xmrig | dea043105621c312415aa7191462d39d8a9f1e3e77ddc090e00770d9ee5cdabf

Analysis

max time kernel
140s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
Size

1.6MB
MD5

d7acac2806f107d6d90bb8e97dd445b0
SHA1

1c16af2a5802e330657a413b318f3e243f82a677
SHA256

dea043105621c312415aa7191462d39d8a9f1e3e77ddc090e00770d9ee5cdabf
SHA512

6d179bbdc3219be41506e683ce8027425f5d25df0482f87cd8b66a66ce034ea25c8d3760609785200913a8fbe801ce770c17ebf407e3ee1e833afc9f338b5e57
SSDEEP

49152:ROdWCCi7/raZ5aIwC+Aj4kVvNWp6IWqDE:RWWBib2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2056-20-0x000000013F710000-0x000000013FA61000-memory.dmp	xmrig
behavioral1/memory/2556-60-0x000000013FEA0000-0x00000001401F1000-memory.dmp	xmrig
behavioral1/memory/2672-64-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig
behavioral1/memory/2636-72-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2668-65-0x000000013F590000-0x000000013F8E1000-memory.dmp	xmrig
behavioral1/memory/2560-63-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2824-61-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2884-58-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2056-1359-0x000000013F710000-0x000000013FA61000-memory.dmp	xmrig
behavioral1/memory/2824-1357-0x000000013F810000-0x000000013FB61000-memory.dmp	xmrig
behavioral1/memory/2404-88-0x000000013FEB0000-0x0000000140201000-memory.dmp	xmrig
behavioral1/memory/2336-99-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2872-52-0x000000013FB70000-0x000000013FEC1000-memory.dmp	xmrig
behavioral1/memory/1504-34-0x000000013F5B0000-0x000000013F901000-memory.dmp	xmrig
behavioral1/memory/2204-46-0x000000013FF00000-0x0000000140251000-memory.dmp	xmrig
behavioral1/memory/2804-2586-0x000000013FC30000-0x000000013FF81000-memory.dmp	xmrig
behavioral1/memory/2176-3122-0x000000013F6F0000-0x000000013FA41000-memory.dmp	xmrig
behavioral1/memory/1504-4197-0x000000013F5B0000-0x000000013F901000-memory.dmp	xmrig
behavioral1/memory/2556-4207-0x000000013FEA0000-0x00000001401F1000-memory.dmp	xmrig
behavioral1/memory/2884-4210-0x000000013FDE0000-0x0000000140131000-memory.dmp	xmrig
behavioral1/memory/2672-4214-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig
behavioral1/memory/2560-4211-0x000000013FEC0000-0x0000000140211000-memory.dmp	xmrig
behavioral1/memory/2636-4215-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2668-4217-0x000000013F590000-0x000000013F8E1000-memory.dmp	xmrig
behavioral1/memory/2804-4219-0x000000013FC30000-0x000000013FF81000-memory.dmp	xmrig
behavioral1/memory/2404-4221-0x000000013FEB0000-0x0000000140201000-memory.dmp	xmrig
behavioral1/memory/2336-4223-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2176-4225-0x000000013F6F0000-0x000000013FA41000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2056	yYuTPzm.exe
1504	WyYzoee.exe
2204	EIouVdq.exe
2872	huqsYwQ.exe
2884	ZmRYxUu.exe
2556	kXpwtRs.exe
2560	GzpLNbV.exe
2672	VozxGgk.exe
2636	VdYLAtr.exe
2668	TmjXKJL.exe
2804	AmlPsLs.exe
2404	eQFvWig.exe
2176	jEyhbdc.exe
2336	qtrWrzF.exe
2136	PsXxzav.exe
1808	fYgeKqB.exe
2024	MYSlvXK.exe
2032	guBnmjD.exe
2320	PsGwTpa.exe
776	RZqNGYM.exe
320	zQrtAkt.exe
1596	kVJzsqA.exe
1584	sAGeXCy.exe
3028	eLyCijZ.exe
892	gqVAzbv.exe
3068	nihjIDx.exe
324	fRDYAjG.exe
716	tHIQCId.exe
1424	BWobsBV.exe
1420	iqFvJIB.exe
328	YHBCTyX.exe
2380	dXYyvmS.exe
272	PhbGSPl.exe
2052	oWmMugs.exe
452	wSEabZz.exe
1204	AUvScZs.exe
2248	bTJmmgG.exe
2360	ohoccia.exe
1904	rcZvHXI.exe
1380	MFClKVy.exe
1556	BEOlqlR.exe
1888	EgoooAg.exe
1876	jZYmANn.exe
1864	kojcYMX.exe
1576	fNTvMOs.exe
3016	wAKHZrz.exe
3064	YhcpvLY.exe
2252	fXneYsL.exe
1612	taSXeIe.exe
3004	NDJHolk.exe
2108	EivbXfm.exe
2076	tBldxFM.exe
1224	zuOhDDu.exe
1748	jtHFfLm.exe
1472	RUdddWm.exe
2228	PhlgwWO.exe
1540	OYbLLbP.exe
1548	TiclGVJ.exe
1336	HRUpatp.exe
2860	qZDKqkl.exe
2548	IXLgNCx.exe
2652	PDZjZZG.exe
1580	aqlZGIm.exe
2436	ijeuuYB.exe

Loads dropped DLL 64 IoCs

pid	Process
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2824-0-0x000000013F810000-0x000000013FB61000-memory.dmp	upx
behavioral1/files/0x000a000000015c85-5.dat	upx
behavioral1/files/0x0008000000015d24-10.dat	upx
behavioral1/files/0x0007000000015d44-14.dat	upx
behavioral1/memory/2056-20-0x000000013F710000-0x000000013FA61000-memory.dmp	upx
behavioral1/files/0x0009000000015cd9-7.dat	upx
behavioral1/files/0x0007000000015e09-30.dat	upx
behavioral1/files/0x0006000000016cf5-47.dat	upx
behavioral1/memory/2556-60-0x000000013FEA0000-0x00000001401F1000-memory.dmp	upx
behavioral1/memory/2672-64-0x000000013F030000-0x000000013F381000-memory.dmp	upx
behavioral1/memory/2636-72-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2668-65-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx
behavioral1/memory/2560-63-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/memory/2884-58-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/files/0x0006000000016cfd-84.dat	upx
behavioral1/memory/2176-97-0x000000013F6F0000-0x000000013FA41000-memory.dmp	upx
behavioral1/files/0x0006000000016d32-109.dat	upx
behavioral1/files/0x0006000000016d3a-119.dat	upx
behavioral1/files/0x0006000000016da4-128.dat	upx
behavioral1/files/0x00060000000175b8-174.dat	upx
behavioral1/memory/2056-1359-0x000000013F710000-0x000000013FA61000-memory.dmp	upx
behavioral1/memory/2824-1357-0x000000013F810000-0x000000013FB61000-memory.dmp	upx
behavioral1/files/0x000500000001865a-189.dat	upx
behavioral1/files/0x0009000000018640-184.dat	upx
behavioral1/files/0x001500000001863c-179.dat	upx
behavioral1/files/0x00060000000175ac-164.dat	upx
behavioral1/files/0x00060000000175b2-169.dat	upx
behavioral1/files/0x00060000000173e5-154.dat	upx
behavioral1/files/0x000600000001744c-159.dat	upx
behavioral1/files/0x0006000000016fe8-144.dat	upx
behavioral1/files/0x000600000001739d-148.dat	upx
behavioral1/files/0x0006000000016db3-134.dat	upx
behavioral1/files/0x0006000000016e78-139.dat	upx
behavioral1/files/0x0006000000016d9f-125.dat	upx
behavioral1/files/0x0006000000016d36-114.dat	upx
behavioral1/files/0x0006000000016d1f-103.dat	upx
behavioral1/files/0x0006000000016d0e-91.dat	upx
behavioral1/memory/2404-88-0x000000013FEB0000-0x0000000140201000-memory.dmp	upx
behavioral1/memory/2336-99-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/files/0x0006000000016d16-94.dat	upx
behavioral1/memory/2804-81-0x000000013FC30000-0x000000013FF81000-memory.dmp	upx
behavioral1/files/0x0006000000016d05-79.dat	upx
behavioral1/files/0x0006000000016ce4-55.dat	upx
behavioral1/files/0x0007000000015e6d-53.dat	upx
behavioral1/memory/2872-52-0x000000013FB70000-0x000000013FEC1000-memory.dmp	upx
behavioral1/files/0x0008000000016cb2-50.dat	upx
behavioral1/memory/1504-34-0x000000013F5B0000-0x000000013F901000-memory.dmp	upx
behavioral1/memory/2204-46-0x000000013FF00000-0x0000000140251000-memory.dmp	upx
behavioral1/files/0x0007000000015d4c-28.dat	upx
behavioral1/memory/2804-2586-0x000000013FC30000-0x000000013FF81000-memory.dmp	upx
behavioral1/memory/2176-3122-0x000000013F6F0000-0x000000013FA41000-memory.dmp	upx
behavioral1/memory/1504-4197-0x000000013F5B0000-0x000000013F901000-memory.dmp	upx
behavioral1/memory/2556-4207-0x000000013FEA0000-0x00000001401F1000-memory.dmp	upx
behavioral1/memory/2884-4210-0x000000013FDE0000-0x0000000140131000-memory.dmp	upx
behavioral1/memory/2672-4214-0x000000013F030000-0x000000013F381000-memory.dmp	upx
behavioral1/memory/2560-4211-0x000000013FEC0000-0x0000000140211000-memory.dmp	upx
behavioral1/memory/2636-4215-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2668-4217-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx
behavioral1/memory/2804-4219-0x000000013FC30000-0x000000013FF81000-memory.dmp	upx
behavioral1/memory/2404-4221-0x000000013FEB0000-0x0000000140201000-memory.dmp	upx
behavioral1/memory/2336-4223-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/memory/2176-4225-0x000000013F6F0000-0x000000013FA41000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bNeKuRy.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\ecEwKQj.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\jvwUnFR.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\WyMcDKz.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\uTXayDc.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\dmkJhPQ.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\rdZKZph.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\gCCEJIV.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\sirQfJM.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\tnJENBW.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\DFlZpjx.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\KFyuAub.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\xkpUGRz.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\OfpDkqp.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\SxWdhLW.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\jOaJkjj.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\CnPoATt.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\YNlXrMN.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\lKUqpsA.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\HtvipNU.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\EAKPaCI.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\xjxUFxP.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\yYGnlKq.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\mtbErOe.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\bJqgvMH.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\AUNUiUd.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\lEdFkxE.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\AmlPsLs.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\uLjrQyA.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\PdGDClI.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\CZSgoFj.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\bwmGhqe.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\DFGZyxm.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\FISrDmo.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\izmeNXl.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\HzKtUcV.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\KbmcFEZ.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\EZGAMLL.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\jLRojlf.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\OgChjrH.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\cUPCMdX.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\IXfwMPs.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\RUvyDdR.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\jOWntLG.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\USuZDgr.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\MOiKWxG.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\QUDxTHJ.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\kZmFmKE.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\EDBXUSm.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\dMolynw.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\iMxxbKV.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\AtcrKEC.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\DPdgLsa.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\xkMvPmU.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\IXLgNCx.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\kjTwSBL.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\QvaWkZg.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\JdRCXMG.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\EbSTAjJ.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\HlvYgQK.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\wdhyXlE.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\copaJTe.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\pCHFzhO.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
File created	C:\Windows\System\ArDvwNi.exe	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2056	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	29
PID 2824 wrote to memory of 2056	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	29
PID 2824 wrote to memory of 2056	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	29
PID 2824 wrote to memory of 1504	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	30
PID 2824 wrote to memory of 1504	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	30
PID 2824 wrote to memory of 1504	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	30
PID 2824 wrote to memory of 2872	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	31
PID 2824 wrote to memory of 2872	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	31
PID 2824 wrote to memory of 2872	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	31
PID 2824 wrote to memory of 2204	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	32
PID 2824 wrote to memory of 2204	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	32
PID 2824 wrote to memory of 2204	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	32
PID 2824 wrote to memory of 2884	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	33
PID 2824 wrote to memory of 2884	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	33
PID 2824 wrote to memory of 2884	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	33
PID 2824 wrote to memory of 2556	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	34
PID 2824 wrote to memory of 2556	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	34
PID 2824 wrote to memory of 2556	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	34
PID 2824 wrote to memory of 2636	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	35
PID 2824 wrote to memory of 2636	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	35
PID 2824 wrote to memory of 2636	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	35
PID 2824 wrote to memory of 2560	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	36
PID 2824 wrote to memory of 2560	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	36
PID 2824 wrote to memory of 2560	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	36
PID 2824 wrote to memory of 2668	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	37
PID 2824 wrote to memory of 2668	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	37
PID 2824 wrote to memory of 2668	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	37
PID 2824 wrote to memory of 2672	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	38
PID 2824 wrote to memory of 2672	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	38
PID 2824 wrote to memory of 2672	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	38
PID 2824 wrote to memory of 2404	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	39
PID 2824 wrote to memory of 2404	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	39
PID 2824 wrote to memory of 2404	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	39
PID 2824 wrote to memory of 2804	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	40
PID 2824 wrote to memory of 2804	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	40
PID 2824 wrote to memory of 2804	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	40
PID 2824 wrote to memory of 2176	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	41
PID 2824 wrote to memory of 2176	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	41
PID 2824 wrote to memory of 2176	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	41
PID 2824 wrote to memory of 2336	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	42
PID 2824 wrote to memory of 2336	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	42
PID 2824 wrote to memory of 2336	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	42
PID 2824 wrote to memory of 2136	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	43
PID 2824 wrote to memory of 2136	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	43
PID 2824 wrote to memory of 2136	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	43
PID 2824 wrote to memory of 1808	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	44
PID 2824 wrote to memory of 1808	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	44
PID 2824 wrote to memory of 1808	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	44
PID 2824 wrote to memory of 2024	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	45
PID 2824 wrote to memory of 2024	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	45
PID 2824 wrote to memory of 2024	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	45
PID 2824 wrote to memory of 2032	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	46
PID 2824 wrote to memory of 2032	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	46
PID 2824 wrote to memory of 2032	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	46
PID 2824 wrote to memory of 2320	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	47
PID 2824 wrote to memory of 2320	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	47
PID 2824 wrote to memory of 2320	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	47
PID 2824 wrote to memory of 776	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	48
PID 2824 wrote to memory of 776	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	48
PID 2824 wrote to memory of 776	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	48
PID 2824 wrote to memory of 320	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	49
PID 2824 wrote to memory of 320	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	49
PID 2824 wrote to memory of 320	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	49
PID 2824 wrote to memory of 1596	2824	d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\d7acac2806f107d6d90bb8e97dd445b0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System\yYuTPzm.exe
  C:\Windows\System\yYuTPzm.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\WyYzoee.exe
  C:\Windows\System\WyYzoee.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\huqsYwQ.exe
  C:\Windows\System\huqsYwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\EIouVdq.exe
  C:\Windows\System\EIouVdq.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ZmRYxUu.exe
  C:\Windows\System\ZmRYxUu.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\kXpwtRs.exe
  C:\Windows\System\kXpwtRs.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\VdYLAtr.exe
  C:\Windows\System\VdYLAtr.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\GzpLNbV.exe
  C:\Windows\System\GzpLNbV.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\TmjXKJL.exe
  C:\Windows\System\TmjXKJL.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\VozxGgk.exe
  C:\Windows\System\VozxGgk.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\eQFvWig.exe
  C:\Windows\System\eQFvWig.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\AmlPsLs.exe
  C:\Windows\System\AmlPsLs.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\jEyhbdc.exe
  C:\Windows\System\jEyhbdc.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\qtrWrzF.exe
  C:\Windows\System\qtrWrzF.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\PsXxzav.exe
  C:\Windows\System\PsXxzav.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\fYgeKqB.exe
  C:\Windows\System\fYgeKqB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\MYSlvXK.exe
  C:\Windows\System\MYSlvXK.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\guBnmjD.exe
  C:\Windows\System\guBnmjD.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\PsGwTpa.exe
  C:\Windows\System\PsGwTpa.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\RZqNGYM.exe
  C:\Windows\System\RZqNGYM.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\zQrtAkt.exe
  C:\Windows\System\zQrtAkt.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\kVJzsqA.exe
  C:\Windows\System\kVJzsqA.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\sAGeXCy.exe
  C:\Windows\System\sAGeXCy.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\eLyCijZ.exe
  C:\Windows\System\eLyCijZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\gqVAzbv.exe
  C:\Windows\System\gqVAzbv.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\nihjIDx.exe
  C:\Windows\System\nihjIDx.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\fRDYAjG.exe
  C:\Windows\System\fRDYAjG.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\tHIQCId.exe
  C:\Windows\System\tHIQCId.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\BWobsBV.exe
  C:\Windows\System\BWobsBV.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\iqFvJIB.exe
  C:\Windows\System\iqFvJIB.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\YHBCTyX.exe
  C:\Windows\System\YHBCTyX.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\dXYyvmS.exe
  C:\Windows\System\dXYyvmS.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\PhbGSPl.exe
  C:\Windows\System\PhbGSPl.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\oWmMugs.exe
  C:\Windows\System\oWmMugs.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\wSEabZz.exe
  C:\Windows\System\wSEabZz.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\AUvScZs.exe
  C:\Windows\System\AUvScZs.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\bTJmmgG.exe
  C:\Windows\System\bTJmmgG.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\ohoccia.exe
  C:\Windows\System\ohoccia.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\rcZvHXI.exe
  C:\Windows\System\rcZvHXI.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\MFClKVy.exe
  C:\Windows\System\MFClKVy.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\BEOlqlR.exe
  C:\Windows\System\BEOlqlR.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\EgoooAg.exe
  C:\Windows\System\EgoooAg.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\jZYmANn.exe
  C:\Windows\System\jZYmANn.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\kojcYMX.exe
  C:\Windows\System\kojcYMX.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\fNTvMOs.exe
  C:\Windows\System\fNTvMOs.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\wAKHZrz.exe
  C:\Windows\System\wAKHZrz.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\YhcpvLY.exe
  C:\Windows\System\YhcpvLY.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\fXneYsL.exe
  C:\Windows\System\fXneYsL.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\taSXeIe.exe
  C:\Windows\System\taSXeIe.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\NDJHolk.exe
  C:\Windows\System\NDJHolk.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\EivbXfm.exe
  C:\Windows\System\EivbXfm.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\tBldxFM.exe
  C:\Windows\System\tBldxFM.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\zuOhDDu.exe
  C:\Windows\System\zuOhDDu.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\jtHFfLm.exe
  C:\Windows\System\jtHFfLm.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\RUdddWm.exe
  C:\Windows\System\RUdddWm.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\PhlgwWO.exe
  C:\Windows\System\PhlgwWO.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\OYbLLbP.exe
  C:\Windows\System\OYbLLbP.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\TiclGVJ.exe
  C:\Windows\System\TiclGVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\HRUpatp.exe
  C:\Windows\System\HRUpatp.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\qZDKqkl.exe
  C:\Windows\System\qZDKqkl.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\IXLgNCx.exe
  C:\Windows\System\IXLgNCx.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\PDZjZZG.exe
  C:\Windows\System\PDZjZZG.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\aqlZGIm.exe
  C:\Windows\System\aqlZGIm.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ijeuuYB.exe
  C:\Windows\System\ijeuuYB.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\cyvMViX.exe
  C:\Windows\System\cyvMViX.exe
  2⤵
  PID:2688
- C:\Windows\System\OxQZmnG.exe
  C:\Windows\System\OxQZmnG.exe
  2⤵
  PID:1436
- C:\Windows\System\gwigwXT.exe
  C:\Windows\System\gwigwXT.exe
  2⤵
  PID:2372
- C:\Windows\System\ohJxbva.exe
  C:\Windows\System\ohJxbva.exe
  2⤵
  PID:1760
- C:\Windows\System\ZWIbkEK.exe
  C:\Windows\System\ZWIbkEK.exe
  2⤵
  PID:1836
- C:\Windows\System\nAyNstX.exe
  C:\Windows\System\nAyNstX.exe
  2⤵
  PID:1252
- C:\Windows\System\VelwXAD.exe
  C:\Windows\System\VelwXAD.exe
  2⤵
  PID:1216
- C:\Windows\System\sStCTLZ.exe
  C:\Windows\System\sStCTLZ.exe
  2⤵
  PID:380
- C:\Windows\System\xehmYRf.exe
  C:\Windows\System\xehmYRf.exe
  2⤵
  PID:1704
- C:\Windows\System\RAeyISd.exe
  C:\Windows\System\RAeyISd.exe
  2⤵
  PID:2896
- C:\Windows\System\OviBjdO.exe
  C:\Windows\System\OviBjdO.exe
  2⤵
  PID:2476
- C:\Windows\System\oydXvOp.exe
  C:\Windows\System\oydXvOp.exe
  2⤵
  PID:940
- C:\Windows\System\DIRxWIx.exe
  C:\Windows\System\DIRxWIx.exe
  2⤵
  PID:588
- C:\Windows\System\fcwYwQB.exe
  C:\Windows\System\fcwYwQB.exe
  2⤵
  PID:872
- C:\Windows\System\cUPCMdX.exe
  C:\Windows\System\cUPCMdX.exe
  2⤵
  PID:788
- C:\Windows\System\laHlMET.exe
  C:\Windows\System\laHlMET.exe
  2⤵
  PID:2972
- C:\Windows\System\nDsieqg.exe
  C:\Windows\System\nDsieqg.exe
  2⤵
  PID:1276
- C:\Windows\System\NMmDCes.exe
  C:\Windows\System\NMmDCes.exe
  2⤵
  PID:2600
- C:\Windows\System\moBguEA.exe
  C:\Windows\System\moBguEA.exe
  2⤵
  PID:2536
- C:\Windows\System\rudNTzW.exe
  C:\Windows\System\rudNTzW.exe
  2⤵
  PID:980
- C:\Windows\System\ovqQcxZ.exe
  C:\Windows\System\ovqQcxZ.exe
  2⤵
  PID:1664
- C:\Windows\System\EQOrsSf.exe
  C:\Windows\System\EQOrsSf.exe
  2⤵
  PID:1912
- C:\Windows\System\OmkMUSj.exe
  C:\Windows\System\OmkMUSj.exe
  2⤵
  PID:1640
- C:\Windows\System\SKvzjKL.exe
  C:\Windows\System\SKvzjKL.exe
  2⤵
  PID:1868
- C:\Windows\System\boEUuVt.exe
  C:\Windows\System\boEUuVt.exe
  2⤵
  PID:2232
- C:\Windows\System\ZYuvpTI.exe
  C:\Windows\System\ZYuvpTI.exe
  2⤵
  PID:2236
- C:\Windows\System\NZihjlK.exe
  C:\Windows\System\NZihjlK.exe
  2⤵
  PID:2144
- C:\Windows\System\bJqgvMH.exe
  C:\Windows\System\bJqgvMH.exe
  2⤵
  PID:2604
- C:\Windows\System\GioclvP.exe
  C:\Windows\System\GioclvP.exe
  2⤵
  PID:628
- C:\Windows\System\CbjVkZH.exe
  C:\Windows\System\CbjVkZH.exe
  2⤵
  PID:2852
- C:\Windows\System\rdZKZph.exe
  C:\Windows\System\rdZKZph.exe
  2⤵
  PID:2244
- C:\Windows\System\zwmqVeX.exe
  C:\Windows\System\zwmqVeX.exe
  2⤵
  PID:2620
- C:\Windows\System\xguhhAJ.exe
  C:\Windows\System\xguhhAJ.exe
  2⤵
  PID:1728
- C:\Windows\System\liaoGHs.exe
  C:\Windows\System\liaoGHs.exe
  2⤵
  PID:1624
- C:\Windows\System\cNkDRiW.exe
  C:\Windows\System\cNkDRiW.exe
  2⤵
  PID:2532
- C:\Windows\System\jiXOKEP.exe
  C:\Windows\System\jiXOKEP.exe
  2⤵
  PID:2444
- C:\Windows\System\KLecRUA.exe
  C:\Windows\System\KLecRUA.exe
  2⤵
  PID:2680
- C:\Windows\System\XbvOAfj.exe
  C:\Windows\System\XbvOAfj.exe
  2⤵
  PID:1820
- C:\Windows\System\hHnbVKZ.exe
  C:\Windows\System\hHnbVKZ.exe
  2⤵
  PID:1892
- C:\Windows\System\DVKFnIz.exe
  C:\Windows\System\DVKFnIz.exe
  2⤵
  PID:2700
- C:\Windows\System\tSMPSFe.exe
  C:\Windows\System\tSMPSFe.exe
  2⤵
  PID:2000
- C:\Windows\System\XYpxiCM.exe
  C:\Windows\System\XYpxiCM.exe
  2⤵
  PID:2508
- C:\Windows\System\CLuQFZv.exe
  C:\Windows\System\CLuQFZv.exe
  2⤵
  PID:1368
- C:\Windows\System\KeYDtit.exe
  C:\Windows\System\KeYDtit.exe
  2⤵
  PID:488
- C:\Windows\System\omeARke.exe
  C:\Windows\System\omeARke.exe
  2⤵
  PID:600
- C:\Windows\System\DCrUpPA.exe
  C:\Windows\System\DCrUpPA.exe
  2⤵
  PID:2348
- C:\Windows\System\RGrjIHM.exe
  C:\Windows\System\RGrjIHM.exe
  2⤵
  PID:1480
- C:\Windows\System\UVvRGjf.exe
  C:\Windows\System\UVvRGjf.exe
  2⤵
  PID:1484
- C:\Windows\System\gOCZiAb.exe
  C:\Windows\System\gOCZiAb.exe
  2⤵
  PID:2648
- C:\Windows\System\ojlWCCh.exe
  C:\Windows\System\ojlWCCh.exe
  2⤵
  PID:1860
- C:\Windows\System\bvVREkE.exe
  C:\Windows\System\bvVREkE.exe
  2⤵
  PID:3060
- C:\Windows\System\LyDKbeK.exe
  C:\Windows\System\LyDKbeK.exe
  2⤵
  PID:2696
- C:\Windows\System\KoCxDJo.exe
  C:\Windows\System\KoCxDJo.exe
  2⤵
  PID:1988
- C:\Windows\System\vRauccx.exe
  C:\Windows\System\vRauccx.exe
  2⤵
  PID:3048
- C:\Windows\System\ticSFmJ.exe
  C:\Windows\System\ticSFmJ.exe
  2⤵
  PID:1724
- C:\Windows\System\BmtrCHY.exe
  C:\Windows\System\BmtrCHY.exe
  2⤵
  PID:1652
- C:\Windows\System\vlvSBYa.exe
  C:\Windows\System\vlvSBYa.exe
  2⤵
  PID:2416
- C:\Windows\System\bveJjmS.exe
  C:\Windows\System\bveJjmS.exe
  2⤵
  PID:2684
- C:\Windows\System\BZkiWYn.exe
  C:\Windows\System\BZkiWYn.exe
  2⤵
  PID:2596
- C:\Windows\System\mxsiGcd.exe
  C:\Windows\System\mxsiGcd.exe
  2⤵
  PID:1796
- C:\Windows\System\LVqMAeg.exe
  C:\Windows\System\LVqMAeg.exe
  2⤵
  PID:2428
- C:\Windows\System\crvkjKa.exe
  C:\Windows\System\crvkjKa.exe
  2⤵
  PID:2292
- C:\Windows\System\XVUqUZP.exe
  C:\Windows\System\XVUqUZP.exe
  2⤵
  PID:700
- C:\Windows\System\HzKtUcV.exe
  C:\Windows\System\HzKtUcV.exe
  2⤵
  PID:288
- C:\Windows\System\GNRAwwP.exe
  C:\Windows\System\GNRAwwP.exe
  2⤵
  PID:976
- C:\Windows\System\kHngcwC.exe
  C:\Windows\System\kHngcwC.exe
  2⤵
  PID:1676
- C:\Windows\System\lFdwnyW.exe
  C:\Windows\System\lFdwnyW.exe
  2⤵
  PID:2124
- C:\Windows\System\vwABmcc.exe
  C:\Windows\System\vwABmcc.exe
  2⤵
  PID:2392
- C:\Windows\System\DFGZyxm.exe
  C:\Windows\System\DFGZyxm.exe
  2⤵
  PID:1840
- C:\Windows\System\GjUAAwQ.exe
  C:\Windows\System\GjUAAwQ.exe
  2⤵
  PID:2808
- C:\Windows\System\UUPznnW.exe
  C:\Windows\System\UUPznnW.exe
  2⤵
  PID:2800
- C:\Windows\System\tJMoNlb.exe
  C:\Windows\System\tJMoNlb.exe
  2⤵
  PID:2732
- C:\Windows\System\yYTEatC.exe
  C:\Windows\System\yYTEatC.exe
  2⤵
  PID:2388
- C:\Windows\System\qMsrKsr.exe
  C:\Windows\System\qMsrKsr.exe
  2⤵
  PID:2924
- C:\Windows\System\xCJHTRM.exe
  C:\Windows\System\xCJHTRM.exe
  2⤵
  PID:2568
- C:\Windows\System\jmFoDAw.exe
  C:\Windows\System\jmFoDAw.exe
  2⤵
  PID:2188
- C:\Windows\System\hXuNNtX.exe
  C:\Windows\System\hXuNNtX.exe
  2⤵
  PID:1448
- C:\Windows\System\cwBkTjM.exe
  C:\Windows\System\cwBkTjM.exe
  2⤵
  PID:684
- C:\Windows\System\hmcxyHf.exe
  C:\Windows\System\hmcxyHf.exe
  2⤵
  PID:1880
- C:\Windows\System\kMREZEV.exe
  C:\Windows\System\kMREZEV.exe
  2⤵
  PID:2712
- C:\Windows\System\qbRJXww.exe
  C:\Windows\System\qbRJXww.exe
  2⤵
  PID:920
- C:\Windows\System\wiOvGmJ.exe
  C:\Windows\System\wiOvGmJ.exe
  2⤵
  PID:2468
- C:\Windows\System\rjKsVkK.exe
  C:\Windows\System\rjKsVkK.exe
  2⤵
  PID:1600
- C:\Windows\System\JsCjCSL.exe
  C:\Windows\System\JsCjCSL.exe
  2⤵
  PID:1260
- C:\Windows\System\mIbUgfZ.exe
  C:\Windows\System\mIbUgfZ.exe
  2⤵
  PID:3020
- C:\Windows\System\ccYaqgQ.exe
  C:\Windows\System\ccYaqgQ.exe
  2⤵
  PID:1208
- C:\Windows\System\wKPEDiH.exe
  C:\Windows\System\wKPEDiH.exe
  2⤵
  PID:2112
- C:\Windows\System\QwbXvWW.exe
  C:\Windows\System\QwbXvWW.exe
  2⤵
  PID:292
- C:\Windows\System\aYwBQlp.exe
  C:\Windows\System\aYwBQlp.exe
  2⤵
  PID:1648
- C:\Windows\System\NUefhlY.exe
  C:\Windows\System\NUefhlY.exe
  2⤵
  PID:1688
- C:\Windows\System\yBzGKQW.exe
  C:\Windows\System\yBzGKQW.exe
  2⤵
  PID:1016
- C:\Windows\System\NLDGanv.exe
  C:\Windows\System\NLDGanv.exe
  2⤵
  PID:1148
- C:\Windows\System\acOCqdu.exe
  C:\Windows\System\acOCqdu.exe
  2⤵
  PID:2828
- C:\Windows\System\JSFlVlj.exe
  C:\Windows\System\JSFlVlj.exe
  2⤵
  PID:1028
- C:\Windows\System\AdqZgjN.exe
  C:\Windows\System\AdqZgjN.exe
  2⤵
  PID:1164
- C:\Windows\System\fQsdzjG.exe
  C:\Windows\System\fQsdzjG.exe
  2⤵
  PID:2332
- C:\Windows\System\CLuOVHs.exe
  C:\Windows\System\CLuOVHs.exe
  2⤵
  PID:1980
- C:\Windows\System\fmwNijh.exe
  C:\Windows\System\fmwNijh.exe
  2⤵
  PID:2196
- C:\Windows\System\SAatRUu.exe
  C:\Windows\System\SAatRUu.exe
  2⤵
  PID:1296
- C:\Windows\System\edfgLTl.exe
  C:\Windows\System\edfgLTl.exe
  2⤵
  PID:2956
- C:\Windows\System\XxNDTiy.exe
  C:\Windows\System\XxNDTiy.exe
  2⤵
  PID:1692
- C:\Windows\System\ZjjKxEj.exe
  C:\Windows\System\ZjjKxEj.exe
  2⤵
  PID:2424
- C:\Windows\System\fjRNZhV.exe
  C:\Windows\System\fjRNZhV.exe
  2⤵
  PID:2028
- C:\Windows\System\NhsGSkl.exe
  C:\Windows\System\NhsGSkl.exe
  2⤵
  PID:1560
- C:\Windows\System\nCjfoVa.exe
  C:\Windows\System\nCjfoVa.exe
  2⤵
  PID:2676
- C:\Windows\System\jIQTIhs.exe
  C:\Windows\System\jIQTIhs.exe
  2⤵
  PID:2200
- C:\Windows\System\HtvipNU.exe
  C:\Windows\System\HtvipNU.exe
  2⤵
  PID:2740
- C:\Windows\System\MBBrNkB.exe
  C:\Windows\System\MBBrNkB.exe
  2⤵
  PID:2396
- C:\Windows\System\uTXayDc.exe
  C:\Windows\System\uTXayDc.exe
  2⤵
  PID:2640
- C:\Windows\System\SUcHGaZ.exe
  C:\Windows\System\SUcHGaZ.exe
  2⤵
  PID:2628
- C:\Windows\System\ihOrPbT.exe
  C:\Windows\System\ihOrPbT.exe
  2⤵
  PID:3076
- C:\Windows\System\KauQnzj.exe
  C:\Windows\System\KauQnzj.exe
  2⤵
  PID:3136
- C:\Windows\System\aaiyjQG.exe
  C:\Windows\System\aaiyjQG.exe
  2⤵
  PID:3152
- C:\Windows\System\geIkEFr.exe
  C:\Windows\System\geIkEFr.exe
  2⤵
  PID:3172
- C:\Windows\System\VwGrlnv.exe
  C:\Windows\System\VwGrlnv.exe
  2⤵
  PID:3188
- C:\Windows\System\twepXTO.exe
  C:\Windows\System\twepXTO.exe
  2⤵
  PID:3204
- C:\Windows\System\HVVdmoz.exe
  C:\Windows\System\HVVdmoz.exe
  2⤵
  PID:3220
- C:\Windows\System\bNeKuRy.exe
  C:\Windows\System\bNeKuRy.exe
  2⤵
  PID:3236
- C:\Windows\System\AYvpXBG.exe
  C:\Windows\System\AYvpXBG.exe
  2⤵
  PID:3256
- C:\Windows\System\nxIpgOP.exe
  C:\Windows\System\nxIpgOP.exe
  2⤵
  PID:3272
- C:\Windows\System\kPjGVdj.exe
  C:\Windows\System\kPjGVdj.exe
  2⤵
  PID:3288
- C:\Windows\System\WzTujlB.exe
  C:\Windows\System\WzTujlB.exe
  2⤵
  PID:3304
- C:\Windows\System\wUSswrG.exe
  C:\Windows\System\wUSswrG.exe
  2⤵
  PID:3324
- C:\Windows\System\xSufkKb.exe
  C:\Windows\System\xSufkKb.exe
  2⤵
  PID:3340
- C:\Windows\System\LtgcKHL.exe
  C:\Windows\System\LtgcKHL.exe
  2⤵
  PID:3356
- C:\Windows\System\FISrDmo.exe
  C:\Windows\System\FISrDmo.exe
  2⤵
  PID:3372
- C:\Windows\System\NFfSFpK.exe
  C:\Windows\System\NFfSFpK.exe
  2⤵
  PID:3388
- C:\Windows\System\SbotamV.exe
  C:\Windows\System\SbotamV.exe
  2⤵
  PID:3408
- C:\Windows\System\vFbCBOJ.exe
  C:\Windows\System\vFbCBOJ.exe
  2⤵
  PID:3424
- C:\Windows\System\DgxfNbz.exe
  C:\Windows\System\DgxfNbz.exe
  2⤵
  PID:3440
- C:\Windows\System\kifwhHC.exe
  C:\Windows\System\kifwhHC.exe
  2⤵
  PID:3456
- C:\Windows\System\CvecLlp.exe
  C:\Windows\System\CvecLlp.exe
  2⤵
  PID:3472
- C:\Windows\System\TXPQQHi.exe
  C:\Windows\System\TXPQQHi.exe
  2⤵
  PID:3488
- C:\Windows\System\ljWmmir.exe
  C:\Windows\System\ljWmmir.exe
  2⤵
  PID:3504
- C:\Windows\System\AuRZhoz.exe
  C:\Windows\System\AuRZhoz.exe
  2⤵
  PID:3520
- C:\Windows\System\niWbjzh.exe
  C:\Windows\System\niWbjzh.exe
  2⤵
  PID:3536
- C:\Windows\System\ieCXLsD.exe
  C:\Windows\System\ieCXLsD.exe
  2⤵
  PID:3556
- C:\Windows\System\lPdkTUB.exe
  C:\Windows\System\lPdkTUB.exe
  2⤵
  PID:3572
- C:\Windows\System\EjnFzOT.exe
  C:\Windows\System\EjnFzOT.exe
  2⤵
  PID:3588
- C:\Windows\System\PnacRiV.exe
  C:\Windows\System\PnacRiV.exe
  2⤵
  PID:3608
- C:\Windows\System\otuVXyB.exe
  C:\Windows\System\otuVXyB.exe
  2⤵
  PID:3624
- C:\Windows\System\BOTJfWO.exe
  C:\Windows\System\BOTJfWO.exe
  2⤵
  PID:3640
- C:\Windows\System\pZliaQV.exe
  C:\Windows\System\pZliaQV.exe
  2⤵
  PID:3656
- C:\Windows\System\FsZWyxD.exe
  C:\Windows\System\FsZWyxD.exe
  2⤵
  PID:3676
- C:\Windows\System\QMsrWNK.exe
  C:\Windows\System\QMsrWNK.exe
  2⤵
  PID:3692
- C:\Windows\System\VjQgZLr.exe
  C:\Windows\System\VjQgZLr.exe
  2⤵
  PID:3708
- C:\Windows\System\ptLoYJe.exe
  C:\Windows\System\ptLoYJe.exe
  2⤵
  PID:3728
- C:\Windows\System\aqPAWIb.exe
  C:\Windows\System\aqPAWIb.exe
  2⤵
  PID:3744
- C:\Windows\System\mtbErOe.exe
  C:\Windows\System\mtbErOe.exe
  2⤵
  PID:3760
- C:\Windows\System\clizBuQ.exe
  C:\Windows\System\clizBuQ.exe
  2⤵
  PID:3776
- C:\Windows\System\VfnacIq.exe
  C:\Windows\System\VfnacIq.exe
  2⤵
  PID:3800
- C:\Windows\System\jdRAubp.exe
  C:\Windows\System\jdRAubp.exe
  2⤵
  PID:3828
- C:\Windows\System\RZMpjpo.exe
  C:\Windows\System\RZMpjpo.exe
  2⤵
  PID:3844
- C:\Windows\System\eEIgWoQ.exe
  C:\Windows\System\eEIgWoQ.exe
  2⤵
  PID:3860
- C:\Windows\System\gzrPlhf.exe
  C:\Windows\System\gzrPlhf.exe
  2⤵
  PID:3876
- C:\Windows\System\SPGnfhn.exe
  C:\Windows\System\SPGnfhn.exe
  2⤵
  PID:3892
- C:\Windows\System\WiLYeJm.exe
  C:\Windows\System\WiLYeJm.exe
  2⤵
  PID:3908
- C:\Windows\System\YRBjQkf.exe
  C:\Windows\System\YRBjQkf.exe
  2⤵
  PID:3960
- C:\Windows\System\aVHJJxA.exe
  C:\Windows\System\aVHJJxA.exe
  2⤵
  PID:2572
- C:\Windows\System\gTjhVFh.exe
  C:\Windows\System\gTjhVFh.exe
  2⤵
  PID:1720
- C:\Windows\System\QUDxTHJ.exe
  C:\Windows\System\QUDxTHJ.exe
  2⤵
  PID:2296
- C:\Windows\System\UdppeFa.exe
  C:\Windows\System\UdppeFa.exe
  2⤵
  PID:1432
- C:\Windows\System\yKrXWTH.exe
  C:\Windows\System\yKrXWTH.exe
  2⤵
  PID:2300
- C:\Windows\System\FJxzVZR.exe
  C:\Windows\System\FJxzVZR.exe
  2⤵
  PID:1900
- C:\Windows\System\djrGZIh.exe
  C:\Windows\System\djrGZIh.exe
  2⤵
  PID:3084
- C:\Windows\System\kzsczHa.exe
  C:\Windows\System\kzsczHa.exe
  2⤵
  PID:3104
- C:\Windows\System\cZIimOj.exe
  C:\Windows\System\cZIimOj.exe
  2⤵
  PID:3120
- C:\Windows\System\AoJjGdz.exe
  C:\Windows\System\AoJjGdz.exe
  2⤵
  PID:3092
- C:\Windows\System\ijyejch.exe
  C:\Windows\System\ijyejch.exe
  2⤵
  PID:3320
- C:\Windows\System\MyyYxlw.exe
  C:\Windows\System\MyyYxlw.exe
  2⤵
  PID:3244
- C:\Windows\System\hKmxcHV.exe
  C:\Windows\System\hKmxcHV.exe
  2⤵
  PID:3284
- C:\Windows\System\lBKWitU.exe
  C:\Windows\System\lBKWitU.exe
  2⤵
  PID:2408
- C:\Windows\System\WTydWmO.exe
  C:\Windows\System\WTydWmO.exe
  2⤵
  PID:3416
- C:\Windows\System\NkeTNhn.exe
  C:\Windows\System\NkeTNhn.exe
  2⤵
  PID:3480
- C:\Windows\System\iMxxbKV.exe
  C:\Windows\System\iMxxbKV.exe
  2⤵
  PID:3544
- C:\Windows\System\uCALPts.exe
  C:\Windows\System\uCALPts.exe
  2⤵
  PID:3584
- C:\Windows\System\UYbECzc.exe
  C:\Windows\System\UYbECzc.exe
  2⤵
  PID:3652
- C:\Windows\System\NRqLJUS.exe
  C:\Windows\System\NRqLJUS.exe
  2⤵
  PID:3720
- C:\Windows\System\QcRdJSr.exe
  C:\Windows\System\QcRdJSr.exe
  2⤵
  PID:3788
- C:\Windows\System\OfpDkqp.exe
  C:\Windows\System\OfpDkqp.exe
  2⤵
  PID:3268
- C:\Windows\System\SxWdhLW.exe
  C:\Windows\System\SxWdhLW.exe
  2⤵
  PID:3792
- C:\Windows\System\qfTcuQF.exe
  C:\Windows\System\qfTcuQF.exe
  2⤵
  PID:3228
- C:\Windows\System\nIzSSrW.exe
  C:\Windows\System\nIzSSrW.exe
  2⤵
  PID:3400
- C:\Windows\System\HEmMBRq.exe
  C:\Windows\System\HEmMBRq.exe
  2⤵
  PID:3496
- C:\Windows\System\geTtXwv.exe
  C:\Windows\System\geTtXwv.exe
  2⤵
  PID:3564
- C:\Windows\System\CHvqXcr.exe
  C:\Windows\System\CHvqXcr.exe
  2⤵
  PID:3736
- C:\Windows\System\xmfJXsm.exe
  C:\Windows\System\xmfJXsm.exe
  2⤵
  PID:3944
- C:\Windows\System\wRtejYn.exe
  C:\Windows\System\wRtejYn.exe
  2⤵
  PID:3840
- C:\Windows\System\tcoAgWz.exe
  C:\Windows\System\tcoAgWz.exe
  2⤵
  PID:3976
- C:\Windows\System\VKtlwpU.exe
  C:\Windows\System\VKtlwpU.exe
  2⤵
  PID:3988
- C:\Windows\System\uaSDbPJ.exe
  C:\Windows\System\uaSDbPJ.exe
  2⤵
  PID:4004
- C:\Windows\System\qWhRUlf.exe
  C:\Windows\System\qWhRUlf.exe
  2⤵
  PID:4020
- C:\Windows\System\Mfiiwaq.exe
  C:\Windows\System\Mfiiwaq.exe
  2⤵
  PID:4040
- C:\Windows\System\sAJpXzx.exe
  C:\Windows\System\sAJpXzx.exe
  2⤵
  PID:4052
- C:\Windows\System\klHEvdH.exe
  C:\Windows\System\klHEvdH.exe
  2⤵
  PID:4068
- C:\Windows\System\IUyRigt.exe
  C:\Windows\System\IUyRigt.exe
  2⤵
  PID:4084
- C:\Windows\System\kwOnGWD.exe
  C:\Windows\System\kwOnGWD.exe
  2⤵
  PID:2716
- C:\Windows\System\XvcJFjR.exe
  C:\Windows\System\XvcJFjR.exe
  2⤵
  PID:2692
- C:\Windows\System\PyUcJNn.exe
  C:\Windows\System\PyUcJNn.exe
  2⤵
  PID:2340
- C:\Windows\System\jOaJkjj.exe
  C:\Windows\System\jOaJkjj.exe
  2⤵
  PID:3112
- C:\Windows\System\byywhDL.exe
  C:\Windows\System\byywhDL.exe
  2⤵
  PID:3180
- C:\Windows\System\xFQugBk.exe
  C:\Windows\System\xFQugBk.exe
  2⤵
  PID:3352
- C:\Windows\System\ecEwKQj.exe
  C:\Windows\System\ecEwKQj.exe
  2⤵
  PID:3620
- C:\Windows\System\CKUmVGK.exe
  C:\Windows\System\CKUmVGK.exe
  2⤵
  PID:3784
- C:\Windows\System\dPxdBEE.exe
  C:\Windows\System\dPxdBEE.exe
  2⤵
  PID:3404
- C:\Windows\System\mwidVze.exe
  C:\Windows\System\mwidVze.exe
  2⤵
  PID:3604
- C:\Windows\System\pCHFzhO.exe
  C:\Windows\System\pCHFzhO.exe
  2⤵
  PID:3632
- C:\Windows\System\wUgFzvj.exe
  C:\Windows\System\wUgFzvj.exe
  2⤵
  PID:2584
- C:\Windows\System\WHzCOxA.exe
  C:\Windows\System\WHzCOxA.exe
  2⤵
  PID:3852
- C:\Windows\System\McxhoRm.exe
  C:\Windows\System\McxhoRm.exe
  2⤵
  PID:3920
- C:\Windows\System\pvxACvu.exe
  C:\Windows\System\pvxACvu.exe
  2⤵
  PID:3464
- C:\Windows\System\wqBmcVl.exe
  C:\Windows\System\wqBmcVl.exe
  2⤵
  PID:852
- C:\Windows\System\ftWEFjr.exe
  C:\Windows\System\ftWEFjr.exe
  2⤵
  PID:4092
- C:\Windows\System\bXFiqrj.exe
  C:\Windows\System\bXFiqrj.exe
  2⤵
  PID:3164
- C:\Windows\System\ahHuOOn.exe
  C:\Windows\System\ahHuOOn.exe
  2⤵
  PID:3688
- C:\Windows\System\QRqRBcc.exe
  C:\Windows\System\QRqRBcc.exe
  2⤵
  PID:4104
- C:\Windows\System\bPRXrot.exe
  C:\Windows\System\bPRXrot.exe
  2⤵
  PID:4120
- C:\Windows\System\FbhgFwB.exe
  C:\Windows\System\FbhgFwB.exe
  2⤵
  PID:4136
- C:\Windows\System\wkptzip.exe
  C:\Windows\System\wkptzip.exe
  2⤵
  PID:4152
- C:\Windows\System\PEtJpCN.exe
  C:\Windows\System\PEtJpCN.exe
  2⤵
  PID:4172
- C:\Windows\System\VXaPyyO.exe
  C:\Windows\System\VXaPyyO.exe
  2⤵
  PID:4188
- C:\Windows\System\mKEkkPV.exe
  C:\Windows\System\mKEkkPV.exe
  2⤵
  PID:4204
- C:\Windows\System\nCRcMtR.exe
  C:\Windows\System\nCRcMtR.exe
  2⤵
  PID:4220
- C:\Windows\System\XCWtDtg.exe
  C:\Windows\System\XCWtDtg.exe
  2⤵
  PID:4240
- C:\Windows\System\pusSeBp.exe
  C:\Windows\System\pusSeBp.exe
  2⤵
  PID:4256
- C:\Windows\System\uPpChfg.exe
  C:\Windows\System\uPpChfg.exe
  2⤵
  PID:4272
- C:\Windows\System\PrqJikU.exe
  C:\Windows\System\PrqJikU.exe
  2⤵
  PID:4288
- C:\Windows\System\frnpAmc.exe
  C:\Windows\System\frnpAmc.exe
  2⤵
  PID:4304
- C:\Windows\System\RbgNXAR.exe
  C:\Windows\System\RbgNXAR.exe
  2⤵
  PID:4324
- C:\Windows\System\ykVwsio.exe
  C:\Windows\System\ykVwsio.exe
  2⤵
  PID:4340
- C:\Windows\System\IXfwMPs.exe
  C:\Windows\System\IXfwMPs.exe
  2⤵
  PID:4356
- C:\Windows\System\IeBbFoa.exe
  C:\Windows\System\IeBbFoa.exe
  2⤵
  PID:4376
- C:\Windows\System\cyaWwGy.exe
  C:\Windows\System\cyaWwGy.exe
  2⤵
  PID:4392
- C:\Windows\System\coTeRLp.exe
  C:\Windows\System\coTeRLp.exe
  2⤵
  PID:4408
- C:\Windows\System\tbwPISf.exe
  C:\Windows\System\tbwPISf.exe
  2⤵
  PID:4428
- C:\Windows\System\OScPEpK.exe
  C:\Windows\System\OScPEpK.exe
  2⤵
  PID:4444
- C:\Windows\System\AtcrKEC.exe
  C:\Windows\System\AtcrKEC.exe
  2⤵
  PID:4460
- C:\Windows\System\LVVKael.exe
  C:\Windows\System\LVVKael.exe
  2⤵
  PID:4480
- C:\Windows\System\qRdpxMR.exe
  C:\Windows\System\qRdpxMR.exe
  2⤵
  PID:4496
- C:\Windows\System\fdgeYzK.exe
  C:\Windows\System\fdgeYzK.exe
  2⤵
  PID:4516
- C:\Windows\System\CTMdnNt.exe
  C:\Windows\System\CTMdnNt.exe
  2⤵
  PID:4532
- C:\Windows\System\gTiiGJx.exe
  C:\Windows\System\gTiiGJx.exe
  2⤵
  PID:4548
- C:\Windows\System\oyDTVDP.exe
  C:\Windows\System\oyDTVDP.exe
  2⤵
  PID:4564
- C:\Windows\System\fgNurJT.exe
  C:\Windows\System\fgNurJT.exe
  2⤵
  PID:4580
- C:\Windows\System\GpXNgch.exe
  C:\Windows\System\GpXNgch.exe
  2⤵
  PID:4600
- C:\Windows\System\FywsYGv.exe
  C:\Windows\System\FywsYGv.exe
  2⤵
  PID:4616
- C:\Windows\System\qgXtflB.exe
  C:\Windows\System\qgXtflB.exe
  2⤵
  PID:4632
- C:\Windows\System\hZGTOpy.exe
  C:\Windows\System\hZGTOpy.exe
  2⤵
  PID:4648
- C:\Windows\System\MPMauve.exe
  C:\Windows\System\MPMauve.exe
  2⤵
  PID:4664
- C:\Windows\System\gxRrzZv.exe
  C:\Windows\System\gxRrzZv.exe
  2⤵
  PID:4680
- C:\Windows\System\cfnKxDW.exe
  C:\Windows\System\cfnKxDW.exe
  2⤵
  PID:4700
- C:\Windows\System\TgogAhu.exe
  C:\Windows\System\TgogAhu.exe
  2⤵
  PID:4716
- C:\Windows\System\kjTwSBL.exe
  C:\Windows\System\kjTwSBL.exe
  2⤵
  PID:4732
- C:\Windows\System\FdhQzrY.exe
  C:\Windows\System\FdhQzrY.exe
  2⤵
  PID:4748
- C:\Windows\System\zsfLidd.exe
  C:\Windows\System\zsfLidd.exe
  2⤵
  PID:4764
- C:\Windows\System\EPplZhd.exe
  C:\Windows\System\EPplZhd.exe
  2⤵
  PID:4780
- C:\Windows\System\pttoMyB.exe
  C:\Windows\System\pttoMyB.exe
  2⤵
  PID:4800
- C:\Windows\System\fQgoHIb.exe
  C:\Windows\System\fQgoHIb.exe
  2⤵
  PID:4816
- C:\Windows\System\SAyQNgZ.exe
  C:\Windows\System\SAyQNgZ.exe
  2⤵
  PID:4832
- C:\Windows\System\WqegrSL.exe
  C:\Windows\System\WqegrSL.exe
  2⤵
  PID:4848
- C:\Windows\System\GwgOkiB.exe
  C:\Windows\System\GwgOkiB.exe
  2⤵
  PID:4868
- C:\Windows\System\NGsqKDC.exe
  C:\Windows\System\NGsqKDC.exe
  2⤵
  PID:4884
- C:\Windows\System\tXQmnRZ.exe
  C:\Windows\System\tXQmnRZ.exe
  2⤵
  PID:4904
- C:\Windows\System\AWFslQC.exe
  C:\Windows\System\AWFslQC.exe
  2⤵
  PID:4920
- C:\Windows\System\KbmcFEZ.exe
  C:\Windows\System\KbmcFEZ.exe
  2⤵
  PID:4936
- C:\Windows\System\bWOsxDE.exe
  C:\Windows\System\bWOsxDE.exe
  2⤵
  PID:4952
- C:\Windows\System\gjDCZUr.exe
  C:\Windows\System\gjDCZUr.exe
  2⤵
  PID:4968
- C:\Windows\System\UVzeahY.exe
  C:\Windows\System\UVzeahY.exe
  2⤵
  PID:4984
- C:\Windows\System\IHTFDEU.exe
  C:\Windows\System\IHTFDEU.exe
  2⤵
  PID:5000
- C:\Windows\System\CfZjxId.exe
  C:\Windows\System\CfZjxId.exe
  2⤵
  PID:5016
- C:\Windows\System\dvlKWhO.exe
  C:\Windows\System\dvlKWhO.exe
  2⤵
  PID:5032
- C:\Windows\System\YuhtzOD.exe
  C:\Windows\System\YuhtzOD.exe
  2⤵
  PID:5048
- C:\Windows\System\IWaUztQ.exe
  C:\Windows\System\IWaUztQ.exe
  2⤵
  PID:5064
- C:\Windows\System\ALxmLFR.exe
  C:\Windows\System\ALxmLFR.exe
  2⤵
  PID:5080
- C:\Windows\System\mjjhbKW.exe
  C:\Windows\System\mjjhbKW.exe
  2⤵
  PID:5096
- C:\Windows\System\ArDvwNi.exe
  C:\Windows\System\ArDvwNi.exe
  2⤵
  PID:5112
- C:\Windows\System\rgUEUUJ.exe
  C:\Windows\System\rgUEUUJ.exe
  2⤵
  PID:3596
- C:\Windows\System\hGczsfN.exe
  C:\Windows\System\hGczsfN.exe
  2⤵
  PID:3948
- C:\Windows\System\GJQcSHY.exe
  C:\Windows\System\GJQcSHY.exe
  2⤵
  PID:3836
- C:\Windows\System\vxdagEB.exe
  C:\Windows\System\vxdagEB.exe
  2⤵
  PID:4060
- C:\Windows\System\RSybRzx.exe
  C:\Windows\System\RSybRzx.exe
  2⤵
  PID:4348
- C:\Windows\System\pBayVJo.exe
  C:\Windows\System\pBayVJo.exe
  2⤵
  PID:4596
- C:\Windows\System\QGMaFft.exe
  C:\Windows\System\QGMaFft.exe
  2⤵
  PID:4628
- C:\Windows\System\RXthZvz.exe
  C:\Windows\System\RXthZvz.exe
  2⤵
  PID:4692
- C:\Windows\System\MfZSGFB.exe
  C:\Windows\System\MfZSGFB.exe
  2⤵
  PID:4996
- C:\Windows\System\DdUwsUp.exe
  C:\Windows\System\DdUwsUp.exe
  2⤵
  PID:5092
- C:\Windows\System\UnXZodY.exe
  C:\Windows\System\UnXZodY.exe
  2⤵
  PID:3900
- C:\Windows\System\FAWxLeo.exe
  C:\Windows\System\FAWxLeo.exe
  2⤵
  PID:4944
- C:\Windows\System\BobLXzG.exe
  C:\Windows\System\BobLXzG.exe
  2⤵
  PID:4164
- C:\Windows\System\yHYUtiW.exe
  C:\Windows\System\yHYUtiW.exe
  2⤵
  PID:4572
- C:\Windows\System\lNhqhya.exe
  C:\Windows\System\lNhqhya.exe
  2⤵
  PID:4744
- C:\Windows\System\bHHIYRN.exe
  C:\Windows\System\bHHIYRN.exe
  2⤵
  PID:4808
- C:\Windows\System\LzyTioQ.exe
  C:\Windows\System\LzyTioQ.exe
  2⤵
  PID:5104
- C:\Windows\System\BqfFVOE.exe
  C:\Windows\System\BqfFVOE.exe
  2⤵
  PID:3316
- C:\Windows\System\CnPoATt.exe
  C:\Windows\System\CnPoATt.exe
  2⤵
  PID:4232
- C:\Windows\System\yxGZPuZ.exe
  C:\Windows\System\yxGZPuZ.exe
  2⤵
  PID:4264
- C:\Windows\System\lpyXCpf.exe
  C:\Windows\System\lpyXCpf.exe
  2⤵
  PID:4336
- C:\Windows\System\TiNaeKC.exe
  C:\Windows\System\TiNaeKC.exe
  2⤵
  PID:4400
- C:\Windows\System\WoLGcka.exe
  C:\Windows\System\WoLGcka.exe
  2⤵
  PID:4472
- C:\Windows\System\MPpBRGO.exe
  C:\Windows\System\MPpBRGO.exe
  2⤵
  PID:4540
- C:\Windows\System\tPFDQGN.exe
  C:\Windows\System\tPFDQGN.exe
  2⤵
  PID:4612
- C:\Windows\System\CverhOM.exe
  C:\Windows\System\CverhOM.exe
  2⤵
  PID:4672
- C:\Windows\System\ybbxwbI.exe
  C:\Windows\System\ybbxwbI.exe
  2⤵
  PID:4976
- C:\Windows\System\EAKPaCI.exe
  C:\Windows\System\EAKPaCI.exe
  2⤵
  PID:2452
- C:\Windows\System\tsttvnw.exe
  C:\Windows\System\tsttvnw.exe
  2⤵
  PID:3148
- C:\Windows\System\WAYNxNo.exe
  C:\Windows\System\WAYNxNo.exe
  2⤵
  PID:3636
- C:\Windows\System\EZGAMLL.exe
  C:\Windows\System\EZGAMLL.exe
  2⤵
  PID:2036
- C:\Windows\System\UnVVOiS.exe
  C:\Windows\System\UnVVOiS.exe
  2⤵
  PID:3368
- C:\Windows\System\sCOejAs.exe
  C:\Windows\System\sCOejAs.exe
  2⤵
  PID:3452
- C:\Windows\System\kOYWipP.exe
  C:\Windows\System\kOYWipP.exe
  2⤵
  PID:4180
- C:\Windows\System\pqNWbvD.exe
  C:\Windows\System\pqNWbvD.exe
  2⤵
  PID:4252
- C:\Windows\System\QgeSfYj.exe
  C:\Windows\System\QgeSfYj.exe
  2⤵
  PID:4556
- C:\Windows\System\HmSjuTX.exe
  C:\Windows\System\HmSjuTX.exe
  2⤵
  PID:4424
- C:\Windows\System\ofdkjKv.exe
  C:\Windows\System\ofdkjKv.exe
  2⤵
  PID:1660
- C:\Windows\System\RloDPBk.exe
  C:\Windows\System\RloDPBk.exe
  2⤵
  PID:4724
- C:\Windows\System\lxARvJx.exe
  C:\Windows\System\lxARvJx.exe
  2⤵
  PID:4788
- C:\Windows\System\ZRWCEQN.exe
  C:\Windows\System\ZRWCEQN.exe
  2⤵
  PID:4856
- C:\Windows\System\jTIdjup.exe
  C:\Windows\System\jTIdjup.exe
  2⤵
  PID:4864
- C:\Windows\System\PsQiuuf.exe
  C:\Windows\System\PsQiuuf.exe
  2⤵
  PID:4932
- C:\Windows\System\xkpUGRz.exe
  C:\Windows\System\xkpUGRz.exe
  2⤵
  PID:4964
- C:\Windows\System\PDFrgXW.exe
  C:\Windows\System\PDFrgXW.exe
  2⤵
  PID:3984
- C:\Windows\System\aVHkrcH.exe
  C:\Windows\System\aVHkrcH.exe
  2⤵
  PID:5024
- C:\Windows\System\vgDNJAw.exe
  C:\Windows\System\vgDNJAw.exe
  2⤵
  PID:5056
- C:\Windows\System\nochRQc.exe
  C:\Windows\System\nochRQc.exe
  2⤵
  PID:4948
- C:\Windows\System\uFgKxnF.exe
  C:\Windows\System\uFgKxnF.exe
  2⤵
  PID:3756
- C:\Windows\System\TpQGWpS.exe
  C:\Windows\System\TpQGWpS.exe
  2⤵
  PID:3704
- C:\Windows\System\jxezlZC.exe
  C:\Windows\System\jxezlZC.exe
  2⤵
  PID:3884
- C:\Windows\System\yMfmWVS.exe
  C:\Windows\System\yMfmWVS.exe
  2⤵
  PID:4048
- C:\Windows\System\vzDpFuM.exe
  C:\Windows\System\vzDpFuM.exe
  2⤵
  PID:4300
- C:\Windows\System\FGhlEgs.exe
  C:\Windows\System\FGhlEgs.exe
  2⤵
  PID:4436
- C:\Windows\System\nOSgpsq.exe
  C:\Windows\System\nOSgpsq.exe
  2⤵
  PID:4440
- C:\Windows\System\UGTCYVM.exe
  C:\Windows\System\UGTCYVM.exe
  2⤵
  PID:4608
- C:\Windows\System\BYdfiIq.exe
  C:\Windows\System\BYdfiIq.exe
  2⤵
  PID:3772
- C:\Windows\System\kOoprng.exe
  C:\Windows\System\kOoprng.exe
  2⤵
  PID:1800
- C:\Windows\System\awRkCqP.exe
  C:\Windows\System\awRkCqP.exe
  2⤵
  PID:3512
- C:\Windows\System\FvzkzrW.exe
  C:\Windows\System\FvzkzrW.exe
  2⤵
  PID:3580
- C:\Windows\System\NVbHFVN.exe
  C:\Windows\System\NVbHFVN.exe
  2⤵
  PID:3132
- C:\Windows\System\ZqzlxDc.exe
  C:\Windows\System\ZqzlxDc.exe
  2⤵
  PID:4216
- C:\Windows\System\FuetCVq.exe
  C:\Windows\System\FuetCVq.exe
  2⤵
  PID:4456
- C:\Windows\System\PqoYSbX.exe
  C:\Windows\System\PqoYSbX.exe
  2⤵
  PID:4900
- C:\Windows\System\EPNOISF.exe
  C:\Windows\System\EPNOISF.exe
  2⤵
  PID:4076
- C:\Windows\System\exJQwDi.exe
  C:\Windows\System\exJQwDi.exe
  2⤵
  PID:4028
- C:\Windows\System\LPAfzAS.exe
  C:\Windows\System\LPAfzAS.exe
  2⤵
  PID:1552
- C:\Windows\System\ayUaZEs.exe
  C:\Windows\System\ayUaZEs.exe
  2⤵
  PID:5088
- C:\Windows\System\EmLiwEF.exe
  C:\Windows\System\EmLiwEF.exe
  2⤵
  PID:404
- C:\Windows\System\oIlEfhz.exe
  C:\Windows\System\oIlEfhz.exe
  2⤵
  PID:3128
- C:\Windows\System\INhpemA.exe
  C:\Windows\System\INhpemA.exe
  2⤵
  PID:3916
- C:\Windows\System\XrZbsiM.exe
  C:\Windows\System\XrZbsiM.exe
  2⤵
  PID:3940
- C:\Windows\System\BumzWts.exe
  C:\Windows\System\BumzWts.exe
  2⤵
  PID:4468
- C:\Windows\System\YprbyvU.exe
  C:\Windows\System\YprbyvU.exe
  2⤵
  PID:4372
- C:\Windows\System\WYrucDx.exe
  C:\Windows\System\WYrucDx.exe
  2⤵
  PID:4032
- C:\Windows\System\xMkOOCp.exe
  C:\Windows\System\xMkOOCp.exe
  2⤵
  PID:3528
- C:\Windows\System\KEwMRMK.exe
  C:\Windows\System\KEwMRMK.exe
  2⤵
  PID:4144
- C:\Windows\System\uvhStwI.exe
  C:\Windows\System\uvhStwI.exe
  2⤵
  PID:3552
- C:\Windows\System\yoMEYRS.exe
  C:\Windows\System\yoMEYRS.exe
  2⤵
  PID:4416
- C:\Windows\System\qKBLVTR.exe
  C:\Windows\System\qKBLVTR.exe
  2⤵
  PID:4896
- C:\Windows\System\xjxUFxP.exe
  C:\Windows\System\xjxUFxP.exe
  2⤵
  PID:5076
- C:\Windows\System\pzTAHRv.exe
  C:\Windows\System\pzTAHRv.exe
  2⤵
  PID:4776
- C:\Windows\System\qfglqLd.exe
  C:\Windows\System\qfglqLd.exe
  2⤵
  PID:3752
- C:\Windows\System\HJIyjKI.exe
  C:\Windows\System\HJIyjKI.exe
  2⤵
  PID:4772
- C:\Windows\System\zhghuti.exe
  C:\Windows\System\zhghuti.exe
  2⤵
  PID:3888
- C:\Windows\System\eMogZTJ.exe
  C:\Windows\System\eMogZTJ.exe
  2⤵
  PID:4236
- C:\Windows\System\mYHEyKR.exe
  C:\Windows\System\mYHEyKR.exe
  2⤵
  PID:3824
- C:\Windows\System\xQAkEty.exe
  C:\Windows\System\xQAkEty.exe
  2⤵
  PID:4320
- C:\Windows\System\CuZHkiE.exe
  C:\Windows\System\CuZHkiE.exe
  2⤵
  PID:4368
- C:\Windows\System\pyToaiV.exe
  C:\Windows\System\pyToaiV.exe
  2⤵
  PID:4728
- C:\Windows\System\nJINjIX.exe
  C:\Windows\System\nJINjIX.exe
  2⤵
  PID:5128
- C:\Windows\System\BVosiGq.exe
  C:\Windows\System\BVosiGq.exe
  2⤵
  PID:5148
- C:\Windows\System\wIOgHOF.exe
  C:\Windows\System\wIOgHOF.exe
  2⤵
  PID:5188
- C:\Windows\System\SpTkMUN.exe
  C:\Windows\System\SpTkMUN.exe
  2⤵
  PID:5224
- C:\Windows\System\QUrsurW.exe
  C:\Windows\System\QUrsurW.exe
  2⤵
  PID:5240
- C:\Windows\System\oxPZLOq.exe
  C:\Windows\System\oxPZLOq.exe
  2⤵
  PID:5256
- C:\Windows\System\ubAOQhz.exe
  C:\Windows\System\ubAOQhz.exe
  2⤵
  PID:5272
- C:\Windows\System\yZGSOsj.exe
  C:\Windows\System\yZGSOsj.exe
  2⤵
  PID:5288
- C:\Windows\System\Gyepbqg.exe
  C:\Windows\System\Gyepbqg.exe
  2⤵
  PID:5304
- C:\Windows\System\HjkzGZT.exe
  C:\Windows\System\HjkzGZT.exe
  2⤵
  PID:5320
- C:\Windows\System\cniAVKb.exe
  C:\Windows\System\cniAVKb.exe
  2⤵
  PID:5336
- C:\Windows\System\qOaygWs.exe
  C:\Windows\System\qOaygWs.exe
  2⤵
  PID:5352
- C:\Windows\System\fKZpTwl.exe
  C:\Windows\System\fKZpTwl.exe
  2⤵
  PID:5368
- C:\Windows\System\bqkZILK.exe
  C:\Windows\System\bqkZILK.exe
  2⤵
  PID:5384
- C:\Windows\System\dvvpnQe.exe
  C:\Windows\System\dvvpnQe.exe
  2⤵
  PID:5400
- C:\Windows\System\zDhFWmn.exe
  C:\Windows\System\zDhFWmn.exe
  2⤵
  PID:5416
- C:\Windows\System\EVpGqYW.exe
  C:\Windows\System\EVpGqYW.exe
  2⤵
  PID:5432
- C:\Windows\System\JNaeifX.exe
  C:\Windows\System\JNaeifX.exe
  2⤵
  PID:5448
- C:\Windows\System\BcheQeh.exe
  C:\Windows\System\BcheQeh.exe
  2⤵
  PID:5464
- C:\Windows\System\fOXFAqt.exe
  C:\Windows\System\fOXFAqt.exe
  2⤵
  PID:5480
- C:\Windows\System\EJYJcIk.exe
  C:\Windows\System\EJYJcIk.exe
  2⤵
  PID:5540
- C:\Windows\System\VijBFuz.exe
  C:\Windows\System\VijBFuz.exe
  2⤵
  PID:5580
- C:\Windows\System\jRgkxtQ.exe
  C:\Windows\System\jRgkxtQ.exe
  2⤵
  PID:5608
- C:\Windows\System\xYNAHri.exe
  C:\Windows\System\xYNAHri.exe
  2⤵
  PID:5628
- C:\Windows\System\TmTKugb.exe
  C:\Windows\System\TmTKugb.exe
  2⤵
  PID:5648
- C:\Windows\System\lXpKtYe.exe
  C:\Windows\System\lXpKtYe.exe
  2⤵
  PID:5664
- C:\Windows\System\wOiPpeV.exe
  C:\Windows\System\wOiPpeV.exe
  2⤵
  PID:5684
- C:\Windows\System\nsCAyWx.exe
  C:\Windows\System\nsCAyWx.exe
  2⤵
  PID:5704
- C:\Windows\System\lsaxOSu.exe
  C:\Windows\System\lsaxOSu.exe
  2⤵
  PID:5720
- C:\Windows\System\CdtepnJ.exe
  C:\Windows\System\CdtepnJ.exe
  2⤵
  PID:5736
- C:\Windows\System\MyZNcjG.exe
  C:\Windows\System\MyZNcjG.exe
  2⤵
  PID:5752
- C:\Windows\System\jdoXJRw.exe
  C:\Windows\System\jdoXJRw.exe
  2⤵
  PID:5772
- C:\Windows\System\NVcDecl.exe
  C:\Windows\System\NVcDecl.exe
  2⤵
  PID:5836
- C:\Windows\System\CZnRAtQ.exe
  C:\Windows\System\CZnRAtQ.exe
  2⤵
  PID:5860
- C:\Windows\System\JbXcrDq.exe
  C:\Windows\System\JbXcrDq.exe
  2⤵
  PID:5876
- C:\Windows\System\GtxxKsR.exe
  C:\Windows\System\GtxxKsR.exe
  2⤵
  PID:5892
- C:\Windows\System\VhRSBzQ.exe
  C:\Windows\System\VhRSBzQ.exe
  2⤵
  PID:5908
- C:\Windows\System\OojYrbD.exe
  C:\Windows\System\OojYrbD.exe
  2⤵
  PID:5924
- C:\Windows\System\ypJnWIY.exe
  C:\Windows\System\ypJnWIY.exe
  2⤵
  PID:5940
- C:\Windows\System\SezPniU.exe
  C:\Windows\System\SezPniU.exe
  2⤵
  PID:5960
- C:\Windows\System\lxIABtf.exe
  C:\Windows\System\lxIABtf.exe
  2⤵
  PID:5976
- C:\Windows\System\nHHemMB.exe
  C:\Windows\System\nHHemMB.exe
  2⤵
  PID:5992
- C:\Windows\System\LOATqQg.exe
  C:\Windows\System\LOATqQg.exe
  2⤵
  PID:6008
- C:\Windows\System\RfgGECK.exe
  C:\Windows\System\RfgGECK.exe
  2⤵
  PID:6028
- C:\Windows\System\QdKxtRC.exe
  C:\Windows\System\QdKxtRC.exe
  2⤵
  PID:6044
- C:\Windows\System\OZRyDDq.exe
  C:\Windows\System\OZRyDDq.exe
  2⤵
  PID:6064
- C:\Windows\System\barxPlS.exe
  C:\Windows\System\barxPlS.exe
  2⤵
  PID:6080
- C:\Windows\System\vebAapR.exe
  C:\Windows\System\vebAapR.exe
  2⤵
  PID:6100
- C:\Windows\System\SrlGspi.exe
  C:\Windows\System\SrlGspi.exe
  2⤵
  PID:6116
- C:\Windows\System\luDZamV.exe
  C:\Windows\System\luDZamV.exe
  2⤵
  PID:6132
- C:\Windows\System\RUvyDdR.exe
  C:\Windows\System\RUvyDdR.exe
  2⤵
  PID:4960
- C:\Windows\System\MNItQoD.exe
  C:\Windows\System\MNItQoD.exe
  2⤵
  PID:3332
- C:\Windows\System\ndwwlTt.exe
  C:\Windows\System\ndwwlTt.exe
  2⤵
  PID:5136
- C:\Windows\System\vgdqyyn.exe
  C:\Windows\System\vgdqyyn.exe
  2⤵
  PID:344
- C:\Windows\System\mcneKFU.exe
  C:\Windows\System\mcneKFU.exe
  2⤵
  PID:4708
- C:\Windows\System\kpUVKbz.exe
  C:\Windows\System\kpUVKbz.exe
  2⤵
  PID:4824
- C:\Windows\System\TirHAVG.exe
  C:\Windows\System\TirHAVG.exe
  2⤵
  PID:5168
- C:\Windows\System\EfStpSl.exe
  C:\Windows\System\EfStpSl.exe
  2⤵
  PID:5172
- C:\Windows\System\bIpbNCp.exe
  C:\Windows\System\bIpbNCp.exe
  2⤵
  PID:5204
- C:\Windows\System\nuODbNZ.exe
  C:\Windows\System\nuODbNZ.exe
  2⤵
  PID:5208
- C:\Windows\System\SAvTxwa.exe
  C:\Windows\System\SAvTxwa.exe
  2⤵
  PID:5284
- C:\Windows\System\UkmSPVD.exe
  C:\Windows\System\UkmSPVD.exe
  2⤵
  PID:5232
- C:\Windows\System\DuqgqRq.exe
  C:\Windows\System\DuqgqRq.exe
  2⤵
  PID:5312
- C:\Windows\System\sGVaJOR.exe
  C:\Windows\System\sGVaJOR.exe
  2⤵
  PID:5348
- C:\Windows\System\RhEAiKH.exe
  C:\Windows\System\RhEAiKH.exe
  2⤵
  PID:5376
- C:\Windows\System\xDcrMFr.exe
  C:\Windows\System\xDcrMFr.exe
  2⤵
  PID:5412
- C:\Windows\System\QnebbiW.exe
  C:\Windows\System\QnebbiW.exe
  2⤵
  PID:5444
- C:\Windows\System\AlJmbgD.exe
  C:\Windows\System\AlJmbgD.exe
  2⤵
  PID:5476
- C:\Windows\System\gkJyqrs.exe
  C:\Windows\System\gkJyqrs.exe
  2⤵
  PID:5504
- C:\Windows\System\xKzhlyM.exe
  C:\Windows\System\xKzhlyM.exe
  2⤵
  PID:5524
- C:\Windows\System\LVrQyBZ.exe
  C:\Windows\System\LVrQyBZ.exe
  2⤵
  PID:5568
- C:\Windows\System\zVcngjd.exe
  C:\Windows\System\zVcngjd.exe
  2⤵
  PID:5548
- C:\Windows\System\ZGaMDWe.exe
  C:\Windows\System\ZGaMDWe.exe
  2⤵
  PID:5604
- C:\Windows\System\WrTWCpG.exe
  C:\Windows\System\WrTWCpG.exe
  2⤵
  PID:5616
- C:\Windows\System\SvwBAuF.exe
  C:\Windows\System\SvwBAuF.exe
  2⤵
  PID:5660
- C:\Windows\System\dImEdIq.exe
  C:\Windows\System\dImEdIq.exe
  2⤵
  PID:5656
- C:\Windows\System\lVythaY.exe
  C:\Windows\System\lVythaY.exe
  2⤵
  PID:5744
- C:\Windows\System\oGrydSh.exe
  C:\Windows\System\oGrydSh.exe
  2⤵
  PID:5696
- C:\Windows\System\YNlXrMN.exe
  C:\Windows\System\YNlXrMN.exe
  2⤵
  PID:5764
- C:\Windows\System\vpXLWms.exe
  C:\Windows\System\vpXLWms.exe
  2⤵
  PID:5796
- C:\Windows\System\LQMOyXG.exe
  C:\Windows\System\LQMOyXG.exe
  2⤵
  PID:5812
- C:\Windows\System\RjbvvIb.exe
  C:\Windows\System\RjbvvIb.exe
  2⤵
  PID:2776
- C:\Windows\System\xNgqoet.exe
  C:\Windows\System\xNgqoet.exe
  2⤵
  PID:5492
- C:\Windows\System\ueiRgEB.exe
  C:\Windows\System\ueiRgEB.exe
  2⤵
  PID:5884
- C:\Windows\System\xWKetoS.exe
  C:\Windows\System\xWKetoS.exe
  2⤵
  PID:5900
- C:\Windows\System\ogtsGuW.exe
  C:\Windows\System\ogtsGuW.exe
  2⤵
  PID:5936
- C:\Windows\System\EeuYHPY.exe
  C:\Windows\System\EeuYHPY.exe
  2⤵
  PID:6016
- C:\Windows\System\KluwhsM.exe
  C:\Windows\System\KluwhsM.exe
  2⤵
  PID:5508
- C:\Windows\System\ertGhtA.exe
  C:\Windows\System\ertGhtA.exe
  2⤵
  PID:5576
- C:\Windows\System\AzXTJfc.exe
  C:\Windows\System\AzXTJfc.exe
  2⤵
  PID:5620
- C:\Windows\System\nhEBggK.exe
  C:\Windows\System\nhEBggK.exe
  2⤵
  PID:5784
- C:\Windows\System\HhlXclr.exe
  C:\Windows\System\HhlXclr.exe
  2⤵
  PID:5828
- C:\Windows\System\mbWDADB.exe
  C:\Windows\System\mbWDADB.exe
  2⤵
  PID:5728
- C:\Windows\System\mjLPCOy.exe
  C:\Windows\System\mjLPCOy.exe
  2⤵
  PID:5596
- C:\Windows\System\PASahex.exe
  C:\Windows\System\PASahex.exe
  2⤵
  PID:6020
- C:\Windows\System\yOsmtOQ.exe
  C:\Windows\System\yOsmtOQ.exe
  2⤵
  PID:5984
- C:\Windows\System\rthzNuG.exe
  C:\Windows\System\rthzNuG.exe
  2⤵
  PID:5952
- C:\Windows\System\SotJCSz.exe
  C:\Windows\System\SotJCSz.exe
  2⤵
  PID:4880
- C:\Windows\System\ykLpNmP.exe
  C:\Windows\System\ykLpNmP.exe
  2⤵
  PID:6108
- C:\Windows\System\sDDiqDs.exe
  C:\Windows\System\sDDiqDs.exe
  2⤵
  PID:6112
- C:\Windows\System\lpeNNVd.exe
  C:\Windows\System\lpeNNVd.exe
  2⤵
  PID:6072
- C:\Windows\System\OkMZIQW.exe
  C:\Windows\System\OkMZIQW.exe
  2⤵
  PID:6140
- C:\Windows\System\HDnKRqF.exe
  C:\Windows\System\HDnKRqF.exe
  2⤵
  PID:1788
- C:\Windows\System\dJaDAIL.exe
  C:\Windows\System\dJaDAIL.exe
  2⤵
  PID:5156
- C:\Windows\System\phUZiHV.exe
  C:\Windows\System\phUZiHV.exe
  2⤵
  PID:5264
- C:\Windows\System\gCCEJIV.exe
  C:\Windows\System\gCCEJIV.exe
  2⤵
  PID:5460
- C:\Windows\System\NNXYhMQ.exe
  C:\Windows\System\NNXYhMQ.exe
  2⤵
  PID:5440
- C:\Windows\System\rRZIJgn.exe
  C:\Windows\System\rRZIJgn.exe
  2⤵
  PID:5532
- C:\Windows\System\HOnEGaq.exe
  C:\Windows\System\HOnEGaq.exe
  2⤵
  PID:5552
- C:\Windows\System\znKpekJ.exe
  C:\Windows\System\znKpekJ.exe
  2⤵
  PID:5644
- C:\Windows\System\njBCGYn.exe
  C:\Windows\System\njBCGYn.exe
  2⤵
  PID:5800
- C:\Windows\System\XUTfnRZ.exe
  C:\Windows\System\XUTfnRZ.exe
  2⤵
  PID:5692
- C:\Windows\System\UGqXYRA.exe
  C:\Windows\System\UGqXYRA.exe
  2⤵
  PID:5712
- C:\Windows\System\BwDrcdw.exe
  C:\Windows\System\BwDrcdw.exe
  2⤵
  PID:5916
- C:\Windows\System\ZiFjZoW.exe
  C:\Windows\System\ZiFjZoW.exe
  2⤵
  PID:5672
- C:\Windows\System\geWzihu.exe
  C:\Windows\System\geWzihu.exe
  2⤵
  PID:6128
- C:\Windows\System\rncXXoy.exe
  C:\Windows\System\rncXXoy.exe
  2⤵
  PID:6036
- C:\Windows\System\xhQCuuB.exe
  C:\Windows\System\xhQCuuB.exe
  2⤵
  PID:5216
- C:\Windows\System\mKrPRYo.exe
  C:\Windows\System\mKrPRYo.exe
  2⤵
  PID:5500
- C:\Windows\System\zcmEbcn.exe
  C:\Windows\System\zcmEbcn.exe
  2⤵
  PID:5872
- C:\Windows\System\ONtQSQX.exe
  C:\Windows\System\ONtQSQX.exe
  2⤵
  PID:5360
- C:\Windows\System\ZNgysgk.exe
  C:\Windows\System\ZNgysgk.exe
  2⤵
  PID:5344
- C:\Windows\System\xmYNIYl.exe
  C:\Windows\System\xmYNIYl.exe
  2⤵
  PID:5328
- C:\Windows\System\mWiqRJV.exe
  C:\Windows\System\mWiqRJV.exe
  2⤵
  PID:5556
- C:\Windows\System\VevBKQi.exe
  C:\Windows\System\VevBKQi.exe
  2⤵
  PID:6160
- C:\Windows\System\AQnFpfZ.exe
  C:\Windows\System\AQnFpfZ.exe
  2⤵
  PID:6176
- C:\Windows\System\oIfHhyy.exe
  C:\Windows\System\oIfHhyy.exe
  2⤵
  PID:6192
- C:\Windows\System\SYojeMs.exe
  C:\Windows\System\SYojeMs.exe
  2⤵
  PID:6208
- C:\Windows\System\NtLsZlz.exe
  C:\Windows\System\NtLsZlz.exe
  2⤵
  PID:6228
- C:\Windows\System\avvYToi.exe
  C:\Windows\System\avvYToi.exe
  2⤵
  PID:6244
- C:\Windows\System\qFRjSkL.exe
  C:\Windows\System\qFRjSkL.exe
  2⤵
  PID:6260
- C:\Windows\System\PVuZNJK.exe
  C:\Windows\System\PVuZNJK.exe
  2⤵
  PID:6280
- C:\Windows\System\LNjavzo.exe
  C:\Windows\System\LNjavzo.exe
  2⤵
  PID:6296
- C:\Windows\System\gGKKyfG.exe
  C:\Windows\System\gGKKyfG.exe
  2⤵
  PID:6312
- C:\Windows\System\tQLBPQW.exe
  C:\Windows\System\tQLBPQW.exe
  2⤵
  PID:6328
- C:\Windows\System\sajnARy.exe
  C:\Windows\System\sajnARy.exe
  2⤵
  PID:6348
- C:\Windows\System\RQNjjnF.exe
  C:\Windows\System\RQNjjnF.exe
  2⤵
  PID:6364
- C:\Windows\System\NkbAcMH.exe
  C:\Windows\System\NkbAcMH.exe
  2⤵
  PID:6436
- C:\Windows\System\TSleunC.exe
  C:\Windows\System\TSleunC.exe
  2⤵
  PID:6452
- C:\Windows\System\mmcmCOs.exe
  C:\Windows\System\mmcmCOs.exe
  2⤵
  PID:6468
- C:\Windows\System\KRozsfG.exe
  C:\Windows\System\KRozsfG.exe
  2⤵
  PID:6484
- C:\Windows\System\pJIvldE.exe
  C:\Windows\System\pJIvldE.exe
  2⤵
  PID:6500
- C:\Windows\System\KNcrUvD.exe
  C:\Windows\System\KNcrUvD.exe
  2⤵
  PID:6516
- C:\Windows\System\OPKrcEj.exe
  C:\Windows\System\OPKrcEj.exe
  2⤵
  PID:6532
- C:\Windows\System\DuvHSsq.exe
  C:\Windows\System\DuvHSsq.exe
  2⤵
  PID:6548
- C:\Windows\System\wFlGCsU.exe
  C:\Windows\System\wFlGCsU.exe
  2⤵
  PID:6564
- C:\Windows\System\qdmlzsG.exe
  C:\Windows\System\qdmlzsG.exe
  2⤵
  PID:6584
- C:\Windows\System\ydLmpnJ.exe
  C:\Windows\System\ydLmpnJ.exe
  2⤵
  PID:6600
- C:\Windows\System\ukNOgPD.exe
  C:\Windows\System\ukNOgPD.exe
  2⤵
  PID:6620
- C:\Windows\System\SURHmaD.exe
  C:\Windows\System\SURHmaD.exe
  2⤵
  PID:6640
- C:\Windows\System\cxzarQc.exe
  C:\Windows\System\cxzarQc.exe
  2⤵
  PID:6656
- C:\Windows\System\HCoOllN.exe
  C:\Windows\System\HCoOllN.exe
  2⤵
  PID:6672
- C:\Windows\System\NzzBFWF.exe
  C:\Windows\System\NzzBFWF.exe
  2⤵
  PID:6748
- C:\Windows\System\aJWkwph.exe
  C:\Windows\System\aJWkwph.exe
  2⤵
  PID:6764
- C:\Windows\System\ESYIzac.exe
  C:\Windows\System\ESYIzac.exe
  2⤵
  PID:6780
- C:\Windows\System\kNfSZhm.exe
  C:\Windows\System\kNfSZhm.exe
  2⤵
  PID:6796
- C:\Windows\System\bjnQQHG.exe
  C:\Windows\System\bjnQQHG.exe
  2⤵
  PID:6812
- C:\Windows\System\HouUSSE.exe
  C:\Windows\System\HouUSSE.exe
  2⤵
  PID:6828
- C:\Windows\System\WAYkvPv.exe
  C:\Windows\System\WAYkvPv.exe
  2⤵
  PID:6860
- C:\Windows\System\sgRAezu.exe
  C:\Windows\System\sgRAezu.exe
  2⤵
  PID:6884
- C:\Windows\System\ZgNWTmF.exe
  C:\Windows\System\ZgNWTmF.exe
  2⤵
  PID:6900
- C:\Windows\System\fUvziym.exe
  C:\Windows\System\fUvziym.exe
  2⤵
  PID:6916
- C:\Windows\System\ovdbGpl.exe
  C:\Windows\System\ovdbGpl.exe
  2⤵
  PID:6932
- C:\Windows\System\QknHvrL.exe
  C:\Windows\System\QknHvrL.exe
  2⤵
  PID:6948
- C:\Windows\System\QvaWkZg.exe
  C:\Windows\System\QvaWkZg.exe
  2⤵
  PID:6972
- C:\Windows\System\PnIlNuD.exe
  C:\Windows\System\PnIlNuD.exe
  2⤵
  PID:6988
- C:\Windows\System\QfhwOGV.exe
  C:\Windows\System\QfhwOGV.exe
  2⤵
  PID:7012
- C:\Windows\System\cVxqqpu.exe
  C:\Windows\System\cVxqqpu.exe
  2⤵
  PID:7028
- C:\Windows\System\qhayoDw.exe
  C:\Windows\System\qhayoDw.exe
  2⤵
  PID:7044
- C:\Windows\System\kZmFmKE.exe
  C:\Windows\System\kZmFmKE.exe
  2⤵
  PID:7064
- C:\Windows\System\ogxxrus.exe
  C:\Windows\System\ogxxrus.exe
  2⤵
  PID:7080
- C:\Windows\System\fWYuhjv.exe
  C:\Windows\System\fWYuhjv.exe
  2⤵
  PID:7096
- C:\Windows\System\mpNhUPh.exe
  C:\Windows\System\mpNhUPh.exe
  2⤵
  PID:7116
- C:\Windows\System\uLjrQyA.exe
  C:\Windows\System\uLjrQyA.exe
  2⤵
  PID:7152
- C:\Windows\System\MhIdGqC.exe
  C:\Windows\System\MhIdGqC.exe
  2⤵
  PID:3672
- C:\Windows\System\ujcxilE.exe
  C:\Windows\System\ujcxilE.exe
  2⤵
  PID:5920
- C:\Windows\System\ncCfwyL.exe
  C:\Windows\System\ncCfwyL.exe
  2⤵
  PID:5852
- C:\Windows\System\sTbPMip.exe
  C:\Windows\System\sTbPMip.exe
  2⤵
  PID:6256
- C:\Windows\System\HsycCJP.exe
  C:\Windows\System\HsycCJP.exe
  2⤵
  PID:6148
- C:\Windows\System\lrHeQTr.exe
  C:\Windows\System\lrHeQTr.exe
  2⤵
  PID:6060
- C:\Windows\System\ESpfaFC.exe
  C:\Windows\System\ESpfaFC.exe
  2⤵
  PID:5252
- C:\Windows\System\ddaFhzL.exe
  C:\Windows\System\ddaFhzL.exe
  2⤵
  PID:5160
- C:\Windows\System\WJHmtmb.exe
  C:\Windows\System\WJHmtmb.exe
  2⤵
  PID:6340
- C:\Windows\System\uAdVucl.exe
  C:\Windows\System\uAdVucl.exe
  2⤵
  PID:6344
- C:\Windows\System\nXilDcB.exe
  C:\Windows\System\nXilDcB.exe
  2⤵
  PID:6388
- C:\Windows\System\VxTNZJj.exe
  C:\Windows\System\VxTNZJj.exe
  2⤵
  PID:6404
- C:\Windows\System\EHSQLbV.exe
  C:\Windows\System\EHSQLbV.exe
  2⤵
  PID:6320
- C:\Windows\System\mqWByNO.exe
  C:\Windows\System\mqWByNO.exe
  2⤵
  PID:6424
- C:\Windows\System\QItExsl.exe
  C:\Windows\System\QItExsl.exe
  2⤵
  PID:6356
- C:\Windows\System\GmaYLuE.exe
  C:\Windows\System\GmaYLuE.exe
  2⤵
  PID:6492
- C:\Windows\System\IWZtCLA.exe
  C:\Windows\System\IWZtCLA.exe
  2⤵
  PID:6556
- C:\Windows\System\YCfGsul.exe
  C:\Windows\System\YCfGsul.exe
  2⤵
  PID:6628
- C:\Windows\System\rkAzrtk.exe
  C:\Windows\System\rkAzrtk.exe
  2⤵
  PID:6448
- C:\Windows\System\KEULAVo.exe
  C:\Windows\System\KEULAVo.exe
  2⤵
  PID:6540
- C:\Windows\System\xfCmJKp.exe
  C:\Windows\System\xfCmJKp.exe
  2⤵
  PID:6580
- C:\Windows\System\DPdgLsa.exe
  C:\Windows\System\DPdgLsa.exe
  2⤵
  PID:6684
- C:\Windows\System\KfnkyVj.exe
  C:\Windows\System\KfnkyVj.exe
  2⤵
  PID:6668
- C:\Windows\System\oNPyHKF.exe
  C:\Windows\System\oNPyHKF.exe
  2⤵
  PID:6708
- C:\Windows\System\KIbTcWZ.exe
  C:\Windows\System\KIbTcWZ.exe
  2⤵
  PID:6696
- C:\Windows\System\pNTFdiO.exe
  C:\Windows\System\pNTFdiO.exe
  2⤵
  PID:6728
- C:\Windows\System\PdGDClI.exe
  C:\Windows\System\PdGDClI.exe
  2⤵
  PID:2836
- C:\Windows\System\vSrczKb.exe
  C:\Windows\System\vSrczKb.exe
  2⤵
  PID:6760
- C:\Windows\System\oYEUDht.exe
  C:\Windows\System\oYEUDht.exe
  2⤵
  PID:6808
- C:\Windows\System\FqxYyGU.exe
  C:\Windows\System\FqxYyGU.exe
  2⤵
  PID:6912
- C:\Windows\System\jOWntLG.exe
  C:\Windows\System\jOWntLG.exe
  2⤵
  PID:6944
- C:\Windows\System\BLkjliD.exe
  C:\Windows\System\BLkjliD.exe
  2⤵
  PID:6980
- C:\Windows\System\giTdzQb.exe
  C:\Windows\System\giTdzQb.exe
  2⤵
  PID:7020
- C:\Windows\System\pbFxASh.exe
  C:\Windows\System\pbFxASh.exe
  2⤵
  PID:7004
- C:\Windows\System\REkcWNT.exe
  C:\Windows\System\REkcWNT.exe
  2⤵
  PID:7092
- C:\Windows\System\fVwWODx.exe
  C:\Windows\System\fVwWODx.exe
  2⤵
  PID:7128
- C:\Windows\System\RVhBCPf.exe
  C:\Windows\System\RVhBCPf.exe
  2⤵
  PID:6632
- C:\Windows\System\oUfvRIh.exe
  C:\Windows\System\oUfvRIh.exe
  2⤵
  PID:7144
- C:\Windows\System\azonhJW.exe
  C:\Windows\System\azonhJW.exe
  2⤵
  PID:4080
- C:\Windows\System\BAsvNob.exe
  C:\Windows\System\BAsvNob.exe
  2⤵
  PID:4388
- C:\Windows\System\MhiCYrl.exe
  C:\Windows\System\MhiCYrl.exe
  2⤵
  PID:6184
- C:\Windows\System\wBTSHkE.exe
  C:\Windows\System\wBTSHkE.exe
  2⤵
  PID:5968
- C:\Windows\System\TWDEgIj.exe
  C:\Windows\System\TWDEgIj.exe
  2⤵
  PID:6292
- C:\Windows\System\sThOoSt.exe
  C:\Windows\System\sThOoSt.exe
  2⤵
  PID:5832
- C:\Windows\System\mjbOCiD.exe
  C:\Windows\System\mjbOCiD.exe
  2⤵
  PID:6168
- C:\Windows\System\HVztnul.exe
  C:\Windows\System\HVztnul.exe
  2⤵
  PID:6396
- C:\Windows\System\sFMKJuy.exe
  C:\Windows\System\sFMKJuy.exe
  2⤵
  PID:6384
- C:\Windows\System\agtpKzL.exe
  C:\Windows\System\agtpKzL.exe
  2⤵
  PID:6508
- C:\Windows\System\USuZDgr.exe
  C:\Windows\System\USuZDgr.exe
  2⤵
  PID:6724
- C:\Windows\System\iHvolGu.exe
  C:\Windows\System\iHvolGu.exe
  2⤵
  PID:6792
- C:\Windows\System\ODUGWbo.exe
  C:\Windows\System\ODUGWbo.exe
  2⤵
  PID:6528
- C:\Windows\System\CZSgoFj.exe
  C:\Windows\System\CZSgoFj.exe
  2⤵
  PID:6576
- C:\Windows\System\cGiIfuU.exe
  C:\Windows\System\cGiIfuU.exe
  2⤵
  PID:6720
- C:\Windows\System\BwZIicz.exe
  C:\Windows\System\BwZIicz.exe
  2⤵
  PID:6804
- C:\Windows\System\XSsSXRK.exe
  C:\Windows\System\XSsSXRK.exe
  2⤵
  PID:7088
- C:\Windows\System\jubymJQ.exe
  C:\Windows\System\jubymJQ.exe
  2⤵
  PID:7136
- C:\Windows\System\JgnQpyj.exe
  C:\Windows\System\JgnQpyj.exe
  2⤵
  PID:5196
- C:\Windows\System\POhXSez.exe
  C:\Windows\System\POhXSez.exe
  2⤵
  PID:6960
- C:\Windows\System\pUXwJwc.exe
  C:\Windows\System\pUXwJwc.exe
  2⤵
  PID:7000
- C:\Windows\System\ASbYcEV.exe
  C:\Windows\System\ASbYcEV.exe
  2⤵
  PID:6308
- C:\Windows\System\Eauywhx.exe
  C:\Windows\System\Eauywhx.exe
  2⤵
  PID:6204
- C:\Windows\System\cqeYxTt.exe
  C:\Windows\System\cqeYxTt.exe
  2⤵
  PID:6616
- C:\Windows\System\NsgVoTH.exe
  C:\Windows\System\NsgVoTH.exe
  2⤵
  PID:6460
- C:\Windows\System\mfaaZCM.exe
  C:\Windows\System\mfaaZCM.exe
  2⤵
  PID:7104
- C:\Windows\System\IxADsMf.exe
  C:\Windows\System\IxADsMf.exe
  2⤵
  PID:904
- C:\Windows\System\hjacbkZ.exe
  C:\Windows\System\hjacbkZ.exe
  2⤵
  PID:6156
- C:\Windows\System\YtsUXwm.exe
  C:\Windows\System\YtsUXwm.exe
  2⤵
  PID:6788
- C:\Windows\System\WUwEhrN.exe
  C:\Windows\System\WUwEhrN.exe
  2⤵
  PID:6880
- C:\Windows\System\TsxiPGA.exe
  C:\Windows\System\TsxiPGA.exe
  2⤵
  PID:6776
- C:\Windows\System\QHaJeKI.exe
  C:\Windows\System\QHaJeKI.exe
  2⤵
  PID:6252
- C:\Windows\System\sRPCgsF.exe
  C:\Windows\System\sRPCgsF.exe
  2⤵
  PID:5176
- C:\Windows\System\jhGxheb.exe
  C:\Windows\System\jhGxheb.exe
  2⤵
  PID:6464
- C:\Windows\System\qBwHTng.exe
  C:\Windows\System\qBwHTng.exe
  2⤵
  PID:7060
- C:\Windows\System\Rxgxfzq.exe
  C:\Windows\System\Rxgxfzq.exe
  2⤵
  PID:4980
- C:\Windows\System\FLtTcgU.exe
  C:\Windows\System\FLtTcgU.exe
  2⤵
  PID:6896
- C:\Windows\System\RWXSAmv.exe
  C:\Windows\System\RWXSAmv.exe
  2⤵
  PID:6840
- C:\Windows\System\uTOGWzO.exe
  C:\Windows\System\uTOGWzO.exe
  2⤵
  PID:6852
- C:\Windows\System\QhrQnnE.exe
  C:\Windows\System\QhrQnnE.exe
  2⤵
  PID:5300
- C:\Windows\System\bwmGhqe.exe
  C:\Windows\System\bwmGhqe.exe
  2⤵
  PID:6188
- C:\Windows\System\iUcDRyD.exe
  C:\Windows\System\iUcDRyD.exe
  2⤵
  PID:7180
- C:\Windows\System\wKIJdzu.exe
  C:\Windows\System\wKIJdzu.exe
  2⤵
  PID:7196
- C:\Windows\System\amjDgHB.exe
  C:\Windows\System\amjDgHB.exe
  2⤵
  PID:7212
- C:\Windows\System\KBIvyPh.exe
  C:\Windows\System\KBIvyPh.exe
  2⤵
  PID:7228
- C:\Windows\System\dBBBvaM.exe
  C:\Windows\System\dBBBvaM.exe
  2⤵
  PID:7248
- C:\Windows\System\uHyeAmk.exe
  C:\Windows\System\uHyeAmk.exe
  2⤵
  PID:7268
- C:\Windows\System\WpnHdfa.exe
  C:\Windows\System\WpnHdfa.exe
  2⤵
  PID:7332
- C:\Windows\System\lqScbuQ.exe
  C:\Windows\System\lqScbuQ.exe
  2⤵
  PID:7348
- C:\Windows\System\KDDzLOQ.exe
  C:\Windows\System\KDDzLOQ.exe
  2⤵
  PID:7368
- C:\Windows\System\LCEYMPX.exe
  C:\Windows\System\LCEYMPX.exe
  2⤵
  PID:7384
- C:\Windows\System\dsDhQqR.exe
  C:\Windows\System\dsDhQqR.exe
  2⤵
  PID:7400
- C:\Windows\System\XSyiQck.exe
  C:\Windows\System\XSyiQck.exe
  2⤵
  PID:7420
- C:\Windows\System\FVQJQMG.exe
  C:\Windows\System\FVQJQMG.exe
  2⤵
  PID:7436
- C:\Windows\System\URWlZpQ.exe
  C:\Windows\System\URWlZpQ.exe
  2⤵
  PID:7452
- C:\Windows\System\BGwmWLX.exe
  C:\Windows\System\BGwmWLX.exe
  2⤵
  PID:7468
- C:\Windows\System\zEWmMvF.exe
  C:\Windows\System\zEWmMvF.exe
  2⤵
  PID:7492
- C:\Windows\System\ecGspZL.exe
  C:\Windows\System\ecGspZL.exe
  2⤵
  PID:7508
- C:\Windows\System\OTnNkFG.exe
  C:\Windows\System\OTnNkFG.exe
  2⤵
  PID:7528
- C:\Windows\System\scJFRid.exe
  C:\Windows\System\scJFRid.exe
  2⤵
  PID:7544
- C:\Windows\System\lAXJoUB.exe
  C:\Windows\System\lAXJoUB.exe
  2⤵
  PID:7560
- C:\Windows\System\JfDhsuI.exe
  C:\Windows\System\JfDhsuI.exe
  2⤵
  PID:7576
- C:\Windows\System\xnYsoLt.exe
  C:\Windows\System\xnYsoLt.exe
  2⤵
  PID:7592
- C:\Windows\System\QJxMkOe.exe
  C:\Windows\System\QJxMkOe.exe
  2⤵
  PID:7612
- C:\Windows\System\xkMvPmU.exe
  C:\Windows\System\xkMvPmU.exe
  2⤵
  PID:7628
- C:\Windows\System\lvWHsvp.exe
  C:\Windows\System\lvWHsvp.exe
  2⤵
  PID:7644
- C:\Windows\System\ApRcLOq.exe
  C:\Windows\System\ApRcLOq.exe
  2⤵
  PID:7660
- C:\Windows\System\UESBCXD.exe
  C:\Windows\System\UESBCXD.exe
  2⤵
  PID:7676
- C:\Windows\System\GFdYmsW.exe
  C:\Windows\System\GFdYmsW.exe
  2⤵
  PID:7692
- C:\Windows\System\CfBSRqb.exe
  C:\Windows\System\CfBSRqb.exe
  2⤵
  PID:7708
- C:\Windows\System\ybFYALS.exe
  C:\Windows\System\ybFYALS.exe
  2⤵
  PID:7728
- C:\Windows\System\YPaorUB.exe
  C:\Windows\System\YPaorUB.exe
  2⤵
  PID:7744
- C:\Windows\System\IrHvIoN.exe
  C:\Windows\System\IrHvIoN.exe
  2⤵
  PID:7764
- C:\Windows\System\GLOmxNP.exe
  C:\Windows\System\GLOmxNP.exe
  2⤵
  PID:7784
- C:\Windows\System\iQhIgXZ.exe
  C:\Windows\System\iQhIgXZ.exe
  2⤵
  PID:7804
- C:\Windows\System\DjliqcC.exe
  C:\Windows\System\DjliqcC.exe
  2⤵
  PID:7824
- C:\Windows\System\gYduHZQ.exe
  C:\Windows\System\gYduHZQ.exe
  2⤵
  PID:7844
- C:\Windows\System\mklajsr.exe
  C:\Windows\System\mklajsr.exe
  2⤵
  PID:7860
- C:\Windows\System\yMFGzJz.exe
  C:\Windows\System\yMFGzJz.exe
  2⤵
  PID:7880
- C:\Windows\System\BjeFmyz.exe
  C:\Windows\System\BjeFmyz.exe
  2⤵
  PID:7940
- C:\Windows\System\RZCbFYX.exe
  C:\Windows\System\RZCbFYX.exe
  2⤵
  PID:7960
- C:\Windows\System\IEYzWlq.exe
  C:\Windows\System\IEYzWlq.exe
  2⤵
  PID:7976
- C:\Windows\System\OajVxhJ.exe
  C:\Windows\System\OajVxhJ.exe
  2⤵
  PID:7992
- C:\Windows\System\pohCghn.exe
  C:\Windows\System\pohCghn.exe
  2⤵
  PID:8008
- C:\Windows\System\tyqGJqs.exe
  C:\Windows\System\tyqGJqs.exe
  2⤵
  PID:8024
- C:\Windows\System\MzgxIJd.exe
  C:\Windows\System\MzgxIJd.exe
  2⤵
  PID:8040
- C:\Windows\System\zmJsVVy.exe
  C:\Windows\System\zmJsVVy.exe
  2⤵
  PID:8056
- C:\Windows\System\zRjKlxf.exe
  C:\Windows\System\zRjKlxf.exe
  2⤵
  PID:8072
- C:\Windows\System\bdDSFWT.exe
  C:\Windows\System\bdDSFWT.exe
  2⤵
  PID:8088
- C:\Windows\System\gqAZjXJ.exe
  C:\Windows\System\gqAZjXJ.exe
  2⤵
  PID:8104
- C:\Windows\System\sBMeEQA.exe
  C:\Windows\System\sBMeEQA.exe
  2⤵
  PID:8120
- C:\Windows\System\LwopZbZ.exe
  C:\Windows\System\LwopZbZ.exe
  2⤵
  PID:8136
- C:\Windows\System\aRNlSDW.exe
  C:\Windows\System\aRNlSDW.exe
  2⤵
  PID:8152
- C:\Windows\System\lSCgkvT.exe
  C:\Windows\System\lSCgkvT.exe
  2⤵
  PID:8168
- C:\Windows\System\IMDwjUP.exe
  C:\Windows\System\IMDwjUP.exe
  2⤵
  PID:8184
- C:\Windows\System\xCoMTnB.exe
  C:\Windows\System\xCoMTnB.exe
  2⤵
  PID:5636
- C:\Windows\System\DPpfjPP.exe
  C:\Windows\System\DPpfjPP.exe
  2⤵
  PID:6088
- C:\Windows\System\izJRMRf.exe
  C:\Windows\System\izJRMRf.exe
  2⤵
  PID:7236
- C:\Windows\System\tmBbvAI.exe
  C:\Windows\System\tmBbvAI.exe
  2⤵
  PID:7176
- C:\Windows\System\LDDqFZW.exe
  C:\Windows\System\LDDqFZW.exe
  2⤵
  PID:7288
- C:\Windows\System\ZbvMovn.exe
  C:\Windows\System\ZbvMovn.exe
  2⤵
  PID:7284
- C:\Windows\System\EYHiQOv.exe
  C:\Windows\System\EYHiQOv.exe
  2⤵
  PID:7304
- C:\Windows\System\UzpEEIr.exe
  C:\Windows\System\UzpEEIr.exe
  2⤵
  PID:7316
- C:\Windows\System\UvkgEFq.exe
  C:\Windows\System\UvkgEFq.exe
  2⤵
  PID:7280
- C:\Windows\System\JdRCXMG.exe
  C:\Windows\System\JdRCXMG.exe
  2⤵
  PID:7392
- C:\Windows\System\rUoOKGa.exe
  C:\Windows\System\rUoOKGa.exe
  2⤵
  PID:7460
- C:\Windows\System\oHvqljC.exe
  C:\Windows\System\oHvqljC.exe
  2⤵
  PID:6964
- C:\Windows\System\PaAqCLc.exe
  C:\Windows\System\PaAqCLc.exe
  2⤵
  PID:6664
- C:\Windows\System\PWubPFX.exe
  C:\Windows\System\PWubPFX.exe
  2⤵
  PID:7540
- C:\Windows\System\EEDIvCf.exe
  C:\Windows\System\EEDIvCf.exe
  2⤵
  PID:7636
- C:\Windows\System\JvhiKnM.exe
  C:\Windows\System\JvhiKnM.exe
  2⤵
  PID:7672
- C:\Windows\System\mxbSKsC.exe
  C:\Windows\System\mxbSKsC.exe
  2⤵
  PID:6868
- C:\Windows\System\QHzyFPE.exe
  C:\Windows\System\QHzyFPE.exe
  2⤵
  PID:7188
- C:\Windows\System\iwRMHqg.exe
  C:\Windows\System\iwRMHqg.exe
  2⤵
  PID:7256
- C:\Windows\System\zhGvZXA.exe
  C:\Windows\System\zhGvZXA.exe
  2⤵
  PID:7376
- C:\Windows\System\NtYvFpm.exe
  C:\Windows\System\NtYvFpm.exe
  2⤵
  PID:7416
- C:\Windows\System\YRBOrIA.exe
  C:\Windows\System\YRBOrIA.exe
  2⤵
  PID:7736
- C:\Windows\System\CZqRjUv.exe
  C:\Windows\System\CZqRjUv.exe
  2⤵
  PID:7780
- C:\Windows\System\FNrjyZk.exe
  C:\Windows\System\FNrjyZk.exe
  2⤵
  PID:7856
- C:\Windows\System\HFSkBpA.exe
  C:\Windows\System\HFSkBpA.exe
  2⤵
  PID:7520
- C:\Windows\System\rftSkZX.exe
  C:\Windows\System\rftSkZX.exe
  2⤵
  PID:7896
- C:\Windows\System\gxDGogk.exe
  C:\Windows\System\gxDGogk.exe
  2⤵
  PID:7972
- C:\Windows\System\sirQfJM.exe
  C:\Windows\System\sirQfJM.exe
  2⤵
  PID:8036
- C:\Windows\System\OKiUoKl.exe
  C:\Windows\System\OKiUoKl.exe
  2⤵
  PID:8164
- C:\Windows\System\qYltrkD.exe
  C:\Windows\System\qYltrkD.exe
  2⤵
  PID:8084
- C:\Windows\System\UJniwcq.exe
  C:\Windows\System\UJniwcq.exe
  2⤵
  PID:8144
- C:\Windows\System\TQVUOrI.exe
  C:\Windows\System\TQVUOrI.exe
  2⤵
  PID:6216
- C:\Windows\System\hJmFnZI.exe
  C:\Windows\System\hJmFnZI.exe
  2⤵
  PID:7300
- C:\Windows\System\hylNDWZ.exe
  C:\Windows\System\hylNDWZ.exe
  2⤵
  PID:8052
- C:\Windows\System\zpWjPfP.exe
  C:\Windows\System\zpWjPfP.exe
  2⤵
  PID:6444
- C:\Windows\System\zXNsTst.exe
  C:\Windows\System\zXNsTst.exe
  2⤵
  PID:7408
- C:\Windows\System\cteZvtv.exe
  C:\Windows\System\cteZvtv.exe
  2⤵
  PID:7500
- C:\Windows\System\DubIpZy.exe
  C:\Windows\System\DubIpZy.exe
  2⤵
  PID:7904
- C:\Windows\System\nLipgJM.exe
  C:\Windows\System\nLipgJM.exe
  2⤵
  PID:6996
- C:\Windows\System\ouVrKYu.exe
  C:\Windows\System\ouVrKYu.exe
  2⤵
  PID:7820
- C:\Windows\System\CNQXUXW.exe
  C:\Windows\System\CNQXUXW.exe
  2⤵
  PID:7852
- C:\Windows\System\QbGidiS.exe
  C:\Windows\System\QbGidiS.exe
  2⤵
  PID:7912
- C:\Windows\System\YZOzkBn.exe
  C:\Windows\System\YZOzkBn.exe
  2⤵
  PID:7444
- C:\Windows\System\rDZMHaX.exe
  C:\Windows\System\rDZMHaX.exe
  2⤵
  PID:7588
- C:\Windows\System\UkQGwmL.exe
  C:\Windows\System\UkQGwmL.exe
  2⤵
  PID:7792
- C:\Windows\System\vpdOxwE.exe
  C:\Windows\System\vpdOxwE.exe
  2⤵
  PID:7876
- C:\Windows\System\trFLxVx.exe
  C:\Windows\System\trFLxVx.exe
  2⤵
  PID:7684
- C:\Windows\System\qyvozsS.exe
  C:\Windows\System\qyvozsS.exe
  2⤵
  PID:7936
- C:\Windows\System\htKSBNo.exe
  C:\Windows\System\htKSBNo.exe
  2⤵
  PID:8032
- C:\Windows\System\IOdWcGq.exe
  C:\Windows\System\IOdWcGq.exe
  2⤵
  PID:8128
- C:\Windows\System\ixsstOI.exe
  C:\Windows\System\ixsstOI.exe
  2⤵
  PID:8116
- C:\Windows\System\qFOVzel.exe
  C:\Windows\System\qFOVzel.exe
  2⤵
  PID:8180
- C:\Windows\System\fzrPHgh.exe
  C:\Windows\System\fzrPHgh.exe
  2⤵
  PID:7328
- C:\Windows\System\sTQzVdA.exe
  C:\Windows\System\sTQzVdA.exe
  2⤵
  PID:8176
- C:\Windows\System\rOechlb.exe
  C:\Windows\System\rOechlb.exe
  2⤵
  PID:8080
- C:\Windows\System\rGLhaSg.exe
  C:\Windows\System\rGLhaSg.exe
  2⤵
  PID:6512
- C:\Windows\System\UcWkgHy.exe
  C:\Windows\System\UcWkgHy.exe
  2⤵
  PID:7600
- C:\Windows\System\hbPdwAe.exe
  C:\Windows\System\hbPdwAe.exe
  2⤵
  PID:7952
- C:\Windows\System\LwUtAAi.exe
  C:\Windows\System\LwUtAAi.exe
  2⤵
  PID:7344
- C:\Windows\System\vLYPtQG.exe
  C:\Windows\System\vLYPtQG.exe
  2⤵
  PID:7584
- C:\Windows\System\JPzZkkg.exe
  C:\Windows\System\JPzZkkg.exe
  2⤵
  PID:7556
- C:\Windows\System\idAuoYL.exe
  C:\Windows\System\idAuoYL.exe
  2⤵
  PID:7868
- C:\Windows\System\qEwqwKs.exe
  C:\Windows\System\qEwqwKs.exe
  2⤵
  PID:7968
- C:\Windows\System\fbnSXYK.exe
  C:\Windows\System\fbnSXYK.exe
  2⤵
  PID:7716
- C:\Windows\System\nYIbAAf.exe
  C:\Windows\System\nYIbAAf.exe
  2⤵
  PID:7220
- C:\Windows\System\etMurZv.exe
  C:\Windows\System\etMurZv.exe
  2⤵
  PID:7484
- C:\Windows\System\vdeBWWj.exe
  C:\Windows\System\vdeBWWj.exe
  2⤵
  PID:8100
- C:\Windows\System\YpDccMa.exe
  C:\Windows\System\YpDccMa.exe
  2⤵
  PID:7432
- C:\Windows\System\IvUSkXQ.exe
  C:\Windows\System\IvUSkXQ.exe
  2⤵
  PID:7244
- C:\Windows\System\jKUSwOf.exe
  C:\Windows\System\jKUSwOf.exe
  2⤵
  PID:7892
- C:\Windows\System\nLgnigV.exe
  C:\Windows\System\nLgnigV.exe
  2⤵
  PID:7920
- C:\Windows\System\MlffBXa.exe
  C:\Windows\System\MlffBXa.exe
  2⤵
  PID:7872
- C:\Windows\System\ZkrHYhR.exe
  C:\Windows\System\ZkrHYhR.exe
  2⤵
  PID:7984
- C:\Windows\System\jvwUnFR.exe
  C:\Windows\System\jvwUnFR.exe
  2⤵
  PID:6480
- C:\Windows\System\KQjdbpP.exe
  C:\Windows\System\KQjdbpP.exe
  2⤵
  PID:7924
- C:\Windows\System\vRzGKpM.exe
  C:\Windows\System\vRzGKpM.exe
  2⤵
  PID:7776
- C:\Windows\System\kABjNiB.exe
  C:\Windows\System\kABjNiB.exe
  2⤵
  PID:8212
- C:\Windows\System\JTcPIhG.exe
  C:\Windows\System\JTcPIhG.exe
  2⤵
  PID:8228
- C:\Windows\System\nMJOVBd.exe
  C:\Windows\System\nMJOVBd.exe
  2⤵
  PID:8244
- C:\Windows\System\hlqdYcg.exe
  C:\Windows\System\hlqdYcg.exe
  2⤵
  PID:8296
- C:\Windows\System\npPRric.exe
  C:\Windows\System\npPRric.exe
  2⤵
  PID:8324
- C:\Windows\System\uoMrJCb.exe
  C:\Windows\System\uoMrJCb.exe
  2⤵
  PID:8340
- C:\Windows\System\UBrFawZ.exe
  C:\Windows\System\UBrFawZ.exe
  2⤵
  PID:8360
- C:\Windows\System\DwQkQnf.exe
  C:\Windows\System\DwQkQnf.exe
  2⤵
  PID:8376
- C:\Windows\System\RGBbfja.exe
  C:\Windows\System\RGBbfja.exe
  2⤵
  PID:8392
- C:\Windows\System\vIeCpiN.exe
  C:\Windows\System\vIeCpiN.exe
  2⤵
  PID:8408
- C:\Windows\System\TDMHvEb.exe
  C:\Windows\System\TDMHvEb.exe
  2⤵
  PID:8424
- C:\Windows\System\ExSAWnY.exe
  C:\Windows\System\ExSAWnY.exe
  2⤵
  PID:8440
- C:\Windows\System\qDnnBAx.exe
  C:\Windows\System\qDnnBAx.exe
  2⤵
  PID:8460
- C:\Windows\System\jUKtWLj.exe
  C:\Windows\System\jUKtWLj.exe
  2⤵
  PID:8480
- C:\Windows\System\pkzTygu.exe
  C:\Windows\System\pkzTygu.exe
  2⤵
  PID:8496
- C:\Windows\System\tDUwXgI.exe
  C:\Windows\System\tDUwXgI.exe
  2⤵
  PID:8512
- C:\Windows\System\AZLFNdC.exe
  C:\Windows\System\AZLFNdC.exe
  2⤵
  PID:8528
- C:\Windows\System\dPWvFca.exe
  C:\Windows\System\dPWvFca.exe
  2⤵
  PID:8544
- C:\Windows\System\xkUhJEi.exe
  C:\Windows\System\xkUhJEi.exe
  2⤵
  PID:8560
- C:\Windows\System\vJdkEWj.exe
  C:\Windows\System\vJdkEWj.exe
  2⤵
  PID:8580
- C:\Windows\System\YBiSqVS.exe
  C:\Windows\System\YBiSqVS.exe
  2⤵
  PID:8608
- C:\Windows\System\PAWZwGU.exe
  C:\Windows\System\PAWZwGU.exe
  2⤵
  PID:8628
- C:\Windows\System\jrhvahm.exe
  C:\Windows\System\jrhvahm.exe
  2⤵
  PID:8644
- C:\Windows\System\uSljyeL.exe
  C:\Windows\System\uSljyeL.exe
  2⤵
  PID:8664
- C:\Windows\System\oHXUBSr.exe
  C:\Windows\System\oHXUBSr.exe
  2⤵
  PID:8680
- C:\Windows\System\JHWsDaW.exe
  C:\Windows\System\JHWsDaW.exe
  2⤵
  PID:8696
- C:\Windows\System\ohbZBAL.exe
  C:\Windows\System\ohbZBAL.exe
  2⤵
  PID:8712
- C:\Windows\System\vQIJLLj.exe
  C:\Windows\System\vQIJLLj.exe
  2⤵
  PID:8728
- C:\Windows\System\emcHowr.exe
  C:\Windows\System\emcHowr.exe
  2⤵
  PID:8744
- C:\Windows\System\EDBXUSm.exe
  C:\Windows\System\EDBXUSm.exe
  2⤵
  PID:8760
- C:\Windows\System\IqYQXtX.exe
  C:\Windows\System\IqYQXtX.exe
  2⤵
  PID:8780
- C:\Windows\System\cbFTHgG.exe
  C:\Windows\System\cbFTHgG.exe
  2⤵
  PID:8796
- C:\Windows\System\JabsIfA.exe
  C:\Windows\System\JabsIfA.exe
  2⤵
  PID:8812
- C:\Windows\System\NsjiSot.exe
  C:\Windows\System\NsjiSot.exe
  2⤵
  PID:8828
- C:\Windows\System\DMiBXlG.exe
  C:\Windows\System\DMiBXlG.exe
  2⤵
  PID:8936
- C:\Windows\System\XiDqDsD.exe
  C:\Windows\System\XiDqDsD.exe
  2⤵
  PID:8952
- C:\Windows\System\gSRvIpl.exe
  C:\Windows\System\gSRvIpl.exe
  2⤵
  PID:8968
- C:\Windows\System\VoIIxLM.exe
  C:\Windows\System\VoIIxLM.exe
  2⤵
  PID:8992
- C:\Windows\System\mBuBVVf.exe
  C:\Windows\System\mBuBVVf.exe
  2⤵
  PID:9008
- C:\Windows\System\SejHrDL.exe
  C:\Windows\System\SejHrDL.exe
  2⤵
  PID:9028
- C:\Windows\System\UbMCoWe.exe
  C:\Windows\System\UbMCoWe.exe
  2⤵
  PID:9044
- C:\Windows\System\fkQlxFm.exe
  C:\Windows\System\fkQlxFm.exe
  2⤵
  PID:9060
- C:\Windows\System\OeEVBgE.exe
  C:\Windows\System\OeEVBgE.exe
  2⤵
  PID:9076
- C:\Windows\System\UxgnKAj.exe
  C:\Windows\System\UxgnKAj.exe
  2⤵
  PID:9092
- C:\Windows\System\uJkDfHx.exe
  C:\Windows\System\uJkDfHx.exe
  2⤵
  PID:9112
- C:\Windows\System\CaYnJig.exe
  C:\Windows\System\CaYnJig.exe
  2⤵
  PID:9128
- C:\Windows\System\NdvIYrw.exe
  C:\Windows\System\NdvIYrw.exe
  2⤵
  PID:9144
- C:\Windows\System\qOGDIWk.exe
  C:\Windows\System\qOGDIWk.exe
  2⤵
  PID:9164
- C:\Windows\System\nvTPawB.exe
  C:\Windows\System\nvTPawB.exe
  2⤵
  PID:9180
- C:\Windows\System\kPuTaFs.exe
  C:\Windows\System\kPuTaFs.exe
  2⤵
  PID:9196
- C:\Windows\System\AIHKCdA.exe
  C:\Windows\System\AIHKCdA.exe
  2⤵
  PID:9212
- C:\Windows\System\LRvXftx.exe
  C:\Windows\System\LRvXftx.exe
  2⤵
  PID:8196
- C:\Windows\System\zBXzFTe.exe
  C:\Windows\System\zBXzFTe.exe
  2⤵
  PID:8236
- C:\Windows\System\FYXHxSJ.exe
  C:\Windows\System\FYXHxSJ.exe
  2⤵
  PID:7908
- C:\Windows\System\mSyZVwE.exe
  C:\Windows\System\mSyZVwE.exe
  2⤵
  PID:8268
- C:\Windows\System\PwCQLSn.exe
  C:\Windows\System\PwCQLSn.exe
  2⤵
  PID:8284
- C:\Windows\System\yfFXeDk.exe
  C:\Windows\System\yfFXeDk.exe
  2⤵
  PID:8304
- C:\Windows\System\CkfUoCv.exe
  C:\Windows\System\CkfUoCv.exe
  2⤵
  PID:8320
- C:\Windows\System\yYGnlKq.exe
  C:\Windows\System\yYGnlKq.exe
  2⤵
  PID:8336
- C:\Windows\System\qvvaPmR.exe
  C:\Windows\System\qvvaPmR.exe
  2⤵
  PID:8388
- C:\Windows\System\DhUvIeh.exe
  C:\Windows\System\DhUvIeh.exe
  2⤵
  PID:8456
- C:\Windows\System\obEYAdS.exe
  C:\Windows\System\obEYAdS.exe
  2⤵
  PID:8524
- C:\Windows\System\nzNsPEE.exe
  C:\Windows\System\nzNsPEE.exe
  2⤵
  PID:8468
- C:\Windows\System\mEjYOaZ.exe
  C:\Windows\System\mEjYOaZ.exe
  2⤵
  PID:8640
- C:\Windows\System\UjWuWYx.exe
  C:\Windows\System\UjWuWYx.exe
  2⤵
  PID:8704
- C:\Windows\System\dSDbZmJ.exe
  C:\Windows\System\dSDbZmJ.exe
  2⤵
  PID:8768
- C:\Windows\System\qacRsnN.exe
  C:\Windows\System\qacRsnN.exe
  2⤵
  PID:8404
- C:\Windows\System\bTmNljs.exe
  C:\Windows\System\bTmNljs.exe
  2⤵
  PID:8476
- C:\Windows\System\uQYsvIR.exe
  C:\Windows\System\uQYsvIR.exe
  2⤵
  PID:8576
- C:\Windows\System\vrRlvBo.exe
  C:\Windows\System\vrRlvBo.exe
  2⤵
  PID:8508
- C:\Windows\System\DMOOtga.exe
  C:\Windows\System\DMOOtga.exe
  2⤵
  PID:8724
- C:\Windows\System\iVnTcZZ.exe
  C:\Windows\System\iVnTcZZ.exe
  2⤵
  PID:8840
- C:\Windows\System\kprhacw.exe
  C:\Windows\System\kprhacw.exe
  2⤵
  PID:8860
- C:\Windows\System\ECqWGZT.exe
  C:\Windows\System\ECqWGZT.exe
  2⤵
  PID:8876
- C:\Windows\System\gVjUpSl.exe
  C:\Windows\System\gVjUpSl.exe
  2⤵
  PID:8912
- C:\Windows\System\UPgWHyh.exe
  C:\Windows\System\UPgWHyh.exe
  2⤵
  PID:8932
- C:\Windows\System\vMqpLkD.exe
  C:\Windows\System\vMqpLkD.exe
  2⤵
  PID:8948
- C:\Windows\System\qNHVxgq.exe
  C:\Windows\System\qNHVxgq.exe
  2⤵
  PID:9136
- C:\Windows\System\XPVstqc.exe
  C:\Windows\System\XPVstqc.exe
  2⤵
  PID:9072
- C:\Windows\System\WsWPBOj.exe
  C:\Windows\System\WsWPBOj.exe
  2⤵
  PID:9140
- C:\Windows\System\VtpnzzT.exe
  C:\Windows\System\VtpnzzT.exe
  2⤵
  PID:9172
- C:\Windows\System\mplgPGd.exe
  C:\Windows\System\mplgPGd.exe
  2⤵
  PID:8208
- C:\Windows\System\vtpicYx.exe
  C:\Windows\System\vtpicYx.exe
  2⤵
  PID:7836
- C:\Windows\System\gZAcqFb.exe
  C:\Windows\System\gZAcqFb.exe
  2⤵
  PID:9156
- C:\Windows\System\VsAIFKu.exe
  C:\Windows\System\VsAIFKu.exe
  2⤵
  PID:9084
- C:\Windows\System\GUErPoy.exe
  C:\Windows\System\GUErPoy.exe
  2⤵
  PID:9192
- C:\Windows\System\EbSTAjJ.exe
  C:\Windows\System\EbSTAjJ.exe
  2⤵
  PID:7160
- C:\Windows\System\cPqPpCn.exe
  C:\Windows\System\cPqPpCn.exe
  2⤵
  PID:6420
- C:\Windows\System\vOElVed.exe
  C:\Windows\System\vOElVed.exe
  2⤵
  PID:8276
- C:\Windows\System\pCFUYZT.exe
  C:\Windows\System\pCFUYZT.exe
  2⤵
  PID:8332
- C:\Windows\System\VUhQfxl.exe
  C:\Windows\System\VUhQfxl.exe
  2⤵
  PID:8556
- C:\Windows\System\vmecwTI.exe
  C:\Windows\System\vmecwTI.exe
  2⤵
  PID:8312
- C:\Windows\System\IZTyXtB.exe
  C:\Windows\System\IZTyXtB.exe
  2⤵
  PID:8776
- C:\Windows\System\TxZuPCs.exe
  C:\Windows\System\TxZuPCs.exe
  2⤵
  PID:8572
- C:\Windows\System\VrhSBbg.exe
  C:\Windows\System\VrhSBbg.exe
  2⤵
  PID:8492
- C:\Windows\System\ppGBmpp.exe
  C:\Windows\System\ppGBmpp.exe
  2⤵
  PID:8820
- C:\Windows\System\FKXoWKz.exe
  C:\Windows\System\FKXoWKz.exe
  2⤵
  PID:8692
- C:\Windows\System\QnIWbJb.exe
  C:\Windows\System\QnIWbJb.exe
  2⤵
  PID:8520
- C:\Windows\System\amjKjtW.exe
  C:\Windows\System\amjKjtW.exe
  2⤵
  PID:8740
- C:\Windows\System\hxmkOSo.exe
  C:\Windows\System\hxmkOSo.exe
  2⤵
  PID:8752
- C:\Windows\System\ITqEurw.exe
  C:\Windows\System\ITqEurw.exe
  2⤵
  PID:8884
- C:\Windows\System\TEMsPkh.exe
  C:\Windows\System\TEMsPkh.exe
  2⤵
  PID:8928
- C:\Windows\System\UEvqYEL.exe
  C:\Windows\System\UEvqYEL.exe
  2⤵
  PID:9040
- C:\Windows\System\xTYbMQk.exe
  C:\Windows\System\xTYbMQk.exe
  2⤵
  PID:8988
- C:\Windows\System\tMXnCXm.exe
  C:\Windows\System\tMXnCXm.exe
  2⤵
  PID:9104
- C:\Windows\System\lXXXROg.exe
  C:\Windows\System\lXXXROg.exe
  2⤵
  PID:7724
- C:\Windows\System\MsPUFGY.exe
  C:\Windows\System\MsPUFGY.exe
  2⤵
  PID:8224
- C:\Windows\System\DLHlvgi.exe
  C:\Windows\System\DLHlvgi.exe
  2⤵
  PID:8292
- C:\Windows\System\qWlGCIx.exe
  C:\Windows\System\qWlGCIx.exe
  2⤵
  PID:8416
- C:\Windows\System\fqBLHWY.exe
  C:\Windows\System\fqBLHWY.exe
  2⤵
  PID:8672
- C:\Windows\System\zxlHIfW.exe
  C:\Windows\System\zxlHIfW.exe
  2⤵
  PID:8436
- C:\Windows\System\kdYolkA.exe
  C:\Windows\System\kdYolkA.exe
  2⤵
  PID:8868
- C:\Windows\System\ITLndcN.exe
  C:\Windows\System\ITLndcN.exe
  2⤵
  PID:8372
- C:\Windows\System\HlvYgQK.exe
  C:\Windows\System\HlvYgQK.exe
  2⤵
  PID:9004
- C:\Windows\System\ZpSFiyy.exe
  C:\Windows\System\ZpSFiyy.exe
  2⤵
  PID:8656
- C:\Windows\System\pbYmSaR.exe
  C:\Windows\System\pbYmSaR.exe
  2⤵
  PID:7928
- C:\Windows\System\oFlGZep.exe
  C:\Windows\System\oFlGZep.exe
  2⤵
  PID:8536
- C:\Windows\System\bpzyxyK.exe
  C:\Windows\System\bpzyxyK.exe
  2⤵
  PID:8888
- C:\Windows\System\eqJJmPi.exe
  C:\Windows\System\eqJJmPi.exe
  2⤵
  PID:7488
- C:\Windows\System\JNFFsMH.exe
  C:\Windows\System\JNFFsMH.exe
  2⤵
  PID:9188
- C:\Windows\System\vpqDljo.exe
  C:\Windows\System\vpqDljo.exe
  2⤵
  PID:9208
- C:\Windows\System\ilpCLAg.exe
  C:\Windows\System\ilpCLAg.exe
  2⤵
  PID:9020
- C:\Windows\System\VJkxSTh.exe
  C:\Windows\System\VJkxSTh.exe
  2⤵
  PID:8652
- C:\Windows\System\ywyNUTc.exe
  C:\Windows\System\ywyNUTc.exe
  2⤵
  PID:9000
- C:\Windows\System\csderkx.exe
  C:\Windows\System\csderkx.exe
  2⤵
  PID:7340
- C:\Windows\System\pnQiTIy.exe
  C:\Windows\System\pnQiTIy.exe
  2⤵
  PID:8420
- C:\Windows\System\pZNYjwZ.exe
  C:\Windows\System\pZNYjwZ.exe
  2⤵
  PID:8352
- C:\Windows\System\hUoEzHV.exe
  C:\Windows\System\hUoEzHV.exe
  2⤵
  PID:9160
- C:\Windows\System\MDlvMxD.exe
  C:\Windows\System\MDlvMxD.exe
  2⤵
  PID:8688
- C:\Windows\System\HUecKbF.exe
  C:\Windows\System\HUecKbF.exe
  2⤵
  PID:8472
- C:\Windows\System\IkXzdoQ.exe
  C:\Windows\System\IkXzdoQ.exe
  2⤵
  PID:8736
- C:\Windows\System\iIINinC.exe
  C:\Windows\System\iIINinC.exe
  2⤵
  PID:9220
- C:\Windows\System\XeRgAos.exe
  C:\Windows\System\XeRgAos.exe
  2⤵
  PID:9236
- C:\Windows\System\EncKaDI.exe
  C:\Windows\System\EncKaDI.exe
  2⤵
  PID:9268
- C:\Windows\System\rftHEgM.exe
  C:\Windows\System\rftHEgM.exe
  2⤵
  PID:9284
- C:\Windows\System\lbOUCzx.exe
  C:\Windows\System\lbOUCzx.exe
  2⤵
  PID:9300
- C:\Windows\System\TZSpMpl.exe
  C:\Windows\System\TZSpMpl.exe
  2⤵
  PID:9316
- C:\Windows\System\mPwWckx.exe
  C:\Windows\System\mPwWckx.exe
  2⤵
  PID:9332
- C:\Windows\System\YtKKhAm.exe
  C:\Windows\System\YtKKhAm.exe
  2⤵
  PID:9348
- C:\Windows\System\uxdgieT.exe
  C:\Windows\System\uxdgieT.exe
  2⤵
  PID:9368
- C:\Windows\System\icwsmyp.exe
  C:\Windows\System\icwsmyp.exe
  2⤵
  PID:9384
- C:\Windows\System\hgsETwz.exe
  C:\Windows\System\hgsETwz.exe
  2⤵
  PID:9400
- C:\Windows\System\ilOqTcz.exe
  C:\Windows\System\ilOqTcz.exe
  2⤵
  PID:9420
- C:\Windows\System\uScTMAE.exe
  C:\Windows\System\uScTMAE.exe
  2⤵
  PID:9436
- C:\Windows\System\eywYfsK.exe
  C:\Windows\System\eywYfsK.exe
  2⤵
  PID:9452
- C:\Windows\System\AqQVtit.exe
  C:\Windows\System\AqQVtit.exe
  2⤵
  PID:9468
- C:\Windows\System\EeiegXK.exe
  C:\Windows\System\EeiegXK.exe
  2⤵
  PID:9488
- C:\Windows\System\jLRojlf.exe
  C:\Windows\System\jLRojlf.exe
  2⤵
  PID:9504
- C:\Windows\System\ztJFDEd.exe
  C:\Windows\System\ztJFDEd.exe
  2⤵
  PID:9520
- C:\Windows\System\oZykoOH.exe
  C:\Windows\System\oZykoOH.exe
  2⤵
  PID:9536
- C:\Windows\System\jCynpCW.exe
  C:\Windows\System\jCynpCW.exe
  2⤵
  PID:9552
- C:\Windows\System\KokCnei.exe
  C:\Windows\System\KokCnei.exe
  2⤵
  PID:9572
- C:\Windows\System\KzyrDmh.exe
  C:\Windows\System\KzyrDmh.exe
  2⤵
  PID:9588
- C:\Windows\System\SZSQFlk.exe
  C:\Windows\System\SZSQFlk.exe
  2⤵
  PID:9604
- C:\Windows\System\BUXdTGe.exe
  C:\Windows\System\BUXdTGe.exe
  2⤵
  PID:9620
- C:\Windows\System\mWmTxxJ.exe
  C:\Windows\System\mWmTxxJ.exe
  2⤵
  PID:9644
- C:\Windows\System\fgZGTgQ.exe
  C:\Windows\System\fgZGTgQ.exe
  2⤵
  PID:9676
- C:\Windows\System\mYOIpFi.exe
  C:\Windows\System\mYOIpFi.exe
  2⤵
  PID:9696
- C:\Windows\System\ouZbDWm.exe
  C:\Windows\System\ouZbDWm.exe
  2⤵
  PID:9720
- C:\Windows\System\tUDkFxm.exe
  C:\Windows\System\tUDkFxm.exe
  2⤵
  PID:9740
- C:\Windows\System\lOETZFd.exe
  C:\Windows\System\lOETZFd.exe
  2⤵
  PID:9760
- C:\Windows\System\MBMrfEl.exe
  C:\Windows\System\MBMrfEl.exe
  2⤵
  PID:9776
- C:\Windows\System\TsZlZYk.exe
  C:\Windows\System\TsZlZYk.exe
  2⤵
  PID:9804
- C:\Windows\System\aIYCxsl.exe
  C:\Windows\System\aIYCxsl.exe
  2⤵
  PID:9824
- C:\Windows\System\pyZiEJu.exe
  C:\Windows\System\pyZiEJu.exe
  2⤵
  PID:9840
- C:\Windows\System\QoYVjXs.exe
  C:\Windows\System\QoYVjXs.exe
  2⤵
  PID:9856
- C:\Windows\System\YSDrytX.exe
  C:\Windows\System\YSDrytX.exe
  2⤵
  PID:9872
- C:\Windows\System\ceeCGPg.exe
  C:\Windows\System\ceeCGPg.exe
  2⤵
  PID:9896
- C:\Windows\System\ObKnSTs.exe
  C:\Windows\System\ObKnSTs.exe
  2⤵
  PID:9912
- C:\Windows\System\smdZEUG.exe
  C:\Windows\System\smdZEUG.exe
  2⤵
  PID:9932
- C:\Windows\System\SerZAAm.exe
  C:\Windows\System\SerZAAm.exe
  2⤵
  PID:9948
- C:\Windows\System\QslbyIS.exe
  C:\Windows\System\QslbyIS.exe
  2⤵
  PID:9964
- C:\Windows\System\kqAMUGq.exe
  C:\Windows\System\kqAMUGq.exe
  2⤵
  PID:9984
- C:\Windows\System\UDvhLen.exe
  C:\Windows\System\UDvhLen.exe
  2⤵
  PID:10000
- C:\Windows\System\EFZvAEB.exe
  C:\Windows\System\EFZvAEB.exe
  2⤵
  PID:10020
- C:\Windows\System\mieMzNn.exe
  C:\Windows\System\mieMzNn.exe
  2⤵
  PID:10036
- C:\Windows\System\JhghlPP.exe
  C:\Windows\System\JhghlPP.exe
  2⤵
  PID:10056
- C:\Windows\System\cuzShwg.exe
  C:\Windows\System\cuzShwg.exe
  2⤵
  PID:10076
- C:\Windows\System\OTCtnzr.exe
  C:\Windows\System\OTCtnzr.exe
  2⤵
  PID:10092
- C:\Windows\System\tnJENBW.exe
  C:\Windows\System\tnJENBW.exe
  2⤵
  PID:10108
- C:\Windows\System\DFlZpjx.exe
  C:\Windows\System\DFlZpjx.exe
  2⤵
  PID:10128
- C:\Windows\System\tmYXPxi.exe
  C:\Windows\System\tmYXPxi.exe
  2⤵
  PID:10144
- C:\Windows\System\MhHdkHY.exe
  C:\Windows\System\MhHdkHY.exe
  2⤵
  PID:10184
- C:\Windows\System\TXxpKdx.exe
  C:\Windows\System\TXxpKdx.exe
  2⤵
  PID:10200
- C:\Windows\System\fUoBxWm.exe
  C:\Windows\System\fUoBxWm.exe
  2⤵
  PID:10224
- C:\Windows\System\lWBsqya.exe
  C:\Windows\System\lWBsqya.exe
  2⤵
  PID:9228
- C:\Windows\System\mcDVZsv.exe
  C:\Windows\System\mcDVZsv.exe
  2⤵
  PID:8204
- C:\Windows\System\vsrQIJE.exe
  C:\Windows\System\vsrQIJE.exe
  2⤵
  PID:8448
- C:\Windows\System\ufAyyQG.exe
  C:\Windows\System\ufAyyQG.exe
  2⤵
  PID:9256
- C:\Windows\System\GQZHTXU.exe
  C:\Windows\System\GQZHTXU.exe
  2⤵
  PID:9308
- C:\Windows\System\EaYIXZz.exe
  C:\Windows\System\EaYIXZz.exe
  2⤵
  PID:9296
- C:\Windows\System\jRWzVfk.exe
  C:\Windows\System\jRWzVfk.exe
  2⤵
  PID:9560
- C:\Windows\System\QcELcuU.exe
  C:\Windows\System\QcELcuU.exe
  2⤵
  PID:9596
- C:\Windows\System\TmrQGWS.exe
  C:\Windows\System\TmrQGWS.exe
  2⤵
  PID:9600
- C:\Windows\System\hjsXwoi.exe
  C:\Windows\System\hjsXwoi.exe
  2⤵
  PID:9640
- C:\Windows\System\bMuODFj.exe
  C:\Windows\System\bMuODFj.exe
  2⤵
  PID:9672
- C:\Windows\System\inYXTer.exe
  C:\Windows\System\inYXTer.exe
  2⤵
  PID:9712
- C:\Windows\System\hgGdnsW.exe
  C:\Windows\System\hgGdnsW.exe
  2⤵
  PID:9688
- C:\Windows\System\tJGxGZn.exe
  C:\Windows\System\tJGxGZn.exe
  2⤵
  PID:9768
- C:\Windows\System\QqSvhgw.exe
  C:\Windows\System\QqSvhgw.exe
  2⤵
  PID:9728
- C:\Windows\System\FORwPdB.exe
  C:\Windows\System\FORwPdB.exe
  2⤵
  PID:9816
- C:\Windows\System\azmKBRI.exe
  C:\Windows\System\azmKBRI.exe
  2⤵
  PID:9904
- C:\Windows\System\MOiKWxG.exe
  C:\Windows\System\MOiKWxG.exe
  2⤵
  PID:9972
- C:\Windows\System\KeYuWnh.exe
  C:\Windows\System\KeYuWnh.exe
  2⤵
  PID:10052
- C:\Windows\System\DXRfUUg.exe
  C:\Windows\System\DXRfUUg.exe
  2⤵
  PID:10124
- C:\Windows\System\McudhDr.exe
  C:\Windows\System\McudhDr.exe
  2⤵
  PID:10164
- C:\Windows\System\fGCzcAu.exe
  C:\Windows\System\fGCzcAu.exe
  2⤵
  PID:9960
- C:\Windows\System\KSXOVMA.exe
  C:\Windows\System\KSXOVMA.exe
  2⤵
  PID:10068
- C:\Windows\System\XBTjAsQ.exe
  C:\Windows\System\XBTjAsQ.exe
  2⤵
  PID:9996
- C:\Windows\System\LTwTeGO.exe
  C:\Windows\System\LTwTeGO.exe
  2⤵
  PID:10156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AmlPsLs.exe

Filesize
1.6MB

MD5
18d531fb41b40e8607369e2793f20fd7

SHA1
610bbd79ec99bc3a9b62e2dd5c5cca8a91f6db73

SHA256
cc1fa71e6ac56c6337074e4fddadd7e5f45a54a22076f4c1c1da3f44b6e8864e

SHA512
38f213e8d6af1ed8beb747e5a833fb1389c3362ed73bb785470c99005d466bed79453bf5e0210474b565c11ae08547e6050361e8b73068e1b4c6c07b36c130cb

Download Submit
C:\Windows\system\BWobsBV.exe

Filesize
1.6MB

MD5
1803385b0d6590652ced33cfe0ca4283

SHA1
2f8e6b5c99f85d1d81b9103c924f508dfee5bdd6

SHA256
246a2bb6497bb83c76cc087fce5e5b3fa19f01ed54a7f52ac7c1e4afa2b9a316

SHA512
8c6a2e4932ae681ccbd6a843418d1a1aa06ab858f803c3afa8d4e2c5ed8c5b497952fc3a2c683e824bff22a936eebdf2607799839926c2add0486525e8dcd7b2

Download Submit
C:\Windows\system\GzpLNbV.exe

Filesize
1.6MB

MD5
3de0f24d001e9d1e025d27b0d6d7cd0f

SHA1
c1628f07378adf2ad554352e66124e736caae9ea

SHA256
3939144933514861f4b9dccfa66ce7471442864ac65d2f48cf60b6e8f3512575

SHA512
f9bd9fbdc586a0850ffcb5da13f0043ca0026a3c7724b6361a031bf87e7bdc45dc886f76fbbdfc03953bd76d3ce43e8f4da1a99cec76a2ec95ee689607531725

Download Submit
C:\Windows\system\MYSlvXK.exe

Filesize
1.6MB

MD5
1d7ab397a0a094265bd661ec6092eeaf

SHA1
a41efdb3f339b07fef9075f221f1f3bc53a50489

SHA256
77fcb859fda3b60712edcfcc16a350fa1202d22e5d03063204bad3f29949b50d

SHA512
8b99d04896c8bd16804a4cc5e7ae0da3372d8f11ce944d7a125c789e5c17ccc96bcdec7ab2fff59b02073692427af9149efa6b040225833a6cedcd21a84629f0

Download Submit
C:\Windows\system\PsGwTpa.exe

Filesize
1.6MB

MD5
4b26c8708c8c8218718be9bbb1aa0bba

SHA1
d5238f9a75064bc66bfda013718b727e7a5ed75e

SHA256
bfa816f8c75f94930e676e6aa1cb08d4e5d4cb572406f7aef87b5a94b4e13492

SHA512
5f4146129082397077c11cae9645ed8b5975041005424f48610245f7d0adbc6db3d3a5fe51579dbfc3c72b7e680372292fc1dffecf557e30d123a38b21ddf27e

Download Submit
C:\Windows\system\PsXxzav.exe

Filesize
1.6MB

MD5
271454f0a21b0887079b82a4872fd55f

SHA1
93b5e9dcc0b576d5e5bfcbcce387fcf2ea649e0b

SHA256
6a62aa09fee4127fd4b8fee622ab1f97c56a20e603264bdeab53176660fe459e

SHA512
462a5694b98768bfcdb2a7a6c6baad4bf9978b2bfc8a888b5732efa6ea357ca48d85e05d34605bd0974f047f7856886c3adcf7256f46957f46aae805d43d5961

Download Submit
C:\Windows\system\RZqNGYM.exe

Filesize
1.6MB

MD5
c48e944110beaf51703a076586238cb1

SHA1
963efbd8a609c0b4a379befd1a647d7cabf4a370

SHA256
45b6980de612e305148313142f5afc272599fc65e57d96adf2b48c997729a8d2

SHA512
e758a0874c8e3dfe37fdd0a6d041ea5a3e6f31310aaf3166d70b88c415ca361164c628148b82c61767d4a956b75f167837200db5755b984314453f5fe778729a

Download Submit
C:\Windows\system\TmjXKJL.exe

Filesize
1.6MB

MD5
ded296a9ddb5c723f0a19999af7ab418

SHA1
6375bdb4f6a71ea158288f0c5f373f64f22904ba

SHA256
231802bff9e1643d060cbed951ac7cf579fd4f2bda9344be05408a8b132799f9

SHA512
31f4bbcf3f40e88bf1c49629558263caf2175265d16d11b23909ca593bdb4699b9d97f83c08ee94d0d1891babac0a48c28be2aee1de9db7a8a1d54d0cef84350

Download Submit
C:\Windows\system\VdYLAtr.exe

Filesize
1.6MB

MD5
1480cc8106d1cbb8bb27c108a2a81dbe

SHA1
b2a17a23280afa22fc0ce856896eb3f0b4ca4227

SHA256
5a23c0ae8223ca2d575e4e882c9a52d084cea6cbc16ba5b5b9c69545864e2818

SHA512
1ef24ae18bfe4af28c1a88e61d1a677ad91674e89166d9a7e6fc742e516edba9f3c1c6b74904d2d8ca6fa80cf987370b0780ce8b15c0913807d3a9d70f1a478c

Download Submit
C:\Windows\system\YHBCTyX.exe

Filesize
1.6MB

MD5
163c6ed2a1ab435812479f68bc06f633

SHA1
e4bd2aa91251d766862df6be9fad66c8534b66b9

SHA256
d0a4dc490cfc55fabe3576f8fde88e398dbf003460fadff5630eeefd8ba3bc89

SHA512
fd572db760cd255ecfccda1f82c4ecffaa12ced8a6f1368103169d7faa639dde9bfa498cdcfd6fea520af7f402a3a6db693daf529802b011b8bb1cc3897f11b7

Download Submit
C:\Windows\system\ZmRYxUu.exe

Filesize
1.6MB

MD5
93876754bbf48c344f9b4a8220d73f60

SHA1
78185ab6d3b473de63f8d8deaef639648eb76edc

SHA256
6a476e5e0b0401ff83f5b23c482403fdaa38eabbf624ed96a64d3e3af63a8979

SHA512
8f0afaf90b08475f95e3ffddfcc6ba871cbb4cdf3c397d1824628d8fafd871d3b7cbd6c9b56e537f9dbea542268e67047e0d44ab36cabc0e4b0664138e757cfc

Download Submit
C:\Windows\system\dXYyvmS.exe

Filesize
1.6MB

MD5
64a022a194f3e815321d1c407be9f83b

SHA1
119fafd1b76229c9e31ea2a649a1f31493431b45

SHA256
8830ad4a741c90fd6c325be2e82cda9d2a14370a8b06075b0d71a7c07dff047b

SHA512
3113a7ce6304ed4a7f40efa2bbefba382bc621c6369bba2bb13f1780357fb9233b48bb807dc7e65fa515ee730dfd4a8f7064f7a16d5dbe51db0d6b217b5f17f7

Download Submit
C:\Windows\system\eLyCijZ.exe

Filesize
1.6MB

MD5
165fda513f51d38c743eb7edbb19f5a1

SHA1
3d96cd625c0054f8b417d5538dfa2111bdf3ff39

SHA256
9d0e728fa907dd272864009063276c64b64e254d99a919cad301f9dd2f66d5c1

SHA512
039730e7431f5efad4a0fb32b0136abce5f504bb6b71e346cf14c9e6fa2f487ce44bd74795a509fc9ab7948c986a57ff716314f9d0a4f711a055589ee56ba990

Download Submit
C:\Windows\system\eQFvWig.exe

Filesize
1.6MB

MD5
4927cead352a37f07a4e60d6ec75aabe

SHA1
c932686103f6f40a5a9c30d53c8b2e73106cfbee

SHA256
864af0da6c59031557086ab6a37d2b30829726e0d7395c29764327ca1f7a613b

SHA512
5a2be7118d26e312a16941d7b5b899d034b8c8aa26592884f16879efa8a7f253818418bcd0274cba71ca090ef09644d01c2dcbe0f9ec14fbf286ccda9072f5f9

Download Submit
C:\Windows\system\fRDYAjG.exe

Filesize
1.6MB

MD5
0b1d01bb61fa6c9f84b0c1e7c4481a90

SHA1
b738f1b3a5be338f0fef8e18de670623acf776ab

SHA256
3ed21865e3547e4b57341cfaa6c265abdcc2e9d7a162d77352cad4ff6cdd23bd

SHA512
4f5f49a45ebb8b3b5f25f4e4ed0df3b061d47492de35ce5ae6a0e42df11516cb6acfadd6f53900e95c7c69997e49310d0e56f8de10e0925e24e09025bf4101e0

Download Submit
C:\Windows\system\fYgeKqB.exe

Filesize
1.6MB

MD5
c35c1ae83457c17536331c2f7b60b8a0

SHA1
72fd4e536f4fd1680ce3a1bdb3022896e3f3c827

SHA256
5e0557198a95329366c7b40cd3e24dbdd8adf530fa5db09303f3c59e853a345b

SHA512
c6c49cc8550002de38d512a21de085342a7e1cb42d264e5f20eb5df4170b00ed67f85f4c9883a82b82606cbfa0def26515e10f7af0f7ad50bc78507b162da983

Download Submit
C:\Windows\system\gqVAzbv.exe

Filesize
1.6MB

MD5
b0bd31116723a13cd96aae212c4c5aec

SHA1
0989dada68de9282689e3dbdc5121aaa05d83f4e

SHA256
e4c92b43bfc751c0ebe65a7cf892112037439352fd26c76760872c0fd123c519

SHA512
9def941adaa0942f31f3259eeaa13ecadb9193c79b29a38a4fac262411f146c8e3fa6a5c2f8375ae817375080e92e39cbcffe1b5ddf0c0709627a4fe07323fa0

Download Submit
C:\Windows\system\guBnmjD.exe

Filesize
1.6MB

MD5
3bec96bfae7de0960f6ab6d079851fb0

SHA1
d17ffbf7e8e325281f52974a9348b833700aa556

SHA256
4026b9d218f73029699a3bb6db1f4b37b220b6c5ed7de70dc84861b1710a8cf0

SHA512
b0c02e6208d29ad339ce26ba3a3e352cc41538814816db72f555b92885716c08c34adaa4d68de698708d3fc2f4baf72b62172ed4feb65d81b134f9db3ab2f041

Download Submit
C:\Windows\system\iqFvJIB.exe

Filesize
1.6MB

MD5
cdc7f9d3c04aab8513102f69e991279d

SHA1
1365092410300f3149477ea31e19bdcbe296a486

SHA256
626099701ab101a34e5dcae47f18b8d9c98ff1c64dbf3571dd8300d20b73169d

SHA512
ee4a1c6794f161d7617507c4f52ad8550820fef4bbc277fb99175f8ecf191ef31009e90bd5d9825b5582cf09d764dbf1e727816244fa511d481d1a019076bb95

Download Submit
C:\Windows\system\jEyhbdc.exe

Filesize
1.6MB

MD5
7384d105ea032a7f636953867b819915

SHA1
fce0e90e6e9686211d5964ea84785b738f43f7d6

SHA256
2337a82434717dc8b3e8f13af333aa8494c0feb47e1144a8179764839f809495

SHA512
041fb97a84f89548e7f03c8c893c3ec67450d3d55ee8ef2ac2221cdcada5f5eadc9c9874ad675be0b6454ec9c241820b6f6736b7cb92517d7104af7c485c7e92

Download Submit
C:\Windows\system\kVJzsqA.exe

Filesize
1.6MB

MD5
1a28105ed9189e43fb0c9f51e91427f5

SHA1
2e39fa5ee359a3a3691dc3604a9d670f6b46e867

SHA256
5a27eba10f02fc0e2635fe77c08bb97d3381945b0f999cf95201a5e7a8f9bcad

SHA512
3933716663ca72576553cd6aa0fd019336249107d8efa517f8dd20b1e72597a020a970692cb9912667a5b3270cec22d36e7cfccfeaf8b4ef087c739208edc68f

Download Submit
C:\Windows\system\nihjIDx.exe

Filesize
1.6MB

MD5
7f73ad3f9c248a6001732a935baea0b1

SHA1
eb4179d5a133f34a7875e96edfda5f6f1cd73c98

SHA256
8fa43226c4dea943c15b2b80d541270e50a450abc7535145c6a258c4ec6484c6

SHA512
ee2da7ca3e26c711848c314a084e6e1e3be31bc952aabb542c0cdc9d5d1d86c5fee3eea667f7e21c7cc0b97382d3d12305c856e9e31ff495d0a2fbf6ec596c22

Download Submit
C:\Windows\system\qtrWrzF.exe

Filesize
1.6MB

MD5
c4b0ca0d42b627a10dc3fbac277cd895

SHA1
b5fcda136877e3ce9d8eb89d84bfd86fe82142ce

SHA256
22b36202e9643aa6a98743317a1803788add251b99de8a1ab6811645d61b6de8

SHA512
f6b42501b5ba049ef6a78ffc0d0c3e05582482f36536f8b82a369b129ba20dfb0d2c72677908b89cd8d1531ef15c0e9a499f07e441d82b4cacb57669f126a792

Download Submit
C:\Windows\system\sAGeXCy.exe

Filesize
1.6MB

MD5
14f1e053e396ab1b81178abfbe4ca464

SHA1
001e5436f7a0615c6ec7d29d3876a9b314c6c108

SHA256
a0ec984d05d7ff742ed991fce393ea99a4041588cb961c094e34d84593a47941

SHA512
bc4b074bf2382b608b601685c161de1a4c96b7e37d3d5918b1d9ab75f8a2c6b33a99175ab8f22553fd2881877d6e641adf99c6e0fc24080f5287b137cea165a8

Download Submit
C:\Windows\system\tHIQCId.exe

Filesize
1.6MB

MD5
17c4ef0277b66d44e84ab309de6f380b

SHA1
39e55fcbf08da883a614049db542f197f7bedc0c

SHA256
e599b8a50488890007ef380978a13c92a3428a42ad030e3445ff143fecfe8c9a

SHA512
3ad448f3036fb9d26d749ccf1e5188e3ca062f82382144771c73199e641912a55ed5667f18a96757fb45be5fdd6cf36117ab96d308b9c7087a5cb2de095fd3a3

Download Submit
C:\Windows\system\yYuTPzm.exe

Filesize
1.6MB

MD5
bcae62f29792ad0093095acf48ff2962

SHA1
13002e7cbb119dbea7ff668680ff3503c4118d72

SHA256
39616ad3c740e7fb1b9736d20e57d2c1b9ce9eeb40436e0d37c135521a46ef8c

SHA512
c1ff26f0a3e99e30c5d04fa791a77ddaa9876979ff70aeff145fbfeaf87983a7bbec89623e620697dd12d9e3bd5b66f6ae8e215d6c258acbd1562a0ee87114a8

Download Submit
C:\Windows\system\zQrtAkt.exe

Filesize
1.6MB

MD5
1c829b8bab079b3f3ae35c91e15f97c3

SHA1
b28012184d0c0d5d59f4d137e3a73b51993b6d62

SHA256
b9278afeb65cebb73e8cbf00b00635e3f71f6fd32066a27828234197a9fd25e5

SHA512
1ed03874c118a145c9ab5e013f6302d99608bfd474a8e5e0a9459d7bd45a072666217db9f39d3d28f4eb6b9d03b601d1dfba770fd1d2012f5aefd04f86f4f333

Download Submit
\Windows\system\EIouVdq.exe

Filesize
1.6MB

MD5
045db205c093cbbb89b4bf6b9c2d626b

SHA1
9357a5f7ad421125ea065e3d0b163bc8592c8d40

SHA256
2b39ceefd4995c114f1a7e1667a30e6be2109d877ee46227a9e6f7b6e649902f

SHA512
d544fe71eb5c556a254afac18755c3aef368e474dc011996463700dedf965f6261cd16179a8c0f131a734d73dfa1b4dd00d3125d4a2fa9fc623aae692ac8773a

Download Submit
\Windows\system\VozxGgk.exe

Filesize
1.6MB

MD5
386c1d032a36c4332916a982de5e908e

SHA1
8b0cacd753b368befe716e4d40daee8054cc2311

SHA256
81af4047becaa77e2ea8e9663dd018d8fe49e5c92b8ac976b17d47a800363038

SHA512
fb1c0b7eaeae15379219aa6161b3378de83ca77466ddb4acb0099559bb163d7015ffad811d12f6ed98ac805883e69bcc26f2d44559c896d38d86616b2001e338

Download Submit
\Windows\system\WyYzoee.exe

Filesize
1.6MB

MD5
0cbe5db963c976e16a5478af24256192

SHA1
b256ece70f13f277b250620dfeb6b87f7192f086

SHA256
3bc6b50c84838c9334243d545d9363d24c40d7885c859164921d767748b8254b

SHA512
5e3023865db69eb757e56d1a0ce5f202137c712ea3c3458c3178c0c3a719c5d1659495f28a6ff3e0f2f0cc35d610023d6da2a986629ba1760e208178c369f8f9

Download Submit
\Windows\system\huqsYwQ.exe

Filesize
1.6MB

MD5
e657b93df2e4ac75e2a069f0086aac34

SHA1
60daaa752e00a5912352457684233511898cf2c3

SHA256
acfc9cd632455ad37799785b3a0d478699a042a759feb9568bbdd3792f113b36

SHA512
412bf5f8453d1536a46b905a55f668cccdc7079b6b895178d664a028606808621590babb1109521452cdaec624a7ac01415d51203d900da92fad703c40707770

Download Submit
\Windows\system\kXpwtRs.exe

Filesize
1.6MB

MD5
266e72a83bf4d55977158371dc114120

SHA1
a2a14a84dcf417bec0a3c0eadfc7afa8fb166b54

SHA256
d502c633fc9da023a865a5682afa0e21e5ad70312ec0e353db23de2d5d4e8116

SHA512
a9c3019814eb9be96d41191ac4ae757e7752ca3b0d1bce575694e8e4e5d2526d21037a52ca644efcf0462c5b200caf5f0257aa8ec1a5dadb0dd7466bf69260f6

Download Submit
memory/1504-4197-0x000000013F5B0000-0x000000013F901000-memory.dmp

Filesize
3.3MB

Download
memory/1504-34-0x000000013F5B0000-0x000000013F901000-memory.dmp

Filesize
3.3MB

Download
memory/2056-20-0x000000013F710000-0x000000013FA61000-memory.dmp

Filesize
3.3MB

Download
memory/2056-1359-0x000000013F710000-0x000000013FA61000-memory.dmp

Filesize
3.3MB

Download
memory/2176-97-0x000000013F6F0000-0x000000013FA41000-memory.dmp

Filesize
3.3MB

Download
memory/2176-3122-0x000000013F6F0000-0x000000013FA41000-memory.dmp

Filesize
3.3MB

Download
memory/2176-4225-0x000000013F6F0000-0x000000013FA41000-memory.dmp

Filesize
3.3MB

Download
memory/2204-46-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2336-4223-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2336-99-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2404-4221-0x000000013FEB0000-0x0000000140201000-memory.dmp

Filesize
3.3MB

Download
memory/2404-88-0x000000013FEB0000-0x0000000140201000-memory.dmp

Filesize
3.3MB

Download
memory/2556-4207-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/2556-60-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/2560-63-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2560-4211-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2636-72-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2636-4215-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2668-4217-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2668-65-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2672-4214-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2672-64-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2804-4219-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/2804-2586-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/2804-81-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/2824-67-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2824-2838-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-69-0x000000013FEA0000-0x00000001401F1000-memory.dmp

Filesize
3.3MB

Download
memory/2824-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2824-70-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-1357-0x000000013F810000-0x000000013FB61000-memory.dmp

Filesize
3.3MB

Download
memory/2824-0-0x000000013F810000-0x000000013FB61000-memory.dmp

Filesize
3.3MB

Download
memory/2824-29-0x000000013FB70000-0x000000013FEC1000-memory.dmp

Filesize
3.3MB

Download
memory/2824-68-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2824-1695-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-1998-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-1982-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-98-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-71-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2824-76-0x000000013FEB0000-0x0000000140201000-memory.dmp

Filesize
3.3MB

Download
memory/2824-3124-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-3389-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-11-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-89-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-1358-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-66-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-104-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-62-0x0000000001ED0000-0x0000000002221000-memory.dmp

Filesize
3.3MB

Download
memory/2824-61-0x000000013FEC0000-0x0000000140211000-memory.dmp

Filesize
3.3MB

Download
memory/2824-80-0x000000013FC30000-0x000000013FF81000-memory.dmp

Filesize
3.3MB

Download
memory/2872-52-0x000000013FB70000-0x000000013FEC1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-58-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download
memory/2884-4210-0x000000013FDE0000-0x0000000140131000-memory.dmp

Filesize
3.3MB

Download