xmrig | 22ab1b2f0fa9b491aa3ac5270bf06104b100ddf61969e918e1ebc63900cd87de

Analysis

max time kernel
150s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
Size

1.3MB
MD5

68161de6eee061a5f371f90c88f9e210
SHA1

4fa71086104aba135e9075677b6a4dafc681a034
SHA256

22ab1b2f0fa9b491aa3ac5270bf06104b100ddf61969e918e1ebc63900cd87de
SHA512

cdc5560608a388bbcd8eb7529684c4de2c988b75dc385b72745c243cab0b7ebaf7d69a0e447706d670c742e31f27458de3615c8daec8037ade2b91c1fa2afe0f
SSDEEP

24576:RVIl/WDGCi7/qkat6OBC6y90Xli7V3kPitbcj6unLDx8BBx2VXh4tM+ql:ROdWCCi7/ra7K9NcHQ+Ic

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral1/memory/2108-8-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2628-508-0x000000013F460000-0x000000013F7B1000-memory.dmp	xmrig
behavioral1/memory/2788-513-0x000000013FAF0000-0x000000013FE41000-memory.dmp	xmrig
behavioral1/memory/2588-527-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2516-520-0x000000013F550000-0x000000013F8A1000-memory.dmp	xmrig
behavioral1/memory/2732-555-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	xmrig
behavioral1/memory/2112-552-0x000000013F6E0000-0x000000013FA31000-memory.dmp	xmrig
behavioral1/memory/3032-550-0x000000013FA10000-0x000000013FD61000-memory.dmp	xmrig
behavioral1/memory/2636-518-0x000000013F0B0000-0x000000013F401000-memory.dmp	xmrig
behavioral1/memory/3068-516-0x000000013FE50000-0x00000001401A1000-memory.dmp	xmrig
behavioral1/memory/2684-511-0x000000013FB00000-0x000000013FE51000-memory.dmp	xmrig
behavioral1/memory/2956-503-0x000000013FAD0000-0x000000013FE21000-memory.dmp	xmrig
behavioral1/memory/2988-1839-0x000000013FFA0000-0x00000001402F1000-memory.dmp	xmrig
behavioral1/memory/2108-2734-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2808-3253-0x000000013F900000-0x000000013FC51000-memory.dmp	xmrig
behavioral1/memory/2632-3255-0x000000013FCB0000-0x0000000140001000-memory.dmp	xmrig
behavioral1/memory/2788-3854-0x000000013FAF0000-0x000000013FE41000-memory.dmp	xmrig
behavioral1/memory/2628-3866-0x000000013F460000-0x000000013F7B1000-memory.dmp	xmrig
behavioral1/memory/2808-3863-0x000000013F900000-0x000000013FC51000-memory.dmp	xmrig
behavioral1/memory/2684-3862-0x000000013FB00000-0x000000013FE51000-memory.dmp	xmrig
behavioral1/memory/2636-3839-0x000000013F0B0000-0x000000013F401000-memory.dmp	xmrig
behavioral1/memory/2956-3851-0x000000013FAD0000-0x000000013FE21000-memory.dmp	xmrig
behavioral1/memory/3032-3891-0x000000013FA10000-0x000000013FD61000-memory.dmp	xmrig
behavioral1/memory/2732-3889-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	xmrig
behavioral1/memory/3068-3876-0x000000013FE50000-0x00000001401A1000-memory.dmp	xmrig
behavioral1/memory/2112-3873-0x000000013F6E0000-0x000000013FA31000-memory.dmp	xmrig
behavioral1/memory/2588-3869-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2108-3956-0x000000013FBF0000-0x000000013FF41000-memory.dmp	xmrig
behavioral1/memory/2516-3991-0x000000013F550000-0x000000013F8A1000-memory.dmp	xmrig
behavioral1/memory/2632-4084-0x000000013FCB0000-0x0000000140001000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2108	klfKURM.exe
2808	ntQptxf.exe
2632	puEwAYF.exe
2732	rTBxIGd.exe
2956	ixlDVdV.exe
2628	EQVisql.exe
2684	SqNwqzH.exe
2788	YBXESjP.exe
3068	pjbjYFJ.exe
2636	ZWyibHo.exe
2516	xrhYAzh.exe
2588	tROJtaF.exe
3032	vXaJwTR.exe
2112	MvzCXye.exe
1932	KCyAQyx.exe
2852	OgYGylV.exe
2856	HkQOWTQ.exe
2900	NyFriFe.exe
1608	WMZYcIP.exe
2904	KNVvNFu.exe
1780	utEjclg.exe
1736	KXnMudB.exe
1684	pRNcUip.exe
1236	XQlxQvK.exe
1768	qwSgpQt.exe
2052	GFpliKm.exe
2268	ZpALAVK.exe
2020	wwDURUC.exe
2504	KbEuHoK.exe
2064	zGRwsFW.exe
772	qqlydHR.exe
988	ceqerCC.exe
604	GXmoRRF.exe
1104	TleWfik.exe
2860	jHBfeUg.exe
340	MZKquza.exe
912	udLQNWD.exe
2376	vIytZsE.exe
1344	KivGlVi.exe
1044	JkptmDe.exe
1980	JUGYAhL.exe
1352	pyYKifj.exe
1536	egyxChv.exe
1080	rDACKzM.exe
744	XOUQCjr.exe
1084	QBUgQGF.exe
2948	ponnhKx.exe
900	bkVWWAg.exe
1052	qDEZpTm.exe
1312	vbTeYsb.exe
2104	EfDLXSX.exe
1740	GBMiqAR.exe
784	nXWYrtl.exe
2980	yUGqJUd.exe
1232	qIBVmQI.exe
1688	jZYgjct.exe
2608	OnpGWVR.exe
1992	jbSoTsY.exe
2460	zTRDDka.exe
3048	tfNavCL.exe
1596	NAGgwcg.exe
2712	ZbIVvQi.exe
2668	ShMRQwe.exe
2092	vFyaGQA.exe

Loads dropped DLL 64 IoCs

pid	Process
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2988-0-0x000000013FFA0000-0x00000001402F1000-memory.dmp	upx
behavioral1/files/0x000d00000001227e-3.dat	upx
behavioral1/memory/2108-8-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/files/0x00380000000141ab-9.dat	upx
behavioral1/memory/2808-14-0x000000013F900000-0x000000013FC51000-memory.dmp	upx
behavioral1/files/0x0008000000014345-11.dat	upx
behavioral1/files/0x0007000000014471-32.dat	upx
behavioral1/files/0x0007000000014415-28.dat	upx
behavioral1/files/0x0007000000014f41-42.dat	upx
behavioral1/files/0x0006000000015122-47.dat	upx
behavioral1/files/0x000600000001552d-62.dat	upx
behavioral1/files/0x000600000001562a-67.dat	upx
behavioral1/files/0x0006000000015ca2-95.dat	upx
behavioral1/files/0x0006000000015ce3-118.dat	upx
behavioral1/files/0x0006000000015d02-132.dat	upx
behavioral1/files/0x0006000000015d6b-158.dat	upx
behavioral1/files/0x0006000000015d77-163.dat	upx
behavioral1/files/0x0006000000015d49-153.dat	upx
behavioral1/files/0x0006000000015d28-148.dat	upx
behavioral1/files/0x0006000000015d19-143.dat	upx
behavioral1/files/0x0006000000015d0c-138.dat	upx
behavioral1/files/0x0006000000015cf0-127.dat	upx
behavioral1/files/0x00380000000141af-122.dat	upx
behavioral1/files/0x0006000000015cc7-107.dat	upx
behavioral1/files/0x0006000000015ccf-112.dat	upx
behavioral1/files/0x0006000000015cb8-102.dat	upx
behavioral1/files/0x0006000000015c7f-87.dat	upx
behavioral1/files/0x0006000000015c93-92.dat	upx
behavioral1/files/0x0006000000015c6f-82.dat	upx
behavioral1/files/0x0006000000015682-77.dat	upx
behavioral1/files/0x0006000000015678-72.dat	upx
behavioral1/files/0x0006000000015424-57.dat	upx
behavioral1/files/0x0006000000015406-52.dat	upx
behavioral1/files/0x0008000000014509-38.dat	upx
behavioral1/files/0x0007000000014353-24.dat	upx
behavioral1/memory/2628-508-0x000000013F460000-0x000000013F7B1000-memory.dmp	upx
behavioral1/memory/2788-513-0x000000013FAF0000-0x000000013FE41000-memory.dmp	upx
behavioral1/memory/2588-527-0x000000013F140000-0x000000013F491000-memory.dmp	upx
behavioral1/memory/2516-520-0x000000013F550000-0x000000013F8A1000-memory.dmp	upx
behavioral1/memory/2732-555-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	upx
behavioral1/memory/2112-552-0x000000013F6E0000-0x000000013FA31000-memory.dmp	upx
behavioral1/memory/3032-550-0x000000013FA10000-0x000000013FD61000-memory.dmp	upx
behavioral1/memory/2636-518-0x000000013F0B0000-0x000000013F401000-memory.dmp	upx
behavioral1/memory/3068-516-0x000000013FE50000-0x00000001401A1000-memory.dmp	upx
behavioral1/memory/2684-511-0x000000013FB00000-0x000000013FE51000-memory.dmp	upx
behavioral1/memory/2956-503-0x000000013FAD0000-0x000000013FE21000-memory.dmp	upx
behavioral1/memory/2632-501-0x000000013FCB0000-0x0000000140001000-memory.dmp	upx
behavioral1/memory/2988-1839-0x000000013FFA0000-0x00000001402F1000-memory.dmp	upx
behavioral1/memory/2108-2734-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/memory/2808-3253-0x000000013F900000-0x000000013FC51000-memory.dmp	upx
behavioral1/memory/2632-3255-0x000000013FCB0000-0x0000000140001000-memory.dmp	upx
behavioral1/memory/2788-3854-0x000000013FAF0000-0x000000013FE41000-memory.dmp	upx
behavioral1/memory/2628-3866-0x000000013F460000-0x000000013F7B1000-memory.dmp	upx
behavioral1/memory/2808-3863-0x000000013F900000-0x000000013FC51000-memory.dmp	upx
behavioral1/memory/2684-3862-0x000000013FB00000-0x000000013FE51000-memory.dmp	upx
behavioral1/memory/2636-3839-0x000000013F0B0000-0x000000013F401000-memory.dmp	upx
behavioral1/memory/2956-3851-0x000000013FAD0000-0x000000013FE21000-memory.dmp	upx
behavioral1/memory/3032-3891-0x000000013FA10000-0x000000013FD61000-memory.dmp	upx
behavioral1/memory/2732-3889-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	upx
behavioral1/memory/3068-3876-0x000000013FE50000-0x00000001401A1000-memory.dmp	upx
behavioral1/memory/2112-3873-0x000000013F6E0000-0x000000013FA31000-memory.dmp	upx
behavioral1/memory/2588-3869-0x000000013F140000-0x000000013F491000-memory.dmp	upx
behavioral1/memory/2108-3956-0x000000013FBF0000-0x000000013FF41000-memory.dmp	upx
behavioral1/memory/2516-3991-0x000000013F550000-0x000000013F8A1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QvlDTqB.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\GwXhoSD.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\TpVpHeh.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\arzPOCC.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\JSFNkRH.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\jYBzMSG.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\mIFTrCD.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\wronQuk.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\EaXozbE.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\XOtjXiS.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\SdilRMN.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\CeVhYjn.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\pdrIUrr.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\lnNLRcg.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\XFNePOS.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\HfODFVK.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\hJGGaua.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\wUOizrR.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\iHqqdGz.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\wCNLBzD.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\rQqVPpS.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\zQpYdjf.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\XvUAGBu.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\gxJIvAa.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\wlbViFt.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\QaGtsWc.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\lFVeZna.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\poDhUCX.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\QTHqric.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\ctPRQoD.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\fncQrbY.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\cvUsgaO.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\rGaEkCT.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\KoLRxfG.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\iydbgfR.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\VYtgxnu.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\ynSyhhs.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\GBMiqAR.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\sapopDy.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\vCZojem.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\RmLZpdS.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\UXkaoCc.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\bURyDpK.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\CIzgrsa.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\pUXnlNq.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\irjNJTU.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\QhIONDf.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\UWVdntu.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\rPibUAe.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\LCEFdBm.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\qyPNtkE.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\MyWvrBu.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\ZUqGyZh.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\gbgYCrQ.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\ADMyvsR.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\PPQntpC.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\FKHFuID.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\ItnGaAU.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\oxrLWfi.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\HiiMTUD.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\hQMgFCY.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\JTIQZmP.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\dasJSQr.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
File created	C:\Windows\System\uFooqfQ.exe	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2108	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2108	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2108	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	29
PID 2988 wrote to memory of 2808	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2808	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2808	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	30
PID 2988 wrote to memory of 2632	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2632	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2632	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	31
PID 2988 wrote to memory of 2732	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2732	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2732	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	32
PID 2988 wrote to memory of 2956	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2956	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2956	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	33
PID 2988 wrote to memory of 2628	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2628	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2628	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	34
PID 2988 wrote to memory of 2684	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2684	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2684	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	35
PID 2988 wrote to memory of 2788	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 2788	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 2788	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	36
PID 2988 wrote to memory of 3068	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 3068	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 3068	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	37
PID 2988 wrote to memory of 2636	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 2636	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 2636	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	38
PID 2988 wrote to memory of 2516	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 2516	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 2516	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	39
PID 2988 wrote to memory of 2588	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 2588	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 2588	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	40
PID 2988 wrote to memory of 3032	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 3032	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 3032	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	41
PID 2988 wrote to memory of 2112	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 2112	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 2112	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	42
PID 2988 wrote to memory of 1932	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 1932	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 1932	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	43
PID 2988 wrote to memory of 2852	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 2852	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 2852	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	44
PID 2988 wrote to memory of 2856	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 2856	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 2856	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	45
PID 2988 wrote to memory of 2900	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 2900	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 2900	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	46
PID 2988 wrote to memory of 1608	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1608	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 1608	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	47
PID 2988 wrote to memory of 2904	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 2904	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 2904	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	48
PID 2988 wrote to memory of 1780	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 1780	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 1780	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	49
PID 2988 wrote to memory of 1736	2988	68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\68161de6eee061a5f371f90c88f9e210_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\System\klfKURM.exe
  C:\Windows\System\klfKURM.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ntQptxf.exe
  C:\Windows\System\ntQptxf.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\puEwAYF.exe
  C:\Windows\System\puEwAYF.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\rTBxIGd.exe
  C:\Windows\System\rTBxIGd.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ixlDVdV.exe
  C:\Windows\System\ixlDVdV.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\EQVisql.exe
  C:\Windows\System\EQVisql.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\SqNwqzH.exe
  C:\Windows\System\SqNwqzH.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\YBXESjP.exe
  C:\Windows\System\YBXESjP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\pjbjYFJ.exe
  C:\Windows\System\pjbjYFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\ZWyibHo.exe
  C:\Windows\System\ZWyibHo.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\xrhYAzh.exe
  C:\Windows\System\xrhYAzh.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\tROJtaF.exe
  C:\Windows\System\tROJtaF.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\vXaJwTR.exe
  C:\Windows\System\vXaJwTR.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\MvzCXye.exe
  C:\Windows\System\MvzCXye.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\KCyAQyx.exe
  C:\Windows\System\KCyAQyx.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\OgYGylV.exe
  C:\Windows\System\OgYGylV.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\HkQOWTQ.exe
  C:\Windows\System\HkQOWTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\NyFriFe.exe
  C:\Windows\System\NyFriFe.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\WMZYcIP.exe
  C:\Windows\System\WMZYcIP.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\KNVvNFu.exe
  C:\Windows\System\KNVvNFu.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\utEjclg.exe
  C:\Windows\System\utEjclg.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\KXnMudB.exe
  C:\Windows\System\KXnMudB.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\pRNcUip.exe
  C:\Windows\System\pRNcUip.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\XQlxQvK.exe
  C:\Windows\System\XQlxQvK.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\qwSgpQt.exe
  C:\Windows\System\qwSgpQt.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\GFpliKm.exe
  C:\Windows\System\GFpliKm.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ZpALAVK.exe
  C:\Windows\System\ZpALAVK.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\wwDURUC.exe
  C:\Windows\System\wwDURUC.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\KbEuHoK.exe
  C:\Windows\System\KbEuHoK.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\zGRwsFW.exe
  C:\Windows\System\zGRwsFW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\qqlydHR.exe
  C:\Windows\System\qqlydHR.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\ceqerCC.exe
  C:\Windows\System\ceqerCC.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\GXmoRRF.exe
  C:\Windows\System\GXmoRRF.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\TleWfik.exe
  C:\Windows\System\TleWfik.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\jHBfeUg.exe
  C:\Windows\System\jHBfeUg.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MZKquza.exe
  C:\Windows\System\MZKquza.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\udLQNWD.exe
  C:\Windows\System\udLQNWD.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\vIytZsE.exe
  C:\Windows\System\vIytZsE.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\KivGlVi.exe
  C:\Windows\System\KivGlVi.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\JkptmDe.exe
  C:\Windows\System\JkptmDe.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\JUGYAhL.exe
  C:\Windows\System\JUGYAhL.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\pyYKifj.exe
  C:\Windows\System\pyYKifj.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\egyxChv.exe
  C:\Windows\System\egyxChv.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\rDACKzM.exe
  C:\Windows\System\rDACKzM.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\XOUQCjr.exe
  C:\Windows\System\XOUQCjr.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\QBUgQGF.exe
  C:\Windows\System\QBUgQGF.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\ponnhKx.exe
  C:\Windows\System\ponnhKx.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\bkVWWAg.exe
  C:\Windows\System\bkVWWAg.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\qDEZpTm.exe
  C:\Windows\System\qDEZpTm.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\vbTeYsb.exe
  C:\Windows\System\vbTeYsb.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\EfDLXSX.exe
  C:\Windows\System\EfDLXSX.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\GBMiqAR.exe
  C:\Windows\System\GBMiqAR.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\nXWYrtl.exe
  C:\Windows\System\nXWYrtl.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\yUGqJUd.exe
  C:\Windows\System\yUGqJUd.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\qIBVmQI.exe
  C:\Windows\System\qIBVmQI.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\jZYgjct.exe
  C:\Windows\System\jZYgjct.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\OnpGWVR.exe
  C:\Windows\System\OnpGWVR.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\jbSoTsY.exe
  C:\Windows\System\jbSoTsY.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\zTRDDka.exe
  C:\Windows\System\zTRDDka.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\tfNavCL.exe
  C:\Windows\System\tfNavCL.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\NAGgwcg.exe
  C:\Windows\System\NAGgwcg.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ZbIVvQi.exe
  C:\Windows\System\ZbIVvQi.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ShMRQwe.exe
  C:\Windows\System\ShMRQwe.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\vFyaGQA.exe
  C:\Windows\System\vFyaGQA.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\AQhcXcc.exe
  C:\Windows\System\AQhcXcc.exe
  2⤵
  PID:2000
- C:\Windows\System\dsWNOka.exe
  C:\Windows\System\dsWNOka.exe
  2⤵
  PID:2700
- C:\Windows\System\DvHVhPc.exe
  C:\Windows\System\DvHVhPc.exe
  2⤵
  PID:2524
- C:\Windows\System\FbHlOrR.exe
  C:\Windows\System\FbHlOrR.exe
  2⤵
  PID:2572
- C:\Windows\System\mfqSUOI.exe
  C:\Windows\System\mfqSUOI.exe
  2⤵
  PID:2200
- C:\Windows\System\pHPBfSd.exe
  C:\Windows\System\pHPBfSd.exe
  2⤵
  PID:2792
- C:\Windows\System\DzgRxqZ.exe
  C:\Windows\System\DzgRxqZ.exe
  2⤵
  PID:2616
- C:\Windows\System\WlYOPiE.exe
  C:\Windows\System\WlYOPiE.exe
  2⤵
  PID:2888
- C:\Windows\System\hamQkRn.exe
  C:\Windows\System\hamQkRn.exe
  2⤵
  PID:2484
- C:\Windows\System\oulqyvM.exe
  C:\Windows\System\oulqyvM.exe
  2⤵
  PID:1440
- C:\Windows\System\zCYQXNA.exe
  C:\Windows\System\zCYQXNA.exe
  2⤵
  PID:2164
- C:\Windows\System\XLNNjeW.exe
  C:\Windows\System\XLNNjeW.exe
  2⤵
  PID:1520
- C:\Windows\System\NRXOIqW.exe
  C:\Windows\System\NRXOIqW.exe
  2⤵
  PID:2132
- C:\Windows\System\giiSiCD.exe
  C:\Windows\System\giiSiCD.exe
  2⤵
  PID:2232
- C:\Windows\System\NSVhKcW.exe
  C:\Windows\System\NSVhKcW.exe
  2⤵
  PID:2500
- C:\Windows\System\asodPAc.exe
  C:\Windows\System\asodPAc.exe
  2⤵
  PID:536
- C:\Windows\System\HLZnjmg.exe
  C:\Windows\System\HLZnjmg.exe
  2⤵
  PID:964
- C:\Windows\System\diJSIsD.exe
  C:\Windows\System\diJSIsD.exe
  2⤵
  PID:836
- C:\Windows\System\VDpDEuW.exe
  C:\Windows\System\VDpDEuW.exe
  2⤵
  PID:1840
- C:\Windows\System\KOFtjUr.exe
  C:\Windows\System\KOFtjUr.exe
  2⤵
  PID:1680
- C:\Windows\System\LxzYTqr.exe
  C:\Windows\System\LxzYTqr.exe
  2⤵
  PID:2292
- C:\Windows\System\fWSholA.exe
  C:\Windows\System\fWSholA.exe
  2⤵
  PID:2492
- C:\Windows\System\PfelmfO.exe
  C:\Windows\System\PfelmfO.exe
  2⤵
  PID:1380
- C:\Windows\System\golTiqk.exe
  C:\Windows\System\golTiqk.exe
  2⤵
  PID:1576
- C:\Windows\System\bkWEclS.exe
  C:\Windows\System\bkWEclS.exe
  2⤵
  PID:1604
- C:\Windows\System\YjkazsZ.exe
  C:\Windows\System\YjkazsZ.exe
  2⤵
  PID:1072
- C:\Windows\System\vlErohT.exe
  C:\Windows\System\vlErohT.exe
  2⤵
  PID:748
- C:\Windows\System\GarsHFW.exe
  C:\Windows\System\GarsHFW.exe
  2⤵
  PID:2128
- C:\Windows\System\LikyEXV.exe
  C:\Windows\System\LikyEXV.exe
  2⤵
  PID:1776
- C:\Windows\System\USFEDCa.exe
  C:\Windows\System\USFEDCa.exe
  2⤵
  PID:2256
- C:\Windows\System\BjFOxVV.exe
  C:\Windows\System\BjFOxVV.exe
  2⤵
  PID:1172
- C:\Windows\System\aavjgBd.exe
  C:\Windows\System\aavjgBd.exe
  2⤵
  PID:2428
- C:\Windows\System\oDmKraF.exe
  C:\Windows\System\oDmKraF.exe
  2⤵
  PID:2116
- C:\Windows\System\UbjCcZp.exe
  C:\Windows\System\UbjCcZp.exe
  2⤵
  PID:2456
- C:\Windows\System\QKDynLI.exe
  C:\Windows\System\QKDynLI.exe
  2⤵
  PID:2204
- C:\Windows\System\RbqrbHy.exe
  C:\Windows\System\RbqrbHy.exe
  2⤵
  PID:2760
- C:\Windows\System\mbeeSgQ.exe
  C:\Windows\System\mbeeSgQ.exe
  2⤵
  PID:2300
- C:\Windows\System\KxjgTnw.exe
  C:\Windows\System\KxjgTnw.exe
  2⤵
  PID:2544
- C:\Windows\System\vjblgWN.exe
  C:\Windows\System\vjblgWN.exe
  2⤵
  PID:2776
- C:\Windows\System\WvmUnyc.exe
  C:\Windows\System\WvmUnyc.exe
  2⤵
  PID:2368
- C:\Windows\System\VbmjZxC.exe
  C:\Windows\System\VbmjZxC.exe
  2⤵
  PID:1916
- C:\Windows\System\xLBezcS.exe
  C:\Windows\System\xLBezcS.exe
  2⤵
  PID:1580
- C:\Windows\System\xrfQPMd.exe
  C:\Windows\System\xrfQPMd.exe
  2⤵
  PID:2328
- C:\Windows\System\gkslVzW.exe
  C:\Windows\System\gkslVzW.exe
  2⤵
  PID:1148
- C:\Windows\System\NQcuyhy.exe
  C:\Windows\System\NQcuyhy.exe
  2⤵
  PID:1428
- C:\Windows\System\QfcDoyD.exe
  C:\Windows\System\QfcDoyD.exe
  2⤵
  PID:2080
- C:\Windows\System\XupsScu.exe
  C:\Windows\System\XupsScu.exe
  2⤵
  PID:2044
- C:\Windows\System\EBGPZYp.exe
  C:\Windows\System\EBGPZYp.exe
  2⤵
  PID:2272
- C:\Windows\System\EnYyVdB.exe
  C:\Windows\System\EnYyVdB.exe
  2⤵
  PID:1068
- C:\Windows\System\HWHzqfV.exe
  C:\Windows\System\HWHzqfV.exe
  2⤵
  PID:2284
- C:\Windows\System\hBSvfES.exe
  C:\Windows\System\hBSvfES.exe
  2⤵
  PID:1156
- C:\Windows\System\EAjkzOp.exe
  C:\Windows\System\EAjkzOp.exe
  2⤵
  PID:2884
- C:\Windows\System\FsDpQLP.exe
  C:\Windows\System\FsDpQLP.exe
  2⤵
  PID:1860
- C:\Windows\System\RdHRefw.exe
  C:\Windows\System\RdHRefw.exe
  2⤵
  PID:2360
- C:\Windows\System\dSawBqI.exe
  C:\Windows\System\dSawBqI.exe
  2⤵
  PID:1636
- C:\Windows\System\GTYfxHM.exe
  C:\Windows\System\GTYfxHM.exe
  2⤵
  PID:556
- C:\Windows\System\Ovmsvjo.exe
  C:\Windows\System\Ovmsvjo.exe
  2⤵
  PID:2740
- C:\Windows\System\SNfIHrh.exe
  C:\Windows\System\SNfIHrh.exe
  2⤵
  PID:2696
- C:\Windows\System\OcyySyu.exe
  C:\Windows\System\OcyySyu.exe
  2⤵
  PID:496
- C:\Windows\System\ApKdpcN.exe
  C:\Windows\System\ApKdpcN.exe
  2⤵
  PID:1564
- C:\Windows\System\dONhpfM.exe
  C:\Windows\System\dONhpfM.exe
  2⤵
  PID:2192
- C:\Windows\System\ZXZkjqM.exe
  C:\Windows\System\ZXZkjqM.exe
  2⤵
  PID:2716
- C:\Windows\System\LLyWHqi.exe
  C:\Windows\System\LLyWHqi.exe
  2⤵
  PID:1668
- C:\Windows\System\OZBawJF.exe
  C:\Windows\System\OZBawJF.exe
  2⤵
  PID:2836
- C:\Windows\System\UpfiEIU.exe
  C:\Windows\System\UpfiEIU.exe
  2⤵
  PID:1940
- C:\Windows\System\dVHfzqf.exe
  C:\Windows\System\dVHfzqf.exe
  2⤵
  PID:2996
- C:\Windows\System\zBZtemY.exe
  C:\Windows\System\zBZtemY.exe
  2⤵
  PID:2288
- C:\Windows\System\nBZKhKh.exe
  C:\Windows\System\nBZKhKh.exe
  2⤵
  PID:1008
- C:\Windows\System\PJTEHuU.exe
  C:\Windows\System\PJTEHuU.exe
  2⤵
  PID:2960
- C:\Windows\System\qKzVJjt.exe
  C:\Windows\System\qKzVJjt.exe
  2⤵
  PID:1472
- C:\Windows\System\dtUGJbS.exe
  C:\Windows\System\dtUGJbS.exe
  2⤵
  PID:2648
- C:\Windows\System\qOsHtzq.exe
  C:\Windows\System\qOsHtzq.exe
  2⤵
  PID:2384
- C:\Windows\System\lYaptGc.exe
  C:\Windows\System\lYaptGc.exe
  2⤵
  PID:1788
- C:\Windows\System\tMLBObG.exe
  C:\Windows\System\tMLBObG.exe
  2⤵
  PID:2872
- C:\Windows\System\AHjhWXV.exe
  C:\Windows\System\AHjhWXV.exe
  2⤵
  PID:2096
- C:\Windows\System\sEJGvPH.exe
  C:\Windows\System\sEJGvPH.exe
  2⤵
  PID:1496
- C:\Windows\System\aeTMQoV.exe
  C:\Windows\System\aeTMQoV.exe
  2⤵
  PID:2400
- C:\Windows\System\PEircXn.exe
  C:\Windows\System\PEircXn.exe
  2⤵
  PID:2940
- C:\Windows\System\VahHFAu.exe
  C:\Windows\System\VahHFAu.exe
  2⤵
  PID:2552
- C:\Windows\System\lOzCUiL.exe
  C:\Windows\System\lOzCUiL.exe
  2⤵
  PID:344
- C:\Windows\System\LVEJPmO.exe
  C:\Windows\System\LVEJPmO.exe
  2⤵
  PID:348
- C:\Windows\System\wThIusJ.exe
  C:\Windows\System\wThIusJ.exe
  2⤵
  PID:1208
- C:\Windows\System\WIcosDh.exe
  C:\Windows\System\WIcosDh.exe
  2⤵
  PID:2772
- C:\Windows\System\OfWbzFY.exe
  C:\Windows\System\OfWbzFY.exe
  2⤵
  PID:2432
- C:\Windows\System\OHxZKaT.exe
  C:\Windows\System\OHxZKaT.exe
  2⤵
  PID:672
- C:\Windows\System\sBFIYLD.exe
  C:\Windows\System\sBFIYLD.exe
  2⤵
  PID:1620
- C:\Windows\System\WpzHGhn.exe
  C:\Windows\System\WpzHGhn.exe
  2⤵
  PID:2764
- C:\Windows\System\aOkjIpH.exe
  C:\Windows\System\aOkjIpH.exe
  2⤵
  PID:2796
- C:\Windows\System\QTIKigz.exe
  C:\Windows\System\QTIKigz.exe
  2⤵
  PID:2208
- C:\Windows\System\ViWNxls.exe
  C:\Windows\System\ViWNxls.exe
  2⤵
  PID:2828
- C:\Windows\System\XzfKmoC.exe
  C:\Windows\System\XzfKmoC.exe
  2⤵
  PID:1292
- C:\Windows\System\BswFbrn.exe
  C:\Windows\System\BswFbrn.exe
  2⤵
  PID:2848
- C:\Windows\System\rPnAxSl.exe
  C:\Windows\System\rPnAxSl.exe
  2⤵
  PID:1784
- C:\Windows\System\NxPVYFW.exe
  C:\Windows\System\NxPVYFW.exe
  2⤵
  PID:1744
- C:\Windows\System\hTRzjiE.exe
  C:\Windows\System\hTRzjiE.exe
  2⤵
  PID:2160
- C:\Windows\System\jrcWFcR.exe
  C:\Windows\System\jrcWFcR.exe
  2⤵
  PID:2912
- C:\Windows\System\bLYNmxJ.exe
  C:\Windows\System\bLYNmxJ.exe
  2⤵
  PID:1088
- C:\Windows\System\sGoiZHW.exe
  C:\Windows\System\sGoiZHW.exe
  2⤵
  PID:1984
- C:\Windows\System\ojNzBpl.exe
  C:\Windows\System\ojNzBpl.exe
  2⤵
  PID:3012
- C:\Windows\System\pzcMNYV.exe
  C:\Windows\System\pzcMNYV.exe
  2⤵
  PID:2916
- C:\Windows\System\MmErEWv.exe
  C:\Windows\System\MmErEWv.exe
  2⤵
  PID:1388
- C:\Windows\System\lOtbAnM.exe
  C:\Windows\System\lOtbAnM.exe
  2⤵
  PID:380
- C:\Windows\System\pcQRWHQ.exe
  C:\Windows\System\pcQRWHQ.exe
  2⤵
  PID:1912
- C:\Windows\System\heWfEDW.exe
  C:\Windows\System\heWfEDW.exe
  2⤵
  PID:336
- C:\Windows\System\NqbWMLh.exe
  C:\Windows\System\NqbWMLh.exe
  2⤵
  PID:864
- C:\Windows\System\rplIhWi.exe
  C:\Windows\System\rplIhWi.exe
  2⤵
  PID:3088
- C:\Windows\System\zpkBIYk.exe
  C:\Windows\System\zpkBIYk.exe
  2⤵
  PID:3108
- C:\Windows\System\udsFuJo.exe
  C:\Windows\System\udsFuJo.exe
  2⤵
  PID:3128
- C:\Windows\System\drTuWuJ.exe
  C:\Windows\System\drTuWuJ.exe
  2⤵
  PID:3148
- C:\Windows\System\XmdSeQJ.exe
  C:\Windows\System\XmdSeQJ.exe
  2⤵
  PID:3168
- C:\Windows\System\wYzawii.exe
  C:\Windows\System\wYzawii.exe
  2⤵
  PID:3188
- C:\Windows\System\gvzTEln.exe
  C:\Windows\System\gvzTEln.exe
  2⤵
  PID:3208
- C:\Windows\System\nrOcQtD.exe
  C:\Windows\System\nrOcQtD.exe
  2⤵
  PID:3228
- C:\Windows\System\dGvKISo.exe
  C:\Windows\System\dGvKISo.exe
  2⤵
  PID:3248
- C:\Windows\System\hAhCrhf.exe
  C:\Windows\System\hAhCrhf.exe
  2⤵
  PID:3268
- C:\Windows\System\yrKrbaF.exe
  C:\Windows\System\yrKrbaF.exe
  2⤵
  PID:3284
- C:\Windows\System\FbSIKlW.exe
  C:\Windows\System\FbSIKlW.exe
  2⤵
  PID:3308
- C:\Windows\System\sapopDy.exe
  C:\Windows\System\sapopDy.exe
  2⤵
  PID:3328
- C:\Windows\System\wIcIuJu.exe
  C:\Windows\System\wIcIuJu.exe
  2⤵
  PID:3348
- C:\Windows\System\EICJTuT.exe
  C:\Windows\System\EICJTuT.exe
  2⤵
  PID:3368
- C:\Windows\System\PmowJHS.exe
  C:\Windows\System\PmowJHS.exe
  2⤵
  PID:3388
- C:\Windows\System\cdyXqub.exe
  C:\Windows\System\cdyXqub.exe
  2⤵
  PID:3408
- C:\Windows\System\LmeMuXb.exe
  C:\Windows\System\LmeMuXb.exe
  2⤵
  PID:3428
- C:\Windows\System\qnAhOvf.exe
  C:\Windows\System\qnAhOvf.exe
  2⤵
  PID:3448
- C:\Windows\System\ntEJbmR.exe
  C:\Windows\System\ntEJbmR.exe
  2⤵
  PID:3468
- C:\Windows\System\WeLrhad.exe
  C:\Windows\System\WeLrhad.exe
  2⤵
  PID:3488
- C:\Windows\System\hpdzURp.exe
  C:\Windows\System\hpdzURp.exe
  2⤵
  PID:3508
- C:\Windows\System\XTAZghE.exe
  C:\Windows\System\XTAZghE.exe
  2⤵
  PID:3524
- C:\Windows\System\AjbNjqL.exe
  C:\Windows\System\AjbNjqL.exe
  2⤵
  PID:3548
- C:\Windows\System\UrPEUgp.exe
  C:\Windows\System\UrPEUgp.exe
  2⤵
  PID:3568
- C:\Windows\System\mknnDge.exe
  C:\Windows\System\mknnDge.exe
  2⤵
  PID:3588
- C:\Windows\System\yQhojCM.exe
  C:\Windows\System\yQhojCM.exe
  2⤵
  PID:3608
- C:\Windows\System\uWaYzeF.exe
  C:\Windows\System\uWaYzeF.exe
  2⤵
  PID:3628
- C:\Windows\System\bUjpQyI.exe
  C:\Windows\System\bUjpQyI.exe
  2⤵
  PID:3648
- C:\Windows\System\rGaEkCT.exe
  C:\Windows\System\rGaEkCT.exe
  2⤵
  PID:3668
- C:\Windows\System\wZXrKRN.exe
  C:\Windows\System\wZXrKRN.exe
  2⤵
  PID:3688
- C:\Windows\System\pjYuRVc.exe
  C:\Windows\System\pjYuRVc.exe
  2⤵
  PID:3708
- C:\Windows\System\EjpmZyw.exe
  C:\Windows\System\EjpmZyw.exe
  2⤵
  PID:3728
- C:\Windows\System\nRlOZcm.exe
  C:\Windows\System\nRlOZcm.exe
  2⤵
  PID:3748
- C:\Windows\System\OEGMWqW.exe
  C:\Windows\System\OEGMWqW.exe
  2⤵
  PID:3768
- C:\Windows\System\hbqGoxV.exe
  C:\Windows\System\hbqGoxV.exe
  2⤵
  PID:3788
- C:\Windows\System\zazIjSi.exe
  C:\Windows\System\zazIjSi.exe
  2⤵
  PID:3808
- C:\Windows\System\hqLhDaq.exe
  C:\Windows\System\hqLhDaq.exe
  2⤵
  PID:3828
- C:\Windows\System\mhphBsQ.exe
  C:\Windows\System\mhphBsQ.exe
  2⤵
  PID:3848
- C:\Windows\System\byQDkIs.exe
  C:\Windows\System\byQDkIs.exe
  2⤵
  PID:3868
- C:\Windows\System\dOUhtuA.exe
  C:\Windows\System\dOUhtuA.exe
  2⤵
  PID:3884
- C:\Windows\System\QKycJha.exe
  C:\Windows\System\QKycJha.exe
  2⤵
  PID:3908
- C:\Windows\System\jgcCmQr.exe
  C:\Windows\System\jgcCmQr.exe
  2⤵
  PID:3928
- C:\Windows\System\vnmICVh.exe
  C:\Windows\System\vnmICVh.exe
  2⤵
  PID:3948
- C:\Windows\System\lPCDyKB.exe
  C:\Windows\System\lPCDyKB.exe
  2⤵
  PID:3968
- C:\Windows\System\hDaBkZo.exe
  C:\Windows\System\hDaBkZo.exe
  2⤵
  PID:3988
- C:\Windows\System\PVuSirL.exe
  C:\Windows\System\PVuSirL.exe
  2⤵
  PID:4004
- C:\Windows\System\hiDfRgv.exe
  C:\Windows\System\hiDfRgv.exe
  2⤵
  PID:4028
- C:\Windows\System\InvDCGJ.exe
  C:\Windows\System\InvDCGJ.exe
  2⤵
  PID:4048
- C:\Windows\System\xelbHzZ.exe
  C:\Windows\System\xelbHzZ.exe
  2⤵
  PID:4068
- C:\Windows\System\AmjrMnq.exe
  C:\Windows\System\AmjrMnq.exe
  2⤵
  PID:4088
- C:\Windows\System\IxEyiMa.exe
  C:\Windows\System\IxEyiMa.exe
  2⤵
  PID:2748
- C:\Windows\System\VsNKjtN.exe
  C:\Windows\System\VsNKjtN.exe
  2⤵
  PID:1100
- C:\Windows\System\QSfFHYr.exe
  C:\Windows\System\QSfFHYr.exe
  2⤵
  PID:2896
- C:\Windows\System\JxcYuuu.exe
  C:\Windows\System\JxcYuuu.exe
  2⤵
  PID:3100
- C:\Windows\System\FyKgkqb.exe
  C:\Windows\System\FyKgkqb.exe
  2⤵
  PID:3116
- C:\Windows\System\hMUMjkt.exe
  C:\Windows\System\hMUMjkt.exe
  2⤵
  PID:3156
- C:\Windows\System\ZduXqDv.exe
  C:\Windows\System\ZduXqDv.exe
  2⤵
  PID:3216
- C:\Windows\System\VEenuTI.exe
  C:\Windows\System\VEenuTI.exe
  2⤵
  PID:3236
- C:\Windows\System\xLVHZMr.exe
  C:\Windows\System\xLVHZMr.exe
  2⤵
  PID:3260
- C:\Windows\System\QCwsqou.exe
  C:\Windows\System\QCwsqou.exe
  2⤵
  PID:3280
- C:\Windows\System\zlWJKrW.exe
  C:\Windows\System\zlWJKrW.exe
  2⤵
  PID:3344
- C:\Windows\System\DwdnCBd.exe
  C:\Windows\System\DwdnCBd.exe
  2⤵
  PID:3360
- C:\Windows\System\JQtWRra.exe
  C:\Windows\System\JQtWRra.exe
  2⤵
  PID:3424
- C:\Windows\System\kWvMGur.exe
  C:\Windows\System\kWvMGur.exe
  2⤵
  PID:3420
- C:\Windows\System\jQHARKM.exe
  C:\Windows\System\jQHARKM.exe
  2⤵
  PID:3460
- C:\Windows\System\IaSJyBR.exe
  C:\Windows\System\IaSJyBR.exe
  2⤵
  PID:3504
- C:\Windows\System\nnCwHAu.exe
  C:\Windows\System\nnCwHAu.exe
  2⤵
  PID:3480
- C:\Windows\System\rfzhrsl.exe
  C:\Windows\System\rfzhrsl.exe
  2⤵
  PID:3540
- C:\Windows\System\mpfFFzF.exe
  C:\Windows\System\mpfFFzF.exe
  2⤵
  PID:3576
- C:\Windows\System\iPeenhy.exe
  C:\Windows\System\iPeenhy.exe
  2⤵
  PID:3580
- C:\Windows\System\lOQnYmp.exe
  C:\Windows\System\lOQnYmp.exe
  2⤵
  PID:3620
- C:\Windows\System\dPGUfko.exe
  C:\Windows\System\dPGUfko.exe
  2⤵
  PID:3664
- C:\Windows\System\TprfkGI.exe
  C:\Windows\System\TprfkGI.exe
  2⤵
  PID:3640
- C:\Windows\System\ZZzSYfU.exe
  C:\Windows\System\ZZzSYfU.exe
  2⤵
  PID:3684
- C:\Windows\System\fLJDLma.exe
  C:\Windows\System\fLJDLma.exe
  2⤵
  PID:3780
- C:\Windows\System\LOUbrmf.exe
  C:\Windows\System\LOUbrmf.exe
  2⤵
  PID:3820
- C:\Windows\System\aWsFpyo.exe
  C:\Windows\System\aWsFpyo.exe
  2⤵
  PID:3860
- C:\Windows\System\wNgWpgs.exe
  C:\Windows\System\wNgWpgs.exe
  2⤵
  PID:3892
- C:\Windows\System\thUwyIM.exe
  C:\Windows\System\thUwyIM.exe
  2⤵
  PID:3876
- C:\Windows\System\kndUOBe.exe
  C:\Windows\System\kndUOBe.exe
  2⤵
  PID:3940
- C:\Windows\System\CXqNxUV.exe
  C:\Windows\System\CXqNxUV.exe
  2⤵
  PID:3984
- C:\Windows\System\hxXRFEv.exe
  C:\Windows\System\hxXRFEv.exe
  2⤵
  PID:4020
- C:\Windows\System\oelnIAi.exe
  C:\Windows\System\oelnIAi.exe
  2⤵
  PID:4056
- C:\Windows\System\rhafCTl.exe
  C:\Windows\System\rhafCTl.exe
  2⤵
  PID:4040
- C:\Windows\System\DGJlPua.exe
  C:\Windows\System\DGJlPua.exe
  2⤵
  PID:4080
- C:\Windows\System\XWVmTpD.exe
  C:\Windows\System\XWVmTpD.exe
  2⤵
  PID:2216
- C:\Windows\System\NwURMCZ.exe
  C:\Windows\System\NwURMCZ.exe
  2⤵
  PID:3096
- C:\Windows\System\MviLxZh.exe
  C:\Windows\System\MviLxZh.exe
  2⤵
  PID:3136
- C:\Windows\System\SKvEpCx.exe
  C:\Windows\System\SKvEpCx.exe
  2⤵
  PID:3104
- C:\Windows\System\wWqXjQB.exe
  C:\Windows\System\wWqXjQB.exe
  2⤵
  PID:3180
- C:\Windows\System\ooRHPhQ.exe
  C:\Windows\System\ooRHPhQ.exe
  2⤵
  PID:3184
- C:\Windows\System\EKVhCuu.exe
  C:\Windows\System\EKVhCuu.exe
  2⤵
  PID:2240
- C:\Windows\System\VGhfAWe.exe
  C:\Windows\System\VGhfAWe.exe
  2⤵
  PID:3264
- C:\Windows\System\ElOVDOF.exe
  C:\Windows\System\ElOVDOF.exe
  2⤵
  PID:2180
- C:\Windows\System\dlvUPJz.exe
  C:\Windows\System\dlvUPJz.exe
  2⤵
  PID:3320
- C:\Windows\System\uMVyZYQ.exe
  C:\Windows\System\uMVyZYQ.exe
  2⤵
  PID:3276
- C:\Windows\System\ohGxJkp.exe
  C:\Windows\System\ohGxJkp.exe
  2⤵
  PID:2724
- C:\Windows\System\PxIyGal.exe
  C:\Windows\System\PxIyGal.exe
  2⤵
  PID:1160
- C:\Windows\System\qvseNmL.exe
  C:\Windows\System\qvseNmL.exe
  2⤵
  PID:2004
- C:\Windows\System\zgGGNWM.exe
  C:\Windows\System\zgGGNWM.exe
  2⤵
  PID:3416
- C:\Windows\System\AdpwHhE.exe
  C:\Windows\System\AdpwHhE.exe
  2⤵
  PID:3440
- C:\Windows\System\FKiHquW.exe
  C:\Windows\System\FKiHquW.exe
  2⤵
  PID:3484
- C:\Windows\System\IjBiQIt.exe
  C:\Windows\System\IjBiQIt.exe
  2⤵
  PID:3616
- C:\Windows\System\AemsTNh.exe
  C:\Windows\System\AemsTNh.exe
  2⤵
  PID:3680
- C:\Windows\System\laDfhyo.exe
  C:\Windows\System\laDfhyo.exe
  2⤵
  PID:3740
- C:\Windows\System\vEzeaYm.exe
  C:\Windows\System\vEzeaYm.exe
  2⤵
  PID:3564
- C:\Windows\System\qsehetf.exe
  C:\Windows\System\qsehetf.exe
  2⤵
  PID:3676
- C:\Windows\System\qpYHqTC.exe
  C:\Windows\System\qpYHqTC.exe
  2⤵
  PID:4024
- C:\Windows\System\gJmsBTb.exe
  C:\Windows\System\gJmsBTb.exe
  2⤵
  PID:2056
- C:\Windows\System\GmQkJVB.exe
  C:\Windows\System\GmQkJVB.exe
  2⤵
  PID:4036
- C:\Windows\System\WJLSXCy.exe
  C:\Windows\System\WJLSXCy.exe
  2⤵
  PID:1676
- C:\Windows\System\ddcEgnn.exe
  C:\Windows\System\ddcEgnn.exe
  2⤵
  PID:3316
- C:\Windows\System\mIxCQte.exe
  C:\Windows\System\mIxCQte.exe
  2⤵
  PID:760
- C:\Windows\System\mHnSsVI.exe
  C:\Windows\System\mHnSsVI.exe
  2⤵
  PID:3600
- C:\Windows\System\DRBdISp.exe
  C:\Windows\System\DRBdISp.exe
  2⤵
  PID:3776
- C:\Windows\System\qrNIMrv.exe
  C:\Windows\System\qrNIMrv.exe
  2⤵
  PID:3064
- C:\Windows\System\AVCzpIc.exe
  C:\Windows\System\AVCzpIc.exe
  2⤵
  PID:3220
- C:\Windows\System\tljZXcU.exe
  C:\Windows\System\tljZXcU.exe
  2⤵
  PID:1648
- C:\Windows\System\TNxgMYB.exe
  C:\Windows\System\TNxgMYB.exe
  2⤵
  PID:3356
- C:\Windows\System\BPrNYmV.exe
  C:\Windows\System\BPrNYmV.exe
  2⤵
  PID:3476
- C:\Windows\System\ciilMFO.exe
  C:\Windows\System\ciilMFO.exe
  2⤵
  PID:3544
- C:\Windows\System\OYaRNQl.exe
  C:\Windows\System\OYaRNQl.exe
  2⤵
  PID:3656
- C:\Windows\System\DmtxDlA.exe
  C:\Windows\System\DmtxDlA.exe
  2⤵
  PID:3856
- C:\Windows\System\DuAdbwQ.exe
  C:\Windows\System\DuAdbwQ.exe
  2⤵
  PID:3824
- C:\Windows\System\dqxGLcj.exe
  C:\Windows\System\dqxGLcj.exe
  2⤵
  PID:424
- C:\Windows\System\mLvDDmK.exe
  C:\Windows\System\mLvDDmK.exe
  2⤵
  PID:572
- C:\Windows\System\VJRiYcT.exe
  C:\Windows\System\VJRiYcT.exe
  2⤵
  PID:2584
- C:\Windows\System\abOAQfJ.exe
  C:\Windows\System\abOAQfJ.exe
  2⤵
  PID:4100
- C:\Windows\System\hsenzZR.exe
  C:\Windows\System\hsenzZR.exe
  2⤵
  PID:4116
- C:\Windows\System\lmtxrGZ.exe
  C:\Windows\System\lmtxrGZ.exe
  2⤵
  PID:4132
- C:\Windows\System\nmESXpc.exe
  C:\Windows\System\nmESXpc.exe
  2⤵
  PID:4152
- C:\Windows\System\DlSKedZ.exe
  C:\Windows\System\DlSKedZ.exe
  2⤵
  PID:4168
- C:\Windows\System\IuoMwtL.exe
  C:\Windows\System\IuoMwtL.exe
  2⤵
  PID:4184
- C:\Windows\System\udNECFL.exe
  C:\Windows\System\udNECFL.exe
  2⤵
  PID:4200
- C:\Windows\System\UxkGTAJ.exe
  C:\Windows\System\UxkGTAJ.exe
  2⤵
  PID:4216
- C:\Windows\System\jnnshLh.exe
  C:\Windows\System\jnnshLh.exe
  2⤵
  PID:4244
- C:\Windows\System\fTffArf.exe
  C:\Windows\System\fTffArf.exe
  2⤵
  PID:4260
- C:\Windows\System\XbdurWT.exe
  C:\Windows\System\XbdurWT.exe
  2⤵
  PID:4276
- C:\Windows\System\zuPsJIP.exe
  C:\Windows\System\zuPsJIP.exe
  2⤵
  PID:4292
- C:\Windows\System\CVNvORc.exe
  C:\Windows\System\CVNvORc.exe
  2⤵
  PID:4308
- C:\Windows\System\eMEKSdR.exe
  C:\Windows\System\eMEKSdR.exe
  2⤵
  PID:4324
- C:\Windows\System\eBpNEOG.exe
  C:\Windows\System\eBpNEOG.exe
  2⤵
  PID:4340
- C:\Windows\System\eEsMUSU.exe
  C:\Windows\System\eEsMUSU.exe
  2⤵
  PID:4356
- C:\Windows\System\eCrYFrj.exe
  C:\Windows\System\eCrYFrj.exe
  2⤵
  PID:4372
- C:\Windows\System\YBMoIoV.exe
  C:\Windows\System\YBMoIoV.exe
  2⤵
  PID:4388
- C:\Windows\System\smXSOCD.exe
  C:\Windows\System\smXSOCD.exe
  2⤵
  PID:4524
- C:\Windows\System\rZOQiqZ.exe
  C:\Windows\System\rZOQiqZ.exe
  2⤵
  PID:4540
- C:\Windows\System\AXGjgtx.exe
  C:\Windows\System\AXGjgtx.exe
  2⤵
  PID:4556
- C:\Windows\System\JjWTsdP.exe
  C:\Windows\System\JjWTsdP.exe
  2⤵
  PID:4576
- C:\Windows\System\MjViuZc.exe
  C:\Windows\System\MjViuZc.exe
  2⤵
  PID:4592
- C:\Windows\System\dxCKbLa.exe
  C:\Windows\System\dxCKbLa.exe
  2⤵
  PID:4608
- C:\Windows\System\TpVpHeh.exe
  C:\Windows\System\TpVpHeh.exe
  2⤵
  PID:4628
- C:\Windows\System\MxTknIt.exe
  C:\Windows\System\MxTknIt.exe
  2⤵
  PID:4720
- C:\Windows\System\TUMaBYy.exe
  C:\Windows\System\TUMaBYy.exe
  2⤵
  PID:4736
- C:\Windows\System\rrqVDIb.exe
  C:\Windows\System\rrqVDIb.exe
  2⤵
  PID:4752
- C:\Windows\System\RcHieYD.exe
  C:\Windows\System\RcHieYD.exe
  2⤵
  PID:4780
- C:\Windows\System\LXoqToF.exe
  C:\Windows\System\LXoqToF.exe
  2⤵
  PID:4796
- C:\Windows\System\PTTZZDG.exe
  C:\Windows\System\PTTZZDG.exe
  2⤵
  PID:4812
- C:\Windows\System\xeHjvHm.exe
  C:\Windows\System\xeHjvHm.exe
  2⤵
  PID:4828
- C:\Windows\System\ZrhtEvM.exe
  C:\Windows\System\ZrhtEvM.exe
  2⤵
  PID:4844
- C:\Windows\System\nyHPwYN.exe
  C:\Windows\System\nyHPwYN.exe
  2⤵
  PID:4864
- C:\Windows\System\hlEVdYK.exe
  C:\Windows\System\hlEVdYK.exe
  2⤵
  PID:4884
- C:\Windows\System\BcJcxPp.exe
  C:\Windows\System\BcJcxPp.exe
  2⤵
  PID:4920
- C:\Windows\System\nNyFZUl.exe
  C:\Windows\System\nNyFZUl.exe
  2⤵
  PID:4936
- C:\Windows\System\QQVsomq.exe
  C:\Windows\System\QQVsomq.exe
  2⤵
  PID:4952
- C:\Windows\System\KQyMDcN.exe
  C:\Windows\System\KQyMDcN.exe
  2⤵
  PID:4968
- C:\Windows\System\EkQGNOV.exe
  C:\Windows\System\EkQGNOV.exe
  2⤵
  PID:4984
- C:\Windows\System\FgUJBnu.exe
  C:\Windows\System\FgUJBnu.exe
  2⤵
  PID:5020
- C:\Windows\System\cvksiGv.exe
  C:\Windows\System\cvksiGv.exe
  2⤵
  PID:5096
- C:\Windows\System\gAwKsGv.exe
  C:\Windows\System\gAwKsGv.exe
  2⤵
  PID:5116
- C:\Windows\System\bjiaqwT.exe
  C:\Windows\System\bjiaqwT.exe
  2⤵
  PID:3204
- C:\Windows\System\TWPDZlt.exe
  C:\Windows\System\TWPDZlt.exe
  2⤵
  PID:3404
- C:\Windows\System\nWfTrrJ.exe
  C:\Windows\System\nWfTrrJ.exe
  2⤵
  PID:4000
- C:\Windows\System\HwswTHL.exe
  C:\Windows\System\HwswTHL.exe
  2⤵
  PID:588
- C:\Windows\System\kMIluxQ.exe
  C:\Windows\System\kMIluxQ.exe
  2⤵
  PID:4144
- C:\Windows\System\oxrLWfi.exe
  C:\Windows\System\oxrLWfi.exe
  2⤵
  PID:4148
- C:\Windows\System\sSdlCAs.exe
  C:\Windows\System\sSdlCAs.exe
  2⤵
  PID:4192
- C:\Windows\System\RgHxqcZ.exe
  C:\Windows\System\RgHxqcZ.exe
  2⤵
  PID:4228
- C:\Windows\System\lnNLRcg.exe
  C:\Windows\System\lnNLRcg.exe
  2⤵
  PID:4288
- C:\Windows\System\oZWHsqw.exe
  C:\Windows\System\oZWHsqw.exe
  2⤵
  PID:4380
- C:\Windows\System\gsWaZBh.exe
  C:\Windows\System\gsWaZBh.exe
  2⤵
  PID:4300
- C:\Windows\System\EHZlwdb.exe
  C:\Windows\System\EHZlwdb.exe
  2⤵
  PID:4384
- C:\Windows\System\GEOlbAd.exe
  C:\Windows\System\GEOlbAd.exe
  2⤵
  PID:4400
- C:\Windows\System\aTFkmzC.exe
  C:\Windows\System\aTFkmzC.exe
  2⤵
  PID:4424
- C:\Windows\System\iXheJbn.exe
  C:\Windows\System\iXheJbn.exe
  2⤵
  PID:4444
- C:\Windows\System\GvKhGmq.exe
  C:\Windows\System\GvKhGmq.exe
  2⤵
  PID:4464
- C:\Windows\System\UvIGluG.exe
  C:\Windows\System\UvIGluG.exe
  2⤵
  PID:4476
- C:\Windows\System\XVOeCgB.exe
  C:\Windows\System\XVOeCgB.exe
  2⤵
  PID:4492
- C:\Windows\System\zqaoLvf.exe
  C:\Windows\System\zqaoLvf.exe
  2⤵
  PID:4508
- C:\Windows\System\oMIdROA.exe
  C:\Windows\System\oMIdROA.exe
  2⤵
  PID:4536
- C:\Windows\System\FzhfFbX.exe
  C:\Windows\System\FzhfFbX.exe
  2⤵
  PID:4552
- C:\Windows\System\XLfFSDV.exe
  C:\Windows\System\XLfFSDV.exe
  2⤵
  PID:4604
- C:\Windows\System\prcsMDj.exe
  C:\Windows\System\prcsMDj.exe
  2⤵
  PID:3324
- C:\Windows\System\TKdTrtI.exe
  C:\Windows\System\TKdTrtI.exe
  2⤵
  PID:4668
- C:\Windows\System\RGZiYdK.exe
  C:\Windows\System\RGZiYdK.exe
  2⤵
  PID:4712
- C:\Windows\System\bqirzAc.exe
  C:\Windows\System\bqirzAc.exe
  2⤵
  PID:4744
- C:\Windows\System\OnjAVVR.exe
  C:\Windows\System\OnjAVVR.exe
  2⤵
  PID:4748
- C:\Windows\System\kMXMCMw.exe
  C:\Windows\System\kMXMCMw.exe
  2⤵
  PID:4792
- C:\Windows\System\ugxyjxc.exe
  C:\Windows\System\ugxyjxc.exe
  2⤵
  PID:4824
- C:\Windows\System\LsUXAQP.exe
  C:\Windows\System\LsUXAQP.exe
  2⤵
  PID:4860
- C:\Windows\System\FkbCNry.exe
  C:\Windows\System\FkbCNry.exe
  2⤵
  PID:5008
- C:\Windows\System\ydgjVbk.exe
  C:\Windows\System\ydgjVbk.exe
  2⤵
  PID:4960
- C:\Windows\System\FCMDbER.exe
  C:\Windows\System\FCMDbER.exe
  2⤵
  PID:5056
- C:\Windows\System\xdWQvjP.exe
  C:\Windows\System\xdWQvjP.exe
  2⤵
  PID:5072
- C:\Windows\System\BFWrqRk.exe
  C:\Windows\System\BFWrqRk.exe
  2⤵
  PID:5088
- C:\Windows\System\GSpqvgV.exe
  C:\Windows\System\GSpqvgV.exe
  2⤵
  PID:5104
- C:\Windows\System\jKKOJvc.exe
  C:\Windows\System\jKKOJvc.exe
  2⤵
  PID:3936
- C:\Windows\System\nPwPpJc.exe
  C:\Windows\System\nPwPpJc.exe
  2⤵
  PID:3996
- C:\Windows\System\HQOJgAN.exe
  C:\Windows\System\HQOJgAN.exe
  2⤵
  PID:4108
- C:\Windows\System\DboLtbO.exe
  C:\Windows\System\DboLtbO.exe
  2⤵
  PID:3456
- C:\Windows\System\rpVYXHe.exe
  C:\Windows\System\rpVYXHe.exe
  2⤵
  PID:4912
- C:\Windows\System\ddIIwKw.exe
  C:\Windows\System\ddIIwKw.exe
  2⤵
  PID:3536
- C:\Windows\System\KExKwlX.exe
  C:\Windows\System\KExKwlX.exe
  2⤵
  PID:2832
- C:\Windows\System\sOFJVsS.exe
  C:\Windows\System\sOFJVsS.exe
  2⤵
  PID:3836
- C:\Windows\System\uiRXcxe.exe
  C:\Windows\System\uiRXcxe.exe
  2⤵
  PID:4060
- C:\Windows\System\PMSKAPG.exe
  C:\Windows\System\PMSKAPG.exe
  2⤵
  PID:4404
- C:\Windows\System\htmmUVt.exe
  C:\Windows\System\htmmUVt.exe
  2⤵
  PID:3956
- C:\Windows\System\BBPWdJi.exe
  C:\Windows\System\BBPWdJi.exe
  2⤵
  PID:4332
- C:\Windows\System\RdnZrbv.exe
  C:\Windows\System\RdnZrbv.exe
  2⤵
  PID:4572
- C:\Windows\System\blbIzUE.exe
  C:\Windows\System\blbIzUE.exe
  2⤵
  PID:4708
- C:\Windows\System\dGxGEke.exe
  C:\Windows\System\dGxGEke.exe
  2⤵
  PID:4484
- C:\Windows\System\kmwwvLU.exe
  C:\Windows\System\kmwwvLU.exe
  2⤵
  PID:4764
- C:\Windows\System\aTIXWDr.exe
  C:\Windows\System\aTIXWDr.exe
  2⤵
  PID:4520
- C:\Windows\System\HHwGoYO.exe
  C:\Windows\System\HHwGoYO.exe
  2⤵
  PID:4588
- C:\Windows\System\cRKXMIZ.exe
  C:\Windows\System\cRKXMIZ.exe
  2⤵
  PID:4272
- C:\Windows\System\nkYdZAr.exe
  C:\Windows\System\nkYdZAr.exe
  2⤵
  PID:4480
- C:\Windows\System\yLOSyDY.exe
  C:\Windows\System\yLOSyDY.exe
  2⤵
  PID:4728
- C:\Windows\System\jqeUPoC.exe
  C:\Windows\System\jqeUPoC.exe
  2⤵
  PID:4900
- C:\Windows\System\kLaAQhj.exe
  C:\Windows\System\kLaAQhj.exe
  2⤵
  PID:4980
- C:\Windows\System\lAuHFJF.exe
  C:\Windows\System\lAuHFJF.exe
  2⤵
  PID:5004
- C:\Windows\System\FkbmZVA.exe
  C:\Windows\System\FkbmZVA.exe
  2⤵
  PID:4880
- C:\Windows\System\YQUOwYJ.exe
  C:\Windows\System\YQUOwYJ.exe
  2⤵
  PID:4772
- C:\Windows\System\tOvMXKQ.exe
  C:\Windows\System\tOvMXKQ.exe
  2⤵
  PID:1924
- C:\Windows\System\RDVPpZA.exe
  C:\Windows\System\RDVPpZA.exe
  2⤵
  PID:4208
- C:\Windows\System\WwsQyGw.exe
  C:\Windows\System\WwsQyGw.exe
  2⤵
  PID:4160
- C:\Windows\System\hIXYNxR.exe
  C:\Windows\System\hIXYNxR.exe
  2⤵
  PID:4196
- C:\Windows\System\arpXXEn.exe
  C:\Windows\System\arpXXEn.exe
  2⤵
  PID:4416
- C:\Windows\System\SALryEf.exe
  C:\Windows\System\SALryEf.exe
  2⤵
  PID:4488
- C:\Windows\System\BijYcGh.exe
  C:\Windows\System\BijYcGh.exe
  2⤵
  PID:4948
- C:\Windows\System\FLGRUny.exe
  C:\Windows\System\FLGRUny.exe
  2⤵
  PID:4964
- C:\Windows\System\Fzlejpf.exe
  C:\Windows\System\Fzlejpf.exe
  2⤵
  PID:5040
- C:\Windows\System\ghdtKJS.exe
  C:\Windows\System\ghdtKJS.exe
  2⤵
  PID:4176
- C:\Windows\System\pixArpB.exe
  C:\Windows\System\pixArpB.exe
  2⤵
  PID:4016
- C:\Windows\System\VfESpzI.exe
  C:\Windows\System\VfESpzI.exe
  2⤵
  PID:4420
- C:\Windows\System\kHjdgwo.exe
  C:\Windows\System\kHjdgwo.exe
  2⤵
  PID:5112
- C:\Windows\System\RrevqKA.exe
  C:\Windows\System\RrevqKA.exe
  2⤵
  PID:4224
- C:\Windows\System\lyIrDmV.exe
  C:\Windows\System\lyIrDmV.exe
  2⤵
  PID:5124
- C:\Windows\System\yFmWPHQ.exe
  C:\Windows\System\yFmWPHQ.exe
  2⤵
  PID:5140
- C:\Windows\System\SfQxbME.exe
  C:\Windows\System\SfQxbME.exe
  2⤵
  PID:5160
- C:\Windows\System\vmoNtuN.exe
  C:\Windows\System\vmoNtuN.exe
  2⤵
  PID:5176
- C:\Windows\System\zFXmnTp.exe
  C:\Windows\System\zFXmnTp.exe
  2⤵
  PID:5192
- C:\Windows\System\OEgEzrI.exe
  C:\Windows\System\OEgEzrI.exe
  2⤵
  PID:5208
- C:\Windows\System\NJnyVjC.exe
  C:\Windows\System\NJnyVjC.exe
  2⤵
  PID:5228
- C:\Windows\System\LCgBqqC.exe
  C:\Windows\System\LCgBqqC.exe
  2⤵
  PID:5244
- C:\Windows\System\KoLRxfG.exe
  C:\Windows\System\KoLRxfG.exe
  2⤵
  PID:5260
- C:\Windows\System\GwfekPd.exe
  C:\Windows\System\GwfekPd.exe
  2⤵
  PID:5276
- C:\Windows\System\LSdfCpL.exe
  C:\Windows\System\LSdfCpL.exe
  2⤵
  PID:5296
- C:\Windows\System\FtqIkRW.exe
  C:\Windows\System\FtqIkRW.exe
  2⤵
  PID:5364
- C:\Windows\System\VfZwVxS.exe
  C:\Windows\System\VfZwVxS.exe
  2⤵
  PID:5380
- C:\Windows\System\gbTgGcW.exe
  C:\Windows\System\gbTgGcW.exe
  2⤵
  PID:5396
- C:\Windows\System\AvuUMiR.exe
  C:\Windows\System\AvuUMiR.exe
  2⤵
  PID:5412
- C:\Windows\System\QhIONDf.exe
  C:\Windows\System\QhIONDf.exe
  2⤵
  PID:5432
- C:\Windows\System\xWHnuHL.exe
  C:\Windows\System\xWHnuHL.exe
  2⤵
  PID:5448
- C:\Windows\System\hKYByWu.exe
  C:\Windows\System\hKYByWu.exe
  2⤵
  PID:5464
- C:\Windows\System\VVSnuzX.exe
  C:\Windows\System\VVSnuzX.exe
  2⤵
  PID:5480
- C:\Windows\System\QusEthw.exe
  C:\Windows\System\QusEthw.exe
  2⤵
  PID:5504
- C:\Windows\System\BbgBBBo.exe
  C:\Windows\System\BbgBBBo.exe
  2⤵
  PID:5576
- C:\Windows\System\ZnJdXSC.exe
  C:\Windows\System\ZnJdXSC.exe
  2⤵
  PID:5592
- C:\Windows\System\QxZaLbU.exe
  C:\Windows\System\QxZaLbU.exe
  2⤵
  PID:5608
- C:\Windows\System\gZoaptV.exe
  C:\Windows\System\gZoaptV.exe
  2⤵
  PID:5624
- C:\Windows\System\hwVsIBj.exe
  C:\Windows\System\hwVsIBj.exe
  2⤵
  PID:5640
- C:\Windows\System\tlgstTz.exe
  C:\Windows\System\tlgstTz.exe
  2⤵
  PID:5656
- C:\Windows\System\lmGybgP.exe
  C:\Windows\System\lmGybgP.exe
  2⤵
  PID:5672
- C:\Windows\System\KfLFWMM.exe
  C:\Windows\System\KfLFWMM.exe
  2⤵
  PID:5688
- C:\Windows\System\OTECZJH.exe
  C:\Windows\System\OTECZJH.exe
  2⤵
  PID:5704
- C:\Windows\System\mbGGrzp.exe
  C:\Windows\System\mbGGrzp.exe
  2⤵
  PID:5724
- C:\Windows\System\xIwqFHn.exe
  C:\Windows\System\xIwqFHn.exe
  2⤵
  PID:5740
- C:\Windows\System\GyIeBTF.exe
  C:\Windows\System\GyIeBTF.exe
  2⤵
  PID:5768
- C:\Windows\System\DCxZnGu.exe
  C:\Windows\System\DCxZnGu.exe
  2⤵
  PID:5784
- C:\Windows\System\ahfByPV.exe
  C:\Windows\System\ahfByPV.exe
  2⤵
  PID:5812
- C:\Windows\System\AAPniac.exe
  C:\Windows\System\AAPniac.exe
  2⤵
  PID:5832
- C:\Windows\System\oOgOLsW.exe
  C:\Windows\System\oOgOLsW.exe
  2⤵
  PID:5848
- C:\Windows\System\BfrYzFd.exe
  C:\Windows\System\BfrYzFd.exe
  2⤵
  PID:5864
- C:\Windows\System\MCQTIJr.exe
  C:\Windows\System\MCQTIJr.exe
  2⤵
  PID:5896
- C:\Windows\System\sWDbzpL.exe
  C:\Windows\System\sWDbzpL.exe
  2⤵
  PID:5912
- C:\Windows\System\GAsyAnT.exe
  C:\Windows\System\GAsyAnT.exe
  2⤵
  PID:5932
- C:\Windows\System\iAGbSMc.exe
  C:\Windows\System\iAGbSMc.exe
  2⤵
  PID:5948
- C:\Windows\System\rhVWQeB.exe
  C:\Windows\System\rhVWQeB.exe
  2⤵
  PID:5964
- C:\Windows\System\nKRKHkH.exe
  C:\Windows\System\nKRKHkH.exe
  2⤵
  PID:5980
- C:\Windows\System\JoOlIxT.exe
  C:\Windows\System\JoOlIxT.exe
  2⤵
  PID:5996
- C:\Windows\System\ajhSTzN.exe
  C:\Windows\System\ajhSTzN.exe
  2⤵
  PID:6016
- C:\Windows\System\czkczxJ.exe
  C:\Windows\System\czkczxJ.exe
  2⤵
  PID:6032
- C:\Windows\System\cxsNjhr.exe
  C:\Windows\System\cxsNjhr.exe
  2⤵
  PID:6048
- C:\Windows\System\eWghvSS.exe
  C:\Windows\System\eWghvSS.exe
  2⤵
  PID:6064
- C:\Windows\System\mgoHrCW.exe
  C:\Windows\System\mgoHrCW.exe
  2⤵
  PID:6080
- C:\Windows\System\eZoJfFl.exe
  C:\Windows\System\eZoJfFl.exe
  2⤵
  PID:6100
- C:\Windows\System\VGCTHiB.exe
  C:\Windows\System\VGCTHiB.exe
  2⤵
  PID:6120
- C:\Windows\System\hmQFsLY.exe
  C:\Windows\System\hmQFsLY.exe
  2⤵
  PID:6136
- C:\Windows\System\DeSeeAu.exe
  C:\Windows\System\DeSeeAu.exe
  2⤵
  PID:4620
- C:\Windows\System\CkYCcXv.exe
  C:\Windows\System\CkYCcXv.exe
  2⤵
  PID:4624
- C:\Windows\System\ujkIWKz.exe
  C:\Windows\System\ujkIWKz.exe
  2⤵
  PID:4432
- C:\Windows\System\gWulRpb.exe
  C:\Windows\System\gWulRpb.exe
  2⤵
  PID:4992
- C:\Windows\System\PTqsAlh.exe
  C:\Windows\System\PTqsAlh.exe
  2⤵
  PID:5080
- C:\Windows\System\hmTJeKj.exe
  C:\Windows\System\hmTJeKj.exe
  2⤵
  PID:5108
- C:\Windows\System\QFLdhjI.exe
  C:\Windows\System\QFLdhjI.exe
  2⤵
  PID:5152
- C:\Windows\System\vZUBRIG.exe
  C:\Windows\System\vZUBRIG.exe
  2⤵
  PID:5156
- C:\Windows\System\HyPkFWf.exe
  C:\Windows\System\HyPkFWf.exe
  2⤵
  PID:5220
- C:\Windows\System\agjyVKw.exe
  C:\Windows\System\agjyVKw.exe
  2⤵
  PID:5288
- C:\Windows\System\gdJBxBz.exe
  C:\Windows\System\gdJBxBz.exe
  2⤵
  PID:5132
- C:\Windows\System\XkKnLzB.exe
  C:\Windows\System\XkKnLzB.exe
  2⤵
  PID:3756
- C:\Windows\System\gUyRtBo.exe
  C:\Windows\System\gUyRtBo.exe
  2⤵
  PID:5272
- C:\Windows\System\kNaOFbr.exe
  C:\Windows\System\kNaOFbr.exe
  2⤵
  PID:3976
- C:\Windows\System\wgJQFcj.exe
  C:\Windows\System\wgJQFcj.exe
  2⤵
  PID:4916
- C:\Windows\System\whPerkQ.exe
  C:\Windows\System\whPerkQ.exe
  2⤵
  PID:5236
- C:\Windows\System\YkwUhnd.exe
  C:\Windows\System\YkwUhnd.exe
  2⤵
  PID:5312
- C:\Windows\System\yDITCzD.exe
  C:\Windows\System\yDITCzD.exe
  2⤵
  PID:5332
- C:\Windows\System\oxeByhJ.exe
  C:\Windows\System\oxeByhJ.exe
  2⤵
  PID:5404
- C:\Windows\System\lacQsCC.exe
  C:\Windows\System\lacQsCC.exe
  2⤵
  PID:5352
- C:\Windows\System\rspnOeY.exe
  C:\Windows\System\rspnOeY.exe
  2⤵
  PID:5472
- C:\Windows\System\ffvFOiO.exe
  C:\Windows\System\ffvFOiO.exe
  2⤵
  PID:5428
- C:\Windows\System\fkxagyT.exe
  C:\Windows\System\fkxagyT.exe
  2⤵
  PID:5496
- C:\Windows\System\zYRnYHM.exe
  C:\Windows\System\zYRnYHM.exe
  2⤵
  PID:5524
- C:\Windows\System\gCgRRtX.exe
  C:\Windows\System\gCgRRtX.exe
  2⤵
  PID:5540
- C:\Windows\System\wHGyTez.exe
  C:\Windows\System\wHGyTez.exe
  2⤵
  PID:5560
- C:\Windows\System\STahhdQ.exe
  C:\Windows\System\STahhdQ.exe
  2⤵
  PID:5780
- C:\Windows\System\zLkUZhv.exe
  C:\Windows\System\zLkUZhv.exe
  2⤵
  PID:5828
- C:\Windows\System\MMKUTmB.exe
  C:\Windows\System\MMKUTmB.exe
  2⤵
  PID:5792
- C:\Windows\System\CKzlRTy.exe
  C:\Windows\System\CKzlRTy.exe
  2⤵
  PID:5904
- C:\Windows\System\UJxHXvd.exe
  C:\Windows\System\UJxHXvd.exe
  2⤵
  PID:5892
- C:\Windows\System\zvhqzFY.exe
  C:\Windows\System\zvhqzFY.exe
  2⤵
  PID:5924
- C:\Windows\System\QajerBB.exe
  C:\Windows\System\QajerBB.exe
  2⤵
  PID:5972
- C:\Windows\System\lqRnEqU.exe
  C:\Windows\System\lqRnEqU.exe
  2⤵
  PID:6072
- C:\Windows\System\zBAVvCO.exe
  C:\Windows\System\zBAVvCO.exe
  2⤵
  PID:6092
- C:\Windows\System\sNqFQua.exe
  C:\Windows\System\sNqFQua.exe
  2⤵
  PID:6024
- C:\Windows\System\LRZedgJ.exe
  C:\Windows\System\LRZedgJ.exe
  2⤵
  PID:6116
- C:\Windows\System\xtzYdwj.exe
  C:\Windows\System\xtzYdwj.exe
  2⤵
  PID:3904
- C:\Windows\System\phORfTS.exe
  C:\Windows\System\phORfTS.exe
  2⤵
  PID:4840
- C:\Windows\System\VrKQeMK.exe
  C:\Windows\System\VrKQeMK.exe
  2⤵
  PID:5148
- C:\Windows\System\vLqzvRR.exe
  C:\Windows\System\vLqzvRR.exe
  2⤵
  PID:5168
- C:\Windows\System\QkCQnXC.exe
  C:\Windows\System\QkCQnXC.exe
  2⤵
  PID:4408
- C:\Windows\System\DUFGJKl.exe
  C:\Windows\System\DUFGJKl.exe
  2⤵
  PID:5348
- C:\Windows\System\WsaWppJ.exe
  C:\Windows\System\WsaWppJ.exe
  2⤵
  PID:5376
- C:\Windows\System\IZHbBMM.exe
  C:\Windows\System\IZHbBMM.exe
  2⤵
  PID:5456
- C:\Windows\System\PoXLUjt.exe
  C:\Windows\System\PoXLUjt.exe
  2⤵
  PID:5200
- C:\Windows\System\RDIXYur.exe
  C:\Windows\System\RDIXYur.exe
  2⤵
  PID:5388
- C:\Windows\System\DXNfAgA.exe
  C:\Windows\System\DXNfAgA.exe
  2⤵
  PID:5420
- C:\Windows\System\bsqZvDQ.exe
  C:\Windows\System\bsqZvDQ.exe
  2⤵
  PID:5284
- C:\Windows\System\KyuemcC.exe
  C:\Windows\System\KyuemcC.exe
  2⤵
  PID:5536
- C:\Windows\System\ONCwIkX.exe
  C:\Windows\System\ONCwIkX.exe
  2⤵
  PID:5548
- C:\Windows\System\HurjyjQ.exe
  C:\Windows\System\HurjyjQ.exe
  2⤵
  PID:5652
- C:\Windows\System\bQtbxLD.exe
  C:\Windows\System\bQtbxLD.exe
  2⤵
  PID:5604
- C:\Windows\System\lJigorx.exe
  C:\Windows\System\lJigorx.exe
  2⤵
  PID:5736
- C:\Windows\System\IMmbvLS.exe
  C:\Windows\System\IMmbvLS.exe
  2⤵
  PID:5716
- C:\Windows\System\LHhKtEm.exe
  C:\Windows\System\LHhKtEm.exe
  2⤵
  PID:5720
- C:\Windows\System\PJYoMzO.exe
  C:\Windows\System\PJYoMzO.exe
  2⤵
  PID:5764
- C:\Windows\System\YzHcxYA.exe
  C:\Windows\System\YzHcxYA.exe
  2⤵
  PID:5872
- C:\Windows\System\gLjmnfO.exe
  C:\Windows\System\gLjmnfO.exe
  2⤵
  PID:6008
- C:\Windows\System\CZKegut.exe
  C:\Windows\System\CZKegut.exe
  2⤵
  PID:6040
- C:\Windows\System\fwpdDkv.exe
  C:\Windows\System\fwpdDkv.exe
  2⤵
  PID:6088
- C:\Windows\System\hwiieGS.exe
  C:\Windows\System\hwiieGS.exe
  2⤵
  PID:5988
- C:\Windows\System\OZvkxtL.exe
  C:\Windows\System\OZvkxtL.exe
  2⤵
  PID:6096
- C:\Windows\System\agrvlxn.exe
  C:\Windows\System\agrvlxn.exe
  2⤵
  PID:4268
- C:\Windows\System\TqvaumF.exe
  C:\Windows\System\TqvaumF.exe
  2⤵
  PID:3164
- C:\Windows\System\IBTEMvI.exe
  C:\Windows\System\IBTEMvI.exe
  2⤵
  PID:5036
- C:\Windows\System\VzhJzHz.exe
  C:\Windows\System\VzhJzHz.exe
  2⤵
  PID:5204
- C:\Windows\System\XNcFsOZ.exe
  C:\Windows\System\XNcFsOZ.exe
  2⤵
  PID:2380
- C:\Windows\System\wlbViFt.exe
  C:\Windows\System\wlbViFt.exe
  2⤵
  PID:3800
- C:\Windows\System\ersQIlS.exe
  C:\Windows\System\ersQIlS.exe
  2⤵
  PID:5556
- C:\Windows\System\RRAAnol.exe
  C:\Windows\System\RRAAnol.exe
  2⤵
  PID:5684
- C:\Windows\System\DdRWFEs.exe
  C:\Windows\System\DdRWFEs.exe
  2⤵
  PID:5048
- C:\Windows\System\zNQyfKu.exe
  C:\Windows\System\zNQyfKu.exe
  2⤵
  PID:5920
- C:\Windows\System\AdgvnWy.exe
  C:\Windows\System\AdgvnWy.exe
  2⤵
  PID:5928
- C:\Windows\System\IroZPPl.exe
  C:\Windows\System\IroZPPl.exe
  2⤵
  PID:5752
- C:\Windows\System\AqiiBDY.exe
  C:\Windows\System\AqiiBDY.exe
  2⤵
  PID:4872
- C:\Windows\System\DqGfmOW.exe
  C:\Windows\System\DqGfmOW.exe
  2⤵
  PID:5944
- C:\Windows\System\YyGGfbX.exe
  C:\Windows\System\YyGGfbX.exe
  2⤵
  PID:5824
- C:\Windows\System\HiiMTUD.exe
  C:\Windows\System\HiiMTUD.exe
  2⤵
  PID:5620
- C:\Windows\System\FsbHSXa.exe
  C:\Windows\System\FsbHSXa.exe
  2⤵
  PID:5960
- C:\Windows\System\vCZojem.exe
  C:\Windows\System\vCZojem.exe
  2⤵
  PID:5700
- C:\Windows\System\xhEXXVq.exe
  C:\Windows\System\xhEXXVq.exe
  2⤵
  PID:4364
- C:\Windows\System\ynFYIxm.exe
  C:\Windows\System\ynFYIxm.exe
  2⤵
  PID:3840
- C:\Windows\System\BYSyyef.exe
  C:\Windows\System\BYSyyef.exe
  2⤵
  PID:5392
- C:\Windows\System\XxReKlV.exe
  C:\Windows\System\XxReKlV.exe
  2⤵
  PID:5600
- C:\Windows\System\GLZDgJV.exe
  C:\Windows\System\GLZDgJV.exe
  2⤵
  PID:5356
- C:\Windows\System\GzkjRHl.exe
  C:\Windows\System\GzkjRHl.exe
  2⤵
  PID:4976
- C:\Windows\System\eXYGujA.exe
  C:\Windows\System\eXYGujA.exe
  2⤵
  PID:6028
- C:\Windows\System\ULqlClq.exe
  C:\Windows\System\ULqlClq.exe
  2⤵
  PID:5940
- C:\Windows\System\IHFZeab.exe
  C:\Windows\System\IHFZeab.exe
  2⤵
  PID:5572
- C:\Windows\System\kToXgCr.exe
  C:\Windows\System\kToXgCr.exe
  2⤵
  PID:4820
- C:\Windows\System\nnfMpwo.exe
  C:\Windows\System\nnfMpwo.exe
  2⤵
  PID:5372
- C:\Windows\System\rFSyOAy.exe
  C:\Windows\System\rFSyOAy.exe
  2⤵
  PID:5756
- C:\Windows\System\QkhwAUY.exe
  C:\Windows\System\QkhwAUY.exe
  2⤵
  PID:5840
- C:\Windows\System\QaGtsWc.exe
  C:\Windows\System\QaGtsWc.exe
  2⤵
  PID:5256
- C:\Windows\System\qbDBHPj.exe
  C:\Windows\System\qbDBHPj.exe
  2⤵
  PID:5476
- C:\Windows\System\tflxOYC.exe
  C:\Windows\System\tflxOYC.exe
  2⤵
  PID:4896
- C:\Windows\System\MImeIcM.exe
  C:\Windows\System\MImeIcM.exe
  2⤵
  PID:5532
- C:\Windows\System\HFdkdzP.exe
  C:\Windows\System\HFdkdzP.exe
  2⤵
  PID:5500
- C:\Windows\System\PcvDbaU.exe
  C:\Windows\System\PcvDbaU.exe
  2⤵
  PID:5668
- C:\Windows\System\cWGxUtm.exe
  C:\Windows\System\cWGxUtm.exe
  2⤵
  PID:6160
- C:\Windows\System\QTeGBJs.exe
  C:\Windows\System\QTeGBJs.exe
  2⤵
  PID:6176
- C:\Windows\System\XFNePOS.exe
  C:\Windows\System\XFNePOS.exe
  2⤵
  PID:6192
- C:\Windows\System\gWDvjZS.exe
  C:\Windows\System\gWDvjZS.exe
  2⤵
  PID:6208
- C:\Windows\System\SwDCJuN.exe
  C:\Windows\System\SwDCJuN.exe
  2⤵
  PID:6224
- C:\Windows\System\lZvrmEO.exe
  C:\Windows\System\lZvrmEO.exe
  2⤵
  PID:6240
- C:\Windows\System\FgXPjLm.exe
  C:\Windows\System\FgXPjLm.exe
  2⤵
  PID:6256
- C:\Windows\System\QXrxoTu.exe
  C:\Windows\System\QXrxoTu.exe
  2⤵
  PID:6272
- C:\Windows\System\lFVeZna.exe
  C:\Windows\System\lFVeZna.exe
  2⤵
  PID:6288
- C:\Windows\System\eAmLmzx.exe
  C:\Windows\System\eAmLmzx.exe
  2⤵
  PID:6304
- C:\Windows\System\kxVJaGD.exe
  C:\Windows\System\kxVJaGD.exe
  2⤵
  PID:6320
- C:\Windows\System\OTsFaqO.exe
  C:\Windows\System\OTsFaqO.exe
  2⤵
  PID:6336
- C:\Windows\System\fGwFrlE.exe
  C:\Windows\System\fGwFrlE.exe
  2⤵
  PID:6372
- C:\Windows\System\wTymaVj.exe
  C:\Windows\System\wTymaVj.exe
  2⤵
  PID:6388
- C:\Windows\System\RUHJMtu.exe
  C:\Windows\System\RUHJMtu.exe
  2⤵
  PID:6404
- C:\Windows\System\mbZmYuJ.exe
  C:\Windows\System\mbZmYuJ.exe
  2⤵
  PID:6424
- C:\Windows\System\clyEdEK.exe
  C:\Windows\System\clyEdEK.exe
  2⤵
  PID:6440
- C:\Windows\System\FCXFdwO.exe
  C:\Windows\System\FCXFdwO.exe
  2⤵
  PID:6456
- C:\Windows\System\sEvoLab.exe
  C:\Windows\System\sEvoLab.exe
  2⤵
  PID:6472
- C:\Windows\System\qNJEAIU.exe
  C:\Windows\System\qNJEAIU.exe
  2⤵
  PID:6492
- C:\Windows\System\fMOFJup.exe
  C:\Windows\System\fMOFJup.exe
  2⤵
  PID:6512
- C:\Windows\System\JDTZNVy.exe
  C:\Windows\System\JDTZNVy.exe
  2⤵
  PID:6532
- C:\Windows\System\xMbsdCw.exe
  C:\Windows\System\xMbsdCw.exe
  2⤵
  PID:6552
- C:\Windows\System\zGTRGGA.exe
  C:\Windows\System\zGTRGGA.exe
  2⤵
  PID:6576
- C:\Windows\System\MzsLBYE.exe
  C:\Windows\System\MzsLBYE.exe
  2⤵
  PID:6592
- C:\Windows\System\vJASRvw.exe
  C:\Windows\System\vJASRvw.exe
  2⤵
  PID:6608
- C:\Windows\System\aNosWkn.exe
  C:\Windows\System\aNosWkn.exe
  2⤵
  PID:6624
- C:\Windows\System\MzMCQGC.exe
  C:\Windows\System\MzMCQGC.exe
  2⤵
  PID:6640
- C:\Windows\System\lsDZGoB.exe
  C:\Windows\System\lsDZGoB.exe
  2⤵
  PID:6664
- C:\Windows\System\SdOjbMN.exe
  C:\Windows\System\SdOjbMN.exe
  2⤵
  PID:6680
- C:\Windows\System\dPujOwy.exe
  C:\Windows\System\dPujOwy.exe
  2⤵
  PID:6700
- C:\Windows\System\tWRfDik.exe
  C:\Windows\System\tWRfDik.exe
  2⤵
  PID:6728
- C:\Windows\System\aiUjGTj.exe
  C:\Windows\System\aiUjGTj.exe
  2⤵
  PID:6744
- C:\Windows\System\adQKqIt.exe
  C:\Windows\System\adQKqIt.exe
  2⤵
  PID:6760
- C:\Windows\System\ImlohJD.exe
  C:\Windows\System\ImlohJD.exe
  2⤵
  PID:6776
- C:\Windows\System\CweoUei.exe
  C:\Windows\System\CweoUei.exe
  2⤵
  PID:6792
- C:\Windows\System\JBxDZbi.exe
  C:\Windows\System\JBxDZbi.exe
  2⤵
  PID:6808
- C:\Windows\System\dCpcCME.exe
  C:\Windows\System\dCpcCME.exe
  2⤵
  PID:6840
- C:\Windows\System\JEhbUHu.exe
  C:\Windows\System\JEhbUHu.exe
  2⤵
  PID:6864
- C:\Windows\System\bvscLvE.exe
  C:\Windows\System\bvscLvE.exe
  2⤵
  PID:6880
- C:\Windows\System\KnHHxYH.exe
  C:\Windows\System\KnHHxYH.exe
  2⤵
  PID:6896
- C:\Windows\System\KBUPZOs.exe
  C:\Windows\System\KBUPZOs.exe
  2⤵
  PID:6912
- C:\Windows\System\irBUyQc.exe
  C:\Windows\System\irBUyQc.exe
  2⤵
  PID:6928
- C:\Windows\System\GiEpYcv.exe
  C:\Windows\System\GiEpYcv.exe
  2⤵
  PID:6944
- C:\Windows\System\YNAYuGl.exe
  C:\Windows\System\YNAYuGl.exe
  2⤵
  PID:6960
- C:\Windows\System\NrWXycP.exe
  C:\Windows\System\NrWXycP.exe
  2⤵
  PID:6992
- C:\Windows\System\RqyYoKj.exe
  C:\Windows\System\RqyYoKj.exe
  2⤵
  PID:7060
- C:\Windows\System\vLAfARO.exe
  C:\Windows\System\vLAfARO.exe
  2⤵
  PID:7164
- C:\Windows\System\oMOqrnK.exe
  C:\Windows\System\oMOqrnK.exe
  2⤵
  PID:6172
- C:\Windows\System\TlLzWgB.exe
  C:\Windows\System\TlLzWgB.exe
  2⤵
  PID:6204
- C:\Windows\System\msLyDfg.exe
  C:\Windows\System\msLyDfg.exe
  2⤵
  PID:6248
- C:\Windows\System\gVhGaQc.exe
  C:\Windows\System\gVhGaQc.exe
  2⤵
  PID:6284
- C:\Windows\System\TdnAQQt.exe
  C:\Windows\System\TdnAQQt.exe
  2⤵
  PID:6316
- C:\Windows\System\tTusfUT.exe
  C:\Windows\System\tTusfUT.exe
  2⤵
  PID:6368
- C:\Windows\System\OeblSsl.exe
  C:\Windows\System\OeblSsl.exe
  2⤵
  PID:6360
- C:\Windows\System\WhRuFlW.exe
  C:\Windows\System\WhRuFlW.exe
  2⤵
  PID:6464
- C:\Windows\System\mKEYcim.exe
  C:\Windows\System\mKEYcim.exe
  2⤵
  PID:6540
- C:\Windows\System\ZDLRLYb.exe
  C:\Windows\System\ZDLRLYb.exe
  2⤵
  PID:6588
- C:\Windows\System\TtbTNIk.exe
  C:\Windows\System\TtbTNIk.exe
  2⤵
  PID:6652
- C:\Windows\System\WLTYhOp.exe
  C:\Windows\System\WLTYhOp.exe
  2⤵
  PID:6692
- C:\Windows\System\ntzDYop.exe
  C:\Windows\System\ntzDYop.exe
  2⤵
  PID:6736
- C:\Windows\System\omApqkA.exe
  C:\Windows\System\omApqkA.exe
  2⤵
  PID:6412
- C:\Windows\System\DxkIFGX.exe
  C:\Windows\System\DxkIFGX.exe
  2⤵
  PID:6568
- C:\Windows\System\cnknzas.exe
  C:\Windows\System\cnknzas.exe
  2⤵
  PID:6632
- C:\Windows\System\WXIJVQe.exe
  C:\Windows\System\WXIJVQe.exe
  2⤵
  PID:6712
- C:\Windows\System\BCLjWCy.exe
  C:\Windows\System\BCLjWCy.exe
  2⤵
  PID:6768
- C:\Windows\System\DjXKnYn.exe
  C:\Windows\System\DjXKnYn.exe
  2⤵
  PID:6800
- C:\Windows\System\kuFzLoZ.exe
  C:\Windows\System\kuFzLoZ.exe
  2⤵
  PID:6852
- C:\Windows\System\nXLMfut.exe
  C:\Windows\System\nXLMfut.exe
  2⤵
  PID:6816
- C:\Windows\System\jhRGXfu.exe
  C:\Windows\System\jhRGXfu.exe
  2⤵
  PID:6828
- C:\Windows\System\jjOUbGz.exe
  C:\Windows\System\jjOUbGz.exe
  2⤵
  PID:6908
- C:\Windows\System\YZnWopZ.exe
  C:\Windows\System\YZnWopZ.exe
  2⤵
  PID:6936
- C:\Windows\System\SsJpaBb.exe
  C:\Windows\System\SsJpaBb.exe
  2⤵
  PID:6972
- C:\Windows\System\YiciIGH.exe
  C:\Windows\System\YiciIGH.exe
  2⤵
  PID:6988
- C:\Windows\System\BMQRpaI.exe
  C:\Windows\System\BMQRpaI.exe
  2⤵
  PID:7012
- C:\Windows\System\lPQvPaq.exe
  C:\Windows\System\lPQvPaq.exe
  2⤵
  PID:7020
- C:\Windows\System\dKpMkyd.exe
  C:\Windows\System\dKpMkyd.exe
  2⤵
  PID:7044
- C:\Windows\System\uaaqoPE.exe
  C:\Windows\System\uaaqoPE.exe
  2⤵
  PID:7068
- C:\Windows\System\TuIEBXx.exe
  C:\Windows\System\TuIEBXx.exe
  2⤵
  PID:7084
- C:\Windows\System\HdSkLRo.exe
  C:\Windows\System\HdSkLRo.exe
  2⤵
  PID:7100
- C:\Windows\System\hMLWsOs.exe
  C:\Windows\System\hMLWsOs.exe
  2⤵
  PID:7120
- C:\Windows\System\DQCNpIF.exe
  C:\Windows\System\DQCNpIF.exe
  2⤵
  PID:7132
- C:\Windows\System\aqHWTMM.exe
  C:\Windows\System\aqHWTMM.exe
  2⤵
  PID:7148
- C:\Windows\System\MHueVux.exe
  C:\Windows\System\MHueVux.exe
  2⤵
  PID:7152
- C:\Windows\System\pCvtydF.exe
  C:\Windows\System\pCvtydF.exe
  2⤵
  PID:6312
- C:\Windows\System\dOBDErr.exe
  C:\Windows\System\dOBDErr.exe
  2⤵
  PID:7156
- C:\Windows\System\RdUvirt.exe
  C:\Windows\System\RdUvirt.exe
  2⤵
  PID:6252
- C:\Windows\System\TlyjEyh.exe
  C:\Windows\System\TlyjEyh.exe
  2⤵
  PID:6328
- C:\Windows\System\xKMFJqb.exe
  C:\Windows\System\xKMFJqb.exe
  2⤵
  PID:6436
- C:\Windows\System\brVdQDL.exe
  C:\Windows\System\brVdQDL.exe
  2⤵
  PID:6660
- C:\Windows\System\zGEObLk.exe
  C:\Windows\System\zGEObLk.exe
  2⤵
  PID:6688
- C:\Windows\System\lAeFpQX.exe
  C:\Windows\System\lAeFpQX.exe
  2⤵
  PID:6488
- C:\Windows\System\sXWSTBu.exe
  C:\Windows\System\sXWSTBu.exe
  2⤵
  PID:6528
- C:\Windows\System\oorHEyg.exe
  C:\Windows\System\oorHEyg.exe
  2⤵
  PID:6600
- C:\Windows\System\ZedRHMw.exe
  C:\Windows\System\ZedRHMw.exe
  2⤵
  PID:6832
- C:\Windows\System\wgpBmeY.exe
  C:\Windows\System\wgpBmeY.exe
  2⤵
  PID:6856
- C:\Windows\System\AyDNQbh.exe
  C:\Windows\System\AyDNQbh.exe
  2⤵
  PID:6968
- C:\Windows\System\cyvKRqe.exe
  C:\Windows\System\cyvKRqe.exe
  2⤵
  PID:7008
- C:\Windows\System\tRJUnlL.exe
  C:\Windows\System\tRJUnlL.exe
  2⤵
  PID:7036
- C:\Windows\System\VvMiMBn.exe
  C:\Windows\System\VvMiMBn.exe
  2⤵
  PID:7024
- C:\Windows\System\pOtmLeH.exe
  C:\Windows\System\pOtmLeH.exe
  2⤵
  PID:7144
- C:\Windows\System\nmciAIo.exe
  C:\Windows\System\nmciAIo.exe
  2⤵
  PID:6296
- C:\Windows\System\BRKUjUW.exe
  C:\Windows\System\BRKUjUW.exe
  2⤵
  PID:6432
- C:\Windows\System\VFqNRGV.exe
  C:\Windows\System\VFqNRGV.exe
  2⤵
  PID:7056
- C:\Windows\System\xHGupoc.exe
  C:\Windows\System\xHGupoc.exe
  2⤵
  PID:6168
- C:\Windows\System\XGGUHtr.exe
  C:\Windows\System\XGGUHtr.exe
  2⤵
  PID:7128
- C:\Windows\System\yNYuwUO.exe
  C:\Windows\System\yNYuwUO.exe
  2⤵
  PID:6788
- C:\Windows\System\DoeATKf.exe
  C:\Windows\System\DoeATKf.exe
  2⤵
  PID:6484
- C:\Windows\System\nFbCUhY.exe
  C:\Windows\System\nFbCUhY.exe
  2⤵
  PID:6708
- C:\Windows\System\FYZvQNL.exe
  C:\Windows\System\FYZvQNL.exe
  2⤵
  PID:6824
- C:\Windows\System\wYENnVT.exe
  C:\Windows\System\wYENnVT.exe
  2⤵
  PID:6752
- C:\Windows\System\bMhabcR.exe
  C:\Windows\System\bMhabcR.exe
  2⤵
  PID:6280
- C:\Windows\System\NMUuPmN.exe
  C:\Windows\System\NMUuPmN.exe
  2⤵
  PID:6892
- C:\Windows\System\iosWdyu.exe
  C:\Windows\System\iosWdyu.exe
  2⤵
  PID:7092
- C:\Windows\System\dOEUOgM.exe
  C:\Windows\System\dOEUOgM.exe
  2⤵
  PID:6384
- C:\Windows\System\TvmSojH.exe
  C:\Windows\System\TvmSojH.exe
  2⤵
  PID:6200
- C:\Windows\System\cRwpdqa.exe
  C:\Windows\System\cRwpdqa.exe
  2⤵
  PID:6720
- C:\Windows\System\SGQMTPt.exe
  C:\Windows\System\SGQMTPt.exe
  2⤵
  PID:6524
- C:\Windows\System\xFvslQO.exe
  C:\Windows\System\xFvslQO.exe
  2⤵
  PID:7176
- C:\Windows\System\uMrjJXR.exe
  C:\Windows\System\uMrjJXR.exe
  2⤵
  PID:7192
- C:\Windows\System\lTGfXvt.exe
  C:\Windows\System\lTGfXvt.exe
  2⤵
  PID:7212
- C:\Windows\System\UIjJrEy.exe
  C:\Windows\System\UIjJrEy.exe
  2⤵
  PID:7228
- C:\Windows\System\oReqrTu.exe
  C:\Windows\System\oReqrTu.exe
  2⤵
  PID:7244
- C:\Windows\System\JbfntTl.exe
  C:\Windows\System\JbfntTl.exe
  2⤵
  PID:7264
- C:\Windows\System\wdQgHCN.exe
  C:\Windows\System\wdQgHCN.exe
  2⤵
  PID:7288
- C:\Windows\System\kbvxOeE.exe
  C:\Windows\System\kbvxOeE.exe
  2⤵
  PID:7304
- C:\Windows\System\mQTxPCX.exe
  C:\Windows\System\mQTxPCX.exe
  2⤵
  PID:7376
- C:\Windows\System\CkAOeSM.exe
  C:\Windows\System\CkAOeSM.exe
  2⤵
  PID:7392
- C:\Windows\System\cXsZIsx.exe
  C:\Windows\System\cXsZIsx.exe
  2⤵
  PID:7412
- C:\Windows\System\IDMzaiJ.exe
  C:\Windows\System\IDMzaiJ.exe
  2⤵
  PID:7428
- C:\Windows\System\hrRpvaV.exe
  C:\Windows\System\hrRpvaV.exe
  2⤵
  PID:7444
- C:\Windows\System\DQYMVcs.exe
  C:\Windows\System\DQYMVcs.exe
  2⤵
  PID:7460
- C:\Windows\System\fzWZJRz.exe
  C:\Windows\System\fzWZJRz.exe
  2⤵
  PID:7480
- C:\Windows\System\xdczaTU.exe
  C:\Windows\System\xdczaTU.exe
  2⤵
  PID:7496
- C:\Windows\System\yeKPhSn.exe
  C:\Windows\System\yeKPhSn.exe
  2⤵
  PID:7512
- C:\Windows\System\qLaeMvE.exe
  C:\Windows\System\qLaeMvE.exe
  2⤵
  PID:7528
- C:\Windows\System\feSqWUr.exe
  C:\Windows\System\feSqWUr.exe
  2⤵
  PID:7544
- C:\Windows\System\nhRAmRi.exe
  C:\Windows\System\nhRAmRi.exe
  2⤵
  PID:7564
- C:\Windows\System\sRORPpv.exe
  C:\Windows\System\sRORPpv.exe
  2⤵
  PID:7580
- C:\Windows\System\ZTpaxPK.exe
  C:\Windows\System\ZTpaxPK.exe
  2⤵
  PID:7596
- C:\Windows\System\urSRcvL.exe
  C:\Windows\System\urSRcvL.exe
  2⤵
  PID:7612
- C:\Windows\System\MGAfNPI.exe
  C:\Windows\System\MGAfNPI.exe
  2⤵
  PID:7628
- C:\Windows\System\yEWzpey.exe
  C:\Windows\System\yEWzpey.exe
  2⤵
  PID:7644
- C:\Windows\System\vtvYdMM.exe
  C:\Windows\System\vtvYdMM.exe
  2⤵
  PID:7660
- C:\Windows\System\inKxJap.exe
  C:\Windows\System\inKxJap.exe
  2⤵
  PID:7676
- C:\Windows\System\ARsPigk.exe
  C:\Windows\System\ARsPigk.exe
  2⤵
  PID:7696
- C:\Windows\System\xtasbCy.exe
  C:\Windows\System\xtasbCy.exe
  2⤵
  PID:7712
- C:\Windows\System\HJwcISu.exe
  C:\Windows\System\HJwcISu.exe
  2⤵
  PID:7728
- C:\Windows\System\VcPXMHO.exe
  C:\Windows\System\VcPXMHO.exe
  2⤵
  PID:7744
- C:\Windows\System\ylHRFjr.exe
  C:\Windows\System\ylHRFjr.exe
  2⤵
  PID:7760
- C:\Windows\System\eWeioai.exe
  C:\Windows\System\eWeioai.exe
  2⤵
  PID:7776
- C:\Windows\System\xFpfSJL.exe
  C:\Windows\System\xFpfSJL.exe
  2⤵
  PID:7792
- C:\Windows\System\rAtVoVC.exe
  C:\Windows\System\rAtVoVC.exe
  2⤵
  PID:7808
- C:\Windows\System\ZPlmPbk.exe
  C:\Windows\System\ZPlmPbk.exe
  2⤵
  PID:7824
- C:\Windows\System\rtsrwVa.exe
  C:\Windows\System\rtsrwVa.exe
  2⤵
  PID:7840
- C:\Windows\System\yCiSYTs.exe
  C:\Windows\System\yCiSYTs.exe
  2⤵
  PID:7856
- C:\Windows\System\eQkGTtR.exe
  C:\Windows\System\eQkGTtR.exe
  2⤵
  PID:7872
- C:\Windows\System\mIFTrCD.exe
  C:\Windows\System\mIFTrCD.exe
  2⤵
  PID:7888
- C:\Windows\System\kVlYihl.exe
  C:\Windows\System\kVlYihl.exe
  2⤵
  PID:7904
- C:\Windows\System\KsodGxV.exe
  C:\Windows\System\KsodGxV.exe
  2⤵
  PID:7920
- C:\Windows\System\qWzflMa.exe
  C:\Windows\System\qWzflMa.exe
  2⤵
  PID:7936
- C:\Windows\System\snlZPMz.exe
  C:\Windows\System\snlZPMz.exe
  2⤵
  PID:7956
- C:\Windows\System\EBfqJZA.exe
  C:\Windows\System\EBfqJZA.exe
  2⤵
  PID:7972
- C:\Windows\System\JuUtvjn.exe
  C:\Windows\System\JuUtvjn.exe
  2⤵
  PID:7988
- C:\Windows\System\Eirkaeh.exe
  C:\Windows\System\Eirkaeh.exe
  2⤵
  PID:8004
- C:\Windows\System\BqjwYdw.exe
  C:\Windows\System\BqjwYdw.exe
  2⤵
  PID:8020
- C:\Windows\System\iydbgfR.exe
  C:\Windows\System\iydbgfR.exe
  2⤵
  PID:8036
- C:\Windows\System\ckfYDGD.exe
  C:\Windows\System\ckfYDGD.exe
  2⤵
  PID:8052
- C:\Windows\System\YQxHIGT.exe
  C:\Windows\System\YQxHIGT.exe
  2⤵
  PID:8072
- C:\Windows\System\tAXndIa.exe
  C:\Windows\System\tAXndIa.exe
  2⤵
  PID:8088
- C:\Windows\System\gsCuyrR.exe
  C:\Windows\System\gsCuyrR.exe
  2⤵
  PID:8104
- C:\Windows\System\JlaThXi.exe
  C:\Windows\System\JlaThXi.exe
  2⤵
  PID:8120
- C:\Windows\System\xrZaDHF.exe
  C:\Windows\System\xrZaDHF.exe
  2⤵
  PID:8136
- C:\Windows\System\delBskf.exe
  C:\Windows\System\delBskf.exe
  2⤵
  PID:8152
- C:\Windows\System\jerqvma.exe
  C:\Windows\System\jerqvma.exe
  2⤵
  PID:8168
- C:\Windows\System\SvlvBet.exe
  C:\Windows\System\SvlvBet.exe
  2⤵
  PID:8184
- C:\Windows\System\WfIPNOU.exe
  C:\Windows\System\WfIPNOU.exe
  2⤵
  PID:6920
- C:\Windows\System\QuUIXsA.exe
  C:\Windows\System\QuUIXsA.exe
  2⤵
  PID:7208
- C:\Windows\System\amZpcAd.exe
  C:\Windows\System\amZpcAd.exe
  2⤵
  PID:6584
- C:\Windows\System\FlBoFPN.exe
  C:\Windows\System\FlBoFPN.exe
  2⤵
  PID:7048
- C:\Windows\System\LLrxedz.exe
  C:\Windows\System\LLrxedz.exe
  2⤵
  PID:7272
- C:\Windows\System\vNjBRzz.exe
  C:\Windows\System\vNjBRzz.exe
  2⤵
  PID:7140
- C:\Windows\System\cIUgTBO.exe
  C:\Windows\System\cIUgTBO.exe
  2⤵
  PID:7280
- C:\Windows\System\xdTXJkd.exe
  C:\Windows\System\xdTXJkd.exe
  2⤵
  PID:7324
- C:\Windows\System\JzGrgFD.exe
  C:\Windows\System\JzGrgFD.exe
  2⤵
  PID:7344
- C:\Windows\System\RnnAqLn.exe
  C:\Windows\System\RnnAqLn.exe
  2⤵
  PID:7360
- C:\Windows\System\mDlRARA.exe
  C:\Windows\System\mDlRARA.exe
  2⤵
  PID:7384
- C:\Windows\System\MSdYjFe.exe
  C:\Windows\System\MSdYjFe.exe
  2⤵
  PID:7468
- C:\Windows\System\PTfzdxC.exe
  C:\Windows\System\PTfzdxC.exe
  2⤵
  PID:7476
- C:\Windows\System\JAchIte.exe
  C:\Windows\System\JAchIte.exe
  2⤵
  PID:7420
- C:\Windows\System\yiDbjUe.exe
  C:\Windows\System\yiDbjUe.exe
  2⤵
  PID:7424
- C:\Windows\System\HfODFVK.exe
  C:\Windows\System\HfODFVK.exe
  2⤵
  PID:7608
- C:\Windows\System\ifsmWqv.exe
  C:\Windows\System\ifsmWqv.exe
  2⤵
  PID:7556
- C:\Windows\System\NyElDxl.exe
  C:\Windows\System\NyElDxl.exe
  2⤵
  PID:7456
- C:\Windows\System\KolTHkc.exe
  C:\Windows\System\KolTHkc.exe
  2⤵
  PID:7524
- C:\Windows\System\fzIZESC.exe
  C:\Windows\System\fzIZESC.exe
  2⤵
  PID:7652
- C:\Windows\System\sFxswEO.exe
  C:\Windows\System\sFxswEO.exe
  2⤵
  PID:7692
- C:\Windows\System\zBgTLxp.exe
  C:\Windows\System\zBgTLxp.exe
  2⤵
  PID:7768
- C:\Windows\System\RkXddUp.exe
  C:\Windows\System\RkXddUp.exe
  2⤵
  PID:7832
- C:\Windows\System\mIUgxPR.exe
  C:\Windows\System\mIUgxPR.exe
  2⤵
  PID:7868
- C:\Windows\System\pMAaIgy.exe
  C:\Windows\System\pMAaIgy.exe
  2⤵
  PID:7752
- C:\Windows\System\IOOcdLf.exe
  C:\Windows\System\IOOcdLf.exe
  2⤵
  PID:7816
- C:\Windows\System\KbUDyQP.exe
  C:\Windows\System\KbUDyQP.exe
  2⤵
  PID:7900
- C:\Windows\System\sumieSl.exe
  C:\Windows\System\sumieSl.exe
  2⤵
  PID:7928
- C:\Windows\System\setFJvW.exe
  C:\Windows\System\setFJvW.exe
  2⤵
  PID:7996
- C:\Windows\System\StuhsJz.exe
  C:\Windows\System\StuhsJz.exe
  2⤵
  PID:8060
- C:\Windows\System\NeOaPYq.exe
  C:\Windows\System\NeOaPYq.exe
  2⤵
  PID:7300
- C:\Windows\System\EWSTLet.exe
  C:\Windows\System\EWSTLet.exe
  2⤵
  PID:7368
- C:\Windows\System\jyyoszZ.exe
  C:\Windows\System\jyyoszZ.exe
  2⤵
  PID:7540
- C:\Windows\System\OHyQmgx.exe
  C:\Windows\System\OHyQmgx.exe
  2⤵
  PID:7492
- C:\Windows\System\jCwcngG.exe
  C:\Windows\System\jCwcngG.exe
  2⤵
  PID:7320
- C:\Windows\System\aqYsyXR.exe
  C:\Windows\System\aqYsyXR.exe
  2⤵
  PID:7508
- C:\Windows\System\DtOIVmA.exe
  C:\Windows\System\DtOIVmA.exe
  2⤵
  PID:7668
- C:\Windows\System\LIHkbka.exe
  C:\Windows\System\LIHkbka.exe
  2⤵
  PID:7620
- C:\Windows\System\zmmOFOy.exe
  C:\Windows\System\zmmOFOy.exe
  2⤵
  PID:7724
- C:\Windows\System\IXEqQYu.exe
  C:\Windows\System\IXEqQYu.exe
  2⤵
  PID:7896
- C:\Windows\System\sODdEqw.exe
  C:\Windows\System\sODdEqw.exe
  2⤵
  PID:7788
- C:\Windows\System\dkIKreJ.exe
  C:\Windows\System\dkIKreJ.exe
  2⤵
  PID:7912
- C:\Windows\System\dKWrCnB.exe
  C:\Windows\System\dKWrCnB.exe
  2⤵
  PID:7952
- C:\Windows\System\gniOCBT.exe
  C:\Windows\System\gniOCBT.exe
  2⤵
  PID:8012
- C:\Windows\System\iOllMmE.exe
  C:\Windows\System\iOllMmE.exe
  2⤵
  PID:8132
- C:\Windows\System\QiQUNMx.exe
  C:\Windows\System\QiQUNMx.exe
  2⤵
  PID:8044
- C:\Windows\System\AICIXoF.exe
  C:\Windows\System\AICIXoF.exe
  2⤵
  PID:8164
- C:\Windows\System\uWSgpJr.exe
  C:\Windows\System\uWSgpJr.exe
  2⤵
  PID:8176
- C:\Windows\System\puYjDXi.exe
  C:\Windows\System\puYjDXi.exe
  2⤵
  PID:7200
- C:\Windows\System\arzPOCC.exe
  C:\Windows\System\arzPOCC.exe
  2⤵
  PID:7256
- C:\Windows\System\akhTPIu.exe
  C:\Windows\System\akhTPIu.exe
  2⤵
  PID:7316
- C:\Windows\System\VEMhQpf.exe
  C:\Windows\System\VEMhQpf.exe
  2⤵
  PID:7184
- C:\Windows\System\wudhQhN.exe
  C:\Windows\System\wudhQhN.exe
  2⤵
  PID:7440
- C:\Windows\System\bysbTkT.exe
  C:\Windows\System\bysbTkT.exe
  2⤵
  PID:7604
- C:\Windows\System\LixCgsI.exe
  C:\Windows\System\LixCgsI.exe
  2⤵
  PID:7636
- C:\Windows\System\JafqxMW.exe
  C:\Windows\System\JafqxMW.exe
  2⤵
  PID:7672
- C:\Windows\System\MwtgZNq.exe
  C:\Windows\System\MwtgZNq.exe
  2⤵
  PID:7880
- C:\Windows\System\poDhUCX.exe
  C:\Windows\System\poDhUCX.exe
  2⤵
  PID:8016
- C:\Windows\System\xRbWpOh.exe
  C:\Windows\System\xRbWpOh.exe
  2⤵
  PID:7944
- C:\Windows\System\CiyHZUt.exe
  C:\Windows\System\CiyHZUt.exe
  2⤵
  PID:7356
- C:\Windows\System\QjeGedX.exe
  C:\Windows\System\QjeGedX.exe
  2⤵
  PID:8144
- C:\Windows\System\aiDzRAV.exe
  C:\Windows\System\aiDzRAV.exe
  2⤵
  PID:7172
- C:\Windows\System\uTvwaQE.exe
  C:\Windows\System\uTvwaQE.exe
  2⤵
  PID:7984
- C:\Windows\System\aPMEogL.exe
  C:\Windows\System\aPMEogL.exe
  2⤵
  PID:8160
- C:\Windows\System\gmcMhFB.exe
  C:\Windows\System\gmcMhFB.exe
  2⤵
  PID:8180
- C:\Windows\System\DUzUCpf.exe
  C:\Windows\System\DUzUCpf.exe
  2⤵
  PID:7800
- C:\Windows\System\Nwosqzz.exe
  C:\Windows\System\Nwosqzz.exe
  2⤵
  PID:8028
- C:\Windows\System\UWVdntu.exe
  C:\Windows\System\UWVdntu.exe
  2⤵
  PID:8068
- C:\Windows\System\cuajkee.exe
  C:\Windows\System\cuajkee.exe
  2⤵
  PID:7968
- C:\Windows\System\wXnCANs.exe
  C:\Windows\System\wXnCANs.exe
  2⤵
  PID:7704
- C:\Windows\System\yqmEHYh.exe
  C:\Windows\System\yqmEHYh.exe
  2⤵
  PID:8128
- C:\Windows\System\uEvdBFP.exe
  C:\Windows\System\uEvdBFP.exe
  2⤵
  PID:8112
- C:\Windows\System\sLSvoRk.exe
  C:\Windows\System\sLSvoRk.exe
  2⤵
  PID:8208
- C:\Windows\System\MTZtxKR.exe
  C:\Windows\System\MTZtxKR.exe
  2⤵
  PID:8228
- C:\Windows\System\zGHGuPA.exe
  C:\Windows\System\zGHGuPA.exe
  2⤵
  PID:8244
- C:\Windows\System\IRQFQux.exe
  C:\Windows\System\IRQFQux.exe
  2⤵
  PID:8264
- C:\Windows\System\IOeNIDk.exe
  C:\Windows\System\IOeNIDk.exe
  2⤵
  PID:8280
- C:\Windows\System\hRdygdz.exe
  C:\Windows\System\hRdygdz.exe
  2⤵
  PID:8296
- C:\Windows\System\iRldZYf.exe
  C:\Windows\System\iRldZYf.exe
  2⤵
  PID:8316
- C:\Windows\System\yswjZEx.exe
  C:\Windows\System\yswjZEx.exe
  2⤵
  PID:8336
- C:\Windows\System\JXGUmml.exe
  C:\Windows\System\JXGUmml.exe
  2⤵
  PID:8356
- C:\Windows\System\QeyWohT.exe
  C:\Windows\System\QeyWohT.exe
  2⤵
  PID:8372
- C:\Windows\System\gzATAxp.exe
  C:\Windows\System\gzATAxp.exe
  2⤵
  PID:8388
- C:\Windows\System\fhBLidi.exe
  C:\Windows\System\fhBLidi.exe
  2⤵
  PID:8404
- C:\Windows\System\UxeKava.exe
  C:\Windows\System\UxeKava.exe
  2⤵
  PID:8420
- C:\Windows\System\ZoWNPNW.exe
  C:\Windows\System\ZoWNPNW.exe
  2⤵
  PID:8436
- C:\Windows\System\ceWpcbL.exe
  C:\Windows\System\ceWpcbL.exe
  2⤵
  PID:8452
- C:\Windows\System\RKaJJYS.exe
  C:\Windows\System\RKaJJYS.exe
  2⤵
  PID:8468
- C:\Windows\System\yODYcCI.exe
  C:\Windows\System\yODYcCI.exe
  2⤵
  PID:8484
- C:\Windows\System\YRdHHtE.exe
  C:\Windows\System\YRdHHtE.exe
  2⤵
  PID:8500
- C:\Windows\System\JLwnkjk.exe
  C:\Windows\System\JLwnkjk.exe
  2⤵
  PID:8516
- C:\Windows\System\YpiuZCD.exe
  C:\Windows\System\YpiuZCD.exe
  2⤵
  PID:8532
- C:\Windows\System\ZzIgSHj.exe
  C:\Windows\System\ZzIgSHj.exe
  2⤵
  PID:8548
- C:\Windows\System\IPmbAsF.exe
  C:\Windows\System\IPmbAsF.exe
  2⤵
  PID:8568
- C:\Windows\System\UjnCinG.exe
  C:\Windows\System\UjnCinG.exe
  2⤵
  PID:8584
- C:\Windows\System\wBlhOcT.exe
  C:\Windows\System\wBlhOcT.exe
  2⤵
  PID:8632
- C:\Windows\System\UxvExKU.exe
  C:\Windows\System\UxvExKU.exe
  2⤵
  PID:8724
- C:\Windows\System\LWqUzvW.exe
  C:\Windows\System\LWqUzvW.exe
  2⤵
  PID:8812
- C:\Windows\System\HYlvIFf.exe
  C:\Windows\System\HYlvIFf.exe
  2⤵
  PID:8920
- C:\Windows\System\oLIMdmg.exe
  C:\Windows\System\oLIMdmg.exe
  2⤵
  PID:8936
- C:\Windows\System\zvgIjvU.exe
  C:\Windows\System\zvgIjvU.exe
  2⤵
  PID:8956
- C:\Windows\System\Uazokjk.exe
  C:\Windows\System\Uazokjk.exe
  2⤵
  PID:8972
- C:\Windows\System\LmDbQcw.exe
  C:\Windows\System\LmDbQcw.exe
  2⤵
  PID:8992
- C:\Windows\System\iKNMLSq.exe
  C:\Windows\System\iKNMLSq.exe
  2⤵
  PID:9012
- C:\Windows\System\GwHhbJh.exe
  C:\Windows\System\GwHhbJh.exe
  2⤵
  PID:9028
- C:\Windows\System\bHTxWBY.exe
  C:\Windows\System\bHTxWBY.exe
  2⤵
  PID:9044
- C:\Windows\System\BMXNIwZ.exe
  C:\Windows\System\BMXNIwZ.exe
  2⤵
  PID:9060
- C:\Windows\System\ZEvYxkm.exe
  C:\Windows\System\ZEvYxkm.exe
  2⤵
  PID:9084
- C:\Windows\System\tiKmNeZ.exe
  C:\Windows\System\tiKmNeZ.exe
  2⤵
  PID:9100
- C:\Windows\System\GZQpsgq.exe
  C:\Windows\System\GZQpsgq.exe
  2⤵
  PID:9116
- C:\Windows\System\tKUdSot.exe
  C:\Windows\System\tKUdSot.exe
  2⤵
  PID:9136
- C:\Windows\System\wxURtLT.exe
  C:\Windows\System\wxURtLT.exe
  2⤵
  PID:9156
- C:\Windows\System\HWizUoB.exe
  C:\Windows\System\HWizUoB.exe
  2⤵
  PID:9180
- C:\Windows\System\OojPYza.exe
  C:\Windows\System\OojPYza.exe
  2⤵
  PID:9196
- C:\Windows\System\pvOSyDZ.exe
  C:\Windows\System\pvOSyDZ.exe
  2⤵
  PID:7552
- C:\Windows\System\pqWRbOd.exe
  C:\Windows\System\pqWRbOd.exe
  2⤵
  PID:7312
- C:\Windows\System\fFKAbbF.exe
  C:\Windows\System\fFKAbbF.exe
  2⤵
  PID:8216
- C:\Windows\System\hJGjjot.exe
  C:\Windows\System\hJGjjot.exe
  2⤵
  PID:8260
- C:\Windows\System\wyuCdaR.exe
  C:\Windows\System\wyuCdaR.exe
  2⤵
  PID:8204
- C:\Windows\System\VcmeUbi.exe
  C:\Windows\System\VcmeUbi.exe
  2⤵
  PID:8304
- C:\Windows\System\DvbCBmP.exe
  C:\Windows\System\DvbCBmP.exe
  2⤵
  PID:8384
- C:\Windows\System\sJuxCEl.exe
  C:\Windows\System\sJuxCEl.exe
  2⤵
  PID:8592
- C:\Windows\System\DQnYcwC.exe
  C:\Windows\System\DQnYcwC.exe
  2⤵
  PID:8612
- C:\Windows\System\MvQbHsq.exe
  C:\Windows\System\MvQbHsq.exe
  2⤵
  PID:8652
- C:\Windows\System\upywhrG.exe
  C:\Windows\System\upywhrG.exe
  2⤵
  PID:8712
- C:\Windows\System\WPBhpen.exe
  C:\Windows\System\WPBhpen.exe
  2⤵
  PID:8744
- C:\Windows\System\xFReXkt.exe
  C:\Windows\System\xFReXkt.exe
  2⤵
  PID:8944
- C:\Windows\System\BdiHyqV.exe
  C:\Windows\System\BdiHyqV.exe
  2⤵
  PID:8932
- C:\Windows\System\dEBPrMi.exe
  C:\Windows\System\dEBPrMi.exe
  2⤵
  PID:9008
- C:\Windows\System\ZpNLdOf.exe
  C:\Windows\System\ZpNLdOf.exe
  2⤵
  PID:9036
- C:\Windows\System\aHvyZGq.exe
  C:\Windows\System\aHvyZGq.exe
  2⤵
  PID:9068
- C:\Windows\System\DniQslS.exe
  C:\Windows\System\DniQslS.exe
  2⤵
  PID:9052
- C:\Windows\System\LrIQBQu.exe
  C:\Windows\System\LrIQBQu.exe
  2⤵
  PID:9176
- C:\Windows\System\BdIUqtQ.exe
  C:\Windows\System\BdIUqtQ.exe
  2⤵
  PID:9172
- C:\Windows\System\VARlVZv.exe
  C:\Windows\System\VARlVZv.exe
  2⤵
  PID:7852
- C:\Windows\System\RcyStdd.exe
  C:\Windows\System\RcyStdd.exe
  2⤵
  PID:8224
- C:\Windows\System\sSIEaml.exe
  C:\Windows\System\sSIEaml.exe
  2⤵
  PID:9144
- C:\Windows\System\RxvltdU.exe
  C:\Windows\System\RxvltdU.exe
  2⤵
  PID:8200
- C:\Windows\System\SUApkEU.exe
  C:\Windows\System\SUApkEU.exe
  2⤵
  PID:8344
- C:\Windows\System\nHIqWjn.exe
  C:\Windows\System\nHIqWjn.exe
  2⤵
  PID:8764
- C:\Windows\System\PvAGfZr.exe
  C:\Windows\System\PvAGfZr.exe
  2⤵
  PID:8752
- C:\Windows\System\BZsEvUE.exe
  C:\Windows\System\BZsEvUE.exe
  2⤵
  PID:8768
- C:\Windows\System\jnTbSlg.exe
  C:\Windows\System\jnTbSlg.exe
  2⤵
  PID:8512
- C:\Windows\System\TONKYap.exe
  C:\Windows\System\TONKYap.exe
  2⤵
  PID:8492
- C:\Windows\System\buJeDzx.exe
  C:\Windows\System\buJeDzx.exe
  2⤵
  PID:8540
- C:\Windows\System\hQsSYQN.exe
  C:\Windows\System\hQsSYQN.exe
  2⤵
  PID:8560
- C:\Windows\System\dUzZYey.exe
  C:\Windows\System\dUzZYey.exe
  2⤵
  PID:8528
- C:\Windows\System\XHvCaaa.exe
  C:\Windows\System\XHvCaaa.exe
  2⤵
  PID:8556
- C:\Windows\System\aiPDxWv.exe
  C:\Windows\System\aiPDxWv.exe
  2⤵
  PID:6452
- C:\Windows\System\jPEHgiu.exe
  C:\Windows\System\jPEHgiu.exe
  2⤵
  PID:8808
- C:\Windows\System\voFdQwc.exe
  C:\Windows\System\voFdQwc.exe
  2⤵
  PID:8732
- C:\Windows\System\BtGxNgp.exe
  C:\Windows\System\BtGxNgp.exe
  2⤵
  PID:8840
- C:\Windows\System\QMHKjSh.exe
  C:\Windows\System\QMHKjSh.exe
  2⤵
  PID:8864
- C:\Windows\System\GZkFiPq.exe
  C:\Windows\System\GZkFiPq.exe
  2⤵
  PID:8880
- C:\Windows\System\fMgDvBu.exe
  C:\Windows\System\fMgDvBu.exe
  2⤵
  PID:9024
- C:\Windows\System\PrSnuAg.exe
  C:\Windows\System\PrSnuAg.exe
  2⤵
  PID:8912
- C:\Windows\System\oBSZbnI.exe
  C:\Windows\System\oBSZbnI.exe
  2⤵
  PID:8952
- C:\Windows\System\jNvqXwD.exe
  C:\Windows\System\jNvqXwD.exe
  2⤵
  PID:8256
- C:\Windows\System\XkxfAXR.exe
  C:\Windows\System\XkxfAXR.exe
  2⤵
  PID:8988
- C:\Windows\System\RmLZpdS.exe
  C:\Windows\System\RmLZpdS.exe
  2⤵
  PID:8928
- C:\Windows\System\GjFYgrz.exe
  C:\Windows\System\GjFYgrz.exe
  2⤵
  PID:9056
- C:\Windows\System\yAyOwaF.exe
  C:\Windows\System\yAyOwaF.exe
  2⤵
  PID:7404
- C:\Windows\System\VEyoUmd.exe
  C:\Windows\System\VEyoUmd.exe
  2⤵
  PID:8328
- C:\Windows\System\jouIbvV.exe
  C:\Windows\System\jouIbvV.exe
  2⤵
  PID:8272
- C:\Windows\System\FDtSQVE.exe
  C:\Windows\System\FDtSQVE.exe
  2⤵
  PID:8708
- C:\Windows\System\qwlEXEu.exe
  C:\Windows\System\qwlEXEu.exe
  2⤵
  PID:8668
- C:\Windows\System\MCoERMa.exe
  C:\Windows\System\MCoERMa.exe
  2⤵
  PID:8448
- C:\Windows\System\vPlslQb.exe
  C:\Windows\System\vPlslQb.exe
  2⤵
  PID:8508
- C:\Windows\System\PubDohR.exe
  C:\Windows\System\PubDohR.exe
  2⤵
  PID:8644
- C:\Windows\System\foQyGzX.exe
  C:\Windows\System\foQyGzX.exe
  2⤵
  PID:8796
- C:\Windows\System\TkwqldS.exe
  C:\Windows\System\TkwqldS.exe
  2⤵
  PID:8852
- C:\Windows\System\voKaPcQ.exe
  C:\Windows\System\voKaPcQ.exe
  2⤵
  PID:9072
- C:\Windows\System\REpmStX.exe
  C:\Windows\System\REpmStX.exe
  2⤵
  PID:9188
- C:\Windows\System\JfFXtpi.exe
  C:\Windows\System\JfFXtpi.exe
  2⤵
  PID:8412
- C:\Windows\System\ZgTOYyL.exe
  C:\Windows\System\ZgTOYyL.exe
  2⤵
  PID:8416
- C:\Windows\System\cqgloqb.exe
  C:\Windows\System\cqgloqb.exe
  2⤵
  PID:9168
- C:\Windows\System\VxuLPeL.exe
  C:\Windows\System\VxuLPeL.exe
  2⤵
  PID:8364
- C:\Windows\System\AqLmDcn.exe
  C:\Windows\System\AqLmDcn.exe
  2⤵
  PID:8860
- C:\Windows\System\HVnQYuR.exe
  C:\Windows\System\HVnQYuR.exe
  2⤵
  PID:9128
- C:\Windows\System\NvdyIQX.exe
  C:\Windows\System\NvdyIQX.exe
  2⤵
  PID:8824
- C:\Windows\System\cpPOiKz.exe
  C:\Windows\System\cpPOiKz.exe
  2⤵
  PID:8900
- C:\Windows\System\PcdkOvT.exe
  C:\Windows\System\PcdkOvT.exe
  2⤵
  PID:9208
- C:\Windows\System\BFUKxqa.exe
  C:\Windows\System\BFUKxqa.exe
  2⤵
  PID:8084
- C:\Windows\System\rVMZWFr.exe
  C:\Windows\System\rVMZWFr.exe
  2⤵
  PID:8476
- C:\Windows\System\fvicKFs.exe
  C:\Windows\System\fvicKFs.exe
  2⤵
  PID:8888
- C:\Windows\System\hQMgFCY.exe
  C:\Windows\System\hQMgFCY.exe
  2⤵
  PID:9112
- C:\Windows\System\EYXsyGF.exe
  C:\Windows\System\EYXsyGF.exe
  2⤵
  PID:8784
- C:\Windows\System\mbjcLMH.exe
  C:\Windows\System\mbjcLMH.exe
  2⤵
  PID:8872
- C:\Windows\System\iQKwwZy.exe
  C:\Windows\System\iQKwwZy.exe
  2⤵
  PID:8352
- C:\Windows\System\GzIonOU.exe
  C:\Windows\System\GzIonOU.exe
  2⤵
  PID:8848
- C:\Windows\System\wFbFmlZ.exe
  C:\Windows\System\wFbFmlZ.exe
  2⤵
  PID:8792
- C:\Windows\System\tkTgBDB.exe
  C:\Windows\System\tkTgBDB.exe
  2⤵
  PID:9108
- C:\Windows\System\nqgFYae.exe
  C:\Windows\System\nqgFYae.exe
  2⤵
  PID:9224
- C:\Windows\System\pPiVcbs.exe
  C:\Windows\System\pPiVcbs.exe
  2⤵
  PID:9240
- C:\Windows\System\doBbTBK.exe
  C:\Windows\System\doBbTBK.exe
  2⤵
  PID:9256
- C:\Windows\System\CfUGazR.exe
  C:\Windows\System\CfUGazR.exe
  2⤵
  PID:9272
- C:\Windows\System\FixHnxj.exe
  C:\Windows\System\FixHnxj.exe
  2⤵
  PID:9288
- C:\Windows\System\azenCHz.exe
  C:\Windows\System\azenCHz.exe
  2⤵
  PID:9304
- C:\Windows\System\AZtfhbh.exe
  C:\Windows\System\AZtfhbh.exe
  2⤵
  PID:9320
- C:\Windows\System\fCYyuZF.exe
  C:\Windows\System\fCYyuZF.exe
  2⤵
  PID:9336
- C:\Windows\System\gSrtRtg.exe
  C:\Windows\System\gSrtRtg.exe
  2⤵
  PID:9356
- C:\Windows\System\sdAgpYR.exe
  C:\Windows\System\sdAgpYR.exe
  2⤵
  PID:9376
- C:\Windows\System\YmIPFxe.exe
  C:\Windows\System\YmIPFxe.exe
  2⤵
  PID:9392
- C:\Windows\System\HttFzrR.exe
  C:\Windows\System\HttFzrR.exe
  2⤵
  PID:9408
- C:\Windows\System\tJNVWCk.exe
  C:\Windows\System\tJNVWCk.exe
  2⤵
  PID:9432
- C:\Windows\System\ORjSDIo.exe
  C:\Windows\System\ORjSDIo.exe
  2⤵
  PID:9452
- C:\Windows\System\DwfzMQA.exe
  C:\Windows\System\DwfzMQA.exe
  2⤵
  PID:9472
- C:\Windows\System\aaZTkti.exe
  C:\Windows\System\aaZTkti.exe
  2⤵
  PID:9488
- C:\Windows\System\iNhdred.exe
  C:\Windows\System\iNhdred.exe
  2⤵
  PID:9504
- C:\Windows\System\sjBsBah.exe
  C:\Windows\System\sjBsBah.exe
  2⤵
  PID:9524
- C:\Windows\System\cGZftbR.exe
  C:\Windows\System\cGZftbR.exe
  2⤵
  PID:9544
- C:\Windows\System\HQLJlBt.exe
  C:\Windows\System\HQLJlBt.exe
  2⤵
  PID:9560
- C:\Windows\System\WJuCgsx.exe
  C:\Windows\System\WJuCgsx.exe
  2⤵
  PID:9576
- C:\Windows\System\BSwZcFM.exe
  C:\Windows\System\BSwZcFM.exe
  2⤵
  PID:9596
- C:\Windows\System\yZaFvXp.exe
  C:\Windows\System\yZaFvXp.exe
  2⤵
  PID:9612
- C:\Windows\System\EfuPSIB.exe
  C:\Windows\System\EfuPSIB.exe
  2⤵
  PID:9628
- C:\Windows\System\uRIBvPh.exe
  C:\Windows\System\uRIBvPh.exe
  2⤵
  PID:9644
- C:\Windows\System\SjyNMsm.exe
  C:\Windows\System\SjyNMsm.exe
  2⤵
  PID:9660
- C:\Windows\System\Ksblejl.exe
  C:\Windows\System\Ksblejl.exe
  2⤵
  PID:9680
- C:\Windows\System\ztrMakM.exe
  C:\Windows\System\ztrMakM.exe
  2⤵
  PID:9696
- C:\Windows\System\cRvVQKn.exe
  C:\Windows\System\cRvVQKn.exe
  2⤵
  PID:9712
- C:\Windows\System\djVhULX.exe
  C:\Windows\System\djVhULX.exe
  2⤵
  PID:9732
- C:\Windows\System\DocNMFa.exe
  C:\Windows\System\DocNMFa.exe
  2⤵
  PID:9748
- C:\Windows\System\VokEHen.exe
  C:\Windows\System\VokEHen.exe
  2⤵
  PID:9764
- C:\Windows\System\bBgBqVU.exe
  C:\Windows\System\bBgBqVU.exe
  2⤵
  PID:9784
- C:\Windows\System\fiZvFBR.exe
  C:\Windows\System\fiZvFBR.exe
  2⤵
  PID:9804
- C:\Windows\System\COtMRis.exe
  C:\Windows\System\COtMRis.exe
  2⤵
  PID:9820
- C:\Windows\System\aUBCHVu.exe
  C:\Windows\System\aUBCHVu.exe
  2⤵
  PID:9836
- C:\Windows\System\tYajaCO.exe
  C:\Windows\System\tYajaCO.exe
  2⤵
  PID:9852
- C:\Windows\System\XSEpsaa.exe
  C:\Windows\System\XSEpsaa.exe
  2⤵
  PID:9868
- C:\Windows\System\hdneglX.exe
  C:\Windows\System\hdneglX.exe
  2⤵
  PID:9888
- C:\Windows\System\tGZTgyR.exe
  C:\Windows\System\tGZTgyR.exe
  2⤵
  PID:10124
- C:\Windows\System\BzFRvWs.exe
  C:\Windows\System\BzFRvWs.exe
  2⤵
  PID:10220
- C:\Windows\System\pScGZyc.exe
  C:\Windows\System\pScGZyc.exe
  2⤵
  PID:1000
- C:\Windows\System\EWLJrmo.exe
  C:\Windows\System\EWLJrmo.exe
  2⤵
  PID:8648
- C:\Windows\System\VcFsbGp.exe
  C:\Windows\System\VcFsbGp.exe
  2⤵
  PID:8428
- C:\Windows\System\TXYMjUa.exe
  C:\Windows\System\TXYMjUa.exe
  2⤵
  PID:9268
- C:\Windows\System\slXapEh.exe
  C:\Windows\System\slXapEh.exe
  2⤵
  PID:9344
- C:\Windows\System\FpfXciB.exe
  C:\Windows\System\FpfXciB.exe
  2⤵
  PID:9368
- C:\Windows\System\SFojArx.exe
  C:\Windows\System\SFojArx.exe
  2⤵
  PID:9444
- C:\Windows\System\MXqUgFA.exe
  C:\Windows\System\MXqUgFA.exe
  2⤵
  PID:9480
- C:\Windows\System\VnhAaQK.exe
  C:\Windows\System\VnhAaQK.exe
  2⤵
  PID:9512
- C:\Windows\System\rQqVPpS.exe
  C:\Windows\System\rQqVPpS.exe
  2⤵
  PID:9584
- C:\Windows\System\JZNjATb.exe
  C:\Windows\System\JZNjATb.exe
  2⤵
  PID:9592
- C:\Windows\System\rPibUAe.exe
  C:\Windows\System\rPibUAe.exe
  2⤵
  PID:9720
- C:\Windows\System\hutQKyv.exe
  C:\Windows\System\hutQKyv.exe
  2⤵
  PID:9776
- C:\Windows\System\iQDXGct.exe
  C:\Windows\System\iQDXGct.exe
  2⤵
  PID:9896
- C:\Windows\System\SvdPZuG.exe
  C:\Windows\System\SvdPZuG.exe
  2⤵
  PID:9728
- C:\Windows\System\veuzxxo.exe
  C:\Windows\System\veuzxxo.exe
  2⤵
  PID:9844
- C:\Windows\System\kBploPU.exe
  C:\Windows\System\kBploPU.exe
  2⤵
  PID:9880
- C:\Windows\System\DOBPBwd.exe
  C:\Windows\System\DOBPBwd.exe
  2⤵
  PID:9900
- C:\Windows\System\gPnSOnf.exe
  C:\Windows\System\gPnSOnf.exe
  2⤵
  PID:9928
- C:\Windows\System\IkMrbaX.exe
  C:\Windows\System\IkMrbaX.exe
  2⤵
  PID:9976
- C:\Windows\System\DyhMHXA.exe
  C:\Windows\System\DyhMHXA.exe
  2⤵
  PID:9992
- C:\Windows\System\zaXJnER.exe
  C:\Windows\System\zaXJnER.exe
  2⤵
  PID:10008
- C:\Windows\System\wRAYcQG.exe
  C:\Windows\System\wRAYcQG.exe
  2⤵
  PID:10028
- C:\Windows\System\gQIBulp.exe
  C:\Windows\System\gQIBulp.exe
  2⤵
  PID:10044
- C:\Windows\System\HvDVrbL.exe
  C:\Windows\System\HvDVrbL.exe
  2⤵
  PID:10060
- C:\Windows\System\viaCqbc.exe
  C:\Windows\System\viaCqbc.exe
  2⤵
  PID:10080
- C:\Windows\System\RfEKTCs.exe
  C:\Windows\System\RfEKTCs.exe
  2⤵
  PID:10088
- C:\Windows\System\kOZOBqF.exe
  C:\Windows\System\kOZOBqF.exe
  2⤵
  PID:10112
- C:\Windows\System\oEuKkah.exe
  C:\Windows\System\oEuKkah.exe
  2⤵
  PID:10140
- C:\Windows\System\cCLlrPN.exe
  C:\Windows\System\cCLlrPN.exe
  2⤵
  PID:10152
- C:\Windows\System\iyxYLki.exe
  C:\Windows\System\iyxYLki.exe
  2⤵
  PID:10192
- C:\Windows\System\MELAfpL.exe
  C:\Windows\System\MELAfpL.exe
  2⤵
  PID:10168
- C:\Windows\System\yqkRUGW.exe
  C:\Windows\System\yqkRUGW.exe
  2⤵
  PID:8292
- C:\Windows\System\DXjUPVJ.exe
  C:\Windows\System\DXjUPVJ.exe
  2⤵
  PID:9236
- C:\Windows\System\zPfcSEN.exe
  C:\Windows\System\zPfcSEN.exe
  2⤵
  PID:9332
- C:\Windows\System\YBpvBfV.exe
  C:\Windows\System\YBpvBfV.exe
  2⤵
  PID:9096
- C:\Windows\System\SdsZyxu.exe
  C:\Windows\System\SdsZyxu.exe
  2⤵
  PID:9460
- C:\Windows\System\fuMvVMo.exe
  C:\Windows\System\fuMvVMo.exe
  2⤵
  PID:9400
- C:\Windows\System\wronQuk.exe
  C:\Windows\System\wronQuk.exe
  2⤵
  PID:9352
- C:\Windows\System\sUmVBbA.exe
  C:\Windows\System\sUmVBbA.exe
  2⤵
  PID:9496
- C:\Windows\System\KwKJClW.exe
  C:\Windows\System\KwKJClW.exe
  2⤵
  PID:9608
- C:\Windows\System\NyCqyHx.exe
  C:\Windows\System\NyCqyHx.exe
  2⤵
  PID:9672
- C:\Windows\System\vhoAhSw.exe
  C:\Windows\System\vhoAhSw.exe
  2⤵
  PID:9552
- C:\Windows\System\ImtgDtl.exe
  C:\Windows\System\ImtgDtl.exe
  2⤵
  PID:9812
- C:\Windows\System\UEBJlKC.exe
  C:\Windows\System\UEBJlKC.exe
  2⤵
  PID:9904
- C:\Windows\System\hqUnTUw.exe
  C:\Windows\System\hqUnTUw.exe
  2⤵
  PID:9796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EQVisql.exe

Filesize
1.3MB

MD5
b7456aadc10a6932af36720e50f3848e

SHA1
f8b80a98f2fce47854eacfb4a930c63ed927632b

SHA256
5861ace4e0b96e45affa1d6181b8ca3acbb5cb1f734d15b11b930492dcbe6f5c

SHA512
1dc8022686bb299efe26ed902de00cbdb080caf8e83bad8a35b61dddff09d37580424013501af1c0c2652b93f0ecab43bbcc58ee68e9c4603e35d73d91bc590e

Download Submit
C:\Windows\system\GFpliKm.exe

Filesize
1.3MB

MD5
9e75b3fd3d2050ba2d4822922fece98d

SHA1
345f79e8c5611341e6eae9a2f5c9f3e24c3331e9

SHA256
f1f5ea72d62731face1c284ed1fae7c5b29e8eb3cc755c6e8dcfd3b84588602a

SHA512
ba823bc688949125d2df87c88abb4e9497598fbb7f74c45b5a2a49b0d3cf475451ba0a4fc7e3564a29eec1021723d3f9aafdf3d6ca80ff423d7e78c890b5b9a9

Download Submit
C:\Windows\system\HkQOWTQ.exe

Filesize
1.3MB

MD5
628a9b65b4b19d01aef50326e17178f6

SHA1
8e6b2df84ba2b8dd699f9ff64ccecbd39888d007

SHA256
6292037a6aa1a02470753bbbc1c1128b1c1efaa05b3508fb18ab2685cb564d25

SHA512
adcfae7d908d56d1a0533e1983dcaa257b2999cb3888f90baa8d5c01e25528310c97b18853d6348c823b25d3c774be32591d3df501d1245f7380af45238f4901

Download Submit
C:\Windows\system\KCyAQyx.exe

Filesize
1.3MB

MD5
f5c392d09cd9908fee04873ca8aa02af

SHA1
05583f4216f8225fd5ae4ec3d461956d5b393d39

SHA256
b06bc387f5c013b1235128ea7036765c259988362007b62f82417f300d69c315

SHA512
c201b53d2f2d843474304638aff764a2f6aac6b2f38e35722f28304755d8652dbc7fe50afe91fa60917abf44997b3545fac93bce2b66581dde6429fc9c430692

Download Submit
C:\Windows\system\KNVvNFu.exe

Filesize
1.3MB

MD5
c7157eec1ef7b88a707a47a019fc94a2

SHA1
15b063beefc7455bcc7bf85751d4ea70da984a44

SHA256
0c5d6a5c1770bd2a3d1ecfe7e44c36911537bf4c341d8f1744ecab6a229fa2ab

SHA512
c710fffac8417909300db64fa8aabeee1e3c3e914c0ca2b9de6cf9391248de8e6443043dfda3c2426fb5c2e9813d7ae1c55d0d2ec4f144040c7499bd3fd9616f

Download Submit
C:\Windows\system\KXnMudB.exe

Filesize
1.3MB

MD5
d28cee3440f16c79d7771443357d2780

SHA1
3a4932ceca2260658d9d8d3276171b14f378f204

SHA256
1d1d3a4ca4a75b117a80087cf4ca7455e23e914fec79db656282bde89917a680

SHA512
279c91d01f2829d6b308744e88aff658c3f420bb6a5bddd25b5e53da26d4b67b82a7b82e56e42ce3411d330853798e22b5364a7a3a47e47bc90cfe5d90a6e71f

Download Submit
C:\Windows\system\KbEuHoK.exe

Filesize
1.3MB

MD5
ca069b1098f3dfe310e964498b7aed43

SHA1
d3112f0c436c6f51edd36bd6000d6f33e350bee8

SHA256
fae919db3e74540de0cfd21ed07dc8bb833b00556031048d4a403005f3e22427

SHA512
cc15661e42b15d751fff4dd9156911c5c991dda39ae782b3d561833b47e9aaba08554ea2f2f670bcecbd0dfc976611837c7a7c62f7389fcc057bd793125871d4

Download Submit
C:\Windows\system\MvzCXye.exe

Filesize
1.3MB

MD5
757a195ee2954ebd513a202b6962fde2

SHA1
6afa3c57836ecb58084a2290dbbd22c1f594ae07

SHA256
b34a3e8446d2e0f391fdd8a13e0901588a7b36c86978314e79c8d4980773008d

SHA512
6dd2f7f54c471f8fd9df64fe107101cc77f043bfd250db7ee7ff24d8b5149e0a17dfbfa4d5a83a8599759255332f2e5b46b68d05a67c4c4636376d3e6c2d1c59

Download Submit
C:\Windows\system\NyFriFe.exe

Filesize
1.3MB

MD5
4f0dff9203c481ca61efc874f183bdaa

SHA1
e459c47df0d7320087f39b1344f01e202c6f1629

SHA256
b21e9a7ebb9c02f03332e07b24199bbfc9329d166bbfab0b5725dcaa08d4b489

SHA512
7d0d1dc60e93544fb9bfcbd9d7f2965fbc78c912cd88d64bf777f0e376950459dc0ebb23f5a1f4ba6121ca6b0f3aadf721a797ecae3a889da63e97b4bd3409b3

Download Submit
C:\Windows\system\OgYGylV.exe

Filesize
1.3MB

MD5
d21fa625c841b6c384396b4d06ef2472

SHA1
9d05b3bf03f424bc1c77e122ba133840c3d58848

SHA256
4f8526f388529bd1a3e9437f7a7e4d557df69cfdb7292a756c0ba3eb71f9fc8e

SHA512
8036a9e5dbd94e0c51c50469d2f466cd123823dbd5a3f816baca5be421accc8b913e5dbc0b94e72348df5a2577817e996e4ca9847df99a603ef46cf3a3f07fe0

Download Submit
C:\Windows\system\SqNwqzH.exe

Filesize
1.3MB

MD5
970bf2bed61aff3f27184ca1dea26a63

SHA1
337644f29c074beafe3c07eb8f78ace5ec86a3fe

SHA256
c7164269f407ee04464982fd53a8d16e0ceb78ce7d1f0062bc73437c05477cce

SHA512
85fdf668f71ef282480614e7f5389235f5be47c7061b374e4b27db7b2d28443529e20fac6a72231bf92254b58acea625445e2e033bf2c6a05492436dbfaafa85

Download Submit
C:\Windows\system\XQlxQvK.exe

Filesize
1.3MB

MD5
fd5bfb865e9f908180f6ef0eddc3423f

SHA1
cf4004a18219d5f88dd10e01ab00456f29637656

SHA256
9a63898733e9f913d8bae2fee2de2ba38ba64708f0d37cbc72821bb74a90cd6b

SHA512
0d1b4518a00d608fab4056bbdc2d9d81d2262326bf632fab27fe9dcdd5a2f72ed0aa1bae9a23ca52dbc4cccb4bd3edf9c6904b5b449c0b603a0bda4baea7abcf

Download Submit
C:\Windows\system\YBXESjP.exe

Filesize
1.3MB

MD5
29c088232fd5d30b3d9d288b6c20ae05

SHA1
a070d1cc533a28214c13add4398df5b706f8c8fc

SHA256
11376b127aa45e8bc4ed7bd9ce4321673a44c2ccd7041c285c206098b5a7b2c0

SHA512
e48e7e3c992830fa8b003684e8030a9195bc223e59e501eda0556b0458e0715615397150290271950d6d868f7476bf95abd9b4f474a5f40e551ee0091e622fb0

Download Submit
C:\Windows\system\ZWyibHo.exe

Filesize
1.3MB

MD5
5534087527487c84d5ac269326f2fc40

SHA1
64031e31f129c79ca1a60b8c737dcc1f650f40d7

SHA256
f32f5830d936ca00837a78ece32c1a098199bf8c2b4d50c4e685357ef67a903e

SHA512
2a3f4080a40641ef42304fa0782c3716ccb9a52e2c738da5d3afd7882c3a7430e87b60615a8a80bf6b56fc905514396e3d63894d616d9a0e8cea8c2ddc789878

Download Submit
C:\Windows\system\ZpALAVK.exe

Filesize
1.3MB

MD5
8f2dcfa5a08d76f1712b8e6ddc0cf10f

SHA1
e3af81560adbc604e4fae7ed1101b018f7736d2e

SHA256
73198168b127f8a6bf99ef6dea96bb3eae0cdeaa01327758a1b7ff8c4a3a31ba

SHA512
9acb32be753f6dd1a9f87b195417af329fece18494a9d7c43971d1215b53ebe0e259b555657653a6712267c761976de15fe8cc8588677cb215da603a2fd5e5d4

Download Submit
C:\Windows\system\ceqerCC.exe

Filesize
1.3MB

MD5
8bf49896afb88a62fa713f182a9c7a0c

SHA1
9882148fde273fac2e9e937eeed099263125fd2b

SHA256
9f2ee683ce6b448ec8defe839bbe2a0ef0963c10f72e515a320ff6b89de538fa

SHA512
4663b2e0fa129f812cb1abb021f3258401cd5c68f2c0faff7c085ff19fe1561ff91bf59d65b44850faef637315cff76033636841c98a2178a71f3abb557c8599

Download Submit
C:\Windows\system\ixlDVdV.exe

Filesize
1.3MB

MD5
4b75b271bd8f99ae63876634feef14b2

SHA1
f3f5e2726b30315cee72df3d8bbc51ad8d54cb59

SHA256
62850033371ba6e029342924a656234431168b7ea9b1b204dbca09e2a128c58d

SHA512
3e6983201674c8dab861c9c3f175c71aee9cce4220beb7b1029aeb3ef451b43d7a77d4fa77304772127beb5a511e36d40a963373fb130da17f792af3f8c177cf

Download Submit
C:\Windows\system\pRNcUip.exe

Filesize
1.3MB

MD5
0f42564335d228ba22dfed34e19e335c

SHA1
72b1b23f53975338e6e9be7836d26839238dcde5

SHA256
3ba1492b2e9395f61b0013f79a9cf1efbb4878a9a27ae0e9b8e8c31d39754bb5

SHA512
dc5cbb052f08a3e1e67e73aa30e397b91bee51b74c181ca1d98d861dcd447b832fcec6af1cfa57af262f7d83702423f9df849f6cc5aab24547c8194d5faef5e5

Download Submit
C:\Windows\system\pjbjYFJ.exe

Filesize
1.3MB

MD5
1675508590c5d89a7ad3014947bea71f

SHA1
54abd048dbb3e9bab3b6dfc0554165f4d0992aae

SHA256
a9ce8d6bbb7200e410770944576d5bfc2df48a0f5f1f3284ccb8acb8022cbef0

SHA512
adcf0b8611e6aae32959c1959833f43644e381a7bab096cd3b1459fcf17fdced062bc5f2266a7f9fdb61df9e92be8da32fb8ac0fbe3746ebfabdbde7670fcd46

Download Submit
C:\Windows\system\puEwAYF.exe

Filesize
1.3MB

MD5
f7b54ac290e2f5b5c857950b4733000b

SHA1
4c6a0a003f821aed5387dd7126fa443e15f96328

SHA256
6f3b058248e3bc0099e2219f043ba5f049a22fb2aa6e7175bc2bb2f3d17400e3

SHA512
42d2e9f1832a61e5460ac488d7aa6740f51fbabcd413e09fb67a496c42887ad644e70e510e852c239f126829fcf524a8f1ba93d29d2442d7798ccc69f7024bbe

Download Submit
C:\Windows\system\qqlydHR.exe

Filesize
1.3MB

MD5
df33cc0ca157755b01c0673dd45d5b35

SHA1
ba278962f8d7bf34fce3d943b3e56fed8a5d9e52

SHA256
15f7eacebf7a878d010289cf8e03c9909b6f29b48872dac5c2525792c40ace8b

SHA512
1f6021e06527b5fee21a9a4dbaeeb1901351b1cd6819553ea65e5e5637fce7d9bec4fa64d31b33529cc52430a0b18cf417301b15178773c4386698d31cff74ec

Download Submit
C:\Windows\system\qwSgpQt.exe

Filesize
1.3MB

MD5
0ca8019d32bc405d80464ffec40d766e

SHA1
1276f459a0982b801cbcfd84115d544ecd3a75cb

SHA256
332540fcd124ff4a02eb5f4f72becea8e265038d5cf6d005d284100a9086906a

SHA512
4b21ca0f6f81ee785a9c5158102f65a278c77c2779c1a3483750f9b3bbdd98d302b3b5ed97bcfb341657fc4d2015b771156be65d32b6f86764e60fbccb148fd0

Download Submit
C:\Windows\system\rTBxIGd.exe

Filesize
1.3MB

MD5
205e936d06aa2c4ec33dae6a90b14a5f

SHA1
4c89e5c24be62f1f3766b6f0446703dd25fc730d

SHA256
a550d64f83ac8ecc5d6c660140804e206f6f41f4343109258ca352d74e8c3c9e

SHA512
ac44f656669b8cddf8f8422a51ebae074e5af933b9a7f56ae6f0b1c43b732f6e59e173b0a270eb0d805d041ab8a88746346406bb11e2a80a9eaf4f282f81bd8f

Download Submit
C:\Windows\system\tROJtaF.exe

Filesize
1.3MB

MD5
e57d48e68b3aa7de98a9a2e31b3d8e0d

SHA1
fd2c9c8a133937f9a8302354d8a32ec0979f6dcd

SHA256
cf0273478579580440d402329b473513b12fbcff6103805705b3940cab6bdb56

SHA512
f8f0382c3051953cb15565052df2ca84e048cf2db4242d797240b1589190a4559efba33594a4a917b04f2a3b72b39fbd81e7943d18ad8f50d5eaea7ee00dfcc8

Download Submit
C:\Windows\system\utEjclg.exe

Filesize
1.3MB

MD5
2c30968ebcf10e7663dfc9fe6b7d02b7

SHA1
79459261536a2a0cd08695ecc3ee52cd609bcc2e

SHA256
030e65b983aaae0c8b460cd971b78370b6e05e2016537571159caa446e13aac5

SHA512
7c7c4a618ea9de2d3fa1c095f32be95f2dbfa27778e865d72ebc107aac9dbeff8ca02c19fc5ecef978664eaf000d611911deafc2c916b87328d2ad240f801ee8

Download Submit
C:\Windows\system\vXaJwTR.exe

Filesize
1.3MB

MD5
4b50d4acf2ab3ccffc5cc7a70cb1326f

SHA1
a32cb0308e1811bcd2ebb4e36b2dcb3bb01027fa

SHA256
bec938527ae49e8f168a2db2972e71b4969bc035c5c11d66a3cf417cd6ca6e6e

SHA512
36343ee1acc203e9bf7c2e26dca2e57e1841eda832834eeb120156d99ab237b9596b27391dec407b02a9554eb48ecb4e4bd13d7ffe9d72581f321527eccac61b

Download Submit
C:\Windows\system\wwDURUC.exe

Filesize
1.3MB

MD5
1deacd6417bbac9e767c5b69ff610f82

SHA1
558269162d5935276cf5e65a51e1b6b62f01b105

SHA256
ed72bf26791af0fcf1753f95d831cbee93b24dbb6bc2aae6f1f171a36a8dfa20

SHA512
791c397d2907316da27d4c8a2e51a97eee23dbcfa5e75c485cbc49bfa39c5dcdcf4858adad3e902945aab5a7f80924fb87d23c910176c507875feafbfbe75748

Download Submit
C:\Windows\system\xrhYAzh.exe

Filesize
1.3MB

MD5
e5de74fa29a4096a1bed5d296d75623c

SHA1
2736cfdc13edc21815fc702da552c5e53e7a0360

SHA256
0176174107b747f4e6bb7e5fa21fb83974e3b2b0801d91b684190c3f9f6b5937

SHA512
513698469599ef7f863ef5d97d25244e48ddc028d3734957ca688f9472f37feb7c2610a6c3e17a59af9f969813b887ad5d3a46b0bf2eb0adbd5d6e92cce8c9fb

Download Submit
C:\Windows\system\zGRwsFW.exe

Filesize
1.3MB

MD5
548e51f9a3ba5c362e3995a84d2d9e60

SHA1
e4196c512466b93fed91af0217b1774b09aec364

SHA256
fae7ed5bb2aa3e202386cdf2c70baa9b62a246b3208a7cfb17bac89216d2b451

SHA512
e9c907807d9bd5007359847ec4da01ff53cb669f1597a45ef5061c236605442bc90b7d03f5de37447d34e62b82b8e8bdbc88cb2b71b4fb74c07b9a40480b8b53

Download Submit
\Windows\system\WMZYcIP.exe

Filesize
1.3MB

MD5
183aeec1c6b828d8ea7ea7a8188cd0cb

SHA1
b979184d4007431562c32b3bbe7ac1b04128fc06

SHA256
8489f3c7fb412d2634cea341242f0324dfb9cb9f4804fec4453eb4d49bbec73c

SHA512
19e7a0a784677f6fa8c418eb20e6f806c47d092e86cdb5b71c1b202c1c1a7c579393664bb0bc8bb9f61ec5994aa657d9b40082550665112acea54f6cc5ec3f3e

Download Submit
\Windows\system\klfKURM.exe

Filesize
1.3MB

MD5
4357d9a6b461e5e1b4f1b1b13fbe36d4

SHA1
436a907377fda3e9a693861dee7dea4913573831

SHA256
ac56572943335f149c1481580ac9380990e6e1871fc3730ca274d49fb5412cbf

SHA512
c8850374f91de0990fbc785883bee78400b74ea501516b17458c5ed7b9d5ea9d2401b1913e2a07fcdfb1bafb4cad533cdc256de1e1a29a61632a9e1686f31e07

Download Submit
\Windows\system\ntQptxf.exe

Filesize
1.3MB

MD5
0ef852df962c865fcf47f8289482856e

SHA1
6f5778bd486fa172c6ec635de85de6e9af4c9449

SHA256
0af91b522019d3f917f8022f87f052dab2fdeb5545d57ef1932d81b148ff1514

SHA512
ce246bec15817ceccae09747d85930f2288e34b185b3164da87810a2e4174d9b43f92e6797d0e5d7664a02a32269495c95f7024bfb3381f96d40f977f18a6307

Download Submit
memory/2108-2734-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download
memory/2108-3956-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download
memory/2108-8-0x000000013FBF0000-0x000000013FF41000-memory.dmp

Filesize
3.3MB

Download
memory/2112-3873-0x000000013F6E0000-0x000000013FA31000-memory.dmp

Filesize
3.3MB

Download
memory/2112-552-0x000000013F6E0000-0x000000013FA31000-memory.dmp

Filesize
3.3MB

Download
memory/2516-3991-0x000000013F550000-0x000000013F8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2516-520-0x000000013F550000-0x000000013F8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2588-527-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2588-3869-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2628-3866-0x000000013F460000-0x000000013F7B1000-memory.dmp

Filesize
3.3MB

Download
memory/2628-508-0x000000013F460000-0x000000013F7B1000-memory.dmp

Filesize
3.3MB

Download
memory/2632-3255-0x000000013FCB0000-0x0000000140001000-memory.dmp

Filesize
3.3MB

Download
memory/2632-501-0x000000013FCB0000-0x0000000140001000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4084-0x000000013FCB0000-0x0000000140001000-memory.dmp

Filesize
3.3MB

Download
memory/2636-3839-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2636-518-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2684-511-0x000000013FB00000-0x000000013FE51000-memory.dmp

Filesize
3.3MB

Download
memory/2684-3862-0x000000013FB00000-0x000000013FE51000-memory.dmp

Filesize
3.3MB

Download
memory/2732-555-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2732-3889-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2788-513-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2788-3854-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2808-3863-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2808-3253-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2808-14-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2956-3851-0x000000013FAD0000-0x000000013FE21000-memory.dmp

Filesize
3.3MB

Download
memory/2956-503-0x000000013FAD0000-0x000000013FE21000-memory.dmp

Filesize
3.3MB

Download
memory/2988-554-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3510-0x000000013F6E0000-0x000000013FA31000-memory.dmp

Filesize
3.3MB

Download
memory/2988-509-0x000000013FB00000-0x000000013FE51000-memory.dmp

Filesize
3.3MB

Download
memory/2988-1839-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-512-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3065-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2988-515-0x0000000001D80000-0x00000000020D1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2988-3254-0x0000000001D80000-0x00000000020D1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3495-0x000000013FAD0000-0x000000013FE21000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3499-0x000000013FB00000-0x000000013FE51000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3505-0x0000000001D80000-0x00000000020D1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3506-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3508-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3507-0x000000013F550000-0x000000013F8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3502-0x000000013FAF0000-0x000000013FE41000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3511-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2988-502-0x000000013FAD0000-0x000000013FE21000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3509-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3497-0x000000013F460000-0x000000013F7B1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-3657-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-517-0x000000013F0B0000-0x000000013F401000-memory.dmp

Filesize
3.3MB

Download
memory/2988-519-0x000000013F550000-0x000000013F8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-531-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/2988-12-0x000000013F900000-0x000000013FC51000-memory.dmp

Filesize
3.3MB

Download
memory/2988-551-0x000000013F6E0000-0x000000013FA31000-memory.dmp

Filesize
3.3MB

Download
memory/2988-553-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/2988-23-0x0000000001D80000-0x00000000020D1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-0-0x000000013FFA0000-0x00000001402F1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-504-0x000000013F460000-0x000000013F7B1000-memory.dmp

Filesize
3.3MB

Download
memory/2988-523-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/3032-3891-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/3032-550-0x000000013FA10000-0x000000013FD61000-memory.dmp

Filesize
3.3MB

Download
memory/3068-3876-0x000000013FE50000-0x00000001401A1000-memory.dmp

Filesize
3.3MB

Download
memory/3068-516-0x000000013FE50000-0x00000001401A1000-memory.dmp

Filesize
3.3MB

Download