xmrig | 4e6fa8022dcb8b376ec2a0854bedd60a54636c67967b1269faabfd04c01733a5

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
Size

1.3MB
MD5

d22bacac124425b6a482ba7a1ac13d20
SHA1

98da624ea3ffbe9236e85310011d8e3a9e36b38d
SHA256

4e6fa8022dcb8b376ec2a0854bedd60a54636c67967b1269faabfd04c01733a5
SHA512

6bc536a0650e20103808183939d51930b33f343745f4dbb59a41dfa0c149b46cd75bcd8debe7d39fff08a25e4aa82cb19e395b0011a0817bdfaa11707086cd6a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzA+Lza0dGr:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV8

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral1/files/0x00080000000122cd-2.dat	xmrig
behavioral1/files/0x003600000001566b-9.dat	xmrig
behavioral1/files/0x0008000000015ca6-14.dat	xmrig
behavioral1/files/0x0008000000015cba-16.dat	xmrig
behavioral1/files/0x0007000000015ce1-24.dat	xmrig
behavioral1/files/0x0007000000015ceb-25.dat	xmrig
behavioral1/files/0x0007000000015d07-33.dat	xmrig
behavioral1/files/0x0008000000016117-38.dat	xmrig
behavioral1/files/0x00060000000161e7-43.dat	xmrig
behavioral1/files/0x000600000001630b-48.dat	xmrig
behavioral1/files/0x0006000000016572-58.dat	xmrig
behavioral1/files/0x000600000001661c-63.dat	xmrig
behavioral1/files/0x0006000000016c4a-78.dat	xmrig
behavioral1/files/0x0006000000016d90-128.dat	xmrig
behavioral1/files/0x0006000000017052-158.dat	xmrig
behavioral1/files/0x0006000000016eb2-153.dat	xmrig
behavioral1/files/0x0006000000016e94-148.dat	xmrig
behavioral1/files/0x0006000000016dbf-143.dat	xmrig
behavioral1/files/0x0006000000016dbb-138.dat	xmrig
behavioral1/files/0x0006000000016da7-133.dat	xmrig
behavioral1/files/0x0006000000016d3a-118.dat	xmrig
behavioral1/files/0x0006000000016d7e-123.dat	xmrig
behavioral1/files/0x0006000000016d26-113.dat	xmrig
behavioral1/files/0x0006000000016d1e-108.dat	xmrig
behavioral1/files/0x0006000000016ce4-98.dat	xmrig
behavioral1/files/0x0006000000016d0d-102.dat	xmrig
behavioral1/files/0x0006000000016c6b-88.dat	xmrig
behavioral1/files/0x0006000000016cb7-93.dat	xmrig
behavioral1/files/0x0006000000016c63-83.dat	xmrig
behavioral1/files/0x0006000000016843-68.dat	xmrig
behavioral1/files/0x0006000000016a9a-73.dat	xmrig
behavioral1/files/0x00060000000164b2-53.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1564	CKKKPrm.exe
2540	ZClPxyt.exe
2616	nYuBbIr.exe
2548	lbszChc.exe
2400	DvuzjRq.exe
2588	LSQJPxL.exe
2428	XfjCDkn.exe
2432	JolLDOe.exe
2704	EqMdhrv.exe
2404	woLRbLB.exe
2512	fNERhxT.exe
2436	HMqaWuU.exe
2708	BPoNcEy.exe
2752	XLtDJxf.exe
2768	XNZqybP.exe
2816	sqGDrEZ.exe
2928	wRqFPIT.exe
2968	WKBAvIq.exe
1592	TLbadFP.exe
2140	JfgbEFI.exe
1240	BGFcCxw.exe
816	vMvLlYo.exe
1588	NkIuuyU.exe
2688	GQOJnXi.exe
384	ZPEMBwW.exe
2924	GvxJTHj.exe
2280	jtHtacd.exe
1976	bbYOHxG.exe
2868	NRIOdYF.exe
760	URloGKe.exe
588	UJQNdVr.exe
2984	ggpsavY.exe
2352	OTyffqE.exe
2256	nylCPxL.exe
1404	PUAjAik.exe
2648	HbZJhZv.exe
1960	LXmwIdy.exe
2040	xyYkDXX.exe
1704	uUNlfXZ.exe
1716	vULxMsl.exe
1600	ODSICsL.exe
952	HRVEich.exe
1808	oklBGOE.exe
2092	UdDzIZb.exe
3024	qUscuVz.exe
112	prFvDRG.exe
3028	uRHcRWF.exe
1484	XWjVRJu.exe
2148	uXSDmgI.exe
2176	yqrhcnU.exe
2056	gAlLiMN.exe
1000	qlSpSHP.exe
2304	eytyIpd.exe
2344	bNDazTF.exe
2324	xHACTpC.exe
2300	KYiNWNG.exe
1952	qsrhBoN.exe
1636	HARdNzL.exe
3036	HXrGjMn.exe
2608	jkeLALn.exe
2700	NqeWHUJ.exe
2420	ryPxxHZ.exe
2208	KainOsL.exe
2388	HPNLkQX.exe

Loads dropped DLL 64 IoCs

pid	Process
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EnerEck.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\nstMpez.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\eCUbRgT.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\YZkjlSK.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\XcWzVZb.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\vKpLdpA.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\VyDdDKF.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\CqBWnVF.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\vBUwnKj.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\obxfefv.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\tBFfyFI.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\Znjllzc.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\lZVJsYT.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\MKRmKPL.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\GqjTvzn.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\mGjuhjU.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\BErZttj.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\BAhSWiB.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\YSjdfxo.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\zaQXyrZ.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\ezefLYI.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\EgLYzeV.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\ROSZAoZ.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\lFcAWLB.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\ctyeNaa.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\HOIKGxn.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\ONrxaED.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\aUExIeu.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\rtnVCDr.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\pbuFIjs.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\XqsfFBN.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\RiyEIVc.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\EpGTDgD.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\izbimKg.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\pdjdnWd.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\DwTIoNa.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\OpJyGcD.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\NhHqPtj.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\PYtFrNn.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\ygfVEeO.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\VbJoWQz.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\DNqWGFR.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\cfAbdXA.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\kpGfdpo.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\udQZMgX.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\zFuZyMH.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\bqphKRk.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\yzCDnTF.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\KPxHMVX.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\ORxCENJ.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\iTpFOfY.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\nPRtena.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\JdSojRs.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\fedwqXm.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\uRvysZT.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\dgImNhJ.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\azyFbDn.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\qzCPFrx.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\tPpCzdB.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\jXJyyVQ.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\KxETHWk.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\PYLefWF.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\UqwNVlb.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
File created	C:\Windows\System\abInzVd.exe	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1564	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	29
PID 1888 wrote to memory of 1564	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	29
PID 1888 wrote to memory of 1564	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	29
PID 1888 wrote to memory of 2540	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	30
PID 1888 wrote to memory of 2540	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	30
PID 1888 wrote to memory of 2540	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	30
PID 1888 wrote to memory of 2616	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	31
PID 1888 wrote to memory of 2616	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	31
PID 1888 wrote to memory of 2616	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	31
PID 1888 wrote to memory of 2548	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	32
PID 1888 wrote to memory of 2548	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	32
PID 1888 wrote to memory of 2548	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	32
PID 1888 wrote to memory of 2400	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	33
PID 1888 wrote to memory of 2400	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	33
PID 1888 wrote to memory of 2400	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	33
PID 1888 wrote to memory of 2588	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	34
PID 1888 wrote to memory of 2588	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	34
PID 1888 wrote to memory of 2588	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	34
PID 1888 wrote to memory of 2428	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	35
PID 1888 wrote to memory of 2428	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	35
PID 1888 wrote to memory of 2428	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	35
PID 1888 wrote to memory of 2432	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	36
PID 1888 wrote to memory of 2432	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	36
PID 1888 wrote to memory of 2432	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	36
PID 1888 wrote to memory of 2704	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	37
PID 1888 wrote to memory of 2704	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	37
PID 1888 wrote to memory of 2704	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	37
PID 1888 wrote to memory of 2404	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	38
PID 1888 wrote to memory of 2404	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	38
PID 1888 wrote to memory of 2404	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	38
PID 1888 wrote to memory of 2512	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	39
PID 1888 wrote to memory of 2512	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	39
PID 1888 wrote to memory of 2512	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	39
PID 1888 wrote to memory of 2436	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	40
PID 1888 wrote to memory of 2436	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	40
PID 1888 wrote to memory of 2436	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	40
PID 1888 wrote to memory of 2708	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	41
PID 1888 wrote to memory of 2708	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	41
PID 1888 wrote to memory of 2708	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	41
PID 1888 wrote to memory of 2752	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	42
PID 1888 wrote to memory of 2752	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	42
PID 1888 wrote to memory of 2752	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	42
PID 1888 wrote to memory of 2768	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	43
PID 1888 wrote to memory of 2768	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	43
PID 1888 wrote to memory of 2768	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	43
PID 1888 wrote to memory of 2816	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	44
PID 1888 wrote to memory of 2816	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	44
PID 1888 wrote to memory of 2816	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	44
PID 1888 wrote to memory of 2928	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	45
PID 1888 wrote to memory of 2928	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	45
PID 1888 wrote to memory of 2928	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	45
PID 1888 wrote to memory of 2968	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	46
PID 1888 wrote to memory of 2968	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	46
PID 1888 wrote to memory of 2968	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	46
PID 1888 wrote to memory of 1592	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	47
PID 1888 wrote to memory of 1592	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	47
PID 1888 wrote to memory of 1592	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	47
PID 1888 wrote to memory of 2140	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	48
PID 1888 wrote to memory of 2140	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	48
PID 1888 wrote to memory of 2140	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	48
PID 1888 wrote to memory of 1240	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	49
PID 1888 wrote to memory of 1240	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	49
PID 1888 wrote to memory of 1240	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	49
PID 1888 wrote to memory of 816	1888	d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d22bacac124425b6a482ba7a1ac13d20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\System\CKKKPrm.exe
  C:\Windows\System\CKKKPrm.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\ZClPxyt.exe
  C:\Windows\System\ZClPxyt.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\nYuBbIr.exe
  C:\Windows\System\nYuBbIr.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\lbszChc.exe
  C:\Windows\System\lbszChc.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\DvuzjRq.exe
  C:\Windows\System\DvuzjRq.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\LSQJPxL.exe
  C:\Windows\System\LSQJPxL.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\XfjCDkn.exe
  C:\Windows\System\XfjCDkn.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\JolLDOe.exe
  C:\Windows\System\JolLDOe.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\EqMdhrv.exe
  C:\Windows\System\EqMdhrv.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\woLRbLB.exe
  C:\Windows\System\woLRbLB.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\fNERhxT.exe
  C:\Windows\System\fNERhxT.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\HMqaWuU.exe
  C:\Windows\System\HMqaWuU.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\BPoNcEy.exe
  C:\Windows\System\BPoNcEy.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\XLtDJxf.exe
  C:\Windows\System\XLtDJxf.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\XNZqybP.exe
  C:\Windows\System\XNZqybP.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\sqGDrEZ.exe
  C:\Windows\System\sqGDrEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\wRqFPIT.exe
  C:\Windows\System\wRqFPIT.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\WKBAvIq.exe
  C:\Windows\System\WKBAvIq.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\TLbadFP.exe
  C:\Windows\System\TLbadFP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\JfgbEFI.exe
  C:\Windows\System\JfgbEFI.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\BGFcCxw.exe
  C:\Windows\System\BGFcCxw.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\vMvLlYo.exe
  C:\Windows\System\vMvLlYo.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\NkIuuyU.exe
  C:\Windows\System\NkIuuyU.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\GQOJnXi.exe
  C:\Windows\System\GQOJnXi.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ZPEMBwW.exe
  C:\Windows\System\ZPEMBwW.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\GvxJTHj.exe
  C:\Windows\System\GvxJTHj.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\jtHtacd.exe
  C:\Windows\System\jtHtacd.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\bbYOHxG.exe
  C:\Windows\System\bbYOHxG.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\NRIOdYF.exe
  C:\Windows\System\NRIOdYF.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\URloGKe.exe
  C:\Windows\System\URloGKe.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\UJQNdVr.exe
  C:\Windows\System\UJQNdVr.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\ggpsavY.exe
  C:\Windows\System\ggpsavY.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\OTyffqE.exe
  C:\Windows\System\OTyffqE.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\nylCPxL.exe
  C:\Windows\System\nylCPxL.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\PUAjAik.exe
  C:\Windows\System\PUAjAik.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\HbZJhZv.exe
  C:\Windows\System\HbZJhZv.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\LXmwIdy.exe
  C:\Windows\System\LXmwIdy.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\xyYkDXX.exe
  C:\Windows\System\xyYkDXX.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\uUNlfXZ.exe
  C:\Windows\System\uUNlfXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\vULxMsl.exe
  C:\Windows\System\vULxMsl.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\ODSICsL.exe
  C:\Windows\System\ODSICsL.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\HRVEich.exe
  C:\Windows\System\HRVEich.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\oklBGOE.exe
  C:\Windows\System\oklBGOE.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\UdDzIZb.exe
  C:\Windows\System\UdDzIZb.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\qUscuVz.exe
  C:\Windows\System\qUscuVz.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\prFvDRG.exe
  C:\Windows\System\prFvDRG.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\uRHcRWF.exe
  C:\Windows\System\uRHcRWF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\XWjVRJu.exe
  C:\Windows\System\XWjVRJu.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\uXSDmgI.exe
  C:\Windows\System\uXSDmgI.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\yqrhcnU.exe
  C:\Windows\System\yqrhcnU.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\gAlLiMN.exe
  C:\Windows\System\gAlLiMN.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\qlSpSHP.exe
  C:\Windows\System\qlSpSHP.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\eytyIpd.exe
  C:\Windows\System\eytyIpd.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\bNDazTF.exe
  C:\Windows\System\bNDazTF.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\xHACTpC.exe
  C:\Windows\System\xHACTpC.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\KYiNWNG.exe
  C:\Windows\System\KYiNWNG.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\qsrhBoN.exe
  C:\Windows\System\qsrhBoN.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\HARdNzL.exe
  C:\Windows\System\HARdNzL.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\HXrGjMn.exe
  C:\Windows\System\HXrGjMn.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\jkeLALn.exe
  C:\Windows\System\jkeLALn.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\NqeWHUJ.exe
  C:\Windows\System\NqeWHUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ryPxxHZ.exe
  C:\Windows\System\ryPxxHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\KainOsL.exe
  C:\Windows\System\KainOsL.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\HPNLkQX.exe
  C:\Windows\System\HPNLkQX.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\TETfiLo.exe
  C:\Windows\System\TETfiLo.exe
  2⤵
  PID:2464
- C:\Windows\System\vLmaMFm.exe
  C:\Windows\System\vLmaMFm.exe
  2⤵
  PID:2988
- C:\Windows\System\eWPRwOH.exe
  C:\Windows\System\eWPRwOH.exe
  2⤵
  PID:2480
- C:\Windows\System\zSDwBAo.exe
  C:\Windows\System\zSDwBAo.exe
  2⤵
  PID:2812
- C:\Windows\System\ITOZPEL.exe
  C:\Windows\System\ITOZPEL.exe
  2⤵
  PID:2912
- C:\Windows\System\lZVJsYT.exe
  C:\Windows\System\lZVJsYT.exe
  2⤵
  PID:376
- C:\Windows\System\NsWogub.exe
  C:\Windows\System\NsWogub.exe
  2⤵
  PID:2680
- C:\Windows\System\cwnSxwc.exe
  C:\Windows\System\cwnSxwc.exe
  2⤵
  PID:1856
- C:\Windows\System\vqaFSgB.exe
  C:\Windows\System\vqaFSgB.exe
  2⤵
  PID:2672
- C:\Windows\System\JuwVwTM.exe
  C:\Windows\System\JuwVwTM.exe
  2⤵
  PID:864
- C:\Windows\System\GLWFNjn.exe
  C:\Windows\System\GLWFNjn.exe
  2⤵
  PID:1748
- C:\Windows\System\WxkpAOh.exe
  C:\Windows\System\WxkpAOh.exe
  2⤵
  PID:1932
- C:\Windows\System\ZvaGvnZ.exe
  C:\Windows\System\ZvaGvnZ.exe
  2⤵
  PID:1176
- C:\Windows\System\GDbNcVH.exe
  C:\Windows\System\GDbNcVH.exe
  2⤵
  PID:2088
- C:\Windows\System\NaYxfJq.exe
  C:\Windows\System\NaYxfJq.exe
  2⤵
  PID:988
- C:\Windows\System\ABfgrIh.exe
  C:\Windows\System\ABfgrIh.exe
  2⤵
  PID:452
- C:\Windows\System\cXdRtss.exe
  C:\Windows\System\cXdRtss.exe
  2⤵
  PID:1248
- C:\Windows\System\DOVJRRp.exe
  C:\Windows\System\DOVJRRp.exe
  2⤵
  PID:1144
- C:\Windows\System\gOBWbGg.exe
  C:\Windows\System\gOBWbGg.exe
  2⤵
  PID:1940
- C:\Windows\System\EVLosSV.exe
  C:\Windows\System\EVLosSV.exe
  2⤵
  PID:1880
- C:\Windows\System\NpTORqO.exe
  C:\Windows\System\NpTORqO.exe
  2⤵
  PID:1540
- C:\Windows\System\zUqGiDe.exe
  C:\Windows\System\zUqGiDe.exe
  2⤵
  PID:1036
- C:\Windows\System\fnCUHUD.exe
  C:\Windows\System\fnCUHUD.exe
  2⤵
  PID:1088
- C:\Windows\System\UTGVgAT.exe
  C:\Windows\System\UTGVgAT.exe
  2⤵
  PID:2252
- C:\Windows\System\DUukiSX.exe
  C:\Windows\System\DUukiSX.exe
  2⤵
  PID:1876
- C:\Windows\System\aWNARCt.exe
  C:\Windows\System\aWNARCt.exe
  2⤵
  PID:2296
- C:\Windows\System\awVMHls.exe
  C:\Windows\System\awVMHls.exe
  2⤵
  PID:2196
- C:\Windows\System\dihGxNv.exe
  C:\Windows\System\dihGxNv.exe
  2⤵
  PID:1584
- C:\Windows\System\wUHQEkm.exe
  C:\Windows\System\wUHQEkm.exe
  2⤵
  PID:2600
- C:\Windows\System\iTJeJJY.exe
  C:\Windows\System\iTJeJJY.exe
  2⤵
  PID:2724
- C:\Windows\System\FTNbJVY.exe
  C:\Windows\System\FTNbJVY.exe
  2⤵
  PID:1640
- C:\Windows\System\GNTFMEa.exe
  C:\Windows\System\GNTFMEa.exe
  2⤵
  PID:2272
- C:\Windows\System\udQdKmt.exe
  C:\Windows\System\udQdKmt.exe
  2⤵
  PID:2564
- C:\Windows\System\JnRHvty.exe
  C:\Windows\System\JnRHvty.exe
  2⤵
  PID:2440
- C:\Windows\System\bqoseOE.exe
  C:\Windows\System\bqoseOE.exe
  2⤵
  PID:3004
- C:\Windows\System\JGCOjFe.exe
  C:\Windows\System\JGCOjFe.exe
  2⤵
  PID:2744
- C:\Windows\System\OuPxvII.exe
  C:\Windows\System\OuPxvII.exe
  2⤵
  PID:1904
- C:\Windows\System\FALIsHF.exe
  C:\Windows\System\FALIsHF.exe
  2⤵
  PID:1604
- C:\Windows\System\ZnPMevC.exe
  C:\Windows\System\ZnPMevC.exe
  2⤵
  PID:1896
- C:\Windows\System\dlvJyIf.exe
  C:\Windows\System\dlvJyIf.exe
  2⤵
  PID:2460
- C:\Windows\System\GFQmpAZ.exe
  C:\Windows\System\GFQmpAZ.exe
  2⤵
  PID:2772
- C:\Windows\System\RDqHWgx.exe
  C:\Windows\System\RDqHWgx.exe
  2⤵
  PID:2872
- C:\Windows\System\ZZANSoi.exe
  C:\Windows\System\ZZANSoi.exe
  2⤵
  PID:2008
- C:\Windows\System\XAhJZsV.exe
  C:\Windows\System\XAhJZsV.exe
  2⤵
  PID:1620
- C:\Windows\System\iRUumZB.exe
  C:\Windows\System\iRUumZB.exe
  2⤵
  PID:1116
- C:\Windows\System\FgyjszZ.exe
  C:\Windows\System\FgyjszZ.exe
  2⤵
  PID:836
- C:\Windows\System\oyUnCQO.exe
  C:\Windows\System\oyUnCQO.exe
  2⤵
  PID:1480
- C:\Windows\System\NARtIho.exe
  C:\Windows\System\NARtIho.exe
  2⤵
  PID:1776
- C:\Windows\System\EpGTDgD.exe
  C:\Windows\System\EpGTDgD.exe
  2⤵
  PID:2232
- C:\Windows\System\nvlYvCa.exe
  C:\Windows\System\nvlYvCa.exe
  2⤵
  PID:844
- C:\Windows\System\QQQcFQy.exe
  C:\Windows\System\QQQcFQy.exe
  2⤵
  PID:3012
- C:\Windows\System\grmHBEq.exe
  C:\Windows\System\grmHBEq.exe
  2⤵
  PID:1948
- C:\Windows\System\DQTUWtp.exe
  C:\Windows\System\DQTUWtp.exe
  2⤵
  PID:1528
- C:\Windows\System\aUExIeu.exe
  C:\Windows\System\aUExIeu.exe
  2⤵
  PID:2856
- C:\Windows\System\LTGGRCT.exe
  C:\Windows\System\LTGGRCT.exe
  2⤵
  PID:2840
- C:\Windows\System\jgkKoTa.exe
  C:\Windows\System\jgkKoTa.exe
  2⤵
  PID:2468
- C:\Windows\System\BsMUMEe.exe
  C:\Windows\System\BsMUMEe.exe
  2⤵
  PID:1556
- C:\Windows\System\ptFLGJP.exe
  C:\Windows\System\ptFLGJP.exe
  2⤵
  PID:2516
- C:\Windows\System\AtFAvQs.exe
  C:\Windows\System\AtFAvQs.exe
  2⤵
  PID:692
- C:\Windows\System\plutRqE.exe
  C:\Windows\System\plutRqE.exe
  2⤵
  PID:2748
- C:\Windows\System\sTgxKeC.exe
  C:\Windows\System\sTgxKeC.exe
  2⤵
  PID:2532
- C:\Windows\System\mGDBRlL.exe
  C:\Windows\System\mGDBRlL.exe
  2⤵
  PID:2624
- C:\Windows\System\dowVChO.exe
  C:\Windows\System\dowVChO.exe
  2⤵
  PID:2640
- C:\Windows\System\nHgnBNC.exe
  C:\Windows\System\nHgnBNC.exe
  2⤵
  PID:2604
- C:\Windows\System\ehKMkMX.exe
  C:\Windows\System\ehKMkMX.exe
  2⤵
  PID:2560
- C:\Windows\System\suMEYfQ.exe
  C:\Windows\System\suMEYfQ.exe
  2⤵
  PID:704
- C:\Windows\System\hVRgWbO.exe
  C:\Windows\System\hVRgWbO.exe
  2⤵
  PID:564
- C:\Windows\System\kxFtDkN.exe
  C:\Windows\System\kxFtDkN.exe
  2⤵
  PID:896
- C:\Windows\System\pZYxdLh.exe
  C:\Windows\System\pZYxdLh.exe
  2⤵
  PID:2504
- C:\Windows\System\EDZdlcE.exe
  C:\Windows\System\EDZdlcE.exe
  2⤵
  PID:2204
- C:\Windows\System\dgImNhJ.exe
  C:\Windows\System\dgImNhJ.exe
  2⤵
  PID:2544
- C:\Windows\System\GZRDoSJ.exe
  C:\Windows\System\GZRDoSJ.exe
  2⤵
  PID:320
- C:\Windows\System\fRoWmLI.exe
  C:\Windows\System\fRoWmLI.exe
  2⤵
  PID:1092
- C:\Windows\System\giyjDSB.exe
  C:\Windows\System\giyjDSB.exe
  2⤵
  PID:1516
- C:\Windows\System\FryAANh.exe
  C:\Windows\System\FryAANh.exe
  2⤵
  PID:1644
- C:\Windows\System\FZyhijk.exe
  C:\Windows\System\FZyhijk.exe
  2⤵
  PID:616
- C:\Windows\System\hpfeQBu.exe
  C:\Windows\System\hpfeQBu.exe
  2⤵
  PID:356
- C:\Windows\System\GGbkapu.exe
  C:\Windows\System\GGbkapu.exe
  2⤵
  PID:2764
- C:\Windows\System\SraMUnt.exe
  C:\Windows\System\SraMUnt.exe
  2⤵
  PID:2236
- C:\Windows\System\QlMvYIw.exe
  C:\Windows\System\QlMvYIw.exe
  2⤵
  PID:1304
- C:\Windows\System\ctihCIR.exe
  C:\Windows\System\ctihCIR.exe
  2⤵
  PID:1764
- C:\Windows\System\vIJgRNP.exe
  C:\Windows\System\vIJgRNP.exe
  2⤵
  PID:3084
- C:\Windows\System\YaXcnDT.exe
  C:\Windows\System\YaXcnDT.exe
  2⤵
  PID:3108
- C:\Windows\System\NSdvjLm.exe
  C:\Windows\System\NSdvjLm.exe
  2⤵
  PID:3124
- C:\Windows\System\ztyDKpe.exe
  C:\Windows\System\ztyDKpe.exe
  2⤵
  PID:3144
- C:\Windows\System\oaIVyad.exe
  C:\Windows\System\oaIVyad.exe
  2⤵
  PID:3164
- C:\Windows\System\eYzOvzU.exe
  C:\Windows\System\eYzOvzU.exe
  2⤵
  PID:3188
- C:\Windows\System\VzjwbLH.exe
  C:\Windows\System\VzjwbLH.exe
  2⤵
  PID:3228
- C:\Windows\System\jxGVnMN.exe
  C:\Windows\System\jxGVnMN.exe
  2⤵
  PID:3260
- C:\Windows\System\ROSZAoZ.exe
  C:\Windows\System\ROSZAoZ.exe
  2⤵
  PID:3280
- C:\Windows\System\RcfRShm.exe
  C:\Windows\System\RcfRShm.exe
  2⤵
  PID:3300
- C:\Windows\System\coJibzU.exe
  C:\Windows\System\coJibzU.exe
  2⤵
  PID:3316
- C:\Windows\System\ntvdJfS.exe
  C:\Windows\System\ntvdJfS.exe
  2⤵
  PID:3336
- C:\Windows\System\CDcFjmP.exe
  C:\Windows\System\CDcFjmP.exe
  2⤵
  PID:3352
- C:\Windows\System\DEIyUjN.exe
  C:\Windows\System\DEIyUjN.exe
  2⤵
  PID:3372
- C:\Windows\System\svZFAVO.exe
  C:\Windows\System\svZFAVO.exe
  2⤵
  PID:3388
- C:\Windows\System\jlZuYgi.exe
  C:\Windows\System\jlZuYgi.exe
  2⤵
  PID:3404
- C:\Windows\System\WzRagRo.exe
  C:\Windows\System\WzRagRo.exe
  2⤵
  PID:3424
- C:\Windows\System\uGEUdtS.exe
  C:\Windows\System\uGEUdtS.exe
  2⤵
  PID:3444
- C:\Windows\System\cgRHNmN.exe
  C:\Windows\System\cgRHNmN.exe
  2⤵
  PID:3472
- C:\Windows\System\lCZNcqw.exe
  C:\Windows\System\lCZNcqw.exe
  2⤵
  PID:3504
- C:\Windows\System\XBUUxrE.exe
  C:\Windows\System\XBUUxrE.exe
  2⤵
  PID:3520
- C:\Windows\System\ydxVIpc.exe
  C:\Windows\System\ydxVIpc.exe
  2⤵
  PID:3540
- C:\Windows\System\benvrTH.exe
  C:\Windows\System\benvrTH.exe
  2⤵
  PID:3556
- C:\Windows\System\TKdNHxN.exe
  C:\Windows\System\TKdNHxN.exe
  2⤵
  PID:3572
- C:\Windows\System\vBUwnKj.exe
  C:\Windows\System\vBUwnKj.exe
  2⤵
  PID:3596
- C:\Windows\System\abInzVd.exe
  C:\Windows\System\abInzVd.exe
  2⤵
  PID:3612
- C:\Windows\System\chCfdYf.exe
  C:\Windows\System\chCfdYf.exe
  2⤵
  PID:3628
- C:\Windows\System\ajoewhW.exe
  C:\Windows\System\ajoewhW.exe
  2⤵
  PID:3648
- C:\Windows\System\OZGjonJ.exe
  C:\Windows\System\OZGjonJ.exe
  2⤵
  PID:3668
- C:\Windows\System\nJPSSjX.exe
  C:\Windows\System\nJPSSjX.exe
  2⤵
  PID:3684
- C:\Windows\System\SiWuEgQ.exe
  C:\Windows\System\SiWuEgQ.exe
  2⤵
  PID:3700
- C:\Windows\System\cqhzldW.exe
  C:\Windows\System\cqhzldW.exe
  2⤵
  PID:3716
- C:\Windows\System\XWMkADj.exe
  C:\Windows\System\XWMkADj.exe
  2⤵
  PID:3740
- C:\Windows\System\cwlXmWl.exe
  C:\Windows\System\cwlXmWl.exe
  2⤵
  PID:3756
- C:\Windows\System\kkNeYOp.exe
  C:\Windows\System\kkNeYOp.exe
  2⤵
  PID:3792
- C:\Windows\System\jOqwZzW.exe
  C:\Windows\System\jOqwZzW.exe
  2⤵
  PID:3808
- C:\Windows\System\CmaJzaf.exe
  C:\Windows\System\CmaJzaf.exe
  2⤵
  PID:3824
- C:\Windows\System\ErWuIwj.exe
  C:\Windows\System\ErWuIwj.exe
  2⤵
  PID:3840
- C:\Windows\System\IdqKgQV.exe
  C:\Windows\System\IdqKgQV.exe
  2⤵
  PID:3856
- C:\Windows\System\KqHDuSQ.exe
  C:\Windows\System\KqHDuSQ.exe
  2⤵
  PID:3876
- C:\Windows\System\fgrakqd.exe
  C:\Windows\System\fgrakqd.exe
  2⤵
  PID:3892
- C:\Windows\System\xLQMYko.exe
  C:\Windows\System\xLQMYko.exe
  2⤵
  PID:3920
- C:\Windows\System\dwpWRKy.exe
  C:\Windows\System\dwpWRKy.exe
  2⤵
  PID:3948
- C:\Windows\System\KUGfPXy.exe
  C:\Windows\System\KUGfPXy.exe
  2⤵
  PID:3964
- C:\Windows\System\WsJmhZy.exe
  C:\Windows\System\WsJmhZy.exe
  2⤵
  PID:3984
- C:\Windows\System\XgBYBvq.exe
  C:\Windows\System\XgBYBvq.exe
  2⤵
  PID:4004
- C:\Windows\System\KEvpkBj.exe
  C:\Windows\System\KEvpkBj.exe
  2⤵
  PID:4032
- C:\Windows\System\mttaCmv.exe
  C:\Windows\System\mttaCmv.exe
  2⤵
  PID:4068
- C:\Windows\System\uCzomoe.exe
  C:\Windows\System\uCzomoe.exe
  2⤵
  PID:4084
- C:\Windows\System\AdEtens.exe
  C:\Windows\System\AdEtens.exe
  2⤵
  PID:2756
- C:\Windows\System\eGSeVdu.exe
  C:\Windows\System\eGSeVdu.exe
  2⤵
  PID:2948
- C:\Windows\System\GkCTppz.exe
  C:\Windows\System\GkCTppz.exe
  2⤵
  PID:2168
- C:\Windows\System\hsbdORq.exe
  C:\Windows\System\hsbdORq.exe
  2⤵
  PID:2596
- C:\Windows\System\nstMpez.exe
  C:\Windows\System\nstMpez.exe
  2⤵
  PID:1532
- C:\Windows\System\sccRZWB.exe
  C:\Windows\System\sccRZWB.exe
  2⤵
  PID:3116
- C:\Windows\System\OTsXrTz.exe
  C:\Windows\System\OTsXrTz.exe
  2⤵
  PID:3092
- C:\Windows\System\YnUnTIA.exe
  C:\Windows\System\YnUnTIA.exe
  2⤵
  PID:3120
- C:\Windows\System\cIapYZm.exe
  C:\Windows\System\cIapYZm.exe
  2⤵
  PID:1652
- C:\Windows\System\bwZpspH.exe
  C:\Windows\System\bwZpspH.exe
  2⤵
  PID:3136
- C:\Windows\System\EDGzvme.exe
  C:\Windows\System\EDGzvme.exe
  2⤵
  PID:3196
- C:\Windows\System\cMOycjH.exe
  C:\Windows\System\cMOycjH.exe
  2⤵
  PID:3172
- C:\Windows\System\rmqsETh.exe
  C:\Windows\System\rmqsETh.exe
  2⤵
  PID:3180
- C:\Windows\System\faPUfvW.exe
  C:\Windows\System\faPUfvW.exe
  2⤵
  PID:3216
- C:\Windows\System\jaSafee.exe
  C:\Windows\System\jaSafee.exe
  2⤵
  PID:3276
- C:\Windows\System\TfaqSkX.exe
  C:\Windows\System\TfaqSkX.exe
  2⤵
  PID:3380
- C:\Windows\System\EnaposC.exe
  C:\Windows\System\EnaposC.exe
  2⤵
  PID:3288
- C:\Windows\System\bzBpCin.exe
  C:\Windows\System\bzBpCin.exe
  2⤵
  PID:3292
- C:\Windows\System\CSdGQMJ.exe
  C:\Windows\System\CSdGQMJ.exe
  2⤵
  PID:3296
- C:\Windows\System\vsoMVbF.exe
  C:\Windows\System\vsoMVbF.exe
  2⤵
  PID:3420
- C:\Windows\System\EpqpDUZ.exe
  C:\Windows\System\EpqpDUZ.exe
  2⤵
  PID:3464
- C:\Windows\System\hRYofpR.exe
  C:\Windows\System\hRYofpR.exe
  2⤵
  PID:2932
- C:\Windows\System\NdEOTME.exe
  C:\Windows\System\NdEOTME.exe
  2⤵
  PID:3496
- C:\Windows\System\xTAcVwF.exe
  C:\Windows\System\xTAcVwF.exe
  2⤵
  PID:3620
- C:\Windows\System\AdONWUX.exe
  C:\Windows\System\AdONWUX.exe
  2⤵
  PID:3564
- C:\Windows\System\pVnGlZC.exe
  C:\Windows\System\pVnGlZC.exe
  2⤵
  PID:3568
- C:\Windows\System\BzMQDSR.exe
  C:\Windows\System\BzMQDSR.exe
  2⤵
  PID:2372
- C:\Windows\System\bDqHtki.exe
  C:\Windows\System\bDqHtki.exe
  2⤵
  PID:3588
- C:\Windows\System\QIyYkWf.exe
  C:\Windows\System\QIyYkWf.exe
  2⤵
  PID:3692
- C:\Windows\System\hSZalwR.exe
  C:\Windows\System\hSZalwR.exe
  2⤵
  PID:3736
- C:\Windows\System\WptoGfw.exe
  C:\Windows\System\WptoGfw.exe
  2⤵
  PID:3772
- C:\Windows\System\DDCKLQR.exe
  C:\Windows\System\DDCKLQR.exe
  2⤵
  PID:3788
- C:\Windows\System\MKRmKPL.exe
  C:\Windows\System\MKRmKPL.exe
  2⤵
  PID:1488
- C:\Windows\System\lhcsbfR.exe
  C:\Windows\System\lhcsbfR.exe
  2⤵
  PID:2492
- C:\Windows\System\MrbSLHy.exe
  C:\Windows\System\MrbSLHy.exe
  2⤵
  PID:3864
- C:\Windows\System\jCYklRc.exe
  C:\Windows\System\jCYklRc.exe
  2⤵
  PID:3636
- C:\Windows\System\dldtOMm.exe
  C:\Windows\System\dldtOMm.exe
  2⤵
  PID:3884
- C:\Windows\System\kZsLEta.exe
  C:\Windows\System\kZsLEta.exe
  2⤵
  PID:3980
- C:\Windows\System\GREApjM.exe
  C:\Windows\System\GREApjM.exe
  2⤵
  PID:4024
- C:\Windows\System\URHgXEI.exe
  C:\Windows\System\URHgXEI.exe
  2⤵
  PID:3956
- C:\Windows\System\mWYjGxc.exe
  C:\Windows\System\mWYjGxc.exe
  2⤵
  PID:4028
- C:\Windows\System\emRVIoy.exe
  C:\Windows\System\emRVIoy.exe
  2⤵
  PID:4044
- C:\Windows\System\NqBErrZ.exe
  C:\Windows\System\NqBErrZ.exe
  2⤵
  PID:4064
- C:\Windows\System\kkgwULm.exe
  C:\Windows\System\kkgwULm.exe
  2⤵
  PID:2720
- C:\Windows\System\vgcmunB.exe
  C:\Windows\System\vgcmunB.exe
  2⤵
  PID:1616
- C:\Windows\System\cyJaZve.exe
  C:\Windows\System\cyJaZve.exe
  2⤵
  PID:1236
- C:\Windows\System\xDKstnK.exe
  C:\Windows\System\xDKstnK.exe
  2⤵
  PID:108
- C:\Windows\System\XBvGqIT.exe
  C:\Windows\System\XBvGqIT.exe
  2⤵
  PID:2364
- C:\Windows\System\oqWIYUu.exe
  C:\Windows\System\oqWIYUu.exe
  2⤵
  PID:2900
- C:\Windows\System\BoDYPit.exe
  C:\Windows\System\BoDYPit.exe
  2⤵
  PID:1972
- C:\Windows\System\HiSGaBb.exe
  C:\Windows\System\HiSGaBb.exe
  2⤵
  PID:3224
- C:\Windows\System\sQMcPHh.exe
  C:\Windows\System\sQMcPHh.exe
  2⤵
  PID:2452
- C:\Windows\System\itZGdXZ.exe
  C:\Windows\System\itZGdXZ.exe
  2⤵
  PID:3244
- C:\Windows\System\NrWbtTz.exe
  C:\Windows\System\NrWbtTz.exe
  2⤵
  PID:3344
- C:\Windows\System\UDBqocb.exe
  C:\Windows\System\UDBqocb.exe
  2⤵
  PID:3308
- C:\Windows\System\cIZwgOl.exe
  C:\Windows\System\cIZwgOl.exe
  2⤵
  PID:3368
- C:\Windows\System\JjvOsfW.exe
  C:\Windows\System\JjvOsfW.exe
  2⤵
  PID:488
- C:\Windows\System\LvHksHU.exe
  C:\Windows\System\LvHksHU.exe
  2⤵
  PID:3460
- C:\Windows\System\obxfefv.exe
  C:\Windows\System\obxfefv.exe
  2⤵
  PID:2248
- C:\Windows\System\QiaeVRG.exe
  C:\Windows\System\QiaeVRG.exe
  2⤵
  PID:3660
- C:\Windows\System\msICsfm.exe
  C:\Windows\System\msICsfm.exe
  2⤵
  PID:676
- C:\Windows\System\daLCEwo.exe
  C:\Windows\System\daLCEwo.exe
  2⤵
  PID:3548
- C:\Windows\System\wgiXkmX.exe
  C:\Windows\System\wgiXkmX.exe
  2⤵
  PID:3552
- C:\Windows\System\HuyGKJO.exe
  C:\Windows\System\HuyGKJO.exe
  2⤵
  PID:3776
- C:\Windows\System\HevkkLY.exe
  C:\Windows\System\HevkkLY.exe
  2⤵
  PID:3748
- C:\Windows\System\pXCwPIF.exe
  C:\Windows\System\pXCwPIF.exe
  2⤵
  PID:3708
- C:\Windows\System\SMZoWFn.exe
  C:\Windows\System\SMZoWFn.exe
  2⤵
  PID:3936
- C:\Windows\System\zooVOww.exe
  C:\Windows\System\zooVOww.exe
  2⤵
  PID:3912
- C:\Windows\System\bWRawfJ.exe
  C:\Windows\System\bWRawfJ.exe
  2⤵
  PID:3944
- C:\Windows\System\FvIiguj.exe
  C:\Windows\System\FvIiguj.exe
  2⤵
  PID:3996
- C:\Windows\System\doesbsL.exe
  C:\Windows\System\doesbsL.exe
  2⤵
  PID:2804
- C:\Windows\System\XNzaelC.exe
  C:\Windows\System\XNzaelC.exe
  2⤵
  PID:2792
- C:\Windows\System\uSOQRxu.exe
  C:\Windows\System\uSOQRxu.exe
  2⤵
  PID:3132
- C:\Windows\System\iDcVlRK.exe
  C:\Windows\System\iDcVlRK.exe
  2⤵
  PID:3312
- C:\Windows\System\DbtOPKZ.exe
  C:\Windows\System\DbtOPKZ.exe
  2⤵
  PID:3416
- C:\Windows\System\vBApeSk.exe
  C:\Windows\System\vBApeSk.exe
  2⤵
  PID:3456
- C:\Windows\System\fNlngrR.exe
  C:\Windows\System\fNlngrR.exe
  2⤵
  PID:3272
- C:\Windows\System\vcRuvlm.exe
  C:\Windows\System\vcRuvlm.exe
  2⤵
  PID:808
- C:\Windows\System\HGJeUMt.exe
  C:\Windows\System\HGJeUMt.exe
  2⤵
  PID:3768
- C:\Windows\System\PfvZijq.exe
  C:\Windows\System\PfvZijq.exe
  2⤵
  PID:3764
- C:\Windows\System\velbEDT.exe
  C:\Windows\System\velbEDT.exe
  2⤵
  PID:2276
- C:\Windows\System\nysrYCW.exe
  C:\Windows\System\nysrYCW.exe
  2⤵
  PID:3928
- C:\Windows\System\QIxrHpL.exe
  C:\Windows\System\QIxrHpL.exe
  2⤵
  PID:3908
- C:\Windows\System\UJWoQsN.exe
  C:\Windows\System\UJWoQsN.exe
  2⤵
  PID:3512
- C:\Windows\System\aeorfhP.exe
  C:\Windows\System\aeorfhP.exe
  2⤵
  PID:4000
- C:\Windows\System\CXdbZDv.exe
  C:\Windows\System\CXdbZDv.exe
  2⤵
  PID:1072
- C:\Windows\System\YkWGHGL.exe
  C:\Windows\System\YkWGHGL.exe
  2⤵
  PID:4076
- C:\Windows\System\caGtvkS.exe
  C:\Windows\System\caGtvkS.exe
  2⤵
  PID:3140
- C:\Windows\System\OsqaoHL.exe
  C:\Windows\System\OsqaoHL.exe
  2⤵
  PID:2976
- C:\Windows\System\kpFqCpx.exe
  C:\Windows\System\kpFqCpx.exe
  2⤵
  PID:2184
- C:\Windows\System\TWxdWAO.exe
  C:\Windows\System\TWxdWAO.exe
  2⤵
  PID:3328
- C:\Windows\System\iWuqCDO.exe
  C:\Windows\System\iWuqCDO.exe
  2⤵
  PID:3236
- C:\Windows\System\pYbzSeq.exe
  C:\Windows\System\pYbzSeq.exe
  2⤵
  PID:3664
- C:\Windows\System\irtdwDv.exe
  C:\Windows\System\irtdwDv.exe
  2⤵
  PID:3940
- C:\Windows\System\nTHNXTP.exe
  C:\Windows\System\nTHNXTP.exe
  2⤵
  PID:3412
- C:\Windows\System\AIfhDKZ.exe
  C:\Windows\System\AIfhDKZ.exe
  2⤵
  PID:3904
- C:\Windows\System\vkeasAv.exe
  C:\Windows\System\vkeasAv.exe
  2⤵
  PID:3608
- C:\Windows\System\jpcBBWS.exe
  C:\Windows\System\jpcBBWS.exe
  2⤵
  PID:628
- C:\Windows\System\qyKFrzc.exe
  C:\Windows\System\qyKFrzc.exe
  2⤵
  PID:3528
- C:\Windows\System\sCypFUV.exe
  C:\Windows\System\sCypFUV.exe
  2⤵
  PID:2332
- C:\Windows\System\NJgdUDJ.exe
  C:\Windows\System\NJgdUDJ.exe
  2⤵
  PID:3160
- C:\Windows\System\qhKRMyU.exe
  C:\Windows\System\qhKRMyU.exe
  2⤵
  PID:1732
- C:\Windows\System\HUCvTfd.exe
  C:\Windows\System\HUCvTfd.exe
  2⤵
  PID:1800
- C:\Windows\System\NleFgwM.exe
  C:\Windows\System\NleFgwM.exe
  2⤵
  PID:3332
- C:\Windows\System\SDtpeUN.exe
  C:\Windows\System\SDtpeUN.exe
  2⤵
  PID:1744
- C:\Windows\System\KCvPjmi.exe
  C:\Windows\System\KCvPjmi.exe
  2⤵
  PID:1552
- C:\Windows\System\zLiNAdf.exe
  C:\Windows\System\zLiNAdf.exe
  2⤵
  PID:3800
- C:\Windows\System\QvxxboX.exe
  C:\Windows\System\QvxxboX.exe
  2⤵
  PID:3852
- C:\Windows\System\BSZJecY.exe
  C:\Windows\System\BSZJecY.exe
  2⤵
  PID:1920
- C:\Windows\System\QCoctow.exe
  C:\Windows\System\QCoctow.exe
  2⤵
  PID:4108
- C:\Windows\System\oSepSSf.exe
  C:\Windows\System\oSepSSf.exe
  2⤵
  PID:4136
- C:\Windows\System\LKerOAZ.exe
  C:\Windows\System\LKerOAZ.exe
  2⤵
  PID:4164
- C:\Windows\System\LFPoYJK.exe
  C:\Windows\System\LFPoYJK.exe
  2⤵
  PID:4192
- C:\Windows\System\cbESGWO.exe
  C:\Windows\System\cbESGWO.exe
  2⤵
  PID:4208
- C:\Windows\System\vqyuwne.exe
  C:\Windows\System\vqyuwne.exe
  2⤵
  PID:4224
- C:\Windows\System\AUoLSWA.exe
  C:\Windows\System\AUoLSWA.exe
  2⤵
  PID:4240
- C:\Windows\System\FLenDfP.exe
  C:\Windows\System\FLenDfP.exe
  2⤵
  PID:4264
- C:\Windows\System\JCyTkDY.exe
  C:\Windows\System\JCyTkDY.exe
  2⤵
  PID:4296
- C:\Windows\System\EwqISEX.exe
  C:\Windows\System\EwqISEX.exe
  2⤵
  PID:4312
- C:\Windows\System\NRfUdaQ.exe
  C:\Windows\System\NRfUdaQ.exe
  2⤵
  PID:4332
- C:\Windows\System\JQbDtVD.exe
  C:\Windows\System\JQbDtVD.exe
  2⤵
  PID:4348
- C:\Windows\System\msELzNb.exe
  C:\Windows\System\msELzNb.exe
  2⤵
  PID:4364
- C:\Windows\System\ZWEtOfQ.exe
  C:\Windows\System\ZWEtOfQ.exe
  2⤵
  PID:4380
- C:\Windows\System\MCJbQjj.exe
  C:\Windows\System\MCJbQjj.exe
  2⤵
  PID:4396
- C:\Windows\System\azyFbDn.exe
  C:\Windows\System\azyFbDn.exe
  2⤵
  PID:4416
- C:\Windows\System\EFTkuuD.exe
  C:\Windows\System\EFTkuuD.exe
  2⤵
  PID:4432
- C:\Windows\System\HXZRJuQ.exe
  C:\Windows\System\HXZRJuQ.exe
  2⤵
  PID:4448
- C:\Windows\System\rEaavAB.exe
  C:\Windows\System\rEaavAB.exe
  2⤵
  PID:4476
- C:\Windows\System\hcfBrJf.exe
  C:\Windows\System\hcfBrJf.exe
  2⤵
  PID:4516
- C:\Windows\System\DHIJUrT.exe
  C:\Windows\System\DHIJUrT.exe
  2⤵
  PID:4532
- C:\Windows\System\mVsiVFB.exe
  C:\Windows\System\mVsiVFB.exe
  2⤵
  PID:4556
- C:\Windows\System\zTwOyLD.exe
  C:\Windows\System\zTwOyLD.exe
  2⤵
  PID:4572
- C:\Windows\System\knTZwNg.exe
  C:\Windows\System\knTZwNg.exe
  2⤵
  PID:4588
- C:\Windows\System\uDACsBg.exe
  C:\Windows\System\uDACsBg.exe
  2⤵
  PID:4608
- C:\Windows\System\LlnxOxQ.exe
  C:\Windows\System\LlnxOxQ.exe
  2⤵
  PID:4624
- C:\Windows\System\mZbeNFX.exe
  C:\Windows\System\mZbeNFX.exe
  2⤵
  PID:4640
- C:\Windows\System\kprNpbZ.exe
  C:\Windows\System\kprNpbZ.exe
  2⤵
  PID:4660
- C:\Windows\System\OoFVyxG.exe
  C:\Windows\System\OoFVyxG.exe
  2⤵
  PID:4704
- C:\Windows\System\ysgcNhu.exe
  C:\Windows\System\ysgcNhu.exe
  2⤵
  PID:4720
- C:\Windows\System\AywUvyh.exe
  C:\Windows\System\AywUvyh.exe
  2⤵
  PID:4736
- C:\Windows\System\gizvYtq.exe
  C:\Windows\System\gizvYtq.exe
  2⤵
  PID:4756
- C:\Windows\System\pQVQexI.exe
  C:\Windows\System\pQVQexI.exe
  2⤵
  PID:4772
- C:\Windows\System\NZOvggc.exe
  C:\Windows\System\NZOvggc.exe
  2⤵
  PID:4792
- C:\Windows\System\fkpLScD.exe
  C:\Windows\System\fkpLScD.exe
  2⤵
  PID:4808
- C:\Windows\System\GthsAli.exe
  C:\Windows\System\GthsAli.exe
  2⤵
  PID:4824
- C:\Windows\System\dVCJvGN.exe
  C:\Windows\System\dVCJvGN.exe
  2⤵
  PID:4840
- C:\Windows\System\SYdOBSv.exe
  C:\Windows\System\SYdOBSv.exe
  2⤵
  PID:4860
- C:\Windows\System\jtkLXHW.exe
  C:\Windows\System\jtkLXHW.exe
  2⤵
  PID:4876
- C:\Windows\System\nxldeQR.exe
  C:\Windows\System\nxldeQR.exe
  2⤵
  PID:4892
- C:\Windows\System\GTQnpTa.exe
  C:\Windows\System\GTQnpTa.exe
  2⤵
  PID:4908
- C:\Windows\System\VbJoWQz.exe
  C:\Windows\System\VbJoWQz.exe
  2⤵
  PID:4928
- C:\Windows\System\PBZYsnH.exe
  C:\Windows\System\PBZYsnH.exe
  2⤵
  PID:4952
- C:\Windows\System\zHeGckp.exe
  C:\Windows\System\zHeGckp.exe
  2⤵
  PID:4972
- C:\Windows\System\IQoifFo.exe
  C:\Windows\System\IQoifFo.exe
  2⤵
  PID:4988
- C:\Windows\System\AXXQPdS.exe
  C:\Windows\System\AXXQPdS.exe
  2⤵
  PID:5008
- C:\Windows\System\ydplrgn.exe
  C:\Windows\System\ydplrgn.exe
  2⤵
  PID:5024
- C:\Windows\System\VWeJVzx.exe
  C:\Windows\System\VWeJVzx.exe
  2⤵
  PID:5040
- C:\Windows\System\TwNzYdP.exe
  C:\Windows\System\TwNzYdP.exe
  2⤵
  PID:5056
- C:\Windows\System\RNATxYG.exe
  C:\Windows\System\RNATxYG.exe
  2⤵
  PID:5072
- C:\Windows\System\oTKrhvv.exe
  C:\Windows\System\oTKrhvv.exe
  2⤵
  PID:5088
- C:\Windows\System\dzoEJYF.exe
  C:\Windows\System\dzoEJYF.exe
  2⤵
  PID:5104
- C:\Windows\System\bEAPiXz.exe
  C:\Windows\System\bEAPiXz.exe
  2⤵
  PID:2780
- C:\Windows\System\vJiDYbU.exe
  C:\Windows\System\vJiDYbU.exe
  2⤵
  PID:4128
- C:\Windows\System\LoLdtkS.exe
  C:\Windows\System\LoLdtkS.exe
  2⤵
  PID:1672
- C:\Windows\System\PwJxFEI.exe
  C:\Windows\System\PwJxFEI.exe
  2⤵
  PID:1980
- C:\Windows\System\qCpJRfc.exe
  C:\Windows\System\qCpJRfc.exe
  2⤵
  PID:4176
- C:\Windows\System\dSSyITu.exe
  C:\Windows\System\dSSyITu.exe
  2⤵
  PID:4220
- C:\Windows\System\tTeJCYK.exe
  C:\Windows\System\tTeJCYK.exe
  2⤵
  PID:4256
- C:\Windows\System\OZKJIWN.exe
  C:\Windows\System\OZKJIWN.exe
  2⤵
  PID:4144
- C:\Windows\System\nJvVaZP.exe
  C:\Windows\System\nJvVaZP.exe
  2⤵
  PID:4236
- C:\Windows\System\egILnxr.exe
  C:\Windows\System\egILnxr.exe
  2⤵
  PID:4344
- C:\Windows\System\atBZWzd.exe
  C:\Windows\System\atBZWzd.exe
  2⤵
  PID:4408
- C:\Windows\System\BMoVBTf.exe
  C:\Windows\System\BMoVBTf.exe
  2⤵
  PID:4424
- C:\Windows\System\NAAISlz.exe
  C:\Windows\System\NAAISlz.exe
  2⤵
  PID:4320
- C:\Windows\System\RdBeqbY.exe
  C:\Windows\System\RdBeqbY.exe
  2⤵
  PID:4388
- C:\Windows\System\GLjJvzi.exe
  C:\Windows\System\GLjJvzi.exe
  2⤵
  PID:4548
- C:\Windows\System\CRWOJgt.exe
  C:\Windows\System\CRWOJgt.exe
  2⤵
  PID:4528
- C:\Windows\System\ANTRgLb.exe
  C:\Windows\System\ANTRgLb.exe
  2⤵
  PID:4564
- C:\Windows\System\PMHYMrj.exe
  C:\Windows\System\PMHYMrj.exe
  2⤵
  PID:4600
- C:\Windows\System\dgGbhNn.exe
  C:\Windows\System\dgGbhNn.exe
  2⤵
  PID:4696
- C:\Windows\System\PQWHMQy.exe
  C:\Windows\System\PQWHMQy.exe
  2⤵
  PID:4684
- C:\Windows\System\YWWkoRv.exe
  C:\Windows\System\YWWkoRv.exe
  2⤵
  PID:4752
- C:\Windows\System\OktQjRf.exe
  C:\Windows\System\OktQjRf.exe
  2⤵
  PID:4816
- C:\Windows\System\xruzQgC.exe
  C:\Windows\System\xruzQgC.exe
  2⤵
  PID:4884
- C:\Windows\System\JeIaHOe.exe
  C:\Windows\System\JeIaHOe.exe
  2⤵
  PID:4964
- C:\Windows\System\zBvdaBH.exe
  C:\Windows\System\zBvdaBH.exe
  2⤵
  PID:4804
- C:\Windows\System\fHYZJlf.exe
  C:\Windows\System\fHYZJlf.exe
  2⤵
  PID:5068
- C:\Windows\System\degkvKk.exe
  C:\Windows\System\degkvKk.exe
  2⤵
  PID:2132
- C:\Windows\System\kVTcRBY.exe
  C:\Windows\System\kVTcRBY.exe
  2⤵
  PID:4100
- C:\Windows\System\XhMRxDc.exe
  C:\Windows\System\XhMRxDc.exe
  2⤵
  PID:4232
- C:\Windows\System\gIffOod.exe
  C:\Windows\System\gIffOod.exe
  2⤵
  PID:4200
- C:\Windows\System\rnOMWnW.exe
  C:\Windows\System\rnOMWnW.exe
  2⤵
  PID:4800
- C:\Windows\System\igDUIrV.exe
  C:\Windows\System\igDUIrV.exe
  2⤵
  PID:4948
- C:\Windows\System\xekLlsD.exe
  C:\Windows\System\xekLlsD.exe
  2⤵
  PID:3604
- C:\Windows\System\hHEfVwH.exe
  C:\Windows\System\hHEfVwH.exe
  2⤵
  PID:4252
- C:\Windows\System\FKuzyEO.exe
  C:\Windows\System\FKuzyEO.exe
  2⤵
  PID:4904
- C:\Windows\System\SkfPfxM.exe
  C:\Windows\System\SkfPfxM.exe
  2⤵
  PID:4284
- C:\Windows\System\DlhPSjU.exe
  C:\Windows\System\DlhPSjU.exe
  2⤵
  PID:4440
- C:\Windows\System\ikHWFZB.exe
  C:\Windows\System\ikHWFZB.exe
  2⤵
  PID:4292
- C:\Windows\System\wNfRbBD.exe
  C:\Windows\System\wNfRbBD.exe
  2⤵
  PID:4404
- C:\Windows\System\VdVoSVm.exe
  C:\Windows\System\VdVoSVm.exe
  2⤵
  PID:4468
- C:\Windows\System\BltSTnX.exe
  C:\Windows\System\BltSTnX.exe
  2⤵
  PID:4508
- C:\Windows\System\YSBsIDS.exe
  C:\Windows\System\YSBsIDS.exe
  2⤵
  PID:4584
- C:\Windows\System\vdrKAXT.exe
  C:\Windows\System\vdrKAXT.exe
  2⤵
  PID:4648
- C:\Windows\System\efXvTEI.exe
  C:\Windows\System\efXvTEI.exe
  2⤵
  PID:4636
- C:\Windows\System\wQtfJiF.exe
  C:\Windows\System\wQtfJiF.exe
  2⤵
  PID:4784
- C:\Windows\System\kDicEVf.exe
  C:\Windows\System\kDicEVf.exe
  2⤵
  PID:5036
- C:\Windows\System\qrzbdMv.exe
  C:\Windows\System\qrzbdMv.exe
  2⤵
  PID:3624
- C:\Windows\System\BqiCvvM.exe
  C:\Windows\System\BqiCvvM.exe
  2⤵
  PID:4924
- C:\Windows\System\UjCMxcY.exe
  C:\Windows\System\UjCMxcY.exe
  2⤵
  PID:4848
- C:\Windows\System\bAqbzOm.exe
  C:\Windows\System\bAqbzOm.exe
  2⤵
  PID:4728
- C:\Windows\System\nEsnifD.exe
  C:\Windows\System\nEsnifD.exe
  2⤵
  PID:4832
- C:\Windows\System\hDkUdEM.exe
  C:\Windows\System\hDkUdEM.exe
  2⤵
  PID:4744
- C:\Windows\System\dcKmKDB.exe
  C:\Windows\System\dcKmKDB.exe
  2⤵
  PID:5000
- C:\Windows\System\rYEtxPP.exe
  C:\Windows\System\rYEtxPP.exe
  2⤵
  PID:5016
- C:\Windows\System\FKchFlS.exe
  C:\Windows\System\FKchFlS.exe
  2⤵
  PID:4464
- C:\Windows\System\pgrbRBG.exe
  C:\Windows\System\pgrbRBG.exe
  2⤵
  PID:4524
- C:\Windows\System\ZDPbMHM.exe
  C:\Windows\System\ZDPbMHM.exe
  2⤵
  PID:4160
- C:\Windows\System\RcZdyFw.exe
  C:\Windows\System\RcZdyFw.exe
  2⤵
  PID:4700
- C:\Windows\System\sGykcpY.exe
  C:\Windows\System\sGykcpY.exe
  2⤵
  PID:4504
- C:\Windows\System\qzcgzZZ.exe
  C:\Windows\System\qzcgzZZ.exe
  2⤵
  PID:4868
- C:\Windows\System\jvzrTpK.exe
  C:\Windows\System\jvzrTpK.exe
  2⤵
  PID:5132
- C:\Windows\System\NuMtxeZ.exe
  C:\Windows\System\NuMtxeZ.exe
  2⤵
  PID:5148
- C:\Windows\System\cWYuJXr.exe
  C:\Windows\System\cWYuJXr.exe
  2⤵
  PID:5164
- C:\Windows\System\SHjkqLu.exe
  C:\Windows\System\SHjkqLu.exe
  2⤵
  PID:5192
- C:\Windows\System\tHWoXAc.exe
  C:\Windows\System\tHWoXAc.exe
  2⤵
  PID:5212
- C:\Windows\System\YmWvkOK.exe
  C:\Windows\System\YmWvkOK.exe
  2⤵
  PID:5232
- C:\Windows\System\kCXixqH.exe
  C:\Windows\System\kCXixqH.exe
  2⤵
  PID:5248
- C:\Windows\System\KrFKmvE.exe
  C:\Windows\System\KrFKmvE.exe
  2⤵
  PID:5268
- C:\Windows\System\DoUjneX.exe
  C:\Windows\System\DoUjneX.exe
  2⤵
  PID:5288
- C:\Windows\System\xXpxlVv.exe
  C:\Windows\System\xXpxlVv.exe
  2⤵
  PID:5304
- C:\Windows\System\GqjTvzn.exe
  C:\Windows\System\GqjTvzn.exe
  2⤵
  PID:5320
- C:\Windows\System\JPwLkkf.exe
  C:\Windows\System\JPwLkkf.exe
  2⤵
  PID:5336
- C:\Windows\System\rfizFhw.exe
  C:\Windows\System\rfizFhw.exe
  2⤵
  PID:5352
- C:\Windows\System\sTbkTJb.exe
  C:\Windows\System\sTbkTJb.exe
  2⤵
  PID:5368
- C:\Windows\System\mGjuhjU.exe
  C:\Windows\System\mGjuhjU.exe
  2⤵
  PID:5392
- C:\Windows\System\iwVpkSP.exe
  C:\Windows\System\iwVpkSP.exe
  2⤵
  PID:5408
- C:\Windows\System\RrsvkMC.exe
  C:\Windows\System\RrsvkMC.exe
  2⤵
  PID:5424
- C:\Windows\System\rvuexMi.exe
  C:\Windows\System\rvuexMi.exe
  2⤵
  PID:5440
- C:\Windows\System\BicKCNR.exe
  C:\Windows\System\BicKCNR.exe
  2⤵
  PID:5464
- C:\Windows\System\IOJhoTz.exe
  C:\Windows\System\IOJhoTz.exe
  2⤵
  PID:5480
- C:\Windows\System\PGQftqJ.exe
  C:\Windows\System\PGQftqJ.exe
  2⤵
  PID:5504
- C:\Windows\System\KzgwyuA.exe
  C:\Windows\System\KzgwyuA.exe
  2⤵
  PID:5536
- C:\Windows\System\oDwTPCv.exe
  C:\Windows\System\oDwTPCv.exe
  2⤵
  PID:5560
- C:\Windows\System\JYBsNbt.exe
  C:\Windows\System\JYBsNbt.exe
  2⤵
  PID:5584
- C:\Windows\System\QIUMuiQ.exe
  C:\Windows\System\QIUMuiQ.exe
  2⤵
  PID:5600
- C:\Windows\System\JTnHArI.exe
  C:\Windows\System\JTnHArI.exe
  2⤵
  PID:5620
- C:\Windows\System\VOCDUKH.exe
  C:\Windows\System\VOCDUKH.exe
  2⤵
  PID:5636
- C:\Windows\System\sZFOvuo.exe
  C:\Windows\System\sZFOvuo.exe
  2⤵
  PID:5652
- C:\Windows\System\mJczElP.exe
  C:\Windows\System\mJczElP.exe
  2⤵
  PID:5680
- C:\Windows\System\gBVMEbV.exe
  C:\Windows\System\gBVMEbV.exe
  2⤵
  PID:5744
- C:\Windows\System\kFpZGut.exe
  C:\Windows\System\kFpZGut.exe
  2⤵
  PID:5768
- C:\Windows\System\gGKSrwf.exe
  C:\Windows\System\gGKSrwf.exe
  2⤵
  PID:5784
- C:\Windows\System\pGlAmEx.exe
  C:\Windows\System\pGlAmEx.exe
  2⤵
  PID:5800
- C:\Windows\System\XIUZHnv.exe
  C:\Windows\System\XIUZHnv.exe
  2⤵
  PID:5828
- C:\Windows\System\LHXYrNG.exe
  C:\Windows\System\LHXYrNG.exe
  2⤵
  PID:5844
- C:\Windows\System\koMJXMB.exe
  C:\Windows\System\koMJXMB.exe
  2⤵
  PID:5860
- C:\Windows\System\ysQIuef.exe
  C:\Windows\System\ysQIuef.exe
  2⤵
  PID:5876
- C:\Windows\System\UWRyrDX.exe
  C:\Windows\System\UWRyrDX.exe
  2⤵
  PID:5892
- C:\Windows\System\ATLftSm.exe
  C:\Windows\System\ATLftSm.exe
  2⤵
  PID:5908
- C:\Windows\System\uMWaBGl.exe
  C:\Windows\System\uMWaBGl.exe
  2⤵
  PID:5924
- C:\Windows\System\LQaWtAC.exe
  C:\Windows\System\LQaWtAC.exe
  2⤵
  PID:5940
- C:\Windows\System\KPxHMVX.exe
  C:\Windows\System\KPxHMVX.exe
  2⤵
  PID:5956
- C:\Windows\System\WjkKazl.exe
  C:\Windows\System\WjkKazl.exe
  2⤵
  PID:5972
- C:\Windows\System\GzDZsGR.exe
  C:\Windows\System\GzDZsGR.exe
  2⤵
  PID:5988
- C:\Windows\System\lInqDVo.exe
  C:\Windows\System\lInqDVo.exe
  2⤵
  PID:6008
- C:\Windows\System\tlexdsp.exe
  C:\Windows\System\tlexdsp.exe
  2⤵
  PID:6032
- C:\Windows\System\TEoNQlq.exe
  C:\Windows\System\TEoNQlq.exe
  2⤵
  PID:6048
- C:\Windows\System\KPCXaEC.exe
  C:\Windows\System\KPCXaEC.exe
  2⤵
  PID:6064
- C:\Windows\System\iuiYzJJ.exe
  C:\Windows\System\iuiYzJJ.exe
  2⤵
  PID:6084
- C:\Windows\System\tQFhnnM.exe
  C:\Windows\System\tQFhnnM.exe
  2⤵
  PID:6104
- C:\Windows\System\kGfUVwm.exe
  C:\Windows\System\kGfUVwm.exe
  2⤵
  PID:6124
- C:\Windows\System\PDrPrLF.exe
  C:\Windows\System\PDrPrLF.exe
  2⤵
  PID:6140
- C:\Windows\System\hzJrGMc.exe
  C:\Windows\System\hzJrGMc.exe
  2⤵
  PID:4340
- C:\Windows\System\QKwbQdk.exe
  C:\Windows\System\QKwbQdk.exe
  2⤵
  PID:4216
- C:\Windows\System\RrerUod.exe
  C:\Windows\System\RrerUod.exe
  2⤵
  PID:5188
- C:\Windows\System\AlGSvFk.exe
  C:\Windows\System\AlGSvFk.exe
  2⤵
  PID:5020
- C:\Windows\System\cqaDxuB.exe
  C:\Windows\System\cqaDxuB.exe
  2⤵
  PID:5264
- C:\Windows\System\nUpmsMU.exe
  C:\Windows\System\nUpmsMU.exe
  2⤵
  PID:2580
- C:\Windows\System\jggsdvk.exe
  C:\Windows\System\jggsdvk.exe
  2⤵
  PID:4460
- C:\Windows\System\CFhTYdF.exe
  C:\Windows\System\CFhTYdF.exe
  2⤵
  PID:5124
- C:\Windows\System\VokXoqh.exe
  C:\Windows\System\VokXoqh.exe
  2⤵
  PID:5112
- C:\Windows\System\uaEILAq.exe
  C:\Windows\System\uaEILAq.exe
  2⤵
  PID:5204
- C:\Windows\System\kOOrYIm.exe
  C:\Windows\System\kOOrYIm.exe
  2⤵
  PID:5276
- C:\Windows\System\kMtnpVB.exe
  C:\Windows\System\kMtnpVB.exe
  2⤵
  PID:5360
- C:\Windows\System\zfsRTxs.exe
  C:\Windows\System\zfsRTxs.exe
  2⤵
  PID:4900
- C:\Windows\System\OmWXOGe.exe
  C:\Windows\System\OmWXOGe.exe
  2⤵
  PID:5436
- C:\Windows\System\AbYfzTz.exe
  C:\Windows\System\AbYfzTz.exe
  2⤵
  PID:4488
- C:\Windows\System\bgCbyJR.exe
  C:\Windows\System\bgCbyJR.exe
  2⤵
  PID:4500
- C:\Windows\System\koaOTKr.exe
  C:\Windows\System\koaOTKr.exe
  2⤵
  PID:4124
- C:\Windows\System\lMXtgTk.exe
  C:\Windows\System\lMXtgTk.exe
  2⤵
  PID:4544
- C:\Windows\System\SEpnoIK.exe
  C:\Windows\System\SEpnoIK.exe
  2⤵
  PID:5416
- C:\Windows\System\vIgbeCN.exe
  C:\Windows\System\vIgbeCN.exe
  2⤵
  PID:5376
- C:\Windows\System\PkXYMlp.exe
  C:\Windows\System\PkXYMlp.exe
  2⤵
  PID:5420
- C:\Windows\System\ucDcqgN.exe
  C:\Windows\System\ucDcqgN.exe
  2⤵
  PID:5488
- C:\Windows\System\ZqETQpe.exe
  C:\Windows\System\ZqETQpe.exe
  2⤵
  PID:5532
- C:\Windows\System\AjDvpos.exe
  C:\Windows\System\AjDvpos.exe
  2⤵
  PID:5576
- C:\Windows\System\jwYCfTh.exe
  C:\Windows\System\jwYCfTh.exe
  2⤵
  PID:5616
- C:\Windows\System\VKOjxwA.exe
  C:\Windows\System\VKOjxwA.exe
  2⤵
  PID:5696
- C:\Windows\System\vTsbTPr.exe
  C:\Windows\System\vTsbTPr.exe
  2⤵
  PID:5712
- C:\Windows\System\WvppvvE.exe
  C:\Windows\System\WvppvvE.exe
  2⤵
  PID:5728
- C:\Windows\System\tYtXRHb.exe
  C:\Windows\System\tYtXRHb.exe
  2⤵
  PID:5776
- C:\Windows\System\bwuIFTg.exe
  C:\Windows\System\bwuIFTg.exe
  2⤵
  PID:5820
- C:\Windows\System\QeVlLyz.exe
  C:\Windows\System\QeVlLyz.exe
  2⤵
  PID:5884
- C:\Windows\System\mNwLVCv.exe
  C:\Windows\System\mNwLVCv.exe
  2⤵
  PID:5920
- C:\Windows\System\eOoGLpr.exe
  C:\Windows\System\eOoGLpr.exe
  2⤵
  PID:5984
- C:\Windows\System\JMqvRRT.exe
  C:\Windows\System\JMqvRRT.exe
  2⤵
  PID:6056
- C:\Windows\System\NEPbRXD.exe
  C:\Windows\System\NEPbRXD.exe
  2⤵
  PID:6096
- C:\Windows\System\KnmYdOd.exe
  C:\Windows\System\KnmYdOd.exe
  2⤵
  PID:5144
- C:\Windows\System\jOWqqmM.exe
  C:\Windows\System\jOWqqmM.exe
  2⤵
  PID:5228
- C:\Windows\System\eNXiYiN.exe
  C:\Windows\System\eNXiYiN.exe
  2⤵
  PID:5332
- C:\Windows\System\drGhzHi.exe
  C:\Windows\System\drGhzHi.exe
  2⤵
  PID:5080
- C:\Windows\System\PVTNhZV.exe
  C:\Windows\System\PVTNhZV.exe
  2⤵
  PID:5280
- C:\Windows\System\OcVqybM.exe
  C:\Windows\System\OcVqybM.exe
  2⤵
  PID:5432
- C:\Windows\System\kEmktzq.exe
  C:\Windows\System\kEmktzq.exe
  2⤵
  PID:5452
- C:\Windows\System\svwyYDQ.exe
  C:\Windows\System\svwyYDQ.exe
  2⤵
  PID:5476
- C:\Windows\System\KekpIwV.exe
  C:\Windows\System\KekpIwV.exe
  2⤵
  PID:5688
- C:\Windows\System\mlsxtvj.exe
  C:\Windows\System\mlsxtvj.exe
  2⤵
  PID:5812
- C:\Windows\System\nsAPPLa.exe
  C:\Windows\System\nsAPPLa.exe
  2⤵
  PID:6080
- C:\Windows\System\aBVPRmN.exe
  C:\Windows\System\aBVPRmN.exe
  2⤵
  PID:4356
- C:\Windows\System\lymdTIn.exe
  C:\Windows\System\lymdTIn.exe
  2⤵
  PID:5244
- C:\Windows\System\oBlOSpg.exe
  C:\Windows\System\oBlOSpg.exe
  2⤵
  PID:4944
- C:\Windows\System\PLOzzIR.exe
  C:\Windows\System\PLOzzIR.exe
  2⤵
  PID:4688
- C:\Windows\System\lkTgYZT.exe
  C:\Windows\System\lkTgYZT.exe
  2⤵
  PID:5760
- C:\Windows\System\UPIJgny.exe
  C:\Windows\System\UPIJgny.exe
  2⤵
  PID:5996
- C:\Windows\System\XwwALED.exe
  C:\Windows\System\XwwALED.exe
  2⤵
  PID:5200
- C:\Windows\System\UBnYGCy.exe
  C:\Windows\System\UBnYGCy.exe
  2⤵
  PID:5592
- C:\Windows\System\IhGNepG.exe
  C:\Windows\System\IhGNepG.exe
  2⤵
  PID:5660
- C:\Windows\System\zVuhceE.exe
  C:\Windows\System\zVuhceE.exe
  2⤵
  PID:5836
- C:\Windows\System\WnMTntG.exe
  C:\Windows\System\WnMTntG.exe
  2⤵
  PID:6004
- C:\Windows\System\rGbJgda.exe
  C:\Windows\System\rGbJgda.exe
  2⤵
  PID:5256
- C:\Windows\System\RqMhsZC.exe
  C:\Windows\System\RqMhsZC.exe
  2⤵
  PID:5720
- C:\Windows\System\AOzDYFx.exe
  C:\Windows\System\AOzDYFx.exe
  2⤵
  PID:6092
- C:\Windows\System\TdnQuDk.exe
  C:\Windows\System\TdnQuDk.exe
  2⤵
  PID:5608
- C:\Windows\System\MdiGuSI.exe
  C:\Windows\System\MdiGuSI.exe
  2⤵
  PID:5708
- C:\Windows\System\bPrISHv.exe
  C:\Windows\System\bPrISHv.exe
  2⤵
  PID:5852
- C:\Windows\System\xWdSwjU.exe
  C:\Windows\System\xWdSwjU.exe
  2⤵
  PID:5856
- C:\Windows\System\bHjJrYh.exe
  C:\Windows\System\bHjJrYh.exe
  2⤵
  PID:6028
- C:\Windows\System\JxSsyHQ.exe
  C:\Windows\System\JxSsyHQ.exe
  2⤵
  PID:5404
- C:\Windows\System\ckvSajE.exe
  C:\Windows\System\ckvSajE.exe
  2⤵
  PID:5116
- C:\Windows\System\OFnpuzk.exe
  C:\Windows\System\OFnpuzk.exe
  2⤵
  PID:6132
- C:\Windows\System\ThiSRst.exe
  C:\Windows\System\ThiSRst.exe
  2⤵
  PID:6120
- C:\Windows\System\dIZnWVi.exe
  C:\Windows\System\dIZnWVi.exe
  2⤵
  PID:5664
- C:\Windows\System\oHRaOrE.exe
  C:\Windows\System\oHRaOrE.exe
  2⤵
  PID:5964
- C:\Windows\System\uUDlVHL.exe
  C:\Windows\System\uUDlVHL.exe
  2⤵
  PID:4308
- C:\Windows\System\ydjsAaW.exe
  C:\Windows\System\ydjsAaW.exe
  2⤵
  PID:4280
- C:\Windows\System\GmgaNCF.exe
  C:\Windows\System\GmgaNCF.exe
  2⤵
  PID:5676
- C:\Windows\System\liBCoLp.exe
  C:\Windows\System\liBCoLp.exe
  2⤵
  PID:5632
- C:\Windows\System\gswuqZe.exe
  C:\Windows\System\gswuqZe.exe
  2⤵
  PID:5380
- C:\Windows\System\rUjdUNk.exe
  C:\Windows\System\rUjdUNk.exe
  2⤵
  PID:5900
- C:\Windows\System\FOqtSyb.exe
  C:\Windows\System\FOqtSyb.exe
  2⤵
  PID:5348
- C:\Windows\System\zBsfqlV.exe
  C:\Windows\System\zBsfqlV.exe
  2⤵
  PID:4276
- C:\Windows\System\EOSbrrT.exe
  C:\Windows\System\EOSbrrT.exe
  2⤵
  PID:5492
- C:\Windows\System\VBdQDGm.exe
  C:\Windows\System\VBdQDGm.exe
  2⤵
  PID:5756
- C:\Windows\System\CvtJXwP.exe
  C:\Windows\System\CvtJXwP.exe
  2⤵
  PID:5500
- C:\Windows\System\isuEywx.exe
  C:\Windows\System\isuEywx.exe
  2⤵
  PID:5544
- C:\Windows\System\qsNMiCf.exe
  C:\Windows\System\qsNMiCf.exe
  2⤵
  PID:5240
- C:\Windows\System\XcsWCih.exe
  C:\Windows\System\XcsWCih.exe
  2⤵
  PID:4188
- C:\Windows\System\lzscmcM.exe
  C:\Windows\System\lzscmcM.exe
  2⤵
  PID:4620
- C:\Windows\System\VkSZIOc.exe
  C:\Windows\System\VkSZIOc.exe
  2⤵
  PID:5764
- C:\Windows\System\yseGsEo.exe
  C:\Windows\System\yseGsEo.exe
  2⤵
  PID:6000
- C:\Windows\System\KhkYxhI.exe
  C:\Windows\System\KhkYxhI.exe
  2⤵
  PID:4496
- C:\Windows\System\mjKUVad.exe
  C:\Windows\System\mjKUVad.exe
  2⤵
  PID:5184
- C:\Windows\System\heLhdZv.exe
  C:\Windows\System\heLhdZv.exe
  2⤵
  PID:5548
- C:\Windows\System\uawNpwp.exe
  C:\Windows\System\uawNpwp.exe
  2⤵
  PID:5980
- C:\Windows\System\gVjKXhP.exe
  C:\Windows\System\gVjKXhP.exe
  2⤵
  PID:5916
- C:\Windows\System\VkYxkeY.exe
  C:\Windows\System\VkYxkeY.exe
  2⤵
  PID:4764
- C:\Windows\System\izbimKg.exe
  C:\Windows\System\izbimKg.exe
  2⤵
  PID:6148
- C:\Windows\System\MwYDozO.exe
  C:\Windows\System\MwYDozO.exe
  2⤵
  PID:6164
- C:\Windows\System\sevxfiq.exe
  C:\Windows\System\sevxfiq.exe
  2⤵
  PID:6180
- C:\Windows\System\ntFHKXk.exe
  C:\Windows\System\ntFHKXk.exe
  2⤵
  PID:6204
- C:\Windows\System\nVeymio.exe
  C:\Windows\System\nVeymio.exe
  2⤵
  PID:6220
- C:\Windows\System\AVWlBnF.exe
  C:\Windows\System\AVWlBnF.exe
  2⤵
  PID:6236
- C:\Windows\System\Zykqfmn.exe
  C:\Windows\System\Zykqfmn.exe
  2⤵
  PID:6256
- C:\Windows\System\guWihuz.exe
  C:\Windows\System\guWihuz.exe
  2⤵
  PID:6272
- C:\Windows\System\kQbuPnr.exe
  C:\Windows\System\kQbuPnr.exe
  2⤵
  PID:6288
- C:\Windows\System\RypeUbw.exe
  C:\Windows\System\RypeUbw.exe
  2⤵
  PID:6304
- C:\Windows\System\gmAMwdy.exe
  C:\Windows\System\gmAMwdy.exe
  2⤵
  PID:6320
- C:\Windows\System\sUkSsTl.exe
  C:\Windows\System\sUkSsTl.exe
  2⤵
  PID:6340
- C:\Windows\System\GouXChL.exe
  C:\Windows\System\GouXChL.exe
  2⤵
  PID:6356
- C:\Windows\System\ddMhuNJ.exe
  C:\Windows\System\ddMhuNJ.exe
  2⤵
  PID:6372
- C:\Windows\System\wMeoluV.exe
  C:\Windows\System\wMeoluV.exe
  2⤵
  PID:6388
- C:\Windows\System\NPexrMh.exe
  C:\Windows\System\NPexrMh.exe
  2⤵
  PID:6408
- C:\Windows\System\SbHnlqG.exe
  C:\Windows\System\SbHnlqG.exe
  2⤵
  PID:6428
- C:\Windows\System\BgAGBXR.exe
  C:\Windows\System\BgAGBXR.exe
  2⤵
  PID:6444
- C:\Windows\System\QBakqlZ.exe
  C:\Windows\System\QBakqlZ.exe
  2⤵
  PID:6460
- C:\Windows\System\xAsCQAy.exe
  C:\Windows\System\xAsCQAy.exe
  2⤵
  PID:6476
- C:\Windows\System\wglBvxs.exe
  C:\Windows\System\wglBvxs.exe
  2⤵
  PID:6492
- C:\Windows\System\wZJQGGM.exe
  C:\Windows\System\wZJQGGM.exe
  2⤵
  PID:6508
- C:\Windows\System\qBXbdMz.exe
  C:\Windows\System\qBXbdMz.exe
  2⤵
  PID:6524
- C:\Windows\System\AGiewdV.exe
  C:\Windows\System\AGiewdV.exe
  2⤵
  PID:6540
- C:\Windows\System\BlImZdp.exe
  C:\Windows\System\BlImZdp.exe
  2⤵
  PID:6556
- C:\Windows\System\DNqWGFR.exe
  C:\Windows\System\DNqWGFR.exe
  2⤵
  PID:6572
- C:\Windows\System\phsPTKl.exe
  C:\Windows\System\phsPTKl.exe
  2⤵
  PID:6592
- C:\Windows\System\MnRXgwR.exe
  C:\Windows\System\MnRXgwR.exe
  2⤵
  PID:6608
- C:\Windows\System\wfPModq.exe
  C:\Windows\System\wfPModq.exe
  2⤵
  PID:6624
- C:\Windows\System\MMEDOcd.exe
  C:\Windows\System\MMEDOcd.exe
  2⤵
  PID:6640
- C:\Windows\System\MQthDVJ.exe
  C:\Windows\System\MQthDVJ.exe
  2⤵
  PID:6656
- C:\Windows\System\owmTVna.exe
  C:\Windows\System\owmTVna.exe
  2⤵
  PID:6672
- C:\Windows\System\tEvmNxT.exe
  C:\Windows\System\tEvmNxT.exe
  2⤵
  PID:6692
- C:\Windows\System\aafzziy.exe
  C:\Windows\System\aafzziy.exe
  2⤵
  PID:6708
- C:\Windows\System\TKvsclb.exe
  C:\Windows\System\TKvsclb.exe
  2⤵
  PID:6724
- C:\Windows\System\lQpQicT.exe
  C:\Windows\System\lQpQicT.exe
  2⤵
  PID:6740
- C:\Windows\System\xpDPzec.exe
  C:\Windows\System\xpDPzec.exe
  2⤵
  PID:6756
- C:\Windows\System\NxyELip.exe
  C:\Windows\System\NxyELip.exe
  2⤵
  PID:6772
- C:\Windows\System\FVTTrtL.exe
  C:\Windows\System\FVTTrtL.exe
  2⤵
  PID:6792
- C:\Windows\System\svnNosE.exe
  C:\Windows\System\svnNosE.exe
  2⤵
  PID:6812
- C:\Windows\System\xHixhmf.exe
  C:\Windows\System\xHixhmf.exe
  2⤵
  PID:6828
- C:\Windows\System\uwuFrlD.exe
  C:\Windows\System\uwuFrlD.exe
  2⤵
  PID:6844
- C:\Windows\System\YJqYTIk.exe
  C:\Windows\System\YJqYTIk.exe
  2⤵
  PID:6860
- C:\Windows\System\SjIGgnc.exe
  C:\Windows\System\SjIGgnc.exe
  2⤵
  PID:6876
- C:\Windows\System\kBfBYsg.exe
  C:\Windows\System\kBfBYsg.exe
  2⤵
  PID:6904
- C:\Windows\System\qrtVXzo.exe
  C:\Windows\System\qrtVXzo.exe
  2⤵
  PID:6924
- C:\Windows\System\SquPjjn.exe
  C:\Windows\System\SquPjjn.exe
  2⤵
  PID:6940
- C:\Windows\System\GQibdkw.exe
  C:\Windows\System\GQibdkw.exe
  2⤵
  PID:6960
- C:\Windows\System\usAcqjR.exe
  C:\Windows\System\usAcqjR.exe
  2⤵
  PID:6976
- C:\Windows\System\FRTadjE.exe
  C:\Windows\System\FRTadjE.exe
  2⤵
  PID:6992
- C:\Windows\System\glnaPah.exe
  C:\Windows\System\glnaPah.exe
  2⤵
  PID:7008
- C:\Windows\System\mnTDnEK.exe
  C:\Windows\System\mnTDnEK.exe
  2⤵
  PID:7024
- C:\Windows\System\jLtFlQw.exe
  C:\Windows\System\jLtFlQw.exe
  2⤵
  PID:7040
- C:\Windows\System\ikxhGoF.exe
  C:\Windows\System\ikxhGoF.exe
  2⤵
  PID:7056
- C:\Windows\System\KthnRvQ.exe
  C:\Windows\System\KthnRvQ.exe
  2⤵
  PID:7072
- C:\Windows\System\yBPzSpw.exe
  C:\Windows\System\yBPzSpw.exe
  2⤵
  PID:7088
- C:\Windows\System\EGURdaB.exe
  C:\Windows\System\EGURdaB.exe
  2⤵
  PID:7108
- C:\Windows\System\tfKfBbe.exe
  C:\Windows\System\tfKfBbe.exe
  2⤵
  PID:7124
- C:\Windows\System\mcnzKZn.exe
  C:\Windows\System\mcnzKZn.exe
  2⤵
  PID:7140
- C:\Windows\System\LlebWHg.exe
  C:\Windows\System\LlebWHg.exe
  2⤵
  PID:7156
- C:\Windows\System\ecNSOIL.exe
  C:\Windows\System\ecNSOIL.exe
  2⤵
  PID:6156
- C:\Windows\System\EEeVjXb.exe
  C:\Windows\System\EEeVjXb.exe
  2⤵
  PID:6192
- C:\Windows\System\rXtaKCd.exe
  C:\Windows\System\rXtaKCd.exe
  2⤵
  PID:5868
- C:\Windows\System\AfNqyXL.exe
  C:\Windows\System\AfNqyXL.exe
  2⤵
  PID:6264
- C:\Windows\System\AeqxamT.exe
  C:\Windows\System\AeqxamT.exe
  2⤵
  PID:6328
- C:\Windows\System\hVBOIXH.exe
  C:\Windows\System\hVBOIXH.exe
  2⤵
  PID:6212
- C:\Windows\System\ulRcQkS.exe
  C:\Windows\System\ulRcQkS.exe
  2⤵
  PID:6284
- C:\Windows\System\pnoGJfY.exe
  C:\Windows\System\pnoGJfY.exe
  2⤵
  PID:6248
- C:\Windows\System\DKfHUGq.exe
  C:\Windows\System\DKfHUGq.exe
  2⤵
  PID:6352
- C:\Windows\System\AWAGhpC.exe
  C:\Windows\System\AWAGhpC.exe
  2⤵
  PID:6380
- C:\Windows\System\krnEyBt.exe
  C:\Windows\System\krnEyBt.exe
  2⤵
  PID:6420
- C:\Windows\System\UGghcfG.exe
  C:\Windows\System\UGghcfG.exe
  2⤵
  PID:6452
- C:\Windows\System\vbZdgmo.exe
  C:\Windows\System\vbZdgmo.exe
  2⤵
  PID:6536
- C:\Windows\System\fRUKRly.exe
  C:\Windows\System\fRUKRly.exe
  2⤵
  PID:6484
- C:\Windows\System\jcZHplY.exe
  C:\Windows\System\jcZHplY.exe
  2⤵
  PID:6632
- C:\Windows\System\IifzhSe.exe
  C:\Windows\System\IifzhSe.exe
  2⤵
  PID:6700
- C:\Windows\System\WoPhfkS.exe
  C:\Windows\System\WoPhfkS.exe
  2⤵
  PID:6520
- C:\Windows\System\BIfIirB.exe
  C:\Windows\System\BIfIirB.exe
  2⤵
  PID:6768
- C:\Windows\System\llCljsR.exe
  C:\Windows\System\llCljsR.exe
  2⤵
  PID:6584
- C:\Windows\System\klDQuuN.exe
  C:\Windows\System\klDQuuN.exe
  2⤵
  PID:6648
- C:\Windows\System\ULuWKRm.exe
  C:\Windows\System\ULuWKRm.exe
  2⤵
  PID:6720
- C:\Windows\System\uwTiYpV.exe
  C:\Windows\System\uwTiYpV.exe
  2⤵
  PID:6784
- C:\Windows\System\BhJSRyf.exe
  C:\Windows\System\BhJSRyf.exe
  2⤵
  PID:6836
- C:\Windows\System\nXSDfkS.exe
  C:\Windows\System\nXSDfkS.exe
  2⤵
  PID:6912
- C:\Windows\System\AimupGO.exe
  C:\Windows\System\AimupGO.exe
  2⤵
  PID:6952
- C:\Windows\System\dKgDfOy.exe
  C:\Windows\System\dKgDfOy.exe
  2⤵
  PID:6856
- C:\Windows\System\CbidySJ.exe
  C:\Windows\System\CbidySJ.exe
  2⤵
  PID:6900
- C:\Windows\System\SyBvugF.exe
  C:\Windows\System\SyBvugF.exe
  2⤵
  PID:7016
- C:\Windows\System\aOjhFlz.exe
  C:\Windows\System\aOjhFlz.exe
  2⤵
  PID:7000
- C:\Windows\System\LiWehck.exe
  C:\Windows\System\LiWehck.exe
  2⤵
  PID:7032
- C:\Windows\System\qyykKYg.exe
  C:\Windows\System\qyykKYg.exe
  2⤵
  PID:7116
- C:\Windows\System\RikEazE.exe
  C:\Windows\System\RikEazE.exe
  2⤵
  PID:7120
- C:\Windows\System\yTwvvHu.exe
  C:\Windows\System\yTwvvHu.exe
  2⤵
  PID:7152
- C:\Windows\System\VZaXwTB.exe
  C:\Windows\System\VZaXwTB.exe
  2⤵
  PID:7164
- C:\Windows\System\VNolRtl.exe
  C:\Windows\System\VNolRtl.exe
  2⤵
  PID:6336
- C:\Windows\System\mnARXoQ.exe
  C:\Windows\System\mnARXoQ.exe
  2⤵
  PID:6368
- C:\Windows\System\qHYLmaK.exe
  C:\Windows\System\qHYLmaK.exe
  2⤵
  PID:6400
- C:\Windows\System\Ajuucwj.exe
  C:\Windows\System\Ajuucwj.exe
  2⤵
  PID:6436
- C:\Windows\System\tpWnMYl.exe
  C:\Windows\System\tpWnMYl.exe
  2⤵
  PID:6440
- C:\Windows\System\RhZRHUk.exe
  C:\Windows\System\RhZRHUk.exe
  2⤵
  PID:6668
- C:\Windows\System\wQmfcGE.exe
  C:\Windows\System\wQmfcGE.exe
  2⤵
  PID:6616
- C:\Windows\System\BoEXtSy.exe
  C:\Windows\System\BoEXtSy.exe
  2⤵
  PID:6872
- C:\Windows\System\AfsOvhs.exe
  C:\Windows\System\AfsOvhs.exe
  2⤵
  PID:6852
- C:\Windows\System\htkHhMH.exe
  C:\Windows\System\htkHhMH.exe
  2⤵
  PID:6548
- C:\Windows\System\qEgnVpJ.exe
  C:\Windows\System\qEgnVpJ.exe
  2⤵
  PID:6824
- C:\Windows\System\ultULKz.exe
  C:\Windows\System\ultULKz.exe
  2⤵
  PID:6984
- C:\Windows\System\wDLdWaq.exe
  C:\Windows\System\wDLdWaq.exe
  2⤵
  PID:6736
- C:\Windows\System\illTCYt.exe
  C:\Windows\System\illTCYt.exe
  2⤵
  PID:6716
- C:\Windows\System\tnHRTaI.exe
  C:\Windows\System\tnHRTaI.exe
  2⤵
  PID:7096
- C:\Windows\System\aJqFUGO.exe
  C:\Windows\System\aJqFUGO.exe
  2⤵
  PID:6972
- C:\Windows\System\BxKPEQE.exe
  C:\Windows\System\BxKPEQE.exe
  2⤵
  PID:7148
- C:\Windows\System\oKEeJDn.exe
  C:\Windows\System\oKEeJDn.exe
  2⤵
  PID:7132
- C:\Windows\System\UsSIgwt.exe
  C:\Windows\System\UsSIgwt.exe
  2⤵
  PID:5740
- C:\Windows\System\VOEbOrv.exe
  C:\Windows\System\VOEbOrv.exe
  2⤵
  PID:6968
- C:\Windows\System\gcIUWAO.exe
  C:\Windows\System\gcIUWAO.exe
  2⤵
  PID:6244
- C:\Windows\System\qsBPpXD.exe
  C:\Windows\System\qsBPpXD.exe
  2⤵
  PID:6808
- C:\Windows\System\eaTiXOs.exe
  C:\Windows\System\eaTiXOs.exe
  2⤵
  PID:6300
- C:\Windows\System\MTDGhqj.exe
  C:\Windows\System\MTDGhqj.exe
  2⤵
  PID:6580
- C:\Windows\System\NIeCKrq.exe
  C:\Windows\System\NIeCKrq.exe
  2⤵
  PID:6732
- C:\Windows\System\cfAbdXA.exe
  C:\Windows\System\cfAbdXA.exe
  2⤵
  PID:6780
- C:\Windows\System\DtPbESM.exe
  C:\Windows\System\DtPbESM.exe
  2⤵
  PID:7036
- C:\Windows\System\eunNrtD.exe
  C:\Windows\System\eunNrtD.exe
  2⤵
  PID:6868
- C:\Windows\System\vzJKDtm.exe
  C:\Windows\System\vzJKDtm.exe
  2⤵
  PID:6516
- C:\Windows\System\MUrQJrm.exe
  C:\Windows\System\MUrQJrm.exe
  2⤵
  PID:6232
- C:\Windows\System\AmacXIg.exe
  C:\Windows\System\AmacXIg.exe
  2⤵
  PID:6820
- C:\Windows\System\YAeJVXx.exe
  C:\Windows\System\YAeJVXx.exe
  2⤵
  PID:6916
- C:\Windows\System\uzspvWy.exe
  C:\Windows\System\uzspvWy.exe
  2⤵
  PID:7176
- C:\Windows\System\kVBssZY.exe
  C:\Windows\System\kVBssZY.exe
  2⤵
  PID:7196
- C:\Windows\System\tdRrjcV.exe
  C:\Windows\System\tdRrjcV.exe
  2⤵
  PID:7212
- C:\Windows\System\OqDahvH.exe
  C:\Windows\System\OqDahvH.exe
  2⤵
  PID:7228
- C:\Windows\System\XixrwLj.exe
  C:\Windows\System\XixrwLj.exe
  2⤵
  PID:7244
- C:\Windows\System\Ljkelbj.exe
  C:\Windows\System\Ljkelbj.exe
  2⤵
  PID:7260
- C:\Windows\System\YJjnEnU.exe
  C:\Windows\System\YJjnEnU.exe
  2⤵
  PID:7276
- C:\Windows\System\dbJXUsA.exe
  C:\Windows\System\dbJXUsA.exe
  2⤵
  PID:7296
- C:\Windows\System\pdjdnWd.exe
  C:\Windows\System\pdjdnWd.exe
  2⤵
  PID:7312
- C:\Windows\System\yawNkWR.exe
  C:\Windows\System\yawNkWR.exe
  2⤵
  PID:7328
- C:\Windows\System\uvndvID.exe
  C:\Windows\System\uvndvID.exe
  2⤵
  PID:7344
- C:\Windows\System\RscrMWa.exe
  C:\Windows\System\RscrMWa.exe
  2⤵
  PID:7360
- C:\Windows\System\EUBeOqS.exe
  C:\Windows\System\EUBeOqS.exe
  2⤵
  PID:7380
- C:\Windows\System\bgWeXkr.exe
  C:\Windows\System\bgWeXkr.exe
  2⤵
  PID:7396
- C:\Windows\System\jQyeExy.exe
  C:\Windows\System\jQyeExy.exe
  2⤵
  PID:7412
- C:\Windows\System\wuRnvit.exe
  C:\Windows\System\wuRnvit.exe
  2⤵
  PID:7428
- C:\Windows\System\ZbSNmpk.exe
  C:\Windows\System\ZbSNmpk.exe
  2⤵
  PID:7444
- C:\Windows\System\eKSOJVW.exe
  C:\Windows\System\eKSOJVW.exe
  2⤵
  PID:7460
- C:\Windows\System\qzCPFrx.exe
  C:\Windows\System\qzCPFrx.exe
  2⤵
  PID:7476
- C:\Windows\System\lpHMRqz.exe
  C:\Windows\System\lpHMRqz.exe
  2⤵
  PID:7492
- C:\Windows\System\oXvEMQF.exe
  C:\Windows\System\oXvEMQF.exe
  2⤵
  PID:7508
- C:\Windows\System\FvRyMrV.exe
  C:\Windows\System\FvRyMrV.exe
  2⤵
  PID:7524
- C:\Windows\System\iMRsGUA.exe
  C:\Windows\System\iMRsGUA.exe
  2⤵
  PID:7540
- C:\Windows\System\oGOCAoV.exe
  C:\Windows\System\oGOCAoV.exe
  2⤵
  PID:7556
- C:\Windows\System\MOuREAy.exe
  C:\Windows\System\MOuREAy.exe
  2⤵
  PID:7572
- C:\Windows\System\FZlhfNZ.exe
  C:\Windows\System\FZlhfNZ.exe
  2⤵
  PID:7588
- C:\Windows\System\iMyrGQU.exe
  C:\Windows\System\iMyrGQU.exe
  2⤵
  PID:7604
- C:\Windows\System\DYTMapG.exe
  C:\Windows\System\DYTMapG.exe
  2⤵
  PID:7624
- C:\Windows\System\tmfBNIU.exe
  C:\Windows\System\tmfBNIU.exe
  2⤵
  PID:7640
- C:\Windows\System\xlHKStZ.exe
  C:\Windows\System\xlHKStZ.exe
  2⤵
  PID:7656
- C:\Windows\System\cKEDyFo.exe
  C:\Windows\System\cKEDyFo.exe
  2⤵
  PID:7672
- C:\Windows\System\PiYoNol.exe
  C:\Windows\System\PiYoNol.exe
  2⤵
  PID:7688
- C:\Windows\System\iMfnRxP.exe
  C:\Windows\System\iMfnRxP.exe
  2⤵
  PID:7704
- C:\Windows\System\mlxSdbf.exe
  C:\Windows\System\mlxSdbf.exe
  2⤵
  PID:7720
- C:\Windows\System\TzeFJaf.exe
  C:\Windows\System\TzeFJaf.exe
  2⤵
  PID:7736
- C:\Windows\System\YKKojhu.exe
  C:\Windows\System\YKKojhu.exe
  2⤵
  PID:7752
- C:\Windows\System\MarXAbQ.exe
  C:\Windows\System\MarXAbQ.exe
  2⤵
  PID:7768
- C:\Windows\System\kHtVKUI.exe
  C:\Windows\System\kHtVKUI.exe
  2⤵
  PID:7788
- C:\Windows\System\IzHrtUY.exe
  C:\Windows\System\IzHrtUY.exe
  2⤵
  PID:7804
- C:\Windows\System\zKQSuwQ.exe
  C:\Windows\System\zKQSuwQ.exe
  2⤵
  PID:7820
- C:\Windows\System\VxmbpYT.exe
  C:\Windows\System\VxmbpYT.exe
  2⤵
  PID:7836
- C:\Windows\System\nubkLdP.exe
  C:\Windows\System\nubkLdP.exe
  2⤵
  PID:7852
- C:\Windows\System\WyKbrrd.exe
  C:\Windows\System\WyKbrrd.exe
  2⤵
  PID:7868
- C:\Windows\System\ybZcwHN.exe
  C:\Windows\System\ybZcwHN.exe
  2⤵
  PID:7884
- C:\Windows\System\WlimdZZ.exe
  C:\Windows\System\WlimdZZ.exe
  2⤵
  PID:7900
- C:\Windows\System\NkzjpTc.exe
  C:\Windows\System\NkzjpTc.exe
  2⤵
  PID:7916
- C:\Windows\System\jTlkKxN.exe
  C:\Windows\System\jTlkKxN.exe
  2⤵
  PID:7932
- C:\Windows\System\nydEAtV.exe
  C:\Windows\System\nydEAtV.exe
  2⤵
  PID:7948
- C:\Windows\System\XKiSWlg.exe
  C:\Windows\System\XKiSWlg.exe
  2⤵
  PID:7968
- C:\Windows\System\UeNcPya.exe
  C:\Windows\System\UeNcPya.exe
  2⤵
  PID:7984
- C:\Windows\System\WBTewcm.exe
  C:\Windows\System\WBTewcm.exe
  2⤵
  PID:8000
- C:\Windows\System\YDqpXup.exe
  C:\Windows\System\YDqpXup.exe
  2⤵
  PID:8016
- C:\Windows\System\iKzGtbC.exe
  C:\Windows\System\iKzGtbC.exe
  2⤵
  PID:8032
- C:\Windows\System\BDBpomT.exe
  C:\Windows\System\BDBpomT.exe
  2⤵
  PID:8060
- C:\Windows\System\znwPIxN.exe
  C:\Windows\System\znwPIxN.exe
  2⤵
  PID:8076
- C:\Windows\System\gswHMyv.exe
  C:\Windows\System\gswHMyv.exe
  2⤵
  PID:8092
- C:\Windows\System\ooUWBvK.exe
  C:\Windows\System\ooUWBvK.exe
  2⤵
  PID:8108
- C:\Windows\System\wEwLsGs.exe
  C:\Windows\System\wEwLsGs.exe
  2⤵
  PID:8124
- C:\Windows\System\hezYcYm.exe
  C:\Windows\System\hezYcYm.exe
  2⤵
  PID:8152
- C:\Windows\System\oWgSHaq.exe
  C:\Windows\System\oWgSHaq.exe
  2⤵
  PID:8168
- C:\Windows\System\npVpDTm.exe
  C:\Windows\System\npVpDTm.exe
  2⤵
  PID:8188
- C:\Windows\System\gZtApbG.exe
  C:\Windows\System\gZtApbG.exe
  2⤵
  PID:7192
- C:\Windows\System\DjFNkuW.exe
  C:\Windows\System\DjFNkuW.exe
  2⤵
  PID:6316
- C:\Windows\System\KsceqNt.exe
  C:\Windows\System\KsceqNt.exe
  2⤵
  PID:6956
- C:\Windows\System\oXUGKpi.exe
  C:\Windows\System\oXUGKpi.exe
  2⤵
  PID:6384
- C:\Windows\System\bKPJiFB.exe
  C:\Windows\System\bKPJiFB.exe
  2⤵
  PID:7240
- C:\Windows\System\mNdyLuV.exe
  C:\Windows\System\mNdyLuV.exe
  2⤵
  PID:7324
- C:\Windows\System\bRZoNBt.exe
  C:\Windows\System\bRZoNBt.exe
  2⤵
  PID:7340
- C:\Windows\System\xjQGQDY.exe
  C:\Windows\System\xjQGQDY.exe
  2⤵
  PID:7424
- C:\Windows\System\QHMdnWM.exe
  C:\Windows\System\QHMdnWM.exe
  2⤵
  PID:7452
- C:\Windows\System\XzBzNpj.exe
  C:\Windows\System\XzBzNpj.exe
  2⤵
  PID:7484
- C:\Windows\System\wWlkrsL.exe
  C:\Windows\System\wWlkrsL.exe
  2⤵
  PID:7520
- C:\Windows\System\bwPndTY.exe
  C:\Windows\System\bwPndTY.exe
  2⤵
  PID:7552
- C:\Windows\System\ZkvBnVR.exe
  C:\Windows\System\ZkvBnVR.exe
  2⤵
  PID:7500
- C:\Windows\System\kHWQsRY.exe
  C:\Windows\System\kHWQsRY.exe
  2⤵
  PID:7620
- C:\Windows\System\ORxCENJ.exe
  C:\Windows\System\ORxCENJ.exe
  2⤵
  PID:7568
- C:\Windows\System\boUxqkW.exe
  C:\Windows\System\boUxqkW.exe
  2⤵
  PID:7600
- C:\Windows\System\arefjVa.exe
  C:\Windows\System\arefjVa.exe
  2⤵
  PID:7636
- C:\Windows\System\iKMgFKT.exe
  C:\Windows\System\iKMgFKT.exe
  2⤵
  PID:7748
- C:\Windows\System\Eelbznv.exe
  C:\Windows\System\Eelbznv.exe
  2⤵
  PID:7908
- C:\Windows\System\dibGvxh.exe
  C:\Windows\System\dibGvxh.exe
  2⤵
  PID:8044
- C:\Windows\System\cSsNwOj.exe
  C:\Windows\System\cSsNwOj.exe
  2⤵
  PID:8068
- C:\Windows\System\ABqaSxu.exe
  C:\Windows\System\ABqaSxu.exe
  2⤵
  PID:8072
- C:\Windows\System\hzfUAjZ.exe
  C:\Windows\System\hzfUAjZ.exe
  2⤵
  PID:8132
- C:\Windows\System\ZxzqbMR.exe
  C:\Windows\System\ZxzqbMR.exe
  2⤵
  PID:8104
- C:\Windows\System\qkJkuQu.exe
  C:\Windows\System\qkJkuQu.exe
  2⤵
  PID:8148
- C:\Windows\System\FibBEYb.exe
  C:\Windows\System\FibBEYb.exe
  2⤵
  PID:7208
- C:\Windows\System\YNyBpWs.exe
  C:\Windows\System\YNyBpWs.exe
  2⤵
  PID:7064
- C:\Windows\System\fKqDbMR.exe
  C:\Windows\System\fKqDbMR.exe
  2⤵
  PID:7236
- C:\Windows\System\KfdLcHq.exe
  C:\Windows\System\KfdLcHq.exe
  2⤵
  PID:7376
- C:\Windows\System\aPeuJiv.exe
  C:\Windows\System\aPeuJiv.exe
  2⤵
  PID:7420
- C:\Windows\System\ODNARSL.exe
  C:\Windows\System\ODNARSL.exe
  2⤵
  PID:7320
- C:\Windows\System\lqCmPIR.exe
  C:\Windows\System\lqCmPIR.exe
  2⤵
  PID:7536
- C:\Windows\System\xiHGjyU.exe
  C:\Windows\System\xiHGjyU.exe
  2⤵
  PID:7596
- C:\Windows\System\BYPepFK.exe
  C:\Windows\System\BYPepFK.exe
  2⤵
  PID:7632
- C:\Windows\System\QZIoORr.exe
  C:\Windows\System\QZIoORr.exe
  2⤵
  PID:7784
- C:\Windows\System\CHTjqAw.exe
  C:\Windows\System\CHTjqAw.exe
  2⤵
  PID:7732
- C:\Windows\System\Dqlwbba.exe
  C:\Windows\System\Dqlwbba.exe
  2⤵
  PID:7800
- C:\Windows\System\okAOtJD.exe
  C:\Windows\System\okAOtJD.exe
  2⤵
  PID:7832
- C:\Windows\System\hhGnXRY.exe
  C:\Windows\System\hhGnXRY.exe
  2⤵
  PID:7892
- C:\Windows\System\pzHKgEf.exe
  C:\Windows\System\pzHKgEf.exe
  2⤵
  PID:7960
- C:\Windows\System\jzyjvqb.exe
  C:\Windows\System\jzyjvqb.exe
  2⤵
  PID:8120
- C:\Windows\System\mFqnZnW.exe
  C:\Windows\System\mFqnZnW.exe
  2⤵
  PID:7976
- C:\Windows\System\LbjaeDb.exe
  C:\Windows\System\LbjaeDb.exe
  2⤵
  PID:8144
- C:\Windows\System\ipBHIDS.exe
  C:\Windows\System\ipBHIDS.exe
  2⤵
  PID:7136
- C:\Windows\System\jSGWjTf.exe
  C:\Windows\System\jSGWjTf.exe
  2⤵
  PID:7356
- C:\Windows\System\PSOVSoc.exe
  C:\Windows\System\PSOVSoc.exe
  2⤵
  PID:7404
- C:\Windows\System\pGKaPuB.exe
  C:\Windows\System\pGKaPuB.exe
  2⤵
  PID:7288
- C:\Windows\System\WfEvvml.exe
  C:\Windows\System\WfEvvml.exe
  2⤵
  PID:7504
- C:\Windows\System\kAtxhaH.exe
  C:\Windows\System\kAtxhaH.exe
  2⤵
  PID:7612
- C:\Windows\System\DwTIoNa.exe
  C:\Windows\System\DwTIoNa.exe
  2⤵
  PID:7744
- C:\Windows\System\iyDLcWl.exe
  C:\Windows\System\iyDLcWl.exe
  2⤵
  PID:8084
- C:\Windows\System\BHDmSgT.exe
  C:\Windows\System\BHDmSgT.exe
  2⤵
  PID:7864
- C:\Windows\System\SSwHyLd.exe
  C:\Windows\System\SSwHyLd.exe
  2⤵
  PID:7924
- C:\Windows\System\cHCGSrn.exe
  C:\Windows\System\cHCGSrn.exe
  2⤵
  PID:7964
- C:\Windows\System\zylKLkC.exe
  C:\Windows\System\zylKLkC.exe
  2⤵
  PID:8176
- C:\Windows\System\hvppDLI.exe
  C:\Windows\System\hvppDLI.exe
  2⤵
  PID:7204
- C:\Windows\System\gGRSdjd.exe
  C:\Windows\System\gGRSdjd.exe
  2⤵
  PID:7436
- C:\Windows\System\BErZttj.exe
  C:\Windows\System\BErZttj.exe
  2⤵
  PID:7760
- C:\Windows\System\xJwIHHS.exe
  C:\Windows\System\xJwIHHS.exe
  2⤵
  PID:7684
- C:\Windows\System\aJXFCtE.exe
  C:\Windows\System\aJXFCtE.exe
  2⤵
  PID:7844
- C:\Windows\System\iEXLvey.exe
  C:\Windows\System\iEXLvey.exe
  2⤵
  PID:7992
- C:\Windows\System\boLyKyW.exe
  C:\Windows\System\boLyKyW.exe
  2⤵
  PID:8024
- C:\Windows\System\BsSdAih.exe
  C:\Windows\System\BsSdAih.exe
  2⤵
  PID:7940
- C:\Windows\System\fyoEIqP.exe
  C:\Windows\System\fyoEIqP.exe
  2⤵
  PID:7796
- C:\Windows\System\jCzpLBV.exe
  C:\Windows\System\jCzpLBV.exe
  2⤵
  PID:7880
- C:\Windows\System\FvPrgwA.exe
  C:\Windows\System\FvPrgwA.exe
  2⤵
  PID:7812
- C:\Windows\System\xvKqefg.exe
  C:\Windows\System\xvKqefg.exe
  2⤵
  PID:7440
- C:\Windows\System\qpENyEk.exe
  C:\Windows\System\qpENyEk.exe
  2⤵
  PID:7564
- C:\Windows\System\PfoXoZa.exe
  C:\Windows\System\PfoXoZa.exe
  2⤵
  PID:8208
- C:\Windows\System\HbWcfjM.exe
  C:\Windows\System\HbWcfjM.exe
  2⤵
  PID:8224
- C:\Windows\System\rtnVCDr.exe
  C:\Windows\System\rtnVCDr.exe
  2⤵
  PID:8252
- C:\Windows\System\tPpCzdB.exe
  C:\Windows\System\tPpCzdB.exe
  2⤵
  PID:8268
- C:\Windows\System\ZhuSqAE.exe
  C:\Windows\System\ZhuSqAE.exe
  2⤵
  PID:8284
- C:\Windows\System\QBqUVpD.exe
  C:\Windows\System\QBqUVpD.exe
  2⤵
  PID:8300
- C:\Windows\System\BxzOpJO.exe
  C:\Windows\System\BxzOpJO.exe
  2⤵
  PID:8316
- C:\Windows\System\AQggtTZ.exe
  C:\Windows\System\AQggtTZ.exe
  2⤵
  PID:8332
- C:\Windows\System\SykFpml.exe
  C:\Windows\System\SykFpml.exe
  2⤵
  PID:8352
- C:\Windows\System\eJNZSGg.exe
  C:\Windows\System\eJNZSGg.exe
  2⤵
  PID:8368
- C:\Windows\System\bDGcaEj.exe
  C:\Windows\System\bDGcaEj.exe
  2⤵
  PID:8392
- C:\Windows\System\TqqImfC.exe
  C:\Windows\System\TqqImfC.exe
  2⤵
  PID:8408
- C:\Windows\System\pobuIiv.exe
  C:\Windows\System\pobuIiv.exe
  2⤵
  PID:8428
- C:\Windows\System\roplNhh.exe
  C:\Windows\System\roplNhh.exe
  2⤵
  PID:8448
- C:\Windows\System\heAWyMs.exe
  C:\Windows\System\heAWyMs.exe
  2⤵
  PID:8464
- C:\Windows\System\FugiyoB.exe
  C:\Windows\System\FugiyoB.exe
  2⤵
  PID:8480
- C:\Windows\System\lFcAWLB.exe
  C:\Windows\System\lFcAWLB.exe
  2⤵
  PID:8496
- C:\Windows\System\GsXrwhy.exe
  C:\Windows\System\GsXrwhy.exe
  2⤵
  PID:8520
- C:\Windows\System\obgOQmM.exe
  C:\Windows\System\obgOQmM.exe
  2⤵
  PID:8540
- C:\Windows\System\DmSxNIs.exe
  C:\Windows\System\DmSxNIs.exe
  2⤵
  PID:8556
- C:\Windows\System\TKtbORh.exe
  C:\Windows\System\TKtbORh.exe
  2⤵
  PID:8576
- C:\Windows\System\eCUbRgT.exe
  C:\Windows\System\eCUbRgT.exe
  2⤵
  PID:8592
- C:\Windows\System\yMhcdtF.exe
  C:\Windows\System\yMhcdtF.exe
  2⤵
  PID:8608
- C:\Windows\System\BsTrEYb.exe
  C:\Windows\System\BsTrEYb.exe
  2⤵
  PID:8624
- C:\Windows\System\EVLBxiI.exe
  C:\Windows\System\EVLBxiI.exe
  2⤵
  PID:8640
- C:\Windows\System\qITYiIp.exe
  C:\Windows\System\qITYiIp.exe
  2⤵
  PID:8656
- C:\Windows\System\QnTaRBX.exe
  C:\Windows\System\QnTaRBX.exe
  2⤵
  PID:8676
- C:\Windows\System\CAMHFxe.exe
  C:\Windows\System\CAMHFxe.exe
  2⤵
  PID:8692
- C:\Windows\System\wUklaun.exe
  C:\Windows\System\wUklaun.exe
  2⤵
  PID:8708
- C:\Windows\System\LuQanqs.exe
  C:\Windows\System\LuQanqs.exe
  2⤵
  PID:8724
- C:\Windows\System\CkWRjIN.exe
  C:\Windows\System\CkWRjIN.exe
  2⤵
  PID:8740
- C:\Windows\System\GbjdCiU.exe
  C:\Windows\System\GbjdCiU.exe
  2⤵
  PID:8764
- C:\Windows\System\yWjGojS.exe
  C:\Windows\System\yWjGojS.exe
  2⤵
  PID:8780
- C:\Windows\System\duLAvrR.exe
  C:\Windows\System\duLAvrR.exe
  2⤵
  PID:8800
- C:\Windows\System\FezZZgZ.exe
  C:\Windows\System\FezZZgZ.exe
  2⤵
  PID:8820
- C:\Windows\System\kSeVDyn.exe
  C:\Windows\System\kSeVDyn.exe
  2⤵
  PID:8836
- C:\Windows\System\mvrPxww.exe
  C:\Windows\System\mvrPxww.exe
  2⤵
  PID:8852
- C:\Windows\System\BqNchLU.exe
  C:\Windows\System\BqNchLU.exe
  2⤵
  PID:8868
- C:\Windows\System\hzNFfaS.exe
  C:\Windows\System\hzNFfaS.exe
  2⤵
  PID:8884
- C:\Windows\System\vtoNsdq.exe
  C:\Windows\System\vtoNsdq.exe
  2⤵
  PID:8900
- C:\Windows\System\BZOQQSo.exe
  C:\Windows\System\BZOQQSo.exe
  2⤵
  PID:8920
- C:\Windows\System\OyZhvUW.exe
  C:\Windows\System\OyZhvUW.exe
  2⤵
  PID:8944
- C:\Windows\System\QLfvMUI.exe
  C:\Windows\System\QLfvMUI.exe
  2⤵
  PID:8960
- C:\Windows\System\vrlMZkx.exe
  C:\Windows\System\vrlMZkx.exe
  2⤵
  PID:8976
- C:\Windows\System\OJkVbEk.exe
  C:\Windows\System\OJkVbEk.exe
  2⤵
  PID:8992
- C:\Windows\System\YryUSyX.exe
  C:\Windows\System\YryUSyX.exe
  2⤵
  PID:9008
- C:\Windows\System\ymzHDcR.exe
  C:\Windows\System\ymzHDcR.exe
  2⤵
  PID:9028
- C:\Windows\System\zCxFofU.exe
  C:\Windows\System\zCxFofU.exe
  2⤵
  PID:9044
- C:\Windows\System\FRCewWV.exe
  C:\Windows\System\FRCewWV.exe
  2⤵
  PID:9060
- C:\Windows\System\iTdkFpi.exe
  C:\Windows\System\iTdkFpi.exe
  2⤵
  PID:9076
- C:\Windows\System\WmguoJx.exe
  C:\Windows\System\WmguoJx.exe
  2⤵
  PID:9092
- C:\Windows\System\mUljlsi.exe
  C:\Windows\System\mUljlsi.exe
  2⤵
  PID:9108
- C:\Windows\System\zftkYjS.exe
  C:\Windows\System\zftkYjS.exe
  2⤵
  PID:9124
- C:\Windows\System\BAhSWiB.exe
  C:\Windows\System\BAhSWiB.exe
  2⤵
  PID:9144
- C:\Windows\System\AxSWJJf.exe
  C:\Windows\System\AxSWJJf.exe
  2⤵
  PID:9160
- C:\Windows\System\MHTvkKa.exe
  C:\Windows\System\MHTvkKa.exe
  2⤵
  PID:9180
- C:\Windows\System\pbFXxQo.exe
  C:\Windows\System\pbFXxQo.exe
  2⤵
  PID:9196
- C:\Windows\System\AjovtHW.exe
  C:\Windows\System\AjovtHW.exe
  2⤵
  PID:9212
- C:\Windows\System\ZfICIxp.exe
  C:\Windows\System\ZfICIxp.exe
  2⤵
  PID:8236
- C:\Windows\System\OuJPXWp.exe
  C:\Windows\System\OuJPXWp.exe
  2⤵
  PID:7224
- C:\Windows\System\DFCZLHO.exe
  C:\Windows\System\DFCZLHO.exe
  2⤵
  PID:8260
- C:\Windows\System\DOLNkgr.exe
  C:\Windows\System\DOLNkgr.exe
  2⤵
  PID:6552
- C:\Windows\System\eiirXCt.exe
  C:\Windows\System\eiirXCt.exe
  2⤵
  PID:8264
- C:\Windows\System\YYhOgxB.exe
  C:\Windows\System\YYhOgxB.exe
  2⤵
  PID:8348
- C:\Windows\System\MTgZNmV.exe
  C:\Windows\System\MTgZNmV.exe
  2⤵
  PID:8296
- C:\Windows\System\TWLzivW.exe
  C:\Windows\System\TWLzivW.exe
  2⤵
  PID:8324
- C:\Windows\System\PuTHsgG.exe
  C:\Windows\System\PuTHsgG.exe
  2⤵
  PID:8404
- C:\Windows\System\fvlVWLc.exe
  C:\Windows\System\fvlVWLc.exe
  2⤵
  PID:8460
- C:\Windows\System\OkfGXun.exe
  C:\Windows\System\OkfGXun.exe
  2⤵
  PID:8472
- C:\Windows\System\CxGkptT.exe
  C:\Windows\System\CxGkptT.exe
  2⤵
  PID:8516
- C:\Windows\System\nzYLTLF.exe
  C:\Windows\System\nzYLTLF.exe
  2⤵
  PID:8552
- C:\Windows\System\BteKmSB.exe
  C:\Windows\System\BteKmSB.exe
  2⤵
  PID:8508
- C:\Windows\System\hjQlfIq.exe
  C:\Windows\System\hjQlfIq.exe
  2⤵
  PID:8588
- C:\Windows\System\PheNylH.exe
  C:\Windows\System\PheNylH.exe
  2⤵
  PID:8620
- C:\Windows\System\TmzYtOI.exe
  C:\Windows\System\TmzYtOI.exe
  2⤵
  PID:8704
- C:\Windows\System\FAqfWUu.exe
  C:\Windows\System\FAqfWUu.exe
  2⤵
  PID:8772
- C:\Windows\System\rqUPDFv.exe
  C:\Windows\System\rqUPDFv.exe
  2⤵
  PID:8816
- C:\Windows\System\pZgzBJv.exe
  C:\Windows\System\pZgzBJv.exe
  2⤵
  PID:8880
- C:\Windows\System\IRSSyLH.exe
  C:\Windows\System\IRSSyLH.exe
  2⤵
  PID:8952
- C:\Windows\System\tTOHzmw.exe
  C:\Windows\System\tTOHzmw.exe
  2⤵
  PID:8716
- C:\Windows\System\boYuUCn.exe
  C:\Windows\System\boYuUCn.exe
  2⤵
  PID:8756
- C:\Windows\System\DksSohs.exe
  C:\Windows\System\DksSohs.exe
  2⤵
  PID:9020
- C:\Windows\System\fnJCiNj.exe
  C:\Windows\System\fnJCiNj.exe
  2⤵
  PID:8828
- C:\Windows\System\DqwvDex.exe
  C:\Windows\System\DqwvDex.exe
  2⤵
  PID:8896
- C:\Windows\System\LFmVzho.exe
  C:\Windows\System\LFmVzho.exe
  2⤵
  PID:8932
- C:\Windows\System\JJXMtic.exe
  C:\Windows\System\JJXMtic.exe
  2⤵
  PID:9056
- C:\Windows\System\mZjIxeF.exe
  C:\Windows\System\mZjIxeF.exe
  2⤵
  PID:8972
- C:\Windows\System\mytlrPI.exe
  C:\Windows\System\mytlrPI.exe
  2⤵
  PID:9072
- C:\Windows\System\YZkjlSK.exe
  C:\Windows\System\YZkjlSK.exe
  2⤵
  PID:9120
- C:\Windows\System\WdADsAp.exe
  C:\Windows\System\WdADsAp.exe
  2⤵
  PID:9132
- C:\Windows\System\fcCOHEV.exe
  C:\Windows\System\fcCOHEV.exe
  2⤵
  PID:9168
- C:\Windows\System\mCFcTAw.exe
  C:\Windows\System\mCFcTAw.exe
  2⤵
  PID:9172
- C:\Windows\System\jXJyyVQ.exe
  C:\Windows\System\jXJyyVQ.exe
  2⤵
  PID:7292
- C:\Windows\System\WmcSNwr.exe
  C:\Windows\System\WmcSNwr.exe
  2⤵
  PID:8012
- C:\Windows\System\VhLGjgA.exe
  C:\Windows\System\VhLGjgA.exe
  2⤵
  PID:8364
- C:\Windows\System\VtQJarW.exe
  C:\Windows\System\VtQJarW.exe
  2⤵
  PID:8340
- C:\Windows\System\KdoEtVL.exe
  C:\Windows\System\KdoEtVL.exe
  2⤵
  PID:8528
- C:\Windows\System\hWbFeRC.exe
  C:\Windows\System\hWbFeRC.exe
  2⤵
  PID:8584
- C:\Windows\System\kbVlAHY.exe
  C:\Windows\System\kbVlAHY.exe
  2⤵
  PID:8664
- C:\Windows\System\sFLVmJT.exe
  C:\Windows\System\sFLVmJT.exe
  2⤵
  PID:8848
- C:\Windows\System\ghWVJtE.exe
  C:\Windows\System\ghWVJtE.exe
  2⤵
  PID:8792
- C:\Windows\System\yKGlsou.exe
  C:\Windows\System\yKGlsou.exe
  2⤵
  PID:8832
- C:\Windows\System\IzlhavS.exe
  C:\Windows\System\IzlhavS.exe
  2⤵
  PID:9004
- C:\Windows\System\EDEsKBW.exe
  C:\Windows\System\EDEsKBW.exe
  2⤵
  PID:9000
- C:\Windows\System\BbqqweR.exe
  C:\Windows\System\BbqqweR.exe
  2⤵
  PID:9104
- C:\Windows\System\VAeXqbi.exe
  C:\Windows\System\VAeXqbi.exe
  2⤵
  PID:8280
- C:\Windows\System\uIlOuSi.exe
  C:\Windows\System\uIlOuSi.exe
  2⤵
  PID:9188
- C:\Windows\System\OeMiSrG.exe
  C:\Windows\System\OeMiSrG.exe
  2⤵
  PID:8220
- C:\Windows\System\IPHjrpj.exe
  C:\Windows\System\IPHjrpj.exe
  2⤵
  PID:8344
- C:\Windows\System\LtFAgpm.exe
  C:\Windows\System\LtFAgpm.exe
  2⤵
  PID:8160
- C:\Windows\System\YEqXasS.exe
  C:\Windows\System\YEqXasS.exe
  2⤵
  PID:8600
- C:\Windows\System\YSjdfxo.exe
  C:\Windows\System\YSjdfxo.exe
  2⤵
  PID:8736
- C:\Windows\System\GvqlGBS.exe
  C:\Windows\System\GvqlGBS.exe
  2⤵
  PID:8652
- C:\Windows\System\ibtkiSo.exe
  C:\Windows\System\ibtkiSo.exe
  2⤵
  PID:8748
- C:\Windows\System\BTUPvNr.exe
  C:\Windows\System\BTUPvNr.exe
  2⤵
  PID:9016
- C:\Windows\System\pboWTOp.exe
  C:\Windows\System\pboWTOp.exe
  2⤵
  PID:9116
- C:\Windows\System\xFPBoDS.exe
  C:\Windows\System\xFPBoDS.exe
  2⤵
  PID:9100
- C:\Windows\System\qbSIiMz.exe
  C:\Windows\System\qbSIiMz.exe
  2⤵
  PID:8456
- C:\Windows\System\wUHzfgo.exe
  C:\Windows\System\wUHzfgo.exe
  2⤵
  PID:8564
- C:\Windows\System\ZqHyzbi.exe
  C:\Windows\System\ZqHyzbi.exe
  2⤵
  PID:8648
- C:\Windows\System\xtBfnfC.exe
  C:\Windows\System\xtBfnfC.exe
  2⤵
  PID:9084
- C:\Windows\System\KnGlLbX.exe
  C:\Windows\System\KnGlLbX.exe
  2⤵
  PID:8876
- C:\Windows\System\xCXGYLp.exe
  C:\Windows\System\xCXGYLp.exe
  2⤵
  PID:8988
- C:\Windows\System\uVBnTfD.exe
  C:\Windows\System\uVBnTfD.exe
  2⤵
  PID:9156
- C:\Windows\System\qkyHgUP.exe
  C:\Windows\System\qkyHgUP.exe
  2⤵
  PID:8700
- C:\Windows\System\kUjfUsy.exe
  C:\Windows\System\kUjfUsy.exe
  2⤵
  PID:9236
- C:\Windows\System\wHQwvrq.exe
  C:\Windows\System\wHQwvrq.exe
  2⤵
  PID:9256
- C:\Windows\System\pMyyQCp.exe
  C:\Windows\System\pMyyQCp.exe
  2⤵
  PID:9276
- C:\Windows\System\kpGfdpo.exe
  C:\Windows\System\kpGfdpo.exe
  2⤵
  PID:9292
- C:\Windows\System\bWVFuOa.exe
  C:\Windows\System\bWVFuOa.exe
  2⤵
  PID:9308
- C:\Windows\System\udWwQcN.exe
  C:\Windows\System\udWwQcN.exe
  2⤵
  PID:9324
- C:\Windows\System\SdUBxvK.exe
  C:\Windows\System\SdUBxvK.exe
  2⤵
  PID:9344
- C:\Windows\System\iIqjGmw.exe
  C:\Windows\System\iIqjGmw.exe
  2⤵
  PID:9364
- C:\Windows\System\ipwNoTU.exe
  C:\Windows\System\ipwNoTU.exe
  2⤵
  PID:9380
- C:\Windows\System\DcUdNGm.exe
  C:\Windows\System\DcUdNGm.exe
  2⤵
  PID:9396
- C:\Windows\System\RAYPllY.exe
  C:\Windows\System\RAYPllY.exe
  2⤵
  PID:9412
- C:\Windows\System\Znjllzc.exe
  C:\Windows\System\Znjllzc.exe
  2⤵
  PID:9428
- C:\Windows\System\MRGKIgJ.exe
  C:\Windows\System\MRGKIgJ.exe
  2⤵
  PID:9444
- C:\Windows\System\fyxdjoP.exe
  C:\Windows\System\fyxdjoP.exe
  2⤵
  PID:9460
- C:\Windows\System\tBFfyFI.exe
  C:\Windows\System\tBFfyFI.exe
  2⤵
  PID:9476
- C:\Windows\System\FxWyswe.exe
  C:\Windows\System\FxWyswe.exe
  2⤵
  PID:9592
- C:\Windows\System\lUytkeh.exe
  C:\Windows\System\lUytkeh.exe
  2⤵
  PID:9652
- C:\Windows\System\ZDiKBfa.exe
  C:\Windows\System\ZDiKBfa.exe
  2⤵
  PID:9676
- C:\Windows\System\EeYnRIh.exe
  C:\Windows\System\EeYnRIh.exe
  2⤵
  PID:9736
- C:\Windows\System\qNSFSCS.exe
  C:\Windows\System\qNSFSCS.exe
  2⤵
  PID:9776
- C:\Windows\System\stqXekF.exe
  C:\Windows\System\stqXekF.exe
  2⤵
  PID:9804
- C:\Windows\System\NQzgmLs.exe
  C:\Windows\System\NQzgmLs.exe
  2⤵
  PID:9820
- C:\Windows\System\sZcOpZq.exe
  C:\Windows\System\sZcOpZq.exe
  2⤵
  PID:9848
- C:\Windows\System\fpchbNJ.exe
  C:\Windows\System\fpchbNJ.exe
  2⤵
  PID:9864
- C:\Windows\System\pQZSVJF.exe
  C:\Windows\System\pQZSVJF.exe
  2⤵
  PID:9880
- C:\Windows\System\LWrzxob.exe
  C:\Windows\System\LWrzxob.exe
  2⤵
  PID:9896
- C:\Windows\System\IqIJgpT.exe
  C:\Windows\System\IqIJgpT.exe
  2⤵
  PID:9912
- C:\Windows\System\dJzNBXN.exe
  C:\Windows\System\dJzNBXN.exe
  2⤵
  PID:9928
- C:\Windows\System\pbuFIjs.exe
  C:\Windows\System\pbuFIjs.exe
  2⤵
  PID:9948
- C:\Windows\System\ViVlbGN.exe
  C:\Windows\System\ViVlbGN.exe
  2⤵
  PID:9964
- C:\Windows\System\bGJqYYe.exe
  C:\Windows\System\bGJqYYe.exe
  2⤵
  PID:9980
- C:\Windows\System\WATksjD.exe
  C:\Windows\System\WATksjD.exe
  2⤵
  PID:9996
- C:\Windows\System\MSXKqgT.exe
  C:\Windows\System\MSXKqgT.exe
  2⤵
  PID:10012
- C:\Windows\System\uiDuzVb.exe
  C:\Windows\System\uiDuzVb.exe
  2⤵
  PID:10028
- C:\Windows\System\UjqIVbX.exe
  C:\Windows\System\UjqIVbX.exe
  2⤵
  PID:10044
- C:\Windows\System\MPjCBQQ.exe
  C:\Windows\System\MPjCBQQ.exe
  2⤵
  PID:10060
- C:\Windows\System\cSbYjta.exe
  C:\Windows\System\cSbYjta.exe
  2⤵
  PID:10076
- C:\Windows\System\oqbqBEa.exe
  C:\Windows\System\oqbqBEa.exe
  2⤵
  PID:10220
- C:\Windows\System\KTvFcFd.exe
  C:\Windows\System\KTvFcFd.exe
  2⤵
  PID:9316
- C:\Windows\System\ODcmCdv.exe
  C:\Windows\System\ODcmCdv.exe
  2⤵
  PID:9360
- C:\Windows\System\ZSlRLCN.exe
  C:\Windows\System\ZSlRLCN.exe
  2⤵
  PID:9372
- C:\Windows\System\kJsEShH.exe
  C:\Windows\System\kJsEShH.exe
  2⤵
  PID:9420
- C:\Windows\System\EypaipA.exe
  C:\Windows\System\EypaipA.exe
  2⤵
  PID:9452
- C:\Windows\System\udQZMgX.exe
  C:\Windows\System\udQZMgX.exe
  2⤵
  PID:9468
- C:\Windows\System\YrfczFk.exe
  C:\Windows\System\YrfczFk.exe
  2⤵
  PID:9492
- C:\Windows\System\AfkPCXK.exe
  C:\Windows\System\AfkPCXK.exe
  2⤵
  PID:9508
- C:\Windows\System\ylizQPf.exe
  C:\Windows\System\ylizQPf.exe
  2⤵
  PID:9524
- C:\Windows\System\OnPkNNx.exe
  C:\Windows\System\OnPkNNx.exe
  2⤵
  PID:9540
- C:\Windows\System\oHaYaAV.exe
  C:\Windows\System\oHaYaAV.exe
  2⤵
  PID:9556
- C:\Windows\System\oKvjxAf.exe
  C:\Windows\System\oKvjxAf.exe
  2⤵
  PID:9572
- C:\Windows\System\pHuQcKi.exe
  C:\Windows\System\pHuQcKi.exe
  2⤵
  PID:9584
- C:\Windows\System\wYNADhH.exe
  C:\Windows\System\wYNADhH.exe
  2⤵
  PID:9612
- C:\Windows\System\TtVjEGc.exe
  C:\Windows\System\TtVjEGc.exe
  2⤵
  PID:9628
- C:\Windows\System\DNsSrpr.exe
  C:\Windows\System\DNsSrpr.exe
  2⤵
  PID:9644
- C:\Windows\System\VWBARqE.exe
  C:\Windows\System\VWBARqE.exe
  2⤵
  PID:9668
- C:\Windows\System\jAVwmKQ.exe
  C:\Windows\System\jAVwmKQ.exe
  2⤵
  PID:9692
- C:\Windows\System\OpJyGcD.exe
  C:\Windows\System\OpJyGcD.exe
  2⤵
  PID:9708
- C:\Windows\System\CfHBgwO.exe
  C:\Windows\System\CfHBgwO.exe
  2⤵
  PID:9724
- C:\Windows\System\qGXzlaQ.exe
  C:\Windows\System\qGXzlaQ.exe
  2⤵
  PID:9748
- C:\Windows\System\AukXteJ.exe
  C:\Windows\System\AukXteJ.exe
  2⤵
  PID:1892
- C:\Windows\System\CscSBaQ.exe
  C:\Windows\System\CscSBaQ.exe
  2⤵
  PID:9768
- C:\Windows\System\xPHjTdn.exe
  C:\Windows\System\xPHjTdn.exe
  2⤵
  PID:9860
- C:\Windows\System\AvASqld.exe
  C:\Windows\System\AvASqld.exe
  2⤵
  PID:9844
- C:\Windows\System\IlCLzMt.exe
  C:\Windows\System\IlCLzMt.exe
  2⤵
  PID:9892
- C:\Windows\System\qlghrKW.exe
  C:\Windows\System\qlghrKW.exe
  2⤵
  PID:9836
- C:\Windows\System\cfRRCwn.exe
  C:\Windows\System\cfRRCwn.exe
  2⤵
  PID:9872
- C:\Windows\System\SxkflCT.exe
  C:\Windows\System\SxkflCT.exe
  2⤵
  PID:9876
- C:\Windows\System\pbTRNUP.exe
  C:\Windows\System\pbTRNUP.exe
  2⤵
  PID:9972
- C:\Windows\System\ejYFYUl.exe
  C:\Windows\System\ejYFYUl.exe
  2⤵
  PID:10004
- C:\Windows\System\loPXyLK.exe
  C:\Windows\System\loPXyLK.exe
  2⤵
  PID:10040
- C:\Windows\System\GalEnPG.exe
  C:\Windows\System\GalEnPG.exe
  2⤵
  PID:10072
- C:\Windows\System\yVFCOCw.exe
  C:\Windows\System\yVFCOCw.exe
  2⤵
  PID:10092
- C:\Windows\System\zAtuXBG.exe
  C:\Windows\System\zAtuXBG.exe
  2⤵
  PID:10132
- C:\Windows\System\cQuzSDT.exe
  C:\Windows\System\cQuzSDT.exe
  2⤵
  PID:10112
- C:\Windows\System\JjziqKN.exe
  C:\Windows\System\JjziqKN.exe
  2⤵
  PID:10136
- C:\Windows\System\fGdRjLe.exe
  C:\Windows\System\fGdRjLe.exe
  2⤵
  PID:10160
- C:\Windows\System\lSUNHyt.exe
  C:\Windows\System\lSUNHyt.exe
  2⤵
  PID:10176
- C:\Windows\System\LTERVUw.exe
  C:\Windows\System\LTERVUw.exe
  2⤵
  PID:10232
- C:\Windows\System\uJGaZHp.exe
  C:\Windows\System\uJGaZHp.exe
  2⤵
  PID:8928
- C:\Windows\System\idkQeRc.exe
  C:\Windows\System\idkQeRc.exe
  2⤵
  PID:9456
- C:\Windows\System\DnybYcB.exe
  C:\Windows\System\DnybYcB.exe
  2⤵
  PID:10152
- C:\Windows\System\IAxOvEK.exe
  C:\Windows\System\IAxOvEK.exe
  2⤵
  PID:10128

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BGFcCxw.exe

Filesize
1.3MB

MD5
c0af756ccf6975cb6b4ea3cf30700a84

SHA1
d53b1e95291a8bf3e09436dc914cdd1e082220c1

SHA256
11e44acf9af18ca77a2e5f8f26d0229f4162c876c1fe79d6a002b9ed05c4788a

SHA512
85aa9d688e0db03554a415f98085f10627e2ab33f4f105305b0fcc641f80896679dffbdb7d50643ebd864059cf571adf23fa9b9bd3107e2aaad10f3854c78111

Download Submit
C:\Windows\system\BPoNcEy.exe

Filesize
1.3MB

MD5
3864ee9def2e09b4e86744aac0fa4a1c

SHA1
640875b78d65d8a5b1f572b91397ad16270fa12f

SHA256
03365fade6be755a13e4560d6183c4e32e48f257bc1055dccef5e01a4c554957

SHA512
c4dfd247ee38657dbfcdf3da21765ab6072d23d8d7694fd180d0f6771e525a551676d7ababe9127c075b761ab0255a7ed0674cfbfd8768949d15a7ca705b68ce

Download Submit
C:\Windows\system\DvuzjRq.exe

Filesize
1.3MB

MD5
965467842d886e7e2cd669a2922ed563

SHA1
abebc89e82a3971e9ccf10d222dc77779ec79c30

SHA256
5d05e5db8cb3d8e6f82def7136491b9040c1c083ac9bbd0a7f063aa517614930

SHA512
5f3f3d0769a6cbd936bae91422e31178a4c5abdec5530e700f40eddc242f9277d2b94448073851bd4e8956cb3fc6cac671a2ef4139cf0ed72eae8bf636585898

Download Submit
C:\Windows\system\EqMdhrv.exe

Filesize
1.3MB

MD5
7ae05eef08df48f203c1fb472c52dd92

SHA1
024333a19d67815c87d582881e492262e33e82ec

SHA256
7cba910234056823935f36cb6aaf737f46f9121259cf6a547f3cb04f0346027f

SHA512
de5f95e58a9d75acec31e4d0fe0c7e56acb93840b53e9623d757ad8c6b7f2ba9e56a93bca0a1a0c42e660d5c043d26abbe0ea4f7d24525b3c52615611c888ab6

Download Submit
C:\Windows\system\GQOJnXi.exe

Filesize
1.3MB

MD5
83bbd13326d07c34581eb27d32e366b7

SHA1
720e630bb9d155561a75e547f106d405e917292c

SHA256
3eb34dede65d9ccf8de3f9011d2d89b6cddc14606f9f7b282ed247f80d43e7a7

SHA512
9a453284748b79f79aeb093b8f38119d544a960900cc9c5150e3d5e0d76209e765919dab0e40b8aeb026bfad69652d78934637cb81d6ab33179520dde5610dd6

Download Submit
C:\Windows\system\GvxJTHj.exe

Filesize
1.3MB

MD5
3ae686ccf6cb6abb9537d607d4d60ada

SHA1
97657c070dadfb93b68406eb63e19f2f0e53d906

SHA256
bfa17eb0879a7599d05608b94b31bb53295e1ba8baea8be9d11ca38818bfd6ec

SHA512
51ec2dbf2612efa530d94a8084b136f3088d57b822cba528a22342abcf6262d5b126a606bf7cc02aab52d70b7543d5270287500027e0979574b92f26d2953933

Download Submit
C:\Windows\system\HMqaWuU.exe

Filesize
1.3MB

MD5
03ef1374d1c60429304b059d7d1afb42

SHA1
0f0ac68c73153ae844d133238ca931eaa75c6f3d

SHA256
406a24d80b49040903436739c5a20ee359cc41df97be01659528016c4139da79

SHA512
465612a4a510f5d18155ca2f89f6ffba48acad3bacf6465ab94ba54e8b3e7d40aa24fc6f4be950e1297e1a6c24970626884bff02cd96358c5b6d860d663f181a

Download Submit
C:\Windows\system\JfgbEFI.exe

Filesize
1.3MB

MD5
050c6879645a89ec153a5babd8cca822

SHA1
477032df5b961ae090a1557e86bd82a27e22d7ae

SHA256
bfcae06b171cd553d5bf0c867235a4442a0dcc794af624da07070138297bfe38

SHA512
7d238ca5c6d21dbbce6966c600f4a7fc4555f545be59f7d24b0846408b90528a3d511fd43a87a1748f6db4199cb6fe586a08edf096b5b3da30596f74432fbf9a

Download Submit
C:\Windows\system\JolLDOe.exe

Filesize
1.3MB

MD5
b3a714b916e8725843de61f0c5b9bd4e

SHA1
b809b0cd5dadc4751b6c82c6d90a27d0ca682aa4

SHA256
004cc30382f4bf00c4c5e5429dc8ef7b17e1205c97ec2f6d69b79abe0b37853d

SHA512
f4a12392f19a62a50d22c52508fd7075f235e8b537a674e671c3241ab61f3a34a2d444f84d176feb34a8dd5358a47a576404d2627e8018dfe497d1b961831834

Download Submit
C:\Windows\system\NRIOdYF.exe

Filesize
1.3MB

MD5
02b3c21e1870e644d54aecc9e74a06f7

SHA1
bb94e091c3c9281e5b17b76805a5ba69941188cd

SHA256
1602c437c389f804e2160eeac31259d0501ef22296f7b7e3b112f97ac023b21d

SHA512
3edfe5422db138444d41d74c2cacc4abd1e67c3bf8dfa06a7fbc56b115b27accf1625453138c6a8af06baa4d842392fa300907118b1187983af2817327d9e4b0

Download Submit
C:\Windows\system\NkIuuyU.exe

Filesize
1.3MB

MD5
755e0e255303fcda33a5b61394ae85d1

SHA1
929fd1b3f2ff6b52a70eae29ce91bfcfb8fbf4c8

SHA256
27a351e24e7d6cdf1bb01cce3e32f4c0c5550b097b0496c78202c76c39e5d5a8

SHA512
e9b74263fc18999418c6f5e3ac539944728b4ee157ad9bc0a5f8e43b62b81805d3f948b74041efcf0318cddc2f2638f5d2b8bcae39f1e54c0aa29bb6695f5d77

Download Submit
C:\Windows\system\TLbadFP.exe

Filesize
1.3MB

MD5
ede37ba492c1a580335ce48f782dcc6e

SHA1
19f0a4c455674383bac922e6edeb0334a79f93d3

SHA256
ac274dfc524826ee54459aeb74ab98a70fc42d470686317f3f82f8f7aed3d090

SHA512
9fd9787ab4d9c953906cce2baeb1cb8dffc84eb4ac12fd1482cd529e61bb679bcf53fadcecf6ad768bb1d2f699b804770883902a4c9b47fe1b3efe525dc63007

Download Submit
C:\Windows\system\UJQNdVr.exe

Filesize
1.3MB

MD5
d20318db88e361a36d4616b07eec275f

SHA1
4684842b0a94958afbaf49ef0e35288d7190c475

SHA256
9e73bef89e9378b7d0452d602442e8dc6cfdedd8fd01e57cb2f3b5e47c105b70

SHA512
d69cfdaf449f395e6c42d9db01d08674eda609efb378cd135cf763686c68bb24576f549c62e1da9b531185818e557ba02864aa75c74694ea22b4e361674bc7ae

Download Submit
C:\Windows\system\URloGKe.exe

Filesize
1.3MB

MD5
0f94bf07abbcb5b7df72489dc1caa357

SHA1
bfb6a694231440194a1875f5dd2582fa176e5ab6

SHA256
27a180799a3631d0b7f63be3c07b5a925ad4a94334510589e322ca03a33d6d3b

SHA512
06482566e09887f8841b8aa6f0c4744644b31900e15031d88901b0d492c3ee6c25c082c988fdb3acf0ddc0739660e1a9268d80e1e47710134bb4d802d420daa8

Download Submit
C:\Windows\system\WKBAvIq.exe

Filesize
1.3MB

MD5
12207dcb96f91ade85f7146f14f86f40

SHA1
c01a89719cbea0c1f90eac0638573d9b92aa4226

SHA256
1a9f2c16819bf4f49bd951a4b0e2b1364c09b299a7587d07be35d35687b22b88

SHA512
b67dd5fab8c8f19bf042c7bce2b700a78d4cebac766ec65585833d4e2e4769ea070bf747d2a9fdda0a375622ffd5e3e4d13c49bdceae5b82f9f4dd837efc7817

Download Submit
C:\Windows\system\XLtDJxf.exe

Filesize
1.3MB

MD5
d2cfa2032c08b32e582ba85129c5ec2c

SHA1
c4677bffccc61a21edb651483d322306f4845b3b

SHA256
86fa9f40275e62696af3fc53491684404c750a940ab064d75e5239a21806e402

SHA512
4bc5ff5d0bf6d6becca946fc80967b511796b4b646189a2697733076cb4b09452d5e415ea1b34e690edc4067fe8a7ece39fa44c1345518f2ecf7fdae1dc1a459

Download Submit
C:\Windows\system\XNZqybP.exe

Filesize
1.3MB

MD5
c8718c680d029a313b8be1ae1caedb5b

SHA1
75b89fc4eaf60f8a07c417ef7781b137d72e69a9

SHA256
32e01bf73e4251c219155d59c8e9c6c1012d689c045a33aec9e6d5c4bdb94842

SHA512
6b53c34d57dfc93e9ad10268bc2560529729f3b89b5cebd7b76ab414be069091f5b816c8d9ef289eed7c314905dce8acf11ca937dbb3ffc230e3e33d4dfe6d94

Download Submit
C:\Windows\system\XfjCDkn.exe

Filesize
1.3MB

MD5
a9e17b69e5096e106c883406f34480bd

SHA1
f67cbef518e2e4621a2901cc2a4bb51f1cdb53d0

SHA256
37bb8db1be9eb4e273ede83a4cad344db3fe7380bd0f88b715f3a5c569581c0a

SHA512
88a05b369f592f326279335531ebdeec01982f6eb49840e35fb22f44ff973ac3718d92556102cdaf5677474fdbde61b8d3f0424a72165d9fc361c9783fc53457

Download Submit
C:\Windows\system\ZClPxyt.exe

Filesize
1.3MB

MD5
bd71b8145ba9f30c988ae6e339cad689

SHA1
2f91a9ffc6c7bb270a6c7b3ec7c80a7b30c29d94

SHA256
7e1f1e6e914bdda2736030905448182f1952786c3f12972f7a2fa924a695f426

SHA512
c00b88a4d87f12aea038cdd5d5a90a74db105fbdd31406ab46d9c3813490018e6e7a7fe8d4bfdc096bfe32d4258234e9ebc3edf7496d7fc1bf6aa961f6e1d2ac

Download Submit
C:\Windows\system\ZPEMBwW.exe

Filesize
1.3MB

MD5
dfd6f6b8d9253e3ae229bf67002444c7

SHA1
cd1e09588319af678d68ea91a25fb7db1293628b

SHA256
ccc0d8c3df277aecb1815116fe1fe098b4b8f1cb0ad0945d6aef56ab138aae33

SHA512
0b65e94d3288e05260d9d04fdd4ece3039a34627e93a28df33c7e2d7dbc4098f6a6a1a0f0e8e27f5d4f03cf0cb018124dccea8d97bd05c389781cc745d7b8175

Download Submit
C:\Windows\system\bbYOHxG.exe

Filesize
1.3MB

MD5
0c943f08cc30c09538c8f7f4fa6a7e03

SHA1
f9400b88bcd36ac0eceaa7223a66deaec9342f34

SHA256
28c14f1ae5546dfbec6027f4ec0cd001ef782bb3b2d58d9222be9e165f0e4c01

SHA512
2a58f737689f2fa28bcd94711ca0b0a8fba35c5cad1da2373ead400b64c1d77bb18fc7422386c879ce456d25fc629a0484db1d89291c0a5638a033929194b9f2

Download Submit
C:\Windows\system\fNERhxT.exe

Filesize
1.3MB

MD5
c590cfe17083ebaa12b1615a07a46b90

SHA1
43604fd4de78b8edf68e625e2c12256adff6bcf3

SHA256
db54289068da7d118f055a5b667d0fd6d3ef2bc8eaca6102748e19cab1a2e8b0

SHA512
72c96ccaf466200b60fdffc295975e22b322ee117d4d279cde3c9ec2ffe14c9dea75284f56c682266b476f40b5f4972ccab66f42f1af57eac6f77f2f65af1199

Download Submit
C:\Windows\system\ggpsavY.exe

Filesize
1.3MB

MD5
56c41a84dc52d3d15ef6229c82d85719

SHA1
4a989618e652928eb1fb82dbaa3cbcfc21982a55

SHA256
2548f01e6b2f50444614388d0da33ab7f0a91869e8bbcb912a27602791a86cff

SHA512
69d729471961c2763edb2516fca44065aa31a5e1456a56cb1b574f9e5ac7763dc902acfca45811ab8b36b5fe55f6eee15cb9054567cd3678640c38e8a17c3639

Download Submit
C:\Windows\system\jtHtacd.exe

Filesize
1.3MB

MD5
fec8793d1c2537fc3ddf9c563000ae61

SHA1
d3af67eb84a810cf4f35c6dccd9fdbf1891fc91a

SHA256
4d6deda4132e1a77f184dcbd3ab568e9f90a19065cce7958e6c1948e9467d499

SHA512
9d5d955bd9aae8be12dff97b10e474b1c8d0af898ce550bcf92b152769eed97bc4d29446f63d0e65228d0993244f24a4a867d5bada13c4494fff21ab02d54cbc

Download Submit
C:\Windows\system\nYuBbIr.exe

Filesize
1.3MB

MD5
a50f9f86d674d15a7376d9fbb4bacf3b

SHA1
4ee25c38398b2c050d88991294d2d4e61d5c8269

SHA256
5bb3c6d384da7f1668ebfb0afc843f652ab89bdc422e2ddc10c24043e413fe01

SHA512
ee979f5baa95229ff9641d9657977e2dce20562a7bea6ec6b95ae497a9c596297b4398110399ee38898ecffcf80825246025e174cd8c0304ef1c98ad98f40049

Download Submit
C:\Windows\system\sqGDrEZ.exe

Filesize
1.3MB

MD5
5f5e7182e05b92ad13977b03a2ac0711

SHA1
c26fe04f61f4a1044473a952ad217db39d4f0205

SHA256
fac220b4d64aa7b05d647de187de503eb10050863de0ee59a8ab51b5adf67953

SHA512
a60b5264c58f922a7569aa26f075cd66a2bad3d9ab53d29540ca1a808d4eb1a04cf3bd9593c00eac8a9b864167ac2372c2ca5d0c4b6734bfe3fafdacbc47178e

Download Submit
C:\Windows\system\vMvLlYo.exe

Filesize
1.3MB

MD5
70664e65c9961c383dd5c86851b4d7a5

SHA1
e67a1fb798f01f905982ce97dba42afaa7d49b3c

SHA256
655633fe61e6e391c0a917c9840473233a8bd6eb1b208e9b76b6e3e991202f4e

SHA512
21ce149d4d375dcaf08cf43183a38899970462dcaa9f9b206d24bbc1f5cd508a4ce2e936bc7dd24e5c1019a26aaf82199732df500a260b75695790bf1fe0725f

Download Submit
C:\Windows\system\wRqFPIT.exe

Filesize
1.3MB

MD5
f7b6ffbf03bf7ebbc4302d477d283d46

SHA1
4e89edbed3db3de2c5b446dac8be6a12e82e4693

SHA256
76594eb425eead8685951f4b6f93e0497563225c638d3969791998f2ac734949

SHA512
cc42d0fd09992357420c111bbe008648781135286e5ee82eae518154772c64873bb09aa973430a58377e7237bd46fef9abb26d6dcd9eb1f27cd4eca9a2ca8574

Download Submit
C:\Windows\system\woLRbLB.exe

Filesize
1.3MB

MD5
c9e03b3e948f2f435868fb1cec89b583

SHA1
09bdc0583750eea93e18f42c7084d3945dc9e85f

SHA256
cc26438c520f5aa5e82fdafd321106679ff3dc1162972f46cadbd07ede66adbb

SHA512
4b91bd934e7733ee831ec7d5509bfc7d5d45ca52e04e2a48c3124c95f09ad3ce829962060a35cfa54e3061272eef0b24b33068a8f4d6ff0aff82351ca4837cb3

Download Submit
\Windows\system\CKKKPrm.exe

Filesize
1.3MB

MD5
72b0420b63fee3abfe743b528c9939e6

SHA1
ca37ef1c4e3e4bd1263f3ce6fbeb65c8a8e67e59

SHA256
6511af56617336e85a7424757ecf9a13615fbb23abb990856028755ba8f97586

SHA512
1ae7ce133e568ddc742645bb53cadd1c1706651c23189b9f3b3cc5a842fcb913aa2f23f0cfda56c86202f0f280d2002b0e766321cff9ef681c265125ca18a602

Download Submit
\Windows\system\LSQJPxL.exe

Filesize
1.3MB

MD5
02829e5d2fa0ff67ee4aab39cdd9065b

SHA1
fb580059cdda2d8917396c680e3bb4f9cf4690dc

SHA256
c4fc0759961842eebc9a7097fe3b5ee9e97499f12c639794b3a607702044f1fa

SHA512
6f95494810312a02c48532c22712c8304d59a25039dc5519896646c61ac270064a561026e17cf2829eea3756c71afb8602a6b288e060453dc41da03508f7eb96

Download Submit
\Windows\system\lbszChc.exe

Filesize
1.3MB

MD5
507b8ce1d84d3a3b78e5a28f4012f333

SHA1
ce57d519120a567b2ff0a7adcbc7854be6ce5749

SHA256
18e713daccff9d8b5d2f0aa210ca5373e4a1a388cc186d5b645c4170c4c09623

SHA512
c49d37fddfaac31de553b08260699513369e57e135bc095a8dd82062ec540481d025c907ffefe87400ea112ed72d95bbb0381551d181d53914768a86df3af6b6

Download Submit
memory/1888-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download