xmrig | c6f20d1a0e95155f5d979143287a5009b4a86de043404180524842ca76650ce9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
Size 2.4MB
Sample240522-22nerscd7x
SHA256 c6f20d1a0e95155f5d979143287a5009b4a86de043404180524842ca76650ce9
MD5 5378b69f3f2c410e418ad3531edbfdd0
SHA1 862c8fce7ad630cfc53c0f742289ae3ec1402c79
SHA512 f3ee1efa8ac5c2c83946a828d53969f2f26c04936f130e06b4afd6d6593a31e5bdf8ada4d349113fe31e7267fa238d9ff4b05759c24dd23b008324995175adb6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jQ:BemTLkNdfE0pZr3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2412-1-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	xmrig
behavioral1/files/0x000a000000012286-3.dat	xmrig
behavioral1/files/0x0036000000015670-14.dat	xmrig
behavioral1/files/0x0007000000015bf4-20.dat	xmrig
behavioral1/memory/3060-27-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig
behavioral1/memory/2140-29-0x000000013F0F0000-0x000000013F444000-memory.dmp	xmrig
behavioral1/memory/3036-28-0x000000013FDF0000-0x0000000140144000-memory.dmp	xmrig
behavioral1/files/0x0008000000015b6e-22.dat	xmrig
behavioral1/memory/2412-24-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/2004-18-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/2660-40-0x000000013FBC0000-0x000000013FF14000-memory.dmp	xmrig
behavioral1/files/0x0008000000015cb8-34.dat	xmrig
behavioral1/memory/2616-57-0x000000013F9B0000-0x000000013FD04000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cf0-61.dat	xmrig
behavioral1/memory/2188-69-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/2412-84-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/2504-78-0x000000013F030000-0x000000013F384000-memory.dmp	xmrig
behavioral1/memory/2412-99-0x0000000002080000-0x00000000023D4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016c52-104.dat	xmrig
behavioral1/files/0x0006000000016cc1-121.dat	xmrig
behavioral1/files/0x0006000000016d43-151.dat	xmrig
behavioral1/files/0x0006000000016d68-171.dat	xmrig
behavioral1/memory/2532-1106-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/memory/2524-507-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2764-352-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016dba-190.dat	xmrig
behavioral1/files/0x0006000000016d9f-186.dat	xmrig
behavioral1/files/0x0006000000016d8b-181.dat	xmrig
behavioral1/files/0x0006000000016d6f-176.dat	xmrig
behavioral1/files/0x0006000000016d64-166.dat	xmrig
behavioral1/files/0x0006000000016d5f-161.dat	xmrig
behavioral1/files/0x0006000000016d4b-156.dat	xmrig
behavioral1/files/0x0006000000016d3b-146.dat	xmrig
behavioral1/files/0x0006000000016d32-141.dat	xmrig
behavioral1/files/0x0006000000016d2a-136.dat	xmrig
behavioral1/files/0x0006000000016d17-131.dat	xmrig
behavioral1/files/0x0006000000016ceb-126.dat	xmrig
behavioral1/files/0x0006000000016c78-116.dat	xmrig
behavioral1/files/0x0006000000016c6f-110.dat	xmrig
behavioral1/memory/2952-100-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/memory/2780-92-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016835-90.dat	xmrig
behavioral1/files/0x0006000000016a8a-97.dat	xmrig
behavioral1/memory/2412-77-0x0000000002080000-0x00000000023D4000-memory.dmp	xmrig
behavioral1/memory/2412-76-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	xmrig
behavioral1/memory/2604-85-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/2004-83-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016581-74.dat	xmrig
behavioral1/files/0x00060000000165e1-81.dat	xmrig
behavioral1/memory/2532-63-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	xmrig
behavioral1/files/0x0008000000015d12-67.dat	xmrig
behavioral1/memory/2524-49-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/files/0x0007000000015ce8-47.dat	xmrig
behavioral1/files/0x0036000000015678-54.dat	xmrig
behavioral1/memory/2764-42-0x000000013F790000-0x000000013FAE4000-memory.dmp	xmrig
behavioral1/files/0x0007000000015cdf-38.dat	xmrig
behavioral1/memory/2188-1885-0x000000013F8F0000-0x000000013FC44000-memory.dmp	xmrig
behavioral1/memory/2504-2358-0x000000013F030000-0x000000013F384000-memory.dmp	xmrig
behavioral1/memory/2604-2562-0x000000013FF40000-0x0000000140294000-memory.dmp	xmrig
behavioral1/memory/2780-2642-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/memory/2952-2885-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/memory/2140-4022-0x000000013F0F0000-0x000000013F444000-memory.dmp	xmrig
behavioral1/memory/2004-4024-0x000000013F190000-0x000000013F4E4000-memory.dmp	xmrig
behavioral1/memory/3060-4023-0x000000013FB20000-0x000000013FE74000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2004	IAmVpYz.exe
2140	MOAorLb.exe
3060	VYGIwSZ.exe
3036	KYkaXDP.exe
2660	SnUIxJM.exe
2764	WvbWlZV.exe
2524	OWAoXEY.exe
2616	UELneQS.exe
2532	rNPnWQH.exe
2188	sxgFHEY.exe
2504	nVKBbew.exe
2604	gjoxGKd.exe
2780	ZqdSlia.exe
2952	DHmyDzW.exe
1628	tJbyNMx.exe
1972	ckLBeFq.exe
1940	bagnMgk.exe
336	KlHOkUa.exe
1632	CSCiYsW.exe
2328	QwshlfD.exe
2488	yyHWdUc.exe
1152	azWrnyF.exe
2596	rtmgIDY.exe
1752	huzAUAM.exe
2308	tQaqGTm.exe
2084	AMwDopy.exe
820	QEmufVt.exe
2480	WGTPQsG.exe
1080	QPNFfoi.exe
264	EgRBdPS.exe
1228	hwpATiY.exe
1624	yuxacwm.exe
2540	Jbhmmja.exe
2032	sSvClxm.exe
1760	IshJFLB.exe
444	RTCsnga.exe
2468	pTlOfaH.exe
2356	xEtWcTC.exe
2152	vVBQXfO.exe
1356	CmQKgpL.exe
1564	CHQhSfi.exe
1344	saclQkP.exe
1336	RprCWdt.exe
2920	qIFwlZk.exe
1048	oRkIgUv.exe
2244	GaLcjYw.exe
944	uTFEHvb.exe
2212	PvZymuH.exe
1232	ONxjZWV.exe
2092	UZKLvGJ.exe
2304	jJNJdum.exe
2200	fXccDxr.exe
2156	UUgTIpo.exe
604	XswtEGI.exe
1920	NEkyMMR.exe
1656	lKuiUbG.exe
2932	GTTsYfD.exe
2408	qpmcstK.exe
1580	okOEcsu.exe
2020	PZMahfT.exe
2732	FcpCNbX.exe
2976	bODyuab.exe
2628	gNWUvbQ.exe
2204	MrLODSo.exe

Loads dropped DLL 64 IoCs

pid	Process
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-1-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	upx
behavioral1/files/0x000a000000012286-3.dat	upx
behavioral1/files/0x0036000000015670-14.dat	upx
behavioral1/files/0x0007000000015bf4-20.dat	upx
behavioral1/memory/3060-27-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/2140-29-0x000000013F0F0000-0x000000013F444000-memory.dmp	upx
behavioral1/memory/3036-28-0x000000013FDF0000-0x0000000140144000-memory.dmp	upx
behavioral1/files/0x0008000000015b6e-22.dat	upx
behavioral1/memory/2004-18-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/memory/2660-40-0x000000013FBC0000-0x000000013FF14000-memory.dmp	upx
behavioral1/files/0x0008000000015cb8-34.dat	upx
behavioral1/memory/2616-57-0x000000013F9B0000-0x000000013FD04000-memory.dmp	upx
behavioral1/files/0x0007000000015cf0-61.dat	upx
behavioral1/memory/2188-69-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/2504-78-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/files/0x0006000000016c52-104.dat	upx
behavioral1/files/0x0006000000016cc1-121.dat	upx
behavioral1/files/0x0006000000016d43-151.dat	upx
behavioral1/files/0x0006000000016d68-171.dat	upx
behavioral1/memory/2532-1106-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/memory/2524-507-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2764-352-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x0006000000016dba-190.dat	upx
behavioral1/files/0x0006000000016d9f-186.dat	upx
behavioral1/files/0x0006000000016d8b-181.dat	upx
behavioral1/files/0x0006000000016d6f-176.dat	upx
behavioral1/files/0x0006000000016d64-166.dat	upx
behavioral1/files/0x0006000000016d5f-161.dat	upx
behavioral1/files/0x0006000000016d4b-156.dat	upx
behavioral1/files/0x0006000000016d3b-146.dat	upx
behavioral1/files/0x0006000000016d32-141.dat	upx
behavioral1/files/0x0006000000016d2a-136.dat	upx
behavioral1/files/0x0006000000016d17-131.dat	upx
behavioral1/files/0x0006000000016ceb-126.dat	upx
behavioral1/files/0x0006000000016c78-116.dat	upx
behavioral1/files/0x0006000000016c6f-110.dat	upx
behavioral1/memory/2952-100-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/memory/2780-92-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/files/0x0006000000016835-90.dat	upx
behavioral1/files/0x0006000000016a8a-97.dat	upx
behavioral1/memory/2412-77-0x0000000002080000-0x00000000023D4000-memory.dmp	upx
behavioral1/memory/2412-76-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	upx
behavioral1/memory/2604-85-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/2004-83-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/files/0x0006000000016581-74.dat	upx
behavioral1/files/0x00060000000165e1-81.dat	upx
behavioral1/memory/2532-63-0x000000013F2A0000-0x000000013F5F4000-memory.dmp	upx
behavioral1/files/0x0008000000015d12-67.dat	upx
behavioral1/memory/2524-49-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/files/0x0007000000015ce8-47.dat	upx
behavioral1/files/0x0036000000015678-54.dat	upx
behavioral1/memory/2764-42-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx
behavioral1/files/0x0007000000015cdf-38.dat	upx
behavioral1/memory/2188-1885-0x000000013F8F0000-0x000000013FC44000-memory.dmp	upx
behavioral1/memory/2504-2358-0x000000013F030000-0x000000013F384000-memory.dmp	upx
behavioral1/memory/2604-2562-0x000000013FF40000-0x0000000140294000-memory.dmp	upx
behavioral1/memory/2780-2642-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/memory/2952-2885-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/memory/2140-4022-0x000000013F0F0000-0x000000013F444000-memory.dmp	upx
behavioral1/memory/2004-4024-0x000000013F190000-0x000000013F4E4000-memory.dmp	upx
behavioral1/memory/3060-4023-0x000000013FB20000-0x000000013FE74000-memory.dmp	upx
behavioral1/memory/3036-4025-0x000000013FDF0000-0x0000000140144000-memory.dmp	upx
behavioral1/memory/2660-4026-0x000000013FBC0000-0x000000013FF14000-memory.dmp	upx
behavioral1/memory/2764-4027-0x000000013F790000-0x000000013FAE4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TrBTVIc.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\fOfloEd.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\stwYWit.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\FMyxBkL.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\uiDrcmJ.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\PlzjXRD.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\ByOngVw.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\PsweHIk.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\htvyFKf.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\uGgwWMT.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\PEkwWuH.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\ftzfihs.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\TPwjwjE.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\QPNFfoi.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\bmqxtMa.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZOjWYjZ.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\CBtMxTI.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\iYJsOoF.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\VJTpxqn.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\aMKKAHP.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\DmLNzHL.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\MrLODSo.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\zVyFJin.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\LNYeHyr.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\uhFYwFN.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\zPfIHrn.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\aFegGfv.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\gpRwjna.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\HZUrkPj.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\iSOKyrH.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\dnTGrXD.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\AcaAHlL.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\jYpENcB.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\WTXjCNC.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\IRLPRbB.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\qJZGxiH.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\eprRaXi.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\yUoEkZK.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\fLlGFoU.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\FAKcwAZ.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\AprqmeD.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\gIbKVpU.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\XVruKBw.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\hmJVnDO.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\xnURXhs.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\DOzjkdS.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\txGQJpf.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\dAyNlVc.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\DBxvlcq.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\zlBiUXC.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\RlCtcPL.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\SmrAflF.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\MulTSWm.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\BpzxcTa.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\wEfQjLQ.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\ImycMMJ.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\bwutGZc.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\SGpYejh.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZMCsuLd.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\duWYnFk.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\QaiHGOO.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\viXLtzq.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\AJFjlAo.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
File created	C:\Windows\System\INLJgqp.exe	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2140	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	29
PID 2412 wrote to memory of 2140	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	29
PID 2412 wrote to memory of 2140	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	29
PID 2412 wrote to memory of 2004	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	30
PID 2412 wrote to memory of 2004	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	30
PID 2412 wrote to memory of 2004	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	30
PID 2412 wrote to memory of 3036	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	31
PID 2412 wrote to memory of 3036	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	31
PID 2412 wrote to memory of 3036	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	31
PID 2412 wrote to memory of 3060	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	32
PID 2412 wrote to memory of 3060	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	32
PID 2412 wrote to memory of 3060	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	32
PID 2412 wrote to memory of 2660	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	33
PID 2412 wrote to memory of 2660	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	33
PID 2412 wrote to memory of 2660	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	33
PID 2412 wrote to memory of 2764	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	34
PID 2412 wrote to memory of 2764	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	34
PID 2412 wrote to memory of 2764	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	34
PID 2412 wrote to memory of 2524	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	35
PID 2412 wrote to memory of 2524	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	35
PID 2412 wrote to memory of 2524	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	35
PID 2412 wrote to memory of 2616	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	36
PID 2412 wrote to memory of 2616	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	36
PID 2412 wrote to memory of 2616	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	36
PID 2412 wrote to memory of 2532	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	37
PID 2412 wrote to memory of 2532	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	37
PID 2412 wrote to memory of 2532	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	37
PID 2412 wrote to memory of 2188	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	38
PID 2412 wrote to memory of 2188	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	38
PID 2412 wrote to memory of 2188	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	38
PID 2412 wrote to memory of 2504	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	39
PID 2412 wrote to memory of 2504	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	39
PID 2412 wrote to memory of 2504	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	39
PID 2412 wrote to memory of 2604	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	40
PID 2412 wrote to memory of 2604	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	40
PID 2412 wrote to memory of 2604	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	40
PID 2412 wrote to memory of 2780	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	41
PID 2412 wrote to memory of 2780	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	41
PID 2412 wrote to memory of 2780	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	41
PID 2412 wrote to memory of 2952	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	42
PID 2412 wrote to memory of 2952	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	42
PID 2412 wrote to memory of 2952	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	42
PID 2412 wrote to memory of 1628	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	43
PID 2412 wrote to memory of 1628	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	43
PID 2412 wrote to memory of 1628	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	43
PID 2412 wrote to memory of 1972	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	44
PID 2412 wrote to memory of 1972	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	44
PID 2412 wrote to memory of 1972	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	44
PID 2412 wrote to memory of 1940	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	45
PID 2412 wrote to memory of 1940	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	45
PID 2412 wrote to memory of 1940	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	45
PID 2412 wrote to memory of 336	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	46
PID 2412 wrote to memory of 336	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	46
PID 2412 wrote to memory of 336	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	46
PID 2412 wrote to memory of 1632	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	47
PID 2412 wrote to memory of 1632	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	47
PID 2412 wrote to memory of 1632	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	47
PID 2412 wrote to memory of 2328	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	48
PID 2412 wrote to memory of 2328	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	48
PID 2412 wrote to memory of 2328	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	48
PID 2412 wrote to memory of 2488	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	49
PID 2412 wrote to memory of 2488	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	49
PID 2412 wrote to memory of 2488	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	49
PID 2412 wrote to memory of 1152	2412	5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5378b69f3f2c410e418ad3531edbfdd0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\System\MOAorLb.exe
  C:\Windows\System\MOAorLb.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\IAmVpYz.exe
  C:\Windows\System\IAmVpYz.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\KYkaXDP.exe
  C:\Windows\System\KYkaXDP.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\VYGIwSZ.exe
  C:\Windows\System\VYGIwSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\SnUIxJM.exe
  C:\Windows\System\SnUIxJM.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\WvbWlZV.exe
  C:\Windows\System\WvbWlZV.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\OWAoXEY.exe
  C:\Windows\System\OWAoXEY.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\UELneQS.exe
  C:\Windows\System\UELneQS.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\rNPnWQH.exe
  C:\Windows\System\rNPnWQH.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\sxgFHEY.exe
  C:\Windows\System\sxgFHEY.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\nVKBbew.exe
  C:\Windows\System\nVKBbew.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\gjoxGKd.exe
  C:\Windows\System\gjoxGKd.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ZqdSlia.exe
  C:\Windows\System\ZqdSlia.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\DHmyDzW.exe
  C:\Windows\System\DHmyDzW.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\tJbyNMx.exe
  C:\Windows\System\tJbyNMx.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ckLBeFq.exe
  C:\Windows\System\ckLBeFq.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\bagnMgk.exe
  C:\Windows\System\bagnMgk.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\KlHOkUa.exe
  C:\Windows\System\KlHOkUa.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\CSCiYsW.exe
  C:\Windows\System\CSCiYsW.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\QwshlfD.exe
  C:\Windows\System\QwshlfD.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\yyHWdUc.exe
  C:\Windows\System\yyHWdUc.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\azWrnyF.exe
  C:\Windows\System\azWrnyF.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\rtmgIDY.exe
  C:\Windows\System\rtmgIDY.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\huzAUAM.exe
  C:\Windows\System\huzAUAM.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\tQaqGTm.exe
  C:\Windows\System\tQaqGTm.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\AMwDopy.exe
  C:\Windows\System\AMwDopy.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\QEmufVt.exe
  C:\Windows\System\QEmufVt.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\WGTPQsG.exe
  C:\Windows\System\WGTPQsG.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\QPNFfoi.exe
  C:\Windows\System\QPNFfoi.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\EgRBdPS.exe
  C:\Windows\System\EgRBdPS.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\hwpATiY.exe
  C:\Windows\System\hwpATiY.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\yuxacwm.exe
  C:\Windows\System\yuxacwm.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\Jbhmmja.exe
  C:\Windows\System\Jbhmmja.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\sSvClxm.exe
  C:\Windows\System\sSvClxm.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\IshJFLB.exe
  C:\Windows\System\IshJFLB.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\RTCsnga.exe
  C:\Windows\System\RTCsnga.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\pTlOfaH.exe
  C:\Windows\System\pTlOfaH.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\xEtWcTC.exe
  C:\Windows\System\xEtWcTC.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\vVBQXfO.exe
  C:\Windows\System\vVBQXfO.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\CmQKgpL.exe
  C:\Windows\System\CmQKgpL.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\CHQhSfi.exe
  C:\Windows\System\CHQhSfi.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\saclQkP.exe
  C:\Windows\System\saclQkP.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\RprCWdt.exe
  C:\Windows\System\RprCWdt.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\qIFwlZk.exe
  C:\Windows\System\qIFwlZk.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\oRkIgUv.exe
  C:\Windows\System\oRkIgUv.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\GaLcjYw.exe
  C:\Windows\System\GaLcjYw.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\uTFEHvb.exe
  C:\Windows\System\uTFEHvb.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\PvZymuH.exe
  C:\Windows\System\PvZymuH.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ONxjZWV.exe
  C:\Windows\System\ONxjZWV.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\UZKLvGJ.exe
  C:\Windows\System\UZKLvGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\jJNJdum.exe
  C:\Windows\System\jJNJdum.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\fXccDxr.exe
  C:\Windows\System\fXccDxr.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\UUgTIpo.exe
  C:\Windows\System\UUgTIpo.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\XswtEGI.exe
  C:\Windows\System\XswtEGI.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\NEkyMMR.exe
  C:\Windows\System\NEkyMMR.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\lKuiUbG.exe
  C:\Windows\System\lKuiUbG.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\GTTsYfD.exe
  C:\Windows\System\GTTsYfD.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\qpmcstK.exe
  C:\Windows\System\qpmcstK.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\okOEcsu.exe
  C:\Windows\System\okOEcsu.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\PZMahfT.exe
  C:\Windows\System\PZMahfT.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\FcpCNbX.exe
  C:\Windows\System\FcpCNbX.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\bODyuab.exe
  C:\Windows\System\bODyuab.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\gNWUvbQ.exe
  C:\Windows\System\gNWUvbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\MrLODSo.exe
  C:\Windows\System\MrLODSo.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\bmqxtMa.exe
  C:\Windows\System\bmqxtMa.exe
  2⤵
  PID:2500
- C:\Windows\System\dmMrzum.exe
  C:\Windows\System\dmMrzum.exe
  2⤵
  PID:2184
- C:\Windows\System\zRFPRiQ.exe
  C:\Windows\System\zRFPRiQ.exe
  2⤵
  PID:2828
- C:\Windows\System\yNhZLAk.exe
  C:\Windows\System\yNhZLAk.exe
  2⤵
  PID:2856
- C:\Windows\System\rICHrJt.exe
  C:\Windows\System\rICHrJt.exe
  2⤵
  PID:1968
- C:\Windows\System\AUMSwWn.exe
  C:\Windows\System\AUMSwWn.exe
  2⤵
  PID:2160
- C:\Windows\System\nyrUzeS.exe
  C:\Windows\System\nyrUzeS.exe
  2⤵
  PID:1612
- C:\Windows\System\awrfNoj.exe
  C:\Windows\System\awrfNoj.exe
  2⤵
  PID:1616
- C:\Windows\System\TdSRnou.exe
  C:\Windows\System\TdSRnou.exe
  2⤵
  PID:2704
- C:\Windows\System\qlNuXwg.exe
  C:\Windows\System\qlNuXwg.exe
  2⤵
  PID:624
- C:\Windows\System\PpIIZTZ.exe
  C:\Windows\System\PpIIZTZ.exe
  2⤵
  PID:840
- C:\Windows\System\bnFekfJ.exe
  C:\Windows\System\bnFekfJ.exe
  2⤵
  PID:1900
- C:\Windows\System\YRDNVyN.exe
  C:\Windows\System\YRDNVyN.exe
  2⤵
  PID:2912
- C:\Windows\System\SrIxOez.exe
  C:\Windows\System\SrIxOez.exe
  2⤵
  PID:2072
- C:\Windows\System\WHpJoik.exe
  C:\Windows\System\WHpJoik.exe
  2⤵
  PID:984
- C:\Windows\System\HNBUQMF.exe
  C:\Windows\System\HNBUQMF.exe
  2⤵
  PID:836
- C:\Windows\System\fyXvJIo.exe
  C:\Windows\System\fyXvJIo.exe
  2⤵
  PID:880
- C:\Windows\System\RlCtcPL.exe
  C:\Windows\System\RlCtcPL.exe
  2⤵
  PID:856
- C:\Windows\System\OMymSGQ.exe
  C:\Windows\System\OMymSGQ.exe
  2⤵
  PID:2372
- C:\Windows\System\YCtaMSa.exe
  C:\Windows\System\YCtaMSa.exe
  2⤵
  PID:2340
- C:\Windows\System\cFpopDW.exe
  C:\Windows\System\cFpopDW.exe
  2⤵
  PID:2144
- C:\Windows\System\eFwhfRl.exe
  C:\Windows\System\eFwhfRl.exe
  2⤵
  PID:956
- C:\Windows\System\LeWOSYM.exe
  C:\Windows\System\LeWOSYM.exe
  2⤵
  PID:1816
- C:\Windows\System\hENAKxP.exe
  C:\Windows\System\hENAKxP.exe
  2⤵
  PID:896
- C:\Windows\System\DoHTBGr.exe
  C:\Windows\System\DoHTBGr.exe
  2⤵
  PID:3028
- C:\Windows\System\xPPZAnF.exe
  C:\Windows\System\xPPZAnF.exe
  2⤵
  PID:1936
- C:\Windows\System\fLSbIgQ.exe
  C:\Windows\System\fLSbIgQ.exe
  2⤵
  PID:284
- C:\Windows\System\hjeXtIF.exe
  C:\Windows\System\hjeXtIF.exe
  2⤵
  PID:756
- C:\Windows\System\dgclecK.exe
  C:\Windows\System\dgclecK.exe
  2⤵
  PID:2272
- C:\Windows\System\FNcIPup.exe
  C:\Windows\System\FNcIPup.exe
  2⤵
  PID:1732
- C:\Windows\System\chXFtWZ.exe
  C:\Windows\System\chXFtWZ.exe
  2⤵
  PID:2992
- C:\Windows\System\rlUcXXh.exe
  C:\Windows\System\rlUcXXh.exe
  2⤵
  PID:1588
- C:\Windows\System\tcPBumm.exe
  C:\Windows\System\tcPBumm.exe
  2⤵
  PID:2724
- C:\Windows\System\fmZsqvW.exe
  C:\Windows\System\fmZsqvW.exe
  2⤵
  PID:3032
- C:\Windows\System\bwutGZc.exe
  C:\Windows\System\bwutGZc.exe
  2⤵
  PID:2620
- C:\Windows\System\DOzjkdS.exe
  C:\Windows\System\DOzjkdS.exe
  2⤵
  PID:2712
- C:\Windows\System\aNSSmKn.exe
  C:\Windows\System\aNSSmKn.exe
  2⤵
  PID:1636
- C:\Windows\System\knCgISZ.exe
  C:\Windows\System\knCgISZ.exe
  2⤵
  PID:2824
- C:\Windows\System\XBlsuBa.exe
  C:\Windows\System\XBlsuBa.exe
  2⤵
  PID:1908
- C:\Windows\System\ONxIyhS.exe
  C:\Windows\System\ONxIyhS.exe
  2⤵
  PID:1552
- C:\Windows\System\yGVLSvD.exe
  C:\Windows\System\yGVLSvD.exe
  2⤵
  PID:1560
- C:\Windows\System\OrffkuH.exe
  C:\Windows\System\OrffkuH.exe
  2⤵
  PID:2064
- C:\Windows\System\ZOjWYjZ.exe
  C:\Windows\System\ZOjWYjZ.exe
  2⤵
  PID:552
- C:\Windows\System\ssXFAWi.exe
  C:\Windows\System\ssXFAWi.exe
  2⤵
  PID:696
- C:\Windows\System\xTWSHsg.exe
  C:\Windows\System\xTWSHsg.exe
  2⤵
  PID:1840
- C:\Windows\System\DZxcGPM.exe
  C:\Windows\System\DZxcGPM.exe
  2⤵
  PID:832
- C:\Windows\System\wKyBUUr.exe
  C:\Windows\System\wKyBUUr.exe
  2⤵
  PID:304
- C:\Windows\System\qpXmgHM.exe
  C:\Windows\System\qpXmgHM.exe
  2⤵
  PID:1764
- C:\Windows\System\fnrpnAK.exe
  C:\Windows\System\fnrpnAK.exe
  2⤵
  PID:2000
- C:\Windows\System\lfllqFn.exe
  C:\Windows\System\lfllqFn.exe
  2⤵
  PID:752
- C:\Windows\System\VqqAOfQ.exe
  C:\Windows\System\VqqAOfQ.exe
  2⤵
  PID:1492
- C:\Windows\System\cHITTia.exe
  C:\Windows\System\cHITTia.exe
  2⤵
  PID:2924
- C:\Windows\System\hAMCgJR.exe
  C:\Windows\System\hAMCgJR.exe
  2⤵
  PID:2688
- C:\Windows\System\jWaQucs.exe
  C:\Windows\System\jWaQucs.exe
  2⤵
  PID:2988
- C:\Windows\System\DwCpiKM.exe
  C:\Windows\System\DwCpiKM.exe
  2⤵
  PID:1584
- C:\Windows\System\DYnZVHS.exe
  C:\Windows\System\DYnZVHS.exe
  2⤵
  PID:2116
- C:\Windows\System\kviyKeq.exe
  C:\Windows\System\kviyKeq.exe
  2⤵
  PID:2752
- C:\Windows\System\YVXAkcw.exe
  C:\Windows\System\YVXAkcw.exe
  2⤵
  PID:344
- C:\Windows\System\TAYeGgg.exe
  C:\Windows\System\TAYeGgg.exe
  2⤵
  PID:1700
- C:\Windows\System\AiAfyTj.exe
  C:\Windows\System\AiAfyTj.exe
  2⤵
  PID:2120
- C:\Windows\System\cAsNOjd.exe
  C:\Windows\System\cAsNOjd.exe
  2⤵
  PID:1372
- C:\Windows\System\DGExQtV.exe
  C:\Windows\System\DGExQtV.exe
  2⤵
  PID:1468
- C:\Windows\System\YMkefnt.exe
  C:\Windows\System\YMkefnt.exe
  2⤵
  PID:1780
- C:\Windows\System\dWcZLzi.exe
  C:\Windows\System\dWcZLzi.exe
  2⤵
  PID:2040
- C:\Windows\System\vFTarGK.exe
  C:\Windows\System\vFTarGK.exe
  2⤵
  PID:1852
- C:\Windows\System\pUeIKMr.exe
  C:\Windows\System\pUeIKMr.exe
  2⤵
  PID:2400
- C:\Windows\System\fQnfIIZ.exe
  C:\Windows\System\fQnfIIZ.exe
  2⤵
  PID:2164
- C:\Windows\System\gxVyWHg.exe
  C:\Windows\System\gxVyWHg.exe
  2⤵
  PID:2428
- C:\Windows\System\MbsISvx.exe
  C:\Windows\System\MbsISvx.exe
  2⤵
  PID:1736
- C:\Windows\System\wZMihwn.exe
  C:\Windows\System\wZMihwn.exe
  2⤵
  PID:2748
- C:\Windows\System\LFBgmMF.exe
  C:\Windows\System\LFBgmMF.exe
  2⤵
  PID:2680
- C:\Windows\System\MiwkbDf.exe
  C:\Windows\System\MiwkbDf.exe
  2⤵
  PID:2648
- C:\Windows\System\RvwDqhF.exe
  C:\Windows\System\RvwDqhF.exe
  2⤵
  PID:1144
- C:\Windows\System\kfekYcw.exe
  C:\Windows\System\kfekYcw.exe
  2⤵
  PID:2908
- C:\Windows\System\bqSWEug.exe
  C:\Windows\System\bqSWEug.exe
  2⤵
  PID:2136
- C:\Windows\System\VXgkyhS.exe
  C:\Windows\System\VXgkyhS.exe
  2⤵
  PID:1720
- C:\Windows\System\rlBHHVT.exe
  C:\Windows\System\rlBHHVT.exe
  2⤵
  PID:2176
- C:\Windows\System\KHgdwap.exe
  C:\Windows\System\KHgdwap.exe
  2⤵
  PID:3092
- C:\Windows\System\djZvHmo.exe
  C:\Windows\System\djZvHmo.exe
  2⤵
  PID:3112
- C:\Windows\System\mHJZebe.exe
  C:\Windows\System\mHJZebe.exe
  2⤵
  PID:3128
- C:\Windows\System\lFZyhwZ.exe
  C:\Windows\System\lFZyhwZ.exe
  2⤵
  PID:3156
- C:\Windows\System\nduGqha.exe
  C:\Windows\System\nduGqha.exe
  2⤵
  PID:3172
- C:\Windows\System\rDbQaTs.exe
  C:\Windows\System\rDbQaTs.exe
  2⤵
  PID:3192
- C:\Windows\System\iMhTWNt.exe
  C:\Windows\System\iMhTWNt.exe
  2⤵
  PID:3212
- C:\Windows\System\ZxgZhdK.exe
  C:\Windows\System\ZxgZhdK.exe
  2⤵
  PID:3236
- C:\Windows\System\vdNfLyt.exe
  C:\Windows\System\vdNfLyt.exe
  2⤵
  PID:3256
- C:\Windows\System\dCCNAyB.exe
  C:\Windows\System\dCCNAyB.exe
  2⤵
  PID:3276
- C:\Windows\System\JIWSqRd.exe
  C:\Windows\System\JIWSqRd.exe
  2⤵
  PID:3292
- C:\Windows\System\EMXUsDB.exe
  C:\Windows\System\EMXUsDB.exe
  2⤵
  PID:3316
- C:\Windows\System\yELJIYn.exe
  C:\Windows\System\yELJIYn.exe
  2⤵
  PID:3340
- C:\Windows\System\JQXlmNu.exe
  C:\Windows\System\JQXlmNu.exe
  2⤵
  PID:3356
- C:\Windows\System\UgnkuNj.exe
  C:\Windows\System\UgnkuNj.exe
  2⤵
  PID:3376
- C:\Windows\System\mGHPWIm.exe
  C:\Windows\System\mGHPWIm.exe
  2⤵
  PID:3396
- C:\Windows\System\MxSGYtw.exe
  C:\Windows\System\MxSGYtw.exe
  2⤵
  PID:3420
- C:\Windows\System\kGltxAe.exe
  C:\Windows\System\kGltxAe.exe
  2⤵
  PID:3440
- C:\Windows\System\LAQxLqf.exe
  C:\Windows\System\LAQxLqf.exe
  2⤵
  PID:3460
- C:\Windows\System\eprRaXi.exe
  C:\Windows\System\eprRaXi.exe
  2⤵
  PID:3480
- C:\Windows\System\RTvQsUp.exe
  C:\Windows\System\RTvQsUp.exe
  2⤵
  PID:3500
- C:\Windows\System\lqAscfS.exe
  C:\Windows\System\lqAscfS.exe
  2⤵
  PID:3520
- C:\Windows\System\GIDKtrm.exe
  C:\Windows\System\GIDKtrm.exe
  2⤵
  PID:3540
- C:\Windows\System\WNWoCKO.exe
  C:\Windows\System\WNWoCKO.exe
  2⤵
  PID:3560
- C:\Windows\System\YdZWAXZ.exe
  C:\Windows\System\YdZWAXZ.exe
  2⤵
  PID:3580
- C:\Windows\System\NDIvdcz.exe
  C:\Windows\System\NDIvdcz.exe
  2⤵
  PID:3600
- C:\Windows\System\FtmRjTb.exe
  C:\Windows\System\FtmRjTb.exe
  2⤵
  PID:3620
- C:\Windows\System\GEQRdZA.exe
  C:\Windows\System\GEQRdZA.exe
  2⤵
  PID:3640
- C:\Windows\System\IVbKazu.exe
  C:\Windows\System\IVbKazu.exe
  2⤵
  PID:3660
- C:\Windows\System\AcEoAwA.exe
  C:\Windows\System\AcEoAwA.exe
  2⤵
  PID:3680
- C:\Windows\System\wrsWFgp.exe
  C:\Windows\System\wrsWFgp.exe
  2⤵
  PID:3700
- C:\Windows\System\OlIzEib.exe
  C:\Windows\System\OlIzEib.exe
  2⤵
  PID:3720
- C:\Windows\System\uMvsgcD.exe
  C:\Windows\System\uMvsgcD.exe
  2⤵
  PID:3740
- C:\Windows\System\cdmJZzz.exe
  C:\Windows\System\cdmJZzz.exe
  2⤵
  PID:3760
- C:\Windows\System\lDVsHkl.exe
  C:\Windows\System\lDVsHkl.exe
  2⤵
  PID:3780
- C:\Windows\System\CfoqxDr.exe
  C:\Windows\System\CfoqxDr.exe
  2⤵
  PID:3800
- C:\Windows\System\JKpZizg.exe
  C:\Windows\System\JKpZizg.exe
  2⤵
  PID:3820
- C:\Windows\System\fkrOFke.exe
  C:\Windows\System\fkrOFke.exe
  2⤵
  PID:3836
- C:\Windows\System\OnHaMwW.exe
  C:\Windows\System\OnHaMwW.exe
  2⤵
  PID:3856
- C:\Windows\System\TMdEZZh.exe
  C:\Windows\System\TMdEZZh.exe
  2⤵
  PID:3880
- C:\Windows\System\tElYvXp.exe
  C:\Windows\System\tElYvXp.exe
  2⤵
  PID:3896
- C:\Windows\System\YnikgwX.exe
  C:\Windows\System\YnikgwX.exe
  2⤵
  PID:3916
- C:\Windows\System\tKSuofl.exe
  C:\Windows\System\tKSuofl.exe
  2⤵
  PID:3940
- C:\Windows\System\viXLtzq.exe
  C:\Windows\System\viXLtzq.exe
  2⤵
  PID:3960
- C:\Windows\System\AexhxTp.exe
  C:\Windows\System\AexhxTp.exe
  2⤵
  PID:3980
- C:\Windows\System\FFjdRni.exe
  C:\Windows\System\FFjdRni.exe
  2⤵
  PID:4000
- C:\Windows\System\aByXfFt.exe
  C:\Windows\System\aByXfFt.exe
  2⤵
  PID:4016
- C:\Windows\System\foASJuN.exe
  C:\Windows\System\foASJuN.exe
  2⤵
  PID:4040
- C:\Windows\System\QujAlhv.exe
  C:\Windows\System\QujAlhv.exe
  2⤵
  PID:4056
- C:\Windows\System\kCtRpvq.exe
  C:\Windows\System\kCtRpvq.exe
  2⤵
  PID:4076
- C:\Windows\System\taOjEHz.exe
  C:\Windows\System\taOjEHz.exe
  2⤵
  PID:4092
- C:\Windows\System\GQXktdm.exe
  C:\Windows\System\GQXktdm.exe
  2⤵
  PID:2892
- C:\Windows\System\pAxvzIQ.exe
  C:\Windows\System\pAxvzIQ.exe
  2⤵
  PID:2612
- C:\Windows\System\EstxlJQ.exe
  C:\Windows\System\EstxlJQ.exe
  2⤵
  PID:1328
- C:\Windows\System\AJFjlAo.exe
  C:\Windows\System\AJFjlAo.exe
  2⤵
  PID:1076
- C:\Windows\System\sbwfHMb.exe
  C:\Windows\System\sbwfHMb.exe
  2⤵
  PID:3108
- C:\Windows\System\BAaKPDm.exe
  C:\Windows\System\BAaKPDm.exe
  2⤵
  PID:3080
- C:\Windows\System\TrBTVIc.exe
  C:\Windows\System\TrBTVIc.exe
  2⤵
  PID:1980
- C:\Windows\System\uUZHONJ.exe
  C:\Windows\System\uUZHONJ.exe
  2⤵
  PID:3152
- C:\Windows\System\FBpdCPR.exe
  C:\Windows\System\FBpdCPR.exe
  2⤵
  PID:3164
- C:\Windows\System\KddlnWt.exe
  C:\Windows\System\KddlnWt.exe
  2⤵
  PID:3200
- C:\Windows\System\ilFBwte.exe
  C:\Windows\System\ilFBwte.exe
  2⤵
  PID:3252
- C:\Windows\System\sJOVEPX.exe
  C:\Windows\System\sJOVEPX.exe
  2⤵
  PID:3300
- C:\Windows\System\RaUaGXn.exe
  C:\Windows\System\RaUaGXn.exe
  2⤵
  PID:3348
- C:\Windows\System\ztWtmLX.exe
  C:\Windows\System\ztWtmLX.exe
  2⤵
  PID:3336
- C:\Windows\System\NLpmmfY.exe
  C:\Windows\System\NLpmmfY.exe
  2⤵
  PID:3368
- C:\Windows\System\dyNkPNZ.exe
  C:\Windows\System\dyNkPNZ.exe
  2⤵
  PID:3404
- C:\Windows\System\xzxCkaL.exe
  C:\Windows\System\xzxCkaL.exe
  2⤵
  PID:3416
- C:\Windows\System\lzGKSSU.exe
  C:\Windows\System\lzGKSSU.exe
  2⤵
  PID:3508
- C:\Windows\System\voZZDTa.exe
  C:\Windows\System\voZZDTa.exe
  2⤵
  PID:3492
- C:\Windows\System\huTMZSI.exe
  C:\Windows\System\huTMZSI.exe
  2⤵
  PID:3536
- C:\Windows\System\uiDrcmJ.exe
  C:\Windows\System\uiDrcmJ.exe
  2⤵
  PID:3596
- C:\Windows\System\VIQNfLW.exe
  C:\Windows\System\VIQNfLW.exe
  2⤵
  PID:3632
- C:\Windows\System\QxEwuVm.exe
  C:\Windows\System\QxEwuVm.exe
  2⤵
  PID:3672
- C:\Windows\System\BVxGYwl.exe
  C:\Windows\System\BVxGYwl.exe
  2⤵
  PID:3652
- C:\Windows\System\CCBCWoL.exe
  C:\Windows\System\CCBCWoL.exe
  2⤵
  PID:3688
- C:\Windows\System\PlzjXRD.exe
  C:\Windows\System\PlzjXRD.exe
  2⤵
  PID:3692
- C:\Windows\System\jtcaueX.exe
  C:\Windows\System\jtcaueX.exe
  2⤵
  PID:3864
- C:\Windows\System\GfKMijL.exe
  C:\Windows\System\GfKMijL.exe
  2⤵
  PID:3872
- C:\Windows\System\SqbTkfE.exe
  C:\Windows\System\SqbTkfE.exe
  2⤵
  PID:3772
- C:\Windows\System\UMGBBpJ.exe
  C:\Windows\System\UMGBBpJ.exe
  2⤵
  PID:3848
- C:\Windows\System\VhZOijL.exe
  C:\Windows\System\VhZOijL.exe
  2⤵
  PID:3956
- C:\Windows\System\OAkbZHL.exe
  C:\Windows\System\OAkbZHL.exe
  2⤵
  PID:3996
- C:\Windows\System\txGQJpf.exe
  C:\Windows\System\txGQJpf.exe
  2⤵
  PID:3932
- C:\Windows\System\XBaGoIX.exe
  C:\Windows\System\XBaGoIX.exe
  2⤵
  PID:4036
- C:\Windows\System\vEKpArC.exe
  C:\Windows\System\vEKpArC.exe
  2⤵
  PID:4012
- C:\Windows\System\zVyFJin.exe
  C:\Windows\System\zVyFJin.exe
  2⤵
  PID:2736
- C:\Windows\System\yZkModv.exe
  C:\Windows\System\yZkModv.exe
  2⤵
  PID:2876
- C:\Windows\System\SmrAflF.exe
  C:\Windows\System\SmrAflF.exe
  2⤵
  PID:4088
- C:\Windows\System\FlJHUsk.exe
  C:\Windows\System\FlJHUsk.exe
  2⤵
  PID:3120
- C:\Windows\System\lPvblFP.exe
  C:\Windows\System\lPvblFP.exe
  2⤵
  PID:3180
- C:\Windows\System\teOQwvX.exe
  C:\Windows\System\teOQwvX.exe
  2⤵
  PID:3140
- C:\Windows\System\tEfEeHL.exe
  C:\Windows\System\tEfEeHL.exe
  2⤵
  PID:2740
- C:\Windows\System\LTVMxxh.exe
  C:\Windows\System\LTVMxxh.exe
  2⤵
  PID:3272
- C:\Windows\System\WdLQnXF.exe
  C:\Windows\System\WdLQnXF.exe
  2⤵
  PID:3312
- C:\Windows\System\qRUqeQQ.exe
  C:\Windows\System\qRUqeQQ.exe
  2⤵
  PID:3324
- C:\Windows\System\iCXoytM.exe
  C:\Windows\System\iCXoytM.exe
  2⤵
  PID:3364
- C:\Windows\System\huBmFiz.exe
  C:\Windows\System\huBmFiz.exe
  2⤵
  PID:3408
- C:\Windows\System\HzPcBTY.exe
  C:\Windows\System\HzPcBTY.exe
  2⤵
  PID:3452
- C:\Windows\System\SroQfHl.exe
  C:\Windows\System\SroQfHl.exe
  2⤵
  PID:3592
- C:\Windows\System\pvBkdLj.exe
  C:\Windows\System\pvBkdLj.exe
  2⤵
  PID:3668
- C:\Windows\System\NbUZlLS.exe
  C:\Windows\System\NbUZlLS.exe
  2⤵
  PID:3628
- C:\Windows\System\ftEVUDl.exe
  C:\Windows\System\ftEVUDl.exe
  2⤵
  PID:3648
- C:\Windows\System\ICqoJwr.exe
  C:\Windows\System\ICqoJwr.exe
  2⤵
  PID:3832
- C:\Windows\System\IpsRZTu.exe
  C:\Windows\System\IpsRZTu.exe
  2⤵
  PID:3776
- C:\Windows\System\eOhPqUu.exe
  C:\Windows\System\eOhPqUu.exe
  2⤵
  PID:3912
- C:\Windows\System\eWUtQGy.exe
  C:\Windows\System\eWUtQGy.exe
  2⤵
  PID:3844
- C:\Windows\System\AcaAHlL.exe
  C:\Windows\System\AcaAHlL.exe
  2⤵
  PID:3992
- C:\Windows\System\pJgEEhp.exe
  C:\Windows\System\pJgEEhp.exe
  2⤵
  PID:4008
- C:\Windows\System\bMCHaVa.exe
  C:\Windows\System\bMCHaVa.exe
  2⤵
  PID:4068
- C:\Windows\System\jQPzLfe.exe
  C:\Windows\System\jQPzLfe.exe
  2⤵
  PID:1256
- C:\Windows\System\xWFpWxR.exe
  C:\Windows\System\xWFpWxR.exe
  2⤵
  PID:3052
- C:\Windows\System\nEwnOeB.exe
  C:\Windows\System\nEwnOeB.exe
  2⤵
  PID:1596
- C:\Windows\System\XvQYcYA.exe
  C:\Windows\System\XvQYcYA.exe
  2⤵
  PID:2564
- C:\Windows\System\MvBaGrL.exe
  C:\Windows\System\MvBaGrL.exe
  2⤵
  PID:2496
- C:\Windows\System\RFVqSWY.exe
  C:\Windows\System\RFVqSWY.exe
  2⤵
  PID:3352
- C:\Windows\System\poYwiIa.exe
  C:\Windows\System\poYwiIa.exe
  2⤵
  PID:3472
- C:\Windows\System\HSsRIBq.exe
  C:\Windows\System\HSsRIBq.exe
  2⤵
  PID:3412
- C:\Windows\System\yDrEPNe.exe
  C:\Windows\System\yDrEPNe.exe
  2⤵
  PID:3552
- C:\Windows\System\AoLYWZU.exe
  C:\Windows\System\AoLYWZU.exe
  2⤵
  PID:3788
- C:\Windows\System\YXXWcwj.exe
  C:\Windows\System\YXXWcwj.exe
  2⤵
  PID:3756
- C:\Windows\System\uIwjjVA.exe
  C:\Windows\System\uIwjjVA.exe
  2⤵
  PID:3792
- C:\Windows\System\fEHlDDf.exe
  C:\Windows\System\fEHlDDf.exe
  2⤵
  PID:4108
- C:\Windows\System\WWYcZGB.exe
  C:\Windows\System\WWYcZGB.exe
  2⤵
  PID:4132
- C:\Windows\System\LZTcgMu.exe
  C:\Windows\System\LZTcgMu.exe
  2⤵
  PID:4148
- C:\Windows\System\FxdSuDn.exe
  C:\Windows\System\FxdSuDn.exe
  2⤵
  PID:4168
- C:\Windows\System\kPzaNnJ.exe
  C:\Windows\System\kPzaNnJ.exe
  2⤵
  PID:4184
- C:\Windows\System\vRPwnAu.exe
  C:\Windows\System\vRPwnAu.exe
  2⤵
  PID:4208
- C:\Windows\System\rCQlcpi.exe
  C:\Windows\System\rCQlcpi.exe
  2⤵
  PID:4228
- C:\Windows\System\fOfloEd.exe
  C:\Windows\System\fOfloEd.exe
  2⤵
  PID:4252
- C:\Windows\System\IGqFBKQ.exe
  C:\Windows\System\IGqFBKQ.exe
  2⤵
  PID:4268
- C:\Windows\System\eUwFUEp.exe
  C:\Windows\System\eUwFUEp.exe
  2⤵
  PID:4284
- C:\Windows\System\TKSbXOU.exe
  C:\Windows\System\TKSbXOU.exe
  2⤵
  PID:4304
- C:\Windows\System\XpvneuU.exe
  C:\Windows\System\XpvneuU.exe
  2⤵
  PID:4324
- C:\Windows\System\eSgtWfF.exe
  C:\Windows\System\eSgtWfF.exe
  2⤵
  PID:4344
- C:\Windows\System\XgHkQKi.exe
  C:\Windows\System\XgHkQKi.exe
  2⤵
  PID:4360
- C:\Windows\System\CXyDtyA.exe
  C:\Windows\System\CXyDtyA.exe
  2⤵
  PID:4380
- C:\Windows\System\RzQXgxI.exe
  C:\Windows\System\RzQXgxI.exe
  2⤵
  PID:4412
- C:\Windows\System\wDowbXs.exe
  C:\Windows\System\wDowbXs.exe
  2⤵
  PID:4432
- C:\Windows\System\xIGDIPq.exe
  C:\Windows\System\xIGDIPq.exe
  2⤵
  PID:4452
- C:\Windows\System\vcYcvwu.exe
  C:\Windows\System\vcYcvwu.exe
  2⤵
  PID:4468
- C:\Windows\System\lAmZUiq.exe
  C:\Windows\System\lAmZUiq.exe
  2⤵
  PID:4492
- C:\Windows\System\lZVMuSX.exe
  C:\Windows\System\lZVMuSX.exe
  2⤵
  PID:4512
- C:\Windows\System\yewBvhg.exe
  C:\Windows\System\yewBvhg.exe
  2⤵
  PID:4532
- C:\Windows\System\SGpYejh.exe
  C:\Windows\System\SGpYejh.exe
  2⤵
  PID:4548
- C:\Windows\System\ZIXTaLR.exe
  C:\Windows\System\ZIXTaLR.exe
  2⤵
  PID:4572
- C:\Windows\System\iKFIAsa.exe
  C:\Windows\System\iKFIAsa.exe
  2⤵
  PID:4592
- C:\Windows\System\SsogwgB.exe
  C:\Windows\System\SsogwgB.exe
  2⤵
  PID:4612
- C:\Windows\System\wVGOVrz.exe
  C:\Windows\System\wVGOVrz.exe
  2⤵
  PID:4632
- C:\Windows\System\ZMCsuLd.exe
  C:\Windows\System\ZMCsuLd.exe
  2⤵
  PID:4652
- C:\Windows\System\BVMAheU.exe
  C:\Windows\System\BVMAheU.exe
  2⤵
  PID:4672
- C:\Windows\System\iSmzQHc.exe
  C:\Windows\System\iSmzQHc.exe
  2⤵
  PID:4692
- C:\Windows\System\yjXmqMR.exe
  C:\Windows\System\yjXmqMR.exe
  2⤵
  PID:4712
- C:\Windows\System\eONLiee.exe
  C:\Windows\System\eONLiee.exe
  2⤵
  PID:4732
- C:\Windows\System\sZGYseV.exe
  C:\Windows\System\sZGYseV.exe
  2⤵
  PID:4752
- C:\Windows\System\lzzSLDB.exe
  C:\Windows\System\lzzSLDB.exe
  2⤵
  PID:4772
- C:\Windows\System\XMtgseK.exe
  C:\Windows\System\XMtgseK.exe
  2⤵
  PID:4792
- C:\Windows\System\aTnXoEZ.exe
  C:\Windows\System\aTnXoEZ.exe
  2⤵
  PID:4812
- C:\Windows\System\iSpRArx.exe
  C:\Windows\System\iSpRArx.exe
  2⤵
  PID:4832
- C:\Windows\System\qaDymZw.exe
  C:\Windows\System\qaDymZw.exe
  2⤵
  PID:4852
- C:\Windows\System\hLhIoIB.exe
  C:\Windows\System\hLhIoIB.exe
  2⤵
  PID:4868
- C:\Windows\System\TGKTBCJ.exe
  C:\Windows\System\TGKTBCJ.exe
  2⤵
  PID:4892
- C:\Windows\System\uMOKIap.exe
  C:\Windows\System\uMOKIap.exe
  2⤵
  PID:4912
- C:\Windows\System\cWWWgZQ.exe
  C:\Windows\System\cWWWgZQ.exe
  2⤵
  PID:4932
- C:\Windows\System\QcCwgbM.exe
  C:\Windows\System\QcCwgbM.exe
  2⤵
  PID:4948
- C:\Windows\System\PbzTnuI.exe
  C:\Windows\System\PbzTnuI.exe
  2⤵
  PID:4972
- C:\Windows\System\QrwhkfW.exe
  C:\Windows\System\QrwhkfW.exe
  2⤵
  PID:4992
- C:\Windows\System\gFpFpiY.exe
  C:\Windows\System\gFpFpiY.exe
  2⤵
  PID:5012
- C:\Windows\System\GRRNVIY.exe
  C:\Windows\System\GRRNVIY.exe
  2⤵
  PID:5028
- C:\Windows\System\dnzCnFO.exe
  C:\Windows\System\dnzCnFO.exe
  2⤵
  PID:5044
- C:\Windows\System\fuwGyby.exe
  C:\Windows\System\fuwGyby.exe
  2⤵
  PID:5064
- C:\Windows\System\GiFyhRg.exe
  C:\Windows\System\GiFyhRg.exe
  2⤵
  PID:5092
- C:\Windows\System\hILyxOv.exe
  C:\Windows\System\hILyxOv.exe
  2⤵
  PID:5108
- C:\Windows\System\VzvHMrB.exe
  C:\Windows\System\VzvHMrB.exe
  2⤵
  PID:3952
- C:\Windows\System\savgbTt.exe
  C:\Windows\System\savgbTt.exe
  2⤵
  PID:3948
- C:\Windows\System\HGSDomf.exe
  C:\Windows\System\HGSDomf.exe
  2⤵
  PID:844
- C:\Windows\System\QucaKgV.exe
  C:\Windows\System\QucaKgV.exe
  2⤵
  PID:2460
- C:\Windows\System\TzSrKjD.exe
  C:\Windows\System\TzSrKjD.exe
  2⤵
  PID:2652
- C:\Windows\System\jNEkfZd.exe
  C:\Windows\System\jNEkfZd.exe
  2⤵
  PID:3516
- C:\Windows\System\nWioDjG.exe
  C:\Windows\System\nWioDjG.exe
  2⤵
  PID:3244
- C:\Windows\System\caAjerI.exe
  C:\Windows\System\caAjerI.exe
  2⤵
  PID:3476
- C:\Windows\System\TkDDExa.exe
  C:\Windows\System\TkDDExa.exe
  2⤵
  PID:3568
- C:\Windows\System\dNsyMYj.exe
  C:\Windows\System\dNsyMYj.exe
  2⤵
  PID:3732
- C:\Windows\System\XqIzmtL.exe
  C:\Windows\System\XqIzmtL.exe
  2⤵
  PID:4156
- C:\Windows\System\pNnjFtg.exe
  C:\Windows\System\pNnjFtg.exe
  2⤵
  PID:2836
- C:\Windows\System\CBtMxTI.exe
  C:\Windows\System\CBtMxTI.exe
  2⤵
  PID:1904
- C:\Windows\System\AdqJdca.exe
  C:\Windows\System\AdqJdca.exe
  2⤵
  PID:4196
- C:\Windows\System\hbqnYvz.exe
  C:\Windows\System\hbqnYvz.exe
  2⤵
  PID:4244
- C:\Windows\System\YNPpWdg.exe
  C:\Windows\System\YNPpWdg.exe
  2⤵
  PID:4216
- C:\Windows\System\vhtGWgb.exe
  C:\Windows\System\vhtGWgb.exe
  2⤵
  PID:4316
- C:\Windows\System\LwGkOAc.exe
  C:\Windows\System\LwGkOAc.exe
  2⤵
  PID:4300
- C:\Windows\System\NkQoSNg.exe
  C:\Windows\System\NkQoSNg.exe
  2⤵
  PID:4332
- C:\Windows\System\EfvptJV.exe
  C:\Windows\System\EfvptJV.exe
  2⤵
  PID:4376
- C:\Windows\System\yIDsSPT.exe
  C:\Windows\System\yIDsSPT.exe
  2⤵
  PID:4400
- C:\Windows\System\KvfwFrQ.exe
  C:\Windows\System\KvfwFrQ.exe
  2⤵
  PID:4476
- C:\Windows\System\QMOxSEk.exe
  C:\Windows\System\QMOxSEk.exe
  2⤵
  PID:4428
- C:\Windows\System\EiEvpGv.exe
  C:\Windows\System\EiEvpGv.exe
  2⤵
  PID:4488
- C:\Windows\System\isNYngo.exe
  C:\Windows\System\isNYngo.exe
  2⤵
  PID:4528
- C:\Windows\System\BBjHEme.exe
  C:\Windows\System\BBjHEme.exe
  2⤵
  PID:4556
- C:\Windows\System\zQLLxin.exe
  C:\Windows\System\zQLLxin.exe
  2⤵
  PID:4544
- C:\Windows\System\UFiCMJO.exe
  C:\Windows\System\UFiCMJO.exe
  2⤵
  PID:4604
- C:\Windows\System\XgryZbm.exe
  C:\Windows\System\XgryZbm.exe
  2⤵
  PID:1960
- C:\Windows\System\HPwkrQd.exe
  C:\Windows\System\HPwkrQd.exe
  2⤵
  PID:2168
- C:\Windows\System\eZyRanZ.exe
  C:\Windows\System\eZyRanZ.exe
  2⤵
  PID:4660
- C:\Windows\System\foyfcPU.exe
  C:\Windows\System\foyfcPU.exe
  2⤵
  PID:1696
- C:\Windows\System\PsweHIk.exe
  C:\Windows\System\PsweHIk.exe
  2⤵
  PID:4724
- C:\Windows\System\CzepaKg.exe
  C:\Windows\System\CzepaKg.exe
  2⤵
  PID:4764
- C:\Windows\System\mINGFGk.exe
  C:\Windows\System\mINGFGk.exe
  2⤵
  PID:1600
- C:\Windows\System\VgeHmpX.exe
  C:\Windows\System\VgeHmpX.exe
  2⤵
  PID:4808
- C:\Windows\System\udMQKIU.exe
  C:\Windows\System\udMQKIU.exe
  2⤵
  PID:4848
- C:\Windows\System\VYXTCMj.exe
  C:\Windows\System\VYXTCMj.exe
  2⤵
  PID:4828
- C:\Windows\System\AScgHYz.exe
  C:\Windows\System\AScgHYz.exe
  2⤵
  PID:2396
- C:\Windows\System\VJnUUOt.exe
  C:\Windows\System\VJnUUOt.exe
  2⤵
  PID:4920
- C:\Windows\System\WhdpRiD.exe
  C:\Windows\System\WhdpRiD.exe
  2⤵
  PID:4928
- C:\Windows\System\BkIQorS.exe
  C:\Windows\System\BkIQorS.exe
  2⤵
  PID:4940
- C:\Windows\System\hVlrJtO.exe
  C:\Windows\System\hVlrJtO.exe
  2⤵
  PID:5000
- C:\Windows\System\DSycssz.exe
  C:\Windows\System\DSycssz.exe
  2⤵
  PID:2268
- C:\Windows\System\BiMcIJp.exe
  C:\Windows\System\BiMcIJp.exe
  2⤵
  PID:2520
- C:\Windows\System\PJhztmi.exe
  C:\Windows\System\PJhztmi.exe
  2⤵
  PID:5056
- C:\Windows\System\OqOROEJ.exe
  C:\Windows\System\OqOROEJ.exe
  2⤵
  PID:5084
- C:\Windows\System\LZOPrdc.exe
  C:\Windows\System\LZOPrdc.exe
  2⤵
  PID:2964
- C:\Windows\System\twCgNXE.exe
  C:\Windows\System\twCgNXE.exe
  2⤵
  PID:5116
- C:\Windows\System\vLOPslO.exe
  C:\Windows\System\vLOPslO.exe
  2⤵
  PID:5104
- C:\Windows\System\pAYxgoH.exe
  C:\Windows\System\pAYxgoH.exe
  2⤵
  PID:688
- C:\Windows\System\AbuMhsL.exe
  C:\Windows\System\AbuMhsL.exe
  2⤵
  PID:2960
- C:\Windows\System\ESmAhEv.exe
  C:\Windows\System\ESmAhEv.exe
  2⤵
  PID:2816
- C:\Windows\System\ImKuQoV.exe
  C:\Windows\System\ImKuQoV.exe
  2⤵
  PID:4124
- C:\Windows\System\zwjkIHD.exe
  C:\Windows\System\zwjkIHD.exe
  2⤵
  PID:1640
- C:\Windows\System\zDIXiWp.exe
  C:\Windows\System\zDIXiWp.exe
  2⤵
  PID:1556
- C:\Windows\System\csSCfce.exe
  C:\Windows\System\csSCfce.exe
  2⤵
  PID:4240
- C:\Windows\System\cwDAjdf.exe
  C:\Windows\System\cwDAjdf.exe
  2⤵
  PID:4180
- C:\Windows\System\AJPxcnn.exe
  C:\Windows\System\AJPxcnn.exe
  2⤵
  PID:4340
- C:\Windows\System\UZFBeGm.exe
  C:\Windows\System\UZFBeGm.exe
  2⤵
  PID:4392
- C:\Windows\System\PMYRsnL.exe
  C:\Windows\System\PMYRsnL.exe
  2⤵
  PID:4396
- C:\Windows\System\XsQSqwh.exe
  C:\Windows\System\XsQSqwh.exe
  2⤵
  PID:4220
- C:\Windows\System\OumAydx.exe
  C:\Windows\System\OumAydx.exe
  2⤵
  PID:1956
- C:\Windows\System\kZHisSs.exe
  C:\Windows\System\kZHisSs.exe
  2⤵
  PID:4444
- C:\Windows\System\ikDWUDC.exe
  C:\Windows\System\ikDWUDC.exe
  2⤵
  PID:1672
- C:\Windows\System\AzJgzoA.exe
  C:\Windows\System\AzJgzoA.exe
  2⤵
  PID:2232
- C:\Windows\System\oCLGgvX.exe
  C:\Windows\System\oCLGgvX.exe
  2⤵
  PID:2080
- C:\Windows\System\effhSfd.exe
  C:\Windows\System\effhSfd.exe
  2⤵
  PID:2068
- C:\Windows\System\lWfufDa.exe
  C:\Windows\System\lWfufDa.exe
  2⤵
  PID:4508
- C:\Windows\System\SEsgBHW.exe
  C:\Windows\System\SEsgBHW.exe
  2⤵
  PID:1724
- C:\Windows\System\StatAuo.exe
  C:\Windows\System\StatAuo.exe
  2⤵
  PID:2528
- C:\Windows\System\HJVgwMg.exe
  C:\Windows\System\HJVgwMg.exe
  2⤵
  PID:4564
- C:\Windows\System\aLQDarp.exe
  C:\Windows\System\aLQDarp.exe
  2⤵
  PID:4584
- C:\Windows\System\WCbXmbe.exe
  C:\Windows\System\WCbXmbe.exe
  2⤵
  PID:4644
- C:\Windows\System\explwrd.exe
  C:\Windows\System\explwrd.exe
  2⤵
  PID:4688
- C:\Windows\System\jiRPJEC.exe
  C:\Windows\System\jiRPJEC.exe
  2⤵
  PID:4704
- C:\Windows\System\YAFgnKJ.exe
  C:\Windows\System\YAFgnKJ.exe
  2⤵
  PID:4820
- C:\Windows\System\YftPpDB.exe
  C:\Windows\System\YftPpDB.exe
  2⤵
  PID:4944
- C:\Windows\System\FazVSsw.exe
  C:\Windows\System\FazVSsw.exe
  2⤵
  PID:5020
- C:\Windows\System\dLvAChC.exe
  C:\Windows\System\dLvAChC.exe
  2⤵
  PID:5076
- C:\Windows\System\SLmoEUw.exe
  C:\Windows\System\SLmoEUw.exe
  2⤵
  PID:4900
- C:\Windows\System\yLcuzuH.exe
  C:\Windows\System\yLcuzuH.exe
  2⤵
  PID:4968
- C:\Windows\System\SxQODEA.exe
  C:\Windows\System\SxQODEA.exe
  2⤵
  PID:5004
- C:\Windows\System\aPilGBV.exe
  C:\Windows\System\aPilGBV.exe
  2⤵
  PID:5052
- C:\Windows\System\gtiHTHR.exe
  C:\Windows\System\gtiHTHR.exe
  2⤵
  PID:2804
- C:\Windows\System\HmxNeeo.exe
  C:\Windows\System\HmxNeeo.exe
  2⤵
  PID:3224
- C:\Windows\System\dAyNlVc.exe
  C:\Windows\System\dAyNlVc.exe
  2⤵
  PID:3208
- C:\Windows\System\tLOVupR.exe
  C:\Windows\System\tLOVupR.exe
  2⤵
  PID:3608
- C:\Windows\System\tPAeqhO.exe
  C:\Windows\System\tPAeqhO.exe
  2⤵
  PID:4104
- C:\Windows\System\BItoleT.exe
  C:\Windows\System\BItoleT.exe
  2⤵
  PID:4280
- C:\Windows\System\jYpENcB.exe
  C:\Windows\System\jYpENcB.exe
  2⤵
  PID:548
- C:\Windows\System\LNNkKSl.exe
  C:\Windows\System\LNNkKSl.exe
  2⤵
  PID:1744
- C:\Windows\System\jAxepld.exe
  C:\Windows\System\jAxepld.exe
  2⤵
  PID:2580
- C:\Windows\System\hzYDexl.exe
  C:\Windows\System\hzYDexl.exe
  2⤵
  PID:4420
- C:\Windows\System\dZMWfPd.exe
  C:\Windows\System\dZMWfPd.exe
  2⤵
  PID:2768
- C:\Windows\System\aBAXHpE.exe
  C:\Windows\System\aBAXHpE.exe
  2⤵
  PID:2476
- C:\Windows\System\INLJgqp.exe
  C:\Windows\System\INLJgqp.exe
  2⤵
  PID:1928
- C:\Windows\System\onxeFAF.exe
  C:\Windows\System\onxeFAF.exe
  2⤵
  PID:4980
- C:\Windows\System\FHzMjqd.exe
  C:\Windows\System\FHzMjqd.exe
  2⤵
  PID:4740
- C:\Windows\System\SYjOypt.exe
  C:\Windows\System\SYjOypt.exe
  2⤵
  PID:316
- C:\Windows\System\wecZFLQ.exe
  C:\Windows\System\wecZFLQ.exe
  2⤵
  PID:4640
- C:\Windows\System\vkdcUTT.exe
  C:\Windows\System\vkdcUTT.exe
  2⤵
  PID:1496
- C:\Windows\System\UHjEuBe.exe
  C:\Windows\System\UHjEuBe.exe
  2⤵
  PID:1320
- C:\Windows\System\uqEEdrX.exe
  C:\Windows\System\uqEEdrX.exe
  2⤵
  PID:4800
- C:\Windows\System\rbeceoP.exe
  C:\Windows\System\rbeceoP.exe
  2⤵
  PID:3816
- C:\Windows\System\fCKPspd.exe
  C:\Windows\System\fCKPspd.exe
  2⤵
  PID:3076
- C:\Windows\System\MdIujFo.exe
  C:\Windows\System\MdIujFo.exe
  2⤵
  PID:4988
- C:\Windows\System\WFQfytl.exe
  C:\Windows\System\WFQfytl.exe
  2⤵
  PID:3936
- C:\Windows\System\exWUmko.exe
  C:\Windows\System\exWUmko.exe
  2⤵
  PID:2860
- C:\Windows\System\NRsYQmW.exe
  C:\Windows\System\NRsYQmW.exe
  2⤵
  PID:4628
- C:\Windows\System\JBoIoyh.exe
  C:\Windows\System\JBoIoyh.exe
  2⤵
  PID:4320
- C:\Windows\System\EslTPSJ.exe
  C:\Windows\System\EslTPSJ.exe
  2⤵
  PID:2716
- C:\Windows\System\LGZyTBJ.exe
  C:\Windows\System\LGZyTBJ.exe
  2⤵
  PID:1688
- C:\Windows\System\FGRgZso.exe
  C:\Windows\System\FGRgZso.exe
  2⤵
  PID:4884
- C:\Windows\System\FjBvnfh.exe
  C:\Windows\System\FjBvnfh.exe
  2⤵
  PID:4664
- C:\Windows\System\eKqYulR.exe
  C:\Windows\System\eKqYulR.exe
  2⤵
  PID:1608
- C:\Windows\System\mFkxkqS.exe
  C:\Windows\System\mFkxkqS.exe
  2⤵
  PID:4448
- C:\Windows\System\RJyNXZc.exe
  C:\Windows\System\RJyNXZc.exe
  2⤵
  PID:2896
- C:\Windows\System\htvyFKf.exe
  C:\Windows\System\htvyFKf.exe
  2⤵
  PID:2848
- C:\Windows\System\lTSYpFg.exe
  C:\Windows\System\lTSYpFg.exe
  2⤵
  PID:4424
- C:\Windows\System\paFAsox.exe
  C:\Windows\System\paFAsox.exe
  2⤵
  PID:4176
- C:\Windows\System\BIsnyXt.exe
  C:\Windows\System\BIsnyXt.exe
  2⤵
  PID:4372
- C:\Windows\System\cqvIIvB.exe
  C:\Windows\System\cqvIIvB.exe
  2⤵
  PID:1800
- C:\Windows\System\dfHayCe.exe
  C:\Windows\System\dfHayCe.exe
  2⤵
  PID:1200
- C:\Windows\System\OonERiF.exe
  C:\Windows\System\OonERiF.exe
  2⤵
  PID:1716
- C:\Windows\System\kvRDvAu.exe
  C:\Windows\System\kvRDvAu.exe
  2⤵
  PID:3736
- C:\Windows\System\MmdNrSY.exe
  C:\Windows\System\MmdNrSY.exe
  2⤵
  PID:5132
- C:\Windows\System\EekjACQ.exe
  C:\Windows\System\EekjACQ.exe
  2⤵
  PID:5152
- C:\Windows\System\vVVmeGq.exe
  C:\Windows\System\vVVmeGq.exe
  2⤵
  PID:5172
- C:\Windows\System\NXSleyo.exe
  C:\Windows\System\NXSleyo.exe
  2⤵
  PID:5188
- C:\Windows\System\ZDuYiTS.exe
  C:\Windows\System\ZDuYiTS.exe
  2⤵
  PID:5216
- C:\Windows\System\ezpEyDF.exe
  C:\Windows\System\ezpEyDF.exe
  2⤵
  PID:5232
- C:\Windows\System\MJaFkYy.exe
  C:\Windows\System\MJaFkYy.exe
  2⤵
  PID:5256
- C:\Windows\System\klFiEDF.exe
  C:\Windows\System\klFiEDF.exe
  2⤵
  PID:5280
- C:\Windows\System\CEEgkWz.exe
  C:\Windows\System\CEEgkWz.exe
  2⤵
  PID:5296
- C:\Windows\System\uJSkghG.exe
  C:\Windows\System\uJSkghG.exe
  2⤵
  PID:5312
- C:\Windows\System\wogVuBK.exe
  C:\Windows\System\wogVuBK.exe
  2⤵
  PID:5336
- C:\Windows\System\lFVIWst.exe
  C:\Windows\System\lFVIWst.exe
  2⤵
  PID:5360
- C:\Windows\System\xVOdXRC.exe
  C:\Windows\System\xVOdXRC.exe
  2⤵
  PID:5380
- C:\Windows\System\rCubBbI.exe
  C:\Windows\System\rCubBbI.exe
  2⤵
  PID:5400
- C:\Windows\System\HjYQJnX.exe
  C:\Windows\System\HjYQJnX.exe
  2⤵
  PID:5420
- C:\Windows\System\MulTSWm.exe
  C:\Windows\System\MulTSWm.exe
  2⤵
  PID:5448
- C:\Windows\System\DgeIcvX.exe
  C:\Windows\System\DgeIcvX.exe
  2⤵
  PID:5464
- C:\Windows\System\lKIurcS.exe
  C:\Windows\System\lKIurcS.exe
  2⤵
  PID:5480
- C:\Windows\System\zGQXHQp.exe
  C:\Windows\System\zGQXHQp.exe
  2⤵
  PID:5496
- C:\Windows\System\IKVPvFX.exe
  C:\Windows\System\IKVPvFX.exe
  2⤵
  PID:5512
- C:\Windows\System\DWiSpba.exe
  C:\Windows\System\DWiSpba.exe
  2⤵
  PID:5528
- C:\Windows\System\LZTpjTi.exe
  C:\Windows\System\LZTpjTi.exe
  2⤵
  PID:5544
- C:\Windows\System\mZMawJY.exe
  C:\Windows\System\mZMawJY.exe
  2⤵
  PID:5560
- C:\Windows\System\hmslJYO.exe
  C:\Windows\System\hmslJYO.exe
  2⤵
  PID:5580
- C:\Windows\System\XOphfHc.exe
  C:\Windows\System\XOphfHc.exe
  2⤵
  PID:5600
- C:\Windows\System\ZWUAoWt.exe
  C:\Windows\System\ZWUAoWt.exe
  2⤵
  PID:5620
- C:\Windows\System\PQwDWeL.exe
  C:\Windows\System\PQwDWeL.exe
  2⤵
  PID:5636
- C:\Windows\System\npGCmjV.exe
  C:\Windows\System\npGCmjV.exe
  2⤵
  PID:5652
- C:\Windows\System\XGOHyyr.exe
  C:\Windows\System\XGOHyyr.exe
  2⤵
  PID:5668
- C:\Windows\System\Advigcs.exe
  C:\Windows\System\Advigcs.exe
  2⤵
  PID:5688
- C:\Windows\System\lbttCFR.exe
  C:\Windows\System\lbttCFR.exe
  2⤵
  PID:5708
- C:\Windows\System\HBtPaYk.exe
  C:\Windows\System\HBtPaYk.exe
  2⤵
  PID:5728
- C:\Windows\System\eFVwkRJ.exe
  C:\Windows\System\eFVwkRJ.exe
  2⤵
  PID:5748
- C:\Windows\System\pYfukab.exe
  C:\Windows\System\pYfukab.exe
  2⤵
  PID:5768
- C:\Windows\System\JITjfTQ.exe
  C:\Windows\System\JITjfTQ.exe
  2⤵
  PID:5788
- C:\Windows\System\kvUbEiD.exe
  C:\Windows\System\kvUbEiD.exe
  2⤵
  PID:5808
- C:\Windows\System\AnixoNa.exe
  C:\Windows\System\AnixoNa.exe
  2⤵
  PID:5828
- C:\Windows\System\ZYNSeeU.exe
  C:\Windows\System\ZYNSeeU.exe
  2⤵
  PID:5848
- C:\Windows\System\gCTqgKw.exe
  C:\Windows\System\gCTqgKw.exe
  2⤵
  PID:5864
- C:\Windows\System\dhQDxOC.exe
  C:\Windows\System\dhQDxOC.exe
  2⤵
  PID:5892
- C:\Windows\System\VgkwAjh.exe
  C:\Windows\System\VgkwAjh.exe
  2⤵
  PID:5908
- C:\Windows\System\yppfLsr.exe
  C:\Windows\System\yppfLsr.exe
  2⤵
  PID:5924
- C:\Windows\System\jCPKgeW.exe
  C:\Windows\System\jCPKgeW.exe
  2⤵
  PID:5940
- C:\Windows\System\zjQbqUY.exe
  C:\Windows\System\zjQbqUY.exe
  2⤵
  PID:5956
- C:\Windows\System\CiQKIYg.exe
  C:\Windows\System\CiQKIYg.exe
  2⤵
  PID:5972
- C:\Windows\System\TTwdcPP.exe
  C:\Windows\System\TTwdcPP.exe
  2⤵
  PID:5988
- C:\Windows\System\cjSwztU.exe
  C:\Windows\System\cjSwztU.exe
  2⤵
  PID:6008
- C:\Windows\System\XLkfcQE.exe
  C:\Windows\System\XLkfcQE.exe
  2⤵
  PID:6028
- C:\Windows\System\yzxjCWe.exe
  C:\Windows\System\yzxjCWe.exe
  2⤵
  PID:6048
- C:\Windows\System\wrkhaLJ.exe
  C:\Windows\System\wrkhaLJ.exe
  2⤵
  PID:6064
- C:\Windows\System\keVLvxt.exe
  C:\Windows\System\keVLvxt.exe
  2⤵
  PID:6080
- C:\Windows\System\SFfOhre.exe
  C:\Windows\System\SFfOhre.exe
  2⤵
  PID:6100
- C:\Windows\System\zHnqsyZ.exe
  C:\Windows\System\zHnqsyZ.exe
  2⤵
  PID:6120
- C:\Windows\System\NpocyrA.exe
  C:\Windows\System\NpocyrA.exe
  2⤵
  PID:5212
- C:\Windows\System\ZiFCHGt.exe
  C:\Windows\System\ZiFCHGt.exe
  2⤵
  PID:5252
- C:\Windows\System\GBvRadR.exe
  C:\Windows\System\GBvRadR.exe
  2⤵
  PID:5184
- C:\Windows\System\XphQJfg.exe
  C:\Windows\System\XphQJfg.exe
  2⤵
  PID:5148
- C:\Windows\System\gQxjSqt.exe
  C:\Windows\System\gQxjSqt.exe
  2⤵
  PID:2548
- C:\Windows\System\duWYnFk.exe
  C:\Windows\System\duWYnFk.exe
  2⤵
  PID:5228
- C:\Windows\System\obgvBrE.exe
  C:\Windows\System\obgvBrE.exe
  2⤵
  PID:5224
- C:\Windows\System\cILEuuy.exe
  C:\Windows\System\cILEuuy.exe
  2⤵
  PID:5372
- C:\Windows\System\PdcSFyt.exe
  C:\Windows\System\PdcSFyt.exe
  2⤵
  PID:5456
- C:\Windows\System\SPggdOL.exe
  C:\Windows\System\SPggdOL.exe
  2⤵
  PID:5520
- C:\Windows\System\vHWjWce.exe
  C:\Windows\System\vHWjWce.exe
  2⤵
  PID:5664
- C:\Windows\System\npnrIZz.exe
  C:\Windows\System\npnrIZz.exe
  2⤵
  PID:5660
- C:\Windows\System\DBxvlcq.exe
  C:\Windows\System\DBxvlcq.exe
  2⤵
  PID:5744
- C:\Windows\System\wwfkJlk.exe
  C:\Windows\System\wwfkJlk.exe
  2⤵
  PID:5820
- C:\Windows\System\AzmmJRM.exe
  C:\Windows\System\AzmmJRM.exe
  2⤵
  PID:5904
- C:\Windows\System\KGdwlGg.exe
  C:\Windows\System\KGdwlGg.exe
  2⤵
  PID:5964
- C:\Windows\System\DGdzNZy.exe
  C:\Windows\System\DGdzNZy.exe
  2⤵
  PID:6044
- C:\Windows\System\RHbsJuq.exe
  C:\Windows\System\RHbsJuq.exe
  2⤵
  PID:6112
- C:\Windows\System\iSOKyrH.exe
  C:\Windows\System\iSOKyrH.exe
  2⤵
  PID:5676
- C:\Windows\System\gSRqErf.exe
  C:\Windows\System\gSRqErf.exe
  2⤵
  PID:5308
- C:\Windows\System\keMNpKn.exe
  C:\Windows\System\keMNpKn.exe
  2⤵
  PID:5392
- C:\Windows\System\zGyinuq.exe
  C:\Windows\System\zGyinuq.exe
  2⤵
  PID:4960
- C:\Windows\System\ZoqyPKY.exe
  C:\Windows\System\ZoqyPKY.exe
  2⤵
  PID:5504
- C:\Windows\System\cSQCwSx.exe
  C:\Windows\System\cSQCwSx.exe
  2⤵
  PID:4784
- C:\Windows\System\YGuUsIr.exe
  C:\Windows\System\YGuUsIr.exe
  2⤵
  PID:5836
- C:\Windows\System\EtmlWEp.exe
  C:\Windows\System\EtmlWEp.exe
  2⤵
  PID:5352
- C:\Windows\System\IvitKsJ.exe
  C:\Windows\System\IvitKsJ.exe
  2⤵
  PID:5980
- C:\Windows\System\jqUnRbS.exe
  C:\Windows\System\jqUnRbS.exe
  2⤵
  PID:5572
- C:\Windows\System\VOpNaeh.exe
  C:\Windows\System\VOpNaeh.exe
  2⤵
  PID:4680
- C:\Windows\System\FiGVraI.exe
  C:\Windows\System\FiGVraI.exe
  2⤵
  PID:1788
- C:\Windows\System\HVAlqSz.exe
  C:\Windows\System\HVAlqSz.exe
  2⤵
  PID:5764
- C:\Windows\System\YJAFQAI.exe
  C:\Windows\System\YJAFQAI.exe
  2⤵
  PID:4924
- C:\Windows\System\oDrevaD.exe
  C:\Windows\System\oDrevaD.exe
  2⤵
  PID:5876
- C:\Windows\System\zEEVZvE.exe
  C:\Windows\System\zEEVZvE.exe
  2⤵
  PID:5916
- C:\Windows\System\eaLSWGH.exe
  C:\Windows\System\eaLSWGH.exe
  2⤵
  PID:5984
- C:\Windows\System\yUKStKx.exe
  C:\Windows\System\yUKStKx.exe
  2⤵
  PID:5168
- C:\Windows\System\plHOnfo.exe
  C:\Windows\System\plHOnfo.exe
  2⤵
  PID:1096
- C:\Windows\System\pKByLNv.exe
  C:\Windows\System\pKByLNv.exe
  2⤵
  PID:4760
- C:\Windows\System\Dmhbmek.exe
  C:\Windows\System\Dmhbmek.exe
  2⤵
  PID:2812
- C:\Windows\System\SQxpILb.exe
  C:\Windows\System\SQxpILb.exe
  2⤵
  PID:5320
- C:\Windows\System\DwzNKrt.exe
  C:\Windows\System\DwzNKrt.exe
  2⤵
  PID:5492
- C:\Windows\System\wOglKRG.exe
  C:\Windows\System\wOglKRG.exe
  2⤵
  PID:5596
- C:\Windows\System\NrHuLHF.exe
  C:\Windows\System\NrHuLHF.exe
  2⤵
  PID:5700
- C:\Windows\System\sfpOkAf.exe
  C:\Windows\System\sfpOkAf.exe
  2⤵
  PID:5816
- C:\Windows\System\QfWrbOE.exe
  C:\Windows\System\QfWrbOE.exe
  2⤵
  PID:5936
- C:\Windows\System\ZHrKLQq.exe
  C:\Windows\System\ZHrKLQq.exe
  2⤵
  PID:6076
- C:\Windows\System\xysIzaq.exe
  C:\Windows\System\xysIzaq.exe
  2⤵
  PID:5396
- C:\Windows\System\iYJsOoF.exe
  C:\Windows\System\iYJsOoF.exe
  2⤵
  PID:6036
- C:\Windows\System\xyTRdsz.exe
  C:\Windows\System\xyTRdsz.exe
  2⤵
  PID:5348
- C:\Windows\System\qFMXzXB.exe
  C:\Windows\System\qFMXzXB.exe
  2⤵
  PID:5240
- C:\Windows\System\zPfIHrn.exe
  C:\Windows\System\zPfIHrn.exe
  2⤵
  PID:5536
- C:\Windows\System\EzgYRrB.exe
  C:\Windows\System\EzgYRrB.exe
  2⤵
  PID:6020
- C:\Windows\System\uRIXfXJ.exe
  C:\Windows\System\uRIXfXJ.exe
  2⤵
  PID:5276
- C:\Windows\System\XLJdcGf.exe
  C:\Windows\System\XLJdcGf.exe
  2⤵
  PID:5476
- C:\Windows\System\ccrjVVY.exe
  C:\Windows\System\ccrjVVY.exe
  2⤵
  PID:5948
- C:\Windows\System\hIIBiba.exe
  C:\Windows\System\hIIBiba.exe
  2⤵
  PID:5724
- C:\Windows\System\JLfcZTH.exe
  C:\Windows\System\JLfcZTH.exe
  2⤵
  PID:5952
- C:\Windows\System\vAIVoTF.exe
  C:\Windows\System\vAIVoTF.exe
  2⤵
  PID:2672
- C:\Windows\System\sSJYuiF.exe
  C:\Windows\System\sSJYuiF.exe
  2⤵
  PID:5368
- C:\Windows\System\dYISTGL.exe
  C:\Windows\System\dYISTGL.exe
  2⤵
  PID:5200
- C:\Windows\System\XULaBjf.exe
  C:\Windows\System\XULaBjf.exe
  2⤵
  PID:5412
- C:\Windows\System\qrmactn.exe
  C:\Windows\System\qrmactn.exe
  2⤵
  PID:5416
- C:\Windows\System\YysoEQs.exe
  C:\Windows\System\YysoEQs.exe
  2⤵
  PID:5784
- C:\Windows\System\OFJTaTY.exe
  C:\Windows\System\OFJTaTY.exe
  2⤵
  PID:5648
- C:\Windows\System\qGxBumw.exe
  C:\Windows\System\qGxBumw.exe
  2⤵
  PID:5592
- C:\Windows\System\TDJLWrJ.exe
  C:\Windows\System\TDJLWrJ.exe
  2⤵
  PID:5888
- C:\Windows\System\ritoMQp.exe
  C:\Windows\System\ritoMQp.exe
  2⤵
  PID:6132
- C:\Windows\System\QwteAFR.exe
  C:\Windows\System\QwteAFR.exe
  2⤵
  PID:4888
- C:\Windows\System\pWoUAil.exe
  C:\Windows\System\pWoUAil.exe
  2⤵
  PID:5844
- C:\Windows\System\ROeSHAt.exe
  C:\Windows\System\ROeSHAt.exe
  2⤵
  PID:5248
- C:\Windows\System\ICbLDMf.exe
  C:\Windows\System\ICbLDMf.exe
  2⤵
  PID:6156
- C:\Windows\System\rnkexdp.exe
  C:\Windows\System\rnkexdp.exe
  2⤵
  PID:6172
- C:\Windows\System\aRkLdQC.exe
  C:\Windows\System\aRkLdQC.exe
  2⤵
  PID:6236
- C:\Windows\System\wZRXQbG.exe
  C:\Windows\System\wZRXQbG.exe
  2⤵
  PID:6268
- C:\Windows\System\XAsdKCF.exe
  C:\Windows\System\XAsdKCF.exe
  2⤵
  PID:6292
- C:\Windows\System\cjMdckS.exe
  C:\Windows\System\cjMdckS.exe
  2⤵
  PID:6308
- C:\Windows\System\VJTpxqn.exe
  C:\Windows\System\VJTpxqn.exe
  2⤵
  PID:6324
- C:\Windows\System\scRliXG.exe
  C:\Windows\System\scRliXG.exe
  2⤵
  PID:6340
- C:\Windows\System\YFQnDdx.exe
  C:\Windows\System\YFQnDdx.exe
  2⤵
  PID:6360
- C:\Windows\System\WJsROwY.exe
  C:\Windows\System\WJsROwY.exe
  2⤵
  PID:6380
- C:\Windows\System\mlfLYPg.exe
  C:\Windows\System\mlfLYPg.exe
  2⤵
  PID:6400
- C:\Windows\System\YjULqFD.exe
  C:\Windows\System\YjULqFD.exe
  2⤵
  PID:6420
- C:\Windows\System\gRwQMmE.exe
  C:\Windows\System\gRwQMmE.exe
  2⤵
  PID:6440
- C:\Windows\System\ozQMQJn.exe
  C:\Windows\System\ozQMQJn.exe
  2⤵
  PID:6468
- C:\Windows\System\mUfJwVf.exe
  C:\Windows\System\mUfJwVf.exe
  2⤵
  PID:6484
- C:\Windows\System\stwYWit.exe
  C:\Windows\System\stwYWit.exe
  2⤵
  PID:6500
- C:\Windows\System\jmJIvZx.exe
  C:\Windows\System\jmJIvZx.exe
  2⤵
  PID:6520
- C:\Windows\System\atrqXqb.exe
  C:\Windows\System\atrqXqb.exe
  2⤵
  PID:6536
- C:\Windows\System\rQAdYmH.exe
  C:\Windows\System\rQAdYmH.exe
  2⤵
  PID:6552
- C:\Windows\System\edeBWzQ.exe
  C:\Windows\System\edeBWzQ.exe
  2⤵
  PID:6568
- C:\Windows\System\TszFSZv.exe
  C:\Windows\System\TszFSZv.exe
  2⤵
  PID:6592
- C:\Windows\System\gzwiXgq.exe
  C:\Windows\System\gzwiXgq.exe
  2⤵
  PID:6640
- C:\Windows\System\kvHfjYa.exe
  C:\Windows\System\kvHfjYa.exe
  2⤵
  PID:6656
- C:\Windows\System\qLlBSIa.exe
  C:\Windows\System\qLlBSIa.exe
  2⤵
  PID:6672
- C:\Windows\System\cqevuHB.exe
  C:\Windows\System\cqevuHB.exe
  2⤵
  PID:6688
- C:\Windows\System\QFXVRVI.exe
  C:\Windows\System\QFXVRVI.exe
  2⤵
  PID:6704
- C:\Windows\System\AAtGvCh.exe
  C:\Windows\System\AAtGvCh.exe
  2⤵
  PID:6720
- C:\Windows\System\VLvcqqk.exe
  C:\Windows\System\VLvcqqk.exe
  2⤵
  PID:6740
- C:\Windows\System\SMbaYvu.exe
  C:\Windows\System\SMbaYvu.exe
  2⤵
  PID:6756
- C:\Windows\System\UhmiWLn.exe
  C:\Windows\System\UhmiWLn.exe
  2⤵
  PID:6772
- C:\Windows\System\dOjqgbp.exe
  C:\Windows\System\dOjqgbp.exe
  2⤵
  PID:6796
- C:\Windows\System\ftejvMK.exe
  C:\Windows\System\ftejvMK.exe
  2⤵
  PID:6820
- C:\Windows\System\surRKZE.exe
  C:\Windows\System\surRKZE.exe
  2⤵
  PID:6864
- C:\Windows\System\Zgkcsbt.exe
  C:\Windows\System\Zgkcsbt.exe
  2⤵
  PID:6880
- C:\Windows\System\kXisHop.exe
  C:\Windows\System\kXisHop.exe
  2⤵
  PID:6900
- C:\Windows\System\tEGgFnP.exe
  C:\Windows\System\tEGgFnP.exe
  2⤵
  PID:6916
- C:\Windows\System\uXZzWpF.exe
  C:\Windows\System\uXZzWpF.exe
  2⤵
  PID:6940
- C:\Windows\System\rYHtglB.exe
  C:\Windows\System\rYHtglB.exe
  2⤵
  PID:6956
- C:\Windows\System\SLmqHxZ.exe
  C:\Windows\System\SLmqHxZ.exe
  2⤵
  PID:6972
- C:\Windows\System\pEUMErL.exe
  C:\Windows\System\pEUMErL.exe
  2⤵
  PID:6992
- C:\Windows\System\UAAxxGh.exe
  C:\Windows\System\UAAxxGh.exe
  2⤵
  PID:7016
- C:\Windows\System\hiJBtlj.exe
  C:\Windows\System\hiJBtlj.exe
  2⤵
  PID:7036
- C:\Windows\System\vkDhUHQ.exe
  C:\Windows\System\vkDhUHQ.exe
  2⤵
  PID:7056
- C:\Windows\System\ZUIMFAW.exe
  C:\Windows\System\ZUIMFAW.exe
  2⤵
  PID:7072
- C:\Windows\System\JyfveYf.exe
  C:\Windows\System\JyfveYf.exe
  2⤵
  PID:7088
- C:\Windows\System\NivhjkS.exe
  C:\Windows\System\NivhjkS.exe
  2⤵
  PID:7104
- C:\Windows\System\OabiJCa.exe
  C:\Windows\System\OabiJCa.exe
  2⤵
  PID:7124
- C:\Windows\System\HoHrCJs.exe
  C:\Windows\System\HoHrCJs.exe
  2⤵
  PID:7152
- C:\Windows\System\eUayzDF.exe
  C:\Windows\System\eUayzDF.exe
  2⤵
  PID:5268
- C:\Windows\System\CXdONdk.exe
  C:\Windows\System\CXdONdk.exe
  2⤵
  PID:6168
- C:\Windows\System\JDRjuHb.exe
  C:\Windows\System\JDRjuHb.exe
  2⤵
  PID:4028
- C:\Windows\System\dxpWwSG.exe
  C:\Windows\System\dxpWwSG.exe
  2⤵
  PID:568
- C:\Windows\System\xyGPaSR.exe
  C:\Windows\System\xyGPaSR.exe
  2⤵
  PID:5884
- C:\Windows\System\VVitQwh.exe
  C:\Windows\System\VVitQwh.exe
  2⤵
  PID:4204
- C:\Windows\System\PRUYrlE.exe
  C:\Windows\System\PRUYrlE.exe
  2⤵
  PID:6188
- C:\Windows\System\KMnXoch.exe
  C:\Windows\System\KMnXoch.exe
  2⤵
  PID:6212
- C:\Windows\System\zHrKbuc.exe
  C:\Windows\System\zHrKbuc.exe
  2⤵
  PID:6060
- C:\Windows\System\IrwnKbd.exe
  C:\Windows\System\IrwnKbd.exe
  2⤵
  PID:5428
- C:\Windows\System\cbdZiXE.exe
  C:\Windows\System\cbdZiXE.exe
  2⤵
  PID:6184
- C:\Windows\System\tDfNIVZ.exe
  C:\Windows\System\tDfNIVZ.exe
  2⤵
  PID:6276
- C:\Windows\System\vULBDaI.exe
  C:\Windows\System\vULBDaI.exe
  2⤵
  PID:6304
- C:\Windows\System\qaVlPYD.exe
  C:\Windows\System\qaVlPYD.exe
  2⤵
  PID:6372
- C:\Windows\System\bBcDUWA.exe
  C:\Windows\System\bBcDUWA.exe
  2⤵
  PID:6416
- C:\Windows\System\gkoiVWd.exe
  C:\Windows\System\gkoiVWd.exe
  2⤵
  PID:6452
- C:\Windows\System\qLQTBmC.exe
  C:\Windows\System\qLQTBmC.exe
  2⤵
  PID:6356
- C:\Windows\System\KnlnSCz.exe
  C:\Windows\System\KnlnSCz.exe
  2⤵
  PID:6432
- C:\Windows\System\oNSUknz.exe
  C:\Windows\System\oNSUknz.exe
  2⤵
  PID:6528
- C:\Windows\System\UCIrchZ.exe
  C:\Windows\System\UCIrchZ.exe
  2⤵
  PID:6508
- C:\Windows\System\aHqoArC.exe
  C:\Windows\System\aHqoArC.exe
  2⤵
  PID:6584
- C:\Windows\System\yUoEkZK.exe
  C:\Windows\System\yUoEkZK.exe
  2⤵
  PID:6588
- C:\Windows\System\HaNqaOS.exe
  C:\Windows\System\HaNqaOS.exe
  2⤵
  PID:6624
- C:\Windows\System\QhBPNoF.exe
  C:\Windows\System\QhBPNoF.exe
  2⤵
  PID:6664
- C:\Windows\System\qftwtCe.exe
  C:\Windows\System\qftwtCe.exe
  2⤵
  PID:6700
- C:\Windows\System\meEdEpj.exe
  C:\Windows\System\meEdEpj.exe
  2⤵
  PID:6764
- C:\Windows\System\DWxbbXy.exe
  C:\Windows\System\DWxbbXy.exe
  2⤵
  PID:6680
- C:\Windows\System\krrbyBp.exe
  C:\Windows\System\krrbyBp.exe
  2⤵
  PID:6812
- C:\Windows\System\FMyxBkL.exe
  C:\Windows\System\FMyxBkL.exe
  2⤵
  PID:6840
- C:\Windows\System\uHezDsM.exe
  C:\Windows\System\uHezDsM.exe
  2⤵
  PID:6908
- C:\Windows\System\fIqWsje.exe
  C:\Windows\System\fIqWsje.exe
  2⤵
  PID:6984
- C:\Windows\System\etGZzRP.exe
  C:\Windows\System\etGZzRP.exe
  2⤵
  PID:7028
- C:\Windows\System\OkPOjhy.exe
  C:\Windows\System\OkPOjhy.exe
  2⤵
  PID:6928
- C:\Windows\System\npHoUOs.exe
  C:\Windows\System\npHoUOs.exe
  2⤵
  PID:7096
- C:\Windows\System\IyNOupn.exe
  C:\Windows\System\IyNOupn.exe
  2⤵
  PID:7012
- C:\Windows\System\LNYeHyr.exe
  C:\Windows\System\LNYeHyr.exe
  2⤵
  PID:7148
- C:\Windows\System\qLgLdlM.exe
  C:\Windows\System\qLgLdlM.exe
  2⤵
  PID:6164
- C:\Windows\System\zCnhLaG.exe
  C:\Windows\System\zCnhLaG.exe
  2⤵
  PID:5472
- C:\Windows\System\fyirRUC.exe
  C:\Windows\System\fyirRUC.exe
  2⤵
  PID:7120
- C:\Windows\System\LugkOIn.exe
  C:\Windows\System\LugkOIn.exe
  2⤵
  PID:7000
- C:\Windows\System\iqKZheq.exe
  C:\Windows\System\iqKZheq.exe
  2⤵
  PID:7080
- C:\Windows\System\AKOwkBP.exe
  C:\Windows\System\AKOwkBP.exe
  2⤵
  PID:5388
- C:\Windows\System\RxqnXDI.exe
  C:\Windows\System\RxqnXDI.exe
  2⤵
  PID:5804
- C:\Windows\System\gttASTZ.exe
  C:\Windows\System\gttASTZ.exe
  2⤵
  PID:5780
- C:\Windows\System\qjYgEXA.exe
  C:\Windows\System\qjYgEXA.exe
  2⤵
  PID:6260
- C:\Windows\System\WJxzDoN.exe
  C:\Windows\System\WJxzDoN.exe
  2⤵
  PID:6336
- C:\Windows\System\IXcFTSC.exe
  C:\Windows\System\IXcFTSC.exe
  2⤵
  PID:6320
- C:\Windows\System\FOgCnyD.exe
  C:\Windows\System\FOgCnyD.exe
  2⤵
  PID:6288
- C:\Windows\System\ftzfihs.exe
  C:\Windows\System\ftzfihs.exe
  2⤵
  PID:6480
- C:\Windows\System\AprqmeD.exe
  C:\Windows\System\AprqmeD.exe
  2⤵
  PID:6516
- C:\Windows\System\uwzTrhj.exe
  C:\Windows\System\uwzTrhj.exe
  2⤵
  PID:6412
- C:\Windows\System\wouMgaY.exe
  C:\Windows\System\wouMgaY.exe
  2⤵
  PID:6352
- C:\Windows\System\zAUmjSv.exe
  C:\Windows\System\zAUmjSv.exe
  2⤵
  PID:6632
- C:\Windows\System\VtHbAqr.exe
  C:\Windows\System\VtHbAqr.exe
  2⤵
  PID:6620
- C:\Windows\System\IZDAJPf.exe
  C:\Windows\System\IZDAJPf.exe
  2⤵
  PID:6748
- C:\Windows\System\NtScEJu.exe
  C:\Windows\System\NtScEJu.exe
  2⤵
  PID:6872
- C:\Windows\System\pFeOHsx.exe
  C:\Windows\System\pFeOHsx.exe
  2⤵
  PID:7024
- C:\Windows\System\uCKwXOf.exe
  C:\Windows\System\uCKwXOf.exe
  2⤵
  PID:6952
- C:\Windows\System\Kptsevc.exe
  C:\Windows\System\Kptsevc.exe
  2⤵
  PID:6892
- C:\Windows\System\LxCODzY.exe
  C:\Windows\System\LxCODzY.exe
  2⤵
  PID:6964
- C:\Windows\System\KDAFcDm.exe
  C:\Windows\System\KDAFcDm.exe
  2⤵
  PID:7164
- C:\Windows\System\rksVQJT.exe
  C:\Windows\System\rksVQJT.exe
  2⤵
  PID:7132
- C:\Windows\System\RXWasMa.exe
  C:\Windows\System\RXWasMa.exe
  2⤵
  PID:6128
- C:\Windows\System\uiaOdwO.exe
  C:\Windows\System\uiaOdwO.exe
  2⤵
  PID:6228
- C:\Windows\System\yiHOkhS.exe
  C:\Windows\System\yiHOkhS.exe
  2⤵
  PID:6208
- C:\Windows\System\grfdiao.exe
  C:\Windows\System\grfdiao.exe
  2⤵
  PID:6224
- C:\Windows\System\TftqTRj.exe
  C:\Windows\System\TftqTRj.exe
  2⤵
  PID:6248
- C:\Windows\System\QMdGZWw.exe
  C:\Windows\System\QMdGZWw.exe
  2⤵
  PID:6576
- C:\Windows\System\aXYJfqz.exe
  C:\Windows\System\aXYJfqz.exe
  2⤵
  PID:6464
- C:\Windows\System\KUechms.exe
  C:\Windows\System\KUechms.exe
  2⤵
  PID:6808
- C:\Windows\System\xclVCLb.exe
  C:\Windows\System\xclVCLb.exe
  2⤵
  PID:6852
- C:\Windows\System\TPwjwjE.exe
  C:\Windows\System\TPwjwjE.exe
  2⤵
  PID:6392
- C:\Windows\System\lHNxKWk.exe
  C:\Windows\System\lHNxKWk.exe
  2⤵
  PID:6492
- C:\Windows\System\RfIQsbt.exe
  C:\Windows\System\RfIQsbt.exe
  2⤵
  PID:7064
- C:\Windows\System\EmXyVEB.exe
  C:\Windows\System\EmXyVEB.exe
  2⤵
  PID:7144
- C:\Windows\System\mCIqqYC.exe
  C:\Windows\System\mCIqqYC.exe
  2⤵
  PID:5332
- C:\Windows\System\XYGcoIl.exe
  C:\Windows\System\XYGcoIl.exe
  2⤵
  PID:7048
- C:\Windows\System\dgbDOIx.exe
  C:\Windows\System\dgbDOIx.exe
  2⤵
  PID:6784
- C:\Windows\System\odNgWEe.exe
  C:\Windows\System\odNgWEe.exe
  2⤵
  PID:6924
- C:\Windows\System\YjqMFjT.exe
  C:\Windows\System\YjqMFjT.exe
  2⤵
  PID:6792
- C:\Windows\System\uwUzadf.exe
  C:\Windows\System\uwUzadf.exe
  2⤵
  PID:6696
- C:\Windows\System\cxDFNDM.exe
  C:\Windows\System\cxDFNDM.exe
  2⤵
  PID:6300
- C:\Windows\System\qcDdmfx.exe
  C:\Windows\System\qcDdmfx.exe
  2⤵
  PID:6836
- C:\Windows\System\xWZDHZl.exe
  C:\Windows\System\xWZDHZl.exe
  2⤵
  PID:5860
- C:\Windows\System\RiiOYQm.exe
  C:\Windows\System\RiiOYQm.exe
  2⤵
  PID:7112
- C:\Windows\System\aMKKAHP.exe
  C:\Windows\System\aMKKAHP.exe
  2⤵
  PID:6428
- C:\Windows\System\tsEIQSA.exe
  C:\Windows\System\tsEIQSA.exe
  2⤵
  PID:7068
- C:\Windows\System\HIBQxco.exe
  C:\Windows\System\HIBQxco.exe
  2⤵
  PID:6448
- C:\Windows\System\erYtHtZ.exe
  C:\Windows\System\erYtHtZ.exe
  2⤵
  PID:7044
- C:\Windows\System\lAZIMBl.exe
  C:\Windows\System\lAZIMBl.exe
  2⤵
  PID:6712
- C:\Windows\System\lmESRYJ.exe
  C:\Windows\System\lmESRYJ.exe
  2⤵
  PID:6496
- C:\Windows\System\aWEWNDH.exe
  C:\Windows\System\aWEWNDH.exe
  2⤵
  PID:5272
- C:\Windows\System\OVlPTBV.exe
  C:\Windows\System\OVlPTBV.exe
  2⤵
  PID:7180
- C:\Windows\System\drzpNgq.exe
  C:\Windows\System\drzpNgq.exe
  2⤵
  PID:7196
- C:\Windows\System\AwqiCJP.exe
  C:\Windows\System\AwqiCJP.exe
  2⤵
  PID:7216
- C:\Windows\System\DKBAlvr.exe
  C:\Windows\System\DKBAlvr.exe
  2⤵
  PID:7232
- C:\Windows\System\jQbgyHj.exe
  C:\Windows\System\jQbgyHj.exe
  2⤵
  PID:7256
- C:\Windows\System\MtLtWYv.exe
  C:\Windows\System\MtLtWYv.exe
  2⤵
  PID:7284
- C:\Windows\System\aGJzpJQ.exe
  C:\Windows\System\aGJzpJQ.exe
  2⤵
  PID:7300
- C:\Windows\System\olxLGfz.exe
  C:\Windows\System\olxLGfz.exe
  2⤵
  PID:7316
- C:\Windows\System\xvTwpVI.exe
  C:\Windows\System\xvTwpVI.exe
  2⤵
  PID:7336
- C:\Windows\System\LZBdAZb.exe
  C:\Windows\System\LZBdAZb.exe
  2⤵
  PID:7352
- C:\Windows\System\SppApkt.exe
  C:\Windows\System\SppApkt.exe
  2⤵
  PID:7372
- C:\Windows\System\PZEcvAK.exe
  C:\Windows\System\PZEcvAK.exe
  2⤵
  PID:7412
- C:\Windows\System\uGdMHKV.exe
  C:\Windows\System\uGdMHKV.exe
  2⤵
  PID:7432
- C:\Windows\System\TEaUdEU.exe
  C:\Windows\System\TEaUdEU.exe
  2⤵
  PID:7460
- C:\Windows\System\wYBQWNH.exe
  C:\Windows\System\wYBQWNH.exe
  2⤵
  PID:7476
- C:\Windows\System\OJBkVhy.exe
  C:\Windows\System\OJBkVhy.exe
  2⤵
  PID:7492
- C:\Windows\System\GDdQuiM.exe
  C:\Windows\System\GDdQuiM.exe
  2⤵
  PID:7512
- C:\Windows\System\zsqPQbg.exe
  C:\Windows\System\zsqPQbg.exe
  2⤵
  PID:7536
- C:\Windows\System\vCdRoFw.exe
  C:\Windows\System\vCdRoFw.exe
  2⤵
  PID:7552
- C:\Windows\System\KLycKfa.exe
  C:\Windows\System\KLycKfa.exe
  2⤵
  PID:7568
- C:\Windows\System\PXydJHo.exe
  C:\Windows\System\PXydJHo.exe
  2⤵
  PID:7588
- C:\Windows\System\uvwpeQe.exe
  C:\Windows\System\uvwpeQe.exe
  2⤵
  PID:7604
- C:\Windows\System\pUsykYd.exe
  C:\Windows\System\pUsykYd.exe
  2⤵
  PID:7620
- C:\Windows\System\IItkfiL.exe
  C:\Windows\System\IItkfiL.exe
  2⤵
  PID:7644
- C:\Windows\System\DuHHGaZ.exe
  C:\Windows\System\DuHHGaZ.exe
  2⤵
  PID:7660
- C:\Windows\System\ExDhvsK.exe
  C:\Windows\System\ExDhvsK.exe
  2⤵
  PID:7676
- C:\Windows\System\uwhLcgd.exe
  C:\Windows\System\uwhLcgd.exe
  2⤵
  PID:7692
- C:\Windows\System\wYsBhjY.exe
  C:\Windows\System\wYsBhjY.exe
  2⤵
  PID:7740
- C:\Windows\System\YJzXprp.exe
  C:\Windows\System\YJzXprp.exe
  2⤵
  PID:7756
- C:\Windows\System\oqfJNai.exe
  C:\Windows\System\oqfJNai.exe
  2⤵
  PID:7776
- C:\Windows\System\slWAQRS.exe
  C:\Windows\System\slWAQRS.exe
  2⤵
  PID:7792
- C:\Windows\System\ZKDkhnb.exe
  C:\Windows\System\ZKDkhnb.exe
  2⤵
  PID:7812
- C:\Windows\System\OItobCj.exe
  C:\Windows\System\OItobCj.exe
  2⤵
  PID:7832
- C:\Windows\System\zsAeEMB.exe
  C:\Windows\System\zsAeEMB.exe
  2⤵
  PID:7860
- C:\Windows\System\MnqhhJs.exe
  C:\Windows\System\MnqhhJs.exe
  2⤵
  PID:7876
- C:\Windows\System\NWlkyWg.exe
  C:\Windows\System\NWlkyWg.exe
  2⤵
  PID:7892
- C:\Windows\System\gIbKVpU.exe
  C:\Windows\System\gIbKVpU.exe
  2⤵
  PID:7916
- C:\Windows\System\Jkmilae.exe
  C:\Windows\System\Jkmilae.exe
  2⤵
  PID:7932
- C:\Windows\System\mxoBbow.exe
  C:\Windows\System\mxoBbow.exe
  2⤵
  PID:7948
- C:\Windows\System\sHEDEce.exe
  C:\Windows\System\sHEDEce.exe
  2⤵
  PID:7972
- C:\Windows\System\fdbIyps.exe
  C:\Windows\System\fdbIyps.exe
  2⤵
  PID:7992
- C:\Windows\System\KCxghOr.exe
  C:\Windows\System\KCxghOr.exe
  2⤵
  PID:8012
- C:\Windows\System\ooOwndV.exe
  C:\Windows\System\ooOwndV.exe
  2⤵
  PID:8028
- C:\Windows\System\rrfcLYP.exe
  C:\Windows\System\rrfcLYP.exe
  2⤵
  PID:8044
- C:\Windows\System\vaxXkal.exe
  C:\Windows\System\vaxXkal.exe
  2⤵
  PID:8060
- C:\Windows\System\jjUoPBI.exe
  C:\Windows\System\jjUoPBI.exe
  2⤵
  PID:8080
- C:\Windows\System\tlcrkPe.exe
  C:\Windows\System\tlcrkPe.exe
  2⤵
  PID:8096
- C:\Windows\System\YFMIbMw.exe
  C:\Windows\System\YFMIbMw.exe
  2⤵
  PID:8120
- C:\Windows\System\jtdhWsh.exe
  C:\Windows\System\jtdhWsh.exe
  2⤵
  PID:8140
- C:\Windows\System\HRnGdhw.exe
  C:\Windows\System\HRnGdhw.exe
  2⤵
  PID:8156
- C:\Windows\System\RWOQlKy.exe
  C:\Windows\System\RWOQlKy.exe
  2⤵
  PID:7192
- C:\Windows\System\vrlVGoc.exe
  C:\Windows\System\vrlVGoc.exe
  2⤵
  PID:6780
- C:\Windows\System\DjzXnpQ.exe
  C:\Windows\System\DjzXnpQ.exe
  2⤵
  PID:7204
- C:\Windows\System\WgSeNnD.exe
  C:\Windows\System\WgSeNnD.exe
  2⤵
  PID:6716
- C:\Windows\System\fGGawgL.exe
  C:\Windows\System\fGGawgL.exe
  2⤵
  PID:7248
- C:\Windows\System\kGJrdCS.exe
  C:\Windows\System\kGJrdCS.exe
  2⤵
  PID:7272
- C:\Windows\System\fLlGFoU.exe
  C:\Windows\System\fLlGFoU.exe
  2⤵
  PID:7348
- C:\Windows\System\ITCEnGs.exe
  C:\Windows\System\ITCEnGs.exe
  2⤵
  PID:7332
- C:\Windows\System\zfsUExZ.exe
  C:\Windows\System\zfsUExZ.exe
  2⤵
  PID:7408
- C:\Windows\System\yTdDzbt.exe
  C:\Windows\System\yTdDzbt.exe
  2⤵
  PID:7440
- C:\Windows\System\zPiPgML.exe
  C:\Windows\System\zPiPgML.exe
  2⤵
  PID:7364
- C:\Windows\System\VvGYORx.exe
  C:\Windows\System\VvGYORx.exe
  2⤵
  PID:7484
- C:\Windows\System\dGvWbCl.exe
  C:\Windows\System\dGvWbCl.exe
  2⤵
  PID:7504
- C:\Windows\System\RUhCZtu.exe
  C:\Windows\System\RUhCZtu.exe
  2⤵
  PID:7528
- C:\Windows\System\XXJkHaB.exe
  C:\Windows\System\XXJkHaB.exe
  2⤵
  PID:7600
- C:\Windows\System\xJqYUds.exe
  C:\Windows\System\xJqYUds.exe
  2⤵
  PID:7544
- C:\Windows\System\kuzgudb.exe
  C:\Windows\System\kuzgudb.exe
  2⤵
  PID:7548
- C:\Windows\System\IYxEdYV.exe
  C:\Windows\System\IYxEdYV.exe
  2⤵
  PID:7584
- C:\Windows\System\yHOONVl.exe
  C:\Windows\System\yHOONVl.exe
  2⤵
  PID:6564
- C:\Windows\System\ZjATBqV.exe
  C:\Windows\System\ZjATBqV.exe
  2⤵
  PID:7736
- C:\Windows\System\iCXEnvZ.exe
  C:\Windows\System\iCXEnvZ.exe
  2⤵
  PID:7768
- C:\Windows\System\sXJsKRQ.exe
  C:\Windows\System\sXJsKRQ.exe
  2⤵
  PID:7808
- C:\Windows\System\fvSabfK.exe
  C:\Windows\System\fvSabfK.exe
  2⤵
  PID:7828
- C:\Windows\System\SnCAoBw.exe
  C:\Windows\System\SnCAoBw.exe
  2⤵
  PID:7872
- C:\Windows\System\QmdkXSG.exe
  C:\Windows\System\QmdkXSG.exe
  2⤵
  PID:7924
- C:\Windows\System\rCJKejH.exe
  C:\Windows\System\rCJKejH.exe
  2⤵
  PID:7968
- C:\Windows\System\IgrGemk.exe
  C:\Windows\System\IgrGemk.exe
  2⤵
  PID:8040
- C:\Windows\System\eYKzbus.exe
  C:\Windows\System\eYKzbus.exe
  2⤵
  PID:8104
- C:\Windows\System\UGIcpAT.exe
  C:\Windows\System\UGIcpAT.exe
  2⤵
  PID:7988
- C:\Windows\System\opcHQjs.exe
  C:\Windows\System\opcHQjs.exe
  2⤵
  PID:8056
- C:\Windows\System\eQHmVss.exe
  C:\Windows\System\eQHmVss.exe
  2⤵
  PID:8132
- C:\Windows\System\VqaUcWL.exe
  C:\Windows\System\VqaUcWL.exe
  2⤵
  PID:8152
- C:\Windows\System\RKGESiW.exe
  C:\Windows\System\RKGESiW.exe
  2⤵
  PID:5556
- C:\Windows\System\ONhfabF.exe
  C:\Windows\System\ONhfabF.exe
  2⤵
  PID:7224
- C:\Windows\System\toAvwCy.exe
  C:\Windows\System\toAvwCy.exe
  2⤵
  PID:7176
- C:\Windows\System\omtXjWd.exe
  C:\Windows\System\omtXjWd.exe
  2⤵
  PID:7280
- C:\Windows\System\HIGZoPz.exe
  C:\Windows\System\HIGZoPz.exe
  2⤵
  PID:7380
- C:\Windows\System\arXcWPi.exe
  C:\Windows\System\arXcWPi.exe
  2⤵
  PID:7296
- C:\Windows\System\XVruKBw.exe
  C:\Windows\System\XVruKBw.exe
  2⤵
  PID:7452
- C:\Windows\System\QjJwSwW.exe
  C:\Windows\System\QjJwSwW.exe
  2⤵
  PID:7400
- C:\Windows\System\XnbUVZV.exe
  C:\Windows\System\XnbUVZV.exe
  2⤵
  PID:7632
- C:\Windows\System\zUTdPAA.exe
  C:\Windows\System\zUTdPAA.exe
  2⤵
  PID:7564
- C:\Windows\System\UBedaET.exe
  C:\Windows\System\UBedaET.exe
  2⤵
  PID:7360
- C:\Windows\System\tskMONX.exe
  C:\Windows\System\tskMONX.exe
  2⤵
  PID:7672
- C:\Windows\System\aFegGfv.exe
  C:\Windows\System\aFegGfv.exe
  2⤵
  PID:7820
- C:\Windows\System\dxiReQC.exe
  C:\Windows\System\dxiReQC.exe
  2⤵
  PID:7868
- C:\Windows\System\HKrebkb.exe
  C:\Windows\System\HKrebkb.exe
  2⤵
  PID:8068
- C:\Windows\System\cUXrooP.exe
  C:\Windows\System\cUXrooP.exe
  2⤵
  PID:7804
- C:\Windows\System\mffyXVN.exe
  C:\Windows\System\mffyXVN.exe
  2⤵
  PID:7944
- C:\Windows\System\UPGgUnU.exe
  C:\Windows\System\UPGgUnU.exe
  2⤵
  PID:7824
- C:\Windows\System\QJFXSyG.exe
  C:\Windows\System\QJFXSyG.exe
  2⤵
  PID:8116
- C:\Windows\System\qnhKCZT.exe
  C:\Windows\System\qnhKCZT.exe
  2⤵
  PID:7252
- C:\Windows\System\GeZwPnu.exe
  C:\Windows\System\GeZwPnu.exe
  2⤵
  PID:8092
- C:\Windows\System\ftJsICF.exe
  C:\Windows\System\ftJsICF.exe
  2⤵
  PID:7532
- C:\Windows\System\ndyuOTn.exe
  C:\Windows\System\ndyuOTn.exe
  2⤵
  PID:7652
- C:\Windows\System\rsbDtfD.exe
  C:\Windows\System\rsbDtfD.exe
  2⤵
  PID:6244
- C:\Windows\System\qRQZhBC.exe
  C:\Windows\System\qRQZhBC.exe
  2⤵
  PID:7668
- C:\Windows\System\XNmnzdk.exe
  C:\Windows\System\XNmnzdk.exe
  2⤵
  PID:7448
- C:\Windows\System\IYEFKrm.exe
  C:\Windows\System\IYEFKrm.exe
  2⤵
  PID:7712
- C:\Windows\System\fJVawjl.exe
  C:\Windows\System\fJVawjl.exe
  2⤵
  PID:7764
- C:\Windows\System\ozkATHs.exe
  C:\Windows\System\ozkATHs.exe
  2⤵
  PID:8024
- C:\Windows\System\YSeCoOa.exe
  C:\Windows\System\YSeCoOa.exe
  2⤵
  PID:8148
- C:\Windows\System\WSFgeIA.exe
  C:\Windows\System\WSFgeIA.exe
  2⤵
  PID:7984
- C:\Windows\System\WMbdjDE.exe
  C:\Windows\System\WMbdjDE.exe
  2⤵
  PID:7912
- C:\Windows\System\tVAhCbk.exe
  C:\Windows\System\tVAhCbk.exe
  2⤵
  PID:7500
- C:\Windows\System\FIILBfM.exe
  C:\Windows\System\FIILBfM.exe
  2⤵
  PID:8184
- C:\Windows\System\GeMDISd.exe
  C:\Windows\System\GeMDISd.exe
  2⤵
  PID:7720
- C:\Windows\System\TLpVPJF.exe
  C:\Windows\System\TLpVPJF.exe
  2⤵
  PID:7752
- C:\Windows\System\JbgbKOK.exe
  C:\Windows\System\JbgbKOK.exe
  2⤵
  PID:7960
- C:\Windows\System\tQYbgfH.exe
  C:\Windows\System\tQYbgfH.exe
  2⤵
  PID:7468
- C:\Windows\System\hgexgyF.exe
  C:\Windows\System\hgexgyF.exe
  2⤵
  PID:8176
- C:\Windows\System\QaiHGOO.exe
  C:\Windows\System\QaiHGOO.exe
  2⤵
  PID:7524
- C:\Windows\System\MMsDOjk.exe
  C:\Windows\System\MMsDOjk.exe
  2⤵
  PID:7716
- C:\Windows\System\JrmYCJJ.exe
  C:\Windows\System\JrmYCJJ.exe
  2⤵
  PID:7900
- C:\Windows\System\SuPohFn.exe
  C:\Windows\System\SuPohFn.exe
  2⤵
  PID:7980
- C:\Windows\System\HTBKBzQ.exe
  C:\Windows\System\HTBKBzQ.exe
  2⤵
  PID:7616
- C:\Windows\System\HhYysJV.exe
  C:\Windows\System\HhYysJV.exe
  2⤵
  PID:8196
- C:\Windows\System\ahUqUhm.exe
  C:\Windows\System\ahUqUhm.exe
  2⤵
  PID:8212
- C:\Windows\System\buNKYpt.exe
  C:\Windows\System\buNKYpt.exe
  2⤵
  PID:8236
- C:\Windows\System\QmkXOQL.exe
  C:\Windows\System\QmkXOQL.exe
  2⤵
  PID:8280
- C:\Windows\System\xtwkrVl.exe
  C:\Windows\System\xtwkrVl.exe
  2⤵
  PID:8300
- C:\Windows\System\YbKHKJb.exe
  C:\Windows\System\YbKHKJb.exe
  2⤵
  PID:8320
- C:\Windows\System\OOsUUxk.exe
  C:\Windows\System\OOsUUxk.exe
  2⤵
  PID:8344
- C:\Windows\System\SiFLbeN.exe
  C:\Windows\System\SiFLbeN.exe
  2⤵
  PID:8360
- C:\Windows\System\TdPNUlf.exe
  C:\Windows\System\TdPNUlf.exe
  2⤵
  PID:8376
- C:\Windows\System\psUFpQW.exe
  C:\Windows\System\psUFpQW.exe
  2⤵
  PID:8400
- C:\Windows\System\JJxbStj.exe
  C:\Windows\System\JJxbStj.exe
  2⤵
  PID:8424
- C:\Windows\System\NYkkwHT.exe
  C:\Windows\System\NYkkwHT.exe
  2⤵
  PID:8440
- C:\Windows\System\ODpuWQW.exe
  C:\Windows\System\ODpuWQW.exe
  2⤵
  PID:8460
- C:\Windows\System\TIGPHNo.exe
  C:\Windows\System\TIGPHNo.exe
  2⤵
  PID:8476
- C:\Windows\System\nCPxfgf.exe
  C:\Windows\System\nCPxfgf.exe
  2⤵
  PID:8496
- C:\Windows\System\xgsIbcW.exe
  C:\Windows\System\xgsIbcW.exe
  2⤵
  PID:8512
- C:\Windows\System\mIEFrwv.exe
  C:\Windows\System\mIEFrwv.exe
  2⤵
  PID:8552
- C:\Windows\System\ZoKvDTT.exe
  C:\Windows\System\ZoKvDTT.exe
  2⤵
  PID:8568
- C:\Windows\System\NbRuRFB.exe
  C:\Windows\System\NbRuRFB.exe
  2⤵
  PID:8592
- C:\Windows\System\ZfFNMHH.exe
  C:\Windows\System\ZfFNMHH.exe
  2⤵
  PID:8616
- C:\Windows\System\YPpAliq.exe
  C:\Windows\System\YPpAliq.exe
  2⤵
  PID:8632
- C:\Windows\System\zBBJgiR.exe
  C:\Windows\System\zBBJgiR.exe
  2⤵
  PID:8652
- C:\Windows\System\FRlWfGv.exe
  C:\Windows\System\FRlWfGv.exe
  2⤵
  PID:8668
- C:\Windows\System\lTGjdSO.exe
  C:\Windows\System\lTGjdSO.exe
  2⤵
  PID:8688
- C:\Windows\System\mHMsjEf.exe
  C:\Windows\System\mHMsjEf.exe
  2⤵
  PID:8708
- C:\Windows\System\JBDUoOJ.exe
  C:\Windows\System\JBDUoOJ.exe
  2⤵
  PID:8728
- C:\Windows\System\HZUrkPj.exe
  C:\Windows\System\HZUrkPj.exe
  2⤵
  PID:8744
- C:\Windows\System\OFpOJFO.exe
  C:\Windows\System\OFpOJFO.exe
  2⤵
  PID:8760
- C:\Windows\System\sAhgAMD.exe
  C:\Windows\System\sAhgAMD.exe
  2⤵
  PID:8780
- C:\Windows\System\JRnzLLz.exe
  C:\Windows\System\JRnzLLz.exe
  2⤵
  PID:8816
- C:\Windows\System\ZTkeGlY.exe
  C:\Windows\System\ZTkeGlY.exe
  2⤵
  PID:8832
- C:\Windows\System\debeMPM.exe
  C:\Windows\System\debeMPM.exe
  2⤵
  PID:8848
- C:\Windows\System\nPRQTzO.exe
  C:\Windows\System\nPRQTzO.exe
  2⤵
  PID:8868
- C:\Windows\System\HEdXSHG.exe
  C:\Windows\System\HEdXSHG.exe
  2⤵
  PID:8888
- C:\Windows\System\fSWydNW.exe
  C:\Windows\System\fSWydNW.exe
  2⤵
  PID:8908
- C:\Windows\System\ffIYIdf.exe
  C:\Windows\System\ffIYIdf.exe
  2⤵
  PID:8932
- C:\Windows\System\AIdKAcN.exe
  C:\Windows\System\AIdKAcN.exe
  2⤵
  PID:8948
- C:\Windows\System\iBqONnO.exe
  C:\Windows\System\iBqONnO.exe
  2⤵
  PID:8976
- C:\Windows\System\tBGXHga.exe
  C:\Windows\System\tBGXHga.exe
  2⤵
  PID:8992
- C:\Windows\System\OScXMPn.exe
  C:\Windows\System\OScXMPn.exe
  2⤵
  PID:9008
- C:\Windows\System\NXdDjEk.exe
  C:\Windows\System\NXdDjEk.exe
  2⤵
  PID:9024
- C:\Windows\System\uFRiDiN.exe
  C:\Windows\System\uFRiDiN.exe
  2⤵
  PID:9040
- C:\Windows\System\ylCOdkN.exe
  C:\Windows\System\ylCOdkN.exe
  2⤵
  PID:9056
- C:\Windows\System\xNTPMhQ.exe
  C:\Windows\System\xNTPMhQ.exe
  2⤵
  PID:9076
- C:\Windows\System\cwnYZYt.exe
  C:\Windows\System\cwnYZYt.exe
  2⤵
  PID:9092
- C:\Windows\System\mzZREoX.exe
  C:\Windows\System\mzZREoX.exe
  2⤵
  PID:9108
- C:\Windows\System\KFOMwWo.exe
  C:\Windows\System\KFOMwWo.exe
  2⤵
  PID:9124
- C:\Windows\System\YoaeCIx.exe
  C:\Windows\System\YoaeCIx.exe
  2⤵
  PID:9140
- C:\Windows\System\FMKRpAb.exe
  C:\Windows\System\FMKRpAb.exe
  2⤵
  PID:9156
- C:\Windows\System\FrPINUx.exe
  C:\Windows\System\FrPINUx.exe
  2⤵
  PID:9176
- C:\Windows\System\lxCRvTl.exe
  C:\Windows\System\lxCRvTl.exe
  2⤵
  PID:9192
- C:\Windows\System\CzoMQnE.exe
  C:\Windows\System\CzoMQnE.exe
  2⤵
  PID:7308
- C:\Windows\System\BpzxcTa.exe
  C:\Windows\System\BpzxcTa.exe
  2⤵
  PID:5696
- C:\Windows\System\rKsgeiS.exe
  C:\Windows\System\rKsgeiS.exe
  2⤵
  PID:8228
- C:\Windows\System\LAHEtsw.exe
  C:\Windows\System\LAHEtsw.exe
  2⤵
  PID:7908
- C:\Windows\System\dYpSeLJ.exe
  C:\Windows\System\dYpSeLJ.exe
  2⤵
  PID:8260
- C:\Windows\System\BvtZXNl.exe
  C:\Windows\System\BvtZXNl.exe
  2⤵
  PID:1544
- C:\Windows\System\vOuXVGx.exe
  C:\Windows\System\vOuXVGx.exe
  2⤵
  PID:8352
- C:\Windows\System\uLLhkwB.exe
  C:\Windows\System\uLLhkwB.exe
  2⤵
  PID:8392
- C:\Windows\System\lngqQwd.exe
  C:\Windows\System\lngqQwd.exe
  2⤵
  PID:8432
- C:\Windows\System\stpgOMe.exe
  C:\Windows\System\stpgOMe.exe
  2⤵
  PID:8508
- C:\Windows\System\LhYfnTX.exe
  C:\Windows\System\LhYfnTX.exe
  2⤵
  PID:8456
- C:\Windows\System\aMSuKbX.exe
  C:\Windows\System\aMSuKbX.exe
  2⤵
  PID:8532
- C:\Windows\System\ulrPyFy.exe
  C:\Windows\System\ulrPyFy.exe
  2⤵
  PID:8548
- C:\Windows\System\GjgWyRu.exe
  C:\Windows\System\GjgWyRu.exe
  2⤵
  PID:8600
- C:\Windows\System\ROpeWiO.exe
  C:\Windows\System\ROpeWiO.exe
  2⤵
  PID:8624
- C:\Windows\System\fKWzjse.exe
  C:\Windows\System\fKWzjse.exe
  2⤵
  PID:8628
- C:\Windows\System\ULkajYC.exe
  C:\Windows\System\ULkajYC.exe
  2⤵
  PID:8680
- C:\Windows\System\JpWGqsS.exe
  C:\Windows\System\JpWGqsS.exe
  2⤵
  PID:8724
- C:\Windows\System\kofJdQm.exe
  C:\Windows\System\kofJdQm.exe
  2⤵
  PID:8768
- C:\Windows\System\IwNvetH.exe
  C:\Windows\System\IwNvetH.exe
  2⤵
  PID:8796
- C:\Windows\System\GTTOxKE.exe
  C:\Windows\System\GTTOxKE.exe
  2⤵
  PID:8824
- C:\Windows\System\WTXjCNC.exe
  C:\Windows\System\WTXjCNC.exe
  2⤵
  PID:8880
- C:\Windows\System\HxlqUoc.exe
  C:\Windows\System\HxlqUoc.exe
  2⤵
  PID:8928
- C:\Windows\System\rVpaTxu.exe
  C:\Windows\System\rVpaTxu.exe
  2⤵
  PID:8960
- C:\Windows\System\npOwvph.exe
  C:\Windows\System\npOwvph.exe
  2⤵
  PID:9000
- C:\Windows\System\ECqnHZF.exe
  C:\Windows\System\ECqnHZF.exe
  2⤵
  PID:9064
- C:\Windows\System\aWACuiT.exe
  C:\Windows\System\aWACuiT.exe
  2⤵
  PID:9104
- C:\Windows\System\UzmTRXj.exe
  C:\Windows\System\UzmTRXj.exe
  2⤵
  PID:9172
- C:\Windows\System\bGVLEAg.exe
  C:\Windows\System\bGVLEAg.exe
  2⤵
  PID:9212
- C:\Windows\System\qtIzJaM.exe
  C:\Windows\System\qtIzJaM.exe
  2⤵
  PID:7684
- C:\Windows\System\TiqfikC.exe
  C:\Windows\System\TiqfikC.exe
  2⤵
  PID:9152
- C:\Windows\System\TqUxUFG.exe
  C:\Windows\System\TqUxUFG.exe
  2⤵
  PID:9084
- C:\Windows\System\awSacZM.exe
  C:\Windows\System\awSacZM.exe
  2⤵
  PID:9016
- C:\Windows\System\RdfXHyU.exe
  C:\Windows\System\RdfXHyU.exe
  2⤵
  PID:9188
- C:\Windows\System\TqxYTAx.exe
  C:\Windows\System\TqxYTAx.exe
  2⤵
  PID:8268
- C:\Windows\System\jMoodHa.exe
  C:\Windows\System\jMoodHa.exe
  2⤵
  PID:8308
- C:\Windows\System\ioMdiiO.exe
  C:\Windows\System\ioMdiiO.exe
  2⤵
  PID:8340
- C:\Windows\System\OVwUiaC.exe
  C:\Windows\System\OVwUiaC.exe
  2⤵
  PID:8372
- C:\Windows\System\rXpcBNZ.exe
  C:\Windows\System\rXpcBNZ.exe
  2⤵
  PID:8416
- C:\Windows\System\mPyarhw.exe
  C:\Windows\System\mPyarhw.exe
  2⤵
  PID:8504
- C:\Windows\System\SmdNHPr.exe
  C:\Windows\System\SmdNHPr.exe
  2⤵
  PID:8540
- C:\Windows\System\sjEysDI.exe
  C:\Windows\System\sjEysDI.exe
  2⤵
  PID:8564
- C:\Windows\System\bvrQZyJ.exe
  C:\Windows\System\bvrQZyJ.exe
  2⤵
  PID:8664
- C:\Windows\System\NdhYTPv.exe
  C:\Windows\System\NdhYTPv.exe
  2⤵
  PID:8772
- C:\Windows\System\NuOBsQC.exe
  C:\Windows\System\NuOBsQC.exe
  2⤵
  PID:8740
- C:\Windows\System\FAKcwAZ.exe
  C:\Windows\System\FAKcwAZ.exe
  2⤵
  PID:8812
- C:\Windows\System\HSJRXam.exe
  C:\Windows\System\HSJRXam.exe
  2⤵
  PID:8968
- C:\Windows\System\ybBbNtL.exe
  C:\Windows\System\ybBbNtL.exe
  2⤵
  PID:9204
- C:\Windows\System\gWYBoDi.exe
  C:\Windows\System\gWYBoDi.exe
  2⤵
  PID:9048
- C:\Windows\System\iXnrlDv.exe
  C:\Windows\System\iXnrlDv.exe
  2⤵
  PID:8984
- C:\Windows\System\ookjqOb.exe
  C:\Windows\System\ookjqOb.exe
  2⤵
  PID:8412
- C:\Windows\System\clWgnoJ.exe
  C:\Windows\System\clWgnoJ.exe
  2⤵
  PID:7800
- C:\Windows\System\yvNvUUt.exe
  C:\Windows\System\yvNvUUt.exe
  2⤵
  PID:8288
- C:\Windows\System\huQzOrr.exe
  C:\Windows\System\huQzOrr.exe
  2⤵
  PID:8292
- C:\Windows\System\IRLPRbB.exe
  C:\Windows\System\IRLPRbB.exe
  2⤵
  PID:8488
- C:\Windows\System\WXDgEIy.exe
  C:\Windows\System\WXDgEIy.exe
  2⤵
  PID:8640
- C:\Windows\System\yNmrTgx.exe
  C:\Windows\System\yNmrTgx.exe
  2⤵
  PID:8788
- C:\Windows\System\dnTGrXD.exe
  C:\Windows\System\dnTGrXD.exe
  2⤵
  PID:8884
- C:\Windows\System\VSmVgbe.exe
  C:\Windows\System\VSmVgbe.exe
  2⤵
  PID:8828
- C:\Windows\System\qaenZNW.exe
  C:\Windows\System\qaenZNW.exe
  2⤵
  PID:8332
- C:\Windows\System\ocNUHYX.exe
  C:\Windows\System\ocNUHYX.exe
  2⤵
  PID:8924
- C:\Windows\System\spDibea.exe
  C:\Windows\System\spDibea.exe
  2⤵
  PID:8204
- C:\Windows\System\QOjCFwp.exe
  C:\Windows\System\QOjCFwp.exe
  2⤵
  PID:8256
- C:\Windows\System\rFcpnBp.exe
  C:\Windows\System\rFcpnBp.exe
  2⤵
  PID:9116
- C:\Windows\System\sZlbqjZ.exe
  C:\Windows\System\sZlbqjZ.exe
  2⤵
  PID:8384
- C:\Windows\System\RNOTsOO.exe
  C:\Windows\System\RNOTsOO.exe
  2⤵
  PID:8528
- C:\Windows\System\hlIPkED.exe
  C:\Windows\System\hlIPkED.exe
  2⤵
  PID:8336
- C:\Windows\System\BBiglEb.exe
  C:\Windows\System\BBiglEb.exe
  2⤵
  PID:8676
- C:\Windows\System\dyhBzFk.exe
  C:\Windows\System\dyhBzFk.exe
  2⤵
  PID:8800
- C:\Windows\System\mfgOYGu.exe
  C:\Windows\System\mfgOYGu.exe
  2⤵
  PID:8252
- C:\Windows\System\vrKfXiv.exe
  C:\Windows\System\vrKfXiv.exe
  2⤵
  PID:8296
- C:\Windows\System\Ibpbzlj.exe
  C:\Windows\System\Ibpbzlj.exe
  2⤵
  PID:8700
- C:\Windows\System\TcAIymA.exe
  C:\Windows\System\TcAIymA.exe
  2⤵
  PID:8956
- C:\Windows\System\twjablm.exe
  C:\Windows\System\twjablm.exe
  2⤵
  PID:9136
- C:\Windows\System\BMilyPs.exe
  C:\Windows\System\BMilyPs.exe
  2⤵
  PID:8576
- C:\Windows\System\khYgCGA.exe
  C:\Windows\System\khYgCGA.exe
  2⤵
  PID:8448
- C:\Windows\System\grSxVyu.exe
  C:\Windows\System\grSxVyu.exe
  2⤵
  PID:9072
- C:\Windows\System\vEGbyfc.exe
  C:\Windows\System\vEGbyfc.exe
  2⤵
  PID:8940
- C:\Windows\System\xxZWwzv.exe
  C:\Windows\System\xxZWwzv.exe
  2⤵
  PID:8608
- C:\Windows\System\SwricBv.exe
  C:\Windows\System\SwricBv.exe
  2⤵
  PID:9228
- C:\Windows\System\hHDZdgj.exe
  C:\Windows\System\hHDZdgj.exe
  2⤵
  PID:9244
- C:\Windows\System\QOcTyCe.exe
  C:\Windows\System\QOcTyCe.exe
  2⤵
  PID:9260
- C:\Windows\System\QpRAJjV.exe
  C:\Windows\System\QpRAJjV.exe
  2⤵
  PID:9276
- C:\Windows\System\cZTZYbf.exe
  C:\Windows\System\cZTZYbf.exe
  2⤵
  PID:9292
- C:\Windows\System\GoCGWZO.exe
  C:\Windows\System\GoCGWZO.exe
  2⤵
  PID:9312
- C:\Windows\System\PUhYrup.exe
  C:\Windows\System\PUhYrup.exe
  2⤵
  PID:9332
- C:\Windows\System\sAwMypq.exe
  C:\Windows\System\sAwMypq.exe
  2⤵
  PID:9384
- C:\Windows\System\AJKHNVU.exe
  C:\Windows\System\AJKHNVU.exe
  2⤵
  PID:9404
- C:\Windows\System\isGLClF.exe
  C:\Windows\System\isGLClF.exe
  2⤵
  PID:9420
- C:\Windows\System\lWItddG.exe
  C:\Windows\System\lWItddG.exe
  2⤵
  PID:9440
- C:\Windows\System\pePyKmo.exe
  C:\Windows\System\pePyKmo.exe
  2⤵
  PID:9456
- C:\Windows\System\zjUmKsg.exe
  C:\Windows\System\zjUmKsg.exe
  2⤵
  PID:9480
- C:\Windows\System\dMQInwX.exe
  C:\Windows\System\dMQInwX.exe
  2⤵
  PID:9496
- C:\Windows\System\ncyEPYW.exe
  C:\Windows\System\ncyEPYW.exe
  2⤵
  PID:9512
- C:\Windows\System\nHBLwHi.exe
  C:\Windows\System\nHBLwHi.exe
  2⤵
  PID:9536
- C:\Windows\System\aXEdQhh.exe
  C:\Windows\System\aXEdQhh.exe
  2⤵
  PID:9552
- C:\Windows\System\dPybjgZ.exe
  C:\Windows\System\dPybjgZ.exe
  2⤵
  PID:9572
- C:\Windows\System\rBrsBpa.exe
  C:\Windows\System\rBrsBpa.exe
  2⤵
  PID:9588
- C:\Windows\System\mAqisOH.exe
  C:\Windows\System\mAqisOH.exe
  2⤵
  PID:9608
- C:\Windows\System\NbBXzdt.exe
  C:\Windows\System\NbBXzdt.exe
  2⤵
  PID:9628
- C:\Windows\System\fvXdogo.exe
  C:\Windows\System\fvXdogo.exe
  2⤵
  PID:9644
- C:\Windows\System\ISevRFj.exe
  C:\Windows\System\ISevRFj.exe
  2⤵
  PID:9660
- C:\Windows\System\BvrtHuq.exe
  C:\Windows\System\BvrtHuq.exe
  2⤵
  PID:9680
- C:\Windows\System\ZVEYQOj.exe
  C:\Windows\System\ZVEYQOj.exe
  2⤵
  PID:9704
- C:\Windows\System\YPzYtep.exe
  C:\Windows\System\YPzYtep.exe
  2⤵
  PID:9720
- C:\Windows\System\BagOuxI.exe
  C:\Windows\System\BagOuxI.exe
  2⤵
  PID:9740
- C:\Windows\System\RGfWVxt.exe
  C:\Windows\System\RGfWVxt.exe
  2⤵
  PID:9792
- C:\Windows\System\iKAurrW.exe
  C:\Windows\System\iKAurrW.exe
  2⤵
  PID:9808
- C:\Windows\System\hDdDhFU.exe
  C:\Windows\System\hDdDhFU.exe
  2⤵
  PID:9824
- C:\Windows\System\opKtsyV.exe
  C:\Windows\System\opKtsyV.exe
  2⤵
  PID:9848
- C:\Windows\System\YbFIHir.exe
  C:\Windows\System\YbFIHir.exe
  2⤵
  PID:9872
- C:\Windows\System\CdFgzYy.exe
  C:\Windows\System\CdFgzYy.exe
  2⤵
  PID:9888
- C:\Windows\System\XHiqznz.exe
  C:\Windows\System\XHiqznz.exe
  2⤵
  PID:9904
- C:\Windows\System\LSaSJYY.exe
  C:\Windows\System\LSaSJYY.exe
  2⤵
  PID:9924
- C:\Windows\System\pYuNuEr.exe
  C:\Windows\System\pYuNuEr.exe
  2⤵
  PID:9944
- C:\Windows\System\wbcEOcm.exe
  C:\Windows\System\wbcEOcm.exe
  2⤵
  PID:9964
- C:\Windows\System\lRWVBRP.exe
  C:\Windows\System\lRWVBRP.exe
  2⤵
  PID:9980
- C:\Windows\System\qJZGxiH.exe
  C:\Windows\System\qJZGxiH.exe
  2⤵
  PID:9996
- C:\Windows\System\ftAcDwu.exe
  C:\Windows\System\ftAcDwu.exe
  2⤵
  PID:10012
- C:\Windows\System\tWIUaYB.exe
  C:\Windows\System\tWIUaYB.exe
  2⤵
  PID:10028
- C:\Windows\System\PIPWiAS.exe
  C:\Windows\System\PIPWiAS.exe
  2⤵
  PID:10048
- C:\Windows\System\CzDNGNf.exe
  C:\Windows\System\CzDNGNf.exe
  2⤵
  PID:10068
- C:\Windows\System\cnHvEdD.exe
  C:\Windows\System\cnHvEdD.exe
  2⤵
  PID:10092
- C:\Windows\System\LVFiKux.exe
  C:\Windows\System\LVFiKux.exe
  2⤵
  PID:10108
- C:\Windows\System\gujsMPk.exe
  C:\Windows\System\gujsMPk.exe
  2⤵
  PID:10124
- C:\Windows\System\cwGggJS.exe
  C:\Windows\System\cwGggJS.exe
  2⤵
  PID:10172
- C:\Windows\System\IZxYBRB.exe
  C:\Windows\System\IZxYBRB.exe
  2⤵
  PID:10192
- C:\Windows\System\mbGijOX.exe
  C:\Windows\System\mbGijOX.exe
  2⤵
  PID:10208
- C:\Windows\System\wuMOXdv.exe
  C:\Windows\System\wuMOXdv.exe
  2⤵
  PID:10224
- C:\Windows\System\EfqqiBU.exe
  C:\Windows\System\EfqqiBU.exe
  2⤵
  PID:8584
- C:\Windows\System\WKaDApi.exe
  C:\Windows\System\WKaDApi.exe
  2⤵
  PID:9240
- C:\Windows\System\htbZwhq.exe
  C:\Windows\System\htbZwhq.exe
  2⤵
  PID:9304
- C:\Windows\System\KFKSiJW.exe
  C:\Windows\System\KFKSiJW.exe
  2⤵
  PID:9288
- C:\Windows\System\pJucBza.exe
  C:\Windows\System\pJucBza.exe
  2⤵
  PID:8524
- C:\Windows\System\ZHEUknm.exe
  C:\Windows\System\ZHEUknm.exe
  2⤵
  PID:9352
- C:\Windows\System\gkLESeI.exe
  C:\Windows\System\gkLESeI.exe
  2⤵
  PID:9372
- C:\Windows\System\rTvvclc.exe
  C:\Windows\System\rTvvclc.exe
  2⤵
  PID:9412
- C:\Windows\System\gIBjxUi.exe
  C:\Windows\System\gIBjxUi.exe
  2⤵
  PID:9428
- C:\Windows\System\DHFoGPH.exe
  C:\Windows\System\DHFoGPH.exe
  2⤵
  PID:9472
- C:\Windows\System\Umcaqid.exe
  C:\Windows\System\Umcaqid.exe
  2⤵
  PID:9528
- C:\Windows\System\CfKOdat.exe
  C:\Windows\System\CfKOdat.exe
  2⤵
  PID:9568
- C:\Windows\System\lsLnLti.exe
  C:\Windows\System\lsLnLti.exe
  2⤵
  PID:9668
- C:\Windows\System\LAQOKfE.exe
  C:\Windows\System\LAQOKfE.exe
  2⤵
  PID:9508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AMwDopy.exe

Path C:\Windows\system\AMwDopy.exe
Size 2.4MB
SHA256 9d1c643d328bf95e7bdc516be4628fc1e6d0587fba8d603c30aad07b4469f037
MD5 f2260ddf5625f25c17e4285973aacbd2
SHA1 154c3573a90ee78d9183f020b397a182fb3c1c1e
SHA512 ca7f57962c0d3684fdb60065c712c374f5b6efbd2ae8e93da75d7c3e2dddcf3a9b079de0caa6dc89cb7e7bb31a5940fc81c6324b10a84cbf88d53fb33f64c873
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371je:BemTLkNdfE0pZrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCiYsW.exe

Path C:\Windows\system\CSCiYsW.exe
Size 2.4MB
SHA256 69770a4c3602e1ca2b83d36102d5dbf15528f2ab9093ac7176cb8d3f80e52c7b
MD5 fa2dc99c2a6958a6f8b5e7d6a8d3fac7
SHA1 4c0bff73f815d2d03f5414aeae066bc026329e63
SHA512 3a52278f0488163885ecfbb091e94c776377ef623ff26024f2b53fb4f1e1021704c37a7e23e9c572277aea5decb1062399843f747ac0c1dc8eb2fd3b48b6cdcf
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jc:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHmyDzW.exe

Path C:\Windows\system\DHmyDzW.exe
Size 2.4MB
SHA256 0687ab92209c99f119988aeb5d5ae648da813dfd7f1f14dc597b684c948facdf
MD5 6f048ae0191e098b6565b83a8f27d68e
SHA1 dea8644524ded1cd0de4d94ca0d4317b896734ba
SHA512 3d0b13298605084d6c434249fbf999bf406478d1aaa83d633f12b246342d58910ab62d63bcf692a84f088ff1e7ad69467ddfba24320fd516f0a5f0638102b838
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jE:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

EgRBdPS.exe

Path C:\Windows\system\EgRBdPS.exe
Size 2.4MB
SHA256 5dab38e22e36af88f8c60b645cf5cf1e51e6be01089804318f2e87f764e9cf02
MD5 defe8222675df41e41b647ef9eefd58d
SHA1 505d86f08e8830d93329c570db4a747fb78c3dc1
SHA512 e081e4e8d815148ee57ff2ca3d6077112cecb249cbac474f80143db5dbc2fced3ceaca8a4c022fa4378c2e34146bbf7b43c50d719af6597cdd3efae8cc6a0cab
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jU:BemTLkNdfE0pZrx
MD5 SHA1 SHA512 SSDEEP

Submit Download

IAmVpYz.exe

Path C:\Windows\system\IAmVpYz.exe
Size 2.4MB
SHA256 cad86d3892ed8a2cbeecb168d77079131e7fb6387617b9cd54cff5ec47009654
MD5 00c2d1a7257f1ca8b95af08462ab46c9
SHA1 4b7de828266fb90f5bdc7395966746338ce379f6
SHA512 381eb482548f0884db8f01f72cc059dac34c80219e43252331cd01914c8efa44fd3b760e76ec21b022ede29d1f13318e4625f0f3b79cc49e0def3da2367a8c8a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jv:BemTLkNdfE0pZri
MD5 SHA1 SHA512 SSDEEP

Submit Download

KYkaXDP.exe

Path C:\Windows\system\KYkaXDP.exe
Size 2.4MB
SHA256 787e8d68f4105160debe18e3c68a41f33fd0776d97649c71395c5ac64ce97b26
MD5 db2ce833e4939fc0afa730116e9613b7
SHA1 17e093b723f911f353da552eb0ba01dde63feb70
SHA512 fe0f68604b529a8103f29f9c5da0320cf5809a3dd72b9786493efe8054b809d842c3e0f1587a0c88d80f8a81de7c8891a88160b3d83407864bf0772024891ad7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jx:BemTLkNdfE0pZr2
MD5 SHA1 SHA512 SSDEEP

Submit Download

KlHOkUa.exe

Path C:\Windows\system\KlHOkUa.exe
Size 2.4MB
SHA256 e641931b9e70e083230a415a1577a4d6ea7457170351efbb9602f3c5612c8a16
MD5 88a91429c66874ed93aff209d523c663
SHA1 0314af12ea0136d083c15cf804e2b78f78b2efec
SHA512 86aa6e5755d881d894382e10870322bcbaaed416046943fc9aeaa291c3cbab63e0e7239515b48963a00376384255587494c9c19ceddcc4f9f709f17b006cc08f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371j9:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

OWAoXEY.exe

Path C:\Windows\system\OWAoXEY.exe
Size 2.4MB
SHA256 f52555608f3a74456348244d3ce78f1a4660784f570da23cf387ecf8ef0e84b8
MD5 41c26a052e95f78ac7ad765a0897d89e
SHA1 21e7e55ba6b280a4b566d68fb5cdbaacd83088d7
SHA512 12042629c8d35214c6c3797a4798de68980d40e03ae0b5bfa3237e5e8ffd229e9b47f01c5b030c27c8be89b8f73d2775e6eb78974d5bf89bd0217427eac4bb71
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jn:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

QEmufVt.exe

Path C:\Windows\system\QEmufVt.exe
Size 2.4MB
SHA256 90f1761e7a0116ba9e4bd8d954b2c1545cd837ec6bcbf0391c0a32de3cfa393b
MD5 d24a6bddf1a37b168252a407437b8cc6
SHA1 994aaeb03cfe04840778b92f80d5834cb82979cc
SHA512 2f7564cd577915ffd10cfde7f46bb710097e070a438c8f4de0a293f1b236b7be523bb4a2352c2354cbc1e846c01a308d28a96cf883ea665f6e54867711cb7ab2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371j4:BemTLkNdfE0pZr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

QPNFfoi.exe

Path C:\Windows\system\QPNFfoi.exe
Size 2.4MB
SHA256 f98e04d520505db29eb8061e7e1d3d90384dd498f5b2ef54bf890b177c2c6b45
MD5 ad9ac9ae3da193ffebea73a8bd601788
SHA1 be5dee0c6fc7cba4b17c72274fdd970e660a5a25
SHA512 073005a7e640669e989e7289668999936c8d9cb89a2845df75bd2680d9cf0bba145e082d4573de1badb955f8ee256b48be6f8fd8841414d6fc7284d096cf3877
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jo:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

QwshlfD.exe

Path C:\Windows\system\QwshlfD.exe
Size 2.4MB
SHA256 9fe0ba051ffcc8224c5a40f0269fa12e71df779dd05270557a8ad326c7888844
MD5 00a48068182403ba08e69b5801cb04b1
SHA1 2d8ccaefe45e932953b231516a61dc3dd94e2acf
SHA512 cf8f582f3f22f16d69f74e3fc297dbae3e58152a8fd0e08e57ae660b678cd0e88c27d90c5ef8b2f4de60aa690824892372082b4639fd51e23448168c351861a6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jM:BemTLkNdfE0pZrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

SnUIxJM.exe

Path C:\Windows\system\SnUIxJM.exe
Size 2.4MB
SHA256 2cf3fedbe199a5fafd77b8f3e2ce4290b7b7ea8297ebe2d05f658cdd2e952d08
MD5 17256c7b60e372422646df70c950e83b
SHA1 103d3adaf2a70743868d75f538fabe346bde2af4
SHA512 48b357832d4cfec9e7c22f682be26056c0fffb5ce514230cde750dc8b7bca0c9412b8c254f8c0a51a898b9b63150bb28d6746f9bde8948ea6e154b9837c000ed
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jw:BemTLkNdfE0pZrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

UELneQS.exe

Path C:\Windows\system\UELneQS.exe
Size 2.4MB
SHA256 756016a34a7ad60bd19b8083788ade64f9ae5197ccc88261338c5a2603cb3885
MD5 e5cdf9c045f218ddeba49c657cbc974f
SHA1 89b9d66cb4522c3efc35894a66ca7b554a63119d
SHA512 c6bec8f6a8c1eaccadceca762f041303d20c11fcb8da4dde3e9378912dd8377e4270ce08b595e880f2f10df3e7ad4deff599814281a0eff6fac598d8b80b7b7f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jx:BemTLkNdfE0pZrQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

VYGIwSZ.exe

Path C:\Windows\system\VYGIwSZ.exe
Size 2.4MB
SHA256 fb674711160b587b8175ff85014112c7e8bfd58dddd75ebc5d1124c8f9efdc02
MD5 2dccc80f635fab3340e3fdcbc7eb0b47
SHA1 a7f0db908ac2ee6e2bdd244f84771c33ba9d5a9b
SHA512 49665e454c2e068a2ab24971fab565d4f655f014ee098bcfe9f64abc8b6623092b7d566f7b6a2fdcd87188d00038c8b91a8f17af3aa95a663bf6d02ffe263c6b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jY:BemTLkNdfE0pZrh
MD5 SHA1 SHA512 SSDEEP

Submit Download

WGTPQsG.exe

Path C:\Windows\system\WGTPQsG.exe
Size 2.4MB
SHA256 a78dd1cc68ce79b7844d0f2b3effe567bdc23faaf8176601445ba1bcbdd40da9
MD5 4ba30f0a6e5246a1a57814fca35599fc
SHA1 09c8298603395fdedbf057ac4659e4c945bd2100
SHA512 c3eb720d7083d681f52bb8d660ed21e6bd4a6024724a2ae273f3647cfbfcce72854c5509c309246504ef76615d4bd1432eab2505da002fd4f71158bfc5105f94
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jN:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

WvbWlZV.exe

Path C:\Windows\system\WvbWlZV.exe
Size 2.4MB
SHA256 3a1a72b6096bf094121de309b4ecf63e10dfe6d437fe31a3678554ac58f275d8
MD5 2ad67a3c61106a22d5d8c19633fd5067
SHA1 cb5a2eb86b19f8864c7cec15cc129b51d013ef7f
SHA512 24c358dcc9801f14563882a63f8c7fb8dc44bfcf3ece6e318ebe51d6c54b9abc972b7b6504ef59670bfa767b2633006c5961e16aa64add72d6ec6218f89b77fd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371j0:BemTLkNdfE0pZr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZqdSlia.exe

Path C:\Windows\system\ZqdSlia.exe
Size 2.4MB
SHA256 a4c0fedb83fce67d3599266b2145d19cf3931dd68ab60a9da0e3161095a68914
MD5 9cc03461aca6dfeb93457d2a69e685b8
SHA1 de23387810f7e96f1cbb9e793f62d6e38f718f59
SHA512 0738780a048e08a25beeedcff1c2cff6627b3c940f2550df12185f9f91ada647484850ad7cc3012954d0c03fab74b4eec085b5a7457aa6750d0fcedaa19a59ea
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371ja:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

azWrnyF.exe

Path C:\Windows\system\azWrnyF.exe
Size 2.4MB
SHA256 63b3fbcee6497886124b4b23ee75f6ca358ee0dd6e79c87c69637f9144233dad
MD5 45a507035d508bd42639f2dc93feb6ea
SHA1 a62eb2914195531d47b2ee521b0c2f956e95dade
SHA512 e361f1aba81c935c387b9c93231cfe55fea8aaae7a3d1d72c0580a14e4528c9e02d659357700e1ac144b91eb9f51fb8b97400045e7f1245fecb8babf5a7797a7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371ja:BemTLkNdfE0pZrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bagnMgk.exe

Path C:\Windows\system\bagnMgk.exe
Size 2.4MB
SHA256 891c5eb63d6682ff3c7347dced15da596f15295bf936757ce74bcf4598b4200c
MD5 7f8e326ce0ca23ba562fa4d391e42c7c
SHA1 8e1011ac01c0d444c97ab72bb57598924541df75
SHA512 0ad8fafb4519f2e382821c462a17e2cc0e271baed1a4edcfe9394d96f9a7e95a752e5479a89d0545a0a8ab80622cc5c042719857df1ae911711a3f610b61f2cd
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jn:BemTLkNdfE0pZrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ckLBeFq.exe

Path C:\Windows\system\ckLBeFq.exe
Size 2.4MB
SHA256 2e6360ba02554469fb2fa3935ba096c0704f04fe8d6f1a7efab610398bd9dcfa
MD5 fe5a52c3eb83f36b458e8323f098ed1f
SHA1 85161c643b349a84d85b13d924398e9acf5ea47d
SHA512 a2926e2abb315b9c4a2042ccc23a7753d4aa0fecd97565841910fe3f7d933a6baed7808404f88d5480302bd82d960f4ee9ece984c45a285d3ec095824906987d
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371ju:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

gjoxGKd.exe

Path C:\Windows\system\gjoxGKd.exe
Size 2.4MB
SHA256 4803f56cb519d0f71d46d92249592fea3b750c3b0d49513e52b42da0d09cca1d
MD5 4540134cf35777cee20f3763077b0e28
SHA1 19d6524d752cdd248fc74dc7e62c57c06278cacc
SHA512 b4949b2de2fe333aab16b4a28c407077529ea559dac83bdd002658b2e830a0953188854f71c360012da32dc383f84f9ed2ff30f7ed184fc0d34606099af60b2a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jX:BemTLkNdfE0pZrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

huzAUAM.exe

Path C:\Windows\system\huzAUAM.exe
Size 2.4MB
SHA256 b3786a96a9c91ac57139e2434b7acd34d3ab983e54e6311abbb31826e009e024
MD5 bc17aeb44fb57131ef2c9d87ac7a5132
SHA1 e538a107d1630a017d56e0ec086429e46846344b
SHA512 5ac2566399a717409610eaa6467d4053a1e40ce40974c2ada16f9f39aad8f9902aa019cf560edf2ce3a9574dbc66b973b070a57ba9f71d5e1f2f57e4c1f648aa
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jP:BemTLkNdfE0pZrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

hwpATiY.exe

Path C:\Windows\system\hwpATiY.exe
Size 2.4MB
SHA256 4a7a77048c2c6ba2bd346e73bb5dce1fca56ef73aeb51171bff4240a3f7297f8
MD5 9ef4c81d9186f259b8b3c6a34f40595a
SHA1 71f1ec2e0e050eec1901511b22555b94e43602b7
SHA512 c3048394d7e3e4c4203617bb5fe6add598d4c389fb92e8c46ee6f6f872481c24a1593cae4667d1e52d470eda22b532dd1c8519c32ad7822c7b84696a5a97d750
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jQ:BemTLkNdfE0pZrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

nVKBbew.exe

Path C:\Windows\system\nVKBbew.exe
Size 2.4MB
SHA256 feb5e9abea5e5e39885099a8ef03e6bd8b302a097612eaa6ff50841e493a7270
MD5 d685d91fe784b8553287c768e4685807
SHA1 edbaf01607f931195bb8566f5242028fb6c085e3
SHA512 6051cbc549e1f7e3ae3321ac7c0e9a080ffec25864cce990543b224e2e35ced29a0bba1e5f1e8155fcf5e39773d5842ea96bb7e86e3a683d25ae440d9ba06621
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jE:BemTLkNdfE0pZrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rNPnWQH.exe

Path C:\Windows\system\rNPnWQH.exe
Size 2.4MB
SHA256 9adf436f11cd003745d45029d37239732cf1ba2e0306332fc5592c2bae974769
MD5 881e4940f03c549e692000dbc960b5cc
SHA1 637389637f9752d4f1ee68ab29f595ae0e02a3b3
SHA512 2bb60adda236320e9961e7d29e4f829c8b832129e5f9b98108a204cbc51610ffc57ab615bf0c849b0bfdfdde820b3fbb2485b4d9ed4af658bef8f563b5a40bc8
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jJ:BemTLkNdfE0pZre
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtmgIDY.exe

Path C:\Windows\system\rtmgIDY.exe
Size 2.4MB
SHA256 c2a8bf860b6504dabb5371fb955cd67f71f2e7ad3cc26f5084722574d32840fb
MD5 dcf57399264067929e1e23b9c954c97c
SHA1 87b5ee15c07e20a0da20bc763986ca9a8eb7e36a
SHA512 761b67639e47b5089f9b25300bb64524c2369364abef041c01b1ba22bba392ea871e38541ec82cf8e8661c92e14a019f8caab9726958ca71b34d774dbf429fe1
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jw:BemTLkNdfE0pZrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sxgFHEY.exe

Path C:\Windows\system\sxgFHEY.exe
Size 2.4MB
SHA256 d624ad9227581556ba85821043d27422a7c609952400807059b5941fa6086c9b
MD5 1779b3cb8d7b08b364abb012f205782f
SHA1 1a9651a09adff92749ee65bb99e236f855c046f7
SHA512 af0b8f57ca3fb698abcf017e4aaf3f5d60926158918d60a1a883f30fca5071c27172d3e44039e4a425c248daf4f7a99d3fcba5866940670a17ac069469d7cfdb
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jn:BemTLkNdfE0pZrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

tJbyNMx.exe

Path C:\Windows\system\tJbyNMx.exe
Size 2.4MB
SHA256 898c2067ff2edf7553cd15159aa072a26526358c81e027af51bc776f291ec926
MD5 87606d6696a77becd7b98082b96e093c
SHA1 e60608ded4336c2bbf1280207171c13624cd2359
SHA512 d72da44ca9f049ba68b73a86019176ad992d500b9d16cd82be4a41c5e507172b87de03c22447da6ca70470b4292d8bf5547b1069e83770d5f5ab206bf8585790
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jB:BemTLkNdfE0pZre
MD5 SHA1 SHA512 SSDEEP

Submit Download

tQaqGTm.exe

Path C:\Windows\system\tQaqGTm.exe
Size 2.4MB
SHA256 26869790c503e9e0814c6348babe386acabf47bd255214b3a693183576290de4
MD5 475d04cea0d0f43af1633edf61b8f72f
SHA1 66a6cc392658d3d33bc995265d8bd51731af7fed
SHA512 b6a43bbd7eec7e2809adfa99b1e9425fd024d112bea20f5eb734467274f79b2796a11c19d4c907e87b3e4a39e7492b7de9a2138902f765051dcd1e654a9a90b2
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jZ:BemTLkNdfE0pZrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

yuxacwm.exe

Path C:\Windows\system\yuxacwm.exe
Size 2.4MB
SHA256 14017cfc3bc20362aae60bc06d79d712b10c9feebe2baadcb8e63932a6a7ead2
MD5 19e1b14e23a691697358541ac136a1d7
SHA1 43b38fd9de70ab07077a03b1a848eafae1460af6
SHA512 cc690e2edcf99b30673c555e375208be56d10d46b92b2f6f20e464eae239501aa84dd952bc3951d126f2f4d552879239827a3b1c5abadf582e9a8c363bb70fb4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jL:BemTLkNdfE0pZrO
MD5 SHA1 SHA512 SSDEEP

Submit Download

yyHWdUc.exe

Path C:\Windows\system\yyHWdUc.exe
Size 2.4MB
SHA256 a6676904855041cfeb33354b59786739942ce3fbdcd1287f976958ed00f0da29
MD5 5ff7f0c9f516cc7e0dc80dfa95c312b6
SHA1 d4a0bc276c5335409dd105e4e1517ad3f2942991
SHA512 1adfd16293868f2d07b4370275d21ce63bf9612fd2c546afc165f5e381e4a548d99bcc3241da3fbf9b4904676bc16ff03aea5a64ccf7103e52949f10287aa459
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371jx:BemTLkNdfE0pZrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MOAorLb.exe

Path \Windows\system\MOAorLb.exe
Size 2.4MB
SHA256 7772822d5868527f9934049792d388b7f6c58a54c7400bde247af4059a071fae
MD5 71cd97be926c5f07fd517538bbf9ae9f
SHA1 24e8c2e6d4b85dd3d5bcb18da5adfa072cb88c01
SHA512 1b4f7396746b52181599e6a3fd0a22d4d1eb29ed3948bc51aae7e012533d1db916a6673d4f4c676e5180f3cfe9208c63c4d0cf5ce8310f7d69dbb290383ccba7
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+ABcizEU7371ji:BemTLkNdfE0pZrx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2004-18-0x000000013F190000-0x000000013F4E4000-memory.dmp

Download

memory/2004-83-0x000000013F190000-0x000000013F4E4000-memory.dmp

Download

memory/2004-4024-0x000000013F190000-0x000000013F4E4000-memory.dmp

Download

memory/2140-29-0x000000013F0F0000-0x000000013F444000-memory.dmp

Download

memory/2140-4022-0x000000013F0F0000-0x000000013F444000-memory.dmp

Download

memory/2188-1885-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2188-69-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2188-4030-0x000000013F8F0000-0x000000013FC44000-memory.dmp

Download

memory/2412-24-0x000000013F190000-0x000000013F4E4000-memory.dmp

Download

memory/2412-2641-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-99-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-1884-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-107-0x000000013F3B0000-0x000000013F704000-memory.dmp

Download

memory/2412-106-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-84-0x000000013FF40000-0x0000000140294000-memory.dmp

Download

memory/2412-0-0x0000000000100000-0x0000000000110000-memory.dmp

Download

memory/2412-41-0x000000013F790000-0x000000013FAE4000-memory.dmp

Download

memory/2412-91-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-844-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-1-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

Download

memory/2412-77-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-76-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

Download

memory/2412-3066-0x000000013F3B0000-0x000000013F704000-memory.dmp

Download

memory/2412-56-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-33-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-2884-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-68-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-9-0x000000013F0F0000-0x000000013F444000-memory.dmp

Download

memory/2412-62-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Download

memory/2412-26-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2412-2561-0x000000013FF40000-0x0000000140294000-memory.dmp

Download

memory/2412-48-0x0000000002080000-0x00000000023D4000-memory.dmp

Download

memory/2504-2358-0x000000013F030000-0x000000013F384000-memory.dmp

Download

memory/2504-4032-0x000000013F030000-0x000000013F384000-memory.dmp

Download

memory/2504-78-0x000000013F030000-0x000000013F384000-memory.dmp

Download

memory/2524-507-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Download

memory/2524-49-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Download

memory/2524-4028-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Download

memory/2532-1106-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Download

memory/2532-4031-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Download

memory/2532-63-0x000000013F2A0000-0x000000013F5F4000-memory.dmp

Download

memory/2604-85-0x000000013FF40000-0x0000000140294000-memory.dmp

Download

memory/2604-4033-0x000000013FF40000-0x0000000140294000-memory.dmp

Download

memory/2604-2562-0x000000013FF40000-0x0000000140294000-memory.dmp

Download

memory/2616-57-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Download

memory/2616-4029-0x000000013F9B0000-0x000000013FD04000-memory.dmp

Download

memory/2660-40-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Download

memory/2660-4026-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Download

memory/2764-42-0x000000013F790000-0x000000013FAE4000-memory.dmp

Download

memory/2764-352-0x000000013F790000-0x000000013FAE4000-memory.dmp

Download

memory/2764-4027-0x000000013F790000-0x000000013FAE4000-memory.dmp

Download

memory/2780-4035-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Download

memory/2780-92-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Download

memory/2780-2642-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Download

memory/2952-100-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Download

memory/2952-4034-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Download

memory/2952-2885-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Download

memory/3036-4025-0x000000013FDF0000-0x0000000140144000-memory.dmp

Download

memory/3036-28-0x000000013FDF0000-0x0000000140144000-memory.dmp

Download

memory/3060-4023-0x000000013FB20000-0x000000013FE74000-memory.dmp

Download

memory/3060-27-0x000000013FB20000-0x000000013FE74000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads