xmrig | c420f35d51f20358d590ec2e2635db6f1e8146666c860b3f9ba52ce6cd95ca36

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 03:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
Size

2.9MB
MD5

643bb4505bac37dccb0a24959b7008d0
SHA1

406873a7779c3cd34e63305910fc92a30ff57c88
SHA256

c420f35d51f20358d590ec2e2635db6f1e8146666c860b3f9ba52ce6cd95ca36
SHA512

af3016a1d821344eb47554db39a0bb6e3bbd468ff8e57c34999b39f83faab426cc7fc8234b2d2c7b12df69e9b72aee1cdb810fd62b989021dd614c3eba00b9ff
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IBcAUNX:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RM

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral1/memory/2476-0-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/files/0x00090000000120ff-6.dat	xmrig
behavioral1/files/0x0033000000016c56-12.dat	xmrig
behavioral1/memory/2204-14-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/files/0x0008000000016ce7-25.dat	xmrig
behavioral1/files/0x0007000000004e76-30.dat	xmrig
behavioral1/files/0x0008000000016d3d-35.dat	xmrig
behavioral1/files/0x0007000000016d45-39.dat	xmrig
behavioral1/files/0x0007000000016d4e-45.dat	xmrig
behavioral1/files/0x0008000000016d65-49.dat	xmrig
behavioral1/files/0x00050000000186ff-69.dat	xmrig
behavioral1/files/0x0006000000018bf0-94.dat	xmrig
behavioral1/files/0x0005000000019228-99.dat	xmrig
behavioral1/files/0x0005000000019462-162.dat	xmrig
behavioral1/files/0x000500000001943e-156.dat	xmrig
behavioral1/files/0x00050000000193b1-147.dat	xmrig
behavioral1/files/0x000500000001939f-140.dat	xmrig
behavioral1/files/0x000500000001933a-132.dat	xmrig
behavioral1/files/0x0005000000019277-123.dat	xmrig
behavioral1/files/0x000500000001925d-109.dat	xmrig
behavioral1/files/0x0005000000019260-115.dat	xmrig
behavioral1/files/0x000500000001923b-104.dat	xmrig
behavioral1/files/0x000500000001878d-89.dat	xmrig
behavioral1/files/0x0005000000018787-84.dat	xmrig
behavioral1/files/0x000500000001873f-79.dat	xmrig
behavioral1/files/0x0005000000018739-74.dat	xmrig
behavioral1/files/0x00050000000186f1-64.dat	xmrig
behavioral1/files/0x00050000000186e6-59.dat	xmrig
behavioral1/files/0x0005000000018686-54.dat	xmrig
behavioral1/files/0x0005000000019433-170.dat	xmrig
behavioral1/memory/2916-226-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2648-259-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/memory/2772-264-0x000000013F840000-0x000000013FC36000-memory.dmp	xmrig
behavioral1/memory/2548-256-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	xmrig
behavioral1/memory/2748-251-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig
behavioral1/memory/2700-237-0x000000013F950000-0x000000013FD46000-memory.dmp	xmrig
behavioral1/memory/2780-215-0x000000013FC90000-0x0000000140086000-memory.dmp	xmrig
behavioral1/memory/2944-222-0x000000013FC70000-0x0000000140066000-memory.dmp	xmrig
behavioral1/memory/2636-208-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	xmrig
behavioral1/memory/2764-203-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	xmrig
behavioral1/files/0x0005000000019457-159.dat	xmrig
behavioral1/files/0x00050000000193a5-143.dat	xmrig
behavioral1/files/0x0005000000019381-135.dat	xmrig
behavioral1/files/0x0005000000019283-127.dat	xmrig
behavioral1/files/0x0005000000019275-118.dat	xmrig
behavioral1/memory/1984-15-0x000000013F120000-0x000000013F516000-memory.dmp	xmrig
behavioral1/memory/2476-2552-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	xmrig
behavioral1/memory/2916-4208-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2748-4209-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2136	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2204	RFQUnDd.exe
1984	CdCYIxv.exe
2764	SQUCqOw.exe
2636	ooMoFWb.exe
2780	SGGLxQs.exe
2944	rAgaYEV.exe
2916	xZQLTZI.exe
2700	dZMxjvo.exe
2748	gNstuiz.exe
2548	mktDyhY.exe
2648	ICSunjr.exe
2772	GaAXQbv.exe
300	eDqzRCQ.exe
1896	lQrvMTc.exe
2844	AnCTfYT.exe
2852	nWZAYid.exe
2828	DUfhabe.exe
2260	biqmfyY.exe
1800	jpCpdSy.exe
1332	iISdxzn.exe
808	TjJDRVF.exe
1328	KtvZFzb.exe
1400	FzxRYre.exe
1748	eJQENog.exe
2912	mIwnjNw.exe
2396	nlEPcRm.exe
2240	lprDNiV.exe
1648	nctAKGm.exe
1236	Tbympsk.exe
2908	eaxjwTT.exe
1976	dFEGDoa.exe
1348	FDjhHGH.exe
2420	wJWiZli.exe
2380	dlcGHmk.exe
1732	PbGVwLP.exe
1360	RogIQqJ.exe
948	MIRNKmZ.exe
1760	kTFKFJH.exe
2200	PBiKWwa.exe
1804	xxEuzrr.exe
1684	sitmypn.exe
2056	UMYExpl.exe
616	tjFkKOP.exe
2124	paAFpES.exe
2440	fUCtrMm.exe
1484	iiYxWXO.exe
1912	PQjnChC.exe
1856	FQYTfzk.exe
536	eEgMtKx.exe
1956	oyKboSp.exe
1592	FERVmUY.exe
2728	psCynAH.exe
2128	zUuyjLn.exe
2796	RjfDtKk.exe
2752	lcFNxuJ.exe
2640	yPcKdVD.exe
3064	KMUtgFU.exe
1936	BfEDquT.exe
2808	JoUxAiO.exe
2848	RYsLEhP.exe
1672	WjBmVll.exe
1668	brmxDbc.exe
2960	lCwoucG.exe
2932	lrEPlsu.exe

Loads dropped DLL 64 IoCs

pid	Process
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-0-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/files/0x00090000000120ff-6.dat	upx
behavioral1/files/0x0033000000016c56-12.dat	upx
behavioral1/memory/2204-14-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/files/0x0008000000016ce7-25.dat	upx
behavioral1/files/0x0007000000004e76-30.dat	upx
behavioral1/files/0x0008000000016d3d-35.dat	upx
behavioral1/files/0x0007000000016d45-39.dat	upx
behavioral1/files/0x0007000000016d4e-45.dat	upx
behavioral1/files/0x0008000000016d65-49.dat	upx
behavioral1/files/0x00050000000186ff-69.dat	upx
behavioral1/files/0x0006000000018bf0-94.dat	upx
behavioral1/files/0x0005000000019228-99.dat	upx
behavioral1/files/0x0005000000019462-162.dat	upx
behavioral1/files/0x000500000001943e-156.dat	upx
behavioral1/files/0x00050000000193b1-147.dat	upx
behavioral1/files/0x000500000001939f-140.dat	upx
behavioral1/files/0x000500000001933a-132.dat	upx
behavioral1/files/0x0005000000019277-123.dat	upx
behavioral1/files/0x000500000001925d-109.dat	upx
behavioral1/files/0x0005000000019260-115.dat	upx
behavioral1/files/0x000500000001923b-104.dat	upx
behavioral1/files/0x000500000001878d-89.dat	upx
behavioral1/files/0x0005000000018787-84.dat	upx
behavioral1/files/0x000500000001873f-79.dat	upx
behavioral1/files/0x0005000000018739-74.dat	upx
behavioral1/files/0x00050000000186f1-64.dat	upx
behavioral1/files/0x00050000000186e6-59.dat	upx
behavioral1/files/0x0005000000018686-54.dat	upx
behavioral1/files/0x0005000000019433-170.dat	upx
behavioral1/memory/2916-226-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/2648-259-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/memory/2772-264-0x000000013F840000-0x000000013FC36000-memory.dmp	upx
behavioral1/memory/2548-256-0x000000013F5B0000-0x000000013F9A6000-memory.dmp	upx
behavioral1/memory/2748-251-0x000000013F640000-0x000000013FA36000-memory.dmp	upx
behavioral1/memory/2700-237-0x000000013F950000-0x000000013FD46000-memory.dmp	upx
behavioral1/memory/2780-215-0x000000013FC90000-0x0000000140086000-memory.dmp	upx
behavioral1/memory/2944-222-0x000000013FC70000-0x0000000140066000-memory.dmp	upx
behavioral1/memory/2636-208-0x000000013F8E0000-0x000000013FCD6000-memory.dmp	upx
behavioral1/memory/2764-203-0x000000013F4C0000-0x000000013F8B6000-memory.dmp	upx
behavioral1/files/0x0005000000019457-159.dat	upx
behavioral1/files/0x00050000000193a5-143.dat	upx
behavioral1/files/0x0005000000019381-135.dat	upx
behavioral1/files/0x0005000000019283-127.dat	upx
behavioral1/files/0x0005000000019275-118.dat	upx
behavioral1/memory/1984-15-0x000000013F120000-0x000000013F516000-memory.dmp	upx
behavioral1/memory/2476-2552-0x000000013FBB0000-0x000000013FFA6000-memory.dmp	upx
behavioral1/memory/2916-4208-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/memory/2748-4209-0x000000013F640000-0x000000013FA36000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SQOUHTW.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\gKxyOxr.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\XTMfaFa.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\qIIkntx.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\kcfmGhd.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\PcQbpve.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\KtrhepD.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\TAhyvIS.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\Hyrmafj.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\atFrOHF.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\nlqFbcZ.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\uGioWio.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\JilxkWH.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\IcmrcsZ.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\Heumvlm.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\kWNOisZ.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\KKgzIqD.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\VCgsImR.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\gwkFtOw.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\BWKmbpt.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\hvUtuur.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\JekTGnd.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\dmMEKSJ.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\sFEOkGO.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\finZxii.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZktglpP.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\Ekelqop.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\FVCMsrR.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\pcABJvp.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\TnraKFv.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\DCMXfRK.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\JTCTPfd.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\awXoIUq.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZKmpKep.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\AMDCZTi.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\FvjEAJg.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\okYlzOa.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\fZJChKq.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\iRCIAYU.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\nEOKwJH.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\QxKtzkZ.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\cbOZYyl.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\gRxcMdJ.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\eXnagHj.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\GtekkcB.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\YUukcLC.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\cwgVqKN.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\TmlAyaU.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\duuAkkU.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\ToOyheN.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\DZUHWus.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\TmRUaIv.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\KLsZGhv.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\skYtbBh.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\OyrVlli.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\Kxrhcqu.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\QlpdTNq.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\oWioNzM.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\gBrAUSK.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\NGwwSAy.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\NNusAPj.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\PlADKko.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\wNCaUUa.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
File created	C:\Windows\System\TGalThX.exe	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2136	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeLockMemoryPrivilege	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2136	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2136	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2136	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	29
PID 2476 wrote to memory of 2204	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	30
PID 2476 wrote to memory of 2204	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	30
PID 2476 wrote to memory of 2204	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	30
PID 2476 wrote to memory of 1984	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	31
PID 2476 wrote to memory of 1984	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	31
PID 2476 wrote to memory of 1984	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	31
PID 2476 wrote to memory of 2764	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 2764	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 2764	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	32
PID 2476 wrote to memory of 2636	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 2636	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 2636	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	33
PID 2476 wrote to memory of 2780	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	34
PID 2476 wrote to memory of 2780	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	34
PID 2476 wrote to memory of 2780	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	34
PID 2476 wrote to memory of 2944	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	35
PID 2476 wrote to memory of 2944	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	35
PID 2476 wrote to memory of 2944	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	35
PID 2476 wrote to memory of 2916	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	36
PID 2476 wrote to memory of 2916	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	36
PID 2476 wrote to memory of 2916	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	36
PID 2476 wrote to memory of 2700	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	37
PID 2476 wrote to memory of 2700	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	37
PID 2476 wrote to memory of 2700	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	37
PID 2476 wrote to memory of 2748	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	38
PID 2476 wrote to memory of 2748	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	38
PID 2476 wrote to memory of 2748	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	38
PID 2476 wrote to memory of 2548	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 2548	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 2548	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	39
PID 2476 wrote to memory of 2648	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	40
PID 2476 wrote to memory of 2648	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	40
PID 2476 wrote to memory of 2648	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	40
PID 2476 wrote to memory of 2772	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 2772	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 2772	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	41
PID 2476 wrote to memory of 300	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	42
PID 2476 wrote to memory of 300	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	42
PID 2476 wrote to memory of 300	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	42
PID 2476 wrote to memory of 1896	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	43
PID 2476 wrote to memory of 1896	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	43
PID 2476 wrote to memory of 1896	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	43
PID 2476 wrote to memory of 2844	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	44
PID 2476 wrote to memory of 2844	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	44
PID 2476 wrote to memory of 2844	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	44
PID 2476 wrote to memory of 2852	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	45
PID 2476 wrote to memory of 2852	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	45
PID 2476 wrote to memory of 2852	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	45
PID 2476 wrote to memory of 2828	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	46
PID 2476 wrote to memory of 2828	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	46
PID 2476 wrote to memory of 2828	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	46
PID 2476 wrote to memory of 2260	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	47
PID 2476 wrote to memory of 2260	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	47
PID 2476 wrote to memory of 2260	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	47
PID 2476 wrote to memory of 1800	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	48
PID 2476 wrote to memory of 1800	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	48
PID 2476 wrote to memory of 1800	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	48
PID 2476 wrote to memory of 1332	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	49
PID 2476 wrote to memory of 1332	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	49
PID 2476 wrote to memory of 1332	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	49
PID 2476 wrote to memory of 808	2476	643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\643bb4505bac37dccb0a24959b7008d0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System\RFQUnDd.exe
  C:\Windows\System\RFQUnDd.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\CdCYIxv.exe
  C:\Windows\System\CdCYIxv.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\SQUCqOw.exe
  C:\Windows\System\SQUCqOw.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ooMoFWb.exe
  C:\Windows\System\ooMoFWb.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\SGGLxQs.exe
  C:\Windows\System\SGGLxQs.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\rAgaYEV.exe
  C:\Windows\System\rAgaYEV.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\xZQLTZI.exe
  C:\Windows\System\xZQLTZI.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\dZMxjvo.exe
  C:\Windows\System\dZMxjvo.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\gNstuiz.exe
  C:\Windows\System\gNstuiz.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\mktDyhY.exe
  C:\Windows\System\mktDyhY.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ICSunjr.exe
  C:\Windows\System\ICSunjr.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\GaAXQbv.exe
  C:\Windows\System\GaAXQbv.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\eDqzRCQ.exe
  C:\Windows\System\eDqzRCQ.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\lQrvMTc.exe
  C:\Windows\System\lQrvMTc.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\AnCTfYT.exe
  C:\Windows\System\AnCTfYT.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\nWZAYid.exe
  C:\Windows\System\nWZAYid.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\DUfhabe.exe
  C:\Windows\System\DUfhabe.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\biqmfyY.exe
  C:\Windows\System\biqmfyY.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\jpCpdSy.exe
  C:\Windows\System\jpCpdSy.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\iISdxzn.exe
  C:\Windows\System\iISdxzn.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\TjJDRVF.exe
  C:\Windows\System\TjJDRVF.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\lprDNiV.exe
  C:\Windows\System\lprDNiV.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\KtvZFzb.exe
  C:\Windows\System\KtvZFzb.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\nctAKGm.exe
  C:\Windows\System\nctAKGm.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\FzxRYre.exe
  C:\Windows\System\FzxRYre.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\Tbympsk.exe
  C:\Windows\System\Tbympsk.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\eJQENog.exe
  C:\Windows\System\eJQENog.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\eaxjwTT.exe
  C:\Windows\System\eaxjwTT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\mIwnjNw.exe
  C:\Windows\System\mIwnjNw.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\dFEGDoa.exe
  C:\Windows\System\dFEGDoa.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\nlEPcRm.exe
  C:\Windows\System\nlEPcRm.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\FDjhHGH.exe
  C:\Windows\System\FDjhHGH.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\wJWiZli.exe
  C:\Windows\System\wJWiZli.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\dlcGHmk.exe
  C:\Windows\System\dlcGHmk.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\PbGVwLP.exe
  C:\Windows\System\PbGVwLP.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\RogIQqJ.exe
  C:\Windows\System\RogIQqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\MIRNKmZ.exe
  C:\Windows\System\MIRNKmZ.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\kTFKFJH.exe
  C:\Windows\System\kTFKFJH.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\PBiKWwa.exe
  C:\Windows\System\PBiKWwa.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\sitmypn.exe
  C:\Windows\System\sitmypn.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\xxEuzrr.exe
  C:\Windows\System\xxEuzrr.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\tjFkKOP.exe
  C:\Windows\System\tjFkKOP.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\UMYExpl.exe
  C:\Windows\System\UMYExpl.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\paAFpES.exe
  C:\Windows\System\paAFpES.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\fUCtrMm.exe
  C:\Windows\System\fUCtrMm.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\iiYxWXO.exe
  C:\Windows\System\iiYxWXO.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\PQjnChC.exe
  C:\Windows\System\PQjnChC.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\eEgMtKx.exe
  C:\Windows\System\eEgMtKx.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\FQYTfzk.exe
  C:\Windows\System\FQYTfzk.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\FERVmUY.exe
  C:\Windows\System\FERVmUY.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\oyKboSp.exe
  C:\Windows\System\oyKboSp.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\zUuyjLn.exe
  C:\Windows\System\zUuyjLn.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\psCynAH.exe
  C:\Windows\System\psCynAH.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\RjfDtKk.exe
  C:\Windows\System\RjfDtKk.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\lcFNxuJ.exe
  C:\Windows\System\lcFNxuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\yPcKdVD.exe
  C:\Windows\System\yPcKdVD.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\KMUtgFU.exe
  C:\Windows\System\KMUtgFU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\BfEDquT.exe
  C:\Windows\System\BfEDquT.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\JoUxAiO.exe
  C:\Windows\System\JoUxAiO.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\RYsLEhP.exe
  C:\Windows\System\RYsLEhP.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\WjBmVll.exe
  C:\Windows\System\WjBmVll.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\brmxDbc.exe
  C:\Windows\System\brmxDbc.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\lCwoucG.exe
  C:\Windows\System\lCwoucG.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\lrEPlsu.exe
  C:\Windows\System\lrEPlsu.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\BRDGbti.exe
  C:\Windows\System\BRDGbti.exe
  2⤵
  PID:1744
- C:\Windows\System\jLJMSnl.exe
  C:\Windows\System\jLJMSnl.exe
  2⤵
  PID:2016
- C:\Windows\System\MjPQuQt.exe
  C:\Windows\System\MjPQuQt.exe
  2⤵
  PID:316
- C:\Windows\System\ODrGVRL.exe
  C:\Windows\System\ODrGVRL.exe
  2⤵
  PID:2468
- C:\Windows\System\sotVVXt.exe
  C:\Windows\System\sotVVXt.exe
  2⤵
  PID:1524
- C:\Windows\System\IxpwGNY.exe
  C:\Windows\System\IxpwGNY.exe
  2⤵
  PID:3060
- C:\Windows\System\XHhhSNX.exe
  C:\Windows\System\XHhhSNX.exe
  2⤵
  PID:2280
- C:\Windows\System\ZbkpvFO.exe
  C:\Windows\System\ZbkpvFO.exe
  2⤵
  PID:2296
- C:\Windows\System\DhvmkXr.exe
  C:\Windows\System\DhvmkXr.exe
  2⤵
  PID:1904
- C:\Windows\System\XuuvDsb.exe
  C:\Windows\System\XuuvDsb.exe
  2⤵
  PID:880
- C:\Windows\System\LXowzXp.exe
  C:\Windows\System\LXowzXp.exe
  2⤵
  PID:2332
- C:\Windows\System\fgdwIta.exe
  C:\Windows\System\fgdwIta.exe
  2⤵
  PID:776
- C:\Windows\System\DjdIpmW.exe
  C:\Windows\System\DjdIpmW.exe
  2⤵
  PID:3024
- C:\Windows\System\QlvOcqc.exe
  C:\Windows\System\QlvOcqc.exe
  2⤵
  PID:1788
- C:\Windows\System\vHtrzVW.exe
  C:\Windows\System\vHtrzVW.exe
  2⤵
  PID:2044
- C:\Windows\System\Ssjqfgs.exe
  C:\Windows\System\Ssjqfgs.exe
  2⤵
  PID:1608
- C:\Windows\System\fIOeqQv.exe
  C:\Windows\System\fIOeqQv.exe
  2⤵
  PID:1736
- C:\Windows\System\hDwjSJG.exe
  C:\Windows\System\hDwjSJG.exe
  2⤵
  PID:2008
- C:\Windows\System\fIGKcTI.exe
  C:\Windows\System\fIGKcTI.exe
  2⤵
  PID:752
- C:\Windows\System\ZNrvPbc.exe
  C:\Windows\System\ZNrvPbc.exe
  2⤵
  PID:108
- C:\Windows\System\cPfapJm.exe
  C:\Windows\System\cPfapJm.exe
  2⤵
  PID:2664
- C:\Windows\System\yXzbjhz.exe
  C:\Windows\System\yXzbjhz.exe
  2⤵
  PID:1032
- C:\Windows\System\RoDDJLP.exe
  C:\Windows\System\RoDDJLP.exe
  2⤵
  PID:2344
- C:\Windows\System\skJlUpQ.exe
  C:\Windows\System\skJlUpQ.exe
  2⤵
  PID:1960
- C:\Windows\System\NvYKsUS.exe
  C:\Windows\System\NvYKsUS.exe
  2⤵
  PID:328
- C:\Windows\System\dIAIFmc.exe
  C:\Windows\System\dIAIFmc.exe
  2⤵
  PID:2068
- C:\Windows\System\FGjsgmY.exe
  C:\Windows\System\FGjsgmY.exe
  2⤵
  PID:2724
- C:\Windows\System\cWeSydz.exe
  C:\Windows\System\cWeSydz.exe
  2⤵
  PID:2736
- C:\Windows\System\LGaUQeP.exe
  C:\Windows\System\LGaUQeP.exe
  2⤵
  PID:1336
- C:\Windows\System\gTNwEPb.exe
  C:\Windows\System\gTNwEPb.exe
  2⤵
  PID:2564
- C:\Windows\System\OOOacNR.exe
  C:\Windows\System\OOOacNR.exe
  2⤵
  PID:2592
- C:\Windows\System\wrXvaRo.exe
  C:\Windows\System\wrXvaRo.exe
  2⤵
  PID:2784
- C:\Windows\System\mPSjYzh.exe
  C:\Windows\System\mPSjYzh.exe
  2⤵
  PID:1776
- C:\Windows\System\FvAOdUV.exe
  C:\Windows\System\FvAOdUV.exe
  2⤵
  PID:2936
- C:\Windows\System\EpWMzSq.exe
  C:\Windows\System\EpWMzSq.exe
  2⤵
  PID:2208
- C:\Windows\System\pWspKdi.exe
  C:\Windows\System\pWspKdi.exe
  2⤵
  PID:2236
- C:\Windows\System\WMnRgYb.exe
  C:\Windows\System\WMnRgYb.exe
  2⤵
  PID:1092
- C:\Windows\System\jLnqCuj.exe
  C:\Windows\System\jLnqCuj.exe
  2⤵
  PID:1512
- C:\Windows\System\tQxVVeh.exe
  C:\Windows\System\tQxVVeh.exe
  2⤵
  PID:2064
- C:\Windows\System\YUejCQP.exe
  C:\Windows\System\YUejCQP.exe
  2⤵
  PID:2168
- C:\Windows\System\IRyxGFi.exe
  C:\Windows\System\IRyxGFi.exe
  2⤵
  PID:1664
- C:\Windows\System\yOayZAC.exe
  C:\Windows\System\yOayZAC.exe
  2⤵
  PID:3016
- C:\Windows\System\LXSoXbY.exe
  C:\Windows\System\LXSoXbY.exe
  2⤵
  PID:1256
- C:\Windows\System\XhQzCbl.exe
  C:\Windows\System\XhQzCbl.exe
  2⤵
  PID:1196
- C:\Windows\System\PQKKLMC.exe
  C:\Windows\System\PQKKLMC.exe
  2⤵
  PID:284
- C:\Windows\System\RXKFLEa.exe
  C:\Windows\System\RXKFLEa.exe
  2⤵
  PID:2988
- C:\Windows\System\TnzSNNP.exe
  C:\Windows\System\TnzSNNP.exe
  2⤵
  PID:1740
- C:\Windows\System\aQBwyrr.exe
  C:\Windows\System\aQBwyrr.exe
  2⤵
  PID:2388
- C:\Windows\System\fyDTOoC.exe
  C:\Windows\System\fyDTOoC.exe
  2⤵
  PID:968
- C:\Windows\System\ipEqVDx.exe
  C:\Windows\System\ipEqVDx.exe
  2⤵
  PID:2364
- C:\Windows\System\LmrgaHt.exe
  C:\Windows\System\LmrgaHt.exe
  2⤵
  PID:2116
- C:\Windows\System\UkDUVvy.exe
  C:\Windows\System\UkDUVvy.exe
  2⤵
  PID:2456
- C:\Windows\System\ntHaZCU.exe
  C:\Windows\System\ntHaZCU.exe
  2⤵
  PID:352
- C:\Windows\System\bMLqrpD.exe
  C:\Windows\System\bMLqrpD.exe
  2⤵
  PID:3032
- C:\Windows\System\gExImHY.exe
  C:\Windows\System\gExImHY.exe
  2⤵
  PID:2824
- C:\Windows\System\RjwAeyc.exe
  C:\Windows\System\RjwAeyc.exe
  2⤵
  PID:2864
- C:\Windows\System\OVqjhMH.exe
  C:\Windows\System\OVqjhMH.exe
  2⤵
  PID:1652
- C:\Windows\System\QqFzbGz.exe
  C:\Windows\System\QqFzbGz.exe
  2⤵
  PID:3076
- C:\Windows\System\GrKkUna.exe
  C:\Windows\System\GrKkUna.exe
  2⤵
  PID:3096
- C:\Windows\System\UhAsrQD.exe
  C:\Windows\System\UhAsrQD.exe
  2⤵
  PID:3116
- C:\Windows\System\HpsgWCS.exe
  C:\Windows\System\HpsgWCS.exe
  2⤵
  PID:3136
- C:\Windows\System\eJBgtPM.exe
  C:\Windows\System\eJBgtPM.exe
  2⤵
  PID:3156
- C:\Windows\System\OBmRRrz.exe
  C:\Windows\System\OBmRRrz.exe
  2⤵
  PID:3172
- C:\Windows\System\JUUDKdF.exe
  C:\Windows\System\JUUDKdF.exe
  2⤵
  PID:3196
- C:\Windows\System\xhDOUSy.exe
  C:\Windows\System\xhDOUSy.exe
  2⤵
  PID:3216
- C:\Windows\System\HRucUpU.exe
  C:\Windows\System\HRucUpU.exe
  2⤵
  PID:3236
- C:\Windows\System\rljjdQm.exe
  C:\Windows\System\rljjdQm.exe
  2⤵
  PID:3256
- C:\Windows\System\zQHyfHp.exe
  C:\Windows\System\zQHyfHp.exe
  2⤵
  PID:3276
- C:\Windows\System\MVbYFTf.exe
  C:\Windows\System\MVbYFTf.exe
  2⤵
  PID:3292
- C:\Windows\System\kwKzpxh.exe
  C:\Windows\System\kwKzpxh.exe
  2⤵
  PID:3312
- C:\Windows\System\NKmWPEN.exe
  C:\Windows\System\NKmWPEN.exe
  2⤵
  PID:3336
- C:\Windows\System\YkaCXBN.exe
  C:\Windows\System\YkaCXBN.exe
  2⤵
  PID:3356
- C:\Windows\System\RxUawPN.exe
  C:\Windows\System\RxUawPN.exe
  2⤵
  PID:3372
- C:\Windows\System\pWuTgNG.exe
  C:\Windows\System\pWuTgNG.exe
  2⤵
  PID:3396
- C:\Windows\System\ToRXXUx.exe
  C:\Windows\System\ToRXXUx.exe
  2⤵
  PID:3416
- C:\Windows\System\QgDOqCR.exe
  C:\Windows\System\QgDOqCR.exe
  2⤵
  PID:3436
- C:\Windows\System\qOyJdby.exe
  C:\Windows\System\qOyJdby.exe
  2⤵
  PID:3456
- C:\Windows\System\yygjGYH.exe
  C:\Windows\System\yygjGYH.exe
  2⤵
  PID:3476
- C:\Windows\System\JwsoElR.exe
  C:\Windows\System\JwsoElR.exe
  2⤵
  PID:3496
- C:\Windows\System\DinwJPT.exe
  C:\Windows\System\DinwJPT.exe
  2⤵
  PID:3516
- C:\Windows\System\npVZsHG.exe
  C:\Windows\System\npVZsHG.exe
  2⤵
  PID:3532
- C:\Windows\System\FvJMNMx.exe
  C:\Windows\System\FvJMNMx.exe
  2⤵
  PID:3552
- C:\Windows\System\xDgkWmw.exe
  C:\Windows\System\xDgkWmw.exe
  2⤵
  PID:3576
- C:\Windows\System\oQsUrOs.exe
  C:\Windows\System\oQsUrOs.exe
  2⤵
  PID:3596
- C:\Windows\System\rSEIBBj.exe
  C:\Windows\System\rSEIBBj.exe
  2⤵
  PID:3616
- C:\Windows\System\WCsoTUM.exe
  C:\Windows\System\WCsoTUM.exe
  2⤵
  PID:3636
- C:\Windows\System\QQtXHuN.exe
  C:\Windows\System\QQtXHuN.exe
  2⤵
  PID:3656
- C:\Windows\System\mgDnwyb.exe
  C:\Windows\System\mgDnwyb.exe
  2⤵
  PID:3676
- C:\Windows\System\NZdtlgl.exe
  C:\Windows\System\NZdtlgl.exe
  2⤵
  PID:3696
- C:\Windows\System\pckGXZV.exe
  C:\Windows\System\pckGXZV.exe
  2⤵
  PID:3716
- C:\Windows\System\vKwkVVl.exe
  C:\Windows\System\vKwkVVl.exe
  2⤵
  PID:3732
- C:\Windows\System\XjgcZGS.exe
  C:\Windows\System\XjgcZGS.exe
  2⤵
  PID:3752
- C:\Windows\System\TkjSxhS.exe
  C:\Windows\System\TkjSxhS.exe
  2⤵
  PID:3768
- C:\Windows\System\Tlupgly.exe
  C:\Windows\System\Tlupgly.exe
  2⤵
  PID:3792
- C:\Windows\System\NnpiicU.exe
  C:\Windows\System\NnpiicU.exe
  2⤵
  PID:3808
- C:\Windows\System\QvSNYYL.exe
  C:\Windows\System\QvSNYYL.exe
  2⤵
  PID:3828
- C:\Windows\System\cPOXUzS.exe
  C:\Windows\System\cPOXUzS.exe
  2⤵
  PID:3844
- C:\Windows\System\kYLmfKu.exe
  C:\Windows\System\kYLmfKu.exe
  2⤵
  PID:3876
- C:\Windows\System\uDcWGeR.exe
  C:\Windows\System\uDcWGeR.exe
  2⤵
  PID:3892
- C:\Windows\System\TBEQLXm.exe
  C:\Windows\System\TBEQLXm.exe
  2⤵
  PID:3916
- C:\Windows\System\nzhJWqp.exe
  C:\Windows\System\nzhJWqp.exe
  2⤵
  PID:3932
- C:\Windows\System\poIVwep.exe
  C:\Windows\System\poIVwep.exe
  2⤵
  PID:3952
- C:\Windows\System\DTAnzyW.exe
  C:\Windows\System\DTAnzyW.exe
  2⤵
  PID:3972
- C:\Windows\System\BEmTegY.exe
  C:\Windows\System\BEmTegY.exe
  2⤵
  PID:3996
- C:\Windows\System\mepJzXH.exe
  C:\Windows\System\mepJzXH.exe
  2⤵
  PID:4012
- C:\Windows\System\NVRtsfm.exe
  C:\Windows\System\NVRtsfm.exe
  2⤵
  PID:4032
- C:\Windows\System\EtCQhPI.exe
  C:\Windows\System\EtCQhPI.exe
  2⤵
  PID:4048
- C:\Windows\System\YOQuNyu.exe
  C:\Windows\System\YOQuNyu.exe
  2⤵
  PID:4068
- C:\Windows\System\FOtzDig.exe
  C:\Windows\System\FOtzDig.exe
  2⤵
  PID:4088
- C:\Windows\System\WBtAqDw.exe
  C:\Windows\System\WBtAqDw.exe
  2⤵
  PID:1980
- C:\Windows\System\AKXLhxv.exe
  C:\Windows\System\AKXLhxv.exe
  2⤵
  PID:1324
- C:\Windows\System\HjFRyNr.exe
  C:\Windows\System\HjFRyNr.exe
  2⤵
  PID:1160
- C:\Windows\System\dSbtHbr.exe
  C:\Windows\System\dSbtHbr.exe
  2⤵
  PID:2108
- C:\Windows\System\hFWDXPm.exe
  C:\Windows\System\hFWDXPm.exe
  2⤵
  PID:308
- C:\Windows\System\UsGKcqH.exe
  C:\Windows\System\UsGKcqH.exe
  2⤵
  PID:3068
- C:\Windows\System\hBwvjNf.exe
  C:\Windows\System\hBwvjNf.exe
  2⤵
  PID:932
- C:\Windows\System\XijWzVh.exe
  C:\Windows\System\XijWzVh.exe
  2⤵
  PID:2412
- C:\Windows\System\lRofeDt.exe
  C:\Windows\System\lRofeDt.exe
  2⤵
  PID:2516
- C:\Windows\System\jxcNpTm.exe
  C:\Windows\System\jxcNpTm.exe
  2⤵
  PID:1556
- C:\Windows\System\zvsxTDR.exe
  C:\Windows\System\zvsxTDR.exe
  2⤵
  PID:1932
- C:\Windows\System\ZQRXohN.exe
  C:\Windows\System\ZQRXohN.exe
  2⤵
  PID:3112
- C:\Windows\System\IcVYbEd.exe
  C:\Windows\System\IcVYbEd.exe
  2⤵
  PID:3144
- C:\Windows\System\MpTeIln.exe
  C:\Windows\System\MpTeIln.exe
  2⤵
  PID:3128
- C:\Windows\System\NCYPjGB.exe
  C:\Windows\System\NCYPjGB.exe
  2⤵
  PID:3168
- C:\Windows\System\RHHuyNc.exe
  C:\Windows\System\RHHuyNc.exe
  2⤵
  PID:3204
- C:\Windows\System\tcEipHX.exe
  C:\Windows\System\tcEipHX.exe
  2⤵
  PID:3252
- C:\Windows\System\GYNkqqH.exe
  C:\Windows\System\GYNkqqH.exe
  2⤵
  PID:3308
- C:\Windows\System\hhermbf.exe
  C:\Windows\System\hhermbf.exe
  2⤵
  PID:3380
- C:\Windows\System\lHIZrSM.exe
  C:\Windows\System\lHIZrSM.exe
  2⤵
  PID:3288
- C:\Windows\System\kpCYBEj.exe
  C:\Windows\System\kpCYBEj.exe
  2⤵
  PID:3424
- C:\Windows\System\YaXVskP.exe
  C:\Windows\System\YaXVskP.exe
  2⤵
  PID:3364
- C:\Windows\System\HpDgCBC.exe
  C:\Windows\System\HpDgCBC.exe
  2⤵
  PID:3408
- C:\Windows\System\BKsaNxZ.exe
  C:\Windows\System\BKsaNxZ.exe
  2⤵
  PID:3504
- C:\Windows\System\QYgonYp.exe
  C:\Windows\System\QYgonYp.exe
  2⤵
  PID:3488
- C:\Windows\System\TPsUBOJ.exe
  C:\Windows\System\TPsUBOJ.exe
  2⤵
  PID:3592
- C:\Windows\System\HEzjTVl.exe
  C:\Windows\System\HEzjTVl.exe
  2⤵
  PID:3564
- C:\Windows\System\IntriGS.exe
  C:\Windows\System\IntriGS.exe
  2⤵
  PID:3668
- C:\Windows\System\JKQnVPe.exe
  C:\Windows\System\JKQnVPe.exe
  2⤵
  PID:3608
- C:\Windows\System\cwgVqKN.exe
  C:\Windows\System\cwgVqKN.exe
  2⤵
  PID:3708
- C:\Windows\System\VZxryvm.exe
  C:\Windows\System\VZxryvm.exe
  2⤵
  PID:3780
- C:\Windows\System\XsWeEtp.exe
  C:\Windows\System\XsWeEtp.exe
  2⤵
  PID:3824
- C:\Windows\System\nVBvaiE.exe
  C:\Windows\System\nVBvaiE.exe
  2⤵
  PID:3652
- C:\Windows\System\DuhgAUW.exe
  C:\Windows\System\DuhgAUW.exe
  2⤵
  PID:3692
- C:\Windows\System\NDuiAUr.exe
  C:\Windows\System\NDuiAUr.exe
  2⤵
  PID:3904
- C:\Windows\System\LwlCjiw.exe
  C:\Windows\System\LwlCjiw.exe
  2⤵
  PID:3804
- C:\Windows\System\ySMZnhw.exe
  C:\Windows\System\ySMZnhw.exe
  2⤵
  PID:3944
- C:\Windows\System\pJRhAlQ.exe
  C:\Windows\System\pJRhAlQ.exe
  2⤵
  PID:3988
- C:\Windows\System\vUFmBhH.exe
  C:\Windows\System\vUFmBhH.exe
  2⤵
  PID:4060
- C:\Windows\System\oJfuljY.exe
  C:\Windows\System\oJfuljY.exe
  2⤵
  PID:3928
- C:\Windows\System\mCZItSA.exe
  C:\Windows\System\mCZItSA.exe
  2⤵
  PID:3964
- C:\Windows\System\SiXaXLj.exe
  C:\Windows\System\SiXaXLj.exe
  2⤵
  PID:2504
- C:\Windows\System\GnfoxYz.exe
  C:\Windows\System\GnfoxYz.exe
  2⤵
  PID:1580
- C:\Windows\System\wZCisvT.exe
  C:\Windows\System\wZCisvT.exe
  2⤵
  PID:4080
- C:\Windows\System\CMkkqpe.exe
  C:\Windows\System\CMkkqpe.exe
  2⤵
  PID:2576
- C:\Windows\System\yKBNvKy.exe
  C:\Windows\System\yKBNvKy.exe
  2⤵
  PID:3040
- C:\Windows\System\ASewCiY.exe
  C:\Windows\System\ASewCiY.exe
  2⤵
  PID:1900
- C:\Windows\System\MBfAloq.exe
  C:\Windows\System\MBfAloq.exe
  2⤵
  PID:1700
- C:\Windows\System\NVjYYOg.exe
  C:\Windows\System\NVjYYOg.exe
  2⤵
  PID:1636
- C:\Windows\System\DVMUNKo.exe
  C:\Windows\System\DVMUNKo.exe
  2⤵
  PID:3092
- C:\Windows\System\NxwsPZm.exe
  C:\Windows\System\NxwsPZm.exe
  2⤵
  PID:3184
- C:\Windows\System\lLTwlbZ.exe
  C:\Windows\System\lLTwlbZ.exe
  2⤵
  PID:3188
- C:\Windows\System\PAoigaw.exe
  C:\Windows\System\PAoigaw.exe
  2⤵
  PID:3228
- C:\Windows\System\GDMVZyh.exe
  C:\Windows\System\GDMVZyh.exe
  2⤵
  PID:3352
- C:\Windows\System\yBBFVMM.exe
  C:\Windows\System\yBBFVMM.exe
  2⤵
  PID:3332
- C:\Windows\System\dVFlbGk.exe
  C:\Windows\System\dVFlbGk.exe
  2⤵
  PID:3404
- C:\Windows\System\KKzVxQj.exe
  C:\Windows\System\KKzVxQj.exe
  2⤵
  PID:3468
- C:\Windows\System\EcdziOC.exe
  C:\Windows\System\EcdziOC.exe
  2⤵
  PID:3540
- C:\Windows\System\XYUIZdy.exe
  C:\Windows\System\XYUIZdy.exe
  2⤵
  PID:3584
- C:\Windows\System\hocgNoj.exe
  C:\Windows\System\hocgNoj.exe
  2⤵
  PID:3604
- C:\Windows\System\minPyMn.exe
  C:\Windows\System\minPyMn.exe
  2⤵
  PID:3744
- C:\Windows\System\TDRJOos.exe
  C:\Windows\System\TDRJOos.exe
  2⤵
  PID:3856
- C:\Windows\System\cPAwKMu.exe
  C:\Windows\System\cPAwKMu.exe
  2⤵
  PID:3816
- C:\Windows\System\BYSMOZa.exe
  C:\Windows\System\BYSMOZa.exe
  2⤵
  PID:3872
- C:\Windows\System\IpJQmuk.exe
  C:\Windows\System\IpJQmuk.exe
  2⤵
  PID:3764
- C:\Windows\System\ETTlDDl.exe
  C:\Windows\System\ETTlDDl.exe
  2⤵
  PID:4024
- C:\Windows\System\LGLpugn.exe
  C:\Windows\System\LGLpugn.exe
  2⤵
  PID:1988
- C:\Windows\System\GLLyNNq.exe
  C:\Windows\System\GLLyNNq.exe
  2⤵
  PID:3888
- C:\Windows\System\JsPYhJs.exe
  C:\Windows\System\JsPYhJs.exe
  2⤵
  PID:4044
- C:\Windows\System\vlhbpGp.exe
  C:\Windows\System\vlhbpGp.exe
  2⤵
  PID:2820
- C:\Windows\System\lAqdkDj.exe
  C:\Windows\System\lAqdkDj.exe
  2⤵
  PID:2096
- C:\Windows\System\JSirAyv.exe
  C:\Windows\System\JSirAyv.exe
  2⤵
  PID:1756
- C:\Windows\System\TguNWVW.exe
  C:\Windows\System\TguNWVW.exe
  2⤵
  PID:3104
- C:\Windows\System\RbFtNin.exe
  C:\Windows\System\RbFtNin.exe
  2⤵
  PID:2840
- C:\Windows\System\iRGnrpD.exe
  C:\Windows\System\iRGnrpD.exe
  2⤵
  PID:3304
- C:\Windows\System\ooIxkmu.exe
  C:\Windows\System\ooIxkmu.exe
  2⤵
  PID:3412
- C:\Windows\System\DpEksWG.exe
  C:\Windows\System\DpEksWG.exe
  2⤵
  PID:3348
- C:\Windows\System\kKqkDgF.exe
  C:\Windows\System\kKqkDgF.exe
  2⤵
  PID:3544
- C:\Windows\System\HVIUxsi.exe
  C:\Windows\System\HVIUxsi.exe
  2⤵
  PID:3748
- C:\Windows\System\lrvoSdi.exe
  C:\Windows\System\lrvoSdi.exe
  2⤵
  PID:3524
- C:\Windows\System\fVEOKGQ.exe
  C:\Windows\System\fVEOKGQ.exe
  2⤵
  PID:3712
- C:\Windows\System\iNFiQrF.exe
  C:\Windows\System\iNFiQrF.exe
  2⤵
  PID:3940
- C:\Windows\System\gqnkSeK.exe
  C:\Windows\System\gqnkSeK.exe
  2⤵
  PID:3984
- C:\Windows\System\gbhqHex.exe
  C:\Windows\System\gbhqHex.exe
  2⤵
  PID:4108
- C:\Windows\System\mZAMylL.exe
  C:\Windows\System\mZAMylL.exe
  2⤵
  PID:4128
- C:\Windows\System\vyckSJa.exe
  C:\Windows\System\vyckSJa.exe
  2⤵
  PID:4148
- C:\Windows\System\LUgAbJB.exe
  C:\Windows\System\LUgAbJB.exe
  2⤵
  PID:4168
- C:\Windows\System\Yajkcvc.exe
  C:\Windows\System\Yajkcvc.exe
  2⤵
  PID:4188
- C:\Windows\System\ItLgCyz.exe
  C:\Windows\System\ItLgCyz.exe
  2⤵
  PID:4208
- C:\Windows\System\MoOxVPk.exe
  C:\Windows\System\MoOxVPk.exe
  2⤵
  PID:4228
- C:\Windows\System\NsWzCTZ.exe
  C:\Windows\System\NsWzCTZ.exe
  2⤵
  PID:4248
- C:\Windows\System\FueTBsp.exe
  C:\Windows\System\FueTBsp.exe
  2⤵
  PID:4268
- C:\Windows\System\DNZIZyD.exe
  C:\Windows\System\DNZIZyD.exe
  2⤵
  PID:4288
- C:\Windows\System\XaGfFVu.exe
  C:\Windows\System\XaGfFVu.exe
  2⤵
  PID:4308
- C:\Windows\System\ygANPut.exe
  C:\Windows\System\ygANPut.exe
  2⤵
  PID:4328
- C:\Windows\System\tacTPBW.exe
  C:\Windows\System\tacTPBW.exe
  2⤵
  PID:4348
- C:\Windows\System\EhHMXGE.exe
  C:\Windows\System\EhHMXGE.exe
  2⤵
  PID:4368
- C:\Windows\System\JdCeoLl.exe
  C:\Windows\System\JdCeoLl.exe
  2⤵
  PID:4388
- C:\Windows\System\xbIRyKr.exe
  C:\Windows\System\xbIRyKr.exe
  2⤵
  PID:4408
- C:\Windows\System\KXltogJ.exe
  C:\Windows\System\KXltogJ.exe
  2⤵
  PID:4428
- C:\Windows\System\RxayVbN.exe
  C:\Windows\System\RxayVbN.exe
  2⤵
  PID:4448
- C:\Windows\System\eWBXhmk.exe
  C:\Windows\System\eWBXhmk.exe
  2⤵
  PID:4468
- C:\Windows\System\BhwDIew.exe
  C:\Windows\System\BhwDIew.exe
  2⤵
  PID:4488
- C:\Windows\System\qeVAcGv.exe
  C:\Windows\System\qeVAcGv.exe
  2⤵
  PID:4508
- C:\Windows\System\JvLSNjm.exe
  C:\Windows\System\JvLSNjm.exe
  2⤵
  PID:4528
- C:\Windows\System\kMmWUIq.exe
  C:\Windows\System\kMmWUIq.exe
  2⤵
  PID:4548
- C:\Windows\System\sNuaJnb.exe
  C:\Windows\System\sNuaJnb.exe
  2⤵
  PID:4568
- C:\Windows\System\bZMxdZf.exe
  C:\Windows\System\bZMxdZf.exe
  2⤵
  PID:4588
- C:\Windows\System\dOtPcCM.exe
  C:\Windows\System\dOtPcCM.exe
  2⤵
  PID:4608
- C:\Windows\System\mcrdAbw.exe
  C:\Windows\System\mcrdAbw.exe
  2⤵
  PID:4628
- C:\Windows\System\yJabtho.exe
  C:\Windows\System\yJabtho.exe
  2⤵
  PID:4652
- C:\Windows\System\XlFPFJX.exe
  C:\Windows\System\XlFPFJX.exe
  2⤵
  PID:4672
- C:\Windows\System\HXNFDSZ.exe
  C:\Windows\System\HXNFDSZ.exe
  2⤵
  PID:4692
- C:\Windows\System\MdwBHPk.exe
  C:\Windows\System\MdwBHPk.exe
  2⤵
  PID:4716
- C:\Windows\System\VXYyArt.exe
  C:\Windows\System\VXYyArt.exe
  2⤵
  PID:4736
- C:\Windows\System\KRFwJav.exe
  C:\Windows\System\KRFwJav.exe
  2⤵
  PID:4756
- C:\Windows\System\VLIqRHq.exe
  C:\Windows\System\VLIqRHq.exe
  2⤵
  PID:4776
- C:\Windows\System\cPPkPkK.exe
  C:\Windows\System\cPPkPkK.exe
  2⤵
  PID:4792
- C:\Windows\System\oGSpVcJ.exe
  C:\Windows\System\oGSpVcJ.exe
  2⤵
  PID:4816
- C:\Windows\System\VHzKcXj.exe
  C:\Windows\System\VHzKcXj.exe
  2⤵
  PID:4836
- C:\Windows\System\gSOkLiq.exe
  C:\Windows\System\gSOkLiq.exe
  2⤵
  PID:4856
- C:\Windows\System\BGJFOlI.exe
  C:\Windows\System\BGJFOlI.exe
  2⤵
  PID:4876
- C:\Windows\System\szZJovh.exe
  C:\Windows\System\szZJovh.exe
  2⤵
  PID:4896
- C:\Windows\System\eEcRKsi.exe
  C:\Windows\System\eEcRKsi.exe
  2⤵
  PID:4916
- C:\Windows\System\suDBolI.exe
  C:\Windows\System\suDBolI.exe
  2⤵
  PID:4936
- C:\Windows\System\DjaNLCp.exe
  C:\Windows\System\DjaNLCp.exe
  2⤵
  PID:4956
- C:\Windows\System\hSyokZd.exe
  C:\Windows\System\hSyokZd.exe
  2⤵
  PID:4976
- C:\Windows\System\CtBapJl.exe
  C:\Windows\System\CtBapJl.exe
  2⤵
  PID:4996
- C:\Windows\System\ZdVzoYv.exe
  C:\Windows\System\ZdVzoYv.exe
  2⤵
  PID:5016
- C:\Windows\System\LZkSrhK.exe
  C:\Windows\System\LZkSrhK.exe
  2⤵
  PID:5032
- C:\Windows\System\rzYeKsI.exe
  C:\Windows\System\rzYeKsI.exe
  2⤵
  PID:5056
- C:\Windows\System\PJQoYLE.exe
  C:\Windows\System\PJQoYLE.exe
  2⤵
  PID:5072
- C:\Windows\System\LOrqzXG.exe
  C:\Windows\System\LOrqzXG.exe
  2⤵
  PID:5096
- C:\Windows\System\fOadOcE.exe
  C:\Windows\System\fOadOcE.exe
  2⤵
  PID:5116
- C:\Windows\System\lEBxeoi.exe
  C:\Windows\System\lEBxeoi.exe
  2⤵
  PID:4008
- C:\Windows\System\wtrnhfu.exe
  C:\Windows\System\wtrnhfu.exe
  2⤵
  PID:2920
- C:\Windows\System\EkETMai.exe
  C:\Windows\System\EkETMai.exe
  2⤵
  PID:2184
- C:\Windows\System\XSOyPdC.exe
  C:\Windows\System\XSOyPdC.exe
  2⤵
  PID:840
- C:\Windows\System\uHexbRW.exe
  C:\Windows\System\uHexbRW.exe
  2⤵
  PID:2012
- C:\Windows\System\bAcmRtt.exe
  C:\Windows\System\bAcmRtt.exe
  2⤵
  PID:3324
- C:\Windows\System\aVtUUyx.exe
  C:\Windows\System\aVtUUyx.exe
  2⤵
  PID:3588
- C:\Windows\System\NOYXFoX.exe
  C:\Windows\System\NOYXFoX.exe
  2⤵
  PID:3704
- C:\Windows\System\cVCgphW.exe
  C:\Windows\System\cVCgphW.exe
  2⤵
  PID:3644
- C:\Windows\System\eHbTSbJ.exe
  C:\Windows\System\eHbTSbJ.exe
  2⤵
  PID:3980
- C:\Windows\System\drwcinU.exe
  C:\Windows\System\drwcinU.exe
  2⤵
  PID:4124
- C:\Windows\System\GjZtIoR.exe
  C:\Windows\System\GjZtIoR.exe
  2⤵
  PID:4160
- C:\Windows\System\UlDsaDS.exe
  C:\Windows\System\UlDsaDS.exe
  2⤵
  PID:4176
- C:\Windows\System\bbHclUh.exe
  C:\Windows\System\bbHclUh.exe
  2⤵
  PID:4224
- C:\Windows\System\PUKAbyQ.exe
  C:\Windows\System\PUKAbyQ.exe
  2⤵
  PID:4256
- C:\Windows\System\YOdfoAF.exe
  C:\Windows\System\YOdfoAF.exe
  2⤵
  PID:4260
- C:\Windows\System\LUaPKZz.exe
  C:\Windows\System\LUaPKZz.exe
  2⤵
  PID:4304
- C:\Windows\System\cpdvXrI.exe
  C:\Windows\System\cpdvXrI.exe
  2⤵
  PID:4360
- C:\Windows\System\vPeBLUw.exe
  C:\Windows\System\vPeBLUw.exe
  2⤵
  PID:4396
- C:\Windows\System\sSyIGbW.exe
  C:\Windows\System\sSyIGbW.exe
  2⤵
  PID:4416
- C:\Windows\System\cmxspaq.exe
  C:\Windows\System\cmxspaq.exe
  2⤵
  PID:4444
- C:\Windows\System\bmMRKOP.exe
  C:\Windows\System\bmMRKOP.exe
  2⤵
  PID:4460
- C:\Windows\System\KLlgJSt.exe
  C:\Windows\System\KLlgJSt.exe
  2⤵
  PID:4504
- C:\Windows\System\AMHGUZH.exe
  C:\Windows\System\AMHGUZH.exe
  2⤵
  PID:2712
- C:\Windows\System\KrQCOcD.exe
  C:\Windows\System\KrQCOcD.exe
  2⤵
  PID:4564
- C:\Windows\System\ZKhomxr.exe
  C:\Windows\System\ZKhomxr.exe
  2⤵
  PID:4600
- C:\Windows\System\lmWUByn.exe
  C:\Windows\System\lmWUByn.exe
  2⤵
  PID:4636
- C:\Windows\System\WqbqrMg.exe
  C:\Windows\System\WqbqrMg.exe
  2⤵
  PID:2688
- C:\Windows\System\WqAEDwk.exe
  C:\Windows\System\WqAEDwk.exe
  2⤵
  PID:2472
- C:\Windows\System\IsmayZI.exe
  C:\Windows\System\IsmayZI.exe
  2⤵
  PID:4660
- C:\Windows\System\qWbbTGt.exe
  C:\Windows\System\qWbbTGt.exe
  2⤵
  PID:4724
- C:\Windows\System\dOXFqAR.exe
  C:\Windows\System\dOXFqAR.exe
  2⤵
  PID:4704
- C:\Windows\System\zzvapbY.exe
  C:\Windows\System\zzvapbY.exe
  2⤵
  PID:4772
- C:\Windows\System\ODOLzBF.exe
  C:\Windows\System\ODOLzBF.exe
  2⤵
  PID:4812
- C:\Windows\System\UlxGWYG.exe
  C:\Windows\System\UlxGWYG.exe
  2⤵
  PID:4848
- C:\Windows\System\WcdtrUp.exe
  C:\Windows\System\WcdtrUp.exe
  2⤵
  PID:4884
- C:\Windows\System\cWwYJjA.exe
  C:\Windows\System\cWwYJjA.exe
  2⤵
  PID:4892
- C:\Windows\System\ZimfMee.exe
  C:\Windows\System\ZimfMee.exe
  2⤵
  PID:4908
- C:\Windows\System\KIKtGtL.exe
  C:\Windows\System\KIKtGtL.exe
  2⤵
  PID:4952
- C:\Windows\System\ZGQagem.exe
  C:\Windows\System\ZGQagem.exe
  2⤵
  PID:5012
- C:\Windows\System\LaZbdjb.exe
  C:\Windows\System\LaZbdjb.exe
  2⤵
  PID:5052
- C:\Windows\System\rZxNJbU.exe
  C:\Windows\System\rZxNJbU.exe
  2⤵
  PID:5028
- C:\Windows\System\JpQMvaA.exe
  C:\Windows\System\JpQMvaA.exe
  2⤵
  PID:3884
- C:\Windows\System\uZRbZft.exe
  C:\Windows\System\uZRbZft.exe
  2⤵
  PID:3960
- C:\Windows\System\hgHpaOe.exe
  C:\Windows\System\hgHpaOe.exe
  2⤵
  PID:2404
- C:\Windows\System\OkLypEM.exe
  C:\Windows\System\OkLypEM.exe
  2⤵
  PID:1584
- C:\Windows\System\saizxSB.exe
  C:\Windows\System\saizxSB.exe
  2⤵
  PID:3152
- C:\Windows\System\beZHlvv.exe
  C:\Windows\System\beZHlvv.exe
  2⤵
  PID:3664
- C:\Windows\System\dhUuusY.exe
  C:\Windows\System\dhUuusY.exe
  2⤵
  PID:3672
- C:\Windows\System\erFSBpn.exe
  C:\Windows\System\erFSBpn.exe
  2⤵
  PID:3860
- C:\Windows\System\BHRoCXV.exe
  C:\Windows\System\BHRoCXV.exe
  2⤵
  PID:4156
- C:\Windows\System\GBfhcSF.exe
  C:\Windows\System\GBfhcSF.exe
  2⤵
  PID:4236
- C:\Windows\System\lBtOfjw.exe
  C:\Windows\System\lBtOfjw.exe
  2⤵
  PID:4240
- C:\Windows\System\HFUAvPU.exe
  C:\Windows\System\HFUAvPU.exe
  2⤵
  PID:4296
- C:\Windows\System\YSWoyAC.exe
  C:\Windows\System\YSWoyAC.exe
  2⤵
  PID:4380
- C:\Windows\System\UumioNv.exe
  C:\Windows\System\UumioNv.exe
  2⤵
  PID:4440
- C:\Windows\System\YCvhQVb.exe
  C:\Windows\System\YCvhQVb.exe
  2⤵
  PID:4516
- C:\Windows\System\xZsPHOw.exe
  C:\Windows\System\xZsPHOw.exe
  2⤵
  PID:1408
- C:\Windows\System\WbiPzSV.exe
  C:\Windows\System\WbiPzSV.exe
  2⤵
  PID:4544
- C:\Windows\System\TkWVwaC.exe
  C:\Windows\System\TkWVwaC.exe
  2⤵
  PID:612
- C:\Windows\System\ZEsehax.exe
  C:\Windows\System\ZEsehax.exe
  2⤵
  PID:4624
- C:\Windows\System\HANwaUI.exe
  C:\Windows\System\HANwaUI.exe
  2⤵
  PID:2428
- C:\Windows\System\erRHwOl.exe
  C:\Windows\System\erRHwOl.exe
  2⤵
  PID:2776
- C:\Windows\System\EJxLfWv.exe
  C:\Windows\System\EJxLfWv.exe
  2⤵
  PID:4764
- C:\Windows\System\xsQfOtz.exe
  C:\Windows\System\xsQfOtz.exe
  2⤵
  PID:4708
- C:\Windows\System\ZLjIGBB.exe
  C:\Windows\System\ZLjIGBB.exe
  2⤵
  PID:4808
- C:\Windows\System\BpzKQBU.exe
  C:\Windows\System\BpzKQBU.exe
  2⤵
  PID:4868
- C:\Windows\System\IODyDfT.exe
  C:\Windows\System\IODyDfT.exe
  2⤵
  PID:4968
- C:\Windows\System\EUtDrmR.exe
  C:\Windows\System\EUtDrmR.exe
  2⤵
  PID:4928
- C:\Windows\System\VmhUksQ.exe
  C:\Windows\System\VmhUksQ.exe
  2⤵
  PID:5044
- C:\Windows\System\koUdHPD.exe
  C:\Windows\System\koUdHPD.exe
  2⤵
  PID:4984
- C:\Windows\System\EJNiMlu.exe
  C:\Windows\System\EJNiMlu.exe
  2⤵
  PID:1728
- C:\Windows\System\FXgpGEk.exe
  C:\Windows\System\FXgpGEk.exe
  2⤵
  PID:2384
- C:\Windows\System\eKhlCto.exe
  C:\Windows\System\eKhlCto.exe
  2⤵
  PID:3244
- C:\Windows\System\jBpYaMq.exe
  C:\Windows\System\jBpYaMq.exe
  2⤵
  PID:3648
- C:\Windows\System\VKevKEw.exe
  C:\Windows\System\VKevKEw.exe
  2⤵
  PID:3836
- C:\Windows\System\aHJVFpf.exe
  C:\Windows\System\aHJVFpf.exe
  2⤵
  PID:4184
- C:\Windows\System\BUWpRhb.exe
  C:\Windows\System\BUWpRhb.exe
  2⤵
  PID:4216
- C:\Windows\System\MypxTBd.exe
  C:\Windows\System\MypxTBd.exe
  2⤵
  PID:4324
- C:\Windows\System\mgQCefM.exe
  C:\Windows\System\mgQCefM.exe
  2⤵
  PID:4404
- C:\Windows\System\jZYveIw.exe
  C:\Windows\System\jZYveIw.exe
  2⤵
  PID:4480
- C:\Windows\System\myyxOHw.exe
  C:\Windows\System\myyxOHw.exe
  2⤵
  PID:4616
- C:\Windows\System\eqWFlhM.exe
  C:\Windows\System\eqWFlhM.exe
  2⤵
  PID:2892
- C:\Windows\System\NCtCdKC.exe
  C:\Windows\System\NCtCdKC.exe
  2⤵
  PID:800
- C:\Windows\System\YgNVXmz.exe
  C:\Windows\System\YgNVXmz.exe
  2⤵
  PID:1140
- C:\Windows\System\wrbJxrI.exe
  C:\Windows\System\wrbJxrI.exe
  2⤵
  PID:4752
- C:\Windows\System\DEHtkTr.exe
  C:\Windows\System\DEHtkTr.exe
  2⤵
  PID:4828
- C:\Windows\System\fhyBqfd.exe
  C:\Windows\System\fhyBqfd.exe
  2⤵
  PID:4972
- C:\Windows\System\xjkdvmw.exe
  C:\Windows\System\xjkdvmw.exe
  2⤵
  PID:5048
- C:\Windows\System\HuNSoXN.exe
  C:\Windows\System\HuNSoXN.exe
  2⤵
  PID:1528
- C:\Windows\System\eMleJsI.exe
  C:\Windows\System\eMleJsI.exe
  2⤵
  PID:3232
- C:\Windows\System\QvZAfcp.exe
  C:\Windows\System\QvZAfcp.exe
  2⤵
  PID:3820
- C:\Windows\System\RMnusoq.exe
  C:\Windows\System\RMnusoq.exe
  2⤵
  PID:4284
- C:\Windows\System\rdUqSma.exe
  C:\Windows\System\rdUqSma.exe
  2⤵
  PID:4336
- C:\Windows\System\YPTpcCj.exe
  C:\Windows\System\YPTpcCj.exe
  2⤵
  PID:4520
- C:\Windows\System\ldUvejz.exe
  C:\Windows\System\ldUvejz.exe
  2⤵
  PID:4712
- C:\Windows\System\QXyPcim.exe
  C:\Windows\System\QXyPcim.exe
  2⤵
  PID:4580
- C:\Windows\System\EjRiaWh.exe
  C:\Windows\System\EjRiaWh.exe
  2⤵
  PID:4788
- C:\Windows\System\TtUxgvS.exe
  C:\Windows\System\TtUxgvS.exe
  2⤵
  PID:4992
- C:\Windows\System\XpVxDMW.exe
  C:\Windows\System\XpVxDMW.exe
  2⤵
  PID:5064
- C:\Windows\System\FzVuENB.exe
  C:\Windows\System\FzVuENB.exe
  2⤵
  PID:5108
- C:\Windows\System\jpZyMHL.exe
  C:\Windows\System\jpZyMHL.exe
  2⤵
  PID:5068
- C:\Windows\System\clwYvUq.exe
  C:\Windows\System\clwYvUq.exe
  2⤵
  PID:4104
- C:\Windows\System\hrMnMeN.exe
  C:\Windows\System\hrMnMeN.exe
  2⤵
  PID:2680
- C:\Windows\System\bwSGAox.exe
  C:\Windows\System\bwSGAox.exe
  2⤵
  PID:404
- C:\Windows\System\xnhrIhS.exe
  C:\Windows\System\xnhrIhS.exe
  2⤵
  PID:4744
- C:\Windows\System\vMrpNAC.exe
  C:\Windows\System\vMrpNAC.exe
  2⤵
  PID:1036
- C:\Windows\System\LHOkOiu.exe
  C:\Windows\System\LHOkOiu.exe
  2⤵
  PID:3132
- C:\Windows\System\EwJInyW.exe
  C:\Windows\System\EwJInyW.exe
  2⤵
  PID:4120
- C:\Windows\System\jUqiUtE.exe
  C:\Windows\System\jUqiUtE.exe
  2⤵
  PID:1972
- C:\Windows\System\oPfrJlB.exe
  C:\Windows\System\oPfrJlB.exe
  2⤵
  PID:2756
- C:\Windows\System\UAWSacF.exe
  C:\Windows\System\UAWSacF.exe
  2⤵
  PID:2672
- C:\Windows\System\bxXeNWu.exe
  C:\Windows\System\bxXeNWu.exe
  2⤵
  PID:2152
- C:\Windows\System\dHBziFY.exe
  C:\Windows\System\dHBziFY.exe
  2⤵
  PID:4164
- C:\Windows\System\FQVHzQa.exe
  C:\Windows\System\FQVHzQa.exe
  2⤵
  PID:2900
- C:\Windows\System\GRFTsnp.exe
  C:\Windows\System\GRFTsnp.exe
  2⤵
  PID:4844
- C:\Windows\System\NevXNHH.exe
  C:\Windows\System\NevXNHH.exe
  2⤵
  PID:5088
- C:\Windows\System\sGZdflQ.exe
  C:\Windows\System\sGZdflQ.exe
  2⤵
  PID:4356
- C:\Windows\System\mozTzbQ.exe
  C:\Windows\System\mozTzbQ.exe
  2⤵
  PID:2092
- C:\Windows\System\klQnYNx.exe
  C:\Windows\System\klQnYNx.exe
  2⤵
  PID:1500
- C:\Windows\System\wbSxhcr.exe
  C:\Windows\System\wbSxhcr.exe
  2⤵
  PID:5136
- C:\Windows\System\ZkpsREw.exe
  C:\Windows\System\ZkpsREw.exe
  2⤵
  PID:5156
- C:\Windows\System\idwGsCG.exe
  C:\Windows\System\idwGsCG.exe
  2⤵
  PID:5172
- C:\Windows\System\xQgzvWk.exe
  C:\Windows\System\xQgzvWk.exe
  2⤵
  PID:5192
- C:\Windows\System\FvSvIIP.exe
  C:\Windows\System\FvSvIIP.exe
  2⤵
  PID:5208
- C:\Windows\System\PkjHEjn.exe
  C:\Windows\System\PkjHEjn.exe
  2⤵
  PID:5228
- C:\Windows\System\wbxAJvZ.exe
  C:\Windows\System\wbxAJvZ.exe
  2⤵
  PID:5252
- C:\Windows\System\vQrtfCU.exe
  C:\Windows\System\vQrtfCU.exe
  2⤵
  PID:5268
- C:\Windows\System\cSoHbgu.exe
  C:\Windows\System\cSoHbgu.exe
  2⤵
  PID:5284
- C:\Windows\System\DBugWtp.exe
  C:\Windows\System\DBugWtp.exe
  2⤵
  PID:5300
- C:\Windows\System\JfiLaoc.exe
  C:\Windows\System\JfiLaoc.exe
  2⤵
  PID:5320
- C:\Windows\System\ZYegUTs.exe
  C:\Windows\System\ZYegUTs.exe
  2⤵
  PID:5340
- C:\Windows\System\UwXRukd.exe
  C:\Windows\System\UwXRukd.exe
  2⤵
  PID:5360
- C:\Windows\System\XtOZpCw.exe
  C:\Windows\System\XtOZpCw.exe
  2⤵
  PID:5416
- C:\Windows\System\jDOauFP.exe
  C:\Windows\System\jDOauFP.exe
  2⤵
  PID:5436
- C:\Windows\System\hEYQqjJ.exe
  C:\Windows\System\hEYQqjJ.exe
  2⤵
  PID:5456
- C:\Windows\System\NJnNlDl.exe
  C:\Windows\System\NJnNlDl.exe
  2⤵
  PID:5472
- C:\Windows\System\nwCopIs.exe
  C:\Windows\System\nwCopIs.exe
  2⤵
  PID:5488
- C:\Windows\System\stPvtlU.exe
  C:\Windows\System\stPvtlU.exe
  2⤵
  PID:5504
- C:\Windows\System\vngaxLK.exe
  C:\Windows\System\vngaxLK.exe
  2⤵
  PID:5524
- C:\Windows\System\BpCOMnI.exe
  C:\Windows\System\BpCOMnI.exe
  2⤵
  PID:5544
- C:\Windows\System\vvtUWWv.exe
  C:\Windows\System\vvtUWWv.exe
  2⤵
  PID:5560
- C:\Windows\System\wrERbxH.exe
  C:\Windows\System\wrERbxH.exe
  2⤵
  PID:5580
- C:\Windows\System\dyKlHsl.exe
  C:\Windows\System\dyKlHsl.exe
  2⤵
  PID:5596
- C:\Windows\System\KbrCgez.exe
  C:\Windows\System\KbrCgez.exe
  2⤵
  PID:5612
- C:\Windows\System\awJcwFB.exe
  C:\Windows\System\awJcwFB.exe
  2⤵
  PID:5640
- C:\Windows\System\cKTPpUO.exe
  C:\Windows\System\cKTPpUO.exe
  2⤵
  PID:5664
- C:\Windows\System\VPyxGJJ.exe
  C:\Windows\System\VPyxGJJ.exe
  2⤵
  PID:5680
- C:\Windows\System\HwdKxLt.exe
  C:\Windows\System\HwdKxLt.exe
  2⤵
  PID:5696
- C:\Windows\System\NGnHByz.exe
  C:\Windows\System\NGnHByz.exe
  2⤵
  PID:5716
- C:\Windows\System\FMguntq.exe
  C:\Windows\System\FMguntq.exe
  2⤵
  PID:5732
- C:\Windows\System\rKoIQGH.exe
  C:\Windows\System\rKoIQGH.exe
  2⤵
  PID:5756
- C:\Windows\System\xVtqtHk.exe
  C:\Windows\System\xVtqtHk.exe
  2⤵
  PID:5772
- C:\Windows\System\iEPXuZP.exe
  C:\Windows\System\iEPXuZP.exe
  2⤵
  PID:5788
- C:\Windows\System\WrhFTqg.exe
  C:\Windows\System\WrhFTqg.exe
  2⤵
  PID:5804
- C:\Windows\System\MKcVAAI.exe
  C:\Windows\System\MKcVAAI.exe
  2⤵
  PID:5824
- C:\Windows\System\mlZhpxE.exe
  C:\Windows\System\mlZhpxE.exe
  2⤵
  PID:5840
- C:\Windows\System\dMePUpO.exe
  C:\Windows\System\dMePUpO.exe
  2⤵
  PID:5860
- C:\Windows\System\gDFKFnR.exe
  C:\Windows\System\gDFKFnR.exe
  2⤵
  PID:5924
- C:\Windows\System\HTrROXl.exe
  C:\Windows\System\HTrROXl.exe
  2⤵
  PID:5940
- C:\Windows\System\RPiOsVv.exe
  C:\Windows\System\RPiOsVv.exe
  2⤵
  PID:5960
- C:\Windows\System\fmrcAVV.exe
  C:\Windows\System\fmrcAVV.exe
  2⤵
  PID:5976
- C:\Windows\System\NCghRWf.exe
  C:\Windows\System\NCghRWf.exe
  2⤵
  PID:6000
- C:\Windows\System\kbxopih.exe
  C:\Windows\System\kbxopih.exe
  2⤵
  PID:6024
- C:\Windows\System\fCEAvzf.exe
  C:\Windows\System\fCEAvzf.exe
  2⤵
  PID:6044
- C:\Windows\System\RkBgdSv.exe
  C:\Windows\System\RkBgdSv.exe
  2⤵
  PID:6060
- C:\Windows\System\IBmrMtm.exe
  C:\Windows\System\IBmrMtm.exe
  2⤵
  PID:6076
- C:\Windows\System\WHvnoXJ.exe
  C:\Windows\System\WHvnoXJ.exe
  2⤵
  PID:6092
- C:\Windows\System\nmzCbxd.exe
  C:\Windows\System\nmzCbxd.exe
  2⤵
  PID:6112
- C:\Windows\System\NEryfhE.exe
  C:\Windows\System\NEryfhE.exe
  2⤵
  PID:6140
- C:\Windows\System\QVTFQSD.exe
  C:\Windows\System\QVTFQSD.exe
  2⤵
  PID:2732
- C:\Windows\System\rWMzwRR.exe
  C:\Windows\System\rWMzwRR.exe
  2⤵
  PID:5236
- C:\Windows\System\UPRDEUs.exe
  C:\Windows\System\UPRDEUs.exe
  2⤵
  PID:2488
- C:\Windows\System\eJWEgJi.exe
  C:\Windows\System\eJWEgJi.exe
  2⤵
  PID:4144
- C:\Windows\System\vorwhFx.exe
  C:\Windows\System\vorwhFx.exe
  2⤵
  PID:1708
- C:\Windows\System\CJVpjRD.exe
  C:\Windows\System\CJVpjRD.exe
  2⤵
  PID:5248
- C:\Windows\System\AJunqgr.exe
  C:\Windows\System\AJunqgr.exe
  2⤵
  PID:5348
- C:\Windows\System\OVfkWBV.exe
  C:\Windows\System\OVfkWBV.exe
  2⤵
  PID:5184
- C:\Windows\System\FPSEujx.exe
  C:\Windows\System\FPSEujx.exe
  2⤵
  PID:5424
- C:\Windows\System\xmwfWDb.exe
  C:\Windows\System\xmwfWDb.exe
  2⤵
  PID:5380
- C:\Windows\System\WucMbJk.exe
  C:\Windows\System\WucMbJk.exe
  2⤵
  PID:5536
- C:\Windows\System\BRvcQeC.exe
  C:\Windows\System\BRvcQeC.exe
  2⤵
  PID:5608
- C:\Windows\System\RCoqMsf.exe
  C:\Windows\System\RCoqMsf.exe
  2⤵
  PID:5180
- C:\Windows\System\UjWcoOc.exe
  C:\Windows\System\UjWcoOc.exe
  2⤵
  PID:5224
- C:\Windows\System\DVZoImm.exe
  C:\Windows\System\DVZoImm.exe
  2⤵
  PID:5660
- C:\Windows\System\vqcWTjJ.exe
  C:\Windows\System\vqcWTjJ.exe
  2⤵
  PID:5692
- C:\Windows\System\uhWbPld.exe
  C:\Windows\System\uhWbPld.exe
  2⤵
  PID:5728
- C:\Windows\System\QNsynSF.exe
  C:\Windows\System\QNsynSF.exe
  2⤵
  PID:5796
- C:\Windows\System\vavQfUu.exe
  C:\Windows\System\vavQfUu.exe
  2⤵
  PID:5832
- C:\Windows\System\fthzdiR.exe
  C:\Windows\System\fthzdiR.exe
  2⤵
  PID:5884
- C:\Windows\System\uutWuFi.exe
  C:\Windows\System\uutWuFi.exe
  2⤵
  PID:5892
- C:\Windows\System\cWcbniM.exe
  C:\Windows\System\cWcbniM.exe
  2⤵
  PID:5396
- C:\Windows\System\ntMpCSx.exe
  C:\Windows\System\ntMpCSx.exe
  2⤵
  PID:5372
- C:\Windows\System\Dxjhmit.exe
  C:\Windows\System\Dxjhmit.exe
  2⤵
  PID:5904
- C:\Windows\System\uyWbRbr.exe
  C:\Windows\System\uyWbRbr.exe
  2⤵
  PID:5856
- C:\Windows\System\GqwfHDv.exe
  C:\Windows\System\GqwfHDv.exe
  2⤵
  PID:5624
- C:\Windows\System\GbbzRzx.exe
  C:\Windows\System\GbbzRzx.exe
  2⤵
  PID:5704
- C:\Windows\System\MyMHcDP.exe
  C:\Windows\System\MyMHcDP.exe
  2⤵
  PID:5752
- C:\Windows\System\nErHJQT.exe
  C:\Windows\System\nErHJQT.exe
  2⤵
  PID:5848
- C:\Windows\System\nluDgHx.exe
  C:\Windows\System\nluDgHx.exe
  2⤵
  PID:1052
- C:\Windows\System\dUeSelg.exe
  C:\Windows\System\dUeSelg.exe
  2⤵
  PID:5952
- C:\Windows\System\RRZynBJ.exe
  C:\Windows\System\RRZynBJ.exe
  2⤵
  PID:5992
- C:\Windows\System\daFfFwL.exe
  C:\Windows\System\daFfFwL.exe
  2⤵
  PID:6008
- C:\Windows\System\OsekWFD.exe
  C:\Windows\System\OsekWFD.exe
  2⤵
  PID:6036
- C:\Windows\System\yGGTmTK.exe
  C:\Windows\System\yGGTmTK.exe
  2⤵
  PID:6100
- C:\Windows\System\dqYGVGr.exe
  C:\Windows\System\dqYGVGr.exe
  2⤵
  PID:6052
- C:\Windows\System\hbwWCSC.exe
  C:\Windows\System\hbwWCSC.exe
  2⤵
  PID:6128
- C:\Windows\System\XeegwqZ.exe
  C:\Windows\System\XeegwqZ.exe
  2⤵
  PID:5124
- C:\Windows\System\xvHqfrZ.exe
  C:\Windows\System\xvHqfrZ.exe
  2⤵
  PID:1716
- C:\Windows\System\wkXTqAj.exe
  C:\Windows\System\wkXTqAj.exe
  2⤵
  PID:5080
- C:\Windows\System\aQoHuTb.exe
  C:\Windows\System\aQoHuTb.exe
  2⤵
  PID:3020
- C:\Windows\System\AknyIfT.exe
  C:\Windows\System\AknyIfT.exe
  2⤵
  PID:5244
- C:\Windows\System\TcDMLtk.exe
  C:\Windows\System\TcDMLtk.exe
  2⤵
  PID:5292
- C:\Windows\System\hxjDHBt.exe
  C:\Windows\System\hxjDHBt.exe
  2⤵
  PID:5432
- C:\Windows\System\RPPHecZ.exe
  C:\Windows\System\RPPHecZ.exe
  2⤵
  PID:5468
- C:\Windows\System\xBNbOpO.exe
  C:\Windows\System\xBNbOpO.exe
  2⤵
  PID:5152
- C:\Windows\System\EMOBpOm.exe
  C:\Windows\System\EMOBpOm.exe
  2⤵
  PID:5216
- C:\Windows\System\jeoJElq.exe
  C:\Windows\System\jeoJElq.exe
  2⤵
  PID:5656
- C:\Windows\System\urWjLrS.exe
  C:\Windows\System\urWjLrS.exe
  2⤵
  PID:5332
- C:\Windows\System\slXPsne.exe
  C:\Windows\System\slXPsne.exe
  2⤵
  PID:5516
- C:\Windows\System\AqFIqIr.exe
  C:\Windows\System\AqFIqIr.exe
  2⤵
  PID:5908
- C:\Windows\System\qkdrTjt.exe
  C:\Windows\System\qkdrTjt.exe
  2⤵
  PID:5632
- C:\Windows\System\CqpkhRU.exe
  C:\Windows\System\CqpkhRU.exe
  2⤵
  PID:6152
- C:\Windows\System\bZdXakI.exe
  C:\Windows\System\bZdXakI.exe
  2⤵
  PID:6168
- C:\Windows\System\KdbDWrn.exe
  C:\Windows\System\KdbDWrn.exe
  2⤵
  PID:6184
- C:\Windows\System\UQjnuge.exe
  C:\Windows\System\UQjnuge.exe
  2⤵
  PID:6200
- C:\Windows\System\vTIIXHE.exe
  C:\Windows\System\vTIIXHE.exe
  2⤵
  PID:6216
- C:\Windows\System\webNlnz.exe
  C:\Windows\System\webNlnz.exe
  2⤵
  PID:6232
- C:\Windows\System\gBOKOvm.exe
  C:\Windows\System\gBOKOvm.exe
  2⤵
  PID:6248
- C:\Windows\System\KttXxlK.exe
  C:\Windows\System\KttXxlK.exe
  2⤵
  PID:6268
- C:\Windows\System\hcuutKb.exe
  C:\Windows\System\hcuutKb.exe
  2⤵
  PID:6360
- C:\Windows\System\tCoAUJJ.exe
  C:\Windows\System\tCoAUJJ.exe
  2⤵
  PID:6380
- C:\Windows\System\zGwJpZb.exe
  C:\Windows\System\zGwJpZb.exe
  2⤵
  PID:6400
- C:\Windows\System\CxnMhTD.exe
  C:\Windows\System\CxnMhTD.exe
  2⤵
  PID:6416
- C:\Windows\System\oqwiBXG.exe
  C:\Windows\System\oqwiBXG.exe
  2⤵
  PID:6432
- C:\Windows\System\rCeMLef.exe
  C:\Windows\System\rCeMLef.exe
  2⤵
  PID:6452
- C:\Windows\System\mlgKMSS.exe
  C:\Windows\System\mlgKMSS.exe
  2⤵
  PID:6468
- C:\Windows\System\KjKsmIa.exe
  C:\Windows\System\KjKsmIa.exe
  2⤵
  PID:6484
- C:\Windows\System\LIRkAvi.exe
  C:\Windows\System\LIRkAvi.exe
  2⤵
  PID:6504
- C:\Windows\System\qpfksHz.exe
  C:\Windows\System\qpfksHz.exe
  2⤵
  PID:6520
- C:\Windows\System\ofivsVG.exe
  C:\Windows\System\ofivsVG.exe
  2⤵
  PID:6536
- C:\Windows\System\groFxTn.exe
  C:\Windows\System\groFxTn.exe
  2⤵
  PID:6552
- C:\Windows\System\tnEzWhj.exe
  C:\Windows\System\tnEzWhj.exe
  2⤵
  PID:6568
- C:\Windows\System\VFDmZXE.exe
  C:\Windows\System\VFDmZXE.exe
  2⤵
  PID:6584
- C:\Windows\System\JyfRpop.exe
  C:\Windows\System\JyfRpop.exe
  2⤵
  PID:6600
- C:\Windows\System\xlqNbvA.exe
  C:\Windows\System\xlqNbvA.exe
  2⤵
  PID:6616
- C:\Windows\System\OjXlJCr.exe
  C:\Windows\System\OjXlJCr.exe
  2⤵
  PID:6632
- C:\Windows\System\bUdZfYX.exe
  C:\Windows\System\bUdZfYX.exe
  2⤵
  PID:6648
- C:\Windows\System\akBIxTn.exe
  C:\Windows\System\akBIxTn.exe
  2⤵
  PID:6668
- C:\Windows\System\voDUIcC.exe
  C:\Windows\System\voDUIcC.exe
  2⤵
  PID:6684
- C:\Windows\System\pytyfAT.exe
  C:\Windows\System\pytyfAT.exe
  2⤵
  PID:6704
- C:\Windows\System\mfrctQk.exe
  C:\Windows\System\mfrctQk.exe
  2⤵
  PID:6720
- C:\Windows\System\WUydZhZ.exe
  C:\Windows\System\WUydZhZ.exe
  2⤵
  PID:6736
- C:\Windows\System\GctKXUS.exe
  C:\Windows\System\GctKXUS.exe
  2⤵
  PID:6752
- C:\Windows\System\jNmUeID.exe
  C:\Windows\System\jNmUeID.exe
  2⤵
  PID:6768
- C:\Windows\System\LjHKXIG.exe
  C:\Windows\System\LjHKXIG.exe
  2⤵
  PID:6784
- C:\Windows\System\JVWBbEi.exe
  C:\Windows\System\JVWBbEi.exe
  2⤵
  PID:6800
- C:\Windows\System\RZbyibC.exe
  C:\Windows\System\RZbyibC.exe
  2⤵
  PID:6816
- C:\Windows\System\xCbAaIl.exe
  C:\Windows\System\xCbAaIl.exe
  2⤵
  PID:6836
- C:\Windows\System\mWwpzCY.exe
  C:\Windows\System\mWwpzCY.exe
  2⤵
  PID:6852
- C:\Windows\System\RBbGnHm.exe
  C:\Windows\System\RBbGnHm.exe
  2⤵
  PID:6868
- C:\Windows\System\VnPoUrF.exe
  C:\Windows\System\VnPoUrF.exe
  2⤵
  PID:6884
- C:\Windows\System\mVTkXUw.exe
  C:\Windows\System\mVTkXUw.exe
  2⤵
  PID:6900
- C:\Windows\System\vuqatwq.exe
  C:\Windows\System\vuqatwq.exe
  2⤵
  PID:6916
- C:\Windows\System\phuWwDe.exe
  C:\Windows\System\phuWwDe.exe
  2⤵
  PID:6932
- C:\Windows\System\RBjxpjf.exe
  C:\Windows\System\RBjxpjf.exe
  2⤵
  PID:6948
- C:\Windows\System\VUsCzqy.exe
  C:\Windows\System\VUsCzqy.exe
  2⤵
  PID:6964
- C:\Windows\System\ULFAAOK.exe
  C:\Windows\System\ULFAAOK.exe
  2⤵
  PID:6980
- C:\Windows\System\YhUIRYk.exe
  C:\Windows\System\YhUIRYk.exe
  2⤵
  PID:6996
- C:\Windows\System\anFpKgJ.exe
  C:\Windows\System\anFpKgJ.exe
  2⤵
  PID:7012
- C:\Windows\System\UGYfGUN.exe
  C:\Windows\System\UGYfGUN.exe
  2⤵
  PID:7028
- C:\Windows\System\BCdokVv.exe
  C:\Windows\System\BCdokVv.exe
  2⤵
  PID:7044
- C:\Windows\System\fXnxEsi.exe
  C:\Windows\System\fXnxEsi.exe
  2⤵
  PID:7060
- C:\Windows\System\brAiQop.exe
  C:\Windows\System\brAiQop.exe
  2⤵
  PID:7076
- C:\Windows\System\cyytiBS.exe
  C:\Windows\System\cyytiBS.exe
  2⤵
  PID:7092
- C:\Windows\System\XTtWwDD.exe
  C:\Windows\System\XTtWwDD.exe
  2⤵
  PID:7108
- C:\Windows\System\kXsdgdL.exe
  C:\Windows\System\kXsdgdL.exe
  2⤵
  PID:7124
- C:\Windows\System\xGMtrXC.exe
  C:\Windows\System\xGMtrXC.exe
  2⤵
  PID:7140
- C:\Windows\System\TWlMktV.exe
  C:\Windows\System\TWlMktV.exe
  2⤵
  PID:7156
- C:\Windows\System\ELUmnyi.exe
  C:\Windows\System\ELUmnyi.exe
  2⤵
  PID:5880
- C:\Windows\System\aLcDHVu.exe
  C:\Windows\System\aLcDHVu.exe
  2⤵
  PID:5900
- C:\Windows\System\yfknVaJ.exe
  C:\Windows\System\yfknVaJ.exe
  2⤵
  PID:5816
- C:\Windows\System\NlbkQjT.exe
  C:\Windows\System\NlbkQjT.exe
  2⤵
  PID:5740
- C:\Windows\System\AubkUFb.exe
  C:\Windows\System\AubkUFb.exe
  2⤵
  PID:5988
- C:\Windows\System\AGoHiPf.exe
  C:\Windows\System\AGoHiPf.exe
  2⤵
  PID:2740
- C:\Windows\System\nNJZMlH.exe
  C:\Windows\System\nNJZMlH.exe
  2⤵
  PID:5164
- C:\Windows\System\tkUyJsL.exe
  C:\Windows\System\tkUyJsL.exe
  2⤵
  PID:5312
- C:\Windows\System\gleiWWw.exe
  C:\Windows\System\gleiWWw.exe
  2⤵
  PID:5852
- C:\Windows\System\ybkaCAR.exe
  C:\Windows\System\ybkaCAR.exe
  2⤵
  PID:5168
- C:\Windows\System\WVKazIH.exe
  C:\Windows\System\WVKazIH.exe
  2⤵
  PID:5820
- C:\Windows\System\RSRwWUr.exe
  C:\Windows\System\RSRwWUr.exe
  2⤵
  PID:5972
- C:\Windows\System\YGgcigM.exe
  C:\Windows\System\YGgcigM.exe
  2⤵
  PID:6120
- C:\Windows\System\OuiFMDC.exe
  C:\Windows\System\OuiFMDC.exe
  2⤵
  PID:2984
- C:\Windows\System\PrSBtHn.exe
  C:\Windows\System\PrSBtHn.exe
  2⤵
  PID:5572
- C:\Windows\System\NWltFNk.exe
  C:\Windows\System\NWltFNk.exe
  2⤵
  PID:5576
- C:\Windows\System\mgYujQi.exe
  C:\Windows\System\mgYujQi.exe
  2⤵
  PID:6148
- C:\Windows\System\HLuGnvR.exe
  C:\Windows\System\HLuGnvR.exe
  2⤵
  PID:6212
- C:\Windows\System\NFnzflz.exe
  C:\Windows\System\NFnzflz.exe
  2⤵
  PID:6284
- C:\Windows\System\kBdWXak.exe
  C:\Windows\System\kBdWXak.exe
  2⤵
  PID:6300
- C:\Windows\System\rrabhTH.exe
  C:\Windows\System\rrabhTH.exe
  2⤵
  PID:6316
- C:\Windows\System\VGlFgKF.exe
  C:\Windows\System\VGlFgKF.exe
  2⤵
  PID:6332
- C:\Windows\System\ZaGnhrS.exe
  C:\Windows\System\ZaGnhrS.exe
  2⤵
  PID:6348
- C:\Windows\System\oLGRnlP.exe
  C:\Windows\System\oLGRnlP.exe
  2⤵
  PID:6160
- C:\Windows\System\gVXXcLG.exe
  C:\Windows\System\gVXXcLG.exe
  2⤵
  PID:6196
- C:\Windows\System\AefZYog.exe
  C:\Windows\System\AefZYog.exe
  2⤵
  PID:6228
- C:\Windows\System\ggQitRB.exe
  C:\Windows\System\ggQitRB.exe
  2⤵
  PID:6388
- C:\Windows\System\ZkOgQnU.exe
  C:\Windows\System\ZkOgQnU.exe
  2⤵
  PID:6428
- C:\Windows\System\oAvyOpQ.exe
  C:\Windows\System\oAvyOpQ.exe
  2⤵
  PID:6408
- C:\Windows\System\VcpPeQW.exe
  C:\Windows\System\VcpPeQW.exe
  2⤵
  PID:6448
- C:\Windows\System\lPJUTyb.exe
  C:\Windows\System\lPJUTyb.exe
  2⤵
  PID:6516
- C:\Windows\System\ZXsIttP.exe
  C:\Windows\System\ZXsIttP.exe
  2⤵
  PID:6580
- C:\Windows\System\rkwuGAz.exe
  C:\Windows\System\rkwuGAz.exe
  2⤵
  PID:6464
- C:\Windows\System\MVZmLkv.exe
  C:\Windows\System\MVZmLkv.exe
  2⤵
  PID:6528
- C:\Windows\System\gMoahNE.exe
  C:\Windows\System\gMoahNE.exe
  2⤵
  PID:6564
- C:\Windows\System\YUAXNiv.exe
  C:\Windows\System\YUAXNiv.exe
  2⤵
  PID:6656
- C:\Windows\System\cnzDpBe.exe
  C:\Windows\System\cnzDpBe.exe
  2⤵
  PID:6696
- C:\Windows\System\jVNOXqd.exe
  C:\Windows\System\jVNOXqd.exe
  2⤵
  PID:6764
- C:\Windows\System\pjJnrpk.exe
  C:\Windows\System\pjJnrpk.exe
  2⤵
  PID:6712
- C:\Windows\System\xvniWYw.exe
  C:\Windows\System\xvniWYw.exe
  2⤵
  PID:6716
- C:\Windows\System\nvtgGff.exe
  C:\Windows\System\nvtgGff.exe
  2⤵
  PID:6680
- C:\Windows\System\ArffNYZ.exe
  C:\Windows\System\ArffNYZ.exe
  2⤵
  PID:2940
- C:\Windows\System\IzOvpmg.exe
  C:\Windows\System\IzOvpmg.exe
  2⤵
  PID:6892
- C:\Windows\System\xvgscMe.exe
  C:\Windows\System\xvgscMe.exe
  2⤵
  PID:6848
- C:\Windows\System\mbUqZMs.exe
  C:\Windows\System\mbUqZMs.exe
  2⤵
  PID:6912
- C:\Windows\System\quUgNgU.exe
  C:\Windows\System\quUgNgU.exe
  2⤵
  PID:6976
- C:\Windows\System\aJyTKja.exe
  C:\Windows\System\aJyTKja.exe
  2⤵
  PID:6956
- C:\Windows\System\eZJdWJe.exe
  C:\Windows\System\eZJdWJe.exe
  2⤵
  PID:7020
- C:\Windows\System\RWVKuxv.exe
  C:\Windows\System\RWVKuxv.exe
  2⤵
  PID:7088
- C:\Windows\System\cqWUkvL.exe
  C:\Windows\System\cqWUkvL.exe
  2⤵
  PID:7148
- C:\Windows\System\fcrYjNZ.exe
  C:\Windows\System\fcrYjNZ.exe
  2⤵
  PID:7104
- C:\Windows\System\dIEnOEP.exe
  C:\Windows\System\dIEnOEP.exe
  2⤵
  PID:7068
- C:\Windows\System\lqITEec.exe
  C:\Windows\System\lqITEec.exe
  2⤵
  PID:7164
- C:\Windows\System\JchNWOv.exe
  C:\Windows\System\JchNWOv.exe
  2⤵
  PID:5748
- C:\Windows\System\nRamUCt.exe
  C:\Windows\System\nRamUCt.exe
  2⤵
  PID:6084
- C:\Windows\System\gxOMYPp.exe
  C:\Windows\System\gxOMYPp.exe
  2⤵
  PID:5592
- C:\Windows\System\aNbvgRx.exe
  C:\Windows\System\aNbvgRx.exe
  2⤵
  PID:5328
- C:\Windows\System\hNUmPjl.exe
  C:\Windows\System\hNUmPjl.exe
  2⤵
  PID:5948
- C:\Windows\System\HGjFlWk.exe
  C:\Windows\System\HGjFlWk.exe
  2⤵
  PID:5452
- C:\Windows\System\JSAFaqo.exe
  C:\Windows\System\JSAFaqo.exe
  2⤵
  PID:6072
- C:\Windows\System\eHzrSTK.exe
  C:\Windows\System\eHzrSTK.exe
  2⤵
  PID:5812
- C:\Windows\System\XRvCttP.exe
  C:\Windows\System\XRvCttP.exe
  2⤵
  PID:6276
- C:\Windows\System\NkpWUEJ.exe
  C:\Windows\System\NkpWUEJ.exe
  2⤵
  PID:6312
- C:\Windows\System\mzeVeOO.exe
  C:\Windows\System\mzeVeOO.exe
  2⤵
  PID:5620
- C:\Windows\System\RtCdssj.exe
  C:\Windows\System\RtCdssj.exe
  2⤵
  PID:6396
- C:\Windows\System\MQfiODa.exe
  C:\Windows\System\MQfiODa.exe
  2⤵
  PID:6192
- C:\Windows\System\ufqwGYS.exe
  C:\Windows\System\ufqwGYS.exe
  2⤵
  PID:6548
- C:\Windows\System\AbtmrfX.exe
  C:\Windows\System\AbtmrfX.exe
  2⤵
  PID:6480
- C:\Windows\System\IMcaHGS.exe
  C:\Windows\System\IMcaHGS.exe
  2⤵
  PID:6628
- C:\Windows\System\uQtztvf.exe
  C:\Windows\System\uQtztvf.exe
  2⤵
  PID:6596
- C:\Windows\System\YvdhveT.exe
  C:\Windows\System\YvdhveT.exe
  2⤵
  PID:6732
- C:\Windows\System\mlSkJZL.exe
  C:\Windows\System\mlSkJZL.exe
  2⤵
  PID:6808
- C:\Windows\System\rRBghyY.exe
  C:\Windows\System\rRBghyY.exe
  2⤵
  PID:6924
- C:\Windows\System\mfqEHcu.exe
  C:\Windows\System\mfqEHcu.exe
  2⤵
  PID:7036
- C:\Windows\System\KhoSYel.exe
  C:\Windows\System\KhoSYel.exe
  2⤵
  PID:6812
- C:\Windows\System\Kujzfod.exe
  C:\Windows\System\Kujzfod.exe
  2⤵
  PID:6832
- C:\Windows\System\EwHBtgg.exe
  C:\Windows\System\EwHBtgg.exe
  2⤵
  PID:6992
- C:\Windows\System\lnRDCZy.exe
  C:\Windows\System\lnRDCZy.exe
  2⤵
  PID:7008
- C:\Windows\System\rmnFUvT.exe
  C:\Windows\System\rmnFUvT.exe
  2⤵
  PID:5984
- C:\Windows\System\VwKodty.exe
  C:\Windows\System\VwKodty.exe
  2⤵
  PID:5652
- C:\Windows\System\siqXSos.exe
  C:\Windows\System\siqXSos.exe
  2⤵
  PID:6644
- C:\Windows\System\CuJVAFl.exe
  C:\Windows\System\CuJVAFl.exe
  2⤵
  PID:6460
- C:\Windows\System\espqVEv.exe
  C:\Windows\System\espqVEv.exe
  2⤵
  PID:6728
- C:\Windows\System\gBzILGs.exe
  C:\Windows\System\gBzILGs.exe
  2⤵
  PID:6500
- C:\Windows\System\WFRggPC.exe
  C:\Windows\System\WFRggPC.exe
  2⤵
  PID:2976
- C:\Windows\System\CDGQgWE.exe
  C:\Windows\System\CDGQgWE.exe
  2⤵
  PID:7084
- C:\Windows\System\kGIvKAg.exe
  C:\Windows\System\kGIvKAg.exe
  2⤵
  PID:5712
- C:\Windows\System\fFluGdV.exe
  C:\Windows\System\fFluGdV.exe
  2⤵
  PID:6944
- C:\Windows\System\zfyDUIL.exe
  C:\Windows\System\zfyDUIL.exe
  2⤵
  PID:7176
- C:\Windows\System\UqAZefN.exe
  C:\Windows\System\UqAZefN.exe
  2⤵
  PID:7192
- C:\Windows\System\FwDTcdJ.exe
  C:\Windows\System\FwDTcdJ.exe
  2⤵
  PID:7212
- C:\Windows\System\IvdIokc.exe
  C:\Windows\System\IvdIokc.exe
  2⤵
  PID:7228
- C:\Windows\System\ipAhkKy.exe
  C:\Windows\System\ipAhkKy.exe
  2⤵
  PID:7244
- C:\Windows\System\bSCQnFY.exe
  C:\Windows\System\bSCQnFY.exe
  2⤵
  PID:7284
- C:\Windows\System\ElgqFpq.exe
  C:\Windows\System\ElgqFpq.exe
  2⤵
  PID:7308
- C:\Windows\System\NSMLQBY.exe
  C:\Windows\System\NSMLQBY.exe
  2⤵
  PID:7324
- C:\Windows\System\dXBHNwY.exe
  C:\Windows\System\dXBHNwY.exe
  2⤵
  PID:7348
- C:\Windows\System\iaafHEq.exe
  C:\Windows\System\iaafHEq.exe
  2⤵
  PID:7364
- C:\Windows\System\TQLjKAO.exe
  C:\Windows\System\TQLjKAO.exe
  2⤵
  PID:7380
- C:\Windows\System\fDUDVvi.exe
  C:\Windows\System\fDUDVvi.exe
  2⤵
  PID:7396
- C:\Windows\System\lbghmqP.exe
  C:\Windows\System\lbghmqP.exe
  2⤵
  PID:7416
- C:\Windows\System\xiFopNp.exe
  C:\Windows\System\xiFopNp.exe
  2⤵
  PID:7432
- C:\Windows\System\gYlKAyy.exe
  C:\Windows\System\gYlKAyy.exe
  2⤵
  PID:7460
- C:\Windows\System\cLOIRFi.exe
  C:\Windows\System\cLOIRFi.exe
  2⤵
  PID:7476
- C:\Windows\System\dvqfdfC.exe
  C:\Windows\System\dvqfdfC.exe
  2⤵
  PID:7492
- C:\Windows\System\VpekVkE.exe
  C:\Windows\System\VpekVkE.exe
  2⤵
  PID:7512
- C:\Windows\System\thHhsee.exe
  C:\Windows\System\thHhsee.exe
  2⤵
  PID:7528
- C:\Windows\System\kKamswl.exe
  C:\Windows\System\kKamswl.exe
  2⤵
  PID:7544
- C:\Windows\System\ixhwBij.exe
  C:\Windows\System\ixhwBij.exe
  2⤵
  PID:7560
- C:\Windows\System\MiJHjjK.exe
  C:\Windows\System\MiJHjjK.exe
  2⤵
  PID:7576
- C:\Windows\System\WJistZF.exe
  C:\Windows\System\WJistZF.exe
  2⤵
  PID:7600
- C:\Windows\System\fPGmDEg.exe
  C:\Windows\System\fPGmDEg.exe
  2⤵
  PID:7656
- C:\Windows\System\QcrZmIt.exe
  C:\Windows\System\QcrZmIt.exe
  2⤵
  PID:7672
- C:\Windows\System\LlfMtiW.exe
  C:\Windows\System\LlfMtiW.exe
  2⤵
  PID:7696
- C:\Windows\System\ubObRBn.exe
  C:\Windows\System\ubObRBn.exe
  2⤵
  PID:7716
- C:\Windows\System\hQoFvcr.exe
  C:\Windows\System\hQoFvcr.exe
  2⤵
  PID:7732
- C:\Windows\System\DHEvCto.exe
  C:\Windows\System\DHEvCto.exe
  2⤵
  PID:7748
- C:\Windows\System\qCgPASP.exe
  C:\Windows\System\qCgPASP.exe
  2⤵
  PID:7764
- C:\Windows\System\fkIiUPZ.exe
  C:\Windows\System\fkIiUPZ.exe
  2⤵
  PID:7780
- C:\Windows\System\eqrpHsR.exe
  C:\Windows\System\eqrpHsR.exe
  2⤵
  PID:7800
- C:\Windows\System\MbLPoOQ.exe
  C:\Windows\System\MbLPoOQ.exe
  2⤵
  PID:7820
- C:\Windows\System\qjiVbGL.exe
  C:\Windows\System\qjiVbGL.exe
  2⤵
  PID:7836
- C:\Windows\System\qvQYJkv.exe
  C:\Windows\System\qvQYJkv.exe
  2⤵
  PID:7852
- C:\Windows\System\SLDkxjt.exe
  C:\Windows\System\SLDkxjt.exe
  2⤵
  PID:7868
- C:\Windows\System\hlyPJuL.exe
  C:\Windows\System\hlyPJuL.exe
  2⤵
  PID:7884
- C:\Windows\System\MuxoWTP.exe
  C:\Windows\System\MuxoWTP.exe
  2⤵
  PID:7900
- C:\Windows\System\kWTQyon.exe
  C:\Windows\System\kWTQyon.exe
  2⤵
  PID:7916
- C:\Windows\System\nEOKwJH.exe
  C:\Windows\System\nEOKwJH.exe
  2⤵
  PID:7932
- C:\Windows\System\rymEIjU.exe
  C:\Windows\System\rymEIjU.exe
  2⤵
  PID:7952
- C:\Windows\System\CeGkHBI.exe
  C:\Windows\System\CeGkHBI.exe
  2⤵
  PID:7980
- C:\Windows\System\AjfjesW.exe
  C:\Windows\System\AjfjesW.exe
  2⤵
  PID:8000
- C:\Windows\System\ObfSDxN.exe
  C:\Windows\System\ObfSDxN.exe
  2⤵
  PID:8028
- C:\Windows\System\HvZbTuc.exe
  C:\Windows\System\HvZbTuc.exe
  2⤵
  PID:8048
- C:\Windows\System\FmRCRhI.exe
  C:\Windows\System\FmRCRhI.exe
  2⤵
  PID:8124
- C:\Windows\System\tSuTTOu.exe
  C:\Windows\System\tSuTTOu.exe
  2⤵
  PID:8140
- C:\Windows\System\IpfCIvf.exe
  C:\Windows\System\IpfCIvf.exe
  2⤵
  PID:8164
- C:\Windows\System\oEvjrKF.exe
  C:\Windows\System\oEvjrKF.exe
  2⤵
  PID:8180
- C:\Windows\System\JohIdcO.exe
  C:\Windows\System\JohIdcO.exe
  2⤵
  PID:7188
- C:\Windows\System\YARJpQw.exe
  C:\Windows\System\YARJpQw.exe
  2⤵
  PID:7208
- C:\Windows\System\vLZcWbJ.exe
  C:\Windows\System\vLZcWbJ.exe
  2⤵
  PID:7268
- C:\Windows\System\vmWpuem.exe
  C:\Windows\System\vmWpuem.exe
  2⤵
  PID:6244
- C:\Windows\System\uffWkoK.exe
  C:\Windows\System\uffWkoK.exe
  2⤵
  PID:5872
- C:\Windows\System\nGKngrZ.exe
  C:\Windows\System\nGKngrZ.exe
  2⤵
  PID:7240
- C:\Windows\System\EgKXwyc.exe
  C:\Windows\System\EgKXwyc.exe
  2⤵
  PID:6972
- C:\Windows\System\IyHsIuG.exe
  C:\Windows\System\IyHsIuG.exe
  2⤵
  PID:5512
- C:\Windows\System\EFFSGmv.exe
  C:\Windows\System\EFFSGmv.exe
  2⤵
  PID:7056
- C:\Windows\System\MGFBGNQ.exe
  C:\Windows\System\MGFBGNQ.exe
  2⤵
  PID:7152
- C:\Windows\System\gWGUFcP.exe
  C:\Windows\System\gWGUFcP.exe
  2⤵
  PID:7296
- C:\Windows\System\GZGLIuQ.exe
  C:\Windows\System\GZGLIuQ.exe
  2⤵
  PID:7388
- C:\Windows\System\BOUMDMc.exe
  C:\Windows\System\BOUMDMc.exe
  2⤵
  PID:7408
- C:\Windows\System\OsKOplo.exe
  C:\Windows\System\OsKOplo.exe
  2⤵
  PID:7448
- C:\Windows\System\gKrfMGs.exe
  C:\Windows\System\gKrfMGs.exe
  2⤵
  PID:7344
- C:\Windows\System\kNsjYNM.exe
  C:\Windows\System\kNsjYNM.exe
  2⤵
  PID:7404
- C:\Windows\System\sDtTBeY.exe
  C:\Windows\System\sDtTBeY.exe
  2⤵
  PID:7472
- C:\Windows\System\VbEdSGQ.exe
  C:\Windows\System\VbEdSGQ.exe
  2⤵
  PID:7632
- C:\Windows\System\ryQNtni.exe
  C:\Windows\System\ryQNtni.exe
  2⤵
  PID:7636
- C:\Windows\System\NrFWcDO.exe
  C:\Windows\System\NrFWcDO.exe
  2⤵
  PID:7592
- C:\Windows\System\brRivnz.exe
  C:\Windows\System\brRivnz.exe
  2⤵
  PID:7652
- C:\Windows\System\TsVuQTz.exe
  C:\Windows\System\TsVuQTz.exe
  2⤵
  PID:7612
- C:\Windows\System\CEXuYni.exe
  C:\Windows\System\CEXuYni.exe
  2⤵
  PID:7756
- C:\Windows\System\IFNQjuB.exe
  C:\Windows\System\IFNQjuB.exe
  2⤵
  PID:7796
- C:\Windows\System\ktUtVOD.exe
  C:\Windows\System\ktUtVOD.exe
  2⤵
  PID:7892
- C:\Windows\System\ETZuSUZ.exe
  C:\Windows\System\ETZuSUZ.exe
  2⤵
  PID:7708
- C:\Windows\System\yfRcaWk.exe
  C:\Windows\System\yfRcaWk.exe
  2⤵
  PID:7772
- C:\Windows\System\GVOVxqC.exe
  C:\Windows\System\GVOVxqC.exe
  2⤵
  PID:7968
- C:\Windows\System\JpBZeuP.exe
  C:\Windows\System\JpBZeuP.exe
  2⤵
  PID:8020
- C:\Windows\System\qWOLrRi.exe
  C:\Windows\System\qWOLrRi.exe
  2⤵
  PID:7996
- C:\Windows\System\lHAGJLR.exe
  C:\Windows\System\lHAGJLR.exe
  2⤵
  PID:7848
- C:\Windows\System\QFlZLAt.exe
  C:\Windows\System\QFlZLAt.exe
  2⤵
  PID:7912
- C:\Windows\System\LRNLjPI.exe
  C:\Windows\System\LRNLjPI.exe
  2⤵
  PID:8044
- C:\Windows\System\kquGSst.exe
  C:\Windows\System\kquGSst.exe
  2⤵
  PID:8084
- C:\Windows\System\emIWaSL.exe
  C:\Windows\System\emIWaSL.exe
  2⤵
  PID:8112
- C:\Windows\System\lsSczOw.exe
  C:\Windows\System\lsSczOw.exe
  2⤵
  PID:8136
- C:\Windows\System\YSnlsmV.exe
  C:\Windows\System\YSnlsmV.exe
  2⤵
  PID:8172
- C:\Windows\System\yKqvKPj.exe
  C:\Windows\System\yKqvKPj.exe
  2⤵
  PID:6660
- C:\Windows\System\aOBUgbC.exe
  C:\Windows\System\aOBUgbC.exe
  2⤵
  PID:7260
- C:\Windows\System\xLLkfMb.exe
  C:\Windows\System\xLLkfMb.exe
  2⤵
  PID:7280
- C:\Windows\System\CNFusJo.exe
  C:\Windows\System\CNFusJo.exe
  2⤵
  PID:7136
- C:\Windows\System\rIQWOie.exe
  C:\Windows\System\rIQWOie.exe
  2⤵
  PID:7236
- C:\Windows\System\YWROaMp.exe
  C:\Windows\System\YWROaMp.exe
  2⤵
  PID:5676
- C:\Windows\System\TFdJFoL.exe
  C:\Windows\System\TFdJFoL.exe
  2⤵
  PID:7424
- C:\Windows\System\GzKMpWr.exe
  C:\Windows\System\GzKMpWr.exe
  2⤵
  PID:7468
- C:\Windows\System\IYekdAq.exe
  C:\Windows\System\IYekdAq.exe
  2⤵
  PID:7336
- C:\Windows\System\uzDWVRW.exe
  C:\Windows\System\uzDWVRW.exe
  2⤵
  PID:7372
- C:\Windows\System\MceGclz.exe
  C:\Windows\System\MceGclz.exe
  2⤵
  PID:7608
- C:\Windows\System\UrsqZnQ.exe
  C:\Windows\System\UrsqZnQ.exe
  2⤵
  PID:7620
- C:\Windows\System\OUtIqPL.exe
  C:\Windows\System\OUtIqPL.exe
  2⤵
  PID:7584
- C:\Windows\System\GZDsFOZ.exe
  C:\Windows\System\GZDsFOZ.exe
  2⤵
  PID:7684
- C:\Windows\System\jLZNZQv.exe
  C:\Windows\System\jLZNZQv.exe
  2⤵
  PID:7924
- C:\Windows\System\GbuqWaA.exe
  C:\Windows\System\GbuqWaA.exe
  2⤵
  PID:7744
- C:\Windows\System\PipFHkv.exe
  C:\Windows\System\PipFHkv.exe
  2⤵
  PID:7812
- C:\Windows\System\icQYBhV.exe
  C:\Windows\System\icQYBhV.exe
  2⤵
  PID:8036
- C:\Windows\System\UKlIogB.exe
  C:\Windows\System\UKlIogB.exe
  2⤵
  PID:8104
- C:\Windows\System\UiyYJZg.exe
  C:\Windows\System\UiyYJZg.exe
  2⤵
  PID:6864
- C:\Windows\System\HFudqwk.exe
  C:\Windows\System\HFudqwk.exe
  2⤵
  PID:7880
- C:\Windows\System\NcaVBPe.exe
  C:\Windows\System\NcaVBPe.exe
  2⤵
  PID:8188
- C:\Windows\System\iTzmFxR.exe
  C:\Windows\System\iTzmFxR.exe
  2⤵
  PID:7360
- C:\Windows\System\eXQeIsx.exe
  C:\Windows\System\eXQeIsx.exe
  2⤵
  PID:7992
- C:\Windows\System\xeDvBZf.exe
  C:\Windows\System\xeDvBZf.exe
  2⤵
  PID:6340
- C:\Windows\System\wlWgPtZ.exe
  C:\Windows\System\wlWgPtZ.exe
  2⤵
  PID:6908
- C:\Windows\System\qywGSoP.exe
  C:\Windows\System\qywGSoP.exe
  2⤵
  PID:8108
- C:\Windows\System\JeUJWOg.exe
  C:\Windows\System\JeUJWOg.exe
  2⤵
  PID:7540
- C:\Windows\System\PjYEdof.exe
  C:\Windows\System\PjYEdof.exe
  2⤵
  PID:7500
- C:\Windows\System\HBsDDtE.exe
  C:\Windows\System\HBsDDtE.exe
  2⤵
  PID:7552
- C:\Windows\System\OGCyoIb.exe
  C:\Windows\System\OGCyoIb.exe
  2⤵
  PID:7664
- C:\Windows\System\duXxJYk.exe
  C:\Windows\System\duXxJYk.exe
  2⤵
  PID:7988
- C:\Windows\System\DbkQqvK.exe
  C:\Windows\System\DbkQqvK.exe
  2⤵
  PID:8092
- C:\Windows\System\MktjrcT.exe
  C:\Windows\System\MktjrcT.exe
  2⤵
  PID:8152
- C:\Windows\System\CGHyaId.exe
  C:\Windows\System\CGHyaId.exe
  2⤵
  PID:8012
- C:\Windows\System\DOdReCZ.exe
  C:\Windows\System\DOdReCZ.exe
  2⤵
  PID:8024
- C:\Windows\System\cfQgPWK.exe
  C:\Windows\System\cfQgPWK.exe
  2⤵
  PID:7276
- C:\Windows\System\fsZSdxE.exe
  C:\Windows\System\fsZSdxE.exe
  2⤵
  PID:1564
- C:\Windows\System\IJflWkA.exe
  C:\Windows\System\IJflWkA.exe
  2⤵
  PID:7256
- C:\Windows\System\dJqDWrF.exe
  C:\Windows\System\dJqDWrF.exe
  2⤵
  PID:7668
- C:\Windows\System\ErgbJQD.exe
  C:\Windows\System\ErgbJQD.exe
  2⤵
  PID:8096
- C:\Windows\System\bOAJKIH.exe
  C:\Windows\System\bOAJKIH.exe
  2⤵
  PID:7976
- C:\Windows\System\PmMuvwl.exe
  C:\Windows\System\PmMuvwl.exe
  2⤵
  PID:6356
- C:\Windows\System\beYrZLq.exe
  C:\Windows\System\beYrZLq.exe
  2⤵
  PID:7640
- C:\Windows\System\VFPKgIJ.exe
  C:\Windows\System\VFPKgIJ.exe
  2⤵
  PID:7948
- C:\Windows\System\lHAtIWC.exe
  C:\Windows\System\lHAtIWC.exe
  2⤵
  PID:6376
- C:\Windows\System\zSDNdTu.exe
  C:\Windows\System\zSDNdTu.exe
  2⤵
  PID:8160
- C:\Windows\System\cijcTXH.exe
  C:\Windows\System\cijcTXH.exe
  2⤵
  PID:7456
- C:\Windows\System\yNeXKMj.exe
  C:\Windows\System\yNeXKMj.exe
  2⤵
  PID:7776
- C:\Windows\System\ueUuHhA.exe
  C:\Windows\System\ueUuHhA.exe
  2⤵
  PID:7320
- C:\Windows\System\BHHWRtr.exe
  C:\Windows\System\BHHWRtr.exe
  2⤵
  PID:6264
- C:\Windows\System\JBKqwUv.exe
  C:\Windows\System\JBKqwUv.exe
  2⤵
  PID:7316
- C:\Windows\System\iBSUeFN.exe
  C:\Windows\System\iBSUeFN.exe
  2⤵
  PID:7628
- C:\Windows\System\wpaoFyA.exe
  C:\Windows\System\wpaoFyA.exe
  2⤵
  PID:8208
- C:\Windows\System\WsgDapE.exe
  C:\Windows\System\WsgDapE.exe
  2⤵
  PID:8256
- C:\Windows\System\HYrfSbY.exe
  C:\Windows\System\HYrfSbY.exe
  2⤵
  PID:8272
- C:\Windows\System\QVwLMsF.exe
  C:\Windows\System\QVwLMsF.exe
  2⤵
  PID:8296
- C:\Windows\System\YiQkjat.exe
  C:\Windows\System\YiQkjat.exe
  2⤵
  PID:8312
- C:\Windows\System\hLTAmCF.exe
  C:\Windows\System\hLTAmCF.exe
  2⤵
  PID:8328
- C:\Windows\System\kZIrahA.exe
  C:\Windows\System\kZIrahA.exe
  2⤵
  PID:8348
- C:\Windows\System\kSVbIaF.exe
  C:\Windows\System\kSVbIaF.exe
  2⤵
  PID:8364
- C:\Windows\System\JCEEtAL.exe
  C:\Windows\System\JCEEtAL.exe
  2⤵
  PID:8396
- C:\Windows\System\HsAnedE.exe
  C:\Windows\System\HsAnedE.exe
  2⤵
  PID:8416
- C:\Windows\System\qRpkxnh.exe
  C:\Windows\System\qRpkxnh.exe
  2⤵
  PID:8432
- C:\Windows\System\qrXZATn.exe
  C:\Windows\System\qrXZATn.exe
  2⤵
  PID:8448
- C:\Windows\System\vzvNFUa.exe
  C:\Windows\System\vzvNFUa.exe
  2⤵
  PID:8472
- C:\Windows\System\LEOsKlL.exe
  C:\Windows\System\LEOsKlL.exe
  2⤵
  PID:8492
- C:\Windows\System\YuMCkix.exe
  C:\Windows\System\YuMCkix.exe
  2⤵
  PID:8520
- C:\Windows\System\yxtZDNS.exe
  C:\Windows\System\yxtZDNS.exe
  2⤵
  PID:8540
- C:\Windows\System\TQuNKni.exe
  C:\Windows\System\TQuNKni.exe
  2⤵
  PID:8560
- C:\Windows\System\QwvOCJN.exe
  C:\Windows\System\QwvOCJN.exe
  2⤵
  PID:8576
- C:\Windows\System\PgfWhMg.exe
  C:\Windows\System\PgfWhMg.exe
  2⤵
  PID:8592
- C:\Windows\System\rZJvEnL.exe
  C:\Windows\System\rZJvEnL.exe
  2⤵
  PID:8608
- C:\Windows\System\PnFLqAY.exe
  C:\Windows\System\PnFLqAY.exe
  2⤵
  PID:8628
- C:\Windows\System\VdUOrwb.exe
  C:\Windows\System\VdUOrwb.exe
  2⤵
  PID:8652
- C:\Windows\System\VgSKVEX.exe
  C:\Windows\System\VgSKVEX.exe
  2⤵
  PID:8672
- C:\Windows\System\HEgDSsM.exe
  C:\Windows\System\HEgDSsM.exe
  2⤵
  PID:8692
- C:\Windows\System\WkbTyAL.exe
  C:\Windows\System\WkbTyAL.exe
  2⤵
  PID:8712
- C:\Windows\System\EeNVgqG.exe
  C:\Windows\System\EeNVgqG.exe
  2⤵
  PID:8728
- C:\Windows\System\auBUGaW.exe
  C:\Windows\System\auBUGaW.exe
  2⤵
  PID:8756
- C:\Windows\System\NHtUZSe.exe
  C:\Windows\System\NHtUZSe.exe
  2⤵
  PID:8776
- C:\Windows\System\eDwROqH.exe
  C:\Windows\System\eDwROqH.exe
  2⤵
  PID:8796
- C:\Windows\System\aAjXAJk.exe
  C:\Windows\System\aAjXAJk.exe
  2⤵
  PID:8820
- C:\Windows\System\FGzZxUX.exe
  C:\Windows\System\FGzZxUX.exe
  2⤵
  PID:8840
- C:\Windows\System\wioLOZC.exe
  C:\Windows\System\wioLOZC.exe
  2⤵
  PID:8860
- C:\Windows\System\vWWJlDy.exe
  C:\Windows\System\vWWJlDy.exe
  2⤵
  PID:8876
- C:\Windows\System\cVVTYYk.exe
  C:\Windows\System\cVVTYYk.exe
  2⤵
  PID:8904
- C:\Windows\System\kvhxGrL.exe
  C:\Windows\System\kvhxGrL.exe
  2⤵
  PID:8924
- C:\Windows\System\MsZugfw.exe
  C:\Windows\System\MsZugfw.exe
  2⤵
  PID:8948
- C:\Windows\System\yAIKxBm.exe
  C:\Windows\System\yAIKxBm.exe
  2⤵
  PID:8964
- C:\Windows\System\qTnAbjt.exe
  C:\Windows\System\qTnAbjt.exe
  2⤵
  PID:8980
- C:\Windows\System\XVgNIcV.exe
  C:\Windows\System\XVgNIcV.exe
  2⤵
  PID:8996
- C:\Windows\System\MQdIRVz.exe
  C:\Windows\System\MQdIRVz.exe
  2⤵
  PID:9016
- C:\Windows\System\HJnkhym.exe
  C:\Windows\System\HJnkhym.exe
  2⤵
  PID:9044
- C:\Windows\System\JmCGwhG.exe
  C:\Windows\System\JmCGwhG.exe
  2⤵
  PID:9064
- C:\Windows\System\eRqMpRJ.exe
  C:\Windows\System\eRqMpRJ.exe
  2⤵
  PID:9092
- C:\Windows\System\WiAyVVC.exe
  C:\Windows\System\WiAyVVC.exe
  2⤵
  PID:9108
- C:\Windows\System\paeuqPr.exe
  C:\Windows\System\paeuqPr.exe
  2⤵
  PID:9124
- C:\Windows\System\pcxjkkE.exe
  C:\Windows\System\pcxjkkE.exe
  2⤵
  PID:9148
- C:\Windows\System\FLGanlV.exe
  C:\Windows\System\FLGanlV.exe
  2⤵
  PID:9172
- C:\Windows\System\xDOgwFQ.exe
  C:\Windows\System\xDOgwFQ.exe
  2⤵
  PID:9188
- C:\Windows\System\qjdaKFx.exe
  C:\Windows\System\qjdaKFx.exe
  2⤵
  PID:9204
- C:\Windows\System\nPgketr.exe
  C:\Windows\System\nPgketr.exe
  2⤵
  PID:8200
- C:\Windows\System\rDdvQLm.exe
  C:\Windows\System\rDdvQLm.exe
  2⤵
  PID:7120
- C:\Windows\System\aCPGjbl.exe
  C:\Windows\System\aCPGjbl.exe
  2⤵
  PID:8236
- C:\Windows\System\nhIezjj.exe
  C:\Windows\System\nhIezjj.exe
  2⤵
  PID:8264
- C:\Windows\System\LFTqGoU.exe
  C:\Windows\System\LFTqGoU.exe
  2⤵
  PID:8304
- C:\Windows\System\NNrJwDi.exe
  C:\Windows\System\NNrJwDi.exe
  2⤵
  PID:8324
- C:\Windows\System\wfmISnq.exe
  C:\Windows\System\wfmISnq.exe
  2⤵
  PID:8380
- C:\Windows\System\PwtOUgy.exe
  C:\Windows\System\PwtOUgy.exe
  2⤵
  PID:8404
- C:\Windows\System\cSRmVOI.exe
  C:\Windows\System\cSRmVOI.exe
  2⤵
  PID:8456
- C:\Windows\System\vJrmjfv.exe
  C:\Windows\System\vJrmjfv.exe
  2⤵
  PID:8480
- C:\Windows\System\gGrPEMF.exe
  C:\Windows\System\gGrPEMF.exe
  2⤵
  PID:8484
- C:\Windows\System\DqYGxtb.exe
  C:\Windows\System\DqYGxtb.exe
  2⤵
  PID:8516
- C:\Windows\System\QnEYeNm.exe
  C:\Windows\System\QnEYeNm.exe
  2⤵
  PID:8556
- C:\Windows\System\ihZxJRu.exe
  C:\Windows\System\ihZxJRu.exe
  2⤵
  PID:8588
- C:\Windows\System\qiJyKXm.exe
  C:\Windows\System\qiJyKXm.exe
  2⤵
  PID:8624
- C:\Windows\System\FroNZMb.exe
  C:\Windows\System\FroNZMb.exe
  2⤵
  PID:8660
- C:\Windows\System\jvDbYzR.exe
  C:\Windows\System\jvDbYzR.exe
  2⤵
  PID:8680
- C:\Windows\System\aZvFrxL.exe
  C:\Windows\System\aZvFrxL.exe
  2⤵
  PID:8748
- C:\Windows\System\Npmcypf.exe
  C:\Windows\System\Npmcypf.exe
  2⤵
  PID:8764
- C:\Windows\System\VZPfmDR.exe
  C:\Windows\System\VZPfmDR.exe
  2⤵
  PID:8768
- C:\Windows\System\cXcPvRt.exe
  C:\Windows\System\cXcPvRt.exe
  2⤵
  PID:8812
- C:\Windows\System\UHACTWe.exe
  C:\Windows\System\UHACTWe.exe
  2⤵
  PID:8856
- C:\Windows\System\tBKlCJp.exe
  C:\Windows\System\tBKlCJp.exe
  2⤵
  PID:8888
- C:\Windows\System\iQXkmNq.exe
  C:\Windows\System\iQXkmNq.exe
  2⤵
  PID:8916
- C:\Windows\System\mtbrmQj.exe
  C:\Windows\System\mtbrmQj.exe
  2⤵
  PID:8956
- C:\Windows\System\BmxbmcR.exe
  C:\Windows\System\BmxbmcR.exe
  2⤵
  PID:9004
- C:\Windows\System\JWhEdDe.exe
  C:\Windows\System\JWhEdDe.exe
  2⤵
  PID:9040
- C:\Windows\System\unQXWKa.exe
  C:\Windows\System\unQXWKa.exe
  2⤵
  PID:9056
- C:\Windows\System\DssseMe.exe
  C:\Windows\System\DssseMe.exe
  2⤵
  PID:9076
- C:\Windows\System\SMPJfbw.exe
  C:\Windows\System\SMPJfbw.exe
  2⤵
  PID:9120
- C:\Windows\System\ihsUjQz.exe
  C:\Windows\System\ihsUjQz.exe
  2⤵
  PID:9140
- C:\Windows\System\mYEPoBR.exe
  C:\Windows\System\mYEPoBR.exe
  2⤵
  PID:9168
- C:\Windows\System\sIAgxSJ.exe
  C:\Windows\System\sIAgxSJ.exe
  2⤵
  PID:7252
- C:\Windows\System\qXezGCm.exe
  C:\Windows\System\qXezGCm.exe
  2⤵
  PID:8216
- C:\Windows\System\znMhFBy.exe
  C:\Windows\System\znMhFBy.exe
  2⤵
  PID:8252
- C:\Windows\System\yWFFsvG.exe
  C:\Windows\System\yWFFsvG.exe
  2⤵
  PID:8320
- C:\Windows\System\gAMmBRg.exe
  C:\Windows\System\gAMmBRg.exe
  2⤵
  PID:8344
- C:\Windows\System\RGODucN.exe
  C:\Windows\System\RGODucN.exe
  2⤵
  PID:8424
- C:\Windows\System\GrNrhmS.exe
  C:\Windows\System\GrNrhmS.exe
  2⤵
  PID:8412
- C:\Windows\System\ucUveKv.exe
  C:\Windows\System\ucUveKv.exe
  2⤵
  PID:8532
- C:\Windows\System\qfaHYaf.exe
  C:\Windows\System\qfaHYaf.exe
  2⤵
  PID:8572
- C:\Windows\System\wxDGWjE.exe
  C:\Windows\System\wxDGWjE.exe
  2⤵
  PID:8604
- C:\Windows\System\vKRNAYQ.exe
  C:\Windows\System\vKRNAYQ.exe
  2⤵
  PID:8684
- C:\Windows\System\olEfScG.exe
  C:\Windows\System\olEfScG.exe
  2⤵
  PID:8740
- C:\Windows\System\pLbffoH.exe
  C:\Windows\System\pLbffoH.exe
  2⤵
  PID:8788
- C:\Windows\System\VXENrTJ.exe
  C:\Windows\System\VXENrTJ.exe
  2⤵
  PID:8848
- C:\Windows\System\jLlxdko.exe
  C:\Windows\System\jLlxdko.exe
  2⤵
  PID:8872
- C:\Windows\System\MpGsqfc.exe
  C:\Windows\System\MpGsqfc.exe
  2⤵
  PID:8944
- C:\Windows\System\aDdKRdm.exe
  C:\Windows\System\aDdKRdm.exe
  2⤵
  PID:9032
- C:\Windows\System\JmxFsse.exe
  C:\Windows\System\JmxFsse.exe
  2⤵
  PID:9072
- C:\Windows\System\UzcSZIi.exe
  C:\Windows\System\UzcSZIi.exe
  2⤵
  PID:9136
- C:\Windows\System\tJMRQuR.exe
  C:\Windows\System\tJMRQuR.exe
  2⤵
  PID:9200
- C:\Windows\System\HLFXdPH.exe
  C:\Windows\System\HLFXdPH.exe
  2⤵
  PID:9184
- C:\Windows\System\CqZTnYc.exe
  C:\Windows\System\CqZTnYc.exe
  2⤵
  PID:8292
- C:\Windows\System\PNmHgPL.exe
  C:\Windows\System\PNmHgPL.exe
  2⤵
  PID:8288
- C:\Windows\System\HFzjsri.exe
  C:\Windows\System\HFzjsri.exe
  2⤵
  PID:8440
- C:\Windows\System\fozPFFg.exe
  C:\Windows\System\fozPFFg.exe
  2⤵
  PID:8232
- C:\Windows\System\YaXXqoE.exe
  C:\Windows\System\YaXXqoE.exe
  2⤵
  PID:8708
- C:\Windows\System\hlEnWSs.exe
  C:\Windows\System\hlEnWSs.exe
  2⤵
  PID:8600
- C:\Windows\System\YkKiJYj.exe
  C:\Windows\System\YkKiJYj.exe
  2⤵
  PID:8832
- C:\Windows\System\qeyhxpg.exe
  C:\Windows\System\qeyhxpg.exe
  2⤵
  PID:8720
- C:\Windows\System\uSHqWsz.exe
  C:\Windows\System\uSHqWsz.exe
  2⤵
  PID:9084
- C:\Windows\System\UvaHIBn.exe
  C:\Windows\System\UvaHIBn.exe
  2⤵
  PID:9008
- C:\Windows\System\sIlksFQ.exe
  C:\Windows\System\sIlksFQ.exe
  2⤵
  PID:7788
- C:\Windows\System\spraPlV.exe
  C:\Windows\System\spraPlV.exe
  2⤵
  PID:8228
- C:\Windows\System\zQArqBs.exe
  C:\Windows\System\zQArqBs.exe
  2⤵
  PID:8464
- C:\Windows\System\PjTvile.exe
  C:\Windows\System\PjTvile.exe
  2⤵
  PID:8512
- C:\Windows\System\AAyPUMs.exe
  C:\Windows\System\AAyPUMs.exe
  2⤵
  PID:8808
- C:\Windows\System\tMMagGn.exe
  C:\Windows\System\tMMagGn.exe
  2⤵
  PID:9036
- C:\Windows\System\IubiITB.exe
  C:\Windows\System\IubiITB.exe
  2⤵
  PID:9180
- C:\Windows\System\oLnNPnb.exe
  C:\Windows\System\oLnNPnb.exe
  2⤵
  PID:9164
- C:\Windows\System\YbuKjmU.exe
  C:\Windows\System\YbuKjmU.exe
  2⤵
  PID:8668
- C:\Windows\System\NzItSTE.exe
  C:\Windows\System\NzItSTE.exe
  2⤵
  PID:8244
- C:\Windows\System\rQPIuFT.exe
  C:\Windows\System\rQPIuFT.exe
  2⤵
  PID:9220
- C:\Windows\System\aBZVFva.exe
  C:\Windows\System\aBZVFva.exe
  2⤵
  PID:9240
- C:\Windows\System\NqvtYZC.exe
  C:\Windows\System\NqvtYZC.exe
  2⤵
  PID:9256
- C:\Windows\System\wTztnql.exe
  C:\Windows\System\wTztnql.exe
  2⤵
  PID:9272
- C:\Windows\System\CzoKrtr.exe
  C:\Windows\System\CzoKrtr.exe
  2⤵
  PID:9308
- C:\Windows\System\bebpFqv.exe
  C:\Windows\System\bebpFqv.exe
  2⤵
  PID:9332
- C:\Windows\System\XfTpDlF.exe
  C:\Windows\System\XfTpDlF.exe
  2⤵
  PID:9348
- C:\Windows\System\CAOVYws.exe
  C:\Windows\System\CAOVYws.exe
  2⤵
  PID:9376
- C:\Windows\System\HCCGHlm.exe
  C:\Windows\System\HCCGHlm.exe
  2⤵
  PID:9400
- C:\Windows\System\LGlQmiD.exe
  C:\Windows\System\LGlQmiD.exe
  2⤵
  PID:9416
- C:\Windows\System\LSZVoIS.exe
  C:\Windows\System\LSZVoIS.exe
  2⤵
  PID:9432
- C:\Windows\System\IPjidCL.exe
  C:\Windows\System\IPjidCL.exe
  2⤵
  PID:9452
- C:\Windows\System\EKFThuv.exe
  C:\Windows\System\EKFThuv.exe
  2⤵
  PID:9468
- C:\Windows\System\FktLXWa.exe
  C:\Windows\System\FktLXWa.exe
  2⤵
  PID:9484
- C:\Windows\System\IPoCAJT.exe
  C:\Windows\System\IPoCAJT.exe
  2⤵
  PID:9508
- C:\Windows\System\kIKaVmI.exe
  C:\Windows\System\kIKaVmI.exe
  2⤵
  PID:9536
- C:\Windows\System\CLoaOLm.exe
  C:\Windows\System\CLoaOLm.exe
  2⤵
  PID:9564
- C:\Windows\System\cOXCnKg.exe
  C:\Windows\System\cOXCnKg.exe
  2⤵
  PID:9580
- C:\Windows\System\mqfRGVC.exe
  C:\Windows\System\mqfRGVC.exe
  2⤵
  PID:9604
- C:\Windows\System\JPYoBfb.exe
  C:\Windows\System\JPYoBfb.exe
  2⤵
  PID:9624
- C:\Windows\System\vgKxDrS.exe
  C:\Windows\System\vgKxDrS.exe
  2⤵
  PID:9640
- C:\Windows\System\EcNAvYo.exe
  C:\Windows\System\EcNAvYo.exe
  2⤵
  PID:9672
- C:\Windows\System\shDyLeA.exe
  C:\Windows\System\shDyLeA.exe
  2⤵
  PID:9688
- C:\Windows\System\AqTplyM.exe
  C:\Windows\System\AqTplyM.exe
  2⤵
  PID:9704
- C:\Windows\System\yWAhaGs.exe
  C:\Windows\System\yWAhaGs.exe
  2⤵
  PID:9732
- C:\Windows\System\qPohjPI.exe
  C:\Windows\System\qPohjPI.exe
  2⤵
  PID:9748
- C:\Windows\System\ywVutUR.exe
  C:\Windows\System\ywVutUR.exe
  2⤵
  PID:9768
- C:\Windows\System\hffWfrR.exe
  C:\Windows\System\hffWfrR.exe
  2⤵
  PID:9788
- C:\Windows\System\tpWTpPF.exe
  C:\Windows\System\tpWTpPF.exe
  2⤵
  PID:9804
- C:\Windows\System\ftCTUVo.exe
  C:\Windows\System\ftCTUVo.exe
  2⤵
  PID:9820
- C:\Windows\System\GJKKnPD.exe
  C:\Windows\System\GJKKnPD.exe
  2⤵
  PID:9840
- C:\Windows\System\fhogCav.exe
  C:\Windows\System\fhogCav.exe
  2⤵
  PID:9864
- C:\Windows\System\rKDMRxn.exe
  C:\Windows\System\rKDMRxn.exe
  2⤵
  PID:9884
- C:\Windows\System\VxVseNQ.exe
  C:\Windows\System\VxVseNQ.exe
  2⤵
  PID:9904
- C:\Windows\System\vyxJige.exe
  C:\Windows\System\vyxJige.exe
  2⤵
  PID:9924
- C:\Windows\System\qAaDebG.exe
  C:\Windows\System\qAaDebG.exe
  2⤵
  PID:9948
- C:\Windows\System\iqCjyAG.exe
  C:\Windows\System\iqCjyAG.exe
  2⤵
  PID:9968
- C:\Windows\System\vbsMgIg.exe
  C:\Windows\System\vbsMgIg.exe
  2⤵
  PID:9988
- C:\Windows\System\hdzpJyd.exe
  C:\Windows\System\hdzpJyd.exe
  2⤵
  PID:10004
- C:\Windows\System\wLQLcKH.exe
  C:\Windows\System\wLQLcKH.exe
  2⤵
  PID:10028
- C:\Windows\System\qNAhCml.exe
  C:\Windows\System\qNAhCml.exe
  2⤵
  PID:10052
- C:\Windows\System\zCTZIcc.exe
  C:\Windows\System\zCTZIcc.exe
  2⤵
  PID:10068
- C:\Windows\System\mubbFcs.exe
  C:\Windows\System\mubbFcs.exe
  2⤵
  PID:10084
- C:\Windows\System\qjSPqMj.exe
  C:\Windows\System\qjSPqMj.exe
  2⤵
  PID:10104
- C:\Windows\System\ojGPQUO.exe
  C:\Windows\System\ojGPQUO.exe
  2⤵
  PID:10124
- C:\Windows\System\nllbXWh.exe
  C:\Windows\System\nllbXWh.exe
  2⤵
  PID:10144
- C:\Windows\System\KfcxeKB.exe
  C:\Windows\System\KfcxeKB.exe
  2⤵
  PID:10160
- C:\Windows\System\VbYrUFd.exe
  C:\Windows\System\VbYrUFd.exe
  2⤵
  PID:10196
- C:\Windows\System\biDCGnD.exe
  C:\Windows\System\biDCGnD.exe
  2⤵
  PID:10216
- C:\Windows\System\AqUdVnx.exe
  C:\Windows\System\AqUdVnx.exe
  2⤵
  PID:10232
- C:\Windows\System\tlFSrJs.exe
  C:\Windows\System\tlFSrJs.exe
  2⤵
  PID:9248
- C:\Windows\System\VfuLOPp.exe
  C:\Windows\System\VfuLOPp.exe
  2⤵
  PID:8356
- C:\Windows\System\EupTLRs.exe
  C:\Windows\System\EupTLRs.exe
  2⤵
  PID:8936
- C:\Windows\System\hlhnoaK.exe
  C:\Windows\System\hlhnoaK.exe
  2⤵
  PID:9236
- C:\Windows\System\aVOZIol.exe
  C:\Windows\System\aVOZIol.exe
  2⤵
  PID:8704
- C:\Windows\System\ituKWJd.exe
  C:\Windows\System\ituKWJd.exe
  2⤵
  PID:8960
- C:\Windows\System\gwhfITK.exe
  C:\Windows\System\gwhfITK.exe
  2⤵
  PID:9304
- C:\Windows\System\YVQuDPh.exe
  C:\Windows\System\YVQuDPh.exe
  2⤵
  PID:9340
- C:\Windows\System\YFKxFBd.exe
  C:\Windows\System\YFKxFBd.exe
  2⤵
  PID:9364
- C:\Windows\System\ErwyiYC.exe
  C:\Windows\System\ErwyiYC.exe
  2⤵
  PID:9388
- C:\Windows\System\aMbVJZT.exe
  C:\Windows\System\aMbVJZT.exe
  2⤵
  PID:9504
- C:\Windows\System\hfyDkxC.exe
  C:\Windows\System\hfyDkxC.exe
  2⤵
  PID:9480
- C:\Windows\System\mLIsWOM.exe
  C:\Windows\System\mLIsWOM.exe
  2⤵
  PID:9524
- C:\Windows\System\atsfApo.exe
  C:\Windows\System\atsfApo.exe
  2⤵
  PID:9448
- C:\Windows\System\VZkeBUJ.exe
  C:\Windows\System\VZkeBUJ.exe
  2⤵
  PID:9596
- C:\Windows\System\gBsFDZu.exe
  C:\Windows\System\gBsFDZu.exe
  2⤵
  PID:9636
- C:\Windows\System\qJQlOXe.exe
  C:\Windows\System\qJQlOXe.exe
  2⤵
  PID:9660
- C:\Windows\System\myGvUUJ.exe
  C:\Windows\System\myGvUUJ.exe
  2⤵
  PID:9712
- C:\Windows\System\jXVFHRC.exe
  C:\Windows\System\jXVFHRC.exe
  2⤵
  PID:9728
- C:\Windows\System\qtsPbaQ.exe
  C:\Windows\System\qtsPbaQ.exe
  2⤵
  PID:9764
- C:\Windows\System\coOTraZ.exe
  C:\Windows\System\coOTraZ.exe
  2⤵
  PID:9796
- C:\Windows\System\GrCNNgy.exe
  C:\Windows\System\GrCNNgy.exe
  2⤵
  PID:9832
- C:\Windows\System\SiEUmNh.exe
  C:\Windows\System\SiEUmNh.exe
  2⤵
  PID:9856
- C:\Windows\System\vYBBoet.exe
  C:\Windows\System\vYBBoet.exe
  2⤵
  PID:9880
- C:\Windows\System\iupMBrj.exe
  C:\Windows\System\iupMBrj.exe
  2⤵
  PID:9896
- C:\Windows\System\CWNBCbg.exe
  C:\Windows\System\CWNBCbg.exe
  2⤵
  PID:9936
- C:\Windows\System\MuvOVGW.exe
  C:\Windows\System\MuvOVGW.exe
  2⤵
  PID:9996
- C:\Windows\System\yFfBwsj.exe
  C:\Windows\System\yFfBwsj.exe
  2⤵
  PID:10000
- C:\Windows\System\toNnZos.exe
  C:\Windows\System\toNnZos.exe
  2⤵
  PID:10016
- C:\Windows\System\ibGjgTo.exe
  C:\Windows\System\ibGjgTo.exe
  2⤵
  PID:10048
- C:\Windows\System\MnVxyPv.exe
  C:\Windows\System\MnVxyPv.exe
  2⤵
  PID:10064
- C:\Windows\System\ujelOgA.exe
  C:\Windows\System\ujelOgA.exe
  2⤵
  PID:10116
- C:\Windows\System\LVZnOZH.exe
  C:\Windows\System\LVZnOZH.exe
  2⤵
  PID:10132
- C:\Windows\System\IWrPLjs.exe
  C:\Windows\System\IWrPLjs.exe
  2⤵
  PID:10176
- C:\Windows\System\gYDcIiG.exe
  C:\Windows\System\gYDcIiG.exe
  2⤵
  PID:10192
- C:\Windows\System\bWaQbOW.exe
  C:\Windows\System\bWaQbOW.exe
  2⤵
  PID:10208
- C:\Windows\System\yvOIcyc.exe
  C:\Windows\System\yvOIcyc.exe
  2⤵
  PID:8584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AnCTfYT.exe

Filesize
2.9MB

MD5
0e4adb47084b9929614411b9b4302b1f

SHA1
94e6a0bc2e7f9d1644eccd1c2a736fb8ba88f177

SHA256
9f3588cb2e280aff7ac12d22e615d7bae17991286d8399d298b2185909b5fc23

SHA512
be35e19244be9aa7d140dc1cfa43a4e72498462f80344e6ed856dae14877526560af07172083f8b0a685a7a709aa0530786dce4ddb4bbdb8e0fa72b881535e81

Download Submit
C:\Windows\system\CdCYIxv.exe

Filesize
2.9MB

MD5
ea60de2efb6016363d684a74044df18f

SHA1
b8f34f3c3da5507fa88eaa0867bfd58781257824

SHA256
260894d93392203d8b62889e8d2d8f6cd93b1bc8ac85a8e3257d3c4151e29116

SHA512
87a6cf785121b417612bd0f3496849ef52dfccb27b9fe8b546fbe91d164692cdbadea92b801c9c71a8638e84fbe921b0aa0ed8dfe33d0404782083f4815d093b

Download Submit
C:\Windows\system\DUfhabe.exe

Filesize
2.9MB

MD5
ba83740fbebc1d72fad9807c3b0dd29d

SHA1
cfd96fa91f9866f6868e283a3a69c74ddd4bb993

SHA256
80bf7aeb141eca8b9aed8678cf2f03e60eaa11fb213bdb09424e344388d6eb17

SHA512
759b6bbe10a2e9e04c4ca46f933283b797ff6bd5ebd1ad250b6ae1bbcfd8a8f5fc818827a3b8abff4290c16db416f0441cc1a87fce95d2898a59ebc94aded4bd

Download Submit
C:\Windows\system\FzxRYre.exe

Filesize
2.9MB

MD5
754f4f69a10db56008bacacc662fc851

SHA1
3919aab43e31502c850e4b317c15378ffe281b1e

SHA256
1491ecf5b929fba28e4d4d9cd7eac8d3fe864a20ff95159100e892b2a3a70382

SHA512
990905f052ddb5c12a8b864a8907fd323cdae071993779b7ea4259e967ef7dc383883f5d11fe4f5c4da780e8761d5bf5b332398d3df292df14e1234d00046ee0

Download Submit
C:\Windows\system\GaAXQbv.exe

Filesize
2.9MB

MD5
a1e1e0847403b0d6554e5e39058760c4

SHA1
9547050df011c58c1138b764ce77510c148ecc18

SHA256
2e297931dc4c4d4c4178a41b0e977df56da1626a4631d8a3b5c656cf7a2b6d66

SHA512
846cb49dd97232a97b0ad16dd5846602db7cd994ae7bbff563152ebe664702d68b376e647f7daef84f3dc3d78d57691e7e1fc47f0f19ec21438961988002446a

Download Submit
C:\Windows\system\ICSunjr.exe

Filesize
2.9MB

MD5
b49eec6eb0776b70db978c3e6b27e929

SHA1
ee2f50fff9cbc3a456b90d2d3754131271df7172

SHA256
4e3674e87ec803a19babfba3e3fcee0843684af2ce26b7c581832b3e90b6a65f

SHA512
d201cdf12d8c8e200ceca21528ca3358c80bbba5e05d6989dfe77bf2d32daa1871842bc6dcead568745c3449adc875c0a7ffe70f300210ee90e3af9474681b4a

Download Submit
C:\Windows\system\KtvZFzb.exe

Filesize
2.9MB

MD5
4428571b0fc8e76bcc0e75d5771bb25f

SHA1
5261b0dbd8981855bcb1445b62c31b97bb78f53f

SHA256
cb1b91ccc7d0a8ebe17dab704c3eb6b2c533ac0c135862c7f60eb94ad3ad0571

SHA512
1db9e9d7ca4d901044d4a41d9b8188079b67866791a6ad28d3b14ccf3c6afc2a7689239c3f8c9008a186b2c7cd034fa6cf7b507f21494235f2f9cf5ad159af50

Download Submit
C:\Windows\system\RFQUnDd.exe

Filesize
2.9MB

MD5
7e3b5b68f8fc7461d131bae9b5b8f841

SHA1
031bf55e3af3554bb48b00f1017e8aa110ddb200

SHA256
0999824c8947817561bd1617f505818b1a92935209df2adee84e1554c5f03958

SHA512
10dfa4ba7c4954a8c91c400fc8e8260108f47c0fb913c144bebdb399be8895c39ac9b66eb306cd46e9f4b1259a69aa13c36a936fb00b2cab6ff5b5cfc33c034a

Download Submit
C:\Windows\system\SGGLxQs.exe

Filesize
2.9MB

MD5
3330e506f5ebf2ee9ef5061a5bef8b30

SHA1
dca04ce305bfb7ee0b994d29fd9da208e83fea16

SHA256
068ac64f786d54cd1d1d1d1c5f1a0509cdbd7669c7b5a4d12a0d890fccb257ed

SHA512
7686702e2a05a2288b99a43d4d4d232d34e382b5185c42ada0241093b41b6bb14d066f67d09ca4e2fa1966790effef7012807e070616126476b84bfc2a9af856

Download Submit
C:\Windows\system\SQUCqOw.exe

Filesize
2.9MB

MD5
ae58197a62ab2624a7f8c99049683657

SHA1
2de17bec95deeb7e6e4f8ced87638d8399be7675

SHA256
4152a4e3578d5f14155f0083da8339f12e3371088fc9c597e8c3334440465946

SHA512
a3997dab062c0209309b8a40f0af8d4af2b33779f3af6c064b952bd5c6b122d4a0cf96013507b4cf33b55ddcec718296dca11753f10511eacabc1c5eb3c2b8b2

Download Submit
C:\Windows\system\TjJDRVF.exe

Filesize
2.9MB

MD5
86cc1f2274443c0e02ab65413f4722fc

SHA1
0709642659089a6ff2cdddb0cf99ddb1c371c09f

SHA256
7bbe5e06d65995ea144941a706379434ec78f4c37767d2c613a213ffafcbc6d9

SHA512
4df923cbc8bd4ab46ac697c99a20286be14fb6ad60d295b4412c868ec4c833633e628c4b7e74b94dfa50bff240bbaa3b4e66812ac9cc0bf557d3c74dc05c8fbf

Download Submit
C:\Windows\system\biqmfyY.exe

Filesize
2.9MB

MD5
d275075a5071fcc0f4526d15e27c5935

SHA1
247fdef05a63f61aeeee47bcd1a8c7a8412fbc99

SHA256
9e6ac043648082be1904ae495960dcc7c2dec4c7de93e0feac8976d82be6057b

SHA512
63c25e3db610b405cfd210f3c9a9dd75338c515e61646303cbd6b8c84a296359c29c4c6b8d38df2b68ebe569001709bf2c4b2f33546340783aad7411c76e2190

Download Submit
C:\Windows\system\dFEGDoa.exe

Filesize
2.9MB

MD5
c325049f3d883435d3014fa4fed0d052

SHA1
a25e2270021b39ec4ea48151bc7902d7e28df19f

SHA256
abb1e0f916a1b2c390a074e008af037dde22371fd955e1e58e553bf5d0b2e18c

SHA512
b5f32ebd563e3ec5bec0c3dd74a9064d3d82c574a45b03ba32a23ab89d7a24dd46ef1cef2d6d34c2ced59354a835c2744154586e460f106233d3fead6d5cf4f3

Download Submit
C:\Windows\system\dZMxjvo.exe

Filesize
2.9MB

MD5
d5e322caf19f5df7abf4e1a88ee37e48

SHA1
6855b15df57b6ba98a965143edb23833836dfa9a

SHA256
6c8f10f2b32f1e41cd785730da541370f4512c80fb61bc34207f7b70ba57473e

SHA512
15e8e17e3524d52ee47f7c106925ba54934a7c350289e8878cf163221e349d38a55ed4cf582e63d7d7b82440f2a782bfacbe1e53de521e7777af3c7470fe7136

Download Submit
C:\Windows\system\eDqzRCQ.exe

Filesize
2.9MB

MD5
b4cad1a66c86da6f50c242f1e41d8406

SHA1
41b8d4458162a79feb4b041ccbf073b2cc7117ac

SHA256
e1f267371999fe50f8bc4a4d5ee5dd0854cd61cf3ad1b93fdf9407225248c2a9

SHA512
5ba176a172bba379fcf67dbc7866cc068626b5a329efb7732cb3c8c7b4528cfda3e52d9943206c59567bab9c52d10400f39b3b8ebff3e998141f2e3e557527c5

Download Submit
C:\Windows\system\eJQENog.exe

Filesize
2.9MB

MD5
3af91248511da1755dc7787dad1eccb8

SHA1
35ccfc62ac0420827d097711b4ed1c9eca137924

SHA256
28940f886407a29fb26ee939fc9dd5893c5821b8cc2aad8887eb7a7280d32eda

SHA512
97a1b93d1d49d63b05cf85d5e2ce2e139bcf03561be0878d16e2be24b1f1e0658eb5b0fd4d42ceaab4fd49f8b755ca7cbd11b2ff0a9e361f490fe3c9cb4099c9

Download Submit
C:\Windows\system\gNstuiz.exe

Filesize
2.9MB

MD5
8696d9e176d2f6778a03e69bfe28ed61

SHA1
c454688cce2a9393f6bfc4bcc9d669379e031c39

SHA256
4d9f29201e669779d81eee72ad48a92040641828611901a378e033517b7c66aa

SHA512
24652e6bf2ab3c02177469184f599f0ca872d77aa917d6fc5e2dd5c4ebde80bdbe5071d473f1589bfe54bd08b0f510fc841d128d90484a88d9864b24790065b1

Download Submit
C:\Windows\system\jpCpdSy.exe

Filesize
2.9MB

MD5
46e18c966bc83b8ecae5db6c41a45fd8

SHA1
df86eae92fa39e95308f200078f79ee9153b1033

SHA256
dbe1f3c4ca488f788b27597d5424e3484a2ceb942fa36f2c626f5023a64d3cb0

SHA512
5497af42fcc623e2f367f170c9dd19a9f7ce68ae271572c80f07189c8e81f6ee2acd778a8cb110c2f0a932f2c4019b948c448681bc3cb88386eaf755521efabb

Download Submit
C:\Windows\system\lQrvMTc.exe

Filesize
2.9MB

MD5
68ce3ed0ae64f1cbff832664cba4f326

SHA1
48a6a4e8ec76b4b68667f853fac653eb1aeb1256

SHA256
dcb9c0f5da9bd95085d9c28e3350f03f23a39de8e5f77101c696aea98eb8827f

SHA512
511faf00138f03668ae2a24f7d16890f27d18271071ab084b956ac72fd26ea55da7c50934e36870cd7478d5e02f96668a654c0cdbca6338d045c0fdafb2f05d1

Download Submit
C:\Windows\system\mIwnjNw.exe

Filesize
2.9MB

MD5
3e32d99b9d06a2b40d9958bf6a2779e6

SHA1
06a31fdf0ed209f8e8f73e21a1d7b184f7b61cac

SHA256
467dfe8696b03fc7cc0227775f4e6744cfa7b4c7d194160f5319edec62c8de94

SHA512
36262a72a28f242a8de557d93e62027cb128f578a8a0f61c44f5c8ec047146cb67b57f4d7cdea0e911f58661c4ed2bd917e0321011939b757f8e0f39f224cb2e

Download Submit
C:\Windows\system\mktDyhY.exe

Filesize
2.9MB

MD5
71641034ca1a685f0900dac665d8ba2c

SHA1
775ca353633c83d89303d000f3199b720bfd2afd

SHA256
76c6448eb50fe0264866c8aae2f4f462b3ad15c059fe3bb793c68bf731e3f4d5

SHA512
efa1ffecce31661fdf0699ae2b0a906bd4d9803c0237cb6797f913667cba06eaa6d46861eb575088f4f0895f38a5d6e9025172112a5e32919486dfc62ea61747

Download Submit
C:\Windows\system\nWZAYid.exe

Filesize
2.9MB

MD5
d24228be4483a7bd63251ef5f6784a70

SHA1
89eebb660648094cea5e0da26f99b54fc164a6af

SHA256
e72dfc69f847faeff83ebe6806c12183ab99fd3c09f548961c6c409fc1dff269

SHA512
5ff673fd6faa9aea27c5504230d70d4890555bff695266e2bdb23847d1fddcb338ccfd799ddb23bd051436d252790a6bb70625f445d89a7ff75b62b050bdd037

Download Submit
C:\Windows\system\nlEPcRm.exe

Filesize
2.9MB

MD5
d3416484f521018a60bd964ec7510d92

SHA1
8253ec8ffc819e2ccf196e3bb2ae36f154348bcd

SHA256
ef7d7c7786d2e096464ebee305e4c866d2ce4792b987bfbdbe617f78bf266ff2

SHA512
c6305f0fb634ea500cb809130352dfefbc19641c15b53e8ac157c197078385b141991fc0efb755afaddd32cc7f96b2812093623a241df922c428764ba1e2784d

Download Submit
C:\Windows\system\ooMoFWb.exe

Filesize
2.9MB

MD5
f75461b5a67f9662eb098462a39e0d70

SHA1
21e203fd1a6df7a7b38b4a0e1ea7ddbc399ff569

SHA256
ef37ff69a197addcbc626c22b739de904ac3791f96a9b2c0a516cc7589020806

SHA512
8ab5349968d3e4235a5d47a5382cb3e28168718affbcf2a0717bd5278c26be26bf9989acb2488ee17afae1134f0625593798ba969f9729a98693ffbf6b99e719

Download Submit
C:\Windows\system\rAgaYEV.exe

Filesize
2.9MB

MD5
02f2dfaf495459c83190529e43b5e9e8

SHA1
32dfe0bdf0a5000efd15a778efd56daa3e1cae1a

SHA256
a92f8d4436692d0e2568601ca56b0c09520ece649127eb8c0a67fb0c76f0bb91

SHA512
9af3aa7470f433a73abf1f33d1c6a3b60df3430cadde6190eaf219b24ebe3a1c72ff76521cbbebc5f7ca0bfe13e73ffb1dbee0946ee276ea54e6f2526f698a0a

Download Submit
C:\Windows\system\xZQLTZI.exe

Filesize
2.9MB

MD5
1f325117e6ee1978763f8d4f03d842f3

SHA1
8906fff657a17fac921fa5e01a4389a6ce1799cf

SHA256
b57220d5130079c3e93ed5fbe66144604908ed17f78fdfda4f0fd3c2f4fe2c17

SHA512
11ceeeac0dcbf26222cbc882d5f7ca4f6c56e591441a2b7f2939e584cbe91124058a610c1bce90c5e2b82237964c0ab252efb5e70c02706b3a83683e77e15ebd

Download Submit
\Windows\system\FDjhHGH.exe

Filesize
2.9MB

MD5
d69a5056d230499b07d3394073318b85

SHA1
c775927128624d54c646f1685354ca3ca4418b92

SHA256
dcc7caa62437bfc40b40f4512c1428463c0442924c117c3be35a7623efc23478

SHA512
e0ee5831a204138932b51f21434bfe2819f5ae7d36e03ccbba86312430b31de139a4bdc0de12e01238e9b663654214d3ad6e7e4d2a02b4fd9ef5fd64e75a6a93

Download Submit
\Windows\system\Tbympsk.exe

Filesize
2.9MB

MD5
545293a614515fa86748a33019ab102a

SHA1
bc4ebd2be430b4b89fa6f74735c48307af1406fa

SHA256
fbf8883328d58c07d5858f0dc68909a84c32126b73fdf15478fc80b226016d18

SHA512
d4172badfa3d81d0832e235b21178b987faf6a3b5779c4773fd0682f7782ef2358d0ce7a46aa0a7e34f08218619a595a71e244c07d416e8d773ec7026dae785c

Download Submit
\Windows\system\eaxjwTT.exe

Filesize
2.9MB

MD5
68311958a0bcb82e5cc56bd906f0e062

SHA1
5a3c65675932b197e90cbd47d44d78d4e705a35c

SHA256
44931c08531c88f9f965a590696e9328080d8e3738e3cca7dc607d27a491ee6e

SHA512
8752ec07a6e535810fa210fcba8e69c051a642a4840994be7c8185405d923ce755947d39e4bb9ea7a3154de2d10502559fffd100887230254c82f42757fdf221

Download Submit
\Windows\system\iISdxzn.exe

Filesize
2.9MB

MD5
79bd54fa92119a2f01abbef2246bfc99

SHA1
4b0add4a16d1bf8d26b73370159431435348591d

SHA256
d94d0052009341e06b35e40392fd1f177f2a549e841839a855ef949812e8874d

SHA512
8827ba55a2be99ffbc50c4b7d4bfac87de0c47ef5e6df0181d8422d2e2748f420037797f53f697abe7b280490cb406ee61d0fcfdc371c2b851303308b1280c39

Download Submit
\Windows\system\lprDNiV.exe

Filesize
2.9MB

MD5
9521fff31d4bf163919a421a49113f17

SHA1
2467a4a04cba2e32afffb5389be64d22379d4df2

SHA256
7eaf313ca3f776364f2205c31f1f5d162652bd657d8f241275cdb4b310712c57

SHA512
478fc230cd1166c2a1e6d6f16fe558cf77bca15bc1a8b867b58790565235e2381bfa56076690fb2e4894c76eec018c0d3b191a4f1db507f31314c19ac32e98d5

Download Submit
\Windows\system\nctAKGm.exe

Filesize
2.9MB

MD5
8c58b4448f682fb2eee0b7f139ad5c75

SHA1
538623682881d9e85d1edf1c839ee48bd9ebee0e

SHA256
8a8b89b9c203b564f5fe238fd80269b0afa55e73023635f649215dd99de0c71e

SHA512
5edc5c8cd7b89e410c869d37064ea109ea45bbd89925147fff50cf4c33356b9a3f018da5b89a573dfb8ac95ec68857a6fdca0e46470959caabf085413fdc9dc0

Download Submit
\Windows\system\wJWiZli.exe

Filesize
2.9MB

MD5
612b63d63227aeec7a64cded699a08c7

SHA1
54755ec3ac78c1a4f91927cd5c1c37ab8786eb02

SHA256
f5f81beae39fc7b2287e0b88a57b2a2fcde235b20aa02782e4e7a2377e179def

SHA512
708fdc959215d6c306338cc4a89490f5e5c19ad864d40784a12ab53feba29213d6680da8c6b2e42f75a81ee089b3d0740f00e76583ac67f0c7215cd37108acd8

Download Submit
memory/1984-15-0x000000013F120000-0x000000013F516000-memory.dmp

Filesize
4.0MB

Download
memory/2136-107-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2136-108-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2136-193-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2136-21-0x000007FEF627E000-0x000007FEF627F000-memory.dmp

Filesize
4KB

Download
memory/2136-192-0x000007FEF5FC0000-0x000007FEF695D000-memory.dmp

Filesize
9.6MB

Download
memory/2204-14-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-194-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-223-0x0000000003210000-0x0000000003606000-memory.dmp

Filesize
4.0MB

Download
memory/2476-227-0x0000000003210000-0x0000000003606000-memory.dmp

Filesize
4.0MB

Download
memory/2476-238-0x000000013F640000-0x000000013FA36000-memory.dmp

Filesize
4.0MB

Download
memory/2476-2657-0x0000000002620000-0x0000000002A16000-memory.dmp

Filesize
4.0MB

Download
memory/2476-216-0x0000000003210000-0x0000000003606000-memory.dmp

Filesize
4.0MB

Download
memory/2476-2552-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-257-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2476-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2476-209-0x0000000003210000-0x0000000003606000-memory.dmp

Filesize
4.0MB

Download
memory/2476-16-0x000000013F120000-0x000000013F516000-memory.dmp

Filesize
4.0MB

Download
memory/2476-0-0x000000013FBB0000-0x000000013FFA6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-252-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2476-8-0x0000000002620000-0x0000000002A16000-memory.dmp

Filesize
4.0MB

Download
memory/2476-204-0x0000000003210000-0x0000000003606000-memory.dmp

Filesize
4.0MB

Download
memory/2476-260-0x0000000003210000-0x0000000003606000-memory.dmp

Filesize
4.0MB

Download
memory/2548-256-0x000000013F5B0000-0x000000013F9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2636-208-0x000000013F8E0000-0x000000013FCD6000-memory.dmp

Filesize
4.0MB

Download
memory/2648-259-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2700-237-0x000000013F950000-0x000000013FD46000-memory.dmp

Filesize
4.0MB

Download
memory/2748-251-0x000000013F640000-0x000000013FA36000-memory.dmp

Filesize
4.0MB

Download
memory/2748-4209-0x000000013F640000-0x000000013FA36000-memory.dmp

Filesize
4.0MB

Download
memory/2764-203-0x000000013F4C0000-0x000000013F8B6000-memory.dmp

Filesize
4.0MB

Download
memory/2772-264-0x000000013F840000-0x000000013FC36000-memory.dmp

Filesize
4.0MB

Download
memory/2780-215-0x000000013FC90000-0x0000000140086000-memory.dmp

Filesize
4.0MB

Download
memory/2916-226-0x000000013FE60000-0x0000000140256000-memory.dmp

Filesize
4.0MB

Download
memory/2916-4208-0x000000013FE60000-0x0000000140256000-memory.dmp

Filesize
4.0MB

Download
memory/2944-222-0x000000013FC70000-0x0000000140066000-memory.dmp

Filesize
4.0MB

Download