xmrig | b0c877958c35e5d953f826e6e4eebfdb2e96ec09df16f9b6376a7be2db9b7f67

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
Size

1.4MB
MD5

9c09b73b304bb33321d1a2f461b05360
SHA1

64fc0a6381ef391f5b442dc77d5e076b4ee1978f
SHA256

b0c877958c35e5d953f826e6e4eebfdb2e96ec09df16f9b6376a7be2db9b7f67
SHA512

bbabd847540836b70dcaa539da90daee6dc6e1aa261a7cdc1d06c673f2dd00bad5443b82e5870aa6edb6c1033083d8be50f80b41271ff45ce528c239fb367c53
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8BoC09aYCmcxYraECNlCOq3vzZv3G:ROdWCCi7/rahwNUnj7Zq621

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 31 IoCs

miner

resource	yara_rule
behavioral1/memory/2560-45-0x000000013FB60000-0x000000013FEB1000-memory.dmp	xmrig
behavioral1/memory/2592-53-0x000000013F470000-0x000000013F7C1000-memory.dmp	xmrig
behavioral1/memory/2652-52-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/2748-56-0x000000013F280000-0x000000013F5D1000-memory.dmp	xmrig
behavioral1/memory/2184-83-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/2636-96-0x000000013F110000-0x000000013F461000-memory.dmp	xmrig
behavioral1/memory/2012-94-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2364-82-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/1748-81-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2184-61-0x000000013FFD0000-0x0000000140321000-memory.dmp	xmrig
behavioral1/memory/2428-1236-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2552-1735-0x000000013F4C0000-0x000000013F811000-memory.dmp	xmrig
behavioral1/memory/1724-2083-0x000000013FE80000-0x00000001401D1000-memory.dmp	xmrig
behavioral1/memory/2184-2595-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/2520-2596-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/2932-3216-0x000000013F100000-0x000000013F451000-memory.dmp	xmrig
behavioral1/memory/1140-3412-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/1748-3916-0x000000013F510000-0x000000013F861000-memory.dmp	xmrig
behavioral1/memory/2364-3915-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2652-3962-0x000000013F540000-0x000000013F891000-memory.dmp	xmrig
behavioral1/memory/2560-3963-0x000000013FB60000-0x000000013FEB1000-memory.dmp	xmrig
behavioral1/memory/2748-3969-0x000000013F280000-0x000000013F5D1000-memory.dmp	xmrig
behavioral1/memory/2636-3973-0x000000013F110000-0x000000013F461000-memory.dmp	xmrig
behavioral1/memory/2012-3964-0x000000013F5C0000-0x000000013F911000-memory.dmp	xmrig
behavioral1/memory/2592-3970-0x000000013F470000-0x000000013F7C1000-memory.dmp	xmrig
behavioral1/memory/2428-3991-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig
behavioral1/memory/2552-3989-0x000000013F4C0000-0x000000013F811000-memory.dmp	xmrig
behavioral1/memory/2520-4021-0x000000013F860000-0x000000013FBB1000-memory.dmp	xmrig
behavioral1/memory/1724-4069-0x000000013FE80000-0x00000001401D1000-memory.dmp	xmrig
behavioral1/memory/1140-4030-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2932-4266-0x000000013F100000-0x000000013F451000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1748	kfODglW.exe
2364	dLvQtnG.exe
2012	nurXAMF.exe
2560	BCsocCn.exe
2636	WFNiymH.exe
2652	csrsQBg.exe
2592	yiFrsyo.exe
2748	cNrSvlP.exe
2428	xWNIHQc.exe
2552	JzYbcpH.exe
1724	ZYLlYph.exe
2520	BseYtfy.exe
2932	OInCsgM.exe
1140	tZAbrHG.exe
2668	BxoWYaA.exe
1940	LsauzxZ.exe
2740	Lpmqqqw.exe
1676	AhjJXLT.exe
2408	wSTEtDY.exe
2736	cWNfhKh.exe
2772	GModfEH.exe
384	xcUXrFB.exe
1500	mMxJVxq.exe
1284	sjMKCQY.exe
2080	aPXRFfJ.exe
1780	XzknuOn.exe
2216	VBgoLIY.exe
2664	uqsGugB.exe
2108	GzVNVIM.exe
540	GgaaGSr.exe
1148	UPxZeFO.exe
1488	LepkUot.exe
1856	twkqGXy.exe
2276	kWTQLpN.exe
1796	FZeaaFE.exe
2400	iGfjvVH.exe
1016	oZrgKDP.exe
2304	BsTCOtG.exe
2116	JzlKYxg.exe
2120	acUOTnr.exe
1548	nSUHfRZ.exe
1952	CFCZgCa.exe
1352	hErxxSs.exe
944	RjdOjPC.exe
1328	FSJOvKy.exe
2904	TtIbGYa.exe
916	bzgrMaI.exe
2140	pZpsLYu.exe
1736	PfhCrmm.exe
2360	KJdmohh.exe
3052	KoVxaws.exe
616	DvmwQJg.exe
2008	vHQxqeW.exe
808	iYVSsES.exe
1504	NDmnNMK.exe
2396	dkDvkiE.exe
2968	DamBazg.exe
1616	dPXOUfE.exe
1604	YTFtSZV.exe
2288	hibtySb.exe
1144	lmpinqJ.exe
2536	xapBiQe.exe
2648	XwGPkTQ.exe
2700	zPykzgm.exe

Loads dropped DLL 64 IoCs

pid	Process
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-0-0x000000013FFD0000-0x0000000140321000-memory.dmp	upx
behavioral1/files/0x000b000000013417-3.dat	upx
behavioral1/memory/2184-6-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/1748-8-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/files/0x0034000000013a53-10.dat	upx
behavioral1/memory/2364-16-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/files/0x0007000000014183-13.dat	upx
behavioral1/memory/2012-22-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/files/0x0007000000014251-27.dat	upx
behavioral1/files/0x000700000001431b-36.dat	upx
behavioral1/files/0x0008000000014367-41.dat	upx
behavioral1/files/0x0034000000013a88-51.dat	upx
behavioral1/memory/2560-45-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/memory/2592-53-0x000000013F470000-0x000000013F7C1000-memory.dmp	upx
behavioral1/memory/2652-52-0x000000013F540000-0x000000013F891000-memory.dmp	upx
behavioral1/memory/2748-56-0x000000013F280000-0x000000013F5D1000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-66.dat	upx
behavioral1/memory/2552-68-0x000000013F4C0000-0x000000013F811000-memory.dmp	upx
behavioral1/memory/2428-62-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/files/0x0006000000014c2d-79.dat	upx
behavioral1/memory/2520-84-0x000000013F860000-0x000000013FBB1000-memory.dmp	upx
behavioral1/memory/1724-74-0x000000013FE80000-0x00000001401D1000-memory.dmp	upx
behavioral1/memory/1140-98-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/files/0x0006000000015b85-144.dat	upx
behavioral1/files/0x0006000000015cd2-167.dat	upx
behavioral1/files/0x0006000000015cf8-184.dat	upx
behavioral1/files/0x0006000000015d0a-188.dat	upx
behavioral1/files/0x0006000000015ce3-175.dat	upx
behavioral1/files/0x0006000000015cee-179.dat	upx
behavioral1/files/0x0006000000015cc5-164.dat	upx
behavioral1/files/0x0006000000015ca8-154.dat	upx
behavioral1/files/0x0006000000015cb1-159.dat	upx
behavioral1/files/0x0006000000015c9a-149.dat	upx
behavioral1/files/0x0006000000015ae3-134.dat	upx
behavioral1/files/0x0006000000015b50-139.dat	upx
behavioral1/files/0x0006000000015662-124.dat	upx
behavioral1/files/0x00060000000158d9-129.dat	upx
behavioral1/files/0x00060000000153ee-114.dat	upx
behavioral1/files/0x000600000001565a-119.dat	upx
behavioral1/files/0x00060000000150d9-109.dat	upx
behavioral1/files/0x0006000000015083-103.dat	upx
behavioral1/memory/2932-90-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/files/0x0006000000014f57-88.dat	upx
behavioral1/memory/2636-96-0x000000013F110000-0x000000013F461000-memory.dmp	upx
behavioral1/memory/2012-94-0x000000013F5C0000-0x000000013F911000-memory.dmp	upx
behavioral1/files/0x000600000001507a-93.dat	upx
behavioral1/memory/2364-82-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/memory/1748-81-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/files/0x0006000000014bd7-73.dat	upx
behavioral1/memory/2184-61-0x000000013FFD0000-0x0000000140321000-memory.dmp	upx
behavioral1/files/0x0007000000014a60-59.dat	upx
behavioral1/memory/2636-39-0x000000013F110000-0x000000013F461000-memory.dmp	upx
behavioral1/files/0x000700000001418c-25.dat	upx
behavioral1/memory/2428-1236-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/memory/2552-1735-0x000000013F4C0000-0x000000013F811000-memory.dmp	upx
behavioral1/memory/1724-2083-0x000000013FE80000-0x00000001401D1000-memory.dmp	upx
behavioral1/memory/2520-2596-0x000000013F860000-0x000000013FBB1000-memory.dmp	upx
behavioral1/memory/2932-3216-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/memory/1140-3412-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/memory/1748-3916-0x000000013F510000-0x000000013F861000-memory.dmp	upx
behavioral1/memory/2364-3915-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/memory/2652-3962-0x000000013F540000-0x000000013F891000-memory.dmp	upx
behavioral1/memory/2560-3963-0x000000013FB60000-0x000000013FEB1000-memory.dmp	upx
behavioral1/memory/2748-3969-0x000000013F280000-0x000000013F5D1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eQMmcmB.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\FfnhUjQ.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\bMngYgn.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\GmrEpJD.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\bvjkmxe.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\mhceNtu.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\OJxqhlS.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\XQiIaAf.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\WAsOxhl.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\qbHCEUr.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\olGttlg.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\LrkkCPj.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\BCsocCn.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\sjMKCQY.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\hhhNGhm.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\UKSTvpL.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\xnRWOsC.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\UFKFIYh.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\knbzYzo.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\qJSzRVb.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\ZFfifNV.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\OARAxYq.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\WKVOPEU.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\BagSeKc.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\EObEbLe.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\uqgOBGY.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\OaObVlu.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\hRxtrFv.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\RxgsPJY.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\iboCatp.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\PkHnUDK.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\AxXfDYP.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\FYtSQbE.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\iXltqYt.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\PUqBRCA.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\EuBpRtE.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\oKFcwEQ.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\VSXRXtZ.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\HyvtlqA.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\curCuis.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\IhmrDBs.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\nuAQQHq.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\xzrXETl.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\btgcaOg.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\PkWHiDL.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\vGFhFPC.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\OhUQuSz.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\ziDqbMd.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\qjKGZCX.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\YNLBvzk.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\ObEZEaw.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\PuaKTAt.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\qzASenZ.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\dsywHPf.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\qatZbgG.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\SlvclMt.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\vtWJCor.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\KlGpGUD.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\fzdcGAx.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\WWyoXPn.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\OcxDdVH.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\ONvYbAc.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\QzQpQbG.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
File created	C:\Windows\System\FhDzhCU.exe	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1748	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	29
PID 2184 wrote to memory of 1748	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	29
PID 2184 wrote to memory of 1748	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	29
PID 2184 wrote to memory of 2364	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	30
PID 2184 wrote to memory of 2364	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	30
PID 2184 wrote to memory of 2364	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	30
PID 2184 wrote to memory of 2012	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	31
PID 2184 wrote to memory of 2012	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	31
PID 2184 wrote to memory of 2012	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	31
PID 2184 wrote to memory of 2560	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	32
PID 2184 wrote to memory of 2560	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	32
PID 2184 wrote to memory of 2560	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	32
PID 2184 wrote to memory of 2636	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	33
PID 2184 wrote to memory of 2636	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	33
PID 2184 wrote to memory of 2636	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	33
PID 2184 wrote to memory of 2652	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	34
PID 2184 wrote to memory of 2652	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	34
PID 2184 wrote to memory of 2652	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	34
PID 2184 wrote to memory of 2592	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	35
PID 2184 wrote to memory of 2592	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	35
PID 2184 wrote to memory of 2592	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	35
PID 2184 wrote to memory of 2748	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	36
PID 2184 wrote to memory of 2748	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	36
PID 2184 wrote to memory of 2748	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	36
PID 2184 wrote to memory of 2428	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	37
PID 2184 wrote to memory of 2428	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	37
PID 2184 wrote to memory of 2428	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	37
PID 2184 wrote to memory of 2552	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	38
PID 2184 wrote to memory of 2552	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	38
PID 2184 wrote to memory of 2552	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	38
PID 2184 wrote to memory of 1724	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	39
PID 2184 wrote to memory of 1724	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	39
PID 2184 wrote to memory of 1724	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	39
PID 2184 wrote to memory of 2520	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	40
PID 2184 wrote to memory of 2520	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	40
PID 2184 wrote to memory of 2520	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	40
PID 2184 wrote to memory of 2932	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	41
PID 2184 wrote to memory of 2932	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	41
PID 2184 wrote to memory of 2932	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	41
PID 2184 wrote to memory of 1140	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	42
PID 2184 wrote to memory of 1140	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	42
PID 2184 wrote to memory of 1140	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	42
PID 2184 wrote to memory of 2668	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	43
PID 2184 wrote to memory of 2668	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	43
PID 2184 wrote to memory of 2668	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	43
PID 2184 wrote to memory of 1940	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	44
PID 2184 wrote to memory of 1940	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	44
PID 2184 wrote to memory of 1940	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	44
PID 2184 wrote to memory of 2740	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	45
PID 2184 wrote to memory of 2740	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	45
PID 2184 wrote to memory of 2740	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	45
PID 2184 wrote to memory of 1676	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	46
PID 2184 wrote to memory of 1676	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	46
PID 2184 wrote to memory of 1676	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	46
PID 2184 wrote to memory of 2408	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	47
PID 2184 wrote to memory of 2408	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	47
PID 2184 wrote to memory of 2408	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	47
PID 2184 wrote to memory of 2736	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	48
PID 2184 wrote to memory of 2736	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	48
PID 2184 wrote to memory of 2736	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	48
PID 2184 wrote to memory of 2772	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	49
PID 2184 wrote to memory of 2772	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	49
PID 2184 wrote to memory of 2772	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	49
PID 2184 wrote to memory of 384	2184	9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9c09b73b304bb33321d1a2f461b05360_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\System\kfODglW.exe
  C:\Windows\System\kfODglW.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\dLvQtnG.exe
  C:\Windows\System\dLvQtnG.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\nurXAMF.exe
  C:\Windows\System\nurXAMF.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\BCsocCn.exe
  C:\Windows\System\BCsocCn.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\WFNiymH.exe
  C:\Windows\System\WFNiymH.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\csrsQBg.exe
  C:\Windows\System\csrsQBg.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\yiFrsyo.exe
  C:\Windows\System\yiFrsyo.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\cNrSvlP.exe
  C:\Windows\System\cNrSvlP.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\xWNIHQc.exe
  C:\Windows\System\xWNIHQc.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\JzYbcpH.exe
  C:\Windows\System\JzYbcpH.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ZYLlYph.exe
  C:\Windows\System\ZYLlYph.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\BseYtfy.exe
  C:\Windows\System\BseYtfy.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\OInCsgM.exe
  C:\Windows\System\OInCsgM.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\tZAbrHG.exe
  C:\Windows\System\tZAbrHG.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\BxoWYaA.exe
  C:\Windows\System\BxoWYaA.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\LsauzxZ.exe
  C:\Windows\System\LsauzxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\Lpmqqqw.exe
  C:\Windows\System\Lpmqqqw.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\AhjJXLT.exe
  C:\Windows\System\AhjJXLT.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\wSTEtDY.exe
  C:\Windows\System\wSTEtDY.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\cWNfhKh.exe
  C:\Windows\System\cWNfhKh.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\GModfEH.exe
  C:\Windows\System\GModfEH.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\xcUXrFB.exe
  C:\Windows\System\xcUXrFB.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\mMxJVxq.exe
  C:\Windows\System\mMxJVxq.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\sjMKCQY.exe
  C:\Windows\System\sjMKCQY.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\aPXRFfJ.exe
  C:\Windows\System\aPXRFfJ.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\XzknuOn.exe
  C:\Windows\System\XzknuOn.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\VBgoLIY.exe
  C:\Windows\System\VBgoLIY.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\uqsGugB.exe
  C:\Windows\System\uqsGugB.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\GzVNVIM.exe
  C:\Windows\System\GzVNVIM.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\GgaaGSr.exe
  C:\Windows\System\GgaaGSr.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\UPxZeFO.exe
  C:\Windows\System\UPxZeFO.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\LepkUot.exe
  C:\Windows\System\LepkUot.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\twkqGXy.exe
  C:\Windows\System\twkqGXy.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\kWTQLpN.exe
  C:\Windows\System\kWTQLpN.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\FZeaaFE.exe
  C:\Windows\System\FZeaaFE.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\iGfjvVH.exe
  C:\Windows\System\iGfjvVH.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\oZrgKDP.exe
  C:\Windows\System\oZrgKDP.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\BsTCOtG.exe
  C:\Windows\System\BsTCOtG.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\JzlKYxg.exe
  C:\Windows\System\JzlKYxg.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\acUOTnr.exe
  C:\Windows\System\acUOTnr.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\nSUHfRZ.exe
  C:\Windows\System\nSUHfRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\CFCZgCa.exe
  C:\Windows\System\CFCZgCa.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\hErxxSs.exe
  C:\Windows\System\hErxxSs.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\RjdOjPC.exe
  C:\Windows\System\RjdOjPC.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\FSJOvKy.exe
  C:\Windows\System\FSJOvKy.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\TtIbGYa.exe
  C:\Windows\System\TtIbGYa.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\bzgrMaI.exe
  C:\Windows\System\bzgrMaI.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\pZpsLYu.exe
  C:\Windows\System\pZpsLYu.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\PfhCrmm.exe
  C:\Windows\System\PfhCrmm.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\KJdmohh.exe
  C:\Windows\System\KJdmohh.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\KoVxaws.exe
  C:\Windows\System\KoVxaws.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\DvmwQJg.exe
  C:\Windows\System\DvmwQJg.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\vHQxqeW.exe
  C:\Windows\System\vHQxqeW.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\iYVSsES.exe
  C:\Windows\System\iYVSsES.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\NDmnNMK.exe
  C:\Windows\System\NDmnNMK.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\dkDvkiE.exe
  C:\Windows\System\dkDvkiE.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\DamBazg.exe
  C:\Windows\System\DamBazg.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\dPXOUfE.exe
  C:\Windows\System\dPXOUfE.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\YTFtSZV.exe
  C:\Windows\System\YTFtSZV.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\hibtySb.exe
  C:\Windows\System\hibtySb.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\lmpinqJ.exe
  C:\Windows\System\lmpinqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\xapBiQe.exe
  C:\Windows\System\xapBiQe.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\XwGPkTQ.exe
  C:\Windows\System\XwGPkTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\zPykzgm.exe
  C:\Windows\System\zPykzgm.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\nWirbuA.exe
  C:\Windows\System\nWirbuA.exe
  2⤵
  PID:2688
- C:\Windows\System\TFqWfMv.exe
  C:\Windows\System\TFqWfMv.exe
  2⤵
  PID:2796
- C:\Windows\System\TdvKSKg.exe
  C:\Windows\System\TdvKSKg.exe
  2⤵
  PID:2680
- C:\Windows\System\hGpHSlY.exe
  C:\Windows\System\hGpHSlY.exe
  2⤵
  PID:2476
- C:\Windows\System\FAakQsm.exe
  C:\Windows\System\FAakQsm.exe
  2⤵
  PID:2828
- C:\Windows\System\zolqcGW.exe
  C:\Windows\System\zolqcGW.exe
  2⤵
  PID:2964
- C:\Windows\System\YAnuqHl.exe
  C:\Windows\System\YAnuqHl.exe
  2⤵
  PID:2720
- C:\Windows\System\yKJSngL.exe
  C:\Windows\System\yKJSngL.exe
  2⤵
  PID:1824
- C:\Windows\System\UnQNTUa.exe
  C:\Windows\System\UnQNTUa.exe
  2⤵
  PID:1752
- C:\Windows\System\bJrBdgO.exe
  C:\Windows\System\bJrBdgO.exe
  2⤵
  PID:2752
- C:\Windows\System\cgrWYau.exe
  C:\Windows\System\cgrWYau.exe
  2⤵
  PID:2456
- C:\Windows\System\WWyoXPn.exe
  C:\Windows\System\WWyoXPn.exe
  2⤵
  PID:1448
- C:\Windows\System\MsVAVJY.exe
  C:\Windows\System\MsVAVJY.exe
  2⤵
  PID:1760
- C:\Windows\System\wyhZeTN.exe
  C:\Windows\System\wyhZeTN.exe
  2⤵
  PID:1732
- C:\Windows\System\pLpYYZg.exe
  C:\Windows\System\pLpYYZg.exe
  2⤵
  PID:1248
- C:\Windows\System\LPOmLhh.exe
  C:\Windows\System\LPOmLhh.exe
  2⤵
  PID:776
- C:\Windows\System\vGqhyxU.exe
  C:\Windows\System\vGqhyxU.exe
  2⤵
  PID:816
- C:\Windows\System\eQMmcmB.exe
  C:\Windows\System\eQMmcmB.exe
  2⤵
  PID:3028
- C:\Windows\System\TdvdEdv.exe
  C:\Windows\System\TdvdEdv.exe
  2⤵
  PID:1484
- C:\Windows\System\RhwruFX.exe
  C:\Windows\System\RhwruFX.exe
  2⤵
  PID:1340
- C:\Windows\System\xYkgwjW.exe
  C:\Windows\System\xYkgwjW.exe
  2⤵
  PID:1092
- C:\Windows\System\eBHUgtK.exe
  C:\Windows\System\eBHUgtK.exe
  2⤵
  PID:452
- C:\Windows\System\qkJcllY.exe
  C:\Windows\System\qkJcllY.exe
  2⤵
  PID:1568
- C:\Windows\System\OdZFZcF.exe
  C:\Windows\System\OdZFZcF.exe
  2⤵
  PID:2112
- C:\Windows\System\RtEVWHg.exe
  C:\Windows\System\RtEVWHg.exe
  2⤵
  PID:1544
- C:\Windows\System\eTERDsB.exe
  C:\Windows\System\eTERDsB.exe
  2⤵
  PID:612
- C:\Windows\System\LXppoYv.exe
  C:\Windows\System\LXppoYv.exe
  2⤵
  PID:320
- C:\Windows\System\LyuCqPb.exe
  C:\Windows\System\LyuCqPb.exe
  2⤵
  PID:572
- C:\Windows\System\aANiVvZ.exe
  C:\Windows\System\aANiVvZ.exe
  2⤵
  PID:552
- C:\Windows\System\JndzbJy.exe
  C:\Windows\System\JndzbJy.exe
  2⤵
  PID:1800
- C:\Windows\System\vmGlOaZ.exe
  C:\Windows\System\vmGlOaZ.exe
  2⤵
  PID:1232
- C:\Windows\System\abMtvhC.exe
  C:\Windows\System\abMtvhC.exe
  2⤵
  PID:1776
- C:\Windows\System\yIrdwGj.exe
  C:\Windows\System\yIrdwGj.exe
  2⤵
  PID:2468
- C:\Windows\System\ZpyWdkj.exe
  C:\Windows\System\ZpyWdkj.exe
  2⤵
  PID:1608
- C:\Windows\System\xROREBU.exe
  C:\Windows\System\xROREBU.exe
  2⤵
  PID:2344
- C:\Windows\System\tKXNoKs.exe
  C:\Windows\System\tKXNoKs.exe
  2⤵
  PID:2196
- C:\Windows\System\ZLPsEFF.exe
  C:\Windows\System\ZLPsEFF.exe
  2⤵
  PID:2368
- C:\Windows\System\ycoIWQB.exe
  C:\Windows\System\ycoIWQB.exe
  2⤵
  PID:2628
- C:\Windows\System\nQgDnNj.exe
  C:\Windows\System\nQgDnNj.exe
  2⤵
  PID:2640
- C:\Windows\System\UaSGzAg.exe
  C:\Windows\System\UaSGzAg.exe
  2⤵
  PID:2696
- C:\Windows\System\TtNlfRa.exe
  C:\Windows\System\TtNlfRa.exe
  2⤵
  PID:1256
- C:\Windows\System\RuUVkIJ.exe
  C:\Windows\System\RuUVkIJ.exe
  2⤵
  PID:2440
- C:\Windows\System\GrdUQDM.exe
  C:\Windows\System\GrdUQDM.exe
  2⤵
  PID:1920
- C:\Windows\System\bEmPKDy.exe
  C:\Windows\System\bEmPKDy.exe
  2⤵
  PID:1192
- C:\Windows\System\PzOwVwX.exe
  C:\Windows\System\PzOwVwX.exe
  2⤵
  PID:1528
- C:\Windows\System\fMrpHjn.exe
  C:\Windows\System\fMrpHjn.exe
  2⤵
  PID:1432
- C:\Windows\System\edrznqZ.exe
  C:\Windows\System\edrznqZ.exe
  2⤵
  PID:2256
- C:\Windows\System\qQjKbIZ.exe
  C:\Windows\System\qQjKbIZ.exe
  2⤵
  PID:448
- C:\Windows\System\TfMjDWa.exe
  C:\Windows\System\TfMjDWa.exe
  2⤵
  PID:1288
- C:\Windows\System\YuzLpGd.exe
  C:\Windows\System\YuzLpGd.exe
  2⤵
  PID:2272
- C:\Windows\System\lQGxOBc.exe
  C:\Windows\System\lQGxOBc.exe
  2⤵
  PID:860
- C:\Windows\System\iGQWFlq.exe
  C:\Windows\System\iGQWFlq.exe
  2⤵
  PID:564
- C:\Windows\System\onuvSBQ.exe
  C:\Windows\System\onuvSBQ.exe
  2⤵
  PID:752
- C:\Windows\System\yNrupgb.exe
  C:\Windows\System\yNrupgb.exe
  2⤵
  PID:1772
- C:\Windows\System\eiHzKLx.exe
  C:\Windows\System\eiHzKLx.exe
  2⤵
  PID:1864
- C:\Windows\System\bIQdIBS.exe
  C:\Windows\System\bIQdIBS.exe
  2⤵
  PID:960
- C:\Windows\System\rPcSsKQ.exe
  C:\Windows\System\rPcSsKQ.exe
  2⤵
  PID:1816
- C:\Windows\System\ivhKMda.exe
  C:\Windows\System\ivhKMda.exe
  2⤵
  PID:2308
- C:\Windows\System\GxgUpdX.exe
  C:\Windows\System\GxgUpdX.exe
  2⤵
  PID:792
- C:\Windows\System\mQOCnlv.exe
  C:\Windows\System\mQOCnlv.exe
  2⤵
  PID:3032
- C:\Windows\System\otyXTKT.exe
  C:\Windows\System\otyXTKT.exe
  2⤵
  PID:1664
- C:\Windows\System\AjVKMuj.exe
  C:\Windows\System\AjVKMuj.exe
  2⤵
  PID:2324
- C:\Windows\System\QHSlgBs.exe
  C:\Windows\System\QHSlgBs.exe
  2⤵
  PID:1584
- C:\Windows\System\PCnfcNl.exe
  C:\Windows\System\PCnfcNl.exe
  2⤵
  PID:1628
- C:\Windows\System\OmPRhKJ.exe
  C:\Windows\System\OmPRhKJ.exe
  2⤵
  PID:2548
- C:\Windows\System\ThMPZpb.exe
  C:\Windows\System\ThMPZpb.exe
  2⤵
  PID:2800
- C:\Windows\System\eCjulVt.exe
  C:\Windows\System\eCjulVt.exe
  2⤵
  PID:2284
- C:\Windows\System\nSMUDgJ.exe
  C:\Windows\System\nSMUDgJ.exe
  2⤵
  PID:1960
- C:\Windows\System\wCwtwrP.exe
  C:\Windows\System\wCwtwrP.exe
  2⤵
  PID:1916
- C:\Windows\System\jFSunGp.exe
  C:\Windows\System\jFSunGp.exe
  2⤵
  PID:1632
- C:\Windows\System\qTYjvzq.exe
  C:\Windows\System\qTYjvzq.exe
  2⤵
  PID:2888
- C:\Windows\System\vNLCUHM.exe
  C:\Windows\System\vNLCUHM.exe
  2⤵
  PID:596
- C:\Windows\System\EUSrpQw.exe
  C:\Windows\System\EUSrpQw.exe
  2⤵
  PID:480
- C:\Windows\System\rsHXDPg.exe
  C:\Windows\System\rsHXDPg.exe
  2⤵
  PID:2900
- C:\Windows\System\fKAbCYp.exe
  C:\Windows\System\fKAbCYp.exe
  2⤵
  PID:2464
- C:\Windows\System\whMHUip.exe
  C:\Windows\System\whMHUip.exe
  2⤵
  PID:1104
- C:\Windows\System\eeOqjFW.exe
  C:\Windows\System\eeOqjFW.exe
  2⤵
  PID:2920
- C:\Windows\System\MzNspWA.exe
  C:\Windows\System\MzNspWA.exe
  2⤵
  PID:1436
- C:\Windows\System\zJLjTmp.exe
  C:\Windows\System\zJLjTmp.exe
  2⤵
  PID:2616
- C:\Windows\System\ZWjRJtf.exe
  C:\Windows\System\ZWjRJtf.exe
  2⤵
  PID:1744
- C:\Windows\System\lPUdxeQ.exe
  C:\Windows\System\lPUdxeQ.exe
  2⤵
  PID:2528
- C:\Windows\System\nCyjKWK.exe
  C:\Windows\System\nCyjKWK.exe
  2⤵
  PID:1276
- C:\Windows\System\UaYRIDD.exe
  C:\Windows\System\UaYRIDD.exe
  2⤵
  PID:896
- C:\Windows\System\XEecCbh.exe
  C:\Windows\System\XEecCbh.exe
  2⤵
  PID:2832
- C:\Windows\System\EXXkKug.exe
  C:\Windows\System\EXXkKug.exe
  2⤵
  PID:2824
- C:\Windows\System\NAEzHDc.exe
  C:\Windows\System\NAEzHDc.exe
  2⤵
  PID:2160
- C:\Windows\System\sBbkcHN.exe
  C:\Windows\System\sBbkcHN.exe
  2⤵
  PID:700
- C:\Windows\System\QWSANGk.exe
  C:\Windows\System\QWSANGk.exe
  2⤵
  PID:1044
- C:\Windows\System\tgvjelu.exe
  C:\Windows\System\tgvjelu.exe
  2⤵
  PID:1904
- C:\Windows\System\JGLjSeN.exe
  C:\Windows\System\JGLjSeN.exe
  2⤵
  PID:400
- C:\Windows\System\DVxyupZ.exe
  C:\Windows\System\DVxyupZ.exe
  2⤵
  PID:2724
- C:\Windows\System\kYKscBR.exe
  C:\Windows\System\kYKscBR.exe
  2⤵
  PID:2168
- C:\Windows\System\YYufWiE.exe
  C:\Windows\System\YYufWiE.exe
  2⤵
  PID:2884
- C:\Windows\System\UKCCfPt.exe
  C:\Windows\System\UKCCfPt.exe
  2⤵
  PID:1356
- C:\Windows\System\PRZXWBp.exe
  C:\Windows\System\PRZXWBp.exe
  2⤵
  PID:1048
- C:\Windows\System\MiTKvaE.exe
  C:\Windows\System\MiTKvaE.exe
  2⤵
  PID:2448
- C:\Windows\System\kYHGSvo.exe
  C:\Windows\System\kYHGSvo.exe
  2⤵
  PID:1552
- C:\Windows\System\BmtDUzz.exe
  C:\Windows\System\BmtDUzz.exe
  2⤵
  PID:2896
- C:\Windows\System\TUywXei.exe
  C:\Windows\System\TUywXei.exe
  2⤵
  PID:1496
- C:\Windows\System\aKxcJqB.exe
  C:\Windows\System\aKxcJqB.exe
  2⤵
  PID:2352
- C:\Windows\System\GFGbKMV.exe
  C:\Windows\System\GFGbKMV.exe
  2⤵
  PID:1620
- C:\Windows\System\FiTPASs.exe
  C:\Windows\System\FiTPASs.exe
  2⤵
  PID:2732
- C:\Windows\System\KlGpGUD.exe
  C:\Windows\System\KlGpGUD.exe
  2⤵
  PID:2948
- C:\Windows\System\MDoSdJT.exe
  C:\Windows\System\MDoSdJT.exe
  2⤵
  PID:2672
- C:\Windows\System\EgbrrUS.exe
  C:\Windows\System\EgbrrUS.exe
  2⤵
  PID:2656
- C:\Windows\System\npSMtwW.exe
  C:\Windows\System\npSMtwW.exe
  2⤵
  PID:2260
- C:\Windows\System\qRwvNxC.exe
  C:\Windows\System\qRwvNxC.exe
  2⤵
  PID:1600
- C:\Windows\System\WtNqIBW.exe
  C:\Windows\System\WtNqIBW.exe
  2⤵
  PID:2860
- C:\Windows\System\MacGfQS.exe
  C:\Windows\System\MacGfQS.exe
  2⤵
  PID:2420
- C:\Windows\System\nQfdXyM.exe
  C:\Windows\System\nQfdXyM.exe
  2⤵
  PID:2220
- C:\Windows\System\iXltqYt.exe
  C:\Windows\System\iXltqYt.exe
  2⤵
  PID:2460
- C:\Windows\System\tdCHbhe.exe
  C:\Windows\System\tdCHbhe.exe
  2⤵
  PID:2496
- C:\Windows\System\jYlLtty.exe
  C:\Windows\System\jYlLtty.exe
  2⤵
  PID:2504
- C:\Windows\System\JZVbjkX.exe
  C:\Windows\System\JZVbjkX.exe
  2⤵
  PID:2840
- C:\Windows\System\GzzVyNt.exe
  C:\Windows\System\GzzVyNt.exe
  2⤵
  PID:1392
- C:\Windows\System\DNdqAsI.exe
  C:\Windows\System\DNdqAsI.exe
  2⤵
  PID:2372
- C:\Windows\System\cBQwzNZ.exe
  C:\Windows\System\cBQwzNZ.exe
  2⤵
  PID:2036
- C:\Windows\System\vATbIAN.exe
  C:\Windows\System\vATbIAN.exe
  2⤵
  PID:2880
- C:\Windows\System\hxmkilU.exe
  C:\Windows\System\hxmkilU.exe
  2⤵
  PID:2572
- C:\Windows\System\kqtEQgn.exe
  C:\Windows\System\kqtEQgn.exe
  2⤵
  PID:1984
- C:\Windows\System\TVoQufp.exe
  C:\Windows\System\TVoQufp.exe
  2⤵
  PID:2928
- C:\Windows\System\uIDdBvd.exe
  C:\Windows\System\uIDdBvd.exe
  2⤵
  PID:1032
- C:\Windows\System\gSOfCvA.exe
  C:\Windows\System\gSOfCvA.exe
  2⤵
  PID:2516
- C:\Windows\System\cIzUPWP.exe
  C:\Windows\System\cIzUPWP.exe
  2⤵
  PID:2088
- C:\Windows\System\VKSgNQg.exe
  C:\Windows\System\VKSgNQg.exe
  2⤵
  PID:2044
- C:\Windows\System\klzeGrk.exe
  C:\Windows\System\klzeGrk.exe
  2⤵
  PID:2908
- C:\Windows\System\jvAmIFA.exe
  C:\Windows\System\jvAmIFA.exe
  2⤵
  PID:2820
- C:\Windows\System\LQTqnni.exe
  C:\Windows\System\LQTqnni.exe
  2⤵
  PID:1860
- C:\Windows\System\XmTZngW.exe
  C:\Windows\System\XmTZngW.exe
  2⤵
  PID:2556
- C:\Windows\System\XEXBJHY.exe
  C:\Windows\System\XEXBJHY.exe
  2⤵
  PID:576
- C:\Windows\System\szPlgMU.exe
  C:\Windows\System\szPlgMU.exe
  2⤵
  PID:1096
- C:\Windows\System\mXZOfwn.exe
  C:\Windows\System\mXZOfwn.exe
  2⤵
  PID:2452
- C:\Windows\System\SfmeGSK.exe
  C:\Windows\System\SfmeGSK.exe
  2⤵
  PID:3088
- C:\Windows\System\YjsINpE.exe
  C:\Windows\System\YjsINpE.exe
  2⤵
  PID:3108
- C:\Windows\System\mGeOLNM.exe
  C:\Windows\System\mGeOLNM.exe
  2⤵
  PID:3128
- C:\Windows\System\TLFlCfB.exe
  C:\Windows\System\TLFlCfB.exe
  2⤵
  PID:3144
- C:\Windows\System\WVSTKeD.exe
  C:\Windows\System\WVSTKeD.exe
  2⤵
  PID:3168
- C:\Windows\System\jPnpSnI.exe
  C:\Windows\System\jPnpSnI.exe
  2⤵
  PID:3184
- C:\Windows\System\tEFABjq.exe
  C:\Windows\System\tEFABjq.exe
  2⤵
  PID:3204
- C:\Windows\System\ThxGrwT.exe
  C:\Windows\System\ThxGrwT.exe
  2⤵
  PID:3228
- C:\Windows\System\anEASrC.exe
  C:\Windows\System\anEASrC.exe
  2⤵
  PID:3248
- C:\Windows\System\pRSpWvc.exe
  C:\Windows\System\pRSpWvc.exe
  2⤵
  PID:3264
- C:\Windows\System\tjMYCuy.exe
  C:\Windows\System\tjMYCuy.exe
  2⤵
  PID:3288
- C:\Windows\System\Hrgooyb.exe
  C:\Windows\System\Hrgooyb.exe
  2⤵
  PID:3304
- C:\Windows\System\YMkPXao.exe
  C:\Windows\System\YMkPXao.exe
  2⤵
  PID:3328
- C:\Windows\System\ofgvxqx.exe
  C:\Windows\System\ofgvxqx.exe
  2⤵
  PID:3344
- C:\Windows\System\hWNthfq.exe
  C:\Windows\System\hWNthfq.exe
  2⤵
  PID:3368
- C:\Windows\System\mcpLtcv.exe
  C:\Windows\System\mcpLtcv.exe
  2⤵
  PID:3384
- C:\Windows\System\VxfXGCM.exe
  C:\Windows\System\VxfXGCM.exe
  2⤵
  PID:3408
- C:\Windows\System\cOvXePC.exe
  C:\Windows\System\cOvXePC.exe
  2⤵
  PID:3424
- C:\Windows\System\PKLCegn.exe
  C:\Windows\System\PKLCegn.exe
  2⤵
  PID:3448
- C:\Windows\System\ZGLuGgi.exe
  C:\Windows\System\ZGLuGgi.exe
  2⤵
  PID:3464
- C:\Windows\System\WAsOxhl.exe
  C:\Windows\System\WAsOxhl.exe
  2⤵
  PID:3488
- C:\Windows\System\unIgFNo.exe
  C:\Windows\System\unIgFNo.exe
  2⤵
  PID:3504
- C:\Windows\System\ugGfhzo.exe
  C:\Windows\System\ugGfhzo.exe
  2⤵
  PID:3528
- C:\Windows\System\HZUHmRn.exe
  C:\Windows\System\HZUHmRn.exe
  2⤵
  PID:3544
- C:\Windows\System\VDzQUhu.exe
  C:\Windows\System\VDzQUhu.exe
  2⤵
  PID:3568
- C:\Windows\System\cqROiHM.exe
  C:\Windows\System\cqROiHM.exe
  2⤵
  PID:3584
- C:\Windows\System\oFWCBid.exe
  C:\Windows\System\oFWCBid.exe
  2⤵
  PID:3604
- C:\Windows\System\xPFnsZJ.exe
  C:\Windows\System\xPFnsZJ.exe
  2⤵
  PID:3624
- C:\Windows\System\DUqNTKu.exe
  C:\Windows\System\DUqNTKu.exe
  2⤵
  PID:3644
- C:\Windows\System\cHTMosK.exe
  C:\Windows\System\cHTMosK.exe
  2⤵
  PID:3660
- C:\Windows\System\NSuXgzf.exe
  C:\Windows\System\NSuXgzf.exe
  2⤵
  PID:3680
- C:\Windows\System\fQpaFsG.exe
  C:\Windows\System\fQpaFsG.exe
  2⤵
  PID:3696
- C:\Windows\System\FtGOSYD.exe
  C:\Windows\System\FtGOSYD.exe
  2⤵
  PID:3712
- C:\Windows\System\dkRPWSn.exe
  C:\Windows\System\dkRPWSn.exe
  2⤵
  PID:3728
- C:\Windows\System\OSRInqm.exe
  C:\Windows\System\OSRInqm.exe
  2⤵
  PID:3744
- C:\Windows\System\LWSVrXw.exe
  C:\Windows\System\LWSVrXw.exe
  2⤵
  PID:3764
- C:\Windows\System\igIgCBr.exe
  C:\Windows\System\igIgCBr.exe
  2⤵
  PID:3804
- C:\Windows\System\gXQMesR.exe
  C:\Windows\System\gXQMesR.exe
  2⤵
  PID:3820
- C:\Windows\System\uuWteoy.exe
  C:\Windows\System\uuWteoy.exe
  2⤵
  PID:3836
- C:\Windows\System\NXfTuny.exe
  C:\Windows\System\NXfTuny.exe
  2⤵
  PID:3856
- C:\Windows\System\ExpcXDj.exe
  C:\Windows\System\ExpcXDj.exe
  2⤵
  PID:3872
- C:\Windows\System\pYSqKeq.exe
  C:\Windows\System\pYSqKeq.exe
  2⤵
  PID:3888
- C:\Windows\System\cCwpPem.exe
  C:\Windows\System\cCwpPem.exe
  2⤵
  PID:3904
- C:\Windows\System\RtdsgqJ.exe
  C:\Windows\System\RtdsgqJ.exe
  2⤵
  PID:3920
- C:\Windows\System\VGszvuH.exe
  C:\Windows\System\VGszvuH.exe
  2⤵
  PID:3936
- C:\Windows\System\oPXnPnj.exe
  C:\Windows\System\oPXnPnj.exe
  2⤵
  PID:3956
- C:\Windows\System\KMopgbt.exe
  C:\Windows\System\KMopgbt.exe
  2⤵
  PID:3972
- C:\Windows\System\pOnEvar.exe
  C:\Windows\System\pOnEvar.exe
  2⤵
  PID:3988
- C:\Windows\System\jWKRQCA.exe
  C:\Windows\System\jWKRQCA.exe
  2⤵
  PID:4004
- C:\Windows\System\dTVOjxP.exe
  C:\Windows\System\dTVOjxP.exe
  2⤵
  PID:4020
- C:\Windows\System\cdbPCZg.exe
  C:\Windows\System\cdbPCZg.exe
  2⤵
  PID:4036
- C:\Windows\System\xqzWCpV.exe
  C:\Windows\System\xqzWCpV.exe
  2⤵
  PID:4056
- C:\Windows\System\wvOsrTO.exe
  C:\Windows\System\wvOsrTO.exe
  2⤵
  PID:4072
- C:\Windows\System\VRtgzLb.exe
  C:\Windows\System\VRtgzLb.exe
  2⤵
  PID:4088
- C:\Windows\System\hRxtrFv.exe
  C:\Windows\System\hRxtrFv.exe
  2⤵
  PID:3080
- C:\Windows\System\DgesKKz.exe
  C:\Windows\System\DgesKKz.exe
  2⤵
  PID:3100
- C:\Windows\System\SSbscKj.exe
  C:\Windows\System\SSbscKj.exe
  2⤵
  PID:3136
- C:\Windows\System\RPLvmGW.exe
  C:\Windows\System\RPLvmGW.exe
  2⤵
  PID:3164
- C:\Windows\System\uXYYiMn.exe
  C:\Windows\System\uXYYiMn.exe
  2⤵
  PID:3192
- C:\Windows\System\iFkpqGe.exe
  C:\Windows\System\iFkpqGe.exe
  2⤵
  PID:3220
- C:\Windows\System\NHwuPJH.exe
  C:\Windows\System\NHwuPJH.exe
  2⤵
  PID:3240
- C:\Windows\System\RKimqmo.exe
  C:\Windows\System\RKimqmo.exe
  2⤵
  PID:3280
- C:\Windows\System\BhLPJMt.exe
  C:\Windows\System\BhLPJMt.exe
  2⤵
  PID:3300
- C:\Windows\System\ysgWeEM.exe
  C:\Windows\System\ysgWeEM.exe
  2⤵
  PID:3316
- C:\Windows\System\TfgLouI.exe
  C:\Windows\System\TfgLouI.exe
  2⤵
  PID:3352
- C:\Windows\System\rNpsrzn.exe
  C:\Windows\System\rNpsrzn.exe
  2⤵
  PID:3380
- C:\Windows\System\DuLfqOp.exe
  C:\Windows\System\DuLfqOp.exe
  2⤵
  PID:3416
- C:\Windows\System\yLTAdHr.exe
  C:\Windows\System\yLTAdHr.exe
  2⤵
  PID:3444
- C:\Windows\System\xUHkTCa.exe
  C:\Windows\System\xUHkTCa.exe
  2⤵
  PID:3460
- C:\Windows\System\OoMaWPS.exe
  C:\Windows\System\OoMaWPS.exe
  2⤵
  PID:3496
- C:\Windows\System\pcpoEqd.exe
  C:\Windows\System\pcpoEqd.exe
  2⤵
  PID:3524
- C:\Windows\System\wlAYGpe.exe
  C:\Windows\System\wlAYGpe.exe
  2⤵
  PID:3560
- C:\Windows\System\ijFWmRM.exe
  C:\Windows\System\ijFWmRM.exe
  2⤵
  PID:3688
- C:\Windows\System\PkWHiDL.exe
  C:\Windows\System\PkWHiDL.exe
  2⤵
  PID:3776
- C:\Windows\System\tbSKfQO.exe
  C:\Windows\System\tbSKfQO.exe
  2⤵
  PID:3848
- C:\Windows\System\zyJWIEt.exe
  C:\Windows\System\zyJWIEt.exe
  2⤵
  PID:3880
- C:\Windows\System\lKaXIxp.exe
  C:\Windows\System\lKaXIxp.exe
  2⤵
  PID:3948
- C:\Windows\System\vmmHdfy.exe
  C:\Windows\System\vmmHdfy.exe
  2⤵
  PID:4012
- C:\Windows\System\dsywHPf.exe
  C:\Windows\System\dsywHPf.exe
  2⤵
  PID:4052
- C:\Windows\System\mhzkXHC.exe
  C:\Windows\System\mhzkXHC.exe
  2⤵
  PID:3096
- C:\Windows\System\yxTOmrJ.exe
  C:\Windows\System\yxTOmrJ.exe
  2⤵
  PID:4032
- C:\Windows\System\VGclBGc.exe
  C:\Windows\System\VGclBGc.exe
  2⤵
  PID:3928
- C:\Windows\System\UYJyaYA.exe
  C:\Windows\System\UYJyaYA.exe
  2⤵
  PID:3968
- C:\Windows\System\oUQnsSa.exe
  C:\Windows\System\oUQnsSa.exe
  2⤵
  PID:3556
- C:\Windows\System\gZLuwNb.exe
  C:\Windows\System\gZLuwNb.exe
  2⤵
  PID:3124
- C:\Windows\System\TbINmRd.exe
  C:\Windows\System\TbINmRd.exe
  2⤵
  PID:3244
- C:\Windows\System\JnnvxlW.exe
  C:\Windows\System\JnnvxlW.exe
  2⤵
  PID:3360
- C:\Windows\System\WocoPcS.exe
  C:\Windows\System\WocoPcS.exe
  2⤵
  PID:3456
- C:\Windows\System\ZgLAIhu.exe
  C:\Windows\System\ZgLAIhu.exe
  2⤵
  PID:3600
- C:\Windows\System\mDnIZts.exe
  C:\Windows\System\mDnIZts.exe
  2⤵
  PID:3632
- C:\Windows\System\CVJfTac.exe
  C:\Windows\System\CVJfTac.exe
  2⤵
  PID:3652
- C:\Windows\System\SHUwuYr.exe
  C:\Windows\System\SHUwuYr.exe
  2⤵
  PID:3656
- C:\Windows\System\MaHFTxz.exe
  C:\Windows\System\MaHFTxz.exe
  2⤵
  PID:3800
- C:\Windows\System\qpqxaNf.exe
  C:\Windows\System\qpqxaNf.exe
  2⤵
  PID:3864
- C:\Windows\System\OmuhFhB.exe
  C:\Windows\System\OmuhFhB.exe
  2⤵
  PID:3324
- C:\Windows\System\WxnEEEU.exe
  C:\Windows\System\WxnEEEU.exe
  2⤵
  PID:3760
- C:\Windows\System\cYWlnQf.exe
  C:\Windows\System\cYWlnQf.exe
  2⤵
  PID:3260
- C:\Windows\System\qatZbgG.exe
  C:\Windows\System\qatZbgG.exe
  2⤵
  PID:3440
- C:\Windows\System\MkPNwCO.exe
  C:\Windows\System\MkPNwCO.exe
  2⤵
  PID:3552
- C:\Windows\System\WLoDTSU.exe
  C:\Windows\System\WLoDTSU.exe
  2⤵
  PID:4068
- C:\Windows\System\Wgzaldo.exe
  C:\Windows\System\Wgzaldo.exe
  2⤵
  PID:3160
- C:\Windows\System\onOqFhy.exe
  C:\Windows\System\onOqFhy.exe
  2⤵
  PID:3592
- C:\Windows\System\cZFfMAA.exe
  C:\Windows\System\cZFfMAA.exe
  2⤵
  PID:3636
- C:\Windows\System\aSrNaua.exe
  C:\Windows\System\aSrNaua.exe
  2⤵
  PID:3692
- C:\Windows\System\fqTJvMG.exe
  C:\Windows\System\fqTJvMG.exe
  2⤵
  PID:3784
- C:\Windows\System\wBfWkSj.exe
  C:\Windows\System\wBfWkSj.exe
  2⤵
  PID:3736
- C:\Windows\System\mJCmwyb.exe
  C:\Windows\System\mJCmwyb.exe
  2⤵
  PID:3272
- C:\Windows\System\TcUgPYu.exe
  C:\Windows\System\TcUgPYu.exe
  2⤵
  PID:336
- C:\Windows\System\gwqSYyP.exe
  C:\Windows\System\gwqSYyP.exe
  2⤵
  PID:4112
- C:\Windows\System\frVSQiN.exe
  C:\Windows\System\frVSQiN.exe
  2⤵
  PID:4128
- C:\Windows\System\abFonZP.exe
  C:\Windows\System\abFonZP.exe
  2⤵
  PID:4148
- C:\Windows\System\kLkfRWB.exe
  C:\Windows\System\kLkfRWB.exe
  2⤵
  PID:4164
- C:\Windows\System\mxkRQrp.exe
  C:\Windows\System\mxkRQrp.exe
  2⤵
  PID:4180
- C:\Windows\System\sjdPYaG.exe
  C:\Windows\System\sjdPYaG.exe
  2⤵
  PID:4196
- C:\Windows\System\RJLIYMT.exe
  C:\Windows\System\RJLIYMT.exe
  2⤵
  PID:4212
- C:\Windows\System\AKATNhy.exe
  C:\Windows\System\AKATNhy.exe
  2⤵
  PID:4232
- C:\Windows\System\DqbFfOm.exe
  C:\Windows\System\DqbFfOm.exe
  2⤵
  PID:4248
- C:\Windows\System\vgbzCzC.exe
  C:\Windows\System\vgbzCzC.exe
  2⤵
  PID:4268
- C:\Windows\System\eTUjyDz.exe
  C:\Windows\System\eTUjyDz.exe
  2⤵
  PID:4284
- C:\Windows\System\AJnCEoX.exe
  C:\Windows\System\AJnCEoX.exe
  2⤵
  PID:4300
- C:\Windows\System\ahAUYAY.exe
  C:\Windows\System\ahAUYAY.exe
  2⤵
  PID:4316
- C:\Windows\System\DihZKAn.exe
  C:\Windows\System\DihZKAn.exe
  2⤵
  PID:4332
- C:\Windows\System\zbKLcFr.exe
  C:\Windows\System\zbKLcFr.exe
  2⤵
  PID:4352
- C:\Windows\System\IhmrDBs.exe
  C:\Windows\System\IhmrDBs.exe
  2⤵
  PID:4368
- C:\Windows\System\AxINnhh.exe
  C:\Windows\System\AxINnhh.exe
  2⤵
  PID:4384
- C:\Windows\System\rmVKgxC.exe
  C:\Windows\System\rmVKgxC.exe
  2⤵
  PID:4400
- C:\Windows\System\SjbtLoh.exe
  C:\Windows\System\SjbtLoh.exe
  2⤵
  PID:4420
- C:\Windows\System\bKicpai.exe
  C:\Windows\System\bKicpai.exe
  2⤵
  PID:4436
- C:\Windows\System\XRqDnuj.exe
  C:\Windows\System\XRqDnuj.exe
  2⤵
  PID:4452
- C:\Windows\System\icUtbPO.exe
  C:\Windows\System\icUtbPO.exe
  2⤵
  PID:4472
- C:\Windows\System\FWiNVGX.exe
  C:\Windows\System\FWiNVGX.exe
  2⤵
  PID:4488
- C:\Windows\System\EiByJsz.exe
  C:\Windows\System\EiByJsz.exe
  2⤵
  PID:4504
- C:\Windows\System\JGvvvCY.exe
  C:\Windows\System\JGvvvCY.exe
  2⤵
  PID:4524
- C:\Windows\System\EUAWUkT.exe
  C:\Windows\System\EUAWUkT.exe
  2⤵
  PID:4540
- C:\Windows\System\deOcllH.exe
  C:\Windows\System\deOcllH.exe
  2⤵
  PID:4556
- C:\Windows\System\xGorNEc.exe
  C:\Windows\System\xGorNEc.exe
  2⤵
  PID:4576
- C:\Windows\System\VhTLTgh.exe
  C:\Windows\System\VhTLTgh.exe
  2⤵
  PID:4592
- C:\Windows\System\bronqiG.exe
  C:\Windows\System\bronqiG.exe
  2⤵
  PID:4608
- C:\Windows\System\SKjqzuz.exe
  C:\Windows\System\SKjqzuz.exe
  2⤵
  PID:4628
- C:\Windows\System\rcqsNXp.exe
  C:\Windows\System\rcqsNXp.exe
  2⤵
  PID:4644
- C:\Windows\System\idnIhmd.exe
  C:\Windows\System\idnIhmd.exe
  2⤵
  PID:4660
- C:\Windows\System\CUIyTsO.exe
  C:\Windows\System\CUIyTsO.exe
  2⤵
  PID:4680
- C:\Windows\System\cJfbrbK.exe
  C:\Windows\System\cJfbrbK.exe
  2⤵
  PID:4696
- C:\Windows\System\QmPuwgl.exe
  C:\Windows\System\QmPuwgl.exe
  2⤵
  PID:4744
- C:\Windows\System\iQXYYRN.exe
  C:\Windows\System\iQXYYRN.exe
  2⤵
  PID:4764
- C:\Windows\System\TKQASAj.exe
  C:\Windows\System\TKQASAj.exe
  2⤵
  PID:4788
- C:\Windows\System\Jjtsrmi.exe
  C:\Windows\System\Jjtsrmi.exe
  2⤵
  PID:4808
- C:\Windows\System\ndmdwmX.exe
  C:\Windows\System\ndmdwmX.exe
  2⤵
  PID:4844
- C:\Windows\System\vGFhFPC.exe
  C:\Windows\System\vGFhFPC.exe
  2⤵
  PID:4864
- C:\Windows\System\SRIObNM.exe
  C:\Windows\System\SRIObNM.exe
  2⤵
  PID:4884
- C:\Windows\System\vEQfGkq.exe
  C:\Windows\System\vEQfGkq.exe
  2⤵
  PID:4900
- C:\Windows\System\LrOiTOc.exe
  C:\Windows\System\LrOiTOc.exe
  2⤵
  PID:4916
- C:\Windows\System\pwAkIig.exe
  C:\Windows\System\pwAkIig.exe
  2⤵
  PID:4932
- C:\Windows\System\pIWjGrH.exe
  C:\Windows\System\pIWjGrH.exe
  2⤵
  PID:4948
- C:\Windows\System\FynZUdE.exe
  C:\Windows\System\FynZUdE.exe
  2⤵
  PID:4964
- C:\Windows\System\hWAcRfw.exe
  C:\Windows\System\hWAcRfw.exe
  2⤵
  PID:4980
- C:\Windows\System\RMpLmOl.exe
  C:\Windows\System\RMpLmOl.exe
  2⤵
  PID:5004
- C:\Windows\System\AfNllmp.exe
  C:\Windows\System\AfNllmp.exe
  2⤵
  PID:5020
- C:\Windows\System\ShGLAod.exe
  C:\Windows\System\ShGLAod.exe
  2⤵
  PID:5040
- C:\Windows\System\CwctyoO.exe
  C:\Windows\System\CwctyoO.exe
  2⤵
  PID:5056
- C:\Windows\System\VWaLBkG.exe
  C:\Windows\System\VWaLBkG.exe
  2⤵
  PID:5072
- C:\Windows\System\EinlvGl.exe
  C:\Windows\System\EinlvGl.exe
  2⤵
  PID:5088
- C:\Windows\System\OXnUodF.exe
  C:\Windows\System\OXnUodF.exe
  2⤵
  PID:5108
- C:\Windows\System\kofePhF.exe
  C:\Windows\System\kofePhF.exe
  2⤵
  PID:3536
- C:\Windows\System\aCgSWQw.exe
  C:\Windows\System\aCgSWQw.exe
  2⤵
  PID:3152
- C:\Windows\System\YScxRSZ.exe
  C:\Windows\System\YScxRSZ.exe
  2⤵
  PID:3756
- C:\Windows\System\WHERkUZ.exe
  C:\Windows\System\WHERkUZ.exe
  2⤵
  PID:4244
- C:\Windows\System\EdxpupX.exe
  C:\Windows\System\EdxpupX.exe
  2⤵
  PID:4484
- C:\Windows\System\qdFaFJc.exe
  C:\Windows\System\qdFaFJc.exe
  2⤵
  PID:4584
- C:\Windows\System\kCyKlEZ.exe
  C:\Windows\System\kCyKlEZ.exe
  2⤵
  PID:4656
- C:\Windows\System\hWaJUEk.exe
  C:\Windows\System\hWaJUEk.exe
  2⤵
  PID:4564
- C:\Windows\System\YqvcuXm.exe
  C:\Windows\System\YqvcuXm.exe
  2⤵
  PID:4188
- C:\Windows\System\HftGIJs.exe
  C:\Windows\System\HftGIJs.exe
  2⤵
  PID:4264
- C:\Windows\System\CyTGiiJ.exe
  C:\Windows\System\CyTGiiJ.exe
  2⤵
  PID:4572
- C:\Windows\System\dCSjzIL.exe
  C:\Windows\System\dCSjzIL.exe
  2⤵
  PID:4668
- C:\Windows\System\XIvQxJw.exe
  C:\Windows\System\XIvQxJw.exe
  2⤵
  PID:3816
- C:\Windows\System\jjGJERf.exe
  C:\Windows\System\jjGJERf.exe
  2⤵
  PID:3404
- C:\Windows\System\ZXsNldE.exe
  C:\Windows\System\ZXsNldE.exe
  2⤵
  PID:4736
- C:\Windows\System\Xycaeur.exe
  C:\Windows\System\Xycaeur.exe
  2⤵
  PID:4772
- C:\Windows\System\nUtURPd.exe
  C:\Windows\System\nUtURPd.exe
  2⤵
  PID:4836
- C:\Windows\System\HVBwWLH.exe
  C:\Windows\System\HVBwWLH.exe
  2⤵
  PID:4896
- C:\Windows\System\QyOmSXk.exe
  C:\Windows\System\QyOmSXk.exe
  2⤵
  PID:4944
- C:\Windows\System\lnLlGGm.exe
  C:\Windows\System\lnLlGGm.exe
  2⤵
  PID:5000
- C:\Windows\System\BKWhOZk.exe
  C:\Windows\System\BKWhOZk.exe
  2⤵
  PID:5032
- C:\Windows\System\FeBUJnn.exe
  C:\Windows\System\FeBUJnn.exe
  2⤵
  PID:5100
- C:\Windows\System\bSeZlhd.exe
  C:\Windows\System\bSeZlhd.exe
  2⤵
  PID:5016
- C:\Windows\System\EVLlZuz.exe
  C:\Windows\System\EVLlZuz.exe
  2⤵
  PID:4344
- C:\Windows\System\BzHJdFQ.exe
  C:\Windows\System\BzHJdFQ.exe
  2⤵
  PID:5116
- C:\Windows\System\cXyGefz.exe
  C:\Windows\System\cXyGefz.exe
  2⤵
  PID:3432
- C:\Windows\System\QZIGTxC.exe
  C:\Windows\System\QZIGTxC.exe
  2⤵
  PID:4240
- C:\Windows\System\VLXXmhO.exe
  C:\Windows\System\VLXXmhO.exe
  2⤵
  PID:3740
- C:\Windows\System\RVhrjKf.exe
  C:\Windows\System\RVhrjKf.exe
  2⤵
  PID:4108
- C:\Windows\System\GKcPIvs.exe
  C:\Windows\System\GKcPIvs.exe
  2⤵
  PID:4448
- C:\Windows\System\vHpzvOu.exe
  C:\Windows\System\vHpzvOu.exe
  2⤵
  PID:4548
- C:\Windows\System\YMvAGYp.exe
  C:\Windows\System\YMvAGYp.exe
  2⤵
  PID:4616
- C:\Windows\System\BYYBWSp.exe
  C:\Windows\System\BYYBWSp.exe
  2⤵
  PID:3196
- C:\Windows\System\CGtPOzH.exe
  C:\Windows\System\CGtPOzH.exe
  2⤵
  PID:3212
- C:\Windows\System\xGUviGd.exe
  C:\Windows\System\xGUviGd.exe
  2⤵
  PID:4432
- C:\Windows\System\VvrDTaK.exe
  C:\Windows\System\VvrDTaK.exe
  2⤵
  PID:4496
- C:\Windows\System\YfnkCNL.exe
  C:\Windows\System\YfnkCNL.exe
  2⤵
  PID:4640
- C:\Windows\System\uCdzmnH.exe
  C:\Windows\System\uCdzmnH.exe
  2⤵
  PID:3916
- C:\Windows\System\LXgQFfW.exe
  C:\Windows\System\LXgQFfW.exe
  2⤵
  PID:3180
- C:\Windows\System\AjacrFA.exe
  C:\Windows\System\AjacrFA.exe
  2⤵
  PID:4712
- C:\Windows\System\KxXSniQ.exe
  C:\Windows\System\KxXSniQ.exe
  2⤵
  PID:4856
- C:\Windows\System\AYtPwuy.exe
  C:\Windows\System\AYtPwuy.exe
  2⤵
  PID:4796
- C:\Windows\System\DAupBqP.exe
  C:\Windows\System\DAupBqP.exe
  2⤵
  PID:4912
- C:\Windows\System\bhZmvAr.exe
  C:\Windows\System\bhZmvAr.exe
  2⤵
  PID:4988
- C:\Windows\System\icxVNID.exe
  C:\Windows\System\icxVNID.exe
  2⤵
  PID:4956
- C:\Windows\System\BxfavrL.exe
  C:\Windows\System\BxfavrL.exe
  2⤵
  PID:4996
- C:\Windows\System\yPJxWsB.exe
  C:\Windows\System\yPJxWsB.exe
  2⤵
  PID:5012
- C:\Windows\System\jfsfGfE.exe
  C:\Windows\System\jfsfGfE.exe
  2⤵
  PID:3944
- C:\Windows\System\VQbuUxn.exe
  C:\Windows\System\VQbuUxn.exe
  2⤵
  PID:3236
- C:\Windows\System\HPIZmPd.exe
  C:\Windows\System\HPIZmPd.exe
  2⤵
  PID:4208
- C:\Windows\System\FWEeiSI.exe
  C:\Windows\System\FWEeiSI.exe
  2⤵
  PID:3780
- C:\Windows\System\QwBeUPY.exe
  C:\Windows\System\QwBeUPY.exe
  2⤵
  PID:4308
- C:\Windows\System\FPbfWOX.exe
  C:\Windows\System\FPbfWOX.exe
  2⤵
  PID:3796
- C:\Windows\System\AydUyEo.exe
  C:\Windows\System\AydUyEo.exe
  2⤵
  PID:4480
- C:\Windows\System\VWQQPTT.exe
  C:\Windows\System\VWQQPTT.exe
  2⤵
  PID:4364
- C:\Windows\System\dUqhtfk.exe
  C:\Windows\System\dUqhtfk.exe
  2⤵
  PID:4468
- C:\Windows\System\kXLfuXr.exe
  C:\Windows\System\kXLfuXr.exe
  2⤵
  PID:4568
- C:\Windows\System\ouyalRm.exe
  C:\Windows\System\ouyalRm.exe
  2⤵
  PID:1712
- C:\Windows\System\YDxlwIe.exe
  C:\Windows\System\YDxlwIe.exe
  2⤵
  PID:3520
- C:\Windows\System\hWupfXk.exe
  C:\Windows\System\hWupfXk.exe
  2⤵
  PID:4852
- C:\Windows\System\aXGfrdz.exe
  C:\Windows\System\aXGfrdz.exe
  2⤵
  PID:4880
- C:\Windows\System\iOTREqG.exe
  C:\Windows\System\iOTREqG.exe
  2⤵
  PID:4940
- C:\Windows\System\XpzjCqs.exe
  C:\Windows\System\XpzjCqs.exe
  2⤵
  PID:4136
- C:\Windows\System\WDRhPnV.exe
  C:\Windows\System\WDRhPnV.exe
  2⤵
  PID:5104
- C:\Windows\System\FXhXtxI.exe
  C:\Windows\System\FXhXtxI.exe
  2⤵
  PID:3216
- C:\Windows\System\MvvLitt.exe
  C:\Windows\System\MvvLitt.exe
  2⤵
  PID:4204
- C:\Windows\System\yUDXXkn.exe
  C:\Windows\System\yUDXXkn.exe
  2⤵
  PID:4328
- C:\Windows\System\qbHCEUr.exe
  C:\Windows\System\qbHCEUr.exe
  2⤵
  PID:4460
- C:\Windows\System\YdtTtmD.exe
  C:\Windows\System\YdtTtmD.exe
  2⤵
  PID:4752
- C:\Windows\System\PTbPciX.exe
  C:\Windows\System\PTbPciX.exe
  2⤵
  PID:4892
- C:\Windows\System\FVnlJcu.exe
  C:\Windows\System\FVnlJcu.exe
  2⤵
  PID:4636
- C:\Windows\System\OfQhjZJ.exe
  C:\Windows\System\OfQhjZJ.exe
  2⤵
  PID:4104
- C:\Windows\System\dezrnGj.exe
  C:\Windows\System\dezrnGj.exe
  2⤵
  PID:5068
- C:\Windows\System\wfvsHmU.exe
  C:\Windows\System\wfvsHmU.exe
  2⤵
  PID:4516
- C:\Windows\System\jElAZGM.exe
  C:\Windows\System\jElAZGM.exe
  2⤵
  PID:4392
- C:\Windows\System\qvvlgol.exe
  C:\Windows\System\qvvlgol.exe
  2⤵
  PID:4160
- C:\Windows\System\JWQSBHH.exe
  C:\Windows\System\JWQSBHH.exe
  2⤵
  PID:2148
- C:\Windows\System\wMgVtfN.exe
  C:\Windows\System\wMgVtfN.exe
  2⤵
  PID:4924
- C:\Windows\System\OkgBRjW.exe
  C:\Windows\System\OkgBRjW.exe
  2⤵
  PID:4048
- C:\Windows\System\yQIOziT.exe
  C:\Windows\System\yQIOziT.exe
  2⤵
  PID:4536
- C:\Windows\System\QAjlmRC.exe
  C:\Windows\System\QAjlmRC.exe
  2⤵
  PID:5136
- C:\Windows\System\EBGNwnQ.exe
  C:\Windows\System\EBGNwnQ.exe
  2⤵
  PID:5156
- C:\Windows\System\xWIIgAw.exe
  C:\Windows\System\xWIIgAw.exe
  2⤵
  PID:5172
- C:\Windows\System\DyqGbmE.exe
  C:\Windows\System\DyqGbmE.exe
  2⤵
  PID:5192
- C:\Windows\System\bEACCtQ.exe
  C:\Windows\System\bEACCtQ.exe
  2⤵
  PID:5208
- C:\Windows\System\YGyIXTA.exe
  C:\Windows\System\YGyIXTA.exe
  2⤵
  PID:5228
- C:\Windows\System\DOAvHgu.exe
  C:\Windows\System\DOAvHgu.exe
  2⤵
  PID:5248
- C:\Windows\System\jLBLFwc.exe
  C:\Windows\System\jLBLFwc.exe
  2⤵
  PID:5264
- C:\Windows\System\iAQCAaK.exe
  C:\Windows\System\iAQCAaK.exe
  2⤵
  PID:5284
- C:\Windows\System\VOCgvoI.exe
  C:\Windows\System\VOCgvoI.exe
  2⤵
  PID:5300
- C:\Windows\System\QmvGMxs.exe
  C:\Windows\System\QmvGMxs.exe
  2⤵
  PID:5320
- C:\Windows\System\EObEbLe.exe
  C:\Windows\System\EObEbLe.exe
  2⤵
  PID:5336
- C:\Windows\System\JsXojVp.exe
  C:\Windows\System\JsXojVp.exe
  2⤵
  PID:5400
- C:\Windows\System\dVurZtE.exe
  C:\Windows\System\dVurZtE.exe
  2⤵
  PID:5416
- C:\Windows\System\NPAApLZ.exe
  C:\Windows\System\NPAApLZ.exe
  2⤵
  PID:5432
- C:\Windows\System\MBCSWFb.exe
  C:\Windows\System\MBCSWFb.exe
  2⤵
  PID:5452
- C:\Windows\System\SgCyMgO.exe
  C:\Windows\System\SgCyMgO.exe
  2⤵
  PID:5468
- C:\Windows\System\witJgAO.exe
  C:\Windows\System\witJgAO.exe
  2⤵
  PID:5484
- C:\Windows\System\xnRWOsC.exe
  C:\Windows\System\xnRWOsC.exe
  2⤵
  PID:5504
- C:\Windows\System\TbMWXrY.exe
  C:\Windows\System\TbMWXrY.exe
  2⤵
  PID:5520
- C:\Windows\System\cuIKKGV.exe
  C:\Windows\System\cuIKKGV.exe
  2⤵
  PID:5536
- C:\Windows\System\LZTklDM.exe
  C:\Windows\System\LZTklDM.exe
  2⤵
  PID:5552
- C:\Windows\System\RbucfDq.exe
  C:\Windows\System\RbucfDq.exe
  2⤵
  PID:5572
- C:\Windows\System\zAbHakK.exe
  C:\Windows\System\zAbHakK.exe
  2⤵
  PID:5588
- C:\Windows\System\kYVEWlM.exe
  C:\Windows\System\kYVEWlM.exe
  2⤵
  PID:5608
- C:\Windows\System\sMiYPtf.exe
  C:\Windows\System\sMiYPtf.exe
  2⤵
  PID:5624
- C:\Windows\System\oLcMRdj.exe
  C:\Windows\System\oLcMRdj.exe
  2⤵
  PID:5640
- C:\Windows\System\oHSEhWC.exe
  C:\Windows\System\oHSEhWC.exe
  2⤵
  PID:5660
- C:\Windows\System\KvFHUrq.exe
  C:\Windows\System\KvFHUrq.exe
  2⤵
  PID:5676
- C:\Windows\System\rtEPfKr.exe
  C:\Windows\System\rtEPfKr.exe
  2⤵
  PID:5692
- C:\Windows\System\SMxIOHH.exe
  C:\Windows\System\SMxIOHH.exe
  2⤵
  PID:5712
- C:\Windows\System\nuAQQHq.exe
  C:\Windows\System\nuAQQHq.exe
  2⤵
  PID:5728
- C:\Windows\System\jmhWqKR.exe
  C:\Windows\System\jmhWqKR.exe
  2⤵
  PID:5744
- C:\Windows\System\ouSedaQ.exe
  C:\Windows\System\ouSedaQ.exe
  2⤵
  PID:5764
- C:\Windows\System\rOZeKnn.exe
  C:\Windows\System\rOZeKnn.exe
  2⤵
  PID:5780
- C:\Windows\System\snOlknU.exe
  C:\Windows\System\snOlknU.exe
  2⤵
  PID:5832
- C:\Windows\System\UnWMoFt.exe
  C:\Windows\System\UnWMoFt.exe
  2⤵
  PID:5848
- C:\Windows\System\JnyjBqu.exe
  C:\Windows\System\JnyjBqu.exe
  2⤵
  PID:5864
- C:\Windows\System\uxXvaFv.exe
  C:\Windows\System\uxXvaFv.exe
  2⤵
  PID:5884
- C:\Windows\System\vigjQXR.exe
  C:\Windows\System\vigjQXR.exe
  2⤵
  PID:5900
- C:\Windows\System\GLynrgw.exe
  C:\Windows\System\GLynrgw.exe
  2⤵
  PID:5960
- C:\Windows\System\kdCHiPc.exe
  C:\Windows\System\kdCHiPc.exe
  2⤵
  PID:5992
- C:\Windows\System\IecBhDZ.exe
  C:\Windows\System\IecBhDZ.exe
  2⤵
  PID:6008
- C:\Windows\System\rKHmYnp.exe
  C:\Windows\System\rKHmYnp.exe
  2⤵
  PID:6024
- C:\Windows\System\YCvXLaV.exe
  C:\Windows\System\YCvXLaV.exe
  2⤵
  PID:6040
- C:\Windows\System\ygHuUQd.exe
  C:\Windows\System\ygHuUQd.exe
  2⤵
  PID:6056
- C:\Windows\System\wuFKIho.exe
  C:\Windows\System\wuFKIho.exe
  2⤵
  PID:6076
- C:\Windows\System\rDlzNfB.exe
  C:\Windows\System\rDlzNfB.exe
  2⤵
  PID:6092
- C:\Windows\System\BQslUqi.exe
  C:\Windows\System\BQslUqi.exe
  2⤵
  PID:6108
- C:\Windows\System\mOIuepD.exe
  C:\Windows\System\mOIuepD.exe
  2⤵
  PID:5180
- C:\Windows\System\QQeNFfa.exe
  C:\Windows\System\QQeNFfa.exe
  2⤵
  PID:5220
- C:\Windows\System\ySKjSJQ.exe
  C:\Windows\System\ySKjSJQ.exe
  2⤵
  PID:4312
- C:\Windows\System\wxPWzxo.exe
  C:\Windows\System\wxPWzxo.exe
  2⤵
  PID:3772
- C:\Windows\System\QoRfsJV.exe
  C:\Windows\System\QoRfsJV.exe
  2⤵
  PID:5164
- C:\Windows\System\nzShpHg.exe
  C:\Windows\System\nzShpHg.exe
  2⤵
  PID:5512
- C:\Windows\System\EYAQehK.exe
  C:\Windows\System\EYAQehK.exe
  2⤵
  PID:4172
- C:\Windows\System\gAqDxGX.exe
  C:\Windows\System\gAqDxGX.exe
  2⤵
  PID:5376
- C:\Windows\System\KDSzdCl.exe
  C:\Windows\System\KDSzdCl.exe
  2⤵
  PID:5240
- C:\Windows\System\zlPrhrI.exe
  C:\Windows\System\zlPrhrI.exe
  2⤵
  PID:5276
- C:\Windows\System\PPhLCAp.exe
  C:\Windows\System\PPhLCAp.exe
  2⤵
  PID:5396
- C:\Windows\System\LlHOFfa.exe
  C:\Windows\System\LlHOFfa.exe
  2⤵
  PID:5360
- C:\Windows\System\PwKQMHI.exe
  C:\Windows\System\PwKQMHI.exe
  2⤵
  PID:5464
- C:\Windows\System\lirGcXZ.exe
  C:\Windows\System\lirGcXZ.exe
  2⤵
  PID:5532
- C:\Windows\System\GCNUCBv.exe
  C:\Windows\System\GCNUCBv.exe
  2⤵
  PID:5604
- C:\Windows\System\dwBCkol.exe
  C:\Windows\System\dwBCkol.exe
  2⤵
  PID:5632
- C:\Windows\System\ylAUudt.exe
  C:\Windows\System\ylAUudt.exe
  2⤵
  PID:5652
- C:\Windows\System\opnJumS.exe
  C:\Windows\System\opnJumS.exe
  2⤵
  PID:5720
- C:\Windows\System\BslzpTv.exe
  C:\Windows\System\BslzpTv.exe
  2⤵
  PID:5760
- C:\Windows\System\DbElmHl.exe
  C:\Windows\System\DbElmHl.exe
  2⤵
  PID:5804
- C:\Windows\System\FcvXOgj.exe
  C:\Windows\System\FcvXOgj.exe
  2⤵
  PID:5820
- C:\Windows\System\wrRvQys.exe
  C:\Windows\System\wrRvQys.exe
  2⤵
  PID:5668
- C:\Windows\System\rJOYkOI.exe
  C:\Windows\System\rJOYkOI.exe
  2⤵
  PID:5792
- C:\Windows\System\JbqIYvC.exe
  C:\Windows\System\JbqIYvC.exe
  2⤵
  PID:5772
- C:\Windows\System\QpREokG.exe
  C:\Windows\System\QpREokG.exe
  2⤵
  PID:5892
- C:\Windows\System\HyvtlqA.exe
  C:\Windows\System\HyvtlqA.exe
  2⤵
  PID:5880
- C:\Windows\System\uzwhIFE.exe
  C:\Windows\System\uzwhIFE.exe
  2⤵
  PID:5916
- C:\Windows\System\FciTHvb.exe
  C:\Windows\System\FciTHvb.exe
  2⤵
  PID:5928
- C:\Windows\System\OHpuMDO.exe
  C:\Windows\System\OHpuMDO.exe
  2⤵
  PID:3620
- C:\Windows\System\cYFRbbN.exe
  C:\Windows\System\cYFRbbN.exe
  2⤵
  PID:5956
- C:\Windows\System\icblyll.exe
  C:\Windows\System\icblyll.exe
  2⤵
  PID:5224
- C:\Windows\System\trBAsDN.exe
  C:\Windows\System\trBAsDN.exe
  2⤵
  PID:6016
- C:\Windows\System\fHzZVXC.exe
  C:\Windows\System\fHzZVXC.exe
  2⤵
  PID:6052
- C:\Windows\System\kXJCfnY.exe
  C:\Windows\System\kXJCfnY.exe
  2⤵
  PID:6072
- C:\Windows\System\IhCVrwM.exe
  C:\Windows\System\IhCVrwM.exe
  2⤵
  PID:6088
- C:\Windows\System\lwYmecw.exe
  C:\Windows\System\lwYmecw.exe
  2⤵
  PID:2924
- C:\Windows\System\UQZkajL.exe
  C:\Windows\System\UQZkajL.exe
  2⤵
  PID:4260
- C:\Windows\System\shmgAGJ.exe
  C:\Windows\System\shmgAGJ.exe
  2⤵
  PID:5152
- C:\Windows\System\DiqcrVL.exe
  C:\Windows\System\DiqcrVL.exe
  2⤵
  PID:5328
- C:\Windows\System\dqGFjBf.exe
  C:\Windows\System\dqGFjBf.exe
  2⤵
  PID:5408
- C:\Windows\System\MRNGxOI.exe
  C:\Windows\System\MRNGxOI.exe
  2⤵
  PID:5444
- C:\Windows\System\sRKKmIo.exe
  C:\Windows\System\sRKKmIo.exe
  2⤵
  PID:4428
- C:\Windows\System\BwXKrBj.exe
  C:\Windows\System\BwXKrBj.exe
  2⤵
  PID:5272
- C:\Windows\System\PGbOzBp.exe
  C:\Windows\System\PGbOzBp.exe
  2⤵
  PID:5500
- C:\Windows\System\IEowche.exe
  C:\Windows\System\IEowche.exe
  2⤵
  PID:5828
- C:\Windows\System\PKTMsZO.exe
  C:\Windows\System\PKTMsZO.exe
  2⤵
  PID:5128
- C:\Windows\System\HLrCqBA.exe
  C:\Windows\System\HLrCqBA.exe
  2⤵
  PID:5736
- C:\Windows\System\byjvNzO.exe
  C:\Windows\System\byjvNzO.exe
  2⤵
  PID:5952
- C:\Windows\System\bsKlMMY.exe
  C:\Windows\System\bsKlMMY.exe
  2⤵
  PID:5236
- C:\Windows\System\AwKlnpd.exe
  C:\Windows\System\AwKlnpd.exe
  2⤵
  PID:5316
- C:\Windows\System\bMngYgn.exe
  C:\Windows\System\bMngYgn.exe
  2⤵
  PID:5620
- C:\Windows\System\kAmQVHE.exe
  C:\Windows\System\kAmQVHE.exe
  2⤵
  PID:5968
- C:\Windows\System\uvPadJS.exe
  C:\Windows\System\uvPadJS.exe
  2⤵
  PID:5972
- C:\Windows\System\AsdXVHv.exe
  C:\Windows\System\AsdXVHv.exe
  2⤵
  PID:5648
- C:\Windows\System\ZFfifNV.exe
  C:\Windows\System\ZFfifNV.exe
  2⤵
  PID:5816
- C:\Windows\System\fqOCeef.exe
  C:\Windows\System\fqOCeef.exe
  2⤵
  PID:5688
- C:\Windows\System\RRzyTUS.exe
  C:\Windows\System\RRzyTUS.exe
  2⤵
  PID:5684
- C:\Windows\System\STvYPrL.exe
  C:\Windows\System\STvYPrL.exe
  2⤵
  PID:5424
- C:\Windows\System\AdDTqYL.exe
  C:\Windows\System\AdDTqYL.exe
  2⤵
  PID:5704
- C:\Windows\System\jvJETtf.exe
  C:\Windows\System\jvJETtf.exe
  2⤵
  PID:5920
- C:\Windows\System\FajTtOS.exe
  C:\Windows\System\FajTtOS.exe
  2⤵
  PID:5388
- C:\Windows\System\RnBaaGk.exe
  C:\Windows\System\RnBaaGk.exe
  2⤵
  PID:5940
- C:\Windows\System\xoXDeKV.exe
  C:\Windows\System\xoXDeKV.exe
  2⤵
  PID:6004
- C:\Windows\System\UVfigHS.exe
  C:\Windows\System\UVfigHS.exe
  2⤵
  PID:6068
- C:\Windows\System\mNnLRfk.exe
  C:\Windows\System\mNnLRfk.exe
  2⤵
  PID:6120
- C:\Windows\System\tXguUyk.exe
  C:\Windows\System\tXguUyk.exe
  2⤵
  PID:4220
- C:\Windows\System\pAqEFDP.exe
  C:\Windows\System\pAqEFDP.exe
  2⤵
  PID:5356
- C:\Windows\System\xzrXETl.exe
  C:\Windows\System\xzrXETl.exe
  2⤵
  PID:5584
- C:\Windows\System\XcDrdwp.exe
  C:\Windows\System\XcDrdwp.exe
  2⤵
  PID:5496
- C:\Windows\System\PTjCLRO.exe
  C:\Windows\System\PTjCLRO.exe
  2⤵
  PID:5460
- C:\Windows\System\quKjjno.exe
  C:\Windows\System\quKjjno.exe
  2⤵
  PID:6064
- C:\Windows\System\PaqSQnB.exe
  C:\Windows\System\PaqSQnB.exe
  2⤵
  PID:4044
- C:\Windows\System\KwQVWFO.exe
  C:\Windows\System\KwQVWFO.exe
  2⤵
  PID:5936
- C:\Windows\System\TEGNCkb.exe
  C:\Windows\System\TEGNCkb.exe
  2⤵
  PID:5440
- C:\Windows\System\TtGFJwQ.exe
  C:\Windows\System\TtGFJwQ.exe
  2⤵
  PID:5800
- C:\Windows\System\ipAITCp.exe
  C:\Windows\System\ipAITCp.exe
  2⤵
  PID:6160
- C:\Windows\System\eqdDvux.exe
  C:\Windows\System\eqdDvux.exe
  2⤵
  PID:6176
- C:\Windows\System\UAgxmGv.exe
  C:\Windows\System\UAgxmGv.exe
  2⤵
  PID:6192
- C:\Windows\System\fVVvJKn.exe
  C:\Windows\System\fVVvJKn.exe
  2⤵
  PID:6208
- C:\Windows\System\ZCiSkHO.exe
  C:\Windows\System\ZCiSkHO.exe
  2⤵
  PID:6224
- C:\Windows\System\tnlYKqT.exe
  C:\Windows\System\tnlYKqT.exe
  2⤵
  PID:6240
- C:\Windows\System\fjKjKdD.exe
  C:\Windows\System\fjKjKdD.exe
  2⤵
  PID:6256
- C:\Windows\System\KlEPoso.exe
  C:\Windows\System\KlEPoso.exe
  2⤵
  PID:6272
- C:\Windows\System\sqBpJYS.exe
  C:\Windows\System\sqBpJYS.exe
  2⤵
  PID:6288
- C:\Windows\System\lVoRXJw.exe
  C:\Windows\System\lVoRXJw.exe
  2⤵
  PID:6304
- C:\Windows\System\PZQQlPG.exe
  C:\Windows\System\PZQQlPG.exe
  2⤵
  PID:6324
- C:\Windows\System\wJxySyo.exe
  C:\Windows\System\wJxySyo.exe
  2⤵
  PID:6340
- C:\Windows\System\TJrYhFE.exe
  C:\Windows\System\TJrYhFE.exe
  2⤵
  PID:6356
- C:\Windows\System\vNBdZac.exe
  C:\Windows\System\vNBdZac.exe
  2⤵
  PID:6372
- C:\Windows\System\hZKcggi.exe
  C:\Windows\System\hZKcggi.exe
  2⤵
  PID:6388
- C:\Windows\System\ODEuDUI.exe
  C:\Windows\System\ODEuDUI.exe
  2⤵
  PID:6404
- C:\Windows\System\XRAjCcR.exe
  C:\Windows\System\XRAjCcR.exe
  2⤵
  PID:6420
- C:\Windows\System\HMzlEKS.exe
  C:\Windows\System\HMzlEKS.exe
  2⤵
  PID:6436
- C:\Windows\System\wuVhkBA.exe
  C:\Windows\System\wuVhkBA.exe
  2⤵
  PID:6452
- C:\Windows\System\cjSVFfH.exe
  C:\Windows\System\cjSVFfH.exe
  2⤵
  PID:6468
- C:\Windows\System\ABgVBHd.exe
  C:\Windows\System\ABgVBHd.exe
  2⤵
  PID:6484
- C:\Windows\System\HowrZBt.exe
  C:\Windows\System\HowrZBt.exe
  2⤵
  PID:6504
- C:\Windows\System\TJSFFHJ.exe
  C:\Windows\System\TJSFFHJ.exe
  2⤵
  PID:6536
- C:\Windows\System\hyfDsuO.exe
  C:\Windows\System\hyfDsuO.exe
  2⤵
  PID:6552
- C:\Windows\System\LEVMUOP.exe
  C:\Windows\System\LEVMUOP.exe
  2⤵
  PID:6572
- C:\Windows\System\HsIbAlT.exe
  C:\Windows\System\HsIbAlT.exe
  2⤵
  PID:6592
- C:\Windows\System\QulzQfJ.exe
  C:\Windows\System\QulzQfJ.exe
  2⤵
  PID:6608
- C:\Windows\System\BskCAMA.exe
  C:\Windows\System\BskCAMA.exe
  2⤵
  PID:6632
- C:\Windows\System\ObEZEaw.exe
  C:\Windows\System\ObEZEaw.exe
  2⤵
  PID:6736
- C:\Windows\System\OGFyqax.exe
  C:\Windows\System\OGFyqax.exe
  2⤵
  PID:6752
- C:\Windows\System\bhFsvUA.exe
  C:\Windows\System\bhFsvUA.exe
  2⤵
  PID:6772
- C:\Windows\System\YgJgLsD.exe
  C:\Windows\System\YgJgLsD.exe
  2⤵
  PID:6792
- C:\Windows\System\tFLelFU.exe
  C:\Windows\System\tFLelFU.exe
  2⤵
  PID:6808
- C:\Windows\System\hhhNGhm.exe
  C:\Windows\System\hhhNGhm.exe
  2⤵
  PID:6824
- C:\Windows\System\NAGaOtl.exe
  C:\Windows\System\NAGaOtl.exe
  2⤵
  PID:6844
- C:\Windows\System\hoAGWuy.exe
  C:\Windows\System\hoAGWuy.exe
  2⤵
  PID:6864
- C:\Windows\System\mKMGVlI.exe
  C:\Windows\System\mKMGVlI.exe
  2⤵
  PID:6880
- C:\Windows\System\TkHaSYn.exe
  C:\Windows\System\TkHaSYn.exe
  2⤵
  PID:6900
- C:\Windows\System\QlSdaAI.exe
  C:\Windows\System\QlSdaAI.exe
  2⤵
  PID:6916
- C:\Windows\System\tTpSOhX.exe
  C:\Windows\System\tTpSOhX.exe
  2⤵
  PID:6932
- C:\Windows\System\ulZFajn.exe
  C:\Windows\System\ulZFajn.exe
  2⤵
  PID:6948
- C:\Windows\System\mChFmkV.exe
  C:\Windows\System\mChFmkV.exe
  2⤵
  PID:6964
- C:\Windows\System\rwJpfWL.exe
  C:\Windows\System\rwJpfWL.exe
  2⤵
  PID:6980
- C:\Windows\System\tFRvtva.exe
  C:\Windows\System\tFRvtva.exe
  2⤵
  PID:6996
- C:\Windows\System\fzdcGAx.exe
  C:\Windows\System\fzdcGAx.exe
  2⤵
  PID:7012
- C:\Windows\System\TJumukY.exe
  C:\Windows\System\TJumukY.exe
  2⤵
  PID:7036
- C:\Windows\System\YrbqWju.exe
  C:\Windows\System\YrbqWju.exe
  2⤵
  PID:7056
- C:\Windows\System\geUvxBs.exe
  C:\Windows\System\geUvxBs.exe
  2⤵
  PID:7076
- C:\Windows\System\gHufZXN.exe
  C:\Windows\System\gHufZXN.exe
  2⤵
  PID:7092
- C:\Windows\System\fOkUUBd.exe
  C:\Windows\System\fOkUUBd.exe
  2⤵
  PID:7108
- C:\Windows\System\QlgJuun.exe
  C:\Windows\System\QlgJuun.exe
  2⤵
  PID:7124
- C:\Windows\System\sFAIjbK.exe
  C:\Windows\System\sFAIjbK.exe
  2⤵
  PID:7156
- C:\Windows\System\OcxDdVH.exe
  C:\Windows\System\OcxDdVH.exe
  2⤵
  PID:6168
- C:\Windows\System\LhBdCsF.exe
  C:\Windows\System\LhBdCsF.exe
  2⤵
  PID:5580
- C:\Windows\System\FhDzhCU.exe
  C:\Windows\System\FhDzhCU.exe
  2⤵
  PID:6268
- C:\Windows\System\XIhsZCg.exe
  C:\Windows\System\XIhsZCg.exe
  2⤵
  PID:5204
- C:\Windows\System\cIBpUsy.exe
  C:\Windows\System\cIBpUsy.exe
  2⤵
  PID:4464
- C:\Windows\System\yyOGIzj.exe
  C:\Windows\System\yyOGIzj.exe
  2⤵
  PID:5596
- C:\Windows\System\nPnSxis.exe
  C:\Windows\System\nPnSxis.exe
  2⤵
  PID:6152
- C:\Windows\System\ehLRcAV.exe
  C:\Windows\System\ehLRcAV.exe
  2⤵
  PID:6216
- C:\Windows\System\VOJsoMo.exe
  C:\Windows\System\VOJsoMo.exe
  2⤵
  PID:6280
- C:\Windows\System\imUffaj.exe
  C:\Windows\System\imUffaj.exe
  2⤵
  PID:6364
- C:\Windows\System\tVgnBbs.exe
  C:\Windows\System\tVgnBbs.exe
  2⤵
  PID:6400
- C:\Windows\System\raASRqA.exe
  C:\Windows\System\raASRqA.exe
  2⤵
  PID:6464
- C:\Windows\System\nlsHgDM.exe
  C:\Windows\System\nlsHgDM.exe
  2⤵
  PID:6480
- C:\Windows\System\oicegrp.exe
  C:\Windows\System\oicegrp.exe
  2⤵
  PID:6348
- C:\Windows\System\VrTKwPy.exe
  C:\Windows\System\VrTKwPy.exe
  2⤵
  PID:6412
- C:\Windows\System\dFnPcbQ.exe
  C:\Windows\System\dFnPcbQ.exe
  2⤵
  PID:6520
- C:\Windows\System\YqMhoLW.exe
  C:\Windows\System\YqMhoLW.exe
  2⤵
  PID:6560
- C:\Windows\System\NxINCGM.exe
  C:\Windows\System\NxINCGM.exe
  2⤵
  PID:6548
- C:\Windows\System\BTwbbcN.exe
  C:\Windows\System\BTwbbcN.exe
  2⤵
  PID:6584
- C:\Windows\System\eEMzkZs.exe
  C:\Windows\System\eEMzkZs.exe
  2⤵
  PID:6600
- C:\Windows\System\qmtbTkX.exe
  C:\Windows\System\qmtbTkX.exe
  2⤵
  PID:5448
- C:\Windows\System\lxRUJWM.exe
  C:\Windows\System\lxRUJWM.exe
  2⤵
  PID:6668
- C:\Windows\System\HXFiUGU.exe
  C:\Windows\System\HXFiUGU.exe
  2⤵
  PID:6680
- C:\Windows\System\rFlOfst.exe
  C:\Windows\System\rFlOfst.exe
  2⤵
  PID:6700
- C:\Windows\System\dWhpAbF.exe
  C:\Windows\System\dWhpAbF.exe
  2⤵
  PID:6712
- C:\Windows\System\QavIUaS.exe
  C:\Windows\System\QavIUaS.exe
  2⤵
  PID:6744
- C:\Windows\System\TWKbTeq.exe
  C:\Windows\System\TWKbTeq.exe
  2⤵
  PID:6820
- C:\Windows\System\eSpaeTO.exe
  C:\Windows\System\eSpaeTO.exe
  2⤵
  PID:6860
- C:\Windows\System\qqohcHT.exe
  C:\Windows\System\qqohcHT.exe
  2⤵
  PID:6928
- C:\Windows\System\CfWYJJE.exe
  C:\Windows\System\CfWYJJE.exe
  2⤵
  PID:7100
- C:\Windows\System\RMCKMHk.exe
  C:\Windows\System\RMCKMHk.exe
  2⤵
  PID:6204
- C:\Windows\System\EzoXTPp.exe
  C:\Windows\System\EzoXTPp.exe
  2⤵
  PID:6136
- C:\Windows\System\OhnVqPE.exe
  C:\Windows\System\OhnVqPE.exe
  2⤵
  PID:7088
- C:\Windows\System\ROWaBBo.exe
  C:\Windows\System\ROWaBBo.exe
  2⤵
  PID:6184
- C:\Windows\System\AyrYErg.exe
  C:\Windows\System\AyrYErg.exe
  2⤵
  PID:6336
- C:\Windows\System\kuwdLhK.exe
  C:\Windows\System\kuwdLhK.exe
  2⤵
  PID:7164
- C:\Windows\System\OwAzSqy.exe
  C:\Windows\System\OwAzSqy.exe
  2⤵
  PID:5480
- C:\Windows\System\RMmSCfu.exe
  C:\Windows\System\RMmSCfu.exe
  2⤵
  PID:6512
- C:\Windows\System\RNlrHPa.exe
  C:\Windows\System\RNlrHPa.exe
  2⤵
  PID:6620
- C:\Windows\System\LXPWQbW.exe
  C:\Windows\System\LXPWQbW.exe
  2⤵
  PID:6852
- C:\Windows\System\lKGqvIn.exe
  C:\Windows\System\lKGqvIn.exe
  2⤵
  PID:6396
- C:\Windows\System\dAMEawi.exe
  C:\Windows\System\dAMEawi.exe
  2⤵
  PID:6616
- C:\Windows\System\dAoNGsK.exe
  C:\Windows\System\dAoNGsK.exe
  2⤵
  PID:6316
- C:\Windows\System\PybhsPw.exe
  C:\Windows\System\PybhsPw.exe
  2⤵
  PID:6476
- C:\Windows\System\AqawBMQ.exe
  C:\Windows\System\AqawBMQ.exe
  2⤵
  PID:6784
- C:\Windows\System\QtxGRCh.exe
  C:\Windows\System\QtxGRCh.exe
  2⤵
  PID:7004
- C:\Windows\System\pcYdXMQ.exe
  C:\Windows\System\pcYdXMQ.exe
  2⤵
  PID:7028
- C:\Windows\System\QCnfSVg.exe
  C:\Windows\System\QCnfSVg.exe
  2⤵
  PID:7032
- C:\Windows\System\lPGCWro.exe
  C:\Windows\System\lPGCWro.exe
  2⤵
  PID:5908
- C:\Windows\System\rQoxMHC.exe
  C:\Windows\System\rQoxMHC.exe
  2⤵
  PID:5740
- C:\Windows\System\IUfDxbl.exe
  C:\Windows\System\IUfDxbl.exe
  2⤵
  PID:6200
- C:\Windows\System\TSqkBve.exe
  C:\Windows\System\TSqkBve.exe
  2⤵
  PID:6496
- C:\Windows\System\MgGndKa.exe
  C:\Windows\System\MgGndKa.exe
  2⤵
  PID:6500
- C:\Windows\System\xrWHgIF.exe
  C:\Windows\System\xrWHgIF.exe
  2⤵
  PID:7084
- C:\Windows\System\flDYsxv.exe
  C:\Windows\System\flDYsxv.exe
  2⤵
  PID:6688
- C:\Windows\System\uxBCdbq.exe
  C:\Windows\System\uxBCdbq.exe
  2⤵
  PID:6720
- C:\Windows\System\KXtGTas.exe
  C:\Windows\System\KXtGTas.exe
  2⤵
  PID:6416
- C:\Windows\System\uygEBuz.exe
  C:\Windows\System\uygEBuz.exe
  2⤵
  PID:6892
- C:\Windows\System\dCPFzzH.exe
  C:\Windows\System\dCPFzzH.exe
  2⤵
  PID:6804
- C:\Windows\System\MuxTeTH.exe
  C:\Windows\System\MuxTeTH.exe
  2⤵
  PID:1580
- C:\Windows\System\lVtILPI.exe
  C:\Windows\System\lVtILPI.exe
  2⤵
  PID:6728
- C:\Windows\System\pklIbNq.exe
  C:\Windows\System\pklIbNq.exe
  2⤵
  PID:7024
- C:\Windows\System\XfsViQj.exe
  C:\Windows\System\XfsViQj.exe
  2⤵
  PID:6692
- C:\Windows\System\wDKHKTe.exe
  C:\Windows\System\wDKHKTe.exe
  2⤵
  PID:5812
- C:\Windows\System\PhAHAgb.exe
  C:\Windows\System\PhAHAgb.exe
  2⤵
  PID:6656
- C:\Windows\System\lRsdfQT.exe
  C:\Windows\System\lRsdfQT.exe
  2⤵
  PID:6724
- C:\Windows\System\ItKwSPW.exe
  C:\Windows\System\ItKwSPW.exe
  2⤵
  PID:6940
- C:\Windows\System\YvlcuFX.exe
  C:\Windows\System\YvlcuFX.exe
  2⤵
  PID:5312
- C:\Windows\System\sLCVPUL.exe
  C:\Windows\System\sLCVPUL.exe
  2⤵
  PID:5412
- C:\Windows\System\AWsZbjH.exe
  C:\Windows\System\AWsZbjH.exe
  2⤵
  PID:6836
- C:\Windows\System\lQcnWxu.exe
  C:\Windows\System\lQcnWxu.exe
  2⤵
  PID:6908
- C:\Windows\System\voVorgD.exe
  C:\Windows\System\voVorgD.exe
  2⤵
  PID:6644
- C:\Windows\System\eYJiBiO.exe
  C:\Windows\System\eYJiBiO.exe
  2⤵
  PID:7132
- C:\Windows\System\TsKTmmp.exe
  C:\Windows\System\TsKTmmp.exe
  2⤵
  PID:6976
- C:\Windows\System\rpnskBP.exe
  C:\Windows\System\rpnskBP.exe
  2⤵
  PID:6872
- C:\Windows\System\ptKnLkb.exe
  C:\Windows\System\ptKnLkb.exe
  2⤵
  PID:6992
- C:\Windows\System\UVpxxLf.exe
  C:\Windows\System\UVpxxLf.exe
  2⤵
  PID:6956
- C:\Windows\System\JxqwqsG.exe
  C:\Windows\System\JxqwqsG.exe
  2⤵
  PID:6768
- C:\Windows\System\HiQoMwF.exe
  C:\Windows\System\HiQoMwF.exe
  2⤵
  PID:6312
- C:\Windows\System\RtHCVlg.exe
  C:\Windows\System\RtHCVlg.exe
  2⤵
  PID:7184
- C:\Windows\System\aFCtisr.exe
  C:\Windows\System\aFCtisr.exe
  2⤵
  PID:7204
- C:\Windows\System\CHJlsMe.exe
  C:\Windows\System\CHJlsMe.exe
  2⤵
  PID:7220
- C:\Windows\System\CinIpHp.exe
  C:\Windows\System\CinIpHp.exe
  2⤵
  PID:7236
- C:\Windows\System\cxonZAF.exe
  C:\Windows\System\cxonZAF.exe
  2⤵
  PID:7252
- C:\Windows\System\RurqImI.exe
  C:\Windows\System\RurqImI.exe
  2⤵
  PID:7268
- C:\Windows\System\gXTOTBV.exe
  C:\Windows\System\gXTOTBV.exe
  2⤵
  PID:7288
- C:\Windows\System\EKwrXoO.exe
  C:\Windows\System\EKwrXoO.exe
  2⤵
  PID:7304
- C:\Windows\System\KZVDzeG.exe
  C:\Windows\System\KZVDzeG.exe
  2⤵
  PID:7320
- C:\Windows\System\KpPtDmX.exe
  C:\Windows\System\KpPtDmX.exe
  2⤵
  PID:7352
- C:\Windows\System\CzEdiip.exe
  C:\Windows\System\CzEdiip.exe
  2⤵
  PID:7372
- C:\Windows\System\nqBpcFV.exe
  C:\Windows\System\nqBpcFV.exe
  2⤵
  PID:7388
- C:\Windows\System\JbGqDre.exe
  C:\Windows\System\JbGqDre.exe
  2⤵
  PID:7404
- C:\Windows\System\hESwate.exe
  C:\Windows\System\hESwate.exe
  2⤵
  PID:7420
- C:\Windows\System\BBVWfhM.exe
  C:\Windows\System\BBVWfhM.exe
  2⤵
  PID:7440
- C:\Windows\System\bmOJkTY.exe
  C:\Windows\System\bmOJkTY.exe
  2⤵
  PID:7460
- C:\Windows\System\knbzYzo.exe
  C:\Windows\System\knbzYzo.exe
  2⤵
  PID:7476
- C:\Windows\System\fEaxVwR.exe
  C:\Windows\System\fEaxVwR.exe
  2⤵
  PID:7524
- C:\Windows\System\XxvejgE.exe
  C:\Windows\System\XxvejgE.exe
  2⤵
  PID:7548
- C:\Windows\System\VxMuoMd.exe
  C:\Windows\System\VxMuoMd.exe
  2⤵
  PID:7580
- C:\Windows\System\TgSrrFs.exe
  C:\Windows\System\TgSrrFs.exe
  2⤵
  PID:7612
- C:\Windows\System\icKUThR.exe
  C:\Windows\System\icKUThR.exe
  2⤵
  PID:7632
- C:\Windows\System\PWZhGho.exe
  C:\Windows\System\PWZhGho.exe
  2⤵
  PID:7648
- C:\Windows\System\jcMNNtS.exe
  C:\Windows\System\jcMNNtS.exe
  2⤵
  PID:7664
- C:\Windows\System\bjdAcwY.exe
  C:\Windows\System\bjdAcwY.exe
  2⤵
  PID:7680
- C:\Windows\System\DcUCHag.exe
  C:\Windows\System\DcUCHag.exe
  2⤵
  PID:7696
- C:\Windows\System\JiqnxdP.exe
  C:\Windows\System\JiqnxdP.exe
  2⤵
  PID:7760
- C:\Windows\System\zeSOjKq.exe
  C:\Windows\System\zeSOjKq.exe
  2⤵
  PID:7776
- C:\Windows\System\ZfpauHM.exe
  C:\Windows\System\ZfpauHM.exe
  2⤵
  PID:7792
- C:\Windows\System\QvSkatf.exe
  C:\Windows\System\QvSkatf.exe
  2⤵
  PID:7808
- C:\Windows\System\TgiqyTV.exe
  C:\Windows\System\TgiqyTV.exe
  2⤵
  PID:7824
- C:\Windows\System\VzAXvqP.exe
  C:\Windows\System\VzAXvqP.exe
  2⤵
  PID:7844
- C:\Windows\System\ANUjBDv.exe
  C:\Windows\System\ANUjBDv.exe
  2⤵
  PID:7864
- C:\Windows\System\LwZNAuX.exe
  C:\Windows\System\LwZNAuX.exe
  2⤵
  PID:7888
- C:\Windows\System\pxKxQRW.exe
  C:\Windows\System\pxKxQRW.exe
  2⤵
  PID:7904
- C:\Windows\System\qzASenZ.exe
  C:\Windows\System\qzASenZ.exe
  2⤵
  PID:7924
- C:\Windows\System\PTwdBaa.exe
  C:\Windows\System\PTwdBaa.exe
  2⤵
  PID:7940
- C:\Windows\System\oyJkgPB.exe
  C:\Windows\System\oyJkgPB.exe
  2⤵
  PID:7960
- C:\Windows\System\ASggDBc.exe
  C:\Windows\System\ASggDBc.exe
  2⤵
  PID:7976
- C:\Windows\System\JGTBkqX.exe
  C:\Windows\System\JGTBkqX.exe
  2⤵
  PID:7992
- C:\Windows\System\jtXSxRj.exe
  C:\Windows\System\jtXSxRj.exe
  2⤵
  PID:8012
- C:\Windows\System\AmJgRuO.exe
  C:\Windows\System\AmJgRuO.exe
  2⤵
  PID:8028
- C:\Windows\System\OAErbzl.exe
  C:\Windows\System\OAErbzl.exe
  2⤵
  PID:8044
- C:\Windows\System\FnOXMdX.exe
  C:\Windows\System\FnOXMdX.exe
  2⤵
  PID:8112
- C:\Windows\System\LwKrLpd.exe
  C:\Windows\System\LwKrLpd.exe
  2⤵
  PID:8128
- C:\Windows\System\XDuegyi.exe
  C:\Windows\System\XDuegyi.exe
  2⤵
  PID:8148
- C:\Windows\System\BGeEAKl.exe
  C:\Windows\System\BGeEAKl.exe
  2⤵
  PID:8164
- C:\Windows\System\QWTWNtb.exe
  C:\Windows\System\QWTWNtb.exe
  2⤵
  PID:8180
- C:\Windows\System\lmfAROz.exe
  C:\Windows\System\lmfAROz.exe
  2⤵
  PID:7068
- C:\Windows\System\kBczXjG.exe
  C:\Windows\System\kBczXjG.exe
  2⤵
  PID:6876
- C:\Windows\System\wWWKjOQ.exe
  C:\Windows\System\wWWKjOQ.exe
  2⤵
  PID:6448
- C:\Windows\System\OARAxYq.exe
  C:\Windows\System\OARAxYq.exe
  2⤵
  PID:7180
- C:\Windows\System\wRofoxU.exe
  C:\Windows\System\wRofoxU.exe
  2⤵
  PID:7280
- C:\Windows\System\leUfCWc.exe
  C:\Windows\System\leUfCWc.exe
  2⤵
  PID:7368
- C:\Windows\System\ZKLkIcN.exe
  C:\Windows\System\ZKLkIcN.exe
  2⤵
  PID:7396
- C:\Windows\System\HdsJeXQ.exe
  C:\Windows\System\HdsJeXQ.exe
  2⤵
  PID:7472
- C:\Windows\System\pEeUOGt.exe
  C:\Windows\System\pEeUOGt.exe
  2⤵
  PID:7196
- C:\Windows\System\CqdkrAC.exe
  C:\Windows\System\CqdkrAC.exe
  2⤵
  PID:7264
- C:\Windows\System\GXKllAa.exe
  C:\Windows\System\GXKllAa.exe
  2⤵
  PID:7340
- C:\Windows\System\osudtlQ.exe
  C:\Windows\System\osudtlQ.exe
  2⤵
  PID:7416
- C:\Windows\System\qcUsmiL.exe
  C:\Windows\System\qcUsmiL.exe
  2⤵
  PID:7484
- C:\Windows\System\DvFfMmr.exe
  C:\Windows\System\DvFfMmr.exe
  2⤵
  PID:7540
- C:\Windows\System\inhqlpq.exe
  C:\Windows\System\inhqlpq.exe
  2⤵
  PID:7576
- C:\Windows\System\WGPEYyQ.exe
  C:\Windows\System\WGPEYyQ.exe
  2⤵
  PID:7596
- C:\Windows\System\ZepuVrJ.exe
  C:\Windows\System\ZepuVrJ.exe
  2⤵
  PID:7640
- C:\Windows\System\TPlDMtn.exe
  C:\Windows\System\TPlDMtn.exe
  2⤵
  PID:7620
- C:\Windows\System\lqdRqdr.exe
  C:\Windows\System\lqdRqdr.exe
  2⤵
  PID:7704
- C:\Windows\System\mbvQgQk.exe
  C:\Windows\System\mbvQgQk.exe
  2⤵
  PID:7708
- C:\Windows\System\DBvaILR.exe
  C:\Windows\System\DBvaILR.exe
  2⤵
  PID:7724
- C:\Windows\System\BAvbMaN.exe
  C:\Windows\System\BAvbMaN.exe
  2⤵
  PID:7736
- C:\Windows\System\SwZHzEZ.exe
  C:\Windows\System\SwZHzEZ.exe
  2⤵
  PID:7756
- C:\Windows\System\KRtBUYN.exe
  C:\Windows\System\KRtBUYN.exe
  2⤵
  PID:7820
- C:\Windows\System\qGGOrGm.exe
  C:\Windows\System\qGGOrGm.exe
  2⤵
  PID:7932
- C:\Windows\System\GTdoAyg.exe
  C:\Windows\System\GTdoAyg.exe
  2⤵
  PID:8004
- C:\Windows\System\IJjXcAP.exe
  C:\Windows\System\IJjXcAP.exe
  2⤵
  PID:7840
- C:\Windows\System\zQJXCpJ.exe
  C:\Windows\System\zQJXCpJ.exe
  2⤵
  PID:7956
- C:\Windows\System\ArnaZwA.exe
  C:\Windows\System\ArnaZwA.exe
  2⤵
  PID:8056
- C:\Windows\System\zCuVmhM.exe
  C:\Windows\System\zCuVmhM.exe
  2⤵
  PID:8076
- C:\Windows\System\jCcwaWO.exe
  C:\Windows\System\jCcwaWO.exe
  2⤵
  PID:8156
- C:\Windows\System\DGblepI.exe
  C:\Windows\System\DGblepI.exe
  2⤵
  PID:8188
- C:\Windows\System\ScZtAlq.exe
  C:\Windows\System\ScZtAlq.exe
  2⤵
  PID:8172
- C:\Windows\System\jlhBBpc.exe
  C:\Windows\System\jlhBBpc.exe
  2⤵
  PID:7176
- C:\Windows\System\PUqBRCA.exe
  C:\Windows\System\PUqBRCA.exe
  2⤵
  PID:7136
- C:\Windows\System\tcJEOJM.exe
  C:\Windows\System\tcJEOJM.exe
  2⤵
  PID:7248
- C:\Windows\System\RxgsPJY.exe
  C:\Windows\System\RxgsPJY.exe
  2⤵
  PID:6252
- C:\Windows\System\PaaSrKk.exe
  C:\Windows\System\PaaSrKk.exe
  2⤵
  PID:7452
- C:\Windows\System\bOXQEwH.exe
  C:\Windows\System\bOXQEwH.exe
  2⤵
  PID:7364
- C:\Windows\System\yjgIfaC.exe
  C:\Windows\System\yjgIfaC.exe
  2⤵
  PID:7544
- C:\Windows\System\fDMEKfC.exe
  C:\Windows\System\fDMEKfC.exe
  2⤵
  PID:7332
- C:\Windows\System\FNlZAZn.exe
  C:\Windows\System\FNlZAZn.exe
  2⤵
  PID:7492
- C:\Windows\System\WVZsXlx.exe
  C:\Windows\System\WVZsXlx.exe
  2⤵
  PID:7604
- C:\Windows\System\zSZTUrI.exe
  C:\Windows\System\zSZTUrI.exe
  2⤵
  PID:7628
- C:\Windows\System\GrXKJYa.exe
  C:\Windows\System\GrXKJYa.exe
  2⤵
  PID:7720
- C:\Windows\System\lwpixhi.exe
  C:\Windows\System\lwpixhi.exe
  2⤵
  PID:7748
- C:\Windows\System\dxvFzxM.exe
  C:\Windows\System\dxvFzxM.exe
  2⤵
  PID:7672
- C:\Windows\System\HcvxaSO.exe
  C:\Windows\System\HcvxaSO.exe
  2⤵
  PID:7728
- C:\Windows\System\VEvwTMp.exe
  C:\Windows\System\VEvwTMp.exe
  2⤵
  PID:7968
- C:\Windows\System\PDXAXGw.exe
  C:\Windows\System\PDXAXGw.exe
  2⤵
  PID:8040
- C:\Windows\System\YOaWndG.exe
  C:\Windows\System\YOaWndG.exe
  2⤵
  PID:7852
- C:\Windows\System\Yvqcbcb.exe
  C:\Windows\System\Yvqcbcb.exe
  2⤵
  PID:8092
- C:\Windows\System\LWSGWlF.exe
  C:\Windows\System\LWSGWlF.exe
  2⤵
  PID:7880
- C:\Windows\System\IyGqKTg.exe
  C:\Windows\System\IyGqKTg.exe
  2⤵
  PID:7952
- C:\Windows\System\FFZCkGZ.exe
  C:\Windows\System\FFZCkGZ.exe
  2⤵
  PID:8052
- C:\Windows\System\rcpArSj.exe
  C:\Windows\System\rcpArSj.exe
  2⤵
  PID:8120
- C:\Windows\System\CvQIELw.exe
  C:\Windows\System\CvQIELw.exe
  2⤵
  PID:8140
- C:\Windows\System\yXZhoqF.exe
  C:\Windows\System\yXZhoqF.exe
  2⤵
  PID:7436
- C:\Windows\System\gSZxkWn.exe
  C:\Windows\System\gSZxkWn.exe
  2⤵
  PID:7008
- C:\Windows\System\hvudvXZ.exe
  C:\Windows\System\hvudvXZ.exe
  2⤵
  PID:7656
- C:\Windows\System\AJvqJgI.exe
  C:\Windows\System\AJvqJgI.exe
  2⤵
  PID:7588
- C:\Windows\System\rKZqQQN.exe
  C:\Windows\System\rKZqQQN.exe
  2⤵
  PID:7768
- C:\Windows\System\RBTsWXm.exe
  C:\Windows\System\RBTsWXm.exe
  2⤵
  PID:8072
- C:\Windows\System\OdfKnpf.exe
  C:\Windows\System\OdfKnpf.exe
  2⤵
  PID:8024
- C:\Windows\System\Uppeazb.exe
  C:\Windows\System\Uppeazb.exe
  2⤵
  PID:7920
- C:\Windows\System\PkHnUDK.exe
  C:\Windows\System\PkHnUDK.exe
  2⤵
  PID:7260
- C:\Windows\System\NvSJzHm.exe
  C:\Windows\System\NvSJzHm.exe
  2⤵
  PID:7360
- C:\Windows\System\UlkYtJs.exe
  C:\Windows\System\UlkYtJs.exe
  2⤵
  PID:7816
- C:\Windows\System\ApgOYVM.exe
  C:\Windows\System\ApgOYVM.exe
  2⤵
  PID:7688
- C:\Windows\System\HlNujfR.exe
  C:\Windows\System\HlNujfR.exe
  2⤵
  PID:7508
- C:\Windows\System\VMOiipp.exe
  C:\Windows\System\VMOiipp.exe
  2⤵
  PID:7412
- C:\Windows\System\LHGdpzH.exe
  C:\Windows\System\LHGdpzH.exe
  2⤵
  PID:7316
- C:\Windows\System\FhRGgfr.exe
  C:\Windows\System\FhRGgfr.exe
  2⤵
  PID:7244
- C:\Windows\System\VJNZXzB.exe
  C:\Windows\System\VJNZXzB.exe
  2⤵
  PID:8108
- C:\Windows\System\SitJvtE.exe
  C:\Windows\System\SitJvtE.exe
  2⤵
  PID:7608
- C:\Windows\System\oqNVHlj.exe
  C:\Windows\System\oqNVHlj.exe
  2⤵
  PID:7900
- C:\Windows\System\bsGMRKi.exe
  C:\Windows\System\bsGMRKi.exe
  2⤵
  PID:7836
- C:\Windows\System\jIXnHvK.exe
  C:\Windows\System\jIXnHvK.exe
  2⤵
  PID:7468
- C:\Windows\System\RIkLhvk.exe
  C:\Windows\System\RIkLhvk.exe
  2⤵
  PID:8204
- C:\Windows\System\PnYmaUj.exe
  C:\Windows\System\PnYmaUj.exe
  2⤵
  PID:8220
- C:\Windows\System\fLRkhmZ.exe
  C:\Windows\System\fLRkhmZ.exe
  2⤵
  PID:8236
- C:\Windows\System\DzDaUvt.exe
  C:\Windows\System\DzDaUvt.exe
  2⤵
  PID:8252
- C:\Windows\System\cCisTpx.exe
  C:\Windows\System\cCisTpx.exe
  2⤵
  PID:8268
- C:\Windows\System\lPmMcQl.exe
  C:\Windows\System\lPmMcQl.exe
  2⤵
  PID:8284
- C:\Windows\System\EcDZEyX.exe
  C:\Windows\System\EcDZEyX.exe
  2⤵
  PID:8300
- C:\Windows\System\idmSAeu.exe
  C:\Windows\System\idmSAeu.exe
  2⤵
  PID:8316
- C:\Windows\System\fQGwQjP.exe
  C:\Windows\System\fQGwQjP.exe
  2⤵
  PID:8332
- C:\Windows\System\lJEoFbb.exe
  C:\Windows\System\lJEoFbb.exe
  2⤵
  PID:8348
- C:\Windows\System\gclPWYL.exe
  C:\Windows\System\gclPWYL.exe
  2⤵
  PID:8448
- C:\Windows\System\pXTMCSa.exe
  C:\Windows\System\pXTMCSa.exe
  2⤵
  PID:8640
- C:\Windows\System\gHwfsVO.exe
  C:\Windows\System\gHwfsVO.exe
  2⤵
  PID:8656
- C:\Windows\System\WGFQRts.exe
  C:\Windows\System\WGFQRts.exe
  2⤵
  PID:8672
- C:\Windows\System\BpUVEOo.exe
  C:\Windows\System\BpUVEOo.exe
  2⤵
  PID:8692
- C:\Windows\System\NmgcxMz.exe
  C:\Windows\System\NmgcxMz.exe
  2⤵
  PID:8708
- C:\Windows\System\kBHRzoi.exe
  C:\Windows\System\kBHRzoi.exe
  2⤵
  PID:8740
- C:\Windows\System\nxrrDqs.exe
  C:\Windows\System\nxrrDqs.exe
  2⤵
  PID:8760
- C:\Windows\System\VJBwPZF.exe
  C:\Windows\System\VJBwPZF.exe
  2⤵
  PID:8780
- C:\Windows\System\ythRSDO.exe
  C:\Windows\System\ythRSDO.exe
  2⤵
  PID:8796
- C:\Windows\System\AMbxZaH.exe
  C:\Windows\System\AMbxZaH.exe
  2⤵
  PID:8816
- C:\Windows\System\XcuyUwJ.exe
  C:\Windows\System\XcuyUwJ.exe
  2⤵
  PID:8832
- C:\Windows\System\qNiFRKi.exe
  C:\Windows\System\qNiFRKi.exe
  2⤵
  PID:8848
- C:\Windows\System\qYjTifr.exe
  C:\Windows\System\qYjTifr.exe
  2⤵
  PID:8868
- C:\Windows\System\btWOCcU.exe
  C:\Windows\System\btWOCcU.exe
  2⤵
  PID:8888
- C:\Windows\System\LLPRzun.exe
  C:\Windows\System\LLPRzun.exe
  2⤵
  PID:8904
- C:\Windows\System\NcChjxQ.exe
  C:\Windows\System\NcChjxQ.exe
  2⤵
  PID:8924
- C:\Windows\System\iwIwKcM.exe
  C:\Windows\System\iwIwKcM.exe
  2⤵
  PID:8940
- C:\Windows\System\wtOmpzu.exe
  C:\Windows\System\wtOmpzu.exe
  2⤵
  PID:8956
- C:\Windows\System\btgcaOg.exe
  C:\Windows\System\btgcaOg.exe
  2⤵
  PID:8972
- C:\Windows\System\qFdqymN.exe
  C:\Windows\System\qFdqymN.exe
  2⤵
  PID:8992
- C:\Windows\System\sbKFvoO.exe
  C:\Windows\System\sbKFvoO.exe
  2⤵
  PID:9008
- C:\Windows\System\upINuEh.exe
  C:\Windows\System\upINuEh.exe
  2⤵
  PID:9024
- C:\Windows\System\OxLWMFF.exe
  C:\Windows\System\OxLWMFF.exe
  2⤵
  PID:9044
- C:\Windows\System\PnkSgvc.exe
  C:\Windows\System\PnkSgvc.exe
  2⤵
  PID:9060
- C:\Windows\System\XxRqkOK.exe
  C:\Windows\System\XxRqkOK.exe
  2⤵
  PID:9076
- C:\Windows\System\NQsGWcm.exe
  C:\Windows\System\NQsGWcm.exe
  2⤵
  PID:9096
- C:\Windows\System\ITrFiNq.exe
  C:\Windows\System\ITrFiNq.exe
  2⤵
  PID:9120
- C:\Windows\System\mggPsZa.exe
  C:\Windows\System\mggPsZa.exe
  2⤵
  PID:9140
- C:\Windows\System\GqKNryk.exe
  C:\Windows\System\GqKNryk.exe
  2⤵
  PID:9156
- C:\Windows\System\GBjHRUs.exe
  C:\Windows\System\GBjHRUs.exe
  2⤵
  PID:7804
- C:\Windows\System\DOqheUI.exe
  C:\Windows\System\DOqheUI.exe
  2⤵
  PID:7912
- C:\Windows\System\LpyXjSp.exe
  C:\Windows\System\LpyXjSp.exe
  2⤵
  PID:8212
- C:\Windows\System\CnRrMKz.exe
  C:\Windows\System\CnRrMKz.exe
  2⤵
  PID:8260
- C:\Windows\System\ixhzAsa.exe
  C:\Windows\System\ixhzAsa.exe
  2⤵
  PID:8276
- C:\Windows\System\TNGmCVg.exe
  C:\Windows\System\TNGmCVg.exe
  2⤵
  PID:8312
- C:\Windows\System\ZxAVRAJ.exe
  C:\Windows\System\ZxAVRAJ.exe
  2⤵
  PID:8340
- C:\Windows\System\AxXfDYP.exe
  C:\Windows\System\AxXfDYP.exe
  2⤵
  PID:8368
- C:\Windows\System\vEYnBcS.exe
  C:\Windows\System\vEYnBcS.exe
  2⤵
  PID:8388
- C:\Windows\System\ZKOeMww.exe
  C:\Windows\System\ZKOeMww.exe
  2⤵
  PID:8408
- C:\Windows\System\TtqmbnE.exe
  C:\Windows\System\TtqmbnE.exe
  2⤵
  PID:8428
- C:\Windows\System\SdWeJvw.exe
  C:\Windows\System\SdWeJvw.exe
  2⤵
  PID:8440
- C:\Windows\System\uqgOBGY.exe
  C:\Windows\System\uqgOBGY.exe
  2⤵
  PID:8500
- C:\Windows\System\gdUPyoY.exe
  C:\Windows\System\gdUPyoY.exe
  2⤵
  PID:8480
- C:\Windows\System\awgtQCZ.exe
  C:\Windows\System\awgtQCZ.exe
  2⤵
  PID:8464
- C:\Windows\System\StMTIOL.exe
  C:\Windows\System\StMTIOL.exe
  2⤵
  PID:8520
- C:\Windows\System\dcooInc.exe
  C:\Windows\System\dcooInc.exe
  2⤵
  PID:8544
- C:\Windows\System\cZCbvaB.exe
  C:\Windows\System\cZCbvaB.exe
  2⤵
  PID:8580
- C:\Windows\System\teBSZXt.exe
  C:\Windows\System\teBSZXt.exe
  2⤵
  PID:8588
- C:\Windows\System\gUlCPbd.exe
  C:\Windows\System\gUlCPbd.exe
  2⤵
  PID:8624
- C:\Windows\System\SeBqkJF.exe
  C:\Windows\System\SeBqkJF.exe
  2⤵
  PID:8716
- C:\Windows\System\XGIGiig.exe
  C:\Windows\System\XGIGiig.exe
  2⤵
  PID:8720
- C:\Windows\System\TEkQuJj.exe
  C:\Windows\System\TEkQuJj.exe
  2⤵
  PID:8424
- C:\Windows\System\cTXxxni.exe
  C:\Windows\System\cTXxxni.exe
  2⤵
  PID:8804
- C:\Windows\System\fXvRiGw.exe
  C:\Windows\System\fXvRiGw.exe
  2⤵
  PID:8812
- C:\Windows\System\gdYxEIH.exe
  C:\Windows\System\gdYxEIH.exe
  2⤵
  PID:8916
- C:\Windows\System\ChgDXti.exe
  C:\Windows\System\ChgDXti.exe
  2⤵
  PID:8828
- C:\Windows\System\LuNIdWN.exe
  C:\Windows\System\LuNIdWN.exe
  2⤵
  PID:9088
- C:\Windows\System\tmFcDnn.exe
  C:\Windows\System\tmFcDnn.exe
  2⤵
  PID:9092
- C:\Windows\System\HyFTFiY.exe
  C:\Windows\System\HyFTFiY.exe
  2⤵
  PID:9164
- C:\Windows\System\QCTIIiH.exe
  C:\Windows\System\QCTIIiH.exe
  2⤵
  PID:8900
- C:\Windows\System\AoOCyQk.exe
  C:\Windows\System\AoOCyQk.exe
  2⤵
  PID:8856
- C:\Windows\System\bKgVevb.exe
  C:\Windows\System\bKgVevb.exe
  2⤵
  PID:9176
- C:\Windows\System\ZayJJtS.exe
  C:\Windows\System\ZayJJtS.exe
  2⤵
  PID:9188
- C:\Windows\System\bmyJrZc.exe
  C:\Windows\System\bmyJrZc.exe
  2⤵
  PID:9200
- C:\Windows\System\nCRKQDf.exe
  C:\Windows\System\nCRKQDf.exe
  2⤵
  PID:9072
- C:\Windows\System\JHaRkcs.exe
  C:\Windows\System\JHaRkcs.exe
  2⤵
  PID:9116
- C:\Windows\System\sVuJNiN.exe
  C:\Windows\System\sVuJNiN.exe
  2⤵
  PID:9204
- C:\Windows\System\xqZEYkX.exe
  C:\Windows\System\xqZEYkX.exe
  2⤵
  PID:7140
- C:\Windows\System\ApNYcRi.exe
  C:\Windows\System\ApNYcRi.exe
  2⤵
  PID:8200
- C:\Windows\System\dnSmkyl.exe
  C:\Windows\System\dnSmkyl.exe
  2⤵
  PID:8248
- C:\Windows\System\hqtDoCJ.exe
  C:\Windows\System\hqtDoCJ.exe
  2⤵
  PID:8296
- C:\Windows\System\VMLsmEs.exe
  C:\Windows\System\VMLsmEs.exe
  2⤵
  PID:8384
- C:\Windows\System\kMMYZed.exe
  C:\Windows\System\kMMYZed.exe
  2⤵
  PID:8460
- C:\Windows\System\CAJuVNP.exe
  C:\Windows\System\CAJuVNP.exe
  2⤵
  PID:8536
- C:\Windows\System\WUonkGV.exe
  C:\Windows\System\WUonkGV.exe
  2⤵
  PID:8596
- C:\Windows\System\yHIWAvf.exe
  C:\Windows\System\yHIWAvf.exe
  2⤵
  PID:8568
- C:\Windows\System\GmrEpJD.exe
  C:\Windows\System\GmrEpJD.exe
  2⤵
  PID:8556
- C:\Windows\System\STZUdIU.exe
  C:\Windows\System\STZUdIU.exe
  2⤵
  PID:8648
- C:\Windows\System\oockHIb.exe
  C:\Windows\System\oockHIb.exe
  2⤵
  PID:8636
- C:\Windows\System\EaizsyO.exe
  C:\Windows\System\EaizsyO.exe
  2⤵
  PID:8668
- C:\Windows\System\SluPpwQ.exe
  C:\Windows\System\SluPpwQ.exe
  2⤵
  PID:8776
- C:\Windows\System\ApemFYg.exe
  C:\Windows\System\ApemFYg.exe
  2⤵
  PID:8840
- C:\Windows\System\dqIoqZX.exe
  C:\Windows\System\dqIoqZX.exe
  2⤵
  PID:8984
- C:\Windows\System\VmjKTsA.exe
  C:\Windows\System\VmjKTsA.exe
  2⤵
  PID:9052
- C:\Windows\System\zFBNEpq.exe
  C:\Windows\System\zFBNEpq.exe
  2⤵
  PID:8860
- C:\Windows\System\qjVfSHo.exe
  C:\Windows\System\qjVfSHo.exe
  2⤵
  PID:9180
- C:\Windows\System\eCuUCKI.exe
  C:\Windows\System\eCuUCKI.exe
  2⤵
  PID:8968
- C:\Windows\System\zAEOYRL.exe
  C:\Windows\System\zAEOYRL.exe
  2⤵
  PID:8484
- C:\Windows\System\mJIAtLf.exe
  C:\Windows\System\mJIAtLf.exe
  2⤵
  PID:8488
- C:\Windows\System\STBjYWh.exe
  C:\Windows\System\STBjYWh.exe
  2⤵
  PID:8436
- C:\Windows\System\kBECezM.exe
  C:\Windows\System\kBECezM.exe
  2⤵
  PID:9000
- C:\Windows\System\HZCEMGR.exe
  C:\Windows\System\HZCEMGR.exe
  2⤵
  PID:8532
- C:\Windows\System\JnbennT.exe
  C:\Windows\System\JnbennT.exe
  2⤵
  PID:8420
- C:\Windows\System\FNRzQOF.exe
  C:\Windows\System\FNRzQOF.exe
  2⤵
  PID:7800
- C:\Windows\System\gdIzTNA.exe
  C:\Windows\System\gdIzTNA.exe
  2⤵
  PID:8632
- C:\Windows\System\McCMARC.exe
  C:\Windows\System\McCMARC.exe
  2⤵
  PID:8756
- C:\Windows\System\CBWTSbL.exe
  C:\Windows\System\CBWTSbL.exe
  2⤵
  PID:8620
- C:\Windows\System\SYvswYl.exe
  C:\Windows\System\SYvswYl.exe
  2⤵
  PID:8688
- C:\Windows\System\oWHDzMu.exe
  C:\Windows\System\oWHDzMu.exe
  2⤵
  PID:8752
- C:\Windows\System\tcBsKEh.exe
  C:\Windows\System\tcBsKEh.exe
  2⤵
  PID:8748
- C:\Windows\System\pRqaBDy.exe
  C:\Windows\System\pRqaBDy.exe
  2⤵
  PID:8980
- C:\Windows\System\htFeNDb.exe
  C:\Windows\System\htFeNDb.exe
  2⤵
  PID:9108
- C:\Windows\System\xKXdcJU.exe
  C:\Windows\System\xKXdcJU.exe
  2⤵
  PID:8456
- C:\Windows\System\gRJzvCl.exe
  C:\Windows\System\gRJzvCl.exe
  2⤵
  PID:9228
- C:\Windows\System\UFKFIYh.exe
  C:\Windows\System\UFKFIYh.exe
  2⤵
  PID:9248
- C:\Windows\System\FkkYCFy.exe
  C:\Windows\System\FkkYCFy.exe
  2⤵
  PID:9264
- C:\Windows\System\cEDWQjn.exe
  C:\Windows\System\cEDWQjn.exe
  2⤵
  PID:9280
- C:\Windows\System\caQXOMd.exe
  C:\Windows\System\caQXOMd.exe
  2⤵
  PID:9300
- C:\Windows\System\SGZSMsc.exe
  C:\Windows\System\SGZSMsc.exe
  2⤵
  PID:9316
- C:\Windows\System\XDjBQWw.exe
  C:\Windows\System\XDjBQWw.exe
  2⤵
  PID:9332
- C:\Windows\System\SUkzwcE.exe
  C:\Windows\System\SUkzwcE.exe
  2⤵
  PID:9352
- C:\Windows\System\vsosxVP.exe
  C:\Windows\System\vsosxVP.exe
  2⤵
  PID:9368
- C:\Windows\System\ppubhvg.exe
  C:\Windows\System\ppubhvg.exe
  2⤵
  PID:9384
- C:\Windows\System\oPIZIvr.exe
  C:\Windows\System\oPIZIvr.exe
  2⤵
  PID:9404
- C:\Windows\System\hNvdaTA.exe
  C:\Windows\System\hNvdaTA.exe
  2⤵
  PID:9476
- C:\Windows\System\tGmcYGu.exe
  C:\Windows\System\tGmcYGu.exe
  2⤵
  PID:9496
- C:\Windows\System\OmpdWKK.exe
  C:\Windows\System\OmpdWKK.exe
  2⤵
  PID:9512
- C:\Windows\System\ZJbloWC.exe
  C:\Windows\System\ZJbloWC.exe
  2⤵
  PID:9540
- C:\Windows\System\LLBSdvS.exe
  C:\Windows\System\LLBSdvS.exe
  2⤵
  PID:9556
- C:\Windows\System\ikAsBiP.exe
  C:\Windows\System\ikAsBiP.exe
  2⤵
  PID:9572
- C:\Windows\System\ScQKHpz.exe
  C:\Windows\System\ScQKHpz.exe
  2⤵
  PID:9628
- C:\Windows\System\rXHeDEB.exe
  C:\Windows\System\rXHeDEB.exe
  2⤵
  PID:9644
- C:\Windows\System\MTZioYR.exe
  C:\Windows\System\MTZioYR.exe
  2⤵
  PID:9660
- C:\Windows\System\kmjuWbp.exe
  C:\Windows\System\kmjuWbp.exe
  2⤵
  PID:9676
- C:\Windows\System\cDBwMJR.exe
  C:\Windows\System\cDBwMJR.exe
  2⤵
  PID:9692
- C:\Windows\System\ifOyhol.exe
  C:\Windows\System\ifOyhol.exe
  2⤵
  PID:9708
- C:\Windows\System\bjlYEZk.exe
  C:\Windows\System\bjlYEZk.exe
  2⤵
  PID:9724
- C:\Windows\System\SNKlIBq.exe
  C:\Windows\System\SNKlIBq.exe
  2⤵
  PID:9744
- C:\Windows\System\AEDBoAS.exe
  C:\Windows\System\AEDBoAS.exe
  2⤵
  PID:9760
- C:\Windows\System\wqcIPur.exe
  C:\Windows\System\wqcIPur.exe
  2⤵
  PID:9788
- C:\Windows\System\VEKmnMM.exe
  C:\Windows\System\VEKmnMM.exe
  2⤵
  PID:9840
- C:\Windows\System\tirKiKr.exe
  C:\Windows\System\tirKiKr.exe
  2⤵
  PID:9856
- C:\Windows\System\curCuis.exe
  C:\Windows\System\curCuis.exe
  2⤵
  PID:9872
- C:\Windows\System\YnRPPIV.exe
  C:\Windows\System\YnRPPIV.exe
  2⤵
  PID:9888
- C:\Windows\System\PHFcYsp.exe
  C:\Windows\System\PHFcYsp.exe
  2⤵
  PID:9904
- C:\Windows\System\bKvDbSH.exe
  C:\Windows\System\bKvDbSH.exe
  2⤵
  PID:9920
- C:\Windows\System\ZRoKoFb.exe
  C:\Windows\System\ZRoKoFb.exe
  2⤵
  PID:9936
- C:\Windows\System\VOnhomn.exe
  C:\Windows\System\VOnhomn.exe
  2⤵
  PID:9960
- C:\Windows\System\fWpwUuS.exe
  C:\Windows\System\fWpwUuS.exe
  2⤵
  PID:9976
- C:\Windows\System\ZcqOFhK.exe
  C:\Windows\System\ZcqOFhK.exe
  2⤵
  PID:9992
- C:\Windows\System\Spdgqay.exe
  C:\Windows\System\Spdgqay.exe
  2⤵
  PID:10008
- C:\Windows\System\IoERihh.exe
  C:\Windows\System\IoERihh.exe
  2⤵
  PID:10024
- C:\Windows\System\PeDUSVA.exe
  C:\Windows\System\PeDUSVA.exe
  2⤵
  PID:10068
- C:\Windows\System\QUcbQes.exe
  C:\Windows\System\QUcbQes.exe
  2⤵
  PID:10084
- C:\Windows\System\dCoFJBl.exe
  C:\Windows\System\dCoFJBl.exe
  2⤵
  PID:10104
- C:\Windows\System\omTzdcG.exe
  C:\Windows\System\omTzdcG.exe
  2⤵
  PID:10120
- C:\Windows\System\refvGhP.exe
  C:\Windows\System\refvGhP.exe
  2⤵
  PID:10136
- C:\Windows\System\YdSFWzA.exe
  C:\Windows\System\YdSFWzA.exe
  2⤵
  PID:10160
- C:\Windows\System\ghuMllm.exe
  C:\Windows\System\ghuMllm.exe
  2⤵
  PID:10184
- C:\Windows\System\JIzKanB.exe
  C:\Windows\System\JIzKanB.exe
  2⤵
  PID:10200
- C:\Windows\System\XRukiCE.exe
  C:\Windows\System\XRukiCE.exe
  2⤵
  PID:10216
- C:\Windows\System\rdRknRi.exe
  C:\Windows\System\rdRknRi.exe
  2⤵
  PID:10232
- C:\Windows\System\BommoQG.exe
  C:\Windows\System\BommoQG.exe
  2⤵
  PID:8516
- C:\Windows\System\AKjdkyC.exe
  C:\Windows\System\AKjdkyC.exe
  2⤵
  PID:9220
- C:\Windows\System\LtCzfGM.exe
  C:\Windows\System\LtCzfGM.exe
  2⤵
  PID:8884
- C:\Windows\System\AFowMDi.exe
  C:\Windows\System\AFowMDi.exe
  2⤵
  PID:9360
- C:\Windows\System\tQLdKTn.exe
  C:\Windows\System\tQLdKTn.exe
  2⤵
  PID:8196
- C:\Windows\System\oTnYQpk.exe
  C:\Windows\System\oTnYQpk.exe
  2⤵
  PID:9276
- C:\Windows\System\ClNGsQl.exe
  C:\Windows\System\ClNGsQl.exe
  2⤵
  PID:8552
- C:\Windows\System\GftTMCT.exe
  C:\Windows\System\GftTMCT.exe
  2⤵
  PID:8020
- C:\Windows\System\pKGAQxV.exe
  C:\Windows\System\pKGAQxV.exe
  2⤵
  PID:8932
- C:\Windows\System\PpPCWAw.exe
  C:\Windows\System\PpPCWAw.exe
  2⤵
  PID:9296
- C:\Windows\System\derjtMe.exe
  C:\Windows\System\derjtMe.exe
  2⤵
  PID:9396
- C:\Windows\System\xpqeMtb.exe
  C:\Windows\System\xpqeMtb.exe
  2⤵
  PID:9432
- C:\Windows\System\EGEvqJR.exe
  C:\Windows\System\EGEvqJR.exe
  2⤵
  PID:9444
- C:\Windows\System\GxKwuef.exe
  C:\Windows\System\GxKwuef.exe
  2⤵
  PID:9492
- C:\Windows\System\nYfdjko.exe
  C:\Windows\System\nYfdjko.exe
  2⤵
  PID:9528
- C:\Windows\System\Kqyfunu.exe
  C:\Windows\System\Kqyfunu.exe
  2⤵
  PID:9564
- C:\Windows\System\JYWEUaP.exe
  C:\Windows\System\JYWEUaP.exe
  2⤵
  PID:9584
- C:\Windows\System\oEygnRg.exe
  C:\Windows\System\oEygnRg.exe
  2⤵
  PID:9508
- C:\Windows\System\mRDdkmL.exe
  C:\Windows\System\mRDdkmL.exe
  2⤵
  PID:9580
- C:\Windows\System\VWklZKu.exe
  C:\Windows\System\VWklZKu.exe
  2⤵
  PID:9624
- C:\Windows\System\LYoirRi.exe
  C:\Windows\System\LYoirRi.exe
  2⤵
  PID:9668
- C:\Windows\System\dNXGpln.exe
  C:\Windows\System\dNXGpln.exe
  2⤵
  PID:9688
- C:\Windows\System\mckEZkf.exe
  C:\Windows\System\mckEZkf.exe
  2⤵
  PID:9752
- C:\Windows\System\dWCTstx.exe
  C:\Windows\System\dWCTstx.exe
  2⤵
  PID:9820
- C:\Windows\System\uxCbYAw.exe
  C:\Windows\System\uxCbYAw.exe
  2⤵
  PID:9852
- C:\Windows\System\PAwJrAd.exe
  C:\Windows\System\PAwJrAd.exe
  2⤵
  PID:9956
- C:\Windows\System\PqPxPJS.exe
  C:\Windows\System\PqPxPJS.exe
  2⤵
  PID:9932
- C:\Windows\System\HTRjbXw.exe
  C:\Windows\System\HTRjbXw.exe
  2⤵
  PID:9912
- C:\Windows\System\BCFCmHe.exe
  C:\Windows\System\BCFCmHe.exe
  2⤵
  PID:10144
- C:\Windows\System\CVeioKe.exe
  C:\Windows\System\CVeioKe.exe
  2⤵
  PID:8592
- C:\Windows\System\ONldNsu.exe
  C:\Windows\System\ONldNsu.exe
  2⤵
  PID:9380
- C:\Windows\System\vfHCKqM.exe
  C:\Windows\System\vfHCKqM.exe
  2⤵
  PID:8308
- C:\Windows\System\nsDDfVz.exe
  C:\Windows\System\nsDDfVz.exe
  2⤵
  PID:10176
- C:\Windows\System\WRDZBTf.exe
  C:\Windows\System\WRDZBTf.exe
  2⤵
  PID:9348
- C:\Windows\System\hTgFTvA.exe
  C:\Windows\System\hTgFTvA.exe
  2⤵
  PID:9416
- C:\Windows\System\SlvclMt.exe
  C:\Windows\System\SlvclMt.exe
  2⤵
  PID:8952
- C:\Windows\System\dKRcRYH.exe
  C:\Windows\System\dKRcRYH.exe
  2⤵
  PID:8572
- C:\Windows\System\QuEOOqN.exe
  C:\Windows\System\QuEOOqN.exe
  2⤵
  PID:9152
- C:\Windows\System\dZjduAf.exe
  C:\Windows\System\dZjduAf.exe
  2⤵
  PID:8404
- C:\Windows\System\HxUiMXn.exe
  C:\Windows\System\HxUiMXn.exe
  2⤵
  PID:9172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhjJXLT.exe

Filesize
1.4MB

MD5
93d4f09087fe3e08525ae44dc9ce1ec1

SHA1
855399919c04ed9b123db86cbf5480d3a46c630f

SHA256
aea8e6838ef24e91a02ec65210b4eed72a7d1b8da06da4b335a6b25a3b4ff62c

SHA512
686b6b848bbb1262a3167ac6372f214174bb4b1055d8839b8298e4b85ca299df28cb0063304b22ea11fe2c11c4eea563f792d9c30a3d467d6fca0f8e42baa32f

Download Submit
C:\Windows\system\BCsocCn.exe

Filesize
1.4MB

MD5
088036f9dba77df68cef7a2f091ddc62

SHA1
7356d36d273e952726b9f54c0d59fd646b66864e

SHA256
bf966012fde7ab6edfbbde36f2bf617268e4408c6d9197718562d60380d459b6

SHA512
0bdff754662e397c7c97090fb0b73045c00be0e81a113570f9759bce10cf003908bdc0c4745654a8e0745b15b96018de57b18abfa591437be0a306cf303e8692

Download Submit
C:\Windows\system\BseYtfy.exe

Filesize
1.4MB

MD5
0fe04210203475d9211160a0dad09f25

SHA1
03caaa88982c553f6e0cc8f511b006aac97f2255

SHA256
60bd8fe86c19b8f58c21245b90a3a72a2b5c7f3f7f773a87ab2d345c59a2728e

SHA512
528bbd57d34345d43ffcd751709f97bdccf08a26802793e71b9032af300a6828563ff17690caeeabce7c780b7e8e05e15424d6f2716cb230742649493f470ec1

Download Submit
C:\Windows\system\BxoWYaA.exe

Filesize
1.4MB

MD5
5a3e7b67b56df9a0c8209144346f86c6

SHA1
97d7c9500de8a67c1b976f7460fbb12d0e23b5b5

SHA256
c44c7fcae2a4e745e70ddbbaf99f71d975ab1a35e40ac03916f26e9fa052ee46

SHA512
50d94023807b2c862149ef6939b8f96ea5e8f89ad7bcf7056cd4679aa6638b716a1ebba6c8f768fb13a2e5a2cf9b7bdc434773826c7476ebb485e2dfd0052c55

Download Submit
C:\Windows\system\GModfEH.exe

Filesize
1.4MB

MD5
a4edb202c161fbcfe395502b8e12b0b0

SHA1
0714d3fe6c4126b33383bc51d97aaf5f85bfb429

SHA256
f211a1738064bd4b1a78ba189a806808be594040d16e1b3b122f4a6eea24737c

SHA512
3efaaf1129e2e41c55d031cc09afccec4cb1026502391d999a24b524c7cca8e04fb6e88aed5d5fb1ae9512ab452ae8b99c3637e82d43124c3fd123aabdb3de55

Download Submit
C:\Windows\system\GgaaGSr.exe

Filesize
1.4MB

MD5
5945b510dda8f7f5a07d1eea35f93e9a

SHA1
f4be64af165b2ac5dd8e7c98dbaa68fd1749c5ab

SHA256
0bde275b799c89cca857866567ad439eaab366f4cadaf60eb3700c145dcc99f9

SHA512
9c453658fa06cae8e8ef3aa310154154e0c231876d82b09c48f55c1c05aa7f1fc506f08fa1535fe9ab941af99ac9551ed779c4a8db2c6e5274675d7745b10d07

Download Submit
C:\Windows\system\GzVNVIM.exe

Filesize
1.4MB

MD5
5a8ddb46edd50004692b6fd808b684dc

SHA1
0fb4807f6ae522e20c18085ab5bc5555f4574801

SHA256
35d12d018b22f26948961b4eb9cacbd47f0a0cb24ce2523c5029b9791c80cc96

SHA512
dd6afef4f614da0e15a6d44370e5e02d981eb439eeb2342bc82cf3c6381bd2f341e52a164e16f5e5da9f7e2ff303d331eeaccbd8be470ecfb705fe1d3beff34c

Download Submit
C:\Windows\system\JzYbcpH.exe

Filesize
1.4MB

MD5
b8bc0cf9f6c521ed8c9984dac5dafbf4

SHA1
a427eff741b92ecb46e673d9ce68609a02e6b56a

SHA256
341cb54914335476facabb1cad35eabc89771f95f50df10e1d2171d5be2723d8

SHA512
f57f2c8b4c453b6c72d497d2d774acd80f8abfa5a819626676e27bb4b1f0ebb7eb97af3d8cd299a5e2369f63e0d7c0d04b9d193a62e7efd6b5bd8de889b56fad

Download Submit
C:\Windows\system\LepkUot.exe

Filesize
1.4MB

MD5
a6e437c7d0db22c9a49321e4f620a10f

SHA1
49c01b5e4ac75ea7814e8af1c2e5118c8ebd7f0b

SHA256
7507f9eab9a1160178d5f3fc08a8df76bd31510be6694692aeda946553b5213e

SHA512
d19943edfa0bf260aa2d6ebad548c60a7e30a5185665e0fdd858fc7480b9b50ed810b226269861529341c06afd3ffbe45f90d4d069ff2caa47bad89bf91c8ef1

Download Submit
C:\Windows\system\Lpmqqqw.exe

Filesize
1.4MB

MD5
0863ddd41491245eeab2d5e30bbbd1ce

SHA1
41df12be01828efab27bb1140a3e1f817f40286f

SHA256
702060dd36d9263090d19d4503b4c3d1e810fc5cf5902b996b76a590512583c1

SHA512
118e963128c9df85edbdcd3ea287a113e9c74c7931ef204cf05c12425d2a05bb474d4b61ab3fea807c1dea84c8952432e85c4f8e1f7045d4d8f37215d82ec843

Download Submit
C:\Windows\system\LsauzxZ.exe

Filesize
1.4MB

MD5
7088942ada93fc165ab31b903a397e2e

SHA1
bf8d13b12f4558d49753c535e06f8fab9217ac37

SHA256
9cbf23d47dd8d5b3a47406bf41daa170b06f23942e06d3eb36dbf8ee95eb8f70

SHA512
f9af2fabe390b07e994da2943240315e39ada3eb720230709554a940a1060fc77747503b7567f9461b152f169afe86b22cca75eac9c045dd8d5a3f7548b4c200

Download Submit
C:\Windows\system\OInCsgM.exe

Filesize
1.4MB

MD5
f9f6bc22f58bda63e7ee0a0d918454ba

SHA1
e2e28ed789ef8593695557bb9050b648cfacd449

SHA256
a33bfe41740be11fee46f292b9bf68dc893a49714ef4c78d5b3622819c3aa09f

SHA512
199f30c5d59e3975bb028c9752438e02b532c7717b872665bc015358b0ddd50444c7b63c22dc544d37d22201ee01e460bba5130acb80d8b827d05bc4db858271

Download Submit
C:\Windows\system\UPxZeFO.exe

Filesize
1.4MB

MD5
e6ea778b7a67ed42b8ef814fd5fda8dc

SHA1
210162a68b2ffbfd9a51864974a32c2888f90286

SHA256
be9e33922ab1e34f6f62871a1acbc34760785fcc14cb33c8a9098eb23e42001e

SHA512
65d5f95d50a5a833c2a9ac5a23d2380af23adf444891b424c0bff0ca1a63c525124d27611bee06a50bba8d73732d5fb55f22492ba0a121cf8cdc13e106cb7214

Download Submit
C:\Windows\system\VBgoLIY.exe

Filesize
1.4MB

MD5
20b388b0468c75da9e0048b05fd811e8

SHA1
7bacdab3da1ef012233fcced520103231062cb31

SHA256
cc2118d3083d7c5f70632e92d585a6dea6769ee0578bf9e4f48d4d91c7ab0806

SHA512
2baa0815c41d332350e0145040a9d315ac3b8dd380d9f841c346d37dd12e3cb66b56f0f2a5dfb4afed60110a9568e2aa4c53ec0cfbfbbd5abdc2c683b69dd881

Download Submit
C:\Windows\system\XzknuOn.exe

Filesize
1.4MB

MD5
856262e87dfe23a5a76d09dcd7e06c62

SHA1
0ade7471e2573aeb757b2bbda11e6e3f5df45fc2

SHA256
703c0dc5c8ebd25cf575cea9814c20af6e18f643e5baf3d3283d94dbe45bdac1

SHA512
d231d34a819f34e527c51d0a1967f75d816e2d66f7fe9a235f2ebd9bd70907b065b61c8f5baee757ab3315bd9e04e73c749ed7df2d2ec773e37a25bbbbd479dd

Download Submit
C:\Windows\system\ZYLlYph.exe

Filesize
1.4MB

MD5
f94691811ef3a64689c1a7088f311ba7

SHA1
d51055ff7833294d9085aa9d0599f975b28e7927

SHA256
ab5e20360cc7ada086caf61f4f18509b218555bd79c5e40d6d0b8d8de8a602d9

SHA512
7e75fb6cd50f8c35991d484f93c47c5775f16dd462767eec471eb5ab607e21777c61f5c32590a6cbe212ad9243f142e75bb61dab153aaf8131ad420b726e8d96

Download Submit
C:\Windows\system\aPXRFfJ.exe

Filesize
1.4MB

MD5
d425be8177ce01e4a50b2297d54448dd

SHA1
98f0a5016538a0603b0891dcf751c91387051345

SHA256
4bf5c65d3c39ddb0b3f984e261fad30afdce62427096a8146e855beeac674028

SHA512
50657152698271e387b0593c3f5514be9198ea5855cf8c97f761a179c5d95792299a9bbd74b8cbfb0ced51e3f1ec49e751b60ae2e850a69a8d5127bb8483a11c

Download Submit
C:\Windows\system\cNrSvlP.exe

Filesize
1.4MB

MD5
15e84a48f09294475324778028c5d98e

SHA1
be1bf60cce299ff445d8d9c9aed97c79d3b4a5ee

SHA256
8b1f58f131822789c24688e3140ef443ef9c113947524dba8488628ef89c695b

SHA512
b64a522ece1c82dd31e5d4e5127ec7b57522ea8c54f9b74f34d79e640ab4c6b280ae6bd5d5b6e56602dcd145f55abbe3d528fa28885b558fe02703953d3e4f49

Download Submit
C:\Windows\system\cWNfhKh.exe

Filesize
1.4MB

MD5
4e02d598f9aeb9eed60dcebc5147af3d

SHA1
a4a69c83c4e8eb2e2e4e7e18641897f937e02923

SHA256
f3f9e4be2b6429ddf171b0d682ae68918d6fbb8b6ca8b11f256feb24891baabb

SHA512
e17adcdd8c7dc4907cb1207c7caedbd4939751461bd76a55ae9f64845deb32fff7fc031d9d9b58bb4b5f76f5ba7f8e526c8ede693d8bf7372a9204c88a059644

Download Submit
C:\Windows\system\csrsQBg.exe

Filesize
1.4MB

MD5
a9ebcf1f9f79947b3b5b66bcc81a64c0

SHA1
f09876a87430a102a60c20d12faac7a3f0e1a465

SHA256
68609ad4bf0a8070cc5d1880c7af3acfa7c9987faba24614a5a91e0118583e4f

SHA512
351731790c1dcfe820807b4fa4ba8b9c34b0ae1f24383fe2bfb1f54a80484b42a7a5355802490d3b78d4493336b326f2dc1ce276d3b6f1a2586b5fc23d551623

Download Submit
C:\Windows\system\mMxJVxq.exe

Filesize
1.4MB

MD5
3044463064aeca28a08d760b03cc592d

SHA1
ce5195a71ee9e5a715fff61d238bd974e25958ec

SHA256
ec7fc191bc0ea820b9bce23830aac0b9b21cf0d94e76cd6332c9acf2d76fd68a

SHA512
74eb81079393fa47d58d5be5b30e2da428260f521c017eabb31f3cb8dedcaa09d07a8765b942a1db9c06f5dc8a1bb4461c7141391a2ed914f1b035a6d0887aa7

Download Submit
C:\Windows\system\nurXAMF.exe

Filesize
1.4MB

MD5
56b6edaddc48e71ddb42e4a09e4b1335

SHA1
6df70202b6d68dfe0407b3fac6017b989c2e9e09

SHA256
cfac22039626da60058e7262989f8e0f81fa95978be08256280bcb60a8cc7bef

SHA512
708c2a323579889e531a278cf9e1b3b488fc2e046548e3e7b14633d7a51878692cae572726cbb93c0e1fd57510788595a5dff65be51e812a9c7f1e3fa8f9e01f

Download Submit
C:\Windows\system\sjMKCQY.exe

Filesize
1.4MB

MD5
d1e9bb72439fb0c9b6ec467866810c99

SHA1
5d327b6cedf81d6781c36814eae09000037a7aa6

SHA256
570cee219ee05d4c7f1f78bfd8ed32eca18a4e22af8a32aec2a8142edb8b8de6

SHA512
339ca978af21afac06aec5730e6530a5809c1cce33ca55df02c5cff57f9e15fc2b2672e46d22272d381d372fd9afe3e978dddda1b67a5cccdca750803e9a0de6

Download Submit
C:\Windows\system\tZAbrHG.exe

Filesize
1.4MB

MD5
435ce5e671b92a54cd0c4f5026fd86bb

SHA1
b71eb5f5ebf3450bd8b488e13f154027772f2f85

SHA256
1cbf400c31103f58c4fe2b35d565a78492e5f37ed3a305a157c31e36028fcfa7

SHA512
2cc049144166f916e504b53476d8b62b29558d181db94e5892ba21fbfb2311c737de830b2f48ca141f44198a28f3d5c624d0d107e74254080cb04f3be160cfd9

Download Submit
C:\Windows\system\wSTEtDY.exe

Filesize
1.4MB

MD5
e7184622d87ec3ee72c74d9263fb783e

SHA1
3da6438657b8b6d4e5af9819e467f3289a0591e5

SHA256
ffe47852eeb317f2450a942f171084e150923e01a8edf8c14bb11a36415cb3f4

SHA512
45a69063f4a0c83394e12fbf5e178825f219b8d705bec3dc04ac43aa58336fe15b1953fa475613e19e1be201144aac67aff4371f637ea9556daba406fd27f2ba

Download Submit
C:\Windows\system\xWNIHQc.exe

Filesize
1.4MB

MD5
680e9f711e63189c179b82ff419e9508

SHA1
0ea55e1f1c22115d30474761e93bd9133d724d4d

SHA256
9c65e8283e34cc372dc767d39e7684a19985bbee316dd00be2380359cffd8ac8

SHA512
8edb1e8ae2c02da8446b7f69e796d85d4a181fd3559222a9d475465befa98eecdf1413f7a599c73a56502b599b4cb654b2e8de788b6acf210272c74ec78c21f5

Download Submit
C:\Windows\system\xcUXrFB.exe

Filesize
1.4MB

MD5
2b8f9f7c7b090d7f8675d2a628f506ff

SHA1
ab576662d33f89cf380d7412441c374bd2ccb40b

SHA256
e8a7f0340732ad2e5aae9747106e72cf1ac4c53b0ed25277a858cbb78a286dbb

SHA512
d626e423c98860297ed85d57a7bd5322c817c5fe9a10960af6425b496bf6bb1b05b8b17c06577734ecf8e888bea85cae5711e050cae134ca857fa99e38589eab

Download Submit
\Windows\system\WFNiymH.exe

Filesize
1.4MB

MD5
8b058df40e84ee8d424d284533d7cf10

SHA1
0d02d9cb874107184091c90b9b24ba0392e32d9e

SHA256
2fc61c5dd9a7310648fecfaf08977935c5ee4f9297206a5591221ee88509b259

SHA512
c7eccf812aa0c32795a48e5b4250942d9e91202d954c39ed9da6e5f99f121ba916a30c64dc4551d89b6e829e43d68c33f237af67f4468542336617a5079c216f

Download Submit
\Windows\system\dLvQtnG.exe

Filesize
1.4MB

MD5
5191e2368d26c8cb83761ec791b07135

SHA1
5a1a6df6e98cac25b502558dfe58a864da0b418c

SHA256
a1b22d07a68d6d0c087dd1a8530f7b31ee990921cfe2cb2f0b4d4e07f9e4b171

SHA512
d8cebdb1a6f486aa9dc62c3793b0664a3a8957c8f7b8810c453da7b051564b634de64a1e5a5eaa2dca0c6945662b0e456a0156c24bb06474d3f1835065ab6d5d

Download Submit
\Windows\system\kfODglW.exe

Filesize
1.4MB

MD5
3f3d5d435cf154867ab1c7a7f6fbee25

SHA1
91b8e76fb543ba05e4e2f70634150331993cc32e

SHA256
b76bea15249d3798071c08382ea84d2317ebfa425badd2b33784300ec393eae2

SHA512
95d741b6b95d4bfdd1c65f17d9fee2751e3bebe5a1277c2920bd19c2269aa0e80fadd456d7b829499cb01a6bff605a526601efb60af86130034c715028314d1b

Download Submit
\Windows\system\uqsGugB.exe

Filesize
1.4MB

MD5
64fa965e7e1086124283278f5b0baf18

SHA1
3463fcbc890910e16e7869c01e8c91eff1e67247

SHA256
dd606af371f5cb6d6f21dcb8f2973a708713580a5ee16f481a9c73c7136441c8

SHA512
7b9f38fda958a8d5cd7f47d8ddc82741c7c004bdd8e4f55b9f23fa8a54565d3f2fe1b6bc4d36609a78a6a98eeae9818722e7ba121175755590dc42fbadfb71fc

Download Submit
\Windows\system\yiFrsyo.exe

Filesize
1.4MB

MD5
5e356cc53811c2d21268a5bc1bc2a377

SHA1
04ff0b342c900f3e172bc6c6f3bbddee0594810d

SHA256
a8bce4bb1371dd8e392e2c3ae48f1386666093875ae3b723e838c741d2bebd32

SHA512
e60b3b96ae9f4192457fa7e706108c068fffb2956f9724622b20498bcfb1b3e93513ca6220fb5a07bdc41f149b33660e58ea49b846bad04a6a7c6a7ffe193c5d

Download Submit
memory/1140-98-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/1140-3412-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/1140-4030-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/1724-4069-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1724-2083-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1724-74-0x000000013FE80000-0x00000001401D1000-memory.dmp

Filesize
3.3MB

Download
memory/1748-8-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download
memory/1748-81-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download
memory/1748-3916-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download
memory/2012-3964-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2012-22-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2012-94-0x000000013F5C0000-0x000000013F911000-memory.dmp

Filesize
3.3MB

Download
memory/2184-83-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-14-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2184-97-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2184-95-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-6-0x000000013F510000-0x000000013F861000-memory.dmp

Filesize
3.3MB

Download
memory/2184-3623-0x000000013F470000-0x000000013F7C1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-0-0x000000013FFD0000-0x0000000140321000-memory.dmp

Filesize
3.3MB

Download
memory/2184-3410-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-105-0x000000013F470000-0x000000013F7C1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2798-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2184-61-0x000000013FFD0000-0x0000000140321000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2595-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-67-0x000000013F4C0000-0x000000013F811000-memory.dmp

Filesize
3.3MB

Download
memory/2184-55-0x000000013F280000-0x000000013F5D1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-49-0x000000013F110000-0x000000013F461000-memory.dmp

Filesize
3.3MB

Download
memory/2184-40-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2184-2082-0x0000000001D60000-0x00000000020B1000-memory.dmp

Filesize
3.3MB

Download
memory/2184-35-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2364-16-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2364-3915-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2364-82-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2428-3991-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2428-1236-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2428-62-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2520-4021-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2520-2596-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2520-84-0x000000013F860000-0x000000013FBB1000-memory.dmp

Filesize
3.3MB

Download
memory/2552-1735-0x000000013F4C0000-0x000000013F811000-memory.dmp

Filesize
3.3MB

Download
memory/2552-3989-0x000000013F4C0000-0x000000013F811000-memory.dmp

Filesize
3.3MB

Download
memory/2552-68-0x000000013F4C0000-0x000000013F811000-memory.dmp

Filesize
3.3MB

Download
memory/2560-3963-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2560-45-0x000000013FB60000-0x000000013FEB1000-memory.dmp

Filesize
3.3MB

Download
memory/2592-53-0x000000013F470000-0x000000013F7C1000-memory.dmp

Filesize
3.3MB

Download
memory/2592-3970-0x000000013F470000-0x000000013F7C1000-memory.dmp

Filesize
3.3MB

Download
memory/2636-39-0x000000013F110000-0x000000013F461000-memory.dmp

Filesize
3.3MB

Download
memory/2636-96-0x000000013F110000-0x000000013F461000-memory.dmp

Filesize
3.3MB

Download
memory/2636-3973-0x000000013F110000-0x000000013F461000-memory.dmp

Filesize
3.3MB

Download
memory/2652-3962-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2652-52-0x000000013F540000-0x000000013F891000-memory.dmp

Filesize
3.3MB

Download
memory/2748-3969-0x000000013F280000-0x000000013F5D1000-memory.dmp

Filesize
3.3MB

Download
memory/2748-56-0x000000013F280000-0x000000013F5D1000-memory.dmp

Filesize
3.3MB

Download
memory/2932-3216-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2932-90-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2932-4266-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download