xmrig | cb15d9729a85c6ca37ed209531e1076178f2460956b25113b607c6842883237b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
Size

1.8MB
MD5

3101ccac09c7c8d15f8be90efee43660
SHA1

4a7579260a7ebe507a73d94204b1182d4bf6b27a
SHA256

cb15d9729a85c6ca37ed209531e1076178f2460956b25113b607c6842883237b
SHA512

847f97eb688569cc054abfec4fbc3c881faf5772e7536eb600ec5aee89f922764dc8b3f87f3c2da338e098b6a35d1ebeeb76356b03f1c2c258792a9fec35d656
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIR1Dy2NRGK3J0tL:GemTLkNdfE0pZaY

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023305-5.dat	xmrig
behavioral2/files/0x00070000000234a4-9.dat	xmrig
behavioral2/files/0x00070000000234a3-10.dat	xmrig
behavioral2/files/0x00070000000234a5-20.dat	xmrig
behavioral2/files/0x00070000000234a6-22.dat	xmrig
behavioral2/files/0x00070000000234a8-34.dat	xmrig
behavioral2/files/0x00070000000234a7-41.dat	xmrig
behavioral2/files/0x00070000000234aa-50.dat	xmrig
behavioral2/files/0x00070000000234ab-48.dat	xmrig
behavioral2/files/0x00070000000234a9-46.dat	xmrig
behavioral2/files/0x00070000000234ac-61.dat	xmrig
behavioral2/files/0x00070000000234af-71.dat	xmrig
behavioral2/files/0x00070000000234b4-95.dat	xmrig
behavioral2/files/0x00070000000234b2-75.dat	xmrig
behavioral2/files/0x00070000000234b7-107.dat	xmrig
behavioral2/files/0x00070000000234b8-115.dat	xmrig
behavioral2/files/0x00070000000234bc-136.dat	xmrig
behavioral2/files/0x00070000000234ba-164.dat	xmrig
behavioral2/files/0x00070000000234c6-163.dat	xmrig
behavioral2/files/0x00070000000234c5-162.dat	xmrig
behavioral2/files/0x00070000000234be-160.dat	xmrig
behavioral2/files/0x00070000000234c4-159.dat	xmrig
behavioral2/files/0x00070000000234c3-158.dat	xmrig
behavioral2/files/0x00070000000234c2-157.dat	xmrig
behavioral2/files/0x00070000000234c1-156.dat	xmrig
behavioral2/files/0x00070000000234c0-153.dat	xmrig
behavioral2/files/0x00070000000234bf-152.dat	xmrig
behavioral2/files/0x00070000000234b9-150.dat	xmrig
behavioral2/files/0x00070000000234bd-139.dat	xmrig
behavioral2/files/0x00070000000234bb-133.dat	xmrig
behavioral2/files/0x00070000000234ba-126.dat	xmrig
behavioral2/files/0x00070000000234b6-111.dat	xmrig
behavioral2/files/0x00070000000234b5-109.dat	xmrig
behavioral2/files/0x00070000000234b3-93.dat	xmrig
behavioral2/files/0x00070000000234ae-90.dat	xmrig
behavioral2/files/0x00070000000234b1-88.dat	xmrig
behavioral2/files/0x00080000000234a0-81.dat	xmrig
behavioral2/files/0x00070000000234b0-76.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4728	EHAoqwB.exe
3480	ZOGTRsO.exe
2248	UbbpGsG.exe
1884	VOerBqo.exe
4856	ukMVXDO.exe
3496	migOwyf.exe
2648	sBEfnlt.exe
3944	oBYnMyw.exe
1872	aefvAXQ.exe
900	trPybLD.exe
3828	GTqpGUU.exe
4464	cERQaun.exe
4680	tgffrCf.exe
3644	MjIJwrT.exe
2712	PVqrOdu.exe
2964	mZudnSZ.exe
4392	nSsuJcf.exe
3964	LwpSqic.exe
1944	blxnIOO.exe
3056	oHfIXSM.exe
3100	vabOSTV.exe
1756	CLrRYyf.exe
4040	uSPGEUE.exe
848	uyHKdMB.exe
1988	UQXXECp.exe
2464	zopfoqV.exe
984	UdTELiN.exe
316	tMcUfue.exe
1236	vDXQgut.exe
4192	XyWwBOB.exe
3040	RPhFVmI.exe
4088	yrzgoIT.exe
3660	HZyvPtm.exe
1772	VUipvfE.exe
3316	ZwRwYJS.exe
1124	BjSoQut.exe
4320	atxEyQU.exe
952	OuovmjZ.exe
1228	hoPpiTQ.exe
2324	rXHbmdW.exe
3120	MqyWBEx.exe
1128	nISXcop.exe
2120	sBEkIST.exe
4456	kKyWqwn.exe
4556	GwnfSSZ.exe
3172	UlDubPS.exe
2644	QQUvWUG.exe
740	aupMyXb.exe
3000	SExGAVv.exe
2664	wWAZcHf.exe
3440	XXwICdL.exe
2220	cEjilrC.exe
1268	qaFNaJd.exe
3704	dKfnPXO.exe
2860	UYEWcaO.exe
4852	WhxOzwX.exe
1800	NCaSutq.exe
4580	bbZyZek.exe
932	supVGjx.exe
3696	oXZtEzi.exe
3740	FPDQzQP.exe
2660	HEjisdz.exe
4624	ANKPHMs.exe
5032	ZMYLMRm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LoRwnrf.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\MwYNzih.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\kxKBDXH.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\bzadPpV.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\kzfSpQJ.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\WFhTKpd.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\oFqoLyr.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\pklPPsi.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\UYEWcaO.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\yqetoaQ.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\BvfKtrZ.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\OGGxUmZ.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\uJMQyAd.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\cEqytBG.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\TTAsUOf.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\uSPGEUE.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\SqyNYKV.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\ZhqItKF.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\vggfuxa.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\tTcZmdE.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\JQoWcLU.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\iNNZFJW.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\uEQDozj.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\txGLVrS.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\bMTKWSa.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\hufZMOR.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\myglxbw.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\PfDLcAs.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\EXvtdeK.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\xRmOytu.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\bbZyZek.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\CaPSUdF.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\IfoAdnO.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\maAhtqL.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\trPybLD.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\NhFwzQG.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\fUNIHDc.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\WncixQV.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\BoETirF.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\eeFQcDJ.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\FjDZtTE.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\DKjHHcg.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\xhAgJfV.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\UZEWBli.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\SQgUmKG.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\GwnfSSZ.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\MIfZOcc.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\jWUJuVG.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\fbXRVmY.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\aMotvUd.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\KyMxjVq.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\SsISoQU.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\WhxOzwX.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\asluKYO.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\DXfeMVg.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\PkxzFRA.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\JRGbgvC.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\KJYptfb.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\MJxtzsS.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\hxKUbBg.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\nSUICoV.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\cDTPAVj.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\qhUmpGx.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
File created	C:\Windows\System\ZwRwYJS.exe	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 4728	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	84
PID 1880 wrote to memory of 4728	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	84
PID 1880 wrote to memory of 3480	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	85
PID 1880 wrote to memory of 3480	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	85
PID 1880 wrote to memory of 2248	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	86
PID 1880 wrote to memory of 2248	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	86
PID 1880 wrote to memory of 1884	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	87
PID 1880 wrote to memory of 1884	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	87
PID 1880 wrote to memory of 4856	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	88
PID 1880 wrote to memory of 4856	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	88
PID 1880 wrote to memory of 3496	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	89
PID 1880 wrote to memory of 3496	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	89
PID 1880 wrote to memory of 2648	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	90
PID 1880 wrote to memory of 2648	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	90
PID 1880 wrote to memory of 3944	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	91
PID 1880 wrote to memory of 3944	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	91
PID 1880 wrote to memory of 1872	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	92
PID 1880 wrote to memory of 1872	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	92
PID 1880 wrote to memory of 900	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	93
PID 1880 wrote to memory of 900	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	93
PID 1880 wrote to memory of 3828	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	94
PID 1880 wrote to memory of 3828	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	94
PID 1880 wrote to memory of 4464	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	95
PID 1880 wrote to memory of 4464	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	95
PID 1880 wrote to memory of 4680	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	96
PID 1880 wrote to memory of 4680	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	96
PID 1880 wrote to memory of 3644	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	97
PID 1880 wrote to memory of 3644	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	97
PID 1880 wrote to memory of 2712	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	98
PID 1880 wrote to memory of 2712	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	98
PID 1880 wrote to memory of 2964	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	99
PID 1880 wrote to memory of 2964	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	99
PID 1880 wrote to memory of 4392	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	100
PID 1880 wrote to memory of 4392	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	100
PID 1880 wrote to memory of 3964	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	101
PID 1880 wrote to memory of 3964	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	101
PID 1880 wrote to memory of 1944	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	102
PID 1880 wrote to memory of 1944	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	102
PID 1880 wrote to memory of 3056	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	103
PID 1880 wrote to memory of 3056	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	103
PID 1880 wrote to memory of 3100	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	104
PID 1880 wrote to memory of 3100	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	104
PID 1880 wrote to memory of 1756	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	105
PID 1880 wrote to memory of 1756	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	105
PID 1880 wrote to memory of 4040	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	106
PID 1880 wrote to memory of 4040	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	106
PID 1880 wrote to memory of 848	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	107
PID 1880 wrote to memory of 848	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	107
PID 1880 wrote to memory of 1988	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	108
PID 1880 wrote to memory of 1988	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	108
PID 1880 wrote to memory of 2464	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	109
PID 1880 wrote to memory of 2464	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	109
PID 1880 wrote to memory of 984	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	110
PID 1880 wrote to memory of 984	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	110
PID 1880 wrote to memory of 316	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	111
PID 1880 wrote to memory of 316	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	111
PID 1880 wrote to memory of 1236	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	112
PID 1880 wrote to memory of 1236	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	112
PID 1880 wrote to memory of 4192	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	113
PID 1880 wrote to memory of 4192	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	113
PID 1880 wrote to memory of 3040	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	114
PID 1880 wrote to memory of 3040	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	114
PID 1880 wrote to memory of 4088	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	115
PID 1880 wrote to memory of 4088	1880	3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3101ccac09c7c8d15f8be90efee43660_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\System\EHAoqwB.exe
  C:\Windows\System\EHAoqwB.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\ZOGTRsO.exe
  C:\Windows\System\ZOGTRsO.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\UbbpGsG.exe
  C:\Windows\System\UbbpGsG.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\VOerBqo.exe
  C:\Windows\System\VOerBqo.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ukMVXDO.exe
  C:\Windows\System\ukMVXDO.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\migOwyf.exe
  C:\Windows\System\migOwyf.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\sBEfnlt.exe
  C:\Windows\System\sBEfnlt.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\oBYnMyw.exe
  C:\Windows\System\oBYnMyw.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\aefvAXQ.exe
  C:\Windows\System\aefvAXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\trPybLD.exe
  C:\Windows\System\trPybLD.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\GTqpGUU.exe
  C:\Windows\System\GTqpGUU.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\cERQaun.exe
  C:\Windows\System\cERQaun.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\tgffrCf.exe
  C:\Windows\System\tgffrCf.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\MjIJwrT.exe
  C:\Windows\System\MjIJwrT.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\PVqrOdu.exe
  C:\Windows\System\PVqrOdu.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\mZudnSZ.exe
  C:\Windows\System\mZudnSZ.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\nSsuJcf.exe
  C:\Windows\System\nSsuJcf.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\LwpSqic.exe
  C:\Windows\System\LwpSqic.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\blxnIOO.exe
  C:\Windows\System\blxnIOO.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\oHfIXSM.exe
  C:\Windows\System\oHfIXSM.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\vabOSTV.exe
  C:\Windows\System\vabOSTV.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\CLrRYyf.exe
  C:\Windows\System\CLrRYyf.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\uSPGEUE.exe
  C:\Windows\System\uSPGEUE.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\uyHKdMB.exe
  C:\Windows\System\uyHKdMB.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\UQXXECp.exe
  C:\Windows\System\UQXXECp.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\zopfoqV.exe
  C:\Windows\System\zopfoqV.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\UdTELiN.exe
  C:\Windows\System\UdTELiN.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\tMcUfue.exe
  C:\Windows\System\tMcUfue.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\vDXQgut.exe
  C:\Windows\System\vDXQgut.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\XyWwBOB.exe
  C:\Windows\System\XyWwBOB.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\RPhFVmI.exe
  C:\Windows\System\RPhFVmI.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\yrzgoIT.exe
  C:\Windows\System\yrzgoIT.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\HZyvPtm.exe
  C:\Windows\System\HZyvPtm.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\VUipvfE.exe
  C:\Windows\System\VUipvfE.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ZwRwYJS.exe
  C:\Windows\System\ZwRwYJS.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\BjSoQut.exe
  C:\Windows\System\BjSoQut.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\atxEyQU.exe
  C:\Windows\System\atxEyQU.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\OuovmjZ.exe
  C:\Windows\System\OuovmjZ.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\hoPpiTQ.exe
  C:\Windows\System\hoPpiTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\rXHbmdW.exe
  C:\Windows\System\rXHbmdW.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\MqyWBEx.exe
  C:\Windows\System\MqyWBEx.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\nISXcop.exe
  C:\Windows\System\nISXcop.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\sBEkIST.exe
  C:\Windows\System\sBEkIST.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\kKyWqwn.exe
  C:\Windows\System\kKyWqwn.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\GwnfSSZ.exe
  C:\Windows\System\GwnfSSZ.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\UlDubPS.exe
  C:\Windows\System\UlDubPS.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\QQUvWUG.exe
  C:\Windows\System\QQUvWUG.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\aupMyXb.exe
  C:\Windows\System\aupMyXb.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\SExGAVv.exe
  C:\Windows\System\SExGAVv.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\wWAZcHf.exe
  C:\Windows\System\wWAZcHf.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\XXwICdL.exe
  C:\Windows\System\XXwICdL.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\cEjilrC.exe
  C:\Windows\System\cEjilrC.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\qaFNaJd.exe
  C:\Windows\System\qaFNaJd.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\dKfnPXO.exe
  C:\Windows\System\dKfnPXO.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\UYEWcaO.exe
  C:\Windows\System\UYEWcaO.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\WhxOzwX.exe
  C:\Windows\System\WhxOzwX.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\NCaSutq.exe
  C:\Windows\System\NCaSutq.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\bbZyZek.exe
  C:\Windows\System\bbZyZek.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\supVGjx.exe
  C:\Windows\System\supVGjx.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\oXZtEzi.exe
  C:\Windows\System\oXZtEzi.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\FPDQzQP.exe
  C:\Windows\System\FPDQzQP.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\HEjisdz.exe
  C:\Windows\System\HEjisdz.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ANKPHMs.exe
  C:\Windows\System\ANKPHMs.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\ZMYLMRm.exe
  C:\Windows\System\ZMYLMRm.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\Xastcos.exe
  C:\Windows\System\Xastcos.exe
  2⤵
  PID:3512
- C:\Windows\System\ovWFKug.exe
  C:\Windows\System\ovWFKug.exe
  2⤵
  PID:2028
- C:\Windows\System\KJINTxs.exe
  C:\Windows\System\KJINTxs.exe
  2⤵
  PID:4440
- C:\Windows\System\NaCrDYj.exe
  C:\Windows\System\NaCrDYj.exe
  2⤵
  PID:2224
- C:\Windows\System\ApVfNgD.exe
  C:\Windows\System\ApVfNgD.exe
  2⤵
  PID:1396
- C:\Windows\System\VRkHElV.exe
  C:\Windows\System\VRkHElV.exe
  2⤵
  PID:3712
- C:\Windows\System\zkZVEEn.exe
  C:\Windows\System\zkZVEEn.exe
  2⤵
  PID:3616
- C:\Windows\System\DdJFjCj.exe
  C:\Windows\System\DdJFjCj.exe
  2⤵
  PID:4416
- C:\Windows\System\GHiyeCH.exe
  C:\Windows\System\GHiyeCH.exe
  2⤵
  PID:4944
- C:\Windows\System\CaDqiFd.exe
  C:\Windows\System\CaDqiFd.exe
  2⤵
  PID:4100
- C:\Windows\System\hTlmCWn.exe
  C:\Windows\System\hTlmCWn.exe
  2⤵
  PID:4644
- C:\Windows\System\yqetoaQ.exe
  C:\Windows\System\yqetoaQ.exe
  2⤵
  PID:3492
- C:\Windows\System\OasYWtg.exe
  C:\Windows\System\OasYWtg.exe
  2⤵
  PID:4108
- C:\Windows\System\vbTPbcI.exe
  C:\Windows\System\vbTPbcI.exe
  2⤵
  PID:1776
- C:\Windows\System\tDokgtm.exe
  C:\Windows\System\tDokgtm.exe
  2⤵
  PID:2056
- C:\Windows\System\ztSyWQY.exe
  C:\Windows\System\ztSyWQY.exe
  2⤵
  PID:1560
- C:\Windows\System\bRpTMWj.exe
  C:\Windows\System\bRpTMWj.exe
  2⤵
  PID:4236
- C:\Windows\System\iHXjFhF.exe
  C:\Windows\System\iHXjFhF.exe
  2⤵
  PID:2620
- C:\Windows\System\MfSccqY.exe
  C:\Windows\System\MfSccqY.exe
  2⤵
  PID:3276
- C:\Windows\System\NVGdsIf.exe
  C:\Windows\System\NVGdsIf.exe
  2⤵
  PID:5016
- C:\Windows\System\QMJhXfr.exe
  C:\Windows\System\QMJhXfr.exe
  2⤵
  PID:1660
- C:\Windows\System\VqZCFzP.exe
  C:\Windows\System\VqZCFzP.exe
  2⤵
  PID:3468
- C:\Windows\System\SqyNYKV.exe
  C:\Windows\System\SqyNYKV.exe
  2⤵
  PID:1412
- C:\Windows\System\dRpHdsO.exe
  C:\Windows\System\dRpHdsO.exe
  2⤵
  PID:4428
- C:\Windows\System\tqwbvka.exe
  C:\Windows\System\tqwbvka.exe
  2⤵
  PID:5140
- C:\Windows\System\aWcShJn.exe
  C:\Windows\System\aWcShJn.exe
  2⤵
  PID:5160
- C:\Windows\System\lgtUtxX.exe
  C:\Windows\System\lgtUtxX.exe
  2⤵
  PID:5188
- C:\Windows\System\QuPKHCR.exe
  C:\Windows\System\QuPKHCR.exe
  2⤵
  PID:5216
- C:\Windows\System\NPqYkqA.exe
  C:\Windows\System\NPqYkqA.exe
  2⤵
  PID:5244
- C:\Windows\System\iKfPVVZ.exe
  C:\Windows\System\iKfPVVZ.exe
  2⤵
  PID:5272
- C:\Windows\System\ThgapTW.exe
  C:\Windows\System\ThgapTW.exe
  2⤵
  PID:5304
- C:\Windows\System\DNsWPsT.exe
  C:\Windows\System\DNsWPsT.exe
  2⤵
  PID:5340
- C:\Windows\System\BCCCJba.exe
  C:\Windows\System\BCCCJba.exe
  2⤵
  PID:5368
- C:\Windows\System\yucKBJh.exe
  C:\Windows\System\yucKBJh.exe
  2⤵
  PID:5396
- C:\Windows\System\OLwTCOO.exe
  C:\Windows\System\OLwTCOO.exe
  2⤵
  PID:5424
- C:\Windows\System\HReJJmy.exe
  C:\Windows\System\HReJJmy.exe
  2⤵
  PID:5452
- C:\Windows\System\wxySiWa.exe
  C:\Windows\System\wxySiWa.exe
  2⤵
  PID:5484
- C:\Windows\System\vSliusB.exe
  C:\Windows\System\vSliusB.exe
  2⤵
  PID:5508
- C:\Windows\System\QWXKtNO.exe
  C:\Windows\System\QWXKtNO.exe
  2⤵
  PID:5540
- C:\Windows\System\YapHhQH.exe
  C:\Windows\System\YapHhQH.exe
  2⤵
  PID:5556
- C:\Windows\System\YrIZYmL.exe
  C:\Windows\System\YrIZYmL.exe
  2⤵
  PID:5572
- C:\Windows\System\KPujhPo.exe
  C:\Windows\System\KPujhPo.exe
  2⤵
  PID:5600
- C:\Windows\System\ItipeMX.exe
  C:\Windows\System\ItipeMX.exe
  2⤵
  PID:5620
- C:\Windows\System\eTZCRlg.exe
  C:\Windows\System\eTZCRlg.exe
  2⤵
  PID:5652
- C:\Windows\System\uQimtsx.exe
  C:\Windows\System\uQimtsx.exe
  2⤵
  PID:5680
- C:\Windows\System\LoRwnrf.exe
  C:\Windows\System\LoRwnrf.exe
  2⤵
  PID:5704
- C:\Windows\System\MMbuIVg.exe
  C:\Windows\System\MMbuIVg.exe
  2⤵
  PID:5736
- C:\Windows\System\MDxFEpi.exe
  C:\Windows\System\MDxFEpi.exe
  2⤵
  PID:5772
- C:\Windows\System\UoPYudx.exe
  C:\Windows\System\UoPYudx.exe
  2⤵
  PID:5792
- C:\Windows\System\iaAobxn.exe
  C:\Windows\System\iaAobxn.exe
  2⤵
  PID:5832
- C:\Windows\System\DKjHHcg.exe
  C:\Windows\System\DKjHHcg.exe
  2⤵
  PID:5868
- C:\Windows\System\kfrNJLb.exe
  C:\Windows\System\kfrNJLb.exe
  2⤵
  PID:5896
- C:\Windows\System\AcPUyKY.exe
  C:\Windows\System\AcPUyKY.exe
  2⤵
  PID:5924
- C:\Windows\System\PSaaAGL.exe
  C:\Windows\System\PSaaAGL.exe
  2⤵
  PID:5956
- C:\Windows\System\BDCQZsq.exe
  C:\Windows\System\BDCQZsq.exe
  2⤵
  PID:5992
- C:\Windows\System\kxKBDXH.exe
  C:\Windows\System\kxKBDXH.exe
  2⤵
  PID:6020
- C:\Windows\System\ybiJvny.exe
  C:\Windows\System\ybiJvny.exe
  2⤵
  PID:6056
- C:\Windows\System\opPlhze.exe
  C:\Windows\System\opPlhze.exe
  2⤵
  PID:6084
- C:\Windows\System\exeJuXM.exe
  C:\Windows\System\exeJuXM.exe
  2⤵
  PID:6108
- C:\Windows\System\kUbCmDh.exe
  C:\Windows\System\kUbCmDh.exe
  2⤵
  PID:6136
- C:\Windows\System\atsabKB.exe
  C:\Windows\System\atsabKB.exe
  2⤵
  PID:5172
- C:\Windows\System\gvXxNpS.exe
  C:\Windows\System\gvXxNpS.exe
  2⤵
  PID:5256
- C:\Windows\System\MIfZOcc.exe
  C:\Windows\System\MIfZOcc.exe
  2⤵
  PID:5336
- C:\Windows\System\zJIxKSz.exe
  C:\Windows\System\zJIxKSz.exe
  2⤵
  PID:5384
- C:\Windows\System\asluKYO.exe
  C:\Windows\System\asluKYO.exe
  2⤵
  PID:5444
- C:\Windows\System\NzahtXs.exe
  C:\Windows\System\NzahtXs.exe
  2⤵
  PID:5532
- C:\Windows\System\jLNbRVe.exe
  C:\Windows\System\jLNbRVe.exe
  2⤵
  PID:5552
- C:\Windows\System\ptDWDGW.exe
  C:\Windows\System\ptDWDGW.exe
  2⤵
  PID:5592
- C:\Windows\System\wOGyneN.exe
  C:\Windows\System\wOGyneN.exe
  2⤵
  PID:5724
- C:\Windows\System\YSnAPoa.exe
  C:\Windows\System\YSnAPoa.exe
  2⤵
  PID:5800
- C:\Windows\System\bCYSNXZ.exe
  C:\Windows\System\bCYSNXZ.exe
  2⤵
  PID:5860
- C:\Windows\System\UllJyIv.exe
  C:\Windows\System\UllJyIv.exe
  2⤵
  PID:5964
- C:\Windows\System\CCLwLpk.exe
  C:\Windows\System\CCLwLpk.exe
  2⤵
  PID:6048
- C:\Windows\System\mprWiCN.exe
  C:\Windows\System\mprWiCN.exe
  2⤵
  PID:6124
- C:\Windows\System\qzvUWxb.exe
  C:\Windows\System\qzvUWxb.exe
  2⤵
  PID:5228
- C:\Windows\System\RtYhpDM.exe
  C:\Windows\System\RtYhpDM.exe
  2⤵
  PID:5360
- C:\Windows\System\hwMaRTT.exe
  C:\Windows\System\hwMaRTT.exe
  2⤵
  PID:5668
- C:\Windows\System\qtYswgo.exe
  C:\Windows\System\qtYswgo.exe
  2⤵
  PID:5820
- C:\Windows\System\AokdKtJ.exe
  C:\Windows\System\AokdKtJ.exe
  2⤵
  PID:5920
- C:\Windows\System\eGBwOfg.exe
  C:\Windows\System\eGBwOfg.exe
  2⤵
  PID:5268
- C:\Windows\System\WzMLqsf.exe
  C:\Windows\System\WzMLqsf.exe
  2⤵
  PID:5732
- C:\Windows\System\sdpRQaP.exe
  C:\Windows\System\sdpRQaP.exe
  2⤵
  PID:6148
- C:\Windows\System\IdbOssb.exe
  C:\Windows\System\IdbOssb.exe
  2⤵
  PID:6176
- C:\Windows\System\oKTOXCK.exe
  C:\Windows\System\oKTOXCK.exe
  2⤵
  PID:6208
- C:\Windows\System\QRTWFhf.exe
  C:\Windows\System\QRTWFhf.exe
  2⤵
  PID:6248
- C:\Windows\System\BOlzgAe.exe
  C:\Windows\System\BOlzgAe.exe
  2⤵
  PID:6312
- C:\Windows\System\DgnmWQW.exe
  C:\Windows\System\DgnmWQW.exe
  2⤵
  PID:6348
- C:\Windows\System\jvfsFCt.exe
  C:\Windows\System\jvfsFCt.exe
  2⤵
  PID:6372
- C:\Windows\System\utYNmOL.exe
  C:\Windows\System\utYNmOL.exe
  2⤵
  PID:6400
- C:\Windows\System\QYbxvca.exe
  C:\Windows\System\QYbxvca.exe
  2⤵
  PID:6428
- C:\Windows\System\QfKFsiX.exe
  C:\Windows\System\QfKFsiX.exe
  2⤵
  PID:6444
- C:\Windows\System\YuQqdVs.exe
  C:\Windows\System\YuQqdVs.exe
  2⤵
  PID:6464
- C:\Windows\System\BjQQtoy.exe
  C:\Windows\System\BjQQtoy.exe
  2⤵
  PID:6484
- C:\Windows\System\zMixwkA.exe
  C:\Windows\System\zMixwkA.exe
  2⤵
  PID:6512
- C:\Windows\System\VJOfLRX.exe
  C:\Windows\System\VJOfLRX.exe
  2⤵
  PID:6536
- C:\Windows\System\yCgRUfw.exe
  C:\Windows\System\yCgRUfw.exe
  2⤵
  PID:6564
- C:\Windows\System\rwdMCGO.exe
  C:\Windows\System\rwdMCGO.exe
  2⤵
  PID:6604
- C:\Windows\System\rBqdIYI.exe
  C:\Windows\System\rBqdIYI.exe
  2⤵
  PID:6648
- C:\Windows\System\LfbYkts.exe
  C:\Windows\System\LfbYkts.exe
  2⤵
  PID:6680
- C:\Windows\System\CggexjD.exe
  C:\Windows\System\CggexjD.exe
  2⤵
  PID:6704
- C:\Windows\System\aSWymSZ.exe
  C:\Windows\System\aSWymSZ.exe
  2⤵
  PID:6736
- C:\Windows\System\ZFwxgRY.exe
  C:\Windows\System\ZFwxgRY.exe
  2⤵
  PID:6768
- C:\Windows\System\kToTbEk.exe
  C:\Windows\System\kToTbEk.exe
  2⤵
  PID:6800
- C:\Windows\System\dkfpRlf.exe
  C:\Windows\System\dkfpRlf.exe
  2⤵
  PID:6836
- C:\Windows\System\dtnqOFw.exe
  C:\Windows\System\dtnqOFw.exe
  2⤵
  PID:6860
- C:\Windows\System\zeJIDVt.exe
  C:\Windows\System\zeJIDVt.exe
  2⤵
  PID:6896
- C:\Windows\System\nFAQpok.exe
  C:\Windows\System\nFAQpok.exe
  2⤵
  PID:6924
- C:\Windows\System\ppbqQdo.exe
  C:\Windows\System\ppbqQdo.exe
  2⤵
  PID:6944
- C:\Windows\System\xEQnCpu.exe
  C:\Windows\System\xEQnCpu.exe
  2⤵
  PID:6976
- C:\Windows\System\SpIFdYy.exe
  C:\Windows\System\SpIFdYy.exe
  2⤵
  PID:7000
- C:\Windows\System\xhAgJfV.exe
  C:\Windows\System\xhAgJfV.exe
  2⤵
  PID:7020
- C:\Windows\System\hMwYCRP.exe
  C:\Windows\System\hMwYCRP.exe
  2⤵
  PID:7048
- C:\Windows\System\ayTWMWD.exe
  C:\Windows\System\ayTWMWD.exe
  2⤵
  PID:7068
- C:\Windows\System\DHslPtU.exe
  C:\Windows\System\DHslPtU.exe
  2⤵
  PID:7104
- C:\Windows\System\iSaAoau.exe
  C:\Windows\System\iSaAoau.exe
  2⤵
  PID:7132
- C:\Windows\System\ZJZgbcn.exe
  C:\Windows\System\ZJZgbcn.exe
  2⤵
  PID:7160
- C:\Windows\System\ZZIJCFE.exe
  C:\Windows\System\ZZIJCFE.exe
  2⤵
  PID:4016
- C:\Windows\System\BDWQHVs.exe
  C:\Windows\System\BDWQHVs.exe
  2⤵
  PID:5416
- C:\Windows\System\GgKdoGX.exe
  C:\Windows\System\GgKdoGX.exe
  2⤵
  PID:6216
- C:\Windows\System\lupxAhs.exe
  C:\Windows\System\lupxAhs.exe
  2⤵
  PID:6188
- C:\Windows\System\ghoLnFb.exe
  C:\Windows\System\ghoLnFb.exe
  2⤵
  PID:6332
- C:\Windows\System\XLGqVif.exe
  C:\Windows\System\XLGqVif.exe
  2⤵
  PID:6416
- C:\Windows\System\iwzXDlI.exe
  C:\Windows\System\iwzXDlI.exe
  2⤵
  PID:6472
- C:\Windows\System\crSfSaQ.exe
  C:\Windows\System\crSfSaQ.exe
  2⤵
  PID:6552
- C:\Windows\System\BzAqUbF.exe
  C:\Windows\System\BzAqUbF.exe
  2⤵
  PID:6544
- C:\Windows\System\gAxXVMR.exe
  C:\Windows\System\gAxXVMR.exe
  2⤵
  PID:6672
- C:\Windows\System\ZZJzUUP.exe
  C:\Windows\System\ZZJzUUP.exe
  2⤵
  PID:6696
- C:\Windows\System\HnYxxyB.exe
  C:\Windows\System\HnYxxyB.exe
  2⤵
  PID:6764
- C:\Windows\System\ikgNqYY.exe
  C:\Windows\System\ikgNqYY.exe
  2⤵
  PID:6912
- C:\Windows\System\cYeaoxh.exe
  C:\Windows\System\cYeaoxh.exe
  2⤵
  PID:6964
- C:\Windows\System\KZSanbH.exe
  C:\Windows\System\KZSanbH.exe
  2⤵
  PID:7032
- C:\Windows\System\OuqACwl.exe
  C:\Windows\System\OuqACwl.exe
  2⤵
  PID:7084
- C:\Windows\System\CSmSpjt.exe
  C:\Windows\System\CSmSpjt.exe
  2⤵
  PID:5472
- C:\Windows\System\YdqAxjH.exe
  C:\Windows\System\YdqAxjH.exe
  2⤵
  PID:6232
- C:\Windows\System\ExMxQeS.exe
  C:\Windows\System\ExMxQeS.exe
  2⤵
  PID:6596
- C:\Windows\System\PetpmDZ.exe
  C:\Windows\System\PetpmDZ.exe
  2⤵
  PID:6880
- C:\Windows\System\zPxlyIC.exe
  C:\Windows\System\zPxlyIC.exe
  2⤵
  PID:6720
- C:\Windows\System\dlmwukr.exe
  C:\Windows\System\dlmwukr.exe
  2⤵
  PID:5696
- C:\Windows\System\uDJDXyJ.exe
  C:\Windows\System\uDJDXyJ.exe
  2⤵
  PID:7172
- C:\Windows\System\wTIcJYL.exe
  C:\Windows\System\wTIcJYL.exe
  2⤵
  PID:7200
- C:\Windows\System\LCxmmaP.exe
  C:\Windows\System\LCxmmaP.exe
  2⤵
  PID:7216
- C:\Windows\System\KgCRzBH.exe
  C:\Windows\System\KgCRzBH.exe
  2⤵
  PID:7248
- C:\Windows\System\bDuQKoU.exe
  C:\Windows\System\bDuQKoU.exe
  2⤵
  PID:7272
- C:\Windows\System\BrEmDgl.exe
  C:\Windows\System\BrEmDgl.exe
  2⤵
  PID:7300
- C:\Windows\System\jqceHiO.exe
  C:\Windows\System\jqceHiO.exe
  2⤵
  PID:7332
- C:\Windows\System\QciEwiP.exe
  C:\Windows\System\QciEwiP.exe
  2⤵
  PID:7352
- C:\Windows\System\avQFuVo.exe
  C:\Windows\System\avQFuVo.exe
  2⤵
  PID:7380
- C:\Windows\System\TEyuRwk.exe
  C:\Windows\System\TEyuRwk.exe
  2⤵
  PID:7408
- C:\Windows\System\OjsLAyY.exe
  C:\Windows\System\OjsLAyY.exe
  2⤵
  PID:7432
- C:\Windows\System\xxibKVt.exe
  C:\Windows\System\xxibKVt.exe
  2⤵
  PID:7468
- C:\Windows\System\BQmrPii.exe
  C:\Windows\System\BQmrPii.exe
  2⤵
  PID:7504
- C:\Windows\System\fONTLXp.exe
  C:\Windows\System\fONTLXp.exe
  2⤵
  PID:7532
- C:\Windows\System\YDRHGQL.exe
  C:\Windows\System\YDRHGQL.exe
  2⤵
  PID:7564
- C:\Windows\System\kXNOCQH.exe
  C:\Windows\System\kXNOCQH.exe
  2⤵
  PID:7588
- C:\Windows\System\NnjULto.exe
  C:\Windows\System\NnjULto.exe
  2⤵
  PID:7612
- C:\Windows\System\oASDvJe.exe
  C:\Windows\System\oASDvJe.exe
  2⤵
  PID:7640
- C:\Windows\System\AjfCaoY.exe
  C:\Windows\System\AjfCaoY.exe
  2⤵
  PID:7676
- C:\Windows\System\ANfeZUu.exe
  C:\Windows\System\ANfeZUu.exe
  2⤵
  PID:7700
- C:\Windows\System\xExKkHk.exe
  C:\Windows\System\xExKkHk.exe
  2⤵
  PID:7732
- C:\Windows\System\QEMVxEf.exe
  C:\Windows\System\QEMVxEf.exe
  2⤵
  PID:7752
- C:\Windows\System\Fxcdaky.exe
  C:\Windows\System\Fxcdaky.exe
  2⤵
  PID:7788
- C:\Windows\System\KwrsfWk.exe
  C:\Windows\System\KwrsfWk.exe
  2⤵
  PID:7828
- C:\Windows\System\VHVlaeL.exe
  C:\Windows\System\VHVlaeL.exe
  2⤵
  PID:7856
- C:\Windows\System\dCQNjzn.exe
  C:\Windows\System\dCQNjzn.exe
  2⤵
  PID:7892
- C:\Windows\System\pvyirva.exe
  C:\Windows\System\pvyirva.exe
  2⤵
  PID:7916
- C:\Windows\System\nZVexen.exe
  C:\Windows\System\nZVexen.exe
  2⤵
  PID:7944
- C:\Windows\System\dVjGMIh.exe
  C:\Windows\System\dVjGMIh.exe
  2⤵
  PID:7976
- C:\Windows\System\EHZVxYU.exe
  C:\Windows\System\EHZVxYU.exe
  2⤵
  PID:8008
- C:\Windows\System\mdVbPNR.exe
  C:\Windows\System\mdVbPNR.exe
  2⤵
  PID:8040
- C:\Windows\System\nuoOOdD.exe
  C:\Windows\System\nuoOOdD.exe
  2⤵
  PID:8068
- C:\Windows\System\AmODkvL.exe
  C:\Windows\System\AmODkvL.exe
  2⤵
  PID:8096
- C:\Windows\System\lKyFZan.exe
  C:\Windows\System\lKyFZan.exe
  2⤵
  PID:8136
- C:\Windows\System\WomBKnK.exe
  C:\Windows\System\WomBKnK.exe
  2⤵
  PID:8164
- C:\Windows\System\KHRdmYS.exe
  C:\Windows\System\KHRdmYS.exe
  2⤵
  PID:7056
- C:\Windows\System\CFCNlpS.exe
  C:\Windows\System\CFCNlpS.exe
  2⤵
  PID:7064
- C:\Windows\System\txGLVrS.exe
  C:\Windows\System\txGLVrS.exe
  2⤵
  PID:6788
- C:\Windows\System\RuETQuF.exe
  C:\Windows\System\RuETQuF.exe
  2⤵
  PID:7260
- C:\Windows\System\XcrjYPm.exe
  C:\Windows\System\XcrjYPm.exe
  2⤵
  PID:7256
- C:\Windows\System\jWUJuVG.exe
  C:\Windows\System\jWUJuVG.exe
  2⤵
  PID:7400
- C:\Windows\System\ygMFEIU.exe
  C:\Windows\System\ygMFEIU.exe
  2⤵
  PID:7444
- C:\Windows\System\QPNjbbK.exe
  C:\Windows\System\QPNjbbK.exe
  2⤵
  PID:7548
- C:\Windows\System\nDQaQgt.exe
  C:\Windows\System\nDQaQgt.exe
  2⤵
  PID:7392
- C:\Windows\System\YXfdOon.exe
  C:\Windows\System\YXfdOon.exe
  2⤵
  PID:7636
- C:\Windows\System\xrZvtIk.exe
  C:\Windows\System\xrZvtIk.exe
  2⤵
  PID:7724
- C:\Windows\System\HCMNZjz.exe
  C:\Windows\System\HCMNZjz.exe
  2⤵
  PID:7764
- C:\Windows\System\kSIvZgY.exe
  C:\Windows\System\kSIvZgY.exe
  2⤵
  PID:7888
- C:\Windows\System\tbMawxP.exe
  C:\Windows\System\tbMawxP.exe
  2⤵
  PID:7928
- C:\Windows\System\UZAyouL.exe
  C:\Windows\System\UZAyouL.exe
  2⤵
  PID:7984
- C:\Windows\System\bpQmiub.exe
  C:\Windows\System\bpQmiub.exe
  2⤵
  PID:8000
- C:\Windows\System\yzZAgsr.exe
  C:\Windows\System\yzZAgsr.exe
  2⤵
  PID:8060
- C:\Windows\System\XFxHgPW.exe
  C:\Windows\System\XFxHgPW.exe
  2⤵
  PID:8112
- C:\Windows\System\XVcWAcV.exe
  C:\Windows\System\XVcWAcV.exe
  2⤵
  PID:8184
- C:\Windows\System\DKxAxZx.exe
  C:\Windows\System\DKxAxZx.exe
  2⤵
  PID:6940
- C:\Windows\System\blJIDqp.exe
  C:\Windows\System\blJIDqp.exe
  2⤵
  PID:7424
- C:\Windows\System\sfCaCDZ.exe
  C:\Windows\System\sfCaCDZ.exe
  2⤵
  PID:7428
- C:\Windows\System\zVHhYrD.exe
  C:\Windows\System\zVHhYrD.exe
  2⤵
  PID:7516
- C:\Windows\System\bbGrguT.exe
  C:\Windows\System\bbGrguT.exe
  2⤵
  PID:7852
- C:\Windows\System\tfInRaM.exe
  C:\Windows\System\tfInRaM.exe
  2⤵
  PID:7900
- C:\Windows\System\tXSMWJz.exe
  C:\Windows\System\tXSMWJz.exe
  2⤵
  PID:8152
- C:\Windows\System\CDcnyVN.exe
  C:\Windows\System\CDcnyVN.exe
  2⤵
  PID:6340
- C:\Windows\System\djpFknD.exe
  C:\Windows\System\djpFknD.exe
  2⤵
  PID:7576
- C:\Windows\System\GctbnhC.exe
  C:\Windows\System\GctbnhC.exe
  2⤵
  PID:7936
- C:\Windows\System\VgKspad.exe
  C:\Windows\System\VgKspad.exe
  2⤵
  PID:7712
- C:\Windows\System\UfKzbET.exe
  C:\Windows\System\UfKzbET.exe
  2⤵
  PID:8208
- C:\Windows\System\gkFmrzR.exe
  C:\Windows\System\gkFmrzR.exe
  2⤵
  PID:8236
- C:\Windows\System\nOetCCL.exe
  C:\Windows\System\nOetCCL.exe
  2⤵
  PID:8264
- C:\Windows\System\XgZjJUT.exe
  C:\Windows\System\XgZjJUT.exe
  2⤵
  PID:8292
- C:\Windows\System\NoTiwHk.exe
  C:\Windows\System\NoTiwHk.exe
  2⤵
  PID:8312
- C:\Windows\System\sfCguVK.exe
  C:\Windows\System\sfCguVK.exe
  2⤵
  PID:8348
- C:\Windows\System\zLLUJfB.exe
  C:\Windows\System\zLLUJfB.exe
  2⤵
  PID:8376
- C:\Windows\System\SVspwnH.exe
  C:\Windows\System\SVspwnH.exe
  2⤵
  PID:8404
- C:\Windows\System\fguNBLC.exe
  C:\Windows\System\fguNBLC.exe
  2⤵
  PID:8424
- C:\Windows\System\zxNdjkT.exe
  C:\Windows\System\zxNdjkT.exe
  2⤵
  PID:8448
- C:\Windows\System\emhuvOc.exe
  C:\Windows\System\emhuvOc.exe
  2⤵
  PID:8468
- C:\Windows\System\PyqCWUS.exe
  C:\Windows\System\PyqCWUS.exe
  2⤵
  PID:8496
- C:\Windows\System\GxGfEhL.exe
  C:\Windows\System\GxGfEhL.exe
  2⤵
  PID:8532
- C:\Windows\System\LXjYaqv.exe
  C:\Windows\System\LXjYaqv.exe
  2⤵
  PID:8560
- C:\Windows\System\jBDdRWC.exe
  C:\Windows\System\jBDdRWC.exe
  2⤵
  PID:8584
- C:\Windows\System\KCnLnyf.exe
  C:\Windows\System\KCnLnyf.exe
  2⤵
  PID:8612
- C:\Windows\System\BVCaexp.exe
  C:\Windows\System\BVCaexp.exe
  2⤵
  PID:8652
- C:\Windows\System\FnltMaZ.exe
  C:\Windows\System\FnltMaZ.exe
  2⤵
  PID:8676
- C:\Windows\System\WXNLxwA.exe
  C:\Windows\System\WXNLxwA.exe
  2⤵
  PID:8708
- C:\Windows\System\ZBeEcxp.exe
  C:\Windows\System\ZBeEcxp.exe
  2⤵
  PID:8736
- C:\Windows\System\UmLjyrn.exe
  C:\Windows\System\UmLjyrn.exe
  2⤵
  PID:8768
- C:\Windows\System\IoWNAWt.exe
  C:\Windows\System\IoWNAWt.exe
  2⤵
  PID:8788
- C:\Windows\System\HLgBjOW.exe
  C:\Windows\System\HLgBjOW.exe
  2⤵
  PID:8820
- C:\Windows\System\DsbEdJo.exe
  C:\Windows\System\DsbEdJo.exe
  2⤵
  PID:8848
- C:\Windows\System\lGCcwED.exe
  C:\Windows\System\lGCcwED.exe
  2⤵
  PID:8876
- C:\Windows\System\IQSkFAQ.exe
  C:\Windows\System\IQSkFAQ.exe
  2⤵
  PID:8904
- C:\Windows\System\mHXzYPp.exe
  C:\Windows\System\mHXzYPp.exe
  2⤵
  PID:8936
- C:\Windows\System\WKcojzi.exe
  C:\Windows\System\WKcojzi.exe
  2⤵
  PID:8968
- C:\Windows\System\leiNCNC.exe
  C:\Windows\System\leiNCNC.exe
  2⤵
  PID:9000
- C:\Windows\System\cYwDCwS.exe
  C:\Windows\System\cYwDCwS.exe
  2⤵
  PID:9024
- C:\Windows\System\yFzaVGP.exe
  C:\Windows\System\yFzaVGP.exe
  2⤵
  PID:9052
- C:\Windows\System\QKjsMQb.exe
  C:\Windows\System\QKjsMQb.exe
  2⤵
  PID:9084
- C:\Windows\System\JRGbgvC.exe
  C:\Windows\System\JRGbgvC.exe
  2⤵
  PID:9112
- C:\Windows\System\eVcsgjq.exe
  C:\Windows\System\eVcsgjq.exe
  2⤵
  PID:9144
- C:\Windows\System\vUIMWJl.exe
  C:\Windows\System\vUIMWJl.exe
  2⤵
  PID:9168
- C:\Windows\System\McCVDbf.exe
  C:\Windows\System\McCVDbf.exe
  2⤵
  PID:9200
- C:\Windows\System\XmpwNUu.exe
  C:\Windows\System\XmpwNUu.exe
  2⤵
  PID:6632
- C:\Windows\System\QdvTnaG.exe
  C:\Windows\System\QdvTnaG.exe
  2⤵
  PID:8280
- C:\Windows\System\xdmBxMP.exe
  C:\Windows\System\xdmBxMP.exe
  2⤵
  PID:8320
- C:\Windows\System\HzGUoDD.exe
  C:\Windows\System\HzGUoDD.exe
  2⤵
  PID:8388
- C:\Windows\System\IlZigpv.exe
  C:\Windows\System\IlZigpv.exe
  2⤵
  PID:8436
- C:\Windows\System\yleuNWC.exe
  C:\Windows\System\yleuNWC.exe
  2⤵
  PID:8464
- C:\Windows\System\eFcywzR.exe
  C:\Windows\System\eFcywzR.exe
  2⤵
  PID:8556
- C:\Windows\System\OUmInqD.exe
  C:\Windows\System\OUmInqD.exe
  2⤵
  PID:8600
- C:\Windows\System\nQwJneJ.exe
  C:\Windows\System\nQwJneJ.exe
  2⤵
  PID:8696
- C:\Windows\System\aZhFSlv.exe
  C:\Windows\System\aZhFSlv.exe
  2⤵
  PID:8764
- C:\Windows\System\dRpqPbE.exe
  C:\Windows\System\dRpqPbE.exe
  2⤵
  PID:752
- C:\Windows\System\rnomKXK.exe
  C:\Windows\System\rnomKXK.exe
  2⤵
  PID:8828
- C:\Windows\System\WYbhFSV.exe
  C:\Windows\System\WYbhFSV.exe
  2⤵
  PID:8920
- C:\Windows\System\UoIfhvO.exe
  C:\Windows\System\UoIfhvO.exe
  2⤵
  PID:8912
- C:\Windows\System\olewFMp.exe
  C:\Windows\System\olewFMp.exe
  2⤵
  PID:9040
- C:\Windows\System\RTvjnjc.exe
  C:\Windows\System\RTvjnjc.exe
  2⤵
  PID:9100
- C:\Windows\System\knzsQYq.exe
  C:\Windows\System\knzsQYq.exe
  2⤵
  PID:9156
- C:\Windows\System\lOHWOpq.exe
  C:\Windows\System\lOHWOpq.exe
  2⤵
  PID:7496
- C:\Windows\System\XdMXDVh.exe
  C:\Windows\System\XdMXDVh.exe
  2⤵
  PID:8308
- C:\Windows\System\lRmDxOx.exe
  C:\Windows\System\lRmDxOx.exe
  2⤵
  PID:8460
- C:\Windows\System\GaheEhw.exe
  C:\Windows\System\GaheEhw.exe
  2⤵
  PID:8752
- C:\Windows\System\LkFFQDa.exe
  C:\Windows\System\LkFFQDa.exe
  2⤵
  PID:8832
- C:\Windows\System\nCjJkdE.exe
  C:\Windows\System\nCjJkdE.exe
  2⤵
  PID:9008
- C:\Windows\System\mSBiSpc.exe
  C:\Windows\System\mSBiSpc.exe
  2⤵
  PID:9128
- C:\Windows\System\vwPeYZr.exe
  C:\Windows\System\vwPeYZr.exe
  2⤵
  PID:9208
- C:\Windows\System\LILkUeb.exe
  C:\Windows\System\LILkUeb.exe
  2⤵
  PID:8868
- C:\Windows\System\uwDLgIP.exe
  C:\Windows\System\uwDLgIP.exe
  2⤵
  PID:9220
- C:\Windows\System\WUzZPIa.exe
  C:\Windows\System\WUzZPIa.exe
  2⤵
  PID:9248
- C:\Windows\System\ghhcElG.exe
  C:\Windows\System\ghhcElG.exe
  2⤵
  PID:9272
- C:\Windows\System\IegkcLV.exe
  C:\Windows\System\IegkcLV.exe
  2⤵
  PID:9296
- C:\Windows\System\MybUnaK.exe
  C:\Windows\System\MybUnaK.exe
  2⤵
  PID:9328
- C:\Windows\System\zniIvkx.exe
  C:\Windows\System\zniIvkx.exe
  2⤵
  PID:9356
- C:\Windows\System\NNxkCNx.exe
  C:\Windows\System\NNxkCNx.exe
  2⤵
  PID:9384
- C:\Windows\System\tXCSovI.exe
  C:\Windows\System\tXCSovI.exe
  2⤵
  PID:9416
- C:\Windows\System\FqIOSiA.exe
  C:\Windows\System\FqIOSiA.exe
  2⤵
  PID:9440
- C:\Windows\System\yjLGWkH.exe
  C:\Windows\System\yjLGWkH.exe
  2⤵
  PID:9464
- C:\Windows\System\XjbbUhs.exe
  C:\Windows\System\XjbbUhs.exe
  2⤵
  PID:9488
- C:\Windows\System\XrpFfJk.exe
  C:\Windows\System\XrpFfJk.exe
  2⤵
  PID:9516
- C:\Windows\System\UVhcnvq.exe
  C:\Windows\System\UVhcnvq.exe
  2⤵
  PID:9540
- C:\Windows\System\eCYNsLt.exe
  C:\Windows\System\eCYNsLt.exe
  2⤵
  PID:9568
- C:\Windows\System\kAbUvGf.exe
  C:\Windows\System\kAbUvGf.exe
  2⤵
  PID:9600
- C:\Windows\System\nVnMksK.exe
  C:\Windows\System\nVnMksK.exe
  2⤵
  PID:9624
- C:\Windows\System\FsAUEGS.exe
  C:\Windows\System\FsAUEGS.exe
  2⤵
  PID:9652
- C:\Windows\System\laHcTRA.exe
  C:\Windows\System\laHcTRA.exe
  2⤵
  PID:9680
- C:\Windows\System\HbUQVdC.exe
  C:\Windows\System\HbUQVdC.exe
  2⤵
  PID:9704
- C:\Windows\System\BnmhLST.exe
  C:\Windows\System\BnmhLST.exe
  2⤵
  PID:9728
- C:\Windows\System\cYpfngC.exe
  C:\Windows\System\cYpfngC.exe
  2⤵
  PID:9760
- C:\Windows\System\JDMtGnl.exe
  C:\Windows\System\JDMtGnl.exe
  2⤵
  PID:9788
- C:\Windows\System\XdGtIMe.exe
  C:\Windows\System\XdGtIMe.exe
  2⤵
  PID:9816
- C:\Windows\System\YCJFgpk.exe
  C:\Windows\System\YCJFgpk.exe
  2⤵
  PID:9844
- C:\Windows\System\nxVyUsW.exe
  C:\Windows\System\nxVyUsW.exe
  2⤵
  PID:9868
- C:\Windows\System\HUlzpCT.exe
  C:\Windows\System\HUlzpCT.exe
  2⤵
  PID:10020
- C:\Windows\System\FYVGUML.exe
  C:\Windows\System\FYVGUML.exe
  2⤵
  PID:10052
- C:\Windows\System\pFxLvOA.exe
  C:\Windows\System\pFxLvOA.exe
  2⤵
  PID:10084
- C:\Windows\System\uEDPCcL.exe
  C:\Windows\System\uEDPCcL.exe
  2⤵
  PID:10104
- C:\Windows\System\wJeyAiy.exe
  C:\Windows\System\wJeyAiy.exe
  2⤵
  PID:10124
- C:\Windows\System\txrebIG.exe
  C:\Windows\System\txrebIG.exe
  2⤵
  PID:10140
- C:\Windows\System\jdECrLX.exe
  C:\Windows\System\jdECrLX.exe
  2⤵
  PID:10156
- C:\Windows\System\vlZyxCt.exe
  C:\Windows\System\vlZyxCt.exe
  2⤵
  PID:10184
- C:\Windows\System\fPoOBTl.exe
  C:\Windows\System\fPoOBTl.exe
  2⤵
  PID:10208
- C:\Windows\System\SOkQOYp.exe
  C:\Windows\System\SOkQOYp.exe
  2⤵
  PID:10228
- C:\Windows\System\ZhqItKF.exe
  C:\Windows\System\ZhqItKF.exe
  2⤵
  PID:9136
- C:\Windows\System\tzwvUyE.exe
  C:\Windows\System\tzwvUyE.exe
  2⤵
  PID:8800
- C:\Windows\System\PMoIQVj.exe
  C:\Windows\System\PMoIQVj.exe
  2⤵
  PID:9268
- C:\Windows\System\IHnStvf.exe
  C:\Windows\System\IHnStvf.exe
  2⤵
  PID:9372
- C:\Windows\System\kWLCEvm.exe
  C:\Windows\System\kWLCEvm.exe
  2⤵
  PID:9424
- C:\Windows\System\eKVNKqN.exe
  C:\Windows\System\eKVNKqN.exe
  2⤵
  PID:9484
- C:\Windows\System\uXwAnTi.exe
  C:\Windows\System\uXwAnTi.exe
  2⤵
  PID:9576
- C:\Windows\System\vRQauZn.exe
  C:\Windows\System\vRQauZn.exe
  2⤵
  PID:9632
- C:\Windows\System\XLWmfQI.exe
  C:\Windows\System\XLWmfQI.exe
  2⤵
  PID:9716
- C:\Windows\System\SptGPuR.exe
  C:\Windows\System\SptGPuR.exe
  2⤵
  PID:9776
- C:\Windows\System\tTTamRS.exe
  C:\Windows\System\tTTamRS.exe
  2⤵
  PID:9892
- C:\Windows\System\ENWtqFj.exe
  C:\Windows\System\ENWtqFj.exe
  2⤵
  PID:4752
- C:\Windows\System\WHsFZAe.exe
  C:\Windows\System\WHsFZAe.exe
  2⤵
  PID:10004
- C:\Windows\System\snjitIJ.exe
  C:\Windows\System\snjitIJ.exe
  2⤵
  PID:9804
- C:\Windows\System\PuUgdAg.exe
  C:\Windows\System\PuUgdAg.exe
  2⤵
  PID:10120
- C:\Windows\System\oujDpGa.exe
  C:\Windows\System\oujDpGa.exe
  2⤵
  PID:10224
- C:\Windows\System\wunOQKr.exe
  C:\Windows\System\wunOQKr.exe
  2⤵
  PID:10168
- C:\Windows\System\qsUbBwr.exe
  C:\Windows\System\qsUbBwr.exe
  2⤵
  PID:9480
- C:\Windows\System\cCSWgIq.exe
  C:\Windows\System\cCSWgIq.exe
  2⤵
  PID:9292
- C:\Windows\System\JGmfAGV.exe
  C:\Windows\System\JGmfAGV.exe
  2⤵
  PID:9744
- C:\Windows\System\bMTKWSa.exe
  C:\Windows\System\bMTKWSa.exe
  2⤵
  PID:9412
- C:\Windows\System\LCGnoWk.exe
  C:\Windows\System\LCGnoWk.exe
  2⤵
  PID:10080
- C:\Windows\System\lEldVaK.exe
  C:\Windows\System\lEldVaK.exe
  2⤵
  PID:10064
- C:\Windows\System\MJxtzsS.exe
  C:\Windows\System\MJxtzsS.exe
  2⤵
  PID:8372
- C:\Windows\System\KJYptfb.exe
  C:\Windows\System\KJYptfb.exe
  2⤵
  PID:10148
- C:\Windows\System\NYYTJso.exe
  C:\Windows\System\NYYTJso.exe
  2⤵
  PID:10272
- C:\Windows\System\EgSAFkA.exe
  C:\Windows\System\EgSAFkA.exe
  2⤵
  PID:10296
- C:\Windows\System\eFFuxwG.exe
  C:\Windows\System\eFFuxwG.exe
  2⤵
  PID:10320
- C:\Windows\System\CcKzbGI.exe
  C:\Windows\System\CcKzbGI.exe
  2⤵
  PID:10344
- C:\Windows\System\BwGsflB.exe
  C:\Windows\System\BwGsflB.exe
  2⤵
  PID:10360
- C:\Windows\System\uJMQyAd.exe
  C:\Windows\System\uJMQyAd.exe
  2⤵
  PID:10388
- C:\Windows\System\JBqRTmI.exe
  C:\Windows\System\JBqRTmI.exe
  2⤵
  PID:10416
- C:\Windows\System\CNguDBa.exe
  C:\Windows\System\CNguDBa.exe
  2⤵
  PID:10448
- C:\Windows\System\KgDOOTU.exe
  C:\Windows\System\KgDOOTU.exe
  2⤵
  PID:10472
- C:\Windows\System\ApVFnxr.exe
  C:\Windows\System\ApVFnxr.exe
  2⤵
  PID:10504
- C:\Windows\System\fefuBVQ.exe
  C:\Windows\System\fefuBVQ.exe
  2⤵
  PID:10532
- C:\Windows\System\shvfdGX.exe
  C:\Windows\System\shvfdGX.exe
  2⤵
  PID:10572
- C:\Windows\System\VVYgEQB.exe
  C:\Windows\System\VVYgEQB.exe
  2⤵
  PID:10600
- C:\Windows\System\EGXFtPl.exe
  C:\Windows\System\EGXFtPl.exe
  2⤵
  PID:10624
- C:\Windows\System\EgTlVgx.exe
  C:\Windows\System\EgTlVgx.exe
  2⤵
  PID:10660
- C:\Windows\System\JtBBocO.exe
  C:\Windows\System\JtBBocO.exe
  2⤵
  PID:10680
- C:\Windows\System\eGLhRkn.exe
  C:\Windows\System\eGLhRkn.exe
  2⤵
  PID:10700
- C:\Windows\System\hUXDhBI.exe
  C:\Windows\System\hUXDhBI.exe
  2⤵
  PID:10728
- C:\Windows\System\kzfSpQJ.exe
  C:\Windows\System\kzfSpQJ.exe
  2⤵
  PID:10752
- C:\Windows\System\XOJgdXW.exe
  C:\Windows\System\XOJgdXW.exe
  2⤵
  PID:10776
- C:\Windows\System\pTFgRFQ.exe
  C:\Windows\System\pTFgRFQ.exe
  2⤵
  PID:10800
- C:\Windows\System\WlOqcHi.exe
  C:\Windows\System\WlOqcHi.exe
  2⤵
  PID:10832
- C:\Windows\System\hEYyOpk.exe
  C:\Windows\System\hEYyOpk.exe
  2⤵
  PID:10860
- C:\Windows\System\IIjOHsb.exe
  C:\Windows\System\IIjOHsb.exe
  2⤵
  PID:10888
- C:\Windows\System\nefJpAA.exe
  C:\Windows\System\nefJpAA.exe
  2⤵
  PID:10904
- C:\Windows\System\XUAGnpx.exe
  C:\Windows\System\XUAGnpx.exe
  2⤵
  PID:10932
- C:\Windows\System\dvNlXLa.exe
  C:\Windows\System\dvNlXLa.exe
  2⤵
  PID:10964
- C:\Windows\System\pFqzvYS.exe
  C:\Windows\System\pFqzvYS.exe
  2⤵
  PID:10988
- C:\Windows\System\yNRdlsL.exe
  C:\Windows\System\yNRdlsL.exe
  2⤵
  PID:11016
- C:\Windows\System\aUeIxtD.exe
  C:\Windows\System\aUeIxtD.exe
  2⤵
  PID:11036
- C:\Windows\System\iQOPqly.exe
  C:\Windows\System\iQOPqly.exe
  2⤵
  PID:11060
- C:\Windows\System\hiQHCOi.exe
  C:\Windows\System\hiQHCOi.exe
  2⤵
  PID:11088
- C:\Windows\System\mipGzxZ.exe
  C:\Windows\System\mipGzxZ.exe
  2⤵
  PID:11104
- C:\Windows\System\ntePZKa.exe
  C:\Windows\System\ntePZKa.exe
  2⤵
  PID:11128
- C:\Windows\System\ksrFWtg.exe
  C:\Windows\System\ksrFWtg.exe
  2⤵
  PID:11160
- C:\Windows\System\WLqwgXr.exe
  C:\Windows\System\WLqwgXr.exe
  2⤵
  PID:11188
- C:\Windows\System\DFXgtRU.exe
  C:\Windows\System\DFXgtRU.exe
  2⤵
  PID:11212
- C:\Windows\System\onYtyTR.exe
  C:\Windows\System\onYtyTR.exe
  2⤵
  PID:11244
- C:\Windows\System\rioEzFj.exe
  C:\Windows\System\rioEzFj.exe
  2⤵
  PID:9620
- C:\Windows\System\yBnWkPF.exe
  C:\Windows\System\yBnWkPF.exe
  2⤵
  PID:9552
- C:\Windows\System\vpyEZXi.exe
  C:\Windows\System\vpyEZXi.exe
  2⤵
  PID:10268
- C:\Windows\System\XCIfPfe.exe
  C:\Windows\System\XCIfPfe.exe
  2⤵
  PID:10152
- C:\Windows\System\PMIlOrT.exe
  C:\Windows\System\PMIlOrT.exe
  2⤵
  PID:10384
- C:\Windows\System\AQNgkQi.exe
  C:\Windows\System\AQNgkQi.exe
  2⤵
  PID:10428
- C:\Windows\System\BvfKtrZ.exe
  C:\Windows\System\BvfKtrZ.exe
  2⤵
  PID:10432
- C:\Windows\System\vHdhWVL.exe
  C:\Windows\System\vHdhWVL.exe
  2⤵
  PID:10568
- C:\Windows\System\ynINfOK.exe
  C:\Windows\System\ynINfOK.exe
  2⤵
  PID:10612
- C:\Windows\System\jOmDCAb.exe
  C:\Windows\System\jOmDCAb.exe
  2⤵
  PID:10596
- C:\Windows\System\rjEQoRF.exe
  C:\Windows\System\rjEQoRF.exe
  2⤵
  PID:10688
- C:\Windows\System\ZJxEcLh.exe
  C:\Windows\System\ZJxEcLh.exe
  2⤵
  PID:10792
- C:\Windows\System\LKhNlHj.exe
  C:\Windows\System\LKhNlHj.exe
  2⤵
  PID:10884
- C:\Windows\System\SuNwvuB.exe
  C:\Windows\System\SuNwvuB.exe
  2⤵
  PID:10916
- C:\Windows\System\NOXXHIH.exe
  C:\Windows\System\NOXXHIH.exe
  2⤵
  PID:11008
- C:\Windows\System\eeTWcyj.exe
  C:\Windows\System\eeTWcyj.exe
  2⤵
  PID:11072
- C:\Windows\System\KuBUcKT.exe
  C:\Windows\System\KuBUcKT.exe
  2⤵
  PID:11048
- C:\Windows\System\WQOdwEG.exe
  C:\Windows\System\WQOdwEG.exe
  2⤵
  PID:11208
- C:\Windows\System\yCZJPIk.exe
  C:\Windows\System\yCZJPIk.exe
  2⤵
  PID:11260
- C:\Windows\System\IszJsUU.exe
  C:\Windows\System\IszJsUU.exe
  2⤵
  PID:11044
- C:\Windows\System\YoAbhfq.exe
  C:\Windows\System\YoAbhfq.exe
  2⤵
  PID:10376
- C:\Windows\System\WssKlff.exe
  C:\Windows\System\WssKlff.exe
  2⤵
  PID:9668
- C:\Windows\System\pwYsKZQ.exe
  C:\Windows\System\pwYsKZQ.exe
  2⤵
  PID:10396
- C:\Windows\System\nSUICoV.exe
  C:\Windows\System\nSUICoV.exe
  2⤵
  PID:10656
- C:\Windows\System\oCnAlHr.exe
  C:\Windows\System\oCnAlHr.exe
  2⤵
  PID:10852
- C:\Windows\System\LXjViAF.exe
  C:\Windows\System\LXjViAF.exe
  2⤵
  PID:10248
- C:\Windows\System\XEyPlXf.exe
  C:\Windows\System\XEyPlXf.exe
  2⤵
  PID:11284
- C:\Windows\System\fUNIHDc.exe
  C:\Windows\System\fUNIHDc.exe
  2⤵
  PID:11316
- C:\Windows\System\QKzDQsS.exe
  C:\Windows\System\QKzDQsS.exe
  2⤵
  PID:11344
- C:\Windows\System\mSjVlJY.exe
  C:\Windows\System\mSjVlJY.exe
  2⤵
  PID:11368
- C:\Windows\System\qwjClUZ.exe
  C:\Windows\System\qwjClUZ.exe
  2⤵
  PID:11392
- C:\Windows\System\tKEbBGl.exe
  C:\Windows\System\tKEbBGl.exe
  2⤵
  PID:11416
- C:\Windows\System\fslxVPm.exe
  C:\Windows\System\fslxVPm.exe
  2⤵
  PID:11448
- C:\Windows\System\STfumZR.exe
  C:\Windows\System\STfumZR.exe
  2⤵
  PID:11476
- C:\Windows\System\MIPDsNe.exe
  C:\Windows\System\MIPDsNe.exe
  2⤵
  PID:11508
- C:\Windows\System\eoVxRJl.exe
  C:\Windows\System\eoVxRJl.exe
  2⤵
  PID:11532
- C:\Windows\System\IEkFgaw.exe
  C:\Windows\System\IEkFgaw.exe
  2⤵
  PID:11560
- C:\Windows\System\WFGKkBp.exe
  C:\Windows\System\WFGKkBp.exe
  2⤵
  PID:11592
- C:\Windows\System\sckErIg.exe
  C:\Windows\System\sckErIg.exe
  2⤵
  PID:11616
- C:\Windows\System\hcegVwM.exe
  C:\Windows\System\hcegVwM.exe
  2⤵
  PID:11644
- C:\Windows\System\NHkhuHe.exe
  C:\Windows\System\NHkhuHe.exe
  2⤵
  PID:11672
- C:\Windows\System\NIwjVpO.exe
  C:\Windows\System\NIwjVpO.exe
  2⤵
  PID:11700
- C:\Windows\System\YNTFatR.exe
  C:\Windows\System\YNTFatR.exe
  2⤵
  PID:11724
- C:\Windows\System\JNFwgIP.exe
  C:\Windows\System\JNFwgIP.exe
  2⤵
  PID:11748
- C:\Windows\System\KqPKtNA.exe
  C:\Windows\System\KqPKtNA.exe
  2⤵
  PID:11764
- C:\Windows\System\jcEGURM.exe
  C:\Windows\System\jcEGURM.exe
  2⤵
  PID:11788
- C:\Windows\System\YaOiKKn.exe
  C:\Windows\System\YaOiKKn.exe
  2⤵
  PID:11808
- C:\Windows\System\jRttCqi.exe
  C:\Windows\System\jRttCqi.exe
  2⤵
  PID:11832
- C:\Windows\System\cTtmutN.exe
  C:\Windows\System\cTtmutN.exe
  2⤵
  PID:11856
- C:\Windows\System\xocYnVU.exe
  C:\Windows\System\xocYnVU.exe
  2⤵
  PID:11888
- C:\Windows\System\LLSbAcN.exe
  C:\Windows\System\LLSbAcN.exe
  2⤵
  PID:11908
- C:\Windows\System\UziKasg.exe
  C:\Windows\System\UziKasg.exe
  2⤵
  PID:11932
- C:\Windows\System\BdvpGBz.exe
  C:\Windows\System\BdvpGBz.exe
  2⤵
  PID:11972
- C:\Windows\System\SOUllLY.exe
  C:\Windows\System\SOUllLY.exe
  2⤵
  PID:11992
- C:\Windows\System\cEBRjCm.exe
  C:\Windows\System\cEBRjCm.exe
  2⤵
  PID:12016
- C:\Windows\System\rhzqijV.exe
  C:\Windows\System\rhzqijV.exe
  2⤵
  PID:12036
- C:\Windows\System\gzQfbKQ.exe
  C:\Windows\System\gzQfbKQ.exe
  2⤵
  PID:12060
- C:\Windows\System\zTegxMF.exe
  C:\Windows\System\zTegxMF.exe
  2⤵
  PID:12092
- C:\Windows\System\vbgUjKC.exe
  C:\Windows\System\vbgUjKC.exe
  2⤵
  PID:12116
- C:\Windows\System\uUoXMVK.exe
  C:\Windows\System\uUoXMVK.exe
  2⤵
  PID:12148
- C:\Windows\System\CnXkUQI.exe
  C:\Windows\System\CnXkUQI.exe
  2⤵
  PID:12168
- C:\Windows\System\mgiRzKm.exe
  C:\Windows\System\mgiRzKm.exe
  2⤵
  PID:12200
- C:\Windows\System\WFhTKpd.exe
  C:\Windows\System\WFhTKpd.exe
  2⤵
  PID:12224
- C:\Windows\System\wYIKUry.exe
  C:\Windows\System\wYIKUry.exe
  2⤵
  PID:12248
- C:\Windows\System\dbxXDiZ.exe
  C:\Windows\System\dbxXDiZ.exe
  2⤵
  PID:12276
- C:\Windows\System\uyDEXef.exe
  C:\Windows\System\uyDEXef.exe
  2⤵
  PID:11056
- C:\Windows\System\yIOZQwQ.exe
  C:\Windows\System\yIOZQwQ.exe
  2⤵
  PID:11024
- C:\Windows\System\znxkFae.exe
  C:\Windows\System\znxkFae.exe
  2⤵
  PID:11032
- C:\Windows\System\dWhJTqn.exe
  C:\Windows\System\dWhJTqn.exe
  2⤵
  PID:10292
- C:\Windows\System\qlhVOtW.exe
  C:\Windows\System\qlhVOtW.exe
  2⤵
  PID:10288
- C:\Windows\System\PQBxvCK.exe
  C:\Windows\System\PQBxvCK.exe
  2⤵
  PID:10820
- C:\Windows\System\fAWHatp.exe
  C:\Windows\System\fAWHatp.exe
  2⤵
  PID:11548
- C:\Windows\System\yjerOnU.exe
  C:\Windows\System\yjerOnU.exe
  2⤵
  PID:11440
- C:\Windows\System\NAVZlSX.exe
  C:\Windows\System\NAVZlSX.exe
  2⤵
  PID:11636
- C:\Windows\System\kAxWUBU.exe
  C:\Windows\System\kAxWUBU.exe
  2⤵
  PID:11496
- C:\Windows\System\NQpolSD.exe
  C:\Windows\System\NQpolSD.exe
  2⤵
  PID:11552
- C:\Windows\System\tnWXFvh.exe
  C:\Windows\System\tnWXFvh.exe
  2⤵
  PID:11588
- C:\Windows\System\DXfeMVg.exe
  C:\Windows\System\DXfeMVg.exe
  2⤵
  PID:11828
- C:\Windows\System\RNIpLmg.exe
  C:\Windows\System\RNIpLmg.exe
  2⤵
  PID:11916
- C:\Windows\System\IuKmkno.exe
  C:\Windows\System\IuKmkno.exe
  2⤵
  PID:12008
- C:\Windows\System\pMNoliE.exe
  C:\Windows\System\pMNoliE.exe
  2⤵
  PID:12044
- C:\Windows\System\GntuwjS.exe
  C:\Windows\System\GntuwjS.exe
  2⤵
  PID:12108
- C:\Windows\System\ieLPoct.exe
  C:\Windows\System\ieLPoct.exe
  2⤵
  PID:11960
- C:\Windows\System\UgZaPwN.exe
  C:\Windows\System\UgZaPwN.exe
  2⤵
  PID:12188
- C:\Windows\System\WmasXpE.exe
  C:\Windows\System\WmasXpE.exe
  2⤵
  PID:11804
- C:\Windows\System\pjcFKQW.exe
  C:\Windows\System\pjcFKQW.exe
  2⤵
  PID:10716
- C:\Windows\System\mxSfsva.exe
  C:\Windows\System\mxSfsva.exe
  2⤵
  PID:10492
- C:\Windows\System\PBXkfNq.exe
  C:\Windows\System\PBXkfNq.exe
  2⤵
  PID:11424
- C:\Windows\System\wqyCxqr.exe
  C:\Windows\System\wqyCxqr.exe
  2⤵
  PID:11400
- C:\Windows\System\GoNPfrx.exe
  C:\Windows\System\GoNPfrx.exe
  2⤵
  PID:12292
- C:\Windows\System\CJGzAzu.exe
  C:\Windows\System\CJGzAzu.exe
  2⤵
  PID:12320
- C:\Windows\System\vaZjHPz.exe
  C:\Windows\System\vaZjHPz.exe
  2⤵
  PID:12340
- C:\Windows\System\VTdNvWE.exe
  C:\Windows\System\VTdNvWE.exe
  2⤵
  PID:12360
- C:\Windows\System\GCeVZFv.exe
  C:\Windows\System\GCeVZFv.exe
  2⤵
  PID:12380
- C:\Windows\System\WwddxOr.exe
  C:\Windows\System\WwddxOr.exe
  2⤵
  PID:12404
- C:\Windows\System\yGQEBSo.exe
  C:\Windows\System\yGQEBSo.exe
  2⤵
  PID:12420
- C:\Windows\System\KYVAShY.exe
  C:\Windows\System\KYVAShY.exe
  2⤵
  PID:12452
- C:\Windows\System\OKVHprS.exe
  C:\Windows\System\OKVHprS.exe
  2⤵
  PID:12472
- C:\Windows\System\fPOfZyU.exe
  C:\Windows\System\fPOfZyU.exe
  2⤵
  PID:12500
- C:\Windows\System\MqTgvVy.exe
  C:\Windows\System\MqTgvVy.exe
  2⤵
  PID:12516
- C:\Windows\System\XlFGkuV.exe
  C:\Windows\System\XlFGkuV.exe
  2⤵
  PID:12536
- C:\Windows\System\qzGlOEv.exe
  C:\Windows\System\qzGlOEv.exe
  2⤵
  PID:12560
- C:\Windows\System\tTcZmdE.exe
  C:\Windows\System\tTcZmdE.exe
  2⤵
  PID:12584
- C:\Windows\System\wrQhufZ.exe
  C:\Windows\System\wrQhufZ.exe
  2⤵
  PID:12608
- C:\Windows\System\EXvtdeK.exe
  C:\Windows\System\EXvtdeK.exe
  2⤵
  PID:12636
- C:\Windows\System\lKkyPYH.exe
  C:\Windows\System\lKkyPYH.exe
  2⤵
  PID:12652
- C:\Windows\System\IfoAdnO.exe
  C:\Windows\System\IfoAdnO.exe
  2⤵
  PID:12672
- C:\Windows\System\avjwmOC.exe
  C:\Windows\System\avjwmOC.exe
  2⤵
  PID:12692
- C:\Windows\System\cNzSBMw.exe
  C:\Windows\System\cNzSBMw.exe
  2⤵
  PID:12732
- C:\Windows\System\ZUlwOEf.exe
  C:\Windows\System\ZUlwOEf.exe
  2⤵
  PID:12760
- C:\Windows\System\hxKUbBg.exe
  C:\Windows\System\hxKUbBg.exe
  2⤵
  PID:12788
- C:\Windows\System\dtoxAAk.exe
  C:\Windows\System\dtoxAAk.exe
  2⤵
  PID:12808
- C:\Windows\System\rwfaEVa.exe
  C:\Windows\System\rwfaEVa.exe
  2⤵
  PID:12840
- C:\Windows\System\tZpjTDP.exe
  C:\Windows\System\tZpjTDP.exe
  2⤵
  PID:12864
- C:\Windows\System\rGnszkK.exe
  C:\Windows\System\rGnszkK.exe
  2⤵
  PID:12892
- C:\Windows\System\ropFUuX.exe
  C:\Windows\System\ropFUuX.exe
  2⤵
  PID:12920
- C:\Windows\System\cEBbmcW.exe
  C:\Windows\System\cEBbmcW.exe
  2⤵
  PID:12936
- C:\Windows\System\jqEtKGu.exe
  C:\Windows\System\jqEtKGu.exe
  2⤵
  PID:12960
- C:\Windows\System\wPYupLj.exe
  C:\Windows\System\wPYupLj.exe
  2⤵
  PID:12992
- C:\Windows\System\zJUVULJ.exe
  C:\Windows\System\zJUVULJ.exe
  2⤵
  PID:13020
- C:\Windows\System\jTQffnr.exe
  C:\Windows\System\jTQffnr.exe
  2⤵
  PID:13048
- C:\Windows\System\UZEWBli.exe
  C:\Windows\System\UZEWBli.exe
  2⤵
  PID:13068
- C:\Windows\System\ZGxRVcT.exe
  C:\Windows\System\ZGxRVcT.exe
  2⤵
  PID:13088
- C:\Windows\System\mJfiJdx.exe
  C:\Windows\System\mJfiJdx.exe
  2⤵
  PID:13116
- C:\Windows\System\OGGxUmZ.exe
  C:\Windows\System\OGGxUmZ.exe
  2⤵
  PID:13140
- C:\Windows\System\STHFgqa.exe
  C:\Windows\System\STHFgqa.exe
  2⤵
  PID:13172
- C:\Windows\System\rVaLoLH.exe
  C:\Windows\System\rVaLoLH.exe
  2⤵
  PID:13188
- C:\Windows\System\bxgTegt.exe
  C:\Windows\System\bxgTegt.exe
  2⤵
  PID:13208
- C:\Windows\System\ovwupXT.exe
  C:\Windows\System\ovwupXT.exe
  2⤵
  PID:13228
- C:\Windows\System\tjoQfDW.exe
  C:\Windows\System\tjoQfDW.exe
  2⤵
  PID:13248
- C:\Windows\System\tlrdOpW.exe
  C:\Windows\System\tlrdOpW.exe
  2⤵
  PID:13272
- C:\Windows\System\HNnZGIJ.exe
  C:\Windows\System\HNnZGIJ.exe
  2⤵
  PID:13304
- C:\Windows\System\uPOGqPO.exe
  C:\Windows\System\uPOGqPO.exe
  2⤵
  PID:11236
- C:\Windows\System\bImSXya.exe
  C:\Windows\System\bImSXya.exe
  2⤵
  PID:11472
- C:\Windows\System\gpyMzPx.exe
  C:\Windows\System\gpyMzPx.exe
  2⤵
  PID:12160
- C:\Windows\System\yVauHDF.exe
  C:\Windows\System\yVauHDF.exe
  2⤵
  PID:11824
- C:\Windows\System\GFxsMYP.exe
  C:\Windows\System\GFxsMYP.exe
  2⤵
  PID:11876
- C:\Windows\System\JmIdKKe.exe
  C:\Windows\System\JmIdKKe.exe
  2⤵
  PID:12372
- C:\Windows\System\VCnLLQz.exe
  C:\Windows\System\VCnLLQz.exe
  2⤵
  PID:11660
- C:\Windows\System\yaTsUNC.exe
  C:\Windows\System\yaTsUNC.exe
  2⤵
  PID:12492
- C:\Windows\System\GIUGeRR.exe
  C:\Windows\System\GIUGeRR.exe
  2⤵
  PID:11240
- C:\Windows\System\pfDXbny.exe
  C:\Windows\System\pfDXbny.exe
  2⤵
  PID:11800
- C:\Windows\System\gMQYzeh.exe
  C:\Windows\System\gMQYzeh.exe
  2⤵
  PID:12336
- C:\Windows\System\sCtWVZu.exe
  C:\Windows\System\sCtWVZu.exe
  2⤵
  PID:1784
- C:\Windows\System\porDhSN.exe
  C:\Windows\System\porDhSN.exe
  2⤵
  PID:12436
- C:\Windows\System\pSHERRM.exe
  C:\Windows\System\pSHERRM.exe
  2⤵
  PID:12772
- C:\Windows\System\ekHTEgi.exe
  C:\Windows\System\ekHTEgi.exe
  2⤵
  PID:12548
- C:\Windows\System\lrdaEVO.exe
  C:\Windows\System\lrdaEVO.exe
  2⤵
  PID:12576
- C:\Windows\System\WBMXdqQ.exe
  C:\Windows\System\WBMXdqQ.exe
  2⤵
  PID:12948
- C:\Windows\System\ZfkQeRS.exe
  C:\Windows\System\ZfkQeRS.exe
  2⤵
  PID:12664
- C:\Windows\System\dSDifmR.exe
  C:\Windows\System\dSDifmR.exe
  2⤵
  PID:12412
- C:\Windows\System\yjFWVck.exe
  C:\Windows\System\yjFWVck.exe
  2⤵
  PID:13080
- C:\Windows\System\cDTPAVj.exe
  C:\Windows\System\cDTPAVj.exe
  2⤵
  PID:12776
- C:\Windows\System\JKfhKBT.exe
  C:\Windows\System\JKfhKBT.exe
  2⤵
  PID:11928
- C:\Windows\System\qhUmpGx.exe
  C:\Windows\System\qhUmpGx.exe
  2⤵
  PID:11780
- C:\Windows\System\zKreWzv.exe
  C:\Windows\System\zKreWzv.exe
  2⤵
  PID:5068
- C:\Windows\System\AMvcSjY.exe
  C:\Windows\System\AMvcSjY.exe
  2⤵
  PID:13324
- C:\Windows\System\LAetENi.exe
  C:\Windows\System\LAetENi.exe
  2⤵
  PID:13348
- C:\Windows\System\cEqytBG.exe
  C:\Windows\System\cEqytBG.exe
  2⤵
  PID:13368
- C:\Windows\System\yHEOSkr.exe
  C:\Windows\System\yHEOSkr.exe
  2⤵
  PID:13384
- C:\Windows\System\NbLqqmJ.exe
  C:\Windows\System\NbLqqmJ.exe
  2⤵
  PID:13412
- C:\Windows\System\IxTlVPI.exe
  C:\Windows\System\IxTlVPI.exe
  2⤵
  PID:13436
- C:\Windows\System\XjySMfq.exe
  C:\Windows\System\XjySMfq.exe
  2⤵
  PID:13456
- C:\Windows\System\flySXSz.exe
  C:\Windows\System\flySXSz.exe
  2⤵
  PID:13476
- C:\Windows\System\FbxQIsl.exe
  C:\Windows\System\FbxQIsl.exe
  2⤵
  PID:13500
- C:\Windows\System\ODJrrrI.exe
  C:\Windows\System\ODJrrrI.exe
  2⤵
  PID:13532
- C:\Windows\System\NDLSyFZ.exe
  C:\Windows\System\NDLSyFZ.exe
  2⤵
  PID:13556
- C:\Windows\System\mlPzXgU.exe
  C:\Windows\System\mlPzXgU.exe
  2⤵
  PID:13580
- C:\Windows\System\CHnDypy.exe
  C:\Windows\System\CHnDypy.exe
  2⤵
  PID:13600
- C:\Windows\System\TxCCddq.exe
  C:\Windows\System\TxCCddq.exe
  2⤵
  PID:13632
- C:\Windows\System\YOjvLJT.exe
  C:\Windows\System\YOjvLJT.exe
  2⤵
  PID:13648
- C:\Windows\System\HkUoThI.exe
  C:\Windows\System\HkUoThI.exe
  2⤵
  PID:13664
- C:\Windows\System\UUuEyNH.exe
  C:\Windows\System\UUuEyNH.exe
  2⤵
  PID:13696
- C:\Windows\System\znIUyXp.exe
  C:\Windows\System\znIUyXp.exe
  2⤵
  PID:13720
- C:\Windows\System\lMicBBf.exe
  C:\Windows\System\lMicBBf.exe
  2⤵
  PID:13752
- C:\Windows\System\XlbaDDD.exe
  C:\Windows\System\XlbaDDD.exe
  2⤵
  PID:13780
- C:\Windows\System\PDLFBam.exe
  C:\Windows\System\PDLFBam.exe
  2⤵
  PID:13816
- C:\Windows\System\IyJQlwA.exe
  C:\Windows\System\IyJQlwA.exe
  2⤵
  PID:13848
- C:\Windows\System\oftYssK.exe
  C:\Windows\System\oftYssK.exe
  2⤵
  PID:13876
- C:\Windows\System\mLuXJJO.exe
  C:\Windows\System\mLuXJJO.exe
  2⤵
  PID:13904
- C:\Windows\System\CCrSjuT.exe
  C:\Windows\System\CCrSjuT.exe
  2⤵
  PID:13932
- C:\Windows\System\yjBxxhb.exe
  C:\Windows\System\yjBxxhb.exe
  2⤵
  PID:13964
- C:\Windows\System\mbzUwVR.exe
  C:\Windows\System\mbzUwVR.exe
  2⤵
  PID:14000
- C:\Windows\System\KmApewC.exe
  C:\Windows\System\KmApewC.exe
  2⤵
  PID:14024
- C:\Windows\System\qaGFdEN.exe
  C:\Windows\System\qaGFdEN.exe
  2⤵
  PID:14048
- C:\Windows\System\wCeFCwg.exe
  C:\Windows\System\wCeFCwg.exe
  2⤵
  PID:14080
- C:\Windows\System\fbXRVmY.exe
  C:\Windows\System\fbXRVmY.exe
  2⤵
  PID:14100
- C:\Windows\System\GFsUSpU.exe
  C:\Windows\System\GFsUSpU.exe
  2⤵
  PID:14132
- C:\Windows\System\sWGXAtj.exe
  C:\Windows\System\sWGXAtj.exe
  2⤵
  PID:14152
- C:\Windows\System\rQmVwux.exe
  C:\Windows\System\rQmVwux.exe
  2⤵
  PID:14176
- C:\Windows\System\WhjkHML.exe
  C:\Windows\System\WhjkHML.exe
  2⤵
  PID:14208
- C:\Windows\System\QiLdBrS.exe
  C:\Windows\System\QiLdBrS.exe
  2⤵
  PID:14240
- C:\Windows\System\PkxzFRA.exe
  C:\Windows\System\PkxzFRA.exe
  2⤵
  PID:14260
- C:\Windows\System\KcQkQuX.exe
  C:\Windows\System\KcQkQuX.exe
  2⤵
  PID:14276
- C:\Windows\System\FhSYrHL.exe
  C:\Windows\System\FhSYrHL.exe
  2⤵
  PID:14300
- C:\Windows\System\wyLVNnn.exe
  C:\Windows\System\wyLVNnn.exe
  2⤵
  PID:14320
- C:\Windows\System\dNHcUeO.exe
  C:\Windows\System\dNHcUeO.exe
  2⤵
  PID:13108
- C:\Windows\System\iiFdrXB.exe
  C:\Windows\System\iiFdrXB.exe
  2⤵
  PID:13160
- C:\Windows\System\rnrwnqZ.exe
  C:\Windows\System\rnrwnqZ.exe
  2⤵
  PID:13204
- C:\Windows\System\LlCjIHD.exe
  C:\Windows\System\LlCjIHD.exe
  2⤵
  PID:12820
- C:\Windows\System\PNfoplx.exe
  C:\Windows\System\PNfoplx.exe
  2⤵
  PID:11988
- C:\Windows\System\tZjduEO.exe
  C:\Windows\System\tZjduEO.exe
  2⤵
  PID:12104
- C:\Windows\System\UrPzwMh.exe
  C:\Windows\System\UrPzwMh.exe
  2⤵
  PID:13288
- C:\Windows\System\Quazacj.exe
  C:\Windows\System\Quazacj.exe
  2⤵
  PID:13400
- C:\Windows\System\NuJKjRO.exe
  C:\Windows\System\NuJKjRO.exe
  2⤵
  PID:12396
- C:\Windows\System\ndAbByM.exe
  C:\Windows\System\ndAbByM.exe
  2⤵
  PID:12832
- C:\Windows\System\aMotvUd.exe
  C:\Windows\System\aMotvUd.exe
  2⤵
  PID:12632
- C:\Windows\System\zKjcuSG.exe
  C:\Windows\System\zKjcuSG.exe
  2⤵
  PID:13628
- C:\Windows\System\KOmOfnt.exe
  C:\Windows\System\KOmOfnt.exe
  2⤵
  PID:13148
- C:\Windows\System\XZJLaAn.exe
  C:\Windows\System\XZJLaAn.exe
  2⤵
  PID:3108
- C:\Windows\System\vggfuxa.exe
  C:\Windows\System\vggfuxa.exe
  2⤵
  PID:4268
- C:\Windows\System\anXCgyP.exe
  C:\Windows\System\anXCgyP.exe
  2⤵
  PID:12972
- C:\Windows\System\FgpusMa.exe
  C:\Windows\System\FgpusMa.exe
  2⤵
  PID:13860
- C:\Windows\System\hufZMOR.exe
  C:\Windows\System\hufZMOR.exe
  2⤵
  PID:13428
- C:\Windows\System\rkkrGTq.exe
  C:\Windows\System\rkkrGTq.exe
  2⤵
  PID:12316
- C:\Windows\System\EqDxnls.exe
  C:\Windows\System\EqDxnls.exe
  2⤵
  PID:13496
- C:\Windows\System\yDabhov.exe
  C:\Windows\System\yDabhov.exe
  2⤵
  PID:13548
- C:\Windows\System\yrlhpxO.exe
  C:\Windows\System\yrlhpxO.exe
  2⤵
  PID:14128
- C:\Windows\System\PjDYhev.exe
  C:\Windows\System\PjDYhev.exe
  2⤵
  PID:13596
- C:\Windows\System\AhvrUXN.exe
  C:\Windows\System\AhvrUXN.exe
  2⤵
  PID:13748
- C:\Windows\System\KyMxjVq.exe
  C:\Windows\System\KyMxjVq.exe
  2⤵
  PID:11744
- C:\Windows\System\gcEoapF.exe
  C:\Windows\System\gcEoapF.exe
  2⤵
  PID:13840
- C:\Windows\System\JsuQVrD.exe
  C:\Windows\System\JsuQVrD.exe
  2⤵
  PID:13380
- C:\Windows\System\ZVHhEgV.exe
  C:\Windows\System\ZVHhEgV.exe
  2⤵
  PID:12628
- C:\Windows\System\sTOrAbO.exe
  C:\Windows\System\sTOrAbO.exe
  2⤵
  PID:13688
- C:\Windows\System\EsFxOhA.exe
  C:\Windows\System\EsFxOhA.exe
  2⤵
  PID:14308
- C:\Windows\System\rqDFixX.exe
  C:\Windows\System\rqDFixX.exe
  2⤵
  PID:14352
- C:\Windows\System\TTfsBnz.exe
  C:\Windows\System\TTfsBnz.exe
  2⤵
  PID:14368
- C:\Windows\System\xRmOytu.exe
  C:\Windows\System\xRmOytu.exe
  2⤵
  PID:14396
- C:\Windows\System\fJIgSuZ.exe
  C:\Windows\System\fJIgSuZ.exe
  2⤵
  PID:14428
- C:\Windows\System\QiGBjfR.exe
  C:\Windows\System\QiGBjfR.exe
  2⤵
  PID:14456
- C:\Windows\System\SsISoQU.exe
  C:\Windows\System\SsISoQU.exe
  2⤵
  PID:14480
- C:\Windows\System\moVZqsG.exe
  C:\Windows\System\moVZqsG.exe
  2⤵
  PID:14512
- C:\Windows\System\zPxjgYT.exe
  C:\Windows\System\zPxjgYT.exe
  2⤵
  PID:14532
- C:\Windows\System\QsggXCT.exe
  C:\Windows\System\QsggXCT.exe
  2⤵
  PID:14552
- C:\Windows\System\NjKyOkN.exe
  C:\Windows\System\NjKyOkN.exe
  2⤵
  PID:14580
- C:\Windows\System\HkJiLsu.exe
  C:\Windows\System\HkJiLsu.exe
  2⤵
  PID:14612
- C:\Windows\System\NoMwSar.exe
  C:\Windows\System\NoMwSar.exe
  2⤵
  PID:14636
- C:\Windows\System\wjBxUhX.exe
  C:\Windows\System\wjBxUhX.exe
  2⤵
  PID:14664
- C:\Windows\System\PtpcDVQ.exe
  C:\Windows\System\PtpcDVQ.exe
  2⤵
  PID:14696
- C:\Windows\System\scJbZWi.exe
  C:\Windows\System\scJbZWi.exe
  2⤵
  PID:14716
- C:\Windows\System\VvExive.exe
  C:\Windows\System\VvExive.exe
  2⤵
  PID:15172
- C:\Windows\System\pCGUcFa.exe
  C:\Windows\System\pCGUcFa.exe
  2⤵
  PID:15188
- C:\Windows\System\mRUskfE.exe
  C:\Windows\System\mRUskfE.exe
  2⤵
  PID:15216
- C:\Windows\System\yVsKwRR.exe
  C:\Windows\System\yVsKwRR.exe
  2⤵
  PID:15232
- C:\Windows\System\YjREnkQ.exe
  C:\Windows\System\YjREnkQ.exe
  2⤵
  PID:15260
- C:\Windows\System\YaWTQKw.exe
  C:\Windows\System\YaWTQKw.exe
  2⤵
  PID:13492
- C:\Windows\System\rzPCVMI.exe
  C:\Windows\System\rzPCVMI.exe
  2⤵
  PID:14124
- C:\Windows\System\RHdLNhm.exe
  C:\Windows\System\RHdLNhm.exe
  2⤵
  PID:12836
- C:\Windows\System\mIHWfgp.exe
  C:\Windows\System\mIHWfgp.exe
  2⤵
  PID:14188
- C:\Windows\System\SGLlcfY.exe
  C:\Windows\System\SGLlcfY.exe
  2⤵
  PID:14268
- C:\Windows\System\XCGpQFH.exe
  C:\Windows\System\XCGpQFH.exe
  2⤵
  PID:14296
- C:\Windows\System\iZxmorY.exe
  C:\Windows\System\iZxmorY.exe
  2⤵
  PID:14464
- C:\Windows\System\tMfTTqr.exe
  C:\Windows\System\tMfTTqr.exe
  2⤵
  PID:13744
- C:\Windows\System\xVrWGKd.exe
  C:\Windows\System\xVrWGKd.exe
  2⤵
  PID:4432
- C:\Windows\System\gvyJlQg.exe
  C:\Windows\System\gvyJlQg.exe
  2⤵
  PID:14360
- C:\Windows\System\zwfoFOR.exe
  C:\Windows\System\zwfoFOR.exe
  2⤵
  PID:13364
- C:\Windows\System\ehfipnq.exe
  C:\Windows\System\ehfipnq.exe
  2⤵
  PID:14120
- C:\Windows\System\aPaWKEw.exe
  C:\Windows\System\aPaWKEw.exe
  2⤵
  PID:14592
- C:\Windows\System\WNhTnqO.exe
  C:\Windows\System\WNhTnqO.exe
  2⤵
  PID:14852
- C:\Windows\System\PfDLcAs.exe
  C:\Windows\System\PfDLcAs.exe
  2⤵
  PID:14892
- C:\Windows\System\FdKkSMU.exe
  C:\Windows\System\FdKkSMU.exe
  2⤵
  PID:14684
- C:\Windows\System\JQoWcLU.exe
  C:\Windows\System\JQoWcLU.exe
  2⤵
  PID:14964
- C:\Windows\System\fGCQXuC.exe
  C:\Windows\System\fGCQXuC.exe
  2⤵
  PID:14776
- C:\Windows\System\RPRvBDC.exe
  C:\Windows\System\RPRvBDC.exe
  2⤵
  PID:3460
- C:\Windows\System\DENvYkn.exe
  C:\Windows\System\DENvYkn.exe
  2⤵
  PID:15008
- C:\Windows\System\vlsyQEj.exe
  C:\Windows\System\vlsyQEj.exe
  2⤵
  PID:15040
- C:\Windows\System\KoTJCTF.exe
  C:\Windows\System\KoTJCTF.exe
  2⤵
  PID:15180
- C:\Windows\System\PjqMYrt.exe
  C:\Windows\System\PjqMYrt.exe
  2⤵
  PID:15224
- C:\Windows\System\GwbvVxx.exe
  C:\Windows\System\GwbvVxx.exe
  2⤵
  PID:13520
- C:\Windows\System\CbXaooW.exe
  C:\Windows\System\CbXaooW.exe
  2⤵
  PID:12980
- C:\Windows\System\cSZDMNQ.exe
  C:\Windows\System\cSZDMNQ.exe
  2⤵
  PID:14184
- C:\Windows\System\rGaDcbJ.exe
  C:\Windows\System\rGaDcbJ.exe
  2⤵
  PID:12856
- C:\Windows\System\okazNOM.exe
  C:\Windows\System\okazNOM.exe
  2⤵
  PID:15316
- C:\Windows\System\BSfejxO.exe
  C:\Windows\System\BSfejxO.exe
  2⤵
  PID:14288
- C:\Windows\System\oFqoLyr.exe
  C:\Windows\System\oFqoLyr.exe
  2⤵
  PID:14936
- C:\Windows\System\mLivclZ.exe
  C:\Windows\System\mLivclZ.exe
  2⤵
  PID:14508
- C:\Windows\System\vzHmZzY.exe
  C:\Windows\System\vzHmZzY.exe
  2⤵
  PID:14732
- C:\Windows\System\oNNNabc.exe
  C:\Windows\System\oNNNabc.exe
  2⤵
  PID:15368
- C:\Windows\System\NhFwzQG.exe
  C:\Windows\System\NhFwzQG.exe
  2⤵
  PID:15392
- C:\Windows\System\gFmmhIP.exe
  C:\Windows\System\gFmmhIP.exe
  2⤵
  PID:15408
- C:\Windows\System\ZdCKYbX.exe
  C:\Windows\System\ZdCKYbX.exe
  2⤵
  PID:15424
- C:\Windows\System\MwYNzih.exe
  C:\Windows\System\MwYNzih.exe
  2⤵
  PID:15456
- C:\Windows\System\ZxAUALI.exe
  C:\Windows\System\ZxAUALI.exe
  2⤵
  PID:15488
- C:\Windows\System\njUSUSl.exe
  C:\Windows\System\njUSUSl.exe
  2⤵
  PID:15512
- C:\Windows\System\WfsWSpz.exe
  C:\Windows\System\WfsWSpz.exe
  2⤵
  PID:15544
- C:\Windows\System\BJDKvyd.exe
  C:\Windows\System\BJDKvyd.exe
  2⤵
  PID:15560
- C:\Windows\System\iqCFWvI.exe
  C:\Windows\System\iqCFWvI.exe
  2⤵
  PID:15584
- C:\Windows\System\EKkTIlL.exe
  C:\Windows\System\EKkTIlL.exe
  2⤵
  PID:15604
- C:\Windows\System\bzadPpV.exe
  C:\Windows\System\bzadPpV.exe
  2⤵
  PID:15632
- C:\Windows\System\wzHvjiH.exe
  C:\Windows\System\wzHvjiH.exe
  2⤵
  PID:15656
- C:\Windows\System\rTiMrvL.exe
  C:\Windows\System\rTiMrvL.exe
  2⤵
  PID:15672
- C:\Windows\System\ljKWnno.exe
  C:\Windows\System\ljKWnno.exe
  2⤵
  PID:15700
- C:\Windows\System\shehzZl.exe
  C:\Windows\System\shehzZl.exe
  2⤵
  PID:15732
- C:\Windows\System\ZyIqckS.exe
  C:\Windows\System\ZyIqckS.exe
  2⤵
  PID:15752
- C:\Windows\System\FPGKXlW.exe
  C:\Windows\System\FPGKXlW.exe
  2⤵
  PID:15772
- C:\Windows\System\WncixQV.exe
  C:\Windows\System\WncixQV.exe
  2⤵
  PID:15800
- C:\Windows\System\LSDlclq.exe
  C:\Windows\System\LSDlclq.exe
  2⤵
  PID:15816
- C:\Windows\System\WMqhjIX.exe
  C:\Windows\System\WMqhjIX.exe
  2⤵
  PID:15840
- C:\Windows\System\DgNAcHi.exe
  C:\Windows\System\DgNAcHi.exe
  2⤵
  PID:15860
- C:\Windows\System\owAKdCA.exe
  C:\Windows\System\owAKdCA.exe
  2⤵
  PID:15884
- C:\Windows\System\xDiDLtg.exe
  C:\Windows\System\xDiDLtg.exe
  2⤵
  PID:15908
- C:\Windows\System\SvpDAKd.exe
  C:\Windows\System\SvpDAKd.exe
  2⤵
  PID:15928
- C:\Windows\System\qxiYzte.exe
  C:\Windows\System\qxiYzte.exe
  2⤵
  PID:15952
- C:\Windows\System\mUpQTzR.exe
  C:\Windows\System\mUpQTzR.exe
  2⤵
  PID:15972
- C:\Windows\System\FcEklvu.exe
  C:\Windows\System\FcEklvu.exe
  2⤵
  PID:16004
- C:\Windows\System\XrbaumJ.exe
  C:\Windows\System\XrbaumJ.exe
  2⤵
  PID:16020
- C:\Windows\System\SQgUmKG.exe
  C:\Windows\System\SQgUmKG.exe
  2⤵
  PID:16048
- C:\Windows\System\BoETirF.exe
  C:\Windows\System\BoETirF.exe
  2⤵
  PID:16068
- C:\Windows\System\AxluPno.exe
  C:\Windows\System\AxluPno.exe
  2⤵
  PID:16088
- C:\Windows\System\USwoYcy.exe
  C:\Windows\System\USwoYcy.exe
  2⤵
  PID:16112
- C:\Windows\System\HcLEIaF.exe
  C:\Windows\System\HcLEIaF.exe
  2⤵
  PID:16144
- C:\Windows\System\JyeYlHs.exe
  C:\Windows\System\JyeYlHs.exe
  2⤵
  PID:16160
- C:\Windows\System\rOYfVvi.exe
  C:\Windows\System\rOYfVvi.exe
  2⤵
  PID:16204
- C:\Windows\System\tohfmdM.exe
  C:\Windows\System\tohfmdM.exe
  2⤵
  PID:16220
- C:\Windows\System\FiepqdZ.exe
  C:\Windows\System\FiepqdZ.exe
  2⤵
  PID:16236
- C:\Windows\System\KZfyhDi.exe
  C:\Windows\System\KZfyhDi.exe
  2⤵
  PID:16252
- C:\Windows\System\fhxlVaF.exe
  C:\Windows\System\fhxlVaF.exe
  2⤵
  PID:16268
- C:\Windows\System\myglxbw.exe
  C:\Windows\System\myglxbw.exe
  2⤵
  PID:16292
- C:\Windows\System\Cxxahwk.exe
  C:\Windows\System\Cxxahwk.exe
  2⤵
  PID:16312
- C:\Windows\System\YCncfkp.exe
  C:\Windows\System\YCncfkp.exe
  2⤵
  PID:16328
- C:\Windows\System\EemhqjW.exe
  C:\Windows\System\EemhqjW.exe
  2⤵
  PID:16356
- C:\Windows\System\LeJjcSZ.exe
  C:\Windows\System\LeJjcSZ.exe
  2⤵
  PID:16380
- C:\Windows\System\RuJZwUv.exe
  C:\Windows\System\RuJZwUv.exe
  2⤵
  PID:14692
- C:\Windows\System\XNKIkLP.exe
  C:\Windows\System\XNKIkLP.exe
  2⤵
  PID:14976
- C:\Windows\System\VmAeTtK.exe
  C:\Windows\System\VmAeTtK.exe
  2⤵
  PID:13320
- C:\Windows\System\maAhtqL.exe
  C:\Windows\System\maAhtqL.exe
  2⤵
  PID:14624
- C:\Windows\System\avFjRir.exe
  C:\Windows\System\avFjRir.exe
  2⤵
  PID:15068
- C:\Windows\System\kImeHgP.exe
  C:\Windows\System\kImeHgP.exe
  2⤵
  PID:15292
- C:\Windows\System\XbbmyPm.exe
  C:\Windows\System\XbbmyPm.exe
  2⤵
  PID:14928
- C:\Windows\System\uCPlDol.exe
  C:\Windows\System\uCPlDol.exe
  2⤵
  PID:3352
- C:\Windows\System\BcpmyWq.exe
  C:\Windows\System\BcpmyWq.exe
  2⤵
  PID:15404
- C:\Windows\System\ABuyfYN.exe
  C:\Windows\System\ABuyfYN.exe
  2⤵
  PID:15500
- C:\Windows\System\tyYxAEm.exe
  C:\Windows\System\tyYxAEm.exe
  2⤵
  PID:14040
- C:\Windows\System\YDSluSx.exe
  C:\Windows\System\YDSluSx.exe
  2⤵
  PID:15452
- C:\Windows\System\MHGnLGD.exe
  C:\Windows\System\MHGnLGD.exe
  2⤵
  PID:15484
- C:\Windows\System\ggxAbIw.exe
  C:\Windows\System\ggxAbIw.exe
  2⤵
  PID:15552
- C:\Windows\System\TTAsUOf.exe
  C:\Windows\System\TTAsUOf.exe
  2⤵
  PID:14272
- C:\Windows\System\DmPMjiN.exe
  C:\Windows\System\DmPMjiN.exe
  2⤵
  PID:15688
- C:\Windows\System\ninKgTW.exe
  C:\Windows\System\ninKgTW.exe
  2⤵
  PID:15768
- C:\Windows\System\nSLFosm.exe
  C:\Windows\System\nSLFosm.exe
  2⤵
  PID:16084
- C:\Windows\System\IGwFpga.exe
  C:\Windows\System\IGwFpga.exe
  2⤵
  PID:16132
- C:\Windows\System\nLRQWRV.exe
  C:\Windows\System\nLRQWRV.exe
  2⤵
  PID:15904
- C:\Windows\System\YkmFClV.exe
  C:\Windows\System\YkmFClV.exe
  2⤵
  PID:15664
- C:\Windows\System\eNbUUbG.exe
  C:\Windows\System\eNbUUbG.exe
  2⤵
  PID:15960
- C:\Windows\System\PLDYcaW.exe
  C:\Windows\System\PLDYcaW.exe
  2⤵
  PID:16284
- C:\Windows\System\dSupNaH.exe
  C:\Windows\System\dSupNaH.exe
  2⤵
  PID:15748
- C:\Windows\System\nMnAbvO.exe
  C:\Windows\System\nMnAbvO.exe
  2⤵
  PID:16076
- C:\Windows\System\iNNZFJW.exe
  C:\Windows\System\iNNZFJW.exe
  2⤵
  PID:16404
- C:\Windows\System\BHlEwFh.exe
  C:\Windows\System\BHlEwFh.exe
  2⤵
  PID:16424
- C:\Windows\System\fdGapUR.exe
  C:\Windows\System\fdGapUR.exe
  2⤵
  PID:16456
- C:\Windows\System\xXcHIgU.exe
  C:\Windows\System\xXcHIgU.exe
  2⤵
  PID:16472
- C:\Windows\System\pLKHHDP.exe
  C:\Windows\System\pLKHHDP.exe
  2⤵
  PID:16488
- C:\Windows\System\tyHXFkE.exe
  C:\Windows\System\tyHXFkE.exe
  2⤵
  PID:16512
- C:\Windows\System\SekHqYw.exe
  C:\Windows\System\SekHqYw.exe
  2⤵
  PID:16536
- C:\Windows\System\EJKsGkP.exe
  C:\Windows\System\EJKsGkP.exe
  2⤵
  PID:16568
- C:\Windows\System\GVlvGjU.exe
  C:\Windows\System\GVlvGjU.exe
  2⤵
  PID:16592
- C:\Windows\System\eAhwMpe.exe
  C:\Windows\System\eAhwMpe.exe
  2⤵
  PID:16616
- C:\Windows\System\hiuvVqU.exe
  C:\Windows\System\hiuvVqU.exe
  2⤵
  PID:16636
- C:\Windows\System\HujjOVa.exe
  C:\Windows\System\HujjOVa.exe
  2⤵
  PID:16656
- C:\Windows\System\fdxiGnA.exe
  C:\Windows\System\fdxiGnA.exe
  2⤵
  PID:16688
- C:\Windows\System\klxZRly.exe
  C:\Windows\System\klxZRly.exe
  2⤵
  PID:16712
- C:\Windows\System\MlSVsSC.exe
  C:\Windows\System\MlSVsSC.exe
  2⤵
  PID:16732
- C:\Windows\System\PbPIgSr.exe
  C:\Windows\System\PbPIgSr.exe
  2⤵
  PID:16748
- C:\Windows\System\gLObIRz.exe
  C:\Windows\System\gLObIRz.exe
  2⤵
  PID:16776
- C:\Windows\System\sYaJoYp.exe
  C:\Windows\System\sYaJoYp.exe
  2⤵
  PID:16792
- C:\Windows\System\CaPSUdF.exe
  C:\Windows\System\CaPSUdF.exe
  2⤵
  PID:16816
- C:\Windows\System\jWssIoW.exe
  C:\Windows\System\jWssIoW.exe
  2⤵
  PID:16840
- C:\Windows\System\opOAEHF.exe
  C:\Windows\System\opOAEHF.exe
  2⤵
  PID:16864
- C:\Windows\System\fVGckWf.exe
  C:\Windows\System\fVGckWf.exe
  2⤵
  PID:16888
- C:\Windows\System\KzDorOB.exe
  C:\Windows\System\KzDorOB.exe
  2⤵
  PID:16904
- C:\Windows\System\Limfahw.exe
  C:\Windows\System\Limfahw.exe
  2⤵
  PID:16936
- C:\Windows\System\PnBaxbr.exe
  C:\Windows\System\PnBaxbr.exe
  2⤵
  PID:16960
- C:\Windows\System\YxwDyPg.exe
  C:\Windows\System\YxwDyPg.exe
  2⤵
  PID:16976
- C:\Windows\System\SuulZpR.exe
  C:\Windows\System\SuulZpR.exe
  2⤵
  PID:17008
- C:\Windows\System\Rtuotvr.exe
  C:\Windows\System\Rtuotvr.exe
  2⤵
  PID:17028
- C:\Windows\System\OmJnbkh.exe
  C:\Windows\System\OmJnbkh.exe
  2⤵
  PID:17052
- C:\Windows\System\zQVGLca.exe
  C:\Windows\System\zQVGLca.exe
  2⤵
  PID:17068
- C:\Windows\System\ZPoxrTf.exe
  C:\Windows\System\ZPoxrTf.exe
  2⤵
  PID:17084
- C:\Windows\System\zvshGpm.exe
  C:\Windows\System\zvshGpm.exe
  2⤵
  PID:17108
- C:\Windows\System\wVNbTJV.exe
  C:\Windows\System\wVNbTJV.exe
  2⤵
  PID:17136
- C:\Windows\System\atlGhCH.exe
  C:\Windows\System\atlGhCH.exe
  2⤵
  PID:17156
- C:\Windows\System\ZrbGJSp.exe
  C:\Windows\System\ZrbGJSp.exe
  2⤵
  PID:17176
- C:\Windows\System\fyXsiGR.exe
  C:\Windows\System\fyXsiGR.exe
  2⤵
  PID:17200
- C:\Windows\System\hepPXex.exe
  C:\Windows\System\hepPXex.exe
  2⤵
  PID:17220
- C:\Windows\System\BfVBdQw.exe
  C:\Windows\System\BfVBdQw.exe
  2⤵
  PID:17248
- C:\Windows\System\ZcUnhAp.exe
  C:\Windows\System\ZcUnhAp.exe
  2⤵
  PID:17276
- C:\Windows\System\UVOXHrh.exe
  C:\Windows\System\UVOXHrh.exe
  2⤵
  PID:17304
- C:\Windows\System\SjupJcY.exe
  C:\Windows\System\SjupJcY.exe
  2⤵
  PID:17320
- C:\Windows\System\xGgbuPw.exe
  C:\Windows\System\xGgbuPw.exe
  2⤵
  PID:17348
- C:\Windows\System\tUUMXbF.exe
  C:\Windows\System\tUUMXbF.exe
  2⤵
  PID:17372
- C:\Windows\System\zBULcth.exe
  C:\Windows\System\zBULcth.exe
  2⤵
  PID:17388
- C:\Windows\System\raEvjSQ.exe
  C:\Windows\System\raEvjSQ.exe
  2⤵
  PID:15836
- C:\Windows\System\uKUGgDr.exe
  C:\Windows\System\uKUGgDr.exe
  2⤵
  PID:16156
- C:\Windows\System\ipoCgwu.exe
  C:\Windows\System\ipoCgwu.exe
  2⤵
  PID:16228
- C:\Windows\System\MqZenhL.exe
  C:\Windows\System\MqZenhL.exe
  2⤵
  PID:16000
- C:\Windows\System\PTKSman.exe
  C:\Windows\System\PTKSman.exe
  2⤵
  PID:15580
- C:\Windows\System\yiqvGYv.exe
  C:\Windows\System\yiqvGYv.exe
  2⤵
  PID:14476
- C:\Windows\System\eeFQcDJ.exe
  C:\Windows\System\eeFQcDJ.exe
  2⤵
  PID:15024
- C:\Windows\System\nXHECZE.exe
  C:\Windows\System\nXHECZE.exe
  2⤵
  PID:16376
- C:\Windows\System\LRIgGlH.exe
  C:\Windows\System\LRIgGlH.exe
  2⤵
  PID:13576
- C:\Windows\System\tuYafcf.exe
  C:\Windows\System\tuYafcf.exe
  2⤵
  PID:16420
- C:\Windows\System\ylhpJfA.exe
  C:\Windows\System\ylhpJfA.exe
  2⤵
  PID:4620
- C:\Windows\System\GcZDAQi.exe
  C:\Windows\System\GcZDAQi.exe
  2⤵
  PID:15212
- C:\Windows\System\tVzjtFA.exe
  C:\Windows\System\tVzjtFA.exe
  2⤵
  PID:15568
- C:\Windows\System\bXMADmY.exe
  C:\Windows\System\bXMADmY.exe
  2⤵
  PID:15540
- C:\Windows\System\lZpMkVi.exe
  C:\Windows\System\lZpMkVi.exe
  2⤵
  PID:16324
- C:\Windows\System\mkPnzUG.exe
  C:\Windows\System\mkPnzUG.exe
  2⤵
  PID:15812
- C:\Windows\System\FjDZtTE.exe
  C:\Windows\System\FjDZtTE.exe
  2⤵
  PID:16784
- C:\Windows\System\QJzoBlC.exe
  C:\Windows\System\QJzoBlC.exe
  2⤵
  PID:4668
- C:\Windows\System\wCKwcaE.exe
  C:\Windows\System\wCKwcaE.exe
  2⤵
  PID:16924
- C:\Windows\System\uEQDozj.exe
  C:\Windows\System\uEQDozj.exe
  2⤵
  PID:16988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BjSoQut.exe

Filesize
1.8MB

MD5
05c2a8502010599f6473ff8d01ea2d8c

SHA1
36d717d56e8bae175e33781e1c0912773260bc9c

SHA256
fa42c1a40d20602993e4e2418452d4eb617e7dc29de7d76dd57ddca5d3e512b1

SHA512
6630b048d74566d2fed72de247a976e99fa1167bbaf5c0fa9b955adc00178a1d25155c4b371982fe4d4df354f1d0b25ac99361cff07e2cd408c93f842eb9411a

Download Submit
C:\Windows\System\CLrRYyf.exe

Filesize
1.8MB

MD5
9a74fe90ba5a972a89796708104a33fd

SHA1
35b6bede10d88cf3faa16594837f135829549336

SHA256
fa67596136cf40056266e6b70f34daf771b2896bb00a1c1ac9b800384fe2519b

SHA512
d9be09bfe9a027e60ba0146f23f1256d9c03ff2fd96de877c53e91586284558db6a45dcc68206b6198e4b19beef955885d040818f74b7102da639997c6157d25

Download Submit
C:\Windows\System\EHAoqwB.exe

Filesize
1.8MB

MD5
77550de60062ad741a8276e6871c926a

SHA1
7eb7b15c5b6862e4e387db44514355d3591d1684

SHA256
dca9c71d9b1191079df027076ddaf2f99402d8464c1109149beeb49ff528837b

SHA512
03bba29772fb7df2b0aba9fbe097c43c721de6b24418044caaa96863804159a885e3461e68346ca1b67ca78515dd160397cd0df01b35edc4a02807c074b441fe

Download Submit
C:\Windows\System\GTqpGUU.exe

Filesize
1.8MB

MD5
c49e7a016f02eaa496937158a70c538a

SHA1
f57b0490c262151da7d22b4d75b3e0df0431057f

SHA256
3c2d60620199ccc4fa0af252f7bb527059144198bdb1e92ec17650330679e1f9

SHA512
4372075978e116cb188f4526f47481246298c5ed844e3a84141292efd06fc2ecfd7acdb23fa3a83efd34eeaa5edccdb54eaa1e3ca460d8c8769a23776f6510cf

Download Submit
C:\Windows\System\HZyvPtm.exe

Filesize
1.8MB

MD5
9c47001baf49dd0eb56a9edb56c76317

SHA1
1b32ca4c7c2c059d9648457079b79051115a0378

SHA256
3706a7a5278cd501b5ae021519f9f4de2eb907e42be2ea67da77d2da01a10822

SHA512
a1be5181bb87286f4eb69bcafb462f5990d88208f34a5702eb1240f84158bf0228071a1d0048211ceaa876f402f0b72002e9bc2f5afc63c5c8c30abeaf13d037

Download Submit
C:\Windows\System\LwpSqic.exe

Filesize
1.8MB

MD5
132ed9a0f3e828667bd85eb1149e5f92

SHA1
2a486b338f6ceadae78a89f666819716127c4655

SHA256
5959237bcfe5430742def7f1d5e4273ccb88a1819979df539f14c37d25768eea

SHA512
2d783c1c7c618a76c5c2ec17c8933fd53d1fe0799123ccdee30db2363f746ff0c8c5f1f181b834e8bddb98bbaf9272d057d2454738fb2bd5141a5ca88085e9c1

Download Submit
C:\Windows\System\MjIJwrT.exe

Filesize
1.8MB

MD5
0a3e0941c6b6b305ee5d38dd86a1ad2f

SHA1
7954027e8103e4c7597b329acfe42257160178d7

SHA256
75de1d836c472cfc3ec2a4bb19efdcf7eac7cd76a618675080a2e9cd1b8d855a

SHA512
e8ba3c89ec6ac79914f68222078e641293a80e41d7a36a585173b3a4117aee1c27644629c1da7639f4e2e911e2356b87c816f4386d19363df8e9ced1df0bfbea

Download Submit
C:\Windows\System\PVqrOdu.exe

Filesize
1.8MB

MD5
c24f029553ab801cf14904bed70d6465

SHA1
688884a8d69494d1238d60ec4a8b0d73e8c67384

SHA256
d9e150a831eba858b65e0d7852237fda1839e04712d4601471d6f8cf7c900a3a

SHA512
dcd192222e3fc440d6e49da90935fd9b3e0a4985779c6068afbd9db0c762139e929391bba935ead0b15718620cbb72d37d343d6c5cf66e8c506225b17b9f000d

Download Submit
C:\Windows\System\RPhFVmI.exe

Filesize
1.8MB

MD5
75e6be92bf0879bba2931f82befaaa5b

SHA1
7dec81d81daea841d5c03a103b2b638c975e571f

SHA256
f42d1f82ca364e16d7e644556fb211fbc7e8a38bbdd7fe09a8bef63ecf753f5c

SHA512
e92f0c6fcd89c90825a547538bc8950013b4da3f77139012a74faec042676919cab3cb483222c5c80dae3a7357dc0a4a0a1559010f2ee3c43a29ef3b4a09997c

Download Submit
C:\Windows\System\UQXXECp.exe

Filesize
1.8MB

MD5
2ea67813fab4259eb8411c6afb81af76

SHA1
43b621fcc00e2e36a2bc32af25bd5237cdfbf01a

SHA256
5beda01f76a82c0458dc6258492144017ab38dd2c95d5f89fcbd50bc789a630f

SHA512
356d11a050401adef7e6c151de415f5bbcdb141e5fec92379552daa5e5dfa2792226bbf54689f70722b13ba2ebc558b704b0e33e394fbc088f2af21798e92e52

Download Submit
C:\Windows\System\UQXXECp.exe

Filesize
1.7MB

MD5
24d73cb2e3ac3bdbead790f6fd19433d

SHA1
ba5c7c780035c488ae0013034a8816312a1d3124

SHA256
9156082e7da94acccd84e33a9c1211ca2d0de20320d4003c80dc495003014a2b

SHA512
553f9db32079333c71f18eed6ad39e26c6da6147297d2e125a0f966778f5f3c88612a113d0bbad746fd446f51b06fe46234855d73a775a9b6ee669e711bc55fb

Download Submit
C:\Windows\System\UbbpGsG.exe

Filesize
1.8MB

MD5
e307c75ad70831081b2fa2d017285207

SHA1
fc7ab9d294f8cb3111ccac37dfaf65d416cc1b95

SHA256
2b6216bc125483d49e99d7ac47bb493881a32eb4b0f04df02a3f43f7d2305ac6

SHA512
869f3e66c6dd95d2f81c59d071df1baf0a3013d69c0d3aa1beb376b02e2e074fafa16e5ec0fef3683b4677ed1a30378a49d83414ccdee48b5333f0f334b00037

Download Submit
C:\Windows\System\UdTELiN.exe

Filesize
1.4MB

MD5
ce366fb5e62ff809a03225f7c01ba577

SHA1
074e2c93e7921fa79f1f095a1b0014dbf312af20

SHA256
f056bb4e6bbf1a521fcad72b0f7fdaeeafef9fc3cb97c3b36f4a32e66325a77e

SHA512
f43c4d7345d575b9dd04cc56f523c7ee7e123a2d8b57541d5d8b6684fe86a425d9f2056bc43423bce15a51f281de36b55f2fc559a7c9fa8ba695b517a4ebbbc5

Download Submit
C:\Windows\System\VOerBqo.exe

Filesize
1.8MB

MD5
22e6073c06068af484936ec3952fee9f

SHA1
52516b6ef8d70c68fb348452d90f010fa2b38e2f

SHA256
91fa03de6288e56ac8b43bd6d5499987e1a709be7f79dc4ea9af436fd9ae30df

SHA512
6ce291b1178dfba9ae5842b021034b17b06119b3d0c5df343d225d8d87b19518b0f2a1707e02b396ecaaae54627cb96a3ab7e15284b9e893597b1c664f5fbb8e

Download Submit
C:\Windows\System\VUipvfE.exe

Filesize
1.8MB

MD5
9ea4b2d6c902c498d8adb4df3fcbb5b8

SHA1
9d182e50bc3422c2ce35c1f555b4e658ef22fb0e

SHA256
f7d544812a7665e5decc00c31ac32308696d8f176dadd7042d57f708a0ee4722

SHA512
fb06b2e5393638f37d64c70ede9dc106c06272bb67c1fe72795edb25229b4664c428d1d37bba696e79d3c42a43a22d3244e13381ba44533da21854bfd1fb0e7e

Download Submit
C:\Windows\System\XyWwBOB.exe

Filesize
1.8MB

MD5
d6adddb4ed69ce284c18791fd29711d8

SHA1
2e687bfb43604cdcf65ac2fbdee0e19afb9a8467

SHA256
797f77bccac8eee0e8fb00d8d455414b5782c3a71451e5a327504578498ef350

SHA512
e78e093d7d15acfd331b982721a818bf3491f6fea46bba6d8055a9b91b24c8afd5a63ed264d645796c4bfd723b05c1721866a1157dd857073cf2a5aed7cc9af3

Download Submit
C:\Windows\System\ZOGTRsO.exe

Filesize
1.8MB

MD5
81a662a30960a30fc09fdc37355c966a

SHA1
d5c4a1950ee99fbf5aeca9253e5688e2cf08a4fd

SHA256
6c39ae22c51ef439bfe7bc51dcc29823a10c91390ae37c4f3c8afe0c6f49a99c

SHA512
dc2a8cefca827c51a329367ff9e3ac0bcbf65c5fb842ae03bdfff44ebaf7362d67e343fae28dce3ff086ca6fbfca66494a1c11191c747ff5631049e641ce8589

Download Submit
C:\Windows\System\ZwRwYJS.exe

Filesize
1.8MB

MD5
b74fd6d763cfe644a93a96c835eb28e3

SHA1
43c7b8259fbc90c61a0a97f66e19476daeac4ec1

SHA256
604362060f5f6c9aede1821b9040328e514968268d81c5365c8d503eb68a75bc

SHA512
36b72e3d51c89318c94a328ac8844c6eed1d68f8c014a00e80ea855a68fdfacc111d42c693013457811263a43f330a527c8fa6fd9e0a20ae6dc103e5d4215e8b

Download Submit
C:\Windows\System\aefvAXQ.exe

Filesize
1.8MB

MD5
3849021f98ed2996c7cbb32532613e3b

SHA1
3f066be8e8a2fa54345c92c8f2fe7ea58efc6125

SHA256
efd6d3dab2ac2347f0802a804eecd1a11bbcda90e27a963ef34ee300736a9d72

SHA512
13835312ed94e6f60cc315f8635b72c1842edfdbdefdbabf361a902bb53207a39a563a14b07c9d09933eedfda758b56ec1e5cc3f96b17e8ad9a4ea9840dfa248

Download Submit
C:\Windows\System\atxEyQU.exe

Filesize
1.8MB

MD5
48a1609afb83bca1d2f950aff92d344b

SHA1
ee62cc77848fc353f3325ac7f9c9ac3f204abb2e

SHA256
d75dd67d7d217e11adf54a0641b6251436101f68d81b083b2788de231cef08bd

SHA512
0e91bc4be868e151ba04bcb4ed087ddba24e7476ad25cddc25606ea5e602148e8467e1046d7f9e6f6e356fefb9038967a0a4eea84ecbf18351a75a9e42b151f0

Download Submit
C:\Windows\System\blxnIOO.exe

Filesize
1.8MB

MD5
1afcb191409c6d4977e652b7cadba822

SHA1
ebe74ebbd2a1e1d954f063dafff079157ea91f58

SHA256
a65f8ebf56320805c4390a54ec1c455e111582562531a172fac4dbbc07297a16

SHA512
6979bc25a3420ca06607889bb504ff0290d0fd317052cf576ef07b58655d2f03ddff5eb197376f7b2995843f789ffbb3463d99ec7fcd7daa906be78b0ad375b6

Download Submit
C:\Windows\System\cERQaun.exe

Filesize
1.8MB

MD5
03ea93a86d602eee50bc80f0d5a25916

SHA1
d1150d43c0c8b7f89adc364ce5aa5b5674040282

SHA256
56f65dd93142b950776e1bfaf9e7a9ff3ceb9cffc0526ed76a6ae8de3fef60e1

SHA512
96e1d53b73c9cb58b2a4b691c8aa8004b51628ef61d5c8d27cd1d0f2cd1051831f2ca559f96661ba3aea3ae454a67f9651d6687602850ac401fe879df946f866

Download Submit
C:\Windows\System\mZudnSZ.exe

Filesize
1.8MB

MD5
88e5a8c36270b4792b79b07f822b06aa

SHA1
7300b539b980b483684343dc3698c91a71153bd8

SHA256
d0c4e8124793bd003f338c9a538109a037adb918c8c372501813816b4e76b041

SHA512
9b018fbdf178fbdce2ecf4cd4ed0def0d20e9d48990abbd1a8136fd692d6850a853f1ad2342436dcae849067099932d46f193692aaa2952afec0da65c93c444b

Download Submit
C:\Windows\System\migOwyf.exe

Filesize
1.8MB

MD5
29eec523ce211dd21329bf7c3658bdfb

SHA1
d99f4e2d7f9687d34cd44fca45f5c8e8142f1cf1

SHA256
2ffeb03d3071650848b33f233e24bdb2209828c9c4141c9034b7afb04b9f1834

SHA512
891a30a5f38439f738d67bb5f00e5b69279ee1cf36e8f7b23751b0e51ce441d8f7c7a475aa3955b3d9c663995601c8d9a8e1e66c6bd4d0eaa31d7a673b01725c

Download Submit
C:\Windows\System\nSsuJcf.exe

Filesize
1.8MB

MD5
7096277e2f0bb9af438ea000a31d59cd

SHA1
e4cf1d8b6c29ae63abd0e00ea7ca36d70f612811

SHA256
fd91fc811e2a46180ef3243fb93c7b97edee095386a9f6177b6632ca12c0b00c

SHA512
909dd1cfd0ef8fcac4e88629adf510cd7c18a3d319317b8b09a1e75934a610e0c15f7cbf3d419fb42f6624214a65b9df0fe51a0d980269e99e2f69d14ccfe6c8

Download Submit
C:\Windows\System\oBYnMyw.exe

Filesize
1.8MB

MD5
82cba668347934fad9099992f9cdf444

SHA1
a001dd90148157571a40c8cfa915e1f8d82b13f4

SHA256
401f9afc1aeca864df21433454e61aeee940f17fa95195dda323722105f517fc

SHA512
05e44b1b530f5505ad85ef2f11b242c47bb5e321dee349502b6baa88e461495b96f73f65365ae1e0568a7107b59ac66294377adaa28256d14903eb5c9c7586a5

Download Submit
C:\Windows\System\oHfIXSM.exe

Filesize
1.8MB

MD5
d133f0a5d4d55c14d8656a200ccfb501

SHA1
97dbbcdc495a42db38d205daba3d88925e3e25b2

SHA256
6791cf4a0069f13a2f2b7c4c649548bc4a4fd652f7fa80c234c305cac8d53861

SHA512
3092d53752a337ce4139c48e517ed1c44c741061ecf6789e6638a37b4b59c4383f3189d58183aecf7dabc682773dea8d4c12efd24c57876810b80dd28b182f06

Download Submit
C:\Windows\System\sBEfnlt.exe

Filesize
1.8MB

MD5
c8211ce82f69e5c851937eb87808afe3

SHA1
39f59823a8aa9dfa042c3ca132d92397c6d869b4

SHA256
a7739d543375eeb92faa4657b6b8f4142b02f42189ff1fedc6e5130253dba658

SHA512
57d96d8d37f7536061a44a2e501d928dfc6d894fcb84248cc08c27344681882a5096b95620bc5060a773f662c945590fed7cc2364ebedb369bfec4ed30c8d952

Download Submit
C:\Windows\System\tMcUfue.exe

Filesize
1.8MB

MD5
dca21413ff817d2d63a12d1c26b8d7c6

SHA1
7fc32c0251715f8645b3bbf23fdb37dd6dae5719

SHA256
fb1c08e0e4de993f6bd385d737b4dd76e0bb82f7e03559267750e53304d86884

SHA512
4b6319f448288e0195fb3a4db11372f79d1a984006b3f9957ddafc048fc0860cc20f92792d31b4d8b1842474f4f3a4f74a8d32fb1178c8d10d5fa19a3ea28950

Download Submit
C:\Windows\System\tgffrCf.exe

Filesize
1.8MB

MD5
d62033a5cbd476b6b2a51d87c7a8584e

SHA1
d85be801ee14cec9f8e1b78356faa88d8ab6b349

SHA256
493ee554cc31ad916ac220bdb5b836254f4d5f7055dd9c171a8eb445867dd391

SHA512
cb3e0865432c25984427d6ad7a561c7e610936b76b49decc5089a19af2409f2797b7e1029425d5396cbd6e24f194fea7607103804027402d3847d8cd291611f6

Download Submit
C:\Windows\System\trPybLD.exe

Filesize
1.8MB

MD5
9b080b85a251877f3903e4c3c23b424c

SHA1
8773e796c5614101595797aebc7ab660f9bbf5bb

SHA256
adc54191d0a5e075730c4774b7d790cc15316b2415e5f99279bac8950adde61d

SHA512
94373f6d4524333106e5af4297acda6b5ccfc0866b42d68c5ec77c4b206360a371552e9fe2a9aaab467589fa63b6fa3f6bda19b1a8e6d9fd6efb112402d0cf8e

Download Submit
C:\Windows\System\uSPGEUE.exe

Filesize
1.8MB

MD5
f5d7a24b90fab5670ad966dd0e8d8aad

SHA1
188277bf047fbf144c44bc325acde69afd5b7e61

SHA256
a62b3f30bf444b14af2162e07724ec7dd89931ba5c00f0eabce6f774268a9522

SHA512
8362b8d7cbd91582175c3643e6497fe8f6f90673b43159ca6667206a4dfd72bb2a4a9a52e05730fc2037aaf63d9319ea08b25065a6583d9c67a9b3b8c04f11ae

Download Submit
C:\Windows\System\ukMVXDO.exe

Filesize
1.8MB

MD5
c0bf0ba6555ef7eb7cc95c7dca5236e5

SHA1
31f4fb1c56dfe175412ac1a1927257b6a09a33d6

SHA256
1d63d371864565559a2550651a520f7784dcd2dde6bc3a828a6d57352bcb58da

SHA512
bd81fd48f6bbb6da76b2467c93baa223dd0121ceeaa7967291705ab555e6077c2b06767d077f19d2250bfd2a72c5fc66fabd45bd4a0fd445729ecc7f1eae130a

Download Submit
C:\Windows\System\uyHKdMB.exe

Filesize
1.8MB

MD5
24235df6539f6fd527a73eca4b9292fd

SHA1
e96eccbb12f0c2f8e7d3e95f7b7cb065cab8303a

SHA256
bc91fac5ea67e338cfd7d689d0f35c96d8ca713d42e349782908c8aef05d86ee

SHA512
5f8efb7fbc295d9bae0f5d978b1dabaebddbcebf05e7accb8f0a57dfc3a68dae6fef1a3641f485c9cfc5c274340f614bcfb35f2a1ba1201c2b1a33558b27b642

Download Submit
C:\Windows\System\vDXQgut.exe

Filesize
1.8MB

MD5
b470765a153cf8bf8339c36269d1d758

SHA1
7f369aec45bfe116cd1b6864025a1f3015c78ebf

SHA256
5e45b165ae480c60ad45d4e9015cd3624a61e5cf3a8186c2c73a52c9c93dfc79

SHA512
1a95bae7594477b14a053c72f5939fd2621fc6d95db24c16d892d679c08b1e965bee73615179e78568b166852a5dad91c2c04204be3ad427fcbcf888bddbed25

Download Submit
C:\Windows\System\vabOSTV.exe

Filesize
1.8MB

MD5
fbde203b1b620699987f2f0c3ef73af9

SHA1
5ee7a6be26a5b0538d317fed9e68e600b41690ba

SHA256
1c59c4a142c9b876ae4f03a84ba05c2f589958cc6d015d9afb56527f185de4f7

SHA512
f0ef32f04fb035bb71ee5c629ccc510696712fea9a6d108bc2046ecd966fd4b0143cf0007ad756c99839a3f49bc97701597523cd1b851d58961dc5bfab91d560

Download Submit
C:\Windows\System\yrzgoIT.exe

Filesize
1.8MB

MD5
08e384722a31d80d2819428ae8e9cf36

SHA1
af474671be67ad3b99351ea2a54117ef33ff6f4e

SHA256
61b15b3898e3c42909b59f3d2d39c1bcea3620888ade30e2873dbbae97549d49

SHA512
49fb3f5ba5d180c0c8fdb8baaa27293651a1a457963642e3c039e6a4773d81331f77f551124da56832506fd8b65887b6b1652faba3eabbd820d1e6eb365d3c97

Download Submit
C:\Windows\System\zopfoqV.exe

Filesize
1.8MB

MD5
ef3a6f26b0e54b57ca0497b54a50640f

SHA1
fad8a5e50325fcb6d9c4e0ea0a6ef132afab3fcc

SHA256
5067fede31c5282943fac8e4deaa396e7362523cfae250657803673250ad59c0

SHA512
70ae5acb42ffda6092f71125af5d3cfabeafd529dd5061abae984060aba0d2880cd9e4c976f48d136ee7abf5f7c012dfb29a61627c9c4320922d7e5f234af140

Download Submit
memory/1880-0-0x0000020A7F750000-0x0000020A7F760000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads