xmrig | ab7fd1c4783f79c1b334f8597b8ead53b51a169a45cdd3bcf3178bfa753d382e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb30916d61d1399e74bbee658c118230_NEIKI.exe
Size

1.8MB
MD5

fb30916d61d1399e74bbee658c118230
SHA1

5d43823b6a87cd17ab37b1de575eb7519a9ff736
SHA256

ab7fd1c4783f79c1b334f8597b8ead53b51a169a45cdd3bcf3178bfa753d382e
SHA512

f75f33eaa979d48960e16e4af3100515dae37488ce598675b055ef6be24eaa1ce0caf77524db65ec1539114f56f68f73e23ad72a1fae86ee5865a2a56edcdc00
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wICbdhDLL4Kw:BemTLkNdfE0pZrN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2192-0-0x000000013F280000-0x000000013F5D4000-memory.dmp	xmrig
behavioral1/files/0x0034000000013a53-7.dat	xmrig
behavioral1/files/0x000700000001431b-32.dat	xmrig
behavioral1/memory/1144-51-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/files/0x0006000000014bd7-52.dat	xmrig
behavioral1/files/0x0006000000014f57-71.dat	xmrig
behavioral1/memory/2864-79-0x000000013F090000-0x000000013F3E4000-memory.dmp	xmrig
behavioral1/memory/2596-83-0x000000013F520000-0x000000013F874000-memory.dmp	xmrig
behavioral1/memory/2464-86-0x000000013FFE0000-0x0000000140334000-memory.dmp	xmrig
behavioral1/memory/2684-85-0x000000013FFF0000-0x0000000140344000-memory.dmp	xmrig
behavioral1/memory/2288-78-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2192-77-0x000000013FFF0000-0x0000000140344000-memory.dmp	xmrig
behavioral1/memory/2460-76-0x000000013F740000-0x000000013FA94000-memory.dmp	xmrig
behavioral1/memory/2576-73-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/memory/3056-72-0x000000013FA80000-0x000000013FDD4000-memory.dmp	xmrig
behavioral1/memory/2868-70-0x000000013F6E0000-0x000000013FA34000-memory.dmp	xmrig
behavioral1/files/0x0006000000014c2d-66.dat	xmrig
behavioral1/memory/2540-64-0x000000013F1D0000-0x000000013F524000-memory.dmp	xmrig
behavioral1/files/0x000600000001507a-90.dat	xmrig
behavioral1/memory/2192-98-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig
behavioral1/memory/2264-100-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig
behavioral1/files/0x00060000000153ee-109.dat	xmrig
behavioral1/files/0x000600000001565a-119.dat	xmrig
behavioral1/files/0x00060000000150d9-110.dat	xmrig
behavioral1/files/0x0006000000015083-103.dat	xmrig
behavioral1/files/0x0034000000013a88-97.dat	xmrig
behavioral1/memory/2832-96-0x000000013FFB0000-0x0000000140304000-memory.dmp	xmrig
behavioral1/files/0x0006000000015662-124.dat	xmrig
behavioral1/files/0x0006000000015b50-139.dat	xmrig
behavioral1/files/0x0006000000015c9a-146.dat	xmrig
behavioral1/files/0x0006000000015cb1-158.dat	xmrig
behavioral1/files/0x0006000000015cd2-166.dat	xmrig
behavioral1/files/0x0006000000015cc5-164.dat	xmrig
behavioral1/files/0x0006000000015cee-177.dat	xmrig
behavioral1/memory/2192-2508-0x000000013F280000-0x000000013F5D4000-memory.dmp	xmrig
behavioral1/memory/2264-3397-0x000000013FBF0000-0x000000013FF44000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d0a-188.dat	xmrig
behavioral1/files/0x0006000000015d0a-186.dat	xmrig
behavioral1/files/0x0006000000015cf8-183.dat	xmrig
behavioral1/files/0x0006000000015cee-175.dat	xmrig
behavioral1/files/0x0006000000015ce3-174.dat	xmrig
behavioral1/files/0x0006000000015ca8-153.dat	xmrig
behavioral1/files/0x0006000000015b85-144.dat	xmrig
behavioral1/files/0x0006000000015ae3-134.dat	xmrig
behavioral1/files/0x00060000000158d9-128.dat	xmrig
behavioral1/files/0x0006000000014b1c-50.dat	xmrig
behavioral1/files/0x0007000000014a60-44.dat	xmrig
behavioral1/files/0x0008000000014367-39.dat	xmrig
behavioral1/memory/1740-29-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/files/0x000700000001418c-27.dat	xmrig
behavioral1/files/0x0007000000014183-9.dat	xmrig
behavioral1/files/0x0007000000014251-25.dat	xmrig
behavioral1/files/0x000b000000013417-5.dat	xmrig
behavioral1/memory/1740-4006-0x000000013FED0000-0x0000000140224000-memory.dmp	xmrig
behavioral1/memory/2288-4007-0x000000013FCE0000-0x0000000140034000-memory.dmp	xmrig
behavioral1/memory/2864-4008-0x000000013F090000-0x000000013F3E4000-memory.dmp	xmrig
behavioral1/memory/2540-4009-0x000000013F1D0000-0x000000013F524000-memory.dmp	xmrig
behavioral1/memory/2596-4014-0x000000013F520000-0x000000013F874000-memory.dmp	xmrig
behavioral1/memory/2460-4013-0x000000013F740000-0x000000013FA94000-memory.dmp	xmrig
behavioral1/memory/2576-4012-0x000000013F680000-0x000000013F9D4000-memory.dmp	xmrig
behavioral1/memory/1144-4011-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/2868-4010-0x000000013F6E0000-0x000000013FA34000-memory.dmp	xmrig
behavioral1/memory/2684-4015-0x000000013FFF0000-0x0000000140344000-memory.dmp	xmrig
behavioral1/memory/2464-4017-0x000000013FFE0000-0x0000000140334000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1740	PCXvtfV.exe
2288	nUlnRWk.exe
1144	zLmeUGz.exe
2864	MxpJYkW.exe
2540	QPSgUIv.exe
2868	qVnnOhS.exe
3056	olSCggG.exe
2576	afYmYyk.exe
2460	qSJdjzo.exe
2596	QjKBLLy.exe
2684	hkKxNmp.exe
2464	rUvkXcW.exe
2832	NVTyvvg.exe
2264	IpOgUOC.exe
1916	bXWfZzD.exe
1908	VGvrCLA.exe
1860	wFuNaQO.exe
1436	sykToBf.exe
2500	xAvTAfs.exe
2756	HSHtivV.exe
384	bgIVzxg.exe
1500	kybfwUX.exe
1288	xXAGnKb.exe
1732	gtPhdwo.exe
2248	vvTSeUm.exe
2808	zFOtKQW.exe
2664	dKKsVow.exe
1984	ZcDArgU.exe
324	xdQUkhK.exe
448	rpALyuU.exe
1488	XIcOZZD.exe
620	awtCzDV.exe
2252	vqnvjrk.exe
1796	FDAwHhc.exe
2404	CcEbENr.exe
2164	AxKLXoQ.exe
1300	rKusnoj.exe
1656	bPbAdYL.exe
3048	bGUeWyp.exe
1768	yqrYyGW.exe
1056	igmqVyI.exe
780	esRKbCG.exe
1864	jIXaetk.exe
2908	LCZawnC.exe
1784	HgMjTTY.exe
968	FtTcQzu.exe
2140	LJuCbpl.exe
2336	JOZVjZh.exe
2300	DLFogBj.exe
2008	CmQkyAf.exe
3008	lXDdNnl.exe
1308	szfAxJx.exe
1980	HVEgHJv.exe
2144	FaKijIx.exe
548	quMiTaF.exe
2968	QBTSkkt.exe
1608	qFrQYSI.exe
1700	Ulzdiqf.exe
3020	UddXaCi.exe
2572	ZpkrNaC.exe
2440	DIaSwRl.exe
2800	DcHKAEv.exe
1748	nfzrbBC.exe
2436	PUzYBcz.exe

Loads dropped DLL 64 IoCs

pid	Process
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe
2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-0-0x000000013F280000-0x000000013F5D4000-memory.dmp	upx
behavioral1/files/0x0034000000013a53-7.dat	upx
behavioral1/files/0x000700000001431b-32.dat	upx
behavioral1/memory/1144-51-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/files/0x0006000000014bd7-52.dat	upx
behavioral1/files/0x0006000000014f57-71.dat	upx
behavioral1/memory/2864-79-0x000000013F090000-0x000000013F3E4000-memory.dmp	upx
behavioral1/memory/2596-83-0x000000013F520000-0x000000013F874000-memory.dmp	upx
behavioral1/memory/2464-86-0x000000013FFE0000-0x0000000140334000-memory.dmp	upx
behavioral1/memory/2684-85-0x000000013FFF0000-0x0000000140344000-memory.dmp	upx
behavioral1/memory/2288-78-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2460-76-0x000000013F740000-0x000000013FA94000-memory.dmp	upx
behavioral1/memory/2576-73-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/memory/3056-72-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2868-70-0x000000013F6E0000-0x000000013FA34000-memory.dmp	upx
behavioral1/files/0x0006000000014c2d-66.dat	upx
behavioral1/memory/2540-64-0x000000013F1D0000-0x000000013F524000-memory.dmp	upx
behavioral1/files/0x000600000001507a-90.dat	upx
behavioral1/memory/2264-100-0x000000013FBF0000-0x000000013FF44000-memory.dmp	upx
behavioral1/files/0x00060000000153ee-109.dat	upx
behavioral1/files/0x000600000001565a-119.dat	upx
behavioral1/files/0x00060000000150d9-110.dat	upx
behavioral1/files/0x0006000000015083-103.dat	upx
behavioral1/files/0x0034000000013a88-97.dat	upx
behavioral1/memory/2832-96-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx
behavioral1/files/0x0006000000015662-124.dat	upx
behavioral1/files/0x0006000000015b50-139.dat	upx
behavioral1/files/0x0006000000015c9a-146.dat	upx
behavioral1/files/0x0006000000015cb1-158.dat	upx
behavioral1/files/0x0006000000015cd2-166.dat	upx
behavioral1/files/0x0006000000015cc5-164.dat	upx
behavioral1/files/0x0006000000015cee-177.dat	upx
behavioral1/memory/2192-2508-0x000000013F280000-0x000000013F5D4000-memory.dmp	upx
behavioral1/memory/2264-3397-0x000000013FBF0000-0x000000013FF44000-memory.dmp	upx
behavioral1/files/0x0006000000015d0a-188.dat	upx
behavioral1/files/0x0006000000015d0a-186.dat	upx
behavioral1/files/0x0006000000015cf8-183.dat	upx
behavioral1/files/0x0006000000015cee-175.dat	upx
behavioral1/files/0x0006000000015ce3-174.dat	upx
behavioral1/files/0x0006000000015ca8-153.dat	upx
behavioral1/files/0x0006000000015b85-144.dat	upx
behavioral1/files/0x0006000000015ae3-134.dat	upx
behavioral1/files/0x00060000000158d9-128.dat	upx
behavioral1/files/0x0006000000014b1c-50.dat	upx
behavioral1/files/0x0007000000014a60-44.dat	upx
behavioral1/files/0x0008000000014367-39.dat	upx
behavioral1/memory/1740-29-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/files/0x000700000001418c-27.dat	upx
behavioral1/files/0x0007000000014183-9.dat	upx
behavioral1/files/0x0007000000014251-25.dat	upx
behavioral1/files/0x000b000000013417-5.dat	upx
behavioral1/memory/1740-4006-0x000000013FED0000-0x0000000140224000-memory.dmp	upx
behavioral1/memory/2288-4007-0x000000013FCE0000-0x0000000140034000-memory.dmp	upx
behavioral1/memory/2864-4008-0x000000013F090000-0x000000013F3E4000-memory.dmp	upx
behavioral1/memory/2540-4009-0x000000013F1D0000-0x000000013F524000-memory.dmp	upx
behavioral1/memory/2596-4014-0x000000013F520000-0x000000013F874000-memory.dmp	upx
behavioral1/memory/2460-4013-0x000000013F740000-0x000000013FA94000-memory.dmp	upx
behavioral1/memory/2576-4012-0x000000013F680000-0x000000013F9D4000-memory.dmp	upx
behavioral1/memory/1144-4011-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/2868-4010-0x000000013F6E0000-0x000000013FA34000-memory.dmp	upx
behavioral1/memory/2684-4015-0x000000013FFF0000-0x0000000140344000-memory.dmp	upx
behavioral1/memory/2464-4017-0x000000013FFE0000-0x0000000140334000-memory.dmp	upx
behavioral1/memory/3056-4016-0x000000013FA80000-0x000000013FDD4000-memory.dmp	upx
behavioral1/memory/2832-4018-0x000000013FFB0000-0x0000000140304000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AxKLXoQ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\svmxldF.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\eoJqfuT.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\kXVmWaO.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ZqRiHqY.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\qTgjbRQ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ttdNXAz.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\VxbNRnQ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\cCBtfGC.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\lboafDT.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\lNOrWFC.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\mqCcZRp.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ycoSmqi.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\EnOVLib.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\vrLkmIZ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\CckRiNg.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\MiROPgR.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\sEaDFZx.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\amBxiys.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\bmmNFBA.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ynsvayD.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\DvIumbR.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ZYAxfmy.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\DfOrhcV.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ULVoTnK.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\AdtGrJe.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\PpZytnl.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\NgkHYsH.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\kLtaoUG.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ROOInYg.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\KMtRWTN.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\hAwTyLG.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\xClRIuR.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ZcDArgU.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\daIchJe.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\spXumMf.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\oJRwENu.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\VPUFWcH.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\tmEnxEt.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\WLiNCaJ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\LrhBcrz.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\UddXaCi.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\jdBUWfy.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\YoDKPTd.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\WpjHxCJ.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\gujpuGe.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\XOaxdpy.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\hxatKVx.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\chchiId.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\xXAGnKb.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\XmYJvBK.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\uUnrsYe.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\jZtsSwj.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ubcCZYa.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\ORSXPlK.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\srpJKnq.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\JVWYmNS.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\CnnjkBT.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\tVxOGKT.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\yNRoxGV.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\KBAozWr.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\acARUhW.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\pkvvWTX.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe
File created	C:\Windows\System\WmxcvKk.exe	fb30916d61d1399e74bbee658c118230_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1740	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	29
PID 2192 wrote to memory of 1740	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	29
PID 2192 wrote to memory of 1740	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	29
PID 2192 wrote to memory of 2288	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	30
PID 2192 wrote to memory of 2288	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	30
PID 2192 wrote to memory of 2288	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	30
PID 2192 wrote to memory of 1144	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	31
PID 2192 wrote to memory of 1144	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	31
PID 2192 wrote to memory of 1144	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	31
PID 2192 wrote to memory of 2540	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	32
PID 2192 wrote to memory of 2540	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	32
PID 2192 wrote to memory of 2540	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	32
PID 2192 wrote to memory of 2864	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	33
PID 2192 wrote to memory of 2864	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	33
PID 2192 wrote to memory of 2864	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	33
PID 2192 wrote to memory of 2868	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	34
PID 2192 wrote to memory of 2868	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	34
PID 2192 wrote to memory of 2868	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	34
PID 2192 wrote to memory of 3056	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	35
PID 2192 wrote to memory of 3056	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	35
PID 2192 wrote to memory of 3056	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	35
PID 2192 wrote to memory of 2576	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	36
PID 2192 wrote to memory of 2576	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	36
PID 2192 wrote to memory of 2576	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	36
PID 2192 wrote to memory of 2460	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	37
PID 2192 wrote to memory of 2460	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	37
PID 2192 wrote to memory of 2460	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	37
PID 2192 wrote to memory of 2596	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	38
PID 2192 wrote to memory of 2596	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	38
PID 2192 wrote to memory of 2596	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	38
PID 2192 wrote to memory of 2684	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	39
PID 2192 wrote to memory of 2684	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	39
PID 2192 wrote to memory of 2684	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	39
PID 2192 wrote to memory of 2464	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	40
PID 2192 wrote to memory of 2464	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	40
PID 2192 wrote to memory of 2464	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	40
PID 2192 wrote to memory of 2832	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	41
PID 2192 wrote to memory of 2832	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	41
PID 2192 wrote to memory of 2832	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	41
PID 2192 wrote to memory of 2264	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	42
PID 2192 wrote to memory of 2264	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	42
PID 2192 wrote to memory of 2264	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	42
PID 2192 wrote to memory of 1916	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	43
PID 2192 wrote to memory of 1916	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	43
PID 2192 wrote to memory of 1916	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	43
PID 2192 wrote to memory of 1908	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	44
PID 2192 wrote to memory of 1908	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	44
PID 2192 wrote to memory of 1908	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	44
PID 2192 wrote to memory of 1860	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	45
PID 2192 wrote to memory of 1860	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	45
PID 2192 wrote to memory of 1860	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	45
PID 2192 wrote to memory of 1436	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	46
PID 2192 wrote to memory of 1436	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	46
PID 2192 wrote to memory of 1436	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	46
PID 2192 wrote to memory of 2500	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	47
PID 2192 wrote to memory of 2500	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	47
PID 2192 wrote to memory of 2500	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	47
PID 2192 wrote to memory of 2756	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	48
PID 2192 wrote to memory of 2756	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	48
PID 2192 wrote to memory of 2756	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	48
PID 2192 wrote to memory of 384	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	49
PID 2192 wrote to memory of 384	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	49
PID 2192 wrote to memory of 384	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	49
PID 2192 wrote to memory of 1500	2192	fb30916d61d1399e74bbee658c118230_NEIKI.exe	50

C:\Users\Admin\AppData\Local\Temp\fb30916d61d1399e74bbee658c118230_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\fb30916d61d1399e74bbee658c118230_NEIKI.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System\PCXvtfV.exe
  C:\Windows\System\PCXvtfV.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\nUlnRWk.exe
  C:\Windows\System\nUlnRWk.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zLmeUGz.exe
  C:\Windows\System\zLmeUGz.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\QPSgUIv.exe
  C:\Windows\System\QPSgUIv.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\MxpJYkW.exe
  C:\Windows\System\MxpJYkW.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\qVnnOhS.exe
  C:\Windows\System\qVnnOhS.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\olSCggG.exe
  C:\Windows\System\olSCggG.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\afYmYyk.exe
  C:\Windows\System\afYmYyk.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\qSJdjzo.exe
  C:\Windows\System\qSJdjzo.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\QjKBLLy.exe
  C:\Windows\System\QjKBLLy.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\hkKxNmp.exe
  C:\Windows\System\hkKxNmp.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\rUvkXcW.exe
  C:\Windows\System\rUvkXcW.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\NVTyvvg.exe
  C:\Windows\System\NVTyvvg.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\IpOgUOC.exe
  C:\Windows\System\IpOgUOC.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\bXWfZzD.exe
  C:\Windows\System\bXWfZzD.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\VGvrCLA.exe
  C:\Windows\System\VGvrCLA.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\wFuNaQO.exe
  C:\Windows\System\wFuNaQO.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\sykToBf.exe
  C:\Windows\System\sykToBf.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\xAvTAfs.exe
  C:\Windows\System\xAvTAfs.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\HSHtivV.exe
  C:\Windows\System\HSHtivV.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\bgIVzxg.exe
  C:\Windows\System\bgIVzxg.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\kybfwUX.exe
  C:\Windows\System\kybfwUX.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\xXAGnKb.exe
  C:\Windows\System\xXAGnKb.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\gtPhdwo.exe
  C:\Windows\System\gtPhdwo.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\vvTSeUm.exe
  C:\Windows\System\vvTSeUm.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\zFOtKQW.exe
  C:\Windows\System\zFOtKQW.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\dKKsVow.exe
  C:\Windows\System\dKKsVow.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ZcDArgU.exe
  C:\Windows\System\ZcDArgU.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\xdQUkhK.exe
  C:\Windows\System\xdQUkhK.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\rpALyuU.exe
  C:\Windows\System\rpALyuU.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\XIcOZZD.exe
  C:\Windows\System\XIcOZZD.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\awtCzDV.exe
  C:\Windows\System\awtCzDV.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\vqnvjrk.exe
  C:\Windows\System\vqnvjrk.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\FDAwHhc.exe
  C:\Windows\System\FDAwHhc.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\CcEbENr.exe
  C:\Windows\System\CcEbENr.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\AxKLXoQ.exe
  C:\Windows\System\AxKLXoQ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\rKusnoj.exe
  C:\Windows\System\rKusnoj.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\bPbAdYL.exe
  C:\Windows\System\bPbAdYL.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\bGUeWyp.exe
  C:\Windows\System\bGUeWyp.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\yqrYyGW.exe
  C:\Windows\System\yqrYyGW.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\igmqVyI.exe
  C:\Windows\System\igmqVyI.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\esRKbCG.exe
  C:\Windows\System\esRKbCG.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\jIXaetk.exe
  C:\Windows\System\jIXaetk.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\LCZawnC.exe
  C:\Windows\System\LCZawnC.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\HgMjTTY.exe
  C:\Windows\System\HgMjTTY.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\FtTcQzu.exe
  C:\Windows\System\FtTcQzu.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\LJuCbpl.exe
  C:\Windows\System\LJuCbpl.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\JOZVjZh.exe
  C:\Windows\System\JOZVjZh.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\DLFogBj.exe
  C:\Windows\System\DLFogBj.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\CmQkyAf.exe
  C:\Windows\System\CmQkyAf.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\lXDdNnl.exe
  C:\Windows\System\lXDdNnl.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\szfAxJx.exe
  C:\Windows\System\szfAxJx.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\HVEgHJv.exe
  C:\Windows\System\HVEgHJv.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\FaKijIx.exe
  C:\Windows\System\FaKijIx.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\quMiTaF.exe
  C:\Windows\System\quMiTaF.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\QBTSkkt.exe
  C:\Windows\System\QBTSkkt.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\qFrQYSI.exe
  C:\Windows\System\qFrQYSI.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\Ulzdiqf.exe
  C:\Windows\System\Ulzdiqf.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\UddXaCi.exe
  C:\Windows\System\UddXaCi.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ZpkrNaC.exe
  C:\Windows\System\ZpkrNaC.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\DIaSwRl.exe
  C:\Windows\System\DIaSwRl.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\DcHKAEv.exe
  C:\Windows\System\DcHKAEv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\nfzrbBC.exe
  C:\Windows\System\nfzrbBC.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PUzYBcz.exe
  C:\Windows\System\PUzYBcz.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\PVPnvuX.exe
  C:\Windows\System\PVPnvuX.exe
  2⤵
  PID:1592
- C:\Windows\System\ckSeDKd.exe
  C:\Windows\System\ckSeDKd.exe
  2⤵
  PID:3040
- C:\Windows\System\mHeBglo.exe
  C:\Windows\System\mHeBglo.exe
  2⤵
  PID:1124
- C:\Windows\System\lrdQSKx.exe
  C:\Windows\System\lrdQSKx.exe
  2⤵
  PID:2708
- C:\Windows\System\dVCsRJc.exe
  C:\Windows\System\dVCsRJc.exe
  2⤵
  PID:2700
- C:\Windows\System\QyaHdaA.exe
  C:\Windows\System\QyaHdaA.exe
  2⤵
  PID:1520
- C:\Windows\System\ZGpMeOm.exe
  C:\Windows\System\ZGpMeOm.exe
  2⤵
  PID:2620
- C:\Windows\System\xujUsVh.exe
  C:\Windows\System\xujUsVh.exe
  2⤵
  PID:2456
- C:\Windows\System\CbumsIp.exe
  C:\Windows\System\CbumsIp.exe
  2⤵
  PID:2556
- C:\Windows\System\lZRCIUE.exe
  C:\Windows\System\lZRCIUE.exe
  2⤵
  PID:2676
- C:\Windows\System\hWzfzZh.exe
  C:\Windows\System\hWzfzZh.exe
  2⤵
  PID:2672
- C:\Windows\System\xKkddjt.exe
  C:\Windows\System\xKkddjt.exe
  2⤵
  PID:2256
- C:\Windows\System\KxzKYwo.exe
  C:\Windows\System\KxzKYwo.exe
  2⤵
  PID:876
- C:\Windows\System\krcMSYa.exe
  C:\Windows\System\krcMSYa.exe
  2⤵
  PID:2056
- C:\Windows\System\REcpgpF.exe
  C:\Windows\System\REcpgpF.exe
  2⤵
  PID:2416
- C:\Windows\System\TxpdqUj.exe
  C:\Windows\System\TxpdqUj.exe
  2⤵
  PID:2892
- C:\Windows\System\RuqcJDx.exe
  C:\Windows\System\RuqcJDx.exe
  2⤵
  PID:2372
- C:\Windows\System\CChszLR.exe
  C:\Windows\System\CChszLR.exe
  2⤵
  PID:2840
- C:\Windows\System\zzebkfh.exe
  C:\Windows\System\zzebkfh.exe
  2⤵
  PID:860
- C:\Windows\System\TRMPjYP.exe
  C:\Windows\System\TRMPjYP.exe
  2⤵
  PID:1092
- C:\Windows\System\sqAyRzf.exe
  C:\Windows\System\sqAyRzf.exe
  2⤵
  PID:1812
- C:\Windows\System\XwCmgFV.exe
  C:\Windows\System\XwCmgFV.exe
  2⤵
  PID:1304
- C:\Windows\System\MTkacRU.exe
  C:\Windows\System\MTkacRU.exe
  2⤵
  PID:1568
- C:\Windows\System\MYzkzxm.exe
  C:\Windows\System\MYzkzxm.exe
  2⤵
  PID:1936
- C:\Windows\System\cTZYxhJ.exe
  C:\Windows\System\cTZYxhJ.exe
  2⤵
  PID:1000
- C:\Windows\System\CILuacD.exe
  C:\Windows\System\CILuacD.exe
  2⤵
  PID:1352
- C:\Windows\System\jdBUWfy.exe
  C:\Windows\System\jdBUWfy.exe
  2⤵
  PID:2408
- C:\Windows\System\FgNCYcB.exe
  C:\Windows\System\FgNCYcB.exe
  2⤵
  PID:1528
- C:\Windows\System\XoZHnQn.exe
  C:\Windows\System\XoZHnQn.exe
  2⤵
  PID:916
- C:\Windows\System\FiQrmIS.exe
  C:\Windows\System\FiQrmIS.exe
  2⤵
  PID:572
- C:\Windows\System\ejOMGfh.exe
  C:\Windows\System\ejOMGfh.exe
  2⤵
  PID:2036
- C:\Windows\System\YZjNnhY.exe
  C:\Windows\System\YZjNnhY.exe
  2⤵
  PID:600
- C:\Windows\System\rSxJCYK.exe
  C:\Windows\System\rSxJCYK.exe
  2⤵
  PID:1708
- C:\Windows\System\fVrpuMm.exe
  C:\Windows\System\fVrpuMm.exe
  2⤵
  PID:996
- C:\Windows\System\iCEhunV.exe
  C:\Windows\System\iCEhunV.exe
  2⤵
  PID:896
- C:\Windows\System\ltvceIK.exe
  C:\Windows\System\ltvceIK.exe
  2⤵
  PID:1584
- C:\Windows\System\GpwkbKo.exe
  C:\Windows\System\GpwkbKo.exe
  2⤵
  PID:2984
- C:\Windows\System\FJogNTB.exe
  C:\Windows\System\FJogNTB.exe
  2⤵
  PID:2420
- C:\Windows\System\KygQXoW.exe
  C:\Windows\System\KygQXoW.exe
  2⤵
  PID:1720
- C:\Windows\System\afNElvn.exe
  C:\Windows\System\afNElvn.exe
  2⤵
  PID:1036
- C:\Windows\System\HAbjBOS.exe
  C:\Windows\System\HAbjBOS.exe
  2⤵
  PID:1912
- C:\Windows\System\ROOInYg.exe
  C:\Windows\System\ROOInYg.exe
  2⤵
  PID:1868
- C:\Windows\System\uhZcAdO.exe
  C:\Windows\System\uhZcAdO.exe
  2⤵
  PID:2948
- C:\Windows\System\nmCiCqP.exe
  C:\Windows\System\nmCiCqP.exe
  2⤵
  PID:2688
- C:\Windows\System\QpvGuGs.exe
  C:\Windows\System\QpvGuGs.exe
  2⤵
  PID:2432
- C:\Windows\System\LqSHdQj.exe
  C:\Windows\System\LqSHdQj.exe
  2⤵
  PID:2584
- C:\Windows\System\pbKZMFa.exe
  C:\Windows\System\pbKZMFa.exe
  2⤵
  PID:820
- C:\Windows\System\qwRXuCu.exe
  C:\Windows\System\qwRXuCu.exe
  2⤵
  PID:1324
- C:\Windows\System\ocARAZd.exe
  C:\Windows\System\ocARAZd.exe
  2⤵
  PID:700
- C:\Windows\System\JoUfPhO.exe
  C:\Windows\System\JoUfPhO.exe
  2⤵
  PID:2392
- C:\Windows\System\QnyXrJe.exe
  C:\Windows\System\QnyXrJe.exe
  2⤵
  PID:2776
- C:\Windows\System\oSqqbLe.exe
  C:\Windows\System\oSqqbLe.exe
  2⤵
  PID:564
- C:\Windows\System\XLdVRQE.exe
  C:\Windows\System\XLdVRQE.exe
  2⤵
  PID:2116
- C:\Windows\System\LRXuUbn.exe
  C:\Windows\System\LRXuUbn.exe
  2⤵
  PID:1548
- C:\Windows\System\fQxNOEU.exe
  C:\Windows\System\fQxNOEU.exe
  2⤵
  PID:320
- C:\Windows\System\pVqkYIk.exe
  C:\Windows\System\pVqkYIk.exe
  2⤵
  PID:2916
- C:\Windows\System\VcSieec.exe
  C:\Windows\System\VcSieec.exe
  2⤵
  PID:1616
- C:\Windows\System\qMhGuLy.exe
  C:\Windows\System\qMhGuLy.exe
  2⤵
  PID:1976
- C:\Windows\System\MUpoHpT.exe
  C:\Windows\System\MUpoHpT.exe
  2⤵
  PID:1232
- C:\Windows\System\rTXIpdl.exe
  C:\Windows\System\rTXIpdl.exe
  2⤵
  PID:2396
- C:\Windows\System\mRaWRTD.exe
  C:\Windows\System\mRaWRTD.exe
  2⤵
  PID:1552
- C:\Windows\System\DHXaLif.exe
  C:\Windows\System\DHXaLif.exe
  2⤵
  PID:1336
- C:\Windows\System\WOEWlsz.exe
  C:\Windows\System\WOEWlsz.exe
  2⤵
  PID:2544
- C:\Windows\System\ENyjJjA.exe
  C:\Windows\System\ENyjJjA.exe
  2⤵
  PID:2944
- C:\Windows\System\zWPlqsE.exe
  C:\Windows\System\zWPlqsE.exe
  2⤵
  PID:2640
- C:\Windows\System\zMFkPLX.exe
  C:\Windows\System\zMFkPLX.exe
  2⤵
  PID:2788
- C:\Windows\System\mXphkSW.exe
  C:\Windows\System\mXphkSW.exe
  2⤵
  PID:1444
- C:\Windows\System\KEAKacn.exe
  C:\Windows\System\KEAKacn.exe
  2⤵
  PID:2616
- C:\Windows\System\XjRzObz.exe
  C:\Windows\System\XjRzObz.exe
  2⤵
  PID:2052
- C:\Windows\System\WQJkOqR.exe
  C:\Windows\System\WQJkOqR.exe
  2⤵
  PID:1644
- C:\Windows\System\KMtRWTN.exe
  C:\Windows\System\KMtRWTN.exe
  2⤵
  PID:2496
- C:\Windows\System\JxpmURw.exe
  C:\Windows\System\JxpmURw.exe
  2⤵
  PID:2100
- C:\Windows\System\picSDwg.exe
  C:\Windows\System\picSDwg.exe
  2⤵
  PID:2304
- C:\Windows\System\XSnwFWk.exe
  C:\Windows\System\XSnwFWk.exe
  2⤵
  PID:2380
- C:\Windows\System\uLagUyW.exe
  C:\Windows\System\uLagUyW.exe
  2⤵
  PID:752
- C:\Windows\System\jxSsqKP.exe
  C:\Windows\System\jxSsqKP.exe
  2⤵
  PID:2588
- C:\Windows\System\sEaDFZx.exe
  C:\Windows\System\sEaDFZx.exe
  2⤵
  PID:2032
- C:\Windows\System\AvcWFYV.exe
  C:\Windows\System\AvcWFYV.exe
  2⤵
  PID:2220
- C:\Windows\System\vDWpxSY.exe
  C:\Windows\System\vDWpxSY.exe
  2⤵
  PID:1688
- C:\Windows\System\yOhPxHa.exe
  C:\Windows\System\yOhPxHa.exe
  2⤵
  PID:848
- C:\Windows\System\eoTGqRi.exe
  C:\Windows\System\eoTGqRi.exe
  2⤵
  PID:2744
- C:\Windows\System\WuEtOGF.exe
  C:\Windows\System\WuEtOGF.exe
  2⤵
  PID:1192
- C:\Windows\System\DpPKMjp.exe
  C:\Windows\System\DpPKMjp.exe
  2⤵
  PID:1496
- C:\Windows\System\HNByOnG.exe
  C:\Windows\System\HNByOnG.exe
  2⤵
  PID:2652
- C:\Windows\System\rIniTvO.exe
  C:\Windows\System\rIniTvO.exe
  2⤵
  PID:2680
- C:\Windows\System\mstnrVH.exe
  C:\Windows\System\mstnrVH.exe
  2⤵
  PID:2928
- C:\Windows\System\bTFTqXR.exe
  C:\Windows\System\bTFTqXR.exe
  2⤵
  PID:2912
- C:\Windows\System\mWRYpTO.exe
  C:\Windows\System\mWRYpTO.exe
  2⤵
  PID:1636
- C:\Windows\System\ZYAxfmy.exe
  C:\Windows\System\ZYAxfmy.exe
  2⤵
  PID:1532
- C:\Windows\System\uuOmaRQ.exe
  C:\Windows\System\uuOmaRQ.exe
  2⤵
  PID:2612
- C:\Windows\System\ziONGTB.exe
  C:\Windows\System\ziONGTB.exe
  2⤵
  PID:2272
- C:\Windows\System\xhQFzPl.exe
  C:\Windows\System\xhQFzPl.exe
  2⤵
  PID:1484
- C:\Windows\System\PvQtONV.exe
  C:\Windows\System\PvQtONV.exe
  2⤵
  PID:632
- C:\Windows\System\HgIOkyK.exe
  C:\Windows\System\HgIOkyK.exe
  2⤵
  PID:1808
- C:\Windows\System\BKlYJEJ.exe
  C:\Windows\System\BKlYJEJ.exe
  2⤵
  PID:2816
- C:\Windows\System\wKTAzMz.exe
  C:\Windows\System\wKTAzMz.exe
  2⤵
  PID:2568
- C:\Windows\System\XzUcubS.exe
  C:\Windows\System\XzUcubS.exe
  2⤵
  PID:1400
- C:\Windows\System\HadtZcJ.exe
  C:\Windows\System\HadtZcJ.exe
  2⤵
  PID:828
- C:\Windows\System\nrKycKj.exe
  C:\Windows\System\nrKycKj.exe
  2⤵
  PID:1508
- C:\Windows\System\GfUjOnv.exe
  C:\Windows\System\GfUjOnv.exe
  2⤵
  PID:2292
- C:\Windows\System\nroXwpZ.exe
  C:\Windows\System\nroXwpZ.exe
  2⤵
  PID:1964
- C:\Windows\System\zTGTXNp.exe
  C:\Windows\System\zTGTXNp.exe
  2⤵
  PID:2760
- C:\Windows\System\cOksZFy.exe
  C:\Windows\System\cOksZFy.exe
  2⤵
  PID:1920
- C:\Windows\System\jLfUORW.exe
  C:\Windows\System\jLfUORW.exe
  2⤵
  PID:2888
- C:\Windows\System\gShtPRr.exe
  C:\Windows\System\gShtPRr.exe
  2⤵
  PID:1960
- C:\Windows\System\eLJGoym.exe
  C:\Windows\System\eLJGoym.exe
  2⤵
  PID:2692
- C:\Windows\System\FqKFtfV.exe
  C:\Windows\System\FqKFtfV.exe
  2⤵
  PID:1628
- C:\Windows\System\OjQUVcS.exe
  C:\Windows\System\OjQUVcS.exe
  2⤵
  PID:336
- C:\Windows\System\DRtctiB.exe
  C:\Windows\System\DRtctiB.exe
  2⤵
  PID:2312
- C:\Windows\System\dMlIDdH.exe
  C:\Windows\System\dMlIDdH.exe
  2⤵
  PID:1340
- C:\Windows\System\zeXamvp.exe
  C:\Windows\System\zeXamvp.exe
  2⤵
  PID:3088
- C:\Windows\System\YlqhRNT.exe
  C:\Windows\System\YlqhRNT.exe
  2⤵
  PID:3104
- C:\Windows\System\xKXoWhF.exe
  C:\Windows\System\xKXoWhF.exe
  2⤵
  PID:3120
- C:\Windows\System\aVXykLa.exe
  C:\Windows\System\aVXykLa.exe
  2⤵
  PID:3140
- C:\Windows\System\svHcdcD.exe
  C:\Windows\System\svHcdcD.exe
  2⤵
  PID:3156
- C:\Windows\System\sDabvjR.exe
  C:\Windows\System\sDabvjR.exe
  2⤵
  PID:3172
- C:\Windows\System\UEdliUp.exe
  C:\Windows\System\UEdliUp.exe
  2⤵
  PID:3188
- C:\Windows\System\GpFEkIg.exe
  C:\Windows\System\GpFEkIg.exe
  2⤵
  PID:3212
- C:\Windows\System\PzyNzqC.exe
  C:\Windows\System\PzyNzqC.exe
  2⤵
  PID:3244
- C:\Windows\System\btoGLAI.exe
  C:\Windows\System\btoGLAI.exe
  2⤵
  PID:3284
- C:\Windows\System\oIBRuGO.exe
  C:\Windows\System\oIBRuGO.exe
  2⤵
  PID:3300
- C:\Windows\System\dtOLFMa.exe
  C:\Windows\System\dtOLFMa.exe
  2⤵
  PID:3316
- C:\Windows\System\XVsFLqo.exe
  C:\Windows\System\XVsFLqo.exe
  2⤵
  PID:3332
- C:\Windows\System\MDOCKEh.exe
  C:\Windows\System\MDOCKEh.exe
  2⤵
  PID:3348
- C:\Windows\System\SxwfKeR.exe
  C:\Windows\System\SxwfKeR.exe
  2⤵
  PID:3368
- C:\Windows\System\zzUfUDl.exe
  C:\Windows\System\zzUfUDl.exe
  2⤵
  PID:3392
- C:\Windows\System\ZHpjoqD.exe
  C:\Windows\System\ZHpjoqD.exe
  2⤵
  PID:3412
- C:\Windows\System\XlDqlHF.exe
  C:\Windows\System\XlDqlHF.exe
  2⤵
  PID:3432
- C:\Windows\System\bMlerZn.exe
  C:\Windows\System\bMlerZn.exe
  2⤵
  PID:3448
- C:\Windows\System\PniYcxa.exe
  C:\Windows\System\PniYcxa.exe
  2⤵
  PID:3488
- C:\Windows\System\cqLswTY.exe
  C:\Windows\System\cqLswTY.exe
  2⤵
  PID:3504
- C:\Windows\System\OOkGmAD.exe
  C:\Windows\System\OOkGmAD.exe
  2⤵
  PID:3520
- C:\Windows\System\WlGvCXz.exe
  C:\Windows\System\WlGvCXz.exe
  2⤵
  PID:3536
- C:\Windows\System\YndsBOF.exe
  C:\Windows\System\YndsBOF.exe
  2⤵
  PID:3552
- C:\Windows\System\WMCcPES.exe
  C:\Windows\System\WMCcPES.exe
  2⤵
  PID:3596
- C:\Windows\System\buaYguO.exe
  C:\Windows\System\buaYguO.exe
  2⤵
  PID:3612
- C:\Windows\System\kDicMeL.exe
  C:\Windows\System\kDicMeL.exe
  2⤵
  PID:3628
- C:\Windows\System\DbwCJFU.exe
  C:\Windows\System\DbwCJFU.exe
  2⤵
  PID:3648
- C:\Windows\System\xrYilYD.exe
  C:\Windows\System\xrYilYD.exe
  2⤵
  PID:3664
- C:\Windows\System\sooVwog.exe
  C:\Windows\System\sooVwog.exe
  2⤵
  PID:3680
- C:\Windows\System\zNrLSIi.exe
  C:\Windows\System\zNrLSIi.exe
  2⤵
  PID:3700
- C:\Windows\System\sXjaqsq.exe
  C:\Windows\System\sXjaqsq.exe
  2⤵
  PID:3720
- C:\Windows\System\hfyMMCv.exe
  C:\Windows\System\hfyMMCv.exe
  2⤵
  PID:3736
- C:\Windows\System\DrcxnCB.exe
  C:\Windows\System\DrcxnCB.exe
  2⤵
  PID:3756
- C:\Windows\System\GLUuZhK.exe
  C:\Windows\System\GLUuZhK.exe
  2⤵
  PID:3776
- C:\Windows\System\IciGALJ.exe
  C:\Windows\System\IciGALJ.exe
  2⤵
  PID:3796
- C:\Windows\System\sJoSYtX.exe
  C:\Windows\System\sJoSYtX.exe
  2⤵
  PID:3812
- C:\Windows\System\vnLAqdh.exe
  C:\Windows\System\vnLAqdh.exe
  2⤵
  PID:3836
- C:\Windows\System\bMQmgIu.exe
  C:\Windows\System\bMQmgIu.exe
  2⤵
  PID:3852
- C:\Windows\System\kUJmDwX.exe
  C:\Windows\System\kUJmDwX.exe
  2⤵
  PID:3868
- C:\Windows\System\BBrvywc.exe
  C:\Windows\System\BBrvywc.exe
  2⤵
  PID:3900
- C:\Windows\System\xTLoyra.exe
  C:\Windows\System\xTLoyra.exe
  2⤵
  PID:3920
- C:\Windows\System\WbPHiZu.exe
  C:\Windows\System\WbPHiZu.exe
  2⤵
  PID:3936
- C:\Windows\System\gXIbpob.exe
  C:\Windows\System\gXIbpob.exe
  2⤵
  PID:3960
- C:\Windows\System\sDaeqkg.exe
  C:\Windows\System\sDaeqkg.exe
  2⤵
  PID:3976
- C:\Windows\System\UvHfnxv.exe
  C:\Windows\System\UvHfnxv.exe
  2⤵
  PID:3992
- C:\Windows\System\AIOoNqw.exe
  C:\Windows\System\AIOoNqw.exe
  2⤵
  PID:4008
- C:\Windows\System\BWJuLTd.exe
  C:\Windows\System\BWJuLTd.exe
  2⤵
  PID:4024
- C:\Windows\System\cromRTA.exe
  C:\Windows\System\cromRTA.exe
  2⤵
  PID:4040
- C:\Windows\System\diagTlL.exe
  C:\Windows\System\diagTlL.exe
  2⤵
  PID:4064
- C:\Windows\System\qRQigqk.exe
  C:\Windows\System\qRQigqk.exe
  2⤵
  PID:4080
- C:\Windows\System\AqivTEc.exe
  C:\Windows\System\AqivTEc.exe
  2⤵
  PID:1804
- C:\Windows\System\eADEpmR.exe
  C:\Windows\System\eADEpmR.exe
  2⤵
  PID:3116
- C:\Windows\System\aJisQBy.exe
  C:\Windows\System\aJisQBy.exe
  2⤵
  PID:676
- C:\Windows\System\donaENP.exe
  C:\Windows\System\donaENP.exe
  2⤵
  PID:3224
- C:\Windows\System\YTsjjKo.exe
  C:\Windows\System\YTsjjKo.exe
  2⤵
  PID:3136
- C:\Windows\System\vstSdFR.exe
  C:\Windows\System\vstSdFR.exe
  2⤵
  PID:3200
- C:\Windows\System\SyuoEFt.exe
  C:\Windows\System\SyuoEFt.exe
  2⤵
  PID:3236
- C:\Windows\System\VVzeKXb.exe
  C:\Windows\System\VVzeKXb.exe
  2⤵
  PID:3256
- C:\Windows\System\ZiLggiI.exe
  C:\Windows\System\ZiLggiI.exe
  2⤵
  PID:3324
- C:\Windows\System\bKOrxVo.exe
  C:\Windows\System\bKOrxVo.exe
  2⤵
  PID:3380
- C:\Windows\System\ZNqAehQ.exe
  C:\Windows\System\ZNqAehQ.exe
  2⤵
  PID:3428
- C:\Windows\System\osRTbUD.exe
  C:\Windows\System\osRTbUD.exe
  2⤵
  PID:3472
- C:\Windows\System\frNHzkm.exe
  C:\Windows\System\frNHzkm.exe
  2⤵
  PID:3516
- C:\Windows\System\BKtWdJW.exe
  C:\Windows\System\BKtWdJW.exe
  2⤵
  PID:3560
- C:\Windows\System\YVXPchV.exe
  C:\Windows\System\YVXPchV.exe
  2⤵
  PID:3588
- C:\Windows\System\ZyPlZvI.exe
  C:\Windows\System\ZyPlZvI.exe
  2⤵
  PID:3624
- C:\Windows\System\AlYdsqm.exe
  C:\Windows\System\AlYdsqm.exe
  2⤵
  PID:3688
- C:\Windows\System\mRKempx.exe
  C:\Windows\System\mRKempx.exe
  2⤵
  PID:3764
- C:\Windows\System\zBaekPr.exe
  C:\Windows\System\zBaekPr.exe
  2⤵
  PID:1904
- C:\Windows\System\bskmTKD.exe
  C:\Windows\System\bskmTKD.exe
  2⤵
  PID:3848
- C:\Windows\System\QKzhJpb.exe
  C:\Windows\System\QKzhJpb.exe
  2⤵
  PID:3672
- C:\Windows\System\LkUgeSS.exe
  C:\Windows\System\LkUgeSS.exe
  2⤵
  PID:3928
- C:\Windows\System\IglgjGU.exe
  C:\Windows\System\IglgjGU.exe
  2⤵
  PID:4000
- C:\Windows\System\XlgTIqs.exe
  C:\Windows\System\XlgTIqs.exe
  2⤵
  PID:4032
- C:\Windows\System\CWewgzz.exe
  C:\Windows\System\CWewgzz.exe
  2⤵
  PID:4072
- C:\Windows\System\zFxGWkJ.exe
  C:\Windows\System\zFxGWkJ.exe
  2⤵
  PID:3748
- C:\Windows\System\ZwBjpGh.exe
  C:\Windows\System\ZwBjpGh.exe
  2⤵
  PID:3820
- C:\Windows\System\ccusiBQ.exe
  C:\Windows\System\ccusiBQ.exe
  2⤵
  PID:3712
- C:\Windows\System\GhtrCAp.exe
  C:\Windows\System\GhtrCAp.exe
  2⤵
  PID:3196
- C:\Windows\System\jMvLhEd.exe
  C:\Windows\System\jMvLhEd.exe
  2⤵
  PID:3264
- C:\Windows\System\nETxdwH.exe
  C:\Windows\System\nETxdwH.exe
  2⤵
  PID:3404
- C:\Windows\System\KHnICRl.exe
  C:\Windows\System\KHnICRl.exe
  2⤵
  PID:2212
- C:\Windows\System\RUmvAtO.exe
  C:\Windows\System\RUmvAtO.exe
  2⤵
  PID:3100
- C:\Windows\System\gkbgTef.exe
  C:\Windows\System\gkbgTef.exe
  2⤵
  PID:3312
- C:\Windows\System\KZMtFYR.exe
  C:\Windows\System\KZMtFYR.exe
  2⤵
  PID:3988
- C:\Windows\System\spXumMf.exe
  C:\Windows\System\spXumMf.exe
  2⤵
  PID:4088
- C:\Windows\System\tvqlVAH.exe
  C:\Windows\System\tvqlVAH.exe
  2⤵
  PID:816
- C:\Windows\System\eoXiKrS.exe
  C:\Windows\System\eoXiKrS.exe
  2⤵
  PID:3268
- C:\Windows\System\bbhGnYK.exe
  C:\Windows\System\bbhGnYK.exe
  2⤵
  PID:3388
- C:\Windows\System\ucFQygX.exe
  C:\Windows\System\ucFQygX.exe
  2⤵
  PID:3580
- C:\Windows\System\IujUctV.exe
  C:\Windows\System\IujUctV.exe
  2⤵
  PID:3696
- C:\Windows\System\dWtAGzl.exe
  C:\Windows\System\dWtAGzl.exe
  2⤵
  PID:3844
- C:\Windows\System\VJukvEv.exe
  C:\Windows\System\VJukvEv.exe
  2⤵
  PID:3788
- C:\Windows\System\cuzoCVc.exe
  C:\Windows\System\cuzoCVc.exe
  2⤵
  PID:3968
- C:\Windows\System\fVUoRgn.exe
  C:\Windows\System\fVUoRgn.exe
  2⤵
  PID:3572
- C:\Windows\System\KcChFtU.exe
  C:\Windows\System\KcChFtU.exe
  2⤵
  PID:3584
- C:\Windows\System\WLifKyC.exe
  C:\Windows\System\WLifKyC.exe
  2⤵
  PID:3084
- C:\Windows\System\iHuABuo.exe
  C:\Windows\System\iHuABuo.exe
  2⤵
  PID:3912
- C:\Windows\System\XKHPuhB.exe
  C:\Windows\System\XKHPuhB.exe
  2⤵
  PID:3232
- C:\Windows\System\zJrlHAh.exe
  C:\Windows\System\zJrlHAh.exe
  2⤵
  PID:2952
- C:\Windows\System\SlqMQiq.exe
  C:\Windows\System\SlqMQiq.exe
  2⤵
  PID:4056
- C:\Windows\System\ozIfliC.exe
  C:\Windows\System\ozIfliC.exe
  2⤵
  PID:4016
- C:\Windows\System\KuuwJui.exe
  C:\Windows\System\KuuwJui.exe
  2⤵
  PID:3220
- C:\Windows\System\HwNpLEV.exe
  C:\Windows\System\HwNpLEV.exe
  2⤵
  PID:3344
- C:\Windows\System\KIyocjO.exe
  C:\Windows\System\KIyocjO.exe
  2⤵
  PID:3208
- C:\Windows\System\uKTMSok.exe
  C:\Windows\System\uKTMSok.exe
  2⤵
  PID:2520
- C:\Windows\System\ULVoTnK.exe
  C:\Windows\System\ULVoTnK.exe
  2⤵
  PID:3808
- C:\Windows\System\njwLdmI.exe
  C:\Windows\System\njwLdmI.exe
  2⤵
  PID:3660
- C:\Windows\System\nurHtnk.exe
  C:\Windows\System\nurHtnk.exe
  2⤵
  PID:3112
- C:\Windows\System\mVjTHwf.exe
  C:\Windows\System\mVjTHwf.exe
  2⤵
  PID:3484
- C:\Windows\System\iuHhtmT.exe
  C:\Windows\System\iuHhtmT.exe
  2⤵
  PID:3364
- C:\Windows\System\aGRCXmu.exe
  C:\Windows\System\aGRCXmu.exe
  2⤵
  PID:3444
- C:\Windows\System\cATvmTv.exe
  C:\Windows\System\cATvmTv.exe
  2⤵
  PID:3500
- C:\Windows\System\dMMNcot.exe
  C:\Windows\System\dMMNcot.exe
  2⤵
  PID:3804
- C:\Windows\System\etuklqU.exe
  C:\Windows\System\etuklqU.exe
  2⤵
  PID:3676
- C:\Windows\System\yzXOCvh.exe
  C:\Windows\System\yzXOCvh.exe
  2⤵
  PID:4112
- C:\Windows\System\eBhLLmc.exe
  C:\Windows\System\eBhLLmc.exe
  2⤵
  PID:4128
- C:\Windows\System\lIdqIje.exe
  C:\Windows\System\lIdqIje.exe
  2⤵
  PID:4144
- C:\Windows\System\BMTugGN.exe
  C:\Windows\System\BMTugGN.exe
  2⤵
  PID:4160
- C:\Windows\System\VLWuLci.exe
  C:\Windows\System\VLWuLci.exe
  2⤵
  PID:4176
- C:\Windows\System\yNRoxGV.exe
  C:\Windows\System\yNRoxGV.exe
  2⤵
  PID:4192
- C:\Windows\System\BUSmzFh.exe
  C:\Windows\System\BUSmzFh.exe
  2⤵
  PID:4208
- C:\Windows\System\ptTyPTD.exe
  C:\Windows\System\ptTyPTD.exe
  2⤵
  PID:4224
- C:\Windows\System\CckRiNg.exe
  C:\Windows\System\CckRiNg.exe
  2⤵
  PID:4240
- C:\Windows\System\AlJmIik.exe
  C:\Windows\System\AlJmIik.exe
  2⤵
  PID:4264
- C:\Windows\System\eLNyRjm.exe
  C:\Windows\System\eLNyRjm.exe
  2⤵
  PID:4328
- C:\Windows\System\AoycZvA.exe
  C:\Windows\System\AoycZvA.exe
  2⤵
  PID:4352
- C:\Windows\System\eMnYnqL.exe
  C:\Windows\System\eMnYnqL.exe
  2⤵
  PID:4368
- C:\Windows\System\VZSOiCT.exe
  C:\Windows\System\VZSOiCT.exe
  2⤵
  PID:4384
- C:\Windows\System\JPjUmFK.exe
  C:\Windows\System\JPjUmFK.exe
  2⤵
  PID:4408
- C:\Windows\System\QcsgDCP.exe
  C:\Windows\System\QcsgDCP.exe
  2⤵
  PID:4440
- C:\Windows\System\yepAfSX.exe
  C:\Windows\System\yepAfSX.exe
  2⤵
  PID:4456
- C:\Windows\System\iUHTTmX.exe
  C:\Windows\System\iUHTTmX.exe
  2⤵
  PID:4472
- C:\Windows\System\bHpusEW.exe
  C:\Windows\System\bHpusEW.exe
  2⤵
  PID:4492
- C:\Windows\System\GsOjfte.exe
  C:\Windows\System\GsOjfte.exe
  2⤵
  PID:4512
- C:\Windows\System\bpKZeSV.exe
  C:\Windows\System\bpKZeSV.exe
  2⤵
  PID:4532
- C:\Windows\System\JjoCNdh.exe
  C:\Windows\System\JjoCNdh.exe
  2⤵
  PID:4552
- C:\Windows\System\ZXVCMQQ.exe
  C:\Windows\System\ZXVCMQQ.exe
  2⤵
  PID:4576
- C:\Windows\System\JuExzvA.exe
  C:\Windows\System\JuExzvA.exe
  2⤵
  PID:4592
- C:\Windows\System\RtRXeOE.exe
  C:\Windows\System\RtRXeOE.exe
  2⤵
  PID:4620
- C:\Windows\System\lRRiOfn.exe
  C:\Windows\System\lRRiOfn.exe
  2⤵
  PID:4668
- C:\Windows\System\jWGlams.exe
  C:\Windows\System\jWGlams.exe
  2⤵
  PID:4684
- C:\Windows\System\RbHVWro.exe
  C:\Windows\System\RbHVWro.exe
  2⤵
  PID:4704
- C:\Windows\System\xHhcwYC.exe
  C:\Windows\System\xHhcwYC.exe
  2⤵
  PID:4720
- C:\Windows\System\gmSJoyS.exe
  C:\Windows\System\gmSJoyS.exe
  2⤵
  PID:4736
- C:\Windows\System\xHVFWxR.exe
  C:\Windows\System\xHVFWxR.exe
  2⤵
  PID:4752
- C:\Windows\System\AdtGrJe.exe
  C:\Windows\System\AdtGrJe.exe
  2⤵
  PID:4776
- C:\Windows\System\JVWYmNS.exe
  C:\Windows\System\JVWYmNS.exe
  2⤵
  PID:4796
- C:\Windows\System\qxNhFXy.exe
  C:\Windows\System\qxNhFXy.exe
  2⤵
  PID:4816
- C:\Windows\System\qdiGKyA.exe
  C:\Windows\System\qdiGKyA.exe
  2⤵
  PID:4836
- C:\Windows\System\xtTRLSL.exe
  C:\Windows\System\xtTRLSL.exe
  2⤵
  PID:4852
- C:\Windows\System\macpbex.exe
  C:\Windows\System\macpbex.exe
  2⤵
  PID:4872
- C:\Windows\System\EbzwFDS.exe
  C:\Windows\System\EbzwFDS.exe
  2⤵
  PID:4888
- C:\Windows\System\gyATOBL.exe
  C:\Windows\System\gyATOBL.exe
  2⤵
  PID:4912
- C:\Windows\System\rBtyweS.exe
  C:\Windows\System\rBtyweS.exe
  2⤵
  PID:4932
- C:\Windows\System\HUVmSnr.exe
  C:\Windows\System\HUVmSnr.exe
  2⤵
  PID:4952
- C:\Windows\System\NHOWYcB.exe
  C:\Windows\System\NHOWYcB.exe
  2⤵
  PID:4972
- C:\Windows\System\nyiNROL.exe
  C:\Windows\System\nyiNROL.exe
  2⤵
  PID:4988
- C:\Windows\System\CAxQiCF.exe
  C:\Windows\System\CAxQiCF.exe
  2⤵
  PID:5004
- C:\Windows\System\juKLHzH.exe
  C:\Windows\System\juKLHzH.exe
  2⤵
  PID:5020
- C:\Windows\System\iqyaIcy.exe
  C:\Windows\System\iqyaIcy.exe
  2⤵
  PID:5068
- C:\Windows\System\WsBEOVp.exe
  C:\Windows\System\WsBEOVp.exe
  2⤵
  PID:5084
- C:\Windows\System\QzztIfb.exe
  C:\Windows\System\QzztIfb.exe
  2⤵
  PID:5100
- C:\Windows\System\HQsByIY.exe
  C:\Windows\System\HQsByIY.exe
  2⤵
  PID:5116
- C:\Windows\System\cgVWEjy.exe
  C:\Windows\System\cgVWEjy.exe
  2⤵
  PID:3888
- C:\Windows\System\QujQNVD.exe
  C:\Windows\System\QujQNVD.exe
  2⤵
  PID:4104
- C:\Windows\System\wFzHcAH.exe
  C:\Windows\System\wFzHcAH.exe
  2⤵
  PID:4168
- C:\Windows\System\wLAoyMB.exe
  C:\Windows\System\wLAoyMB.exe
  2⤵
  PID:4236
- C:\Windows\System\pwVBEMT.exe
  C:\Windows\System\pwVBEMT.exe
  2⤵
  PID:4152
- C:\Windows\System\arUPZGS.exe
  C:\Windows\System\arUPZGS.exe
  2⤵
  PID:3132
- C:\Windows\System\VydJeIJ.exe
  C:\Windows\System\VydJeIJ.exe
  2⤵
  PID:3184
- C:\Windows\System\viqMsRA.exe
  C:\Windows\System\viqMsRA.exe
  2⤵
  PID:4288
- C:\Windows\System\JmEhhgH.exe
  C:\Windows\System\JmEhhgH.exe
  2⤵
  PID:4304
- C:\Windows\System\qdmiskz.exe
  C:\Windows\System\qdmiskz.exe
  2⤵
  PID:4156
- C:\Windows\System\zcJiHVE.exe
  C:\Windows\System\zcJiHVE.exe
  2⤵
  PID:4256
- C:\Windows\System\MVVwmMq.exe
  C:\Windows\System\MVVwmMq.exe
  2⤵
  PID:3984
- C:\Windows\System\QmPvFVM.exe
  C:\Windows\System\QmPvFVM.exe
  2⤵
  PID:4316
- C:\Windows\System\AlRjZJB.exe
  C:\Windows\System\AlRjZJB.exe
  2⤵
  PID:4252
- C:\Windows\System\TMkBjlk.exe
  C:\Windows\System\TMkBjlk.exe
  2⤵
  PID:4400
- C:\Windows\System\ciprfpM.exe
  C:\Windows\System\ciprfpM.exe
  2⤵
  PID:4452
- C:\Windows\System\OBUdMaE.exe
  C:\Windows\System\OBUdMaE.exe
  2⤵
  PID:4524
- C:\Windows\System\rYxmDdN.exe
  C:\Windows\System\rYxmDdN.exe
  2⤵
  PID:4568
- C:\Windows\System\xCjTzlR.exe
  C:\Windows\System\xCjTzlR.exe
  2⤵
  PID:4612
- C:\Windows\System\KwQdWSm.exe
  C:\Windows\System\KwQdWSm.exe
  2⤵
  PID:4376
- C:\Windows\System\ACWYBnx.exe
  C:\Windows\System\ACWYBnx.exe
  2⤵
  PID:4420
- C:\Windows\System\lNOrWFC.exe
  C:\Windows\System\lNOrWFC.exe
  2⤵
  PID:4464
- C:\Windows\System\LobQehz.exe
  C:\Windows\System\LobQehz.exe
  2⤵
  PID:4508
- C:\Windows\System\jCsAORJ.exe
  C:\Windows\System\jCsAORJ.exe
  2⤵
  PID:4584
- C:\Windows\System\WFtPgFU.exe
  C:\Windows\System\WFtPgFU.exe
  2⤵
  PID:4636
- C:\Windows\System\FALNfWB.exe
  C:\Windows\System\FALNfWB.exe
  2⤵
  PID:4652
- C:\Windows\System\pRQkwhM.exe
  C:\Windows\System\pRQkwhM.exe
  2⤵
  PID:4680
- C:\Windows\System\mqCcZRp.exe
  C:\Windows\System\mqCcZRp.exe
  2⤵
  PID:288
- C:\Windows\System\cTvUkkL.exe
  C:\Windows\System\cTvUkkL.exe
  2⤵
  PID:4788
- C:\Windows\System\VoEFlZq.exe
  C:\Windows\System\VoEFlZq.exe
  2⤵
  PID:4828
- C:\Windows\System\qmPsvEA.exe
  C:\Windows\System\qmPsvEA.exe
  2⤵
  PID:4864
- C:\Windows\System\PvRWIxa.exe
  C:\Windows\System\PvRWIxa.exe
  2⤵
  PID:4760
- C:\Windows\System\tEsuHcf.exe
  C:\Windows\System\tEsuHcf.exe
  2⤵
  PID:4804
- C:\Windows\System\dZNDwki.exe
  C:\Windows\System\dZNDwki.exe
  2⤵
  PID:4940
- C:\Windows\System\vjiLHAe.exe
  C:\Windows\System\vjiLHAe.exe
  2⤵
  PID:4848
- C:\Windows\System\SPSUENa.exe
  C:\Windows\System\SPSUENa.exe
  2⤵
  PID:4924
- C:\Windows\System\RwRMoBi.exe
  C:\Windows\System\RwRMoBi.exe
  2⤵
  PID:4968
- C:\Windows\System\SylMpBu.exe
  C:\Windows\System\SylMpBu.exe
  2⤵
  PID:5052
- C:\Windows\System\RxtGtli.exe
  C:\Windows\System\RxtGtli.exe
  2⤵
  PID:5044
- C:\Windows\System\YovsQqW.exe
  C:\Windows\System\YovsQqW.exe
  2⤵
  PID:5080
- C:\Windows\System\qMqblgM.exe
  C:\Windows\System\qMqblgM.exe
  2⤵
  PID:5092
- C:\Windows\System\IAwChgI.exe
  C:\Windows\System\IAwChgI.exe
  2⤵
  PID:3544
- C:\Windows\System\QHhdwCK.exe
  C:\Windows\System\QHhdwCK.exe
  2⤵
  PID:4020
- C:\Windows\System\CrIDwwp.exe
  C:\Windows\System\CrIDwwp.exe
  2⤵
  PID:3180
- C:\Windows\System\kkTMWxp.exe
  C:\Windows\System\kkTMWxp.exe
  2⤵
  PID:3656
- C:\Windows\System\rUkwUjI.exe
  C:\Windows\System\rUkwUjI.exe
  2⤵
  PID:4120
- C:\Windows\System\BJmxHjq.exe
  C:\Windows\System\BJmxHjq.exe
  2⤵
  PID:4124
- C:\Windows\System\bazENyr.exe
  C:\Windows\System\bazENyr.exe
  2⤵
  PID:4184
- C:\Windows\System\OWzDjZi.exe
  C:\Windows\System\OWzDjZi.exe
  2⤵
  PID:4140
- C:\Windows\System\HsLmNxt.exe
  C:\Windows\System\HsLmNxt.exe
  2⤵
  PID:4360
- C:\Windows\System\CPxnXLn.exe
  C:\Windows\System\CPxnXLn.exe
  2⤵
  PID:4488
- C:\Windows\System\xRvSFMO.exe
  C:\Windows\System\xRvSFMO.exe
  2⤵
  PID:4416
- C:\Windows\System\barzsfa.exe
  C:\Windows\System\barzsfa.exe
  2⤵
  PID:4564
- C:\Windows\System\iaAjbxJ.exe
  C:\Windows\System\iaAjbxJ.exe
  2⤵
  PID:4340
- C:\Windows\System\UmhcXJA.exe
  C:\Windows\System\UmhcXJA.exe
  2⤵
  PID:4500
- C:\Windows\System\XaXdWUW.exe
  C:\Windows\System\XaXdWUW.exe
  2⤵
  PID:4648
- C:\Windows\System\OzulTTx.exe
  C:\Windows\System\OzulTTx.exe
  2⤵
  PID:4716
- C:\Windows\System\IdneBwK.exe
  C:\Windows\System\IdneBwK.exe
  2⤵
  PID:2260
- C:\Windows\System\wwOvgvn.exe
  C:\Windows\System\wwOvgvn.exe
  2⤵
  PID:4900
- C:\Windows\System\XNvYiJR.exe
  C:\Windows\System\XNvYiJR.exe
  2⤵
  PID:4812
- C:\Windows\System\AoFNRHE.exe
  C:\Windows\System\AoFNRHE.exe
  2⤵
  PID:5000
- C:\Windows\System\CztzmfF.exe
  C:\Windows\System\CztzmfF.exe
  2⤵
  PID:5036
- C:\Windows\System\rqxmRfo.exe
  C:\Windows\System\rqxmRfo.exe
  2⤵
  PID:4280
- C:\Windows\System\aSMpMZb.exe
  C:\Windows\System\aSMpMZb.exe
  2⤵
  PID:4296
- C:\Windows\System\PpZytnl.exe
  C:\Windows\System\PpZytnl.exe
  2⤵
  PID:4600
- C:\Windows\System\ccwoJJJ.exe
  C:\Windows\System\ccwoJJJ.exe
  2⤵
  PID:4548
- C:\Windows\System\VEVElwb.exe
  C:\Windows\System\VEVElwb.exe
  2⤵
  PID:4792
- C:\Windows\System\hszSzOY.exe
  C:\Windows\System\hszSzOY.exe
  2⤵
  PID:4908
- C:\Windows\System\pLaRdvV.exe
  C:\Windows\System\pLaRdvV.exe
  2⤵
  PID:3152
- C:\Windows\System\OpNPQuZ.exe
  C:\Windows\System\OpNPQuZ.exe
  2⤵
  PID:4608
- C:\Windows\System\cRjuMqB.exe
  C:\Windows\System\cRjuMqB.exe
  2⤵
  PID:4744
- C:\Windows\System\SllOXOW.exe
  C:\Windows\System\SllOXOW.exe
  2⤵
  PID:4484
- C:\Windows\System\vItVCIx.exe
  C:\Windows\System\vItVCIx.exe
  2⤵
  PID:1932
- C:\Windows\System\sQUJZkI.exe
  C:\Windows\System\sQUJZkI.exe
  2⤵
  PID:4448
- C:\Windows\System\nuwhAcf.exe
  C:\Windows\System\nuwhAcf.exe
  2⤵
  PID:4784
- C:\Windows\System\ZBnZvuV.exe
  C:\Windows\System\ZBnZvuV.exe
  2⤵
  PID:4860
- C:\Windows\System\bTiWUJW.exe
  C:\Windows\System\bTiWUJW.exe
  2⤵
  PID:5048
- C:\Windows\System\CnnjkBT.exe
  C:\Windows\System\CnnjkBT.exe
  2⤵
  PID:4312
- C:\Windows\System\VCcjEJl.exe
  C:\Windows\System\VCcjEJl.exe
  2⤵
  PID:4676
- C:\Windows\System\zEOBAMN.exe
  C:\Windows\System\zEOBAMN.exe
  2⤵
  PID:3620
- C:\Windows\System\tzAlziL.exe
  C:\Windows\System\tzAlziL.exe
  2⤵
  PID:4232
- C:\Windows\System\quUCCdp.exe
  C:\Windows\System\quUCCdp.exe
  2⤵
  PID:5060
- C:\Windows\System\WhzCjPI.exe
  C:\Windows\System\WhzCjPI.exe
  2⤵
  PID:3944
- C:\Windows\System\PxbRYLM.exe
  C:\Windows\System\PxbRYLM.exe
  2⤵
  PID:4660
- C:\Windows\System\UPGFpae.exe
  C:\Windows\System\UPGFpae.exe
  2⤵
  PID:1104
- C:\Windows\System\wXXqShB.exe
  C:\Windows\System\wXXqShB.exe
  2⤵
  PID:4540
- C:\Windows\System\aRQWREf.exe
  C:\Windows\System\aRQWREf.exe
  2⤵
  PID:2784
- C:\Windows\System\aLQaBji.exe
  C:\Windows\System\aLQaBji.exe
  2⤵
  PID:2104
- C:\Windows\System\ITFdSER.exe
  C:\Windows\System\ITFdSER.exe
  2⤵
  PID:4272
- C:\Windows\System\OZXgEDQ.exe
  C:\Windows\System\OZXgEDQ.exe
  2⤵
  PID:2508
- C:\Windows\System\hYypZqi.exe
  C:\Windows\System\hYypZqi.exe
  2⤵
  PID:3464
- C:\Windows\System\XumiSgj.exe
  C:\Windows\System\XumiSgj.exe
  2⤵
  PID:4964
- C:\Windows\System\xFojlfK.exe
  C:\Windows\System\xFojlfK.exe
  2⤵
  PID:4204
- C:\Windows\System\svmxldF.exe
  C:\Windows\System\svmxldF.exe
  2⤵
  PID:4984
- C:\Windows\System\ynsvayD.exe
  C:\Windows\System\ynsvayD.exe
  2⤵
  PID:4632
- C:\Windows\System\mCJgYQe.exe
  C:\Windows\System\mCJgYQe.exe
  2⤵
  PID:1824
- C:\Windows\System\rFuTxyw.exe
  C:\Windows\System\rFuTxyw.exe
  2⤵
  PID:5124
- C:\Windows\System\xSkMoxm.exe
  C:\Windows\System\xSkMoxm.exe
  2⤵
  PID:5172
- C:\Windows\System\cwOaNeJ.exe
  C:\Windows\System\cwOaNeJ.exe
  2⤵
  PID:5188
- C:\Windows\System\lvJlrzP.exe
  C:\Windows\System\lvJlrzP.exe
  2⤵
  PID:5204
- C:\Windows\System\mwKvOGQ.exe
  C:\Windows\System\mwKvOGQ.exe
  2⤵
  PID:5220
- C:\Windows\System\wKfEniX.exe
  C:\Windows\System\wKfEniX.exe
  2⤵
  PID:5236
- C:\Windows\System\rbYnaXE.exe
  C:\Windows\System\rbYnaXE.exe
  2⤵
  PID:5252
- C:\Windows\System\lFwlzDm.exe
  C:\Windows\System\lFwlzDm.exe
  2⤵
  PID:5272
- C:\Windows\System\ickCVfD.exe
  C:\Windows\System\ickCVfD.exe
  2⤵
  PID:5288
- C:\Windows\System\zUlTYUB.exe
  C:\Windows\System\zUlTYUB.exe
  2⤵
  PID:5304
- C:\Windows\System\uMoXvva.exe
  C:\Windows\System\uMoXvva.exe
  2⤵
  PID:5320
- C:\Windows\System\YQANOCw.exe
  C:\Windows\System\YQANOCw.exe
  2⤵
  PID:5336
- C:\Windows\System\lsjwlaR.exe
  C:\Windows\System\lsjwlaR.exe
  2⤵
  PID:5352
- C:\Windows\System\leMpIxa.exe
  C:\Windows\System\leMpIxa.exe
  2⤵
  PID:5368
- C:\Windows\System\sdeNChk.exe
  C:\Windows\System\sdeNChk.exe
  2⤵
  PID:5384
- C:\Windows\System\YtoQHYT.exe
  C:\Windows\System\YtoQHYT.exe
  2⤵
  PID:5400
- C:\Windows\System\RlNUriV.exe
  C:\Windows\System\RlNUriV.exe
  2⤵
  PID:5416
- C:\Windows\System\tWHOLxQ.exe
  C:\Windows\System\tWHOLxQ.exe
  2⤵
  PID:5432
- C:\Windows\System\ynAXkiJ.exe
  C:\Windows\System\ynAXkiJ.exe
  2⤵
  PID:5448
- C:\Windows\System\QQyGJpW.exe
  C:\Windows\System\QQyGJpW.exe
  2⤵
  PID:5464
- C:\Windows\System\bAmheEQ.exe
  C:\Windows\System\bAmheEQ.exe
  2⤵
  PID:5480
- C:\Windows\System\HaJZSFy.exe
  C:\Windows\System\HaJZSFy.exe
  2⤵
  PID:5496
- C:\Windows\System\CjUmJVj.exe
  C:\Windows\System\CjUmJVj.exe
  2⤵
  PID:5512
- C:\Windows\System\MDUrpmq.exe
  C:\Windows\System\MDUrpmq.exe
  2⤵
  PID:5528
- C:\Windows\System\pLuzEyA.exe
  C:\Windows\System\pLuzEyA.exe
  2⤵
  PID:5544
- C:\Windows\System\uUnrsYe.exe
  C:\Windows\System\uUnrsYe.exe
  2⤵
  PID:5560
- C:\Windows\System\uJVrnYX.exe
  C:\Windows\System\uJVrnYX.exe
  2⤵
  PID:5576
- C:\Windows\System\QVdTQRm.exe
  C:\Windows\System\QVdTQRm.exe
  2⤵
  PID:5596
- C:\Windows\System\PizffCe.exe
  C:\Windows\System\PizffCe.exe
  2⤵
  PID:5612
- C:\Windows\System\JqRHzsr.exe
  C:\Windows\System\JqRHzsr.exe
  2⤵
  PID:5632
- C:\Windows\System\jZtsSwj.exe
  C:\Windows\System\jZtsSwj.exe
  2⤵
  PID:5648
- C:\Windows\System\VnLhrzX.exe
  C:\Windows\System\VnLhrzX.exe
  2⤵
  PID:5664
- C:\Windows\System\NbVYgZO.exe
  C:\Windows\System\NbVYgZO.exe
  2⤵
  PID:5684
- C:\Windows\System\PNMpBrX.exe
  C:\Windows\System\PNMpBrX.exe
  2⤵
  PID:5700
- C:\Windows\System\aNkcgAe.exe
  C:\Windows\System\aNkcgAe.exe
  2⤵
  PID:5720
- C:\Windows\System\ubcCZYa.exe
  C:\Windows\System\ubcCZYa.exe
  2⤵
  PID:5740
- C:\Windows\System\PtyOQjE.exe
  C:\Windows\System\PtyOQjE.exe
  2⤵
  PID:5756
- C:\Windows\System\tDvCWiI.exe
  C:\Windows\System\tDvCWiI.exe
  2⤵
  PID:5772
- C:\Windows\System\daIchJe.exe
  C:\Windows\System\daIchJe.exe
  2⤵
  PID:5788
- C:\Windows\System\FuErJzH.exe
  C:\Windows\System\FuErJzH.exe
  2⤵
  PID:5808
- C:\Windows\System\lObLtzG.exe
  C:\Windows\System\lObLtzG.exe
  2⤵
  PID:5824
- C:\Windows\System\MOgQuKV.exe
  C:\Windows\System\MOgQuKV.exe
  2⤵
  PID:5840
- C:\Windows\System\nVvaqlo.exe
  C:\Windows\System\nVvaqlo.exe
  2⤵
  PID:5856
- C:\Windows\System\uXhjCiS.exe
  C:\Windows\System\uXhjCiS.exe
  2⤵
  PID:5872
- C:\Windows\System\aTvKSnc.exe
  C:\Windows\System\aTvKSnc.exe
  2⤵
  PID:5888
- C:\Windows\System\oJVFogI.exe
  C:\Windows\System\oJVFogI.exe
  2⤵
  PID:5904
- C:\Windows\System\keocMPr.exe
  C:\Windows\System\keocMPr.exe
  2⤵
  PID:5920
- C:\Windows\System\oJRwENu.exe
  C:\Windows\System\oJRwENu.exe
  2⤵
  PID:5936
- C:\Windows\System\MiROPgR.exe
  C:\Windows\System\MiROPgR.exe
  2⤵
  PID:5952
- C:\Windows\System\DQdiZBt.exe
  C:\Windows\System\DQdiZBt.exe
  2⤵
  PID:5968
- C:\Windows\System\FBALNtZ.exe
  C:\Windows\System\FBALNtZ.exe
  2⤵
  PID:5984
- C:\Windows\System\cfqwqkq.exe
  C:\Windows\System\cfqwqkq.exe
  2⤵
  PID:6000
- C:\Windows\System\hGklJmQ.exe
  C:\Windows\System\hGklJmQ.exe
  2⤵
  PID:6016
- C:\Windows\System\LuAMQMv.exe
  C:\Windows\System\LuAMQMv.exe
  2⤵
  PID:6032
- C:\Windows\System\LphcAAY.exe
  C:\Windows\System\LphcAAY.exe
  2⤵
  PID:6048
- C:\Windows\System\usWcNGA.exe
  C:\Windows\System\usWcNGA.exe
  2⤵
  PID:6064
- C:\Windows\System\WWOGVha.exe
  C:\Windows\System\WWOGVha.exe
  2⤵
  PID:6080
- C:\Windows\System\BNKrJJF.exe
  C:\Windows\System\BNKrJJF.exe
  2⤵
  PID:6096
- C:\Windows\System\NLEhTig.exe
  C:\Windows\System\NLEhTig.exe
  2⤵
  PID:6116
- C:\Windows\System\CLmqUrv.exe
  C:\Windows\System\CLmqUrv.exe
  2⤵
  PID:6132
- C:\Windows\System\nODaaUD.exe
  C:\Windows\System\nODaaUD.exe
  2⤵
  PID:5140
- C:\Windows\System\rbkCnYP.exe
  C:\Windows\System\rbkCnYP.exe
  2⤵
  PID:5164
- C:\Windows\System\zMwPxix.exe
  C:\Windows\System\zMwPxix.exe
  2⤵
  PID:5228
- C:\Windows\System\DlXOUVO.exe
  C:\Windows\System\DlXOUVO.exe
  2⤵
  PID:5212
- C:\Windows\System\AnRiFSF.exe
  C:\Windows\System\AnRiFSF.exe
  2⤵
  PID:5300
- C:\Windows\System\uHNNQPS.exe
  C:\Windows\System\uHNNQPS.exe
  2⤵
  PID:5244
- C:\Windows\System\FNLzFjD.exe
  C:\Windows\System\FNLzFjD.exe
  2⤵
  PID:5312
- C:\Windows\System\YUSYoFt.exe
  C:\Windows\System\YUSYoFt.exe
  2⤵
  PID:5348
- C:\Windows\System\cQhNQUX.exe
  C:\Windows\System\cQhNQUX.exe
  2⤵
  PID:5424
- C:\Windows\System\xYJqANr.exe
  C:\Windows\System\xYJqANr.exe
  2⤵
  PID:5488
- C:\Windows\System\CoiogmD.exe
  C:\Windows\System\CoiogmD.exe
  2⤵
  PID:5520
- C:\Windows\System\fesPxla.exe
  C:\Windows\System\fesPxla.exe
  2⤵
  PID:5540
- C:\Windows\System\lBaYSSV.exe
  C:\Windows\System\lBaYSSV.exe
  2⤵
  PID:5592
- C:\Windows\System\XcNwzgX.exe
  C:\Windows\System\XcNwzgX.exe
  2⤵
  PID:5604
- C:\Windows\System\gSUfAcF.exe
  C:\Windows\System\gSUfAcF.exe
  2⤵
  PID:5660
- C:\Windows\System\oikEyUd.exe
  C:\Windows\System\oikEyUd.exe
  2⤵
  PID:3360
- C:\Windows\System\TMtAXPa.exe
  C:\Windows\System\TMtAXPa.exe
  2⤵
  PID:5672
- C:\Windows\System\zNxMlqy.exe
  C:\Windows\System\zNxMlqy.exe
  2⤵
  PID:5816
- C:\Windows\System\BLRhAhG.exe
  C:\Windows\System\BLRhAhG.exe
  2⤵
  PID:6044
- C:\Windows\System\GkyERLF.exe
  C:\Windows\System\GkyERLF.exe
  2⤵
  PID:6072
- C:\Windows\System\fkgfMSS.exe
  C:\Windows\System\fkgfMSS.exe
  2⤵
  PID:6112
- C:\Windows\System\dsGumGW.exe
  C:\Windows\System\dsGumGW.exe
  2⤵
  PID:5040
- C:\Windows\System\lkvlHNB.exe
  C:\Windows\System\lkvlHNB.exe
  2⤵
  PID:5160
- C:\Windows\System\OJpTPFc.exe
  C:\Windows\System\OJpTPFc.exe
  2⤵
  PID:5264
- C:\Windows\System\BKoskPe.exe
  C:\Windows\System\BKoskPe.exe
  2⤵
  PID:5332
- C:\Windows\System\YcminXt.exe
  C:\Windows\System\YcminXt.exe
  2⤵
  PID:5284
- C:\Windows\System\irqMYpG.exe
  C:\Windows\System\irqMYpG.exe
  2⤵
  PID:5280
- C:\Windows\System\HefCIKi.exe
  C:\Windows\System\HefCIKi.exe
  2⤵
  PID:5492
- C:\Windows\System\hAwTyLG.exe
  C:\Windows\System\hAwTyLG.exe
  2⤵
  PID:5552
- C:\Windows\System\VZJwakr.exe
  C:\Windows\System\VZJwakr.exe
  2⤵
  PID:5572
- C:\Windows\System\cLMaZvd.exe
  C:\Windows\System\cLMaZvd.exe
  2⤵
  PID:5716
- C:\Windows\System\XmYJvBK.exe
  C:\Windows\System\XmYJvBK.exe
  2⤵
  PID:5796
- C:\Windows\System\MOzKDjp.exe
  C:\Windows\System\MOzKDjp.exe
  2⤵
  PID:5836
- C:\Windows\System\DLxOWFo.exe
  C:\Windows\System\DLxOWFo.exe
  2⤵
  PID:1684
- C:\Windows\System\hrNtWqu.exe
  C:\Windows\System\hrNtWqu.exe
  2⤵
  PID:5928
- C:\Windows\System\DwJmcmA.exe
  C:\Windows\System\DwJmcmA.exe
  2⤵
  PID:5916
- C:\Windows\System\qyeYtDt.exe
  C:\Windows\System\qyeYtDt.exe
  2⤵
  PID:5912
- C:\Windows\System\XZeOgxu.exe
  C:\Windows\System\XZeOgxu.exe
  2⤵
  PID:5960
- C:\Windows\System\WXfygzf.exe
  C:\Windows\System\WXfygzf.exe
  2⤵
  PID:5976
- C:\Windows\System\fWcFxJC.exe
  C:\Windows\System\fWcFxJC.exe
  2⤵
  PID:6088
- C:\Windows\System\GOUKwPX.exe
  C:\Windows\System\GOUKwPX.exe
  2⤵
  PID:5032
- C:\Windows\System\wvtMliR.exe
  C:\Windows\System\wvtMliR.exe
  2⤵
  PID:6012
- C:\Windows\System\HfnBudo.exe
  C:\Windows\System\HfnBudo.exe
  2⤵
  PID:4768
- C:\Windows\System\DrJgHuO.exe
  C:\Windows\System\DrJgHuO.exe
  2⤵
  PID:5216
- C:\Windows\System\eqhDlBF.exe
  C:\Windows\System\eqhDlBF.exe
  2⤵
  PID:5732
- C:\Windows\System\RzPXvBn.exe
  C:\Windows\System\RzPXvBn.exe
  2⤵
  PID:5868
- C:\Windows\System\PGDdSJd.exe
  C:\Windows\System\PGDdSJd.exe
  2⤵
  PID:6008
- C:\Windows\System\ndnEaJO.exe
  C:\Windows\System\ndnEaJO.exe
  2⤵
  PID:5848
- C:\Windows\System\AGjmUFX.exe
  C:\Windows\System\AGjmUFX.exe
  2⤵
  PID:6056
- C:\Windows\System\CVUleOE.exe
  C:\Windows\System\CVUleOE.exe
  2⤵
  PID:5184
- C:\Windows\System\JqSiVJN.exe
  C:\Windows\System\JqSiVJN.exe
  2⤵
  PID:5508
- C:\Windows\System\HZHSvWM.exe
  C:\Windows\System\HZHSvWM.exe
  2⤵
  PID:5132
- C:\Windows\System\fiqGVOq.exe
  C:\Windows\System\fiqGVOq.exe
  2⤵
  PID:5804
- C:\Windows\System\ypmSLXX.exe
  C:\Windows\System\ypmSLXX.exe
  2⤵
  PID:5964
- C:\Windows\System\JTheZJB.exe
  C:\Windows\System\JTheZJB.exe
  2⤵
  PID:5380
- C:\Windows\System\ojCFmDF.exe
  C:\Windows\System\ojCFmDF.exe
  2⤵
  PID:5728
- C:\Windows\System\QRBOVXa.exe
  C:\Windows\System\QRBOVXa.exe
  2⤵
  PID:5360
- C:\Windows\System\ynlMEuY.exe
  C:\Windows\System\ynlMEuY.exe
  2⤵
  PID:5880
- C:\Windows\System\aNsDOxi.exe
  C:\Windows\System\aNsDOxi.exe
  2⤵
  PID:5820
- C:\Windows\System\gLPfjeH.exe
  C:\Windows\System\gLPfjeH.exe
  2⤵
  PID:5260
- C:\Windows\System\bCLlGCY.exe
  C:\Windows\System\bCLlGCY.exe
  2⤵
  PID:5408
- C:\Windows\System\KMorFtq.exe
  C:\Windows\System\KMorFtq.exe
  2⤵
  PID:5152
- C:\Windows\System\sQLjHBs.exe
  C:\Windows\System\sQLjHBs.exe
  2⤵
  PID:5900
- C:\Windows\System\CgXgAky.exe
  C:\Windows\System\CgXgAky.exe
  2⤵
  PID:1148
- C:\Windows\System\rOQdXdk.exe
  C:\Windows\System\rOQdXdk.exe
  2⤵
  PID:5628
- C:\Windows\System\RFjSDKT.exe
  C:\Windows\System\RFjSDKT.exe
  2⤵
  PID:5896
- C:\Windows\System\BcnXDOt.exe
  C:\Windows\System\BcnXDOt.exe
  2⤵
  PID:6148
- C:\Windows\System\ZXQwcnT.exe
  C:\Windows\System\ZXQwcnT.exe
  2⤵
  PID:6164
- C:\Windows\System\WKIbOic.exe
  C:\Windows\System\WKIbOic.exe
  2⤵
  PID:6180
- C:\Windows\System\ZqRiHqY.exe
  C:\Windows\System\ZqRiHqY.exe
  2⤵
  PID:6200
- C:\Windows\System\NkhxiXk.exe
  C:\Windows\System\NkhxiXk.exe
  2⤵
  PID:6216
- C:\Windows\System\GhThrNv.exe
  C:\Windows\System\GhThrNv.exe
  2⤵
  PID:6232
- C:\Windows\System\BmCslIa.exe
  C:\Windows\System\BmCslIa.exe
  2⤵
  PID:6252
- C:\Windows\System\RaEmaEp.exe
  C:\Windows\System\RaEmaEp.exe
  2⤵
  PID:6268
- C:\Windows\System\skjGxfn.exe
  C:\Windows\System\skjGxfn.exe
  2⤵
  PID:6284
- C:\Windows\System\XWekThv.exe
  C:\Windows\System\XWekThv.exe
  2⤵
  PID:6300
- C:\Windows\System\coEDaPu.exe
  C:\Windows\System\coEDaPu.exe
  2⤵
  PID:6316
- C:\Windows\System\RerFSBF.exe
  C:\Windows\System\RerFSBF.exe
  2⤵
  PID:6332
- C:\Windows\System\ttdNXAz.exe
  C:\Windows\System\ttdNXAz.exe
  2⤵
  PID:6348
- C:\Windows\System\BZhqHZg.exe
  C:\Windows\System\BZhqHZg.exe
  2⤵
  PID:6368
- C:\Windows\System\MXjgcaL.exe
  C:\Windows\System\MXjgcaL.exe
  2⤵
  PID:6392
- C:\Windows\System\cOKFwRJ.exe
  C:\Windows\System\cOKFwRJ.exe
  2⤵
  PID:6412
- C:\Windows\System\zwacCeY.exe
  C:\Windows\System\zwacCeY.exe
  2⤵
  PID:6428
- C:\Windows\System\xpUtKvD.exe
  C:\Windows\System\xpUtKvD.exe
  2⤵
  PID:6444
- C:\Windows\System\qlrwzpd.exe
  C:\Windows\System\qlrwzpd.exe
  2⤵
  PID:6460
- C:\Windows\System\CMoyIMO.exe
  C:\Windows\System\CMoyIMO.exe
  2⤵
  PID:6476
- C:\Windows\System\IeyiXAQ.exe
  C:\Windows\System\IeyiXAQ.exe
  2⤵
  PID:6492
- C:\Windows\System\pfmjaYd.exe
  C:\Windows\System\pfmjaYd.exe
  2⤵
  PID:6508
- C:\Windows\System\pOMLNfM.exe
  C:\Windows\System\pOMLNfM.exe
  2⤵
  PID:6524
- C:\Windows\System\VPUFWcH.exe
  C:\Windows\System\VPUFWcH.exe
  2⤵
  PID:6540
- C:\Windows\System\ruOfCnK.exe
  C:\Windows\System\ruOfCnK.exe
  2⤵
  PID:6556
- C:\Windows\System\oBRYraz.exe
  C:\Windows\System\oBRYraz.exe
  2⤵
  PID:6576
- C:\Windows\System\wvBpGDS.exe
  C:\Windows\System\wvBpGDS.exe
  2⤵
  PID:6592
- C:\Windows\System\bNOidGg.exe
  C:\Windows\System\bNOidGg.exe
  2⤵
  PID:6620
- C:\Windows\System\SiXrYWf.exe
  C:\Windows\System\SiXrYWf.exe
  2⤵
  PID:6648
- C:\Windows\System\TpbYnwQ.exe
  C:\Windows\System\TpbYnwQ.exe
  2⤵
  PID:6664
- C:\Windows\System\XeaRUBM.exe
  C:\Windows\System\XeaRUBM.exe
  2⤵
  PID:6680
- C:\Windows\System\hhmTGUk.exe
  C:\Windows\System\hhmTGUk.exe
  2⤵
  PID:6696
- C:\Windows\System\EFuTKKO.exe
  C:\Windows\System\EFuTKKO.exe
  2⤵
  PID:6716
- C:\Windows\System\SDlOqTZ.exe
  C:\Windows\System\SDlOqTZ.exe
  2⤵
  PID:6740
- C:\Windows\System\nFIzPQc.exe
  C:\Windows\System\nFIzPQc.exe
  2⤵
  PID:6756
- C:\Windows\System\dovszxS.exe
  C:\Windows\System\dovszxS.exe
  2⤵
  PID:6772
- C:\Windows\System\WrTCapb.exe
  C:\Windows\System\WrTCapb.exe
  2⤵
  PID:6800
- C:\Windows\System\TuupWdU.exe
  C:\Windows\System\TuupWdU.exe
  2⤵
  PID:6844
- C:\Windows\System\IGNbbxy.exe
  C:\Windows\System\IGNbbxy.exe
  2⤵
  PID:6860
- C:\Windows\System\mttXawx.exe
  C:\Windows\System\mttXawx.exe
  2⤵
  PID:6876
- C:\Windows\System\nDdXPiG.exe
  C:\Windows\System\nDdXPiG.exe
  2⤵
  PID:6892
- C:\Windows\System\yCwykSd.exe
  C:\Windows\System\yCwykSd.exe
  2⤵
  PID:6908
- C:\Windows\System\vPYefOT.exe
  C:\Windows\System\vPYefOT.exe
  2⤵
  PID:6924
- C:\Windows\System\AnBrrFN.exe
  C:\Windows\System\AnBrrFN.exe
  2⤵
  PID:6940
- C:\Windows\System\qTgjbRQ.exe
  C:\Windows\System\qTgjbRQ.exe
  2⤵
  PID:6956
- C:\Windows\System\TRevMMN.exe
  C:\Windows\System\TRevMMN.exe
  2⤵
  PID:6972
- C:\Windows\System\bZBWRsq.exe
  C:\Windows\System\bZBWRsq.exe
  2⤵
  PID:6996
- C:\Windows\System\jGDvikO.exe
  C:\Windows\System\jGDvikO.exe
  2⤵
  PID:7016
- C:\Windows\System\kZWklVE.exe
  C:\Windows\System\kZWklVE.exe
  2⤵
  PID:7032
- C:\Windows\System\UkUIbdC.exe
  C:\Windows\System\UkUIbdC.exe
  2⤵
  PID:7056
- C:\Windows\System\NggcFnZ.exe
  C:\Windows\System\NggcFnZ.exe
  2⤵
  PID:7116
- C:\Windows\System\yRIWlmE.exe
  C:\Windows\System\yRIWlmE.exe
  2⤵
  PID:7132
- C:\Windows\System\QlfEmhb.exe
  C:\Windows\System\QlfEmhb.exe
  2⤵
  PID:7148
- C:\Windows\System\cbjHQqI.exe
  C:\Windows\System\cbjHQqI.exe
  2⤵
  PID:480
- C:\Windows\System\kPAbQtF.exe
  C:\Windows\System\kPAbQtF.exe
  2⤵
  PID:6188
- C:\Windows\System\goLRZHL.exe
  C:\Windows\System\goLRZHL.exe
  2⤵
  PID:6260
- C:\Windows\System\uzJxPrc.exe
  C:\Windows\System\uzJxPrc.exe
  2⤵
  PID:6172
- C:\Windows\System\DBGWKbq.exe
  C:\Windows\System\DBGWKbq.exe
  2⤵
  PID:6280
- C:\Windows\System\XrGmICy.exe
  C:\Windows\System\XrGmICy.exe
  2⤵
  PID:6440
- C:\Windows\System\omICBVr.exe
  C:\Windows\System\omICBVr.exe
  2⤵
  PID:6604
- C:\Windows\System\ImLHBnS.exe
  C:\Windows\System\ImLHBnS.exe
  2⤵
  PID:6456
- C:\Windows\System\RjocxAn.exe
  C:\Windows\System\RjocxAn.exe
  2⤵
  PID:6692
- C:\Windows\System\wlYMjEe.exe
  C:\Windows\System\wlYMjEe.exe
  2⤵
  PID:6828
- C:\Windows\System\nXzcUfa.exe
  C:\Windows\System\nXzcUfa.exe
  2⤵
  PID:6640
- C:\Windows\System\tmEnxEt.exe
  C:\Windows\System\tmEnxEt.exe
  2⤵
  PID:6704
- C:\Windows\System\psnvfmJ.exe
  C:\Windows\System\psnvfmJ.exe
  2⤵
  PID:6784
- C:\Windows\System\XPUjNEJ.exe
  C:\Windows\System\XPUjNEJ.exe
  2⤵
  PID:6872
- C:\Windows\System\WpjHxCJ.exe
  C:\Windows\System\WpjHxCJ.exe
  2⤵
  PID:6936
- C:\Windows\System\FUHawvX.exe
  C:\Windows\System\FUHawvX.exe
  2⤵
  PID:7004
- C:\Windows\System\UgdIfpn.exe
  C:\Windows\System\UgdIfpn.exe
  2⤵
  PID:7044
- C:\Windows\System\DcTDqwq.exe
  C:\Windows\System\DcTDqwq.exe
  2⤵
  PID:7024
- C:\Windows\System\qaTpJKy.exe
  C:\Windows\System\qaTpJKy.exe
  2⤵
  PID:6952
- C:\Windows\System\OwOXBxP.exe
  C:\Windows\System\OwOXBxP.exe
  2⤵
  PID:7064
- C:\Windows\System\ZyfGYFY.exe
  C:\Windows\System\ZyfGYFY.exe
  2⤵
  PID:7092
- C:\Windows\System\bvoEWoN.exe
  C:\Windows\System\bvoEWoN.exe
  2⤵
  PID:7128
- C:\Windows\System\dIIHson.exe
  C:\Windows\System\dIIHson.exe
  2⤵
  PID:7160
- C:\Windows\System\uFOmrzb.exe
  C:\Windows\System\uFOmrzb.exe
  2⤵
  PID:7144
- C:\Windows\System\hZLCqay.exe
  C:\Windows\System\hZLCqay.exe
  2⤵
  PID:6160
- C:\Windows\System\WJOUiap.exe
  C:\Windows\System\WJOUiap.exe
  2⤵
  PID:6292
- C:\Windows\System\djcglYj.exe
  C:\Windows\System\djcglYj.exe
  2⤵
  PID:6324
- C:\Windows\System\qReUYor.exe
  C:\Windows\System\qReUYor.exe
  2⤵
  PID:6244
- C:\Windows\System\GyMBwYm.exe
  C:\Windows\System\GyMBwYm.exe
  2⤵
  PID:6024
- C:\Windows\System\ITLDLos.exe
  C:\Windows\System\ITLDLos.exe
  2⤵
  PID:6356
- C:\Windows\System\hHECecu.exe
  C:\Windows\System\hHECecu.exe
  2⤵
  PID:6212
- C:\Windows\System\HZHApRG.exe
  C:\Windows\System\HZHApRG.exe
  2⤵
  PID:6408
- C:\Windows\System\WLiNCaJ.exe
  C:\Windows\System\WLiNCaJ.exe
  2⤵
  PID:6536
- C:\Windows\System\KdzienD.exe
  C:\Windows\System\KdzienD.exe
  2⤵
  PID:6504
- C:\Windows\System\VrPhxxQ.exe
  C:\Windows\System\VrPhxxQ.exe
  2⤵
  PID:6600
- C:\Windows\System\eoJqfuT.exe
  C:\Windows\System\eoJqfuT.exe
  2⤵
  PID:6420
- C:\Windows\System\OjRDRsQ.exe
  C:\Windows\System\OjRDRsQ.exe
  2⤵
  PID:6452
- C:\Windows\System\CPYFzfN.exe
  C:\Windows\System\CPYFzfN.exe
  2⤵
  PID:6608
- C:\Windows\System\ORSXPlK.exe
  C:\Windows\System\ORSXPlK.exe
  2⤵
  PID:6656
- C:\Windows\System\fnbGgAu.exe
  C:\Windows\System\fnbGgAu.exe
  2⤵
  PID:6732
- C:\Windows\System\ycCFuKh.exe
  C:\Windows\System\ycCFuKh.exe
  2⤵
  PID:6820
- C:\Windows\System\TUzYoJI.exe
  C:\Windows\System\TUzYoJI.exe
  2⤵
  PID:6824
- C:\Windows\System\vgsxUrO.exe
  C:\Windows\System\vgsxUrO.exe
  2⤵
  PID:6636
- C:\Windows\System\hJzxmCK.exe
  C:\Windows\System\hJzxmCK.exe
  2⤵
  PID:6672
- C:\Windows\System\GSDbfcL.exe
  C:\Windows\System\GSDbfcL.exe
  2⤵
  PID:6780
- C:\Windows\System\ozWDTNV.exe
  C:\Windows\System\ozWDTNV.exe
  2⤵
  PID:6904
- C:\Windows\System\gujpuGe.exe
  C:\Windows\System\gujpuGe.exe
  2⤵
  PID:7012
- C:\Windows\System\ezYcRyt.exe
  C:\Windows\System\ezYcRyt.exe
  2⤵
  PID:6920
- C:\Windows\System\qMQHOwi.exe
  C:\Windows\System\qMQHOwi.exe
  2⤵
  PID:1652
- C:\Windows\System\qRwYewr.exe
  C:\Windows\System\qRwYewr.exe
  2⤵
  PID:6964
- C:\Windows\System\sHAEQVv.exe
  C:\Windows\System\sHAEQVv.exe
  2⤵
  PID:7124
- C:\Windows\System\pmSgvUk.exe
  C:\Windows\System\pmSgvUk.exe
  2⤵
  PID:6108
- C:\Windows\System\ShjASrg.exe
  C:\Windows\System\ShjASrg.exe
  2⤵
  PID:6156
- C:\Windows\System\nVUPXSX.exe
  C:\Windows\System\nVUPXSX.exe
  2⤵
  PID:6192
- C:\Windows\System\cqVaPeM.exe
  C:\Windows\System\cqVaPeM.exe
  2⤵
  PID:5768
- C:\Windows\System\ZytmGzp.exe
  C:\Windows\System\ZytmGzp.exe
  2⤵
  PID:6380
- C:\Windows\System\nmuYAKv.exe
  C:\Windows\System\nmuYAKv.exe
  2⤵
  PID:6436
- C:\Windows\System\siKaKtn.exe
  C:\Windows\System\siKaKtn.exe
  2⤵
  PID:6572
- C:\Windows\System\QcPQYAL.exe
  C:\Windows\System\QcPQYAL.exe
  2⤵
  PID:6516
- C:\Windows\System\lnlGwJT.exe
  C:\Windows\System\lnlGwJT.exe
  2⤵
  PID:6388
- C:\Windows\System\eXLzZBF.exe
  C:\Windows\System\eXLzZBF.exe
  2⤵
  PID:6764
- C:\Windows\System\CiqoKDy.exe
  C:\Windows\System\CiqoKDy.exe
  2⤵
  PID:6808
- C:\Windows\System\EcmieKb.exe
  C:\Windows\System\EcmieKb.exe
  2⤵
  PID:7112
- C:\Windows\System\CJKzZgc.exe
  C:\Windows\System\CJKzZgc.exe
  2⤵
  PID:7080
- C:\Windows\System\UVMoosR.exe
  C:\Windows\System\UVMoosR.exe
  2⤵
  PID:7140
- C:\Windows\System\OgHDflU.exe
  C:\Windows\System\OgHDflU.exe
  2⤵
  PID:6852
- C:\Windows\System\CrmlULd.exe
  C:\Windows\System\CrmlULd.exe
  2⤵
  PID:7052
- C:\Windows\System\UNCUZzL.exe
  C:\Windows\System\UNCUZzL.exe
  2⤵
  PID:7068
- C:\Windows\System\cLAEkpi.exe
  C:\Windows\System\cLAEkpi.exe
  2⤵
  PID:2452
- C:\Windows\System\QFURhVa.exe
  C:\Windows\System\QFURhVa.exe
  2⤵
  PID:6584
- C:\Windows\System\wbHOVmx.exe
  C:\Windows\System\wbHOVmx.exe
  2⤵
  PID:6816
- C:\Windows\System\ChYFdZn.exe
  C:\Windows\System\ChYFdZn.exe
  2⤵
  PID:6916
- C:\Windows\System\ccqPQIX.exe
  C:\Windows\System\ccqPQIX.exe
  2⤵
  PID:7156
- C:\Windows\System\rbjfLAU.exe
  C:\Windows\System\rbjfLAU.exe
  2⤵
  PID:7180
- C:\Windows\System\lWvMukI.exe
  C:\Windows\System\lWvMukI.exe
  2⤵
  PID:7196
- C:\Windows\System\jQAPGHp.exe
  C:\Windows\System\jQAPGHp.exe
  2⤵
  PID:7212
- C:\Windows\System\CoZhBqj.exe
  C:\Windows\System\CoZhBqj.exe
  2⤵
  PID:7228
- C:\Windows\System\jARdiWm.exe
  C:\Windows\System\jARdiWm.exe
  2⤵
  PID:7244
- C:\Windows\System\sfgxQLM.exe
  C:\Windows\System\sfgxQLM.exe
  2⤵
  PID:7260
- C:\Windows\System\lVmdppZ.exe
  C:\Windows\System\lVmdppZ.exe
  2⤵
  PID:7276
- C:\Windows\System\iQriNzB.exe
  C:\Windows\System\iQriNzB.exe
  2⤵
  PID:7292
- C:\Windows\System\SptqLev.exe
  C:\Windows\System\SptqLev.exe
  2⤵
  PID:7308
- C:\Windows\System\efXxKbm.exe
  C:\Windows\System\efXxKbm.exe
  2⤵
  PID:7324
- C:\Windows\System\TSERRss.exe
  C:\Windows\System\TSERRss.exe
  2⤵
  PID:7340
- C:\Windows\System\lQTQxXC.exe
  C:\Windows\System\lQTQxXC.exe
  2⤵
  PID:7356
- C:\Windows\System\xwIcRED.exe
  C:\Windows\System\xwIcRED.exe
  2⤵
  PID:7372
- C:\Windows\System\ixIxVMX.exe
  C:\Windows\System\ixIxVMX.exe
  2⤵
  PID:7388
- C:\Windows\System\DSHkwhe.exe
  C:\Windows\System\DSHkwhe.exe
  2⤵
  PID:7404
- C:\Windows\System\hLRwqtL.exe
  C:\Windows\System\hLRwqtL.exe
  2⤵
  PID:7420
- C:\Windows\System\dmJYyPn.exe
  C:\Windows\System\dmJYyPn.exe
  2⤵
  PID:7440
- C:\Windows\System\eKyabzr.exe
  C:\Windows\System\eKyabzr.exe
  2⤵
  PID:7456
- C:\Windows\System\kEokywH.exe
  C:\Windows\System\kEokywH.exe
  2⤵
  PID:7472
- C:\Windows\System\hqGOsbJ.exe
  C:\Windows\System\hqGOsbJ.exe
  2⤵
  PID:7488
- C:\Windows\System\FqIoxBs.exe
  C:\Windows\System\FqIoxBs.exe
  2⤵
  PID:7504
- C:\Windows\System\ymuiHwn.exe
  C:\Windows\System\ymuiHwn.exe
  2⤵
  PID:7520
- C:\Windows\System\mhcxtde.exe
  C:\Windows\System\mhcxtde.exe
  2⤵
  PID:7536
- C:\Windows\System\cfgFtfP.exe
  C:\Windows\System\cfgFtfP.exe
  2⤵
  PID:7556
- C:\Windows\System\xkMoStv.exe
  C:\Windows\System\xkMoStv.exe
  2⤵
  PID:7580
- C:\Windows\System\BMuojBL.exe
  C:\Windows\System\BMuojBL.exe
  2⤵
  PID:7596
- C:\Windows\System\TifQEKg.exe
  C:\Windows\System\TifQEKg.exe
  2⤵
  PID:7612
- C:\Windows\System\WUtSbfT.exe
  C:\Windows\System\WUtSbfT.exe
  2⤵
  PID:7628
- C:\Windows\System\orLDWOi.exe
  C:\Windows\System\orLDWOi.exe
  2⤵
  PID:7644
- C:\Windows\System\KEMpAhR.exe
  C:\Windows\System\KEMpAhR.exe
  2⤵
  PID:7660
- C:\Windows\System\HsAnKNh.exe
  C:\Windows\System\HsAnKNh.exe
  2⤵
  PID:7676
- C:\Windows\System\cZjpxXg.exe
  C:\Windows\System\cZjpxXg.exe
  2⤵
  PID:7692
- C:\Windows\System\VaXoQht.exe
  C:\Windows\System\VaXoQht.exe
  2⤵
  PID:7708
- C:\Windows\System\FIvuDtv.exe
  C:\Windows\System\FIvuDtv.exe
  2⤵
  PID:7756
- C:\Windows\System\kwCvZDL.exe
  C:\Windows\System\kwCvZDL.exe
  2⤵
  PID:7780
- C:\Windows\System\JgtHrjR.exe
  C:\Windows\System\JgtHrjR.exe
  2⤵
  PID:7812
- C:\Windows\System\lFtuMsE.exe
  C:\Windows\System\lFtuMsE.exe
  2⤵
  PID:7836
- C:\Windows\System\hECeEjD.exe
  C:\Windows\System\hECeEjD.exe
  2⤵
  PID:7856
- C:\Windows\System\FsFMnCe.exe
  C:\Windows\System\FsFMnCe.exe
  2⤵
  PID:7872
- C:\Windows\System\GKSEuui.exe
  C:\Windows\System\GKSEuui.exe
  2⤵
  PID:7888
- C:\Windows\System\DYaxkNw.exe
  C:\Windows\System\DYaxkNw.exe
  2⤵
  PID:7904
- C:\Windows\System\KqFYUCg.exe
  C:\Windows\System\KqFYUCg.exe
  2⤵
  PID:7920
- C:\Windows\System\sUleXDY.exe
  C:\Windows\System\sUleXDY.exe
  2⤵
  PID:7936
- C:\Windows\System\kbrymtF.exe
  C:\Windows\System\kbrymtF.exe
  2⤵
  PID:7956
- C:\Windows\System\QcUpIGf.exe
  C:\Windows\System\QcUpIGf.exe
  2⤵
  PID:7972
- C:\Windows\System\eRsOixs.exe
  C:\Windows\System\eRsOixs.exe
  2⤵
  PID:7988
- C:\Windows\System\gmDMmRN.exe
  C:\Windows\System\gmDMmRN.exe
  2⤵
  PID:8004
- C:\Windows\System\CQPPtXz.exe
  C:\Windows\System\CQPPtXz.exe
  2⤵
  PID:8020
- C:\Windows\System\WjSSXeL.exe
  C:\Windows\System\WjSSXeL.exe
  2⤵
  PID:8036
- C:\Windows\System\MMUGWgb.exe
  C:\Windows\System\MMUGWgb.exe
  2⤵
  PID:8052
- C:\Windows\System\vALUMrv.exe
  C:\Windows\System\vALUMrv.exe
  2⤵
  PID:8068
- C:\Windows\System\lcJWcKJ.exe
  C:\Windows\System\lcJWcKJ.exe
  2⤵
  PID:8084
- C:\Windows\System\cNZGNum.exe
  C:\Windows\System\cNZGNum.exe
  2⤵
  PID:8100
- C:\Windows\System\bqiLffy.exe
  C:\Windows\System\bqiLffy.exe
  2⤵
  PID:8116
- C:\Windows\System\xNFRayM.exe
  C:\Windows\System\xNFRayM.exe
  2⤵
  PID:8132
- C:\Windows\System\jQuEtlo.exe
  C:\Windows\System\jQuEtlo.exe
  2⤵
  PID:8168
- C:\Windows\System\qtLVBBw.exe
  C:\Windows\System\qtLVBBw.exe
  2⤵
  PID:5980
- C:\Windows\System\gSOHcia.exe
  C:\Windows\System\gSOHcia.exe
  2⤵
  PID:7188
- C:\Windows\System\DOYzqEe.exe
  C:\Windows\System\DOYzqEe.exe
  2⤵
  PID:6400
- C:\Windows\System\PLczmgG.exe
  C:\Windows\System\PLczmgG.exe
  2⤵
  PID:6588
- C:\Windows\System\URImygN.exe
  C:\Windows\System\URImygN.exe
  2⤵
  PID:7172
- C:\Windows\System\VXhpctg.exe
  C:\Windows\System\VXhpctg.exe
  2⤵
  PID:7252
- C:\Windows\System\pphBSxn.exe
  C:\Windows\System\pphBSxn.exe
  2⤵
  PID:7288
- C:\Windows\System\yxJolqi.exe
  C:\Windows\System\yxJolqi.exe
  2⤵
  PID:7352
- C:\Windows\System\wBYCigT.exe
  C:\Windows\System\wBYCigT.exe
  2⤵
  PID:7332
- C:\Windows\System\anMyrHM.exe
  C:\Windows\System\anMyrHM.exe
  2⤵
  PID:7364
- C:\Windows\System\DxyLLfn.exe
  C:\Windows\System\DxyLLfn.exe
  2⤵
  PID:7272
- C:\Windows\System\dwSwMzB.exe
  C:\Windows\System\dwSwMzB.exe
  2⤵
  PID:7448
- C:\Windows\System\YvKkIPc.exe
  C:\Windows\System\YvKkIPc.exe
  2⤵
  PID:7484
- C:\Windows\System\wYkWaer.exe
  C:\Windows\System\wYkWaer.exe
  2⤵
  PID:7548
- C:\Windows\System\IjBznDt.exe
  C:\Windows\System\IjBznDt.exe
  2⤵
  PID:7588
- C:\Windows\System\XOaxdpy.exe
  C:\Windows\System\XOaxdpy.exe
  2⤵
  PID:7652
- C:\Windows\System\DpXBrJA.exe
  C:\Windows\System\DpXBrJA.exe
  2⤵
  PID:7684
- C:\Windows\System\NxAkdrg.exe
  C:\Windows\System\NxAkdrg.exe
  2⤵
  PID:7716
- C:\Windows\System\sUsLFAO.exe
  C:\Windows\System\sUsLFAO.exe
  2⤵
  PID:7668
- C:\Windows\System\uNRSuRt.exe
  C:\Windows\System\uNRSuRt.exe
  2⤵
  PID:7636
- C:\Windows\System\zVYKFLj.exe
  C:\Windows\System\zVYKFLj.exe
  2⤵
  PID:7604
- C:\Windows\System\hdGWedz.exe
  C:\Windows\System\hdGWedz.exe
  2⤵
  PID:7724
- C:\Windows\System\XVtdMHn.exe
  C:\Windows\System\XVtdMHn.exe
  2⤵
  PID:7744
- C:\Windows\System\AFMssTC.exe
  C:\Windows\System\AFMssTC.exe
  2⤵
  PID:7764
- C:\Windows\System\eaiBbFK.exe
  C:\Windows\System\eaiBbFK.exe
  2⤵
  PID:7788
- C:\Windows\System\auFhDgy.exe
  C:\Windows\System\auFhDgy.exe
  2⤵
  PID:7800
- C:\Windows\System\iPmQbEA.exe
  C:\Windows\System\iPmQbEA.exe
  2⤵
  PID:7824
- C:\Windows\System\SBsWtml.exe
  C:\Windows\System\SBsWtml.exe
  2⤵
  PID:7848
- C:\Windows\System\qSCnxaQ.exe
  C:\Windows\System\qSCnxaQ.exe
  2⤵
  PID:7864
- C:\Windows\System\woAvAik.exe
  C:\Windows\System\woAvAik.exe
  2⤵
  PID:7932
- C:\Windows\System\wupkSFK.exe
  C:\Windows\System\wupkSFK.exe
  2⤵
  PID:7944
- C:\Windows\System\VsKDlII.exe
  C:\Windows\System\VsKDlII.exe
  2⤵
  PID:7980
- C:\Windows\System\CqQwiUz.exe
  C:\Windows\System\CqQwiUz.exe
  2⤵
  PID:8044
- C:\Windows\System\IuyuGAl.exe
  C:\Windows\System\IuyuGAl.exe
  2⤵
  PID:8108
- C:\Windows\System\dKfDtDi.exe
  C:\Windows\System\dKfDtDi.exe
  2⤵
  PID:7996
- C:\Windows\System\fwSloih.exe
  C:\Windows\System\fwSloih.exe
  2⤵
  PID:8060
- C:\Windows\System\ehHTabu.exe
  C:\Windows\System\ehHTabu.exe
  2⤵
  PID:8032
- C:\Windows\System\RqRPpWc.exe
  C:\Windows\System\RqRPpWc.exe
  2⤵
  PID:8160
- C:\Windows\System\YHKyONu.exe
  C:\Windows\System\YHKyONu.exe
  2⤵
  PID:8180
- C:\Windows\System\mLMHjXS.exe
  C:\Windows\System\mLMHjXS.exe
  2⤵
  PID:6644
- C:\Windows\System\oXOTHaa.exe
  C:\Windows\System\oXOTHaa.exe
  2⤵
  PID:7236
- C:\Windows\System\ypyWMOv.exe
  C:\Windows\System\ypyWMOv.exe
  2⤵
  PID:7348
- C:\Windows\System\EvwRMCN.exe
  C:\Windows\System\EvwRMCN.exe
  2⤵
  PID:8188
- C:\Windows\System\QFsILbs.exe
  C:\Windows\System\QFsILbs.exe
  2⤵
  PID:7656
- C:\Windows\System\tYdDPaa.exe
  C:\Windows\System\tYdDPaa.exe
  2⤵
  PID:7808
- C:\Windows\System\MgvUqrY.exe
  C:\Windows\System\MgvUqrY.exe
  2⤵
  PID:7880
- C:\Windows\System\ojGiZRC.exe
  C:\Windows\System\ojGiZRC.exe
  2⤵
  PID:7240
- C:\Windows\System\tKaThjA.exe
  C:\Windows\System\tKaThjA.exe
  2⤵
  PID:7284
- C:\Windows\System\xNXCPCB.exe
  C:\Windows\System\xNXCPCB.exe
  2⤵
  PID:6632
- C:\Windows\System\LHupuVn.exe
  C:\Windows\System\LHupuVn.exe
  2⤵
  PID:7432
- C:\Windows\System\lpHorUQ.exe
  C:\Windows\System\lpHorUQ.exe
  2⤵
  PID:7300
- C:\Windows\System\cMnovsO.exe
  C:\Windows\System\cMnovsO.exe
  2⤵
  PID:7740
- C:\Windows\System\vghansg.exe
  C:\Windows\System\vghansg.exe
  2⤵
  PID:7752
- C:\Windows\System\CDeSRkI.exe
  C:\Windows\System\CDeSRkI.exe
  2⤵
  PID:7964
- C:\Windows\System\KbKIlyA.exe
  C:\Windows\System\KbKIlyA.exe
  2⤵
  PID:8016
- C:\Windows\System\FjUoYHh.exe
  C:\Windows\System\FjUoYHh.exe
  2⤵
  PID:7516
- C:\Windows\System\KGAnzVN.exe
  C:\Windows\System\KGAnzVN.exe
  2⤵
  PID:8144
- C:\Windows\System\AwxbjTd.exe
  C:\Windows\System\AwxbjTd.exe
  2⤵
  PID:8152
- C:\Windows\System\ntQCTCg.exe
  C:\Windows\System\ntQCTCg.exe
  2⤵
  PID:8176
- C:\Windows\System\ntycGcl.exe
  C:\Windows\System\ntycGcl.exe
  2⤵
  PID:7544
- C:\Windows\System\BehjJwt.exe
  C:\Windows\System\BehjJwt.exe
  2⤵
  PID:6748
- C:\Windows\System\EvkLYpt.exe
  C:\Windows\System\EvkLYpt.exe
  2⤵
  PID:7528
- C:\Windows\System\LrhBcrz.exe
  C:\Windows\System\LrhBcrz.exe
  2⤵
  PID:7608
- C:\Windows\System\acARUhW.exe
  C:\Windows\System\acARUhW.exe
  2⤵
  PID:7900
- C:\Windows\System\kIbODTh.exe
  C:\Windows\System\kIbODTh.exe
  2⤵
  PID:8096
- C:\Windows\System\FDivOlh.exe
  C:\Windows\System\FDivOlh.exe
  2⤵
  PID:8012
- C:\Windows\System\pSeqSKe.exe
  C:\Windows\System\pSeqSKe.exe
  2⤵
  PID:7968
- C:\Windows\System\XnbynRb.exe
  C:\Windows\System\XnbynRb.exe
  2⤵
  PID:8148
- C:\Windows\System\ApoGCVa.exe
  C:\Windows\System\ApoGCVa.exe
  2⤵
  PID:7720
- C:\Windows\System\YXJxrlM.exe
  C:\Windows\System\YXJxrlM.exe
  2⤵
  PID:7384
- C:\Windows\System\POTXoNq.exe
  C:\Windows\System\POTXoNq.exe
  2⤵
  PID:7220
- C:\Windows\System\MjwmnQL.exe
  C:\Windows\System\MjwmnQL.exe
  2⤵
  PID:8208
- C:\Windows\System\uFEayKy.exe
  C:\Windows\System\uFEayKy.exe
  2⤵
  PID:8224
- C:\Windows\System\TxJKFaz.exe
  C:\Windows\System\TxJKFaz.exe
  2⤵
  PID:8240
- C:\Windows\System\klvbwAF.exe
  C:\Windows\System\klvbwAF.exe
  2⤵
  PID:8256
- C:\Windows\System\eulHShd.exe
  C:\Windows\System\eulHShd.exe
  2⤵
  PID:8272
- C:\Windows\System\IjwOsfG.exe
  C:\Windows\System\IjwOsfG.exe
  2⤵
  PID:8300
- C:\Windows\System\WoysktH.exe
  C:\Windows\System\WoysktH.exe
  2⤵
  PID:8340
- C:\Windows\System\DmVWSwo.exe
  C:\Windows\System\DmVWSwo.exe
  2⤵
  PID:8356
- C:\Windows\System\rMSPieu.exe
  C:\Windows\System\rMSPieu.exe
  2⤵
  PID:8372
- C:\Windows\System\KYrwvly.exe
  C:\Windows\System\KYrwvly.exe
  2⤵
  PID:8404
- C:\Windows\System\AcBsKmZ.exe
  C:\Windows\System\AcBsKmZ.exe
  2⤵
  PID:8420
- C:\Windows\System\AVwlpxU.exe
  C:\Windows\System\AVwlpxU.exe
  2⤵
  PID:8436
- C:\Windows\System\AuaoyVQ.exe
  C:\Windows\System\AuaoyVQ.exe
  2⤵
  PID:8456
- C:\Windows\System\lcxCrRe.exe
  C:\Windows\System\lcxCrRe.exe
  2⤵
  PID:8484
- C:\Windows\System\RVvUvrH.exe
  C:\Windows\System\RVvUvrH.exe
  2⤵
  PID:8504
- C:\Windows\System\rQoYRTD.exe
  C:\Windows\System\rQoYRTD.exe
  2⤵
  PID:8528
- C:\Windows\System\XZjfgNg.exe
  C:\Windows\System\XZjfgNg.exe
  2⤵
  PID:8548
- C:\Windows\System\dpitHZO.exe
  C:\Windows\System\dpitHZO.exe
  2⤵
  PID:8568
- C:\Windows\System\qrdPkkL.exe
  C:\Windows\System\qrdPkkL.exe
  2⤵
  PID:8588
- C:\Windows\System\PNlVjtJ.exe
  C:\Windows\System\PNlVjtJ.exe
  2⤵
  PID:8620
- C:\Windows\System\MrrzBLx.exe
  C:\Windows\System\MrrzBLx.exe
  2⤵
  PID:8636
- C:\Windows\System\bzcZqhi.exe
  C:\Windows\System\bzcZqhi.exe
  2⤵
  PID:8652
- C:\Windows\System\wdkAgty.exe
  C:\Windows\System\wdkAgty.exe
  2⤵
  PID:8672
- C:\Windows\System\ZFvIpPv.exe
  C:\Windows\System\ZFvIpPv.exe
  2⤵
  PID:8692
- C:\Windows\System\RbxMSAL.exe
  C:\Windows\System\RbxMSAL.exe
  2⤵
  PID:8708
- C:\Windows\System\oTDbGVE.exe
  C:\Windows\System\oTDbGVE.exe
  2⤵
  PID:8724
- C:\Windows\System\HeudLGm.exe
  C:\Windows\System\HeudLGm.exe
  2⤵
  PID:8764
- C:\Windows\System\hSGONGY.exe
  C:\Windows\System\hSGONGY.exe
  2⤵
  PID:8780
- C:\Windows\System\ewnIhUN.exe
  C:\Windows\System\ewnIhUN.exe
  2⤵
  PID:8796
- C:\Windows\System\AwzSdIt.exe
  C:\Windows\System\AwzSdIt.exe
  2⤵
  PID:8812
- C:\Windows\System\wXxFmUU.exe
  C:\Windows\System\wXxFmUU.exe
  2⤵
  PID:8828
- C:\Windows\System\LfQEoUa.exe
  C:\Windows\System\LfQEoUa.exe
  2⤵
  PID:8852
- C:\Windows\System\syRWeeH.exe
  C:\Windows\System\syRWeeH.exe
  2⤵
  PID:8868
- C:\Windows\System\ZbvGyJA.exe
  C:\Windows\System\ZbvGyJA.exe
  2⤵
  PID:8892
- C:\Windows\System\rLeDTal.exe
  C:\Windows\System\rLeDTal.exe
  2⤵
  PID:8912
- C:\Windows\System\KBAozWr.exe
  C:\Windows\System\KBAozWr.exe
  2⤵
  PID:8944
- C:\Windows\System\mxbJbwo.exe
  C:\Windows\System\mxbJbwo.exe
  2⤵
  PID:8964
- C:\Windows\System\sQBeYED.exe
  C:\Windows\System\sQBeYED.exe
  2⤵
  PID:8980
- C:\Windows\System\QgKRDXv.exe
  C:\Windows\System\QgKRDXv.exe
  2⤵
  PID:8996
- C:\Windows\System\THhKuXk.exe
  C:\Windows\System\THhKuXk.exe
  2⤵
  PID:9016
- C:\Windows\System\DfOrhcV.exe
  C:\Windows\System\DfOrhcV.exe
  2⤵
  PID:9048
- C:\Windows\System\syPjskH.exe
  C:\Windows\System\syPjskH.exe
  2⤵
  PID:9068
- C:\Windows\System\QsfNxYi.exe
  C:\Windows\System\QsfNxYi.exe
  2⤵
  PID:9088
- C:\Windows\System\jqLyeWA.exe
  C:\Windows\System\jqLyeWA.exe
  2⤵
  PID:9108
- C:\Windows\System\uQVOLUf.exe
  C:\Windows\System\uQVOLUf.exe
  2⤵
  PID:9128
- C:\Windows\System\jJeNQWB.exe
  C:\Windows\System\jJeNQWB.exe
  2⤵
  PID:9144
- C:\Windows\System\XHuKAYF.exe
  C:\Windows\System\XHuKAYF.exe
  2⤵
  PID:9160
- C:\Windows\System\wxJeZqN.exe
  C:\Windows\System\wxJeZqN.exe
  2⤵
  PID:9176
- C:\Windows\System\ofCEEmq.exe
  C:\Windows\System\ofCEEmq.exe
  2⤵
  PID:9204
- C:\Windows\System\zlVvvxn.exe
  C:\Windows\System\zlVvvxn.exe
  2⤵
  PID:7104
- C:\Windows\System\suveNoC.exe
  C:\Windows\System\suveNoC.exe
  2⤵
  PID:7320
- C:\Windows\System\QgrAluq.exe
  C:\Windows\System\QgrAluq.exe
  2⤵
  PID:8196
- C:\Windows\System\CtFLgnC.exe
  C:\Windows\System\CtFLgnC.exe
  2⤵
  PID:7912
- C:\Windows\System\pQxVren.exe
  C:\Windows\System\pQxVren.exe
  2⤵
  PID:7208
- C:\Windows\System\fEestVW.exe
  C:\Windows\System\fEestVW.exe
  2⤵
  PID:8268
- C:\Windows\System\MKljvzE.exe
  C:\Windows\System\MKljvzE.exe
  2⤵
  PID:7916
- C:\Windows\System\EdXUwEH.exe
  C:\Windows\System\EdXUwEH.exe
  2⤵
  PID:8312
- C:\Windows\System\XmZbEKq.exe
  C:\Windows\System\XmZbEKq.exe
  2⤵
  PID:8348
- C:\Windows\System\SFLaGWX.exe
  C:\Windows\System\SFLaGWX.exe
  2⤵
  PID:8364
- C:\Windows\System\HJGVqgz.exe
  C:\Windows\System\HJGVqgz.exe
  2⤵
  PID:8388
- C:\Windows\System\xClRIuR.exe
  C:\Windows\System\xClRIuR.exe
  2⤵
  PID:8416
- C:\Windows\System\LbpTDFT.exe
  C:\Windows\System\LbpTDFT.exe
  2⤵
  PID:8428
- C:\Windows\System\ZlQJihk.exe
  C:\Windows\System\ZlQJihk.exe
  2⤵
  PID:8432
- C:\Windows\System\ZhhQQwX.exe
  C:\Windows\System\ZhhQQwX.exe
  2⤵
  PID:8480
- C:\Windows\System\SHEnLxn.exe
  C:\Windows\System\SHEnLxn.exe
  2⤵
  PID:8472
- C:\Windows\System\epjtYuS.exe
  C:\Windows\System\epjtYuS.exe
  2⤵
  PID:8524
- C:\Windows\System\UjXQsHM.exe
  C:\Windows\System\UjXQsHM.exe
  2⤵
  PID:8600
- C:\Windows\System\DNzjMXn.exe
  C:\Windows\System\DNzjMXn.exe
  2⤵
  PID:8660
- C:\Windows\System\gIPqYVp.exe
  C:\Windows\System\gIPqYVp.exe
  2⤵
  PID:8680
- C:\Windows\System\TsTiKau.exe
  C:\Windows\System\TsTiKau.exe
  2⤵
  PID:8716
- C:\Windows\System\lHXFFaz.exe
  C:\Windows\System\lHXFFaz.exe
  2⤵
  PID:8760
- C:\Windows\System\JWSrPEq.exe
  C:\Windows\System\JWSrPEq.exe
  2⤵
  PID:8864
- C:\Windows\System\ErCXdut.exe
  C:\Windows\System\ErCXdut.exe
  2⤵
  PID:8908
- C:\Windows\System\jiazeyx.exe
  C:\Windows\System\jiazeyx.exe
  2⤵
  PID:8956
- C:\Windows\System\LMPvcAp.exe
  C:\Windows\System\LMPvcAp.exe
  2⤵
  PID:9024
- C:\Windows\System\lslfIXv.exe
  C:\Windows\System\lslfIXv.exe
  2⤵
  PID:8928
- C:\Windows\System\kuBGaGg.exe
  C:\Windows\System\kuBGaGg.exe
  2⤵
  PID:8880
- C:\Windows\System\uAXcKGo.exe
  C:\Windows\System\uAXcKGo.exe
  2⤵
  PID:8840
- C:\Windows\System\bneeUmV.exe
  C:\Windows\System\bneeUmV.exe
  2⤵
  PID:9032
- C:\Windows\System\HxUlMXy.exe
  C:\Windows\System\HxUlMXy.exe
  2⤵
  PID:9044
- C:\Windows\System\pWfXhBZ.exe
  C:\Windows\System\pWfXhBZ.exe
  2⤵
  PID:9080
- C:\Windows\System\JjMCHZy.exe
  C:\Windows\System\JjMCHZy.exe
  2⤵
  PID:9124
- C:\Windows\System\BpdTfkT.exe
  C:\Windows\System\BpdTfkT.exe
  2⤵
  PID:8156
- C:\Windows\System\ZyclIsO.exe
  C:\Windows\System\ZyclIsO.exe
  2⤵
  PID:9140
- C:\Windows\System\cdecIlK.exe
  C:\Windows\System\cdecIlK.exe
  2⤵
  PID:2060
- C:\Windows\System\rdyYdET.exe
  C:\Windows\System\rdyYdET.exe
  2⤵
  PID:8236
- C:\Windows\System\iVaAxhQ.exe
  C:\Windows\System\iVaAxhQ.exe
  2⤵
  PID:8332
- C:\Windows\System\HAKjeBM.exe
  C:\Windows\System\HAKjeBM.exe
  2⤵
  PID:8400
- C:\Windows\System\KPoKOOC.exe
  C:\Windows\System\KPoKOOC.exe
  2⤵
  PID:9212
- C:\Windows\System\MDAmOmK.exe
  C:\Windows\System\MDAmOmK.exe
  2⤵
  PID:8540
- C:\Windows\System\qCDmOPB.exe
  C:\Windows\System\qCDmOPB.exe
  2⤵
  PID:8560
- C:\Windows\System\jkLSphn.exe
  C:\Windows\System\jkLSphn.exe
  2⤵
  PID:8324
- C:\Windows\System\nSaHSGV.exe
  C:\Windows\System\nSaHSGV.exe
  2⤵
  PID:8448
- C:\Windows\System\xoUakQL.exe
  C:\Windows\System\xoUakQL.exe
  2⤵
  PID:6724
- C:\Windows\System\iPTTaYg.exe
  C:\Windows\System\iPTTaYg.exe
  2⤵
  PID:8748
- C:\Windows\System\PAanXTM.exe
  C:\Windows\System\PAanXTM.exe
  2⤵
  PID:8688
- C:\Windows\System\uObwLkC.exe
  C:\Windows\System\uObwLkC.exe
  2⤵
  PID:8900
- C:\Windows\System\kGjulMG.exe
  C:\Windows\System\kGjulMG.exe
  2⤵
  PID:8952
- C:\Windows\System\LqGeYJN.exe
  C:\Windows\System\LqGeYJN.exe
  2⤵
  PID:8792
- C:\Windows\System\uNzmRnm.exe
  C:\Windows\System\uNzmRnm.exe
  2⤵
  PID:8920
- C:\Windows\System\xYAyPOw.exe
  C:\Windows\System\xYAyPOw.exe
  2⤵
  PID:8888
- C:\Windows\System\wSyvmpX.exe
  C:\Windows\System\wSyvmpX.exe
  2⤵
  PID:9064
- C:\Windows\System\WCgfcUp.exe
  C:\Windows\System\WCgfcUp.exe
  2⤵
  PID:9152
- C:\Windows\System\ZUYJMJp.exe
  C:\Windows\System\ZUYJMJp.exe
  2⤵
  PID:8292
- C:\Windows\System\dNimCfZ.exe
  C:\Windows\System\dNimCfZ.exe
  2⤵
  PID:9120
- C:\Windows\System\pCFJOcq.exe
  C:\Windows\System\pCFJOcq.exe
  2⤵
  PID:6768
- C:\Windows\System\BnNfSSm.exe
  C:\Windows\System\BnNfSSm.exe
  2⤵
  PID:1852
- C:\Windows\System\jZyMRgB.exe
  C:\Windows\System\jZyMRgB.exe
  2⤵
  PID:8496
- C:\Windows\System\xTyQTSF.exe
  C:\Windows\System\xTyQTSF.exe
  2⤵
  PID:8220
- C:\Windows\System\uIQembM.exe
  C:\Windows\System\uIQembM.exe
  2⤵
  PID:8580
- C:\Windows\System\STheGiS.exe
  C:\Windows\System\STheGiS.exe
  2⤵
  PID:8280
- C:\Windows\System\pYlGKNu.exe
  C:\Windows\System\pYlGKNu.exe
  2⤵
  PID:8584
- C:\Windows\System\XBIZSsC.exe
  C:\Windows\System\XBIZSsC.exe
  2⤵
  PID:8632
- C:\Windows\System\TDtYCGJ.exe
  C:\Windows\System\TDtYCGJ.exe
  2⤵
  PID:9008
- C:\Windows\System\vsiPRxh.exe
  C:\Windows\System\vsiPRxh.exe
  2⤵
  PID:8544
- C:\Windows\System\nrsfvzM.exe
  C:\Windows\System\nrsfvzM.exe
  2⤵
  PID:9104
- C:\Windows\System\iIrOJLX.exe
  C:\Windows\System\iIrOJLX.exe
  2⤵
  PID:8468
- C:\Windows\System\xXuyDSL.exe
  C:\Windows\System\xXuyDSL.exe
  2⤵
  PID:8992
- C:\Windows\System\vfyFoNq.exe
  C:\Windows\System\vfyFoNq.exe
  2⤵
  PID:8564
- C:\Windows\System\NyaPFSH.exe
  C:\Windows\System\NyaPFSH.exe
  2⤵
  PID:8700
- C:\Windows\System\anXSOKj.exe
  C:\Windows\System\anXSOKj.exe
  2⤵
  PID:8772
- C:\Windows\System\DYOYaBQ.exe
  C:\Windows\System\DYOYaBQ.exe
  2⤵
  PID:8976
- C:\Windows\System\uskmHfH.exe
  C:\Windows\System\uskmHfH.exe
  2⤵
  PID:8644
- C:\Windows\System\IjBIGME.exe
  C:\Windows\System\IjBIGME.exe
  2⤵
  PID:8216
- C:\Windows\System\YcOdFtT.exe
  C:\Windows\System\YcOdFtT.exe
  2⤵
  PID:8972
- C:\Windows\System\qZKTZBt.exe
  C:\Windows\System\qZKTZBt.exe
  2⤵
  PID:8608
- C:\Windows\System\PDZJkXo.exe
  C:\Windows\System\PDZJkXo.exe
  2⤵
  PID:9084
- C:\Windows\System\ycoSmqi.exe
  C:\Windows\System\ycoSmqi.exe
  2⤵
  PID:9188
- C:\Windows\System\fscKMZi.exe
  C:\Windows\System\fscKMZi.exe
  2⤵
  PID:8744
- C:\Windows\System\okEpnWX.exe
  C:\Windows\System\okEpnWX.exe
  2⤵
  PID:7736
- C:\Windows\System\cDmBqYA.exe
  C:\Windows\System\cDmBqYA.exe
  2⤵
  PID:8284
- C:\Windows\System\bTpodCq.exe
  C:\Windows\System\bTpodCq.exe
  2⤵
  PID:8776
- C:\Windows\System\wwPFdWW.exe
  C:\Windows\System\wwPFdWW.exe
  2⤵
  PID:8500
- C:\Windows\System\miKcJgZ.exe
  C:\Windows\System\miKcJgZ.exe
  2⤵
  PID:8452
- C:\Windows\System\JFyPioo.exe
  C:\Windows\System\JFyPioo.exe
  2⤵
  PID:9040
- C:\Windows\System\PDDLirq.exe
  C:\Windows\System\PDDLirq.exe
  2⤵
  PID:9224
- C:\Windows\System\wAbNNle.exe
  C:\Windows\System\wAbNNle.exe
  2⤵
  PID:9240
- C:\Windows\System\VAXzeYc.exe
  C:\Windows\System\VAXzeYc.exe
  2⤵
  PID:9260
- C:\Windows\System\ZlWMXyH.exe
  C:\Windows\System\ZlWMXyH.exe
  2⤵
  PID:9280
- C:\Windows\System\EnOVLib.exe
  C:\Windows\System\EnOVLib.exe
  2⤵
  PID:9304
- C:\Windows\System\agnkRss.exe
  C:\Windows\System\agnkRss.exe
  2⤵
  PID:9320
- C:\Windows\System\TNyMvPY.exe
  C:\Windows\System\TNyMvPY.exe
  2⤵
  PID:9344
- C:\Windows\System\HkhQQKO.exe
  C:\Windows\System\HkhQQKO.exe
  2⤵
  PID:9364
- C:\Windows\System\GzAUEuA.exe
  C:\Windows\System\GzAUEuA.exe
  2⤵
  PID:9384
- C:\Windows\System\gAYqAdo.exe
  C:\Windows\System\gAYqAdo.exe
  2⤵
  PID:9404
- C:\Windows\System\fBNSeiL.exe
  C:\Windows\System\fBNSeiL.exe
  2⤵
  PID:9424
- C:\Windows\System\FsqFwCi.exe
  C:\Windows\System\FsqFwCi.exe
  2⤵
  PID:9440
- C:\Windows\System\xiZKIMp.exe
  C:\Windows\System\xiZKIMp.exe
  2⤵
  PID:9464
- C:\Windows\System\VRbJvEo.exe
  C:\Windows\System\VRbJvEo.exe
  2⤵
  PID:9480
- C:\Windows\System\vEyuFqS.exe
  C:\Windows\System\vEyuFqS.exe
  2⤵
  PID:9496
- C:\Windows\System\NYklYGg.exe
  C:\Windows\System\NYklYGg.exe
  2⤵
  PID:9516
- C:\Windows\System\YNSooGa.exe
  C:\Windows\System\YNSooGa.exe
  2⤵
  PID:9536
- C:\Windows\System\yQgjDoW.exe
  C:\Windows\System\yQgjDoW.exe
  2⤵
  PID:9556
- C:\Windows\System\RSgmhYk.exe
  C:\Windows\System\RSgmhYk.exe
  2⤵
  PID:9576
- C:\Windows\System\MwhuGXr.exe
  C:\Windows\System\MwhuGXr.exe
  2⤵
  PID:9592
- C:\Windows\System\qqLNZCn.exe
  C:\Windows\System\qqLNZCn.exe
  2⤵
  PID:9612
- C:\Windows\System\NIweHxJ.exe
  C:\Windows\System\NIweHxJ.exe
  2⤵
  PID:9632
- C:\Windows\System\uGuJKHf.exe
  C:\Windows\System\uGuJKHf.exe
  2⤵
  PID:9656
- C:\Windows\System\VGjxOgF.exe
  C:\Windows\System\VGjxOgF.exe
  2⤵
  PID:9672
- C:\Windows\System\KOeNfIx.exe
  C:\Windows\System\KOeNfIx.exe
  2⤵
  PID:9696
- C:\Windows\System\zzycxaw.exe
  C:\Windows\System\zzycxaw.exe
  2⤵
  PID:9732
- C:\Windows\System\Bdqazxl.exe
  C:\Windows\System\Bdqazxl.exe
  2⤵
  PID:9748
- C:\Windows\System\vrLkmIZ.exe
  C:\Windows\System\vrLkmIZ.exe
  2⤵
  PID:9764
- C:\Windows\System\vRxVPxl.exe
  C:\Windows\System\vRxVPxl.exe
  2⤵
  PID:9796
- C:\Windows\System\OewfqZB.exe
  C:\Windows\System\OewfqZB.exe
  2⤵
  PID:9816
- C:\Windows\System\HZjeqAZ.exe
  C:\Windows\System\HZjeqAZ.exe
  2⤵
  PID:9832
- C:\Windows\System\yktlBWJ.exe
  C:\Windows\System\yktlBWJ.exe
  2⤵
  PID:9852
- C:\Windows\System\ntTmzmh.exe
  C:\Windows\System\ntTmzmh.exe
  2⤵
  PID:9868
- C:\Windows\System\bgnzumY.exe
  C:\Windows\System\bgnzumY.exe
  2⤵
  PID:9888
- C:\Windows\System\EVhWqha.exe
  C:\Windows\System\EVhWqha.exe
  2⤵
  PID:9912
- C:\Windows\System\RXcjAjG.exe
  C:\Windows\System\RXcjAjG.exe
  2⤵
  PID:9928
- C:\Windows\System\NgkHYsH.exe
  C:\Windows\System\NgkHYsH.exe
  2⤵
  PID:9944
- C:\Windows\System\tOFTWEo.exe
  C:\Windows\System\tOFTWEo.exe
  2⤵
  PID:9960
- C:\Windows\System\MHDJCzR.exe
  C:\Windows\System\MHDJCzR.exe
  2⤵
  PID:9984
- C:\Windows\System\KyKiAFZ.exe
  C:\Windows\System\KyKiAFZ.exe
  2⤵
  PID:10004
- C:\Windows\System\KQloJsw.exe
  C:\Windows\System\KQloJsw.exe
  2⤵
  PID:10020
- C:\Windows\System\pXHpelN.exe
  C:\Windows\System\pXHpelN.exe
  2⤵
  PID:10036
- C:\Windows\System\fcDBNwN.exe
  C:\Windows\System\fcDBNwN.exe
  2⤵
  PID:10060
- C:\Windows\System\CotOeOj.exe
  C:\Windows\System\CotOeOj.exe
  2⤵
  PID:10084
- C:\Windows\System\XVppRJu.exe
  C:\Windows\System\XVppRJu.exe
  2⤵
  PID:10104
- C:\Windows\System\kyblKVN.exe
  C:\Windows\System\kyblKVN.exe
  2⤵
  PID:10128
- C:\Windows\System\VzUBYiW.exe
  C:\Windows\System\VzUBYiW.exe
  2⤵
  PID:10144
- C:\Windows\System\JWQqAbs.exe
  C:\Windows\System\JWQqAbs.exe
  2⤵
  PID:10160
- C:\Windows\System\CMopEQZ.exe
  C:\Windows\System\CMopEQZ.exe
  2⤵
  PID:10180
- C:\Windows\System\cLjxWEd.exe
  C:\Windows\System\cLjxWEd.exe
  2⤵
  PID:10196
- C:\Windows\System\tVxOGKT.exe
  C:\Windows\System\tVxOGKT.exe
  2⤵
  PID:10236
- C:\Windows\System\jQaFiPP.exe
  C:\Windows\System\jQaFiPP.exe
  2⤵
  PID:9268
- C:\Windows\System\yZecqOi.exe
  C:\Windows\System\yZecqOi.exe
  2⤵
  PID:9256
- C:\Windows\System\xxpkpdy.exe
  C:\Windows\System\xxpkpdy.exe
  2⤵
  PID:9296
- C:\Windows\System\gdodSIn.exe
  C:\Windows\System\gdodSIn.exe
  2⤵
  PID:9336
- C:\Windows\System\LklGWam.exe
  C:\Windows\System\LklGWam.exe
  2⤵
  PID:9356
- C:\Windows\System\bZIHiTl.exe
  C:\Windows\System\bZIHiTl.exe
  2⤵
  PID:9380
- C:\Windows\System\kFJbAYT.exe
  C:\Windows\System\kFJbAYT.exe
  2⤵
  PID:9416
- C:\Windows\System\nhUJFbB.exe
  C:\Windows\System\nhUJFbB.exe
  2⤵
  PID:9552
- C:\Windows\System\cghrkcf.exe
  C:\Windows\System\cghrkcf.exe
  2⤵
  PID:9564
- C:\Windows\System\NRassrC.exe
  C:\Windows\System\NRassrC.exe
  2⤵
  PID:9568
- C:\Windows\System\uQyIeDP.exe
  C:\Windows\System\uQyIeDP.exe
  2⤵
  PID:9600
- C:\Windows\System\ZRKJtxe.exe
  C:\Windows\System\ZRKJtxe.exe
  2⤵
  PID:9628
- C:\Windows\System\srpJKnq.exe
  C:\Windows\System\srpJKnq.exe
  2⤵
  PID:9640
- C:\Windows\System\dOlVbZV.exe
  C:\Windows\System\dOlVbZV.exe
  2⤵
  PID:9684
- C:\Windows\System\HWQFnbG.exe
  C:\Windows\System\HWQFnbG.exe
  2⤵
  PID:9720
- C:\Windows\System\EQnLgrj.exe
  C:\Windows\System\EQnLgrj.exe
  2⤵
  PID:9756
- C:\Windows\System\HcpHZun.exe
  C:\Windows\System\HcpHZun.exe
  2⤵
  PID:9780
- C:\Windows\System\VSBkBzX.exe
  C:\Windows\System\VSBkBzX.exe
  2⤵
  PID:9808
- C:\Windows\System\uucHYzF.exe
  C:\Windows\System\uucHYzF.exe
  2⤵
  PID:9828
- C:\Windows\System\jjNeeaf.exe
  C:\Windows\System\jjNeeaf.exe
  2⤵
  PID:9884
- C:\Windows\System\UVtLnnB.exe
  C:\Windows\System\UVtLnnB.exe
  2⤵
  PID:9904
- C:\Windows\System\FldNKbP.exe
  C:\Windows\System\FldNKbP.exe
  2⤵
  PID:9952
- C:\Windows\System\FDBeNQW.exe
  C:\Windows\System\FDBeNQW.exe
  2⤵
  PID:9996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HSHtivV.exe

Filesize
1.8MB

MD5
20a25d6469f7c4dede98c73ee2660b88

SHA1
6a34d0a05959fb95b73978f8f17c7d2889ba4c9c

SHA256
827c979c42027afa6ea6414df695ea1a021e15b02cb0bacb59855ca1d066fb97

SHA512
d65354d1ed8955004f8e724e9d1d7eab1ecc9a42166932ab4a3b9e3d7fd685716fa47bef4cdf6d2d6b3d6564fe9dfd0e5382d167d35a6c02b81f3661ca94141f

Download Submit
C:\Windows\system\IpOgUOC.exe

Filesize
1.8MB

MD5
d12066848cb1ee0a5d0a1336afdf230f

SHA1
91935e26082f991b42882d5e76afb342263be074

SHA256
eb7bb03e6ad17fe49da83564f16fd34ee78e7f1a45d1d1c9917199dd7de790fe

SHA512
6ee7a62396fb28f42739aeea27f3b3d5a738883448c21a65dc90ef0b3597c99f1bcd547ba30728cae30f539e22076b1ad24b7914d6f667a437f0a262abcec138

Download Submit
C:\Windows\system\MxpJYkW.exe

Filesize
1.8MB

MD5
e11ec12b0ea90c46f758370c54638e8a

SHA1
8ac3944ca9195ade437092670c37b33c19c76df5

SHA256
6a2de39afc2a984b5939a0fe3bbbd146292785edaa1c02cf023f344dcabff8bf

SHA512
34d287e4c9a5c256b547dbcde73a08598ff74ce85418f5b58d02379def83b2a7f3126ce72ee3102fd7f63db33f04a0773602a730703c63b62f4e7adec9b261e1

Download Submit
C:\Windows\system\NVTyvvg.exe

Filesize
1.8MB

MD5
254bd537aae5d39342cada836d1119ca

SHA1
c623ea95472860973018bcb28a17582ed274346c

SHA256
15f79b80194039ac2449b015342846614acf290e5a7bc9f09d7c171eda03a7c9

SHA512
1f93e64f6ea5f7a9ba749b8afe6263421f24e431f1a2735906a808f1fbf8303951bb2f62290b2567e8b80d1b15fab05e5c21bf8fd859808fffb2a7438905a371

Download Submit
C:\Windows\system\PCXvtfV.exe

Filesize
1.8MB

MD5
6914227b32f60b0f9f2b7cf896c55d2e

SHA1
a7bff225d509194789487e54207ac02d5f8f7a51

SHA256
9e7019569be5ce560ec3266091d1125ba66c1ccc709f040b64e81d0e89bcfec2

SHA512
7f9221f365483c2590702c0b85b67051c6349088822e5e3d4387f764e21c23ea8cd1e4ef38dfb50e92804720e93223859a3c7e5cd059e84965a21f5e6b10b748

Download Submit
C:\Windows\system\QPSgUIv.exe

Filesize
1.8MB

MD5
3809359c7b1cb9bf9b3a0018784a7097

SHA1
6ebc6806f722b6a7742cb06ceee248e043409164

SHA256
060f07ba1b4d991a6554dfe400c9ac9934945f491fe06207cb21303fc34f3271

SHA512
07f698fd1b07fe2cecb619a7b89e2b115bf4608184118da7eb50fa0bea46667225066617b6f29e403ef414250ed10d1a78771086370924ccacb5fa48dc197d32

Download Submit
C:\Windows\system\VGvrCLA.exe

Filesize
1.8MB

MD5
53c96abf3745dbf01d861d1531cb6ded

SHA1
aae23664a89cda63ce26679141a270bd89e4b323

SHA256
4114339dc046868d95795d70a59a15ba0d9eef7f61349cd45821ac6f85f84965

SHA512
c7c186c5898831764699d0f8a154489a15c66a93f37d3c4d41a2b861d8fa937fdc9d90e93f086240c8b3c91ac761523631722691ec7a1db2f6ae136b3f231970

Download Submit
C:\Windows\system\XIcOZZD.exe

Filesize
1.8MB

MD5
22601b830dfb135e92f046051b51c406

SHA1
174413a9fc365dd961d7124f20dcd77c6cf137e8

SHA256
32c736444c6afac635a68922e4283d93eddf24b10c412096d465640b68012789

SHA512
6b7f44d356c3cd30bfad52c7a338e9eef12eb4dd2527e6b0bdc499a8a8a6a5443d12392c809354f03c404c3c0f2c23c6e4d4e474a43d8e7005b1e6efc61516e2

Download Submit
C:\Windows\system\afYmYyk.exe

Filesize
1.8MB

MD5
a7331e4a0c6e5f550076f3e86602c1e0

SHA1
460e30db46bcfd4c3126ad05140d0471dc97c6f6

SHA256
06badd162f9a98f5560bf8b450f5a59d649129843b4c1ffdbef17feca0f76911

SHA512
14d09c76e9ffe4d530e067eb79353d1e7f5307b970b1b8b64926284d624bfd5649b5f12e72b98622169f2d7c3cb4cadb0d1f41b0dd96888b2b3c33b138e177db

Download Submit
C:\Windows\system\awtCzDV.exe

Filesize
1.8MB

MD5
37e3b683742704fa94902bfd63eee93e

SHA1
9be3c6b75c9a5093f831554a57439c0d637e1dff

SHA256
2fc1feff2b6d82de79e3ef91c2b23b39158fcedeb0752fd53085ecc4cb9d6767

SHA512
a9f68e0f8eacc59aed651ea8d0faca89ddccf374c2512d49b5e4f14d0ad2605b465504a4fd752cc2c201d9b6b8a18983c3b9eee93ccb2d989c079290947f39c8

Download Submit
C:\Windows\system\bXWfZzD.exe

Filesize
1.8MB

MD5
3ac29d774a9b64f34f3ff7c56f46efe5

SHA1
ae81f241d8cce6b900029509fcd490177846a495

SHA256
77f5cf176a08205697dcf866c7db6338d98774cb1bbdd3d815c1a8b76d0fc9f1

SHA512
45976db643528ef4127e6ac988ba74a6b064c34cb82396249a022683851d90182683b3b44770911340df3469d3aa557cb8eea11fbc968dbe6eab1f0c6e462dab

Download Submit
C:\Windows\system\bgIVzxg.exe

Filesize
1.8MB

MD5
e86213b74693d2f04d937347e6af3e5b

SHA1
073cb81a2f3427e45b82d445205e5e566eb8554c

SHA256
c94d90d5a9074445cc4443ea923fed257d3047617934bc8e797b0d14834d42cb

SHA512
ebb5bb52c686625a999d0e31a2b6bdf468dac3ab2d8fa3720cb10e6b4cd9d5f33a73ecab93db4798e21e3294aaedf56c01e65ba1e9a0be8b7c1b42f9f9f13e56

Download Submit
C:\Windows\system\dKKsVow.exe

Filesize
1.8MB

MD5
06b045c65e6bb79041e24a2af803e3e3

SHA1
0c2b2f1bc45b8afc385e234aae29d85ef674530c

SHA256
cd01ade7ed6cb62b459a709bada8365c329d6842bb752c837cd3246d7973e1f8

SHA512
8d972a42214d1188005388ac22a5d1ed3df6bfdb3eb3d64e1dfb3c4c563f576676a97e0b61aca38baef931a731c8e8eb7829729cdd9db2dd541f7223793fbef5

Download Submit
C:\Windows\system\hkKxNmp.exe

Filesize
1.8MB

MD5
68b0bb8c4628f0e2dbca368ea64254c0

SHA1
c1ab874e24fee1dcc284cc95533010c5c8d7ed72

SHA256
abff16b60e60bf473baa7b5b31fe324cbf943d6ad566a0620e8388809b516c51

SHA512
e34f3c168a90e5df6ee792cde658e48f86a365f71f074bbd0a7a0efdf4120014649b2a98d87e8eb4326a3f8d5564e90857f57ae405cac48fbae554a608aebf9a

Download Submit
C:\Windows\system\kybfwUX.exe

Filesize
1.8MB

MD5
b7e22b5bcac08f172bb97c032b6ba086

SHA1
55092589c03c7078df73a51f0320c8a70155dd99

SHA256
36081045f9a749bc5ff8ad54aa7746795bfa7fad4648905a50e9b5cb8c904a29

SHA512
523c9bc4f18c4c7667ecfedfe85395e896d3045c9d120a75a65c19ce3798d57dc8791a4b82dc6889ebc9c3abdce1b879511707b2c24d156823dc095dfba266f4

Download Submit
C:\Windows\system\olSCggG.exe

Filesize
1.8MB

MD5
c73ee74b68e33ef680d073661cabac54

SHA1
4f60400beae39747a2fded854171911760716ecd

SHA256
0d20d76f16bab936f6a81d9b7ccd8a237f5e160ef3a03ab324395017e5660197

SHA512
3611363f660fe7086d1e387c4150f03694e5820f2e119b2bef7d8f7914d0bc6325b1567288993ce04726168bf4f3801c2f18e8a2b26de8533bb47c86d5e22465

Download Submit
C:\Windows\system\qSJdjzo.exe

Filesize
1.8MB

MD5
c86ea446f77a966eab811eb5bc2ff64c

SHA1
7b74a7ab6d7b0b6cc39ca5708239e82fe463539d

SHA256
c2d05a83ff34880d913d321fe9b042a0de9e5ac4fb406891bb2b12dbb6bf3ab9

SHA512
8dd72b36248e72c9321019fce34855b820b1beef5b36f1027717c9553a333b7b6cf863d3b5053305f9c4d770d0d805db72ac7ccbb1adc4f5590c425a02208ac4

Download Submit
C:\Windows\system\qVnnOhS.exe

Filesize
1.8MB

MD5
17ce75392d589a000da0f1adcbf0f143

SHA1
e5cd267697025a5a4caa4b4f88f4dded770bb2b7

SHA256
7f3cb42b198b55f1c5a7e3299451411aef59ca12c0e5fd9fb11378f40f287d63

SHA512
0e201c155eb97686d9df301705781e8bb59afead3cca89a4201a64cfc1caef44fa99e92ab27ea47ea06fabb41aede05928249ee95943171baeafe7b4f0ca6ca2

Download Submit
C:\Windows\system\rUvkXcW.exe

Filesize
1.8MB

MD5
4634aaabc893fa26591e6e11f9f94cd2

SHA1
e5983d88bdcdf66d7a083e0b60d6308e0bb7e50e

SHA256
a0798b83c5649ceedc5f8834ba3d5699bca0db14c915fc49a7a552953201430b

SHA512
9f7995d6b39c0003015cd5b10dfebc5715bfac08b98b368daaaf161a1d80e4c8cbcd084f6f219ca828fffd6249efcbe881d3f5c06e76b8af51ea37b2a70963c4

Download Submit
C:\Windows\system\rpALyuU.exe

Filesize
1.8MB

MD5
2b8dbbf8dbe8cba01585ab61443ea31f

SHA1
591c2f16de83c4928cb709e6e5e954dac47e1e77

SHA256
d5e88271ee0113bddc6526cc847c78158dd68ea8a067cf7b1b60ccf36382e7c8

SHA512
f62a13bc37652440958c739c395f5c8bb775dcc98f49ea47a779f7e54db25b4e8cb3454331510a8ace4e9ebdc30796c56261cf8cd211c45875bda69e04bb8753

Download Submit
C:\Windows\system\sykToBf.exe

Filesize
1.8MB

MD5
2b9892aabf9b65ee07c0a1881ce4601d

SHA1
9f7d7906dae3d7dd727b5be638f2a1eb3a74e4b1

SHA256
4242bc9a4d3baa891005fb74fb03e568e7b5b075a568607d3ae268b0eb45da1b

SHA512
46443b7f7c05a610de232fa59ad1ce8242a69eacb1dbba0e47da232dea3bf6c0d72c6f9767fcc5d72b259a7bf5361fece1329530184126d6395b4fecf0401011

Download Submit
C:\Windows\system\vvTSeUm.exe

Filesize
1.8MB

MD5
de5efb70386b049c9bd94ea062c5aec5

SHA1
cd5876617cf87f0e06a1465c7401d11460bd19db

SHA256
98594a38c5f298b35d387b33e425193da3e675793918e87867039d369caee610

SHA512
bb8236dce41b613f7e1e4f0b481856f61d528930a81686dc8e32b8f155a6a2d0e08f77f0945de8bfe663cb81b21bc523f0b6091955fe9263db78d2d11dc2db8d

Download Submit
C:\Windows\system\xAvTAfs.exe

Filesize
1.8MB

MD5
43786b89767cb85fc93f008f93703ec7

SHA1
36ef79498891b786d300ba5fe4486385ad99a6a7

SHA256
1ff61228716e329a3c2d359db513064642fef6d67291e3e76c2138071ea275a7

SHA512
6c32d3caeb801f2235209f48470273514d09dd386c3c8cdfee286d2bacb794e9da08c004174b325f246fc36c23f503c025946c352f43fa4700ceae79d8150a52

Download Submit
C:\Windows\system\xXAGnKb.exe

Filesize
1.8MB

MD5
2e173f91cc6aec1015b8b62c9a9164f4

SHA1
a79ddb5035727a4b19dda65ff17ff5f2d9a98463

SHA256
9f81759c67ecbdc7d7d527848105f5fed67afc765e2c43100d1b5fee37fb42c4

SHA512
a1b680dd24543370aa6ddc35609c0ad8d2d8ca7af1cd93bcd482f479f7300373bd884869cfed355bdfabcc154b30f88dff42ba0485ccc4e86d691ef40fd1fa89

Download Submit
C:\Windows\system\xdQUkhK.exe

Filesize
1.8MB

MD5
3aa078ad0649293264f32fb91195607f

SHA1
025ffe423ff38f17b97f2381c704af6c908cfb0e

SHA256
c7f9a6006b7bb92ee2c661a3542c0a4d11ec7947d2c5874e717aa5956ec132e2

SHA512
d59f99b6ef21ed465fe0c40bc5a78eb322149557f6d06acc19421dff3b58438ab384642f6470347cae0b19feeb2ba83be5b3a9cd7995e5438d0f1da23a119f65

Download Submit
C:\Windows\system\zFOtKQW.exe

Filesize
1.8MB

MD5
ceb5aff1a3ec934fd7b5c9f6a5993768

SHA1
47d38c8c5eb8227ff288bd078eb8223898e538e1

SHA256
0b39e984e55524fdd4427126df60de34a659049da1cfa1c248d3a780516e339c

SHA512
3881c780789b61c74d31f660c88a022e05f41f235dd8a5a9ae2aaad7cd3fc961414fcdfb3d6eaf8c2a3a3f6b30cb99f3e7f059dc6e60969349a1f81ae901327e

Download Submit
C:\Windows\system\zLmeUGz.exe

Filesize
1.8MB

MD5
d417d8652c6252d0e4b5fa623e2fd367

SHA1
1367963c510f9c9c50ef4ab6d2914492372fed91

SHA256
98ec3ed8d9704e68ea28efc044d2c14564daf0639048e635ed37fa74987ce017

SHA512
7da80159a32aeb6d35a450c9856db5dc4b075a08ed01802b46a6f9a49ce6cd7bb64122f464fc65c9829c5cc15b4532763375d923f4811214c5539d98da86b7ee

Download Submit
\Windows\system\QjKBLLy.exe

Filesize
1.8MB

MD5
cc7b47581e7f6706dd2d451438f77a06

SHA1
14f12581990de7c9fe63f9245cb03180db3e53e0

SHA256
aa458c1cee44a07030fef7c52cd6165f00633d338440c8f85336876461c1134b

SHA512
9c83adfa8fca2b0c36bd0393efbbc2c4f60cd3c6955998caf10055aa719cd6f31e50ee766bafe3da6f2952457b885adfb972d278875bc13cd8baf983bd560630

Download Submit
\Windows\system\ZcDArgU.exe

Filesize
1.8MB

MD5
6b79f9ee92c67f324a06c6665f4f65c2

SHA1
8e94de6cfe0a1d1911f6b7fbdb5ad851e2e322a6

SHA256
3f29cdf74dfd880bf45bdf3ab098fbd91153b72027b23b1b40ac0c959795a327

SHA512
974c1717f54c9ee36cebdaa7a7a05fee464d49996e8c02b275f4e4a96acce884710597584e5e16205d13dabc6aba1e819d57650f6ace4905854d75f88f36d054

Download Submit
\Windows\system\awtCzDV.exe

Filesize
1.6MB

MD5
968308729ece8a6ced1ed316b79998a4

SHA1
60537e684af28d29fe94e4457980439906393ce2

SHA256
f3eb458f36c3ebdeac5711c042715820d3cf039bf43d79ed3fb79f04b7971c32

SHA512
ad4190b5742b463280fa76fb5d5bd4d533399274a7e72519419ac0b3dfc178d1426c598be99f3912bb4b5984f8048342fbfef466281369644a269fb0db584d6c

Download Submit
\Windows\system\gtPhdwo.exe

Filesize
1.8MB

MD5
8ca6dde3433bf0e00492cb2f57db3aa9

SHA1
bf4bc0eebf8461552aa2524efd485484e0f94dca

SHA256
1d533a1379f5569138b1a1d3658aa617aca04be3291e584306504d96128be087

SHA512
0b2334c2a22aff8ddf8476435ea612057a46883a1eb741cfeabea715e18cd85183e82988d0f3b9a45e4aea854e8de6e4c8d3daab83bdc798fd0e4ef119f2c182

Download Submit
\Windows\system\nUlnRWk.exe

Filesize
1.8MB

MD5
ef23b07586ca5564eb077198dbe32af0

SHA1
c8fde7bd4b17bb7e94274aff756d783b7a7b9f44

SHA256
ee2bd27467775f3fc597d36dfe74b71962168fc36f10e36f162e64978a4af5fd

SHA512
80477e83f6c89465749e1ec676b0cd93378a204a94df81520aa673f80cab5d31f88ccf5ddf9bd8dca66886aa03f032e2da70ec3e627ebcbd07cabfb21f2e2351

Download Submit
\Windows\system\rpALyuU.exe

Filesize
1.8MB

MD5
da3c574479019fcea05566c59242cd46

SHA1
f0d2673e170eee2bfbead678b7d2d5ec3616fef2

SHA256
02dfcde27dbad2f9b70019b2b5d4d8ef3264ca2099dadc9ca2999cb7f67b8ad2

SHA512
97765ca34b8004bd1b02810ea8d94c5dc0468a0925371e0f783f22889d57e942d852261f8c2b106f205acaf00340246a489553a09ca600864ec567d1021f75f5

Download Submit
\Windows\system\wFuNaQO.exe

Filesize
1.8MB

MD5
1af71696da119fe9a390dfbd052e4a70

SHA1
9ca207a708567e24f2d281ced8ff53ddeda70792

SHA256
9a9f7d58523386c95c462e5be2023ccc2ddce7c732e6b979e230dc0ab6abba55

SHA512
ca94fcdb47a90319c9d558bb8510759a8db814924c89942c4895655adad2d7b2a6a68bf0f4397fe34279e1d0aad67f124d28ae0458b337e40365dfd26e4db44c

Download Submit
memory/1144-4011-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/1144-51-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/1740-29-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/1740-4006-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2192-40-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-98-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2192-58-0x0000000002020000-0x0000000002374000-memory.dmp

Filesize
3.3MB

Download
memory/2192-82-0x0000000002020000-0x0000000002374000-memory.dmp

Filesize
3.3MB

Download
memory/2192-61-0x0000000002020000-0x0000000002374000-memory.dmp

Filesize
3.3MB

Download
memory/2192-3026-0x0000000002020000-0x0000000002374000-memory.dmp

Filesize
3.3MB

Download
memory/2192-3177-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2192-2528-0x0000000002020000-0x0000000002374000-memory.dmp

Filesize
3.3MB

Download
memory/2192-2523-0x0000000002020000-0x0000000002374000-memory.dmp

Filesize
3.3MB

Download
memory/2192-2508-0x000000013F280000-0x000000013F5D4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2192-68-0x000000013F6E0000-0x000000013FA34000-memory.dmp

Filesize
3.3MB

Download
memory/2192-111-0x000000013FD50000-0x00000001400A4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-75-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/2192-20-0x000000013FED0000-0x0000000140224000-memory.dmp

Filesize
3.3MB

Download
memory/2192-0-0x000000013F280000-0x000000013F5D4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-77-0x000000013FFF0000-0x0000000140344000-memory.dmp

Filesize
3.3MB

Download
memory/2192-35-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/2192-80-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-81-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2192-95-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2192-84-0x000000013FFE0000-0x0000000140334000-memory.dmp

Filesize
3.3MB

Download
memory/2264-100-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2264-3397-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2264-4019-0x000000013FBF0000-0x000000013FF44000-memory.dmp

Filesize
3.3MB

Download
memory/2288-4007-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/2288-78-0x000000013FCE0000-0x0000000140034000-memory.dmp

Filesize
3.3MB

Download
memory/2460-4013-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/2460-76-0x000000013F740000-0x000000013FA94000-memory.dmp

Filesize
3.3MB

Download
memory/2464-4017-0x000000013FFE0000-0x0000000140334000-memory.dmp

Filesize
3.3MB

Download
memory/2464-86-0x000000013FFE0000-0x0000000140334000-memory.dmp

Filesize
3.3MB

Download
memory/2540-64-0x000000013F1D0000-0x000000013F524000-memory.dmp

Filesize
3.3MB

Download
memory/2540-4009-0x000000013F1D0000-0x000000013F524000-memory.dmp

Filesize
3.3MB

Download
memory/2576-73-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4012-0x000000013F680000-0x000000013F9D4000-memory.dmp

Filesize
3.3MB

Download
memory/2596-4014-0x000000013F520000-0x000000013F874000-memory.dmp

Filesize
3.3MB

Download
memory/2596-83-0x000000013F520000-0x000000013F874000-memory.dmp

Filesize
3.3MB

Download
memory/2684-4015-0x000000013FFF0000-0x0000000140344000-memory.dmp

Filesize
3.3MB

Download
memory/2684-85-0x000000013FFF0000-0x0000000140344000-memory.dmp

Filesize
3.3MB

Download
memory/2832-96-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2832-4018-0x000000013FFB0000-0x0000000140304000-memory.dmp

Filesize
3.3MB

Download
memory/2864-4008-0x000000013F090000-0x000000013F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/2864-79-0x000000013F090000-0x000000013F3E4000-memory.dmp

Filesize
3.3MB

Download
memory/2868-70-0x000000013F6E0000-0x000000013FA34000-memory.dmp

Filesize
3.3MB

Download
memory/2868-4010-0x000000013F6E0000-0x000000013FA34000-memory.dmp

Filesize
3.3MB

Download
memory/3056-4016-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download
memory/3056-72-0x000000013FA80000-0x000000013FDD4000-memory.dmp

Filesize
3.3MB

Download