xmrig | cc60959140a1c70587aefac000e8194c12854b268324d00c25cb4be20656bb51

Analysis

max time kernel
130s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
Size

1.4MB
MD5

06cfdca80255a91408a6493141bf5b70
SHA1

03d6ccc1fe338bf2e7ff04c0510ace88aaf42e87
SHA256

cc60959140a1c70587aefac000e8194c12854b268324d00c25cb4be20656bb51
SHA512

92156370e3796e67664ee70447577457f45336a052ed5a0712ac4dc74ce286b0b808a1a4e381ecfd355f559a903dba71b4d5d259f7554b052c2583f9db358730
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727f8UhNnwSz7TD0SqKpTIr2ejZvU67NnX1vQnTzaf:ROdWCCi7/rahUUvlhqLr2+W4p

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral1/memory/2700-89-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2816-95-0x000000013F450000-0x000000013F7A1000-memory.dmp	xmrig
behavioral1/memory/2632-97-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	xmrig
behavioral1/memory/2348-96-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2656-91-0x000000013F230000-0x000000013F581000-memory.dmp	xmrig
behavioral1/memory/2540-90-0x000000013F020000-0x000000013F371000-memory.dmp	xmrig
behavioral1/memory/2560-88-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/2276-87-0x000000013F3D0000-0x000000013F721000-memory.dmp	xmrig
behavioral1/memory/1372-77-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2808-75-0x000000013F190000-0x000000013F4E1000-memory.dmp	xmrig
behavioral1/memory/1676-74-0x000000013F890000-0x000000013FBE1000-memory.dmp	xmrig
behavioral1/memory/2444-2828-0x000000013F0F0000-0x000000013F441000-memory.dmp	xmrig
behavioral1/memory/2392-2831-0x000000013F7C0000-0x000000013FB11000-memory.dmp	xmrig
behavioral1/memory/2644-3345-0x000000013F590000-0x000000013F8E1000-memory.dmp	xmrig
behavioral1/memory/2656-3635-0x000000013F230000-0x000000013F581000-memory.dmp	xmrig
behavioral1/memory/1372-3629-0x000000013F2B0000-0x000000013F601000-memory.dmp	xmrig
behavioral1/memory/2816-3628-0x000000013F450000-0x000000013F7A1000-memory.dmp	xmrig
behavioral1/memory/1676-3627-0x000000013F890000-0x000000013FBE1000-memory.dmp	xmrig
behavioral1/memory/2808-3620-0x000000013F190000-0x000000013F4E1000-memory.dmp	xmrig
behavioral1/memory/2632-3644-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	xmrig
behavioral1/memory/2276-3648-0x000000013F3D0000-0x000000013F721000-memory.dmp	xmrig
behavioral1/memory/2348-3650-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	xmrig
behavioral1/memory/2700-3646-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	xmrig
behavioral1/memory/2560-3645-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/2392-3639-0x000000013F7C0000-0x000000013FB11000-memory.dmp	xmrig
behavioral1/memory/2540-3638-0x000000013F020000-0x000000013F371000-memory.dmp	xmrig
behavioral1/memory/2644-3666-0x000000013F590000-0x000000013F8E1000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2392	CZFkynr.exe
1676	CeAtYDM.exe
2808	naCtRrx.exe
1372	mYPpeTo.exe
2276	NIxvtOy.exe
2560	DSisVrv.exe
2700	VZWjLMq.exe
2540	uzhfujj.exe
2656	Vhxmmyh.exe
2816	FrZDBUZ.exe
2348	CeQtpZC.exe
2632	OvJBSld.exe
2644	CNqRYyV.exe
2724	GFAgtfI.exe
2580	gwtJXnp.exe
2604	ktfjHZo.exe
1152	ILUkbln.exe
2864	jWjPUdC.exe
2960	NvnwVnm.exe
2972	rHIamLN.exe
1944	MDUqfeV.exe
1708	vJxNEMz.exe
1632	Ejkrrwr.exe
1828	KiuQkTI.exe
1240	rFjUStn.exe
2504	VhrtdYb.exe
1696	VTbvRok.exe
2908	UjAcWkj.exe
1728	djjSXtf.exe
676	lsQohiz.exe
812	yxRCtls.exe
1480	lAesIhn.exe
572	MgGKIuf.exe
1476	YHNslbB.exe
1520	lEczcEU.exe
1840	yswVRMA.exe
2420	dpRzbkO.exe
1872	jyNuZhd.exe
880	oRJMshL.exe
448	lNDVfHa.exe
2484	DkYJqiJ.exe
2236	MBvTZPc.exe
2324	kcraQJH.exe
1348	NjqWgRx.exe
1376	ekltOIH.exe
2336	uoCCSiW.exe
1084	fiHeBFJ.exe
1332	sJuGIiE.exe
612	vaVncVs.exe
1876	PxAMKng.exe
1892	RYQzklb.exe
1864	XOAxJqr.exe
940	ARGHbga.exe
568	kFfwOYW.exe
3004	BJTgdyd.exe
2188	McRvyGh.exe
2180	VTrJyRF.exe
1832	lLVgqkm.exe
2940	iFHJkKp.exe
1856	MwGsqNs.exe
2948	hxYvDcW.exe
2320	opkaWbZ.exe
1532	xuxvLCh.exe
1048	bnXRRoz.exe

Loads dropped DLL 64 IoCs

pid	Process
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2444-0-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/files/0x000b00000001227c-3.dat	upx
behavioral1/files/0x0039000000013362-28.dat	upx
behavioral1/files/0x000a000000013abd-23.dat	upx
behavioral1/files/0x0006000000014525-33.dat	upx
behavioral1/memory/2700-89-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/memory/2816-95-0x000000013F450000-0x000000013F7A1000-memory.dmp	upx
behavioral1/files/0x00060000000145d4-100.dat	upx
behavioral1/files/0x000600000001474b-59.dat	upx
behavioral1/files/0x00060000000146a7-58.dat	upx
behavioral1/files/0x00060000000145c9-57.dat	upx
behavioral1/files/0x000800000001451d-56.dat	upx
behavioral1/files/0x000600000001475f-55.dat	upx
behavioral1/files/0x0006000000014730-47.dat	upx
behavioral1/memory/2644-98-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx
behavioral1/memory/2632-97-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	upx
behavioral1/memory/2348-96-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/memory/2656-91-0x000000013F230000-0x000000013F581000-memory.dmp	upx
behavioral1/memory/2540-90-0x000000013F020000-0x000000013F371000-memory.dmp	upx
behavioral1/memory/2560-88-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2276-87-0x000000013F3D0000-0x000000013F721000-memory.dmp	upx
behavioral1/memory/1372-77-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/files/0x00060000000148af-76.dat	upx
behavioral1/memory/2808-75-0x000000013F190000-0x000000013F4E1000-memory.dmp	upx
behavioral1/memory/1676-74-0x000000013F890000-0x000000013FBE1000-memory.dmp	upx
behavioral1/files/0x0008000000013a65-70.dat	upx
behavioral1/files/0x00090000000134f5-65.dat	upx
behavioral1/files/0x0008000000013a85-30.dat	upx
behavioral1/files/0x0008000000013a15-29.dat	upx
behavioral1/memory/2392-22-0x000000013F7C0000-0x000000013FB11000-memory.dmp	upx
behavioral1/files/0x0006000000014a29-106.dat	upx
behavioral1/files/0x003900000001340e-110.dat	upx
behavioral1/files/0x0006000000014c0b-118.dat	upx
behavioral1/files/0x0006000000014d0f-119.dat	upx
behavioral1/files/0x0006000000014fac-127.dat	upx
behavioral1/files/0x0006000000015077-128.dat	upx
behavioral1/files/0x00060000000150aa-136.dat	upx
behavioral1/files/0x000600000001523e-140.dat	upx
behavioral1/files/0x000600000001543a-144.dat	upx
behavioral1/files/0x0006000000015a15-152.dat	upx
behavioral1/files/0x0006000000015b37-156.dat	upx
behavioral1/files/0x0006000000015c9b-172.dat	upx
behavioral1/files/0x0006000000015c91-168.dat	upx
behavioral1/files/0x0006000000015bb5-164.dat	upx
behavioral1/files/0x0006000000015b72-160.dat	upx
behavioral1/files/0x00060000000155e8-148.dat	upx
behavioral1/memory/2444-2828-0x000000013F0F0000-0x000000013F441000-memory.dmp	upx
behavioral1/memory/2392-2831-0x000000013F7C0000-0x000000013FB11000-memory.dmp	upx
behavioral1/memory/2644-3345-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx
behavioral1/memory/2656-3635-0x000000013F230000-0x000000013F581000-memory.dmp	upx
behavioral1/memory/1372-3629-0x000000013F2B0000-0x000000013F601000-memory.dmp	upx
behavioral1/memory/2816-3628-0x000000013F450000-0x000000013F7A1000-memory.dmp	upx
behavioral1/memory/1676-3627-0x000000013F890000-0x000000013FBE1000-memory.dmp	upx
behavioral1/memory/2808-3620-0x000000013F190000-0x000000013F4E1000-memory.dmp	upx
behavioral1/memory/2632-3644-0x000000013F6A0000-0x000000013F9F1000-memory.dmp	upx
behavioral1/memory/2276-3648-0x000000013F3D0000-0x000000013F721000-memory.dmp	upx
behavioral1/memory/2348-3650-0x000000013F2A0000-0x000000013F5F1000-memory.dmp	upx
behavioral1/memory/2700-3646-0x000000013F8A0000-0x000000013FBF1000-memory.dmp	upx
behavioral1/memory/2560-3645-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2392-3639-0x000000013F7C0000-0x000000013FB11000-memory.dmp	upx
behavioral1/memory/2540-3638-0x000000013F020000-0x000000013F371000-memory.dmp	upx
behavioral1/memory/2644-3666-0x000000013F590000-0x000000013F8E1000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JJZkybE.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\qASqGWf.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\olbIeWm.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\nspcpnR.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\bRsJUFs.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\CgdPSDM.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZsHtLaC.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\rhvPgey.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\apbUyaA.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\JAyaeQF.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\kQbJoAm.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\DZwrMuy.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\EeTOrfW.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZMlVmck.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\Osycjet.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZUFrbEI.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\nzUANTq.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\pVEpMyz.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\Gexabua.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\NeERFFm.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\xgWDvpM.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\fjZeZEG.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\BwcJFlJ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\iXPgBle.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\BujncRd.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\mryzdXj.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZCHFlTW.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\cfkubiM.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\xmlExVh.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\RoqzUCj.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\kJkWOgy.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\gOtQFLK.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\SaYIOOA.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\dCfyxfz.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\njlaFhK.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\rDsZbsK.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\NSMLrLJ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\wcSGQhR.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sDoADYG.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\whPQLgb.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\VYnSNfh.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\lEczcEU.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\LDjklPv.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\UjvSFUZ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\juKucoj.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sriHNXH.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\fNMBQLQ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\HPJNZWC.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\imgyYtZ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\DSisVrv.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sEKOomz.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\rbgdllk.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\kadXaEJ.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\EFpMXjO.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\ZchTyZk.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\vDCGKYn.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\uwgKqBv.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\sDGXTaC.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\bWGklQr.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\UusIxRw.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\mJHqxmb.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\rNMcQAg.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\fExzJUm.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
File created	C:\Windows\System\MBvTZPc.exe	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2392	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2392	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 2392	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	29
PID 2444 wrote to memory of 1676	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	30
PID 2444 wrote to memory of 1676	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	30
PID 2444 wrote to memory of 1676	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	30
PID 2444 wrote to memory of 2656	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	31
PID 2444 wrote to memory of 2656	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	31
PID 2444 wrote to memory of 2656	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	31
PID 2444 wrote to memory of 2808	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	32
PID 2444 wrote to memory of 2808	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	32
PID 2444 wrote to memory of 2808	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	32
PID 2444 wrote to memory of 2816	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	33
PID 2444 wrote to memory of 2816	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	33
PID 2444 wrote to memory of 2816	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	33
PID 2444 wrote to memory of 1372	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	34
PID 2444 wrote to memory of 1372	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	34
PID 2444 wrote to memory of 1372	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	34
PID 2444 wrote to memory of 2632	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	35
PID 2444 wrote to memory of 2632	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	35
PID 2444 wrote to memory of 2632	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	35
PID 2444 wrote to memory of 2276	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	36
PID 2444 wrote to memory of 2276	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	36
PID 2444 wrote to memory of 2276	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	36
PID 2444 wrote to memory of 2644	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	37
PID 2444 wrote to memory of 2644	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	37
PID 2444 wrote to memory of 2644	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	37
PID 2444 wrote to memory of 2560	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	38
PID 2444 wrote to memory of 2560	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	38
PID 2444 wrote to memory of 2560	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	38
PID 2444 wrote to memory of 2724	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	39
PID 2444 wrote to memory of 2724	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	39
PID 2444 wrote to memory of 2724	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	39
PID 2444 wrote to memory of 2700	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	40
PID 2444 wrote to memory of 2700	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	40
PID 2444 wrote to memory of 2700	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	40
PID 2444 wrote to memory of 2580	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	41
PID 2444 wrote to memory of 2580	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	41
PID 2444 wrote to memory of 2580	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	41
PID 2444 wrote to memory of 2540	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	42
PID 2444 wrote to memory of 2540	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	42
PID 2444 wrote to memory of 2540	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	42
PID 2444 wrote to memory of 2604	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	43
PID 2444 wrote to memory of 2604	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	43
PID 2444 wrote to memory of 2604	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	43
PID 2444 wrote to memory of 2348	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	44
PID 2444 wrote to memory of 2348	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	44
PID 2444 wrote to memory of 2348	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	44
PID 2444 wrote to memory of 1152	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	45
PID 2444 wrote to memory of 1152	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	45
PID 2444 wrote to memory of 1152	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	45
PID 2444 wrote to memory of 2864	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	46
PID 2444 wrote to memory of 2864	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	46
PID 2444 wrote to memory of 2864	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	46
PID 2444 wrote to memory of 2960	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	47
PID 2444 wrote to memory of 2960	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	47
PID 2444 wrote to memory of 2960	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	47
PID 2444 wrote to memory of 2972	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	48
PID 2444 wrote to memory of 2972	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	48
PID 2444 wrote to memory of 2972	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	48
PID 2444 wrote to memory of 1944	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	49
PID 2444 wrote to memory of 1944	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	49
PID 2444 wrote to memory of 1944	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	49
PID 2444 wrote to memory of 1708	2444	06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06cfdca80255a91408a6493141bf5b70_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\System\CZFkynr.exe
  C:\Windows\System\CZFkynr.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\CeAtYDM.exe
  C:\Windows\System\CeAtYDM.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\Vhxmmyh.exe
  C:\Windows\System\Vhxmmyh.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\naCtRrx.exe
  C:\Windows\System\naCtRrx.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\FrZDBUZ.exe
  C:\Windows\System\FrZDBUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\mYPpeTo.exe
  C:\Windows\System\mYPpeTo.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\OvJBSld.exe
  C:\Windows\System\OvJBSld.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\NIxvtOy.exe
  C:\Windows\System\NIxvtOy.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\CNqRYyV.exe
  C:\Windows\System\CNqRYyV.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\DSisVrv.exe
  C:\Windows\System\DSisVrv.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\GFAgtfI.exe
  C:\Windows\System\GFAgtfI.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\VZWjLMq.exe
  C:\Windows\System\VZWjLMq.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\gwtJXnp.exe
  C:\Windows\System\gwtJXnp.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\uzhfujj.exe
  C:\Windows\System\uzhfujj.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\ktfjHZo.exe
  C:\Windows\System\ktfjHZo.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\CeQtpZC.exe
  C:\Windows\System\CeQtpZC.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\ILUkbln.exe
  C:\Windows\System\ILUkbln.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\jWjPUdC.exe
  C:\Windows\System\jWjPUdC.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\NvnwVnm.exe
  C:\Windows\System\NvnwVnm.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\rHIamLN.exe
  C:\Windows\System\rHIamLN.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\MDUqfeV.exe
  C:\Windows\System\MDUqfeV.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\vJxNEMz.exe
  C:\Windows\System\vJxNEMz.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\Ejkrrwr.exe
  C:\Windows\System\Ejkrrwr.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\KiuQkTI.exe
  C:\Windows\System\KiuQkTI.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\rFjUStn.exe
  C:\Windows\System\rFjUStn.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\VhrtdYb.exe
  C:\Windows\System\VhrtdYb.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\VTbvRok.exe
  C:\Windows\System\VTbvRok.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\UjAcWkj.exe
  C:\Windows\System\UjAcWkj.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\djjSXtf.exe
  C:\Windows\System\djjSXtf.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\lsQohiz.exe
  C:\Windows\System\lsQohiz.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\yxRCtls.exe
  C:\Windows\System\yxRCtls.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\lAesIhn.exe
  C:\Windows\System\lAesIhn.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\MgGKIuf.exe
  C:\Windows\System\MgGKIuf.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\YHNslbB.exe
  C:\Windows\System\YHNslbB.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\lEczcEU.exe
  C:\Windows\System\lEczcEU.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\yswVRMA.exe
  C:\Windows\System\yswVRMA.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\dpRzbkO.exe
  C:\Windows\System\dpRzbkO.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\jyNuZhd.exe
  C:\Windows\System\jyNuZhd.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\oRJMshL.exe
  C:\Windows\System\oRJMshL.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\lNDVfHa.exe
  C:\Windows\System\lNDVfHa.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\DkYJqiJ.exe
  C:\Windows\System\DkYJqiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\MBvTZPc.exe
  C:\Windows\System\MBvTZPc.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\kcraQJH.exe
  C:\Windows\System\kcraQJH.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\NjqWgRx.exe
  C:\Windows\System\NjqWgRx.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ekltOIH.exe
  C:\Windows\System\ekltOIH.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\uoCCSiW.exe
  C:\Windows\System\uoCCSiW.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\fiHeBFJ.exe
  C:\Windows\System\fiHeBFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\sJuGIiE.exe
  C:\Windows\System\sJuGIiE.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\vaVncVs.exe
  C:\Windows\System\vaVncVs.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\PxAMKng.exe
  C:\Windows\System\PxAMKng.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\RYQzklb.exe
  C:\Windows\System\RYQzklb.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\XOAxJqr.exe
  C:\Windows\System\XOAxJqr.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\ARGHbga.exe
  C:\Windows\System\ARGHbga.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\kFfwOYW.exe
  C:\Windows\System\kFfwOYW.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\BJTgdyd.exe
  C:\Windows\System\BJTgdyd.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\McRvyGh.exe
  C:\Windows\System\McRvyGh.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\VTrJyRF.exe
  C:\Windows\System\VTrJyRF.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\lLVgqkm.exe
  C:\Windows\System\lLVgqkm.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\iFHJkKp.exe
  C:\Windows\System\iFHJkKp.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\MwGsqNs.exe
  C:\Windows\System\MwGsqNs.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\hxYvDcW.exe
  C:\Windows\System\hxYvDcW.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\opkaWbZ.exe
  C:\Windows\System\opkaWbZ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\xuxvLCh.exe
  C:\Windows\System\xuxvLCh.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\bnXRRoz.exe
  C:\Windows\System\bnXRRoz.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\EHBMwsO.exe
  C:\Windows\System\EHBMwsO.exe
  2⤵
  PID:2308
- C:\Windows\System\YHgGhsS.exe
  C:\Windows\System\YHgGhsS.exe
  2⤵
  PID:1600
- C:\Windows\System\jCSPcFy.exe
  C:\Windows\System\jCSPcFy.exe
  2⤵
  PID:1716
- C:\Windows\System\nQxmXMz.exe
  C:\Windows\System\nQxmXMz.exe
  2⤵
  PID:2304
- C:\Windows\System\uZTavMD.exe
  C:\Windows\System\uZTavMD.exe
  2⤵
  PID:2872
- C:\Windows\System\VvBQKPq.exe
  C:\Windows\System\VvBQKPq.exe
  2⤵
  PID:1416
- C:\Windows\System\mLaKGLT.exe
  C:\Windows\System\mLaKGLT.exe
  2⤵
  PID:2884
- C:\Windows\System\JgptYvQ.exe
  C:\Windows\System\JgptYvQ.exe
  2⤵
  PID:1896
- C:\Windows\System\qtSUeqt.exe
  C:\Windows\System\qtSUeqt.exe
  2⤵
  PID:2944
- C:\Windows\System\VfYfkJO.exe
  C:\Windows\System\VfYfkJO.exe
  2⤵
  PID:2688
- C:\Windows\System\mJXufbE.exe
  C:\Windows\System\mJXufbE.exe
  2⤵
  PID:2692
- C:\Windows\System\RlIqqAa.exe
  C:\Windows\System\RlIqqAa.exe
  2⤵
  PID:2448
- C:\Windows\System\CUABXnU.exe
  C:\Windows\System\CUABXnU.exe
  2⤵
  PID:1964
- C:\Windows\System\xPGoxBZ.exe
  C:\Windows\System\xPGoxBZ.exe
  2⤵
  PID:2708
- C:\Windows\System\QKXdMay.exe
  C:\Windows\System\QKXdMay.exe
  2⤵
  PID:2988
- C:\Windows\System\RANzGpp.exe
  C:\Windows\System\RANzGpp.exe
  2⤵
  PID:2228
- C:\Windows\System\VHXGUay.exe
  C:\Windows\System\VHXGUay.exe
  2⤵
  PID:1148
- C:\Windows\System\IQztAEg.exe
  C:\Windows\System\IQztAEg.exe
  2⤵
  PID:2616
- C:\Windows\System\FyKDsDi.exe
  C:\Windows\System\FyKDsDi.exe
  2⤵
  PID:316
- C:\Windows\System\TkZfcmi.exe
  C:\Windows\System\TkZfcmi.exe
  2⤵
  PID:1928
- C:\Windows\System\bfEkCwf.exe
  C:\Windows\System\bfEkCwf.exe
  2⤵
  PID:1624
- C:\Windows\System\kpWanwN.exe
  C:\Windows\System\kpWanwN.exe
  2⤵
  PID:2328
- C:\Windows\System\cpSjaYu.exe
  C:\Windows\System\cpSjaYu.exe
  2⤵
  PID:1900
- C:\Windows\System\YCveKDb.exe
  C:\Windows\System\YCveKDb.exe
  2⤵
  PID:1216
- C:\Windows\System\vkwqkjI.exe
  C:\Windows\System\vkwqkjI.exe
  2⤵
  PID:972
- C:\Windows\System\mzNlQhX.exe
  C:\Windows\System\mzNlQhX.exe
  2⤵
  PID:1648
- C:\Windows\System\JHXniLR.exe
  C:\Windows\System\JHXniLR.exe
  2⤵
  PID:1812
- C:\Windows\System\HSeCdCZ.exe
  C:\Windows\System\HSeCdCZ.exe
  2⤵
  PID:640
- C:\Windows\System\FnFBzjq.exe
  C:\Windows\System\FnFBzjq.exe
  2⤵
  PID:2416
- C:\Windows\System\rvFzbBB.exe
  C:\Windows\System\rvFzbBB.exe
  2⤵
  PID:2384
- C:\Windows\System\ATENhaJ.exe
  C:\Windows\System\ATENhaJ.exe
  2⤵
  PID:2748
- C:\Windows\System\Osycjet.exe
  C:\Windows\System\Osycjet.exe
  2⤵
  PID:1800
- C:\Windows\System\xnbomJs.exe
  C:\Windows\System\xnbomJs.exe
  2⤵
  PID:1092
- C:\Windows\System\ZvTkajy.exe
  C:\Windows\System\ZvTkajy.exe
  2⤵
  PID:2396
- C:\Windows\System\vbHziic.exe
  C:\Windows\System\vbHziic.exe
  2⤵
  PID:2488
- C:\Windows\System\tzBgDLE.exe
  C:\Windows\System\tzBgDLE.exe
  2⤵
  PID:2468
- C:\Windows\System\TfnDvVJ.exe
  C:\Windows\System\TfnDvVJ.exe
  2⤵
  PID:1772
- C:\Windows\System\xlTPQvV.exe
  C:\Windows\System\xlTPQvV.exe
  2⤵
  PID:1924
- C:\Windows\System\dNxwgsK.exe
  C:\Windows\System\dNxwgsK.exe
  2⤵
  PID:1512
- C:\Windows\System\FsluGrk.exe
  C:\Windows\System\FsluGrk.exe
  2⤵
  PID:2116
- C:\Windows\System\EEAztDl.exe
  C:\Windows\System\EEAztDl.exe
  2⤵
  PID:2852
- C:\Windows\System\cWMzGWM.exe
  C:\Windows\System\cWMzGWM.exe
  2⤵
  PID:1604
- C:\Windows\System\JAOpAtz.exe
  C:\Windows\System\JAOpAtz.exe
  2⤵
  PID:2912
- C:\Windows\System\VqHJlZl.exe
  C:\Windows\System\VqHJlZl.exe
  2⤵
  PID:1940
- C:\Windows\System\LeuvPbZ.exe
  C:\Windows\System\LeuvPbZ.exe
  2⤵
  PID:2712
- C:\Windows\System\njFrWxA.exe
  C:\Windows\System\njFrWxA.exe
  2⤵
  PID:1304
- C:\Windows\System\FITaerc.exe
  C:\Windows\System\FITaerc.exe
  2⤵
  PID:2792
- C:\Windows\System\xDDIMKX.exe
  C:\Windows\System\xDDIMKX.exe
  2⤵
  PID:760
- C:\Windows\System\GjyDMcl.exe
  C:\Windows\System\GjyDMcl.exe
  2⤵
  PID:1732
- C:\Windows\System\XIzQOui.exe
  C:\Windows\System\XIzQOui.exe
  2⤵
  PID:2664
- C:\Windows\System\AoZRzIO.exe
  C:\Windows\System\AoZRzIO.exe
  2⤵
  PID:3064
- C:\Windows\System\CtiUXUh.exe
  C:\Windows\System\CtiUXUh.exe
  2⤵
  PID:2520
- C:\Windows\System\MtjiZmc.exe
  C:\Windows\System\MtjiZmc.exe
  2⤵
  PID:2800
- C:\Windows\System\LjZSnWW.exe
  C:\Windows\System\LjZSnWW.exe
  2⤵
  PID:1912
- C:\Windows\System\AXIPFBA.exe
  C:\Windows\System\AXIPFBA.exe
  2⤵
  PID:3020
- C:\Windows\System\CXXQtJD.exe
  C:\Windows\System\CXXQtJD.exe
  2⤵
  PID:2280
- C:\Windows\System\ANbiOXJ.exe
  C:\Windows\System\ANbiOXJ.exe
  2⤵
  PID:696
- C:\Windows\System\MtbNcTv.exe
  C:\Windows\System\MtbNcTv.exe
  2⤵
  PID:2980
- C:\Windows\System\PerZYOD.exe
  C:\Windows\System\PerZYOD.exe
  2⤵
  PID:1424
- C:\Windows\System\zhSuDyB.exe
  C:\Windows\System\zhSuDyB.exe
  2⤵
  PID:2060
- C:\Windows\System\hTAJPGF.exe
  C:\Windows\System\hTAJPGF.exe
  2⤵
  PID:856
- C:\Windows\System\rfwZWSc.exe
  C:\Windows\System\rfwZWSc.exe
  2⤵
  PID:1868
- C:\Windows\System\pxlkOwd.exe
  C:\Windows\System\pxlkOwd.exe
  2⤵
  PID:2292
- C:\Windows\System\KkfOLSe.exe
  C:\Windows\System\KkfOLSe.exe
  2⤵
  PID:2492
- C:\Windows\System\uvrYCRN.exe
  C:\Windows\System\uvrYCRN.exe
  2⤵
  PID:2968
- C:\Windows\System\whddeEq.exe
  C:\Windows\System\whddeEq.exe
  2⤵
  PID:1692
- C:\Windows\System\dfiuOqt.exe
  C:\Windows\System\dfiuOqt.exe
  2⤵
  PID:1804
- C:\Windows\System\wcSGQhR.exe
  C:\Windows\System\wcSGQhR.exe
  2⤵
  PID:2244
- C:\Windows\System\xyFeRGa.exe
  C:\Windows\System\xyFeRGa.exe
  2⤵
  PID:2160
- C:\Windows\System\tIoOAHz.exe
  C:\Windows\System\tIoOAHz.exe
  2⤵
  PID:2288
- C:\Windows\System\nutaEGW.exe
  C:\Windows\System\nutaEGW.exe
  2⤵
  PID:1608
- C:\Windows\System\QUFUFGM.exe
  C:\Windows\System\QUFUFGM.exe
  2⤵
  PID:840
- C:\Windows\System\nEolbfw.exe
  C:\Windows\System\nEolbfw.exe
  2⤵
  PID:876
- C:\Windows\System\idVoYFr.exe
  C:\Windows\System\idVoYFr.exe
  2⤵
  PID:2464
- C:\Windows\System\dNeftEF.exe
  C:\Windows\System\dNeftEF.exe
  2⤵
  PID:772
- C:\Windows\System\iXPgBle.exe
  C:\Windows\System\iXPgBle.exe
  2⤵
  PID:2360
- C:\Windows\System\SAidUdp.exe
  C:\Windows\System\SAidUdp.exe
  2⤵
  PID:2652
- C:\Windows\System\WhgYukm.exe
  C:\Windows\System\WhgYukm.exe
  2⤵
  PID:2556
- C:\Windows\System\pVEpMyz.exe
  C:\Windows\System\pVEpMyz.exe
  2⤵
  PID:576
- C:\Windows\System\DVxBsqu.exe
  C:\Windows\System\DVxBsqu.exe
  2⤵
  PID:1412
- C:\Windows\System\iBwbQnB.exe
  C:\Windows\System\iBwbQnB.exe
  2⤵
  PID:2588
- C:\Windows\System\LmPMFqg.exe
  C:\Windows\System\LmPMFqg.exe
  2⤵
  PID:3012
- C:\Windows\System\PsFkfMc.exe
  C:\Windows\System\PsFkfMc.exe
  2⤵
  PID:2080
- C:\Windows\System\QYnfmmR.exe
  C:\Windows\System\QYnfmmR.exe
  2⤵
  PID:1292
- C:\Windows\System\owdzjgC.exe
  C:\Windows\System\owdzjgC.exe
  2⤵
  PID:2628
- C:\Windows\System\KrQGEsz.exe
  C:\Windows\System\KrQGEsz.exe
  2⤵
  PID:1688
- C:\Windows\System\PzFOzXC.exe
  C:\Windows\System\PzFOzXC.exe
  2⤵
  PID:2456
- C:\Windows\System\RWXiJVL.exe
  C:\Windows\System\RWXiJVL.exe
  2⤵
  PID:2096
- C:\Windows\System\GJbSpht.exe
  C:\Windows\System\GJbSpht.exe
  2⤵
  PID:944
- C:\Windows\System\rJnfcpu.exe
  C:\Windows\System\rJnfcpu.exe
  2⤵
  PID:280
- C:\Windows\System\wgPURUQ.exe
  C:\Windows\System\wgPURUQ.exe
  2⤵
  PID:748
- C:\Windows\System\yiKYbDa.exe
  C:\Windows\System\yiKYbDa.exe
  2⤵
  PID:2620
- C:\Windows\System\YXceLDM.exe
  C:\Windows\System\YXceLDM.exe
  2⤵
  PID:2408
- C:\Windows\System\fbgOdhk.exe
  C:\Windows\System\fbgOdhk.exe
  2⤵
  PID:2240
- C:\Windows\System\vcpYoqO.exe
  C:\Windows\System\vcpYoqO.exe
  2⤵
  PID:2192
- C:\Windows\System\mFFioOZ.exe
  C:\Windows\System\mFFioOZ.exe
  2⤵
  PID:2640
- C:\Windows\System\WMtUTld.exe
  C:\Windows\System\WMtUTld.exe
  2⤵
  PID:1848
- C:\Windows\System\tjRtMSR.exe
  C:\Windows\System\tjRtMSR.exe
  2⤵
  PID:2344
- C:\Windows\System\gBVchzm.exe
  C:\Windows\System\gBVchzm.exe
  2⤵
  PID:552
- C:\Windows\System\VxbaXCU.exe
  C:\Windows\System\VxbaXCU.exe
  2⤵
  PID:2552
- C:\Windows\System\AkAQIoe.exe
  C:\Windows\System\AkAQIoe.exe
  2⤵
  PID:2860
- C:\Windows\System\mnfDilt.exe
  C:\Windows\System\mnfDilt.exe
  2⤵
  PID:1236
- C:\Windows\System\BHHAQPU.exe
  C:\Windows\System\BHHAQPU.exe
  2⤵
  PID:3016
- C:\Windows\System\eynLjRL.exe
  C:\Windows\System\eynLjRL.exe
  2⤵
  PID:3080
- C:\Windows\System\FeJVoEk.exe
  C:\Windows\System\FeJVoEk.exe
  2⤵
  PID:3164
- C:\Windows\System\ycFwInW.exe
  C:\Windows\System\ycFwInW.exe
  2⤵
  PID:3180
- C:\Windows\System\JAIyYoG.exe
  C:\Windows\System\JAIyYoG.exe
  2⤵
  PID:3196
- C:\Windows\System\GDEjxux.exe
  C:\Windows\System\GDEjxux.exe
  2⤵
  PID:3220
- C:\Windows\System\HcSGMgN.exe
  C:\Windows\System\HcSGMgN.exe
  2⤵
  PID:3240
- C:\Windows\System\jJjGdcd.exe
  C:\Windows\System\jJjGdcd.exe
  2⤵
  PID:3260
- C:\Windows\System\oMxUVqb.exe
  C:\Windows\System\oMxUVqb.exe
  2⤵
  PID:3280
- C:\Windows\System\YAfvARd.exe
  C:\Windows\System\YAfvARd.exe
  2⤵
  PID:3300
- C:\Windows\System\FlMJLnq.exe
  C:\Windows\System\FlMJLnq.exe
  2⤵
  PID:3324
- C:\Windows\System\mMVCTCB.exe
  C:\Windows\System\mMVCTCB.exe
  2⤵
  PID:3340
- C:\Windows\System\ZVpVrAO.exe
  C:\Windows\System\ZVpVrAO.exe
  2⤵
  PID:3364
- C:\Windows\System\qyplAVH.exe
  C:\Windows\System\qyplAVH.exe
  2⤵
  PID:3380
- C:\Windows\System\fazGMHA.exe
  C:\Windows\System\fazGMHA.exe
  2⤵
  PID:3404
- C:\Windows\System\DiEQAwB.exe
  C:\Windows\System\DiEQAwB.exe
  2⤵
  PID:3420
- C:\Windows\System\pHqGUtj.exe
  C:\Windows\System\pHqGUtj.exe
  2⤵
  PID:3436
- C:\Windows\System\yZdeMiG.exe
  C:\Windows\System\yZdeMiG.exe
  2⤵
  PID:3452
- C:\Windows\System\wlMyQRS.exe
  C:\Windows\System\wlMyQRS.exe
  2⤵
  PID:3468
- C:\Windows\System\qcRIiEm.exe
  C:\Windows\System\qcRIiEm.exe
  2⤵
  PID:3484
- C:\Windows\System\XfHjRgi.exe
  C:\Windows\System\XfHjRgi.exe
  2⤵
  PID:3520
- C:\Windows\System\XpozyMW.exe
  C:\Windows\System\XpozyMW.exe
  2⤵
  PID:3536
- C:\Windows\System\PxRUbdp.exe
  C:\Windows\System\PxRUbdp.exe
  2⤵
  PID:3552
- C:\Windows\System\rPxrECu.exe
  C:\Windows\System\rPxrECu.exe
  2⤵
  PID:3572
- C:\Windows\System\yPvAArb.exe
  C:\Windows\System\yPvAArb.exe
  2⤵
  PID:3588
- C:\Windows\System\CVGlNOv.exe
  C:\Windows\System\CVGlNOv.exe
  2⤵
  PID:3608
- C:\Windows\System\Wtamtbj.exe
  C:\Windows\System\Wtamtbj.exe
  2⤵
  PID:3632
- C:\Windows\System\sHJBIJn.exe
  C:\Windows\System\sHJBIJn.exe
  2⤵
  PID:3648
- C:\Windows\System\tXXqhlG.exe
  C:\Windows\System\tXXqhlG.exe
  2⤵
  PID:3664
- C:\Windows\System\Gexabua.exe
  C:\Windows\System\Gexabua.exe
  2⤵
  PID:3684
- C:\Windows\System\QoKYbnI.exe
  C:\Windows\System\QoKYbnI.exe
  2⤵
  PID:3700
- C:\Windows\System\FzQIizF.exe
  C:\Windows\System\FzQIizF.exe
  2⤵
  PID:3716
- C:\Windows\System\gTmFYtE.exe
  C:\Windows\System\gTmFYtE.exe
  2⤵
  PID:3732
- C:\Windows\System\IxdwREa.exe
  C:\Windows\System\IxdwREa.exe
  2⤵
  PID:3752
- C:\Windows\System\IpsOzEk.exe
  C:\Windows\System\IpsOzEk.exe
  2⤵
  PID:3768
- C:\Windows\System\BGJtcgZ.exe
  C:\Windows\System\BGJtcgZ.exe
  2⤵
  PID:3784
- C:\Windows\System\SNgcUMQ.exe
  C:\Windows\System\SNgcUMQ.exe
  2⤵
  PID:3800
- C:\Windows\System\LHnaGJK.exe
  C:\Windows\System\LHnaGJK.exe
  2⤵
  PID:3820
- C:\Windows\System\ZchTyZk.exe
  C:\Windows\System\ZchTyZk.exe
  2⤵
  PID:3836
- C:\Windows\System\DmkDyDH.exe
  C:\Windows\System\DmkDyDH.exe
  2⤵
  PID:3852
- C:\Windows\System\WiPtPnA.exe
  C:\Windows\System\WiPtPnA.exe
  2⤵
  PID:3916
- C:\Windows\System\EvVtHGw.exe
  C:\Windows\System\EvVtHGw.exe
  2⤵
  PID:3932
- C:\Windows\System\PNjHmgI.exe
  C:\Windows\System\PNjHmgI.exe
  2⤵
  PID:3948
- C:\Windows\System\ZAfMGqi.exe
  C:\Windows\System\ZAfMGqi.exe
  2⤵
  PID:3964
- C:\Windows\System\zvbmwgn.exe
  C:\Windows\System\zvbmwgn.exe
  2⤵
  PID:3988
- C:\Windows\System\SuACqNd.exe
  C:\Windows\System\SuACqNd.exe
  2⤵
  PID:4004
- C:\Windows\System\ANNMMZC.exe
  C:\Windows\System\ANNMMZC.exe
  2⤵
  PID:4020
- C:\Windows\System\gcYpIwU.exe
  C:\Windows\System\gcYpIwU.exe
  2⤵
  PID:4036
- C:\Windows\System\ceOYnTt.exe
  C:\Windows\System\ceOYnTt.exe
  2⤵
  PID:4056
- C:\Windows\System\RLiWZkZ.exe
  C:\Windows\System\RLiWZkZ.exe
  2⤵
  PID:4072
- C:\Windows\System\jRXCsvd.exe
  C:\Windows\System\jRXCsvd.exe
  2⤵
  PID:4088
- C:\Windows\System\GkFKBXh.exe
  C:\Windows\System\GkFKBXh.exe
  2⤵
  PID:352
- C:\Windows\System\FVTzgHx.exe
  C:\Windows\System\FVTzgHx.exe
  2⤵
  PID:2208
- C:\Windows\System\WZTUAtb.exe
  C:\Windows\System\WZTUAtb.exe
  2⤵
  PID:1836
- C:\Windows\System\ljSsUKL.exe
  C:\Windows\System\ljSsUKL.exe
  2⤵
  PID:2480
- C:\Windows\System\nuQMoRK.exe
  C:\Windows\System\nuQMoRK.exe
  2⤵
  PID:2052
- C:\Windows\System\SbrZBbf.exe
  C:\Windows\System\SbrZBbf.exe
  2⤵
  PID:3088
- C:\Windows\System\wuwNUrz.exe
  C:\Windows\System\wuwNUrz.exe
  2⤵
  PID:3108
- C:\Windows\System\fbBMucx.exe
  C:\Windows\System\fbBMucx.exe
  2⤵
  PID:3116
- C:\Windows\System\cuzQeWp.exe
  C:\Windows\System\cuzQeWp.exe
  2⤵
  PID:2856
- C:\Windows\System\PsvOIpG.exe
  C:\Windows\System\PsvOIpG.exe
  2⤵
  PID:988
- C:\Windows\System\tQqWRRU.exe
  C:\Windows\System\tQqWRRU.exe
  2⤵
  PID:2524
- C:\Windows\System\ISVaFmg.exe
  C:\Windows\System\ISVaFmg.exe
  2⤵
  PID:3128
- C:\Windows\System\hbEuHLc.exe
  C:\Windows\System\hbEuHLc.exe
  2⤵
  PID:3144
- C:\Windows\System\zCKnhpO.exe
  C:\Windows\System\zCKnhpO.exe
  2⤵
  PID:3160
- C:\Windows\System\qdAeUJn.exe
  C:\Windows\System\qdAeUJn.exe
  2⤵
  PID:3188
- C:\Windows\System\qWjZRBb.exe
  C:\Windows\System\qWjZRBb.exe
  2⤵
  PID:3212
- C:\Windows\System\GFVHLrp.exe
  C:\Windows\System\GFVHLrp.exe
  2⤵
  PID:3248
- C:\Windows\System\ogPARBm.exe
  C:\Windows\System\ogPARBm.exe
  2⤵
  PID:3276
- C:\Windows\System\PLcQfKh.exe
  C:\Windows\System\PLcQfKh.exe
  2⤵
  PID:3292
- C:\Windows\System\JmSPijn.exe
  C:\Windows\System\JmSPijn.exe
  2⤵
  PID:3312
- C:\Windows\System\NkqpzCK.exe
  C:\Windows\System\NkqpzCK.exe
  2⤵
  PID:3360
- C:\Windows\System\XDdqHZx.exe
  C:\Windows\System\XDdqHZx.exe
  2⤵
  PID:3528
- C:\Windows\System\qinrNeQ.exe
  C:\Windows\System\qinrNeQ.exe
  2⤵
  PID:3568
- C:\Windows\System\VWnHZSe.exe
  C:\Windows\System\VWnHZSe.exe
  2⤵
  PID:3580
- C:\Windows\System\rcmspxd.exe
  C:\Windows\System\rcmspxd.exe
  2⤵
  PID:3624
- C:\Windows\System\duxlIno.exe
  C:\Windows\System\duxlIno.exe
  2⤵
  PID:3660
- C:\Windows\System\msWGnGY.exe
  C:\Windows\System\msWGnGY.exe
  2⤵
  PID:3696
- C:\Windows\System\EjXDXih.exe
  C:\Windows\System\EjXDXih.exe
  2⤵
  PID:3676
- C:\Windows\System\YQRdLSY.exe
  C:\Windows\System\YQRdLSY.exe
  2⤵
  PID:3740
- C:\Windows\System\NWJEGZG.exe
  C:\Windows\System\NWJEGZG.exe
  2⤵
  PID:3860
- C:\Windows\System\ZofBhFH.exe
  C:\Windows\System\ZofBhFH.exe
  2⤵
  PID:3832
- C:\Windows\System\tsnxZrq.exe
  C:\Windows\System\tsnxZrq.exe
  2⤵
  PID:3880
- C:\Windows\System\mryzdXj.exe
  C:\Windows\System\mryzdXj.exe
  2⤵
  PID:3896
- C:\Windows\System\toKCyhE.exe
  C:\Windows\System\toKCyhE.exe
  2⤵
  PID:3912
- C:\Windows\System\crkDUST.exe
  C:\Windows\System\crkDUST.exe
  2⤵
  PID:3940
- C:\Windows\System\YXxhcGP.exe
  C:\Windows\System\YXxhcGP.exe
  2⤵
  PID:3928
- C:\Windows\System\kFthtqr.exe
  C:\Windows\System\kFthtqr.exe
  2⤵
  PID:3808
- C:\Windows\System\cjqvYCK.exe
  C:\Windows\System\cjqvYCK.exe
  2⤵
  PID:3848
- C:\Windows\System\GOQcUkZ.exe
  C:\Windows\System\GOQcUkZ.exe
  2⤵
  PID:4016
- C:\Windows\System\CKnrUoW.exe
  C:\Windows\System\CKnrUoW.exe
  2⤵
  PID:4028
- C:\Windows\System\BtoKTVG.exe
  C:\Windows\System\BtoKTVG.exe
  2⤵
  PID:4052
- C:\Windows\System\XUrPZew.exe
  C:\Windows\System\XUrPZew.exe
  2⤵
  PID:2788
- C:\Windows\System\MmGQtEQ.exe
  C:\Windows\System\MmGQtEQ.exe
  2⤵
  PID:1528
- C:\Windows\System\QuuibJr.exe
  C:\Windows\System\QuuibJr.exe
  2⤵
  PID:2648
- C:\Windows\System\icDsBzu.exe
  C:\Windows\System\icDsBzu.exe
  2⤵
  PID:3192
- C:\Windows\System\uakwXkB.exe
  C:\Windows\System\uakwXkB.exe
  2⤵
  PID:3252
- C:\Windows\System\sKYtDLR.exe
  C:\Windows\System\sKYtDLR.exe
  2⤵
  PID:3396
- C:\Windows\System\qASqGWf.exe
  C:\Windows\System\qASqGWf.exe
  2⤵
  PID:1584
- C:\Windows\System\PUycxQV.exe
  C:\Windows\System\PUycxQV.exe
  2⤵
  PID:1300
- C:\Windows\System\CVDWACl.exe
  C:\Windows\System\CVDWACl.exe
  2⤵
  PID:3336
- C:\Windows\System\IuCSVCC.exe
  C:\Windows\System\IuCSVCC.exe
  2⤵
  PID:3432
- C:\Windows\System\SAGecbZ.exe
  C:\Windows\System\SAGecbZ.exe
  2⤵
  PID:3496
- C:\Windows\System\cQmdpms.exe
  C:\Windows\System\cQmdpms.exe
  2⤵
  PID:3448
- C:\Windows\System\fNMBQLQ.exe
  C:\Windows\System\fNMBQLQ.exe
  2⤵
  PID:3512
- C:\Windows\System\ztwWSUQ.exe
  C:\Windows\System\ztwWSUQ.exe
  2⤵
  PID:4108
- C:\Windows\System\ZHYmnKW.exe
  C:\Windows\System\ZHYmnKW.exe
  2⤵
  PID:4128
- C:\Windows\System\VOrFwoq.exe
  C:\Windows\System\VOrFwoq.exe
  2⤵
  PID:4148
- C:\Windows\System\nuJisaL.exe
  C:\Windows\System\nuJisaL.exe
  2⤵
  PID:4164
- C:\Windows\System\ZatAoBE.exe
  C:\Windows\System\ZatAoBE.exe
  2⤵
  PID:4180
- C:\Windows\System\KygytFl.exe
  C:\Windows\System\KygytFl.exe
  2⤵
  PID:4200
- C:\Windows\System\fSKbyRt.exe
  C:\Windows\System\fSKbyRt.exe
  2⤵
  PID:4216
- C:\Windows\System\hLkdCvr.exe
  C:\Windows\System\hLkdCvr.exe
  2⤵
  PID:4292
- C:\Windows\System\bQqYiOd.exe
  C:\Windows\System\bQqYiOd.exe
  2⤵
  PID:4308
- C:\Windows\System\QSpJWVB.exe
  C:\Windows\System\QSpJWVB.exe
  2⤵
  PID:4324
- C:\Windows\System\DXGeiPL.exe
  C:\Windows\System\DXGeiPL.exe
  2⤵
  PID:4340
- C:\Windows\System\tfKaQpb.exe
  C:\Windows\System\tfKaQpb.exe
  2⤵
  PID:4360
- C:\Windows\System\PuRXHWb.exe
  C:\Windows\System\PuRXHWb.exe
  2⤵
  PID:4376
- C:\Windows\System\SUUHFKo.exe
  C:\Windows\System\SUUHFKo.exe
  2⤵
  PID:4392
- C:\Windows\System\czXdXJH.exe
  C:\Windows\System\czXdXJH.exe
  2⤵
  PID:4408
- C:\Windows\System\qgfSFrv.exe
  C:\Windows\System\qgfSFrv.exe
  2⤵
  PID:4436
- C:\Windows\System\FjqtqOS.exe
  C:\Windows\System\FjqtqOS.exe
  2⤵
  PID:4452
- C:\Windows\System\KRbHPbh.exe
  C:\Windows\System\KRbHPbh.exe
  2⤵
  PID:4472
- C:\Windows\System\xvoHFRj.exe
  C:\Windows\System\xvoHFRj.exe
  2⤵
  PID:4488
- C:\Windows\System\tzVSwJP.exe
  C:\Windows\System\tzVSwJP.exe
  2⤵
  PID:4508
- C:\Windows\System\BFHbvRP.exe
  C:\Windows\System\BFHbvRP.exe
  2⤵
  PID:4524
- C:\Windows\System\uomZShY.exe
  C:\Windows\System\uomZShY.exe
  2⤵
  PID:4540
- C:\Windows\System\cJrEOCT.exe
  C:\Windows\System\cJrEOCT.exe
  2⤵
  PID:4556
- C:\Windows\System\NYXxSZX.exe
  C:\Windows\System\NYXxSZX.exe
  2⤵
  PID:4572
- C:\Windows\System\ZoyeiYF.exe
  C:\Windows\System\ZoyeiYF.exe
  2⤵
  PID:4588
- C:\Windows\System\EooldGu.exe
  C:\Windows\System\EooldGu.exe
  2⤵
  PID:4604
- C:\Windows\System\WjJCCYq.exe
  C:\Windows\System\WjJCCYq.exe
  2⤵
  PID:4620
- C:\Windows\System\eMQrDMf.exe
  C:\Windows\System\eMQrDMf.exe
  2⤵
  PID:4636
- C:\Windows\System\ioFIYfI.exe
  C:\Windows\System\ioFIYfI.exe
  2⤵
  PID:4652
- C:\Windows\System\ehGEYYK.exe
  C:\Windows\System\ehGEYYK.exe
  2⤵
  PID:4668
- C:\Windows\System\HiKrTNa.exe
  C:\Windows\System\HiKrTNa.exe
  2⤵
  PID:4684
- C:\Windows\System\DPOKAzH.exe
  C:\Windows\System\DPOKAzH.exe
  2⤵
  PID:4700
- C:\Windows\System\PACIWZw.exe
  C:\Windows\System\PACIWZw.exe
  2⤵
  PID:4716
- C:\Windows\System\JhAwJCG.exe
  C:\Windows\System\JhAwJCG.exe
  2⤵
  PID:4732
- C:\Windows\System\zQEojOE.exe
  C:\Windows\System\zQEojOE.exe
  2⤵
  PID:4748
- C:\Windows\System\kvFbJAo.exe
  C:\Windows\System\kvFbJAo.exe
  2⤵
  PID:4764
- C:\Windows\System\HBZKxsB.exe
  C:\Windows\System\HBZKxsB.exe
  2⤵
  PID:4780
- C:\Windows\System\oMmFfrd.exe
  C:\Windows\System\oMmFfrd.exe
  2⤵
  PID:4796
- C:\Windows\System\NfHJtwz.exe
  C:\Windows\System\NfHJtwz.exe
  2⤵
  PID:4812
- C:\Windows\System\jiPgKdc.exe
  C:\Windows\System\jiPgKdc.exe
  2⤵
  PID:4828
- C:\Windows\System\PbQWFWW.exe
  C:\Windows\System\PbQWFWW.exe
  2⤵
  PID:4844
- C:\Windows\System\yoEwoNZ.exe
  C:\Windows\System\yoEwoNZ.exe
  2⤵
  PID:4864
- C:\Windows\System\hpbUEMp.exe
  C:\Windows\System\hpbUEMp.exe
  2⤵
  PID:4936
- C:\Windows\System\fRZzwbT.exe
  C:\Windows\System\fRZzwbT.exe
  2⤵
  PID:4952
- C:\Windows\System\xPGWhzT.exe
  C:\Windows\System\xPGWhzT.exe
  2⤵
  PID:4968
- C:\Windows\System\LZkequb.exe
  C:\Windows\System\LZkequb.exe
  2⤵
  PID:5092
- C:\Windows\System\NRWldWp.exe
  C:\Windows\System\NRWldWp.exe
  2⤵
  PID:3104
- C:\Windows\System\iFuisMA.exe
  C:\Windows\System\iFuisMA.exe
  2⤵
  PID:3548
- C:\Windows\System\ALjFghR.exe
  C:\Windows\System\ALjFghR.exe
  2⤵
  PID:3796
- C:\Windows\System\OxqshOr.exe
  C:\Windows\System\OxqshOr.exe
  2⤵
  PID:3984
- C:\Windows\System\ubPsOyv.exe
  C:\Windows\System\ubPsOyv.exe
  2⤵
  PID:3728
- C:\Windows\System\sZeFRag.exe
  C:\Windows\System\sZeFRag.exe
  2⤵
  PID:2004
- C:\Windows\System\DFPmCJA.exe
  C:\Windows\System\DFPmCJA.exe
  2⤵
  PID:4000
- C:\Windows\System\YQTJHaX.exe
  C:\Windows\System\YQTJHaX.exe
  2⤵
  PID:4064
- C:\Windows\System\TregQzy.exe
  C:\Windows\System\TregQzy.exe
  2⤵
  PID:3288
- C:\Windows\System\laDdFjj.exe
  C:\Windows\System\laDdFjj.exe
  2⤵
  PID:4116
- C:\Windows\System\GWXchkW.exe
  C:\Windows\System\GWXchkW.exe
  2⤵
  PID:4192
- C:\Windows\System\xJpZTLp.exe
  C:\Windows\System\xJpZTLp.exe
  2⤵
  PID:4240
- C:\Windows\System\LuFELfb.exe
  C:\Windows\System\LuFELfb.exe
  2⤵
  PID:4260
- C:\Windows\System\dVgCoSc.exe
  C:\Windows\System\dVgCoSc.exe
  2⤵
  PID:4284
- C:\Windows\System\XqaebPJ.exe
  C:\Windows\System\XqaebPJ.exe
  2⤵
  PID:4100
- C:\Windows\System\qcANvjX.exe
  C:\Windows\System\qcANvjX.exe
  2⤵
  PID:3416
- C:\Windows\System\jdqynBU.exe
  C:\Windows\System\jdqynBU.exe
  2⤵
  PID:4144
- C:\Windows\System\iHSfsAg.exe
  C:\Windows\System\iHSfsAg.exe
  2⤵
  PID:4320
- C:\Windows\System\NTQUWId.exe
  C:\Windows\System\NTQUWId.exe
  2⤵
  PID:4384
- C:\Windows\System\UveUfPz.exe
  C:\Windows\System\UveUfPz.exe
  2⤵
  PID:4332
- C:\Windows\System\gQqgicL.exe
  C:\Windows\System\gQqgicL.exe
  2⤵
  PID:4400
- C:\Windows\System\MtGiayK.exe
  C:\Windows\System\MtGiayK.exe
  2⤵
  PID:4420
- C:\Windows\System\YoRmWoD.exe
  C:\Windows\System\YoRmWoD.exe
  2⤵
  PID:4460
- C:\Windows\System\zjwNzQV.exe
  C:\Windows\System\zjwNzQV.exe
  2⤵
  PID:4500
- C:\Windows\System\bXJpHta.exe
  C:\Windows\System\bXJpHta.exe
  2⤵
  PID:4568
- C:\Windows\System\XDMBIXV.exe
  C:\Windows\System\XDMBIXV.exe
  2⤵
  PID:4448
- C:\Windows\System\UZhDrGG.exe
  C:\Windows\System\UZhDrGG.exe
  2⤵
  PID:4552
- C:\Windows\System\VKhejQU.exe
  C:\Windows\System\VKhejQU.exe
  2⤵
  PID:4616
- C:\Windows\System\zKHTwhe.exe
  C:\Windows\System\zKHTwhe.exe
  2⤵
  PID:4664
- C:\Windows\System\rEwLkML.exe
  C:\Windows\System\rEwLkML.exe
  2⤵
  PID:4728
- C:\Windows\System\BlmGNkn.exe
  C:\Windows\System\BlmGNkn.exe
  2⤵
  PID:4676
- C:\Windows\System\Asprbxv.exe
  C:\Windows\System\Asprbxv.exe
  2⤵
  PID:4792
- C:\Windows\System\VfWFYZQ.exe
  C:\Windows\System\VfWFYZQ.exe
  2⤵
  PID:4772
- C:\Windows\System\zLIaQEb.exe
  C:\Windows\System\zLIaQEb.exe
  2⤵
  PID:4824
- C:\Windows\System\IQxioof.exe
  C:\Windows\System\IQxioof.exe
  2⤵
  PID:4872
- C:\Windows\System\BFzFEHp.exe
  C:\Windows\System\BFzFEHp.exe
  2⤵
  PID:4880
- C:\Windows\System\VXdwJNi.exe
  C:\Windows\System\VXdwJNi.exe
  2⤵
  PID:4912
- C:\Windows\System\xWWPRcq.exe
  C:\Windows\System\xWWPRcq.exe
  2⤵
  PID:4944
- C:\Windows\System\HpiyfYR.exe
  C:\Windows\System\HpiyfYR.exe
  2⤵
  PID:5012
- C:\Windows\System\TeClcXR.exe
  C:\Windows\System\TeClcXR.exe
  2⤵
  PID:5064
- C:\Windows\System\kGkpjwh.exe
  C:\Windows\System\kGkpjwh.exe
  2⤵
  PID:5084
- C:\Windows\System\gUBqtwE.exe
  C:\Windows\System\gUBqtwE.exe
  2⤵
  PID:3140
- C:\Windows\System\rKavsNl.exe
  C:\Windows\System\rKavsNl.exe
  2⤵
  PID:1036
- C:\Windows\System\DAmUDco.exe
  C:\Windows\System\DAmUDco.exe
  2⤵
  PID:1368
- C:\Windows\System\HxJiOsk.exe
  C:\Windows\System\HxJiOsk.exe
  2⤵
  PID:3236
- C:\Windows\System\idmDyBy.exe
  C:\Windows\System\idmDyBy.exe
  2⤵
  PID:3348
- C:\Windows\System\scUIIsP.exe
  C:\Windows\System\scUIIsP.exe
  2⤵
  PID:3764
- C:\Windows\System\FLhyzLj.exe
  C:\Windows\System\FLhyzLj.exe
  2⤵
  PID:3656
- C:\Windows\System\lxocadO.exe
  C:\Windows\System\lxocadO.exe
  2⤵
  PID:408
- C:\Windows\System\IlRCPmx.exe
  C:\Windows\System\IlRCPmx.exe
  2⤵
  PID:3908
- C:\Windows\System\CChDpmW.exe
  C:\Windows\System\CChDpmW.exe
  2⤵
  PID:2432
- C:\Windows\System\urPLwGq.exe
  C:\Windows\System\urPLwGq.exe
  2⤵
  PID:4160
- C:\Windows\System\tkAJCuD.exe
  C:\Windows\System\tkAJCuD.exe
  2⤵
  PID:4252
- C:\Windows\System\hwoGzjJ.exe
  C:\Windows\System\hwoGzjJ.exe
  2⤵
  PID:4208
- C:\Windows\System\opBpOhd.exe
  C:\Windows\System\opBpOhd.exe
  2⤵
  PID:3480
- C:\Windows\System\mJZQHCF.exe
  C:\Windows\System\mJZQHCF.exe
  2⤵
  PID:3444
- C:\Windows\System\DlQARjZ.exe
  C:\Windows\System\DlQARjZ.exe
  2⤵
  PID:4352
- C:\Windows\System\hhpcYBS.exe
  C:\Windows\System\hhpcYBS.exe
  2⤵
  PID:4236
- C:\Windows\System\HSwvzBC.exe
  C:\Windows\System\HSwvzBC.exe
  2⤵
  PID:4432
- C:\Windows\System\MXWdKAx.exe
  C:\Windows\System\MXWdKAx.exe
  2⤵
  PID:3412
- C:\Windows\System\SkIiwrN.exe
  C:\Windows\System\SkIiwrN.exe
  2⤵
  PID:3972
- C:\Windows\System\CbHMfgj.exe
  C:\Windows\System\CbHMfgj.exe
  2⤵
  PID:3828
- C:\Windows\System\bRFsIJr.exe
  C:\Windows\System\bRFsIJr.exe
  2⤵
  PID:1712
- C:\Windows\System\BkMRAYA.exe
  C:\Windows\System\BkMRAYA.exe
  2⤵
  PID:4660
- C:\Windows\System\OkUFQKe.exe
  C:\Windows\System\OkUFQKe.exe
  2⤵
  PID:4600
- C:\Windows\System\FZtnKrN.exe
  C:\Windows\System\FZtnKrN.exe
  2⤵
  PID:4808
- C:\Windows\System\RYcqAwn.exe
  C:\Windows\System\RYcqAwn.exe
  2⤵
  PID:4924
- C:\Windows\System\QpyTQLt.exe
  C:\Windows\System\QpyTQLt.exe
  2⤵
  PID:4932
- C:\Windows\System\hFeHmel.exe
  C:\Windows\System\hFeHmel.exe
  2⤵
  PID:4908
- C:\Windows\System\wqBcWYG.exe
  C:\Windows\System\wqBcWYG.exe
  2⤵
  PID:4960
- C:\Windows\System\rajuVzR.exe
  C:\Windows\System\rajuVzR.exe
  2⤵
  PID:5052
- C:\Windows\System\uKnGHpG.exe
  C:\Windows\System\uKnGHpG.exe
  2⤵
  PID:3356
- C:\Windows\System\ZosXdUz.exe
  C:\Windows\System\ZosXdUz.exe
  2⤵
  PID:3296
- C:\Windows\System\QuteWqD.exe
  C:\Windows\System\QuteWqD.exe
  2⤵
  PID:3876
- C:\Windows\System\jzWzbMp.exe
  C:\Windows\System\jzWzbMp.exe
  2⤵
  PID:628
- C:\Windows\System\oIeEasT.exe
  C:\Windows\System\oIeEasT.exe
  2⤵
  PID:5080
- C:\Windows\System\eoxltca.exe
  C:\Windows\System\eoxltca.exe
  2⤵
  PID:372
- C:\Windows\System\TWaiFQY.exe
  C:\Windows\System\TWaiFQY.exe
  2⤵
  PID:3816
- C:\Windows\System\qBTxsED.exe
  C:\Windows\System\qBTxsED.exe
  2⤵
  PID:3152
- C:\Windows\System\FRxWupC.exe
  C:\Windows\System\FRxWupC.exe
  2⤵
  PID:4140
- C:\Windows\System\aQPLrIQ.exe
  C:\Windows\System\aQPLrIQ.exe
  2⤵
  PID:4232
- C:\Windows\System\hDRQqFD.exe
  C:\Windows\System\hDRQqFD.exe
  2⤵
  PID:4256
- C:\Windows\System\dKmTaqc.exe
  C:\Windows\System\dKmTaqc.exe
  2⤵
  PID:4212
- C:\Windows\System\YlBmFtV.exe
  C:\Windows\System\YlBmFtV.exe
  2⤵
  PID:3372
- C:\Windows\System\GSIvJex.exe
  C:\Windows\System\GSIvJex.exe
  2⤵
  PID:4760
- C:\Windows\System\BMnHwMG.exe
  C:\Windows\System\BMnHwMG.exe
  2⤵
  PID:4860
- C:\Windows\System\MgaWKoB.exe
  C:\Windows\System\MgaWKoB.exe
  2⤵
  PID:3228
- C:\Windows\System\HgToaQb.exe
  C:\Windows\System\HgToaQb.exe
  2⤵
  PID:4712
- C:\Windows\System\bSGRTJC.exe
  C:\Windows\System\bSGRTJC.exe
  2⤵
  PID:4724
- C:\Windows\System\lQWxQgf.exe
  C:\Windows\System\lQWxQgf.exe
  2⤵
  PID:4904
- C:\Windows\System\PqzmZMR.exe
  C:\Windows\System\PqzmZMR.exe
  2⤵
  PID:2436
- C:\Windows\System\ToiQmKb.exe
  C:\Windows\System\ToiQmKb.exe
  2⤵
  PID:4248
- C:\Windows\System\CxbGOiC.exe
  C:\Windows\System\CxbGOiC.exe
  2⤵
  PID:4068
- C:\Windows\System\AlqdFmI.exe
  C:\Windows\System\AlqdFmI.exe
  2⤵
  PID:3508
- C:\Windows\System\jeEHGSG.exe
  C:\Windows\System\jeEHGSG.exe
  2⤵
  PID:4228
- C:\Windows\System\GcTFBWL.exe
  C:\Windows\System\GcTFBWL.exe
  2⤵
  PID:3320
- C:\Windows\System\PQEAwFJ.exe
  C:\Windows\System\PQEAwFJ.exe
  2⤵
  PID:4468
- C:\Windows\System\IcXBRVv.exe
  C:\Windows\System\IcXBRVv.exe
  2⤵
  PID:4496
- C:\Windows\System\qxGJOAJ.exe
  C:\Windows\System\qxGJOAJ.exe
  2⤵
  PID:4804
- C:\Windows\System\ECUqGDo.exe
  C:\Windows\System\ECUqGDo.exe
  2⤵
  PID:5104
- C:\Windows\System\DnaWZUn.exe
  C:\Windows\System\DnaWZUn.exe
  2⤵
  PID:3708
- C:\Windows\System\ApPAulW.exe
  C:\Windows\System\ApPAulW.exe
  2⤵
  PID:3544
- C:\Windows\System\cnusZAr.exe
  C:\Windows\System\cnusZAr.exe
  2⤵
  PID:3564
- C:\Windows\System\OtBWTDQ.exe
  C:\Windows\System\OtBWTDQ.exe
  2⤵
  PID:4428
- C:\Windows\System\sEKOomz.exe
  C:\Windows\System\sEKOomz.exe
  2⤵
  PID:2660
- C:\Windows\System\gCVmPHR.exe
  C:\Windows\System\gCVmPHR.exe
  2⤵
  PID:4224
- C:\Windows\System\fJfJzXG.exe
  C:\Windows\System\fJfJzXG.exe
  2⤵
  PID:4304
- C:\Windows\System\aGlFERy.exe
  C:\Windows\System\aGlFERy.exe
  2⤵
  PID:4788
- C:\Windows\System\EDwoTWo.exe
  C:\Windows\System\EDwoTWo.exe
  2⤵
  PID:3600
- C:\Windows\System\QtvkRoP.exe
  C:\Windows\System\QtvkRoP.exe
  2⤵
  PID:2936
- C:\Windows\System\DtESKVB.exe
  C:\Windows\System\DtESKVB.exe
  2⤵
  PID:4048
- C:\Windows\System\nREaDVl.exe
  C:\Windows\System\nREaDVl.exe
  2⤵
  PID:4632
- C:\Windows\System\sDoADYG.exe
  C:\Windows\System\sDoADYG.exe
  2⤵
  PID:1640
- C:\Windows\System\RyiVxRL.exe
  C:\Windows\System\RyiVxRL.exe
  2⤵
  PID:5124
- C:\Windows\System\XhceLNi.exe
  C:\Windows\System\XhceLNi.exe
  2⤵
  PID:5140
- C:\Windows\System\YqsCapZ.exe
  C:\Windows\System\YqsCapZ.exe
  2⤵
  PID:5156
- C:\Windows\System\etZrdjt.exe
  C:\Windows\System\etZrdjt.exe
  2⤵
  PID:5176
- C:\Windows\System\sVruRRc.exe
  C:\Windows\System\sVruRRc.exe
  2⤵
  PID:5192
- C:\Windows\System\eWfvlTN.exe
  C:\Windows\System\eWfvlTN.exe
  2⤵
  PID:5208
- C:\Windows\System\jTABQAI.exe
  C:\Windows\System\jTABQAI.exe
  2⤵
  PID:5228
- C:\Windows\System\mVlmQdD.exe
  C:\Windows\System\mVlmQdD.exe
  2⤵
  PID:5244
- C:\Windows\System\TRWDOCo.exe
  C:\Windows\System\TRWDOCo.exe
  2⤵
  PID:5268
- C:\Windows\System\iBhxxSE.exe
  C:\Windows\System\iBhxxSE.exe
  2⤵
  PID:5304
- C:\Windows\System\fUmubKj.exe
  C:\Windows\System\fUmubKj.exe
  2⤵
  PID:5320
- C:\Windows\System\TTYIRwq.exe
  C:\Windows\System\TTYIRwq.exe
  2⤵
  PID:5336
- C:\Windows\System\FQZOCDy.exe
  C:\Windows\System\FQZOCDy.exe
  2⤵
  PID:5356
- C:\Windows\System\VJGhuHu.exe
  C:\Windows\System\VJGhuHu.exe
  2⤵
  PID:5376
- C:\Windows\System\uaOFLoP.exe
  C:\Windows\System\uaOFLoP.exe
  2⤵
  PID:5392
- C:\Windows\System\ZcFwtSe.exe
  C:\Windows\System\ZcFwtSe.exe
  2⤵
  PID:5408
- C:\Windows\System\svJkCWX.exe
  C:\Windows\System\svJkCWX.exe
  2⤵
  PID:5424
- C:\Windows\System\YZKthMa.exe
  C:\Windows\System\YZKthMa.exe
  2⤵
  PID:5440
- C:\Windows\System\ekwSeZS.exe
  C:\Windows\System\ekwSeZS.exe
  2⤵
  PID:5456
- C:\Windows\System\jwcgjUV.exe
  C:\Windows\System\jwcgjUV.exe
  2⤵
  PID:5500
- C:\Windows\System\mEwQYHV.exe
  C:\Windows\System\mEwQYHV.exe
  2⤵
  PID:5516
- C:\Windows\System\bIYaPJB.exe
  C:\Windows\System\bIYaPJB.exe
  2⤵
  PID:5532
- C:\Windows\System\HxGQJqK.exe
  C:\Windows\System\HxGQJqK.exe
  2⤵
  PID:5552
- C:\Windows\System\csPBQgC.exe
  C:\Windows\System\csPBQgC.exe
  2⤵
  PID:5572
- C:\Windows\System\bvbiBGg.exe
  C:\Windows\System\bvbiBGg.exe
  2⤵
  PID:5592
- C:\Windows\System\nJgELGl.exe
  C:\Windows\System\nJgELGl.exe
  2⤵
  PID:5608
- C:\Windows\System\PWIlhqF.exe
  C:\Windows\System\PWIlhqF.exe
  2⤵
  PID:5624
- C:\Windows\System\AKcTIyz.exe
  C:\Windows\System\AKcTIyz.exe
  2⤵
  PID:5644
- C:\Windows\System\LmOsSFF.exe
  C:\Windows\System\LmOsSFF.exe
  2⤵
  PID:5660
- C:\Windows\System\pSqTwFV.exe
  C:\Windows\System\pSqTwFV.exe
  2⤵
  PID:5680
- C:\Windows\System\GteBKeE.exe
  C:\Windows\System\GteBKeE.exe
  2⤵
  PID:5696
- C:\Windows\System\pZNuGEI.exe
  C:\Windows\System\pZNuGEI.exe
  2⤵
  PID:5712
- C:\Windows\System\cATQfuL.exe
  C:\Windows\System\cATQfuL.exe
  2⤵
  PID:5728
- C:\Windows\System\AUhnPXd.exe
  C:\Windows\System\AUhnPXd.exe
  2⤵
  PID:5748
- C:\Windows\System\wZnaOXe.exe
  C:\Windows\System\wZnaOXe.exe
  2⤵
  PID:5764
- C:\Windows\System\SgXERbu.exe
  C:\Windows\System\SgXERbu.exe
  2⤵
  PID:5780
- C:\Windows\System\YskWfcD.exe
  C:\Windows\System\YskWfcD.exe
  2⤵
  PID:5796
- C:\Windows\System\saMuggf.exe
  C:\Windows\System\saMuggf.exe
  2⤵
  PID:5816
- C:\Windows\System\KFpBViK.exe
  C:\Windows\System\KFpBViK.exe
  2⤵
  PID:5832
- C:\Windows\System\krtNNCV.exe
  C:\Windows\System\krtNNCV.exe
  2⤵
  PID:5852
- C:\Windows\System\IExcbMk.exe
  C:\Windows\System\IExcbMk.exe
  2⤵
  PID:5872
- C:\Windows\System\ivdbrZa.exe
  C:\Windows\System\ivdbrZa.exe
  2⤵
  PID:5888
- C:\Windows\System\KUVskpa.exe
  C:\Windows\System\KUVskpa.exe
  2⤵
  PID:5952
- C:\Windows\System\MUnRRcB.exe
  C:\Windows\System\MUnRRcB.exe
  2⤵
  PID:5968
- C:\Windows\System\MTkcaaD.exe
  C:\Windows\System\MTkcaaD.exe
  2⤵
  PID:6040
- C:\Windows\System\yKvcpIp.exe
  C:\Windows\System\yKvcpIp.exe
  2⤵
  PID:6056
- C:\Windows\System\GFzzNBo.exe
  C:\Windows\System\GFzzNBo.exe
  2⤵
  PID:6072
- C:\Windows\System\iIjvOWS.exe
  C:\Windows\System\iIjvOWS.exe
  2⤵
  PID:6088
- C:\Windows\System\VnkIBCK.exe
  C:\Windows\System\VnkIBCK.exe
  2⤵
  PID:6104
- C:\Windows\System\fHQclpJ.exe
  C:\Windows\System\fHQclpJ.exe
  2⤵
  PID:6120
- C:\Windows\System\QaXrUfb.exe
  C:\Windows\System\QaXrUfb.exe
  2⤵
  PID:6136
- C:\Windows\System\Mbqpqtu.exe
  C:\Windows\System\Mbqpqtu.exe
  2⤵
  PID:5044
- C:\Windows\System\StMjArc.exe
  C:\Windows\System\StMjArc.exe
  2⤵
  PID:4268
- C:\Windows\System\HPwFqEJ.exe
  C:\Windows\System\HPwFqEJ.exe
  2⤵
  PID:5216
- C:\Windows\System\ATdMfVF.exe
  C:\Windows\System\ATdMfVF.exe
  2⤵
  PID:4536
- C:\Windows\System\xwCVrdl.exe
  C:\Windows\System\xwCVrdl.exe
  2⤵
  PID:5164
- C:\Windows\System\sLXmLSZ.exe
  C:\Windows\System\sLXmLSZ.exe
  2⤵
  PID:5240
- C:\Windows\System\atnhCsd.exe
  C:\Windows\System\atnhCsd.exe
  2⤵
  PID:5260
- C:\Windows\System\SDquALE.exe
  C:\Windows\System\SDquALE.exe
  2⤵
  PID:5348
- C:\Windows\System\rhvPgey.exe
  C:\Windows\System\rhvPgey.exe
  2⤵
  PID:5384
- C:\Windows\System\CyAqZJa.exe
  C:\Windows\System\CyAqZJa.exe
  2⤵
  PID:5404
- C:\Windows\System\vFGUOeD.exe
  C:\Windows\System\vFGUOeD.exe
  2⤵
  PID:5364
- C:\Windows\System\okvrvwq.exe
  C:\Windows\System\okvrvwq.exe
  2⤵
  PID:5292
- C:\Windows\System\QbyPTPJ.exe
  C:\Windows\System\QbyPTPJ.exe
  2⤵
  PID:5544
- C:\Windows\System\zVAjFwY.exe
  C:\Windows\System\zVAjFwY.exe
  2⤵
  PID:5580
- C:\Windows\System\QnanLeU.exe
  C:\Windows\System\QnanLeU.exe
  2⤵
  PID:5616
- C:\Windows\System\yfehOFI.exe
  C:\Windows\System\yfehOFI.exe
  2⤵
  PID:5476
- C:\Windows\System\KdRmFWs.exe
  C:\Windows\System\KdRmFWs.exe
  2⤵
  PID:5864
- C:\Windows\System\jfRTAoo.exe
  C:\Windows\System\jfRTAoo.exe
  2⤵
  PID:5904
- C:\Windows\System\NZucnxh.exe
  C:\Windows\System\NZucnxh.exe
  2⤵
  PID:5788
- C:\Windows\System\PQSGSfs.exe
  C:\Windows\System\PQSGSfs.exe
  2⤵
  PID:5924
- C:\Windows\System\dPtzKcR.exe
  C:\Windows\System\dPtzKcR.exe
  2⤵
  PID:5940
- C:\Windows\System\KYceOOl.exe
  C:\Windows\System\KYceOOl.exe
  2⤵
  PID:5484
- C:\Windows\System\jQFdEhb.exe
  C:\Windows\System\jQFdEhb.exe
  2⤵
  PID:5884
- C:\Windows\System\OTsdiFa.exe
  C:\Windows\System\OTsdiFa.exe
  2⤵
  PID:5840
- C:\Windows\System\RrItqcS.exe
  C:\Windows\System\RrItqcS.exe
  2⤵
  PID:5776
- C:\Windows\System\mmDqSXK.exe
  C:\Windows\System\mmDqSXK.exe
  2⤵
  PID:5736
- C:\Windows\System\ksQxCKl.exe
  C:\Windows\System\ksQxCKl.exe
  2⤵
  PID:5668
- C:\Windows\System\lxxqmOj.exe
  C:\Windows\System\lxxqmOj.exe
  2⤵
  PID:5604
- C:\Windows\System\QLyOEzL.exe
  C:\Windows\System\QLyOEzL.exe
  2⤵
  PID:5524
- C:\Windows\System\ULKYJuk.exe
  C:\Windows\System\ULKYJuk.exe
  2⤵
  PID:5980
- C:\Windows\System\ybXdbXj.exe
  C:\Windows\System\ybXdbXj.exe
  2⤵
  PID:5996
- C:\Windows\System\kBwEnrz.exe
  C:\Windows\System\kBwEnrz.exe
  2⤵
  PID:6020
- C:\Windows\System\vmuJgAW.exe
  C:\Windows\System\vmuJgAW.exe
  2⤵
  PID:6048
- C:\Windows\System\rliCaJe.exe
  C:\Windows\System\rliCaJe.exe
  2⤵
  PID:6128
- C:\Windows\System\AhPlHLl.exe
  C:\Windows\System\AhPlHLl.exe
  2⤵
  PID:5148
- C:\Windows\System\iTFTeRT.exe
  C:\Windows\System\iTFTeRT.exe
  2⤵
  PID:6112
- C:\Windows\System\ftkybda.exe
  C:\Windows\System\ftkybda.exe
  2⤵
  PID:5152
- C:\Windows\System\gaoFmJw.exe
  C:\Windows\System\gaoFmJw.exe
  2⤵
  PID:4280
- C:\Windows\System\xyCuemz.exe
  C:\Windows\System\xyCuemz.exe
  2⤵
  PID:5448
- C:\Windows\System\kJkWOgy.exe
  C:\Windows\System\kJkWOgy.exe
  2⤵
  PID:5352
- C:\Windows\System\xpfTnLi.exe
  C:\Windows\System\xpfTnLi.exe
  2⤵
  PID:5512
- C:\Windows\System\VzjbYnJ.exe
  C:\Windows\System\VzjbYnJ.exe
  2⤵
  PID:5548
- C:\Windows\System\xUrQWSX.exe
  C:\Windows\System\xUrQWSX.exe
  2⤵
  PID:5300
- C:\Windows\System\mSisPcn.exe
  C:\Windows\System\mSisPcn.exe
  2⤵
  PID:5724
- C:\Windows\System\RMJlfDX.exe
  C:\Windows\System\RMJlfDX.exe
  2⤵
  PID:5720
- C:\Windows\System\ZcOMbYd.exe
  C:\Windows\System\ZcOMbYd.exe
  2⤵
  PID:5480
- C:\Windows\System\CersdNL.exe
  C:\Windows\System\CersdNL.exe
  2⤵
  PID:5740
- C:\Windows\System\AEKKmpy.exe
  C:\Windows\System\AEKKmpy.exe
  2⤵
  PID:5960
- C:\Windows\System\RPwKpdo.exe
  C:\Windows\System\RPwKpdo.exe
  2⤵
  PID:6036
- C:\Windows\System\yzQSeTD.exe
  C:\Windows\System\yzQSeTD.exe
  2⤵
  PID:5760
- C:\Windows\System\RTZtxcM.exe
  C:\Windows\System\RTZtxcM.exe
  2⤵
  PID:5932
- C:\Windows\System\LDjklPv.exe
  C:\Windows\System\LDjklPv.exe
  2⤵
  PID:5804
- C:\Windows\System\tuhMKHd.exe
  C:\Windows\System\tuhMKHd.exe
  2⤵
  PID:5528
- C:\Windows\System\jSKhkkW.exe
  C:\Windows\System\jSKhkkW.exe
  2⤵
  PID:3924
- C:\Windows\System\mMriabk.exe
  C:\Windows\System\mMriabk.exe
  2⤵
  PID:5436
- C:\Windows\System\KOhDhbQ.exe
  C:\Windows\System\KOhDhbQ.exe
  2⤵
  PID:6080
- C:\Windows\System\UjvSFUZ.exe
  C:\Windows\System\UjvSFUZ.exe
  2⤵
  PID:5296
- C:\Windows\System\aZqUNkE.exe
  C:\Windows\System\aZqUNkE.exe
  2⤵
  PID:5204
- C:\Windows\System\VzsYrTI.exe
  C:\Windows\System\VzsYrTI.exe
  2⤵
  PID:5280
- C:\Windows\System\sawbYWs.exe
  C:\Windows\System\sawbYWs.exe
  2⤵
  PID:5792
- C:\Windows\System\xBrcfmG.exe
  C:\Windows\System\xBrcfmG.exe
  2⤵
  PID:5508
- C:\Windows\System\osaNnYU.exe
  C:\Windows\System\osaNnYU.exe
  2⤵
  PID:5744
- C:\Windows\System\WkVlBdb.exe
  C:\Windows\System\WkVlBdb.exe
  2⤵
  PID:5184
- C:\Windows\System\RMnikHB.exe
  C:\Windows\System\RMnikHB.exe
  2⤵
  PID:5564
- C:\Windows\System\wgiBkYS.exe
  C:\Windows\System\wgiBkYS.exe
  2⤵
  PID:5964
- C:\Windows\System\OQUrWcQ.exe
  C:\Windows\System\OQUrWcQ.exe
  2⤵
  PID:5132
- C:\Windows\System\ShUSGon.exe
  C:\Windows\System\ShUSGon.exe
  2⤵
  PID:6052
- C:\Windows\System\tVwMzFj.exe
  C:\Windows\System\tVwMzFj.exe
  2⤵
  PID:6028
- C:\Windows\System\PjoEoAq.exe
  C:\Windows\System\PjoEoAq.exe
  2⤵
  PID:5312
- C:\Windows\System\MtGMeSF.exe
  C:\Windows\System\MtGMeSF.exe
  2⤵
  PID:5988
- C:\Windows\System\vEztzTK.exe
  C:\Windows\System\vEztzTK.exe
  2⤵
  PID:5060
- C:\Windows\System\HZhuSFZ.exe
  C:\Windows\System\HZhuSFZ.exe
  2⤵
  PID:5692
- C:\Windows\System\lYaDSMN.exe
  C:\Windows\System\lYaDSMN.exe
  2⤵
  PID:5912
- C:\Windows\System\NeERFFm.exe
  C:\Windows\System\NeERFFm.exe
  2⤵
  PID:6152
- C:\Windows\System\QPGsecB.exe
  C:\Windows\System\QPGsecB.exe
  2⤵
  PID:6208
- C:\Windows\System\DPJQkGv.exe
  C:\Windows\System\DPJQkGv.exe
  2⤵
  PID:6224
- C:\Windows\System\ZWNhyDE.exe
  C:\Windows\System\ZWNhyDE.exe
  2⤵
  PID:6240
- C:\Windows\System\dOYUdEM.exe
  C:\Windows\System\dOYUdEM.exe
  2⤵
  PID:6260
- C:\Windows\System\fqwBHaD.exe
  C:\Windows\System\fqwBHaD.exe
  2⤵
  PID:6276
- C:\Windows\System\xviixVe.exe
  C:\Windows\System\xviixVe.exe
  2⤵
  PID:6292
- C:\Windows\System\guhOCMJ.exe
  C:\Windows\System\guhOCMJ.exe
  2⤵
  PID:6316
- C:\Windows\System\UczdgJG.exe
  C:\Windows\System\UczdgJG.exe
  2⤵
  PID:6332
- C:\Windows\System\hfjcrvh.exe
  C:\Windows\System\hfjcrvh.exe
  2⤵
  PID:6348
- C:\Windows\System\JewhMVy.exe
  C:\Windows\System\JewhMVy.exe
  2⤵
  PID:6368
- C:\Windows\System\FLuUiLC.exe
  C:\Windows\System\FLuUiLC.exe
  2⤵
  PID:6384
- C:\Windows\System\uhcvprG.exe
  C:\Windows\System\uhcvprG.exe
  2⤵
  PID:6400
- C:\Windows\System\PjECjLw.exe
  C:\Windows\System\PjECjLw.exe
  2⤵
  PID:6416
- C:\Windows\System\ioXsscU.exe
  C:\Windows\System\ioXsscU.exe
  2⤵
  PID:6432
- C:\Windows\System\PiruQOe.exe
  C:\Windows\System\PiruQOe.exe
  2⤵
  PID:6448
- C:\Windows\System\pTIemKH.exe
  C:\Windows\System\pTIemKH.exe
  2⤵
  PID:6468
- C:\Windows\System\AMgxZEL.exe
  C:\Windows\System\AMgxZEL.exe
  2⤵
  PID:6484
- C:\Windows\System\XYnknma.exe
  C:\Windows\System\XYnknma.exe
  2⤵
  PID:6500
- C:\Windows\System\zravPLr.exe
  C:\Windows\System\zravPLr.exe
  2⤵
  PID:6520
- C:\Windows\System\NyFPPdk.exe
  C:\Windows\System\NyFPPdk.exe
  2⤵
  PID:6540
- C:\Windows\System\rkYeBwi.exe
  C:\Windows\System\rkYeBwi.exe
  2⤵
  PID:6612
- C:\Windows\System\vcVJXFb.exe
  C:\Windows\System\vcVJXFb.exe
  2⤵
  PID:6632
- C:\Windows\System\OxMQSKS.exe
  C:\Windows\System\OxMQSKS.exe
  2⤵
  PID:6648
- C:\Windows\System\XuIIZJA.exe
  C:\Windows\System\XuIIZJA.exe
  2⤵
  PID:6664
- C:\Windows\System\ukQDvZw.exe
  C:\Windows\System\ukQDvZw.exe
  2⤵
  PID:6684
- C:\Windows\System\wCczxGy.exe
  C:\Windows\System\wCczxGy.exe
  2⤵
  PID:6704
- C:\Windows\System\vFSCkWZ.exe
  C:\Windows\System\vFSCkWZ.exe
  2⤵
  PID:6720
- C:\Windows\System\xgWDvpM.exe
  C:\Windows\System\xgWDvpM.exe
  2⤵
  PID:6736
- C:\Windows\System\VTcFvoq.exe
  C:\Windows\System\VTcFvoq.exe
  2⤵
  PID:6760
- C:\Windows\System\dnORdNc.exe
  C:\Windows\System\dnORdNc.exe
  2⤵
  PID:6776
- C:\Windows\System\cntTXfi.exe
  C:\Windows\System\cntTXfi.exe
  2⤵
  PID:6792
- C:\Windows\System\GcPHTTx.exe
  C:\Windows\System\GcPHTTx.exe
  2⤵
  PID:6808
- C:\Windows\System\euSlrLp.exe
  C:\Windows\System\euSlrLp.exe
  2⤵
  PID:6836
- C:\Windows\System\ZHOMgVn.exe
  C:\Windows\System\ZHOMgVn.exe
  2⤵
  PID:6852
- C:\Windows\System\edPDDjG.exe
  C:\Windows\System\edPDDjG.exe
  2⤵
  PID:6868
- C:\Windows\System\pOeHGhA.exe
  C:\Windows\System\pOeHGhA.exe
  2⤵
  PID:6888
- C:\Windows\System\SNpKnRf.exe
  C:\Windows\System\SNpKnRf.exe
  2⤵
  PID:6904
- C:\Windows\System\lNaFMzX.exe
  C:\Windows\System\lNaFMzX.exe
  2⤵
  PID:6920
- C:\Windows\System\vaCUqyH.exe
  C:\Windows\System\vaCUqyH.exe
  2⤵
  PID:6936
- C:\Windows\System\eGErKjH.exe
  C:\Windows\System\eGErKjH.exe
  2⤵
  PID:6952
- C:\Windows\System\TtqPZcS.exe
  C:\Windows\System\TtqPZcS.exe
  2⤵
  PID:6972
- C:\Windows\System\qoJvCeN.exe
  C:\Windows\System\qoJvCeN.exe
  2⤵
  PID:6992
- C:\Windows\System\zLryaUo.exe
  C:\Windows\System\zLryaUo.exe
  2⤵
  PID:7012
- C:\Windows\System\TqdGUhu.exe
  C:\Windows\System\TqdGUhu.exe
  2⤵
  PID:7028
- C:\Windows\System\eVcFqEA.exe
  C:\Windows\System\eVcFqEA.exe
  2⤵
  PID:7044
- C:\Windows\System\GGbRwGG.exe
  C:\Windows\System\GGbRwGG.exe
  2⤵
  PID:7060
- C:\Windows\System\KnqQtvy.exe
  C:\Windows\System\KnqQtvy.exe
  2⤵
  PID:7076
- C:\Windows\System\bqbBHge.exe
  C:\Windows\System\bqbBHge.exe
  2⤵
  PID:7096
- C:\Windows\System\hLnDDdH.exe
  C:\Windows\System\hLnDDdH.exe
  2⤵
  PID:7112
- C:\Windows\System\lvzfFJx.exe
  C:\Windows\System\lvzfFJx.exe
  2⤵
  PID:7128
- C:\Windows\System\RlWZvDh.exe
  C:\Windows\System\RlWZvDh.exe
  2⤵
  PID:7148
- C:\Windows\System\XgaZchj.exe
  C:\Windows\System\XgaZchj.exe
  2⤵
  PID:7164
- C:\Windows\System\IChqKrL.exe
  C:\Windows\System\IChqKrL.exe
  2⤵
  PID:5172
- C:\Windows\System\rVhlvbA.exe
  C:\Windows\System\rVhlvbA.exe
  2⤵
  PID:5896
- C:\Windows\System\yZxmmFo.exe
  C:\Windows\System\yZxmmFo.exe
  2⤵
  PID:4900
- C:\Windows\System\pUkcVwx.exe
  C:\Windows\System\pUkcVwx.exe
  2⤵
  PID:6216
- C:\Windows\System\qxpalgs.exe
  C:\Windows\System\qxpalgs.exe
  2⤵
  PID:6252
- C:\Windows\System\coeUMfL.exe
  C:\Windows\System\coeUMfL.exe
  2⤵
  PID:6324
- C:\Windows\System\FofNxTX.exe
  C:\Windows\System\FofNxTX.exe
  2⤵
  PID:6180
- C:\Windows\System\WOzuUFZ.exe
  C:\Windows\System\WOzuUFZ.exe
  2⤵
  PID:6196
- C:\Windows\System\fzerLQQ.exe
  C:\Windows\System\fzerLQQ.exe
  2⤵
  PID:6160
- C:\Windows\System\kCSyPiW.exe
  C:\Windows\System\kCSyPiW.exe
  2⤵
  PID:6232
- C:\Windows\System\tmsQcUe.exe
  C:\Windows\System\tmsQcUe.exe
  2⤵
  PID:6528
- C:\Windows\System\QHQOKzo.exe
  C:\Windows\System\QHQOKzo.exe
  2⤵
  PID:6312
- C:\Windows\System\ZXnUclS.exe
  C:\Windows\System\ZXnUclS.exe
  2⤵
  PID:6424
- C:\Windows\System\pSPrmVz.exe
  C:\Windows\System\pSPrmVz.exe
  2⤵
  PID:6464
- C:\Windows\System\OKNbzGj.exe
  C:\Windows\System\OKNbzGj.exe
  2⤵
  PID:6548
- C:\Windows\System\JJZkybE.exe
  C:\Windows\System\JJZkybE.exe
  2⤵
  PID:1568
- C:\Windows\System\AYtUTwM.exe
  C:\Windows\System\AYtUTwM.exe
  2⤵
  PID:6300
- C:\Windows\System\ddfSSFM.exe
  C:\Windows\System\ddfSSFM.exe
  2⤵
  PID:6172
- C:\Windows\System\xKwcvED.exe
  C:\Windows\System\xKwcvED.exe
  2⤵
  PID:6412
- C:\Windows\System\sOlhgBK.exe
  C:\Windows\System\sOlhgBK.exe
  2⤵
  PID:6480
- C:\Windows\System\syqIbBU.exe
  C:\Windows\System\syqIbBU.exe
  2⤵
  PID:6620
- C:\Windows\System\qjWJrBN.exe
  C:\Windows\System\qjWJrBN.exe
  2⤵
  PID:6568
- C:\Windows\System\ZWUrRFj.exe
  C:\Windows\System\ZWUrRFj.exe
  2⤵
  PID:6672
- C:\Windows\System\XQhTmHm.exe
  C:\Windows\System\XQhTmHm.exe
  2⤵
  PID:6744
- C:\Windows\System\yXTnnqL.exe
  C:\Windows\System\yXTnnqL.exe
  2⤵
  PID:6788
- C:\Windows\System\eDYeFXm.exe
  C:\Windows\System\eDYeFXm.exe
  2⤵
  PID:6828
- C:\Windows\System\vaCMDtx.exe
  C:\Windows\System\vaCMDtx.exe
  2⤵
  PID:6700
- C:\Windows\System\zRBEkcS.exe
  C:\Windows\System\zRBEkcS.exe
  2⤵
  PID:6844
- C:\Windows\System\sDGXTaC.exe
  C:\Windows\System\sDGXTaC.exe
  2⤵
  PID:6864
- C:\Windows\System\vDtvHQp.exe
  C:\Windows\System\vDtvHQp.exe
  2⤵
  PID:6932
- C:\Windows\System\sSrjIoS.exe
  C:\Windows\System\sSrjIoS.exe
  2⤵
  PID:6876
- C:\Windows\System\umGxbEg.exe
  C:\Windows\System\umGxbEg.exe
  2⤵
  PID:7024
- C:\Windows\System\KqkNELG.exe
  C:\Windows\System\KqkNELG.exe
  2⤵
  PID:6912
- C:\Windows\System\vRLhBvX.exe
  C:\Windows\System\vRLhBvX.exe
  2⤵
  PID:7056
- C:\Windows\System\koxboCG.exe
  C:\Windows\System\koxboCG.exe
  2⤵
  PID:7088
- C:\Windows\System\RkiUgTh.exe
  C:\Windows\System\RkiUgTh.exe
  2⤵
  PID:7160
- C:\Windows\System\olCNoXD.exe
  C:\Windows\System\olCNoXD.exe
  2⤵
  PID:5636
- C:\Windows\System\RIHgcRX.exe
  C:\Windows\System\RIHgcRX.exe
  2⤵
  PID:7008
- C:\Windows\System\MzXiHHI.exe
  C:\Windows\System\MzXiHHI.exe
  2⤵
  PID:7072
- C:\Windows\System\PTSgKQH.exe
  C:\Windows\System\PTSgKQH.exe
  2⤵
  PID:7140
- C:\Windows\System\dVdJAwg.exe
  C:\Windows\System\dVdJAwg.exe
  2⤵
  PID:5828
- C:\Windows\System\qChYjzU.exe
  C:\Windows\System\qChYjzU.exe
  2⤵
  PID:6116
- C:\Windows\System\FZTJQQT.exe
  C:\Windows\System\FZTJQQT.exe
  2⤵
  PID:6288
- C:\Windows\System\apbUyaA.exe
  C:\Windows\System\apbUyaA.exe
  2⤵
  PID:6188
- C:\Windows\System\IVGkmlO.exe
  C:\Windows\System\IVGkmlO.exe
  2⤵
  PID:5672
- C:\Windows\System\OoqmmLF.exe
  C:\Windows\System\OoqmmLF.exe
  2⤵
  PID:6308
- C:\Windows\System\XcvUKqU.exe
  C:\Windows\System\XcvUKqU.exe
  2⤵
  PID:6508
- C:\Windows\System\PSBxTGW.exe
  C:\Windows\System\PSBxTGW.exe
  2⤵
  PID:6536
- C:\Windows\System\JAyaeQF.exe
  C:\Windows\System\JAyaeQF.exe
  2⤵
  PID:6476
- C:\Windows\System\vTgaJpn.exe
  C:\Windows\System\vTgaJpn.exe
  2⤵
  PID:6608
- C:\Windows\System\nkvEElh.exe
  C:\Windows\System\nkvEElh.exe
  2⤵
  PID:6644
- C:\Windows\System\FKvhvWK.exe
  C:\Windows\System\FKvhvWK.exe
  2⤵
  PID:6728
- C:\Windows\System\lqGYUsz.exe
  C:\Windows\System\lqGYUsz.exe
  2⤵
  PID:6820
- C:\Windows\System\BuaDrGh.exe
  C:\Windows\System\BuaDrGh.exe
  2⤵
  PID:6928
- C:\Windows\System\emynUca.exe
  C:\Windows\System\emynUca.exe
  2⤵
  PID:7124
- C:\Windows\System\sUFeSSa.exe
  C:\Windows\System\sUFeSSa.exe
  2⤵
  PID:7108
- C:\Windows\System\UfhZOax.exe
  C:\Windows\System\UfhZOax.exe
  2⤵
  PID:6696
- C:\Windows\System\vAnDmdA.exe
  C:\Windows\System\vAnDmdA.exe
  2⤵
  PID:6964
- C:\Windows\System\kadXaEJ.exe
  C:\Windows\System\kadXaEJ.exe
  2⤵
  PID:6988
- C:\Windows\System\GYnQnmO.exe
  C:\Windows\System\GYnQnmO.exe
  2⤵
  PID:5344
- C:\Windows\System\xAAJisB.exe
  C:\Windows\System\xAAJisB.exe
  2⤵
  PID:7040
- C:\Windows\System\RQLhKSb.exe
  C:\Windows\System\RQLhKSb.exe
  2⤵
  PID:5844
- C:\Windows\System\OLuVNnx.exe
  C:\Windows\System\OLuVNnx.exe
  2⤵
  PID:6204
- C:\Windows\System\OiQRAPd.exe
  C:\Windows\System\OiQRAPd.exe
  2⤵
  PID:6396
- C:\Windows\System\hsuhvAD.exe
  C:\Windows\System\hsuhvAD.exe
  2⤵
  PID:6340
- C:\Windows\System\ZvgCYHR.exe
  C:\Windows\System\ZvgCYHR.exe
  2⤵
  PID:6564
- C:\Windows\System\LdkcJYA.exe
  C:\Windows\System\LdkcJYA.exe
  2⤵
  PID:6380
- C:\Windows\System\DTHPBBY.exe
  C:\Windows\System\DTHPBBY.exe
  2⤵
  PID:6660
- C:\Windows\System\OzUsukR.exe
  C:\Windows\System\OzUsukR.exe
  2⤵
  PID:7000
- C:\Windows\System\eXpqVTh.exe
  C:\Windows\System\eXpqVTh.exe
  2⤵
  PID:7068
- C:\Windows\System\wjoOvef.exe
  C:\Windows\System\wjoOvef.exe
  2⤵
  PID:6712
- C:\Windows\System\IYCWUBs.exe
  C:\Windows\System\IYCWUBs.exe
  2⤵
  PID:6884
- C:\Windows\System\ePBhpHU.exe
  C:\Windows\System\ePBhpHU.exe
  2⤵
  PID:6768
- C:\Windows\System\udQMeMa.exe
  C:\Windows\System\udQMeMa.exe
  2⤵
  PID:1352
- C:\Windows\System\YJKiLCh.exe
  C:\Windows\System\YJKiLCh.exe
  2⤵
  PID:6360
- C:\Windows\System\BQYsfef.exe
  C:\Windows\System\BQYsfef.exe
  2⤵
  PID:6552
- C:\Windows\System\PqOPpSf.exe
  C:\Windows\System\PqOPpSf.exe
  2⤵
  PID:6148
- C:\Windows\System\RdgQoPM.exe
  C:\Windows\System\RdgQoPM.exe
  2⤵
  PID:6496
- C:\Windows\System\nkonjqN.exe
  C:\Windows\System\nkonjqN.exe
  2⤵
  PID:6272
- C:\Windows\System\oicMzfM.exe
  C:\Windows\System\oicMzfM.exe
  2⤵
  PID:6784
- C:\Windows\System\JHTQxvW.exe
  C:\Windows\System\JHTQxvW.exe
  2⤵
  PID:6512
- C:\Windows\System\phayPOG.exe
  C:\Windows\System\phayPOG.exe
  2⤵
  PID:7052
- C:\Windows\System\hTrixhL.exe
  C:\Windows\System\hTrixhL.exe
  2⤵
  PID:7184
- C:\Windows\System\CwCpRLD.exe
  C:\Windows\System\CwCpRLD.exe
  2⤵
  PID:7200
- C:\Windows\System\lgGKAkm.exe
  C:\Windows\System\lgGKAkm.exe
  2⤵
  PID:7216
- C:\Windows\System\WtzeCaG.exe
  C:\Windows\System\WtzeCaG.exe
  2⤵
  PID:7232
- C:\Windows\System\qadCuhb.exe
  C:\Windows\System\qadCuhb.exe
  2⤵
  PID:7248
- C:\Windows\System\oBEnWwK.exe
  C:\Windows\System\oBEnWwK.exe
  2⤵
  PID:7264
- C:\Windows\System\juKucoj.exe
  C:\Windows\System\juKucoj.exe
  2⤵
  PID:7280
- C:\Windows\System\ThvrMaP.exe
  C:\Windows\System\ThvrMaP.exe
  2⤵
  PID:7296
- C:\Windows\System\llxjqXt.exe
  C:\Windows\System\llxjqXt.exe
  2⤵
  PID:7312
- C:\Windows\System\sriHNXH.exe
  C:\Windows\System\sriHNXH.exe
  2⤵
  PID:7328
- C:\Windows\System\xEZRrVH.exe
  C:\Windows\System\xEZRrVH.exe
  2⤵
  PID:7344
- C:\Windows\System\bWGklQr.exe
  C:\Windows\System\bWGklQr.exe
  2⤵
  PID:7360
- C:\Windows\System\EjiWzdB.exe
  C:\Windows\System\EjiWzdB.exe
  2⤵
  PID:7380
- C:\Windows\System\ktFOegI.exe
  C:\Windows\System\ktFOegI.exe
  2⤵
  PID:7396
- C:\Windows\System\AIEozNc.exe
  C:\Windows\System\AIEozNc.exe
  2⤵
  PID:7412
- C:\Windows\System\TBwwuaz.exe
  C:\Windows\System\TBwwuaz.exe
  2⤵
  PID:7428
- C:\Windows\System\oSKEzUB.exe
  C:\Windows\System\oSKEzUB.exe
  2⤵
  PID:7444
- C:\Windows\System\eKfpUIa.exe
  C:\Windows\System\eKfpUIa.exe
  2⤵
  PID:7460
- C:\Windows\System\KBVhJJV.exe
  C:\Windows\System\KBVhJJV.exe
  2⤵
  PID:7616
- C:\Windows\System\oHBqUWt.exe
  C:\Windows\System\oHBqUWt.exe
  2⤵
  PID:7632
- C:\Windows\System\pjMANUC.exe
  C:\Windows\System\pjMANUC.exe
  2⤵
  PID:7648
- C:\Windows\System\JJvAfAG.exe
  C:\Windows\System\JJvAfAG.exe
  2⤵
  PID:7668
- C:\Windows\System\HeCieWK.exe
  C:\Windows\System\HeCieWK.exe
  2⤵
  PID:7684
- C:\Windows\System\AUGSUis.exe
  C:\Windows\System\AUGSUis.exe
  2⤵
  PID:7704
- C:\Windows\System\isNTWPz.exe
  C:\Windows\System\isNTWPz.exe
  2⤵
  PID:7724
- C:\Windows\System\tmiSuzY.exe
  C:\Windows\System\tmiSuzY.exe
  2⤵
  PID:7740
- C:\Windows\System\WKrmEeH.exe
  C:\Windows\System\WKrmEeH.exe
  2⤵
  PID:7756
- C:\Windows\System\GhNwUMx.exe
  C:\Windows\System\GhNwUMx.exe
  2⤵
  PID:7776
- C:\Windows\System\ZigAfyS.exe
  C:\Windows\System\ZigAfyS.exe
  2⤵
  PID:7904
- C:\Windows\System\ZQEaKAM.exe
  C:\Windows\System\ZQEaKAM.exe
  2⤵
  PID:7924
- C:\Windows\System\zzfyOFk.exe
  C:\Windows\System\zzfyOFk.exe
  2⤵
  PID:7940
- C:\Windows\System\SEYfwza.exe
  C:\Windows\System\SEYfwza.exe
  2⤵
  PID:7956
- C:\Windows\System\mzYKiyX.exe
  C:\Windows\System\mzYKiyX.exe
  2⤵
  PID:7976
- C:\Windows\System\meyYAji.exe
  C:\Windows\System\meyYAji.exe
  2⤵
  PID:7992
- C:\Windows\System\AlPsNIf.exe
  C:\Windows\System\AlPsNIf.exe
  2⤵
  PID:8008
- C:\Windows\System\lMnBxBP.exe
  C:\Windows\System\lMnBxBP.exe
  2⤵
  PID:8028
- C:\Windows\System\VgrbdSN.exe
  C:\Windows\System\VgrbdSN.exe
  2⤵
  PID:8044
- C:\Windows\System\KUnpQLG.exe
  C:\Windows\System\KUnpQLG.exe
  2⤵
  PID:8060
- C:\Windows\System\gwajjLd.exe
  C:\Windows\System\gwajjLd.exe
  2⤵
  PID:8076
- C:\Windows\System\MYEYCEN.exe
  C:\Windows\System\MYEYCEN.exe
  2⤵
  PID:8144
- C:\Windows\System\ESrTALC.exe
  C:\Windows\System\ESrTALC.exe
  2⤵
  PID:6556
- C:\Windows\System\dqwnDGU.exe
  C:\Windows\System\dqwnDGU.exe
  2⤵
  PID:7208
- C:\Windows\System\PoKrcSa.exe
  C:\Windows\System\PoKrcSa.exe
  2⤵
  PID:7288
- C:\Windows\System\sVCUwag.exe
  C:\Windows\System\sVCUwag.exe
  2⤵
  PID:7244
- C:\Windows\System\fnDHKYs.exe
  C:\Windows\System\fnDHKYs.exe
  2⤵
  PID:7356
- C:\Windows\System\nxLUGsu.exe
  C:\Windows\System\nxLUGsu.exe
  2⤵
  PID:7308
- C:\Windows\System\YCFlFGW.exe
  C:\Windows\System\YCFlFGW.exe
  2⤵
  PID:7304
- C:\Windows\System\PHqvsjT.exe
  C:\Windows\System\PHqvsjT.exe
  2⤵
  PID:7376
- C:\Windows\System\KOjzYGZ.exe
  C:\Windows\System\KOjzYGZ.exe
  2⤵
  PID:7468
- C:\Windows\System\vXammko.exe
  C:\Windows\System\vXammko.exe
  2⤵
  PID:7496
- C:\Windows\System\YnhuVVV.exe
  C:\Windows\System\YnhuVVV.exe
  2⤵
  PID:7500
- C:\Windows\System\PmnJPuA.exe
  C:\Windows\System\PmnJPuA.exe
  2⤵
  PID:7520
- C:\Windows\System\rEbmddz.exe
  C:\Windows\System\rEbmddz.exe
  2⤵
  PID:7528
- C:\Windows\System\eRamXBv.exe
  C:\Windows\System\eRamXBv.exe
  2⤵
  PID:7556
- C:\Windows\System\LabNvRq.exe
  C:\Windows\System\LabNvRq.exe
  2⤵
  PID:7572
- C:\Windows\System\ZCHFlTW.exe
  C:\Windows\System\ZCHFlTW.exe
  2⤵
  PID:7588
- C:\Windows\System\ifTNLrt.exe
  C:\Windows\System\ifTNLrt.exe
  2⤵
  PID:7660
- C:\Windows\System\lNLGuAc.exe
  C:\Windows\System\lNLGuAc.exe
  2⤵
  PID:7700
- C:\Windows\System\luOlsEc.exe
  C:\Windows\System\luOlsEc.exe
  2⤵
  PID:7768
- C:\Windows\System\oIZlvnK.exe
  C:\Windows\System\oIZlvnK.exe
  2⤵
  PID:7832
- C:\Windows\System\WJEHtWb.exe
  C:\Windows\System\WJEHtWb.exe
  2⤵
  PID:7860
- C:\Windows\System\ZxFeyyw.exe
  C:\Windows\System\ZxFeyyw.exe
  2⤵
  PID:7876
- C:\Windows\System\UCbJrxa.exe
  C:\Windows\System\UCbJrxa.exe
  2⤵
  PID:7892
- C:\Windows\System\myTUJOH.exe
  C:\Windows\System\myTUJOH.exe
  2⤵
  PID:7916
- C:\Windows\System\XcuKjVd.exe
  C:\Windows\System\XcuKjVd.exe
  2⤵
  PID:7988
- C:\Windows\System\zpPbDzu.exe
  C:\Windows\System\zpPbDzu.exe
  2⤵
  PID:8000
- C:\Windows\System\yoEwRCp.exe
  C:\Windows\System\yoEwRCp.exe
  2⤵
  PID:7968
- C:\Windows\System\MTMIbiN.exe
  C:\Windows\System\MTMIbiN.exe
  2⤵
  PID:8056
- C:\Windows\System\MYLkqUv.exe
  C:\Windows\System\MYLkqUv.exe
  2⤵
  PID:8096
- C:\Windows\System\etpxoVy.exe
  C:\Windows\System\etpxoVy.exe
  2⤵
  PID:8116
- C:\Windows\System\jCVzRUt.exe
  C:\Windows\System\jCVzRUt.exe
  2⤵
  PID:8132
- C:\Windows\System\hQXsmRU.exe
  C:\Windows\System\hQXsmRU.exe
  2⤵
  PID:8152
- C:\Windows\System\Ptvcijm.exe
  C:\Windows\System\Ptvcijm.exe
  2⤵
  PID:8172
- C:\Windows\System\wVGzwEJ.exe
  C:\Windows\System\wVGzwEJ.exe
  2⤵
  PID:6948
- C:\Windows\System\nqWeyIx.exe
  C:\Windows\System\nqWeyIx.exe
  2⤵
  PID:6604
- C:\Windows\System\sdfJHvG.exe
  C:\Windows\System\sdfJHvG.exe
  2⤵
  PID:6732
- C:\Windows\System\eqORBCg.exe
  C:\Windows\System\eqORBCg.exe
  2⤵
  PID:7272
- C:\Windows\System\bmxGQkA.exe
  C:\Windows\System\bmxGQkA.exe
  2⤵
  PID:7368
- C:\Windows\System\JCAQPcT.exe
  C:\Windows\System\JCAQPcT.exe
  2⤵
  PID:7352
- C:\Windows\System\oSyvtYa.exe
  C:\Windows\System\oSyvtYa.exe
  2⤵
  PID:7512
- C:\Windows\System\PlTGPNR.exe
  C:\Windows\System\PlTGPNR.exe
  2⤵
  PID:6772
- C:\Windows\System\GEwrtaW.exe
  C:\Windows\System\GEwrtaW.exe
  2⤵
  PID:7580
- C:\Windows\System\WGXhMkz.exe
  C:\Windows\System\WGXhMkz.exe
  2⤵
  PID:7452
- C:\Windows\System\eKqmcuR.exe
  C:\Windows\System\eKqmcuR.exe
  2⤵
  PID:7492
- C:\Windows\System\nNgGStA.exe
  C:\Windows\System\nNgGStA.exe
  2⤵
  PID:7536
- C:\Windows\System\Exqojgx.exe
  C:\Windows\System\Exqojgx.exe
  2⤵
  PID:7764
- C:\Windows\System\zgKBUbn.exe
  C:\Windows\System\zgKBUbn.exe
  2⤵
  PID:7680
- C:\Windows\System\bMorgAQ.exe
  C:\Windows\System\bMorgAQ.exe
  2⤵
  PID:7612
- C:\Windows\System\BzKbcdc.exe
  C:\Windows\System\BzKbcdc.exe
  2⤵
  PID:7784
- C:\Windows\System\ubqZeOO.exe
  C:\Windows\System\ubqZeOO.exe
  2⤵
  PID:7792
- C:\Windows\System\pdvIVkH.exe
  C:\Windows\System\pdvIVkH.exe
  2⤵
  PID:7816
- C:\Windows\System\sywwEjD.exe
  C:\Windows\System\sywwEjD.exe
  2⤵
  PID:7884
- C:\Windows\System\glnrjio.exe
  C:\Windows\System\glnrjio.exe
  2⤵
  PID:8112
- C:\Windows\System\sFCqgOh.exe
  C:\Windows\System\sFCqgOh.exe
  2⤵
  PID:8124
- C:\Windows\System\vioYyIN.exe
  C:\Windows\System\vioYyIN.exe
  2⤵
  PID:7952
- C:\Windows\System\pnmUimd.exe
  C:\Windows\System\pnmUimd.exe
  2⤵
  PID:8180
- C:\Windows\System\UusIxRw.exe
  C:\Windows\System\UusIxRw.exe
  2⤵
  PID:8160
- C:\Windows\System\PyJkqqU.exe
  C:\Windows\System\PyJkqqU.exe
  2⤵
  PID:7804
- C:\Windows\System\QRGvQVn.exe
  C:\Windows\System\QRGvQVn.exe
  2⤵
  PID:7840
- C:\Windows\System\tOoAPuL.exe
  C:\Windows\System\tOoAPuL.exe
  2⤵
  PID:7896
- C:\Windows\System\tkavUPG.exe
  C:\Windows\System\tkavUPG.exe
  2⤵
  PID:8104
- C:\Windows\System\kTuHTIG.exe
  C:\Windows\System\kTuHTIG.exe
  2⤵
  PID:8040
- C:\Windows\System\QmyGJWN.exe
  C:\Windows\System\QmyGJWN.exe
  2⤵
  PID:8052
- C:\Windows\System\azrXpsu.exe
  C:\Windows\System\azrXpsu.exe
  2⤵
  PID:7228
- C:\Windows\System\mGNUCMN.exe
  C:\Windows\System\mGNUCMN.exe
  2⤵
  PID:7324
- C:\Windows\System\JtQIYJf.exe
  C:\Windows\System\JtQIYJf.exe
  2⤵
  PID:7628
- C:\Windows\System\JKpTYJk.exe
  C:\Windows\System\JKpTYJk.exe
  2⤵
  PID:7544
- C:\Windows\System\ZCdUqLN.exe
  C:\Windows\System\ZCdUqLN.exe
  2⤵
  PID:7696
- C:\Windows\System\RxqZSRa.exe
  C:\Windows\System\RxqZSRa.exe
  2⤵
  PID:7548
- C:\Windows\System\cfkubiM.exe
  C:\Windows\System\cfkubiM.exe
  2⤵
  PID:7748
- C:\Windows\System\GIxiLWK.exe
  C:\Windows\System\GIxiLWK.exe
  2⤵
  PID:7800
- C:\Windows\System\nmZLPEg.exe
  C:\Windows\System\nmZLPEg.exe
  2⤵
  PID:7828
- C:\Windows\System\ZrVYMRw.exe
  C:\Windows\System\ZrVYMRw.exe
  2⤵
  PID:7856
- C:\Windows\System\ujRyPxm.exe
  C:\Windows\System\ujRyPxm.exe
  2⤵
  PID:8088
- C:\Windows\System\BujncRd.exe
  C:\Windows\System\BujncRd.exe
  2⤵
  PID:7848
- C:\Windows\System\qxYFmyt.exe
  C:\Windows\System\qxYFmyt.exe
  2⤵
  PID:8168
- C:\Windows\System\cvXCZYX.exe
  C:\Windows\System\cvXCZYX.exe
  2⤵
  PID:7392
- C:\Windows\System\ZkoRANJ.exe
  C:\Windows\System\ZkoRANJ.exe
  2⤵
  PID:7180
- C:\Windows\System\fSaSush.exe
  C:\Windows\System\fSaSush.exe
  2⤵
  PID:7676
- C:\Windows\System\UBJGJBe.exe
  C:\Windows\System\UBJGJBe.exe
  2⤵
  PID:8252
- C:\Windows\System\GqYaLRj.exe
  C:\Windows\System\GqYaLRj.exe
  2⤵
  PID:8272
- C:\Windows\System\nWKycgW.exe
  C:\Windows\System\nWKycgW.exe
  2⤵
  PID:8296
- C:\Windows\System\EgoHOGw.exe
  C:\Windows\System\EgoHOGw.exe
  2⤵
  PID:8312
- C:\Windows\System\OTSbipf.exe
  C:\Windows\System\OTSbipf.exe
  2⤵
  PID:8328
- C:\Windows\System\JvZubKQ.exe
  C:\Windows\System\JvZubKQ.exe
  2⤵
  PID:8344
- C:\Windows\System\qzXILWD.exe
  C:\Windows\System\qzXILWD.exe
  2⤵
  PID:8360
- C:\Windows\System\ZFAINhw.exe
  C:\Windows\System\ZFAINhw.exe
  2⤵
  PID:8376
- C:\Windows\System\PjJmXvo.exe
  C:\Windows\System\PjJmXvo.exe
  2⤵
  PID:8392
- C:\Windows\System\ARUDuQo.exe
  C:\Windows\System\ARUDuQo.exe
  2⤵
  PID:8408
- C:\Windows\System\SzIqxJn.exe
  C:\Windows\System\SzIqxJn.exe
  2⤵
  PID:8424
- C:\Windows\System\AOYdohi.exe
  C:\Windows\System\AOYdohi.exe
  2⤵
  PID:8440
- C:\Windows\System\VFofnNp.exe
  C:\Windows\System\VFofnNp.exe
  2⤵
  PID:8456
- C:\Windows\System\ilaFhLH.exe
  C:\Windows\System\ilaFhLH.exe
  2⤵
  PID:8472
- C:\Windows\System\IGbTZuq.exe
  C:\Windows\System\IGbTZuq.exe
  2⤵
  PID:8488
- C:\Windows\System\mCbkPiB.exe
  C:\Windows\System\mCbkPiB.exe
  2⤵
  PID:8504
- C:\Windows\System\PaAjaQl.exe
  C:\Windows\System\PaAjaQl.exe
  2⤵
  PID:8520
- C:\Windows\System\qxxqDVl.exe
  C:\Windows\System\qxxqDVl.exe
  2⤵
  PID:8544
- C:\Windows\System\WMOozwR.exe
  C:\Windows\System\WMOozwR.exe
  2⤵
  PID:8560
- C:\Windows\System\dXkekKK.exe
  C:\Windows\System\dXkekKK.exe
  2⤵
  PID:8576
- C:\Windows\System\VsEAFDj.exe
  C:\Windows\System\VsEAFDj.exe
  2⤵
  PID:8592
- C:\Windows\System\UHUyGnu.exe
  C:\Windows\System\UHUyGnu.exe
  2⤵
  PID:8696
- C:\Windows\System\edKyovb.exe
  C:\Windows\System\edKyovb.exe
  2⤵
  PID:8712
- C:\Windows\System\cQHyEtc.exe
  C:\Windows\System\cQHyEtc.exe
  2⤵
  PID:8732
- C:\Windows\System\mSacPnR.exe
  C:\Windows\System\mSacPnR.exe
  2⤵
  PID:8748
- C:\Windows\System\UhXpXob.exe
  C:\Windows\System\UhXpXob.exe
  2⤵
  PID:8764
- C:\Windows\System\UKwKafX.exe
  C:\Windows\System\UKwKafX.exe
  2⤵
  PID:8780
- C:\Windows\System\WuyXVCt.exe
  C:\Windows\System\WuyXVCt.exe
  2⤵
  PID:8800
- C:\Windows\System\WFYWpbr.exe
  C:\Windows\System\WFYWpbr.exe
  2⤵
  PID:8820
- C:\Windows\System\RhkeRSu.exe
  C:\Windows\System\RhkeRSu.exe
  2⤵
  PID:8836
- C:\Windows\System\LjPCGkn.exe
  C:\Windows\System\LjPCGkn.exe
  2⤵
  PID:8856
- C:\Windows\System\zueQvVJ.exe
  C:\Windows\System\zueQvVJ.exe
  2⤵
  PID:8872
- C:\Windows\System\jekPCmA.exe
  C:\Windows\System\jekPCmA.exe
  2⤵
  PID:8888
- C:\Windows\System\KabsGwm.exe
  C:\Windows\System\KabsGwm.exe
  2⤵
  PID:8936
- C:\Windows\System\WwMqsHd.exe
  C:\Windows\System\WwMqsHd.exe
  2⤵
  PID:8952
- C:\Windows\System\ofvpciX.exe
  C:\Windows\System\ofvpciX.exe
  2⤵
  PID:8968
- C:\Windows\System\NrPlPhi.exe
  C:\Windows\System\NrPlPhi.exe
  2⤵
  PID:8988
- C:\Windows\System\bzfydGN.exe
  C:\Windows\System\bzfydGN.exe
  2⤵
  PID:9008
- C:\Windows\System\PrxRdoe.exe
  C:\Windows\System\PrxRdoe.exe
  2⤵
  PID:9028
- C:\Windows\System\KtYXrNb.exe
  C:\Windows\System\KtYXrNb.exe
  2⤵
  PID:9044
- C:\Windows\System\ZUFrbEI.exe
  C:\Windows\System\ZUFrbEI.exe
  2⤵
  PID:9064
- C:\Windows\System\ExcTcmO.exe
  C:\Windows\System\ExcTcmO.exe
  2⤵
  PID:9084
- C:\Windows\System\BaUxIjb.exe
  C:\Windows\System\BaUxIjb.exe
  2⤵
  PID:9104
- C:\Windows\System\QhWqHxb.exe
  C:\Windows\System\QhWqHxb.exe
  2⤵
  PID:9124
- C:\Windows\System\PscjbRk.exe
  C:\Windows\System\PscjbRk.exe
  2⤵
  PID:9140
- C:\Windows\System\OBClWkQ.exe
  C:\Windows\System\OBClWkQ.exe
  2⤵
  PID:9168
- C:\Windows\System\GbrtqJt.exe
  C:\Windows\System\GbrtqJt.exe
  2⤵
  PID:9184
- C:\Windows\System\xkKZnLk.exe
  C:\Windows\System\xkKZnLk.exe
  2⤵
  PID:9200
- C:\Windows\System\JMjWnfO.exe
  C:\Windows\System\JMjWnfO.exe
  2⤵
  PID:7872
- C:\Windows\System\LqTuRDV.exe
  C:\Windows\System\LqTuRDV.exe
  2⤵
  PID:7736
- C:\Windows\System\VvXhJtc.exe
  C:\Windows\System\VvXhJtc.exe
  2⤵
  PID:7788
- C:\Windows\System\PSvTrAk.exe
  C:\Windows\System\PSvTrAk.exe
  2⤵
  PID:7488
- C:\Windows\System\QvjpFvd.exe
  C:\Windows\System\QvjpFvd.exe
  2⤵
  PID:7600
- C:\Windows\System\HNrDceQ.exe
  C:\Windows\System\HNrDceQ.exe
  2⤵
  PID:8212
- C:\Windows\System\FTvTfME.exe
  C:\Windows\System\FTvTfME.exe
  2⤵
  PID:8216
- C:\Windows\System\GyAIitQ.exe
  C:\Windows\System\GyAIitQ.exe
  2⤵
  PID:8240
- C:\Windows\System\fLRuIlQ.exe
  C:\Windows\System\fLRuIlQ.exe
  2⤵
  PID:7420
- C:\Windows\System\VNTVEnR.exe
  C:\Windows\System\VNTVEnR.exe
  2⤵
  PID:8260
- C:\Windows\System\sHDYIVy.exe
  C:\Windows\System\sHDYIVy.exe
  2⤵
  PID:8284
- C:\Windows\System\Aufwheh.exe
  C:\Windows\System\Aufwheh.exe
  2⤵
  PID:8292
- C:\Windows\System\bopOFxD.exe
  C:\Windows\System\bopOFxD.exe
  2⤵
  PID:8340
- C:\Windows\System\QYhUMrL.exe
  C:\Windows\System\QYhUMrL.exe
  2⤵
  PID:8372
- C:\Windows\System\dJTToNv.exe
  C:\Windows\System\dJTToNv.exe
  2⤵
  PID:8404
- C:\Windows\System\mKfsBCC.exe
  C:\Windows\System\mKfsBCC.exe
  2⤵
  PID:8480
- C:\Windows\System\kioGdnW.exe
  C:\Windows\System\kioGdnW.exe
  2⤵
  PID:8516
- C:\Windows\System\lFtPwqi.exe
  C:\Windows\System\lFtPwqi.exe
  2⤵
  PID:8496
- C:\Windows\System\RYwDAWf.exe
  C:\Windows\System\RYwDAWf.exe
  2⤵
  PID:8540
- C:\Windows\System\YNALmQI.exe
  C:\Windows\System\YNALmQI.exe
  2⤵
  PID:8572
- C:\Windows\System\ayqPmNA.exe
  C:\Windows\System\ayqPmNA.exe
  2⤵
  PID:8600
- C:\Windows\System\QEILOKZ.exe
  C:\Windows\System\QEILOKZ.exe
  2⤵
  PID:8632
- C:\Windows\System\rOfhPWe.exe
  C:\Windows\System\rOfhPWe.exe
  2⤵
  PID:8616
- C:\Windows\System\NkcXcPX.exe
  C:\Windows\System\NkcXcPX.exe
  2⤵
  PID:8648
- C:\Windows\System\mxtnfLJ.exe
  C:\Windows\System\mxtnfLJ.exe
  2⤵
  PID:8660
- C:\Windows\System\PbWlaUR.exe
  C:\Windows\System\PbWlaUR.exe
  2⤵
  PID:8816
- C:\Windows\System\cdYuAhR.exe
  C:\Windows\System\cdYuAhR.exe
  2⤵
  PID:8900
- C:\Windows\System\ruZRxHM.exe
  C:\Windows\System\ruZRxHM.exe
  2⤵
  PID:8976
- C:\Windows\System\oHAwBVL.exe
  C:\Windows\System\oHAwBVL.exe
  2⤵
  PID:8904
- C:\Windows\System\ZsHtLaC.exe
  C:\Windows\System\ZsHtLaC.exe
  2⤵
  PID:8980
- C:\Windows\System\DaLsZbc.exe
  C:\Windows\System\DaLsZbc.exe
  2⤵
  PID:9024
- C:\Windows\System\rlRypuG.exe
  C:\Windows\System\rlRypuG.exe
  2⤵
  PID:9092
- C:\Windows\System\ulMGpEB.exe
  C:\Windows\System\ulMGpEB.exe
  2⤵
  PID:9080
- C:\Windows\System\lNzUgxm.exe
  C:\Windows\System\lNzUgxm.exe
  2⤵
  PID:9072
- C:\Windows\System\WmljCBH.exe
  C:\Windows\System\WmljCBH.exe
  2⤵
  PID:9036
- C:\Windows\System\HbRtsxn.exe
  C:\Windows\System\HbRtsxn.exe
  2⤵
  PID:9148
- C:\Windows\System\MHMIFax.exe
  C:\Windows\System\MHMIFax.exe
  2⤵
  PID:9180
- C:\Windows\System\vXUXaEY.exe
  C:\Windows\System\vXUXaEY.exe
  2⤵
  PID:7476
- C:\Windows\System\uayEHfN.exe
  C:\Windows\System\uayEHfN.exe
  2⤵
  PID:7644
- C:\Windows\System\SOSVhRX.exe
  C:\Windows\System\SOSVhRX.exe
  2⤵
  PID:8452
- C:\Windows\System\IEnlwhz.exe
  C:\Windows\System\IEnlwhz.exe
  2⤵
  PID:8356
- C:\Windows\System\kQbJoAm.exe
  C:\Windows\System\kQbJoAm.exe
  2⤵
  PID:8432
- C:\Windows\System\BAcGgJV.exe
  C:\Windows\System\BAcGgJV.exe
  2⤵
  PID:8644
- C:\Windows\System\qbmBSpz.exe
  C:\Windows\System\qbmBSpz.exe
  2⤵
  PID:8704
- C:\Windows\System\NEZwGbC.exe
  C:\Windows\System\NEZwGbC.exe
  2⤵
  PID:8236
- C:\Windows\System\UjDmTAv.exe
  C:\Windows\System\UjDmTAv.exe
  2⤵
  PID:8848
- C:\Windows\System\XLdsAgB.exe
  C:\Windows\System\XLdsAgB.exe
  2⤵
  PID:8772
- C:\Windows\System\soKtrCM.exe
  C:\Windows\System\soKtrCM.exe
  2⤵
  PID:8684
- C:\Windows\System\vDCGKYn.exe
  C:\Windows\System\vDCGKYn.exe
  2⤵
  PID:8920
- C:\Windows\System\mJHqxmb.exe
  C:\Windows\System\mJHqxmb.exe
  2⤵
  PID:8960
- C:\Windows\System\ItnTZSy.exe
  C:\Windows\System\ItnTZSy.exe
  2⤵
  PID:9132
- C:\Windows\System\cPuhaIP.exe
  C:\Windows\System\cPuhaIP.exe
  2⤵
  PID:8944
- C:\Windows\System\pZdTIcP.exe
  C:\Windows\System\pZdTIcP.exe
  2⤵
  PID:8928
- C:\Windows\System\TLZLiie.exe
  C:\Windows\System\TLZLiie.exe
  2⤵
  PID:9056
- C:\Windows\System\PUCrVWr.exe
  C:\Windows\System\PUCrVWr.exe
  2⤵
  PID:9116
- C:\Windows\System\PoknoUP.exe
  C:\Windows\System\PoknoUP.exe
  2⤵
  PID:8268
- C:\Windows\System\FMBZWnu.exe
  C:\Windows\System\FMBZWnu.exe
  2⤵
  PID:8584
- C:\Windows\System\vRUEkdS.exe
  C:\Windows\System\vRUEkdS.exe
  2⤵
  PID:7888
- C:\Windows\System\vSCUvmg.exe
  C:\Windows\System\vSCUvmg.exe
  2⤵
  PID:8608
- C:\Windows\System\BKgTMea.exe
  C:\Windows\System\BKgTMea.exe
  2⤵
  PID:8884
- C:\Windows\System\ciUsOja.exe
  C:\Windows\System\ciUsOja.exe
  2⤵
  PID:8792
- C:\Windows\System\rpwTPmp.exe
  C:\Windows\System\rpwTPmp.exe
  2⤵
  PID:8916
- C:\Windows\System\SSiNvyY.exe
  C:\Windows\System\SSiNvyY.exe
  2⤵
  PID:9160
- C:\Windows\System\KqyyCiw.exe
  C:\Windows\System\KqyyCiw.exe
  2⤵
  PID:9156
- C:\Windows\System\salAXKu.exe
  C:\Windows\System\salAXKu.exe
  2⤵
  PID:8368
- C:\Windows\System\XKYhEMC.exe
  C:\Windows\System\XKYhEMC.exe
  2⤵
  PID:9276
- C:\Windows\System\XVLwnEm.exe
  C:\Windows\System\XVLwnEm.exe
  2⤵
  PID:9292
- C:\Windows\System\igmZQnV.exe
  C:\Windows\System\igmZQnV.exe
  2⤵
  PID:9308
- C:\Windows\System\TNOAMBK.exe
  C:\Windows\System\TNOAMBK.exe
  2⤵
  PID:9324
- C:\Windows\System\CniDoQy.exe
  C:\Windows\System\CniDoQy.exe
  2⤵
  PID:9340
- C:\Windows\System\rxjbhSl.exe
  C:\Windows\System\rxjbhSl.exe
  2⤵
  PID:9356
- C:\Windows\System\dkrMaCX.exe
  C:\Windows\System\dkrMaCX.exe
  2⤵
  PID:9408
- C:\Windows\System\TtXcYRx.exe
  C:\Windows\System\TtXcYRx.exe
  2⤵
  PID:9424
- C:\Windows\System\NixcSHL.exe
  C:\Windows\System\NixcSHL.exe
  2⤵
  PID:9440
- C:\Windows\System\ALNLrjs.exe
  C:\Windows\System\ALNLrjs.exe
  2⤵
  PID:9456
- C:\Windows\System\GNADsnQ.exe
  C:\Windows\System\GNADsnQ.exe
  2⤵
  PID:9480
- C:\Windows\System\wDaItin.exe
  C:\Windows\System\wDaItin.exe
  2⤵
  PID:9500
- C:\Windows\System\mnspNPy.exe
  C:\Windows\System\mnspNPy.exe
  2⤵
  PID:9516
- C:\Windows\System\OMUZvyR.exe
  C:\Windows\System\OMUZvyR.exe
  2⤵
  PID:9532
- C:\Windows\System\HOBzlds.exe
  C:\Windows\System\HOBzlds.exe
  2⤵
  PID:9548
- C:\Windows\System\MBsBrOE.exe
  C:\Windows\System\MBsBrOE.exe
  2⤵
  PID:9576
- C:\Windows\System\yshimFv.exe
  C:\Windows\System\yshimFv.exe
  2⤵
  PID:9592
- C:\Windows\System\otnZYmF.exe
  C:\Windows\System\otnZYmF.exe
  2⤵
  PID:9608
- C:\Windows\System\wUlGBmX.exe
  C:\Windows\System\wUlGBmX.exe
  2⤵
  PID:9624
- C:\Windows\System\dSOfvIw.exe
  C:\Windows\System\dSOfvIw.exe
  2⤵
  PID:9640
- C:\Windows\System\gDVAxOO.exe
  C:\Windows\System\gDVAxOO.exe
  2⤵
  PID:9656
- C:\Windows\System\qUdluiU.exe
  C:\Windows\System\qUdluiU.exe
  2⤵
  PID:9672
- C:\Windows\System\IgrEkLI.exe
  C:\Windows\System\IgrEkLI.exe
  2⤵
  PID:9688
- C:\Windows\System\IduDRcd.exe
  C:\Windows\System\IduDRcd.exe
  2⤵
  PID:9704
- C:\Windows\System\xYPAfKw.exe
  C:\Windows\System\xYPAfKw.exe
  2⤵
  PID:9720
- C:\Windows\System\NMgjvzl.exe
  C:\Windows\System\NMgjvzl.exe
  2⤵
  PID:9736
- C:\Windows\System\OYMAyqt.exe
  C:\Windows\System\OYMAyqt.exe
  2⤵
  PID:9752
- C:\Windows\System\OFYZvvO.exe
  C:\Windows\System\OFYZvvO.exe
  2⤵
  PID:9768
- C:\Windows\System\oBioDuZ.exe
  C:\Windows\System\oBioDuZ.exe
  2⤵
  PID:9784
- C:\Windows\System\fTQUIdb.exe
  C:\Windows\System\fTQUIdb.exe
  2⤵
  PID:9800
- C:\Windows\System\TyWiYoh.exe
  C:\Windows\System\TyWiYoh.exe
  2⤵
  PID:9816
- C:\Windows\System\GnZDPbp.exe
  C:\Windows\System\GnZDPbp.exe
  2⤵
  PID:9832
- C:\Windows\System\udsExEx.exe
  C:\Windows\System\udsExEx.exe
  2⤵
  PID:9848
- C:\Windows\System\SlAuPhO.exe
  C:\Windows\System\SlAuPhO.exe
  2⤵
  PID:9864
- C:\Windows\System\DIyrPUP.exe
  C:\Windows\System\DIyrPUP.exe
  2⤵
  PID:9880
- C:\Windows\System\djYFMLd.exe
  C:\Windows\System\djYFMLd.exe
  2⤵
  PID:9900
- C:\Windows\System\CsNHsZy.exe
  C:\Windows\System\CsNHsZy.exe
  2⤵
  PID:10008
- C:\Windows\System\uFHCIXQ.exe
  C:\Windows\System\uFHCIXQ.exe
  2⤵
  PID:10028
- C:\Windows\System\SgNdrTf.exe
  C:\Windows\System\SgNdrTf.exe
  2⤵
  PID:10044
- C:\Windows\System\nMapbEl.exe
  C:\Windows\System\nMapbEl.exe
  2⤵
  PID:10088
- C:\Windows\System\LrGnmnX.exe
  C:\Windows\System\LrGnmnX.exe
  2⤵
  PID:10104
- C:\Windows\System\YOgDjKl.exe
  C:\Windows\System\YOgDjKl.exe
  2⤵
  PID:10120
- C:\Windows\System\EvEeFkA.exe
  C:\Windows\System\EvEeFkA.exe
  2⤵
  PID:10144
- C:\Windows\System\jYNGpdf.exe
  C:\Windows\System\jYNGpdf.exe
  2⤵
  PID:10160
- C:\Windows\System\sETpwJY.exe
  C:\Windows\System\sETpwJY.exe
  2⤵
  PID:10180
- C:\Windows\System\IZlNABe.exe
  C:\Windows\System\IZlNABe.exe
  2⤵
  PID:10196
- C:\Windows\System\xiJfvIR.exe
  C:\Windows\System\xiJfvIR.exe
  2⤵
  PID:10236
- C:\Windows\System\ztJtOnm.exe
  C:\Windows\System\ztJtOnm.exe
  2⤵
  PID:9020
- C:\Windows\System\RcTWJCV.exe
  C:\Windows\System\RcTWJCV.exe
  2⤵
  PID:9192
- C:\Windows\System\ZnAqIXR.exe
  C:\Windows\System\ZnAqIXR.exe
  2⤵
  PID:7812
- C:\Windows\System\McCcmSe.exe
  C:\Windows\System\McCcmSe.exe
  2⤵
  PID:8208
- C:\Windows\System\HSzmFZZ.exe
  C:\Windows\System\HSzmFZZ.exe
  2⤵
  PID:8248
- C:\Windows\System\sNFYqXC.exe
  C:\Windows\System\sNFYqXC.exe
  2⤵
  PID:8692
- C:\Windows\System\oaMVnsz.exe
  C:\Windows\System\oaMVnsz.exe
  2⤵
  PID:8808
- C:\Windows\System\bDvsnBx.exe
  C:\Windows\System\bDvsnBx.exe
  2⤵
  PID:9136
- C:\Windows\System\aNkDYSo.exe
  C:\Windows\System\aNkDYSo.exe
  2⤵
  PID:8224
- C:\Windows\System\UYrlBbD.exe
  C:\Windows\System\UYrlBbD.exe
  2⤵
  PID:8740
- C:\Windows\System\vmjLLPr.exe
  C:\Windows\System\vmjLLPr.exe
  2⤵
  PID:9000
- C:\Windows\System\eFYoDbd.exe
  C:\Windows\System\eFYoDbd.exe
  2⤵
  PID:9228
- C:\Windows\System\LlLCzaW.exe
  C:\Windows\System\LlLCzaW.exe
  2⤵
  PID:9248
- C:\Windows\System\VzwQanG.exe
  C:\Windows\System\VzwQanG.exe
  2⤵
  PID:9264
- C:\Windows\System\OaaRffG.exe
  C:\Windows\System\OaaRffG.exe
  2⤵
  PID:8436
- C:\Windows\System\BgtohUR.exe
  C:\Windows\System\BgtohUR.exe
  2⤵
  PID:9300
- C:\Windows\System\QnNymWu.exe
  C:\Windows\System\QnNymWu.exe
  2⤵
  PID:9372
- C:\Windows\System\iCxyAoh.exe
  C:\Windows\System\iCxyAoh.exe
  2⤵
  PID:9388
- C:\Windows\System\DYpENVq.exe
  C:\Windows\System\DYpENVq.exe
  2⤵
  PID:7920
- C:\Windows\System\uxGrUGJ.exe
  C:\Windows\System\uxGrUGJ.exe
  2⤵
  PID:9452
- C:\Windows\System\IWHzhZB.exe
  C:\Windows\System\IWHzhZB.exe
  2⤵
  PID:9468
- C:\Windows\System\ycyKgZA.exe
  C:\Windows\System\ycyKgZA.exe
  2⤵
  PID:9512
- C:\Windows\System\CBJiCQR.exe
  C:\Windows\System\CBJiCQR.exe
  2⤵
  PID:9488
- C:\Windows\System\vqpESAZ.exe
  C:\Windows\System\vqpESAZ.exe
  2⤵
  PID:9568
- C:\Windows\System\YqPyDKR.exe
  C:\Windows\System\YqPyDKR.exe
  2⤵
  PID:9572
- C:\Windows\System\LbWMItW.exe
  C:\Windows\System\LbWMItW.exe
  2⤵
  PID:9636
- C:\Windows\System\CEuPdzH.exe
  C:\Windows\System\CEuPdzH.exe
  2⤵
  PID:9620
- C:\Windows\System\CSDRTgv.exe
  C:\Windows\System\CSDRTgv.exe
  2⤵
  PID:9860
- C:\Windows\System\XaSzSpl.exe
  C:\Windows\System\XaSzSpl.exe
  2⤵
  PID:9684
- C:\Windows\System\EldmhOw.exe
  C:\Windows\System\EldmhOw.exe
  2⤵
  PID:9780
- C:\Windows\System\HdflpqS.exe
  C:\Windows\System\HdflpqS.exe
  2⤵
  PID:9876
- C:\Windows\System\vqKUNXs.exe
  C:\Windows\System\vqKUNXs.exe
  2⤵
  PID:9872
- C:\Windows\System\BruTPYj.exe
  C:\Windows\System\BruTPYj.exe
  2⤵
  PID:9916
- C:\Windows\System\WXtOsuW.exe
  C:\Windows\System\WXtOsuW.exe
  2⤵
  PID:9932
- C:\Windows\System\iDANBBM.exe
  C:\Windows\System\iDANBBM.exe
  2⤵
  PID:9944
- C:\Windows\System\tVwVXUW.exe
  C:\Windows\System\tVwVXUW.exe
  2⤵
  PID:9976
- C:\Windows\System\fyOdBAV.exe
  C:\Windows\System\fyOdBAV.exe
  2⤵
  PID:9968
- C:\Windows\System\xQoVmzS.exe
  C:\Windows\System\xQoVmzS.exe
  2⤵
  PID:10016
- C:\Windows\System\REQAMSG.exe
  C:\Windows\System\REQAMSG.exe
  2⤵
  PID:10040
- C:\Windows\System\tXPFwuW.exe
  C:\Windows\System\tXPFwuW.exe
  2⤵
  PID:10060
- C:\Windows\System\gwyWOFV.exe
  C:\Windows\System\gwyWOFV.exe
  2⤵
  PID:10068
- C:\Windows\System\itwkgfc.exe
  C:\Windows\System\itwkgfc.exe
  2⤵
  PID:10096
- C:\Windows\System\cGPBjrO.exe
  C:\Windows\System\cGPBjrO.exe
  2⤵
  PID:10224
- C:\Windows\System\pIIiAZu.exe
  C:\Windows\System\pIIiAZu.exe
  2⤵
  PID:8912
- C:\Windows\System\ToPIOoL.exe
  C:\Windows\System\ToPIOoL.exe
  2⤵
  PID:8652
- C:\Windows\System\xoualiY.exe
  C:\Windows\System\xoualiY.exe
  2⤵
  PID:8024
- C:\Windows\System\zvXfFml.exe
  C:\Windows\System\zvXfFml.exe
  2⤵
  PID:9164
- C:\Windows\System\NGvKIRt.exe
  C:\Windows\System\NGvKIRt.exe
  2⤵
  PID:9236
- C:\Windows\System\yXHQjzc.exe
  C:\Windows\System\yXHQjzc.exe
  2⤵
  PID:8776
- C:\Windows\System\WFJdEsx.exe
  C:\Windows\System\WFJdEsx.exe
  2⤵
  PID:9260
- C:\Windows\System\oTfDbnr.exe
  C:\Windows\System\oTfDbnr.exe
  2⤵
  PID:8964
- C:\Windows\System\zHWdInX.exe
  C:\Windows\System\zHWdInX.exe
  2⤵
  PID:9352
- C:\Windows\System\WrLbFmu.exe
  C:\Windows\System\WrLbFmu.exe
  2⤵
  PID:9364
- C:\Windows\System\KnEmwjb.exe
  C:\Windows\System\KnEmwjb.exe
  2⤵
  PID:9564
- C:\Windows\System\fWhvMUt.exe
  C:\Windows\System\fWhvMUt.exe
  2⤵
  PID:9732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CeAtYDM.exe

Filesize
1.4MB

MD5
d311a15630e1a26dbbef2405ea9fdea5

SHA1
2e878e578f81a5377df09b914b4ea1e8a280066b

SHA256
0b4a163a4de06a56a6dadb2ef9c724fa61df039e98469478f2feacb0e72788bb

SHA512
193cb8fcc0a141d976a6df32a488c6383e9873916b5b1492df008da943365619b1238274ab922de21c6b16ee0b902ba5a95a470aa9a2e20bbfdb28aa8c4a0911

Download Submit
C:\Windows\system\CeQtpZC.exe

Filesize
1.4MB

MD5
ebd43df1c5f15e3021d46fe46e45b95b

SHA1
c4e8f97ea6858376d6154c65df135eb198df43b9

SHA256
5bd8c7e13aa68bbda32112a52cf76194e24749dad7b836649e7234355735e79a

SHA512
dc6ea1b80dfc651fa4a04f19bacb10b13eb9aafb2390422f1953b295498128399f0ad5f56f04c0f42cf49bc2e6b297c0865cbc5e0c10b39b313cb32baee7dde6

Download Submit
C:\Windows\system\DSisVrv.exe

Filesize
1.4MB

MD5
559b16c88087a6c4120501ad07c13f6a

SHA1
0e63668f9162af3c50cb6412ad95c150b9aa048f

SHA256
91015a82d2e06c0af93f90c2dc82551edf493c8408f683e0e77ad2e12f160c07

SHA512
c0deaf09fe9672a9bada3a870bc714d70b63fbbcacc52cf4060ff3165cc340c37924a6fa57570df59dd39bd62774a6b557669f149fb85480bc894fc460ae1a8b

Download Submit
C:\Windows\system\Ejkrrwr.exe

Filesize
1.4MB

MD5
e30d126cd035a65ba45e1ce553f33980

SHA1
2297c7eac2f8748d3208999153a51d002587bb1e

SHA256
12084e0c8eb573d72fc18f2a5c9ee63f429ec874c4a0404d7b568d2bb8ed683f

SHA512
14639f7c887966dd08e07a4bb114c52025eece6edcc45ea835993eeabc016dcf24e31d9a1d6783ab2e209abaf9b1373e23a456222d9572b1a053272d3d1f3536

Download Submit
C:\Windows\system\FrZDBUZ.exe

Filesize
1.4MB

MD5
3159f544c31b93425ac1fb708b3d02ad

SHA1
7190106a36fe87355876490e7f95dd47d76527e5

SHA256
7f8679f2ebed138297971e384b3c0e932ed546f47ee45c7fe40e0a3a27cb793a

SHA512
45f2e4f375a03cefb7258b0262fdebda447546a45fbf714f8e9897f62af59a32cb6e10a57a8d484eeb416bcfcc51671cd0bc3c0e620ebba542a29fcb41a13213

Download Submit
C:\Windows\system\GFAgtfI.exe

Filesize
1.4MB

MD5
cc52669ea5852905bbd9dd38d153875f

SHA1
f861f0b39c21bfca8ab91809b358910d809a619c

SHA256
aea69d56fab0c0a101a40791b4219c720fa78e4380f52b4b01174fb74fab07bc

SHA512
5c6c2b96a2599595ac0180a23c7d6cf78dc3910fccd888f0afda815c1ce4bad89d023cd69cd523d2481363864abd6567b18c95354e598026ca23b2539d0d5175

Download Submit
C:\Windows\system\KiuQkTI.exe

Filesize
1.4MB

MD5
94ae03e69c412455f0faddf9af59c77a

SHA1
11c5a6aa849de8caf1b833a630ca5ecaa7f48325

SHA256
a7e335ece3372ba5de244149672df042945eb693de10542c8f0213ce7c47409b

SHA512
aed23dcb6443187df937c2a2e18003ea5d5d4f0dcbfff8e31d47203682eeb78cd29abc4994bac6807decf070984df056c2ed5e4bbc0979521f7612ad0f9eb69d

Download Submit
C:\Windows\system\MDUqfeV.exe

Filesize
1.4MB

MD5
eb9f9005d9ee9ea88d68d686a4292daa

SHA1
d897b563748c8f3029237afcee62027c76b111fb

SHA256
99f807c100fd0dc54b6cac5a83cd0e7baec73fa3a8e51836326dd6e15a7db73c

SHA512
ae8847df5f9863bc0e66e861567340bd5e85c124432d68e6f96c0c5b66008fe4d25be044c03f170484bded12af245f50c782c4707d3730dc70c58441be12c0c5

Download Submit
C:\Windows\system\NIxvtOy.exe

Filesize
1.4MB

MD5
257a90acce28451a0b3e760bf59c1a9a

SHA1
70adbddf9db5563360de1c165d262c203c2673e6

SHA256
dab9221bed2e00b814f227a1ad888a7d4c6b553b0b530ae540d7afa1c7c8d624

SHA512
0a5eb9ca190a67b686b926d5771d50c3469e1a241cf374391829b19585e2671338fb119ab82d6d29958df9bc8260f149afc31b5b7af75d78b23737d7c575ac39

Download Submit
C:\Windows\system\NvnwVnm.exe

Filesize
1.4MB

MD5
e0073e64b60d963592ff48a8df294467

SHA1
a810b69c9c2000234c9f3e08a092985b42eb49e2

SHA256
38099008e94c09c4150df0fba474fdf16fec36d875746f8b0cb34197cb84af7b

SHA512
fb158e66cd8cae0cf5638f10a791a1e17d6104f44f013aa11222d4c2b895fdc6e0c0da4738df602ccd814518fbb66cd59683c7244e77a96c17b841362da7820e

Download Submit
C:\Windows\system\UjAcWkj.exe

Filesize
1.4MB

MD5
797a720f16c4fb41ff3f5dceb1ef2a47

SHA1
aaef4e76ddde01ec87b7ce678a5506c712926f37

SHA256
3ffbc7e6840032d39d063c775e6849b6a78e5f757f400e04906764bd16107f35

SHA512
e72751951319dcadaeab74174c9e49b18b5a30d9c6f5131232c7f2a9942aec91ba7cd62a7247c4380779af582c5324de93c717becec6dfec09172828294c77f2

Download Submit
C:\Windows\system\VTbvRok.exe

Filesize
1.4MB

MD5
18bf09b20889a3961df348a029304890

SHA1
5466eae4b39833fc9485b6c1cea1d4e85acfb631

SHA256
128df932603672acf6f534d099b0cedc7396cf88c06614cc18c343cf646f9b36

SHA512
e671e195a4c93d9d0ca66a206c4f687650d52c575b9a44fc84a2bcc01ff6e732d019bb05fd2884907c9f313a6dd53b4668ad0f6fae8e723af4335e256fe7a8c6

Download Submit
C:\Windows\system\VZWjLMq.exe

Filesize
1.4MB

MD5
728819d6b8edd73b1a4c08a2a8bc552c

SHA1
03302918c20674eaf1bd3083773ad70c0c29b1bf

SHA256
565148a680b3736ff76cf7577f43975da94ef5b80d0165a181809de3b482d975

SHA512
5bb324f5d617da42f00f2c03ab84f234f74b9a21f04bc4944b983ea40e399b323f299be006d214991881280459a1f61cecaee2ec30ed0f7b6c01d3c89d782f88

Download Submit
C:\Windows\system\VhrtdYb.exe

Filesize
1.4MB

MD5
4ddaa4135225ec847d29cc05daae5831

SHA1
9f1ea5454229907831a0a46f13fb766d04f21f1b

SHA256
7287502de3943793391b36c763134d1d2a103b0e3f2fd53688114ce522b57f9d

SHA512
d02860ffb98c2d4d6aea6eeca9c33022f07360dc73f698a9572983b6f3a5b9f40e9d98a7e64c18916d63c59370629d95d27e30a654dd5c1103dc047d78776912

Download Submit
C:\Windows\system\Vhxmmyh.exe

Filesize
1.4MB

MD5
626acd8d60a298af84a657cf123c705c

SHA1
8e2c5d2b186f57d6e610215dcbb339b986689169

SHA256
fa23bab052fe5f179299449fed2bcebfb3467dbb7d6499b21e0873b2748ff960

SHA512
3477259994f3aa63abb2be1f7130a80d70e0d169c7e75e8e9b73db45ff50987b375252a596400b5a75bb6fab88e6e1e336adca25c50fa486e44c5e6ce2305ebc

Download Submit
C:\Windows\system\djjSXtf.exe

Filesize
1.4MB

MD5
424137e93a6dbe4a52e4c9af37f15a69

SHA1
0c1c54195c67be34e48617f1f091a34dc908ffbe

SHA256
2f504d17f6cb1d64dd05d1d9c3f9d5d8cf80db7fe9464a940374b71ecf0c7409

SHA512
7bb43e106960d71c1c2e20de5d50e6ecf12845fa101c2212c2dc083ae771b6b1fa87c797935bb9ed08941762d7a327c2e256f76ac7c5fff10b7d9e3881f0e6fa

Download Submit
C:\Windows\system\lAesIhn.exe

Filesize
1.4MB

MD5
7a78d0212909434c3b8833fa0046eecc

SHA1
c9c2db04e338b64ceb2082584858bc223df21ccf

SHA256
0ae8de4ae1d3c945f54a241646a023ba29f1870b7e4e2a73495206b52b2b54ba

SHA512
b9863a6a1facf10cea18d9e6a9a7baa5e1f2e914821d321b556eee5bf5eb60c720d045ad4f614da35005c0a7291d40767d2fc10f15be42caff790c3152ffdb38

Download Submit
C:\Windows\system\lsQohiz.exe

Filesize
1.4MB

MD5
e889bb10a4c88223862d70d25119aa5e

SHA1
4de70cbd56a2cf8aa65e8d345d8e6b0f88332b14

SHA256
44614fcd3e5b525a95cc5211b33b280a3baee6540f2584885495cca2fe5c0078

SHA512
fd1c4140542a4cf4de72ce270a173079553077be17e0ad2456c4e35f1fb7d6d1136abdebf4fbf079e84a7364c47b58710762c3d7aa8bb70a0f71634acac65b08

Download Submit
C:\Windows\system\mYPpeTo.exe

Filesize
1.4MB

MD5
a688e0406b1671a5495272cebdbd475f

SHA1
71f4970e8404f67d42730b62a74eb9d13e3d9b2f

SHA256
2483a708d4dfbe1b125db0232e21b540eb14886f8e80227eaff293db446e645d

SHA512
e486f24caec7255eddf43bd6daf8b16d02c666601e4d802ac33a8b397556cecb00e395d7e480a3d1a302ea731ebf17bb2b9faf6c1b9b5995edc4dfe174e753f7

Download Submit
C:\Windows\system\naCtRrx.exe

Filesize
1.4MB

MD5
d471c3b34f6f838df3c856d644496f79

SHA1
af40e893411a59af9c454ce74973e727148d2a5c

SHA256
d32f4e48d625bb5130ed52daa287f5fa7badd261aca08ae79070eaaf4f102714

SHA512
dbaa3801906f385bee6fc48bd05df21d87233744e0ec1d07d90e5f883ceb6987c95f0c91868bea3b1b02be2227d24f6dc097abf6852e2757f6912457e3d1ee09

Download Submit
C:\Windows\system\rFjUStn.exe

Filesize
1.4MB

MD5
290f73b7dd9c58ba9954d4cc83e69c51

SHA1
db7a2cee365f09315114340119336bb247021241

SHA256
1950b2fdbfd9b484512850ccc3472498521d00407dc7a1a88397d0930b03be15

SHA512
52474bddfa96231bce7a29177b0a8b2d8815866352a0ae2b0cc73dda5ab22b268db92385110c6751ebafec13cafadc680b6142fef6fcb1449c31254305a3d5b4

Download Submit
C:\Windows\system\uzhfujj.exe

Filesize
1.4MB

MD5
d2ca0e440802ff187935acf890df8241

SHA1
8c3aa223cc51ee59060c9ecf210fdba50648fea0

SHA256
a210baeb90a4e9c3cf6418790f405bbf285f7268e0600d470ec8f7a8b7c1e090

SHA512
10fd31ffd5e92c4eaa3a7e6d2039f5aad51ac0cc709f79521400828d88e3ab65da8454e946b5a8d9df06c4bfde5e4f5154d4bcdcfeb4330d4c5dc52c4eaa2d6e

Download Submit
C:\Windows\system\yxRCtls.exe

Filesize
1.4MB

MD5
209309d41b6ffb997f16c56122bfe8a8

SHA1
76706eaf1604b5fa972b75b8abd2421fe1282e6f

SHA256
16735af2f4e05eb222d017fc5a796ea11a0d20dbf17677da99a53f4a2ffa93a4

SHA512
097b58e89777811c7739d0036e01ef22865448d9e8ee0960bf41ee19b3919d3c46568ed0263a92b535781df3768f032b28d96cfd6fe92ae8f531f672d6268d8a

Download Submit
\Windows\system\CNqRYyV.exe

Filesize
1.4MB

MD5
93ec405c06f5ca8b3d7303bb56408d6c

SHA1
397c6c6ea083b8db2efc4c433911ba95d4f17ad3

SHA256
f1c4082a00ad40889f860bcc76a71760b210df90c0d53470ae5c2840de236814

SHA512
223cc8644443f96d40c4e8ec22b729a3565a8b84faa49df94d03f50c1690bfb7980a1b25b1eec2d7f6026a74bad93664851f75b9e7ee86a2c5451522414dc2d8

Download Submit
\Windows\system\CZFkynr.exe

Filesize
1.4MB

MD5
abd7a3b394f6935e8649dfe4b4ba0a5b

SHA1
53297268d093f4178776228764a3047be605af51

SHA256
b054d6f0dda5667a4b7967ef3a4f1c4e73d13492b3e08332c81b9515491730ec

SHA512
66190c0e9fdf1fadfe984101b470a0dddad92aa87586a25831af272ee47e7abaa11ce0c2e1a33200c4280c4720c501ce31ff4732b8e49043aed1c9f3acbae406

Download Submit
\Windows\system\ILUkbln.exe

Filesize
1.4MB

MD5
69be14aa57286843da956d950271e6d8

SHA1
37046d93be451f443fd19e020c788819edd69136

SHA256
1c062da4e47d55f2b92ce2bba8091c6ee8cf4bb9b4bec11968bdb126d3d7c43a

SHA512
0ce4cc51eb9b542126f38b0933d159f57f29fc38c6fc33ae2171fc16aa9b0b06ae831dae6a427cfec26e52d54749f0755072de91f3759d4646746ddb1baa423e

Download Submit
\Windows\system\OvJBSld.exe

Filesize
1.4MB

MD5
fb5ae448fbc2adc6fa67ee6c55a1e73a

SHA1
545a9154077e58c261ef306656df12a2e7d0f3bf

SHA256
98615102b2a6806ea606515916f34213c41745f2ee336c3988bee22aa505f81e

SHA512
f253cdf947891fc68aa950b65fb6696bf0998e8490921d5e5301fef6986f050a7cc1ebdf1cc85d8e0dea2b5a76b437e6d2cbaf976e4b2adb66a86e48646d2922

Download Submit
\Windows\system\gwtJXnp.exe

Filesize
1.4MB

MD5
7a5db5899028459340ac34fc1cd270a1

SHA1
77392d13b55934ac1dd229c661cff715675b5b17

SHA256
d62629a8bba8548e7802138b09e80ea048c24c9648f86477997b95b5528dad60

SHA512
c1fdd323e259520e9a41864c1e3bf8730d76918d6264b5445efc3bcd6b8e224b0f9f7f66a6c914e34fc8960d75dd876c6c90a9d952ad1ca39ce75b43d191abaf

Download Submit
\Windows\system\jWjPUdC.exe

Filesize
1.4MB

MD5
deb44f7b77b7b0d90581f6ae7a2ea139

SHA1
71bd450e295f56a81099312d487a668be2876950

SHA256
40955f93bfd962e96dc069868b7616e56391aabd290275d0ff4742f4d495ab75

SHA512
df49dde181e939fe67afdbb4c4c8f6cecb467056f484865bb9b79e9bbee7640c2bdee9f082d6d20335364f8dffc009a6a7c8631943fec490022808ddef68b08b

Download Submit
\Windows\system\ktfjHZo.exe

Filesize
1.4MB

MD5
0b833840399ec7180776ee3c23d68441

SHA1
5e413da02e219baba5b0ac07884a536986fd6182

SHA256
e89f60a29ec3ea747a0713034571b0a7cda8cff88d7bded1eb90683b4abc6163

SHA512
29ce5cad9406b732c334e9f3666b1c09025692e5cda4106403109bca48391f534c2c3d153f887417f2f5eb27842f497c335d0f826530856d5cef63b660f6c8b9

Download Submit
\Windows\system\rHIamLN.exe

Filesize
1.4MB

MD5
bf76dfb1bc880e38f900d217c8303aed

SHA1
8f2a26db57e4e4beddbb84132624f2e8a141f198

SHA256
ab6a8d151a3b3f67e2963c79d16cc24224449ac3b873f33868eb8afcc456736a

SHA512
f412198073edc9076804e1c3b4c9197451d2778ce9bac5c0f09208bdb696549addda253cb538f3900c9b019b31f3691abce8869139c4e0b416bcb5c9d0503842

Download Submit
\Windows\system\vJxNEMz.exe

Filesize
1.4MB

MD5
3b39fe878e8c33cc5b8d4bee11a5741a

SHA1
68a76822ab6302db91d3d34ffe89c88bd8df3651

SHA256
a95b54bab4b2de140bb2a1c82615c72e6517c3e7ba4e487b5e697760d2619bb7

SHA512
40fbd3207a6ef67cd9880585a49aa7c220d3b4b3e0d35b9761b9ff36eddbe9bc5db45b80fc9306e94aa0e22386bef8a4dc7fce3babce4de6446cfbb8e6e2622b

Download Submit
memory/1372-77-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1372-3629-0x000000013F2B0000-0x000000013F601000-memory.dmp

Filesize
3.3MB

Download
memory/1676-74-0x000000013F890000-0x000000013FBE1000-memory.dmp

Filesize
3.3MB

Download
memory/1676-3627-0x000000013F890000-0x000000013FBE1000-memory.dmp

Filesize
3.3MB

Download
memory/2276-87-0x000000013F3D0000-0x000000013F721000-memory.dmp

Filesize
3.3MB

Download
memory/2276-3648-0x000000013F3D0000-0x000000013F721000-memory.dmp

Filesize
3.3MB

Download
memory/2348-96-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2348-3650-0x000000013F2A0000-0x000000013F5F1000-memory.dmp

Filesize
3.3MB

Download
memory/2392-2831-0x000000013F7C0000-0x000000013FB11000-memory.dmp

Filesize
3.3MB

Download
memory/2392-22-0x000000013F7C0000-0x000000013FB11000-memory.dmp

Filesize
3.3MB

Download
memory/2392-3639-0x000000013F7C0000-0x000000013FB11000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2828-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2444-93-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2444-81-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2444-82-0x000000013F8C0000-0x000000013FC11000-memory.dmp

Filesize
3.3MB

Download
memory/2444-84-0x000000013F780000-0x000000013FAD1000-memory.dmp

Filesize
3.3MB

Download
memory/2444-85-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-83-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2444-66-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

Filesize
3.3MB

Download
memory/2444-3344-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-92-0x000000013F890000-0x000000013FBE1000-memory.dmp

Filesize
3.3MB

Download
memory/2444-94-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-3071-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-35-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-0-0x000000013F0F0000-0x000000013F441000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2834-0x000000013F450000-0x000000013F7A1000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2849-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2444-2832-0x0000000001FF0000-0x0000000002341000-memory.dmp

Filesize
3.3MB

Download
memory/2540-3638-0x000000013F020000-0x000000013F371000-memory.dmp

Filesize
3.3MB

Download
memory/2540-90-0x000000013F020000-0x000000013F371000-memory.dmp

Filesize
3.3MB

Download
memory/2560-88-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/2560-3645-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/2632-97-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

Filesize
3.3MB

Download
memory/2632-3644-0x000000013F6A0000-0x000000013F9F1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-3345-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-3666-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2644-98-0x000000013F590000-0x000000013F8E1000-memory.dmp

Filesize
3.3MB

Download
memory/2656-91-0x000000013F230000-0x000000013F581000-memory.dmp

Filesize
3.3MB

Download
memory/2656-3635-0x000000013F230000-0x000000013F581000-memory.dmp

Filesize
3.3MB

Download
memory/2700-3646-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2700-89-0x000000013F8A0000-0x000000013FBF1000-memory.dmp

Filesize
3.3MB

Download
memory/2808-3620-0x000000013F190000-0x000000013F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/2808-75-0x000000013F190000-0x000000013F4E1000-memory.dmp

Filesize
3.3MB

Download
memory/2816-3628-0x000000013F450000-0x000000013F7A1000-memory.dmp

Filesize
3.3MB

Download
memory/2816-95-0x000000013F450000-0x000000013F7A1000-memory.dmp

Filesize
3.3MB

Download