xmrig | 72f4da354d579d118078905f1c23ae6816ea586721c69d80fe49b86dd3941b63

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
Size

1.3MB
MD5

7313aed18c8657ba01c1fccfec262a00
SHA1

17ebc21d60f08917774f7746b51b41487534437d
SHA256

72f4da354d579d118078905f1c23ae6816ea586721c69d80fe49b86dd3941b63
SHA512

e74afef2dcf72972904ebc54fead4009d8fc68f286e69e9bb4da3ca14cef4ae319fa5cd3f3df16c51b33ac3fdaaae1a50570084e0e139a26c9e7bd00ff71d503
SSDEEP

24576:RVIl/WDGCi7/qkat6Q5aILMCfmARvKYYtJh8DXmB4thd9qiYrydNvp:ROdWCCi7/raZ5aIwC+A8JhP703

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral1/memory/2568-12-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2800-41-0x000000013F700000-0x000000013FA51000-memory.dmp	xmrig
behavioral1/memory/2540-44-0x000000013F8C0000-0x000000013FC11000-memory.dmp	xmrig
behavioral1/memory/2764-49-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig
behavioral1/memory/2512-48-0x000000013F500000-0x000000013F851000-memory.dmp	xmrig
behavioral1/memory/2376-62-0x000000013F070000-0x000000013F3C1000-memory.dmp	xmrig
behavioral1/memory/1620-60-0x0000000001E20000-0x0000000002171000-memory.dmp	xmrig
behavioral1/memory/2552-59-0x000000013FBE0000-0x000000013FF31000-memory.dmp	xmrig
behavioral1/memory/2872-69-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/1620-101-0x000000013FF80000-0x00000001402D1000-memory.dmp	xmrig
behavioral1/memory/2652-102-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/1620-100-0x000000013F110000-0x000000013F461000-memory.dmp	xmrig
behavioral1/memory/2488-1163-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2368-98-0x000000013FF80000-0x00000001402D1000-memory.dmp	xmrig
behavioral1/memory/856-97-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2308-92-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2596-33-0x000000013F710000-0x000000013FA61000-memory.dmp	xmrig
behavioral1/memory/2800-3948-0x000000013F700000-0x000000013FA51000-memory.dmp	xmrig
behavioral1/memory/2512-3961-0x000000013F500000-0x000000013F851000-memory.dmp	xmrig
behavioral1/memory/2568-3958-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2596-3963-0x000000013F710000-0x000000013FA61000-memory.dmp	xmrig
behavioral1/memory/2540-3943-0x000000013F8C0000-0x000000013FC11000-memory.dmp	xmrig
behavioral1/memory/2552-3986-0x000000013FBE0000-0x000000013FF31000-memory.dmp	xmrig
behavioral1/memory/2376-4001-0x000000013F070000-0x000000013F3C1000-memory.dmp	xmrig
behavioral1/memory/2872-4030-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2488-4024-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/856-4039-0x000000013F850000-0x000000013FBA1000-memory.dmp	xmrig
behavioral1/memory/2368-4083-0x000000013FF80000-0x00000001402D1000-memory.dmp	xmrig
behavioral1/memory/2652-4082-0x000000013FD10000-0x0000000140061000-memory.dmp	xmrig
behavioral1/memory/2308-4109-0x000000013F3B0000-0x000000013F701000-memory.dmp	xmrig
behavioral1/memory/2764-4108-0x000000013F8D0000-0x000000013FC21000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2568	FURexmv.exe
2488	xgcDEKL.exe
2596	uWGAvpi.exe
2800	oMXDHZI.exe
2540	CSOykZo.exe
2512	ysyHpCL.exe
2764	kJLnqGQ.exe
2552	zuFfiCx.exe
2376	DLTcVQz.exe
2872	hVFWknB.exe
2308	OwOXnOE.exe
856	VYgErzP.exe
2368	hPHEyJF.exe
2652	CCdBmLx.exe
2664	CLgyqRE.exe
1568	szqukUZ.exe
1960	tpgDmAD.exe
2156	mMMIDIy.exe
352	kgNtKZO.exe
2268	qVlyxyg.exe
1484	ZJzBAxR.exe
2160	oZXPpDi.exe
848	aAavkQK.exe
1188	OfvLZmF.exe
2876	tTuShMK.exe
2760	gMZzCMW.exe
1968	rPFSzpY.exe
2192	tcGtbPX.exe
1712	wanEGHw.exe
1580	ptIMtiZ.exe
320	lpVILdF.exe
780	sjEyzAT.exe
1104	RiWwvpw.exe
2084	hGajNjY.exe
2972	ZaFpgXu.exe
2476	KeKrmPj.exe
1912	IJCRitf.exe
1604	edCRDQg.exe
1920	NhbRrnN.exe
1300	lWmljbh.exe
756	GmglEpM.exe
2148	csLfHSp.exe
900	BrlFlUR.exe
2796	kXepDjm.exe
688	wBcxNen.exe
692	oHFctjl.exe
1940	QNoNrOk.exe
1884	fYsqrdM.exe
1684	YbWVzYN.exe
600	bBbWpyd.exe
1956	UfSUuAE.exe
1664	HWeYpqt.exe
1308	VDfPWbc.exe
2256	PBfrRUT.exe
1952	bBOGcXn.exe
2792	UWaGsWr.exe
1892	gecXxCJ.exe
1648	lnNLsRj.exe
1528	dLbjIzv.exe
2248	Cxtejtp.exe
2212	BVmGLaR.exe
2604	OoDxcYx.exe
2788	knrXedn.exe
2952	ureQKVD.exe

Loads dropped DLL 64 IoCs

pid	Process
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1620-0-0x000000013F110000-0x000000013F461000-memory.dmp	upx
behavioral1/files/0x000d00000001342e-3.dat	upx
behavioral1/memory/2568-12-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/files/0x002a000000013a88-13.dat	upx
behavioral1/memory/2488-14-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0007000000014183-16.dat	upx
behavioral1/files/0x000700000001418c-21.dat	upx
behavioral1/memory/2800-41-0x000000013F700000-0x000000013FA51000-memory.dmp	upx
behavioral1/memory/2540-44-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/files/0x0008000000014367-43.dat	upx
behavioral1/memory/2764-49-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx
behavioral1/memory/2512-48-0x000000013F500000-0x000000013F851000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-58.dat	upx
behavioral1/memory/2376-62-0x000000013F070000-0x000000013F3C1000-memory.dmp	upx
behavioral1/memory/2552-59-0x000000013FBE0000-0x000000013FF31000-memory.dmp	upx
behavioral1/files/0x00080000000143fb-52.dat	upx
behavioral1/files/0x0006000000014bd7-65.dat	upx
behavioral1/memory/2872-69-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/files/0x0006000000014f57-74.dat	upx
behavioral1/files/0x0006000000014c2d-72.dat	upx
behavioral1/files/0x0006000000015083-87.dat	upx
behavioral1/files/0x000600000001507a-85.dat	upx
behavioral1/memory/2652-102-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/1620-100-0x000000013F110000-0x000000013F461000-memory.dmp	upx
behavioral1/files/0x000600000001565a-114.dat	upx
behavioral1/files/0x0006000000015b50-134.dat	upx
behavioral1/files/0x0006000000015b85-138.dat	upx
behavioral1/files/0x0006000000015c9a-144.dat	upx
behavioral1/files/0x0006000000015cb1-155.dat	upx
behavioral1/files/0x0006000000015cd2-160.dat	upx
behavioral1/files/0x0006000000015d0a-179.dat	upx
behavioral1/files/0x0006000000015cf8-175.dat	upx
behavioral1/files/0x0006000000015d21-182.dat	upx
behavioral1/files/0x0006000000015ce3-177.dat	upx
behavioral1/files/0x0006000000015cee-172.dat	upx
behavioral1/memory/2488-1163-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/files/0x0006000000015cc5-165.dat	upx
behavioral1/files/0x0006000000015ca8-149.dat	upx
behavioral1/files/0x0006000000015ae3-128.dat	upx
behavioral1/files/0x00060000000158d9-123.dat	upx
behavioral1/files/0x0006000000015662-119.dat	upx
behavioral1/files/0x00060000000153ee-110.dat	upx
behavioral1/files/0x00060000000150d9-105.dat	upx
behavioral1/memory/2368-98-0x000000013FF80000-0x00000001402D1000-memory.dmp	upx
behavioral1/memory/856-97-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/files/0x0029000000013adc-83.dat	upx
behavioral1/memory/2308-92-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/files/0x0007000000014251-35.dat	upx
behavioral1/memory/2596-33-0x000000013F710000-0x000000013FA61000-memory.dmp	upx
behavioral1/files/0x000700000001431b-32.dat	upx
behavioral1/memory/2800-3948-0x000000013F700000-0x000000013FA51000-memory.dmp	upx
behavioral1/memory/2512-3961-0x000000013F500000-0x000000013F851000-memory.dmp	upx
behavioral1/memory/2568-3958-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/2596-3963-0x000000013F710000-0x000000013FA61000-memory.dmp	upx
behavioral1/memory/2540-3943-0x000000013F8C0000-0x000000013FC11000-memory.dmp	upx
behavioral1/memory/2552-3986-0x000000013FBE0000-0x000000013FF31000-memory.dmp	upx
behavioral1/memory/2376-4001-0x000000013F070000-0x000000013F3C1000-memory.dmp	upx
behavioral1/memory/2872-4030-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/2488-4024-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/856-4039-0x000000013F850000-0x000000013FBA1000-memory.dmp	upx
behavioral1/memory/2368-4083-0x000000013FF80000-0x00000001402D1000-memory.dmp	upx
behavioral1/memory/2652-4082-0x000000013FD10000-0x0000000140061000-memory.dmp	upx
behavioral1/memory/2308-4109-0x000000013F3B0000-0x000000013F701000-memory.dmp	upx
behavioral1/memory/2764-4108-0x000000013F8D0000-0x000000013FC21000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GsSLemO.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\itreGuK.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\DeMrsYx.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\oLfLZJO.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\VhcNwTb.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\mMMIDIy.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\wdZzxHx.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\RVpgimF.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\doKaJgH.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\qtAwJqx.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\ptIMtiZ.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\wBcxNen.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\hyzjHHi.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\DCHGbLV.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\iuPAOJi.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\JLKdZLw.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\pVYSDfV.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\oShEiJo.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\pTfzCJx.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\bQUuFAj.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\IyEKCBP.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\nzEMknq.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\gGkgZol.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\iDrjTBu.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\WtANjEl.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\QtgMVyz.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\ZpyPPpW.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\wRYwMmH.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\uzeKiEZ.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\pNZmEye.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\qtdkdub.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\gorEwcF.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\oqfEMfI.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\cnMSdTm.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\OqfsrLi.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\RCymeRW.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\lmlYqNg.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\dNVylby.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\vDBZgIM.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\oHFctjl.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\qEtGLtE.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\kudgfYo.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\AtLCUwX.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\GYNYrsJ.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\byuImhz.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\ThzrjSx.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\GJJaSis.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\CLgyqRE.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\FmlwZxB.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\opInmtx.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\uWydCRI.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\OkFcsXC.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\OLDPcjK.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\LOnmHeB.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\qEpBtMn.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\opaxvGH.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\QvszpNo.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\Wbovsak.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\GWtuaRE.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\zNTyVcT.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\eLdtwyB.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\EvQXLuQ.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\gQcAusL.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
File created	C:\Windows\System\WQByAqI.exe	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2568	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	29
PID 1620 wrote to memory of 2568	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	29
PID 1620 wrote to memory of 2568	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	29
PID 1620 wrote to memory of 2488	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	30
PID 1620 wrote to memory of 2488	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	30
PID 1620 wrote to memory of 2488	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	30
PID 1620 wrote to memory of 2596	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	31
PID 1620 wrote to memory of 2596	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	31
PID 1620 wrote to memory of 2596	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	31
PID 1620 wrote to memory of 2800	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	32
PID 1620 wrote to memory of 2800	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	32
PID 1620 wrote to memory of 2800	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	32
PID 1620 wrote to memory of 2512	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	33
PID 1620 wrote to memory of 2512	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	33
PID 1620 wrote to memory of 2512	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	33
PID 1620 wrote to memory of 2540	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	34
PID 1620 wrote to memory of 2540	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	34
PID 1620 wrote to memory of 2540	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	34
PID 1620 wrote to memory of 2764	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	35
PID 1620 wrote to memory of 2764	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	35
PID 1620 wrote to memory of 2764	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	35
PID 1620 wrote to memory of 2552	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	36
PID 1620 wrote to memory of 2552	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	36
PID 1620 wrote to memory of 2552	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	36
PID 1620 wrote to memory of 2376	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	37
PID 1620 wrote to memory of 2376	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	37
PID 1620 wrote to memory of 2376	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	37
PID 1620 wrote to memory of 2872	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	38
PID 1620 wrote to memory of 2872	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	38
PID 1620 wrote to memory of 2872	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	38
PID 1620 wrote to memory of 2308	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	39
PID 1620 wrote to memory of 2308	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	39
PID 1620 wrote to memory of 2308	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	39
PID 1620 wrote to memory of 856	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	40
PID 1620 wrote to memory of 856	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	40
PID 1620 wrote to memory of 856	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	40
PID 1620 wrote to memory of 2368	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	41
PID 1620 wrote to memory of 2368	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	41
PID 1620 wrote to memory of 2368	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	41
PID 1620 wrote to memory of 2664	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	42
PID 1620 wrote to memory of 2664	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	42
PID 1620 wrote to memory of 2664	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	42
PID 1620 wrote to memory of 2652	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	43
PID 1620 wrote to memory of 2652	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	43
PID 1620 wrote to memory of 2652	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	43
PID 1620 wrote to memory of 1568	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	44
PID 1620 wrote to memory of 1568	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	44
PID 1620 wrote to memory of 1568	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	44
PID 1620 wrote to memory of 1960	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	45
PID 1620 wrote to memory of 1960	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	45
PID 1620 wrote to memory of 1960	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	45
PID 1620 wrote to memory of 2156	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	46
PID 1620 wrote to memory of 2156	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	46
PID 1620 wrote to memory of 2156	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	46
PID 1620 wrote to memory of 352	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	47
PID 1620 wrote to memory of 352	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	47
PID 1620 wrote to memory of 352	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	47
PID 1620 wrote to memory of 2268	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	48
PID 1620 wrote to memory of 2268	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	48
PID 1620 wrote to memory of 2268	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	48
PID 1620 wrote to memory of 1484	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	49
PID 1620 wrote to memory of 1484	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	49
PID 1620 wrote to memory of 1484	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	49
PID 1620 wrote to memory of 2160	1620	7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7313aed18c8657ba01c1fccfec262a00_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\System\FURexmv.exe
  C:\Windows\System\FURexmv.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\xgcDEKL.exe
  C:\Windows\System\xgcDEKL.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\uWGAvpi.exe
  C:\Windows\System\uWGAvpi.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\oMXDHZI.exe
  C:\Windows\System\oMXDHZI.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ysyHpCL.exe
  C:\Windows\System\ysyHpCL.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\CSOykZo.exe
  C:\Windows\System\CSOykZo.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\kJLnqGQ.exe
  C:\Windows\System\kJLnqGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\zuFfiCx.exe
  C:\Windows\System\zuFfiCx.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\DLTcVQz.exe
  C:\Windows\System\DLTcVQz.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\hVFWknB.exe
  C:\Windows\System\hVFWknB.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\OwOXnOE.exe
  C:\Windows\System\OwOXnOE.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\VYgErzP.exe
  C:\Windows\System\VYgErzP.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\hPHEyJF.exe
  C:\Windows\System\hPHEyJF.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\CLgyqRE.exe
  C:\Windows\System\CLgyqRE.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\CCdBmLx.exe
  C:\Windows\System\CCdBmLx.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\szqukUZ.exe
  C:\Windows\System\szqukUZ.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\tpgDmAD.exe
  C:\Windows\System\tpgDmAD.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\mMMIDIy.exe
  C:\Windows\System\mMMIDIy.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\kgNtKZO.exe
  C:\Windows\System\kgNtKZO.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\qVlyxyg.exe
  C:\Windows\System\qVlyxyg.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ZJzBAxR.exe
  C:\Windows\System\ZJzBAxR.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\oZXPpDi.exe
  C:\Windows\System\oZXPpDi.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\aAavkQK.exe
  C:\Windows\System\aAavkQK.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\OfvLZmF.exe
  C:\Windows\System\OfvLZmF.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\tTuShMK.exe
  C:\Windows\System\tTuShMK.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\gMZzCMW.exe
  C:\Windows\System\gMZzCMW.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\tcGtbPX.exe
  C:\Windows\System\tcGtbPX.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\rPFSzpY.exe
  C:\Windows\System\rPFSzpY.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ptIMtiZ.exe
  C:\Windows\System\ptIMtiZ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\wanEGHw.exe
  C:\Windows\System\wanEGHw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\sjEyzAT.exe
  C:\Windows\System\sjEyzAT.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\lpVILdF.exe
  C:\Windows\System\lpVILdF.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\hGajNjY.exe
  C:\Windows\System\hGajNjY.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\RiWwvpw.exe
  C:\Windows\System\RiWwvpw.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\ZaFpgXu.exe
  C:\Windows\System\ZaFpgXu.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\KeKrmPj.exe
  C:\Windows\System\KeKrmPj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\IJCRitf.exe
  C:\Windows\System\IJCRitf.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\edCRDQg.exe
  C:\Windows\System\edCRDQg.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\NhbRrnN.exe
  C:\Windows\System\NhbRrnN.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\lWmljbh.exe
  C:\Windows\System\lWmljbh.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\GmglEpM.exe
  C:\Windows\System\GmglEpM.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\csLfHSp.exe
  C:\Windows\System\csLfHSp.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\BrlFlUR.exe
  C:\Windows\System\BrlFlUR.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\kXepDjm.exe
  C:\Windows\System\kXepDjm.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\wBcxNen.exe
  C:\Windows\System\wBcxNen.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\oHFctjl.exe
  C:\Windows\System\oHFctjl.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\QNoNrOk.exe
  C:\Windows\System\QNoNrOk.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\fYsqrdM.exe
  C:\Windows\System\fYsqrdM.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\YbWVzYN.exe
  C:\Windows\System\YbWVzYN.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\bBbWpyd.exe
  C:\Windows\System\bBbWpyd.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\UfSUuAE.exe
  C:\Windows\System\UfSUuAE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\HWeYpqt.exe
  C:\Windows\System\HWeYpqt.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\VDfPWbc.exe
  C:\Windows\System\VDfPWbc.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\PBfrRUT.exe
  C:\Windows\System\PBfrRUT.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\bBOGcXn.exe
  C:\Windows\System\bBOGcXn.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\UWaGsWr.exe
  C:\Windows\System\UWaGsWr.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\gecXxCJ.exe
  C:\Windows\System\gecXxCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\lnNLsRj.exe
  C:\Windows\System\lnNLsRj.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\dLbjIzv.exe
  C:\Windows\System\dLbjIzv.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\Cxtejtp.exe
  C:\Windows\System\Cxtejtp.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\BVmGLaR.exe
  C:\Windows\System\BVmGLaR.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\OoDxcYx.exe
  C:\Windows\System\OoDxcYx.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\knrXedn.exe
  C:\Windows\System\knrXedn.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ureQKVD.exe
  C:\Windows\System\ureQKVD.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\bSyPvOw.exe
  C:\Windows\System\bSyPvOw.exe
  2⤵
  PID:2632
- C:\Windows\System\oWrwdHx.exe
  C:\Windows\System\oWrwdHx.exe
  2⤵
  PID:2444
- C:\Windows\System\KofAjyu.exe
  C:\Windows\System\KofAjyu.exe
  2⤵
  PID:2868
- C:\Windows\System\aIgFfJi.exe
  C:\Windows\System\aIgFfJi.exe
  2⤵
  PID:2428
- C:\Windows\System\TJpIhXi.exe
  C:\Windows\System\TJpIhXi.exe
  2⤵
  PID:2396
- C:\Windows\System\EngfAVX.exe
  C:\Windows\System\EngfAVX.exe
  2⤵
  PID:2524
- C:\Windows\System\lmlYqNg.exe
  C:\Windows\System\lmlYqNg.exe
  2⤵
  PID:1676
- C:\Windows\System\ruxkECo.exe
  C:\Windows\System\ruxkECo.exe
  2⤵
  PID:2124
- C:\Windows\System\xQZrSxB.exe
  C:\Windows\System\xQZrSxB.exe
  2⤵
  PID:844
- C:\Windows\System\CtBDZKU.exe
  C:\Windows\System\CtBDZKU.exe
  2⤵
  PID:1280
- C:\Windows\System\pfihhJm.exe
  C:\Windows\System\pfihhJm.exe
  2⤵
  PID:2420
- C:\Windows\System\dPyjPTM.exe
  C:\Windows\System\dPyjPTM.exe
  2⤵
  PID:2380
- C:\Windows\System\xUMlmvy.exe
  C:\Windows\System\xUMlmvy.exe
  2⤵
  PID:2196
- C:\Windows\System\jvSjYIT.exe
  C:\Windows\System\jvSjYIT.exe
  2⤵
  PID:664
- C:\Windows\System\BBPSRcw.exe
  C:\Windows\System\BBPSRcw.exe
  2⤵
  PID:1404
- C:\Windows\System\xazuNHp.exe
  C:\Windows\System\xazuNHp.exe
  2⤵
  PID:560
- C:\Windows\System\SDpssLJ.exe
  C:\Windows\System\SDpssLJ.exe
  2⤵
  PID:680
- C:\Windows\System\sxfLYWR.exe
  C:\Windows\System\sxfLYWR.exe
  2⤵
  PID:1824
- C:\Windows\System\ICRvrJg.exe
  C:\Windows\System\ICRvrJg.exe
  2⤵
  PID:2312
- C:\Windows\System\tEsGmuA.exe
  C:\Windows\System\tEsGmuA.exe
  2⤵
  PID:1008
- C:\Windows\System\xHjYrGQ.exe
  C:\Windows\System\xHjYrGQ.exe
  2⤵
  PID:1252
- C:\Windows\System\FmlwZxB.exe
  C:\Windows\System\FmlwZxB.exe
  2⤵
  PID:1796
- C:\Windows\System\DOVBItc.exe
  C:\Windows\System\DOVBItc.exe
  2⤵
  PID:772
- C:\Windows\System\xaAfyzd.exe
  C:\Windows\System\xaAfyzd.exe
  2⤵
  PID:3060
- C:\Windows\System\fywyWhC.exe
  C:\Windows\System\fywyWhC.exe
  2⤵
  PID:2172
- C:\Windows\System\eLaAEqT.exe
  C:\Windows\System\eLaAEqT.exe
  2⤵
  PID:556
- C:\Windows\System\ppLTtEw.exe
  C:\Windows\System\ppLTtEw.exe
  2⤵
  PID:1800
- C:\Windows\System\TYQnnIy.exe
  C:\Windows\System\TYQnnIy.exe
  2⤵
  PID:1508
- C:\Windows\System\VwCcpkj.exe
  C:\Windows\System\VwCcpkj.exe
  2⤵
  PID:3048
- C:\Windows\System\tDiLwOM.exe
  C:\Windows\System\tDiLwOM.exe
  2⤵
  PID:2976
- C:\Windows\System\yGxfSsj.exe
  C:\Windows\System\yGxfSsj.exe
  2⤵
  PID:880
- C:\Windows\System\cWShzAp.exe
  C:\Windows\System\cWShzAp.exe
  2⤵
  PID:1700
- C:\Windows\System\rSxKQjY.exe
  C:\Windows\System\rSxKQjY.exe
  2⤵
  PID:1636
- C:\Windows\System\UoXIReR.exe
  C:\Windows\System\UoXIReR.exe
  2⤵
  PID:2536
- C:\Windows\System\pbtGBkC.exe
  C:\Windows\System\pbtGBkC.exe
  2⤵
  PID:2696
- C:\Windows\System\opInmtx.exe
  C:\Windows\System\opInmtx.exe
  2⤵
  PID:2624
- C:\Windows\System\zWfXhIk.exe
  C:\Windows\System\zWfXhIk.exe
  2⤵
  PID:340
- C:\Windows\System\wUacXHR.exe
  C:\Windows\System\wUacXHR.exe
  2⤵
  PID:2612
- C:\Windows\System\TiRKFyS.exe
  C:\Windows\System\TiRKFyS.exe
  2⤵
  PID:1724
- C:\Windows\System\xeeyRrl.exe
  C:\Windows\System\xeeyRrl.exe
  2⤵
  PID:2600
- C:\Windows\System\ivBpoMr.exe
  C:\Windows\System\ivBpoMr.exe
  2⤵
  PID:2672
- C:\Windows\System\PATansd.exe
  C:\Windows\System\PATansd.exe
  2⤵
  PID:2636
- C:\Windows\System\WrFoKNW.exe
  C:\Windows\System\WrFoKNW.exe
  2⤵
  PID:2340
- C:\Windows\System\qqdklQo.exe
  C:\Windows\System\qqdklQo.exe
  2⤵
  PID:2400
- C:\Windows\System\sgwubgI.exe
  C:\Windows\System\sgwubgI.exe
  2⤵
  PID:1556
- C:\Windows\System\yXzyZgV.exe
  C:\Windows\System\yXzyZgV.exe
  2⤵
  PID:2532
- C:\Windows\System\GSrknmS.exe
  C:\Windows\System\GSrknmS.exe
  2⤵
  PID:2984
- C:\Windows\System\HHmkgay.exe
  C:\Windows\System\HHmkgay.exe
  2⤵
  PID:2752
- C:\Windows\System\sXNZlam.exe
  C:\Windows\System\sXNZlam.exe
  2⤵
  PID:1244
- C:\Windows\System\SllYXkL.exe
  C:\Windows\System\SllYXkL.exe
  2⤵
  PID:1596
- C:\Windows\System\BpUhxkr.exe
  C:\Windows\System\BpUhxkr.exe
  2⤵
  PID:1200
- C:\Windows\System\GKuiLml.exe
  C:\Windows\System\GKuiLml.exe
  2⤵
  PID:3028
- C:\Windows\System\zqHIYmN.exe
  C:\Windows\System\zqHIYmN.exe
  2⤵
  PID:3020
- C:\Windows\System\LljKARh.exe
  C:\Windows\System\LljKARh.exe
  2⤵
  PID:2920
- C:\Windows\System\VPRdeuB.exe
  C:\Windows\System\VPRdeuB.exe
  2⤵
  PID:1132
- C:\Windows\System\znGyaPv.exe
  C:\Windows\System\znGyaPv.exe
  2⤵
  PID:1420
- C:\Windows\System\jknYtEG.exe
  C:\Windows\System\jknYtEG.exe
  2⤵
  PID:1872
- C:\Windows\System\hHaSqdq.exe
  C:\Windows\System\hHaSqdq.exe
  2⤵
  PID:944
- C:\Windows\System\byENSat.exe
  C:\Windows\System\byENSat.exe
  2⤵
  PID:808
- C:\Windows\System\OywXOOY.exe
  C:\Windows\System\OywXOOY.exe
  2⤵
  PID:2996
- C:\Windows\System\kbzxMpy.exe
  C:\Windows\System\kbzxMpy.exe
  2⤵
  PID:2480
- C:\Windows\System\IZKggci.exe
  C:\Windows\System\IZKggci.exe
  2⤵
  PID:2128
- C:\Windows\System\xgiORkV.exe
  C:\Windows\System\xgiORkV.exe
  2⤵
  PID:984
- C:\Windows\System\ExQbOWB.exe
  C:\Windows\System\ExQbOWB.exe
  2⤵
  PID:1236
- C:\Windows\System\skPNvlf.exe
  C:\Windows\System\skPNvlf.exe
  2⤵
  PID:1504
- C:\Windows\System\XnnPMRa.exe
  C:\Windows\System\XnnPMRa.exe
  2⤵
  PID:2036
- C:\Windows\System\SEOwlTR.exe
  C:\Windows\System\SEOwlTR.exe
  2⤵
  PID:2756
- C:\Windows\System\XEgkAXC.exe
  C:\Windows\System\XEgkAXC.exe
  2⤵
  PID:2364
- C:\Windows\System\lsbcrUZ.exe
  C:\Windows\System\lsbcrUZ.exe
  2⤵
  PID:2132
- C:\Windows\System\dcGpBmX.exe
  C:\Windows\System\dcGpBmX.exe
  2⤵
  PID:2580
- C:\Windows\System\BobDSBm.exe
  C:\Windows\System\BobDSBm.exe
  2⤵
  PID:2608
- C:\Windows\System\vpQEAtz.exe
  C:\Windows\System\vpQEAtz.exe
  2⤵
  PID:1584
- C:\Windows\System\CaOnsVp.exe
  C:\Windows\System\CaOnsVp.exe
  2⤵
  PID:1748
- C:\Windows\System\gyGcpGP.exe
  C:\Windows\System\gyGcpGP.exe
  2⤵
  PID:2068
- C:\Windows\System\NvzFywE.exe
  C:\Windows\System\NvzFywE.exe
  2⤵
  PID:328
- C:\Windows\System\LHZsTmu.exe
  C:\Windows\System\LHZsTmu.exe
  2⤵
  PID:2288
- C:\Windows\System\iuPAOJi.exe
  C:\Windows\System\iuPAOJi.exe
  2⤵
  PID:1640
- C:\Windows\System\THkedWT.exe
  C:\Windows\System\THkedWT.exe
  2⤵
  PID:1500
- C:\Windows\System\nwfIKXt.exe
  C:\Windows\System\nwfIKXt.exe
  2⤵
  PID:2616
- C:\Windows\System\fXOZxCp.exe
  C:\Windows\System\fXOZxCp.exe
  2⤵
  PID:1996
- C:\Windows\System\hRqbbcM.exe
  C:\Windows\System\hRqbbcM.exe
  2⤵
  PID:2940
- C:\Windows\System\bAIVrYn.exe
  C:\Windows\System\bAIVrYn.exe
  2⤵
  PID:1672
- C:\Windows\System\WTajjtr.exe
  C:\Windows\System\WTajjtr.exe
  2⤵
  PID:2716
- C:\Windows\System\eGaEEtr.exe
  C:\Windows\System\eGaEEtr.exe
  2⤵
  PID:448
- C:\Windows\System\BgcOMHr.exe
  C:\Windows\System\BgcOMHr.exe
  2⤵
  PID:1432
- C:\Windows\System\dAzeMpe.exe
  C:\Windows\System\dAzeMpe.exe
  2⤵
  PID:2020
- C:\Windows\System\ypURAxn.exe
  C:\Windows\System\ypURAxn.exe
  2⤵
  PID:3088
- C:\Windows\System\MLzjdTp.exe
  C:\Windows\System\MLzjdTp.exe
  2⤵
  PID:3104
- C:\Windows\System\YNzYYkD.exe
  C:\Windows\System\YNzYYkD.exe
  2⤵
  PID:3120
- C:\Windows\System\soIkxng.exe
  C:\Windows\System\soIkxng.exe
  2⤵
  PID:3144
- C:\Windows\System\xNSvqJs.exe
  C:\Windows\System\xNSvqJs.exe
  2⤵
  PID:3160
- C:\Windows\System\htcwEaK.exe
  C:\Windows\System\htcwEaK.exe
  2⤵
  PID:3180
- C:\Windows\System\cZJqsbU.exe
  C:\Windows\System\cZJqsbU.exe
  2⤵
  PID:3196
- C:\Windows\System\QUArSfS.exe
  C:\Windows\System\QUArSfS.exe
  2⤵
  PID:3212
- C:\Windows\System\uWydCRI.exe
  C:\Windows\System\uWydCRI.exe
  2⤵
  PID:3228
- C:\Windows\System\lQQOKAR.exe
  C:\Windows\System\lQQOKAR.exe
  2⤵
  PID:3324
- C:\Windows\System\PmATksW.exe
  C:\Windows\System\PmATksW.exe
  2⤵
  PID:3344
- C:\Windows\System\gDyXKDj.exe
  C:\Windows\System\gDyXKDj.exe
  2⤵
  PID:3364
- C:\Windows\System\OuilpiV.exe
  C:\Windows\System\OuilpiV.exe
  2⤵
  PID:3380
- C:\Windows\System\QLeRvOr.exe
  C:\Windows\System\QLeRvOr.exe
  2⤵
  PID:3400
- C:\Windows\System\rrpFXIZ.exe
  C:\Windows\System\rrpFXIZ.exe
  2⤵
  PID:3416
- C:\Windows\System\IzRYQwR.exe
  C:\Windows\System\IzRYQwR.exe
  2⤵
  PID:3440
- C:\Windows\System\ATzVEQo.exe
  C:\Windows\System\ATzVEQo.exe
  2⤵
  PID:3460
- C:\Windows\System\ijvynSU.exe
  C:\Windows\System\ijvynSU.exe
  2⤵
  PID:3476
- C:\Windows\System\cZDeAdI.exe
  C:\Windows\System\cZDeAdI.exe
  2⤵
  PID:3496
- C:\Windows\System\ILpMbBm.exe
  C:\Windows\System\ILpMbBm.exe
  2⤵
  PID:3512
- C:\Windows\System\VczLiuy.exe
  C:\Windows\System\VczLiuy.exe
  2⤵
  PID:3536
- C:\Windows\System\huXpfQX.exe
  C:\Windows\System\huXpfQX.exe
  2⤵
  PID:3552
- C:\Windows\System\hCCFUWg.exe
  C:\Windows\System\hCCFUWg.exe
  2⤵
  PID:3568
- C:\Windows\System\zXpuBGO.exe
  C:\Windows\System\zXpuBGO.exe
  2⤵
  PID:3680
- C:\Windows\System\nbhNIId.exe
  C:\Windows\System\nbhNIId.exe
  2⤵
  PID:3696
- C:\Windows\System\vpapDfI.exe
  C:\Windows\System\vpapDfI.exe
  2⤵
  PID:3712
- C:\Windows\System\DznKomE.exe
  C:\Windows\System\DznKomE.exe
  2⤵
  PID:3728
- C:\Windows\System\BjYmnXS.exe
  C:\Windows\System\BjYmnXS.exe
  2⤵
  PID:3748
- C:\Windows\System\LwctmwJ.exe
  C:\Windows\System\LwctmwJ.exe
  2⤵
  PID:3764
- C:\Windows\System\DnySFbK.exe
  C:\Windows\System\DnySFbK.exe
  2⤵
  PID:3784
- C:\Windows\System\VYpHUZR.exe
  C:\Windows\System\VYpHUZR.exe
  2⤵
  PID:3800
- C:\Windows\System\aITjwcg.exe
  C:\Windows\System\aITjwcg.exe
  2⤵
  PID:3816
- C:\Windows\System\GisZtfZ.exe
  C:\Windows\System\GisZtfZ.exe
  2⤵
  PID:3836
- C:\Windows\System\nTPhjjL.exe
  C:\Windows\System\nTPhjjL.exe
  2⤵
  PID:3880
- C:\Windows\System\hfRGBkU.exe
  C:\Windows\System\hfRGBkU.exe
  2⤵
  PID:3896
- C:\Windows\System\FRJgqFs.exe
  C:\Windows\System\FRJgqFs.exe
  2⤵
  PID:3920
- C:\Windows\System\KPMrPxj.exe
  C:\Windows\System\KPMrPxj.exe
  2⤵
  PID:3936
- C:\Windows\System\anbuttU.exe
  C:\Windows\System\anbuttU.exe
  2⤵
  PID:3956
- C:\Windows\System\VLFXFUY.exe
  C:\Windows\System\VLFXFUY.exe
  2⤵
  PID:3976
- C:\Windows\System\BCpMYWM.exe
  C:\Windows\System\BCpMYWM.exe
  2⤵
  PID:4000
- C:\Windows\System\BChrJFR.exe
  C:\Windows\System\BChrJFR.exe
  2⤵
  PID:4016
- C:\Windows\System\vgrqgkz.exe
  C:\Windows\System\vgrqgkz.exe
  2⤵
  PID:4044
- C:\Windows\System\PqTNjRQ.exe
  C:\Windows\System\PqTNjRQ.exe
  2⤵
  PID:4060
- C:\Windows\System\oNlZWSf.exe
  C:\Windows\System\oNlZWSf.exe
  2⤵
  PID:4080
- C:\Windows\System\HWiQWgE.exe
  C:\Windows\System\HWiQWgE.exe
  2⤵
  PID:2504
- C:\Windows\System\XxEQpnE.exe
  C:\Windows\System\XxEQpnE.exe
  2⤵
  PID:1612
- C:\Windows\System\HJCTkiw.exe
  C:\Windows\System\HJCTkiw.exe
  2⤵
  PID:2964
- C:\Windows\System\ktojqiB.exe
  C:\Windows\System\ktojqiB.exe
  2⤵
  PID:2744
- C:\Windows\System\nZFqHjp.exe
  C:\Windows\System\nZFqHjp.exe
  2⤵
  PID:1472
- C:\Windows\System\oxcUCFO.exe
  C:\Windows\System\oxcUCFO.exe
  2⤵
  PID:3116
- C:\Windows\System\poDlGvX.exe
  C:\Windows\System\poDlGvX.exe
  2⤵
  PID:3220
- C:\Windows\System\PGcTIyx.exe
  C:\Windows\System\PGcTIyx.exe
  2⤵
  PID:1352
- C:\Windows\System\OmOFtym.exe
  C:\Windows\System\OmOFtym.exe
  2⤵
  PID:2352
- C:\Windows\System\ofjdEyK.exe
  C:\Windows\System\ofjdEyK.exe
  2⤵
  PID:3044
- C:\Windows\System\TDgLoXi.exe
  C:\Windows\System\TDgLoXi.exe
  2⤵
  PID:1564
- C:\Windows\System\eLdtwyB.exe
  C:\Windows\System\eLdtwyB.exe
  2⤵
  PID:3132
- C:\Windows\System\Pbwnbsf.exe
  C:\Windows\System\Pbwnbsf.exe
  2⤵
  PID:3204
- C:\Windows\System\uWKHwqc.exe
  C:\Windows\System\uWKHwqc.exe
  2⤵
  PID:2008
- C:\Windows\System\QTqbCTF.exe
  C:\Windows\System\QTqbCTF.exe
  2⤵
  PID:3332
- C:\Windows\System\PCWuJDJ.exe
  C:\Windows\System\PCWuJDJ.exe
  2⤵
  PID:3408
- C:\Windows\System\opdTmxl.exe
  C:\Windows\System\opdTmxl.exe
  2⤵
  PID:3520
- C:\Windows\System\ndYmKRu.exe
  C:\Windows\System\ndYmKRu.exe
  2⤵
  PID:3528
- C:\Windows\System\laWzowV.exe
  C:\Windows\System\laWzowV.exe
  2⤵
  PID:476
- C:\Windows\System\HFUZRbc.exe
  C:\Windows\System\HFUZRbc.exe
  2⤵
  PID:3596
- C:\Windows\System\wnrRFfQ.exe
  C:\Windows\System\wnrRFfQ.exe
  2⤵
  PID:3616
- C:\Windows\System\oGzdAst.exe
  C:\Windows\System\oGzdAst.exe
  2⤵
  PID:3636
- C:\Windows\System\fQZHbNy.exe
  C:\Windows\System\fQZHbNy.exe
  2⤵
  PID:3316
- C:\Windows\System\PTdQQtk.exe
  C:\Windows\System\PTdQQtk.exe
  2⤵
  PID:3360
- C:\Windows\System\CPeniyA.exe
  C:\Windows\System\CPeniyA.exe
  2⤵
  PID:3432
- C:\Windows\System\OxXrtab.exe
  C:\Windows\System\OxXrtab.exe
  2⤵
  PID:3508
- C:\Windows\System\NwScuHh.exe
  C:\Windows\System\NwScuHh.exe
  2⤵
  PID:3652
- C:\Windows\System\WVbUwqh.exe
  C:\Windows\System\WVbUwqh.exe
  2⤵
  PID:3672
- C:\Windows\System\hBGhexT.exe
  C:\Windows\System\hBGhexT.exe
  2⤵
  PID:3692
- C:\Windows\System\WlYiLTg.exe
  C:\Windows\System\WlYiLTg.exe
  2⤵
  PID:3740
- C:\Windows\System\iGqNIwN.exe
  C:\Windows\System\iGqNIwN.exe
  2⤵
  PID:3756
- C:\Windows\System\xdeFBVL.exe
  C:\Windows\System\xdeFBVL.exe
  2⤵
  PID:3824
- C:\Windows\System\jfVADrU.exe
  C:\Windows\System\jfVADrU.exe
  2⤵
  PID:3844
- C:\Windows\System\PmsHtZA.exe
  C:\Windows\System\PmsHtZA.exe
  2⤵
  PID:3868
- C:\Windows\System\sRBtvjN.exe
  C:\Windows\System\sRBtvjN.exe
  2⤵
  PID:3892
- C:\Windows\System\GGFeiKW.exe
  C:\Windows\System\GGFeiKW.exe
  2⤵
  PID:3908
- C:\Windows\System\sdtBvnd.exe
  C:\Windows\System\sdtBvnd.exe
  2⤵
  PID:3964
- C:\Windows\System\LDayPSK.exe
  C:\Windows\System\LDayPSK.exe
  2⤵
  PID:3992
- C:\Windows\System\tjMMEfa.exe
  C:\Windows\System\tjMMEfa.exe
  2⤵
  PID:4032
- C:\Windows\System\VwwFpTm.exe
  C:\Windows\System\VwwFpTm.exe
  2⤵
  PID:1608
- C:\Windows\System\YMrUFeN.exe
  C:\Windows\System\YMrUFeN.exe
  2⤵
  PID:2296
- C:\Windows\System\YWRXrJQ.exe
  C:\Windows\System\YWRXrJQ.exe
  2⤵
  PID:4056
- C:\Windows\System\nedzjYY.exe
  C:\Windows\System\nedzjYY.exe
  2⤵
  PID:1460
- C:\Windows\System\zPSWWjN.exe
  C:\Windows\System\zPSWWjN.exe
  2⤵
  PID:2648
- C:\Windows\System\fQXSiQr.exe
  C:\Windows\System\fQXSiQr.exe
  2⤵
  PID:668
- C:\Windows\System\wlrxBZF.exe
  C:\Windows\System\wlrxBZF.exe
  2⤵
  PID:2416
- C:\Windows\System\AzBtHMA.exe
  C:\Windows\System\AzBtHMA.exe
  2⤵
  PID:3084
- C:\Windows\System\pDdnGtX.exe
  C:\Windows\System\pDdnGtX.exe
  2⤵
  PID:1448
- C:\Windows\System\NOyhjAf.exe
  C:\Windows\System\NOyhjAf.exe
  2⤵
  PID:1348
- C:\Windows\System\OcmnzLd.exe
  C:\Windows\System\OcmnzLd.exe
  2⤵
  PID:2888
- C:\Windows\System\QDwZfoO.exe
  C:\Windows\System\QDwZfoO.exe
  2⤵
  PID:3128
- C:\Windows\System\nHqYtyu.exe
  C:\Windows\System\nHqYtyu.exe
  2⤵
  PID:3176
- C:\Windows\System\lAOaAWf.exe
  C:\Windows\System\lAOaAWf.exe
  2⤵
  PID:2544
- C:\Windows\System\AdXPTsy.exe
  C:\Windows\System\AdXPTsy.exe
  2⤵
  PID:3372
- C:\Windows\System\iCWFWSQ.exe
  C:\Windows\System\iCWFWSQ.exe
  2⤵
  PID:3452
- C:\Windows\System\mJyBkBO.exe
  C:\Windows\System\mJyBkBO.exe
  2⤵
  PID:3352
- C:\Windows\System\JaJVOkx.exe
  C:\Windows\System\JaJVOkx.exe
  2⤵
  PID:3588
- C:\Windows\System\gkuBgqW.exe
  C:\Windows\System\gkuBgqW.exe
  2⤵
  PID:3632
- C:\Windows\System\NJhccPN.exe
  C:\Windows\System\NJhccPN.exe
  2⤵
  PID:2692
- C:\Windows\System\onvCNXV.exe
  C:\Windows\System\onvCNXV.exe
  2⤵
  PID:3396
- C:\Windows\System\vTXJJnr.exe
  C:\Windows\System\vTXJJnr.exe
  2⤵
  PID:3468
- C:\Windows\System\CiPXIhU.exe
  C:\Windows\System\CiPXIhU.exe
  2⤵
  PID:3548
- C:\Windows\System\CIfZzEq.exe
  C:\Windows\System\CIfZzEq.exe
  2⤵
  PID:3664
- C:\Windows\System\QycTXgU.exe
  C:\Windows\System\QycTXgU.exe
  2⤵
  PID:3720
- C:\Windows\System\IyEKCBP.exe
  C:\Windows\System\IyEKCBP.exe
  2⤵
  PID:3780
- C:\Windows\System\JurFnRf.exe
  C:\Windows\System\JurFnRf.exe
  2⤵
  PID:3796
- C:\Windows\System\mRfpUHa.exe
  C:\Windows\System\mRfpUHa.exe
  2⤵
  PID:3860
- C:\Windows\System\yHVTwoF.exe
  C:\Windows\System\yHVTwoF.exe
  2⤵
  PID:3876
- C:\Windows\System\AbuKYAq.exe
  C:\Windows\System\AbuKYAq.exe
  2⤵
  PID:3916
- C:\Windows\System\SgNjcxB.exe
  C:\Windows\System\SgNjcxB.exe
  2⤵
  PID:3972
- C:\Windows\System\YCUvRuu.exe
  C:\Windows\System\YCUvRuu.exe
  2⤵
  PID:4012
- C:\Windows\System\isVaRCb.exe
  C:\Windows\System\isVaRCb.exe
  2⤵
  PID:1224
- C:\Windows\System\fSmkvWL.exe
  C:\Windows\System\fSmkvWL.exe
  2⤵
  PID:4028
- C:\Windows\System\YbIAONo.exe
  C:\Windows\System\YbIAONo.exe
  2⤵
  PID:2136
- C:\Windows\System\dGytVJe.exe
  C:\Windows\System\dGytVJe.exe
  2⤵
  PID:2472
- C:\Windows\System\rzCiLsN.exe
  C:\Windows\System\rzCiLsN.exe
  2⤵
  PID:1360
- C:\Windows\System\iHYvIwT.exe
  C:\Windows\System\iHYvIwT.exe
  2⤵
  PID:3428
- C:\Windows\System\GTwlVpX.exe
  C:\Windows\System\GTwlVpX.exe
  2⤵
  PID:3592
- C:\Windows\System\QhqQtkA.exe
  C:\Windows\System\QhqQtkA.exe
  2⤵
  PID:3424
- C:\Windows\System\DRefFVD.exe
  C:\Windows\System\DRefFVD.exe
  2⤵
  PID:3724
- C:\Windows\System\iulKAFC.exe
  C:\Windows\System\iulKAFC.exe
  2⤵
  PID:3848
- C:\Windows\System\FIxuZko.exe
  C:\Windows\System\FIxuZko.exe
  2⤵
  PID:4040
- C:\Windows\System\zfuDiOP.exe
  C:\Windows\System\zfuDiOP.exe
  2⤵
  PID:1688
- C:\Windows\System\nfFteYd.exe
  C:\Windows\System\nfFteYd.exe
  2⤵
  PID:2804
- C:\Windows\System\NWFPqPq.exe
  C:\Windows\System\NWFPqPq.exe
  2⤵
  PID:3948
- C:\Windows\System\BPRTIYA.exe
  C:\Windows\System\BPRTIYA.exe
  2⤵
  PID:4036
- C:\Windows\System\xPGOScb.exe
  C:\Windows\System\xPGOScb.exe
  2⤵
  PID:1776
- C:\Windows\System\moSeujw.exe
  C:\Windows\System\moSeujw.exe
  2⤵
  PID:3300
- C:\Windows\System\PAgZdrL.exe
  C:\Windows\System\PAgZdrL.exe
  2⤵
  PID:3564
- C:\Windows\System\JiFjCxO.exe
  C:\Windows\System\JiFjCxO.exe
  2⤵
  PID:3356
- C:\Windows\System\KCJMfae.exe
  C:\Windows\System\KCJMfae.exe
  2⤵
  PID:396
- C:\Windows\System\bzAKIsa.exe
  C:\Windows\System\bzAKIsa.exe
  2⤵
  PID:3704
- C:\Windows\System\rUqJzvb.exe
  C:\Windows\System\rUqJzvb.exe
  2⤵
  PID:3812
- C:\Windows\System\bbthrKT.exe
  C:\Windows\System\bbthrKT.exe
  2⤵
  PID:2856
- C:\Windows\System\zGLxxKn.exe
  C:\Windows\System\zGLxxKn.exe
  2⤵
  PID:4076
- C:\Windows\System\qVlqvvQ.exe
  C:\Windows\System\qVlqvvQ.exe
  2⤵
  PID:1652
- C:\Windows\System\oSyWsEW.exe
  C:\Windows\System\oSyWsEW.exe
  2⤵
  PID:3240
- C:\Windows\System\NhNTbHG.exe
  C:\Windows\System\NhNTbHG.exe
  2⤵
  PID:3988
- C:\Windows\System\SVjZeWp.exe
  C:\Windows\System\SVjZeWp.exe
  2⤵
  PID:3312
- C:\Windows\System\Yqgokfo.exe
  C:\Windows\System\Yqgokfo.exe
  2⤵
  PID:4148
- C:\Windows\System\STaCadz.exe
  C:\Windows\System\STaCadz.exe
  2⤵
  PID:4164
- C:\Windows\System\FkCYtJJ.exe
  C:\Windows\System\FkCYtJJ.exe
  2⤵
  PID:4184
- C:\Windows\System\dhELdIu.exe
  C:\Windows\System\dhELdIu.exe
  2⤵
  PID:4200
- C:\Windows\System\OuJqZRW.exe
  C:\Windows\System\OuJqZRW.exe
  2⤵
  PID:4216
- C:\Windows\System\HVIAuoM.exe
  C:\Windows\System\HVIAuoM.exe
  2⤵
  PID:4232
- C:\Windows\System\pSiXXFu.exe
  C:\Windows\System\pSiXXFu.exe
  2⤵
  PID:4252
- C:\Windows\System\JLKdZLw.exe
  C:\Windows\System\JLKdZLw.exe
  2⤵
  PID:4268
- C:\Windows\System\lbaTsyx.exe
  C:\Windows\System\lbaTsyx.exe
  2⤵
  PID:4288
- C:\Windows\System\xyZxYvW.exe
  C:\Windows\System\xyZxYvW.exe
  2⤵
  PID:4308
- C:\Windows\System\GsSLemO.exe
  C:\Windows\System\GsSLemO.exe
  2⤵
  PID:4324
- C:\Windows\System\gorEwcF.exe
  C:\Windows\System\gorEwcF.exe
  2⤵
  PID:4344
- C:\Windows\System\dirngoR.exe
  C:\Windows\System\dirngoR.exe
  2⤵
  PID:4360
- C:\Windows\System\IidrhBI.exe
  C:\Windows\System\IidrhBI.exe
  2⤵
  PID:4416
- C:\Windows\System\gYhhXtR.exe
  C:\Windows\System\gYhhXtR.exe
  2⤵
  PID:4432
- C:\Windows\System\UFBntAx.exe
  C:\Windows\System\UFBntAx.exe
  2⤵
  PID:4448
- C:\Windows\System\TTJHvll.exe
  C:\Windows\System\TTJHvll.exe
  2⤵
  PID:4476
- C:\Windows\System\nzEMknq.exe
  C:\Windows\System\nzEMknq.exe
  2⤵
  PID:4492
- C:\Windows\System\langVVm.exe
  C:\Windows\System\langVVm.exe
  2⤵
  PID:4508
- C:\Windows\System\pVYSDfV.exe
  C:\Windows\System\pVYSDfV.exe
  2⤵
  PID:4528
- C:\Windows\System\QjdFtlM.exe
  C:\Windows\System\QjdFtlM.exe
  2⤵
  PID:4544
- C:\Windows\System\xvMJPPe.exe
  C:\Windows\System\xvMJPPe.exe
  2⤵
  PID:4560
- C:\Windows\System\dNgdABi.exe
  C:\Windows\System\dNgdABi.exe
  2⤵
  PID:4576
- C:\Windows\System\bmeUmKZ.exe
  C:\Windows\System\bmeUmKZ.exe
  2⤵
  PID:4592
- C:\Windows\System\WQIsXFD.exe
  C:\Windows\System\WQIsXFD.exe
  2⤵
  PID:4608
- C:\Windows\System\sVhkeFK.exe
  C:\Windows\System\sVhkeFK.exe
  2⤵
  PID:4628
- C:\Windows\System\WOykknt.exe
  C:\Windows\System\WOykknt.exe
  2⤵
  PID:4644
- C:\Windows\System\SzHvUFW.exe
  C:\Windows\System\SzHvUFW.exe
  2⤵
  PID:4684
- C:\Windows\System\uJRQWqM.exe
  C:\Windows\System\uJRQWqM.exe
  2⤵
  PID:4708
- C:\Windows\System\LAonJrd.exe
  C:\Windows\System\LAonJrd.exe
  2⤵
  PID:4724
- C:\Windows\System\OrOcVRI.exe
  C:\Windows\System\OrOcVRI.exe
  2⤵
  PID:4740
- C:\Windows\System\GWtuaRE.exe
  C:\Windows\System\GWtuaRE.exe
  2⤵
  PID:4760
- C:\Windows\System\HEWwikX.exe
  C:\Windows\System\HEWwikX.exe
  2⤵
  PID:4776
- C:\Windows\System\wdTAuqh.exe
  C:\Windows\System\wdTAuqh.exe
  2⤵
  PID:4792
- C:\Windows\System\wAwNHwj.exe
  C:\Windows\System\wAwNHwj.exe
  2⤵
  PID:4836
- C:\Windows\System\UAIvZYn.exe
  C:\Windows\System\UAIvZYn.exe
  2⤵
  PID:4856
- C:\Windows\System\SIaMdeF.exe
  C:\Windows\System\SIaMdeF.exe
  2⤵
  PID:4872
- C:\Windows\System\VdVmfRs.exe
  C:\Windows\System\VdVmfRs.exe
  2⤵
  PID:4888
- C:\Windows\System\HryAcuf.exe
  C:\Windows\System\HryAcuf.exe
  2⤵
  PID:4908
- C:\Windows\System\vzWCYka.exe
  C:\Windows\System\vzWCYka.exe
  2⤵
  PID:4924
- C:\Windows\System\PcfEvMa.exe
  C:\Windows\System\PcfEvMa.exe
  2⤵
  PID:4944
- C:\Windows\System\gWsdDKN.exe
  C:\Windows\System\gWsdDKN.exe
  2⤵
  PID:4964
- C:\Windows\System\OXERhVa.exe
  C:\Windows\System\OXERhVa.exe
  2⤵
  PID:4980
- C:\Windows\System\QnBSywM.exe
  C:\Windows\System\QnBSywM.exe
  2⤵
  PID:4996
- C:\Windows\System\vqreYUA.exe
  C:\Windows\System\vqreYUA.exe
  2⤵
  PID:5012
- C:\Windows\System\yJnogac.exe
  C:\Windows\System\yJnogac.exe
  2⤵
  PID:5028
- C:\Windows\System\bWSOolL.exe
  C:\Windows\System\bWSOolL.exe
  2⤵
  PID:5048
- C:\Windows\System\UaUWDnp.exe
  C:\Windows\System\UaUWDnp.exe
  2⤵
  PID:5068
- C:\Windows\System\HwWenWi.exe
  C:\Windows\System\HwWenWi.exe
  2⤵
  PID:5088
- C:\Windows\System\IhnaQBn.exe
  C:\Windows\System\IhnaQBn.exe
  2⤵
  PID:5104
- C:\Windows\System\SGhfktD.exe
  C:\Windows\System\SGhfktD.exe
  2⤵
  PID:2336
- C:\Windows\System\VqXLhWB.exe
  C:\Windows\System\VqXLhWB.exe
  2⤵
  PID:1632
- C:\Windows\System\eDBAuVT.exe
  C:\Windows\System\eDBAuVT.exe
  2⤵
  PID:2108
- C:\Windows\System\dSEHagy.exe
  C:\Windows\System\dSEHagy.exe
  2⤵
  PID:3236
- C:\Windows\System\vjrMZtP.exe
  C:\Windows\System\vjrMZtP.exe
  2⤵
  PID:2316
- C:\Windows\System\gllcOJy.exe
  C:\Windows\System\gllcOJy.exe
  2⤵
  PID:4120
- C:\Windows\System\WgSJErJ.exe
  C:\Windows\System\WgSJErJ.exe
  2⤵
  PID:4128
- C:\Windows\System\rwWvQPt.exe
  C:\Windows\System\rwWvQPt.exe
  2⤵
  PID:2272
- C:\Windows\System\CsQsaSe.exe
  C:\Windows\System\CsQsaSe.exe
  2⤵
  PID:4160
- C:\Windows\System\zWJBeKl.exe
  C:\Windows\System\zWJBeKl.exe
  2⤵
  PID:4208
- C:\Windows\System\sDgjEQE.exe
  C:\Windows\System\sDgjEQE.exe
  2⤵
  PID:4228
- C:\Windows\System\LvFzAmE.exe
  C:\Windows\System\LvFzAmE.exe
  2⤵
  PID:4260
- C:\Windows\System\VXqImCF.exe
  C:\Windows\System\VXqImCF.exe
  2⤵
  PID:4296
- C:\Windows\System\UvWMMGJ.exe
  C:\Windows\System\UvWMMGJ.exe
  2⤵
  PID:4280
- C:\Windows\System\slPgXGw.exe
  C:\Windows\System\slPgXGw.exe
  2⤵
  PID:4316
- C:\Windows\System\LhHYXYe.exe
  C:\Windows\System\LhHYXYe.exe
  2⤵
  PID:4368
- C:\Windows\System\foUFqFm.exe
  C:\Windows\System\foUFqFm.exe
  2⤵
  PID:4384
- C:\Windows\System\XnEbbfU.exe
  C:\Windows\System\XnEbbfU.exe
  2⤵
  PID:4400
- C:\Windows\System\obsNkXx.exe
  C:\Windows\System\obsNkXx.exe
  2⤵
  PID:4440
- C:\Windows\System\AhXkmhf.exe
  C:\Windows\System\AhXkmhf.exe
  2⤵
  PID:4464
- C:\Windows\System\hyzjHHi.exe
  C:\Windows\System\hyzjHHi.exe
  2⤵
  PID:4472
- C:\Windows\System\YjdJmxv.exe
  C:\Windows\System\YjdJmxv.exe
  2⤵
  PID:4556
- C:\Windows\System\uoraSTI.exe
  C:\Windows\System\uoraSTI.exe
  2⤵
  PID:4504
- C:\Windows\System\KYbNuQi.exe
  C:\Windows\System\KYbNuQi.exe
  2⤵
  PID:4620
- C:\Windows\System\NQqKZUv.exe
  C:\Windows\System\NQqKZUv.exe
  2⤵
  PID:4720
- C:\Windows\System\fAsBAXA.exe
  C:\Windows\System\fAsBAXA.exe
  2⤵
  PID:4752
- C:\Windows\System\eqouYDK.exe
  C:\Windows\System\eqouYDK.exe
  2⤵
  PID:4804
- C:\Windows\System\wwKFfJt.exe
  C:\Windows\System\wwKFfJt.exe
  2⤵
  PID:4784
- C:\Windows\System\BBUYWIj.exe
  C:\Windows\System\BBUYWIj.exe
  2⤵
  PID:4828
- C:\Windows\System\kJUcRIh.exe
  C:\Windows\System\kJUcRIh.exe
  2⤵
  PID:4848
- C:\Windows\System\aagjQvh.exe
  C:\Windows\System\aagjQvh.exe
  2⤵
  PID:4936
- C:\Windows\System\QeeEMuf.exe
  C:\Windows\System\QeeEMuf.exe
  2⤵
  PID:5008
- C:\Windows\System\OIWwCGY.exe
  C:\Windows\System\OIWwCGY.exe
  2⤵
  PID:5044
- C:\Windows\System\HAZLddg.exe
  C:\Windows\System\HAZLddg.exe
  2⤵
  PID:4956
- C:\Windows\System\WAZottB.exe
  C:\Windows\System\WAZottB.exe
  2⤵
  PID:5020
- C:\Windows\System\xvQokuf.exe
  C:\Windows\System\xvQokuf.exe
  2⤵
  PID:5112
- C:\Windows\System\IiCThjc.exe
  C:\Windows\System\IiCThjc.exe
  2⤵
  PID:3932
- C:\Windows\System\xkdguyF.exe
  C:\Windows\System\xkdguyF.exe
  2⤵
  PID:5100
- C:\Windows\System\TqBkBae.exe
  C:\Windows\System\TqBkBae.exe
  2⤵
  PID:3172
- C:\Windows\System\sWWNAUf.exe
  C:\Windows\System\sWWNAUf.exe
  2⤵
  PID:3668
- C:\Windows\System\aTBUCIh.exe
  C:\Windows\System\aTBUCIh.exe
  2⤵
  PID:4104
- C:\Windows\System\eFyGess.exe
  C:\Windows\System\eFyGess.exe
  2⤵
  PID:4116
- C:\Windows\System\oqfEMfI.exe
  C:\Windows\System\oqfEMfI.exe
  2⤵
  PID:4264
- C:\Windows\System\lstACcn.exe
  C:\Windows\System\lstACcn.exe
  2⤵
  PID:4340
- C:\Windows\System\SflfQsa.exe
  C:\Windows\System\SflfQsa.exe
  2⤵
  PID:4136
- C:\Windows\System\OZBTrGx.exe
  C:\Windows\System\OZBTrGx.exe
  2⤵
  PID:3308
- C:\Windows\System\SuSmlyi.exe
  C:\Windows\System\SuSmlyi.exe
  2⤵
  PID:4304
- C:\Windows\System\ersmMjG.exe
  C:\Windows\System\ersmMjG.exe
  2⤵
  PID:4424
- C:\Windows\System\LDZCiAc.exe
  C:\Windows\System\LDZCiAc.exe
  2⤵
  PID:4520
- C:\Windows\System\gGkgZol.exe
  C:\Windows\System\gGkgZol.exe
  2⤵
  PID:4456
- C:\Windows\System\GiaVfyS.exe
  C:\Windows\System\GiaVfyS.exe
  2⤵
  PID:4404
- C:\Windows\System\PWAniUt.exe
  C:\Windows\System\PWAniUt.exe
  2⤵
  PID:4572
- C:\Windows\System\wfWMbUM.exe
  C:\Windows\System\wfWMbUM.exe
  2⤵
  PID:4588
- C:\Windows\System\bWbqCGp.exe
  C:\Windows\System\bWbqCGp.exe
  2⤵
  PID:4676
- C:\Windows\System\JIrPTOd.exe
  C:\Windows\System\JIrPTOd.exe
  2⤵
  PID:4880
- C:\Windows\System\kSPDelg.exe
  C:\Windows\System\kSPDelg.exe
  2⤵
  PID:4884
- C:\Windows\System\fEdVYAk.exe
  C:\Windows\System\fEdVYAk.exe
  2⤵
  PID:4932
- C:\Windows\System\emEhjtG.exe
  C:\Windows\System\emEhjtG.exe
  2⤵
  PID:5040
- C:\Windows\System\xKCVNrB.exe
  C:\Windows\System\xKCVNrB.exe
  2⤵
  PID:4988
- C:\Windows\System\aOvOOmY.exe
  C:\Windows\System\aOvOOmY.exe
  2⤵
  PID:5056
- C:\Windows\System\btzcdYM.exe
  C:\Windows\System\btzcdYM.exe
  2⤵
  PID:3968
- C:\Windows\System\bbbMHBC.exe
  C:\Windows\System\bbbMHBC.exe
  2⤵
  PID:4332
- C:\Windows\System\ByKpWTi.exe
  C:\Windows\System\ByKpWTi.exe
  2⤵
  PID:4640
- C:\Windows\System\qEtGLtE.exe
  C:\Windows\System\qEtGLtE.exe
  2⤵
  PID:2492
- C:\Windows\System\AUyLOqC.exe
  C:\Windows\System\AUyLOqC.exe
  2⤵
  PID:5084
- C:\Windows\System\VBExyhZ.exe
  C:\Windows\System\VBExyhZ.exe
  2⤵
  PID:4392
- C:\Windows\System\TpOpuLK.exe
  C:\Windows\System\TpOpuLK.exe
  2⤵
  PID:4584
- C:\Windows\System\oShEiJo.exe
  C:\Windows\System\oShEiJo.exe
  2⤵
  PID:4132
- C:\Windows\System\ApZysvh.exe
  C:\Windows\System\ApZysvh.exe
  2⤵
  PID:4652
- C:\Windows\System\iDrjTBu.exe
  C:\Windows\System\iDrjTBu.exe
  2⤵
  PID:4616
- C:\Windows\System\YxvtARW.exe
  C:\Windows\System\YxvtARW.exe
  2⤵
  PID:4732
- C:\Windows\System\GchqWWh.exe
  C:\Windows\System\GchqWWh.exe
  2⤵
  PID:4700
- C:\Windows\System\Afhhfec.exe
  C:\Windows\System\Afhhfec.exe
  2⤵
  PID:4788
- C:\Windows\System\KbOOEEO.exe
  C:\Windows\System\KbOOEEO.exe
  2⤵
  PID:4812
- C:\Windows\System\SXmiXms.exe
  C:\Windows\System\SXmiXms.exe
  2⤵
  PID:4824
- C:\Windows\System\GvJLSLS.exe
  C:\Windows\System\GvJLSLS.exe
  2⤵
  PID:4224
- C:\Windows\System\wKCqBbe.exe
  C:\Windows\System\wKCqBbe.exe
  2⤵
  PID:5136
- C:\Windows\System\msnSAGw.exe
  C:\Windows\System\msnSAGw.exe
  2⤵
  PID:5156
- C:\Windows\System\WhhgiQm.exe
  C:\Windows\System\WhhgiQm.exe
  2⤵
  PID:5172
- C:\Windows\System\mzHfXqD.exe
  C:\Windows\System\mzHfXqD.exe
  2⤵
  PID:5188
- C:\Windows\System\jOUOqRc.exe
  C:\Windows\System\jOUOqRc.exe
  2⤵
  PID:5204
- C:\Windows\System\cBUZycf.exe
  C:\Windows\System\cBUZycf.exe
  2⤵
  PID:5236
- C:\Windows\System\HKYECNk.exe
  C:\Windows\System\HKYECNk.exe
  2⤵
  PID:5268
- C:\Windows\System\MbEfIuG.exe
  C:\Windows\System\MbEfIuG.exe
  2⤵
  PID:5284
- C:\Windows\System\PukgwPo.exe
  C:\Windows\System\PukgwPo.exe
  2⤵
  PID:5300
- C:\Windows\System\DxFlFcG.exe
  C:\Windows\System\DxFlFcG.exe
  2⤵
  PID:5316
- C:\Windows\System\OIzZgDP.exe
  C:\Windows\System\OIzZgDP.exe
  2⤵
  PID:5372
- C:\Windows\System\KhQqJOc.exe
  C:\Windows\System\KhQqJOc.exe
  2⤵
  PID:5388
- C:\Windows\System\IeAvfuL.exe
  C:\Windows\System\IeAvfuL.exe
  2⤵
  PID:5404
- C:\Windows\System\wdZzxHx.exe
  C:\Windows\System\wdZzxHx.exe
  2⤵
  PID:5420
- C:\Windows\System\YplkXqS.exe
  C:\Windows\System\YplkXqS.exe
  2⤵
  PID:5436
- C:\Windows\System\cchqPSi.exe
  C:\Windows\System\cchqPSi.exe
  2⤵
  PID:5592
- C:\Windows\System\ViKtfCW.exe
  C:\Windows\System\ViKtfCW.exe
  2⤵
  PID:5616
- C:\Windows\System\tfwUUXc.exe
  C:\Windows\System\tfwUUXc.exe
  2⤵
  PID:5636
- C:\Windows\System\LuqULfL.exe
  C:\Windows\System\LuqULfL.exe
  2⤵
  PID:5656
- C:\Windows\System\nBncRzy.exe
  C:\Windows\System\nBncRzy.exe
  2⤵
  PID:5680
- C:\Windows\System\RVeIdfL.exe
  C:\Windows\System\RVeIdfL.exe
  2⤵
  PID:5700
- C:\Windows\System\TEpasal.exe
  C:\Windows\System\TEpasal.exe
  2⤵
  PID:5724
- C:\Windows\System\duOKwha.exe
  C:\Windows\System\duOKwha.exe
  2⤵
  PID:5772
- C:\Windows\System\aUebriD.exe
  C:\Windows\System\aUebriD.exe
  2⤵
  PID:5788
- C:\Windows\System\HLcGeCn.exe
  C:\Windows\System\HLcGeCn.exe
  2⤵
  PID:5808
- C:\Windows\System\TpCKFFR.exe
  C:\Windows\System\TpCKFFR.exe
  2⤵
  PID:5832
- C:\Windows\System\yzWJQpf.exe
  C:\Windows\System\yzWJQpf.exe
  2⤵
  PID:5848
- C:\Windows\System\aATOrxC.exe
  C:\Windows\System\aATOrxC.exe
  2⤵
  PID:5864
- C:\Windows\System\IfTfWSx.exe
  C:\Windows\System\IfTfWSx.exe
  2⤵
  PID:5880
- C:\Windows\System\EwtmdRj.exe
  C:\Windows\System\EwtmdRj.exe
  2⤵
  PID:5896
- C:\Windows\System\PhHjAZM.exe
  C:\Windows\System\PhHjAZM.exe
  2⤵
  PID:5912
- C:\Windows\System\tvQrFmZ.exe
  C:\Windows\System\tvQrFmZ.exe
  2⤵
  PID:5928
- C:\Windows\System\gtXYQAi.exe
  C:\Windows\System\gtXYQAi.exe
  2⤵
  PID:5944
- C:\Windows\System\fbTzLkm.exe
  C:\Windows\System\fbTzLkm.exe
  2⤵
  PID:5960
- C:\Windows\System\UEmqVza.exe
  C:\Windows\System\UEmqVza.exe
  2⤵
  PID:5976
- C:\Windows\System\bFIqwSo.exe
  C:\Windows\System\bFIqwSo.exe
  2⤵
  PID:6048
- C:\Windows\System\OcYuTMm.exe
  C:\Windows\System\OcYuTMm.exe
  2⤵
  PID:6064
- C:\Windows\System\yocyOeR.exe
  C:\Windows\System\yocyOeR.exe
  2⤵
  PID:6080
- C:\Windows\System\HyLxMuD.exe
  C:\Windows\System\HyLxMuD.exe
  2⤵
  PID:6096
- C:\Windows\System\PJGrQPV.exe
  C:\Windows\System\PJGrQPV.exe
  2⤵
  PID:6112
- C:\Windows\System\XfbOXdy.exe
  C:\Windows\System\XfbOXdy.exe
  2⤵
  PID:6128
- C:\Windows\System\iLyFnpQ.exe
  C:\Windows\System\iLyFnpQ.exe
  2⤵
  PID:5080
- C:\Windows\System\iBTnxum.exe
  C:\Windows\System\iBTnxum.exe
  2⤵
  PID:4844
- C:\Windows\System\jaWfhjN.exe
  C:\Windows\System\jaWfhjN.exe
  2⤵
  PID:5164
- C:\Windows\System\cnowlkq.exe
  C:\Windows\System\cnowlkq.exe
  2⤵
  PID:4488
- C:\Windows\System\iArZshl.exe
  C:\Windows\System\iArZshl.exe
  2⤵
  PID:3852
- C:\Windows\System\fjGnRSu.exe
  C:\Windows\System\fjGnRSu.exe
  2⤵
  PID:3192
- C:\Windows\System\OZYukfV.exe
  C:\Windows\System\OZYukfV.exe
  2⤵
  PID:3648
- C:\Windows\System\WIrzFNS.exe
  C:\Windows\System\WIrzFNS.exe
  2⤵
  PID:5184
- C:\Windows\System\uGUWxbz.exe
  C:\Windows\System\uGUWxbz.exe
  2⤵
  PID:4692
- C:\Windows\System\xcGoJCj.exe
  C:\Windows\System\xcGoJCj.exe
  2⤵
  PID:3320
- C:\Windows\System\OriDioI.exe
  C:\Windows\System\OriDioI.exe
  2⤵
  PID:5212
- C:\Windows\System\Prluzfk.exe
  C:\Windows\System\Prluzfk.exe
  2⤵
  PID:5216
- C:\Windows\System\eUtZPfr.exe
  C:\Windows\System\eUtZPfr.exe
  2⤵
  PID:5260
- C:\Windows\System\gxNBvdZ.exe
  C:\Windows\System\gxNBvdZ.exe
  2⤵
  PID:5244
- C:\Windows\System\HhgEkXy.exe
  C:\Windows\System\HhgEkXy.exe
  2⤵
  PID:5352
- C:\Windows\System\oqOqYsx.exe
  C:\Windows\System\oqOqYsx.exe
  2⤵
  PID:5356
- C:\Windows\System\RaShQcm.exe
  C:\Windows\System\RaShQcm.exe
  2⤵
  PID:5412
- C:\Windows\System\lXMjmlP.exe
  C:\Windows\System\lXMjmlP.exe
  2⤵
  PID:5428
- C:\Windows\System\wcMKNqe.exe
  C:\Windows\System\wcMKNqe.exe
  2⤵
  PID:4172
- C:\Windows\System\gMjSLWm.exe
  C:\Windows\System\gMjSLWm.exe
  2⤵
  PID:5464
- C:\Windows\System\vvCJXEX.exe
  C:\Windows\System\vvCJXEX.exe
  2⤵
  PID:5472
- C:\Windows\System\ixBppsz.exe
  C:\Windows\System\ixBppsz.exe
  2⤵
  PID:5488
- C:\Windows\System\pdjCfZP.exe
  C:\Windows\System\pdjCfZP.exe
  2⤵
  PID:5516
- C:\Windows\System\xGXBlHN.exe
  C:\Windows\System\xGXBlHN.exe
  2⤵
  PID:5552
- C:\Windows\System\evFAPGn.exe
  C:\Windows\System\evFAPGn.exe
  2⤵
  PID:5568
- C:\Windows\System\XlvGKDe.exe
  C:\Windows\System\XlvGKDe.exe
  2⤵
  PID:5576
- C:\Windows\System\AtPTxiG.exe
  C:\Windows\System\AtPTxiG.exe
  2⤵
  PID:5736
- C:\Windows\System\SuxOhhh.exe
  C:\Windows\System\SuxOhhh.exe
  2⤵
  PID:5584
- C:\Windows\System\HEDvJbU.exe
  C:\Windows\System\HEDvJbU.exe
  2⤵
  PID:5672
- C:\Windows\System\nEmpPgy.exe
  C:\Windows\System\nEmpPgy.exe
  2⤵
  PID:5720
- C:\Windows\System\qbmdFsI.exe
  C:\Windows\System\qbmdFsI.exe
  2⤵
  PID:5752
- C:\Windows\System\cXwvORf.exe
  C:\Windows\System\cXwvORf.exe
  2⤵
  PID:5768
- C:\Windows\System\XmnMrGl.exe
  C:\Windows\System\XmnMrGl.exe
  2⤵
  PID:5800
- C:\Windows\System\MNKCgAt.exe
  C:\Windows\System\MNKCgAt.exe
  2⤵
  PID:5904
- C:\Windows\System\svZwBbE.exe
  C:\Windows\System\svZwBbE.exe
  2⤵
  PID:5924
- C:\Windows\System\vronHMv.exe
  C:\Windows\System\vronHMv.exe
  2⤵
  PID:6000
- C:\Windows\System\opaxvGH.exe
  C:\Windows\System\opaxvGH.exe
  2⤵
  PID:6024
- C:\Windows\System\ylJVYdD.exe
  C:\Windows\System\ylJVYdD.exe
  2⤵
  PID:5992
- C:\Windows\System\kWdaJbS.exe
  C:\Windows\System\kWdaJbS.exe
  2⤵
  PID:5860
- C:\Windows\System\HkkOcCs.exe
  C:\Windows\System\HkkOcCs.exe
  2⤵
  PID:6016
- C:\Windows\System\ujefFPr.exe
  C:\Windows\System\ujefFPr.exe
  2⤵
  PID:6036
- C:\Windows\System\jqomWpH.exe
  C:\Windows\System\jqomWpH.exe
  2⤵
  PID:6060
- C:\Windows\System\UwwSzHu.exe
  C:\Windows\System\UwwSzHu.exe
  2⤵
  PID:6108
- C:\Windows\System\ADzerIB.exe
  C:\Windows\System\ADzerIB.exe
  2⤵
  PID:4568
- C:\Windows\System\SvOWPcL.exe
  C:\Windows\System\SvOWPcL.exe
  2⤵
  PID:5036
- C:\Windows\System\BXCEFpq.exe
  C:\Windows\System\BXCEFpq.exe
  2⤵
  PID:5224
- C:\Windows\System\YUyYtRb.exe
  C:\Windows\System\YUyYtRb.exe
  2⤵
  PID:6124
- C:\Windows\System\vtlKUAr.exe
  C:\Windows\System\vtlKUAr.exe
  2⤵
  PID:4820
- C:\Windows\System\bbUgLJt.exe
  C:\Windows\System\bbUgLJt.exe
  2⤵
  PID:4920
- C:\Windows\System\IVTDsyS.exe
  C:\Windows\System\IVTDsyS.exe
  2⤵
  PID:5280
- C:\Windows\System\jCMFKti.exe
  C:\Windows\System\jCMFKti.exe
  2⤵
  PID:5336
- C:\Windows\System\FdqBaQx.exe
  C:\Windows\System\FdqBaQx.exe
  2⤵
  PID:6040
- C:\Windows\System\EqfbwAc.exe
  C:\Windows\System\EqfbwAc.exe
  2⤵
  PID:5344
- C:\Windows\System\WahRQDX.exe
  C:\Windows\System\WahRQDX.exe
  2⤵
  PID:5368
- C:\Windows\System\xUxmHsW.exe
  C:\Windows\System\xUxmHsW.exe
  2⤵
  PID:5460
- C:\Windows\System\QGliAXY.exe
  C:\Windows\System\QGliAXY.exe
  2⤵
  PID:5524
- C:\Windows\System\BvqVlab.exe
  C:\Windows\System\BvqVlab.exe
  2⤵
  PID:5504
- C:\Windows\System\olaWhJQ.exe
  C:\Windows\System\olaWhJQ.exe
  2⤵
  PID:5468
- C:\Windows\System\STgToHX.exe
  C:\Windows\System\STgToHX.exe
  2⤵
  PID:5364
- C:\Windows\System\WcclHlP.exe
  C:\Windows\System\WcclHlP.exe
  2⤵
  PID:5624
- C:\Windows\System\LfDBLnD.exe
  C:\Windows\System\LfDBLnD.exe
  2⤵
  PID:5644
- C:\Windows\System\tQGYESn.exe
  C:\Windows\System\tQGYESn.exe
  2⤵
  PID:5648
- C:\Windows\System\aqhHojV.exe
  C:\Windows\System\aqhHojV.exe
  2⤵
  PID:5676
- C:\Windows\System\awTizZH.exe
  C:\Windows\System\awTizZH.exe
  2⤵
  PID:5744
- C:\Windows\System\LyDAeMS.exe
  C:\Windows\System\LyDAeMS.exe
  2⤵
  PID:5872
- C:\Windows\System\atSditQ.exe
  C:\Windows\System\atSditQ.exe
  2⤵
  PID:5712
- C:\Windows\System\gelAZvM.exe
  C:\Windows\System\gelAZvM.exe
  2⤵
  PID:5828
- C:\Windows\System\ORNpZcg.exe
  C:\Windows\System\ORNpZcg.exe
  2⤵
  PID:5820
- C:\Windows\System\qXhnLvr.exe
  C:\Windows\System\qXhnLvr.exe
  2⤵
  PID:6076
- C:\Windows\System\pnxUklG.exe
  C:\Windows\System\pnxUklG.exe
  2⤵
  PID:5920
- C:\Windows\System\zuLmjYR.exe
  C:\Windows\System\zuLmjYR.exe
  2⤵
  PID:6120
- C:\Windows\System\jIHDbsa.exe
  C:\Windows\System\jIHDbsa.exe
  2⤵
  PID:2772
- C:\Windows\System\yXLyyVc.exe
  C:\Windows\System\yXLyyVc.exe
  2⤵
  PID:5296
- C:\Windows\System\MyChUzZ.exe
  C:\Windows\System\MyChUzZ.exe
  2⤵
  PID:5520
- C:\Windows\System\VKvNyMx.exe
  C:\Windows\System\VKvNyMx.exe
  2⤵
  PID:5732
- C:\Windows\System\uVBEWli.exe
  C:\Windows\System\uVBEWli.exe
  2⤵
  PID:5512
- C:\Windows\System\PYRhULa.exe
  C:\Windows\System\PYRhULa.exe
  2⤵
  PID:5816
- C:\Windows\System\WaRsMwv.exe
  C:\Windows\System\WaRsMwv.exe
  2⤵
  PID:4704
- C:\Windows\System\vGMHZQo.exe
  C:\Windows\System\vGMHZQo.exe
  2⤵
  PID:4380
- C:\Windows\System\iwUuEyK.exe
  C:\Windows\System\iwUuEyK.exe
  2⤵
  PID:5608
- C:\Windows\System\ckfiqIJ.exe
  C:\Windows\System\ckfiqIJ.exe
  2⤵
  PID:5444
- C:\Windows\System\YZkdTHn.exe
  C:\Windows\System\YZkdTHn.exe
  2⤵
  PID:5580
- C:\Windows\System\UYWzQtp.exe
  C:\Windows\System\UYWzQtp.exe
  2⤵
  PID:6032
- C:\Windows\System\AbXRaiL.exe
  C:\Windows\System\AbXRaiL.exe
  2⤵
  PID:6028
- C:\Windows\System\nwvRfCr.exe
  C:\Windows\System\nwvRfCr.exe
  2⤵
  PID:6088
- C:\Windows\System\dNVylby.exe
  C:\Windows\System\dNVylby.exe
  2⤵
  PID:4900
- C:\Windows\System\WUqIPDw.exe
  C:\Windows\System\WUqIPDw.exe
  2⤵
  PID:5180
- C:\Windows\System\NByhOBa.exe
  C:\Windows\System\NByhOBa.exe
  2⤵
  PID:5252
- C:\Windows\System\NwdUQCx.exe
  C:\Windows\System\NwdUQCx.exe
  2⤵
  PID:5760
- C:\Windows\System\LhYVbVr.exe
  C:\Windows\System\LhYVbVr.exe
  2⤵
  PID:5668
- C:\Windows\System\RzjJTMP.exe
  C:\Windows\System\RzjJTMP.exe
  2⤵
  PID:6012
- C:\Windows\System\jQkYmGW.exe
  C:\Windows\System\jQkYmGW.exe
  2⤵
  PID:5396
- C:\Windows\System\JuCbhVO.exe
  C:\Windows\System\JuCbhVO.exe
  2⤵
  PID:5956
- C:\Windows\System\rXmiCil.exe
  C:\Windows\System\rXmiCil.exe
  2⤵
  PID:5132
- C:\Windows\System\oeySFFS.exe
  C:\Windows\System\oeySFFS.exe
  2⤵
  PID:6160
- C:\Windows\System\QvszpNo.exe
  C:\Windows\System\QvszpNo.exe
  2⤵
  PID:6176
- C:\Windows\System\sUKWAlz.exe
  C:\Windows\System\sUKWAlz.exe
  2⤵
  PID:6192
- C:\Windows\System\NyuIcYA.exe
  C:\Windows\System\NyuIcYA.exe
  2⤵
  PID:6244
- C:\Windows\System\RVpgimF.exe
  C:\Windows\System\RVpgimF.exe
  2⤵
  PID:6260
- C:\Windows\System\XCiLmWW.exe
  C:\Windows\System\XCiLmWW.exe
  2⤵
  PID:6276
- C:\Windows\System\vmmpmfv.exe
  C:\Windows\System\vmmpmfv.exe
  2⤵
  PID:6292
- C:\Windows\System\doKaJgH.exe
  C:\Windows\System\doKaJgH.exe
  2⤵
  PID:6308
- C:\Windows\System\yaPRCHe.exe
  C:\Windows\System\yaPRCHe.exe
  2⤵
  PID:6324
- C:\Windows\System\EVetihb.exe
  C:\Windows\System\EVetihb.exe
  2⤵
  PID:6340
- C:\Windows\System\sWRliDp.exe
  C:\Windows\System\sWRliDp.exe
  2⤵
  PID:6356
- C:\Windows\System\ZitFmJh.exe
  C:\Windows\System\ZitFmJh.exe
  2⤵
  PID:6372
- C:\Windows\System\pQpENMc.exe
  C:\Windows\System\pQpENMc.exe
  2⤵
  PID:6388
- C:\Windows\System\jsXAENi.exe
  C:\Windows\System\jsXAENi.exe
  2⤵
  PID:6404
- C:\Windows\System\cHieXhT.exe
  C:\Windows\System\cHieXhT.exe
  2⤵
  PID:6420
- C:\Windows\System\pCPIYyL.exe
  C:\Windows\System\pCPIYyL.exe
  2⤵
  PID:6436
- C:\Windows\System\qurlRRn.exe
  C:\Windows\System\qurlRRn.exe
  2⤵
  PID:6452
- C:\Windows\System\PmKHnsO.exe
  C:\Windows\System\PmKHnsO.exe
  2⤵
  PID:6468
- C:\Windows\System\OgsdDVc.exe
  C:\Windows\System\OgsdDVc.exe
  2⤵
  PID:6484
- C:\Windows\System\ZXXewxO.exe
  C:\Windows\System\ZXXewxO.exe
  2⤵
  PID:6500
- C:\Windows\System\qsUoJCA.exe
  C:\Windows\System\qsUoJCA.exe
  2⤵
  PID:6516
- C:\Windows\System\ICrOTmo.exe
  C:\Windows\System\ICrOTmo.exe
  2⤵
  PID:6532
- C:\Windows\System\PlBZPOO.exe
  C:\Windows\System\PlBZPOO.exe
  2⤵
  PID:6548
- C:\Windows\System\axNypeO.exe
  C:\Windows\System\axNypeO.exe
  2⤵
  PID:6564
- C:\Windows\System\xyTcgCn.exe
  C:\Windows\System\xyTcgCn.exe
  2⤵
  PID:6580
- C:\Windows\System\grPRJsj.exe
  C:\Windows\System\grPRJsj.exe
  2⤵
  PID:6596
- C:\Windows\System\bhXrykb.exe
  C:\Windows\System\bhXrykb.exe
  2⤵
  PID:6612
- C:\Windows\System\YsJLeOc.exe
  C:\Windows\System\YsJLeOc.exe
  2⤵
  PID:6628
- C:\Windows\System\wtwtcOE.exe
  C:\Windows\System\wtwtcOE.exe
  2⤵
  PID:6644
- C:\Windows\System\TRlDtBD.exe
  C:\Windows\System\TRlDtBD.exe
  2⤵
  PID:6660
- C:\Windows\System\OSNVJBu.exe
  C:\Windows\System\OSNVJBu.exe
  2⤵
  PID:6676
- C:\Windows\System\PEejnHD.exe
  C:\Windows\System\PEejnHD.exe
  2⤵
  PID:6692
- C:\Windows\System\rZhJHHt.exe
  C:\Windows\System\rZhJHHt.exe
  2⤵
  PID:6708
- C:\Windows\System\PlbmAWM.exe
  C:\Windows\System\PlbmAWM.exe
  2⤵
  PID:6724
- C:\Windows\System\UHVpEWM.exe
  C:\Windows\System\UHVpEWM.exe
  2⤵
  PID:6740
- C:\Windows\System\cqNnltg.exe
  C:\Windows\System\cqNnltg.exe
  2⤵
  PID:6756
- C:\Windows\System\tqntWRQ.exe
  C:\Windows\System\tqntWRQ.exe
  2⤵
  PID:6772
- C:\Windows\System\spzKwQZ.exe
  C:\Windows\System\spzKwQZ.exe
  2⤵
  PID:6788
- C:\Windows\System\sKPNZPV.exe
  C:\Windows\System\sKPNZPV.exe
  2⤵
  PID:6804
- C:\Windows\System\llwIeJJ.exe
  C:\Windows\System\llwIeJJ.exe
  2⤵
  PID:6820
- C:\Windows\System\tBIoSlR.exe
  C:\Windows\System\tBIoSlR.exe
  2⤵
  PID:6836
- C:\Windows\System\bTSEJVs.exe
  C:\Windows\System\bTSEJVs.exe
  2⤵
  PID:6852
- C:\Windows\System\ubrKJrM.exe
  C:\Windows\System\ubrKJrM.exe
  2⤵
  PID:6868
- C:\Windows\System\OchXEmO.exe
  C:\Windows\System\OchXEmO.exe
  2⤵
  PID:6884
- C:\Windows\System\ztbMzHH.exe
  C:\Windows\System\ztbMzHH.exe
  2⤵
  PID:6900
- C:\Windows\System\CdwBYWH.exe
  C:\Windows\System\CdwBYWH.exe
  2⤵
  PID:6916
- C:\Windows\System\yrEGCVa.exe
  C:\Windows\System\yrEGCVa.exe
  2⤵
  PID:6932
- C:\Windows\System\BObOnaN.exe
  C:\Windows\System\BObOnaN.exe
  2⤵
  PID:6948
- C:\Windows\System\ssyqNuK.exe
  C:\Windows\System\ssyqNuK.exe
  2⤵
  PID:6964
- C:\Windows\System\WpEkhLZ.exe
  C:\Windows\System\WpEkhLZ.exe
  2⤵
  PID:6980
- C:\Windows\System\xEKfUEc.exe
  C:\Windows\System\xEKfUEc.exe
  2⤵
  PID:6996
- C:\Windows\System\qzUReXE.exe
  C:\Windows\System\qzUReXE.exe
  2⤵
  PID:7012
- C:\Windows\System\PURNEdC.exe
  C:\Windows\System\PURNEdC.exe
  2⤵
  PID:7028
- C:\Windows\System\FxtgXCd.exe
  C:\Windows\System\FxtgXCd.exe
  2⤵
  PID:7044
- C:\Windows\System\iZPBfnE.exe
  C:\Windows\System\iZPBfnE.exe
  2⤵
  PID:7060
- C:\Windows\System\WTvrABB.exe
  C:\Windows\System\WTvrABB.exe
  2⤵
  PID:7076
- C:\Windows\System\HenexhB.exe
  C:\Windows\System\HenexhB.exe
  2⤵
  PID:7092
- C:\Windows\System\oASTvUw.exe
  C:\Windows\System\oASTvUw.exe
  2⤵
  PID:7108
- C:\Windows\System\mObLNOI.exe
  C:\Windows\System\mObLNOI.exe
  2⤵
  PID:7124
- C:\Windows\System\iRFNIst.exe
  C:\Windows\System\iRFNIst.exe
  2⤵
  PID:7140
- C:\Windows\System\YWCLGcp.exe
  C:\Windows\System\YWCLGcp.exe
  2⤵
  PID:7156
- C:\Windows\System\AVIuFKu.exe
  C:\Windows\System\AVIuFKu.exe
  2⤵
  PID:5152
- C:\Windows\System\VFRHVcm.exe
  C:\Windows\System\VFRHVcm.exe
  2⤵
  PID:5876
- C:\Windows\System\XEPOnZn.exe
  C:\Windows\System\XEPOnZn.exe
  2⤵
  PID:6236
- C:\Windows\System\DKPGvPv.exe
  C:\Windows\System\DKPGvPv.exe
  2⤵
  PID:6220
- C:\Windows\System\WIkzkjf.exe
  C:\Windows\System\WIkzkjf.exe
  2⤵
  PID:6172
- C:\Windows\System\BQznPsl.exe
  C:\Windows\System\BQznPsl.exe
  2⤵
  PID:5716
- C:\Windows\System\VfMPIJs.exe
  C:\Windows\System\VfMPIJs.exe
  2⤵
  PID:5312
- C:\Windows\System\EIVoXcI.exe
  C:\Windows\System\EIVoXcI.exe
  2⤵
  PID:4540
- C:\Windows\System\gDFZkQx.exe
  C:\Windows\System\gDFZkQx.exe
  2⤵
  PID:6508
- C:\Windows\System\MzeSRex.exe
  C:\Windows\System\MzeSRex.exe
  2⤵
  PID:6688
- C:\Windows\System\sdopzzi.exe
  C:\Windows\System\sdopzzi.exe
  2⤵
  PID:6684
- C:\Windows\System\kgaPKAt.exe
  C:\Windows\System\kgaPKAt.exe
  2⤵
  PID:6892
- C:\Windows\System\TiLxIJX.exe
  C:\Windows\System\TiLxIJX.exe
  2⤵
  PID:6928
- C:\Windows\System\bGmWkkD.exe
  C:\Windows\System\bGmWkkD.exe
  2⤵
  PID:6960
- C:\Windows\System\bKydzbE.exe
  C:\Windows\System\bKydzbE.exe
  2⤵
  PID:7004
- C:\Windows\System\EjJEIQf.exe
  C:\Windows\System\EjJEIQf.exe
  2⤵
  PID:7036
- C:\Windows\System\HPgMEvk.exe
  C:\Windows\System\HPgMEvk.exe
  2⤵
  PID:7084
- C:\Windows\System\kudgfYo.exe
  C:\Windows\System\kudgfYo.exe
  2⤵
  PID:7072
- C:\Windows\System\KTZMziy.exe
  C:\Windows\System\KTZMziy.exe
  2⤵
  PID:7136
- C:\Windows\System\lSONglO.exe
  C:\Windows\System\lSONglO.exe
  2⤵
  PID:5564
- C:\Windows\System\JQKBGxC.exe
  C:\Windows\System\JQKBGxC.exe
  2⤵
  PID:4552
- C:\Windows\System\bHeAOBq.exe
  C:\Windows\System\bHeAOBq.exe
  2⤵
  PID:6188
- C:\Windows\System\csTWhCA.exe
  C:\Windows\System\csTWhCA.exe
  2⤵
  PID:5448
- C:\Windows\System\QOYlxin.exe
  C:\Windows\System\QOYlxin.exe
  2⤵
  PID:6256
- C:\Windows\System\HIZDQgn.exe
  C:\Windows\System\HIZDQgn.exe
  2⤵
  PID:6272
- C:\Windows\System\tQLFUNi.exe
  C:\Windows\System\tQLFUNi.exe
  2⤵
  PID:6352
- C:\Windows\System\LfauCUc.exe
  C:\Windows\System\LfauCUc.exe
  2⤵
  PID:6384
- C:\Windows\System\CzPRscj.exe
  C:\Windows\System\CzPRscj.exe
  2⤵
  PID:6332
- C:\Windows\System\aMQtnrY.exe
  C:\Windows\System\aMQtnrY.exe
  2⤵
  PID:6540
- C:\Windows\System\axpwFWn.exe
  C:\Windows\System\axpwFWn.exe
  2⤵
  PID:6364
- C:\Windows\System\ZWUOQoS.exe
  C:\Windows\System\ZWUOQoS.exe
  2⤵
  PID:6368
- C:\Windows\System\dUvwxrT.exe
  C:\Windows\System\dUvwxrT.exe
  2⤵
  PID:6460
- C:\Windows\System\hchVKpD.exe
  C:\Windows\System\hchVKpD.exe
  2⤵
  PID:6608
- C:\Windows\System\cYIuQqL.exe
  C:\Windows\System\cYIuQqL.exe
  2⤵
  PID:6640
- C:\Windows\System\eXooTsT.exe
  C:\Windows\System\eXooTsT.exe
  2⤵
  PID:6732
- C:\Windows\System\EjoDZmU.exe
  C:\Windows\System\EjoDZmU.exe
  2⤵
  PID:6796
- C:\Windows\System\iJmnxJw.exe
  C:\Windows\System\iJmnxJw.exe
  2⤵
  PID:6832
- C:\Windows\System\hvFWBNK.exe
  C:\Windows\System\hvFWBNK.exe
  2⤵
  PID:6656
- C:\Windows\System\dTETzYp.exe
  C:\Windows\System\dTETzYp.exe
  2⤵
  PID:6944
- C:\Windows\System\nitQkly.exe
  C:\Windows\System\nitQkly.exe
  2⤵
  PID:7068
- C:\Windows\System\EHXntxG.exe
  C:\Windows\System\EHXntxG.exe
  2⤵
  PID:6924
- C:\Windows\System\EpxBZZC.exe
  C:\Windows\System\EpxBZZC.exe
  2⤵
  PID:7052
- C:\Windows\System\ERqviER.exe
  C:\Windows\System\ERqviER.exe
  2⤵
  PID:7120
- C:\Windows\System\fPSmLik.exe
  C:\Windows\System\fPSmLik.exe
  2⤵
  PID:7148
- C:\Windows\System\CaZuwlL.exe
  C:\Windows\System\CaZuwlL.exe
  2⤵
  PID:6104
- C:\Windows\System\nQdFzFE.exe
  C:\Windows\System\nQdFzFE.exe
  2⤵
  PID:6212
- C:\Windows\System\LyICpfH.exe
  C:\Windows\System\LyICpfH.exe
  2⤵
  PID:6288
- C:\Windows\System\bxPtsvo.exe
  C:\Windows\System\bxPtsvo.exe
  2⤵
  PID:5940
- C:\Windows\System\LuzBZvs.exe
  C:\Windows\System\LuzBZvs.exe
  2⤵
  PID:6416
- C:\Windows\System\TXYZZxx.exe
  C:\Windows\System\TXYZZxx.exe
  2⤵
  PID:6400
- C:\Windows\System\QIuDUtD.exe
  C:\Windows\System\QIuDUtD.exe
  2⤵
  PID:6284
- C:\Windows\System\dterjAH.exe
  C:\Windows\System\dterjAH.exe
  2⤵
  PID:6428
- C:\Windows\System\ZXYKiGm.exe
  C:\Windows\System\ZXYKiGm.exe
  2⤵
  PID:6624
- C:\Windows\System\RGLKUcH.exe
  C:\Windows\System\RGLKUcH.exe
  2⤵
  PID:6800
- C:\Windows\System\XVbellD.exe
  C:\Windows\System\XVbellD.exe
  2⤵
  PID:7020
- C:\Windows\System\ooicxEg.exe
  C:\Windows\System\ooicxEg.exe
  2⤵
  PID:6672
- C:\Windows\System\agkGqaV.exe
  C:\Windows\System\agkGqaV.exe
  2⤵
  PID:7132
- C:\Windows\System\zmSXjJz.exe
  C:\Windows\System\zmSXjJz.exe
  2⤵
  PID:6152
- C:\Windows\System\nozLqzz.exe
  C:\Windows\System\nozLqzz.exe
  2⤵
  PID:6748
- C:\Windows\System\gOeuiDN.exe
  C:\Windows\System\gOeuiDN.exe
  2⤵
  PID:6876
- C:\Windows\System\BgJtlOT.exe
  C:\Windows\System\BgJtlOT.exe
  2⤵
  PID:6912
- C:\Windows\System\rciWfmF.exe
  C:\Windows\System\rciWfmF.exe
  2⤵
  PID:5696
- C:\Windows\System\fFuuWii.exe
  C:\Windows\System\fFuuWii.exe
  2⤵
  PID:6764
- C:\Windows\System\WYJjJOk.exe
  C:\Windows\System\WYJjJOk.exe
  2⤵
  PID:6752
- C:\Windows\System\OLDPcjK.exe
  C:\Windows\System\OLDPcjK.exe
  2⤵
  PID:6592
- C:\Windows\System\lEXJmqw.exe
  C:\Windows\System\lEXJmqw.exe
  2⤵
  PID:6704
- C:\Windows\System\lEKRnrA.exe
  C:\Windows\System\lEKRnrA.exe
  2⤵
  PID:6492
- C:\Windows\System\eEjtYxA.exe
  C:\Windows\System\eEjtYxA.exe
  2⤵
  PID:6988
- C:\Windows\System\PZnVTsX.exe
  C:\Windows\System\PZnVTsX.exe
  2⤵
  PID:6476
- C:\Windows\System\fvWvVLy.exe
  C:\Windows\System\fvWvVLy.exe
  2⤵
  PID:7104
- C:\Windows\System\rsLbeBP.exe
  C:\Windows\System\rsLbeBP.exe
  2⤵
  PID:5536
- C:\Windows\System\ySxaRDp.exe
  C:\Windows\System\ySxaRDp.exe
  2⤵
  PID:6092
- C:\Windows\System\qudvNec.exe
  C:\Windows\System\qudvNec.exe
  2⤵
  PID:7180
- C:\Windows\System\QcxJpzY.exe
  C:\Windows\System\QcxJpzY.exe
  2⤵
  PID:7200
- C:\Windows\System\JIBUVfR.exe
  C:\Windows\System\JIBUVfR.exe
  2⤵
  PID:7216
- C:\Windows\System\fZThpJd.exe
  C:\Windows\System\fZThpJd.exe
  2⤵
  PID:7236
- C:\Windows\System\RoUZTsl.exe
  C:\Windows\System\RoUZTsl.exe
  2⤵
  PID:7256
- C:\Windows\System\CRVGKEd.exe
  C:\Windows\System\CRVGKEd.exe
  2⤵
  PID:7276
- C:\Windows\System\KnHPoPV.exe
  C:\Windows\System\KnHPoPV.exe
  2⤵
  PID:7292
- C:\Windows\System\Srplgmo.exe
  C:\Windows\System\Srplgmo.exe
  2⤵
  PID:7312
- C:\Windows\System\koCEhMx.exe
  C:\Windows\System\koCEhMx.exe
  2⤵
  PID:7328
- C:\Windows\System\fqAAwxI.exe
  C:\Windows\System\fqAAwxI.exe
  2⤵
  PID:7344
- C:\Windows\System\vCKjcXK.exe
  C:\Windows\System\vCKjcXK.exe
  2⤵
  PID:7372
- C:\Windows\System\UcTgNgd.exe
  C:\Windows\System\UcTgNgd.exe
  2⤵
  PID:7388
- C:\Windows\System\xmqMyhb.exe
  C:\Windows\System\xmqMyhb.exe
  2⤵
  PID:7404
- C:\Windows\System\MolTXNR.exe
  C:\Windows\System\MolTXNR.exe
  2⤵
  PID:7424
- C:\Windows\System\WTeYOVI.exe
  C:\Windows\System\WTeYOVI.exe
  2⤵
  PID:7440
- C:\Windows\System\hNUfyEg.exe
  C:\Windows\System\hNUfyEg.exe
  2⤵
  PID:7460
- C:\Windows\System\OVlaLbO.exe
  C:\Windows\System\OVlaLbO.exe
  2⤵
  PID:7476
- C:\Windows\System\WnwZNbQ.exe
  C:\Windows\System\WnwZNbQ.exe
  2⤵
  PID:7492
- C:\Windows\System\cnMSdTm.exe
  C:\Windows\System\cnMSdTm.exe
  2⤵
  PID:7516
- C:\Windows\System\omQBGej.exe
  C:\Windows\System\omQBGej.exe
  2⤵
  PID:7548
- C:\Windows\System\maRqVwa.exe
  C:\Windows\System\maRqVwa.exe
  2⤵
  PID:7564
- C:\Windows\System\BLusLdD.exe
  C:\Windows\System\BLusLdD.exe
  2⤵
  PID:7580
- C:\Windows\System\SMLqSJt.exe
  C:\Windows\System\SMLqSJt.exe
  2⤵
  PID:7596
- C:\Windows\System\QKGgfGM.exe
  C:\Windows\System\QKGgfGM.exe
  2⤵
  PID:7612
- C:\Windows\System\TaCGyqf.exe
  C:\Windows\System\TaCGyqf.exe
  2⤵
  PID:7628
- C:\Windows\System\cnygDUy.exe
  C:\Windows\System\cnygDUy.exe
  2⤵
  PID:7644
- C:\Windows\System\mbwVPAi.exe
  C:\Windows\System\mbwVPAi.exe
  2⤵
  PID:7660
- C:\Windows\System\xWEMVub.exe
  C:\Windows\System\xWEMVub.exe
  2⤵
  PID:7676
- C:\Windows\System\ZCZiHDZ.exe
  C:\Windows\System\ZCZiHDZ.exe
  2⤵
  PID:7692
- C:\Windows\System\AtLCUwX.exe
  C:\Windows\System\AtLCUwX.exe
  2⤵
  PID:7708
- C:\Windows\System\EMiTDFc.exe
  C:\Windows\System\EMiTDFc.exe
  2⤵
  PID:7728
- C:\Windows\System\RHSdOgx.exe
  C:\Windows\System\RHSdOgx.exe
  2⤵
  PID:7744
- C:\Windows\System\LDcyctj.exe
  C:\Windows\System\LDcyctj.exe
  2⤵
  PID:7760
- C:\Windows\System\HMqONZQ.exe
  C:\Windows\System\HMqONZQ.exe
  2⤵
  PID:7776
- C:\Windows\System\FzlNQXA.exe
  C:\Windows\System\FzlNQXA.exe
  2⤵
  PID:7792
- C:\Windows\System\eySTTXv.exe
  C:\Windows\System\eySTTXv.exe
  2⤵
  PID:7808
- C:\Windows\System\vioinOU.exe
  C:\Windows\System\vioinOU.exe
  2⤵
  PID:7824
- C:\Windows\System\RsljAwD.exe
  C:\Windows\System\RsljAwD.exe
  2⤵
  PID:7840
- C:\Windows\System\ysHGKuP.exe
  C:\Windows\System\ysHGKuP.exe
  2⤵
  PID:7856
- C:\Windows\System\itreGuK.exe
  C:\Windows\System\itreGuK.exe
  2⤵
  PID:7872
- C:\Windows\System\UfJRMBx.exe
  C:\Windows\System\UfJRMBx.exe
  2⤵
  PID:7888
- C:\Windows\System\DnrMNXd.exe
  C:\Windows\System\DnrMNXd.exe
  2⤵
  PID:7904
- C:\Windows\System\UkHkhkg.exe
  C:\Windows\System\UkHkhkg.exe
  2⤵
  PID:7920
- C:\Windows\System\HADcAaf.exe
  C:\Windows\System\HADcAaf.exe
  2⤵
  PID:7936
- C:\Windows\System\LNIukXx.exe
  C:\Windows\System\LNIukXx.exe
  2⤵
  PID:7952
- C:\Windows\System\HiJJvYB.exe
  C:\Windows\System\HiJJvYB.exe
  2⤵
  PID:7968
- C:\Windows\System\OPvMdeI.exe
  C:\Windows\System\OPvMdeI.exe
  2⤵
  PID:7984
- C:\Windows\System\YQElSRI.exe
  C:\Windows\System\YQElSRI.exe
  2⤵
  PID:8000
- C:\Windows\System\MChjVaG.exe
  C:\Windows\System\MChjVaG.exe
  2⤵
  PID:8016
- C:\Windows\System\PnBfsyb.exe
  C:\Windows\System\PnBfsyb.exe
  2⤵
  PID:8032
- C:\Windows\System\cLZSuKx.exe
  C:\Windows\System\cLZSuKx.exe
  2⤵
  PID:8048
- C:\Windows\System\uEOepNN.exe
  C:\Windows\System\uEOepNN.exe
  2⤵
  PID:8068
- C:\Windows\System\lfnVTWF.exe
  C:\Windows\System\lfnVTWF.exe
  2⤵
  PID:8184
- C:\Windows\System\dDHcZTT.exe
  C:\Windows\System\dDHcZTT.exe
  2⤵
  PID:7320
- C:\Windows\System\yqfJdyb.exe
  C:\Windows\System\yqfJdyb.exe
  2⤵
  PID:7248
- C:\Windows\System\rHcAhTV.exe
  C:\Windows\System\rHcAhTV.exe
  2⤵
  PID:7172
- C:\Windows\System\oIKsxzy.exe
  C:\Windows\System\oIKsxzy.exe
  2⤵
  PID:6336
- C:\Windows\System\nORIQxb.exe
  C:\Windows\System\nORIQxb.exe
  2⤵
  PID:7340
- C:\Windows\System\LiyLCOB.exe
  C:\Windows\System\LiyLCOB.exe
  2⤵
  PID:6908
- C:\Windows\System\iNnjjXk.exe
  C:\Windows\System\iNnjjXk.exe
  2⤵
  PID:7188
- C:\Windows\System\bOSwsKV.exe
  C:\Windows\System\bOSwsKV.exe
  2⤵
  PID:7228
- C:\Windows\System\yMHSNaP.exe
  C:\Windows\System\yMHSNaP.exe
  2⤵
  PID:7272
- C:\Windows\System\ghlMMbe.exe
  C:\Windows\System\ghlMMbe.exe
  2⤵
  PID:7380
- C:\Windows\System\zgMRjsj.exe
  C:\Windows\System\zgMRjsj.exe
  2⤵
  PID:7420
- C:\Windows\System\wDPUQpO.exe
  C:\Windows\System\wDPUQpO.exe
  2⤵
  PID:7352
- C:\Windows\System\qtAwJqx.exe
  C:\Windows\System\qtAwJqx.exe
  2⤵
  PID:7368
- C:\Windows\System\Zynutiw.exe
  C:\Windows\System\Zynutiw.exe
  2⤵
  PID:7528
- C:\Windows\System\eTqxGbz.exe
  C:\Windows\System\eTqxGbz.exe
  2⤵
  PID:7472
- C:\Windows\System\CFwLPsF.exe
  C:\Windows\System\CFwLPsF.exe
  2⤵
  PID:7512
- C:\Windows\System\iCxSeYG.exe
  C:\Windows\System\iCxSeYG.exe
  2⤵
  PID:6240
- C:\Windows\System\NrvORBj.exe
  C:\Windows\System\NrvORBj.exe
  2⤵
  PID:7604
- C:\Windows\System\WuALYOn.exe
  C:\Windows\System\WuALYOn.exe
  2⤵
  PID:7560
- C:\Windows\System\CbCvKOd.exe
  C:\Windows\System\CbCvKOd.exe
  2⤵
  PID:7636
- C:\Windows\System\EevIaZI.exe
  C:\Windows\System\EevIaZI.exe
  2⤵
  PID:7668
- C:\Windows\System\xLblXQV.exe
  C:\Windows\System\xLblXQV.exe
  2⤵
  PID:7684
- C:\Windows\System\sslmaUj.exe
  C:\Windows\System\sslmaUj.exe
  2⤵
  PID:7716
- C:\Windows\System\gAScKsS.exe
  C:\Windows\System\gAScKsS.exe
  2⤵
  PID:7804
- C:\Windows\System\CImqHtP.exe
  C:\Windows\System\CImqHtP.exe
  2⤵
  PID:7864
- C:\Windows\System\WhhGYHB.exe
  C:\Windows\System\WhhGYHB.exe
  2⤵
  PID:7848
- C:\Windows\System\tLfWMEr.exe
  C:\Windows\System\tLfWMEr.exe
  2⤵
  PID:7900
- C:\Windows\System\LnTJFFU.exe
  C:\Windows\System\LnTJFFU.exe
  2⤵
  PID:7964
- C:\Windows\System\tmJbSnD.exe
  C:\Windows\System\tmJbSnD.exe
  2⤵
  PID:7912
- C:\Windows\System\uYlUOhM.exe
  C:\Windows\System\uYlUOhM.exe
  2⤵
  PID:8076
- C:\Windows\System\zPbQfkT.exe
  C:\Windows\System\zPbQfkT.exe
  2⤵
  PID:8096
- C:\Windows\System\OkFcsXC.exe
  C:\Windows\System\OkFcsXC.exe
  2⤵
  PID:8112
- C:\Windows\System\NjzcMDS.exe
  C:\Windows\System\NjzcMDS.exe
  2⤵
  PID:8024
- C:\Windows\System\FuNrRYy.exe
  C:\Windows\System\FuNrRYy.exe
  2⤵
  PID:8116
- C:\Windows\System\ilwqBkm.exe
  C:\Windows\System\ilwqBkm.exe
  2⤵
  PID:8128
- C:\Windows\System\dhQhELW.exe
  C:\Windows\System\dhQhELW.exe
  2⤵
  PID:8152
- C:\Windows\System\QuIMLZG.exe
  C:\Windows\System\QuIMLZG.exe
  2⤵
  PID:8172
- C:\Windows\System\OGBdpBR.exe
  C:\Windows\System\OGBdpBR.exe
  2⤵
  PID:7304
- C:\Windows\System\AslLset.exe
  C:\Windows\System\AslLset.exe
  2⤵
  PID:7308
- C:\Windows\System\RDYhGiX.exe
  C:\Windows\System\RDYhGiX.exe
  2⤵
  PID:6848
- C:\Windows\System\rkmNlIk.exe
  C:\Windows\System\rkmNlIk.exe
  2⤵
  PID:8180
- C:\Windows\System\WtANjEl.exe
  C:\Windows\System\WtANjEl.exe
  2⤵
  PID:7176
- C:\Windows\System\JXLOMMW.exe
  C:\Windows\System\JXLOMMW.exe
  2⤵
  PID:7264
- C:\Windows\System\cNTYPlX.exe
  C:\Windows\System\cNTYPlX.exe
  2⤵
  PID:7484
- C:\Windows\System\xfzcizj.exe
  C:\Windows\System\xfzcizj.exe
  2⤵
  PID:5612
- C:\Windows\System\mLCjifG.exe
  C:\Windows\System\mLCjifG.exe
  2⤵
  PID:7508
- C:\Windows\System\ecgHBAq.exe
  C:\Windows\System\ecgHBAq.exe
  2⤵
  PID:7752
- C:\Windows\System\XaOKPur.exe
  C:\Windows\System\XaOKPur.exe
  2⤵
  PID:7620
- C:\Windows\System\vaKgLGG.exe
  C:\Windows\System\vaKgLGG.exe
  2⤵
  PID:7932
- C:\Windows\System\bjhPMkk.exe
  C:\Windows\System\bjhPMkk.exe
  2⤵
  PID:7788
- C:\Windows\System\ogWlpXx.exe
  C:\Windows\System\ogWlpXx.exe
  2⤵
  PID:8088
- C:\Windows\System\ixsfend.exe
  C:\Windows\System\ixsfend.exe
  2⤵
  PID:7980
- C:\Windows\System\ejFpZLK.exe
  C:\Windows\System\ejFpZLK.exe
  2⤵
  PID:8164
- C:\Windows\System\kfSHLXg.exe
  C:\Windows\System\kfSHLXg.exe
  2⤵
  PID:8140
- C:\Windows\System\lWSXXIM.exe
  C:\Windows\System\lWSXXIM.exe
  2⤵
  PID:8108
- C:\Windows\System\EvQXLuQ.exe
  C:\Windows\System\EvQXLuQ.exe
  2⤵
  PID:7252
- C:\Windows\System\xAwGMof.exe
  C:\Windows\System\xAwGMof.exe
  2⤵
  PID:7088
- C:\Windows\System\AlVPZAa.exe
  C:\Windows\System\AlVPZAa.exe
  2⤵
  PID:7724
- C:\Windows\System\vFBKUwF.exe
  C:\Windows\System\vFBKUwF.exe
  2⤵
  PID:7896
- C:\Windows\System\bBDLujy.exe
  C:\Windows\System\bBDLujy.exe
  2⤵
  PID:8044
- C:\Windows\System\lwUXGRd.exe
  C:\Windows\System\lwUXGRd.exe
  2⤵
  PID:7284
- C:\Windows\System\TnkkxYe.exe
  C:\Windows\System\TnkkxYe.exe
  2⤵
  PID:7468
- C:\Windows\System\RMYJHjV.exe
  C:\Windows\System\RMYJHjV.exe
  2⤵
  PID:7656
- C:\Windows\System\ILiSClI.exe
  C:\Windows\System\ILiSClI.exe
  2⤵
  PID:7740
- C:\Windows\System\bgOBZnY.exe
  C:\Windows\System\bgOBZnY.exe
  2⤵
  PID:7772
- C:\Windows\System\JazokYz.exe
  C:\Windows\System\JazokYz.exe
  2⤵
  PID:7504
- C:\Windows\System\aSeiSFk.exe
  C:\Windows\System\aSeiSFk.exe
  2⤵
  PID:7416
- C:\Windows\System\DeMrsYx.exe
  C:\Windows\System\DeMrsYx.exe
  2⤵
  PID:7960
- C:\Windows\System\jxGQWzA.exe
  C:\Windows\System\jxGQWzA.exe
  2⤵
  PID:8028
- C:\Windows\System\tFwlohe.exe
  C:\Windows\System\tFwlohe.exe
  2⤵
  PID:7544
- C:\Windows\System\vQulJFt.exe
  C:\Windows\System\vQulJFt.exe
  2⤵
  PID:7336
- C:\Windows\System\VrklNHY.exe
  C:\Windows\System\VrklNHY.exe
  2⤵
  PID:7556
- C:\Windows\System\BblJkpk.exe
  C:\Windows\System\BblJkpk.exe
  2⤵
  PID:7412
- C:\Windows\System\fWjiCHA.exe
  C:\Windows\System\fWjiCHA.exe
  2⤵
  PID:1496
- C:\Windows\System\yzPMykD.exe
  C:\Windows\System\yzPMykD.exe
  2⤵
  PID:8060
- C:\Windows\System\zGLEBPA.exe
  C:\Windows\System\zGLEBPA.exe
  2⤵
  PID:6300
- C:\Windows\System\DazBakL.exe
  C:\Windows\System\DazBakL.exe
  2⤵
  PID:8064
- C:\Windows\System\PpWPLWr.exe
  C:\Windows\System\PpWPLWr.exe
  2⤵
  PID:8208
- C:\Windows\System\mEyNJsS.exe
  C:\Windows\System\mEyNJsS.exe
  2⤵
  PID:8228
- C:\Windows\System\lrdGjDu.exe
  C:\Windows\System\lrdGjDu.exe
  2⤵
  PID:8244
- C:\Windows\System\PofIUJH.exe
  C:\Windows\System\PofIUJH.exe
  2⤵
  PID:8264
- C:\Windows\System\yTLFIqj.exe
  C:\Windows\System\yTLFIqj.exe
  2⤵
  PID:8280
- C:\Windows\System\VOTfBMf.exe
  C:\Windows\System\VOTfBMf.exe
  2⤵
  PID:8296
- C:\Windows\System\ooERZsJ.exe
  C:\Windows\System\ooERZsJ.exe
  2⤵
  PID:8388
- C:\Windows\System\tatVNaH.exe
  C:\Windows\System\tatVNaH.exe
  2⤵
  PID:8408
- C:\Windows\System\Azvyhlj.exe
  C:\Windows\System\Azvyhlj.exe
  2⤵
  PID:8432
- C:\Windows\System\ZicDMRp.exe
  C:\Windows\System\ZicDMRp.exe
  2⤵
  PID:8448
- C:\Windows\System\KyZuLkr.exe
  C:\Windows\System\KyZuLkr.exe
  2⤵
  PID:8468
- C:\Windows\System\chsTWpE.exe
  C:\Windows\System\chsTWpE.exe
  2⤵
  PID:8484
- C:\Windows\System\iHUKLio.exe
  C:\Windows\System\iHUKLio.exe
  2⤵
  PID:8500
- C:\Windows\System\zKmqKyn.exe
  C:\Windows\System\zKmqKyn.exe
  2⤵
  PID:8516
- C:\Windows\System\oMGLhgG.exe
  C:\Windows\System\oMGLhgG.exe
  2⤵
  PID:8532
- C:\Windows\System\POSSlIA.exe
  C:\Windows\System\POSSlIA.exe
  2⤵
  PID:8548
- C:\Windows\System\FInSnAJ.exe
  C:\Windows\System\FInSnAJ.exe
  2⤵
  PID:8564
- C:\Windows\System\SnUfGKm.exe
  C:\Windows\System\SnUfGKm.exe
  2⤵
  PID:8580
- C:\Windows\System\gixPjYM.exe
  C:\Windows\System\gixPjYM.exe
  2⤵
  PID:8600
- C:\Windows\System\udvGPSM.exe
  C:\Windows\System\udvGPSM.exe
  2⤵
  PID:8616
- C:\Windows\System\CFHZFJY.exe
  C:\Windows\System\CFHZFJY.exe
  2⤵
  PID:8656
- C:\Windows\System\TkCAUnp.exe
  C:\Windows\System\TkCAUnp.exe
  2⤵
  PID:8672
- C:\Windows\System\orBERXp.exe
  C:\Windows\System\orBERXp.exe
  2⤵
  PID:8688
- C:\Windows\System\VplBYoU.exe
  C:\Windows\System\VplBYoU.exe
  2⤵
  PID:8704
- C:\Windows\System\vHAYeuL.exe
  C:\Windows\System\vHAYeuL.exe
  2⤵
  PID:8728
- C:\Windows\System\vwgXNyr.exe
  C:\Windows\System\vwgXNyr.exe
  2⤵
  PID:8744
- C:\Windows\System\tEeaxcv.exe
  C:\Windows\System\tEeaxcv.exe
  2⤵
  PID:8760
- C:\Windows\System\eejvGHo.exe
  C:\Windows\System\eejvGHo.exe
  2⤵
  PID:8776
- C:\Windows\System\zXxgcpP.exe
  C:\Windows\System\zXxgcpP.exe
  2⤵
  PID:8792
- C:\Windows\System\XMYYQTl.exe
  C:\Windows\System\XMYYQTl.exe
  2⤵
  PID:8808
- C:\Windows\System\xxQiwyT.exe
  C:\Windows\System\xxQiwyT.exe
  2⤵
  PID:8824
- C:\Windows\System\BvgTLAV.exe
  C:\Windows\System\BvgTLAV.exe
  2⤵
  PID:8840
- C:\Windows\System\ImojuPl.exe
  C:\Windows\System\ImojuPl.exe
  2⤵
  PID:8860
- C:\Windows\System\GojeGWI.exe
  C:\Windows\System\GojeGWI.exe
  2⤵
  PID:8876
- C:\Windows\System\yikEHnT.exe
  C:\Windows\System\yikEHnT.exe
  2⤵
  PID:8892
- C:\Windows\System\uyVoRVB.exe
  C:\Windows\System\uyVoRVB.exe
  2⤵
  PID:8908
- C:\Windows\System\spuRvov.exe
  C:\Windows\System\spuRvov.exe
  2⤵
  PID:8924
- C:\Windows\System\AIdRwSe.exe
  C:\Windows\System\AIdRwSe.exe
  2⤵
  PID:8940
- C:\Windows\System\oFkxDpZ.exe
  C:\Windows\System\oFkxDpZ.exe
  2⤵
  PID:8956
- C:\Windows\System\oLfLZJO.exe
  C:\Windows\System\oLfLZJO.exe
  2⤵
  PID:8972
- C:\Windows\System\tzmShWx.exe
  C:\Windows\System\tzmShWx.exe
  2⤵
  PID:8988
- C:\Windows\System\oRzqFeU.exe
  C:\Windows\System\oRzqFeU.exe
  2⤵
  PID:9004
- C:\Windows\System\DZHdTgq.exe
  C:\Windows\System\DZHdTgq.exe
  2⤵
  PID:9020
- C:\Windows\System\gBhPMVU.exe
  C:\Windows\System\gBhPMVU.exe
  2⤵
  PID:9036
- C:\Windows\System\EPkPaFV.exe
  C:\Windows\System\EPkPaFV.exe
  2⤵
  PID:9052
- C:\Windows\System\kmNZCtg.exe
  C:\Windows\System\kmNZCtg.exe
  2⤵
  PID:9068
- C:\Windows\System\GnPHZPB.exe
  C:\Windows\System\GnPHZPB.exe
  2⤵
  PID:9084
- C:\Windows\System\uKGkxmd.exe
  C:\Windows\System\uKGkxmd.exe
  2⤵
  PID:9100
- C:\Windows\System\dOBWfLs.exe
  C:\Windows\System\dOBWfLs.exe
  2⤵
  PID:9116
- C:\Windows\System\gPsfwuA.exe
  C:\Windows\System\gPsfwuA.exe
  2⤵
  PID:9132
- C:\Windows\System\pDfwSlU.exe
  C:\Windows\System\pDfwSlU.exe
  2⤵
  PID:9148
- C:\Windows\System\KnOcHsk.exe
  C:\Windows\System\KnOcHsk.exe
  2⤵
  PID:8256
- C:\Windows\System\qrSJwMM.exe
  C:\Windows\System\qrSJwMM.exe
  2⤵
  PID:8292
- C:\Windows\System\gAglDKZ.exe
  C:\Windows\System\gAglDKZ.exe
  2⤵
  PID:8316
- C:\Windows\System\uXvNiNs.exe
  C:\Windows\System\uXvNiNs.exe
  2⤵
  PID:8332
- C:\Windows\System\WNTtNTj.exe
  C:\Windows\System\WNTtNTj.exe
  2⤵
  PID:8352
- C:\Windows\System\QPghwEm.exe
  C:\Windows\System\QPghwEm.exe
  2⤵
  PID:8364
- C:\Windows\System\oBmxeDU.exe
  C:\Windows\System\oBmxeDU.exe
  2⤵
  PID:8404
- C:\Windows\System\KEeWKih.exe
  C:\Windows\System\KEeWKih.exe
  2⤵
  PID:8476
- C:\Windows\System\NTkamZI.exe
  C:\Windows\System\NTkamZI.exe
  2⤵
  PID:8424
- C:\Windows\System\dDcGJJj.exe
  C:\Windows\System\dDcGJJj.exe
  2⤵
  PID:8372
- C:\Windows\System\ohVNOJI.exe
  C:\Windows\System\ohVNOJI.exe
  2⤵
  PID:8480
- C:\Windows\System\ifZfqam.exe
  C:\Windows\System\ifZfqam.exe
  2⤵
  PID:8544
- C:\Windows\System\bwNiwPb.exe
  C:\Windows\System\bwNiwPb.exe
  2⤵
  PID:8524
- C:\Windows\System\Fivrouh.exe
  C:\Windows\System\Fivrouh.exe
  2⤵
  PID:8556
- C:\Windows\System\Wbovsak.exe
  C:\Windows\System\Wbovsak.exe
  2⤵
  PID:8636
- C:\Windows\System\DBkngUJ.exe
  C:\Windows\System\DBkngUJ.exe
  2⤵
  PID:8612
- C:\Windows\System\wNfyCFv.exe
  C:\Windows\System\wNfyCFv.exe
  2⤵
  PID:8700
- C:\Windows\System\VsHmXFQ.exe
  C:\Windows\System\VsHmXFQ.exe
  2⤵
  PID:8712
- C:\Windows\System\aCGjqIt.exe
  C:\Windows\System\aCGjqIt.exe
  2⤵
  PID:8740
- C:\Windows\System\TfEWbad.exe
  C:\Windows\System\TfEWbad.exe
  2⤵
  PID:8804
- C:\Windows\System\DyDwsVL.exe
  C:\Windows\System\DyDwsVL.exe
  2⤵
  PID:8872
- C:\Windows\System\XkIGOWl.exe
  C:\Windows\System\XkIGOWl.exe
  2⤵
  PID:8936
- C:\Windows\System\byuImhz.exe
  C:\Windows\System\byuImhz.exe
  2⤵
  PID:8964
- C:\Windows\System\XwYIlqK.exe
  C:\Windows\System\XwYIlqK.exe
  2⤵
  PID:9028
- C:\Windows\System\HsYnnye.exe
  C:\Windows\System\HsYnnye.exe
  2⤵
  PID:8752
- C:\Windows\System\DRaeOIV.exe
  C:\Windows\System\DRaeOIV.exe
  2⤵
  PID:8820
- C:\Windows\System\DMMbdeZ.exe
  C:\Windows\System\DMMbdeZ.exe
  2⤵
  PID:8920
- C:\Windows\System\hrPTgeQ.exe
  C:\Windows\System\hrPTgeQ.exe
  2⤵
  PID:8084
- C:\Windows\System\bVCaLQC.exe
  C:\Windows\System\bVCaLQC.exe
  2⤵
  PID:8080
- C:\Windows\System\caGndDi.exe
  C:\Windows\System\caGndDi.exe
  2⤵
  PID:8200
- C:\Windows\System\NwqgcFd.exe
  C:\Windows\System\NwqgcFd.exe
  2⤵
  PID:8252
- C:\Windows\System\IYdQTHE.exe
  C:\Windows\System\IYdQTHE.exe
  2⤵
  PID:8288
- C:\Windows\System\sqUMhVz.exe
  C:\Windows\System\sqUMhVz.exe
  2⤵
  PID:8324
- C:\Windows\System\HwYEpwE.exe
  C:\Windows\System\HwYEpwE.exe
  2⤵
  PID:8428
- C:\Windows\System\efUkEhL.exe
  C:\Windows\System\efUkEhL.exe
  2⤵
  PID:8628
- C:\Windows\System\QLGOdkM.exe
  C:\Windows\System\QLGOdkM.exe
  2⤵
  PID:8540
- C:\Windows\System\qAuqBhT.exe
  C:\Windows\System\qAuqBhT.exe
  2⤵
  PID:8528
- C:\Windows\System\RycCqLO.exe
  C:\Windows\System\RycCqLO.exe
  2⤵
  PID:8680
- C:\Windows\System\eaZRNjd.exe
  C:\Windows\System\eaZRNjd.exe
  2⤵
  PID:8884
- C:\Windows\System\XVYshgJ.exe
  C:\Windows\System\XVYshgJ.exe
  2⤵
  PID:8888
- C:\Windows\System\WSRglGY.exe
  C:\Windows\System\WSRglGY.exe
  2⤵
  PID:8996
- C:\Windows\System\uYnApsb.exe
  C:\Windows\System\uYnApsb.exe
  2⤵
  PID:8980
- C:\Windows\System\ZoEoEkx.exe
  C:\Windows\System\ZoEoEkx.exe
  2⤵
  PID:9016
- C:\Windows\System\nkaqzvi.exe
  C:\Windows\System\nkaqzvi.exe
  2⤵
  PID:9080
- C:\Windows\System\wmMzlWk.exe
  C:\Windows\System\wmMzlWk.exe
  2⤵
  PID:9164
- C:\Windows\System\KOILEXa.exe
  C:\Windows\System\KOILEXa.exe
  2⤵
  PID:9172
- C:\Windows\System\rCrwWDK.exe
  C:\Windows\System\rCrwWDK.exe
  2⤵
  PID:9184
- C:\Windows\System\TauHlDx.exe
  C:\Windows\System\TauHlDx.exe
  2⤵
  PID:9208
- C:\Windows\System\BotbyPH.exe
  C:\Windows\System\BotbyPH.exe
  2⤵
  PID:8236
- C:\Windows\System\PgkIaVn.exe
  C:\Windows\System\PgkIaVn.exe
  2⤵
  PID:7652
- C:\Windows\System\fUTqUMJ.exe
  C:\Windows\System\fUTqUMJ.exe
  2⤵
  PID:8396
- C:\Windows\System\fvvKOrx.exe
  C:\Windows\System\fvvKOrx.exe
  2⤵
  PID:8276
- C:\Windows\System\UzBeDua.exe
  C:\Windows\System\UzBeDua.exe
  2⤵
  PID:8608
- C:\Windows\System\jKwwRtp.exe
  C:\Windows\System\jKwwRtp.exe
  2⤵
  PID:8696
- C:\Windows\System\oidguAz.exe
  C:\Windows\System\oidguAz.exe
  2⤵
  PID:8724
- C:\Windows\System\xjWMbzl.exe
  C:\Windows\System\xjWMbzl.exe
  2⤵
  PID:8376
- C:\Windows\System\rboPzpV.exe
  C:\Windows\System\rboPzpV.exe
  2⤵
  PID:8852
- C:\Windows\System\veKsAfn.exe
  C:\Windows\System\veKsAfn.exe
  2⤵
  PID:9232
- C:\Windows\System\MCqpNUl.exe
  C:\Windows\System\MCqpNUl.exe
  2⤵
  PID:9248
- C:\Windows\System\uvxtkkl.exe
  C:\Windows\System\uvxtkkl.exe
  2⤵
  PID:9268
- C:\Windows\System\WvEScdG.exe
  C:\Windows\System\WvEScdG.exe
  2⤵
  PID:9284
- C:\Windows\System\lXfmLuE.exe
  C:\Windows\System\lXfmLuE.exe
  2⤵
  PID:9304
- C:\Windows\System\InBYvMP.exe
  C:\Windows\System\InBYvMP.exe
  2⤵
  PID:9324
- C:\Windows\System\lLNLuzS.exe
  C:\Windows\System\lLNLuzS.exe
  2⤵
  PID:9344
- C:\Windows\System\WFEIkoM.exe
  C:\Windows\System\WFEIkoM.exe
  2⤵
  PID:9360
- C:\Windows\System\NQZGouf.exe
  C:\Windows\System\NQZGouf.exe
  2⤵
  PID:9380
- C:\Windows\System\lrptRtb.exe
  C:\Windows\System\lrptRtb.exe
  2⤵
  PID:9396
- C:\Windows\System\DiPPzaC.exe
  C:\Windows\System\DiPPzaC.exe
  2⤵
  PID:9416
- C:\Windows\System\oEIosRT.exe
  C:\Windows\System\oEIosRT.exe
  2⤵
  PID:9436
- C:\Windows\System\szBVTLG.exe
  C:\Windows\System\szBVTLG.exe
  2⤵
  PID:9452
- C:\Windows\System\WoPhCNs.exe
  C:\Windows\System\WoPhCNs.exe
  2⤵
  PID:9472
- C:\Windows\System\xBAwwjc.exe
  C:\Windows\System\xBAwwjc.exe
  2⤵
  PID:9564
- C:\Windows\System\anifygY.exe
  C:\Windows\System\anifygY.exe
  2⤵
  PID:9680
- C:\Windows\System\CZxuFJk.exe
  C:\Windows\System\CZxuFJk.exe
  2⤵
  PID:9696
- C:\Windows\System\pcIHmdw.exe
  C:\Windows\System\pcIHmdw.exe
  2⤵
  PID:9712
- C:\Windows\System\enwhthn.exe
  C:\Windows\System\enwhthn.exe
  2⤵
  PID:9728
- C:\Windows\System\FJjFmpZ.exe
  C:\Windows\System\FJjFmpZ.exe
  2⤵
  PID:9744
- C:\Windows\System\vCSOUSO.exe
  C:\Windows\System\vCSOUSO.exe
  2⤵
  PID:9764
- C:\Windows\System\IMwdpDt.exe
  C:\Windows\System\IMwdpDt.exe
  2⤵
  PID:9784
- C:\Windows\System\vjkgabC.exe
  C:\Windows\System\vjkgabC.exe
  2⤵
  PID:9804
- C:\Windows\System\OdoLyeE.exe
  C:\Windows\System\OdoLyeE.exe
  2⤵
  PID:9824
- C:\Windows\System\opmcCdE.exe
  C:\Windows\System\opmcCdE.exe
  2⤵
  PID:9840
- C:\Windows\System\qSQMYqp.exe
  C:\Windows\System\qSQMYqp.exe
  2⤵
  PID:9856
- C:\Windows\System\ipNbswE.exe
  C:\Windows\System\ipNbswE.exe
  2⤵
  PID:9876
- C:\Windows\System\ROdjPTw.exe
  C:\Windows\System\ROdjPTw.exe
  2⤵
  PID:9892
- C:\Windows\System\zETeibj.exe
  C:\Windows\System\zETeibj.exe
  2⤵
  PID:9908
- C:\Windows\System\JNpvelM.exe
  C:\Windows\System\JNpvelM.exe
  2⤵
  PID:9928
- C:\Windows\System\OqfsrLi.exe
  C:\Windows\System\OqfsrLi.exe
  2⤵
  PID:9948
- C:\Windows\System\LmGnrau.exe
  C:\Windows\System\LmGnrau.exe
  2⤵
  PID:9964
- C:\Windows\System\gQcAusL.exe
  C:\Windows\System\gQcAusL.exe
  2⤵
  PID:9980
- C:\Windows\System\qzOyQcM.exe
  C:\Windows\System\qzOyQcM.exe
  2⤵
  PID:9996
- C:\Windows\System\HEqrZFV.exe
  C:\Windows\System\HEqrZFV.exe
  2⤵
  PID:10012
- C:\Windows\System\WJWjzzu.exe
  C:\Windows\System\WJWjzzu.exe
  2⤵
  PID:10052
- C:\Windows\System\Qqbrzar.exe
  C:\Windows\System\Qqbrzar.exe
  2⤵
  PID:10068
- C:\Windows\System\ycqVtgc.exe
  C:\Windows\System\ycqVtgc.exe
  2⤵
  PID:10084
- C:\Windows\System\LSsRsVh.exe
  C:\Windows\System\LSsRsVh.exe
  2⤵
  PID:10144
- C:\Windows\System\lJGsSPV.exe
  C:\Windows\System\lJGsSPV.exe
  2⤵
  PID:10160
- C:\Windows\System\uGdkxCZ.exe
  C:\Windows\System\uGdkxCZ.exe
  2⤵
  PID:10176
- C:\Windows\System\wyJZwBe.exe
  C:\Windows\System\wyJZwBe.exe
  2⤵
  PID:10196
- C:\Windows\System\ZpyPPpW.exe
  C:\Windows\System\ZpyPPpW.exe
  2⤵
  PID:10236
- C:\Windows\System\NsGxLwc.exe
  C:\Windows\System\NsGxLwc.exe
  2⤵
  PID:9012
- C:\Windows\System\vXXzIgH.exe
  C:\Windows\System\vXXzIgH.exe
  2⤵
  PID:9140
- C:\Windows\System\WCMmIXG.exe
  C:\Windows\System\WCMmIXG.exe
  2⤵
  PID:8224
- C:\Windows\System\QfhPRyp.exe
  C:\Windows\System\QfhPRyp.exe
  2⤵
  PID:9240
- C:\Windows\System\vkxgDCc.exe
  C:\Windows\System\vkxgDCc.exe
  2⤵
  PID:9312
- C:\Windows\System\MuLhklx.exe
  C:\Windows\System\MuLhklx.exe
  2⤵
  PID:9244
- C:\Windows\System\wRYwMmH.exe
  C:\Windows\System\wRYwMmH.exe
  2⤵
  PID:9352
- C:\Windows\System\RkGmqTl.exe
  C:\Windows\System\RkGmqTl.exe
  2⤵
  PID:9392
- C:\Windows\System\iGnIYPs.exe
  C:\Windows\System\iGnIYPs.exe
  2⤵
  PID:9064
- C:\Windows\System\dJtltfU.exe
  C:\Windows\System\dJtltfU.exe
  2⤵
  PID:9224
- C:\Windows\System\YuSakFb.exe
  C:\Windows\System\YuSakFb.exe
  2⤵
  PID:9428
- C:\Windows\System\nqPfbRQ.exe
  C:\Windows\System\nqPfbRQ.exe
  2⤵
  PID:9468
- C:\Windows\System\ZQneVKJ.exe
  C:\Windows\System\ZQneVKJ.exe
  2⤵
  PID:9332
- C:\Windows\System\gHxZmtp.exe
  C:\Windows\System\gHxZmtp.exe
  2⤵
  PID:9448
- C:\Windows\System\cAuAEPx.exe
  C:\Windows\System\cAuAEPx.exe
  2⤵
  PID:9500
- C:\Windows\System\jUmicNQ.exe
  C:\Windows\System\jUmicNQ.exe
  2⤵
  PID:9480
- C:\Windows\System\vsHyNNF.exe
  C:\Windows\System\vsHyNNF.exe
  2⤵
  PID:9496
- C:\Windows\System\VOQBIAJ.exe
  C:\Windows\System\VOQBIAJ.exe
  2⤵
  PID:9520
- C:\Windows\System\kqZldrq.exe
  C:\Windows\System\kqZldrq.exe
  2⤵
  PID:9552
- C:\Windows\System\xGYsfBW.exe
  C:\Windows\System\xGYsfBW.exe
  2⤵
  PID:9572
- C:\Windows\System\LMNCweG.exe
  C:\Windows\System\LMNCweG.exe
  2⤵
  PID:9592
- C:\Windows\System\hokPqUi.exe
  C:\Windows\System\hokPqUi.exe
  2⤵
  PID:9608
- C:\Windows\System\iPFSlGb.exe
  C:\Windows\System\iPFSlGb.exe
  2⤵
  PID:9624
- C:\Windows\System\aJozhtU.exe
  C:\Windows\System\aJozhtU.exe
  2⤵
  PID:9644
- C:\Windows\System\cdmiAqp.exe
  C:\Windows\System\cdmiAqp.exe
  2⤵
  PID:9660
- C:\Windows\System\tfjOGph.exe
  C:\Windows\System\tfjOGph.exe
  2⤵
  PID:9676
- C:\Windows\System\JyTYdnN.exe
  C:\Windows\System\JyTYdnN.exe
  2⤵
  PID:9724
- C:\Windows\System\zryzvAq.exe
  C:\Windows\System\zryzvAq.exe
  2⤵
  PID:9688
- C:\Windows\System\yVTCoJI.exe
  C:\Windows\System\yVTCoJI.exe
  2⤵
  PID:9920
- C:\Windows\System\sQUdRyj.exe
  C:\Windows\System\sQUdRyj.exe
  2⤵
  PID:8416
- C:\Windows\System\ELOroeH.exe
  C:\Windows\System\ELOroeH.exe
  2⤵
  PID:9836
- C:\Windows\System\vHGYrLk.exe
  C:\Windows\System\vHGYrLk.exe
  2⤵
  PID:9900
- C:\Windows\System\EXwDQhl.exe
  C:\Windows\System\EXwDQhl.exe
  2⤵
  PID:9796
- C:\Windows\System\pyUvorq.exe
  C:\Windows\System\pyUvorq.exe
  2⤵
  PID:10020
- C:\Windows\System\AxqMAwr.exe
  C:\Windows\System\AxqMAwr.exe
  2⤵
  PID:10040
- C:\Windows\System\jeZYbKw.exe
  C:\Windows\System\jeZYbKw.exe
  2⤵
  PID:10080
- C:\Windows\System\jMkzBQk.exe
  C:\Windows\System\jMkzBQk.exe
  2⤵
  PID:10136
- C:\Windows\System\ZWSoxwe.exe
  C:\Windows\System\ZWSoxwe.exe
  2⤵
  PID:10092
- C:\Windows\System\kjBzPLM.exe
  C:\Windows\System\kjBzPLM.exe
  2⤵
  PID:10108
- C:\Windows\System\TgIyKvk.exe
  C:\Windows\System\TgIyKvk.exe
  2⤵
  PID:10184
- C:\Windows\System\CXNNBsN.exe
  C:\Windows\System\CXNNBsN.exe
  2⤵
  PID:10204
- C:\Windows\System\fAOhnOL.exe
  C:\Windows\System\fAOhnOL.exe
  2⤵
  PID:9940
- C:\Windows\System\pvBikhj.exe
  C:\Windows\System\pvBikhj.exe
  2⤵
  PID:9180
- C:\Windows\System\uVvOAEY.exe
  C:\Windows\System\uVvOAEY.exe
  2⤵
  PID:9280
- C:\Windows\System\MKfXAvb.exe
  C:\Windows\System\MKfXAvb.exe
  2⤵
  PID:9320
- C:\Windows\System\EOhDKgc.exe
  C:\Windows\System\EOhDKgc.exe
  2⤵
  PID:7756
- C:\Windows\System\VuCLDrW.exe
  C:\Windows\System\VuCLDrW.exe
  2⤵
  PID:9092
- C:\Windows\System\eFPaLaX.exe
  C:\Windows\System\eFPaLaX.exe
  2⤵
  PID:9160
- C:\Windows\System\lbGkvfw.exe
  C:\Windows\System\lbGkvfw.exe
  2⤵
  PID:8240
- C:\Windows\System\kFTgwsN.exe
  C:\Windows\System\kFTgwsN.exe
  2⤵
  PID:8340
- C:\Windows\System\jFxysOR.exe
  C:\Windows\System\jFxysOR.exe
  2⤵
  PID:9368
- C:\Windows\System\npddCJD.exe
  C:\Windows\System\npddCJD.exe
  2⤵
  PID:9492
- C:\Windows\System\DuFtuTr.exe
  C:\Windows\System\DuFtuTr.exe
  2⤵
  PID:9528
- C:\Windows\System\qPlHjin.exe
  C:\Windows\System\qPlHjin.exe
  2⤵
  PID:9464
- C:\Windows\System\AOAZsRq.exe
  C:\Windows\System\AOAZsRq.exe
  2⤵
  PID:9512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CSOykZo.exe

Filesize
1.3MB

MD5
2e82ef02e76ae095205ae6570b094020

SHA1
b0683cd04e139459ec2cf8ff0c3a826d210df229

SHA256
b7ac6b299a4eed0c8ec6ef8f1347b0f2a7137beefaf92bb43dfbd44ac07246fa

SHA512
8b1288bfc7cb90634f369d1dc6ec092044e1b1704f0e31b4e4ee0621b97f01694b16c1d7b8e413e4e4770c187a258906f3bb57cf6813669dc77d5756d6fc013d

Download Submit
C:\Windows\system\DLTcVQz.exe

Filesize
1.3MB

MD5
5326d784e2ebb7b440e131248796ce9d

SHA1
5e4f663eb49c960fb3ad79a713f57a4de7c81d68

SHA256
10c4dde8724e2a67034ebe8596001965ad2866cbbdb2a1afc43d4ad70f4ce4dc

SHA512
2fc17678e933e8f738aec9d9295f3fe2397bc056711fa7d693f528be5eb7c89d2929a1f05a7a6e2219862288c2e7ecbf88bffda4368ddfcfc67a1f3f43af2bd2

Download Submit
C:\Windows\system\OfvLZmF.exe

Filesize
1.3MB

MD5
5a5075701faf2d12fdd7ea554ab63bb5

SHA1
1a836e64f276fb096b09baa829762caa995b0c1d

SHA256
3bd05f82b1d8e229ca0b751d07ee826cbabbe84b836c9964dbf3dcedf29e0605

SHA512
34ffed4b34170053ec4d14911b07d3f3e2eb623f4d294b891c2ce717c674170780023af67d6db5b4e6c719c566292daab33974752c9ecdef72e6ad13747665d8

Download Submit
C:\Windows\system\OwOXnOE.exe

Filesize
1.3MB

MD5
76fa81b15ae7187be5eba319780161f8

SHA1
1645c844bb624b7ee71815ad86b870a7c789fcfb

SHA256
24a6c3a31d7ac0ce2993c7dc1aa36e225afcfd4cfb0a2608dffa089f6a3b99ff

SHA512
18d46bbec0ebf18656f94de1c99af0087584a9985517e4fc8fe9e7a6b4848d1e2494722cefe090763264f2f7899a40ee292148d9c8a973370be0234862fcd511

Download Submit
C:\Windows\system\ZJzBAxR.exe

Filesize
1.3MB

MD5
c000f2d97770954160250e0d3d4969b2

SHA1
bdaec2805a00263f5162d781e7b1469e8632aefc

SHA256
a894d5184caa712e4b973ca63a848ad147a476b3c7638faf73d18c45d0934e17

SHA512
82ba63e4c43e19ceb44c6b927e3a7469977a1270d0a827b1b23dc9c9bf0ee8c1f4e8109536b31a8ef42d6ffcfd923d64e7053bb4ae5bfdfb2cc2ec590610d1cf

Download Submit
C:\Windows\system\aAavkQK.exe

Filesize
1.3MB

MD5
0d49c94ee18b70e680197dffc444b24d

SHA1
d77d1ce1273e75c5d8235d6045530dd21c1ab442

SHA256
c6a87ae93f10fb16df7687a3ce819fe919f2cf77c7681176b22444c30c44b34e

SHA512
6b80f82414e19e46b1cfc6ae0cad8814a8a473b29e6d5892178eee2375ecbf424a745df7fa10caaaa9c9a5bd3cdd4dcdf82e9306aaf82f856e0cb01b7a8cecc6

Download Submit
C:\Windows\system\gMZzCMW.exe

Filesize
1.3MB

MD5
cd76023eb87eb1c88a8323758a210da2

SHA1
9bd3157b4ce98679330f483d79236531032a0793

SHA256
7694aaa5417b305a9836ad6d3c457ecbcab6a3fb26196da3d94b64c21044d0e2

SHA512
fdd8281597bd4943f23ce8bd821bb66d02b92436bc99d18a910a9935996fde08e8df144c12a1267cf7954537cc00047ff01d91f9d5ea820e6d72919c48202ccb

Download Submit
C:\Windows\system\hPHEyJF.exe

Filesize
1.3MB

MD5
fb595adfb9e9cda45238337d0a9c1928

SHA1
afc70efdb2fe05b500e3cd16f67534eb1cde2a4c

SHA256
b29bc12d12915b89a488690597fa5c3561fbc2451dab57a3467b018454d2f2c1

SHA512
e16e457d866c684d8b66741c730b09966c23854f1eb0c659f48d13766d02cd7663942c723fa1e51b6c03cbbe7c6ec41ecf00a9fa6f50ce2d80a335e47b9e24f1

Download Submit
C:\Windows\system\hVFWknB.exe

Filesize
1.3MB

MD5
1dc448676960b6ca9eb87fa97e55d6a7

SHA1
c267b312dcd01962c913e71e6125dea0be15e4e2

SHA256
b84a259095697fa16a6694a5b7d3cf2fa7e40a007273722274755150bfbbba92

SHA512
9225377f6adb88ff98a3ef3dc115e08dd6527638ae42217ed8beef7b7aec46d488733019a6335a308fcfd4ed0909f6ebb5fab10af0b039f48fbd796880dfc935

Download Submit
C:\Windows\system\kJLnqGQ.exe

Filesize
1.3MB

MD5
0e860d1a7a28d45b1a116bb055d3173a

SHA1
48b1b938459b072237b45869569973bcf3d7b681

SHA256
bb6c23441db0dc494ba9a115cb86e2e8940870af15368e47187f0c14bbd6935d

SHA512
820761eec3f20aea6766bad95e5d94539baebcda51895c12b7a9ae20ed3f4f601b804422334e28da3fb706dc1c4e69c5bea8332d32381d9ca271af9b048ecb23

Download Submit
C:\Windows\system\kgNtKZO.exe

Filesize
1.3MB

MD5
9958bb45595060350a67a126ad435dc2

SHA1
77aec9579c5f86c06329dec4c92a594498f925c8

SHA256
20d21ffbc64aa810f02c7856e8605d4f0ba3d46ecc96b367ed564a61245ee4cb

SHA512
a4f59a41b96cbca736e2105372a212cedddbc3507704bd2b3ffcf45e2fba142e571ebb1574847246a280bc7d3aad8ea32c45263a5a9f5be0c21f0a6ab7767bd0

Download Submit
C:\Windows\system\mMMIDIy.exe

Filesize
1.3MB

MD5
9f522e4be6ad2cb4c765fdf0a1f83494

SHA1
86ae8b3d580b6dd0f706c8f7fbe6a54e93bd4cb5

SHA256
67fb0a3c8a4ad6cabc934ba56a78cda4670c3ae6a4674ec419132fbb826239d1

SHA512
599824843d9f41832a4eae6216c1732f1903c38f8a5499278994ec9c689c04806f194ece6e58245b38250449e9e6366ec64f1fdc87d0ecd82b28118a853cc97a

Download Submit
C:\Windows\system\oZXPpDi.exe

Filesize
1.3MB

MD5
40a2fa9e855779a9b37d1fd0e6472c03

SHA1
6e495709ba37f8a59f09c0e55536e78c2f38c63e

SHA256
8b97c7553f4b970fd82a20baa308da9a2ef8fb964690998332eb96fd4ea2a81c

SHA512
1a138a12d36741f0446b6c91256e412864a606dd6e3739e60e6cb01739e2c579579368aa7b54e82c9781e17f641b685fc7099ee800ef08dd07f4df2d11242efa

Download Submit
C:\Windows\system\ptIMtiZ.exe

Filesize
1.3MB

MD5
764d95e122cce15e4f7c489602571734

SHA1
b306c64ef75caaee939c2d17a1770382b72b1008

SHA256
d48766fedc55d7d3c44330e4b0fd0a2566da23ae546e460b4108bb6f0e5ef27f

SHA512
5fc86a20f00d1cbd98a4a10370f035919793ddc81f1d2187d061dadc429d3147492710e9c91650fd12dccde578b6da1898bb41a8db6c286e5e20686c4592e8de

Download Submit
C:\Windows\system\qVlyxyg.exe

Filesize
1.3MB

MD5
f19535e3be176b2a5b1483afee032e94

SHA1
4ab2183c7098ec51aa053f0931c2bd88a4c775d6

SHA256
be2285f310aa18c95159d6c16217789964c252f366b8f53de27cdec00110106c

SHA512
fcf361b611c8cec11574500f4776a8f6afb34799365ea629bee57ec240e97024fdd007f69bd38032a54af9271b47edc8b17e23fda8f77703066910e6276a91b8

Download Submit
C:\Windows\system\szqukUZ.exe

Filesize
1.3MB

MD5
57d9253741a261263783c7a710b907a9

SHA1
dc8b3bc47c067b2da53bebef5d97253294bdeadf

SHA256
95471e913e29be8c87159a150490ef1ada7a3a89c60b7e6e127f51eae4ab29ad

SHA512
dec8fc072c3f6c8d62caac3b04c3f93fc7531ffce971dc83c828d0cae800fe080b1373a5cbb6fc664363b2a75f92ba28edb7b47986f57f5f657152528a26f406

Download Submit
C:\Windows\system\tTuShMK.exe

Filesize
1.3MB

MD5
c24810d3103c4b9f4ecc32dfec82f47b

SHA1
58c1e0077b86d8588e8885665f3331c578ab1a9d

SHA256
7e437dc6fad722bd4fde598715905156ac34df8a051443f2495b91a49fdc2110

SHA512
1cbd8838e4a0fa6e598b5d09ddec6d56a337f790501c5dc6215040946756235a088efa8aab438ff6858e4c0814d29d58b46443cb8deb9eb65a197472663a64b3

Download Submit
C:\Windows\system\tcGtbPX.exe

Filesize
1.3MB

MD5
af755c6e570ffc4e6731c6174b5b02d8

SHA1
6a442623699e1558e2373350b0867a74fcad6697

SHA256
1393463da54f52dbfd3a935096c05853592a7218da7472fd8186cce9774a82a2

SHA512
6216a448417540b9cf8ef6714ecc61785ee81ba3885c4abbea30b6c83b1daad569e0a033611dcdf015a3f326339315972630dd21ba167af515fdb8baa1579201

Download Submit
C:\Windows\system\tpgDmAD.exe

Filesize
1.3MB

MD5
0db4e57cfb924b22467cdfd09caf7121

SHA1
2cdc1877346888731937d56ebc23d5ce7a7627de

SHA256
081370ea53e14c720484cba9c59cd69f4c6a82686f79f1357b7c0f0d6d36f9db

SHA512
62939b47125eb745cc0492d32ca07dd12509463d82714cf4522c86c743f270b07312a31f6af04f0f4ee551d98c683d9015d8d7dab7fe9f5ed3e0bce3dc673e56

Download Submit
C:\Windows\system\wanEGHw.exe

Filesize
1.3MB

MD5
e069cd964e34f420ee95f1d30abfe414

SHA1
425ce8300bdbca8c9c3a7cb743a74fc22315e9ce

SHA256
c1cf3b8be3bffaa0709581703d43a9423b990c0f9dbc8e03443e0978a9dfc328

SHA512
165afe1a58a8367d910953587bc55e05e58d6970a38f7f7e36ae3e6a6194cb559be505cb5a51d3899f54ba54ee9ac66fe5c9c30cceae8ed1fbd58b126f49655a

Download Submit
C:\Windows\system\xgcDEKL.exe

Filesize
1.3MB

MD5
d2cfe552882b07487aeeea53b12a257b

SHA1
20c59549aedf25aa88ce11a043041f531acac95e

SHA256
aa35d739293487d11ac63f7ce623e3f0ad373ac1154c1b219e1b82be6113e5ed

SHA512
a7f0d13c454e01ea6b1263313afe6262ae69b99fcd52f50f6b71d7bbf39d510411d7e6049fcbe7f5f4ba8aea1c64f90c07384be4b38bb772f6b1e48444bf4359

Download Submit
C:\Windows\system\ysyHpCL.exe

Filesize
1.3MB

MD5
caa9d4466849d20a52bb18e9d6e7cb04

SHA1
e1b8105633445b1002fc52a3a1571859e883b91c

SHA256
51ea74bef3deb009e0ede82a63568909b0ae9a57fcf67937230c4320ce61c5de

SHA512
9cef0ed1010accb4cbf9279014c69990774f212baecd4f692c781cfd1a1cf04ed93b05f39229c06d367d201312e82f5852ca19d1376afa7b6426bee1fef1e17a

Download Submit
C:\Windows\system\zuFfiCx.exe

Filesize
1.3MB

MD5
67637d3b963b6843fe80cf587ea9e537

SHA1
4757db328c93c6de35051fe2de1e592109834b2a

SHA256
c99020b4698d6e95ec74889c1e33c5110f5bedc98b70722cd4c13cba924f4311

SHA512
40a51ea8acc250785b48151392cd03d7a619a88864a52166cff7757810bbcf3656844ae85a997135f38dd5e41a8ad9f54da70a5b5204c93960a02528eec62b81

Download Submit
\Windows\system\CCdBmLx.exe

Filesize
1.3MB

MD5
ea999f2b6e7fd5707ca5006b98f34020

SHA1
1ca4b5aa122d34cae7ceae2a708da8d90023a810

SHA256
a0f49c310b68aabd2463bbe8ce01968431acb9e83fd20508d57f4eabc4ca6f3a

SHA512
153f84c70a68f6a2692ad7ffa02a4ad67e0df38a9c5d733facb1521a261208dab8b74713c5c1716dc5f6f19af57baf40fb5114ca8d2eccfa29bef13e10bd286a

Download Submit
\Windows\system\CLgyqRE.exe

Filesize
1.3MB

MD5
ac008eb4ae05d19df71166c9d8bed21b

SHA1
621b311590c27359eac58f7e1e36c72a020967a0

SHA256
34373d23c9452725aab94b3ccaaa9f37e3258974ede4d1a3c53b8a30b4129f73

SHA512
10f0833fbf9c595e3ecad78d22bb582405f2a518d3d282ed506c5c06bd69841acd90eee01e564030ea2e5a920d3ae6f90adf7c581529793e3a8d405a5ebd1fd0

Download Submit
\Windows\system\FURexmv.exe

Filesize
1.3MB

MD5
a6c255a259036bb81432e313fa7cb9c7

SHA1
cc51b5458de5dab58744ef44d3ef3d5363a0d376

SHA256
a329b1c4eaa63c9f7aaa25a2874f57fc41ec5566579e2ccfd76939bcecadb45c

SHA512
35a9bd670d3d185ff715d1c8800da66981748f268edc240fe8f5f785e138585db9df8a861e3b50a3df6b62058cd0d19242cdbac5395b08fa3d90d12910da1c0b

Download Submit
\Windows\system\VYgErzP.exe

Filesize
1.3MB

MD5
5ece3e3f963ca91e46d46ed56f330824

SHA1
4bf08809fe74b538eb1d4b5b70c546e8fb33736e

SHA256
a3da691321c608e544fb31f182245793d2189ecfdbd0001afaac23755e1a5a18

SHA512
807ab3c06e72d9aeebc08b53d04ebd250ce8b6eeac1eda0abb02c24c50dd1defad78df31fa4f1b9d88d57c1c12312eb467abc81effa55ccc30b35c1a98c152bc

Download Submit
\Windows\system\hGajNjY.exe

Filesize
1.3MB

MD5
65371c18666737b3fd9604367bbd6d7f

SHA1
c976d124eee2238df196d7b7a08f144c36a4dde8

SHA256
ebd9919c347f504dad30801523c1709a45336a73e9cdb5d491012a2a23ffec87

SHA512
5f15040e82a5e02c9cf579d64a3a7994ef2b222a358b79bbb4c2d64ac9116ec40918c4ddbcdf88498bf25a72bdf261db7f8929b57cf98fc1cfd19671099de735

Download Submit
\Windows\system\lpVILdF.exe

Filesize
1.3MB

MD5
e97ca207776d3ad29d7088c26c6aa909

SHA1
803d83c28f6ac8166db71518ac9465cb02b6e74d

SHA256
c09abf5e816e1accb3f0bb9a5017bc0d9561fbea1e09c32e27e4f79f5773d5ab

SHA512
6932a3b93848f6d417d1293efb24a5adb5511e7ad368cbfcd15ab07a2e5613e0cc9d18e0279477909ffd3231dbbc4ff09b8cdc97e2bf2975cd861332f6b5e792

Download Submit
\Windows\system\oMXDHZI.exe

Filesize
1.3MB

MD5
8b1504987e69fd17cad60abd2c9c71ff

SHA1
5827b76d4c987f4536041f72c91c603b716de677

SHA256
3eb640f8db6fb2f258ba334b41de5a8fd8374971439299cb0e8af3b188660740

SHA512
cd541dc15825098bcb66d6b3c934223b89388c9918cfafd4b4d21b832c807255ff54f71dec0da9949726383ae046f2f140d77e91b1121fc68ec9d0dbfc6d2b2a

Download Submit
\Windows\system\rPFSzpY.exe

Filesize
1.3MB

MD5
21042b5fba6d854b42282d07e6a9d640

SHA1
5a203d5b2edead27f47884a5f1fef4bcf2173dd2

SHA256
c850902606e59966a353af7ed7e7b840b5a073222aed7dabd75e75499ddf18e6

SHA512
330eeb69a692e8ac8c6fdf047ef2f0193abf68412b0dfbf03739f64837a6d264eaa25ea70ba824925ca32009403e28338331eb82631a6c9f7be5f414261782eb

Download Submit
\Windows\system\sjEyzAT.exe

Filesize
1.3MB

MD5
e476fe0ed765751c7517cc9dd89a759b

SHA1
3d6ad7e438f2fe77615ecff758e754ef1cfd65e3

SHA256
5fa5620b6b3483e55bb992f109715918b7e71565b7372cae0fe33dc9d9a610aa

SHA512
bd5a53af524438e68d8d401dba6617be22011f90c8ad8f8a658e3abe35d46bd55e2c0e24eab4b858849397d23d3a1dce07a7fc7a3e797541bfa717ca27b007df

Download Submit
\Windows\system\uWGAvpi.exe

Filesize
1.3MB

MD5
3bd23cacafef71ef3b406a21d7fb3995

SHA1
9dfae99c637c772ffbaf1f3adcd5d14770a1282c

SHA256
1ed596c093c48881f98da6633c5d2beca2e583fe03e4f2cdfbe971d3839c0634

SHA512
e0b7891111068205149e864973c045e16ab5cb678b2179d1c1457045d540381944f010a2f08855a8cb006cdf64fca680c21ea5a207ed1d3d4afef1cd0ef1f658

Download Submit
memory/856-97-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/856-4039-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/1620-60-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/1620-47-0x000000013F500000-0x000000013F851000-memory.dmp

Filesize
3.3MB

Download
memory/1620-68-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download
memory/1620-101-0x000000013FF80000-0x00000001402D1000-memory.dmp

Filesize
3.3MB

Download
memory/1620-96-0x000000013F850000-0x000000013FBA1000-memory.dmp

Filesize
3.3MB

Download
memory/1620-100-0x000000013F110000-0x000000013F461000-memory.dmp

Filesize
3.3MB

Download
memory/1620-3095-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/1620-0-0x000000013F110000-0x000000013F461000-memory.dmp

Filesize
3.3MB

Download
memory/1620-2133-0x0000000001E20000-0x0000000002171000-memory.dmp

Filesize
3.3MB

Download
memory/1620-46-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/1620-25-0x000000013F710000-0x000000013FA61000-memory.dmp

Filesize
3.3MB

Download
memory/1620-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1620-42-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/1620-8-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/1620-99-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2308-92-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2308-4109-0x000000013F3B0000-0x000000013F701000-memory.dmp

Filesize
3.3MB

Download
memory/2368-98-0x000000013FF80000-0x00000001402D1000-memory.dmp

Filesize
3.3MB

Download
memory/2368-4083-0x000000013FF80000-0x00000001402D1000-memory.dmp

Filesize
3.3MB

Download
memory/2376-62-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2376-4001-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2488-14-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2488-4024-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2488-1163-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2512-48-0x000000013F500000-0x000000013F851000-memory.dmp

Filesize
3.3MB

Download
memory/2512-3961-0x000000013F500000-0x000000013F851000-memory.dmp

Filesize
3.3MB

Download
memory/2540-44-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2540-3943-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2552-3986-0x000000013FBE0000-0x000000013FF31000-memory.dmp

Filesize
3.3MB

Download
memory/2552-59-0x000000013FBE0000-0x000000013FF31000-memory.dmp

Filesize
3.3MB

Download
memory/2568-12-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2568-3958-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2596-3963-0x000000013F710000-0x000000013FA61000-memory.dmp

Filesize
3.3MB

Download
memory/2596-33-0x000000013F710000-0x000000013FA61000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4082-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2652-102-0x000000013FD10000-0x0000000140061000-memory.dmp

Filesize
3.3MB

Download
memory/2764-49-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2764-4108-0x000000013F8D0000-0x000000013FC21000-memory.dmp

Filesize
3.3MB

Download
memory/2800-3948-0x000000013F700000-0x000000013FA51000-memory.dmp

Filesize
3.3MB

Download
memory/2800-41-0x000000013F700000-0x000000013FA51000-memory.dmp

Filesize
3.3MB

Download
memory/2872-4030-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download
memory/2872-69-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download