xmrig | 09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
Size

1.5MB
MD5

28ee700f85f8f9d42b6ddb75c2bfca80
SHA1

4962dbd5af354e12f065b29edfcb18dde271c2cc
SHA256

09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680
SHA512

4f932ea99d9ba6ba5971ab72341f5fa609d8003f4b12de6ae43aeb0008fcc314e37ab8b656691dda6ac89b5d630b9495a08e7f66fa0f655320b51161bb824b0a
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727ZvhwJWe9pY4p9XvOjeUlV/oPVHsv4TuUgGqj15G+y:ROdWCCi7/rahoyS6SHb8GSxy

Score

10^/10

xmrig miner persistence privilege_escalation upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 29 IoCs

miner

resource	yara_rule
behavioral1/memory/2148-35-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/2604-34-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2568-33-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/2884-54-0x000000013FAD0000-0x000000013FE21000-memory.dmp	xmrig
behavioral1/memory/2776-55-0x000000013F9E0000-0x000000013FD31000-memory.dmp	xmrig
behavioral1/memory/2548-68-0x000000013F800000-0x000000013FB51000-memory.dmp	xmrig
behavioral1/memory/2988-67-0x000000013FC20000-0x000000013FF71000-memory.dmp	xmrig
behavioral1/memory/2484-61-0x000000013F9D0000-0x000000013FD21000-memory.dmp	xmrig
behavioral1/memory/2388-97-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2884-80-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/3012-73-0x000000013F370000-0x000000013F6C1000-memory.dmp	xmrig
behavioral1/memory/2836-93-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2932-1844-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/2924-2445-0x000000013F660000-0x000000013F9B1000-memory.dmp	xmrig
behavioral1/memory/944-2614-0x000000013F660000-0x000000013F9B1000-memory.dmp	xmrig
behavioral1/memory/2044-2845-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2988-3777-0x000000013FC20000-0x000000013FF71000-memory.dmp	xmrig
behavioral1/memory/2568-3821-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/3012-3824-0x000000013F370000-0x000000013F6C1000-memory.dmp	xmrig
behavioral1/memory/2836-3842-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2484-3865-0x000000013F9D0000-0x000000013FD21000-memory.dmp	xmrig
behavioral1/memory/2548-3864-0x000000013F800000-0x000000013FB51000-memory.dmp	xmrig
behavioral1/memory/2776-3862-0x000000013F9E0000-0x000000013FD31000-memory.dmp	xmrig
behavioral1/memory/2388-3848-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2148-3878-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/2932-3894-0x000000013F160000-0x000000013F4B1000-memory.dmp	xmrig
behavioral1/memory/2044-3922-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/944-3930-0x000000013F660000-0x000000013F9B1000-memory.dmp	xmrig
behavioral1/memory/2924-3935-0x000000013F660000-0x000000013F9B1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2988	cqMDRpu.exe
3012	RlbZWRQ.exe
2148	wEOAOWl.exe
2568	gklgyWO.exe
2604	HGKPrte.exe
2836	TPhIRFa.exe
2388	EKdqIDL.exe
2776	JlPiGvy.exe
2484	ibnQhCZ.exe
2548	FfrHAaz.exe
2932	GGYQWPe.exe
2924	kOJJRYL.exe
944	wSBzZXB.exe
2044	vQgdonz.exe
816	vqHHjeB.exe
2348	XPVGwRQ.exe
764	Cpudzal.exe
2660	MkVvyHU.exe
932	cffYmZl.exe
1844	vCXHphE.exe
2812	nofmnWg.exe
2412	nKrimkC.exe
1688	mNwNNWU.exe
2892	ZgDkUWx.exe
2244	sDmPmuO.exe
1636	jybTSZT.exe
2136	ZpeEwfe.exe
1292	tbdfqjj.exe
2308	qpFoDjq.exe
268	gibKPWa.exe
576	YJcNKpg.exe
2336	COGHAhG.exe
3060	fibUmVi.exe
1028	glsAlBz.exe
1880	zfWIzJd.exe
3052	AngGTCg.exe
1532	DSrLUSv.exe
1800	GPSwloq.exe
616	RScZNZi.exe
1628	BxqKWfs.exe
108	rZdTOII.exe
400	xxzxMCr.exe
1884	avpuaiR.exe
1048	jenaPgj.exe
2856	wlDTsgo.exe
1460	YRNbSWb.exe
1648	XnRaVYW.exe
1116	ltDgLec.exe
2004	oCBwNen.exe
1092	AiJqPDl.exe
1768	alyNyDX.exe
2032	UkQKUMM.exe
2320	PKVcSyC.exe
2956	qoLMLdf.exe
1724	CxDMxqW.exe
1704	gKntJFc.exe
3024	vcKgIyd.exe
3032	YAAOdoQ.exe
2584	rWGUVjg.exe
2156	GAfeFoo.exe
2672	JlcmEMs.exe
2724	wpcJTRc.exe
2816	zSEdfDH.exe
2140	TaqFXxq.exe

Loads dropped DLL 64 IoCs

pid	Process
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2884-0-0x000000013FAD0000-0x000000013FE21000-memory.dmp	upx
behavioral1/files/0x00090000000149f5-3.dat	upx
behavioral1/memory/2988-7-0x000000013FC20000-0x000000013FF71000-memory.dmp	upx
behavioral1/files/0x0009000000015018-8.dat	upx
behavioral1/memory/3012-14-0x000000013F370000-0x000000013F6C1000-memory.dmp	upx
behavioral1/files/0x00080000000155f7-11.dat	upx
behavioral1/files/0x0007000000015605-27.dat	upx
behavioral1/memory/2148-35-0x000000013F860000-0x000000013FBB1000-memory.dmp	upx
behavioral1/memory/2604-34-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/memory/2568-33-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/files/0x000a000000015616-30.dat	upx
behavioral1/files/0x0009000000015626-38.dat	upx
behavioral1/files/0x0009000000015b6f-41.dat	upx
behavioral1/files/0x0008000000015c3d-47.dat	upx
behavioral1/memory/2884-54-0x000000013FAD0000-0x000000013FE21000-memory.dmp	upx
behavioral1/memory/2776-55-0x000000013F9E0000-0x000000013FD31000-memory.dmp	upx
behavioral1/files/0x00080000000155ed-65.dat	upx
behavioral1/files/0x0008000000015c52-59.dat	upx
behavioral1/files/0x0007000000015c78-75.dat	upx
behavioral1/memory/2548-68-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/memory/2988-67-0x000000013FC20000-0x000000013FF71000-memory.dmp	upx
behavioral1/memory/2484-61-0x000000013F9D0000-0x000000013FD21000-memory.dmp	upx
behavioral1/memory/2924-87-0x000000013F660000-0x000000013F9B1000-memory.dmp	upx
behavioral1/memory/2388-97-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/files/0x0007000000015c6b-84.dat	upx
behavioral1/memory/2884-82-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/2932-81-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/files/0x0006000000015c83-78.dat	upx
behavioral1/memory/3012-73-0x000000013F370000-0x000000013F6C1000-memory.dmp	upx
behavioral1/memory/944-95-0x000000013F660000-0x000000013F9B1000-memory.dmp	upx
behavioral1/memory/2836-93-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/files/0x0006000000015c9f-90.dat	upx
behavioral1/memory/2388-53-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/memory/2836-40-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/files/0x0006000000015cb6-101.dat	upx
behavioral1/files/0x0006000000015d07-125.dat	upx
behavioral1/files/0x0006000000015d1a-129.dat	upx
behavioral1/files/0x0006000000015cf6-123.dat	upx
behavioral1/files/0x0006000000015d31-142.dat	upx
behavioral1/files/0x0006000000015df1-151.dat	upx
behavioral1/files/0x0006000000015d27-164.dat	upx
behavioral1/files/0x0006000000016176-174.dat	upx
behavioral1/files/0x0006000000015d0f-159.dat	upx
behavioral1/files/0x0006000000016448-189.dat	upx
behavioral1/files/0x0006000000016287-182.dat	upx
behavioral1/files/0x00060000000160af-181.dat	upx
behavioral1/files/0x0006000000015f01-180.dat	upx
behavioral1/files/0x0006000000015d98-171.dat	upx
behavioral1/files/0x0006000000015cfe-139.dat	upx
behavioral1/files/0x0006000000015cee-138.dat	upx
behavioral1/files/0x0006000000015f7a-163.dat	upx
behavioral1/files/0x0006000000015cce-109.dat	upx
behavioral1/memory/2932-1844-0x000000013F160000-0x000000013F4B1000-memory.dmp	upx
behavioral1/memory/2924-2445-0x000000013F660000-0x000000013F9B1000-memory.dmp	upx
behavioral1/memory/944-2614-0x000000013F660000-0x000000013F9B1000-memory.dmp	upx
behavioral1/memory/2044-2845-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/2988-3777-0x000000013FC20000-0x000000013FF71000-memory.dmp	upx
behavioral1/memory/2568-3821-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/3012-3824-0x000000013F370000-0x000000013F6C1000-memory.dmp	upx
behavioral1/memory/2836-3842-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/memory/2484-3865-0x000000013F9D0000-0x000000013FD21000-memory.dmp	upx
behavioral1/memory/2548-3864-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/memory/2776-3862-0x000000013F9E0000-0x000000013FD31000-memory.dmp	upx
behavioral1/memory/2388-3848-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qMWBMBk.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\XXBPrRV.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ecMTZxi.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\YfjaPXK.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\SwidKlY.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\zdmZtDY.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\CdTqkAX.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\WvpEvgX.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\inQwhej.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\qEvmIGK.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\FyUPTef.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\LgaUIVf.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\aVdxpvi.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\FfrHAaz.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\znjKZHA.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\xabjVOc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\dKBPiUe.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\rBVyWvK.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\AYCNUHr.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\AIpAfLa.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\uPzUPxA.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\adCBWWP.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\tyjOHFZ.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\oRZXqUR.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\JAXzkSV.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\brBflqy.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\YbHfyfk.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\MGGnPTp.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\MFvlkJi.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ShEfeDo.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\nAbbtKP.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\jRWoRFc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\UdIxlzD.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\hwusrgO.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\EOfGztN.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\OBATvVe.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fkehvSH.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\CTEBhYQ.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\mLCfckt.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\rNYsDUe.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\eSOlspc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\CjvPzLB.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\BFBevUX.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\QwpFevw.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\ZrWgTUG.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fAgwhBk.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\EnYYNGk.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\IRkiUzW.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\PORhvOu.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\CMCndeb.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\OXbKpNh.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\QLFKAfg.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\XzcKrbF.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\aYLbYRH.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\IcRFKCN.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\HdvhBij.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\LalTXlc.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\jlhZJyE.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\CsSyTxq.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\fkKRflB.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\CuzeNmS.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\xAUXCqm.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\IyRDTEL.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
File created	C:\Windows\System\SvYdtpy.exe	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2988	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 2988	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 2988	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	29
PID 2884 wrote to memory of 3012	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	30
PID 2884 wrote to memory of 3012	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	30
PID 2884 wrote to memory of 3012	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	30
PID 2884 wrote to memory of 2148	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	31
PID 2884 wrote to memory of 2148	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	31
PID 2884 wrote to memory of 2148	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	31
PID 2884 wrote to memory of 2568	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	32
PID 2884 wrote to memory of 2568	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	32
PID 2884 wrote to memory of 2568	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	32
PID 2884 wrote to memory of 2604	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	33
PID 2884 wrote to memory of 2604	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	33
PID 2884 wrote to memory of 2604	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	33
PID 2884 wrote to memory of 2836	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	34
PID 2884 wrote to memory of 2836	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	34
PID 2884 wrote to memory of 2836	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	34
PID 2884 wrote to memory of 2776	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	35
PID 2884 wrote to memory of 2776	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	35
PID 2884 wrote to memory of 2776	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	35
PID 2884 wrote to memory of 2388	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	36
PID 2884 wrote to memory of 2388	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	36
PID 2884 wrote to memory of 2388	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	36
PID 2884 wrote to memory of 2484	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	37
PID 2884 wrote to memory of 2484	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	37
PID 2884 wrote to memory of 2484	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	37
PID 2884 wrote to memory of 2548	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	38
PID 2884 wrote to memory of 2548	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	38
PID 2884 wrote to memory of 2548	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	38
PID 2884 wrote to memory of 2924	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	39
PID 2884 wrote to memory of 2924	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	39
PID 2884 wrote to memory of 2924	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	39
PID 2884 wrote to memory of 2932	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	40
PID 2884 wrote to memory of 2932	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	40
PID 2884 wrote to memory of 2932	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	40
PID 2884 wrote to memory of 2044	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	41
PID 2884 wrote to memory of 2044	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	41
PID 2884 wrote to memory of 2044	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	41
PID 2884 wrote to memory of 944	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	42
PID 2884 wrote to memory of 944	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	42
PID 2884 wrote to memory of 944	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	42
PID 2884 wrote to memory of 816	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	43
PID 2884 wrote to memory of 816	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	43
PID 2884 wrote to memory of 816	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	43
PID 2884 wrote to memory of 2348	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	44
PID 2884 wrote to memory of 2348	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	44
PID 2884 wrote to memory of 2348	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	44
PID 2884 wrote to memory of 1844	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	45
PID 2884 wrote to memory of 1844	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	45
PID 2884 wrote to memory of 1844	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	45
PID 2884 wrote to memory of 764	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	46
PID 2884 wrote to memory of 764	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	46
PID 2884 wrote to memory of 764	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	46
PID 2884 wrote to memory of 2812	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	47
PID 2884 wrote to memory of 2812	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	47
PID 2884 wrote to memory of 2812	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	47
PID 2884 wrote to memory of 2660	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	48
PID 2884 wrote to memory of 2660	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	48
PID 2884 wrote to memory of 2660	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	48
PID 2884 wrote to memory of 2892	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	49
PID 2884 wrote to memory of 2892	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	49
PID 2884 wrote to memory of 2892	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	49
PID 2884 wrote to memory of 932	2884	09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\09a0a2ca246bbf99d96fb9bd129d90421755d1e4850671a641587e3b881dc680_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\System\cqMDRpu.exe
  C:\Windows\System\cqMDRpu.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\RlbZWRQ.exe
  C:\Windows\System\RlbZWRQ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\wEOAOWl.exe
  C:\Windows\System\wEOAOWl.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\gklgyWO.exe
  C:\Windows\System\gklgyWO.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\HGKPrte.exe
  C:\Windows\System\HGKPrte.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\TPhIRFa.exe
  C:\Windows\System\TPhIRFa.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\JlPiGvy.exe
  C:\Windows\System\JlPiGvy.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\EKdqIDL.exe
  C:\Windows\System\EKdqIDL.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\ibnQhCZ.exe
  C:\Windows\System\ibnQhCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\FfrHAaz.exe
  C:\Windows\System\FfrHAaz.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\kOJJRYL.exe
  C:\Windows\System\kOJJRYL.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\GGYQWPe.exe
  C:\Windows\System\GGYQWPe.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\vQgdonz.exe
  C:\Windows\System\vQgdonz.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\wSBzZXB.exe
  C:\Windows\System\wSBzZXB.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\vqHHjeB.exe
  C:\Windows\System\vqHHjeB.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\XPVGwRQ.exe
  C:\Windows\System\XPVGwRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vCXHphE.exe
  C:\Windows\System\vCXHphE.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\Cpudzal.exe
  C:\Windows\System\Cpudzal.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\nofmnWg.exe
  C:\Windows\System\nofmnWg.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\MkVvyHU.exe
  C:\Windows\System\MkVvyHU.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ZgDkUWx.exe
  C:\Windows\System\ZgDkUWx.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\cffYmZl.exe
  C:\Windows\System\cffYmZl.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\jybTSZT.exe
  C:\Windows\System\jybTSZT.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\nKrimkC.exe
  C:\Windows\System\nKrimkC.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\ZpeEwfe.exe
  C:\Windows\System\ZpeEwfe.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\mNwNNWU.exe
  C:\Windows\System\mNwNNWU.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\qpFoDjq.exe
  C:\Windows\System\qpFoDjq.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\sDmPmuO.exe
  C:\Windows\System\sDmPmuO.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\gibKPWa.exe
  C:\Windows\System\gibKPWa.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\tbdfqjj.exe
  C:\Windows\System\tbdfqjj.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\YJcNKpg.exe
  C:\Windows\System\YJcNKpg.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\COGHAhG.exe
  C:\Windows\System\COGHAhG.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\fibUmVi.exe
  C:\Windows\System\fibUmVi.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\glsAlBz.exe
  C:\Windows\System\glsAlBz.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\zfWIzJd.exe
  C:\Windows\System\zfWIzJd.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\AngGTCg.exe
  C:\Windows\System\AngGTCg.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\DSrLUSv.exe
  C:\Windows\System\DSrLUSv.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\GPSwloq.exe
  C:\Windows\System\GPSwloq.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\RScZNZi.exe
  C:\Windows\System\RScZNZi.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\BxqKWfs.exe
  C:\Windows\System\BxqKWfs.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\rZdTOII.exe
  C:\Windows\System\rZdTOII.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\xxzxMCr.exe
  C:\Windows\System\xxzxMCr.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\avpuaiR.exe
  C:\Windows\System\avpuaiR.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\jenaPgj.exe
  C:\Windows\System\jenaPgj.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\wlDTsgo.exe
  C:\Windows\System\wlDTsgo.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\YRNbSWb.exe
  C:\Windows\System\YRNbSWb.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\XnRaVYW.exe
  C:\Windows\System\XnRaVYW.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ltDgLec.exe
  C:\Windows\System\ltDgLec.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\oCBwNen.exe
  C:\Windows\System\oCBwNen.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\AiJqPDl.exe
  C:\Windows\System\AiJqPDl.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\alyNyDX.exe
  C:\Windows\System\alyNyDX.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\UkQKUMM.exe
  C:\Windows\System\UkQKUMM.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\PKVcSyC.exe
  C:\Windows\System\PKVcSyC.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\qoLMLdf.exe
  C:\Windows\System\qoLMLdf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\CxDMxqW.exe
  C:\Windows\System\CxDMxqW.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\gKntJFc.exe
  C:\Windows\System\gKntJFc.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\vcKgIyd.exe
  C:\Windows\System\vcKgIyd.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\YAAOdoQ.exe
  C:\Windows\System\YAAOdoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\rWGUVjg.exe
  C:\Windows\System\rWGUVjg.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\GAfeFoo.exe
  C:\Windows\System\GAfeFoo.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\JlcmEMs.exe
  C:\Windows\System\JlcmEMs.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\wpcJTRc.exe
  C:\Windows\System\wpcJTRc.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\zSEdfDH.exe
  C:\Windows\System\zSEdfDH.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\TaqFXxq.exe
  C:\Windows\System\TaqFXxq.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\YIheLnD.exe
  C:\Windows\System\YIheLnD.exe
  2⤵
  PID:2540
- C:\Windows\System\fUGRWxa.exe
  C:\Windows\System\fUGRWxa.exe
  2⤵
  PID:800
- C:\Windows\System\yRzJPrV.exe
  C:\Windows\System\yRzJPrV.exe
  2⤵
  PID:2712
- C:\Windows\System\usKdxfa.exe
  C:\Windows\System\usKdxfa.exe
  2⤵
  PID:2640
- C:\Windows\System\pHUsnVK.exe
  C:\Windows\System\pHUsnVK.exe
  2⤵
  PID:2496
- C:\Windows\System\npNZqqO.exe
  C:\Windows\System\npNZqqO.exe
  2⤵
  PID:2492
- C:\Windows\System\ZrWgTUG.exe
  C:\Windows\System\ZrWgTUG.exe
  2⤵
  PID:3056
- C:\Windows\System\BBTqZdD.exe
  C:\Windows\System\BBTqZdD.exe
  2⤵
  PID:928
- C:\Windows\System\DuTRlBx.exe
  C:\Windows\System\DuTRlBx.exe
  2⤵
  PID:2468
- C:\Windows\System\KyYXgbz.exe
  C:\Windows\System\KyYXgbz.exe
  2⤵
  PID:1776
- C:\Windows\System\wllUSLN.exe
  C:\Windows\System\wllUSLN.exe
  2⤵
  PID:2912
- C:\Windows\System\hTsILGY.exe
  C:\Windows\System\hTsILGY.exe
  2⤵
  PID:2536
- C:\Windows\System\GFvHvok.exe
  C:\Windows\System\GFvHvok.exe
  2⤵
  PID:2184
- C:\Windows\System\QbgYYsL.exe
  C:\Windows\System\QbgYYsL.exe
  2⤵
  PID:484
- C:\Windows\System\urTlqOC.exe
  C:\Windows\System\urTlqOC.exe
  2⤵
  PID:968
- C:\Windows\System\sqLpSXw.exe
  C:\Windows\System\sqLpSXw.exe
  2⤵
  PID:1772
- C:\Windows\System\GLUAcDU.exe
  C:\Windows\System\GLUAcDU.exe
  2⤵
  PID:2056
- C:\Windows\System\VPzvAGT.exe
  C:\Windows\System\VPzvAGT.exe
  2⤵
  PID:700
- C:\Windows\System\srJMvNf.exe
  C:\Windows\System\srJMvNf.exe
  2⤵
  PID:1916
- C:\Windows\System\fAgwhBk.exe
  C:\Windows\System\fAgwhBk.exe
  2⤵
  PID:828
- C:\Windows\System\nwBXEhM.exe
  C:\Windows\System\nwBXEhM.exe
  2⤵
  PID:1764
- C:\Windows\System\nAbbtKP.exe
  C:\Windows\System\nAbbtKP.exe
  2⤵
  PID:1068
- C:\Windows\System\sgCkWDi.exe
  C:\Windows\System\sgCkWDi.exe
  2⤵
  PID:3048
- C:\Windows\System\JpLwrKP.exe
  C:\Windows\System\JpLwrKP.exe
  2⤵
  PID:1976
- C:\Windows\System\SkPMzLs.exe
  C:\Windows\System\SkPMzLs.exe
  2⤵
  PID:844
- C:\Windows\System\pwIgjgi.exe
  C:\Windows\System\pwIgjgi.exe
  2⤵
  PID:2168
- C:\Windows\System\loQjWPV.exe
  C:\Windows\System\loQjWPV.exe
  2⤵
  PID:1904
- C:\Windows\System\bQXGlBj.exe
  C:\Windows\System\bQXGlBj.exe
  2⤵
  PID:1604
- C:\Windows\System\JgUyWrn.exe
  C:\Windows\System\JgUyWrn.exe
  2⤵
  PID:2720
- C:\Windows\System\hUosTcs.exe
  C:\Windows\System\hUosTcs.exe
  2⤵
  PID:1156
- C:\Windows\System\HgPyNob.exe
  C:\Windows\System\HgPyNob.exe
  2⤵
  PID:2852
- C:\Windows\System\HLpkpCt.exe
  C:\Windows\System\HLpkpCt.exe
  2⤵
  PID:2180
- C:\Windows\System\nMttwIJ.exe
  C:\Windows\System\nMttwIJ.exe
  2⤵
  PID:1760
- C:\Windows\System\HpNPTMU.exe
  C:\Windows\System\HpNPTMU.exe
  2⤵
  PID:2200
- C:\Windows\System\ixmADwJ.exe
  C:\Windows\System\ixmADwJ.exe
  2⤵
  PID:1620
- C:\Windows\System\WmvtTYR.exe
  C:\Windows\System\WmvtTYR.exe
  2⤵
  PID:1720
- C:\Windows\System\QxMuxaU.exe
  C:\Windows\System\QxMuxaU.exe
  2⤵
  PID:2824
- C:\Windows\System\lpDDceD.exe
  C:\Windows\System\lpDDceD.exe
  2⤵
  PID:2500
- C:\Windows\System\jKNsmdS.exe
  C:\Windows\System\jKNsmdS.exe
  2⤵
  PID:2588
- C:\Windows\System\zdmZtDY.exe
  C:\Windows\System\zdmZtDY.exe
  2⤵
  PID:2160
- C:\Windows\System\mZNcxuM.exe
  C:\Windows\System\mZNcxuM.exe
  2⤵
  PID:2504
- C:\Windows\System\tbsqQrs.exe
  C:\Windows\System\tbsqQrs.exe
  2⤵
  PID:1984
- C:\Windows\System\Zshanis.exe
  C:\Windows\System\Zshanis.exe
  2⤵
  PID:2072
- C:\Windows\System\MhWWviI.exe
  C:\Windows\System\MhWWviI.exe
  2⤵
  PID:2552
- C:\Windows\System\EkjkhXD.exe
  C:\Windows\System\EkjkhXD.exe
  2⤵
  PID:2428
- C:\Windows\System\OwWcoKA.exe
  C:\Windows\System\OwWcoKA.exe
  2⤵
  PID:2392
- C:\Windows\System\mLCfckt.exe
  C:\Windows\System\mLCfckt.exe
  2⤵
  PID:1848
- C:\Windows\System\lXFlFJE.exe
  C:\Windows\System\lXFlFJE.exe
  2⤵
  PID:1320
- C:\Windows\System\zbarhpj.exe
  C:\Windows\System\zbarhpj.exe
  2⤵
  PID:2628
- C:\Windows\System\tFQgRVq.exe
  C:\Windows\System\tFQgRVq.exe
  2⤵
  PID:1972
- C:\Windows\System\xUCWQQZ.exe
  C:\Windows\System\xUCWQQZ.exe
  2⤵
  PID:2928
- C:\Windows\System\zokFMre.exe
  C:\Windows\System\zokFMre.exe
  2⤵
  PID:2188
- C:\Windows\System\ZQPxOQv.exe
  C:\Windows\System\ZQPxOQv.exe
  2⤵
  PID:2940
- C:\Windows\System\oljlDvy.exe
  C:\Windows\System\oljlDvy.exe
  2⤵
  PID:896
- C:\Windows\System\olwywTI.exe
  C:\Windows\System\olwywTI.exe
  2⤵
  PID:1436
- C:\Windows\System\bCoWodM.exe
  C:\Windows\System\bCoWodM.exe
  2⤵
  PID:2572
- C:\Windows\System\zgtwhcH.exe
  C:\Windows\System\zgtwhcH.exe
  2⤵
  PID:592
- C:\Windows\System\OukPCyW.exe
  C:\Windows\System\OukPCyW.exe
  2⤵
  PID:680
- C:\Windows\System\YAEkrDg.exe
  C:\Windows\System\YAEkrDg.exe
  2⤵
  PID:348
- C:\Windows\System\HbaNnOQ.exe
  C:\Windows\System\HbaNnOQ.exe
  2⤵
  PID:2356
- C:\Windows\System\znjKZHA.exe
  C:\Windows\System\znjKZHA.exe
  2⤵
  PID:1560
- C:\Windows\System\mMRaDVD.exe
  C:\Windows\System\mMRaDVD.exe
  2⤵
  PID:1548
- C:\Windows\System\FxIMcrI.exe
  C:\Windows\System\FxIMcrI.exe
  2⤵
  PID:1872
- C:\Windows\System\ruUvlyO.exe
  C:\Windows\System\ruUvlyO.exe
  2⤵
  PID:1924
- C:\Windows\System\MiUtaLX.exe
  C:\Windows\System\MiUtaLX.exe
  2⤵
  PID:2316
- C:\Windows\System\IkofvBu.exe
  C:\Windows\System\IkofvBu.exe
  2⤵
  PID:2024
- C:\Windows\System\SHIYtQP.exe
  C:\Windows\System\SHIYtQP.exe
  2⤵
  PID:2172
- C:\Windows\System\MGRaquh.exe
  C:\Windows\System\MGRaquh.exe
  2⤵
  PID:1204
- C:\Windows\System\VBdoQdP.exe
  C:\Windows\System\VBdoQdP.exe
  2⤵
  PID:1180
- C:\Windows\System\CfriqtV.exe
  C:\Windows\System\CfriqtV.exe
  2⤵
  PID:1632
- C:\Windows\System\lJtTbPO.exe
  C:\Windows\System\lJtTbPO.exe
  2⤵
  PID:2008
- C:\Windows\System\ouYEODN.exe
  C:\Windows\System\ouYEODN.exe
  2⤵
  PID:2980
- C:\Windows\System\oAZtjyI.exe
  C:\Windows\System\oAZtjyI.exe
  2⤵
  PID:2740
- C:\Windows\System\lTpdRAZ.exe
  C:\Windows\System\lTpdRAZ.exe
  2⤵
  PID:1676
- C:\Windows\System\GpkBzWt.exe
  C:\Windows\System\GpkBzWt.exe
  2⤵
  PID:2012
- C:\Windows\System\IgqEuvd.exe
  C:\Windows\System\IgqEuvd.exe
  2⤵
  PID:2532
- C:\Windows\System\jtVXSpe.exe
  C:\Windows\System\jtVXSpe.exe
  2⤵
  PID:1596
- C:\Windows\System\AsrbtWI.exe
  C:\Windows\System\AsrbtWI.exe
  2⤵
  PID:936
- C:\Windows\System\macgqfa.exe
  C:\Windows\System\macgqfa.exe
  2⤵
  PID:2052
- C:\Windows\System\HbZbVKp.exe
  C:\Windows\System\HbZbVKp.exe
  2⤵
  PID:2656
- C:\Windows\System\FoxdZjy.exe
  C:\Windows\System\FoxdZjy.exe
  2⤵
  PID:2472
- C:\Windows\System\rHfEkmP.exe
  C:\Windows\System\rHfEkmP.exe
  2⤵
  PID:2096
- C:\Windows\System\EPhwikQ.exe
  C:\Windows\System\EPhwikQ.exe
  2⤵
  PID:2916
- C:\Windows\System\qcUJByi.exe
  C:\Windows\System\qcUJByi.exe
  2⤵
  PID:2608
- C:\Windows\System\QkrBkIx.exe
  C:\Windows\System\QkrBkIx.exe
  2⤵
  PID:1684
- C:\Windows\System\WZgXzUs.exe
  C:\Windows\System\WZgXzUs.exe
  2⤵
  PID:1296
- C:\Windows\System\AluOUac.exe
  C:\Windows\System\AluOUac.exe
  2⤵
  PID:2292
- C:\Windows\System\KNSVMQN.exe
  C:\Windows\System\KNSVMQN.exe
  2⤵
  PID:284
- C:\Windows\System\AaBQzES.exe
  C:\Windows\System\AaBQzES.exe
  2⤵
  PID:1816
- C:\Windows\System\PhsSEKQ.exe
  C:\Windows\System\PhsSEKQ.exe
  2⤵
  PID:1164
- C:\Windows\System\xVenQXu.exe
  C:\Windows\System\xVenQXu.exe
  2⤵
  PID:1912
- C:\Windows\System\SsVlzfn.exe
  C:\Windows\System\SsVlzfn.exe
  2⤵
  PID:2312
- C:\Windows\System\fzkZtYR.exe
  C:\Windows\System\fzkZtYR.exe
  2⤵
  PID:1044
- C:\Windows\System\NpkpPvr.exe
  C:\Windows\System\NpkpPvr.exe
  2⤵
  PID:1484
- C:\Windows\System\GbcLbRp.exe
  C:\Windows\System\GbcLbRp.exe
  2⤵
  PID:3004
- C:\Windows\System\OuLrCHy.exe
  C:\Windows\System\OuLrCHy.exe
  2⤵
  PID:2692
- C:\Windows\System\bCUKBRj.exe
  C:\Windows\System\bCUKBRj.exe
  2⤵
  PID:3088
- C:\Windows\System\ZmFJyyi.exe
  C:\Windows\System\ZmFJyyi.exe
  2⤵
  PID:3108
- C:\Windows\System\vUwLDjp.exe
  C:\Windows\System\vUwLDjp.exe
  2⤵
  PID:3124
- C:\Windows\System\dVicxje.exe
  C:\Windows\System\dVicxje.exe
  2⤵
  PID:3140
- C:\Windows\System\bHdPqSW.exe
  C:\Windows\System\bHdPqSW.exe
  2⤵
  PID:3156
- C:\Windows\System\pDFbsSI.exe
  C:\Windows\System\pDFbsSI.exe
  2⤵
  PID:3176
- C:\Windows\System\NVXnIvN.exe
  C:\Windows\System\NVXnIvN.exe
  2⤵
  PID:3192
- C:\Windows\System\nzVmgDQ.exe
  C:\Windows\System\nzVmgDQ.exe
  2⤵
  PID:3208
- C:\Windows\System\SBBZOtu.exe
  C:\Windows\System\SBBZOtu.exe
  2⤵
  PID:3224
- C:\Windows\System\PblGlAS.exe
  C:\Windows\System\PblGlAS.exe
  2⤵
  PID:3240
- C:\Windows\System\CgwQRYs.exe
  C:\Windows\System\CgwQRYs.exe
  2⤵
  PID:3260
- C:\Windows\System\FjnmhSd.exe
  C:\Windows\System\FjnmhSd.exe
  2⤵
  PID:3276
- C:\Windows\System\WAbsmuU.exe
  C:\Windows\System\WAbsmuU.exe
  2⤵
  PID:3292
- C:\Windows\System\IfEbkzp.exe
  C:\Windows\System\IfEbkzp.exe
  2⤵
  PID:3308
- C:\Windows\System\eaHwCfy.exe
  C:\Windows\System\eaHwCfy.exe
  2⤵
  PID:3324
- C:\Windows\System\PDGQYeO.exe
  C:\Windows\System\PDGQYeO.exe
  2⤵
  PID:3340
- C:\Windows\System\KsJWTJH.exe
  C:\Windows\System\KsJWTJH.exe
  2⤵
  PID:3360
- C:\Windows\System\UyZQwfd.exe
  C:\Windows\System\UyZQwfd.exe
  2⤵
  PID:3376
- C:\Windows\System\lpoeCpw.exe
  C:\Windows\System\lpoeCpw.exe
  2⤵
  PID:3392
- C:\Windows\System\CbswtYC.exe
  C:\Windows\System\CbswtYC.exe
  2⤵
  PID:3408
- C:\Windows\System\AolrGTM.exe
  C:\Windows\System\AolrGTM.exe
  2⤵
  PID:3428
- C:\Windows\System\fSETlWs.exe
  C:\Windows\System\fSETlWs.exe
  2⤵
  PID:3444
- C:\Windows\System\vsnsiti.exe
  C:\Windows\System\vsnsiti.exe
  2⤵
  PID:3460
- C:\Windows\System\JrlKXlR.exe
  C:\Windows\System\JrlKXlR.exe
  2⤵
  PID:3476
- C:\Windows\System\uYaAJoB.exe
  C:\Windows\System\uYaAJoB.exe
  2⤵
  PID:3496
- C:\Windows\System\DywSwUB.exe
  C:\Windows\System\DywSwUB.exe
  2⤵
  PID:3512
- C:\Windows\System\kstaxfR.exe
  C:\Windows\System\kstaxfR.exe
  2⤵
  PID:3528
- C:\Windows\System\IVDgMGX.exe
  C:\Windows\System\IVDgMGX.exe
  2⤵
  PID:3724
- C:\Windows\System\STMgPVo.exe
  C:\Windows\System\STMgPVo.exe
  2⤵
  PID:3740
- C:\Windows\System\EnYUWCf.exe
  C:\Windows\System\EnYUWCf.exe
  2⤵
  PID:3756
- C:\Windows\System\EXljjNj.exe
  C:\Windows\System\EXljjNj.exe
  2⤵
  PID:3772
- C:\Windows\System\eAKUOvI.exe
  C:\Windows\System\eAKUOvI.exe
  2⤵
  PID:3788
- C:\Windows\System\YgDoUVL.exe
  C:\Windows\System\YgDoUVL.exe
  2⤵
  PID:3804
- C:\Windows\System\qWWEktS.exe
  C:\Windows\System\qWWEktS.exe
  2⤵
  PID:3824
- C:\Windows\System\gDtrDQO.exe
  C:\Windows\System\gDtrDQO.exe
  2⤵
  PID:3840
- C:\Windows\System\HxlbtTT.exe
  C:\Windows\System\HxlbtTT.exe
  2⤵
  PID:3856
- C:\Windows\System\jBhPVYe.exe
  C:\Windows\System\jBhPVYe.exe
  2⤵
  PID:3872
- C:\Windows\System\alRMHFX.exe
  C:\Windows\System\alRMHFX.exe
  2⤵
  PID:3888
- C:\Windows\System\SiWfxII.exe
  C:\Windows\System\SiWfxII.exe
  2⤵
  PID:3904
- C:\Windows\System\pMocDgA.exe
  C:\Windows\System\pMocDgA.exe
  2⤵
  PID:3920
- C:\Windows\System\KmwDTAy.exe
  C:\Windows\System\KmwDTAy.exe
  2⤵
  PID:3936
- C:\Windows\System\iGeihkX.exe
  C:\Windows\System\iGeihkX.exe
  2⤵
  PID:3952
- C:\Windows\System\OPjpwVp.exe
  C:\Windows\System\OPjpwVp.exe
  2⤵
  PID:3968
- C:\Windows\System\HwVlraJ.exe
  C:\Windows\System\HwVlraJ.exe
  2⤵
  PID:3984
- C:\Windows\System\aSSyRiF.exe
  C:\Windows\System\aSSyRiF.exe
  2⤵
  PID:4000
- C:\Windows\System\YtwFQqX.exe
  C:\Windows\System\YtwFQqX.exe
  2⤵
  PID:4024
- C:\Windows\System\CCDTMrF.exe
  C:\Windows\System\CCDTMrF.exe
  2⤵
  PID:4048
- C:\Windows\System\outnTXj.exe
  C:\Windows\System\outnTXj.exe
  2⤵
  PID:4088
- C:\Windows\System\wkEHwEr.exe
  C:\Windows\System\wkEHwEr.exe
  2⤵
  PID:2100
- C:\Windows\System\jRWoRFc.exe
  C:\Windows\System\jRWoRFc.exe
  2⤵
  PID:2984
- C:\Windows\System\eARvHvd.exe
  C:\Windows\System\eARvHvd.exe
  2⤵
  PID:2684
- C:\Windows\System\efBmsso.exe
  C:\Windows\System\efBmsso.exe
  2⤵
  PID:2372
- C:\Windows\System\SnYpkCD.exe
  C:\Windows\System\SnYpkCD.exe
  2⤵
  PID:3492
- C:\Windows\System\tOdbSAQ.exe
  C:\Windows\System\tOdbSAQ.exe
  2⤵
  PID:2340
- C:\Windows\System\kazJVLy.exe
  C:\Windows\System\kazJVLy.exe
  2⤵
  PID:3084
- C:\Windows\System\IHwdNFw.exe
  C:\Windows\System\IHwdNFw.exe
  2⤵
  PID:3184
- C:\Windows\System\xAIsaGH.exe
  C:\Windows\System\xAIsaGH.exe
  2⤵
  PID:3248
- C:\Windows\System\uATHljQ.exe
  C:\Windows\System\uATHljQ.exe
  2⤵
  PID:3288
- C:\Windows\System\sHvnOro.exe
  C:\Windows\System\sHvnOro.exe
  2⤵
  PID:3352
- C:\Windows\System\pBktepK.exe
  C:\Windows\System\pBktepK.exe
  2⤵
  PID:3416
- C:\Windows\System\wLPnZwc.exe
  C:\Windows\System\wLPnZwc.exe
  2⤵
  PID:3456
- C:\Windows\System\FetHNXy.exe
  C:\Windows\System\FetHNXy.exe
  2⤵
  PID:1780
- C:\Windows\System\otZwHLK.exe
  C:\Windows\System\otZwHLK.exe
  2⤵
  PID:3580
- C:\Windows\System\gHYZsEv.exe
  C:\Windows\System\gHYZsEv.exe
  2⤵
  PID:320
- C:\Windows\System\rAcAHkU.exe
  C:\Windows\System\rAcAHkU.exe
  2⤵
  PID:3600
- C:\Windows\System\IlYJkzh.exe
  C:\Windows\System\IlYJkzh.exe
  2⤵
  PID:3616
- C:\Windows\System\WlqgPRz.exe
  C:\Windows\System\WlqgPRz.exe
  2⤵
  PID:2164
- C:\Windows\System\zDrcxJp.exe
  C:\Windows\System\zDrcxJp.exe
  2⤵
  PID:3020
- C:\Windows\System\EywnHlB.exe
  C:\Windows\System\EywnHlB.exe
  2⤵
  PID:2220
- C:\Windows\System\JxEDTPs.exe
  C:\Windows\System\JxEDTPs.exe
  2⤵
  PID:3676
- C:\Windows\System\EIzLeCD.exe
  C:\Windows\System\EIzLeCD.exe
  2⤵
  PID:3372
- C:\Windows\System\tCCiDqC.exe
  C:\Windows\System\tCCiDqC.exe
  2⤵
  PID:3468
- C:\Windows\System\VhbjlCA.exe
  C:\Windows\System\VhbjlCA.exe
  2⤵
  PID:2644
- C:\Windows\System\XIgkNkZ.exe
  C:\Windows\System\XIgkNkZ.exe
  2⤵
  PID:872
- C:\Windows\System\BdpJabF.exe
  C:\Windows\System\BdpJabF.exe
  2⤵
  PID:1876
- C:\Windows\System\yZMnRXR.exe
  C:\Windows\System\yZMnRXR.exe
  2⤵
  PID:3096
- C:\Windows\System\iGNubhl.exe
  C:\Windows\System\iGNubhl.exe
  2⤵
  PID:3132
- C:\Windows\System\HGkeKNw.exe
  C:\Windows\System\HGkeKNw.exe
  2⤵
  PID:3236
- C:\Windows\System\JhidxXb.exe
  C:\Windows\System\JhidxXb.exe
  2⤵
  PID:3336
- C:\Windows\System\fYSViAJ.exe
  C:\Windows\System\fYSViAJ.exe
  2⤵
  PID:3536
- C:\Windows\System\WgoaXfK.exe
  C:\Windows\System\WgoaXfK.exe
  2⤵
  PID:3560
- C:\Windows\System\xEqjDsg.exe
  C:\Windows\System\xEqjDsg.exe
  2⤵
  PID:3648
- C:\Windows\System\szJkgpc.exe
  C:\Windows\System\szJkgpc.exe
  2⤵
  PID:3668
- C:\Windows\System\uLyQNLt.exe
  C:\Windows\System\uLyQNLt.exe
  2⤵
  PID:3688
- C:\Windows\System\GRRJyVS.exe
  C:\Windows\System\GRRJyVS.exe
  2⤵
  PID:3708
- C:\Windows\System\KuXCtOO.exe
  C:\Windows\System\KuXCtOO.exe
  2⤵
  PID:3732
- C:\Windows\System\pLjXJdb.exe
  C:\Windows\System\pLjXJdb.exe
  2⤵
  PID:3852
- C:\Windows\System\kJsdDEv.exe
  C:\Windows\System\kJsdDEv.exe
  2⤵
  PID:3916
- C:\Windows\System\eskhCJN.exe
  C:\Windows\System\eskhCJN.exe
  2⤵
  PID:3796
- C:\Windows\System\tsqQBde.exe
  C:\Windows\System\tsqQBde.exe
  2⤵
  PID:3868
- C:\Windows\System\RBWSXLr.exe
  C:\Windows\System\RBWSXLr.exe
  2⤵
  PID:3944
- C:\Windows\System\BzxBmku.exe
  C:\Windows\System\BzxBmku.exe
  2⤵
  PID:3996
- C:\Windows\System\MYchAkC.exe
  C:\Windows\System\MYchAkC.exe
  2⤵
  PID:3948
- C:\Windows\System\TGTaPxF.exe
  C:\Windows\System\TGTaPxF.exe
  2⤵
  PID:4044
- C:\Windows\System\LdIvkse.exe
  C:\Windows\System\LdIvkse.exe
  2⤵
  PID:3820
- C:\Windows\System\GArHYPW.exe
  C:\Windows\System\GArHYPW.exe
  2⤵
  PID:4060
- C:\Windows\System\ctQhwMZ.exe
  C:\Windows\System\ctQhwMZ.exe
  2⤵
  PID:4076
- C:\Windows\System\XmiMwcM.exe
  C:\Windows\System\XmiMwcM.exe
  2⤵
  PID:2176
- C:\Windows\System\YdUzlpr.exe
  C:\Windows\System\YdUzlpr.exe
  2⤵
  PID:1652
- C:\Windows\System\RjeJSJw.exe
  C:\Windows\System\RjeJSJw.exe
  2⤵
  PID:3232
- C:\Windows\System\ITwcPnC.exe
  C:\Windows\System\ITwcPnC.exe
  2⤵
  PID:3204
- C:\Windows\System\CadTTjV.exe
  C:\Windows\System\CadTTjV.exe
  2⤵
  PID:572
- C:\Windows\System\uTJndiq.exe
  C:\Windows\System\uTJndiq.exe
  2⤵
  PID:2272
- C:\Windows\System\UcQEdRw.exe
  C:\Windows\System\UcQEdRw.exe
  2⤵
  PID:3080
- C:\Windows\System\obptlbw.exe
  C:\Windows\System\obptlbw.exe
  2⤵
  PID:3320
- C:\Windows\System\Jepmtsv.exe
  C:\Windows\System\Jepmtsv.exe
  2⤵
  PID:3576
- C:\Windows\System\YDwbaDj.exe
  C:\Windows\System\YDwbaDj.exe
  2⤵
  PID:1084
- C:\Windows\System\aglOaOh.exe
  C:\Windows\System\aglOaOh.exe
  2⤵
  PID:1728
- C:\Windows\System\bxmEFiZ.exe
  C:\Windows\System\bxmEFiZ.exe
  2⤵
  PID:3628
- C:\Windows\System\wGmlSQm.exe
  C:\Windows\System\wGmlSQm.exe
  2⤵
  PID:3136
- C:\Windows\System\pdmXBfA.exe
  C:\Windows\System\pdmXBfA.exe
  2⤵
  PID:3556
- C:\Windows\System\nOISOxf.exe
  C:\Windows\System\nOISOxf.exe
  2⤵
  PID:3704
- C:\Windows\System\wkspFyH.exe
  C:\Windows\System\wkspFyH.exe
  2⤵
  PID:3960
- C:\Windows\System\JEFayEW.exe
  C:\Windows\System\JEFayEW.exe
  2⤵
  PID:3752
- C:\Windows\System\pDEoHpn.exe
  C:\Windows\System\pDEoHpn.exe
  2⤵
  PID:3680
- C:\Windows\System\hSzlUfB.exe
  C:\Windows\System\hSzlUfB.exe
  2⤵
  PID:3720
- C:\Windows\System\rrYMEIq.exe
  C:\Windows\System\rrYMEIq.exe
  2⤵
  PID:3488
- C:\Windows\System\YmkHbNf.exe
  C:\Windows\System\YmkHbNf.exe
  2⤵
  PID:2904
- C:\Windows\System\JvmcPiG.exe
  C:\Windows\System\JvmcPiG.exe
  2⤵
  PID:952
- C:\Windows\System\pWlbvmg.exe
  C:\Windows\System\pWlbvmg.exe
  2⤵
  PID:1256
- C:\Windows\System\HZFWHqP.exe
  C:\Windows\System\HZFWHqP.exe
  2⤵
  PID:1500
- C:\Windows\System\whhKXAh.exe
  C:\Windows\System\whhKXAh.exe
  2⤵
  PID:3592
- C:\Windows\System\ZTzBIuz.exe
  C:\Windows\System\ZTzBIuz.exe
  2⤵
  PID:3544
- C:\Windows\System\MgwycSk.exe
  C:\Windows\System\MgwycSk.exe
  2⤵
  PID:2400
- C:\Windows\System\zRNHwkx.exe
  C:\Windows\System\zRNHwkx.exe
  2⤵
  PID:3552
- C:\Windows\System\FqzClRb.exe
  C:\Windows\System\FqzClRb.exe
  2⤵
  PID:3644
- C:\Windows\System\TvciBfG.exe
  C:\Windows\System\TvciBfG.exe
  2⤵
  PID:3540
- C:\Windows\System\kBNyWYK.exe
  C:\Windows\System\kBNyWYK.exe
  2⤵
  PID:3836
- C:\Windows\System\clGPYcM.exe
  C:\Windows\System\clGPYcM.exe
  2⤵
  PID:4036
- C:\Windows\System\qNSAzkO.exe
  C:\Windows\System\qNSAzkO.exe
  2⤵
  PID:4072
- C:\Windows\System\DEjwbXG.exe
  C:\Windows\System\DEjwbXG.exe
  2⤵
  PID:4020
- C:\Windows\System\NdIcHvI.exe
  C:\Windows\System\NdIcHvI.exe
  2⤵
  PID:2512
- C:\Windows\System\byvVEzx.exe
  C:\Windows\System\byvVEzx.exe
  2⤵
  PID:3148
- C:\Windows\System\dGgMISL.exe
  C:\Windows\System\dGgMISL.exe
  2⤵
  PID:2036
- C:\Windows\System\aHQzhTR.exe
  C:\Windows\System\aHQzhTR.exe
  2⤵
  PID:3284
- C:\Windows\System\dHXlDVg.exe
  C:\Windows\System\dHXlDVg.exe
  2⤵
  PID:3612
- C:\Windows\System\xYBJjUF.exe
  C:\Windows\System\xYBJjUF.exe
  2⤵
  PID:3216
- C:\Windows\System\lrblekp.exe
  C:\Windows\System\lrblekp.exe
  2⤵
  PID:1388
- C:\Windows\System\yzaNXln.exe
  C:\Windows\System\yzaNXln.exe
  2⤵
  PID:3368
- C:\Windows\System\nLDhXqQ.exe
  C:\Windows\System\nLDhXqQ.exe
  2⤵
  PID:3640
- C:\Windows\System\xabjVOc.exe
  C:\Windows\System\xabjVOc.exe
  2⤵
  PID:1796
- C:\Windows\System\NoYyvSL.exe
  C:\Windows\System\NoYyvSL.exe
  2⤵
  PID:3608
- C:\Windows\System\RgeEncf.exe
  C:\Windows\System\RgeEncf.exe
  2⤵
  PID:1928
- C:\Windows\System\FvxupBd.exe
  C:\Windows\System\FvxupBd.exe
  2⤵
  PID:3992
- C:\Windows\System\FYlPhCw.exe
  C:\Windows\System\FYlPhCw.exe
  2⤵
  PID:2808
- C:\Windows\System\UguAShF.exe
  C:\Windows\System\UguAShF.exe
  2⤵
  PID:3256
- C:\Windows\System\FPiIqdJ.exe
  C:\Windows\System\FPiIqdJ.exe
  2⤵
  PID:3452
- C:\Windows\System\ldZpLDg.exe
  C:\Windows\System\ldZpLDg.exe
  2⤵
  PID:3508
- C:\Windows\System\WMoVCTi.exe
  C:\Windows\System\WMoVCTi.exe
  2⤵
  PID:3200
- C:\Windows\System\mmChMRa.exe
  C:\Windows\System\mmChMRa.exe
  2⤵
  PID:4104
- C:\Windows\System\MyYbzuX.exe
  C:\Windows\System\MyYbzuX.exe
  2⤵
  PID:4124
- C:\Windows\System\mCfGCjy.exe
  C:\Windows\System\mCfGCjy.exe
  2⤵
  PID:4148
- C:\Windows\System\KffeCkx.exe
  C:\Windows\System\KffeCkx.exe
  2⤵
  PID:4164
- C:\Windows\System\ODwFDJv.exe
  C:\Windows\System\ODwFDJv.exe
  2⤵
  PID:4180
- C:\Windows\System\Vcuaamm.exe
  C:\Windows\System\Vcuaamm.exe
  2⤵
  PID:4200
- C:\Windows\System\yhHBDvA.exe
  C:\Windows\System\yhHBDvA.exe
  2⤵
  PID:4216
- C:\Windows\System\cfslRCB.exe
  C:\Windows\System\cfslRCB.exe
  2⤵
  PID:4236
- C:\Windows\System\BQApCqa.exe
  C:\Windows\System\BQApCqa.exe
  2⤵
  PID:4252
- C:\Windows\System\ujHHTlX.exe
  C:\Windows\System\ujHHTlX.exe
  2⤵
  PID:4268
- C:\Windows\System\ZFjtGbZ.exe
  C:\Windows\System\ZFjtGbZ.exe
  2⤵
  PID:4284
- C:\Windows\System\pieCNVz.exe
  C:\Windows\System\pieCNVz.exe
  2⤵
  PID:4300
- C:\Windows\System\pLSidLb.exe
  C:\Windows\System\pLSidLb.exe
  2⤵
  PID:4316
- C:\Windows\System\TQefkso.exe
  C:\Windows\System\TQefkso.exe
  2⤵
  PID:4332
- C:\Windows\System\kZVQVsd.exe
  C:\Windows\System\kZVQVsd.exe
  2⤵
  PID:4348
- C:\Windows\System\KnmLAau.exe
  C:\Windows\System\KnmLAau.exe
  2⤵
  PID:4364
- C:\Windows\System\bHeOFfV.exe
  C:\Windows\System\bHeOFfV.exe
  2⤵
  PID:4380
- C:\Windows\System\fDwwcuD.exe
  C:\Windows\System\fDwwcuD.exe
  2⤵
  PID:4396
- C:\Windows\System\JuqayCO.exe
  C:\Windows\System\JuqayCO.exe
  2⤵
  PID:4412
- C:\Windows\System\dkeIWRk.exe
  C:\Windows\System\dkeIWRk.exe
  2⤵
  PID:4428
- C:\Windows\System\vwjQiwn.exe
  C:\Windows\System\vwjQiwn.exe
  2⤵
  PID:4448
- C:\Windows\System\okwUXtR.exe
  C:\Windows\System\okwUXtR.exe
  2⤵
  PID:4464
- C:\Windows\System\dTKgsrv.exe
  C:\Windows\System\dTKgsrv.exe
  2⤵
  PID:4480
- C:\Windows\System\bJpssWu.exe
  C:\Windows\System\bJpssWu.exe
  2⤵
  PID:4496
- C:\Windows\System\ZyOJZLc.exe
  C:\Windows\System\ZyOJZLc.exe
  2⤵
  PID:4516
- C:\Windows\System\dvDwQuh.exe
  C:\Windows\System\dvDwQuh.exe
  2⤵
  PID:4532
- C:\Windows\System\dDvAdCQ.exe
  C:\Windows\System\dDvAdCQ.exe
  2⤵
  PID:4548
- C:\Windows\System\zsKoYvn.exe
  C:\Windows\System\zsKoYvn.exe
  2⤵
  PID:4564
- C:\Windows\System\qECrXnh.exe
  C:\Windows\System\qECrXnh.exe
  2⤵
  PID:4580
- C:\Windows\System\bkqIjuT.exe
  C:\Windows\System\bkqIjuT.exe
  2⤵
  PID:4600
- C:\Windows\System\VtXYLoC.exe
  C:\Windows\System\VtXYLoC.exe
  2⤵
  PID:4616
- C:\Windows\System\iZbRsZm.exe
  C:\Windows\System\iZbRsZm.exe
  2⤵
  PID:4632
- C:\Windows\System\PqQxnpF.exe
  C:\Windows\System\PqQxnpF.exe
  2⤵
  PID:4648
- C:\Windows\System\mbpQICW.exe
  C:\Windows\System\mbpQICW.exe
  2⤵
  PID:4664
- C:\Windows\System\ArWbJLC.exe
  C:\Windows\System\ArWbJLC.exe
  2⤵
  PID:4680
- C:\Windows\System\paKXNkC.exe
  C:\Windows\System\paKXNkC.exe
  2⤵
  PID:4696
- C:\Windows\System\QryoMVr.exe
  C:\Windows\System\QryoMVr.exe
  2⤵
  PID:4712
- C:\Windows\System\vtWpPlT.exe
  C:\Windows\System\vtWpPlT.exe
  2⤵
  PID:4728
- C:\Windows\System\HgKrowh.exe
  C:\Windows\System\HgKrowh.exe
  2⤵
  PID:4744
- C:\Windows\System\XNGWwQy.exe
  C:\Windows\System\XNGWwQy.exe
  2⤵
  PID:4764
- C:\Windows\System\euTBjFQ.exe
  C:\Windows\System\euTBjFQ.exe
  2⤵
  PID:4780
- C:\Windows\System\mJkBGhp.exe
  C:\Windows\System\mJkBGhp.exe
  2⤵
  PID:4796
- C:\Windows\System\SZQpAEa.exe
  C:\Windows\System\SZQpAEa.exe
  2⤵
  PID:4812
- C:\Windows\System\MBUGrtH.exe
  C:\Windows\System\MBUGrtH.exe
  2⤵
  PID:4828
- C:\Windows\System\eTPuilP.exe
  C:\Windows\System\eTPuilP.exe
  2⤵
  PID:4844
- C:\Windows\System\WUmjzYS.exe
  C:\Windows\System\WUmjzYS.exe
  2⤵
  PID:4860
- C:\Windows\System\MrPlEIy.exe
  C:\Windows\System\MrPlEIy.exe
  2⤵
  PID:4876
- C:\Windows\System\MIZaiiW.exe
  C:\Windows\System\MIZaiiW.exe
  2⤵
  PID:4892
- C:\Windows\System\WGxpjOp.exe
  C:\Windows\System\WGxpjOp.exe
  2⤵
  PID:4908
- C:\Windows\System\JRJoGGR.exe
  C:\Windows\System\JRJoGGR.exe
  2⤵
  PID:4924
- C:\Windows\System\EtbSjks.exe
  C:\Windows\System\EtbSjks.exe
  2⤵
  PID:4940
- C:\Windows\System\drlMORd.exe
  C:\Windows\System\drlMORd.exe
  2⤵
  PID:4956
- C:\Windows\System\pXdlOrm.exe
  C:\Windows\System\pXdlOrm.exe
  2⤵
  PID:4972
- C:\Windows\System\arqvNPa.exe
  C:\Windows\System\arqvNPa.exe
  2⤵
  PID:4988
- C:\Windows\System\kEuYsqa.exe
  C:\Windows\System\kEuYsqa.exe
  2⤵
  PID:5004
- C:\Windows\System\hfcLHgU.exe
  C:\Windows\System\hfcLHgU.exe
  2⤵
  PID:1888
- C:\Windows\System\HmaipUI.exe
  C:\Windows\System\HmaipUI.exe
  2⤵
  PID:4244
- C:\Windows\System\tXMLfDC.exe
  C:\Windows\System\tXMLfDC.exe
  2⤵
  PID:4328
- C:\Windows\System\pDjYoeK.exe
  C:\Windows\System\pDjYoeK.exe
  2⤵
  PID:4356
- C:\Windows\System\pwXIigx.exe
  C:\Windows\System\pwXIigx.exe
  2⤵
  PID:4456
- C:\Windows\System\CNNhtKG.exe
  C:\Windows\System\CNNhtKG.exe
  2⤵
  PID:4492
- C:\Windows\System\UpGsBcD.exe
  C:\Windows\System\UpGsBcD.exe
  2⤵
  PID:4624
- C:\Windows\System\VQVCilC.exe
  C:\Windows\System\VQVCilC.exe
  2⤵
  PID:4628
- C:\Windows\System\ItXEOYe.exe
  C:\Windows\System\ItXEOYe.exe
  2⤵
  PID:4692
- C:\Windows\System\BqrAENC.exe
  C:\Windows\System\BqrAENC.exe
  2⤵
  PID:4756
- C:\Windows\System\DgePfFG.exe
  C:\Windows\System\DgePfFG.exe
  2⤵
  PID:4788
- C:\Windows\System\WfZuqxW.exe
  C:\Windows\System\WfZuqxW.exe
  2⤵
  PID:4856
- C:\Windows\System\hybdQxI.exe
  C:\Windows\System\hybdQxI.exe
  2⤵
  PID:4872
- C:\Windows\System\xwJEgSx.exe
  C:\Windows\System\xwJEgSx.exe
  2⤵
  PID:4644
- C:\Windows\System\LtpIUoD.exe
  C:\Windows\System\LtpIUoD.exe
  2⤵
  PID:4708
- C:\Windows\System\UyLXGwZ.exe
  C:\Windows\System\UyLXGwZ.exe
  2⤵
  PID:4776
- C:\Windows\System\CwPLzzF.exe
  C:\Windows\System\CwPLzzF.exe
  2⤵
  PID:4948
- C:\Windows\System\EquNfgm.exe
  C:\Windows\System\EquNfgm.exe
  2⤵
  PID:4980
- C:\Windows\System\BIrwREo.exe
  C:\Windows\System\BIrwREo.exe
  2⤵
  PID:5000
- C:\Windows\System\ucuGcvu.exe
  C:\Windows\System\ucuGcvu.exe
  2⤵
  PID:5028
- C:\Windows\System\OfBvJgk.exe
  C:\Windows\System\OfBvJgk.exe
  2⤵
  PID:5048
- C:\Windows\System\SWdjKpX.exe
  C:\Windows\System\SWdjKpX.exe
  2⤵
  PID:5072
- C:\Windows\System\fRcNOgK.exe
  C:\Windows\System\fRcNOgK.exe
  2⤵
  PID:5084
- C:\Windows\System\yKgbHaQ.exe
  C:\Windows\System\yKgbHaQ.exe
  2⤵
  PID:5116
- C:\Windows\System\CYEWZoI.exe
  C:\Windows\System\CYEWZoI.exe
  2⤵
  PID:3636
- C:\Windows\System\fsPiRUN.exe
  C:\Windows\System\fsPiRUN.exe
  2⤵
  PID:3520
- C:\Windows\System\gLcVcMT.exe
  C:\Windows\System\gLcVcMT.exe
  2⤵
  PID:4100
- C:\Windows\System\IxIWAPs.exe
  C:\Windows\System\IxIWAPs.exe
  2⤵
  PID:3172
- C:\Windows\System\DFcjMcb.exe
  C:\Windows\System\DFcjMcb.exe
  2⤵
  PID:4160
- C:\Windows\System\eTRVvzp.exe
  C:\Windows\System\eTRVvzp.exe
  2⤵
  PID:4012
- C:\Windows\System\ffwolPB.exe
  C:\Windows\System\ffwolPB.exe
  2⤵
  PID:4172
- C:\Windows\System\VWwfzLt.exe
  C:\Windows\System\VWwfzLt.exe
  2⤵
  PID:4212
- C:\Windows\System\MTUfctE.exe
  C:\Windows\System\MTUfctE.exe
  2⤵
  PID:4372
- C:\Windows\System\NSOhLkW.exe
  C:\Windows\System\NSOhLkW.exe
  2⤵
  PID:4376
- C:\Windows\System\pqhxgma.exe
  C:\Windows\System\pqhxgma.exe
  2⤵
  PID:4472
- C:\Windows\System\AydswCJ.exe
  C:\Windows\System\AydswCJ.exe
  2⤵
  PID:4528
- C:\Windows\System\zgAoqpK.exe
  C:\Windows\System\zgAoqpK.exe
  2⤵
  PID:4660
- C:\Windows\System\kXbqwSN.exe
  C:\Windows\System\kXbqwSN.exe
  2⤵
  PID:4540
- C:\Windows\System\riQjLQc.exe
  C:\Windows\System\riQjLQc.exe
  2⤵
  PID:4572
- C:\Windows\System\ZDEHYvZ.exe
  C:\Windows\System\ZDEHYvZ.exe
  2⤵
  PID:4260
- C:\Windows\System\fUdhtaf.exe
  C:\Windows\System\fUdhtaf.exe
  2⤵
  PID:4704
- C:\Windows\System\atqrQZi.exe
  C:\Windows\System\atqrQZi.exe
  2⤵
  PID:4868
- C:\Windows\System\DHKRPsA.exe
  C:\Windows\System\DHKRPsA.exe
  2⤵
  PID:5012
- C:\Windows\System\RORTmHJ.exe
  C:\Windows\System\RORTmHJ.exe
  2⤵
  PID:5020
- C:\Windows\System\LzdWarB.exe
  C:\Windows\System\LzdWarB.exe
  2⤵
  PID:5044
- C:\Windows\System\pDDNuhi.exe
  C:\Windows\System\pDDNuhi.exe
  2⤵
  PID:5076
- C:\Windows\System\lctByfw.exe
  C:\Windows\System\lctByfw.exe
  2⤵
  PID:1172
- C:\Windows\System\ffwRiYm.exe
  C:\Windows\System\ffwRiYm.exe
  2⤵
  PID:4232
- C:\Windows\System\CKiwkHl.exe
  C:\Windows\System\CKiwkHl.exe
  2⤵
  PID:4592
- C:\Windows\System\LufFzWc.exe
  C:\Windows\System\LufFzWc.exe
  2⤵
  PID:4444
- C:\Windows\System\dmFwwRM.exe
  C:\Windows\System\dmFwwRM.exe
  2⤵
  PID:4820
- C:\Windows\System\qvjvSzz.exe
  C:\Windows\System\qvjvSzz.exe
  2⤵
  PID:4504
- C:\Windows\System\hKcuEZm.exe
  C:\Windows\System\hKcuEZm.exe
  2⤵
  PID:4808
- C:\Windows\System\szMKBdW.exe
  C:\Windows\System\szMKBdW.exe
  2⤵
  PID:4840
- C:\Windows\System\IKycMyq.exe
  C:\Windows\System\IKycMyq.exe
  2⤵
  PID:4772
- C:\Windows\System\fgjrKaL.exe
  C:\Windows\System\fgjrKaL.exe
  2⤵
  PID:5080
- C:\Windows\System\YsuybAN.exe
  C:\Windows\System\YsuybAN.exe
  2⤵
  PID:5036
- C:\Windows\System\KjYHYkW.exe
  C:\Windows\System\KjYHYkW.exe
  2⤵
  PID:2296
- C:\Windows\System\UHkSZbk.exe
  C:\Windows\System\UHkSZbk.exe
  2⤵
  PID:3780
- C:\Windows\System\olXyWqF.exe
  C:\Windows\System\olXyWqF.exe
  2⤵
  PID:4156
- C:\Windows\System\piucQCo.exe
  C:\Windows\System\piucQCo.exe
  2⤵
  PID:3928
- C:\Windows\System\AWGTfWp.exe
  C:\Windows\System\AWGTfWp.exe
  2⤵
  PID:4188
- C:\Windows\System\LFuAHsG.exe
  C:\Windows\System\LFuAHsG.exe
  2⤵
  PID:4852
- C:\Windows\System\OJPXiED.exe
  C:\Windows\System\OJPXiED.exe
  2⤵
  PID:4740
- C:\Windows\System\gGwNoBk.exe
  C:\Windows\System\gGwNoBk.exe
  2⤵
  PID:5108
- C:\Windows\System\iAZfObh.exe
  C:\Windows\System\iAZfObh.exe
  2⤵
  PID:4968
- C:\Windows\System\ahailsk.exe
  C:\Windows\System\ahailsk.exe
  2⤵
  PID:4296
- C:\Windows\System\sFkajCN.exe
  C:\Windows\System\sFkajCN.exe
  2⤵
  PID:4408
- C:\Windows\System\ZDBqoWB.exe
  C:\Windows\System\ZDBqoWB.exe
  2⤵
  PID:4576
- C:\Windows\System\JAXzkSV.exe
  C:\Windows\System\JAXzkSV.exe
  2⤵
  PID:2664
- C:\Windows\System\xYlGvsG.exe
  C:\Windows\System\xYlGvsG.exe
  2⤵
  PID:4932
- C:\Windows\System\tGeUQNT.exe
  C:\Windows\System\tGeUQNT.exe
  2⤵
  PID:3524
- C:\Windows\System\gLZVPVM.exe
  C:\Windows\System\gLZVPVM.exe
  2⤵
  PID:4344
- C:\Windows\System\AJtovCp.exe
  C:\Windows\System\AJtovCp.exe
  2⤵
  PID:4228
- C:\Windows\System\GddEVac.exe
  C:\Windows\System\GddEVac.exe
  2⤵
  PID:5040
- C:\Windows\System\onmdScz.exe
  C:\Windows\System\onmdScz.exe
  2⤵
  PID:4120
- C:\Windows\System\iUQDYXa.exe
  C:\Windows\System\iUQDYXa.exe
  2⤵
  PID:5128
- C:\Windows\System\arsaKuR.exe
  C:\Windows\System\arsaKuR.exe
  2⤵
  PID:5144
- C:\Windows\System\jHTcDCl.exe
  C:\Windows\System\jHTcDCl.exe
  2⤵
  PID:5184
- C:\Windows\System\BHtZTPl.exe
  C:\Windows\System\BHtZTPl.exe
  2⤵
  PID:5200
- C:\Windows\System\uexoJEK.exe
  C:\Windows\System\uexoJEK.exe
  2⤵
  PID:5216
- C:\Windows\System\eXBJyoK.exe
  C:\Windows\System\eXBJyoK.exe
  2⤵
  PID:5236
- C:\Windows\System\ExVawAg.exe
  C:\Windows\System\ExVawAg.exe
  2⤵
  PID:5256
- C:\Windows\System\JkchOeT.exe
  C:\Windows\System\JkchOeT.exe
  2⤵
  PID:5276
- C:\Windows\System\yTFxbYA.exe
  C:\Windows\System\yTFxbYA.exe
  2⤵
  PID:5292
- C:\Windows\System\RyDOjIY.exe
  C:\Windows\System\RyDOjIY.exe
  2⤵
  PID:5312
- C:\Windows\System\OssVNfm.exe
  C:\Windows\System\OssVNfm.exe
  2⤵
  PID:5328
- C:\Windows\System\tLBXKVH.exe
  C:\Windows\System\tLBXKVH.exe
  2⤵
  PID:5348
- C:\Windows\System\FyUPTef.exe
  C:\Windows\System\FyUPTef.exe
  2⤵
  PID:5364
- C:\Windows\System\LIuWfvz.exe
  C:\Windows\System\LIuWfvz.exe
  2⤵
  PID:5380
- C:\Windows\System\FnSzSfK.exe
  C:\Windows\System\FnSzSfK.exe
  2⤵
  PID:5396
- C:\Windows\System\SGwSerE.exe
  C:\Windows\System\SGwSerE.exe
  2⤵
  PID:5416
- C:\Windows\System\BZgvVsq.exe
  C:\Windows\System\BZgvVsq.exe
  2⤵
  PID:5464
- C:\Windows\System\volUsuc.exe
  C:\Windows\System\volUsuc.exe
  2⤵
  PID:5480
- C:\Windows\System\oMjKjYK.exe
  C:\Windows\System\oMjKjYK.exe
  2⤵
  PID:5500
- C:\Windows\System\cNEalgZ.exe
  C:\Windows\System\cNEalgZ.exe
  2⤵
  PID:5516
- C:\Windows\System\AjGBEkM.exe
  C:\Windows\System\AjGBEkM.exe
  2⤵
  PID:5532
- C:\Windows\System\GRbrimK.exe
  C:\Windows\System\GRbrimK.exe
  2⤵
  PID:5548
- C:\Windows\System\iDMXTLF.exe
  C:\Windows\System\iDMXTLF.exe
  2⤵
  PID:5564
- C:\Windows\System\GXaTLes.exe
  C:\Windows\System\GXaTLes.exe
  2⤵
  PID:5580
- C:\Windows\System\bjngWYP.exe
  C:\Windows\System\bjngWYP.exe
  2⤵
  PID:5616
- C:\Windows\System\hjnktoW.exe
  C:\Windows\System\hjnktoW.exe
  2⤵
  PID:5636
- C:\Windows\System\VSEgkEi.exe
  C:\Windows\System\VSEgkEi.exe
  2⤵
  PID:5652
- C:\Windows\System\NpJvTnb.exe
  C:\Windows\System\NpJvTnb.exe
  2⤵
  PID:5672
- C:\Windows\System\OeOopzN.exe
  C:\Windows\System\OeOopzN.exe
  2⤵
  PID:5700
- C:\Windows\System\GcExwAP.exe
  C:\Windows\System\GcExwAP.exe
  2⤵
  PID:5716
- C:\Windows\System\cTUSckK.exe
  C:\Windows\System\cTUSckK.exe
  2⤵
  PID:5740
- C:\Windows\System\cacIYXc.exe
  C:\Windows\System\cacIYXc.exe
  2⤵
  PID:5756
- C:\Windows\System\pLNNikG.exe
  C:\Windows\System\pLNNikG.exe
  2⤵
  PID:5772
- C:\Windows\System\GIaUIhO.exe
  C:\Windows\System\GIaUIhO.exe
  2⤵
  PID:5788
- C:\Windows\System\sdqvcZO.exe
  C:\Windows\System\sdqvcZO.exe
  2⤵
  PID:5804
- C:\Windows\System\fNgLGFB.exe
  C:\Windows\System\fNgLGFB.exe
  2⤵
  PID:5888
- C:\Windows\System\QVGAvSQ.exe
  C:\Windows\System\QVGAvSQ.exe
  2⤵
  PID:5908
- C:\Windows\System\nthZNtv.exe
  C:\Windows\System\nthZNtv.exe
  2⤵
  PID:5932
- C:\Windows\System\wzTARil.exe
  C:\Windows\System\wzTARil.exe
  2⤵
  PID:5948
- C:\Windows\System\oGYDMDt.exe
  C:\Windows\System\oGYDMDt.exe
  2⤵
  PID:5972
- C:\Windows\System\Kqkqnqf.exe
  C:\Windows\System\Kqkqnqf.exe
  2⤵
  PID:5992
- C:\Windows\System\sMXAkNB.exe
  C:\Windows\System\sMXAkNB.exe
  2⤵
  PID:6008
- C:\Windows\System\QFYoECh.exe
  C:\Windows\System\QFYoECh.exe
  2⤵
  PID:6028
- C:\Windows\System\ChgZvGn.exe
  C:\Windows\System\ChgZvGn.exe
  2⤵
  PID:6044
- C:\Windows\System\OaGgVFg.exe
  C:\Windows\System\OaGgVFg.exe
  2⤵
  PID:6060
- C:\Windows\System\PzPOfUW.exe
  C:\Windows\System\PzPOfUW.exe
  2⤵
  PID:6076
- C:\Windows\System\bEcwPYL.exe
  C:\Windows\System\bEcwPYL.exe
  2⤵
  PID:6096
- C:\Windows\System\XnVhWcj.exe
  C:\Windows\System\XnVhWcj.exe
  2⤵
  PID:6116
- C:\Windows\System\FsMEvey.exe
  C:\Windows\System\FsMEvey.exe
  2⤵
  PID:6132
- C:\Windows\System\hJqMwRY.exe
  C:\Windows\System\hJqMwRY.exe
  2⤵
  PID:4724
- C:\Windows\System\LkMwYZo.exe
  C:\Windows\System\LkMwYZo.exe
  2⤵
  PID:4208
- C:\Windows\System\ARhyXgb.exe
  C:\Windows\System\ARhyXgb.exe
  2⤵
  PID:5160
- C:\Windows\System\EOwWymu.exe
  C:\Windows\System\EOwWymu.exe
  2⤵
  PID:4760
- C:\Windows\System\Rldgogh.exe
  C:\Windows\System\Rldgogh.exe
  2⤵
  PID:5140
- C:\Windows\System\quZelDl.exe
  C:\Windows\System\quZelDl.exe
  2⤵
  PID:5196
- C:\Windows\System\pRpyGyg.exe
  C:\Windows\System\pRpyGyg.exe
  2⤵
  PID:5288
- C:\Windows\System\laxlljo.exe
  C:\Windows\System\laxlljo.exe
  2⤵
  PID:5320
- C:\Windows\System\DFFFjaR.exe
  C:\Windows\System\DFFFjaR.exe
  2⤵
  PID:5344
- C:\Windows\System\opqLSOK.exe
  C:\Windows\System\opqLSOK.exe
  2⤵
  PID:5376
- C:\Windows\System\FQJGYyL.exe
  C:\Windows\System\FQJGYyL.exe
  2⤵
  PID:5304
- C:\Windows\System\mXWlkBf.exe
  C:\Windows\System\mXWlkBf.exe
  2⤵
  PID:5388
- C:\Windows\System\IgbREFH.exe
  C:\Windows\System\IgbREFH.exe
  2⤵
  PID:5436
- C:\Windows\System\tjpyldS.exe
  C:\Windows\System\tjpyldS.exe
  2⤵
  PID:5576
- C:\Windows\System\wgCeShN.exe
  C:\Windows\System\wgCeShN.exe
  2⤵
  PID:5644
- C:\Windows\System\GKPPDPf.exe
  C:\Windows\System\GKPPDPf.exe
  2⤵
  PID:5688
- C:\Windows\System\NfbzIdu.exe
  C:\Windows\System\NfbzIdu.exe
  2⤵
  PID:5684
- C:\Windows\System\ubgXmsf.exe
  C:\Windows\System\ubgXmsf.exe
  2⤵
  PID:5660
- C:\Windows\System\XrXAeno.exe
  C:\Windows\System\XrXAeno.exe
  2⤵
  PID:5732
- C:\Windows\System\AKiAPhk.exe
  C:\Windows\System\AKiAPhk.exe
  2⤵
  PID:5752
- C:\Windows\System\ZMONral.exe
  C:\Windows\System\ZMONral.exe
  2⤵
  PID:5816
- C:\Windows\System\XWoEWGb.exe
  C:\Windows\System\XWoEWGb.exe
  2⤵
  PID:5800
- C:\Windows\System\OmpXQhq.exe
  C:\Windows\System\OmpXQhq.exe
  2⤵
  PID:5836
- C:\Windows\System\raisoOn.exe
  C:\Windows\System\raisoOn.exe
  2⤵
  PID:5852
- C:\Windows\System\WwkoVle.exe
  C:\Windows\System\WwkoVle.exe
  2⤵
  PID:5868
- C:\Windows\System\esMNrlL.exe
  C:\Windows\System\esMNrlL.exe
  2⤵
  PID:5904
- C:\Windows\System\ssWAkNx.exe
  C:\Windows\System\ssWAkNx.exe
  2⤵
  PID:6016
- C:\Windows\System\OvwyVvD.exe
  C:\Windows\System\OvwyVvD.exe
  2⤵
  PID:2876
- C:\Windows\System\UQLfskB.exe
  C:\Windows\System\UQLfskB.exe
  2⤵
  PID:5920
- C:\Windows\System\yiwqXMw.exe
  C:\Windows\System\yiwqXMw.exe
  2⤵
  PID:6024
- C:\Windows\System\uBUnwGY.exe
  C:\Windows\System\uBUnwGY.exe
  2⤵
  PID:6068
- C:\Windows\System\QJkTUTY.exe
  C:\Windows\System\QJkTUTY.exe
  2⤵
  PID:6084
- C:\Windows\System\XuNjRAc.exe
  C:\Windows\System\XuNjRAc.exe
  2⤵
  PID:5244
- C:\Windows\System\WyhLQtI.exe
  C:\Windows\System\WyhLQtI.exe
  2⤵
  PID:996
- C:\Windows\System\obUOkGZ.exe
  C:\Windows\System\obUOkGZ.exe
  2⤵
  PID:5300
- C:\Windows\System\VIqJEPo.exe
  C:\Windows\System\VIqJEPo.exe
  2⤵
  PID:5068
- C:\Windows\System\zsWcEKR.exe
  C:\Windows\System\zsWcEKR.exe
  2⤵
  PID:5360
- C:\Windows\System\iFMddOs.exe
  C:\Windows\System\iFMddOs.exe
  2⤵
  PID:5408
- C:\Windows\System\lymwGOk.exe
  C:\Windows\System\lymwGOk.exe
  2⤵
  PID:5432
- C:\Windows\System\XNEpvhY.exe
  C:\Windows\System\XNEpvhY.exe
  2⤵
  PID:5472
- C:\Windows\System\zUClKFJ.exe
  C:\Windows\System\zUClKFJ.exe
  2⤵
  PID:5508
- C:\Windows\System\GokYBBZ.exe
  C:\Windows\System\GokYBBZ.exe
  2⤵
  PID:5540
- C:\Windows\System\lWIUgJt.exe
  C:\Windows\System\lWIUgJt.exe
  2⤵
  PID:5596
- C:\Windows\System\zYftKHt.exe
  C:\Windows\System\zYftKHt.exe
  2⤵
  PID:5612
- C:\Windows\System\ufzVyge.exe
  C:\Windows\System\ufzVyge.exe
  2⤵
  PID:5764
- C:\Windows\System\hSzEHtn.exe
  C:\Windows\System\hSzEHtn.exe
  2⤵
  PID:5748
- C:\Windows\System\lohJmSB.exe
  C:\Windows\System\lohJmSB.exe
  2⤵
  PID:6020
- C:\Windows\System\bDKRHHr.exe
  C:\Windows\System\bDKRHHr.exe
  2⤵
  PID:6092
- C:\Windows\System\wfFWWcU.exe
  C:\Windows\System\wfFWWcU.exe
  2⤵
  PID:5872
- C:\Windows\System\hsTLPTt.exe
  C:\Windows\System\hsTLPTt.exe
  2⤵
  PID:5784
- C:\Windows\System\KslHUUo.exe
  C:\Windows\System\KslHUUo.exe
  2⤵
  PID:5964
- C:\Windows\System\XCEnTNd.exe
  C:\Windows\System\XCEnTNd.exe
  2⤵
  PID:6108
- C:\Windows\System\koAChhG.exe
  C:\Windows\System\koAChhG.exe
  2⤵
  PID:6056
- C:\Windows\System\AjXJnYm.exe
  C:\Windows\System\AjXJnYm.exe
  2⤵
  PID:5232
- C:\Windows\System\QXViWxJ.exe
  C:\Windows\System\QXViWxJ.exe
  2⤵
  PID:5180
- C:\Windows\System\HtuLlAU.exe
  C:\Windows\System\HtuLlAU.exe
  2⤵
  PID:5544
- C:\Windows\System\OniOYBm.exe
  C:\Windows\System\OniOYBm.exe
  2⤵
  PID:5844
- C:\Windows\System\eqxftrU.exe
  C:\Windows\System\eqxftrU.exe
  2⤵
  PID:5628
- C:\Windows\System\ZNWEJLX.exe
  C:\Windows\System\ZNWEJLX.exe
  2⤵
  PID:5424
- C:\Windows\System\lZpJyDl.exe
  C:\Windows\System\lZpJyDl.exe
  2⤵
  PID:5268
- C:\Windows\System\fGYeBqN.exe
  C:\Windows\System\fGYeBqN.exe
  2⤵
  PID:5876
- C:\Windows\System\adWrWEN.exe
  C:\Windows\System\adWrWEN.exe
  2⤵
  PID:5172
- C:\Windows\System\zTOqeZO.exe
  C:\Windows\System\zTOqeZO.exe
  2⤵
  PID:5680
- C:\Windows\System\tVwJtfT.exe
  C:\Windows\System\tVwJtfT.exe
  2⤵
  PID:5940
- C:\Windows\System\vzOkNjd.exe
  C:\Windows\System\vzOkNjd.exe
  2⤵
  PID:5152
- C:\Windows\System\tRpCWSX.exe
  C:\Windows\System\tRpCWSX.exe
  2⤵
  PID:5176
- C:\Windows\System\lWYuJFf.exe
  C:\Windows\System\lWYuJFf.exe
  2⤵
  PID:5664
- C:\Windows\System\fMKWovF.exe
  C:\Windows\System\fMKWovF.exe
  2⤵
  PID:5372
- C:\Windows\System\gmKLZjo.exe
  C:\Windows\System\gmKLZjo.exe
  2⤵
  PID:5980
- C:\Windows\System\GoujvLK.exe
  C:\Windows\System\GoujvLK.exe
  2⤵
  PID:5828
- C:\Windows\System\niRxmiB.exe
  C:\Windows\System\niRxmiB.exe
  2⤵
  PID:5356
- C:\Windows\System\JxaIYNj.exe
  C:\Windows\System\JxaIYNj.exe
  2⤵
  PID:5524
- C:\Windows\System\mTBxqCC.exe
  C:\Windows\System\mTBxqCC.exe
  2⤵
  PID:6160
- C:\Windows\System\mwkaopA.exe
  C:\Windows\System\mwkaopA.exe
  2⤵
  PID:6176
- C:\Windows\System\VRcBrli.exe
  C:\Windows\System\VRcBrli.exe
  2⤵
  PID:6192
- C:\Windows\System\iZGjUif.exe
  C:\Windows\System\iZGjUif.exe
  2⤵
  PID:6212
- C:\Windows\System\zmzHSqw.exe
  C:\Windows\System\zmzHSqw.exe
  2⤵
  PID:6228
- C:\Windows\System\oAXMblW.exe
  C:\Windows\System\oAXMblW.exe
  2⤵
  PID:6248
- C:\Windows\System\ebtGKjx.exe
  C:\Windows\System\ebtGKjx.exe
  2⤵
  PID:6264
- C:\Windows\System\OgGjjET.exe
  C:\Windows\System\OgGjjET.exe
  2⤵
  PID:6280
- C:\Windows\System\OQemuwA.exe
  C:\Windows\System\OQemuwA.exe
  2⤵
  PID:6300
- C:\Windows\System\Sckhpef.exe
  C:\Windows\System\Sckhpef.exe
  2⤵
  PID:6316
- C:\Windows\System\xrSrvwm.exe
  C:\Windows\System\xrSrvwm.exe
  2⤵
  PID:6332
- C:\Windows\System\UHSGVND.exe
  C:\Windows\System\UHSGVND.exe
  2⤵
  PID:6352
- C:\Windows\System\gBLjzRG.exe
  C:\Windows\System\gBLjzRG.exe
  2⤵
  PID:6368
- C:\Windows\System\TaAfFJR.exe
  C:\Windows\System\TaAfFJR.exe
  2⤵
  PID:6384
- C:\Windows\System\lGNvCAa.exe
  C:\Windows\System\lGNvCAa.exe
  2⤵
  PID:6404
- C:\Windows\System\kqlfWVS.exe
  C:\Windows\System\kqlfWVS.exe
  2⤵
  PID:6420
- C:\Windows\System\agABiTB.exe
  C:\Windows\System\agABiTB.exe
  2⤵
  PID:6436
- C:\Windows\System\VWLDObA.exe
  C:\Windows\System\VWLDObA.exe
  2⤵
  PID:6548
- C:\Windows\System\HUZlAQZ.exe
  C:\Windows\System\HUZlAQZ.exe
  2⤵
  PID:6564
- C:\Windows\System\ZoGVKMJ.exe
  C:\Windows\System\ZoGVKMJ.exe
  2⤵
  PID:6580
- C:\Windows\System\pjkZCyK.exe
  C:\Windows\System\pjkZCyK.exe
  2⤵
  PID:6604
- C:\Windows\System\rlchimx.exe
  C:\Windows\System\rlchimx.exe
  2⤵
  PID:6620
- C:\Windows\System\XxzgyNq.exe
  C:\Windows\System\XxzgyNq.exe
  2⤵
  PID:6636
- C:\Windows\System\qJehcCt.exe
  C:\Windows\System\qJehcCt.exe
  2⤵
  PID:6652
- C:\Windows\System\RfAfSmG.exe
  C:\Windows\System\RfAfSmG.exe
  2⤵
  PID:6668
- C:\Windows\System\bqCCSBz.exe
  C:\Windows\System\bqCCSBz.exe
  2⤵
  PID:6684
- C:\Windows\System\whuzmeM.exe
  C:\Windows\System\whuzmeM.exe
  2⤵
  PID:6704
- C:\Windows\System\hfyUQxW.exe
  C:\Windows\System\hfyUQxW.exe
  2⤵
  PID:6720
- C:\Windows\System\QrRLMog.exe
  C:\Windows\System\QrRLMog.exe
  2⤵
  PID:6736
- C:\Windows\System\mOhoILW.exe
  C:\Windows\System\mOhoILW.exe
  2⤵
  PID:6752
- C:\Windows\System\beRIZil.exe
  C:\Windows\System\beRIZil.exe
  2⤵
  PID:6768
- C:\Windows\System\LkVDzwM.exe
  C:\Windows\System\LkVDzwM.exe
  2⤵
  PID:6788
- C:\Windows\System\AzwYzzk.exe
  C:\Windows\System\AzwYzzk.exe
  2⤵
  PID:6804
- C:\Windows\System\EPeLBRJ.exe
  C:\Windows\System\EPeLBRJ.exe
  2⤵
  PID:6820
- C:\Windows\System\xwApQlR.exe
  C:\Windows\System\xwApQlR.exe
  2⤵
  PID:6840
- C:\Windows\System\bteZnTx.exe
  C:\Windows\System\bteZnTx.exe
  2⤵
  PID:6864
- C:\Windows\System\VxckuxZ.exe
  C:\Windows\System\VxckuxZ.exe
  2⤵
  PID:6912
- C:\Windows\System\CdTqkAX.exe
  C:\Windows\System\CdTqkAX.exe
  2⤵
  PID:6928
- C:\Windows\System\YoOgMmr.exe
  C:\Windows\System\YoOgMmr.exe
  2⤵
  PID:6948
- C:\Windows\System\aWIJeDm.exe
  C:\Windows\System\aWIJeDm.exe
  2⤵
  PID:6980
- C:\Windows\System\UvSqMfu.exe
  C:\Windows\System\UvSqMfu.exe
  2⤵
  PID:6996
- C:\Windows\System\AUruutW.exe
  C:\Windows\System\AUruutW.exe
  2⤵
  PID:7016
- C:\Windows\System\GxTOEUK.exe
  C:\Windows\System\GxTOEUK.exe
  2⤵
  PID:7032
- C:\Windows\System\sMqYfXf.exe
  C:\Windows\System\sMqYfXf.exe
  2⤵
  PID:7048
- C:\Windows\System\lLMcszn.exe
  C:\Windows\System\lLMcszn.exe
  2⤵
  PID:7064
- C:\Windows\System\XvbWUQa.exe
  C:\Windows\System\XvbWUQa.exe
  2⤵
  PID:7080
- C:\Windows\System\iShwcQp.exe
  C:\Windows\System\iShwcQp.exe
  2⤵
  PID:7100
- C:\Windows\System\ooFVsBM.exe
  C:\Windows\System\ooFVsBM.exe
  2⤵
  PID:7116
- C:\Windows\System\WLwKjsU.exe
  C:\Windows\System\WLwKjsU.exe
  2⤵
  PID:7136
- C:\Windows\System\hZRMKXM.exe
  C:\Windows\System\hZRMKXM.exe
  2⤵
  PID:7152
- C:\Windows\System\wFOHWup.exe
  C:\Windows\System\wFOHWup.exe
  2⤵
  PID:6140
- C:\Windows\System\fuvVgcX.exe
  C:\Windows\System\fuvVgcX.exe
  2⤵
  PID:6308
- C:\Windows\System\gamKMFA.exe
  C:\Windows\System\gamKMFA.exe
  2⤵
  PID:6380
- C:\Windows\System\hqoXcxa.exe
  C:\Windows\System\hqoXcxa.exe
  2⤵
  PID:6416
- C:\Windows\System\CDjuyCf.exe
  C:\Windows\System\CDjuyCf.exe
  2⤵
  PID:6292
- C:\Windows\System\OngftKg.exe
  C:\Windows\System\OngftKg.exe
  2⤵
  PID:6220
- C:\Windows\System\oqkqmtb.exe
  C:\Windows\System\oqkqmtb.exe
  2⤵
  PID:6152
- C:\Windows\System\tYmfJSu.exe
  C:\Windows\System\tYmfJSu.exe
  2⤵
  PID:5428
- C:\Windows\System\bBBryQh.exe
  C:\Windows\System\bBBryQh.exe
  2⤵
  PID:5588
- C:\Windows\System\UYHQSzG.exe
  C:\Windows\System\UYHQSzG.exe
  2⤵
  PID:6392
- C:\Windows\System\zeIBwEG.exe
  C:\Windows\System\zeIBwEG.exe
  2⤵
  PID:5592
- C:\Windows\System\rhkobAB.exe
  C:\Windows\System\rhkobAB.exe
  2⤵
  PID:6168
- C:\Windows\System\AJvmNNS.exe
  C:\Windows\System\AJvmNNS.exe
  2⤵
  PID:6208
- C:\Windows\System\FnRMNot.exe
  C:\Windows\System\FnRMNot.exe
  2⤵
  PID:6480
- C:\Windows\System\MDpMeBc.exe
  C:\Windows\System\MDpMeBc.exe
  2⤵
  PID:6484
- C:\Windows\System\NIYwzCP.exe
  C:\Windows\System\NIYwzCP.exe
  2⤵
  PID:6504
- C:\Windows\System\ZeVZbdI.exe
  C:\Windows\System\ZeVZbdI.exe
  2⤵
  PID:6520
- C:\Windows\System\BwZtVRE.exe
  C:\Windows\System\BwZtVRE.exe
  2⤵
  PID:6456
- C:\Windows\System\vYFdDVB.exe
  C:\Windows\System\vYFdDVB.exe
  2⤵
  PID:6460
- C:\Windows\System\TwpavWC.exe
  C:\Windows\System\TwpavWC.exe
  2⤵
  PID:6588
- C:\Windows\System\XTgAGYR.exe
  C:\Windows\System\XTgAGYR.exe
  2⤵
  PID:6616
- C:\Windows\System\eVbQlkq.exe
  C:\Windows\System\eVbQlkq.exe
  2⤵
  PID:6676
- C:\Windows\System\FsHMFPP.exe
  C:\Windows\System\FsHMFPP.exe
  2⤵
  PID:6760
- C:\Windows\System\wbLCMbE.exe
  C:\Windows\System\wbLCMbE.exe
  2⤵
  PID:6860
- C:\Windows\System\nXjfrMr.exe
  C:\Windows\System\nXjfrMr.exe
  2⤵
  PID:6816
- C:\Windows\System\LalTXlc.exe
  C:\Windows\System\LalTXlc.exe
  2⤵
  PID:6920
- C:\Windows\System\jhyxkKL.exe
  C:\Windows\System\jhyxkKL.exe
  2⤵
  PID:6960
- C:\Windows\System\GqpHjyD.exe
  C:\Windows\System\GqpHjyD.exe
  2⤵
  PID:7008
- C:\Windows\System\ffhGJSr.exe
  C:\Windows\System\ffhGJSr.exe
  2⤵
  PID:6904
- C:\Windows\System\KxMzrqr.exe
  C:\Windows\System\KxMzrqr.exe
  2⤵
  PID:7012
- C:\Windows\System\rNYsDUe.exe
  C:\Windows\System\rNYsDUe.exe
  2⤵
  PID:7044
- C:\Windows\System\mOVzdZv.exe
  C:\Windows\System\mOVzdZv.exe
  2⤵
  PID:7024
- C:\Windows\System\LotXljN.exe
  C:\Windows\System\LotXljN.exe
  2⤵
  PID:7060
- C:\Windows\System\aIEJoRX.exe
  C:\Windows\System\aIEJoRX.exe
  2⤵
  PID:7124
- C:\Windows\System\RKOfnGi.exe
  C:\Windows\System\RKOfnGi.exe
  2⤵
  PID:7144
- C:\Windows\System\sodtuuG.exe
  C:\Windows\System\sodtuuG.exe
  2⤵
  PID:5916
- C:\Windows\System\nrxbgop.exe
  C:\Windows\System\nrxbgop.exe
  2⤵
  PID:6236
- C:\Windows\System\EMBbnoh.exe
  C:\Windows\System\EMBbnoh.exe
  2⤵
  PID:5476
- C:\Windows\System\BQGfLsc.exe
  C:\Windows\System\BQGfLsc.exe
  2⤵
  PID:6272
- C:\Windows\System\yAGoldY.exe
  C:\Windows\System\yAGoldY.exe
  2⤵
  PID:6412
- C:\Windows\System\ITtAKkW.exe
  C:\Windows\System\ITtAKkW.exe
  2⤵
  PID:6324
- C:\Windows\System\rrppMHp.exe
  C:\Windows\System\rrppMHp.exe
  2⤵
  PID:6364
- C:\Windows\System\ptWaOPy.exe
  C:\Windows\System\ptWaOPy.exe
  2⤵
  PID:6452
- C:\Windows\System\LHXoNyX.exe
  C:\Windows\System\LHXoNyX.exe
  2⤵
  PID:6476
- C:\Windows\System\vcXLVFQ.exe
  C:\Windows\System\vcXLVFQ.exe
  2⤵
  PID:6540
- C:\Windows\System\DOwZVxj.exe
  C:\Windows\System\DOwZVxj.exe
  2⤵
  PID:6660
- C:\Windows\System\joZCFQR.exe
  C:\Windows\System\joZCFQR.exe
  2⤵
  PID:6648
- C:\Windows\System\NooketO.exe
  C:\Windows\System\NooketO.exe
  2⤵
  PID:6716
- C:\Windows\System\FMGbFOR.exe
  C:\Windows\System\FMGbFOR.exe
  2⤵
  PID:6836
- C:\Windows\System\sHBTkrj.exe
  C:\Windows\System\sHBTkrj.exe
  2⤵
  PID:6748
- C:\Windows\System\dnKpcAL.exe
  C:\Windows\System\dnKpcAL.exe
  2⤵
  PID:6968
- C:\Windows\System\PHExEwH.exe
  C:\Windows\System\PHExEwH.exe
  2⤵
  PID:6876
- C:\Windows\System\ehmSucb.exe
  C:\Windows\System\ehmSucb.exe
  2⤵
  PID:6936
- C:\Windows\System\UxfyANJ.exe
  C:\Windows\System\UxfyANJ.exe
  2⤵
  PID:6900
- C:\Windows\System\OObSfaO.exe
  C:\Windows\System\OObSfaO.exe
  2⤵
  PID:5928
- C:\Windows\System\myCMair.exe
  C:\Windows\System\myCMair.exe
  2⤵
  PID:7040
- C:\Windows\System\GfuTHfv.exe
  C:\Windows\System\GfuTHfv.exe
  2⤵
  PID:7160
- C:\Windows\System\YgPkMJm.exe
  C:\Windows\System\YgPkMJm.exe
  2⤵
  PID:5724
- C:\Windows\System\KxZqozY.exe
  C:\Windows\System\KxZqozY.exe
  2⤵
  PID:6612
- C:\Windows\System\bPgknmE.exe
  C:\Windows\System\bPgknmE.exe
  2⤵
  PID:5864
- C:\Windows\System\vmMgnun.exe
  C:\Windows\System\vmMgnun.exe
  2⤵
  PID:6296
- C:\Windows\System\JXtzKeX.exe
  C:\Windows\System\JXtzKeX.exe
  2⤵
  PID:6532
- C:\Windows\System\ZOVELbb.exe
  C:\Windows\System\ZOVELbb.exe
  2⤵
  PID:7072
- C:\Windows\System\ARxgPjO.exe
  C:\Windows\System\ARxgPjO.exe
  2⤵
  PID:5856
- C:\Windows\System\zBGsJzT.exe
  C:\Windows\System\zBGsJzT.exe
  2⤵
  PID:6956
- C:\Windows\System\jsFXeky.exe
  C:\Windows\System\jsFXeky.exe
  2⤵
  PID:6892
- C:\Windows\System\lARmadJ.exe
  C:\Windows\System\lARmadJ.exe
  2⤵
  PID:5768
- C:\Windows\System\ZuLnQsq.exe
  C:\Windows\System\ZuLnQsq.exe
  2⤵
  PID:6052
- C:\Windows\System\bKXETnI.exe
  C:\Windows\System\bKXETnI.exe
  2⤵
  PID:6528
- C:\Windows\System\SgllLqo.exe
  C:\Windows\System\SgllLqo.exe
  2⤵
  PID:6500
- C:\Windows\System\LuSqInt.exe
  C:\Windows\System\LuSqInt.exe
  2⤵
  PID:6812
- C:\Windows\System\bomifaf.exe
  C:\Windows\System\bomifaf.exe
  2⤵
  PID:6728
- C:\Windows\System\VpKNxNT.exe
  C:\Windows\System\VpKNxNT.exe
  2⤵
  PID:6516
- C:\Windows\System\TVQlZOL.exe
  C:\Windows\System\TVQlZOL.exe
  2⤵
  PID:7164
- C:\Windows\System\iykVmin.exe
  C:\Windows\System\iykVmin.exe
  2⤵
  PID:6112
- C:\Windows\System\zVvGaAg.exe
  C:\Windows\System\zVvGaAg.exe
  2⤵
  PID:6496
- C:\Windows\System\DOxStst.exe
  C:\Windows\System\DOxStst.exe
  2⤵
  PID:6940
- C:\Windows\System\JUURMOh.exe
  C:\Windows\System\JUURMOh.exe
  2⤵
  PID:6972
- C:\Windows\System\UdIxlzD.exe
  C:\Windows\System\UdIxlzD.exe
  2⤵
  PID:6472
- C:\Windows\System\XtjUKcK.exe
  C:\Windows\System\XtjUKcK.exe
  2⤵
  PID:6800
- C:\Windows\System\hjHJqzJ.exe
  C:\Windows\System\hjHJqzJ.exe
  2⤵
  PID:7092
- C:\Windows\System\phTdKti.exe
  C:\Windows\System\phTdKti.exe
  2⤵
  PID:7184
- C:\Windows\System\TqnYvNI.exe
  C:\Windows\System\TqnYvNI.exe
  2⤵
  PID:7200
- C:\Windows\System\mVZyqVt.exe
  C:\Windows\System\mVZyqVt.exe
  2⤵
  PID:7220
- C:\Windows\System\JVBBiYr.exe
  C:\Windows\System\JVBBiYr.exe
  2⤵
  PID:7292
- C:\Windows\System\fmAFaIc.exe
  C:\Windows\System\fmAFaIc.exe
  2⤵
  PID:7308
- C:\Windows\System\XFLMDKn.exe
  C:\Windows\System\XFLMDKn.exe
  2⤵
  PID:7324
- C:\Windows\System\FkGxTgz.exe
  C:\Windows\System\FkGxTgz.exe
  2⤵
  PID:7344
- C:\Windows\System\BKgwQlk.exe
  C:\Windows\System\BKgwQlk.exe
  2⤵
  PID:7360
- C:\Windows\System\nXLKhNO.exe
  C:\Windows\System\nXLKhNO.exe
  2⤵
  PID:7376
- C:\Windows\System\WRdvkRv.exe
  C:\Windows\System\WRdvkRv.exe
  2⤵
  PID:7392
- C:\Windows\System\ONrzjpX.exe
  C:\Windows\System\ONrzjpX.exe
  2⤵
  PID:7412
- C:\Windows\System\aGjwvcN.exe
  C:\Windows\System\aGjwvcN.exe
  2⤵
  PID:7428
- C:\Windows\System\jfhoZpX.exe
  C:\Windows\System\jfhoZpX.exe
  2⤵
  PID:7444
- C:\Windows\System\LkSyVAL.exe
  C:\Windows\System\LkSyVAL.exe
  2⤵
  PID:7460
- C:\Windows\System\tzimAjn.exe
  C:\Windows\System\tzimAjn.exe
  2⤵
  PID:7476
- C:\Windows\System\qnuZGdt.exe
  C:\Windows\System\qnuZGdt.exe
  2⤵
  PID:7492
- C:\Windows\System\FtpJmNL.exe
  C:\Windows\System\FtpJmNL.exe
  2⤵
  PID:7512
- C:\Windows\System\ahSOJLJ.exe
  C:\Windows\System\ahSOJLJ.exe
  2⤵
  PID:7528
- C:\Windows\System\GGrFpQl.exe
  C:\Windows\System\GGrFpQl.exe
  2⤵
  PID:7544
- C:\Windows\System\RCPBajB.exe
  C:\Windows\System\RCPBajB.exe
  2⤵
  PID:7564
- C:\Windows\System\fHhRxnk.exe
  C:\Windows\System\fHhRxnk.exe
  2⤵
  PID:7580
- C:\Windows\System\XgXNABD.exe
  C:\Windows\System\XgXNABD.exe
  2⤵
  PID:7596
- C:\Windows\System\rDBZPll.exe
  C:\Windows\System\rDBZPll.exe
  2⤵
  PID:7616
- C:\Windows\System\IUQSULQ.exe
  C:\Windows\System\IUQSULQ.exe
  2⤵
  PID:7632
- C:\Windows\System\HenZQpx.exe
  C:\Windows\System\HenZQpx.exe
  2⤵
  PID:7648
- C:\Windows\System\aXIamAD.exe
  C:\Windows\System\aXIamAD.exe
  2⤵
  PID:7664
- C:\Windows\System\YfOIZyb.exe
  C:\Windows\System\YfOIZyb.exe
  2⤵
  PID:7684
- C:\Windows\System\VjtwUnH.exe
  C:\Windows\System\VjtwUnH.exe
  2⤵
  PID:7776
- C:\Windows\System\HnwoVDK.exe
  C:\Windows\System\HnwoVDK.exe
  2⤵
  PID:7792
- C:\Windows\System\IyRDTEL.exe
  C:\Windows\System\IyRDTEL.exe
  2⤵
  PID:7808
- C:\Windows\System\bPpMzAk.exe
  C:\Windows\System\bPpMzAk.exe
  2⤵
  PID:7824
- C:\Windows\System\pxsOZtM.exe
  C:\Windows\System\pxsOZtM.exe
  2⤵
  PID:7844
- C:\Windows\System\QqrANiG.exe
  C:\Windows\System\QqrANiG.exe
  2⤵
  PID:7876
- C:\Windows\System\dhkKQFg.exe
  C:\Windows\System\dhkKQFg.exe
  2⤵
  PID:7892
- C:\Windows\System\txypZqR.exe
  C:\Windows\System\txypZqR.exe
  2⤵
  PID:7908
- C:\Windows\System\ZUZSNHr.exe
  C:\Windows\System\ZUZSNHr.exe
  2⤵
  PID:7924
- C:\Windows\System\HQHAAdX.exe
  C:\Windows\System\HQHAAdX.exe
  2⤵
  PID:7940
- C:\Windows\System\LuvfFIv.exe
  C:\Windows\System\LuvfFIv.exe
  2⤵
  PID:7960
- C:\Windows\System\aGEAdSu.exe
  C:\Windows\System\aGEAdSu.exe
  2⤵
  PID:7976
- C:\Windows\System\mIOUjar.exe
  C:\Windows\System\mIOUjar.exe
  2⤵
  PID:7992
- C:\Windows\System\iOXjQqy.exe
  C:\Windows\System\iOXjQqy.exe
  2⤵
  PID:8008
- C:\Windows\System\YPLJnkH.exe
  C:\Windows\System\YPLJnkH.exe
  2⤵
  PID:8024
- C:\Windows\System\befTgOi.exe
  C:\Windows\System\befTgOi.exe
  2⤵
  PID:8064
- C:\Windows\System\hISXifZ.exe
  C:\Windows\System\hISXifZ.exe
  2⤵
  PID:8084
- C:\Windows\System\LmCKJeB.exe
  C:\Windows\System\LmCKJeB.exe
  2⤵
  PID:8100
- C:\Windows\System\ZFNCuBv.exe
  C:\Windows\System\ZFNCuBv.exe
  2⤵
  PID:8116
- C:\Windows\System\EbYaUSc.exe
  C:\Windows\System\EbYaUSc.exe
  2⤵
  PID:8132
- C:\Windows\System\DcsYiBb.exe
  C:\Windows\System\DcsYiBb.exe
  2⤵
  PID:8148
- C:\Windows\System\eMVAMsC.exe
  C:\Windows\System\eMVAMsC.exe
  2⤵
  PID:8168
- C:\Windows\System\OXRLlTS.exe
  C:\Windows\System\OXRLlTS.exe
  2⤵
  PID:8184
- C:\Windows\System\ECkkyFx.exe
  C:\Windows\System\ECkkyFx.exe
  2⤵
  PID:6776
- C:\Windows\System\uKutTvb.exe
  C:\Windows\System\uKutTvb.exe
  2⤵
  PID:6732
- C:\Windows\System\zIEnfAe.exe
  C:\Windows\System\zIEnfAe.exe
  2⤵
  PID:6544
- C:\Windows\System\wFLqNct.exe
  C:\Windows\System\wFLqNct.exe
  2⤵
  PID:6908
- C:\Windows\System\XOkAhVV.exe
  C:\Windows\System\XOkAhVV.exe
  2⤵
  PID:7176
- C:\Windows\System\AMETens.exe
  C:\Windows\System\AMETens.exe
  2⤵
  PID:7212
- C:\Windows\System\gQYYHKB.exe
  C:\Windows\System\gQYYHKB.exe
  2⤵
  PID:7240
- C:\Windows\System\VeYlJhc.exe
  C:\Windows\System\VeYlJhc.exe
  2⤵
  PID:7260
- C:\Windows\System\wZedycy.exe
  C:\Windows\System\wZedycy.exe
  2⤵
  PID:7268
- C:\Windows\System\gEmJsbB.exe
  C:\Windows\System\gEmJsbB.exe
  2⤵
  PID:7356
- C:\Windows\System\BuAyJwJ.exe
  C:\Windows\System\BuAyJwJ.exe
  2⤵
  PID:7424
- C:\Windows\System\qoFZZOM.exe
  C:\Windows\System\qoFZZOM.exe
  2⤵
  PID:7488
- C:\Windows\System\SdmrpxP.exe
  C:\Windows\System\SdmrpxP.exe
  2⤵
  PID:7560
- C:\Windows\System\FDVqazK.exe
  C:\Windows\System\FDVqazK.exe
  2⤵
  PID:7628
- C:\Windows\System\AzUnDwl.exe
  C:\Windows\System\AzUnDwl.exe
  2⤵
  PID:7700
- C:\Windows\System\LbmLgOz.exe
  C:\Windows\System\LbmLgOz.exe
  2⤵
  PID:7536
- C:\Windows\System\CRuuuyv.exe
  C:\Windows\System\CRuuuyv.exe
  2⤵
  PID:7612
- C:\Windows\System\KBCRvIO.exe
  C:\Windows\System\KBCRvIO.exe
  2⤵
  PID:7676
- C:\Windows\System\IHHvxPe.exe
  C:\Windows\System\IHHvxPe.exe
  2⤵
  PID:7724
- C:\Windows\System\PYnDdoo.exe
  C:\Windows\System\PYnDdoo.exe
  2⤵
  PID:7736
- C:\Windows\System\IKDzrsO.exe
  C:\Windows\System\IKDzrsO.exe
  2⤵
  PID:7752
- C:\Windows\System\rRHtczD.exe
  C:\Windows\System\rRHtczD.exe
  2⤵
  PID:7772
- C:\Windows\System\mpNAgkI.exe
  C:\Windows\System\mpNAgkI.exe
  2⤵
  PID:7836
- C:\Windows\System\upCjuhP.exe
  C:\Windows\System\upCjuhP.exe
  2⤵
  PID:8004
- C:\Windows\System\SImcNxP.exe
  C:\Windows\System\SImcNxP.exe
  2⤵
  PID:8052
- C:\Windows\System\kTxQilc.exe
  C:\Windows\System\kTxQilc.exe
  2⤵
  PID:7988
- C:\Windows\System\omeRGtP.exe
  C:\Windows\System\omeRGtP.exe
  2⤵
  PID:8128
- C:\Windows\System\ctEvDla.exe
  C:\Windows\System\ctEvDla.exe
  2⤵
  PID:6488
- C:\Windows\System\vGaIDcF.exe
  C:\Windows\System\vGaIDcF.exe
  2⤵
  PID:7264
- C:\Windows\System\FjwJgAP.exe
  C:\Windows\System\FjwJgAP.exe
  2⤵
  PID:6796
- C:\Windows\System\mURnFBj.exe
  C:\Windows\System\mURnFBj.exe
  2⤵
  PID:7288
- C:\Windows\System\HDGuaSU.exe
  C:\Windows\System\HDGuaSU.exe
  2⤵
  PID:6204
- C:\Windows\System\TYamCPM.exe
  C:\Windows\System\TYamCPM.exe
  2⤵
  PID:7280
- C:\Windows\System\ePvRVpe.exe
  C:\Windows\System\ePvRVpe.exe
  2⤵
  PID:7332
- C:\Windows\System\udmAMQa.exe
  C:\Windows\System\udmAMQa.exe
  2⤵
  PID:7408
- C:\Windows\System\bhoxqeQ.exe
  C:\Windows\System\bhoxqeQ.exe
  2⤵
  PID:7500
- C:\Windows\System\PDgEBgI.exe
  C:\Windows\System\PDgEBgI.exe
  2⤵
  PID:7604
- C:\Windows\System\oFGQkgw.exe
  C:\Windows\System\oFGQkgw.exe
  2⤵
  PID:7660
- C:\Windows\System\WNpwdya.exe
  C:\Windows\System\WNpwdya.exe
  2⤵
  PID:7624
- C:\Windows\System\LsHmVWn.exe
  C:\Windows\System\LsHmVWn.exe
  2⤵
  PID:7508
- C:\Windows\System\dnnJaMX.exe
  C:\Windows\System\dnnJaMX.exe
  2⤵
  PID:7728
- C:\Windows\System\VAFEkGQ.exe
  C:\Windows\System\VAFEkGQ.exe
  2⤵
  PID:6832
- C:\Windows\System\AMVnYTT.exe
  C:\Windows\System\AMVnYTT.exe
  2⤵
  PID:7840
- C:\Windows\System\TeBqMUW.exe
  C:\Windows\System\TeBqMUW.exe
  2⤵
  PID:7608
- C:\Windows\System\QLFKAfg.exe
  C:\Windows\System\QLFKAfg.exe
  2⤵
  PID:7748
- C:\Windows\System\uFXRGJW.exe
  C:\Windows\System\uFXRGJW.exe
  2⤵
  PID:7820
- C:\Windows\System\mnQwihO.exe
  C:\Windows\System\mnQwihO.exe
  2⤵
  PID:7768
- C:\Windows\System\luYUyEU.exe
  C:\Windows\System\luYUyEU.exe
  2⤵
  PID:7920
- C:\Windows\System\CHRVtia.exe
  C:\Windows\System\CHRVtia.exe
  2⤵
  PID:7972
- C:\Windows\System\rMTNTVY.exe
  C:\Windows\System\rMTNTVY.exe
  2⤵
  PID:7192
- C:\Windows\System\FmVSNKc.exe
  C:\Windows\System\FmVSNKc.exe
  2⤵
  PID:8180
- C:\Windows\System\unawcGI.exe
  C:\Windows\System\unawcGI.exe
  2⤵
  PID:7208
- C:\Windows\System\zPlbIKG.exe
  C:\Windows\System\zPlbIKG.exe
  2⤵
  PID:8176
- C:\Windows\System\PFLhqMe.exe
  C:\Windows\System\PFLhqMe.exe
  2⤵
  PID:8112
- C:\Windows\System\tdGdZLQ.exe
  C:\Windows\System\tdGdZLQ.exe
  2⤵
  PID:6572
- C:\Windows\System\JsSAgDS.exe
  C:\Windows\System\JsSAgDS.exe
  2⤵
  PID:7440
- C:\Windows\System\XFDSPHv.exe
  C:\Windows\System\XFDSPHv.exe
  2⤵
  PID:7592
- C:\Windows\System\yzwhMsl.exe
  C:\Windows\System\yzwhMsl.exe
  2⤵
  PID:8044
- C:\Windows\System\wQBOjbG.exe
  C:\Windows\System\wQBOjbG.exe
  2⤵
  PID:7900
- C:\Windows\System\sLUKajc.exe
  C:\Windows\System\sLUKajc.exe
  2⤵
  PID:7468
- C:\Windows\System\yzxkRxE.exe
  C:\Windows\System\yzxkRxE.exe
  2⤵
  PID:7816
- C:\Windows\System\ePGqONj.exe
  C:\Windows\System\ePGqONj.exe
  2⤵
  PID:7420
- C:\Windows\System\mphzjgL.exe
  C:\Windows\System\mphzjgL.exe
  2⤵
  PID:7760
- C:\Windows\System\XlmNnTi.exe
  C:\Windows\System\XlmNnTi.exe
  2⤵
  PID:8096
- C:\Windows\System\ouexyPb.exe
  C:\Windows\System\ouexyPb.exe
  2⤵
  PID:8080
- C:\Windows\System\PAcFYjm.exe
  C:\Windows\System\PAcFYjm.exe
  2⤵
  PID:7864
- C:\Windows\System\DxovKzU.exe
  C:\Windows\System\DxovKzU.exe
  2⤵
  PID:7672
- C:\Windows\System\jJOknxr.exe
  C:\Windows\System\jJOknxr.exe
  2⤵
  PID:7304
- C:\Windows\System\eSOlspc.exe
  C:\Windows\System\eSOlspc.exe
  2⤵
  PID:8020
- C:\Windows\System\GOgWtnI.exe
  C:\Windows\System\GOgWtnI.exe
  2⤵
  PID:7804
- C:\Windows\System\ElOyqFN.exe
  C:\Windows\System\ElOyqFN.exe
  2⤵
  PID:7884
- C:\Windows\System\lRKyyfP.exe
  C:\Windows\System\lRKyyfP.exe
  2⤵
  PID:8048
- C:\Windows\System\JxcAhDL.exe
  C:\Windows\System\JxcAhDL.exe
  2⤵
  PID:8032
- C:\Windows\System\fwSaUpS.exe
  C:\Windows\System\fwSaUpS.exe
  2⤵
  PID:7572
- C:\Windows\System\SfCXpdI.exe
  C:\Windows\System\SfCXpdI.exe
  2⤵
  PID:7504
- C:\Windows\System\XxKTNMB.exe
  C:\Windows\System\XxKTNMB.exe
  2⤵
  PID:7868
- C:\Windows\System\kWnBhep.exe
  C:\Windows\System\kWnBhep.exe
  2⤵
  PID:7984
- C:\Windows\System\KPBItgR.exe
  C:\Windows\System\KPBItgR.exe
  2⤵
  PID:7316
- C:\Windows\System\pPNstKm.exe
  C:\Windows\System\pPNstKm.exe
  2⤵
  PID:7716
- C:\Windows\System\bYnTjVk.exe
  C:\Windows\System\bYnTjVk.exe
  2⤵
  PID:8092
- C:\Windows\System\yoMylxY.exe
  C:\Windows\System\yoMylxY.exe
  2⤵
  PID:8196
- C:\Windows\System\tahnngu.exe
  C:\Windows\System\tahnngu.exe
  2⤵
  PID:8212
- C:\Windows\System\YTHlKDC.exe
  C:\Windows\System\YTHlKDC.exe
  2⤵
  PID:8232
- C:\Windows\System\UUZJUxH.exe
  C:\Windows\System\UUZJUxH.exe
  2⤵
  PID:8268
- C:\Windows\System\ZiIPqQi.exe
  C:\Windows\System\ZiIPqQi.exe
  2⤵
  PID:8284
- C:\Windows\System\tzzHKoe.exe
  C:\Windows\System\tzzHKoe.exe
  2⤵
  PID:8300
- C:\Windows\System\HZNRqDM.exe
  C:\Windows\System\HZNRqDM.exe
  2⤵
  PID:8316
- C:\Windows\System\dMEKumJ.exe
  C:\Windows\System\dMEKumJ.exe
  2⤵
  PID:8332
- C:\Windows\System\iPqhlvx.exe
  C:\Windows\System\iPqhlvx.exe
  2⤵
  PID:8348
- C:\Windows\System\gJevRyA.exe
  C:\Windows\System\gJevRyA.exe
  2⤵
  PID:8376
- C:\Windows\System\eIhTxPW.exe
  C:\Windows\System\eIhTxPW.exe
  2⤵
  PID:8392
- C:\Windows\System\UPVKdFK.exe
  C:\Windows\System\UPVKdFK.exe
  2⤵
  PID:8408
- C:\Windows\System\uGexiBr.exe
  C:\Windows\System\uGexiBr.exe
  2⤵
  PID:8424
- C:\Windows\System\BdHkQhI.exe
  C:\Windows\System\BdHkQhI.exe
  2⤵
  PID:8440
- C:\Windows\System\lYNczJB.exe
  C:\Windows\System\lYNczJB.exe
  2⤵
  PID:8464
- C:\Windows\System\JxoWNXh.exe
  C:\Windows\System\JxoWNXh.exe
  2⤵
  PID:8480
- C:\Windows\System\hhKEuYm.exe
  C:\Windows\System\hhKEuYm.exe
  2⤵
  PID:8500
- C:\Windows\System\serwfDw.exe
  C:\Windows\System\serwfDw.exe
  2⤵
  PID:8516
- C:\Windows\System\EnYYNGk.exe
  C:\Windows\System\EnYYNGk.exe
  2⤵
  PID:8536
- C:\Windows\System\NojRAvW.exe
  C:\Windows\System\NojRAvW.exe
  2⤵
  PID:8592
- C:\Windows\System\AepSwLr.exe
  C:\Windows\System\AepSwLr.exe
  2⤵
  PID:8612
- C:\Windows\System\NVMTOPU.exe
  C:\Windows\System\NVMTOPU.exe
  2⤵
  PID:8628
- C:\Windows\System\SbJFNjM.exe
  C:\Windows\System\SbJFNjM.exe
  2⤵
  PID:8644
- C:\Windows\System\hlfzlqC.exe
  C:\Windows\System\hlfzlqC.exe
  2⤵
  PID:8664
- C:\Windows\System\yjNHmLt.exe
  C:\Windows\System\yjNHmLt.exe
  2⤵
  PID:8680
- C:\Windows\System\rHpzUoZ.exe
  C:\Windows\System\rHpzUoZ.exe
  2⤵
  PID:8700
- C:\Windows\System\IlLXgIY.exe
  C:\Windows\System\IlLXgIY.exe
  2⤵
  PID:8716
- C:\Windows\System\MkDEKoe.exe
  C:\Windows\System\MkDEKoe.exe
  2⤵
  PID:8732
- C:\Windows\System\PhAPeOk.exe
  C:\Windows\System\PhAPeOk.exe
  2⤵
  PID:8752
- C:\Windows\System\yAIJSAP.exe
  C:\Windows\System\yAIJSAP.exe
  2⤵
  PID:8768
- C:\Windows\System\GWULjkv.exe
  C:\Windows\System\GWULjkv.exe
  2⤵
  PID:8784
- C:\Windows\System\RbleLoP.exe
  C:\Windows\System\RbleLoP.exe
  2⤵
  PID:8836
- C:\Windows\System\wMyqCPz.exe
  C:\Windows\System\wMyqCPz.exe
  2⤵
  PID:8852
- C:\Windows\System\fGBjuen.exe
  C:\Windows\System\fGBjuen.exe
  2⤵
  PID:8868
- C:\Windows\System\wkTxFFg.exe
  C:\Windows\System\wkTxFFg.exe
  2⤵
  PID:8884
- C:\Windows\System\iykeqrb.exe
  C:\Windows\System\iykeqrb.exe
  2⤵
  PID:8904
- C:\Windows\System\jlpFMiv.exe
  C:\Windows\System\jlpFMiv.exe
  2⤵
  PID:8920
- C:\Windows\System\PlmnLbo.exe
  C:\Windows\System\PlmnLbo.exe
  2⤵
  PID:8944
- C:\Windows\System\DCMZRkW.exe
  C:\Windows\System\DCMZRkW.exe
  2⤵
  PID:8964
- C:\Windows\System\CpHxXbE.exe
  C:\Windows\System\CpHxXbE.exe
  2⤵
  PID:8980
- C:\Windows\System\TXoBQWg.exe
  C:\Windows\System\TXoBQWg.exe
  2⤵
  PID:8996
- C:\Windows\System\ZcoFbpu.exe
  C:\Windows\System\ZcoFbpu.exe
  2⤵
  PID:9012
- C:\Windows\System\mpQSjue.exe
  C:\Windows\System\mpQSjue.exe
  2⤵
  PID:9028
- C:\Windows\System\piOAiRH.exe
  C:\Windows\System\piOAiRH.exe
  2⤵
  PID:9044
- C:\Windows\System\CcCnWzN.exe
  C:\Windows\System\CcCnWzN.exe
  2⤵
  PID:9064
- C:\Windows\System\yWiEnjC.exe
  C:\Windows\System\yWiEnjC.exe
  2⤵
  PID:9080
- C:\Windows\System\gZkthbN.exe
  C:\Windows\System\gZkthbN.exe
  2⤵
  PID:9096
- C:\Windows\System\EPdMzVl.exe
  C:\Windows\System\EPdMzVl.exe
  2⤵
  PID:9116
- C:\Windows\System\MJcXJmg.exe
  C:\Windows\System\MJcXJmg.exe
  2⤵
  PID:9132
- C:\Windows\System\DklrErL.exe
  C:\Windows\System\DklrErL.exe
  2⤵
  PID:9148
- C:\Windows\System\QBAPKMx.exe
  C:\Windows\System\QBAPKMx.exe
  2⤵
  PID:9168
- C:\Windows\System\FihwIlV.exe
  C:\Windows\System\FihwIlV.exe
  2⤵
  PID:9188
- C:\Windows\System\yHzcCvZ.exe
  C:\Windows\System\yHzcCvZ.exe
  2⤵
  PID:9204
- C:\Windows\System\MdVVHNT.exe
  C:\Windows\System\MdVVHNT.exe
  2⤵
  PID:7368
- C:\Windows\System\JXEbQjS.exe
  C:\Windows\System\JXEbQjS.exe
  2⤵
  PID:7916
- C:\Windows\System\wwYLmei.exe
  C:\Windows\System\wwYLmei.exe
  2⤵
  PID:8276
- C:\Windows\System\qMOAWPz.exe
  C:\Windows\System\qMOAWPz.exe
  2⤵
  PID:8312
- C:\Windows\System\FNpaYrk.exe
  C:\Windows\System\FNpaYrk.exe
  2⤵
  PID:8256
- C:\Windows\System\XPRyyPm.exe
  C:\Windows\System\XPRyyPm.exe
  2⤵
  PID:8208
- C:\Windows\System\JbTJJBc.exe
  C:\Windows\System\JbTJJBc.exe
  2⤵
  PID:8452
- C:\Windows\System\QQgVIbk.exe
  C:\Windows\System\QQgVIbk.exe
  2⤵
  PID:8528
- C:\Windows\System\jOKaWjo.exe
  C:\Windows\System\jOKaWjo.exe
  2⤵
  PID:8556
- C:\Windows\System\AJMYmJM.exe
  C:\Windows\System\AJMYmJM.exe
  2⤵
  PID:8472
- C:\Windows\System\UFIkpeB.exe
  C:\Windows\System\UFIkpeB.exe
  2⤵
  PID:8580
- C:\Windows\System\tTbkCtQ.exe
  C:\Windows\System\tTbkCtQ.exe
  2⤵
  PID:8608
- C:\Windows\System\dtMMAEb.exe
  C:\Windows\System\dtMMAEb.exe
  2⤵
  PID:8640
- C:\Windows\System\VvUsIkq.exe
  C:\Windows\System\VvUsIkq.exe
  2⤵
  PID:8740
- C:\Windows\System\MWPlvvG.exe
  C:\Windows\System\MWPlvvG.exe
  2⤵
  PID:8548
- C:\Windows\System\QEIKeMo.exe
  C:\Windows\System\QEIKeMo.exe
  2⤵
  PID:8660
- C:\Windows\System\wComWOs.exe
  C:\Windows\System\wComWOs.exe
  2⤵
  PID:7524
- C:\Windows\System\iHJQJiN.exe
  C:\Windows\System\iHJQJiN.exe
  2⤵
  PID:8800
- C:\Windows\System\lvPzUeW.exe
  C:\Windows\System\lvPzUeW.exe
  2⤵
  PID:8832
- C:\Windows\System\CiILAjH.exe
  C:\Windows\System\CiILAjH.exe
  2⤵
  PID:8876
- C:\Windows\System\ttqIAvW.exe
  C:\Windows\System\ttqIAvW.exe
  2⤵
  PID:8892
- C:\Windows\System\UlJuqTQ.exe
  C:\Windows\System\UlJuqTQ.exe
  2⤵
  PID:8932
- C:\Windows\System\WvpEvgX.exe
  C:\Windows\System\WvpEvgX.exe
  2⤵
  PID:8992
- C:\Windows\System\MMQoaFy.exe
  C:\Windows\System\MMQoaFy.exe
  2⤵
  PID:9056
- C:\Windows\System\NkgRKXR.exe
  C:\Windows\System\NkgRKXR.exe
  2⤵
  PID:9160
- C:\Windows\System\jSPbFII.exe
  C:\Windows\System\jSPbFII.exe
  2⤵
  PID:8220
- C:\Windows\System\CunzqFy.exe
  C:\Windows\System\CunzqFy.exe
  2⤵
  PID:8940
- C:\Windows\System\XasTDqn.exe
  C:\Windows\System\XasTDqn.exe
  2⤵
  PID:9004
- C:\Windows\System\cShqWMA.exe
  C:\Windows\System\cShqWMA.exe
  2⤵
  PID:8344
- C:\Windows\System\PZYEVms.exe
  C:\Windows\System\PZYEVms.exe
  2⤵
  PID:9112
- C:\Windows\System\SAmzlzE.exe
  C:\Windows\System\SAmzlzE.exe
  2⤵
  PID:9212
- C:\Windows\System\wCCDiio.exe
  C:\Windows\System\wCCDiio.exe
  2⤵
  PID:8976
- C:\Windows\System\dRLfDXm.exe
  C:\Windows\System\dRLfDXm.exe
  2⤵
  PID:8248
- C:\Windows\System\hWddOfP.exe
  C:\Windows\System\hWddOfP.exe
  2⤵
  PID:8292
- C:\Windows\System\GuxZwMk.exe
  C:\Windows\System\GuxZwMk.exe
  2⤵
  PID:8492
- C:\Windows\System\LyXFowT.exe
  C:\Windows\System\LyXFowT.exe
  2⤵
  PID:8496
- C:\Windows\System\EjQIMpI.exe
  C:\Windows\System\EjQIMpI.exe
  2⤵
  PID:8572
- C:\Windows\System\lNLoLHD.exe
  C:\Windows\System\lNLoLHD.exe
  2⤵
  PID:8708
- C:\Windows\System\AzhtoIz.exe
  C:\Windows\System\AzhtoIz.exe
  2⤵
  PID:8656
- C:\Windows\System\wgCTTsK.exe
  C:\Windows\System\wgCTTsK.exe
  2⤵
  PID:8620
- C:\Windows\System\PEtmMvf.exe
  C:\Windows\System\PEtmMvf.exe
  2⤵
  PID:8636
- C:\Windows\System\IXvANSt.exe
  C:\Windows\System\IXvANSt.exe
  2⤵
  PID:8792
- C:\Windows\System\abgxlJq.exe
  C:\Windows\System\abgxlJq.exe
  2⤵
  PID:8816
- C:\Windows\System\eFowmOr.exe
  C:\Windows\System\eFowmOr.exe
  2⤵
  PID:8820
- C:\Windows\System\FehHtEK.exe
  C:\Windows\System\FehHtEK.exe
  2⤵
  PID:8928
- C:\Windows\System\zSLYnxM.exe
  C:\Windows\System\zSLYnxM.exe
  2⤵
  PID:8956
- C:\Windows\System\tDqgpsc.exe
  C:\Windows\System\tDqgpsc.exe
  2⤵
  PID:8916
- C:\Windows\System\tCclYql.exe
  C:\Windows\System\tCclYql.exe
  2⤵
  PID:8056
- C:\Windows\System\gNRyqEm.exe
  C:\Windows\System\gNRyqEm.exe
  2⤵
  PID:9156
- C:\Windows\System\rARTSsa.exe
  C:\Windows\System\rARTSsa.exe
  2⤵
  PID:9036
- C:\Windows\System\MGMBcuR.exe
  C:\Windows\System\MGMBcuR.exe
  2⤵
  PID:8252
- C:\Windows\System\vqGmoSb.exe
  C:\Windows\System\vqGmoSb.exe
  2⤵
  PID:8364
- C:\Windows\System\aHMcaWM.exe
  C:\Windows\System\aHMcaWM.exe
  2⤵
  PID:8384
- C:\Windows\System\brBflqy.exe
  C:\Windows\System\brBflqy.exe
  2⤵
  PID:8416
- C:\Windows\System\gPMxeyO.exe
  C:\Windows\System\gPMxeyO.exe
  2⤵
  PID:8400
- C:\Windows\System\JzWSAxz.exe
  C:\Windows\System\JzWSAxz.exe
  2⤵
  PID:8604
- C:\Windows\System\SgrrayU.exe
  C:\Windows\System\SgrrayU.exe
  2⤵
  PID:9196
- C:\Windows\System\NauKEiV.exe
  C:\Windows\System\NauKEiV.exe
  2⤵
  PID:9140
- C:\Windows\System\WgUnJIP.exe
  C:\Windows\System\WgUnJIP.exe
  2⤵
  PID:8988
- C:\Windows\System\rkEexQx.exe
  C:\Windows\System\rkEexQx.exe
  2⤵
  PID:8696
- C:\Windows\System\YxRsdel.exe
  C:\Windows\System\YxRsdel.exe
  2⤵
  PID:8724
- C:\Windows\System\RcKchvN.exe
  C:\Windows\System\RcKchvN.exe
  2⤵
  PID:9104
- C:\Windows\System\MBfQadA.exe
  C:\Windows\System\MBfQadA.exe
  2⤵
  PID:8860
- C:\Windows\System\hWEyVaK.exe
  C:\Windows\System\hWEyVaK.exe
  2⤵
  PID:8512
- C:\Windows\System\nnKZCUV.exe
  C:\Windows\System\nnKZCUV.exe
  2⤵
  PID:9224
- C:\Windows\System\lbOejOk.exe
  C:\Windows\System\lbOejOk.exe
  2⤵
  PID:9244
- C:\Windows\System\AHoRDaM.exe
  C:\Windows\System\AHoRDaM.exe
  2⤵
  PID:9264
- C:\Windows\System\PYhJYhC.exe
  C:\Windows\System\PYhJYhC.exe
  2⤵
  PID:9280
- C:\Windows\System\QIscEgQ.exe
  C:\Windows\System\QIscEgQ.exe
  2⤵
  PID:9296
- C:\Windows\System\jrldyLP.exe
  C:\Windows\System\jrldyLP.exe
  2⤵
  PID:9312
- C:\Windows\System\louwVDs.exe
  C:\Windows\System\louwVDs.exe
  2⤵
  PID:9328
- C:\Windows\System\iZkYrDt.exe
  C:\Windows\System\iZkYrDt.exe
  2⤵
  PID:9440
- C:\Windows\System\kZBNxAa.exe
  C:\Windows\System\kZBNxAa.exe
  2⤵
  PID:9456
- C:\Windows\System\JUvmEPC.exe
  C:\Windows\System\JUvmEPC.exe
  2⤵
  PID:9472
- C:\Windows\System\QxXJJNp.exe
  C:\Windows\System\QxXJJNp.exe
  2⤵
  PID:9488
- C:\Windows\System\xevGsfr.exe
  C:\Windows\System\xevGsfr.exe
  2⤵
  PID:9508
- C:\Windows\System\EKSMdTx.exe
  C:\Windows\System\EKSMdTx.exe
  2⤵
  PID:9524
- C:\Windows\System\mOrEezl.exe
  C:\Windows\System\mOrEezl.exe
  2⤵
  PID:9540
- C:\Windows\System\alckqUz.exe
  C:\Windows\System\alckqUz.exe
  2⤵
  PID:9560
- C:\Windows\System\RDvjFju.exe
  C:\Windows\System\RDvjFju.exe
  2⤵
  PID:9576
- C:\Windows\System\qjGhYpB.exe
  C:\Windows\System\qjGhYpB.exe
  2⤵
  PID:9596
- C:\Windows\System\jOQykMn.exe
  C:\Windows\System\jOQykMn.exe
  2⤵
  PID:9612
- C:\Windows\System\YtPsYPb.exe
  C:\Windows\System\YtPsYPb.exe
  2⤵
  PID:9632
- C:\Windows\System\ukWGAMs.exe
  C:\Windows\System\ukWGAMs.exe
  2⤵
  PID:9648
- C:\Windows\System\FupwfDh.exe
  C:\Windows\System\FupwfDh.exe
  2⤵
  PID:9668
- C:\Windows\System\FKGRZwt.exe
  C:\Windows\System\FKGRZwt.exe
  2⤵
  PID:9684
- C:\Windows\System\qpgodfx.exe
  C:\Windows\System\qpgodfx.exe
  2⤵
  PID:9704
- C:\Windows\System\LgytxdL.exe
  C:\Windows\System\LgytxdL.exe
  2⤵
  PID:9720
- C:\Windows\System\MuBmDrw.exe
  C:\Windows\System\MuBmDrw.exe
  2⤵
  PID:9736
- C:\Windows\System\WOBNQnM.exe
  C:\Windows\System\WOBNQnM.exe
  2⤵
  PID:9752
- C:\Windows\System\fcbEZNu.exe
  C:\Windows\System\fcbEZNu.exe
  2⤵
  PID:9768
- C:\Windows\System\dXyOWij.exe
  C:\Windows\System\dXyOWij.exe
  2⤵
  PID:9788
- C:\Windows\System\XUvCRlw.exe
  C:\Windows\System\XUvCRlw.exe
  2⤵
  PID:9804
- C:\Windows\System\aeMBWYs.exe
  C:\Windows\System\aeMBWYs.exe
  2⤵
  PID:9820
- C:\Windows\System\MOPbPvE.exe
  C:\Windows\System\MOPbPvE.exe
  2⤵
  PID:9840
- C:\Windows\System\ZrJaBci.exe
  C:\Windows\System\ZrJaBci.exe
  2⤵
  PID:9860
- C:\Windows\System\aVXTlVw.exe
  C:\Windows\System\aVXTlVw.exe
  2⤵
  PID:9876
- C:\Windows\System\pKnonLX.exe
  C:\Windows\System\pKnonLX.exe
  2⤵
  PID:9912
- C:\Windows\System\QaPjUwp.exe
  C:\Windows\System\QaPjUwp.exe
  2⤵
  PID:9952
- C:\Windows\System\kVTEoKT.exe
  C:\Windows\System\kVTEoKT.exe
  2⤵
  PID:9968
- C:\Windows\System\mJOAIus.exe
  C:\Windows\System\mJOAIus.exe
  2⤵
  PID:9984
- C:\Windows\System\SxvpHjq.exe
  C:\Windows\System\SxvpHjq.exe
  2⤵
  PID:10032
- C:\Windows\System\hEKYKvC.exe
  C:\Windows\System\hEKYKvC.exe
  2⤵
  PID:10048
- C:\Windows\System\bxsRxqN.exe
  C:\Windows\System\bxsRxqN.exe
  2⤵
  PID:10064
- C:\Windows\System\QTkTwZP.exe
  C:\Windows\System\QTkTwZP.exe
  2⤵
  PID:10092
- C:\Windows\System\ctpPOXg.exe
  C:\Windows\System\ctpPOXg.exe
  2⤵
  PID:10108
- C:\Windows\System\yDXdWlH.exe
  C:\Windows\System\yDXdWlH.exe
  2⤵
  PID:10128
- C:\Windows\System\AGGOcPW.exe
  C:\Windows\System\AGGOcPW.exe
  2⤵
  PID:10144
- C:\Windows\System\RXkuwtr.exe
  C:\Windows\System\RXkuwtr.exe
  2⤵
  PID:10160
- C:\Windows\System\OvMwjXa.exe
  C:\Windows\System\OvMwjXa.exe
  2⤵
  PID:10180
- C:\Windows\System\qxqQARl.exe
  C:\Windows\System\qxqQARl.exe
  2⤵
  PID:10196
- C:\Windows\System\aAfUzZU.exe
  C:\Windows\System\aAfUzZU.exe
  2⤵
  PID:10220
- C:\Windows\System\gpWizyu.exe
  C:\Windows\System\gpWizyu.exe
  2⤵
  PID:8900
- C:\Windows\System\hwusrgO.exe
  C:\Windows\System\hwusrgO.exe
  2⤵
  PID:8776
- C:\Windows\System\CGTHvdl.exe
  C:\Windows\System\CGTHvdl.exe
  2⤵
  PID:8712
- C:\Windows\System\DPRjxkC.exe
  C:\Windows\System\DPRjxkC.exe
  2⤵
  PID:9040
- C:\Windows\System\ZjOZBSD.exe
  C:\Windows\System\ZjOZBSD.exe
  2⤵
  PID:9088
- C:\Windows\System\VoKgFsw.exe
  C:\Windows\System\VoKgFsw.exe
  2⤵
  PID:8324
- C:\Windows\System\hRABqHX.exe
  C:\Windows\System\hRABqHX.exe
  2⤵
  PID:9344
- C:\Windows\System\SrSfFDm.exe
  C:\Windows\System\SrSfFDm.exe
  2⤵
  PID:9360
- C:\Windows\System\paJmkLh.exe
  C:\Windows\System\paJmkLh.exe
  2⤵
  PID:9380
- C:\Windows\System\wcHJmJF.exe
  C:\Windows\System\wcHJmJF.exe
  2⤵
  PID:9392
- C:\Windows\System\vJJLaRh.exe
  C:\Windows\System\vJJLaRh.exe
  2⤵
  PID:9412
- C:\Windows\System\nmRxvXZ.exe
  C:\Windows\System\nmRxvXZ.exe
  2⤵
  PID:9428
- C:\Windows\System\UvcrCZg.exe
  C:\Windows\System\UvcrCZg.exe
  2⤵
  PID:9452
- C:\Windows\System\SLFtNww.exe
  C:\Windows\System\SLFtNww.exe
  2⤵
  PID:9504
- C:\Windows\System\qyBVkxF.exe
  C:\Windows\System\qyBVkxF.exe
  2⤵
  PID:9680
- C:\Windows\System\VKzXkUo.exe
  C:\Windows\System\VKzXkUo.exe
  2⤵
  PID:9812
- C:\Windows\System\xEJGgwD.exe
  C:\Windows\System\xEJGgwD.exe
  2⤵
  PID:9744
- C:\Windows\System\OsyMmXv.exe
  C:\Windows\System\OsyMmXv.exe
  2⤵
  PID:9816
- C:\Windows\System\ctREbgN.exe
  C:\Windows\System\ctREbgN.exe
  2⤵
  PID:9516
- C:\Windows\System\YCyupsE.exe
  C:\Windows\System\YCyupsE.exe
  2⤵
  PID:9588
- C:\Windows\System\CJZVwNA.exe
  C:\Windows\System\CJZVwNA.exe
  2⤵
  PID:9628
- C:\Windows\System\MvmYTcc.exe
  C:\Windows\System\MvmYTcc.exe
  2⤵
  PID:9692
- C:\Windows\System\ExQfdAx.exe
  C:\Windows\System\ExQfdAx.exe
  2⤵
  PID:9760
- C:\Windows\System\SWPinya.exe
  C:\Windows\System\SWPinya.exe
  2⤵
  PID:9896
- C:\Windows\System\kYUoyGL.exe
  C:\Windows\System\kYUoyGL.exe
  2⤵
  PID:9920
- C:\Windows\System\AJFDBgW.exe
  C:\Windows\System\AJFDBgW.exe
  2⤵
  PID:10000
- C:\Windows\System\BJnrOJY.exe
  C:\Windows\System\BJnrOJY.exe
  2⤵
  PID:10016
- C:\Windows\System\JABkuaO.exe
  C:\Windows\System\JABkuaO.exe
  2⤵
  PID:9980
- C:\Windows\System\iEveCht.exe
  C:\Windows\System\iEveCht.exe
  2⤵
  PID:10040
- C:\Windows\System\HVSZBEP.exe
  C:\Windows\System\HVSZBEP.exe
  2⤵
  PID:10104
- C:\Windows\System\eLkNVwh.exe
  C:\Windows\System\eLkNVwh.exe
  2⤵
  PID:10084
- C:\Windows\System\sIxwdmu.exe
  C:\Windows\System\sIxwdmu.exe
  2⤵
  PID:10152
- C:\Windows\System\lVhpIiV.exe
  C:\Windows\System\lVhpIiV.exe
  2⤵
  PID:10176
- C:\Windows\System\mfOazJL.exe
  C:\Windows\System\mfOazJL.exe
  2⤵
  PID:10172
- C:\Windows\System\UwYOehL.exe
  C:\Windows\System\UwYOehL.exe
  2⤵
  PID:10228
- C:\Windows\System\qVCpfPk.exe
  C:\Windows\System\qVCpfPk.exe
  2⤵
  PID:8780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\COGHAhG.exe

Filesize
1.5MB

MD5
90eec0ab115551f329e427e620f745e4

SHA1
aaaeee8ffb6ed4babce7be30424fe2642575c16a

SHA256
a72aafd992c37298017851484f84b15d050ec005640fceb357e0838fa118dc79

SHA512
e52870ba7be6f5b01a402c20538179ae15fe552cf4ab54cbe6341e78b96d4b54e67c6a18f3d0ff20ac091ff388c76d4e6654b4857284d692ec115ee6729914f0

Download Submit
C:\Windows\system\Cpudzal.exe

Filesize
1.5MB

MD5
70cee83912c515c7f8d14931eabdc97d

SHA1
600acc76614c65cce1829c250155c814da9c64e7

SHA256
3e5866dd085b7bad4fe3b923b7dac1ea81fe008c5ed477a69dfc3c3e8997432c

SHA512
ad414d4aca0872ec40070481572577e7266d820739bf12ce35bd974958498bc3720fe946588f5c873276bed55081b33f72b40a4e6f7a924b414e21596aa9e570

Download Submit
C:\Windows\system\EKdqIDL.exe

Filesize
1.5MB

MD5
c20a720a549928682a5af4870013ba8d

SHA1
e893f36f0eb07f848c261bf22103a2a12e033285

SHA256
15ca9129930c20a75d6ecfaab9c64ad023a8fb1433436451dfc6a2b83a36ba1f

SHA512
4a8f059cf4e5fcccc37361b585e6a34507d7201a13b9a7833fb4b0b0db95391325bf010cbe9e42e3071b67cc2af64e6b687fd68300ec1d32a47623303eb2a28d

Download Submit
C:\Windows\system\FfrHAaz.exe

Filesize
1.5MB

MD5
4ce157ea8abcbf6ae6ae9587c191bde5

SHA1
4103b654879c6c54ed6519830834c747e875d59c

SHA256
b80a4cc26a6175f45319a7830de0d76a298d76c32f8ed89052deb8693e3f996f

SHA512
b38ad0ad78d3e5d5f069df4317627dc907294283a9a17b1d9128d97a56fecf9163a8566f3248c3bb3a44a1d2b0a44e37fbc9a51ac2bbf9f75be123e7968727a0

Download Submit
C:\Windows\system\HGKPrte.exe

Filesize
1.5MB

MD5
ecb95b1bbba859df871129c915cdb7c8

SHA1
a23cc18040133cb8199d816ca40fb2b8bc918bd5

SHA256
4e102ff98f730f47bdc55b54c8c1377a4b9031bbb038cc5995bb876e274be351

SHA512
9e8ebad516986e118568c4d142201148308a42086bc17e847da3dd0448f78abd10ff93a7e82630e22ceb6c586acc487a2cbf340086151a7ae6ca65d3eb800a0d

Download Submit
C:\Windows\system\MkVvyHU.exe

Filesize
1.5MB

MD5
73e0de8ffb2f29fe85e9dfa2e58950b3

SHA1
b72eb5ab76d7ebf25d75ab2024d5435585ce97d3

SHA256
e346faca0360566eed584e8172ee199fa40a6fda83e33635a6a0dffcff06b90c

SHA512
a62b6551d54a99b2822352546f9fdd1894ce46f83b375f94093223a9601ce70ce9af13a58d1ed7027dd98ce8ed63bd7bf05b56862fbcc21cbd36cfde4097ff46

Download Submit
C:\Windows\system\TPhIRFa.exe

Filesize
1.5MB

MD5
a3b65306297f6488b65ded5100e0048d

SHA1
ab4779b7f2defb2a6a02675293d9c43d2db7bee6

SHA256
f40f781ab4dd5550345e5bb3b96959d193c6159e71cc4a1e292651bbba2dddac

SHA512
30c2747c83081ef4b74742fbde8ad96d8fde1977ec39dc71c1d50702c781d8a1cab53ab2c50eccc1936d694ec655cd2b18062386c48bf93136c1a863ad65ecd7

Download Submit
C:\Windows\system\XPVGwRQ.exe

Filesize
1.5MB

MD5
f4243088332dde50ad166b1abb35f3ab

SHA1
90619a077bfbafbe1198ed2d7f3c5264c35fecfd

SHA256
61210c97c10a490dee39b7ca40ca5ed6ad45adfe43227d775386b54344443482

SHA512
5c38b349bccff09ecb1893a6d061540daa6f3b8782ff1a6d205a17983f6a30087918a4c3c7bdf861ff6b9eb0fd84ffbbc2211c2f05f4948d05fafb9d2251daaa

Download Submit
C:\Windows\system\YJcNKpg.exe

Filesize
1.5MB

MD5
b4b61f2fb0dcbf35c2ec01d6f69c485f

SHA1
a8820addc34f3ab8c2f015644df533e4e8005a39

SHA256
907b74efbbd373f4e537101966c7be55412aea403ab1bb8d98c0f1f608819f9e

SHA512
9450433e934af232ffd4c8b2328a470217342c266cce968d0bfc281c7d7e0cd13ae88e0a4511005d2e0d0a1d034bb61f5beb02e686cb5526463459f007aaa099

Download Submit
C:\Windows\system\ZgDkUWx.exe

Filesize
1.5MB

MD5
ab91aa45184a33b5624f8c509413e4a2

SHA1
04f1e5a63adde666634bff4f540f05cbd2cde39b

SHA256
ab9707e557f693e21cedf7b1e27e5d6db924aab2b640738098c567f68181373d

SHA512
1d37e899fcf53f2982cea978af45b7f11b8e56a44b0329ceebb55ffac6fee169d69986c6c0139eb7b83ad3576a8e6a976e7a5105a00c584e497b0bf2441c7541

Download Submit
C:\Windows\system\ZpeEwfe.exe

Filesize
1.5MB

MD5
8ddaa846df3743483d0a739de8094d51

SHA1
3aefb55fc1e8116677d4603b7d3da472f9a07cd0

SHA256
fb84ecf48b1c51d8677a3b729e99b0741e57ae39402adb0e13e551853a12f06c

SHA512
afa020e3d0821ba99f34f86859a5b5be435e4ae09bd58a2046138c2488093a26702b20204a58512e50c0efeeb12e67a72d3224bf2fe1d35c913946cd2095f871

Download Submit
C:\Windows\system\gibKPWa.exe

Filesize
1.5MB

MD5
3ee74125951f135b4901667d652fcfc1

SHA1
78eb92407aa1ecd813a824d9e91d695118a2314e

SHA256
fa1f42a4abd315cf08a192e09331cc740e270b2483f836f2ee018dbd0b8c176f

SHA512
4d67cf1ccba97c4a6dc7d8ade039bc9a8f431c48535dff0920a8ac24b32cc414c94afe387a286bcd68224896be26f686b618372ce8a2f0f4c0f65cf0a4da52cd

Download Submit
C:\Windows\system\gklgyWO.exe

Filesize
1.5MB

MD5
24e4614a10aa9b722def6985d63313d6

SHA1
eb25b4aa1abb9ffbf1fc2811ffbc79cde591ac1f

SHA256
ffe2539e5ef3843aa422ef98d85978c313978b606f288c9ddec5a28457a4845b

SHA512
24ec1462c9d274fc89fbc76148972d197408f59684aac066d0d52f2871daa7ade4c592663b7f8143b90ab6db2eda364e0887359120715aed7d142808ec505860

Download Submit
C:\Windows\system\ibnQhCZ.exe

Filesize
1.5MB

MD5
8b6cf4c8e6b87aa561701239cd3ed34d

SHA1
ba2abcaaf628f0971c5d62ff40af693cc4547c21

SHA256
d84bbf5e8867a9ee8c4f7e02153ec514890d3cec9f0164d82562f853a7a41cf6

SHA512
608372cf80206c7bbc3680ca605313199a5d9e386d5569dedf8d6b51add0d43dd65f64fdebf5d6fa59f9c6334673071c1caf0c2f430ac2fef6bf284ec367093e

Download Submit
C:\Windows\system\jybTSZT.exe

Filesize
1.5MB

MD5
c39755bc545e0838d018e0cc275ffd33

SHA1
652c69b41592a91ac29eb39d306b19f7529ea616

SHA256
4a17c6770accdd8fa700fb95b78d751bad2aa1c3d41e00633d43b963e1f05c98

SHA512
1e79a7824958d4f33ad2b2365840624c5f5352b07a5b3e05311a111bbde2398dc006fe5b51480004177009ab98632083a344f7a6cbf45c12c3209df9f47cfb05

Download Submit
C:\Windows\system\kOJJRYL.exe

Filesize
1.5MB

MD5
bee50a446031866f26128a59550d17e8

SHA1
d0c83c5baf2c55080742f9180b3fb2c73c52af92

SHA256
88daaceb03474f35191d36ad08d1532de58c515f82e566806698521d810ea40e

SHA512
29a080d71e857a67d5dd68e0d7d09138dfd63df7ffb619c05f0cfb4ef68e54e7ce6dbca7be2635f9a4060ca70c990f22bebf242d86730ebae1e7eeb7bf7e1518

Download Submit
C:\Windows\system\mNwNNWU.exe

Filesize
1.5MB

MD5
b9bf78b97239b28501f7b4b7af70be9a

SHA1
98447baf7f9366c3b59e1e5746a7a69cb3a69c6b

SHA256
3534d2423f6c46e05f38177b328df06a1ea28379aa8a02f8fab8544eff9e3c55

SHA512
47c901684ee1ed4e856657ad830f51d7bdeaf1d6925248a6f8ca119864a8de191cf6e05e8c749383b086d713d50d38052c08817ea769286ed859eb99b55ae913

Download Submit
C:\Windows\system\nKrimkC.exe

Filesize
1.5MB

MD5
effb4fa91e90f7980104cf52b46cfd5a

SHA1
a505e37d6a2913bd0f68c7697d6ced6b6d411431

SHA256
92df3773644f6e63857962a4d5172a33f23fe5f6d8744e18d61e80d1218ae5ad

SHA512
380078d9cf6040d0fede29819ffe1c972553bbfd46c8429f5ea626acecfe3c502ced0bf5e45341f0a4d8bbccfaedfcd0268d0c6b56cac3da8f7b59ff1faba254

Download Submit
C:\Windows\system\nofmnWg.exe

Filesize
1.5MB

MD5
48aa46d0dc5bb71ac2d5ee1ef6b16e89

SHA1
0b9ede7eb8ec5ba41c8e950e62675f7f28ef1d47

SHA256
b1835a03771c102f98f9ee7ff957aa12109fcc0ac875d1eee98dc9462fd6fd0d

SHA512
89dcbb704916f60ed44e884b3c561fbe7f58d73f4902257c07e8433ef058242cd198cea2163db05575303233c6de5f8d40115e41af158ff0aad43175d6fce321

Download Submit
C:\Windows\system\qpFoDjq.exe

Filesize
1.5MB

MD5
560d30743ab5368360a0e8230e049833

SHA1
a87c547d7a42cb3b96d53327863d73ccfeddfbc4

SHA256
2ef860ffd13766a26934ed6a9cf7af762d74c8da380173daaa00f024f6c5b88a

SHA512
64db31d4868d2a5a34f2dcad8594be6f3943c59de329c89deb1d430ff798fd8612e6e04163887768c11a3dcdfae5c2ad00bfbd318d5f53f319f7e1535271d93a

Download Submit
C:\Windows\system\sDmPmuO.exe

Filesize
1.5MB

MD5
85d0da1deecab6398e1cef32d8f2daad

SHA1
63cbec610fbc7cba47c4a3eb688913b83585b638

SHA256
64a9bd38dbe472ce6b47fa458e67a934d71dc1ca095b85049cdbd776fcdcbd33

SHA512
b312e80d437ce6a6b17fe84f0f6a76b774705c46b3eb3656168a3093ba1585aadfc6eac594343ca7a5ebbccdef8dff1fef6c63cca2bd779c9828bf883031473d

Download Submit
C:\Windows\system\tbdfqjj.exe

Filesize
1.5MB

MD5
41058b762e9fae1cd682fcc1fcba3c38

SHA1
ddcee91d08e3d2168a6255d551b148d11ccac410

SHA256
93311d50474f595d71088a1d4b344eb5edade93014be86bb63d352ae6548c1a9

SHA512
3873b766d5640e365133da14b848333c29d1fc58ebf68d1062f70a2c39d553c44e441e88bc4c7fc9bdf18d4a773f77661b827d7ad09e661bf56bb5eec3393d0a

Download Submit
C:\Windows\system\vCXHphE.exe

Filesize
1.5MB

MD5
b11ef6df285a7d0eafcb943e68ab04dc

SHA1
4926f60cc4172baac7d6880ecf56c39c2cdfb0c8

SHA256
e5ad5667e99fc74eeca9fe0ba952a8e046882ba917069a4a9bce0564cf9f5f38

SHA512
a0ee33325a2fb216938e34ab4003b2b0442bc8b58e6ab350a6a250711e52f9a89f330b8c0acd7619c8f4160642ea35678618e465be97113f340f7a1b3d6066b0

Download Submit
C:\Windows\system\wEOAOWl.exe

Filesize
1.5MB

MD5
6e69906a105394152316c562da9292df

SHA1
665b661392b5b34974d977407b0db1751400c1fe

SHA256
672fe9a4b2093ab5f26bc34c2438a51086f204c79678973bfe19f99fc05f5365

SHA512
fdd795b0acfc2c415d6eed787aea76ca60c49529fdb15c226f7e652e345f217b7207cb06084747ed2bc70bc2bdf0fd8a3c9426cf20fdeaddb326e875b158821a

Download Submit
C:\Windows\system\wSBzZXB.exe

Filesize
1.5MB

MD5
fbc8fdae98351c751e5f4b5748ef8186

SHA1
dc56ae6071b8eec5bb5dfdcb5c67c4f0d1bed7cd

SHA256
daf22fa81564c08efe229582b2a2b7907b9051734852f04df67aee44285a1750

SHA512
68297f6205839d6f89bac78e1bf2d533fd6f2f9c9b234dca560041c7a6011dbf4ed3e5940d9820be8698201969257edd055f141c11002adca6d4c163fc871bfb

Download Submit
\Windows\system\GGYQWPe.exe

Filesize
1.5MB

MD5
561df278b8a14b0f0c303305e6404fb1

SHA1
a73298771b54364c4cc8645e1603177dfa880e7f

SHA256
109d7563aae915a45091a7a5702383033a8eb2bc5069d66ffc5be095f8399176

SHA512
9acc66146dfb78e74564509d067b201000ae9d833d89e1ba49af93e5c89655ae8dac381db63efe6d10d8049dfb0068e6afdbd49147e37983b932594f3443415c

Download Submit
\Windows\system\JlPiGvy.exe

Filesize
1.5MB

MD5
19dbbe86d0476fb74f6db9f18cfa2b7b

SHA1
5320dd7b7941bbf124b93eab02a32aadb86846b9

SHA256
98630c196aa3c3ff37d9ebe517d633625a2d85373b566e74a4bd12df7ecf0b79

SHA512
8495fdf3855ac20ecf21097a97bbbb254b0ce8e03bf3a2888c0e814a77f81809d81655046406e9e54e653929fa7aa0f7b217c8887d1605fc0df28290df1e8764

Download Submit
\Windows\system\RlbZWRQ.exe

Filesize
1.5MB

MD5
b32c4b18d775a76dbcfa15edea5656b6

SHA1
913ce382b9de5c56d78a7797a702c95157d0e0c9

SHA256
377d86fb7d0f6ff076177b2f6aa9e34899a27e4f78b2908489f8731296278853

SHA512
aa4ee43dc19bd92a3e21a6c3b8b3a46dd015aedfd9765e2c39a80fa5e23ce71bf2300f3a285654ad769305c40664640af516b1f6840b0356aa374cedbef54f8e

Download Submit
\Windows\system\cffYmZl.exe

Filesize
1.5MB

MD5
235380dafaa58d3af318b6cdbd7ea630

SHA1
2acbade85ce39e144083e9b2c807fcce8489eec8

SHA256
b747ae90d03d51905e128c6d6c0c7ee3bfc35f8d1058ec088d7022400574513d

SHA512
a707d24e1452a4dfdeca76d9a5c3fdb0d0f90b88a23b6e9999985b43282e63fd548935f9894fdb056686da054d1fceb577a5f9e79d99259537b5a0140b051502

Download Submit
\Windows\system\cqMDRpu.exe

Filesize
1.5MB

MD5
1397f599852f2741394d9427f541cad5

SHA1
c33c7ae54f53dc1634043935482f5d39526fe0e9

SHA256
173386025f1bc8aa2399214feeac0b440655526fa9c9fe3c243b8c21952dd49c

SHA512
015f8243be31135aa8c2d2fffa08a00fb62f34da0aa50a536503733f67a525ce18d38e3ae58ae2e84ddb3c9471c478a7c759b2ae57105b190f572749bb95aca9

Download Submit
\Windows\system\vQgdonz.exe

Filesize
1.5MB

MD5
c15b778919ef363b4d13461e4a24801a

SHA1
f3dae6a87333f575aa31cb536fad24d0913c8143

SHA256
fd9ef393fa9f4268bad2c24bee308e0988145abfed5228808861427f5325c85f

SHA512
b34d6fc9bcbd384f0f8f587e473cce4c263656c25b7fb33d9b33b63282e5cc7fc304480c9a111ae9a6b9c2e94128539c0bd2c7fab757460d2d00fd2d78b51c30

Download Submit
\Windows\system\vqHHjeB.exe

Filesize
1.5MB

MD5
efb967115a6e5f558c60d2c629227546

SHA1
9cf9acc9a9d1eb8dcb34471eea6242e2ed0e1512

SHA256
6c43a9a4c97802c3fb2d60a0e6279fa9f913ccbbe551a2bdc36aab13a77937c0

SHA512
968d39324287891672a8499dcb7e407fc3aa772efa93a5164144c983385f761dd865c940feac5609443d0ca7b2fdb5bede23c62d8f84119711573af1bd3d4dad

Download Submit
memory/944-95-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/944-2614-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/944-3930-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2044-2845-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2044-3922-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2148-35-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2148-3878-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2388-3848-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2388-97-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2388-53-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2484-3865-0x000000013F9D0000-0x000000013FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2484-61-0x000000013F9D0000-0x000000013FD21000-memory.dmp

Filesize
3.3MB

Download
memory/2548-68-0x000000013F800000-0x000000013FB51000-memory.dmp

Filesize
3.3MB

Download
memory/2548-3864-0x000000013F800000-0x000000013FB51000-memory.dmp

Filesize
3.3MB

Download
memory/2568-3821-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2568-33-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2604-34-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2776-55-0x000000013F9E0000-0x000000013FD31000-memory.dmp

Filesize
3.3MB

Download
memory/2776-3862-0x000000013F9E0000-0x000000013FD31000-memory.dmp

Filesize
3.3MB

Download
memory/2836-40-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2836-93-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2836-3842-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2884-54-0x000000013FAD0000-0x000000013FE21000-memory.dmp

Filesize
3.3MB

Download
memory/2884-92-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/2884-72-0x000000013F370000-0x000000013F6C1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2884-74-0x0000000001F20000-0x0000000002271000-memory.dmp

Filesize
3.3MB

Download
memory/2884-80-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-13-0x000000013F370000-0x000000013F6C1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-82-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2884-122-0x000000013FE60000-0x00000001401B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-1344-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-1343-0x0000000001F20000-0x0000000002271000-memory.dmp

Filesize
3.3MB

Download
memory/2884-1843-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-25-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2884-31-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2884-94-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-2612-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-0-0x000000013FAD0000-0x000000013FE21000-memory.dmp

Filesize
3.3MB

Download
memory/2884-3181-0x000000013FE60000-0x00000001401B1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-48-0x0000000001F20000-0x0000000002271000-memory.dmp

Filesize
3.3MB

Download
memory/2924-87-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2924-2445-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2924-3935-0x000000013F660000-0x000000013F9B1000-memory.dmp

Filesize
3.3MB

Download
memory/2932-1844-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2932-81-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2932-3894-0x000000013F160000-0x000000013F4B1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-67-0x000000013FC20000-0x000000013FF71000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3777-0x000000013FC20000-0x000000013FF71000-memory.dmp

Filesize
3.3MB

Download
memory/2988-7-0x000000013FC20000-0x000000013FF71000-memory.dmp

Filesize
3.3MB

Download
memory/3012-3824-0x000000013F370000-0x000000013F6C1000-memory.dmp

Filesize
3.3MB

Download
memory/3012-14-0x000000013F370000-0x000000013F6C1000-memory.dmp

Filesize
3.3MB

Download
memory/3012-73-0x000000013F370000-0x000000013F6C1000-memory.dmp

Filesize
3.3MB

Download