
  C:\Windows\System\jthsbUn.exe
  2⤵
  PID:4536
- C:\Windows\System\yWHSvlG.exe
  C:\Windows\System\yWHSvlG.exe
  2⤵
  PID:1052
- C:\Windows\System\QkNNPzD.exe
  C:\Windows\System\QkNNPzD.exe
  2⤵
  PID:4424
- C:\Windows\System\UBQkJMl.exe
  C:\Windows\System\UBQkJMl.exe
  2⤵
  PID:2404
- C:\Windows\System\pqoUbaX.exe
  C:\Windows\System\pqoUbaX.exe
  2⤵
  PID:1404
- C:\Windows\System\RnoulCd.exe
  C:\Windows\System\RnoulCd.exe
  2⤵
  PID:3968
- C:\Windows\System\BrQZjot.exe
  C:\Windows\System\BrQZjot.exe
  2⤵
  PID:1496
- C:\Windows\System\QkZSkmz.exe
  C:\Windows\System\QkZSkmz.exe
  2⤵
  PID:1880
- C:\Windows\System\WNxoYwS.exe
  C:\Windows\System\WNxoYwS.exe
  2⤵
  PID:1936
- C:\Windows\System\sFxaLOx.exe
  C:\Windows\System\sFxaLOx.exe
  2⤵
  PID:4452
- C:\Windows\System\qPJPilQ.exe
  C:\Windows\System\qPJPilQ.exe
  2⤵
  PID:1924
- C:\Windows\System\gdBTLWb.exe
  C:\Windows\System\gdBTLWb.exe
  2⤵
  PID:4684
- C:\Windows\System\VqbBZss.exe
  C:\Windows\System\VqbBZss.exe
  2⤵
  PID:5124
- C:\Windows\System\OpAfkam.exe
  C:\Windows\System\OpAfkam.exe
  2⤵
  PID:5160
- C:\Windows\System\mvAnmYx.exe
  C:\Windows\System\mvAnmYx.exe
  2⤵
  PID:5188
- C:\Windows\System\lgaxega.exe
  C:\Windows\System\lgaxega.exe
  2⤵
  PID:5220
- C:\Windows\System\HNYercS.exe
  C:\Windows\System\HNYercS.exe
  2⤵
  PID:5248
- C:\Windows\System\bifylPr.exe
  C:\Windows\System\bifylPr.exe
  2⤵
  PID:5276
- C:\Windows\System\mmrvOTQ.exe
  C:\Windows\System\mmrvOTQ.exe
  2⤵
  PID:5292
- C:\Windows\System\rljbYkn.exe
  C:\Windows\System\rljbYkn.exe
  2⤵
  PID:5332
- C:\Windows\System\tZghTCJ.exe
  C:\Windows\System\tZghTCJ.exe
  2⤵
  PID:5360
- C:\Windows\System\yNvStZg.exe
  C:\Windows\System\yNvStZg.exe
  2⤵
  PID:5380
- C:\Windows\System\IONRpXY.exe
  C:\Windows\System\IONRpXY.exe
  2⤵
  PID:5408
- C:\Windows\System\uIPNWfy.exe
  C:\Windows\System\uIPNWfy.exe
  2⤵
  PID:5444
- C:\Windows\System\WoyGEYq.exe
  C:\Windows\System\WoyGEYq.exe
  2⤵
  PID:5464
- C:\Windows\System\xKJoADr.exe
  C:\Windows\System\xKJoADr.exe
  2⤵
  PID:5488
- C:\Windows\System\XMCBMQN.exe
  C:\Windows\System\XMCBMQN.exe
  2⤵
  PID:5516
- C:\Windows\System\lmfPKKS.exe
  C:\Windows\System\lmfPKKS.exe
  2⤵
  PID:5556
- C:\Windows\System\fvZRBFN.exe
  C:\Windows\System\fvZRBFN.exe
  2⤵
  PID:5580
- C:\Windows\System\SRbNkQZ.exe
  C:\Windows\System\SRbNkQZ.exe
  2⤵
  PID:5612
- C:\Windows\System\JSADSOM.exe
  C:\Windows\System\JSADSOM.exe
  2⤵
  PID:5640
- C:\Windows\System\dPcSJBY.exe
  C:\Windows\System\dPcSJBY.exe
  2⤵
  PID:5660
- C:\Windows\System\zUcKhKu.exe
  C:\Windows\System\zUcKhKu.exe
  2⤵
  PID:5688
- C:\Windows\System\HDOHFRG.exe
  C:\Windows\System\HDOHFRG.exe
  2⤵
  PID:5724
- C:\Windows\System\ZWVZaCh.exe
  C:\Windows\System\ZWVZaCh.exe
  2⤵
  PID:5752
- C:\Windows\System\MovCdzY.exe
  C:\Windows\System\MovCdzY.exe
  2⤵
  PID:5776
- C:\Windows\System\omqxcjr.exe
  C:\Windows\System\omqxcjr.exe
  2⤵
  PID:5796
- C:\Windows\System\PValAbc.exe
  C:\Windows\System\PValAbc.exe
  2⤵
  PID:5836
- C:\Windows\System\DVvyhND.exe
  C:\Windows\System\DVvyhND.exe
  2⤵
  PID:5852
- C:\Windows\System\JjXCerf.exe
  C:\Windows\System\JjXCerf.exe
  2⤵
  PID:5880
- C:\Windows\System\QOojjEI.exe
  C:\Windows\System\QOojjEI.exe
  2⤵
  PID:5908
- C:\Windows\System\jwUceoV.exe
  C:\Windows\System\jwUceoV.exe
  2⤵
  PID:5936
- C:\Windows\System\XFxdLJl.exe
  C:\Windows\System\XFxdLJl.exe
  2⤵
  PID:5972
- C:\Windows\System\ohQmiWZ.exe
  C:\Windows\System\ohQmiWZ.exe
  2⤵
  PID:6004
- C:\Windows\System\EjnWhgP.exe
  C:\Windows\System\EjnWhgP.exe
  2⤵
  PID:6020
- C:\Windows\System\vhqmdnL.exe
  C:\Windows\System\vhqmdnL.exe
  2⤵
  PID:6052
- C:\Windows\System\RJtYZum.exe
  C:\Windows\System\RJtYZum.exe
  2⤵
  PID:6088
- C:\Windows\System\fCwgsWe.exe
  C:\Windows\System\fCwgsWe.exe
  2⤵
  PID:6116
- C:\Windows\System\BOsJSGQ.exe
  C:\Windows\System\BOsJSGQ.exe
  2⤵
  PID:6132
- C:\Windows\System\xmULTAv.exe
  C:\Windows\System\xmULTAv.exe
  2⤵
  PID:5152
- C:\Windows\System\xHqQeoe.exe
  C:\Windows\System\xHqQeoe.exe
  2⤵
  PID:5244
- C:\Windows\System\BcawMxr.exe
  C:\Windows\System\BcawMxr.exe
  2⤵
  PID:5316
- C:\Windows\System\ANoPkhQ.exe
  C:\Windows\System\ANoPkhQ.exe
  2⤵
  PID:5372
- C:\Windows\System\dbCfVkB.exe
  C:\Windows\System\dbCfVkB.exe
  2⤵
  PID:5432
- C:\Windows\System\GOZZncN.exe
  C:\Windows\System\GOZZncN.exe
  2⤵
  PID:5480
- C:\Windows\System\NDtJCbr.exe
  C:\Windows\System\NDtJCbr.exe
  2⤵
  PID:5572
- C:\Windows\System\kPTFakj.exe
  C:\Windows\System\kPTFakj.exe
  2⤵
  PID:5636
- C:\Windows\System\iXnYAJw.exe
  C:\Windows\System\iXnYAJw.exe
  2⤵
  PID:5712
- C:\Windows\System\MwczYcq.exe
  C:\Windows\System\MwczYcq.exe
  2⤵
  PID:5784
- C:\Windows\System\xjDfVJx.exe
  C:\Windows\System\xjDfVJx.exe
  2⤵
  PID:5824
- C:\Windows\System\OdtPsll.exe
  C:\Windows\System\OdtPsll.exe
  2⤵
  PID:5920
- C:\Windows\System\LOQnIID.exe
  C:\Windows\System\LOQnIID.exe
  2⤵
  PID:5956
- C:\Windows\System\LnerDRL.exe
  C:\Windows\System\LnerDRL.exe
  2⤵
  PID:6032
- C:\Windows\System\GcgejUD.exe
  C:\Windows\System\GcgejUD.exe
  2⤵
  PID:6100
- C:\Windows\System\NuswlVG.exe
  C:\Windows\System\NuswlVG.exe
  2⤵
  PID:5140
- C:\Windows\System\QjzwpAD.exe
  C:\Windows\System\QjzwpAD.exe
  2⤵
  PID:5284
- C:\Windows\System\cOPJSxz.exe
  C:\Windows\System\cOPJSxz.exe
  2⤵
  PID:5484
- C:\Windows\System\rWWQQlE.exe
  C:\Windows\System\rWWQQlE.exe
  2⤵
  PID:5600
- C:\Windows\System\vUalbwE.exe
  C:\Windows\System\vUalbwE.exe
  2⤵
  PID:5768
- C:\Windows\System\QVuWOWf.exe
  C:\Windows\System\QVuWOWf.exe
  2⤵
  PID:5900
- C:\Windows\System\jLGSLIP.exe
  C:\Windows\System\jLGSLIP.exe
  2⤵
  PID:6076
- C:\Windows\System\SJYewUL.exe
  C:\Windows\System\SJYewUL.exe
  2⤵
  PID:5304
- C:\Windows\System\pyqeCTI.exe
  C:\Windows\System\pyqeCTI.exe
  2⤵
  PID:5680
- C:\Windows\System\rLCHhns.exe
  C:\Windows\System\rLCHhns.exe
  2⤵
  PID:6016
- C:\Windows\System\oNvlveq.exe
  C:\Windows\System\oNvlveq.exe
  2⤵
  PID:5588
- C:\Windows\System\PnbNlfQ.exe
  C:\Windows\System\PnbNlfQ.exe
  2⤵
  PID:5208
- C:\Windows\System\hpitaiU.exe
  C:\Windows\System\hpitaiU.exe
  2⤵
  PID:6160
- C:\Windows\System\JiPPNLr.exe
  C:\Windows\System\JiPPNLr.exe
  2⤵
  PID:6188
- C:\Windows\System\jpsgRHL.exe
  C:\Windows\System\jpsgRHL.exe
  2⤵
  PID:6212
- C:\Windows\System\HmksRaa.exe
  C:\Windows\System\HmksRaa.exe
  2⤵
  PID:6240
- C:\Windows\System\bEvSBjL.exe
  C:\Windows\System\bEvSBjL.exe
  2⤵
  PID:6276
- C:\Windows\System\uwmyKKC.exe
  C:\Windows\System\uwmyKKC.exe
  2⤵
  PID:6300
- C:\Windows\System\xdrlSCB.exe
  C:\Windows\System\xdrlSCB.exe
  2⤵
  PID:6328
- C:\Windows\System\XgkDygE.exe
  C:\Windows\System\XgkDygE.exe
  2⤵
  PID:6368
- C:\Windows\System\hUWFsqR.exe
  C:\Windows\System\hUWFsqR.exe
  2⤵
  PID:6400
- C:\Windows\System\lYckBjY.exe
  C:\Windows\System\lYckBjY.exe
  2⤵
  PID:6416
- C:\Windows\System\dJEJLZO.exe
  C:\Windows\System\dJEJLZO.exe
  2⤵
  PID:6444
- C:\Windows\System\TUEYLVn.exe
  C:\Windows\System\TUEYLVn.exe
  2⤵
  PID:6472
- C:\Windows\System\mfueKVq.exe
  C:\Windows\System\mfueKVq.exe
  2⤵
  PID:6500
- C:\Windows\System\nlqAnuE.exe
  C:\Windows\System\nlqAnuE.exe
  2⤵
  PID:6528
- C:\Windows\System\KbHFMPg.exe
  C:\Windows\System\KbHFMPg.exe
  2⤵
  PID:6568
- C:\Windows\System\sEoXSkw.exe
  C:\Windows\System\sEoXSkw.exe
  2⤵
  PID:6596
- C:\Windows\System\YvwvWbK.exe
  C:\Windows\System\YvwvWbK.exe
  2⤵
  PID:6612
- C:\Windows\System\fOjRtBU.exe
  C:\Windows\System\fOjRtBU.exe
  2⤵
  PID:6640
- C:\Windows\System\OELhUVH.exe
  C:\Windows\System\OELhUVH.exe
  2⤵
  PID:6668
- C:\Windows\System\BuLbFYs.exe
  C:\Windows\System\BuLbFYs.exe
  2⤵
  PID:6708
- C:\Windows\System\CPZsFvg.exe
  C:\Windows\System\CPZsFvg.exe
  2⤵
  PID:6736
- C:\Windows\System\BjPijjB.exe
  C:\Windows\System\BjPijjB.exe
  2⤵
  PID:6768
- C:\Windows\System\qrZfDoF.exe
  C:\Windows\System\qrZfDoF.exe
  2⤵
  PID:6796
- C:\Windows\System\XSdXwvY.exe
  C:\Windows\System\XSdXwvY.exe
  2⤵
  PID:6824
- C:\Windows\System\IJHFIXk.exe
  C:\Windows\System\IJHFIXk.exe
  2⤵
  PID:6852
- C:\Windows\System\ZpNFiNX.exe
  C:\Windows\System\ZpNFiNX.exe
  2⤵
  PID:6868
- C:\Windows\System\NEZUXkf.exe
  C:\Windows\System\NEZUXkf.exe
  2⤵
  PID:6904
- C:\Windows\System\bjIXMBV.exe
  C:\Windows\System\bjIXMBV.exe
  2⤵
  PID:6928
- C:\Windows\System\DQdxNxL.exe
  C:\Windows\System\DQdxNxL.exe
  2⤵
  PID:6952
- C:\Windows\System\kebfoOU.exe
  C:\Windows\System\kebfoOU.exe
  2⤵
  PID:6980
- C:\Windows\System\ZBjmIos.exe
  C:\Windows\System\ZBjmIos.exe
  2⤵
  PID:7004
- C:\Windows\System\EidKTLx.exe
  C:\Windows\System\EidKTLx.exe
  2⤵
  PID:7036
- C:\Windows\System\gAHjoxF.exe
  C:\Windows\System\gAHjoxF.exe
  2⤵
  PID:7064
- C:\Windows\System\YWTzgNY.exe
  C:\Windows\System\YWTzgNY.exe
  2⤵
  PID:7088
- C:\Windows\System\gcgMIro.exe
  C:\Windows\System\gcgMIro.exe
  2⤵
  PID:7120
- C:\Windows\System\nMSOLcL.exe
  C:\Windows\System\nMSOLcL.exe
  2⤵
  PID:7144
- C:\Windows\System\KkhvTqI.exe
  C:\Windows\System\KkhvTqI.exe
  2⤵
  PID:6000
- C:\Windows\System\Butsyys.exe
  C:\Windows\System\Butsyys.exe
  2⤵
  PID:6208
- C:\Windows\System\eJYIuPa.exe
  C:\Windows\System\eJYIuPa.exe
  2⤵
  PID:6284
- C:\Windows\System\VozPrLN.exe
  C:\Windows\System\VozPrLN.exe
  2⤵
  PID:6360
- C:\Windows\System\eUFFMrA.exe
  C:\Windows\System\eUFFMrA.exe
  2⤵
  PID:6408
- C:\Windows\System\kgrWqca.exe
  C:\Windows\System\kgrWqca.exe
  2⤵
  PID:6464
- C:\Windows\System\IPtGPBN.exe
  C:\Windows\System\IPtGPBN.exe
  2⤵
  PID:6516
- C:\Windows\System\TFXupEO.exe
  C:\Windows\System\TFXupEO.exe
  2⤵
  PID:6604
- C:\Windows\System\rzvmcMo.exe
  C:\Windows\System\rzvmcMo.exe
  2⤵
  PID:6656
- C:\Windows\System\CBXyjBJ.exe
  C:\Windows\System\CBXyjBJ.exe
  2⤵
  PID:6728
- C:\Windows\System\XVljwxa.exe
  C:\Windows\System\XVljwxa.exe
  2⤵
  PID:6808
- C:\Windows\System\dhmVAou.exe
  C:\Windows\System\dhmVAou.exe
  2⤵
  PID:6864
- C:\Windows\System\HXRmveF.exe
  C:\Windows\System\HXRmveF.exe
  2⤵
  PID:6944
- C:\Windows\System\xhqMXxV.exe
  C:\Windows\System\xhqMXxV.exe
  2⤵
  PID:6992
- C:\Windows\System\rJsoxpS.exe
  C:\Windows\System\rJsoxpS.exe
  2⤵
  PID:7020
- C:\Windows\System\EIaOfIv.exe
  C:\Windows\System\EIaOfIv.exe
  2⤵
  PID:7160
- C:\Windows\System\uoXJoln.exe
  C:\Windows\System\uoXJoln.exe
  2⤵
  PID:6256
- C:\Windows\System\PCeQFxc.exe
  C:\Windows\System\PCeQFxc.exe
  2⤵
  PID:6348
- C:\Windows\System\XfJVZwW.exe
  C:\Windows\System\XfJVZwW.exe
  2⤵
  PID:6484
- C:\Windows\System\RJwNoIW.exe
  C:\Windows\System\RJwNoIW.exe
  2⤵
  PID:6664
- C:\Windows\System\FjZkSdh.exe
  C:\Windows\System\FjZkSdh.exe
  2⤵
  PID:6836
- C:\Windows\System\KRFZQeM.exe
  C:\Windows\System\KRFZQeM.exe
  2⤵
  PID:7044
- C:\Windows\System\qttJrRV.exe
  C:\Windows\System\qttJrRV.exe
  2⤵
  PID:7096
- C:\Windows\System\BAOgvWI.exe
  C:\Windows\System\BAOgvWI.exe
  2⤵
  PID:6364
- C:\Windows\System\DZIvVzJ.exe
  C:\Windows\System\DZIvVzJ.exe
  2⤵
  PID:6788
- C:\Windows\System\LtZhKOm.exe
  C:\Windows\System\LtZhKOm.exe
  2⤵
  PID:7128
- C:\Windows\System\KtYZEjy.exe
  C:\Windows\System\KtYZEjy.exe
  2⤵
  PID:7024
- C:\Windows\System\xAGnwpQ.exe
  C:\Windows\System\xAGnwpQ.exe
  2⤵
  PID:7176
- C:\Windows\System\uFvQXek.exe
  C:\Windows\System\uFvQXek.exe
  2⤵
  PID:7204
- C:\Windows\System\XnrXKUi.exe
  C:\Windows\System\XnrXKUi.exe
  2⤵
  PID:7232
- C:\Windows\System\tJuHUFx.exe
  C:\Windows\System\tJuHUFx.exe
  2⤵
  PID:7248
- C:\Windows\System\yJFUzKT.exe
  C:\Windows\System\yJFUzKT.exe
  2⤵
  PID:7264
- C:\Windows\System\eiiSsrn.exe
  C:\Windows\System\eiiSsrn.exe
  2⤵
  PID:7284
- C:\Windows\System\ymMMzoB.exe
  C:\Windows\System\ymMMzoB.exe
  2⤵
  PID:7320
- C:\Windows\System\oKrLUaQ.exe
  C:\Windows\System\oKrLUaQ.exe
  2⤵
  PID:7344
- C:\Windows\System\OdZKaQf.exe
  C:\Windows\System\OdZKaQf.exe
  2⤵
  PID:7376
- C:\Windows\System\BAGGkgJ.exe
  C:\Windows\System\BAGGkgJ.exe
  2⤵
  PID:7396
- C:\Windows\System\QXmDyde.exe
  C:\Windows\System\QXmDyde.exe
  2⤵
  PID:7424
- C:\Windows\System\rkxfNaF.exe
  C:\Windows\System\rkxfNaF.exe
  2⤵
  PID:7456
- C:\Windows\System\NgfKwJP.exe
  C:\Windows\System\NgfKwJP.exe
  2⤵
  PID:7492
- C:\Windows\System\lMWPAng.exe
  C:\Windows\System\lMWPAng.exe
  2⤵
  PID:7524
- C:\Windows\System\NAiNZjO.exe
  C:\Windows\System\NAiNZjO.exe
  2⤵
  PID:7568
- C:\Windows\System\dOjZgrW.exe
  C:\Windows\System\dOjZgrW.exe
  2⤵
  PID:7584
- C:\Windows\System\KNVXLHk.exe
  C:\Windows\System\KNVXLHk.exe
  2⤵
  PID:7600
- C:\Windows\System\eWEyWIA.exe
  C:\Windows\System\eWEyWIA.exe
  2⤵
  PID:7616
- C:\Windows\System\aVGRPuK.exe
  C:\Windows\System\aVGRPuK.exe
  2⤵
  PID:7680
- C:\Windows\System\YmYkBiG.exe
  C:\Windows\System\YmYkBiG.exe
  2⤵
  PID:7700
- C:\Windows\System\GygCQtc.exe
  C:\Windows\System\GygCQtc.exe
  2⤵
  PID:7724
- C:\Windows\System\VleOLME.exe
  C:\Windows\System\VleOLME.exe
  2⤵
  PID:7752
- C:\Windows\System\FPabxvQ.exe
  C:\Windows\System\FPabxvQ.exe
  2⤵
  PID:7780
- C:\Windows\System\nvBlBIX.exe
  C:\Windows\System\nvBlBIX.exe
  2⤵
  PID:7824
- C:\Windows\System\lLDbNYC.exe
  C:\Windows\System\lLDbNYC.exe
  2⤵
  PID:7852
- C:\Windows\System\lYRnORx.exe
  C:\Windows\System\lYRnORx.exe
  2⤵
  PID:7880
- C:\Windows\System\TPfItLN.exe
  C:\Windows\System\TPfItLN.exe
  2⤵
  PID:7896
- C:\Windows\System\cLmwYFr.exe
  C:\Windows\System\cLmwYFr.exe
  2⤵
  PID:7928
- C:\Windows\System\ngCVVyY.exe
  C:\Windows\System\ngCVVyY.exe
  2⤵
  PID:7964
- C:\Windows\System\ZhLmNfF.exe
  C:\Windows\System\ZhLmNfF.exe
  2⤵
  PID:7992
- C:\Windows\System\zshZQLr.exe
  C:\Windows\System\zshZQLr.exe
  2⤵
  PID:8020
- C:\Windows\System\GvoWiQw.exe
  C:\Windows\System\GvoWiQw.exe
  2⤵
  PID:8040
- C:\Windows\System\oyGuUNs.exe
  C:\Windows\System\oyGuUNs.exe
  2⤵
  PID:8064
- C:\Windows\System\taBKCsD.exe
  C:\Windows\System\taBKCsD.exe
  2⤵
  PID:8092
- C:\Windows\System\blZBUfC.exe
  C:\Windows\System\blZBUfC.exe
  2⤵
  PID:8116
- C:\Windows\System\Jfhiqym.exe
  C:\Windows\System\Jfhiqym.exe
  2⤵
  PID:8140
- C:\Windows\System\IHJeVyz.exe
  C:\Windows\System\IHJeVyz.exe
  2⤵
  PID:8168
- C:\Windows\System\CVydQyb.exe
  C:\Windows\System\CVydQyb.exe
  2⤵
  PID:8188
- C:\Windows\System\dTAqEbR.exe
  C:\Windows\System\dTAqEbR.exe
  2⤵
  PID:7256
- C:\Windows\System\zZdMaMw.exe
  C:\Windows\System\zZdMaMw.exe
  2⤵
  PID:7308
- C:\Windows\System\kXsCXKJ.exe
  C:\Windows\System\kXsCXKJ.exe
  2⤵
  PID:7364
- C:\Windows\System\FIoZjOg.exe
  C:\Windows\System\FIoZjOg.exe
  2⤵
  PID:7420
- C:\Windows\System\SAJcgox.exe
  C:\Windows\System\SAJcgox.exe
  2⤵
  PID:7476
- C:\Windows\System\mgAxiJl.exe
  C:\Windows\System\mgAxiJl.exe
  2⤵
  PID:7592
- C:\Windows\System\VQjEwrc.exe
  C:\Windows\System\VQjEwrc.exe
  2⤵
  PID:7608
- C:\Windows\System\OtQqjMg.exe
  C:\Windows\System\OtQqjMg.exe
  2⤵
  PID:7736
- C:\Windows\System\zRKKAfj.exe
  C:\Windows\System\zRKKAfj.exe
  2⤵
  PID:7776
- C:\Windows\System\RRWetnA.exe
  C:\Windows\System\RRWetnA.exe
  2⤵
  PID:7876
- C:\Windows\System\NyZSEXJ.exe
  C:\Windows\System\NyZSEXJ.exe
  2⤵
  PID:7936
- C:\Windows\System\FxqrRul.exe
  C:\Windows\System\FxqrRul.exe
  2⤵
  PID:7984
- C:\Windows\System\vDIioyO.exe
  C:\Windows\System\vDIioyO.exe
  2⤵
  PID:8016
- C:\Windows\System\cTDiqkl.exe
  C:\Windows\System\cTDiqkl.exe
  2⤵
  PID:8124
- C:\Windows\System\gkicZLu.exe
  C:\Windows\System\gkicZLu.exe
  2⤵
  PID:8152
- C:\Windows\System\miKwYLu.exe
  C:\Windows\System\miKwYLu.exe
  2⤵
  PID:6588
- C:\Windows\System\rcqKBxh.exe
  C:\Windows\System\rcqKBxh.exe
  2⤵
  PID:7392
- C:\Windows\System\FeXxOvr.exe
  C:\Windows\System\FeXxOvr.exe
  2⤵
  PID:7412
- C:\Windows\System\rnmsOnJ.exe
  C:\Windows\System\rnmsOnJ.exe
  2⤵
  PID:7596
- C:\Windows\System\AqzhMQC.exe
  C:\Windows\System\AqzhMQC.exe
  2⤵
  PID:7748
- C:\Windows\System\nRTMHuT.exe
  C:\Windows\System\nRTMHuT.exe
  2⤵
  PID:7952
- C:\Windows\System\VPLpyeY.exe
  C:\Windows\System\VPLpyeY.exe
  2⤵
  PID:7192
- C:\Windows\System\xrNXNWA.exe
  C:\Windows\System\xrNXNWA.exe
  2⤵
  PID:7216
- C:\Windows\System\ofdkKbr.exe
  C:\Windows\System\ofdkKbr.exe
  2⤵
  PID:7696
- C:\Windows\System\UfRpWEZ.exe
  C:\Windows\System\UfRpWEZ.exe
  2⤵
  PID:8100
- C:\Windows\System\SRuazZk.exe
  C:\Windows\System\SRuazZk.exe
  2⤵
  PID:7228
- C:\Windows\System\yfpMMHt.exe
  C:\Windows\System\yfpMMHt.exe
  2⤵
  PID:8212
- C:\Windows\System\nBrEjUQ.exe
  C:\Windows\System\nBrEjUQ.exe
  2⤵
  PID:8244
- C:\Windows\System\cyjWRzH.exe
  C:\Windows\System\cyjWRzH.exe
  2⤵
  PID:8272
- C:\Windows\System\UQOsmen.exe
  C:\Windows\System\UQOsmen.exe
  2⤵
  PID:8288
- C:\Windows\System\FUzXskE.exe
  C:\Windows\System\FUzXskE.exe
  2⤵
  PID:8308
- C:\Windows\System\nCaCoEB.exe
  C:\Windows\System\nCaCoEB.exe
  2⤵
  PID:8344
- C:\Windows\System\bpEHWsw.exe
  C:\Windows\System\bpEHWsw.exe
  2⤵
  PID:8360
- C:\Windows\System\GezgHzq.exe
  C:\Windows\System\GezgHzq.exe
  2⤵
  PID:8400
- C:\Windows\System\tJKJedM.exe
  C:\Windows\System\tJKJedM.exe
  2⤵
  PID:8416
- C:\Windows\System\vhlNnVN.exe
  C:\Windows\System\vhlNnVN.exe
  2⤵
  PID:8444
- C:\Windows\System\OUfpBDW.exe
  C:\Windows\System\OUfpBDW.exe
  2⤵
  PID:8472
- C:\Windows\System\SkZHelr.exe
  C:\Windows\System\SkZHelr.exe
  2⤵
  PID:8508
- C:\Windows\System\slUgofk.exe
  C:\Windows\System\slUgofk.exe
  2⤵
  PID:8544
- C:\Windows\System\TTjbYWU.exe
  C:\Windows\System\TTjbYWU.exe
  2⤵
  PID:8580
- C:\Windows\System\xwjLKSs.exe
  C:\Windows\System\xwjLKSs.exe
  2⤵
  PID:8596
- C:\Windows\System\WLUQSvR.exe
  C:\Windows\System\WLUQSvR.exe
  2⤵
  PID:8624
- C:\Windows\System\Glujena.exe
  C:\Windows\System\Glujena.exe
  2⤵
  PID:8652
- C:\Windows\System\xCnIyDy.exe
  C:\Windows\System\xCnIyDy.exe
  2⤵
  PID:8680
- C:\Windows\System\tyakOre.exe
  C:\Windows\System\tyakOre.exe
  2⤵
  PID:8708
- C:\Windows\System\cNjxKyp.exe
  C:\Windows\System\cNjxKyp.exe
  2⤵
  PID:8736
- C:\Windows\System\AqgreKX.exe
  C:\Windows\System\AqgreKX.exe
  2⤵
  PID:8764
- C:\Windows\System\WOEomCv.exe
  C:\Windows\System\WOEomCv.exe
  2⤵
  PID:8804
- C:\Windows\System\VgkJeyj.exe
  C:\Windows\System\VgkJeyj.exe
  2⤵
  PID:8832
- C:\Windows\System\PBtawbj.exe
  C:\Windows\System\PBtawbj.exe
  2⤵
  PID:8860
- C:\Windows\System\OCtmPtP.exe
  C:\Windows\System\OCtmPtP.exe
  2⤵
  PID:8880
- C:\Windows\System\PfOOACT.exe
  C:\Windows\System\PfOOACT.exe
  2⤵
  PID:8904
- C:\Windows\System\PjOftWR.exe
  C:\Windows\System\PjOftWR.exe
  2⤵
  PID:8924
- C:\Windows\System\hPRsNAY.exe
  C:\Windows\System\hPRsNAY.exe
  2⤵
  PID:8956
- C:\Windows\System\nxnNIhW.exe
  C:\Windows\System\nxnNIhW.exe
  2⤵
  PID:8992
- C:\Windows\System\FQQraSd.exe
  C:\Windows\System\FQQraSd.exe
  2⤵
  PID:9016
- C:\Windows\System\fXBsUud.exe
  C:\Windows\System\fXBsUud.exe
  2⤵
  PID:9044
- C:\Windows\System\qvGXVUj.exe
  C:\Windows\System\qvGXVUj.exe
  2⤵
  PID:9060
- C:\Windows\System\GRDRHEc.exe
  C:\Windows\System\GRDRHEc.exe
  2⤵
  PID:9076
- C:\Windows\System\wdJTsih.exe
  C:\Windows\System\wdJTsih.exe
  2⤵
  PID:9104
- C:\Windows\System\qcjihRy.exe
  C:\Windows\System\qcjihRy.exe
  2⤵
  PID:9132
- C:\Windows\System\rrVZrQI.exe
  C:\Windows\System\rrVZrQI.exe
  2⤵
  PID:9156
- C:\Windows\System\aTXneds.exe
  C:\Windows\System\aTXneds.exe
  2⤵
  PID:9188
- C:\Windows\System\yUoCbHU.exe
  C:\Windows\System\yUoCbHU.exe
  2⤵
  PID:8076
- C:\Windows\System\boEyhDO.exe
  C:\Windows\System\boEyhDO.exe
  2⤵
  PID:8256
- C:\Windows\System\WsoTbZR.exe
  C:\Windows\System\WsoTbZR.exe
  2⤵
  PID:8280
- C:\Windows\System\BkGpsOf.exe
  C:\Windows\System\BkGpsOf.exe
  2⤵
  PID:8356
- C:\Windows\System\aldvulk.exe
  C:\Windows\System\aldvulk.exe
  2⤵
  PID:8484
- C:\Windows\System\LCCmnlW.exe
  C:\Windows\System\LCCmnlW.exe
  2⤵
  PID:8568
- C:\Windows\System\yvQxAwm.exe
  C:\Windows\System\yvQxAwm.exe
  2⤵
  PID:8608
- C:\Windows\System\dPJndZf.exe
  C:\Windows\System\dPJndZf.exe
  2⤵
  PID:8696
- C:\Windows\System\zaIaXRp.exe
  C:\Windows\System\zaIaXRp.exe
  2⤵
  PID:8720
- C:\Windows\System\ZBmDxot.exe
  C:\Windows\System\ZBmDxot.exe
  2⤵
  PID:8820
- C:\Windows\System\yrXaHdZ.exe
  C:\Windows\System\yrXaHdZ.exe
  2⤵
  PID:8868
- C:\Windows\System\XdAMlHS.exe
  C:\Windows\System\XdAMlHS.exe
  2⤵
  PID:8968
- C:\Windows\System\xnqRGUx.exe
  C:\Windows\System\xnqRGUx.exe
  2⤵
  PID:9012
- C:\Windows\System\DseLNAV.exe
  C:\Windows\System\DseLNAV.exe
  2⤵
  PID:9072
- C:\Windows\System\SeJmeBk.exe
  C:\Windows\System\SeJmeBk.exe
  2⤵
  PID:9120
- C:\Windows\System\QgxcjVa.exe
  C:\Windows\System\QgxcjVa.exe
  2⤵
  PID:7304
- C:\Windows\System\xKioNdP.exe
  C:\Windows\System\xKioNdP.exe
  2⤵
  PID:8204
- C:\Windows\System\wkItnPy.exe
  C:\Windows\System\wkItnPy.exe
  2⤵
  PID:8428
- C:\Windows\System\vEdEUbm.exe
  C:\Windows\System\vEdEUbm.exe
  2⤵
  PID:8644
- C:\Windows\System\HUtcoaT.exe
  C:\Windows\System\HUtcoaT.exe
  2⤵
  PID:8744
- C:\Windows\System\RaDHtyD.exe
  C:\Windows\System\RaDHtyD.exe
  2⤵
  PID:8940
- C:\Windows\System\TPqnEXs.exe
  C:\Windows\System\TPqnEXs.exe
  2⤵
  PID:9068
- C:\Windows\System\CRTjFlO.exe
  C:\Windows\System\CRTjFlO.exe
  2⤵
  PID:9200
- C:\Windows\System\eCHcyEp.exe
  C:\Windows\System\eCHcyEp.exe
  2⤵
  PID:8576
- C:\Windows\System\YATVfkc.exe
  C:\Windows\System\YATVfkc.exe
  2⤵
  PID:8948
- C:\Windows\System\rSUHyFE.exe
  C:\Windows\System\rSUHyFE.exe
  2⤵
  PID:9036
- C:\Windows\System\KecdawY.exe
  C:\Windows\System\KecdawY.exe
  2⤵
  PID:9052
- C:\Windows\System\nUMVRmx.exe
  C:\Windows\System\nUMVRmx.exe
  2⤵
  PID:9236
- C:\Windows\System\iWAdFNY.exe
  C:\Windows\System\iWAdFNY.exe
  2⤵
  PID:9256
- C:\Windows\System\lrShVqT.exe
  C:\Windows\System\lrShVqT.exe
  2⤵
  PID:9296
- C:\Windows\System\BtpCOpF.exe
  C:\Windows\System\BtpCOpF.exe
  2⤵
  PID:9320
- C:\Windows\System\SQcfVJp.exe
  C:\Windows\System\SQcfVJp.exe
  2⤵
  PID:9348
- C:\Windows\System\UEhVyFk.exe
  C:\Windows\System\UEhVyFk.exe
  2⤵
  PID:9376
- C:\Windows\System\pgGrsEP.exe
  C:\Windows\System\pgGrsEP.exe
  2⤵
  PID:9408
- C:\Windows\System\bojxzYh.exe
  C:\Windows\System\bojxzYh.exe
  2⤵
  PID:9444
- C:\Windows\System\qzTbUbD.exe
  C:\Windows\System\qzTbUbD.exe
  2⤵
  PID:9472
- C:\Windows\System\CeZCoZi.exe
  C:\Windows\System\CeZCoZi.exe
  2⤵
  PID:9488
- C:\Windows\System\HrNSZnl.exe
  C:\Windows\System\HrNSZnl.exe
  2⤵
  PID:9528
- C:\Windows\System\mluwOue.exe
  C:\Windows\System\mluwOue.exe
  2⤵
  PID:9544
- C:\Windows\System\UnXVrMR.exe
  C:\Windows\System\UnXVrMR.exe
  2⤵
  PID:9572
- C:\Windows\System\kCoGRVC.exe
  C:\Windows\System\kCoGRVC.exe
  2⤵
  PID:9604
- C:\Windows\System\RAmbykG.exe
  C:\Windows\System\RAmbykG.exe
  2⤵
  PID:9628
- C:\Windows\System\bClzJff.exe
  C:\Windows\System\bClzJff.exe
  2⤵
  PID:9668
- C:\Windows\System\KcTmpju.exe
  C:\Windows\System\KcTmpju.exe
  2⤵
  PID:9696
- C:\Windows\System\xvMvktk.exe
  C:\Windows\System\xvMvktk.exe
  2⤵
  PID:9716
- C:\Windows\System\XaKXyFs.exe
  C:\Windows\System\XaKXyFs.exe
  2⤵
  PID:9752
- C:\Windows\System\xcwAKVF.exe
  C:\Windows\System\xcwAKVF.exe
  2⤵
  PID:9780
- C:\Windows\System\nXRubZj.exe
  C:\Windows\System\nXRubZj.exe
  2⤵
  PID:9796
- C:\Windows\System\LVxBVIT.exe
  C:\Windows\System\LVxBVIT.exe
  2⤵
  PID:9824
- C:\Windows\System\fmHxLsq.exe
  C:\Windows\System\fmHxLsq.exe
  2⤵
  PID:9852
- C:\Windows\System\tKVXgEB.exe
  C:\Windows\System\tKVXgEB.exe
  2⤵
  PID:9880
- C:\Windows\System\ygAVxvy.exe
  C:\Windows\System\ygAVxvy.exe
  2⤵
  PID:9920
- C:\Windows\System\yrFjxhs.exe
  C:\Windows\System\yrFjxhs.exe
  2⤵
  PID:9948
- C:\Windows\System\vTUJeaP.exe
  C:\Windows\System\vTUJeaP.exe
  2⤵
  PID:9976
- C:\Windows\System\mwePVrA.exe
  C:\Windows\System\mwePVrA.exe
  2⤵
  PID:10000
- C:\Windows\System\FzKLPDJ.exe
  C:\Windows\System\FzKLPDJ.exe
  2⤵
  PID:10020
- C:\Windows\System\RCGLApm.exe
  C:\Windows\System\RCGLApm.exe
  2⤵
  PID:10036
- C:\Windows\System\EyTAXcY.exe
  C:\Windows\System\EyTAXcY.exe
  2⤵
  PID:10060
- C:\Windows\System\yigielt.exe
  C:\Windows\System\yigielt.exe
  2⤵
  PID:10080
- C:\Windows\System\EmUEeHT.exe
  C:\Windows\System\EmUEeHT.exe
  2⤵
  PID:10108
- C:\Windows\System\fQrOAiP.exe
  C:\Windows\System\fQrOAiP.exe
  2⤵
  PID:10152
- C:\Windows\System\IohDYBt.exe
  C:\Windows\System\IohDYBt.exe
  2⤵
  PID:10188
- C:\Windows\System\icaWkID.exe
  C:\Windows\System\icaWkID.exe
  2⤵
  PID:10228
- C:\Windows\System\KDvqOAR.exe
  C:\Windows\System\KDvqOAR.exe
  2⤵
  PID:9128
- C:\Windows\System\AetQrlH.exe
  C:\Windows\System\AetQrlH.exe
  2⤵
  PID:9252
- C:\Windows\System\KyHPhmz.exe
  C:\Windows\System\KyHPhmz.exe
  2⤵
  PID:9340
- C:\Windows\System\dWaqSGL.exe
  C:\Windows\System\dWaqSGL.exe
  2⤵
  PID:9416
- C:\Windows\System\uXzjOOw.exe
  C:\Windows\System\uXzjOOw.exe
  2⤵
  PID:9460
- C:\Windows\System\vfsODCB.exe
  C:\Windows\System\vfsODCB.exe
  2⤵
  PID:9480
- C:\Windows\System\cnoPfzq.exe
  C:\Windows\System\cnoPfzq.exe
  2⤵
  PID:9540
- C:\Windows\System\PmHfKJS.exe
  C:\Windows\System\PmHfKJS.exe
  2⤵
  PID:9648
- C:\Windows\System\mLSlGmW.exe
  C:\Windows\System\mLSlGmW.exe
  2⤵
  PID:9692
- C:\Windows\System\sKBBtOs.exe
  C:\Windows\System\sKBBtOs.exe
  2⤵
  PID:9776
- C:\Windows\System\hKByAEf.exe
  C:\Windows\System\hKByAEf.exe
  2⤵
  PID:9844
- C:\Windows\System\CQbkDow.exe
  C:\Windows\System\CQbkDow.exe
  2⤵
  PID:9944
- C:\Windows\System\FqDwXbR.exe
  C:\Windows\System\FqDwXbR.exe
  2⤵
  PID:9992
- C:\Windows\System\SOEtqNJ.exe
  C:\Windows\System\SOEtqNJ.exe
  2⤵
  PID:10072
- C:\Windows\System\HwvbEXG.exe
  C:\Windows\System\HwvbEXG.exe
  2⤵
  PID:10116
- C:\Windows\System\Bmlrxhn.exe
  C:\Windows\System\Bmlrxhn.exe
  2⤵
  PID:10160
- C:\Windows\System\KaRxXlK.exe
  C:\Windows\System\KaRxXlK.exe
  2⤵
  PID:10236
- C:\Windows\System\rFVjLwC.exe
  C:\Windows\System\rFVjLwC.exe
  2⤵
  PID:9332
- C:\Windows\System\KIFGRsH.exe
  C:\Windows\System\KIFGRsH.exe
  2⤵
  PID:9624
- C:\Windows\System\bkbbGYb.exe
  C:\Windows\System\bkbbGYb.exe
  2⤵
  PID:9556
- C:\Windows\System\zLHTXTL.exe
  C:\Windows\System\zLHTXTL.exe
  2⤵
  PID:9764
- C:\Windows\System\KrpPCvJ.exe
  C:\Windows\System\KrpPCvJ.exe
  2⤵
  PID:9836
- C:\Windows\System\ifphNFf.exe
  C:\Windows\System\ifphNFf.exe
  2⤵
  PID:10100
- C:\Windows\System\YUlSeqd.exe
  C:\Windows\System\YUlSeqd.exe
  2⤵
  PID:10216
- C:\Windows\System\ImLXPda.exe
  C:\Windows\System\ImLXPda.exe
  2⤵
  PID:9736
- C:\Windows\System\cLtdOZf.exe
  C:\Windows\System\cLtdOZf.exe
  2⤵
  PID:10048
- C:\Windows\System\mmluAIv.exe
  C:\Windows\System\mmluAIv.exe
  2⤵
  PID:10224
- C:\Windows\System\xjSNnfi.exe
  C:\Windows\System\xjSNnfi.exe
  2⤵
  PID:9820
- C:\Windows\System\OdMKver.exe
  C:\Windows\System\OdMKver.exe
  2⤵
  PID:10268
- C:\Windows\System\uDTIHlM.exe
  C:\Windows\System\uDTIHlM.exe
  2⤵
  PID:10288
- C:\Windows\System\ULSLSmg.exe
  C:\Windows\System\ULSLSmg.exe
  2⤵
  PID:10328
- C:\Windows\System\WOJqKaU.exe
  C:\Windows\System\WOJqKaU.exe
  2⤵
  PID:10352
- C:\Windows\System\MwrMcJO.exe
  C:\Windows\System\MwrMcJO.exe
  2⤵
  PID:10372
- C:\Windows\System\IaNkUXG.exe
  C:\Windows\System\IaNkUXG.exe
  2⤵
  PID:10392
- C:\Windows\System\dsiKqda.exe
  C:\Windows\System\dsiKqda.exe
  2⤵
  PID:10420
- C:\Windows\System\zdrOgmL.exe
  C:\Windows\System\zdrOgmL.exe
  2⤵
  PID:10464
- C:\Windows\System\WQNJLZw.exe
  C:\Windows\System\WQNJLZw.exe
  2⤵
  PID:10484
- C:\Windows\System\yDHouTe.exe
  C:\Windows\System\yDHouTe.exe
  2⤵
  PID:10524
- C:\Windows\System\HyrnCXt.exe
  C:\Windows\System\HyrnCXt.exe
  2⤵
  PID:10548
- C:\Windows\System\QGuTZGs.exe
  C:\Windows\System\QGuTZGs.exe
  2⤵
  PID:10568
- C:\Windows\System\GNpnxYt.exe
  C:\Windows\System\GNpnxYt.exe
  2⤵
  PID:10608
- C:\Windows\System\sLgJbUv.exe
  C:\Windows\System\sLgJbUv.exe
  2⤵
  PID:10636
- C:\Windows\System\vlsZxlM.exe
  C:\Windows\System\vlsZxlM.exe
  2⤵
  PID:10660
- C:\Windows\System\bUGJZYj.exe
  C:\Windows\System\bUGJZYj.exe
  2⤵
  PID:10684
- C:\Windows\System\WtckWPQ.exe
  C:\Windows\System\WtckWPQ.exe
  2⤵
  PID:10708
- C:\Windows\System\XBrXedD.exe
  C:\Windows\System\XBrXedD.exe
  2⤵
  PID:10744
- C:\Windows\System\JBShrws.exe
  C:\Windows\System\JBShrws.exe
  2⤵
  PID:10776
- C:\Windows\System\SknMcCE.exe
  C:\Windows\System\SknMcCE.exe
  2⤵
  PID:10804
- C:\Windows\System\XdxqsSM.exe
  C:\Windows\System\XdxqsSM.exe
  2⤵
  PID:10820
- C:\Windows\System\rLHWmLp.exe
  C:\Windows\System\rLHWmLp.exe
  2⤵
  PID:10848
- C:\Windows\System\dMRfSFF.exe
  C:\Windows\System\dMRfSFF.exe
  2⤵
  PID:10864
- C:\Windows\System\vqOMetV.exe
  C:\Windows\System\vqOMetV.exe
  2⤵
  PID:10880
- C:\Windows\System\yhqcFpm.exe
  C:\Windows\System\yhqcFpm.exe
  2⤵
  PID:10932
- C:\Windows\System\ewiOIfm.exe
  C:\Windows\System\ewiOIfm.exe
  2⤵
  PID:10968
- C:\Windows\System\OlTLMaD.exe
  C:\Windows\System\OlTLMaD.exe
  2⤵
  PID:10996
- C:\Windows\System\ReVDMox.exe
  C:\Windows\System\ReVDMox.exe
  2⤵
  PID:11028
- C:\Windows\System\HBfHxMQ.exe
  C:\Windows\System\HBfHxMQ.exe
  2⤵
  PID:11056
- C:\Windows\System\sigPAJG.exe
  C:\Windows\System\sigPAJG.exe
  2⤵
  PID:11084
- C:\Windows\System\KWbChwD.exe
  C:\Windows\System\KWbChwD.exe
  2⤵
  PID:11100
- C:\Windows\System\gIuOnuE.exe
  C:\Windows\System\gIuOnuE.exe
  2⤵
  PID:11136
- C:\Windows\System\VGyLvzg.exe
  C:\Windows\System\VGyLvzg.exe
  2⤵
  PID:11156
- C:\Windows\System\kXYmfhB.exe
  C:\Windows\System\kXYmfhB.exe
  2⤵
  PID:11184
- C:\Windows\System\NEnHXpV.exe
  C:\Windows\System\NEnHXpV.exe
  2⤵
  PID:11212
- C:\Windows\System\ORKVbLt.exe
  C:\Windows\System\ORKVbLt.exe
  2⤵
  PID:11232
- C:\Windows\System\asZqBRP.exe
  C:\Windows\System\asZqBRP.exe
  2⤵
  PID:9932
- C:\Windows\System\yDDQcrQ.exe
  C:\Windows\System\yDDQcrQ.exe
  2⤵
  PID:10252
- C:\Windows\System\KQlGkbM.exe
  C:\Windows\System\KQlGkbM.exe
  2⤵
  PID:10320
- C:\Windows\System\eyINGoA.exe
  C:\Windows\System\eyINGoA.exe
  2⤵
  PID:10380
- C:\Windows\System\mWxtdmC.exe
  C:\Windows\System\mWxtdmC.exe
  2⤵
  PID:10504
- C:\Windows\System\eJOPEdx.exe
  C:\Windows\System\eJOPEdx.exe
  2⤵
  PID:10544
- C:\Windows\System\kHCEwZQ.exe
  C:\Windows\System\kHCEwZQ.exe
  2⤵
  PID:10620
- C:\Windows\System\tVDvPkf.exe
  C:\Windows\System\tVDvPkf.exe
  2⤵
  PID:10692
- C:\Windows\System\kMUoihk.exe
  C:\Windows\System\kMUoihk.exe
  2⤵
  PID:10724
- C:\Windows\System\kcCYXQO.exe
  C:\Windows\System\kcCYXQO.exe
  2⤵
  PID:10816
- C:\Windows\System\NHxDbqJ.exe
  C:\Windows\System\NHxDbqJ.exe
  2⤵
  PID:10896
- C:\Windows\System\dnVyEcU.exe
  C:\Windows\System\dnVyEcU.exe
  2⤵
  PID:10952
- C:\Windows\System\NjWVGwX.exe
  C:\Windows\System\NjWVGwX.exe
  2⤵
  PID:11044
- C:\Windows\System\gGYyVJZ.exe
  C:\Windows\System\gGYyVJZ.exe
  2⤵
  PID:11068
- C:\Windows\System\iSagcyJ.exe
  C:\Windows\System\iSagcyJ.exe
  2⤵
  PID:11124
- C:\Windows\System\JPLuXkv.exe
  C:\Windows\System\JPLuXkv.exe
  2⤵
  PID:11152
- C:\Windows\System\pYggLcn.exe
  C:\Windows\System\pYggLcn.exe
  2⤵
  PID:11256
- C:\Windows\System\FalqSDY.exe
  C:\Windows\System\FalqSDY.exe
  2⤵
  PID:10364
- C:\Windows\System\JQvsqkR.exe
  C:\Windows\System\JQvsqkR.exe
  2⤵
  PID:10536
- C:\Windows\System\OrlGjKT.exe
  C:\Windows\System\OrlGjKT.exe
  2⤵
  PID:10592
- C:\Windows\System\yJSdMHJ.exe
  C:\Windows\System\yJSdMHJ.exe
  2⤵
  PID:10800
- C:\Windows\System\lwFYVaG.exe
  C:\Windows\System\lwFYVaG.exe
  2⤵
  PID:10948
- C:\Windows\System\VPTDUAI.exe
  C:\Windows\System\VPTDUAI.exe
  2⤵
  PID:11252
- C:\Windows\System\AAVHSPo.exe
  C:\Windows\System\AAVHSPo.exe
  2⤵
  PID:10368
- C:\Windows\System\vPpnGdv.exe
  C:\Windows\System\vPpnGdv.exe
  2⤵
  PID:10704
- C:\Windows\System\SVDdaDE.exe
  C:\Windows\System\SVDdaDE.exe
  2⤵
  PID:10752
- C:\Windows\System\HXpLmGq.exe
  C:\Windows\System\HXpLmGq.exe
  2⤵
  PID:11096
- C:\Windows\System\PGYodyS.exe
  C:\Windows\System\PGYodyS.exe
  2⤵
  PID:11052
- C:\Windows\System\lYDGnGK.exe
  C:\Windows\System\lYDGnGK.exe
  2⤵
  PID:11296
- C:\Windows\System\sldlErJ.exe
  C:\Windows\System\sldlErJ.exe
  2⤵
  PID:11316
- C:\Windows\System\TOCJYuA.exe
  C:\Windows\System\TOCJYuA.exe
  2⤵
  PID:11352
- C:\Windows\System\BbkXZbG.exe
  C:\Windows\System\BbkXZbG.exe
  2⤵
  PID:11376
- C:\Windows\System\PewsbcP.exe
  C:\Windows\System\PewsbcP.exe
  2⤵
  PID:11424
- C:\Windows\System\Uecrwdi.exe
  C:\Windows\System\Uecrwdi.exe
  2⤵
  PID:11440
- C:\Windows\System\BZEyPuF.exe
  C:\Windows\System\BZEyPuF.exe
  2⤵
  PID:11468
- C:\Windows\System\iBoHLZX.exe
  C:\Windows\System\iBoHLZX.exe
  2⤵
  PID:11500
- C:\Windows\System\icjaGAU.exe
  C:\Windows\System\icjaGAU.exe
  2⤵
  PID:11524
- C:\Windows\System\zucwqIr.exe
  C:\Windows\System\zucwqIr.exe
  2⤵
  PID:11552
- C:\Windows\System\avxUAPI.exe
  C:\Windows\System\avxUAPI.exe
  2⤵
  PID:11580
- C:\Windows\System\mQPXLtr.exe
  C:\Windows\System\mQPXLtr.exe
  2⤵
  PID:11600
- C:\Windows\System\IQIrHbi.exe
  C:\Windows\System\IQIrHbi.exe
  2⤵
  PID:11640
- C:\Windows\System\LyFQKtd.exe
  C:\Windows\System\LyFQKtd.exe
  2⤵
  PID:11676
- C:\Windows\System\uLUYDhC.exe
  C:\Windows\System\uLUYDhC.exe
  2⤵
  PID:11704
- C:\Windows\System\WpzPGeV.exe
  C:\Windows\System\WpzPGeV.exe
  2⤵
  PID:11732
- C:\Windows\System\EghDPRp.exe
  C:\Windows\System\EghDPRp.exe
  2⤵
  PID:11748
- C:\Windows\System\hfsKzMR.exe
  C:\Windows\System\hfsKzMR.exe
  2⤵
  PID:11788
- C:\Windows\System\RrKDdXe.exe
  C:\Windows\System\RrKDdXe.exe
  2⤵
  PID:11808
- C:\Windows\System\BJIyiaQ.exe
  C:\Windows\System\BJIyiaQ.exe
  2⤵
  PID:11832
- C:\Windows\System\ozSHfWw.exe
  C:\Windows\System\ozSHfWw.exe
  2⤵
  PID:11860
- C:\Windows\System\CEYOIrC.exe
  C:\Windows\System\CEYOIrC.exe
  2⤵
  PID:11900
- C:\Windows\System\ZzdaRYF.exe
  C:\Windows\System\ZzdaRYF.exe
  2⤵
  PID:11928
- C:\Windows\System\QkmcUnA.exe
  C:\Windows\System\QkmcUnA.exe
  2⤵
  PID:11956
- C:\Windows\System\kUpPetJ.exe
  C:\Windows\System\kUpPetJ.exe
  2⤵
  PID:11984
- C:\Windows\System\gmpajoX.exe
  C:\Windows\System\gmpajoX.exe
  2⤵
  PID:12000
- C:\Windows\System\stKdfbp.exe
  C:\Windows\System\stKdfbp.exe
  2⤵
  PID:12020
- C:\Windows\System\VcexWLW.exe
  C:\Windows\System\VcexWLW.exe
  2⤵
  PID:12044
- C:\Windows\System\bwyoSrX.exe
  C:\Windows\System\bwyoSrX.exe
  2⤵
  PID:12064
- C:\Windows\System\eSKHYtc.exe
  C:\Windows\System\eSKHYtc.exe
  2⤵
  PID:12100
- C:\Windows\System\RLBCOLn.exe
  C:\Windows\System\RLBCOLn.exe
  2⤵
  PID:12128
- C:\Windows\System\iJwteQt.exe
  C:\Windows\System\iJwteQt.exe
  2⤵
  PID:12168
- C:\Windows\System\pITxlgT.exe
  C:\Windows\System\pITxlgT.exe
  2⤵
  PID:12196
- C:\Windows\System\eEqnajA.exe
  C:\Windows\System\eEqnajA.exe
  2⤵
  PID:12224
- C:\Windows\System\ZOdboNU.exe
  C:\Windows\System\ZOdboNU.exe
  2⤵
  PID:12252
- C:\Windows\System\jDAhmRM.exe
  C:\Windows\System\jDAhmRM.exe
  2⤵
  PID:11148
- C:\Windows\System\gtdhrBc.exe
  C:\Windows\System\gtdhrBc.exe
  2⤵
  PID:11344
- C:\Windows\System\uSkJTqH.exe
  C:\Windows\System\uSkJTqH.exe
  2⤵
  PID:11364
- C:\Windows\System\TnobaqK.exe
  C:\Windows\System\TnobaqK.exe
  2⤵
  PID:11372
- C:\Windows\System\nKafzLz.exe
  C:\Windows\System\nKafzLz.exe
  2⤵
  PID:11488
- C:\Windows\System\yTGKeUy.exe
  C:\Windows\System\yTGKeUy.exe
  2⤵
  PID:11540
- C:\Windows\System\BXeSjsG.exe
  C:\Windows\System\BXeSjsG.exe
  2⤵
  PID:11596
- C:\Windows\System\upsJjgX.exe
  C:\Windows\System\upsJjgX.exe
  2⤵
  PID:11668
- C:\Windows\System\gOSQeyg.exe
  C:\Windows\System\gOSQeyg.exe
  2⤵
  PID:11716
- C:\Windows\System\fhJMRXn.exe
  C:\Windows\System\fhJMRXn.exe
  2⤵
  PID:11804
- C:\Windows\System\TRvrnrV.exe
  C:\Windows\System\TRvrnrV.exe
  2⤵
  PID:11848
- C:\Windows\System\zBsRtOX.exe
  C:\Windows\System\zBsRtOX.exe
  2⤵
  PID:11892
- C:\Windows\System\sxOYFEb.exe
  C:\Windows\System\sxOYFEb.exe
  2⤵
  PID:11940
- C:\Windows\System\ZKiFuCS.exe
  C:\Windows\System\ZKiFuCS.exe
  2⤵
  PID:12056
- C:\Windows\System\HHGJzLy.exe
  C:\Windows\System\HHGJzLy.exe
  2⤵
  PID:12136
- C:\Windows\System\PTIjYlO.exe
  C:\Windows\System\PTIjYlO.exe
  2⤵
  PID:12192
- C:\Windows\System\bAknBdL.exe
  C:\Windows\System\bAknBdL.exe
  2⤵
  PID:12284
- C:\Windows\System\lCkgulb.exe
  C:\Windows\System\lCkgulb.exe
  2⤵
  PID:11336
- C:\Windows\System\duBMHnQ.exe
  C:\Windows\System\duBMHnQ.exe
  2⤵
  PID:11536
- C:\Windows\System\apwZCfG.exe
  C:\Windows\System\apwZCfG.exe
  2⤵
  PID:11628
- C:\Windows\System\hNwsMMU.exe
  C:\Windows\System\hNwsMMU.exe
  2⤵
  PID:11828
- C:\Windows\System\cOwEJZV.exe
  C:\Windows\System\cOwEJZV.exe
  2⤵
  PID:11972
- C:\Windows\System\RiPrYME.exe
  C:\Windows\System\RiPrYME.exe
  2⤵
  PID:12052
- C:\Windows\System\KIyVYXH.exe
  C:\Windows\System\KIyVYXH.exe
  2⤵
  PID:12220
- C:\Windows\System\IFXWCBb.exe
  C:\Windows\System\IFXWCBb.exe
  2⤵
  PID:11568
- C:\Windows\System\HhFdZwo.exe
  C:\Windows\System\HhFdZwo.exe
  2⤵
  PID:11844
- C:\Windows\System\AJFtvCz.exe
  C:\Windows\System\AJFtvCz.exe
  2⤵
  PID:12184
- C:\Windows\System\FcKOCet.exe
  C:\Windows\System\FcKOCet.exe
  2⤵
  PID:12276
- C:\Windows\System\xwOjETJ.exe
  C:\Windows\System\xwOjETJ.exe
  2⤵
  PID:12308
- C:\Windows\System\ayWOfTQ.exe
  C:\Windows\System\ayWOfTQ.exe
  2⤵
  PID:12344
- C:\Windows\System\SwRcIwt.exe
  C:\Windows\System\SwRcIwt.exe
  2⤵
  PID:12372
- C:\Windows\System\EgvfTLi.exe
  C:\Windows\System\EgvfTLi.exe
  2⤵
  PID:12388
- C:\Windows\System\NxRuMmB.exe
  C:\Windows\System\NxRuMmB.exe
  2⤵
  PID:12424
- C:\Windows\System\AjTpJpN.exe
  C:\Windows\System\AjTpJpN.exe
  2⤵
  PID:12464
- C:\Windows\System\WMUhdwh.exe
  C:\Windows\System\WMUhdwh.exe
  2⤵
  PID:12492
- C:\Windows\System\TvUTKpJ.exe
  C:\Windows\System\TvUTKpJ.exe
  2⤵
  PID:12508
- C:\Windows\System\JPAfKYZ.exe
  C:\Windows\System\JPAfKYZ.exe
  2⤵
  PID:12536
- C:\Windows\System\tagILcR.exe
  C:\Windows\System\tagILcR.exe
  2⤵
  PID:12564
- C:\Windows\System\ZJjdRIX.exe
  C:\Windows\System\ZJjdRIX.exe
  2⤵
  PID:12608
- C:\Windows\System\QmfJDEB.exe
  C:\Windows\System\QmfJDEB.exe
  2⤵
  PID:12628
- C:\Windows\System\qbnFcni.exe
  C:\Windows\System\qbnFcni.exe
  2⤵
  PID:12660
- C:\Windows\System\UkaUzoI.exe
  C:\Windows\System\UkaUzoI.exe
  2⤵
  PID:12696
- C:\Windows\System\iUyDymu.exe
  C:\Windows\System\iUyDymu.exe
  2⤵
  PID:12728
- C:\Windows\System\eJCdBDU.exe
  C:\Windows\System\eJCdBDU.exe
  2⤵
  PID:12744
- C:\Windows\System\AcMdNZB.exe
  C:\Windows\System\AcMdNZB.exe
  2⤵
  PID:12776
- C:\Windows\System\xrHMKrj.exe
  C:\Windows\System\xrHMKrj.exe
  2⤵
  PID:12824
- C:\Windows\System\xWHFbyU.exe
  C:\Windows\System\xWHFbyU.exe
  2⤵
  PID:12840
- C:\Windows\System\VbetZse.exe
  C:\Windows\System\VbetZse.exe
  2⤵
  PID:12868
- C:\Windows\System\FfPVjdD.exe
  C:\Windows\System\FfPVjdD.exe
  2⤵
  PID:12912
- C:\Windows\System\fOqjORU.exe
  C:\Windows\System\fOqjORU.exe
  2⤵
  PID:12940
- C:\Windows\System\YrmmrTV.exe
  C:\Windows\System\YrmmrTV.exe
  2⤵
  PID:12956
- C:\Windows\System\OTyDaVs.exe
  C:\Windows\System\OTyDaVs.exe
  2⤵
  PID:12984
- C:\Windows\System\FhKEIhQ.exe
  C:\Windows\System\FhKEIhQ.exe
  2⤵
  PID:13024
- C:\Windows\System\GGMZdIm.exe
  C:\Windows\System\GGMZdIm.exe
  2⤵
  PID:13052
- C:\Windows\System\eEKgVTZ.exe
  C:\Windows\System\eEKgVTZ.exe
  2⤵
  PID:13068
- C:\Windows\System\VApPfcW.exe
  C:\Windows\System\VApPfcW.exe
  2⤵
  PID:13096
- C:\Windows\System\KyppDxb.exe
  C:\Windows\System\KyppDxb.exe
  2⤵
  PID:13116
- C:\Windows\System\EAHHOdi.exe
  C:\Windows\System\EAHHOdi.exe
  2⤵
  PID:13144
- C:\Windows\System\nIceRmJ.exe
  C:\Windows\System\nIceRmJ.exe
  2⤵
  PID:13176
- C:\Windows\System\GVOLCFu.exe
  C:\Windows\System\GVOLCFu.exe
  2⤵
  PID:13208
- C:\Windows\System\LUqfVXR.exe
  C:\Windows\System\LUqfVXR.exe
  2⤵
  PID:13236
- C:\Windows\System\oRFTwFU.exe
  C:\Windows\System\oRFTwFU.exe
  2⤵
  PID:13276
- C:\Windows\System\IpTiIXC.exe
  C:\Windows\System\IpTiIXC.exe
  2⤵
  PID:13304
- C:\Windows\System\cnruKSB.exe
  C:\Windows\System\cnruKSB.exe
  2⤵
  PID:12088
- C:\Windows\System\FufvLBC.exe
  C:\Windows\System\FufvLBC.exe
  2⤵
  PID:12328
- C:\Windows\System\nHHAsTt.exe
  C:\Windows\System\nHHAsTt.exe
  2⤵
  PID:12384
- C:\Windows\System\OIOxyVA.exe
  C:\Windows\System\OIOxyVA.exe
  2⤵
  PID:12444
- C:\Windows\System\RPtVUxH.exe
  C:\Windows\System\RPtVUxH.exe
  2⤵
  PID:12548
- C:\Windows\System\DjBFdnA.exe
  C:\Windows\System\DjBFdnA.exe
  2⤵
  PID:12624
- C:\Windows\System\oqwjnyF.exe
  C:\Windows\System\oqwjnyF.exe
  2⤵
  PID:12672
- C:\Windows\System\SeTmeNf.exe
  C:\Windows\System\SeTmeNf.exe
  2⤵
  PID:12756
- C:\Windows\System\wielfUB.exe
  C:\Windows\System\wielfUB.exe
  2⤵
  PID:12836
- C:\Windows\System\QXjvNnl.exe
  C:\Windows\System\QXjvNnl.exe
  2⤵
  PID:12928
- C:\Windows\System\THkqjTb.exe
  C:\Windows\System\THkqjTb.exe
  2⤵
  PID:12996
- C:\Windows\System\NwYhAyP.exe
  C:\Windows\System\NwYhAyP.exe
  2⤵
  PID:13040
- C:\Windows\System\hfJdKeN.exe
  C:\Windows\System\hfJdKeN.exe
  2⤵
  PID:13088
- C:\Windows\System\hmnakVI.exe
  C:\Windows\System\hmnakVI.exe
  2⤵
  PID:13252
- C:\Windows\System\grFZDIQ.exe
  C:\Windows\System\grFZDIQ.exe
  2⤵
  PID:13196
- C:\Windows\System\LcSiVka.exe
  C:\Windows\System\LcSiVka.exe
  2⤵
  PID:13292
- C:\Windows\System\QGKjvCK.exe
  C:\Windows\System\QGKjvCK.exe
  2⤵
  PID:12332
- C:\Windows\System\NamBRFm.exe
  C:\Windows\System\NamBRFm.exe
  2⤵
  PID:12520
- C:\Windows\System\GiHHZpD.exe
  C:\Windows\System\GiHHZpD.exe
  2⤵
  PID:12740
- C:\Windows\System\FgUeBkt.exe
  C:\Windows\System\FgUeBkt.exe
  2⤵
  PID:12768
- C:\Windows\System\TfzqZMc.exe
  C:\Windows\System\TfzqZMc.exe
  2⤵
  PID:13020
- C:\Windows\System\bBWFumk.exe
  C:\Windows\System\bBWFumk.exe
  2⤵
  PID:13164
- C:\Windows\System\xFfikDP.exe
  C:\Windows\System\xFfikDP.exe
  2⤵
  PID:11220
- C:\Windows\System\iMXMdES.exe
  C:\Windows\System\iMXMdES.exe
  2⤵
  PID:12440
- C:\Windows\System\jBtORih.exe
  C:\Windows\System\jBtORih.exe
  2⤵
  PID:12968
- C:\Windows\System\uCYKsPK.exe
  C:\Windows\System\uCYKsPK.exe
  2⤵
  PID:12712
- C:\Windows\System\VbERvBZ.exe
  C:\Windows\System\VbERvBZ.exe
  2⤵
  PID:13324
- C:\Windows\System\lQjQxiV.exe
  C:\Windows\System\lQjQxiV.exe
  2⤵
  PID:13340
- C:\Windows\System\IZdqyth.exe
  C:\Windows\System\IZdqyth.exe
  2⤵
  PID:13360
- C:\Windows\System\RIBJYMh.exe
  C:\Windows\System\RIBJYMh.exe
  2⤵
  PID:13384
- C:\Windows\System\DWOOVYR.exe
  C:\Windows\System\DWOOVYR.exe
  2⤵
  PID:13436
- C:\Windows\System\RvGEckW.exe
  C:\Windows\System\RvGEckW.exe
  2⤵
  PID:13472
- C:\Windows\System\tIrFcYK.exe
  C:\Windows\System\tIrFcYK.exe
  2⤵
  PID:13504
- C:\Windows\System\OUordfc.exe
  C:\Windows\System\OUordfc.exe
  2⤵
  PID:13552
- C:\Windows\System\RyJLCQy.exe
  C:\Windows\System\RyJLCQy.exe
  2⤵
  PID:13584
- C:\Windows\System\HGkbqYN.exe
  C:\Windows\System\HGkbqYN.exe
  2⤵
  PID:13604
- C:\Windows\System\iJzSduF.exe
  C:\Windows\System\iJzSduF.exe
  2⤵
  PID:13632
- C:\Windows\System\eYhmTwt.exe
  C:\Windows\System\eYhmTwt.exe
  2⤵
  PID:13648
- C:\Windows\System\fPKIBQx.exe
  C:\Windows\System\fPKIBQx.exe
  2⤵
  PID:13680
- C:\Windows\System\gInEnKE.exe
  C:\Windows\System\gInEnKE.exe
  2⤵
  PID:13708
- C:\Windows\System\iMNpneU.exe
  C:\Windows\System\iMNpneU.exe
  2⤵
  PID:13740
- C:\Windows\System\rylJxLF.exe
  C:\Windows\System\rylJxLF.exe
  2⤵
  PID:13780
- C:\Windows\System\VYSnzAN.exe
  C:\Windows\System\VYSnzAN.exe
  2⤵
  PID:13812
- C:\Windows\System\jlnxPvZ.exe
  C:\Windows\System\jlnxPvZ.exe
  2⤵
  PID:13844
- C:\Windows\System\vcCoVPO.exe
  C:\Windows\System\vcCoVPO.exe
  2⤵
  PID:13876
- C:\Windows\System\BuKLQQP.exe
  C:\Windows\System\BuKLQQP.exe
  2⤵
  PID:13904
- C:\Windows\System\GwtCWRw.exe
  C:\Windows\System\GwtCWRw.exe
  2⤵
  PID:13940
- C:\Windows\System\NZkTOWK.exe
  C:\Windows\System\NZkTOWK.exe
  2⤵
  PID:13972
- C:\Windows\System\zJXOFkl.exe
  C:\Windows\System\zJXOFkl.exe
  2⤵
  PID:14000
- C:\Windows\System\ndpffib.exe
  C:\Windows\System\ndpffib.exe
  2⤵
  PID:14048
- C:\Windows\System\TxkgraN.exe
  C:\Windows\System\TxkgraN.exe
  2⤵
  PID:14080
- C:\Windows\System\BZYuvMW.exe
  C:\Windows\System\BZYuvMW.exe
  2⤵
  PID:14112
- C:\Windows\System\gHWWvZg.exe
  C:\Windows\System\gHWWvZg.exe
  2⤵
  PID:14156
- C:\Windows\System\MZPcNMX.exe
  C:\Windows\System\MZPcNMX.exe
  2⤵
  PID:14180
- C:\Windows\System\ePLqwlm.exe
  C:\Windows\System\ePLqwlm.exe
  2⤵
  PID:14204
- C:\Windows\System\yWWrDtr.exe
  C:\Windows\System\yWWrDtr.exe
  2⤵
  PID:14240
- C:\Windows\System\FCIktWo.exe
  C:\Windows\System\FCIktWo.exe
  2⤵
  PID:14272
- C:\Windows\System\ICvCPCo.exe
  C:\Windows\System\ICvCPCo.exe
  2⤵
  PID:14308
- C:\Windows\System\axfjKpZ.exe
  C:\Windows\System\axfjKpZ.exe
  2⤵
  PID:13316
- C:\Windows\System\QkeZIEb.exe
  C:\Windows\System\QkeZIEb.exe
  2⤵
  PID:13380
- C:\Windows\System\XzwnGal.exe
  C:\Windows\System\XzwnGal.exe
  2⤵
  PID:13468
- C:\Windows\System\vxJqqKv.exe
  C:\Windows\System\vxJqqKv.exe
  2⤵
  PID:13572
- C:\Windows\System\qJqExez.exe
  C:\Windows\System\qJqExez.exe
  2⤵
  PID:13668
- C:\Windows\System\UeebFiB.exe
  C:\Windows\System\UeebFiB.exe
  2⤵
  PID:13704
- C:\Windows\System\TqOilAo.exe
  C:\Windows\System\TqOilAo.exe
  2⤵
  PID:13804
- C:\Windows\System\JhJGssB.exe
  C:\Windows\System\JhJGssB.exe
  2⤵
  PID:13868
- C:\Windows\System\TiEaJAT.exe
  C:\Windows\System\TiEaJAT.exe
  2⤵
  PID:13900
- C:\Windows\System\BxAgCtb.exe
  C:\Windows\System\BxAgCtb.exe
  2⤵
  PID:13980
- C:\Windows\System\hXdRkCF.exe
  C:\Windows\System\hXdRkCF.exe
  2⤵
  PID:14068
- C:\Windows\System\ijcqwHf.exe
  C:\Windows\System\ijcqwHf.exe
  2⤵
  PID:14168
- C:\Windows\System\JMyACIq.exe
  C:\Windows\System\JMyACIq.exe
  2⤵
  PID:14216
- C:\Windows\System\wiPoEEk.exe
  C:\Windows\System\wiPoEEk.exe
  2⤵
  PID:14324
- C:\Windows\System\BxUlPwV.exe
  C:\Windows\System\BxUlPwV.exe
  2⤵
  PID:13376
- C:\Windows\System\pwuPLLy.exe
  C:\Windows\System\pwuPLLy.exe
  2⤵
  PID:13640
- C:\Windows\System\MetqwSC.exe
  C:\Windows\System\MetqwSC.exe
  2⤵
  PID:13700
- C:\Windows\System\CmpzWuH.exe
  C:\Windows\System\CmpzWuH.exe
  2⤵
  PID:14144
- C:\Windows\System\VicamoQ.exe
  C:\Windows\System\VicamoQ.exe
  2⤵
  PID:13492
- C:\Windows\System\CBlLMWk.exe
  C:\Windows\System\CBlLMWk.exe
  2⤵
  PID:13624
- C:\Windows\System\ykFsCLf.exe
  C:\Windows\System\ykFsCLf.exe
  2⤵
  PID:14248
- C:\Windows\System\wOdkVYn.exe
  C:\Windows\System\wOdkVYn.exe
  2⤵
  PID:13348
- C:\Windows\System\FoBWSrX.exe
  C:\Windows\System\FoBWSrX.exe
  2⤵
  PID:14352
- C:\Windows\System\tEPFVkC.exe
  C:\Windows\System\tEPFVkC.exe
  2⤵
  PID:14380
- C:\Windows\System\kxQuasc.exe
  C:\Windows\System\kxQuasc.exe
  2⤵
  PID:14400
- C:\Windows\System\wikzrNh.exe
  C:\Windows\System\wikzrNh.exe
  2⤵
  PID:14436
- C:\Windows\System\GyMurHd.exe
  C:\Windows\System\GyMurHd.exe
  2⤵
  PID:14468
- C:\Windows\System\IQhPJil.exe
  C:\Windows\System\IQhPJil.exe
  2⤵
  PID:14496
- C:\Windows\System\dTWDoCX.exe
  C:\Windows\System\dTWDoCX.exe
  2⤵
  PID:14516
- C:\Windows\System\cHmeuQM.exe
  C:\Windows\System\cHmeuQM.exe
  2⤵
  PID:14540
- C:\Windows\System\HgZzTfM.exe
  C:\Windows\System\HgZzTfM.exe
  2⤵
  PID:14568
- C:\Windows\System\YviUKjB.exe
  C:\Windows\System\YviUKjB.exe
  2⤵
  PID:14584
- C:\Windows\System\vBcqQVm.exe
  C:\Windows\System\vBcqQVm.exe
  2⤵
  PID:14600
- C:\Windows\System\FKpHgGA.exe
  C:\Windows\System\FKpHgGA.exe
  2⤵
  PID:14632
- C:\Windows\System\MQvENjA.exe
  C:\Windows\System\MQvENjA.exe
  2⤵
  PID:14680
- C:\Windows\System\NjrEiNI.exe
  C:\Windows\System\NjrEiNI.exe
  2⤵
  PID:14708
- C:\Windows\System\XVCRsPD.exe
  C:\Windows\System\XVCRsPD.exe
  2⤵
  PID:14736
- C:\Windows\System\qPGlGKf.exe
  C:\Windows\System\qPGlGKf.exe
  2⤵
  PID:14760
- C:\Windows\System\tOAipKY.exe
  C:\Windows\System\tOAipKY.exe
  2⤵
  PID:14792
- C:\Windows\System\QshBpfP.exe
  C:\Windows\System\QshBpfP.exe
  2⤵
  PID:14820
- C:\Windows\System\jVgDKTg.exe
  C:\Windows\System\jVgDKTg.exe
  2⤵
  PID:14848
- C:\Windows\System\EBQdWcb.exe
  C:\Windows\System\EBQdWcb.exe
  2⤵
  PID:14864
- C:\Windows\System\uPTDQfo.exe
  C:\Windows\System\uPTDQfo.exe
  2⤵
  PID:14896
- C:\Windows\System\HUqZEYb.exe
  C:\Windows\System\HUqZEYb.exe
  2⤵
  PID:14924
- C:\Windows\System\AmkBdZn.exe
  C:\Windows\System\AmkBdZn.exe
  2⤵
  PID:14960
- C:\Windows\System\ZwStBTJ.exe
  C:\Windows\System\ZwStBTJ.exe
  2⤵
  PID:14988
- C:\Windows\System\PFfNoRV.exe
  C:\Windows\System\PFfNoRV.exe
  2⤵
  PID:15036
- C:\Windows\System\ZWVOUeE.exe
  C:\Windows\System\ZWVOUeE.exe
  2⤵
  PID:15064
- C:\Windows\System\GVMUhGC.exe
  C:\Windows\System\GVMUhGC.exe
  2⤵
  PID:15080
- C:\Windows\System\cEpWCxm.exe
  C:\Windows\System\cEpWCxm.exe
  2⤵
  PID:15112
- C:\Windows\System\uHwEpnF.exe
  C:\Windows\System\uHwEpnF.exe
  2⤵
  PID:15140
- C:\Windows\System\tzTHNgD.exe
  C:\Windows\System\tzTHNgD.exe
  2⤵
  PID:15172
- C:\Windows\System\FnCXTpb.exe
  C:\Windows\System\FnCXTpb.exe
  2⤵
  PID:15196
- C:\Windows\System\zJUecRR.exe
  C:\Windows\System\zJUecRR.exe
  2⤵
  PID:15220
- C:\Windows\System\xDXDzyt.exe
  C:\Windows\System\xDXDzyt.exe
  2⤵
  PID:15248
- C:\Windows\System\BLkViOf.exe
  C:\Windows\System\BLkViOf.exe
  2⤵
  PID:15276
- C:\Windows\System\bWIOUyt.exe
  C:\Windows\System\bWIOUyt.exe
  2⤵
  PID:15308
- C:\Windows\System\BaySdON.exe
  C:\Windows\System\BaySdON.exe
  2⤵
  PID:15332
- C:\Windows\System\IAEmfoQ.exe
  C:\Windows\System\IAEmfoQ.exe
  2⤵
  PID:13616
- C:\Windows\System\CjYHbzU.exe
  C:\Windows\System\CjYHbzU.exe
  2⤵
  PID:14424
- C:\Windows\System\aiiIZOb.exe
  C:\Windows\System\aiiIZOb.exe
  2⤵
  PID:14508
- C:\Windows\System\yGjAbdp.exe
  C:\Windows\System\yGjAbdp.exe
  2⤵
  PID:14560
- C:\Windows\System\dnvgrhZ.exe
  C:\Windows\System\dnvgrhZ.exe
  2⤵
  PID:14620
- C:\Windows\System\fWuEyGV.exe
  C:\Windows\System\fWuEyGV.exe
  2⤵
  PID:14688
- C:\Windows\System\VWUpIwp.exe
  C:\Windows\System\VWUpIwp.exe
  2⤵
  PID:14728
- C:\Windows\System\HrsgASg.exe
  C:\Windows\System\HrsgASg.exe
  2⤵
  PID:14780
- C:\Windows\System\qhxnsdR.exe
  C:\Windows\System\qhxnsdR.exe
  2⤵
  PID:14860
- C:\Windows\System\aWzHoue.exe
  C:\Windows\System\aWzHoue.exe
  2⤵
  PID:14940
- C:\Windows\System\MroJetc.exe
  C:\Windows\System\MroJetc.exe
  2⤵
  PID:14972
- C:\Windows\System\uUfWxwg.exe
  C:\Windows\System\uUfWxwg.exe
  2⤵
  PID:15092
- C:\Windows\System\QEIVZDd.exe
  C:\Windows\System\QEIVZDd.exe
  2⤵
  PID:15136
- C:\Windows\System\JRigYRA.exe
  C:\Windows\System\JRigYRA.exe
  2⤵
  PID:15180
- C:\Windows\System\wOydVEw.exe
  C:\Windows\System\wOydVEw.exe
  2⤵
  PID:15212
- C:\Windows\System\PAKoImV.exe
  C:\Windows\System\PAKoImV.exe
  2⤵
  PID:15300
- C:\Windows\System\lICXoZv.exe
  C:\Windows\System\lICXoZv.exe
  2⤵
  PID:14464
- C:\Windows\System\AiibYMN.exe
  C:\Windows\System\AiibYMN.exe
  2⤵
  PID:14596
- C:\Windows\System\StcsKnw.exe
  C:\Windows\System\StcsKnw.exe
  2⤵
  PID:14784
- C:\Windows\System\LzhjtCR.exe
  C:\Windows\System\LzhjtCR.exe
  2⤵
  PID:14952
- C:\Windows\System\hbCUNVT.exe
  C:\Windows\System\hbCUNVT.exe
  2⤵
  PID:14980
- C:\Windows\System\gmHVEpX.exe
  C:\Windows\System\gmHVEpX.exe
  2⤵
  PID:15164
- C:\Windows\System\vpQQUQd.exe
  C:\Windows\System\vpQQUQd.exe
  2⤵
  PID:15244
- C:\Windows\System\iLuANSp.exe
  C:\Windows\System\iLuANSp.exe
  2⤵
  PID:14372
- C:\Windows\System\yKxlSAG.exe
  C:\Windows\System\yKxlSAG.exe
  2⤵
  PID:14292
- C:\Windows\System\eDiYBAl.exe
  C:\Windows\System\eDiYBAl.exe
  2⤵
  PID:14556
- C:\Windows\System\HnpbmbF.exe
  C:\Windows\System\HnpbmbF.exe
  2⤵
  PID:15048
- C:\Windows\System\HQtEdWQ.exe
  C:\Windows\System\HQtEdWQ.exe
  2⤵
  PID:15376
- C:\Windows\System\kpnZaQT.exe
  C:\Windows\System\kpnZaQT.exe
  2⤵
  PID:15404
- C:\Windows\System\KDNXklG.exe
  C:\Windows\System\KDNXklG.exe
  2⤵
  PID:15444
- C:\Windows\System\MKjYCFF.exe
  C:\Windows\System\MKjYCFF.exe
  2⤵
  PID:15460
- C:\Windows\System\upIdXnX.exe
  C:\Windows\System\upIdXnX.exe
  2⤵
  PID:15488
- C:\Windows\System\ihTPdxL.exe
  C:\Windows\System\ihTPdxL.exe
  2⤵
  PID:15512
- C:\Windows\System\MKQoOVp.exe
  C:\Windows\System\MKQoOVp.exe
  2⤵
  PID:15544
- C:\Windows\System\FjtwlpB.exe
  C:\Windows\System\FjtwlpB.exe
  2⤵
  PID:15576
- C:\Windows\System\wTeiiZW.exe
  C:\Windows\System\wTeiiZW.exe
  2⤵
  PID:15612
- C:\Windows\System\mSEvywu.exe
  C:\Windows\System\mSEvywu.exe
  2⤵
  PID:15640
- C:\Windows\System\oJPzTys.exe
  C:\Windows\System\oJPzTys.exe
  2⤵
  PID:15656
- C:\Windows\System\zpbBkXU.exe
  C:\Windows\System\zpbBkXU.exe
  2⤵
  PID:15684
- C:\Windows\System\MLrxEOW.exe
  C:\Windows\System\MLrxEOW.exe
  2⤵
  PID:15724
- C:\Windows\System\tTiQnnU.exe
  C:\Windows\System\tTiQnnU.exe
  2⤵
  PID:15752
- C:\Windows\System\fVOdswB.exe
  C:\Windows\System\fVOdswB.exe
  2⤵
  PID:15780
- C:\Windows\System\aiWwohn.exe
  C:\Windows\System\aiWwohn.exe
  2⤵
  PID:15804
- C:\Windows\System\UDgVgvj.exe
  C:\Windows\System\UDgVgvj.exe
  2⤵
  PID:15824
- C:\Windows\System\UcQSYNM.exe
  C:\Windows\System\UcQSYNM.exe
  2⤵
  PID:15860
- C:\Windows\System\PskRlCK.exe
  C:\Windows\System\PskRlCK.exe
  2⤵
  PID:15880
- C:\Windows\System\rsaRpQR.exe
  C:\Windows\System\rsaRpQR.exe
  2⤵
  PID:15908
- C:\Windows\System\gccmetM.exe
  C:\Windows\System\gccmetM.exe
  2⤵
  PID:15948
- C:\Windows\System\jqiRpFA.exe
  C:\Windows\System\jqiRpFA.exe
  2⤵
  PID:15968
- C:\Windows\System\jiagnJw.exe
  C:\Windows\System\jiagnJw.exe
  2⤵
  PID:15992
- C:\Windows\System\UoyRFHr.exe
  C:\Windows\System\UoyRFHr.exe
  2⤵
  PID:16020
- C:\Windows\System\uhkLyOa.exe
  C:\Windows\System\uhkLyOa.exe
  2⤵
  PID:16048
- C:\Windows\System\qIxsjsk.exe
  C:\Windows\System\qIxsjsk.exe
  2⤵
  PID:16068
- C:\Windows\System\siLFzzI.exe
  C:\Windows\System\siLFzzI.exe
  2⤵
  PID:16104
- C:\Windows\System\xyQyTLc.exe
  C:\Windows\System\xyQyTLc.exe
  2⤵
  PID:16128
- C:\Windows\System\gTmcSsF.exe
  C:\Windows\System\gTmcSsF.exe
  2⤵
  PID:16160
- C:\Windows\System\FzgOgJc.exe
  C:\Windows\System\FzgOgJc.exe
  2⤵
  PID:16192
- C:\Windows\System\MuBYOkl.exe
  C:\Windows\System\MuBYOkl.exe
  2⤵
  PID:16212
- C:\Windows\System\ghIodVI.exe
  C:\Windows\System\ghIodVI.exe
  2⤵
  PID:16256
- C:\Windows\System\eOtrdPY.exe
  C:\Windows\System\eOtrdPY.exe
  2⤵
  PID:16284
- C:\Windows\System\ePUcyPE.exe
  C:\Windows\System\ePUcyPE.exe
  2⤵
  PID:16312
- C:\Windows\System\cmWmJsD.exe
  C:\Windows\System\cmWmJsD.exe
  2⤵
  PID:16340
- C:\Windows\System\huKekJq.exe
  C:\Windows\System\huKekJq.exe
  2⤵
  PID:16368
- C:\Windows\System\pxoVfEy.exe
  C:\Windows\System\pxoVfEy.exe
  2⤵
  PID:14920
- C:\Windows\System\chZoWWk.exe
  C:\Windows\System\chZoWWk.exe
  2⤵
  PID:15416
- C:\Windows\System\gwFOGYy.exe
  C:\Windows\System\gwFOGYy.exe
  2⤵
  PID:15504
- C:\Windows\System\JUttucm.exe
  C:\Windows\System\JUttucm.exe
  2⤵
  PID:15596
- C:\Windows\System\gibXSkD.exe
  C:\Windows\System\gibXSkD.exe
  2⤵
  PID:15652
- C:\Windows\System\fyfYrwL.exe
  C:\Windows\System\fyfYrwL.exe
  2⤵
  PID:15748
- C:\Windows\System\nOUFJEm.exe
  C:\Windows\System\nOUFJEm.exe
  2⤵
  PID:15800
- C:\Windows\System\xHYFeKs.exe
  C:\Windows\System\xHYFeKs.exe
  2⤵
  PID:15872
- C:\Windows\System\uFGeppq.exe
  C:\Windows\System\uFGeppq.exe
  2⤵
  PID:15944
- C:\Windows\System\FYklOGp.exe
  C:\Windows\System\FYklOGp.exe
  2⤵
  PID:16008
- C:\Windows\System\MxihnOQ.exe
  C:\Windows\System\MxihnOQ.exe
  2⤵
  PID:16076
- C:\Windows\System\McGGkYs.exe
  C:\Windows\System\McGGkYs.exe
  2⤵
  PID:16088
- C:\Windows\System\cHmuoUK.exe
  C:\Windows\System\cHmuoUK.exe
  2⤵
  PID:16172
- C:\Windows\System\ZRvHiSk.exe
  C:\Windows\System\ZRvHiSk.exe
  2⤵
  PID:16296
- C:\Windows\System\TZwOrez.exe
  C:\Windows\System\TZwOrez.exe
  2⤵
  PID:16332
- C:\Windows\System\ahnVbmW.exe
  C:\Windows\System\ahnVbmW.exe
  2⤵
  PID:16360
- C:\Windows\System\dmxHjjg.exe
  C:\Windows\System\dmxHjjg.exe
  2⤵
  PID:15560
- C:\Windows\System\bmmmjvV.exe
  C:\Windows\System\bmmmjvV.exe
  2⤵
  PID:15836
- C:\Windows\System\KAJABhE.exe
  C:\Windows\System\KAJABhE.exe
  2⤵
  PID:3248
- C:\Windows\System\CkDgCHJ.exe
  C:\Windows\System\CkDgCHJ.exe
  2⤵
  PID:4996
- C:\Windows\System\fklUyba.exe
  C:\Windows\System\fklUyba.exe
  2⤵
  PID:16032
- C:\Windows\System\dUdDwKs.exe
  C:\Windows\System\dUdDwKs.exe
  2⤵
  PID:16252
- C:\Windows\System\TdSVBRt.exe
  C:\Windows\System\TdSVBRt.exe
  2⤵
  PID:16376
- C:\Windows\System\CJVXfsF.exe
  C:\Windows\System\CJVXfsF.exe
  2⤵
  PID:15608
- C:\Windows\System\hbUVVPB.exe
  C:\Windows\System\hbUVVPB.exe
  2⤵
  PID:15976
- C:\Windows\System\QPcmwcF.exe
  C:\Windows\System\QPcmwcF.exe
  2⤵
  PID:4992
- C:\Windows\System\FYMMcfU.exe
  C:\Windows\System\FYMMcfU.exe
  2⤵
  PID:15556
- C:\Windows\System\MwViyrB.exe
  C:\Windows\System\MwViyrB.exe
  2⤵
  PID:15924
- C:\Windows\System\mLkCYDx.exe
  C:\Windows\System\mLkCYDx.exe
  2⤵
  PID:16416
- C:\Windows\System\CMavvDR.exe
  C:\Windows\System\CMavvDR.exe
  2⤵
  PID:16444
- C:\Windows\System\geSOqdO.exe
  C:\Windows\System\geSOqdO.exe
  2⤵
  PID:16472
- C:\Windows\System\sXUXOph.exe
  C:\Windows\System\sXUXOph.exe
  2⤵
  PID:16488
- C:\Windows\System\vEJBAho.exe
  C:\Windows\System\vEJBAho.exe
  2⤵
  PID:16532
- C:\Windows\System\HpNFtqR.exe
  C:\Windows\System\HpNFtqR.exe
  2⤵
  PID:16560
- C:\Windows\System\vavwQaH.exe
  C:\Windows\System\vavwQaH.exe
  2⤵
  PID:16588
- C:\Windows\System\HXxdrhm.exe
  C:\Windows\System\HXxdrhm.exe
  2⤵
  PID:16616
- C:\Windows\System\IrRjlqw.exe
  C:\Windows\System\IrRjlqw.exe
  2⤵
  PID:16644
- C:\Windows\System\gmYrqpe.exe
  C:\Windows\System\gmYrqpe.exe
  2⤵
  PID:16660
- C:\Windows\System\lEKhDnA.exe
  C:\Windows\System\lEKhDnA.exe
  2⤵
  PID:16696
- C:\Windows\System\gFPtnEJ.exe
  C:\Windows\System\gFPtnEJ.exe
  2⤵
  PID:16716
- C:\Windows\System\eaaDJYB.exe
  C:\Windows\System\eaaDJYB.exe
  2⤵
  PID:16744
- C:\Windows\System\bGsRomL.exe
  C:\Windows\System\bGsRomL.exe
  2⤵
  PID:16768
- C:\Windows\System\xlkXYeM.exe
  C:\Windows\System\xlkXYeM.exe
  2⤵
  PID:16804
- C:\Windows\System\UCijZxC.exe
  C:\Windows\System\UCijZxC.exe
  2⤵
  PID:16840
- C:\Windows\System\WYhOEjY.exe
  C:\Windows\System\WYhOEjY.exe
  2⤵
  PID:16868
- C:\Windows\System\GDZHLhm.exe
  C:\Windows\System\GDZHLhm.exe
  2⤵
  PID:16884
- C:\Windows\System\TNBvUEh.exe
  C:\Windows\System\TNBvUEh.exe
  2⤵
  PID:16912
- C:\Windows\System\wtlgbvT.exe
  C:\Windows\System\wtlgbvT.exe
  2⤵
  PID:16940
- C:\Windows\System\yxMerXL.exe
  C:\Windows\System\yxMerXL.exe
  2⤵
  PID:16956
- C:\Windows\System\tqLqpnk.exe
  C:\Windows\System\tqLqpnk.exe
  2⤵
  PID:16972
- C:\Windows\System\RHbvTDe.exe
  C:\Windows\System\RHbvTDe.exe
  2⤵
  PID:17036
- C:\Windows\System\rhFcWFZ.exe
  C:\Windows\System\rhFcWFZ.exe
  2⤵
  PID:17064
- C:\Windows\System\hzHXRoE.exe
  C:\Windows\System\hzHXRoE.exe
  2⤵
  PID:17092
- C:\Windows\System\BmUTSQG.exe
  C:\Windows\System\BmUTSQG.exe
  2⤵
  PID:17120
- C:\Windows\System\UnAGhXP.exe
  C:\Windows\System\UnAGhXP.exe
  2⤵
  PID:17148
- C:\Windows\System\OoKGQfV.exe
  C:\Windows\System\OoKGQfV.exe
  2⤵
  PID:17168
- C:\Windows\System\HXgpKoy.exe
  C:\Windows\System\HXgpKoy.exe
  2⤵
  PID:17196
- C:\Windows\System\esKGytq.exe
  C:\Windows\System\esKGytq.exe
  2⤵
  PID:17228
- C:\Windows\System\zQXwFZC.exe
  C:\Windows\System\zQXwFZC.exe
  2⤵
  PID:17248
- C:\Windows\System\yqasthX.exe
  C:\Windows\System\yqasthX.exe
  2⤵
  PID:17276
- C:\Windows\System\WvdJuXr.exe
  C:\Windows\System\WvdJuXr.exe
  2⤵
  PID:17304
- C:\Windows\System\elhEWOx.exe
  C:\Windows\System\elhEWOx.exe
  2⤵
  PID:17344
- C:\Windows\System\RWqQWNn.exe
  C:\Windows\System\RWqQWNn.exe
  2⤵
  PID:17360
- C:\Windows\System\gYesfyD.exe
  C:\Windows\System\gYesfyD.exe
  2⤵
  PID:17400
- C:\Windows\System\nCCPvGV.exe
  C:\Windows\System\nCCPvGV.exe
  2⤵
  PID:16400
- C:\Windows\System\xrXnIWc.exe
  C:\Windows\System\xrXnIWc.exe
  2⤵
  PID:16460
- C:\Windows\System\AUOsqwP.exe
  C:\Windows\System\AUOsqwP.exe
  2⤵
  PID:16528
- C:\Windows\System\nUERtOs.exe
  C:\Windows\System\nUERtOs.exe
  2⤵
  PID:16584
- C:\Windows\System\PGsXlma.exe
  C:\Windows\System\PGsXlma.exe
  2⤵
  PID:16636
- C:\Windows\System\dTycQkY.exe
  C:\Windows\System\dTycQkY.exe
  2⤵
  PID:16708
- C:\Windows\System\NAQXaEE.exe
  C:\Windows\System\NAQXaEE.exe
  2⤵
  PID:16788
- C:\Windows\System\bZZiXyQ.exe
  C:\Windows\System\bZZiXyQ.exe
  2⤵
  PID:16856
- C:\Windows\System\QphoXRz.exe
  C:\Windows\System\QphoXRz.exe
  2⤵
  PID:16924
- C:\Windows\System\KYwBfGk.exe
  C:\Windows\System\KYwBfGk.exe
  2⤵
  PID:16968
- C:\Windows\System\peFGTEA.exe
  C:\Windows\System\peFGTEA.exe
  2⤵
  PID:17028
- C:\Windows\System\wXAawHR.exe
  C:\Windows\System\wXAawHR.exe
  2⤵
  PID:17080
- C:\Windows\System\bjzwmfa.exe
  C:\Windows\System\bjzwmfa.exe
  2⤵
  PID:17164
- C:\Windows\System\hgqNwRG.exe
  C:\Windows\System\hgqNwRG.exe
  2⤵
  PID:17260
- C:\Windows\System\qiEPOom.exe
  C:\Windows\System\qiEPOom.exe
  2⤵
  PID:17300
- C:\Windows\System\JSibxzA.exe
  C:\Windows\System\JSibxzA.exe
  2⤵
  PID:17340
- C:\Windows\System\FKvBjRe.exe
  C:\Windows\System\FKvBjRe.exe
  2⤵
  PID:17396

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BPauSDI.exe

Filesize
1.8MB

MD5
ef2886fc9ccd2c36105f0eb5a022bfbf

SHA1
bc3059dd24dc4106c57aa7b682e3e91f74c3f177

SHA256
d9bf4860eec814b63784ab83e0241e3b0fe4de70b10e5acccb83fd8a79a3ee0e

SHA512
f365b03f1ffd6facd659bd17ca0b294e741a417006cd816dc4aa041f34f2792fb20fba7ecdfce04352d01b24945f947cc816d7cead1d681659c7e3cec77f20a2

Download Submit
C:\Windows\System\CRLtplP.exe

Filesize
1.8MB

MD5
389eb14e7282d2c0aa2a51cfda6608ce

SHA1
bf3fb3d4307757ed04374fa3e5491842b8eb3336

SHA256
4ec978732840a1da0dc8b211599c718545e7741efc7652dd9030fc76b9e889bd

SHA512
9cfcf83e3f274c663844243198b34d268703d4b84a78884b92be13ab4a1ed76fae1ef5033c513ec63b903199e6728c9da45add150553e87a27e538012ed7c31a

Download Submit
C:\Windows\System\FMhbcum.exe

Filesize
1.8MB

MD5
581289e7b113b6502a01ae0c45005c8b

SHA1
fd4aa6ed3a64bd7ab39bdd32e35826516dddc23f

SHA256
2b44cb044db389848087d8c9f1f3e74bd46aa9740669477ef7ac08945fda8205

SHA512
892c2250e62516f57e8866d52208fcdc9708f2b00eed82ce0dbfc9e39c9b57764d5862bf2f6a42707f3a3be325734e8ffac70d07be79f8f660593ad946d4d7b0

Download Submit
C:\Windows\System\FjJqhUb.exe

Filesize
1.8MB

MD5
d0e6f8c8a1b9d3a0d604679b09208200

SHA1
656b9a32fe832271a91c03dd46ddeadf1693bde3

SHA256
09f04609dd641963544a939f1a1ea8bf454dfa01b8497563ff45940bb596d499

SHA512
b5a3beddfd22030fbe4c71d3e616fc4c1bb0fd65a339da9da1d5761c2718bc3362894c65bdc49671d5dc42a9e56b365b5b07465a92affa6aba1fc555cad02b35

Download Submit
C:\Windows\System\GrceTdF.exe

Filesize
1.8MB

MD5
a006620ea9a91685eef1b6fa00129927

SHA1
2de41ec824fc10fc66e828c21ff5be82bd286340

SHA256
f6487125cf23ce3d8672cb2ae365e99592347b5dc8bd8fbac4de93cf10e074b0

SHA512
087a7acb5231b14d84b7cd43874cd36c8073d18856cafe9e6d60cc9306a287f45a2eeaa930035b782349f417937783904848f5b0a55bbffe05ece6b626e84b70

Download Submit
C:\Windows\System\IBTAeFc.exe

Filesize
1.8MB

MD5
e13b925a0d43cc100640604c63a5827e

SHA1
e5f12e59e187a7194c9eaf599459eeadc992481e

SHA256
509a79ac803dd832c3fcc7fcb3fcc04245427805847960b612176fda389ce72d

SHA512
140d4e7c64972acc15898570a790e98beb22c3394b0da8de3fe5b6de474ca22f91b01892086b9472b24f0ca82c8b387c6ae1bdffef217b50098b50529d8853b4

Download Submit
C:\Windows\System\InfhuOW.exe

Filesize
1.8MB

MD5
943a8aaa34d7c783656c27dd8a175b49

SHA1
5b40fa3f956d023a8cc0e83ba36d98ddb23950a5

SHA256
fb616552bb84e590ff5ae4fd490fc42ebb15452bc6ef32ade0d4133dc7347923

SHA512
1283b0225ceba1052447076607c03369373d45f85c0b34fa7fae275216897fcfd55fbe324c650af8639aeb3b933e1d9e8a81a13e0ea3e7e754aa5745fdf6278a

Download Submit
C:\Windows\System\KSUvRZz.exe

Filesize
1.8MB

MD5
c7117dd6e7e393c65f027fd853972a7d

SHA1
61aa9388892ad9949965fad7489debb5feff1052

SHA256
04b124f102ca9a79d854f80baf5ff992740b610bc658b8f27c97dce8906af619

SHA512
da68a66385feabe7a22f53744807529ead69ad62f533d90f7bdc068e23e4d3938ef29d16d69f91ec32bcab97767aac7b7cdb48f251d13e8a1648c0b789dcd97a

Download Submit
C:\Windows\System\LxrjcqB.exe

Filesize
1.8MB

MD5
25d187c279eb368af5998d2efc38f1fe

SHA1
3e203b5f8d93a25656592a94fdc1f555f6894bc1

SHA256
0ac56478cae0e53c21a1ddb21fae1f4106a6e8aa4026ee304d4786211f0cfbda

SHA512
2de97bc7e2a0b6ecafd754502b74b8aadccb0129cfac7286909d6d010ed523f0e611614b205de4d4018039d9c1a162274e8a93702f402852f6550544d76f5aed

Download Submit
C:\Windows\System\MrLHHVL.exe

Filesize
1.8MB

MD5
7934c44e4431cdee913ba5ef006d1247

SHA1
83bcee9e074ed54aaeb166ea8fbc84b52824f475

SHA256
34a7bc3481d2473a9ae4b495eb656601244144662c1ca1d8f611693c582096ad

SHA512
6f111dd13df38dcb90030e25cee6549a3c530e19d9834829c013bb921eb0ddaab4937fbfa3636ac36e0fc294c0300f870e475188f728ca5720adb5da702a33b8

Download Submit
C:\Windows\System\ONNlxlG.exe

Filesize
1.8MB

MD5
e0ebdb6bc5cd6430d1134b42745d7b12

SHA1
ff5ee3108adeae4b4f2c912c1680fcb56fb26a1c

SHA256
6a2a426ee7419fbbc5f07ac9e908ef2b6fd16e66aa4e495738e1be1ff4df2753

SHA512
4355dbfda3da4f86ddcc96f2fe4792069569d308ea616648c18f6e692f8042a5ed6ecea5d92cd2911a347811a02a647e98082225965cb458d2445ccad4995522

Download Submit
C:\Windows\System\PKsXnMH.exe

Filesize
1.8MB

MD5
c727c7c11445a037eccc526f62271f53

SHA1
9d5e7797e29b45b0244076a2d3aabb68a1e72bf3

SHA256
b5036e80d03fbb865547964ee51696d8d251515019967925523fe318e86397e1

SHA512
729efe52184b29d5b6a4579b62657446bb0ac755afa87a14c26781f568098c6fe446c980feab3059e566e1272e1d1ca07d881cfd6e9ce077773c29213a3bd9c9

Download Submit
C:\Windows\System\SFELAKq.exe

Filesize
1.8MB

MD5
cd11aa0c16305de6fb53208520f9d5a2

SHA1
be195110dda9c1373c34b70dd9f07af345dfffdf

SHA256
5b165d047faec16950cfcffc1079ec6fff15e1d22751693108c79b4942760712

SHA512
c4d383ddc4d79acdca6e963f2394baf240bc8c4e7e72095f96925adb842ec03ff5ead39272be92df7868bed4f93088741899a27b8d4d98b413e762834a6a1bb1

Download Submit
C:\Windows\System\SxxzJIV.exe

Filesize
1.8MB

MD5
c495b7683ecb45fd1d740193c738d5fa

SHA1
19c467e905c1ef6aaf58624f5db03151a128c269

SHA256
d358dfe5ac6d01ede16a305931990042c82933740ef4a11ea308e3606a966fa2

SHA512
913e2b80fae454097f8b385327928ce72f4da7d5f96c760f267e7c024fdea0c4ef877f758f04627804c25d334d6f2740156ee9ade8554dd35596546f58f6aa8b

Download Submit
C:\Windows\System\UOOiJto.exe

Filesize
1.8MB

MD5
ff4ab968e604ddeeb1e6ab9adcb2febf

SHA1
99f10c15408c6f9308b66c4f55a724f8af966aa9

SHA256
5175fcff1e6037035574894b6f169ae5f1cbdf9f63963e06ba2c8f632b65b23e

SHA512
6a41c66d3f952fa9e2d3ba15a79b87749fcc67d5268855e6e7ddcd99dd0135bbb1807bc6ac983340524060f44c305df3cdd942e71166c5eb01fe3f5262ac7509

Download Submit
C:\Windows\System\VtxUjei.exe

Filesize
1.8MB

MD5
e4a439502f37c05341223ced3a070376

SHA1
236021dbc4b099d2557614781b5e445e2fff20d6

SHA256
82b622550ef34902f84e82fd8d6b72b67ee448aa36a0559721f3c8e308b23cf8

SHA512
3a5c719c809c42ca8e9acb3b7a08fc8b550805e0f70ca45fdf389d4c82a1183f5a4bdbe3f1b81abecff579b498d187654ca9601793e10bf8e85e521863fb4207

Download Submit
C:\Windows\System\WbjpUoJ.exe

Filesize
1.8MB

MD5
ec829ca7ca3b1b4312ffec499a800a97

SHA1
b5a1d7ed46568976220d3887532f541fe142d3c2

SHA256
fa84af6fbc03a298f3afa1f1c70e20784c5d438d56567ed95f1e92bcfd71c6d1

SHA512
72b565c7be883b6c758a8b095995c2b223a29aa7df273b16e2e62f9e0bf4dfa299c7c45613d634d2c6a5552c69677ef0fbf3f3adfcf3b70ca3280367afb4123b

Download Submit
C:\Windows\System\WrltdGN.exe

Filesize
1.8MB

MD5
197f7c69928cbf0729bebbf99fe3b0dd

SHA1
616fdbfd7df708119d9c3d5b1483c00916b765eb

SHA256
5919043863e78721ca4a1592b6df55467036c908b3ea53f4adce64e4776c9b81

SHA512
3d7a474924ba8b3ac0849a5292454f2732262f4a10a4496e2f8cc5eda0fad055f1de6074ccd73d63f11b1ab1b8f764f4e76e8105f6162e8419fa8b0c9d4f7a3d

Download Submit
C:\Windows\System\YEIOdDI.exe

Filesize
1.8MB

MD5
168bbe97468b9b22ecdaf697ce786cdd

SHA1
f869ef2a438e87f72640a6a10df6dca3867953f7

SHA256
6424c7111b59e221f90c19a1990698d2667dd7c8b9d57d39b74ac9b89303a196

SHA512
c1fee2480ca01300cb46fb74b2d8739c680e923d995c8f5741e80b45b6243a76a266c81dfe82eb0b952ca0b3e837336a76a7767b1419fac6fbdbd381d73a832a

Download Submit
C:\Windows\System\YJMgOOG.exe

Filesize
1.8MB

MD5
114f7e0461009341fc5f9ff2c95c7975

SHA1
5acd238eb5f36e39062213049b9f0294430c94e1

SHA256
2e36ea53d6aa776de59e6db719fc3f0fb5b3b0fe2f8fbd4c8aeb9c22c5ecdeeb

SHA512
5ca206f73beccdb98848b6f8ef84d23eb627939d96a041d196b1d5b9090d3b2acc4c46b41c7d1bcfb5e2fe2f7f99ea1006c64ad3e60852af60b9527ddbc9aff3

Download Submit
C:\Windows\System\ZWqEauY.exe

Filesize
1.8MB

MD5
75e75480c24296be00ff4f5673fc55e7

SHA1
a1467964ed730b231dd73c77428cf8d3514a77c9

SHA256
7c1fc6df30b9a0aba35d790d3c56aff3605ce184e4dc2099bf01cb1d6ff5b855

SHA512
85fe8cca2e31a0bf15f9ddd50cbce3f0bb146bedbbe025a9a8522857a3ed72811257135e3262e6400464d986f8a0fdeecb12123d5fb2395ad3da4abcdf1e7cac

Download Submit
C:\Windows\System\abpibSW.exe

Filesize
1.8MB

MD5
0acd79e7e68e786fd57ac323163ed0e6

SHA1
1148015c5768801575d14a1c3c96492b86a6d0a1

SHA256
458b1a7f93c6eb86dc208c531a20a2fa05af3820d26a513677c6b8fa4031414a

SHA512
eb328b6341bfae065532a9bc929c371a7332a73841a57a3ddfa0f8515f5c622dd6f27dda4aa3df688502e2d58f1df96044962b5e0cef331064b215688e11f605

Download Submit
C:\Windows\System\bUfeXaV.exe

Filesize
1.8MB

MD5
4e8b37f829e74a19356203d486d48ad1

SHA1
8872020cc6e7b1e24aae327fa6670d6f70ff7c30

SHA256
97fdbef4757b23454cff5b30b3451dc38bc9c7196b066978839d0ada1825b16e

SHA512
174018082da66d27c7e7dc672c94d93bea0076915a11ec19fe7cceb82cf11f3236b229dfbe7788b064f0961c4749cdd2d603de690947ad4429f219a5cc1b4dee

Download Submit
C:\Windows\System\cJMFSqB.exe

Filesize
1.8MB

MD5
6604615c7ffc28105b51f264aed3a7fa

SHA1
e0bc8506f0735ae2c7eb8b48a1d37382643e2d6c

SHA256
aa85cdf229680fae41e2d9b4011dc2158a2c3bc3f0ea292555cf2146b24ae721

SHA512
d429aa7afb94b9c02faa9f809e30e6f7dd04b20e9f3ad6714ccafe2969df2bba4883ca2f448cd33e7831e7410607e32d6dd9da364c45d5647642f53952d6d567

Download Submit
C:\Windows\System\gqyrIdR.exe

Filesize
1.8MB

MD5
d34411d52f374c6363fedabbccfe5cb9

SHA1
27d134b01c244823402b06714a24f7728fc7f78a

SHA256
dfecee8ea937b4595ead55a7e620cfe25a17c5b08ac43db5d34233b65a878241

SHA512
c8ffe629f7ed894547e978ebdf818dabb01d2f1100dd7180613b479ce970c2a84898a39d7dde3d6303dfca96e3f381e53194d80f0c0806eb3e281e04a72a0454

Download Submit
C:\Windows\System\kXWbviP.exe

Filesize
1.8MB

MD5
c8c0878f501b3c267e5da1a1adc0b148

SHA1
0fabff266d4d54b621692f66c6f0eb3315c47b58

SHA256
37530cbe95f3c2df67f06bc82afe5eac9b57183f6971745b897169203547aba2

SHA512
0ab747ab7722f8cb273c3ce524147e4f996e083bbf870138849bfd59100fb27aa6f7a4148c10d8c6b0931b9d3bf4ef6d64d4e34c158f772b63fde84153f7131f

Download Submit
C:\Windows\System\lIyPypu.exe

Filesize
1.8MB

MD5
5b23ac81074923e79635ccb25705cee4

SHA1
719894171bf7c77682f84fa35922ed12ceebe610

SHA256
70c6355c2f29c51e37c881cf5c5787ab1d5f76170bf046b09413ca65e3b700f8

SHA512
15b883e2e3e4b003f15ab49895b962f61e9403838b4b312d174cfce370106ebaa88e8c53c332187764e97eb4396d51b2919e5e02f81b4df8587aac8fbbe80f82

Download Submit
C:\Windows\System\qFzfQsL.exe

Filesize
1.8MB

MD5
382ed86e2d907f7cbad9b89258834e13

SHA1
c0b7d2fb013eab3812b7552b9f46c6990c1308be

SHA256
fb0d56a6a5b02d26c6cf6cb0e1ce6819afcd731859d82247bde57fc45d81aa77

SHA512
aa209f9d188e7735a89a2d57d56dce3cefe5b661a017748a49d4f3bd2922bb26938a0b3290adc368ab25968f517dff333aba33b2a577dd9e00700b35ee40ea2b

Download Submit
C:\Windows\System\tRhIoVO.exe

Filesize
1.8MB

MD5
7c6497cea88f82cf941194692ef40a63

SHA1
95de600220c5ee71a69b874298c775bf84fab12b

SHA256
b0a9cc44991a862f1b536289e9c7817362a71ed73943a9bf2a377c26295cdd0b

SHA512
cdc7ceaa52182277343115f9f509a39d48462ccda003500c3f01d7f349b40178074a3439ff4c48c9713de5798c4ae9e722689ca40627162f1314dcc926d78b3d

Download Submit
C:\Windows\System\uDieRAw.exe

Filesize
1.8MB

MD5
dce04ed83eeb2b1046e43bc683a0ec6c

SHA1
f8c6eba5681bb1030d67b3d72a4ebf1274e4069f

SHA256
0c0a61e44755b8510f86c46e79faba79d1ac8aa73a4a18fb76c468529c4197e6

SHA512
e879122651de3581d3af284557628bab900523477f1c92ea5ac72f9ee09326a5044e895331f89756ce9c3c82cd1e0bcb20de050369e5ed4e6606590be26d226b

Download Submit
C:\Windows\System\vsLHNjM.exe

Filesize
1.8MB

MD5
49a0a7769c5ad6b65e063ba0090fc755

SHA1
60873923dcd2d4390fb1708f141f05434e9bc475

SHA256
2c0387dd9e62bf791754aebec762f748badfa4527a8cb6389b04f230231d7aaa

SHA512
4d8498e2d00f9e0d2bc8e81f3f2728da044f7497a6fedd9329b867dd84d0ff8d9099550ed70468124a1e5180b203fbc7e5c291ce10f81e15c77c497aa2a84e1a

Download Submit
C:\Windows\System\wXCbAaM.exe

Filesize
1.8MB

MD5
7ec1c1a111f9344a4a7ac36baba05861

SHA1
b5d3533c4e1de2d61f7f5ea86532e18e7898fd35

SHA256
2a6174717863322c4f0952754ab34b919d979fb4a9ff212c9647c638153ebd96

SHA512
646ddfb58109161d42334b2d320c44d23951386b70296449beefb5842ea5dd67586271d671f0866f6801870d753dc16cacb3d77d73920d9d40a942715e769c42

Download Submit
C:\Windows\System\yfMiXVt.exe

Filesize
1.8MB

MD5
a761e5ec4eeace6c334b4a9d6c3e4ec7

SHA1
7f60f97729b834799418c381e96bdbb5a45fa333

SHA256
1e113219ed71b2d7f95755f0b023b25ea664dc8ffdc16189ad5ff2e3a63da7fe

SHA512
2b271babff022b36c7645fc01c1cd4da71e41e998213b4239f2ad985abb503a9c31b576eaf8b967cada17ec333fd86734e6a315957c78797a09a47cbe139c14e

Download Submit
memory/2336-0-0x000001515B310000-0x000001515B320000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads