xmrig | d49f7eaa91024b75ab5d0669a3dc76e2a418be209ca37d9a532860e316702e60

Analysis

max time kernel
147s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 09:58 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
Size

1.1MB
MD5

b08609ef4d7e7c961902dfae153e5de0
SHA1

1db12def67c3203616b2cc5ccbb12ef32c9c344c
SHA256

d49f7eaa91024b75ab5d0669a3dc76e2a418be209ca37d9a532860e316702e60
SHA512

600179b816a7e2b046a840757ca01af2211cfd18566ae0a76237ae6c0aaf14ccec533f3b0bf5b720a4e057e590226b72da26cb4680297d752e7f56f4b13ef966
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzAaHfsCIZT:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVE

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a0000000233c2-4.dat	xmrig
behavioral2/files/0x000900000002341a-9.dat	xmrig
behavioral2/files/0x000700000002341e-12.dat	xmrig
behavioral2/files/0x0007000000023420-29.dat	xmrig
behavioral2/files/0x0007000000023424-44.dat	xmrig
behavioral2/files/0x0007000000023428-53.dat	xmrig
behavioral2/files/0x0007000000023430-97.dat	xmrig
behavioral2/files/0x000700000002342e-111.dat	xmrig
behavioral2/files/0x0007000000023433-129.dat	xmrig
behavioral2/files/0x0007000000023435-142.dat	xmrig
behavioral2/files/0x000700000002343c-162.dat	xmrig
behavioral2/files/0x000700000002343d-167.dat	xmrig
behavioral2/files/0x000700000002343b-159.dat	xmrig
behavioral2/files/0x000700000002343a-154.dat	xmrig
behavioral2/files/0x0007000000023439-150.dat	xmrig
behavioral2/files/0x0007000000023438-148.dat	xmrig
behavioral2/files/0x0007000000023437-146.dat	xmrig
behavioral2/files/0x0007000000023436-144.dat	xmrig
behavioral2/files/0x0007000000023434-134.dat	xmrig
behavioral2/files/0x000700000002342f-125.dat	xmrig
behavioral2/files/0x0007000000023432-122.dat	xmrig
behavioral2/files/0x0007000000023431-117.dat	xmrig
behavioral2/files/0x000700000002342c-115.dat	xmrig
behavioral2/files/0x000700000002342b-109.dat	xmrig
behavioral2/files/0x000700000002342d-107.dat	xmrig
behavioral2/files/0x0007000000023429-93.dat	xmrig
behavioral2/files/0x0007000000023427-76.dat	xmrig
behavioral2/files/0x0007000000023426-74.dat	xmrig
behavioral2/files/0x000700000002342a-73.dat	xmrig
behavioral2/files/0x0007000000023425-70.dat	xmrig
behavioral2/files/0x0007000000023423-58.dat	xmrig
behavioral2/files/0x0007000000023422-50.dat	xmrig
behavioral2/files/0x000700000002341f-34.dat	xmrig
behavioral2/files/0x0007000000023421-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4796	rQIwKkh.exe
3332	NOMdrlg.exe
4740	oCYoCGZ.exe
3136	mpZQaRD.exe
4820	SPzaYge.exe
4480	eYvUgFL.exe
1608	jAzuOwG.exe
4184	KLAMcyj.exe
4792	PMNWlYK.exe
3180	XXEzNPs.exe
2328	DvhdCnS.exe
3408	AyzPjUS.exe
1160	hqlMUiW.exe
1132	AZXNVJG.exe
668	LhmZOez.exe
2612	eBHbqRa.exe
2488	dwyizCW.exe
2416	TivwhCW.exe
3448	Ocxrhrp.exe
4672	ZeSFZiK.exe
3540	KUUaVVg.exe
396	FnPYwdB.exe
3064	XDDOyXX.exe
4860	mMxZmlz.exe
3636	AdwENZh.exe
4656	HvYSfrj.exe
1948	iGGPAFC.exe
876	UCvVfCE.exe
1320	qUyrPZW.exe
4632	MyBEZpa.exe
392	FdOEzoj.exe
3108	XWbWOtl.exe
3096	AiDDvfx.exe
1676	okqTWld.exe
1156	JXRmSaM.exe
3492	vhmwxoh.exe
1988	glKgEea.exe
1932	eazXpcR.exe
1552	osAzLGd.exe
1344	IYLYUha.exe
1620	gfYXNYd.exe
2128	sNMQOEY.exe
3268	zbKFpbD.exe
4468	nyKJBaF.exe
2432	NKzrpnt.exe
4568	IfiuIXO.exe
4576	AooFUKq.exe
3008	Zmcilkw.exe
1576	HvSCbSg.exe
724	NOuKuoe.exe
1580	uYPMLua.exe
1096	beGITNV.exe
3648	lnGegBb.exe
4440	QRNtfCF.exe
4448	eLmkHyH.exe
4000	eVbSGaV.exe
2772	RMjfQaI.exe
4492	kzREmMF.exe
1688	SnoJOkd.exe
5056	XoWcRKE.exe
5108	fJyPcNg.exe
860	jZNNZTl.exe
2316	wqGRCVk.exe
3192	ScSolgF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yAkZWMF.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\UtoMyuC.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\hsksUCE.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\wWCHPUu.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\FnPYwdB.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\zGCYOVp.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\thumlvD.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\OokOzFX.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\sJmAuEa.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\aIVbQuY.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\JFUAjOM.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\PbadUJK.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\NOuKuoe.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\uapdcFD.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\rBfcyXz.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\AyzPjUS.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\DQqogFA.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\mdOtZfP.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\MWhGkuK.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\HqDFvPI.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\PtmThLq.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\jZIZwVN.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\fSjvxuG.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\AyOaxZA.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\VTSgrfe.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\NDdsVpK.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\zLOgdkh.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\hTceehD.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\nTnaXHm.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\BItyily.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\QRNtfCF.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\IxOuMuX.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\VSBfoRz.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\JezZzEp.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\EmYtAHv.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\cuFGfdM.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\sjmWOVe.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\dbBlvbq.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\cTNEJwH.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\NiXrwdj.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\zsUTTLE.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\WpmQusF.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\MiIGvqU.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\pqyYKHa.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\dwYbhIX.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\COTBlCU.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\uVDTIKv.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\OKPzDbS.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\yvKSQgv.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\ufyYhoJ.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\RQlTexg.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\GjMpfcK.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\cfDmcug.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\IeeFFDg.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\OEYznlt.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\lZWgnbF.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\sBbYidg.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\WlthuHO.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\rlNDCJN.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\LAXgtNY.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\PHiibEU.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\YZKWuhe.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\EfAAxSu.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
File created	C:\Windows\System\Jnlnmmn.exe	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 4796	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	85
PID 4284 wrote to memory of 4796	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	85
PID 4284 wrote to memory of 3332	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	86
PID 4284 wrote to memory of 3332	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	86
PID 4284 wrote to memory of 4740	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	87
PID 4284 wrote to memory of 4740	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	87
PID 4284 wrote to memory of 3136	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	88
PID 4284 wrote to memory of 3136	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	88
PID 4284 wrote to memory of 4480	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	89
PID 4284 wrote to memory of 4480	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	89
PID 4284 wrote to memory of 4820	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	90
PID 4284 wrote to memory of 4820	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	90
PID 4284 wrote to memory of 1608	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	91
PID 4284 wrote to memory of 1608	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	91
PID 4284 wrote to memory of 4184	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	92
PID 4284 wrote to memory of 4184	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	92
PID 4284 wrote to memory of 4792	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	93
PID 4284 wrote to memory of 4792	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	93
PID 4284 wrote to memory of 3180	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	94
PID 4284 wrote to memory of 3180	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	94
PID 4284 wrote to memory of 2328	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	95
PID 4284 wrote to memory of 2328	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	95
PID 4284 wrote to memory of 3408	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	96
PID 4284 wrote to memory of 3408	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	96
PID 4284 wrote to memory of 1160	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	97
PID 4284 wrote to memory of 1160	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	97
PID 4284 wrote to memory of 1132	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	98
PID 4284 wrote to memory of 1132	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	98
PID 4284 wrote to memory of 668	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	99
PID 4284 wrote to memory of 668	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	99
PID 4284 wrote to memory of 2612	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	100
PID 4284 wrote to memory of 2612	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	100
PID 4284 wrote to memory of 4672	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	101
PID 4284 wrote to memory of 4672	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	101
PID 4284 wrote to memory of 2488	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	102
PID 4284 wrote to memory of 2488	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	102
PID 4284 wrote to memory of 2416	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	103
PID 4284 wrote to memory of 2416	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	103
PID 4284 wrote to memory of 3064	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	104
PID 4284 wrote to memory of 3064	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	104
PID 4284 wrote to memory of 3448	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	105
PID 4284 wrote to memory of 3448	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	105
PID 4284 wrote to memory of 3540	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	106
PID 4284 wrote to memory of 3540	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	106
PID 4284 wrote to memory of 396	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	107
PID 4284 wrote to memory of 396	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	107
PID 4284 wrote to memory of 4860	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	108
PID 4284 wrote to memory of 4860	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	108
PID 4284 wrote to memory of 3636	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	109
PID 4284 wrote to memory of 3636	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	109
PID 4284 wrote to memory of 4656	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	110
PID 4284 wrote to memory of 4656	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	110
PID 4284 wrote to memory of 1948	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	111
PID 4284 wrote to memory of 1948	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	111
PID 4284 wrote to memory of 876	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	112
PID 4284 wrote to memory of 876	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	112
PID 4284 wrote to memory of 1320	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	113
PID 4284 wrote to memory of 1320	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	113
PID 4284 wrote to memory of 4632	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	114
PID 4284 wrote to memory of 4632	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	114
PID 4284 wrote to memory of 392	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	115
PID 4284 wrote to memory of 392	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	115
PID 4284 wrote to memory of 3108	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	116
PID 4284 wrote to memory of 3108	4284	b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b08609ef4d7e7c961902dfae153e5de0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\System\rQIwKkh.exe
  C:\Windows\System\rQIwKkh.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\NOMdrlg.exe
  C:\Windows\System\NOMdrlg.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\oCYoCGZ.exe
  C:\Windows\System\oCYoCGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\mpZQaRD.exe
  C:\Windows\System\mpZQaRD.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\eYvUgFL.exe
  C:\Windows\System\eYvUgFL.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\SPzaYge.exe
  C:\Windows\System\SPzaYge.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\jAzuOwG.exe
  C:\Windows\System\jAzuOwG.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\KLAMcyj.exe
  C:\Windows\System\KLAMcyj.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\PMNWlYK.exe
  C:\Windows\System\PMNWlYK.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\XXEzNPs.exe
  C:\Windows\System\XXEzNPs.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\DvhdCnS.exe
  C:\Windows\System\DvhdCnS.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\AyzPjUS.exe
  C:\Windows\System\AyzPjUS.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\hqlMUiW.exe
  C:\Windows\System\hqlMUiW.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\AZXNVJG.exe
  C:\Windows\System\AZXNVJG.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\LhmZOez.exe
  C:\Windows\System\LhmZOez.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\eBHbqRa.exe
  C:\Windows\System\eBHbqRa.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ZeSFZiK.exe
  C:\Windows\System\ZeSFZiK.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\dwyizCW.exe
  C:\Windows\System\dwyizCW.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\TivwhCW.exe
  C:\Windows\System\TivwhCW.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\XDDOyXX.exe
  C:\Windows\System\XDDOyXX.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\Ocxrhrp.exe
  C:\Windows\System\Ocxrhrp.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\KUUaVVg.exe
  C:\Windows\System\KUUaVVg.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\FnPYwdB.exe
  C:\Windows\System\FnPYwdB.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\mMxZmlz.exe
  C:\Windows\System\mMxZmlz.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\AdwENZh.exe
  C:\Windows\System\AdwENZh.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\HvYSfrj.exe
  C:\Windows\System\HvYSfrj.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\iGGPAFC.exe
  C:\Windows\System\iGGPAFC.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\UCvVfCE.exe
  C:\Windows\System\UCvVfCE.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\qUyrPZW.exe
  C:\Windows\System\qUyrPZW.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\MyBEZpa.exe
  C:\Windows\System\MyBEZpa.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\FdOEzoj.exe
  C:\Windows\System\FdOEzoj.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\XWbWOtl.exe
  C:\Windows\System\XWbWOtl.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\AiDDvfx.exe
  C:\Windows\System\AiDDvfx.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\okqTWld.exe
  C:\Windows\System\okqTWld.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\JXRmSaM.exe
  C:\Windows\System\JXRmSaM.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\vhmwxoh.exe
  C:\Windows\System\vhmwxoh.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\glKgEea.exe
  C:\Windows\System\glKgEea.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\eazXpcR.exe
  C:\Windows\System\eazXpcR.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\osAzLGd.exe
  C:\Windows\System\osAzLGd.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\IYLYUha.exe
  C:\Windows\System\IYLYUha.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\gfYXNYd.exe
  C:\Windows\System\gfYXNYd.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\sNMQOEY.exe
  C:\Windows\System\sNMQOEY.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\zbKFpbD.exe
  C:\Windows\System\zbKFpbD.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\nyKJBaF.exe
  C:\Windows\System\nyKJBaF.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\NKzrpnt.exe
  C:\Windows\System\NKzrpnt.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\IfiuIXO.exe
  C:\Windows\System\IfiuIXO.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\AooFUKq.exe
  C:\Windows\System\AooFUKq.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\Zmcilkw.exe
  C:\Windows\System\Zmcilkw.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\HvSCbSg.exe
  C:\Windows\System\HvSCbSg.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\NOuKuoe.exe
  C:\Windows\System\NOuKuoe.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\uYPMLua.exe
  C:\Windows\System\uYPMLua.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\beGITNV.exe
  C:\Windows\System\beGITNV.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\lnGegBb.exe
  C:\Windows\System\lnGegBb.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\QRNtfCF.exe
  C:\Windows\System\QRNtfCF.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\eLmkHyH.exe
  C:\Windows\System\eLmkHyH.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\eVbSGaV.exe
  C:\Windows\System\eVbSGaV.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\RMjfQaI.exe
  C:\Windows\System\RMjfQaI.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\kzREmMF.exe
  C:\Windows\System\kzREmMF.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\SnoJOkd.exe
  C:\Windows\System\SnoJOkd.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XoWcRKE.exe
  C:\Windows\System\XoWcRKE.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\fJyPcNg.exe
  C:\Windows\System\fJyPcNg.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\jZNNZTl.exe
  C:\Windows\System\jZNNZTl.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\wqGRCVk.exe
  C:\Windows\System\wqGRCVk.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ScSolgF.exe
  C:\Windows\System\ScSolgF.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\NSJqoJj.exe
  C:\Windows\System\NSJqoJj.exe
  2⤵
  PID:3296
- C:\Windows\System\qcmJqHa.exe
  C:\Windows\System\qcmJqHa.exe
  2⤵
  PID:5048
- C:\Windows\System\ebPnUBw.exe
  C:\Windows\System\ebPnUBw.exe
  2⤵
  PID:2396
- C:\Windows\System\yjmnzyR.exe
  C:\Windows\System\yjmnzyR.exe
  2⤵
  PID:3704
- C:\Windows\System\AndDUZg.exe
  C:\Windows\System\AndDUZg.exe
  2⤵
  PID:4532
- C:\Windows\System\yuSQdrl.exe
  C:\Windows\System\yuSQdrl.exe
  2⤵
  PID:3440
- C:\Windows\System\WoDlCtk.exe
  C:\Windows\System\WoDlCtk.exe
  2⤵
  PID:3084
- C:\Windows\System\IIaKjkb.exe
  C:\Windows\System\IIaKjkb.exe
  2⤵
  PID:1600
- C:\Windows\System\POaZNvJ.exe
  C:\Windows\System\POaZNvJ.exe
  2⤵
  PID:1876
- C:\Windows\System\mrDoxBZ.exe
  C:\Windows\System\mrDoxBZ.exe
  2⤵
  PID:3488
- C:\Windows\System\OwcnxUD.exe
  C:\Windows\System\OwcnxUD.exe
  2⤵
  PID:1716
- C:\Windows\System\COTBlCU.exe
  C:\Windows\System\COTBlCU.exe
  2⤵
  PID:1808
- C:\Windows\System\QwTlfrD.exe
  C:\Windows\System\QwTlfrD.exe
  2⤵
  PID:2716
- C:\Windows\System\bLhDvlB.exe
  C:\Windows\System\bLhDvlB.exe
  2⤵
  PID:2532
- C:\Windows\System\TLEDXvt.exe
  C:\Windows\System\TLEDXvt.exe
  2⤵
  PID:4408
- C:\Windows\System\QVMCjeW.exe
  C:\Windows\System\QVMCjeW.exe
  2⤵
  PID:1840
- C:\Windows\System\oPcPnGK.exe
  C:\Windows\System\oPcPnGK.exe
  2⤵
  PID:3048
- C:\Windows\System\aBOrBvl.exe
  C:\Windows\System\aBOrBvl.exe
  2⤵
  PID:444
- C:\Windows\System\LPmyReF.exe
  C:\Windows\System\LPmyReF.exe
  2⤵
  PID:1700
- C:\Windows\System\iOCDpqK.exe
  C:\Windows\System\iOCDpqK.exe
  2⤵
  PID:3848
- C:\Windows\System\cmxRSWF.exe
  C:\Windows\System\cmxRSWF.exe
  2⤵
  PID:2864
- C:\Windows\System\UZvkyzG.exe
  C:\Windows\System\UZvkyzG.exe
  2⤵
  PID:116
- C:\Windows\System\EekAWmv.exe
  C:\Windows\System\EekAWmv.exe
  2⤵
  PID:880
- C:\Windows\System\ZBavsOI.exe
  C:\Windows\System\ZBavsOI.exe
  2⤵
  PID:2248
- C:\Windows\System\HLDfaQQ.exe
  C:\Windows\System\HLDfaQQ.exe
  2⤵
  PID:3484
- C:\Windows\System\gsComie.exe
  C:\Windows\System\gsComie.exe
  2⤵
  PID:2256
- C:\Windows\System\enRKPKJ.exe
  C:\Windows\System\enRKPKJ.exe
  2⤵
  PID:2780
- C:\Windows\System\NpUDnwa.exe
  C:\Windows\System\NpUDnwa.exe
  2⤵
  PID:2276
- C:\Windows\System\hmakxdY.exe
  C:\Windows\System\hmakxdY.exe
  2⤵
  PID:3844
- C:\Windows\System\uoPvwGU.exe
  C:\Windows\System\uoPvwGU.exe
  2⤵
  PID:4528
- C:\Windows\System\XmEBAgv.exe
  C:\Windows\System\XmEBAgv.exe
  2⤵
  PID:5116
- C:\Windows\System\svVgVdM.exe
  C:\Windows\System\svVgVdM.exe
  2⤵
  PID:5140
- C:\Windows\System\XMOksgG.exe
  C:\Windows\System\XMOksgG.exe
  2⤵
  PID:5168
- C:\Windows\System\oOfaUMA.exe
  C:\Windows\System\oOfaUMA.exe
  2⤵
  PID:5196
- C:\Windows\System\eImAorc.exe
  C:\Windows\System\eImAorc.exe
  2⤵
  PID:5232
- C:\Windows\System\pnphdvG.exe
  C:\Windows\System\pnphdvG.exe
  2⤵
  PID:5256
- C:\Windows\System\PfdMhVd.exe
  C:\Windows\System\PfdMhVd.exe
  2⤵
  PID:5280
- C:\Windows\System\AobPEEL.exe
  C:\Windows\System\AobPEEL.exe
  2⤵
  PID:5316
- C:\Windows\System\jZIZwVN.exe
  C:\Windows\System\jZIZwVN.exe
  2⤵
  PID:5336
- C:\Windows\System\WlthuHO.exe
  C:\Windows\System\WlthuHO.exe
  2⤵
  PID:5368
- C:\Windows\System\gzxmZdp.exe
  C:\Windows\System\gzxmZdp.exe
  2⤵
  PID:5392
- C:\Windows\System\McYiDVD.exe
  C:\Windows\System\McYiDVD.exe
  2⤵
  PID:5420
- C:\Windows\System\HaiUWzP.exe
  C:\Windows\System\HaiUWzP.exe
  2⤵
  PID:5448
- C:\Windows\System\UbmGYqt.exe
  C:\Windows\System\UbmGYqt.exe
  2⤵
  PID:5516
- C:\Windows\System\mtgGYdG.exe
  C:\Windows\System\mtgGYdG.exe
  2⤵
  PID:5540
- C:\Windows\System\OabbCyi.exe
  C:\Windows\System\OabbCyi.exe
  2⤵
  PID:5568
- C:\Windows\System\iasFjnX.exe
  C:\Windows\System\iasFjnX.exe
  2⤵
  PID:5600
- C:\Windows\System\IPfFkkl.exe
  C:\Windows\System\IPfFkkl.exe
  2⤵
  PID:5624
- C:\Windows\System\EnGygOc.exe
  C:\Windows\System\EnGygOc.exe
  2⤵
  PID:5656
- C:\Windows\System\dbBlvbq.exe
  C:\Windows\System\dbBlvbq.exe
  2⤵
  PID:5688
- C:\Windows\System\BTJVewN.exe
  C:\Windows\System\BTJVewN.exe
  2⤵
  PID:5716
- C:\Windows\System\UNDrVcy.exe
  C:\Windows\System\UNDrVcy.exe
  2⤵
  PID:5744
- C:\Windows\System\TTDtLvF.exe
  C:\Windows\System\TTDtLvF.exe
  2⤵
  PID:5772
- C:\Windows\System\oWaRWwq.exe
  C:\Windows\System\oWaRWwq.exe
  2⤵
  PID:5800
- C:\Windows\System\DYbcGtu.exe
  C:\Windows\System\DYbcGtu.exe
  2⤵
  PID:5828
- C:\Windows\System\fSXPXIq.exe
  C:\Windows\System\fSXPXIq.exe
  2⤵
  PID:5856
- C:\Windows\System\IwheWIQ.exe
  C:\Windows\System\IwheWIQ.exe
  2⤵
  PID:5884
- C:\Windows\System\RaETnee.exe
  C:\Windows\System\RaETnee.exe
  2⤵
  PID:5912
- C:\Windows\System\TegZOtr.exe
  C:\Windows\System\TegZOtr.exe
  2⤵
  PID:5940
- C:\Windows\System\gVTXJyX.exe
  C:\Windows\System\gVTXJyX.exe
  2⤵
  PID:5964
- C:\Windows\System\FuyXiLD.exe
  C:\Windows\System\FuyXiLD.exe
  2⤵
  PID:5996
- C:\Windows\System\skrMhew.exe
  C:\Windows\System\skrMhew.exe
  2⤵
  PID:6024
- C:\Windows\System\PHlgZBU.exe
  C:\Windows\System\PHlgZBU.exe
  2⤵
  PID:6044
- C:\Windows\System\QAyWmTW.exe
  C:\Windows\System\QAyWmTW.exe
  2⤵
  PID:6076
- C:\Windows\System\FjXInWH.exe
  C:\Windows\System\FjXInWH.exe
  2⤵
  PID:6104
- C:\Windows\System\BjSvETR.exe
  C:\Windows\System\BjSvETR.exe
  2⤵
  PID:6128
- C:\Windows\System\xgPQivc.exe
  C:\Windows\System\xgPQivc.exe
  2⤵
  PID:5152
- C:\Windows\System\cUXKNNp.exe
  C:\Windows\System\cUXKNNp.exe
  2⤵
  PID:5216
- C:\Windows\System\UjqUjnx.exe
  C:\Windows\System\UjqUjnx.exe
  2⤵
  PID:5272
- C:\Windows\System\qMgWLWy.exe
  C:\Windows\System\qMgWLWy.exe
  2⤵
  PID:5332
- C:\Windows\System\FvvLMCB.exe
  C:\Windows\System\FvvLMCB.exe
  2⤵
  PID:5408
- C:\Windows\System\ovzllbT.exe
  C:\Windows\System\ovzllbT.exe
  2⤵
  PID:5468
- C:\Windows\System\CjTnNTP.exe
  C:\Windows\System\CjTnNTP.exe
  2⤵
  PID:5564
- C:\Windows\System\WkzToua.exe
  C:\Windows\System\WkzToua.exe
  2⤵
  PID:5620
- C:\Windows\System\CVJLPIJ.exe
  C:\Windows\System\CVJLPIJ.exe
  2⤵
  PID:5708
- C:\Windows\System\LpnetIp.exe
  C:\Windows\System\LpnetIp.exe
  2⤵
  PID:5768
- C:\Windows\System\EPHfqSh.exe
  C:\Windows\System\EPHfqSh.exe
  2⤵
  PID:5812
- C:\Windows\System\AkOMquS.exe
  C:\Windows\System\AkOMquS.exe
  2⤵
  PID:5896
- C:\Windows\System\fYmwRws.exe
  C:\Windows\System\fYmwRws.exe
  2⤵
  PID:5972
- C:\Windows\System\LhIpcyJ.exe
  C:\Windows\System\LhIpcyJ.exe
  2⤵
  PID:6020
- C:\Windows\System\THRNarN.exe
  C:\Windows\System\THRNarN.exe
  2⤵
  PID:6068
- C:\Windows\System\VWwZlzB.exe
  C:\Windows\System\VWwZlzB.exe
  2⤵
  PID:6124
- C:\Windows\System\MunZXqP.exe
  C:\Windows\System\MunZXqP.exe
  2⤵
  PID:5188
- C:\Windows\System\pjgsaiK.exe
  C:\Windows\System\pjgsaiK.exe
  2⤵
  PID:5360
- C:\Windows\System\rkfRWXe.exe
  C:\Windows\System\rkfRWXe.exe
  2⤵
  PID:5648
- C:\Windows\System\KKuGcql.exe
  C:\Windows\System\KKuGcql.exe
  2⤵
  PID:5756
- C:\Windows\System\JxRjtHc.exe
  C:\Windows\System\JxRjtHc.exe
  2⤵
  PID:6120
- C:\Windows\System\RWqHQJx.exe
  C:\Windows\System\RWqHQJx.exe
  2⤵
  PID:5436
- C:\Windows\System\tAlXssN.exe
  C:\Windows\System\tAlXssN.exe
  2⤵
  PID:6052
- C:\Windows\System\ldPNVXF.exe
  C:\Windows\System\ldPNVXF.exe
  2⤵
  PID:5304
- C:\Windows\System\sQhrVXJ.exe
  C:\Windows\System\sQhrVXJ.exe
  2⤵
  PID:6176
- C:\Windows\System\ssyakCj.exe
  C:\Windows\System\ssyakCj.exe
  2⤵
  PID:6204
- C:\Windows\System\qrNDqxT.exe
  C:\Windows\System\qrNDqxT.exe
  2⤵
  PID:6232
- C:\Windows\System\OINWIXR.exe
  C:\Windows\System\OINWIXR.exe
  2⤵
  PID:6256
- C:\Windows\System\YZKWuhe.exe
  C:\Windows\System\YZKWuhe.exe
  2⤵
  PID:6288
- C:\Windows\System\DeufDcE.exe
  C:\Windows\System\DeufDcE.exe
  2⤵
  PID:6316
- C:\Windows\System\xIqrRWi.exe
  C:\Windows\System\xIqrRWi.exe
  2⤵
  PID:6336
- C:\Windows\System\FdyHdpu.exe
  C:\Windows\System\FdyHdpu.exe
  2⤵
  PID:6364
- C:\Windows\System\bOWAtak.exe
  C:\Windows\System\bOWAtak.exe
  2⤵
  PID:6388
- C:\Windows\System\ZPwWeBW.exe
  C:\Windows\System\ZPwWeBW.exe
  2⤵
  PID:6416
- C:\Windows\System\vpjudDc.exe
  C:\Windows\System\vpjudDc.exe
  2⤵
  PID:6444
- C:\Windows\System\mJEzxDX.exe
  C:\Windows\System\mJEzxDX.exe
  2⤵
  PID:6476
- C:\Windows\System\GFQXbQW.exe
  C:\Windows\System\GFQXbQW.exe
  2⤵
  PID:6504
- C:\Windows\System\QclfDMm.exe
  C:\Windows\System\QclfDMm.exe
  2⤵
  PID:6536
- C:\Windows\System\veycmLP.exe
  C:\Windows\System\veycmLP.exe
  2⤵
  PID:6564
- C:\Windows\System\IbqdEJu.exe
  C:\Windows\System\IbqdEJu.exe
  2⤵
  PID:6592
- C:\Windows\System\MBQEKOC.exe
  C:\Windows\System\MBQEKOC.exe
  2⤵
  PID:6620
- C:\Windows\System\JTizsLO.exe
  C:\Windows\System\JTizsLO.exe
  2⤵
  PID:6652
- C:\Windows\System\pAfTeaE.exe
  C:\Windows\System\pAfTeaE.exe
  2⤵
  PID:6676
- C:\Windows\System\AkthSBg.exe
  C:\Windows\System\AkthSBg.exe
  2⤵
  PID:6712
- C:\Windows\System\iukffRu.exe
  C:\Windows\System\iukffRu.exe
  2⤵
  PID:6744
- C:\Windows\System\nqrqWnj.exe
  C:\Windows\System\nqrqWnj.exe
  2⤵
  PID:6776
- C:\Windows\System\UeaRuvi.exe
  C:\Windows\System\UeaRuvi.exe
  2⤵
  PID:6800
- C:\Windows\System\uFDzfQC.exe
  C:\Windows\System\uFDzfQC.exe
  2⤵
  PID:6832
- C:\Windows\System\ZxVTAwI.exe
  C:\Windows\System\ZxVTAwI.exe
  2⤵
  PID:6860
- C:\Windows\System\otTmUkm.exe
  C:\Windows\System\otTmUkm.exe
  2⤵
  PID:6884
- C:\Windows\System\fguuxXU.exe
  C:\Windows\System\fguuxXU.exe
  2⤵
  PID:7116
- C:\Windows\System\zViMLzp.exe
  C:\Windows\System\zViMLzp.exe
  2⤵
  PID:7132
- C:\Windows\System\EwsPhVg.exe
  C:\Windows\System\EwsPhVg.exe
  2⤵
  PID:7148
- C:\Windows\System\SsCyPhj.exe
  C:\Windows\System\SsCyPhj.exe
  2⤵
  PID:7164
- C:\Windows\System\ZCzpJKW.exe
  C:\Windows\System\ZCzpJKW.exe
  2⤵
  PID:5876
- C:\Windows\System\LlaYczj.exe
  C:\Windows\System\LlaYczj.exe
  2⤵
  PID:6212
- C:\Windows\System\lNBKOgY.exe
  C:\Windows\System\lNBKOgY.exe
  2⤵
  PID:6296
- C:\Windows\System\XlIhHCQ.exe
  C:\Windows\System\XlIhHCQ.exe
  2⤵
  PID:6332
- C:\Windows\System\IFoIKLd.exe
  C:\Windows\System\IFoIKLd.exe
  2⤵
  PID:6396
- C:\Windows\System\cVeqmli.exe
  C:\Windows\System\cVeqmli.exe
  2⤵
  PID:6440
- C:\Windows\System\exZfKGV.exe
  C:\Windows\System\exZfKGV.exe
  2⤵
  PID:6496
- C:\Windows\System\bJXmiJE.exe
  C:\Windows\System\bJXmiJE.exe
  2⤵
  PID:6552
- C:\Windows\System\FLcRvou.exe
  C:\Windows\System\FLcRvou.exe
  2⤵
  PID:6648
- C:\Windows\System\QaILEOs.exe
  C:\Windows\System\QaILEOs.exe
  2⤵
  PID:6684
- C:\Windows\System\VmqPGfb.exe
  C:\Windows\System\VmqPGfb.exe
  2⤵
  PID:6784
- C:\Windows\System\KwQtdUM.exe
  C:\Windows\System\KwQtdUM.exe
  2⤵
  PID:6824
- C:\Windows\System\ggIaMwi.exe
  C:\Windows\System\ggIaMwi.exe
  2⤵
  PID:6876
- C:\Windows\System\xELvWnV.exe
  C:\Windows\System\xELvWnV.exe
  2⤵
  PID:6928
- C:\Windows\System\CRLhfgw.exe
  C:\Windows\System\CRLhfgw.exe
  2⤵
  PID:6948
- C:\Windows\System\Juyqeej.exe
  C:\Windows\System\Juyqeej.exe
  2⤵
  PID:6964
- C:\Windows\System\ZfVxkfm.exe
  C:\Windows\System\ZfVxkfm.exe
  2⤵
  PID:6988
- C:\Windows\System\bhyQGRv.exe
  C:\Windows\System\bhyQGRv.exe
  2⤵
  PID:7008
- C:\Windows\System\EfAAxSu.exe
  C:\Windows\System\EfAAxSu.exe
  2⤵
  PID:7044
- C:\Windows\System\Xmjrmvg.exe
  C:\Windows\System\Xmjrmvg.exe
  2⤵
  PID:7092
- C:\Windows\System\hbFnnRr.exe
  C:\Windows\System\hbFnnRr.exe
  2⤵
  PID:6904
- C:\Windows\System\pnbdujZ.exe
  C:\Windows\System\pnbdujZ.exe
  2⤵
  PID:7140
- C:\Windows\System\BDDwrDS.exe
  C:\Windows\System\BDDwrDS.exe
  2⤵
  PID:7160
- C:\Windows\System\cGxyPxx.exe
  C:\Windows\System\cGxyPxx.exe
  2⤵
  PID:6268
- C:\Windows\System\oJjynQG.exe
  C:\Windows\System\oJjynQG.exe
  2⤵
  PID:6428
- C:\Windows\System\cxxVhOp.exe
  C:\Windows\System\cxxVhOp.exe
  2⤵
  PID:6612
- C:\Windows\System\DBbmofC.exe
  C:\Windows\System\DBbmofC.exe
  2⤵
  PID:6692
- C:\Windows\System\nTPVYiN.exe
  C:\Windows\System\nTPVYiN.exe
  2⤵
  PID:6584
- C:\Windows\System\rbUfGzr.exe
  C:\Windows\System\rbUfGzr.exe
  2⤵
  PID:6792
- C:\Windows\System\XJcYwRv.exe
  C:\Windows\System\XJcYwRv.exe
  2⤵
  PID:6956
- C:\Windows\System\xaaaxte.exe
  C:\Windows\System\xaaaxte.exe
  2⤵
  PID:7064
- C:\Windows\System\yAzYgfC.exe
  C:\Windows\System\yAzYgfC.exe
  2⤵
  PID:7124
- C:\Windows\System\OokOzFX.exe
  C:\Windows\System\OokOzFX.exe
  2⤵
  PID:7144
- C:\Windows\System\oGtKbfs.exe
  C:\Windows\System\oGtKbfs.exe
  2⤵
  PID:6356
- C:\Windows\System\fyguKmU.exe
  C:\Windows\System\fyguKmU.exe
  2⤵
  PID:7184
- C:\Windows\System\bEbjOpt.exe
  C:\Windows\System\bEbjOpt.exe
  2⤵
  PID:7216
- C:\Windows\System\PeqfCHi.exe
  C:\Windows\System\PeqfCHi.exe
  2⤵
  PID:7232
- C:\Windows\System\pjMsusb.exe
  C:\Windows\System\pjMsusb.exe
  2⤵
  PID:7260
- C:\Windows\System\UrsnliG.exe
  C:\Windows\System\UrsnliG.exe
  2⤵
  PID:7284
- C:\Windows\System\KFhPZZb.exe
  C:\Windows\System\KFhPZZb.exe
  2⤵
  PID:7300
- C:\Windows\System\yvKSQgv.exe
  C:\Windows\System\yvKSQgv.exe
  2⤵
  PID:7324
- C:\Windows\System\jBXNSJp.exe
  C:\Windows\System\jBXNSJp.exe
  2⤵
  PID:7344
- C:\Windows\System\asbxRzr.exe
  C:\Windows\System\asbxRzr.exe
  2⤵
  PID:7372
- C:\Windows\System\NiXrwdj.exe
  C:\Windows\System\NiXrwdj.exe
  2⤵
  PID:7392
- C:\Windows\System\cAbZQLr.exe
  C:\Windows\System\cAbZQLr.exe
  2⤵
  PID:7416
- C:\Windows\System\SgpuTkZ.exe
  C:\Windows\System\SgpuTkZ.exe
  2⤵
  PID:7436
- C:\Windows\System\DAAByRf.exe
  C:\Windows\System\DAAByRf.exe
  2⤵
  PID:7468
- C:\Windows\System\TfTvQgu.exe
  C:\Windows\System\TfTvQgu.exe
  2⤵
  PID:7492
- C:\Windows\System\kzQWJmP.exe
  C:\Windows\System\kzQWJmP.exe
  2⤵
  PID:7520
- C:\Windows\System\CPWvzsx.exe
  C:\Windows\System\CPWvzsx.exe
  2⤵
  PID:7548
- C:\Windows\System\iFkGlcO.exe
  C:\Windows\System\iFkGlcO.exe
  2⤵
  PID:7576
- C:\Windows\System\sJmAuEa.exe
  C:\Windows\System\sJmAuEa.exe
  2⤵
  PID:7604
- C:\Windows\System\oooqvGu.exe
  C:\Windows\System\oooqvGu.exe
  2⤵
  PID:7636
- C:\Windows\System\glSmDNs.exe
  C:\Windows\System\glSmDNs.exe
  2⤵
  PID:7660
- C:\Windows\System\WNYaFsL.exe
  C:\Windows\System\WNYaFsL.exe
  2⤵
  PID:7684
- C:\Windows\System\sVhULJt.exe
  C:\Windows\System\sVhULJt.exe
  2⤵
  PID:7720
- C:\Windows\System\bkdoBpx.exe
  C:\Windows\System\bkdoBpx.exe
  2⤵
  PID:7752
- C:\Windows\System\Agqxnoq.exe
  C:\Windows\System\Agqxnoq.exe
  2⤵
  PID:7788
- C:\Windows\System\SBzmZXf.exe
  C:\Windows\System\SBzmZXf.exe
  2⤵
  PID:7816
- C:\Windows\System\kxkUsVY.exe
  C:\Windows\System\kxkUsVY.exe
  2⤵
  PID:7844
- C:\Windows\System\jZosGWv.exe
  C:\Windows\System\jZosGWv.exe
  2⤵
  PID:7872
- C:\Windows\System\KIfodDR.exe
  C:\Windows\System\KIfodDR.exe
  2⤵
  PID:7896
- C:\Windows\System\srVtaxX.exe
  C:\Windows\System\srVtaxX.exe
  2⤵
  PID:7920
- C:\Windows\System\KyuCncc.exe
  C:\Windows\System\KyuCncc.exe
  2⤵
  PID:7948
- C:\Windows\System\OmCEZBq.exe
  C:\Windows\System\OmCEZBq.exe
  2⤵
  PID:7972
- C:\Windows\System\bphznic.exe
  C:\Windows\System\bphznic.exe
  2⤵
  PID:8000
- C:\Windows\System\NmxJtva.exe
  C:\Windows\System\NmxJtva.exe
  2⤵
  PID:8032
- C:\Windows\System\eDZGRos.exe
  C:\Windows\System\eDZGRos.exe
  2⤵
  PID:8052
- C:\Windows\System\HsDbqPs.exe
  C:\Windows\System\HsDbqPs.exe
  2⤵
  PID:8076
- C:\Windows\System\HWoQUJm.exe
  C:\Windows\System\HWoQUJm.exe
  2⤵
  PID:8104
- C:\Windows\System\MDdVsgp.exe
  C:\Windows\System\MDdVsgp.exe
  2⤵
  PID:8132
- C:\Windows\System\fSjvxuG.exe
  C:\Windows\System\fSjvxuG.exe
  2⤵
  PID:8160
- C:\Windows\System\gZSacbS.exe
  C:\Windows\System\gZSacbS.exe
  2⤵
  PID:8184
- C:\Windows\System\likoobb.exe
  C:\Windows\System\likoobb.exe
  2⤵
  PID:6452
- C:\Windows\System\upznKqr.exe
  C:\Windows\System\upznKqr.exe
  2⤵
  PID:6556
- C:\Windows\System\omxDagY.exe
  C:\Windows\System\omxDagY.exe
  2⤵
  PID:6796
- C:\Windows\System\WZhSZEL.exe
  C:\Windows\System\WZhSZEL.exe
  2⤵
  PID:7204
- C:\Windows\System\oHCQara.exe
  C:\Windows\System\oHCQara.exe
  2⤵
  PID:6868
- C:\Windows\System\nlnmvSh.exe
  C:\Windows\System\nlnmvSh.exe
  2⤵
  PID:7296
- C:\Windows\System\rBfcyXz.exe
  C:\Windows\System\rBfcyXz.exe
  2⤵
  PID:7360
- C:\Windows\System\GRuzPID.exe
  C:\Windows\System\GRuzPID.exe
  2⤵
  PID:7480
- C:\Windows\System\OsECPzd.exe
  C:\Windows\System\OsECPzd.exe
  2⤵
  PID:7336
- C:\Windows\System\PlpaFzY.exe
  C:\Windows\System\PlpaFzY.exe
  2⤵
  PID:7616
- C:\Windows\System\aGIrguZ.exe
  C:\Windows\System\aGIrguZ.exe
  2⤵
  PID:7656
- C:\Windows\System\nHdgcew.exe
  C:\Windows\System\nHdgcew.exe
  2⤵
  PID:7764
- C:\Windows\System\BhRCvZm.exe
  C:\Windows\System\BhRCvZm.exe
  2⤵
  PID:7672
- C:\Windows\System\OJuYvdq.exe
  C:\Windows\System\OJuYvdq.exe
  2⤵
  PID:7892
- C:\Windows\System\tvlJOql.exe
  C:\Windows\System\tvlJOql.exe
  2⤵
  PID:7516
- C:\Windows\System\dGFjoCZ.exe
  C:\Windows\System\dGFjoCZ.exe
  2⤵
  PID:7956
- C:\Windows\System\hQPfUfp.exe
  C:\Windows\System\hQPfUfp.exe
  2⤵
  PID:7728
- C:\Windows\System\SRAltgh.exe
  C:\Windows\System\SRAltgh.exe
  2⤵
  PID:8100
- C:\Windows\System\QKXJvri.exe
  C:\Windows\System\QKXJvri.exe
  2⤵
  PID:8144
- C:\Windows\System\AyOaxZA.exe
  C:\Windows\System\AyOaxZA.exe
  2⤵
  PID:8040
- C:\Windows\System\nmbdkxb.exe
  C:\Windows\System\nmbdkxb.exe
  2⤵
  PID:7272
- C:\Windows\System\FaYYjYz.exe
  C:\Windows\System\FaYYjYz.exe
  2⤵
  PID:6940
- C:\Windows\System\wbfrPwj.exe
  C:\Windows\System\wbfrPwj.exe
  2⤵
  PID:7176
- C:\Windows\System\qiKpwiw.exe
  C:\Windows\System\qiKpwiw.exe
  2⤵
  PID:7804
- C:\Windows\System\IxOuMuX.exe
  C:\Windows\System\IxOuMuX.exe
  2⤵
  PID:8200
- C:\Windows\System\vlNSmjA.exe
  C:\Windows\System\vlNSmjA.exe
  2⤵
  PID:8228
- C:\Windows\System\NwQRltB.exe
  C:\Windows\System\NwQRltB.exe
  2⤵
  PID:8252
- C:\Windows\System\JBxpWDt.exe
  C:\Windows\System\JBxpWDt.exe
  2⤵
  PID:8276
- C:\Windows\System\YRnlELQ.exe
  C:\Windows\System\YRnlELQ.exe
  2⤵
  PID:8320
- C:\Windows\System\oIyjRYl.exe
  C:\Windows\System\oIyjRYl.exe
  2⤵
  PID:8348
- C:\Windows\System\TESypxX.exe
  C:\Windows\System\TESypxX.exe
  2⤵
  PID:8372
- C:\Windows\System\yxeJEbm.exe
  C:\Windows\System\yxeJEbm.exe
  2⤵
  PID:8396
- C:\Windows\System\OhWFFIk.exe
  C:\Windows\System\OhWFFIk.exe
  2⤵
  PID:8420
- C:\Windows\System\uHbQVnX.exe
  C:\Windows\System\uHbQVnX.exe
  2⤵
  PID:8448
- C:\Windows\System\bbOvTBP.exe
  C:\Windows\System\bbOvTBP.exe
  2⤵
  PID:8472
- C:\Windows\System\SDphbjq.exe
  C:\Windows\System\SDphbjq.exe
  2⤵
  PID:8488
- C:\Windows\System\KfCNxFh.exe
  C:\Windows\System\KfCNxFh.exe
  2⤵
  PID:8512
- C:\Windows\System\jOsKXxd.exe
  C:\Windows\System\jOsKXxd.exe
  2⤵
  PID:8536
- C:\Windows\System\wzXcoze.exe
  C:\Windows\System\wzXcoze.exe
  2⤵
  PID:8568
- C:\Windows\System\FqxIZdy.exe
  C:\Windows\System\FqxIZdy.exe
  2⤵
  PID:8596
- C:\Windows\System\pLgeKCd.exe
  C:\Windows\System\pLgeKCd.exe
  2⤵
  PID:8624
- C:\Windows\System\JezZzEp.exe
  C:\Windows\System\JezZzEp.exe
  2⤵
  PID:8652
- C:\Windows\System\DGjMwWA.exe
  C:\Windows\System\DGjMwWA.exe
  2⤵
  PID:8676
- C:\Windows\System\lkcqHAT.exe
  C:\Windows\System\lkcqHAT.exe
  2⤵
  PID:8696
- C:\Windows\System\XAECAJf.exe
  C:\Windows\System\XAECAJf.exe
  2⤵
  PID:8728
- C:\Windows\System\hKcYbze.exe
  C:\Windows\System\hKcYbze.exe
  2⤵
  PID:8760
- C:\Windows\System\aoyXgiS.exe
  C:\Windows\System\aoyXgiS.exe
  2⤵
  PID:8792
- C:\Windows\System\FkJnRbr.exe
  C:\Windows\System\FkJnRbr.exe
  2⤵
  PID:8816
- C:\Windows\System\cjYuxqG.exe
  C:\Windows\System\cjYuxqG.exe
  2⤵
  PID:8840
- C:\Windows\System\EJooNJi.exe
  C:\Windows\System\EJooNJi.exe
  2⤵
  PID:8876
- C:\Windows\System\yDmmuqc.exe
  C:\Windows\System\yDmmuqc.exe
  2⤵
  PID:8896
- C:\Windows\System\dSrYGsm.exe
  C:\Windows\System\dSrYGsm.exe
  2⤵
  PID:8920
- C:\Windows\System\LlAGcDA.exe
  C:\Windows\System\LlAGcDA.exe
  2⤵
  PID:8956
- C:\Windows\System\bYHLESN.exe
  C:\Windows\System\bYHLESN.exe
  2⤵
  PID:8980
- C:\Windows\System\nJpTZSZ.exe
  C:\Windows\System\nJpTZSZ.exe
  2⤵
  PID:9008
- C:\Windows\System\yJdTOQM.exe
  C:\Windows\System\yJdTOQM.exe
  2⤵
  PID:9036
- C:\Windows\System\HCvfSkN.exe
  C:\Windows\System\HCvfSkN.exe
  2⤵
  PID:9060
- C:\Windows\System\lDzKmAw.exe
  C:\Windows\System\lDzKmAw.exe
  2⤵
  PID:9080
- C:\Windows\System\jrfrVCu.exe
  C:\Windows\System\jrfrVCu.exe
  2⤵
  PID:9112
- C:\Windows\System\cTNEJwH.exe
  C:\Windows\System\cTNEJwH.exe
  2⤵
  PID:9132
- C:\Windows\System\NNbtzVv.exe
  C:\Windows\System\NNbtzVv.exe
  2⤵
  PID:9160
- C:\Windows\System\IrSvWqj.exe
  C:\Windows\System\IrSvWqj.exe
  2⤵
  PID:9180
- C:\Windows\System\xvCKXVQ.exe
  C:\Windows\System\xvCKXVQ.exe
  2⤵
  PID:9200
- C:\Windows\System\CKozPmE.exe
  C:\Windows\System\CKozPmE.exe
  2⤵
  PID:7024
- C:\Windows\System\OyyCUAe.exe
  C:\Windows\System\OyyCUAe.exe
  2⤵
  PID:8072
- C:\Windows\System\lQdFhnH.exe
  C:\Windows\System\lQdFhnH.exe
  2⤵
  PID:6848
- C:\Windows\System\MvmZrgP.exe
  C:\Windows\System\MvmZrgP.exe
  2⤵
  PID:7228
- C:\Windows\System\VHgzBrg.exe
  C:\Windows\System\VHgzBrg.exe
  2⤵
  PID:7932
- C:\Windows\System\NsVlEtG.exe
  C:\Windows\System\NsVlEtG.exe
  2⤵
  PID:8244
- C:\Windows\System\TTAYsFZ.exe
  C:\Windows\System\TTAYsFZ.exe
  2⤵
  PID:8288
- C:\Windows\System\mdOtZfP.exe
  C:\Windows\System\mdOtZfP.exe
  2⤵
  PID:7648
- C:\Windows\System\nOEQruv.exe
  C:\Windows\System\nOEQruv.exe
  2⤵
  PID:8356
- C:\Windows\System\FWryHgC.exe
  C:\Windows\System\FWryHgC.exe
  2⤵
  PID:8440
- C:\Windows\System\OcpLdbe.exe
  C:\Windows\System\OcpLdbe.exe
  2⤵
  PID:6252
- C:\Windows\System\sUcDzuY.exe
  C:\Windows\System\sUcDzuY.exe
  2⤵
  PID:8580
- C:\Windows\System\GTIbfRa.exe
  C:\Windows\System\GTIbfRa.exe
  2⤵
  PID:8392
- C:\Windows\System\gmXGNAW.exe
  C:\Windows\System\gmXGNAW.exe
  2⤵
  PID:8412
- C:\Windows\System\HCQMcBd.exe
  C:\Windows\System\HCQMcBd.exe
  2⤵
  PID:8504
- C:\Windows\System\QRaiEqR.exe
  C:\Windows\System\QRaiEqR.exe
  2⤵
  PID:8776
- C:\Windows\System\EivQHAO.exe
  C:\Windows\System\EivQHAO.exe
  2⤵
  PID:8868
- C:\Windows\System\vzQKOSN.exe
  C:\Windows\System\vzQKOSN.exe
  2⤵
  PID:8904
- C:\Windows\System\LljRFzc.exe
  C:\Windows\System\LljRFzc.exe
  2⤵
  PID:8996
- C:\Windows\System\MsCdLYS.exe
  C:\Windows\System\MsCdLYS.exe
  2⤵
  PID:9028
- C:\Windows\System\mCPvqHW.exe
  C:\Windows\System\mCPvqHW.exe
  2⤵
  PID:9096
- C:\Windows\System\KOGxWyp.exe
  C:\Windows\System\KOGxWyp.exe
  2⤵
  PID:9144
- C:\Windows\System\gQpOhTB.exe
  C:\Windows\System\gQpOhTB.exe
  2⤵
  PID:9196
- C:\Windows\System\wyQfhME.exe
  C:\Windows\System\wyQfhME.exe
  2⤵
  PID:6308
- C:\Windows\System\FGBnRQb.exe
  C:\Windows\System\FGBnRQb.exe
  2⤵
  PID:8772
- C:\Windows\System\xMpXUkz.exe
  C:\Windows\System\xMpXUkz.exe
  2⤵
  PID:7744
- C:\Windows\System\UccfawA.exe
  C:\Windows\System\UccfawA.exe
  2⤵
  PID:9228
- C:\Windows\System\LaqKOVI.exe
  C:\Windows\System\LaqKOVI.exe
  2⤵
  PID:9256
- C:\Windows\System\JhqUECM.exe
  C:\Windows\System\JhqUECM.exe
  2⤵
  PID:9276
- C:\Windows\System\eRdzTVb.exe
  C:\Windows\System\eRdzTVb.exe
  2⤵
  PID:9300
- C:\Windows\System\mHMSDWu.exe
  C:\Windows\System\mHMSDWu.exe
  2⤵
  PID:9332
- C:\Windows\System\VkVGVbz.exe
  C:\Windows\System\VkVGVbz.exe
  2⤵
  PID:9360
- C:\Windows\System\WJCMFTE.exe
  C:\Windows\System\WJCMFTE.exe
  2⤵
  PID:9392
- C:\Windows\System\uVDTIKv.exe
  C:\Windows\System\uVDTIKv.exe
  2⤵
  PID:9424
- C:\Windows\System\vDhJbWH.exe
  C:\Windows\System\vDhJbWH.exe
  2⤵
  PID:9452
- C:\Windows\System\FDFPjVc.exe
  C:\Windows\System\FDFPjVc.exe
  2⤵
  PID:9476
- C:\Windows\System\egtwYsd.exe
  C:\Windows\System\egtwYsd.exe
  2⤵
  PID:9500
- C:\Windows\System\ZsLIRHg.exe
  C:\Windows\System\ZsLIRHg.exe
  2⤵
  PID:9524
- C:\Windows\System\vmlbcTl.exe
  C:\Windows\System\vmlbcTl.exe
  2⤵
  PID:9552
- C:\Windows\System\KHtjjwa.exe
  C:\Windows\System\KHtjjwa.exe
  2⤵
  PID:9580
- C:\Windows\System\CQbdSpS.exe
  C:\Windows\System\CQbdSpS.exe
  2⤵
  PID:9600
- C:\Windows\System\BMIesSY.exe
  C:\Windows\System\BMIesSY.exe
  2⤵
  PID:9632
- C:\Windows\System\ifPGUvZ.exe
  C:\Windows\System\ifPGUvZ.exe
  2⤵
  PID:9656
- C:\Windows\System\NaDsUMh.exe
  C:\Windows\System\NaDsUMh.exe
  2⤵
  PID:9676
- C:\Windows\System\rlNDCJN.exe
  C:\Windows\System\rlNDCJN.exe
  2⤵
  PID:9704
- C:\Windows\System\eitjzWX.exe
  C:\Windows\System\eitjzWX.exe
  2⤵
  PID:9728
- C:\Windows\System\PeAdvzH.exe
  C:\Windows\System\PeAdvzH.exe
  2⤵
  PID:9748
- C:\Windows\System\FtlNDFw.exe
  C:\Windows\System\FtlNDFw.exe
  2⤵
  PID:9772
- C:\Windows\System\ObNKaWY.exe
  C:\Windows\System\ObNKaWY.exe
  2⤵
  PID:9792
- C:\Windows\System\QvowCvW.exe
  C:\Windows\System\QvowCvW.exe
  2⤵
  PID:9820
- C:\Windows\System\buaLkKZ.exe
  C:\Windows\System\buaLkKZ.exe
  2⤵
  PID:9840
- C:\Windows\System\AgLEkjO.exe
  C:\Windows\System\AgLEkjO.exe
  2⤵
  PID:9868
- C:\Windows\System\vlFWyly.exe
  C:\Windows\System\vlFWyly.exe
  2⤵
  PID:9900
- C:\Windows\System\wYhJdct.exe
  C:\Windows\System\wYhJdct.exe
  2⤵
  PID:9920
- C:\Windows\System\GDQFvsp.exe
  C:\Windows\System\GDQFvsp.exe
  2⤵
  PID:9948
- C:\Windows\System\cJRffXC.exe
  C:\Windows\System\cJRffXC.exe
  2⤵
  PID:9972
- C:\Windows\System\IHjFAEk.exe
  C:\Windows\System\IHjFAEk.exe
  2⤵
  PID:10000
- C:\Windows\System\sPPFfBL.exe
  C:\Windows\System\sPPFfBL.exe
  2⤵
  PID:10020
- C:\Windows\System\nAHpHjJ.exe
  C:\Windows\System\nAHpHjJ.exe
  2⤵
  PID:10048
- C:\Windows\System\ETAkiwd.exe
  C:\Windows\System\ETAkiwd.exe
  2⤵
  PID:10068
- C:\Windows\System\fbuafNa.exe
  C:\Windows\System\fbuafNa.exe
  2⤵
  PID:10092
- C:\Windows\System\uSWyLbI.exe
  C:\Windows\System\uSWyLbI.exe
  2⤵
  PID:10124
- C:\Windows\System\YmOFGhy.exe
  C:\Windows\System\YmOFGhy.exe
  2⤵
  PID:10152
- C:\Windows\System\HiufgLe.exe
  C:\Windows\System\HiufgLe.exe
  2⤵
  PID:10180
- C:\Windows\System\vaSjGSN.exe
  C:\Windows\System\vaSjGSN.exe
  2⤵
  PID:10208
- C:\Windows\System\FXyHeCN.exe
  C:\Windows\System\FXyHeCN.exe
  2⤵
  PID:10228
- C:\Windows\System\cwiMnAI.exe
  C:\Windows\System\cwiMnAI.exe
  2⤵
  PID:6168
- C:\Windows\System\zarTSlT.exe
  C:\Windows\System\zarTSlT.exe
  2⤵
  PID:8856
- C:\Windows\System\FNpGMIJ.exe
  C:\Windows\System\FNpGMIJ.exe
  2⤵
  PID:9044
- C:\Windows\System\NoItCfX.exe
  C:\Windows\System\NoItCfX.exe
  2⤵
  PID:9176
- C:\Windows\System\GBokzpe.exe
  C:\Windows\System\GBokzpe.exe
  2⤵
  PID:8168
- C:\Windows\System\aSbOsFH.exe
  C:\Windows\System\aSbOsFH.exe
  2⤵
  PID:7404
- C:\Windows\System\WSyxEoE.exe
  C:\Windows\System\WSyxEoE.exe
  2⤵
  PID:9356
- C:\Windows\System\CeMbvTX.exe
  C:\Windows\System\CeMbvTX.exe
  2⤵
  PID:9408
- C:\Windows\System\XsaYIpc.exe
  C:\Windows\System\XsaYIpc.exe
  2⤵
  PID:7320
- C:\Windows\System\qtljHPe.exe
  C:\Windows\System\qtljHPe.exe
  2⤵
  PID:9468
- C:\Windows\System\DBQbujV.exe
  C:\Windows\System\DBQbujV.exe
  2⤵
  PID:7252
- C:\Windows\System\SFsrpXX.exe
  C:\Windows\System\SFsrpXX.exe
  2⤵
  PID:9620
- C:\Windows\System\zGCYOVp.exe
  C:\Windows\System\zGCYOVp.exe
  2⤵
  PID:8668
- C:\Windows\System\zLOgdkh.exe
  C:\Windows\System\zLOgdkh.exe
  2⤵
  PID:9372
- C:\Windows\System\fEZkbXl.exe
  C:\Windows\System\fEZkbXl.exe
  2⤵
  PID:9740
- C:\Windows\System\qXvLjFl.exe
  C:\Windows\System\qXvLjFl.exe
  2⤵
  PID:9492
- C:\Windows\System\VSBfoRz.exe
  C:\Windows\System\VSBfoRz.exe
  2⤵
  PID:9944
- C:\Windows\System\zoBYITr.exe
  C:\Windows\System\zoBYITr.exe
  2⤵
  PID:10032
- C:\Windows\System\BGlxHOD.exe
  C:\Windows\System\BGlxHOD.exe
  2⤵
  PID:9672
- C:\Windows\System\sptJhXR.exe
  C:\Windows\System\sptJhXR.exe
  2⤵
  PID:10160
- C:\Windows\System\yBjgpPe.exe
  C:\Windows\System\yBjgpPe.exe
  2⤵
  PID:10220
- C:\Windows\System\kCURKiZ.exe
  C:\Windows\System\kCURKiZ.exe
  2⤵
  PID:9068
- C:\Windows\System\QFUBoWN.exe
  C:\Windows\System\QFUBoWN.exe
  2⤵
  PID:9992
- C:\Windows\System\fvhqDYy.exe
  C:\Windows\System\fvhqDYy.exe
  2⤵
  PID:9224
- C:\Windows\System\aIVbQuY.exe
  C:\Windows\System\aIVbQuY.exe
  2⤵
  PID:10256
- C:\Windows\System\LyLeXeB.exe
  C:\Windows\System\LyLeXeB.exe
  2⤵
  PID:10280
- C:\Windows\System\KdBJqgr.exe
  C:\Windows\System\KdBJqgr.exe
  2⤵
  PID:10304
- C:\Windows\System\vMIsMlM.exe
  C:\Windows\System\vMIsMlM.exe
  2⤵
  PID:10332
- C:\Windows\System\YCLqRKN.exe
  C:\Windows\System\YCLqRKN.exe
  2⤵
  PID:10348
- C:\Windows\System\LZLDsMb.exe
  C:\Windows\System\LZLDsMb.exe
  2⤵
  PID:10368
- C:\Windows\System\YsuCLbo.exe
  C:\Windows\System\YsuCLbo.exe
  2⤵
  PID:10388
- C:\Windows\System\EDriSmD.exe
  C:\Windows\System\EDriSmD.exe
  2⤵
  PID:10412
- C:\Windows\System\lrFjlQA.exe
  C:\Windows\System\lrFjlQA.exe
  2⤵
  PID:10440
- C:\Windows\System\eWAaJCM.exe
  C:\Windows\System\eWAaJCM.exe
  2⤵
  PID:10464
- C:\Windows\System\KwHIhZJ.exe
  C:\Windows\System\KwHIhZJ.exe
  2⤵
  PID:10488
- C:\Windows\System\XLQKCxZ.exe
  C:\Windows\System\XLQKCxZ.exe
  2⤵
  PID:10520
- C:\Windows\System\ZQOADpT.exe
  C:\Windows\System\ZQOADpT.exe
  2⤵
  PID:10544
- C:\Windows\System\AMhDkYS.exe
  C:\Windows\System\AMhDkYS.exe
  2⤵
  PID:10568
- C:\Windows\System\NlVKHqZ.exe
  C:\Windows\System\NlVKHqZ.exe
  2⤵
  PID:10588
- C:\Windows\System\zeHcFoo.exe
  C:\Windows\System\zeHcFoo.exe
  2⤵
  PID:10608
- C:\Windows\System\ftelUlR.exe
  C:\Windows\System\ftelUlR.exe
  2⤵
  PID:10632
- C:\Windows\System\uMYcZzj.exe
  C:\Windows\System\uMYcZzj.exe
  2⤵
  PID:10656
- C:\Windows\System\qGZvAQM.exe
  C:\Windows\System\qGZvAQM.exe
  2⤵
  PID:10680
- C:\Windows\System\TjnivUe.exe
  C:\Windows\System\TjnivUe.exe
  2⤵
  PID:10704
- C:\Windows\System\tttbvvj.exe
  C:\Windows\System\tttbvvj.exe
  2⤵
  PID:10728
- C:\Windows\System\NOqgaHL.exe
  C:\Windows\System\NOqgaHL.exe
  2⤵
  PID:10756
- C:\Windows\System\LsaAEtm.exe
  C:\Windows\System\LsaAEtm.exe
  2⤵
  PID:10788
- C:\Windows\System\eQqHHbS.exe
  C:\Windows\System\eQqHHbS.exe
  2⤵
  PID:10816
- C:\Windows\System\wnHIbJE.exe
  C:\Windows\System\wnHIbJE.exe
  2⤵
  PID:10836
- C:\Windows\System\QzcFciD.exe
  C:\Windows\System\QzcFciD.exe
  2⤵
  PID:10864
- C:\Windows\System\TkkRkwh.exe
  C:\Windows\System\TkkRkwh.exe
  2⤵
  PID:10888
- C:\Windows\System\EKaHeGw.exe
  C:\Windows\System\EKaHeGw.exe
  2⤵
  PID:10920
- C:\Windows\System\bqyPPOr.exe
  C:\Windows\System\bqyPPOr.exe
  2⤵
  PID:10940
- C:\Windows\System\oRkXgvA.exe
  C:\Windows\System\oRkXgvA.exe
  2⤵
  PID:10964
- C:\Windows\System\usuHHpq.exe
  C:\Windows\System\usuHHpq.exe
  2⤵
  PID:10996
- C:\Windows\System\rlpdMMp.exe
  C:\Windows\System\rlpdMMp.exe
  2⤵
  PID:11020
- C:\Windows\System\uapdcFD.exe
  C:\Windows\System\uapdcFD.exe
  2⤵
  PID:11040
- C:\Windows\System\YFiNEPH.exe
  C:\Windows\System\YFiNEPH.exe
  2⤵
  PID:11064
- C:\Windows\System\WIsWQcR.exe
  C:\Windows\System\WIsWQcR.exe
  2⤵
  PID:11088
- C:\Windows\System\XGZHwYq.exe
  C:\Windows\System\XGZHwYq.exe
  2⤵
  PID:11112
- C:\Windows\System\jziiroQ.exe
  C:\Windows\System\jziiroQ.exe
  2⤵
  PID:11132
- C:\Windows\System\OBgOAHk.exe
  C:\Windows\System\OBgOAHk.exe
  2⤵
  PID:11164
- C:\Windows\System\zsUTTLE.exe
  C:\Windows\System\zsUTTLE.exe
  2⤵
  PID:11196
- C:\Windows\System\BpZZTwk.exe
  C:\Windows\System\BpZZTwk.exe
  2⤵
  PID:11224
- C:\Windows\System\ZcyVFeQ.exe
  C:\Windows\System\ZcyVFeQ.exe
  2⤵
  PID:11252
- C:\Windows\System\WMZASKu.exe
  C:\Windows\System\WMZASKu.exe
  2⤵
  PID:9764
- C:\Windows\System\qoVfHXn.exe
  C:\Windows\System\qoVfHXn.exe
  2⤵
  PID:9808
- C:\Windows\System\lTDtyBP.exe
  C:\Windows\System\lTDtyBP.exe
  2⤵
  PID:9464
- C:\Windows\System\oxBxehB.exe
  C:\Windows\System\oxBxehB.exe
  2⤵
  PID:8640
- C:\Windows\System\UvvqRCE.exe
  C:\Windows\System\UvvqRCE.exe
  2⤵
  PID:9984
- C:\Windows\System\hUgiTfo.exe
  C:\Windows\System\hUgiTfo.exe
  2⤵
  PID:10016
- C:\Windows\System\oyYaJdl.exe
  C:\Windows\System\oyYaJdl.exe
  2⤵
  PID:8892
- C:\Windows\System\CcqYWiS.exe
  C:\Windows\System\CcqYWiS.exe
  2⤵
  PID:8972
- C:\Windows\System\zxdmxxl.exe
  C:\Windows\System\zxdmxxl.exe
  2⤵
  PID:10252
- C:\Windows\System\EmDCUYH.exe
  C:\Windows\System\EmDCUYH.exe
  2⤵
  PID:10164
- C:\Windows\System\DHqGZbf.exe
  C:\Windows\System\DHqGZbf.exe
  2⤵
  PID:10432
- C:\Windows\System\RQlTexg.exe
  C:\Windows\System\RQlTexg.exe
  2⤵
  PID:7980
- C:\Windows\System\sTgwRhR.exe
  C:\Windows\System\sTgwRhR.exe
  2⤵
  PID:9520
- C:\Windows\System\RtzUnXW.exe
  C:\Windows\System\RtzUnXW.exe
  2⤵
  PID:10676
- C:\Windows\System\SkQhbSK.exe
  C:\Windows\System\SkQhbSK.exe
  2⤵
  PID:9932
- C:\Windows\System\YUVyKpL.exe
  C:\Windows\System\YUVyKpL.exe
  2⤵
  PID:10908
- C:\Windows\System\JmVTGlC.exe
  C:\Windows\System\JmVTGlC.exe
  2⤵
  PID:9876
- C:\Windows\System\OkyGbNw.exe
  C:\Windows\System\OkyGbNw.exe
  2⤵
  PID:9960
- C:\Windows\System\WTkZJMH.exe
  C:\Windows\System\WTkZJMH.exe
  2⤵
  PID:10644
- C:\Windows\System\vlhRJEt.exe
  C:\Windows\System\vlhRJEt.exe
  2⤵
  PID:11108
- C:\Windows\System\OaaljCz.exe
  C:\Windows\System\OaaljCz.exe
  2⤵
  PID:10292
- C:\Windows\System\tzHWodQ.exe
  C:\Windows\System\tzHWodQ.exe
  2⤵
  PID:11212
- C:\Windows\System\anMqVGG.exe
  C:\Windows\System\anMqVGG.exe
  2⤵
  PID:10936
- C:\Windows\System\SMoIeoA.exe
  C:\Windows\System\SMoIeoA.exe
  2⤵
  PID:11284
- C:\Windows\System\yylLCQI.exe
  C:\Windows\System\yylLCQI.exe
  2⤵
  PID:11312
- C:\Windows\System\XvesGlu.exe
  C:\Windows\System\XvesGlu.exe
  2⤵
  PID:11332
- C:\Windows\System\bFTMCtE.exe
  C:\Windows\System\bFTMCtE.exe
  2⤵
  PID:11356
- C:\Windows\System\AKhVFhG.exe
  C:\Windows\System\AKhVFhG.exe
  2⤵
  PID:11380
- C:\Windows\System\cayqSgw.exe
  C:\Windows\System\cayqSgw.exe
  2⤵
  PID:11412
- C:\Windows\System\WpmQusF.exe
  C:\Windows\System\WpmQusF.exe
  2⤵
  PID:11436
- C:\Windows\System\OlYrDMC.exe
  C:\Windows\System\OlYrDMC.exe
  2⤵
  PID:11468
- C:\Windows\System\IofXKUU.exe
  C:\Windows\System\IofXKUU.exe
  2⤵
  PID:11484
- C:\Windows\System\GjMpfcK.exe
  C:\Windows\System\GjMpfcK.exe
  2⤵
  PID:11512
- C:\Windows\System\kWHJtYU.exe
  C:\Windows\System\kWHJtYU.exe
  2⤵
  PID:11544
- C:\Windows\System\opRgZoL.exe
  C:\Windows\System\opRgZoL.exe
  2⤵
  PID:11564
- C:\Windows\System\HlOsbDc.exe
  C:\Windows\System\HlOsbDc.exe
  2⤵
  PID:11596
- C:\Windows\System\YCUxFWj.exe
  C:\Windows\System\YCUxFWj.exe
  2⤵
  PID:11620
- C:\Windows\System\bJvGfPO.exe
  C:\Windows\System\bJvGfPO.exe
  2⤵
  PID:11644
- C:\Windows\System\JsDAByr.exe
  C:\Windows\System\JsDAByr.exe
  2⤵
  PID:11668
- C:\Windows\System\iovJQhN.exe
  C:\Windows\System\iovJQhN.exe
  2⤵
  PID:11704
- C:\Windows\System\PdJDzfj.exe
  C:\Windows\System\PdJDzfj.exe
  2⤵
  PID:11732
- C:\Windows\System\eRHwSCq.exe
  C:\Windows\System\eRHwSCq.exe
  2⤵
  PID:11768
- C:\Windows\System\MWhGkuK.exe
  C:\Windows\System\MWhGkuK.exe
  2⤵
  PID:11796
- C:\Windows\System\VWpERkw.exe
  C:\Windows\System\VWpERkw.exe
  2⤵
  PID:11824
- C:\Windows\System\bjtMLXx.exe
  C:\Windows\System\bjtMLXx.exe
  2⤵
  PID:11860
- C:\Windows\System\KMiZgxS.exe
  C:\Windows\System\KMiZgxS.exe
  2⤵
  PID:11884
- C:\Windows\System\wRqxzpH.exe
  C:\Windows\System\wRqxzpH.exe
  2⤵
  PID:11912
- C:\Windows\System\thumlvD.exe
  C:\Windows\System\thumlvD.exe
  2⤵
  PID:11932
- C:\Windows\System\YBCmtNt.exe
  C:\Windows\System\YBCmtNt.exe
  2⤵
  PID:11964
- C:\Windows\System\YjCqKhl.exe
  C:\Windows\System\YjCqKhl.exe
  2⤵
  PID:11992
- C:\Windows\System\XXYNgQC.exe
  C:\Windows\System\XXYNgQC.exe
  2⤵
  PID:12024
- C:\Windows\System\kWIEMND.exe
  C:\Windows\System\kWIEMND.exe
  2⤵
  PID:12044
- C:\Windows\System\YGZuHBV.exe
  C:\Windows\System\YGZuHBV.exe
  2⤵
  PID:12072
- C:\Windows\System\YbtkPLy.exe
  C:\Windows\System\YbtkPLy.exe
  2⤵
  PID:12100
- C:\Windows\System\PzBegOW.exe
  C:\Windows\System\PzBegOW.exe
  2⤵
  PID:12132
- C:\Windows\System\StVvnmy.exe
  C:\Windows\System\StVvnmy.exe
  2⤵
  PID:12156
- C:\Windows\System\bpwJsrn.exe
  C:\Windows\System\bpwJsrn.exe
  2⤵
  PID:12176
- C:\Windows\System\GBkHISV.exe
  C:\Windows\System\GBkHISV.exe
  2⤵
  PID:12200
- C:\Windows\System\qtEjeTW.exe
  C:\Windows\System\qtEjeTW.exe
  2⤵
  PID:12232
- C:\Windows\System\yDvXhBU.exe
  C:\Windows\System\yDvXhBU.exe
  2⤵
  PID:12260
- C:\Windows\System\jdRioGy.exe
  C:\Windows\System\jdRioGy.exe
  2⤵
  PID:12280
- C:\Windows\System\iIPDJIl.exe
  C:\Windows\System\iIPDJIl.exe
  2⤵
  PID:10516
- C:\Windows\System\WjVlUIw.exe
  C:\Windows\System\WjVlUIw.exe
  2⤵
  PID:10540
- C:\Windows\System\zxPEdwU.exe
  C:\Windows\System\zxPEdwU.exe
  2⤵
  PID:9756
- C:\Windows\System\vxidPQT.exe
  C:\Windows\System\vxidPQT.exe
  2⤵
  PID:11028
- C:\Windows\System\wsilESA.exe
  C:\Windows\System\wsilESA.exe
  2⤵
  PID:10720
- C:\Windows\System\UdeZbgh.exe
  C:\Windows\System\UdeZbgh.exe
  2⤵
  PID:10300
- C:\Windows\System\SvahyOf.exe
  C:\Windows\System\SvahyOf.exe
  2⤵
  PID:10812
- C:\Windows\System\GZYXKOg.exe
  C:\Windows\System\GZYXKOg.exe
  2⤵
  PID:10716
- C:\Windows\System\XdmSHyS.exe
  C:\Windows\System\XdmSHyS.exe
  2⤵
  PID:10796
- C:\Windows\System\feFLrSj.exe
  C:\Windows\System\feFLrSj.exe
  2⤵
  PID:10952
- C:\Windows\System\ZxIVHhU.exe
  C:\Windows\System\ZxIVHhU.exe
  2⤵
  PID:11320
- C:\Windows\System\SrGJjju.exe
  C:\Windows\System\SrGJjju.exe
  2⤵
  PID:11460
- C:\Windows\System\TxcltTF.exe
  C:\Windows\System\TxcltTF.exe
  2⤵
  PID:11060
- C:\Windows\System\XHEBjsJ.exe
  C:\Windows\System\XHEBjsJ.exe
  2⤵
  PID:10480
- C:\Windows\System\bQvJCbA.exe
  C:\Windows\System\bQvJCbA.exe
  2⤵
  PID:11612
- C:\Windows\System\mbIlwtq.exe
  C:\Windows\System\mbIlwtq.exe
  2⤵
  PID:11656
- C:\Windows\System\KMRHNTa.exe
  C:\Windows\System\KMRHNTa.exe
  2⤵
  PID:11172
- C:\Windows\System\oKLtyCq.exe
  C:\Windows\System\oKLtyCq.exe
  2⤵
  PID:11756
- C:\Windows\System\wWCHPUu.exe
  C:\Windows\System\wWCHPUu.exe
  2⤵
  PID:11780
- C:\Windows\System\qkwGdpU.exe
  C:\Windows\System\qkwGdpU.exe
  2⤵
  PID:10832
- C:\Windows\System\HCBPDae.exe
  C:\Windows\System\HCBPDae.exe
  2⤵
  PID:11244
- C:\Windows\System\uHgFaXg.exe
  C:\Windows\System\uHgFaXg.exe
  2⤵
  PID:10040
- C:\Windows\System\jHXiTNC.exe
  C:\Windows\System\jHXiTNC.exe
  2⤵
  PID:8708
- C:\Windows\System\xseSOKQ.exe
  C:\Windows\System\xseSOKQ.exe
  2⤵
  PID:12168
- C:\Windows\System\qQigdtl.exe
  C:\Windows\System\qQigdtl.exe
  2⤵
  PID:12192
- C:\Windows\System\ucGUXHm.exe
  C:\Windows\System\ucGUXHm.exe
  2⤵
  PID:11716
- C:\Windows\System\qRBSfsQ.exe
  C:\Windows\System\qRBSfsQ.exe
  2⤵
  PID:11740
- C:\Windows\System\ZTLryiJ.exe
  C:\Windows\System\ZTLryiJ.exe
  2⤵
  PID:11348
- C:\Windows\System\mMaMioB.exe
  C:\Windows\System\mMaMioB.exe
  2⤵
  PID:12036
- C:\Windows\System\yaqwRGt.exe
  C:\Windows\System\yaqwRGt.exe
  2⤵
  PID:10476
- C:\Windows\System\QdkjdWt.exe
  C:\Windows\System\QdkjdWt.exe
  2⤵
  PID:11480
- C:\Windows\System\pEgXXec.exe
  C:\Windows\System\pEgXXec.exe
  2⤵
  PID:11524
- C:\Windows\System\rBWZrSp.exe
  C:\Windows\System\rBWZrSp.exe
  2⤵
  PID:11692
- C:\Windows\System\qfMKnmO.exe
  C:\Windows\System\qfMKnmO.exe
  2⤵
  PID:10932
- C:\Windows\System\RxAheqY.exe
  C:\Windows\System\RxAheqY.exe
  2⤵
  PID:12312
- C:\Windows\System\RnbwzHS.exe
  C:\Windows\System\RnbwzHS.exe
  2⤵
  PID:12336
- C:\Windows\System\DQqogFA.exe
  C:\Windows\System\DQqogFA.exe
  2⤵
  PID:12368
- C:\Windows\System\oyKlYvk.exe
  C:\Windows\System\oyKlYvk.exe
  2⤵
  PID:12392
- C:\Windows\System\UlvoYHn.exe
  C:\Windows\System\UlvoYHn.exe
  2⤵
  PID:12412
- C:\Windows\System\VYMVGXb.exe
  C:\Windows\System\VYMVGXb.exe
  2⤵
  PID:12428
- C:\Windows\System\hrdSvNV.exe
  C:\Windows\System\hrdSvNV.exe
  2⤵
  PID:12444
- C:\Windows\System\hriWceb.exe
  C:\Windows\System\hriWceb.exe
  2⤵
  PID:12464
- C:\Windows\System\OHhnaEK.exe
  C:\Windows\System\OHhnaEK.exe
  2⤵
  PID:12488
- C:\Windows\System\WJWCyPq.exe
  C:\Windows\System\WJWCyPq.exe
  2⤵
  PID:12508
- C:\Windows\System\zTHmejM.exe
  C:\Windows\System\zTHmejM.exe
  2⤵
  PID:12536
- C:\Windows\System\QYzZSZF.exe
  C:\Windows\System\QYzZSZF.exe
  2⤵
  PID:12564
- C:\Windows\System\BuuYEWo.exe
  C:\Windows\System\BuuYEWo.exe
  2⤵
  PID:12588
- C:\Windows\System\BRSfIOP.exe
  C:\Windows\System\BRSfIOP.exe
  2⤵
  PID:12608
- C:\Windows\System\xzGDgaN.exe
  C:\Windows\System\xzGDgaN.exe
  2⤵
  PID:12632
- C:\Windows\System\UzgUVCH.exe
  C:\Windows\System\UzgUVCH.exe
  2⤵
  PID:12664
- C:\Windows\System\UrPuJXb.exe
  C:\Windows\System\UrPuJXb.exe
  2⤵
  PID:12684
- C:\Windows\System\bKoXvAi.exe
  C:\Windows\System\bKoXvAi.exe
  2⤵
  PID:12732
- C:\Windows\System\ifqpKuo.exe
  C:\Windows\System\ifqpKuo.exe
  2⤵
  PID:12760
- C:\Windows\System\xaNuION.exe
  C:\Windows\System\xaNuION.exe
  2⤵
  PID:12784
- C:\Windows\System\ryaEzYd.exe
  C:\Windows\System\ryaEzYd.exe
  2⤵
  PID:12808
- C:\Windows\System\hTceehD.exe
  C:\Windows\System\hTceehD.exe
  2⤵
  PID:12832
- C:\Windows\System\AJEVpdx.exe
  C:\Windows\System\AJEVpdx.exe
  2⤵
  PID:12856
- C:\Windows\System\HqDFvPI.exe
  C:\Windows\System\HqDFvPI.exe
  2⤵
  PID:12884
- C:\Windows\System\nkgqRec.exe
  C:\Windows\System\nkgqRec.exe
  2⤵
  PID:12904
- C:\Windows\System\xcWEgIR.exe
  C:\Windows\System\xcWEgIR.exe
  2⤵
  PID:12924
- C:\Windows\System\cfDmcug.exe
  C:\Windows\System\cfDmcug.exe
  2⤵
  PID:12948
- C:\Windows\System\lTzHquY.exe
  C:\Windows\System\lTzHquY.exe
  2⤵
  PID:12976
- C:\Windows\System\XuojwBX.exe
  C:\Windows\System\XuojwBX.exe
  2⤵
  PID:12996
- C:\Windows\System\FRDzyoB.exe
  C:\Windows\System\FRDzyoB.exe
  2⤵
  PID:13012
- C:\Windows\System\kkJGEiw.exe
  C:\Windows\System\kkJGEiw.exe
  2⤵
  PID:13040
- C:\Windows\System\MiIGvqU.exe
  C:\Windows\System\MiIGvqU.exe
  2⤵
  PID:13068
- C:\Windows\System\ufyYhoJ.exe
  C:\Windows\System\ufyYhoJ.exe
  2⤵
  PID:13096
- C:\Windows\System\sMYxazq.exe
  C:\Windows\System\sMYxazq.exe
  2⤵
  PID:13120
- C:\Windows\System\YJqNpHq.exe
  C:\Windows\System\YJqNpHq.exe
  2⤵
  PID:13152
- C:\Windows\System\iZeIBEt.exe
  C:\Windows\System\iZeIBEt.exe
  2⤵
  PID:13176
- C:\Windows\System\qUvMMEX.exe
  C:\Windows\System\qUvMMEX.exe
  2⤵
  PID:13204
- C:\Windows\System\iEQFVot.exe
  C:\Windows\System\iEQFVot.exe
  2⤵
  PID:13228
- C:\Windows\System\AAEubPy.exe
  C:\Windows\System\AAEubPy.exe
  2⤵
  PID:13248
- C:\Windows\System\zsVdUdR.exe
  C:\Windows\System\zsVdUdR.exe
  2⤵
  PID:13280
- C:\Windows\System\piIAPfW.exe
  C:\Windows\System\piIAPfW.exe
  2⤵
  PID:13296
- C:\Windows\System\FMrsvxe.exe
  C:\Windows\System\FMrsvxe.exe
  2⤵
  PID:11960
- C:\Windows\System\HMnnBRc.exe
  C:\Windows\System\HMnnBRc.exe
  2⤵
  PID:12012
- C:\Windows\System\jbjwWpN.exe
  C:\Windows\System\jbjwWpN.exe
  2⤵
  PID:11292
- C:\Windows\System\cEKsEtj.exe
  C:\Windows\System\cEKsEtj.exe
  2⤵
  PID:11056
- C:\Windows\System\VTSgrfe.exe
  C:\Windows\System\VTSgrfe.exe
  2⤵
  PID:11664
- C:\Windows\System\GOkXVUL.exe
  C:\Windows\System\GOkXVUL.exe
  2⤵
  PID:9712
- C:\Windows\System\ioQLtcT.exe
  C:\Windows\System\ioQLtcT.exe
  2⤵
  PID:9272
- C:\Windows\System\VJyWrGa.exe
  C:\Windows\System\VJyWrGa.exe
  2⤵
  PID:9560
- C:\Windows\System\TQQgWdP.exe
  C:\Windows\System\TQQgWdP.exe
  2⤵
  PID:12268
- C:\Windows\System\mcWnBNs.exe
  C:\Windows\System\mcWnBNs.exe
  2⤵
  PID:12308
- C:\Windows\System\mdfEcuS.exe
  C:\Windows\System\mdfEcuS.exe
  2⤵
  PID:12388
- C:\Windows\System\yMVHaqO.exe
  C:\Windows\System\yMVHaqO.exe
  2⤵
  PID:11140
- C:\Windows\System\NNAtsjO.exe
  C:\Windows\System\NNAtsjO.exe
  2⤵
  PID:12520
- C:\Windows\System\OLpATZN.exe
  C:\Windows\System\OLpATZN.exe
  2⤵
  PID:12580
- C:\Windows\System\TCloTHe.exe
  C:\Windows\System\TCloTHe.exe
  2⤵
  PID:12672
- C:\Windows\System\MzBeaHM.exe
  C:\Windows\System\MzBeaHM.exe
  2⤵
  PID:11816
- C:\Windows\System\yglKPJY.exe
  C:\Windows\System\yglKPJY.exe
  2⤵
  PID:12084
- C:\Windows\System\GnvSxZJ.exe
  C:\Windows\System\GnvSxZJ.exe
  2⤵
  PID:11616
- C:\Windows\System\osVsFnA.exe
  C:\Windows\System\osVsFnA.exe
  2⤵
  PID:12896
- C:\Windows\System\nTnaXHm.exe
  C:\Windows\System\nTnaXHm.exe
  2⤵
  PID:12404
- C:\Windows\System\bnTunPp.exe
  C:\Windows\System\bnTunPp.exe
  2⤵
  PID:13064
- C:\Windows\System\zInmsoP.exe
  C:\Windows\System\zInmsoP.exe
  2⤵
  PID:13212
- C:\Windows\System\KPqyWad.exe
  C:\Windows\System\KPqyWad.exe
  2⤵
  PID:13344
- C:\Windows\System\qbCctYF.exe
  C:\Windows\System\qbCctYF.exe
  2⤵
  PID:13368
- C:\Windows\System\EaHmoKM.exe
  C:\Windows\System\EaHmoKM.exe
  2⤵
  PID:13388
- C:\Windows\System\neKdWWg.exe
  C:\Windows\System\neKdWWg.exe
  2⤵
  PID:13404
- C:\Windows\System\wJcOgzz.exe
  C:\Windows\System\wJcOgzz.exe
  2⤵
  PID:13432
- C:\Windows\System\kkkzCzf.exe
  C:\Windows\System\kkkzCzf.exe
  2⤵
  PID:13460
- C:\Windows\System\QbLfpqQ.exe
  C:\Windows\System\QbLfpqQ.exe
  2⤵
  PID:13492
- C:\Windows\System\dQLeIPa.exe
  C:\Windows\System\dQLeIPa.exe
  2⤵
  PID:13516
- C:\Windows\System\RHLJaoz.exe
  C:\Windows\System\RHLJaoz.exe
  2⤵
  PID:13544
- C:\Windows\System\rDqvola.exe
  C:\Windows\System\rDqvola.exe
  2⤵
  PID:13568
- C:\Windows\System\YvLAKoP.exe
  C:\Windows\System\YvLAKoP.exe
  2⤵
  PID:13600
- C:\Windows\System\Jnlnmmn.exe
  C:\Windows\System\Jnlnmmn.exe
  2⤵
  PID:13628
- C:\Windows\System\LcakesW.exe
  C:\Windows\System\LcakesW.exe
  2⤵
  PID:13652
- C:\Windows\System\DJXoMcW.exe
  C:\Windows\System\DJXoMcW.exe
  2⤵
  PID:13684
- C:\Windows\System\BclesMu.exe
  C:\Windows\System\BclesMu.exe
  2⤵
  PID:13704
- C:\Windows\System\WcTnSrp.exe
  C:\Windows\System\WcTnSrp.exe
  2⤵
  PID:13732
- C:\Windows\System\JFUAjOM.exe
  C:\Windows\System\JFUAjOM.exe
  2⤵
  PID:13760
- C:\Windows\System\kTaXNua.exe
  C:\Windows\System\kTaXNua.exe
  2⤵
  PID:13788
- C:\Windows\System\lpBDGFN.exe
  C:\Windows\System\lpBDGFN.exe
  2⤵
  PID:13808
- C:\Windows\System\KQsxOcY.exe
  C:\Windows\System\KQsxOcY.exe
  2⤵
  PID:13836
- C:\Windows\System\egKrVWv.exe
  C:\Windows\System\egKrVWv.exe
  2⤵
  PID:13856
- C:\Windows\System\yAkZWMF.exe
  C:\Windows\System\yAkZWMF.exe
  2⤵
  PID:13884
- C:\Windows\System\UhCcMsd.exe
  C:\Windows\System\UhCcMsd.exe
  2⤵
  PID:13908
- C:\Windows\System\TxwGXTp.exe
  C:\Windows\System\TxwGXTp.exe
  2⤵
  PID:13936
- C:\Windows\System\VuzNNCu.exe
  C:\Windows\System\VuzNNCu.exe
  2⤵
  PID:13968
- C:\Windows\System\pYIbnoi.exe
  C:\Windows\System\pYIbnoi.exe
  2⤵
  PID:13992
- C:\Windows\System\GKUANtl.exe
  C:\Windows\System\GKUANtl.exe
  2⤵
  PID:14016
- C:\Windows\System\WeHnGZg.exe
  C:\Windows\System\WeHnGZg.exe
  2⤵
  PID:14048
- C:\Windows\System\PnSLihx.exe
  C:\Windows\System\PnSLihx.exe
  2⤵
  PID:14076
- C:\Windows\System\nHcvlHL.exe
  C:\Windows\System\nHcvlHL.exe
  2⤵
  PID:14096
- C:\Windows\System\cagKwEz.exe
  C:\Windows\System\cagKwEz.exe
  2⤵
  PID:14120
- C:\Windows\System\CGQJwYl.exe
  C:\Windows\System\CGQJwYl.exe
  2⤵
  PID:14148
- C:\Windows\System\gNVRqsP.exe
  C:\Windows\System\gNVRqsP.exe
  2⤵
  PID:14172
- C:\Windows\System\GxQmrCJ.exe
  C:\Windows\System\GxQmrCJ.exe
  2⤵
  PID:14196
- C:\Windows\System\IeeFFDg.exe
  C:\Windows\System\IeeFFDg.exe
  2⤵
  PID:14232
- C:\Windows\System\YhfzQCk.exe
  C:\Windows\System\YhfzQCk.exe
  2⤵
  PID:14256
- C:\Windows\System\DDVTolf.exe
  C:\Windows\System\DDVTolf.exe
  2⤵
  PID:14280
- C:\Windows\System\KIgEfKh.exe
  C:\Windows\System\KIgEfKh.exe
  2⤵
  PID:14316
- C:\Windows\System\PbadUJK.exe
  C:\Windows\System\PbadUJK.exe
  2⤵
  PID:14332
- C:\Windows\System\wqDSlTc.exe
  C:\Windows\System\wqDSlTc.exe
  2⤵
  PID:13272
- C:\Windows\System\IdfFQTz.exe
  C:\Windows\System\IdfFQTz.exe
  2⤵
  PID:10860
- C:\Windows\System\CBmIWwJ.exe
  C:\Windows\System\CBmIWwJ.exe
  2⤵
  PID:11556
- C:\Windows\System\DXEOgkQ.exe
  C:\Windows\System\DXEOgkQ.exe
  2⤵
  PID:12728
- C:\Windows\System\DwUeZiq.exe
  C:\Windows\System\DwUeZiq.exe
  2⤵
  PID:12800
- C:\Windows\System\ZcFjizv.exe
  C:\Windows\System\ZcFjizv.exe
  2⤵
  PID:10800
- C:\Windows\System\hNhGmjk.exe
  C:\Windows\System\hNhGmjk.exe
  2⤵
  PID:12932
- C:\Windows\System\dIqdwAn.exe
  C:\Windows\System\dIqdwAn.exe
  2⤵
  PID:11036
- C:\Windows\System\trrpNqb.exe
  C:\Windows\System\trrpNqb.exe
  2⤵
  PID:13036
- C:\Windows\System\KOEOypv.exe
  C:\Windows\System\KOEOypv.exe
  2⤵
  PID:13112
- C:\Windows\System\wgYSziJ.exe
  C:\Windows\System\wgYSziJ.exe
  2⤵
  PID:13324
- C:\Windows\System\rGsSQRJ.exe
  C:\Windows\System\rGsSQRJ.exe
  2⤵
  PID:13512
- C:\Windows\System\eHdIiPW.exe
  C:\Windows\System\eHdIiPW.exe
  2⤵
  PID:12780
- C:\Windows\System\sbXbDuj.exe
  C:\Windows\System\sbXbDuj.exe
  2⤵
  PID:13712
- C:\Windows\System\gPDjCdn.exe
  C:\Windows\System\gPDjCdn.exe
  2⤵
  PID:12868
- C:\Windows\System\iIVaCUQ.exe
  C:\Windows\System\iIVaCUQ.exe
  2⤵
  PID:12424
- C:\Windows\System\osIJOKn.exe
  C:\Windows\System\osIJOKn.exe
  2⤵
  PID:13892
- C:\Windows\System\akSljWO.exe
  C:\Windows\System\akSljWO.exe
  2⤵
  PID:12556
- C:\Windows\System\HFukeox.exe
  C:\Windows\System\HFukeox.exe
  2⤵
  PID:8836
- C:\Windows\System\zjrtZAR.exe
  C:\Windows\System\zjrtZAR.exe
  2⤵
  PID:14880
- C:\Windows\System\EhTpHGx.exe
  C:\Windows\System\EhTpHGx.exe
  2⤵
  PID:14952
- C:\Windows\System\VmlISBy.exe
  C:\Windows\System\VmlISBy.exe
  2⤵
  PID:14996
- C:\Windows\System\ZMtnmpl.exe
  C:\Windows\System\ZMtnmpl.exe
  2⤵
  PID:15032
- C:\Windows\System\CeliqPt.exe
  C:\Windows\System\CeliqPt.exe
  2⤵
  PID:15068
- C:\Windows\System\OpEXrvk.exe
  C:\Windows\System\OpEXrvk.exe
  2⤵
  PID:15096
- C:\Windows\System\MOmfYMF.exe
  C:\Windows\System\MOmfYMF.exe
  2⤵
  PID:15124
- C:\Windows\System\RGbBfQK.exe
  C:\Windows\System\RGbBfQK.exe
  2⤵
  PID:15160
- C:\Windows\System\ZXLYpeZ.exe
  C:\Windows\System\ZXLYpeZ.exe
  2⤵
  PID:15208
- C:\Windows\System\IGVDPYr.exe
  C:\Windows\System\IGVDPYr.exe
  2⤵
  PID:15228
- C:\Windows\System\yzCfeIc.exe
  C:\Windows\System\yzCfeIc.exe
  2⤵
  PID:15256
- C:\Windows\System\LxlemvO.exe
  C:\Windows\System\LxlemvO.exe
  2⤵
  PID:15288
- C:\Windows\System\zPISDNF.exe
  C:\Windows\System\zPISDNF.exe
  2⤵
  PID:15324
- C:\Windows\System\FbylfCx.exe
  C:\Windows\System\FbylfCx.exe
  2⤵
  PID:15352
- C:\Windows\System\bLSVQNj.exe
  C:\Windows\System\bLSVQNj.exe
  2⤵
  PID:13960
- C:\Windows\System\NDdsVpK.exe
  C:\Windows\System\NDdsVpK.exe
  2⤵
  PID:14028
- C:\Windows\System\OEYKXuy.exe
  C:\Windows\System\OEYKXuy.exe
  2⤵
  PID:12504
- C:\Windows\System\BHRplQl.exe
  C:\Windows\System\BHRplQl.exe
  2⤵
  PID:13116
- C:\Windows\System\VbUKypl.exe
  C:\Windows\System\VbUKypl.exe
  2⤵
  PID:13060
- C:\Windows\System\teIYhzZ.exe
  C:\Windows\System\teIYhzZ.exe
  2⤵
  PID:13556
- C:\Windows\System\ZPOATIs.exe
  C:\Windows\System\ZPOATIs.exe
  2⤵
  PID:14328
- C:\Windows\System\LAXgtNY.exe
  C:\Windows\System\LAXgtNY.exe
  2⤵
  PID:11400
- C:\Windows\System\EknyVYl.exe
  C:\Windows\System\EknyVYl.exe
  2⤵
  PID:13848
- C:\Windows\System\VuHTozu.exe
  C:\Windows\System\VuHTozu.exe
  2⤵
  PID:12740
- C:\Windows\System\HLXbyqd.exe
  C:\Windows\System\HLXbyqd.exe
  2⤵
  PID:12124
- C:\Windows\System\KZNztWU.exe
  C:\Windows\System\KZNztWU.exe
  2⤵
  PID:14476
- C:\Windows\System\KpIzfeq.exe
  C:\Windows\System\KpIzfeq.exe
  2⤵
  PID:14116
- C:\Windows\System\ENOVPFc.exe
  C:\Windows\System\ENOVPFc.exe
  2⤵
  PID:14184
- C:\Windows\System\TcxnKyj.exe
  C:\Windows\System\TcxnKyj.exe
  2⤵
  PID:14300
- C:\Windows\System\WgjSfis.exe
  C:\Windows\System\WgjSfis.exe
  2⤵
  PID:11152
- C:\Windows\System\gWqImjs.exe
  C:\Windows\System\gWqImjs.exe
  2⤵
  PID:13132
- C:\Windows\System\sJfKzsh.exe
  C:\Windows\System\sJfKzsh.exe
  2⤵
  PID:13752
- C:\Windows\System\ePqXYDc.exe
  C:\Windows\System\ePqXYDc.exe
  2⤵
  PID:11328
- C:\Windows\System\SBWlcrH.exe
  C:\Windows\System\SBWlcrH.exe
  2⤵
  PID:12420
- C:\Windows\System\spdOsaM.exe
  C:\Windows\System\spdOsaM.exe
  2⤵
  PID:13424
- C:\Windows\System\zDpTqtd.exe
  C:\Windows\System\zDpTqtd.exe
  2⤵
  PID:12676
- C:\Windows\System\gvnPVPK.exe
  C:\Windows\System\gvnPVPK.exe
  2⤵
  PID:12356
- C:\Windows\System\HWiTdbc.exe
  C:\Windows\System\HWiTdbc.exe
  2⤵
  PID:14372
- C:\Windows\System\EmYtAHv.exe
  C:\Windows\System\EmYtAHv.exe
  2⤵
  PID:15024
- C:\Windows\System\XYjiVbO.exe
  C:\Windows\System\XYjiVbO.exe
  2⤵
  PID:15132
- C:\Windows\System\vKotpTX.exe
  C:\Windows\System\vKotpTX.exe
  2⤵
  PID:15204
- C:\Windows\System\inHmLAK.exe
  C:\Windows\System\inHmLAK.exe
  2⤵
  PID:15224
- C:\Windows\System\vRNlsmH.exe
  C:\Windows\System\vRNlsmH.exe
  2⤵
  PID:14980
- C:\Windows\System\cuFGfdM.exe
  C:\Windows\System\cuFGfdM.exe
  2⤵
  PID:14760
- C:\Windows\System\onGLiFb.exe
  C:\Windows\System\onGLiFb.exe
  2⤵
  PID:15332
- C:\Windows\System\TLNhkFE.exe
  C:\Windows\System\TLNhkFE.exe
  2⤵
  PID:15080
- C:\Windows\System\KAjWvHV.exe
  C:\Windows\System\KAjWvHV.exe
  2⤵
  PID:15168
- C:\Windows\System\tzemYzn.exe
  C:\Windows\System\tzemYzn.exe
  2⤵
  PID:13420
- C:\Windows\System\MFhESIs.exe
  C:\Windows\System\MFhESIs.exe
  2⤵
  PID:13624
- C:\Windows\System\OEYznlt.exe
  C:\Windows\System\OEYznlt.exe
  2⤵
  PID:12240
- C:\Windows\System\rJPpLZP.exe
  C:\Windows\System\rJPpLZP.exe
  2⤵
  PID:13328
- C:\Windows\System\cScnuWD.exe
  C:\Windows\System\cScnuWD.exe
  2⤵
  PID:14296
- C:\Windows\System\SaVnlYj.exe
  C:\Windows\System\SaVnlYj.exe
  2⤵
  PID:11444
- C:\Windows\System\wKNsCMN.exe
  C:\Windows\System\wKNsCMN.exe
  2⤵
  PID:14180
- C:\Windows\System\vmVLnUs.exe
  C:\Windows\System\vmVLnUs.exe
  2⤵
  PID:11324
- C:\Windows\System\rgAwNBB.exe
  C:\Windows\System\rgAwNBB.exe
  2⤵
  PID:13596
- C:\Windows\System\tfEIaeB.exe
  C:\Windows\System\tfEIaeB.exe
  2⤵
  PID:14384
- C:\Windows\System\PHiibEU.exe
  C:\Windows\System\PHiibEU.exe
  2⤵
  PID:14404
- C:\Windows\System\KXeBvOp.exe
  C:\Windows\System\KXeBvOp.exe
  2⤵
  PID:14496
- C:\Windows\System\yVRjXQH.exe
  C:\Windows\System\yVRjXQH.exe
  2⤵
  PID:11084
- C:\Windows\System\ErzQbLK.exe
  C:\Windows\System\ErzQbLK.exe
  2⤵
  PID:14432
- C:\Windows\System\TRgJKMq.exe
  C:\Windows\System\TRgJKMq.exe
  2⤵
  PID:15152
- C:\Windows\System\pqyYKHa.exe
  C:\Windows\System\pqyYKHa.exe
  2⤵
  PID:15384
- C:\Windows\System\OMyskQl.exe
  C:\Windows\System\OMyskQl.exe
  2⤵
  PID:15416
- C:\Windows\System\nNNEQIt.exe
  C:\Windows\System\nNNEQIt.exe
  2⤵
  PID:15436
- C:\Windows\System\attiYxw.exe
  C:\Windows\System\attiYxw.exe
  2⤵
  PID:15468
- C:\Windows\System\KWofIgu.exe
  C:\Windows\System\KWofIgu.exe
  2⤵
  PID:15500
- C:\Windows\System\aLMtmPb.exe
  C:\Windows\System\aLMtmPb.exe
  2⤵
  PID:15536
- C:\Windows\System\fKdvpZu.exe
  C:\Windows\System\fKdvpZu.exe
  2⤵
  PID:15560
- C:\Windows\System\UJkTGyG.exe
  C:\Windows\System\UJkTGyG.exe
  2⤵
  PID:15576
- C:\Windows\System\LjgDaFZ.exe
  C:\Windows\System\LjgDaFZ.exe
  2⤵
  PID:15608
- C:\Windows\System\NtRLcuj.exe
  C:\Windows\System\NtRLcuj.exe
  2⤵
  PID:15628
- C:\Windows\System\WLrtFWX.exe
  C:\Windows\System\WLrtFWX.exe
  2⤵
  PID:15656
- C:\Windows\System\myKkgmH.exe
  C:\Windows\System\myKkgmH.exe
  2⤵
  PID:15684
- C:\Windows\System\QcDHNuD.exe
  C:\Windows\System\QcDHNuD.exe
  2⤵
  PID:15724
- C:\Windows\System\RlzpWYH.exe
  C:\Windows\System\RlzpWYH.exe
  2⤵
  PID:15760
- C:\Windows\System\fjLelhq.exe
  C:\Windows\System\fjLelhq.exe
  2⤵
  PID:15788
- C:\Windows\System\UtoMyuC.exe
  C:\Windows\System\UtoMyuC.exe
  2⤵
  PID:15816
- C:\Windows\System\iczMklr.exe
  C:\Windows\System\iczMklr.exe
  2⤵
  PID:15852
- C:\Windows\System\kwbvpkz.exe
  C:\Windows\System\kwbvpkz.exe
  2⤵
  PID:15868
- C:\Windows\System\TXJEKMe.exe
  C:\Windows\System\TXJEKMe.exe
  2⤵
  PID:15884
- C:\Windows\System\Rowkbdw.exe
  C:\Windows\System\Rowkbdw.exe
  2⤵
  PID:15908
- C:\Windows\System\PdHQQNn.exe
  C:\Windows\System\PdHQQNn.exe
  2⤵
  PID:15928
- C:\Windows\System\mCFXAuz.exe
  C:\Windows\System\mCFXAuz.exe
  2⤵
  PID:15956
- C:\Windows\System\LzSbxPD.exe
  C:\Windows\System\LzSbxPD.exe
  2⤵
  PID:15992
- C:\Windows\System\zXcYVkp.exe
  C:\Windows\System\zXcYVkp.exe
  2⤵
  PID:16020
- C:\Windows\System\LYXqBJK.exe
  C:\Windows\System\LYXqBJK.exe
  2⤵
  PID:16044
- C:\Windows\System\zXiHiEi.exe
  C:\Windows\System\zXiHiEi.exe
  2⤵
  PID:16068
- C:\Windows\System\LbJmwDA.exe
  C:\Windows\System\LbJmwDA.exe
  2⤵
  PID:16092
- C:\Windows\System\vMLKbKk.exe
  C:\Windows\System\vMLKbKk.exe
  2⤵
  PID:16124
- C:\Windows\System\xEKPOyM.exe
  C:\Windows\System\xEKPOyM.exe
  2⤵
  PID:16144
- C:\Windows\System\hsksUCE.exe
  C:\Windows\System\hsksUCE.exe
  2⤵
  PID:16160
- C:\Windows\System\MEyJezl.exe
  C:\Windows\System\MEyJezl.exe
  2⤵
  PID:16180
- C:\Windows\System\jqHWweJ.exe
  C:\Windows\System\jqHWweJ.exe
  2⤵
  PID:16212
- C:\Windows\System\lrKPyMW.exe
  C:\Windows\System\lrKPyMW.exe
  2⤵
  PID:16236
- C:\Windows\System\lGYWnAT.exe
  C:\Windows\System\lGYWnAT.exe
  2⤵
  PID:16264
- C:\Windows\System\OWEJoFY.exe
  C:\Windows\System\OWEJoFY.exe
  2⤵
  PID:16296
- C:\Windows\System\vVbxZPT.exe
  C:\Windows\System\vVbxZPT.exe
  2⤵
  PID:16320
- C:\Windows\System\ITdtDfw.exe
  C:\Windows\System\ITdtDfw.exe
  2⤵
  PID:16336
- C:\Windows\System\qBWGRLu.exe
  C:\Windows\System\qBWGRLu.exe
  2⤵
  PID:16356
- C:\Windows\System\JqMOFth.exe
  C:\Windows\System\JqMOFth.exe
  2⤵
  PID:16376
- C:\Windows\System\WGtWLbF.exe
  C:\Windows\System\WGtWLbF.exe
  2⤵
  PID:14164
- C:\Windows\System\mGhUpav.exe
  C:\Windows\System\mGhUpav.exe
  2⤵
  PID:13976
- C:\Windows\System\tQRLqjf.exe
  C:\Windows\System\tQRLqjf.exe
  2⤵
  PID:13028
- C:\Windows\System\lZWgnbF.exe
  C:\Windows\System\lZWgnbF.exe
  2⤵
  PID:13136
- C:\Windows\System\xRBvNRc.exe
  C:\Windows\System\xRBvNRc.exe
  2⤵
  PID:12852
- C:\Windows\System\SkNLRYt.exe
  C:\Windows\System\SkNLRYt.exe
  2⤵
  PID:15460
- C:\Windows\System\qcaVURP.exe
  C:\Windows\System\qcaVURP.exe
  2⤵
  PID:11576
- C:\Windows\System\HDgnHvo.exe
  C:\Windows\System\HDgnHvo.exe
  2⤵
  PID:13508
- C:\Windows\System\aWEgQnb.exe
  C:\Windows\System\aWEgQnb.exe
  2⤵
  PID:15112
- C:\Windows\System\GThVduj.exe
  C:\Windows\System\GThVduj.exe
  2⤵
  PID:15756
- C:\Windows\System\NvMSmta.exe
  C:\Windows\System\NvMSmta.exe
  2⤵
  PID:15824
- C:\Windows\System\JqXeRlG.exe
  C:\Windows\System\JqXeRlG.exe
  2⤵
  PID:15896
- C:\Windows\System\dpZRBng.exe
  C:\Windows\System\dpZRBng.exe
  2⤵
  PID:15948
- C:\Windows\System\wUOTpgp.exe
  C:\Windows\System\wUOTpgp.exe
  2⤵
  PID:15676
- C:\Windows\System\ylvUrqo.exe
  C:\Windows\System\ylvUrqo.exe
  2⤵
  PID:15412
- C:\Windows\System\RUdnFKI.exe
  C:\Windows\System\RUdnFKI.exe
  2⤵
  PID:16088
- C:\Windows\System\BcgSlnQ.exe
  C:\Windows\System\BcgSlnQ.exe
  2⤵
  PID:15836
- C:\Windows\System\MSFqDXt.exe
  C:\Windows\System\MSFqDXt.exe
  2⤵
  PID:15860
- C:\Windows\System\wtjMPXN.exe
  C:\Windows\System\wtjMPXN.exe
  2⤵
  PID:16272
- C:\Windows\System\jDINaMD.exe
  C:\Windows\System\jDINaMD.exe
  2⤵
  PID:15736
- C:\Windows\System\VvGXrAW.exe
  C:\Windows\System\VvGXrAW.exe
  2⤵
  PID:15772
- C:\Windows\System\PtmThLq.exe
  C:\Windows\System\PtmThLq.exe
  2⤵
  PID:13772
- C:\Windows\System\uOjCyjU.exe
  C:\Windows\System\uOjCyjU.exe
  2⤵
  PID:14924
- C:\Windows\System\ryMgvxM.exe
  C:\Windows\System\ryMgvxM.exe
  2⤵
  PID:16396
- C:\Windows\System\ccfREGA.exe
  C:\Windows\System\ccfREGA.exe
  2⤵
  PID:16412
- C:\Windows\System\eenRYXy.exe
  C:\Windows\System\eenRYXy.exe
  2⤵
  PID:16432
- C:\Windows\System\PIYVtfq.exe
  C:\Windows\System\PIYVtfq.exe
  2⤵
  PID:16464
- C:\Windows\System\iNYHEVC.exe
  C:\Windows\System\iNYHEVC.exe
  2⤵
  PID:16488
- C:\Windows\System\NdhJxyY.exe
  C:\Windows\System\NdhJxyY.exe
  2⤵
  PID:16512
- C:\Windows\System\akcZInI.exe
  C:\Windows\System\akcZInI.exe
  2⤵
  PID:16536
- C:\Windows\System\mhcubCT.exe
  C:\Windows\System\mhcubCT.exe
  2⤵
  PID:16552
- C:\Windows\System\JGbbCSv.exe
  C:\Windows\System\JGbbCSv.exe
  2⤵
  PID:16576
- C:\Windows\System\BAJrPyi.exe
  C:\Windows\System\BAJrPyi.exe
  2⤵
  PID:16596
- C:\Windows\System\rkwQqZZ.exe
  C:\Windows\System\rkwQqZZ.exe
  2⤵
  PID:16612
- C:\Windows\System\BFSbdfo.exe
  C:\Windows\System\BFSbdfo.exe
  2⤵
  PID:16636
- C:\Windows\System\lWPyZLI.exe
  C:\Windows\System\lWPyZLI.exe
  2⤵
  PID:16664
- C:\Windows\System\WeBVTSc.exe
  C:\Windows\System\WeBVTSc.exe
  2⤵
  PID:16692
- C:\Windows\System\RvNvQAF.exe
  C:\Windows\System\RvNvQAF.exe
  2⤵
  PID:16708
- C:\Windows\System\zHYTMOG.exe
  C:\Windows\System\zHYTMOG.exe
  2⤵
  PID:16736
- C:\Windows\System\lsgxqZT.exe
  C:\Windows\System\lsgxqZT.exe
  2⤵
  PID:16760
- C:\Windows\System\OKPzDbS.exe
  C:\Windows\System\OKPzDbS.exe
  2⤵
  PID:16784
- C:\Windows\System\mFigAjc.exe
  C:\Windows\System\mFigAjc.exe
  2⤵
  PID:16800
- C:\Windows\System\ACmAAho.exe
  C:\Windows\System\ACmAAho.exe
  2⤵
  PID:16820
- C:\Windows\System\mNyZlPS.exe
  C:\Windows\System\mNyZlPS.exe
  2⤵
  PID:16836
- C:\Windows\System\jpoxoQP.exe
  C:\Windows\System\jpoxoQP.exe
  2⤵
  PID:16864
- C:\Windows\System\bRlaifq.exe
  C:\Windows\System\bRlaifq.exe
  2⤵
  PID:16888
- C:\Windows\System\GMuKDuQ.exe
  C:\Windows\System\GMuKDuQ.exe
  2⤵
  PID:16912
- C:\Windows\System\SEnALVq.exe
  C:\Windows\System\SEnALVq.exe
  2⤵
  PID:16932
- C:\Windows\System\GklMmTo.exe
  C:\Windows\System\GklMmTo.exe
  2⤵
  PID:16952
- C:\Windows\System\HwmjgVn.exe
  C:\Windows\System\HwmjgVn.exe
  2⤵
  PID:16976
- C:\Windows\System\acPObCW.exe
  C:\Windows\System\acPObCW.exe
  2⤵
  PID:17000
- C:\Windows\System\KmrNOxR.exe
  C:\Windows\System\KmrNOxR.exe
  2⤵
  PID:17020
- C:\Windows\System\uiHDdFk.exe
  C:\Windows\System\uiHDdFk.exe
  2⤵
  PID:17040
- C:\Windows\System\gSgLeHg.exe
  C:\Windows\System\gSgLeHg.exe
  2⤵
  PID:17060
- C:\Windows\System\lazsDYb.exe
  C:\Windows\System\lazsDYb.exe
  2⤵
  PID:17080
- C:\Windows\System\SoqbZGz.exe
  C:\Windows\System\SoqbZGz.exe
  2⤵
  PID:17096
- C:\Windows\System\sKepODg.exe
  C:\Windows\System\sKepODg.exe
  2⤵
  PID:17116
- C:\Windows\System\yRxZyzp.exe
  C:\Windows\System\yRxZyzp.exe
  2⤵
  PID:17140
- C:\Windows\System\CIuMady.exe
  C:\Windows\System\CIuMady.exe
  2⤵
  PID:17164
- C:\Windows\System\cLncVAz.exe
  C:\Windows\System\cLncVAz.exe
  2⤵
  PID:17192
- C:\Windows\System\ZWKuVaD.exe
  C:\Windows\System\ZWKuVaD.exe
  2⤵
  PID:17224
- C:\Windows\System\PvhMfQL.exe
  C:\Windows\System\PvhMfQL.exe
  2⤵
  PID:17240
- C:\Windows\System\niwNtXF.exe
  C:\Windows\System\niwNtXF.exe
  2⤵
  PID:17264
- C:\Windows\System\jYbeoNI.exe
  C:\Windows\System\jYbeoNI.exe
  2⤵
  PID:17296
- C:\Windows\System\lnovWzl.exe
  C:\Windows\System\lnovWzl.exe
  2⤵
  PID:17320
- C:\Windows\System\sckTJbX.exe
  C:\Windows\System\sckTJbX.exe
  2⤵
  PID:17340
- C:\Windows\System\ZgxKuOo.exe
  C:\Windows\System\ZgxKuOo.exe
  2⤵
  PID:17360
- C:\Windows\System\iXsHiRc.exe
  C:\Windows\System\iXsHiRc.exe
  2⤵
  PID:17376
- C:\Windows\System\BItyily.exe
  C:\Windows\System\BItyily.exe
  2⤵
  PID:17404
- C:\Windows\System\QDpBDqu.exe
  C:\Windows\System\QDpBDqu.exe
  2⤵
  PID:15880
- C:\Windows\System\bPEnONX.exe
  C:\Windows\System\bPEnONX.exe
  2⤵
  PID:15940
- C:\Windows\System\IZgYcAd.exe
  C:\Windows\System\IZgYcAd.exe
  2⤵
  PID:15696
- C:\Windows\System\XgayONL.exe
  C:\Windows\System\XgayONL.exe
  2⤵
  PID:14652
- C:\Windows\System\mvFKCsZ.exe
  C:\Windows\System\mvFKCsZ.exe
  2⤵
  PID:956

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:16836

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:17264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:16596

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:17060

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

154.239.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

154.239.44.20.in-addr.arpa

IN PTR

Response
DNS

77.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.190.18.2.in-addr.arpa

IN PTR

Response

77.190.18.2.in-addr.arpa

IN PTR

a2-18-190-77deploystaticakamaitechnologiescom
DNS

2.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.159.190.20.in-addr.arpa

IN PTR

Response
DNS

g.bing.com

Remote address:

8.8.8.8:53

Request

g.bing.com

IN A

Response

g.bing.com

IN CNAME

g-bing-com.dual-a-0034.a-msedge.net

g-bing-com.dual-a-0034.a-msedge.net

IN CNAME

dual-a-0034.a-msedge.net

dual-a-0034.a-msedge.net

IN A

204.79.197.237

dual-a-0034.a-msedge.net

IN A

13.107.21.237
GET

https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55 HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=25F656CF782F690F306842B17994686E; domain=.bing.com; expires=Sat, 07-Jun-2025 09:58:41 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8F874F83FB8F4745B722C44489872013 Ref B: LON04EDGE0818 Ref C: 2024-05-13T09:58:41Z
date: Mon, 13 May 2024 09:58:41 GMT
GET

https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55

Remote address:

204.79.197.237:443

Request

GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55 HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=25F656CF782F690F306842B17994686E; _EDGE_S=SID=3BFDE527658A6A621BD3F159648C6B85

Response

HTTP/2.0 204

cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=s4xHxphTZKB74hIGHo-UlF_Iu3mb2hqifx20uPK0sLM; domain=.bing.com; expires=Sat, 07-Jun-2025 09:58:42 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6EAA53D537F24A9BAF4532AEE7827012 Ref B: LON04EDGE0818 Ref C: 2024-05-13T09:58:42Z
date: Mon, 13 May 2024 09:58:41 GMT
GET

https://www.bing.com/aes/c.gif?RG=8649d8f926484c288eea3898e241410f&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T130809Z&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189

Remote address:

88.221.83.232:443

Request

GET /aes/c.gif?RG=8649d8f926484c288eea3898e241410f&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T130809Z&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189 HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=25F656CF782F690F306842B17994686E

Response

HTTP/2.0 200

cache-control: private,no-store
pragma: no-cache
vary: Origin
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 965E175F9A5E48969E4CA2603E4E5B90 Ref B: LON212050719009 Ref C: 2024-05-13T09:58:41Z
content-length: 0
date: Mon, 13 May 2024 09:58:42 GMT
set-cookie: _EDGE_S=SID=3BFDE527658A6A621BD3F159648C6B85; path=/; httponly; domain=bing.com
set-cookie: MUIDB=25F656CF782F690F306842B17994686E; path=/; httponly; expires=Sat, 07-Jun-2025 09:58:42 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.e453dd58.1715594321.5d6992a
DNS

237.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

237.197.79.204.in-addr.arpa

IN PTR

Response
DNS

232.83.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.83.221.88.in-addr.arpa

IN PTR

Response

232.83.221.88.in-addr.arpa

IN PTR

a88-221-83-232deploystaticakamaitechnologiescom
GET

https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

BackgroundTransferHost.exe

Remote address:

88.221.83.232:443

Request

GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
cookie: MUID=25F656CF782F690F306842B17994686E; _EDGE_S=SID=3BFDE527658A6A621BD3F159648C6B85; MSPTC=s4xHxphTZKB74hIGHo-UlF_Iu3mb2hqifx20uPK0sLM; MUIDB=25F656CF782F690F306842B17994686E
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Mon, 13 May 2024 09:58:43 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.e453dd58.1715594323.5d6a1b3
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

15.164.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.164.165.52.in-addr.arpa

IN PTR

Response
DNS

142.53.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

142.53.16.96.in-addr.arpa

IN PTR

Response

142.53.16.96.in-addr.arpa

IN PTR

a96-16-53-142deploystaticakamaitechnologiescom
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 476246
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 589971449CA542FEBD7315EEFDD88A1B Ref B: LON04EDGE0706 Ref C: 2024-05-13T10:00:19Z
date: Mon, 13 May 2024 10:00:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 499516
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AA1CBF085EC7403AA4448A899B8F8B27 Ref B: LON04EDGE0706 Ref C: 2024-05-13T10:00:19Z
date: Mon, 13 May 2024 10:00:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 464243
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C2EBC18DDD7445969F2B31C5B8809AAF Ref B: LON04EDGE0706 Ref C: 2024-05-13T10:00:19Z
date: Mon, 13 May 2024 10:00:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 382817
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E75705933A3340138FACDC1A80B24D9C Ref B: LON04EDGE0706 Ref C: 2024-05-13T10:00:19Z
date: Mon, 13 May 2024 10:00:18 GMT
DNS

57.169.31.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.169.31.20.in-addr.arpa

IN PTR

Response
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet

204.79.197.237:443

https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55

tls, http2

2.5kB
9.0kB
20
17

HTTP Request

GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55

HTTP Response

204

HTTP Request

GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-tg29k904okAvrVgsroJ-DVUCUy2lW0KWA_gDc0d6ToHDp9qRpWtAOIC6fafEAm2TbAEovpLzniJRGS-_8cQH7s6BQTssXDgPdaMbkr68srl7gxq5FbsGDuIJC_jyvldaMM7q3dYnFW8Ftx_jvbveCK86_AxdGXx4ilTPpjNYyOlFF6V%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3De3b9885cbf5512d75f13ee77184c4051&TIME=20240426T130809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189&muid=DA7A91E17E56FC56DF5DE341A69C2E55

HTTP Response

204
88.221.83.232:443

https://www.bing.com/aes/c.gif?RG=8649d8f926484c288eea3898e241410f&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T130809Z&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189

tls, http2

1.4kB
5.3kB
16
10

HTTP Request

GET https://www.bing.com/aes/c.gif?RG=8649d8f926484c288eea3898e241410f&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T130809Z&adUnitId=11730597&localId=w:DA7A91E1-7E56-FC56-DF5D-E341A69C2E55&deviceId=6966564702298189

HTTP Response

200
88.221.83.232:443

https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

tls, http2

BackgroundTransferHost.exe

1.6kB
6.4kB
16
12

HTTP Request

GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

HTTP Response

200
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

64.3kB
1.9MB
1373
1370

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
13

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

154.239.44.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

154.239.44.20.in-addr.arpa
8.8.8.8:53

77.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

77.190.18.2.in-addr.arpa
8.8.8.8:53

2.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.159.190.20.in-addr.arpa
8.8.8.8:53

g.bing.com

dns

56 B
151 B
1
1

DNS Request

g.bing.com

DNS Response

204.79.197.237

13.107.21.237
8.8.8.8:53

237.197.79.204.in-addr.arpa

dns

73 B
143 B
1
1

DNS Request

237.197.79.204.in-addr.arpa
8.8.8.8:53

232.83.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

232.83.221.88.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

15.164.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

15.164.165.52.in-addr.arpa
8.8.8.8:53

142.53.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

142.53.16.96.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
173 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

57.169.31.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

57.169.31.20.in-addr.arpa
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

200.197.79.204.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AZXNVJG.exe

Filesize
1.1MB

MD5
eb4bed1fcbd71d1da2bfa6498a34c414

SHA1
40facf243b2554a3f187ea2c4f965732f55e0ec3

SHA256
964f4eb5a86919bcf5d9334d723a750a234bfc48ee960308fcd1c651da327377

SHA512
709ecb088624f60f35633ba64a3c280c72679cc6068160bffc888ce863531412deaa296afa8595eb3754767c806ac44319699e2fc2dd60867f860eb047082645

Download Submit
C:\Windows\System\AdwENZh.exe

Filesize
1.1MB

MD5
1dc9a395a7269cd3b3857a51a1f310f3

SHA1
feba2e10db2f8569859accc8a65edc22cbfa0d8f

SHA256
507a81459b8f9d6c70c6bd5a7429ef91ec2d4833021448ae0a62467f21c8242e

SHA512
76b2d8e8a8bf064d8b361b9e290ee8b38bcb5bfb1fa76322b5ab620ceac98e01db53a27db3b138646d5aeb79802d73a875527924afa0b3f7df99a9378b54986d

Download Submit
C:\Windows\System\AiDDvfx.exe

Filesize
1.1MB

MD5
dbebdc0630ca0231b1b884c0a4d843ae

SHA1
75ff70cb4593debed5e5cb1ce923980d16a5ac82

SHA256
07b8c9c27424e5169c6212b09a926978e8eb7bec427442be40f3ee62620ed4fe

SHA512
1edd118c30498e06458b2af2418b52d1e8660b3bd7976973448d302a1d4ed8632e9b5b7929a001c813e81ba3336922871caa4e858ad2c55a7d7cb285f31177a9

Download Submit
C:\Windows\System\AyzPjUS.exe

Filesize
1.1MB

MD5
9dac240eed0ca01fddde68d03d8e1230

SHA1
178ddbe51ea7da335bce6dd8eed00edf34535077

SHA256
0099382a0c45f61aba0eb9862d3c2ee982ea8dd664cf65ae173b835599a6b1b3

SHA512
f6facf563a2f3e484ac3517417fc4e84d9507d23b721d924050f1cf227c40b72d8269a21cf7c6aa98142271a5140c698ea8b65445255b6a016340c065cca7705

Download Submit
C:\Windows\System\DvhdCnS.exe

Filesize
1.1MB

MD5
6c7b0adc1bf65380fd1f2b6b40cca233

SHA1
99cb5eff1f813c768e70f11ebfa01d45c8d23371

SHA256
df4878b0191b58956b0bf8ce455d8ef48e63ca2720260c5e33d6a65244df65be

SHA512
37f46994bba59784692f23bc9dd84c1b04e0f7f5a088008f6297c6720f4d62a3d400885567640b7a2f7dcf6d32ac13bbff3698a0914ebcfd09ff48aab34487ca

Download Submit
C:\Windows\System\FdOEzoj.exe

Filesize
1.1MB

MD5
8b3d30af922d21de93b50089d4f1a84c

SHA1
cb50b90a41cc144e21ee320db213d84246a9f043

SHA256
c6e1b8710def15985d124106b8950323d15741e0178709d1fe1adeca14782b6e

SHA512
bdbd39b0631ec6c2559bc12c6065b3c0820f1064d4972f9e58e7a6ff13187d89b37c0a36a60ea94585286a121faf67a29e285088b115eebcb6745592586f795b

Download Submit
C:\Windows\System\FnPYwdB.exe

Filesize
1.1MB

MD5
0ce03d92971613cd77f77d8e6909bacd

SHA1
181e59e7011cb1755f85887ac1f7cadfa2498936

SHA256
8478321aec21ff6c02e9a8a94f2821078e5ba0094a9097db2dc083f6d0b1b1ac

SHA512
0de08f985468dc5c48d7b56d4d815ce8d00bd628bc18438df1fcb0d7268e36f9a56f90fa79727100ce33b5d0df74b1caceea3fc784bc03908c8283aee4960b7b

Download Submit
C:\Windows\System\HvYSfrj.exe

Filesize
1.1MB

MD5
89c5b3d772bdf554adbe5ec2c7a4a798

SHA1
8ca522aecc3ab49b746677d28c8041414d123514

SHA256
3f541df9e46ffa16a01fde4b8f70ca6e1a16918126db50c7e381f8a141fb123e

SHA512
9aaa1f222bef8fcd0823f37d96b30a6c0d75c7ee0d9d413da0baca2564b6225dd9abad785aab7e095e84e4ed764b6fb9ed5476e543ab5a9059f2072c96d19848

Download Submit
C:\Windows\System\KLAMcyj.exe

Filesize
1.1MB

MD5
cd2744adf3b54c4e0686976d95aea107

SHA1
660bdf025dc7b8bf7c0e5f08cf9eb726e9db5b7e

SHA256
09bb94b95f47cf91f19d45c353f7d3b77b3f838a522c602540a77a2dea55db9a

SHA512
3a94b59cc6c6aa5f0f7676b788b712e684cad472a584c76f13c965b47a34b886c444c7009ec7dfee5345706d22c20608adaf4ece4b6493e912e8eedbdd798c00

Download Submit
C:\Windows\System\KUUaVVg.exe

Filesize
1.1MB

MD5
dbb19b9dc9d9fb78a7d1edf7d184333f

SHA1
cb06d780f820dbe6508d2a3c0341c6aee865889a

SHA256
061d14f24bd517a4117f62ec24d17077ba411018b1c0f52db346f1324e07699e

SHA512
616a4f1d6dae8822e18246712ad564f9f7c48a92af3df1ba91584b8fc8cdbff2f323ff5a5ee8fcceb8bee1d12c699872fc6aa2bc7e020129fc57e4c5fa00ff56

Download Submit
C:\Windows\System\LhmZOez.exe

Filesize
1.1MB

MD5
74ff0562d504c01c8fc2590ce934c461

SHA1
6dc06310fcff58b5814337a7f28a697aa12781df

SHA256
372f38d60842c4c39e79ff86f872ccf01b963b5e056a607ef57ed61bd4f1d9d2

SHA512
26427ff05eb88c8ab66cc67b40117500291e2699845ec73ed0fcd49d3771d66d6862d4c07d994f459dcc542a5d18355058d02bb8c07bc32bcf9ec2671891e5e9

Download Submit
C:\Windows\System\MyBEZpa.exe

Filesize
1.1MB

MD5
d0487492980d8107eac062367d80f5ba

SHA1
b1a7c88f7bd9ab3f48eef1a860c80c0866aa3af6

SHA256
ef44287e37793a7a25c1e56067ac460071475a52755a9352484ad539e5cd6c0a

SHA512
c1fd9bbc205fdd321d5d83c582919940a5c1eb21d380cd272a41bc987812baa737f761d6863487e4b3a7686c44f569a71fdb6c616fc493aa4b9a489d6694f854

Download Submit
C:\Windows\System\NOMdrlg.exe

Filesize
1.1MB

MD5
bd276a32799b8620c01ebcb4cdda03dc

SHA1
a34e8e476f5d1ddaaf85e9b49d0cc03d47c13432

SHA256
849c5bca5d6acb97a3c64f3f023b12961e119f2ca33c32851c6d7040526e1a7d

SHA512
d9e1d2856b3e78a2023ed4636ee4174307a5a677f4f2f68296f1ca40a6b07a32143abeb654d72254dc30a0c51c72e3e5d21d656ae95bbde4f91c406f0885c56b

Download Submit
C:\Windows\System\Ocxrhrp.exe

Filesize
1.1MB

MD5
d048f2f258f760c236456bca24d1719a

SHA1
5a3c97799a42d06d5226d4109c6f13aaa7b5283b

SHA256
07776e1c3ccc414703307615f3f87640625820579f1a4897ca6f588f0f2711f5

SHA512
ca339c571fe292a540e1e18c4f6c716ba6629a5760eef7d7881bc0561cc80f4a3d84679e77cc74c2750e9563208a6d0367e211e3bce454690d425fdd00fca088

Download Submit
C:\Windows\System\PMNWlYK.exe

Filesize
1.1MB

MD5
b3e6e3fdee794124271fdc5fb113a53f

SHA1
d68f6832156f988c12c8eee8d63a38df48b85041

SHA256
6626a4b6aff88c1c48585973fa222535238afab8ebaa88f845bd01c18eea8902

SHA512
8d435a89e2dfe1aae8f13a20f4091c73e953391ffdf68e2e2be7093ca4d55f93e7a34dbbe1a2599c34bbe6fbf3d5f17bd7ae7bb009a5dc1e8a01765efb987393

Download Submit
C:\Windows\System\SPzaYge.exe

Filesize
1.1MB

MD5
2eeeaac6b08896561d528e248280ea90

SHA1
dd249935e04d96ffa6ceb8511fa18d970b9acfed

SHA256
26928cbf564e5cc3ad056e2b23491857025e812de04bc44c86435614e54975dc

SHA512
2cf912f427289be682b4158d1dbaea5e5c0e60cf4d616ed7c62393b561b61f349208f9c8bed8ff7742a90e9268c378d38a033ce9cdb0e8f75371073d92c4b6ef

Download Submit
C:\Windows\System\TivwhCW.exe

Filesize
1.1MB

MD5
b1afcaf74d50aa338f9cd2eb880fc527

SHA1
c4c02831ce4021e804954c46b7cd14d11b44d075

SHA256
f458da356f317a5b8664ab869f5e680845679aa746da8fd7c296a8af6a4954c3

SHA512
55b7856141a20c5a6541fb01ea76f0f2defba7ae129b214139adcef9028b99deab2225cbc596ed306a6f7e8504155d50c7c51df922acdf5f486c37f5b5d03d8f

Download Submit
C:\Windows\System\UCvVfCE.exe

Filesize
1.1MB

MD5
4c8bba8dfa355b1395a27b854a677418

SHA1
c86ee96a57619caa382d95edb04958ebb4b9e7d8

SHA256
a834676bed45948cd7cd6f674eba483c1afc625afd28804beffba443422825f8

SHA512
14451dd7f83f994766558668f43ec8fb58442c6c09df1c0ca0c52ae2a43eda3a37ab61aadb8c3f834dc50076a78d2b57279c7354731b3716b5ebb48aca770f76

Download Submit
C:\Windows\System\XDDOyXX.exe

Filesize
1.1MB

MD5
e5ca6f3540ba9ec74ddf2cbc06f8fc30

SHA1
89757799a3cce7f88843aac6ddeb95588b3c5bfe

SHA256
d830c173723028bbe5e53dcc4479721f9666a841ab43eb1e4b40777026496b67

SHA512
e704fe4f761ce12571d723bd540dc613d0db004bde03dafc330921536bcc49aa9a16ba0256627e9af7f989c7bb9243b390809ed7517aebe181997a3af068f69a

Download Submit
C:\Windows\System\XWbWOtl.exe

Filesize
1.1MB

MD5
7ec74e2ca05f946a178dd08325dafad8

SHA1
be511e9b718fb9acaf3dc33f040d0a636fee31f0

SHA256
5626beba8788ff2268852058c35c65dda97d79464b3578901586cce58e24ba47

SHA512
c55524b40b3ab467f92c7ae42c5058e1b0417ee7c15acae98bddd6d25aa500204a3e0b3b330b700dd6efc4d85d50c538816a4c49b3a1ac6870d5a830b52ba905

Download Submit
C:\Windows\System\XXEzNPs.exe

Filesize
1.1MB

MD5
5305089c68c95cd1d398a511d80570ec

SHA1
4f84dd367d1228de80220ffff6b54e2a0c3e63b6

SHA256
fefdb70d5e2877a3c4949f5a367f851317eb12d4a464c1cfa679017daa8a643c

SHA512
2f1d8d8105f7b3f4b7d3b174b884586fea81a64796588d305657ec02c445ec88405f3a3bcf2a779a43dd5bcc0ac09c174e0351e7880e129687f11fb69aa0a33d

Download Submit
C:\Windows\System\ZeSFZiK.exe

Filesize
1.1MB

MD5
598b93dd065a86f984a040b053d348c1

SHA1
77d07cc04f91f36109cb197d2481827ba4d3a563

SHA256
49bf1904216296ccc2a877b06532558757028f689f79fa766d7ea07eecebc1c1

SHA512
0b74d524f23541b7792f58df9284bb899553843ba6c13b75a9028a9c15be6f795ed90acf8fc11ef9813d6eefab20e83959824991c5b179d5a90dd4c4ae18e073

Download Submit
C:\Windows\System\dwyizCW.exe

Filesize
1.1MB

MD5
c83ee33a3a404f571da505aa135a5711

SHA1
f0180f88de2f4e27b39c4de64424464b105ab9b7

SHA256
6cf81d95fb9293842d8bd8e7a9380d96c3559d53be8f34eb4f6ba5db82ca33f7

SHA512
550a7b68ca9e01848c65d05c3e5032d3037a9b0778387be7f3355678446fb1fbefb0195c6d498ebff229b06a6f68d08612550250c53566f3298049f116643e93

Download Submit
C:\Windows\System\eBHbqRa.exe

Filesize
1.1MB

MD5
ba2cc648c9fd030cf62fbc3229de4d4a

SHA1
c0cea6f0acab77e993d8b47b242e4d2d4076c643

SHA256
a396bd249808560c4265716a8bfb544a4dbe08e6987adb3b94bc9a2a608f94d4

SHA512
845567e773e3182b137e0ef8cd4b3b5d58587252ced63ca5f280b521d77e92187633372c1d6dec6a05808ff34e73b7bc97ab8f1d5288645e05dc6ae16a0da293

Download Submit
C:\Windows\System\eYvUgFL.exe

Filesize
1.1MB

MD5
d4f7bc6c8abac2ca136a342caedbb251

SHA1
9447c21f327d189614fb366ce0e0d6000271292a

SHA256
7c34ca1d50e807b6f7fc40dc32ea09e48b2838d682b00d185b3138459a4e1d85

SHA512
46051b4c48bc6cef8188d93a9c79e7a806673308cc0f3cfef3fccdb980ea620bfb7edc2334da0f6d3da92d59cbb6248abfb0e357183d541b9175f73c5eb3b462

Download Submit
C:\Windows\System\hqlMUiW.exe

Filesize
1.1MB

MD5
e49d452cc73a29ab0c1146e16647f9b0

SHA1
b3efd55503b51a7d8301fc150cd905d4fb60629a

SHA256
959f2629ec8619ca0000096a296e26a05a3ef59476ffd1b79de11439d9afd0dc

SHA512
1bd04a05239d2dfd602a6510befda8558c3aa489553f8cf19f92b07c2fdee168478e317fb7c1cf433179435c377900400f54eb4cd5d77a01054a7df2777b1076

Download Submit
C:\Windows\System\iGGPAFC.exe

Filesize
1.1MB

MD5
39f07888d51ed452c751fa17dbe01f1d

SHA1
6931769485290d3d8c7f2b9155d578642770819c

SHA256
2474de7bd418465dace1a433b6e283571577abb13f1a05e2b6f72952a48a75b7

SHA512
4afbf758e8b976f8720e569d673105bf063cf2b447221511fa177342855f9de6af0c84f6ce0a681b1005c4de98c7a84b42f521d7acc0035223f4b94b33acd147

Download Submit
C:\Windows\System\jAzuOwG.exe

Filesize
1.1MB

MD5
d0f944841e01cd6fca34df3701e9b934

SHA1
5d4460cc6d76ee6893218d4e4f4982631816dc5c

SHA256
deda2f8876f478c3a0365015d5cb85960e60506a2c63b8031475cd4af9fb913c

SHA512
5e087105b56bfb140b798efc1ed3f3c8fac7cce9096d8cbe59a33dbb363f5f5700f6e3267a1721f0171e9d48e7adee38d4e9f5bcb7b4af05a9d6c45e46dfde64

Download Submit
C:\Windows\System\mMxZmlz.exe

Filesize
1.1MB

MD5
241f3db384611442fdc6292285bc651c

SHA1
36700338db08a77ec75e3a31e13d9782261b42af

SHA256
ec48378452fecfe142f594ae8d3d369a8829934e1cba0c68b53cd28bae1d6d31

SHA512
24b07b8773e62ca8615a89d6e7fc7a34f7d4dcc89cda8dc9bb52223d3a18cdf15f7649f25390b2bfa5bf71828f9f82595e7f2a2ed2d05f7003b8f98dfe2835b0

Download Submit
C:\Windows\System\mpZQaRD.exe

Filesize
1.1MB

MD5
0023c1b7ad8f8408b9f0526526821a97

SHA1
ce5003e734f1b8e971d613f234a190d6758744dd

SHA256
c9f937d34c867c890e76a78c50b252545f7faff6e46ddb4947e3f23345a26a56

SHA512
2cb08ad5621635c39bd61b10e204fb7adc7bd67752ed0cca78fa4ea93375d0bfcc2b5f551099d72d69e76af4ef90e0a6962815287c09cf2415d00ddde475d37f

Download Submit
C:\Windows\System\oCYoCGZ.exe

Filesize
1.1MB

MD5
a33365933f608203f9c2ea3bb46059bc

SHA1
78ffeff2e3f51148fa7e294dc9488006fcae3cef

SHA256
1fd7f7c8ac3b709649140b3249c316b38ad40064274af19b3e02a181d2962c0d

SHA512
84e79fe4237370088ddb94de02b1713aa2ea5fb99340bd5f658b7c8470675ab6cbf72b41c6e64e1e01911718937ad9fc5fd0dd8bc39f75ffe1a6568c2514d2fa

Download Submit
C:\Windows\System\okqTWld.exe

Filesize
1.1MB

MD5
8b4c4f5ccb6a0025d73fb8a26096a8e4

SHA1
430283447cefcfe9f3c5e4854db9b0e344a85b51

SHA256
3b69b97feb3249625eeca30b95b69843a506f632326cc347b31f30766651ca79

SHA512
df485a3a4c6e912b55367edaebee0f16bf32ef8b767255b7374a8277e960383e029e8f7ede8035cfae9f1a9ee5dda8f0cf8cf95c84837bfe6311752ae2ae480b

Download Submit
C:\Windows\System\qUyrPZW.exe

Filesize
1.1MB

MD5
d2f86834b28fc7725f78719427a84e2e

SHA1
fa0dbb9ace03fbff85d76764d941c9d54d2a156e

SHA256
9d88ec28676e3ef5aedf5b2e3fad997d6cb809569568c9be2d23bb3c2758261c

SHA512
2935868eaeb6686928c2ab84a1d5720ef5bb7f5fddb9226b281a0c640703e16bc3a7bd06b9cf07018c628be9b3bf381255f09eaa59986abbeae8469c482380f8

Download Submit
C:\Windows\System\rQIwKkh.exe

Filesize
1.1MB

MD5
a1c18549dac43c761cd5bddf814ab915

SHA1
7f4c3d9e8613dd902cc8df53ad76dc50790cc5fd

SHA256
9224b584664ee00f914d856e43377cea33d68287a9427d45b78e32832e78d75f

SHA512
79a7b059b601ca6961a11108281d5da80bf999b9200192bc3f472d948a8983ffaa16d5eefbc3bd150c0255fdf423598ffc12c58d6bdfbc750a0cf4bf7a52fe2b

Download Submit
memory/4284-0-0x00000204AD330000-0x00000204AD340000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.