xmrig | 8318bfcf652435d46c275322c88e61b323e29ec30f6213ce2ffe492ef1a2c027

Analysis

max time kernel
116s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 04:59 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
Size

1.3MB
MD5

9ee9cb7258d7cb5edb10048c3836c900
SHA1

8f0c59e994b884bb705498e6507fa4db0e50df6d
SHA256

8318bfcf652435d46c275322c88e61b323e29ec30f6213ce2ffe492ef1a2c027
SHA512

cda7794fac134949b4a0698904877c730f3bd692cf893ec863cc7533f110b739ac14906f66205865c9036db6890210f8943b73150ff1004bb3635868c5ac3853
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzQv4SYm/ji:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVL

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000022f51-4.dat	xmrig
behavioral2/files/0x000900000002340a-9.dat	xmrig
behavioral2/files/0x0007000000023413-15.dat	xmrig
behavioral2/files/0x0007000000023414-19.dat	xmrig
behavioral2/files/0x0007000000023415-24.dat	xmrig
behavioral2/files/0x0007000000023416-29.dat	xmrig
behavioral2/files/0x0007000000023418-37.dat	xmrig
behavioral2/files/0x0007000000023427-107.dat	xmrig
behavioral2/files/0x000700000002342c-132.dat	xmrig
behavioral2/files/0x0007000000023432-162.dat	xmrig
behavioral2/files/0x0007000000023430-160.dat	xmrig
behavioral2/files/0x0007000000023431-157.dat	xmrig
behavioral2/files/0x000700000002342f-155.dat	xmrig
behavioral2/files/0x000700000002342e-150.dat	xmrig
behavioral2/files/0x000700000002342d-145.dat	xmrig
behavioral2/files/0x000700000002342b-135.dat	xmrig
behavioral2/files/0x000700000002342a-130.dat	xmrig
behavioral2/files/0x0007000000023429-125.dat	xmrig
behavioral2/files/0x0007000000023428-120.dat	xmrig
behavioral2/files/0x0007000000023426-110.dat	xmrig
behavioral2/files/0x0007000000023425-105.dat	xmrig
behavioral2/files/0x0007000000023424-100.dat	xmrig
behavioral2/files/0x0007000000023423-95.dat	xmrig
behavioral2/files/0x0007000000023422-90.dat	xmrig
behavioral2/files/0x0007000000023421-85.dat	xmrig
behavioral2/files/0x0007000000023420-80.dat	xmrig
behavioral2/files/0x000700000002341f-75.dat	xmrig
behavioral2/files/0x000700000002341e-70.dat	xmrig
behavioral2/files/0x000700000002341d-65.dat	xmrig
behavioral2/files/0x000700000002341c-60.dat	xmrig
behavioral2/files/0x000700000002341b-55.dat	xmrig
behavioral2/files/0x000700000002341a-47.dat	xmrig
behavioral2/files/0x0007000000023419-43.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2888	UZJHsKO.exe
3312	abHuXKJ.exe
3956	UPOGKpR.exe
4220	RujaOSD.exe
4428	DyvlTGW.exe
2416	dfnaqYs.exe
1528	sQOprSz.exe
2608	uEMBeGy.exe
3644	HBEFTFL.exe
4892	etGvpBX.exe
4380	XIMbbTk.exe
4964	sGmNNcS.exe
2452	EfxjQXF.exe
4388	aPatdMw.exe
3160	ncQaETh.exe
2704	ioxZZRh.exe
3144	pAHmByi.exe
3668	xXmSEgH.exe
4672	cVPSziC.exe
3532	TUzTYsu.exe
3012	yzGNgdQ.exe
4040	vKLHnKU.exe
4976	zaAKIEP.exe
2692	VhhYSJO.exe
2128	CNBBawJ.exe
428	nhLCvty.exe
812	UPrsbCw.exe
556	JctbpnE.exe
4788	JEGcMGi.exe
2856	VReHHTr.exe
1192	DbuqhYW.exe
4844	WSfadiw.exe
4036	GVWsLuh.exe
2744	GUoTlOc.exe
2596	grlKPbU.exe
4556	tjftqDP.exe
5000	xSTcbpE.exe
1892	caaGZvt.exe
3568	sWvTJMI.exe
3124	CKVxgZV.exe
3128	CoDCXhh.exe
3664	yGpwLyu.exe
2176	WXyqraA.exe
4932	fOahtIG.exe
5004	rTKWNrK.exe
3952	yWmOovn.exe
752	weJesvJ.exe
3064	CGllDya.exe
512	EfiKXaO.exe
4636	cYwgOXH.exe
3964	YxkccKm.exe
3708	ZBuCYed.exe
2488	qJSLvNp.exe
4332	EYDTJIa.exe
3232	ZCQaFYY.exe
3376	kfyqskE.exe
404	tkBWKUK.exe
2904	saJtdOQ.exe
3628	QSlFlia.exe
1608	tYdHSwL.exe
3136	rkYwWiv.exe
4152	AudDNdb.exe
3380	BxmlsHg.exe
1156	wlUlGgI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hDijCop.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\gDvZWAm.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\JABgHPR.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\OgahgvX.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\EArmRzm.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\hrBUyyw.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\ZwlKTXm.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\tKkpSgq.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\McQFJxn.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\YnvPiEr.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\poUfTGQ.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\TTvmALU.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\gBbAKXF.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\fxsinXa.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\BiFRpqW.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\FgfcvXW.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\VWRDUMS.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\VsAHLui.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\dncDShP.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\jfCPQzy.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\CarHppa.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\gksBQpJ.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\WOJTSJx.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\UynZxCU.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\IbpfTPV.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\XRSZuaN.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\pRGeaiQ.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\umuaASe.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\UjpgTpL.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\ngYNDjT.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\fhXgxNo.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\Qqxgcwn.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\aVyZhWI.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\UEQLwjH.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\DKjjjhD.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\jRmabFa.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\SZWbWBy.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\piCQMEE.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\wJmnfoD.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\VMKaGcr.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\tcYHrFw.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\vVRiiyI.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\IdAcoms.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\sGmNNcS.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\JhTohDy.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\GEvtSJE.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\etcfBBY.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\gaOJdry.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\vMbywkZ.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\PaDqsFx.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\YBxIwGk.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\OXUVidv.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\nfDIlex.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\ZgRIWKI.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\hpEtAKX.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\rTKWNrK.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\fHBAeCA.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\YjiRtAU.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\SvqciGK.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\uMmmLqI.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\HZmcJdb.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\rYvgaYV.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\NLaPRRn.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
File created	C:\Windows\System\UCbXANq.exe	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 2888	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	84
PID 536 wrote to memory of 2888	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	84
PID 536 wrote to memory of 3312	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	85
PID 536 wrote to memory of 3312	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	85
PID 536 wrote to memory of 3956	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	86
PID 536 wrote to memory of 3956	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	86
PID 536 wrote to memory of 4220	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	87
PID 536 wrote to memory of 4220	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	87
PID 536 wrote to memory of 4428	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	88
PID 536 wrote to memory of 4428	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	88
PID 536 wrote to memory of 2416	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	89
PID 536 wrote to memory of 2416	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	89
PID 536 wrote to memory of 1528	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	90
PID 536 wrote to memory of 1528	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	90
PID 536 wrote to memory of 2608	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	91
PID 536 wrote to memory of 2608	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	91
PID 536 wrote to memory of 3644	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	92
PID 536 wrote to memory of 3644	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	92
PID 536 wrote to memory of 4892	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	93
PID 536 wrote to memory of 4892	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	93
PID 536 wrote to memory of 4380	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	94
PID 536 wrote to memory of 4380	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	94
PID 536 wrote to memory of 4964	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	95
PID 536 wrote to memory of 4964	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	95
PID 536 wrote to memory of 2452	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	96
PID 536 wrote to memory of 2452	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	96
PID 536 wrote to memory of 4388	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	97
PID 536 wrote to memory of 4388	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	97
PID 536 wrote to memory of 3160	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	98
PID 536 wrote to memory of 3160	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	98
PID 536 wrote to memory of 2704	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	99
PID 536 wrote to memory of 2704	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	99
PID 536 wrote to memory of 3144	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	100
PID 536 wrote to memory of 3144	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	100
PID 536 wrote to memory of 3668	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	101
PID 536 wrote to memory of 3668	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	101
PID 536 wrote to memory of 4672	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	102
PID 536 wrote to memory of 4672	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	102
PID 536 wrote to memory of 3532	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	103
PID 536 wrote to memory of 3532	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	103
PID 536 wrote to memory of 3012	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	104
PID 536 wrote to memory of 3012	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	104
PID 536 wrote to memory of 4040	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	105
PID 536 wrote to memory of 4040	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	105
PID 536 wrote to memory of 4976	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	106
PID 536 wrote to memory of 4976	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	106
PID 536 wrote to memory of 2692	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	107
PID 536 wrote to memory of 2692	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	107
PID 536 wrote to memory of 2128	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	108
PID 536 wrote to memory of 2128	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	108
PID 536 wrote to memory of 428	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	109
PID 536 wrote to memory of 428	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	109
PID 536 wrote to memory of 812	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	110
PID 536 wrote to memory of 812	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	110
PID 536 wrote to memory of 556	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	111
PID 536 wrote to memory of 556	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	111
PID 536 wrote to memory of 4788	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	112
PID 536 wrote to memory of 4788	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	112
PID 536 wrote to memory of 2856	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	113
PID 536 wrote to memory of 2856	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	113
PID 536 wrote to memory of 1192	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	114
PID 536 wrote to memory of 1192	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	114
PID 536 wrote to memory of 4844	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	115
PID 536 wrote to memory of 4844	536	9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ee9cb7258d7cb5edb10048c3836c900_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System\UZJHsKO.exe
  C:\Windows\System\UZJHsKO.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\abHuXKJ.exe
  C:\Windows\System\abHuXKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\UPOGKpR.exe
  C:\Windows\System\UPOGKpR.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\RujaOSD.exe
  C:\Windows\System\RujaOSD.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\DyvlTGW.exe
  C:\Windows\System\DyvlTGW.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\dfnaqYs.exe
  C:\Windows\System\dfnaqYs.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\sQOprSz.exe
  C:\Windows\System\sQOprSz.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\uEMBeGy.exe
  C:\Windows\System\uEMBeGy.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\HBEFTFL.exe
  C:\Windows\System\HBEFTFL.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\etGvpBX.exe
  C:\Windows\System\etGvpBX.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\XIMbbTk.exe
  C:\Windows\System\XIMbbTk.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\sGmNNcS.exe
  C:\Windows\System\sGmNNcS.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\EfxjQXF.exe
  C:\Windows\System\EfxjQXF.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\aPatdMw.exe
  C:\Windows\System\aPatdMw.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\ncQaETh.exe
  C:\Windows\System\ncQaETh.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ioxZZRh.exe
  C:\Windows\System\ioxZZRh.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\pAHmByi.exe
  C:\Windows\System\pAHmByi.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\xXmSEgH.exe
  C:\Windows\System\xXmSEgH.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\cVPSziC.exe
  C:\Windows\System\cVPSziC.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\TUzTYsu.exe
  C:\Windows\System\TUzTYsu.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\yzGNgdQ.exe
  C:\Windows\System\yzGNgdQ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\vKLHnKU.exe
  C:\Windows\System\vKLHnKU.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\zaAKIEP.exe
  C:\Windows\System\zaAKIEP.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\VhhYSJO.exe
  C:\Windows\System\VhhYSJO.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\CNBBawJ.exe
  C:\Windows\System\CNBBawJ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\nhLCvty.exe
  C:\Windows\System\nhLCvty.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\UPrsbCw.exe
  C:\Windows\System\UPrsbCw.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\JctbpnE.exe
  C:\Windows\System\JctbpnE.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\JEGcMGi.exe
  C:\Windows\System\JEGcMGi.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\VReHHTr.exe
  C:\Windows\System\VReHHTr.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\DbuqhYW.exe
  C:\Windows\System\DbuqhYW.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\WSfadiw.exe
  C:\Windows\System\WSfadiw.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\GVWsLuh.exe
  C:\Windows\System\GVWsLuh.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\GUoTlOc.exe
  C:\Windows\System\GUoTlOc.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\grlKPbU.exe
  C:\Windows\System\grlKPbU.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\tjftqDP.exe
  C:\Windows\System\tjftqDP.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\xSTcbpE.exe
  C:\Windows\System\xSTcbpE.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\caaGZvt.exe
  C:\Windows\System\caaGZvt.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\sWvTJMI.exe
  C:\Windows\System\sWvTJMI.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\CKVxgZV.exe
  C:\Windows\System\CKVxgZV.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\CoDCXhh.exe
  C:\Windows\System\CoDCXhh.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\yGpwLyu.exe
  C:\Windows\System\yGpwLyu.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\WXyqraA.exe
  C:\Windows\System\WXyqraA.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\fOahtIG.exe
  C:\Windows\System\fOahtIG.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\rTKWNrK.exe
  C:\Windows\System\rTKWNrK.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\yWmOovn.exe
  C:\Windows\System\yWmOovn.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\weJesvJ.exe
  C:\Windows\System\weJesvJ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\CGllDya.exe
  C:\Windows\System\CGllDya.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\EfiKXaO.exe
  C:\Windows\System\EfiKXaO.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\cYwgOXH.exe
  C:\Windows\System\cYwgOXH.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\YxkccKm.exe
  C:\Windows\System\YxkccKm.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\ZBuCYed.exe
  C:\Windows\System\ZBuCYed.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\qJSLvNp.exe
  C:\Windows\System\qJSLvNp.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\EYDTJIa.exe
  C:\Windows\System\EYDTJIa.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ZCQaFYY.exe
  C:\Windows\System\ZCQaFYY.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\kfyqskE.exe
  C:\Windows\System\kfyqskE.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\tkBWKUK.exe
  C:\Windows\System\tkBWKUK.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\saJtdOQ.exe
  C:\Windows\System\saJtdOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\QSlFlia.exe
  C:\Windows\System\QSlFlia.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\tYdHSwL.exe
  C:\Windows\System\tYdHSwL.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\rkYwWiv.exe
  C:\Windows\System\rkYwWiv.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\AudDNdb.exe
  C:\Windows\System\AudDNdb.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\BxmlsHg.exe
  C:\Windows\System\BxmlsHg.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\wlUlGgI.exe
  C:\Windows\System\wlUlGgI.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ghXYprb.exe
  C:\Windows\System\ghXYprb.exe
  2⤵
  PID:4884
- C:\Windows\System\QibzwGc.exe
  C:\Windows\System\QibzwGc.exe
  2⤵
  PID:2032
- C:\Windows\System\TTvmALU.exe
  C:\Windows\System\TTvmALU.exe
  2⤵
  PID:4248
- C:\Windows\System\EwIHFUD.exe
  C:\Windows\System\EwIHFUD.exe
  2⤵
  PID:5084
- C:\Windows\System\YBdbHnm.exe
  C:\Windows\System\YBdbHnm.exe
  2⤵
  PID:3736
- C:\Windows\System\IEgdDGh.exe
  C:\Windows\System\IEgdDGh.exe
  2⤵
  PID:2192
- C:\Windows\System\gnjDMOm.exe
  C:\Windows\System\gnjDMOm.exe
  2⤵
  PID:2432
- C:\Windows\System\jfCPQzy.exe
  C:\Windows\System\jfCPQzy.exe
  2⤵
  PID:760
- C:\Windows\System\XMkLNCW.exe
  C:\Windows\System\XMkLNCW.exe
  2⤵
  PID:4484
- C:\Windows\System\WZsTYVf.exe
  C:\Windows\System\WZsTYVf.exe
  2⤵
  PID:2284
- C:\Windows\System\qJOLPpI.exe
  C:\Windows\System\qJOLPpI.exe
  2⤵
  PID:876
- C:\Windows\System\KJlAeLY.exe
  C:\Windows\System\KJlAeLY.exe
  2⤵
  PID:2828
- C:\Windows\System\RjTtAXA.exe
  C:\Windows\System\RjTtAXA.exe
  2⤵
  PID:4928
- C:\Windows\System\oiMsmIm.exe
  C:\Windows\System\oiMsmIm.exe
  2⤵
  PID:4500
- C:\Windows\System\KftToUD.exe
  C:\Windows\System\KftToUD.exe
  2⤵
  PID:1740
- C:\Windows\System\ZyJirhA.exe
  C:\Windows\System\ZyJirhA.exe
  2⤵
  PID:3020
- C:\Windows\System\mUCchEn.exe
  C:\Windows\System\mUCchEn.exe
  2⤵
  PID:1820
- C:\Windows\System\zUqbPKd.exe
  C:\Windows\System\zUqbPKd.exe
  2⤵
  PID:4352
- C:\Windows\System\MIlAtEu.exe
  C:\Windows\System\MIlAtEu.exe
  2⤵
  PID:5140
- C:\Windows\System\VRoqRyQ.exe
  C:\Windows\System\VRoqRyQ.exe
  2⤵
  PID:5168
- C:\Windows\System\OMOGgLN.exe
  C:\Windows\System\OMOGgLN.exe
  2⤵
  PID:5196
- C:\Windows\System\nghLgxA.exe
  C:\Windows\System\nghLgxA.exe
  2⤵
  PID:5224
- C:\Windows\System\VPIWOFO.exe
  C:\Windows\System\VPIWOFO.exe
  2⤵
  PID:5252
- C:\Windows\System\RmCvCUI.exe
  C:\Windows\System\RmCvCUI.exe
  2⤵
  PID:5280
- C:\Windows\System\UisdALN.exe
  C:\Windows\System\UisdALN.exe
  2⤵
  PID:5312
- C:\Windows\System\fHmPKQO.exe
  C:\Windows\System\fHmPKQO.exe
  2⤵
  PID:5340
- C:\Windows\System\EWemGLf.exe
  C:\Windows\System\EWemGLf.exe
  2⤵
  PID:5364
- C:\Windows\System\SZWbWBy.exe
  C:\Windows\System\SZWbWBy.exe
  2⤵
  PID:5392
- C:\Windows\System\lxnmHYg.exe
  C:\Windows\System\lxnmHYg.exe
  2⤵
  PID:5420
- C:\Windows\System\luPQtyV.exe
  C:\Windows\System\luPQtyV.exe
  2⤵
  PID:5448
- C:\Windows\System\fHBAeCA.exe
  C:\Windows\System\fHBAeCA.exe
  2⤵
  PID:5476
- C:\Windows\System\UEKjLXQ.exe
  C:\Windows\System\UEKjLXQ.exe
  2⤵
  PID:5504
- C:\Windows\System\acgntkU.exe
  C:\Windows\System\acgntkU.exe
  2⤵
  PID:5532
- C:\Windows\System\xROvHwG.exe
  C:\Windows\System\xROvHwG.exe
  2⤵
  PID:5560
- C:\Windows\System\UTvteDi.exe
  C:\Windows\System\UTvteDi.exe
  2⤵
  PID:5588
- C:\Windows\System\jpBFDyV.exe
  C:\Windows\System\jpBFDyV.exe
  2⤵
  PID:5616
- C:\Windows\System\lcsneBs.exe
  C:\Windows\System\lcsneBs.exe
  2⤵
  PID:5644
- C:\Windows\System\rHjUTGD.exe
  C:\Windows\System\rHjUTGD.exe
  2⤵
  PID:5672
- C:\Windows\System\euPyJGe.exe
  C:\Windows\System\euPyJGe.exe
  2⤵
  PID:5700
- C:\Windows\System\MOryLoU.exe
  C:\Windows\System\MOryLoU.exe
  2⤵
  PID:5728
- C:\Windows\System\gMuFosH.exe
  C:\Windows\System\gMuFosH.exe
  2⤵
  PID:5756
- C:\Windows\System\JEHmTRz.exe
  C:\Windows\System\JEHmTRz.exe
  2⤵
  PID:5784
- C:\Windows\System\cDgfXVo.exe
  C:\Windows\System\cDgfXVo.exe
  2⤵
  PID:5812
- C:\Windows\System\YzMZtKP.exe
  C:\Windows\System\YzMZtKP.exe
  2⤵
  PID:5840
- C:\Windows\System\JbKboxE.exe
  C:\Windows\System\JbKboxE.exe
  2⤵
  PID:5868
- C:\Windows\System\CLbiUzk.exe
  C:\Windows\System\CLbiUzk.exe
  2⤵
  PID:5896
- C:\Windows\System\OiwGNYh.exe
  C:\Windows\System\OiwGNYh.exe
  2⤵
  PID:5932
- C:\Windows\System\NzpTFGp.exe
  C:\Windows\System\NzpTFGp.exe
  2⤵
  PID:5952
- C:\Windows\System\xntiMlp.exe
  C:\Windows\System\xntiMlp.exe
  2⤵
  PID:5980
- C:\Windows\System\yidRWvT.exe
  C:\Windows\System\yidRWvT.exe
  2⤵
  PID:6008
- C:\Windows\System\xqYuoJY.exe
  C:\Windows\System\xqYuoJY.exe
  2⤵
  PID:6036
- C:\Windows\System\DKwMXdc.exe
  C:\Windows\System\DKwMXdc.exe
  2⤵
  PID:6064
- C:\Windows\System\BYKSYCm.exe
  C:\Windows\System\BYKSYCm.exe
  2⤵
  PID:6092
- C:\Windows\System\MNldjBc.exe
  C:\Windows\System\MNldjBc.exe
  2⤵
  PID:6116
- C:\Windows\System\VMKaGcr.exe
  C:\Windows\System\VMKaGcr.exe
  2⤵
  PID:4868
- C:\Windows\System\NZAoRZe.exe
  C:\Windows\System\NZAoRZe.exe
  2⤵
  PID:1168
- C:\Windows\System\dSCWUuR.exe
  C:\Windows\System\dSCWUuR.exe
  2⤵
  PID:3536
- C:\Windows\System\zjUovJM.exe
  C:\Windows\System\zjUovJM.exe
  2⤵
  PID:4076
- C:\Windows\System\fQrAknu.exe
  C:\Windows\System\fQrAknu.exe
  2⤵
  PID:4616
- C:\Windows\System\fLtYqAZ.exe
  C:\Windows\System\fLtYqAZ.exe
  2⤵
  PID:3444
- C:\Windows\System\AOHljav.exe
  C:\Windows\System\AOHljav.exe
  2⤵
  PID:3284
- C:\Windows\System\WtgzqXt.exe
  C:\Windows\System\WtgzqXt.exe
  2⤵
  PID:1896
- C:\Windows\System\MWVdlSv.exe
  C:\Windows\System\MWVdlSv.exe
  2⤵
  PID:5156
- C:\Windows\System\xbufBVl.exe
  C:\Windows\System\xbufBVl.exe
  2⤵
  PID:5212
- C:\Windows\System\sEmaryP.exe
  C:\Windows\System\sEmaryP.exe
  2⤵
  PID:5272
- C:\Windows\System\wUjHEWx.exe
  C:\Windows\System\wUjHEWx.exe
  2⤵
  PID:5348
- C:\Windows\System\rYvgaYV.exe
  C:\Windows\System\rYvgaYV.exe
  2⤵
  PID:5408
- C:\Windows\System\HynNrUC.exe
  C:\Windows\System\HynNrUC.exe
  2⤵
  PID:5468
- C:\Windows\System\HiKPWTf.exe
  C:\Windows\System\HiKPWTf.exe
  2⤵
  PID:5524
- C:\Windows\System\XRSZuaN.exe
  C:\Windows\System\XRSZuaN.exe
  2⤵
  PID:5600
- C:\Windows\System\cROSnLT.exe
  C:\Windows\System\cROSnLT.exe
  2⤵
  PID:5660
- C:\Windows\System\NQGrqgE.exe
  C:\Windows\System\NQGrqgE.exe
  2⤵
  PID:5720
- C:\Windows\System\LmFmpYU.exe
  C:\Windows\System\LmFmpYU.exe
  2⤵
  PID:5796
- C:\Windows\System\HJhxvgt.exe
  C:\Windows\System\HJhxvgt.exe
  2⤵
  PID:5856
- C:\Windows\System\UIjmjst.exe
  C:\Windows\System\UIjmjst.exe
  2⤵
  PID:5920
- C:\Windows\System\YjiRtAU.exe
  C:\Windows\System\YjiRtAU.exe
  2⤵
  PID:5992
- C:\Windows\System\IkjRRjA.exe
  C:\Windows\System\IkjRRjA.exe
  2⤵
  PID:6048
- C:\Windows\System\CYvoafP.exe
  C:\Windows\System\CYvoafP.exe
  2⤵
  PID:6108
- C:\Windows\System\ACENnvc.exe
  C:\Windows\System\ACENnvc.exe
  2⤵
  PID:4808
- C:\Windows\System\XyQBJVU.exe
  C:\Windows\System\XyQBJVU.exe
  2⤵
  PID:3828
- C:\Windows\System\LIGGDsf.exe
  C:\Windows\System\LIGGDsf.exe
  2⤵
  PID:2372
- C:\Windows\System\aDtoFPI.exe
  C:\Windows\System\aDtoFPI.exe
  2⤵
  PID:5128
- C:\Windows\System\OxzlyFu.exe
  C:\Windows\System\OxzlyFu.exe
  2⤵
  PID:5244
- C:\Windows\System\vxSXYiZ.exe
  C:\Windows\System\vxSXYiZ.exe
  2⤵
  PID:5384
- C:\Windows\System\bpiiRrb.exe
  C:\Windows\System\bpiiRrb.exe
  2⤵
  PID:5552
- C:\Windows\System\vdcDLDM.exe
  C:\Windows\System\vdcDLDM.exe
  2⤵
  PID:5688
- C:\Windows\System\bLhCapg.exe
  C:\Windows\System\bLhCapg.exe
  2⤵
  PID:5824
- C:\Windows\System\bcmsmnI.exe
  C:\Windows\System\bcmsmnI.exe
  2⤵
  PID:6172
- C:\Windows\System\ueHVhAr.exe
  C:\Windows\System\ueHVhAr.exe
  2⤵
  PID:6200
- C:\Windows\System\hivYoWv.exe
  C:\Windows\System\hivYoWv.exe
  2⤵
  PID:6228
- C:\Windows\System\yrcTVxD.exe
  C:\Windows\System\yrcTVxD.exe
  2⤵
  PID:6256
- C:\Windows\System\WtVBZFP.exe
  C:\Windows\System\WtVBZFP.exe
  2⤵
  PID:6280
- C:\Windows\System\EwMaqGy.exe
  C:\Windows\System\EwMaqGy.exe
  2⤵
  PID:6316
- C:\Windows\System\tWwdRHT.exe
  C:\Windows\System\tWwdRHT.exe
  2⤵
  PID:6348
- C:\Windows\System\qkuGgih.exe
  C:\Windows\System\qkuGgih.exe
  2⤵
  PID:6376
- C:\Windows\System\YhkGGMB.exe
  C:\Windows\System\YhkGGMB.exe
  2⤵
  PID:6396
- C:\Windows\System\SbAAsgh.exe
  C:\Windows\System\SbAAsgh.exe
  2⤵
  PID:6420
- C:\Windows\System\eXeaeRB.exe
  C:\Windows\System\eXeaeRB.exe
  2⤵
  PID:6448
- C:\Windows\System\pqdvqWN.exe
  C:\Windows\System\pqdvqWN.exe
  2⤵
  PID:6480
- C:\Windows\System\OGMpWrm.exe
  C:\Windows\System\OGMpWrm.exe
  2⤵
  PID:6508
- C:\Windows\System\bYhNCJl.exe
  C:\Windows\System\bYhNCJl.exe
  2⤵
  PID:6536
- C:\Windows\System\GDpKrjt.exe
  C:\Windows\System\GDpKrjt.exe
  2⤵
  PID:6560
- C:\Windows\System\QSwdjaP.exe
  C:\Windows\System\QSwdjaP.exe
  2⤵
  PID:6592
- C:\Windows\System\oIFKDqM.exe
  C:\Windows\System\oIFKDqM.exe
  2⤵
  PID:6620
- C:\Windows\System\atuQDtF.exe
  C:\Windows\System\atuQDtF.exe
  2⤵
  PID:6648
- C:\Windows\System\tkrmqVG.exe
  C:\Windows\System\tkrmqVG.exe
  2⤵
  PID:6676
- C:\Windows\System\JABgHPR.exe
  C:\Windows\System\JABgHPR.exe
  2⤵
  PID:6704
- C:\Windows\System\IHzufqv.exe
  C:\Windows\System\IHzufqv.exe
  2⤵
  PID:6732
- C:\Windows\System\alEajDy.exe
  C:\Windows\System\alEajDy.exe
  2⤵
  PID:6760
- C:\Windows\System\HnNSPkR.exe
  C:\Windows\System\HnNSPkR.exe
  2⤵
  PID:6788
- C:\Windows\System\cVXWZok.exe
  C:\Windows\System\cVXWZok.exe
  2⤵
  PID:6816
- C:\Windows\System\OiAMLCG.exe
  C:\Windows\System\OiAMLCG.exe
  2⤵
  PID:6844
- C:\Windows\System\SPKSrCC.exe
  C:\Windows\System\SPKSrCC.exe
  2⤵
  PID:6872
- C:\Windows\System\TOuErel.exe
  C:\Windows\System\TOuErel.exe
  2⤵
  PID:6900
- C:\Windows\System\IDTycss.exe
  C:\Windows\System\IDTycss.exe
  2⤵
  PID:6928
- C:\Windows\System\oqeyDxP.exe
  C:\Windows\System\oqeyDxP.exe
  2⤵
  PID:6952
- C:\Windows\System\NYlPwzR.exe
  C:\Windows\System\NYlPwzR.exe
  2⤵
  PID:6980
- C:\Windows\System\MTVPjzF.exe
  C:\Windows\System\MTVPjzF.exe
  2⤵
  PID:7008
- C:\Windows\System\CGtHhDZ.exe
  C:\Windows\System\CGtHhDZ.exe
  2⤵
  PID:7040
- C:\Windows\System\UoakrRw.exe
  C:\Windows\System\UoakrRw.exe
  2⤵
  PID:7068
- C:\Windows\System\VlACTJz.exe
  C:\Windows\System\VlACTJz.exe
  2⤵
  PID:7096
- C:\Windows\System\RxxqhDW.exe
  C:\Windows\System\RxxqhDW.exe
  2⤵
  PID:7124
- C:\Windows\System\MIdKTwz.exe
  C:\Windows\System\MIdKTwz.exe
  2⤵
  PID:7152
- C:\Windows\System\qlCGAaN.exe
  C:\Windows\System\qlCGAaN.exe
  2⤵
  PID:5884
- C:\Windows\System\YNuNICo.exe
  C:\Windows\System\YNuNICo.exe
  2⤵
  PID:6140
- C:\Windows\System\IrsRiKW.exe
  C:\Windows\System\IrsRiKW.exe
  2⤵
  PID:5184
- C:\Windows\System\gaOJdry.exe
  C:\Windows\System\gaOJdry.exe
  2⤵
  PID:5632
- C:\Windows\System\xSUfseC.exe
  C:\Windows\System\xSUfseC.exe
  2⤵
  PID:6164
- C:\Windows\System\MTWNUKT.exe
  C:\Windows\System\MTWNUKT.exe
  2⤵
  PID:6240
- C:\Windows\System\OblpZJL.exe
  C:\Windows\System\OblpZJL.exe
  2⤵
  PID:6272
- C:\Windows\System\ZDeVDZi.exe
  C:\Windows\System\ZDeVDZi.exe
  2⤵
  PID:6364
- C:\Windows\System\hXuEbSw.exe
  C:\Windows\System\hXuEbSw.exe
  2⤵
  PID:6388
- C:\Windows\System\pRGeaiQ.exe
  C:\Windows\System\pRGeaiQ.exe
  2⤵
  PID:6436
- C:\Windows\System\itBGPIA.exe
  C:\Windows\System\itBGPIA.exe
  2⤵
  PID:6492
- C:\Windows\System\sSaSAxs.exe
  C:\Windows\System\sSaSAxs.exe
  2⤵
  PID:4804
- C:\Windows\System\KvdnrIb.exe
  C:\Windows\System\KvdnrIb.exe
  2⤵
  PID:6580
- C:\Windows\System\vMbywkZ.exe
  C:\Windows\System\vMbywkZ.exe
  2⤵
  PID:6632
- C:\Windows\System\TQFvXXM.exe
  C:\Windows\System\TQFvXXM.exe
  2⤵
  PID:6668
- C:\Windows\System\jAQsniD.exe
  C:\Windows\System\jAQsniD.exe
  2⤵
  PID:6748
- C:\Windows\System\DVDtePn.exe
  C:\Windows\System\DVDtePn.exe
  2⤵
  PID:6808
- C:\Windows\System\BbPvmfe.exe
  C:\Windows\System\BbPvmfe.exe
  2⤵
  PID:6832
- C:\Windows\System\cnDJUfS.exe
  C:\Windows\System\cnDJUfS.exe
  2⤵
  PID:5080
- C:\Windows\System\zZEEcDk.exe
  C:\Windows\System\zZEEcDk.exe
  2⤵
  PID:4996
- C:\Windows\System\rsPnzsx.exe
  C:\Windows\System\rsPnzsx.exe
  2⤵
  PID:6920
- C:\Windows\System\zsMUIyO.exe
  C:\Windows\System\zsMUIyO.exe
  2⤵
  PID:6944
- C:\Windows\System\IbEmIMx.exe
  C:\Windows\System\IbEmIMx.exe
  2⤵
  PID:7032
- C:\Windows\System\WcodIqQ.exe
  C:\Windows\System\WcodIqQ.exe
  2⤵
  PID:7108
- C:\Windows\System\AZVPCLN.exe
  C:\Windows\System\AZVPCLN.exe
  2⤵
  PID:456
- C:\Windows\System\zkotacK.exe
  C:\Windows\System\zkotacK.exe
  2⤵
  PID:7140
- C:\Windows\System\rGsEAVn.exe
  C:\Windows\System\rGsEAVn.exe
  2⤵
  PID:4348
- C:\Windows\System\xebvDWy.exe
  C:\Windows\System\xebvDWy.exe
  2⤵
  PID:5832
- C:\Windows\System\QANMRBF.exe
  C:\Windows\System\QANMRBF.exe
  2⤵
  PID:5208
- C:\Windows\System\cGkBAiJ.exe
  C:\Windows\System\cGkBAiJ.exe
  2⤵
  PID:5768
- C:\Windows\System\RbcrzUZ.exe
  C:\Windows\System\RbcrzUZ.exe
  2⤵
  PID:6312
- C:\Windows\System\uGZKQut.exe
  C:\Windows\System\uGZKQut.exe
  2⤵
  PID:6464
- C:\Windows\System\PtJHvmT.exe
  C:\Windows\System\PtJHvmT.exe
  2⤵
  PID:4584
- C:\Windows\System\REslJIB.exe
  C:\Windows\System\REslJIB.exe
  2⤵
  PID:6640
- C:\Windows\System\SPvjAJb.exe
  C:\Windows\System\SPvjAJb.exe
  2⤵
  PID:2832
- C:\Windows\System\GXXQYEl.exe
  C:\Windows\System\GXXQYEl.exe
  2⤵
  PID:6884
- C:\Windows\System\jvqXRYc.exe
  C:\Windows\System\jvqXRYc.exe
  2⤵
  PID:6940
- C:\Windows\System\GiEdeRO.exe
  C:\Windows\System\GiEdeRO.exe
  2⤵
  PID:4820
- C:\Windows\System\VHGrxam.exe
  C:\Windows\System\VHGrxam.exe
  2⤵
  PID:6084
- C:\Windows\System\sOqHupV.exe
  C:\Windows\System\sOqHupV.exe
  2⤵
  PID:1008
- C:\Windows\System\VfdSvJG.exe
  C:\Windows\System\VfdSvJG.exe
  2⤵
  PID:5628
- C:\Windows\System\UCEVSQY.exe
  C:\Windows\System\UCEVSQY.exe
  2⤵
  PID:6440
- C:\Windows\System\lTVpmJN.exe
  C:\Windows\System\lTVpmJN.exe
  2⤵
  PID:6772
- C:\Windows\System\bJaJDIj.exe
  C:\Windows\System\bJaJDIj.exe
  2⤵
  PID:3348
- C:\Windows\System\GoWRnMd.exe
  C:\Windows\System\GoWRnMd.exe
  2⤵
  PID:7024
- C:\Windows\System\VBKcUgt.exe
  C:\Windows\System\VBKcUgt.exe
  2⤵
  PID:4968
- C:\Windows\System\gBbAKXF.exe
  C:\Windows\System\gBbAKXF.exe
  2⤵
  PID:6156
- C:\Windows\System\jbZeXdQ.exe
  C:\Windows\System\jbZeXdQ.exe
  2⤵
  PID:6860
- C:\Windows\System\hTvnHYu.exe
  C:\Windows\System\hTvnHYu.exe
  2⤵
  PID:7176
- C:\Windows\System\stmIWwe.exe
  C:\Windows\System\stmIWwe.exe
  2⤵
  PID:7224
- C:\Windows\System\XzUvgzU.exe
  C:\Windows\System\XzUvgzU.exe
  2⤵
  PID:7248
- C:\Windows\System\HPwTPkt.exe
  C:\Windows\System\HPwTPkt.exe
  2⤵
  PID:7316
- C:\Windows\System\NLaPRRn.exe
  C:\Windows\System\NLaPRRn.exe
  2⤵
  PID:7340
- C:\Windows\System\zbQEwBX.exe
  C:\Windows\System\zbQEwBX.exe
  2⤵
  PID:7380
- C:\Windows\System\aDmyIpI.exe
  C:\Windows\System\aDmyIpI.exe
  2⤵
  PID:7396
- C:\Windows\System\lDypYPk.exe
  C:\Windows\System\lDypYPk.exe
  2⤵
  PID:7424
- C:\Windows\System\mKmJVPk.exe
  C:\Windows\System\mKmJVPk.exe
  2⤵
  PID:7440
- C:\Windows\System\oqjPVTV.exe
  C:\Windows\System\oqjPVTV.exe
  2⤵
  PID:7488
- C:\Windows\System\IcBSRmO.exe
  C:\Windows\System\IcBSRmO.exe
  2⤵
  PID:7508
- C:\Windows\System\SvqciGK.exe
  C:\Windows\System\SvqciGK.exe
  2⤵
  PID:7556
- C:\Windows\System\aRPsNJv.exe
  C:\Windows\System\aRPsNJv.exe
  2⤵
  PID:7576
- C:\Windows\System\eSTPFOF.exe
  C:\Windows\System\eSTPFOF.exe
  2⤵
  PID:7600
- C:\Windows\System\cxdWEAs.exe
  C:\Windows\System\cxdWEAs.exe
  2⤵
  PID:7628
- C:\Windows\System\PpqPjpB.exe
  C:\Windows\System\PpqPjpB.exe
  2⤵
  PID:7656
- C:\Windows\System\sbVAByl.exe
  C:\Windows\System\sbVAByl.exe
  2⤵
  PID:7688
- C:\Windows\System\CarHppa.exe
  C:\Windows\System\CarHppa.exe
  2⤵
  PID:7712
- C:\Windows\System\TtJfrHq.exe
  C:\Windows\System\TtJfrHq.exe
  2⤵
  PID:7736
- C:\Windows\System\QBQymNL.exe
  C:\Windows\System\QBQymNL.exe
  2⤵
  PID:7760
- C:\Windows\System\uXNmvqN.exe
  C:\Windows\System\uXNmvqN.exe
  2⤵
  PID:7784
- C:\Windows\System\kdnAbMR.exe
  C:\Windows\System\kdnAbMR.exe
  2⤵
  PID:7820
- C:\Windows\System\KPXCqAW.exe
  C:\Windows\System\KPXCqAW.exe
  2⤵
  PID:7844
- C:\Windows\System\asYJdOB.exe
  C:\Windows\System\asYJdOB.exe
  2⤵
  PID:7864
- C:\Windows\System\IcfHdJS.exe
  C:\Windows\System\IcfHdJS.exe
  2⤵
  PID:7900
- C:\Windows\System\UOMQupX.exe
  C:\Windows\System\UOMQupX.exe
  2⤵
  PID:7928
- C:\Windows\System\tFhcjnW.exe
  C:\Windows\System\tFhcjnW.exe
  2⤵
  PID:7976
- C:\Windows\System\AHmHUWk.exe
  C:\Windows\System\AHmHUWk.exe
  2⤵
  PID:8008
- C:\Windows\System\lTMpBMe.exe
  C:\Windows\System\lTMpBMe.exe
  2⤵
  PID:8040
- C:\Windows\System\PaDqsFx.exe
  C:\Windows\System\PaDqsFx.exe
  2⤵
  PID:8056
- C:\Windows\System\tcYHrFw.exe
  C:\Windows\System\tcYHrFw.exe
  2⤵
  PID:8072
- C:\Windows\System\JVLIbQq.exe
  C:\Windows\System\JVLIbQq.exe
  2⤵
  PID:8088
- C:\Windows\System\djCjdgK.exe
  C:\Windows\System\djCjdgK.exe
  2⤵
  PID:8116
- C:\Windows\System\hAbkbPo.exe
  C:\Windows\System\hAbkbPo.exe
  2⤵
  PID:8132
- C:\Windows\System\DZVaQEt.exe
  C:\Windows\System\DZVaQEt.exe
  2⤵
  PID:8172
- C:\Windows\System\hEpbvEY.exe
  C:\Windows\System\hEpbvEY.exe
  2⤵
  PID:5036
- C:\Windows\System\hrpvFzP.exe
  C:\Windows\System\hrpvFzP.exe
  2⤵
  PID:7172
- C:\Windows\System\oDCIyaF.exe
  C:\Windows\System\oDCIyaF.exe
  2⤵
  PID:7244
- C:\Windows\System\QOFQbxa.exe
  C:\Windows\System\QOFQbxa.exe
  2⤵
  PID:7352
- C:\Windows\System\QgIrWvn.exe
  C:\Windows\System\QgIrWvn.exe
  2⤵
  PID:7416
- C:\Windows\System\qthBpCQ.exe
  C:\Windows\System\qthBpCQ.exe
  2⤵
  PID:7476
- C:\Windows\System\dliyGcW.exe
  C:\Windows\System\dliyGcW.exe
  2⤵
  PID:7528
- C:\Windows\System\DTxOjid.exe
  C:\Windows\System\DTxOjid.exe
  2⤵
  PID:7644
- C:\Windows\System\MleZfYa.exe
  C:\Windows\System\MleZfYa.exe
  2⤵
  PID:7680
- C:\Windows\System\yCDTFXX.exe
  C:\Windows\System\yCDTFXX.exe
  2⤵
  PID:7744
- C:\Windows\System\umuaASe.exe
  C:\Windows\System\umuaASe.exe
  2⤵
  PID:7836
- C:\Windows\System\oyUAFxU.exe
  C:\Windows\System\oyUAFxU.exe
  2⤵
  PID:7856
- C:\Windows\System\ISyUDvT.exe
  C:\Windows\System\ISyUDvT.exe
  2⤵
  PID:7944
- C:\Windows\System\rJytmwv.exe
  C:\Windows\System\rJytmwv.exe
  2⤵
  PID:8004
- C:\Windows\System\UCbXANq.exe
  C:\Windows\System\UCbXANq.exe
  2⤵
  PID:8108
- C:\Windows\System\OXKxctr.exe
  C:\Windows\System\OXKxctr.exe
  2⤵
  PID:8124
- C:\Windows\System\OHBcDLk.exe
  C:\Windows\System\OHBcDLk.exe
  2⤵
  PID:7000
- C:\Windows\System\TrmLowL.exe
  C:\Windows\System\TrmLowL.exe
  2⤵
  PID:7332
- C:\Windows\System\iYqKKky.exe
  C:\Windows\System\iYqKKky.exe
  2⤵
  PID:7432
- C:\Windows\System\OAxoIDo.exe
  C:\Windows\System\OAxoIDo.exe
  2⤵
  PID:7460
- C:\Windows\System\KbCGuHm.exe
  C:\Windows\System\KbCGuHm.exe
  2⤵
  PID:7652
- C:\Windows\System\EIyfuqE.exe
  C:\Windows\System\EIyfuqE.exe
  2⤵
  PID:7804
- C:\Windows\System\iRzkqrL.exe
  C:\Windows\System\iRzkqrL.exe
  2⤵
  PID:7992
- C:\Windows\System\JfJZOFd.exe
  C:\Windows\System\JfJZOFd.exe
  2⤵
  PID:6268
- C:\Windows\System\xoSKazO.exe
  C:\Windows\System\xoSKazO.exe
  2⤵
  PID:8152
- C:\Windows\System\OBOmfaL.exe
  C:\Windows\System\OBOmfaL.exe
  2⤵
  PID:7704
- C:\Windows\System\XYtgncd.exe
  C:\Windows\System\XYtgncd.exe
  2⤵
  PID:7256
- C:\Windows\System\dwhhlOB.exe
  C:\Windows\System\dwhhlOB.exe
  2⤵
  PID:8180
- C:\Windows\System\AXkQLrg.exe
  C:\Windows\System\AXkQLrg.exe
  2⤵
  PID:8200
- C:\Windows\System\BSYRZPc.exe
  C:\Windows\System\BSYRZPc.exe
  2⤵
  PID:8220
- C:\Windows\System\YuuAJSz.exe
  C:\Windows\System\YuuAJSz.exe
  2⤵
  PID:8248
- C:\Windows\System\IrQVDny.exe
  C:\Windows\System\IrQVDny.exe
  2⤵
  PID:8288
- C:\Windows\System\aalgXni.exe
  C:\Windows\System\aalgXni.exe
  2⤵
  PID:8304
- C:\Windows\System\aRLJjEy.exe
  C:\Windows\System\aRLJjEy.exe
  2⤵
  PID:8332
- C:\Windows\System\AivBkNb.exe
  C:\Windows\System\AivBkNb.exe
  2⤵
  PID:8360
- C:\Windows\System\ueJPdMc.exe
  C:\Windows\System\ueJPdMc.exe
  2⤵
  PID:8376
- C:\Windows\System\czAfoxe.exe
  C:\Windows\System\czAfoxe.exe
  2⤵
  PID:8400
- C:\Windows\System\ImmNGrV.exe
  C:\Windows\System\ImmNGrV.exe
  2⤵
  PID:8424
- C:\Windows\System\hyhmWjO.exe
  C:\Windows\System\hyhmWjO.exe
  2⤵
  PID:8452
- C:\Windows\System\QkXGJsV.exe
  C:\Windows\System\QkXGJsV.exe
  2⤵
  PID:8476
- C:\Windows\System\usriNMK.exe
  C:\Windows\System\usriNMK.exe
  2⤵
  PID:8500
- C:\Windows\System\xXnejVc.exe
  C:\Windows\System\xXnejVc.exe
  2⤵
  PID:8568
- C:\Windows\System\SQsIpNV.exe
  C:\Windows\System\SQsIpNV.exe
  2⤵
  PID:8596
- C:\Windows\System\hSpNraw.exe
  C:\Windows\System\hSpNraw.exe
  2⤵
  PID:8620
- C:\Windows\System\AERWyKM.exe
  C:\Windows\System\AERWyKM.exe
  2⤵
  PID:8640
- C:\Windows\System\DQEbcsk.exe
  C:\Windows\System\DQEbcsk.exe
  2⤵
  PID:8668
- C:\Windows\System\mtjwSIJ.exe
  C:\Windows\System\mtjwSIJ.exe
  2⤵
  PID:8688
- C:\Windows\System\lvzNrua.exe
  C:\Windows\System\lvzNrua.exe
  2⤵
  PID:8724
- C:\Windows\System\jIPMKRw.exe
  C:\Windows\System\jIPMKRw.exe
  2⤵
  PID:8764
- C:\Windows\System\ClpTuyJ.exe
  C:\Windows\System\ClpTuyJ.exe
  2⤵
  PID:8796
- C:\Windows\System\UjpsoIj.exe
  C:\Windows\System\UjpsoIj.exe
  2⤵
  PID:8812
- C:\Windows\System\lOfJTyu.exe
  C:\Windows\System\lOfJTyu.exe
  2⤵
  PID:8828
- C:\Windows\System\ZqyDfut.exe
  C:\Windows\System\ZqyDfut.exe
  2⤵
  PID:8868
- C:\Windows\System\rQtHdSK.exe
  C:\Windows\System\rQtHdSK.exe
  2⤵
  PID:8884
- C:\Windows\System\JkXwaUH.exe
  C:\Windows\System\JkXwaUH.exe
  2⤵
  PID:8904
- C:\Windows\System\wUCFEzf.exe
  C:\Windows\System\wUCFEzf.exe
  2⤵
  PID:8920
- C:\Windows\System\JsMMFbn.exe
  C:\Windows\System\JsMMFbn.exe
  2⤵
  PID:8936
- C:\Windows\System\DJmZTnL.exe
  C:\Windows\System\DJmZTnL.exe
  2⤵
  PID:8968
- C:\Windows\System\MHfaCgs.exe
  C:\Windows\System\MHfaCgs.exe
  2⤵
  PID:8988
- C:\Windows\System\BCylOUl.exe
  C:\Windows\System\BCylOUl.exe
  2⤵
  PID:9076
- C:\Windows\System\BluejpW.exe
  C:\Windows\System\BluejpW.exe
  2⤵
  PID:9100
- C:\Windows\System\kIqRONz.exe
  C:\Windows\System\kIqRONz.exe
  2⤵
  PID:9140
- C:\Windows\System\yONQIiL.exe
  C:\Windows\System\yONQIiL.exe
  2⤵
  PID:9156
- C:\Windows\System\NbTsmHL.exe
  C:\Windows\System\NbTsmHL.exe
  2⤵
  PID:9180
- C:\Windows\System\UOHLAAu.exe
  C:\Windows\System\UOHLAAu.exe
  2⤵
  PID:9212
- C:\Windows\System\KwxXjqz.exe
  C:\Windows\System\KwxXjqz.exe
  2⤵
  PID:8232
- C:\Windows\System\KGGoSLi.exe
  C:\Windows\System\KGGoSLi.exe
  2⤵
  PID:8300
- C:\Windows\System\qtVsWVI.exe
  C:\Windows\System\qtVsWVI.exe
  2⤵
  PID:8316
- C:\Windows\System\IagQEzT.exe
  C:\Windows\System\IagQEzT.exe
  2⤵
  PID:8408
- C:\Windows\System\IFeWPuD.exe
  C:\Windows\System\IFeWPuD.exe
  2⤵
  PID:8464
- C:\Windows\System\horWTcH.exe
  C:\Windows\System\horWTcH.exe
  2⤵
  PID:8560
- C:\Windows\System\svkcYMe.exe
  C:\Windows\System\svkcYMe.exe
  2⤵
  PID:8616
- C:\Windows\System\Coirppq.exe
  C:\Windows\System\Coirppq.exe
  2⤵
  PID:8652
- C:\Windows\System\jRlEhcW.exe
  C:\Windows\System\jRlEhcW.exe
  2⤵
  PID:8736
- C:\Windows\System\ppZEzwG.exe
  C:\Windows\System\ppZEzwG.exe
  2⤵
  PID:8776
- C:\Windows\System\AqHgEaB.exe
  C:\Windows\System\AqHgEaB.exe
  2⤵
  PID:8844
- C:\Windows\System\MzhELbv.exe
  C:\Windows\System\MzhELbv.exe
  2⤵
  PID:8928
- C:\Windows\System\gksBQpJ.exe
  C:\Windows\System\gksBQpJ.exe
  2⤵
  PID:8956
- C:\Windows\System\RaxrLyg.exe
  C:\Windows\System\RaxrLyg.exe
  2⤵
  PID:9008
- C:\Windows\System\DmXITTK.exe
  C:\Windows\System\DmXITTK.exe
  2⤵
  PID:9040
- C:\Windows\System\NmNYHTX.exe
  C:\Windows\System\NmNYHTX.exe
  2⤵
  PID:9128
- C:\Windows\System\OomKksc.exe
  C:\Windows\System\OomKksc.exe
  2⤵
  PID:8236
- C:\Windows\System\qKFkwIG.exe
  C:\Windows\System\qKFkwIG.exe
  2⤵
  PID:8340
- C:\Windows\System\SPEifbS.exe
  C:\Windows\System\SPEifbS.exe
  2⤵
  PID:8468
- C:\Windows\System\WOJTSJx.exe
  C:\Windows\System\WOJTSJx.exe
  2⤵
  PID:8716
- C:\Windows\System\ngYNDjT.exe
  C:\Windows\System\ngYNDjT.exe
  2⤵
  PID:8820
- C:\Windows\System\KCcGGdY.exe
  C:\Windows\System\KCcGGdY.exe
  2⤵
  PID:9032
- C:\Windows\System\UynZxCU.exe
  C:\Windows\System\UynZxCU.exe
  2⤵
  PID:9192
- C:\Windows\System\sDKnqfF.exe
  C:\Windows\System\sDKnqfF.exe
  2⤵
  PID:8700
- C:\Windows\System\koeuvzj.exe
  C:\Windows\System\koeuvzj.exe
  2⤵
  PID:8900
- C:\Windows\System\RvktxKM.exe
  C:\Windows\System\RvktxKM.exe
  2⤵
  PID:9068
- C:\Windows\System\AJvdZzD.exe
  C:\Windows\System\AJvdZzD.exe
  2⤵
  PID:9244
- C:\Windows\System\rBuUnYx.exe
  C:\Windows\System\rBuUnYx.exe
  2⤵
  PID:9272
- C:\Windows\System\GhaXdEZ.exe
  C:\Windows\System\GhaXdEZ.exe
  2⤵
  PID:9304
- C:\Windows\System\rRGfUyd.exe
  C:\Windows\System\rRGfUyd.exe
  2⤵
  PID:9336
- C:\Windows\System\ETNbspg.exe
  C:\Windows\System\ETNbspg.exe
  2⤵
  PID:9356
- C:\Windows\System\hYwuZTL.exe
  C:\Windows\System\hYwuZTL.exe
  2⤵
  PID:9384
- C:\Windows\System\dJARJSW.exe
  C:\Windows\System\dJARJSW.exe
  2⤵
  PID:9424
- C:\Windows\System\JhTohDy.exe
  C:\Windows\System\JhTohDy.exe
  2⤵
  PID:9444
- C:\Windows\System\dPrrqCp.exe
  C:\Windows\System\dPrrqCp.exe
  2⤵
  PID:9468
- C:\Windows\System\tegvQnx.exe
  C:\Windows\System\tegvQnx.exe
  2⤵
  PID:9500
- C:\Windows\System\aZAdFIt.exe
  C:\Windows\System\aZAdFIt.exe
  2⤵
  PID:9524
- C:\Windows\System\gXZfnig.exe
  C:\Windows\System\gXZfnig.exe
  2⤵
  PID:9540
- C:\Windows\System\lYKLrbE.exe
  C:\Windows\System\lYKLrbE.exe
  2⤵
  PID:9568
- C:\Windows\System\vtKISTR.exe
  C:\Windows\System\vtKISTR.exe
  2⤵
  PID:9592
- C:\Windows\System\bEWKlkm.exe
  C:\Windows\System\bEWKlkm.exe
  2⤵
  PID:9608
- C:\Windows\System\WFVGTdV.exe
  C:\Windows\System\WFVGTdV.exe
  2⤵
  PID:9624
- C:\Windows\System\VpnPyeV.exe
  C:\Windows\System\VpnPyeV.exe
  2⤵
  PID:9656
- C:\Windows\System\UgAXNeg.exe
  C:\Windows\System\UgAXNeg.exe
  2⤵
  PID:9684
- C:\Windows\System\SVNiIPK.exe
  C:\Windows\System\SVNiIPK.exe
  2⤵
  PID:9712
- C:\Windows\System\UVnsffa.exe
  C:\Windows\System\UVnsffa.exe
  2⤵
  PID:9744
- C:\Windows\System\Qkblgfs.exe
  C:\Windows\System\Qkblgfs.exe
  2⤵
  PID:9764
- C:\Windows\System\THraDeo.exe
  C:\Windows\System\THraDeo.exe
  2⤵
  PID:9844
- C:\Windows\System\MKoPxpm.exe
  C:\Windows\System\MKoPxpm.exe
  2⤵
  PID:9876
- C:\Windows\System\olYsflH.exe
  C:\Windows\System\olYsflH.exe
  2⤵
  PID:9900
- C:\Windows\System\VavrEEY.exe
  C:\Windows\System\VavrEEY.exe
  2⤵
  PID:9924
- C:\Windows\System\aKajqKa.exe
  C:\Windows\System\aKajqKa.exe
  2⤵
  PID:9952
- C:\Windows\System\ucsTwla.exe
  C:\Windows\System\ucsTwla.exe
  2⤵
  PID:9968
- C:\Windows\System\tQgrWTh.exe
  C:\Windows\System\tQgrWTh.exe
  2⤵
  PID:10004
- C:\Windows\System\ArsgcyU.exe
  C:\Windows\System\ArsgcyU.exe
  2⤵
  PID:10024
- C:\Windows\System\WprFhfJ.exe
  C:\Windows\System\WprFhfJ.exe
  2⤵
  PID:10040
- C:\Windows\System\GFeMZGl.exe
  C:\Windows\System\GFeMZGl.exe
  2⤵
  PID:10068
- C:\Windows\System\gkpYflP.exe
  C:\Windows\System\gkpYflP.exe
  2⤵
  PID:10100
- C:\Windows\System\LBEWaRn.exe
  C:\Windows\System\LBEWaRn.exe
  2⤵
  PID:10128
- C:\Windows\System\OOAYsmH.exe
  C:\Windows\System\OOAYsmH.exe
  2⤵
  PID:10152
- C:\Windows\System\fhXgxNo.exe
  C:\Windows\System\fhXgxNo.exe
  2⤵
  PID:10216
- C:\Windows\System\uFquikA.exe
  C:\Windows\System\uFquikA.exe
  2⤵
  PID:10236
- C:\Windows\System\ssfSaME.exe
  C:\Windows\System\ssfSaME.exe
  2⤵
  PID:8516
- C:\Windows\System\zLrbDts.exe
  C:\Windows\System\zLrbDts.exe
  2⤵
  PID:9288
- C:\Windows\System\QPRIVoX.exe
  C:\Windows\System\QPRIVoX.exe
  2⤵
  PID:9352
- C:\Windows\System\vViMxpX.exe
  C:\Windows\System\vViMxpX.exe
  2⤵
  PID:9404
- C:\Windows\System\SrZvtNo.exe
  C:\Windows\System\SrZvtNo.exe
  2⤵
  PID:9436
- C:\Windows\System\TlyHLmV.exe
  C:\Windows\System\TlyHLmV.exe
  2⤵
  PID:9532
- C:\Windows\System\GsYFXwI.exe
  C:\Windows\System\GsYFXwI.exe
  2⤵
  PID:9580
- C:\Windows\System\rMzdMbS.exe
  C:\Windows\System\rMzdMbS.exe
  2⤵
  PID:9652
- C:\Windows\System\gTnmzQO.exe
  C:\Windows\System\gTnmzQO.exe
  2⤵
  PID:9776
- C:\Windows\System\tvnWSrV.exe
  C:\Windows\System\tvnWSrV.exe
  2⤵
  PID:9852
- C:\Windows\System\OeRQdRT.exe
  C:\Windows\System\OeRQdRT.exe
  2⤵
  PID:9936
- C:\Windows\System\XcNflfp.exe
  C:\Windows\System\XcNflfp.exe
  2⤵
  PID:10016
- C:\Windows\System\DQBjrji.exe
  C:\Windows\System\DQBjrji.exe
  2⤵
  PID:10088
- C:\Windows\System\DHzPuXn.exe
  C:\Windows\System\DHzPuXn.exe
  2⤵
  PID:10084
- C:\Windows\System\VnvZcTn.exe
  C:\Windows\System\VnvZcTn.exe
  2⤵
  PID:10168
- C:\Windows\System\wzuDOfj.exe
  C:\Windows\System\wzuDOfj.exe
  2⤵
  PID:8240
- C:\Windows\System\YBxIwGk.exe
  C:\Windows\System\YBxIwGk.exe
  2⤵
  PID:9268
- C:\Windows\System\ZgRIWKI.exe
  C:\Windows\System\ZgRIWKI.exe
  2⤵
  PID:9440
- C:\Windows\System\fncHbnV.exe
  C:\Windows\System\fncHbnV.exe
  2⤵
  PID:9516
- C:\Windows\System\GABnYSw.exe
  C:\Windows\System\GABnYSw.exe
  2⤵
  PID:9756
- C:\Windows\System\TABwWjG.exe
  C:\Windows\System\TABwWjG.exe
  2⤵
  PID:9888
- C:\Windows\System\oHTPOLM.exe
  C:\Windows\System\oHTPOLM.exe
  2⤵
  PID:10196
- C:\Windows\System\OUEwTjQ.exe
  C:\Windows\System\OUEwTjQ.exe
  2⤵
  PID:8356
- C:\Windows\System\xtxKecu.exe
  C:\Windows\System\xtxKecu.exe
  2⤵
  PID:9676
- C:\Windows\System\cdWiWRa.exe
  C:\Windows\System\cdWiWRa.exe
  2⤵
  PID:9960
- C:\Windows\System\XFzZNan.exe
  C:\Windows\System\XFzZNan.exe
  2⤵
  PID:9456
- C:\Windows\System\EAYorEX.exe
  C:\Windows\System\EAYorEX.exe
  2⤵
  PID:10244
- C:\Windows\System\oCUSZZx.exe
  C:\Windows\System\oCUSZZx.exe
  2⤵
  PID:10264
- C:\Windows\System\tPUcRFK.exe
  C:\Windows\System\tPUcRFK.exe
  2⤵
  PID:10284
- C:\Windows\System\gFbGcZr.exe
  C:\Windows\System\gFbGcZr.exe
  2⤵
  PID:10312
- C:\Windows\System\vsKGLel.exe
  C:\Windows\System\vsKGLel.exe
  2⤵
  PID:10344
- C:\Windows\System\zCtdwbw.exe
  C:\Windows\System\zCtdwbw.exe
  2⤵
  PID:10380
- C:\Windows\System\RCLWItZ.exe
  C:\Windows\System\RCLWItZ.exe
  2⤵
  PID:10408
- C:\Windows\System\oJMNpJW.exe
  C:\Windows\System\oJMNpJW.exe
  2⤵
  PID:10452
- C:\Windows\System\mKfgYBb.exe
  C:\Windows\System\mKfgYBb.exe
  2⤵
  PID:10468
- C:\Windows\System\jnEPhyA.exe
  C:\Windows\System\jnEPhyA.exe
  2⤵
  PID:10496
- C:\Windows\System\bdUdjgL.exe
  C:\Windows\System\bdUdjgL.exe
  2⤵
  PID:10524
- C:\Windows\System\lmUNwlE.exe
  C:\Windows\System\lmUNwlE.exe
  2⤵
  PID:10540
- C:\Windows\System\AQLOSHc.exe
  C:\Windows\System\AQLOSHc.exe
  2⤵
  PID:10556
- C:\Windows\System\xaZvQdf.exe
  C:\Windows\System\xaZvQdf.exe
  2⤵
  PID:10584
- C:\Windows\System\FgfcvXW.exe
  C:\Windows\System\FgfcvXW.exe
  2⤵
  PID:10608
- C:\Windows\System\UJirhUY.exe
  C:\Windows\System\UJirhUY.exe
  2⤵
  PID:10640
- C:\Windows\System\XxMVzLt.exe
  C:\Windows\System\XxMVzLt.exe
  2⤵
  PID:10676
- C:\Windows\System\HRgNDvU.exe
  C:\Windows\System\HRgNDvU.exe
  2⤵
  PID:10700
- C:\Windows\System\WSZHdHX.exe
  C:\Windows\System\WSZHdHX.exe
  2⤵
  PID:10724
- C:\Windows\System\dGKklit.exe
  C:\Windows\System\dGKklit.exe
  2⤵
  PID:10752
- C:\Windows\System\txnfXkD.exe
  C:\Windows\System\txnfXkD.exe
  2⤵
  PID:10784
- C:\Windows\System\kfyLsFb.exe
  C:\Windows\System\kfyLsFb.exe
  2⤵
  PID:10804
- C:\Windows\System\fBnNgVN.exe
  C:\Windows\System\fBnNgVN.exe
  2⤵
  PID:10828
- C:\Windows\System\jyYhnOn.exe
  C:\Windows\System\jyYhnOn.exe
  2⤵
  PID:10860
- C:\Windows\System\UbbahoR.exe
  C:\Windows\System\UbbahoR.exe
  2⤵
  PID:10912
- C:\Windows\System\ledVMYf.exe
  C:\Windows\System\ledVMYf.exe
  2⤵
  PID:10940
- C:\Windows\System\oLWQdWa.exe
  C:\Windows\System\oLWQdWa.exe
  2⤵
  PID:10960
- C:\Windows\System\hAGTMpw.exe
  C:\Windows\System\hAGTMpw.exe
  2⤵
  PID:10984
- C:\Windows\System\KMMYohB.exe
  C:\Windows\System\KMMYohB.exe
  2⤵
  PID:11012
- C:\Windows\System\bNQMWNn.exe
  C:\Windows\System\bNQMWNn.exe
  2⤵
  PID:11032
- C:\Windows\System\cisfmKD.exe
  C:\Windows\System\cisfmKD.exe
  2⤵
  PID:11056
- C:\Windows\System\aZzHjEu.exe
  C:\Windows\System\aZzHjEu.exe
  2⤵
  PID:11088
- C:\Windows\System\zSWqEJd.exe
  C:\Windows\System\zSWqEJd.exe
  2⤵
  PID:11136
- C:\Windows\System\tVcyyDI.exe
  C:\Windows\System\tVcyyDI.exe
  2⤵
  PID:11172
- C:\Windows\System\fiQuSPf.exe
  C:\Windows\System\fiQuSPf.exe
  2⤵
  PID:11204
- C:\Windows\System\KcwUorS.exe
  C:\Windows\System\KcwUorS.exe
  2⤵
  PID:11228
- C:\Windows\System\iltvviU.exe
  C:\Windows\System\iltvviU.exe
  2⤵
  PID:11256
- C:\Windows\System\EfrbzGq.exe
  C:\Windows\System\EfrbzGq.exe
  2⤵
  PID:10280
- C:\Windows\System\ftAxkOh.exe
  C:\Windows\System\ftAxkOh.exe
  2⤵
  PID:10332
- C:\Windows\System\GxjEYTZ.exe
  C:\Windows\System\GxjEYTZ.exe
  2⤵
  PID:10360
- C:\Windows\System\kjwZAyF.exe
  C:\Windows\System\kjwZAyF.exe
  2⤵
  PID:10424
- C:\Windows\System\EzEeeam.exe
  C:\Windows\System\EzEeeam.exe
  2⤵
  PID:10568
- C:\Windows\System\kVkklRF.exe
  C:\Windows\System\kVkklRF.exe
  2⤵
  PID:10572
- C:\Windows\System\Defplaf.exe
  C:\Windows\System\Defplaf.exe
  2⤵
  PID:10636
- C:\Windows\System\FCsIZkl.exe
  C:\Windows\System\FCsIZkl.exe
  2⤵
  PID:10692
- C:\Windows\System\viuWWyi.exe
  C:\Windows\System\viuWWyi.exe
  2⤵
  PID:10772
- C:\Windows\System\FTwiEZK.exe
  C:\Windows\System\FTwiEZK.exe
  2⤵
  PID:10760
- C:\Windows\System\sptRcOn.exe
  C:\Windows\System\sptRcOn.exe
  2⤵
  PID:10840
- C:\Windows\System\vVRiiyI.exe
  C:\Windows\System\vVRiiyI.exe
  2⤵
  PID:10932
- C:\Windows\System\WeimArU.exe
  C:\Windows\System\WeimArU.exe
  2⤵
  PID:10972
- C:\Windows\System\vzrZCzJ.exe
  C:\Windows\System\vzrZCzJ.exe
  2⤵
  PID:11004
- C:\Windows\System\HoBBWut.exe
  C:\Windows\System\HoBBWut.exe
  2⤵
  PID:11224
- C:\Windows\System\OBDhmiP.exe
  C:\Windows\System\OBDhmiP.exe
  2⤵
  PID:10252
- C:\Windows\System\ZiKAivH.exe
  C:\Windows\System\ZiKAivH.exe
  2⤵
  PID:10392
- C:\Windows\System\ZsMcLzJ.exe
  C:\Windows\System\ZsMcLzJ.exe
  2⤵
  PID:10508
- C:\Windows\System\BTrtHqh.exe
  C:\Windows\System\BTrtHqh.exe
  2⤵
  PID:10628
- C:\Windows\System\mvenLyI.exe
  C:\Windows\System\mvenLyI.exe
  2⤵
  PID:10892
- C:\Windows\System\flSmeax.exe
  C:\Windows\System\flSmeax.exe
  2⤵
  PID:10952
- C:\Windows\System\PKmoaun.exe
  C:\Windows\System\PKmoaun.exe
  2⤵
  PID:11160
- C:\Windows\System\YZQyzAV.exe
  C:\Windows\System\YZQyzAV.exe
  2⤵
  PID:11240
- C:\Windows\System\pMZLYUI.exe
  C:\Windows\System\pMZLYUI.exe
  2⤵
  PID:10820
- C:\Windows\System\WNVVmSp.exe
  C:\Windows\System\WNVVmSp.exe
  2⤵
  PID:10720
- C:\Windows\System\XXOMNyf.exe
  C:\Windows\System\XXOMNyf.exe
  2⤵
  PID:10256
- C:\Windows\System\trGcOGr.exe
  C:\Windows\System\trGcOGr.exe
  2⤵
  PID:10716
- C:\Windows\System\Xulhbpt.exe
  C:\Windows\System\Xulhbpt.exe
  2⤵
  PID:11304
- C:\Windows\System\PghJyvb.exe
  C:\Windows\System\PghJyvb.exe
  2⤵
  PID:11332
- C:\Windows\System\EvcBdOi.exe
  C:\Windows\System\EvcBdOi.exe
  2⤵
  PID:11352
- C:\Windows\System\TGgAZFm.exe
  C:\Windows\System\TGgAZFm.exe
  2⤵
  PID:11376
- C:\Windows\System\syTqEyd.exe
  C:\Windows\System\syTqEyd.exe
  2⤵
  PID:11412
- C:\Windows\System\OQbtnPp.exe
  C:\Windows\System\OQbtnPp.exe
  2⤵
  PID:11444
- C:\Windows\System\KgKpxec.exe
  C:\Windows\System\KgKpxec.exe
  2⤵
  PID:11464
- C:\Windows\System\jipcsQc.exe
  C:\Windows\System\jipcsQc.exe
  2⤵
  PID:11484
- C:\Windows\System\mtmGGKh.exe
  C:\Windows\System\mtmGGKh.exe
  2⤵
  PID:11524
- C:\Windows\System\MdOmvvl.exe
  C:\Windows\System\MdOmvvl.exe
  2⤵
  PID:11548
- C:\Windows\System\atMxVxa.exe
  C:\Windows\System\atMxVxa.exe
  2⤵
  PID:11568
- C:\Windows\System\CQLfFmN.exe
  C:\Windows\System\CQLfFmN.exe
  2⤵
  PID:11592
- C:\Windows\System\rDHkxrW.exe
  C:\Windows\System\rDHkxrW.exe
  2⤵
  PID:11620
- C:\Windows\System\xHnVtEP.exe
  C:\Windows\System\xHnVtEP.exe
  2⤵
  PID:11648
- C:\Windows\System\OXUVidv.exe
  C:\Windows\System\OXUVidv.exe
  2⤵
  PID:11668
- C:\Windows\System\RVvLaWt.exe
  C:\Windows\System\RVvLaWt.exe
  2⤵
  PID:11692
- C:\Windows\System\ZplfFWd.exe
  C:\Windows\System\ZplfFWd.exe
  2⤵
  PID:11716
- C:\Windows\System\AKPZCrp.exe
  C:\Windows\System\AKPZCrp.exe
  2⤵
  PID:11744
- C:\Windows\System\OgahgvX.exe
  C:\Windows\System\OgahgvX.exe
  2⤵
  PID:11768
- C:\Windows\System\lusapdv.exe
  C:\Windows\System\lusapdv.exe
  2⤵
  PID:11784
- C:\Windows\System\caWgsqc.exe
  C:\Windows\System\caWgsqc.exe
  2⤵
  PID:11832
- C:\Windows\System\CGYIefi.exe
  C:\Windows\System\CGYIefi.exe
  2⤵
  PID:11852
- C:\Windows\System\WaBpWYe.exe
  C:\Windows\System\WaBpWYe.exe
  2⤵
  PID:11876
- C:\Windows\System\zsutZWB.exe
  C:\Windows\System\zsutZWB.exe
  2⤵
  PID:11916
- C:\Windows\System\uLgTgPk.exe
  C:\Windows\System\uLgTgPk.exe
  2⤵
  PID:11960
- C:\Windows\System\hfqbHEa.exe
  C:\Windows\System\hfqbHEa.exe
  2⤵
  PID:11976
- C:\Windows\System\RKEnjba.exe
  C:\Windows\System\RKEnjba.exe
  2⤵
  PID:12004
- C:\Windows\System\mPtNXMb.exe
  C:\Windows\System\mPtNXMb.exe
  2⤵
  PID:12036
- C:\Windows\System\ZwlKTXm.exe
  C:\Windows\System\ZwlKTXm.exe
  2⤵
  PID:12088
- C:\Windows\System\TAAgWWX.exe
  C:\Windows\System\TAAgWWX.exe
  2⤵
  PID:12104
- C:\Windows\System\HgUTenG.exe
  C:\Windows\System\HgUTenG.exe
  2⤵
  PID:12128
- C:\Windows\System\fxsinXa.exe
  C:\Windows\System\fxsinXa.exe
  2⤵
  PID:12152
- C:\Windows\System\fZRCWwt.exe
  C:\Windows\System\fZRCWwt.exe
  2⤵
  PID:12188
- C:\Windows\System\mdQAnnN.exe
  C:\Windows\System\mdQAnnN.exe
  2⤵
  PID:12228
- C:\Windows\System\ZBEtOIz.exe
  C:\Windows\System\ZBEtOIz.exe
  2⤵
  PID:12244
- C:\Windows\System\RgIaVrK.exe
  C:\Windows\System\RgIaVrK.exe
  2⤵
  PID:12272
- C:\Windows\System\lxsnSVH.exe
  C:\Windows\System\lxsnSVH.exe
  2⤵
  PID:10924
- C:\Windows\System\vGOzBcl.exe
  C:\Windows\System\vGOzBcl.exe
  2⤵
  PID:11320
- C:\Windows\System\aVyZhWI.exe
  C:\Windows\System\aVyZhWI.exe
  2⤵
  PID:11432
- C:\Windows\System\RWtyEQx.exe
  C:\Windows\System\RWtyEQx.exe
  2⤵
  PID:11472
- C:\Windows\System\LAzYHYL.exe
  C:\Windows\System\LAzYHYL.exe
  2⤵
  PID:11628
- C:\Windows\System\GBfMVEd.exe
  C:\Windows\System\GBfMVEd.exe
  2⤵
  PID:11584
- C:\Windows\System\Qqxgcwn.exe
  C:\Windows\System\Qqxgcwn.exe
  2⤵
  PID:11684
- C:\Windows\System\WBAWYZP.exe
  C:\Windows\System\WBAWYZP.exe
  2⤵
  PID:11764
- C:\Windows\System\rtgUtNw.exe
  C:\Windows\System\rtgUtNw.exe
  2⤵
  PID:11804
- C:\Windows\System\iRkxvoe.exe
  C:\Windows\System\iRkxvoe.exe
  2⤵
  PID:11868
- C:\Windows\System\hSqiIYs.exe
  C:\Windows\System\hSqiIYs.exe
  2⤵
  PID:11940
- C:\Windows\System\LWpVkHY.exe
  C:\Windows\System\LWpVkHY.exe
  2⤵
  PID:11992
- C:\Windows\System\OFkrKSr.exe
  C:\Windows\System\OFkrKSr.exe
  2⤵
  PID:12096
- C:\Windows\System\hYYOhiB.exe
  C:\Windows\System\hYYOhiB.exe
  2⤵
  PID:12184
- C:\Windows\System\mgTBdfp.exe
  C:\Windows\System\mgTBdfp.exe
  2⤵
  PID:12208
- C:\Windows\System\KiOpeOQ.exe
  C:\Windows\System\KiOpeOQ.exe
  2⤵
  PID:12268
- C:\Windows\System\rfxCSET.exe
  C:\Windows\System\rfxCSET.exe
  2⤵
  PID:11508
- C:\Windows\System\wyCRhrU.exe
  C:\Windows\System\wyCRhrU.exe
  2⤵
  PID:11480
- C:\Windows\System\incJgxp.exe
  C:\Windows\System\incJgxp.exe
  2⤵
  PID:11760
- C:\Windows\System\mYOLuTc.exe
  C:\Windows\System\mYOLuTc.exe
  2⤵
  PID:11776
- C:\Windows\System\nmHyKYc.exe
  C:\Windows\System\nmHyKYc.exe
  2⤵
  PID:12124
- C:\Windows\System\HWcrPry.exe
  C:\Windows\System\HWcrPry.exe
  2⤵
  PID:12160
- C:\Windows\System\ZuZXdBi.exe
  C:\Windows\System\ZuZXdBi.exe
  2⤵
  PID:12224
- C:\Windows\System\qponvtP.exe
  C:\Windows\System\qponvtP.exe
  2⤵
  PID:11368
- C:\Windows\System\lPLbsHA.exe
  C:\Windows\System\lPLbsHA.exe
  2⤵
  PID:12064
- C:\Windows\System\lzguend.exe
  C:\Windows\System\lzguend.exe
  2⤵
  PID:11324
- C:\Windows\System\DVrmuVM.exe
  C:\Windows\System\DVrmuVM.exe
  2⤵
  PID:11944
- C:\Windows\System\ItWblfn.exe
  C:\Windows\System\ItWblfn.exe
  2⤵
  PID:12308
- C:\Windows\System\gaSVsNs.exe
  C:\Windows\System\gaSVsNs.exe
  2⤵
  PID:12332
- C:\Windows\System\eqscqFb.exe
  C:\Windows\System\eqscqFb.exe
  2⤵
  PID:12356
- C:\Windows\System\ScMhaHv.exe
  C:\Windows\System\ScMhaHv.exe
  2⤵
  PID:12380
- C:\Windows\System\AxLIGZi.exe
  C:\Windows\System\AxLIGZi.exe
  2⤵
  PID:12408
- C:\Windows\System\ZUcGrIr.exe
  C:\Windows\System\ZUcGrIr.exe
  2⤵
  PID:12444
- C:\Windows\System\PoEonny.exe
  C:\Windows\System\PoEonny.exe
  2⤵
  PID:12504
- C:\Windows\System\rfrxQVn.exe
  C:\Windows\System\rfrxQVn.exe
  2⤵
  PID:12520
- C:\Windows\System\KnDMgpG.exe
  C:\Windows\System\KnDMgpG.exe
  2⤵
  PID:12540
- C:\Windows\System\nlzWpMk.exe
  C:\Windows\System\nlzWpMk.exe
  2⤵
  PID:12588
- C:\Windows\System\WzCCXKR.exe
  C:\Windows\System\WzCCXKR.exe
  2⤵
  PID:12608
- C:\Windows\System\PGAJiGn.exe
  C:\Windows\System\PGAJiGn.exe
  2⤵
  PID:12632
- C:\Windows\System\SYWHdbb.exe
  C:\Windows\System\SYWHdbb.exe
  2⤵
  PID:12660
- C:\Windows\System\BhImmtz.exe
  C:\Windows\System\BhImmtz.exe
  2⤵
  PID:12684
- C:\Windows\System\ShleTDs.exe
  C:\Windows\System\ShleTDs.exe
  2⤵
  PID:12708
- C:\Windows\System\DPaoWpf.exe
  C:\Windows\System\DPaoWpf.exe
  2⤵
  PID:12732
- C:\Windows\System\iYhfCKi.exe
  C:\Windows\System\iYhfCKi.exe
  2⤵
  PID:12772
- C:\Windows\System\VWRDUMS.exe
  C:\Windows\System\VWRDUMS.exe
  2⤵
  PID:12792
- C:\Windows\System\tKkpSgq.exe
  C:\Windows\System\tKkpSgq.exe
  2⤵
  PID:12824
- C:\Windows\System\QMOzznf.exe
  C:\Windows\System\QMOzznf.exe
  2⤵
  PID:12848
- C:\Windows\System\KIowUUT.exe
  C:\Windows\System\KIowUUT.exe
  2⤵
  PID:12888
- C:\Windows\System\DZyhXyX.exe
  C:\Windows\System\DZyhXyX.exe
  2⤵
  PID:12904
- C:\Windows\System\HURfMRZ.exe
  C:\Windows\System\HURfMRZ.exe
  2⤵
  PID:12928
- C:\Windows\System\BOEiupO.exe
  C:\Windows\System\BOEiupO.exe
  2⤵
  PID:12968
- C:\Windows\System\UJqBFhS.exe
  C:\Windows\System\UJqBFhS.exe
  2⤵
  PID:12992
- C:\Windows\System\yIEzYmx.exe
  C:\Windows\System\yIEzYmx.exe
  2⤵
  PID:13012
- C:\Windows\System\GothVvk.exe
  C:\Windows\System\GothVvk.exe
  2⤵
  PID:13036
- C:\Windows\System\QbdJoYP.exe
  C:\Windows\System\QbdJoYP.exe
  2⤵
  PID:13064
- C:\Windows\System\xgbSNzw.exe
  C:\Windows\System\xgbSNzw.exe
  2⤵
  PID:13088
- C:\Windows\System\obAwrWj.exe
  C:\Windows\System\obAwrWj.exe
  2⤵
  PID:13120
- C:\Windows\System\QZSbKMb.exe
  C:\Windows\System\QZSbKMb.exe
  2⤵
  PID:13168
- C:\Windows\System\jamIUeg.exe
  C:\Windows\System\jamIUeg.exe
  2⤵
  PID:13184
- C:\Windows\System\EArmRzm.exe
  C:\Windows\System\EArmRzm.exe
  2⤵
  PID:13200
- C:\Windows\System\VZvRMiy.exe
  C:\Windows\System\VZvRMiy.exe
  2⤵
  PID:13224
- C:\Windows\System\XJdjyFI.exe
  C:\Windows\System\XJdjyFI.exe
  2⤵
  PID:13244
- C:\Windows\System\ahranwN.exe
  C:\Windows\System\ahranwN.exe
  2⤵
  PID:13292
- C:\Windows\System\hScAezS.exe
  C:\Windows\System\hScAezS.exe
  2⤵
  PID:12284
- C:\Windows\System\sdAQQJt.exe
  C:\Windows\System\sdAQQJt.exe
  2⤵
  PID:12328
- C:\Windows\System\xSpVeeV.exe
  C:\Windows\System\xSpVeeV.exe
  2⤵
  PID:12348
- C:\Windows\System\FdRlYYu.exe
  C:\Windows\System\FdRlYYu.exe
  2⤵
  PID:12464
- C:\Windows\System\VSAQlJA.exe
  C:\Windows\System\VSAQlJA.exe
  2⤵
  PID:12528
- C:\Windows\System\McQFJxn.exe
  C:\Windows\System\McQFJxn.exe
  2⤵
  PID:12568
- C:\Windows\System\ILHOqTv.exe
  C:\Windows\System\ILHOqTv.exe
  2⤵
  PID:12700
- C:\Windows\System\XImPInW.exe
  C:\Windows\System\XImPInW.exe
  2⤵
  PID:12728
- C:\Windows\System\LJQtOzr.exe
  C:\Windows\System\LJQtOzr.exe
  2⤵
  PID:12800
- C:\Windows\System\mzucrov.exe
  C:\Windows\System\mzucrov.exe
  2⤵
  PID:12952
- C:\Windows\System\aWmIMvo.exe
  C:\Windows\System\aWmIMvo.exe
  2⤵
  PID:12920
- C:\Windows\System\mZpKplW.exe
  C:\Windows\System\mZpKplW.exe
  2⤵
  PID:13028
- C:\Windows\System\uMmmLqI.exe
  C:\Windows\System\uMmmLqI.exe
  2⤵
  PID:13060
- C:\Windows\System\DnKTbOO.exe
  C:\Windows\System\DnKTbOO.exe
  2⤵
  PID:13148
- C:\Windows\System\oeHyJOm.exe
  C:\Windows\System\oeHyJOm.exe
  2⤵
  PID:13196
- C:\Windows\System\nfDIlex.exe
  C:\Windows\System\nfDIlex.exe
  2⤵
  PID:13240
- C:\Windows\System\DiaQVYw.exe
  C:\Windows\System\DiaQVYw.exe
  2⤵
  PID:12172
- C:\Windows\System\IxPsUaa.exe
  C:\Windows\System\IxPsUaa.exe
  2⤵
  PID:12400
- C:\Windows\System\OAwrdey.exe
  C:\Windows\System\OAwrdey.exe
  2⤵
  PID:12572
- C:\Windows\System\vxmCnJs.exe
  C:\Windows\System\vxmCnJs.exe
  2⤵
  PID:12620
- C:\Windows\System\WCGervn.exe
  C:\Windows\System\WCGervn.exe
  2⤵
  PID:12916
- C:\Windows\System\mNHbyDd.exe
  C:\Windows\System\mNHbyDd.exe
  2⤵
  PID:13056
- C:\Windows\System\omLnlaK.exe
  C:\Windows\System\omLnlaK.exe
  2⤵
  PID:13104
- C:\Windows\System\psAAdgV.exe
  C:\Windows\System\psAAdgV.exe
  2⤵
  PID:13192
- C:\Windows\System\iHMXQmO.exe
  C:\Windows\System\iHMXQmO.exe
  2⤵
  PID:12480
- C:\Windows\System\IyqEJnu.exe
  C:\Windows\System\IyqEJnu.exe
  2⤵
  PID:13080
- C:\Windows\System\eqqKTQS.exe
  C:\Windows\System\eqqKTQS.exe
  2⤵
  PID:12548
- C:\Windows\System\rLxxRJj.exe
  C:\Windows\System\rLxxRJj.exe
  2⤵
  PID:13324
- C:\Windows\System\TqDzyOm.exe
  C:\Windows\System\TqDzyOm.exe
  2⤵
  PID:13356
- C:\Windows\System\GfinQNk.exe
  C:\Windows\System\GfinQNk.exe
  2⤵
  PID:13376
- C:\Windows\System\dAUnQSm.exe
  C:\Windows\System\dAUnQSm.exe
  2⤵
  PID:13400
- C:\Windows\System\hDijCop.exe
  C:\Windows\System\hDijCop.exe
  2⤵
  PID:13420
- C:\Windows\System\vmGmyNH.exe
  C:\Windows\System\vmGmyNH.exe
  2⤵
  PID:13448
- C:\Windows\System\PBffvLl.exe
  C:\Windows\System\PBffvLl.exe
  2⤵
  PID:13492
- C:\Windows\System\aJxSfqB.exe
  C:\Windows\System\aJxSfqB.exe
  2⤵
  PID:13544
- C:\Windows\System\ANIpCZt.exe
  C:\Windows\System\ANIpCZt.exe
  2⤵
  PID:13560
- C:\Windows\System\tQqJjoO.exe
  C:\Windows\System\tQqJjoO.exe
  2⤵
  PID:13588
- C:\Windows\System\rQYFotE.exe
  C:\Windows\System\rQYFotE.exe
  2⤵
  PID:13604
- C:\Windows\System\zQWPlih.exe
  C:\Windows\System\zQWPlih.exe
  2⤵
  PID:13628
- C:\Windows\System\PRaDojU.exe
  C:\Windows\System\PRaDojU.exe
  2⤵
  PID:13672
- C:\Windows\System\cBrpWjv.exe
  C:\Windows\System\cBrpWjv.exe
  2⤵
  PID:13688
- C:\Windows\System\gSKIJdw.exe
  C:\Windows\System\gSKIJdw.exe
  2⤵
  PID:13712
- C:\Windows\System\aZaWEFL.exe
  C:\Windows\System\aZaWEFL.exe
  2⤵
  PID:13740
- C:\Windows\System\cVSmFTW.exe
  C:\Windows\System\cVSmFTW.exe
  2⤵
  PID:13760
- C:\Windows\System\rsIUwEe.exe
  C:\Windows\System\rsIUwEe.exe
  2⤵
  PID:13808
- C:\Windows\System\kAZqGuM.exe
  C:\Windows\System\kAZqGuM.exe
  2⤵
  PID:13832
- C:\Windows\System\yNKtRXW.exe
  C:\Windows\System\yNKtRXW.exe
  2⤵
  PID:13860
- C:\Windows\System\chpjPOo.exe
  C:\Windows\System\chpjPOo.exe
  2⤵
  PID:13880
- C:\Windows\System\yLbQwfo.exe
  C:\Windows\System\yLbQwfo.exe
  2⤵
  PID:13904
- C:\Windows\System\DVDLlkt.exe
  C:\Windows\System\DVDLlkt.exe
  2⤵
  PID:13960
- C:\Windows\System\BiFRpqW.exe
  C:\Windows\System\BiFRpqW.exe
  2⤵
  PID:13976
- C:\Windows\System\kGrYdwo.exe
  C:\Windows\System\kGrYdwo.exe
  2⤵
  PID:13996
- C:\Windows\System\ALyunZj.exe
  C:\Windows\System\ALyunZj.exe
  2⤵
  PID:14024
- C:\Windows\System\UWESULa.exe
  C:\Windows\System\UWESULa.exe
  2⤵
  PID:14052
- C:\Windows\System\GQBMsKS.exe
  C:\Windows\System\GQBMsKS.exe
  2⤵
  PID:14084
- C:\Windows\System\thVeKZM.exe
  C:\Windows\System\thVeKZM.exe
  2⤵
  PID:14108
- C:\Windows\System\evEhsVF.exe
  C:\Windows\System\evEhsVF.exe
  2⤵
  PID:14128
- C:\Windows\System\UtHbqkA.exe
  C:\Windows\System\UtHbqkA.exe
  2⤵
  PID:14152
- C:\Windows\System\hvUQvFh.exe
  C:\Windows\System\hvUQvFh.exe
  2⤵
  PID:14180
- C:\Windows\System\vEJxknp.exe
  C:\Windows\System\vEJxknp.exe
  2⤵
  PID:14216
- C:\Windows\System\mvySNdw.exe
  C:\Windows\System\mvySNdw.exe
  2⤵
  PID:14240
- C:\Windows\System\IbpfTPV.exe
  C:\Windows\System\IbpfTPV.exe
  2⤵
  PID:14260
- C:\Windows\System\QgXfLEb.exe
  C:\Windows\System\QgXfLEb.exe
  2⤵
  PID:14296
- C:\Windows\System\sPVNrVw.exe
  C:\Windows\System\sPVNrVw.exe
  2⤵
  PID:14316
- C:\Windows\System\fxezzfE.exe
  C:\Windows\System\fxezzfE.exe
  2⤵
  PID:12868
- C:\Windows\System\wBylckX.exe
  C:\Windows\System\wBylckX.exe
  2⤵
  PID:13344
- C:\Windows\System\WYnKMXa.exe
  C:\Windows\System\WYnKMXa.exe
  2⤵
  PID:13432
- C:\Windows\System\YBNCMbo.exe
  C:\Windows\System\YBNCMbo.exe
  2⤵
  PID:13476
- C:\Windows\System\QXPLRhC.exe
  C:\Windows\System\QXPLRhC.exe
  2⤵
  PID:13616
- C:\Windows\System\OFkFcWs.exe
  C:\Windows\System\OFkFcWs.exe
  2⤵
  PID:13728
- C:\Windows\System\xYohFog.exe
  C:\Windows\System\xYohFog.exe
  2⤵
  PID:13708
- C:\Windows\System\fImEvpa.exe
  C:\Windows\System\fImEvpa.exe
  2⤵
  PID:13788
- C:\Windows\System\JrnHRqR.exe
  C:\Windows\System\JrnHRqR.exe
  2⤵
  PID:13844
- C:\Windows\System\MYduUEd.exe
  C:\Windows\System\MYduUEd.exe
  2⤵
  PID:13868
- C:\Windows\System\xJalqBP.exe
  C:\Windows\System\xJalqBP.exe
  2⤵
  PID:14008
- C:\Windows\System\LvNkBfD.exe
  C:\Windows\System\LvNkBfD.exe
  2⤵
  PID:14120
- C:\Windows\System\BsvrkGb.exe
  C:\Windows\System\BsvrkGb.exe
  2⤵
  PID:14068
- C:\Windows\System\iCrdvOT.exe
  C:\Windows\System\iCrdvOT.exe
  2⤵
  PID:14148
- C:\Windows\System\HTkvCXZ.exe
  C:\Windows\System\HTkvCXZ.exe
  2⤵
  PID:14232
- C:\Windows\System\mjqlMyr.exe
  C:\Windows\System\mjqlMyr.exe
  2⤵
  PID:14276
- C:\Windows\System\ZUtNRvN.exe
  C:\Windows\System\ZUtNRvN.exe
  2⤵
  PID:13164
- C:\Windows\System\OufiJPw.exe
  C:\Windows\System\OufiJPw.exe
  2⤵
  PID:13520
- C:\Windows\System\prKFdtG.exe
  C:\Windows\System\prKFdtG.exe
  2⤵
  PID:13620
- C:\Windows\System\UyMswvP.exe
  C:\Windows\System\UyMswvP.exe
  2⤵
  PID:13828
- C:\Windows\System\CPzFCTd.exe
  C:\Windows\System\CPzFCTd.exe
  2⤵
  PID:13948
- C:\Windows\System\YnvPiEr.exe
  C:\Windows\System\YnvPiEr.exe
  2⤵
  PID:14212
- C:\Windows\System\xSjImTM.exe
  C:\Windows\System\xSjImTM.exe
  2⤵
  PID:13304
- C:\Windows\System\DfKEkaB.exe
  C:\Windows\System\DfKEkaB.exe
  2⤵
  PID:13440
- C:\Windows\System\xqbyVGO.exe
  C:\Windows\System\xqbyVGO.exe
  2⤵
  PID:13372
- C:\Windows\System\MQqtZJo.exe
  C:\Windows\System\MQqtZJo.exe
  2⤵
  PID:13968
- C:\Windows\System\NXUNvVE.exe
  C:\Windows\System\NXUNvVE.exe
  2⤵
  PID:14044
- C:\Windows\System\fYhUOeG.exe
  C:\Windows\System\fYhUOeG.exe
  2⤵
  PID:14372
- C:\Windows\System\rPRLhHE.exe
  C:\Windows\System\rPRLhHE.exe
  2⤵
  PID:14396
- C:\Windows\System\TCZcxkJ.exe
  C:\Windows\System\TCZcxkJ.exe
  2⤵
  PID:14428
- C:\Windows\System\wNYrcMY.exe
  C:\Windows\System\wNYrcMY.exe
  2⤵
  PID:14444
- C:\Windows\System\HAYYWgk.exe
  C:\Windows\System\HAYYWgk.exe
  2⤵
  PID:14468
- C:\Windows\System\RIInMMy.exe
  C:\Windows\System\RIInMMy.exe
  2⤵
  PID:14496
- C:\Windows\System\gDvZWAm.exe
  C:\Windows\System\gDvZWAm.exe
  2⤵
  PID:14528
- C:\Windows\System\nEoWiBo.exe
  C:\Windows\System\nEoWiBo.exe
  2⤵
  PID:14564
- C:\Windows\System\qufjqHf.exe
  C:\Windows\System\qufjqHf.exe
  2⤵
  PID:14584
- C:\Windows\System\hkHiQES.exe
  C:\Windows\System\hkHiQES.exe
  2⤵
  PID:14612
- C:\Windows\System\tHYibZO.exe
  C:\Windows\System\tHYibZO.exe
  2⤵
  PID:14640
- C:\Windows\System\RVMldEb.exe
  C:\Windows\System\RVMldEb.exe
  2⤵
  PID:14660
- C:\Windows\System\QOYXujX.exe
  C:\Windows\System\QOYXujX.exe
  2⤵
  PID:14680
- C:\Windows\System\kHTTLfL.exe
  C:\Windows\System\kHTTLfL.exe
  2⤵
  PID:14700
- C:\Windows\System\vwKcryL.exe
  C:\Windows\System\vwKcryL.exe
  2⤵
  PID:14716
- C:\Windows\System\rumIiiu.exe
  C:\Windows\System\rumIiiu.exe
  2⤵
  PID:14732
- C:\Windows\System\hreiqCw.exe
  C:\Windows\System\hreiqCw.exe
  2⤵
  PID:14784
- C:\Windows\System\AyMeznZ.exe
  C:\Windows\System\AyMeznZ.exe
  2⤵
  PID:14812
- C:\Windows\System\oBYMRDf.exe
  C:\Windows\System\oBYMRDf.exe
  2⤵
  PID:14852
- C:\Windows\System\HcBLlja.exe
  C:\Windows\System\HcBLlja.exe
  2⤵
  PID:14880
- C:\Windows\System\eQomWlz.exe
  C:\Windows\System\eQomWlz.exe
  2⤵
  PID:14920
- C:\Windows\System\szCLFpZ.exe
  C:\Windows\System\szCLFpZ.exe
  2⤵
  PID:14944
- C:\Windows\System\uYxmUfL.exe
  C:\Windows\System\uYxmUfL.exe
  2⤵
  PID:14964
- C:\Windows\System\GPkaXvo.exe
  C:\Windows\System\GPkaXvo.exe
  2⤵
  PID:15016
- C:\Windows\System\fukuJdK.exe
  C:\Windows\System\fukuJdK.exe
  2⤵
  PID:15036
- C:\Windows\System\VsAHLui.exe
  C:\Windows\System\VsAHLui.exe
  2⤵
  PID:15064
- C:\Windows\System\xPfzopZ.exe
  C:\Windows\System\xPfzopZ.exe
  2⤵
  PID:15088
- C:\Windows\System\DkecWEy.exe
  C:\Windows\System\DkecWEy.exe
  2⤵
  PID:15112
- C:\Windows\System\QZVxUJz.exe
  C:\Windows\System\QZVxUJz.exe
  2⤵
  PID:15136
- C:\Windows\System\Wbwrrjg.exe
  C:\Windows\System\Wbwrrjg.exe
  2⤵
  PID:15152
- C:\Windows\System\AsszHyT.exe
  C:\Windows\System\AsszHyT.exe
  2⤵
  PID:15216
- C:\Windows\System\vzZQIpA.exe
  C:\Windows\System\vzZQIpA.exe
  2⤵
  PID:15232
- C:\Windows\System\fxBqvuJ.exe
  C:\Windows\System\fxBqvuJ.exe
  2⤵
  PID:15260
- C:\Windows\System\rSzXvRe.exe
  C:\Windows\System\rSzXvRe.exe
  2⤵
  PID:15276
- C:\Windows\System\KTNrKNg.exe
  C:\Windows\System\KTNrKNg.exe
  2⤵
  PID:15304
- C:\Windows\System\VLXnSxZ.exe
  C:\Windows\System\VLXnSxZ.exe
  2⤵
  PID:15332
- C:\Windows\System\piCQMEE.exe
  C:\Windows\System\piCQMEE.exe
  2⤵
  PID:15348
- C:\Windows\System\ArvKwur.exe
  C:\Windows\System\ArvKwur.exe
  2⤵
  PID:12692
- C:\Windows\System\jIIvmbb.exe
  C:\Windows\System\jIIvmbb.exe
  2⤵
  PID:14392
- C:\Windows\System\cMYOacU.exe
  C:\Windows\System\cMYOacU.exe
  2⤵
  PID:14440
- C:\Windows\System\odLEfYZ.exe
  C:\Windows\System\odLEfYZ.exe
  2⤵
  PID:14604
- C:\Windows\System\gSsTTWX.exe
  C:\Windows\System\gSsTTWX.exe
  2⤵
  PID:14648
- C:\Windows\System\XkAMXTO.exe
  C:\Windows\System\XkAMXTO.exe
  2⤵
  PID:14672
- C:\Windows\System\bVGRSDk.exe
  C:\Windows\System\bVGRSDk.exe
  2⤵
  PID:14760
- C:\Windows\System\ixCYTPH.exe
  C:\Windows\System\ixCYTPH.exe
  2⤵
  PID:14848
- C:\Windows\System\CyNEcDw.exe
  C:\Windows\System\CyNEcDw.exe
  2⤵
  PID:14904
- C:\Windows\System\PhdLeHi.exe
  C:\Windows\System\PhdLeHi.exe
  2⤵
  PID:14976
- C:\Windows\System\GZaMAGn.exe
  C:\Windows\System\GZaMAGn.exe
  2⤵
  PID:15048
- C:\Windows\System\ghCWLPr.exe
  C:\Windows\System\ghCWLPr.exe
  2⤵
  PID:15108
- C:\Windows\System\AtCRnQG.exe
  C:\Windows\System\AtCRnQG.exe
  2⤵
  PID:15172
- C:\Windows\System\gTLWMJN.exe
  C:\Windows\System\gTLWMJN.exe
  2⤵
  PID:15252
- C:\Windows\System\GsWoaDI.exe
  C:\Windows\System\GsWoaDI.exe
  2⤵
  PID:15344
- C:\Windows\System\kpXVEor.exe
  C:\Windows\System\kpXVEor.exe
  2⤵
  PID:13872
- C:\Windows\System\GEvtSJE.exe
  C:\Windows\System\GEvtSJE.exe
  2⤵
  PID:14344
- C:\Windows\System\LjINbxm.exe
  C:\Windows\System\LjINbxm.exe
  2⤵
  PID:14632
- C:\Windows\System\rRnlZAK.exe
  C:\Windows\System\rRnlZAK.exe
  2⤵
  PID:14796
- C:\Windows\System\poUfTGQ.exe
  C:\Windows\System\poUfTGQ.exe
  2⤵
  PID:14872
- C:\Windows\System\vQhtXiW.exe
  C:\Windows\System\vQhtXiW.exe
  2⤵
  PID:15012
- C:\Windows\System\ruRZein.exe
  C:\Windows\System\ruRZein.exe
  2⤵
  PID:15148
- C:\Windows\System\SaNOJZC.exe
  C:\Windows\System\SaNOJZC.exe
  2⤵
  PID:15224
- C:\Windows\System\vobeAYv.exe
  C:\Windows\System\vobeAYv.exe
  2⤵
  PID:14364
- C:\Windows\System\dncDShP.exe
  C:\Windows\System\dncDShP.exe
  2⤵
  PID:14916
- C:\Windows\System\obHTPsV.exe
  C:\Windows\System\obHTPsV.exe
  2⤵
  PID:14624
- C:\Windows\System\CeEKIJE.exe
  C:\Windows\System\CeEKIJE.exe
  2⤵
  PID:15100
- C:\Windows\System\XpRcCun.exe
  C:\Windows\System\XpRcCun.exe
  2⤵
  PID:15368
- C:\Windows\System\anYovCp.exe
  C:\Windows\System\anYovCp.exe
  2⤵
  PID:15400
- C:\Windows\System\uSzUOIH.exe
  C:\Windows\System\uSzUOIH.exe
  2⤵
  PID:15424
- C:\Windows\System\HuScjPK.exe
  C:\Windows\System\HuScjPK.exe
  2⤵
  PID:15452
- C:\Windows\System\XKYITnV.exe
  C:\Windows\System\XKYITnV.exe
  2⤵
  PID:15480
- C:\Windows\System\UEAvJLN.exe
  C:\Windows\System\UEAvJLN.exe
  2⤵
  PID:15500
- C:\Windows\System\SrkvjKe.exe
  C:\Windows\System\SrkvjKe.exe
  2⤵
  PID:15516
- C:\Windows\System\bBjlanJ.exe
  C:\Windows\System\bBjlanJ.exe
  2⤵
  PID:15548
- C:\Windows\System\ncbJATf.exe
  C:\Windows\System\ncbJATf.exe
  2⤵
  PID:15588
- C:\Windows\System\YXkEzex.exe
  C:\Windows\System\YXkEzex.exe
  2⤵
  PID:15608
- C:\Windows\System\VtTnCih.exe
  C:\Windows\System\VtTnCih.exe
  2⤵
  PID:15628
- C:\Windows\System\fSLPXwp.exe
  C:\Windows\System\fSLPXwp.exe
  2⤵
  PID:15692
- C:\Windows\System\UEQLwjH.exe
  C:\Windows\System\UEQLwjH.exe
  2⤵
  PID:15720
- C:\Windows\System\awbmonN.exe
  C:\Windows\System\awbmonN.exe
  2⤵
  PID:15736
- C:\Windows\System\BVeAOBm.exe
  C:\Windows\System\BVeAOBm.exe
  2⤵
  PID:15764
- C:\Windows\System\bOVFDIr.exe
  C:\Windows\System\bOVFDIr.exe
  2⤵
  PID:15808
- C:\Windows\System\SdUahOW.exe
  C:\Windows\System\SdUahOW.exe
  2⤵
  PID:15840
- C:\Windows\System\yJacBgD.exe
  C:\Windows\System\yJacBgD.exe
  2⤵
  PID:15876
- C:\Windows\System\GbRoIgQ.exe
  C:\Windows\System\GbRoIgQ.exe
  2⤵
  PID:15892
- C:\Windows\System\QvVkExI.exe
  C:\Windows\System\QvVkExI.exe
  2⤵
  PID:15912
- C:\Windows\System\CNpjicz.exe
  C:\Windows\System\CNpjicz.exe
  2⤵
  PID:15940
- C:\Windows\System\siYAtrk.exe
  C:\Windows\System\siYAtrk.exe
  2⤵
  PID:15968
- C:\Windows\System\CnIZaYc.exe
  C:\Windows\System\CnIZaYc.exe
  2⤵
  PID:16000
- C:\Windows\System\ZJaKtnf.exe
  C:\Windows\System\ZJaKtnf.exe
  2⤵
  PID:16024
- C:\Windows\System\HljlDTw.exe
  C:\Windows\System\HljlDTw.exe
  2⤵
  PID:16060
- C:\Windows\System\pIzFqiB.exe
  C:\Windows\System\pIzFqiB.exe
  2⤵
  PID:16088
- C:\Windows\System\bAZHcKt.exe
  C:\Windows\System\bAZHcKt.exe
  2⤵
  PID:16112
- C:\Windows\System\onsgyfN.exe
  C:\Windows\System\onsgyfN.exe
  2⤵
  PID:16136
- C:\Windows\System\FLTjWhj.exe
  C:\Windows\System\FLTjWhj.exe
  2⤵
  PID:16152
- C:\Windows\System\rornOtE.exe
  C:\Windows\System\rornOtE.exe
  2⤵
  PID:16188
- C:\Windows\System\wRCnefh.exe
  C:\Windows\System\wRCnefh.exe
  2⤵
  PID:16208
- C:\Windows\System\ncZjEVU.exe
  C:\Windows\System\ncZjEVU.exe
  2⤵
  PID:16232
- C:\Windows\System\fWmhPeE.exe
  C:\Windows\System\fWmhPeE.exe
  2⤵
  PID:16264
- C:\Windows\System\ocAkEyr.exe
  C:\Windows\System\ocAkEyr.exe
  2⤵
  PID:16288
- C:\Windows\System\qExeVtt.exe
  C:\Windows\System\qExeVtt.exe
  2⤵
  PID:16324
- C:\Windows\System\uyTdbzi.exe
  C:\Windows\System\uyTdbzi.exe
  2⤵
  PID:16360
- C:\Windows\System\YDSpgoA.exe
  C:\Windows\System\YDSpgoA.exe
  2⤵
  PID:15364
- C:\Windows\System\etcfBBY.exe
  C:\Windows\System\etcfBBY.exe
  2⤵
  PID:15420
- C:\Windows\System\bKopatj.exe
  C:\Windows\System\bKopatj.exe
  2⤵
  PID:15464
- C:\Windows\System\EOYogkj.exe
  C:\Windows\System\EOYogkj.exe
  2⤵
  PID:15572
- C:\Windows\System\jUFKcnB.exe
  C:\Windows\System\jUFKcnB.exe
  2⤵
  PID:15584
- C:\Windows\System\DKjjjhD.exe
  C:\Windows\System\DKjjjhD.exe
  2⤵
  PID:15640
- C:\Windows\System\OwjqqTl.exe
  C:\Windows\System\OwjqqTl.exe
  2⤵
  PID:15780
- C:\Windows\System\ZdyJdTT.exe
  C:\Windows\System\ZdyJdTT.exe
  2⤵
  PID:15872
- C:\Windows\System\DwwLbVa.exe
  C:\Windows\System\DwwLbVa.exe
  2⤵
  PID:11496
- C:\Windows\System\hviLrdI.exe
  C:\Windows\System\hviLrdI.exe
  2⤵
  PID:2364
- C:\Windows\System\KaSePSG.exe
  C:\Windows\System\KaSePSG.exe
  2⤵
  PID:15936
- C:\Windows\System\IDxTBbp.exe
  C:\Windows\System\IDxTBbp.exe
  2⤵
  PID:15996
- C:\Windows\System\ejoQPAq.exe
  C:\Windows\System\ejoQPAq.exe
  2⤵
  PID:16036
- C:\Windows\System\wJmnfoD.exe
  C:\Windows\System\wJmnfoD.exe
  2⤵
  PID:16128
- C:\Windows\System\QKmahQo.exe
  C:\Windows\System\QKmahQo.exe
  2⤵
  PID:16180
- C:\Windows\System\tVIPkom.exe
  C:\Windows\System\tVIPkom.exe
  2⤵
  PID:16260
- C:\Windows\System\HUcfgnT.exe
  C:\Windows\System\HUcfgnT.exe
  2⤵
  PID:16348
- C:\Windows\System\KZUMmLb.exe
  C:\Windows\System\KZUMmLb.exe
  2⤵
  PID:15512
- C:\Windows\System\lnWtQVy.exe
  C:\Windows\System\lnWtQVy.exe
  2⤵
  PID:15624
- C:\Windows\System\TIecJOA.exe
  C:\Windows\System\TIecJOA.exe
  2⤵
  PID:15796
- C:\Windows\System\LNVKBLZ.exe
  C:\Windows\System\LNVKBLZ.exe
  2⤵
  PID:15888
- C:\Windows\System\cshtLWW.exe
  C:\Windows\System\cshtLWW.exe
  2⤵
  PID:15988
- C:\Windows\System\ZqynmvD.exe
  C:\Windows\System\ZqynmvD.exe
  2⤵
  PID:16020
- C:\Windows\System\XFwpeJL.exe
  C:\Windows\System\XFwpeJL.exe
  2⤵
  PID:16224
- C:\Windows\System\NvrQQah.exe
  C:\Windows\System\NvrQQah.exe
  2⤵
  PID:16352
- C:\Windows\System\wihTrBm.exe
  C:\Windows\System\wihTrBm.exe
  2⤵
  PID:3372
- C:\Windows\System\kEJuPRV.exe
  C:\Windows\System\kEJuPRV.exe
  2⤵
  PID:15460
- C:\Windows\System\maPehxo.exe
  C:\Windows\System\maPehxo.exe
  2⤵
  PID:15676
- C:\Windows\System\ASHZDvk.exe
  C:\Windows\System\ASHZDvk.exe
  2⤵
  PID:16392
- C:\Windows\System\qMUqqii.exe
  C:\Windows\System\qMUqqii.exe
  2⤵
  PID:16412
- C:\Windows\System\vAcWTOS.exe
  C:\Windows\System\vAcWTOS.exe
  2⤵
  PID:16448
- C:\Windows\System\mexxfFD.exe
  C:\Windows\System\mexxfFD.exe
  2⤵
  PID:16468
- C:\Windows\System\oeEesDm.exe
  C:\Windows\System\oeEesDm.exe
  2⤵
  PID:16496
- C:\Windows\System\WuAJuWe.exe
  C:\Windows\System\WuAJuWe.exe
  2⤵
  PID:16516
- C:\Windows\System\rYTCmOh.exe
  C:\Windows\System\rYTCmOh.exe
  2⤵
  PID:16540
- C:\Windows\System\YPAHiSL.exe
  C:\Windows\System\YPAHiSL.exe
  2⤵
  PID:16576
- C:\Windows\System\dAUHUIC.exe
  C:\Windows\System\dAUHUIC.exe
  2⤵
  PID:16604
- C:\Windows\System\wybXopH.exe
  C:\Windows\System\wybXopH.exe
  2⤵
  PID:16628
- C:\Windows\System\TECBRKA.exe
  C:\Windows\System\TECBRKA.exe
  2⤵
  PID:16660
- C:\Windows\System\BWrJwRu.exe
  C:\Windows\System\BWrJwRu.exe
  2⤵
  PID:16696
- C:\Windows\System\ywUsyqo.exe
  C:\Windows\System\ywUsyqo.exe
  2⤵
  PID:16712
- C:\Windows\System\qixNdKP.exe
  C:\Windows\System\qixNdKP.exe
  2⤵
  PID:16744
- C:\Windows\System\IdAcoms.exe
  C:\Windows\System\IdAcoms.exe
  2⤵
  PID:16768
- C:\Windows\System\lOQVpod.exe
  C:\Windows\System\lOQVpod.exe
  2⤵
  PID:16820
- C:\Windows\System\nfTnmtC.exe
  C:\Windows\System\nfTnmtC.exe
  2⤵
  PID:16836
- C:\Windows\System\ffgzJmg.exe
  C:\Windows\System\ffgzJmg.exe
  2⤵
  PID:16864
- C:\Windows\System\DCynXBO.exe
  C:\Windows\System\DCynXBO.exe
  2⤵
  PID:16892
- C:\Windows\System\tFzHRVh.exe
  C:\Windows\System\tFzHRVh.exe
  2⤵
  PID:16908
- C:\Windows\System\BvBvRyL.exe
  C:\Windows\System\BvBvRyL.exe
  2⤵
  PID:16940
- C:\Windows\System\OpYplgc.exe
  C:\Windows\System\OpYplgc.exe
  2⤵
  PID:16968
- C:\Windows\System\lVhhpbo.exe
  C:\Windows\System\lVhhpbo.exe
  2⤵
  PID:16992
- C:\Windows\System\mdAQvXw.exe
  C:\Windows\System\mdAQvXw.exe
  2⤵
  PID:17008
- C:\Windows\System\mXmZYng.exe
  C:\Windows\System\mXmZYng.exe
  2⤵
  PID:17052
- C:\Windows\System\SwfYiTn.exe
  C:\Windows\System\SwfYiTn.exe
  2⤵
  PID:17076
- C:\Windows\System\gYOpobe.exe
  C:\Windows\System\gYOpobe.exe
  2⤵
  PID:17108
- C:\Windows\System\RuzhEvw.exe
  C:\Windows\System\RuzhEvw.exe
  2⤵
  PID:17128
- C:\Windows\System\gWBgUYt.exe
  C:\Windows\System\gWBgUYt.exe
  2⤵
  PID:17160
- C:\Windows\System\JDjgESP.exe
  C:\Windows\System\JDjgESP.exe
  2⤵
  PID:17224
- C:\Windows\System\FnrYHsr.exe
  C:\Windows\System\FnrYHsr.exe
  2⤵
  PID:17300
- C:\Windows\System\DloTVgU.exe
  C:\Windows\System\DloTVgU.exe
  2⤵
  PID:17316

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

79.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.190.18.2.in-addr.arpa

IN PTR

Response

79.190.18.2.in-addr.arpa

IN PTR

a2-18-190-79deploystaticakamaitechnologiescom
DNS

71.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

71.159.190.20.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

21.121.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.121.18.2.in-addr.arpa

IN PTR

Response

21.121.18.2.in-addr.arpa

IN PTR

a2-18-121-21deploystaticakamaitechnologiescom
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response
DNS

77.190.18.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.190.18.2.in-addr.arpa

IN PTR

Response

77.190.18.2.in-addr.arpa

IN PTR

a2-18-190-77deploystaticakamaitechnologiescom
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 442324
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1A249CF727BD43D9B47B21748EF3E8F9 Ref B: LON04EDGE0611 Ref C: 2024-05-16T05:01:10Z
date: Thu, 16 May 2024 05:01:10 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 394521
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1D554272917E4904B6592C0AE001E243 Ref B: LON04EDGE0611 Ref C: 2024-05-16T05:01:10Z
date: Thu, 16 May 2024 05:01:10 GMT
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response

204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

32.0kB
873.5kB
640
636

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

79.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

79.190.18.2.in-addr.arpa
8.8.8.8:53

71.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

71.159.190.20.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

21.121.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

21.121.18.2.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa
8.8.8.8:53

77.190.18.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

77.190.18.2.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
173 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

26.35.223.20.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CNBBawJ.exe

Filesize
1.3MB

MD5
df7925083e72356c1abddc57e2605a29

SHA1
1b03ef2f016e0309e3cb34520923915555aa988d

SHA256
404b81d8be8a417cfe4fec4bda820dfa2a37d1af6bdfa07bdfc834eadcfdf726

SHA512
dd9056b3903cf4ea69412ddb320662e5be0e39928cd7da66f7e7485feaf306d988d332085fc9d86de465f474f8f98adbc5fd25d440b5e98428b29ed80bf221b8

Download Submit
C:\Windows\System\DbuqhYW.exe

Filesize
1.3MB

MD5
8b86f6e91a28aa9eb69efbdfdcc8c7a7

SHA1
7a12d32bf52e3a2a649ae4d6324b07e9062261d0

SHA256
a4d4f0c36b0094e6a356367502508669f8cfb7f0faf53497592aa8ed19c30da2

SHA512
0535a7f9a06000e055745b6f583a01364648a9478930e01b4756cbe8d5b1104144cc45429b56ed14853723570b0c582c4292f2282b9f9fb55521df221b87dce1

Download Submit
C:\Windows\System\DyvlTGW.exe

Filesize
1.3MB

MD5
53202bef19e487435fbbba8243c20abc

SHA1
ac4beb6d873a06ba378cbf79104cdd673d928c97

SHA256
eaea2250772edf66ad95fd87f26f1cc8991830102a7e5cdead434010001cae6d

SHA512
143bd85eaf4ad40bdac60cad811b49f1afcff2503ec930fc5bfc397cb1149c370f5e775a638e24c120ed4e251be2b93bd61900591b354abfddd75659a9b53dbb

Download Submit
C:\Windows\System\EfxjQXF.exe

Filesize
1.3MB

MD5
0bf3ab5dd31dcd9e67c516cf04f0c8ff

SHA1
c3a870ba91da862b5904f53aec3330e3862fdb54

SHA256
3085b454d892a44bd3edf9db49d184ffec40bdeac8a25bf184dc60337d991ccd

SHA512
1cb6fa764074292e63d2a5987d4d7fa0dd5d1295267931f52957fa3d215bfbcf25f47519318fdda45654ac64040c3560d621e1e208e5c0dac856809aba3efeb5

Download Submit
C:\Windows\System\GVWsLuh.exe

Filesize
1.3MB

MD5
89956abd87078c133937cda6e523924a

SHA1
397d5aed2fea1bf639f0b334a3976fdad358b8c2

SHA256
ca7912d34c3d3cfdc400984c0f09171471b7e8121589257645e34f33261a4495

SHA512
3239504953285887b30abde9f51a18cbf250b70127036a799f932144fb1dedcbbb4f2354b3dac5d633ea7386e0d2cbf0a3fa980ad934601e8cdd272814fe7442

Download Submit
C:\Windows\System\HBEFTFL.exe

Filesize
1.3MB

MD5
0e531b45f567eb72ad3db73778ddd08f

SHA1
b04a84869a3a54ae0da3490d8680c90db635ccec

SHA256
59ffc890aa0fa7b426b31c06f0f324daba2e266b80d1e9eb1ab01e1efa38f4df

SHA512
6e07001a0f9d487b20b86c12ae17af0fdc0c782ffbed00dace2c855fdd0b3747d867c4de9490c967576afdd02d10eaee9bb702256f1a8609e64c44fbf8a4d2db

Download Submit
C:\Windows\System\JEGcMGi.exe

Filesize
1.3MB

MD5
9a902ca8a59f0bf17593bdac5fc704d0

SHA1
e2e96d25e10628bece8e5f1c2316fd255a6bb6f0

SHA256
27f023ec495bc68c475e1e3b3e20bfc6caad2e297d881f6bae1d96ede9f6b102

SHA512
e2ba5d67f63f378fdcb1a121c4f135756d58370987852af90fcd906f0bd87e89abad2d5fb9f7c6195760bd4b3b00f4d9eba7629720a65a316b4a41b40b2c66fb

Download Submit
C:\Windows\System\JctbpnE.exe

Filesize
1.3MB

MD5
4156edb3184a9874aa537d227d784bed

SHA1
09c69f6bbc4b9cd6e9d867a703767f1a95a5db4a

SHA256
f09eb9a6fa5a7814792eafde74621d60fea3d99c82baf310d73aa7807e449df5

SHA512
3c1336bf3facbfb163d47f50f2f2ff79c5ef2023120474a6ff78f8b354eb63630b3146514932b492901d0cef040cfc092fa8eb8cd4e163e799a700a711305e1a

Download Submit
C:\Windows\System\RujaOSD.exe

Filesize
1.3MB

MD5
f3d7f094f53909b71357fbc6aa52bd25

SHA1
52ae94f842a42710ba17fa4198825acf48b15bb8

SHA256
ce68e282b393ad9e46b64ad62b625e12305e719f3ebaa4d68503781bbc2f3a0d

SHA512
457cdb413cc52054429802ee00a94a667bfe640bb2a5f77187689acd53da91325d2146f6119749400a54811ca3fcb535409f33c2bdcaa39e8f86c60e1b4f997b

Download Submit
C:\Windows\System\TUzTYsu.exe

Filesize
1.3MB

MD5
9607053e283e58e20925ca7e94dca6b1

SHA1
1ec5fbb0bba93203e187493f6f16b3ec18c070c1

SHA256
16567770764d771382059a934e10145104670b05068f223c23e34a5d4351a373

SHA512
74f0ca13616dca8d2d5629a3e05edb41bbf22ec90efe1dd8efb68fe80e847d421de60308875b2ffd3b971ca64bee3ec75e3d2b118bb700c1daffcd65efd0f0bd

Download Submit
C:\Windows\System\UPOGKpR.exe

Filesize
1.3MB

MD5
f066f4994d58a738bb89c9961d840021

SHA1
943acc94b055f7e6ea8fc0f28440ed5a4b068aa3

SHA256
6bc9eb617ebd0e5a9c7d0ead1ebac44ed99741bac7892b708b79569b9ec50545

SHA512
b65143d7fd1d80cf31820a608abcc37281aab949f90d64efc3c32b26883d8b212b69e9d89d58c3b878b0eac7407a05b7a869a062a9e82ef39941d8abbc4bee48

Download Submit
C:\Windows\System\UPrsbCw.exe

Filesize
1.3MB

MD5
dee277bd7b338253f93a28c26cfb3efc

SHA1
8653b651f425ff2216efc61a7abc9ae28c572e4c

SHA256
056d087b175133c31f0412c5ffa5aa62511db65be3a58e364b4b5a612faa9e35

SHA512
a3e216ed315b4231e234fc3dcd1262bc3946140de403c51acf37006e5be54820bc219bada334b2dcdb42723bd47d4c130d8c05954f6cf804ec00b7ed14d31195

Download Submit
C:\Windows\System\UZJHsKO.exe

Filesize
1.3MB

MD5
708c0bcd18fff2ff63e404e1a34137cf

SHA1
6f6c4259de840014858e2d640e54fa6ecde4280d

SHA256
51ce02edd08d8f7d242e61bebf2fd92babe7590bfe5af6d04b1b88a97eef6e6b

SHA512
b72442a81c174fdcf4d2aa1c6f62ea290a363e683b80926fe930f52948b7d96457aa61c6fc1d423a4759f43de1fd90c4d7fe3378325f89dd12a1acf7dfd87a9b

Download Submit
C:\Windows\System\VReHHTr.exe

Filesize
1.3MB

MD5
aa142cf5e3fecd11324899f77bf58cd3

SHA1
e2ef1a840d5a3a53a6f73fe411d9f37b7d23256a

SHA256
7d1ea97c58e8ef9b16527b2a037ec53fef9880d27b9697270c5bd60f30b7f48d

SHA512
3cc8218509a6e0b93aea423179e24da994359865a5e28f2dbac4a621716b2f142a578b0d2f49c3b604b67be7320ded50b63640fbae58bfe59008011205e9a452

Download Submit
C:\Windows\System\VhhYSJO.exe

Filesize
1.3MB

MD5
84a289f99ee198ee8b8f7671c3c17641

SHA1
e1916b391a00e81ed4bde4148425f675f6ed227e

SHA256
8db97e702fdeab24e2a07aa8b26dd386067166319bdb54ce6de390738df55ecb

SHA512
2935d75ba45466ef5aed989f85ed0da7d91c5fa2f8addd1f37a471a75b800b9bf165578072ac2161605c65529858b6ba482ceafffa97ec59503b9d95a4cdc2dc

Download Submit
C:\Windows\System\WSfadiw.exe

Filesize
1.3MB

MD5
a21cd02f5094ddd4eabc163cbf416eaa

SHA1
6da9b61a47e446e4c24745ed2ab5d85d4e124946

SHA256
d89182f2dcffc84606474c0ecd159436873e5dcbef6f01fd13ba79c95a40beb3

SHA512
a2e6676989b41c90c47c22ba3a4561cb71e12386749e6eba851c4d39a137fbbfeebc6d7d5fe3d31e83afa19d9159d6d1ecde5e34495e87665fc2eab97269ae3c

Download Submit
C:\Windows\System\XIMbbTk.exe

Filesize
1.3MB

MD5
256e4cbbfbaa650ca2730a0c8be782ee

SHA1
16ab9101249b7ec1180877bda717f223ace1f349

SHA256
f73f502a850491db81c4b5a9b2f72580327fa9b111cb0135afdffb3ab79a3fa2

SHA512
50a59edec4a0ae058f65be06e2162994f105a4824c81e9b4a859f3d9e2f1a0a6f32f04b3713279fd96a07a04c5e27e144c4c915629effb26e2d3531e2c7901b3

Download Submit
C:\Windows\System\aPatdMw.exe

Filesize
1.3MB

MD5
3f3fe3a31e1378f8d283dcc49906f051

SHA1
fbe6c345485f35e826c625a8d4f460c040cf7836

SHA256
8ad3fec487054145a65220a7a06204a3bf42fb5c760c1a94a4a66692ca22020a

SHA512
a2923d25b67dfa3b3cc34951468f1c125a9314e9d3ae2aba226fe5f8a3f2d730829163217db0124bdfcf91890bb2488701eefc60df94299ff91e080f529a8ad9

Download Submit
C:\Windows\System\abHuXKJ.exe

Filesize
1.3MB

MD5
f9dcc6de564cb4adfd98af1dbdd32957

SHA1
aef547ff35b5f2025eaef8b4ad1029ed2985562c

SHA256
2c0162bef67ecb000a2b5d954caab1cd61ecb119a5ff458d18bf13d44684cb9b

SHA512
1fdb95ff87148b69da9d8979b95e98fbf09dcd588e4a65863a00eb401aa97d7b11a10c44b0799d60eefb4d56365b305ebcc2f8acade3a33e5ea3132835c201bc

Download Submit
C:\Windows\System\cVPSziC.exe

Filesize
1.3MB

MD5
6d80a23f574705f1d9ed9a35be9589d1

SHA1
23b3de4c81b93e1e3ba37ff4bada13827ed5cf33

SHA256
b0462b00d8369d652c2bf8b0227f0b2f14b97249ff2f75ed1dda7c07adb6b6a9

SHA512
e2c072b70dfaf92f9cb6bbdb74fb43c0d0dbe737c2b25ca1bfeac1d97db94471f107c89f0828488ac7b9706cd7c91a3c89f12b9f6295670e63dd55a376d5aac7

Download Submit
C:\Windows\System\dfnaqYs.exe

Filesize
1.3MB

MD5
cf1683ed038736ae559b048c85e1144e

SHA1
9c3a2afb00b69a6573e15797ede5350aeff8628b

SHA256
293c9dec6fefb5c5b15698510624aa58c0b510b7daa911edd13bdc6c6be89cb7

SHA512
cb32a89dd4f93b0ec081de9200599ff1a21b87738859b85f5a98c5c5e317f9c40a3feabd9f2a1210619e88c7fb75547f33d8ed24be63705dc428b45dcbe71b20

Download Submit
C:\Windows\System\etGvpBX.exe

Filesize
1.3MB

MD5
1a094ff454be0ee030911b29611c181a

SHA1
7c3c29b363cf41c79439b08eead25d0ca56863d6

SHA256
242790749cfab8882dca2349caeb32a5b11e145e9f1555d6440d4db9109c4656

SHA512
73608f0bf812512dcb527a5140725d5e086ff45c4f472d051f555833b3eecda746700d6ea47d2b1b67fc42ec6250212aeb33543c851208e3999e959caa8d21f3

Download Submit
C:\Windows\System\ioxZZRh.exe

Filesize
1.3MB

MD5
9111e24206104b52e53a4d483790b9fb

SHA1
b092ed05b154b5561131624668fbfb490c358588

SHA256
74dda155894f265e30f36d624c77af7528785ab3ff8f903a25c6463b6afd0e82

SHA512
fc7162e373061b262db268e8f1dafaaf2eb2f0da42bfd1af96864d420f1168b53cf6b2a93ca1707cfaeee4ff89f94241833d0c5f7b98c7c5e87838e4ae72611c

Download Submit
C:\Windows\System\ncQaETh.exe

Filesize
1.3MB

MD5
e0fe9075ec61bb9375866077e0e0a1aa

SHA1
81e52e400f0329f85faac7582ec685ec01f52e1d

SHA256
58a465c43dcfa26cf51a84530411427da44df9a916726171d0dfdebb732fc538

SHA512
85adba11103c22a28c38bff958c956cd58046047e576d4ea2c15c848ca16bea57d4d09404f467a3aa9e850fbb997a683a0d1d50d1dceccb0a1f195c121d893df

Download Submit
C:\Windows\System\nhLCvty.exe

Filesize
1.3MB

MD5
b35cf86df680c097e1fe4bfd8a76decd

SHA1
1539e1d7753a09e3f1b14177724a688c39f3b984

SHA256
2f9ec49e710726e02db7691d9cee2cb4513520f64029d1e70423f0643f00bdaf

SHA512
65d17d35af442c98d83c0513be2ab8821ede604cbf5c8b94fc4af2c931566112c5c09a7c9c3191c0e9d0c2d87f06577081a974d9b22f2a14368b2ce7d7168335

Download Submit
C:\Windows\System\pAHmByi.exe

Filesize
1.3MB

MD5
d4f4dc2f4ee0da5f83eb19b7793c30e2

SHA1
dd0596e4328e77ebdf353f107abf5658c18fac76

SHA256
ebb80c315b0563ace9359eca6d5162f2ca67daa07fc32f04d87b5d6e8dc9b1d6

SHA512
8fba72f8b502c4e92080e3fd5249ff4c927ae7fe35e9692b527ace02952ae3aed949822a3e1b19e54525d294c7e3d1ddf774a3413efd700751d5893763a83454

Download Submit
C:\Windows\System\sGmNNcS.exe

Filesize
1.3MB

MD5
f397bea40b76e80043a81f77ce15aef0

SHA1
7432011a21042f7e77c4b3fa87aea3476059d98b

SHA256
50fe404d44ae2703cee9dd4927ecfe43bdf20531edd5b637f12494453d37ab8e

SHA512
5045c4e7271e5cde10e978c17b7d119d4b4f0b542fa45302c771f54a01b401d08bfacf5a54029bf05b8a4e16328c8cd830a879601ccf34d46f3a452d34260d3b

Download Submit
C:\Windows\System\sQOprSz.exe

Filesize
1.3MB

MD5
4380ddff33716471c4377268d7676506

SHA1
559e2a205664090c3b15551e8ba7a31297714ae1

SHA256
08c58c49a80aafc181d42f206e6a17dd92bbfc0674e9aa1c77605dc198f62f89

SHA512
dfc810379bcfc2b3775f253ea3f1ef622929884fadfc97755a1cd9619043e272897e2b33db7f2390fd7828605860d2af3bbe162fe2b7903984dd8dc907440be7

Download Submit
C:\Windows\System\uEMBeGy.exe

Filesize
1.3MB

MD5
a7c9b909c9f767afa5fe3741ad644d97

SHA1
082baf886bf32963b6114e8893c41d3f9c568ddd

SHA256
3de9cec22bca4cbe15fc51c3f77f4d4e4859b2ee91d1768f04c2d656d5c5fc40

SHA512
11cb1bb84eeec518d27287802f6b7b2c9dc3544ea926b954cf6908f545c09e51b2593037c3292be8876a6c3c66616874bd3bc95f32456e7d39c2754370d3a281

Download Submit
C:\Windows\System\vKLHnKU.exe

Filesize
1.3MB

MD5
7cff013a8f4ac7e23bfa251d87a51b20

SHA1
5b2b920f5ea81b82b12852d82582c48c1867d1ce

SHA256
73b9723da80203536a9bfe4f18d5e7b316a33a48eb49aff043faaf2572e07c93

SHA512
4c6a5f05cfc46e15f2c9817c0fdbd78aad152e3bb64153d85e1ccc9eb939a73aaebe6618723cf6becc90e2fff905beacdb8ee6e7b6c6f2a88be8c89560bf57a4

Download Submit
C:\Windows\System\xXmSEgH.exe

Filesize
1.3MB

MD5
66d7b9b9db57d13aaeddaa334478b7bb

SHA1
cb4638370c539326f06ce3b15440d90fcedc554e

SHA256
c02580cf0117cb00f63d0097c8a861b6aaa0e4857f4eec390a9e07a68a0f5abd

SHA512
7b1ea342cae9b96fc77c725fad1e172a2aeff225f4fa66618f4fc19a286a57d3f1252e72c54bed7aad9a7dfc925f3852d7bfdcfd2ef904d33c90811ac7c9f769

Download Submit
C:\Windows\System\yzGNgdQ.exe

Filesize
1.3MB

MD5
faa3b32dd7fa557a0cabd0a3002ffa86

SHA1
ad88da3046b772c24b605c59dce4365e3e5a0231

SHA256
bf82e8c4d4cc71b565d3df6f955bf41f53b80a4c71fce5b446b23c4dc149473c

SHA512
51135de066d87e2f09d89a0620f31fb806b14a6f3838ccffccda6f042f593a22052e680fa878ee7fdb9878015d2d6474c59acef0ae37f73f821270a9ca07dedf

Download Submit
C:\Windows\System\zaAKIEP.exe

Filesize
1.3MB

MD5
cb7173bd6c4ddcfb8caec30dc4b01982

SHA1
9f8956d8c14ae8898afdb69493c7ddefbd5e923c

SHA256
6854bc614a7138e1f0e9c61bef2248c77c2d0166f104a23049427c91e287f1db

SHA512
efdea14a9ee6a1069ed055c7233d7b18320ec615ca04e66c830041471d7d823986589b81e6c7a8fef39646a2482307f91ebc4a8476146c58429fd82175dc8ad8

Download Submit
memory/536-0-0x000001EFBEA90000-0x000001EFBEAA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Response

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.