xmrig | aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 08:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
Size

1.1MB
MD5

53d9e69f0220f1940da3182c87c281c3
SHA1

5dee5626efa92a10bffb0a78b3a1ec294a4d1800
SHA256

aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8
SHA512

9b261a45a85068db3a63d3dffb4a3c8865129785942d8ceea1b19bbbee70c3ff4ebb4573f11115a6150a6ab8def7cc6b838da8a4d361f47a47a45233fc84a2da
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMr2KiliyeeQ:GezaTF8FcNkNdfE0pZ9ozttwIRQC9e

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b1e-3.dat	xmrig
behavioral2/files/0x000a000000023b75-7.dat	xmrig
behavioral2/files/0x000b000000023b71-10.dat	xmrig
behavioral2/files/0x0031000000023b76-19.dat	xmrig
behavioral2/files/0x0031000000023b78-23.dat	xmrig
behavioral2/files/0x000a000000023b79-29.dat	xmrig
behavioral2/files/0x000b000000023b72-32.dat	xmrig
behavioral2/files/0x000a000000023b7a-39.dat	xmrig
behavioral2/files/0x000a000000023b7b-42.dat	xmrig
behavioral2/files/0x000a000000023b7d-54.dat	xmrig
behavioral2/files/0x000a000000023b7c-50.dat	xmrig
behavioral2/files/0x000a000000023b7f-62.dat	xmrig
behavioral2/files/0x000a000000023b80-70.dat	xmrig
behavioral2/files/0x000a000000023b82-74.dat	xmrig
behavioral2/files/0x000a000000023b8d-127.dat	xmrig
behavioral2/files/0x000a000000023b90-150.dat	xmrig
behavioral2/files/0x000a000000023b94-162.dat	xmrig
behavioral2/files/0x000a000000023b92-160.dat	xmrig
behavioral2/files/0x000a000000023b93-157.dat	xmrig
behavioral2/files/0x000a000000023b91-155.dat	xmrig
behavioral2/files/0x000a000000023b8f-145.dat	xmrig
behavioral2/files/0x000a000000023b8e-140.dat	xmrig
behavioral2/files/0x000a000000023b8c-130.dat	xmrig
behavioral2/files/0x000a000000023b8b-125.dat	xmrig
behavioral2/files/0x000a000000023b8a-120.dat	xmrig
behavioral2/files/0x000a000000023b89-115.dat	xmrig
behavioral2/files/0x000a000000023b88-107.dat	xmrig
behavioral2/files/0x000a000000023b87-103.dat	xmrig
behavioral2/files/0x000a000000023b86-97.dat	xmrig
behavioral2/files/0x000a000000023b85-93.dat	xmrig
behavioral2/files/0x000a000000023b84-87.dat	xmrig
behavioral2/files/0x000a000000023b83-83.dat	xmrig
behavioral2/files/0x000a000000023b7e-63.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2944	dWtGHlD.exe
4984	SZtQCXb.exe
1852	xUQzSAf.exe
936	ipKzwKz.exe
3312	LQCwSJo.exe
2692	XuSnKOM.exe
4880	qoHSXNi.exe
4336	zfYrPxd.exe
964	fZIcJEN.exe
1116	bgcRPUm.exe
532	QjVXXfi.exe
2960	BiizDrm.exe
1584	drWDEue.exe
2792	XBwhgdS.exe
3284	OTcNZaU.exe
1520	askIBbX.exe
4864	JyJsoOr.exe
5084	CHvniFx.exe
408	MXeiwgB.exe
4360	CIZoLiE.exe
3984	KHZgdoB.exe
3560	cVYfPoG.exe
1632	aItNyTa.exe
752	fEbqpbL.exe
2308	xxhwPEh.exe
3804	NBaRQzX.exe
1716	FJAcNsN.exe
4784	RFaaoSz.exe
4268	VtyFzEd.exe
3140	DLJEeIZ.exe
3472	nrJkgjh.exe
4296	UGwurJX.exe
4048	xumfWPO.exe
4524	nccOZdi.exe
1000	ggCZaWI.exe
2904	eIAUnAC.exe
2276	xlPnXWS.exe
2968	KrfTpJi.exe
4816	lcYlfrd.exe
2172	upiIlOF.exe
4260	UybDUgj.exe
4300	aBWGkue.exe
4004	MYkFfVI.exe
4224	ymcsqas.exe
208	sfMgEuc.exe
5100	gCDFTTK.exe
4828	BCCdQsn.exe
2268	OdznQVW.exe
4868	yWguONV.exe
3836	zvkbecW.exe
2256	BssbPAc.exe
2840	dxXarKR.exe
2204	eqyDjnI.exe
3912	znIsbky.exe
3896	MqNyiJn.exe
2288	OjXVkhl.exe
3920	zDSwZdM.exe
1060	CDcklLf.exe
2216	zwzGpnn.exe
3180	HLBwVHV.exe
1560	YFeoUig.exe
4204	vfgiSqQ.exe
4288	BuajbGm.exe
2680	iQMpmlO.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IgtijLa.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\khVEzLM.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\KaWhyqA.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\fPmobGn.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\kvmBGhS.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\eIAUnAC.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\cMziXDc.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\CcFJShR.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\ATzgqtD.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\WDRYNTA.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\ErycYZP.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\SrWZwPl.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\gppmDGS.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\RtwGrRU.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\HfgtPDL.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\bVycsSk.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\ZkrjqSx.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\pubUAyU.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\VtyFzEd.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\wITfOZH.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\VcQsrQz.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\QcjibKl.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\OeZxbAu.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\RIyLGbz.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\EAFjNHy.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\hQlWCrf.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\JyGbPIQ.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\dgHxWzZ.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\zBhMksH.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\EeeNnLj.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\wafvOpL.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\qjGkYxs.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\nmpVPfB.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\ACgzfUr.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\AWkTgXV.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\sOoanMx.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\qSHAaQS.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\OtTPfkt.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\hplHHbH.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\aBWGkue.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\zAqhFed.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\adfnqpp.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\PNvZZDO.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\Zgdrgtz.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\HNLiFKM.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\eoEPexC.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\rtDHpnH.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\UwUvOuT.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\VrzAbUp.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\XeOunAP.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\AfNZnvn.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\vhhKuOu.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\gquFORY.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\tZcssvY.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\CHvniFx.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\EwzjjIN.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\tfmAGoe.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\cVYfPoG.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\nrJkgjh.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\OwWhtML.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\TippPav.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\pkaaRZh.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\ZmkGpcJ.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
File created	C:\Windows\System\LYgviBG.exe	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 2944	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	84
PID 3404 wrote to memory of 2944	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	84
PID 3404 wrote to memory of 4984	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	85
PID 3404 wrote to memory of 4984	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	85
PID 3404 wrote to memory of 1852	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	86
PID 3404 wrote to memory of 1852	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	86
PID 3404 wrote to memory of 936	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	87
PID 3404 wrote to memory of 936	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	87
PID 3404 wrote to memory of 3312	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	88
PID 3404 wrote to memory of 3312	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	88
PID 3404 wrote to memory of 2692	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	91
PID 3404 wrote to memory of 2692	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	91
PID 3404 wrote to memory of 4880	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	93
PID 3404 wrote to memory of 4880	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	93
PID 3404 wrote to memory of 4336	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	94
PID 3404 wrote to memory of 4336	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	94
PID 3404 wrote to memory of 964	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	95
PID 3404 wrote to memory of 964	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	95
PID 3404 wrote to memory of 1116	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	96
PID 3404 wrote to memory of 1116	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	96
PID 3404 wrote to memory of 532	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	97
PID 3404 wrote to memory of 532	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	97
PID 3404 wrote to memory of 2960	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	98
PID 3404 wrote to memory of 2960	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	98
PID 3404 wrote to memory of 1584	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	99
PID 3404 wrote to memory of 1584	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	99
PID 3404 wrote to memory of 2792	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	100
PID 3404 wrote to memory of 2792	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	100
PID 3404 wrote to memory of 3284	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	101
PID 3404 wrote to memory of 3284	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	101
PID 3404 wrote to memory of 1520	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	102
PID 3404 wrote to memory of 1520	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	102
PID 3404 wrote to memory of 4864	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	103
PID 3404 wrote to memory of 4864	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	103
PID 3404 wrote to memory of 5084	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	104
PID 3404 wrote to memory of 5084	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	104
PID 3404 wrote to memory of 408	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	105
PID 3404 wrote to memory of 408	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	105
PID 3404 wrote to memory of 4360	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	106
PID 3404 wrote to memory of 4360	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	106
PID 3404 wrote to memory of 3984	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	107
PID 3404 wrote to memory of 3984	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	107
PID 3404 wrote to memory of 3560	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	108
PID 3404 wrote to memory of 3560	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	108
PID 3404 wrote to memory of 1632	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	109
PID 3404 wrote to memory of 1632	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	109
PID 3404 wrote to memory of 752	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	110
PID 3404 wrote to memory of 752	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	110
PID 3404 wrote to memory of 2308	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	111
PID 3404 wrote to memory of 2308	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	111
PID 3404 wrote to memory of 3804	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	112
PID 3404 wrote to memory of 3804	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	112
PID 3404 wrote to memory of 1716	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	113
PID 3404 wrote to memory of 1716	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	113
PID 3404 wrote to memory of 4784	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	114
PID 3404 wrote to memory of 4784	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	114
PID 3404 wrote to memory of 4268	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	115
PID 3404 wrote to memory of 4268	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	115
PID 3404 wrote to memory of 3140	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	116
PID 3404 wrote to memory of 3140	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	116
PID 3404 wrote to memory of 3472	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	117
PID 3404 wrote to memory of 3472	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	117
PID 3404 wrote to memory of 4296	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	118
PID 3404 wrote to memory of 4296	3404	aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe	118

C:\Users\Admin\AppData\Local\Temp\aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe
"C:\Users\Admin\AppData\Local\Temp\aca8ef6652934e034ec2f333732137c126b175e01530b66e79e4621bba28f2b8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\System\dWtGHlD.exe
  C:\Windows\System\dWtGHlD.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\SZtQCXb.exe
  C:\Windows\System\SZtQCXb.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\xUQzSAf.exe
  C:\Windows\System\xUQzSAf.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ipKzwKz.exe
  C:\Windows\System\ipKzwKz.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\LQCwSJo.exe
  C:\Windows\System\LQCwSJo.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\XuSnKOM.exe
  C:\Windows\System\XuSnKOM.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\qoHSXNi.exe
  C:\Windows\System\qoHSXNi.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\zfYrPxd.exe
  C:\Windows\System\zfYrPxd.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\fZIcJEN.exe
  C:\Windows\System\fZIcJEN.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\bgcRPUm.exe
  C:\Windows\System\bgcRPUm.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\QjVXXfi.exe
  C:\Windows\System\QjVXXfi.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\BiizDrm.exe
  C:\Windows\System\BiizDrm.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\drWDEue.exe
  C:\Windows\System\drWDEue.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\XBwhgdS.exe
  C:\Windows\System\XBwhgdS.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\OTcNZaU.exe
  C:\Windows\System\OTcNZaU.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\askIBbX.exe
  C:\Windows\System\askIBbX.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\JyJsoOr.exe
  C:\Windows\System\JyJsoOr.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\CHvniFx.exe
  C:\Windows\System\CHvniFx.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\MXeiwgB.exe
  C:\Windows\System\MXeiwgB.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\CIZoLiE.exe
  C:\Windows\System\CIZoLiE.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\KHZgdoB.exe
  C:\Windows\System\KHZgdoB.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\cVYfPoG.exe
  C:\Windows\System\cVYfPoG.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\aItNyTa.exe
  C:\Windows\System\aItNyTa.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\fEbqpbL.exe
  C:\Windows\System\fEbqpbL.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\xxhwPEh.exe
  C:\Windows\System\xxhwPEh.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\NBaRQzX.exe
  C:\Windows\System\NBaRQzX.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\FJAcNsN.exe
  C:\Windows\System\FJAcNsN.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\RFaaoSz.exe
  C:\Windows\System\RFaaoSz.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\VtyFzEd.exe
  C:\Windows\System\VtyFzEd.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\DLJEeIZ.exe
  C:\Windows\System\DLJEeIZ.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\nrJkgjh.exe
  C:\Windows\System\nrJkgjh.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\UGwurJX.exe
  C:\Windows\System\UGwurJX.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\xumfWPO.exe
  C:\Windows\System\xumfWPO.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\nccOZdi.exe
  C:\Windows\System\nccOZdi.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\ggCZaWI.exe
  C:\Windows\System\ggCZaWI.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\eIAUnAC.exe
  C:\Windows\System\eIAUnAC.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\xlPnXWS.exe
  C:\Windows\System\xlPnXWS.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\KrfTpJi.exe
  C:\Windows\System\KrfTpJi.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\lcYlfrd.exe
  C:\Windows\System\lcYlfrd.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\upiIlOF.exe
  C:\Windows\System\upiIlOF.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\UybDUgj.exe
  C:\Windows\System\UybDUgj.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\aBWGkue.exe
  C:\Windows\System\aBWGkue.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\MYkFfVI.exe
  C:\Windows\System\MYkFfVI.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\ymcsqas.exe
  C:\Windows\System\ymcsqas.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\sfMgEuc.exe
  C:\Windows\System\sfMgEuc.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\gCDFTTK.exe
  C:\Windows\System\gCDFTTK.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\BCCdQsn.exe
  C:\Windows\System\BCCdQsn.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\OdznQVW.exe
  C:\Windows\System\OdznQVW.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\yWguONV.exe
  C:\Windows\System\yWguONV.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\zvkbecW.exe
  C:\Windows\System\zvkbecW.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\BssbPAc.exe
  C:\Windows\System\BssbPAc.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\dxXarKR.exe
  C:\Windows\System\dxXarKR.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\eqyDjnI.exe
  C:\Windows\System\eqyDjnI.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\znIsbky.exe
  C:\Windows\System\znIsbky.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\MqNyiJn.exe
  C:\Windows\System\MqNyiJn.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\OjXVkhl.exe
  C:\Windows\System\OjXVkhl.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zDSwZdM.exe
  C:\Windows\System\zDSwZdM.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\CDcklLf.exe
  C:\Windows\System\CDcklLf.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\zwzGpnn.exe
  C:\Windows\System\zwzGpnn.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\HLBwVHV.exe
  C:\Windows\System\HLBwVHV.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\YFeoUig.exe
  C:\Windows\System\YFeoUig.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\vfgiSqQ.exe
  C:\Windows\System\vfgiSqQ.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\BuajbGm.exe
  C:\Windows\System\BuajbGm.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\iQMpmlO.exe
  C:\Windows\System\iQMpmlO.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\SckCZPP.exe
  C:\Windows\System\SckCZPP.exe
  2⤵
  PID:5088
- C:\Windows\System\SeoVIqx.exe
  C:\Windows\System\SeoVIqx.exe
  2⤵
  PID:4304
- C:\Windows\System\dWifSnQ.exe
  C:\Windows\System\dWifSnQ.exe
  2⤵
  PID:1288
- C:\Windows\System\cZxCnkx.exe
  C:\Windows\System\cZxCnkx.exe
  2⤵
  PID:400
- C:\Windows\System\yomuDcS.exe
  C:\Windows\System\yomuDcS.exe
  2⤵
  PID:4780
- C:\Windows\System\kTCRliE.exe
  C:\Windows\System\kTCRliE.exe
  2⤵
  PID:952
- C:\Windows\System\kcaQLHL.exe
  C:\Windows\System\kcaQLHL.exe
  2⤵
  PID:1292
- C:\Windows\System\TvMFsYT.exe
  C:\Windows\System\TvMFsYT.exe
  2⤵
  PID:2552
- C:\Windows\System\lXvNJin.exe
  C:\Windows\System\lXvNJin.exe
  2⤵
  PID:1672
- C:\Windows\System\eFNqpou.exe
  C:\Windows\System\eFNqpou.exe
  2⤵
  PID:4792
- C:\Windows\System\afWEeEN.exe
  C:\Windows\System\afWEeEN.exe
  2⤵
  PID:5144
- C:\Windows\System\MwISgeC.exe
  C:\Windows\System\MwISgeC.exe
  2⤵
  PID:5168
- C:\Windows\System\QcjibKl.exe
  C:\Windows\System\QcjibKl.exe
  2⤵
  PID:5196
- C:\Windows\System\FyCwVsI.exe
  C:\Windows\System\FyCwVsI.exe
  2⤵
  PID:5224
- C:\Windows\System\YcxXevF.exe
  C:\Windows\System\YcxXevF.exe
  2⤵
  PID:5252
- C:\Windows\System\XQoCXuh.exe
  C:\Windows\System\XQoCXuh.exe
  2⤵
  PID:5280
- C:\Windows\System\sOoanMx.exe
  C:\Windows\System\sOoanMx.exe
  2⤵
  PID:5320
- C:\Windows\System\PUYiwED.exe
  C:\Windows\System\PUYiwED.exe
  2⤵
  PID:5344
- C:\Windows\System\YOoTiYQ.exe
  C:\Windows\System\YOoTiYQ.exe
  2⤵
  PID:5376
- C:\Windows\System\NJyjlil.exe
  C:\Windows\System\NJyjlil.exe
  2⤵
  PID:5400
- C:\Windows\System\htSBNeb.exe
  C:\Windows\System\htSBNeb.exe
  2⤵
  PID:5432
- C:\Windows\System\BlIzAgI.exe
  C:\Windows\System\BlIzAgI.exe
  2⤵
  PID:5460
- C:\Windows\System\sTZhAaG.exe
  C:\Windows\System\sTZhAaG.exe
  2⤵
  PID:5492
- C:\Windows\System\NYlvupS.exe
  C:\Windows\System\NYlvupS.exe
  2⤵
  PID:5516
- C:\Windows\System\GTZdmHK.exe
  C:\Windows\System\GTZdmHK.exe
  2⤵
  PID:5536
- C:\Windows\System\qfyZbQh.exe
  C:\Windows\System\qfyZbQh.exe
  2⤵
  PID:5560
- C:\Windows\System\iaLKpmV.exe
  C:\Windows\System\iaLKpmV.exe
  2⤵
  PID:5592
- C:\Windows\System\wDsXPLV.exe
  C:\Windows\System\wDsXPLV.exe
  2⤵
  PID:5620
- C:\Windows\System\eekLSEd.exe
  C:\Windows\System\eekLSEd.exe
  2⤵
  PID:5644
- C:\Windows\System\sXAhNYV.exe
  C:\Windows\System\sXAhNYV.exe
  2⤵
  PID:5672
- C:\Windows\System\onxbyLg.exe
  C:\Windows\System\onxbyLg.exe
  2⤵
  PID:5700
- C:\Windows\System\lUwREjs.exe
  C:\Windows\System\lUwREjs.exe
  2⤵
  PID:5732
- C:\Windows\System\FwOtQhg.exe
  C:\Windows\System\FwOtQhg.exe
  2⤵
  PID:5760
- C:\Windows\System\YrEGSib.exe
  C:\Windows\System\YrEGSib.exe
  2⤵
  PID:5784
- C:\Windows\System\GDWokSE.exe
  C:\Windows\System\GDWokSE.exe
  2⤵
  PID:5812
- C:\Windows\System\kDFRnPJ.exe
  C:\Windows\System\kDFRnPJ.exe
  2⤵
  PID:5844
- C:\Windows\System\CgOrNlR.exe
  C:\Windows\System\CgOrNlR.exe
  2⤵
  PID:5868
- C:\Windows\System\wITfOZH.exe
  C:\Windows\System\wITfOZH.exe
  2⤵
  PID:5896
- C:\Windows\System\hdiDCpF.exe
  C:\Windows\System\hdiDCpF.exe
  2⤵
  PID:5928
- C:\Windows\System\wBgiovO.exe
  C:\Windows\System\wBgiovO.exe
  2⤵
  PID:5952
- C:\Windows\System\kKRpHZB.exe
  C:\Windows\System\kKRpHZB.exe
  2⤵
  PID:5980
- C:\Windows\System\bGfoiKf.exe
  C:\Windows\System\bGfoiKf.exe
  2⤵
  PID:6008
- C:\Windows\System\xrwwnhf.exe
  C:\Windows\System\xrwwnhf.exe
  2⤵
  PID:6036
- C:\Windows\System\zqZXVdj.exe
  C:\Windows\System\zqZXVdj.exe
  2⤵
  PID:6064
- C:\Windows\System\ktTCFFh.exe
  C:\Windows\System\ktTCFFh.exe
  2⤵
  PID:6092
- C:\Windows\System\kAoofdT.exe
  C:\Windows\System\kAoofdT.exe
  2⤵
  PID:6120
- C:\Windows\System\HTTseqi.exe
  C:\Windows\System\HTTseqi.exe
  2⤵
  PID:1796
- C:\Windows\System\hfSyKUM.exe
  C:\Windows\System\hfSyKUM.exe
  2⤵
  PID:4092
- C:\Windows\System\WyTWCLw.exe
  C:\Windows\System\WyTWCLw.exe
  2⤵
  PID:4588
- C:\Windows\System\ONGRuhb.exe
  C:\Windows\System\ONGRuhb.exe
  2⤵
  PID:3988
- C:\Windows\System\BcHfPuS.exe
  C:\Windows\System\BcHfPuS.exe
  2⤵
  PID:1720
- C:\Windows\System\slhLuus.exe
  C:\Windows\System\slhLuus.exe
  2⤵
  PID:4988
- C:\Windows\System\IAnpbxy.exe
  C:\Windows\System\IAnpbxy.exe
  2⤵
  PID:5132
- C:\Windows\System\fTwRAoR.exe
  C:\Windows\System\fTwRAoR.exe
  2⤵
  PID:5188
- C:\Windows\System\wrPjcnG.exe
  C:\Windows\System\wrPjcnG.exe
  2⤵
  PID:5268
- C:\Windows\System\hnmqPlm.exe
  C:\Windows\System\hnmqPlm.exe
  2⤵
  PID:5336
- C:\Windows\System\DnMFKew.exe
  C:\Windows\System\DnMFKew.exe
  2⤵
  PID:5392
- C:\Windows\System\KsgikzV.exe
  C:\Windows\System\KsgikzV.exe
  2⤵
  PID:5452
- C:\Windows\System\KXytKgD.exe
  C:\Windows\System\KXytKgD.exe
  2⤵
  PID:5524
- C:\Windows\System\sGbpryH.exe
  C:\Windows\System\sGbpryH.exe
  2⤵
  PID:5600
- C:\Windows\System\OeuNawK.exe
  C:\Windows\System\OeuNawK.exe
  2⤵
  PID:5664
- C:\Windows\System\zBhMksH.exe
  C:\Windows\System\zBhMksH.exe
  2⤵
  PID:5720
- C:\Windows\System\pCaNOTC.exe
  C:\Windows\System\pCaNOTC.exe
  2⤵
  PID:5780
- C:\Windows\System\LhsOzDc.exe
  C:\Windows\System\LhsOzDc.exe
  2⤵
  PID:5852
- C:\Windows\System\qxFWliN.exe
  C:\Windows\System\qxFWliN.exe
  2⤵
  PID:5916
- C:\Windows\System\EZOIudA.exe
  C:\Windows\System\EZOIudA.exe
  2⤵
  PID:5968
- C:\Windows\System\PuzeKpy.exe
  C:\Windows\System\PuzeKpy.exe
  2⤵
  PID:6048
- C:\Windows\System\qQeiLYa.exe
  C:\Windows\System\qQeiLYa.exe
  2⤵
  PID:6104
- C:\Windows\System\yamnwjG.exe
  C:\Windows\System\yamnwjG.exe
  2⤵
  PID:3848
- C:\Windows\System\GkPznnT.exe
  C:\Windows\System\GkPznnT.exe
  2⤵
  PID:3416
- C:\Windows\System\DmLKJsn.exe
  C:\Windows\System\DmLKJsn.exe
  2⤵
  PID:3440
- C:\Windows\System\uIjqtHr.exe
  C:\Windows\System\uIjqtHr.exe
  2⤵
  PID:2740
- C:\Windows\System\SYzzDKI.exe
  C:\Windows\System\SYzzDKI.exe
  2⤵
  PID:5292
- C:\Windows\System\DZiFDbf.exe
  C:\Windows\System\DZiFDbf.exe
  2⤵
  PID:5424
- C:\Windows\System\jUJFCQY.exe
  C:\Windows\System\jUJFCQY.exe
  2⤵
  PID:5572
- C:\Windows\System\GVUYTkk.exe
  C:\Windows\System\GVUYTkk.exe
  2⤵
  PID:5748
- C:\Windows\System\ZrIACCV.exe
  C:\Windows\System\ZrIACCV.exe
  2⤵
  PID:5884
- C:\Windows\System\TGVWbNg.exe
  C:\Windows\System\TGVWbNg.exe
  2⤵
  PID:6020
- C:\Windows\System\ONWZwym.exe
  C:\Windows\System\ONWZwym.exe
  2⤵
  PID:3256
- C:\Windows\System\iSbilJk.exe
  C:\Windows\System\iSbilJk.exe
  2⤵
  PID:388
- C:\Windows\System\reEQEOd.exe
  C:\Windows\System\reEQEOd.exe
  2⤵
  PID:6176
- C:\Windows\System\DuwMueD.exe
  C:\Windows\System\DuwMueD.exe
  2⤵
  PID:6204
- C:\Windows\System\mDdvQEN.exe
  C:\Windows\System\mDdvQEN.exe
  2⤵
  PID:6228
- C:\Windows\System\QqcvCDu.exe
  C:\Windows\System\QqcvCDu.exe
  2⤵
  PID:6260
- C:\Windows\System\VCyXhce.exe
  C:\Windows\System\VCyXhce.exe
  2⤵
  PID:6284
- C:\Windows\System\xYkPXJI.exe
  C:\Windows\System\xYkPXJI.exe
  2⤵
  PID:6308
- C:\Windows\System\zmpXJDs.exe
  C:\Windows\System\zmpXJDs.exe
  2⤵
  PID:6336
- C:\Windows\System\JxNajkK.exe
  C:\Windows\System\JxNajkK.exe
  2⤵
  PID:6360
- C:\Windows\System\IgtijLa.exe
  C:\Windows\System\IgtijLa.exe
  2⤵
  PID:6408
- C:\Windows\System\JHewylP.exe
  C:\Windows\System\JHewylP.exe
  2⤵
  PID:6428
- C:\Windows\System\twiqCjO.exe
  C:\Windows\System\twiqCjO.exe
  2⤵
  PID:6468
- C:\Windows\System\TwoWkNr.exe
  C:\Windows\System\TwoWkNr.exe
  2⤵
  PID:6496
- C:\Windows\System\RYjPekl.exe
  C:\Windows\System\RYjPekl.exe
  2⤵
  PID:6524
- C:\Windows\System\eHMXHuB.exe
  C:\Windows\System\eHMXHuB.exe
  2⤵
  PID:6544
- C:\Windows\System\FXdfGha.exe
  C:\Windows\System\FXdfGha.exe
  2⤵
  PID:6564
- C:\Windows\System\AwYLFhO.exe
  C:\Windows\System\AwYLFhO.exe
  2⤵
  PID:6584
- C:\Windows\System\NlvUVpI.exe
  C:\Windows\System\NlvUVpI.exe
  2⤵
  PID:6604
- C:\Windows\System\AbQIGnk.exe
  C:\Windows\System\AbQIGnk.exe
  2⤵
  PID:6668
- C:\Windows\System\NDtGWGF.exe
  C:\Windows\System\NDtGWGF.exe
  2⤵
  PID:6708
- C:\Windows\System\yPaTcrz.exe
  C:\Windows\System\yPaTcrz.exe
  2⤵
  PID:6732
- C:\Windows\System\ptdVmcp.exe
  C:\Windows\System\ptdVmcp.exe
  2⤵
  PID:6756
- C:\Windows\System\BZpnwsD.exe
  C:\Windows\System\BZpnwsD.exe
  2⤵
  PID:6784
- C:\Windows\System\ypxVLAg.exe
  C:\Windows\System\ypxVLAg.exe
  2⤵
  PID:6816
- C:\Windows\System\boAmfMZ.exe
  C:\Windows\System\boAmfMZ.exe
  2⤵
  PID:6832
- C:\Windows\System\gpgXFHS.exe
  C:\Windows\System\gpgXFHS.exe
  2⤵
  PID:6856
- C:\Windows\System\fQzUARc.exe
  C:\Windows\System\fQzUARc.exe
  2⤵
  PID:6896
- C:\Windows\System\IrSqiRb.exe
  C:\Windows\System\IrSqiRb.exe
  2⤵
  PID:6916
- C:\Windows\System\PdLunxS.exe
  C:\Windows\System\PdLunxS.exe
  2⤵
  PID:6940
- C:\Windows\System\TwVjvjc.exe
  C:\Windows\System\TwVjvjc.exe
  2⤵
  PID:6968
- C:\Windows\System\cqOfpVP.exe
  C:\Windows\System\cqOfpVP.exe
  2⤵
  PID:6996
- C:\Windows\System\JIBUulA.exe
  C:\Windows\System\JIBUulA.exe
  2⤵
  PID:7020
- C:\Windows\System\nkdcUzo.exe
  C:\Windows\System\nkdcUzo.exe
  2⤵
  PID:7044
- C:\Windows\System\NiwiJSm.exe
  C:\Windows\System\NiwiJSm.exe
  2⤵
  PID:7064
- C:\Windows\System\uQcmPpN.exe
  C:\Windows\System\uQcmPpN.exe
  2⤵
  PID:7088
- C:\Windows\System\gqeefgF.exe
  C:\Windows\System\gqeefgF.exe
  2⤵
  PID:7120
- C:\Windows\System\LSnNHoq.exe
  C:\Windows\System\LSnNHoq.exe
  2⤵
  PID:5180
- C:\Windows\System\UzipgDq.exe
  C:\Windows\System\UzipgDq.exe
  2⤵
  PID:5500
- C:\Windows\System\welYYGn.exe
  C:\Windows\System\welYYGn.exe
  2⤵
  PID:5808
- C:\Windows\System\VUORPWE.exe
  C:\Windows\System\VUORPWE.exe
  2⤵
  PID:4604
- C:\Windows\System\mZRIqOR.exe
  C:\Windows\System\mZRIqOR.exe
  2⤵
  PID:6160
- C:\Windows\System\WizzSdI.exe
  C:\Windows\System\WizzSdI.exe
  2⤵
  PID:6244
- C:\Windows\System\UPHGHMA.exe
  C:\Windows\System\UPHGHMA.exe
  2⤵
  PID:6192
- C:\Windows\System\MQjSKhN.exe
  C:\Windows\System\MQjSKhN.exe
  2⤵
  PID:6316
- C:\Windows\System\khVEzLM.exe
  C:\Windows\System\khVEzLM.exe
  2⤵
  PID:6384
- C:\Windows\System\KJihnSp.exe
  C:\Windows\System\KJihnSp.exe
  2⤵
  PID:1132
- C:\Windows\System\LzoyxgC.exe
  C:\Windows\System\LzoyxgC.exe
  2⤵
  PID:3004
- C:\Windows\System\CuHnXKC.exe
  C:\Windows\System\CuHnXKC.exe
  2⤵
  PID:2236
- C:\Windows\System\FswtZlj.exe
  C:\Windows\System\FswtZlj.exe
  2⤵
  PID:6400
- C:\Windows\System\ruDLKzL.exe
  C:\Windows\System\ruDLKzL.exe
  2⤵
  PID:6452
- C:\Windows\System\gCTWRMA.exe
  C:\Windows\System\gCTWRMA.exe
  2⤵
  PID:6516
- C:\Windows\System\XjPoCLW.exe
  C:\Windows\System\XjPoCLW.exe
  2⤵
  PID:6540
- C:\Windows\System\MDEGWZG.exe
  C:\Windows\System\MDEGWZG.exe
  2⤵
  PID:6692
- C:\Windows\System\sZAbdyT.exe
  C:\Windows\System\sZAbdyT.exe
  2⤵
  PID:4200
- C:\Windows\System\PwZRSrl.exe
  C:\Windows\System\PwZRSrl.exe
  2⤵
  PID:6776
- C:\Windows\System\OdwZZqd.exe
  C:\Windows\System\OdwZZqd.exe
  2⤵
  PID:6812
- C:\Windows\System\vfZhyhc.exe
  C:\Windows\System\vfZhyhc.exe
  2⤵
  PID:6928
- C:\Windows\System\AtAKgnx.exe
  C:\Windows\System\AtAKgnx.exe
  2⤵
  PID:6936
- C:\Windows\System\BGeflbG.exe
  C:\Windows\System\BGeflbG.exe
  2⤵
  PID:3996
- C:\Windows\System\RwsstUh.exe
  C:\Windows\System\RwsstUh.exe
  2⤵
  PID:6960
- C:\Windows\System\xOQUnnO.exe
  C:\Windows\System\xOQUnnO.exe
  2⤵
  PID:7052
- C:\Windows\System\xcHAySC.exe
  C:\Windows\System\xcHAySC.exe
  2⤵
  PID:7140
- C:\Windows\System\pNaGcYQ.exe
  C:\Windows\System\pNaGcYQ.exe
  2⤵
  PID:7116
- C:\Windows\System\MuZrByt.exe
  C:\Windows\System\MuZrByt.exe
  2⤵
  PID:3136
- C:\Windows\System\apBVEcY.exe
  C:\Windows\System\apBVEcY.exe
  2⤵
  PID:3644
- C:\Windows\System\XWFkXrx.exe
  C:\Windows\System\XWFkXrx.exe
  2⤵
  PID:2620
- C:\Windows\System\ZfvUkhw.exe
  C:\Windows\System\ZfvUkhw.exe
  2⤵
  PID:6216
- C:\Windows\System\OeZxbAu.exe
  C:\Windows\System\OeZxbAu.exe
  2⤵
  PID:4228
- C:\Windows\System\zmnXgtx.exe
  C:\Windows\System\zmnXgtx.exe
  2⤵
  PID:4512
- C:\Windows\System\cfdFyyW.exe
  C:\Windows\System\cfdFyyW.exe
  2⤵
  PID:6532
- C:\Windows\System\uAmoAfs.exe
  C:\Windows\System\uAmoAfs.exe
  2⤵
  PID:2260
- C:\Windows\System\iMjpHBm.exe
  C:\Windows\System\iMjpHBm.exe
  2⤵
  PID:6628
- C:\Windows\System\jzpsUiT.exe
  C:\Windows\System\jzpsUiT.exe
  2⤵
  PID:1940
- C:\Windows\System\qNHUCZt.exe
  C:\Windows\System\qNHUCZt.exe
  2⤵
  PID:1424
- C:\Windows\System\nAoNOpG.exe
  C:\Windows\System\nAoNOpG.exe
  2⤵
  PID:7016
- C:\Windows\System\WArBWQA.exe
  C:\Windows\System\WArBWQA.exe
  2⤵
  PID:7076
- C:\Windows\System\JFFEzIA.exe
  C:\Windows\System\JFFEzIA.exe
  2⤵
  PID:3164
- C:\Windows\System\uPweVIu.exe
  C:\Windows\System\uPweVIu.exe
  2⤵
  PID:2920
- C:\Windows\System\kvBqiZT.exe
  C:\Windows\System\kvBqiZT.exe
  2⤵
  PID:1448
- C:\Windows\System\KjTEJhX.exe
  C:\Windows\System\KjTEJhX.exe
  2⤵
  PID:6688
- C:\Windows\System\JyLUCPa.exe
  C:\Windows\System\JyLUCPa.exe
  2⤵
  PID:3564
- C:\Windows\System\OdJbgvD.exe
  C:\Windows\System\OdJbgvD.exe
  2⤵
  PID:6748
- C:\Windows\System\FAvBqjj.exe
  C:\Windows\System\FAvBqjj.exe
  2⤵
  PID:6276
- C:\Windows\System\qpLPNGG.exe
  C:\Windows\System\qpLPNGG.exe
  2⤵
  PID:6484
- C:\Windows\System\wSMGwRt.exe
  C:\Windows\System\wSMGwRt.exe
  2⤵
  PID:6852
- C:\Windows\System\jfjuHSi.exe
  C:\Windows\System\jfjuHSi.exe
  2⤵
  PID:6956
- C:\Windows\System\XdcsVcH.exe
  C:\Windows\System\XdcsVcH.exe
  2⤵
  PID:7192
- C:\Windows\System\eRwkLhe.exe
  C:\Windows\System\eRwkLhe.exe
  2⤵
  PID:7212
- C:\Windows\System\JIYlycs.exe
  C:\Windows\System\JIYlycs.exe
  2⤵
  PID:7244
- C:\Windows\System\koongXe.exe
  C:\Windows\System\koongXe.exe
  2⤵
  PID:7264
- C:\Windows\System\tYLEyUz.exe
  C:\Windows\System\tYLEyUz.exe
  2⤵
  PID:7296
- C:\Windows\System\RqxqeFZ.exe
  C:\Windows\System\RqxqeFZ.exe
  2⤵
  PID:7312
- C:\Windows\System\sIzWnbn.exe
  C:\Windows\System\sIzWnbn.exe
  2⤵
  PID:7372
- C:\Windows\System\fdyDosI.exe
  C:\Windows\System\fdyDosI.exe
  2⤵
  PID:7404
- C:\Windows\System\EAFjNHy.exe
  C:\Windows\System\EAFjNHy.exe
  2⤵
  PID:7420
- C:\Windows\System\zIYJTzZ.exe
  C:\Windows\System\zIYJTzZ.exe
  2⤵
  PID:7444
- C:\Windows\System\jiDtvdR.exe
  C:\Windows\System\jiDtvdR.exe
  2⤵
  PID:7500
- C:\Windows\System\NaOgVLH.exe
  C:\Windows\System\NaOgVLH.exe
  2⤵
  PID:7520
- C:\Windows\System\RtwGrRU.exe
  C:\Windows\System\RtwGrRU.exe
  2⤵
  PID:7540
- C:\Windows\System\BqEbndR.exe
  C:\Windows\System\BqEbndR.exe
  2⤵
  PID:7564
- C:\Windows\System\DyLYfTb.exe
  C:\Windows\System\DyLYfTb.exe
  2⤵
  PID:7588
- C:\Windows\System\mfJnwoK.exe
  C:\Windows\System\mfJnwoK.exe
  2⤵
  PID:7608
- C:\Windows\System\ptfHyZs.exe
  C:\Windows\System\ptfHyZs.exe
  2⤵
  PID:7628
- C:\Windows\System\yMyLpLZ.exe
  C:\Windows\System\yMyLpLZ.exe
  2⤵
  PID:7656
- C:\Windows\System\FMOiKWo.exe
  C:\Windows\System\FMOiKWo.exe
  2⤵
  PID:7676
- C:\Windows\System\ORPNAyC.exe
  C:\Windows\System\ORPNAyC.exe
  2⤵
  PID:7696
- C:\Windows\System\FfhdaLE.exe
  C:\Windows\System\FfhdaLE.exe
  2⤵
  PID:7720
- C:\Windows\System\cbAuHaP.exe
  C:\Windows\System\cbAuHaP.exe
  2⤵
  PID:7740
- C:\Windows\System\xsZzRRZ.exe
  C:\Windows\System\xsZzRRZ.exe
  2⤵
  PID:7804
- C:\Windows\System\wScnNnh.exe
  C:\Windows\System\wScnNnh.exe
  2⤵
  PID:7832
- C:\Windows\System\nsjFzCU.exe
  C:\Windows\System\nsjFzCU.exe
  2⤵
  PID:7856
- C:\Windows\System\rteWjmZ.exe
  C:\Windows\System\rteWjmZ.exe
  2⤵
  PID:7876
- C:\Windows\System\NYyrWqf.exe
  C:\Windows\System\NYyrWqf.exe
  2⤵
  PID:7896
- C:\Windows\System\beyoyyE.exe
  C:\Windows\System\beyoyyE.exe
  2⤵
  PID:7928
- C:\Windows\System\uQgebqS.exe
  C:\Windows\System\uQgebqS.exe
  2⤵
  PID:7980
- C:\Windows\System\qSHAaQS.exe
  C:\Windows\System\qSHAaQS.exe
  2⤵
  PID:8008
- C:\Windows\System\ymPvjIN.exe
  C:\Windows\System\ymPvjIN.exe
  2⤵
  PID:8056
- C:\Windows\System\FKRWrwJ.exe
  C:\Windows\System\FKRWrwJ.exe
  2⤵
  PID:8076
- C:\Windows\System\xsRhAvu.exe
  C:\Windows\System\xsRhAvu.exe
  2⤵
  PID:8096
- C:\Windows\System\ErycYZP.exe
  C:\Windows\System\ErycYZP.exe
  2⤵
  PID:8124
- C:\Windows\System\GwCbnHt.exe
  C:\Windows\System\GwCbnHt.exe
  2⤵
  PID:8148
- C:\Windows\System\KaWhyqA.exe
  C:\Windows\System\KaWhyqA.exe
  2⤵
  PID:8168
- C:\Windows\System\WhpvzBJ.exe
  C:\Windows\System\WhpvzBJ.exe
  2⤵
  PID:6656
- C:\Windows\System\CxNxRYH.exe
  C:\Windows\System\CxNxRYH.exe
  2⤵
  PID:5948
- C:\Windows\System\suqMCMs.exe
  C:\Windows\System\suqMCMs.exe
  2⤵
  PID:7224
- C:\Windows\System\qymXWZh.exe
  C:\Windows\System\qymXWZh.exe
  2⤵
  PID:7276
- C:\Windows\System\bdMaLAL.exe
  C:\Windows\System\bdMaLAL.exe
  2⤵
  PID:7432
- C:\Windows\System\OSAvkEY.exe
  C:\Windows\System\OSAvkEY.exe
  2⤵
  PID:7508
- C:\Windows\System\VaqLeWB.exe
  C:\Windows\System\VaqLeWB.exe
  2⤵
  PID:7620
- C:\Windows\System\vOrntwz.exe
  C:\Windows\System\vOrntwz.exe
  2⤵
  PID:7572
- C:\Windows\System\JgNfjPB.exe
  C:\Windows\System\JgNfjPB.exe
  2⤵
  PID:7648
- C:\Windows\System\QiRZdnV.exe
  C:\Windows\System\QiRZdnV.exe
  2⤵
  PID:7668
- C:\Windows\System\OdrQspI.exe
  C:\Windows\System\OdrQspI.exe
  2⤵
  PID:7824
- C:\Windows\System\JPHZWfn.exe
  C:\Windows\System\JPHZWfn.exe
  2⤵
  PID:7852
- C:\Windows\System\HfgtPDL.exe
  C:\Windows\System\HfgtPDL.exe
  2⤵
  PID:7924
- C:\Windows\System\lCdfUle.exe
  C:\Windows\System\lCdfUle.exe
  2⤵
  PID:7952
- C:\Windows\System\UTQRyQV.exe
  C:\Windows\System\UTQRyQV.exe
  2⤵
  PID:8068
- C:\Windows\System\QptqLAX.exe
  C:\Windows\System\QptqLAX.exe
  2⤵
  PID:8136
- C:\Windows\System\OwWhtML.exe
  C:\Windows\System\OwWhtML.exe
  2⤵
  PID:7208
- C:\Windows\System\JJDqDAn.exe
  C:\Windows\System\JJDqDAn.exe
  2⤵
  PID:7180
- C:\Windows\System\AJrwxBk.exe
  C:\Windows\System\AJrwxBk.exe
  2⤵
  PID:3748
- C:\Windows\System\BZIcpfF.exe
  C:\Windows\System\BZIcpfF.exe
  2⤵
  PID:4416
- C:\Windows\System\CCXNUJt.exe
  C:\Windows\System\CCXNUJt.exe
  2⤵
  PID:7532
- C:\Windows\System\vuqONGH.exe
  C:\Windows\System\vuqONGH.exe
  2⤵
  PID:7556
- C:\Windows\System\tJVLcsC.exe
  C:\Windows\System\tJVLcsC.exe
  2⤵
  PID:7772
- C:\Windows\System\LmpjJKB.exe
  C:\Windows\System\LmpjJKB.exe
  2⤵
  PID:8048
- C:\Windows\System\AfNZnvn.exe
  C:\Windows\System\AfNZnvn.exe
  2⤵
  PID:8000
- C:\Windows\System\mJUKzNJ.exe
  C:\Windows\System\mJUKzNJ.exe
  2⤵
  PID:7512
- C:\Windows\System\ClHJmtB.exe
  C:\Windows\System\ClHJmtB.exe
  2⤵
  PID:7684
- C:\Windows\System\OHESdwh.exe
  C:\Windows\System\OHESdwh.exe
  2⤵
  PID:7904
- C:\Windows\System\hJISjda.exe
  C:\Windows\System\hJISjda.exe
  2⤵
  PID:3056
- C:\Windows\System\rFZoYPw.exe
  C:\Windows\System\rFZoYPw.exe
  2⤵
  PID:7848
- C:\Windows\System\ZVKeKHA.exe
  C:\Windows\System\ZVKeKHA.exe
  2⤵
  PID:8208
- C:\Windows\System\IiRSKZR.exe
  C:\Windows\System\IiRSKZR.exe
  2⤵
  PID:8236
- C:\Windows\System\hSplgKD.exe
  C:\Windows\System\hSplgKD.exe
  2⤵
  PID:8256
- C:\Windows\System\dxGdmgr.exe
  C:\Windows\System\dxGdmgr.exe
  2⤵
  PID:8296
- C:\Windows\System\JKTXFKQ.exe
  C:\Windows\System\JKTXFKQ.exe
  2⤵
  PID:8340
- C:\Windows\System\SgWlmuB.exe
  C:\Windows\System\SgWlmuB.exe
  2⤵
  PID:8364
- C:\Windows\System\ohGXLOV.exe
  C:\Windows\System\ohGXLOV.exe
  2⤵
  PID:8392
- C:\Windows\System\dYxznxV.exe
  C:\Windows\System\dYxznxV.exe
  2⤵
  PID:8420
- C:\Windows\System\hhocJjW.exe
  C:\Windows\System\hhocJjW.exe
  2⤵
  PID:8444
- C:\Windows\System\wlVGoWr.exe
  C:\Windows\System\wlVGoWr.exe
  2⤵
  PID:8464
- C:\Windows\System\iYkAMpo.exe
  C:\Windows\System\iYkAMpo.exe
  2⤵
  PID:8492
- C:\Windows\System\wvwvoaO.exe
  C:\Windows\System\wvwvoaO.exe
  2⤵
  PID:8528
- C:\Windows\System\axDXAEQ.exe
  C:\Windows\System\axDXAEQ.exe
  2⤵
  PID:8560
- C:\Windows\System\uKyFZhY.exe
  C:\Windows\System\uKyFZhY.exe
  2⤵
  PID:8580
- C:\Windows\System\NEybyGJ.exe
  C:\Windows\System\NEybyGJ.exe
  2⤵
  PID:8612
- C:\Windows\System\GYMKdqp.exe
  C:\Windows\System\GYMKdqp.exe
  2⤵
  PID:8640
- C:\Windows\System\rRfOZdt.exe
  C:\Windows\System\rRfOZdt.exe
  2⤵
  PID:8692
- C:\Windows\System\ajNwIwg.exe
  C:\Windows\System\ajNwIwg.exe
  2⤵
  PID:8708
- C:\Windows\System\XlfOCDF.exe
  C:\Windows\System\XlfOCDF.exe
  2⤵
  PID:8728
- C:\Windows\System\KzQwUOD.exe
  C:\Windows\System\KzQwUOD.exe
  2⤵
  PID:8748
- C:\Windows\System\OChDOBg.exe
  C:\Windows\System\OChDOBg.exe
  2⤵
  PID:8792
- C:\Windows\System\QcmkXse.exe
  C:\Windows\System\QcmkXse.exe
  2⤵
  PID:8816
- C:\Windows\System\XBcRIml.exe
  C:\Windows\System\XBcRIml.exe
  2⤵
  PID:8848
- C:\Windows\System\ZgVOoJv.exe
  C:\Windows\System\ZgVOoJv.exe
  2⤵
  PID:8868
- C:\Windows\System\QKYUwHg.exe
  C:\Windows\System\QKYUwHg.exe
  2⤵
  PID:8892
- C:\Windows\System\QvKiNaw.exe
  C:\Windows\System\QvKiNaw.exe
  2⤵
  PID:8920
- C:\Windows\System\PkvJSTo.exe
  C:\Windows\System\PkvJSTo.exe
  2⤵
  PID:8948
- C:\Windows\System\mLGyjJM.exe
  C:\Windows\System\mLGyjJM.exe
  2⤵
  PID:8992
- C:\Windows\System\wlnMKoD.exe
  C:\Windows\System\wlnMKoD.exe
  2⤵
  PID:9016
- C:\Windows\System\PNmvsOk.exe
  C:\Windows\System\PNmvsOk.exe
  2⤵
  PID:9044
- C:\Windows\System\zwplDqO.exe
  C:\Windows\System\zwplDqO.exe
  2⤵
  PID:9068
- C:\Windows\System\bVycsSk.exe
  C:\Windows\System\bVycsSk.exe
  2⤵
  PID:9096
- C:\Windows\System\nXuMlNA.exe
  C:\Windows\System\nXuMlNA.exe
  2⤵
  PID:9120
- C:\Windows\System\EeeNnLj.exe
  C:\Windows\System\EeeNnLj.exe
  2⤵
  PID:9168
- C:\Windows\System\FGnGVIx.exe
  C:\Windows\System\FGnGVIx.exe
  2⤵
  PID:9184
- C:\Windows\System\EHSZEfm.exe
  C:\Windows\System\EHSZEfm.exe
  2⤵
  PID:9212
- C:\Windows\System\vvlhLqQ.exe
  C:\Windows\System\vvlhLqQ.exe
  2⤵
  PID:8224
- C:\Windows\System\qtDJltc.exe
  C:\Windows\System\qtDJltc.exe
  2⤵
  PID:8244
- C:\Windows\System\dPbTJqY.exe
  C:\Windows\System\dPbTJqY.exe
  2⤵
  PID:8312
- C:\Windows\System\seFGRnK.exe
  C:\Windows\System\seFGRnK.exe
  2⤵
  PID:8384
- C:\Windows\System\eEjThgo.exe
  C:\Windows\System\eEjThgo.exe
  2⤵
  PID:8452
- C:\Windows\System\CNWjtwZ.exe
  C:\Windows\System\CNWjtwZ.exe
  2⤵
  PID:8552
- C:\Windows\System\DwCReMs.exe
  C:\Windows\System\DwCReMs.exe
  2⤵
  PID:8608
- C:\Windows\System\kxDFsGZ.exe
  C:\Windows\System\kxDFsGZ.exe
  2⤵
  PID:8668
- C:\Windows\System\ahAODnm.exe
  C:\Windows\System\ahAODnm.exe
  2⤵
  PID:8716
- C:\Windows\System\IUwjzTZ.exe
  C:\Windows\System\IUwjzTZ.exe
  2⤵
  PID:8776
- C:\Windows\System\sVoIYNd.exe
  C:\Windows\System\sVoIYNd.exe
  2⤵
  PID:8812
- C:\Windows\System\jcxCDbS.exe
  C:\Windows\System\jcxCDbS.exe
  2⤵
  PID:8884
- C:\Windows\System\WJGEXtw.exe
  C:\Windows\System\WJGEXtw.exe
  2⤵
  PID:8944
- C:\Windows\System\emNBqVN.exe
  C:\Windows\System\emNBqVN.exe
  2⤵
  PID:9032
- C:\Windows\System\wxvkIjB.exe
  C:\Windows\System\wxvkIjB.exe
  2⤵
  PID:9056
- C:\Windows\System\GATqAwX.exe
  C:\Windows\System\GATqAwX.exe
  2⤵
  PID:8132
- C:\Windows\System\wSqckYb.exe
  C:\Windows\System\wSqckYb.exe
  2⤵
  PID:8284
- C:\Windows\System\aAPAJuB.exe
  C:\Windows\System\aAPAJuB.exe
  2⤵
  PID:8352
- C:\Windows\System\tleNkYJ.exe
  C:\Windows\System\tleNkYJ.exe
  2⤵
  PID:8480
- C:\Windows\System\YVikERT.exe
  C:\Windows\System\YVikERT.exe
  2⤵
  PID:8636
- C:\Windows\System\itmJGQc.exe
  C:\Windows\System\itmJGQc.exe
  2⤵
  PID:8744
- C:\Windows\System\gOqbkPL.exe
  C:\Windows\System\gOqbkPL.exe
  2⤵
  PID:8876
- C:\Windows\System\eUqrIGQ.exe
  C:\Windows\System\eUqrIGQ.exe
  2⤵
  PID:8292
- C:\Windows\System\UDAYiwp.exe
  C:\Windows\System\UDAYiwp.exe
  2⤵
  PID:920
- C:\Windows\System\drYpOWl.exe
  C:\Windows\System\drYpOWl.exe
  2⤵
  PID:8676
- C:\Windows\System\oksMuaQ.exe
  C:\Windows\System\oksMuaQ.exe
  2⤵
  PID:8960
- C:\Windows\System\XpFEIZf.exe
  C:\Windows\System\XpFEIZf.exe
  2⤵
  PID:9156
- C:\Windows\System\clzMAzd.exe
  C:\Windows\System\clzMAzd.exe
  2⤵
  PID:8576
- C:\Windows\System\XQkWdrq.exe
  C:\Windows\System\XQkWdrq.exe
  2⤵
  PID:9228
- C:\Windows\System\UVLelln.exe
  C:\Windows\System\UVLelln.exe
  2⤵
  PID:9284
- C:\Windows\System\rhzyHdY.exe
  C:\Windows\System\rhzyHdY.exe
  2⤵
  PID:9300
- C:\Windows\System\vXmHFLD.exe
  C:\Windows\System\vXmHFLD.exe
  2⤵
  PID:9340
- C:\Windows\System\uYQoNIw.exe
  C:\Windows\System\uYQoNIw.exe
  2⤵
  PID:9368
- C:\Windows\System\KpdOEun.exe
  C:\Windows\System\KpdOEun.exe
  2⤵
  PID:9384
- C:\Windows\System\sVncwuu.exe
  C:\Windows\System\sVncwuu.exe
  2⤵
  PID:9424
- C:\Windows\System\zAqhFed.exe
  C:\Windows\System\zAqhFed.exe
  2⤵
  PID:9452
- C:\Windows\System\tWkdwIx.exe
  C:\Windows\System\tWkdwIx.exe
  2⤵
  PID:9468
- C:\Windows\System\gwJocyi.exe
  C:\Windows\System\gwJocyi.exe
  2⤵
  PID:9496
- C:\Windows\System\xMnpQIx.exe
  C:\Windows\System\xMnpQIx.exe
  2⤵
  PID:9516
- C:\Windows\System\KyASwLx.exe
  C:\Windows\System\KyASwLx.exe
  2⤵
  PID:9536
- C:\Windows\System\hUVjMbP.exe
  C:\Windows\System\hUVjMbP.exe
  2⤵
  PID:9572
- C:\Windows\System\suTdNOz.exe
  C:\Windows\System\suTdNOz.exe
  2⤵
  PID:9600
- C:\Windows\System\HijDthE.exe
  C:\Windows\System\HijDthE.exe
  2⤵
  PID:9620
- C:\Windows\System\QjmlLDp.exe
  C:\Windows\System\QjmlLDp.exe
  2⤵
  PID:9648
- C:\Windows\System\XoSpgon.exe
  C:\Windows\System\XoSpgon.exe
  2⤵
  PID:9684
- C:\Windows\System\OtTPfkt.exe
  C:\Windows\System\OtTPfkt.exe
  2⤵
  PID:9716
- C:\Windows\System\cdzmpmT.exe
  C:\Windows\System\cdzmpmT.exe
  2⤵
  PID:9740
- C:\Windows\System\vVLiIaI.exe
  C:\Windows\System\vVLiIaI.exe
  2⤵
  PID:9764
- C:\Windows\System\gMbPFbz.exe
  C:\Windows\System\gMbPFbz.exe
  2⤵
  PID:9784
- C:\Windows\System\KcXDoVM.exe
  C:\Windows\System\KcXDoVM.exe
  2⤵
  PID:9808
- C:\Windows\System\nmpVPfB.exe
  C:\Windows\System\nmpVPfB.exe
  2⤵
  PID:9852
- C:\Windows\System\OPmKIoA.exe
  C:\Windows\System\OPmKIoA.exe
  2⤵
  PID:9892
- C:\Windows\System\sagjBfa.exe
  C:\Windows\System\sagjBfa.exe
  2⤵
  PID:9916
- C:\Windows\System\JSztlEb.exe
  C:\Windows\System\JSztlEb.exe
  2⤵
  PID:9948
- C:\Windows\System\hGWXhwY.exe
  C:\Windows\System\hGWXhwY.exe
  2⤵
  PID:9988
- C:\Windows\System\pZbMnia.exe
  C:\Windows\System\pZbMnia.exe
  2⤵
  PID:10016
- C:\Windows\System\rDQSrTc.exe
  C:\Windows\System\rDQSrTc.exe
  2⤵
  PID:10036
- C:\Windows\System\glpWifI.exe
  C:\Windows\System\glpWifI.exe
  2⤵
  PID:10060
- C:\Windows\System\BDDpxWd.exe
  C:\Windows\System\BDDpxWd.exe
  2⤵
  PID:10084
- C:\Windows\System\yyqlfVR.exe
  C:\Windows\System\yyqlfVR.exe
  2⤵
  PID:10104
- C:\Windows\System\uPxgGuJ.exe
  C:\Windows\System\uPxgGuJ.exe
  2⤵
  PID:10152
- C:\Windows\System\mCXmSJd.exe
  C:\Windows\System\mCXmSJd.exe
  2⤵
  PID:10172
- C:\Windows\System\ukQsASr.exe
  C:\Windows\System\ukQsASr.exe
  2⤵
  PID:10200
- C:\Windows\System\xsuoAqm.exe
  C:\Windows\System\xsuoAqm.exe
  2⤵
  PID:10216
- C:\Windows\System\PedbaOv.exe
  C:\Windows\System\PedbaOv.exe
  2⤵
  PID:10236
- C:\Windows\System\gKwllfo.exe
  C:\Windows\System\gKwllfo.exe
  2⤵
  PID:9240
- C:\Windows\System\PqvwYGd.exe
  C:\Windows\System\PqvwYGd.exe
  2⤵
  PID:9296
- C:\Windows\System\iZXXcBm.exe
  C:\Windows\System\iZXXcBm.exe
  2⤵
  PID:9412
- C:\Windows\System\xgimzBX.exe
  C:\Windows\System\xgimzBX.exe
  2⤵
  PID:9460
- C:\Windows\System\qnfEOha.exe
  C:\Windows\System\qnfEOha.exe
  2⤵
  PID:9524
- C:\Windows\System\jZnlgFc.exe
  C:\Windows\System\jZnlgFc.exe
  2⤵
  PID:9532
- C:\Windows\System\eoEPexC.exe
  C:\Windows\System\eoEPexC.exe
  2⤵
  PID:9616
- C:\Windows\System\JwLwfDn.exe
  C:\Windows\System\JwLwfDn.exe
  2⤵
  PID:9644
- C:\Windows\System\KrgJUkZ.exe
  C:\Windows\System\KrgJUkZ.exe
  2⤵
  PID:9728
- C:\Windows\System\FXRmotq.exe
  C:\Windows\System\FXRmotq.exe
  2⤵
  PID:9824
- C:\Windows\System\TluCcOh.exe
  C:\Windows\System\TluCcOh.exe
  2⤵
  PID:9880
- C:\Windows\System\zNfqZCB.exe
  C:\Windows\System\zNfqZCB.exe
  2⤵
  PID:4264
- C:\Windows\System\kCelvsF.exe
  C:\Windows\System\kCelvsF.exe
  2⤵
  PID:9984
- C:\Windows\System\bDjNkSU.exe
  C:\Windows\System\bDjNkSU.exe
  2⤵
  PID:10024
- C:\Windows\System\tZxAxQk.exe
  C:\Windows\System\tZxAxQk.exe
  2⤵
  PID:10196
- C:\Windows\System\LxXImRp.exe
  C:\Windows\System\LxXImRp.exe
  2⤵
  PID:10212
- C:\Windows\System\xluvBFh.exe
  C:\Windows\System\xluvBFh.exe
  2⤵
  PID:9204
- C:\Windows\System\nTGmtEp.exe
  C:\Windows\System\nTGmtEp.exe
  2⤵
  PID:9488
- C:\Windows\System\SbAqUaC.exe
  C:\Windows\System\SbAqUaC.exe
  2⤵
  PID:9596
- C:\Windows\System\KMyeDAv.exe
  C:\Windows\System\KMyeDAv.exe
  2⤵
  PID:9608
- C:\Windows\System\FRgcWaI.exe
  C:\Windows\System\FRgcWaI.exe
  2⤵
  PID:9676
- C:\Windows\System\aSWMoZX.exe
  C:\Windows\System\aSWMoZX.exe
  2⤵
  PID:9848
- C:\Windows\System\XKvNsev.exe
  C:\Windows\System\XKvNsev.exe
  2⤵
  PID:9904
- C:\Windows\System\fxKZEls.exe
  C:\Windows\System\fxKZEls.exe
  2⤵
  PID:10124
- C:\Windows\System\gTHNEfF.exe
  C:\Windows\System\gTHNEfF.exe
  2⤵
  PID:9440
- C:\Windows\System\FIjLnGU.exe
  C:\Windows\System\FIjLnGU.exe
  2⤵
  PID:10008
- C:\Windows\System\ponpBRQ.exe
  C:\Windows\System\ponpBRQ.exe
  2⤵
  PID:10000
- C:\Windows\System\TBtltid.exe
  C:\Windows\System\TBtltid.exe
  2⤵
  PID:10248
- C:\Windows\System\IeqTTGg.exe
  C:\Windows\System\IeqTTGg.exe
  2⤵
  PID:10280
- C:\Windows\System\jqEVJGm.exe
  C:\Windows\System\jqEVJGm.exe
  2⤵
  PID:10312
- C:\Windows\System\LCljBWH.exe
  C:\Windows\System\LCljBWH.exe
  2⤵
  PID:10340
- C:\Windows\System\MiXVfLT.exe
  C:\Windows\System\MiXVfLT.exe
  2⤵
  PID:10380
- C:\Windows\System\xTYdanm.exe
  C:\Windows\System\xTYdanm.exe
  2⤵
  PID:10400
- C:\Windows\System\dyiGiFT.exe
  C:\Windows\System\dyiGiFT.exe
  2⤵
  PID:10428
- C:\Windows\System\VbFQVEj.exe
  C:\Windows\System\VbFQVEj.exe
  2⤵
  PID:10496
- C:\Windows\System\PxnJPhx.exe
  C:\Windows\System\PxnJPhx.exe
  2⤵
  PID:10512
- C:\Windows\System\kWOUfUZ.exe
  C:\Windows\System\kWOUfUZ.exe
  2⤵
  PID:10536
- C:\Windows\System\nmVlVjU.exe
  C:\Windows\System\nmVlVjU.exe
  2⤵
  PID:10560
- C:\Windows\System\FvjPdHQ.exe
  C:\Windows\System\FvjPdHQ.exe
  2⤵
  PID:10588
- C:\Windows\System\RnQUCjS.exe
  C:\Windows\System\RnQUCjS.exe
  2⤵
  PID:10620
- C:\Windows\System\JvvPOGn.exe
  C:\Windows\System\JvvPOGn.exe
  2⤵
  PID:10644
- C:\Windows\System\UYkYBhn.exe
  C:\Windows\System\UYkYBhn.exe
  2⤵
  PID:10664
- C:\Windows\System\pSplvhj.exe
  C:\Windows\System\pSplvhj.exe
  2⤵
  PID:10684
- C:\Windows\System\sQdqMDu.exe
  C:\Windows\System\sQdqMDu.exe
  2⤵
  PID:10708
- C:\Windows\System\DfWPPBR.exe
  C:\Windows\System\DfWPPBR.exe
  2⤵
  PID:10744
- C:\Windows\System\eevhhtX.exe
  C:\Windows\System\eevhhtX.exe
  2⤵
  PID:10772
- C:\Windows\System\BcVBRyB.exe
  C:\Windows\System\BcVBRyB.exe
  2⤵
  PID:10820
- C:\Windows\System\ZResBOs.exe
  C:\Windows\System\ZResBOs.exe
  2⤵
  PID:10860
- C:\Windows\System\HtjeuCQ.exe
  C:\Windows\System\HtjeuCQ.exe
  2⤵
  PID:10876
- C:\Windows\System\YuwKgqp.exe
  C:\Windows\System\YuwKgqp.exe
  2⤵
  PID:10892
- C:\Windows\System\HJwDNWg.exe
  C:\Windows\System\HJwDNWg.exe
  2⤵
  PID:10932
- C:\Windows\System\TzQdTnx.exe
  C:\Windows\System\TzQdTnx.exe
  2⤵
  PID:10960
- C:\Windows\System\SKuBHbZ.exe
  C:\Windows\System\SKuBHbZ.exe
  2⤵
  PID:10980
- C:\Windows\System\GpjnzNN.exe
  C:\Windows\System\GpjnzNN.exe
  2⤵
  PID:10996
- C:\Windows\System\qZwIgae.exe
  C:\Windows\System\qZwIgae.exe
  2⤵
  PID:11040
- C:\Windows\System\FhKpiWk.exe
  C:\Windows\System\FhKpiWk.exe
  2⤵
  PID:11056
- C:\Windows\System\LPwwgcN.exe
  C:\Windows\System\LPwwgcN.exe
  2⤵
  PID:11080
- C:\Windows\System\vWuexMw.exe
  C:\Windows\System\vWuexMw.exe
  2⤵
  PID:11104
- C:\Windows\System\SDwCTxs.exe
  C:\Windows\System\SDwCTxs.exe
  2⤵
  PID:11152
- C:\Windows\System\nMgmQeS.exe
  C:\Windows\System\nMgmQeS.exe
  2⤵
  PID:11184
- C:\Windows\System\JWQnaBi.exe
  C:\Windows\System\JWQnaBi.exe
  2⤵
  PID:11204
- C:\Windows\System\GHlcDbm.exe
  C:\Windows\System\GHlcDbm.exe
  2⤵
  PID:11232
- C:\Windows\System\cdVmcAr.exe
  C:\Windows\System\cdVmcAr.exe
  2⤵
  PID:11248
- C:\Windows\System\eKKVgUO.exe
  C:\Windows\System\eKKVgUO.exe
  2⤵
  PID:9484
- C:\Windows\System\fRIcNJy.exe
  C:\Windows\System\fRIcNJy.exe
  2⤵
  PID:10300
- C:\Windows\System\KEUqhHt.exe
  C:\Windows\System\KEUqhHt.exe
  2⤵
  PID:10264
- C:\Windows\System\xdKkRjG.exe
  C:\Windows\System\xdKkRjG.exe
  2⤵
  PID:10396
- C:\Windows\System\XudEWSg.exe
  C:\Windows\System\XudEWSg.exe
  2⤵
  PID:10444
- C:\Windows\System\uWtuKQS.exe
  C:\Windows\System\uWtuKQS.exe
  2⤵
  PID:10532
- C:\Windows\System\tfaEDeZ.exe
  C:\Windows\System\tfaEDeZ.exe
  2⤵
  PID:10584
- C:\Windows\System\eZhXprk.exe
  C:\Windows\System\eZhXprk.exe
  2⤵
  PID:10636
- C:\Windows\System\hDSriMP.exe
  C:\Windows\System\hDSriMP.exe
  2⤵
  PID:10720
- C:\Windows\System\xbIhUUJ.exe
  C:\Windows\System\xbIhUUJ.exe
  2⤵
  PID:10788
- C:\Windows\System\qlPWFmC.exe
  C:\Windows\System\qlPWFmC.exe
  2⤵
  PID:10816
- C:\Windows\System\uywHgjH.exe
  C:\Windows\System\uywHgjH.exe
  2⤵
  PID:10948
- C:\Windows\System\KGTnGby.exe
  C:\Windows\System\KGTnGby.exe
  2⤵
  PID:11016
- C:\Windows\System\ypcdysd.exe
  C:\Windows\System\ypcdysd.exe
  2⤵
  PID:11100
- C:\Windows\System\lfmRPlc.exe
  C:\Windows\System\lfmRPlc.exe
  2⤵
  PID:11148
- C:\Windows\System\izXVmPj.exe
  C:\Windows\System\izXVmPj.exe
  2⤵
  PID:11140
- C:\Windows\System\yxUJmrq.exe
  C:\Windows\System\yxUJmrq.exe
  2⤵
  PID:9924
- C:\Windows\System\rTUIhrD.exe
  C:\Windows\System\rTUIhrD.exe
  2⤵
  PID:10244
- C:\Windows\System\llEzhZQ.exe
  C:\Windows\System\llEzhZQ.exe
  2⤵
  PID:10328
- C:\Windows\System\jViljUD.exe
  C:\Windows\System\jViljUD.exe
  2⤵
  PID:10504
- C:\Windows\System\wIShxUm.exe
  C:\Windows\System\wIShxUm.exe
  2⤵
  PID:10700
- C:\Windows\System\KgWKhSc.exe
  C:\Windows\System\KgWKhSc.exe
  2⤵
  PID:10768
- C:\Windows\System\TfRzZUO.exe
  C:\Windows\System\TfRzZUO.exe
  2⤵
  PID:10868
- C:\Windows\System\NyCQjYZ.exe
  C:\Windows\System\NyCQjYZ.exe
  2⤵
  PID:11216
- C:\Windows\System\OGVGZqS.exe
  C:\Windows\System\OGVGZqS.exe
  2⤵
  PID:10324
- C:\Windows\System\qAtYmwX.exe
  C:\Windows\System\qAtYmwX.exe
  2⤵
  PID:10696
- C:\Windows\System\vWrHYAE.exe
  C:\Windows\System\vWrHYAE.exe
  2⤵
  PID:10992
- C:\Windows\System\vnTvRsv.exe
  C:\Windows\System\vnTvRsv.exe
  2⤵
  PID:11076
- C:\Windows\System\GEteoIw.exe
  C:\Windows\System\GEteoIw.exe
  2⤵
  PID:10612
- C:\Windows\System\sYKRDwx.exe
  C:\Windows\System\sYKRDwx.exe
  2⤵
  PID:11292
- C:\Windows\System\WMwicEJ.exe
  C:\Windows\System\WMwicEJ.exe
  2⤵
  PID:11308
- C:\Windows\System\ZmkGpcJ.exe
  C:\Windows\System\ZmkGpcJ.exe
  2⤵
  PID:11324
- C:\Windows\System\hrDIoPd.exe
  C:\Windows\System\hrDIoPd.exe
  2⤵
  PID:11344
- C:\Windows\System\uqVQALO.exe
  C:\Windows\System\uqVQALO.exe
  2⤵
  PID:11404
- C:\Windows\System\JhCoypm.exe
  C:\Windows\System\JhCoypm.exe
  2⤵
  PID:11424
- C:\Windows\System\kagrkMI.exe
  C:\Windows\System\kagrkMI.exe
  2⤵
  PID:11440
- C:\Windows\System\supIqef.exe
  C:\Windows\System\supIqef.exe
  2⤵
  PID:11468
- C:\Windows\System\IhMzEYq.exe
  C:\Windows\System\IhMzEYq.exe
  2⤵
  PID:11492
- C:\Windows\System\uxarySM.exe
  C:\Windows\System\uxarySM.exe
  2⤵
  PID:11512
- C:\Windows\System\elOLCvR.exe
  C:\Windows\System\elOLCvR.exe
  2⤵
  PID:11528
- C:\Windows\System\IekNhxX.exe
  C:\Windows\System\IekNhxX.exe
  2⤵
  PID:11560
- C:\Windows\System\TSWcvGA.exe
  C:\Windows\System\TSWcvGA.exe
  2⤵
  PID:11612
- C:\Windows\System\VSjSwnJ.exe
  C:\Windows\System\VSjSwnJ.exe
  2⤵
  PID:11632
- C:\Windows\System\WFuqJwl.exe
  C:\Windows\System\WFuqJwl.exe
  2⤵
  PID:11648
- C:\Windows\System\ISrCDOO.exe
  C:\Windows\System\ISrCDOO.exe
  2⤵
  PID:11676
- C:\Windows\System\rwjsdEJ.exe
  C:\Windows\System\rwjsdEJ.exe
  2⤵
  PID:11728
- C:\Windows\System\HBOWkPD.exe
  C:\Windows\System\HBOWkPD.exe
  2⤵
  PID:11760
- C:\Windows\System\txfELtF.exe
  C:\Windows\System\txfELtF.exe
  2⤵
  PID:11776
- C:\Windows\System\SrWZwPl.exe
  C:\Windows\System\SrWZwPl.exe
  2⤵
  PID:11804
- C:\Windows\System\ZNbexyU.exe
  C:\Windows\System\ZNbexyU.exe
  2⤵
  PID:11832
- C:\Windows\System\weYsfGn.exe
  C:\Windows\System\weYsfGn.exe
  2⤵
  PID:11852
- C:\Windows\System\BPrRVFT.exe
  C:\Windows\System\BPrRVFT.exe
  2⤵
  PID:11880
- C:\Windows\System\IevFBPe.exe
  C:\Windows\System\IevFBPe.exe
  2⤵
  PID:11932
- C:\Windows\System\jVhlEwP.exe
  C:\Windows\System\jVhlEwP.exe
  2⤵
  PID:11960
- C:\Windows\System\JKoKuCn.exe
  C:\Windows\System\JKoKuCn.exe
  2⤵
  PID:11984
- C:\Windows\System\NGwGNeb.exe
  C:\Windows\System\NGwGNeb.exe
  2⤵
  PID:12004
- C:\Windows\System\QGhtUgc.exe
  C:\Windows\System\QGhtUgc.exe
  2⤵
  PID:12052
- C:\Windows\System\MiehuRf.exe
  C:\Windows\System\MiehuRf.exe
  2⤵
  PID:12080
- C:\Windows\System\uRSsvzh.exe
  C:\Windows\System\uRSsvzh.exe
  2⤵
  PID:12104
- C:\Windows\System\hvzYmrW.exe
  C:\Windows\System\hvzYmrW.exe
  2⤵
  PID:12124
- C:\Windows\System\PkRSOnI.exe
  C:\Windows\System\PkRSOnI.exe
  2⤵
  PID:12168
- C:\Windows\System\PNvZZDO.exe
  C:\Windows\System\PNvZZDO.exe
  2⤵
  PID:12192
- C:\Windows\System\jRMjJcp.exe
  C:\Windows\System\jRMjJcp.exe
  2⤵
  PID:12212
- C:\Windows\System\phHShWp.exe
  C:\Windows\System\phHShWp.exe
  2⤵
  PID:12240
- C:\Windows\System\hplHHbH.exe
  C:\Windows\System\hplHHbH.exe
  2⤵
  PID:12268
- C:\Windows\System\RyTxSDx.exe
  C:\Windows\System\RyTxSDx.exe
  2⤵
  PID:12284
- C:\Windows\System\cyGFlaR.exe
  C:\Windows\System\cyGFlaR.exe
  2⤵
  PID:11360
- C:\Windows\System\zLjGFox.exe
  C:\Windows\System\zLjGFox.exe
  2⤵
  PID:11412
- C:\Windows\System\ytHAtWe.exe
  C:\Windows\System\ytHAtWe.exe
  2⤵
  PID:11452
- C:\Windows\System\DbvgYFh.exe
  C:\Windows\System\DbvgYFh.exe
  2⤵
  PID:11584
- C:\Windows\System\hQlWCrf.exe
  C:\Windows\System\hQlWCrf.exe
  2⤵
  PID:11596
- C:\Windows\System\Zgdrgtz.exe
  C:\Windows\System\Zgdrgtz.exe
  2⤵
  PID:11624
- C:\Windows\System\EhLizbr.exe
  C:\Windows\System\EhLizbr.exe
  2⤵
  PID:11712
- C:\Windows\System\rtDHpnH.exe
  C:\Windows\System\rtDHpnH.exe
  2⤵
  PID:11800
- C:\Windows\System\IveapEi.exe
  C:\Windows\System\IveapEi.exe
  2⤵
  PID:11872
- C:\Windows\System\pinwdxN.exe
  C:\Windows\System\pinwdxN.exe
  2⤵
  PID:11920
- C:\Windows\System\vELKcvB.exe
  C:\Windows\System\vELKcvB.exe
  2⤵
  PID:11944
- C:\Windows\System\ZEPuoCg.exe
  C:\Windows\System\ZEPuoCg.exe
  2⤵
  PID:12040
- C:\Windows\System\xVZMHjF.exe
  C:\Windows\System\xVZMHjF.exe
  2⤵
  PID:12160
- C:\Windows\System\eLItriW.exe
  C:\Windows\System\eLItriW.exe
  2⤵
  PID:12180
- C:\Windows\System\KYDXIem.exe
  C:\Windows\System\KYDXIem.exe
  2⤵
  PID:12228
- C:\Windows\System\efIQRZW.exe
  C:\Windows\System\efIQRZW.exe
  2⤵
  PID:12264
- C:\Windows\System\InmhcAS.exe
  C:\Windows\System\InmhcAS.exe
  2⤵
  PID:11504
- C:\Windows\System\lDidowY.exe
  C:\Windows\System\lDidowY.exe
  2⤵
  PID:11640
- C:\Windows\System\ACgzfUr.exe
  C:\Windows\System\ACgzfUr.exe
  2⤵
  PID:11824
- C:\Windows\System\DvLUPQn.exe
  C:\Windows\System\DvLUPQn.exe
  2⤵
  PID:11900
- C:\Windows\System\joYyOyS.exe
  C:\Windows\System\joYyOyS.exe
  2⤵
  PID:12000
- C:\Windows\System\FJXqCed.exe
  C:\Windows\System\FJXqCed.exe
  2⤵
  PID:12184
- C:\Windows\System\VcQsrQz.exe
  C:\Windows\System\VcQsrQz.exe
  2⤵
  PID:11276
- C:\Windows\System\SeDTgwO.exe
  C:\Windows\System\SeDTgwO.exe
  2⤵
  PID:11724
- C:\Windows\System\upnzjsL.exe
  C:\Windows\System\upnzjsL.exe
  2⤵
  PID:11500
- C:\Windows\System\ANYpnlp.exe
  C:\Windows\System\ANYpnlp.exe
  2⤵
  PID:11556
- C:\Windows\System\iEYOYaF.exe
  C:\Windows\System\iEYOYaF.exe
  2⤵
  PID:12304
- C:\Windows\System\pNsPhhk.exe
  C:\Windows\System\pNsPhhk.exe
  2⤵
  PID:12328
- C:\Windows\System\KMnCzFi.exe
  C:\Windows\System\KMnCzFi.exe
  2⤵
  PID:12344
- C:\Windows\System\JJiXiaE.exe
  C:\Windows\System\JJiXiaE.exe
  2⤵
  PID:12384
- C:\Windows\System\LYgviBG.exe
  C:\Windows\System\LYgviBG.exe
  2⤵
  PID:12412
- C:\Windows\System\REawGLf.exe
  C:\Windows\System\REawGLf.exe
  2⤵
  PID:12464
- C:\Windows\System\OFGTxmt.exe
  C:\Windows\System\OFGTxmt.exe
  2⤵
  PID:12492
- C:\Windows\System\LcRLspt.exe
  C:\Windows\System\LcRLspt.exe
  2⤵
  PID:12508
- C:\Windows\System\GoOqRDR.exe
  C:\Windows\System\GoOqRDR.exe
  2⤵
  PID:12548
- C:\Windows\System\VWnYTRD.exe
  C:\Windows\System\VWnYTRD.exe
  2⤵
  PID:12564
- C:\Windows\System\zqiEbwI.exe
  C:\Windows\System\zqiEbwI.exe
  2⤵
  PID:12584
- C:\Windows\System\mAnOfjX.exe
  C:\Windows\System\mAnOfjX.exe
  2⤵
  PID:12608
- C:\Windows\System\sECjzFY.exe
  C:\Windows\System\sECjzFY.exe
  2⤵
  PID:12648
- C:\Windows\System\IDRMkhW.exe
  C:\Windows\System\IDRMkhW.exe
  2⤵
  PID:12676
- C:\Windows\System\yzSwUeV.exe
  C:\Windows\System\yzSwUeV.exe
  2⤵
  PID:12716
- C:\Windows\System\fTMfyRK.exe
  C:\Windows\System\fTMfyRK.exe
  2⤵
  PID:12744
- C:\Windows\System\yxkcXID.exe
  C:\Windows\System\yxkcXID.exe
  2⤵
  PID:12776
- C:\Windows\System\wRlZOFX.exe
  C:\Windows\System\wRlZOFX.exe
  2⤵
  PID:12804
- C:\Windows\System\SevaYhl.exe
  C:\Windows\System\SevaYhl.exe
  2⤵
  PID:12824
- C:\Windows\System\wELhEjd.exe
  C:\Windows\System\wELhEjd.exe
  2⤵
  PID:12848
- C:\Windows\System\grTHtxd.exe
  C:\Windows\System\grTHtxd.exe
  2⤵
  PID:12864
- C:\Windows\System\aZZeDdu.exe
  C:\Windows\System\aZZeDdu.exe
  2⤵
  PID:12904
- C:\Windows\System\NdhuEkA.exe
  C:\Windows\System\NdhuEkA.exe
  2⤵
  PID:12936
- C:\Windows\System\eoXjrSC.exe
  C:\Windows\System\eoXjrSC.exe
  2⤵
  PID:12960
- C:\Windows\System\TippPav.exe
  C:\Windows\System\TippPav.exe
  2⤵
  PID:12976
- C:\Windows\System\praJGvb.exe
  C:\Windows\System\praJGvb.exe
  2⤵
  PID:13004
- C:\Windows\System\uVAbmuW.exe
  C:\Windows\System\uVAbmuW.exe
  2⤵
  PID:13024
- C:\Windows\System\eVHLGRZ.exe
  C:\Windows\System\eVHLGRZ.exe
  2⤵
  PID:13048
- C:\Windows\System\vfCtXvf.exe
  C:\Windows\System\vfCtXvf.exe
  2⤵
  PID:13064
- C:\Windows\System\bIHVcCL.exe
  C:\Windows\System\bIHVcCL.exe
  2⤵
  PID:13080
- C:\Windows\System\cDzPDsa.exe
  C:\Windows\System\cDzPDsa.exe
  2⤵
  PID:13112
- C:\Windows\System\cMziXDc.exe
  C:\Windows\System\cMziXDc.exe
  2⤵
  PID:13140
- C:\Windows\System\MJiZzrg.exe
  C:\Windows\System\MJiZzrg.exe
  2⤵
  PID:13200
- C:\Windows\System\yYLjXaV.exe
  C:\Windows\System\yYLjXaV.exe
  2⤵
  PID:13216
- C:\Windows\System\bAnlgRu.exe
  C:\Windows\System\bAnlgRu.exe
  2⤵
  PID:13244
- C:\Windows\System\kGkNRIN.exe
  C:\Windows\System\kGkNRIN.exe
  2⤵
  PID:13272
- C:\Windows\System\xcgXFEI.exe
  C:\Windows\System\xcgXFEI.exe
  2⤵
  PID:12292
- C:\Windows\System\CcFJShR.exe
  C:\Windows\System\CcFJShR.exe
  2⤵
  PID:12336
- C:\Windows\System\fPmobGn.exe
  C:\Windows\System\fPmobGn.exe
  2⤵
  PID:12408
- C:\Windows\System\qOYMeiI.exe
  C:\Windows\System\qOYMeiI.exe
  2⤵
  PID:12480
- C:\Windows\System\AWkTgXV.exe
  C:\Windows\System\AWkTgXV.exe
  2⤵
  PID:12504
- C:\Windows\System\jhzzkHs.exe
  C:\Windows\System\jhzzkHs.exe
  2⤵
  PID:12556
- C:\Windows\System\YmrmdTn.exe
  C:\Windows\System\YmrmdTn.exe
  2⤵
  PID:12672
- C:\Windows\System\qJsgbiI.exe
  C:\Windows\System\qJsgbiI.exe
  2⤵
  PID:12712
- C:\Windows\System\cTVPeTN.exe
  C:\Windows\System\cTVPeTN.exe
  2⤵
  PID:12800
- C:\Windows\System\atgQmPi.exe
  C:\Windows\System\atgQmPi.exe
  2⤵
  PID:12836
- C:\Windows\System\JcHeCZw.exe
  C:\Windows\System\JcHeCZw.exe
  2⤵
  PID:12888
- C:\Windows\System\BCbFohN.exe
  C:\Windows\System\BCbFohN.exe
  2⤵
  PID:12948
- C:\Windows\System\yxdISjt.exe
  C:\Windows\System\yxdISjt.exe
  2⤵
  PID:13016
- C:\Windows\System\LnkggdS.exe
  C:\Windows\System\LnkggdS.exe
  2⤵
  PID:13060
- C:\Windows\System\noqRHVv.exe
  C:\Windows\System\noqRHVv.exe
  2⤵
  PID:13076
- C:\Windows\System\QMIEIFv.exe
  C:\Windows\System\QMIEIFv.exe
  2⤵
  PID:13192
- C:\Windows\System\RuaGMYm.exe
  C:\Windows\System\RuaGMYm.exe
  2⤵
  PID:13236
- C:\Windows\System\UwUvOuT.exe
  C:\Windows\System\UwUvOuT.exe
  2⤵
  PID:12148
- C:\Windows\System\rIursxX.exe
  C:\Windows\System\rIursxX.exe
  2⤵
  PID:12540
- C:\Windows\System\CYyGfeE.exe
  C:\Windows\System\CYyGfeE.exe
  2⤵
  PID:12688
- C:\Windows\System\mFmDVbS.exe
  C:\Windows\System\mFmDVbS.exe
  2⤵
  PID:12856
- C:\Windows\System\EysjSAJ.exe
  C:\Windows\System\EysjSAJ.exe
  2⤵
  PID:12972
- C:\Windows\System\pcaGQIo.exe
  C:\Windows\System\pcaGQIo.exe
  2⤵
  PID:13108
- C:\Windows\System\EBkexHl.exe
  C:\Windows\System\EBkexHl.exe
  2⤵
  PID:13136
- C:\Windows\System\vsCeAob.exe
  C:\Windows\System\vsCeAob.exe
  2⤵
  PID:12460
- C:\Windows\System\EWPfuNm.exe
  C:\Windows\System\EWPfuNm.exe
  2⤵
  PID:12928
- C:\Windows\System\UjRsgmy.exe
  C:\Windows\System\UjRsgmy.exe
  2⤵
  PID:13264
- C:\Windows\System\SPforne.exe
  C:\Windows\System\SPforne.exe
  2⤵
  PID:12844
- C:\Windows\System\tijcwcH.exe
  C:\Windows\System\tijcwcH.exe
  2⤵
  PID:13332
- C:\Windows\System\BVqidav.exe
  C:\Windows\System\BVqidav.exe
  2⤵
  PID:13356
- C:\Windows\System\JuJtuSj.exe
  C:\Windows\System\JuJtuSj.exe
  2⤵
  PID:13384
- C:\Windows\System\DtjHqQk.exe
  C:\Windows\System\DtjHqQk.exe
  2⤵
  PID:13412
- C:\Windows\System\wsWuPNS.exe
  C:\Windows\System\wsWuPNS.exe
  2⤵
  PID:13436
- C:\Windows\System\mjlodGm.exe
  C:\Windows\System\mjlodGm.exe
  2⤵
  PID:13456
- C:\Windows\System\DwoLKlf.exe
  C:\Windows\System\DwoLKlf.exe
  2⤵
  PID:13480
- C:\Windows\System\VrzAbUp.exe
  C:\Windows\System\VrzAbUp.exe
  2⤵
  PID:13516
- C:\Windows\System\vnvSMfA.exe
  C:\Windows\System\vnvSMfA.exe
  2⤵
  PID:13532
- C:\Windows\System\NsEZgcX.exe
  C:\Windows\System\NsEZgcX.exe
  2⤵
  PID:13568
- C:\Windows\System\jRSTBGq.exe
  C:\Windows\System\jRSTBGq.exe
  2⤵
  PID:13596
- C:\Windows\System\oKjPwui.exe
  C:\Windows\System\oKjPwui.exe
  2⤵
  PID:13644
- C:\Windows\System\AmwVsOo.exe
  C:\Windows\System\AmwVsOo.exe
  2⤵
  PID:13684
- C:\Windows\System\mlWbJcG.exe
  C:\Windows\System\mlWbJcG.exe
  2⤵
  PID:13712
- C:\Windows\System\EwzjjIN.exe
  C:\Windows\System\EwzjjIN.exe
  2⤵
  PID:13732
- C:\Windows\System\hBDVUEG.exe
  C:\Windows\System\hBDVUEG.exe
  2⤵
  PID:13752
- C:\Windows\System\SHoGzRx.exe
  C:\Windows\System\SHoGzRx.exe
  2⤵
  PID:13768
- C:\Windows\System\sSQLdPt.exe
  C:\Windows\System\sSQLdPt.exe
  2⤵
  PID:13816
- C:\Windows\System\TIckkOo.exe
  C:\Windows\System\TIckkOo.exe
  2⤵
  PID:13832
- C:\Windows\System\NIfVJie.exe
  C:\Windows\System\NIfVJie.exe
  2⤵
  PID:13852
- C:\Windows\System\eYdSclM.exe
  C:\Windows\System\eYdSclM.exe
  2⤵
  PID:13912
- C:\Windows\System\UUbkNAx.exe
  C:\Windows\System\UUbkNAx.exe
  2⤵
  PID:13936
- C:\Windows\System\CgoYXkF.exe
  C:\Windows\System\CgoYXkF.exe
  2⤵
  PID:13952
- C:\Windows\System\cJcWXsr.exe
  C:\Windows\System\cJcWXsr.exe
  2⤵
  PID:13972
- C:\Windows\System\IFDOytO.exe
  C:\Windows\System\IFDOytO.exe
  2⤵
  PID:13988
- C:\Windows\System\aewybPT.exe
  C:\Windows\System\aewybPT.exe
  2⤵
  PID:14040
- C:\Windows\System\ZlDbtKy.exe
  C:\Windows\System\ZlDbtKy.exe
  2⤵
  PID:14056
- C:\Windows\System\JyGbPIQ.exe
  C:\Windows\System\JyGbPIQ.exe
  2⤵
  PID:14072
- C:\Windows\System\GMPllzU.exe
  C:\Windows\System\GMPllzU.exe
  2⤵
  PID:14096
- C:\Windows\System\wafvOpL.exe
  C:\Windows\System\wafvOpL.exe
  2⤵
  PID:14120
- C:\Windows\System\vhhKuOu.exe
  C:\Windows\System\vhhKuOu.exe
  2⤵
  PID:14160
- C:\Windows\System\InUNSAx.exe
  C:\Windows\System\InUNSAx.exe
  2⤵
  PID:14188
- C:\Windows\System\EbebZyQ.exe
  C:\Windows\System\EbebZyQ.exe
  2⤵
  PID:14212
- C:\Windows\System\ouoGerv.exe
  C:\Windows\System\ouoGerv.exe
  2⤵
  PID:14232
- C:\Windows\System\IsphfWo.exe
  C:\Windows\System\IsphfWo.exe
  2⤵
  PID:14248
- C:\Windows\System\FBFWBNl.exe
  C:\Windows\System\FBFWBNl.exe
  2⤵
  PID:14272
- C:\Windows\System\ByALgTg.exe
  C:\Windows\System\ByALgTg.exe
  2⤵
  PID:14296
- C:\Windows\System\wUiQqWa.exe
  C:\Windows\System\wUiQqWa.exe
  2⤵
  PID:14312
- C:\Windows\System\GoWwPYY.exe
  C:\Windows\System\GoWwPYY.exe
  2⤵
  PID:12248
- C:\Windows\System\ZkrjqSx.exe
  C:\Windows\System\ZkrjqSx.exe
  2⤵
  PID:12760
- C:\Windows\System\PsIMQGV.exe
  C:\Windows\System\PsIMQGV.exe
  2⤵
  PID:13392
- C:\Windows\System\DaYGXaF.exe
  C:\Windows\System\DaYGXaF.exe
  2⤵
  PID:13420
- C:\Windows\System\VFzdVKn.exe
  C:\Windows\System\VFzdVKn.exe
  2⤵
  PID:13468
- C:\Windows\System\wLGpeHp.exe
  C:\Windows\System\wLGpeHp.exe
  2⤵
  PID:13504
- C:\Windows\System\EgcPLZK.exe
  C:\Windows\System\EgcPLZK.exe
  2⤵
  PID:13632
- C:\Windows\System\wqdAsly.exe
  C:\Windows\System\wqdAsly.exe
  2⤵
  PID:13592
- C:\Windows\System\HQgTGHm.exe
  C:\Windows\System\HQgTGHm.exe
  2⤵
  PID:13696
- C:\Windows\System\kaBsajY.exe
  C:\Windows\System\kaBsajY.exe
  2⤵
  PID:13740
- C:\Windows\System\vnDtAve.exe
  C:\Windows\System\vnDtAve.exe
  2⤵
  PID:13784
- C:\Windows\System\GJFixHX.exe
  C:\Windows\System\GJFixHX.exe
  2⤵
  PID:13828
- C:\Windows\System\jxfZLqS.exe
  C:\Windows\System\jxfZLqS.exe
  2⤵
  PID:13888
- C:\Windows\System\HnTtaLx.exe
  C:\Windows\System\HnTtaLx.exe
  2⤵
  PID:13928
- C:\Windows\System\dgHxWzZ.exe
  C:\Windows\System\dgHxWzZ.exe
  2⤵
  PID:13968
- C:\Windows\System\cnPkGDk.exe
  C:\Windows\System\cnPkGDk.exe
  2⤵
  PID:14028
- C:\Windows\System\uhfCmPP.exe
  C:\Windows\System\uhfCmPP.exe
  2⤵
  PID:14092
- C:\Windows\System\AJkboxL.exe
  C:\Windows\System\AJkboxL.exe
  2⤵
  PID:14064
- C:\Windows\System\qiHOEat.exe
  C:\Windows\System\qiHOEat.exe
  2⤵
  PID:14228
- C:\Windows\System\OQGnYhC.exe
  C:\Windows\System\OQGnYhC.exe
  2⤵
  PID:14196
- C:\Windows\System\GUGKRyz.exe
  C:\Windows\System\GUGKRyz.exe
  2⤵
  PID:14308
- C:\Windows\System\UiIxMkf.exe
  C:\Windows\System\UiIxMkf.exe
  2⤵
  PID:13316
- C:\Windows\System\aBoFDNW.exe
  C:\Windows\System\aBoFDNW.exe
  2⤵
  PID:13320
- C:\Windows\System\sYznAwv.exe
  C:\Windows\System\sYznAwv.exe
  2⤵
  PID:13408
- C:\Windows\System\DgTVItf.exe
  C:\Windows\System\DgTVItf.exe
  2⤵
  PID:13492
- C:\Windows\System\TBOnRTT.exe
  C:\Windows\System\TBOnRTT.exe
  2⤵
  PID:13808
- C:\Windows\System\FBwOsST.exe
  C:\Windows\System\FBwOsST.exe
  2⤵
  PID:13944
- C:\Windows\System\uimtcqV.exe
  C:\Windows\System\uimtcqV.exe
  2⤵
  PID:14048
- C:\Windows\System\FKKPpuu.exe
  C:\Windows\System\FKKPpuu.exe
  2⤵
  PID:13824
- C:\Windows\System\LWaCyBd.exe
  C:\Windows\System\LWaCyBd.exe
  2⤵
  PID:14352
- C:\Windows\System\mxZrlCu.exe
  C:\Windows\System\mxZrlCu.exe
  2⤵
  PID:14376
- C:\Windows\System\GPkSjRV.exe
  C:\Windows\System\GPkSjRV.exe
  2⤵
  PID:14400
- C:\Windows\System\IDXrNSE.exe
  C:\Windows\System\IDXrNSE.exe
  2⤵
  PID:14424
- C:\Windows\System\IoqtLYM.exe
  C:\Windows\System\IoqtLYM.exe
  2⤵
  PID:14448
- C:\Windows\System\iZyBDuN.exe
  C:\Windows\System\iZyBDuN.exe
  2⤵
  PID:14464
- C:\Windows\System\SdVjwBS.exe
  C:\Windows\System\SdVjwBS.exe
  2⤵
  PID:14484
- C:\Windows\System\BFcZebZ.exe
  C:\Windows\System\BFcZebZ.exe
  2⤵
  PID:14508
- C:\Windows\System\sBTeJVC.exe
  C:\Windows\System\sBTeJVC.exe
  2⤵
  PID:14532
- C:\Windows\System\ATzgqtD.exe
  C:\Windows\System\ATzgqtD.exe
  2⤵
  PID:14560
- C:\Windows\System\LFaEmrO.exe
  C:\Windows\System\LFaEmrO.exe
  2⤵
  PID:14592
- C:\Windows\System\edNbMmd.exe
  C:\Windows\System\edNbMmd.exe
  2⤵
  PID:14892
- C:\Windows\System\jaCkBVF.exe
  C:\Windows\System\jaCkBVF.exe
  2⤵
  PID:14924
- C:\Windows\System\hBXVrTF.exe
  C:\Windows\System\hBXVrTF.exe
  2⤵
  PID:14960
- C:\Windows\System\pKMKqjh.exe
  C:\Windows\System\pKMKqjh.exe
  2⤵
  PID:14984
- C:\Windows\System\PghugcY.exe
  C:\Windows\System\PghugcY.exe
  2⤵
  PID:15008
- C:\Windows\System\waGnfoI.exe
  C:\Windows\System\waGnfoI.exe
  2⤵
  PID:15028
- C:\Windows\System\PYIqevn.exe
  C:\Windows\System\PYIqevn.exe
  2⤵
  PID:15052
- C:\Windows\System\NUzRkXo.exe
  C:\Windows\System\NUzRkXo.exe
  2⤵
  PID:15072
- C:\Windows\System\zLjsRNB.exe
  C:\Windows\System\zLjsRNB.exe
  2⤵
  PID:15092
- C:\Windows\System\aSupVAQ.exe
  C:\Windows\System\aSupVAQ.exe
  2⤵
  PID:15108
- C:\Windows\System\TADHAIK.exe
  C:\Windows\System\TADHAIK.exe
  2⤵
  PID:15144
- C:\Windows\System\IvrEmRq.exe
  C:\Windows\System\IvrEmRq.exe
  2⤵
  PID:15168
- C:\Windows\System\qDCOQNX.exe
  C:\Windows\System\qDCOQNX.exe
  2⤵
  PID:15196
- C:\Windows\System\Hpnxljx.exe
  C:\Windows\System\Hpnxljx.exe
  2⤵
  PID:15212
- C:\Windows\System\pkaaRZh.exe
  C:\Windows\System\pkaaRZh.exe
  2⤵
  PID:15228
- C:\Windows\System\ITCwIpB.exe
  C:\Windows\System\ITCwIpB.exe
  2⤵
  PID:15248
- C:\Windows\System\RCYFaPR.exe
  C:\Windows\System\RCYFaPR.exe
  2⤵
  PID:15264
- C:\Windows\System\YvGxPbA.exe
  C:\Windows\System\YvGxPbA.exe
  2⤵
  PID:15280
- C:\Windows\System\mDJMHOa.exe
  C:\Windows\System\mDJMHOa.exe
  2⤵
  PID:15296
- C:\Windows\System\zEPSnZo.exe
  C:\Windows\System\zEPSnZo.exe
  2⤵
  PID:15328
- C:\Windows\System\QKygGew.exe
  C:\Windows\System\QKygGew.exe
  2⤵
  PID:15348
- C:\Windows\System\ZNcuuCP.exe
  C:\Windows\System\ZNcuuCP.exe
  2⤵
  PID:13640
- C:\Windows\System\RIyLGbz.exe
  C:\Windows\System\RIyLGbz.exe
  2⤵
  PID:13472
- C:\Windows\System\wdPRHHE.exe
  C:\Windows\System\wdPRHHE.exe
  2⤵
  PID:14152
- C:\Windows\System\NxQVQIp.exe
  C:\Windows\System\NxQVQIp.exe
  2⤵
  PID:13760
- C:\Windows\System\wpOzfvJ.exe
  C:\Windows\System\wpOzfvJ.exe
  2⤵
  PID:14444
- C:\Windows\System\JELMLWa.exe
  C:\Windows\System\JELMLWa.exe
  2⤵
  PID:13884
- C:\Windows\System\YfeaPAl.exe
  C:\Windows\System\YfeaPAl.exe
  2⤵
  PID:14600
- C:\Windows\System\juguYWV.exe
  C:\Windows\System\juguYWV.exe
  2⤵
  PID:14620
- C:\Windows\System\JPzUBYo.exe
  C:\Windows\System\JPzUBYo.exe
  2⤵
  PID:14436
- C:\Windows\System\MdwRXFr.exe
  C:\Windows\System\MdwRXFr.exe
  2⤵
  PID:14456
- C:\Windows\System\YBtWVgD.exe
  C:\Windows\System\YBtWVgD.exe
  2⤵
  PID:14368
- C:\Windows\System\AZXhAyy.exe
  C:\Windows\System\AZXhAyy.exe
  2⤵
  PID:14496
- C:\Windows\System\khrTuGj.exe
  C:\Windows\System\khrTuGj.exe
  2⤵
  PID:14680
- C:\Windows\System\WucwSGk.exe
  C:\Windows\System\WucwSGk.exe
  2⤵
  PID:14728
- C:\Windows\System\lPDdpZz.exe
  C:\Windows\System\lPDdpZz.exe
  2⤵
  PID:14604
- C:\Windows\System\eESDnXD.exe
  C:\Windows\System\eESDnXD.exe
  2⤵
  PID:14932
- C:\Windows\System\VMGgblE.exe
  C:\Windows\System\VMGgblE.exe
  2⤵
  PID:14900
- C:\Windows\System\Bitlany.exe
  C:\Windows\System\Bitlany.exe
  2⤵
  PID:14944
- C:\Windows\System\lEmcvYm.exe
  C:\Windows\System\lEmcvYm.exe
  2⤵
  PID:15128
- C:\Windows\System\tlNqPDv.exe
  C:\Windows\System\tlNqPDv.exe
  2⤵
  PID:15060
- C:\Windows\System\qtnNHhh.exe
  C:\Windows\System\qtnNHhh.exe
  2⤵
  PID:15224
- C:\Windows\System\UknUaQF.exe
  C:\Windows\System\UknUaQF.exe
  2⤵
  PID:15160
- C:\Windows\System\jBZngXe.exe
  C:\Windows\System\jBZngXe.exe
  2⤵
  PID:15188
- C:\Windows\System\Yryserj.exe
  C:\Windows\System\Yryserj.exe
  2⤵
  PID:15324
- C:\Windows\System\WRnXcRu.exe
  C:\Windows\System\WRnXcRu.exe
  2⤵
  PID:14268
- C:\Windows\System\aZPprcB.exe
  C:\Windows\System\aZPprcB.exe
  2⤵
  PID:15356
- C:\Windows\System\DvuNHMS.exe
  C:\Windows\System\DvuNHMS.exe
  2⤵
  PID:13984
- C:\Windows\System\CxTnNaw.exe
  C:\Windows\System\CxTnNaw.exe
  2⤵
  PID:14364
- C:\Windows\System\NejnVVS.exe
  C:\Windows\System\NejnVVS.exe
  2⤵
  PID:14528
- C:\Windows\System\wmpFEjb.exe
  C:\Windows\System\wmpFEjb.exe
  2⤵
  PID:13328
- C:\Windows\System\HSvNAPC.exe
  C:\Windows\System\HSvNAPC.exe
  2⤵
  PID:13904
- C:\Windows\System\ELDzkeG.exe
  C:\Windows\System\ELDzkeG.exe
  2⤵
  PID:15368
- C:\Windows\System\aFCXHBP.exe
  C:\Windows\System\aFCXHBP.exe
  2⤵
  PID:15384
- C:\Windows\System\YgpsqBs.exe
  C:\Windows\System\YgpsqBs.exe
  2⤵
  PID:15400
- C:\Windows\System\HFWemQq.exe
  C:\Windows\System\HFWemQq.exe
  2⤵
  PID:15416
- C:\Windows\System\FpYciFM.exe
  C:\Windows\System\FpYciFM.exe
  2⤵
  PID:15432
- C:\Windows\System\rOavSiO.exe
  C:\Windows\System\rOavSiO.exe
  2⤵
  PID:15452
- C:\Windows\System\azdivNP.exe
  C:\Windows\System\azdivNP.exe
  2⤵
  PID:15472
- C:\Windows\System\ShsRxLk.exe
  C:\Windows\System\ShsRxLk.exe
  2⤵
  PID:15500
- C:\Windows\System\VrKCLlu.exe
  C:\Windows\System\VrKCLlu.exe
  2⤵
  PID:15516
- C:\Windows\System\xdGlzbD.exe
  C:\Windows\System\xdGlzbD.exe
  2⤵
  PID:15532
- C:\Windows\System\AEkcaxe.exe
  C:\Windows\System\AEkcaxe.exe
  2⤵
  PID:15548
- C:\Windows\System\qjGkYxs.exe
  C:\Windows\System\qjGkYxs.exe
  2⤵
  PID:15576
- C:\Windows\System\vVIfLbr.exe
  C:\Windows\System\vVIfLbr.exe
  2⤵
  PID:15600
- C:\Windows\System\EbUPMDL.exe
  C:\Windows\System\EbUPMDL.exe
  2⤵
  PID:15616
- C:\Windows\System\NWlsHYe.exe
  C:\Windows\System\NWlsHYe.exe
  2⤵
  PID:15632
- C:\Windows\System\yahJBxB.exe
  C:\Windows\System\yahJBxB.exe
  2⤵
  PID:15656
- C:\Windows\System\AdgFwgF.exe
  C:\Windows\System\AdgFwgF.exe
  2⤵
  PID:15680
- C:\Windows\System\pubUAyU.exe
  C:\Windows\System\pubUAyU.exe
  2⤵
  PID:15712
- C:\Windows\System\hkBihfw.exe
  C:\Windows\System\hkBihfw.exe
  2⤵
  PID:15732
- C:\Windows\System\ABTEnaV.exe
  C:\Windows\System\ABTEnaV.exe
  2⤵
  PID:15760
- C:\Windows\System\QxYAkEo.exe
  C:\Windows\System\QxYAkEo.exe
  2⤵
  PID:15780
- C:\Windows\System\gquFORY.exe
  C:\Windows\System\gquFORY.exe
  2⤵
  PID:15804
- C:\Windows\System\BmXaCuT.exe
  C:\Windows\System\BmXaCuT.exe
  2⤵
  PID:15828
- C:\Windows\System\VtjjjoP.exe
  C:\Windows\System\VtjjjoP.exe
  2⤵
  PID:15848
- C:\Windows\System\eGbvUQS.exe
  C:\Windows\System\eGbvUQS.exe
  2⤵
  PID:15872
- C:\Windows\System\eBbXKhq.exe
  C:\Windows\System\eBbXKhq.exe
  2⤵
  PID:15888
- C:\Windows\System\QMOwblV.exe
  C:\Windows\System\QMOwblV.exe
  2⤵
  PID:15908
- C:\Windows\System\dVZvPgE.exe
  C:\Windows\System\dVZvPgE.exe
  2⤵
  PID:15928
- C:\Windows\System\QrFCBAb.exe
  C:\Windows\System\QrFCBAb.exe
  2⤵
  PID:15944
- C:\Windows\System\XeOunAP.exe
  C:\Windows\System\XeOunAP.exe
  2⤵
  PID:15960
- C:\Windows\System\adfnqpp.exe
  C:\Windows\System\adfnqpp.exe
  2⤵
  PID:15976
- C:\Windows\System\SyGuDlN.exe
  C:\Windows\System\SyGuDlN.exe
  2⤵
  PID:15992
- C:\Windows\System\eWyZKuA.exe
  C:\Windows\System\eWyZKuA.exe
  2⤵
  PID:16008
- C:\Windows\System\ObrpCvm.exe
  C:\Windows\System\ObrpCvm.exe
  2⤵
  PID:16032
- C:\Windows\System\xWNcKpV.exe
  C:\Windows\System\xWNcKpV.exe
  2⤵
  PID:16056
- C:\Windows\System\rIOxcDz.exe
  C:\Windows\System\rIOxcDz.exe
  2⤵
  PID:16076
- C:\Windows\System\kBTqphZ.exe
  C:\Windows\System\kBTqphZ.exe
  2⤵
  PID:16092
- C:\Windows\System\jejfful.exe
  C:\Windows\System\jejfful.exe
  2⤵
  PID:16116
- C:\Windows\System\xupTatU.exe
  C:\Windows\System\xupTatU.exe
  2⤵
  PID:16140
- C:\Windows\System\JXODiXV.exe
  C:\Windows\System\JXODiXV.exe
  2⤵
  PID:16160
- C:\Windows\System\sBnyAtA.exe
  C:\Windows\System\sBnyAtA.exe
  2⤵
  PID:16184
- C:\Windows\System\kgHudcP.exe
  C:\Windows\System\kgHudcP.exe
  2⤵
  PID:16212
- C:\Windows\System\Fatncqn.exe
  C:\Windows\System\Fatncqn.exe
  2⤵
  PID:16228
- C:\Windows\System\CdpLOiJ.exe
  C:\Windows\System\CdpLOiJ.exe
  2⤵
  PID:16244
- C:\Windows\System\SdKYcUe.exe
  C:\Windows\System\SdKYcUe.exe
  2⤵
  PID:16260
- C:\Windows\System\okbyYDV.exe
  C:\Windows\System\okbyYDV.exe
  2⤵
  PID:16276
- C:\Windows\System\gvoKsJr.exe
  C:\Windows\System\gvoKsJr.exe
  2⤵
  PID:16292
- C:\Windows\System\oVPBfGK.exe
  C:\Windows\System\oVPBfGK.exe
  2⤵
  PID:16320
- C:\Windows\System\eUJggMR.exe
  C:\Windows\System\eUJggMR.exe
  2⤵
  PID:16336
- C:\Windows\System\BTffNuE.exe
  C:\Windows\System\BTffNuE.exe
  2⤵
  PID:16364
- C:\Windows\System\Nkgxpxn.exe
  C:\Windows\System\Nkgxpxn.exe
  2⤵
  PID:16380
- C:\Windows\System\FbfrXIS.exe
  C:\Windows\System\FbfrXIS.exe
  2⤵
  PID:15140
- C:\Windows\System\UqAmdFt.exe
  C:\Windows\System\UqAmdFt.exe
  2⤵
  PID:14132
- C:\Windows\System\UNjHxkn.exe
  C:\Windows\System\UNjHxkn.exe
  2⤵
  PID:14420
- C:\Windows\System\RIWANer.exe
  C:\Windows\System\RIWANer.exe
  2⤵
  PID:14556
- C:\Windows\System\tfmAGoe.exe
  C:\Windows\System\tfmAGoe.exe
  2⤵
  PID:14816
- C:\Windows\System\IvRYQow.exe
  C:\Windows\System\IvRYQow.exe
  2⤵
  PID:15316
- C:\Windows\System\bmZEPdi.exe
  C:\Windows\System\bmZEPdi.exe
  2⤵
  PID:14088
- C:\Windows\System\dpLhqZe.exe
  C:\Windows\System\dpLhqZe.exe
  2⤵
  PID:14396
- C:\Windows\System\TIUyVrx.exe
  C:\Windows\System\TIUyVrx.exe
  2⤵
  PID:15628
- C:\Windows\System\dKEWldz.exe
  C:\Windows\System\dKEWldz.exe
  2⤵
  PID:14288
- C:\Windows\System\Tjpkgwc.exe
  C:\Windows\System\Tjpkgwc.exe
  2⤵
  PID:14348
- C:\Windows\System\tZcssvY.exe
  C:\Windows\System\tZcssvY.exe
  2⤵
  PID:15744
- C:\Windows\System\gppmDGS.exe
  C:\Windows\System\gppmDGS.exe
  2⤵
  PID:15820
- C:\Windows\System\RZiODZD.exe
  C:\Windows\System\RZiODZD.exe
  2⤵
  PID:15120
- C:\Windows\System\eCovEOT.exe
  C:\Windows\System\eCovEOT.exe
  2⤵
  PID:15916
- C:\Windows\System\moCVJSe.exe
  C:\Windows\System\moCVJSe.exe
  2⤵
  PID:15956
- C:\Windows\System\HNLiFKM.exe
  C:\Windows\System\HNLiFKM.exe
  2⤵
  PID:15508
- C:\Windows\System\OXtNdFr.exe
  C:\Windows\System\OXtNdFr.exe
  2⤵
  PID:16000
- C:\Windows\System\ufUyjyH.exe
  C:\Windows\System\ufUyjyH.exe
  2⤵
  PID:15584
- C:\Windows\System\xUzGyQW.exe
  C:\Windows\System\xUzGyQW.exe
  2⤵
  PID:16400
- C:\Windows\System\DVQspjd.exe
  C:\Windows\System\DVQspjd.exe
  2⤵
  PID:16428
- C:\Windows\System\jHuRdxv.exe
  C:\Windows\System\jHuRdxv.exe
  2⤵
  PID:16452
- C:\Windows\System\mIIaEhB.exe
  C:\Windows\System\mIIaEhB.exe
  2⤵
  PID:16468
- C:\Windows\System\NgucNbb.exe
  C:\Windows\System\NgucNbb.exe
  2⤵
  PID:16484
- C:\Windows\System\PiJqNzD.exe
  C:\Windows\System\PiJqNzD.exe
  2⤵
  PID:16500
- C:\Windows\System\lcBksRU.exe
  C:\Windows\System\lcBksRU.exe
  2⤵
  PID:16516
- C:\Windows\System\aEartPA.exe
  C:\Windows\System\aEartPA.exe
  2⤵
  PID:16532
- C:\Windows\System\rEzBwwb.exe
  C:\Windows\System\rEzBwwb.exe
  2⤵
  PID:16548
- C:\Windows\System\TxzxWIE.exe
  C:\Windows\System\TxzxWIE.exe
  2⤵
  PID:16572
- C:\Windows\System\wUuEhlb.exe
  C:\Windows\System\wUuEhlb.exe
  2⤵
  PID:16588
- C:\Windows\System\kfIUmLd.exe
  C:\Windows\System\kfIUmLd.exe
  2⤵
  PID:16612
- C:\Windows\System\kjzSuAA.exe
  C:\Windows\System\kjzSuAA.exe
  2⤵
  PID:16628
- C:\Windows\System\dkCyNMg.exe
  C:\Windows\System\dkCyNMg.exe
  2⤵
  PID:16644
- C:\Windows\System\ZrtkGAO.exe
  C:\Windows\System\ZrtkGAO.exe
  2⤵
  PID:16668
- C:\Windows\System\WGvOwFX.exe
  C:\Windows\System\WGvOwFX.exe
  2⤵
  PID:16684
- C:\Windows\System\oRVjxgJ.exe
  C:\Windows\System\oRVjxgJ.exe
  2⤵
  PID:16708
- C:\Windows\System\PSwaSiU.exe
  C:\Windows\System\PSwaSiU.exe
  2⤵
  PID:16724
- C:\Windows\System\bjULbTR.exe
  C:\Windows\System\bjULbTR.exe
  2⤵
  PID:16740
- C:\Windows\System\kKPWXTp.exe
  C:\Windows\System\kKPWXTp.exe
  2⤵
  PID:16760
- C:\Windows\System\MHLrfTM.exe
  C:\Windows\System\MHLrfTM.exe
  2⤵
  PID:16776
- C:\Windows\System\lJidtDY.exe
  C:\Windows\System\lJidtDY.exe
  2⤵
  PID:16792
- C:\Windows\System\PAWTRIw.exe
  C:\Windows\System\PAWTRIw.exe
  2⤵
  PID:16816
- C:\Windows\System\vUaXIqp.exe
  C:\Windows\System\vUaXIqp.exe
  2⤵
  PID:16832
- C:\Windows\System\kwYYADN.exe
  C:\Windows\System\kwYYADN.exe
  2⤵
  PID:16868
- C:\Windows\System\xjTvsPR.exe
  C:\Windows\System\xjTvsPR.exe
  2⤵
  PID:16884
- C:\Windows\System\GkhFlxN.exe
  C:\Windows\System\GkhFlxN.exe
  2⤵
  PID:16908
- C:\Windows\System\CewazjW.exe
  C:\Windows\System\CewazjW.exe
  2⤵
  PID:16936
- C:\Windows\System\tfxCYgu.exe
  C:\Windows\System\tfxCYgu.exe
  2⤵
  PID:16952
- C:\Windows\System\rBdEMrk.exe
  C:\Windows\System\rBdEMrk.exe
  2⤵
  PID:16968
- C:\Windows\System\DVnrfwE.exe
  C:\Windows\System\DVnrfwE.exe
  2⤵
  PID:16984
- C:\Windows\System\WDRYNTA.exe
  C:\Windows\System\WDRYNTA.exe
  2⤵
  PID:17004
- C:\Windows\System\vxGkSAr.exe
  C:\Windows\System\vxGkSAr.exe
  2⤵
  PID:17032
- C:\Windows\System\xHeIaTQ.exe
  C:\Windows\System\xHeIaTQ.exe
  2⤵
  PID:17048
- C:\Windows\System\DZNZzPD.exe
  C:\Windows\System\DZNZzPD.exe
  2⤵
  PID:17068
- C:\Windows\System\VXjKQEI.exe
  C:\Windows\System\VXjKQEI.exe
  2⤵
  PID:17084

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:15760

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:16452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BiizDrm.exe

Filesize
1.1MB

MD5
f50527c6c31bb1f27407081cf31423a1

SHA1
6381942ee7ac5b0913809600741c51484967ea0a

SHA256
bdde8a5a14bf7d4194d3d9f7b07a74c35e5154a5e1d8f57fe88fdd6f4168a71a

SHA512
ee1c0ba17dedc1ced4418fe84bc44bfd32e55d229ddcb077796e401932ca58e6f487647472715b2ce7253892d142e9d34b2e8cd83bce7bae72ef3710c1d9ff9f

Download Submit
C:\Windows\System\CHvniFx.exe

Filesize
1.1MB

MD5
b955079845ac24b2aacf74957817c4c1

SHA1
6ebdb99e3cf2fb5bb25a7ee7fdc85b2e928efeeb

SHA256
8d66d51da3ae134ef2ea6c96129358ea3f7e37fe733d488e21bde671e787a75b

SHA512
518b924fb3b2e912f50f96856d905cc78456ee2431d71ebc7a65c0fe81d517f90dba94be8c6d55c60903bd520487e97c2996107f6fcef207dd8c60a2cc7f1e25

Download Submit
C:\Windows\System\CIZoLiE.exe

Filesize
1.1MB

MD5
a809249c0819c7f70cb5b15983181594

SHA1
60253b7ccf7cba660a7541ff66e87dd91f3c4255

SHA256
35557532f4c33f293870e41159dc2d2866dc12ca7e898ac0f595eb1472481c92

SHA512
a1893785c0ac44cf5d399581f1ec69881fbe51f5ac963285c92e8fa2954c4c26eec8db0edd089cb028ff87f384488568511efa8538e44960700197ff9f040e06

Download Submit
C:\Windows\System\DLJEeIZ.exe

Filesize
1.1MB

MD5
b3d88965b76381d507b1335ee662e29b

SHA1
d4d82177f2753a119110166c4fe7a4a1ae17e0d7

SHA256
027a5558a3c884a6eea1e4e0ab88bf0e18f92b0759e3ede4fc6b7c11c558616f

SHA512
30c79b9e5f0c74bbbb3b54c230eace344030a10cfd050129e8badcac7e9f58e0c848b6fa15cef4db959b4c525713190ca276e42610103c6a9a738228031d3a04

Download Submit
C:\Windows\System\FJAcNsN.exe

Filesize
1.1MB

MD5
bec2f5cdc3a59e82efeff7871ce66be1

SHA1
ea83f412140660e01b10b2891c9e37694ab568d5

SHA256
49e787e0300d8d253b270359e0bac8c7758a3850f346812b552f68e8dff55a0d

SHA512
4bdc730c4d894c4b0dbbf20bf928d031545da644badff6c5938d7b1a33879f349c9dfff1626de7f8b3e4d945fa726f347a56f5485f052bdc2d37134371ea2985

Download Submit
C:\Windows\System\JyJsoOr.exe

Filesize
1.1MB

MD5
df4fceb853472d4947096f1a91401080

SHA1
7b6e37753c42f23998922bdcb882009ac03877ca

SHA256
05767ecbfa713ba7dcd85baeec4606d72f3643db8ebd81c044c401fab0162729

SHA512
22d98f4e9992c3fae2c87e24b6dc9c264ef3332294e652892c0dfab5e77a35acb84619254f14d5e71e8e6cc40f4bbfc394606135a525b8e067945381e40df5df

Download Submit
C:\Windows\System\KHZgdoB.exe

Filesize
1.1MB

MD5
1814a001be2498b2fdafe32e35841830

SHA1
9ac1a8f0d52c363dc8f3663a6088d229919c02b1

SHA256
c900d33a7e3f0e0f5bb77eec1a9db8a4b81f374ca77681553d44b5ed0ab404f3

SHA512
c22cf3e836df9e09c37df2ace8275770796c77a62003217d9b6a1cfeef15ad2dfc637a660e8ef898a5fc6806a894528d86fe3fa460e587efdfb8e62bdd938248

Download Submit
C:\Windows\System\LQCwSJo.exe

Filesize
1.1MB

MD5
a41b6216eade8628a16b99f423a06bbb

SHA1
89d54ce55e9f55ba69eb29075f431dfe5da3eeca

SHA256
b26f5bf0a6de5f5f45f1256b9942d5859c3f117b3993340fa90d0a4178182e6b

SHA512
fb0cee5e46a4d5db5f38b6f598e7bbb1072ae68aff84d130ab199b5073bfb62f5c9cd44f3d6eff31efbbb3f5c726d86f3ca892fec47e23de75c5ed309931aeb5

Download Submit
C:\Windows\System\MXeiwgB.exe

Filesize
1.1MB

MD5
2c566f1717bb53cdc0a0d99cd5b71308

SHA1
cd2840c2ae3d76a646f0b77652ae60a72667c73e

SHA256
57ae9e68727ce3b6a7e3ef897e9e2fe21bb7b340d8b94a29c31ba18b2df57271

SHA512
c7c5b4b282f76ce2811922f844c2db56cedc27f0b6a6f9fc75d469ff09e36b00369fcfd05a429ec1d6a53c5099316d4ad8277b8590ae20e0e7c6e74a6c9a85e7

Download Submit
C:\Windows\System\NBaRQzX.exe

Filesize
1.1MB

MD5
129af3d31b935b11c9b80e56ddba826a

SHA1
92e07caaf7f937cceee57901160b41090b566af7

SHA256
bcacfd0381939ec81d7b5abb5120079e2b1a259ab9e99e386beb21aebe37c418

SHA512
a8ded99301f4613cc1ebb2cbf5fd60fdc2ddca4df0de053a15d6e66c2867eeaf6fd24b02572911ef8b8d150ef07a243cd135000d50616e206242b112432352d2

Download Submit
C:\Windows\System\OTcNZaU.exe

Filesize
1.1MB

MD5
c81187d6e19ed78f6bf4f7551913c4df

SHA1
0ceb12bd5fe34ceebc6d1c6dae25e9759c8c8d4f

SHA256
c62936a41ae5edb2a262ff12664008c039b92cb94676bfb97945e525c15bdeaf

SHA512
29ef82d0b9f4de96a972fc884554945ddccdd63a484bc63a751731d40ba646e192ef52d6f204876413d3d065fda04c25d8a6e0411e1d9ecaa337b7831a48a8de

Download Submit
C:\Windows\System\QjVXXfi.exe

Filesize
1.1MB

MD5
1f14a4393fa4888e6cdf035b0fee494a

SHA1
b381cb4ed81ec542e6a3b35a543aaead35cbea77

SHA256
89ad27658ca66d618523eab61494a804a3c4187b4d2e306b8e70506d271a8ce7

SHA512
cf8b7725820307aa6d99b7ad16b0fcd86571200ef7b0ed0631c3f0c8c22ee1609523a61c565c1d8ca13c9068c9575bade91209e004307ddab3f6e1dd471c8125

Download Submit
C:\Windows\System\RFaaoSz.exe

Filesize
1.1MB

MD5
4e7a7850c18d138f614c8156c5596e35

SHA1
92f6403e979dbd3991bd6616f7c273098f9dd70f

SHA256
47f3d6c2d097f356b8cb59b329ca7b00ec62eef2c91548d85754bbc05251266a

SHA512
f3aae24a2b7c3bbbd4f0a8ca83fec7514c341c52fa73c40b79958e657ae6d1dac49248486f892c823b88c1b332fabd01727f87e283e48107cbdeca9d151b3556

Download Submit
C:\Windows\System\SZtQCXb.exe

Filesize
1.1MB

MD5
d8a2a332991b0cfd47c06d0dbc46b071

SHA1
89646f1208fd5ce243afef996f66136bb99b1b87

SHA256
eb07a1de8693c1b6d356482cd19f6a5dc76306a424ca526253f474b509c0c93f

SHA512
660fe8f16c3eee3504d8ee767895b22f9fe2530093b934436fcada0eb4c8dab1c4dfc6351bb252e88f48f9081cfac19929d1127cd7c9ab01c5e30a7a3324b424

Download Submit
C:\Windows\System\UGwurJX.exe

Filesize
1.1MB

MD5
74bc3b01acecc90ae7b7e5fad343eb74

SHA1
596458b5082def78b33fc775b20b7ca4aacd25ad

SHA256
d5346851509c5df0e43eb29a34598f23b4198504b17876878d4e7fc0b8f215ea

SHA512
ecfcde88bd6ceebf2465a39bec41ced8f3d9136ab9bbe26cfe2615f89d9912c7bdd660d9209a8910707d8dc3e559ad036336a5f9d5c2a707d0c18be191b888e8

Download Submit
C:\Windows\System\VtyFzEd.exe

Filesize
1.1MB

MD5
850e217816164539adc4150f337f4efc

SHA1
63adb76b7dadbfa35fd64caa84457bb0a5732930

SHA256
cadf344f8fbfd889ef7d32a4e1e9cfbe9a935847b832bd274ce99e13b28515f7

SHA512
69faf1799015b598046e2c3bd79bb46e33064493544ac0487666cdfdd333909446e946695de11abdf85969ea031e964321c82bff54817347ee911235b6a58ff1

Download Submit
C:\Windows\System\XBwhgdS.exe

Filesize
1.1MB

MD5
57a53641b0427f12306b981ec22c032e

SHA1
f96789116f5ca0bb3eb42675401b993853530fe0

SHA256
dc1ec90b32261c0803fbf474ea93b4b7b3b46884759c89c3a51d90d023f1d9cd

SHA512
d9c0985fe390611d2ad1f01ae18aeaae3a961dbfbfb9e526505d7e417199ab2ee1f0041e7603d9bcbc6f4f114c0ad7931d23d8f32b6b8eab79eb4d40c9e08a10

Download Submit
C:\Windows\System\XuSnKOM.exe

Filesize
1.1MB

MD5
1335d87286244142e30ad5f36b2f094f

SHA1
33d6eb031ee9b020ff66e4676faba0d9695206d8

SHA256
2c2b757edc21ea54d8f4af59dd3b6921c0148eb710ddb6c8c9468f99a39ec34c

SHA512
8694d3b49eda30b2dd78a11eae8de261a1f9075f3578cff942ebd2b02eb605f1a61de433b2edcd1669271e8a54099dd58edf3d9a4f7a3d2accde63b0304228ab

Download Submit
C:\Windows\System\aItNyTa.exe

Filesize
1.1MB

MD5
b14ed22d8c08d00098c4228c6a90e199

SHA1
975d7abd4cb29e056d5057706ee22afd2ec4dd6a

SHA256
d594706dcc2c6b349bcf856b4d5f102ea9beb49249a13ce062414e538db6fdeb

SHA512
73ef641da324f5be18c46c6541394b527f7773a489065b51eda95bfddbea92fde282df43a9a95eed64f91759ee1d99b0d2d18cc62f5105b4bece5ea4633de1e3

Download Submit
C:\Windows\System\askIBbX.exe

Filesize
1.1MB

MD5
db1e2c0bbc70c315ac03250a610882e6

SHA1
2fe462d6f50b32c9347c6c05262c7ddf009c378d

SHA256
11eb4759179cb6f41d5734b55cb25e3100882667133a132b566d309186e3c668

SHA512
d78d4afdd7c33759d345c191e18f1e3311645119b470ad3f867b1747c96626bc18b93ce57475f1bde49de724a5d39c7f3211f0393cf952592aeb20ad2c282402

Download Submit
C:\Windows\System\bgcRPUm.exe

Filesize
1.1MB

MD5
3b25071ec07cacf7a20e57ab689f1cd7

SHA1
6158bc56023d160294eccac81b4103f8d5ccd005

SHA256
2323aae623f78da60e07586a4ffb5273f1aa4d0b2fa51ba9a4449a7cafa58180

SHA512
4bf60955e986bbd479bfbe219b9a8715717bd1942e38eabffc6cdf3e19304239f6b756f12f7f1b3447535be5602ce6d931e2a0ce6acad9dc86f6d191526cb028

Download Submit
C:\Windows\System\cVYfPoG.exe

Filesize
1.1MB

MD5
23a9fb4483100f37a061dde679c153a2

SHA1
1f0568fe3875266cb33c949215b63f15a66f46ad

SHA256
fbb1f80fe4332d7bc6252ced4e1e6d67832d2a689aecc305a5e489e19707b50c

SHA512
342e8184296ac3c16447e48dd5082f74095024a031f7e6effb055a2d11f6e87a983274a48439a1d3225722ae6b0c67c3c00965c6ccb6cc3b0df1007c7cf7ff16

Download Submit
C:\Windows\System\dWtGHlD.exe

Filesize
1.1MB

MD5
0ddd13bc3bda5e4b1921d5264b23658b

SHA1
8c6e6bb2487bfba243dc533efd6d4174342ea6cd

SHA256
f6f1cf76bb0a3986bf3ddce03215b2045d63da867d12d3991b69472e5ae9e240

SHA512
1009f31d380fde58cabc440ca06d0a3922d832a452f15bed977b92374766ce8629a823dbee59bea4147b3d72a4fcafe82b85f01df684079bd5f09cd22fb7e0e8

Download Submit
C:\Windows\System\drWDEue.exe

Filesize
1.1MB

MD5
bc69c9fdf91a78f26e5cbc19cdfa9c68

SHA1
57fa31d52caff59e5c21084dfafa9cb52eae6d8d

SHA256
dd261c6a5b0056f47ebbac0b69f333ba6b9edf3bc88d82d50258ce51090a65ac

SHA512
e59b69fe4a2b02b866c23d79d8d801a23975af96de227f0d0a46bd58a5b1fe1810b0f08daf22725b4a97e66d9db91581087aeb87d24ee875760b10ac8231eeab

Download Submit
C:\Windows\System\fEbqpbL.exe

Filesize
1.1MB

MD5
9f09cb6ec09429b7bfc3989ca7b85bd9

SHA1
8ca759d424728bc50e7b58729bc8a01493e584b2

SHA256
4be5dfe69bcf814740d55984cf45c2da3239bd1448d3a32e49c413012d7119e6

SHA512
205adb838996d154be20f86e6e33066d03b22635732d0fe7a45138f1caef8bf3bddd1bda4bf7064dd7509059c8df44ccb0aa12f8a69ec4ab7bd1f4eebe1fc785

Download Submit
C:\Windows\System\fZIcJEN.exe

Filesize
1.1MB

MD5
1a5435e3f1fc0b02885ce9ed0445d1ca

SHA1
d80f928676c57897a1943b233a4f17ede666771d

SHA256
c8245bafcb684b3b52bc4bf530f18424e588b65b231f302e51f5494404fd128a

SHA512
22dcc9e4a653d2f914eb21063d95006d835bc5b5b641c4628ce35b9519bb983342070997cc6f1c1f19038c24905c880c480672274f1e76bd92aedda44c859916

Download Submit
C:\Windows\System\ipKzwKz.exe

Filesize
1.1MB

MD5
64fd395927fe5b998c6d830ba57cb999

SHA1
769b56c3f9e43b6ca603883d2a27a532e3051312

SHA256
ed840917e0ee02f250a39b3371951f0f3b951b2b6f51d691e528f45dabcb9d84

SHA512
4a3bf5e3ce0c40d945ba5f854cd5760ac4c9c37aa59ea486c0c7c97106ae06b38c9eac531da3a7e85f2926e5c5701d991edc72ed1448a273ee3b95715662753f

Download Submit
C:\Windows\System\nrJkgjh.exe

Filesize
1.1MB

MD5
351bebee167bc1d9c49bcf01999b4712

SHA1
9787e3ab70b7e5f8f2114f95e160b1ffaf82787c

SHA256
2bad1ec66f04f943a692cdb16455b5d4751d11ca70bb12258d3a4b66cadc0733

SHA512
5733b12fc39c0a4dadff5042952e8c4451ece80c73e86e956d277e25ea3581b8edb558ff23857f3ed8eb93b44633a92fbc8f2515e2db1b4a6226ef10af0bd13f

Download Submit
C:\Windows\System\qoHSXNi.exe

Filesize
1.1MB

MD5
6eff66b84c4004c0de3bebd0232fa8a1

SHA1
03ab4bb2879018266e7eddcd12af04bd4a7bf4fd

SHA256
349153ec1a270fb4c0ee4e2ecb331442c0c568bc8f0d276ba2f028255e6aaf07

SHA512
1b083c814af48ca69994214b0ea3fbd72322f6ea424ee6711e87ae783f9a20cdd1fac2f1be6e82de21ca6bd21b2c7e85bb3a5fc55008387c906c44ffd908a748

Download Submit
C:\Windows\System\xUQzSAf.exe

Filesize
1.1MB

MD5
5443dfb0448dc76aa50b78ca260b0111

SHA1
b2801b47a189a594e607c54f2149d53bad1525a1

SHA256
485492a2604c442fe693ecbe305bac20f52a58f0b2e052dfc21523a2327574d9

SHA512
516561377b8b12d423ff4cc46ab70626ae9b7fb5fb62d17ae3dd80131eb9b7e8b2a25fdcee230e6a23887a47b727fc6e7b01b477014cc1507f531dcb5484bbf4

Download Submit
C:\Windows\System\xumfWPO.exe

Filesize
1.1MB

MD5
419c93ef8d512edd29ef74ba8e81ac08

SHA1
960221929cc9e9f714788213116160b948768468

SHA256
e6f8db6a849123966c0af3be7104add9c6af2d410498856d6af514cd40b85c19

SHA512
747fe5801333b2a6367c9b8068cd08052b62a8edafdda66497cd1e542eb90d15ded6e0a36dd9ad1c73beca45cefe733fd0198eca2f69ff189cdc0fc39e2b2dc9

Download Submit
C:\Windows\System\xxhwPEh.exe

Filesize
1.1MB

MD5
2e775d77b32431483a58baee4da82f62

SHA1
261c09112495312f4d26ea4ec56788e56d4625e6

SHA256
df51ff867bd7924d1db242d782962ea6b6289e97e9990c68ed0857d977da42bb

SHA512
72998538642d83ecb9f5ead2d7e9abb968cd352632db0cadd673589354221f28c98a5f74e57b48e9a4f3936ac341baa0e4268b21e8101177a9a23c6b46308d65

Download Submit
C:\Windows\System\zfYrPxd.exe

Filesize
1.1MB

MD5
8477762e1b3152b6c525e53c332ef6ef

SHA1
eb8689eb83c5d990483d22f8a7233ff5f1c120b1

SHA256
e1450db90c9eeeffc14b7f13a6e15a7af32615558622d5cc9e062a9f63f7fa80

SHA512
f9e9d930950d9b21d956fe5d711021e36bea241ee146c90db7037be34656cb32ff7cee8b97875005c6382391e56e364adff8259ff9b8f3d88047b410283e5b75

Download Submit
memory/3404-0-0x000001E5DB7E0000-0x000001E5DB7F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads