xmrig | 19207c29c7e2a37a4c3c6a3c225f84a3b20f561062b28daa2131776481c6cb2a

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
Size

1.4MB
MD5

c31a7d183e943598357b0f993e1e6640
SHA1

1e2f84561ce2a9fc0f1419cc9425f82a096f2d1a
SHA256

19207c29c7e2a37a4c3c6a3c225f84a3b20f561062b28daa2131776481c6cb2a
SHA512

bcfd539a635f7d19bb143446d3c0fb77cd776f67bcf2ec89ad628090b0006ebedb647bda2b41492d1283cde0bdac58c9ae3b6b05c68b127414e3cbfc9e6bfb1e
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727XL1+Kwen8Z2IXW4zO1dYXK4oFe:ROdWCCi7/rahHxlUJ

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral1/memory/2148-16-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2240-15-0x000000013F690000-0x000000013F9E1000-memory.dmp	xmrig
behavioral1/memory/1988-36-0x0000000001DD0000-0x0000000002121000-memory.dmp	xmrig
behavioral1/memory/2484-56-0x000000013FA40000-0x000000013FD91000-memory.dmp	xmrig
behavioral1/memory/1988-50-0x000000013FB80000-0x000000013FED1000-memory.dmp	xmrig
behavioral1/memory/2656-350-0x000000013FB30000-0x000000013FE81000-memory.dmp	xmrig
behavioral1/memory/1988-108-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2608-107-0x000000013F0B0000-0x000000013F401000-memory.dmp	xmrig
behavioral1/memory/1996-99-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/1988-84-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/2732-83-0x000000013FDB0000-0x0000000140101000-memory.dmp	xmrig
behavioral1/memory/2616-34-0x000000013F2D0000-0x000000013F621000-memory.dmp	xmrig
behavioral1/memory/2144-1139-0x000000013F2F0000-0x000000013F641000-memory.dmp	xmrig
behavioral1/memory/2044-1206-0x000000013F790000-0x000000013FAE1000-memory.dmp	xmrig
behavioral1/memory/2716-1416-0x000000013F7B0000-0x000000013FB01000-memory.dmp	xmrig
behavioral1/memory/2804-1656-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/2812-2330-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2868-2537-0x000000013F580000-0x000000013F8D1000-memory.dmp	xmrig
behavioral1/memory/1988-2874-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2240-3335-0x000000013F690000-0x000000013F9E1000-memory.dmp	xmrig
behavioral1/memory/2148-3338-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2616-3361-0x000000013F2D0000-0x000000013F621000-memory.dmp	xmrig
behavioral1/memory/2732-3360-0x000000013FDB0000-0x0000000140101000-memory.dmp	xmrig
behavioral1/memory/1996-3372-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2804-3390-0x000000013F2C0000-0x000000013F611000-memory.dmp	xmrig
behavioral1/memory/2656-3392-0x000000013FB30000-0x000000013FE81000-memory.dmp	xmrig
behavioral1/memory/2868-3416-0x000000013F580000-0x000000013F8D1000-memory.dmp	xmrig
behavioral1/memory/2044-3383-0x000000013F790000-0x000000013FAE1000-memory.dmp	xmrig
behavioral1/memory/2484-3369-0x000000013FA40000-0x000000013FD91000-memory.dmp	xmrig
behavioral1/memory/2608-3425-0x000000013F0B0000-0x000000013F401000-memory.dmp	xmrig
behavioral1/memory/2144-3467-0x000000013F2F0000-0x000000013F641000-memory.dmp	xmrig
behavioral1/memory/2812-3476-0x000000013FD40000-0x0000000140091000-memory.dmp	xmrig
behavioral1/memory/2716-3468-0x000000013F7B0000-0x000000013FB01000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2148	NlnNupk.exe
2240	dseRLDR.exe
2732	rZbRUQq.exe
2616	NUMJYBb.exe
1996	wXBLFtL.exe
2608	eEOhtXu.exe
2656	DZKryLi.exe
2484	sfXAnIe.exe
2144	OzlQHNR.exe
2044	vqVKqOD.exe
2716	bVkBkOe.exe
2804	OMWGdom.exe
2812	MNfFezP.exe
2868	YlopYrn.exe
1936	kzrELDL.exe
864	hTFuKpE.exe
1496	stNPlwd.exe
1684	ifEaTFA.exe
1564	KzSduhq.exe
1380	EUEyGvK.exe
3016	PRmzBNk.exe
2984	qwaRoHD.exe
868	JQzBBlr.exe
2904	mcqgvsf.exe
2060	AKTObEz.exe
264	CYobPCZ.exe
592	AAaBKZZ.exe
800	yenqumu.exe
2700	BnDjHWF.exe
824	UHzCUHV.exe
1088	YolbPzK.exe
2092	maMwpgM.exe
748	gNqXPWW.exe
1188	TRxNTYP.exe
2304	LnfTaaa.exe
900	eOqxWIH.exe
684	iNyKTof.exe
1604	jbyTawp.exe
960	ZlgdKwP.exe
944	VvGznsa.exe
2012	kRUXEFo.exe
1596	KqWmlbC.exe
928	zquZTMY.exe
2200	mDQlqSt.exe
3048	aJDxNYM.exe
2004	icIYIyS.exe
1816	wmbdxhY.exe
572	BrXFomS.exe
1436	UaDvJZT.exe
1256	coeSbXn.exe
3064	OzFBAdN.exe
1692	kfaFzrC.exe
1720	ZcYSzxy.exe
2008	WonmYus.exe
2580	JHOvUcL.exe
1636	OJQMaVE.exe
2436	DNYLKZs.exe
2688	WhGkgMM.exe
2696	OMCzfdE.exe
2680	fgmeIUF.exe
2776	RIZLSUE.exe
2764	wxHhrVD.exe
2560	egJRHSx.exe
1560	ZFIQvLE.exe

Loads dropped DLL 64 IoCs

pid	Process
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1988-0-0x000000013FB80000-0x000000013FED1000-memory.dmp	upx
behavioral1/files/0x000c0000000122eb-3.dat	upx
behavioral1/memory/2148-16-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/memory/2240-15-0x000000013F690000-0x000000013F9E1000-memory.dmp	upx
behavioral1/memory/1988-9-0x0000000001DD0000-0x0000000002121000-memory.dmp	upx
behavioral1/files/0x0036000000014335-6.dat	upx
behavioral1/files/0x0008000000014464-8.dat	upx
behavioral1/memory/2732-21-0x000000013FDB0000-0x0000000140101000-memory.dmp	upx
behavioral1/files/0x00080000000144c0-22.dat	upx
behavioral1/files/0x00070000000145be-35.dat	upx
behavioral1/memory/1996-39-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0036000000014349-26.dat	upx
behavioral1/memory/2608-41-0x000000013F0B0000-0x000000013F401000-memory.dmp	upx
behavioral1/memory/2484-56-0x000000013FA40000-0x000000013FD91000-memory.dmp	upx
behavioral1/files/0x000700000001471a-54.dat	upx
behavioral1/memory/1988-50-0x000000013FB80000-0x000000013FED1000-memory.dmp	upx
behavioral1/files/0x0006000000015b6e-68.dat	upx
behavioral1/memory/2044-70-0x000000013F790000-0x000000013FAE1000-memory.dmp	upx
behavioral1/memory/2144-62-0x000000013F2F0000-0x000000013F641000-memory.dmp	upx
behavioral1/memory/2716-78-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/memory/2804-85-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/files/0x0006000000015cdf-97.dat	upx
behavioral1/memory/2868-101-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/files/0x0006000000015d12-120.dat	upx
behavioral1/files/0x0006000000015d24-127.dat	upx
behavioral1/files/0x0006000000015dca-164.dat	upx
behavioral1/memory/2656-350-0x000000013FB30000-0x000000013FE81000-memory.dmp	upx
behavioral1/files/0x000600000001615c-192.dat	upx
behavioral1/files/0x000600000001611e-187.dat	upx
behavioral1/files/0x0006000000015f73-177.dat	upx
behavioral1/files/0x0006000000015fef-182.dat	upx
behavioral1/files/0x0006000000015d90-158.dat	upx
behavioral1/files/0x0006000000015e1d-170.dat	upx
behavioral1/files/0x0006000000015d7b-147.dat	upx
behavioral1/files/0x0006000000015d9f-161.dat	upx
behavioral1/files/0x0006000000015d53-137.dat	upx
behavioral1/files/0x0006000000015d83-152.dat	upx
behavioral1/files/0x0006000000015d73-142.dat	upx
behavioral1/files/0x0006000000015d3b-132.dat	upx
behavioral1/files/0x0006000000015d08-117.dat	upx
behavioral1/memory/2608-107-0x000000013F0B0000-0x000000013F401000-memory.dmp	upx
behavioral1/files/0x0006000000015cf0-111.dat	upx
behavioral1/files/0x0006000000015ce8-105.dat	upx
behavioral1/memory/2812-93-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/memory/1996-99-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0006000000015cc7-90.dat	upx
behavioral1/files/0x0006000000015bf4-75.dat	upx
behavioral1/memory/2732-83-0x000000013FDB0000-0x0000000140101000-memory.dmp	upx
behavioral1/files/0x0006000000015cb8-82.dat	upx
behavioral1/files/0x0008000000015693-59.dat	upx
behavioral1/memory/2656-48-0x000000013FB30000-0x000000013FE81000-memory.dmp	upx
behavioral1/files/0x0007000000014691-45.dat	upx
behavioral1/memory/2616-34-0x000000013F2D0000-0x000000013F621000-memory.dmp	upx
behavioral1/memory/2144-1139-0x000000013F2F0000-0x000000013F641000-memory.dmp	upx
behavioral1/memory/2044-1206-0x000000013F790000-0x000000013FAE1000-memory.dmp	upx
behavioral1/memory/2716-1416-0x000000013F7B0000-0x000000013FB01000-memory.dmp	upx
behavioral1/memory/2804-1656-0x000000013F2C0000-0x000000013F611000-memory.dmp	upx
behavioral1/memory/2812-2330-0x000000013FD40000-0x0000000140091000-memory.dmp	upx
behavioral1/memory/2868-2537-0x000000013F580000-0x000000013F8D1000-memory.dmp	upx
behavioral1/memory/2240-3335-0x000000013F690000-0x000000013F9E1000-memory.dmp	upx
behavioral1/memory/2148-3338-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/memory/2616-3361-0x000000013F2D0000-0x000000013F621000-memory.dmp	upx
behavioral1/memory/2732-3360-0x000000013FDB0000-0x0000000140101000-memory.dmp	upx
behavioral1/memory/1996-3372-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GHicnrJ.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\IMHVBMt.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\TviopVl.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\eypxrAU.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\HQNTbZU.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\sjxrXYk.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\kgmznYL.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\NPbsuNX.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\Pykmgiu.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\fpAAOcF.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\avHFsfS.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\mvLDiev.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\wlndBEY.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\JnoiLNX.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\KWEnMoK.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\UJBloxT.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\CjiypCX.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\pQxAcfW.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\rDHnsQy.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\gBxgudH.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\TUhbyma.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\nRQSxZf.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\RFiOaXv.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\YKdOTvB.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\THlVfkF.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\HpTbgAG.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\PDvMuyJ.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\GHWFhZF.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\XHXYsPK.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\sQzYCkb.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\jtFIILd.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\IuXNvSB.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\TTtimro.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\xAeMUKy.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\OykdqYG.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\vrEQwFI.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\tMTbAGi.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\KkWGnYA.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\maWOfcA.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\zvNrGAL.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\RbstBCK.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\QjEsCIl.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\wJpYXzv.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\YuwwHEB.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\VvltmVO.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\vorolrC.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\hacLSBe.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\KAkhxQV.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\WKahCIx.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\stNPlwd.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\IwNCEya.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\UTBIwZA.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\qTvQZOy.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\XlNrxQM.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\aSgOsMO.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\stljvjQ.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\kWOtYTF.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\jVybDri.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\CxaaChx.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\tDothXr.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\vYDyUek.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\RLqBntm.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\GqnCVeM.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
File created	C:\Windows\System\SuClOHU.exe	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2148	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	29
PID 1988 wrote to memory of 2148	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	29
PID 1988 wrote to memory of 2148	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	29
PID 1988 wrote to memory of 2240	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	30
PID 1988 wrote to memory of 2240	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	30
PID 1988 wrote to memory of 2240	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	30
PID 1988 wrote to memory of 2732	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	31
PID 1988 wrote to memory of 2732	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	31
PID 1988 wrote to memory of 2732	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	31
PID 1988 wrote to memory of 2616	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	32
PID 1988 wrote to memory of 2616	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	32
PID 1988 wrote to memory of 2616	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	32
PID 1988 wrote to memory of 2608	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	33
PID 1988 wrote to memory of 2608	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	33
PID 1988 wrote to memory of 2608	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	33
PID 1988 wrote to memory of 1996	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	34
PID 1988 wrote to memory of 1996	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	34
PID 1988 wrote to memory of 1996	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	34
PID 1988 wrote to memory of 2656	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	35
PID 1988 wrote to memory of 2656	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	35
PID 1988 wrote to memory of 2656	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	35
PID 1988 wrote to memory of 2484	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	36
PID 1988 wrote to memory of 2484	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	36
PID 1988 wrote to memory of 2484	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	36
PID 1988 wrote to memory of 2144	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	37
PID 1988 wrote to memory of 2144	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	37
PID 1988 wrote to memory of 2144	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	37
PID 1988 wrote to memory of 2044	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	38
PID 1988 wrote to memory of 2044	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	38
PID 1988 wrote to memory of 2044	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	38
PID 1988 wrote to memory of 2716	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	39
PID 1988 wrote to memory of 2716	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	39
PID 1988 wrote to memory of 2716	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	39
PID 1988 wrote to memory of 2804	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	40
PID 1988 wrote to memory of 2804	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	40
PID 1988 wrote to memory of 2804	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	40
PID 1988 wrote to memory of 2812	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	41
PID 1988 wrote to memory of 2812	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	41
PID 1988 wrote to memory of 2812	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	41
PID 1988 wrote to memory of 2868	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	42
PID 1988 wrote to memory of 2868	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	42
PID 1988 wrote to memory of 2868	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	42
PID 1988 wrote to memory of 1936	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	43
PID 1988 wrote to memory of 1936	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	43
PID 1988 wrote to memory of 1936	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	43
PID 1988 wrote to memory of 864	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	44
PID 1988 wrote to memory of 864	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	44
PID 1988 wrote to memory of 864	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	44
PID 1988 wrote to memory of 1496	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	45
PID 1988 wrote to memory of 1496	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	45
PID 1988 wrote to memory of 1496	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	45
PID 1988 wrote to memory of 1684	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	46
PID 1988 wrote to memory of 1684	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	46
PID 1988 wrote to memory of 1684	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	46
PID 1988 wrote to memory of 1564	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	47
PID 1988 wrote to memory of 1564	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	47
PID 1988 wrote to memory of 1564	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	47
PID 1988 wrote to memory of 1380	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	48
PID 1988 wrote to memory of 1380	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	48
PID 1988 wrote to memory of 1380	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	48
PID 1988 wrote to memory of 3016	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	49
PID 1988 wrote to memory of 3016	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	49
PID 1988 wrote to memory of 3016	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	49
PID 1988 wrote to memory of 2984	1988	c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c31a7d183e943598357b0f993e1e6640_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System\NlnNupk.exe
  C:\Windows\System\NlnNupk.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\dseRLDR.exe
  C:\Windows\System\dseRLDR.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\rZbRUQq.exe
  C:\Windows\System\rZbRUQq.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\NUMJYBb.exe
  C:\Windows\System\NUMJYBb.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\eEOhtXu.exe
  C:\Windows\System\eEOhtXu.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\wXBLFtL.exe
  C:\Windows\System\wXBLFtL.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\DZKryLi.exe
  C:\Windows\System\DZKryLi.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\sfXAnIe.exe
  C:\Windows\System\sfXAnIe.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\OzlQHNR.exe
  C:\Windows\System\OzlQHNR.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\vqVKqOD.exe
  C:\Windows\System\vqVKqOD.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bVkBkOe.exe
  C:\Windows\System\bVkBkOe.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\OMWGdom.exe
  C:\Windows\System\OMWGdom.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\MNfFezP.exe
  C:\Windows\System\MNfFezP.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\YlopYrn.exe
  C:\Windows\System\YlopYrn.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\kzrELDL.exe
  C:\Windows\System\kzrELDL.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\hTFuKpE.exe
  C:\Windows\System\hTFuKpE.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\stNPlwd.exe
  C:\Windows\System\stNPlwd.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\ifEaTFA.exe
  C:\Windows\System\ifEaTFA.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\KzSduhq.exe
  C:\Windows\System\KzSduhq.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\EUEyGvK.exe
  C:\Windows\System\EUEyGvK.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\PRmzBNk.exe
  C:\Windows\System\PRmzBNk.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\qwaRoHD.exe
  C:\Windows\System\qwaRoHD.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\JQzBBlr.exe
  C:\Windows\System\JQzBBlr.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mcqgvsf.exe
  C:\Windows\System\mcqgvsf.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\AKTObEz.exe
  C:\Windows\System\AKTObEz.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\CYobPCZ.exe
  C:\Windows\System\CYobPCZ.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\yenqumu.exe
  C:\Windows\System\yenqumu.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\AAaBKZZ.exe
  C:\Windows\System\AAaBKZZ.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\BnDjHWF.exe
  C:\Windows\System\BnDjHWF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\UHzCUHV.exe
  C:\Windows\System\UHzCUHV.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\YolbPzK.exe
  C:\Windows\System\YolbPzK.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\maMwpgM.exe
  C:\Windows\System\maMwpgM.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\gNqXPWW.exe
  C:\Windows\System\gNqXPWW.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\TRxNTYP.exe
  C:\Windows\System\TRxNTYP.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\LnfTaaa.exe
  C:\Windows\System\LnfTaaa.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\eOqxWIH.exe
  C:\Windows\System\eOqxWIH.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\iNyKTof.exe
  C:\Windows\System\iNyKTof.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\jbyTawp.exe
  C:\Windows\System\jbyTawp.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ZlgdKwP.exe
  C:\Windows\System\ZlgdKwP.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\VvGznsa.exe
  C:\Windows\System\VvGznsa.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\kRUXEFo.exe
  C:\Windows\System\kRUXEFo.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\KqWmlbC.exe
  C:\Windows\System\KqWmlbC.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\zquZTMY.exe
  C:\Windows\System\zquZTMY.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\mDQlqSt.exe
  C:\Windows\System\mDQlqSt.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\aJDxNYM.exe
  C:\Windows\System\aJDxNYM.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\icIYIyS.exe
  C:\Windows\System\icIYIyS.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wmbdxhY.exe
  C:\Windows\System\wmbdxhY.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BrXFomS.exe
  C:\Windows\System\BrXFomS.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\UaDvJZT.exe
  C:\Windows\System\UaDvJZT.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\coeSbXn.exe
  C:\Windows\System\coeSbXn.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\OzFBAdN.exe
  C:\Windows\System\OzFBAdN.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\kfaFzrC.exe
  C:\Windows\System\kfaFzrC.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ZcYSzxy.exe
  C:\Windows\System\ZcYSzxy.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\WonmYus.exe
  C:\Windows\System\WonmYus.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\JHOvUcL.exe
  C:\Windows\System\JHOvUcL.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\OJQMaVE.exe
  C:\Windows\System\OJQMaVE.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\DNYLKZs.exe
  C:\Windows\System\DNYLKZs.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\WhGkgMM.exe
  C:\Windows\System\WhGkgMM.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\OMCzfdE.exe
  C:\Windows\System\OMCzfdE.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\fgmeIUF.exe
  C:\Windows\System\fgmeIUF.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\RIZLSUE.exe
  C:\Windows\System\RIZLSUE.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\wxHhrVD.exe
  C:\Windows\System\wxHhrVD.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\egJRHSx.exe
  C:\Windows\System\egJRHSx.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ZFIQvLE.exe
  C:\Windows\System\ZFIQvLE.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\WfpdnYL.exe
  C:\Windows\System\WfpdnYL.exe
  2⤵
  PID:3036
- C:\Windows\System\ovvjnIJ.exe
  C:\Windows\System\ovvjnIJ.exe
  2⤵
  PID:2588
- C:\Windows\System\iDhrAGf.exe
  C:\Windows\System\iDhrAGf.exe
  2⤵
  PID:1924
- C:\Windows\System\PajZBki.exe
  C:\Windows\System\PajZBki.exe
  2⤵
  PID:2760
- C:\Windows\System\DmifOvs.exe
  C:\Windows\System\DmifOvs.exe
  2⤵
  PID:2752
- C:\Windows\System\ZsLPZgG.exe
  C:\Windows\System\ZsLPZgG.exe
  2⤵
  PID:2292
- C:\Windows\System\yFWaCZm.exe
  C:\Windows\System\yFWaCZm.exe
  2⤵
  PID:280
- C:\Windows\System\yLJOpdo.exe
  C:\Windows\System\yLJOpdo.exe
  2⤵
  PID:1468
- C:\Windows\System\btfIJBg.exe
  C:\Windows\System\btfIJBg.exe
  2⤵
  PID:1912
- C:\Windows\System\whyxhcm.exe
  C:\Windows\System\whyxhcm.exe
  2⤵
  PID:3008
- C:\Windows\System\TNRtGvN.exe
  C:\Windows\System\TNRtGvN.exe
  2⤵
  PID:2432
- C:\Windows\System\AHkgrhA.exe
  C:\Windows\System\AHkgrhA.exe
  2⤵
  PID:2312
- C:\Windows\System\tDpSQTW.exe
  C:\Windows\System\tDpSQTW.exe
  2⤵
  PID:356
- C:\Windows\System\cBRIvtU.exe
  C:\Windows\System\cBRIvtU.exe
  2⤵
  PID:2972
- C:\Windows\System\CVtgDKB.exe
  C:\Windows\System\CVtgDKB.exe
  2⤵
  PID:2100
- C:\Windows\System\RzldLyi.exe
  C:\Windows\System\RzldLyi.exe
  2⤵
  PID:2300
- C:\Windows\System\SuMVZeI.exe
  C:\Windows\System\SuMVZeI.exe
  2⤵
  PID:1956
- C:\Windows\System\VNVlpCm.exe
  C:\Windows\System\VNVlpCm.exe
  2⤵
  PID:792
- C:\Windows\System\SGRHBNT.exe
  C:\Windows\System\SGRHBNT.exe
  2⤵
  PID:1736
- C:\Windows\System\NWajATX.exe
  C:\Windows\System\NWajATX.exe
  2⤵
  PID:400
- C:\Windows\System\LxsbOXv.exe
  C:\Windows\System\LxsbOXv.exe
  2⤵
  PID:624
- C:\Windows\System\HQhmzhG.exe
  C:\Windows\System\HQhmzhG.exe
  2⤵
  PID:924
- C:\Windows\System\iYFCuGb.exe
  C:\Windows\System\iYFCuGb.exe
  2⤵
  PID:2088
- C:\Windows\System\zbYsiUO.exe
  C:\Windows\System\zbYsiUO.exe
  2⤵
  PID:2424
- C:\Windows\System\nUzMuDr.exe
  C:\Windows\System\nUzMuDr.exe
  2⤵
  PID:828
- C:\Windows\System\TUSakoq.exe
  C:\Windows\System\TUSakoq.exe
  2⤵
  PID:2876
- C:\Windows\System\xyQiDvg.exe
  C:\Windows\System\xyQiDvg.exe
  2⤵
  PID:908
- C:\Windows\System\cGKSIpo.exe
  C:\Windows\System\cGKSIpo.exe
  2⤵
  PID:2080
- C:\Windows\System\pQguHem.exe
  C:\Windows\System\pQguHem.exe
  2⤵
  PID:1672
- C:\Windows\System\CDSEslD.exe
  C:\Windows\System\CDSEslD.exe
  2⤵
  PID:1172
- C:\Windows\System\iJcRlij.exe
  C:\Windows\System\iJcRlij.exe
  2⤵
  PID:2620
- C:\Windows\System\YIuITvf.exe
  C:\Windows\System\YIuITvf.exe
  2⤵
  PID:1220
- C:\Windows\System\wmAkkou.exe
  C:\Windows\System\wmAkkou.exe
  2⤵
  PID:2384
- C:\Windows\System\PgPFEmk.exe
  C:\Windows\System\PgPFEmk.exe
  2⤵
  PID:2640
- C:\Windows\System\qVlvvBF.exe
  C:\Windows\System\qVlvvBF.exe
  2⤵
  PID:3068
- C:\Windows\System\MyEjzib.exe
  C:\Windows\System\MyEjzib.exe
  2⤵
  PID:2792
- C:\Windows\System\iQEhnbd.exe
  C:\Windows\System\iQEhnbd.exe
  2⤵
  PID:2524
- C:\Windows\System\fcHQFKV.exe
  C:\Windows\System\fcHQFKV.exe
  2⤵
  PID:2448
- C:\Windows\System\eyWXwPV.exe
  C:\Windows\System\eyWXwPV.exe
  2⤵
  PID:2476
- C:\Windows\System\TbdvCGp.exe
  C:\Windows\System\TbdvCGp.exe
  2⤵
  PID:3056
- C:\Windows\System\TIoSRve.exe
  C:\Windows\System\TIoSRve.exe
  2⤵
  PID:3000
- C:\Windows\System\NHVtirQ.exe
  C:\Windows\System\NHVtirQ.exe
  2⤵
  PID:2020
- C:\Windows\System\gUFegPO.exe
  C:\Windows\System\gUFegPO.exe
  2⤵
  PID:956
- C:\Windows\System\VrIihcW.exe
  C:\Windows\System\VrIihcW.exe
  2⤵
  PID:1100
- C:\Windows\System\XLRsgtR.exe
  C:\Windows\System\XLRsgtR.exe
  2⤵
  PID:1976
- C:\Windows\System\fmXuymy.exe
  C:\Windows\System\fmXuymy.exe
  2⤵
  PID:1832
- C:\Windows\System\RzVWMIu.exe
  C:\Windows\System\RzVWMIu.exe
  2⤵
  PID:2604
- C:\Windows\System\IFVggBg.exe
  C:\Windows\System\IFVggBg.exe
  2⤵
  PID:620
- C:\Windows\System\ZhmOxuu.exe
  C:\Windows\System\ZhmOxuu.exe
  2⤵
  PID:700
- C:\Windows\System\WaDwGID.exe
  C:\Windows\System\WaDwGID.exe
  2⤵
  PID:1284
- C:\Windows\System\SGRJpVI.exe
  C:\Windows\System\SGRJpVI.exe
  2⤵
  PID:2416
- C:\Windows\System\IsbXdHI.exe
  C:\Windows\System\IsbXdHI.exe
  2⤵
  PID:1880
- C:\Windows\System\vlgOvOp.exe
  C:\Windows\System\vlgOvOp.exe
  2⤵
  PID:904
- C:\Windows\System\rzlhyMP.exe
  C:\Windows\System\rzlhyMP.exe
  2⤵
  PID:2636
- C:\Windows\System\HHNrKHG.exe
  C:\Windows\System\HHNrKHG.exe
  2⤵
  PID:2644
- C:\Windows\System\rweSuyh.exe
  C:\Windows\System\rweSuyh.exe
  2⤵
  PID:380
- C:\Windows\System\jTFwymu.exe
  C:\Windows\System\jTFwymu.exe
  2⤵
  PID:2892
- C:\Windows\System\pPyjUxN.exe
  C:\Windows\System\pPyjUxN.exe
  2⤵
  PID:2712
- C:\Windows\System\XGRzHgN.exe
  C:\Windows\System\XGRzHgN.exe
  2⤵
  PID:1792
- C:\Windows\System\UDgKfya.exe
  C:\Windows\System\UDgKfya.exe
  2⤵
  PID:600
- C:\Windows\System\BhzFSVi.exe
  C:\Windows\System\BhzFSVi.exe
  2⤵
  PID:2780
- C:\Windows\System\eqXKRhY.exe
  C:\Windows\System\eqXKRhY.exe
  2⤵
  PID:1416
- C:\Windows\System\XfvdSIq.exe
  C:\Windows\System\XfvdSIq.exe
  2⤵
  PID:2284
- C:\Windows\System\RJVJcoO.exe
  C:\Windows\System\RJVJcoO.exe
  2⤵
  PID:1716
- C:\Windows\System\iemYkPw.exe
  C:\Windows\System\iemYkPw.exe
  2⤵
  PID:884
- C:\Windows\System\UiygKjh.exe
  C:\Windows\System\UiygKjh.exe
  2⤵
  PID:2336
- C:\Windows\System\pVUJaLn.exe
  C:\Windows\System\pVUJaLn.exe
  2⤵
  PID:2992
- C:\Windows\System\cphVOOT.exe
  C:\Windows\System\cphVOOT.exe
  2⤵
  PID:2164
- C:\Windows\System\JzvXdMN.exe
  C:\Windows\System\JzvXdMN.exe
  2⤵
  PID:1620
- C:\Windows\System\IQAWwSe.exe
  C:\Windows\System\IQAWwSe.exe
  2⤵
  PID:2692
- C:\Windows\System\QTtznuv.exe
  C:\Windows\System\QTtznuv.exe
  2⤵
  PID:2708
- C:\Windows\System\gnBElHp.exe
  C:\Windows\System\gnBElHp.exe
  2⤵
  PID:2576
- C:\Windows\System\DlpeoDM.exe
  C:\Windows\System\DlpeoDM.exe
  2⤵
  PID:2652
- C:\Windows\System\FMgsiHg.exe
  C:\Windows\System\FMgsiHg.exe
  2⤵
  PID:2748
- C:\Windows\System\KwHjytz.exe
  C:\Windows\System\KwHjytz.exe
  2⤵
  PID:1624
- C:\Windows\System\IzWEhco.exe
  C:\Windows\System\IzWEhco.exe
  2⤵
  PID:1448
- C:\Windows\System\ftUwAdg.exe
  C:\Windows\System\ftUwAdg.exe
  2⤵
  PID:1552
- C:\Windows\System\mgxhnyf.exe
  C:\Windows\System\mgxhnyf.exe
  2⤵
  PID:576
- C:\Windows\System\xVGreqr.exe
  C:\Windows\System\xVGreqr.exe
  2⤵
  PID:2512
- C:\Windows\System\mGJdXMv.exe
  C:\Windows\System\mGJdXMv.exe
  2⤵
  PID:1572
- C:\Windows\System\CEmhFvI.exe
  C:\Windows\System\CEmhFvI.exe
  2⤵
  PID:1412
- C:\Windows\System\nnjNVUv.exe
  C:\Windows\System\nnjNVUv.exe
  2⤵
  PID:1020
- C:\Windows\System\KBpJrqj.exe
  C:\Windows\System\KBpJrqj.exe
  2⤵
  PID:1244
- C:\Windows\System\QKuiuiF.exe
  C:\Windows\System\QKuiuiF.exe
  2⤵
  PID:2516
- C:\Windows\System\uowTqzk.exe
  C:\Windows\System\uowTqzk.exe
  2⤵
  PID:2112
- C:\Windows\System\jSLmKmV.exe
  C:\Windows\System\jSLmKmV.exe
  2⤵
  PID:1472
- C:\Windows\System\NRaOyHE.exe
  C:\Windows\System\NRaOyHE.exe
  2⤵
  PID:2584
- C:\Windows\System\IuXNvSB.exe
  C:\Windows\System\IuXNvSB.exe
  2⤵
  PID:1740
- C:\Windows\System\AbOkQuv.exe
  C:\Windows\System\AbOkQuv.exe
  2⤵
  PID:2460
- C:\Windows\System\sDMIoTz.exe
  C:\Windows\System\sDMIoTz.exe
  2⤵
  PID:1592
- C:\Windows\System\lpOrNBt.exe
  C:\Windows\System\lpOrNBt.exe
  2⤵
  PID:3012
- C:\Windows\System\RuKhCNM.exe
  C:\Windows\System\RuKhCNM.exe
  2⤵
  PID:2548
- C:\Windows\System\uVKqwMR.exe
  C:\Windows\System\uVKqwMR.exe
  2⤵
  PID:2488
- C:\Windows\System\iNPgUyu.exe
  C:\Windows\System\iNPgUyu.exe
  2⤵
  PID:808
- C:\Windows\System\mbmhosc.exe
  C:\Windows\System\mbmhosc.exe
  2⤵
  PID:2800
- C:\Windows\System\bihJErZ.exe
  C:\Windows\System\bihJErZ.exe
  2⤵
  PID:1860
- C:\Windows\System\LIhQqzL.exe
  C:\Windows\System\LIhQqzL.exe
  2⤵
  PID:332
- C:\Windows\System\uPSpfOF.exe
  C:\Windows\System\uPSpfOF.exe
  2⤵
  PID:2628
- C:\Windows\System\ZDMweWr.exe
  C:\Windows\System\ZDMweWr.exe
  2⤵
  PID:2136
- C:\Windows\System\kwyssIZ.exe
  C:\Windows\System\kwyssIZ.exe
  2⤵
  PID:776
- C:\Windows\System\dHscRTZ.exe
  C:\Windows\System\dHscRTZ.exe
  2⤵
  PID:496
- C:\Windows\System\RaIApgC.exe
  C:\Windows\System\RaIApgC.exe
  2⤵
  PID:1304
- C:\Windows\System\BRmniWB.exe
  C:\Windows\System\BRmniWB.exe
  2⤵
  PID:1680
- C:\Windows\System\dDZInhg.exe
  C:\Windows\System\dDZInhg.exe
  2⤵
  PID:2376
- C:\Windows\System\wgzzZrs.exe
  C:\Windows\System\wgzzZrs.exe
  2⤵
  PID:1628
- C:\Windows\System\IAyNmpi.exe
  C:\Windows\System\IAyNmpi.exe
  2⤵
  PID:1704
- C:\Windows\System\aexYkMQ.exe
  C:\Windows\System\aexYkMQ.exe
  2⤵
  PID:1892
- C:\Windows\System\eMrapKc.exe
  C:\Windows\System\eMrapKc.exe
  2⤵
  PID:1752
- C:\Windows\System\BphAVgc.exe
  C:\Windows\System\BphAVgc.exe
  2⤵
  PID:112
- C:\Windows\System\Wpcikhn.exe
  C:\Windows\System\Wpcikhn.exe
  2⤵
  PID:1868
- C:\Windows\System\vSRSAXZ.exe
  C:\Windows\System\vSRSAXZ.exe
  2⤵
  PID:968
- C:\Windows\System\DvYBfWJ.exe
  C:\Windows\System\DvYBfWJ.exe
  2⤵
  PID:2808
- C:\Windows\System\kKMnqMC.exe
  C:\Windows\System\kKMnqMC.exe
  2⤵
  PID:484
- C:\Windows\System\hAaSKHB.exe
  C:\Windows\System\hAaSKHB.exe
  2⤵
  PID:2828
- C:\Windows\System\uUVBgYl.exe
  C:\Windows\System\uUVBgYl.exe
  2⤵
  PID:2648
- C:\Windows\System\azvATyS.exe
  C:\Windows\System\azvATyS.exe
  2⤵
  PID:2468
- C:\Windows\System\tuqLGgq.exe
  C:\Windows\System\tuqLGgq.exe
  2⤵
  PID:3040
- C:\Windows\System\FsuvRZb.exe
  C:\Windows\System\FsuvRZb.exe
  2⤵
  PID:1688
- C:\Windows\System\ktXHtWm.exe
  C:\Windows\System\ktXHtWm.exe
  2⤵
  PID:2600
- C:\Windows\System\EKqJJAy.exe
  C:\Windows\System\EKqJJAy.exe
  2⤵
  PID:2756
- C:\Windows\System\BjyofmF.exe
  C:\Windows\System\BjyofmF.exe
  2⤵
  PID:2052
- C:\Windows\System\YIzSSzB.exe
  C:\Windows\System\YIzSSzB.exe
  2⤵
  PID:1232
- C:\Windows\System\dnWgdqK.exe
  C:\Windows\System\dnWgdqK.exe
  2⤵
  PID:2820
- C:\Windows\System\HclZPIY.exe
  C:\Windows\System\HclZPIY.exe
  2⤵
  PID:1728
- C:\Windows\System\yRiKpPs.exe
  C:\Windows\System\yRiKpPs.exe
  2⤵
  PID:2532
- C:\Windows\System\TknBboF.exe
  C:\Windows\System\TknBboF.exe
  2⤵
  PID:1072
- C:\Windows\System\iYduwGZ.exe
  C:\Windows\System\iYduwGZ.exe
  2⤵
  PID:3080
- C:\Windows\System\KkWGnYA.exe
  C:\Windows\System\KkWGnYA.exe
  2⤵
  PID:3096
- C:\Windows\System\XIvJJNG.exe
  C:\Windows\System\XIvJJNG.exe
  2⤵
  PID:3116
- C:\Windows\System\rltnevX.exe
  C:\Windows\System\rltnevX.exe
  2⤵
  PID:3132
- C:\Windows\System\ATgUncb.exe
  C:\Windows\System\ATgUncb.exe
  2⤵
  PID:3148
- C:\Windows\System\DiqfjEB.exe
  C:\Windows\System\DiqfjEB.exe
  2⤵
  PID:3164
- C:\Windows\System\jYCeavB.exe
  C:\Windows\System\jYCeavB.exe
  2⤵
  PID:3180
- C:\Windows\System\qlEDMgY.exe
  C:\Windows\System\qlEDMgY.exe
  2⤵
  PID:3200
- C:\Windows\System\UrDHrzN.exe
  C:\Windows\System\UrDHrzN.exe
  2⤵
  PID:3216
- C:\Windows\System\GHicnrJ.exe
  C:\Windows\System\GHicnrJ.exe
  2⤵
  PID:3236
- C:\Windows\System\tKVqOax.exe
  C:\Windows\System\tKVqOax.exe
  2⤵
  PID:3252
- C:\Windows\System\ZrTFxoB.exe
  C:\Windows\System\ZrTFxoB.exe
  2⤵
  PID:3268
- C:\Windows\System\CwltQcp.exe
  C:\Windows\System\CwltQcp.exe
  2⤵
  PID:3284
- C:\Windows\System\LubjvwV.exe
  C:\Windows\System\LubjvwV.exe
  2⤵
  PID:3300
- C:\Windows\System\omYWHBp.exe
  C:\Windows\System\omYWHBp.exe
  2⤵
  PID:3320
- C:\Windows\System\rAAVrUX.exe
  C:\Windows\System\rAAVrUX.exe
  2⤵
  PID:3336
- C:\Windows\System\LimZupy.exe
  C:\Windows\System\LimZupy.exe
  2⤵
  PID:3404
- C:\Windows\System\SuLypsI.exe
  C:\Windows\System\SuLypsI.exe
  2⤵
  PID:3424
- C:\Windows\System\sEHYSYB.exe
  C:\Windows\System\sEHYSYB.exe
  2⤵
  PID:3456
- C:\Windows\System\KMquHkP.exe
  C:\Windows\System\KMquHkP.exe
  2⤵
  PID:3472
- C:\Windows\System\mfmADhi.exe
  C:\Windows\System\mfmADhi.exe
  2⤵
  PID:3488
- C:\Windows\System\aPiEUlU.exe
  C:\Windows\System\aPiEUlU.exe
  2⤵
  PID:3504
- C:\Windows\System\WCYMckF.exe
  C:\Windows\System\WCYMckF.exe
  2⤵
  PID:3520
- C:\Windows\System\hqTRpLK.exe
  C:\Windows\System\hqTRpLK.exe
  2⤵
  PID:3540
- C:\Windows\System\OMSdXgn.exe
  C:\Windows\System\OMSdXgn.exe
  2⤵
  PID:3556
- C:\Windows\System\xwrTjVH.exe
  C:\Windows\System\xwrTjVH.exe
  2⤵
  PID:3572
- C:\Windows\System\cIREDkg.exe
  C:\Windows\System\cIREDkg.exe
  2⤵
  PID:3588
- C:\Windows\System\tBrkBVv.exe
  C:\Windows\System\tBrkBVv.exe
  2⤵
  PID:3604
- C:\Windows\System\ccRgeRd.exe
  C:\Windows\System\ccRgeRd.exe
  2⤵
  PID:3624
- C:\Windows\System\BEcLoZF.exe
  C:\Windows\System\BEcLoZF.exe
  2⤵
  PID:3668
- C:\Windows\System\KhWSMvB.exe
  C:\Windows\System\KhWSMvB.exe
  2⤵
  PID:3684
- C:\Windows\System\sskqEjq.exe
  C:\Windows\System\sskqEjq.exe
  2⤵
  PID:3704
- C:\Windows\System\BjvEXmj.exe
  C:\Windows\System\BjvEXmj.exe
  2⤵
  PID:3720
- C:\Windows\System\eTJrSCW.exe
  C:\Windows\System\eTJrSCW.exe
  2⤵
  PID:3736
- C:\Windows\System\kkpuvhW.exe
  C:\Windows\System\kkpuvhW.exe
  2⤵
  PID:3756
- C:\Windows\System\KNfuRvF.exe
  C:\Windows\System\KNfuRvF.exe
  2⤵
  PID:3792
- C:\Windows\System\wIpFjVf.exe
  C:\Windows\System\wIpFjVf.exe
  2⤵
  PID:3840
- C:\Windows\System\OkDjxWj.exe
  C:\Windows\System\OkDjxWj.exe
  2⤵
  PID:3860
- C:\Windows\System\VedYSod.exe
  C:\Windows\System\VedYSod.exe
  2⤵
  PID:3880
- C:\Windows\System\GqnCVeM.exe
  C:\Windows\System\GqnCVeM.exe
  2⤵
  PID:3896
- C:\Windows\System\tBGfBpe.exe
  C:\Windows\System\tBGfBpe.exe
  2⤵
  PID:3916
- C:\Windows\System\POHKmVx.exe
  C:\Windows\System\POHKmVx.exe
  2⤵
  PID:3932
- C:\Windows\System\aSZPCLg.exe
  C:\Windows\System\aSZPCLg.exe
  2⤵
  PID:3948
- C:\Windows\System\iRwWMdy.exe
  C:\Windows\System\iRwWMdy.exe
  2⤵
  PID:3964
- C:\Windows\System\EbfqNCJ.exe
  C:\Windows\System\EbfqNCJ.exe
  2⤵
  PID:3984
- C:\Windows\System\uPFUVbT.exe
  C:\Windows\System\uPFUVbT.exe
  2⤵
  PID:4000
- C:\Windows\System\CGlkIVr.exe
  C:\Windows\System\CGlkIVr.exe
  2⤵
  PID:4016
- C:\Windows\System\kelJedJ.exe
  C:\Windows\System\kelJedJ.exe
  2⤵
  PID:4056
- C:\Windows\System\smldEWV.exe
  C:\Windows\System\smldEWV.exe
  2⤵
  PID:4072
- C:\Windows\System\BkxpgJA.exe
  C:\Windows\System\BkxpgJA.exe
  2⤵
  PID:4088
- C:\Windows\System\qxAvGhg.exe
  C:\Windows\System\qxAvGhg.exe
  2⤵
  PID:3108
- C:\Windows\System\PBNVBgr.exe
  C:\Windows\System\PBNVBgr.exe
  2⤵
  PID:3088
- C:\Windows\System\qurmMcu.exe
  C:\Windows\System\qurmMcu.exe
  2⤵
  PID:3176
- C:\Windows\System\jvrjBAe.exe
  C:\Windows\System\jvrjBAe.exe
  2⤵
  PID:3244
- C:\Windows\System\TKtgDsW.exe
  C:\Windows\System\TKtgDsW.exe
  2⤵
  PID:3312
- C:\Windows\System\KKSPQuF.exe
  C:\Windows\System\KKSPQuF.exe
  2⤵
  PID:3364
- C:\Windows\System\mRRBUJj.exe
  C:\Windows\System\mRRBUJj.exe
  2⤵
  PID:3380
- C:\Windows\System\BhWhFYR.exe
  C:\Windows\System\BhWhFYR.exe
  2⤵
  PID:3124
- C:\Windows\System\JQyXsDh.exe
  C:\Windows\System\JQyXsDh.exe
  2⤵
  PID:3160
- C:\Windows\System\HIFaHrw.exe
  C:\Windows\System\HIFaHrw.exe
  2⤵
  PID:3156
- C:\Windows\System\LQzWBZN.exe
  C:\Windows\System\LQzWBZN.exe
  2⤵
  PID:3436
- C:\Windows\System\MWNmTVY.exe
  C:\Windows\System\MWNmTVY.exe
  2⤵
  PID:3188
- C:\Windows\System\TJutyzI.exe
  C:\Windows\System\TJutyzI.exe
  2⤵
  PID:3260
- C:\Windows\System\qRBjJjY.exe
  C:\Windows\System\qRBjJjY.exe
  2⤵
  PID:3412
- C:\Windows\System\TPiXrUo.exe
  C:\Windows\System\TPiXrUo.exe
  2⤵
  PID:3516
- C:\Windows\System\bzNgVtI.exe
  C:\Windows\System\bzNgVtI.exe
  2⤵
  PID:3420
- C:\Windows\System\vPWkjXo.exe
  C:\Windows\System\vPWkjXo.exe
  2⤵
  PID:3612
- C:\Windows\System\DXueQVg.exe
  C:\Windows\System\DXueQVg.exe
  2⤵
  PID:3528
- C:\Windows\System\TslPJUx.exe
  C:\Windows\System\TslPJUx.exe
  2⤵
  PID:3600
- C:\Windows\System\MIXMpik.exe
  C:\Windows\System\MIXMpik.exe
  2⤵
  PID:3468
- C:\Windows\System\pcZrhjM.exe
  C:\Windows\System\pcZrhjM.exe
  2⤵
  PID:3648
- C:\Windows\System\pkvPcaW.exe
  C:\Windows\System\pkvPcaW.exe
  2⤵
  PID:3680
- C:\Windows\System\dssegXo.exe
  C:\Windows\System\dssegXo.exe
  2⤵
  PID:3748
- C:\Windows\System\oOcDzcc.exe
  C:\Windows\System\oOcDzcc.exe
  2⤵
  PID:3692
- C:\Windows\System\ttxFVgz.exe
  C:\Windows\System\ttxFVgz.exe
  2⤵
  PID:3732
- C:\Windows\System\TmPZaSJ.exe
  C:\Windows\System\TmPZaSJ.exe
  2⤵
  PID:3804
- C:\Windows\System\CfFwNOd.exe
  C:\Windows\System\CfFwNOd.exe
  2⤵
  PID:3824
- C:\Windows\System\DGXFRzX.exe
  C:\Windows\System\DGXFRzX.exe
  2⤵
  PID:3104
- C:\Windows\System\OwJAHja.exe
  C:\Windows\System\OwJAHja.exe
  2⤵
  PID:4052
- C:\Windows\System\GeLLwsA.exe
  C:\Windows\System\GeLLwsA.exe
  2⤵
  PID:3960
- C:\Windows\System\zBilOff.exe
  C:\Windows\System\zBilOff.exe
  2⤵
  PID:3568
- C:\Windows\System\fdeDBJX.exe
  C:\Windows\System\fdeDBJX.exe
  2⤵
  PID:3208
- C:\Windows\System\pRUpuZT.exe
  C:\Windows\System\pRUpuZT.exe
  2⤵
  PID:3280
- C:\Windows\System\hyGzDdS.exe
  C:\Windows\System\hyGzDdS.exe
  2⤵
  PID:3644
- C:\Windows\System\GNMEZqY.exe
  C:\Windows\System\GNMEZqY.exe
  2⤵
  PID:3196
- C:\Windows\System\ZKtMfzo.exe
  C:\Windows\System\ZKtMfzo.exe
  2⤵
  PID:3584
- C:\Windows\System\WliSoTd.exe
  C:\Windows\System\WliSoTd.exe
  2⤵
  PID:3700
- C:\Windows\System\ZHPfQII.exe
  C:\Windows\System\ZHPfQII.exe
  2⤵
  PID:3532
- C:\Windows\System\ykFqswS.exe
  C:\Windows\System\ykFqswS.exe
  2⤵
  PID:3876
- C:\Windows\System\KfQpouk.exe
  C:\Windows\System\KfQpouk.exe
  2⤵
  PID:3912
- C:\Windows\System\taeSOKf.exe
  C:\Windows\System\taeSOKf.exe
  2⤵
  PID:2176
- C:\Windows\System\WooERXu.exe
  C:\Windows\System\WooERXu.exe
  2⤵
  PID:3328
- C:\Windows\System\UvlSVbc.exe
  C:\Windows\System\UvlSVbc.exe
  2⤵
  PID:3564
- C:\Windows\System\vHSjSwD.exe
  C:\Windows\System\vHSjSwD.exe
  2⤵
  PID:3656
- C:\Windows\System\HxSbOYb.exe
  C:\Windows\System\HxSbOYb.exe
  2⤵
  PID:3660
- C:\Windows\System\gllnUoL.exe
  C:\Windows\System\gllnUoL.exe
  2⤵
  PID:3872
- C:\Windows\System\lIkKOgv.exe
  C:\Windows\System\lIkKOgv.exe
  2⤵
  PID:3924
- C:\Windows\System\lYihTtu.exe
  C:\Windows\System\lYihTtu.exe
  2⤵
  PID:3940
- C:\Windows\System\iCUTdnh.exe
  C:\Windows\System\iCUTdnh.exe
  2⤵
  PID:4012
- C:\Windows\System\ubYvEWE.exe
  C:\Windows\System\ubYvEWE.exe
  2⤵
  PID:636
- C:\Windows\System\PFaerNT.exe
  C:\Windows\System\PFaerNT.exe
  2⤵
  PID:4036
- C:\Windows\System\CtKdWnL.exe
  C:\Windows\System\CtKdWnL.exe
  2⤵
  PID:3396
- C:\Windows\System\uwHhsAM.exe
  C:\Windows\System\uwHhsAM.exe
  2⤵
  PID:3640
- C:\Windows\System\BHaIdYX.exe
  C:\Windows\System\BHaIdYX.exe
  2⤵
  PID:4104
- C:\Windows\System\IXdFsrr.exe
  C:\Windows\System\IXdFsrr.exe
  2⤵
  PID:4124
- C:\Windows\System\leZQrom.exe
  C:\Windows\System\leZQrom.exe
  2⤵
  PID:4140
- C:\Windows\System\jKGGLLt.exe
  C:\Windows\System\jKGGLLt.exe
  2⤵
  PID:4156
- C:\Windows\System\SZuzEae.exe
  C:\Windows\System\SZuzEae.exe
  2⤵
  PID:4256
- C:\Windows\System\SrllELl.exe
  C:\Windows\System\SrllELl.exe
  2⤵
  PID:4272
- C:\Windows\System\AMnZmAc.exe
  C:\Windows\System\AMnZmAc.exe
  2⤵
  PID:4288
- C:\Windows\System\EPzZOvZ.exe
  C:\Windows\System\EPzZOvZ.exe
  2⤵
  PID:4304
- C:\Windows\System\IIFLUHN.exe
  C:\Windows\System\IIFLUHN.exe
  2⤵
  PID:4320
- C:\Windows\System\zwkjcVO.exe
  C:\Windows\System\zwkjcVO.exe
  2⤵
  PID:4340
- C:\Windows\System\cUmvXNX.exe
  C:\Windows\System\cUmvXNX.exe
  2⤵
  PID:4356
- C:\Windows\System\BtounNf.exe
  C:\Windows\System\BtounNf.exe
  2⤵
  PID:4372
- C:\Windows\System\GOWIieg.exe
  C:\Windows\System\GOWIieg.exe
  2⤵
  PID:4388
- C:\Windows\System\SgOwfNJ.exe
  C:\Windows\System\SgOwfNJ.exe
  2⤵
  PID:4404
- C:\Windows\System\dQmAciP.exe
  C:\Windows\System\dQmAciP.exe
  2⤵
  PID:4424
- C:\Windows\System\FymSSuS.exe
  C:\Windows\System\FymSSuS.exe
  2⤵
  PID:4440
- C:\Windows\System\yWiKfmj.exe
  C:\Windows\System\yWiKfmj.exe
  2⤵
  PID:4456
- C:\Windows\System\yaKpqbt.exe
  C:\Windows\System\yaKpqbt.exe
  2⤵
  PID:4476
- C:\Windows\System\Syctguo.exe
  C:\Windows\System\Syctguo.exe
  2⤵
  PID:4492
- C:\Windows\System\YIdMFaC.exe
  C:\Windows\System\YIdMFaC.exe
  2⤵
  PID:4508
- C:\Windows\System\iQYSiNL.exe
  C:\Windows\System\iQYSiNL.exe
  2⤵
  PID:4524
- C:\Windows\System\ZtqQzxM.exe
  C:\Windows\System\ZtqQzxM.exe
  2⤵
  PID:4544
- C:\Windows\System\zqICUex.exe
  C:\Windows\System\zqICUex.exe
  2⤵
  PID:4560
- C:\Windows\System\IFnMRVk.exe
  C:\Windows\System\IFnMRVk.exe
  2⤵
  PID:4596
- C:\Windows\System\MbnvQCk.exe
  C:\Windows\System\MbnvQCk.exe
  2⤵
  PID:4660
- C:\Windows\System\jjBSCpt.exe
  C:\Windows\System\jjBSCpt.exe
  2⤵
  PID:4676
- C:\Windows\System\QeYrEbY.exe
  C:\Windows\System\QeYrEbY.exe
  2⤵
  PID:4692
- C:\Windows\System\NTRnJoo.exe
  C:\Windows\System\NTRnJoo.exe
  2⤵
  PID:4712
- C:\Windows\System\HJMJlJV.exe
  C:\Windows\System\HJMJlJV.exe
  2⤵
  PID:4728
- C:\Windows\System\OcfvNdK.exe
  C:\Windows\System\OcfvNdK.exe
  2⤵
  PID:4776
- C:\Windows\System\rgevCvw.exe
  C:\Windows\System\rgevCvw.exe
  2⤵
  PID:4792
- C:\Windows\System\PgakXxT.exe
  C:\Windows\System\PgakXxT.exe
  2⤵
  PID:4808
- C:\Windows\System\PcxNULW.exe
  C:\Windows\System\PcxNULW.exe
  2⤵
  PID:4832
- C:\Windows\System\xiUjhbY.exe
  C:\Windows\System\xiUjhbY.exe
  2⤵
  PID:4848
- C:\Windows\System\mtTMtHz.exe
  C:\Windows\System\mtTMtHz.exe
  2⤵
  PID:4864
- C:\Windows\System\vBMHwGy.exe
  C:\Windows\System\vBMHwGy.exe
  2⤵
  PID:4880
- C:\Windows\System\MIRLZWJ.exe
  C:\Windows\System\MIRLZWJ.exe
  2⤵
  PID:4916
- C:\Windows\System\iNajXNx.exe
  C:\Windows\System\iNajXNx.exe
  2⤵
  PID:4932
- C:\Windows\System\uryOjey.exe
  C:\Windows\System\uryOjey.exe
  2⤵
  PID:4952
- C:\Windows\System\QEIYJWZ.exe
  C:\Windows\System\QEIYJWZ.exe
  2⤵
  PID:4968
- C:\Windows\System\GtUMgJG.exe
  C:\Windows\System\GtUMgJG.exe
  2⤵
  PID:4984
- C:\Windows\System\pSwImeZ.exe
  C:\Windows\System\pSwImeZ.exe
  2⤵
  PID:5000
- C:\Windows\System\szalfMq.exe
  C:\Windows\System\szalfMq.exe
  2⤵
  PID:5040
- C:\Windows\System\fcblLmb.exe
  C:\Windows\System\fcblLmb.exe
  2⤵
  PID:5056
- C:\Windows\System\YCXBdcg.exe
  C:\Windows\System\YCXBdcg.exe
  2⤵
  PID:5072
- C:\Windows\System\iXwkZpp.exe
  C:\Windows\System\iXwkZpp.exe
  2⤵
  PID:5088
- C:\Windows\System\TOgXhRS.exe
  C:\Windows\System\TOgXhRS.exe
  2⤵
  PID:2492
- C:\Windows\System\HflIqnh.exe
  C:\Windows\System\HflIqnh.exe
  2⤵
  PID:4048
- C:\Windows\System\ExvTvAO.exe
  C:\Windows\System\ExvTvAO.exe
  2⤵
  PID:3348
- C:\Windows\System\DfTmEID.exe
  C:\Windows\System\DfTmEID.exe
  2⤵
  PID:3888
- C:\Windows\System\foSjEUs.exe
  C:\Windows\System\foSjEUs.exe
  2⤵
  PID:3092
- C:\Windows\System\ZCjyBom.exe
  C:\Windows\System\ZCjyBom.exe
  2⤵
  PID:4192
- C:\Windows\System\bqtQqwo.exe
  C:\Windows\System\bqtQqwo.exe
  2⤵
  PID:4208
- C:\Windows\System\gRSAWrS.exe
  C:\Windows\System\gRSAWrS.exe
  2⤵
  PID:3636
- C:\Windows\System\QgbWczS.exe
  C:\Windows\System\QgbWczS.exe
  2⤵
  PID:3972
- C:\Windows\System\QlIAOSw.exe
  C:\Windows\System\QlIAOSw.exe
  2⤵
  PID:4228
- C:\Windows\System\acwvAJx.exe
  C:\Windows\System\acwvAJx.exe
  2⤵
  PID:3276
- C:\Windows\System\orPXtBc.exe
  C:\Windows\System\orPXtBc.exe
  2⤵
  PID:4184
- C:\Windows\System\gEQoWnG.exe
  C:\Windows\System\gEQoWnG.exe
  2⤵
  PID:4168
- C:\Windows\System\vWizmsm.exe
  C:\Windows\System\vWizmsm.exe
  2⤵
  PID:4296
- C:\Windows\System\WBbxmiH.exe
  C:\Windows\System\WBbxmiH.exe
  2⤵
  PID:4312
- C:\Windows\System\LCppgjy.exe
  C:\Windows\System\LCppgjy.exe
  2⤵
  PID:4384
- C:\Windows\System\IIlCosI.exe
  C:\Windows\System\IIlCosI.exe
  2⤵
  PID:4416
- C:\Windows\System\qqeKZci.exe
  C:\Windows\System\qqeKZci.exe
  2⤵
  PID:4336
- C:\Windows\System\BvUDlJX.exe
  C:\Windows\System\BvUDlJX.exe
  2⤵
  PID:4432
- C:\Windows\System\VybJTtK.exe
  C:\Windows\System\VybJTtK.exe
  2⤵
  PID:4532
- C:\Windows\System\zgZfufq.exe
  C:\Windows\System\zgZfufq.exe
  2⤵
  PID:4572
- C:\Windows\System\WbTPQLH.exe
  C:\Windows\System\WbTPQLH.exe
  2⤵
  PID:4552
- C:\Windows\System\JNaBrht.exe
  C:\Windows\System\JNaBrht.exe
  2⤵
  PID:4620
- C:\Windows\System\UMNFycQ.exe
  C:\Windows\System\UMNFycQ.exe
  2⤵
  PID:4644
- C:\Windows\System\bKvdmZB.exe
  C:\Windows\System\bKvdmZB.exe
  2⤵
  PID:4704
- C:\Windows\System\KfmPpfO.exe
  C:\Windows\System\KfmPpfO.exe
  2⤵
  PID:4744
- C:\Windows\System\NEcjHOB.exe
  C:\Windows\System\NEcjHOB.exe
  2⤵
  PID:4752
- C:\Windows\System\kLOfArs.exe
  C:\Windows\System\kLOfArs.exe
  2⤵
  PID:4772
- C:\Windows\System\vddFdrS.exe
  C:\Windows\System\vddFdrS.exe
  2⤵
  PID:4816
- C:\Windows\System\jTjrnKv.exe
  C:\Windows\System\jTjrnKv.exe
  2⤵
  PID:4844
- C:\Windows\System\BDYUyqw.exe
  C:\Windows\System\BDYUyqw.exe
  2⤵
  PID:4860
- C:\Windows\System\KaWnMQA.exe
  C:\Windows\System\KaWnMQA.exe
  2⤵
  PID:4888
- C:\Windows\System\qnXlCMN.exe
  C:\Windows\System\qnXlCMN.exe
  2⤵
  PID:4908
- C:\Windows\System\vGnYHhx.exe
  C:\Windows\System\vGnYHhx.exe
  2⤵
  PID:4940
- C:\Windows\System\LwxnOqm.exe
  C:\Windows\System\LwxnOqm.exe
  2⤵
  PID:4964
- C:\Windows\System\FpNkppc.exe
  C:\Windows\System\FpNkppc.exe
  2⤵
  PID:4768
- C:\Windows\System\XgPuYFe.exe
  C:\Windows\System\XgPuYFe.exe
  2⤵
  PID:5080
- C:\Windows\System\gcLgqWQ.exe
  C:\Windows\System\gcLgqWQ.exe
  2⤵
  PID:5112
- C:\Windows\System\hUwjWEJ.exe
  C:\Windows\System\hUwjWEJ.exe
  2⤵
  PID:4084
- C:\Windows\System\fNSjTfO.exe
  C:\Windows\System\fNSjTfO.exe
  2⤵
  PID:5024
- C:\Windows\System\pAigYCv.exe
  C:\Windows\System\pAigYCv.exe
  2⤵
  PID:3856
- C:\Windows\System\NpZUCwH.exe
  C:\Windows\System\NpZUCwH.exe
  2⤵
  PID:3664
- C:\Windows\System\DGcOWcI.exe
  C:\Windows\System\DGcOWcI.exe
  2⤵
  PID:4008
- C:\Windows\System\kNYciaC.exe
  C:\Windows\System\kNYciaC.exe
  2⤵
  PID:4148
- C:\Windows\System\BkhyqPr.exe
  C:\Windows\System\BkhyqPr.exe
  2⤵
  PID:3996
- C:\Windows\System\FJPDGFG.exe
  C:\Windows\System\FJPDGFG.exe
  2⤵
  PID:3448
- C:\Windows\System\nWvOged.exe
  C:\Windows\System\nWvOged.exe
  2⤵
  PID:3852
- C:\Windows\System\VNGgMrH.exe
  C:\Windows\System\VNGgMrH.exe
  2⤵
  PID:4068
- C:\Windows\System\NWRVUPh.exe
  C:\Windows\System\NWRVUPh.exe
  2⤵
  PID:3308
- C:\Windows\System\pcjFqNQ.exe
  C:\Windows\System\pcjFqNQ.exe
  2⤵
  PID:4364
- C:\Windows\System\XmPKAAv.exe
  C:\Windows\System\XmPKAAv.exe
  2⤵
  PID:4396
- C:\Windows\System\rjQniHi.exe
  C:\Windows\System\rjQniHi.exe
  2⤵
  PID:2288
- C:\Windows\System\JvHFRQw.exe
  C:\Windows\System\JvHFRQw.exe
  2⤵
  PID:4504
- C:\Windows\System\fAWEbLr.exe
  C:\Windows\System\fAWEbLr.exe
  2⤵
  PID:4640
- C:\Windows\System\FxPFCoH.exe
  C:\Windows\System\FxPFCoH.exe
  2⤵
  PID:4604
- C:\Windows\System\yrVHwJE.exe
  C:\Windows\System\yrVHwJE.exe
  2⤵
  PID:4656
- C:\Windows\System\fyUhKdS.exe
  C:\Windows\System\fyUhKdS.exe
  2⤵
  PID:4740
- C:\Windows\System\OVjkmGs.exe
  C:\Windows\System\OVjkmGs.exe
  2⤵
  PID:4760
- C:\Windows\System\pqJEoNp.exe
  C:\Windows\System\pqJEoNp.exe
  2⤵
  PID:4788
- C:\Windows\System\FkyRaIA.exe
  C:\Windows\System\FkyRaIA.exe
  2⤵
  PID:4876
- C:\Windows\System\BxHHYhX.exe
  C:\Windows\System\BxHHYhX.exe
  2⤵
  PID:4904
- C:\Windows\System\shSncmv.exe
  C:\Windows\System\shSncmv.exe
  2⤵
  PID:4996
- C:\Windows\System\TXBnxpS.exe
  C:\Windows\System\TXBnxpS.exe
  2⤵
  PID:5020
- C:\Windows\System\PkptfRm.exe
  C:\Windows\System\PkptfRm.exe
  2⤵
  PID:5096
- C:\Windows\System\boFFQzM.exe
  C:\Windows\System\boFFQzM.exe
  2⤵
  PID:5104
- C:\Windows\System\rchjGyn.exe
  C:\Windows\System\rchjGyn.exe
  2⤵
  PID:3344
- C:\Windows\System\YOFOWMD.exe
  C:\Windows\System\YOFOWMD.exe
  2⤵
  PID:3764
- C:\Windows\System\nWMwZch.exe
  C:\Windows\System\nWMwZch.exe
  2⤵
  PID:3956
- C:\Windows\System\VCiWOIU.exe
  C:\Windows\System\VCiWOIU.exe
  2⤵
  PID:3552
- C:\Windows\System\ufLlsdj.exe
  C:\Windows\System\ufLlsdj.exe
  2⤵
  PID:4180
- C:\Windows\System\wHkNyGZ.exe
  C:\Windows\System\wHkNyGZ.exe
  2⤵
  PID:4116
- C:\Windows\System\REFnpoo.exe
  C:\Windows\System\REFnpoo.exe
  2⤵
  PID:4268
- C:\Windows\System\KmHcDdu.exe
  C:\Windows\System\KmHcDdu.exe
  2⤵
  PID:4688
- C:\Windows\System\hYvvYuM.exe
  C:\Windows\System\hYvvYuM.exe
  2⤵
  PID:4516
- C:\Windows\System\OBetJJB.exe
  C:\Windows\System\OBetJJB.exe
  2⤵
  PID:4400
- C:\Windows\System\IwNCEya.exe
  C:\Windows\System\IwNCEya.exe
  2⤵
  PID:4616
- C:\Windows\System\vArkaiM.exe
  C:\Windows\System\vArkaiM.exe
  2⤵
  PID:4800
- C:\Windows\System\XrMVkdb.exe
  C:\Windows\System\XrMVkdb.exe
  2⤵
  PID:4944
- C:\Windows\System\mGiTCwk.exe
  C:\Windows\System\mGiTCwk.exe
  2⤵
  PID:1652
- C:\Windows\System\uCVkQag.exe
  C:\Windows\System\uCVkQag.exe
  2⤵
  PID:3620
- C:\Windows\System\MFgNyZd.exe
  C:\Windows\System\MFgNyZd.exe
  2⤵
  PID:5012
- C:\Windows\System\mfaAHzH.exe
  C:\Windows\System\mfaAHzH.exe
  2⤵
  PID:4900
- C:\Windows\System\sPVCeqI.exe
  C:\Windows\System\sPVCeqI.exe
  2⤵
  PID:4452
- C:\Windows\System\sToUKmK.exe
  C:\Windows\System\sToUKmK.exe
  2⤵
  PID:3908
- C:\Windows\System\GmhGfBh.exe
  C:\Windows\System\GmhGfBh.exe
  2⤵
  PID:3976
- C:\Windows\System\IGmzFGG.exe
  C:\Windows\System\IGmzFGG.exe
  2⤵
  PID:4352
- C:\Windows\System\IAfXrKn.exe
  C:\Windows\System\IAfXrKn.exe
  2⤵
  PID:4724
- C:\Windows\System\GQaByMX.exe
  C:\Windows\System\GQaByMX.exe
  2⤵
  PID:4892
- C:\Windows\System\lSLUKZQ.exe
  C:\Windows\System\lSLUKZQ.exe
  2⤵
  PID:4948
- C:\Windows\System\EMKNrUL.exe
  C:\Windows\System\EMKNrUL.exe
  2⤵
  PID:1660
- C:\Windows\System\NGyuZXn.exe
  C:\Windows\System\NGyuZXn.exe
  2⤵
  PID:4200
- C:\Windows\System\HUcSRkk.exe
  C:\Windows\System\HUcSRkk.exe
  2⤵
  PID:4412
- C:\Windows\System\zlIEUSr.exe
  C:\Windows\System\zlIEUSr.exe
  2⤵
  PID:4172
- C:\Windows\System\aCOjAtM.exe
  C:\Windows\System\aCOjAtM.exe
  2⤵
  PID:4708
- C:\Windows\System\gLLlDIT.exe
  C:\Windows\System\gLLlDIT.exe
  2⤵
  PID:4284
- C:\Windows\System\jLfCIBG.exe
  C:\Windows\System\jLfCIBG.exe
  2⤵
  PID:4176
- C:\Windows\System\RkAMFew.exe
  C:\Windows\System\RkAMFew.exe
  2⤵
  PID:4980
- C:\Windows\System\atWnmSf.exe
  C:\Windows\System\atWnmSf.exe
  2⤵
  PID:5100
- C:\Windows\System\mvLDiev.exe
  C:\Windows\System\mvLDiev.exe
  2⤵
  PID:4928
- C:\Windows\System\tComQyl.exe
  C:\Windows\System\tComQyl.exe
  2⤵
  PID:5132
- C:\Windows\System\lNfoHWG.exe
  C:\Windows\System\lNfoHWG.exe
  2⤵
  PID:5148
- C:\Windows\System\brNiLNs.exe
  C:\Windows\System\brNiLNs.exe
  2⤵
  PID:5168
- C:\Windows\System\tDdMBFh.exe
  C:\Windows\System\tDdMBFh.exe
  2⤵
  PID:5184
- C:\Windows\System\VNPyVnn.exe
  C:\Windows\System\VNPyVnn.exe
  2⤵
  PID:5200
- C:\Windows\System\gjMBkOa.exe
  C:\Windows\System\gjMBkOa.exe
  2⤵
  PID:5240
- C:\Windows\System\GosENVx.exe
  C:\Windows\System\GosENVx.exe
  2⤵
  PID:5256
- C:\Windows\System\cjEERCq.exe
  C:\Windows\System\cjEERCq.exe
  2⤵
  PID:5276
- C:\Windows\System\gRWUlnd.exe
  C:\Windows\System\gRWUlnd.exe
  2⤵
  PID:5296
- C:\Windows\System\iSLiORh.exe
  C:\Windows\System\iSLiORh.exe
  2⤵
  PID:5312
- C:\Windows\System\jlQPUqQ.exe
  C:\Windows\System\jlQPUqQ.exe
  2⤵
  PID:5328
- C:\Windows\System\nEoWFRU.exe
  C:\Windows\System\nEoWFRU.exe
  2⤵
  PID:5348
- C:\Windows\System\FJyFhoj.exe
  C:\Windows\System\FJyFhoj.exe
  2⤵
  PID:5364
- C:\Windows\System\wxWONMo.exe
  C:\Windows\System\wxWONMo.exe
  2⤵
  PID:5380
- C:\Windows\System\wnykkeV.exe
  C:\Windows\System\wnykkeV.exe
  2⤵
  PID:5400
- C:\Windows\System\ZWPidhV.exe
  C:\Windows\System\ZWPidhV.exe
  2⤵
  PID:5416
- C:\Windows\System\ghLJHiM.exe
  C:\Windows\System\ghLJHiM.exe
  2⤵
  PID:5432
- C:\Windows\System\nVMXsSR.exe
  C:\Windows\System\nVMXsSR.exe
  2⤵
  PID:5452
- C:\Windows\System\ZzLbaMk.exe
  C:\Windows\System\ZzLbaMk.exe
  2⤵
  PID:5468
- C:\Windows\System\evvsNfx.exe
  C:\Windows\System\evvsNfx.exe
  2⤵
  PID:5488
- C:\Windows\System\SZMXzPB.exe
  C:\Windows\System\SZMXzPB.exe
  2⤵
  PID:5504
- C:\Windows\System\CHteQrb.exe
  C:\Windows\System\CHteQrb.exe
  2⤵
  PID:5520
- C:\Windows\System\UJwkZYC.exe
  C:\Windows\System\UJwkZYC.exe
  2⤵
  PID:5540
- C:\Windows\System\OhROJVJ.exe
  C:\Windows\System\OhROJVJ.exe
  2⤵
  PID:5612
- C:\Windows\System\bwnlDRU.exe
  C:\Windows\System\bwnlDRU.exe
  2⤵
  PID:5628
- C:\Windows\System\TTtimro.exe
  C:\Windows\System\TTtimro.exe
  2⤵
  PID:5644
- C:\Windows\System\GLXxRBk.exe
  C:\Windows\System\GLXxRBk.exe
  2⤵
  PID:5660
- C:\Windows\System\KzByDbr.exe
  C:\Windows\System\KzByDbr.exe
  2⤵
  PID:5676
- C:\Windows\System\TBKeHOV.exe
  C:\Windows\System\TBKeHOV.exe
  2⤵
  PID:5692
- C:\Windows\System\dAxNeEw.exe
  C:\Windows\System\dAxNeEw.exe
  2⤵
  PID:5712
- C:\Windows\System\PBSGshA.exe
  C:\Windows\System\PBSGshA.exe
  2⤵
  PID:5728
- C:\Windows\System\ecWzFPU.exe
  C:\Windows\System\ecWzFPU.exe
  2⤵
  PID:5744
- C:\Windows\System\VwdimPk.exe
  C:\Windows\System\VwdimPk.exe
  2⤵
  PID:5760
- C:\Windows\System\OLiquWO.exe
  C:\Windows\System\OLiquWO.exe
  2⤵
  PID:5780
- C:\Windows\System\OXKbjWt.exe
  C:\Windows\System\OXKbjWt.exe
  2⤵
  PID:5796
- C:\Windows\System\WsIXsGp.exe
  C:\Windows\System\WsIXsGp.exe
  2⤵
  PID:5812
- C:\Windows\System\xdIPiGp.exe
  C:\Windows\System\xdIPiGp.exe
  2⤵
  PID:5828
- C:\Windows\System\CjisZPo.exe
  C:\Windows\System\CjisZPo.exe
  2⤵
  PID:5844
- C:\Windows\System\fLXJpIc.exe
  C:\Windows\System\fLXJpIc.exe
  2⤵
  PID:5860
- C:\Windows\System\FrwqBcB.exe
  C:\Windows\System\FrwqBcB.exe
  2⤵
  PID:5936
- C:\Windows\System\fGfHgqe.exe
  C:\Windows\System\fGfHgqe.exe
  2⤵
  PID:5952
- C:\Windows\System\yIYYRCS.exe
  C:\Windows\System\yIYYRCS.exe
  2⤵
  PID:5968
- C:\Windows\System\sVkaWBW.exe
  C:\Windows\System\sVkaWBW.exe
  2⤵
  PID:5984
- C:\Windows\System\unDzgoo.exe
  C:\Windows\System\unDzgoo.exe
  2⤵
  PID:6000
- C:\Windows\System\WGaTuzO.exe
  C:\Windows\System\WGaTuzO.exe
  2⤵
  PID:6016
- C:\Windows\System\PXdjXNM.exe
  C:\Windows\System\PXdjXNM.exe
  2⤵
  PID:6032
- C:\Windows\System\bcXHYXT.exe
  C:\Windows\System\bcXHYXT.exe
  2⤵
  PID:6052
- C:\Windows\System\VeBbCOz.exe
  C:\Windows\System\VeBbCOz.exe
  2⤵
  PID:6068
- C:\Windows\System\auEqZnA.exe
  C:\Windows\System\auEqZnA.exe
  2⤵
  PID:6096
- C:\Windows\System\wEnmTMv.exe
  C:\Windows\System\wEnmTMv.exe
  2⤵
  PID:6112
- C:\Windows\System\jzNxuFa.exe
  C:\Windows\System\jzNxuFa.exe
  2⤵
  PID:6128
- C:\Windows\System\wwxmNAs.exe
  C:\Windows\System\wwxmNAs.exe
  2⤵
  PID:5164
- C:\Windows\System\MXQOfpM.exe
  C:\Windows\System\MXQOfpM.exe
  2⤵
  PID:5216
- C:\Windows\System\twihzZw.exe
  C:\Windows\System\twihzZw.exe
  2⤵
  PID:5252
- C:\Windows\System\bfbMfDm.exe
  C:\Windows\System\bfbMfDm.exe
  2⤵
  PID:5180
- C:\Windows\System\biQEEVy.exe
  C:\Windows\System\biQEEVy.exe
  2⤵
  PID:5220
- C:\Windows\System\YfEzBaQ.exe
  C:\Windows\System\YfEzBaQ.exe
  2⤵
  PID:5236
- C:\Windows\System\uQNDVvH.exe
  C:\Windows\System\uQNDVvH.exe
  2⤵
  PID:4648
- C:\Windows\System\kLTZxhC.exe
  C:\Windows\System\kLTZxhC.exe
  2⤵
  PID:5324
- C:\Windows\System\IfneGDF.exe
  C:\Windows\System\IfneGDF.exe
  2⤵
  PID:5396
- C:\Windows\System\EkxpZoj.exe
  C:\Windows\System\EkxpZoj.exe
  2⤵
  PID:5464
- C:\Windows\System\GPMBAvg.exe
  C:\Windows\System\GPMBAvg.exe
  2⤵
  PID:5376
- C:\Windows\System\MgNLHIM.exe
  C:\Windows\System\MgNLHIM.exe
  2⤵
  PID:5444
- C:\Windows\System\AgLWBRx.exe
  C:\Windows\System\AgLWBRx.exe
  2⤵
  PID:5484
- C:\Windows\System\YYejoDS.exe
  C:\Windows\System\YYejoDS.exe
  2⤵
  PID:5552
- C:\Windows\System\iuQyMQm.exe
  C:\Windows\System\iuQyMQm.exe
  2⤵
  PID:5564
- C:\Windows\System\wHFPgTI.exe
  C:\Windows\System\wHFPgTI.exe
  2⤵
  PID:5580
- C:\Windows\System\ciAimAt.exe
  C:\Windows\System\ciAimAt.exe
  2⤵
  PID:4632
- C:\Windows\System\wclOpRg.exe
  C:\Windows\System\wclOpRg.exe
  2⤵
  PID:5624
- C:\Windows\System\dEhNVWm.exe
  C:\Windows\System\dEhNVWm.exe
  2⤵
  PID:5724
- C:\Windows\System\jiFRjHa.exe
  C:\Windows\System\jiFRjHa.exe
  2⤵
  PID:5820
- C:\Windows\System\gmXsHna.exe
  C:\Windows\System\gmXsHna.exe
  2⤵
  PID:5888
- C:\Windows\System\iCzzMbZ.exe
  C:\Windows\System\iCzzMbZ.exe
  2⤵
  PID:5908
- C:\Windows\System\DbWugxi.exe
  C:\Windows\System\DbWugxi.exe
  2⤵
  PID:5924
- C:\Windows\System\QTgpyGD.exe
  C:\Windows\System\QTgpyGD.exe
  2⤵
  PID:5976
- C:\Windows\System\fIdEEZG.exe
  C:\Windows\System\fIdEEZG.exe
  2⤵
  PID:5964
- C:\Windows\System\gFEfAFG.exe
  C:\Windows\System\gFEfAFG.exe
  2⤵
  PID:6028
- C:\Windows\System\pSrtXwv.exe
  C:\Windows\System\pSrtXwv.exe
  2⤵
  PID:6040
- C:\Windows\System\OeaPUVV.exe
  C:\Windows\System\OeaPUVV.exe
  2⤵
  PID:6084
- C:\Windows\System\tfjkttQ.exe
  C:\Windows\System\tfjkttQ.exe
  2⤵
  PID:6104
- C:\Windows\System\agoyotg.exe
  C:\Windows\System\agoyotg.exe
  2⤵
  PID:4132
- C:\Windows\System\SHapsKJ.exe
  C:\Windows\System\SHapsKJ.exe
  2⤵
  PID:5052
- C:\Windows\System\BpXNdIT.exe
  C:\Windows\System\BpXNdIT.exe
  2⤵
  PID:5196
- C:\Windows\System\IsfHTcR.exe
  C:\Windows\System\IsfHTcR.exe
  2⤵
  PID:5232
- C:\Windows\System\bywBcHn.exe
  C:\Windows\System\bywBcHn.exe
  2⤵
  PID:5496
- C:\Windows\System\rRVjPse.exe
  C:\Windows\System\rRVjPse.exe
  2⤵
  PID:5388
- C:\Windows\System\fIllWoH.exe
  C:\Windows\System\fIllWoH.exe
  2⤵
  PID:5248
- C:\Windows\System\dNvXmwS.exe
  C:\Windows\System\dNvXmwS.exe
  2⤵
  PID:5536
- C:\Windows\System\PyPkbOh.exe
  C:\Windows\System\PyPkbOh.exe
  2⤵
  PID:5340
- C:\Windows\System\YRkOvDA.exe
  C:\Windows\System\YRkOvDA.exe
  2⤵
  PID:5336
- C:\Windows\System\rzgUiFn.exe
  C:\Windows\System\rzgUiFn.exe
  2⤵
  PID:5672
- C:\Windows\System\dOVykvu.exe
  C:\Windows\System\dOVykvu.exe
  2⤵
  PID:5708
- C:\Windows\System\QihkFek.exe
  C:\Windows\System\QihkFek.exe
  2⤵
  PID:5740
- C:\Windows\System\thFwFxt.exe
  C:\Windows\System\thFwFxt.exe
  2⤵
  PID:5668
- C:\Windows\System\sqcGsjl.exe
  C:\Windows\System\sqcGsjl.exe
  2⤵
  PID:5896
- C:\Windows\System\zgnzdaa.exe
  C:\Windows\System\zgnzdaa.exe
  2⤵
  PID:5948
- C:\Windows\System\EXsZoCo.exe
  C:\Windows\System\EXsZoCo.exe
  2⤵
  PID:6024
- C:\Windows\System\YfYHQBI.exe
  C:\Windows\System\YfYHQBI.exe
  2⤵
  PID:6140
- C:\Windows\System\kHEnKmo.exe
  C:\Windows\System\kHEnKmo.exe
  2⤵
  PID:5804
- C:\Windows\System\jxFWkLV.exe
  C:\Windows\System\jxFWkLV.exe
  2⤵
  PID:5304
- C:\Windows\System\RehPOGE.exe
  C:\Windows\System\RehPOGE.exe
  2⤵
  PID:5516
- C:\Windows\System\FUsrEdD.exe
  C:\Windows\System\FUsrEdD.exe
  2⤵
  PID:5608
- C:\Windows\System\wdctHjj.exe
  C:\Windows\System\wdctHjj.exe
  2⤵
  PID:5752
- C:\Windows\System\SKgCugf.exe
  C:\Windows\System\SKgCugf.exe
  2⤵
  PID:5476
- C:\Windows\System\ASoITWW.exe
  C:\Windows\System\ASoITWW.exe
  2⤵
  PID:5980
- C:\Windows\System\VvltmVO.exe
  C:\Windows\System\VvltmVO.exe
  2⤵
  PID:6012
- C:\Windows\System\rOctkqy.exe
  C:\Windows\System\rOctkqy.exe
  2⤵
  PID:5124
- C:\Windows\System\OHlyARI.exe
  C:\Windows\System\OHlyARI.exe
  2⤵
  PID:5360
- C:\Windows\System\htgLKGu.exe
  C:\Windows\System\htgLKGu.exe
  2⤵
  PID:5308
- C:\Windows\System\wCNThtw.exe
  C:\Windows\System\wCNThtw.exe
  2⤵
  PID:5876
- C:\Windows\System\DZKCvtS.exe
  C:\Windows\System\DZKCvtS.exe
  2⤵
  PID:5156
- C:\Windows\System\AaZneSn.exe
  C:\Windows\System\AaZneSn.exe
  2⤵
  PID:5372
- C:\Windows\System\ZPYbYgu.exe
  C:\Windows\System\ZPYbYgu.exe
  2⤵
  PID:6152
- C:\Windows\System\zmSPcdx.exe
  C:\Windows\System\zmSPcdx.exe
  2⤵
  PID:6168
- C:\Windows\System\whPWYbM.exe
  C:\Windows\System\whPWYbM.exe
  2⤵
  PID:6188
- C:\Windows\System\TSZaecc.exe
  C:\Windows\System\TSZaecc.exe
  2⤵
  PID:6216
- C:\Windows\System\fyfYvbF.exe
  C:\Windows\System\fyfYvbF.exe
  2⤵
  PID:6232
- C:\Windows\System\DTUsrZJ.exe
  C:\Windows\System\DTUsrZJ.exe
  2⤵
  PID:6252
- C:\Windows\System\dziIlYc.exe
  C:\Windows\System\dziIlYc.exe
  2⤵
  PID:6276
- C:\Windows\System\MXowTKi.exe
  C:\Windows\System\MXowTKi.exe
  2⤵
  PID:6292
- C:\Windows\System\wzXDWnC.exe
  C:\Windows\System\wzXDWnC.exe
  2⤵
  PID:6308
- C:\Windows\System\ZcPbxWf.exe
  C:\Windows\System\ZcPbxWf.exe
  2⤵
  PID:6328
- C:\Windows\System\IOTaOcJ.exe
  C:\Windows\System\IOTaOcJ.exe
  2⤵
  PID:6344
- C:\Windows\System\PekYULj.exe
  C:\Windows\System\PekYULj.exe
  2⤵
  PID:6360
- C:\Windows\System\AQBCkkw.exe
  C:\Windows\System\AQBCkkw.exe
  2⤵
  PID:6380
- C:\Windows\System\xDrtjsa.exe
  C:\Windows\System\xDrtjsa.exe
  2⤵
  PID:6396
- C:\Windows\System\bLWLbwU.exe
  C:\Windows\System\bLWLbwU.exe
  2⤵
  PID:6416
- C:\Windows\System\UrEfRMc.exe
  C:\Windows\System\UrEfRMc.exe
  2⤵
  PID:6448
- C:\Windows\System\dQTSnwx.exe
  C:\Windows\System\dQTSnwx.exe
  2⤵
  PID:6464
- C:\Windows\System\cyCZDsa.exe
  C:\Windows\System\cyCZDsa.exe
  2⤵
  PID:6480
- C:\Windows\System\TUhbyma.exe
  C:\Windows\System\TUhbyma.exe
  2⤵
  PID:6496
- C:\Windows\System\wlndBEY.exe
  C:\Windows\System\wlndBEY.exe
  2⤵
  PID:6516
- C:\Windows\System\mfwLcIz.exe
  C:\Windows\System\mfwLcIz.exe
  2⤵
  PID:6536
- C:\Windows\System\RjYnCuX.exe
  C:\Windows\System\RjYnCuX.exe
  2⤵
  PID:6552
- C:\Windows\System\FpTbOfG.exe
  C:\Windows\System\FpTbOfG.exe
  2⤵
  PID:6572
- C:\Windows\System\ebpXWxK.exe
  C:\Windows\System\ebpXWxK.exe
  2⤵
  PID:6588
- C:\Windows\System\NssVoDa.exe
  C:\Windows\System\NssVoDa.exe
  2⤵
  PID:6604
- C:\Windows\System\xAeMUKy.exe
  C:\Windows\System\xAeMUKy.exe
  2⤵
  PID:6620
- C:\Windows\System\mKDyVmo.exe
  C:\Windows\System\mKDyVmo.exe
  2⤵
  PID:6644
- C:\Windows\System\wlvypgj.exe
  C:\Windows\System\wlvypgj.exe
  2⤵
  PID:6660
- C:\Windows\System\MwXZxFQ.exe
  C:\Windows\System\MwXZxFQ.exe
  2⤵
  PID:6680
- C:\Windows\System\BQHbprI.exe
  C:\Windows\System\BQHbprI.exe
  2⤵
  PID:6696
- C:\Windows\System\tUTyKKI.exe
  C:\Windows\System\tUTyKKI.exe
  2⤵
  PID:6716
- C:\Windows\System\nWeluZg.exe
  C:\Windows\System\nWeluZg.exe
  2⤵
  PID:6732
- C:\Windows\System\yNVKhcB.exe
  C:\Windows\System\yNVKhcB.exe
  2⤵
  PID:6840
- C:\Windows\System\gICcjgU.exe
  C:\Windows\System\gICcjgU.exe
  2⤵
  PID:6856
- C:\Windows\System\gkjZdFz.exe
  C:\Windows\System\gkjZdFz.exe
  2⤵
  PID:6872
- C:\Windows\System\CctLnjx.exe
  C:\Windows\System\CctLnjx.exe
  2⤵
  PID:6892
- C:\Windows\System\XHmqbhD.exe
  C:\Windows\System\XHmqbhD.exe
  2⤵
  PID:6928
- C:\Windows\System\ixZBNKx.exe
  C:\Windows\System\ixZBNKx.exe
  2⤵
  PID:6944
- C:\Windows\System\xncbdiH.exe
  C:\Windows\System\xncbdiH.exe
  2⤵
  PID:6960
- C:\Windows\System\WfZzPXN.exe
  C:\Windows\System\WfZzPXN.exe
  2⤵
  PID:6976
- C:\Windows\System\iBSVQrv.exe
  C:\Windows\System\iBSVQrv.exe
  2⤵
  PID:6992
- C:\Windows\System\WqdaFkL.exe
  C:\Windows\System\WqdaFkL.exe
  2⤵
  PID:7012
- C:\Windows\System\OQAnbLL.exe
  C:\Windows\System\OQAnbLL.exe
  2⤵
  PID:7028
- C:\Windows\System\NKXCDkx.exe
  C:\Windows\System\NKXCDkx.exe
  2⤵
  PID:7044
- C:\Windows\System\dedDenq.exe
  C:\Windows\System\dedDenq.exe
  2⤵
  PID:7060
- C:\Windows\System\vwHNUqD.exe
  C:\Windows\System\vwHNUqD.exe
  2⤵
  PID:7080
- C:\Windows\System\xqzrHig.exe
  C:\Windows\System\xqzrHig.exe
  2⤵
  PID:7096
- C:\Windows\System\aZCagth.exe
  C:\Windows\System\aZCagth.exe
  2⤵
  PID:7112
- C:\Windows\System\qvfcJcV.exe
  C:\Windows\System\qvfcJcV.exe
  2⤵
  PID:7132
- C:\Windows\System\uzTooGU.exe
  C:\Windows\System\uzTooGU.exe
  2⤵
  PID:5884
- C:\Windows\System\Qeleeyk.exe
  C:\Windows\System\Qeleeyk.exe
  2⤵
  PID:6176
- C:\Windows\System\FKLtSCb.exe
  C:\Windows\System\FKLtSCb.exe
  2⤵
  PID:6224
- C:\Windows\System\WPbYbMn.exe
  C:\Windows\System\WPbYbMn.exe
  2⤵
  PID:6264
- C:\Windows\System\yAJpWeL.exe
  C:\Windows\System\yAJpWeL.exe
  2⤵
  PID:6304
- C:\Windows\System\xAuBIIU.exe
  C:\Windows\System\xAuBIIU.exe
  2⤵
  PID:6368
- C:\Windows\System\EbAcjiO.exe
  C:\Windows\System\EbAcjiO.exe
  2⤵
  PID:6372
- C:\Windows\System\jAEfLCw.exe
  C:\Windows\System\jAEfLCw.exe
  2⤵
  PID:6136
- C:\Windows\System\JGMKeFq.exe
  C:\Windows\System\JGMKeFq.exe
  2⤵
  PID:5528
- C:\Windows\System\BsbHDZr.exe
  C:\Windows\System\BsbHDZr.exe
  2⤵
  PID:6076
- C:\Windows\System\DgUHWsf.exe
  C:\Windows\System\DgUHWsf.exe
  2⤵
  PID:5792
- C:\Windows\System\lAzgUqm.exe
  C:\Windows\System\lAzgUqm.exe
  2⤵
  PID:5652
- C:\Windows\System\SgcPjUW.exe
  C:\Windows\System\SgcPjUW.exe
  2⤵
  PID:6200
- C:\Windows\System\Elpugsh.exe
  C:\Windows\System\Elpugsh.exe
  2⤵
  PID:6240
- C:\Windows\System\SQrdDZX.exe
  C:\Windows\System\SQrdDZX.exe
  2⤵
  PID:6316
- C:\Windows\System\eJOWDAp.exe
  C:\Windows\System\eJOWDAp.exe
  2⤵
  PID:6436
- C:\Windows\System\GnmkUrp.exe
  C:\Windows\System\GnmkUrp.exe
  2⤵
  PID:6460
- C:\Windows\System\YlciJRy.exe
  C:\Windows\System\YlciJRy.exe
  2⤵
  PID:6532
- C:\Windows\System\nRdCdpM.exe
  C:\Windows\System\nRdCdpM.exe
  2⤵
  PID:6596
- C:\Windows\System\ZFzSJMg.exe
  C:\Windows\System\ZFzSJMg.exe
  2⤵
  PID:6668
- C:\Windows\System\PANaIIX.exe
  C:\Windows\System\PANaIIX.exe
  2⤵
  PID:6708
- C:\Windows\System\HedgpGO.exe
  C:\Windows\System\HedgpGO.exe
  2⤵
  PID:6544
- C:\Windows\System\KFMTeDz.exe
  C:\Windows\System\KFMTeDz.exe
  2⤵
  PID:6612
- C:\Windows\System\xlaaqnB.exe
  C:\Windows\System\xlaaqnB.exe
  2⤵
  PID:6688
- C:\Windows\System\JeagzuF.exe
  C:\Windows\System\JeagzuF.exe
  2⤵
  PID:6740
- C:\Windows\System\eGjuYTh.exe
  C:\Windows\System\eGjuYTh.exe
  2⤵
  PID:6756
- C:\Windows\System\CBmboyr.exe
  C:\Windows\System\CBmboyr.exe
  2⤵
  PID:6768
- C:\Windows\System\BUNHCCf.exe
  C:\Windows\System\BUNHCCf.exe
  2⤵
  PID:6780
- C:\Windows\System\ihJQWUk.exe
  C:\Windows\System\ihJQWUk.exe
  2⤵
  PID:6796
- C:\Windows\System\eNsMUOT.exe
  C:\Windows\System\eNsMUOT.exe
  2⤵
  PID:6812
- C:\Windows\System\NfHXQWM.exe
  C:\Windows\System\NfHXQWM.exe
  2⤵
  PID:6832
- C:\Windows\System\oFwbWMU.exe
  C:\Windows\System\oFwbWMU.exe
  2⤵
  PID:5836
- C:\Windows\System\GOaUpOM.exe
  C:\Windows\System\GOaUpOM.exe
  2⤵
  PID:6916
- C:\Windows\System\IkIJLgM.exe
  C:\Windows\System\IkIJLgM.exe
  2⤵
  PID:6956
- C:\Windows\System\HTMFjuG.exe
  C:\Windows\System\HTMFjuG.exe
  2⤵
  PID:7088
- C:\Windows\System\hqxUEId.exe
  C:\Windows\System\hqxUEId.exe
  2⤵
  PID:7052
- C:\Windows\System\bPDQeVJ.exe
  C:\Windows\System\bPDQeVJ.exe
  2⤵
  PID:6968
- C:\Windows\System\yKdNotC.exe
  C:\Windows\System\yKdNotC.exe
  2⤵
  PID:6936
- C:\Windows\System\xNeEFxL.exe
  C:\Windows\System\xNeEFxL.exe
  2⤵
  PID:7140
- C:\Windows\System\fhrVMfg.exe
  C:\Windows\System\fhrVMfg.exe
  2⤵
  PID:7160
- C:\Windows\System\OtndORu.exe
  C:\Windows\System\OtndORu.exe
  2⤵
  PID:4540
- C:\Windows\System\HLmprah.exe
  C:\Windows\System\HLmprah.exe
  2⤵
  PID:6404
- C:\Windows\System\oRTdUPL.exe
  C:\Windows\System\oRTdUPL.exe
  2⤵
  PID:6064
- C:\Windows\System\IzusgCZ.exe
  C:\Windows\System\IzusgCZ.exe
  2⤵
  PID:5640
- C:\Windows\System\jVybDri.exe
  C:\Windows\System\jVybDri.exe
  2⤵
  PID:5600
- C:\Windows\System\IXNSmQO.exe
  C:\Windows\System\IXNSmQO.exe
  2⤵
  PID:6412
- C:\Windows\System\cXgRSEh.exe
  C:\Windows\System\cXgRSEh.exe
  2⤵
  PID:6288
- C:\Windows\System\dYVdDWn.exe
  C:\Windows\System\dYVdDWn.exe
  2⤵
  PID:6356
- C:\Windows\System\HljPgHa.exe
  C:\Windows\System\HljPgHa.exe
  2⤵
  PID:6432
- C:\Windows\System\EwFwAok.exe
  C:\Windows\System\EwFwAok.exe
  2⤵
  PID:6196
- C:\Windows\System\nMEfkzY.exe
  C:\Windows\System\nMEfkzY.exe
  2⤵
  PID:6628
- C:\Windows\System\oYZFYsi.exe
  C:\Windows\System\oYZFYsi.exe
  2⤵
  PID:6428
- C:\Windows\System\rnYjsDm.exe
  C:\Windows\System\rnYjsDm.exe
  2⤵
  PID:6504
- C:\Windows\System\MaYOORy.exe
  C:\Windows\System\MaYOORy.exe
  2⤵
  PID:6580
- C:\Windows\System\aGCBwyV.exe
  C:\Windows\System\aGCBwyV.exe
  2⤵
  PID:6728
- C:\Windows\System\mKkxtjy.exe
  C:\Windows\System\mKkxtjy.exe
  2⤵
  PID:6764
- C:\Windows\System\rqybSnB.exe
  C:\Windows\System\rqybSnB.exe
  2⤵
  PID:6864
- C:\Windows\System\UbMUcag.exe
  C:\Windows\System\UbMUcag.exe
  2⤵
  PID:6868
- C:\Windows\System\QsmTLvH.exe
  C:\Windows\System\QsmTLvH.exe
  2⤵
  PID:7104
- C:\Windows\System\yeCCpNL.exe
  C:\Windows\System\yeCCpNL.exe
  2⤵
  PID:6820
- C:\Windows\System\nRddvGa.exe
  C:\Windows\System\nRddvGa.exe
  2⤵
  PID:7076
- C:\Windows\System\VmMgMun.exe
  C:\Windows\System\VmMgMun.exe
  2⤵
  PID:6828
- C:\Windows\System\XAVzsbG.exe
  C:\Windows\System\XAVzsbG.exe
  2⤵
  PID:6336
- C:\Windows\System\WldpSmf.exe
  C:\Windows\System\WldpSmf.exe
  2⤵
  PID:6300
- C:\Windows\System\gzPyaBg.exe
  C:\Windows\System\gzPyaBg.exe
  2⤵
  PID:6912
- C:\Windows\System\uWFAZGi.exe
  C:\Windows\System\uWFAZGi.exe
  2⤵
  PID:7024
- C:\Windows\System\zWWBiXx.exe
  C:\Windows\System\zWWBiXx.exe
  2⤵
  PID:6880
- C:\Windows\System\PYKSPsp.exe
  C:\Windows\System\PYKSPsp.exe
  2⤵
  PID:5776
- C:\Windows\System\UFypZjH.exe
  C:\Windows\System\UFypZjH.exe
  2⤵
  PID:6164
- C:\Windows\System\zBxpmeN.exe
  C:\Windows\System\zBxpmeN.exe
  2⤵
  PID:896
- C:\Windows\System\ZubZIlO.exe
  C:\Windows\System\ZubZIlO.exe
  2⤵
  PID:6632
- C:\Windows\System\QjvUylC.exe
  C:\Windows\System\QjvUylC.exe
  2⤵
  PID:6456
- C:\Windows\System\dFkkDKh.exe
  C:\Windows\System\dFkkDKh.exe
  2⤵
  PID:6636
- C:\Windows\System\gzZcVlx.exe
  C:\Windows\System\gzZcVlx.exe
  2⤵
  PID:6788
- C:\Windows\System\LbkoKRw.exe
  C:\Windows\System\LbkoKRw.exe
  2⤵
  PID:5720
- C:\Windows\System\xPYacgA.exe
  C:\Windows\System\xPYacgA.exe
  2⤵
  PID:4840
- C:\Windows\System\TDjMpPA.exe
  C:\Windows\System\TDjMpPA.exe
  2⤵
  PID:5440
- C:\Windows\System\ZtmeDhK.exe
  C:\Windows\System\ZtmeDhK.exe
  2⤵
  PID:7000
- C:\Windows\System\ZXpCkRl.exe
  C:\Windows\System\ZXpCkRl.exe
  2⤵
  PID:6528
- C:\Windows\System\WQIPHoa.exe
  C:\Windows\System\WQIPHoa.exe
  2⤵
  PID:6908
- C:\Windows\System\lkzyGrF.exe
  C:\Windows\System\lkzyGrF.exe
  2⤵
  PID:6952
- C:\Windows\System\BicYzHi.exe
  C:\Windows\System\BicYzHi.exe
  2⤵
  PID:6584
- C:\Windows\System\DfvrNMK.exe
  C:\Windows\System\DfvrNMK.exe
  2⤵
  PID:6792
- C:\Windows\System\crQMCCz.exe
  C:\Windows\System\crQMCCz.exe
  2⤵
  PID:6476
- C:\Windows\System\aCNndGW.exe
  C:\Windows\System\aCNndGW.exe
  2⤵
  PID:6808
- C:\Windows\System\CMmRnSz.exe
  C:\Windows\System\CMmRnSz.exe
  2⤵
  PID:6824
- C:\Windows\System\iWiwFTl.exe
  C:\Windows\System\iWiwFTl.exe
  2⤵
  PID:6472
- C:\Windows\System\lpcbfvB.exe
  C:\Windows\System\lpcbfvB.exe
  2⤵
  PID:6424
- C:\Windows\System\wVKdbQT.exe
  C:\Windows\System\wVKdbQT.exe
  2⤵
  PID:6776
- C:\Windows\System\WwaolFr.exe
  C:\Windows\System\WwaolFr.exe
  2⤵
  PID:6512
- C:\Windows\System\mIWCGiD.exe
  C:\Windows\System\mIWCGiD.exe
  2⤵
  PID:7148
- C:\Windows\System\aQHoeRJ.exe
  C:\Windows\System\aQHoeRJ.exe
  2⤵
  PID:5272
- C:\Windows\System\uYrCtoM.exe
  C:\Windows\System\uYrCtoM.exe
  2⤵
  PID:7180
- C:\Windows\System\QLjmgFl.exe
  C:\Windows\System\QLjmgFl.exe
  2⤵
  PID:7196
- C:\Windows\System\pcxeAoJ.exe
  C:\Windows\System\pcxeAoJ.exe
  2⤵
  PID:7212
- C:\Windows\System\lYzYScx.exe
  C:\Windows\System\lYzYScx.exe
  2⤵
  PID:7228
- C:\Windows\System\YKygUWB.exe
  C:\Windows\System\YKygUWB.exe
  2⤵
  PID:7244
- C:\Windows\System\jtJmJdQ.exe
  C:\Windows\System\jtJmJdQ.exe
  2⤵
  PID:7260
- C:\Windows\System\bBulCVU.exe
  C:\Windows\System\bBulCVU.exe
  2⤵
  PID:7276
- C:\Windows\System\zYqyDDP.exe
  C:\Windows\System\zYqyDDP.exe
  2⤵
  PID:7292
- C:\Windows\System\zJtsbzh.exe
  C:\Windows\System\zJtsbzh.exe
  2⤵
  PID:7308
- C:\Windows\System\YQBAjAM.exe
  C:\Windows\System\YQBAjAM.exe
  2⤵
  PID:7324
- C:\Windows\System\bQPZgui.exe
  C:\Windows\System\bQPZgui.exe
  2⤵
  PID:7340
- C:\Windows\System\wTGovaP.exe
  C:\Windows\System\wTGovaP.exe
  2⤵
  PID:7360
- C:\Windows\System\QSqwbtg.exe
  C:\Windows\System\QSqwbtg.exe
  2⤵
  PID:7380
- C:\Windows\System\GFznBRE.exe
  C:\Windows\System\GFznBRE.exe
  2⤵
  PID:7396
- C:\Windows\System\lcIolFX.exe
  C:\Windows\System\lcIolFX.exe
  2⤵
  PID:7412
- C:\Windows\System\oJLoFJF.exe
  C:\Windows\System\oJLoFJF.exe
  2⤵
  PID:7428
- C:\Windows\System\fuYiyyI.exe
  C:\Windows\System\fuYiyyI.exe
  2⤵
  PID:7444
- C:\Windows\System\HcoXAIH.exe
  C:\Windows\System\HcoXAIH.exe
  2⤵
  PID:7460
- C:\Windows\System\yhVvzzH.exe
  C:\Windows\System\yhVvzzH.exe
  2⤵
  PID:7476
- C:\Windows\System\iVxyAAq.exe
  C:\Windows\System\iVxyAAq.exe
  2⤵
  PID:7492
- C:\Windows\System\OqAwioH.exe
  C:\Windows\System\OqAwioH.exe
  2⤵
  PID:7512
- C:\Windows\System\rfXeoEq.exe
  C:\Windows\System\rfXeoEq.exe
  2⤵
  PID:7528
- C:\Windows\System\JMQdUdG.exe
  C:\Windows\System\JMQdUdG.exe
  2⤵
  PID:7548
- C:\Windows\System\FgsULlI.exe
  C:\Windows\System\FgsULlI.exe
  2⤵
  PID:7564
- C:\Windows\System\neZjTvL.exe
  C:\Windows\System\neZjTvL.exe
  2⤵
  PID:7584
- C:\Windows\System\KNhRNCY.exe
  C:\Windows\System\KNhRNCY.exe
  2⤵
  PID:7604
- C:\Windows\System\ffniVYp.exe
  C:\Windows\System\ffniVYp.exe
  2⤵
  PID:7680
- C:\Windows\System\VMBYhrn.exe
  C:\Windows\System\VMBYhrn.exe
  2⤵
  PID:7700
- C:\Windows\System\BqtpZUq.exe
  C:\Windows\System\BqtpZUq.exe
  2⤵
  PID:7716
- C:\Windows\System\XgOUmAy.exe
  C:\Windows\System\XgOUmAy.exe
  2⤵
  PID:7732
- C:\Windows\System\YzOFKIp.exe
  C:\Windows\System\YzOFKIp.exe
  2⤵
  PID:7748
- C:\Windows\System\nRQSxZf.exe
  C:\Windows\System\nRQSxZf.exe
  2⤵
  PID:7776
- C:\Windows\System\WbiwDuK.exe
  C:\Windows\System\WbiwDuK.exe
  2⤵
  PID:7792
- C:\Windows\System\mOdGGoB.exe
  C:\Windows\System\mOdGGoB.exe
  2⤵
  PID:7808
- C:\Windows\System\OsPTkZw.exe
  C:\Windows\System\OsPTkZw.exe
  2⤵
  PID:7824
- C:\Windows\System\BpSQswy.exe
  C:\Windows\System\BpSQswy.exe
  2⤵
  PID:7840
- C:\Windows\System\ePEsXxD.exe
  C:\Windows\System\ePEsXxD.exe
  2⤵
  PID:7860
- C:\Windows\System\OAEgFVo.exe
  C:\Windows\System\OAEgFVo.exe
  2⤵
  PID:7888
- C:\Windows\System\hGvpNRa.exe
  C:\Windows\System\hGvpNRa.exe
  2⤵
  PID:7904
- C:\Windows\System\PgeANpu.exe
  C:\Windows\System\PgeANpu.exe
  2⤵
  PID:7920
- C:\Windows\System\djREczJ.exe
  C:\Windows\System\djREczJ.exe
  2⤵
  PID:7936
- C:\Windows\System\JvFbDnt.exe
  C:\Windows\System\JvFbDnt.exe
  2⤵
  PID:7952
- C:\Windows\System\MTFMRvv.exe
  C:\Windows\System\MTFMRvv.exe
  2⤵
  PID:7988
- C:\Windows\System\rgZVmsm.exe
  C:\Windows\System\rgZVmsm.exe
  2⤵
  PID:8128
- C:\Windows\System\QHNXmtT.exe
  C:\Windows\System\QHNXmtT.exe
  2⤵
  PID:8148
- C:\Windows\System\qEuXrAd.exe
  C:\Windows\System\qEuXrAd.exe
  2⤵
  PID:8168
- C:\Windows\System\cfZyhrd.exe
  C:\Windows\System\cfZyhrd.exe
  2⤵
  PID:8184
- C:\Windows\System\VFBweQm.exe
  C:\Windows\System\VFBweQm.exe
  2⤵
  PID:6268
- C:\Windows\System\CLBNQeH.exe
  C:\Windows\System\CLBNQeH.exe
  2⤵
  PID:7072
- C:\Windows\System\SlEEVMz.exe
  C:\Windows\System\SlEEVMz.exe
  2⤵
  PID:7204
- C:\Windows\System\vkhBpAg.exe
  C:\Windows\System\vkhBpAg.exe
  2⤵
  PID:7068
- C:\Windows\System\kBUoTIA.exe
  C:\Windows\System\kBUoTIA.exe
  2⤵
  PID:7284
- C:\Windows\System\AkWEihP.exe
  C:\Windows\System\AkWEihP.exe
  2⤵
  PID:7352
- C:\Windows\System\BtLJNIK.exe
  C:\Windows\System\BtLJNIK.exe
  2⤵
  PID:7420
- C:\Windows\System\zApsMFI.exe
  C:\Windows\System\zApsMFI.exe
  2⤵
  PID:7304
- C:\Windows\System\rGiQklt.exe
  C:\Windows\System\rGiQklt.exe
  2⤵
  PID:7372
- C:\Windows\System\KWwrydi.exe
  C:\Windows\System\KWwrydi.exe
  2⤵
  PID:7520
- C:\Windows\System\lzHSnoy.exe
  C:\Windows\System\lzHSnoy.exe
  2⤵
  PID:7300
- C:\Windows\System\prkVwnx.exe
  C:\Windows\System\prkVwnx.exe
  2⤵
  PID:7500
- C:\Windows\System\nulncve.exe
  C:\Windows\System\nulncve.exe
  2⤵
  PID:7540
- C:\Windows\System\ArXHdAY.exe
  C:\Windows\System\ArXHdAY.exe
  2⤵
  PID:7580
- C:\Windows\System\FUEhLXd.exe
  C:\Windows\System\FUEhLXd.exe
  2⤵
  PID:7560
- C:\Windows\System\GSSuGHl.exe
  C:\Windows\System\GSSuGHl.exe
  2⤵
  PID:7620
- C:\Windows\System\XTuTQqD.exe
  C:\Windows\System\XTuTQqD.exe
  2⤵
  PID:7636
- C:\Windows\System\zxHKAno.exe
  C:\Windows\System\zxHKAno.exe
  2⤵
  PID:7656
- C:\Windows\System\HQbomiX.exe
  C:\Windows\System\HQbomiX.exe
  2⤵
  PID:7724
- C:\Windows\System\rQybwOr.exe
  C:\Windows\System\rQybwOr.exe
  2⤵
  PID:7764
- C:\Windows\System\FhqfNbH.exe
  C:\Windows\System\FhqfNbH.exe
  2⤵
  PID:7668
- C:\Windows\System\aFAtKHW.exe
  C:\Windows\System\aFAtKHW.exe
  2⤵
  PID:7772
- C:\Windows\System\MPmyTih.exe
  C:\Windows\System\MPmyTih.exe
  2⤵
  PID:7836
- C:\Windows\System\bTtVrCk.exe
  C:\Windows\System\bTtVrCk.exe
  2⤵
  PID:7880
- C:\Windows\System\SqJVsPY.exe
  C:\Windows\System\SqJVsPY.exe
  2⤵
  PID:7784
- C:\Windows\System\BwmCUSJ.exe
  C:\Windows\System\BwmCUSJ.exe
  2⤵
  PID:7848
- C:\Windows\System\epKANtq.exe
  C:\Windows\System\epKANtq.exe
  2⤵
  PID:7900
- C:\Windows\System\vSGbbaV.exe
  C:\Windows\System\vSGbbaV.exe
  2⤵
  PID:7968
- C:\Windows\System\ymPGTsX.exe
  C:\Windows\System\ymPGTsX.exe
  2⤵
  PID:7976
- C:\Windows\System\myZrpru.exe
  C:\Windows\System\myZrpru.exe
  2⤵
  PID:7996
- C:\Windows\System\ipoYIUA.exe
  C:\Windows\System\ipoYIUA.exe
  2⤵
  PID:8012
- C:\Windows\System\eHtEdQV.exe
  C:\Windows\System\eHtEdQV.exe
  2⤵
  PID:8032
- C:\Windows\System\UTBIwZA.exe
  C:\Windows\System\UTBIwZA.exe
  2⤵
  PID:8052
- C:\Windows\System\NiFIwAs.exe
  C:\Windows\System\NiFIwAs.exe
  2⤵
  PID:8068
- C:\Windows\System\qmhYBlb.exe
  C:\Windows\System\qmhYBlb.exe
  2⤵
  PID:8076
- C:\Windows\System\DcZosaT.exe
  C:\Windows\System\DcZosaT.exe
  2⤵
  PID:6848
- C:\Windows\System\sjDxelO.exe
  C:\Windows\System\sjDxelO.exe
  2⤵
  PID:8112
- C:\Windows\System\VWXokSz.exe
  C:\Windows\System\VWXokSz.exe
  2⤵
  PID:8156
- C:\Windows\System\cromobu.exe
  C:\Windows\System\cromobu.exe
  2⤵
  PID:6260
- C:\Windows\System\fDmyeEL.exe
  C:\Windows\System\fDmyeEL.exe
  2⤵
  PID:7224
- C:\Windows\System\qgpoMzm.exe
  C:\Windows\System\qgpoMzm.exe
  2⤵
  PID:7208
- C:\Windows\System\UHyyGfm.exe
  C:\Windows\System\UHyyGfm.exe
  2⤵
  PID:7268
- C:\Windows\System\JXYpmgG.exe
  C:\Windows\System\JXYpmgG.exe
  2⤵
  PID:7336
- C:\Windows\System\jSaBuqf.exe
  C:\Windows\System\jSaBuqf.exe
  2⤵
  PID:7536
- C:\Windows\System\eEmdCbh.exe
  C:\Windows\System\eEmdCbh.exe
  2⤵
  PID:7640
- C:\Windows\System\XepbSKn.exe
  C:\Windows\System\XepbSKn.exe
  2⤵
  PID:7508
- C:\Windows\System\MyPmjmR.exe
  C:\Windows\System\MyPmjmR.exe
  2⤵
  PID:7688
- C:\Windows\System\kVPTzzF.exe
  C:\Windows\System\kVPTzzF.exe
  2⤵
  PID:7760
- C:\Windows\System\kYMSUvS.exe
  C:\Windows\System\kYMSUvS.exe
  2⤵
  PID:7912
- C:\Windows\System\qDeeypr.exe
  C:\Windows\System\qDeeypr.exe
  2⤵
  PID:7856
- C:\Windows\System\XtMoLkq.exe
  C:\Windows\System\XtMoLkq.exe
  2⤵
  PID:8008
- C:\Windows\System\LXUhQPy.exe
  C:\Windows\System\LXUhQPy.exe
  2⤵
  PID:8108
- C:\Windows\System\dDirGlP.exe
  C:\Windows\System\dDirGlP.exe
  2⤵
  PID:8164
- C:\Windows\System\cWizhzB.exe
  C:\Windows\System\cWizhzB.exe
  2⤵
  PID:7484
- C:\Windows\System\FnTTRgE.exe
  C:\Windows\System\FnTTRgE.exe
  2⤵
  PID:7316
- C:\Windows\System\HpQetxW.exe
  C:\Windows\System\HpQetxW.exe
  2⤵
  PID:6940
- C:\Windows\System\IkHztYP.exe
  C:\Windows\System\IkHztYP.exe
  2⤵
  PID:7820
- C:\Windows\System\dsgZLXx.exe
  C:\Windows\System\dsgZLXx.exe
  2⤵
  PID:7744
- C:\Windows\System\SojweMZ.exe
  C:\Windows\System\SojweMZ.exe
  2⤵
  PID:7984
- C:\Windows\System\VtqOexZ.exe
  C:\Windows\System\VtqOexZ.exe
  2⤵
  PID:8084
- C:\Windows\System\kOqvaTn.exe
  C:\Windows\System\kOqvaTn.exe
  2⤵
  PID:8160
- C:\Windows\System\oRPesGM.exe
  C:\Windows\System\oRPesGM.exe
  2⤵
  PID:1012
- C:\Windows\System\qnmtGHl.exe
  C:\Windows\System\qnmtGHl.exe
  2⤵
  PID:7644
- C:\Windows\System\FCskRnF.exe
  C:\Windows\System\FCskRnF.exe
  2⤵
  PID:7272
- C:\Windows\System\JnoiLNX.exe
  C:\Windows\System\JnoiLNX.exe
  2⤵
  PID:6724
- C:\Windows\System\TGqYqYI.exe
  C:\Windows\System\TGqYqYI.exe
  2⤵
  PID:7652
- C:\Windows\System\XgrBQYr.exe
  C:\Windows\System\XgrBQYr.exe
  2⤵
  PID:7692
- C:\Windows\System\WqdHaGM.exe
  C:\Windows\System\WqdHaGM.exe
  2⤵
  PID:7348
- C:\Windows\System\ogMeajq.exe
  C:\Windows\System\ogMeajq.exe
  2⤵
  PID:7876
- C:\Windows\System\TwxswYl.exe
  C:\Windows\System\TwxswYl.exe
  2⤵
  PID:7932
- C:\Windows\System\nWxMGpc.exe
  C:\Windows\System\nWxMGpc.exe
  2⤵
  PID:7948
- C:\Windows\System\PaVHZjg.exe
  C:\Windows\System\PaVHZjg.exe
  2⤵
  PID:7768
- C:\Windows\System\efyAUGC.exe
  C:\Windows\System\efyAUGC.exe
  2⤵
  PID:8140
- C:\Windows\System\RAzxrHU.exe
  C:\Windows\System\RAzxrHU.exe
  2⤵
  PID:8196
- C:\Windows\System\wVyYWPR.exe
  C:\Windows\System\wVyYWPR.exe
  2⤵
  PID:8216
- C:\Windows\System\trNzDPJ.exe
  C:\Windows\System\trNzDPJ.exe
  2⤵
  PID:8232
- C:\Windows\System\blFVhXw.exe
  C:\Windows\System\blFVhXw.exe
  2⤵
  PID:8248
- C:\Windows\System\gtNRhto.exe
  C:\Windows\System\gtNRhto.exe
  2⤵
  PID:8324
- C:\Windows\System\JVRlIJV.exe
  C:\Windows\System\JVRlIJV.exe
  2⤵
  PID:8340
- C:\Windows\System\OkcDEaD.exe
  C:\Windows\System\OkcDEaD.exe
  2⤵
  PID:8356
- C:\Windows\System\ISmNEBI.exe
  C:\Windows\System\ISmNEBI.exe
  2⤵
  PID:8376
- C:\Windows\System\PALwIbK.exe
  C:\Windows\System\PALwIbK.exe
  2⤵
  PID:8392
- C:\Windows\System\jhUfOhf.exe
  C:\Windows\System\jhUfOhf.exe
  2⤵
  PID:8408
- C:\Windows\System\gZjncgG.exe
  C:\Windows\System\gZjncgG.exe
  2⤵
  PID:8424
- C:\Windows\System\qTvQZOy.exe
  C:\Windows\System\qTvQZOy.exe
  2⤵
  PID:8440
- C:\Windows\System\ssmilJJ.exe
  C:\Windows\System\ssmilJJ.exe
  2⤵
  PID:8456
- C:\Windows\System\wvKwVLP.exe
  C:\Windows\System\wvKwVLP.exe
  2⤵
  PID:8472
- C:\Windows\System\TYNLvhT.exe
  C:\Windows\System\TYNLvhT.exe
  2⤵
  PID:8488
- C:\Windows\System\lkBsrMw.exe
  C:\Windows\System\lkBsrMw.exe
  2⤵
  PID:8508
- C:\Windows\System\BeHmqUL.exe
  C:\Windows\System\BeHmqUL.exe
  2⤵
  PID:8564
- C:\Windows\System\HqEQJgO.exe
  C:\Windows\System\HqEQJgO.exe
  2⤵
  PID:8580
- C:\Windows\System\qNhpDlC.exe
  C:\Windows\System\qNhpDlC.exe
  2⤵
  PID:8600
- C:\Windows\System\ugYCjfB.exe
  C:\Windows\System\ugYCjfB.exe
  2⤵
  PID:8624
- C:\Windows\System\gJiSuim.exe
  C:\Windows\System\gJiSuim.exe
  2⤵
  PID:8640
- C:\Windows\System\xmQzybR.exe
  C:\Windows\System\xmQzybR.exe
  2⤵
  PID:8660
- C:\Windows\System\SKMhrIH.exe
  C:\Windows\System\SKMhrIH.exe
  2⤵
  PID:8676
- C:\Windows\System\YZthavf.exe
  C:\Windows\System\YZthavf.exe
  2⤵
  PID:8692
- C:\Windows\System\ZDCcKim.exe
  C:\Windows\System\ZDCcKim.exe
  2⤵
  PID:8712
- C:\Windows\System\tfGCnAK.exe
  C:\Windows\System\tfGCnAK.exe
  2⤵
  PID:8728
- C:\Windows\System\ZWNstoc.exe
  C:\Windows\System\ZWNstoc.exe
  2⤵
  PID:8744
- C:\Windows\System\lecrMCo.exe
  C:\Windows\System\lecrMCo.exe
  2⤵
  PID:8760
- C:\Windows\System\gSnqbiC.exe
  C:\Windows\System\gSnqbiC.exe
  2⤵
  PID:8776
- C:\Windows\System\zYzBcmu.exe
  C:\Windows\System\zYzBcmu.exe
  2⤵
  PID:8796
- C:\Windows\System\hfApKRn.exe
  C:\Windows\System\hfApKRn.exe
  2⤵
  PID:8812
- C:\Windows\System\XHXYsPK.exe
  C:\Windows\System\XHXYsPK.exe
  2⤵
  PID:8828
- C:\Windows\System\ACevybm.exe
  C:\Windows\System\ACevybm.exe
  2⤵
  PID:8848
- C:\Windows\System\ocXpGUW.exe
  C:\Windows\System\ocXpGUW.exe
  2⤵
  PID:8864
- C:\Windows\System\hiNnfze.exe
  C:\Windows\System\hiNnfze.exe
  2⤵
  PID:8880
- C:\Windows\System\tKxxrOP.exe
  C:\Windows\System\tKxxrOP.exe
  2⤵
  PID:8896
- C:\Windows\System\VKtShGu.exe
  C:\Windows\System\VKtShGu.exe
  2⤵
  PID:8916
- C:\Windows\System\gKIfpLd.exe
  C:\Windows\System\gKIfpLd.exe
  2⤵
  PID:8932
- C:\Windows\System\AbldLjk.exe
  C:\Windows\System\AbldLjk.exe
  2⤵
  PID:8952
- C:\Windows\System\ZbgIxOE.exe
  C:\Windows\System\ZbgIxOE.exe
  2⤵
  PID:8968
- C:\Windows\System\pcpKlgF.exe
  C:\Windows\System\pcpKlgF.exe
  2⤵
  PID:8984
- C:\Windows\System\dsbAmSe.exe
  C:\Windows\System\dsbAmSe.exe
  2⤵
  PID:9004
- C:\Windows\System\KWEnMoK.exe
  C:\Windows\System\KWEnMoK.exe
  2⤵
  PID:9020
- C:\Windows\System\LGRvsGZ.exe
  C:\Windows\System\LGRvsGZ.exe
  2⤵
  PID:9036
- C:\Windows\System\GldmmqO.exe
  C:\Windows\System\GldmmqO.exe
  2⤵
  PID:9056
- C:\Windows\System\lwRpRnw.exe
  C:\Windows\System\lwRpRnw.exe
  2⤵
  PID:9072
- C:\Windows\System\VgnIoup.exe
  C:\Windows\System\VgnIoup.exe
  2⤵
  PID:9088
- C:\Windows\System\RvOKvMO.exe
  C:\Windows\System\RvOKvMO.exe
  2⤵
  PID:9104
- C:\Windows\System\uaitjjV.exe
  C:\Windows\System\uaitjjV.exe
  2⤵
  PID:9120
- C:\Windows\System\kgmznYL.exe
  C:\Windows\System\kgmznYL.exe
  2⤵
  PID:9136
- C:\Windows\System\RJaTcqg.exe
  C:\Windows\System\RJaTcqg.exe
  2⤵
  PID:8028
- C:\Windows\System\oOChGBZ.exe
  C:\Windows\System\oOChGBZ.exe
  2⤵
  PID:7980
- C:\Windows\System\Muyqgcl.exe
  C:\Windows\System\Muyqgcl.exe
  2⤵
  PID:8212
- C:\Windows\System\oHtGBlT.exe
  C:\Windows\System\oHtGBlT.exe
  2⤵
  PID:8124
- C:\Windows\System\OlTPkId.exe
  C:\Windows\System\OlTPkId.exe
  2⤵
  PID:7456
- C:\Windows\System\qRsSFoL.exe
  C:\Windows\System\qRsSFoL.exe
  2⤵
  PID:7832
- C:\Windows\System\mZGqJeu.exe
  C:\Windows\System\mZGqJeu.exe
  2⤵
  PID:8276
- C:\Windows\System\kXnIyqS.exe
  C:\Windows\System\kXnIyqS.exe
  2⤵
  PID:8292
- C:\Windows\System\IrQEDcN.exe
  C:\Windows\System\IrQEDcN.exe
  2⤵
  PID:8308
- C:\Windows\System\GdnoCeO.exe
  C:\Windows\System\GdnoCeO.exe
  2⤵
  PID:8332
- C:\Windows\System\uIWrcJG.exe
  C:\Windows\System\uIWrcJG.exe
  2⤵
  PID:8372
- C:\Windows\System\fhrfsRX.exe
  C:\Windows\System\fhrfsRX.exe
  2⤵
  PID:8352
- C:\Windows\System\fGyhRLw.exe
  C:\Windows\System\fGyhRLw.exe
  2⤵
  PID:8436
- C:\Windows\System\pNuQzli.exe
  C:\Windows\System\pNuQzli.exe
  2⤵
  PID:8500
- C:\Windows\System\OXhixgy.exe
  C:\Windows\System\OXhixgy.exe
  2⤵
  PID:8448
- C:\Windows\System\rOmTmYD.exe
  C:\Windows\System\rOmTmYD.exe
  2⤵
  PID:8520
- C:\Windows\System\kUNJOmP.exe
  C:\Windows\System\kUNJOmP.exe
  2⤵
  PID:8524
- C:\Windows\System\ZyMameL.exe
  C:\Windows\System\ZyMameL.exe
  2⤵
  PID:8532
- C:\Windows\System\QyVkXAv.exe
  C:\Windows\System\QyVkXAv.exe
  2⤵
  PID:8572
- C:\Windows\System\ogBLOWe.exe
  C:\Windows\System\ogBLOWe.exe
  2⤵
  PID:8596
- C:\Windows\System\mOTMwnM.exe
  C:\Windows\System\mOTMwnM.exe
  2⤵
  PID:8648
- C:\Windows\System\WMjdaVn.exe
  C:\Windows\System\WMjdaVn.exe
  2⤵
  PID:8688
- C:\Windows\System\JwGaHWB.exe
  C:\Windows\System\JwGaHWB.exe
  2⤵
  PID:8756
- C:\Windows\System\aSmKYtL.exe
  C:\Windows\System\aSmKYtL.exe
  2⤵
  PID:8708
- C:\Windows\System\mTzRIRX.exe
  C:\Windows\System\mTzRIRX.exe
  2⤵
  PID:8736
- C:\Windows\System\RPIoVBm.exe
  C:\Windows\System\RPIoVBm.exe
  2⤵
  PID:8840
- C:\Windows\System\yvOgrJs.exe
  C:\Windows\System\yvOgrJs.exe
  2⤵
  PID:8768
- C:\Windows\System\VlORjEn.exe
  C:\Windows\System\VlORjEn.exe
  2⤵
  PID:9064
- C:\Windows\System\YJGxdFi.exe
  C:\Windows\System\YJGxdFi.exe
  2⤵
  PID:8824
- C:\Windows\System\UBWPATf.exe
  C:\Windows\System\UBWPATf.exe
  2⤵
  PID:9132
- C:\Windows\System\HQeObFq.exe
  C:\Windows\System\HQeObFq.exe
  2⤵
  PID:8928
- C:\Windows\System\RiHNTcW.exe
  C:\Windows\System\RiHNTcW.exe
  2⤵
  PID:9028
- C:\Windows\System\GxTtSQk.exe
  C:\Windows\System\GxTtSQk.exe
  2⤵
  PID:9112
- C:\Windows\System\NTIlIRb.exe
  C:\Windows\System\NTIlIRb.exe
  2⤵
  PID:7672
- C:\Windows\System\KQnjJIu.exe
  C:\Windows\System\KQnjJIu.exe
  2⤵
  PID:7440
- C:\Windows\System\jaLltpz.exe
  C:\Windows\System\jaLltpz.exe
  2⤵
  PID:8804
- C:\Windows\System\zJgmein.exe
  C:\Windows\System\zJgmein.exe
  2⤵
  PID:8904
- C:\Windows\System\hvxzGHQ.exe
  C:\Windows\System\hvxzGHQ.exe
  2⤵
  PID:8048
- C:\Windows\System\XlNrxQM.exe
  C:\Windows\System\XlNrxQM.exe
  2⤵
  PID:7192
- C:\Windows\System\IDhZwpp.exe
  C:\Windows\System\IDhZwpp.exe
  2⤵
  PID:8480
- C:\Windows\System\KxjWuyh.exe
  C:\Windows\System\KxjWuyh.exe
  2⤵
  PID:8496
- C:\Windows\System\wIVIGzO.exe
  C:\Windows\System\wIVIGzO.exe
  2⤵
  PID:8208
- C:\Windows\System\sBsAAYd.exe
  C:\Windows\System\sBsAAYd.exe
  2⤵
  PID:9080
- C:\Windows\System\APKyAkb.exe
  C:\Windows\System\APKyAkb.exe
  2⤵
  PID:8304
- C:\Windows\System\UBLMxsz.exe
  C:\Windows\System\UBLMxsz.exe
  2⤵
  PID:8384
- C:\Windows\System\sDjdOMS.exe
  C:\Windows\System\sDjdOMS.exe
  2⤵
  PID:7616
- C:\Windows\System\eedjJzc.exe
  C:\Windows\System\eedjJzc.exe
  2⤵
  PID:8560
- C:\Windows\System\Pykmgiu.exe
  C:\Windows\System\Pykmgiu.exe
  2⤵
  PID:8724
- C:\Windows\System\AsSsRca.exe
  C:\Windows\System\AsSsRca.exe
  2⤵
  PID:8788
- C:\Windows\System\yJQTJRv.exe
  C:\Windows\System\yJQTJRv.exe
  2⤵
  PID:8060
- C:\Windows\System\DZjlCcF.exe
  C:\Windows\System\DZjlCcF.exe
  2⤵
  PID:9148
- C:\Windows\System\JQrOTMn.exe
  C:\Windows\System\JQrOTMn.exe
  2⤵
  PID:8684
- C:\Windows\System\QAVtoon.exe
  C:\Windows\System\QAVtoon.exe
  2⤵
  PID:8844
- C:\Windows\System\GhOxlni.exe
  C:\Windows\System\GhOxlni.exe
  2⤵
  PID:9096
- C:\Windows\System\yjAgJLd.exe
  C:\Windows\System\yjAgJLd.exe
  2⤵
  PID:7220
- C:\Windows\System\efcjDJu.exe
  C:\Windows\System\efcjDJu.exe
  2⤵
  PID:8096
- C:\Windows\System\bwrSMJH.exe
  C:\Windows\System\bwrSMJH.exe
  2⤵
  PID:8320
- C:\Windows\System\onMfeXT.exe
  C:\Windows\System\onMfeXT.exe
  2⤵
  PID:8544
- C:\Windows\System\oXOXhfy.exe
  C:\Windows\System\oXOXhfy.exe
  2⤵
  PID:9184
- C:\Windows\System\geZVtRS.exe
  C:\Windows\System\geZVtRS.exe
  2⤵
  PID:7676
- C:\Windows\System\XqjWRVX.exe
  C:\Windows\System\XqjWRVX.exe
  2⤵
  PID:9208
- C:\Windows\System\yeJfXKl.exe
  C:\Windows\System\yeJfXKl.exe
  2⤵
  PID:9044
- C:\Windows\System\ZRPkSqm.exe
  C:\Windows\System\ZRPkSqm.exe
  2⤵
  PID:8980
- C:\Windows\System\vVNSWFQ.exe
  C:\Windows\System\vVNSWFQ.exe
  2⤵
  PID:8268
- C:\Windows\System\yCKaZvV.exe
  C:\Windows\System\yCKaZvV.exe
  2⤵
  PID:8416
- C:\Windows\System\NMidjug.exe
  C:\Windows\System\NMidjug.exe
  2⤵
  PID:8272
- C:\Windows\System\cbKvxMA.exe
  C:\Windows\System\cbKvxMA.exe
  2⤵
  PID:8556
- C:\Windows\System\IRAhsXx.exe
  C:\Windows\System\IRAhsXx.exe
  2⤵
  PID:8892
- C:\Windows\System\nDwKpXP.exe
  C:\Windows\System\nDwKpXP.exe
  2⤵
  PID:7172
- C:\Windows\System\WGUmmMS.exe
  C:\Windows\System\WGUmmMS.exe
  2⤵
  PID:8656
- C:\Windows\System\crtKzog.exe
  C:\Windows\System\crtKzog.exe
  2⤵
  PID:8964
- C:\Windows\System\dJkuBBU.exe
  C:\Windows\System\dJkuBBU.exe
  2⤵
  PID:9128
- C:\Windows\System\sIWIwOk.exe
  C:\Windows\System\sIWIwOk.exe
  2⤵
  PID:8484
- C:\Windows\System\ujxESpH.exe
  C:\Windows\System\ujxESpH.exe
  2⤵
  PID:8288
- C:\Windows\System\SfXoOvm.exe
  C:\Windows\System\SfXoOvm.exe
  2⤵
  PID:9012
- C:\Windows\System\dBXffab.exe
  C:\Windows\System\dBXffab.exe
  2⤵
  PID:9196
- C:\Windows\System\HrMNSkD.exe
  C:\Windows\System\HrMNSkD.exe
  2⤵
  PID:8612
- C:\Windows\System\YNsGote.exe
  C:\Windows\System\YNsGote.exe
  2⤵
  PID:8516
- C:\Windows\System\QsVFWaa.exe
  C:\Windows\System\QsVFWaa.exe
  2⤵
  PID:8704
- C:\Windows\System\mzXetqx.exe
  C:\Windows\System\mzXetqx.exe
  2⤵
  PID:9188
- C:\Windows\System\RzcBSdN.exe
  C:\Windows\System\RzcBSdN.exe
  2⤵
  PID:9032
- C:\Windows\System\tISOnco.exe
  C:\Windows\System\tISOnco.exe
  2⤵
  PID:9204
- C:\Windows\System\kfdITwN.exe
  C:\Windows\System\kfdITwN.exe
  2⤵
  PID:8592
- C:\Windows\System\scMsYnQ.exe
  C:\Windows\System\scMsYnQ.exe
  2⤵
  PID:8368
- C:\Windows\System\SrfFmaM.exe
  C:\Windows\System\SrfFmaM.exe
  2⤵
  PID:9200
- C:\Windows\System\HqVRaje.exe
  C:\Windows\System\HqVRaje.exe
  2⤵
  PID:9232
- C:\Windows\System\oWviPUp.exe
  C:\Windows\System\oWviPUp.exe
  2⤵
  PID:9248
- C:\Windows\System\VeyHczC.exe
  C:\Windows\System\VeyHczC.exe
  2⤵
  PID:9264
- C:\Windows\System\uAymQpI.exe
  C:\Windows\System\uAymQpI.exe
  2⤵
  PID:9280
- C:\Windows\System\TBInNAU.exe
  C:\Windows\System\TBInNAU.exe
  2⤵
  PID:9396
- C:\Windows\System\ZtPLLTW.exe
  C:\Windows\System\ZtPLLTW.exe
  2⤵
  PID:9412
- C:\Windows\System\pUIshQn.exe
  C:\Windows\System\pUIshQn.exe
  2⤵
  PID:9464
- C:\Windows\System\YpIftzQ.exe
  C:\Windows\System\YpIftzQ.exe
  2⤵
  PID:9484
- C:\Windows\System\IiYgboN.exe
  C:\Windows\System\IiYgboN.exe
  2⤵
  PID:9500
- C:\Windows\System\gFEEIaK.exe
  C:\Windows\System\gFEEIaK.exe
  2⤵
  PID:9516
- C:\Windows\System\kOoKvep.exe
  C:\Windows\System\kOoKvep.exe
  2⤵
  PID:9532
- C:\Windows\System\QngHVnT.exe
  C:\Windows\System\QngHVnT.exe
  2⤵
  PID:9548
- C:\Windows\System\qTnmgyH.exe
  C:\Windows\System\qTnmgyH.exe
  2⤵
  PID:9568
- C:\Windows\System\cPSfeax.exe
  C:\Windows\System\cPSfeax.exe
  2⤵
  PID:9584
- C:\Windows\System\GONigTe.exe
  C:\Windows\System\GONigTe.exe
  2⤵
  PID:9604
- C:\Windows\System\FziksuD.exe
  C:\Windows\System\FziksuD.exe
  2⤵
  PID:9700
- C:\Windows\System\xMuhDwZ.exe
  C:\Windows\System\xMuhDwZ.exe
  2⤵
  PID:9720
- C:\Windows\System\kqgJclv.exe
  C:\Windows\System\kqgJclv.exe
  2⤵
  PID:9736
- C:\Windows\System\MUYASzL.exe
  C:\Windows\System\MUYASzL.exe
  2⤵
  PID:9752
- C:\Windows\System\JBVGIws.exe
  C:\Windows\System\JBVGIws.exe
  2⤵
  PID:9772
- C:\Windows\System\qbRMYjK.exe
  C:\Windows\System\qbRMYjK.exe
  2⤵
  PID:9788
- C:\Windows\System\HJLfTPq.exe
  C:\Windows\System\HJLfTPq.exe
  2⤵
  PID:9812
- C:\Windows\System\vwRicGS.exe
  C:\Windows\System\vwRicGS.exe
  2⤵
  PID:9828
- C:\Windows\System\CvsghEh.exe
  C:\Windows\System\CvsghEh.exe
  2⤵
  PID:9844
- C:\Windows\System\hNTrlsZ.exe
  C:\Windows\System\hNTrlsZ.exe
  2⤵
  PID:9860
- C:\Windows\System\mPQGQOq.exe
  C:\Windows\System\mPQGQOq.exe
  2⤵
  PID:9880
- C:\Windows\System\unlzHRs.exe
  C:\Windows\System\unlzHRs.exe
  2⤵
  PID:9900
- C:\Windows\System\SEbnStE.exe
  C:\Windows\System\SEbnStE.exe
  2⤵
  PID:9916
- C:\Windows\System\NSeMuwE.exe
  C:\Windows\System\NSeMuwE.exe
  2⤵
  PID:9936
- C:\Windows\System\VITBqHP.exe
  C:\Windows\System\VITBqHP.exe
  2⤵
  PID:9956
- C:\Windows\System\RzuBpVx.exe
  C:\Windows\System\RzuBpVx.exe
  2⤵
  PID:9972
- C:\Windows\System\cxBZvYh.exe
  C:\Windows\System\cxBZvYh.exe
  2⤵
  PID:9988
- C:\Windows\System\gTgkeWm.exe
  C:\Windows\System\gTgkeWm.exe
  2⤵
  PID:10008
- C:\Windows\System\lIJRVNe.exe
  C:\Windows\System\lIJRVNe.exe
  2⤵
  PID:10024
- C:\Windows\System\TByAXZA.exe
  C:\Windows\System\TByAXZA.exe
  2⤵
  PID:10144
- C:\Windows\System\nHyFZRa.exe
  C:\Windows\System\nHyFZRa.exe
  2⤵
  PID:10168
- C:\Windows\System\zVxtwbr.exe
  C:\Windows\System\zVxtwbr.exe
  2⤵
  PID:10184
- C:\Windows\System\zlPwaam.exe
  C:\Windows\System\zlPwaam.exe
  2⤵
  PID:10200
- C:\Windows\System\JnNMhPt.exe
  C:\Windows\System\JnNMhPt.exe
  2⤵
  PID:10216
- C:\Windows\System\qlftkiE.exe
  C:\Windows\System\qlftkiE.exe
  2⤵
  PID:9224
- C:\Windows\System\YFCDtmi.exe
  C:\Windows\System\YFCDtmi.exe
  2⤵
  PID:9228
- C:\Windows\System\eKTBqxF.exe
  C:\Windows\System\eKTBqxF.exe
  2⤵
  PID:9000
- C:\Windows\System\ZASevzp.exe
  C:\Windows\System\ZASevzp.exe
  2⤵
  PID:9256
- C:\Windows\System\NxIgrwa.exe
  C:\Windows\System\NxIgrwa.exe
  2⤵
  PID:9272
- C:\Windows\System\ZfkMfQQ.exe
  C:\Windows\System\ZfkMfQQ.exe
  2⤵
  PID:9296
- C:\Windows\System\tMsgpOr.exe
  C:\Windows\System\tMsgpOr.exe
  2⤵
  PID:9316
- C:\Windows\System\zVxjjMV.exe
  C:\Windows\System\zVxjjMV.exe
  2⤵
  PID:9332
- C:\Windows\System\khCPowE.exe
  C:\Windows\System\khCPowE.exe
  2⤵
  PID:9352
- C:\Windows\System\TnKGdad.exe
  C:\Windows\System\TnKGdad.exe
  2⤵
  PID:9368
- C:\Windows\System\zizRydE.exe
  C:\Windows\System\zizRydE.exe
  2⤵
  PID:9420
- C:\Windows\System\rHOmvSN.exe
  C:\Windows\System\rHOmvSN.exe
  2⤵
  PID:9452
- C:\Windows\System\aAHmdHz.exe
  C:\Windows\System\aAHmdHz.exe
  2⤵
  PID:9164
- C:\Windows\System\QzzLija.exe
  C:\Windows\System\QzzLija.exe
  2⤵
  PID:9524
- C:\Windows\System\paulnzZ.exe
  C:\Windows\System\paulnzZ.exe
  2⤵
  PID:9560
- C:\Windows\System\mqvrNZM.exe
  C:\Windows\System\mqvrNZM.exe
  2⤵
  PID:9600
- C:\Windows\System\gbbZZvd.exe
  C:\Windows\System\gbbZZvd.exe
  2⤵
  PID:9512
- C:\Windows\System\LWfULvk.exe
  C:\Windows\System\LWfULvk.exe
  2⤵
  PID:9612
- C:\Windows\System\lDdXwPv.exe
  C:\Windows\System\lDdXwPv.exe
  2⤵
  PID:9632
- C:\Windows\System\pMaeqah.exe
  C:\Windows\System\pMaeqah.exe
  2⤵
  PID:9648
- C:\Windows\System\YXyjyMt.exe
  C:\Windows\System\YXyjyMt.exe
  2⤵
  PID:9664
- C:\Windows\System\nLodlnB.exe
  C:\Windows\System\nLodlnB.exe
  2⤵
  PID:9688
- C:\Windows\System\JIbkyay.exe
  C:\Windows\System\JIbkyay.exe
  2⤵
  PID:9672
- C:\Windows\System\TOOgWLj.exe
  C:\Windows\System\TOOgWLj.exe
  2⤵
  PID:9716
- C:\Windows\System\WYcEvWA.exe
  C:\Windows\System\WYcEvWA.exe
  2⤵
  PID:9764
- C:\Windows\System\toAaIqk.exe
  C:\Windows\System\toAaIqk.exe
  2⤵
  PID:9780
- C:\Windows\System\ulEUjmm.exe
  C:\Windows\System\ulEUjmm.exe
  2⤵
  PID:9840
- C:\Windows\System\Biaffno.exe
  C:\Windows\System\Biaffno.exe
  2⤵
  PID:9888
- C:\Windows\System\hpfupVX.exe
  C:\Windows\System\hpfupVX.exe
  2⤵
  PID:9868
- C:\Windows\System\XsTVJOq.exe
  C:\Windows\System\XsTVJOq.exe
  2⤵
  PID:9912
- C:\Windows\System\brBaFXf.exe
  C:\Windows\System\brBaFXf.exe
  2⤵
  PID:9952
- C:\Windows\System\ftOyLbo.exe
  C:\Windows\System\ftOyLbo.exe
  2⤵
  PID:9980
- C:\Windows\System\lREWnDp.exe
  C:\Windows\System\lREWnDp.exe
  2⤵
  PID:9996
- C:\Windows\System\LKzpBWW.exe
  C:\Windows\System\LKzpBWW.exe
  2⤵
  PID:10016
- C:\Windows\System\OvSNSTP.exe
  C:\Windows\System\OvSNSTP.exe
  2⤵
  PID:10044
- C:\Windows\System\uCVcmpr.exe
  C:\Windows\System\uCVcmpr.exe
  2⤵
  PID:10052
- C:\Windows\System\dXIxZSz.exe
  C:\Windows\System\dXIxZSz.exe
  2⤵
  PID:10084
- C:\Windows\System\kBliQzs.exe
  C:\Windows\System\kBliQzs.exe
  2⤵
  PID:10092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AAaBKZZ.exe

Filesize
1.4MB

MD5
06aa588e6767baa98e5aa62d908d467f

SHA1
bdb4b41d9783a6185099cdd8b6efa3b8b5bc1bde

SHA256
791c6662f9adb512496b9e85000c1b3789f0330433b685e966338730e22dbb5a

SHA512
4291713a39a6eb7d35790e439899424617e4aaa3dc872c0b8e3b30f976414446efa635f46dc34bd56250f9bdedb90dacee99aaff961b55f28901d7aa34a0e0ca

Download Submit
C:\Windows\system\AKTObEz.exe

Filesize
1.4MB

MD5
59a1c07e98c29d947438ac971e7ca0d0

SHA1
7499aec2638f2c1da1a266085e423b5ceef7b812

SHA256
a94b6bdbc2724ea7f0e759cf950ec94648d7642a85aa33bd293afdb356a483e8

SHA512
93a63155ec2e1da01c2d737fb630e9e6023e546bd3559c666bbaa1f3b84aad657ad033702fabacd241fa765c68753853cd29168be138421c1e23116b227c917e

Download Submit
C:\Windows\system\BnDjHWF.exe

Filesize
1.4MB

MD5
54c384271f24f1bbbae05040a03efd74

SHA1
3071a41152d3b2a6497da9ec8de550bf7bfd4c0b

SHA256
6180c81c99a079867b070bbf9c8e675e30b42c6d2bfe57ea8b1064d50d182536

SHA512
18e755e601e4a519f9b896fd6c75838f7ad04bb61c876d9fd0c40bfb69541430f87d66d508cce6d9943d0d0bbf8e596176ecb5bb2115dc04c2f14aa54b8657c9

Download Submit
C:\Windows\system\CYobPCZ.exe

Filesize
1.4MB

MD5
9c16f222a79318d42ba2d53e69cecaa8

SHA1
1f00bf36e5ffca617067fd2d8f684b0478066aa9

SHA256
b8e19c8dfc11cdb73e988114d05ff20cf2ca5dbf256618d436ade30fb9c329c5

SHA512
21b869615eee165d30e250bd98e1c2ba3207ca23ae4ebae0830b1058032bff57710ce3e3e799bdcb2217180e03ddd5b3ce5a137057da81d4c6615ce76da0dd66

Download Submit
C:\Windows\system\DZKryLi.exe

Filesize
1.4MB

MD5
b35f0586e83f6ff3f71c95af5289d81c

SHA1
ac23cce2014bfbab785aa1bb7ee85bcddcfb1455

SHA256
1b99bc3c4c26a254da254b59840caaf5a4e32e92fe88dbb85cc2fd84327667c9

SHA512
68682258d2a30aab770ccca2ee433562b953ddd4341733863653c18a5083e6bab32b694de619f5ab9e87305d9d1e949db7be6369dc6d5069709f233d2a69e4c5

Download Submit
C:\Windows\system\EUEyGvK.exe

Filesize
1.4MB

MD5
8b9bce9df5cf5f1df3bf2059b28e1ef9

SHA1
d35cc6c82749dec3dfdaf997869a427a5f03f004

SHA256
7352115c1a0d187fd54c844c363b588d687db09646edce51279028143bbb23b8

SHA512
f73cc3731395d611b2c418083efab023516402b9244a457e850f8f4de289ca55f26831a5126fb53f9885cf6f265333fdc8f56f16123c3680d8744bfc31d8245c

Download Submit
C:\Windows\system\JQzBBlr.exe

Filesize
1.4MB

MD5
5351481cae417b614f9d4df5fb06df5a

SHA1
64f92a867c7a5877eeb2516290bd32bbc974f52f

SHA256
b5e3c3f169e461af28f8986c6f98bf104295ad35522af68695d937fda3345150

SHA512
47160573242df837a643a0b3bcd8dc70658f893166a97d5008a242a20eb31b1405240bdcd22e86d0e0ee6db40e46072586f865d1015b3e8985f304c14e1fa7bf

Download Submit
C:\Windows\system\KzSduhq.exe

Filesize
1.4MB

MD5
da8ee545b0b5f08479751ed00b7ea33d

SHA1
d2c6fa1a2a68385eaf98d2fe950f6ed95c57f993

SHA256
6549183341a6dfb329da331ddf508b0c9bb963828e893714590ffd94ba584bb6

SHA512
a28b363de2bcd2d9dc3a1e65452815463327ddf5b2b7c8dce067b93bcd28a6a8529385f07010a321591750e050e73968e6b5c21de9b59719d9e36b294929ada7

Download Submit
C:\Windows\system\MNfFezP.exe

Filesize
1.4MB

MD5
13bc37efc11a5c3afb3962152eb898d1

SHA1
aa77bbdee779c068b81d21bab311200704e31253

SHA256
f6e0fff2e54252276a3cc00f2a748a6eeb8b546e0e157bc7ecd5065e710adc76

SHA512
462deadba9b4e8bebe3a5a0e3f454e9b83f14d5e280b90766f18a8b7da7393884780fddf29aca0c30f53fb662cde95f559ddbeeac45b17677e1d653471ddc1d2

Download Submit
C:\Windows\system\OMWGdom.exe

Filesize
1.4MB

MD5
b355ec9fbc94214d13d3f4193c1d6075

SHA1
ac544bb4423e95ab8bcf660574887c8e2153d4c7

SHA256
cb5b206df82812de2b4604fd1f0f01888046b7f98171d9179de5ae7d18a02782

SHA512
a75c59a5b4bb29075606c1c2a0f5375acc7e124a8f32fd9ecb943399486ca7f99c8887bb1fda3b6038addc18b64a2da76da0c6ecb0e7b971615f75214573ce7d

Download Submit
C:\Windows\system\OzlQHNR.exe

Filesize
1.4MB

MD5
036c7ad71aa7212db27666436a641b75

SHA1
428ffb4c8d3463599ed8b47ca9dcfdf82aa66145

SHA256
f2152a2455fce884c3d2c1fcc7013ce800a5dac8fd7f5e3c407b7bf1fe8f6713

SHA512
ae915900c8976b0f925e9fead3f4137da02e8712656a23a93e503962b85c62f40d4191004aa0723b1a796e3bf41135ee18941438eb03dfe39abc69c70512fa14

Download Submit
C:\Windows\system\PRmzBNk.exe

Filesize
1.4MB

MD5
fe4d9333d781a867139b8500f91f55c9

SHA1
d9fc6d2ab53fa9e82801c5fd27003b0d90d89e21

SHA256
25d8f6d29979d734c7bc721ffb1502f7cb16e623e79d9896099aa1c454c85a60

SHA512
4f071f8ca04af39374e43fb3652a0826fef1d2c4080f104c4d267af9e686066b018911a759cc705c2c80015dbc23cfd4aa4aaf75e49350cd0152f3fd40188ae7

Download Submit
C:\Windows\system\UHzCUHV.exe

Filesize
1.4MB

MD5
01c4c072b3f93717e7864613799269dd

SHA1
ed4cb5fa79b9d1cec9d91f83e40650d7fdeac9ce

SHA256
e3b8223e52f8b99fdef7cb66d9c519c65bcbac1bda4eba2864fe93efcccf1e3e

SHA512
24258a89149c7c9b3bb37ef6d8b5118d53667cbb77b188d765704f49232a8efd5cb8dab78b17861e8a4317af0dc9308b0249c52836a784869ffb667fbdb5a7e0

Download Submit
C:\Windows\system\YlopYrn.exe

Filesize
1.4MB

MD5
7fa7eaa6f7122db3b2d823714454fbdd

SHA1
cc185ccbd6df5ace59fffb33738016ca85139a3d

SHA256
3519c115d93373b4c71c44a2c9f38aea6241a826a40588bb2fe610a526f5b872

SHA512
5f8748907007492624182c5a2496ef70b2a87cf00c44e2c67504481fc4521b36c5cb9ad66c851883ecb2a4a3eb6f4793a61c5dcae356562af8b0c584491d600a

Download Submit
C:\Windows\system\YolbPzK.exe

Filesize
1.4MB

MD5
ddb920374bd97af9eb2aac246393d8f1

SHA1
e5b0e355711cab64d8dd829dfde1137467e4fb79

SHA256
fe021270f3fa66f0544c07074a49eb4e267a89ea730624c7104edbf8f90d6011

SHA512
396ff24574171287208331585370b1a22ec52813df231a495d77e0417c0817bf0abbe93c85b9b076ca165fd5bc6d3ef70fa9db9144232d78896d47904e3cd6a6

Download Submit
C:\Windows\system\bVkBkOe.exe

Filesize
1.4MB

MD5
27ddded734560e256cab4e73356f5506

SHA1
52aefdac3f8d2bb3244b07894a1f39f82faa9f38

SHA256
ad90799394b22c425c2ee42c85e2516fbad0fccee563a5fa6f0e68970888dc29

SHA512
c123f0de898e099b20f83fb5e5941fd1863004fed003acb8a3d543236db6dd6fd3ee5ce038775adb67aeca5b274494f1ef80c4b9b3279be8e2a23b0d779a4242

Download Submit
C:\Windows\system\hTFuKpE.exe

Filesize
1.4MB

MD5
81a794435488c24f94378d98100137fa

SHA1
ef408b6c8c19197193f6f93e3bd4bcd5a7f45d85

SHA256
06e3cfaceaff151e1db5eb2ce7f0b6b9d90f6e756176e5b0241affc4cd4a459c

SHA512
88d868c48b07420d65ca604e9b5cf37556b0bfd6f513b161b4ee946359c8fa2677ff9eee91694febb66171179bf22d17539a6072d3649ff63a0bf96b3329e53e

Download Submit
C:\Windows\system\kzrELDL.exe

Filesize
1.4MB

MD5
964575573735f8c6e60f3817033eac94

SHA1
07e28ea59196bbe33dd960487d4779a70691483d

SHA256
70b651fb2a1fe6abc57c6357ab38e7e7ad8114354dcc990266f167f22acfa337

SHA512
ec9bd9569208570d503c7ee55489e7eccba885ef03181245240b104fb241dc3543f10518337c983f95534ab7daf1d37daac9cf931544534f5eb5a75eb686200c

Download Submit
C:\Windows\system\maMwpgM.exe

Filesize
1.4MB

MD5
daee2c2a42e9b290d1340fe41adc4dd9

SHA1
4414b94246b0ae95194be5c6e331ba8655a515e8

SHA256
874c018b5d313f209ae29f79d55805bc52f64396587cf4867a681fa5b2da4be4

SHA512
d9ae02af1de0779fd96ba7075f6e1e4f770687b4fddd871eeb16a0d271cdb1e0f7eaac3259558366909ca1f4729a396834162e8bbd697714994336d41a190981

Download Submit
C:\Windows\system\mcqgvsf.exe

Filesize
1.4MB

MD5
3f1f9c62abfc7d52ead344e205c8ab97

SHA1
eeeddb635d00ec681aa82a535a69ab753ee8c0de

SHA256
cd7b50ea3d43041a2ab1c2acd86201b1967c52faef215a44611dcd37551da59b

SHA512
bf8b253e79c6d7e53c92ae19c72ec31effdc5c6ad3d1b48a90d5ddf051618eaa7d49f46c04860afe3ce54582d02090a8c43a3e220f78a06a6ffbd0e71e4f8924

Download Submit
C:\Windows\system\qwaRoHD.exe

Filesize
1.4MB

MD5
5aa96e5488a1da4fdf469bf61953ba53

SHA1
002a08c590773900fe6c00ad5e794fc32aeea751

SHA256
9cb7cb46408fce61b0fce036ec0f3c2c50dda64e9db0751db12b63a0857996f0

SHA512
ce379bc31f8fe2e09324f91747b500618a608a3e2fa50c49f87387e71d65b66040d41e4f6981006ce06ddc22a5e3dd49014cc12aa015abe68272c2cd5157390c

Download Submit
C:\Windows\system\rZbRUQq.exe

Filesize
1.4MB

MD5
b2cd1eff14a26e3079a6b2cc99004cd0

SHA1
969ca16d79d6cf554635762cc70dd8b8e0e9c0d2

SHA256
cdc61240e2ea960966dfa1047b306b8d09ba04f1b13a9238bcb57271abe6b09a

SHA512
d8c04db1d64ba4d7f53a4864f201301a3477e0a850e8ddcc9efb66f113ed23b38aed01aef55e99ceb874effb775846044488a787ba6bdddedbd11c8fece5d397

Download Submit
C:\Windows\system\sfXAnIe.exe

Filesize
1.4MB

MD5
1e53093466f7aeebaa511b12e07c7d41

SHA1
72278d49ce2e0a8551ed38ebc1860a190528368d

SHA256
be1c97994950cf855d4fc8bba15001995c4e10b92f8845faabf9bd9178e1448a

SHA512
677de84b70fb0c49912c58dcfba3cafc62c7849864d314ac884f8fbca15264d818923ef7c39a951081d6fa67f827626535b4afafc37691e0f0f252783b5c5d92

Download Submit
C:\Windows\system\stNPlwd.exe

Filesize
1.4MB

MD5
67ea4a30cccfb17e4da7116143c16472

SHA1
e70690703f6d5019525d84c1a4b3edc16cb70218

SHA256
c3ea6c3cf8378dc21ba7b2203f4c4519d25d1d3d4dfb1905eb234695de2f50e4

SHA512
68856a085a9201ede2bf32ab65ad24ddf4a3e26bbfbdb6ac87960cb6c35b7cd99b3013e5ec305989a3e6de942a3d7cceacaeda2f99ace8d42d523f006dbcfeae

Download Submit
C:\Windows\system\vqVKqOD.exe

Filesize
1.4MB

MD5
d8dd2bc3035dccb6db29c7e04eb0dae5

SHA1
bfc494eacfdfceaeb30a258d29384c3c1fc9a15b

SHA256
5b40059ba60f305f0a3ae011751215af47a694884dfb7b0df5ce3f8cce28ae14

SHA512
f8ef77ce185b76c7d68a69499e8f18f3f20ea6c5f2a7d7bf49d51dd9221494169c0f090b601757e4e5ad622058bb8ba7ff2accc787c7ada52762b75ce286d023

Download Submit
C:\Windows\system\wXBLFtL.exe

Filesize
1.4MB

MD5
33764d51b3b8a59f67ded965b9859e10

SHA1
faa6f24c19a511c6aa9835ef419593fcc7acafcc

SHA256
b1d7733e3d7c1c7a7571f227d0d0c25e1adb274092f250c2a945f77dc5c8bd56

SHA512
e17287adb691e41ae38056027ecb473d1a126fae5eaa58a02d24b3422c5d700cecb2a7be63ea71621aeeda02de132daf4eed351a8d267285155259c33891774d

Download Submit
\Windows\system\NUMJYBb.exe

Filesize
1.4MB

MD5
631c683efb207577767260fa592a92d0

SHA1
752953b568223de991aaa6030c33a0cd842ebda9

SHA256
2bf72c8a73d32608ddbd58555da4872301e8d0e316a378413662fefb2cbc4bda

SHA512
c1ff512540807d0f29c870d39667d996a693df619246a4db10127e30275974ef339db11c74c3e07ae6b9864633b1bd26521b513b8883940047e3392ed0b33df1

Download Submit
\Windows\system\NlnNupk.exe

Filesize
1.4MB

MD5
81b3eccaa3af35f48af78558f4530295

SHA1
766f2551876a42b9b4aa08459f07559f708488da

SHA256
114d607966a87a97ca035829ad04ae656085188add5211fcc8e86782564e2ff3

SHA512
f514b9d3ffa9d4e79f38a050cd7bd638a3e86fdca5cdb291efe3998475fdebf346a8d18479a0fcdecd748c5ebdbd61e44073efc078491856bbe3b53feaa5ed9d

Download Submit
\Windows\system\dseRLDR.exe

Filesize
1.4MB

MD5
ae71af24a8301c59f41f819aeb13d18d

SHA1
57c70e3d8d304281596f5cec5f396139bcd4c80e

SHA256
e5bb4ac8166f2043f5c3c7a8fe22756e242dc7b9baac9ee52b401320256d4226

SHA512
9319d1384623358d0603e73108fd0bed5609bce936dcb457c2d4fec944027cad3588cb0e4055942dd0d824ff05ed9b25e8a17fc380d7cf29c10b023ec9a5eb21

Download Submit
\Windows\system\eEOhtXu.exe

Filesize
1.4MB

MD5
c2e65cb705e4fb7f299e48a845a41608

SHA1
636730afeb4dcb79c7d838013efe5edf97fed432

SHA256
eac865bda392f8d74bc98cab0168ffb7beaaaaaee0e7c8be89307d5957503848

SHA512
eab29110cf23ec58ba23ec8bb8f5d4ec9715a43f840913af26fb029b4d339ff395f9a2380bc255b3cc6dd1c7cd78579cf3212b4b3fac1ce90f4af7f989b69d6b

Download Submit
\Windows\system\ifEaTFA.exe

Filesize
1.4MB

MD5
e3402456640c4089408df9bb510b00b5

SHA1
a87c971f1ae95029e1af9134826888bf495ecfe4

SHA256
7e839c61f7c67d25ae737f63b428f57369fbae099e91c24cf5ba21f5273f0ad2

SHA512
68b2d84f3ab8ebcdd72fc39e2e2843fc1b5629922c9bba23ddbc507ffae5ae6dfe2363bb25531d164abdc842046c318cb718ad1b831daa820ef49b1348e7e569

Download Submit
\Windows\system\yenqumu.exe

Filesize
1.4MB

MD5
4040c700998172c14696e3858071f429

SHA1
efa13f3a8e1f283e20dddaf2047b1835b3ebf96d

SHA256
a09ef7649eec9f410bae88d49b0b30210e917c64fec136b36f3b0775ee78ec6e

SHA512
181d3afd2a331612fea4f8bb1c2970929d2a96bc793d2ded68b970bd5355a35ad754930e10af8d45e379a8b9f718c9c712b7a925e84aadd695052df38bcdf3d8

Download Submit
memory/1988-1138-0x000000013F2F0000-0x000000013F641000-memory.dmp

Filesize
3.3MB

Download
memory/1988-14-0x000000013F690000-0x000000013F9E1000-memory.dmp

Filesize
3.3MB

Download
memory/1988-47-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-37-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/1988-36-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2535-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/1988-33-0x000000013F2D0000-0x000000013F621000-memory.dmp

Filesize
3.3MB

Download
memory/1988-61-0x000000013F2F0000-0x000000013F641000-memory.dmp

Filesize
3.3MB

Download
memory/1988-9-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2874-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/1988-77-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/1988-1411-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/1988-0-0x000000013FB80000-0x000000013FED1000-memory.dmp

Filesize
3.3MB

Download
memory/1988-489-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-50-0x000000013FB80000-0x000000013FED1000-memory.dmp

Filesize
3.3MB

Download
memory/1988-108-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/1988-69-0x000000013F790000-0x000000013FAE1000-memory.dmp

Filesize
3.3MB

Download
memory/1988-1655-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/1988-51-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2328-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-92-0x0000000001DD0000-0x0000000002121000-memory.dmp

Filesize
3.3MB

Download
memory/1988-100-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/1988-84-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/1988-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1996-99-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/1996-3372-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/1996-39-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2044-70-0x000000013F790000-0x000000013FAE1000-memory.dmp

Filesize
3.3MB

Download
memory/2044-3383-0x000000013F790000-0x000000013FAE1000-memory.dmp

Filesize
3.3MB

Download
memory/2044-1206-0x000000013F790000-0x000000013FAE1000-memory.dmp

Filesize
3.3MB

Download
memory/2144-62-0x000000013F2F0000-0x000000013F641000-memory.dmp

Filesize
3.3MB

Download
memory/2144-1139-0x000000013F2F0000-0x000000013F641000-memory.dmp

Filesize
3.3MB

Download
memory/2144-3467-0x000000013F2F0000-0x000000013F641000-memory.dmp

Filesize
3.3MB

Download
memory/2148-3338-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2148-16-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2240-15-0x000000013F690000-0x000000013F9E1000-memory.dmp

Filesize
3.3MB

Download
memory/2240-3335-0x000000013F690000-0x000000013F9E1000-memory.dmp

Filesize
3.3MB

Download
memory/2484-3369-0x000000013FA40000-0x000000013FD91000-memory.dmp

Filesize
3.3MB

Download
memory/2484-56-0x000000013FA40000-0x000000013FD91000-memory.dmp

Filesize
3.3MB

Download
memory/2608-41-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2608-107-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2608-3425-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2616-34-0x000000013F2D0000-0x000000013F621000-memory.dmp

Filesize
3.3MB

Download
memory/2616-3361-0x000000013F2D0000-0x000000013F621000-memory.dmp

Filesize
3.3MB

Download
memory/2656-3392-0x000000013FB30000-0x000000013FE81000-memory.dmp

Filesize
3.3MB

Download
memory/2656-48-0x000000013FB30000-0x000000013FE81000-memory.dmp

Filesize
3.3MB

Download
memory/2656-350-0x000000013FB30000-0x000000013FE81000-memory.dmp

Filesize
3.3MB

Download
memory/2716-78-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/2716-1416-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/2716-3468-0x000000013F7B0000-0x000000013FB01000-memory.dmp

Filesize
3.3MB

Download
memory/2732-3360-0x000000013FDB0000-0x0000000140101000-memory.dmp

Filesize
3.3MB

Download
memory/2732-21-0x000000013FDB0000-0x0000000140101000-memory.dmp

Filesize
3.3MB

Download
memory/2732-83-0x000000013FDB0000-0x0000000140101000-memory.dmp

Filesize
3.3MB

Download
memory/2804-1656-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2804-3390-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2804-85-0x000000013F2C0000-0x000000013F611000-memory.dmp

Filesize
3.3MB

Download
memory/2812-2330-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2812-93-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2812-3476-0x000000013FD40000-0x0000000140091000-memory.dmp

Filesize
3.3MB

Download
memory/2868-3416-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2868-101-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download
memory/2868-2537-0x000000013F580000-0x000000013F8D1000-memory.dmp

Filesize
3.3MB

Download