xmrig | 87a8f412300262bb82eaf549db388f23bea369c5209e69c7601c6347f071ff37

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
Size 2.1MB
Sample240522-1ppxdsaa7x
SHA256 87a8f412300262bb82eaf549db388f23bea369c5209e69c7601c6347f071ff37
MD5 4489d9f5b3f4a67ac4ec2e5e61924ab0
SHA1 0b23f1b715cb85ac50bf4601fc7f1924b63908b6
SHA512 66114e5c5eac138da5ba2649ceb2b5695a650f9ca0111db6fed6feb2bc3ea4db0a89d3b1186ac1dce9ceb82e5bb58dcb7a56ebd347becd46ec875f0d23678f92
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6c:BemTLkNdfE0pZrQ/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1368-2-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/files/0x000f00000001226b-6.dat	xmrig
behavioral1/files/0x0036000000016c71-7.dat	xmrig
behavioral1/files/0x0008000000016d1b-9.dat	xmrig
behavioral1/files/0x0007000000016d3d-32.dat	xmrig
behavioral1/memory/2752-36-0x000000013F850000-0x000000013FBA4000-memory.dmp	xmrig
behavioral1/memory/1368-40-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/memory/2524-50-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2556-57-0x000000013F9F0000-0x000000013FD44000-memory.dmp	xmrig
behavioral1/files/0x00050000000186f1-75.dat	xmrig
behavioral1/memory/2620-77-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/files/0x0005000000019277-133.dat	xmrig
behavioral1/files/0x0005000000019457-169.dat	xmrig
behavioral1/files/0x000500000001943e-165.dat	xmrig
behavioral1/files/0x0005000000019433-161.dat	xmrig
behavioral1/files/0x00050000000193b1-157.dat	xmrig
behavioral1/files/0x00050000000193a5-153.dat	xmrig
behavioral1/files/0x0005000000019381-143.dat	xmrig
behavioral1/files/0x000500000001939f-148.dat	xmrig
behavioral1/files/0x000500000001933a-141.dat	xmrig
behavioral1/files/0x0005000000019283-137.dat	xmrig
behavioral1/files/0x0036000000016c7a-130.dat	xmrig
behavioral1/files/0x0005000000019260-122.dat	xmrig
behavioral1/files/0x000500000001923b-121.dat	xmrig
behavioral1/files/0x0006000000018bf0-120.dat	xmrig
behavioral1/files/0x0005000000018787-119.dat	xmrig
behavioral1/files/0x000500000001878d-100.dat	xmrig
behavioral1/files/0x0005000000019275-126.dat	xmrig
behavioral1/memory/2792-115-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/files/0x000500000001925d-113.dat	xmrig
behavioral1/files/0x0005000000019228-112.dat	xmrig
behavioral1/memory/2188-83-0x000000013F110000-0x000000013F464000-memory.dmp	xmrig
behavioral1/memory/1532-96-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2884-88-0x000000013F740000-0x000000013FA94000-memory.dmp	xmrig
behavioral1/files/0x000500000001873f-86.dat	xmrig
behavioral1/files/0x0005000000018739-80.dat	xmrig
behavioral1/memory/2324-76-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2952-74-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2688-71-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/1368-70-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	xmrig
behavioral1/memory/2532-69-0x000000013F450000-0x000000013F7A4000-memory.dmp	xmrig
behavioral1/files/0x00050000000186ff-66.dat	xmrig
behavioral1/files/0x0008000000016d65-60.dat	xmrig
behavioral1/files/0x0008000000016d61-54.dat	xmrig
behavioral1/memory/2792-41-0x000000013F720000-0x000000013FA74000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d4e-47.dat	xmrig
behavioral1/files/0x0007000000016d45-39.dat	xmrig
behavioral1/memory/2884-28-0x000000013F740000-0x000000013FA94000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d2c-26.dat	xmrig
behavioral1/memory/2648-22-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/memory/2324-13-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2688-12-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2532-1703-0x000000013F450000-0x000000013F7A4000-memory.dmp	xmrig
behavioral1/memory/2952-4051-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2620-4052-0x000000013F5B0000-0x000000013F904000-memory.dmp	xmrig
behavioral1/memory/1532-4056-0x000000013FC30000-0x000000013FF84000-memory.dmp	xmrig
behavioral1/memory/2188-4054-0x000000013F110000-0x000000013F464000-memory.dmp	xmrig
behavioral1/memory/2648-4058-0x000000013FC40000-0x000000013FF94000-memory.dmp	xmrig
behavioral1/memory/2688-4057-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2324-4059-0x000000013F980000-0x000000013FCD4000-memory.dmp	xmrig
behavioral1/memory/2752-4060-0x000000013F850000-0x000000013FBA4000-memory.dmp	xmrig
behavioral1/memory/2884-4061-0x000000013F740000-0x000000013FA94000-memory.dmp	xmrig
behavioral1/memory/2524-4062-0x000000013F2D0000-0x000000013F624000-memory.dmp	xmrig
behavioral1/memory/2556-4063-0x000000013F9F0000-0x000000013FD44000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2688	fsAGSWE.exe
2324	lNOfhPB.exe
2648	TKPyLLL.exe
2884	PqqFCPx.exe
2752	qhLveyZ.exe
2792	ESttnJs.exe
2524	GGwIXXD.exe
2556	kToqcDK.exe
2532	EDoxSlv.exe
2952	MFPWZGh.exe
2620	TmdyiLX.exe
2188	uoKwYBd.exe
1532	iuRZyaq.exe
1844	gieyfBK.exe
1580	HTziBXo.exe
344	PgxOrbg.exe
1504	ZjwQrJq.exe
2172	wAOmKMM.exe
1496	oSyROHC.exe
2412	BpPkyZi.exe
2192	rxujEzM.exe
1868	sTfTbZn.exe
880	xSXxKoo.exe
636	cIhUVcS.exe
996	QpAzqic.exe
2596	NLLvPaB.exe
1548	bfVqQnl.exe
1964	bevSVIL.exe
2928	xBmlFWq.exe
1668	YOgVvHv.exe
1448	VViHKxQ.exe
2568	VWItURg.exe
1708	qYJzZiB.exe
1212	AOmDfMD.exe
2464	DyCKioD.exe
788	witXVIS.exe
1220	QFZZblA.exe
1728	jZCJrkN.exe
2900	OHLTzlo.exe
1752	CqrtXlE.exe
1892	lDpAVZc.exe
1712	FmhOqBS.exe
1296	CsozXEH.exe
560	jILDeFQ.exe
1204	liDRtcb.exe
1716	xsRICWL.exe
1252	vJICtUZ.exe
864	GsnEVdt.exe
2168	THtzfwO.exe
2920	tASkxZH.exe
1224	iepNuOd.exe
2584	YbYLUkR.exe
1948	vHTmTRL.exe
2800	cbRHFVJ.exe
2148	eOMkdiK.exe
1756	tsQKQrH.exe
2140	IqZYGYw.exe
2136	UouTKee.exe
2668	SSEyZEK.exe
1444	mWjPfki.exe
2812	FZpAXKf.exe
2516	DzjRkCl.exe
2024	WmaYhDk.exe
668	pBpTiZE.exe

Loads dropped DLL 64 IoCs

pid	Process
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1368-2-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/files/0x000f00000001226b-6.dat	upx
behavioral1/files/0x0036000000016c71-7.dat	upx
behavioral1/files/0x0008000000016d1b-9.dat	upx
behavioral1/files/0x0007000000016d3d-32.dat	upx
behavioral1/memory/2752-36-0x000000013F850000-0x000000013FBA4000-memory.dmp	upx
behavioral1/memory/2524-50-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2556-57-0x000000013F9F0000-0x000000013FD44000-memory.dmp	upx
behavioral1/files/0x00050000000186f1-75.dat	upx
behavioral1/memory/2620-77-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/files/0x0005000000019277-133.dat	upx
behavioral1/files/0x0005000000019457-169.dat	upx
behavioral1/files/0x000500000001943e-165.dat	upx
behavioral1/files/0x0005000000019433-161.dat	upx
behavioral1/files/0x00050000000193b1-157.dat	upx
behavioral1/files/0x00050000000193a5-153.dat	upx
behavioral1/files/0x0005000000019381-143.dat	upx
behavioral1/files/0x000500000001939f-148.dat	upx
behavioral1/files/0x000500000001933a-141.dat	upx
behavioral1/files/0x0005000000019283-137.dat	upx
behavioral1/files/0x0036000000016c7a-130.dat	upx
behavioral1/files/0x0005000000019260-122.dat	upx
behavioral1/files/0x000500000001923b-121.dat	upx
behavioral1/files/0x0006000000018bf0-120.dat	upx
behavioral1/files/0x0005000000018787-119.dat	upx
behavioral1/files/0x000500000001878d-100.dat	upx
behavioral1/files/0x0005000000019275-126.dat	upx
behavioral1/memory/2792-115-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/files/0x000500000001925d-113.dat	upx
behavioral1/files/0x0005000000019228-112.dat	upx
behavioral1/memory/2188-83-0x000000013F110000-0x000000013F464000-memory.dmp	upx
behavioral1/memory/1532-96-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2884-88-0x000000013F740000-0x000000013FA94000-memory.dmp	upx
behavioral1/files/0x000500000001873f-86.dat	upx
behavioral1/files/0x0005000000018739-80.dat	upx
behavioral1/memory/2324-76-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2952-74-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2688-71-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/1368-70-0x000000013F3A0000-0x000000013F6F4000-memory.dmp	upx
behavioral1/memory/2532-69-0x000000013F450000-0x000000013F7A4000-memory.dmp	upx
behavioral1/files/0x00050000000186ff-66.dat	upx
behavioral1/files/0x0008000000016d65-60.dat	upx
behavioral1/files/0x0008000000016d61-54.dat	upx
behavioral1/memory/2792-41-0x000000013F720000-0x000000013FA74000-memory.dmp	upx
behavioral1/files/0x0007000000016d4e-47.dat	upx
behavioral1/files/0x0007000000016d45-39.dat	upx
behavioral1/memory/2884-28-0x000000013F740000-0x000000013FA94000-memory.dmp	upx
behavioral1/files/0x0008000000016d2c-26.dat	upx
behavioral1/memory/2648-22-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/memory/2324-13-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2688-12-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2532-1703-0x000000013F450000-0x000000013F7A4000-memory.dmp	upx
behavioral1/memory/2952-4051-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2620-4052-0x000000013F5B0000-0x000000013F904000-memory.dmp	upx
behavioral1/memory/1532-4056-0x000000013FC30000-0x000000013FF84000-memory.dmp	upx
behavioral1/memory/2188-4054-0x000000013F110000-0x000000013F464000-memory.dmp	upx
behavioral1/memory/2648-4058-0x000000013FC40000-0x000000013FF94000-memory.dmp	upx
behavioral1/memory/2688-4057-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2324-4059-0x000000013F980000-0x000000013FCD4000-memory.dmp	upx
behavioral1/memory/2752-4060-0x000000013F850000-0x000000013FBA4000-memory.dmp	upx
behavioral1/memory/2884-4061-0x000000013F740000-0x000000013FA94000-memory.dmp	upx
behavioral1/memory/2524-4062-0x000000013F2D0000-0x000000013F624000-memory.dmp	upx
behavioral1/memory/2556-4063-0x000000013F9F0000-0x000000013FD44000-memory.dmp	upx
behavioral1/memory/2792-4064-0x000000013F720000-0x000000013FA74000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gJeOAWI.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\lqsbZvm.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\lNOfhPB.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\KoBvkiA.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\WQToGTB.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\tYvvraw.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\eseWEGU.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ZmRXPuW.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\bntRKZb.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\UouTKee.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\KSzXmbm.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\KFEVoFT.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\jwOCAjq.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\yGIuqxP.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\RRekipD.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\UqyBxYz.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\waHJddY.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\qGLXDIo.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\XkCXhNq.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\nFtDhps.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MKOnCpP.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MNkCMob.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\fwrYPbE.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\eZPsxJU.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\suqlNto.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\DXOgVHs.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\tsQKQrH.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MDrAKkA.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ggjEVaa.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\DIATCwP.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\OSGIzIL.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MUsniDp.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\nzpjiYV.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\ppnyzBF.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\jXbguqN.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\sBQFeud.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\oGxJZnk.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\lElctqF.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\drRHjVq.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\aRRuTyR.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\QWwaGkb.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\WnYzDNm.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\asAARyA.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\wZlPYnv.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\vucdHxH.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\vxeorrV.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\zguvquz.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\SraxJiL.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\rNRDLcF.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\VmmBaTr.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\GjKiMFu.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\madiyAT.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\lftCSVs.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\DnlbZJt.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\mbRzrgO.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\TLlXPHF.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\FvezJKh.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\JlNRXMz.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\smpOepx.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\zVoDpaj.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\SIwEgTe.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\VjKkJzI.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\wvWHkpp.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
File created	C:\Windows\System\MbeCoFU.exe	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2688	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2688	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2688	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	29
PID 1368 wrote to memory of 2324	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2324	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2324	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	30
PID 1368 wrote to memory of 2648	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	31
PID 1368 wrote to memory of 2648	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	31
PID 1368 wrote to memory of 2648	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	31
PID 1368 wrote to memory of 2884	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	32
PID 1368 wrote to memory of 2884	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	32
PID 1368 wrote to memory of 2884	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	32
PID 1368 wrote to memory of 2752	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	33
PID 1368 wrote to memory of 2752	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	33
PID 1368 wrote to memory of 2752	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	33
PID 1368 wrote to memory of 2792	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	34
PID 1368 wrote to memory of 2792	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	34
PID 1368 wrote to memory of 2792	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	34
PID 1368 wrote to memory of 2524	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	35
PID 1368 wrote to memory of 2524	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	35
PID 1368 wrote to memory of 2524	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	35
PID 1368 wrote to memory of 2556	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	36
PID 1368 wrote to memory of 2556	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	36
PID 1368 wrote to memory of 2556	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	36
PID 1368 wrote to memory of 2532	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	37
PID 1368 wrote to memory of 2532	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	37
PID 1368 wrote to memory of 2532	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	37
PID 1368 wrote to memory of 2620	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	38
PID 1368 wrote to memory of 2620	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	38
PID 1368 wrote to memory of 2620	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	38
PID 1368 wrote to memory of 2952	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	39
PID 1368 wrote to memory of 2952	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	39
PID 1368 wrote to memory of 2952	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	39
PID 1368 wrote to memory of 2188	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	40
PID 1368 wrote to memory of 2188	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	40
PID 1368 wrote to memory of 2188	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	40
PID 1368 wrote to memory of 1532	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	41
PID 1368 wrote to memory of 1532	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	41
PID 1368 wrote to memory of 1532	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	41
PID 1368 wrote to memory of 1504	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	42
PID 1368 wrote to memory of 1504	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	42
PID 1368 wrote to memory of 1504	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	42
PID 1368 wrote to memory of 1844	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	43
PID 1368 wrote to memory of 1844	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	43
PID 1368 wrote to memory of 1844	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	43
PID 1368 wrote to memory of 2172	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	44
PID 1368 wrote to memory of 2172	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	44
PID 1368 wrote to memory of 2172	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	44
PID 1368 wrote to memory of 1580	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	45
PID 1368 wrote to memory of 1580	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	45
PID 1368 wrote to memory of 1580	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	45
PID 1368 wrote to memory of 1496	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	46
PID 1368 wrote to memory of 1496	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	46
PID 1368 wrote to memory of 1496	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	46
PID 1368 wrote to memory of 344	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	47
PID 1368 wrote to memory of 344	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	47
PID 1368 wrote to memory of 344	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	47
PID 1368 wrote to memory of 2412	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	48
PID 1368 wrote to memory of 2412	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	48
PID 1368 wrote to memory of 2412	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	48
PID 1368 wrote to memory of 2192	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	49
PID 1368 wrote to memory of 2192	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	49
PID 1368 wrote to memory of 2192	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	49
PID 1368 wrote to memory of 1868	1368	4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4489d9f5b3f4a67ac4ec2e5e61924ab0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\System\fsAGSWE.exe
  C:\Windows\System\fsAGSWE.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\lNOfhPB.exe
  C:\Windows\System\lNOfhPB.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\TKPyLLL.exe
  C:\Windows\System\TKPyLLL.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\PqqFCPx.exe
  C:\Windows\System\PqqFCPx.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\qhLveyZ.exe
  C:\Windows\System\qhLveyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\ESttnJs.exe
  C:\Windows\System\ESttnJs.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\GGwIXXD.exe
  C:\Windows\System\GGwIXXD.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\kToqcDK.exe
  C:\Windows\System\kToqcDK.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\EDoxSlv.exe
  C:\Windows\System\EDoxSlv.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\TmdyiLX.exe
  C:\Windows\System\TmdyiLX.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\MFPWZGh.exe
  C:\Windows\System\MFPWZGh.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\uoKwYBd.exe
  C:\Windows\System\uoKwYBd.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\iuRZyaq.exe
  C:\Windows\System\iuRZyaq.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ZjwQrJq.exe
  C:\Windows\System\ZjwQrJq.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\gieyfBK.exe
  C:\Windows\System\gieyfBK.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\wAOmKMM.exe
  C:\Windows\System\wAOmKMM.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\HTziBXo.exe
  C:\Windows\System\HTziBXo.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\oSyROHC.exe
  C:\Windows\System\oSyROHC.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\PgxOrbg.exe
  C:\Windows\System\PgxOrbg.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\BpPkyZi.exe
  C:\Windows\System\BpPkyZi.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\rxujEzM.exe
  C:\Windows\System\rxujEzM.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\sTfTbZn.exe
  C:\Windows\System\sTfTbZn.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\xSXxKoo.exe
  C:\Windows\System\xSXxKoo.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\cIhUVcS.exe
  C:\Windows\System\cIhUVcS.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\QpAzqic.exe
  C:\Windows\System\QpAzqic.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\bfVqQnl.exe
  C:\Windows\System\bfVqQnl.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\NLLvPaB.exe
  C:\Windows\System\NLLvPaB.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\bevSVIL.exe
  C:\Windows\System\bevSVIL.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\xBmlFWq.exe
  C:\Windows\System\xBmlFWq.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\YOgVvHv.exe
  C:\Windows\System\YOgVvHv.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VViHKxQ.exe
  C:\Windows\System\VViHKxQ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\VWItURg.exe
  C:\Windows\System\VWItURg.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\qYJzZiB.exe
  C:\Windows\System\qYJzZiB.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\AOmDfMD.exe
  C:\Windows\System\AOmDfMD.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\DyCKioD.exe
  C:\Windows\System\DyCKioD.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\witXVIS.exe
  C:\Windows\System\witXVIS.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\QFZZblA.exe
  C:\Windows\System\QFZZblA.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\jZCJrkN.exe
  C:\Windows\System\jZCJrkN.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\OHLTzlo.exe
  C:\Windows\System\OHLTzlo.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\CqrtXlE.exe
  C:\Windows\System\CqrtXlE.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\lDpAVZc.exe
  C:\Windows\System\lDpAVZc.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\FmhOqBS.exe
  C:\Windows\System\FmhOqBS.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\CsozXEH.exe
  C:\Windows\System\CsozXEH.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\jILDeFQ.exe
  C:\Windows\System\jILDeFQ.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\liDRtcb.exe
  C:\Windows\System\liDRtcb.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\xsRICWL.exe
  C:\Windows\System\xsRICWL.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\vJICtUZ.exe
  C:\Windows\System\vJICtUZ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\GsnEVdt.exe
  C:\Windows\System\GsnEVdt.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\THtzfwO.exe
  C:\Windows\System\THtzfwO.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\tASkxZH.exe
  C:\Windows\System\tASkxZH.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\iepNuOd.exe
  C:\Windows\System\iepNuOd.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\YbYLUkR.exe
  C:\Windows\System\YbYLUkR.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\vHTmTRL.exe
  C:\Windows\System\vHTmTRL.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\cbRHFVJ.exe
  C:\Windows\System\cbRHFVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\eOMkdiK.exe
  C:\Windows\System\eOMkdiK.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\tsQKQrH.exe
  C:\Windows\System\tsQKQrH.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\IqZYGYw.exe
  C:\Windows\System\IqZYGYw.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\SSEyZEK.exe
  C:\Windows\System\SSEyZEK.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\UouTKee.exe
  C:\Windows\System\UouTKee.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\DzjRkCl.exe
  C:\Windows\System\DzjRkCl.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\mWjPfki.exe
  C:\Windows\System\mWjPfki.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WmaYhDk.exe
  C:\Windows\System\WmaYhDk.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\FZpAXKf.exe
  C:\Windows\System\FZpAXKf.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\pBpTiZE.exe
  C:\Windows\System\pBpTiZE.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\lftCSVs.exe
  C:\Windows\System\lftCSVs.exe
  2⤵
  PID:1500
- C:\Windows\System\sSTKeIc.exe
  C:\Windows\System\sSTKeIc.exe
  2⤵
  PID:2012
- C:\Windows\System\gJrYIAY.exe
  C:\Windows\System\gJrYIAY.exe
  2⤵
  PID:1912
- C:\Windows\System\fFAHaYK.exe
  C:\Windows\System\fFAHaYK.exe
  2⤵
  PID:2968
- C:\Windows\System\WvolXPj.exe
  C:\Windows\System\WvolXPj.exe
  2⤵
  PID:2888
- C:\Windows\System\uvWrbvo.exe
  C:\Windows\System\uvWrbvo.exe
  2⤵
  PID:684
- C:\Windows\System\fetNgdi.exe
  C:\Windows\System\fetNgdi.exe
  2⤵
  PID:2456
- C:\Windows\System\FiatkJL.exe
  C:\Windows\System\FiatkJL.exe
  2⤵
  PID:2680
- C:\Windows\System\diTPPxA.exe
  C:\Windows\System\diTPPxA.exe
  2⤵
  PID:1228
- C:\Windows\System\XXblapa.exe
  C:\Windows\System\XXblapa.exe
  2⤵
  PID:944
- C:\Windows\System\BKsdkuN.exe
  C:\Windows\System\BKsdkuN.exe
  2⤵
  PID:888
- C:\Windows\System\qVGjJQD.exe
  C:\Windows\System\qVGjJQD.exe
  2⤵
  PID:2284
- C:\Windows\System\SFpMzRH.exe
  C:\Windows\System\SFpMzRH.exe
  2⤵
  PID:2312
- C:\Windows\System\psWsfTi.exe
  C:\Windows\System\psWsfTi.exe
  2⤵
  PID:2292
- C:\Windows\System\HlnnLJk.exe
  C:\Windows\System\HlnnLJk.exe
  2⤵
  PID:1888
- C:\Windows\System\fcveBTT.exe
  C:\Windows\System\fcveBTT.exe
  2⤵
  PID:2040
- C:\Windows\System\kVEFkOL.exe
  C:\Windows\System\kVEFkOL.exe
  2⤵
  PID:1564
- C:\Windows\System\VUVopMK.exe
  C:\Windows\System\VUVopMK.exe
  2⤵
  PID:2164
- C:\Windows\System\lFKdjrY.exe
  C:\Windows\System\lFKdjrY.exe
  2⤵
  PID:1736
- C:\Windows\System\EeHPqMs.exe
  C:\Windows\System\EeHPqMs.exe
  2⤵
  PID:2176
- C:\Windows\System\dJcTkkb.exe
  C:\Windows\System\dJcTkkb.exe
  2⤵
  PID:2316
- C:\Windows\System\iLgcmPS.exe
  C:\Windows\System\iLgcmPS.exe
  2⤵
  PID:2200
- C:\Windows\System\PDtevrD.exe
  C:\Windows\System\PDtevrD.exe
  2⤵
  PID:2728
- C:\Windows\System\TDmHSeJ.exe
  C:\Windows\System\TDmHSeJ.exe
  2⤵
  PID:2868
- C:\Windows\System\WRAOfwN.exe
  C:\Windows\System\WRAOfwN.exe
  2⤵
  PID:2388
- C:\Windows\System\KSzXmbm.exe
  C:\Windows\System\KSzXmbm.exe
  2⤵
  PID:2404
- C:\Windows\System\qGLXDIo.exe
  C:\Windows\System\qGLXDIo.exe
  2⤵
  PID:756
- C:\Windows\System\sEwgVwV.exe
  C:\Windows\System\sEwgVwV.exe
  2⤵
  PID:1744
- C:\Windows\System\HIwzIhs.exe
  C:\Windows\System\HIwzIhs.exe
  2⤵
  PID:3080
- C:\Windows\System\ZDHpnte.exe
  C:\Windows\System\ZDHpnte.exe
  2⤵
  PID:3096
- C:\Windows\System\swLvpCZ.exe
  C:\Windows\System\swLvpCZ.exe
  2⤵
  PID:3120
- C:\Windows\System\GpfnLwA.exe
  C:\Windows\System\GpfnLwA.exe
  2⤵
  PID:3136
- C:\Windows\System\GtQfcvU.exe
  C:\Windows\System\GtQfcvU.exe
  2⤵
  PID:3156
- C:\Windows\System\udqApou.exe
  C:\Windows\System\udqApou.exe
  2⤵
  PID:3172
- C:\Windows\System\vHGYaxF.exe
  C:\Windows\System\vHGYaxF.exe
  2⤵
  PID:3204
- C:\Windows\System\eLuFlrv.exe
  C:\Windows\System\eLuFlrv.exe
  2⤵
  PID:3224
- C:\Windows\System\xPHGyQp.exe
  C:\Windows\System\xPHGyQp.exe
  2⤵
  PID:3244
- C:\Windows\System\DkBMaRU.exe
  C:\Windows\System\DkBMaRU.exe
  2⤵
  PID:3264
- C:\Windows\System\nzpjiYV.exe
  C:\Windows\System\nzpjiYV.exe
  2⤵
  PID:3284
- C:\Windows\System\CIJazbq.exe
  C:\Windows\System\CIJazbq.exe
  2⤵
  PID:3304
- C:\Windows\System\mKMlXyn.exe
  C:\Windows\System\mKMlXyn.exe
  2⤵
  PID:3324
- C:\Windows\System\KFEVoFT.exe
  C:\Windows\System\KFEVoFT.exe
  2⤵
  PID:3344
- C:\Windows\System\hmSqzeC.exe
  C:\Windows\System\hmSqzeC.exe
  2⤵
  PID:3364
- C:\Windows\System\XdrrINv.exe
  C:\Windows\System\XdrrINv.exe
  2⤵
  PID:3384
- C:\Windows\System\IwSdCSY.exe
  C:\Windows\System\IwSdCSY.exe
  2⤵
  PID:3404
- C:\Windows\System\JEfXDcU.exe
  C:\Windows\System\JEfXDcU.exe
  2⤵
  PID:3424
- C:\Windows\System\vGjglUb.exe
  C:\Windows\System\vGjglUb.exe
  2⤵
  PID:3444
- C:\Windows\System\HQprSCr.exe
  C:\Windows\System\HQprSCr.exe
  2⤵
  PID:3464
- C:\Windows\System\KoBvkiA.exe
  C:\Windows\System\KoBvkiA.exe
  2⤵
  PID:3484
- C:\Windows\System\VVtBXGv.exe
  C:\Windows\System\VVtBXGv.exe
  2⤵
  PID:3504
- C:\Windows\System\XlSeVKZ.exe
  C:\Windows\System\XlSeVKZ.exe
  2⤵
  PID:3524
- C:\Windows\System\lesHseX.exe
  C:\Windows\System\lesHseX.exe
  2⤵
  PID:3544
- C:\Windows\System\mgrJyrs.exe
  C:\Windows\System\mgrJyrs.exe
  2⤵
  PID:3564
- C:\Windows\System\QlZZOOG.exe
  C:\Windows\System\QlZZOOG.exe
  2⤵
  PID:3584
- C:\Windows\System\UnCbHSD.exe
  C:\Windows\System\UnCbHSD.exe
  2⤵
  PID:3604
- C:\Windows\System\DKNXlyT.exe
  C:\Windows\System\DKNXlyT.exe
  2⤵
  PID:3624
- C:\Windows\System\OqFdIWm.exe
  C:\Windows\System\OqFdIWm.exe
  2⤵
  PID:3644
- C:\Windows\System\nGPOphm.exe
  C:\Windows\System\nGPOphm.exe
  2⤵
  PID:3664
- C:\Windows\System\mAcfoiT.exe
  C:\Windows\System\mAcfoiT.exe
  2⤵
  PID:3684
- C:\Windows\System\sNVCtbQ.exe
  C:\Windows\System\sNVCtbQ.exe
  2⤵
  PID:3704
- C:\Windows\System\QItzyIt.exe
  C:\Windows\System\QItzyIt.exe
  2⤵
  PID:3720
- C:\Windows\System\PrCCpCl.exe
  C:\Windows\System\PrCCpCl.exe
  2⤵
  PID:3736
- C:\Windows\System\GScIJiw.exe
  C:\Windows\System\GScIJiw.exe
  2⤵
  PID:3760
- C:\Windows\System\vdFFoNC.exe
  C:\Windows\System\vdFFoNC.exe
  2⤵
  PID:3776
- C:\Windows\System\SBSbwFf.exe
  C:\Windows\System\SBSbwFf.exe
  2⤵
  PID:3792
- C:\Windows\System\JQzcAII.exe
  C:\Windows\System\JQzcAII.exe
  2⤵
  PID:3808
- C:\Windows\System\EtWocRy.exe
  C:\Windows\System\EtWocRy.exe
  2⤵
  PID:3828
- C:\Windows\System\gcHiwmW.exe
  C:\Windows\System\gcHiwmW.exe
  2⤵
  PID:3844
- C:\Windows\System\lGXdkzS.exe
  C:\Windows\System\lGXdkzS.exe
  2⤵
  PID:3864
- C:\Windows\System\zIsyaGG.exe
  C:\Windows\System\zIsyaGG.exe
  2⤵
  PID:3884
- C:\Windows\System\QKzGolh.exe
  C:\Windows\System\QKzGolh.exe
  2⤵
  PID:3900
- C:\Windows\System\crHYMXe.exe
  C:\Windows\System\crHYMXe.exe
  2⤵
  PID:3916
- C:\Windows\System\SdLuqfw.exe
  C:\Windows\System\SdLuqfw.exe
  2⤵
  PID:3932
- C:\Windows\System\FncsPae.exe
  C:\Windows\System\FncsPae.exe
  2⤵
  PID:3956
- C:\Windows\System\pRZruhP.exe
  C:\Windows\System\pRZruhP.exe
  2⤵
  PID:3976
- C:\Windows\System\DSDVQFo.exe
  C:\Windows\System\DSDVQFo.exe
  2⤵
  PID:3992
- C:\Windows\System\MWJRlTd.exe
  C:\Windows\System\MWJRlTd.exe
  2⤵
  PID:4012
- C:\Windows\System\lElctqF.exe
  C:\Windows\System\lElctqF.exe
  2⤵
  PID:4032
- C:\Windows\System\tHcxeQi.exe
  C:\Windows\System\tHcxeQi.exe
  2⤵
  PID:4048
- C:\Windows\System\VRXZdlE.exe
  C:\Windows\System\VRXZdlE.exe
  2⤵
  PID:4068
- C:\Windows\System\WfCNQnd.exe
  C:\Windows\System\WfCNQnd.exe
  2⤵
  PID:4088
- C:\Windows\System\lXwKoJL.exe
  C:\Windows\System\lXwKoJL.exe
  2⤵
  PID:1856
- C:\Windows\System\FYCzOzV.exe
  C:\Windows\System\FYCzOzV.exe
  2⤵
  PID:2948
- C:\Windows\System\DnlbZJt.exe
  C:\Windows\System\DnlbZJt.exe
  2⤵
  PID:2336
- C:\Windows\System\tIFahci.exe
  C:\Windows\System\tIFahci.exe
  2⤵
  PID:824
- C:\Windows\System\zguvquz.exe
  C:\Windows\System\zguvquz.exe
  2⤵
  PID:1576
- C:\Windows\System\BvQEyUh.exe
  C:\Windows\System\BvQEyUh.exe
  2⤵
  PID:572
- C:\Windows\System\dNhlrlZ.exe
  C:\Windows\System\dNhlrlZ.exe
  2⤵
  PID:2460
- C:\Windows\System\wZxxNKR.exe
  C:\Windows\System\wZxxNKR.exe
  2⤵
  PID:1312
- C:\Windows\System\svoCYqZ.exe
  C:\Windows\System\svoCYqZ.exe
  2⤵
  PID:900
- C:\Windows\System\dqvazpo.exe
  C:\Windows\System\dqvazpo.exe
  2⤵
  PID:324
- C:\Windows\System\tGeLLLW.exe
  C:\Windows\System\tGeLLLW.exe
  2⤵
  PID:1516
- C:\Windows\System\oZafeUw.exe
  C:\Windows\System\oZafeUw.exe
  2⤵
  PID:1492
- C:\Windows\System\HwjxQmZ.exe
  C:\Windows\System\HwjxQmZ.exe
  2⤵
  PID:2500
- C:\Windows\System\ruZkmlt.exe
  C:\Windows\System\ruZkmlt.exe
  2⤵
  PID:2028
- C:\Windows\System\RSkdbWw.exe
  C:\Windows\System\RSkdbWw.exe
  2⤵
  PID:3088
- C:\Windows\System\ZxctVPj.exe
  C:\Windows\System\ZxctVPj.exe
  2⤵
  PID:3128
- C:\Windows\System\mbRzrgO.exe
  C:\Windows\System\mbRzrgO.exe
  2⤵
  PID:3164
- C:\Windows\System\mqteTdb.exe
  C:\Windows\System\mqteTdb.exe
  2⤵
  PID:3144
- C:\Windows\System\dQANOgj.exe
  C:\Windows\System\dQANOgj.exe
  2⤵
  PID:3188
- C:\Windows\System\pXQttyP.exe
  C:\Windows\System\pXQttyP.exe
  2⤵
  PID:3220
- C:\Windows\System\LWOzzOi.exe
  C:\Windows\System\LWOzzOi.exe
  2⤵
  PID:3240
- C:\Windows\System\onnrrcp.exe
  C:\Windows\System\onnrrcp.exe
  2⤵
  PID:3280
- C:\Windows\System\wfxyDEZ.exe
  C:\Windows\System\wfxyDEZ.exe
  2⤵
  PID:3276
- C:\Windows\System\HIFfDYs.exe
  C:\Windows\System\HIFfDYs.exe
  2⤵
  PID:3332
- C:\Windows\System\BRrniMK.exe
  C:\Windows\System\BRrniMK.exe
  2⤵
  PID:3360
- C:\Windows\System\KGkDMvm.exe
  C:\Windows\System\KGkDMvm.exe
  2⤵
  PID:3392
- C:\Windows\System\wyJJQny.exe
  C:\Windows\System\wyJJQny.exe
  2⤵
  PID:3420
- C:\Windows\System\FHxvMcP.exe
  C:\Windows\System\FHxvMcP.exe
  2⤵
  PID:3460
- C:\Windows\System\WgDFaQo.exe
  C:\Windows\System\WgDFaQo.exe
  2⤵
  PID:3480
- C:\Windows\System\UaTWvlY.exe
  C:\Windows\System\UaTWvlY.exe
  2⤵
  PID:2716
- C:\Windows\System\tTXFEmK.exe
  C:\Windows\System\tTXFEmK.exe
  2⤵
  PID:3536
- C:\Windows\System\SgdDEKl.exe
  C:\Windows\System\SgdDEKl.exe
  2⤵
  PID:3616
- C:\Windows\System\QGPLeCF.exe
  C:\Windows\System\QGPLeCF.exe
  2⤵
  PID:3656
- C:\Windows\System\SraxJiL.exe
  C:\Windows\System\SraxJiL.exe
  2⤵
  PID:3728
- C:\Windows\System\CIIkKqs.exe
  C:\Windows\System\CIIkKqs.exe
  2⤵
  PID:3800
- C:\Windows\System\XkCXhNq.exe
  C:\Windows\System\XkCXhNq.exe
  2⤵
  PID:3876
- C:\Windows\System\QzlMKUX.exe
  C:\Windows\System\QzlMKUX.exe
  2⤵
  PID:3940
- C:\Windows\System\KHFzDfG.exe
  C:\Windows\System\KHFzDfG.exe
  2⤵
  PID:3984
- C:\Windows\System\QWwaGkb.exe
  C:\Windows\System\QWwaGkb.exe
  2⤵
  PID:3600
- C:\Windows\System\EmjOnpg.exe
  C:\Windows\System\EmjOnpg.exe
  2⤵
  PID:4028
- C:\Windows\System\eTWAWyn.exe
  C:\Windows\System\eTWAWyn.exe
  2⤵
  PID:3716
- C:\Windows\System\XBlNvZy.exe
  C:\Windows\System\XBlNvZy.exe
  2⤵
  PID:3756
- C:\Windows\System\SbXfIGu.exe
  C:\Windows\System\SbXfIGu.exe
  2⤵
  PID:3788
- C:\Windows\System\HYThISl.exe
  C:\Windows\System\HYThISl.exe
  2⤵
  PID:904
- C:\Windows\System\hUjhEIF.exe
  C:\Windows\System\hUjhEIF.exe
  2⤵
  PID:2704
- C:\Windows\System\neQCxbc.exe
  C:\Windows\System\neQCxbc.exe
  2⤵
  PID:2436
- C:\Windows\System\niESGBq.exe
  C:\Windows\System\niESGBq.exe
  2⤵
  PID:4004
- C:\Windows\System\gjdIMEB.exe
  C:\Windows\System\gjdIMEB.exe
  2⤵
  PID:2256
- C:\Windows\System\MkeFiHM.exe
  C:\Windows\System\MkeFiHM.exe
  2⤵
  PID:3852
- C:\Windows\System\dbhWlWI.exe
  C:\Windows\System\dbhWlWI.exe
  2⤵
  PID:2956
- C:\Windows\System\lesyxuq.exe
  C:\Windows\System\lesyxuq.exe
  2⤵
  PID:4044
- C:\Windows\System\xCaXNfz.exe
  C:\Windows\System\xCaXNfz.exe
  2⤵
  PID:3928
- C:\Windows\System\dYnSSKA.exe
  C:\Windows\System\dYnSSKA.exe
  2⤵
  PID:3180
- C:\Windows\System\RdVQOei.exe
  C:\Windows\System\RdVQOei.exe
  2⤵
  PID:1256
- C:\Windows\System\VBHRkkG.exe
  C:\Windows\System\VBHRkkG.exe
  2⤵
  PID:2268
- C:\Windows\System\YwzyXaX.exe
  C:\Windows\System\YwzyXaX.exe
  2⤵
  PID:2580
- C:\Windows\System\dEQtPnz.exe
  C:\Windows\System\dEQtPnz.exe
  2⤵
  PID:3336
- C:\Windows\System\TZkoclJ.exe
  C:\Windows\System\TZkoclJ.exe
  2⤵
  PID:2328
- C:\Windows\System\rrttpnA.exe
  C:\Windows\System\rrttpnA.exe
  2⤵
  PID:3532
- C:\Windows\System\cIbsnFB.exe
  C:\Windows\System\cIbsnFB.exe
  2⤵
  PID:3032
- C:\Windows\System\uQJRBWa.exe
  C:\Windows\System\uQJRBWa.exe
  2⤵
  PID:2280
- C:\Windows\System\oJzfXoe.exe
  C:\Windows\System\oJzfXoe.exe
  2⤵
  PID:3112
- C:\Windows\System\MchWJbN.exe
  C:\Windows\System\MchWJbN.exe
  2⤵
  PID:3200
- C:\Windows\System\blSGXuG.exe
  C:\Windows\System\blSGXuG.exe
  2⤵
  PID:3260
- C:\Windows\System\yvCmrRd.exe
  C:\Windows\System\yvCmrRd.exe
  2⤵
  PID:3772
- C:\Windows\System\jYKjuin.exe
  C:\Windows\System\jYKjuin.exe
  2⤵
  PID:2672
- C:\Windows\System\qfEYmQW.exe
  C:\Windows\System\qfEYmQW.exe
  2⤵
  PID:3320
- C:\Windows\System\bcyfiEr.exe
  C:\Windows\System\bcyfiEr.exe
  2⤵
  PID:3620
- C:\Windows\System\lsSZljf.exe
  C:\Windows\System\lsSZljf.exe
  2⤵
  PID:3872
- C:\Windows\System\boAmPui.exe
  C:\Windows\System\boAmPui.exe
  2⤵
  PID:4020
- C:\Windows\System\gjcigHK.exe
  C:\Windows\System\gjcigHK.exe
  2⤵
  PID:3516
- C:\Windows\System\uIPpyTA.exe
  C:\Windows\System\uIPpyTA.exe
  2⤵
  PID:3436
- C:\Windows\System\oCggOJg.exe
  C:\Windows\System\oCggOJg.exe
  2⤵
  PID:4064
- C:\Windows\System\fEKLsal.exe
  C:\Windows\System\fEKLsal.exe
  2⤵
  PID:2832
- C:\Windows\System\eDxDkCS.exe
  C:\Windows\System\eDxDkCS.exe
  2⤵
  PID:3680
- C:\Windows\System\KYLPdbY.exe
  C:\Windows\System\KYLPdbY.exe
  2⤵
  PID:2608
- C:\Windows\System\AJEmsoW.exe
  C:\Windows\System\AJEmsoW.exe
  2⤵
  PID:3860
- C:\Windows\System\WATmCRJ.exe
  C:\Windows\System\WATmCRJ.exe
  2⤵
  PID:3892
- C:\Windows\System\OEdRHEu.exe
  C:\Windows\System\OEdRHEu.exe
  2⤵
  PID:1648
- C:\Windows\System\hAyqhsw.exe
  C:\Windows\System\hAyqhsw.exe
  2⤵
  PID:4116
- C:\Windows\System\MmQlBvb.exe
  C:\Windows\System\MmQlBvb.exe
  2⤵
  PID:4132
- C:\Windows\System\SnLpXKW.exe
  C:\Windows\System\SnLpXKW.exe
  2⤵
  PID:4148
- C:\Windows\System\dYrhOzm.exe
  C:\Windows\System\dYrhOzm.exe
  2⤵
  PID:4164
- C:\Windows\System\GQgnTkO.exe
  C:\Windows\System\GQgnTkO.exe
  2⤵
  PID:4180
- C:\Windows\System\nMMvSuE.exe
  C:\Windows\System\nMMvSuE.exe
  2⤵
  PID:4208
- C:\Windows\System\paizROg.exe
  C:\Windows\System\paizROg.exe
  2⤵
  PID:4228
- C:\Windows\System\INVpbhR.exe
  C:\Windows\System\INVpbhR.exe
  2⤵
  PID:4244
- C:\Windows\System\ZzqNVoR.exe
  C:\Windows\System\ZzqNVoR.exe
  2⤵
  PID:4264
- C:\Windows\System\LnJTMuy.exe
  C:\Windows\System\LnJTMuy.exe
  2⤵
  PID:4280
- C:\Windows\System\FfpXgFE.exe
  C:\Windows\System\FfpXgFE.exe
  2⤵
  PID:4300
- C:\Windows\System\MWHymmf.exe
  C:\Windows\System\MWHymmf.exe
  2⤵
  PID:4316
- C:\Windows\System\dALUtlP.exe
  C:\Windows\System\dALUtlP.exe
  2⤵
  PID:4336
- C:\Windows\System\iYAdrpo.exe
  C:\Windows\System\iYAdrpo.exe
  2⤵
  PID:4352
- C:\Windows\System\BmcVnAF.exe
  C:\Windows\System\BmcVnAF.exe
  2⤵
  PID:4376
- C:\Windows\System\qabmuqS.exe
  C:\Windows\System\qabmuqS.exe
  2⤵
  PID:4392
- C:\Windows\System\RDPgivi.exe
  C:\Windows\System\RDPgivi.exe
  2⤵
  PID:4452
- C:\Windows\System\kGQdRGo.exe
  C:\Windows\System\kGQdRGo.exe
  2⤵
  PID:4528
- C:\Windows\System\fmxWZFi.exe
  C:\Windows\System\fmxWZFi.exe
  2⤵
  PID:4544
- C:\Windows\System\DutNevn.exe
  C:\Windows\System\DutNevn.exe
  2⤵
  PID:4560
- C:\Windows\System\qIovETt.exe
  C:\Windows\System\qIovETt.exe
  2⤵
  PID:4576
- C:\Windows\System\QxYrQor.exe
  C:\Windows\System\QxYrQor.exe
  2⤵
  PID:4592
- C:\Windows\System\MDCQuKt.exe
  C:\Windows\System\MDCQuKt.exe
  2⤵
  PID:4608
- C:\Windows\System\ewqsPWU.exe
  C:\Windows\System\ewqsPWU.exe
  2⤵
  PID:4640
- C:\Windows\System\DJmJtnY.exe
  C:\Windows\System\DJmJtnY.exe
  2⤵
  PID:4660
- C:\Windows\System\KbfBOyx.exe
  C:\Windows\System\KbfBOyx.exe
  2⤵
  PID:4688
- C:\Windows\System\pbGphMN.exe
  C:\Windows\System\pbGphMN.exe
  2⤵
  PID:4704
- C:\Windows\System\LArBmDw.exe
  C:\Windows\System\LArBmDw.exe
  2⤵
  PID:4720
- C:\Windows\System\lJEBbpK.exe
  C:\Windows\System\lJEBbpK.exe
  2⤵
  PID:4744
- C:\Windows\System\mQpNxeQ.exe
  C:\Windows\System\mQpNxeQ.exe
  2⤵
  PID:4760
- C:\Windows\System\EtaUgXD.exe
  C:\Windows\System\EtaUgXD.exe
  2⤵
  PID:4780
- C:\Windows\System\dFaRzVG.exe
  C:\Windows\System\dFaRzVG.exe
  2⤵
  PID:4796
- C:\Windows\System\FYWCSTi.exe
  C:\Windows\System\FYWCSTi.exe
  2⤵
  PID:4816
- C:\Windows\System\BKIsgOm.exe
  C:\Windows\System\BKIsgOm.exe
  2⤵
  PID:4836
- C:\Windows\System\hXbTeGM.exe
  C:\Windows\System\hXbTeGM.exe
  2⤵
  PID:4860
- C:\Windows\System\nEOGwwI.exe
  C:\Windows\System\nEOGwwI.exe
  2⤵
  PID:4876
- C:\Windows\System\YFMMtbE.exe
  C:\Windows\System\YFMMtbE.exe
  2⤵
  PID:4896
- C:\Windows\System\rroSIFJ.exe
  C:\Windows\System\rroSIFJ.exe
  2⤵
  PID:4920
- C:\Windows\System\OAxXegX.exe
  C:\Windows\System\OAxXegX.exe
  2⤵
  PID:4936
- C:\Windows\System\oNCxgRW.exe
  C:\Windows\System\oNCxgRW.exe
  2⤵
  PID:4952
- C:\Windows\System\pGpjKuK.exe
  C:\Windows\System\pGpjKuK.exe
  2⤵
  PID:4976
- C:\Windows\System\bTwdPbW.exe
  C:\Windows\System\bTwdPbW.exe
  2⤵
  PID:4992
- C:\Windows\System\DnGLPvZ.exe
  C:\Windows\System\DnGLPvZ.exe
  2⤵
  PID:5008
- C:\Windows\System\rXcBQfv.exe
  C:\Windows\System\rXcBQfv.exe
  2⤵
  PID:5024
- C:\Windows\System\DTcPUOZ.exe
  C:\Windows\System\DTcPUOZ.exe
  2⤵
  PID:5040
- C:\Windows\System\zPCfIAH.exe
  C:\Windows\System\zPCfIAH.exe
  2⤵
  PID:5056
- C:\Windows\System\HDyWyFK.exe
  C:\Windows\System\HDyWyFK.exe
  2⤵
  PID:5072
- C:\Windows\System\mJDqlJY.exe
  C:\Windows\System\mJDqlJY.exe
  2⤵
  PID:5088
- C:\Windows\System\BWOPMmi.exe
  C:\Windows\System\BWOPMmi.exe
  2⤵
  PID:5104
- C:\Windows\System\aGPtadw.exe
  C:\Windows\System\aGPtadw.exe
  2⤵
  PID:3300
- C:\Windows\System\jaIqaqi.exe
  C:\Windows\System\jaIqaqi.exe
  2⤵
  PID:3472
- C:\Windows\System\GrsiFAZ.exe
  C:\Windows\System\GrsiFAZ.exe
  2⤵
  PID:3752
- C:\Windows\System\zJNvjbV.exe
  C:\Windows\System\zJNvjbV.exe
  2⤵
  PID:3768
- C:\Windows\System\DDTJKeH.exe
  C:\Windows\System\DDTJKeH.exe
  2⤵
  PID:3712
- C:\Windows\System\lrhpjrf.exe
  C:\Windows\System\lrhpjrf.exe
  2⤵
  PID:3836
- C:\Windows\System\akKJhFI.exe
  C:\Windows\System\akKJhFI.exe
  2⤵
  PID:4060
- C:\Windows\System\RvalhJK.exe
  C:\Windows\System\RvalhJK.exe
  2⤵
  PID:2588
- C:\Windows\System\tezklnF.exe
  C:\Windows\System\tezklnF.exe
  2⤵
  PID:1412
- C:\Windows\System\HftvIzb.exe
  C:\Windows\System\HftvIzb.exe
  2⤵
  PID:3028
- C:\Windows\System\EQqDPwh.exe
  C:\Windows\System\EQqDPwh.exe
  2⤵
  PID:3152
- C:\Windows\System\bAodvZO.exe
  C:\Windows\System\bAodvZO.exe
  2⤵
  PID:3964
- C:\Windows\System\GJHIeLX.exe
  C:\Windows\System\GJHIeLX.exe
  2⤵
  PID:4160
- C:\Windows\System\hyPAbHD.exe
  C:\Windows\System\hyPAbHD.exe
  2⤵
  PID:4204
- C:\Windows\System\JEAPPFN.exe
  C:\Windows\System\JEAPPFN.exe
  2⤵
  PID:2132
- C:\Windows\System\ZnpdqSB.exe
  C:\Windows\System\ZnpdqSB.exe
  2⤵
  PID:4236
- C:\Windows\System\cuWxbWK.exe
  C:\Windows\System\cuWxbWK.exe
  2⤵
  PID:4272
- C:\Windows\System\phoAwen.exe
  C:\Windows\System\phoAwen.exe
  2⤵
  PID:4312
- C:\Windows\System\sskZXQA.exe
  C:\Windows\System\sskZXQA.exe
  2⤵
  PID:4344
- C:\Windows\System\WnYzDNm.exe
  C:\Windows\System\WnYzDNm.exe
  2⤵
  PID:3612
- C:\Windows\System\zqrwczo.exe
  C:\Windows\System\zqrwczo.exe
  2⤵
  PID:3640
- C:\Windows\System\OEDEfRv.exe
  C:\Windows\System\OEDEfRv.exe
  2⤵
  PID:4076
- C:\Windows\System\nXwegKS.exe
  C:\Windows\System\nXwegKS.exe
  2⤵
  PID:4108
- C:\Windows\System\ulVoqdp.exe
  C:\Windows\System\ulVoqdp.exe
  2⤵
  PID:4176
- C:\Windows\System\avhKzon.exe
  C:\Windows\System\avhKzon.exe
  2⤵
  PID:4252
- C:\Windows\System\meBiNBO.exe
  C:\Windows\System\meBiNBO.exe
  2⤵
  PID:4296
- C:\Windows\System\pyrZWXI.exe
  C:\Windows\System\pyrZWXI.exe
  2⤵
  PID:4360
- C:\Windows\System\iaYEXjk.exe
  C:\Windows\System\iaYEXjk.exe
  2⤵
  PID:3592
- C:\Windows\System\PHBhvYu.exe
  C:\Windows\System\PHBhvYu.exe
  2⤵
  PID:3560
- C:\Windows\System\mlOoNUI.exe
  C:\Windows\System\mlOoNUI.exe
  2⤵
  PID:4460
- C:\Windows\System\cUypctH.exe
  C:\Windows\System\cUypctH.exe
  2⤵
  PID:4476
- C:\Windows\System\ZeaSNmZ.exe
  C:\Windows\System\ZeaSNmZ.exe
  2⤵
  PID:4496
- C:\Windows\System\TDlNJaL.exe
  C:\Windows\System\TDlNJaL.exe
  2⤵
  PID:4512
- C:\Windows\System\vrXzVgV.exe
  C:\Windows\System\vrXzVgV.exe
  2⤵
  PID:4624
- C:\Windows\System\BcMLwGi.exe
  C:\Windows\System\BcMLwGi.exe
  2⤵
  PID:4676
- C:\Windows\System\XvtSHhm.exe
  C:\Windows\System\XvtSHhm.exe
  2⤵
  PID:4712
- C:\Windows\System\APvjgVm.exe
  C:\Windows\System\APvjgVm.exe
  2⤵
  PID:4788
- C:\Windows\System\OjgtqXv.exe
  C:\Windows\System\OjgtqXv.exe
  2⤵
  PID:4908
- C:\Windows\System\DvgJIUD.exe
  C:\Windows\System\DvgJIUD.exe
  2⤵
  PID:4948
- C:\Windows\System\dcZstqc.exe
  C:\Windows\System\dcZstqc.exe
  2⤵
  PID:2416
- C:\Windows\System\psclmig.exe
  C:\Windows\System\psclmig.exe
  2⤵
  PID:5016
- C:\Windows\System\WcONkHK.exe
  C:\Windows\System\WcONkHK.exe
  2⤵
  PID:3856
- C:\Windows\System\xRcoStQ.exe
  C:\Windows\System\xRcoStQ.exe
  2⤵
  PID:2828
- C:\Windows\System\tAHBeXo.exe
  C:\Windows\System\tAHBeXo.exe
  2⤵
  PID:3076
- C:\Windows\System\YUMponT.exe
  C:\Windows\System\YUMponT.exe
  2⤵
  PID:1628
- C:\Windows\System\JhQnUTl.exe
  C:\Windows\System\JhQnUTl.exe
  2⤵
  PID:1656
- C:\Windows\System\xiPbKIj.exe
  C:\Windows\System\xiPbKIj.exe
  2⤵
  PID:3236
- C:\Windows\System\vlrNHtm.exe
  C:\Windows\System\vlrNHtm.exe
  2⤵
  PID:4104
- C:\Windows\System\smpOepx.exe
  C:\Windows\System\smpOepx.exe
  2⤵
  PID:2352
- C:\Windows\System\nAMjvid.exe
  C:\Windows\System\nAMjvid.exe
  2⤵
  PID:3580
- C:\Windows\System\wOlLsLS.exe
  C:\Windows\System\wOlLsLS.exe
  2⤵
  PID:4468
- C:\Windows\System\FFMILWr.exe
  C:\Windows\System\FFMILWr.exe
  2⤵
  PID:2772
- C:\Windows\System\tzFfVcR.exe
  C:\Windows\System\tzFfVcR.exe
  2⤵
  PID:4540
- C:\Windows\System\AHCnsUf.exe
  C:\Windows\System\AHCnsUf.exe
  2⤵
  PID:4656
- C:\Windows\System\tPdbVpM.exe
  C:\Windows\System\tPdbVpM.exe
  2⤵
  PID:4732
- C:\Windows\System\vMBQgFn.exe
  C:\Windows\System\vMBQgFn.exe
  2⤵
  PID:2760
- C:\Windows\System\rPSHwvF.exe
  C:\Windows\System\rPSHwvF.exe
  2⤵
  PID:4916
- C:\Windows\System\qPEtaWy.exe
  C:\Windows\System\qPEtaWy.exe
  2⤵
  PID:4856
- C:\Windows\System\kLEahxy.exe
  C:\Windows\System\kLEahxy.exe
  2⤵
  PID:4972
- C:\Windows\System\zBJgGjn.exe
  C:\Windows\System\zBJgGjn.exe
  2⤵
  PID:2080
- C:\Windows\System\wqJFAQH.exe
  C:\Windows\System\wqJFAQH.exe
  2⤵
  PID:1636
- C:\Windows\System\acXarUx.exe
  C:\Windows\System\acXarUx.exe
  2⤵
  PID:3048
- C:\Windows\System\KjscNiQ.exe
  C:\Windows\System\KjscNiQ.exe
  2⤵
  PID:5096
- C:\Windows\System\HzftDwJ.exe
  C:\Windows\System\HzftDwJ.exe
  2⤵
  PID:5032
- C:\Windows\System\UFPeZxN.exe
  C:\Windows\System\UFPeZxN.exe
  2⤵
  PID:4964
- C:\Windows\System\NJeUqwD.exe
  C:\Windows\System\NJeUqwD.exe
  2⤵
  PID:3968
- C:\Windows\System\pixoLtn.exe
  C:\Windows\System\pixoLtn.exe
  2⤵
  PID:3396
- C:\Windows\System\KVUdYTU.exe
  C:\Windows\System\KVUdYTU.exe
  2⤵
  PID:3104
- C:\Windows\System\pXglZKW.exe
  C:\Windows\System\pXglZKW.exe
  2⤵
  PID:1464
- C:\Windows\System\gjDNogT.exe
  C:\Windows\System\gjDNogT.exe
  2⤵
  PID:4172
- C:\Windows\System\WunYjXH.exe
  C:\Windows\System\WunYjXH.exe
  2⤵
  PID:4372
- C:\Windows\System\POnHGFz.exe
  C:\Windows\System\POnHGFz.exe
  2⤵
  PID:4448
- C:\Windows\System\FIJbzpS.exe
  C:\Windows\System\FIJbzpS.exe
  2⤵
  PID:4588
- C:\Windows\System\IIuepcK.exe
  C:\Windows\System\IIuepcK.exe
  2⤵
  PID:2180
- C:\Windows\System\CJDwLTv.exe
  C:\Windows\System\CJDwLTv.exe
  2⤵
  PID:4872
- C:\Windows\System\iJPBSfZ.exe
  C:\Windows\System\iJPBSfZ.exe
  2⤵
  PID:2228
- C:\Windows\System\AFnnaZP.exe
  C:\Windows\System\AFnnaZP.exe
  2⤵
  PID:2944
- C:\Windows\System\sHpnzjB.exe
  C:\Windows\System\sHpnzjB.exe
  2⤵
  PID:5084
- C:\Windows\System\qOTYbqJ.exe
  C:\Windows\System\qOTYbqJ.exe
  2⤵
  PID:3748
- C:\Windows\System\dOQgJil.exe
  C:\Windows\System\dOQgJil.exe
  2⤵
  PID:108
- C:\Windows\System\WIeNGtJ.exe
  C:\Windows\System\WIeNGtJ.exe
  2⤵
  PID:1852
- C:\Windows\System\SVtRppQ.exe
  C:\Windows\System\SVtRppQ.exe
  2⤵
  PID:480
- C:\Windows\System\rnlLLGG.exe
  C:\Windows\System\rnlLLGG.exe
  2⤵
  PID:4128
- C:\Windows\System\UYWjmuX.exe
  C:\Windows\System\UYWjmuX.exe
  2⤵
  PID:4220
- C:\Windows\System\HzfJTGb.exe
  C:\Windows\System\HzfJTGb.exe
  2⤵
  PID:4672
- C:\Windows\System\nXEyaeM.exe
  C:\Windows\System\nXEyaeM.exe
  2⤵
  PID:4328
- C:\Windows\System\rMGxcTg.exe
  C:\Windows\System\rMGxcTg.exe
  2⤵
  PID:4632
- C:\Windows\System\gyJjMwc.exe
  C:\Windows\System\gyJjMwc.exe
  2⤵
  PID:4884
- C:\Windows\System\PEZYNSZ.exe
  C:\Windows\System\PEZYNSZ.exe
  2⤵
  PID:4648
- C:\Windows\System\qaIThey.exe
  C:\Windows\System\qaIThey.exe
  2⤵
  PID:4968
- C:\Windows\System\dlsUYRo.exe
  C:\Windows\System\dlsUYRo.exe
  2⤵
  PID:4776
- C:\Windows\System\Vqwexny.exe
  C:\Windows\System\Vqwexny.exe
  2⤵
  PID:3212
- C:\Windows\System\UaMdgNY.exe
  C:\Windows\System\UaMdgNY.exe
  2⤵
  PID:2432
- C:\Windows\System\zUqkZCK.exe
  C:\Windows\System\zUqkZCK.exe
  2⤵
  PID:2612
- C:\Windows\System\lfpDCAh.exe
  C:\Windows\System\lfpDCAh.exe
  2⤵
  PID:2216
- C:\Windows\System\ZBigTzI.exe
  C:\Windows\System\ZBigTzI.exe
  2⤵
  PID:3412
- C:\Windows\System\kVxUACY.exe
  C:\Windows\System\kVxUACY.exe
  2⤵
  PID:1976
- C:\Windows\System\EhYhJKS.exe
  C:\Windows\System\EhYhJKS.exe
  2⤵
  PID:4552
- C:\Windows\System\epUtFeY.exe
  C:\Windows\System\epUtFeY.exe
  2⤵
  PID:4584
- C:\Windows\System\rTpoaej.exe
  C:\Windows\System\rTpoaej.exe
  2⤵
  PID:5036
- C:\Windows\System\wYLnaAF.exe
  C:\Windows\System\wYLnaAF.exe
  2⤵
  PID:4828
- C:\Windows\System\BOvHhiZ.exe
  C:\Windows\System\BOvHhiZ.exe
  2⤵
  PID:3452
- C:\Windows\System\CURdSlj.exe
  C:\Windows\System\CURdSlj.exe
  2⤵
  PID:5112
- C:\Windows\System\EmuXvSX.exe
  C:\Windows\System\EmuXvSX.exe
  2⤵
  PID:4620
- C:\Windows\System\aOjXjSE.exe
  C:\Windows\System\aOjXjSE.exe
  2⤵
  PID:1540
- C:\Windows\System\FVhuLBY.exe
  C:\Windows\System\FVhuLBY.exe
  2⤵
  PID:2008
- C:\Windows\System\uhOXAlc.exe
  C:\Windows\System\uhOXAlc.exe
  2⤵
  PID:1452
- C:\Windows\System\PcSWJds.exe
  C:\Windows\System\PcSWJds.exe
  2⤵
  PID:4504
- C:\Windows\System\CEAihls.exe
  C:\Windows\System\CEAihls.exe
  2⤵
  PID:2512
- C:\Windows\System\KMoeviD.exe
  C:\Windows\System\KMoeviD.exe
  2⤵
  PID:4768
- C:\Windows\System\QkYvcLe.exe
  C:\Windows\System\QkYvcLe.exe
  2⤵
  PID:4156
- C:\Windows\System\JWdoRUi.exe
  C:\Windows\System\JWdoRUi.exe
  2⤵
  PID:4944
- C:\Windows\System\iPWKVsW.exe
  C:\Windows\System\iPWKVsW.exe
  2⤵
  PID:4200
- C:\Windows\System\TDgOMVg.exe
  C:\Windows\System\TDgOMVg.exe
  2⤵
  PID:3476
- C:\Windows\System\hnZEzkn.exe
  C:\Windows\System\hnZEzkn.exe
  2⤵
  PID:2072
- C:\Windows\System\ImcbIxf.exe
  C:\Windows\System\ImcbIxf.exe
  2⤵
  PID:2692
- C:\Windows\System\rGQpgKI.exe
  C:\Windows\System\rGQpgKI.exe
  2⤵
  PID:2572
- C:\Windows\System\lxUTQCe.exe
  C:\Windows\System\lxUTQCe.exe
  2⤵
  PID:4224
- C:\Windows\System\gCCIxWj.exe
  C:\Windows\System\gCCIxWj.exe
  2⤵
  PID:3356
- C:\Windows\System\VdlJLFI.exe
  C:\Windows\System\VdlJLFI.exe
  2⤵
  PID:1664
- C:\Windows\System\GpgUsfK.exe
  C:\Windows\System\GpgUsfK.exe
  2⤵
  PID:1932
- C:\Windows\System\SkwGcYE.exe
  C:\Windows\System\SkwGcYE.exe
  2⤵
  PID:2780
- C:\Windows\System\xqCvQsj.exe
  C:\Windows\System\xqCvQsj.exe
  2⤵
  PID:1436
- C:\Windows\System\FQhDoAZ.exe
  C:\Windows\System\FQhDoAZ.exe
  2⤵
  PID:1428
- C:\Windows\System\JhsEzyj.exe
  C:\Windows\System\JhsEzyj.exe
  2⤵
  PID:1144
- C:\Windows\System\FlxTytH.exe
  C:\Windows\System\FlxTytH.exe
  2⤵
  PID:4144
- C:\Windows\System\LzcFJzQ.exe
  C:\Windows\System\LzcFJzQ.exe
  2⤵
  PID:1956
- C:\Windows\System\NAKvgPH.exe
  C:\Windows\System\NAKvgPH.exe
  2⤵
  PID:2392
- C:\Windows\System\AvuChRO.exe
  C:\Windows\System\AvuChRO.exe
  2⤵
  PID:4928
- C:\Windows\System\efXEmbc.exe
  C:\Windows\System\efXEmbc.exe
  2⤵
  PID:4852
- C:\Windows\System\ANrOyNx.exe
  C:\Windows\System\ANrOyNx.exe
  2⤵
  PID:2960
- C:\Windows\System\OianRdc.exe
  C:\Windows\System\OianRdc.exe
  2⤵
  PID:2372
- C:\Windows\System\nyPqGQP.exe
  C:\Windows\System\nyPqGQP.exe
  2⤵
  PID:4740
- C:\Windows\System\KantsfJ.exe
  C:\Windows\System\KantsfJ.exe
  2⤵
  PID:4192
- C:\Windows\System\YikQYIz.exe
  C:\Windows\System\YikQYIz.exe
  2⤵
  PID:2244
- C:\Windows\System\asAARyA.exe
  C:\Windows\System\asAARyA.exe
  2⤵
  PID:5052
- C:\Windows\System\PPmpWWF.exe
  C:\Windows\System\PPmpWWF.exe
  2⤵
  PID:3676
- C:\Windows\System\kPaDusf.exe
  C:\Windows\System\kPaDusf.exe
  2⤵
  PID:2520
- C:\Windows\System\bJSaGwo.exe
  C:\Windows\System\bJSaGwo.exe
  2⤵
  PID:4600
- C:\Windows\System\TdRAdEJ.exe
  C:\Windows\System\TdRAdEJ.exe
  2⤵
  PID:352
- C:\Windows\System\WBAaZfm.exe
  C:\Windows\System\WBAaZfm.exe
  2⤵
  PID:4988
- C:\Windows\System\Pnzrlki.exe
  C:\Windows\System\Pnzrlki.exe
  2⤵
  PID:4844
- C:\Windows\System\GRRcDTu.exe
  C:\Windows\System\GRRcDTu.exe
  2⤵
  PID:2480
- C:\Windows\System\ZBhrvss.exe
  C:\Windows\System\ZBhrvss.exe
  2⤵
  PID:1864
- C:\Windows\System\jwOCAjq.exe
  C:\Windows\System\jwOCAjq.exe
  2⤵
  PID:1032
- C:\Windows\System\FfkZqBr.exe
  C:\Windows\System\FfkZqBr.exe
  2⤵
  PID:4932
- C:\Windows\System\rOwYRVi.exe
  C:\Windows\System\rOwYRVi.exe
  2⤵
  PID:2604
- C:\Windows\System\IegwhHx.exe
  C:\Windows\System\IegwhHx.exe
  2⤵
  PID:4484
- C:\Windows\System\PsEXVGW.exe
  C:\Windows\System\PsEXVGW.exe
  2⤵
  PID:4572
- C:\Windows\System\JFLxnBU.exe
  C:\Windows\System\JFLxnBU.exe
  2⤵
  PID:4772
- C:\Windows\System\VebQMXs.exe
  C:\Windows\System\VebQMXs.exe
  2⤵
  PID:2600
- C:\Windows\System\ZwVrthC.exe
  C:\Windows\System\ZwVrthC.exe
  2⤵
  PID:5132
- C:\Windows\System\zbkgYkI.exe
  C:\Windows\System\zbkgYkI.exe
  2⤵
  PID:5148
- C:\Windows\System\voirSRG.exe
  C:\Windows\System\voirSRG.exe
  2⤵
  PID:5164
- C:\Windows\System\aZycJlH.exe
  C:\Windows\System\aZycJlH.exe
  2⤵
  PID:5180
- C:\Windows\System\TcPvrcB.exe
  C:\Windows\System\TcPvrcB.exe
  2⤵
  PID:5196
- C:\Windows\System\hEsDYfw.exe
  C:\Windows\System\hEsDYfw.exe
  2⤵
  PID:5212
- C:\Windows\System\RTaNTOE.exe
  C:\Windows\System\RTaNTOE.exe
  2⤵
  PID:5236
- C:\Windows\System\QLXTtXl.exe
  C:\Windows\System\QLXTtXl.exe
  2⤵
  PID:5256
- C:\Windows\System\RofjbJC.exe
  C:\Windows\System\RofjbJC.exe
  2⤵
  PID:5308
- C:\Windows\System\vmblvlW.exe
  C:\Windows\System\vmblvlW.exe
  2⤵
  PID:5324
- C:\Windows\System\nFtDhps.exe
  C:\Windows\System\nFtDhps.exe
  2⤵
  PID:5340
- C:\Windows\System\AmMczQi.exe
  C:\Windows\System\AmMczQi.exe
  2⤵
  PID:5364
- C:\Windows\System\cZNlVeO.exe
  C:\Windows\System\cZNlVeO.exe
  2⤵
  PID:5380
- C:\Windows\System\kIlJCFq.exe
  C:\Windows\System\kIlJCFq.exe
  2⤵
  PID:5396
- C:\Windows\System\jJXSCyp.exe
  C:\Windows\System\jJXSCyp.exe
  2⤵
  PID:5412
- C:\Windows\System\DrJXXeY.exe
  C:\Windows\System\DrJXXeY.exe
  2⤵
  PID:5428
- C:\Windows\System\rNRDLcF.exe
  C:\Windows\System\rNRDLcF.exe
  2⤵
  PID:5448
- C:\Windows\System\FqigUtm.exe
  C:\Windows\System\FqigUtm.exe
  2⤵
  PID:5464
- C:\Windows\System\SlTPSzX.exe
  C:\Windows\System\SlTPSzX.exe
  2⤵
  PID:5484
- C:\Windows\System\wZlPYnv.exe
  C:\Windows\System\wZlPYnv.exe
  2⤵
  PID:5500
- C:\Windows\System\zfUfsKk.exe
  C:\Windows\System\zfUfsKk.exe
  2⤵
  PID:5520
- C:\Windows\System\gAdfkUJ.exe
  C:\Windows\System\gAdfkUJ.exe
  2⤵
  PID:5536
- C:\Windows\System\bCBOAWn.exe
  C:\Windows\System\bCBOAWn.exe
  2⤵
  PID:5556
- C:\Windows\System\EwvmiGC.exe
  C:\Windows\System\EwvmiGC.exe
  2⤵
  PID:5572
- C:\Windows\System\rSVgqsR.exe
  C:\Windows\System\rSVgqsR.exe
  2⤵
  PID:5588
- C:\Windows\System\SZBZbaT.exe
  C:\Windows\System\SZBZbaT.exe
  2⤵
  PID:5604
- C:\Windows\System\lrvfVAr.exe
  C:\Windows\System\lrvfVAr.exe
  2⤵
  PID:5620
- C:\Windows\System\rkWfISL.exe
  C:\Windows\System\rkWfISL.exe
  2⤵
  PID:5636
- C:\Windows\System\RpwIlUU.exe
  C:\Windows\System\RpwIlUU.exe
  2⤵
  PID:5652
- C:\Windows\System\yoMnshG.exe
  C:\Windows\System\yoMnshG.exe
  2⤵
  PID:5668
- C:\Windows\System\DmMbCqQ.exe
  C:\Windows\System\DmMbCqQ.exe
  2⤵
  PID:5684
- C:\Windows\System\GvTISNP.exe
  C:\Windows\System\GvTISNP.exe
  2⤵
  PID:5700
- C:\Windows\System\iiysVGs.exe
  C:\Windows\System\iiysVGs.exe
  2⤵
  PID:5804
- C:\Windows\System\zVoDpaj.exe
  C:\Windows\System\zVoDpaj.exe
  2⤵
  PID:5820
- C:\Windows\System\FzgRnKT.exe
  C:\Windows\System\FzgRnKT.exe
  2⤵
  PID:5836
- C:\Windows\System\tlMhyFU.exe
  C:\Windows\System\tlMhyFU.exe
  2⤵
  PID:5852
- C:\Windows\System\KcbNqwR.exe
  C:\Windows\System\KcbNqwR.exe
  2⤵
  PID:5868
- C:\Windows\System\mDlAgNZ.exe
  C:\Windows\System\mDlAgNZ.exe
  2⤵
  PID:5888
- C:\Windows\System\VJRgsgB.exe
  C:\Windows\System\VJRgsgB.exe
  2⤵
  PID:5908
- C:\Windows\System\rgAldoa.exe
  C:\Windows\System\rgAldoa.exe
  2⤵
  PID:5924
- C:\Windows\System\XQSGzMd.exe
  C:\Windows\System\XQSGzMd.exe
  2⤵
  PID:5940
- C:\Windows\System\KWYpkQd.exe
  C:\Windows\System\KWYpkQd.exe
  2⤵
  PID:5956
- C:\Windows\System\MKOnCpP.exe
  C:\Windows\System\MKOnCpP.exe
  2⤵
  PID:5972
- C:\Windows\System\QozisZW.exe
  C:\Windows\System\QozisZW.exe
  2⤵
  PID:5988
- C:\Windows\System\lILavEl.exe
  C:\Windows\System\lILavEl.exe
  2⤵
  PID:6004
- C:\Windows\System\aYrvOTM.exe
  C:\Windows\System\aYrvOTM.exe
  2⤵
  PID:6020
- C:\Windows\System\FMXiign.exe
  C:\Windows\System\FMXiign.exe
  2⤵
  PID:6036
- C:\Windows\System\MDrAKkA.exe
  C:\Windows\System\MDrAKkA.exe
  2⤵
  PID:6052
- C:\Windows\System\dSXDilz.exe
  C:\Windows\System\dSXDilz.exe
  2⤵
  PID:6068
- C:\Windows\System\rIfVJfd.exe
  C:\Windows\System\rIfVJfd.exe
  2⤵
  PID:6084
- C:\Windows\System\SXabvLg.exe
  C:\Windows\System\SXabvLg.exe
  2⤵
  PID:6100
- C:\Windows\System\xdWEnud.exe
  C:\Windows\System\xdWEnud.exe
  2⤵
  PID:5160
- C:\Windows\System\OGvuMau.exe
  C:\Windows\System\OGvuMau.exe
  2⤵
  PID:492
- C:\Windows\System\cotSdUA.exe
  C:\Windows\System\cotSdUA.exe
  2⤵
  PID:5048
- C:\Windows\System\qEKzUPK.exe
  C:\Windows\System\qEKzUPK.exe
  2⤵
  PID:1796
- C:\Windows\System\jyCWsUd.exe
  C:\Windows\System\jyCWsUd.exe
  2⤵
  PID:5172
- C:\Windows\System\ZrLkTsf.exe
  C:\Windows\System\ZrLkTsf.exe
  2⤵
  PID:5188
- C:\Windows\System\aCJfnVg.exe
  C:\Windows\System\aCJfnVg.exe
  2⤵
  PID:5232
- C:\Windows\System\GKDzvQv.exe
  C:\Windows\System\GKDzvQv.exe
  2⤵
  PID:5280
- C:\Windows\System\uJPfBbG.exe
  C:\Windows\System\uJPfBbG.exe
  2⤵
  PID:5300
- C:\Windows\System\WCQBQbt.exe
  C:\Windows\System\WCQBQbt.exe
  2⤵
  PID:5376
- C:\Windows\System\foOOVcs.exe
  C:\Windows\System\foOOVcs.exe
  2⤵
  PID:5444
- C:\Windows\System\rqLsKBg.exe
  C:\Windows\System\rqLsKBg.exe
  2⤵
  PID:5508
- C:\Windows\System\KOflpyF.exe
  C:\Windows\System\KOflpyF.exe
  2⤵
  PID:5552
- C:\Windows\System\XgjUDcQ.exe
  C:\Windows\System\XgjUDcQ.exe
  2⤵
  PID:5584
- C:\Windows\System\lTXnvNY.exe
  C:\Windows\System\lTXnvNY.exe
  2⤵
  PID:5676
- C:\Windows\System\TMnNrBA.exe
  C:\Windows\System\TMnNrBA.exe
  2⤵
  PID:5720
- C:\Windows\System\fzpUHjN.exe
  C:\Windows\System\fzpUHjN.exe
  2⤵
  PID:5736
- C:\Windows\System\TwpOpAB.exe
  C:\Windows\System\TwpOpAB.exe
  2⤵
  PID:5752
- C:\Windows\System\CGmkejE.exe
  C:\Windows\System\CGmkejE.exe
  2⤵
  PID:5772
- C:\Windows\System\Gdkmgvx.exe
  C:\Windows\System\Gdkmgvx.exe
  2⤵
  PID:5788
- C:\Windows\System\ppnyzBF.exe
  C:\Windows\System\ppnyzBF.exe
  2⤵
  PID:5680
- C:\Windows\System\VWaauVL.exe
  C:\Windows\System\VWaauVL.exe
  2⤵
  PID:5904
- C:\Windows\System\JIlJnol.exe
  C:\Windows\System\JIlJnol.exe
  2⤵
  PID:5968
- C:\Windows\System\lnczpKT.exe
  C:\Windows\System\lnczpKT.exe
  2⤵
  PID:6032
- C:\Windows\System\FzGAsca.exe
  C:\Windows\System\FzGAsca.exe
  2⤵
  PID:6096
- C:\Windows\System\ggjEVaa.exe
  C:\Windows\System\ggjEVaa.exe
  2⤵
  PID:6012
- C:\Windows\System\QFrCFLn.exe
  C:\Windows\System\QFrCFLn.exe
  2⤵
  PID:5360
- C:\Windows\System\KUUFVbs.exe
  C:\Windows\System\KUUFVbs.exe
  2⤵
  PID:5424
- C:\Windows\System\GjYrpvW.exe
  C:\Windows\System\GjYrpvW.exe
  2⤵
  PID:5496
- C:\Windows\System\qeUEFMy.exe
  C:\Windows\System\qeUEFMy.exe
  2⤵
  PID:5628
- C:\Windows\System\iMsQJUQ.exe
  C:\Windows\System\iMsQJUQ.exe
  2⤵
  PID:6044
- C:\Windows\System\tisOttv.exe
  C:\Windows\System\tisOttv.exe
  2⤵
  PID:6116
- C:\Windows\System\WZOcGut.exe
  C:\Windows\System\WZOcGut.exe
  2⤵
  PID:6132
- C:\Windows\System\hCtGzDe.exe
  C:\Windows\System\hCtGzDe.exe
  2⤵
  PID:2804
- C:\Windows\System\SXsByec.exe
  C:\Windows\System\SXsByec.exe
  2⤵
  PID:4752
- C:\Windows\System\dAjyLTH.exe
  C:\Windows\System\dAjyLTH.exe
  2⤵
  PID:2272
- C:\Windows\System\DSaYMkj.exe
  C:\Windows\System\DSaYMkj.exe
  2⤵
  PID:5156
- C:\Windows\System\lWhNtey.exe
  C:\Windows\System\lWhNtey.exe
  2⤵
  PID:1012
- C:\Windows\System\XesHmgp.exe
  C:\Windows\System\XesHmgp.exe
  2⤵
  PID:5224
- C:\Windows\System\BJNfePf.exe
  C:\Windows\System\BJNfePf.exe
  2⤵
  PID:5332
- C:\Windows\System\BQUJHny.exe
  C:\Windows\System\BQUJHny.exe
  2⤵
  PID:5784
- C:\Windows\System\YCCPbGy.exe
  C:\Windows\System\YCCPbGy.exe
  2⤵
  PID:5864
- C:\Windows\System\YLIuDar.exe
  C:\Windows\System\YLIuDar.exe
  2⤵
  PID:5140
- C:\Windows\System\AcAxDbh.exe
  C:\Windows\System\AcAxDbh.exe
  2⤵
  PID:6000
- C:\Windows\System\xmHSiVM.exe
  C:\Windows\System\xmHSiVM.exe
  2⤵
  PID:5252
- C:\Windows\System\IfdLkxr.exe
  C:\Windows\System\IfdLkxr.exe
  2⤵
  PID:5564
- C:\Windows\System\puIquBi.exe
  C:\Windows\System\puIquBi.exe
  2⤵
  PID:5660
- C:\Windows\System\JPPnObw.exe
  C:\Windows\System\JPPnObw.exe
  2⤵
  PID:5460
- C:\Windows\System\CUwEZsn.exe
  C:\Windows\System\CUwEZsn.exe
  2⤵
  PID:5516
- C:\Windows\System\leNKEoa.exe
  C:\Windows\System\leNKEoa.exe
  2⤵
  PID:5648
- C:\Windows\System\jVToLZi.exe
  C:\Windows\System\jVToLZi.exe
  2⤵
  PID:5760
- C:\Windows\System\wddZrUh.exe
  C:\Windows\System\wddZrUh.exe
  2⤵
  PID:5800
- C:\Windows\System\SzWfiwO.exe
  C:\Windows\System\SzWfiwO.exe
  2⤵
  PID:6064
- C:\Windows\System\xgvyAbN.exe
  C:\Windows\System\xgvyAbN.exe
  2⤵
  PID:5356
- C:\Windows\System\qTGqAmg.exe
  C:\Windows\System\qTGqAmg.exe
  2⤵
  PID:5844
- C:\Windows\System\ButoqKi.exe
  C:\Windows\System\ButoqKi.exe
  2⤵
  PID:5128
- C:\Windows\System\AWrqnce.exe
  C:\Windows\System\AWrqnce.exe
  2⤵
  PID:5948
- C:\Windows\System\qQjRQqb.exe
  C:\Windows\System\qQjRQqb.exe
  2⤵
  PID:2408
- C:\Windows\System\oaQVvAl.exe
  C:\Windows\System\oaQVvAl.exe
  2⤵
  PID:4892
- C:\Windows\System\vHNLKzE.exe
  C:\Windows\System\vHNLKzE.exe
  2⤵
  PID:5896
- C:\Windows\System\qOixgJn.exe
  C:\Windows\System\qOixgJn.exe
  2⤵
  PID:5548
- C:\Windows\System\AgfKlym.exe
  C:\Windows\System\AgfKlym.exe
  2⤵
  PID:5748
- C:\Windows\System\aHCozIK.exe
  C:\Windows\System\aHCozIK.exe
  2⤵
  PID:5248
- C:\Windows\System\vtsRwnn.exe
  C:\Windows\System\vtsRwnn.exe
  2⤵
  PID:5440
- C:\Windows\System\nFeOOOc.exe
  C:\Windows\System\nFeOOOc.exe
  2⤵
  PID:5880
- C:\Windows\System\AIEfgaU.exe
  C:\Windows\System\AIEfgaU.exe
  2⤵
  PID:5848
- C:\Windows\System\uXNGvWp.exe
  C:\Windows\System\uXNGvWp.exe
  2⤵
  PID:5208
- C:\Windows\System\WQToGTB.exe
  C:\Windows\System\WQToGTB.exe
  2⤵
  PID:5352
- C:\Windows\System\PguXEwo.exe
  C:\Windows\System\PguXEwo.exe
  2⤵
  PID:6016
- C:\Windows\System\BhbgUZw.exe
  C:\Windows\System\BhbgUZw.exe
  2⤵
  PID:5336
- C:\Windows\System\elUSRSz.exe
  C:\Windows\System\elUSRSz.exe
  2⤵
  PID:6108
- C:\Windows\System\xvNkZqk.exe
  C:\Windows\System\xvNkZqk.exe
  2⤵
  PID:4388
- C:\Windows\System\CXcKfSg.exe
  C:\Windows\System\CXcKfSg.exe
  2⤵
  PID:5716
- C:\Windows\System\vYgIAbV.exe
  C:\Windows\System\vYgIAbV.exe
  2⤵
  PID:6148
- C:\Windows\System\gIydrfh.exe
  C:\Windows\System\gIydrfh.exe
  2⤵
  PID:6164
- C:\Windows\System\MjYrYzX.exe
  C:\Windows\System\MjYrYzX.exe
  2⤵
  PID:6180
- C:\Windows\System\BvOgGBm.exe
  C:\Windows\System\BvOgGBm.exe
  2⤵
  PID:6220
- C:\Windows\System\ZJzxQsQ.exe
  C:\Windows\System\ZJzxQsQ.exe
  2⤵
  PID:6240
- C:\Windows\System\gVgAWqB.exe
  C:\Windows\System\gVgAWqB.exe
  2⤵
  PID:6260
- C:\Windows\System\MNkCMob.exe
  C:\Windows\System\MNkCMob.exe
  2⤵
  PID:6276
- C:\Windows\System\gqZdMHq.exe
  C:\Windows\System\gqZdMHq.exe
  2⤵
  PID:6292
- C:\Windows\System\pJHYrfn.exe
  C:\Windows\System\pJHYrfn.exe
  2⤵
  PID:6316
- C:\Windows\System\DIATCwP.exe
  C:\Windows\System\DIATCwP.exe
  2⤵
  PID:6340
- C:\Windows\System\jXbguqN.exe
  C:\Windows\System\jXbguqN.exe
  2⤵
  PID:6360
- C:\Windows\System\AJvgVvT.exe
  C:\Windows\System\AJvgVvT.exe
  2⤵
  PID:6376
- C:\Windows\System\WHZWyyP.exe
  C:\Windows\System\WHZWyyP.exe
  2⤵
  PID:6396
- C:\Windows\System\YvqMTSS.exe
  C:\Windows\System\YvqMTSS.exe
  2⤵
  PID:6412
- C:\Windows\System\JKHuxEM.exe
  C:\Windows\System\JKHuxEM.exe
  2⤵
  PID:6436
- C:\Windows\System\TLJYWth.exe
  C:\Windows\System\TLJYWth.exe
  2⤵
  PID:6452
- C:\Windows\System\SBBJcqW.exe
  C:\Windows\System\SBBJcqW.exe
  2⤵
  PID:6468
- C:\Windows\System\ZxzBZfe.exe
  C:\Windows\System\ZxzBZfe.exe
  2⤵
  PID:6484
- C:\Windows\System\VmmBaTr.exe
  C:\Windows\System\VmmBaTr.exe
  2⤵
  PID:6508
- C:\Windows\System\vtqqzXJ.exe
  C:\Windows\System\vtqqzXJ.exe
  2⤵
  PID:6580
- C:\Windows\System\FAsJKii.exe
  C:\Windows\System\FAsJKii.exe
  2⤵
  PID:6596
- C:\Windows\System\eMRexPQ.exe
  C:\Windows\System\eMRexPQ.exe
  2⤵
  PID:6612
- C:\Windows\System\ixAcAys.exe
  C:\Windows\System\ixAcAys.exe
  2⤵
  PID:6628
- C:\Windows\System\MEPReDe.exe
  C:\Windows\System\MEPReDe.exe
  2⤵
  PID:6644
- C:\Windows\System\SgaMGAh.exe
  C:\Windows\System\SgaMGAh.exe
  2⤵
  PID:6660
- C:\Windows\System\ZtDMRJz.exe
  C:\Windows\System\ZtDMRJz.exe
  2⤵
  PID:6680
- C:\Windows\System\GSqvQbx.exe
  C:\Windows\System\GSqvQbx.exe
  2⤵
  PID:6696
- C:\Windows\System\cdrUXOl.exe
  C:\Windows\System\cdrUXOl.exe
  2⤵
  PID:6712
- C:\Windows\System\YCneKOD.exe
  C:\Windows\System\YCneKOD.exe
  2⤵
  PID:6732
- C:\Windows\System\zQhbpxt.exe
  C:\Windows\System\zQhbpxt.exe
  2⤵
  PID:6752
- C:\Windows\System\zdidEVd.exe
  C:\Windows\System\zdidEVd.exe
  2⤵
  PID:6768
- C:\Windows\System\aUDhpwM.exe
  C:\Windows\System\aUDhpwM.exe
  2⤵
  PID:6788
- C:\Windows\System\yUDekMZ.exe
  C:\Windows\System\yUDekMZ.exe
  2⤵
  PID:6804
- C:\Windows\System\jYuRowE.exe
  C:\Windows\System\jYuRowE.exe
  2⤵
  PID:6820
- C:\Windows\System\yBlbtVx.exe
  C:\Windows\System\yBlbtVx.exe
  2⤵
  PID:6836
- C:\Windows\System\naBjTkX.exe
  C:\Windows\System\naBjTkX.exe
  2⤵
  PID:6852
- C:\Windows\System\yrMWuOF.exe
  C:\Windows\System\yrMWuOF.exe
  2⤵
  PID:6868
- C:\Windows\System\qRfDXvm.exe
  C:\Windows\System\qRfDXvm.exe
  2⤵
  PID:6884
- C:\Windows\System\YapPlYJ.exe
  C:\Windows\System\YapPlYJ.exe
  2⤵
  PID:6900
- C:\Windows\System\QKZLTQK.exe
  C:\Windows\System\QKZLTQK.exe
  2⤵
  PID:6920
- C:\Windows\System\OKyVHzQ.exe
  C:\Windows\System\OKyVHzQ.exe
  2⤵
  PID:6940
- C:\Windows\System\ozadoAX.exe
  C:\Windows\System\ozadoAX.exe
  2⤵
  PID:6960
- C:\Windows\System\MRWgJxA.exe
  C:\Windows\System\MRWgJxA.exe
  2⤵
  PID:6980
- C:\Windows\System\eMcMKsW.exe
  C:\Windows\System\eMcMKsW.exe
  2⤵
  PID:6996
- C:\Windows\System\TLlXPHF.exe
  C:\Windows\System\TLlXPHF.exe
  2⤵
  PID:7016
- C:\Windows\System\RRaaMop.exe
  C:\Windows\System\RRaaMop.exe
  2⤵
  PID:7036
- C:\Windows\System\YkMsDbz.exe
  C:\Windows\System\YkMsDbz.exe
  2⤵
  PID:7056
- C:\Windows\System\IcVOdkp.exe
  C:\Windows\System\IcVOdkp.exe
  2⤵
  PID:7072
- C:\Windows\System\VqSSuYb.exe
  C:\Windows\System\VqSSuYb.exe
  2⤵
  PID:7088
- C:\Windows\System\fwrYPbE.exe
  C:\Windows\System\fwrYPbE.exe
  2⤵
  PID:7104
- C:\Windows\System\ChkxkTg.exe
  C:\Windows\System\ChkxkTg.exe
  2⤵
  PID:7120
- C:\Windows\System\SPLSlZT.exe
  C:\Windows\System\SPLSlZT.exe
  2⤵
  PID:7140
- C:\Windows\System\XFYCDUM.exe
  C:\Windows\System\XFYCDUM.exe
  2⤵
  PID:7156
- C:\Windows\System\WTpZzlB.exe
  C:\Windows\System\WTpZzlB.exe
  2⤵
  PID:5780
- C:\Windows\System\ltOKRei.exe
  C:\Windows\System\ltOKRei.exe
  2⤵
  PID:5664
- C:\Windows\System\RQISoYf.exe
  C:\Windows\System\RQISoYf.exe
  2⤵
  PID:4808
- C:\Windows\System\zRrODHD.exe
  C:\Windows\System\zRrODHD.exe
  2⤵
  PID:5860
- C:\Windows\System\dNVncqG.exe
  C:\Windows\System\dNVncqG.exe
  2⤵
  PID:6156
- C:\Windows\System\uLVxLlr.exe
  C:\Windows\System\uLVxLlr.exe
  2⤵
  PID:5408
- C:\Windows\System\NotPdTU.exe
  C:\Windows\System\NotPdTU.exe
  2⤵
  PID:6076
- C:\Windows\System\JSruoPU.exe
  C:\Windows\System\JSruoPU.exe
  2⤵
  PID:5712
- C:\Windows\System\NiRDofL.exe
  C:\Windows\System\NiRDofL.exe
  2⤵
  PID:6160
- C:\Windows\System\XuasCIu.exe
  C:\Windows\System\XuasCIu.exe
  2⤵
  PID:6200
- C:\Windows\System\ChaCPaq.exe
  C:\Windows\System\ChaCPaq.exe
  2⤵
  PID:6248
- C:\Windows\System\FTLZvXD.exe
  C:\Windows\System\FTLZvXD.exe
  2⤵
  PID:6288
- C:\Windows\System\Uwmcvsx.exe
  C:\Windows\System\Uwmcvsx.exe
  2⤵
  PID:6336
- C:\Windows\System\igSQsWB.exe
  C:\Windows\System\igSQsWB.exe
  2⤵
  PID:6408
- C:\Windows\System\NCtfzgN.exe
  C:\Windows\System\NCtfzgN.exe
  2⤵
  PID:6480
- C:\Windows\System\vVzXbZw.exe
  C:\Windows\System\vVzXbZw.exe
  2⤵
  PID:6300
- C:\Windows\System\ihAIFaQ.exe
  C:\Windows\System\ihAIFaQ.exe
  2⤵
  PID:6348
- C:\Windows\System\wUnyqHj.exe
  C:\Windows\System\wUnyqHj.exe
  2⤵
  PID:6388
- C:\Windows\System\pYaWvMT.exe
  C:\Windows\System\pYaWvMT.exe
  2⤵
  PID:6428
- C:\Windows\System\IHnhqzt.exe
  C:\Windows\System\IHnhqzt.exe
  2⤵
  PID:6492
- C:\Windows\System\RFHSYTx.exe
  C:\Windows\System\RFHSYTx.exe
  2⤵
  PID:6504
- C:\Windows\System\tYvvraw.exe
  C:\Windows\System\tYvvraw.exe
  2⤵
  PID:6528
- C:\Windows\System\yjWQAdG.exe
  C:\Windows\System\yjWQAdG.exe
  2⤵
  PID:6544
- C:\Windows\System\OByDYlC.exe
  C:\Windows\System\OByDYlC.exe
  2⤵
  PID:6560
- C:\Windows\System\lQqpKET.exe
  C:\Windows\System\lQqpKET.exe
  2⤵
  PID:6620
- C:\Windows\System\brgLKph.exe
  C:\Windows\System\brgLKph.exe
  2⤵
  PID:6688
- C:\Windows\System\hzmhzAw.exe
  C:\Windows\System\hzmhzAw.exe
  2⤵
  PID:6728
- C:\Windows\System\eseWEGU.exe
  C:\Windows\System\eseWEGU.exe
  2⤵
  PID:6800
- C:\Windows\System\iUUospZ.exe
  C:\Windows\System\iUUospZ.exe
  2⤵
  PID:6864
- C:\Windows\System\kvNdZAR.exe
  C:\Windows\System\kvNdZAR.exe
  2⤵
  PID:6932
- C:\Windows\System\rEDAsud.exe
  C:\Windows\System\rEDAsud.exe
  2⤵
  PID:6976
- C:\Windows\System\cpiTYNa.exe
  C:\Windows\System\cpiTYNa.exe
  2⤵
  PID:7044
- C:\Windows\System\jNWTPlx.exe
  C:\Windows\System\jNWTPlx.exe
  2⤵
  PID:7084
- C:\Windows\System\KBjgHyq.exe
  C:\Windows\System\KBjgHyq.exe
  2⤵
  PID:6572
- C:\Windows\System\GjKiMFu.exe
  C:\Windows\System\GjKiMFu.exe
  2⤵
  PID:6636
- C:\Windows\System\wzVASQx.exe
  C:\Windows\System\wzVASQx.exe
  2⤵
  PID:6676
- C:\Windows\System\XPoPHZZ.exe
  C:\Windows\System\XPoPHZZ.exe
  2⤵
  PID:6744
- C:\Windows\System\MsapHUz.exe
  C:\Windows\System\MsapHUz.exe
  2⤵
  PID:6784
- C:\Windows\System\PKgnGXQ.exe
  C:\Windows\System\PKgnGXQ.exe
  2⤵
  PID:6848
- C:\Windows\System\mtCsxAj.exe
  C:\Windows\System\mtCsxAj.exe
  2⤵
  PID:6912
- C:\Windows\System\xvuKbCa.exe
  C:\Windows\System\xvuKbCa.exe
  2⤵
  PID:6956
- C:\Windows\System\vqTyFfQ.exe
  C:\Windows\System\vqTyFfQ.exe
  2⤵
  PID:7032
- C:\Windows\System\kMQJkwO.exe
  C:\Windows\System\kMQJkwO.exe
  2⤵
  PID:7100
- C:\Windows\System\ZcczOdN.exe
  C:\Windows\System\ZcczOdN.exe
  2⤵
  PID:7152
- C:\Windows\System\xiSuLUT.exe
  C:\Windows\System\xiSuLUT.exe
  2⤵
  PID:5528
- C:\Windows\System\sBQFeud.exe
  C:\Windows\System\sBQFeud.exe
  2⤵
  PID:5580
- C:\Windows\System\HkjXczu.exe
  C:\Windows\System\HkjXczu.exe
  2⤵
  PID:6176
- C:\Windows\System\NLpSSxa.exe
  C:\Windows\System\NLpSSxa.exe
  2⤵
  PID:7136
- C:\Windows\System\RJRWkVn.exe
  C:\Windows\System\RJRWkVn.exe
  2⤵
  PID:6128
- C:\Windows\System\lluKRhs.exe
  C:\Windows\System\lluKRhs.exe
  2⤵
  PID:6212
- C:\Windows\System\tEObbeU.exe
  C:\Windows\System\tEObbeU.exe
  2⤵
  PID:6332
- C:\Windows\System\BYmjxaH.exe
  C:\Windows\System\BYmjxaH.exe
  2⤵
  PID:6404
- C:\Windows\System\mwiGror.exe
  C:\Windows\System\mwiGror.exe
  2⤵
  PID:6272
- C:\Windows\System\YotDYxH.exe
  C:\Windows\System\YotDYxH.exe
  2⤵
  PID:6520
- C:\Windows\System\UqMIrLD.exe
  C:\Windows\System\UqMIrLD.exe
  2⤵
  PID:6556
- C:\Windows\System\yXogNZw.exe
  C:\Windows\System\yXogNZw.exe
  2⤵
  PID:6796
- C:\Windows\System\htacfyL.exe
  C:\Windows\System\htacfyL.exe
  2⤵
  PID:7012
- C:\Windows\System\VUJDPEl.exe
  C:\Windows\System\VUJDPEl.exe
  2⤵
  PID:6672
- C:\Windows\System\oWAnRaz.exe
  C:\Windows\System\oWAnRaz.exe
  2⤵
  PID:6312
- C:\Windows\System\apohXtH.exe
  C:\Windows\System\apohXtH.exe
  2⤵
  PID:6536
- C:\Windows\System\axuXIwm.exe
  C:\Windows\System\axuXIwm.exe
  2⤵
  PID:6592
- C:\Windows\System\BiXYwhA.exe
  C:\Windows\System\BiXYwhA.exe
  2⤵
  PID:6880
- C:\Windows\System\plIFjgv.exe
  C:\Windows\System\plIFjgv.exe
  2⤵
  PID:3064
- C:\Windows\System\qyWqqcF.exe
  C:\Windows\System\qyWqqcF.exe
  2⤵
  PID:6968
- C:\Windows\System\BpDhaxM.exe
  C:\Windows\System\BpDhaxM.exe
  2⤵
  PID:6604
- C:\Windows\System\ZKbaaoX.exe
  C:\Windows\System\ZKbaaoX.exe
  2⤵
  PID:6080
- C:\Windows\System\InQSvvB.exe
  C:\Windows\System\InQSvvB.exe
  2⤵
  PID:6232
- C:\Windows\System\dyqXjHU.exe
  C:\Windows\System\dyqXjHU.exe
  2⤵
  PID:6464
- C:\Windows\System\jXWgbjN.exe
  C:\Windows\System\jXWgbjN.exe
  2⤵
  PID:6816
- C:\Windows\System\hnHfZpp.exe
  C:\Windows\System\hnHfZpp.exe
  2⤵
  PID:6424
- C:\Windows\System\BaEJufu.exe
  C:\Windows\System\BaEJufu.exe
  2⤵
  PID:6832
- C:\Windows\System\yjQsawA.exe
  C:\Windows\System\yjQsawA.exe
  2⤵
  PID:6460
- C:\Windows\System\iYtvrQA.exe
  C:\Windows\System\iYtvrQA.exe
  2⤵
  PID:6780
- C:\Windows\System\CuuiwCN.exe
  C:\Windows\System\CuuiwCN.exe
  2⤵
  PID:7096
- C:\Windows\System\madiyAT.exe
  C:\Windows\System\madiyAT.exe
  2⤵
  PID:6764
- C:\Windows\System\egtezam.exe
  C:\Windows\System\egtezam.exe
  2⤵
  PID:5984
- C:\Windows\System\NrsltDU.exe
  C:\Windows\System\NrsltDU.exe
  2⤵
  PID:6256
- C:\Windows\System\cFlMtYi.exe
  C:\Windows\System\cFlMtYi.exe
  2⤵
  PID:6308
- C:\Windows\System\YTGzkDB.exe
  C:\Windows\System\YTGzkDB.exe
  2⤵
  PID:7132
- C:\Windows\System\WtMNkQH.exe
  C:\Windows\System\WtMNkQH.exe
  2⤵
  PID:6668
- C:\Windows\System\miITsyk.exe
  C:\Windows\System\miITsyk.exe
  2⤵
  PID:7172
- C:\Windows\System\GlaEfOA.exe
  C:\Windows\System\GlaEfOA.exe
  2⤵
  PID:7188
- C:\Windows\System\ueBVsaW.exe
  C:\Windows\System\ueBVsaW.exe
  2⤵
  PID:7204
- C:\Windows\System\nITIESJ.exe
  C:\Windows\System\nITIESJ.exe
  2⤵
  PID:7220
- C:\Windows\System\KKEusQL.exe
  C:\Windows\System\KKEusQL.exe
  2⤵
  PID:7236
- C:\Windows\System\vpoKekK.exe
  C:\Windows\System\vpoKekK.exe
  2⤵
  PID:7252
- C:\Windows\System\ZmRXPuW.exe
  C:\Windows\System\ZmRXPuW.exe
  2⤵
  PID:7268
- C:\Windows\System\rFwQheV.exe
  C:\Windows\System\rFwQheV.exe
  2⤵
  PID:7284
- C:\Windows\System\trhtuym.exe
  C:\Windows\System\trhtuym.exe
  2⤵
  PID:7300
- C:\Windows\System\fixzfyM.exe
  C:\Windows\System\fixzfyM.exe
  2⤵
  PID:7316
- C:\Windows\System\LunKyZi.exe
  C:\Windows\System\LunKyZi.exe
  2⤵
  PID:7332
- C:\Windows\System\QUVIEZs.exe
  C:\Windows\System\QUVIEZs.exe
  2⤵
  PID:7348
- C:\Windows\System\OjCDhkT.exe
  C:\Windows\System\OjCDhkT.exe
  2⤵
  PID:7364
- C:\Windows\System\zpKKWWN.exe
  C:\Windows\System\zpKKWWN.exe
  2⤵
  PID:7380
- C:\Windows\System\UtzVmqK.exe
  C:\Windows\System\UtzVmqK.exe
  2⤵
  PID:7396
- C:\Windows\System\vxwydJg.exe
  C:\Windows\System\vxwydJg.exe
  2⤵
  PID:7412
- C:\Windows\System\PkxWcff.exe
  C:\Windows\System\PkxWcff.exe
  2⤵
  PID:7428
- C:\Windows\System\TfmnObW.exe
  C:\Windows\System\TfmnObW.exe
  2⤵
  PID:7444
- C:\Windows\System\hSCJNNy.exe
  C:\Windows\System\hSCJNNy.exe
  2⤵
  PID:7460
- C:\Windows\System\Rnrntwu.exe
  C:\Windows\System\Rnrntwu.exe
  2⤵
  PID:7476
- C:\Windows\System\VlGbbXq.exe
  C:\Windows\System\VlGbbXq.exe
  2⤵
  PID:7492
- C:\Windows\System\yNojUiw.exe
  C:\Windows\System\yNojUiw.exe
  2⤵
  PID:7508
- C:\Windows\System\QhAZgBc.exe
  C:\Windows\System\QhAZgBc.exe
  2⤵
  PID:7524
- C:\Windows\System\BUaeSTO.exe
  C:\Windows\System\BUaeSTO.exe
  2⤵
  PID:7540
- C:\Windows\System\NMqjaSH.exe
  C:\Windows\System\NMqjaSH.exe
  2⤵
  PID:7556
- C:\Windows\System\OVrynJT.exe
  C:\Windows\System\OVrynJT.exe
  2⤵
  PID:7572
- C:\Windows\System\mDZKFdG.exe
  C:\Windows\System\mDZKFdG.exe
  2⤵
  PID:7588
- C:\Windows\System\PanuUWy.exe
  C:\Windows\System\PanuUWy.exe
  2⤵
  PID:7604
- C:\Windows\System\cTuKRee.exe
  C:\Windows\System\cTuKRee.exe
  2⤵
  PID:7620
- C:\Windows\System\aOAJBAD.exe
  C:\Windows\System\aOAJBAD.exe
  2⤵
  PID:7636
- C:\Windows\System\NLZpZlT.exe
  C:\Windows\System\NLZpZlT.exe
  2⤵
  PID:7652
- C:\Windows\System\nqTnlNe.exe
  C:\Windows\System\nqTnlNe.exe
  2⤵
  PID:7668
- C:\Windows\System\SbyodbF.exe
  C:\Windows\System\SbyodbF.exe
  2⤵
  PID:7684
- C:\Windows\System\sDKEYdQ.exe
  C:\Windows\System\sDKEYdQ.exe
  2⤵
  PID:7700
- C:\Windows\System\eZVXFpl.exe
  C:\Windows\System\eZVXFpl.exe
  2⤵
  PID:7716
- C:\Windows\System\WXeAEts.exe
  C:\Windows\System\WXeAEts.exe
  2⤵
  PID:7732
- C:\Windows\System\LNzYkpq.exe
  C:\Windows\System\LNzYkpq.exe
  2⤵
  PID:7748
- C:\Windows\System\nLwiOyR.exe
  C:\Windows\System\nLwiOyR.exe
  2⤵
  PID:7764
- C:\Windows\System\hSweYKu.exe
  C:\Windows\System\hSweYKu.exe
  2⤵
  PID:7780
- C:\Windows\System\AhQdRRy.exe
  C:\Windows\System\AhQdRRy.exe
  2⤵
  PID:7796
- C:\Windows\System\IWlKHYO.exe
  C:\Windows\System\IWlKHYO.exe
  2⤵
  PID:7812
- C:\Windows\System\kZZwQZM.exe
  C:\Windows\System\kZZwQZM.exe
  2⤵
  PID:7828
- C:\Windows\System\oHgNPBU.exe
  C:\Windows\System\oHgNPBU.exe
  2⤵
  PID:7844
- C:\Windows\System\FvezJKh.exe
  C:\Windows\System\FvezJKh.exe
  2⤵
  PID:7860
- C:\Windows\System\cyjLEKU.exe
  C:\Windows\System\cyjLEKU.exe
  2⤵
  PID:7876
- C:\Windows\System\srszLQe.exe
  C:\Windows\System\srszLQe.exe
  2⤵
  PID:7892
- C:\Windows\System\FhUPiPd.exe
  C:\Windows\System\FhUPiPd.exe
  2⤵
  PID:7908
- C:\Windows\System\emBTwlZ.exe
  C:\Windows\System\emBTwlZ.exe
  2⤵
  PID:7924
- C:\Windows\System\ZNsAlIY.exe
  C:\Windows\System\ZNsAlIY.exe
  2⤵
  PID:7940
- C:\Windows\System\MJvYoCl.exe
  C:\Windows\System\MJvYoCl.exe
  2⤵
  PID:7956
- C:\Windows\System\yBQPJoZ.exe
  C:\Windows\System\yBQPJoZ.exe
  2⤵
  PID:7972
- C:\Windows\System\sCAUaWe.exe
  C:\Windows\System\sCAUaWe.exe
  2⤵
  PID:7988
- C:\Windows\System\GpMTQqA.exe
  C:\Windows\System\GpMTQqA.exe
  2⤵
  PID:8004
- C:\Windows\System\dZPSJCh.exe
  C:\Windows\System\dZPSJCh.exe
  2⤵
  PID:8020
- C:\Windows\System\fJRWqlF.exe
  C:\Windows\System\fJRWqlF.exe
  2⤵
  PID:8036
- C:\Windows\System\OAHLviz.exe
  C:\Windows\System\OAHLviz.exe
  2⤵
  PID:8052
- C:\Windows\System\eAVaeUn.exe
  C:\Windows\System\eAVaeUn.exe
  2⤵
  PID:8072
- C:\Windows\System\cwtbeDO.exe
  C:\Windows\System\cwtbeDO.exe
  2⤵
  PID:8088
- C:\Windows\System\eLNnaMX.exe
  C:\Windows\System\eLNnaMX.exe
  2⤵
  PID:8104
- C:\Windows\System\UCWoHFW.exe
  C:\Windows\System\UCWoHFW.exe
  2⤵
  PID:8120
- C:\Windows\System\CyzOugu.exe
  C:\Windows\System\CyzOugu.exe
  2⤵
  PID:8136
- C:\Windows\System\elJuhGG.exe
  C:\Windows\System\elJuhGG.exe
  2⤵
  PID:8152
- C:\Windows\System\tlDPBpT.exe
  C:\Windows\System\tlDPBpT.exe
  2⤵
  PID:8168
- C:\Windows\System\QYHEnBZ.exe
  C:\Windows\System\QYHEnBZ.exe
  2⤵
  PID:8184
- C:\Windows\System\dBfpDBU.exe
  C:\Windows\System\dBfpDBU.exe
  2⤵
  PID:6196
- C:\Windows\System\GfARQEO.exe
  C:\Windows\System\GfARQEO.exe
  2⤵
  PID:6740
- C:\Windows\System\IrIPTnF.exe
  C:\Windows\System\IrIPTnF.exe
  2⤵
  PID:7212
- C:\Windows\System\nZWqTMu.exe
  C:\Windows\System\nZWqTMu.exe
  2⤵
  PID:7276
- C:\Windows\System\wLCOfOb.exe
  C:\Windows\System\wLCOfOb.exe
  2⤵
  PID:7340
- C:\Windows\System\dmymjwv.exe
  C:\Windows\System\dmymjwv.exe
  2⤵
  PID:7404
- C:\Windows\System\HXqxyPf.exe
  C:\Windows\System\HXqxyPf.exe
  2⤵
  PID:7468
- C:\Windows\System\jemmIQa.exe
  C:\Windows\System\jemmIQa.exe
  2⤵
  PID:7532
- C:\Windows\System\HnEDjfV.exe
  C:\Windows\System\HnEDjfV.exe
  2⤵
  PID:7596
- C:\Windows\System\tKBijqX.exe
  C:\Windows\System\tKBijqX.exe
  2⤵
  PID:7660
- C:\Windows\System\RxxYzna.exe
  C:\Windows\System\RxxYzna.exe
  2⤵
  PID:1992
- C:\Windows\System\UWMeIIg.exe
  C:\Windows\System\UWMeIIg.exe
  2⤵
  PID:7360
- C:\Windows\System\vCpHbNI.exe
  C:\Windows\System\vCpHbNI.exe
  2⤵
  PID:6140
- C:\Windows\System\Omfweut.exe
  C:\Windows\System\Omfweut.exe
  2⤵
  PID:872
- C:\Windows\System\scHUZhZ.exe
  C:\Windows\System\scHUZhZ.exe
  2⤵
  PID:6496
- C:\Windows\System\eeYBIUS.exe
  C:\Windows\System\eeYBIUS.exe
  2⤵
  PID:7260
- C:\Windows\System\sArUtpG.exe
  C:\Windows\System\sArUtpG.exe
  2⤵
  PID:7296
- C:\Windows\System\XjvJebG.exe
  C:\Windows\System\XjvJebG.exe
  2⤵
  PID:7356
- C:\Windows\System\jMuobXY.exe
  C:\Windows\System\jMuobXY.exe
  2⤵
  PID:7760
- C:\Windows\System\oGxJZnk.exe
  C:\Windows\System\oGxJZnk.exe
  2⤵
  PID:7420
- C:\Windows\System\grNcdvm.exe
  C:\Windows\System\grNcdvm.exe
  2⤵
  PID:7488
- C:\Windows\System\gJeOAWI.exe
  C:\Windows\System\gJeOAWI.exe
  2⤵
  PID:7612
- C:\Windows\System\nNTVrZV.exe
  C:\Windows\System\nNTVrZV.exe
  2⤵
  PID:7676
- C:\Windows\System\jWPqdER.exe
  C:\Windows\System\jWPqdER.exe
  2⤵
  PID:7820
- C:\Windows\System\cjhLCXq.exe
  C:\Windows\System\cjhLCXq.exe
  2⤵
  PID:7824
- C:\Windows\System\rWJcsuc.exe
  C:\Windows\System\rWJcsuc.exe
  2⤵
  PID:7916
- C:\Windows\System\lqsbZvm.exe
  C:\Windows\System\lqsbZvm.exe
  2⤵
  PID:7980
- C:\Windows\System\fViEePN.exe
  C:\Windows\System\fViEePN.exe
  2⤵
  PID:7840
- C:\Windows\System\vkTEwpc.exe
  C:\Windows\System\vkTEwpc.exe
  2⤵
  PID:8048
- C:\Windows\System\ZOJESrV.exe
  C:\Windows\System\ZOJESrV.exe
  2⤵
  PID:8084
- C:\Windows\System\dZVqard.exe
  C:\Windows\System\dZVqard.exe
  2⤵
  PID:7996
- C:\Windows\System\hOeUBiK.exe
  C:\Windows\System\hOeUBiK.exe
  2⤵
  PID:8116
- C:\Windows\System\aLidvpV.exe
  C:\Windows\System\aLidvpV.exe
  2⤵
  PID:8180
- C:\Windows\System\xyWsABk.exe
  C:\Windows\System\xyWsABk.exe
  2⤵
  PID:8068
- C:\Windows\System\MqiFdaW.exe
  C:\Windows\System\MqiFdaW.exe
  2⤵
  PID:7180
- C:\Windows\System\RHMvmfZ.exe
  C:\Windows\System\RHMvmfZ.exe
  2⤵
  PID:6928
- C:\Windows\System\dZxDkwH.exe
  C:\Windows\System\dZxDkwH.exe
  2⤵
  PID:7372
- C:\Windows\System\TqhiGQi.exe
  C:\Windows\System\TqhiGQi.exe
  2⤵
  PID:7312
- C:\Windows\System\zMTzVxh.exe
  C:\Windows\System\zMTzVxh.exe
  2⤵
  PID:6372
- C:\Windows\System\PoCHmyD.exe
  C:\Windows\System\PoCHmyD.exe
  2⤵
  PID:6724
- C:\Windows\System\FyfhIZe.exe
  C:\Windows\System\FyfhIZe.exe
  2⤵
  PID:7232
- C:\Windows\System\xwZMldR.exe
  C:\Windows\System\xwZMldR.exe
  2⤵
  PID:7052
- C:\Windows\System\AYpMTeh.exe
  C:\Windows\System\AYpMTeh.exe
  2⤵
  PID:7292
- C:\Windows\System\mtycnKI.exe
  C:\Windows\System\mtycnKI.exe
  2⤵
  PID:7756
- C:\Windows\System\nTYcuZQ.exe
  C:\Windows\System\nTYcuZQ.exe
  2⤵
  PID:7580
- C:\Windows\System\kgjjvpf.exe
  C:\Windows\System\kgjjvpf.exe
  2⤵
  PID:7740
- C:\Windows\System\gWnfQGM.exe
  C:\Windows\System\gWnfQGM.exe
  2⤵
  PID:7804
- C:\Windows\System\pahVkwU.exe
  C:\Windows\System\pahVkwU.exe
  2⤵
  PID:7884
- C:\Windows\System\cSQugoe.exe
  C:\Windows\System\cSQugoe.exe
  2⤵
  PID:8016
- C:\Windows\System\FNqZVAY.exe
  C:\Windows\System\FNqZVAY.exe
  2⤵
  PID:8044
- C:\Windows\System\EztQMel.exe
  C:\Windows\System\EztQMel.exe
  2⤵
  PID:8032
- C:\Windows\System\CreKayw.exe
  C:\Windows\System\CreKayw.exe
  2⤵
  PID:8148
- C:\Windows\System\hCcavLl.exe
  C:\Windows\System\hCcavLl.exe
  2⤵
  PID:7436
- C:\Windows\System\lEAFwFR.exe
  C:\Windows\System\lEAFwFR.exe
  2⤵
  PID:7068
- C:\Windows\System\HiOurUJ.exe
  C:\Windows\System\HiOurUJ.exe
  2⤵
  PID:7244
- C:\Windows\System\zwHGhts.exe
  C:\Windows\System\zwHGhts.exe
  2⤵
  PID:7628
- C:\Windows\System\beMsNku.exe
  C:\Windows\System\beMsNku.exe
  2⤵
  PID:7692
- C:\Windows\System\rvjTngf.exe
  C:\Windows\System\rvjTngf.exe
  2⤵
  PID:7548
- C:\Windows\System\GYyRhyu.exe
  C:\Windows\System\GYyRhyu.exe
  2⤵
  PID:7392
- C:\Windows\System\pWTGzfL.exe
  C:\Windows\System\pWTGzfL.exe
  2⤵
  PID:7712
- C:\Windows\System\joHMgOr.exe
  C:\Windows\System\joHMgOr.exe
  2⤵
  PID:7888
- C:\Windows\System\JwTEXbR.exe
  C:\Windows\System\JwTEXbR.exe
  2⤵
  PID:8012
- C:\Windows\System\ttPROnR.exe
  C:\Windows\System\ttPROnR.exe
  2⤵
  PID:8176
- C:\Windows\System\zbCMNMR.exe
  C:\Windows\System\zbCMNMR.exe
  2⤵
  PID:8164
- C:\Windows\System\pKpdnBe.exe
  C:\Windows\System\pKpdnBe.exe
  2⤵
  PID:7248
- C:\Windows\System\NjlBydq.exe
  C:\Windows\System\NjlBydq.exe
  2⤵
  PID:7792
- C:\Windows\System\lwhXcUv.exe
  C:\Windows\System\lwhXcUv.exe
  2⤵
  PID:7324
- C:\Windows\System\xFsvCaY.exe
  C:\Windows\System\xFsvCaY.exe
  2⤵
  PID:7856
- C:\Windows\System\yDlfPGL.exe
  C:\Windows\System\yDlfPGL.exe
  2⤵
  PID:8112
- C:\Windows\System\jHCPCNw.exe
  C:\Windows\System\jHCPCNw.exe
  2⤵
  PID:7080
- C:\Windows\System\fJmxVHB.exe
  C:\Windows\System\fJmxVHB.exe
  2⤵
  PID:7484
- C:\Windows\System\UqyBxYz.exe
  C:\Windows\System\UqyBxYz.exe
  2⤵
  PID:5768
- C:\Windows\System\aVFUvci.exe
  C:\Windows\System\aVFUvci.exe
  2⤵
  PID:7388
- C:\Windows\System\FAkLYak.exe
  C:\Windows\System\FAkLYak.exe
  2⤵
  PID:8204
- C:\Windows\System\YcRLbPi.exe
  C:\Windows\System\YcRLbPi.exe
  2⤵
  PID:8220
- C:\Windows\System\StrSMOZ.exe
  C:\Windows\System\StrSMOZ.exe
  2⤵
  PID:8236
- C:\Windows\System\YkdYhbM.exe
  C:\Windows\System\YkdYhbM.exe
  2⤵
  PID:8252
- C:\Windows\System\NGiCnEA.exe
  C:\Windows\System\NGiCnEA.exe
  2⤵
  PID:8268
- C:\Windows\System\Ncxmnrk.exe
  C:\Windows\System\Ncxmnrk.exe
  2⤵
  PID:8284
- C:\Windows\System\SFNZcnj.exe
  C:\Windows\System\SFNZcnj.exe
  2⤵
  PID:8300
- C:\Windows\System\QOtlfKi.exe
  C:\Windows\System\QOtlfKi.exe
  2⤵
  PID:8316
- C:\Windows\System\pwcNaGQ.exe
  C:\Windows\System\pwcNaGQ.exe
  2⤵
  PID:8332
- C:\Windows\System\SSczMqG.exe
  C:\Windows\System\SSczMqG.exe
  2⤵
  PID:8348
- C:\Windows\System\QWiJNSX.exe
  C:\Windows\System\QWiJNSX.exe
  2⤵
  PID:8364
- C:\Windows\System\zoxRtYh.exe
  C:\Windows\System\zoxRtYh.exe
  2⤵
  PID:8380
- C:\Windows\System\KOWCxUH.exe
  C:\Windows\System\KOWCxUH.exe
  2⤵
  PID:8396
- C:\Windows\System\gKtUyes.exe
  C:\Windows\System\gKtUyes.exe
  2⤵
  PID:8412
- C:\Windows\System\mdNxKSG.exe
  C:\Windows\System\mdNxKSG.exe
  2⤵
  PID:8428
- C:\Windows\System\YvMmlWe.exe
  C:\Windows\System\YvMmlWe.exe
  2⤵
  PID:8444
- C:\Windows\System\xQjBOfX.exe
  C:\Windows\System\xQjBOfX.exe
  2⤵
  PID:8460
- C:\Windows\System\PxohDIk.exe
  C:\Windows\System\PxohDIk.exe
  2⤵
  PID:8476
- C:\Windows\System\gKMdkvJ.exe
  C:\Windows\System\gKMdkvJ.exe
  2⤵
  PID:8492
- C:\Windows\System\mwqKWmt.exe
  C:\Windows\System\mwqKWmt.exe
  2⤵
  PID:8508
- C:\Windows\System\rFrRRJq.exe
  C:\Windows\System\rFrRRJq.exe
  2⤵
  PID:8524
- C:\Windows\System\ErAxEMD.exe
  C:\Windows\System\ErAxEMD.exe
  2⤵
  PID:8540
- C:\Windows\System\MUminec.exe
  C:\Windows\System\MUminec.exe
  2⤵
  PID:8556
- C:\Windows\System\zZSgcuh.exe
  C:\Windows\System\zZSgcuh.exe
  2⤵
  PID:8572
- C:\Windows\System\BuYzLFS.exe
  C:\Windows\System\BuYzLFS.exe
  2⤵
  PID:8588
- C:\Windows\System\ZPDGwhl.exe
  C:\Windows\System\ZPDGwhl.exe
  2⤵
  PID:8604
- C:\Windows\System\vWWRRln.exe
  C:\Windows\System\vWWRRln.exe
  2⤵
  PID:8620
- C:\Windows\System\LpIWJlZ.exe
  C:\Windows\System\LpIWJlZ.exe
  2⤵
  PID:8636
- C:\Windows\System\DcrnQQK.exe
  C:\Windows\System\DcrnQQK.exe
  2⤵
  PID:8652
- C:\Windows\System\krpKGjm.exe
  C:\Windows\System\krpKGjm.exe
  2⤵
  PID:8668
- C:\Windows\System\yGIuqxP.exe
  C:\Windows\System\yGIuqxP.exe
  2⤵
  PID:8684
- C:\Windows\System\gukIUlI.exe
  C:\Windows\System\gukIUlI.exe
  2⤵
  PID:8700
- C:\Windows\System\wxsCmoG.exe
  C:\Windows\System\wxsCmoG.exe
  2⤵
  PID:8716
- C:\Windows\System\wkbnptg.exe
  C:\Windows\System\wkbnptg.exe
  2⤵
  PID:8732
- C:\Windows\System\FFykljo.exe
  C:\Windows\System\FFykljo.exe
  2⤵
  PID:8748
- C:\Windows\System\yvDVCiQ.exe
  C:\Windows\System\yvDVCiQ.exe
  2⤵
  PID:8764
- C:\Windows\System\nQigqoE.exe
  C:\Windows\System\nQigqoE.exe
  2⤵
  PID:8780
- C:\Windows\System\ZiZeidg.exe
  C:\Windows\System\ZiZeidg.exe
  2⤵
  PID:8796
- C:\Windows\System\BOTbuli.exe
  C:\Windows\System\BOTbuli.exe
  2⤵
  PID:8812
- C:\Windows\System\ZwbBsDN.exe
  C:\Windows\System\ZwbBsDN.exe
  2⤵
  PID:8828
- C:\Windows\System\PPRhTZh.exe
  C:\Windows\System\PPRhTZh.exe
  2⤵
  PID:8844
- C:\Windows\System\PBAueyV.exe
  C:\Windows\System\PBAueyV.exe
  2⤵
  PID:8860
- C:\Windows\System\qSKoOtM.exe
  C:\Windows\System\qSKoOtM.exe
  2⤵
  PID:8876
- C:\Windows\System\zHJtkBi.exe
  C:\Windows\System\zHJtkBi.exe
  2⤵
  PID:8892
- C:\Windows\System\lyLBUyw.exe
  C:\Windows\System\lyLBUyw.exe
  2⤵
  PID:8908
- C:\Windows\System\pxWwNSa.exe
  C:\Windows\System\pxWwNSa.exe
  2⤵
  PID:8924
- C:\Windows\System\coISBiB.exe
  C:\Windows\System\coISBiB.exe
  2⤵
  PID:8940
- C:\Windows\System\edZMsAX.exe
  C:\Windows\System\edZMsAX.exe
  2⤵
  PID:8956
- C:\Windows\System\ZMlFtJK.exe
  C:\Windows\System\ZMlFtJK.exe
  2⤵
  PID:8972
- C:\Windows\System\rAhzOJV.exe
  C:\Windows\System\rAhzOJV.exe
  2⤵
  PID:8988
- C:\Windows\System\AcKmXRh.exe
  C:\Windows\System\AcKmXRh.exe
  2⤵
  PID:9004
- C:\Windows\System\ouYiRho.exe
  C:\Windows\System\ouYiRho.exe
  2⤵
  PID:9020
- C:\Windows\System\fERPzVI.exe
  C:\Windows\System\fERPzVI.exe
  2⤵
  PID:9036
- C:\Windows\System\SPSSXQw.exe
  C:\Windows\System\SPSSXQw.exe
  2⤵
  PID:9052
- C:\Windows\System\NWDkwMO.exe
  C:\Windows\System\NWDkwMO.exe
  2⤵
  PID:9068
- C:\Windows\System\fkBjufF.exe
  C:\Windows\System\fkBjufF.exe
  2⤵
  PID:9084
- C:\Windows\System\NYhvIby.exe
  C:\Windows\System\NYhvIby.exe
  2⤵
  PID:9100
- C:\Windows\System\rQXXrsg.exe
  C:\Windows\System\rQXXrsg.exe
  2⤵
  PID:9116
- C:\Windows\System\eaFGJQP.exe
  C:\Windows\System\eaFGJQP.exe
  2⤵
  PID:9132
- C:\Windows\System\sTEtWcp.exe
  C:\Windows\System\sTEtWcp.exe
  2⤵
  PID:9152
- C:\Windows\System\hHOwrEj.exe
  C:\Windows\System\hHOwrEj.exe
  2⤵
  PID:9168
- C:\Windows\System\EZCAIfM.exe
  C:\Windows\System\EZCAIfM.exe
  2⤵
  PID:9184
- C:\Windows\System\FekIMeH.exe
  C:\Windows\System\FekIMeH.exe
  2⤵
  PID:9204
- C:\Windows\System\AhqAXFM.exe
  C:\Windows\System\AhqAXFM.exe
  2⤵
  PID:7648
- C:\Windows\System\DPLTNxu.exe
  C:\Windows\System\DPLTNxu.exe
  2⤵
  PID:8216
- C:\Windows\System\SWWbIAZ.exe
  C:\Windows\System\SWWbIAZ.exe
  2⤵
  PID:8248
- C:\Windows\System\nWstwkc.exe
  C:\Windows\System\nWstwkc.exe
  2⤵
  PID:8296
- C:\Windows\System\WnyOEzX.exe
  C:\Windows\System\WnyOEzX.exe
  2⤵
  PID:8360
- C:\Windows\System\lSSVrMq.exe
  C:\Windows\System\lSSVrMq.exe
  2⤵
  PID:8424
- C:\Windows\System\lijWdKF.exe
  C:\Windows\System\lijWdKF.exe
  2⤵
  PID:8516
- C:\Windows\System\OtXKHRH.exe
  C:\Windows\System\OtXKHRH.exe
  2⤵
  PID:8280
- C:\Windows\System\uZeAoSz.exe
  C:\Windows\System\uZeAoSz.exe
  2⤵
  PID:8344
- C:\Windows\System\dLQoVmv.exe
  C:\Windows\System\dLQoVmv.exe
  2⤵
  PID:8404
- C:\Windows\System\MXobHfW.exe
  C:\Windows\System\MXobHfW.exe
  2⤵
  PID:8612
- C:\Windows\System\nvyUhlD.exe
  C:\Windows\System\nvyUhlD.exe
  2⤵
  PID:8676
- C:\Windows\System\axOaXzU.exe
  C:\Windows\System\axOaXzU.exe
  2⤵
  PID:8628
- C:\Windows\System\opDaFXK.exe
  C:\Windows\System\opDaFXK.exe
  2⤵
  PID:8564
- C:\Windows\System\DifRWWL.exe
  C:\Windows\System\DifRWWL.exe
  2⤵
  PID:8440
- C:\Windows\System\VaxiWqz.exe
  C:\Windows\System\VaxiWqz.exe
  2⤵
  PID:8500
- C:\Windows\System\etlggWT.exe
  C:\Windows\System\etlggWT.exe
  2⤵
  PID:8664
- C:\Windows\System\SIwEgTe.exe
  C:\Windows\System\SIwEgTe.exe
  2⤵
  PID:8808
- C:\Windows\System\drRHjVq.exe
  C:\Windows\System\drRHjVq.exe
  2⤵
  PID:8836
- C:\Windows\System\QgVlObB.exe
  C:\Windows\System\QgVlObB.exe
  2⤵
  PID:8824
- C:\Windows\System\NsxkdMh.exe
  C:\Windows\System\NsxkdMh.exe
  2⤵
  PID:8868
- C:\Windows\System\lQGyWDy.exe
  C:\Windows\System\lQGyWDy.exe
  2⤵
  PID:8900
- C:\Windows\System\wYzLJhH.exe
  C:\Windows\System\wYzLJhH.exe
  2⤵
  PID:8916
- C:\Windows\System\TfkFcvK.exe
  C:\Windows\System\TfkFcvK.exe
  2⤵
  PID:8948
- C:\Windows\System\KsEqGeb.exe
  C:\Windows\System\KsEqGeb.exe
  2⤵
  PID:8980
- C:\Windows\System\uJGxfER.exe
  C:\Windows\System\uJGxfER.exe
  2⤵
  PID:9012
- C:\Windows\System\jbNFYZU.exe
  C:\Windows\System\jbNFYZU.exe
  2⤵
  PID:9044
- C:\Windows\System\yumeEjP.exe
  C:\Windows\System\yumeEjP.exe
  2⤵
  PID:9092
- C:\Windows\System\VVBCxrR.exe
  C:\Windows\System\VVBCxrR.exe
  2⤵
  PID:9096
- C:\Windows\System\syGdBGh.exe
  C:\Windows\System\syGdBGh.exe
  2⤵
  PID:9112
- C:\Windows\System\PPaYnRg.exe
  C:\Windows\System\PPaYnRg.exe
  2⤵
  PID:9160
- C:\Windows\System\pvwWQJu.exe
  C:\Windows\System\pvwWQJu.exe
  2⤵
  PID:9180
- C:\Windows\System\BJwZoOi.exe
  C:\Windows\System\BJwZoOi.exe
  2⤵
  PID:8196
- C:\Windows\System\CjhInsQ.exe
  C:\Windows\System\CjhInsQ.exe
  2⤵
  PID:8260
- C:\Windows\System\NFKDuNz.exe
  C:\Windows\System\NFKDuNz.exe
  2⤵
  PID:8420
- C:\Windows\System\fHxSoyR.exe
  C:\Windows\System\fHxSoyR.exe
  2⤵
  PID:8456
- C:\Windows\System\GrbHlFz.exe
  C:\Windows\System\GrbHlFz.exe
  2⤵
  PID:8376
- C:\Windows\System\aEShTIY.exe
  C:\Windows\System\aEShTIY.exe
  2⤵
  PID:8644
- C:\Windows\System\jWyAxza.exe
  C:\Windows\System\jWyAxza.exe
  2⤵
  PID:8532
- C:\Windows\System\ZtVSKjI.exe
  C:\Windows\System\ZtVSKjI.exe
  2⤵
  PID:8744
- C:\Windows\System\gRxgQxN.exe
  C:\Windows\System\gRxgQxN.exe
  2⤵
  PID:8804
- C:\Windows\System\gnujlrG.exe
  C:\Windows\System\gnujlrG.exe
  2⤵
  PID:8872
- C:\Windows\System\OCMwOMv.exe
  C:\Windows\System\OCMwOMv.exe
  2⤵
  PID:8820
- C:\Windows\System\QCJQmrZ.exe
  C:\Windows\System\QCJQmrZ.exe
  2⤵
  PID:8776
- C:\Windows\System\ucWtzdq.exe
  C:\Windows\System\ucWtzdq.exe
  2⤵
  PID:8936
- C:\Windows\System\OYyuHgW.exe
  C:\Windows\System\OYyuHgW.exe
  2⤵
  PID:8968
- C:\Windows\System\GZVtKsE.exe
  C:\Windows\System\GZVtKsE.exe
  2⤵
  PID:9032
- C:\Windows\System\hftbYBW.exe
  C:\Windows\System\hftbYBW.exe
  2⤵
  PID:9080
- C:\Windows\System\EGWScbg.exe
  C:\Windows\System\EGWScbg.exe
  2⤵
  PID:9192
- C:\Windows\System\RrFaPpa.exe
  C:\Windows\System\RrFaPpa.exe
  2⤵
  PID:8244
- C:\Windows\System\vQgKhWa.exe
  C:\Windows\System\vQgKhWa.exe
  2⤵
  PID:8328
- C:\Windows\System\hfxdrnR.exe
  C:\Windows\System\hfxdrnR.exe
  2⤵
  PID:8740
- C:\Windows\System\JomVQjs.exe
  C:\Windows\System\JomVQjs.exe
  2⤵
  PID:8312
- C:\Windows\System\CPZaSUx.exe
  C:\Windows\System\CPZaSUx.exe
  2⤵
  PID:8436
- C:\Windows\System\FSsxtJx.exe
  C:\Windows\System\FSsxtJx.exe
  2⤵
  PID:8760
- C:\Windows\System\UMNtSeZ.exe
  C:\Windows\System\UMNtSeZ.exe
  2⤵
  PID:8996
- C:\Windows\System\wUWlGqJ.exe
  C:\Windows\System\wUWlGqJ.exe
  2⤵
  PID:8904
- C:\Windows\System\jzsQSoI.exe
  C:\Windows\System\jzsQSoI.exe
  2⤵
  PID:8340
- C:\Windows\System\ZJyMtRQ.exe
  C:\Windows\System\ZJyMtRQ.exe
  2⤵
  PID:8392
- C:\Windows\System\MFFEIWT.exe
  C:\Windows\System\MFFEIWT.exe
  2⤵
  PID:8292
- C:\Windows\System\qfirLvj.exe
  C:\Windows\System\qfirLvj.exe
  2⤵
  PID:2068
- C:\Windows\System\LWYiuZy.exe
  C:\Windows\System\LWYiuZy.exe
  2⤵
  PID:8840
- C:\Windows\System\IiNBPzR.exe
  C:\Windows\System\IiNBPzR.exe
  2⤵
  PID:8488
- C:\Windows\System\KZOwpNp.exe
  C:\Windows\System\KZOwpNp.exe
  2⤵
  PID:9128
- C:\Windows\System\MeFmnhf.exe
  C:\Windows\System\MeFmnhf.exe
  2⤵
  PID:9060
- C:\Windows\System\QogxiIJ.exe
  C:\Windows\System\QogxiIJ.exe
  2⤵
  PID:9228
- C:\Windows\System\QownnIc.exe
  C:\Windows\System\QownnIc.exe
  2⤵
  PID:9244
- C:\Windows\System\qhwOcKb.exe
  C:\Windows\System\qhwOcKb.exe
  2⤵
  PID:9260
- C:\Windows\System\HwlUBdy.exe
  C:\Windows\System\HwlUBdy.exe
  2⤵
  PID:9276
- C:\Windows\System\waHJddY.exe
  C:\Windows\System\waHJddY.exe
  2⤵
  PID:9292
- C:\Windows\System\PWYBIEr.exe
  C:\Windows\System\PWYBIEr.exe
  2⤵
  PID:9308
- C:\Windows\System\poKrFYu.exe
  C:\Windows\System\poKrFYu.exe
  2⤵
  PID:9324
- C:\Windows\System\efaOKnl.exe
  C:\Windows\System\efaOKnl.exe
  2⤵
  PID:9340
- C:\Windows\System\DXPqVsT.exe
  C:\Windows\System\DXPqVsT.exe
  2⤵
  PID:9356
- C:\Windows\System\HIIMwui.exe
  C:\Windows\System\HIIMwui.exe
  2⤵
  PID:9372
- C:\Windows\System\sWZZNjZ.exe
  C:\Windows\System\sWZZNjZ.exe
  2⤵
  PID:9392
- C:\Windows\System\ltxhbgp.exe
  C:\Windows\System\ltxhbgp.exe
  2⤵
  PID:9408
- C:\Windows\System\yFlzTkL.exe
  C:\Windows\System\yFlzTkL.exe
  2⤵
  PID:9424
- C:\Windows\System\ZbbNNZQ.exe
  C:\Windows\System\ZbbNNZQ.exe
  2⤵
  PID:9440
- C:\Windows\System\kQRzjYC.exe
  C:\Windows\System\kQRzjYC.exe
  2⤵
  PID:9456
- C:\Windows\System\LFmQsdC.exe
  C:\Windows\System\LFmQsdC.exe
  2⤵
  PID:9472
- C:\Windows\System\txMObfS.exe
  C:\Windows\System\txMObfS.exe
  2⤵
  PID:9488
- C:\Windows\System\Edfqdhb.exe
  C:\Windows\System\Edfqdhb.exe
  2⤵
  PID:9504
- C:\Windows\System\fVlXsyn.exe
  C:\Windows\System\fVlXsyn.exe
  2⤵
  PID:9520
- C:\Windows\System\EfeAbco.exe
  C:\Windows\System\EfeAbco.exe
  2⤵
  PID:9536
- C:\Windows\System\krqASsB.exe
  C:\Windows\System\krqASsB.exe
  2⤵
  PID:9552
- C:\Windows\System\qaUsHuV.exe
  C:\Windows\System\qaUsHuV.exe
  2⤵
  PID:9568
- C:\Windows\System\RRekipD.exe
  C:\Windows\System\RRekipD.exe
  2⤵
  PID:9584
- C:\Windows\System\swmzDuh.exe
  C:\Windows\System\swmzDuh.exe
  2⤵
  PID:9600
- C:\Windows\System\BFLBLKW.exe
  C:\Windows\System\BFLBLKW.exe
  2⤵
  PID:9616
- C:\Windows\System\ZvtQuvh.exe
  C:\Windows\System\ZvtQuvh.exe
  2⤵
  PID:9632
- C:\Windows\System\EXeRLUo.exe
  C:\Windows\System\EXeRLUo.exe
  2⤵
  PID:9648
- C:\Windows\System\LADHHkU.exe
  C:\Windows\System\LADHHkU.exe
  2⤵
  PID:9664
- C:\Windows\System\ELGnPer.exe
  C:\Windows\System\ELGnPer.exe
  2⤵
  PID:9680
- C:\Windows\System\saedoWj.exe
  C:\Windows\System\saedoWj.exe
  2⤵
  PID:9696
- C:\Windows\System\YclSVzw.exe
  C:\Windows\System\YclSVzw.exe
  2⤵
  PID:9712
- C:\Windows\System\Ehvlliu.exe
  C:\Windows\System\Ehvlliu.exe
  2⤵
  PID:9728
- C:\Windows\System\pjSXgnA.exe
  C:\Windows\System\pjSXgnA.exe
  2⤵
  PID:9988
- C:\Windows\System\FkSTkvA.exe
  C:\Windows\System\FkSTkvA.exe
  2⤵
  PID:10004
- C:\Windows\System\XzfaWGn.exe
  C:\Windows\System\XzfaWGn.exe
  2⤵
  PID:10020
- C:\Windows\System\ZuUdVaB.exe
  C:\Windows\System\ZuUdVaB.exe
  2⤵
  PID:10036
- C:\Windows\System\yEYjGKD.exe
  C:\Windows\System\yEYjGKD.exe
  2⤵
  PID:10052
- C:\Windows\System\xNzIzgE.exe
  C:\Windows\System\xNzIzgE.exe
  2⤵
  PID:10068
- C:\Windows\System\cMdFMzc.exe
  C:\Windows\System\cMdFMzc.exe
  2⤵
  PID:9368
- C:\Windows\System\BDnxbXW.exe
  C:\Windows\System\BDnxbXW.exe
  2⤵
  PID:9516
- C:\Windows\System\nIDUzLo.exe
  C:\Windows\System\nIDUzLo.exe
  2⤵
  PID:9692
- C:\Windows\System\hLMrgwg.exe
  C:\Windows\System\hLMrgwg.exe
  2⤵
  PID:9788
- C:\Windows\System\wAYzKZX.exe
  C:\Windows\System\wAYzKZX.exe
  2⤵
  PID:9416
- C:\Windows\System\VcFaMSR.exe
  C:\Windows\System\VcFaMSR.exe
  2⤵
  PID:9812
- C:\Windows\System\ulSboUj.exe
  C:\Windows\System\ulSboUj.exe
  2⤵
  PID:9816
- C:\Windows\System\wTfszlr.exe
  C:\Windows\System\wTfszlr.exe
  2⤵
  PID:9860
- C:\Windows\System\ebtIpyN.exe
  C:\Windows\System\ebtIpyN.exe
  2⤵
  PID:9856
- C:\Windows\System\IQyMfCL.exe
  C:\Windows\System\IQyMfCL.exe
  2⤵
  PID:9880
- C:\Windows\System\bntRKZb.exe
  C:\Windows\System\bntRKZb.exe
  2⤵
  PID:9920
- C:\Windows\System\MwdhKYe.exe
  C:\Windows\System\MwdhKYe.exe
  2⤵
  PID:9960
- C:\Windows\System\oIqCgZx.exe
  C:\Windows\System\oIqCgZx.exe
  2⤵
  PID:9996
- C:\Windows\System\zmJEUiS.exe
  C:\Windows\System\zmJEUiS.exe
  2⤵
  PID:9976
- C:\Windows\System\cliCyOS.exe
  C:\Windows\System\cliCyOS.exe
  2⤵
  PID:9964
- C:\Windows\System\TftHTiL.exe
  C:\Windows\System\TftHTiL.exe
  2⤵
  PID:9452
- C:\Windows\System\LOkbZRL.exe
  C:\Windows\System\LOkbZRL.exe
  2⤵
  PID:10116
- C:\Windows\System\TZtgSIH.exe
  C:\Windows\System\TZtgSIH.exe
  2⤵
  PID:10156
- C:\Windows\System\EgqcwgT.exe
  C:\Windows\System\EgqcwgT.exe
  2⤵
  PID:10172
- C:\Windows\System\PICRpQn.exe
  C:\Windows\System\PICRpQn.exe
  2⤵
  PID:10188
- C:\Windows\System\dBlcnnh.exe
  C:\Windows\System\dBlcnnh.exe
  2⤵
  PID:10208
- C:\Windows\System\gKASeoc.exe
  C:\Windows\System\gKASeoc.exe
  2⤵
  PID:10232
- C:\Windows\System\WmScATA.exe
  C:\Windows\System\WmScATA.exe
  2⤵
  PID:9240
- C:\Windows\System\vCyRnKy.exe
  C:\Windows\System\vCyRnKy.exe
  2⤵
  PID:9288
- C:\Windows\System\jEZEsSH.exe
  C:\Windows\System\jEZEsSH.exe
  2⤵
  PID:9332
- C:\Windows\System\HpsXQRz.exe
  C:\Windows\System\HpsXQRz.exe
  2⤵
  PID:9384
- C:\Windows\System\iDoinDV.exe
  C:\Windows\System\iDoinDV.exe
  2⤵
  PID:10136
- C:\Windows\System\rNvnpkZ.exe
  C:\Windows\System\rNvnpkZ.exe
  2⤵
  PID:9608
- C:\Windows\System\CxQudjU.exe
  C:\Windows\System\CxQudjU.exe
  2⤵
  PID:9220
- C:\Windows\System\AKBuUcD.exe
  C:\Windows\System\AKBuUcD.exe
  2⤵
  PID:9352
- C:\Windows\System\gaFVNrA.exe
  C:\Windows\System\gaFVNrA.exe
  2⤵
  PID:9388
- C:\Windows\System\fTUPLRq.exe
  C:\Windows\System\fTUPLRq.exe
  2⤵
  PID:9464
- C:\Windows\System\tnSkYFQ.exe
  C:\Windows\System\tnSkYFQ.exe
  2⤵
  PID:9640
- C:\Windows\System\NeNykvd.exe
  C:\Windows\System\NeNykvd.exe
  2⤵
  PID:9560
- C:\Windows\System\DqxqJPU.exe
  C:\Windows\System\DqxqJPU.exe
  2⤵
  PID:9432
- C:\Windows\System\aRRuTyR.exe
  C:\Windows\System\aRRuTyR.exe
  2⤵
  PID:9500
- C:\Windows\System\MzvdtRI.exe
  C:\Windows\System\MzvdtRI.exe
  2⤵
  PID:9752
- C:\Windows\System\cpgIuCa.exe
  C:\Windows\System\cpgIuCa.exe
  2⤵
  PID:9872
- C:\Windows\System\pIMlDDg.exe
  C:\Windows\System\pIMlDDg.exe
  2⤵
  PID:9892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

BpPkyZi.exe

Path C:\Windows\system\BpPkyZi.exe
Size 2.1MB
SHA256 46c15a1189f66e8af5a2e002d83afd49ec9ff49d9f1e59b74b013d2f2a166caa
MD5 3b320ef690518346eaec4fba07a86ff5
SHA1 939bc1e54470c696eabd7b28c10bfdf37ae46121
SHA512 45e7bbc7efedc5abae954238f2844915814af8667ece49cc1f797eaec06225c03cd5f8356186be83c0200ea9849589ce61623846e6c78e06ef9b327fa84a3b59
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6A:BemTLkNdfE0pZrQp
MD5 SHA1 SHA512 SSDEEP

Submit Download

EDoxSlv.exe

Path C:\Windows\system\EDoxSlv.exe
Size 2.1MB
SHA256 29e97fe7f742e56fa551c5449f4e317c5238b2170cdcce7ca73ffee43e2608f6
MD5 e4f202ebe0004763c3d74aa6e6f2e6bf
SHA1 16b11dc0fab6c968840c0ac40f525b5d613f4373
SHA512 72d21314489dbdcc84d561f82b0152a8d7f0e328a4360e051d6ce15c111b957a8fdf4d5a739dfdc64c235240fe8c94061bed0f9a6eb13cfca7d0b2e3e89b0f21
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6p:BemTLkNdfE0pZrQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ESttnJs.exe

Path C:\Windows\system\ESttnJs.exe
Size 2.1MB
SHA256 ab1b89ab7b6847771d81c8a7ec18efd745c1972489fe07e50598f0803ad5b2b7
MD5 0a9eea002f284dd2f19365910e390552
SHA1 6d30c8e0958ae2072de3f36089a64d0e7bbd9895
SHA512 77b4c5b9024c7eed4b0bc0849deae7c38c724a42f037ce0db5a15f634ccc865b192ea09748e2a1c654ac63126bd829c41d186d2c5d5cf8e70377c41aaabdb8a2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6a:BemTLkNdfE0pZrQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

GGwIXXD.exe

Path C:\Windows\system\GGwIXXD.exe
Size 2.1MB
SHA256 48788b9ec96a1b2d59d9a59f165148150a633e58bc724c33f628adbae76698a2
MD5 a247c034bd93623ce1f817ecdaf0dc1e
SHA1 e89a46ace787946a81e8f0e9b608a0d70385aca2
SHA512 00ca4364b01076da0067dee8da8df93b603dfdca1d9e4b82b46efeda8fcde6ebadd6e5bc159572ed16fccad9dff4cd4b4a81654b334c71673d4f04b820a0ad6c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6Z:BemTLkNdfE0pZrQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

HTziBXo.exe

Path C:\Windows\system\HTziBXo.exe
Size 2.1MB
SHA256 7ad45c214e17cea177a5ea0b6e5a679a75a9cc54227e3fccac0a74d6187a1af1
MD5 3950e05114f11ed05fbba18076a9f1b2
SHA1 320e0a7d65cca3213a712061ac795c5cd0369dd9
SHA512 94005174fe7f4da20da4bf5462ca033d785002b2b487a727f241c8fa0d1545758295abcc000a17fcdb81761f4fb7393aae13be28db28c3507d8405c4cd54e077
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6H:BemTLkNdfE0pZrQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

NLLvPaB.exe

Path C:\Windows\system\NLLvPaB.exe
Size 2.1MB
SHA256 650c266d383bfd1a34ef4d545fdb0ed94306b9f45f6734ea59b5d77775e680bc
MD5 5bdd8d7654ed703d6a7be4369c1cd7bb
SHA1 70f111e3cd818c289eeb7063415169304893c24f
SHA512 a11579d1108fbfae6278d27e51a9346d4f210b8369ace21613389ed53f6b3c2f3f448d485b2c83105ca078b9c68711c64a787cdbbde5f4c60f255c55e0800260
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6M:BemTLkNdfE0pZrQv
MD5 SHA1 SHA512 SSDEEP

Submit Download

PgxOrbg.exe

Path C:\Windows\system\PgxOrbg.exe
Size 2.1MB
SHA256 cb781718b72b15cf6f12f362666493ae8e0305a9e75b418735ce5e1e9cf05fee
MD5 a5c1232daa88440cd71ffd7dde6b1413
SHA1 a50609d82b435f975686619e3f1437b287cd20d2
SHA512 0690441d2b3bb804c2b965353f66ce5102d6576d6b746e709435b2c83ffce37ebab6e0356254a77cd514c55101369850444d8ad94cc55ae79b7b4cc5156561db
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6J:BemTLkNdfE0pZrQ6
MD5 SHA1 SHA512 SSDEEP

Submit Download

PqqFCPx.exe

Path C:\Windows\system\PqqFCPx.exe
Size 2.1MB
SHA256 c99009c4a0bad4691e2ca6b0b97c2cf4c683bd92a1ffee11e40bf73cd17e5db8
MD5 e77bb3317780bf30fc3ec876f4966ce5
SHA1 2a35cb6ae7fb6b4f83647b10970798252dea92ed
SHA512 ab93687b2c798e605320788e7ecb3074346d1652bd724907d87c6b984c4d500c1601ae929b325bffbddb8171be385a6286d99304644c9562a6ab5758f4ba939c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC61:BemTLkNdfE0pZrQE
MD5 SHA1 SHA512 SSDEEP

Submit Download

QpAzqic.exe

Path C:\Windows\system\QpAzqic.exe
Size 2.1MB
SHA256 2aa68c2cd2376dbc47d55e0eff0ae77b4a6870672fcb815a6093de6f6bbc2d7e
MD5 f3138eb2f6f8491ae9f97493de29ad28
SHA1 6302f9d65ac3094f92b02c77c44c3fc44a53e08a
SHA512 fd35ed536bad8e91bfb99c6086bd794e48f24bb6abde4680fbdae8ab734c9c1c54bc0ac92b90144acb743638125cce836fc5af12a12c0ae06b39637f3a4e55ad
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6l:BemTLkNdfE0pZrQW
MD5 SHA1 SHA512 SSDEEP

Submit Download

TKPyLLL.exe

Path C:\Windows\system\TKPyLLL.exe
Size 2.1MB
SHA256 ca901620e661a988d9d01604ca46f96bc133ec3f2a34b5ee2a26077928844924
MD5 50874d52d7f460898f08bfcd52b4bf58
SHA1 d0ff89fd72aca1775c34d99683660f44ca3010a8
SHA512 14d82230b1b6f59e192208ed51ea8fa633e7ccbf92bb15bd5c272831fa6a96fcbb2c7e58685eefa66a87b2464ad6f9315be777f9a1eea04a7d0c92ce77600568
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6x:BemTLkNdfE0pZrQW
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmdyiLX.exe

Path C:\Windows\system\TmdyiLX.exe
Size 2.1MB
SHA256 47300bd15eed515acbcfb3d6a0e06a01abb6e19f1eec0a34ae4a25a7f9e7727e
MD5 cf1cab7570fbaa045f2e29e41a1efaa9
SHA1 69e73a7da37a0671eb6fcad2cf2b76eb3fb11cdd
SHA512 65a5bf2baa581f4de0944a1a62116f9a70eb8aa634f607eb12d80b0eec183c293fedebf22715846162b3308048211a520485f3a37ef22266ebd8acf780ebc755
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC69:BemTLkNdfE0pZrQ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

VViHKxQ.exe

Path C:\Windows\system\VViHKxQ.exe
Size 2.1MB
SHA256 e6e7b2e6da0f4a137768a2257e5987587e7d89b4cc6b2ae893ecf0bd155b3db2
MD5 1e60cf8407382ed12c09a519ae73f715
SHA1 819d8059b875a9902b7c7e33a03f61ea446a57b1
SHA512 04a7971722b0f0442c54afd8727f8279aad42b961228b30b28b2767c3769f0a10cbc9b4e1d1353bffc0726f9d05bdb7b9a13e1ee0d04337a6d8353ccacb56c68
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6y:BemTLkNdfE0pZrQt
MD5 SHA1 SHA512 SSDEEP

Submit Download

VWItURg.exe

Path C:\Windows\system\VWItURg.exe
Size 2.1MB
SHA256 8d0ade7e1c0e9f4247c04a4183e661a4d1f876a3a8c567d9e7c56d23fc488c15
MD5 bba7e158ba007514095a25b48ca45f5f
SHA1 7199ff27780d7ecfb703dd2ebfb855bd58bd2d53
SHA512 53ae2f473e720c60884ac575d73e1feb8b3be733c181ca2014c2c6f4d74bc4adb39e02aab55eb18133c4268cbd05f1c7a266edf30bdcc98fb6ea1c25d02a36f0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6i:BemTLkNdfE0pZrQz
MD5 SHA1 SHA512 SSDEEP

Submit Download

YOgVvHv.exe

Path C:\Windows\system\YOgVvHv.exe
Size 2.1MB
SHA256 b58e6b01286a1652cff7fa106dbe902096506616c6fce26d0cc6110d121238e9
MD5 0277e66e69f747270987e37ceabd844f
SHA1 fd78b4333f8d124453da90068ff39c7e62298d5a
SHA512 2bfb38de524f4707d860acc9e9745b35ab862c0c2f1fa8747aa56d270f5ff6d2fa807a87d16e6c1e4bb208346101c4768cca5a6945ae05ba23913809f49896c0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC63:BemTLkNdfE0pZrQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZjwQrJq.exe

Path C:\Windows\system\ZjwQrJq.exe
Size 2.1MB
SHA256 a9b03da4729523d086bc6138139aec38d75a511831a9571ec832500d364e645c
MD5 d317813cbde680f61882e08cf829b29e
SHA1 ff7ef45d6f7632e6c2009dffa911e223303349a5
SHA512 2cacf36c85c2a0d7082a1b603c0bbe5f2eff462fa8f99b54647bcc50237acc3639d3309e80ce678565f17151bc6e40ba3ea900f36b466dd883e96c4e89f8af3d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6X:BemTLkNdfE0pZrQy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bevSVIL.exe

Path C:\Windows\system\bevSVIL.exe
Size 2.1MB
SHA256 66816ae5dff4fd08f3304eb9641cee965d2f92c995de98857e0b184ffa884807
MD5 b05b3a6e28314e73c286909f74ddc17b
SHA1 739e4f0bc4b38c0d7fc75de64cdf0eacf0a4a39c
SHA512 07f77984cb10ca63041ff6742dafd48fa2d2eb9b381c96d43aea8084f7197c49ed0822e56f8322a780b661fe483b314b1aee72f7a8db999570347e0110b2d4b8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6w:BemTLkNdfE0pZrQV
MD5 SHA1 SHA512 SSDEEP

Submit Download

cIhUVcS.exe

Path C:\Windows\system\cIhUVcS.exe
Size 2.1MB
SHA256 632bd28f975c0c7cd2fd49439f74bf39852cad259769c834500ccfce4691b372
MD5 5631abe64bbf1e6eaa055b58023a5589
SHA1 ae805a6d2b0ddb87ff77cdfcfc2f8eb35e981bb2
SHA512 5ef991f9fded0729f201862b11eed6bed1d288c6cb049b75032ea3efa9624b9a6bbb1f4ccd530df02981986f8cea8882c5a3a880c14f68dcd4d09d2d350dd55d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC68:BemTLkNdfE0pZrQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

fsAGSWE.exe

Path C:\Windows\system\fsAGSWE.exe
Size 2.1MB
SHA256 db747b549a750c2220650691fc1a50a1d4bba4fa4888afec08d28b1e0d1b5fb9
MD5 0a14afee85794784138159c2dd5fec3e
SHA1 de36a0834344c4c9cce956bbc11e2bede7168144
SHA512 02a32eb33d55c9e1c7252ce70482c1a7a0569b08e819e25516503037df41da00057358863d8e9c348627da751e40b6c19071586186d39ed66138e9485bad93fb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6j:BemTLkNdfE0pZrQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

gieyfBK.exe

Path C:\Windows\system\gieyfBK.exe
Size 2.1MB
SHA256 0c528364c19d44bc0bc0b7f2fa3da471b4d382dc5a1631aaa294b09b4538cb6c
MD5 487e7c48eaf7b490b91e88d2cf4e8bac
SHA1 3b38ec5390f41a0882e84355920961ebe2b153ae
SHA512 d2bc3d665cddd7bf7b52b397cab5b21b413d7b8ae16c5ccbe6c02bce0c3f970090c23e0b52984f37725632b23c1188f01f994f4e84c2ce45f40969dc677f54fc
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6N:BemTLkNdfE0pZrQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

iuRZyaq.exe

Path C:\Windows\system\iuRZyaq.exe
Size 2.1MB
SHA256 2dd797b153f19be5d7969121c0eba2ee565810b259365baf4ae195323afab898
MD5 4cf711585f23fd4821e2ff0f5cd725c2
SHA1 7e605b14abe1cd74ea276a494c7fdcf35f5f81da
SHA512 6595344ea1a61a09272379b3808822924a3928a7489682b74189b2b806b9f10e6a95686c3c3f112a1fc448bc493c30acc4797524184b80cb3ce8d8598652f309
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6c:BemTLkNdfE0pZrQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

kToqcDK.exe

Path C:\Windows\system\kToqcDK.exe
Size 2.1MB
SHA256 7dd659d960996a53626b9ee29b97f2d2f4ac936f4b3422d8d937b36f61f76d56
MD5 7f4500910e4e6eb415cb3984297db54d
SHA1 7475943f946a0265d01d2341e9c8e8c4ad52c3cd
SHA512 0364ec5317502d638143c67a3eacc42dbf9e315bc63e5258e95ad640fcd28ec94e7b85f8f021a3a674d087425969cc413753e9a3c6c0f696923fd50a96e0fc22
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6E:BemTLkNdfE0pZrQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oSyROHC.exe

Path C:\Windows\system\oSyROHC.exe
Size 2.1MB
SHA256 a3860fd21417718295512c1b25ced7b986546b9accea2965c53a596fab94609c
MD5 ea7ee772a13f6dfe483513340a4f145c
SHA1 92fe2af05385295028c3126590f928d8e4232080
SHA512 96bb7883b494f30cbacb3a988ccd4385611f00705a51834d9440cc8b643a7cde09abaa723290e4824114da5f98a628648cb6653e8b0911904c30ccb0d8bf7ec7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6o:BemTLkNdfE0pZrQV
MD5 SHA1 SHA512 SSDEEP

Submit Download

qhLveyZ.exe

Path C:\Windows\system\qhLveyZ.exe
Size 2.1MB
SHA256 997ee2bf9cdbd01e19de317490bfd5a53173fba1b2b708a40fa5a0f62a5e6e04
MD5 14393d335bee215654365f20c0d481a7
SHA1 b38eb7f4e0c4f35624bb8e547d049978e090e906
SHA512 a0c193667ccc57bafc4e1cdfc85c645daf53700911004bb864de4323dbc1a4616788d2c97270361dfa5b141fe58052854f05c8d4bc262cade80bf94111e6ec67
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6r:BemTLkNdfE0pZrQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rxujEzM.exe

Path C:\Windows\system\rxujEzM.exe
Size 2.1MB
SHA256 e883ee50081b51f2e162c44089aae5b097add89544ddd4e79bdfac7deea91cf5
MD5 7e0f6b6faae39e8ab153ee8edf340910
SHA1 d14876c4f9f863d624fbb4857311db26ef7a0db1
SHA512 005cfd3005f04ad62a6bc7252cc37331e85e2633f37020d3e11c4b3099e2810bba1b043d981ae3a1bf8781eb1de8330c60176759672932e2372b38caf1d89f1b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6Y:BemTLkNdfE0pZrQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sTfTbZn.exe

Path C:\Windows\system\sTfTbZn.exe
Size 2.1MB
SHA256 72abaf111432a2c38923428e0392da18a22af92c36a0d5983d72e159f3a6f964
MD5 926017e83b7dfcaf8e811d56244af098
SHA1 ad3f0c70cd8ba2a8810bc65bc3ba8d0d1c561176
SHA512 259aef371407a9c95403f3fcda1750a2e95bfc5596cf898cb9fe1c58e018caf52f76a1838ba663c1965af42ab888ae029ceed323c9cdcf10d9ea26f7243a1d8f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6G:BemTLkNdfE0pZrQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

uoKwYBd.exe

Path C:\Windows\system\uoKwYBd.exe
Size 2.1MB
SHA256 0c6b6e05722fdc8527b6975822f6d71fbb99178655afccc7de7183313fb826d5
MD5 6ef223a56c40a454ea135991cc5c4a4b
SHA1 7939daf3cd945997beb629760e30f573db0879e4
SHA512 2ab0200c33825d79a89120005f48749763d0e4a916006aa06ba8fc675c350508c42bc95daa5eea52cf4ea3de87604db88847762a631d4bf890f3a7083d31b01a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6d:BemTLkNdfE0pZrQs
MD5 SHA1 SHA512 SSDEEP

Submit Download

wAOmKMM.exe

Path C:\Windows\system\wAOmKMM.exe
Size 2.1MB
SHA256 39d9ac5a013f9e4da4950307795bc69857c92c8be68c99c0df4e9fb0728f67e2
MD5 aed9395c245aa59272c1f66f2840bde1
SHA1 94c03b3cf246704bd1ad0adad646140b4bd7acea
SHA512 9d880e8ddd853bdeeda7ae7f2c3d0cd82c434c855db14d2dbf63fdf2d313727b5ed1b14151a070d231d24455dc5bb76b5e569a53b5687814edb4d1f4757fd6bb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6u:BemTLkNdfE0pZrQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

xBmlFWq.exe

Path C:\Windows\system\xBmlFWq.exe
Size 2.1MB
SHA256 0a15bc118086576526045c927ca9e106605a31063a5a02514a58814609d4854d
MD5 18a03235be5a39a2200924d00842e1da
SHA1 c2e9046de5b6683eadeb9856690e4f8e1ae6d503
SHA512 aa1b28115f05a9af731dab6aff4146da8447fe10147bf6e096bfc70eb2b6ef81f54ac1c95354942c37ae042de1b14799889042e8ae182029a3902913ce049b90
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6o:BemTLkNdfE0pZrQj
MD5 SHA1 SHA512 SSDEEP

Submit Download

xSXxKoo.exe

Path C:\Windows\system\xSXxKoo.exe
Size 2.1MB
SHA256 537f5f3eb888a1ef4539bf168fbb18a8719a53cd6aa68904fceedc1b205f09b6
MD5 9eb5f9358326a3daa8f01c68b8efa76f
SHA1 c800f179b052ed567f886f280bf7405db3dfe637
SHA512 10cafac6d02d1ef7b0811044a4c1dbb12bdecf1ba9e958b24bcea9bc92b00cc72595d88d47c1bc2047eff3d44a1f318607466019e5cb86aeccfff856b4ac35f0
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6x:BemTLkNdfE0pZrQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

MFPWZGh.exe

Path \Windows\system\MFPWZGh.exe
Size 2.1MB
SHA256 f9bf29fe1a8de7c8e44d25b51ebb007dac8addc705cf2aa16e8720e14879f7d6
MD5 35f4a4f0a7b0d206d9d0a3e11e4291d1
SHA1 181f667bbd92f11c8d5015e55c133342945fd4d5
SHA512 ff5dab1bef72c4b0cffd1fbc3fe4613c6b2c632ed11e29014df9f11644d1cd01bf9a0edff960d179444c904b7752d1cf25c7e1ccb7d934bbc3488abe8165d0f3
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6l:BemTLkNdfE0pZrQO
MD5 SHA1 SHA512 SSDEEP

Submit Download

bfVqQnl.exe

Path \Windows\system\bfVqQnl.exe
Size 2.1MB
SHA256 33dcb248f14d6f8c677005d7af79b14975a67cd25464e3760883637ba1a711d3
MD5 8c52a54b6787a560087b8dcb3b6c8c52
SHA1 232e626c6c5386d2d234143ac0be058d1b1fde9e
SHA512 58a6eb0c2e4441af32b94b2cdb3c95c2cbf55de5a11cc679b5adc14e7f245834edd9dc4d399b4376425e9b0403a2b23fcb81a21d904c38c07780304bd7059ff7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6K:BemTLkNdfE0pZrQT
MD5 SHA1 SHA512 SSDEEP

Submit Download

lNOfhPB.exe

Path \Windows\system\lNOfhPB.exe
Size 2.1MB
SHA256 c835065b309f8f0d7d57bc8d195b37e696947a5e132696e7ddb4a70e3f585c4e
MD5 69ca50dca24d17c0e513e36b014b3856
SHA1 299dd4fed121b0929229d621a4cc372d46d608ce
SHA512 a329550cd0be94ac97961a543d341297928beeef923bdff17a09f98d60a00b02509c80a09596368d393c2958435d3ee212b51a36308abd8a497d52f544ff97d2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIQOY7CH09QhC6D:BemTLkNdfE0pZrQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-56-0x000000013F9F0000-0x000000013FD44000-memory.dmp

Download

memory/1368-21-0x000000013FC40000-0x000000013FF94000-memory.dmp

Download

memory/1368-4071-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-111-0x000000013FD40000-0x0000000140094000-memory.dmp

Download

memory/1368-4070-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Download

memory/1368-109-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Download

memory/1368-4053-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-4055-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/1368-92-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/1368-82-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-4050-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Download

memory/1368-65-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-4049-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-2-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Download

memory/1368-73-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Download

memory/1368-1701-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-70-0x000000013F3A0000-0x000000013F6F4000-memory.dmp

Download

memory/1368-10-0x000000013FCE0000-0x0000000140034000-memory.dmp

Download

memory/1368-114-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-0-0x0000000000080000-0x0000000000090000-memory.dmp

Download

memory/1368-27-0x000000013F740000-0x000000013FA94000-memory.dmp

Download

memory/1368-49-0x0000000002010000-0x0000000002364000-memory.dmp

Download

memory/1368-35-0x000000013F850000-0x000000013FBA4000-memory.dmp

Download

memory/1368-40-0x000000013F720000-0x000000013FA74000-memory.dmp

Download

memory/1532-4056-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/1532-96-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/1532-4067-0x000000013FC30000-0x000000013FF84000-memory.dmp

Download

memory/2188-83-0x000000013F110000-0x000000013F464000-memory.dmp

Download

memory/2188-4054-0x000000013F110000-0x000000013F464000-memory.dmp

Download

memory/2188-4069-0x000000013F110000-0x000000013F464000-memory.dmp

Download

memory/2324-4059-0x000000013F980000-0x000000013FCD4000-memory.dmp

Download

memory/2324-13-0x000000013F980000-0x000000013FCD4000-memory.dmp

Download

memory/2324-76-0x000000013F980000-0x000000013FCD4000-memory.dmp

Download

memory/2524-50-0x000000013F2D0000-0x000000013F624000-memory.dmp

Download

memory/2524-4062-0x000000013F2D0000-0x000000013F624000-memory.dmp

Download

memory/2532-4065-0x000000013F450000-0x000000013F7A4000-memory.dmp

Download

memory/2532-1703-0x000000013F450000-0x000000013F7A4000-memory.dmp

Download

memory/2532-69-0x000000013F450000-0x000000013F7A4000-memory.dmp

Download

memory/2556-4063-0x000000013F9F0000-0x000000013FD44000-memory.dmp

Download

memory/2556-57-0x000000013F9F0000-0x000000013FD44000-memory.dmp

Download

memory/2620-4052-0x000000013F5B0000-0x000000013F904000-memory.dmp

Download

memory/2620-77-0x000000013F5B0000-0x000000013F904000-memory.dmp

Download

memory/2620-4068-0x000000013F5B0000-0x000000013F904000-memory.dmp

Download

memory/2648-22-0x000000013FC40000-0x000000013FF94000-memory.dmp

Download

memory/2648-4058-0x000000013FC40000-0x000000013FF94000-memory.dmp

Download

memory/2688-12-0x000000013FCE0000-0x0000000140034000-memory.dmp

Download

memory/2688-71-0x000000013FCE0000-0x0000000140034000-memory.dmp

Download

memory/2688-4057-0x000000013FCE0000-0x0000000140034000-memory.dmp

Download

memory/2752-4060-0x000000013F850000-0x000000013FBA4000-memory.dmp

Download

memory/2752-36-0x000000013F850000-0x000000013FBA4000-memory.dmp

Download

memory/2792-115-0x000000013F720000-0x000000013FA74000-memory.dmp

Download

memory/2792-41-0x000000013F720000-0x000000013FA74000-memory.dmp

Download

memory/2792-4064-0x000000013F720000-0x000000013FA74000-memory.dmp

Download

memory/2884-88-0x000000013F740000-0x000000013FA94000-memory.dmp

Download

memory/2884-28-0x000000013F740000-0x000000013FA94000-memory.dmp

Download

memory/2884-4061-0x000000013F740000-0x000000013FA94000-memory.dmp

Download

memory/2952-4066-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Download

memory/2952-74-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Download

memory/2952-4051-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads