xmrig | 7e741c664e4a8ae89c7c3ae7d9c2e2a23b525a219125dfc115afc56a39dcb8f3

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08/05/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
Size

880KB
MD5

6eec15f21e4d8cca03350725b02c5970
SHA1

d5ead1b0f2f6f3c8961feb8304168a559bb00ca5
SHA256

7e741c664e4a8ae89c7c3ae7d9c2e2a23b525a219125dfc115afc56a39dcb8f3
SHA512

a5b8569a29b755fcf48abbed07ad13c4d88f1a24f14516e02216a4e4181e258bac627eeeb48cbdc32fac1c42b5fac7bb29d833a947c817e7c99e10cc6431276b
SSDEEP

24576:RVIl/WDGCi7/qkat62wTidpo3IpuOQ+g4NuZ7:ROdWCCi7/ra++d8bZ7

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/memory/1720-19-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/3012-23-0x000000013F2D0000-0x000000013F621000-memory.dmp	xmrig
behavioral1/memory/2344-17-0x000000013FD90000-0x00000001400E1000-memory.dmp	xmrig
behavioral1/memory/2660-36-0x000000013F790000-0x000000013FAE1000-memory.dmp	xmrig
behavioral1/memory/2628-34-0x000000013F960000-0x000000013FCB1000-memory.dmp	xmrig
behavioral1/memory/2548-44-0x000000013F670000-0x000000013F9C1000-memory.dmp	xmrig
behavioral1/memory/2452-76-0x000000013F0D0000-0x000000013F421000-memory.dmp	xmrig
behavioral1/memory/2208-103-0x0000000001DF0000-0x0000000002141000-memory.dmp	xmrig
behavioral1/memory/2832-105-0x000000013F680000-0x000000013F9D1000-memory.dmp	xmrig
behavioral1/memory/2844-101-0x000000013FF90000-0x00000001402E1000-memory.dmp	xmrig
behavioral1/memory/2208-99-0x0000000001DF0000-0x0000000002141000-memory.dmp	xmrig
behavioral1/memory/2208-88-0x000000013F580000-0x000000013F8D1000-memory.dmp	xmrig
behavioral1/memory/1688-77-0x000000013F840000-0x000000013FB91000-memory.dmp	xmrig
behavioral1/memory/2792-74-0x000000013F5B0000-0x000000013F901000-memory.dmp	xmrig
behavioral1/memory/2480-73-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2692-58-0x000000013FF70000-0x00000001402C1000-memory.dmp	xmrig
behavioral1/memory/2548-2275-0x000000013F670000-0x000000013F9C1000-memory.dmp	xmrig
behavioral1/memory/1684-4187-0x000000013F800000-0x000000013FB51000-memory.dmp	xmrig
behavioral1/memory/2344-4196-0x000000013FD90000-0x00000001400E1000-memory.dmp	xmrig
behavioral1/memory/3012-4200-0x000000013F2D0000-0x000000013F621000-memory.dmp	xmrig
behavioral1/memory/1720-4198-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2660-4204-0x000000013F790000-0x000000013FAE1000-memory.dmp	xmrig
behavioral1/memory/2628-4202-0x000000013F960000-0x000000013FCB1000-memory.dmp	xmrig
behavioral1/memory/2548-4206-0x000000013F670000-0x000000013F9C1000-memory.dmp	xmrig
behavioral1/memory/2480-4210-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2792-4212-0x000000013F5B0000-0x000000013F901000-memory.dmp	xmrig
behavioral1/memory/1688-4216-0x000000013F840000-0x000000013FB91000-memory.dmp	xmrig
behavioral1/memory/2452-4214-0x000000013F0D0000-0x000000013F421000-memory.dmp	xmrig
behavioral1/memory/1684-4218-0x000000013F800000-0x000000013FB51000-memory.dmp	xmrig
behavioral1/memory/2692-4208-0x000000013FF70000-0x00000001402C1000-memory.dmp	xmrig
behavioral1/memory/2832-4222-0x000000013F680000-0x000000013F9D1000-memory.dmp	xmrig
behavioral1/memory/2844-4221-0x000000013FF90000-0x00000001402E1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2344	JLDvOwd.exe
1720	rzrQfOt.exe
3012	FnBKEZz.exe
2628	JscYYCn.exe
2660	xVyZfRb.exe
2548	VfiNkos.exe
2692	yAUJxmf.exe
2480	Qgxtbcx.exe
2792	FAGvCDs.exe
2452	cwTLkme.exe
1688	bMAPMTL.exe
1684	GXANFyc.exe
2832	GCotTGC.exe
2844	abHAbMa.exe
2472	jvBSFjp.exe
2776	nSxTrhT.exe
2408	WmdlSUr.exe
2732	XjfUhZg.exe
2788	LHLRgfj.exe
2616	DMQIBiT.exe
2256	LLOXaZP.exe
632	iejLVOF.exe
312	BjhBDef.exe
2080	PhYkUSx.exe
2248	RBKTBjC.exe
2412	mOSpjbq.exe
2168	febBpgd.exe
2892	nCDstXx.exe
2372	IdXTKDc.exe
676	JGscBDf.exe
1148	EkdRNJl.exe
1488	MZBexLy.exe
3028	AzLrmqc.exe
700	vIbRcgg.exe
2252	aTbVLMb.exe
1796	wkXUZGF.exe
1092	LqHXTky.exe
1812	vFbtwhp.exe
452	DTNrExV.exe
1300	uLLZIZF.exe
2116	zYNgUbK.exe
2112	xLsfsPD.exe
1568	HqUSZgu.exe
1544	lfkrVrw.exe
1056	SKWwzol.exe
1624	rqQlXYT.exe
944	OccBnqn.exe
2900	cgRXjCv.exe
2908	oQNnRLi.exe
2608	uBiejhC.exe
916	YdenMRs.exe
572	pWkofjd.exe
2036	RXiQdzw.exe
2336	DYAOIsJ.exe
1844	RGvBuAl.exe
600	DGsIemt.exe
2916	dvJNUIe.exe
2972	tnNrHxI.exe
1804	mGWGUfd.exe
1504	iAalcPk.exe
2312	YOQUfOu.exe
2984	uUiWVbB.exe
2396	ayFHWJm.exe
1584	tvMVaXI.exe

Loads dropped DLL 64 IoCs

pid	Process
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-0-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/memory/1720-19-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/3012-23-0x000000013F2D0000-0x000000013F621000-memory.dmp	upx
behavioral1/files/0x0007000000014183-18.dat	upx
behavioral1/memory/2344-17-0x000000013FD90000-0x00000001400E1000-memory.dmp	upx
behavioral1/files/0x000700000001418c-26.dat	upx
behavioral1/memory/2660-36-0x000000013F790000-0x000000013FAE1000-memory.dmp	upx
behavioral1/memory/2628-34-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/files/0x000700000001431b-40.dat	upx
behavioral1/memory/2548-44-0x000000013F670000-0x000000013F9C1000-memory.dmp	upx
behavioral1/files/0x0007000000014251-28.dat	upx
behavioral1/files/0x0006000000014b1c-57.dat	upx
behavioral1/files/0x0006000000014bd7-65.dat	upx
behavioral1/memory/2452-76-0x000000013F0D0000-0x000000013F421000-memory.dmp	upx
behavioral1/memory/1684-83-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/files/0x0006000000014f57-78.dat	upx
behavioral1/files/0x000600000001507a-91.dat	upx
behavioral1/files/0x0006000000015083-100.dat	upx
behavioral1/files/0x0006000000015b85-137.dat	upx
behavioral1/files/0x0006000000015cee-165.dat	upx
behavioral1/memory/2208-555-0x0000000001DF0000-0x0000000002141000-memory.dmp	upx
behavioral1/memory/2208-554-0x0000000001DF0000-0x0000000002141000-memory.dmp	upx
behavioral1/files/0x0006000000015d0a-173.dat	upx
behavioral1/files/0x0006000000015cf8-169.dat	upx
behavioral1/files/0x0006000000015ce3-161.dat	upx
behavioral1/files/0x0006000000015cd2-157.dat	upx
behavioral1/files/0x0006000000015cc5-153.dat	upx
behavioral1/files/0x0006000000015cb1-149.dat	upx
behavioral1/files/0x0006000000015ca8-145.dat	upx
behavioral1/files/0x0006000000015c9a-141.dat	upx
behavioral1/files/0x0006000000015b50-133.dat	upx
behavioral1/files/0x0006000000015ae3-129.dat	upx
behavioral1/files/0x00060000000158d9-125.dat	upx
behavioral1/files/0x0006000000015662-121.dat	upx
behavioral1/files/0x000600000001565a-117.dat	upx
behavioral1/files/0x00060000000153ee-113.dat	upx
behavioral1/files/0x00060000000150d9-109.dat	upx
behavioral1/memory/2832-105-0x000000013F680000-0x000000013F9D1000-memory.dmp	upx
behavioral1/memory/2844-101-0x000000013FF90000-0x00000001402E1000-memory.dmp	upx
behavioral1/files/0x0034000000013a88-92.dat	upx
behavioral1/memory/2208-88-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/memory/1688-77-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/memory/2792-74-0x000000013F5B0000-0x000000013F901000-memory.dmp	upx
behavioral1/memory/2480-73-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0006000000014c2d-71.dat	upx
behavioral1/files/0x0007000000014a60-50.dat	upx
behavioral1/memory/2692-58-0x000000013FF70000-0x00000001402C1000-memory.dmp	upx
behavioral1/files/0x0008000000014367-47.dat	upx
behavioral1/files/0x0034000000013a53-11.dat	upx
behavioral1/files/0x000b000000013417-5.dat	upx
behavioral1/memory/2548-2275-0x000000013F670000-0x000000013F9C1000-memory.dmp	upx
behavioral1/memory/1684-4187-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/memory/2344-4196-0x000000013FD90000-0x00000001400E1000-memory.dmp	upx
behavioral1/memory/3012-4200-0x000000013F2D0000-0x000000013F621000-memory.dmp	upx
behavioral1/memory/1720-4198-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/2660-4204-0x000000013F790000-0x000000013FAE1000-memory.dmp	upx
behavioral1/memory/2628-4202-0x000000013F960000-0x000000013FCB1000-memory.dmp	upx
behavioral1/memory/2548-4206-0x000000013F670000-0x000000013F9C1000-memory.dmp	upx
behavioral1/memory/2480-4210-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2792-4212-0x000000013F5B0000-0x000000013F901000-memory.dmp	upx
behavioral1/memory/1688-4216-0x000000013F840000-0x000000013FB91000-memory.dmp	upx
behavioral1/memory/2452-4214-0x000000013F0D0000-0x000000013F421000-memory.dmp	upx
behavioral1/memory/1684-4218-0x000000013F800000-0x000000013FB51000-memory.dmp	upx
behavioral1/memory/2692-4208-0x000000013FF70000-0x00000001402C1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YOQUfOu.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\EZxqYMI.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\jBXPRhK.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\TlppQUW.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\EUnMunc.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\ZYGLFUO.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\RxQMiTh.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\dZGbjBH.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\viSwADW.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\zPmxZtz.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\bFjdQbm.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\YFyOHIm.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\THcOXLH.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\PtupTOW.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\ExgvRPB.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\EZiWLdU.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\dOlpcAB.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\JaMkGZe.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\DYPAEiy.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\mDGRWfX.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\vFbtwhp.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\qaCmwUQ.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\CdBUiOu.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\fgzGEMu.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\RpxFkFp.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\HXesMBd.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\SiuroGj.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\xVyZfRb.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\HpBvLrS.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\TCdWuON.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\xTmlWKB.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\febBpgd.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\GeeDuRC.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\FPoxmKo.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\HDQspme.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\xFmgbZb.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\fYUsTVh.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\ULonfaa.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\CAcRzii.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\AzeHfse.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\WrfkfRL.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\RoJZSct.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\uZaTllG.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\VvdAQcw.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\gAaQvpg.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\JzwdOxp.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\PuEMXqr.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\jxPxHaw.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\OJEVgLL.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\ZHzkkdi.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\HZWqsms.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\doKzHJK.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\lKrtlwM.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\yHESYBO.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\JrHVnKR.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\CCSWeyW.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\vIbRcgg.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\ojItQVl.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\nEymeZZ.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\dxbnYmW.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\JWeFAwL.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\vxPBRxA.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\CWCmUXS.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
File created	C:\Windows\System\ntKmoKa.exe	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2344	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	29
PID 2208 wrote to memory of 2344	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	29
PID 2208 wrote to memory of 2344	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	29
PID 2208 wrote to memory of 1720	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	30
PID 2208 wrote to memory of 1720	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	30
PID 2208 wrote to memory of 1720	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	30
PID 2208 wrote to memory of 3012	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	31
PID 2208 wrote to memory of 3012	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	31
PID 2208 wrote to memory of 3012	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	31
PID 2208 wrote to memory of 2628	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	32
PID 2208 wrote to memory of 2628	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	32
PID 2208 wrote to memory of 2628	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	32
PID 2208 wrote to memory of 2660	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	33
PID 2208 wrote to memory of 2660	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	33
PID 2208 wrote to memory of 2660	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	33
PID 2208 wrote to memory of 2548	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	34
PID 2208 wrote to memory of 2548	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	34
PID 2208 wrote to memory of 2548	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	34
PID 2208 wrote to memory of 2692	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	35
PID 2208 wrote to memory of 2692	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	35
PID 2208 wrote to memory of 2692	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	35
PID 2208 wrote to memory of 2792	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	36
PID 2208 wrote to memory of 2792	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	36
PID 2208 wrote to memory of 2792	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	36
PID 2208 wrote to memory of 2480	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	37
PID 2208 wrote to memory of 2480	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	37
PID 2208 wrote to memory of 2480	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	37
PID 2208 wrote to memory of 2452	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	38
PID 2208 wrote to memory of 2452	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	38
PID 2208 wrote to memory of 2452	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	38
PID 2208 wrote to memory of 1688	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	39
PID 2208 wrote to memory of 1688	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	39
PID 2208 wrote to memory of 1688	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	39
PID 2208 wrote to memory of 1684	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	40
PID 2208 wrote to memory of 1684	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	40
PID 2208 wrote to memory of 1684	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	40
PID 2208 wrote to memory of 2832	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	41
PID 2208 wrote to memory of 2832	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	41
PID 2208 wrote to memory of 2832	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	41
PID 2208 wrote to memory of 2844	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	42
PID 2208 wrote to memory of 2844	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	42
PID 2208 wrote to memory of 2844	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	42
PID 2208 wrote to memory of 2472	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	43
PID 2208 wrote to memory of 2472	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	43
PID 2208 wrote to memory of 2472	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	43
PID 2208 wrote to memory of 2776	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	44
PID 2208 wrote to memory of 2776	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	44
PID 2208 wrote to memory of 2776	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	44
PID 2208 wrote to memory of 2408	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	45
PID 2208 wrote to memory of 2408	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	45
PID 2208 wrote to memory of 2408	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	45
PID 2208 wrote to memory of 2732	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	46
PID 2208 wrote to memory of 2732	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	46
PID 2208 wrote to memory of 2732	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	46
PID 2208 wrote to memory of 2788	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	47
PID 2208 wrote to memory of 2788	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	47
PID 2208 wrote to memory of 2788	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	47
PID 2208 wrote to memory of 2616	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	48
PID 2208 wrote to memory of 2616	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	48
PID 2208 wrote to memory of 2616	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	48
PID 2208 wrote to memory of 2256	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	49
PID 2208 wrote to memory of 2256	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	49
PID 2208 wrote to memory of 2256	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	49
PID 2208 wrote to memory of 632	2208	6eec15f21e4d8cca03350725b02c5970_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\6eec15f21e4d8cca03350725b02c5970_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\6eec15f21e4d8cca03350725b02c5970_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System\JLDvOwd.exe
  C:\Windows\System\JLDvOwd.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\rzrQfOt.exe
  C:\Windows\System\rzrQfOt.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\FnBKEZz.exe
  C:\Windows\System\FnBKEZz.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\JscYYCn.exe
  C:\Windows\System\JscYYCn.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\xVyZfRb.exe
  C:\Windows\System\xVyZfRb.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\VfiNkos.exe
  C:\Windows\System\VfiNkos.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\yAUJxmf.exe
  C:\Windows\System\yAUJxmf.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\FAGvCDs.exe
  C:\Windows\System\FAGvCDs.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\Qgxtbcx.exe
  C:\Windows\System\Qgxtbcx.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\cwTLkme.exe
  C:\Windows\System\cwTLkme.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\bMAPMTL.exe
  C:\Windows\System\bMAPMTL.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\GXANFyc.exe
  C:\Windows\System\GXANFyc.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\GCotTGC.exe
  C:\Windows\System\GCotTGC.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\abHAbMa.exe
  C:\Windows\System\abHAbMa.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\jvBSFjp.exe
  C:\Windows\System\jvBSFjp.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\nSxTrhT.exe
  C:\Windows\System\nSxTrhT.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\WmdlSUr.exe
  C:\Windows\System\WmdlSUr.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\XjfUhZg.exe
  C:\Windows\System\XjfUhZg.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\LHLRgfj.exe
  C:\Windows\System\LHLRgfj.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\DMQIBiT.exe
  C:\Windows\System\DMQIBiT.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\LLOXaZP.exe
  C:\Windows\System\LLOXaZP.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\iejLVOF.exe
  C:\Windows\System\iejLVOF.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\BjhBDef.exe
  C:\Windows\System\BjhBDef.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\PhYkUSx.exe
  C:\Windows\System\PhYkUSx.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\RBKTBjC.exe
  C:\Windows\System\RBKTBjC.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\mOSpjbq.exe
  C:\Windows\System\mOSpjbq.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\febBpgd.exe
  C:\Windows\System\febBpgd.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\nCDstXx.exe
  C:\Windows\System\nCDstXx.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\IdXTKDc.exe
  C:\Windows\System\IdXTKDc.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\JGscBDf.exe
  C:\Windows\System\JGscBDf.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\EkdRNJl.exe
  C:\Windows\System\EkdRNJl.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\MZBexLy.exe
  C:\Windows\System\MZBexLy.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\AzLrmqc.exe
  C:\Windows\System\AzLrmqc.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\vIbRcgg.exe
  C:\Windows\System\vIbRcgg.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\aTbVLMb.exe
  C:\Windows\System\aTbVLMb.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\wkXUZGF.exe
  C:\Windows\System\wkXUZGF.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\LqHXTky.exe
  C:\Windows\System\LqHXTky.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\vFbtwhp.exe
  C:\Windows\System\vFbtwhp.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\DTNrExV.exe
  C:\Windows\System\DTNrExV.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\uLLZIZF.exe
  C:\Windows\System\uLLZIZF.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\zYNgUbK.exe
  C:\Windows\System\zYNgUbK.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\xLsfsPD.exe
  C:\Windows\System\xLsfsPD.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\HqUSZgu.exe
  C:\Windows\System\HqUSZgu.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\lfkrVrw.exe
  C:\Windows\System\lfkrVrw.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\SKWwzol.exe
  C:\Windows\System\SKWwzol.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\rqQlXYT.exe
  C:\Windows\System\rqQlXYT.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\OccBnqn.exe
  C:\Windows\System\OccBnqn.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\cgRXjCv.exe
  C:\Windows\System\cgRXjCv.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\oQNnRLi.exe
  C:\Windows\System\oQNnRLi.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\uBiejhC.exe
  C:\Windows\System\uBiejhC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\YdenMRs.exe
  C:\Windows\System\YdenMRs.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\pWkofjd.exe
  C:\Windows\System\pWkofjd.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\RXiQdzw.exe
  C:\Windows\System\RXiQdzw.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\DYAOIsJ.exe
  C:\Windows\System\DYAOIsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\RGvBuAl.exe
  C:\Windows\System\RGvBuAl.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\DGsIemt.exe
  C:\Windows\System\DGsIemt.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\dvJNUIe.exe
  C:\Windows\System\dvJNUIe.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\tnNrHxI.exe
  C:\Windows\System\tnNrHxI.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\mGWGUfd.exe
  C:\Windows\System\mGWGUfd.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\iAalcPk.exe
  C:\Windows\System\iAalcPk.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\YOQUfOu.exe
  C:\Windows\System\YOQUfOu.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\uUiWVbB.exe
  C:\Windows\System\uUiWVbB.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ayFHWJm.exe
  C:\Windows\System\ayFHWJm.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\tvMVaXI.exe
  C:\Windows\System\tvMVaXI.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\hPZxSTw.exe
  C:\Windows\System\hPZxSTw.exe
  2⤵
  PID:1608
- C:\Windows\System\PtupTOW.exe
  C:\Windows\System\PtupTOW.exe
  2⤵
  PID:1680
- C:\Windows\System\sPibsYn.exe
  C:\Windows\System\sPibsYn.exe
  2⤵
  PID:2012
- C:\Windows\System\JoAbqZz.exe
  C:\Windows\System\JoAbqZz.exe
  2⤵
  PID:3060
- C:\Windows\System\dCCUsDe.exe
  C:\Windows\System\dCCUsDe.exe
  2⤵
  PID:2588
- C:\Windows\System\DmCnEJt.exe
  C:\Windows\System\DmCnEJt.exe
  2⤵
  PID:1620
- C:\Windows\System\VkbahbL.exe
  C:\Windows\System\VkbahbL.exe
  2⤵
  PID:2572
- C:\Windows\System\FxaNumH.exe
  C:\Windows\System\FxaNumH.exe
  2⤵
  PID:1144
- C:\Windows\System\FwsjNsB.exe
  C:\Windows\System\FwsjNsB.exe
  2⤵
  PID:2456
- C:\Windows\System\uLCjstD.exe
  C:\Windows\System\uLCjstD.exe
  2⤵
  PID:2596
- C:\Windows\System\jzkcPRa.exe
  C:\Windows\System\jzkcPRa.exe
  2⤵
  PID:2496
- C:\Windows\System\LdMyhLg.exe
  C:\Windows\System\LdMyhLg.exe
  2⤵
  PID:2992
- C:\Windows\System\flfDdKO.exe
  C:\Windows\System\flfDdKO.exe
  2⤵
  PID:2476
- C:\Windows\System\ENfaMli.exe
  C:\Windows\System\ENfaMli.exe
  2⤵
  PID:2656
- C:\Windows\System\JGHySeH.exe
  C:\Windows\System\JGHySeH.exe
  2⤵
  PID:2528
- C:\Windows\System\nozIDxf.exe
  C:\Windows\System\nozIDxf.exe
  2⤵
  PID:2964
- C:\Windows\System\AuBqXkz.exe
  C:\Windows\System\AuBqXkz.exe
  2⤵
  PID:1676
- C:\Windows\System\kmDxZPh.exe
  C:\Windows\System\kmDxZPh.exe
  2⤵
  PID:2744
- C:\Windows\System\IGLlNmJ.exe
  C:\Windows\System\IGLlNmJ.exe
  2⤵
  PID:384
- C:\Windows\System\oKQFzzK.exe
  C:\Windows\System\oKQFzzK.exe
  2⤵
  PID:2228
- C:\Windows\System\HULhQbF.exe
  C:\Windows\System\HULhQbF.exe
  2⤵
  PID:1248
- C:\Windows\System\fRJhikf.exe
  C:\Windows\System\fRJhikf.exe
  2⤵
  PID:2224
- C:\Windows\System\UxsfyQw.exe
  C:\Windows\System\UxsfyQw.exe
  2⤵
  PID:1984
- C:\Windows\System\APdmjLw.exe
  C:\Windows\System\APdmjLw.exe
  2⤵
  PID:1396
- C:\Windows\System\ZzMatZA.exe
  C:\Windows\System\ZzMatZA.exe
  2⤵
  PID:2460
- C:\Windows\System\CzIDPbE.exe
  C:\Windows\System\CzIDPbE.exe
  2⤵
  PID:1484
- C:\Windows\System\NSqYMcZ.exe
  C:\Windows\System\NSqYMcZ.exe
  2⤵
  PID:2948
- C:\Windows\System\MSzicLb.exe
  C:\Windows\System\MSzicLb.exe
  2⤵
  PID:2276
- C:\Windows\System\OdrGgcY.exe
  C:\Windows\System\OdrGgcY.exe
  2⤵
  PID:2428
- C:\Windows\System\DaYekWB.exe
  C:\Windows\System\DaYekWB.exe
  2⤵
  PID:2404
- C:\Windows\System\ZIqQTFM.exe
  C:\Windows\System\ZIqQTFM.exe
  2⤵
  PID:752
- C:\Windows\System\sHvLAnQ.exe
  C:\Windows\System\sHvLAnQ.exe
  2⤵
  PID:2820
- C:\Windows\System\jlMZydU.exe
  C:\Windows\System\jlMZydU.exe
  2⤵
  PID:1952
- C:\Windows\System\Lymgdqv.exe
  C:\Windows\System\Lymgdqv.exe
  2⤵
  PID:1600
- C:\Windows\System\ZzABMYR.exe
  C:\Windows\System\ZzABMYR.exe
  2⤵
  PID:1352
- C:\Windows\System\QzWsTUt.exe
  C:\Windows\System\QzWsTUt.exe
  2⤵
  PID:1864
- C:\Windows\System\CKBqOxb.exe
  C:\Windows\System\CKBqOxb.exe
  2⤵
  PID:2904
- C:\Windows\System\dSuZsxC.exe
  C:\Windows\System\dSuZsxC.exe
  2⤵
  PID:2388
- C:\Windows\System\IMGPaTX.exe
  C:\Windows\System\IMGPaTX.exe
  2⤵
  PID:1696
- C:\Windows\System\CsDqYxd.exe
  C:\Windows\System\CsDqYxd.exe
  2⤵
  PID:2076
- C:\Windows\System\ZZShQNF.exe
  C:\Windows\System\ZZShQNF.exe
  2⤵
  PID:996
- C:\Windows\System\hfWrLkr.exe
  C:\Windows\System\hfWrLkr.exe
  2⤵
  PID:892
- C:\Windows\System\pKHxzht.exe
  C:\Windows\System\pKHxzht.exe
  2⤵
  PID:2292
- C:\Windows\System\TiFLAuC.exe
  C:\Windows\System\TiFLAuC.exe
  2⤵
  PID:1612
- C:\Windows\System\LRBZCpP.exe
  C:\Windows\System\LRBZCpP.exe
  2⤵
  PID:2708
- C:\Windows\System\HpBvLrS.exe
  C:\Windows\System\HpBvLrS.exe
  2⤵
  PID:2648
- C:\Windows\System\kqaOoBZ.exe
  C:\Windows\System\kqaOoBZ.exe
  2⤵
  PID:3020
- C:\Windows\System\uAxhfdG.exe
  C:\Windows\System\uAxhfdG.exe
  2⤵
  PID:2028
- C:\Windows\System\BSJeujX.exe
  C:\Windows\System\BSJeujX.exe
  2⤵
  PID:2568
- C:\Windows\System\HgfJHYg.exe
  C:\Windows\System\HgfJHYg.exe
  2⤵
  PID:2296
- C:\Windows\System\KEuVjAP.exe
  C:\Windows\System\KEuVjAP.exe
  2⤵
  PID:2716
- C:\Windows\System\eQkqURt.exe
  C:\Windows\System\eQkqURt.exe
  2⤵
  PID:2828
- C:\Windows\System\bqZavtd.exe
  C:\Windows\System\bqZavtd.exe
  2⤵
  PID:2504
- C:\Windows\System\neWtBaX.exe
  C:\Windows\System\neWtBaX.exe
  2⤵
  PID:1448
- C:\Windows\System\NNTqbcN.exe
  C:\Windows\System\NNTqbcN.exe
  2⤵
  PID:1932
- C:\Windows\System\VcdZGsx.exe
  C:\Windows\System\VcdZGsx.exe
  2⤵
  PID:2824
- C:\Windows\System\eeRIScy.exe
  C:\Windows\System\eeRIScy.exe
  2⤵
  PID:772
- C:\Windows\System\PGNEOdF.exe
  C:\Windows\System\PGNEOdF.exe
  2⤵
  PID:1856
- C:\Windows\System\SkfJvyJ.exe
  C:\Windows\System\SkfJvyJ.exe
  2⤵
  PID:1256
- C:\Windows\System\skjDIcM.exe
  C:\Windows\System\skjDIcM.exe
  2⤵
  PID:1016
- C:\Windows\System\mOUMCxc.exe
  C:\Windows\System\mOUMCxc.exe
  2⤵
  PID:2136
- C:\Windows\System\RZDMyQV.exe
  C:\Windows\System\RZDMyQV.exe
  2⤵
  PID:1768
- C:\Windows\System\KxJMwRO.exe
  C:\Windows\System\KxJMwRO.exe
  2⤵
  PID:2100
- C:\Windows\System\XrAOgaq.exe
  C:\Windows\System\XrAOgaq.exe
  2⤵
  PID:2672
- C:\Windows\System\PwRNWSd.exe
  C:\Windows\System\PwRNWSd.exe
  2⤵
  PID:2912
- C:\Windows\System\DCCHtJa.exe
  C:\Windows\System\DCCHtJa.exe
  2⤵
  PID:2420
- C:\Windows\System\SjbOWQe.exe
  C:\Windows\System\SjbOWQe.exe
  2⤵
  PID:2976
- C:\Windows\System\EyuBljM.exe
  C:\Windows\System\EyuBljM.exe
  2⤵
  PID:1716
- C:\Windows\System\CQHzCLb.exe
  C:\Windows\System\CQHzCLb.exe
  2⤵
  PID:1604
- C:\Windows\System\QGgcMSz.exe
  C:\Windows\System\QGgcMSz.exe
  2⤵
  PID:2632
- C:\Windows\System\nKlGOTj.exe
  C:\Windows\System\nKlGOTj.exe
  2⤵
  PID:2316
- C:\Windows\System\pWaNLWc.exe
  C:\Windows\System\pWaNLWc.exe
  2⤵
  PID:2264
- C:\Windows\System\AzeHfse.exe
  C:\Windows\System\AzeHfse.exe
  2⤵
  PID:2760
- C:\Windows\System\xxfkxxb.exe
  C:\Windows\System\xxfkxxb.exe
  2⤵
  PID:1284
- C:\Windows\System\HRRzwMN.exe
  C:\Windows\System\HRRzwMN.exe
  2⤵
  PID:2064
- C:\Windows\System\rFLmZMU.exe
  C:\Windows\System\rFLmZMU.exe
  2⤵
  PID:2088
- C:\Windows\System\QAvemYO.exe
  C:\Windows\System\QAvemYO.exe
  2⤵
  PID:1192
- C:\Windows\System\QSmPyqX.exe
  C:\Windows\System\QSmPyqX.exe
  2⤵
  PID:1160
- C:\Windows\System\WfxQsyi.exe
  C:\Windows\System\WfxQsyi.exe
  2⤵
  PID:612
- C:\Windows\System\TCdWuON.exe
  C:\Windows\System\TCdWuON.exe
  2⤵
  PID:1800
- C:\Windows\System\hwliEsR.exe
  C:\Windows\System\hwliEsR.exe
  2⤵
  PID:2044
- C:\Windows\System\dAcbzrF.exe
  C:\Windows\System\dAcbzrF.exe
  2⤵
  PID:2584
- C:\Windows\System\dkzBVZe.exe
  C:\Windows\System\dkzBVZe.exe
  2⤵
  PID:2796
- C:\Windows\System\nqsocgm.exe
  C:\Windows\System\nqsocgm.exe
  2⤵
  PID:2508
- C:\Windows\System\ExgvRPB.exe
  C:\Windows\System\ExgvRPB.exe
  2⤵
  PID:2020
- C:\Windows\System\upnizuO.exe
  C:\Windows\System\upnizuO.exe
  2⤵
  PID:1904
- C:\Windows\System\xJiAJWr.exe
  C:\Windows\System\xJiAJWr.exe
  2⤵
  PID:1708
- C:\Windows\System\JFLWwhN.exe
  C:\Windows\System\JFLWwhN.exe
  2⤵
  PID:1788
- C:\Windows\System\LTifZeE.exe
  C:\Windows\System\LTifZeE.exe
  2⤵
  PID:1760
- C:\Windows\System\XfSkuSw.exe
  C:\Windows\System\XfSkuSw.exe
  2⤵
  PID:1536
- C:\Windows\System\DjdDeGM.exe
  C:\Windows\System\DjdDeGM.exe
  2⤵
  PID:2664
- C:\Windows\System\WrGnmBC.exe
  C:\Windows\System\WrGnmBC.exe
  2⤵
  PID:776
- C:\Windows\System\cxAwETc.exe
  C:\Windows\System\cxAwETc.exe
  2⤵
  PID:2052
- C:\Windows\System\LDWwcNl.exe
  C:\Windows\System\LDWwcNl.exe
  2⤵
  PID:2108
- C:\Windows\System\sBeChpA.exe
  C:\Windows\System\sBeChpA.exe
  2⤵
  PID:576
- C:\Windows\System\wBWnNNq.exe
  C:\Windows\System\wBWnNNq.exe
  2⤵
  PID:2000
- C:\Windows\System\UuEfSfV.exe
  C:\Windows\System\UuEfSfV.exe
  2⤵
  PID:324
- C:\Windows\System\zrGQsVE.exe
  C:\Windows\System\zrGQsVE.exe
  2⤵
  PID:288
- C:\Windows\System\rmWBjJq.exe
  C:\Windows\System\rmWBjJq.exe
  2⤵
  PID:1272
- C:\Windows\System\OngLuOX.exe
  C:\Windows\System\OngLuOX.exe
  2⤵
  PID:1104
- C:\Windows\System\MtRuLnM.exe
  C:\Windows\System\MtRuLnM.exe
  2⤵
  PID:1692
- C:\Windows\System\cBhzIqk.exe
  C:\Windows\System\cBhzIqk.exe
  2⤵
  PID:848
- C:\Windows\System\KnizRNP.exe
  C:\Windows\System\KnizRNP.exe
  2⤵
  PID:2876
- C:\Windows\System\mlkkvGM.exe
  C:\Windows\System\mlkkvGM.exe
  2⤵
  PID:564
- C:\Windows\System\VQZxIbM.exe
  C:\Windows\System\VQZxIbM.exe
  2⤵
  PID:3088
- C:\Windows\System\abFAoDy.exe
  C:\Windows\System\abFAoDy.exe
  2⤵
  PID:3104
- C:\Windows\System\znnnTrj.exe
  C:\Windows\System\znnnTrj.exe
  2⤵
  PID:3120
- C:\Windows\System\LTumKdO.exe
  C:\Windows\System\LTumKdO.exe
  2⤵
  PID:3136
- C:\Windows\System\wAKujjo.exe
  C:\Windows\System\wAKujjo.exe
  2⤵
  PID:3152
- C:\Windows\System\oOSbSuN.exe
  C:\Windows\System\oOSbSuN.exe
  2⤵
  PID:3168
- C:\Windows\System\jGPilYR.exe
  C:\Windows\System\jGPilYR.exe
  2⤵
  PID:3188
- C:\Windows\System\QYbToNg.exe
  C:\Windows\System\QYbToNg.exe
  2⤵
  PID:3204
- C:\Windows\System\MvsXzDF.exe
  C:\Windows\System\MvsXzDF.exe
  2⤵
  PID:3220
- C:\Windows\System\pKttOFq.exe
  C:\Windows\System\pKttOFq.exe
  2⤵
  PID:3240
- C:\Windows\System\LeDzQpa.exe
  C:\Windows\System\LeDzQpa.exe
  2⤵
  PID:3256
- C:\Windows\System\EqbDGyx.exe
  C:\Windows\System\EqbDGyx.exe
  2⤵
  PID:3272
- C:\Windows\System\qxApjbB.exe
  C:\Windows\System\qxApjbB.exe
  2⤵
  PID:3288
- C:\Windows\System\pKUPbDT.exe
  C:\Windows\System\pKUPbDT.exe
  2⤵
  PID:3304
- C:\Windows\System\fFDyEMz.exe
  C:\Windows\System\fFDyEMz.exe
  2⤵
  PID:3320
- C:\Windows\System\KCsutmc.exe
  C:\Windows\System\KCsutmc.exe
  2⤵
  PID:3344
- C:\Windows\System\RaAgscE.exe
  C:\Windows\System\RaAgscE.exe
  2⤵
  PID:3360
- C:\Windows\System\WUKazuB.exe
  C:\Windows\System\WUKazuB.exe
  2⤵
  PID:3376
- C:\Windows\System\uGBJIfP.exe
  C:\Windows\System\uGBJIfP.exe
  2⤵
  PID:3392
- C:\Windows\System\gHYGcsS.exe
  C:\Windows\System\gHYGcsS.exe
  2⤵
  PID:3408
- C:\Windows\System\EZiWLdU.exe
  C:\Windows\System\EZiWLdU.exe
  2⤵
  PID:3428
- C:\Windows\System\CUfpUBf.exe
  C:\Windows\System\CUfpUBf.exe
  2⤵
  PID:3452
- C:\Windows\System\wdVXCFf.exe
  C:\Windows\System\wdVXCFf.exe
  2⤵
  PID:3468
- C:\Windows\System\RCmPovn.exe
  C:\Windows\System\RCmPovn.exe
  2⤵
  PID:3484
- C:\Windows\System\SvxsmkK.exe
  C:\Windows\System\SvxsmkK.exe
  2⤵
  PID:3500
- C:\Windows\System\zHnhWpt.exe
  C:\Windows\System\zHnhWpt.exe
  2⤵
  PID:3532
- C:\Windows\System\ceKgWKl.exe
  C:\Windows\System\ceKgWKl.exe
  2⤵
  PID:3552
- C:\Windows\System\FxAtTxO.exe
  C:\Windows\System\FxAtTxO.exe
  2⤵
  PID:3588
- C:\Windows\System\uAhjSos.exe
  C:\Windows\System\uAhjSos.exe
  2⤵
  PID:3640
- C:\Windows\System\WgOUdut.exe
  C:\Windows\System\WgOUdut.exe
  2⤵
  PID:3664
- C:\Windows\System\WWXZfaZ.exe
  C:\Windows\System\WWXZfaZ.exe
  2⤵
  PID:3700
- C:\Windows\System\xCwdXRl.exe
  C:\Windows\System\xCwdXRl.exe
  2⤵
  PID:3716
- C:\Windows\System\BKrDqvE.exe
  C:\Windows\System\BKrDqvE.exe
  2⤵
  PID:3732
- C:\Windows\System\nPMVlCR.exe
  C:\Windows\System\nPMVlCR.exe
  2⤵
  PID:3748
- C:\Windows\System\PHIKDtm.exe
  C:\Windows\System\PHIKDtm.exe
  2⤵
  PID:3768
- C:\Windows\System\wLSkNJC.exe
  C:\Windows\System\wLSkNJC.exe
  2⤵
  PID:3784
- C:\Windows\System\pfsVQrc.exe
  C:\Windows\System\pfsVQrc.exe
  2⤵
  PID:3800
- C:\Windows\System\rncCcCt.exe
  C:\Windows\System\rncCcCt.exe
  2⤵
  PID:3816
- C:\Windows\System\waRJJAq.exe
  C:\Windows\System\waRJJAq.exe
  2⤵
  PID:3832
- C:\Windows\System\TPtgXKr.exe
  C:\Windows\System\TPtgXKr.exe
  2⤵
  PID:3848
- C:\Windows\System\fnQglTE.exe
  C:\Windows\System\fnQglTE.exe
  2⤵
  PID:3868
- C:\Windows\System\uRfxHxE.exe
  C:\Windows\System\uRfxHxE.exe
  2⤵
  PID:3884
- C:\Windows\System\vaNqfbS.exe
  C:\Windows\System\vaNqfbS.exe
  2⤵
  PID:3900
- C:\Windows\System\kYGOapX.exe
  C:\Windows\System\kYGOapX.exe
  2⤵
  PID:3916
- C:\Windows\System\kKmewBw.exe
  C:\Windows\System\kKmewBw.exe
  2⤵
  PID:3932
- C:\Windows\System\bzEBtHu.exe
  C:\Windows\System\bzEBtHu.exe
  2⤵
  PID:3948
- C:\Windows\System\kuPHAHv.exe
  C:\Windows\System\kuPHAHv.exe
  2⤵
  PID:3964
- C:\Windows\System\qLWuHIJ.exe
  C:\Windows\System\qLWuHIJ.exe
  2⤵
  PID:3980
- C:\Windows\System\QovLeUk.exe
  C:\Windows\System\QovLeUk.exe
  2⤵
  PID:3996
- C:\Windows\System\DfunOWc.exe
  C:\Windows\System\DfunOWc.exe
  2⤵
  PID:4012
- C:\Windows\System\BjeXlhK.exe
  C:\Windows\System\BjeXlhK.exe
  2⤵
  PID:4028
- C:\Windows\System\HKQWUga.exe
  C:\Windows\System\HKQWUga.exe
  2⤵
  PID:4044
- C:\Windows\System\CQSIGEK.exe
  C:\Windows\System\CQSIGEK.exe
  2⤵
  PID:4060
- C:\Windows\System\xOcLHnZ.exe
  C:\Windows\System\xOcLHnZ.exe
  2⤵
  PID:4076
- C:\Windows\System\doKzHJK.exe
  C:\Windows\System\doKzHJK.exe
  2⤵
  PID:4092
- C:\Windows\System\wWipVxG.exe
  C:\Windows\System\wWipVxG.exe
  2⤵
  PID:3080
- C:\Windows\System\fvQjeND.exe
  C:\Windows\System\fvQjeND.exe
  2⤵
  PID:3112
- C:\Windows\System\PjoBCOx.exe
  C:\Windows\System\PjoBCOx.exe
  2⤵
  PID:2752
- C:\Windows\System\JxxagEu.exe
  C:\Windows\System\JxxagEu.exe
  2⤵
  PID:3144
- C:\Windows\System\dOlpcAB.exe
  C:\Windows\System\dOlpcAB.exe
  2⤵
  PID:3132
- C:\Windows\System\nDJjDAN.exe
  C:\Windows\System\nDJjDAN.exe
  2⤵
  PID:3176
- C:\Windows\System\KCawByX.exe
  C:\Windows\System\KCawByX.exe
  2⤵
  PID:3216
- C:\Windows\System\PIhcAmX.exe
  C:\Windows\System\PIhcAmX.exe
  2⤵
  PID:3280
- C:\Windows\System\XeGSYtb.exe
  C:\Windows\System\XeGSYtb.exe
  2⤵
  PID:3164
- C:\Windows\System\jJUEdkJ.exe
  C:\Windows\System\jJUEdkJ.exe
  2⤵
  PID:3300
- C:\Windows\System\CjhuHfx.exe
  C:\Windows\System\CjhuHfx.exe
  2⤵
  PID:3228
- C:\Windows\System\VasDJXc.exe
  C:\Windows\System\VasDJXc.exe
  2⤵
  PID:3336
- C:\Windows\System\tyWMAra.exe
  C:\Windows\System\tyWMAra.exe
  2⤵
  PID:3388
- C:\Windows\System\KenbzXI.exe
  C:\Windows\System\KenbzXI.exe
  2⤵
  PID:3400
- C:\Windows\System\ApeJGwu.exe
  C:\Windows\System\ApeJGwu.exe
  2⤵
  PID:3372
- C:\Windows\System\xHfFaLC.exe
  C:\Windows\System\xHfFaLC.exe
  2⤵
  PID:3460
- C:\Windows\System\ibZtEPO.exe
  C:\Windows\System\ibZtEPO.exe
  2⤵
  PID:3492
- C:\Windows\System\GNvyVqV.exe
  C:\Windows\System\GNvyVqV.exe
  2⤵
  PID:3496
- C:\Windows\System\mbPKbXi.exe
  C:\Windows\System\mbPKbXi.exe
  2⤵
  PID:3520
- C:\Windows\System\EIOmajX.exe
  C:\Windows\System\EIOmajX.exe
  2⤵
  PID:3560
- C:\Windows\System\UPBazuf.exe
  C:\Windows\System\UPBazuf.exe
  2⤵
  PID:3572
- C:\Windows\System\EMhwNkL.exe
  C:\Windows\System\EMhwNkL.exe
  2⤵
  PID:3584
- C:\Windows\System\JLwYAsH.exe
  C:\Windows\System\JLwYAsH.exe
  2⤵
  PID:3600
- C:\Windows\System\QTRglTV.exe
  C:\Windows\System\QTRglTV.exe
  2⤵
  PID:3628
- C:\Windows\System\PvMNtvS.exe
  C:\Windows\System\PvMNtvS.exe
  2⤵
  PID:3652
- C:\Windows\System\joTcHvP.exe
  C:\Windows\System\joTcHvP.exe
  2⤵
  PID:3676
- C:\Windows\System\MGdBLJI.exe
  C:\Windows\System\MGdBLJI.exe
  2⤵
  PID:2580
- C:\Windows\System\ygAKiFh.exe
  C:\Windows\System\ygAKiFh.exe
  2⤵
  PID:3728
- C:\Windows\System\lKrtlwM.exe
  C:\Windows\System\lKrtlwM.exe
  2⤵
  PID:3792
- C:\Windows\System\mllnOuU.exe
  C:\Windows\System\mllnOuU.exe
  2⤵
  PID:3708
- C:\Windows\System\NkSQqxa.exe
  C:\Windows\System\NkSQqxa.exe
  2⤵
  PID:3924
- C:\Windows\System\ojItQVl.exe
  C:\Windows\System\ojItQVl.exe
  2⤵
  PID:3992
- C:\Windows\System\bZdRTZv.exe
  C:\Windows\System\bZdRTZv.exe
  2⤵
  PID:3744
- C:\Windows\System\ADwZeaR.exe
  C:\Windows\System\ADwZeaR.exe
  2⤵
  PID:3840
- C:\Windows\System\LMtwwrA.exe
  C:\Windows\System\LMtwwrA.exe
  2⤵
  PID:3908
- C:\Windows\System\XNlUhKe.exe
  C:\Windows\System\XNlUhKe.exe
  2⤵
  PID:3972
- C:\Windows\System\ciNIyqR.exe
  C:\Windows\System\ciNIyqR.exe
  2⤵
  PID:4024
- C:\Windows\System\XptMZDn.exe
  C:\Windows\System\XptMZDn.exe
  2⤵
  PID:4084
- C:\Windows\System\nLHGNeV.exe
  C:\Windows\System\nLHGNeV.exe
  2⤵
  PID:2748
- C:\Windows\System\IPniEJU.exe
  C:\Windows\System\IPniEJU.exe
  2⤵
  PID:3076
- C:\Windows\System\eXXxRhJ.exe
  C:\Windows\System\eXXxRhJ.exe
  2⤵
  PID:3128
- C:\Windows\System\koHpQeb.exe
  C:\Windows\System\koHpQeb.exe
  2⤵
  PID:3180
- C:\Windows\System\KJfjQlX.exe
  C:\Windows\System\KJfjQlX.exe
  2⤵
  PID:2860
- C:\Windows\System\zdvKRYr.exe
  C:\Windows\System\zdvKRYr.exe
  2⤵
  PID:3312
- C:\Windows\System\HezlCRV.exe
  C:\Windows\System\HezlCRV.exe
  2⤵
  PID:3196
- C:\Windows\System\PtShYMe.exe
  C:\Windows\System\PtShYMe.exe
  2⤵
  PID:3384
- C:\Windows\System\oDaEdio.exe
  C:\Windows\System\oDaEdio.exe
  2⤵
  PID:3368
- C:\Windows\System\Nexpurw.exe
  C:\Windows\System\Nexpurw.exe
  2⤵
  PID:3476
- C:\Windows\System\LIavlGc.exe
  C:\Windows\System\LIavlGc.exe
  2⤵
  PID:3540
- C:\Windows\System\QUBNySI.exe
  C:\Windows\System\QUBNySI.exe
  2⤵
  PID:3056
- C:\Windows\System\APywloa.exe
  C:\Windows\System\APywloa.exe
  2⤵
  PID:1724
- C:\Windows\System\ocggCCR.exe
  C:\Windows\System\ocggCCR.exe
  2⤵
  PID:3636
- C:\Windows\System\UHozrph.exe
  C:\Windows\System\UHozrph.exe
  2⤵
  PID:3672
- C:\Windows\System\BeuKhsP.exe
  C:\Windows\System\BeuKhsP.exe
  2⤵
  PID:3760
- C:\Windows\System\uvgrGnX.exe
  C:\Windows\System\uvgrGnX.exe
  2⤵
  PID:3860
- C:\Windows\System\BoPVrUE.exe
  C:\Windows\System\BoPVrUE.exe
  2⤵
  PID:3960
- C:\Windows\System\goqLRyR.exe
  C:\Windows\System\goqLRyR.exe
  2⤵
  PID:3776
- C:\Windows\System\CLjCOJR.exe
  C:\Windows\System\CLjCOJR.exe
  2⤵
  PID:3940
- C:\Windows\System\oDnSZHn.exe
  C:\Windows\System\oDnSZHn.exe
  2⤵
  PID:4052
- C:\Windows\System\YqUgXSA.exe
  C:\Windows\System\YqUgXSA.exe
  2⤵
  PID:2536
- C:\Windows\System\ePVfDao.exe
  C:\Windows\System\ePVfDao.exe
  2⤵
  PID:4040
- C:\Windows\System\lLmIyOk.exe
  C:\Windows\System\lLmIyOk.exe
  2⤵
  PID:2448
- C:\Windows\System\WHBGHJS.exe
  C:\Windows\System\WHBGHJS.exe
  2⤵
  PID:3356
- C:\Windows\System\xlsCakY.exe
  C:\Windows\System\xlsCakY.exe
  2⤵
  PID:3436
- C:\Windows\System\gjTLaim.exe
  C:\Windows\System\gjTLaim.exe
  2⤵
  PID:3544
- C:\Windows\System\ACWOOjr.exe
  C:\Windows\System\ACWOOjr.exe
  2⤵
  PID:3612
- C:\Windows\System\bEXCZIZ.exe
  C:\Windows\System\bEXCZIZ.exe
  2⤵
  PID:2680
- C:\Windows\System\IQOcrwt.exe
  C:\Windows\System\IQOcrwt.exe
  2⤵
  PID:3828
- C:\Windows\System\TdeBzdd.exe
  C:\Windows\System\TdeBzdd.exe
  2⤵
  PID:3740
- C:\Windows\System\SZTkgNA.exe
  C:\Windows\System\SZTkgNA.exe
  2⤵
  PID:4004
- C:\Windows\System\JYDIWCf.exe
  C:\Windows\System\JYDIWCf.exe
  2⤵
  PID:2864
- C:\Windows\System\eKHprrE.exe
  C:\Windows\System\eKHprrE.exe
  2⤵
  PID:3352
- C:\Windows\System\XCeVzCM.exe
  C:\Windows\System\XCeVzCM.exe
  2⤵
  PID:4020
- C:\Windows\System\zPmxZtz.exe
  C:\Windows\System\zPmxZtz.exe
  2⤵
  PID:3296
- C:\Windows\System\rjassZy.exe
  C:\Windows\System\rjassZy.exe
  2⤵
  PID:3576
- C:\Windows\System\wSmLVsw.exe
  C:\Windows\System\wSmLVsw.exe
  2⤵
  PID:3660
- C:\Windows\System\OWxILVs.exe
  C:\Windows\System\OWxILVs.exe
  2⤵
  PID:2840
- C:\Windows\System\LwuiZVb.exe
  C:\Windows\System\LwuiZVb.exe
  2⤵
  PID:3232
- C:\Windows\System\mJQCOGg.exe
  C:\Windows\System\mJQCOGg.exe
  2⤵
  PID:2444
- C:\Windows\System\FrWegJE.exe
  C:\Windows\System\FrWegJE.exe
  2⤵
  PID:3892
- C:\Windows\System\RdowaHy.exe
  C:\Windows\System\RdowaHy.exe
  2⤵
  PID:1956
- C:\Windows\System\VVgFSQW.exe
  C:\Windows\System\VVgFSQW.exe
  2⤵
  PID:2956
- C:\Windows\System\bIPQTTa.exe
  C:\Windows\System\bIPQTTa.exe
  2⤵
  PID:1960
- C:\Windows\System\yyBKzPs.exe
  C:\Windows\System\yyBKzPs.exe
  2⤵
  PID:2440
- C:\Windows\System\rBKwZuq.exe
  C:\Windows\System\rBKwZuq.exe
  2⤵
  PID:1880
- C:\Windows\System\zSQUBKJ.exe
  C:\Windows\System\zSQUBKJ.exe
  2⤵
  PID:1988
- C:\Windows\System\blfLqBZ.exe
  C:\Windows\System\blfLqBZ.exe
  2⤵
  PID:4036
- C:\Windows\System\aOfdaqt.exe
  C:\Windows\System\aOfdaqt.exe
  2⤵
  PID:3928
- C:\Windows\System\dgBgDdH.exe
  C:\Windows\System\dgBgDdH.exe
  2⤵
  PID:4140
- C:\Windows\System\mAUmBqb.exe
  C:\Windows\System\mAUmBqb.exe
  2⤵
  PID:4160
- C:\Windows\System\DTAsRFj.exe
  C:\Windows\System\DTAsRFj.exe
  2⤵
  PID:4184
- C:\Windows\System\CJNfnJe.exe
  C:\Windows\System\CJNfnJe.exe
  2⤵
  PID:4212
- C:\Windows\System\ZEKCdkk.exe
  C:\Windows\System\ZEKCdkk.exe
  2⤵
  PID:4236
- C:\Windows\System\RnNaTpM.exe
  C:\Windows\System\RnNaTpM.exe
  2⤵
  PID:4256
- C:\Windows\System\fNdiUFq.exe
  C:\Windows\System\fNdiUFq.exe
  2⤵
  PID:4280
- C:\Windows\System\uLmCHkg.exe
  C:\Windows\System\uLmCHkg.exe
  2⤵
  PID:4300
- C:\Windows\System\xzETfNH.exe
  C:\Windows\System\xzETfNH.exe
  2⤵
  PID:4316
- C:\Windows\System\tRmxScx.exe
  C:\Windows\System\tRmxScx.exe
  2⤵
  PID:4332
- C:\Windows\System\cwpzhGd.exe
  C:\Windows\System\cwpzhGd.exe
  2⤵
  PID:4352
- C:\Windows\System\tbWgdPL.exe
  C:\Windows\System\tbWgdPL.exe
  2⤵
  PID:4368
- C:\Windows\System\xcddNTB.exe
  C:\Windows\System\xcddNTB.exe
  2⤵
  PID:4384
- C:\Windows\System\ElRZVje.exe
  C:\Windows\System\ElRZVje.exe
  2⤵
  PID:4404
- C:\Windows\System\awcvqtC.exe
  C:\Windows\System\awcvqtC.exe
  2⤵
  PID:4424
- C:\Windows\System\sCnyOAg.exe
  C:\Windows\System\sCnyOAg.exe
  2⤵
  PID:4444
- C:\Windows\System\OqjCNGc.exe
  C:\Windows\System\OqjCNGc.exe
  2⤵
  PID:4472
- C:\Windows\System\JTDlDZL.exe
  C:\Windows\System\JTDlDZL.exe
  2⤵
  PID:4496
- C:\Windows\System\xuiZImB.exe
  C:\Windows\System\xuiZImB.exe
  2⤵
  PID:4532
- C:\Windows\System\bWIewQv.exe
  C:\Windows\System\bWIewQv.exe
  2⤵
  PID:4560
- C:\Windows\System\JzwdOxp.exe
  C:\Windows\System\JzwdOxp.exe
  2⤵
  PID:4580
- C:\Windows\System\YHGujbv.exe
  C:\Windows\System\YHGujbv.exe
  2⤵
  PID:4596
- C:\Windows\System\aMiZbmw.exe
  C:\Windows\System\aMiZbmw.exe
  2⤵
  PID:4616
- C:\Windows\System\kkAvohu.exe
  C:\Windows\System\kkAvohu.exe
  2⤵
  PID:4640
- C:\Windows\System\TUsaWlk.exe
  C:\Windows\System\TUsaWlk.exe
  2⤵
  PID:4660
- C:\Windows\System\mjelAEB.exe
  C:\Windows\System\mjelAEB.exe
  2⤵
  PID:4680
- C:\Windows\System\hcjYZsT.exe
  C:\Windows\System\hcjYZsT.exe
  2⤵
  PID:4700
- C:\Windows\System\OOUqoTg.exe
  C:\Windows\System\OOUqoTg.exe
  2⤵
  PID:4720
- C:\Windows\System\BsduBpp.exe
  C:\Windows\System\BsduBpp.exe
  2⤵
  PID:4748
- C:\Windows\System\eSHbchQ.exe
  C:\Windows\System\eSHbchQ.exe
  2⤵
  PID:4768
- C:\Windows\System\oNjMQgZ.exe
  C:\Windows\System\oNjMQgZ.exe
  2⤵
  PID:4788
- C:\Windows\System\JxSxCFf.exe
  C:\Windows\System\JxSxCFf.exe
  2⤵
  PID:4804
- C:\Windows\System\WcTIgJg.exe
  C:\Windows\System\WcTIgJg.exe
  2⤵
  PID:4820
- C:\Windows\System\LDGbPxs.exe
  C:\Windows\System\LDGbPxs.exe
  2⤵
  PID:4836
- C:\Windows\System\heRJGqo.exe
  C:\Windows\System\heRJGqo.exe
  2⤵
  PID:4852
- C:\Windows\System\WxLKHFg.exe
  C:\Windows\System\WxLKHFg.exe
  2⤵
  PID:4868
- C:\Windows\System\TdyUBYy.exe
  C:\Windows\System\TdyUBYy.exe
  2⤵
  PID:4884
- C:\Windows\System\PKaBkWQ.exe
  C:\Windows\System\PKaBkWQ.exe
  2⤵
  PID:4900
- C:\Windows\System\sONzvnN.exe
  C:\Windows\System\sONzvnN.exe
  2⤵
  PID:4916
- C:\Windows\System\yHpcMHY.exe
  C:\Windows\System\yHpcMHY.exe
  2⤵
  PID:4932
- C:\Windows\System\JzhJGlJ.exe
  C:\Windows\System\JzhJGlJ.exe
  2⤵
  PID:4948
- C:\Windows\System\nTkrGwr.exe
  C:\Windows\System\nTkrGwr.exe
  2⤵
  PID:4964
- C:\Windows\System\UvzcXQM.exe
  C:\Windows\System\UvzcXQM.exe
  2⤵
  PID:4980
- C:\Windows\System\PzfvJzH.exe
  C:\Windows\System\PzfvJzH.exe
  2⤵
  PID:4996
- C:\Windows\System\zTBkeGa.exe
  C:\Windows\System\zTBkeGa.exe
  2⤵
  PID:5012
- C:\Windows\System\hXuVwJC.exe
  C:\Windows\System\hXuVwJC.exe
  2⤵
  PID:5028
- C:\Windows\System\nEymeZZ.exe
  C:\Windows\System\nEymeZZ.exe
  2⤵
  PID:5072
- C:\Windows\System\DxsEvUb.exe
  C:\Windows\System\DxsEvUb.exe
  2⤵
  PID:5104
- C:\Windows\System\EpDBYER.exe
  C:\Windows\System\EpDBYER.exe
  2⤵
  PID:3824
- C:\Windows\System\xTmlWKB.exe
  C:\Windows\System\xTmlWKB.exe
  2⤵
  PID:4104
- C:\Windows\System\YuULPZP.exe
  C:\Windows\System\YuULPZP.exe
  2⤵
  PID:4124
- C:\Windows\System\yRFgczr.exe
  C:\Windows\System\yRFgczr.exe
  2⤵
  PID:4136
- C:\Windows\System\sgbXZbS.exe
  C:\Windows\System\sgbXZbS.exe
  2⤵
  PID:4156
- C:\Windows\System\NRqNwBm.exe
  C:\Windows\System\NRqNwBm.exe
  2⤵
  PID:4180
- C:\Windows\System\yHqWanz.exe
  C:\Windows\System\yHqWanz.exe
  2⤵
  PID:4204
- C:\Windows\System\fjVlNfT.exe
  C:\Windows\System\fjVlNfT.exe
  2⤵
  PID:4228
- C:\Windows\System\jwVceUG.exe
  C:\Windows\System\jwVceUG.exe
  2⤵
  PID:4248
- C:\Windows\System\bmQuPyv.exe
  C:\Windows\System\bmQuPyv.exe
  2⤵
  PID:4268
- C:\Windows\System\BVpWAoB.exe
  C:\Windows\System\BVpWAoB.exe
  2⤵
  PID:4296
- C:\Windows\System\sLOfuRg.exe
  C:\Windows\System\sLOfuRg.exe
  2⤵
  PID:4328
- C:\Windows\System\zNnxjmK.exe
  C:\Windows\System\zNnxjmK.exe
  2⤵
  PID:4360
- C:\Windows\System\OoLdDij.exe
  C:\Windows\System\OoLdDij.exe
  2⤵
  PID:4392
- C:\Windows\System\fKGBMNk.exe
  C:\Windows\System\fKGBMNk.exe
  2⤵
  PID:4416
- C:\Windows\System\mMQpMNi.exe
  C:\Windows\System\mMQpMNi.exe
  2⤵
  PID:4436
- C:\Windows\System\iFXHUFf.exe
  C:\Windows\System\iFXHUFf.exe
  2⤵
  PID:4464
- C:\Windows\System\EZxqYMI.exe
  C:\Windows\System\EZxqYMI.exe
  2⤵
  PID:2520
- C:\Windows\System\qchQIfU.exe
  C:\Windows\System\qchQIfU.exe
  2⤵
  PID:4504
- C:\Windows\System\vCSZmGu.exe
  C:\Windows\System\vCSZmGu.exe
  2⤵
  PID:4524
- C:\Windows\System\UHUBOYp.exe
  C:\Windows\System\UHUBOYp.exe
  2⤵
  PID:4544
- C:\Windows\System\oaWVqqa.exe
  C:\Windows\System\oaWVqqa.exe
  2⤵
  PID:4568
- C:\Windows\System\uVDuKgL.exe
  C:\Windows\System\uVDuKgL.exe
  2⤵
  PID:4592
- C:\Windows\System\rknVxXM.exe
  C:\Windows\System\rknVxXM.exe
  2⤵
  PID:4624
- C:\Windows\System\QuJCCbZ.exe
  C:\Windows\System\QuJCCbZ.exe
  2⤵
  PID:4648
- C:\Windows\System\DhconZi.exe
  C:\Windows\System\DhconZi.exe
  2⤵
  PID:4672
- C:\Windows\System\kHxIcfi.exe
  C:\Windows\System\kHxIcfi.exe
  2⤵
  PID:4696
- C:\Windows\System\IKAwvmi.exe
  C:\Windows\System\IKAwvmi.exe
  2⤵
  PID:4728
- C:\Windows\System\AYUWUMG.exe
  C:\Windows\System\AYUWUMG.exe
  2⤵
  PID:4756
- C:\Windows\System\ZsDHkew.exe
  C:\Windows\System\ZsDHkew.exe
  2⤵
  PID:4780
- C:\Windows\System\fPbPLMM.exe
  C:\Windows\System\fPbPLMM.exe
  2⤵
  PID:4832
- C:\Windows\System\yHNILvl.exe
  C:\Windows\System\yHNILvl.exe
  2⤵
  PID:4896
- C:\Windows\System\DesMjZK.exe
  C:\Windows\System\DesMjZK.exe
  2⤵
  PID:4928
- C:\Windows\System\MwhBKXZ.exe
  C:\Windows\System\MwhBKXZ.exe
  2⤵
  PID:4992
- C:\Windows\System\gDrcCJt.exe
  C:\Windows\System\gDrcCJt.exe
  2⤵
  PID:4876
- C:\Windows\System\cfWTdaO.exe
  C:\Windows\System\cfWTdaO.exe
  2⤵
  PID:5024
- C:\Windows\System\gmcPDwf.exe
  C:\Windows\System\gmcPDwf.exe
  2⤵
  PID:5008
- C:\Windows\System\GcuzgTr.exe
  C:\Windows\System\GcuzgTr.exe
  2⤵
  PID:5036
- C:\Windows\System\rjNcpZy.exe
  C:\Windows\System\rjNcpZy.exe
  2⤵
  PID:5096
- C:\Windows\System\VIBQVCq.exe
  C:\Windows\System\VIBQVCq.exe
  2⤵
  PID:4108
- C:\Windows\System\AETSOlM.exe
  C:\Windows\System\AETSOlM.exe
  2⤵
  PID:4200
- C:\Windows\System\HTmXVWo.exe
  C:\Windows\System\HTmXVWo.exe
  2⤵
  PID:4312
- C:\Windows\System\vANEjLE.exe
  C:\Windows\System\vANEjLE.exe
  2⤵
  PID:4420
- C:\Windows\System\ELGhMlF.exe
  C:\Windows\System\ELGhMlF.exe
  2⤵
  PID:4480
- C:\Windows\System\xjUsvtC.exe
  C:\Windows\System\xjUsvtC.exe
  2⤵
  PID:4120
- C:\Windows\System\DmIAuIR.exe
  C:\Windows\System\DmIAuIR.exe
  2⤵
  PID:4608
- C:\Windows\System\PsRfKch.exe
  C:\Windows\System\PsRfKch.exe
  2⤵
  PID:4612
- C:\Windows\System\ynxAqBG.exe
  C:\Windows\System\ynxAqBG.exe
  2⤵
  PID:4196
- C:\Windows\System\vpmCWNC.exe
  C:\Windows\System\vpmCWNC.exe
  2⤵
  PID:1944
- C:\Windows\System\aNEHgOU.exe
  C:\Windows\System\aNEHgOU.exe
  2⤵
  PID:4292
- C:\Windows\System\OxUpNjx.exe
  C:\Windows\System\OxUpNjx.exe
  2⤵
  PID:4452
- C:\Windows\System\BMHIZpg.exe
  C:\Windows\System\BMHIZpg.exe
  2⤵
  PID:4492
- C:\Windows\System\mZRWkRi.exe
  C:\Windows\System\mZRWkRi.exe
  2⤵
  PID:4628
- C:\Windows\System\WUUCUgk.exe
  C:\Windows\System\WUUCUgk.exe
  2⤵
  PID:4732
- C:\Windows\System\kSFHTcp.exe
  C:\Windows\System\kSFHTcp.exe
  2⤵
  PID:4960
- C:\Windows\System\tDmVniF.exe
  C:\Windows\System\tDmVniF.exe
  2⤵
  PID:4972
- C:\Windows\System\tPYVHdf.exe
  C:\Windows\System\tPYVHdf.exe
  2⤵
  PID:3052
- C:\Windows\System\ESJjfhV.exe
  C:\Windows\System\ESJjfhV.exe
  2⤵
  PID:4880
- C:\Windows\System\BngbnSi.exe
  C:\Windows\System\BngbnSi.exe
  2⤵
  PID:4716
- C:\Windows\System\yJGKRqx.exe
  C:\Windows\System\yJGKRqx.exe
  2⤵
  PID:4288
- C:\Windows\System\GZoChef.exe
  C:\Windows\System\GZoChef.exe
  2⤵
  PID:4816
- C:\Windows\System\MFuHSGI.exe
  C:\Windows\System\MFuHSGI.exe
  2⤵
  PID:4116
- C:\Windows\System\DRFTrgQ.exe
  C:\Windows\System\DRFTrgQ.exe
  2⤵
  PID:5080
- C:\Windows\System\avYuGMb.exe
  C:\Windows\System\avYuGMb.exe
  2⤵
  PID:4172
- C:\Windows\System\QUYdngg.exe
  C:\Windows\System\QUYdngg.exe
  2⤵
  PID:4688
- C:\Windows\System\GViUeSx.exe
  C:\Windows\System\GViUeSx.exe
  2⤵
  PID:4828
- C:\Windows\System\FhTupmL.exe
  C:\Windows\System\FhTupmL.exe
  2⤵
  PID:3696
- C:\Windows\System\RsmBRca.exe
  C:\Windows\System\RsmBRca.exe
  2⤵
  PID:4892
- C:\Windows\System\VPFJQYS.exe
  C:\Windows\System\VPFJQYS.exe
  2⤵
  PID:4784
- C:\Windows\System\jXjIeqL.exe
  C:\Windows\System\jXjIeqL.exe
  2⤵
  PID:4484
- C:\Windows\System\MLfJacP.exe
  C:\Windows\System\MLfJacP.exe
  2⤵
  PID:4912
- C:\Windows\System\HiyMzMn.exe
  C:\Windows\System\HiyMzMn.exe
  2⤵
  PID:4572
- C:\Windows\System\yeXNQPR.exe
  C:\Windows\System\yeXNQPR.exe
  2⤵
  PID:5136
- C:\Windows\System\LdIuZEK.exe
  C:\Windows\System\LdIuZEK.exe
  2⤵
  PID:5152
- C:\Windows\System\bivUrEP.exe
  C:\Windows\System\bivUrEP.exe
  2⤵
  PID:5168
- C:\Windows\System\igYQbcD.exe
  C:\Windows\System\igYQbcD.exe
  2⤵
  PID:5184
- C:\Windows\System\mCCMdeX.exe
  C:\Windows\System\mCCMdeX.exe
  2⤵
  PID:5200
- C:\Windows\System\VprSgrT.exe
  C:\Windows\System\VprSgrT.exe
  2⤵
  PID:5216
- C:\Windows\System\GUXeilM.exe
  C:\Windows\System\GUXeilM.exe
  2⤵
  PID:5232
- C:\Windows\System\xWgfJjk.exe
  C:\Windows\System\xWgfJjk.exe
  2⤵
  PID:5248
- C:\Windows\System\IlSkXaL.exe
  C:\Windows\System\IlSkXaL.exe
  2⤵
  PID:5264
- C:\Windows\System\sYseryq.exe
  C:\Windows\System\sYseryq.exe
  2⤵
  PID:5280
- C:\Windows\System\dNmRmDl.exe
  C:\Windows\System\dNmRmDl.exe
  2⤵
  PID:5296
- C:\Windows\System\MDxDjJu.exe
  C:\Windows\System\MDxDjJu.exe
  2⤵
  PID:5312
- C:\Windows\System\cYhrPDr.exe
  C:\Windows\System\cYhrPDr.exe
  2⤵
  PID:5332
- C:\Windows\System\bwoRPEP.exe
  C:\Windows\System\bwoRPEP.exe
  2⤵
  PID:5348
- C:\Windows\System\bFjdQbm.exe
  C:\Windows\System\bFjdQbm.exe
  2⤵
  PID:5364
- C:\Windows\System\qurTYxZ.exe
  C:\Windows\System\qurTYxZ.exe
  2⤵
  PID:5380
- C:\Windows\System\iXXqWCb.exe
  C:\Windows\System\iXXqWCb.exe
  2⤵
  PID:5396
- C:\Windows\System\viQhzmQ.exe
  C:\Windows\System\viQhzmQ.exe
  2⤵
  PID:5412
- C:\Windows\System\FnbFROu.exe
  C:\Windows\System\FnbFROu.exe
  2⤵
  PID:5428
- C:\Windows\System\TnrOkvt.exe
  C:\Windows\System\TnrOkvt.exe
  2⤵
  PID:5444
- C:\Windows\System\xiaAzFN.exe
  C:\Windows\System\xiaAzFN.exe
  2⤵
  PID:5460
- C:\Windows\System\KENitFF.exe
  C:\Windows\System\KENitFF.exe
  2⤵
  PID:5476
- C:\Windows\System\CrRlkzb.exe
  C:\Windows\System\CrRlkzb.exe
  2⤵
  PID:5492
- C:\Windows\System\SRPVchj.exe
  C:\Windows\System\SRPVchj.exe
  2⤵
  PID:5508
- C:\Windows\System\EtfuTmH.exe
  C:\Windows\System\EtfuTmH.exe
  2⤵
  PID:5524
- C:\Windows\System\JWXzQBr.exe
  C:\Windows\System\JWXzQBr.exe
  2⤵
  PID:5540
- C:\Windows\System\rTJUThw.exe
  C:\Windows\System\rTJUThw.exe
  2⤵
  PID:5556
- C:\Windows\System\pPRdFKE.exe
  C:\Windows\System\pPRdFKE.exe
  2⤵
  PID:5572
- C:\Windows\System\uifAEzp.exe
  C:\Windows\System\uifAEzp.exe
  2⤵
  PID:5588
- C:\Windows\System\gRMhPFO.exe
  C:\Windows\System\gRMhPFO.exe
  2⤵
  PID:5604
- C:\Windows\System\CvsJokV.exe
  C:\Windows\System\CvsJokV.exe
  2⤵
  PID:5620
- C:\Windows\System\gFKQbQi.exe
  C:\Windows\System\gFKQbQi.exe
  2⤵
  PID:5636
- C:\Windows\System\MoPXnrO.exe
  C:\Windows\System\MoPXnrO.exe
  2⤵
  PID:5652
- C:\Windows\System\KpuEvgj.exe
  C:\Windows\System\KpuEvgj.exe
  2⤵
  PID:5668
- C:\Windows\System\AVXBsvT.exe
  C:\Windows\System\AVXBsvT.exe
  2⤵
  PID:5684
- C:\Windows\System\uckInxi.exe
  C:\Windows\System\uckInxi.exe
  2⤵
  PID:5700
- C:\Windows\System\LLPYpoL.exe
  C:\Windows\System\LLPYpoL.exe
  2⤵
  PID:5716
- C:\Windows\System\kVvJlQV.exe
  C:\Windows\System\kVvJlQV.exe
  2⤵
  PID:5732
- C:\Windows\System\tFqpYcZ.exe
  C:\Windows\System\tFqpYcZ.exe
  2⤵
  PID:5748
- C:\Windows\System\WPamxxj.exe
  C:\Windows\System\WPamxxj.exe
  2⤵
  PID:5764
- C:\Windows\System\hBWxmfr.exe
  C:\Windows\System\hBWxmfr.exe
  2⤵
  PID:5780
- C:\Windows\System\jZxyZmx.exe
  C:\Windows\System\jZxyZmx.exe
  2⤵
  PID:5796
- C:\Windows\System\LHwCOeO.exe
  C:\Windows\System\LHwCOeO.exe
  2⤵
  PID:5812
- C:\Windows\System\fTkThHf.exe
  C:\Windows\System\fTkThHf.exe
  2⤵
  PID:5828
- C:\Windows\System\sPwYLqi.exe
  C:\Windows\System\sPwYLqi.exe
  2⤵
  PID:5844
- C:\Windows\System\lyzErDr.exe
  C:\Windows\System\lyzErDr.exe
  2⤵
  PID:5860
- C:\Windows\System\HUzxIRq.exe
  C:\Windows\System\HUzxIRq.exe
  2⤵
  PID:5876
- C:\Windows\System\fZiIZUf.exe
  C:\Windows\System\fZiIZUf.exe
  2⤵
  PID:5892
- C:\Windows\System\mfFxrPE.exe
  C:\Windows\System\mfFxrPE.exe
  2⤵
  PID:5908
- C:\Windows\System\QKFmEyU.exe
  C:\Windows\System\QKFmEyU.exe
  2⤵
  PID:5924
- C:\Windows\System\BuGytiM.exe
  C:\Windows\System\BuGytiM.exe
  2⤵
  PID:5940
- C:\Windows\System\JCxJWcN.exe
  C:\Windows\System\JCxJWcN.exe
  2⤵
  PID:5956
- C:\Windows\System\CWCmUXS.exe
  C:\Windows\System\CWCmUXS.exe
  2⤵
  PID:5972
- C:\Windows\System\XaUWeQU.exe
  C:\Windows\System\XaUWeQU.exe
  2⤵
  PID:5988
- C:\Windows\System\NtDqImA.exe
  C:\Windows\System\NtDqImA.exe
  2⤵
  PID:6004
- C:\Windows\System\jqPmioP.exe
  C:\Windows\System\jqPmioP.exe
  2⤵
  PID:6020
- C:\Windows\System\JzbpMun.exe
  C:\Windows\System\JzbpMun.exe
  2⤵
  PID:6036
- C:\Windows\System\oImdfez.exe
  C:\Windows\System\oImdfez.exe
  2⤵
  PID:6052
- C:\Windows\System\yHESYBO.exe
  C:\Windows\System\yHESYBO.exe
  2⤵
  PID:6068
- C:\Windows\System\EaLbHqb.exe
  C:\Windows\System\EaLbHqb.exe
  2⤵
  PID:6084
- C:\Windows\System\owdlLxn.exe
  C:\Windows\System\owdlLxn.exe
  2⤵
  PID:6100
- C:\Windows\System\NPNYCAs.exe
  C:\Windows\System\NPNYCAs.exe
  2⤵
  PID:6116
- C:\Windows\System\YgTWmZA.exe
  C:\Windows\System\YgTWmZA.exe
  2⤵
  PID:6132
- C:\Windows\System\hibdxtg.exe
  C:\Windows\System\hibdxtg.exe
  2⤵
  PID:5116
- C:\Windows\System\EfNypcz.exe
  C:\Windows\System\EfNypcz.exe
  2⤵
  PID:5144
- C:\Windows\System\lKHMeiC.exe
  C:\Windows\System\lKHMeiC.exe
  2⤵
  PID:5212
- C:\Windows\System\gCCYtAE.exe
  C:\Windows\System\gCCYtAE.exe
  2⤵
  PID:5272
- C:\Windows\System\YFyOHIm.exe
  C:\Windows\System\YFyOHIm.exe
  2⤵
  PID:5308
- C:\Windows\System\bVhSDRu.exe
  C:\Windows\System\bVhSDRu.exe
  2⤵
  PID:5376
- C:\Windows\System\kSVUeim.exe
  C:\Windows\System\kSVUeim.exe
  2⤵
  PID:5440
- C:\Windows\System\PvcRkot.exe
  C:\Windows\System\PvcRkot.exe
  2⤵
  PID:5504
- C:\Windows\System\WrfkfRL.exe
  C:\Windows\System\WrfkfRL.exe
  2⤵
  PID:5564
- C:\Windows\System\eIyZzpJ.exe
  C:\Windows\System\eIyZzpJ.exe
  2⤵
  PID:5628
- C:\Windows\System\ykbvuQm.exe
  C:\Windows\System\ykbvuQm.exe
  2⤵
  PID:2552
- C:\Windows\System\kBZSiEw.exe
  C:\Windows\System\kBZSiEw.exe
  2⤵
  PID:5696
- C:\Windows\System\czlGrqo.exe
  C:\Windows\System\czlGrqo.exe
  2⤵
  PID:5724
- C:\Windows\System\GuKIQmn.exe
  C:\Windows\System\GuKIQmn.exe
  2⤵
  PID:5324
- C:\Windows\System\JiYpjUU.exe
  C:\Windows\System\JiYpjUU.exe
  2⤵
  PID:5760
- C:\Windows\System\XMDfWaF.exe
  C:\Windows\System\XMDfWaF.exe
  2⤵
  PID:5824
- C:\Windows\System\ynSELTw.exe
  C:\Windows\System\ynSELTw.exe
  2⤵
  PID:5712
- C:\Windows\System\WxEVYKv.exe
  C:\Windows\System\WxEVYKv.exe
  2⤵
  PID:5756
- C:\Windows\System\eylygmx.exe
  C:\Windows\System\eylygmx.exe
  2⤵
  PID:5900
- C:\Windows\System\WtDoLtr.exe
  C:\Windows\System\WtDoLtr.exe
  2⤵
  PID:5852
- C:\Windows\System\YVDyeIk.exe
  C:\Windows\System\YVDyeIk.exe
  2⤵
  PID:5948
- C:\Windows\System\PLhhYzt.exe
  C:\Windows\System\PLhhYzt.exe
  2⤵
  PID:5568
- C:\Windows\System\TNTydOA.exe
  C:\Windows\System\TNTydOA.exe
  2⤵
  PID:5580
- C:\Windows\System\ENQBqqr.exe
  C:\Windows\System\ENQBqqr.exe
  2⤵
  PID:5128
- C:\Windows\System\BkqayIY.exe
  C:\Windows\System\BkqayIY.exe
  2⤵
  PID:5360
- C:\Windows\System\hmTTfjP.exe
  C:\Windows\System\hmTTfjP.exe
  2⤵
  PID:5584
- C:\Windows\System\qfcUhSj.exe
  C:\Windows\System\qfcUhSj.exe
  2⤵
  PID:5680
- C:\Windows\System\pcBzHHV.exe
  C:\Windows\System\pcBzHHV.exe
  2⤵
  PID:6160
- C:\Windows\System\Wstkdyo.exe
  C:\Windows\System\Wstkdyo.exe
  2⤵
  PID:6180
- C:\Windows\System\mOWXcQN.exe
  C:\Windows\System\mOWXcQN.exe
  2⤵
  PID:6196
- C:\Windows\System\kJmOmHo.exe
  C:\Windows\System\kJmOmHo.exe
  2⤵
  PID:6212
- C:\Windows\System\FEjqBlA.exe
  C:\Windows\System\FEjqBlA.exe
  2⤵
  PID:6228
- C:\Windows\System\NfFYWWP.exe
  C:\Windows\System\NfFYWWP.exe
  2⤵
  PID:6248
- C:\Windows\System\jgwAwxM.exe
  C:\Windows\System\jgwAwxM.exe
  2⤵
  PID:6264
- C:\Windows\System\yIfjPEm.exe
  C:\Windows\System\yIfjPEm.exe
  2⤵
  PID:6340
- C:\Windows\System\IgfYjya.exe
  C:\Windows\System\IgfYjya.exe
  2⤵
  PID:6356
- C:\Windows\System\GBCkvba.exe
  C:\Windows\System\GBCkvba.exe
  2⤵
  PID:6376
- C:\Windows\System\tcvIjak.exe
  C:\Windows\System\tcvIjak.exe
  2⤵
  PID:6396
- C:\Windows\System\UjGeyzH.exe
  C:\Windows\System\UjGeyzH.exe
  2⤵
  PID:6416
- C:\Windows\System\QgPCdJs.exe
  C:\Windows\System\QgPCdJs.exe
  2⤵
  PID:6436
- C:\Windows\System\jwmwwPT.exe
  C:\Windows\System\jwmwwPT.exe
  2⤵
  PID:6452
- C:\Windows\System\GeeDuRC.exe
  C:\Windows\System\GeeDuRC.exe
  2⤵
  PID:6472
- C:\Windows\System\AFhIdmp.exe
  C:\Windows\System\AFhIdmp.exe
  2⤵
  PID:6488
- C:\Windows\System\aJXiEut.exe
  C:\Windows\System\aJXiEut.exe
  2⤵
  PID:6512
- C:\Windows\System\nCyEibU.exe
  C:\Windows\System\nCyEibU.exe
  2⤵
  PID:6528
- C:\Windows\System\YrPvvgh.exe
  C:\Windows\System\YrPvvgh.exe
  2⤵
  PID:6548
- C:\Windows\System\kLUOolc.exe
  C:\Windows\System\kLUOolc.exe
  2⤵
  PID:6564
- C:\Windows\System\rUBugqa.exe
  C:\Windows\System\rUBugqa.exe
  2⤵
  PID:6580
- C:\Windows\System\vmLxxPw.exe
  C:\Windows\System\vmLxxPw.exe
  2⤵
  PID:6600
- C:\Windows\System\RQELkGn.exe
  C:\Windows\System\RQELkGn.exe
  2⤵
  PID:6624
- C:\Windows\System\KlhVNDY.exe
  C:\Windows\System\KlhVNDY.exe
  2⤵
  PID:6936
- C:\Windows\System\UbCRWHF.exe
  C:\Windows\System\UbCRWHF.exe
  2⤵
  PID:6952
- C:\Windows\System\AoLgjaL.exe
  C:\Windows\System\AoLgjaL.exe
  2⤵
  PID:6972
- C:\Windows\System\meSKkFE.exe
  C:\Windows\System\meSKkFE.exe
  2⤵
  PID:6992
- C:\Windows\System\OFggxBU.exe
  C:\Windows\System\OFggxBU.exe
  2⤵
  PID:7008
- C:\Windows\System\OHqZtsN.exe
  C:\Windows\System\OHqZtsN.exe
  2⤵
  PID:7028
- C:\Windows\System\aCjnoNF.exe
  C:\Windows\System\aCjnoNF.exe
  2⤵
  PID:7044
- C:\Windows\System\JwsRcBd.exe
  C:\Windows\System\JwsRcBd.exe
  2⤵
  PID:7068
- C:\Windows\System\PNSDWts.exe
  C:\Windows\System\PNSDWts.exe
  2⤵
  PID:7088
- C:\Windows\System\ukyBUKo.exe
  C:\Windows\System\ukyBUKo.exe
  2⤵
  PID:7104
- C:\Windows\System\tbVMKRt.exe
  C:\Windows\System\tbVMKRt.exe
  2⤵
  PID:7120
- C:\Windows\System\vIkZMYo.exe
  C:\Windows\System\vIkZMYo.exe
  2⤵
  PID:7136
- C:\Windows\System\qmfmbWm.exe
  C:\Windows\System\qmfmbWm.exe
  2⤵
  PID:7156
- C:\Windows\System\VXWUzyW.exe
  C:\Windows\System\VXWUzyW.exe
  2⤵
  PID:6092
- C:\Windows\System\HEpjjyM.exe
  C:\Windows\System\HEpjjyM.exe
  2⤵
  PID:6172
- C:\Windows\System\BsFNsff.exe
  C:\Windows\System\BsFNsff.exe
  2⤵
  PID:3624
- C:\Windows\System\OhPsFrw.exe
  C:\Windows\System\OhPsFrw.exe
  2⤵
  PID:6272
- C:\Windows\System\aJvMgrr.exe
  C:\Windows\System\aJvMgrr.exe
  2⤵
  PID:6032
- C:\Windows\System\uumOlDJ.exe
  C:\Windows\System\uumOlDJ.exe
  2⤵
  PID:5792
- C:\Windows\System\QznLnrR.exe
  C:\Windows\System\QznLnrR.exe
  2⤵
  PID:6308
- C:\Windows\System\dwsTaPz.exe
  C:\Windows\System\dwsTaPz.exe
  2⤵
  PID:5692
- C:\Windows\System\AZKUUuv.exe
  C:\Windows\System\AZKUUuv.exe
  2⤵
  PID:6316
- C:\Windows\System\AYzqaez.exe
  C:\Windows\System\AYzqaez.exe
  2⤵
  PID:6332
- C:\Windows\System\ebhcBNS.exe
  C:\Windows\System\ebhcBNS.exe
  2⤵
  PID:5904
- C:\Windows\System\bthklvL.exe
  C:\Windows\System\bthklvL.exe
  2⤵
  PID:6364
- C:\Windows\System\BTeWsoa.exe
  C:\Windows\System\BTeWsoa.exe
  2⤵
  PID:6408
- C:\Windows\System\zWNwpwr.exe
  C:\Windows\System\zWNwpwr.exe
  2⤵
  PID:6480
- C:\Windows\System\xnkWhib.exe
  C:\Windows\System\xnkWhib.exe
  2⤵
  PID:5472
- C:\Windows\System\ZYGLFUO.exe
  C:\Windows\System\ZYGLFUO.exe
  2⤵
  PID:5344
- C:\Windows\System\BRBfqBE.exe
  C:\Windows\System\BRBfqBE.exe
  2⤵
  PID:6588
- C:\Windows\System\EiiXyyH.exe
  C:\Windows\System\EiiXyyH.exe
  2⤵
  PID:6320
- C:\Windows\System\eGqkFeI.exe
  C:\Windows\System\eGqkFeI.exe
  2⤵
  PID:5244
- C:\Windows\System\HQhYJkK.exe
  C:\Windows\System\HQhYJkK.exe
  2⤵
  PID:6648
- C:\Windows\System\JutKclh.exe
  C:\Windows\System\JutKclh.exe
  2⤵
  PID:6668
- C:\Windows\System\KmUihEp.exe
  C:\Windows\System\KmUihEp.exe
  2⤵
  PID:5740
- C:\Windows\System\QdORlSg.exe
  C:\Windows\System\QdORlSg.exe
  2⤵
  PID:6128
- C:\Windows\System\ahwJGMh.exe
  C:\Windows\System\ahwJGMh.exe
  2⤵
  PID:6704
- C:\Windows\System\gLErUon.exe
  C:\Windows\System\gLErUon.exe
  2⤵
  PID:6712
- C:\Windows\System\uqblmMH.exe
  C:\Windows\System\uqblmMH.exe
  2⤵
  PID:6736
- C:\Windows\System\HnTWSkc.exe
  C:\Windows\System\HnTWSkc.exe
  2⤵
  PID:6540
- C:\Windows\System\FPoxmKo.exe
  C:\Windows\System\FPoxmKo.exe
  2⤵
  PID:5664
- C:\Windows\System\OLeSPJR.exe
  C:\Windows\System\OLeSPJR.exe
  2⤵
  PID:6156
- C:\Windows\System\QoqKuox.exe
  C:\Windows\System\QoqKuox.exe
  2⤵
  PID:6224
- C:\Windows\System\USCWvNy.exe
  C:\Windows\System\USCWvNy.exe
  2⤵
  PID:6352
- C:\Windows\System\bkClMdx.exe
  C:\Windows\System\bkClMdx.exe
  2⤵
  PID:6428
- C:\Windows\System\sMSjjtf.exe
  C:\Windows\System\sMSjjtf.exe
  2⤵
  PID:6468
- C:\Windows\System\mmTKcrQ.exe
  C:\Windows\System\mmTKcrQ.exe
  2⤵
  PID:6508
- C:\Windows\System\WxZemel.exe
  C:\Windows\System\WxZemel.exe
  2⤵
  PID:6768
- C:\Windows\System\wIMVPMT.exe
  C:\Windows\System\wIMVPMT.exe
  2⤵
  PID:6612
- C:\Windows\System\SgcRVal.exe
  C:\Windows\System\SgcRVal.exe
  2⤵
  PID:6788
- C:\Windows\System\QgnteiW.exe
  C:\Windows\System\QgnteiW.exe
  2⤵
  PID:6804
- C:\Windows\System\jmpTqWy.exe
  C:\Windows\System\jmpTqWy.exe
  2⤵
  PID:6740
- C:\Windows\System\CbGpQeq.exe
  C:\Windows\System\CbGpQeq.exe
  2⤵
  PID:6748
- C:\Windows\System\wbbpVIP.exe
  C:\Windows\System\wbbpVIP.exe
  2⤵
  PID:6824
- C:\Windows\System\lrwAcJm.exe
  C:\Windows\System\lrwAcJm.exe
  2⤵
  PID:6844
- C:\Windows\System\XJRXXge.exe
  C:\Windows\System\XJRXXge.exe
  2⤵
  PID:6856
- C:\Windows\System\xbQaWkP.exe
  C:\Windows\System\xbQaWkP.exe
  2⤵
  PID:6876
- C:\Windows\System\dCOuUPq.exe
  C:\Windows\System\dCOuUPq.exe
  2⤵
  PID:6892
- C:\Windows\System\RLjvtvD.exe
  C:\Windows\System\RLjvtvD.exe
  2⤵
  PID:6908
- C:\Windows\System\zVgOyea.exe
  C:\Windows\System\zVgOyea.exe
  2⤵
  PID:2184
- C:\Windows\System\rUdKghX.exe
  C:\Windows\System\rUdKghX.exe
  2⤵
  PID:6988
- C:\Windows\System\NRnrLnq.exe
  C:\Windows\System\NRnrLnq.exe
  2⤵
  PID:6964
- C:\Windows\System\MJlONww.exe
  C:\Windows\System\MJlONww.exe
  2⤵
  PID:7100
- C:\Windows\System\trKjdCE.exe
  C:\Windows\System\trKjdCE.exe
  2⤵
  PID:7004
- C:\Windows\System\nTduApA.exe
  C:\Windows\System\nTduApA.exe
  2⤵
  PID:7164
- C:\Windows\System\LQsiEjb.exe
  C:\Windows\System\LQsiEjb.exe
  2⤵
  PID:5372
- C:\Windows\System\RojKfSQ.exe
  C:\Windows\System\RojKfSQ.exe
  2⤵
  PID:7148
- C:\Windows\System\pTRWEXP.exe
  C:\Windows\System\pTRWEXP.exe
  2⤵
  PID:7152
- C:\Windows\System\sUtNqOi.exe
  C:\Windows\System\sUtNqOi.exe
  2⤵
  PID:6372
- C:\Windows\System\bBMSlbV.exe
  C:\Windows\System\bBMSlbV.exe
  2⤵
  PID:6444
- C:\Windows\System\HQhNVmO.exe
  C:\Windows\System\HQhNVmO.exe
  2⤵
  PID:6664
- C:\Windows\System\PfFnOkY.exe
  C:\Windows\System\PfFnOkY.exe
  2⤵
  PID:6680
- C:\Windows\System\oKUIenF.exe
  C:\Windows\System\oKUIenF.exe
  2⤵
  PID:6080
- C:\Windows\System\huZBvsw.exe
  C:\Windows\System\huZBvsw.exe
  2⤵
  PID:5356
- C:\Windows\System\MzTlpGI.exe
  C:\Windows\System\MzTlpGI.exe
  2⤵
  PID:5984
- C:\Windows\System\VsoDgaj.exe
  C:\Windows\System\VsoDgaj.exe
  2⤵
  PID:6076
- C:\Windows\System\yjdMDmm.exe
  C:\Windows\System\yjdMDmm.exe
  2⤵
  PID:6064
- C:\Windows\System\PzlmRyi.exe
  C:\Windows\System\PzlmRyi.exe
  2⤵
  PID:5208
- C:\Windows\System\uVGOwmQ.exe
  C:\Windows\System\uVGOwmQ.exe
  2⤵
  PID:6688
- C:\Windows\System\bQmkGsS.exe
  C:\Windows\System\bQmkGsS.exe
  2⤵
  PID:5552
- C:\Windows\System\kJwwGjU.exe
  C:\Windows\System\kJwwGjU.exe
  2⤵
  PID:6708
- C:\Windows\System\wZsPbPr.exe
  C:\Windows\System\wZsPbPr.exe
  2⤵
  PID:6012
- C:\Windows\System\HcfhYqu.exe
  C:\Windows\System\HcfhYqu.exe
  2⤵
  PID:5228
- C:\Windows\System\bDPCtRW.exe
  C:\Windows\System\bDPCtRW.exe
  2⤵
  PID:6152
- C:\Windows\System\qnvHoiG.exe
  C:\Windows\System\qnvHoiG.exe
  2⤵
  PID:6460
- C:\Windows\System\hJLCunp.exe
  C:\Windows\System\hJLCunp.exe
  2⤵
  PID:6220
- C:\Windows\System\yvKsIwc.exe
  C:\Windows\System\yvKsIwc.exe
  2⤵
  PID:6576
- C:\Windows\System\YOePUmY.exe
  C:\Windows\System\YOePUmY.exe
  2⤵
  PID:6776
- C:\Windows\System\uAGaNzh.exe
  C:\Windows\System\uAGaNzh.exe
  2⤵
  PID:6724
- C:\Windows\System\OrAmoEK.exe
  C:\Windows\System\OrAmoEK.exe
  2⤵
  PID:6796
- C:\Windows\System\FkDmOiU.exe
  C:\Windows\System\FkDmOiU.exe
  2⤵
  PID:6884
- C:\Windows\System\EgKckxu.exe
  C:\Windows\System\EgKckxu.exe
  2⤵
  PID:6836
- C:\Windows\System\JSpCLmQ.exe
  C:\Windows\System\JSpCLmQ.exe
  2⤵
  PID:6868
- C:\Windows\System\KwqNFeM.exe
  C:\Windows\System\KwqNFeM.exe
  2⤵
  PID:6948
- C:\Windows\System\HDQspme.exe
  C:\Windows\System\HDQspme.exe
  2⤵
  PID:5868
- C:\Windows\System\FQEVWet.exe
  C:\Windows\System\FQEVWet.exe
  2⤵
  PID:6324
- C:\Windows\System\EOyHFXI.exe
  C:\Windows\System\EOyHFXI.exe
  2⤵
  PID:5808
- C:\Windows\System\JrHVnKR.exe
  C:\Windows\System\JrHVnKR.exe
  2⤵
  PID:4456
- C:\Windows\System\pBnhljj.exe
  C:\Windows\System\pBnhljj.exe
  2⤵
  PID:6560
- C:\Windows\System\CLsxtjz.exe
  C:\Windows\System\CLsxtjz.exe
  2⤵
  PID:5648
- C:\Windows\System\naHXflo.exe
  C:\Windows\System\naHXflo.exe
  2⤵
  PID:5196
- C:\Windows\System\zakYupt.exe
  C:\Windows\System\zakYupt.exe
  2⤵
  PID:5548
- C:\Windows\System\LIxpRSO.exe
  C:\Windows\System\LIxpRSO.exe
  2⤵
  PID:5404
- C:\Windows\System\WrScOhy.exe
  C:\Windows\System\WrScOhy.exe
  2⤵
  PID:5980
- C:\Windows\System\cfaXFTR.exe
  C:\Windows\System\cfaXFTR.exe
  2⤵
  PID:5424
- C:\Windows\System\DvEZpyc.exe
  C:\Windows\System\DvEZpyc.exe
  2⤵
  PID:6000
- C:\Windows\System\cNKGjOb.exe
  C:\Windows\System\cNKGjOb.exe
  2⤵
  PID:6544
- C:\Windows\System\KGDGEQr.exe
  C:\Windows\System\KGDGEQr.exe
  2⤵
  PID:6784
- C:\Windows\System\AemnjXb.exe
  C:\Windows\System\AemnjXb.exe
  2⤵
  PID:7020
- C:\Windows\System\WyIaBND.exe
  C:\Windows\System\WyIaBND.exe
  2⤵
  PID:7052
- C:\Windows\System\jxPxHaw.exe
  C:\Windows\System\jxPxHaw.exe
  2⤵
  PID:7040
- C:\Windows\System\vMargnQ.exe
  C:\Windows\System\vMargnQ.exe
  2⤵
  PID:7144
- C:\Windows\System\LTXIaRU.exe
  C:\Windows\System\LTXIaRU.exe
  2⤵
  PID:6328
- C:\Windows\System\kXeSaOH.exe
  C:\Windows\System\kXeSaOH.exe
  2⤵
  PID:6920
- C:\Windows\System\phXWAgj.exe
  C:\Windows\System\phXWAgj.exe
  2⤵
  PID:6236
- C:\Windows\System\QgvaoLv.exe
  C:\Windows\System\QgvaoLv.exe
  2⤵
  PID:7060
- C:\Windows\System\aBUuqsa.exe
  C:\Windows\System\aBUuqsa.exe
  2⤵
  PID:5916
- C:\Windows\System\OnCfJTT.exe
  C:\Windows\System\OnCfJTT.exe
  2⤵
  PID:5176
- C:\Windows\System\baPsicR.exe
  C:\Windows\System\baPsicR.exe
  2⤵
  PID:6556
- C:\Windows\System\emYxILC.exe
  C:\Windows\System\emYxILC.exe
  2⤵
  PID:6652
- C:\Windows\System\SsTIRTh.exe
  C:\Windows\System\SsTIRTh.exe
  2⤵
  PID:5456
- C:\Windows\System\skLfHya.exe
  C:\Windows\System\skLfHya.exe
  2⤵
  PID:6640
- C:\Windows\System\IKzsoTT.exe
  C:\Windows\System\IKzsoTT.exe
  2⤵
  PID:6192
- C:\Windows\System\WlKunGD.exe
  C:\Windows\System\WlKunGD.exe
  2⤵
  PID:5996
- C:\Windows\System\Aedctdr.exe
  C:\Windows\System\Aedctdr.exe
  2⤵
  PID:6832
- C:\Windows\System\hzwWLEj.exe
  C:\Windows\System\hzwWLEj.exe
  2⤵
  PID:6916
- C:\Windows\System\NjJATbm.exe
  C:\Windows\System\NjJATbm.exe
  2⤵
  PID:6900
- C:\Windows\System\zowVaeT.exe
  C:\Windows\System\zowVaeT.exe
  2⤵
  PID:2172
- C:\Windows\System\dxbnYmW.exe
  C:\Windows\System\dxbnYmW.exe
  2⤵
  PID:7056
- C:\Windows\System\mJjoEJt.exe
  C:\Windows\System\mJjoEJt.exe
  2⤵
  PID:7076
- C:\Windows\System\oiKKyNy.exe
  C:\Windows\System\oiKKyNy.exe
  2⤵
  PID:7128
- C:\Windows\System\FTKyqOB.exe
  C:\Windows\System\FTKyqOB.exe
  2⤵
  PID:6280
- C:\Windows\System\skYFocy.exe
  C:\Windows\System\skYFocy.exe
  2⤵
  PID:4548
- C:\Windows\System\DxoDZCt.exe
  C:\Windows\System\DxoDZCt.exe
  2⤵
  PID:5804
- C:\Windows\System\ZCbDVgS.exe
  C:\Windows\System\ZCbDVgS.exe
  2⤵
  PID:5408
- C:\Windows\System\MDOkHjR.exe
  C:\Windows\System\MDOkHjR.exe
  2⤵
  PID:4176
- C:\Windows\System\VUsygLt.exe
  C:\Windows\System\VUsygLt.exe
  2⤵
  PID:6984
- C:\Windows\System\gHyMQrX.exe
  C:\Windows\System\gHyMQrX.exe
  2⤵
  PID:6244
- C:\Windows\System\RpxFkFp.exe
  C:\Windows\System\RpxFkFp.exe
  2⤵
  PID:7204
- C:\Windows\System\TbmVjed.exe
  C:\Windows\System\TbmVjed.exe
  2⤵
  PID:7224
- C:\Windows\System\BZbtQFi.exe
  C:\Windows\System\BZbtQFi.exe
  2⤵
  PID:7244
- C:\Windows\System\UjjrXaK.exe
  C:\Windows\System\UjjrXaK.exe
  2⤵
  PID:7260
- C:\Windows\System\FeBZufL.exe
  C:\Windows\System\FeBZufL.exe
  2⤵
  PID:7276
- C:\Windows\System\vduisMx.exe
  C:\Windows\System\vduisMx.exe
  2⤵
  PID:7304
- C:\Windows\System\vjbRCpC.exe
  C:\Windows\System\vjbRCpC.exe
  2⤵
  PID:7320
- C:\Windows\System\eUSvJAP.exe
  C:\Windows\System\eUSvJAP.exe
  2⤵
  PID:7336
- C:\Windows\System\ikXDaEr.exe
  C:\Windows\System\ikXDaEr.exe
  2⤵
  PID:7352
- C:\Windows\System\CvcKWJH.exe
  C:\Windows\System\CvcKWJH.exe
  2⤵
  PID:7372
- C:\Windows\System\VcNWOMH.exe
  C:\Windows\System\VcNWOMH.exe
  2⤵
  PID:7400
- C:\Windows\System\oacjgAz.exe
  C:\Windows\System\oacjgAz.exe
  2⤵
  PID:7456
- C:\Windows\System\NdFjTEs.exe
  C:\Windows\System\NdFjTEs.exe
  2⤵
  PID:7476
- C:\Windows\System\JEXhLTL.exe
  C:\Windows\System\JEXhLTL.exe
  2⤵
  PID:7496
- C:\Windows\System\mfwFrOG.exe
  C:\Windows\System\mfwFrOG.exe
  2⤵
  PID:7512
- C:\Windows\System\DmzTtae.exe
  C:\Windows\System\DmzTtae.exe
  2⤵
  PID:7536
- C:\Windows\System\uXNzvsn.exe
  C:\Windows\System\uXNzvsn.exe
  2⤵
  PID:7552
- C:\Windows\System\fxtieOc.exe
  C:\Windows\System\fxtieOc.exe
  2⤵
  PID:7568
- C:\Windows\System\XVuQyvC.exe
  C:\Windows\System\XVuQyvC.exe
  2⤵
  PID:7588
- C:\Windows\System\FKvhYvu.exe
  C:\Windows\System\FKvhYvu.exe
  2⤵
  PID:7616
- C:\Windows\System\WjuWjcU.exe
  C:\Windows\System\WjuWjcU.exe
  2⤵
  PID:7636
- C:\Windows\System\qElZfpg.exe
  C:\Windows\System\qElZfpg.exe
  2⤵
  PID:7652
- C:\Windows\System\ZkcSKUg.exe
  C:\Windows\System\ZkcSKUg.exe
  2⤵
  PID:7668
- C:\Windows\System\sLrBcdE.exe
  C:\Windows\System\sLrBcdE.exe
  2⤵
  PID:7684
- C:\Windows\System\ntKmoKa.exe
  C:\Windows\System\ntKmoKa.exe
  2⤵
  PID:7704
- C:\Windows\System\bFjaqtY.exe
  C:\Windows\System\bFjaqtY.exe
  2⤵
  PID:7720
- C:\Windows\System\jhyIhWk.exe
  C:\Windows\System\jhyIhWk.exe
  2⤵
  PID:7740
- C:\Windows\System\TOqzIBM.exe
  C:\Windows\System\TOqzIBM.exe
  2⤵
  PID:7764
- C:\Windows\System\kVfadlL.exe
  C:\Windows\System\kVfadlL.exe
  2⤵
  PID:7780
- C:\Windows\System\ovwchGN.exe
  C:\Windows\System\ovwchGN.exe
  2⤵
  PID:7796
- C:\Windows\System\QmQhSVF.exe
  C:\Windows\System\QmQhSVF.exe
  2⤵
  PID:7848
- C:\Windows\System\xSkhtsn.exe
  C:\Windows\System\xSkhtsn.exe
  2⤵
  PID:7864
- C:\Windows\System\CLRWgQu.exe
  C:\Windows\System\CLRWgQu.exe
  2⤵
  PID:7888
- C:\Windows\System\gBdWYAe.exe
  C:\Windows\System\gBdWYAe.exe
  2⤵
  PID:7904
- C:\Windows\System\skBHiMG.exe
  C:\Windows\System\skBHiMG.exe
  2⤵
  PID:7920
- C:\Windows\System\eyiIfJQ.exe
  C:\Windows\System\eyiIfJQ.exe
  2⤵
  PID:7936
- C:\Windows\System\gPgURKL.exe
  C:\Windows\System\gPgURKL.exe
  2⤵
  PID:7956
- C:\Windows\System\TQODqvA.exe
  C:\Windows\System\TQODqvA.exe
  2⤵
  PID:7976
- C:\Windows\System\BKaAHrM.exe
  C:\Windows\System\BKaAHrM.exe
  2⤵
  PID:7992
- C:\Windows\System\PzBYVlQ.exe
  C:\Windows\System\PzBYVlQ.exe
  2⤵
  PID:8008
- C:\Windows\System\HEHZnuy.exe
  C:\Windows\System\HEHZnuy.exe
  2⤵
  PID:8080
- C:\Windows\System\mmmqsJP.exe
  C:\Windows\System\mmmqsJP.exe
  2⤵
  PID:8096
- C:\Windows\System\kMmfBmb.exe
  C:\Windows\System\kMmfBmb.exe
  2⤵
  PID:8112
- C:\Windows\System\WFsHNiQ.exe
  C:\Windows\System\WFsHNiQ.exe
  2⤵
  PID:8132
- C:\Windows\System\KlfdasW.exe
  C:\Windows\System\KlfdasW.exe
  2⤵
  PID:8156
- C:\Windows\System\kgCSZdj.exe
  C:\Windows\System\kgCSZdj.exe
  2⤵
  PID:8172
- C:\Windows\System\IhMUDAS.exe
  C:\Windows\System\IhMUDAS.exe
  2⤵
  PID:8188
- C:\Windows\System\IBgIjzF.exe
  C:\Windows\System\IBgIjzF.exe
  2⤵
  PID:6676
- C:\Windows\System\GKiZDqw.exe
  C:\Windows\System\GKiZDqw.exe
  2⤵
  PID:7084
- C:\Windows\System\qGhreQa.exe
  C:\Windows\System\qGhreQa.exe
  2⤵
  PID:5772
- C:\Windows\System\fLUxihp.exe
  C:\Windows\System\fLUxihp.exe
  2⤵
  PID:6720
- C:\Windows\System\HvEMehK.exe
  C:\Windows\System\HvEMehK.exe
  2⤵
  PID:5192
- C:\Windows\System\qaCmwUQ.exe
  C:\Windows\System\qaCmwUQ.exe
  2⤵
  PID:7080
- C:\Windows\System\vLsnfVi.exe
  C:\Windows\System\vLsnfVi.exe
  2⤵
  PID:7192
- C:\Windows\System\eXGdLfQ.exe
  C:\Windows\System\eXGdLfQ.exe
  2⤵
  PID:7176
- C:\Windows\System\ahXaqFy.exe
  C:\Windows\System\ahXaqFy.exe
  2⤵
  PID:7256
- C:\Windows\System\IlIlWTu.exe
  C:\Windows\System\IlIlWTu.exe
  2⤵
  PID:7288
- C:\Windows\System\RKIwzbC.exe
  C:\Windows\System\RKIwzbC.exe
  2⤵
  PID:7328
- C:\Windows\System\jBXPRhK.exe
  C:\Windows\System\jBXPRhK.exe
  2⤵
  PID:7344
- C:\Windows\System\tmIhloW.exe
  C:\Windows\System\tmIhloW.exe
  2⤵
  PID:7388
- C:\Windows\System\CnuTHMZ.exe
  C:\Windows\System\CnuTHMZ.exe
  2⤵
  PID:7416
- C:\Windows\System\ropIkdG.exe
  C:\Windows\System\ropIkdG.exe
  2⤵
  PID:7448
- C:\Windows\System\jslQUcd.exe
  C:\Windows\System\jslQUcd.exe
  2⤵
  PID:7492
- C:\Windows\System\QYMJvIp.exe
  C:\Windows\System\QYMJvIp.exe
  2⤵
  PID:7524
- C:\Windows\System\cEWQAtu.exe
  C:\Windows\System\cEWQAtu.exe
  2⤵
  PID:7564
- C:\Windows\System\OjQzjnS.exe
  C:\Windows\System\OjQzjnS.exe
  2⤵
  PID:7612
- C:\Windows\System\FwrgVgc.exe
  C:\Windows\System\FwrgVgc.exe
  2⤵
  PID:7716
- C:\Windows\System\XuwiReg.exe
  C:\Windows\System\XuwiReg.exe
  2⤵
  PID:7788
- C:\Windows\System\MmUgTiu.exe
  C:\Windows\System\MmUgTiu.exe
  2⤵
  PID:7576
- C:\Windows\System\OQpbmAt.exe
  C:\Windows\System\OQpbmAt.exe
  2⤵
  PID:7772
- C:\Windows\System\BeHPEIg.exe
  C:\Windows\System\BeHPEIg.exe
  2⤵
  PID:7664
- C:\Windows\System\VTZrdgm.exe
  C:\Windows\System\VTZrdgm.exe
  2⤵
  PID:7508
- C:\Windows\System\XtuDhZW.exe
  C:\Windows\System\XtuDhZW.exe
  2⤵
  PID:7732
- C:\Windows\System\CqObtHn.exe
  C:\Windows\System\CqObtHn.exe
  2⤵
  PID:7964
- C:\Windows\System\GGDMJyo.exe
  C:\Windows\System\GGDMJyo.exe
  2⤵
  PID:7932
- C:\Windows\System\OFXSakX.exe
  C:\Windows\System\OFXSakX.exe
  2⤵
  PID:7820
- C:\Windows\System\ncSCAtr.exe
  C:\Windows\System\ncSCAtr.exe
  2⤵
  PID:7836
- C:\Windows\System\XDWtizL.exe
  C:\Windows\System\XDWtizL.exe
  2⤵
  PID:7844
- C:\Windows\System\FWHRglb.exe
  C:\Windows\System\FWHRglb.exe
  2⤵
  PID:8048
- C:\Windows\System\hMXFFtl.exe
  C:\Windows\System\hMXFFtl.exe
  2⤵
  PID:7944
- C:\Windows\System\ZEmKhdv.exe
  C:\Windows\System\ZEmKhdv.exe
  2⤵
  PID:8016
- C:\Windows\System\ilVdKYJ.exe
  C:\Windows\System\ilVdKYJ.exe
  2⤵
  PID:8052
- C:\Windows\System\PCOItRa.exe
  C:\Windows\System\PCOItRa.exe
  2⤵
  PID:8068
- C:\Windows\System\OlTYzjF.exe
  C:\Windows\System\OlTYzjF.exe
  2⤵
  PID:8088
- C:\Windows\System\lPaFKzd.exe
  C:\Windows\System\lPaFKzd.exe
  2⤵
  PID:8108
- C:\Windows\System\xCxnIko.exe
  C:\Windows\System\xCxnIko.exe
  2⤵
  PID:8164
- C:\Windows\System\XmzaCzP.exe
  C:\Windows\System\XmzaCzP.exe
  2⤵
  PID:4712
- C:\Windows\System\znnefiP.exe
  C:\Windows\System\znnefiP.exe
  2⤵
  PID:8184
- C:\Windows\System\XPcOEdO.exe
  C:\Windows\System\XPcOEdO.exe
  2⤵
  PID:5840
- C:\Windows\System\dvPAZJN.exe
  C:\Windows\System\dvPAZJN.exe
  2⤵
  PID:6284
- C:\Windows\System\RxQMiTh.exe
  C:\Windows\System\RxQMiTh.exe
  2⤵
  PID:7240
- C:\Windows\System\eVPlWiA.exe
  C:\Windows\System\eVPlWiA.exe
  2⤵
  PID:7364
- C:\Windows\System\eyPsgSg.exe
  C:\Windows\System\eyPsgSg.exe
  2⤵
  PID:7396
- C:\Windows\System\YGlnseZ.exe
  C:\Windows\System\YGlnseZ.exe
  2⤵
  PID:7428
- C:\Windows\System\zAowtNg.exe
  C:\Windows\System\zAowtNg.exe
  2⤵
  PID:7444
- C:\Windows\System\aEwSjXl.exe
  C:\Windows\System\aEwSjXl.exe
  2⤵
  PID:7312
- C:\Windows\System\joMICxy.exe
  C:\Windows\System\joMICxy.exe
  2⤵
  PID:7464
- C:\Windows\System\PsUjFqp.exe
  C:\Windows\System\PsUjFqp.exe
  2⤵
  PID:7608
- C:\Windows\System\yBYOkNz.exe
  C:\Windows\System\yBYOkNz.exe
  2⤵
  PID:7644
- C:\Windows\System\fPipuoK.exe
  C:\Windows\System\fPipuoK.exe
  2⤵
  PID:8000
- C:\Windows\System\xJtgJIp.exe
  C:\Windows\System\xJtgJIp.exe
  2⤵
  PID:7736
- C:\Windows\System\EGclRLh.exe
  C:\Windows\System\EGclRLh.exe
  2⤵
  PID:7544
- C:\Windows\System\fgGcmHY.exe
  C:\Windows\System\fgGcmHY.exe
  2⤵
  PID:8028
- C:\Windows\System\FhtrVNI.exe
  C:\Windows\System\FhtrVNI.exe
  2⤵
  PID:7408
- C:\Windows\System\vApSBrZ.exe
  C:\Windows\System\vApSBrZ.exe
  2⤵
  PID:4776
- C:\Windows\System\cXDviGb.exe
  C:\Windows\System\cXDviGb.exe
  2⤵
  PID:8032
- C:\Windows\System\EFTCrYB.exe
  C:\Windows\System\EFTCrYB.exe
  2⤵
  PID:7872
- C:\Windows\System\ktlmNQO.exe
  C:\Windows\System\ktlmNQO.exe
  2⤵
  PID:6928
- C:\Windows\System\ozBPRvf.exe
  C:\Windows\System\ozBPRvf.exe
  2⤵
  PID:7968
- C:\Windows\System\HwPGzLm.exe
  C:\Windows\System\HwPGzLm.exe
  2⤵
  PID:8144
- C:\Windows\System\eKOwjKB.exe
  C:\Windows\System\eKOwjKB.exe
  2⤵
  PID:6800
- C:\Windows\System\HtfGCZY.exe
  C:\Windows\System\HtfGCZY.exe
  2⤵
  PID:6392
- C:\Windows\System\qjYfLtO.exe
  C:\Windows\System\qjYfLtO.exe
  2⤵
  PID:7212
- C:\Windows\System\FmmAnbJ.exe
  C:\Windows\System\FmmAnbJ.exe
  2⤵
  PID:7332
- C:\Windows\System\cYCFDQL.exe
  C:\Windows\System\cYCFDQL.exe
  2⤵
  PID:7472
- C:\Windows\System\HRLEtFF.exe
  C:\Windows\System\HRLEtFF.exe
  2⤵
  PID:7200
- C:\Windows\System\HHkKKet.exe
  C:\Windows\System\HHkKKet.exe
  2⤵
  PID:7236
- C:\Windows\System\VXYGVPi.exe
  C:\Windows\System\VXYGVPi.exe
  2⤵
  PID:7712
- C:\Windows\System\HgVTbHd.exe
  C:\Windows\System\HgVTbHd.exe
  2⤵
  PID:7692
- C:\Windows\System\ZJEsfHK.exe
  C:\Windows\System\ZJEsfHK.exe
  2⤵
  PID:7696
- C:\Windows\System\fhCOSGC.exe
  C:\Windows\System\fhCOSGC.exe
  2⤵
  PID:7580
- C:\Windows\System\IavWKeK.exe
  C:\Windows\System\IavWKeK.exe
  2⤵
  PID:7024
- C:\Windows\System\wdwvPyX.exe
  C:\Windows\System\wdwvPyX.exe
  2⤵
  PID:7884
- C:\Windows\System\IdbjZaJ.exe
  C:\Windows\System\IdbjZaJ.exe
  2⤵
  PID:8056
- C:\Windows\System\Mgfybqw.exe
  C:\Windows\System\Mgfybqw.exe
  2⤵
  PID:7948
- C:\Windows\System\kgQeeLR.exe
  C:\Windows\System\kgQeeLR.exe
  2⤵
  PID:8064
- C:\Windows\System\ZtLLCbn.exe
  C:\Windows\System\ZtLLCbn.exe
  2⤵
  PID:7748
- C:\Windows\System\vwkqFeC.exe
  C:\Windows\System\vwkqFeC.exe
  2⤵
  PID:7296
- C:\Windows\System\KxqlLkR.exe
  C:\Windows\System\KxqlLkR.exe
  2⤵
  PID:7216
- C:\Windows\System\cKwrGVT.exe
  C:\Windows\System\cKwrGVT.exe
  2⤵
  PID:8208
- C:\Windows\System\MyDPJrb.exe
  C:\Windows\System\MyDPJrb.exe
  2⤵
  PID:8228
- C:\Windows\System\zCUQUZH.exe
  C:\Windows\System\zCUQUZH.exe
  2⤵
  PID:8244
- C:\Windows\System\vZckWPz.exe
  C:\Windows\System\vZckWPz.exe
  2⤵
  PID:8260
- C:\Windows\System\GRzHNEj.exe
  C:\Windows\System\GRzHNEj.exe
  2⤵
  PID:8280
- C:\Windows\System\LYMWFlw.exe
  C:\Windows\System\LYMWFlw.exe
  2⤵
  PID:8296
- C:\Windows\System\zKCMnFQ.exe
  C:\Windows\System\zKCMnFQ.exe
  2⤵
  PID:8312
- C:\Windows\System\fIACgSC.exe
  C:\Windows\System\fIACgSC.exe
  2⤵
  PID:8332
- C:\Windows\System\CdBUiOu.exe
  C:\Windows\System\CdBUiOu.exe
  2⤵
  PID:8348
- C:\Windows\System\qZfQIUb.exe
  C:\Windows\System\qZfQIUb.exe
  2⤵
  PID:8368
- C:\Windows\System\JWeFAwL.exe
  C:\Windows\System\JWeFAwL.exe
  2⤵
  PID:8384
- C:\Windows\System\eKAiMQR.exe
  C:\Windows\System\eKAiMQR.exe
  2⤵
  PID:8400
- C:\Windows\System\cEZUazg.exe
  C:\Windows\System\cEZUazg.exe
  2⤵
  PID:8416
- C:\Windows\System\NQcJnPS.exe
  C:\Windows\System\NQcJnPS.exe
  2⤵
  PID:8436
- C:\Windows\System\afRnTan.exe
  C:\Windows\System\afRnTan.exe
  2⤵
  PID:8452
- C:\Windows\System\qzNcmaj.exe
  C:\Windows\System\qzNcmaj.exe
  2⤵
  PID:8468
- C:\Windows\System\ydWcwJV.exe
  C:\Windows\System\ydWcwJV.exe
  2⤵
  PID:8488
- C:\Windows\System\dZGbjBH.exe
  C:\Windows\System\dZGbjBH.exe
  2⤵
  PID:8504
- C:\Windows\System\OhGaTnx.exe
  C:\Windows\System\OhGaTnx.exe
  2⤵
  PID:8524
- C:\Windows\System\YLGYbQS.exe
  C:\Windows\System\YLGYbQS.exe
  2⤵
  PID:8544
- C:\Windows\System\SZIwFbl.exe
  C:\Windows\System\SZIwFbl.exe
  2⤵
  PID:8560
- C:\Windows\System\YnwHLri.exe
  C:\Windows\System\YnwHLri.exe
  2⤵
  PID:8580
- C:\Windows\System\bSZTVAs.exe
  C:\Windows\System\bSZTVAs.exe
  2⤵
  PID:8596
- C:\Windows\System\tjZsgfb.exe
  C:\Windows\System\tjZsgfb.exe
  2⤵
  PID:8612
- C:\Windows\System\vQJKrGl.exe
  C:\Windows\System\vQJKrGl.exe
  2⤵
  PID:8628
- C:\Windows\System\AcuBoor.exe
  C:\Windows\System\AcuBoor.exe
  2⤵
  PID:8644
- C:\Windows\System\fBYuYZJ.exe
  C:\Windows\System\fBYuYZJ.exe
  2⤵
  PID:8660
- C:\Windows\System\DPduhFA.exe
  C:\Windows\System\DPduhFA.exe
  2⤵
  PID:8680
- C:\Windows\System\mmJpoVC.exe
  C:\Windows\System\mmJpoVC.exe
  2⤵
  PID:8696
- C:\Windows\System\rKonuXe.exe
  C:\Windows\System\rKonuXe.exe
  2⤵
  PID:8720
- C:\Windows\System\HXesMBd.exe
  C:\Windows\System\HXesMBd.exe
  2⤵
  PID:8736
- C:\Windows\System\JWZBraj.exe
  C:\Windows\System\JWZBraj.exe
  2⤵
  PID:8752
- C:\Windows\System\RjZNVBv.exe
  C:\Windows\System\RjZNVBv.exe
  2⤵
  PID:8772
- C:\Windows\System\xzlPbaY.exe
  C:\Windows\System\xzlPbaY.exe
  2⤵
  PID:8788
- C:\Windows\System\viSwADW.exe
  C:\Windows\System\viSwADW.exe
  2⤵
  PID:8804
- C:\Windows\System\LfkxPDm.exe
  C:\Windows\System\LfkxPDm.exe
  2⤵
  PID:8820
- C:\Windows\System\YdSJvKL.exe
  C:\Windows\System\YdSJvKL.exe
  2⤵
  PID:8836
- C:\Windows\System\ieUdQVG.exe
  C:\Windows\System\ieUdQVG.exe
  2⤵
  PID:8856
- C:\Windows\System\IYSCgHA.exe
  C:\Windows\System\IYSCgHA.exe
  2⤵
  PID:8880
- C:\Windows\System\WiHyMUh.exe
  C:\Windows\System\WiHyMUh.exe
  2⤵
  PID:8908
- C:\Windows\System\RoJZSct.exe
  C:\Windows\System\RoJZSct.exe
  2⤵
  PID:8924
- C:\Windows\System\LLrXmOU.exe
  C:\Windows\System\LLrXmOU.exe
  2⤵
  PID:8940
- C:\Windows\System\MaWnRJW.exe
  C:\Windows\System\MaWnRJW.exe
  2⤵
  PID:8956
- C:\Windows\System\nsPllCq.exe
  C:\Windows\System\nsPllCq.exe
  2⤵
  PID:8976
- C:\Windows\System\RxHowxd.exe
  C:\Windows\System\RxHowxd.exe
  2⤵
  PID:8992
- C:\Windows\System\PeZkkLs.exe
  C:\Windows\System\PeZkkLs.exe
  2⤵
  PID:9008
- C:\Windows\System\SlXcbUR.exe
  C:\Windows\System\SlXcbUR.exe
  2⤵
  PID:9028
- C:\Windows\System\YLuUnwu.exe
  C:\Windows\System\YLuUnwu.exe
  2⤵
  PID:9044
- C:\Windows\System\JRoGGIH.exe
  C:\Windows\System\JRoGGIH.exe
  2⤵
  PID:9060
- C:\Windows\System\HYHXrer.exe
  C:\Windows\System\HYHXrer.exe
  2⤵
  PID:9076
- C:\Windows\System\uZaTllG.exe
  C:\Windows\System\uZaTllG.exe
  2⤵
  PID:9100
- C:\Windows\System\wZYlaCt.exe
  C:\Windows\System\wZYlaCt.exe
  2⤵
  PID:9116
- C:\Windows\System\lpuFaeg.exe
  C:\Windows\System\lpuFaeg.exe
  2⤵
  PID:9200
- C:\Windows\System\tJqeuop.exe
  C:\Windows\System\tJqeuop.exe
  2⤵
  PID:8236
- C:\Windows\System\lAfctmB.exe
  C:\Windows\System\lAfctmB.exe
  2⤵
  PID:8196
- C:\Windows\System\gUmeRMI.exe
  C:\Windows\System\gUmeRMI.exe
  2⤵
  PID:8268
- C:\Windows\System\YQTQaOx.exe
  C:\Windows\System\YQTQaOx.exe
  2⤵
  PID:8344
- C:\Windows\System\nilqhCO.exe
  C:\Windows\System\nilqhCO.exe
  2⤵
  PID:8380
- C:\Windows\System\uGRfGII.exe
  C:\Windows\System\uGRfGII.exe
  2⤵
  PID:8480
- C:\Windows\System\NpdzRlJ.exe
  C:\Windows\System\NpdzRlJ.exe
  2⤵
  PID:8520
- C:\Windows\System\bxGnfBF.exe
  C:\Windows\System\bxGnfBF.exe
  2⤵
  PID:8252
- C:\Windows\System\vJPbagJ.exe
  C:\Windows\System\vJPbagJ.exe
  2⤵
  PID:8460
- C:\Windows\System\jEwfEye.exe
  C:\Windows\System\jEwfEye.exe
  2⤵
  PID:8424
- C:\Windows\System\JAVJXuE.exe
  C:\Windows\System\JAVJXuE.exe
  2⤵
  PID:7368
- C:\Windows\System\LQlOrOC.exe
  C:\Windows\System\LQlOrOC.exe
  2⤵
  PID:7916
- C:\Windows\System\RBSjOaT.exe
  C:\Windows\System\RBSjOaT.exe
  2⤵
  PID:7488
- C:\Windows\System\eYnRCwT.exe
  C:\Windows\System\eYnRCwT.exe
  2⤵
  PID:8216
- C:\Windows\System\XFOZjJA.exe
  C:\Windows\System\XFOZjJA.exe
  2⤵
  PID:8288
- C:\Windows\System\FvtxfPC.exe
  C:\Windows\System\FvtxfPC.exe
  2⤵
  PID:8356
- C:\Windows\System\euaRvzQ.exe
  C:\Windows\System\euaRvzQ.exe
  2⤵
  PID:8396
- C:\Windows\System\uQsdbLR.exe
  C:\Windows\System\uQsdbLR.exe
  2⤵
  PID:8540
- C:\Windows\System\gJOsDbn.exe
  C:\Windows\System\gJOsDbn.exe
  2⤵
  PID:8620
- C:\Windows\System\mUVOyzk.exe
  C:\Windows\System\mUVOyzk.exe
  2⤵
  PID:8608
- C:\Windows\System\zbqTWFX.exe
  C:\Windows\System\zbqTWFX.exe
  2⤵
  PID:8640
- C:\Windows\System\GoQRjgt.exe
  C:\Windows\System\GoQRjgt.exe
  2⤵
  PID:8128
- C:\Windows\System\QjTTltr.exe
  C:\Windows\System\QjTTltr.exe
  2⤵
  PID:8760
- C:\Windows\System\CCSWeyW.exe
  C:\Windows\System\CCSWeyW.exe
  2⤵
  PID:8800
- C:\Windows\System\JmNSIiM.exe
  C:\Windows\System\JmNSIiM.exe
  2⤵
  PID:9000
- C:\Windows\System\sxHqbwU.exe
  C:\Windows\System\sxHqbwU.exe
  2⤵
  PID:9108
- C:\Windows\System\dXQJACx.exe
  C:\Windows\System\dXQJACx.exe
  2⤵
  PID:9140
- C:\Windows\System\KMYYByp.exe
  C:\Windows\System\KMYYByp.exe
  2⤵
  PID:9152
- C:\Windows\System\KhZVDGe.exe
  C:\Windows\System\KhZVDGe.exe
  2⤵
  PID:9176
- C:\Windows\System\THcOXLH.exe
  C:\Windows\System\THcOXLH.exe
  2⤵
  PID:9188
- C:\Windows\System\kqEczfN.exe
  C:\Windows\System\kqEczfN.exe
  2⤵
  PID:9212
- C:\Windows\System\xFmgbZb.exe
  C:\Windows\System\xFmgbZb.exe
  2⤵
  PID:8308
- C:\Windows\System\endsLVr.exe
  C:\Windows\System\endsLVr.exe
  2⤵
  PID:8092
- C:\Windows\System\ruYwkAF.exe
  C:\Windows\System\ruYwkAF.exe
  2⤵
  PID:8552
- C:\Windows\System\FolmHAO.exe
  C:\Windows\System\FolmHAO.exe
  2⤵
  PID:7424
- C:\Windows\System\JgLtXuc.exe
  C:\Windows\System\JgLtXuc.exe
  2⤵
  PID:8004
- C:\Windows\System\eHaCCIy.exe
  C:\Windows\System\eHaCCIy.exe
  2⤵
  PID:8412
- C:\Windows\System\iqwRWVT.exe
  C:\Windows\System\iqwRWVT.exe
  2⤵
  PID:8656
- C:\Windows\System\dsjdIlr.exe
  C:\Windows\System\dsjdIlr.exe
  2⤵
  PID:8432
- C:\Windows\System\nwplgtt.exe
  C:\Windows\System\nwplgtt.exe
  2⤵
  PID:8152
- C:\Windows\System\DYGDNOP.exe
  C:\Windows\System\DYGDNOP.exe
  2⤵
  PID:8364
- C:\Windows\System\VZFSObt.exe
  C:\Windows\System\VZFSObt.exe
  2⤵
  PID:8672
- C:\Windows\System\GdisRap.exe
  C:\Windows\System\GdisRap.exe
  2⤵
  PID:8864
- C:\Windows\System\MlSTPnA.exe
  C:\Windows\System\MlSTPnA.exe
  2⤵
  PID:8604
- C:\Windows\System\jTVPWHn.exe
  C:\Windows\System\jTVPWHn.exe
  2⤵
  PID:8872
- C:\Windows\System\lrReDuO.exe
  C:\Windows\System\lrReDuO.exe
  2⤵
  PID:8816
- C:\Windows\System\oUZCXoC.exe
  C:\Windows\System\oUZCXoC.exe
  2⤵
  PID:8744
- C:\Windows\System\STHlNRH.exe
  C:\Windows\System\STHlNRH.exe
  2⤵
  PID:8844
- C:\Windows\System\AEnqzIj.exe
  C:\Windows\System\AEnqzIj.exe
  2⤵
  PID:9124
- C:\Windows\System\DmEOFaK.exe
  C:\Windows\System\DmEOFaK.exe
  2⤵
  PID:8916
- C:\Windows\System\CusVHBT.exe
  C:\Windows\System\CusVHBT.exe
  2⤵
  PID:8892
- C:\Windows\System\vJzvxjv.exe
  C:\Windows\System\vJzvxjv.exe
  2⤵
  PID:9020
- C:\Windows\System\XkGAFvk.exe
  C:\Windows\System\XkGAFvk.exe
  2⤵
  PID:9088
- C:\Windows\System\zJJblri.exe
  C:\Windows\System\zJJblri.exe
  2⤵
  PID:8904
- C:\Windows\System\uirwgsJ.exe
  C:\Windows\System\uirwgsJ.exe
  2⤵
  PID:9136
- C:\Windows\System\ZdKtWKG.exe
  C:\Windows\System\ZdKtWKG.exe
  2⤵
  PID:9160
- C:\Windows\System\BOtZYQS.exe
  C:\Windows\System\BOtZYQS.exe
  2⤵
  PID:9196
- C:\Windows\System\Gxccuma.exe
  C:\Windows\System\Gxccuma.exe
  2⤵
  PID:8340
- C:\Windows\System\MQiYqCi.exe
  C:\Windows\System\MQiYqCi.exe
  2⤵
  PID:7876
- C:\Windows\System\VlicHLT.exe
  C:\Windows\System\VlicHLT.exe
  2⤵
  PID:8124
- C:\Windows\System\xVfMtYo.exe
  C:\Windows\System\xVfMtYo.exe
  2⤵
  PID:7928
- C:\Windows\System\SdAwUJw.exe
  C:\Windows\System\SdAwUJw.exe
  2⤵
  PID:7900
- C:\Windows\System\GqUxtYk.exe
  C:\Windows\System\GqUxtYk.exe
  2⤵
  PID:8716
- C:\Windows\System\HRYuPwW.exe
  C:\Windows\System\HRYuPwW.exe
  2⤵
  PID:8668
- C:\Windows\System\OdQxLDk.exe
  C:\Windows\System\OdQxLDk.exe
  2⤵
  PID:8784
- C:\Windows\System\pXacePY.exe
  C:\Windows\System\pXacePY.exe
  2⤵
  PID:9056
- C:\Windows\System\ckmwhlv.exe
  C:\Windows\System\ckmwhlv.exe
  2⤵
  PID:9016
- C:\Windows\System\gLwsNos.exe
  C:\Windows\System\gLwsNos.exe
  2⤵
  PID:9040
- C:\Windows\System\kQtoCOa.exe
  C:\Windows\System\kQtoCOa.exe
  2⤵
  PID:8920
- C:\Windows\System\uNbyWZd.exe
  C:\Windows\System\uNbyWZd.exe
  2⤵
  PID:9072
- C:\Windows\System\LBvkRiS.exe
  C:\Windows\System\LBvkRiS.exe
  2⤵
  PID:8964
- C:\Windows\System\xvjvxWW.exe
  C:\Windows\System\xvjvxWW.exe
  2⤵
  PID:8500
- C:\Windows\System\glvvkWa.exe
  C:\Windows\System\glvvkWa.exe
  2⤵
  PID:9192
- C:\Windows\System\espmmoO.exe
  C:\Windows\System\espmmoO.exe
  2⤵
  PID:8024
- C:\Windows\System\rVEkntB.exe
  C:\Windows\System\rVEkntB.exe
  2⤵
  PID:8512
- C:\Windows\System\mmfrpYV.exe
  C:\Windows\System\mmfrpYV.exe
  2⤵
  PID:8832
- C:\Windows\System\AdIHPsQ.exe
  C:\Windows\System\AdIHPsQ.exe
  2⤵
  PID:8812
- C:\Windows\System\rzeQZCQ.exe
  C:\Windows\System\rzeQZCQ.exe
  2⤵
  PID:7972
- C:\Windows\System\qoVfnho.exe
  C:\Windows\System\qoVfnho.exe
  2⤵
  PID:8256
- C:\Windows\System\mfKVqSq.exe
  C:\Windows\System\mfKVqSq.exe
  2⤵
  PID:8988
- C:\Windows\System\ZrKgPwL.exe
  C:\Windows\System\ZrKgPwL.exe
  2⤵
  PID:8496
- C:\Windows\System\pKGzdLt.exe
  C:\Windows\System\pKGzdLt.exe
  2⤵
  PID:8780
- C:\Windows\System\gfOwegh.exe
  C:\Windows\System\gfOwegh.exe
  2⤵
  PID:8636
- C:\Windows\System\irrQnxZ.exe
  C:\Windows\System\irrQnxZ.exe
  2⤵
  PID:9224
- C:\Windows\System\XehBJCM.exe
  C:\Windows\System\XehBJCM.exe
  2⤵
  PID:9240
- C:\Windows\System\GIlxlDE.exe
  C:\Windows\System\GIlxlDE.exe
  2⤵
  PID:9256
- C:\Windows\System\XIbgZPr.exe
  C:\Windows\System\XIbgZPr.exe
  2⤵
  PID:9272
- C:\Windows\System\vOHiaph.exe
  C:\Windows\System\vOHiaph.exe
  2⤵
  PID:9288
- C:\Windows\System\lUsbvOi.exe
  C:\Windows\System\lUsbvOi.exe
  2⤵
  PID:9304
- C:\Windows\System\FCfNNYA.exe
  C:\Windows\System\FCfNNYA.exe
  2⤵
  PID:9320
- C:\Windows\System\aRLAGPk.exe
  C:\Windows\System\aRLAGPk.exe
  2⤵
  PID:9336
- C:\Windows\System\JzjxDOv.exe
  C:\Windows\System\JzjxDOv.exe
  2⤵
  PID:9352
- C:\Windows\System\QnGdSiJ.exe
  C:\Windows\System\QnGdSiJ.exe
  2⤵
  PID:9368
- C:\Windows\System\vTpxyep.exe
  C:\Windows\System\vTpxyep.exe
  2⤵
  PID:9384
- C:\Windows\System\zRLllrM.exe
  C:\Windows\System\zRLllrM.exe
  2⤵
  PID:9400
- C:\Windows\System\PsgWMeW.exe
  C:\Windows\System\PsgWMeW.exe
  2⤵
  PID:9416
- C:\Windows\System\LkICNJU.exe
  C:\Windows\System\LkICNJU.exe
  2⤵
  PID:9432
- C:\Windows\System\noAyeul.exe
  C:\Windows\System\noAyeul.exe
  2⤵
  PID:9448
- C:\Windows\System\PnoFUOt.exe
  C:\Windows\System\PnoFUOt.exe
  2⤵
  PID:9464
- C:\Windows\System\rgncpeq.exe
  C:\Windows\System\rgncpeq.exe
  2⤵
  PID:9480
- C:\Windows\System\GxJRfoS.exe
  C:\Windows\System\GxJRfoS.exe
  2⤵
  PID:9496
- C:\Windows\System\rZurdEa.exe
  C:\Windows\System\rZurdEa.exe
  2⤵
  PID:9512
- C:\Windows\System\zUKACGC.exe
  C:\Windows\System\zUKACGC.exe
  2⤵
  PID:9528
- C:\Windows\System\FnboEMk.exe
  C:\Windows\System\FnboEMk.exe
  2⤵
  PID:9544
- C:\Windows\System\bGJYPPw.exe
  C:\Windows\System\bGJYPPw.exe
  2⤵
  PID:9560
- C:\Windows\System\GaBgvMc.exe
  C:\Windows\System\GaBgvMc.exe
  2⤵
  PID:9576
- C:\Windows\System\pGCGXSE.exe
  C:\Windows\System\pGCGXSE.exe
  2⤵
  PID:9592
- C:\Windows\System\jHgKjJU.exe
  C:\Windows\System\jHgKjJU.exe
  2⤵
  PID:9608
- C:\Windows\System\DgBOmGq.exe
  C:\Windows\System\DgBOmGq.exe
  2⤵
  PID:9624
- C:\Windows\System\BtjHxMM.exe
  C:\Windows\System\BtjHxMM.exe
  2⤵
  PID:9640
- C:\Windows\System\WZaQNvx.exe
  C:\Windows\System\WZaQNvx.exe
  2⤵
  PID:9656
- C:\Windows\System\aBoHAEL.exe
  C:\Windows\System\aBoHAEL.exe
  2⤵
  PID:9672
- C:\Windows\System\PlDYUNA.exe
  C:\Windows\System\PlDYUNA.exe
  2⤵
  PID:9688
- C:\Windows\System\eknitPA.exe
  C:\Windows\System\eknitPA.exe
  2⤵
  PID:9704
- C:\Windows\System\FDILOFC.exe
  C:\Windows\System\FDILOFC.exe
  2⤵
  PID:9720
- C:\Windows\System\lVLxllQ.exe
  C:\Windows\System\lVLxllQ.exe
  2⤵
  PID:9736
- C:\Windows\System\yhkmQHi.exe
  C:\Windows\System\yhkmQHi.exe
  2⤵
  PID:9752
- C:\Windows\System\rKcyKMo.exe
  C:\Windows\System\rKcyKMo.exe
  2⤵
  PID:9772
- C:\Windows\System\ozTUhfb.exe
  C:\Windows\System\ozTUhfb.exe
  2⤵
  PID:9788
- C:\Windows\System\rpVMwjQ.exe
  C:\Windows\System\rpVMwjQ.exe
  2⤵
  PID:9804
- C:\Windows\System\TlafqQP.exe
  C:\Windows\System\TlafqQP.exe
  2⤵
  PID:9820
- C:\Windows\System\CAzHLEa.exe
  C:\Windows\System\CAzHLEa.exe
  2⤵
  PID:9836
- C:\Windows\System\jOGfqAM.exe
  C:\Windows\System\jOGfqAM.exe
  2⤵
  PID:9852
- C:\Windows\System\YcqDLPr.exe
  C:\Windows\System\YcqDLPr.exe
  2⤵
  PID:9868
- C:\Windows\System\IEanayK.exe
  C:\Windows\System\IEanayK.exe
  2⤵
  PID:9884
- C:\Windows\System\VcYVgcj.exe
  C:\Windows\System\VcYVgcj.exe
  2⤵
  PID:9900
- C:\Windows\System\Dniuera.exe
  C:\Windows\System\Dniuera.exe
  2⤵
  PID:9916
- C:\Windows\System\oaJZVNS.exe
  C:\Windows\System\oaJZVNS.exe
  2⤵
  PID:9932
- C:\Windows\System\YSvleHT.exe
  C:\Windows\System\YSvleHT.exe
  2⤵
  PID:9948
- C:\Windows\System\pePMFxl.exe
  C:\Windows\System\pePMFxl.exe
  2⤵
  PID:9964
- C:\Windows\System\tFhFOOr.exe
  C:\Windows\System\tFhFOOr.exe
  2⤵
  PID:9980
- C:\Windows\System\AtSPCkJ.exe
  C:\Windows\System\AtSPCkJ.exe
  2⤵
  PID:9996
- C:\Windows\System\TwopYte.exe
  C:\Windows\System\TwopYte.exe
  2⤵
  PID:10012
- C:\Windows\System\sZPDaGL.exe
  C:\Windows\System\sZPDaGL.exe
  2⤵
  PID:10028
- C:\Windows\System\BVPyHpy.exe
  C:\Windows\System\BVPyHpy.exe
  2⤵
  PID:10220
- C:\Windows\System\AzzdHnA.exe
  C:\Windows\System\AzzdHnA.exe
  2⤵
  PID:8936
- C:\Windows\System\ToYgtqC.exe
  C:\Windows\System\ToYgtqC.exe
  2⤵
  PID:9096
- C:\Windows\System\anktSTx.exe
  C:\Windows\System\anktSTx.exe
  2⤵
  PID:9280
- C:\Windows\System\nThBuSb.exe
  C:\Windows\System\nThBuSb.exe
  2⤵
  PID:9296
- C:\Windows\System\wQugCPv.exe
  C:\Windows\System\wQugCPv.exe
  2⤵
  PID:9348
- C:\Windows\System\FLdJxie.exe
  C:\Windows\System\FLdJxie.exe
  2⤵
  PID:9376
- C:\Windows\System\fgzGEMu.exe
  C:\Windows\System\fgzGEMu.exe
  2⤵
  PID:9396
- C:\Windows\System\aKslEOP.exe
  C:\Windows\System\aKslEOP.exe
  2⤵
  PID:9472
- C:\Windows\System\RZRhMsL.exe
  C:\Windows\System\RZRhMsL.exe
  2⤵
  PID:9536
- C:\Windows\System\HsuhmlB.exe
  C:\Windows\System\HsuhmlB.exe
  2⤵
  PID:9572
- C:\Windows\System\kzaadts.exe
  C:\Windows\System\kzaadts.exe
  2⤵
  PID:9428
- C:\Windows\System\GjiCRMx.exe
  C:\Windows\System\GjiCRMx.exe
  2⤵
  PID:9524
- C:\Windows\System\CtNfCRO.exe
  C:\Windows\System\CtNfCRO.exe
  2⤵
  PID:9604
- C:\Windows\System\QSnZMre.exe
  C:\Windows\System\QSnZMre.exe
  2⤵
  PID:9636
- C:\Windows\System\ctxTYSI.exe
  C:\Windows\System\ctxTYSI.exe
  2⤵
  PID:9696
- C:\Windows\System\WdYenzj.exe
  C:\Windows\System\WdYenzj.exe
  2⤵
  PID:9732
- C:\Windows\System\GnHVpAF.exe
  C:\Windows\System\GnHVpAF.exe
  2⤵
  PID:9796
- C:\Windows\System\pdExUBz.exe
  C:\Windows\System\pdExUBz.exe
  2⤵
  PID:9828
- C:\Windows\System\ngIxtSw.exe
  C:\Windows\System\ngIxtSw.exe
  2⤵
  PID:9812
- C:\Windows\System\ZAMGkCB.exe
  C:\Windows\System\ZAMGkCB.exe
  2⤵
  PID:9816
- C:\Windows\System\BaPmzfs.exe
  C:\Windows\System\BaPmzfs.exe
  2⤵
  PID:9864
- C:\Windows\System\pXfcxWZ.exe
  C:\Windows\System\pXfcxWZ.exe
  2⤵
  PID:9896
- C:\Windows\System\EABvWxV.exe
  C:\Windows\System\EABvWxV.exe
  2⤵
  PID:9912
- C:\Windows\System\DnzWdJy.exe
  C:\Windows\System\DnzWdJy.exe
  2⤵
  PID:9992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BjhBDef.exe

Filesize
885KB

MD5
0503be39f364ba6c7e354ca1052cd0d3

SHA1
cb5a1a3a56d7f31f91e7685aedcf2108a4416c49

SHA256
42fe73ff9708cc26f8095ac121d444c2a48b3d370077cb01dd9b92bba2d4fd1b

SHA512
b98b98194f44027f8dce25193422e1e0aa1d1be4b945eaca55b12c2b0572001b62ec0d5cc53b55d7ce0721ea62e8627702e81c771099bd5d6ff3654174d32c25

Download Submit
C:\Windows\system\DMQIBiT.exe

Filesize
885KB

MD5
22acdfaf55a22bcdb4a30f5688a5b0d7

SHA1
776331ce4b31999afe9190c793462e1b24592085

SHA256
e444203759e23cdfc834eadfab22ec2f41238adb7b556db3cfb706c9179d543d

SHA512
53a10a9a7b86b448e3c00dd8163f0928a5526ecb43445f063a116bc07d65ebc8b17de83117ed6b03604e19164e904e69c0a288c3822885c187a2d1a156e0b6ed

Download Submit
C:\Windows\system\EkdRNJl.exe

Filesize
887KB

MD5
b0e7b346808ad41e4dd02f2320032b19

SHA1
c3ca3f058836a81fa77316c5ab324a7cbd6f352d

SHA256
73503b96e1808ec66f9e6af3eff55d1f4269b211c289ca1404519d5494864d02

SHA512
c0ca576d1eed4d549de6c098f2a33508837e161c99d74c63ba1252033eeb624aa2b396c511e54c9daac9c24f5b4f17d3a75e4a882d85c8bf766c806019f1f85f

Download Submit
C:\Windows\system\FnBKEZz.exe

Filesize
881KB

MD5
61b50221a4eed9f86e27d59df29f15f6

SHA1
ef05b67f9dfd6cfe93917dbe7424a0d964adfaed

SHA256
d1d11606fd097d8f6a50e32dc26c07f2b82eef2ab528fc4cbf096564a33a6e74

SHA512
5d652864411cf7d272a4e7b461a4225af82f85c899292b9192578b2a506aedfc6e824954e8bc0e7646ba1e909a1a034a88323e078ae8d1d725ed540ae2b74b85

Download Submit
C:\Windows\system\GCotTGC.exe

Filesize
883KB

MD5
6458d01f1377ca85c4fa8e7ef6f7c273

SHA1
c561393b99c3a17b3bd4a2037eb29d744d886265

SHA256
3b81a9136ed33b19508a3b5425bc4c3cc2ff4d772b0b6cf13d8025130dd3ec77

SHA512
1d642c85349a2620aeb75b4ef794bd2e4866ea8c3df63214292ac816d27688fdeef51991ddd1ab7d75be48171bf201d9f7426721bf67170d58e21190faa8e10b

Download Submit
C:\Windows\system\IdXTKDc.exe

Filesize
887KB

MD5
420e7e915b96a12c2107a651724414e9

SHA1
e63effcf068a659b85721aeadab98727e3708932

SHA256
ea653403db69343892c72a4f014c60b402c47945a97af6fe142933938e176ea1

SHA512
9941da76fbf150a1bb3a5b8eddcd34a97687d9ace21e36ded5ab4edb822a05419320b3e99b11ac6b3314349715cc7224f21a3531f8c690f09e93a07b0142885d

Download Submit
C:\Windows\system\JGscBDf.exe

Filesize
887KB

MD5
c1034f4d4de621f610063ac8b90fcad6

SHA1
bdbf493076af82b331449f8cdd880b398d0cc2b0

SHA256
f70428c58b0d335038404e711b507462831adc8227e71c695fedc9b101ad5531

SHA512
ee012101599dfc3c6aa9aac8ecc558f9b7413df4c03e7a44069d80d0b31598b0da491799f0295b7dc7a9900e49f326b7d33e438bec31f5d44fc77d826031d1c9

Download Submit
C:\Windows\system\JLDvOwd.exe

Filesize
880KB

MD5
0aa8429cdf8cf7ae51d81ffd80580fd9

SHA1
7aea7bf4819574dee11e85c6a16e7b0d25826d1b

SHA256
51f5bd1ae5a40f0a7988af6d05aa883972aeb6ecf5373b1e4a93f0dd8c13d913

SHA512
2f1fa3afee34396cb07d72ed6fb88165d5031f2d030992ebb1725a34ea0a20ba8f8639d47cbb41391df3a340cd1a94b03fa24f052e06d95428dac694584a4377

Download Submit
C:\Windows\system\JscYYCn.exe

Filesize
881KB

MD5
3dac973252355b68770a7d640dc41d86

SHA1
90b7e4699ca5427ce5dafbc82a0f92e3bc581b0d

SHA256
295215813ecd6d10d4fc5af6a87e6aa7d6aa7c05ed1f023514c9e7e0dff77ead

SHA512
022673b1e0be4b7b7f47349e48ddf61ad3b327497bcb5be830b69852040c4da0a2c35bbf8532464d180f52a8e297e6d8b3a515ccefa01917a3ed510a0587a42e

Download Submit
C:\Windows\system\LHLRgfj.exe

Filesize
884KB

MD5
1b4a598fd750a2f7156198647a6e5e82

SHA1
fe2d9caa5782cfa9df22d730833fcf2d45fccdc7

SHA256
f56b6d9082b76d94a08cd70d090bf0ad740f59febd8c3dd1d7dbc6f5a0afd813

SHA512
5ac178b4a2f19cd5b38d3f3201d0a5b856e8886f8c20cf33cb01162fa5600a81eb8d7bbdb60f39bc2da33fc6f71512fd90377b87c3c4db2afbefc072b47b3552

Download Submit
C:\Windows\system\LLOXaZP.exe

Filesize
885KB

MD5
f99ef5a88b953159d209a954caed3cc8

SHA1
f87bb5da7b00e8faff6a87d8e1be348a5c4aabe5

SHA256
b10234e6087d5598f494af173156e5f5d029229306a4d5c5997edffc305c94d8

SHA512
628a03dae312720908bc0526ac8495ef8d3bb80055a1b24891023dba8b07cf63f7110c3cbcf2f1d7a3a42c19df0a60a315db3bdd7471767ff20c4fc1b3a42604

Download Submit
C:\Windows\system\MZBexLy.exe

Filesize
888KB

MD5
65f96b05d6fa930e1b0c9cd60f39db94

SHA1
03512cbc3bedc5fca2b0fa780daadf1829a8bfe9

SHA256
3b398e3b1410a09ef051b4f68b20c8425b07aaafd6e4a9ce68fcfeff8401d381

SHA512
9ce8d24a9a2c6cdc33e3dfb7778912464e2e6120ac740ca5523dcb0de3b55941e2869e3a20a2c9e9b05b9c478ac9f0deed397f31d42972f766543c25a901dc53

Download Submit
C:\Windows\system\PhYkUSx.exe

Filesize
886KB

MD5
9a6010189ca0e857bd905f4dbb8df19a

SHA1
c7aa516869a93bcd217c60e553cf8a4688c08e88

SHA256
0e1c49b91a2a9fbda517702732b84d2f1210120ababb5b54aea512f729afe610

SHA512
07e13f5a734de0c03cb34a817ebfc47c57ac07aa4fc3937e5984af7cbadafcff08025ce632af83d82fdda240c20c11f4cd07ad9e829aa99b6dcd892118457d89

Download Submit
C:\Windows\system\Qgxtbcx.exe

Filesize
882KB

MD5
66030b9638010ee00025e19dca9f8b8c

SHA1
f519ed9ab4973a2f34d6748497c90fdcb4a8bef2

SHA256
c14dbc8a2b9cb0fe6adf39b0579ff2867cb48ae723537681b59bd66fa9af8afd

SHA512
2f6480f9b72501136045ce329c5b16a5e4d26c4a7f26fae77f6024b2dacccb86197823b9645226009bfcdb9d2e678cdece8c10a44d57ddd9c2761ae61b4275f6

Download Submit
C:\Windows\system\RBKTBjC.exe

Filesize
886KB

MD5
08abe8a31419f5cc1e89cc861de3f25c

SHA1
4cee11e19777ba78ca8d49aca3ad4a354ce9e4f0

SHA256
35bef94ca33466051c1faae7cba34ae6883ac6ddadba13615ff1d966c0e7d1dc

SHA512
b0c574e280e6ca98324b6cc42c7316c2da4f21fc65863ed23501753c2751689861b445e41177df990b547c269b423be01736e2e92dc4d5bd75f4d7e020363680

Download Submit
C:\Windows\system\VfiNkos.exe

Filesize
881KB

MD5
bae2022d15bd1507180853c70529fbec

SHA1
f45330bd2703f3c84002402d9e8b06a6c22bbd5a

SHA256
8df43f98e75f994c26ec625e18f9bbd207d45992bbac783f5ac037ee7a9f1794

SHA512
af75b54171afc7bdbf5fc73b2b0ad9360c29d1296c1abb20f2b8cb1d7d41ecc5d521275069f5b83f6c853db6815d0af02756675948ea98a06cdbbcd6ed449ec9

Download Submit
C:\Windows\system\WmdlSUr.exe

Filesize
884KB

MD5
065c1388f31ef78c58fd5317ec36f3b0

SHA1
c59ccf51e358310f57b91a590e8980c06349af5d

SHA256
732975fb1eabfe09994ea745437ad5992fd8dd6f3d79fac381930c4862648a8b

SHA512
f4f52ea6620229f3c4bed92390b9ba941def94acba091e9ddeae8e50217dde60d28a1c23d712b80f4ebaf4bc9fc9c805d9fb968b13dc89d1f8610ba32d109e28

Download Submit
C:\Windows\system\XjfUhZg.exe

Filesize
884KB

MD5
8b06fe774c386c8955a70fb83c459314

SHA1
387e4162be92d5bbd00c6f28e89bedb7077081f2

SHA256
dc324103b4876aa1dd822870c42e5959aaf4fda4706145c05e491ff209136af5

SHA512
572676ba26421bca87d609c4ce293b615571b2815aec8ec4285346cfea1866f1d92ae535a2649a6649039659c95f288e4db8b54410265e38c0edbe718f4f8301

Download Submit
C:\Windows\system\abHAbMa.exe

Filesize
883KB

MD5
a5c00bc44c7860301a8d01a506e98445

SHA1
2c1e97e76d9c59a569e80df3ca1980e246747224

SHA256
3d15d464b709805462ebc44ae8ad10e0ec6c9405dc83c4f89267f9c3b05245c2

SHA512
5dc227b18a9a8ef137590d158f50ee20bbf8367b0a687172c988d611107790b5af325e3f3c04718c25993b828f8c54dbc8d71f0c2d6f97b3b52f0a024512bc98

Download Submit
C:\Windows\system\bMAPMTL.exe

Filesize
883KB

MD5
b2c62c525f60cea748f442ef1071aea0

SHA1
9620508b1695ffc184e9def4efb6e1c759b07403

SHA256
15ee74499e8ececd6c6e63ff768b190414561f04275dfe648d113cb84c61096a

SHA512
4ba7cb454fb94fbc325df6e22e9f0cf13cd52ea70e143b56e93c6cd71d59e0ea1f20571e60fdb72938f131a92fae5500995c534892b4e5f1d06ebd3fd4ca69f1

Download Submit
C:\Windows\system\cwTLkme.exe

Filesize
882KB

MD5
b73cb40a9a94c41ccb55d1f52e84aac1

SHA1
b3d94f6d42d8e2dab484ebe8600c8f66e0463af0

SHA256
831cb63d942a279cda8cfe8edb7424ef283a354342137c65c89a1b10900b5655

SHA512
ae16bef92c82010cb0bd3e4ceda482e0efd3482a8ac414a237e6ee425baeb8f7d288b1973b44256c07d231b41dc1841cce08499159d73f4ad163cd256669e594

Download Submit
C:\Windows\system\febBpgd.exe

Filesize
886KB

MD5
10a69951bfc8b68ae776c5284416f5f0

SHA1
28ee47e107dce5691435f0f8cdf7c8314da3cc2b

SHA256
179306a76c07a0fb457dc857801b48eff7fa4b79400f61dc3ec6ecdfbae5a936

SHA512
d2f77e87474da93cc860f9361977e72ba4fb6e2cd3166fa847324c19802a825ce8987974b838cb89fbf56e1b9d73336aa1d35e6e5515e71b01e353de941c0a76

Download Submit
C:\Windows\system\iejLVOF.exe

Filesize
885KB

MD5
bbc046ee4aa11cdfbcd07c7969bd7c2c

SHA1
2654afa252d109212afe630f1d3523b3e69b5a16

SHA256
7e71abde50bb33eeca2b3f6e21a7a563a42d01d0a78152660c01cc9243b908ef

SHA512
4d9f896c64843ed45f707ba69aef1e3d9f086469d8a0e00fccc94e44bac0a2f71dee23f0be1441ab6d75e378bfc2cc281e064ac1de11acfc33356f38d41dbc26

Download Submit
C:\Windows\system\jvBSFjp.exe

Filesize
883KB

MD5
0d6084dbf7b9478b89335420a8cba42a

SHA1
654e0554fb15bf36c932333ed35ba7804a0cd1c8

SHA256
8e980d36ba71864b2fa8c841896230cba20c9211891474184a7077543d196e24

SHA512
61bdebf2835c114e0c79981f4d9fe63aa509d9dfed18b3a2fd4cc69572a4984699e66f1775e81c363c110fee16b36375e0f82605b06502c2995e1319d6e02e64

Download Submit
C:\Windows\system\mOSpjbq.exe

Filesize
886KB

MD5
8534ad8830b28febfd2a8adc6cff6e02

SHA1
72e43279388f4108791287e27df93e2d39a78fd0

SHA256
0aee2aa11f6de448eb0100b8974a3c28c809eb6ebf612caf5c03063d5a6b2fe3

SHA512
9093e143106747a5096474d9464186989680636701c4f67d48451e768a8d5e562a8f6aeb5957fc7caf76d5d54ce0d025624c86a5e1642d4e234e93fe65670116

Download Submit
C:\Windows\system\nCDstXx.exe

Filesize
887KB

MD5
24c0d2c3557f8b34a28ee36b22c3d61e

SHA1
61eeff451c10c32d1a03003c4e81e72c42936999

SHA256
12b1e78cb36618f7ff79c2e762e308a312669317a7b233516fc30e80d3294a43

SHA512
a633ba5c40b261c7a1d10d4059541dee599de0e5456a72acd0b8a24c7baf1faa0050e13771e9569b7ff7224198b58443c5064b005caf76a81b236bbf753d585b

Download Submit
C:\Windows\system\nSxTrhT.exe

Filesize
884KB

MD5
38cd8bd7f2b2e0280fad43f69b881692

SHA1
89d922b6ad61471ac2f579a209eedc202ada2564

SHA256
62cf06633af20b8f83a1985b768596852d8cafe02352a21317291160ab72a8ed

SHA512
778c46b3f618edf3fab7555072b5135bd35ca55f9fc7dcf60905c1fe7445640117a52688df256fc2440c6b1db74e1f09e3662d0ec2551d5f09a22cca25003978

Download Submit
C:\Windows\system\rzrQfOt.exe

Filesize
880KB

MD5
500a00eaeba7b1449724bf483c4cea63

SHA1
24c86db365343688b7cb76e53e62c58902966b92

SHA256
8579fccdb31c204980c507b8c49a6c36cd1b42978cffbbe71d5c78581045eb3a

SHA512
cbb83746525fa1a89ff4327ca806af515eb80ff65959d6dec5d1acd885de7a2f9e30d160cfe4aef0a8356585530dcb09a8cf8d6ffb1954910af8708c0193a244

Download Submit
C:\Windows\system\yAUJxmf.exe

Filesize
882KB

MD5
d3077fbe264b8b726f65e1c2d20a56b0

SHA1
fb6165fc63f8ae9aa5e11a290bb7f59dfc2766cb

SHA256
605542f5ff03591706da8453d2390856c8cfe5f0bf21cc820b0f363774b84864

SHA512
ed71702671206e05fdd027fe93f3b551c9af14cf04b5ea9e14c2616cf95443e56046e8ce2728b1309f9a81e58246931286c54aab3d558f5bc937c93613f72905

Download Submit
\Windows\system\FAGvCDs.exe

Filesize
882KB

MD5
e7c0c2a26f440c17bcf0d085645c54f5

SHA1
3b17d103a40c97d82dc00d0a4cf3fe06790f2311

SHA256
04d27bedd3073cbdfdfe7f151e02548e3ee54cf84f1c5d67ab809755f1ba5398

SHA512
e9ad44651fcac91589b4c67fe7acc6c9f1088516009e7bc9e5a784997be1b5e3ebd2e5529dab6f6b0eba11e57fb7c85dc0f801bd201c10b88ebbf88801993dcc

Download Submit
\Windows\system\GXANFyc.exe

Filesize
883KB

MD5
1ee8823d168bc2fb9467b9400d0d6493

SHA1
fe08ba33c5a14f80b61c455685bb8739c3e95a69

SHA256
a69c26fda348fa53e77f74203f6e97087dfa29fab1662ac9ef08ad49e64ad7ee

SHA512
f04b47ba3e2b73b176edf47224e57d85ae738f2eb725b9fa2e47c30b693ba4d81ce0b54cc4483ffc02a24f99cf3caea161a6f30af17093363bda722500545905

Download Submit
\Windows\system\xVyZfRb.exe

Filesize
881KB

MD5
ff0a7c013bdb44175b25be735c151ef1

SHA1
f7da40fa13acab1f3d221bfc17721bc1c59d0072

SHA256
e4a1f260458effcba486ac5c4343205b80e8117026682e36cdf395b938cb2295

SHA512
e233ad9aeafb92eadbca9455708d240e36ec09868581421c76015794567c963fc04dd498284d866fe36d001dd34215f39efb33c2c7415bcc39e817debae85cfd

Download Submit
memory/1684-83-0x000000013F800000-0x000000013FB51000-memory.dmp

Filesize
3.3MB

Download
memory/1684-4218-0x000000013F800000-0x000000013FB51000-memory.dmp

Filesize
3.3MB

Download
memory/1684-4187-0x000000013F800000-0x000000013FB51000-memory.dmp

Filesize
3.3MB

Download
memory/1688-77-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/1688-4216-0x000000013F840000-0x000000013FB91000-memory.dmp

Filesize
3.3MB

Download
memory/1720-4198-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/1720-19-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2208-3845-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-99-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-42-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-103-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-22-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-54-0x000000013FF70000-0x00000001402C1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-33-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-106-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-2265-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-104-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-2077-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-37-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-21-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-88-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-82-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2208-0-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-12-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-67-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-554-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2208-61-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2208-555-0x0000000001DF0000-0x0000000002141000-memory.dmp

Filesize
3.3MB

Download
memory/2344-17-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/2344-4196-0x000000013FD90000-0x00000001400E1000-memory.dmp

Filesize
3.3MB

Download
memory/2452-4214-0x000000013F0D0000-0x000000013F421000-memory.dmp

Filesize
3.3MB

Download
memory/2452-76-0x000000013F0D0000-0x000000013F421000-memory.dmp

Filesize
3.3MB

Download
memory/2480-73-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2480-4210-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2548-44-0x000000013F670000-0x000000013F9C1000-memory.dmp

Filesize
3.3MB

Download
memory/2548-2275-0x000000013F670000-0x000000013F9C1000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4206-0x000000013F670000-0x000000013F9C1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-34-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4202-0x000000013F960000-0x000000013FCB1000-memory.dmp

Filesize
3.3MB

Download
memory/2660-36-0x000000013F790000-0x000000013FAE1000-memory.dmp

Filesize
3.3MB

Download
memory/2660-4204-0x000000013F790000-0x000000013FAE1000-memory.dmp

Filesize
3.3MB

Download
memory/2692-4208-0x000000013FF70000-0x00000001402C1000-memory.dmp

Filesize
3.3MB

Download
memory/2692-58-0x000000013FF70000-0x00000001402C1000-memory.dmp

Filesize
3.3MB

Download
memory/2792-4212-0x000000013F5B0000-0x000000013F901000-memory.dmp

Filesize
3.3MB

Download
memory/2792-74-0x000000013F5B0000-0x000000013F901000-memory.dmp

Filesize
3.3MB

Download
memory/2832-105-0x000000013F680000-0x000000013F9D1000-memory.dmp

Filesize
3.3MB

Download
memory/2832-4222-0x000000013F680000-0x000000013F9D1000-memory.dmp

Filesize
3.3MB

Download
memory/2844-101-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2844-4221-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/3012-4200-0x000000013F2D0000-0x000000013F621000-memory.dmp

Filesize
3.3MB

Download
memory/3012-23-0x000000013F2D0000-0x000000013F621000-memory.dmp

Filesize
3.3MB

Download