xmrig | 3949de9e22172082261ee717939d0d21be2eabc5d20c0fb1e6fd937f119ab8d1

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
Size 2.0MB
Sample240613-dh42easbrb
SHA256 3949de9e22172082261ee717939d0d21be2eabc5d20c0fb1e6fd937f119ab8d1
MD5 59469d3c92aa6420cc7d1c2db876d620
SHA1 8bb8555170b87fea0f0c404d4eedd6517f95fc47
SHA512 e2d482d1a983b27667aff9b831ef706e66b6c3b954fe2c57e66739364ed48d2055ba2773132185e0bb75897a3b7818c1425b837a8dcad3b5404429efca130faf
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5r:BemTLkNdfE0pZr3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1736-0-0x000000013F7B0000-0x000000013FB04000-memory.dmp	xmrig
behavioral1/files/0x0010000000012272-3.dat	xmrig
behavioral1/memory/1740-14-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/files/0x00350000000165d4-13.dat	xmrig
behavioral1/memory/1736-9-0x0000000001ED0000-0x0000000002224000-memory.dmp	xmrig
behavioral1/files/0x0008000000016c67-18.dat	xmrig
behavioral1/files/0x00060000000173b4-53.dat	xmrig
behavioral1/files/0x0006000000017568-68.dat	xmrig
behavioral1/files/0x00050000000186ff-83.dat	xmrig
behavioral1/files/0x0005000000018711-98.dat	xmrig
behavioral1/files/0x00050000000187a2-118.dat	xmrig
behavioral1/files/0x0006000000018bc6-129.dat	xmrig
behavioral1/files/0x0005000000019349-148.dat	xmrig
behavioral1/memory/1704-581-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/2764-591-0x000000013F710000-0x000000013FA64000-memory.dmp	xmrig
behavioral1/memory/2772-597-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/memory/2604-595-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/3052-593-0x000000013F690000-0x000000013F9E4000-memory.dmp	xmrig
behavioral1/memory/2648-589-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/memory/2684-660-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig
behavioral1/memory/2364-706-0x000000013F470000-0x000000013F7C4000-memory.dmp	xmrig
behavioral1/memory/2192-702-0x000000013F570000-0x000000013F8C4000-memory.dmp	xmrig
behavioral1/memory/2532-700-0x000000013FA20000-0x000000013FD74000-memory.dmp	xmrig
behavioral1/memory/2556-689-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2672-680-0x000000013F350000-0x000000013F6A4000-memory.dmp	xmrig
behavioral1/memory/2744-642-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/files/0x00050000000193ee-163.dat	xmrig
behavioral1/files/0x00050000000193d2-158.dat	xmrig
behavioral1/files/0x00050000000193c5-152.dat	xmrig
behavioral1/files/0x00060000000190d6-138.dat	xmrig
behavioral1/files/0x0005000000019296-143.dat	xmrig
behavioral1/files/0x0006000000018bda-133.dat	xmrig
behavioral1/files/0x0006000000018b73-123.dat	xmrig
behavioral1/files/0x000500000001878b-113.dat	xmrig
behavioral1/files/0x0005000000018784-108.dat	xmrig
behavioral1/files/0x000500000001873a-103.dat	xmrig
behavioral1/files/0x000500000001870d-93.dat	xmrig
behavioral1/files/0x0005000000018701-88.dat	xmrig
behavioral1/files/0x00060000000175f4-78.dat	xmrig
behavioral1/files/0x00060000000175e8-73.dat	xmrig
behavioral1/files/0x00060000000173d6-63.dat	xmrig
behavioral1/files/0x00060000000173d3-58.dat	xmrig
behavioral1/files/0x000600000001720f-48.dat	xmrig
behavioral1/files/0x00070000000171ba-43.dat	xmrig
behavioral1/files/0x0008000000016d2b-39.dat	xmrig
behavioral1/files/0x0007000000016d1a-33.dat	xmrig
behavioral1/files/0x0007000000016d05-29.dat	xmrig
behavioral1/files/0x0007000000016cde-24.dat	xmrig
behavioral1/memory/1736-2570-0x000000013F7B0000-0x000000013FB04000-memory.dmp	xmrig
behavioral1/memory/1704-3128-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/1740-4034-0x000000013F730000-0x000000013FA84000-memory.dmp	xmrig
behavioral1/memory/2764-4036-0x000000013F710000-0x000000013FA64000-memory.dmp	xmrig
behavioral1/memory/2604-4038-0x000000013F880000-0x000000013FBD4000-memory.dmp	xmrig
behavioral1/memory/2648-4037-0x000000013F020000-0x000000013F374000-memory.dmp	xmrig
behavioral1/memory/1704-4035-0x000000013F860000-0x000000013FBB4000-memory.dmp	xmrig
behavioral1/memory/2744-4039-0x000000013F410000-0x000000013F764000-memory.dmp	xmrig
behavioral1/memory/2532-4042-0x000000013FA20000-0x000000013FD74000-memory.dmp	xmrig
behavioral1/memory/3052-4041-0x000000013F690000-0x000000013F9E4000-memory.dmp	xmrig
behavioral1/memory/2672-4040-0x000000013F350000-0x000000013F6A4000-memory.dmp	xmrig
behavioral1/memory/2772-4043-0x000000013F9C0000-0x000000013FD14000-memory.dmp	xmrig
behavioral1/memory/2556-4045-0x000000013F270000-0x000000013F5C4000-memory.dmp	xmrig
behavioral1/memory/2192-4046-0x000000013F570000-0x000000013F8C4000-memory.dmp	xmrig
behavioral1/memory/2364-4044-0x000000013F470000-0x000000013F7C4000-memory.dmp	xmrig
behavioral1/memory/2684-4047-0x000000013F8B0000-0x000000013FC04000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1740	rEqKoNS.exe
1704	SYwjsSB.exe
2648	mkEvijU.exe
2764	JwmegoM.exe
3052	IxkQaXa.exe
2604	TuuHZCJ.exe
2772	OdNaXRf.exe
2744	aCRLYkQ.exe
2684	cBvOliI.exe
2672	CsqNJki.exe
2556	uBKSqTA.exe
2532	iVCipew.exe
2192	pZTKSBx.exe
2364	OUriVEY.exe
340	kmoIqQq.exe
1200	QCJNhgm.exe
2796	oKOSVZs.exe
2820	AhkLPie.exe
1000	PdTmFcm.exe
2036	JmispBR.exe
2404	DAQfIrX.exe
2240	JlQVlIH.exe
272	WAlprnf.exe
1940	TuRXpiP.exe
1920	fOjIDLs.exe
1680	BBRzNAW.exe
2092	JfWZwmp.exe
836	kMmVsEq.exe
1764	BdKVxTT.exe
2300	AqPGMoS.exe
2600	bQuHAmC.exe
2116	wYFBGTn.exe
2888	yKMjvSK.exe
2076	VphcbOu.exe
1852	ntKJrLZ.exe
3048	eFWbBtD.exe
644	mvSxebA.exe
1012	fxoRwla.exe
1092	wsLYDTD.exe
2196	AsQnCkz.exe
2156	knMpiPY.exe
1696	whzFlqa.exe
1772	gLuxvhr.exe
2024	FYgPcQU.exe
1384	qWEqfeJ.exe
2104	ZOqGvLs.exe
2064	fUTSbbd.exe
1064	OqzneyL.exe
960	AsuEyOI.exe
564	axZARuq.exe
2068	zjzAxoX.exe
2908	hRFrWTB.exe
792	FxzGVih.exe
1796	HlQtOzJ.exe
1164	FoYuVlJ.exe
2088	bMUePsQ.exe
2436	jPnXrnC.exe
1868	CUrZkHq.exe
2232	brLWNeo.exe
1556	SOvqbIA.exe
1724	AukAaXm.exe
2184	Byeczbt.exe
2728	tCfHvqt.exe
2632	WKeGHgU.exe

Loads dropped DLL 64 IoCs

pid	Process
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-0-0x000000013F7B0000-0x000000013FB04000-memory.dmp	upx
behavioral1/files/0x0010000000012272-3.dat	upx
behavioral1/memory/1740-14-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/files/0x00350000000165d4-13.dat	upx
behavioral1/memory/1736-9-0x0000000001ED0000-0x0000000002224000-memory.dmp	upx
behavioral1/files/0x0008000000016c67-18.dat	upx
behavioral1/files/0x00060000000173b4-53.dat	upx
behavioral1/files/0x0006000000017568-68.dat	upx
behavioral1/files/0x00050000000186ff-83.dat	upx
behavioral1/files/0x0005000000018711-98.dat	upx
behavioral1/files/0x00050000000187a2-118.dat	upx
behavioral1/files/0x0006000000018bc6-129.dat	upx
behavioral1/files/0x0005000000019349-148.dat	upx
behavioral1/memory/1704-581-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/2764-591-0x000000013F710000-0x000000013FA64000-memory.dmp	upx
behavioral1/memory/2772-597-0x000000013F9C0000-0x000000013FD14000-memory.dmp	upx
behavioral1/memory/2604-595-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/3052-593-0x000000013F690000-0x000000013F9E4000-memory.dmp	upx
behavioral1/memory/2648-589-0x000000013F020000-0x000000013F374000-memory.dmp	upx
behavioral1/memory/2684-660-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx
behavioral1/memory/2364-706-0x000000013F470000-0x000000013F7C4000-memory.dmp	upx
behavioral1/memory/2192-702-0x000000013F570000-0x000000013F8C4000-memory.dmp	upx
behavioral1/memory/2532-700-0x000000013FA20000-0x000000013FD74000-memory.dmp	upx
behavioral1/memory/2556-689-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2672-680-0x000000013F350000-0x000000013F6A4000-memory.dmp	upx
behavioral1/memory/2744-642-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/files/0x00050000000193ee-163.dat	upx
behavioral1/files/0x00050000000193d2-158.dat	upx
behavioral1/files/0x00050000000193c5-152.dat	upx
behavioral1/files/0x00060000000190d6-138.dat	upx
behavioral1/files/0x0005000000019296-143.dat	upx
behavioral1/files/0x0006000000018bda-133.dat	upx
behavioral1/files/0x0006000000018b73-123.dat	upx
behavioral1/files/0x000500000001878b-113.dat	upx
behavioral1/files/0x0005000000018784-108.dat	upx
behavioral1/files/0x000500000001873a-103.dat	upx
behavioral1/files/0x000500000001870d-93.dat	upx
behavioral1/files/0x0005000000018701-88.dat	upx
behavioral1/files/0x00060000000175f4-78.dat	upx
behavioral1/files/0x00060000000175e8-73.dat	upx
behavioral1/files/0x00060000000173d6-63.dat	upx
behavioral1/files/0x00060000000173d3-58.dat	upx
behavioral1/files/0x000600000001720f-48.dat	upx
behavioral1/files/0x00070000000171ba-43.dat	upx
behavioral1/files/0x0008000000016d2b-39.dat	upx
behavioral1/files/0x0007000000016d1a-33.dat	upx
behavioral1/files/0x0007000000016d05-29.dat	upx
behavioral1/files/0x0007000000016cde-24.dat	upx
behavioral1/memory/1736-2570-0x000000013F7B0000-0x000000013FB04000-memory.dmp	upx
behavioral1/memory/1704-3128-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/1740-4034-0x000000013F730000-0x000000013FA84000-memory.dmp	upx
behavioral1/memory/2764-4036-0x000000013F710000-0x000000013FA64000-memory.dmp	upx
behavioral1/memory/2604-4038-0x000000013F880000-0x000000013FBD4000-memory.dmp	upx
behavioral1/memory/2648-4037-0x000000013F020000-0x000000013F374000-memory.dmp	upx
behavioral1/memory/1704-4035-0x000000013F860000-0x000000013FBB4000-memory.dmp	upx
behavioral1/memory/2744-4039-0x000000013F410000-0x000000013F764000-memory.dmp	upx
behavioral1/memory/2532-4042-0x000000013FA20000-0x000000013FD74000-memory.dmp	upx
behavioral1/memory/3052-4041-0x000000013F690000-0x000000013F9E4000-memory.dmp	upx
behavioral1/memory/2672-4040-0x000000013F350000-0x000000013F6A4000-memory.dmp	upx
behavioral1/memory/2772-4043-0x000000013F9C0000-0x000000013FD14000-memory.dmp	upx
behavioral1/memory/2556-4045-0x000000013F270000-0x000000013F5C4000-memory.dmp	upx
behavioral1/memory/2192-4046-0x000000013F570000-0x000000013F8C4000-memory.dmp	upx
behavioral1/memory/2364-4044-0x000000013F470000-0x000000013F7C4000-memory.dmp	upx
behavioral1/memory/2684-4047-0x000000013F8B0000-0x000000013FC04000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\izGlXuV.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\lmZJadd.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\TflNpCA.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\fWnXlwU.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\jaTLpzk.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\TxaldCy.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\YeFKgEr.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\EmiXUKb.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\RvBRYiX.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\hKmzsHr.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\HkWxhhP.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\lhfTrnD.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\twhurty.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\NjGbnNV.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\zyBqsjk.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\NOXsKuv.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\WcOyqMV.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\jRBoaIK.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\yECAjLr.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\YlnuBwz.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\DEaBduT.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\vZvpLTn.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\tAFFnBC.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\zKJnTbI.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\Hfmrjtx.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\spdYoRW.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\gtyjpXM.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\FRrpYsX.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\XFtFaIB.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\kxadDFB.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\aZrTcIR.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\QLOHMwo.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\dzjtqvH.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\gQEgdqH.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\TdhdSwx.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\xNNtACC.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\VZEkWBh.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\oRacslb.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\gyLRlEc.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\QSqsuZy.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\BDKVXpP.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\gxsMQUh.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\SHCtoef.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\uBKSqTA.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\ZBOrHtE.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\KdHKuiA.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\FytyvNy.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\LQhcqMd.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\PdwaIrN.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\XLzCDDA.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\kyyyIlH.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\JdHRywa.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\EcPIvFv.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\xwqktPH.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\htIcIWr.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\FsDmfSi.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\ROOfyjU.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\yJULqoB.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\BBHPggz.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\CVbdhFY.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\OvddMnk.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\mgrTJZd.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\OFTnnsh.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
File created	C:\Windows\System\whzFlqa.exe	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1740	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	29
PID 1736 wrote to memory of 1740	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	29
PID 1736 wrote to memory of 1740	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	29
PID 1736 wrote to memory of 1704	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	30
PID 1736 wrote to memory of 1704	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	30
PID 1736 wrote to memory of 1704	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	30
PID 1736 wrote to memory of 2648	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	31
PID 1736 wrote to memory of 2648	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	31
PID 1736 wrote to memory of 2648	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	31
PID 1736 wrote to memory of 2764	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	32
PID 1736 wrote to memory of 2764	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	32
PID 1736 wrote to memory of 2764	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	32
PID 1736 wrote to memory of 3052	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	33
PID 1736 wrote to memory of 3052	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	33
PID 1736 wrote to memory of 3052	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	33
PID 1736 wrote to memory of 2604	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	34
PID 1736 wrote to memory of 2604	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	34
PID 1736 wrote to memory of 2604	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	34
PID 1736 wrote to memory of 2772	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	35
PID 1736 wrote to memory of 2772	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	35
PID 1736 wrote to memory of 2772	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	35
PID 1736 wrote to memory of 2744	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	36
PID 1736 wrote to memory of 2744	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	36
PID 1736 wrote to memory of 2744	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	36
PID 1736 wrote to memory of 2684	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	37
PID 1736 wrote to memory of 2684	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	37
PID 1736 wrote to memory of 2684	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	37
PID 1736 wrote to memory of 2672	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	38
PID 1736 wrote to memory of 2672	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	38
PID 1736 wrote to memory of 2672	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	38
PID 1736 wrote to memory of 2556	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	39
PID 1736 wrote to memory of 2556	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	39
PID 1736 wrote to memory of 2556	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	39
PID 1736 wrote to memory of 2532	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	40
PID 1736 wrote to memory of 2532	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	40
PID 1736 wrote to memory of 2532	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	40
PID 1736 wrote to memory of 2192	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	41
PID 1736 wrote to memory of 2192	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	41
PID 1736 wrote to memory of 2192	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	41
PID 1736 wrote to memory of 2364	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	42
PID 1736 wrote to memory of 2364	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	42
PID 1736 wrote to memory of 2364	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	42
PID 1736 wrote to memory of 340	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	43
PID 1736 wrote to memory of 340	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	43
PID 1736 wrote to memory of 340	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	43
PID 1736 wrote to memory of 1200	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	44
PID 1736 wrote to memory of 1200	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	44
PID 1736 wrote to memory of 1200	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	44
PID 1736 wrote to memory of 2796	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	45
PID 1736 wrote to memory of 2796	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	45
PID 1736 wrote to memory of 2796	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	45
PID 1736 wrote to memory of 2820	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	46
PID 1736 wrote to memory of 2820	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	46
PID 1736 wrote to memory of 2820	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	46
PID 1736 wrote to memory of 1000	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	47
PID 1736 wrote to memory of 1000	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	47
PID 1736 wrote to memory of 1000	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	47
PID 1736 wrote to memory of 2036	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	48
PID 1736 wrote to memory of 2036	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	48
PID 1736 wrote to memory of 2036	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	48
PID 1736 wrote to memory of 2404	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	49
PID 1736 wrote to memory of 2404	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	49
PID 1736 wrote to memory of 2404	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	49
PID 1736 wrote to memory of 2240	1736	59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\59469d3c92aa6420cc7d1c2db876d620_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\System\rEqKoNS.exe
  C:\Windows\System\rEqKoNS.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\SYwjsSB.exe
  C:\Windows\System\SYwjsSB.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\mkEvijU.exe
  C:\Windows\System\mkEvijU.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\JwmegoM.exe
  C:\Windows\System\JwmegoM.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\IxkQaXa.exe
  C:\Windows\System\IxkQaXa.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\TuuHZCJ.exe
  C:\Windows\System\TuuHZCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\OdNaXRf.exe
  C:\Windows\System\OdNaXRf.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\aCRLYkQ.exe
  C:\Windows\System\aCRLYkQ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\cBvOliI.exe
  C:\Windows\System\cBvOliI.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\CsqNJki.exe
  C:\Windows\System\CsqNJki.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\uBKSqTA.exe
  C:\Windows\System\uBKSqTA.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\iVCipew.exe
  C:\Windows\System\iVCipew.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\pZTKSBx.exe
  C:\Windows\System\pZTKSBx.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\OUriVEY.exe
  C:\Windows\System\OUriVEY.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\kmoIqQq.exe
  C:\Windows\System\kmoIqQq.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\QCJNhgm.exe
  C:\Windows\System\QCJNhgm.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\oKOSVZs.exe
  C:\Windows\System\oKOSVZs.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\AhkLPie.exe
  C:\Windows\System\AhkLPie.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\PdTmFcm.exe
  C:\Windows\System\PdTmFcm.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\JmispBR.exe
  C:\Windows\System\JmispBR.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\DAQfIrX.exe
  C:\Windows\System\DAQfIrX.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\JlQVlIH.exe
  C:\Windows\System\JlQVlIH.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\WAlprnf.exe
  C:\Windows\System\WAlprnf.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\TuRXpiP.exe
  C:\Windows\System\TuRXpiP.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\fOjIDLs.exe
  C:\Windows\System\fOjIDLs.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\BBRzNAW.exe
  C:\Windows\System\BBRzNAW.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\JfWZwmp.exe
  C:\Windows\System\JfWZwmp.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\kMmVsEq.exe
  C:\Windows\System\kMmVsEq.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\BdKVxTT.exe
  C:\Windows\System\BdKVxTT.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\AqPGMoS.exe
  C:\Windows\System\AqPGMoS.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\bQuHAmC.exe
  C:\Windows\System\bQuHAmC.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\wYFBGTn.exe
  C:\Windows\System\wYFBGTn.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\yKMjvSK.exe
  C:\Windows\System\yKMjvSK.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\VphcbOu.exe
  C:\Windows\System\VphcbOu.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\ntKJrLZ.exe
  C:\Windows\System\ntKJrLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\eFWbBtD.exe
  C:\Windows\System\eFWbBtD.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\mvSxebA.exe
  C:\Windows\System\mvSxebA.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\fxoRwla.exe
  C:\Windows\System\fxoRwla.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\wsLYDTD.exe
  C:\Windows\System\wsLYDTD.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\AsQnCkz.exe
  C:\Windows\System\AsQnCkz.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\knMpiPY.exe
  C:\Windows\System\knMpiPY.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\whzFlqa.exe
  C:\Windows\System\whzFlqa.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\gLuxvhr.exe
  C:\Windows\System\gLuxvhr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\FYgPcQU.exe
  C:\Windows\System\FYgPcQU.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\qWEqfeJ.exe
  C:\Windows\System\qWEqfeJ.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\ZOqGvLs.exe
  C:\Windows\System\ZOqGvLs.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\fUTSbbd.exe
  C:\Windows\System\fUTSbbd.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\OqzneyL.exe
  C:\Windows\System\OqzneyL.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\AsuEyOI.exe
  C:\Windows\System\AsuEyOI.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\axZARuq.exe
  C:\Windows\System\axZARuq.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\zjzAxoX.exe
  C:\Windows\System\zjzAxoX.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\hRFrWTB.exe
  C:\Windows\System\hRFrWTB.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\FxzGVih.exe
  C:\Windows\System\FxzGVih.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\HlQtOzJ.exe
  C:\Windows\System\HlQtOzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\FoYuVlJ.exe
  C:\Windows\System\FoYuVlJ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\bMUePsQ.exe
  C:\Windows\System\bMUePsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\jPnXrnC.exe
  C:\Windows\System\jPnXrnC.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\CUrZkHq.exe
  C:\Windows\System\CUrZkHq.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\brLWNeo.exe
  C:\Windows\System\brLWNeo.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\SOvqbIA.exe
  C:\Windows\System\SOvqbIA.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\AukAaXm.exe
  C:\Windows\System\AukAaXm.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\Byeczbt.exe
  C:\Windows\System\Byeczbt.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\tCfHvqt.exe
  C:\Windows\System\tCfHvqt.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\WKeGHgU.exe
  C:\Windows\System\WKeGHgU.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\uiTRTHI.exe
  C:\Windows\System\uiTRTHI.exe
  2⤵
  PID:2392
- C:\Windows\System\LaHJtGB.exe
  C:\Windows\System\LaHJtGB.exe
  2⤵
  PID:2856
- C:\Windows\System\eTyfGax.exe
  C:\Windows\System\eTyfGax.exe
  2⤵
  PID:2664
- C:\Windows\System\ctIcBuP.exe
  C:\Windows\System\ctIcBuP.exe
  2⤵
  PID:2520
- C:\Windows\System\lZYXIqQ.exe
  C:\Windows\System\lZYXIqQ.exe
  2⤵
  PID:2344
- C:\Windows\System\sGrcodB.exe
  C:\Windows\System\sGrcodB.exe
  2⤵
  PID:1760
- C:\Windows\System\fxFSgJE.exe
  C:\Windows\System\fxFSgJE.exe
  2⤵
  PID:1916
- C:\Windows\System\mMXgWkJ.exe
  C:\Windows\System\mMXgWkJ.exe
  2⤵
  PID:2808
- C:\Windows\System\QZzNCWM.exe
  C:\Windows\System\QZzNCWM.exe
  2⤵
  PID:2220
- C:\Windows\System\JjDtNgP.exe
  C:\Windows\System\JjDtNgP.exe
  2⤵
  PID:1028
- C:\Windows\System\toDGWuM.exe
  C:\Windows\System\toDGWuM.exe
  2⤵
  PID:2164
- C:\Windows\System\pHpTJNG.exe
  C:\Windows\System\pHpTJNG.exe
  2⤵
  PID:2236
- C:\Windows\System\JEyprSf.exe
  C:\Windows\System\JEyprSf.exe
  2⤵
  PID:1604
- C:\Windows\System\EQDHZjO.exe
  C:\Windows\System\EQDHZjO.exe
  2⤵
  PID:1436
- C:\Windows\System\haheACj.exe
  C:\Windows\System\haheACj.exe
  2⤵
  PID:2304
- C:\Windows\System\DfdVyFv.exe
  C:\Windows\System\DfdVyFv.exe
  2⤵
  PID:2284
- C:\Windows\System\RHRSIax.exe
  C:\Windows\System\RHRSIax.exe
  2⤵
  PID:1100
- C:\Windows\System\otuqMLO.exe
  C:\Windows\System\otuqMLO.exe
  2⤵
  PID:2144
- C:\Windows\System\MImkbpB.exe
  C:\Windows\System\MImkbpB.exe
  2⤵
  PID:1776
- C:\Windows\System\FAIhrPl.exe
  C:\Windows\System\FAIhrPl.exe
  2⤵
  PID:2432
- C:\Windows\System\HkWxhhP.exe
  C:\Windows\System\HkWxhhP.exe
  2⤵
  PID:1144
- C:\Windows\System\ZgDsHxD.exe
  C:\Windows\System\ZgDsHxD.exe
  2⤵
  PID:1288
- C:\Windows\System\XZkItRr.exe
  C:\Windows\System\XZkItRr.exe
  2⤵
  PID:996
- C:\Windows\System\reBIkiv.exe
  C:\Windows\System\reBIkiv.exe
  2⤵
  PID:1356
- C:\Windows\System\jNzVFCY.exe
  C:\Windows\System\jNzVFCY.exe
  2⤵
  PID:1060
- C:\Windows\System\ozCtFNn.exe
  C:\Windows\System\ozCtFNn.exe
  2⤵
  PID:1300
- C:\Windows\System\MtHGRlp.exe
  C:\Windows\System\MtHGRlp.exe
  2⤵
  PID:980
- C:\Windows\System\TflNpCA.exe
  C:\Windows\System\TflNpCA.exe
  2⤵
  PID:2032
- C:\Windows\System\VZEkWBh.exe
  C:\Windows\System\VZEkWBh.exe
  2⤵
  PID:2912
- C:\Windows\System\GzOpgJA.exe
  C:\Windows\System\GzOpgJA.exe
  2⤵
  PID:1784
- C:\Windows\System\kfewlqa.exe
  C:\Windows\System\kfewlqa.exe
  2⤵
  PID:896
- C:\Windows\System\JdHRywa.exe
  C:\Windows\System\JdHRywa.exe
  2⤵
  PID:1624
- C:\Windows\System\oQjzjGY.exe
  C:\Windows\System\oQjzjGY.exe
  2⤵
  PID:1308
- C:\Windows\System\PZPxydP.exe
  C:\Windows\System\PZPxydP.exe
  2⤵
  PID:2100
- C:\Windows\System\fWnXlwU.exe
  C:\Windows\System\fWnXlwU.exe
  2⤵
  PID:2712
- C:\Windows\System\tPjWjxB.exe
  C:\Windows\System\tPjWjxB.exe
  2⤵
  PID:2628
- C:\Windows\System\eaYQcDE.exe
  C:\Windows\System\eaYQcDE.exe
  2⤵
  PID:2468
- C:\Windows\System\gmDbfCK.exe
  C:\Windows\System\gmDbfCK.exe
  2⤵
  PID:2564
- C:\Windows\System\vQoQnCh.exe
  C:\Windows\System\vQoQnCh.exe
  2⤵
  PID:2992
- C:\Windows\System\ZQyyPiw.exe
  C:\Windows\System\ZQyyPiw.exe
  2⤵
  PID:1668
- C:\Windows\System\vRpHyKu.exe
  C:\Windows\System\vRpHyKu.exe
  2⤵
  PID:1968
- C:\Windows\System\yzuBNDi.exe
  C:\Windows\System\yzuBNDi.exe
  2⤵
  PID:1224
- C:\Windows\System\aldyswx.exe
  C:\Windows\System\aldyswx.exe
  2⤵
  PID:1748
- C:\Windows\System\KcXXPqw.exe
  C:\Windows\System\KcXXPqw.exe
  2⤵
  PID:568
- C:\Windows\System\zeOEqOg.exe
  C:\Windows\System\zeOEqOg.exe
  2⤵
  PID:2380
- C:\Windows\System\tOOROBP.exe
  C:\Windows\System\tOOROBP.exe
  2⤵
  PID:2188
- C:\Windows\System\UMPJGrF.exe
  C:\Windows\System\UMPJGrF.exe
  2⤵
  PID:2000
- C:\Windows\System\PGcneVa.exe
  C:\Windows\System\PGcneVa.exe
  2⤵
  PID:2916
- C:\Windows\System\tuHZuwI.exe
  C:\Windows\System\tuHZuwI.exe
  2⤵
  PID:408
- C:\Windows\System\ajuBwZC.exe
  C:\Windows\System\ajuBwZC.exe
  2⤵
  PID:1532
- C:\Windows\System\VMAsGsH.exe
  C:\Windows\System\VMAsGsH.exe
  2⤵
  PID:956
- C:\Windows\System\VoKtZyM.exe
  C:\Windows\System\VoKtZyM.exe
  2⤵
  PID:3028
- C:\Windows\System\EBLsxxA.exe
  C:\Windows\System\EBLsxxA.exe
  2⤵
  PID:1348
- C:\Windows\System\KVdttSw.exe
  C:\Windows\System\KVdttSw.exe
  2⤵
  PID:1364
- C:\Windows\System\sgjcSSX.exe
  C:\Windows\System\sgjcSSX.exe
  2⤵
  PID:1688
- C:\Windows\System\YCUKLfQ.exe
  C:\Windows\System\YCUKLfQ.exe
  2⤵
  PID:1708
- C:\Windows\System\BBHPggz.exe
  C:\Windows\System\BBHPggz.exe
  2⤵
  PID:2608
- C:\Windows\System\YFpHNdt.exe
  C:\Windows\System\YFpHNdt.exe
  2⤵
  PID:2496
- C:\Windows\System\NJqHamK.exe
  C:\Windows\System\NJqHamK.exe
  2⤵
  PID:1692
- C:\Windows\System\PDFWeFH.exe
  C:\Windows\System\PDFWeFH.exe
  2⤵
  PID:2708
- C:\Windows\System\pIJCIzg.exe
  C:\Windows\System\pIJCIzg.exe
  2⤵
  PID:1276
- C:\Windows\System\ZyhCTcY.exe
  C:\Windows\System\ZyhCTcY.exe
  2⤵
  PID:1492
- C:\Windows\System\BSVRKjY.exe
  C:\Windows\System\BSVRKjY.exe
  2⤵
  PID:3088
- C:\Windows\System\hrxleOZ.exe
  C:\Windows\System\hrxleOZ.exe
  2⤵
  PID:3112
- C:\Windows\System\XRkhQxN.exe
  C:\Windows\System\XRkhQxN.exe
  2⤵
  PID:3132
- C:\Windows\System\todoCLP.exe
  C:\Windows\System\todoCLP.exe
  2⤵
  PID:3152
- C:\Windows\System\WxKmrGw.exe
  C:\Windows\System\WxKmrGw.exe
  2⤵
  PID:3180
- C:\Windows\System\nzCoHMM.exe
  C:\Windows\System\nzCoHMM.exe
  2⤵
  PID:3200
- C:\Windows\System\BXMupui.exe
  C:\Windows\System\BXMupui.exe
  2⤵
  PID:3216
- C:\Windows\System\hYYrBTh.exe
  C:\Windows\System\hYYrBTh.exe
  2⤵
  PID:3240
- C:\Windows\System\gvedwHX.exe
  C:\Windows\System\gvedwHX.exe
  2⤵
  PID:3260
- C:\Windows\System\kCUhUun.exe
  C:\Windows\System\kCUhUun.exe
  2⤵
  PID:3276
- C:\Windows\System\UhQyeIe.exe
  C:\Windows\System\UhQyeIe.exe
  2⤵
  PID:3296
- C:\Windows\System\aZnqAmI.exe
  C:\Windows\System\aZnqAmI.exe
  2⤵
  PID:3312
- C:\Windows\System\tOTLnds.exe
  C:\Windows\System\tOTLnds.exe
  2⤵
  PID:3328
- C:\Windows\System\oexbPbj.exe
  C:\Windows\System\oexbPbj.exe
  2⤵
  PID:3348
- C:\Windows\System\UxsJTUX.exe
  C:\Windows\System\UxsJTUX.exe
  2⤵
  PID:3368
- C:\Windows\System\yebpztC.exe
  C:\Windows\System\yebpztC.exe
  2⤵
  PID:3384
- C:\Windows\System\SPUjYzq.exe
  C:\Windows\System\SPUjYzq.exe
  2⤵
  PID:3412
- C:\Windows\System\XbrNWgQ.exe
  C:\Windows\System\XbrNWgQ.exe
  2⤵
  PID:3428
- C:\Windows\System\JVIwcKg.exe
  C:\Windows\System\JVIwcKg.exe
  2⤵
  PID:3452
- C:\Windows\System\poyxNkT.exe
  C:\Windows\System\poyxNkT.exe
  2⤵
  PID:3472
- C:\Windows\System\iKflprN.exe
  C:\Windows\System\iKflprN.exe
  2⤵
  PID:3492
- C:\Windows\System\JUSYTIj.exe
  C:\Windows\System\JUSYTIj.exe
  2⤵
  PID:3508
- C:\Windows\System\tHrbBhk.exe
  C:\Windows\System\tHrbBhk.exe
  2⤵
  PID:3528
- C:\Windows\System\QhToDZd.exe
  C:\Windows\System\QhToDZd.exe
  2⤵
  PID:3548
- C:\Windows\System\kToJVmJ.exe
  C:\Windows\System\kToJVmJ.exe
  2⤵
  PID:3584
- C:\Windows\System\sSFyqIQ.exe
  C:\Windows\System\sSFyqIQ.exe
  2⤵
  PID:3604
- C:\Windows\System\PiTJpbr.exe
  C:\Windows\System\PiTJpbr.exe
  2⤵
  PID:3624
- C:\Windows\System\JvVvaUp.exe
  C:\Windows\System\JvVvaUp.exe
  2⤵
  PID:3644
- C:\Windows\System\JqrMfKS.exe
  C:\Windows\System\JqrMfKS.exe
  2⤵
  PID:3668
- C:\Windows\System\qmIvvKU.exe
  C:\Windows\System\qmIvvKU.exe
  2⤵
  PID:3688
- C:\Windows\System\KVZYHfw.exe
  C:\Windows\System\KVZYHfw.exe
  2⤵
  PID:3708
- C:\Windows\System\AlBWLqM.exe
  C:\Windows\System\AlBWLqM.exe
  2⤵
  PID:3728
- C:\Windows\System\MsaacZr.exe
  C:\Windows\System\MsaacZr.exe
  2⤵
  PID:3748
- C:\Windows\System\HmfAZeq.exe
  C:\Windows\System\HmfAZeq.exe
  2⤵
  PID:3768
- C:\Windows\System\RgiUAZc.exe
  C:\Windows\System\RgiUAZc.exe
  2⤵
  PID:3788
- C:\Windows\System\ikkmgxV.exe
  C:\Windows\System\ikkmgxV.exe
  2⤵
  PID:3804
- C:\Windows\System\kdjcPjq.exe
  C:\Windows\System\kdjcPjq.exe
  2⤵
  PID:3824
- C:\Windows\System\EmvnFgB.exe
  C:\Windows\System\EmvnFgB.exe
  2⤵
  PID:3844
- C:\Windows\System\MQMDdrR.exe
  C:\Windows\System\MQMDdrR.exe
  2⤵
  PID:3864
- C:\Windows\System\UgXzBdF.exe
  C:\Windows\System\UgXzBdF.exe
  2⤵
  PID:3880
- C:\Windows\System\xwlFhAV.exe
  C:\Windows\System\xwlFhAV.exe
  2⤵
  PID:3900
- C:\Windows\System\cPGRrSK.exe
  C:\Windows\System\cPGRrSK.exe
  2⤵
  PID:3920
- C:\Windows\System\cMGvIwW.exe
  C:\Windows\System\cMGvIwW.exe
  2⤵
  PID:3940
- C:\Windows\System\FJOWgpa.exe
  C:\Windows\System\FJOWgpa.exe
  2⤵
  PID:3956
- C:\Windows\System\aHeaIws.exe
  C:\Windows\System\aHeaIws.exe
  2⤵
  PID:3976
- C:\Windows\System\mWHSEfS.exe
  C:\Windows\System\mWHSEfS.exe
  2⤵
  PID:3992
- C:\Windows\System\eVbtQCg.exe
  C:\Windows\System\eVbtQCg.exe
  2⤵
  PID:4012
- C:\Windows\System\ZGDzjil.exe
  C:\Windows\System\ZGDzjil.exe
  2⤵
  PID:4028
- C:\Windows\System\dewXGyj.exe
  C:\Windows\System\dewXGyj.exe
  2⤵
  PID:4044
- C:\Windows\System\yJULqoB.exe
  C:\Windows\System\yJULqoB.exe
  2⤵
  PID:4060
- C:\Windows\System\itlgXWL.exe
  C:\Windows\System\itlgXWL.exe
  2⤵
  PID:1720
- C:\Windows\System\YMaWuBX.exe
  C:\Windows\System\YMaWuBX.exe
  2⤵
  PID:304
- C:\Windows\System\ILpbOYD.exe
  C:\Windows\System\ILpbOYD.exe
  2⤵
  PID:1324
- C:\Windows\System\hgrutlJ.exe
  C:\Windows\System\hgrutlJ.exe
  2⤵
  PID:1072
- C:\Windows\System\VsJChhH.exe
  C:\Windows\System\VsJChhH.exe
  2⤵
  PID:3080
- C:\Windows\System\WmnmiPa.exe
  C:\Windows\System\WmnmiPa.exe
  2⤵
  PID:592
- C:\Windows\System\jxLTEzL.exe
  C:\Windows\System\jxLTEzL.exe
  2⤵
  PID:3172
- C:\Windows\System\yrvJjrl.exe
  C:\Windows\System\yrvJjrl.exe
  2⤵
  PID:1640
- C:\Windows\System\yMEqzNb.exe
  C:\Windows\System\yMEqzNb.exe
  2⤵
  PID:3256
- C:\Windows\System\wlWdloO.exe
  C:\Windows\System\wlWdloO.exe
  2⤵
  PID:1896
- C:\Windows\System\NNKljLV.exe
  C:\Windows\System\NNKljLV.exe
  2⤵
  PID:3292
- C:\Windows\System\rRlPvZB.exe
  C:\Windows\System\rRlPvZB.exe
  2⤵
  PID:108
- C:\Windows\System\wZUvPIL.exe
  C:\Windows\System\wZUvPIL.exe
  2⤵
  PID:3324
- C:\Windows\System\JaBywAd.exe
  C:\Windows\System\JaBywAd.exe
  2⤵
  PID:1576
- C:\Windows\System\RYYwarp.exe
  C:\Windows\System\RYYwarp.exe
  2⤵
  PID:3404
- C:\Windows\System\erCRNMf.exe
  C:\Windows\System\erCRNMf.exe
  2⤵
  PID:3444
- C:\Windows\System\ZtGgfKY.exe
  C:\Windows\System\ZtGgfKY.exe
  2⤵
  PID:3484
- C:\Windows\System\RsljGeJ.exe
  C:\Windows\System\RsljGeJ.exe
  2⤵
  PID:3140
- C:\Windows\System\lqFuGDf.exe
  C:\Windows\System\lqFuGDf.exe
  2⤵
  PID:2640
- C:\Windows\System\mLeuyYI.exe
  C:\Windows\System\mLeuyYI.exe
  2⤵
  PID:2552
- C:\Windows\System\iVdhPbO.exe
  C:\Windows\System\iVdhPbO.exe
  2⤵
  PID:2720
- C:\Windows\System\dyuwDgn.exe
  C:\Windows\System\dyuwDgn.exe
  2⤵
  PID:3224
- C:\Windows\System\kOMlBdA.exe
  C:\Windows\System\kOMlBdA.exe
  2⤵
  PID:2704
- C:\Windows\System\kvMaOkl.exe
  C:\Windows\System\kvMaOkl.exe
  2⤵
  PID:3308
- C:\Windows\System\ovuGLOo.exe
  C:\Windows\System\ovuGLOo.exe
  2⤵
  PID:3556
- C:\Windows\System\UehXbIz.exe
  C:\Windows\System\UehXbIz.exe
  2⤵
  PID:3420
- C:\Windows\System\MwawPGB.exe
  C:\Windows\System\MwawPGB.exe
  2⤵
  PID:3500
- C:\Windows\System\eHipujm.exe
  C:\Windows\System\eHipujm.exe
  2⤵
  PID:3376
- C:\Windows\System\HOAYkMv.exe
  C:\Windows\System\HOAYkMv.exe
  2⤵
  PID:3612
- C:\Windows\System\XZYmCBG.exe
  C:\Windows\System\XZYmCBG.exe
  2⤵
  PID:3600
- C:\Windows\System\fCbKBLI.exe
  C:\Windows\System\fCbKBLI.exe
  2⤵
  PID:3820
- C:\Windows\System\cCoayQC.exe
  C:\Windows\System\cCoayQC.exe
  2⤵
  PID:3888
- C:\Windows\System\GFIMqci.exe
  C:\Windows\System\GFIMqci.exe
  2⤵
  PID:3964
- C:\Windows\System\seNktXQ.exe
  C:\Windows\System\seNktXQ.exe
  2⤵
  PID:3800
- C:\Windows\System\yPyLfbF.exe
  C:\Windows\System\yPyLfbF.exe
  2⤵
  PID:3760
- C:\Windows\System\VhOusdL.exe
  C:\Windows\System\VhOusdL.exe
  2⤵
  PID:4020
- C:\Windows\System\cGOFVdR.exe
  C:\Windows\System\cGOFVdR.exe
  2⤵
  PID:1496
- C:\Windows\System\DbbPdIa.exe
  C:\Windows\System\DbbPdIa.exe
  2⤵
  PID:3948
- C:\Windows\System\dyZMyia.exe
  C:\Windows\System\dyZMyia.exe
  2⤵
  PID:2636
- C:\Windows\System\PUHTrut.exe
  C:\Windows\System\PUHTrut.exe
  2⤵
  PID:4040
- C:\Windows\System\rsYPGnk.exe
  C:\Windows\System\rsYPGnk.exe
  2⤵
  PID:1564
- C:\Windows\System\QDnJurz.exe
  C:\Windows\System\QDnJurz.exe
  2⤵
  PID:1296
- C:\Windows\System\AuVagsT.exe
  C:\Windows\System\AuVagsT.exe
  2⤵
  PID:840
- C:\Windows\System\kLUoDur.exe
  C:\Windows\System\kLUoDur.exe
  2⤵
  PID:2136
- C:\Windows\System\WfUXbTb.exe
  C:\Windows\System\WfUXbTb.exe
  2⤵
  PID:2324
- C:\Windows\System\mghtzFn.exe
  C:\Windows\System\mghtzFn.exe
  2⤵
  PID:2384
- C:\Windows\System\PigHNfw.exe
  C:\Windows\System\PigHNfw.exe
  2⤵
  PID:2268
- C:\Windows\System\PNmkIlu.exe
  C:\Windows\System\PNmkIlu.exe
  2⤵
  PID:1600
- C:\Windows\System\iErQYEy.exe
  C:\Windows\System\iErQYEy.exe
  2⤵
  PID:2612
- C:\Windows\System\euIjSyD.exe
  C:\Windows\System\euIjSyD.exe
  2⤵
  PID:1316
- C:\Windows\System\kUtWlHy.exe
  C:\Windows\System\kUtWlHy.exe
  2⤵
  PID:2816
- C:\Windows\System\CapauqU.exe
  C:\Windows\System\CapauqU.exe
  2⤵
  PID:2840
- C:\Windows\System\olPeuJL.exe
  C:\Windows\System\olPeuJL.exe
  2⤵
  PID:3164
- C:\Windows\System\gzbRwkO.exe
  C:\Windows\System\gzbRwkO.exe
  2⤵
  PID:3248
- C:\Windows\System\cyCVFtU.exe
  C:\Windows\System\cyCVFtU.exe
  2⤵
  PID:3064
- C:\Windows\System\AtpwKfA.exe
  C:\Windows\System\AtpwKfA.exe
  2⤵
  PID:3284
- C:\Windows\System\aQoVwmY.exe
  C:\Windows\System\aQoVwmY.exe
  2⤵
  PID:3364
- C:\Windows\System\KNiHfky.exe
  C:\Windows\System\KNiHfky.exe
  2⤵
  PID:3396
- C:\Windows\System\LgCnMVP.exe
  C:\Windows\System\LgCnMVP.exe
  2⤵
  PID:3096
- C:\Windows\System\WNozeHz.exe
  C:\Windows\System\WNozeHz.exe
  2⤵
  PID:3108
- C:\Windows\System\XbnCOMg.exe
  C:\Windows\System\XbnCOMg.exe
  2⤵
  PID:2572
- C:\Windows\System\YvICFaZ.exe
  C:\Windows\System\YvICFaZ.exe
  2⤵
  PID:3340
- C:\Windows\System\FJZoRMA.exe
  C:\Windows\System\FJZoRMA.exe
  2⤵
  PID:3664
- C:\Windows\System\iQOQuka.exe
  C:\Windows\System\iQOQuka.exe
  2⤵
  PID:3696
- C:\Windows\System\KdHKuiA.exe
  C:\Windows\System\KdHKuiA.exe
  2⤵
  PID:3780
- C:\Windows\System\cjsvMmB.exe
  C:\Windows\System\cjsvMmB.exe
  2⤵
  PID:3272
- C:\Windows\System\kqUHNWn.exe
  C:\Windows\System\kqUHNWn.exe
  2⤵
  PID:3424
- C:\Windows\System\waQMnfN.exe
  C:\Windows\System\waQMnfN.exe
  2⤵
  PID:3852
- C:\Windows\System\btacpyL.exe
  C:\Windows\System\btacpyL.exe
  2⤵
  PID:3860
- C:\Windows\System\BAOqYXK.exe
  C:\Windows\System\BAOqYXK.exe
  2⤵
  PID:3796
- C:\Windows\System\BXEmALl.exe
  C:\Windows\System\BXEmALl.exe
  2⤵
  PID:4052
- C:\Windows\System\yzQwaBn.exe
  C:\Windows\System\yzQwaBn.exe
  2⤵
  PID:2948
- C:\Windows\System\ExxHLVt.exe
  C:\Windows\System\ExxHLVt.exe
  2⤵
  PID:4068
- C:\Windows\System\pVJrFxS.exe
  C:\Windows\System\pVJrFxS.exe
  2⤵
  PID:2776
- C:\Windows\System\rBKHwdM.exe
  C:\Windows\System\rBKHwdM.exe
  2⤵
  PID:2644
- C:\Windows\System\TwpPWIF.exe
  C:\Windows\System\TwpPWIF.exe
  2⤵
  PID:2932
- C:\Windows\System\AxzUJnT.exe
  C:\Windows\System\AxzUJnT.exe
  2⤵
  PID:1032
- C:\Windows\System\wAFobrN.exe
  C:\Windows\System\wAFobrN.exe
  2⤵
  PID:1620
- C:\Windows\System\IqMurTA.exe
  C:\Windows\System\IqMurTA.exe
  2⤵
  PID:1912
- C:\Windows\System\ZniIUgW.exe
  C:\Windows\System\ZniIUgW.exe
  2⤵
  PID:2488
- C:\Windows\System\eOItnDu.exe
  C:\Windows\System\eOItnDu.exe
  2⤵
  PID:3084
- C:\Windows\System\CEALOJL.exe
  C:\Windows\System\CEALOJL.exe
  2⤵
  PID:616
- C:\Windows\System\pfjlapz.exe
  C:\Windows\System\pfjlapz.exe
  2⤵
  PID:2804
- C:\Windows\System\ovpmoAO.exe
  C:\Windows\System\ovpmoAO.exe
  2⤵
  PID:992
- C:\Windows\System\kxadDFB.exe
  C:\Windows\System\kxadDFB.exe
  2⤵
  PID:2052
- C:\Windows\System\BCVjfNc.exe
  C:\Windows\System\BCVjfNc.exe
  2⤵
  PID:3100
- C:\Windows\System\EjhAfKJ.exe
  C:\Windows\System\EjhAfKJ.exe
  2⤵
  PID:3576
- C:\Windows\System\huOkfAQ.exe
  C:\Windows\System\huOkfAQ.exe
  2⤵
  PID:3740
- C:\Windows\System\PRJPxPg.exe
  C:\Windows\System\PRJPxPg.exe
  2⤵
  PID:3572
- C:\Windows\System\jiSwGfO.exe
  C:\Windows\System\jiSwGfO.exe
  2⤵
  PID:3936
- C:\Windows\System\swrlazP.exe
  C:\Windows\System\swrlazP.exe
  2⤵
  PID:3656
- C:\Windows\System\oATpoTE.exe
  C:\Windows\System\oATpoTE.exe
  2⤵
  PID:3968
- C:\Windows\System\VqrkwsQ.exe
  C:\Windows\System\VqrkwsQ.exe
  2⤵
  PID:3876
- C:\Windows\System\oRacslb.exe
  C:\Windows\System\oRacslb.exe
  2⤵
  PID:4004
- C:\Windows\System\bhrHMzA.exe
  C:\Windows\System\bhrHMzA.exe
  2⤵
  PID:2464
- C:\Windows\System\nsjaVNB.exe
  C:\Windows\System\nsjaVNB.exe
  2⤵
  PID:3024
- C:\Windows\System\uplauGa.exe
  C:\Windows\System\uplauGa.exe
  2⤵
  PID:2812
- C:\Windows\System\xnKrJXi.exe
  C:\Windows\System\xnKrJXi.exe
  2⤵
  PID:2056
- C:\Windows\System\zftQoTq.exe
  C:\Windows\System\zftQoTq.exe
  2⤵
  PID:2920
- C:\Windows\System\sDSpGwq.exe
  C:\Windows\System\sDSpGwq.exe
  2⤵
  PID:2748
- C:\Windows\System\xnMfRGz.exe
  C:\Windows\System\xnMfRGz.exe
  2⤵
  PID:3544
- C:\Windows\System\aCgswqZ.exe
  C:\Windows\System\aCgswqZ.exe
  2⤵
  PID:1268
- C:\Windows\System\FXGdhCG.exe
  C:\Windows\System\FXGdhCG.exe
  2⤵
  PID:3564
- C:\Windows\System\sOggwCD.exe
  C:\Windows\System\sOggwCD.exe
  2⤵
  PID:3596
- C:\Windows\System\SvWutTX.exe
  C:\Windows\System\SvWutTX.exe
  2⤵
  PID:1828
- C:\Windows\System\sCDLhoG.exe
  C:\Windows\System\sCDLhoG.exe
  2⤵
  PID:3916
- C:\Windows\System\ZxKMgnh.exe
  C:\Windows\System\ZxKMgnh.exe
  2⤵
  PID:4092
- C:\Windows\System\qxszhoR.exe
  C:\Windows\System\qxszhoR.exe
  2⤵
  PID:4080
- C:\Windows\System\DFtHvYj.exe
  C:\Windows\System\DFtHvYj.exe
  2⤵
  PID:572
- C:\Windows\System\bBOqYYs.exe
  C:\Windows\System\bBOqYYs.exe
  2⤵
  PID:1508
- C:\Windows\System\PYeNIgb.exe
  C:\Windows\System\PYeNIgb.exe
  2⤵
  PID:3436
- C:\Windows\System\lMHbetD.exe
  C:\Windows\System\lMHbetD.exe
  2⤵
  PID:3344
- C:\Windows\System\zSbuFqg.exe
  C:\Windows\System\zSbuFqg.exe
  2⤵
  PID:2452
- C:\Windows\System\ELOJQca.exe
  C:\Windows\System\ELOJQca.exe
  2⤵
  PID:3616
- C:\Windows\System\ZSesmzi.exe
  C:\Windows\System\ZSesmzi.exe
  2⤵
  PID:3984
- C:\Windows\System\sTTfUrW.exe
  C:\Windows\System\sTTfUrW.exe
  2⤵
  PID:2316
- C:\Windows\System\edRJDgN.exe
  C:\Windows\System\edRJDgN.exe
  2⤵
  PID:920
- C:\Windows\System\cDUGoOa.exe
  C:\Windows\System\cDUGoOa.exe
  2⤵
  PID:3212
- C:\Windows\System\qFtqHeK.exe
  C:\Windows\System\qFtqHeK.exe
  2⤵
  PID:4008
- C:\Windows\System\mnCcphQ.exe
  C:\Windows\System\mnCcphQ.exe
  2⤵
  PID:3908
- C:\Windows\System\zCHWByS.exe
  C:\Windows\System\zCHWByS.exe
  2⤵
  PID:1420
- C:\Windows\System\kBoItAU.exe
  C:\Windows\System\kBoItAU.exe
  2⤵
  PID:4088
- C:\Windows\System\CsAYnzD.exe
  C:\Windows\System\CsAYnzD.exe
  2⤵
  PID:3196
- C:\Windows\System\iJCGCnC.exe
  C:\Windows\System\iJCGCnC.exe
  2⤵
  PID:1808
- C:\Windows\System\lJhYcUB.exe
  C:\Windows\System\lJhYcUB.exe
  2⤵
  PID:4116
- C:\Windows\System\zSKotOc.exe
  C:\Windows\System\zSKotOc.exe
  2⤵
  PID:4132
- C:\Windows\System\hVIyJFs.exe
  C:\Windows\System\hVIyJFs.exe
  2⤵
  PID:4156
- C:\Windows\System\glvpduf.exe
  C:\Windows\System\glvpduf.exe
  2⤵
  PID:4176
- C:\Windows\System\dmGhiOU.exe
  C:\Windows\System\dmGhiOU.exe
  2⤵
  PID:4196
- C:\Windows\System\GuIwSVf.exe
  C:\Windows\System\GuIwSVf.exe
  2⤵
  PID:4216
- C:\Windows\System\ertfcth.exe
  C:\Windows\System\ertfcth.exe
  2⤵
  PID:4236
- C:\Windows\System\zsPxasr.exe
  C:\Windows\System\zsPxasr.exe
  2⤵
  PID:4252
- C:\Windows\System\TbRCBMv.exe
  C:\Windows\System\TbRCBMv.exe
  2⤵
  PID:4276
- C:\Windows\System\ooBUAnM.exe
  C:\Windows\System\ooBUAnM.exe
  2⤵
  PID:4292
- C:\Windows\System\vauGCaG.exe
  C:\Windows\System\vauGCaG.exe
  2⤵
  PID:4316
- C:\Windows\System\cGskJTV.exe
  C:\Windows\System\cGskJTV.exe
  2⤵
  PID:4336
- C:\Windows\System\pOfutJW.exe
  C:\Windows\System\pOfutJW.exe
  2⤵
  PID:4356
- C:\Windows\System\UDvxIWk.exe
  C:\Windows\System\UDvxIWk.exe
  2⤵
  PID:4372
- C:\Windows\System\KMUdYVM.exe
  C:\Windows\System\KMUdYVM.exe
  2⤵
  PID:4396
- C:\Windows\System\bQZAHGc.exe
  C:\Windows\System\bQZAHGc.exe
  2⤵
  PID:4412
- C:\Windows\System\WkginWz.exe
  C:\Windows\System\WkginWz.exe
  2⤵
  PID:4436
- C:\Windows\System\LHqobVM.exe
  C:\Windows\System\LHqobVM.exe
  2⤵
  PID:4452
- C:\Windows\System\bRwSOqr.exe
  C:\Windows\System\bRwSOqr.exe
  2⤵
  PID:4480
- C:\Windows\System\xZEwGtR.exe
  C:\Windows\System\xZEwGtR.exe
  2⤵
  PID:4500
- C:\Windows\System\vJoEVKH.exe
  C:\Windows\System\vJoEVKH.exe
  2⤵
  PID:4516
- C:\Windows\System\VyZiFub.exe
  C:\Windows\System\VyZiFub.exe
  2⤵
  PID:4532
- C:\Windows\System\fOvlZhn.exe
  C:\Windows\System\fOvlZhn.exe
  2⤵
  PID:4548
- C:\Windows\System\elqQnTP.exe
  C:\Windows\System\elqQnTP.exe
  2⤵
  PID:4572
- C:\Windows\System\spdYoRW.exe
  C:\Windows\System\spdYoRW.exe
  2⤵
  PID:4592
- C:\Windows\System\lSghQQn.exe
  C:\Windows\System\lSghQQn.exe
  2⤵
  PID:4612
- C:\Windows\System\sscpbWU.exe
  C:\Windows\System\sscpbWU.exe
  2⤵
  PID:4628
- C:\Windows\System\EJSVMEH.exe
  C:\Windows\System\EJSVMEH.exe
  2⤵
  PID:4644
- C:\Windows\System\mBwKhXO.exe
  C:\Windows\System\mBwKhXO.exe
  2⤵
  PID:4660
- C:\Windows\System\RGpVscd.exe
  C:\Windows\System\RGpVscd.exe
  2⤵
  PID:4676
- C:\Windows\System\mQzSqaZ.exe
  C:\Windows\System\mQzSqaZ.exe
  2⤵
  PID:4692
- C:\Windows\System\eHBXvuh.exe
  C:\Windows\System\eHBXvuh.exe
  2⤵
  PID:4712
- C:\Windows\System\cNFjLKB.exe
  C:\Windows\System\cNFjLKB.exe
  2⤵
  PID:4740
- C:\Windows\System\tKANKwg.exe
  C:\Windows\System\tKANKwg.exe
  2⤵
  PID:4756
- C:\Windows\System\HqrDZpP.exe
  C:\Windows\System\HqrDZpP.exe
  2⤵
  PID:4780
- C:\Windows\System\gtyjpXM.exe
  C:\Windows\System\gtyjpXM.exe
  2⤵
  PID:4800
- C:\Windows\System\tPyXffO.exe
  C:\Windows\System\tPyXffO.exe
  2⤵
  PID:4816
- C:\Windows\System\rYqCMcU.exe
  C:\Windows\System\rYqCMcU.exe
  2⤵
  PID:4836
- C:\Windows\System\aSNSVZn.exe
  C:\Windows\System\aSNSVZn.exe
  2⤵
  PID:4852
- C:\Windows\System\HOSvXnE.exe
  C:\Windows\System\HOSvXnE.exe
  2⤵
  PID:4872
- C:\Windows\System\IkVxQxG.exe
  C:\Windows\System\IkVxQxG.exe
  2⤵
  PID:4888
- C:\Windows\System\deiHNfL.exe
  C:\Windows\System\deiHNfL.exe
  2⤵
  PID:4908
- C:\Windows\System\UAMIiRt.exe
  C:\Windows\System\UAMIiRt.exe
  2⤵
  PID:4936
- C:\Windows\System\GDvqVvm.exe
  C:\Windows\System\GDvqVvm.exe
  2⤵
  PID:4952
- C:\Windows\System\JngEiWG.exe
  C:\Windows\System\JngEiWG.exe
  2⤵
  PID:4972
- C:\Windows\System\eAbBEyS.exe
  C:\Windows\System\eAbBEyS.exe
  2⤵
  PID:4988
- C:\Windows\System\zEFmcTn.exe
  C:\Windows\System\zEFmcTn.exe
  2⤵
  PID:5004
- C:\Windows\System\fzZXUuh.exe
  C:\Windows\System\fzZXUuh.exe
  2⤵
  PID:5020
- C:\Windows\System\dKOqbGH.exe
  C:\Windows\System\dKOqbGH.exe
  2⤵
  PID:5036
- C:\Windows\System\QqzCEWo.exe
  C:\Windows\System\QqzCEWo.exe
  2⤵
  PID:5056
- C:\Windows\System\BkQesQg.exe
  C:\Windows\System\BkQesQg.exe
  2⤵
  PID:5076
- C:\Windows\System\gijHAig.exe
  C:\Windows\System\gijHAig.exe
  2⤵
  PID:5096
- C:\Windows\System\wVZibPo.exe
  C:\Windows\System\wVZibPo.exe
  2⤵
  PID:2592
- C:\Windows\System\Mfuemrx.exe
  C:\Windows\System\Mfuemrx.exe
  2⤵
  PID:4100
- C:\Windows\System\TzWKLlf.exe
  C:\Windows\System\TzWKLlf.exe
  2⤵
  PID:4140
- C:\Windows\System\idCuwPC.exe
  C:\Windows\System\idCuwPC.exe
  2⤵
  PID:4128
- C:\Windows\System\JFNxnYk.exe
  C:\Windows\System\JFNxnYk.exe
  2⤵
  PID:4168
- C:\Windows\System\ssicanB.exe
  C:\Windows\System\ssicanB.exe
  2⤵
  PID:4204
- C:\Windows\System\XQAiGZq.exe
  C:\Windows\System\XQAiGZq.exe
  2⤵
  PID:4228
- C:\Windows\System\aDCfoRT.exe
  C:\Windows\System\aDCfoRT.exe
  2⤵
  PID:4248
- C:\Windows\System\gMSMouK.exe
  C:\Windows\System\gMSMouK.exe
  2⤵
  PID:4308
- C:\Windows\System\tAFFnBC.exe
  C:\Windows\System\tAFFnBC.exe
  2⤵
  PID:4348
- C:\Windows\System\OnVdaTw.exe
  C:\Windows\System\OnVdaTw.exe
  2⤵
  PID:4352
- C:\Windows\System\SCEwMtQ.exe
  C:\Windows\System\SCEwMtQ.exe
  2⤵
  PID:4384
- C:\Windows\System\BhuOtgL.exe
  C:\Windows\System\BhuOtgL.exe
  2⤵
  PID:4428
- C:\Windows\System\ClQEjUG.exe
  C:\Windows\System\ClQEjUG.exe
  2⤵
  PID:4404
- C:\Windows\System\tHqOyJW.exe
  C:\Windows\System\tHqOyJW.exe
  2⤵
  PID:4460
- C:\Windows\System\sCbqEgw.exe
  C:\Windows\System\sCbqEgw.exe
  2⤵
  PID:4468
- C:\Windows\System\VAGbgsj.exe
  C:\Windows\System\VAGbgsj.exe
  2⤵
  PID:1716
- C:\Windows\System\RsUGvIl.exe
  C:\Windows\System\RsUGvIl.exe
  2⤵
  PID:3716
- C:\Windows\System\GMBXram.exe
  C:\Windows\System\GMBXram.exe
  2⤵
  PID:1728
- C:\Windows\System\KHpMLAw.exe
  C:\Windows\System\KHpMLAw.exe
  2⤵
  PID:4524
- C:\Windows\System\AnDVMLs.exe
  C:\Windows\System\AnDVMLs.exe
  2⤵
  PID:4556
- C:\Windows\System\mMVAyma.exe
  C:\Windows\System\mMVAyma.exe
  2⤵
  PID:4588
- C:\Windows\System\IeQgNxa.exe
  C:\Windows\System\IeQgNxa.exe
  2⤵
  PID:4568
- C:\Windows\System\bIbbADE.exe
  C:\Windows\System\bIbbADE.exe
  2⤵
  PID:4652
- C:\Windows\System\NNJvQzS.exe
  C:\Windows\System\NNJvQzS.exe
  2⤵
  PID:4700
- C:\Windows\System\ppvnfRi.exe
  C:\Windows\System\ppvnfRi.exe
  2⤵
  PID:4636
- C:\Windows\System\TeFfsBN.exe
  C:\Windows\System\TeFfsBN.exe
  2⤵
  PID:4764
- C:\Windows\System\GKqINvO.exe
  C:\Windows\System\GKqINvO.exe
  2⤵
  PID:4808
- C:\Windows\System\BijAwjk.exe
  C:\Windows\System\BijAwjk.exe
  2⤵
  PID:4880
- C:\Windows\System\dTcTReN.exe
  C:\Windows\System\dTcTReN.exe
  2⤵
  PID:4916
- C:\Windows\System\yOtsTQL.exe
  C:\Windows\System\yOtsTQL.exe
  2⤵
  PID:4932
- C:\Windows\System\zGukoDE.exe
  C:\Windows\System\zGukoDE.exe
  2⤵
  PID:4996
- C:\Windows\System\bMDtssm.exe
  C:\Windows\System\bMDtssm.exe
  2⤵
  PID:5068
- C:\Windows\System\tYVxRYW.exe
  C:\Windows\System\tYVxRYW.exe
  2⤵
  PID:4752
- C:\Windows\System\iNSZvhg.exe
  C:\Windows\System\iNSZvhg.exe
  2⤵
  PID:5116
- C:\Windows\System\EcPIvFv.exe
  C:\Windows\System\EcPIvFv.exe
  2⤵
  PID:4868
- C:\Windows\System\iETDgpH.exe
  C:\Windows\System\iETDgpH.exe
  2⤵
  PID:4212
- C:\Windows\System\kEUcnuF.exe
  C:\Windows\System\kEUcnuF.exe
  2⤵
  PID:4300
- C:\Windows\System\nCDHBxd.exe
  C:\Windows\System\nCDHBxd.exe
  2⤵
  PID:4388
- C:\Windows\System\crerRSL.exe
  C:\Windows\System\crerRSL.exe
  2⤵
  PID:3704
- C:\Windows\System\cmbsDqM.exe
  C:\Windows\System\cmbsDqM.exe
  2⤵
  PID:2780
- C:\Windows\System\YMzieex.exe
  C:\Windows\System\YMzieex.exe
  2⤵
  PID:5048
- C:\Windows\System\hCJLIuI.exe
  C:\Windows\System\hCJLIuI.exe
  2⤵
  PID:4792
- C:\Windows\System\HWrcLUw.exe
  C:\Windows\System\HWrcLUw.exe
  2⤵
  PID:4832
- C:\Windows\System\dbhPjxj.exe
  C:\Windows\System\dbhPjxj.exe
  2⤵
  PID:4904
- C:\Windows\System\aQzMHGH.exe
  C:\Windows\System\aQzMHGH.exe
  2⤵
  PID:2668
- C:\Windows\System\nMkAHrA.exe
  C:\Windows\System\nMkAHrA.exe
  2⤵
  PID:4148
- C:\Windows\System\fxrMbqE.exe
  C:\Windows\System\fxrMbqE.exe
  2⤵
  PID:4312
- C:\Windows\System\YCUFqkf.exe
  C:\Windows\System\YCUFqkf.exe
  2⤵
  PID:4432
- C:\Windows\System\noNKrCL.exe
  C:\Windows\System\noNKrCL.exe
  2⤵
  PID:760
- C:\Windows\System\jRBoaIK.exe
  C:\Windows\System\jRBoaIK.exe
  2⤵
  PID:4540
- C:\Windows\System\FWUTVIM.exe
  C:\Windows\System\FWUTVIM.exe
  2⤵
  PID:4672
- C:\Windows\System\cXIYrdx.exe
  C:\Windows\System\cXIYrdx.exe
  2⤵
  PID:5052
- C:\Windows\System\HjkcrrA.exe
  C:\Windows\System\HjkcrrA.exe
  2⤵
  PID:4984
- C:\Windows\System\Uvauguu.exe
  C:\Windows\System\Uvauguu.exe
  2⤵
  PID:4508
- C:\Windows\System\uOFIKZF.exe
  C:\Windows\System\uOFIKZF.exe
  2⤵
  PID:4624
- C:\Windows\System\rgzAAUi.exe
  C:\Windows\System\rgzAAUi.exe
  2⤵
  PID:4720
- C:\Windows\System\lCEnPRz.exe
  C:\Windows\System\lCEnPRz.exe
  2⤵
  PID:4844
- C:\Windows\System\OlHwgcS.exe
  C:\Windows\System\OlHwgcS.exe
  2⤵
  PID:5028
- C:\Windows\System\gPqSZns.exe
  C:\Windows\System\gPqSZns.exe
  2⤵
  PID:5032
- C:\Windows\System\tGtiWBV.exe
  C:\Windows\System\tGtiWBV.exe
  2⤵
  PID:4748
- C:\Windows\System\IlxjIzj.exe
  C:\Windows\System\IlxjIzj.exe
  2⤵
  PID:4864
- C:\Windows\System\EmThZws.exe
  C:\Windows\System\EmThZws.exe
  2⤵
  PID:2964
- C:\Windows\System\lXlbqxi.exe
  C:\Windows\System\lXlbqxi.exe
  2⤵
  PID:3440
- C:\Windows\System\QNbQfrm.exe
  C:\Windows\System\QNbQfrm.exe
  2⤵
  PID:4192
- C:\Windows\System\dGCEncS.exe
  C:\Windows\System\dGCEncS.exe
  2⤵
  PID:4488
- C:\Windows\System\PTQgngg.exe
  C:\Windows\System\PTQgngg.exe
  2⤵
  PID:3236
- C:\Windows\System\XdZHpLJ.exe
  C:\Windows\System\XdZHpLJ.exe
  2⤵
  PID:4608
- C:\Windows\System\dzkYfpr.exe
  C:\Windows\System\dzkYfpr.exe
  2⤵
  PID:4264
- C:\Windows\System\nqMNOXi.exe
  C:\Windows\System\nqMNOXi.exe
  2⤵
  PID:4824
- C:\Windows\System\gFbQOgd.exe
  C:\Windows\System\gFbQOgd.exe
  2⤵
  PID:4928
- C:\Windows\System\vbpnWdw.exe
  C:\Windows\System\vbpnWdw.exe
  2⤵
  PID:4944
- C:\Windows\System\kguZlko.exe
  C:\Windows\System\kguZlko.exe
  2⤵
  PID:4380
- C:\Windows\System\PWEnpDM.exe
  C:\Windows\System\PWEnpDM.exe
  2⤵
  PID:4344
- C:\Windows\System\RpRvBvB.exe
  C:\Windows\System\RpRvBvB.exe
  2⤵
  PID:4708
- C:\Windows\System\JkKjrbp.exe
  C:\Windows\System\JkKjrbp.exe
  2⤵
  PID:3700
- C:\Windows\System\XlyrKJp.exe
  C:\Windows\System\XlyrKJp.exe
  2⤵
  PID:4272
- C:\Windows\System\YKAqaCi.exe
  C:\Windows\System\YKAqaCi.exe
  2⤵
  PID:4444
- C:\Windows\System\EJKJBsL.exe
  C:\Windows\System\EJKJBsL.exe
  2⤵
  PID:4828
- C:\Windows\System\pKlTrQr.exe
  C:\Windows\System\pKlTrQr.exe
  2⤵
  PID:4332
- C:\Windows\System\MkWGsCg.exe
  C:\Windows\System\MkWGsCg.exe
  2⤵
  PID:5104
- C:\Windows\System\yZmbAVF.exe
  C:\Windows\System\yZmbAVF.exe
  2⤵
  PID:5084
- C:\Windows\System\cYYjVLR.exe
  C:\Windows\System\cYYjVLR.exe
  2⤵
  PID:5016
- C:\Windows\System\sUNpCHc.exe
  C:\Windows\System\sUNpCHc.exe
  2⤵
  PID:4900
- C:\Windows\System\PygHzDi.exe
  C:\Windows\System\PygHzDi.exe
  2⤵
  PID:4772
- C:\Windows\System\MOueVwu.exe
  C:\Windows\System\MOueVwu.exe
  2⤵
  PID:5132
- C:\Windows\System\izGlXuV.exe
  C:\Windows\System\izGlXuV.exe
  2⤵
  PID:5160
- C:\Windows\System\feATKHA.exe
  C:\Windows\System\feATKHA.exe
  2⤵
  PID:5176
- C:\Windows\System\mtAStYw.exe
  C:\Windows\System\mtAStYw.exe
  2⤵
  PID:5200
- C:\Windows\System\rOmtuoQ.exe
  C:\Windows\System\rOmtuoQ.exe
  2⤵
  PID:5220
- C:\Windows\System\NXohQri.exe
  C:\Windows\System\NXohQri.exe
  2⤵
  PID:5240
- C:\Windows\System\lUMusUa.exe
  C:\Windows\System\lUMusUa.exe
  2⤵
  PID:5260
- C:\Windows\System\icpmNsR.exe
  C:\Windows\System\icpmNsR.exe
  2⤵
  PID:5276
- C:\Windows\System\HAenRTB.exe
  C:\Windows\System\HAenRTB.exe
  2⤵
  PID:5296
- C:\Windows\System\kYrIaBH.exe
  C:\Windows\System\kYrIaBH.exe
  2⤵
  PID:5316
- C:\Windows\System\HXxcpKV.exe
  C:\Windows\System\HXxcpKV.exe
  2⤵
  PID:5332
- C:\Windows\System\TZMwZec.exe
  C:\Windows\System\TZMwZec.exe
  2⤵
  PID:5356
- C:\Windows\System\cJkBjLD.exe
  C:\Windows\System\cJkBjLD.exe
  2⤵
  PID:5376
- C:\Windows\System\HWzhKDG.exe
  C:\Windows\System\HWzhKDG.exe
  2⤵
  PID:5400
- C:\Windows\System\BINPpGl.exe
  C:\Windows\System\BINPpGl.exe
  2⤵
  PID:5420
- C:\Windows\System\mSDnrTV.exe
  C:\Windows\System\mSDnrTV.exe
  2⤵
  PID:5440
- C:\Windows\System\LbBeQIK.exe
  C:\Windows\System\LbBeQIK.exe
  2⤵
  PID:5468
- C:\Windows\System\mqnEZfJ.exe
  C:\Windows\System\mqnEZfJ.exe
  2⤵
  PID:5484
- C:\Windows\System\CVbdhFY.exe
  C:\Windows\System\CVbdhFY.exe
  2⤵
  PID:5504
- C:\Windows\System\WcbgiYc.exe
  C:\Windows\System\WcbgiYc.exe
  2⤵
  PID:5520
- C:\Windows\System\VuUnMFi.exe
  C:\Windows\System\VuUnMFi.exe
  2⤵
  PID:5536
- C:\Windows\System\yECAjLr.exe
  C:\Windows\System\yECAjLr.exe
  2⤵
  PID:5556
- C:\Windows\System\QjSqhBi.exe
  C:\Windows\System\QjSqhBi.exe
  2⤵
  PID:5576
- C:\Windows\System\XsIDBde.exe
  C:\Windows\System\XsIDBde.exe
  2⤵
  PID:5596
- C:\Windows\System\mMqWZwo.exe
  C:\Windows\System\mMqWZwo.exe
  2⤵
  PID:5616
- C:\Windows\System\KTyIXUx.exe
  C:\Windows\System\KTyIXUx.exe
  2⤵
  PID:5636
- C:\Windows\System\rUOFOvY.exe
  C:\Windows\System\rUOFOvY.exe
  2⤵
  PID:5656
- C:\Windows\System\HinCyfM.exe
  C:\Windows\System\HinCyfM.exe
  2⤵
  PID:5676
- C:\Windows\System\ZWadCVT.exe
  C:\Windows\System\ZWadCVT.exe
  2⤵
  PID:5696
- C:\Windows\System\hibyyoA.exe
  C:\Windows\System\hibyyoA.exe
  2⤵
  PID:5716
- C:\Windows\System\zjNtkhT.exe
  C:\Windows\System\zjNtkhT.exe
  2⤵
  PID:5732
- C:\Windows\System\GiqnSGl.exe
  C:\Windows\System\GiqnSGl.exe
  2⤵
  PID:5748
- C:\Windows\System\lhfTrnD.exe
  C:\Windows\System\lhfTrnD.exe
  2⤵
  PID:5768
- C:\Windows\System\qjRpYXe.exe
  C:\Windows\System\qjRpYXe.exe
  2⤵
  PID:5804
- C:\Windows\System\TdhdSwx.exe
  C:\Windows\System\TdhdSwx.exe
  2⤵
  PID:5820
- C:\Windows\System\dzSfYlm.exe
  C:\Windows\System\dzSfYlm.exe
  2⤵
  PID:5836
- C:\Windows\System\CKZJWdI.exe
  C:\Windows\System\CKZJWdI.exe
  2⤵
  PID:5852
- C:\Windows\System\YCoLIae.exe
  C:\Windows\System\YCoLIae.exe
  2⤵
  PID:5876
- C:\Windows\System\NhVfPvK.exe
  C:\Windows\System\NhVfPvK.exe
  2⤵
  PID:5900
- C:\Windows\System\LRmqhNa.exe
  C:\Windows\System\LRmqhNa.exe
  2⤵
  PID:5916
- C:\Windows\System\cEoXHXg.exe
  C:\Windows\System\cEoXHXg.exe
  2⤵
  PID:5932
- C:\Windows\System\qMLmVqX.exe
  C:\Windows\System\qMLmVqX.exe
  2⤵
  PID:5948
- C:\Windows\System\Hfmrjtx.exe
  C:\Windows\System\Hfmrjtx.exe
  2⤵
  PID:5964
- C:\Windows\System\knyEVuf.exe
  C:\Windows\System\knyEVuf.exe
  2⤵
  PID:5984
- C:\Windows\System\AZkpXdu.exe
  C:\Windows\System\AZkpXdu.exe
  2⤵
  PID:6000
- C:\Windows\System\FytyvNy.exe
  C:\Windows\System\FytyvNy.exe
  2⤵
  PID:6016
- C:\Windows\System\IFBfwtb.exe
  C:\Windows\System\IFBfwtb.exe
  2⤵
  PID:6036
- C:\Windows\System\cBawCvk.exe
  C:\Windows\System\cBawCvk.exe
  2⤵
  PID:6056
- C:\Windows\System\BOPwcei.exe
  C:\Windows\System\BOPwcei.exe
  2⤵
  PID:6076
- C:\Windows\System\tMzkJFG.exe
  C:\Windows\System\tMzkJFG.exe
  2⤵
  PID:6092
- C:\Windows\System\SNaXkvd.exe
  C:\Windows\System\SNaXkvd.exe
  2⤵
  PID:6108
- C:\Windows\System\YIbkDKR.exe
  C:\Windows\System\YIbkDKR.exe
  2⤵
  PID:6124
- C:\Windows\System\mDuYGLz.exe
  C:\Windows\System\mDuYGLz.exe
  2⤵
  PID:6140
- C:\Windows\System\AjMAvxH.exe
  C:\Windows\System\AjMAvxH.exe
  2⤵
  PID:5144
- C:\Windows\System\kAaNMkA.exe
  C:\Windows\System\kAaNMkA.exe
  2⤵
  PID:5188
- C:\Windows\System\KkQtnMQ.exe
  C:\Windows\System\KkQtnMQ.exe
  2⤵
  PID:5124
- C:\Windows\System\qknavXV.exe
  C:\Windows\System\qknavXV.exe
  2⤵
  PID:5216
- C:\Windows\System\rIupaqW.exe
  C:\Windows\System\rIupaqW.exe
  2⤵
  PID:5252
- C:\Windows\System\oBioFxh.exe
  C:\Windows\System\oBioFxh.exe
  2⤵
  PID:5284
- C:\Windows\System\XUHUxrQ.exe
  C:\Windows\System\XUHUxrQ.exe
  2⤵
  PID:5292
- C:\Windows\System\IGydJvF.exe
  C:\Windows\System\IGydJvF.exe
  2⤵
  PID:5368
- C:\Windows\System\rTqXLSY.exe
  C:\Windows\System\rTqXLSY.exe
  2⤵
  PID:5476
- C:\Windows\System\OuJUaae.exe
  C:\Windows\System\OuJUaae.exe
  2⤵
  PID:5512
- C:\Windows\System\Mszapck.exe
  C:\Windows\System\Mszapck.exe
  2⤵
  PID:5584
- C:\Windows\System\RRjGCZw.exe
  C:\Windows\System\RRjGCZw.exe
  2⤵
  PID:5456
- C:\Windows\System\KaWvZCe.exe
  C:\Windows\System\KaWvZCe.exe
  2⤵
  PID:5500
- C:\Windows\System\OycPAhY.exe
  C:\Windows\System\OycPAhY.exe
  2⤵
  PID:5644
- C:\Windows\System\FaIncxx.exe
  C:\Windows\System\FaIncxx.exe
  2⤵
  PID:5604
- C:\Windows\System\XCEEkZo.exe
  C:\Windows\System\XCEEkZo.exe
  2⤵
  PID:5672
- C:\Windows\System\lPeoTms.exe
  C:\Windows\System\lPeoTms.exe
  2⤵
  PID:5776
- C:\Windows\System\Egrmyvp.exe
  C:\Windows\System\Egrmyvp.exe
  2⤵
  PID:5688
- C:\Windows\System\xwqktPH.exe
  C:\Windows\System\xwqktPH.exe
  2⤵
  PID:5784
- C:\Windows\System\ZyJymLs.exe
  C:\Windows\System\ZyJymLs.exe
  2⤵
  PID:5652
- C:\Windows\System\OmxuWll.exe
  C:\Windows\System\OmxuWll.exe
  2⤵
  PID:5868
- C:\Windows\System\kLoUfCq.exe
  C:\Windows\System\kLoUfCq.exe
  2⤵
  PID:5908
- C:\Windows\System\OvddMnk.exe
  C:\Windows\System\OvddMnk.exe
  2⤵
  PID:5764
- C:\Windows\System\jZxVWzA.exe
  C:\Windows\System\jZxVWzA.exe
  2⤵
  PID:5976
- C:\Windows\System\drMBAmw.exe
  C:\Windows\System\drMBAmw.exe
  2⤵
  PID:6088
- C:\Windows\System\yBrnZiS.exe
  C:\Windows\System\yBrnZiS.exe
  2⤵
  PID:3640
- C:\Windows\System\TnSnXZj.exe
  C:\Windows\System\TnSnXZj.exe
  2⤵
  PID:5168
- C:\Windows\System\anSeKNV.exe
  C:\Windows\System\anSeKNV.exe
  2⤵
  PID:5272
- C:\Windows\System\VPYYOkk.exe
  C:\Windows\System\VPYYOkk.exe
  2⤵
  PID:5340
- C:\Windows\System\CxwCxVx.exe
  C:\Windows\System\CxwCxVx.exe
  2⤵
  PID:5384
- C:\Windows\System\gEghASW.exe
  C:\Windows\System\gEghASW.exe
  2⤵
  PID:5992
- C:\Windows\System\HePNJJo.exe
  C:\Windows\System\HePNJJo.exe
  2⤵
  PID:6064
- C:\Windows\System\YtSmZpf.exe
  C:\Windows\System\YtSmZpf.exe
  2⤵
  PID:6136
- C:\Windows\System\QhmXBay.exe
  C:\Windows\System\QhmXBay.exe
  2⤵
  PID:5228
- C:\Windows\System\ksOTAuN.exe
  C:\Windows\System\ksOTAuN.exe
  2⤵
  PID:5288
- C:\Windows\System\BwShpcZ.exe
  C:\Windows\System\BwShpcZ.exe
  2⤵
  PID:5408
- C:\Windows\System\JbYJRLf.exe
  C:\Windows\System\JbYJRLf.exe
  2⤵
  PID:5628
- C:\Windows\System\UnIaMgd.exe
  C:\Windows\System\UnIaMgd.exe
  2⤵
  PID:5412
- C:\Windows\System\uHyBkmX.exe
  C:\Windows\System\uHyBkmX.exe
  2⤵
  PID:5744
- C:\Windows\System\EgOhBCT.exe
  C:\Windows\System\EgOhBCT.exe
  2⤵
  PID:5860
- C:\Windows\System\FnYIKdQ.exe
  C:\Windows\System\FnYIKdQ.exe
  2⤵
  PID:5760
- C:\Windows\System\VBcdttp.exe
  C:\Windows\System\VBcdttp.exe
  2⤵
  PID:5668
- C:\Windows\System\tkLNoAm.exe
  C:\Windows\System\tkLNoAm.exe
  2⤵
  PID:5828
- C:\Windows\System\ugyotVl.exe
  C:\Windows\System\ugyotVl.exe
  2⤵
  PID:6052
- C:\Windows\System\JgETGbE.exe
  C:\Windows\System\JgETGbE.exe
  2⤵
  PID:5528
- C:\Windows\System\qQFrVpF.exe
  C:\Windows\System\qQFrVpF.exe
  2⤵
  PID:5816
- C:\Windows\System\zemjRtE.exe
  C:\Windows\System\zemjRtE.exe
  2⤵
  PID:6012
- C:\Windows\System\pKMUMLt.exe
  C:\Windows\System\pKMUMLt.exe
  2⤵
  PID:5308
- C:\Windows\System\GGzFLeC.exe
  C:\Windows\System\GGzFLeC.exe
  2⤵
  PID:6100
- C:\Windows\System\ifTmnmi.exe
  C:\Windows\System\ifTmnmi.exe
  2⤵
  PID:5256
- C:\Windows\System\PniOzbl.exe
  C:\Windows\System\PniOzbl.exe
  2⤵
  PID:5712
- C:\Windows\System\TNzNvWY.exe
  C:\Windows\System\TNzNvWY.exe
  2⤵
  PID:5608
- C:\Windows\System\QbEBWst.exe
  C:\Windows\System\QbEBWst.exe
  2⤵
  PID:5432
- C:\Windows\System\TWuvMxY.exe
  C:\Windows\System\TWuvMxY.exe
  2⤵
  PID:5564
- C:\Windows\System\jllbcgn.exe
  C:\Windows\System\jllbcgn.exe
  2⤵
  PID:6028
- C:\Windows\System\pTkjbUU.exe
  C:\Windows\System\pTkjbUU.exe
  2⤵
  PID:5956
- C:\Windows\System\cpUsrKJ.exe
  C:\Windows\System\cpUsrKJ.exe
  2⤵
  PID:5208
- C:\Windows\System\NjGJFPD.exe
  C:\Windows\System\NjGJFPD.exe
  2⤵
  PID:5352
- C:\Windows\System\bmmoBeI.exe
  C:\Windows\System\bmmoBeI.exe
  2⤵
  PID:5796
- C:\Windows\System\EffEfUt.exe
  C:\Windows\System\EffEfUt.exe
  2⤵
  PID:6132
- C:\Windows\System\ufAPkOy.exe
  C:\Windows\System\ufAPkOy.exe
  2⤵
  PID:5792
- C:\Windows\System\abqzixC.exe
  C:\Windows\System\abqzixC.exe
  2⤵
  PID:5832
- C:\Windows\System\rWIZzXN.exe
  C:\Windows\System\rWIZzXN.exe
  2⤵
  PID:5328
- C:\Windows\System\TfjpjDP.exe
  C:\Windows\System\TfjpjDP.exe
  2⤵
  PID:5348
- C:\Windows\System\WXlCdYN.exe
  C:\Windows\System\WXlCdYN.exe
  2⤵
  PID:5812
- C:\Windows\System\qYuwLTm.exe
  C:\Windows\System\qYuwLTm.exe
  2⤵
  PID:5844
- C:\Windows\System\zKJnTbI.exe
  C:\Windows\System\zKJnTbI.exe
  2⤵
  PID:6172
- C:\Windows\System\wfwFmrj.exe
  C:\Windows\System\wfwFmrj.exe
  2⤵
  PID:6196
- C:\Windows\System\GlmMUoE.exe
  C:\Windows\System\GlmMUoE.exe
  2⤵
  PID:6216
- C:\Windows\System\QnddvfR.exe
  C:\Windows\System\QnddvfR.exe
  2⤵
  PID:6244
- C:\Windows\System\hGggoby.exe
  C:\Windows\System\hGggoby.exe
  2⤵
  PID:6264
- C:\Windows\System\cVuDBGF.exe
  C:\Windows\System\cVuDBGF.exe
  2⤵
  PID:6284
- C:\Windows\System\wJaLldo.exe
  C:\Windows\System\wJaLldo.exe
  2⤵
  PID:6300
- C:\Windows\System\kZmBkzz.exe
  C:\Windows\System\kZmBkzz.exe
  2⤵
  PID:6324
- C:\Windows\System\OKBtrDL.exe
  C:\Windows\System\OKBtrDL.exe
  2⤵
  PID:6340
- C:\Windows\System\DAoRotd.exe
  C:\Windows\System\DAoRotd.exe
  2⤵
  PID:6356
- C:\Windows\System\bZqYuml.exe
  C:\Windows\System\bZqYuml.exe
  2⤵
  PID:6372
- C:\Windows\System\WSXvOAB.exe
  C:\Windows\System\WSXvOAB.exe
  2⤵
  PID:6388
- C:\Windows\System\dAsfMsQ.exe
  C:\Windows\System\dAsfMsQ.exe
  2⤵
  PID:6404
- C:\Windows\System\YJomSbw.exe
  C:\Windows\System\YJomSbw.exe
  2⤵
  PID:6424
- C:\Windows\System\Tybyiuv.exe
  C:\Windows\System\Tybyiuv.exe
  2⤵
  PID:6464
- C:\Windows\System\KdicFmy.exe
  C:\Windows\System\KdicFmy.exe
  2⤵
  PID:6480
- C:\Windows\System\hkOmyDW.exe
  C:\Windows\System\hkOmyDW.exe
  2⤵
  PID:6496
- C:\Windows\System\PpZjRRN.exe
  C:\Windows\System\PpZjRRN.exe
  2⤵
  PID:6524
- C:\Windows\System\vWsWUYm.exe
  C:\Windows\System\vWsWUYm.exe
  2⤵
  PID:6540
- C:\Windows\System\XttRLfD.exe
  C:\Windows\System\XttRLfD.exe
  2⤵
  PID:6556
- C:\Windows\System\iCHtcOb.exe
  C:\Windows\System\iCHtcOb.exe
  2⤵
  PID:6572
- C:\Windows\System\FhNEskS.exe
  C:\Windows\System\FhNEskS.exe
  2⤵
  PID:6588
- C:\Windows\System\GzWCNSP.exe
  C:\Windows\System\GzWCNSP.exe
  2⤵
  PID:6612
- C:\Windows\System\GfqOWpC.exe
  C:\Windows\System\GfqOWpC.exe
  2⤵
  PID:6636
- C:\Windows\System\iMHnWVq.exe
  C:\Windows\System\iMHnWVq.exe
  2⤵
  PID:6652
- C:\Windows\System\IkkIahv.exe
  C:\Windows\System\IkkIahv.exe
  2⤵
  PID:6668
- C:\Windows\System\TYVtIAF.exe
  C:\Windows\System\TYVtIAF.exe
  2⤵
  PID:6684
- C:\Windows\System\XkHYgOb.exe
  C:\Windows\System\XkHYgOb.exe
  2⤵
  PID:6704
- C:\Windows\System\WgetOKf.exe
  C:\Windows\System\WgetOKf.exe
  2⤵
  PID:6732
- C:\Windows\System\jqlqKOK.exe
  C:\Windows\System\jqlqKOK.exe
  2⤵
  PID:6748
- C:\Windows\System\cFcjLss.exe
  C:\Windows\System\cFcjLss.exe
  2⤵
  PID:6788
- C:\Windows\System\QoOJuxa.exe
  C:\Windows\System\QoOJuxa.exe
  2⤵
  PID:6804
- C:\Windows\System\RgWvWwp.exe
  C:\Windows\System\RgWvWwp.exe
  2⤵
  PID:6828
- C:\Windows\System\BCTeeMg.exe
  C:\Windows\System\BCTeeMg.exe
  2⤵
  PID:6848
- C:\Windows\System\TEXBsmp.exe
  C:\Windows\System\TEXBsmp.exe
  2⤵
  PID:6868
- C:\Windows\System\UQdEpDD.exe
  C:\Windows\System\UQdEpDD.exe
  2⤵
  PID:6884
- C:\Windows\System\wxmOUzl.exe
  C:\Windows\System\wxmOUzl.exe
  2⤵
  PID:6900
- C:\Windows\System\tdFRrrY.exe
  C:\Windows\System\tdFRrrY.exe
  2⤵
  PID:6928
- C:\Windows\System\jaTLpzk.exe
  C:\Windows\System\jaTLpzk.exe
  2⤵
  PID:6944
- C:\Windows\System\aZrTcIR.exe
  C:\Windows\System\aZrTcIR.exe
  2⤵
  PID:6964
- C:\Windows\System\WlmIaLb.exe
  C:\Windows\System\WlmIaLb.exe
  2⤵
  PID:6980
- C:\Windows\System\HlSswbt.exe
  C:\Windows\System\HlSswbt.exe
  2⤵
  PID:7000
- C:\Windows\System\LutXluR.exe
  C:\Windows\System\LutXluR.exe
  2⤵
  PID:7020
- C:\Windows\System\TxaldCy.exe
  C:\Windows\System\TxaldCy.exe
  2⤵
  PID:7036
- C:\Windows\System\YDnCYsF.exe
  C:\Windows\System\YDnCYsF.exe
  2⤵
  PID:7052
- C:\Windows\System\xAtedtz.exe
  C:\Windows\System\xAtedtz.exe
  2⤵
  PID:7068
- C:\Windows\System\vkxYpCn.exe
  C:\Windows\System\vkxYpCn.exe
  2⤵
  PID:7084
- C:\Windows\System\qiTUBgF.exe
  C:\Windows\System\qiTUBgF.exe
  2⤵
  PID:7100
- C:\Windows\System\EcZuFFA.exe
  C:\Windows\System\EcZuFFA.exe
  2⤵
  PID:7120
- C:\Windows\System\HjTVVAz.exe
  C:\Windows\System\HjTVVAz.exe
  2⤵
  PID:7136
- C:\Windows\System\xUNvkJZ.exe
  C:\Windows\System\xUNvkJZ.exe
  2⤵
  PID:7160
- C:\Windows\System\JodYpTg.exe
  C:\Windows\System\JodYpTg.exe
  2⤵
  PID:5800
- C:\Windows\System\etlbBJt.exe
  C:\Windows\System\etlbBJt.exe
  2⤵
  PID:6152
- C:\Windows\System\bTfhvse.exe
  C:\Windows\System\bTfhvse.exe
  2⤵
  PID:6168
- C:\Windows\System\BuSKCwg.exe
  C:\Windows\System\BuSKCwg.exe
  2⤵
  PID:5928
- C:\Windows\System\tdboPYy.exe
  C:\Windows\System\tdboPYy.exe
  2⤵
  PID:6208
- C:\Windows\System\pdJIEiu.exe
  C:\Windows\System\pdJIEiu.exe
  2⤵
  PID:6188
- C:\Windows\System\aAPDXmu.exe
  C:\Windows\System\aAPDXmu.exe
  2⤵
  PID:5972
- C:\Windows\System\KDFXGSB.exe
  C:\Windows\System\KDFXGSB.exe
  2⤵
  PID:6256
- C:\Windows\System\NQUbrNp.exe
  C:\Windows\System\NQUbrNp.exe
  2⤵
  PID:6232
- C:\Windows\System\rpiMZnU.exe
  C:\Windows\System\rpiMZnU.exe
  2⤵
  PID:6364
- C:\Windows\System\ynWnoxH.exe
  C:\Windows\System\ynWnoxH.exe
  2⤵
  PID:6224
- C:\Windows\System\VvUvzjk.exe
  C:\Windows\System\VvUvzjk.exe
  2⤵
  PID:6272
- C:\Windows\System\ciuyvGW.exe
  C:\Windows\System\ciuyvGW.exe
  2⤵
  PID:6320
- C:\Windows\System\yDgmDwE.exe
  C:\Windows\System\yDgmDwE.exe
  2⤵
  PID:6452
- C:\Windows\System\BPtVCmD.exe
  C:\Windows\System\BPtVCmD.exe
  2⤵
  PID:6436
- C:\Windows\System\YLvNcQN.exe
  C:\Windows\System\YLvNcQN.exe
  2⤵
  PID:6384
- C:\Windows\System\SwLmAOB.exe
  C:\Windows\System\SwLmAOB.exe
  2⤵
  PID:6644
- C:\Windows\System\rBXWsWX.exe
  C:\Windows\System\rBXWsWX.exe
  2⤵
  PID:6716
- C:\Windows\System\qgwIFeS.exe
  C:\Windows\System\qgwIFeS.exe
  2⤵
  PID:6620
- C:\Windows\System\iSAUiGQ.exe
  C:\Windows\System\iSAUiGQ.exe
  2⤵
  PID:6696
- C:\Windows\System\lBjsEcH.exe
  C:\Windows\System\lBjsEcH.exe
  2⤵
  PID:6724
- C:\Windows\System\CrRYlba.exe
  C:\Windows\System\CrRYlba.exe
  2⤵
  PID:6768
- C:\Windows\System\zGPFkAB.exe
  C:\Windows\System\zGPFkAB.exe
  2⤵
  PID:6580
- C:\Windows\System\jiKzLNQ.exe
  C:\Windows\System\jiKzLNQ.exe
  2⤵
  PID:6796
- C:\Windows\System\jhcrzEm.exe
  C:\Windows\System\jhcrzEm.exe
  2⤵
  PID:6824
- C:\Windows\System\YfZguTe.exe
  C:\Windows\System\YfZguTe.exe
  2⤵
  PID:6860
- C:\Windows\System\LTLVnCk.exe
  C:\Windows\System\LTLVnCk.exe
  2⤵
  PID:6896
- C:\Windows\System\mJedcHC.exe
  C:\Windows\System\mJedcHC.exe
  2⤵
  PID:6936
- C:\Windows\System\ofedJMa.exe
  C:\Windows\System\ofedJMa.exe
  2⤵
  PID:7008
- C:\Windows\System\rzwAFQZ.exe
  C:\Windows\System\rzwAFQZ.exe
  2⤵
  PID:7048
- C:\Windows\System\omdySjF.exe
  C:\Windows\System\omdySjF.exe
  2⤵
  PID:7112
- C:\Windows\System\dfTsHal.exe
  C:\Windows\System\dfTsHal.exe
  2⤵
  PID:7156
- C:\Windows\System\YLZxcRK.exe
  C:\Windows\System\YLZxcRK.exe
  2⤵
  PID:5156
- C:\Windows\System\ceRGydF.exe
  C:\Windows\System\ceRGydF.exe
  2⤵
  PID:6184
- C:\Windows\System\oLoUSrk.exe
  C:\Windows\System\oLoUSrk.exe
  2⤵
  PID:6332
- C:\Windows\System\jqAqajH.exe
  C:\Windows\System\jqAqajH.exe
  2⤵
  PID:6440
- C:\Windows\System\GKNvCII.exe
  C:\Windows\System\GKNvCII.exe
  2⤵
  PID:5548
- C:\Windows\System\GffbkeC.exe
  C:\Windows\System\GffbkeC.exe
  2⤵
  PID:7060
- C:\Windows\System\NLzwXML.exe
  C:\Windows\System\NLzwXML.exe
  2⤵
  PID:7028
- C:\Windows\System\FHOwVoB.exe
  C:\Windows\System\FHOwVoB.exe
  2⤵
  PID:6676
- C:\Windows\System\SPprThe.exe
  C:\Windows\System\SPprThe.exe
  2⤵
  PID:6416
- C:\Windows\System\jxsHriD.exe
  C:\Windows\System\jxsHriD.exe
  2⤵
  PID:3160
- C:\Windows\System\kdagiwc.exe
  C:\Windows\System\kdagiwc.exe
  2⤵
  PID:6400
- C:\Windows\System\SQFpUhh.exe
  C:\Windows\System\SQFpUhh.exe
  2⤵
  PID:6280
- C:\Windows\System\YlnuBwz.exe
  C:\Windows\System\YlnuBwz.exe
  2⤵
  PID:6600
- C:\Windows\System\hOAfgEJ.exe
  C:\Windows\System\hOAfgEJ.exe
  2⤵
  PID:6628
- C:\Windows\System\AAcCFGh.exe
  C:\Windows\System\AAcCFGh.exe
  2⤵
  PID:6584
- C:\Windows\System\ZGXHpJd.exe
  C:\Windows\System\ZGXHpJd.exe
  2⤵
  PID:6764
- C:\Windows\System\RRodHqu.exe
  C:\Windows\System\RRodHqu.exe
  2⤵
  PID:6856
- C:\Windows\System\mouNFYN.exe
  C:\Windows\System\mouNFYN.exe
  2⤵
  PID:6776
- C:\Windows\System\vZqRYOt.exe
  C:\Windows\System\vZqRYOt.exe
  2⤵
  PID:7144
- C:\Windows\System\GNJVIeF.exe
  C:\Windows\System\GNJVIeF.exe
  2⤵
  PID:6892
- C:\Windows\System\jlnYlCo.exe
  C:\Windows\System\jlnYlCo.exe
  2⤵
  PID:6312
- C:\Windows\System\tqsXvrZ.exe
  C:\Windows\System\tqsXvrZ.exe
  2⤵
  PID:7108
- C:\Windows\System\gyLRlEc.exe
  C:\Windows\System\gyLRlEc.exe
  2⤵
  PID:6940
- C:\Windows\System\NdKFCJJ.exe
  C:\Windows\System\NdKFCJJ.exe
  2⤵
  PID:6908
- C:\Windows\System\KVjkopY.exe
  C:\Windows\System\KVjkopY.exe
  2⤵
  PID:7064
- C:\Windows\System\lcAKNGY.exe
  C:\Windows\System\lcAKNGY.exe
  2⤵
  PID:6296
- C:\Windows\System\fyGpDdS.exe
  C:\Windows\System\fyGpDdS.exe
  2⤵
  PID:6956
- C:\Windows\System\NqSurIs.exe
  C:\Windows\System\NqSurIs.exe
  2⤵
  PID:6120
- C:\Windows\System\pHzDxpG.exe
  C:\Windows\System\pHzDxpG.exe
  2⤵
  PID:5888
- C:\Windows\System\vQCTvtL.exe
  C:\Windows\System\vQCTvtL.exe
  2⤵
  PID:6512
- C:\Windows\System\xOPfkms.exe
  C:\Windows\System\xOPfkms.exe
  2⤵
  PID:6460
- C:\Windows\System\iVqywlY.exe
  C:\Windows\System\iVqywlY.exe
  2⤵
  PID:6520
- C:\Windows\System\oqSQVCY.exe
  C:\Windows\System\oqSQVCY.exe
  2⤵
  PID:6916
- C:\Windows\System\hViaUey.exe
  C:\Windows\System\hViaUey.exe
  2⤵
  PID:6660
- C:\Windows\System\XjpDHtx.exe
  C:\Windows\System\XjpDHtx.exe
  2⤵
  PID:6044
- C:\Windows\System\QvDNdsM.exe
  C:\Windows\System\QvDNdsM.exe
  2⤵
  PID:6960
- C:\Windows\System\FFhuvwA.exe
  C:\Windows\System\FFhuvwA.exe
  2⤵
  PID:6820
- C:\Windows\System\AxqUCoA.exe
  C:\Windows\System\AxqUCoA.exe
  2⤵
  PID:7096
- C:\Windows\System\DTcAyee.exe
  C:\Windows\System\DTcAyee.exe
  2⤵
  PID:6476
- C:\Windows\System\JRXdJVe.exe
  C:\Windows\System\JRXdJVe.exe
  2⤵
  PID:7016
- C:\Windows\System\AUpvEqz.exe
  C:\Windows\System\AUpvEqz.exe
  2⤵
  PID:6664
- C:\Windows\System\xpkVYCJ.exe
  C:\Windows\System\xpkVYCJ.exe
  2⤵
  PID:7184
- C:\Windows\System\apApAwE.exe
  C:\Windows\System\apApAwE.exe
  2⤵
  PID:7200
- C:\Windows\System\deeNUUQ.exe
  C:\Windows\System\deeNUUQ.exe
  2⤵
  PID:7216
- C:\Windows\System\dxjqlpR.exe
  C:\Windows\System\dxjqlpR.exe
  2⤵
  PID:7232
- C:\Windows\System\mfyIHCp.exe
  C:\Windows\System\mfyIHCp.exe
  2⤵
  PID:7252
- C:\Windows\System\ppmQUQm.exe
  C:\Windows\System\ppmQUQm.exe
  2⤵
  PID:7272
- C:\Windows\System\WCxIiwh.exe
  C:\Windows\System\WCxIiwh.exe
  2⤵
  PID:7288
- C:\Windows\System\CAgshfm.exe
  C:\Windows\System\CAgshfm.exe
  2⤵
  PID:7336
- C:\Windows\System\MNliiED.exe
  C:\Windows\System\MNliiED.exe
  2⤵
  PID:7380
- C:\Windows\System\NRkacDw.exe
  C:\Windows\System\NRkacDw.exe
  2⤵
  PID:7400
- C:\Windows\System\qvSAvYN.exe
  C:\Windows\System\qvSAvYN.exe
  2⤵
  PID:7416
- C:\Windows\System\aKZeRwl.exe
  C:\Windows\System\aKZeRwl.exe
  2⤵
  PID:7432
- C:\Windows\System\oSdTKzX.exe
  C:\Windows\System\oSdTKzX.exe
  2⤵
  PID:7468
- C:\Windows\System\QIKwmyn.exe
  C:\Windows\System\QIKwmyn.exe
  2⤵
  PID:7484
- C:\Windows\System\SknIrbV.exe
  C:\Windows\System\SknIrbV.exe
  2⤵
  PID:7500
- C:\Windows\System\uKwjoZM.exe
  C:\Windows\System\uKwjoZM.exe
  2⤵
  PID:7516
- C:\Windows\System\nrTARhn.exe
  C:\Windows\System\nrTARhn.exe
  2⤵
  PID:7532
- C:\Windows\System\cghwMKl.exe
  C:\Windows\System\cghwMKl.exe
  2⤵
  PID:7548
- C:\Windows\System\PSgkaVK.exe
  C:\Windows\System\PSgkaVK.exe
  2⤵
  PID:7564
- C:\Windows\System\myWnjRB.exe
  C:\Windows\System\myWnjRB.exe
  2⤵
  PID:7588
- C:\Windows\System\LJhmdiV.exe
  C:\Windows\System\LJhmdiV.exe
  2⤵
  PID:7604
- C:\Windows\System\QLOHMwo.exe
  C:\Windows\System\QLOHMwo.exe
  2⤵
  PID:7644
- C:\Windows\System\FRrpYsX.exe
  C:\Windows\System\FRrpYsX.exe
  2⤵
  PID:7660
- C:\Windows\System\qEvlAhk.exe
  C:\Windows\System\qEvlAhk.exe
  2⤵
  PID:7676
- C:\Windows\System\zvcGVTh.exe
  C:\Windows\System\zvcGVTh.exe
  2⤵
  PID:7696
- C:\Windows\System\JwVonKb.exe
  C:\Windows\System\JwVonKb.exe
  2⤵
  PID:7712
- C:\Windows\System\HoIrjRz.exe
  C:\Windows\System\HoIrjRz.exe
  2⤵
  PID:7732
- C:\Windows\System\yreCqZd.exe
  C:\Windows\System\yreCqZd.exe
  2⤵
  PID:7752
- C:\Windows\System\QiWPCwG.exe
  C:\Windows\System\QiWPCwG.exe
  2⤵
  PID:7784
- C:\Windows\System\POaOyWK.exe
  C:\Windows\System\POaOyWK.exe
  2⤵
  PID:7800
- C:\Windows\System\vjBKnSI.exe
  C:\Windows\System\vjBKnSI.exe
  2⤵
  PID:7820
- C:\Windows\System\XFtFaIB.exe
  C:\Windows\System\XFtFaIB.exe
  2⤵
  PID:7836
- C:\Windows\System\nMjEgIV.exe
  C:\Windows\System\nMjEgIV.exe
  2⤵
  PID:7856
- C:\Windows\System\LThOuUo.exe
  C:\Windows\System\LThOuUo.exe
  2⤵
  PID:7872
- C:\Windows\System\GjJzpen.exe
  C:\Windows\System\GjJzpen.exe
  2⤵
  PID:7892
- C:\Windows\System\sOMJWxs.exe
  C:\Windows\System\sOMJWxs.exe
  2⤵
  PID:7908
- C:\Windows\System\FwGkBYW.exe
  C:\Windows\System\FwGkBYW.exe
  2⤵
  PID:7932
- C:\Windows\System\WMaPmUp.exe
  C:\Windows\System\WMaPmUp.exe
  2⤵
  PID:7952
- C:\Windows\System\nijTvic.exe
  C:\Windows\System\nijTvic.exe
  2⤵
  PID:7968
- C:\Windows\System\TxiXEzR.exe
  C:\Windows\System\TxiXEzR.exe
  2⤵
  PID:7984
- C:\Windows\System\fpoKQEI.exe
  C:\Windows\System\fpoKQEI.exe
  2⤵
  PID:8000
- C:\Windows\System\DEaBduT.exe
  C:\Windows\System\DEaBduT.exe
  2⤵
  PID:8016
- C:\Windows\System\DjOMnei.exe
  C:\Windows\System\DjOMnei.exe
  2⤵
  PID:8036
- C:\Windows\System\sXLevUt.exe
  C:\Windows\System\sXLevUt.exe
  2⤵
  PID:8060
- C:\Windows\System\eNkOQcv.exe
  C:\Windows\System\eNkOQcv.exe
  2⤵
  PID:8076
- C:\Windows\System\gxENbcS.exe
  C:\Windows\System\gxENbcS.exe
  2⤵
  PID:8092
- C:\Windows\System\edbpMOb.exe
  C:\Windows\System\edbpMOb.exe
  2⤵
  PID:8108
- C:\Windows\System\CtGKyJe.exe
  C:\Windows\System\CtGKyJe.exe
  2⤵
  PID:8124
- C:\Windows\System\tbmZXUC.exe
  C:\Windows\System\tbmZXUC.exe
  2⤵
  PID:8144
- C:\Windows\System\ursIExS.exe
  C:\Windows\System\ursIExS.exe
  2⤵
  PID:8180
- C:\Windows\System\hrBtJbC.exe
  C:\Windows\System\hrBtJbC.exe
  2⤵
  PID:6744
- C:\Windows\System\NYXEGCb.exe
  C:\Windows\System\NYXEGCb.exe
  2⤵
  PID:7248
- C:\Windows\System\jEiDYpY.exe
  C:\Windows\System\jEiDYpY.exe
  2⤵
  PID:6988
- C:\Windows\System\QyEDNWc.exe
  C:\Windows\System\QyEDNWc.exe
  2⤵
  PID:7224
- C:\Windows\System\LQhcqMd.exe
  C:\Windows\System\LQhcqMd.exe
  2⤵
  PID:6380
- C:\Windows\System\lDlBQyu.exe
  C:\Windows\System\lDlBQyu.exe
  2⤵
  PID:6504
- C:\Windows\System\DvLnwia.exe
  C:\Windows\System\DvLnwia.exe
  2⤵
  PID:7320
- C:\Windows\System\kqqxqLE.exe
  C:\Windows\System\kqqxqLE.exe
  2⤵
  PID:7196
- C:\Windows\System\YrarQRE.exe
  C:\Windows\System\YrarQRE.exe
  2⤵
  PID:7304
- C:\Windows\System\dOHeAbM.exe
  C:\Windows\System\dOHeAbM.exe
  2⤵
  PID:6608
- C:\Windows\System\tzvIofm.exe
  C:\Windows\System\tzvIofm.exe
  2⤵
  PID:6680
- C:\Windows\System\crRYGmU.exe
  C:\Windows\System\crRYGmU.exe
  2⤵
  PID:7372
- C:\Windows\System\xbGiiHW.exe
  C:\Windows\System\xbGiiHW.exe
  2⤵
  PID:6840
- C:\Windows\System\WgpQlAP.exe
  C:\Windows\System\WgpQlAP.exe
  2⤵
  PID:7396
- C:\Windows\System\Qanwdgw.exe
  C:\Windows\System\Qanwdgw.exe
  2⤵
  PID:7440
- C:\Windows\System\gLFjMEq.exe
  C:\Windows\System\gLFjMEq.exe
  2⤵
  PID:7444
- C:\Windows\System\fAXfxeE.exe
  C:\Windows\System\fAXfxeE.exe
  2⤵
  PID:7464
- C:\Windows\System\jUdEUur.exe
  C:\Windows\System\jUdEUur.exe
  2⤵
  PID:7528
- C:\Windows\System\wifGadq.exe
  C:\Windows\System\wifGadq.exe
  2⤵
  PID:7540
- C:\Windows\System\KTZczCP.exe
  C:\Windows\System\KTZczCP.exe
  2⤵
  PID:7512
- C:\Windows\System\ESsJdzz.exe
  C:\Windows\System\ESsJdzz.exe
  2⤵
  PID:7672
- C:\Windows\System\UrXdCUD.exe
  C:\Windows\System\UrXdCUD.exe
  2⤵
  PID:7764
- C:\Windows\System\hSFESiF.exe
  C:\Windows\System\hSFESiF.exe
  2⤵
  PID:7744
- C:\Windows\System\eObBvCf.exe
  C:\Windows\System\eObBvCf.exe
  2⤵
  PID:7808
- C:\Windows\System\wCiFMPb.exe
  C:\Windows\System\wCiFMPb.exe
  2⤵
  PID:7884
- C:\Windows\System\eckRUnC.exe
  C:\Windows\System\eckRUnC.exe
  2⤵
  PID:7916
- C:\Windows\System\zBKSbpL.exe
  C:\Windows\System\zBKSbpL.exe
  2⤵
  PID:7960
- C:\Windows\System\IrFgpQt.exe
  C:\Windows\System\IrFgpQt.exe
  2⤵
  PID:8024
- C:\Windows\System\hKVLAEY.exe
  C:\Windows\System\hKVLAEY.exe
  2⤵
  PID:8072
- C:\Windows\System\ncCoUPD.exe
  C:\Windows\System\ncCoUPD.exe
  2⤵
  PID:8140
- C:\Windows\System\lxhpHKq.exe
  C:\Windows\System\lxhpHKq.exe
  2⤵
  PID:7980
- C:\Windows\System\mdVmlnX.exe
  C:\Windows\System\mdVmlnX.exe
  2⤵
  PID:7828
- C:\Windows\System\WrRfgBG.exe
  C:\Windows\System\WrRfgBG.exe
  2⤵
  PID:8156
- C:\Windows\System\DCrgzNf.exe
  C:\Windows\System\DCrgzNf.exe
  2⤵
  PID:8164
- C:\Windows\System\oWEpUOG.exe
  C:\Windows\System\oWEpUOG.exe
  2⤵
  PID:1444
- C:\Windows\System\JeLKwMN.exe
  C:\Windows\System\JeLKwMN.exe
  2⤵
  PID:7240
- C:\Windows\System\aBgvzoI.exe
  C:\Windows\System\aBgvzoI.exe
  2⤵
  PID:5184
- C:\Windows\System\aNIWnOk.exe
  C:\Windows\System\aNIWnOk.exe
  2⤵
  PID:6308
- C:\Windows\System\ZNDsaRk.exe
  C:\Windows\System\ZNDsaRk.exe
  2⤵
  PID:8172
- C:\Windows\System\PBAZADX.exe
  C:\Windows\System\PBAZADX.exe
  2⤵
  PID:7452
- C:\Windows\System\UOqHssX.exe
  C:\Windows\System\UOqHssX.exe
  2⤵
  PID:6844
- C:\Windows\System\twuPoWc.exe
  C:\Windows\System\twuPoWc.exe
  2⤵
  PID:7352
- C:\Windows\System\TLkrkXv.exe
  C:\Windows\System\TLkrkXv.exe
  2⤵
  PID:7412
- C:\Windows\System\AvRebno.exe
  C:\Windows\System\AvRebno.exe
  2⤵
  PID:6692
- C:\Windows\System\oIItygp.exe
  C:\Windows\System\oIItygp.exe
  2⤵
  PID:6816
- C:\Windows\System\VOwHIRt.exe
  C:\Windows\System\VOwHIRt.exe
  2⤵
  PID:5944
- C:\Windows\System\QYOaoKO.exe
  C:\Windows\System\QYOaoKO.exe
  2⤵
  PID:7584
- C:\Windows\System\YtbsGEA.exe
  C:\Windows\System\YtbsGEA.exe
  2⤵
  PID:7620
- C:\Windows\System\rYDFqFO.exe
  C:\Windows\System\rYDFqFO.exe
  2⤵
  PID:7640
- C:\Windows\System\DEOegWn.exe
  C:\Windows\System\DEOegWn.exe
  2⤵
  PID:7704
- C:\Windows\System\EdCMuCQ.exe
  C:\Windows\System\EdCMuCQ.exe
  2⤵
  PID:7776
- C:\Windows\System\QNpvkZc.exe
  C:\Windows\System\QNpvkZc.exe
  2⤵
  PID:7880
- C:\Windows\System\caMhrSZ.exe
  C:\Windows\System\caMhrSZ.exe
  2⤵
  PID:7904
- C:\Windows\System\roXYklE.exe
  C:\Windows\System\roXYklE.exe
  2⤵
  PID:7992
- C:\Windows\System\wqxNcfW.exe
  C:\Windows\System\wqxNcfW.exe
  2⤵
  PID:8136
- C:\Windows\System\FTklqfK.exe
  C:\Windows\System\FTklqfK.exe
  2⤵
  PID:7948
- C:\Windows\System\FcdnZoQ.exe
  C:\Windows\System\FcdnZoQ.exe
  2⤵
  PID:6756
- C:\Windows\System\sKofucK.exe
  C:\Windows\System\sKofucK.exe
  2⤵
  PID:6164
- C:\Windows\System\EbjaJHi.exe
  C:\Windows\System\EbjaJHi.exe
  2⤵
  PID:7600
- C:\Windows\System\AhqHwjH.exe
  C:\Windows\System\AhqHwjH.exe
  2⤵
  PID:6996
- C:\Windows\System\TXNjYno.exe
  C:\Windows\System\TXNjYno.exe
  2⤵
  PID:7624
- C:\Windows\System\rTUcNxt.exe
  C:\Windows\System\rTUcNxt.exe
  2⤵
  PID:8056
- C:\Windows\System\OHZODoX.exe
  C:\Windows\System\OHZODoX.exe
  2⤵
  PID:7560
- C:\Windows\System\YrazMrq.exe
  C:\Windows\System\YrazMrq.exe
  2⤵
  PID:7348
- C:\Windows\System\KkjoXHR.exe
  C:\Windows\System\KkjoXHR.exe
  2⤵
  PID:7080
- C:\Windows\System\IjhcIdp.exe
  C:\Windows\System\IjhcIdp.exe
  2⤵
  PID:7684
- C:\Windows\System\RWxrZPt.exe
  C:\Windows\System\RWxrZPt.exe
  2⤵
  PID:7748
- C:\Windows\System\SnqNAOW.exe
  C:\Windows\System\SnqNAOW.exe
  2⤵
  PID:8168
- C:\Windows\System\TgormOh.exe
  C:\Windows\System\TgormOh.exe
  2⤵
  PID:7928
- C:\Windows\System\AavxUDb.exe
  C:\Windows\System\AavxUDb.exe
  2⤵
  PID:8008
- C:\Windows\System\lmdxGwU.exe
  C:\Windows\System\lmdxGwU.exe
  2⤵
  PID:8176
- C:\Windows\System\UkBfBWQ.exe
  C:\Windows\System\UkBfBWQ.exe
  2⤵
  PID:8084
- C:\Windows\System\ytsqOSF.exe
  C:\Windows\System\ytsqOSF.exe
  2⤵
  PID:7260
- C:\Windows\System\MUucPpv.exe
  C:\Windows\System\MUucPpv.exe
  2⤵
  PID:7692
- C:\Windows\System\zwJQCWl.exe
  C:\Windows\System\zwJQCWl.exe
  2⤵
  PID:5728
- C:\Windows\System\NkrBfpd.exe
  C:\Windows\System\NkrBfpd.exe
  2⤵
  PID:7652
- C:\Windows\System\sfdtQtl.exe
  C:\Windows\System\sfdtQtl.exe
  2⤵
  PID:7900
- C:\Windows\System\lmLURrT.exe
  C:\Windows\System\lmLURrT.exe
  2⤵
  PID:7944
- C:\Windows\System\KIPxfyv.exe
  C:\Windows\System\KIPxfyv.exe
  2⤵
  PID:1732
- C:\Windows\System\kEcRDdc.exe
  C:\Windows\System\kEcRDdc.exe
  2⤵
  PID:7364
- C:\Windows\System\zpHZNid.exe
  C:\Windows\System\zpHZNid.exe
  2⤵
  PID:7192
- C:\Windows\System\PNAMFiv.exe
  C:\Windows\System\PNAMFiv.exe
  2⤵
  PID:8032
- C:\Windows\System\nNuNVpE.exe
  C:\Windows\System\nNuNVpE.exe
  2⤵
  PID:7844
- C:\Windows\System\WrEfoaY.exe
  C:\Windows\System\WrEfoaY.exe
  2⤵
  PID:8088
- C:\Windows\System\xPjEqlz.exe
  C:\Windows\System\xPjEqlz.exe
  2⤵
  PID:5940
- C:\Windows\System\zmhzKGp.exe
  C:\Windows\System\zmhzKGp.exe
  2⤵
  PID:7720
- C:\Windows\System\KQBFPaq.exe
  C:\Windows\System\KQBFPaq.exe
  2⤵
  PID:5924
- C:\Windows\System\pilvCRW.exe
  C:\Windows\System\pilvCRW.exe
  2⤵
  PID:8132
- C:\Windows\System\PdwaIrN.exe
  C:\Windows\System\PdwaIrN.exe
  2⤵
  PID:7940
- C:\Windows\System\mgrTJZd.exe
  C:\Windows\System\mgrTJZd.exe
  2⤵
  PID:8204
- C:\Windows\System\cPTJLQJ.exe
  C:\Windows\System\cPTJLQJ.exe
  2⤵
  PID:8232
- C:\Windows\System\UPmHaIg.exe
  C:\Windows\System\UPmHaIg.exe
  2⤵
  PID:8252
- C:\Windows\System\gyrEfIf.exe
  C:\Windows\System\gyrEfIf.exe
  2⤵
  PID:8268
- C:\Windows\System\eIDMEHm.exe
  C:\Windows\System\eIDMEHm.exe
  2⤵
  PID:8284
- C:\Windows\System\vjEdlSU.exe
  C:\Windows\System\vjEdlSU.exe
  2⤵
  PID:8304
- C:\Windows\System\mgQhBZa.exe
  C:\Windows\System\mgQhBZa.exe
  2⤵
  PID:8344
- C:\Windows\System\GqEiKpn.exe
  C:\Windows\System\GqEiKpn.exe
  2⤵
  PID:8360
- C:\Windows\System\fnVGZof.exe
  C:\Windows\System\fnVGZof.exe
  2⤵
  PID:8376
- C:\Windows\System\iiKLnWf.exe
  C:\Windows\System\iiKLnWf.exe
  2⤵
  PID:8396
- C:\Windows\System\cWxEtwA.exe
  C:\Windows\System\cWxEtwA.exe
  2⤵
  PID:8416
- C:\Windows\System\apJYzgP.exe
  C:\Windows\System\apJYzgP.exe
  2⤵
  PID:8432
- C:\Windows\System\bUQLuAA.exe
  C:\Windows\System\bUQLuAA.exe
  2⤵
  PID:8448
- C:\Windows\System\HBUMpJO.exe
  C:\Windows\System\HBUMpJO.exe
  2⤵
  PID:8464
- C:\Windows\System\PFDtFtX.exe
  C:\Windows\System\PFDtFtX.exe
  2⤵
  PID:8496
- C:\Windows\System\zSvkYIZ.exe
  C:\Windows\System\zSvkYIZ.exe
  2⤵
  PID:8512
- C:\Windows\System\YDECMem.exe
  C:\Windows\System\YDECMem.exe
  2⤵
  PID:8532
- C:\Windows\System\pokvhMp.exe
  C:\Windows\System\pokvhMp.exe
  2⤵
  PID:8552
- C:\Windows\System\cICIucw.exe
  C:\Windows\System\cICIucw.exe
  2⤵
  PID:8568
- C:\Windows\System\AnPXUtJ.exe
  C:\Windows\System\AnPXUtJ.exe
  2⤵
  PID:8584
- C:\Windows\System\ltWqOqp.exe
  C:\Windows\System\ltWqOqp.exe
  2⤵
  PID:8604
- C:\Windows\System\zEqmtDC.exe
  C:\Windows\System\zEqmtDC.exe
  2⤵
  PID:8624
- C:\Windows\System\GRAWJuA.exe
  C:\Windows\System\GRAWJuA.exe
  2⤵
  PID:8640
- C:\Windows\System\Npormdh.exe
  C:\Windows\System\Npormdh.exe
  2⤵
  PID:8656
- C:\Windows\System\NAlOkuc.exe
  C:\Windows\System\NAlOkuc.exe
  2⤵
  PID:8680
- C:\Windows\System\kpQJXYW.exe
  C:\Windows\System\kpQJXYW.exe
  2⤵
  PID:8724
- C:\Windows\System\qfcFwZa.exe
  C:\Windows\System\qfcFwZa.exe
  2⤵
  PID:8740
- C:\Windows\System\xYBllul.exe
  C:\Windows\System\xYBllul.exe
  2⤵
  PID:8764
- C:\Windows\System\ZyeiowN.exe
  C:\Windows\System\ZyeiowN.exe
  2⤵
  PID:8780
- C:\Windows\System\INULKhC.exe
  C:\Windows\System\INULKhC.exe
  2⤵
  PID:8796
- C:\Windows\System\twhurty.exe
  C:\Windows\System\twhurty.exe
  2⤵
  PID:8812
- C:\Windows\System\WQzJbju.exe
  C:\Windows\System\WQzJbju.exe
  2⤵
  PID:8852
- C:\Windows\System\USGyAEM.exe
  C:\Windows\System\USGyAEM.exe
  2⤵
  PID:8868
- C:\Windows\System\ThVhNOG.exe
  C:\Windows\System\ThVhNOG.exe
  2⤵
  PID:8892
- C:\Windows\System\fSgeVdS.exe
  C:\Windows\System\fSgeVdS.exe
  2⤵
  PID:8908
- C:\Windows\System\YRcHtOk.exe
  C:\Windows\System\YRcHtOk.exe
  2⤵
  PID:8924
- C:\Windows\System\yZoDirN.exe
  C:\Windows\System\yZoDirN.exe
  2⤵
  PID:8940
- C:\Windows\System\xMMtZkO.exe
  C:\Windows\System\xMMtZkO.exe
  2⤵
  PID:8960
- C:\Windows\System\qKySgKi.exe
  C:\Windows\System\qKySgKi.exe
  2⤵
  PID:8976
- C:\Windows\System\GbrzAcF.exe
  C:\Windows\System\GbrzAcF.exe
  2⤵
  PID:8996
- C:\Windows\System\uvLmosT.exe
  C:\Windows\System\uvLmosT.exe
  2⤵
  PID:9012
- C:\Windows\System\UYGopKO.exe
  C:\Windows\System\UYGopKO.exe
  2⤵
  PID:9032
- C:\Windows\System\wShuElz.exe
  C:\Windows\System\wShuElz.exe
  2⤵
  PID:9048
- C:\Windows\System\vZvpLTn.exe
  C:\Windows\System\vZvpLTn.exe
  2⤵
  PID:9068
- C:\Windows\System\oFAanuS.exe
  C:\Windows\System\oFAanuS.exe
  2⤵
  PID:9088
- C:\Windows\System\eqXyKOl.exe
  C:\Windows\System\eqXyKOl.exe
  2⤵
  PID:9116
- C:\Windows\System\IqTSTCw.exe
  C:\Windows\System\IqTSTCw.exe
  2⤵
  PID:9152
- C:\Windows\System\erhpEpD.exe
  C:\Windows\System\erhpEpD.exe
  2⤵
  PID:9168
- C:\Windows\System\jsStgzA.exe
  C:\Windows\System\jsStgzA.exe
  2⤵
  PID:9184
- C:\Windows\System\rgjlnjx.exe
  C:\Windows\System\rgjlnjx.exe
  2⤵
  PID:7284
- C:\Windows\System\hLWsqzd.exe
  C:\Windows\System\hLWsqzd.exe
  2⤵
  PID:7612
- C:\Windows\System\iQdxgdC.exe
  C:\Windows\System\iQdxgdC.exe
  2⤵
  PID:8228
- C:\Windows\System\VAglATg.exe
  C:\Windows\System\VAglATg.exe
  2⤵
  PID:8264
- C:\Windows\System\IsbVrKY.exe
  C:\Windows\System\IsbVrKY.exe
  2⤵
  PID:8296
- C:\Windows\System\Bgefuvz.exe
  C:\Windows\System\Bgefuvz.exe
  2⤵
  PID:7768
- C:\Windows\System\xhhLJSf.exe
  C:\Windows\System\xhhLJSf.exe
  2⤵
  PID:8352
- C:\Windows\System\IYTekSe.exe
  C:\Windows\System\IYTekSe.exe
  2⤵
  PID:8404
- C:\Windows\System\EmsgTHP.exe
  C:\Windows\System\EmsgTHP.exe
  2⤵
  PID:8412
- C:\Windows\System\VDHAjGi.exe
  C:\Windows\System\VDHAjGi.exe
  2⤵
  PID:8476
- C:\Windows\System\yhXRYGy.exe
  C:\Windows\System\yhXRYGy.exe
  2⤵
  PID:8540
- C:\Windows\System\fgKpOKX.exe
  C:\Windows\System\fgKpOKX.exe
  2⤵
  PID:8576
- C:\Windows\System\HbCHWiF.exe
  C:\Windows\System\HbCHWiF.exe
  2⤵
  PID:8616
- C:\Windows\System\xNNtACC.exe
  C:\Windows\System\xNNtACC.exe
  2⤵
  PID:8488
- C:\Windows\System\QPtyQkg.exe
  C:\Windows\System\QPtyQkg.exe
  2⤵
  PID:8636
- C:\Windows\System\GonjDWD.exe
  C:\Windows\System\GonjDWD.exe
  2⤵
  PID:8520
- C:\Windows\System\mMapXVP.exe
  C:\Windows\System\mMapXVP.exe
  2⤵
  PID:8692
- C:\Windows\System\jBawZsr.exe
  C:\Windows\System\jBawZsr.exe
  2⤵
  PID:8704
- C:\Windows\System\LwzYDDX.exe
  C:\Windows\System\LwzYDDX.exe
  2⤵
  PID:8772
- C:\Windows\System\qLLVkvm.exe
  C:\Windows\System\qLLVkvm.exe
  2⤵
  PID:8804
- C:\Windows\System\dXEvOad.exe
  C:\Windows\System\dXEvOad.exe
  2⤵
  PID:8828
- C:\Windows\System\AbldpNB.exe
  C:\Windows\System\AbldpNB.exe
  2⤵
  PID:8848
- C:\Windows\System\gVWNqzd.exe
  C:\Windows\System\gVWNqzd.exe
  2⤵
  PID:8916
- C:\Windows\System\YKbXQat.exe
  C:\Windows\System\YKbXQat.exe
  2⤵
  PID:8936
- C:\Windows\System\jBymZkF.exe
  C:\Windows\System\jBymZkF.exe
  2⤵
  PID:8984
- C:\Windows\System\EHMbcmL.exe
  C:\Windows\System\EHMbcmL.exe
  2⤵
  PID:9056
- C:\Windows\System\djfnxPx.exe
  C:\Windows\System\djfnxPx.exe
  2⤵
  PID:9104
- C:\Windows\System\iqGUpOh.exe
  C:\Windows\System\iqGUpOh.exe
  2⤵
  PID:9004
- C:\Windows\System\Exwahcy.exe
  C:\Windows\System\Exwahcy.exe
  2⤵
  PID:9084
- C:\Windows\System\cHkZhfs.exe
  C:\Windows\System\cHkZhfs.exe
  2⤵
  PID:9136
- C:\Windows\System\baLRnur.exe
  C:\Windows\System\baLRnur.exe
  2⤵
  PID:9148
- C:\Windows\System\vLmgyxL.exe
  C:\Windows\System\vLmgyxL.exe
  2⤵
  PID:9196
- C:\Windows\System\gcWIepj.exe
  C:\Windows\System\gcWIepj.exe
  2⤵
  PID:6432
- C:\Windows\System\dzjtqvH.exe
  C:\Windows\System\dzjtqvH.exe
  2⤵
  PID:9212
- C:\Windows\System\ZWjnulX.exe
  C:\Windows\System\ZWjnulX.exe
  2⤵
  PID:8280
- C:\Windows\System\ypigExe.exe
  C:\Windows\System\ypigExe.exe
  2⤵
  PID:8340
- C:\Windows\System\biPJonw.exe
  C:\Windows\System\biPJonw.exe
  2⤵
  PID:8384
- C:\Windows\System\OIPsIJp.exe
  C:\Windows\System\OIPsIJp.exe
  2⤵
  PID:8428
- C:\Windows\System\VcHRiVZ.exe
  C:\Windows\System\VcHRiVZ.exe
  2⤵
  PID:8508
- C:\Windows\System\btsfhVt.exe
  C:\Windows\System\btsfhVt.exe
  2⤵
  PID:8648
- C:\Windows\System\uQSyjsZ.exe
  C:\Windows\System\uQSyjsZ.exe
  2⤵
  PID:8528
- C:\Windows\System\ouQtJgy.exe
  C:\Windows\System\ouQtJgy.exe
  2⤵
  PID:8696
- C:\Windows\System\CHPIIQI.exe
  C:\Windows\System\CHPIIQI.exe
  2⤵
  PID:8732
- C:\Windows\System\NHEQcgV.exe
  C:\Windows\System\NHEQcgV.exe
  2⤵
  PID:8792
- C:\Windows\System\xxfueqZ.exe
  C:\Windows\System\xxfueqZ.exe
  2⤵
  PID:8864
- C:\Windows\System\xNFWzkO.exe
  C:\Windows\System\xNFWzkO.exe
  2⤵
  PID:8884
- C:\Windows\System\fkQExqt.exe
  C:\Windows\System\fkQExqt.exe
  2⤵
  PID:8904
- C:\Windows\System\THcCeTS.exe
  C:\Windows\System\THcCeTS.exe
  2⤵
  PID:9024
- C:\Windows\System\MKJdZPe.exe
  C:\Windows\System\MKJdZPe.exe
  2⤵
  PID:9096
- C:\Windows\System\XccwduT.exe
  C:\Windows\System\XccwduT.exe
  2⤵
  PID:9040
- C:\Windows\System\AVXiZRi.exe
  C:\Windows\System\AVXiZRi.exe
  2⤵
  PID:9132
- C:\Windows\System\PyPlUPB.exe
  C:\Windows\System\PyPlUPB.exe
  2⤵
  PID:1552
- C:\Windows\System\lrQKYHw.exe
  C:\Windows\System\lrQKYHw.exe
  2⤵
  PID:9180
- C:\Windows\System\nEJZUmg.exe
  C:\Windows\System\nEJZUmg.exe
  2⤵
  PID:8216
- C:\Windows\System\KmeTZiJ.exe
  C:\Windows\System\KmeTZiJ.exe
  2⤵
  PID:8324
- C:\Windows\System\EspeKyK.exe
  C:\Windows\System\EspeKyK.exe
  2⤵
  PID:8580
- C:\Windows\System\uFONtmE.exe
  C:\Windows\System\uFONtmE.exe
  2⤵
  PID:8716
- C:\Windows\System\BRYIyrH.exe
  C:\Windows\System\BRYIyrH.exe
  2⤵
  PID:8720
- C:\Windows\System\OTTlZsJ.exe
  C:\Windows\System\OTTlZsJ.exe
  2⤵
  PID:8820
- C:\Windows\System\yzIfuBh.exe
  C:\Windows\System\yzIfuBh.exe
  2⤵
  PID:8900
- C:\Windows\System\XLzCDDA.exe
  C:\Windows\System\XLzCDDA.exe
  2⤵
  PID:9044
- C:\Windows\System\HavMpcF.exe
  C:\Windows\System\HavMpcF.exe
  2⤵
  PID:9192
- C:\Windows\System\ntAUetl.exe
  C:\Windows\System\ntAUetl.exe
  2⤵
  PID:8968
- C:\Windows\System\RoPDufk.exe
  C:\Windows\System\RoPDufk.exe
  2⤵
  PID:8200
- C:\Windows\System\ZsDtAhG.exe
  C:\Windows\System\ZsDtAhG.exe
  2⤵
  PID:8444
- C:\Windows\System\tWFafIP.exe
  C:\Windows\System\tWFafIP.exe
  2⤵
  PID:9208
- C:\Windows\System\QSqsuZy.exe
  C:\Windows\System\QSqsuZy.exe
  2⤵
  PID:8712
- C:\Windows\System\UIoxIJZ.exe
  C:\Windows\System\UIoxIJZ.exe
  2⤵
  PID:9100
- C:\Windows\System\NIkGBKP.exe
  C:\Windows\System\NIkGBKP.exe
  2⤵
  PID:8700
- C:\Windows\System\ArmBJuD.exe
  C:\Windows\System\ArmBJuD.exe
  2⤵
  PID:9176
- C:\Windows\System\gUiFRzl.exe
  C:\Windows\System\gUiFRzl.exe
  2⤵
  PID:8956
- C:\Windows\System\AnmHoIY.exe
  C:\Windows\System\AnmHoIY.exe
  2⤵
  PID:8372
- C:\Windows\System\mHhzVdO.exe
  C:\Windows\System\mHhzVdO.exe
  2⤵
  PID:8760
- C:\Windows\System\xpbznMI.exe
  C:\Windows\System\xpbznMI.exe
  2⤵
  PID:8312
- C:\Windows\System\KRvRwSQ.exe
  C:\Windows\System\KRvRwSQ.exe
  2⤵
  PID:9220
- C:\Windows\System\hEpnmvH.exe
  C:\Windows\System\hEpnmvH.exe
  2⤵
  PID:9240
- C:\Windows\System\bjjYnBz.exe
  C:\Windows\System\bjjYnBz.exe
  2⤵
  PID:9260
- C:\Windows\System\LDIwiXu.exe
  C:\Windows\System\LDIwiXu.exe
  2⤵
  PID:9284
- C:\Windows\System\PwZPvuv.exe
  C:\Windows\System\PwZPvuv.exe
  2⤵
  PID:9324
- C:\Windows\System\dOwJnCw.exe
  C:\Windows\System\dOwJnCw.exe
  2⤵
  PID:9340
- C:\Windows\System\CtXgbyx.exe
  C:\Windows\System\CtXgbyx.exe
  2⤵
  PID:9356
- C:\Windows\System\CwszBzf.exe
  C:\Windows\System\CwszBzf.exe
  2⤵
  PID:9376
- C:\Windows\System\ReCtpNH.exe
  C:\Windows\System\ReCtpNH.exe
  2⤵
  PID:9400
- C:\Windows\System\bxxNvhm.exe
  C:\Windows\System\bxxNvhm.exe
  2⤵
  PID:9424
- C:\Windows\System\qkkUYIk.exe
  C:\Windows\System\qkkUYIk.exe
  2⤵
  PID:9440
- C:\Windows\System\PJNIlOQ.exe
  C:\Windows\System\PJNIlOQ.exe
  2⤵
  PID:9456
- C:\Windows\System\gnukblz.exe
  C:\Windows\System\gnukblz.exe
  2⤵
  PID:9476
- C:\Windows\System\oxWOYEm.exe
  C:\Windows\System\oxWOYEm.exe
  2⤵
  PID:9496
- C:\Windows\System\tQWFTir.exe
  C:\Windows\System\tQWFTir.exe
  2⤵
  PID:9516
- C:\Windows\System\rNPFFvI.exe
  C:\Windows\System\rNPFFvI.exe
  2⤵
  PID:9540
- C:\Windows\System\JVtEIRG.exe
  C:\Windows\System\JVtEIRG.exe
  2⤵
  PID:9556
- C:\Windows\System\TEXFICS.exe
  C:\Windows\System\TEXFICS.exe
  2⤵
  PID:9572
- C:\Windows\System\JPOWTvV.exe
  C:\Windows\System\JPOWTvV.exe
  2⤵
  PID:9592
- C:\Windows\System\MdgiJjp.exe
  C:\Windows\System\MdgiJjp.exe
  2⤵
  PID:9616
- C:\Windows\System\dUaunkG.exe
  C:\Windows\System\dUaunkG.exe
  2⤵
  PID:9632
- C:\Windows\System\lEFvtHD.exe
  C:\Windows\System\lEFvtHD.exe
  2⤵
  PID:9648
- C:\Windows\System\ozsRPwW.exe
  C:\Windows\System\ozsRPwW.exe
  2⤵
  PID:9668
- C:\Windows\System\AngnPyN.exe
  C:\Windows\System\AngnPyN.exe
  2⤵
  PID:9692
- C:\Windows\System\troBTEl.exe
  C:\Windows\System\troBTEl.exe
  2⤵
  PID:9708
- C:\Windows\System\ODJzNpk.exe
  C:\Windows\System\ODJzNpk.exe
  2⤵
  PID:9724
- C:\Windows\System\iBQyAWN.exe
  C:\Windows\System\iBQyAWN.exe
  2⤵
  PID:9740
- C:\Windows\System\YHoGmUr.exe
  C:\Windows\System\YHoGmUr.exe
  2⤵
  PID:9760
- C:\Windows\System\nfJblTO.exe
  C:\Windows\System\nfJblTO.exe
  2⤵
  PID:9776
- C:\Windows\System\xiRmQDY.exe
  C:\Windows\System\xiRmQDY.exe
  2⤵
  PID:9796
- C:\Windows\System\lWWbPdt.exe
  C:\Windows\System\lWWbPdt.exe
  2⤵
  PID:9816
- C:\Windows\System\BnoLMuc.exe
  C:\Windows\System\BnoLMuc.exe
  2⤵
  PID:9836
- C:\Windows\System\uDKgRKR.exe
  C:\Windows\System\uDKgRKR.exe
  2⤵
  PID:9860
- C:\Windows\System\qjQeHWP.exe
  C:\Windows\System\qjQeHWP.exe
  2⤵
  PID:9876
- C:\Windows\System\RGOMjOa.exe
  C:\Windows\System\RGOMjOa.exe
  2⤵
  PID:9892
- C:\Windows\System\YJHXXAe.exe
  C:\Windows\System\YJHXXAe.exe
  2⤵
  PID:9916
- C:\Windows\System\LCHwGjN.exe
  C:\Windows\System\LCHwGjN.exe
  2⤵
  PID:9936
- C:\Windows\System\GhbhfQi.exe
  C:\Windows\System\GhbhfQi.exe
  2⤵
  PID:9952
- C:\Windows\System\PeUYldT.exe
  C:\Windows\System\PeUYldT.exe
  2⤵
  PID:10008
- C:\Windows\System\BfHlmbb.exe
  C:\Windows\System\BfHlmbb.exe
  2⤵
  PID:10028
- C:\Windows\System\kWzSqTj.exe
  C:\Windows\System\kWzSqTj.exe
  2⤵
  PID:10044
- C:\Windows\System\yaZUdre.exe
  C:\Windows\System\yaZUdre.exe
  2⤵
  PID:10060
- C:\Windows\System\kmQNJJh.exe
  C:\Windows\System\kmQNJJh.exe
  2⤵
  PID:10076
- C:\Windows\System\hRuFgbe.exe
  C:\Windows\System\hRuFgbe.exe
  2⤵
  PID:10096
- C:\Windows\System\gLYKxZp.exe
  C:\Windows\System\gLYKxZp.exe
  2⤵
  PID:10120
- C:\Windows\System\uasoeDx.exe
  C:\Windows\System\uasoeDx.exe
  2⤵
  PID:10136
- C:\Windows\System\xFlKZgX.exe
  C:\Windows\System\xFlKZgX.exe
  2⤵
  PID:10152
- C:\Windows\System\SKHlxAB.exe
  C:\Windows\System\SKHlxAB.exe
  2⤵
  PID:10168
- C:\Windows\System\xCsPyHh.exe
  C:\Windows\System\xCsPyHh.exe
  2⤵
  PID:10196
- C:\Windows\System\ZoKgcCF.exe
  C:\Windows\System\ZoKgcCF.exe
  2⤵
  PID:10216
- C:\Windows\System\otKrCjW.exe
  C:\Windows\System\otKrCjW.exe
  2⤵
  PID:10232
- C:\Windows\System\rCebPCb.exe
  C:\Windows\System\rCebPCb.exe
  2⤵
  PID:9248
- C:\Windows\System\pRJjDDU.exe
  C:\Windows\System\pRJjDDU.exe
  2⤵
  PID:8992
- C:\Windows\System\bmwnOfX.exe
  C:\Windows\System\bmwnOfX.exe
  2⤵
  PID:8460
- C:\Windows\System\YeFKgEr.exe
  C:\Windows\System\YeFKgEr.exe
  2⤵
  PID:8332
- C:\Windows\System\NDFmuAw.exe
  C:\Windows\System\NDFmuAw.exe
  2⤵
  PID:9280
- C:\Windows\System\eFDNdbw.exe
  C:\Windows\System\eFDNdbw.exe
  2⤵
  PID:9300
- C:\Windows\System\oIGafzr.exe
  C:\Windows\System\oIGafzr.exe
  2⤵
  PID:8220
- C:\Windows\System\quieINV.exe
  C:\Windows\System\quieINV.exe
  2⤵
  PID:9352
- C:\Windows\System\wFNDIHH.exe
  C:\Windows\System\wFNDIHH.exe
  2⤵
  PID:9384
- C:\Windows\System\MaBMMyA.exe
  C:\Windows\System\MaBMMyA.exe
  2⤵
  PID:9420
- C:\Windows\System\gDHRyKg.exe
  C:\Windows\System\gDHRyKg.exe
  2⤵
  PID:9448
- C:\Windows\System\vSIhjRi.exe
  C:\Windows\System\vSIhjRi.exe
  2⤵
  PID:9492
- C:\Windows\System\wkktZuU.exe
  C:\Windows\System\wkktZuU.exe
  2⤵
  PID:9536
- C:\Windows\System\WBoGWBR.exe
  C:\Windows\System\WBoGWBR.exe
  2⤵
  PID:9588
- C:\Windows\System\xobxhRe.exe
  C:\Windows\System\xobxhRe.exe
  2⤵
  PID:9660
- C:\Windows\System\ithTxXY.exe
  C:\Windows\System\ithTxXY.exe
  2⤵
  PID:9804
- C:\Windows\System\aZWigef.exe
  C:\Windows\System\aZWigef.exe
  2⤵
  PID:9844
- C:\Windows\System\HMAtOqH.exe
  C:\Windows\System\HMAtOqH.exe
  2⤵
  PID:9720
- C:\Windows\System\sBFlkJr.exe
  C:\Windows\System\sBFlkJr.exe
  2⤵
  PID:9788
- C:\Windows\System\sUYsKso.exe
  C:\Windows\System\sUYsKso.exe
  2⤵
  PID:9832
- C:\Windows\System\BDKVXpP.exe
  C:\Windows\System\BDKVXpP.exe
  2⤵
  PID:9680
- C:\Windows\System\epaxxLJ.exe
  C:\Windows\System\epaxxLJ.exe
  2⤵
  PID:9900
- C:\Windows\System\zDWaSUY.exe
  C:\Windows\System\zDWaSUY.exe
  2⤵
  PID:9688
- C:\Windows\System\bSFWvuS.exe
  C:\Windows\System\bSFWvuS.exe
  2⤵
  PID:9296
- C:\Windows\System\gKcHEHM.exe
  C:\Windows\System\gKcHEHM.exe
  2⤵
  PID:9976
- C:\Windows\System\JVNQDRS.exe
  C:\Windows\System\JVNQDRS.exe
  2⤵
  PID:9996
- C:\Windows\System\bqFvDEi.exe
  C:\Windows\System\bqFvDEi.exe
  2⤵
  PID:10024
- C:\Windows\System\htIcIWr.exe
  C:\Windows\System\htIcIWr.exe
  2⤵
  PID:10068
- C:\Windows\System\WYXZjkU.exe
  C:\Windows\System\WYXZjkU.exe
  2⤵
  PID:10144
- C:\Windows\System\gFoTqWt.exe
  C:\Windows\System\gFoTqWt.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

AhkLPie.exe

Path C:\Windows\system\AhkLPie.exe
Size 2.0MB
SHA256 649369fa60ef727a193e590abe41e5007cdc9d7de6240375a5429243635a27fa
MD5 9e2c0b0848f2920bc17fd6da188a59b0
SHA1 f99aab157dfa6461b60f83702210e60e249c569e
SHA512 79c82eff49c0d9c15c69ce1fd23883e14be55981ad8e6aa4bfe7bdd9b0ab26865ef37719dbe64095c4198875b00b66b34525181ff00e00dd726b954d30ff1f93
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5G:BemTLkNdfE0pZri
MD5 SHA1 SHA512 SSDEEP

Submit Download

AqPGMoS.exe

Path C:\Windows\system\AqPGMoS.exe
Size 2.0MB
SHA256 90cede1f97fa2968d8c29c9b6176701a058fd21d3e5d40b481188535ac326394
MD5 81fdd4be2fb1aa7f135b001bf0f8b5ad
SHA1 830741b46acc7d3a9d95de4809a85c08f81102a0
SHA512 39a2b250745216d65bd15a8ef2559982856e2bf20be2b778f8dd8dd6d53a06e37b6fa3828ba5b78a55f5337cbdca1058435fc05673a8822bf30fe128286443d6
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE54:BemTLkNdfE0pZrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

BBRzNAW.exe

Path C:\Windows\system\BBRzNAW.exe
Size 2.0MB
SHA256 25561e580c88108434000d83e29619095100a60f84d9d9e3c124ada6f2e48bf4
MD5 60da76f318e88e71e71366b45b00aab0
SHA1 9337fbbc1e0cb8bcd36767d083eb42c94c3fc636
SHA512 01cb4a17b9e00cb47560d72140a45ad0b4bc71c7bb03eb9383b6728056f15621db2a8472480201c5f9d95cabc069a7a12807c8e8900c03ff7106ffcc4922a52c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5A:BemTLkNdfE0pZr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

BdKVxTT.exe

Path C:\Windows\system\BdKVxTT.exe
Size 2.0MB
SHA256 c1f5a57c0cfbd18a49a08d67280438b648d4eaeddcb36ecd704196d9e1069b4d
MD5 8e179e912b935759989bfecae11e3196
SHA1 286307234e188bb036bf740d2674da994a23197c
SHA512 56b09c02b87422c5643cdfa0401d2fee90b5e6df454f5716752cc46e21cc51dcac5686adee32c857155c577acaa175eb9c5ba071a8a5a17af9265c0a1a6c27fe
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5I:BemTLkNdfE0pZrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

CsqNJki.exe

Path C:\Windows\system\CsqNJki.exe
Size 2.0MB
SHA256 dcc0e2d5a19610cd47c2cae3c8ef8a4a02af6b4f434754d753d8e3cc07b23972
MD5 82c8426c5a330b80045782fc5f2f61e2
SHA1 18606cf377661c967844b7ad10e4a8c5721f7368
SHA512 0ab2ed2540a43a59de87b0ee32863a7d005ea9925c46512bbe1122724021dafed948cddf2f371f302198978e2188627e1db8533ee8bda77269a5a5b77fb8f211
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE54:BemTLkNdfE0pZrU
MD5 SHA1 SHA512 SSDEEP

Submit Download

DAQfIrX.exe

Path C:\Windows\system\DAQfIrX.exe
Size 2.0MB
SHA256 3261ab986aec5c4213c8f40c5c610b9f6daf961fb16041d6f82f6405476d5140
MD5 a9cc6e9a81f7d4d8b528a159eeb0f591
SHA1 0ea3fdfb7157e5526fc745640b783d097e034aab
SHA512 6efd25fa767035caf1f416066967612d7802e894f67eb727e28a130d2a1716f6ca883fbb5c66206a8ceb3d5e62ee2b6801244b3a1357aa1a09298851d6208099
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5h:BemTLkNdfE0pZr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

IxkQaXa.exe

Path C:\Windows\system\IxkQaXa.exe
Size 2.0MB
SHA256 3ad0d4defdf916e8504f7fc5536b693f68a7d5bd7b07f4c662dd86ae7688e374
MD5 da09c36d203f91cb4cda5e66ed863859
SHA1 a44238640c0a26a8230ab038cea4378ac5fbfd71
SHA512 7523f02bbf0e6d77abbbcc7c28574ce17d7db9b94a0560641d90d21b7555a861883d98182a39edb63764f58fc9d1936eaaedec549a36c65386a5ed03927e4e84
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5y:BemTLkNdfE0pZrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

JfWZwmp.exe

Path C:\Windows\system\JfWZwmp.exe
Size 2.0MB
SHA256 6a675ecba5e28d1c9587ea47be37ad58235c482bd824736b966a93917739f9c8
MD5 670a6b08e20e7fa2536dd3a61c388d4e
SHA1 334bfdfc3bca05fc2be2bda92c943e3dccf9811c
SHA512 9f0e518286a9c940aed35d0ff8066743be800a942f44c4342091ac327cb4f2d664dd1cc9b8209e7fce5de6ee0188c2fd46195b0f68ad3b3f827c3a1ed9128a7a
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5l:BemTLkNdfE0pZr5
MD5 SHA1 SHA512 SSDEEP

Submit Download

JlQVlIH.exe

Path C:\Windows\system\JlQVlIH.exe
Size 2.0MB
SHA256 991a3f52aa574ae4c1b6898048068dda85f403067648ea53287cfa96824c8c4d
MD5 6d5911e92f3553687442cc4d3c662860
SHA1 9a5af5850cc0916a293b369a344a421afc258b0c
SHA512 96e440f9f68bf083dfdf592f972da7dc299bb83f5409201f275876d363d7f90c612652aa32d58946674dd11ad3058a619cdeabf62170da8f30bc048d6816fa30
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5t:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JmispBR.exe

Path C:\Windows\system\JmispBR.exe
Size 2.0MB
SHA256 e2f7f9f3abac5852b2dcc3076b574db876f523699c92e84831c92ca6f8e314f6
MD5 1ec563a3d7a3048df193876f6f7a2ca9
SHA1 1567e9ae6fa40c3483c0607bd83acc1c57d20ff5
SHA512 140477f055ae349cf95f31329d00ebfc07e7dc9ba6a4b8783ae60e27844403e40672d522d3b9150e7141ababe50733213b965930f49312da2e5defcb97b2376b
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5N:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

JwmegoM.exe

Path C:\Windows\system\JwmegoM.exe
Size 2.0MB
SHA256 6aadd479fc5bbf87ebe74ab20281c2408aed870c5f2fb73986a7928233f42c9f
MD5 86962d31edc9522d0919b3a39da3b740
SHA1 7274cf5512ad91628c39263e2b2fbc0a9a601a38
SHA512 d8564492576cb4a9256157ece69de1ad5189ab3785bfd09f36dc5f8abfdef00ff07ae5b5b8af49c6f9c432c5bcb35395f5c16b72cc13a0cdfcb382d0abd5be48
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5k:BemTLkNdfE0pZrA
MD5 SHA1 SHA512 SSDEEP

Submit Download

OUriVEY.exe

Path C:\Windows\system\OUriVEY.exe
Size 2.0MB
SHA256 ba7ce5b6948d4d3387762c87f49f314910cd2c39757f389ff6c64914ab44bde8
MD5 0705a75eaaf8ae52a6f4652855d9004f
SHA1 f757c1b1959b48937d7051d752ffa8aaa56da8dc
SHA512 1e0f8610ccb041897c57e6459b6c06e303b9b781642e93eb614b1c89fd9c358ab0d55d58ec884d9c805d496cac6f7a0a5fe8ef62ea96f6392c8b422cc0e94bc5
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5Ro:BemTLkNdfE0pZrG
MD5 SHA1 SHA512 SSDEEP

Submit Download

OdNaXRf.exe

Path C:\Windows\system\OdNaXRf.exe
Size 2.0MB
SHA256 03011a5720629d650545d1392fc523394b8fd0415134cab4f8dd8d7421e1490e
MD5 372607ac0f282789f6fc3a3aea2161c2
SHA1 d0e2a30a830eccdbbfad7b3103e0d5865c735519
SHA512 363a1d1528f80dd2a4318631fdfaf45fae417601c9ee821e654b82fe364a52ddefeb2f404c27d513930de65d8f47c62cf856a7a17e2ddf1f36369cb30af76aa9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5b:BemTLkNdfE0pZr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

PdTmFcm.exe

Path C:\Windows\system\PdTmFcm.exe
Size 2.0MB
SHA256 eff772a1f6cb3ff362c66dd592d1d86a6d4685db5d214104422dba8ce52a977d
MD5 d815f1438d688e27ba0db3c89e6fd477
SHA1 81c56d08c2fab7f0d49599129c3c9d060035b3d6
SHA512 39da3c6d9e9bb23bb3ca5e1b6360d6aa2964c30c010e44605e55b88f149d07987f30b073a7dbc01803d794d06fe00c66c543fcb0f1177ede4237c795fc56cc80
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5m:BemTLkNdfE0pZry
MD5 SHA1 SHA512 SSDEEP

Submit Download

QCJNhgm.exe

Path C:\Windows\system\QCJNhgm.exe
Size 2.0MB
SHA256 1dcb2f778fe27fc9af24cffd591c6ecdad0824bb8300992c6471d624ffd2cb54
MD5 bb6eb326bb2ecd89037109a6cff1e118
SHA1 7bd5daf6b856e57fc18d590f01ab4f371017c3e8
SHA512 1aa693cf92338a25ce59236b24860c76da9dd590997b7372081c37240b4d074fdf85009fdb25c6a4e76a89849b755f5a029a42f8aa98619154cef47fadf87821
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5f:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYwjsSB.exe

Path C:\Windows\system\SYwjsSB.exe
Size 2.0MB
SHA256 b1dfb26b99e36fd84fe7517b3aa8f9a6db83d16321b859b4d93d653e7dd937aa
MD5 d5512a508ba2a58915e007adb6bf4db9
SHA1 285faa2554c71033e13eac9f1e1e3d757441721d
SHA512 996da8f8dc782450e14a353e5f02c57154f2066d948ceb6603870951008241c2f81488c3788a75206209af764bc6ea63322bdd55df7a878eee68611af956dfab
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5N:BemTLkNdfE0pZrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TuRXpiP.exe

Path C:\Windows\system\TuRXpiP.exe
Size 2.0MB
SHA256 dbf9c8304d73db4a109493449ecc60c89bb9f75bfd48d704cef3cd71bf206167
MD5 415f58c23004e6906a914acff646cd11
SHA1 373795687dff96f6f1ec08799b8a4c9af066a7b3
SHA512 06af158ac25b46a391afd897a4b99aac8282b844e1550d8279119c76541be3c0214c9d61a3f242a17f1db83b12e9c07af770b544481018f44a84efb20dbab37f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5u:BemTLkNdfE0pZrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

TuuHZCJ.exe

Path C:\Windows\system\TuuHZCJ.exe
Size 2.0MB
SHA256 a22de9a6dffc6b4479148ea5aaffa8ffdb99de35cb5f4db0c582ab74b33f3d3b
MD5 52dcba0232fbe1e237047273a46dcb3a
SHA1 8a0bab9f62319f215c29d9b33276f02d75de9165
SHA512 44cf88be3ddc987536009fa936d313b825841406388cc0759ebaeecfa6026a2de058b59c46ce1164c2334104d0c298834f8df3e293e920a27048b44ca5c0b839
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5M:BemTLkNdfE0pZr4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WAlprnf.exe

Path C:\Windows\system\WAlprnf.exe
Size 2.0MB
SHA256 7202440a0b383e81d6d404e966ed6c084a97e502f0c4aa7c7d8be3bea09d4c8b
MD5 f99c9772f245459829d3f615976ab598
SHA1 653908c5a7c35b7d76e7a9097ec9567915ae55c4
SHA512 25be1e283f095ab3e5e11c1f58bbad059f191678bd3fa6a0d0534bb82cb6f2bbb8fcd1469304409235d23e61999f2924ca9da9c52c53658f1437ed663c9e0c70
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5t:BemTLkNdfE0pZrZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

aCRLYkQ.exe

Path C:\Windows\system\aCRLYkQ.exe
Size 2.0MB
SHA256 467625fc76087fae405944ec1255517cc039833fd811c0d3b296bdfba8044f60
MD5 adb3b0c924c76ad7fb18b95c413ed04f
SHA1 c2eb435309b10446e9710c262dcfb42d92e13f05
SHA512 350479b2dde3610a01cd231d5545178bdb004d99835d90bfd2cd95fdccdd7580b66260c99e4171eec20905ba61c2d34e7012814e82e0c850ae264d8532bd0294
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5n:BemTLkNdfE0pZrD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bQuHAmC.exe

Path C:\Windows\system\bQuHAmC.exe
Size 2.0MB
SHA256 18559357bd0fe56bfa8f52396c2edfa4b7602e32c3a96b7a8b047adaefa23014
MD5 7e10f72d6c3e3cf5c217e6ea61334d84
SHA1 2e7bc3adef9850e455ffa7b320a9ea75575bc4e0
SHA512 e9aef46b78ad938b4a02ac5d38708d1b6e9ac48f2b7acf9cc2067af9b6a9b053226cb34e2cdaf9878205ef328f571843eb20c4cd8ae0a18073f9a6077707b530
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5K:BemTLkNdfE0pZrm
MD5 SHA1 SHA512 SSDEEP

Submit Download

cBvOliI.exe

Path C:\Windows\system\cBvOliI.exe
Size 2.0MB
SHA256 a72a5faa967a20775c5397ead02199ed279546e8190be7b7d2fa274f10197da6
MD5 9a71af72997747c5634d4d11b1bae794
SHA1 e2b757d1b3b381e696e5e1811a0ece382e26308a
SHA512 a535d89ca59729d8996b83eab0c0041eeee3fab3144aedcea3680736f90772ac6c29c71eca6ed9a25c18ee605e13e6b3cfcb5fa9e986b646cd8103ded740f58f
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5n:BemTLkNdfE0pZrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

fOjIDLs.exe

Path C:\Windows\system\fOjIDLs.exe
Size 2.0MB
SHA256 b9d119d833003634d13569285371fac89b2fb3004cc060f19a23b0b0f674e4e4
MD5 edc6587e8fdc4e8bcda4efa543be1989
SHA1 3e64c22fefcd48558892eb3b3869486aaa527ddf
SHA512 563f65cab166b9c0be49a0b6f35b02fbcd108b2250a4cd9905849365a09c5193abbdbe748831dcfd896357490ed20c3d87a2d04026205643ac4b960246e0fc8e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5j:BemTLkNdfE0pZr3
MD5 SHA1 SHA512 SSDEEP

Submit Download

iVCipew.exe

Path C:\Windows\system\iVCipew.exe
Size 2.0MB
SHA256 5beef65d7529c49d63cbaf811b6f252f93446cfbad6c81fbf2b18699c015cd8c
MD5 fa5088fc57dd88d8222ff1dee4dcca1f
SHA1 6ba5ffd913358938bfbc319912d20bef7b185694
SHA512 edb57ab32ff896857dd47b4144a03d19e1c3f1b4f9315fe90ffe34551ab4e74410aa9846801c61a7ff256a9b54e339a024f9eb2f5c9fe1b055f8f66d55dc5ae9
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE59:BemTLkNdfE0pZrJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

kMmVsEq.exe

Path C:\Windows\system\kMmVsEq.exe
Size 2.0MB
SHA256 36cb6c06b732168452a5870365d4f6a2c3f903952c9075a987b2d8eeb794614c
MD5 e0ff7c44f5ef6c92629a3d3389e06f50
SHA1 97ab40f01cd0053fe120e434790a2edd4f8c2136
SHA512 497a428880b594beede54cbe15f876ca4b78e631c5f8b8dbf7024f3909afa576421ef53edf38f081d7058bfa1c46a6fb8a976dbfa976d5c126f2f05a8bc7c84c
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5S:BemTLkNdfE0pZre
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmoIqQq.exe

Path C:\Windows\system\kmoIqQq.exe
Size 2.0MB
SHA256 b26eab0cefcd0abd26ba222dc1c6477c414303e955cd6e046c8403421f9fb192
MD5 0501efab872cf21d6fa39f8157600d1c
SHA1 4394b845689fbceb75361199c3a94c3dbb46cc95
SHA512 9119784d6d2cf7c4fdd7debc40003f7bc3f1583b572f1971d324e9f5c0dcffd6b7bd3ef93130c6b6ebf048ca22e3b2c8ac38aea91bc7d5de53e2413cd3ed222e
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE58:BemTLkNdfE0pZrY
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkEvijU.exe

Path C:\Windows\system\mkEvijU.exe
Size 2.0MB
SHA256 20ab72e42a4ccb0c53650d2de9734b5e13e8d93c0142188ffa58475aa47325e3
MD5 a9864ded23052fd6af8f6997b5cb493a
SHA1 6ee94c3f23f1e2e68852b7423e864f4da23ad4f0
SHA512 5c17c87908431a801b53b42ec796d0ba463235a8ec81749335185ab6f659a90cd6d0c8e132727c814a112550240fe4d8783d86cbf04fb4349a218bec23b68c08
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5R:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

oKOSVZs.exe

Path C:\Windows\system\oKOSVZs.exe
Size 2.0MB
SHA256 e279f465f40720bae6caa619d7297b6c6297daf80e7a5f63a0d69b47b642ec3b
MD5 0247d4eb32ab5d02ca53dc2c64dfed7e
SHA1 84b4503649a4c0ad195868aba479cb471643c9d5
SHA512 f0368e6b7104b9033c00de75460709c2bb46bee08ca58dab919c86d8bd5eef25f265e83479c429010bf4461c6b6b1f9f247d4ae48701b4669bcd250dbe71e8ed
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5D:BemTLkNdfE0pZrn
MD5 SHA1 SHA512 SSDEEP

Submit Download

pZTKSBx.exe

Path C:\Windows\system\pZTKSBx.exe
Size 2.0MB
SHA256 b94cf27d17e73554f235d6cbde6c398e7306bd9fef7adcb0b013659ac8b0393e
MD5 2ddb26e67efb4f2683c18655a8641ced
SHA1 7f26637367c4693daedf4609946e770826d959e4
SHA512 67515a18ff00e855dd9b2784ea92f9fc45583f69d1660d4c0781d82441470f6dbc74ae69f5e9c04a5cf93476c534b7de9178caa546a32bb5ee9588079e3caad4
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5b:BemTLkNdfE0pZr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

uBKSqTA.exe

Path C:\Windows\system\uBKSqTA.exe
Size 2.0MB
SHA256 e2c841e461d6e01b2d03c45a1fab4838424f58cb469218e9bb137def3db96800
MD5 7d75a7dbba1d3c8abbebe0c8fc24842b
SHA1 e17d8863feb6c81b9458aaf632f60f549bd48c31
SHA512 c882297ed55646c6647388c9bcdab235be0cf70b57c58930bc71770d4f7024a4eb2b852ce33584994551b899a9c64416643103ae50f13c407cce82dcd57e6cce
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5J:BemTLkNdfE0pZrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wYFBGTn.exe

Path C:\Windows\system\wYFBGTn.exe
Size 2.0MB
SHA256 fb533d8f39db9083d504b6c5a2aa267636b5b7c479ec87ff86d70037f9508f21
MD5 f543132101855c0de2a5b923c59d8116
SHA1 66934096f0178b564443a3eabd15cfc7fb58a3fa
SHA512 b0f18c493c94760e6c2761e55804dc2f9ee25334b579aa2f5e27c17f08482ffae45747d82f7a0c5f14c07a5fa0383e268de0f83db3f6a582345d57ec1b08e021
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5v:BemTLkNdfE0pZrL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rEqKoNS.exe

Path \Windows\system\rEqKoNS.exe
Size 2.0MB
SHA256 24d08acaa4b64f81afafbfb22849bcfeb727f3aed49e8c0a272bd82bf07d5e0a
MD5 54c1683153efe1760990d7cce9664a6e
SHA1 2ad49a7dfe5477703079f147a0d244da76edf7a6
SHA512 0b5deeee9b5cb2652d3649b54fa1c89f7ef25374f4d7984b5a9ea497c12f48a071274980631008f6f5f20053f596ae77c8129842b6c4ee07e7c468acde2e6058
SSDEEP 49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIqndvMjn44c2Hh4YeKE5h:BemTLkNdfE0pZrN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1704-3128-0x000000013F860000-0x000000013FBB4000-memory.dmp

Download

memory/1704-4035-0x000000013F860000-0x000000013FBB4000-memory.dmp

Download

memory/1704-581-0x000000013F860000-0x000000013FBB4000-memory.dmp

Download

memory/1736-592-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3311-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-698-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Download

memory/1736-3688-0x000000013F020000-0x000000013F374000-memory.dmp

Download

memory/1736-3312-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3314-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-703-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-707-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-663-0x000000013F350000-0x000000013F6A4000-memory.dmp

Download

memory/1736-687-0x000000013F270000-0x000000013F5C4000-memory.dmp

Download

memory/1736-708-0x000000013F020000-0x000000013F374000-memory.dmp

Download

memory/1736-3354-0x000000013F270000-0x000000013F5C4000-memory.dmp

Download

memory/1736-701-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3363-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-651-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3369-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-0-0x000000013F7B0000-0x000000013FB04000-memory.dmp

Download

memory/1736-3367-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-594-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3357-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3352-0x000000013F350000-0x000000013F6A4000-memory.dmp

Download

memory/1736-598-0x000000013F410000-0x000000013F764000-memory.dmp

Download

memory/1736-596-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-590-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3330-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-9-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3324-0x000000013F410000-0x000000013F764000-memory.dmp

Download

memory/1736-2570-0x000000013F7B0000-0x000000013FB04000-memory.dmp

Download

memory/1736-2571-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-2701-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-11-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1736-3301-0x0000000001ED0000-0x0000000002224000-memory.dmp

Download

memory/1740-14-0x000000013F730000-0x000000013FA84000-memory.dmp

Download

memory/1740-4034-0x000000013F730000-0x000000013FA84000-memory.dmp

Download

memory/2192-4046-0x000000013F570000-0x000000013F8C4000-memory.dmp

Download

memory/2192-702-0x000000013F570000-0x000000013F8C4000-memory.dmp

Download

memory/2364-706-0x000000013F470000-0x000000013F7C4000-memory.dmp

Download

memory/2364-4044-0x000000013F470000-0x000000013F7C4000-memory.dmp

Download

memory/2532-4042-0x000000013FA20000-0x000000013FD74000-memory.dmp

Download

memory/2532-700-0x000000013FA20000-0x000000013FD74000-memory.dmp

Download

memory/2556-4045-0x000000013F270000-0x000000013F5C4000-memory.dmp

Download

memory/2556-689-0x000000013F270000-0x000000013F5C4000-memory.dmp

Download

memory/2604-4038-0x000000013F880000-0x000000013FBD4000-memory.dmp

Download

memory/2604-595-0x000000013F880000-0x000000013FBD4000-memory.dmp

Download

memory/2648-589-0x000000013F020000-0x000000013F374000-memory.dmp

Download

memory/2648-4037-0x000000013F020000-0x000000013F374000-memory.dmp

Download

memory/2672-680-0x000000013F350000-0x000000013F6A4000-memory.dmp

Download

memory/2672-4040-0x000000013F350000-0x000000013F6A4000-memory.dmp

Download

memory/2684-660-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Download

memory/2684-4047-0x000000013F8B0000-0x000000013FC04000-memory.dmp

Download

memory/2744-4039-0x000000013F410000-0x000000013F764000-memory.dmp

Download

memory/2744-642-0x000000013F410000-0x000000013F764000-memory.dmp

Download

memory/2764-4036-0x000000013F710000-0x000000013FA64000-memory.dmp

Download

memory/2764-591-0x000000013F710000-0x000000013FA64000-memory.dmp

Download

memory/2772-4043-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Download

memory/2772-597-0x000000013F9C0000-0x000000013FD14000-memory.dmp

Download

memory/3052-593-0x000000013F690000-0x000000013F9E4000-memory.dmp

Download

memory/3052-4041-0x000000013F690000-0x000000013F9E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads