xmrig | 764ae6091e92cead1efae1227e0cad74593f52c2d40d00363084f7e4b5251606

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

779e9141075a779462aa494c44412490_NeikiAnalytics.exe
Size

2.0MB
MD5

779e9141075a779462aa494c44412490
SHA1

55f6deafa8f54d810f6a998d1347e6bad2f901b3
SHA256

764ae6091e92cead1efae1227e0cad74593f52c2d40d00363084f7e4b5251606
SHA512

2fa932e3dd391d816025d55efe2974766143640f5ec069acf1d3e86beafebb97acc4e8adb7eeaa5df534f3e92eb1b81ded47050e17932ec9a7e6c0a8609cfa97
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIQW/dLUoJlrug:BemTLkNdfE0pZrQ6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/1712-0-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig
behavioral1/files/0x000a000000015f7a-3.dat	xmrig
behavioral1/files/0x00090000000167d5-9.dat	xmrig
behavioral1/files/0x0008000000016bfb-11.dat	xmrig
behavioral1/files/0x0007000000016c51-20.dat	xmrig
behavioral1/files/0x0007000000016c04-23.dat	xmrig
behavioral1/files/0x0008000000016ca5-29.dat	xmrig
behavioral1/files/0x0007000000016d16-36.dat	xmrig
behavioral1/files/0x0007000000016d1a-42.dat	xmrig
behavioral1/memory/2852-35-0x000000013F520000-0x000000013F874000-memory.dmp	xmrig
behavioral1/memory/2460-83-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/files/0x0006000000017407-139.dat	xmrig
behavioral1/memory/1712-1635-0x000000013F0D0000-0x000000013F424000-memory.dmp	xmrig
behavioral1/files/0x0006000000018fbf-189.dat	xmrig
behavioral1/files/0x0006000000018ed8-184.dat	xmrig
behavioral1/files/0x0006000000018bab-179.dat	xmrig
behavioral1/files/0x0006000000018ba1-174.dat	xmrig
behavioral1/files/0x0005000000018717-169.dat	xmrig
behavioral1/files/0x000500000001860c-164.dat	xmrig
behavioral1/files/0x000d0000000185f4-159.dat	xmrig
behavioral1/files/0x00140000000185e9-155.dat	xmrig
behavioral1/files/0x0006000000017422-144.dat	xmrig
behavioral1/files/0x00060000000173f2-134.dat	xmrig
behavioral1/files/0x00060000000174a5-149.dat	xmrig
behavioral1/files/0x0006000000017374-124.dat	xmrig
behavioral1/files/0x000600000001737c-129.dat	xmrig
behavioral1/files/0x0006000000017371-119.dat	xmrig
behavioral1/files/0x000600000001735a-114.dat	xmrig
behavioral1/files/0x0006000000016fed-109.dat	xmrig
behavioral1/files/0x0006000000016e4a-103.dat	xmrig
behavioral1/memory/1492-99-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/memory/2488-92-0x000000013F430000-0x000000013F784000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d57-89.dat	xmrig
behavioral1/files/0x0006000000016e24-96.dat	xmrig
behavioral1/memory/1712-82-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d3e-77.dat	xmrig
behavioral1/memory/2668-76-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2548-75-0x000000013F970000-0x000000013FCC4000-memory.dmp	xmrig
behavioral1/memory/2168-72-0x000000013F460000-0x000000013F7B4000-memory.dmp	xmrig
behavioral1/memory/2396-71-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/2564-63-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	xmrig
behavioral1/memory/2596-59-0x000000013F1E0000-0x000000013F534000-memory.dmp	xmrig
behavioral1/memory/1324-58-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/3032-53-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/1712-41-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/files/0x0009000000016cc6-38.dat	xmrig
behavioral1/files/0x0007000000016c7c-37.dat	xmrig
behavioral1/memory/2448-81-0x000000013F060000-0x000000013F3B4000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d51-80.dat	xmrig
behavioral1/memory/2216-26-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	xmrig
behavioral1/memory/2448-2810-0x000000013F060000-0x000000013F3B4000-memory.dmp	xmrig
behavioral1/memory/2460-2812-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig
behavioral1/memory/2488-2934-0x000000013F430000-0x000000013F784000-memory.dmp	xmrig
behavioral1/memory/1492-3162-0x000000013F560000-0x000000013F8B4000-memory.dmp	xmrig
behavioral1/memory/2852-4020-0x000000013F520000-0x000000013F874000-memory.dmp	xmrig
behavioral1/memory/2216-4021-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	xmrig
behavioral1/memory/3032-4022-0x000000013FD60000-0x00000001400B4000-memory.dmp	xmrig
behavioral1/memory/1324-4023-0x000000013F670000-0x000000013F9C4000-memory.dmp	xmrig
behavioral1/memory/2596-4024-0x000000013F1E0000-0x000000013F534000-memory.dmp	xmrig
behavioral1/memory/2564-4025-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	xmrig
behavioral1/memory/2396-4026-0x000000013F920000-0x000000013FC74000-memory.dmp	xmrig
behavioral1/memory/2168-4027-0x000000013F460000-0x000000013F7B4000-memory.dmp	xmrig
behavioral1/memory/2668-4028-0x000000013FA70000-0x000000013FDC4000-memory.dmp	xmrig
behavioral1/memory/2460-4030-0x000000013FF20000-0x0000000140274000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2216	MrKQnhK.exe
2852	rMackNe.exe
3032	iMHeBJy.exe
1324	OCiwTJA.exe
2596	VlMvDFW.exe
2396	nOXgwxR.exe
2564	ylmBtAA.exe
2168	fjxTDxa.exe
2548	ROWJuRT.exe
2668	uyGCkAu.exe
2448	wpWsgJj.exe
2460	zfotkQl.exe
2488	ZkkxeOY.exe
1492	OOiQrYO.exe
2004	zifxuFd.exe
1088	wydWxkB.exe
2332	QjyaLCd.exe
1972	fcVyklT.exe
2184	LOqsGVc.exe
1204	pjQnJQF.exe
2620	dvqqiCX.exe
2700	XgizBpU.exe
2000	MDcYEBr.exe
1640	JdzpIFT.exe
1608	jbjdmYe.exe
2276	cEnpapm.exe
576	GJnwULm.exe
748	QTFghSG.exe
584	pJEmTsO.exe
1464	fZMNChp.exe
1904	KdPWxfP.exe
2412	yNKbvrS.exe
1336	mqNKliN.exe
972	kTmCgFw.exe
2884	lrShcSd.exe
1764	YFkSRcB.exe
1064	kgdxQEJ.exe
1808	ISccQKN.exe
752	fndyxhw.exe
1820	VbVcLEO.exe
1172	DGfEzKr.exe
2072	ouwMnYk.exe
904	erzoBgz.exe
568	WhzLUgK.exe
1580	gitaapF.exe
2120	SAdKEQw.exe
2116	uGmuNsy.exe
1072	JNOuSCM.exe
2076	JNUPKfj.exe
2104	IHoSxVW.exe
892	TjMvWCi.exe
2968	TkisSLQ.exe
2912	mxZiDyT.exe
2132	MHHTTdc.exe
1600	meXlYuQ.exe
2848	xajetgA.exe
2644	pTxLsCI.exe
2740	IMpNTsO.exe
2660	viFBOnN.exe
2504	owCJoGY.exe
2540	ZbLcAmI.exe
2804	ysrQgmK.exe
2388	AcBOYhv.exe
2008	umsOaWj.exe

Loads dropped DLL 64 IoCs

pid	Process
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1712-0-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx
behavioral1/files/0x000a000000015f7a-3.dat	upx
behavioral1/files/0x00090000000167d5-9.dat	upx
behavioral1/files/0x0008000000016bfb-11.dat	upx
behavioral1/files/0x0007000000016c51-20.dat	upx
behavioral1/files/0x0007000000016c04-23.dat	upx
behavioral1/files/0x0008000000016ca5-29.dat	upx
behavioral1/files/0x0007000000016d16-36.dat	upx
behavioral1/files/0x0007000000016d1a-42.dat	upx
behavioral1/memory/2852-35-0x000000013F520000-0x000000013F874000-memory.dmp	upx
behavioral1/memory/2460-83-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/files/0x0006000000017407-139.dat	upx
behavioral1/memory/1712-1635-0x000000013F0D0000-0x000000013F424000-memory.dmp	upx
behavioral1/files/0x0006000000018fbf-189.dat	upx
behavioral1/files/0x0006000000018ed8-184.dat	upx
behavioral1/files/0x0006000000018bab-179.dat	upx
behavioral1/files/0x0006000000018ba1-174.dat	upx
behavioral1/files/0x0005000000018717-169.dat	upx
behavioral1/files/0x000500000001860c-164.dat	upx
behavioral1/files/0x000d0000000185f4-159.dat	upx
behavioral1/files/0x00140000000185e9-155.dat	upx
behavioral1/files/0x0006000000017422-144.dat	upx
behavioral1/files/0x00060000000173f2-134.dat	upx
behavioral1/files/0x00060000000174a5-149.dat	upx
behavioral1/files/0x0006000000017374-124.dat	upx
behavioral1/files/0x000600000001737c-129.dat	upx
behavioral1/files/0x0006000000017371-119.dat	upx
behavioral1/files/0x000600000001735a-114.dat	upx
behavioral1/files/0x0006000000016fed-109.dat	upx
behavioral1/files/0x0006000000016e4a-103.dat	upx
behavioral1/memory/1492-99-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/memory/2488-92-0x000000013F430000-0x000000013F784000-memory.dmp	upx
behavioral1/files/0x0006000000016d57-89.dat	upx
behavioral1/files/0x0006000000016e24-96.dat	upx
behavioral1/files/0x0007000000016d3e-77.dat	upx
behavioral1/memory/2668-76-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2548-75-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/2168-72-0x000000013F460000-0x000000013F7B4000-memory.dmp	upx
behavioral1/memory/2396-71-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/2564-63-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	upx
behavioral1/memory/2596-59-0x000000013F1E0000-0x000000013F534000-memory.dmp	upx
behavioral1/memory/1324-58-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/3032-53-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/files/0x0009000000016cc6-38.dat	upx
behavioral1/files/0x0007000000016c7c-37.dat	upx
behavioral1/memory/2448-81-0x000000013F060000-0x000000013F3B4000-memory.dmp	upx
behavioral1/files/0x0006000000016d51-80.dat	upx
behavioral1/memory/2216-26-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	upx
behavioral1/memory/2448-2810-0x000000013F060000-0x000000013F3B4000-memory.dmp	upx
behavioral1/memory/2460-2812-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/memory/2488-2934-0x000000013F430000-0x000000013F784000-memory.dmp	upx
behavioral1/memory/1492-3162-0x000000013F560000-0x000000013F8B4000-memory.dmp	upx
behavioral1/memory/2852-4020-0x000000013F520000-0x000000013F874000-memory.dmp	upx
behavioral1/memory/2216-4021-0x000000013FBA0000-0x000000013FEF4000-memory.dmp	upx
behavioral1/memory/3032-4022-0x000000013FD60000-0x00000001400B4000-memory.dmp	upx
behavioral1/memory/1324-4023-0x000000013F670000-0x000000013F9C4000-memory.dmp	upx
behavioral1/memory/2596-4024-0x000000013F1E0000-0x000000013F534000-memory.dmp	upx
behavioral1/memory/2564-4025-0x000000013FAA0000-0x000000013FDF4000-memory.dmp	upx
behavioral1/memory/2396-4026-0x000000013F920000-0x000000013FC74000-memory.dmp	upx
behavioral1/memory/2168-4027-0x000000013F460000-0x000000013F7B4000-memory.dmp	upx
behavioral1/memory/2668-4028-0x000000013FA70000-0x000000013FDC4000-memory.dmp	upx
behavioral1/memory/2460-4030-0x000000013FF20000-0x0000000140274000-memory.dmp	upx
behavioral1/memory/2548-4029-0x000000013F970000-0x000000013FCC4000-memory.dmp	upx
behavioral1/memory/2448-4031-0x000000013F060000-0x000000013F3B4000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\obIprxa.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\WHemLuN.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\sMOXyTO.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\ELcmEFL.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\GJnwULm.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\ysrQgmK.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\IdDzAio.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\bOnXSrT.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\INnhAwD.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\ZhLVfkW.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\dwyXkTp.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\HTMFNhp.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\IhTLGBB.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\mqDGyZV.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\hOTUMai.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\TBxCZof.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\nkkNomJ.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\uKUSUXA.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\WMfjGag.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\ZBMDJoM.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\juxQavj.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\JvmxdUc.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\vwlbsSs.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\pLYHcCg.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\HnQCuBL.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\BYLOTZI.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\jyupKDw.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\AhUXxEn.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\AyoQaqo.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\YtnovzT.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\WTPmqXC.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\XLbmdyJ.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\yTbDiop.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\lajGEJm.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\HAfXdHq.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\XmaozXg.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\KNQzsGE.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\QpneBiL.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\zxzVLpN.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\aSTnwFR.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\VUEysdh.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\GEabGiy.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\NagmSPk.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\wzFUSwg.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\RAIssru.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\coEFlTd.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\kgdxQEJ.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\ccClUSZ.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\GBJfiwI.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\MXVOaxX.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\gApYoKu.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\AAAdmVp.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\phoYnSz.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\tPAUkYN.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\PURWXRf.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\asFfQhJ.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\wDelrRV.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\TIzmRZE.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\KGVYhLC.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\ZnYQwlI.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\FBGmUnG.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\FkohnNF.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\EhwDVGf.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe
File created	C:\Windows\System\jxkEHIt.exe	779e9141075a779462aa494c44412490_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2216	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 2216	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 2216	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	29
PID 1712 wrote to memory of 2852	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 2852	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 2852	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	30
PID 1712 wrote to memory of 2396	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	31
PID 1712 wrote to memory of 2396	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	31
PID 1712 wrote to memory of 2396	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	31
PID 1712 wrote to memory of 3032	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 3032	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 3032	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	32
PID 1712 wrote to memory of 2168	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	33
PID 1712 wrote to memory of 2168	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	33
PID 1712 wrote to memory of 2168	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	33
PID 1712 wrote to memory of 1324	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1324	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 1324	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	34
PID 1712 wrote to memory of 2548	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2548	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2548	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	35
PID 1712 wrote to memory of 2596	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	36
PID 1712 wrote to memory of 2596	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	36
PID 1712 wrote to memory of 2596	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	36
PID 1712 wrote to memory of 2668	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	37
PID 1712 wrote to memory of 2668	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	37
PID 1712 wrote to memory of 2668	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	37
PID 1712 wrote to memory of 2564	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	38
PID 1712 wrote to memory of 2564	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	38
PID 1712 wrote to memory of 2564	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	38
PID 1712 wrote to memory of 2448	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	39
PID 1712 wrote to memory of 2448	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	39
PID 1712 wrote to memory of 2448	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	39
PID 1712 wrote to memory of 2460	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	40
PID 1712 wrote to memory of 2460	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	40
PID 1712 wrote to memory of 2460	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	40
PID 1712 wrote to memory of 2488	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	41
PID 1712 wrote to memory of 2488	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	41
PID 1712 wrote to memory of 2488	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	41
PID 1712 wrote to memory of 1492	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	42
PID 1712 wrote to memory of 1492	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	42
PID 1712 wrote to memory of 1492	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	42
PID 1712 wrote to memory of 2004	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	43
PID 1712 wrote to memory of 2004	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	43
PID 1712 wrote to memory of 2004	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	43
PID 1712 wrote to memory of 1088	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	44
PID 1712 wrote to memory of 1088	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	44
PID 1712 wrote to memory of 1088	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	44
PID 1712 wrote to memory of 2332	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	45
PID 1712 wrote to memory of 2332	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	45
PID 1712 wrote to memory of 2332	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	45
PID 1712 wrote to memory of 1972	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	46
PID 1712 wrote to memory of 1972	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	46
PID 1712 wrote to memory of 1972	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	46
PID 1712 wrote to memory of 2184	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	47
PID 1712 wrote to memory of 2184	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	47
PID 1712 wrote to memory of 2184	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	47
PID 1712 wrote to memory of 1204	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	48
PID 1712 wrote to memory of 1204	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	48
PID 1712 wrote to memory of 1204	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	48
PID 1712 wrote to memory of 2620	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	49
PID 1712 wrote to memory of 2620	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	49
PID 1712 wrote to memory of 2620	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	49
PID 1712 wrote to memory of 2700	1712	779e9141075a779462aa494c44412490_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\779e9141075a779462aa494c44412490_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\779e9141075a779462aa494c44412490_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\System\MrKQnhK.exe
  C:\Windows\System\MrKQnhK.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\rMackNe.exe
  C:\Windows\System\rMackNe.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\nOXgwxR.exe
  C:\Windows\System\nOXgwxR.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\iMHeBJy.exe
  C:\Windows\System\iMHeBJy.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\fjxTDxa.exe
  C:\Windows\System\fjxTDxa.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\OCiwTJA.exe
  C:\Windows\System\OCiwTJA.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\ROWJuRT.exe
  C:\Windows\System\ROWJuRT.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\VlMvDFW.exe
  C:\Windows\System\VlMvDFW.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uyGCkAu.exe
  C:\Windows\System\uyGCkAu.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ylmBtAA.exe
  C:\Windows\System\ylmBtAA.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\wpWsgJj.exe
  C:\Windows\System\wpWsgJj.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\zfotkQl.exe
  C:\Windows\System\zfotkQl.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\ZkkxeOY.exe
  C:\Windows\System\ZkkxeOY.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\OOiQrYO.exe
  C:\Windows\System\OOiQrYO.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\zifxuFd.exe
  C:\Windows\System\zifxuFd.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wydWxkB.exe
  C:\Windows\System\wydWxkB.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\QjyaLCd.exe
  C:\Windows\System\QjyaLCd.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\fcVyklT.exe
  C:\Windows\System\fcVyklT.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\LOqsGVc.exe
  C:\Windows\System\LOqsGVc.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\pjQnJQF.exe
  C:\Windows\System\pjQnJQF.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\dvqqiCX.exe
  C:\Windows\System\dvqqiCX.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\XgizBpU.exe
  C:\Windows\System\XgizBpU.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\MDcYEBr.exe
  C:\Windows\System\MDcYEBr.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\JdzpIFT.exe
  C:\Windows\System\JdzpIFT.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\jbjdmYe.exe
  C:\Windows\System\jbjdmYe.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\cEnpapm.exe
  C:\Windows\System\cEnpapm.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\GJnwULm.exe
  C:\Windows\System\GJnwULm.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\QTFghSG.exe
  C:\Windows\System\QTFghSG.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\pJEmTsO.exe
  C:\Windows\System\pJEmTsO.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\fZMNChp.exe
  C:\Windows\System\fZMNChp.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\KdPWxfP.exe
  C:\Windows\System\KdPWxfP.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\yNKbvrS.exe
  C:\Windows\System\yNKbvrS.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\mqNKliN.exe
  C:\Windows\System\mqNKliN.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\kTmCgFw.exe
  C:\Windows\System\kTmCgFw.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\lrShcSd.exe
  C:\Windows\System\lrShcSd.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\YFkSRcB.exe
  C:\Windows\System\YFkSRcB.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\kgdxQEJ.exe
  C:\Windows\System\kgdxQEJ.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ISccQKN.exe
  C:\Windows\System\ISccQKN.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\fndyxhw.exe
  C:\Windows\System\fndyxhw.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\VbVcLEO.exe
  C:\Windows\System\VbVcLEO.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\DGfEzKr.exe
  C:\Windows\System\DGfEzKr.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\ouwMnYk.exe
  C:\Windows\System\ouwMnYk.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\erzoBgz.exe
  C:\Windows\System\erzoBgz.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\WhzLUgK.exe
  C:\Windows\System\WhzLUgK.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\gitaapF.exe
  C:\Windows\System\gitaapF.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\SAdKEQw.exe
  C:\Windows\System\SAdKEQw.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\uGmuNsy.exe
  C:\Windows\System\uGmuNsy.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\JNOuSCM.exe
  C:\Windows\System\JNOuSCM.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\JNUPKfj.exe
  C:\Windows\System\JNUPKfj.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\IHoSxVW.exe
  C:\Windows\System\IHoSxVW.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\TjMvWCi.exe
  C:\Windows\System\TjMvWCi.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\TkisSLQ.exe
  C:\Windows\System\TkisSLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\mxZiDyT.exe
  C:\Windows\System\mxZiDyT.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\MHHTTdc.exe
  C:\Windows\System\MHHTTdc.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\meXlYuQ.exe
  C:\Windows\System\meXlYuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\xajetgA.exe
  C:\Windows\System\xajetgA.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\pTxLsCI.exe
  C:\Windows\System\pTxLsCI.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\IMpNTsO.exe
  C:\Windows\System\IMpNTsO.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\viFBOnN.exe
  C:\Windows\System\viFBOnN.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\owCJoGY.exe
  C:\Windows\System\owCJoGY.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\ZbLcAmI.exe
  C:\Windows\System\ZbLcAmI.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\ysrQgmK.exe
  C:\Windows\System\ysrQgmK.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\AcBOYhv.exe
  C:\Windows\System\AcBOYhv.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\umsOaWj.exe
  C:\Windows\System\umsOaWj.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\rMbPZXL.exe
  C:\Windows\System\rMbPZXL.exe
  2⤵
  PID:1920
- C:\Windows\System\aSTnwFR.exe
  C:\Windows\System\aSTnwFR.exe
  2⤵
  PID:1040
- C:\Windows\System\oUiJVOC.exe
  C:\Windows\System\oUiJVOC.exe
  2⤵
  PID:1436
- C:\Windows\System\ltNpXKq.exe
  C:\Windows\System\ltNpXKq.exe
  2⤵
  PID:1996
- C:\Windows\System\ywPIvyD.exe
  C:\Windows\System\ywPIvyD.exe
  2⤵
  PID:2624
- C:\Windows\System\NJpzbHg.exe
  C:\Windows\System\NJpzbHg.exe
  2⤵
  PID:1924
- C:\Windows\System\XqWbuQL.exe
  C:\Windows\System\XqWbuQL.exe
  2⤵
  PID:3040
- C:\Windows\System\JvmxdUc.exe
  C:\Windows\System\JvmxdUc.exe
  2⤵
  PID:288
- C:\Windows\System\bxXeKxS.exe
  C:\Windows\System\bxXeKxS.exe
  2⤵
  PID:2952
- C:\Windows\System\UazHysl.exe
  C:\Windows\System\UazHysl.exe
  2⤵
  PID:2408
- C:\Windows\System\sXYBhPN.exe
  C:\Windows\System\sXYBhPN.exe
  2⤵
  PID:408
- C:\Windows\System\bEZiwKT.exe
  C:\Windows\System\bEZiwKT.exe
  2⤵
  PID:2420
- C:\Windows\System\VkIpZQl.exe
  C:\Windows\System\VkIpZQl.exe
  2⤵
  PID:2752
- C:\Windows\System\tyYAkQp.exe
  C:\Windows\System\tyYAkQp.exe
  2⤵
  PID:1552
- C:\Windows\System\VPqQrxT.exe
  C:\Windows\System\VPqQrxT.exe
  2⤵
  PID:276
- C:\Windows\System\YSRSwaZ.exe
  C:\Windows\System\YSRSwaZ.exe
  2⤵
  PID:1096
- C:\Windows\System\nMDIYZR.exe
  C:\Windows\System\nMDIYZR.exe
  2⤵
  PID:800
- C:\Windows\System\ITCqlfn.exe
  C:\Windows\System\ITCqlfn.exe
  2⤵
  PID:1248
- C:\Windows\System\hiObPJD.exe
  C:\Windows\System\hiObPJD.exe
  2⤵
  PID:2268
- C:\Windows\System\WJFQTLa.exe
  C:\Windows\System\WJFQTLa.exe
  2⤵
  PID:636
- C:\Windows\System\mbSCCXo.exe
  C:\Windows\System\mbSCCXo.exe
  2⤵
  PID:1756
- C:\Windows\System\ZftToTg.exe
  C:\Windows\System\ZftToTg.exe
  2⤵
  PID:1704
- C:\Windows\System\PURWXRf.exe
  C:\Windows\System\PURWXRf.exe
  2⤵
  PID:2520
- C:\Windows\System\LnJGDCZ.exe
  C:\Windows\System\LnJGDCZ.exe
  2⤵
  PID:2400
- C:\Windows\System\RYadTOb.exe
  C:\Windows\System\RYadTOb.exe
  2⤵
  PID:2796
- C:\Windows\System\xKcYAuR.exe
  C:\Windows\System\xKcYAuR.exe
  2⤵
  PID:2720
- C:\Windows\System\aQRZkDu.exe
  C:\Windows\System\aQRZkDu.exe
  2⤵
  PID:2568
- C:\Windows\System\hpMZdJE.exe
  C:\Windows\System\hpMZdJE.exe
  2⤵
  PID:2484
- C:\Windows\System\UOyajKg.exe
  C:\Windows\System\UOyajKg.exe
  2⤵
  PID:2444
- C:\Windows\System\bKYJbuY.exe
  C:\Windows\System\bKYJbuY.exe
  2⤵
  PID:1872
- C:\Windows\System\UuuNYzf.exe
  C:\Windows\System\UuuNYzf.exe
  2⤵
  PID:1216
- C:\Windows\System\IdLWzRz.exe
  C:\Windows\System\IdLWzRz.exe
  2⤵
  PID:1660
- C:\Windows\System\PZFGvsm.exe
  C:\Windows\System\PZFGvsm.exe
  2⤵
  PID:952
- C:\Windows\System\mEjvUhr.exe
  C:\Windows\System\mEjvUhr.exe
  2⤵
  PID:1948
- C:\Windows\System\VQIXyfq.exe
  C:\Windows\System\VQIXyfq.exe
  2⤵
  PID:268
- C:\Windows\System\JXpaWEs.exe
  C:\Windows\System\JXpaWEs.exe
  2⤵
  PID:2136
- C:\Windows\System\wahdqrw.exe
  C:\Windows\System\wahdqrw.exe
  2⤵
  PID:2424
- C:\Windows\System\wXOVzDZ.exe
  C:\Windows\System\wXOVzDZ.exe
  2⤵
  PID:1372
- C:\Windows\System\hXGxGli.exe
  C:\Windows\System\hXGxGli.exe
  2⤵
  PID:1440
- C:\Windows\System\YcnzFDj.exe
  C:\Windows\System\YcnzFDj.exe
  2⤵
  PID:3080
- C:\Windows\System\wxwaaIp.exe
  C:\Windows\System\wxwaaIp.exe
  2⤵
  PID:3104
- C:\Windows\System\WjaKyJn.exe
  C:\Windows\System\WjaKyJn.exe
  2⤵
  PID:3120
- C:\Windows\System\XCWQlwQ.exe
  C:\Windows\System\XCWQlwQ.exe
  2⤵
  PID:3144
- C:\Windows\System\yNRTFei.exe
  C:\Windows\System\yNRTFei.exe
  2⤵
  PID:3164
- C:\Windows\System\EhwDVGf.exe
  C:\Windows\System\EhwDVGf.exe
  2⤵
  PID:3184
- C:\Windows\System\FokcTNd.exe
  C:\Windows\System\FokcTNd.exe
  2⤵
  PID:3200
- C:\Windows\System\qRvXZHr.exe
  C:\Windows\System\qRvXZHr.exe
  2⤵
  PID:3224
- C:\Windows\System\yialAWI.exe
  C:\Windows\System\yialAWI.exe
  2⤵
  PID:3240
- C:\Windows\System\LzwSCtH.exe
  C:\Windows\System\LzwSCtH.exe
  2⤵
  PID:3264
- C:\Windows\System\IUwmDeS.exe
  C:\Windows\System\IUwmDeS.exe
  2⤵
  PID:3280
- C:\Windows\System\EqsXWaf.exe
  C:\Windows\System\EqsXWaf.exe
  2⤵
  PID:3300
- C:\Windows\System\eclwrZM.exe
  C:\Windows\System\eclwrZM.exe
  2⤵
  PID:3320
- C:\Windows\System\giuWqta.exe
  C:\Windows\System\giuWqta.exe
  2⤵
  PID:3340
- C:\Windows\System\EoxSAfb.exe
  C:\Windows\System\EoxSAfb.exe
  2⤵
  PID:3360
- C:\Windows\System\ZCZJZLV.exe
  C:\Windows\System\ZCZJZLV.exe
  2⤵
  PID:3380
- C:\Windows\System\fHgtMQP.exe
  C:\Windows\System\fHgtMQP.exe
  2⤵
  PID:3400
- C:\Windows\System\TzMJzpi.exe
  C:\Windows\System\TzMJzpi.exe
  2⤵
  PID:3424
- C:\Windows\System\SrTPAnY.exe
  C:\Windows\System\SrTPAnY.exe
  2⤵
  PID:3440
- C:\Windows\System\kTEmfkx.exe
  C:\Windows\System\kTEmfkx.exe
  2⤵
  PID:3460
- C:\Windows\System\SuFAAmQ.exe
  C:\Windows\System\SuFAAmQ.exe
  2⤵
  PID:3480
- C:\Windows\System\rmBRRoj.exe
  C:\Windows\System\rmBRRoj.exe
  2⤵
  PID:3500
- C:\Windows\System\KdjirRe.exe
  C:\Windows\System\KdjirRe.exe
  2⤵
  PID:3520
- C:\Windows\System\IDyVCoC.exe
  C:\Windows\System\IDyVCoC.exe
  2⤵
  PID:3540
- C:\Windows\System\hOTUMai.exe
  C:\Windows\System\hOTUMai.exe
  2⤵
  PID:3556
- C:\Windows\System\ixpbqnj.exe
  C:\Windows\System\ixpbqnj.exe
  2⤵
  PID:3580
- C:\Windows\System\rtdSlZl.exe
  C:\Windows\System\rtdSlZl.exe
  2⤵
  PID:3600
- C:\Windows\System\EDIgLzz.exe
  C:\Windows\System\EDIgLzz.exe
  2⤵
  PID:3620
- C:\Windows\System\EBMRWlV.exe
  C:\Windows\System\EBMRWlV.exe
  2⤵
  PID:3636
- C:\Windows\System\nnPoQXc.exe
  C:\Windows\System\nnPoQXc.exe
  2⤵
  PID:3656
- C:\Windows\System\frOMhvA.exe
  C:\Windows\System\frOMhvA.exe
  2⤵
  PID:3680
- C:\Windows\System\FScZoYq.exe
  C:\Windows\System\FScZoYq.exe
  2⤵
  PID:3704
- C:\Windows\System\rysFzoK.exe
  C:\Windows\System\rysFzoK.exe
  2⤵
  PID:3724
- C:\Windows\System\cFVetsW.exe
  C:\Windows\System\cFVetsW.exe
  2⤵
  PID:3744
- C:\Windows\System\whAEjjH.exe
  C:\Windows\System\whAEjjH.exe
  2⤵
  PID:3764
- C:\Windows\System\bXxFrRB.exe
  C:\Windows\System\bXxFrRB.exe
  2⤵
  PID:3784
- C:\Windows\System\vowkWNV.exe
  C:\Windows\System\vowkWNV.exe
  2⤵
  PID:3804
- C:\Windows\System\cWCgJAE.exe
  C:\Windows\System\cWCgJAE.exe
  2⤵
  PID:3824
- C:\Windows\System\IKPHEWT.exe
  C:\Windows\System\IKPHEWT.exe
  2⤵
  PID:3844
- C:\Windows\System\DTZZWmL.exe
  C:\Windows\System\DTZZWmL.exe
  2⤵
  PID:3864
- C:\Windows\System\zbnggYg.exe
  C:\Windows\System\zbnggYg.exe
  2⤵
  PID:3884
- C:\Windows\System\DoeUYiQ.exe
  C:\Windows\System\DoeUYiQ.exe
  2⤵
  PID:3904
- C:\Windows\System\XmaozXg.exe
  C:\Windows\System\XmaozXg.exe
  2⤵
  PID:3920
- C:\Windows\System\WsREIhM.exe
  C:\Windows\System\WsREIhM.exe
  2⤵
  PID:3944
- C:\Windows\System\rXKxXwO.exe
  C:\Windows\System\rXKxXwO.exe
  2⤵
  PID:3960
- C:\Windows\System\lVIpXoS.exe
  C:\Windows\System\lVIpXoS.exe
  2⤵
  PID:3980
- C:\Windows\System\YBiKswy.exe
  C:\Windows\System\YBiKswy.exe
  2⤵
  PID:4004
- C:\Windows\System\Dtsstbe.exe
  C:\Windows\System\Dtsstbe.exe
  2⤵
  PID:4024
- C:\Windows\System\YvJDqel.exe
  C:\Windows\System\YvJDqel.exe
  2⤵
  PID:4044
- C:\Windows\System\jgFhjTy.exe
  C:\Windows\System\jgFhjTy.exe
  2⤵
  PID:4064
- C:\Windows\System\AGwpnjq.exe
  C:\Windows\System\AGwpnjq.exe
  2⤵
  PID:4084
- C:\Windows\System\kJxevTQ.exe
  C:\Windows\System\kJxevTQ.exe
  2⤵
  PID:2064
- C:\Windows\System\jKLnGia.exe
  C:\Windows\System\jKLnGia.exe
  2⤵
  PID:2044
- C:\Windows\System\eQHFMgQ.exe
  C:\Windows\System\eQHFMgQ.exe
  2⤵
  PID:2872
- C:\Windows\System\jDstraO.exe
  C:\Windows\System\jDstraO.exe
  2⤵
  PID:2088
- C:\Windows\System\qyJAuVz.exe
  C:\Windows\System\qyJAuVz.exe
  2⤵
  PID:2524
- C:\Windows\System\MqzLXiB.exe
  C:\Windows\System\MqzLXiB.exe
  2⤵
  PID:2152
- C:\Windows\System\UcBaTHy.exe
  C:\Windows\System\UcBaTHy.exe
  2⤵
  PID:2572
- C:\Windows\System\huEXtZT.exe
  C:\Windows\System\huEXtZT.exe
  2⤵
  PID:1780
- C:\Windows\System\sKSQoMw.exe
  C:\Windows\System\sKSQoMw.exe
  2⤵
  PID:2500
- C:\Windows\System\axqeMJX.exe
  C:\Windows\System\axqeMJX.exe
  2⤵
  PID:2780
- C:\Windows\System\HFTZpmY.exe
  C:\Windows\System\HFTZpmY.exe
  2⤵
  PID:612
- C:\Windows\System\FjJSwCx.exe
  C:\Windows\System\FjJSwCx.exe
  2⤵
  PID:788
- C:\Windows\System\faIahST.exe
  C:\Windows\System\faIahST.exe
  2⤵
  PID:2404
- C:\Windows\System\JOVdPmO.exe
  C:\Windows\System\JOVdPmO.exe
  2⤵
  PID:1812
- C:\Windows\System\ZhLVfkW.exe
  C:\Windows\System\ZhLVfkW.exe
  2⤵
  PID:3092
- C:\Windows\System\viEeJiY.exe
  C:\Windows\System\viEeJiY.exe
  2⤵
  PID:3140
- C:\Windows\System\yTVPssd.exe
  C:\Windows\System\yTVPssd.exe
  2⤵
  PID:3180
- C:\Windows\System\DFETImd.exe
  C:\Windows\System\DFETImd.exe
  2⤵
  PID:3156
- C:\Windows\System\GmaAIii.exe
  C:\Windows\System\GmaAIii.exe
  2⤵
  PID:3216
- C:\Windows\System\csvKYcc.exe
  C:\Windows\System\csvKYcc.exe
  2⤵
  PID:3252
- C:\Windows\System\SfQbzXX.exe
  C:\Windows\System\SfQbzXX.exe
  2⤵
  PID:3332
- C:\Windows\System\aNSzWKp.exe
  C:\Windows\System\aNSzWKp.exe
  2⤵
  PID:3276
- C:\Windows\System\cmFZdYN.exe
  C:\Windows\System\cmFZdYN.exe
  2⤵
  PID:3316
- C:\Windows\System\uOfusHc.exe
  C:\Windows\System\uOfusHc.exe
  2⤵
  PID:3412
- C:\Windows\System\rDrqHeY.exe
  C:\Windows\System\rDrqHeY.exe
  2⤵
  PID:3348
- C:\Windows\System\lExWiRn.exe
  C:\Windows\System\lExWiRn.exe
  2⤵
  PID:3432
- C:\Windows\System\gYCYAnP.exe
  C:\Windows\System\gYCYAnP.exe
  2⤵
  PID:3536
- C:\Windows\System\UAwGbSd.exe
  C:\Windows\System\UAwGbSd.exe
  2⤵
  PID:3576
- C:\Windows\System\wvYWXOy.exe
  C:\Windows\System\wvYWXOy.exe
  2⤵
  PID:2160
- C:\Windows\System\DGgPzgX.exe
  C:\Windows\System\DGgPzgX.exe
  2⤵
  PID:3516
- C:\Windows\System\JIoDHfr.exe
  C:\Windows\System\JIoDHfr.exe
  2⤵
  PID:3548
- C:\Windows\System\uoVwFWv.exe
  C:\Windows\System\uoVwFWv.exe
  2⤵
  PID:3628
- C:\Windows\System\CVqVtup.exe
  C:\Windows\System\CVqVtup.exe
  2⤵
  PID:3688
- C:\Windows\System\bXWJrXH.exe
  C:\Windows\System\bXWJrXH.exe
  2⤵
  PID:3668
- C:\Windows\System\ccutNRX.exe
  C:\Windows\System\ccutNRX.exe
  2⤵
  PID:3736
- C:\Windows\System\eCogPxO.exe
  C:\Windows\System\eCogPxO.exe
  2⤵
  PID:3716
- C:\Windows\System\QpIxTRV.exe
  C:\Windows\System\QpIxTRV.exe
  2⤵
  PID:3752
- C:\Windows\System\rkBgqST.exe
  C:\Windows\System\rkBgqST.exe
  2⤵
  PID:3760
- C:\Windows\System\KZBXhNv.exe
  C:\Windows\System\KZBXhNv.exe
  2⤵
  PID:3860
- C:\Windows\System\FmNXlgm.exe
  C:\Windows\System\FmNXlgm.exe
  2⤵
  PID:3836
- C:\Windows\System\esCqtQm.exe
  C:\Windows\System\esCqtQm.exe
  2⤵
  PID:3940
- C:\Windows\System\MYoOspP.exe
  C:\Windows\System\MYoOspP.exe
  2⤵
  PID:3972
- C:\Windows\System\HbfHcMP.exe
  C:\Windows\System\HbfHcMP.exe
  2⤵
  PID:3876
- C:\Windows\System\BxLZVgf.exe
  C:\Windows\System\BxLZVgf.exe
  2⤵
  PID:4056
- C:\Windows\System\rtSQwaB.exe
  C:\Windows\System\rtSQwaB.exe
  2⤵
  PID:3056
- C:\Windows\System\nHBMBiN.exe
  C:\Windows\System\nHBMBiN.exe
  2⤵
  PID:1624
- C:\Windows\System\dUBfnNR.exe
  C:\Windows\System\dUBfnNR.exe
  2⤵
  PID:3912
- C:\Windows\System\NxvnMWS.exe
  C:\Windows\System\NxvnMWS.exe
  2⤵
  PID:3992
- C:\Windows\System\zVZLdmJ.exe
  C:\Windows\System\zVZLdmJ.exe
  2⤵
  PID:2636
- C:\Windows\System\QMfjSua.exe
  C:\Windows\System\QMfjSua.exe
  2⤵
  PID:3996
- C:\Windows\System\FGsWgZQ.exe
  C:\Windows\System\FGsWgZQ.exe
  2⤵
  PID:4072
- C:\Windows\System\AyoQaqo.exe
  C:\Windows\System\AyoQaqo.exe
  2⤵
  PID:2284
- C:\Windows\System\KTxmnVy.exe
  C:\Windows\System\KTxmnVy.exe
  2⤵
  PID:1896
- C:\Windows\System\rfEZklP.exe
  C:\Windows\System\rfEZklP.exe
  2⤵
  PID:3172
- C:\Windows\System\KhtHZwC.exe
  C:\Windows\System\KhtHZwC.exe
  2⤵
  PID:2300
- C:\Windows\System\cYVkQMC.exe
  C:\Windows\System\cYVkQMC.exe
  2⤵
  PID:3208
- C:\Windows\System\AvMkZgK.exe
  C:\Windows\System\AvMkZgK.exe
  2⤵
  PID:3256
- C:\Windows\System\NxNTFXZ.exe
  C:\Windows\System\NxNTFXZ.exe
  2⤵
  PID:3336
- C:\Windows\System\ycKSHsJ.exe
  C:\Windows\System\ycKSHsJ.exe
  2⤵
  PID:3112
- C:\Windows\System\CzgLCOE.exe
  C:\Windows\System\CzgLCOE.exe
  2⤵
  PID:3376
- C:\Windows\System\KNQzsGE.exe
  C:\Windows\System\KNQzsGE.exe
  2⤵
  PID:3452
- C:\Windows\System\XERRhBN.exe
  C:\Windows\System\XERRhBN.exe
  2⤵
  PID:3472
- C:\Windows\System\VQtyMpw.exe
  C:\Windows\System\VQtyMpw.exe
  2⤵
  PID:3272
- C:\Windows\System\xQDBOUv.exe
  C:\Windows\System\xQDBOUv.exe
  2⤵
  PID:3588
- C:\Windows\System\AsNhLSX.exe
  C:\Windows\System\AsNhLSX.exe
  2⤵
  PID:3676
- C:\Windows\System\wXUiGAa.exe
  C:\Windows\System\wXUiGAa.exe
  2⤵
  PID:3392
- C:\Windows\System\VUEysdh.exe
  C:\Windows\System\VUEysdh.exe
  2⤵
  PID:3564
- C:\Windows\System\bsWpQXW.exe
  C:\Windows\System\bsWpQXW.exe
  2⤵
  PID:3508
- C:\Windows\System\duWhiQN.exe
  C:\Windows\System\duWhiQN.exe
  2⤵
  PID:3044
- C:\Windows\System\uFnbrId.exe
  C:\Windows\System\uFnbrId.exe
  2⤵
  PID:3932
- C:\Windows\System\SynjNHZ.exe
  C:\Windows\System\SynjNHZ.exe
  2⤵
  PID:1116
- C:\Windows\System\vGzligJ.exe
  C:\Windows\System\vGzligJ.exe
  2⤵
  PID:3644
- C:\Windows\System\xmbjeEc.exe
  C:\Windows\System\xmbjeEc.exe
  2⤵
  PID:3712
- C:\Windows\System\EzRTdZx.exe
  C:\Windows\System\EzRTdZx.exe
  2⤵
  PID:1572
- C:\Windows\System\PONnvtl.exe
  C:\Windows\System\PONnvtl.exe
  2⤵
  PID:3988
- C:\Windows\System\NTtfTCH.exe
  C:\Windows\System\NTtfTCH.exe
  2⤵
  PID:3088
- C:\Windows\System\WmbHrxL.exe
  C:\Windows\System\WmbHrxL.exe
  2⤵
  PID:2188
- C:\Windows\System\QtVdZBW.exe
  C:\Windows\System\QtVdZBW.exe
  2⤵
  PID:3020
- C:\Windows\System\KbbMmyG.exe
  C:\Windows\System\KbbMmyG.exe
  2⤵
  PID:1692
- C:\Windows\System\OHBJwCu.exe
  C:\Windows\System\OHBJwCu.exe
  2⤵
  PID:3196
- C:\Windows\System\QdWsAHl.exe
  C:\Windows\System\QdWsAHl.exe
  2⤵
  PID:3248
- C:\Windows\System\LNNHtMI.exe
  C:\Windows\System\LNNHtMI.exe
  2⤵
  PID:2588
- C:\Windows\System\Wwrnobe.exe
  C:\Windows\System\Wwrnobe.exe
  2⤵
  PID:2880
- C:\Windows\System\bAMlLkz.exe
  C:\Windows\System\bAMlLkz.exe
  2⤵
  PID:1212
- C:\Windows\System\SdXtbpm.exe
  C:\Windows\System\SdXtbpm.exe
  2⤵
  PID:1528
- C:\Windows\System\cVxncta.exe
  C:\Windows\System\cVxncta.exe
  2⤵
  PID:2456
- C:\Windows\System\hUHtFpb.exe
  C:\Windows\System\hUHtFpb.exe
  2⤵
  PID:2772
- C:\Windows\System\WPqsWXH.exe
  C:\Windows\System\WPqsWXH.exe
  2⤵
  PID:2312
- C:\Windows\System\EdwLcdm.exe
  C:\Windows\System\EdwLcdm.exe
  2⤵
  PID:1076
- C:\Windows\System\BrSsMDK.exe
  C:\Windows\System\BrSsMDK.exe
  2⤵
  PID:3456
- C:\Windows\System\CtlwDuI.exe
  C:\Windows\System\CtlwDuI.exe
  2⤵
  PID:3652
- C:\Windows\System\ZoRLFfj.exe
  C:\Windows\System\ZoRLFfj.exe
  2⤵
  PID:3496
- C:\Windows\System\YrQnsmW.exe
  C:\Windows\System\YrQnsmW.exe
  2⤵
  PID:4020
- C:\Windows\System\omHrbzM.exe
  C:\Windows\System\omHrbzM.exe
  2⤵
  PID:3720
- C:\Windows\System\PblXWeT.exe
  C:\Windows\System\PblXWeT.exe
  2⤵
  PID:1236
- C:\Windows\System\NWqsawf.exe
  C:\Windows\System\NWqsawf.exe
  2⤵
  PID:1460
- C:\Windows\System\jITMjvG.exe
  C:\Windows\System\jITMjvG.exe
  2⤵
  PID:3696
- C:\Windows\System\FPLqION.exe
  C:\Windows\System\FPLqION.exe
  2⤵
  PID:2192
- C:\Windows\System\WaWkhil.exe
  C:\Windows\System\WaWkhil.exe
  2⤵
  PID:3492
- C:\Windows\System\GrabCfo.exe
  C:\Windows\System\GrabCfo.exe
  2⤵
  PID:3420
- C:\Windows\System\QqzuOzn.exe
  C:\Windows\System\QqzuOzn.exe
  2⤵
  PID:3128
- C:\Windows\System\asFfQhJ.exe
  C:\Windows\System\asFfQhJ.exe
  2⤵
  PID:3968
- C:\Windows\System\RhtVqMB.exe
  C:\Windows\System\RhtVqMB.exe
  2⤵
  PID:948
- C:\Windows\System\OpMuyjE.exe
  C:\Windows\System\OpMuyjE.exe
  2⤵
  PID:2536
- C:\Windows\System\KTGrTcq.exe
  C:\Windows\System\KTGrTcq.exe
  2⤵
  PID:2688
- C:\Windows\System\TMmbInM.exe
  C:\Windows\System\TMmbInM.exe
  2⤵
  PID:2544
- C:\Windows\System\wcSAdoL.exe
  C:\Windows\System\wcSAdoL.exe
  2⤵
  PID:1136
- C:\Windows\System\ojGDfrJ.exe
  C:\Windows\System\ojGDfrJ.exe
  2⤵
  PID:1656
- C:\Windows\System\GEabGiy.exe
  C:\Windows\System\GEabGiy.exe
  2⤵
  PID:1888
- C:\Windows\System\RhFCjRp.exe
  C:\Windows\System\RhFCjRp.exe
  2⤵
  PID:1816
- C:\Windows\System\OvdIvDW.exe
  C:\Windows\System\OvdIvDW.exe
  2⤵
  PID:3732
- C:\Windows\System\JudWlEj.exe
  C:\Windows\System\JudWlEj.exe
  2⤵
  PID:1992
- C:\Windows\System\FkMUzjj.exe
  C:\Windows\System\FkMUzjj.exe
  2⤵
  PID:1244
- C:\Windows\System\pUguhsS.exe
  C:\Windows\System\pUguhsS.exe
  2⤵
  PID:3212
- C:\Windows\System\czVOIww.exe
  C:\Windows\System\czVOIww.exe
  2⤵
  PID:4052
- C:\Windows\System\DpFpmzU.exe
  C:\Windows\System\DpFpmzU.exe
  2⤵
  PID:956
- C:\Windows\System\MfPAPWx.exe
  C:\Windows\System\MfPAPWx.exe
  2⤵
  PID:1144
- C:\Windows\System\aEBdQCj.exe
  C:\Windows\System\aEBdQCj.exe
  2⤵
  PID:2464
- C:\Windows\System\GYKwZMg.exe
  C:\Windows\System\GYKwZMg.exe
  2⤵
  PID:2676
- C:\Windows\System\ArDfewi.exe
  C:\Windows\System\ArDfewi.exe
  2⤵
  PID:2176
- C:\Windows\System\sUVyKTd.exe
  C:\Windows\System\sUVyKTd.exe
  2⤵
  PID:3796
- C:\Windows\System\SqwNWYL.exe
  C:\Windows\System\SqwNWYL.exe
  2⤵
  PID:3152
- C:\Windows\System\xmfmoIR.exe
  C:\Windows\System\xmfmoIR.exe
  2⤵
  PID:556
- C:\Windows\System\BVrATFt.exe
  C:\Windows\System\BVrATFt.exe
  2⤵
  PID:2376
- C:\Windows\System\yRtPCHu.exe
  C:\Windows\System\yRtPCHu.exe
  2⤵
  PID:2788
- C:\Windows\System\kzzXwBH.exe
  C:\Windows\System\kzzXwBH.exe
  2⤵
  PID:1036
- C:\Windows\System\YMnYERO.exe
  C:\Windows\System\YMnYERO.exe
  2⤵
  PID:2960
- C:\Windows\System\JXhctIK.exe
  C:\Windows\System\JXhctIK.exe
  2⤵
  PID:2528
- C:\Windows\System\ChwGTBf.exe
  C:\Windows\System\ChwGTBf.exe
  2⤵
  PID:2032
- C:\Windows\System\eECVMsO.exe
  C:\Windows\System\eECVMsO.exe
  2⤵
  PID:2272
- C:\Windows\System\jKzGNOT.exe
  C:\Windows\System\jKzGNOT.exe
  2⤵
  PID:1912
- C:\Windows\System\osQvYtG.exe
  C:\Windows\System\osQvYtG.exe
  2⤵
  PID:3872
- C:\Windows\System\vWICfRW.exe
  C:\Windows\System\vWICfRW.exe
  2⤵
  PID:3308
- C:\Windows\System\KtZRHtF.exe
  C:\Windows\System\KtZRHtF.exe
  2⤵
  PID:1936
- C:\Windows\System\rQykFJD.exe
  C:\Windows\System\rQykFJD.exe
  2⤵
  PID:2508
- C:\Windows\System\frmizbc.exe
  C:\Windows\System\frmizbc.exe
  2⤵
  PID:2416
- C:\Windows\System\wvTuYoY.exe
  C:\Windows\System\wvTuYoY.exe
  2⤵
  PID:4108
- C:\Windows\System\tYlVsGZ.exe
  C:\Windows\System\tYlVsGZ.exe
  2⤵
  PID:4124
- C:\Windows\System\eZRbmfM.exe
  C:\Windows\System\eZRbmfM.exe
  2⤵
  PID:4140
- C:\Windows\System\WGytwcV.exe
  C:\Windows\System\WGytwcV.exe
  2⤵
  PID:4156
- C:\Windows\System\ckDtKdi.exe
  C:\Windows\System\ckDtKdi.exe
  2⤵
  PID:4176
- C:\Windows\System\SHoYUHf.exe
  C:\Windows\System\SHoYUHf.exe
  2⤵
  PID:4220
- C:\Windows\System\rmoofZN.exe
  C:\Windows\System\rmoofZN.exe
  2⤵
  PID:4240
- C:\Windows\System\LCZCXut.exe
  C:\Windows\System\LCZCXut.exe
  2⤵
  PID:4256
- C:\Windows\System\LhztgWR.exe
  C:\Windows\System\LhztgWR.exe
  2⤵
  PID:4276
- C:\Windows\System\EQONxfN.exe
  C:\Windows\System\EQONxfN.exe
  2⤵
  PID:4304
- C:\Windows\System\sJwRTSX.exe
  C:\Windows\System\sJwRTSX.exe
  2⤵
  PID:4320
- C:\Windows\System\zjqIIWM.exe
  C:\Windows\System\zjqIIWM.exe
  2⤵
  PID:4340
- C:\Windows\System\DakvOMw.exe
  C:\Windows\System\DakvOMw.exe
  2⤵
  PID:4356
- C:\Windows\System\rjTbGQZ.exe
  C:\Windows\System\rjTbGQZ.exe
  2⤵
  PID:4372
- C:\Windows\System\fWGqIgw.exe
  C:\Windows\System\fWGqIgw.exe
  2⤵
  PID:4396
- C:\Windows\System\hxLUsrv.exe
  C:\Windows\System\hxLUsrv.exe
  2⤵
  PID:4416
- C:\Windows\System\odZCqAO.exe
  C:\Windows\System\odZCqAO.exe
  2⤵
  PID:4432
- C:\Windows\System\MWMLjuU.exe
  C:\Windows\System\MWMLjuU.exe
  2⤵
  PID:4456
- C:\Windows\System\SnQTigb.exe
  C:\Windows\System\SnQTigb.exe
  2⤵
  PID:4472
- C:\Windows\System\SrCYlpj.exe
  C:\Windows\System\SrCYlpj.exe
  2⤵
  PID:4492
- C:\Windows\System\rSqpnYl.exe
  C:\Windows\System\rSqpnYl.exe
  2⤵
  PID:4528
- C:\Windows\System\MoJNuSC.exe
  C:\Windows\System\MoJNuSC.exe
  2⤵
  PID:4548
- C:\Windows\System\SjDHGGG.exe
  C:\Windows\System\SjDHGGG.exe
  2⤵
  PID:4568
- C:\Windows\System\BSBGTaU.exe
  C:\Windows\System\BSBGTaU.exe
  2⤵
  PID:4584
- C:\Windows\System\GOUohAp.exe
  C:\Windows\System\GOUohAp.exe
  2⤵
  PID:4600
- C:\Windows\System\nEmTffS.exe
  C:\Windows\System\nEmTffS.exe
  2⤵
  PID:4616
- C:\Windows\System\TXhdCrv.exe
  C:\Windows\System\TXhdCrv.exe
  2⤵
  PID:4632
- C:\Windows\System\LXFDOGN.exe
  C:\Windows\System\LXFDOGN.exe
  2⤵
  PID:4648
- C:\Windows\System\NoIPfPo.exe
  C:\Windows\System\NoIPfPo.exe
  2⤵
  PID:4664
- C:\Windows\System\DBRJCUM.exe
  C:\Windows\System\DBRJCUM.exe
  2⤵
  PID:4680
- C:\Windows\System\FNDuxlL.exe
  C:\Windows\System\FNDuxlL.exe
  2⤵
  PID:4700
- C:\Windows\System\VhSkfer.exe
  C:\Windows\System\VhSkfer.exe
  2⤵
  PID:4720
- C:\Windows\System\ozOvtwj.exe
  C:\Windows\System\ozOvtwj.exe
  2⤵
  PID:4740
- C:\Windows\System\yjYpmzh.exe
  C:\Windows\System\yjYpmzh.exe
  2⤵
  PID:4760
- C:\Windows\System\IIREiUo.exe
  C:\Windows\System\IIREiUo.exe
  2⤵
  PID:4776
- C:\Windows\System\PgtBDEO.exe
  C:\Windows\System\PgtBDEO.exe
  2⤵
  PID:4796
- C:\Windows\System\VjDfyzH.exe
  C:\Windows\System\VjDfyzH.exe
  2⤵
  PID:4816
- C:\Windows\System\OaEOCHj.exe
  C:\Windows\System\OaEOCHj.exe
  2⤵
  PID:4832
- C:\Windows\System\IdnPKXz.exe
  C:\Windows\System\IdnPKXz.exe
  2⤵
  PID:4856
- C:\Windows\System\XiDSGWF.exe
  C:\Windows\System\XiDSGWF.exe
  2⤵
  PID:4876
- C:\Windows\System\eQfXkYi.exe
  C:\Windows\System\eQfXkYi.exe
  2⤵
  PID:4892
- C:\Windows\System\JbKNVZR.exe
  C:\Windows\System\JbKNVZR.exe
  2⤵
  PID:4916
- C:\Windows\System\pCAFvUm.exe
  C:\Windows\System\pCAFvUm.exe
  2⤵
  PID:4940
- C:\Windows\System\yMszxSn.exe
  C:\Windows\System\yMszxSn.exe
  2⤵
  PID:4956
- C:\Windows\System\CSuWsMH.exe
  C:\Windows\System\CSuWsMH.exe
  2⤵
  PID:4976
- C:\Windows\System\DaBItbV.exe
  C:\Windows\System\DaBItbV.exe
  2⤵
  PID:4992
- C:\Windows\System\ZMYQOBw.exe
  C:\Windows\System\ZMYQOBw.exe
  2⤵
  PID:5012
- C:\Windows\System\JgcRUAG.exe
  C:\Windows\System\JgcRUAG.exe
  2⤵
  PID:5032
- C:\Windows\System\bLtvjWF.exe
  C:\Windows\System\bLtvjWF.exe
  2⤵
  PID:5052
- C:\Windows\System\bXVYoCk.exe
  C:\Windows\System\bXVYoCk.exe
  2⤵
  PID:5072
- C:\Windows\System\ytPJpQK.exe
  C:\Windows\System\ytPJpQK.exe
  2⤵
  PID:5092
- C:\Windows\System\AKrFSyl.exe
  C:\Windows\System\AKrFSyl.exe
  2⤵
  PID:5116
- C:\Windows\System\pkbHmOK.exe
  C:\Windows\System\pkbHmOK.exe
  2⤵
  PID:4104
- C:\Windows\System\fgRvQQm.exe
  C:\Windows\System\fgRvQQm.exe
  2⤵
  PID:4172
- C:\Windows\System\SHiKiOa.exe
  C:\Windows\System\SHiKiOa.exe
  2⤵
  PID:2988
- C:\Windows\System\ajemcom.exe
  C:\Windows\System\ajemcom.exe
  2⤵
  PID:4268
- C:\Windows\System\uPaaXzQ.exe
  C:\Windows\System\uPaaXzQ.exe
  2⤵
  PID:4000
- C:\Windows\System\ccClUSZ.exe
  C:\Windows\System\ccClUSZ.exe
  2⤵
  PID:4120
- C:\Windows\System\GdSVpyK.exe
  C:\Windows\System\GdSVpyK.exe
  2⤵
  PID:4192
- C:\Windows\System\ocQIOhR.exe
  C:\Windows\System\ocQIOhR.exe
  2⤵
  PID:4380
- C:\Windows\System\lJDrjEP.exe
  C:\Windows\System\lJDrjEP.exe
  2⤵
  PID:4424
- C:\Windows\System\lPqawtz.exe
  C:\Windows\System\lPqawtz.exe
  2⤵
  PID:4464
- C:\Windows\System\ZZKrnFE.exe
  C:\Windows\System\ZZKrnFE.exe
  2⤵
  PID:4336
- C:\Windows\System\hTAJUlP.exe
  C:\Windows\System\hTAJUlP.exe
  2⤵
  PID:4508
- C:\Windows\System\ZaPCHAx.exe
  C:\Windows\System\ZaPCHAx.exe
  2⤵
  PID:4252
- C:\Windows\System\LVqDlIF.exe
  C:\Windows\System\LVqDlIF.exe
  2⤵
  PID:4300
- C:\Windows\System\TBxCZof.exe
  C:\Windows\System\TBxCZof.exe
  2⤵
  PID:4328
- C:\Windows\System\jxkEHIt.exe
  C:\Windows\System\jxkEHIt.exe
  2⤵
  PID:4364
- C:\Windows\System\zvxfjXI.exe
  C:\Windows\System\zvxfjXI.exe
  2⤵
  PID:4688
- C:\Windows\System\NyHqapt.exe
  C:\Windows\System\NyHqapt.exe
  2⤵
  PID:4848
- C:\Windows\System\VcKMTZo.exe
  C:\Windows\System\VcKMTZo.exe
  2⤵
  PID:4408
- C:\Windows\System\eiQiuKF.exe
  C:\Windows\System\eiQiuKF.exe
  2⤵
  PID:4448
- C:\Windows\System\FuTzYIO.exe
  C:\Windows\System\FuTzYIO.exe
  2⤵
  PID:4488
- C:\Windows\System\BPsjqoy.exe
  C:\Windows\System\BPsjqoy.exe
  2⤵
  PID:4928
- C:\Windows\System\MSjxPSO.exe
  C:\Windows\System\MSjxPSO.exe
  2⤵
  PID:5044
- C:\Windows\System\iSdMUyR.exe
  C:\Windows\System\iSdMUyR.exe
  2⤵
  PID:5088
- C:\Windows\System\DXNSmpl.exe
  C:\Windows\System\DXNSmpl.exe
  2⤵
  PID:4236
- C:\Windows\System\SKFEorN.exe
  C:\Windows\System\SKFEorN.exe
  2⤵
  PID:4828
- C:\Windows\System\dLHbFgQ.exe
  C:\Windows\System\dLHbFgQ.exe
  2⤵
  PID:4908
- C:\Windows\System\JUMfqSg.exe
  C:\Windows\System\JUMfqSg.exe
  2⤵
  PID:4912
- C:\Windows\System\OTBVTLH.exe
  C:\Windows\System\OTBVTLH.exe
  2⤵
  PID:4824
- C:\Windows\System\QtHqNfY.exe
  C:\Windows\System\QtHqNfY.exe
  2⤵
  PID:4640
- C:\Windows\System\ATVdBNb.exe
  C:\Windows\System\ATVdBNb.exe
  2⤵
  PID:4748
- C:\Windows\System\fGEyXVa.exe
  C:\Windows\System\fGEyXVa.exe
  2⤵
  PID:4872
- C:\Windows\System\LSZMUsL.exe
  C:\Windows\System\LSZMUsL.exe
  2⤵
  PID:4988
- C:\Windows\System\ePLvCxa.exe
  C:\Windows\System\ePLvCxa.exe
  2⤵
  PID:5068
- C:\Windows\System\EKjXRIg.exe
  C:\Windows\System\EKjXRIg.exe
  2⤵
  PID:4136
- C:\Windows\System\IXQzQYn.exe
  C:\Windows\System\IXQzQYn.exe
  2⤵
  PID:1496
- C:\Windows\System\sFkMPYA.exe
  C:\Windows\System\sFkMPYA.exe
  2⤵
  PID:4384
- C:\Windows\System\FUCxwBP.exe
  C:\Windows\System\FUCxwBP.exe
  2⤵
  PID:4512
- C:\Windows\System\CNzhzbP.exe
  C:\Windows\System\CNzhzbP.exe
  2⤵
  PID:4504
- C:\Windows\System\DOebxbK.exe
  C:\Windows\System\DOebxbK.exe
  2⤵
  PID:2932
- C:\Windows\System\VVplyoA.exe
  C:\Windows\System\VVplyoA.exe
  2⤵
  PID:4596
- C:\Windows\System\nkkNomJ.exe
  C:\Windows\System\nkkNomJ.exe
  2⤵
  PID:4208
- C:\Windows\System\UIxRfwY.exe
  C:\Windows\System\UIxRfwY.exe
  2⤵
  PID:4404
- C:\Windows\System\vjQlURQ.exe
  C:\Windows\System\vjQlURQ.exe
  2⤵
  PID:4728
- C:\Windows\System\sRVVQQR.exe
  C:\Windows\System\sRVVQQR.exe
  2⤵
  PID:4884
- C:\Windows\System\itMvCsM.exe
  C:\Windows\System\itMvCsM.exe
  2⤵
  PID:4936
- C:\Windows\System\aFmePXe.exe
  C:\Windows\System\aFmePXe.exe
  2⤵
  PID:4768
- C:\Windows\System\epushvO.exe
  C:\Windows\System\epushvO.exe
  2⤵
  PID:2612
- C:\Windows\System\vBtMBWf.exe
  C:\Windows\System\vBtMBWf.exe
  2⤵
  PID:4576
- C:\Windows\System\ozaxooS.exe
  C:\Windows\System\ozaxooS.exe
  2⤵
  PID:5040
- C:\Windows\System\VTlVaED.exe
  C:\Windows\System\VTlVaED.exe
  2⤵
  PID:4840
- C:\Windows\System\ALsaXrb.exe
  C:\Windows\System\ALsaXrb.exe
  2⤵
  PID:4580
- C:\Windows\System\lbIFbgi.exe
  C:\Windows\System\lbIFbgi.exe
  2⤵
  PID:4440
- C:\Windows\System\OSNeIOT.exe
  C:\Windows\System\OSNeIOT.exe
  2⤵
  PID:4148
- C:\Windows\System\RWDffHF.exe
  C:\Windows\System\RWDffHF.exe
  2⤵
  PID:2708
- C:\Windows\System\CTHtpGu.exe
  C:\Windows\System\CTHtpGu.exe
  2⤵
  PID:3016
- C:\Windows\System\BpNFkQw.exe
  C:\Windows\System\BpNFkQw.exe
  2⤵
  PID:5084
- C:\Windows\System\qKfptbP.exe
  C:\Windows\System\qKfptbP.exe
  2⤵
  PID:5028
- C:\Windows\System\pLnOisM.exe
  C:\Windows\System\pLnOisM.exe
  2⤵
  PID:696
- C:\Windows\System\NagmSPk.exe
  C:\Windows\System\NagmSPk.exe
  2⤵
  PID:4732
- C:\Windows\System\EvBrpla.exe
  C:\Windows\System\EvBrpla.exe
  2⤵
  PID:676
- C:\Windows\System\BQbopac.exe
  C:\Windows\System\BQbopac.exe
  2⤵
  PID:2468
- C:\Windows\System\RZGGibs.exe
  C:\Windows\System\RZGGibs.exe
  2⤵
  PID:4716
- C:\Windows\System\irYHnVQ.exe
  C:\Windows\System\irYHnVQ.exe
  2⤵
  PID:3176
- C:\Windows\System\VrukYee.exe
  C:\Windows\System\VrukYee.exe
  2⤵
  PID:5112
- C:\Windows\System\MOGxAee.exe
  C:\Windows\System\MOGxAee.exe
  2⤵
  PID:4864
- C:\Windows\System\kaidZBS.exe
  C:\Windows\System\kaidZBS.exe
  2⤵
  PID:4888
- C:\Windows\System\OOvSELH.exe
  C:\Windows\System\OOvSELH.exe
  2⤵
  PID:4968
- C:\Windows\System\obIprxa.exe
  C:\Windows\System\obIprxa.exe
  2⤵
  PID:4656
- C:\Windows\System\FjaBqBr.exe
  C:\Windows\System\FjaBqBr.exe
  2⤵
  PID:4524
- C:\Windows\System\MyoWuiu.exe
  C:\Windows\System\MyoWuiu.exe
  2⤵
  PID:4288
- C:\Windows\System\BbhbWnz.exe
  C:\Windows\System\BbhbWnz.exe
  2⤵
  PID:4712
- C:\Windows\System\EwfNhsn.exe
  C:\Windows\System\EwfNhsn.exe
  2⤵
  PID:5100
- C:\Windows\System\JPnacmm.exe
  C:\Windows\System\JPnacmm.exe
  2⤵
  PID:2868
- C:\Windows\System\LaAdQqR.exe
  C:\Windows\System\LaAdQqR.exe
  2⤵
  PID:4188
- C:\Windows\System\JXBwlUc.exe
  C:\Windows\System\JXBwlUc.exe
  2⤵
  PID:5124
- C:\Windows\System\wTBSNDw.exe
  C:\Windows\System\wTBSNDw.exe
  2⤵
  PID:5164
- C:\Windows\System\ghdqAch.exe
  C:\Windows\System\ghdqAch.exe
  2⤵
  PID:5180
- C:\Windows\System\pzIUcmM.exe
  C:\Windows\System\pzIUcmM.exe
  2⤵
  PID:5196
- C:\Windows\System\gQHfVRh.exe
  C:\Windows\System\gQHfVRh.exe
  2⤵
  PID:5216
- C:\Windows\System\iFDSnby.exe
  C:\Windows\System\iFDSnby.exe
  2⤵
  PID:5232
- C:\Windows\System\bCRKxic.exe
  C:\Windows\System\bCRKxic.exe
  2⤵
  PID:5252
- C:\Windows\System\iyVRUAB.exe
  C:\Windows\System\iyVRUAB.exe
  2⤵
  PID:5272
- C:\Windows\System\zwmpeCT.exe
  C:\Windows\System\zwmpeCT.exe
  2⤵
  PID:5288
- C:\Windows\System\BKqNQGp.exe
  C:\Windows\System\BKqNQGp.exe
  2⤵
  PID:5308
- C:\Windows\System\CWQlWnZ.exe
  C:\Windows\System\CWQlWnZ.exe
  2⤵
  PID:5340
- C:\Windows\System\zCycDhx.exe
  C:\Windows\System\zCycDhx.exe
  2⤵
  PID:5364
- C:\Windows\System\OIedtbd.exe
  C:\Windows\System\OIedtbd.exe
  2⤵
  PID:5380
- C:\Windows\System\ccPZtUO.exe
  C:\Windows\System\ccPZtUO.exe
  2⤵
  PID:5396
- C:\Windows\System\SzddrBa.exe
  C:\Windows\System\SzddrBa.exe
  2⤵
  PID:5412
- C:\Windows\System\mAMxLRr.exe
  C:\Windows\System\mAMxLRr.exe
  2⤵
  PID:5428
- C:\Windows\System\MCsxQJG.exe
  C:\Windows\System\MCsxQJG.exe
  2⤵
  PID:5448
- C:\Windows\System\NmgaIVh.exe
  C:\Windows\System\NmgaIVh.exe
  2⤵
  PID:5468
- C:\Windows\System\sjwOwCI.exe
  C:\Windows\System\sjwOwCI.exe
  2⤵
  PID:5484
- C:\Windows\System\tEyycqT.exe
  C:\Windows\System\tEyycqT.exe
  2⤵
  PID:5500
- C:\Windows\System\HNQVuvh.exe
  C:\Windows\System\HNQVuvh.exe
  2⤵
  PID:5520
- C:\Windows\System\HBIrXVg.exe
  C:\Windows\System\HBIrXVg.exe
  2⤵
  PID:5544
- C:\Windows\System\HAfXdHq.exe
  C:\Windows\System\HAfXdHq.exe
  2⤵
  PID:5564
- C:\Windows\System\jNLAmcV.exe
  C:\Windows\System\jNLAmcV.exe
  2⤵
  PID:5580
- C:\Windows\System\ZXCaGRz.exe
  C:\Windows\System\ZXCaGRz.exe
  2⤵
  PID:5600
- C:\Windows\System\PpimJcV.exe
  C:\Windows\System\PpimJcV.exe
  2⤵
  PID:5624
- C:\Windows\System\SnnoPlm.exe
  C:\Windows\System\SnnoPlm.exe
  2⤵
  PID:5648
- C:\Windows\System\zZsYcXA.exe
  C:\Windows\System\zZsYcXA.exe
  2⤵
  PID:5668
- C:\Windows\System\ceDYuSa.exe
  C:\Windows\System\ceDYuSa.exe
  2⤵
  PID:5688
- C:\Windows\System\qBMfjjn.exe
  C:\Windows\System\qBMfjjn.exe
  2⤵
  PID:5708
- C:\Windows\System\hoXYzgG.exe
  C:\Windows\System\hoXYzgG.exe
  2⤵
  PID:5728
- C:\Windows\System\wzFUSwg.exe
  C:\Windows\System\wzFUSwg.exe
  2⤵
  PID:5788
- C:\Windows\System\eblZdbJ.exe
  C:\Windows\System\eblZdbJ.exe
  2⤵
  PID:5804
- C:\Windows\System\mRzFWfI.exe
  C:\Windows\System\mRzFWfI.exe
  2⤵
  PID:5820
- C:\Windows\System\mIdKIbr.exe
  C:\Windows\System\mIdKIbr.exe
  2⤵
  PID:5836
- C:\Windows\System\agSPYDh.exe
  C:\Windows\System\agSPYDh.exe
  2⤵
  PID:5852
- C:\Windows\System\takYybS.exe
  C:\Windows\System\takYybS.exe
  2⤵
  PID:5868
- C:\Windows\System\mbYdKDd.exe
  C:\Windows\System\mbYdKDd.exe
  2⤵
  PID:5884
- C:\Windows\System\hnbvHWZ.exe
  C:\Windows\System\hnbvHWZ.exe
  2⤵
  PID:5904
- C:\Windows\System\LlJRcEm.exe
  C:\Windows\System\LlJRcEm.exe
  2⤵
  PID:5920
- C:\Windows\System\aNgQJxn.exe
  C:\Windows\System\aNgQJxn.exe
  2⤵
  PID:5944
- C:\Windows\System\OPFuhYf.exe
  C:\Windows\System\OPFuhYf.exe
  2⤵
  PID:5968
- C:\Windows\System\vwlbsSs.exe
  C:\Windows\System\vwlbsSs.exe
  2⤵
  PID:5984
- C:\Windows\System\mwuXLaR.exe
  C:\Windows\System\mwuXLaR.exe
  2⤵
  PID:6008
- C:\Windows\System\qlAkMkb.exe
  C:\Windows\System\qlAkMkb.exe
  2⤵
  PID:6024
- C:\Windows\System\nwmlVxE.exe
  C:\Windows\System\nwmlVxE.exe
  2⤵
  PID:6040
- C:\Windows\System\UgNEuvj.exe
  C:\Windows\System\UgNEuvj.exe
  2⤵
  PID:6056
- C:\Windows\System\VOzYQwH.exe
  C:\Windows\System\VOzYQwH.exe
  2⤵
  PID:6076
- C:\Windows\System\jGgRkGH.exe
  C:\Windows\System\jGgRkGH.exe
  2⤵
  PID:6092
- C:\Windows\System\bxYVavB.exe
  C:\Windows\System\bxYVavB.exe
  2⤵
  PID:6108
- C:\Windows\System\vkqwzbk.exe
  C:\Windows\System\vkqwzbk.exe
  2⤵
  PID:6128
- C:\Windows\System\vPseLSk.exe
  C:\Windows\System\vPseLSk.exe
  2⤵
  PID:4200
- C:\Windows\System\FLKuuSi.exe
  C:\Windows\System\FLKuuSi.exe
  2⤵
  PID:4544
- C:\Windows\System\JCLBswk.exe
  C:\Windows\System\JCLBswk.exe
  2⤵
  PID:3012
- C:\Windows\System\reSnXcn.exe
  C:\Windows\System\reSnXcn.exe
  2⤵
  PID:5136
- C:\Windows\System\vRLdDRJ.exe
  C:\Windows\System\vRLdDRJ.exe
  2⤵
  PID:4564
- C:\Windows\System\EafgrOV.exe
  C:\Windows\System\EafgrOV.exe
  2⤵
  PID:5008
- C:\Windows\System\kMQHMrR.exe
  C:\Windows\System\kMQHMrR.exe
  2⤵
  PID:4612
- C:\Windows\System\ELAiyaA.exe
  C:\Windows\System\ELAiyaA.exe
  2⤵
  PID:5260
- C:\Windows\System\QtcaDas.exe
  C:\Windows\System\QtcaDas.exe
  2⤵
  PID:5300
- C:\Windows\System\aqTqUet.exe
  C:\Windows\System\aqTqUet.exe
  2⤵
  PID:5352
- C:\Windows\System\XyUAKyB.exe
  C:\Windows\System\XyUAKyB.exe
  2⤵
  PID:5388
- C:\Windows\System\kongVFi.exe
  C:\Windows\System\kongVFi.exe
  2⤵
  PID:5492
- C:\Windows\System\RDeNehk.exe
  C:\Windows\System\RDeNehk.exe
  2⤵
  PID:5528
- C:\Windows\System\wGGQOlm.exe
  C:\Windows\System\wGGQOlm.exe
  2⤵
  PID:5612
- C:\Windows\System\WNWYzSM.exe
  C:\Windows\System\WNWYzSM.exe
  2⤵
  PID:5620
- C:\Windows\System\exQxJGf.exe
  C:\Windows\System\exQxJGf.exe
  2⤵
  PID:5696
- C:\Windows\System\GnqAHuG.exe
  C:\Windows\System\GnqAHuG.exe
  2⤵
  PID:5736
- C:\Windows\System\NKgvIEg.exe
  C:\Windows\System\NKgvIEg.exe
  2⤵
  PID:5436
- C:\Windows\System\RGbmxde.exe
  C:\Windows\System\RGbmxde.exe
  2⤵
  PID:5480
- C:\Windows\System\PwyFMTd.exe
  C:\Windows\System\PwyFMTd.exe
  2⤵
  PID:5176
- C:\Windows\System\IfBDjka.exe
  C:\Windows\System\IfBDjka.exe
  2⤵
  PID:5768
- C:\Windows\System\vjEexVp.exe
  C:\Windows\System\vjEexVp.exe
  2⤵
  PID:5780
- C:\Windows\System\PqUlkIQ.exe
  C:\Windows\System\PqUlkIQ.exe
  2⤵
  PID:5552
- C:\Windows\System\ToBlEbE.exe
  C:\Windows\System\ToBlEbE.exe
  2⤵
  PID:5212
- C:\Windows\System\XvLxjzC.exe
  C:\Windows\System\XvLxjzC.exe
  2⤵
  PID:5284
- C:\Windows\System\KWTaRaU.exe
  C:\Windows\System\KWTaRaU.exe
  2⤵
  PID:5324
- C:\Windows\System\corVhMu.exe
  C:\Windows\System\corVhMu.exe
  2⤵
  PID:5376
- C:\Windows\System\QGwclyh.exe
  C:\Windows\System\QGwclyh.exe
  2⤵
  PID:5876
- C:\Windows\System\kNDDRdC.exe
  C:\Windows\System\kNDDRdC.exe
  2⤵
  PID:5952
- C:\Windows\System\dsLtqEh.exe
  C:\Windows\System\dsLtqEh.exe
  2⤵
  PID:5636
- C:\Windows\System\fqfymPE.exe
  C:\Windows\System\fqfymPE.exe
  2⤵
  PID:5676
- C:\Windows\System\fReiSmH.exe
  C:\Windows\System\fReiSmH.exe
  2⤵
  PID:5996
- C:\Windows\System\vLOxzvy.exe
  C:\Windows\System\vLOxzvy.exe
  2⤵
  PID:6064
- C:\Windows\System\VjJUxef.exe
  C:\Windows\System\VjJUxef.exe
  2⤵
  PID:6104
- C:\Windows\System\jfBzwcw.exe
  C:\Windows\System\jfBzwcw.exe
  2⤵
  PID:5020
- C:\Windows\System\tfjNVxI.exe
  C:\Windows\System\tfjNVxI.exe
  2⤵
  PID:5796
- C:\Windows\System\mLlKdFm.exe
  C:\Windows\System\mLlKdFm.exe
  2⤵
  PID:5864
- C:\Windows\System\UvLgPGn.exe
  C:\Windows\System\UvLgPGn.exe
  2⤵
  PID:5980
- C:\Windows\System\cfoPHLr.exe
  C:\Windows\System\cfoPHLr.exe
  2⤵
  PID:6088
- C:\Windows\System\JOxjYLN.exe
  C:\Windows\System\JOxjYLN.exe
  2⤵
  PID:5932
- C:\Windows\System\OOtxNTi.exe
  C:\Windows\System\OOtxNTi.exe
  2⤵
  PID:6048
- C:\Windows\System\ZdSBpWN.exe
  C:\Windows\System\ZdSBpWN.exe
  2⤵
  PID:4904
- C:\Windows\System\aOUjOMK.exe
  C:\Windows\System\aOUjOMK.exe
  2⤵
  PID:5536
- C:\Windows\System\QqsqpyV.exe
  C:\Windows\System\QqsqpyV.exe
  2⤵
  PID:5228
- C:\Windows\System\IKmbIWb.exe
  C:\Windows\System\IKmbIWb.exe
  2⤵
  PID:2716
- C:\Windows\System\fUlbSsk.exe
  C:\Windows\System\fUlbSsk.exe
  2⤵
  PID:5740
- C:\Windows\System\LOUxphE.exe
  C:\Windows\System\LOUxphE.exe
  2⤵
  PID:5332
- C:\Windows\System\quLGMsB.exe
  C:\Windows\System\quLGMsB.exe
  2⤵
  PID:5916
- C:\Windows\System\kUOvSJe.exe
  C:\Windows\System\kUOvSJe.exe
  2⤵
  PID:5456
- C:\Windows\System\wmXkZQg.exe
  C:\Windows\System\wmXkZQg.exe
  2⤵
  PID:5132
- C:\Windows\System\BcIrEZf.exe
  C:\Windows\System\BcIrEZf.exe
  2⤵
  PID:6020
- C:\Windows\System\McwvSaW.exe
  C:\Windows\System\McwvSaW.exe
  2⤵
  PID:5576
- C:\Windows\System\hSaFhkg.exe
  C:\Windows\System\hSaFhkg.exe
  2⤵
  PID:6124
- C:\Windows\System\iFnwSxg.exe
  C:\Windows\System\iFnwSxg.exe
  2⤵
  PID:2812
- C:\Windows\System\QMwRXbh.exe
  C:\Windows\System\QMwRXbh.exe
  2⤵
  PID:5264
- C:\Windows\System\MeDozrt.exe
  C:\Windows\System\MeDozrt.exe
  2⤵
  PID:4792
- C:\Windows\System\SYTOPcS.exe
  C:\Windows\System\SYTOPcS.exe
  2⤵
  PID:2576
- C:\Windows\System\SDSIMAA.exe
  C:\Windows\System\SDSIMAA.exe
  2⤵
  PID:5760
- C:\Windows\System\eOZBlIX.exe
  C:\Windows\System\eOZBlIX.exe
  2⤵
  PID:5680
- C:\Windows\System\DsSTyrE.exe
  C:\Windows\System\DsSTyrE.exe
  2⤵
  PID:6072
- C:\Windows\System\hIofsXM.exe
  C:\Windows\System\hIofsXM.exe
  2⤵
  PID:5928
- C:\Windows\System\bIujHsO.exe
  C:\Windows\System\bIujHsO.exe
  2⤵
  PID:5664
- C:\Windows\System\IVKiYQU.exe
  C:\Windows\System\IVKiYQU.exe
  2⤵
  PID:5356
- C:\Windows\System\VIGJcSe.exe
  C:\Windows\System\VIGJcSe.exe
  2⤵
  PID:5192
- C:\Windows\System\yPuogZB.exe
  C:\Windows\System\yPuogZB.exe
  2⤵
  PID:5404
- C:\Windows\System\xjRyXYT.exe
  C:\Windows\System\xjRyXYT.exe
  2⤵
  PID:5244
- C:\Windows\System\dYcrLMK.exe
  C:\Windows\System\dYcrLMK.exe
  2⤵
  PID:5608
- C:\Windows\System\QnqOfKh.exe
  C:\Windows\System\QnqOfKh.exe
  2⤵
  PID:4964
- C:\Windows\System\OTxRfbL.exe
  C:\Windows\System\OTxRfbL.exe
  2⤵
  PID:5776
- C:\Windows\System\APlavRh.exe
  C:\Windows\System\APlavRh.exe
  2⤵
  PID:4808
- C:\Windows\System\rrwbEkS.exe
  C:\Windows\System\rrwbEkS.exe
  2⤵
  PID:5204
- C:\Windows\System\GuacNwU.exe
  C:\Windows\System\GuacNwU.exe
  2⤵
  PID:5372
- C:\Windows\System\yhQJUpa.exe
  C:\Windows\System\yhQJUpa.exe
  2⤵
  PID:6140
- C:\Windows\System\WVbagrZ.exe
  C:\Windows\System\WVbagrZ.exe
  2⤵
  PID:5900
- C:\Windows\System\pgbHAVr.exe
  C:\Windows\System\pgbHAVr.exe
  2⤵
  PID:6000
- C:\Windows\System\BPSdthj.exe
  C:\Windows\System\BPSdthj.exe
  2⤵
  PID:5160
- C:\Windows\System\nDJJTej.exe
  C:\Windows\System\nDJJTej.exe
  2⤵
  PID:5684
- C:\Windows\System\QyFAjne.exe
  C:\Windows\System\QyFAjne.exe
  2⤵
  PID:5828
- C:\Windows\System\tlvUGBM.exe
  C:\Windows\System\tlvUGBM.exe
  2⤵
  PID:5660
- C:\Windows\System\QhANFls.exe
  C:\Windows\System\QhANFls.exe
  2⤵
  PID:5208
- C:\Windows\System\mIbQDLh.exe
  C:\Windows\System\mIbQDLh.exe
  2⤵
  PID:1240
- C:\Windows\System\yYycesi.exe
  C:\Windows\System\yYycesi.exe
  2⤵
  PID:5644
- C:\Windows\System\sgkeZXC.exe
  C:\Windows\System\sgkeZXC.exe
  2⤵
  PID:4312
- C:\Windows\System\EwWCPce.exe
  C:\Windows\System\EwWCPce.exe
  2⤵
  PID:2552
- C:\Windows\System\SUrdRxO.exe
  C:\Windows\System\SUrdRxO.exe
  2⤵
  PID:5572
- C:\Windows\System\UcQaVLN.exe
  C:\Windows\System\UcQaVLN.exe
  2⤵
  PID:6152
- C:\Windows\System\ntFMRtB.exe
  C:\Windows\System\ntFMRtB.exe
  2⤵
  PID:6172
- C:\Windows\System\ACzBkta.exe
  C:\Windows\System\ACzBkta.exe
  2⤵
  PID:6192
- C:\Windows\System\uxAtbpY.exe
  C:\Windows\System\uxAtbpY.exe
  2⤵
  PID:6232
- C:\Windows\System\KAqUqin.exe
  C:\Windows\System\KAqUqin.exe
  2⤵
  PID:6248
- C:\Windows\System\BkndEeQ.exe
  C:\Windows\System\BkndEeQ.exe
  2⤵
  PID:6264
- C:\Windows\System\kSrBgwI.exe
  C:\Windows\System\kSrBgwI.exe
  2⤵
  PID:6280
- C:\Windows\System\TZLfkOf.exe
  C:\Windows\System\TZLfkOf.exe
  2⤵
  PID:6296
- C:\Windows\System\MpVApCy.exe
  C:\Windows\System\MpVApCy.exe
  2⤵
  PID:6312
- C:\Windows\System\nFokgMc.exe
  C:\Windows\System\nFokgMc.exe
  2⤵
  PID:6332
- C:\Windows\System\nPIcaYx.exe
  C:\Windows\System\nPIcaYx.exe
  2⤵
  PID:6352
- C:\Windows\System\YnVnnwJ.exe
  C:\Windows\System\YnVnnwJ.exe
  2⤵
  PID:6368
- C:\Windows\System\utnoxXD.exe
  C:\Windows\System\utnoxXD.exe
  2⤵
  PID:6388
- C:\Windows\System\rJbzgIn.exe
  C:\Windows\System\rJbzgIn.exe
  2⤵
  PID:6404
- C:\Windows\System\hTiiJrv.exe
  C:\Windows\System\hTiiJrv.exe
  2⤵
  PID:6420
- C:\Windows\System\UtLFKgF.exe
  C:\Windows\System\UtLFKgF.exe
  2⤵
  PID:6436
- C:\Windows\System\RGsxNvt.exe
  C:\Windows\System\RGsxNvt.exe
  2⤵
  PID:6452
- C:\Windows\System\sTRmiOi.exe
  C:\Windows\System\sTRmiOi.exe
  2⤵
  PID:6468
- C:\Windows\System\XdEkIOK.exe
  C:\Windows\System\XdEkIOK.exe
  2⤵
  PID:6536
- C:\Windows\System\XZwVCeV.exe
  C:\Windows\System\XZwVCeV.exe
  2⤵
  PID:6552
- C:\Windows\System\qzKAPAz.exe
  C:\Windows\System\qzKAPAz.exe
  2⤵
  PID:6568
- C:\Windows\System\HNhCzKj.exe
  C:\Windows\System\HNhCzKj.exe
  2⤵
  PID:6588
- C:\Windows\System\uKUSUXA.exe
  C:\Windows\System\uKUSUXA.exe
  2⤵
  PID:6608
- C:\Windows\System\gIoEXFd.exe
  C:\Windows\System\gIoEXFd.exe
  2⤵
  PID:6624
- C:\Windows\System\vXrLohY.exe
  C:\Windows\System\vXrLohY.exe
  2⤵
  PID:6640
- C:\Windows\System\RwsbDwx.exe
  C:\Windows\System\RwsbDwx.exe
  2⤵
  PID:6660
- C:\Windows\System\WHemLuN.exe
  C:\Windows\System\WHemLuN.exe
  2⤵
  PID:6676
- C:\Windows\System\YGFqvAv.exe
  C:\Windows\System\YGFqvAv.exe
  2⤵
  PID:6696
- C:\Windows\System\nKPZlMC.exe
  C:\Windows\System\nKPZlMC.exe
  2⤵
  PID:6736
- C:\Windows\System\QJtKNhB.exe
  C:\Windows\System\QJtKNhB.exe
  2⤵
  PID:6752
- C:\Windows\System\JCrOJHk.exe
  C:\Windows\System\JCrOJHk.exe
  2⤵
  PID:6768
- C:\Windows\System\rXUNYri.exe
  C:\Windows\System\rXUNYri.exe
  2⤵
  PID:6788
- C:\Windows\System\NjlAESa.exe
  C:\Windows\System\NjlAESa.exe
  2⤵
  PID:6808
- C:\Windows\System\WMfjGag.exe
  C:\Windows\System\WMfjGag.exe
  2⤵
  PID:6828
- C:\Windows\System\yQJawVI.exe
  C:\Windows\System\yQJawVI.exe
  2⤵
  PID:6844
- C:\Windows\System\PFTLbaZ.exe
  C:\Windows\System\PFTLbaZ.exe
  2⤵
  PID:6864
- C:\Windows\System\yoNAzxs.exe
  C:\Windows\System\yoNAzxs.exe
  2⤵
  PID:6884
- C:\Windows\System\dzUWHFB.exe
  C:\Windows\System\dzUWHFB.exe
  2⤵
  PID:6904
- C:\Windows\System\QxfXTCi.exe
  C:\Windows\System\QxfXTCi.exe
  2⤵
  PID:6920
- C:\Windows\System\timqbaZ.exe
  C:\Windows\System\timqbaZ.exe
  2⤵
  PID:6940
- C:\Windows\System\lfUzZib.exe
  C:\Windows\System\lfUzZib.exe
  2⤵
  PID:6956
- C:\Windows\System\XmmOdKR.exe
  C:\Windows\System\XmmOdKR.exe
  2⤵
  PID:6976
- C:\Windows\System\HPkKbPs.exe
  C:\Windows\System\HPkKbPs.exe
  2⤵
  PID:6992
- C:\Windows\System\wUiZCLK.exe
  C:\Windows\System\wUiZCLK.exe
  2⤵
  PID:7008
- C:\Windows\System\AbGGSTM.exe
  C:\Windows\System\AbGGSTM.exe
  2⤵
  PID:7028
- C:\Windows\System\lOnCTtT.exe
  C:\Windows\System\lOnCTtT.exe
  2⤵
  PID:7044
- C:\Windows\System\gKAhnzl.exe
  C:\Windows\System\gKAhnzl.exe
  2⤵
  PID:7060
- C:\Windows\System\BVYaOPk.exe
  C:\Windows\System\BVYaOPk.exe
  2⤵
  PID:7116
- C:\Windows\System\OTXNWrd.exe
  C:\Windows\System\OTXNWrd.exe
  2⤵
  PID:7132
- C:\Windows\System\XgupsBv.exe
  C:\Windows\System\XgupsBv.exe
  2⤵
  PID:7148
- C:\Windows\System\sceCpAc.exe
  C:\Windows\System\sceCpAc.exe
  2⤵
  PID:7164
- C:\Windows\System\DbgahgO.exe
  C:\Windows\System\DbgahgO.exe
  2⤵
  PID:6164
- C:\Windows\System\YPDGSul.exe
  C:\Windows\System\YPDGSul.exe
  2⤵
  PID:4116
- C:\Windows\System\cKSTUDQ.exe
  C:\Windows\System\cKSTUDQ.exe
  2⤵
  PID:6208
- C:\Windows\System\EzkNCoF.exe
  C:\Windows\System\EzkNCoF.exe
  2⤵
  PID:6220
- C:\Windows\System\hjmFKct.exe
  C:\Windows\System\hjmFKct.exe
  2⤵
  PID:6204
- C:\Windows\System\XcUOtkO.exe
  C:\Windows\System\XcUOtkO.exe
  2⤵
  PID:6320
- C:\Windows\System\jDTjdHC.exe
  C:\Windows\System\jDTjdHC.exe
  2⤵
  PID:6360
- C:\Windows\System\qUmyuqp.exe
  C:\Windows\System\qUmyuqp.exe
  2⤵
  PID:6148
- C:\Windows\System\HKHRSLh.exe
  C:\Windows\System\HKHRSLh.exe
  2⤵
  PID:5172
- C:\Windows\System\TqwZmaf.exe
  C:\Windows\System\TqwZmaf.exe
  2⤵
  PID:6276
- C:\Windows\System\XMNTqcI.exe
  C:\Windows\System\XMNTqcI.exe
  2⤵
  PID:6460
- C:\Windows\System\MaJyCMl.exe
  C:\Windows\System\MaJyCMl.exe
  2⤵
  PID:6416
- C:\Windows\System\oBFoBwx.exe
  C:\Windows\System\oBFoBwx.exe
  2⤵
  PID:6304
- C:\Windows\System\IDslJmZ.exe
  C:\Windows\System\IDslJmZ.exe
  2⤵
  PID:6508
- C:\Windows\System\RpalZqP.exe
  C:\Windows\System\RpalZqP.exe
  2⤵
  PID:6380
- C:\Windows\System\dEelOUb.exe
  C:\Windows\System\dEelOUb.exe
  2⤵
  PID:6492
- C:\Windows\System\jxwEPPO.exe
  C:\Windows\System\jxwEPPO.exe
  2⤵
  PID:6620
- C:\Windows\System\GBJfiwI.exe
  C:\Windows\System\GBJfiwI.exe
  2⤵
  PID:6688
- C:\Windows\System\yItmFSi.exe
  C:\Windows\System\yItmFSi.exe
  2⤵
  PID:6704
- C:\Windows\System\TcpFblA.exe
  C:\Windows\System\TcpFblA.exe
  2⤵
  PID:6600
- C:\Windows\System\VxYyFBM.exe
  C:\Windows\System\VxYyFBM.exe
  2⤵
  PID:6632
- C:\Windows\System\hbDifUD.exe
  C:\Windows\System\hbDifUD.exe
  2⤵
  PID:6728
- C:\Windows\System\qVFRphh.exe
  C:\Windows\System\qVFRphh.exe
  2⤵
  PID:6748
- C:\Windows\System\vwUVsbz.exe
  C:\Windows\System\vwUVsbz.exe
  2⤵
  PID:6804
- C:\Windows\System\nhDjOwl.exe
  C:\Windows\System\nhDjOwl.exe
  2⤵
  PID:6760
- C:\Windows\System\DGqsbhv.exe
  C:\Windows\System\DGqsbhv.exe
  2⤵
  PID:6896
- C:\Windows\System\PznMhim.exe
  C:\Windows\System\PznMhim.exe
  2⤵
  PID:6936
- C:\Windows\System\INUSBEn.exe
  C:\Windows\System\INUSBEn.exe
  2⤵
  PID:7000
- C:\Windows\System\riXkOVQ.exe
  C:\Windows\System\riXkOVQ.exe
  2⤵
  PID:6840
- C:\Windows\System\oazMHTo.exe
  C:\Windows\System\oazMHTo.exe
  2⤵
  PID:7092
- C:\Windows\System\utmoYVa.exe
  C:\Windows\System\utmoYVa.exe
  2⤵
  PID:6988
- C:\Windows\System\RXgMxLz.exe
  C:\Windows\System\RXgMxLz.exe
  2⤵
  PID:7052
- C:\Windows\System\WKbTrgt.exe
  C:\Windows\System\WKbTrgt.exe
  2⤵
  PID:6912
- C:\Windows\System\rFzaqfk.exe
  C:\Windows\System\rFzaqfk.exe
  2⤵
  PID:7140
- C:\Windows\System\kJTHrqA.exe
  C:\Windows\System\kJTHrqA.exe
  2⤵
  PID:6016
- C:\Windows\System\iLMBDwF.exe
  C:\Windows\System\iLMBDwF.exe
  2⤵
  PID:6004
- C:\Windows\System\hGXVRmO.exe
  C:\Windows\System\hGXVRmO.exe
  2⤵
  PID:7156
- C:\Windows\System\VfCrFeA.exe
  C:\Windows\System\VfCrFeA.exe
  2⤵
  PID:5956
- C:\Windows\System\SRzneyQ.exe
  C:\Windows\System\SRzneyQ.exe
  2⤵
  PID:7128
- C:\Windows\System\SUGnvWK.exe
  C:\Windows\System\SUGnvWK.exe
  2⤵
  PID:6244
- C:\Windows\System\uNfDsqG.exe
  C:\Windows\System\uNfDsqG.exe
  2⤵
  PID:6504
- C:\Windows\System\mlRToRj.exe
  C:\Windows\System\mlRToRj.exe
  2⤵
  PID:6428
- C:\Windows\System\kKUVEix.exe
  C:\Windows\System\kKUVEix.exe
  2⤵
  PID:6376
- C:\Windows\System\crmrsbI.exe
  C:\Windows\System\crmrsbI.exe
  2⤵
  PID:6484
- C:\Windows\System\VbLqBbO.exe
  C:\Windows\System\VbLqBbO.exe
  2⤵
  PID:6528
- C:\Windows\System\WHiSKKC.exe
  C:\Windows\System\WHiSKKC.exe
  2⤵
  PID:6580
- C:\Windows\System\FsNYEpZ.exe
  C:\Windows\System\FsNYEpZ.exe
  2⤵
  PID:6668
- C:\Windows\System\LBVRHSb.exe
  C:\Windows\System\LBVRHSb.exe
  2⤵
  PID:6648
- C:\Windows\System\nszrPMY.exe
  C:\Windows\System\nszrPMY.exe
  2⤵
  PID:6656
- C:\Windows\System\SRGFMYX.exe
  C:\Windows\System\SRGFMYX.exe
  2⤵
  PID:6800
- C:\Windows\System\gZkbXgz.exe
  C:\Windows\System\gZkbXgz.exe
  2⤵
  PID:7040
- C:\Windows\System\AoaHIJp.exe
  C:\Windows\System\AoaHIJp.exe
  2⤵
  PID:6984
- C:\Windows\System\xYaufEu.exe
  C:\Windows\System\xYaufEu.exe
  2⤵
  PID:6764
- C:\Windows\System\pIVawoi.exe
  C:\Windows\System\pIVawoi.exe
  2⤵
  PID:5144
- C:\Windows\System\YtnovzT.exe
  C:\Windows\System\YtnovzT.exe
  2⤵
  PID:6916
- C:\Windows\System\BWCtUZp.exe
  C:\Windows\System\BWCtUZp.exe
  2⤵
  PID:7124
- C:\Windows\System\wDelrRV.exe
  C:\Windows\System\wDelrRV.exe
  2⤵
  PID:6348
- C:\Windows\System\bunKoRX.exe
  C:\Windows\System\bunKoRX.exe
  2⤵
  PID:6576
- C:\Windows\System\lYrZGYP.exe
  C:\Windows\System\lYrZGYP.exe
  2⤵
  PID:6784
- C:\Windows\System\JvVWMsh.exe
  C:\Windows\System\JvVWMsh.exe
  2⤵
  PID:6952
- C:\Windows\System\AWwPyVk.exe
  C:\Windows\System\AWwPyVk.exe
  2⤵
  PID:5248
- C:\Windows\System\ufoAeRL.exe
  C:\Windows\System\ufoAeRL.exe
  2⤵
  PID:6796
- C:\Windows\System\iOcbRKC.exe
  C:\Windows\System\iOcbRKC.exe
  2⤵
  PID:7088
- C:\Windows\System\qCflcaa.exe
  C:\Windows\System\qCflcaa.exe
  2⤵
  PID:6744
- C:\Windows\System\BSKxDLz.exe
  C:\Windows\System\BSKxDLz.exe
  2⤵
  PID:6480
- C:\Windows\System\tRpziGT.exe
  C:\Windows\System\tRpziGT.exe
  2⤵
  PID:7100
- C:\Windows\System\zjnYbBp.exe
  C:\Windows\System\zjnYbBp.exe
  2⤵
  PID:6876
- C:\Windows\System\JtRzrfc.exe
  C:\Windows\System\JtRzrfc.exe
  2⤵
  PID:6892
- C:\Windows\System\XnYOiIm.exe
  C:\Windows\System\XnYOiIm.exe
  2⤵
  PID:6412
- C:\Windows\System\MXVOaxX.exe
  C:\Windows\System\MXVOaxX.exe
  2⤵
  PID:5716
- C:\Windows\System\DaqBcdi.exe
  C:\Windows\System\DaqBcdi.exe
  2⤵
  PID:6184
- C:\Windows\System\IXNnqtY.exe
  C:\Windows\System\IXNnqtY.exe
  2⤵
  PID:7084
- C:\Windows\System\WTPmqXC.exe
  C:\Windows\System\WTPmqXC.exe
  2⤵
  PID:6520
- C:\Windows\System\pLYHcCg.exe
  C:\Windows\System\pLYHcCg.exe
  2⤵
  PID:7180
- C:\Windows\System\CJkQreu.exe
  C:\Windows\System\CJkQreu.exe
  2⤵
  PID:7196
- C:\Windows\System\zlHhdsJ.exe
  C:\Windows\System\zlHhdsJ.exe
  2⤵
  PID:7216
- C:\Windows\System\elBgbhr.exe
  C:\Windows\System\elBgbhr.exe
  2⤵
  PID:7232
- C:\Windows\System\urHSEzz.exe
  C:\Windows\System\urHSEzz.exe
  2⤵
  PID:7256
- C:\Windows\System\xLhdaWm.exe
  C:\Windows\System\xLhdaWm.exe
  2⤵
  PID:7272
- C:\Windows\System\DZSiWhE.exe
  C:\Windows\System\DZSiWhE.exe
  2⤵
  PID:7288
- C:\Windows\System\ervdMZG.exe
  C:\Windows\System\ervdMZG.exe
  2⤵
  PID:7304
- C:\Windows\System\aKOycEQ.exe
  C:\Windows\System\aKOycEQ.exe
  2⤵
  PID:7332
- C:\Windows\System\DjcoAPf.exe
  C:\Windows\System\DjcoAPf.exe
  2⤵
  PID:7352
- C:\Windows\System\oMGkeZe.exe
  C:\Windows\System\oMGkeZe.exe
  2⤵
  PID:7368
- C:\Windows\System\HMyHEtz.exe
  C:\Windows\System\HMyHEtz.exe
  2⤵
  PID:7384
- C:\Windows\System\ZzzqqyS.exe
  C:\Windows\System\ZzzqqyS.exe
  2⤵
  PID:7416
- C:\Windows\System\aKQQvOT.exe
  C:\Windows\System\aKQQvOT.exe
  2⤵
  PID:7432
- C:\Windows\System\ERRgwYf.exe
  C:\Windows\System\ERRgwYf.exe
  2⤵
  PID:7452
- C:\Windows\System\opAWivC.exe
  C:\Windows\System\opAWivC.exe
  2⤵
  PID:7496
- C:\Windows\System\xXKBklf.exe
  C:\Windows\System\xXKBklf.exe
  2⤵
  PID:7528
- C:\Windows\System\QpneBiL.exe
  C:\Windows\System\QpneBiL.exe
  2⤵
  PID:7544
- C:\Windows\System\NsFtWNY.exe
  C:\Windows\System\NsFtWNY.exe
  2⤵
  PID:7568
- C:\Windows\System\msgzPPe.exe
  C:\Windows\System\msgzPPe.exe
  2⤵
  PID:7584
- C:\Windows\System\pHGGNXI.exe
  C:\Windows\System\pHGGNXI.exe
  2⤵
  PID:7600
- C:\Windows\System\pMdNjcj.exe
  C:\Windows\System\pMdNjcj.exe
  2⤵
  PID:7616
- C:\Windows\System\gtCVNlj.exe
  C:\Windows\System\gtCVNlj.exe
  2⤵
  PID:7636
- C:\Windows\System\PANMkfe.exe
  C:\Windows\System\PANMkfe.exe
  2⤵
  PID:7652
- C:\Windows\System\cTdSnQs.exe
  C:\Windows\System\cTdSnQs.exe
  2⤵
  PID:7668
- C:\Windows\System\dsewpsz.exe
  C:\Windows\System\dsewpsz.exe
  2⤵
  PID:7684
- C:\Windows\System\VSqbSUD.exe
  C:\Windows\System\VSqbSUD.exe
  2⤵
  PID:7748
- C:\Windows\System\VTkWhhv.exe
  C:\Windows\System\VTkWhhv.exe
  2⤵
  PID:7764
- C:\Windows\System\Iufdjru.exe
  C:\Windows\System\Iufdjru.exe
  2⤵
  PID:7780
- C:\Windows\System\xLaqpTL.exe
  C:\Windows\System\xLaqpTL.exe
  2⤵
  PID:7796
- C:\Windows\System\qZvdyHx.exe
  C:\Windows\System\qZvdyHx.exe
  2⤵
  PID:7812
- C:\Windows\System\TfoSKjV.exe
  C:\Windows\System\TfoSKjV.exe
  2⤵
  PID:7828
- C:\Windows\System\iAfpFTC.exe
  C:\Windows\System\iAfpFTC.exe
  2⤵
  PID:7848
- C:\Windows\System\fiDZtRQ.exe
  C:\Windows\System\fiDZtRQ.exe
  2⤵
  PID:7872
- C:\Windows\System\ZBgczLI.exe
  C:\Windows\System\ZBgczLI.exe
  2⤵
  PID:7888
- C:\Windows\System\DjLEkMy.exe
  C:\Windows\System\DjLEkMy.exe
  2⤵
  PID:7904
- C:\Windows\System\cMiyUSK.exe
  C:\Windows\System\cMiyUSK.exe
  2⤵
  PID:7924
- C:\Windows\System\abePrvi.exe
  C:\Windows\System\abePrvi.exe
  2⤵
  PID:7940
- C:\Windows\System\NaJQdEd.exe
  C:\Windows\System\NaJQdEd.exe
  2⤵
  PID:7956
- C:\Windows\System\dttuAlR.exe
  C:\Windows\System\dttuAlR.exe
  2⤵
  PID:7976
- C:\Windows\System\eivmPIp.exe
  C:\Windows\System\eivmPIp.exe
  2⤵
  PID:7996
- C:\Windows\System\DGydhUD.exe
  C:\Windows\System\DGydhUD.exe
  2⤵
  PID:8012
- C:\Windows\System\GQgtFvR.exe
  C:\Windows\System\GQgtFvR.exe
  2⤵
  PID:8028
- C:\Windows\System\yxLfRvJ.exe
  C:\Windows\System\yxLfRvJ.exe
  2⤵
  PID:8044
- C:\Windows\System\DbZgSCZ.exe
  C:\Windows\System\DbZgSCZ.exe
  2⤵
  PID:8108
- C:\Windows\System\fpilJny.exe
  C:\Windows\System\fpilJny.exe
  2⤵
  PID:8128
- C:\Windows\System\bNOXfJl.exe
  C:\Windows\System\bNOXfJl.exe
  2⤵
  PID:8144
- C:\Windows\System\KspzJfd.exe
  C:\Windows\System\KspzJfd.exe
  2⤵
  PID:8160
- C:\Windows\System\HxGArwm.exe
  C:\Windows\System\HxGArwm.exe
  2⤵
  PID:8180
- C:\Windows\System\atbZCMa.exe
  C:\Windows\System\atbZCMa.exe
  2⤵
  PID:7188
- C:\Windows\System\xleaYJf.exe
  C:\Windows\System\xleaYJf.exe
  2⤵
  PID:7268
- C:\Windows\System\HTiplYI.exe
  C:\Windows\System\HTiplYI.exe
  2⤵
  PID:7280
- C:\Windows\System\kWolqrx.exe
  C:\Windows\System\kWolqrx.exe
  2⤵
  PID:7340
- C:\Windows\System\jaxKuue.exe
  C:\Windows\System\jaxKuue.exe
  2⤵
  PID:6860
- C:\Windows\System\ZAplQtU.exe
  C:\Windows\System\ZAplQtU.exe
  2⤵
  PID:7348
- C:\Windows\System\VPXEENB.exe
  C:\Windows\System\VPXEENB.exe
  2⤵
  PID:7464
- C:\Windows\System\uLfRtYN.exe
  C:\Windows\System\uLfRtYN.exe
  2⤵
  PID:7176
- C:\Windows\System\fwkxouI.exe
  C:\Windows\System\fwkxouI.exe
  2⤵
  PID:7316
- C:\Windows\System\wdFgAhl.exe
  C:\Windows\System\wdFgAhl.exe
  2⤵
  PID:6716
- C:\Windows\System\CKzEJVW.exe
  C:\Windows\System\CKzEJVW.exe
  2⤵
  PID:6708
- C:\Windows\System\LEKCAdG.exe
  C:\Windows\System\LEKCAdG.exe
  2⤵
  PID:6524
- C:\Windows\System\JTwivSe.exe
  C:\Windows\System\JTwivSe.exe
  2⤵
  PID:7488
- C:\Windows\System\LyJZIVX.exe
  C:\Windows\System\LyJZIVX.exe
  2⤵
  PID:7540
- C:\Windows\System\cdBIBCk.exe
  C:\Windows\System\cdBIBCk.exe
  2⤵
  PID:7648
- C:\Windows\System\ewxJsAf.exe
  C:\Windows\System\ewxJsAf.exe
  2⤵
  PID:7444
- C:\Windows\System\aNZuleH.exe
  C:\Windows\System\aNZuleH.exe
  2⤵
  PID:7512
- C:\Windows\System\HqoPQTl.exe
  C:\Windows\System\HqoPQTl.exe
  2⤵
  PID:7556
- C:\Windows\System\AFBgbQc.exe
  C:\Windows\System\AFBgbQc.exe
  2⤵
  PID:7624
- C:\Windows\System\uFQOYxW.exe
  C:\Windows\System\uFQOYxW.exe
  2⤵
  PID:7664
- C:\Windows\System\sWsbXHS.exe
  C:\Windows\System\sWsbXHS.exe
  2⤵
  PID:7396
- C:\Windows\System\wdTIssX.exe
  C:\Windows\System\wdTIssX.exe
  2⤵
  PID:7408
- C:\Windows\System\bjVJciM.exe
  C:\Windows\System\bjVJciM.exe
  2⤵
  PID:7716
- C:\Windows\System\yKseklE.exe
  C:\Windows\System\yKseklE.exe
  2⤵
  PID:7860
- C:\Windows\System\xigXaCz.exe
  C:\Windows\System\xigXaCz.exe
  2⤵
  PID:7900
- C:\Windows\System\etSiZmZ.exe
  C:\Windows\System\etSiZmZ.exe
  2⤵
  PID:7936
- C:\Windows\System\yLJAOrO.exe
  C:\Windows\System\yLJAOrO.exe
  2⤵
  PID:7696
- C:\Windows\System\ucfhxve.exe
  C:\Windows\System\ucfhxve.exe
  2⤵
  PID:7968
- C:\Windows\System\kuzylqP.exe
  C:\Windows\System\kuzylqP.exe
  2⤵
  PID:8040
- C:\Windows\System\UZTnCDC.exe
  C:\Windows\System\UZTnCDC.exe
  2⤵
  PID:8020
- C:\Windows\System\vnwLSLl.exe
  C:\Windows\System\vnwLSLl.exe
  2⤵
  PID:8052
- C:\Windows\System\mAnPyrB.exe
  C:\Windows\System\mAnPyrB.exe
  2⤵
  PID:7920
- C:\Windows\System\ISUMaDo.exe
  C:\Windows\System\ISUMaDo.exe
  2⤵
  PID:8100
- C:\Windows\System\XtRiiNC.exe
  C:\Windows\System\XtRiiNC.exe
  2⤵
  PID:8088
- C:\Windows\System\eYiwfDj.exe
  C:\Windows\System\eYiwfDj.exe
  2⤵
  PID:8120
- C:\Windows\System\YLDmjqN.exe
  C:\Windows\System\YLDmjqN.exe
  2⤵
  PID:8152
- C:\Windows\System\vgzUyCO.exe
  C:\Windows\System\vgzUyCO.exe
  2⤵
  PID:7076
- C:\Windows\System\WnYHbmT.exe
  C:\Windows\System\WnYHbmT.exe
  2⤵
  PID:7112
- C:\Windows\System\zYOIGZB.exe
  C:\Windows\System\zYOIGZB.exe
  2⤵
  PID:8176
- C:\Windows\System\udEKLTv.exe
  C:\Windows\System\udEKLTv.exe
  2⤵
  PID:7428
- C:\Windows\System\LXeRwni.exe
  C:\Windows\System\LXeRwni.exe
  2⤵
  PID:7284
- C:\Windows\System\VLkbVZC.exe
  C:\Windows\System\VLkbVZC.exe
  2⤵
  PID:7344
- C:\Windows\System\GgFQHRy.exe
  C:\Windows\System\GgFQHRy.exe
  2⤵
  PID:7104
- C:\Windows\System\KtLRdPm.exe
  C:\Windows\System\KtLRdPm.exe
  2⤵
  PID:7480
- C:\Windows\System\WzfIoFk.exe
  C:\Windows\System\WzfIoFk.exe
  2⤵
  PID:7504
- C:\Windows\System\ORWXvWj.exe
  C:\Windows\System\ORWXvWj.exe
  2⤵
  PID:7360
- C:\Windows\System\htcMIsG.exe
  C:\Windows\System\htcMIsG.exe
  2⤵
  PID:7824
- C:\Windows\System\hXbYMHB.exe
  C:\Windows\System\hXbYMHB.exe
  2⤵
  PID:7644
- C:\Windows\System\nSwthib.exe
  C:\Windows\System\nSwthib.exe
  2⤵
  PID:7660
- C:\Windows\System\wMpyLSV.exe
  C:\Windows\System\wMpyLSV.exe
  2⤵
  PID:7792
- C:\Windows\System\VDQbRAB.exe
  C:\Windows\System\VDQbRAB.exe
  2⤵
  PID:7728
- C:\Windows\System\lqitOdU.exe
  C:\Windows\System\lqitOdU.exe
  2⤵
  PID:7972
- C:\Windows\System\ejqdepB.exe
  C:\Windows\System\ejqdepB.exe
  2⤵
  PID:7240
- C:\Windows\System\CXjdQHu.exe
  C:\Windows\System\CXjdQHu.exe
  2⤵
  PID:7992
- C:\Windows\System\lXTzkWb.exe
  C:\Windows\System\lXTzkWb.exe
  2⤵
  PID:7952
- C:\Windows\System\HTZZQiK.exe
  C:\Windows\System\HTZZQiK.exe
  2⤵
  PID:7916
- C:\Windows\System\PWIkFFb.exe
  C:\Windows\System\PWIkFFb.exe
  2⤵
  PID:6400
- C:\Windows\System\qumSGhK.exe
  C:\Windows\System\qumSGhK.exe
  2⤵
  PID:7424
- C:\Windows\System\eeIQmkL.exe
  C:\Windows\System\eeIQmkL.exe
  2⤵
  PID:7248
- C:\Windows\System\cDcwdTt.exe
  C:\Windows\System\cDcwdTt.exe
  2⤵
  PID:8140
- C:\Windows\System\dXsIbTe.exe
  C:\Windows\System\dXsIbTe.exe
  2⤵
  PID:7208
- C:\Windows\System\ebeDJqo.exe
  C:\Windows\System\ebeDJqo.exe
  2⤵
  PID:8080
- C:\Windows\System\OGSEHci.exe
  C:\Windows\System\OGSEHci.exe
  2⤵
  PID:7576
- C:\Windows\System\ykKSJwo.exe
  C:\Windows\System\ykKSJwo.exe
  2⤵
  PID:7328
- C:\Windows\System\KCZelql.exe
  C:\Windows\System\KCZelql.exe
  2⤵
  PID:7472
- C:\Windows\System\DdaEYZh.exe
  C:\Windows\System\DdaEYZh.exe
  2⤵
  PID:7564
- C:\Windows\System\WApsFsq.exe
  C:\Windows\System\WApsFsq.exe
  2⤵
  PID:7736
- C:\Windows\System\ZeLJKUd.exe
  C:\Windows\System\ZeLJKUd.exe
  2⤵
  PID:7468
- C:\Windows\System\CrJdTan.exe
  C:\Windows\System\CrJdTan.exe
  2⤵
  PID:7404
- C:\Windows\System\wuUZDqM.exe
  C:\Windows\System\wuUZDqM.exe
  2⤵
  PID:8008
- C:\Windows\System\MycFqvw.exe
  C:\Windows\System\MycFqvw.exe
  2⤵
  PID:7988
- C:\Windows\System\PgfXaIG.exe
  C:\Windows\System\PgfXaIG.exe
  2⤵
  PID:7484
- C:\Windows\System\OwrHLQa.exe
  C:\Windows\System\OwrHLQa.exe
  2⤵
  PID:8092
- C:\Windows\System\iGwvZfa.exe
  C:\Windows\System\iGwvZfa.exe
  2⤵
  PID:7536
- C:\Windows\System\khDbvVN.exe
  C:\Windows\System\khDbvVN.exe
  2⤵
  PID:7312
- C:\Windows\System\cWGjqpS.exe
  C:\Windows\System\cWGjqpS.exe
  2⤵
  PID:7320
- C:\Windows\System\ZdZxqvn.exe
  C:\Windows\System\ZdZxqvn.exe
  2⤵
  PID:6932
- C:\Windows\System\dwyXkTp.exe
  C:\Windows\System\dwyXkTp.exe
  2⤵
  PID:7724
- C:\Windows\System\TIzmRZE.exe
  C:\Windows\System\TIzmRZE.exe
  2⤵
  PID:8056
- C:\Windows\System\cgDkSSS.exe
  C:\Windows\System\cgDkSSS.exe
  2⤵
  PID:7680
- C:\Windows\System\RBaBFAH.exe
  C:\Windows\System\RBaBFAH.exe
  2⤵
  PID:7840
- C:\Windows\System\NYlXwzf.exe
  C:\Windows\System\NYlXwzf.exe
  2⤵
  PID:8084
- C:\Windows\System\CBrhZMU.exe
  C:\Windows\System\CBrhZMU.exe
  2⤵
  PID:7224
- C:\Windows\System\gApYoKu.exe
  C:\Windows\System\gApYoKu.exe
  2⤵
  PID:7912
- C:\Windows\System\sviBcur.exe
  C:\Windows\System\sviBcur.exe
  2⤵
  PID:7704
- C:\Windows\System\eCBSAgV.exe
  C:\Windows\System\eCBSAgV.exe
  2⤵
  PID:7760
- C:\Windows\System\eYKkhPm.exe
  C:\Windows\System\eYKkhPm.exe
  2⤵
  PID:7364
- C:\Windows\System\rXXGeYT.exe
  C:\Windows\System\rXXGeYT.exe
  2⤵
  PID:8224
- C:\Windows\System\uYNexSG.exe
  C:\Windows\System\uYNexSG.exe
  2⤵
  PID:8244
- C:\Windows\System\bwhiwRF.exe
  C:\Windows\System\bwhiwRF.exe
  2⤵
  PID:8268
- C:\Windows\System\IGFNKeQ.exe
  C:\Windows\System\IGFNKeQ.exe
  2⤵
  PID:8288
- C:\Windows\System\RjhHYoD.exe
  C:\Windows\System\RjhHYoD.exe
  2⤵
  PID:8316
- C:\Windows\System\FWhvXWz.exe
  C:\Windows\System\FWhvXWz.exe
  2⤵
  PID:8332
- C:\Windows\System\kVPfXvV.exe
  C:\Windows\System\kVPfXvV.exe
  2⤵
  PID:8352
- C:\Windows\System\kSYcpyJ.exe
  C:\Windows\System\kSYcpyJ.exe
  2⤵
  PID:8368
- C:\Windows\System\MgqtzLO.exe
  C:\Windows\System\MgqtzLO.exe
  2⤵
  PID:8384
- C:\Windows\System\lWrDuiU.exe
  C:\Windows\System\lWrDuiU.exe
  2⤵
  PID:8412
- C:\Windows\System\AAAdmVp.exe
  C:\Windows\System\AAAdmVp.exe
  2⤵
  PID:8428
- C:\Windows\System\NBxxMQL.exe
  C:\Windows\System\NBxxMQL.exe
  2⤵
  PID:8452
- C:\Windows\System\iYwlJxM.exe
  C:\Windows\System\iYwlJxM.exe
  2⤵
  PID:8472
- C:\Windows\System\XntutTR.exe
  C:\Windows\System\XntutTR.exe
  2⤵
  PID:8492
- C:\Windows\System\NoMGyTp.exe
  C:\Windows\System\NoMGyTp.exe
  2⤵
  PID:8508
- C:\Windows\System\NVKGkeU.exe
  C:\Windows\System\NVKGkeU.exe
  2⤵
  PID:8528
- C:\Windows\System\PGsahjG.exe
  C:\Windows\System\PGsahjG.exe
  2⤵
  PID:8548
- C:\Windows\System\whQTmIY.exe
  C:\Windows\System\whQTmIY.exe
  2⤵
  PID:8564
- C:\Windows\System\HJRhgUO.exe
  C:\Windows\System\HJRhgUO.exe
  2⤵
  PID:8584
- C:\Windows\System\ixQnbnV.exe
  C:\Windows\System\ixQnbnV.exe
  2⤵
  PID:8608
- C:\Windows\System\afqwHPa.exe
  C:\Windows\System\afqwHPa.exe
  2⤵
  PID:8628
- C:\Windows\System\NUwFgWe.exe
  C:\Windows\System\NUwFgWe.exe
  2⤵
  PID:8644
- C:\Windows\System\jVFuSvU.exe
  C:\Windows\System\jVFuSvU.exe
  2⤵
  PID:8672
- C:\Windows\System\iifpOBQ.exe
  C:\Windows\System\iifpOBQ.exe
  2⤵
  PID:8696
- C:\Windows\System\VNDbVFo.exe
  C:\Windows\System\VNDbVFo.exe
  2⤵
  PID:8712
- C:\Windows\System\Kuqemwo.exe
  C:\Windows\System\Kuqemwo.exe
  2⤵
  PID:8728
- C:\Windows\System\KFpkONk.exe
  C:\Windows\System\KFpkONk.exe
  2⤵
  PID:8744
- C:\Windows\System\zSnSIAm.exe
  C:\Windows\System\zSnSIAm.exe
  2⤵
  PID:8760
- C:\Windows\System\EjgnYsi.exe
  C:\Windows\System\EjgnYsi.exe
  2⤵
  PID:8776
- C:\Windows\System\vVyClzh.exe
  C:\Windows\System\vVyClzh.exe
  2⤵
  PID:8796
- C:\Windows\System\UTutZEi.exe
  C:\Windows\System\UTutZEi.exe
  2⤵
  PID:8812
- C:\Windows\System\wTIbZHe.exe
  C:\Windows\System\wTIbZHe.exe
  2⤵
  PID:8828
- C:\Windows\System\zvhfTWG.exe
  C:\Windows\System\zvhfTWG.exe
  2⤵
  PID:8848
- C:\Windows\System\KjgzwQm.exe
  C:\Windows\System\KjgzwQm.exe
  2⤵
  PID:8864
- C:\Windows\System\XObhjjV.exe
  C:\Windows\System\XObhjjV.exe
  2⤵
  PID:8892
- C:\Windows\System\XLbmdyJ.exe
  C:\Windows\System\XLbmdyJ.exe
  2⤵
  PID:8940
- C:\Windows\System\HYKjMXX.exe
  C:\Windows\System\HYKjMXX.exe
  2⤵
  PID:8956
- C:\Windows\System\QLOjOnP.exe
  C:\Windows\System\QLOjOnP.exe
  2⤵
  PID:8976
- C:\Windows\System\stoXkVq.exe
  C:\Windows\System\stoXkVq.exe
  2⤵
  PID:8996
- C:\Windows\System\cSPPVlZ.exe
  C:\Windows\System\cSPPVlZ.exe
  2⤵
  PID:9012
- C:\Windows\System\WynUkyI.exe
  C:\Windows\System\WynUkyI.exe
  2⤵
  PID:9048
- C:\Windows\System\DqEvKqC.exe
  C:\Windows\System\DqEvKqC.exe
  2⤵
  PID:9064
- C:\Windows\System\HTMFNhp.exe
  C:\Windows\System\HTMFNhp.exe
  2⤵
  PID:9088
- C:\Windows\System\SYIfszQ.exe
  C:\Windows\System\SYIfszQ.exe
  2⤵
  PID:9108
- C:\Windows\System\zQiTHBK.exe
  C:\Windows\System\zQiTHBK.exe
  2⤵
  PID:9124
- C:\Windows\System\DqUageB.exe
  C:\Windows\System\DqUageB.exe
  2⤵
  PID:9140
- C:\Windows\System\GLYaYFA.exe
  C:\Windows\System\GLYaYFA.exe
  2⤵
  PID:9156
- C:\Windows\System\RWrQTQg.exe
  C:\Windows\System\RWrQTQg.exe
  2⤵
  PID:9176
- C:\Windows\System\VhgGgFK.exe
  C:\Windows\System\VhgGgFK.exe
  2⤵
  PID:9192
- C:\Windows\System\FVDOjbc.exe
  C:\Windows\System\FVDOjbc.exe
  2⤵
  PID:7712
- C:\Windows\System\ZFzhnhR.exe
  C:\Windows\System\ZFzhnhR.exe
  2⤵
  PID:7776
- C:\Windows\System\HnQCuBL.exe
  C:\Windows\System\HnQCuBL.exe
  2⤵
  PID:8168
- C:\Windows\System\TmpwMMC.exe
  C:\Windows\System\TmpwMMC.exe
  2⤵
  PID:7632
- C:\Windows\System\PypPlAh.exe
  C:\Windows\System\PypPlAh.exe
  2⤵
  PID:8240
- C:\Windows\System\weUPeLO.exe
  C:\Windows\System\weUPeLO.exe
  2⤵
  PID:8280
- C:\Windows\System\BWECZck.exe
  C:\Windows\System\BWECZck.exe
  2⤵
  PID:8300
- C:\Windows\System\GUrMiTb.exe
  C:\Windows\System\GUrMiTb.exe
  2⤵
  PID:8324
- C:\Windows\System\RAIssru.exe
  C:\Windows\System\RAIssru.exe
  2⤵
  PID:8360
- C:\Windows\System\OkpdzFH.exe
  C:\Windows\System\OkpdzFH.exe
  2⤵
  PID:8392
- C:\Windows\System\ZImqhmU.exe
  C:\Windows\System\ZImqhmU.exe
  2⤵
  PID:8436
- C:\Windows\System\QpSJxzz.exe
  C:\Windows\System\QpSJxzz.exe
  2⤵
  PID:8420
- C:\Windows\System\HZXRZqx.exe
  C:\Windows\System\HZXRZqx.exe
  2⤵
  PID:8488
- C:\Windows\System\YqNZXiz.exe
  C:\Windows\System\YqNZXiz.exe
  2⤵
  PID:8500
- C:\Windows\System\DmPlNfV.exe
  C:\Windows\System\DmPlNfV.exe
  2⤵
  PID:8596
- C:\Windows\System\fenjLZg.exe
  C:\Windows\System\fenjLZg.exe
  2⤵
  PID:8536
- C:\Windows\System\fCoRich.exe
  C:\Windows\System\fCoRich.exe
  2⤵
  PID:8580
- C:\Windows\System\eYnRYde.exe
  C:\Windows\System\eYnRYde.exe
  2⤵
  PID:8688
- C:\Windows\System\rlDoHLB.exe
  C:\Windows\System\rlDoHLB.exe
  2⤵
  PID:8708
- C:\Windows\System\vfzrzcB.exe
  C:\Windows\System\vfzrzcB.exe
  2⤵
  PID:8784
- C:\Windows\System\AVmzaip.exe
  C:\Windows\System\AVmzaip.exe
  2⤵
  PID:8824
- C:\Windows\System\JtHbNdX.exe
  C:\Windows\System\JtHbNdX.exe
  2⤵
  PID:8768
- C:\Windows\System\DmiLZUa.exe
  C:\Windows\System\DmiLZUa.exe
  2⤵
  PID:8836
- C:\Windows\System\WIFgKcn.exe
  C:\Windows\System\WIFgKcn.exe
  2⤵
  PID:8876
- C:\Windows\System\CSKicuT.exe
  C:\Windows\System\CSKicuT.exe
  2⤵
  PID:8916
- C:\Windows\System\PUTIbdN.exe
  C:\Windows\System\PUTIbdN.exe
  2⤵
  PID:8872
- C:\Windows\System\FBGmUnG.exe
  C:\Windows\System\FBGmUnG.exe
  2⤵
  PID:8988
- C:\Windows\System\SugvfED.exe
  C:\Windows\System\SugvfED.exe
  2⤵
  PID:8992
- C:\Windows\System\KDqikhC.exe
  C:\Windows\System\KDqikhC.exe
  2⤵
  PID:8840
- C:\Windows\System\gZRRhjC.exe
  C:\Windows\System\gZRRhjC.exe
  2⤵
  PID:9060
- C:\Windows\System\csdLBUB.exe
  C:\Windows\System\csdLBUB.exe
  2⤵
  PID:9084
- C:\Windows\System\pSqrVBr.exe
  C:\Windows\System\pSqrVBr.exe
  2⤵
  PID:9136
- C:\Windows\System\GriaCaB.exe
  C:\Windows\System\GriaCaB.exe
  2⤵
  PID:9204
- C:\Windows\System\QpxDsUX.exe
  C:\Windows\System\QpxDsUX.exe
  2⤵
  PID:8204
- C:\Windows\System\nxniOLH.exe
  C:\Windows\System\nxniOLH.exe
  2⤵
  PID:8284
- C:\Windows\System\kKBWxOX.exe
  C:\Windows\System\kKBWxOX.exe
  2⤵
  PID:8308
- C:\Windows\System\SbYgzOh.exe
  C:\Windows\System\SbYgzOh.exe
  2⤵
  PID:8348
- C:\Windows\System\QtOpblF.exe
  C:\Windows\System\QtOpblF.exe
  2⤵
  PID:8396
- C:\Windows\System\JodJECr.exe
  C:\Windows\System\JodJECr.exe
  2⤵
  PID:8480
- C:\Windows\System\tzdDFsB.exe
  C:\Windows\System\tzdDFsB.exe
  2⤵
  PID:8276
- C:\Windows\System\edRgqAF.exe
  C:\Windows\System\edRgqAF.exe
  2⤵
  PID:8640
- C:\Windows\System\NIgMSks.exe
  C:\Windows\System\NIgMSks.exe
  2⤵
  PID:8616
- C:\Windows\System\yZOydvH.exe
  C:\Windows\System\yZOydvH.exe
  2⤵
  PID:8668
- C:\Windows\System\iJyPKju.exe
  C:\Windows\System\iJyPKju.exe
  2⤵
  PID:8656
- C:\Windows\System\vkAJEwx.exe
  C:\Windows\System\vkAJEwx.exe
  2⤵
  PID:8792
- C:\Windows\System\OvyPpTR.exe
  C:\Windows\System\OvyPpTR.exe
  2⤵
  PID:8736
- C:\Windows\System\kJcWWDG.exe
  C:\Windows\System\kJcWWDG.exe
  2⤵
  PID:8904
- C:\Windows\System\EeWDxnx.exe
  C:\Windows\System\EeWDxnx.exe
  2⤵
  PID:8936
- C:\Windows\System\GnpPwVc.exe
  C:\Windows\System\GnpPwVc.exe
  2⤵
  PID:8860
- C:\Windows\System\orWTVQM.exe
  C:\Windows\System\orWTVQM.exe
  2⤵
  PID:8952
- C:\Windows\System\MbHBiKB.exe
  C:\Windows\System\MbHBiKB.exe
  2⤵
  PID:9028
- C:\Windows\System\nUAIDwZ.exe
  C:\Windows\System\nUAIDwZ.exe
  2⤵
  PID:9044
- C:\Windows\System\asKzAWJ.exe
  C:\Windows\System\asKzAWJ.exe
  2⤵
  PID:9116
- C:\Windows\System\XqnHmar.exe
  C:\Windows\System\XqnHmar.exe
  2⤵
  PID:9200
- C:\Windows\System\NbMBLVc.exe
  C:\Windows\System\NbMBLVc.exe
  2⤵
  PID:8216
- C:\Windows\System\yYNrySc.exe
  C:\Windows\System\yYNrySc.exe
  2⤵
  PID:8340
- C:\Windows\System\IWllNjz.exe
  C:\Windows\System\IWllNjz.exe
  2⤵
  PID:9184
- C:\Windows\System\RSGNhFy.exe
  C:\Windows\System\RSGNhFy.exe
  2⤵
  PID:8404
- C:\Windows\System\dAZbVPV.exe
  C:\Windows\System\dAZbVPV.exe
  2⤵
  PID:8556
- C:\Windows\System\QnnQPiM.exe
  C:\Windows\System\QnnQPiM.exe
  2⤵
  PID:8620
- C:\Windows\System\mTOmFtU.exe
  C:\Windows\System\mTOmFtU.exe
  2⤵
  PID:8844
- C:\Windows\System\ZEFPrRH.exe
  C:\Windows\System\ZEFPrRH.exe
  2⤵
  PID:8856
- C:\Windows\System\woKvNdp.exe
  C:\Windows\System\woKvNdp.exe
  2⤵
  PID:932
- C:\Windows\System\nyaadwR.exe
  C:\Windows\System\nyaadwR.exe
  2⤵
  PID:9076
- C:\Windows\System\FkohnNF.exe
  C:\Windows\System\FkohnNF.exe
  2⤵
  PID:8200
- C:\Windows\System\XCcaUKZ.exe
  C:\Windows\System\XCcaUKZ.exe
  2⤵
  PID:8296
- C:\Windows\System\apCFHIJ.exe
  C:\Windows\System\apCFHIJ.exe
  2⤵
  PID:8464
- C:\Windows\System\QsbXSQM.exe
  C:\Windows\System\QsbXSQM.exe
  2⤵
  PID:8196
- C:\Windows\System\zfcXVsp.exe
  C:\Windows\System\zfcXVsp.exe
  2⤵
  PID:8504
- C:\Windows\System\mLXSWYi.exe
  C:\Windows\System\mLXSWYi.exe
  2⤵
  PID:8560
- C:\Windows\System\phYxZWC.exe
  C:\Windows\System\phYxZWC.exe
  2⤵
  PID:8516
- C:\Windows\System\cgzdFds.exe
  C:\Windows\System\cgzdFds.exe
  2⤵
  PID:8772
- C:\Windows\System\pnIIYDN.exe
  C:\Windows\System\pnIIYDN.exe
  2⤵
  PID:9172
- C:\Windows\System\kFDSrsT.exe
  C:\Windows\System\kFDSrsT.exe
  2⤵
  PID:8520
- C:\Windows\System\zzXoYta.exe
  C:\Windows\System\zzXoYta.exe
  2⤵
  PID:8460
- C:\Windows\System\CQxVZze.exe
  C:\Windows\System\CQxVZze.exe
  2⤵
  PID:8576
- C:\Windows\System\IhTLGBB.exe
  C:\Windows\System\IhTLGBB.exe
  2⤵
  PID:8236
- C:\Windows\System\iJyZzSg.exe
  C:\Windows\System\iJyZzSg.exe
  2⤵
  PID:9132
- C:\Windows\System\eXWhSrO.exe
  C:\Windows\System\eXWhSrO.exe
  2⤵
  PID:8968
- C:\Windows\System\EeEZZTV.exe
  C:\Windows\System\EeEZZTV.exe
  2⤵
  PID:9008
- C:\Windows\System\BgLOiEe.exe
  C:\Windows\System\BgLOiEe.exe
  2⤵
  PID:8380
- C:\Windows\System\zmJynEA.exe
  C:\Windows\System\zmJynEA.exe
  2⤵
  PID:8376
- C:\Windows\System\GyliTuR.exe
  C:\Windows\System\GyliTuR.exe
  2⤵
  PID:6836
- C:\Windows\System\rqQeWJk.exe
  C:\Windows\System\rqQeWJk.exe
  2⤵
  PID:9228
- C:\Windows\System\QZOJAZE.exe
  C:\Windows\System\QZOJAZE.exe
  2⤵
  PID:9244
- C:\Windows\System\uQlUewE.exe
  C:\Windows\System\uQlUewE.exe
  2⤵
  PID:9268
- C:\Windows\System\clAYdmr.exe
  C:\Windows\System\clAYdmr.exe
  2⤵
  PID:9304
- C:\Windows\System\kIefrKe.exe
  C:\Windows\System\kIefrKe.exe
  2⤵
  PID:9320
- C:\Windows\System\emXeIMR.exe
  C:\Windows\System\emXeIMR.exe
  2⤵
  PID:9336
- C:\Windows\System\ciAAsQv.exe
  C:\Windows\System\ciAAsQv.exe
  2⤵
  PID:9380
- C:\Windows\System\AdDsygk.exe
  C:\Windows\System\AdDsygk.exe
  2⤵
  PID:9400
- C:\Windows\System\HyzYqiA.exe
  C:\Windows\System\HyzYqiA.exe
  2⤵
  PID:9420
- C:\Windows\System\ygFFTOD.exe
  C:\Windows\System\ygFFTOD.exe
  2⤵
  PID:9436
- C:\Windows\System\zSWNVkf.exe
  C:\Windows\System\zSWNVkf.exe
  2⤵
  PID:9452
- C:\Windows\System\aNzvXxH.exe
  C:\Windows\System\aNzvXxH.exe
  2⤵
  PID:9472
- C:\Windows\System\WnIRnRw.exe
  C:\Windows\System\WnIRnRw.exe
  2⤵
  PID:9492
- C:\Windows\System\jtKeEGW.exe
  C:\Windows\System\jtKeEGW.exe
  2⤵
  PID:9508
- C:\Windows\System\TusXHHi.exe
  C:\Windows\System\TusXHHi.exe
  2⤵
  PID:9524
- C:\Windows\System\QREaCUE.exe
  C:\Windows\System\QREaCUE.exe
  2⤵
  PID:9548
- C:\Windows\System\VSTPPVa.exe
  C:\Windows\System\VSTPPVa.exe
  2⤵
  PID:9576
- C:\Windows\System\pjXtuiR.exe
  C:\Windows\System\pjXtuiR.exe
  2⤵
  PID:9592
- C:\Windows\System\EgcemFZ.exe
  C:\Windows\System\EgcemFZ.exe
  2⤵
  PID:9612
- C:\Windows\System\icrnaag.exe
  C:\Windows\System\icrnaag.exe
  2⤵
  PID:9636
- C:\Windows\System\BkgEWel.exe
  C:\Windows\System\BkgEWel.exe
  2⤵
  PID:9656
- C:\Windows\System\mAdajBp.exe
  C:\Windows\System\mAdajBp.exe
  2⤵
  PID:9676
- C:\Windows\System\XoiumuQ.exe
  C:\Windows\System\XoiumuQ.exe
  2⤵
  PID:9696
- C:\Windows\System\dMjuZrU.exe
  C:\Windows\System\dMjuZrU.exe
  2⤵
  PID:9712
- C:\Windows\System\tgfmBdv.exe
  C:\Windows\System\tgfmBdv.exe
  2⤵
  PID:9736
- C:\Windows\System\VhCvzJH.exe
  C:\Windows\System\VhCvzJH.exe
  2⤵
  PID:9752
- C:\Windows\System\IunMrzD.exe
  C:\Windows\System\IunMrzD.exe
  2⤵
  PID:9772
- C:\Windows\System\WEfPHnL.exe
  C:\Windows\System\WEfPHnL.exe
  2⤵
  PID:9796
- C:\Windows\System\IdDzAio.exe
  C:\Windows\System\IdDzAio.exe
  2⤵
  PID:9816
- C:\Windows\System\tuDczYF.exe
  C:\Windows\System\tuDczYF.exe
  2⤵
  PID:9832
- C:\Windows\System\WGBUmRd.exe
  C:\Windows\System\WGBUmRd.exe
  2⤵
  PID:9852
- C:\Windows\System\NrsYpkh.exe
  C:\Windows\System\NrsYpkh.exe
  2⤵
  PID:9868
- C:\Windows\System\yhIQKId.exe
  C:\Windows\System\yhIQKId.exe
  2⤵
  PID:9884
- C:\Windows\System\uvaTGRV.exe
  C:\Windows\System\uvaTGRV.exe
  2⤵
  PID:9904
- C:\Windows\System\mXHJmcU.exe
  C:\Windows\System\mXHJmcU.exe
  2⤵
  PID:9928
- C:\Windows\System\XezKpFg.exe
  C:\Windows\System\XezKpFg.exe
  2⤵
  PID:9948
- C:\Windows\System\CdUraUI.exe
  C:\Windows\System\CdUraUI.exe
  2⤵
  PID:9968
- C:\Windows\System\ZWiHeuW.exe
  C:\Windows\System\ZWiHeuW.exe
  2⤵
  PID:9992
- C:\Windows\System\hLoDagA.exe
  C:\Windows\System\hLoDagA.exe
  2⤵
  PID:10012
- C:\Windows\System\VbnjIgN.exe
  C:\Windows\System\VbnjIgN.exe
  2⤵
  PID:10028
- C:\Windows\System\XAAIrqv.exe
  C:\Windows\System\XAAIrqv.exe
  2⤵
  PID:10060
- C:\Windows\System\QKnsmDw.exe
  C:\Windows\System\QKnsmDw.exe
  2⤵
  PID:10080
- C:\Windows\System\coEFlTd.exe
  C:\Windows\System\coEFlTd.exe
  2⤵
  PID:10096
- C:\Windows\System\dskDvev.exe
  C:\Windows\System\dskDvev.exe
  2⤵
  PID:10120
- C:\Windows\System\MiBuQUM.exe
  C:\Windows\System\MiBuQUM.exe
  2⤵
  PID:10136
- C:\Windows\System\xUTJgkg.exe
  C:\Windows\System\xUTJgkg.exe
  2⤵
  PID:10160
- C:\Windows\System\jMhleTK.exe
  C:\Windows\System\jMhleTK.exe
  2⤵
  PID:10176
- C:\Windows\System\tTmqfIx.exe
  C:\Windows\System\tTmqfIx.exe
  2⤵
  PID:10200
- C:\Windows\System\XkcxUyP.exe
  C:\Windows\System\XkcxUyP.exe
  2⤵
  PID:10220
- C:\Windows\System\xvjSEEO.exe
  C:\Windows\System\xvjSEEO.exe
  2⤵
  PID:8720
- C:\Windows\System\VIXvwSB.exe
  C:\Windows\System\VIXvwSB.exe
  2⤵
  PID:9276
- C:\Windows\System\XFDqZsR.exe
  C:\Windows\System\XFDqZsR.exe
  2⤵
  PID:9288
- C:\Windows\System\KDBuJJY.exe
  C:\Windows\System\KDBuJJY.exe
  2⤵
  PID:9264
- C:\Windows\System\FagxXWq.exe
  C:\Windows\System\FagxXWq.exe
  2⤵
  PID:8660
- C:\Windows\System\ZJhCfeQ.exe
  C:\Windows\System\ZJhCfeQ.exe
  2⤵
  PID:9360
- C:\Windows\System\ahYfkWo.exe
  C:\Windows\System\ahYfkWo.exe
  2⤵
  PID:9376
- C:\Windows\System\qQPbqXt.exe
  C:\Windows\System\qQPbqXt.exe
  2⤵
  PID:9416
- C:\Windows\System\ifWYDzV.exe
  C:\Windows\System\ifWYDzV.exe
  2⤵
  PID:9412
- C:\Windows\System\QBvRKPQ.exe
  C:\Windows\System\QBvRKPQ.exe
  2⤵
  PID:9500
- C:\Windows\System\oBJkbjE.exe
  C:\Windows\System\oBJkbjE.exe
  2⤵
  PID:9520
- C:\Windows\System\dxfzSrF.exe
  C:\Windows\System\dxfzSrF.exe
  2⤵
  PID:9540
- C:\Windows\System\fFsbQpL.exe
  C:\Windows\System\fFsbQpL.exe
  2⤵
  PID:9572
- C:\Windows\System\PWJyvnT.exe
  C:\Windows\System\PWJyvnT.exe
  2⤵
  PID:9604
- C:\Windows\System\hIpeBnt.exe
  C:\Windows\System\hIpeBnt.exe
  2⤵
  PID:9664
- C:\Windows\System\ZBMDJoM.exe
  C:\Windows\System\ZBMDJoM.exe
  2⤵
  PID:9684
- C:\Windows\System\rnhhPAw.exe
  C:\Windows\System\rnhhPAw.exe
  2⤵
  PID:9708
- C:\Windows\System\Hffuxiw.exe
  C:\Windows\System\Hffuxiw.exe
  2⤵
  PID:9732
- C:\Windows\System\wsdwCkH.exe
  C:\Windows\System\wsdwCkH.exe
  2⤵
  PID:9780
- C:\Windows\System\GHoDqXp.exe
  C:\Windows\System\GHoDqXp.exe
  2⤵
  PID:9804
- C:\Windows\System\TmpXvAS.exe
  C:\Windows\System\TmpXvAS.exe
  2⤵
  PID:9260
- C:\Windows\System\kWRQVnq.exe
  C:\Windows\System\kWRQVnq.exe
  2⤵
  PID:9844
- C:\Windows\System\sMOXyTO.exe
  C:\Windows\System\sMOXyTO.exe
  2⤵
  PID:9916
- C:\Windows\System\jMVKEwa.exe
  C:\Windows\System\jMVKEwa.exe
  2⤵
  PID:9940
- C:\Windows\System\gfgzauC.exe
  C:\Windows\System\gfgzauC.exe
  2⤵
  PID:10000
- C:\Windows\System\midRPuC.exe
  C:\Windows\System\midRPuC.exe
  2⤵
  PID:9984
- C:\Windows\System\ejlJFZW.exe
  C:\Windows\System\ejlJFZW.exe
  2⤵
  PID:10048
- C:\Windows\System\APYUPCk.exe
  C:\Windows\System\APYUPCk.exe
  2⤵
  PID:10088
- C:\Windows\System\hynuZIR.exe
  C:\Windows\System\hynuZIR.exe
  2⤵
  PID:10144

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GJnwULm.exe

Filesize
2.0MB

MD5
5f9662439e98a98c352c185095bfc487

SHA1
a11fe81e1ff68db31e14c5e4d57892ab3a61bbcf

SHA256
ff2997e8d84d6decfeea3b76199a70dc0f4834be7629a98e88659aa78ab923fb

SHA512
f173d67d6f31c6aad7656d8eed00926d5c53f748d58e66d10641459bb5404528633f668d4176440d1bf7d4d2efc8a1dde8d1a76f1ca97eadee9adef3060f82ea

Download Submit
C:\Windows\system\JdzpIFT.exe

Filesize
2.0MB

MD5
cd33afa72b8aba7098fef77dfec4b82b

SHA1
2a5ca0f83723740883f5b63b15ec7d2fa71e9644

SHA256
e1ea29b9d0890c657b93dcf4486a614452c6f020cae02d8d3043c77f35aa4bc5

SHA512
9bc96dc3908e4575a62a63e3c9b86a77a3f01c2fd239f0195bc10d87dc4377666150bdf2396fd9644ae407ee4624cc36ef8ba89c986a87035e0bb3d7db87b8f5

Download Submit
C:\Windows\system\KdPWxfP.exe

Filesize
2.0MB

MD5
ab37bed9e6b852d6c91080885b8ad3a9

SHA1
99ea1fab8cbf56c38e1e907e201a6e8067f58d8c

SHA256
18ffaa147760569da07d194d281c2ef0b7ee2acd62ed5e8298b6c51c4e996acf

SHA512
aff225b0d6dbc573e7e6b465b1a966d70ec5fecb40699406b059149107119d5096d6a5e20ba72e0c4c36bf9cb00675e2c01aeef1b9985ccaa44c8741f4816f17

Download Submit
C:\Windows\system\LOqsGVc.exe

Filesize
2.0MB

MD5
08c8cd897f1876c984b5357ff5182247

SHA1
12e013af145c799f5cc7b26caf778135531f04c8

SHA256
321f75721d85a22e038f836a077077563496ad275fbb80a1fd387271584bffbf

SHA512
e0920b9cd66a3a6d9330a4de0ff42e1be98c8c2df1177ecca50454587611717b53fa237611102edb450188c1e4f8429dc366801db66c5f5244ae8def0266ade3

Download Submit
C:\Windows\system\MDcYEBr.exe

Filesize
2.0MB

MD5
0879c30fe32ee4ce63217ea1725b7252

SHA1
669024fd0c1baa6ab972e05c964dd93ea4cea686

SHA256
19e53f24bb05504c20928d8a18a51bfe52d60055c4f078eefb8e225e6c3b55bf

SHA512
c112a7406a1d65bb321c8bda308eff76ffb104545d4dcb78f5bb2bc29bcd2b6e46a2a5226342d0930f4e28be61b8dc7683b36f4a063f7ee1f921b15b94b576d8

Download Submit
C:\Windows\system\OCiwTJA.exe

Filesize
2.0MB

MD5
93871a855ac2fa38f2d9e3b603ea741e

SHA1
4b39a858a6c340c405e55b0b38ae4d0e7488967d

SHA256
91cd040ed5dbdac03410f8aaf0ca4183c46a06ac1cb6004cf9fbe9c6d0f53232

SHA512
259ee1737ad5c7869397a4673d76659db2124b2ae9bab1e908c0eb0bb894616faf848b3cf062b5118a07bb478fd4baa0efb97d559da6543db702b527a8077652

Download Submit
C:\Windows\system\OOiQrYO.exe

Filesize
2.0MB

MD5
e3920d51f8e0f326a75408829e4e4e5a

SHA1
210a2f641f2daf5890ed3e085211b78e4bd6c86f

SHA256
bef0715b57cc8cdea480c99e8176b2cce8ec6f1f9c810beea3b5afb2f35e55d1

SHA512
449c3e645d44e642f6be86186aaa4fad883aadc136ba4a88d2d3f4009d933625f18d773b521f789e6977a591eb4a1e28edf1b4c38bd4ffd4aab74d79dfa27138

Download Submit
C:\Windows\system\QTFghSG.exe

Filesize
2.0MB

MD5
40b8a4108d697e182881761844b83ce2

SHA1
08b5ea36d80ad5ef1e3deec383fc426edea6feb9

SHA256
4a34d90cb8d7a0f0f3e12ee56b00c757875e16b2d7caf5e19c0a997b6006b825

SHA512
e7dc270980dcba6f3f3eef096164dda8924557f9a7f1a6a5b8dde25c5649f697ba00dbaf1cf88a0a7d8dd0c6c6cfe4bf9f133597241667d28d3673b5ef695146

Download Submit
C:\Windows\system\QjyaLCd.exe

Filesize
2.0MB

MD5
a57503aec401c569fbb271867ce5c457

SHA1
8bd83f3e462ddfaa485d6491834570fa02539f35

SHA256
36c16ee9a55925c823a3308688a5686e1147ef0f07ffa120691bb9398f0d1e88

SHA512
3be6b2b7e45ef7ea6aa5bfa985990165f14aada893f16b6bfbbc830cdc53717de768146fe3df904a2f2656c5581144419e7a5c201faff371a933600f0d1f8938

Download Submit
C:\Windows\system\VlMvDFW.exe

Filesize
2.0MB

MD5
f1516e39b41935919befcf530e176ef0

SHA1
b54296e13f8ad12059515588a4343e95bd74a0ce

SHA256
e06dd74ee606c432f0c90c97377805fbea96b059be8f37169ab504e135e61b23

SHA512
be07a61d36221428f9128f2f624c2c95da6cd86ea8d82f0fc0974772c74fc7e736b936ee4c9fef513151fe2fa6d8c3f5e4372ba27948f1fbba9da03384f1641c

Download Submit
C:\Windows\system\XgizBpU.exe

Filesize
2.0MB

MD5
9e89e880572d7be449e1dc15d47793f6

SHA1
28f383e16d3e66e67d5b5b8e7f16325b7f94de44

SHA256
7332d2920f814bd8c02a37e7645995b50f8442bd2354a81c913bfa94eef26860

SHA512
166f36477886b57eea3143a8d6a92538c2ac4557299186d190f69bb0e14383710aa7e2fee7b4ac8808a5b17134181dabe25a6ed2e134b8eadde97564e23944f5

Download Submit
C:\Windows\system\ZkkxeOY.exe

Filesize
2.0MB

MD5
627cee35aa4ab135c16947ce53bac1cd

SHA1
bdc5cb0d9fad1468dfa7811ea54629c232bab313

SHA256
60fbb51a85f0bd3e03ee9d44ed41785eb581e5a599fe0aa5806246b441d4ab6b

SHA512
324e7a0aa141b14f75b2a1702468f8c2b52f4ffdf0d1fb77ffebb95e71c1fe72c13a66b9625e7b39f772c7c0ae13e9df4c12ad2fd6cc4a17ce0c93443ed9fa3b

Download Submit
C:\Windows\system\cEnpapm.exe

Filesize
2.0MB

MD5
75aa033d04362f221092736a8353edc9

SHA1
72ec7d67b78dae430c5ebfef99f179bf65614f21

SHA256
3b8dee891b0c78b9221fa0716e5ed770c599a7dc931273e2653cbc6c21b13bbb

SHA512
c6b47332aafbf34b070a188e6d07b2c195b4447f091f12016ef64b13294583ec40ea979580517ede2d83c80a9f529f11cc46527bf5b2eaf7bf81da6874ec98fb

Download Submit
C:\Windows\system\dvqqiCX.exe

Filesize
2.0MB

MD5
1e88e70c6df5edb06c8d0b270af8b811

SHA1
c9f75e9d56b43560caacd28d8a28d2af73f87e90

SHA256
830bce12fab12f049450e31540f291d242759cad4b8348b10e708f875d416fc3

SHA512
96a1a5c3ea5b39dcffc146b7d7f5e1893ab12f0ab1389c3f0ede648d906a5c201168f2ef5052cc9d87f9f3e32d0fd6f3764af593a1750f9f821b1fc2920b88bd

Download Submit
C:\Windows\system\fZMNChp.exe

Filesize
2.0MB

MD5
60a84910f6c1bed494ead87911c9e5ba

SHA1
a6a89ffa17734c3b19eccbd16f6ac2e411517fcf

SHA256
837ca4fb43e2130c839b63072d249b5e1943a0f7cd8da90908eea2a086922ee0

SHA512
99d057ddf513707b36b68fb29a6e92081468e2687f42551f8571ca4a44a00107d517027f8bc870a77c6426830893f408d017dd94570c239eab4c80c5ad860445

Download Submit
C:\Windows\system\fcVyklT.exe

Filesize
2.0MB

MD5
62a110763eb8007b59011428cd323ef0

SHA1
e26e771eec21fa9679e6d5781035b06d85d22558

SHA256
9a8f6c0694a9d5123a4c7e21299d2edffceed3a93a982b5d4c2a3941d545ba0e

SHA512
aa848801476c60f6bd4192fed6ea04f0e6622aee47ca6c902037d9460cfef23b0e0266e3bf1d98c9aa890c4e7be27f9da25bc6a423cfb8acaaa55a6ba7e00c67

Download Submit
C:\Windows\system\iMHeBJy.exe

Filesize
2.0MB

MD5
1079d8d8e04da044479f7f40e6ffe6c4

SHA1
7ceabe008771af2e752d857c3514cf8289a05053

SHA256
26641b9a2bc77ede10bf54bf9a64f6b5ae2a4483554b5f2101c70cc544db9830

SHA512
604d04b2a1ac1067dfe328f83aa6c59cfe0bfb877851f7a068db1323da147f93bd776cef7f7c6f0e42507af7286d2f48b622eb7c3ca276ac328bf65082753e02

Download Submit
C:\Windows\system\jbjdmYe.exe

Filesize
2.0MB

MD5
588010bfe2a27415d77f44c765f5b99a

SHA1
4299fe955fb758c97295debd24aec53a70da1124

SHA256
c0962e13af031fe5f66a1adfe3cf4758a728aaceaa57f2adec4b82e489d55515

SHA512
acc67e9c48427e372b2fd927d6ea73b3a81ff0906c3b55fb6826f764d95ef7fc3c396bbf725abf28097e560bf4a97d253933cb14897c51e12a2c91ac2e92a3e3

Download Submit
C:\Windows\system\pJEmTsO.exe

Filesize
2.0MB

MD5
c3e99632d2b76964ca7213aeac021a3d

SHA1
b90b5d94e2841082c215d81490119b7fa402e5ab

SHA256
4e5bcc34d14fd9838bda1b3ae039e3fc819f1f8822e6d0136621946ff050c8cf

SHA512
a1d4a672754b314bb565c5ec08d704e6d2e064971b7dcc2a0533c60a07edbb41ac334f22cae648253aaa10421fc4e2323374b082b991b61db8b9aa9f91a60b41

Download Submit
C:\Windows\system\pjQnJQF.exe

Filesize
2.0MB

MD5
7f9b76b498254e03d877534f0941e9de

SHA1
28bc68f1e7949d16bd9ef10c6392ab4e202b3a42

SHA256
0e762688f75f9561d67de4b846a6ec9be9848d4ffe57e27780cb86ccffcc5732

SHA512
5e10dac2278fd9a3662fdcc0f2235de500c3c65f49573a9ef5cdaa8e0a3bbc77f5cd1503c91452891258f2d697ae47c29f7675f90fcdb89f438a740fcb79431c

Download Submit
C:\Windows\system\rMackNe.exe

Filesize
2.0MB

MD5
1a9d6259801a89d2b52c87013adb8121

SHA1
0723d639153ef7df66ff5ffd8cfd407b590747b5

SHA256
d7a73a4124c9a6b59f757a976d29a8072c80eec96e430752ff9438c2e9a69d23

SHA512
beb65c60f9edd73ceac3336870b9af384889fe2d4cd805cf0637a1ef708087a5b62035f5435bfb88568fbc69c7a673e3b9c8eea4537a12b92ebf1d598950a072

Download Submit
C:\Windows\system\wpWsgJj.exe

Filesize
2.0MB

MD5
ce920297c32580ac2cc4930e4e7c3f31

SHA1
28614b809ad8576960a28cd832f5a9a149f82020

SHA256
30dab9312b54a8b0442a4c48e9b5f9ca9a778ad6be3e2c0eb194ea49d4bd0340

SHA512
c49bd435d0cb0fd8e0f019747feece5d0c96395d3ab8b6127c55bc0c15c1a61ac04d005d228e139da23f24bc186aad929fb05243d7f759785c80de58bc9845b4

Download Submit
C:\Windows\system\wydWxkB.exe

Filesize
2.0MB

MD5
00876f7b2a0c220c9977522a090e7797

SHA1
66801b1231a431ff300aae4a79d07f1521fd7f8a

SHA256
011520bb6256cd8206e5b12688aadee143c8818762447e360a764abee464b0ff

SHA512
5bb9a5836651d4b74b5356a10f83ed8df90d15543357d44c19506b37bbac4cdca448bb61768df0f3c1dbe16a973979ffb71d837e2662edb0df00ce24c55956a3

Download Submit
C:\Windows\system\yNKbvrS.exe

Filesize
2.0MB

MD5
bc9a621b9d3680e08ba2f0e247c8c9f6

SHA1
477f89f74aa49e342892b9dcec8dfc386567b291

SHA256
60f6a10b7215fd0e02f7c54b8105f2efd2dce68e70e70be634947f18d7bb5ccb

SHA512
8738280c28c94573d56c3fca20dbefe83976451acfa28b150134251b452614ba34e4cbe8b4ffd907753855700eae63a35c3e673d7ba87c3d39f840e4d99dea05

Download Submit
C:\Windows\system\zfotkQl.exe

Filesize
2.0MB

MD5
e93f3e34712dccc9e95798fdf64c02ff

SHA1
ef4762dda3a0b1e4832e698a91fc5a0672a493c9

SHA256
bbef29cb41f133733195928a44374d88a35f049909a9be743792a882f6ab2c45

SHA512
c5a5a052e34056f256cb6575068cf1a681ef4cfec792a39b04e554b1962f14e7941312c5b9626d9a61c6bcfd3d7576e7987c775e43ded2b43f4f65f1aa512610

Download Submit
C:\Windows\system\zifxuFd.exe

Filesize
2.0MB

MD5
f411b725a35c2ca65037a240af751a4c

SHA1
08a3f69b001a1fdc99ed05ad43b7676f016de156

SHA256
06885faf68071b370b4ccc33d8e704ea7f42d585fcefa6da4652699b77740805

SHA512
8e8a4fad7dc389323605940081e2f03f0228281e0dc6d36c25d0efa94892b87daa40a3b5fa2e4c876856711a71387446b1f2e8fe0b7225bf4bb93f441da3c62f

Download Submit
\Windows\system\MrKQnhK.exe

Filesize
2.0MB

MD5
48664b5b4871ce4b2b1e93b6c44acbfc

SHA1
72ed6b68fdd5667551f02c5fe992a9589e5c0928

SHA256
9b9f2093c31cce57752412a1971c7cd93a0a454f43967015b9d450f5bded770f

SHA512
d9d52487bc286e31b55f6bcf801d4cf26772c4f09dda304f19b881fa7b55ac1b963a27d711abe425e35c2268a7eef4a4f7f2c1cd854466f6de347a5f6c8f29f8

Download Submit
\Windows\system\ROWJuRT.exe

Filesize
2.0MB

MD5
42d2b7460b48f9ad45d42fc251978a31

SHA1
55a3e4306ae3a1c9d81ac6d1d942c0010d892db9

SHA256
c4d6adf5a5f6dee2aec7f4648d28dfc5e9c14a7fa241df555ffc65054caca9a0

SHA512
15978bc1af1001af0cf1d0540da03e7687cc72d0db7897fa091e2f6559a5c5dfdc9d49c980e5daac9ae579b2d2c986436267696f6ac5e3b3bcd952a020e75aa6

Download Submit
\Windows\system\fjxTDxa.exe

Filesize
2.0MB

MD5
2e60dbfc367ce0ecf3759ba2f54709f2

SHA1
4ac04d84861b6af950b56f99931e0086573ead0e

SHA256
88b3dd4899934cd29b89039db5ffb4aecc555a79c4a839ee033606e537dc78c7

SHA512
cbabdc5be6f39aeb9bb3f75e5fc413c44e1c2589b13669556f817764d155327161c41bfca478dd0f35e26c05b5db29def7b2c17ad75798a779cf8d1a5d19b862

Download Submit
\Windows\system\nOXgwxR.exe

Filesize
2.0MB

MD5
5b00122e86add61d21a360e205ef54c9

SHA1
49454e3dc981edb8bb7ae5f3ac26c7acf36e3ab8

SHA256
ab1bb7e075846bace3178536854e3579683cb6d994d715e64fcdf196abc5b7cb

SHA512
86a85f74f8faf199ecc041df26d2de4a76573d77e7c05c6eed39ec848dda476a055f9496f259a2abc1a385a312fa500d22438a6a2008e6eca7c9143ad66b0c86

Download Submit
\Windows\system\uyGCkAu.exe

Filesize
2.0MB

MD5
d859fbf5763a7d914736a53c06704053

SHA1
ef091d2ffe74b18cfa396a42c89ee8797e1376fe

SHA256
b339a3ce85cd614fdcca25f5269bc54e4e31cbaa800b2fe18406193f17d6458f

SHA512
10fc0f0e2b3a8a788b92e84f880bc81d0579a133f337db26f209be47520a32b649527bb45b612ad2fc36510ec220038277313e5a3ca5456fbcaaef95ebdcb898

Download Submit
\Windows\system\ylmBtAA.exe

Filesize
2.0MB

MD5
4710228effc47f71b0e5c7adcbd509cf

SHA1
9502f964e16c8631fd858fe99040f8de9c5ab80c

SHA256
68d3385178400ab7f6acf9cdf33c20f493b576138c8f67ab691e59316be3a9ee

SHA512
43ad58fbe900ccfb02631e97877834fa2f1e4b3295363ff88268c08da3d8cad929612e3446e7ef7e139760bcb7abc0a520e7250e8c2325e6f7903078d93cf1be

Download Submit
memory/1324-4023-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/1324-58-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/1492-99-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1492-3162-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1492-4033-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-68-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-61-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-91-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/1712-0-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/1712-2321-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-106-0x0000000002100000-0x0000000002454000-memory.dmp

Filesize
3.3MB

Download
memory/1712-82-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/1712-70-0x0000000002100000-0x0000000002454000-memory.dmp

Filesize
3.3MB

Download
memory/1712-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1712-66-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-65-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-64-0x000000013F520000-0x000000013F874000-memory.dmp

Filesize
3.3MB

Download
memory/1712-3424-0x0000000002100000-0x0000000002454000-memory.dmp

Filesize
3.3MB

Download
memory/1712-18-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-3161-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-2811-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/1712-57-0x0000000002100000-0x0000000002454000-memory.dmp

Filesize
3.3MB

Download
memory/1712-54-0x000000013F670000-0x000000013F9C4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-2492-0x0000000002100000-0x0000000002454000-memory.dmp

Filesize
3.3MB

Download
memory/1712-48-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-41-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/1712-98-0x000000013F560000-0x000000013F8B4000-memory.dmp

Filesize
3.3MB

Download
memory/1712-1635-0x000000013F0D0000-0x000000013F424000-memory.dmp

Filesize
3.3MB

Download
memory/1712-2309-0x0000000002100000-0x0000000002454000-memory.dmp

Filesize
3.3MB

Download
memory/2168-72-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2168-4027-0x000000013F460000-0x000000013F7B4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-4021-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

Filesize
3.3MB

Download
memory/2216-26-0x000000013FBA0000-0x000000013FEF4000-memory.dmp

Filesize
3.3MB

Download
memory/2396-4026-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2396-71-0x000000013F920000-0x000000013FC74000-memory.dmp

Filesize
3.3MB

Download
memory/2448-4031-0x000000013F060000-0x000000013F3B4000-memory.dmp

Filesize
3.3MB

Download
memory/2448-81-0x000000013F060000-0x000000013F3B4000-memory.dmp

Filesize
3.3MB

Download
memory/2448-2810-0x000000013F060000-0x000000013F3B4000-memory.dmp

Filesize
3.3MB

Download
memory/2460-2812-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2460-4030-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2460-83-0x000000013FF20000-0x0000000140274000-memory.dmp

Filesize
3.3MB

Download
memory/2488-92-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/2488-2934-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/2488-4032-0x000000013F430000-0x000000013F784000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4029-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2548-75-0x000000013F970000-0x000000013FCC4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-63-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2564-4025-0x000000013FAA0000-0x000000013FDF4000-memory.dmp

Filesize
3.3MB

Download
memory/2596-59-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/2596-4024-0x000000013F1E0000-0x000000013F534000-memory.dmp

Filesize
3.3MB

Download
memory/2668-4028-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2668-76-0x000000013FA70000-0x000000013FDC4000-memory.dmp

Filesize
3.3MB

Download
memory/2852-35-0x000000013F520000-0x000000013F874000-memory.dmp

Filesize
3.3MB

Download
memory/2852-4020-0x000000013F520000-0x000000013F874000-memory.dmp

Filesize
3.3MB

Download
memory/3032-4022-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download
memory/3032-53-0x000000013FD60000-0x00000001400B4000-memory.dmp

Filesize
3.3MB

Download