xmrig | 7c7ac05ac9f13f691979fe72932340f90de1d6c09d1dc8858a9d217af80a0ef0

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/06/2024, 01:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
Size

1.7MB
MD5

1d2353e34e1e070cf3616f99d37eec20
SHA1

26c1ada7cfebb78b41b1d2ff7d7437ef8e3ca83e
SHA256

7c7ac05ac9f13f691979fe72932340f90de1d6c09d1dc8858a9d217af80a0ef0
SHA512

b5afe248b6a4168379ee7b30226ff0f234fca1af5b154ab3cb489cb9413250f3171b6750d5354db6112a7fa09c3203eee54a6e600d2122e4b611fbb1f3d6307e
SSDEEP

49152:ROdWCCi7/rahUUvXjVTZLVOaOxdygHGSX:RWWBibaq

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2668-465-0x000000013F130000-0x000000013F481000-memory.dmp	xmrig
behavioral1/memory/2596-475-0x000000013FCA0000-0x000000013FFF1000-memory.dmp	xmrig
behavioral1/memory/2312-505-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2544-511-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2980-513-0x000000013F060000-0x000000013F3B1000-memory.dmp	xmrig
behavioral1/memory/2456-519-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/2444-517-0x000000013FBC0000-0x000000013FF11000-memory.dmp	xmrig
behavioral1/memory/2940-515-0x000000013F550000-0x000000013F8A1000-memory.dmp	xmrig
behavioral1/memory/2584-507-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig
behavioral1/memory/2480-509-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/2828-503-0x000000013F820000-0x000000013FB71000-memory.dmp	xmrig
behavioral1/memory/2632-491-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2700-471-0x000000013FB90000-0x000000013FEE1000-memory.dmp	xmrig
behavioral1/memory/2444-4217-0x000000013FBC0000-0x000000013FF11000-memory.dmp	xmrig
behavioral1/memory/2668-4417-0x000000013F130000-0x000000013F481000-memory.dmp	xmrig
behavioral1/memory/2576-4503-0x000000013F700000-0x000000013FA51000-memory.dmp	xmrig
behavioral1/memory/2544-4520-0x000000013F4F0000-0x000000013F841000-memory.dmp	xmrig
behavioral1/memory/2940-4518-0x000000013F550000-0x000000013F8A1000-memory.dmp	xmrig
behavioral1/memory/2456-4516-0x000000013FE60000-0x00000001401B1000-memory.dmp	xmrig
behavioral1/memory/2596-4515-0x000000013FCA0000-0x000000013FFF1000-memory.dmp	xmrig
behavioral1/memory/2480-4521-0x000000013F3E0000-0x000000013F731000-memory.dmp	xmrig
behavioral1/memory/2584-4524-0x000000013F030000-0x000000013F381000-memory.dmp	xmrig
behavioral1/memory/2828-4522-0x000000013F820000-0x000000013FB71000-memory.dmp	xmrig
behavioral1/memory/2980-4525-0x000000013F060000-0x000000013F3B1000-memory.dmp	xmrig
behavioral1/memory/2312-4527-0x000000013FDC0000-0x0000000140111000-memory.dmp	xmrig
behavioral1/memory/2700-4533-0x000000013FB90000-0x000000013FEE1000-memory.dmp	xmrig
behavioral1/memory/2632-4534-0x000000013F140000-0x000000013F491000-memory.dmp	xmrig
behavioral1/memory/2196-5952-0x000000013F600000-0x000000013F951000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2576	VhZgMat.exe
2668	INGHPoa.exe
2700	rnHpCjk.exe
2596	nEiuPQW.exe
2632	prgyvcq.exe
2828	yOrxIJM.exe
2312	AGqRBUO.exe
2584	NyKIhnj.exe
2480	gOyoxmV.exe
2544	TKZBVuM.exe
2980	SRnxGSU.exe
2940	QCczmEA.exe
2444	pQXccDy.exe
2456	EiZvwNM.exe
748	jWEcpTz.exe
1584	vXpWZNJ.exe
1448	BpGhEBN.exe
868	vXQkCRy.exe
2384	bIuMwhE.exe
2368	KydDNIi.exe
1588	cFrNEBa.exe
2164	YpMYQuO.exe
2036	ohnjINb.exe
1996	uZEnWWx.exe
2816	RnshteM.exe
2740	ZdSKQwl.exe
2212	kGVKQHv.exe
1832	JgPXXUn.exe
2200	agkqlWZ.exe
320	sbisJDo.exe
540	VElGcKR.exe
1068	aHNtZrl.exe
1724	SqHpiaR.exe
1556	HYRTXHs.exe
1084	HVIYbGF.exe
1696	eIaHfNN.exe
2316	YibVUJr.exe
2052	KtyRzUu.exe
1116	IiyLHDU.exe
3008	hWLvOya.exe
3028	jbDVOOI.exe
1700	wErcEWF.exe
1600	BwplCiD.exe
324	NtMAedx.exe
780	OzWzqfQ.exe
1612	BHvZJRI.exe
900	HUWdAMG.exe
960	stQpOOH.exe
2108	NxuIpPV.exe
2852	YMaOrkd.exe
836	SRcTvkK.exe
1708	hHZDUrK.exe
1868	gWlPmco.exe
2888	fQthEbn.exe
2244	PXmikgN.exe
1896	obpjkhw.exe
3044	NDWcLst.exe
892	ollAWwN.exe
2188	gvJUALt.exe
2964	IGuvXkS.exe
2792	mCTrxKU.exe
1524	NFruwAH.exe
3000	HFxNVUP.exe
2680	dRYhvar.exe

Loads dropped DLL 64 IoCs

pid	Process
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-0-0x000000013F600000-0x000000013F951000-memory.dmp	upx
behavioral1/files/0x000d00000001227e-3.dat	upx
behavioral1/memory/2576-7-0x000000013F700000-0x000000013FA51000-memory.dmp	upx
behavioral1/files/0x0037000000015406-9.dat	upx
behavioral1/files/0x0008000000015678-11.dat	upx
behavioral1/files/0x0007000000015c6f-22.dat	upx
behavioral1/files/0x0007000000015c7f-28.dat	upx
behavioral1/files/0x0006000000015f05-45.dat	upx
behavioral1/files/0x0006000000015ff4-57.dat	upx
behavioral1/files/0x0037000000015424-80.dat	upx
behavioral1/files/0x000600000001663f-92.dat	upx
behavioral1/files/0x0006000000016c71-112.dat	upx
behavioral1/files/0x0006000000016d45-150.dat	upx
behavioral1/files/0x0006000000016d61-160.dat	upx
behavioral1/memory/2668-465-0x000000013F130000-0x000000013F481000-memory.dmp	upx
behavioral1/memory/2596-475-0x000000013FCA0000-0x000000013FFF1000-memory.dmp	upx
behavioral1/memory/2312-505-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2544-511-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/2980-513-0x000000013F060000-0x000000013F3B1000-memory.dmp	upx
behavioral1/memory/2456-519-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/2444-517-0x000000013FBC0000-0x000000013FF11000-memory.dmp	upx
behavioral1/memory/2940-515-0x000000013F550000-0x000000013F8A1000-memory.dmp	upx
behavioral1/memory/2584-507-0x000000013F030000-0x000000013F381000-memory.dmp	upx
behavioral1/memory/2480-509-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/2828-503-0x000000013F820000-0x000000013FB71000-memory.dmp	upx
behavioral1/memory/2632-491-0x000000013F140000-0x000000013F491000-memory.dmp	upx
behavioral1/memory/2700-471-0x000000013FB90000-0x000000013FEE1000-memory.dmp	upx
behavioral1/files/0x0006000000016d4e-157.dat	upx
behavioral1/files/0x0006000000016d3d-147.dat	upx
behavioral1/files/0x0006000000016d2c-137.dat	upx
behavioral1/files/0x0006000000016d34-142.dat	upx
behavioral1/files/0x0006000000016ce7-127.dat	upx
behavioral1/files/0x0006000000016d1b-132.dat	upx
behavioral1/files/0x0006000000016cc3-122.dat	upx
behavioral1/files/0x0006000000016c7a-117.dat	upx
behavioral1/files/0x0006000000016c56-107.dat	upx
behavioral1/files/0x0006000000016abb-102.dat	upx
behavioral1/files/0x000600000001686d-97.dat	upx
behavioral1/files/0x00060000000165a8-87.dat	upx
behavioral1/files/0x00060000000164a9-78.dat	upx
behavioral1/files/0x0006000000016255-67.dat	upx
behavioral1/files/0x0006000000016310-72.dat	upx
behavioral1/files/0x0006000000016103-62.dat	upx
behavioral1/files/0x0006000000015f71-52.dat	upx
behavioral1/files/0x0008000000015cb8-38.dat	upx
behavioral1/files/0x0007000000015e5b-41.dat	upx
behavioral1/files/0x0007000000015c93-31.dat	upx
behavioral1/memory/2444-4217-0x000000013FBC0000-0x000000013FF11000-memory.dmp	upx
behavioral1/memory/2668-4417-0x000000013F130000-0x000000013F481000-memory.dmp	upx
behavioral1/memory/2576-4503-0x000000013F700000-0x000000013FA51000-memory.dmp	upx
behavioral1/memory/2544-4520-0x000000013F4F0000-0x000000013F841000-memory.dmp	upx
behavioral1/memory/2940-4518-0x000000013F550000-0x000000013F8A1000-memory.dmp	upx
behavioral1/memory/2456-4516-0x000000013FE60000-0x00000001401B1000-memory.dmp	upx
behavioral1/memory/2596-4515-0x000000013FCA0000-0x000000013FFF1000-memory.dmp	upx
behavioral1/memory/2480-4521-0x000000013F3E0000-0x000000013F731000-memory.dmp	upx
behavioral1/memory/2584-4524-0x000000013F030000-0x000000013F381000-memory.dmp	upx
behavioral1/memory/2828-4522-0x000000013F820000-0x000000013FB71000-memory.dmp	upx
behavioral1/memory/2980-4525-0x000000013F060000-0x000000013F3B1000-memory.dmp	upx
behavioral1/memory/2312-4527-0x000000013FDC0000-0x0000000140111000-memory.dmp	upx
behavioral1/memory/2700-4533-0x000000013FB90000-0x000000013FEE1000-memory.dmp	upx
behavioral1/memory/2632-4534-0x000000013F140000-0x000000013F491000-memory.dmp	upx
behavioral1/memory/2196-5952-0x000000013F600000-0x000000013F951000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\smmDaaY.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\JyvRclk.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\vGJLaRJ.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\YFWlxuy.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\RseKoPP.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\IcsnrmV.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\RqOKGsf.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\VHCyzNL.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\bOiHUKx.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\XXbasiF.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\vCQNofN.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\SYYVYKH.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\NCCCxBk.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\qkUuihY.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\vmdaCZv.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\fgfAcjx.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\XqvFIjS.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\UffZviz.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\eWYdesS.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\mbedvTU.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\RgyYkVH.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\DlFvdQm.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\mpfhnrH.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\rLieGuw.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\LxYFTcE.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\PzuiKvs.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\pnqGLiQ.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\MNhEXyH.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\OxgDueW.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\aHNtZrl.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\fguWESA.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\hMymaSN.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\cixlaXI.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\mHZSekA.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\dgJvRwZ.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\NLtOgif.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\IObAMir.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\uTTJyEY.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\VjvLzQp.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\nfuquVO.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\ysfbvgi.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\CDGzufk.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\ZwNwhmT.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\zCbERZQ.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\lFbpOLv.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\CqZPYiT.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\ALZvAve.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\fpWvuIf.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\BtEfCOt.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\wVMgkRa.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\AZRHZOu.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\alfIycA.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\nimNdNi.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\FetZIeA.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\fgmHZsI.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\RQZxkVY.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\oRtFCsJ.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\NcXCyQy.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\GwfzpcT.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\MzXRqDP.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\EZspUkP.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\ayOKDdg.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\qWxvVwt.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
File created	C:\Windows\System\SlLRNho.exe	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2576	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2576	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2576	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2668	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2668	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2668	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2700	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2700	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2700	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2596	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	32
PID 2196 wrote to memory of 2596	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	32
PID 2196 wrote to memory of 2596	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	32
PID 2196 wrote to memory of 2632	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	33
PID 2196 wrote to memory of 2632	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	33
PID 2196 wrote to memory of 2632	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	33
PID 2196 wrote to memory of 2828	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	34
PID 2196 wrote to memory of 2828	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	34
PID 2196 wrote to memory of 2828	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	34
PID 2196 wrote to memory of 2312	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	35
PID 2196 wrote to memory of 2312	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	35
PID 2196 wrote to memory of 2312	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	35
PID 2196 wrote to memory of 2584	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	36
PID 2196 wrote to memory of 2584	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	36
PID 2196 wrote to memory of 2584	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	36
PID 2196 wrote to memory of 2480	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	37
PID 2196 wrote to memory of 2480	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	37
PID 2196 wrote to memory of 2480	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	37
PID 2196 wrote to memory of 2544	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	38
PID 2196 wrote to memory of 2544	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	38
PID 2196 wrote to memory of 2544	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	38
PID 2196 wrote to memory of 2980	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	39
PID 2196 wrote to memory of 2980	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	39
PID 2196 wrote to memory of 2980	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	39
PID 2196 wrote to memory of 2940	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	40
PID 2196 wrote to memory of 2940	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	40
PID 2196 wrote to memory of 2940	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	40
PID 2196 wrote to memory of 2444	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	41
PID 2196 wrote to memory of 2444	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	41
PID 2196 wrote to memory of 2444	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	41
PID 2196 wrote to memory of 2456	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	42
PID 2196 wrote to memory of 2456	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	42
PID 2196 wrote to memory of 2456	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	42
PID 2196 wrote to memory of 748	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	43
PID 2196 wrote to memory of 748	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	43
PID 2196 wrote to memory of 748	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	43
PID 2196 wrote to memory of 1584	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	44
PID 2196 wrote to memory of 1584	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	44
PID 2196 wrote to memory of 1584	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	44
PID 2196 wrote to memory of 1448	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	45
PID 2196 wrote to memory of 1448	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	45
PID 2196 wrote to memory of 1448	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	45
PID 2196 wrote to memory of 868	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	46
PID 2196 wrote to memory of 868	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	46
PID 2196 wrote to memory of 868	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	46
PID 2196 wrote to memory of 2384	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	47
PID 2196 wrote to memory of 2384	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	47
PID 2196 wrote to memory of 2384	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	47
PID 2196 wrote to memory of 2368	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	48
PID 2196 wrote to memory of 2368	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	48
PID 2196 wrote to memory of 2368	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	48
PID 2196 wrote to memory of 1588	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	49
PID 2196 wrote to memory of 1588	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	49
PID 2196 wrote to memory of 1588	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	49
PID 2196 wrote to memory of 2164	2196	1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1d2353e34e1e070cf3616f99d37eec20_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System\VhZgMat.exe
  C:\Windows\System\VhZgMat.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\INGHPoa.exe
  C:\Windows\System\INGHPoa.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\rnHpCjk.exe
  C:\Windows\System\rnHpCjk.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\nEiuPQW.exe
  C:\Windows\System\nEiuPQW.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\prgyvcq.exe
  C:\Windows\System\prgyvcq.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\yOrxIJM.exe
  C:\Windows\System\yOrxIJM.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\AGqRBUO.exe
  C:\Windows\System\AGqRBUO.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\NyKIhnj.exe
  C:\Windows\System\NyKIhnj.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\gOyoxmV.exe
  C:\Windows\System\gOyoxmV.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\TKZBVuM.exe
  C:\Windows\System\TKZBVuM.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\SRnxGSU.exe
  C:\Windows\System\SRnxGSU.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\QCczmEA.exe
  C:\Windows\System\QCczmEA.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\pQXccDy.exe
  C:\Windows\System\pQXccDy.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\EiZvwNM.exe
  C:\Windows\System\EiZvwNM.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\jWEcpTz.exe
  C:\Windows\System\jWEcpTz.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\vXpWZNJ.exe
  C:\Windows\System\vXpWZNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\BpGhEBN.exe
  C:\Windows\System\BpGhEBN.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\vXQkCRy.exe
  C:\Windows\System\vXQkCRy.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\bIuMwhE.exe
  C:\Windows\System\bIuMwhE.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\KydDNIi.exe
  C:\Windows\System\KydDNIi.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\cFrNEBa.exe
  C:\Windows\System\cFrNEBa.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\YpMYQuO.exe
  C:\Windows\System\YpMYQuO.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\ohnjINb.exe
  C:\Windows\System\ohnjINb.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\uZEnWWx.exe
  C:\Windows\System\uZEnWWx.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\RnshteM.exe
  C:\Windows\System\RnshteM.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ZdSKQwl.exe
  C:\Windows\System\ZdSKQwl.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\kGVKQHv.exe
  C:\Windows\System\kGVKQHv.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\JgPXXUn.exe
  C:\Windows\System\JgPXXUn.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\agkqlWZ.exe
  C:\Windows\System\agkqlWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\sbisJDo.exe
  C:\Windows\System\sbisJDo.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\VElGcKR.exe
  C:\Windows\System\VElGcKR.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\aHNtZrl.exe
  C:\Windows\System\aHNtZrl.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\SqHpiaR.exe
  C:\Windows\System\SqHpiaR.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\HYRTXHs.exe
  C:\Windows\System\HYRTXHs.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\HVIYbGF.exe
  C:\Windows\System\HVIYbGF.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\eIaHfNN.exe
  C:\Windows\System\eIaHfNN.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YibVUJr.exe
  C:\Windows\System\YibVUJr.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\KtyRzUu.exe
  C:\Windows\System\KtyRzUu.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\IiyLHDU.exe
  C:\Windows\System\IiyLHDU.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\hWLvOya.exe
  C:\Windows\System\hWLvOya.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\jbDVOOI.exe
  C:\Windows\System\jbDVOOI.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\wErcEWF.exe
  C:\Windows\System\wErcEWF.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\BwplCiD.exe
  C:\Windows\System\BwplCiD.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\NtMAedx.exe
  C:\Windows\System\NtMAedx.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\OzWzqfQ.exe
  C:\Windows\System\OzWzqfQ.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\BHvZJRI.exe
  C:\Windows\System\BHvZJRI.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\HUWdAMG.exe
  C:\Windows\System\HUWdAMG.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\stQpOOH.exe
  C:\Windows\System\stQpOOH.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\NxuIpPV.exe
  C:\Windows\System\NxuIpPV.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\YMaOrkd.exe
  C:\Windows\System\YMaOrkd.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\SRcTvkK.exe
  C:\Windows\System\SRcTvkK.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\hHZDUrK.exe
  C:\Windows\System\hHZDUrK.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\gWlPmco.exe
  C:\Windows\System\gWlPmco.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\fQthEbn.exe
  C:\Windows\System\fQthEbn.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\PXmikgN.exe
  C:\Windows\System\PXmikgN.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\obpjkhw.exe
  C:\Windows\System\obpjkhw.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\NDWcLst.exe
  C:\Windows\System\NDWcLst.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\ollAWwN.exe
  C:\Windows\System\ollAWwN.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\gvJUALt.exe
  C:\Windows\System\gvJUALt.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\IGuvXkS.exe
  C:\Windows\System\IGuvXkS.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\mCTrxKU.exe
  C:\Windows\System\mCTrxKU.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\NFruwAH.exe
  C:\Windows\System\NFruwAH.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\HFxNVUP.exe
  C:\Windows\System\HFxNVUP.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\dRYhvar.exe
  C:\Windows\System\dRYhvar.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\iydbhLq.exe
  C:\Windows\System\iydbhLq.exe
  2⤵
  PID:2588
- C:\Windows\System\znADbDM.exe
  C:\Windows\System\znADbDM.exe
  2⤵
  PID:2976
- C:\Windows\System\QEllcxc.exe
  C:\Windows\System\QEllcxc.exe
  2⤵
  PID:2472
- C:\Windows\System\jMgtUeh.exe
  C:\Windows\System\jMgtUeh.exe
  2⤵
  PID:2636
- C:\Windows\System\jjWYXiC.exe
  C:\Windows\System\jjWYXiC.exe
  2⤵
  PID:2548
- C:\Windows\System\dLyhKcb.exe
  C:\Windows\System\dLyhKcb.exe
  2⤵
  PID:2112
- C:\Windows\System\mNKCZmB.exe
  C:\Windows\System\mNKCZmB.exe
  2⤵
  PID:2376
- C:\Windows\System\wgaMRLQ.exe
  C:\Windows\System\wgaMRLQ.exe
  2⤵
  PID:2656
- C:\Windows\System\hwywVag.exe
  C:\Windows\System\hwywVag.exe
  2⤵
  PID:1548
- C:\Windows\System\QTJPPLF.exe
  C:\Windows\System\QTJPPLF.exe
  2⤵
  PID:1592
- C:\Windows\System\JWzsZbz.exe
  C:\Windows\System\JWzsZbz.exe
  2⤵
  PID:812
- C:\Windows\System\wlDdaOQ.exe
  C:\Windows\System\wlDdaOQ.exe
  2⤵
  PID:2276
- C:\Windows\System\AvtEJoE.exe
  C:\Windows\System\AvtEJoE.exe
  2⤵
  PID:2032
- C:\Windows\System\KYAQsXA.exe
  C:\Windows\System\KYAQsXA.exe
  2⤵
  PID:2824
- C:\Windows\System\UbfViWG.exe
  C:\Windows\System\UbfViWG.exe
  2⤵
  PID:1924
- C:\Windows\System\TNBbAZn.exe
  C:\Windows\System\TNBbAZn.exe
  2⤵
  PID:2684
- C:\Windows\System\GaVhUnz.exe
  C:\Windows\System\GaVhUnz.exe
  2⤵
  PID:332
- C:\Windows\System\smmDaaY.exe
  C:\Windows\System\smmDaaY.exe
  2⤵
  PID:2508
- C:\Windows\System\sUbYouZ.exe
  C:\Windows\System\sUbYouZ.exe
  2⤵
  PID:572
- C:\Windows\System\MFvzrVA.exe
  C:\Windows\System\MFvzrVA.exe
  2⤵
  PID:2752
- C:\Windows\System\fVYfopg.exe
  C:\Windows\System\fVYfopg.exe
  2⤵
  PID:2120
- C:\Windows\System\zApOgat.exe
  C:\Windows\System\zApOgat.exe
  2⤵
  PID:644
- C:\Windows\System\ryDnroY.exe
  C:\Windows\System\ryDnroY.exe
  2⤵
  PID:408
- C:\Windows\System\oRtFCsJ.exe
  C:\Windows\System\oRtFCsJ.exe
  2⤵
  PID:3040
- C:\Windows\System\rOkDpAF.exe
  C:\Windows\System\rOkDpAF.exe
  2⤵
  PID:2868
- C:\Windows\System\ysfbvgi.exe
  C:\Windows\System\ysfbvgi.exe
  2⤵
  PID:2136
- C:\Windows\System\fmKMpKW.exe
  C:\Windows\System\fmKMpKW.exe
  2⤵
  PID:1304
- C:\Windows\System\iFQNStZ.exe
  C:\Windows\System\iFQNStZ.exe
  2⤵
  PID:1732
- C:\Windows\System\khbgnFS.exe
  C:\Windows\System\khbgnFS.exe
  2⤵
  PID:952
- C:\Windows\System\KScQkbx.exe
  C:\Windows\System\KScQkbx.exe
  2⤵
  PID:496
- C:\Windows\System\pKTREiB.exe
  C:\Windows\System\pKTREiB.exe
  2⤵
  PID:1216
- C:\Windows\System\QBJogMF.exe
  C:\Windows\System\QBJogMF.exe
  2⤵
  PID:1944
- C:\Windows\System\oFRVegC.exe
  C:\Windows\System\oFRVegC.exe
  2⤵
  PID:2340
- C:\Windows\System\QGiyinP.exe
  C:\Windows\System\QGiyinP.exe
  2⤵
  PID:2144
- C:\Windows\System\qnuLIgB.exe
  C:\Windows\System\qnuLIgB.exe
  2⤵
  PID:2968
- C:\Windows\System\UAGQvbo.exe
  C:\Windows\System\UAGQvbo.exe
  2⤵
  PID:1940
- C:\Windows\System\XnyLqrS.exe
  C:\Windows\System\XnyLqrS.exe
  2⤵
  PID:2972
- C:\Windows\System\PJDjkfs.exe
  C:\Windows\System\PJDjkfs.exe
  2⤵
  PID:3064
- C:\Windows\System\mCqNkTd.exe
  C:\Windows\System\mCqNkTd.exe
  2⤵
  PID:2620
- C:\Windows\System\zFPGxTr.exe
  C:\Windows\System\zFPGxTr.exe
  2⤵
  PID:2808
- C:\Windows\System\LxYFTcE.exe
  C:\Windows\System\LxYFTcE.exe
  2⤵
  PID:2764
- C:\Windows\System\KTUnnid.exe
  C:\Windows\System\KTUnnid.exe
  2⤵
  PID:2936
- C:\Windows\System\JoepbOQ.exe
  C:\Windows\System\JoepbOQ.exe
  2⤵
  PID:1144
- C:\Windows\System\oZaLOGO.exe
  C:\Windows\System\oZaLOGO.exe
  2⤵
  PID:2532
- C:\Windows\System\wDXOzpu.exe
  C:\Windows\System\wDXOzpu.exe
  2⤵
  PID:2672
- C:\Windows\System\yJyyGFV.exe
  C:\Windows\System\yJyyGFV.exe
  2⤵
  PID:2404
- C:\Windows\System\RdXscHk.exe
  C:\Windows\System\RdXscHk.exe
  2⤵
  PID:2372
- C:\Windows\System\VpdwKez.exe
  C:\Windows\System\VpdwKez.exe
  2⤵
  PID:2000
- C:\Windows\System\XliJTuK.exe
  C:\Windows\System\XliJTuK.exe
  2⤵
  PID:2216
- C:\Windows\System\rDobHGa.exe
  C:\Windows\System\rDobHGa.exe
  2⤵
  PID:2804
- C:\Windows\System\pBgJDGf.exe
  C:\Windows\System\pBgJDGf.exe
  2⤵
  PID:1780
- C:\Windows\System\VqFNMUv.exe
  C:\Windows\System\VqFNMUv.exe
  2⤵
  PID:1008
- C:\Windows\System\kYTrbHc.exe
  C:\Windows\System\kYTrbHc.exe
  2⤵
  PID:2436
- C:\Windows\System\HxwJrfF.exe
  C:\Windows\System\HxwJrfF.exe
  2⤵
  PID:2600
- C:\Windows\System\GFiewKz.exe
  C:\Windows\System\GFiewKz.exe
  2⤵
  PID:2992
- C:\Windows\System\dPhFgjY.exe
  C:\Windows\System\dPhFgjY.exe
  2⤵
  PID:876
- C:\Windows\System\KMqjssn.exe
  C:\Windows\System\KMqjssn.exe
  2⤵
  PID:908
- C:\Windows\System\FHTyfbJ.exe
  C:\Windows\System\FHTyfbJ.exe
  2⤵
  PID:2572
- C:\Windows\System\TtrbHCm.exe
  C:\Windows\System\TtrbHCm.exe
  2⤵
  PID:1784
- C:\Windows\System\rIIMjPF.exe
  C:\Windows\System\rIIMjPF.exe
  2⤵
  PID:1680
- C:\Windows\System\GfRMuaJ.exe
  C:\Windows\System\GfRMuaJ.exe
  2⤵
  PID:2896
- C:\Windows\System\iSJKINu.exe
  C:\Windows\System\iSJKINu.exe
  2⤵
  PID:568
- C:\Windows\System\RbRynMa.exe
  C:\Windows\System\RbRynMa.exe
  2⤵
  PID:1636
- C:\Windows\System\jQYEMax.exe
  C:\Windows\System\jQYEMax.exe
  2⤵
  PID:2580
- C:\Windows\System\OYxlMFR.exe
  C:\Windows\System\OYxlMFR.exe
  2⤵
  PID:2848
- C:\Windows\System\SVQdRhn.exe
  C:\Windows\System\SVQdRhn.exe
  2⤵
  PID:2416
- C:\Windows\System\apCqhNo.exe
  C:\Windows\System\apCqhNo.exe
  2⤵
  PID:2512
- C:\Windows\System\rzikXsO.exe
  C:\Windows\System\rzikXsO.exe
  2⤵
  PID:2696
- C:\Windows\System\vbZXSci.exe
  C:\Windows\System\vbZXSci.exe
  2⤵
  PID:1568
- C:\Windows\System\rLJNCzo.exe
  C:\Windows\System\rLJNCzo.exe
  2⤵
  PID:1480
- C:\Windows\System\gOObzgf.exe
  C:\Windows\System\gOObzgf.exe
  2⤵
  PID:2104
- C:\Windows\System\RTtWfRF.exe
  C:\Windows\System\RTtWfRF.exe
  2⤵
  PID:2352
- C:\Windows\System\gvHcLXB.exe
  C:\Windows\System\gvHcLXB.exe
  2⤵
  PID:2320
- C:\Windows\System\zxjOwGn.exe
  C:\Windows\System\zxjOwGn.exe
  2⤵
  PID:444
- C:\Windows\System\BIsxMWi.exe
  C:\Windows\System\BIsxMWi.exe
  2⤵
  PID:1140
- C:\Windows\System\bXxUPlT.exe
  C:\Windows\System\bXxUPlT.exe
  2⤵
  PID:2876
- C:\Windows\System\FrJdAHm.exe
  C:\Windows\System\FrJdAHm.exe
  2⤵
  PID:304
- C:\Windows\System\WETxyoO.exe
  C:\Windows\System\WETxyoO.exe
  2⤵
  PID:2356
- C:\Windows\System\fguWESA.exe
  C:\Windows\System\fguWESA.exe
  2⤵
  PID:1500
- C:\Windows\System\cyLqyBN.exe
  C:\Windows\System\cyLqyBN.exe
  2⤵
  PID:236
- C:\Windows\System\duvliWT.exe
  C:\Windows\System\duvliWT.exe
  2⤵
  PID:2264
- C:\Windows\System\aOfjSZh.exe
  C:\Windows\System\aOfjSZh.exe
  2⤵
  PID:2292
- C:\Windows\System\awiKwOm.exe
  C:\Windows\System\awiKwOm.exe
  2⤵
  PID:2628
- C:\Windows\System\Wzpaxmg.exe
  C:\Windows\System\Wzpaxmg.exe
  2⤵
  PID:2148
- C:\Windows\System\wZHcLzX.exe
  C:\Windows\System\wZHcLzX.exe
  2⤵
  PID:1212
- C:\Windows\System\wISgWbj.exe
  C:\Windows\System\wISgWbj.exe
  2⤵
  PID:2720
- C:\Windows\System\BhOXAxH.exe
  C:\Windows\System\BhOXAxH.exe
  2⤵
  PID:2412
- C:\Windows\System\DZYltPJ.exe
  C:\Windows\System\DZYltPJ.exe
  2⤵
  PID:1444
- C:\Windows\System\PgUOCco.exe
  C:\Windows\System\PgUOCco.exe
  2⤵
  PID:2476
- C:\Windows\System\skHyZmc.exe
  C:\Windows\System\skHyZmc.exe
  2⤵
  PID:112
- C:\Windows\System\eSlIxcA.exe
  C:\Windows\System\eSlIxcA.exe
  2⤵
  PID:2944
- C:\Windows\System\hMymaSN.exe
  C:\Windows\System\hMymaSN.exe
  2⤵
  PID:1032
- C:\Windows\System\TucgzWn.exe
  C:\Windows\System\TucgzWn.exe
  2⤵
  PID:2692
- C:\Windows\System\gwiMhbx.exe
  C:\Windows\System\gwiMhbx.exe
  2⤵
  PID:784
- C:\Windows\System\ULgbATD.exe
  C:\Windows\System\ULgbATD.exe
  2⤵
  PID:2044
- C:\Windows\System\aPaxWcJ.exe
  C:\Windows\System\aPaxWcJ.exe
  2⤵
  PID:2536
- C:\Windows\System\KvnBcKA.exe
  C:\Windows\System\KvnBcKA.exe
  2⤵
  PID:2160
- C:\Windows\System\qVpKMeV.exe
  C:\Windows\System\qVpKMeV.exe
  2⤵
  PID:2728
- C:\Windows\System\OYxXleB.exe
  C:\Windows\System\OYxXleB.exe
  2⤵
  PID:1728
- C:\Windows\System\JyvRclk.exe
  C:\Windows\System\JyvRclk.exe
  2⤵
  PID:1688
- C:\Windows\System\bSfreQg.exe
  C:\Windows\System\bSfreQg.exe
  2⤵
  PID:1464
- C:\Windows\System\KBpNtXM.exe
  C:\Windows\System\KBpNtXM.exe
  2⤵
  PID:752
- C:\Windows\System\sVjdOsA.exe
  C:\Windows\System\sVjdOsA.exe
  2⤵
  PID:1404
- C:\Windows\System\zocmjWs.exe
  C:\Windows\System\zocmjWs.exe
  2⤵
  PID:2192
- C:\Windows\System\qiBAGcL.exe
  C:\Windows\System\qiBAGcL.exe
  2⤵
  PID:1184
- C:\Windows\System\prnshss.exe
  C:\Windows\System\prnshss.exe
  2⤵
  PID:1368
- C:\Windows\System\BMNWfRJ.exe
  C:\Windows\System\BMNWfRJ.exe
  2⤵
  PID:2780
- C:\Windows\System\jcERQfW.exe
  C:\Windows\System\jcERQfW.exe
  2⤵
  PID:3020
- C:\Windows\System\TYfSCGs.exe
  C:\Windows\System\TYfSCGs.exe
  2⤵
  PID:2040
- C:\Windows\System\qjtmohw.exe
  C:\Windows\System\qjtmohw.exe
  2⤵
  PID:2516
- C:\Windows\System\SlYGRzV.exe
  C:\Windows\System\SlYGRzV.exe
  2⤵
  PID:2768
- C:\Windows\System\OVwrGln.exe
  C:\Windows\System\OVwrGln.exe
  2⤵
  PID:2028
- C:\Windows\System\YgGrvxR.exe
  C:\Windows\System\YgGrvxR.exe
  2⤵
  PID:3088
- C:\Windows\System\IbTmujg.exe
  C:\Windows\System\IbTmujg.exe
  2⤵
  PID:3108
- C:\Windows\System\WmqmWTA.exe
  C:\Windows\System\WmqmWTA.exe
  2⤵
  PID:3128
- C:\Windows\System\rjNdeue.exe
  C:\Windows\System\rjNdeue.exe
  2⤵
  PID:3148
- C:\Windows\System\mPcIXYt.exe
  C:\Windows\System\mPcIXYt.exe
  2⤵
  PID:3168
- C:\Windows\System\OtrRDEW.exe
  C:\Windows\System\OtrRDEW.exe
  2⤵
  PID:3192
- C:\Windows\System\sBhuWxv.exe
  C:\Windows\System\sBhuWxv.exe
  2⤵
  PID:3212
- C:\Windows\System\CbLcack.exe
  C:\Windows\System\CbLcack.exe
  2⤵
  PID:3232
- C:\Windows\System\iiKJReT.exe
  C:\Windows\System\iiKJReT.exe
  2⤵
  PID:3252
- C:\Windows\System\XpkGfgA.exe
  C:\Windows\System\XpkGfgA.exe
  2⤵
  PID:3272
- C:\Windows\System\foMUdTO.exe
  C:\Windows\System\foMUdTO.exe
  2⤵
  PID:3292
- C:\Windows\System\WRVZbiC.exe
  C:\Windows\System\WRVZbiC.exe
  2⤵
  PID:3308
- C:\Windows\System\ogtHukm.exe
  C:\Windows\System\ogtHukm.exe
  2⤵
  PID:3332
- C:\Windows\System\XhPNNfn.exe
  C:\Windows\System\XhPNNfn.exe
  2⤵
  PID:3348
- C:\Windows\System\CrcyLtQ.exe
  C:\Windows\System\CrcyLtQ.exe
  2⤵
  PID:3372
- C:\Windows\System\mIfCfKv.exe
  C:\Windows\System\mIfCfKv.exe
  2⤵
  PID:3392
- C:\Windows\System\FmyyMvi.exe
  C:\Windows\System\FmyyMvi.exe
  2⤵
  PID:3412
- C:\Windows\System\LQaEbdd.exe
  C:\Windows\System\LQaEbdd.exe
  2⤵
  PID:3432
- C:\Windows\System\wDANtUg.exe
  C:\Windows\System\wDANtUg.exe
  2⤵
  PID:3452
- C:\Windows\System\BtEfCOt.exe
  C:\Windows\System\BtEfCOt.exe
  2⤵
  PID:3468
- C:\Windows\System\TwfYNYv.exe
  C:\Windows\System\TwfYNYv.exe
  2⤵
  PID:3492
- C:\Windows\System\cixlaXI.exe
  C:\Windows\System\cixlaXI.exe
  2⤵
  PID:3508
- C:\Windows\System\VmfcBjb.exe
  C:\Windows\System\VmfcBjb.exe
  2⤵
  PID:3528
- C:\Windows\System\jrOBpOD.exe
  C:\Windows\System\jrOBpOD.exe
  2⤵
  PID:3548
- C:\Windows\System\vGJLaRJ.exe
  C:\Windows\System\vGJLaRJ.exe
  2⤵
  PID:3568
- C:\Windows\System\evvfXUh.exe
  C:\Windows\System\evvfXUh.exe
  2⤵
  PID:3588
- C:\Windows\System\KLNTxkd.exe
  C:\Windows\System\KLNTxkd.exe
  2⤵
  PID:3612
- C:\Windows\System\gwQaRdw.exe
  C:\Windows\System\gwQaRdw.exe
  2⤵
  PID:3628
- C:\Windows\System\roIQXRw.exe
  C:\Windows\System\roIQXRw.exe
  2⤵
  PID:3648
- C:\Windows\System\eTWdgjr.exe
  C:\Windows\System\eTWdgjr.exe
  2⤵
  PID:3668
- C:\Windows\System\hDdKACM.exe
  C:\Windows\System\hDdKACM.exe
  2⤵
  PID:3688
- C:\Windows\System\rlbLXyv.exe
  C:\Windows\System\rlbLXyv.exe
  2⤵
  PID:3708
- C:\Windows\System\kMhcgad.exe
  C:\Windows\System\kMhcgad.exe
  2⤵
  PID:3728
- C:\Windows\System\hmFAUTS.exe
  C:\Windows\System\hmFAUTS.exe
  2⤵
  PID:3744
- C:\Windows\System\ZyvhTwP.exe
  C:\Windows\System\ZyvhTwP.exe
  2⤵
  PID:3768
- C:\Windows\System\SwQkVgR.exe
  C:\Windows\System\SwQkVgR.exe
  2⤵
  PID:3788
- C:\Windows\System\uuxiBHK.exe
  C:\Windows\System\uuxiBHK.exe
  2⤵
  PID:3812
- C:\Windows\System\ZQLlIsv.exe
  C:\Windows\System\ZQLlIsv.exe
  2⤵
  PID:3828
- C:\Windows\System\jGunWyc.exe
  C:\Windows\System\jGunWyc.exe
  2⤵
  PID:3848
- C:\Windows\System\Pytnfep.exe
  C:\Windows\System\Pytnfep.exe
  2⤵
  PID:3864
- C:\Windows\System\CosQBHF.exe
  C:\Windows\System\CosQBHF.exe
  2⤵
  PID:3888
- C:\Windows\System\zJMuvaG.exe
  C:\Windows\System\zJMuvaG.exe
  2⤵
  PID:3908
- C:\Windows\System\OzDGNEL.exe
  C:\Windows\System\OzDGNEL.exe
  2⤵
  PID:3924
- C:\Windows\System\oybPLwf.exe
  C:\Windows\System\oybPLwf.exe
  2⤵
  PID:3940
- C:\Windows\System\ogLyTJx.exe
  C:\Windows\System\ogLyTJx.exe
  2⤵
  PID:3956
- C:\Windows\System\kBAXejj.exe
  C:\Windows\System\kBAXejj.exe
  2⤵
  PID:3972
- C:\Windows\System\mHZSekA.exe
  C:\Windows\System\mHZSekA.exe
  2⤵
  PID:3992
- C:\Windows\System\WRCvPPB.exe
  C:\Windows\System\WRCvPPB.exe
  2⤵
  PID:4020
- C:\Windows\System\rYRQyQs.exe
  C:\Windows\System\rYRQyQs.exe
  2⤵
  PID:4044
- C:\Windows\System\RUKUaAP.exe
  C:\Windows\System\RUKUaAP.exe
  2⤵
  PID:4060
- C:\Windows\System\UDrcsGt.exe
  C:\Windows\System\UDrcsGt.exe
  2⤵
  PID:4080
- C:\Windows\System\NcXCyQy.exe
  C:\Windows\System\NcXCyQy.exe
  2⤵
  PID:992
- C:\Windows\System\wJKFmfr.exe
  C:\Windows\System\wJKFmfr.exe
  2⤵
  PID:1156
- C:\Windows\System\wLCqsDK.exe
  C:\Windows\System\wLCqsDK.exe
  2⤵
  PID:3084
- C:\Windows\System\USDChdh.exe
  C:\Windows\System\USDChdh.exe
  2⤵
  PID:3104
- C:\Windows\System\vgMAMod.exe
  C:\Windows\System\vgMAMod.exe
  2⤵
  PID:3136
- C:\Windows\System\MyyXlUT.exe
  C:\Windows\System\MyyXlUT.exe
  2⤵
  PID:3164
- C:\Windows\System\qkUuihY.exe
  C:\Windows\System\qkUuihY.exe
  2⤵
  PID:3180
- C:\Windows\System\fhCxKWW.exe
  C:\Windows\System\fhCxKWW.exe
  2⤵
  PID:3220
- C:\Windows\System\ImnqqlE.exe
  C:\Windows\System\ImnqqlE.exe
  2⤵
  PID:3244
- C:\Windows\System\wVMgkRa.exe
  C:\Windows\System\wVMgkRa.exe
  2⤵
  PID:3260
- C:\Windows\System\xbAanyW.exe
  C:\Windows\System\xbAanyW.exe
  2⤵
  PID:3324
- C:\Windows\System\mbedvTU.exe
  C:\Windows\System\mbedvTU.exe
  2⤵
  PID:3340
- C:\Windows\System\RmeRxqX.exe
  C:\Windows\System\RmeRxqX.exe
  2⤵
  PID:3368
- C:\Windows\System\NlfAkdi.exe
  C:\Windows\System\NlfAkdi.exe
  2⤵
  PID:3400
- C:\Windows\System\xAlSQCF.exe
  C:\Windows\System\xAlSQCF.exe
  2⤵
  PID:3440
- C:\Windows\System\kXmwJTp.exe
  C:\Windows\System\kXmwJTp.exe
  2⤵
  PID:3484
- C:\Windows\System\hGZOYwO.exe
  C:\Windows\System\hGZOYwO.exe
  2⤵
  PID:3516
- C:\Windows\System\cSeDrwB.exe
  C:\Windows\System\cSeDrwB.exe
  2⤵
  PID:3428
- C:\Windows\System\dcrRxOZ.exe
  C:\Windows\System\dcrRxOZ.exe
  2⤵
  PID:3560
- C:\Windows\System\yUlJgkK.exe
  C:\Windows\System\yUlJgkK.exe
  2⤵
  PID:3604
- C:\Windows\System\JoPUcgR.exe
  C:\Windows\System\JoPUcgR.exe
  2⤵
  PID:1676
- C:\Windows\System\pECjsUB.exe
  C:\Windows\System\pECjsUB.exe
  2⤵
  PID:3460
- C:\Windows\System\nQDHaQc.exe
  C:\Windows\System\nQDHaQc.exe
  2⤵
  PID:3536
- C:\Windows\System\gjyLSXE.exe
  C:\Windows\System\gjyLSXE.exe
  2⤵
  PID:3684
- C:\Windows\System\lsTmFOJ.exe
  C:\Windows\System\lsTmFOJ.exe
  2⤵
  PID:3036
- C:\Windows\System\zCbERZQ.exe
  C:\Windows\System\zCbERZQ.exe
  2⤵
  PID:3580
- C:\Windows\System\LXBswGG.exe
  C:\Windows\System\LXBswGG.exe
  2⤵
  PID:3720
- C:\Windows\System\KKsCPbT.exe
  C:\Windows\System\KKsCPbT.exe
  2⤵
  PID:2236
- C:\Windows\System\qdoJyDJ.exe
  C:\Windows\System\qdoJyDJ.exe
  2⤵
  PID:1988
- C:\Windows\System\PKqnOCa.exe
  C:\Windows\System\PKqnOCa.exe
  2⤵
  PID:1308
- C:\Windows\System\tcitYQA.exe
  C:\Windows\System\tcitYQA.exe
  2⤵
  PID:3696
- C:\Windows\System\oSdpgFo.exe
  C:\Windows\System\oSdpgFo.exe
  2⤵
  PID:3776
- C:\Windows\System\bWrJbau.exe
  C:\Windows\System\bWrJbau.exe
  2⤵
  PID:3784
- C:\Windows\System\ZGTiaiA.exe
  C:\Windows\System\ZGTiaiA.exe
  2⤵
  PID:3808
- C:\Windows\System\MTwYoQB.exe
  C:\Windows\System\MTwYoQB.exe
  2⤵
  PID:3872
- C:\Windows\System\RwUcxOR.exe
  C:\Windows\System\RwUcxOR.exe
  2⤵
  PID:3916
- C:\Windows\System\qrcKhNQ.exe
  C:\Windows\System\qrcKhNQ.exe
  2⤵
  PID:3984
- C:\Windows\System\NPyiWTm.exe
  C:\Windows\System\NPyiWTm.exe
  2⤵
  PID:3860
- C:\Windows\System\vmdaCZv.exe
  C:\Windows\System\vmdaCZv.exe
  2⤵
  PID:3964
- C:\Windows\System\NTvfSYE.exe
  C:\Windows\System\NTvfSYE.exe
  2⤵
  PID:3932
- C:\Windows\System\hGqLcdz.exe
  C:\Windows\System\hGqLcdz.exe
  2⤵
  PID:4028
- C:\Windows\System\mpMppub.exe
  C:\Windows\System\mpMppub.exe
  2⤵
  PID:4016
- C:\Windows\System\IQFpkuN.exe
  C:\Windows\System\IQFpkuN.exe
  2⤵
  PID:4072
- C:\Windows\System\zVZegri.exe
  C:\Windows\System\zVZegri.exe
  2⤵
  PID:4104
- C:\Windows\System\iMNxnLF.exe
  C:\Windows\System\iMNxnLF.exe
  2⤵
  PID:4120
- C:\Windows\System\CkcbfCx.exe
  C:\Windows\System\CkcbfCx.exe
  2⤵
  PID:4136
- C:\Windows\System\VbiwmYg.exe
  C:\Windows\System\VbiwmYg.exe
  2⤵
  PID:4156
- C:\Windows\System\BPWGpFE.exe
  C:\Windows\System\BPWGpFE.exe
  2⤵
  PID:4172
- C:\Windows\System\hbWeWXx.exe
  C:\Windows\System\hbWeWXx.exe
  2⤵
  PID:4188
- C:\Windows\System\psEmCLw.exe
  C:\Windows\System\psEmCLw.exe
  2⤵
  PID:4204
- C:\Windows\System\xuxboCR.exe
  C:\Windows\System\xuxboCR.exe
  2⤵
  PID:4224
- C:\Windows\System\sPyCJQg.exe
  C:\Windows\System\sPyCJQg.exe
  2⤵
  PID:4240
- C:\Windows\System\YzFbtzW.exe
  C:\Windows\System\YzFbtzW.exe
  2⤵
  PID:4256
- C:\Windows\System\xOFaoIA.exe
  C:\Windows\System\xOFaoIA.exe
  2⤵
  PID:4272
- C:\Windows\System\HikZQdg.exe
  C:\Windows\System\HikZQdg.exe
  2⤵
  PID:4288
- C:\Windows\System\kNfxLXP.exe
  C:\Windows\System\kNfxLXP.exe
  2⤵
  PID:4312
- C:\Windows\System\FzFbKmQ.exe
  C:\Windows\System\FzFbKmQ.exe
  2⤵
  PID:4352
- C:\Windows\System\dXAlusW.exe
  C:\Windows\System\dXAlusW.exe
  2⤵
  PID:4384
- C:\Windows\System\DsGiZMP.exe
  C:\Windows\System\DsGiZMP.exe
  2⤵
  PID:4400
- C:\Windows\System\cdzcpqC.exe
  C:\Windows\System\cdzcpqC.exe
  2⤵
  PID:4416
- C:\Windows\System\fRUTrcm.exe
  C:\Windows\System\fRUTrcm.exe
  2⤵
  PID:4432
- C:\Windows\System\OPoTGkr.exe
  C:\Windows\System\OPoTGkr.exe
  2⤵
  PID:4456
- C:\Windows\System\qIGQisK.exe
  C:\Windows\System\qIGQisK.exe
  2⤵
  PID:4476
- C:\Windows\System\SxCADpR.exe
  C:\Windows\System\SxCADpR.exe
  2⤵
  PID:4492
- C:\Windows\System\UPPaZEW.exe
  C:\Windows\System\UPPaZEW.exe
  2⤵
  PID:4508
- C:\Windows\System\ihDYJxO.exe
  C:\Windows\System\ihDYJxO.exe
  2⤵
  PID:4528
- C:\Windows\System\GwfzpcT.exe
  C:\Windows\System\GwfzpcT.exe
  2⤵
  PID:4544
- C:\Windows\System\wugCRbI.exe
  C:\Windows\System\wugCRbI.exe
  2⤵
  PID:4564
- C:\Windows\System\RgyYkVH.exe
  C:\Windows\System\RgyYkVH.exe
  2⤵
  PID:4580
- C:\Windows\System\pRfGWUC.exe
  C:\Windows\System\pRfGWUC.exe
  2⤵
  PID:4596
- C:\Windows\System\bCLdfJA.exe
  C:\Windows\System\bCLdfJA.exe
  2⤵
  PID:4632
- C:\Windows\System\OHaexuH.exe
  C:\Windows\System\OHaexuH.exe
  2⤵
  PID:4648
- C:\Windows\System\YSesqIk.exe
  C:\Windows\System\YSesqIk.exe
  2⤵
  PID:4664
- C:\Windows\System\aywomfN.exe
  C:\Windows\System\aywomfN.exe
  2⤵
  PID:4680
- C:\Windows\System\fOHyrzx.exe
  C:\Windows\System\fOHyrzx.exe
  2⤵
  PID:4700
- C:\Windows\System\JITOStR.exe
  C:\Windows\System\JITOStR.exe
  2⤵
  PID:4716
- C:\Windows\System\hzpwLGT.exe
  C:\Windows\System\hzpwLGT.exe
  2⤵
  PID:4732
- C:\Windows\System\cdfNCZh.exe
  C:\Windows\System\cdfNCZh.exe
  2⤵
  PID:4748
- C:\Windows\System\sJZQRoL.exe
  C:\Windows\System\sJZQRoL.exe
  2⤵
  PID:4764
- C:\Windows\System\CeIICeH.exe
  C:\Windows\System\CeIICeH.exe
  2⤵
  PID:4780
- C:\Windows\System\CBymkvR.exe
  C:\Windows\System\CBymkvR.exe
  2⤵
  PID:4796
- C:\Windows\System\oSPQlzu.exe
  C:\Windows\System\oSPQlzu.exe
  2⤵
  PID:4812
- C:\Windows\System\KBuMjcC.exe
  C:\Windows\System\KBuMjcC.exe
  2⤵
  PID:4828
- C:\Windows\System\iypwkEy.exe
  C:\Windows\System\iypwkEy.exe
  2⤵
  PID:4848
- C:\Windows\System\ZGiKpqd.exe
  C:\Windows\System\ZGiKpqd.exe
  2⤵
  PID:4864
- C:\Windows\System\fgfAcjx.exe
  C:\Windows\System\fgfAcjx.exe
  2⤵
  PID:4884
- C:\Windows\System\vTYaYbI.exe
  C:\Windows\System\vTYaYbI.exe
  2⤵
  PID:4900
- C:\Windows\System\Grrjqlp.exe
  C:\Windows\System\Grrjqlp.exe
  2⤵
  PID:4916
- C:\Windows\System\emZOYTD.exe
  C:\Windows\System\emZOYTD.exe
  2⤵
  PID:4932
- C:\Windows\System\HBjuspF.exe
  C:\Windows\System\HBjuspF.exe
  2⤵
  PID:4948
- C:\Windows\System\uTfXXaD.exe
  C:\Windows\System\uTfXXaD.exe
  2⤵
  PID:4968
- C:\Windows\System\VAjqAdR.exe
  C:\Windows\System\VAjqAdR.exe
  2⤵
  PID:4984
- C:\Windows\System\HnnZzgf.exe
  C:\Windows\System\HnnZzgf.exe
  2⤵
  PID:5000
- C:\Windows\System\cYjoMKw.exe
  C:\Windows\System\cYjoMKw.exe
  2⤵
  PID:5016
- C:\Windows\System\IsBUcZS.exe
  C:\Windows\System\IsBUcZS.exe
  2⤵
  PID:5032
- C:\Windows\System\JxEfCtl.exe
  C:\Windows\System\JxEfCtl.exe
  2⤵
  PID:5048
- C:\Windows\System\AZRHZOu.exe
  C:\Windows\System\AZRHZOu.exe
  2⤵
  PID:5064
- C:\Windows\System\AcNymUt.exe
  C:\Windows\System\AcNymUt.exe
  2⤵
  PID:5080
- C:\Windows\System\XPMzXBI.exe
  C:\Windows\System\XPMzXBI.exe
  2⤵
  PID:5096
- C:\Windows\System\EyFICLp.exe
  C:\Windows\System\EyFICLp.exe
  2⤵
  PID:5116
- C:\Windows\System\jMdlBDm.exe
  C:\Windows\System\jMdlBDm.exe
  2⤵
  PID:4056
- C:\Windows\System\qDvUPWO.exe
  C:\Windows\System\qDvUPWO.exe
  2⤵
  PID:2176
- C:\Windows\System\hGSXgch.exe
  C:\Windows\System\hGSXgch.exe
  2⤵
  PID:3184
- C:\Windows\System\MzXRqDP.exe
  C:\Windows\System\MzXRqDP.exe
  2⤵
  PID:3248
- C:\Windows\System\ZcVMIig.exe
  C:\Windows\System\ZcVMIig.exe
  2⤵
  PID:3300
- C:\Windows\System\OjfwyNJ.exe
  C:\Windows\System\OjfwyNJ.exe
  2⤵
  PID:3404
- C:\Windows\System\eQANYhW.exe
  C:\Windows\System\eQANYhW.exe
  2⤵
  PID:3556
- C:\Windows\System\sBACiga.exe
  C:\Windows\System\sBACiga.exe
  2⤵
  PID:3240
- C:\Windows\System\fLmlriY.exe
  C:\Windows\System\fLmlriY.exe
  2⤵
  PID:3388
- C:\Windows\System\fMWOoHL.exe
  C:\Windows\System\fMWOoHL.exe
  2⤵
  PID:3420
- C:\Windows\System\SJxdzLK.exe
  C:\Windows\System\SJxdzLK.exe
  2⤵
  PID:3640
- C:\Windows\System\DagdhpS.exe
  C:\Windows\System\DagdhpS.exe
  2⤵
  PID:3464
- C:\Windows\System\QAxQwWr.exe
  C:\Windows\System\QAxQwWr.exe
  2⤵
  PID:3576
- C:\Windows\System\JSSrmYn.exe
  C:\Windows\System\JSSrmYn.exe
  2⤵
  PID:3756
- C:\Windows\System\EumLJAF.exe
  C:\Windows\System\EumLJAF.exe
  2⤵
  PID:3704
- C:\Windows\System\YFWlxuy.exe
  C:\Windows\System\YFWlxuy.exe
  2⤵
  PID:3876
- C:\Windows\System\rZiDKmW.exe
  C:\Windows\System\rZiDKmW.exe
  2⤵
  PID:3968
- C:\Windows\System\rwtLcZR.exe
  C:\Windows\System\rwtLcZR.exe
  2⤵
  PID:3760
- C:\Windows\System\gEORgHW.exe
  C:\Windows\System\gEORgHW.exe
  2⤵
  PID:4100
- C:\Windows\System\LjgiNVS.exe
  C:\Windows\System\LjgiNVS.exe
  2⤵
  PID:4164
- C:\Windows\System\OWrXlhu.exe
  C:\Windows\System\OWrXlhu.exe
  2⤵
  PID:4232
- C:\Windows\System\TKLaPxQ.exe
  C:\Windows\System\TKLaPxQ.exe
  2⤵
  PID:4296
- C:\Windows\System\OJwcVKZ.exe
  C:\Windows\System\OJwcVKZ.exe
  2⤵
  PID:3076
- C:\Windows\System\wKQdxpr.exe
  C:\Windows\System\wKQdxpr.exe
  2⤵
  PID:2420
- C:\Windows\System\lEIoqfa.exe
  C:\Windows\System\lEIoqfa.exe
  2⤵
  PID:1036
- C:\Windows\System\RxbaPAM.exe
  C:\Windows\System\RxbaPAM.exe
  2⤵
  PID:3948
- C:\Windows\System\jZvZybZ.exe
  C:\Windows\System\jZvZybZ.exe
  2⤵
  PID:3936
- C:\Windows\System\qBABhGq.exe
  C:\Windows\System\qBABhGq.exe
  2⤵
  PID:4068
- C:\Windows\System\eZMaeEB.exe
  C:\Windows\System\eZMaeEB.exe
  2⤵
  PID:4180
- C:\Windows\System\pNqVfyh.exe
  C:\Windows\System\pNqVfyh.exe
  2⤵
  PID:4284
- C:\Windows\System\brJMWei.exe
  C:\Windows\System\brJMWei.exe
  2⤵
  PID:4248
- C:\Windows\System\yQhGCpF.exe
  C:\Windows\System\yQhGCpF.exe
  2⤵
  PID:4412
- C:\Windows\System\UlSFMkN.exe
  C:\Windows\System\UlSFMkN.exe
  2⤵
  PID:4440
- C:\Windows\System\qylwHiu.exe
  C:\Windows\System\qylwHiu.exe
  2⤵
  PID:4484
- C:\Windows\System\hwBjPMc.exe
  C:\Windows\System\hwBjPMc.exe
  2⤵
  PID:4524
- C:\Windows\System\alfIycA.exe
  C:\Windows\System\alfIycA.exe
  2⤵
  PID:4588
- C:\Windows\System\ABBoXDS.exe
  C:\Windows\System\ABBoXDS.exe
  2⤵
  PID:4396
- C:\Windows\System\EZuFSIw.exe
  C:\Windows\System\EZuFSIw.exe
  2⤵
  PID:4472
- C:\Windows\System\hjfyclH.exe
  C:\Windows\System\hjfyclH.exe
  2⤵
  PID:4536
- C:\Windows\System\zPtgqus.exe
  C:\Windows\System\zPtgqus.exe
  2⤵
  PID:4620
- C:\Windows\System\uxXhUUT.exe
  C:\Windows\System\uxXhUUT.exe
  2⤵
  PID:4676
- C:\Windows\System\HIIGNey.exe
  C:\Windows\System\HIIGNey.exe
  2⤵
  PID:4744
- C:\Windows\System\QPjYOFh.exe
  C:\Windows\System\QPjYOFh.exe
  2⤵
  PID:4836
- C:\Windows\System\ewJtjnY.exe
  C:\Windows\System\ewJtjnY.exe
  2⤵
  PID:4844
- C:\Windows\System\XqvFIjS.exe
  C:\Windows\System\XqvFIjS.exe
  2⤵
  PID:4880
- C:\Windows\System\MTlWPof.exe
  C:\Windows\System\MTlWPof.exe
  2⤵
  PID:4820
- C:\Windows\System\SRCibnh.exe
  C:\Windows\System\SRCibnh.exe
  2⤵
  PID:4628
- C:\Windows\System\BuhnUpJ.exe
  C:\Windows\System\BuhnUpJ.exe
  2⤵
  PID:4692
- C:\Windows\System\eACGyPy.exe
  C:\Windows\System\eACGyPy.exe
  2⤵
  PID:4756
- C:\Windows\System\wLPmVWf.exe
  C:\Windows\System\wLPmVWf.exe
  2⤵
  PID:4824
- C:\Windows\System\xAunKsU.exe
  C:\Windows\System\xAunKsU.exe
  2⤵
  PID:4892
- C:\Windows\System\CAekpqW.exe
  C:\Windows\System\CAekpqW.exe
  2⤵
  PID:4928
- C:\Windows\System\SyPiUAK.exe
  C:\Windows\System\SyPiUAK.exe
  2⤵
  PID:4980
- C:\Windows\System\UEluZfT.exe
  C:\Windows\System\UEluZfT.exe
  2⤵
  PID:4992
- C:\Windows\System\AWShHCC.exe
  C:\Windows\System\AWShHCC.exe
  2⤵
  PID:5044
- C:\Windows\System\Lwnlzwg.exe
  C:\Windows\System\Lwnlzwg.exe
  2⤵
  PID:5088
- C:\Windows\System\aJkYYrC.exe
  C:\Windows\System\aJkYYrC.exe
  2⤵
  PID:5092
- C:\Windows\System\VaPMniP.exe
  C:\Windows\System\VaPMniP.exe
  2⤵
  PID:3096
- C:\Windows\System\sJxsLOd.exe
  C:\Windows\System\sJxsLOd.exe
  2⤵
  PID:3140
- C:\Windows\System\ctVHPQd.exe
  C:\Windows\System\ctVHPQd.exe
  2⤵
  PID:2220
- C:\Windows\System\MaElEGj.exe
  C:\Windows\System\MaElEGj.exe
  2⤵
  PID:3284
- C:\Windows\System\zKmsuDe.exe
  C:\Windows\System\zKmsuDe.exe
  2⤵
  PID:3644
- C:\Windows\System\JWfmGre.exe
  C:\Windows\System\JWfmGre.exe
  2⤵
  PID:3716
- C:\Windows\System\ayejUbf.exe
  C:\Windows\System\ayejUbf.exe
  2⤵
  PID:4036
- C:\Windows\System\EZspUkP.exe
  C:\Windows\System\EZspUkP.exe
  2⤵
  PID:3820
- C:\Windows\System\ChZCGSQ.exe
  C:\Windows\System\ChZCGSQ.exe
  2⤵
  PID:4132
- C:\Windows\System\YKkRqKv.exe
  C:\Windows\System\YKkRqKv.exe
  2⤵
  PID:3480
- C:\Windows\System\ZjFsxpu.exe
  C:\Windows\System\ZjFsxpu.exe
  2⤵
  PID:1532
- C:\Windows\System\UwgZxTD.exe
  C:\Windows\System\UwgZxTD.exe
  2⤵
  PID:4152
- C:\Windows\System\sOkMyvY.exe
  C:\Windows\System\sOkMyvY.exe
  2⤵
  PID:4220
- C:\Windows\System\zTscWOU.exe
  C:\Windows\System\zTscWOU.exe
  2⤵
  PID:4372
- C:\Windows\System\YYoVNyM.exe
  C:\Windows\System\YYoVNyM.exe
  2⤵
  PID:4616
- C:\Windows\System\gMgjZYK.exe
  C:\Windows\System\gMgjZYK.exe
  2⤵
  PID:4964
- C:\Windows\System\DlpYGof.exe
  C:\Windows\System\DlpYGof.exe
  2⤵
  PID:5012
- C:\Windows\System\VvOfiNs.exe
  C:\Windows\System\VvOfiNs.exe
  2⤵
  PID:3360
- C:\Windows\System\lFbpOLv.exe
  C:\Windows\System\lFbpOLv.exe
  2⤵
  PID:4076
- C:\Windows\System\ixThTdP.exe
  C:\Windows\System\ixThTdP.exe
  2⤵
  PID:4216
- C:\Windows\System\mVqbZhe.exe
  C:\Windows\System\mVqbZhe.exe
  2⤵
  PID:4452
- C:\Windows\System\GiogDzf.exe
  C:\Windows\System\GiogDzf.exe
  2⤵
  PID:4520
- C:\Windows\System\TPePmBd.exe
  C:\Windows\System\TPePmBd.exe
  2⤵
  PID:4428
- C:\Windows\System\LgOatFD.exe
  C:\Windows\System\LgOatFD.exe
  2⤵
  PID:4712
- C:\Windows\System\jQtkOvk.exe
  C:\Windows\System\jQtkOvk.exe
  2⤵
  PID:4840
- C:\Windows\System\GLamHkU.exe
  C:\Windows\System\GLamHkU.exe
  2⤵
  PID:4672
- C:\Windows\System\feAZhld.exe
  C:\Windows\System\feAZhld.exe
  2⤵
  PID:4876
- C:\Windows\System\egZXaNj.exe
  C:\Windows\System\egZXaNj.exe
  2⤵
  PID:4624
- C:\Windows\System\vFAAQUS.exe
  C:\Windows\System\vFAAQUS.exe
  2⤵
  PID:4924
- C:\Windows\System\UyXTShR.exe
  C:\Windows\System\UyXTShR.exe
  2⤵
  PID:5028
- C:\Windows\System\UaiCiwK.exe
  C:\Windows\System\UaiCiwK.exe
  2⤵
  PID:4944
- C:\Windows\System\ktqntCy.exe
  C:\Windows\System\ktqntCy.exe
  2⤵
  PID:4200
- C:\Windows\System\fupkVsH.exe
  C:\Windows\System\fupkVsH.exe
  2⤵
  PID:3120
- C:\Windows\System\qOPkUVg.exe
  C:\Windows\System\qOPkUVg.exe
  2⤵
  PID:3624
- C:\Windows\System\nVsnxaG.exe
  C:\Windows\System\nVsnxaG.exe
  2⤵
  PID:4364
- C:\Windows\System\IiRlTlO.exe
  C:\Windows\System\IiRlTlO.exe
  2⤵
  PID:4740
- C:\Windows\System\KagXopM.exe
  C:\Windows\System\KagXopM.exe
  2⤵
  PID:4772
- C:\Windows\System\bFzlAwW.exe
  C:\Windows\System\bFzlAwW.exe
  2⤵
  PID:5040
- C:\Windows\System\AJiRhwE.exe
  C:\Windows\System\AJiRhwE.exe
  2⤵
  PID:5104
- C:\Windows\System\QTIMCWm.exe
  C:\Windows\System\QTIMCWm.exe
  2⤵
  PID:1664
- C:\Windows\System\dFWCGLF.exe
  C:\Windows\System\dFWCGLF.exe
  2⤵
  PID:4252
- C:\Windows\System\FyYlqhY.exe
  C:\Windows\System\FyYlqhY.exe
  2⤵
  PID:4408
- C:\Windows\System\XMroStm.exe
  C:\Windows\System\XMroStm.exe
  2⤵
  PID:4572
- C:\Windows\System\SiANNTK.exe
  C:\Windows\System\SiANNTK.exe
  2⤵
  PID:4308
- C:\Windows\System\YHREKvv.exe
  C:\Windows\System\YHREKvv.exe
  2⤵
  PID:5144
- C:\Windows\System\JPeVmoq.exe
  C:\Windows\System\JPeVmoq.exe
  2⤵
  PID:5160
- C:\Windows\System\pyfNPle.exe
  C:\Windows\System\pyfNPle.exe
  2⤵
  PID:5176
- C:\Windows\System\tYiYchQ.exe
  C:\Windows\System\tYiYchQ.exe
  2⤵
  PID:5200
- C:\Windows\System\ZphCJUi.exe
  C:\Windows\System\ZphCJUi.exe
  2⤵
  PID:5224
- C:\Windows\System\ldnlZci.exe
  C:\Windows\System\ldnlZci.exe
  2⤵
  PID:5248
- C:\Windows\System\TwPoCCm.exe
  C:\Windows\System\TwPoCCm.exe
  2⤵
  PID:5272
- C:\Windows\System\mxfVSDa.exe
  C:\Windows\System\mxfVSDa.exe
  2⤵
  PID:5292
- C:\Windows\System\ecaqQcA.exe
  C:\Windows\System\ecaqQcA.exe
  2⤵
  PID:5312
- C:\Windows\System\SkJkHqi.exe
  C:\Windows\System\SkJkHqi.exe
  2⤵
  PID:5328
- C:\Windows\System\EZxhGOe.exe
  C:\Windows\System\EZxhGOe.exe
  2⤵
  PID:5348
- C:\Windows\System\sPxPNnW.exe
  C:\Windows\System\sPxPNnW.exe
  2⤵
  PID:5364
- C:\Windows\System\RYEOPqo.exe
  C:\Windows\System\RYEOPqo.exe
  2⤵
  PID:5380
- C:\Windows\System\EAIBCvU.exe
  C:\Windows\System\EAIBCvU.exe
  2⤵
  PID:5404
- C:\Windows\System\qFDkTaf.exe
  C:\Windows\System\qFDkTaf.exe
  2⤵
  PID:5420
- C:\Windows\System\hSxFhCc.exe
  C:\Windows\System\hSxFhCc.exe
  2⤵
  PID:5440
- C:\Windows\System\iQdjOEt.exe
  C:\Windows\System\iQdjOEt.exe
  2⤵
  PID:5456
- C:\Windows\System\FUMvxXX.exe
  C:\Windows\System\FUMvxXX.exe
  2⤵
  PID:5472
- C:\Windows\System\QLPEysq.exe
  C:\Windows\System\QLPEysq.exe
  2⤵
  PID:5488
- C:\Windows\System\GsTroEY.exe
  C:\Windows\System\GsTroEY.exe
  2⤵
  PID:5504
- C:\Windows\System\cisgQnV.exe
  C:\Windows\System\cisgQnV.exe
  2⤵
  PID:5520
- C:\Windows\System\lHgyZFk.exe
  C:\Windows\System\lHgyZFk.exe
  2⤵
  PID:5536
- C:\Windows\System\HxUFPle.exe
  C:\Windows\System\HxUFPle.exe
  2⤵
  PID:5556
- C:\Windows\System\nGLqQQj.exe
  C:\Windows\System\nGLqQQj.exe
  2⤵
  PID:5572
- C:\Windows\System\xKozNGD.exe
  C:\Windows\System\xKozNGD.exe
  2⤵
  PID:5588
- C:\Windows\System\vTnsbuq.exe
  C:\Windows\System\vTnsbuq.exe
  2⤵
  PID:5604
- C:\Windows\System\wsLXLVY.exe
  C:\Windows\System\wsLXLVY.exe
  2⤵
  PID:5620
- C:\Windows\System\SvyrWjN.exe
  C:\Windows\System\SvyrWjN.exe
  2⤵
  PID:5636
- C:\Windows\System\FeCYdmo.exe
  C:\Windows\System\FeCYdmo.exe
  2⤵
  PID:5652
- C:\Windows\System\AjVRmGd.exe
  C:\Windows\System\AjVRmGd.exe
  2⤵
  PID:5668
- C:\Windows\System\ilWlnRK.exe
  C:\Windows\System\ilWlnRK.exe
  2⤵
  PID:5684
- C:\Windows\System\WTDVUdM.exe
  C:\Windows\System\WTDVUdM.exe
  2⤵
  PID:5700
- C:\Windows\System\epTWeMn.exe
  C:\Windows\System\epTWeMn.exe
  2⤵
  PID:5716
- C:\Windows\System\bMHzZrh.exe
  C:\Windows\System\bMHzZrh.exe
  2⤵
  PID:5732
- C:\Windows\System\rRgctpB.exe
  C:\Windows\System\rRgctpB.exe
  2⤵
  PID:5748
- C:\Windows\System\zBpybgF.exe
  C:\Windows\System\zBpybgF.exe
  2⤵
  PID:5764
- C:\Windows\System\juYqoqq.exe
  C:\Windows\System\juYqoqq.exe
  2⤵
  PID:5780
- C:\Windows\System\kiNTZdF.exe
  C:\Windows\System\kiNTZdF.exe
  2⤵
  PID:5796
- C:\Windows\System\dgJvRwZ.exe
  C:\Windows\System\dgJvRwZ.exe
  2⤵
  PID:5880
- C:\Windows\System\zrKKUKC.exe
  C:\Windows\System\zrKKUKC.exe
  2⤵
  PID:5896
- C:\Windows\System\kEwfwwJ.exe
  C:\Windows\System\kEwfwwJ.exe
  2⤵
  PID:5916
- C:\Windows\System\XkuIHfn.exe
  C:\Windows\System\XkuIHfn.exe
  2⤵
  PID:5932
- C:\Windows\System\NbGtAYT.exe
  C:\Windows\System\NbGtAYT.exe
  2⤵
  PID:5948
- C:\Windows\System\bfQaIKc.exe
  C:\Windows\System\bfQaIKc.exe
  2⤵
  PID:5964
- C:\Windows\System\nimNdNi.exe
  C:\Windows\System\nimNdNi.exe
  2⤵
  PID:5984
- C:\Windows\System\uyEBlrq.exe
  C:\Windows\System\uyEBlrq.exe
  2⤵
  PID:6000
- C:\Windows\System\cZbdNcd.exe
  C:\Windows\System\cZbdNcd.exe
  2⤵
  PID:6020
- C:\Windows\System\pInOMZu.exe
  C:\Windows\System\pInOMZu.exe
  2⤵
  PID:6036
- C:\Windows\System\gyUFVio.exe
  C:\Windows\System\gyUFVio.exe
  2⤵
  PID:6052
- C:\Windows\System\tZRgIUz.exe
  C:\Windows\System\tZRgIUz.exe
  2⤵
  PID:6068
- C:\Windows\System\jAQPIsi.exe
  C:\Windows\System\jAQPIsi.exe
  2⤵
  PID:6084
- C:\Windows\System\kOiMWLD.exe
  C:\Windows\System\kOiMWLD.exe
  2⤵
  PID:6100
- C:\Windows\System\klMColc.exe
  C:\Windows\System\klMColc.exe
  2⤵
  PID:6116
- C:\Windows\System\GscZidf.exe
  C:\Windows\System\GscZidf.exe
  2⤵
  PID:6132
- C:\Windows\System\dGePFRX.exe
  C:\Windows\System\dGePFRX.exe
  2⤵
  PID:5152
- C:\Windows\System\xqukCrg.exe
  C:\Windows\System\xqukCrg.exe
  2⤵
  PID:1992
- C:\Windows\System\HMfjMjf.exe
  C:\Windows\System\HMfjMjf.exe
  2⤵
  PID:4500
- C:\Windows\System\apoloHF.exe
  C:\Windows\System\apoloHF.exe
  2⤵
  PID:2568
- C:\Windows\System\ZFfMkkG.exe
  C:\Windows\System\ZFfMkkG.exe
  2⤵
  PID:5124
- C:\Windows\System\FetZIeA.exe
  C:\Windows\System\FetZIeA.exe
  2⤵
  PID:5136
- C:\Windows\System\EYMXqiC.exe
  C:\Windows\System\EYMXqiC.exe
  2⤵
  PID:5188
- C:\Windows\System\ayOKDdg.exe
  C:\Windows\System\ayOKDdg.exe
  2⤵
  PID:5172
- C:\Windows\System\acwGCVn.exe
  C:\Windows\System\acwGCVn.exe
  2⤵
  PID:5240
- C:\Windows\System\oabVwrQ.exe
  C:\Windows\System\oabVwrQ.exe
  2⤵
  PID:5260
- C:\Windows\System\JTLhRJd.exe
  C:\Windows\System\JTLhRJd.exe
  2⤵
  PID:5320
- C:\Windows\System\lOSzWjM.exe
  C:\Windows\System\lOSzWjM.exe
  2⤵
  PID:5304
- C:\Windows\System\RLBBmQt.exe
  C:\Windows\System\RLBBmQt.exe
  2⤵
  PID:5300
- C:\Windows\System\oDQQHNs.exe
  C:\Windows\System\oDQQHNs.exe
  2⤵
  PID:5416
- C:\Windows\System\BFCBraD.exe
  C:\Windows\System\BFCBraD.exe
  2⤵
  PID:5484
- C:\Windows\System\HFJoEKh.exe
  C:\Windows\System\HFJoEKh.exe
  2⤵
  PID:5552
- C:\Windows\System\mvctFwA.exe
  C:\Windows\System\mvctFwA.exe
  2⤵
  PID:5612
- C:\Windows\System\ATsbBjb.exe
  C:\Windows\System\ATsbBjb.exe
  2⤵
  PID:4128
- C:\Windows\System\tuNvYCh.exe
  C:\Windows\System\tuNvYCh.exe
  2⤵
  PID:5676
- C:\Windows\System\pppqduW.exe
  C:\Windows\System\pppqduW.exe
  2⤵
  PID:5816
- C:\Windows\System\qWxvVwt.exe
  C:\Windows\System\qWxvVwt.exe
  2⤵
  PID:5832
- C:\Windows\System\YLqivFL.exe
  C:\Windows\System\YLqivFL.exe
  2⤵
  PID:5852
- C:\Windows\System\QwwzDne.exe
  C:\Windows\System\QwwzDne.exe
  2⤵
  PID:5868
- C:\Windows\System\MOzlaaZ.exe
  C:\Windows\System\MOzlaaZ.exe
  2⤵
  PID:5908
- C:\Windows\System\QDqVIwF.exe
  C:\Windows\System\QDqVIwF.exe
  2⤵
  PID:5976
- C:\Windows\System\wnrEAhw.exe
  C:\Windows\System\wnrEAhw.exe
  2⤵
  PID:6016
- C:\Windows\System\xtQSNsj.exe
  C:\Windows\System\xtQSNsj.exe
  2⤵
  PID:6076
- C:\Windows\System\igbNEAq.exe
  C:\Windows\System\igbNEAq.exe
  2⤵
  PID:5960
- C:\Windows\System\cdDTTgq.exe
  C:\Windows\System\cdDTTgq.exe
  2⤵
  PID:6112
- C:\Windows\System\OjwBbZX.exe
  C:\Windows\System\OjwBbZX.exe
  2⤵
  PID:5996
- C:\Windows\System\TwhwJUh.exe
  C:\Windows\System\TwhwJUh.exe
  2⤵
  PID:6064
- C:\Windows\System\YRQxfGf.exe
  C:\Windows\System\YRQxfGf.exe
  2⤵
  PID:4092
- C:\Windows\System\XLpErVz.exe
  C:\Windows\System\XLpErVz.exe
  2⤵
  PID:5232
- C:\Windows\System\JlSHZOl.exe
  C:\Windows\System\JlSHZOl.exe
  2⤵
  PID:4792
- C:\Windows\System\vOloevw.exe
  C:\Windows\System\vOloevw.exe
  2⤵
  PID:5220
- C:\Windows\System\bjLauFw.exe
  C:\Windows\System\bjLauFw.exe
  2⤵
  PID:1488
- C:\Windows\System\UJYVDDy.exe
  C:\Windows\System\UJYVDDy.exe
  2⤵
  PID:5284
- C:\Windows\System\KuVqYpf.exe
  C:\Windows\System\KuVqYpf.exe
  2⤵
  PID:5376
- C:\Windows\System\rmoRaDS.exe
  C:\Windows\System\rmoRaDS.exe
  2⤵
  PID:5584
- C:\Windows\System\WNLSahf.exe
  C:\Windows\System\WNLSahf.exe
  2⤵
  PID:5544
- C:\Windows\System\BTNDYcR.exe
  C:\Windows\System\BTNDYcR.exe
  2⤵
  PID:5532
- C:\Windows\System\McGtccb.exe
  C:\Windows\System\McGtccb.exe
  2⤵
  PID:5596
- C:\Windows\System\uBwZgzW.exe
  C:\Windows\System\uBwZgzW.exe
  2⤵
  PID:5632
- C:\Windows\System\GwDeJYY.exe
  C:\Windows\System\GwDeJYY.exe
  2⤵
  PID:5600
- C:\Windows\System\xRUGGgv.exe
  C:\Windows\System\xRUGGgv.exe
  2⤵
  PID:5464
- C:\Windows\System\bWMjgDX.exe
  C:\Windows\System\bWMjgDX.exe
  2⤵
  PID:5396
- C:\Windows\System\xNvoglO.exe
  C:\Windows\System\xNvoglO.exe
  2⤵
  PID:5660
- C:\Windows\System\FpqhoZM.exe
  C:\Windows\System\FpqhoZM.exe
  2⤵
  PID:5792
- C:\Windows\System\SRVefsb.exe
  C:\Windows\System\SRVefsb.exe
  2⤵
  PID:5804
- C:\Windows\System\rBxrdnu.exe
  C:\Windows\System\rBxrdnu.exe
  2⤵
  PID:5828
- C:\Windows\System\okQWpiJ.exe
  C:\Windows\System\okQWpiJ.exe
  2⤵
  PID:5844
- C:\Windows\System\DQIorou.exe
  C:\Windows\System\DQIorou.exe
  2⤵
  PID:5812
- C:\Windows\System\mKqbUEP.exe
  C:\Windows\System\mKqbUEP.exe
  2⤵
  PID:6048
- C:\Windows\System\ZjIwSlp.exe
  C:\Windows\System\ZjIwSlp.exe
  2⤵
  PID:6080
- C:\Windows\System\mUjlZUR.exe
  C:\Windows\System\mUjlZUR.exe
  2⤵
  PID:5924
- C:\Windows\System\LpIKeJA.exe
  C:\Windows\System\LpIKeJA.exe
  2⤵
  PID:5184
- C:\Windows\System\uFTrYSk.exe
  C:\Windows\System\uFTrYSk.exe
  2⤵
  PID:6128
- C:\Windows\System\vPNFWmq.exe
  C:\Windows\System\vPNFWmq.exe
  2⤵
  PID:5412
- C:\Windows\System\ufZuEXK.exe
  C:\Windows\System\ufZuEXK.exe
  2⤵
  PID:5356
- C:\Windows\System\lyUePLg.exe
  C:\Windows\System\lyUePLg.exe
  2⤵
  PID:5564
- C:\Windows\System\JlSXbce.exe
  C:\Windows\System\JlSXbce.exe
  2⤵
  PID:5496
- C:\Windows\System\BIBmrWE.exe
  C:\Windows\System\BIBmrWE.exe
  2⤵
  PID:5360
- C:\Windows\System\oDnHkjT.exe
  C:\Windows\System\oDnHkjT.exe
  2⤵
  PID:5692
- C:\Windows\System\LzIzbMS.exe
  C:\Windows\System\LzIzbMS.exe
  2⤵
  PID:5664
- C:\Windows\System\sjHZMiw.exe
  C:\Windows\System\sjHZMiw.exe
  2⤵
  PID:5776
- C:\Windows\System\wMzCNlh.exe
  C:\Windows\System\wMzCNlh.exe
  2⤵
  PID:5728
- C:\Windows\System\iqFNPjO.exe
  C:\Windows\System\iqFNPjO.exe
  2⤵
  PID:4184
- C:\Windows\System\oxOMlrW.exe
  C:\Windows\System\oxOMlrW.exe
  2⤵
  PID:5940
- C:\Windows\System\RAxfJYB.exe
  C:\Windows\System\RAxfJYB.exe
  2⤵
  PID:5468
- C:\Windows\System\rdXvJum.exe
  C:\Windows\System\rdXvJum.exe
  2⤵
  PID:6012
- C:\Windows\System\SQqNHFl.exe
  C:\Windows\System\SQqNHFl.exe
  2⤵
  PID:5568
- C:\Windows\System\UimQwrJ.exe
  C:\Windows\System\UimQwrJ.exe
  2⤵
  PID:5628
- C:\Windows\System\VAApBHl.exe
  C:\Windows\System\VAApBHl.exe
  2⤵
  PID:5580
- C:\Windows\System\tdShIsV.exe
  C:\Windows\System\tdShIsV.exe
  2⤵
  PID:5860
- C:\Windows\System\zXYzDZJ.exe
  C:\Windows\System\zXYzDZJ.exe
  2⤵
  PID:5168
- C:\Windows\System\PzuiKvs.exe
  C:\Windows\System\PzuiKvs.exe
  2⤵
  PID:5156
- C:\Windows\System\RKPiBnz.exe
  C:\Windows\System\RKPiBnz.exe
  2⤵
  PID:5824
- C:\Windows\System\Vbopxzd.exe
  C:\Windows\System\Vbopxzd.exe
  2⤵
  PID:5400
- C:\Windows\System\FzrptNT.exe
  C:\Windows\System\FzrptNT.exe
  2⤵
  PID:5132
- C:\Windows\System\CgZFRyX.exe
  C:\Windows\System\CgZFRyX.exe
  2⤵
  PID:4728
- C:\Windows\System\tQDLvdy.exe
  C:\Windows\System\tQDLvdy.exe
  2⤵
  PID:6032
- C:\Windows\System\KoRGZJi.exe
  C:\Windows\System\KoRGZJi.exe
  2⤵
  PID:6148
- C:\Windows\System\lgmCbfb.exe
  C:\Windows\System\lgmCbfb.exe
  2⤵
  PID:6164
- C:\Windows\System\vNlgMPv.exe
  C:\Windows\System\vNlgMPv.exe
  2⤵
  PID:6180
- C:\Windows\System\qSdcxue.exe
  C:\Windows\System\qSdcxue.exe
  2⤵
  PID:6196
- C:\Windows\System\gLxXtqU.exe
  C:\Windows\System\gLxXtqU.exe
  2⤵
  PID:6212
- C:\Windows\System\XOpLTIr.exe
  C:\Windows\System\XOpLTIr.exe
  2⤵
  PID:6228
- C:\Windows\System\dIojNvV.exe
  C:\Windows\System\dIojNvV.exe
  2⤵
  PID:6244
- C:\Windows\System\WJIwBVP.exe
  C:\Windows\System\WJIwBVP.exe
  2⤵
  PID:6260
- C:\Windows\System\SYpXnEq.exe
  C:\Windows\System\SYpXnEq.exe
  2⤵
  PID:6276
- C:\Windows\System\tmlGYaN.exe
  C:\Windows\System\tmlGYaN.exe
  2⤵
  PID:6292
- C:\Windows\System\pnqGLiQ.exe
  C:\Windows\System\pnqGLiQ.exe
  2⤵
  PID:6308
- C:\Windows\System\clnddhE.exe
  C:\Windows\System\clnddhE.exe
  2⤵
  PID:6324
- C:\Windows\System\EfUUpki.exe
  C:\Windows\System\EfUUpki.exe
  2⤵
  PID:6340
- C:\Windows\System\xJaDsiQ.exe
  C:\Windows\System\xJaDsiQ.exe
  2⤵
  PID:6356
- C:\Windows\System\PMraPSz.exe
  C:\Windows\System\PMraPSz.exe
  2⤵
  PID:6372
- C:\Windows\System\lQcIuTP.exe
  C:\Windows\System\lQcIuTP.exe
  2⤵
  PID:6388
- C:\Windows\System\WblDHAd.exe
  C:\Windows\System\WblDHAd.exe
  2⤵
  PID:6404
- C:\Windows\System\mOTSvnh.exe
  C:\Windows\System\mOTSvnh.exe
  2⤵
  PID:6420
- C:\Windows\System\HiXbhpE.exe
  C:\Windows\System\HiXbhpE.exe
  2⤵
  PID:6436
- C:\Windows\System\kBRoEZX.exe
  C:\Windows\System\kBRoEZX.exe
  2⤵
  PID:6452
- C:\Windows\System\DZHvkRV.exe
  C:\Windows\System\DZHvkRV.exe
  2⤵
  PID:6468
- C:\Windows\System\NcmWfka.exe
  C:\Windows\System\NcmWfka.exe
  2⤵
  PID:6484
- C:\Windows\System\EXsFAfK.exe
  C:\Windows\System\EXsFAfK.exe
  2⤵
  PID:6500
- C:\Windows\System\tVCsAWd.exe
  C:\Windows\System\tVCsAWd.exe
  2⤵
  PID:6516
- C:\Windows\System\cJyFUXF.exe
  C:\Windows\System\cJyFUXF.exe
  2⤵
  PID:6532
- C:\Windows\System\Oxvuepd.exe
  C:\Windows\System\Oxvuepd.exe
  2⤵
  PID:6548
- C:\Windows\System\lvvoCyp.exe
  C:\Windows\System\lvvoCyp.exe
  2⤵
  PID:6564
- C:\Windows\System\OocsUws.exe
  C:\Windows\System\OocsUws.exe
  2⤵
  PID:6580
- C:\Windows\System\QIZmMcC.exe
  C:\Windows\System\QIZmMcC.exe
  2⤵
  PID:6604
- C:\Windows\System\PXChJcl.exe
  C:\Windows\System\PXChJcl.exe
  2⤵
  PID:6620
- C:\Windows\System\bpSkZqi.exe
  C:\Windows\System\bpSkZqi.exe
  2⤵
  PID:6636
- C:\Windows\System\bOiHUKx.exe
  C:\Windows\System\bOiHUKx.exe
  2⤵
  PID:6652
- C:\Windows\System\KFonERw.exe
  C:\Windows\System\KFonERw.exe
  2⤵
  PID:6668
- C:\Windows\System\sVeleaQ.exe
  C:\Windows\System\sVeleaQ.exe
  2⤵
  PID:6684
- C:\Windows\System\PXKfZxa.exe
  C:\Windows\System\PXKfZxa.exe
  2⤵
  PID:6700
- C:\Windows\System\OzHQwZR.exe
  C:\Windows\System\OzHQwZR.exe
  2⤵
  PID:6716
- C:\Windows\System\czKEDfe.exe
  C:\Windows\System\czKEDfe.exe
  2⤵
  PID:6732
- C:\Windows\System\BgAJSQH.exe
  C:\Windows\System\BgAJSQH.exe
  2⤵
  PID:6748
- C:\Windows\System\EKTcLtT.exe
  C:\Windows\System\EKTcLtT.exe
  2⤵
  PID:6764
- C:\Windows\System\VyhzmWE.exe
  C:\Windows\System\VyhzmWE.exe
  2⤵
  PID:6780
- C:\Windows\System\MljXqbV.exe
  C:\Windows\System\MljXqbV.exe
  2⤵
  PID:6796
- C:\Windows\System\kctuirU.exe
  C:\Windows\System\kctuirU.exe
  2⤵
  PID:6812
- C:\Windows\System\kzDzccO.exe
  C:\Windows\System\kzDzccO.exe
  2⤵
  PID:6828
- C:\Windows\System\esUboiL.exe
  C:\Windows\System\esUboiL.exe
  2⤵
  PID:6844
- C:\Windows\System\butqbdw.exe
  C:\Windows\System\butqbdw.exe
  2⤵
  PID:6860
- C:\Windows\System\IfSsSGQ.exe
  C:\Windows\System\IfSsSGQ.exe
  2⤵
  PID:6876
- C:\Windows\System\FqKXfJF.exe
  C:\Windows\System\FqKXfJF.exe
  2⤵
  PID:6892
- C:\Windows\System\EpVNDep.exe
  C:\Windows\System\EpVNDep.exe
  2⤵
  PID:6908
- C:\Windows\System\zdgpCAY.exe
  C:\Windows\System\zdgpCAY.exe
  2⤵
  PID:6924
- C:\Windows\System\CBoQSix.exe
  C:\Windows\System\CBoQSix.exe
  2⤵
  PID:6940
- C:\Windows\System\ZeBPyLF.exe
  C:\Windows\System\ZeBPyLF.exe
  2⤵
  PID:6956
- C:\Windows\System\oJChHtP.exe
  C:\Windows\System\oJChHtP.exe
  2⤵
  PID:6972
- C:\Windows\System\KgUvxDQ.exe
  C:\Windows\System\KgUvxDQ.exe
  2⤵
  PID:6988
- C:\Windows\System\DAwtelD.exe
  C:\Windows\System\DAwtelD.exe
  2⤵
  PID:7004
- C:\Windows\System\PSXcxYl.exe
  C:\Windows\System\PSXcxYl.exe
  2⤵
  PID:7020
- C:\Windows\System\SZWabgb.exe
  C:\Windows\System\SZWabgb.exe
  2⤵
  PID:7036
- C:\Windows\System\VjRAJWT.exe
  C:\Windows\System\VjRAJWT.exe
  2⤵
  PID:7052
- C:\Windows\System\PwqyQow.exe
  C:\Windows\System\PwqyQow.exe
  2⤵
  PID:7068
- C:\Windows\System\BfBYAzq.exe
  C:\Windows\System\BfBYAzq.exe
  2⤵
  PID:7084
- C:\Windows\System\IkFaWwC.exe
  C:\Windows\System\IkFaWwC.exe
  2⤵
  PID:7100
- C:\Windows\System\yzmhPIy.exe
  C:\Windows\System\yzmhPIy.exe
  2⤵
  PID:7116
- C:\Windows\System\BIQoJBR.exe
  C:\Windows\System\BIQoJBR.exe
  2⤵
  PID:7132
- C:\Windows\System\zNwLqxR.exe
  C:\Windows\System\zNwLqxR.exe
  2⤵
  PID:7148
- C:\Windows\System\JBgHAhY.exe
  C:\Windows\System\JBgHAhY.exe
  2⤵
  PID:7164
- C:\Windows\System\DkyICvs.exe
  C:\Windows\System\DkyICvs.exe
  2⤵
  PID:6192
- C:\Windows\System\CDGzufk.exe
  C:\Windows\System\CDGzufk.exe
  2⤵
  PID:6240
- C:\Windows\System\MvJdEkj.exe
  C:\Windows\System\MvJdEkj.exe
  2⤵
  PID:6208
- C:\Windows\System\CZqWKNR.exe
  C:\Windows\System\CZqWKNR.exe
  2⤵
  PID:6256
- C:\Windows\System\KQSBSVV.exe
  C:\Windows\System\KQSBSVV.exe
  2⤵
  PID:6320
- C:\Windows\System\wbKmgeK.exe
  C:\Windows\System\wbKmgeK.exe
  2⤵
  PID:6352
- C:\Windows\System\YDMqbPe.exe
  C:\Windows\System\YDMqbPe.exe
  2⤵
  PID:6476
- C:\Windows\System\ywrcRFk.exe
  C:\Windows\System\ywrcRFk.exe
  2⤵
  PID:6512
- C:\Windows\System\vznNcYu.exe
  C:\Windows\System\vznNcYu.exe
  2⤵
  PID:6576
- C:\Windows\System\HkrlSuL.exe
  C:\Windows\System\HkrlSuL.exe
  2⤵
  PID:6464
- C:\Windows\System\gJELEln.exe
  C:\Windows\System\gJELEln.exe
  2⤵
  PID:6336
- C:\Windows\System\CDnrcmR.exe
  C:\Windows\System\CDnrcmR.exe
  2⤵
  PID:6432
- C:\Windows\System\bYtxvlQ.exe
  C:\Windows\System\bYtxvlQ.exe
  2⤵
  PID:6272
- C:\Windows\System\qBwyQVY.exe
  C:\Windows\System\qBwyQVY.exe
  2⤵
  PID:6496
- C:\Windows\System\cAMNXZG.exe
  C:\Windows\System\cAMNXZG.exe
  2⤵
  PID:6592
- C:\Windows\System\srlibpd.exe
  C:\Windows\System\srlibpd.exe
  2⤵
  PID:6648
- C:\Windows\System\XTEjHXn.exe
  C:\Windows\System\XTEjHXn.exe
  2⤵
  PID:6740
- C:\Windows\System\awgKrhr.exe
  C:\Windows\System\awgKrhr.exe
  2⤵
  PID:6808
- C:\Windows\System\WzfEpNq.exe
  C:\Windows\System\WzfEpNq.exe
  2⤵
  PID:6840
- C:\Windows\System\afLKeRW.exe
  C:\Windows\System\afLKeRW.exe
  2⤵
  PID:6900
- C:\Windows\System\tBaeXcD.exe
  C:\Windows\System\tBaeXcD.exe
  2⤵
  PID:6932
- C:\Windows\System\JhwnGKo.exe
  C:\Windows\System\JhwnGKo.exe
  2⤵
  PID:6788
- C:\Windows\System\wajBOjM.exe
  C:\Windows\System\wajBOjM.exe
  2⤵
  PID:6968
- C:\Windows\System\KIUJkKh.exe
  C:\Windows\System\KIUJkKh.exe
  2⤵
  PID:6692
- C:\Windows\System\AjxUmjI.exe
  C:\Windows\System\AjxUmjI.exe
  2⤵
  PID:6996
- C:\Windows\System\IGAcytU.exe
  C:\Windows\System\IGAcytU.exe
  2⤵
  PID:6824
- C:\Windows\System\qAuOEJc.exe
  C:\Windows\System\qAuOEJc.exe
  2⤵
  PID:6948
- C:\Windows\System\uuUGLpr.exe
  C:\Windows\System\uuUGLpr.exe
  2⤵
  PID:7016
- C:\Windows\System\nrwqfhR.exe
  C:\Windows\System\nrwqfhR.exe
  2⤵
  PID:7092
- C:\Windows\System\XnZpQMe.exe
  C:\Windows\System\XnZpQMe.exe
  2⤵
  PID:7080
- C:\Windows\System\embJRXk.exe
  C:\Windows\System\embJRXk.exe
  2⤵
  PID:7124
- C:\Windows\System\ijCGdvr.exe
  C:\Windows\System\ijCGdvr.exe
  2⤵
  PID:7160
- C:\Windows\System\oInfUHJ.exe
  C:\Windows\System\oInfUHJ.exe
  2⤵
  PID:6188
- C:\Windows\System\KzuXuBn.exe
  C:\Windows\System\KzuXuBn.exe
  2⤵
  PID:6028
- C:\Windows\System\tdAOXCd.exe
  C:\Windows\System\tdAOXCd.exe
  2⤵
  PID:6480
- C:\Windows\System\GbnBSLe.exe
  C:\Windows\System\GbnBSLe.exe
  2⤵
  PID:6444
- C:\Windows\System\UEStYgr.exe
  C:\Windows\System\UEStYgr.exe
  2⤵
  PID:6300
- C:\Windows\System\qSxEooT.exe
  C:\Windows\System\qSxEooT.exe
  2⤵
  PID:6772
- C:\Windows\System\fnPQeUy.exe
  C:\Windows\System\fnPQeUy.exe
  2⤵
  PID:6572
- C:\Windows\System\Ffaowhk.exe
  C:\Windows\System\Ffaowhk.exe
  2⤵
  PID:6708
- C:\Windows\System\pxKFQub.exe
  C:\Windows\System\pxKFQub.exe
  2⤵
  PID:6868
- C:\Windows\System\RWTzENq.exe
  C:\Windows\System\RWTzENq.exe
  2⤵
  PID:6428
- C:\Windows\System\uVCvxFP.exe
  C:\Windows\System\uVCvxFP.exe
  2⤵
  PID:6820
- C:\Windows\System\uOXbuby.exe
  C:\Windows\System\uOXbuby.exe
  2⤵
  PID:6664
- C:\Windows\System\jxMgBhh.exe
  C:\Windows\System\jxMgBhh.exe
  2⤵
  PID:6984
- C:\Windows\System\quydktz.exe
  C:\Windows\System\quydktz.exe
  2⤵
  PID:7156
- C:\Windows\System\kqmAWRV.exe
  C:\Windows\System\kqmAWRV.exe
  2⤵
  PID:6316
- C:\Windows\System\RIFGgIG.exe
  C:\Windows\System\RIFGgIG.exe
  2⤵
  PID:7028
- C:\Windows\System\hslOwPJ.exe
  C:\Windows\System\hslOwPJ.exe
  2⤵
  PID:6252
- C:\Windows\System\blaRUYB.exe
  C:\Windows\System\blaRUYB.exe
  2⤵
  PID:6628
- C:\Windows\System\dPneBgS.exe
  C:\Windows\System\dPneBgS.exe
  2⤵
  PID:6776
- C:\Windows\System\acQrGzL.exe
  C:\Windows\System\acQrGzL.exe
  2⤵
  PID:6660
- C:\Windows\System\yFiZEYi.exe
  C:\Windows\System\yFiZEYi.exe
  2⤵
  PID:7044
- C:\Windows\System\LeiCVNu.exe
  C:\Windows\System\LeiCVNu.exe
  2⤵
  PID:7128
- C:\Windows\System\TbbhcIS.exe
  C:\Windows\System\TbbhcIS.exe
  2⤵
  PID:6348
- C:\Windows\System\zDKVgUk.exe
  C:\Windows\System\zDKVgUk.exe
  2⤵
  PID:6980
- C:\Windows\System\kfFjbUo.exe
  C:\Windows\System\kfFjbUo.exe
  2⤵
  PID:7108
- C:\Windows\System\LBuYESn.exe
  C:\Windows\System\LBuYESn.exe
  2⤵
  PID:6544
- C:\Windows\System\utlZvob.exe
  C:\Windows\System\utlZvob.exe
  2⤵
  PID:6600
- C:\Windows\System\GNLNoVE.exe
  C:\Windows\System\GNLNoVE.exe
  2⤵
  PID:6756
- C:\Windows\System\RseKoPP.exe
  C:\Windows\System\RseKoPP.exe
  2⤵
  PID:6524
- C:\Windows\System\nIhWGtx.exe
  C:\Windows\System\nIhWGtx.exe
  2⤵
  PID:7060
- C:\Windows\System\AWYXuvz.exe
  C:\Windows\System\AWYXuvz.exe
  2⤵
  PID:7172
- C:\Windows\System\jHPEEXq.exe
  C:\Windows\System\jHPEEXq.exe
  2⤵
  PID:7188
- C:\Windows\System\COIukFI.exe
  C:\Windows\System\COIukFI.exe
  2⤵
  PID:7204
- C:\Windows\System\ATjxrpu.exe
  C:\Windows\System\ATjxrpu.exe
  2⤵
  PID:7220
- C:\Windows\System\YMqqCeB.exe
  C:\Windows\System\YMqqCeB.exe
  2⤵
  PID:7236
- C:\Windows\System\dquSoJP.exe
  C:\Windows\System\dquSoJP.exe
  2⤵
  PID:7252
- C:\Windows\System\UtJVhHT.exe
  C:\Windows\System\UtJVhHT.exe
  2⤵
  PID:7268
- C:\Windows\System\BPvmTlG.exe
  C:\Windows\System\BPvmTlG.exe
  2⤵
  PID:7284
- C:\Windows\System\rSRHEFS.exe
  C:\Windows\System\rSRHEFS.exe
  2⤵
  PID:7300
- C:\Windows\System\XwZajzK.exe
  C:\Windows\System\XwZajzK.exe
  2⤵
  PID:7316
- C:\Windows\System\fgmHZsI.exe
  C:\Windows\System\fgmHZsI.exe
  2⤵
  PID:7340
- C:\Windows\System\STscnGR.exe
  C:\Windows\System\STscnGR.exe
  2⤵
  PID:7360
- C:\Windows\System\StncWwd.exe
  C:\Windows\System\StncWwd.exe
  2⤵
  PID:7376
- C:\Windows\System\QNzsoIX.exe
  C:\Windows\System\QNzsoIX.exe
  2⤵
  PID:7392
- C:\Windows\System\jpFHvBr.exe
  C:\Windows\System\jpFHvBr.exe
  2⤵
  PID:7408
- C:\Windows\System\mbFQdgO.exe
  C:\Windows\System\mbFQdgO.exe
  2⤵
  PID:7424
- C:\Windows\System\aoLlVaF.exe
  C:\Windows\System\aoLlVaF.exe
  2⤵
  PID:7440
- C:\Windows\System\sGBisQa.exe
  C:\Windows\System\sGBisQa.exe
  2⤵
  PID:7456
- C:\Windows\System\bmjjHrL.exe
  C:\Windows\System\bmjjHrL.exe
  2⤵
  PID:7472
- C:\Windows\System\wZXEDio.exe
  C:\Windows\System\wZXEDio.exe
  2⤵
  PID:7488
- C:\Windows\System\MaDtXaK.exe
  C:\Windows\System\MaDtXaK.exe
  2⤵
  PID:7504
- C:\Windows\System\cUBbSUb.exe
  C:\Windows\System\cUBbSUb.exe
  2⤵
  PID:7520
- C:\Windows\System\ECYKaqq.exe
  C:\Windows\System\ECYKaqq.exe
  2⤵
  PID:7536
- C:\Windows\System\JEyrmVR.exe
  C:\Windows\System\JEyrmVR.exe
  2⤵
  PID:7552
- C:\Windows\System\EyQArWz.exe
  C:\Windows\System\EyQArWz.exe
  2⤵
  PID:7568
- C:\Windows\System\FEWledd.exe
  C:\Windows\System\FEWledd.exe
  2⤵
  PID:7584
- C:\Windows\System\DlFvdQm.exe
  C:\Windows\System\DlFvdQm.exe
  2⤵
  PID:7600
- C:\Windows\System\nIElygk.exe
  C:\Windows\System\nIElygk.exe
  2⤵
  PID:7616
- C:\Windows\System\WUiDvse.exe
  C:\Windows\System\WUiDvse.exe
  2⤵
  PID:7632
- C:\Windows\System\CqZPYiT.exe
  C:\Windows\System\CqZPYiT.exe
  2⤵
  PID:7648
- C:\Windows\System\mvxoJjQ.exe
  C:\Windows\System\mvxoJjQ.exe
  2⤵
  PID:7664
- C:\Windows\System\rOBuLRx.exe
  C:\Windows\System\rOBuLRx.exe
  2⤵
  PID:7680
- C:\Windows\System\iLTEpCH.exe
  C:\Windows\System\iLTEpCH.exe
  2⤵
  PID:7696
- C:\Windows\System\jZgytud.exe
  C:\Windows\System\jZgytud.exe
  2⤵
  PID:7712
- C:\Windows\System\FNDLRCM.exe
  C:\Windows\System\FNDLRCM.exe
  2⤵
  PID:7728
- C:\Windows\System\lRdqlTH.exe
  C:\Windows\System\lRdqlTH.exe
  2⤵
  PID:7744
- C:\Windows\System\fFapjwa.exe
  C:\Windows\System\fFapjwa.exe
  2⤵
  PID:7760
- C:\Windows\System\hqoWJlE.exe
  C:\Windows\System\hqoWJlE.exe
  2⤵
  PID:7776
- C:\Windows\System\CCcDHHI.exe
  C:\Windows\System\CCcDHHI.exe
  2⤵
  PID:7792
- C:\Windows\System\SbiPvtp.exe
  C:\Windows\System\SbiPvtp.exe
  2⤵
  PID:7808
- C:\Windows\System\LYayFVY.exe
  C:\Windows\System\LYayFVY.exe
  2⤵
  PID:7824
- C:\Windows\System\bNoekrk.exe
  C:\Windows\System\bNoekrk.exe
  2⤵
  PID:7840
- C:\Windows\System\cQAbOUC.exe
  C:\Windows\System\cQAbOUC.exe
  2⤵
  PID:7856
- C:\Windows\System\edblomp.exe
  C:\Windows\System\edblomp.exe
  2⤵
  PID:7872
- C:\Windows\System\rrNYUOi.exe
  C:\Windows\System\rrNYUOi.exe
  2⤵
  PID:7888
- C:\Windows\System\NLtOgif.exe
  C:\Windows\System\NLtOgif.exe
  2⤵
  PID:7904
- C:\Windows\System\UopvAha.exe
  C:\Windows\System\UopvAha.exe
  2⤵
  PID:7920
- C:\Windows\System\wwdtwEx.exe
  C:\Windows\System\wwdtwEx.exe
  2⤵
  PID:7936
- C:\Windows\System\xqgfEQw.exe
  C:\Windows\System\xqgfEQw.exe
  2⤵
  PID:7952
- C:\Windows\System\rHokVtX.exe
  C:\Windows\System\rHokVtX.exe
  2⤵
  PID:7968
- C:\Windows\System\WiyggPx.exe
  C:\Windows\System\WiyggPx.exe
  2⤵
  PID:7984
- C:\Windows\System\Nlykgkd.exe
  C:\Windows\System\Nlykgkd.exe
  2⤵
  PID:8000
- C:\Windows\System\xiZpFxO.exe
  C:\Windows\System\xiZpFxO.exe
  2⤵
  PID:8144
- C:\Windows\System\kztwOxZ.exe
  C:\Windows\System\kztwOxZ.exe
  2⤵
  PID:8164
- C:\Windows\System\cJPgynJ.exe
  C:\Windows\System\cJPgynJ.exe
  2⤵
  PID:8180
- C:\Windows\System\SHQGGqI.exe
  C:\Windows\System\SHQGGqI.exe
  2⤵
  PID:7212
- C:\Windows\System\wJCoSOH.exe
  C:\Windows\System\wJCoSOH.exe
  2⤵
  PID:7076
- C:\Windows\System\GFgtYyy.exe
  C:\Windows\System\GFgtYyy.exe
  2⤵
  PID:7228
- C:\Windows\System\LpsKHLL.exe
  C:\Windows\System\LpsKHLL.exe
  2⤵
  PID:7264
- C:\Windows\System\ALZvAve.exe
  C:\Windows\System\ALZvAve.exe
  2⤵
  PID:7312
- C:\Windows\System\ezWKfql.exe
  C:\Windows\System\ezWKfql.exe
  2⤵
  PID:7348
- C:\Windows\System\jgiALCA.exe
  C:\Windows\System\jgiALCA.exe
  2⤵
  PID:7416
- C:\Windows\System\tKtwDRo.exe
  C:\Windows\System\tKtwDRo.exe
  2⤵
  PID:7452
- C:\Windows\System\IObAMir.exe
  C:\Windows\System\IObAMir.exe
  2⤵
  PID:7516
- C:\Windows\System\nDftdXO.exe
  C:\Windows\System\nDftdXO.exe
  2⤵
  PID:7580
- C:\Windows\System\KWYLncg.exe
  C:\Windows\System\KWYLncg.exe
  2⤵
  PID:7432
- C:\Windows\System\hGZDoxt.exe
  C:\Windows\System\hGZDoxt.exe
  2⤵
  PID:7608
- C:\Windows\System\UffZviz.exe
  C:\Windows\System\UffZviz.exe
  2⤵
  PID:7532
- C:\Windows\System\nYOSwRE.exe
  C:\Windows\System\nYOSwRE.exe
  2⤵
  PID:7644
- C:\Windows\System\UmfDwVi.exe
  C:\Windows\System\UmfDwVi.exe
  2⤵
  PID:7740
- C:\Windows\System\obOnsgc.exe
  C:\Windows\System\obOnsgc.exe
  2⤵
  PID:7596
- C:\Windows\System\pSYtrsJ.exe
  C:\Windows\System\pSYtrsJ.exe
  2⤵
  PID:7628
- C:\Windows\System\HOlFwuf.exe
  C:\Windows\System\HOlFwuf.exe
  2⤵
  PID:7768
- C:\Windows\System\VIghFwc.exe
  C:\Windows\System\VIghFwc.exe
  2⤵
  PID:7772
- C:\Windows\System\WtRNgpA.exe
  C:\Windows\System\WtRNgpA.exe
  2⤵
  PID:7832
- C:\Windows\System\lWjqzwg.exe
  C:\Windows\System\lWjqzwg.exe
  2⤵
  PID:7896
- C:\Windows\System\jEXweIJ.exe
  C:\Windows\System\jEXweIJ.exe
  2⤵
  PID:7928
- C:\Windows\System\tRQZunT.exe
  C:\Windows\System\tRQZunT.exe
  2⤵
  PID:6712
- C:\Windows\System\EDLXbMX.exe
  C:\Windows\System\EDLXbMX.exe
  2⤵
  PID:7884
- C:\Windows\System\pgKrXQj.exe
  C:\Windows\System\pgKrXQj.exe
  2⤵
  PID:7948
- C:\Windows\System\VlQLPGd.exe
  C:\Windows\System\VlQLPGd.exe
  2⤵
  PID:7992
- C:\Windows\System\ddXQcrX.exe
  C:\Windows\System\ddXQcrX.exe
  2⤵
  PID:8016
- C:\Windows\System\FvaudjK.exe
  C:\Windows\System\FvaudjK.exe
  2⤵
  PID:8036
- C:\Windows\System\fgEMBei.exe
  C:\Windows\System\fgEMBei.exe
  2⤵
  PID:8056
- C:\Windows\System\tZoNZAl.exe
  C:\Windows\System\tZoNZAl.exe
  2⤵
  PID:8072
- C:\Windows\System\FomZfRS.exe
  C:\Windows\System\FomZfRS.exe
  2⤵
  PID:8088
- C:\Windows\System\YfwkAGc.exe
  C:\Windows\System\YfwkAGc.exe
  2⤵
  PID:8104
- C:\Windows\System\oOsnTYL.exe
  C:\Windows\System\oOsnTYL.exe
  2⤵
  PID:8120
- C:\Windows\System\WmEPPbi.exe
  C:\Windows\System\WmEPPbi.exe
  2⤵
  PID:8136
- C:\Windows\System\IRZNwuB.exe
  C:\Windows\System\IRZNwuB.exe
  2⤵
  PID:7184
- C:\Windows\System\sQAttBu.exe
  C:\Windows\System\sQAttBu.exe
  2⤵
  PID:8156
- C:\Windows\System\zKRvxKT.exe
  C:\Windows\System\zKRvxKT.exe
  2⤵
  PID:7292
- C:\Windows\System\mebsQNd.exe
  C:\Windows\System\mebsQNd.exe
  2⤵
  PID:6760
- C:\Windows\System\UodgVYH.exe
  C:\Windows\System\UodgVYH.exe
  2⤵
  PID:7324
- C:\Windows\System\bnpDDZX.exe
  C:\Windows\System\bnpDDZX.exe
  2⤵
  PID:7384
- C:\Windows\System\KUgafGy.exe
  C:\Windows\System\KUgafGy.exe
  2⤵
  PID:7500
- C:\Windows\System\PlZsHXJ.exe
  C:\Windows\System\PlZsHXJ.exe
  2⤵
  PID:7336
- C:\Windows\System\IQFgEoH.exe
  C:\Windows\System\IQFgEoH.exe
  2⤵
  PID:7468
- C:\Windows\System\eNWyuJF.exe
  C:\Windows\System\eNWyuJF.exe
  2⤵
  PID:8176
- C:\Windows\System\RXdrbrH.exe
  C:\Windows\System\RXdrbrH.exe
  2⤵
  PID:7720
- C:\Windows\System\sEhXQTB.exe
  C:\Windows\System\sEhXQTB.exe
  2⤵
  PID:7756
- C:\Windows\System\qHgyBLt.exe
  C:\Windows\System\qHgyBLt.exe
  2⤵
  PID:7804
- C:\Windows\System\AJkcpVC.exe
  C:\Windows\System\AJkcpVC.exe
  2⤵
  PID:7332
- C:\Windows\System\OvnSDqV.exe
  C:\Windows\System\OvnSDqV.exe
  2⤵
  PID:8008
- C:\Windows\System\MbSVKWL.exe
  C:\Windows\System\MbSVKWL.exe
  2⤵
  PID:7912
- C:\Windows\System\uAFDbHc.exe
  C:\Windows\System\uAFDbHc.exe
  2⤵
  PID:8044
- C:\Windows\System\DmXNxcb.exe
  C:\Windows\System\DmXNxcb.exe
  2⤵
  PID:8112
- C:\Windows\System\URliMRf.exe
  C:\Windows\System\URliMRf.exe
  2⤵
  PID:7232
- C:\Windows\System\MzQwcEn.exe
  C:\Windows\System\MzQwcEn.exe
  2⤵
  PID:8064
- C:\Windows\System\fCgZgVP.exe
  C:\Windows\System\fCgZgVP.exe
  2⤵
  PID:8132
- C:\Windows\System\NZcQhLs.exe
  C:\Windows\System\NZcQhLs.exe
  2⤵
  PID:8172
- C:\Windows\System\RQZxkVY.exe
  C:\Windows\System\RQZxkVY.exe
  2⤵
  PID:7400
- C:\Windows\System\qzsMStI.exe
  C:\Windows\System\qzsMStI.exe
  2⤵
  PID:7736
- C:\Windows\System\XrtNwpp.exe
  C:\Windows\System\XrtNwpp.exe
  2⤵
  PID:7868
- C:\Windows\System\vbAhYca.exe
  C:\Windows\System\vbAhYca.exe
  2⤵
  PID:7704
- C:\Windows\System\QScQorw.exe
  C:\Windows\System\QScQorw.exe
  2⤵
  PID:7788
- C:\Windows\System\HToXWbj.exe
  C:\Windows\System\HToXWbj.exe
  2⤵
  PID:7900
- C:\Windows\System\gDnlfkB.exe
  C:\Windows\System\gDnlfkB.exe
  2⤵
  PID:8160
- C:\Windows\System\bjywvtf.exe
  C:\Windows\System\bjywvtf.exe
  2⤵
  PID:7964
- C:\Windows\System\dKGlrwL.exe
  C:\Windows\System\dKGlrwL.exe
  2⤵
  PID:7660
- C:\Windows\System\unylYLw.exe
  C:\Windows\System\unylYLw.exe
  2⤵
  PID:8100
- C:\Windows\System\CkAvffZ.exe
  C:\Windows\System\CkAvffZ.exe
  2⤵
  PID:7464
- C:\Windows\System\MiMgEGw.exe
  C:\Windows\System\MiMgEGw.exe
  2⤵
  PID:7752
- C:\Windows\System\ralEuiK.exe
  C:\Windows\System\ralEuiK.exe
  2⤵
  PID:7448
- C:\Windows\System\maqjMgV.exe
  C:\Windows\System\maqjMgV.exe
  2⤵
  PID:8040
- C:\Windows\System\XKUzTIW.exe
  C:\Windows\System\XKUzTIW.exe
  2⤵
  PID:7216
- C:\Windows\System\OIRAiWh.exe
  C:\Windows\System\OIRAiWh.exe
  2⤵
  PID:7724
- C:\Windows\System\NzMencj.exe
  C:\Windows\System\NzMencj.exe
  2⤵
  PID:8196
- C:\Windows\System\LJggHKh.exe
  C:\Windows\System\LJggHKh.exe
  2⤵
  PID:8212
- C:\Windows\System\phzsCfP.exe
  C:\Windows\System\phzsCfP.exe
  2⤵
  PID:8228
- C:\Windows\System\XKLUosF.exe
  C:\Windows\System\XKLUosF.exe
  2⤵
  PID:8248
- C:\Windows\System\IcsnrmV.exe
  C:\Windows\System\IcsnrmV.exe
  2⤵
  PID:8264
- C:\Windows\System\umPafEW.exe
  C:\Windows\System\umPafEW.exe
  2⤵
  PID:8284
- C:\Windows\System\BFUvkaU.exe
  C:\Windows\System\BFUvkaU.exe
  2⤵
  PID:8300
- C:\Windows\System\xWaqOTW.exe
  C:\Windows\System\xWaqOTW.exe
  2⤵
  PID:8324
- C:\Windows\System\BnCDEQj.exe
  C:\Windows\System\BnCDEQj.exe
  2⤵
  PID:8340
- C:\Windows\System\xuzVQxg.exe
  C:\Windows\System\xuzVQxg.exe
  2⤵
  PID:8356
- C:\Windows\System\YxGCGnC.exe
  C:\Windows\System\YxGCGnC.exe
  2⤵
  PID:8372
- C:\Windows\System\EQDaMPf.exe
  C:\Windows\System\EQDaMPf.exe
  2⤵
  PID:8388
- C:\Windows\System\eWYdesS.exe
  C:\Windows\System\eWYdesS.exe
  2⤵
  PID:8404
- C:\Windows\System\fpWvuIf.exe
  C:\Windows\System\fpWvuIf.exe
  2⤵
  PID:8420
- C:\Windows\System\dnMWEya.exe
  C:\Windows\System\dnMWEya.exe
  2⤵
  PID:8436
- C:\Windows\System\TdfxhmK.exe
  C:\Windows\System\TdfxhmK.exe
  2⤵
  PID:8468
- C:\Windows\System\fIgErdR.exe
  C:\Windows\System\fIgErdR.exe
  2⤵
  PID:8484
- C:\Windows\System\lqAGwdR.exe
  C:\Windows\System\lqAGwdR.exe
  2⤵
  PID:8500
- C:\Windows\System\fdWLYsw.exe
  C:\Windows\System\fdWLYsw.exe
  2⤵
  PID:8516
- C:\Windows\System\rHiFokG.exe
  C:\Windows\System\rHiFokG.exe
  2⤵
  PID:8532
- C:\Windows\System\uTTJyEY.exe
  C:\Windows\System\uTTJyEY.exe
  2⤵
  PID:8548
- C:\Windows\System\xmcppyJ.exe
  C:\Windows\System\xmcppyJ.exe
  2⤵
  PID:8564
- C:\Windows\System\pmwOkSX.exe
  C:\Windows\System\pmwOkSX.exe
  2⤵
  PID:8580
- C:\Windows\System\BJaMcRL.exe
  C:\Windows\System\BJaMcRL.exe
  2⤵
  PID:8596
- C:\Windows\System\aLuqVQo.exe
  C:\Windows\System\aLuqVQo.exe
  2⤵
  PID:8612
- C:\Windows\System\lCtBGEN.exe
  C:\Windows\System\lCtBGEN.exe
  2⤵
  PID:8628
- C:\Windows\System\cuWYtPZ.exe
  C:\Windows\System\cuWYtPZ.exe
  2⤵
  PID:8644
- C:\Windows\System\lnkDyzY.exe
  C:\Windows\System\lnkDyzY.exe
  2⤵
  PID:8668
- C:\Windows\System\UFRGvWL.exe
  C:\Windows\System\UFRGvWL.exe
  2⤵
  PID:8688
- C:\Windows\System\JfjRaxO.exe
  C:\Windows\System\JfjRaxO.exe
  2⤵
  PID:8704
- C:\Windows\System\ySORAKU.exe
  C:\Windows\System\ySORAKU.exe
  2⤵
  PID:8720
- C:\Windows\System\cfaALlX.exe
  C:\Windows\System\cfaALlX.exe
  2⤵
  PID:8736
- C:\Windows\System\IoEuNft.exe
  C:\Windows\System\IoEuNft.exe
  2⤵
  PID:8752
- C:\Windows\System\xcYCpwU.exe
  C:\Windows\System\xcYCpwU.exe
  2⤵
  PID:8768
- C:\Windows\System\qvPTtBm.exe
  C:\Windows\System\qvPTtBm.exe
  2⤵
  PID:8784
- C:\Windows\System\WQuhGCw.exe
  C:\Windows\System\WQuhGCw.exe
  2⤵
  PID:8800
- C:\Windows\System\afwhIaT.exe
  C:\Windows\System\afwhIaT.exe
  2⤵
  PID:8816
- C:\Windows\System\oOTxSvK.exe
  C:\Windows\System\oOTxSvK.exe
  2⤵
  PID:8832
- C:\Windows\System\bvJGKDP.exe
  C:\Windows\System\bvJGKDP.exe
  2⤵
  PID:8848
- C:\Windows\System\HYfqvKn.exe
  C:\Windows\System\HYfqvKn.exe
  2⤵
  PID:8864
- C:\Windows\System\pBVcVYr.exe
  C:\Windows\System\pBVcVYr.exe
  2⤵
  PID:8880
- C:\Windows\System\mCJqLoi.exe
  C:\Windows\System\mCJqLoi.exe
  2⤵
  PID:8896
- C:\Windows\System\RvMVeGQ.exe
  C:\Windows\System\RvMVeGQ.exe
  2⤵
  PID:8912
- C:\Windows\System\RqOKGsf.exe
  C:\Windows\System\RqOKGsf.exe
  2⤵
  PID:8928
- C:\Windows\System\YpRofre.exe
  C:\Windows\System\YpRofre.exe
  2⤵
  PID:8944
- C:\Windows\System\TGwDlnK.exe
  C:\Windows\System\TGwDlnK.exe
  2⤵
  PID:8960
- C:\Windows\System\BcqkVod.exe
  C:\Windows\System\BcqkVod.exe
  2⤵
  PID:8976
- C:\Windows\System\MxlKVoR.exe
  C:\Windows\System\MxlKVoR.exe
  2⤵
  PID:8996
- C:\Windows\System\crUIumq.exe
  C:\Windows\System\crUIumq.exe
  2⤵
  PID:9012
- C:\Windows\System\dBvSmRb.exe
  C:\Windows\System\dBvSmRb.exe
  2⤵
  PID:9028
- C:\Windows\System\IQkLXLe.exe
  C:\Windows\System\IQkLXLe.exe
  2⤵
  PID:9044
- C:\Windows\System\GmJKlJm.exe
  C:\Windows\System\GmJKlJm.exe
  2⤵
  PID:9060
- C:\Windows\System\lLxKnUE.exe
  C:\Windows\System\lLxKnUE.exe
  2⤵
  PID:9076
- C:\Windows\System\JoSFlyz.exe
  C:\Windows\System\JoSFlyz.exe
  2⤵
  PID:9092
- C:\Windows\System\MbJSKTH.exe
  C:\Windows\System\MbJSKTH.exe
  2⤵
  PID:9108
- C:\Windows\System\ydTLQNu.exe
  C:\Windows\System\ydTLQNu.exe
  2⤵
  PID:9124
- C:\Windows\System\iEFlmWl.exe
  C:\Windows\System\iEFlmWl.exe
  2⤵
  PID:9140
- C:\Windows\System\SqIHFat.exe
  C:\Windows\System\SqIHFat.exe
  2⤵
  PID:9156
- C:\Windows\System\XvmmxSr.exe
  C:\Windows\System\XvmmxSr.exe
  2⤵
  PID:9172
- C:\Windows\System\puQGVDD.exe
  C:\Windows\System\puQGVDD.exe
  2⤵
  PID:9188
- C:\Windows\System\XxwKwvC.exe
  C:\Windows\System\XxwKwvC.exe
  2⤵
  PID:9204
- C:\Windows\System\EBOEGPQ.exe
  C:\Windows\System\EBOEGPQ.exe
  2⤵
  PID:8220
- C:\Windows\System\yPLOkPL.exe
  C:\Windows\System\yPLOkPL.exe
  2⤵
  PID:8224
- C:\Windows\System\YXUaMVj.exe
  C:\Windows\System\YXUaMVj.exe
  2⤵
  PID:8260
- C:\Windows\System\cTKQnyp.exe
  C:\Windows\System\cTKQnyp.exe
  2⤵
  PID:8276
- C:\Windows\System\HcnoVYr.exe
  C:\Windows\System\HcnoVYr.exe
  2⤵
  PID:8296
- C:\Windows\System\ycsqnBt.exe
  C:\Windows\System\ycsqnBt.exe
  2⤵
  PID:8316
- C:\Windows\System\hcglmJr.exe
  C:\Windows\System\hcglmJr.exe
  2⤵
  PID:8364
- C:\Windows\System\qKYuywv.exe
  C:\Windows\System\qKYuywv.exe
  2⤵
  PID:8396
- C:\Windows\System\fPPGMwr.exe
  C:\Windows\System\fPPGMwr.exe
  2⤵
  PID:8432
- C:\Windows\System\NaROOUf.exe
  C:\Windows\System\NaROOUf.exe
  2⤵
  PID:8444
- C:\Windows\System\fxbjkpP.exe
  C:\Windows\System\fxbjkpP.exe
  2⤵
  PID:8480
- C:\Windows\System\fSzhSQq.exe
  C:\Windows\System\fSzhSQq.exe
  2⤵
  PID:8544
- C:\Windows\System\IATTyzR.exe
  C:\Windows\System\IATTyzR.exe
  2⤵
  PID:8560
- C:\Windows\System\hyqNaBF.exe
  C:\Windows\System\hyqNaBF.exe
  2⤵
  PID:8496
- C:\Windows\System\FROHtpj.exe
  C:\Windows\System\FROHtpj.exe
  2⤵
  PID:8592
- C:\Windows\System\IicCdgt.exe
  C:\Windows\System\IicCdgt.exe
  2⤵
  PID:8652
- C:\Windows\System\WhFDvRL.exe
  C:\Windows\System\WhFDvRL.exe
  2⤵
  PID:8680
- C:\Windows\System\sZdCfaT.exe
  C:\Windows\System\sZdCfaT.exe
  2⤵
  PID:8684
- C:\Windows\System\KthQrmt.exe
  C:\Windows\System\KthQrmt.exe
  2⤵
  PID:8716
- C:\Windows\System\oGuOLWK.exe
  C:\Windows\System\oGuOLWK.exe
  2⤵
  PID:8776
- C:\Windows\System\mglnASE.exe
  C:\Windows\System\mglnASE.exe
  2⤵
  PID:8764
- C:\Windows\System\WugMKva.exe
  C:\Windows\System\WugMKva.exe
  2⤵
  PID:8812
- C:\Windows\System\kqOXIKF.exe
  C:\Windows\System\kqOXIKF.exe
  2⤵
  PID:8860
- C:\Windows\System\XzVnLtS.exe
  C:\Windows\System\XzVnLtS.exe
  2⤵
  PID:8904
- C:\Windows\System\kJNJutU.exe
  C:\Windows\System\kJNJutU.exe
  2⤵
  PID:8968
- C:\Windows\System\lbSejwu.exe
  C:\Windows\System\lbSejwu.exe
  2⤵
  PID:9020
- C:\Windows\System\Tfyhsbd.exe
  C:\Windows\System\Tfyhsbd.exe
  2⤵
  PID:9036
- C:\Windows\System\Xmhdptn.exe
  C:\Windows\System\Xmhdptn.exe
  2⤵
  PID:8956
- C:\Windows\System\VkwYseM.exe
  C:\Windows\System\VkwYseM.exe
  2⤵
  PID:9052
- C:\Windows\System\anVkFxd.exe
  C:\Windows\System\anVkFxd.exe
  2⤵
  PID:9100
- C:\Windows\System\qAwRVhw.exe
  C:\Windows\System\qAwRVhw.exe
  2⤵
  PID:9132
- C:\Windows\System\zZHroVb.exe
  C:\Windows\System\zZHroVb.exe
  2⤵
  PID:9116
- C:\Windows\System\zbDlAKm.exe
  C:\Windows\System\zbDlAKm.exe
  2⤵
  PID:9180
- C:\Windows\System\DezJAar.exe
  C:\Windows\System\DezJAar.exe
  2⤵
  PID:9212
- C:\Windows\System\DZSzXEW.exe
  C:\Windows\System\DZSzXEW.exe
  2⤵
  PID:8240
- C:\Windows\System\ZfDNceS.exe
  C:\Windows\System\ZfDNceS.exe
  2⤵
  PID:8312
- C:\Windows\System\RzmGiqf.exe
  C:\Windows\System\RzmGiqf.exe
  2⤵
  PID:8068
- C:\Windows\System\mvjILUE.exe
  C:\Windows\System\mvjILUE.exe
  2⤵
  PID:8412
- C:\Windows\System\ItmTiSV.exe
  C:\Windows\System\ItmTiSV.exe
  2⤵
  PID:8452
- C:\Windows\System\QSRlwHL.exe
  C:\Windows\System\QSRlwHL.exe
  2⤵
  PID:8524
- C:\Windows\System\LCyGFHZ.exe
  C:\Windows\System\LCyGFHZ.exe
  2⤵
  PID:8476
- C:\Windows\System\jNiZozg.exe
  C:\Windows\System\jNiZozg.exe
  2⤵
  PID:8464
- C:\Windows\System\cjsJsRp.exe
  C:\Windows\System\cjsJsRp.exe
  2⤵
  PID:8620
- C:\Windows\System\bmuCvzv.exe
  C:\Windows\System\bmuCvzv.exe
  2⤵
  PID:8700
- C:\Windows\System\atypTiV.exe
  C:\Windows\System\atypTiV.exe
  2⤵
  PID:8828
- C:\Windows\System\enloUPM.exe
  C:\Windows\System\enloUPM.exe
  2⤵
  PID:8872
- C:\Windows\System\lNhybcg.exe
  C:\Windows\System\lNhybcg.exe
  2⤵
  PID:8940
- C:\Windows\System\MygjZDl.exe
  C:\Windows\System\MygjZDl.exe
  2⤵
  PID:9072
- C:\Windows\System\ubHKbXz.exe
  C:\Windows\System\ubHKbXz.exe
  2⤵
  PID:8936
- C:\Windows\System\JFlWbsY.exe
  C:\Windows\System\JFlWbsY.exe
  2⤵
  PID:9200
- C:\Windows\System\ITsGEvG.exe
  C:\Windows\System\ITsGEvG.exe
  2⤵
  PID:8992
- C:\Windows\System\PdgYlHG.exe
  C:\Windows\System\PdgYlHG.exe
  2⤵
  PID:9152
- C:\Windows\System\wvbqaIP.exe
  C:\Windows\System\wvbqaIP.exe
  2⤵
  PID:8352
- C:\Windows\System\txZqdYY.exe
  C:\Windows\System\txZqdYY.exe
  2⤵
  PID:8380
- C:\Windows\System\ZwzCobL.exe
  C:\Windows\System\ZwzCobL.exe
  2⤵
  PID:8576
- C:\Windows\System\SlLRNho.exe
  C:\Windows\System\SlLRNho.exe
  2⤵
  PID:8760
- C:\Windows\System\KDlyExM.exe
  C:\Windows\System\KDlyExM.exe
  2⤵
  PID:8732
- C:\Windows\System\XxfOxXj.exe
  C:\Windows\System\XxfOxXj.exe
  2⤵
  PID:8796
- C:\Windows\System\LcKHzgx.exe
  C:\Windows\System\LcKHzgx.exe
  2⤵
  PID:8892
- C:\Windows\System\fxzfaZt.exe
  C:\Windows\System\fxzfaZt.exe
  2⤵
  PID:8336
- C:\Windows\System\yaVbMUG.exe
  C:\Windows\System\yaVbMUG.exe
  2⤵
  PID:8712
- C:\Windows\System\VjvLzQp.exe
  C:\Windows\System\VjvLzQp.exe
  2⤵
  PID:9184
- C:\Windows\System\AZEkorA.exe
  C:\Windows\System\AZEkorA.exe
  2⤵
  PID:8808
- C:\Windows\System\kJVqpjl.exe
  C:\Windows\System\kJVqpjl.exe
  2⤵
  PID:8844
- C:\Windows\System\mGHItTB.exe
  C:\Windows\System\mGHItTB.exe
  2⤵
  PID:8656
- C:\Windows\System\hOWgvel.exe
  C:\Windows\System\hOWgvel.exe
  2⤵
  PID:8604
- C:\Windows\System\IHoiyTo.exe
  C:\Windows\System\IHoiyTo.exe
  2⤵
  PID:9228
- C:\Windows\System\nhMBYAd.exe
  C:\Windows\System\nhMBYAd.exe
  2⤵
  PID:9244
- C:\Windows\System\hAMnFky.exe
  C:\Windows\System\hAMnFky.exe
  2⤵
  PID:9260
- C:\Windows\System\cZkGUaU.exe
  C:\Windows\System\cZkGUaU.exe
  2⤵
  PID:9276
- C:\Windows\System\JAiZRGs.exe
  C:\Windows\System\JAiZRGs.exe
  2⤵
  PID:9292
- C:\Windows\System\tEGrAtd.exe
  C:\Windows\System\tEGrAtd.exe
  2⤵
  PID:9308
- C:\Windows\System\gHYtmkN.exe
  C:\Windows\System\gHYtmkN.exe
  2⤵
  PID:9324
- C:\Windows\System\tyqmZOB.exe
  C:\Windows\System\tyqmZOB.exe
  2⤵
  PID:9380
- C:\Windows\System\uBndoaZ.exe
  C:\Windows\System\uBndoaZ.exe
  2⤵
  PID:9400
- C:\Windows\System\QBRPFFf.exe
  C:\Windows\System\QBRPFFf.exe
  2⤵
  PID:9416
- C:\Windows\System\MZlKEkS.exe
  C:\Windows\System\MZlKEkS.exe
  2⤵
  PID:9432
- C:\Windows\System\GNIuOGD.exe
  C:\Windows\System\GNIuOGD.exe
  2⤵
  PID:9448
- C:\Windows\System\uRZjcwW.exe
  C:\Windows\System\uRZjcwW.exe
  2⤵
  PID:9464
- C:\Windows\System\XHtwOik.exe
  C:\Windows\System\XHtwOik.exe
  2⤵
  PID:9480
- C:\Windows\System\wgVmKPp.exe
  C:\Windows\System\wgVmKPp.exe
  2⤵
  PID:9496
- C:\Windows\System\SZemYrW.exe
  C:\Windows\System\SZemYrW.exe
  2⤵
  PID:9512
- C:\Windows\System\nkBNscN.exe
  C:\Windows\System\nkBNscN.exe
  2⤵
  PID:9528
- C:\Windows\System\NzLvRIZ.exe
  C:\Windows\System\NzLvRIZ.exe
  2⤵
  PID:9552
- C:\Windows\System\szlugms.exe
  C:\Windows\System\szlugms.exe
  2⤵
  PID:9572
- C:\Windows\System\egUyvWs.exe
  C:\Windows\System\egUyvWs.exe
  2⤵
  PID:9588
- C:\Windows\System\sXpipwF.exe
  C:\Windows\System\sXpipwF.exe
  2⤵
  PID:9612
- C:\Windows\System\RXcQiUs.exe
  C:\Windows\System\RXcQiUs.exe
  2⤵
  PID:9632
- C:\Windows\System\TcqIMxN.exe
  C:\Windows\System\TcqIMxN.exe
  2⤵
  PID:9652
- C:\Windows\System\DyYarOz.exe
  C:\Windows\System\DyYarOz.exe
  2⤵
  PID:9676
- C:\Windows\System\DrocUzU.exe
  C:\Windows\System\DrocUzU.exe
  2⤵
  PID:9692
- C:\Windows\System\rocENSz.exe
  C:\Windows\System\rocENSz.exe
  2⤵
  PID:9712
- C:\Windows\System\KeGlNIv.exe
  C:\Windows\System\KeGlNIv.exe
  2⤵
  PID:9728
- C:\Windows\System\piDOUja.exe
  C:\Windows\System\piDOUja.exe
  2⤵
  PID:9744
- C:\Windows\System\xEwKIgy.exe
  C:\Windows\System\xEwKIgy.exe
  2⤵
  PID:9760
- C:\Windows\System\Oxzadvu.exe
  C:\Windows\System\Oxzadvu.exe
  2⤵
  PID:9776
- C:\Windows\System\MRAdsIY.exe
  C:\Windows\System\MRAdsIY.exe
  2⤵
  PID:9792
- C:\Windows\System\fAwFxRU.exe
  C:\Windows\System\fAwFxRU.exe
  2⤵
  PID:9812
- C:\Windows\System\DLoTlBG.exe
  C:\Windows\System\DLoTlBG.exe
  2⤵
  PID:9836
- C:\Windows\System\iRLocFK.exe
  C:\Windows\System\iRLocFK.exe
  2⤵
  PID:9852
- C:\Windows\System\xTrPucG.exe
  C:\Windows\System\xTrPucG.exe
  2⤵
  PID:9868
- C:\Windows\System\agCjzuP.exe
  C:\Windows\System\agCjzuP.exe
  2⤵
  PID:9884
- C:\Windows\System\WdhVvcs.exe
  C:\Windows\System\WdhVvcs.exe
  2⤵
  PID:9900
- C:\Windows\System\fDorMwr.exe
  C:\Windows\System\fDorMwr.exe
  2⤵
  PID:9916
- C:\Windows\System\htRzpYu.exe
  C:\Windows\System\htRzpYu.exe
  2⤵
  PID:9936
- C:\Windows\System\CekwHPj.exe
  C:\Windows\System\CekwHPj.exe
  2⤵
  PID:9952
- C:\Windows\System\unmOovz.exe
  C:\Windows\System\unmOovz.exe
  2⤵
  PID:9972
- C:\Windows\System\EKEMHiy.exe
  C:\Windows\System\EKEMHiy.exe
  2⤵
  PID:9992
- C:\Windows\System\idpRfOA.exe
  C:\Windows\System\idpRfOA.exe
  2⤵
  PID:10008
- C:\Windows\System\sfENsDt.exe
  C:\Windows\System\sfENsDt.exe
  2⤵
  PID:10024
- C:\Windows\System\heAGGho.exe
  C:\Windows\System\heAGGho.exe
  2⤵
  PID:10040
- C:\Windows\System\WrYIGfj.exe
  C:\Windows\System\WrYIGfj.exe
  2⤵
  PID:10060
- C:\Windows\System\cPnpKnS.exe
  C:\Windows\System\cPnpKnS.exe
  2⤵
  PID:10076
- C:\Windows\System\hQcwGhC.exe
  C:\Windows\System\hQcwGhC.exe
  2⤵
  PID:10092
- C:\Windows\System\xVZMrFo.exe
  C:\Windows\System\xVZMrFo.exe
  2⤵
  PID:10108
- C:\Windows\System\FRcqBZY.exe
  C:\Windows\System\FRcqBZY.exe
  2⤵
  PID:10132
- C:\Windows\System\NuqoVRj.exe
  C:\Windows\System\NuqoVRj.exe
  2⤵
  PID:10212
- C:\Windows\System\oTQnGIa.exe
  C:\Windows\System\oTQnGIa.exe
  2⤵
  PID:10236
- C:\Windows\System\mtZiTiT.exe
  C:\Windows\System\mtZiTiT.exe
  2⤵
  PID:9236
- C:\Windows\System\pwfKfrp.exe
  C:\Windows\System\pwfKfrp.exe
  2⤵
  PID:8540
- C:\Windows\System\qMEPtNQ.exe
  C:\Windows\System\qMEPtNQ.exe
  2⤵
  PID:9320
- C:\Windows\System\FWtqOoe.exe
  C:\Windows\System\FWtqOoe.exe
  2⤵
  PID:9256
- C:\Windows\System\RDrwuBv.exe
  C:\Windows\System\RDrwuBv.exe
  2⤵
  PID:9340
- C:\Windows\System\XcqKzkz.exe
  C:\Windows\System\XcqKzkz.exe
  2⤵
  PID:9912
- C:\Windows\System\YSQdnhn.exe
  C:\Windows\System\YSQdnhn.exe
  2⤵
  PID:9944
- C:\Windows\System\MYaGLVg.exe
  C:\Windows\System\MYaGLVg.exe
  2⤵
  PID:9984
- C:\Windows\System\veoVwRX.exe
  C:\Windows\System\veoVwRX.exe
  2⤵
  PID:10020
- C:\Windows\System\SRAnoCd.exe
  C:\Windows\System\SRAnoCd.exe
  2⤵
  PID:10084
- C:\Windows\System\SBLntfs.exe
  C:\Windows\System\SBLntfs.exe
  2⤵
  PID:10128
- C:\Windows\System\eItxSOd.exe
  C:\Windows\System\eItxSOd.exe
  2⤵
  PID:10140
- C:\Windows\System\gbXrCom.exe
  C:\Windows\System\gbXrCom.exe
  2⤵
  PID:10144
- C:\Windows\System\NSehaoQ.exe
  C:\Windows\System\NSehaoQ.exe
  2⤵
  PID:10160
- C:\Windows\System\VsDfNvV.exe
  C:\Windows\System\VsDfNvV.exe
  2⤵
  PID:10176
- C:\Windows\System\ouWITFH.exe
  C:\Windows\System\ouWITFH.exe
  2⤵
  PID:9664
- C:\Windows\System\MYItxEy.exe
  C:\Windows\System\MYItxEy.exe
  2⤵
  PID:10220
- C:\Windows\System\wjSSlwr.exe
  C:\Windows\System\wjSSlwr.exe
  2⤵
  PID:9284
- C:\Windows\System\HtJQAJd.exe
  C:\Windows\System\HtJQAJd.exe
  2⤵
  PID:9104
- C:\Windows\System\gojIEpd.exe
  C:\Windows\System\gojIEpd.exe
  2⤵
  PID:9332
- C:\Windows\System\TilRXZz.exe
  C:\Windows\System\TilRXZz.exe
  2⤵
  PID:9356
- C:\Windows\System\huHxdTH.exe
  C:\Windows\System\huHxdTH.exe
  2⤵
  PID:9368
- C:\Windows\System\tIdLAYU.exe
  C:\Windows\System\tIdLAYU.exe
  2⤵
  PID:9376
- C:\Windows\System\lXMQEmq.exe
  C:\Windows\System\lXMQEmq.exe
  2⤵
  PID:9424
- C:\Windows\System\xQkzvoH.exe
  C:\Windows\System\xQkzvoH.exe
  2⤵
  PID:9504
- C:\Windows\System\MNhEXyH.exe
  C:\Windows\System\MNhEXyH.exe
  2⤵
  PID:9488
- C:\Windows\System\RBgASGK.exe
  C:\Windows\System\RBgASGK.exe
  2⤵
  PID:9548
- C:\Windows\System\HTrCyQr.exe
  C:\Windows\System\HTrCyQr.exe
  2⤵
  PID:9560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AGqRBUO.exe

Filesize
1.7MB

MD5
e2f7d6844672e73b342dd5ef8d1d0f1e

SHA1
ae35a1ba8b5529070edeacb157eac988d5541596

SHA256
cb36f3e286fa8c4a53b837d817db37d0d82217f4a0215c2454359b45ec2143ac

SHA512
ad4f62359df54626da7572d3b35a2e6a5e1f9702fb50b891691bf0b3fcd38a8ce0b2049094409f1fafbe6d9c8c5c055015afd30f0f0050768da89c1f58269630

Download Submit
C:\Windows\system\BpGhEBN.exe

Filesize
1.7MB

MD5
07a034a1d45771bf2ebda69e1276bbd6

SHA1
2abd6c688f6561f7f18bc584e3e7860a03d43052

SHA256
fccbbe34d31e1e0e84ec09ec5b324eac5dc1005f1c422f3d0b0a72143a82b5e4

SHA512
ff8945c19a40a198338b64fc2279b089b8ecbb6f9bcf7c4389ee960f28afbf68b53259413416566aa2640dadceb873d7065dc58d1ecceb1cd96b6801fd8f55c9

Download Submit
C:\Windows\system\EiZvwNM.exe

Filesize
1.7MB

MD5
05cef3a62b41690365a5185b720bda52

SHA1
39dd7d08cd664924c81c5bf6cfd7b760c6687dca

SHA256
8e2ffe93319526f617c43169afe322fe7add4e58490fbbb7e20a1b625f8ea843

SHA512
919c24af2d5638cd4951940fefa72710cbbb97a3492a1ab20687502de3bfb1e87cc753dba727619d19d6f626a96abc6840790d77616e363f8954bc9b29713efc

Download Submit
C:\Windows\system\JgPXXUn.exe

Filesize
1.7MB

MD5
6be6326c5c20de4451b2f2bc2283cf01

SHA1
74c9e96c3eeb30e596cdf20c97011cb2280a4239

SHA256
4ba53527d9dcde4987783568c9fe8dc044048a1770faeda813cc443f72e8ebdd

SHA512
8359c99b88df6e13e97dc7c8e1ba89e812a34403d8780557eceea39d1634a830e1597629c83944418fff2af8557e1fb6871acbdfda2692b138758086ef454ce3

Download Submit
C:\Windows\system\KydDNIi.exe

Filesize
1.7MB

MD5
62d504aa52455c4fd9d55fe58f5b0d4f

SHA1
56b5b98e0bcad966077a06f9e49f3234e68bdd61

SHA256
b1adc72f7fe96fdd845eee6a0755631740fab4cf1245c53743d38cf1dbeca2bb

SHA512
e071479010bf47a4be1ef591173025793fe7862b1778a1aae883c122c4e0b5554f120a8793d9101190ef637294ec8608312c49bd5229228042417121c538427b

Download Submit
C:\Windows\system\NyKIhnj.exe

Filesize
1.7MB

MD5
845884e548420b4bffe4b9be2bb2c664

SHA1
d59a1e4ece27e17835ac36bd16552d06e4baaa35

SHA256
55b416562034dc3ee0de3ed2f1b028bd1f04b718459c8ae9b9c9187f06b7b72e

SHA512
9123cb9358f4a58d77524eea9cd4a695446809f59302f11aba8d1b6e6c95d7f53b0c5f687d388a3e464eeabd78a4ac1ace61dc663ec07e13283dc95625459ac5

Download Submit
C:\Windows\system\QCczmEA.exe

Filesize
1.7MB

MD5
62976e47a79de8d2dceccace8650133e

SHA1
0d3eba9166f6d8468e414de223c72bc427278ac3

SHA256
8b5bf3484c6374ec0ae4e0ec2ee6419e0cb8d1db15aa8509bf5f15df32e25b13

SHA512
0a17724096e4b6b8d62d06acdc102ecf1505c46ef36cc1a60af66bbfc15e68bbb68964f489d11462cd5fea49cf975438b9c6d080adbf8b8a1d9f98f02f5cd639

Download Submit
C:\Windows\system\RnshteM.exe

Filesize
1.7MB

MD5
16f8de25ad46d47b87343dc2a986abb6

SHA1
6ceca4ebcad9e9bf842d08659ee9c02ac7d9a526

SHA256
e012d468e81315eeff036a49220f41613bfe5f5c7b22756d9dd455c26bfedb65

SHA512
ced8cd6566b792e50c9325558ade6a47093b709d8daa41b8e1b02fa0787c197bad394d5b9af9981618bb569145f66f82d1e21aa7d06e1c602ab8920078d03aa1

Download Submit
C:\Windows\system\SRnxGSU.exe

Filesize
1.7MB

MD5
2a0d15b7e1c58ac440b47efd0b5c2f13

SHA1
641d458790d68d9f114b37c885f230baf37f6dc3

SHA256
17e178da59371fa15b4b7881717acd43328d9d4c90bf6dc5beb5338eec93d7dd

SHA512
93ca214f6ea5d2519be3c557efbdd070d899f1bd6225e6a8601cac86d8993a604ce4407beea243da1b2bc58bf8fc5de07ff47adab0844e3cb293d25c86461bbe

Download Submit
C:\Windows\system\TKZBVuM.exe

Filesize
1.7MB

MD5
f7f988c8c82263fde81220267b7e20a0

SHA1
8d9d6967e2dbca186df8d1861c8b420935684b9f

SHA256
d69d4dc95b9d5221828770fd817b9b49e1131597cb0c4e4f7a3f9c0bc9489b80

SHA512
f6581c39269dd1eea7f67de2b43edd16e7148e2c003a12451c573272a3ef052bc4e281f6fe8f6c453a43517a8a891cd180412431fe0eb213a1df969105e86519

Download Submit
C:\Windows\system\VElGcKR.exe

Filesize
1.7MB

MD5
f8f0ebeaf73bfe69ba1af4ef7a3829d4

SHA1
64f997cb7c8ddeb4e6dedd4e153db28d1a3b217a

SHA256
caee0f8d11bc44878220c0797bc566a294d54f026ab1dcf0c59350d75b4b9f1b

SHA512
e9f4bbc70548383d8a27d7a170ea1f716672ae046aaf25741870652268d5299130d9f2462f0bb1481fed76ca494ac4b40036f8c600c42a2cc3052aaf015c66f5

Download Submit
C:\Windows\system\YpMYQuO.exe

Filesize
1.7MB

MD5
d040875283fea4c03820527ef6094422

SHA1
fbd3c5731d8f44da061d2d1f88dcc0725f99cba6

SHA256
1212ab274e1607740bac79304c8636845d375e518932a3b93598038ed5fa1e0f

SHA512
7ea515e8bc9330c28864855f066dbf6c66f619c4b8e6b2c1f4f1241e2e9e1a9f94d7e879c2c7d7abb86d38b231fb1798fbd4e24b3d5900a9ee8f254070fb8e62

Download Submit
C:\Windows\system\ZdSKQwl.exe

Filesize
1.7MB

MD5
5877bb35148400c3a0d9665699b0cd0c

SHA1
287be6ed20029cde53397f0383a25b6483af8701

SHA256
0c33660ef9ca352e6364a7763fd0d5f1b1c4d0140d02c850da2af5ef781778f0

SHA512
8c6281d6d5ebde384b2892469e0d34d71278a5e1561b664cc26c784641be48e217af486e2da93b984b1e4e27978690ac94200e611f1f52765fa928b8deda9ab6

Download Submit
C:\Windows\system\agkqlWZ.exe

Filesize
1.7MB

MD5
c5983a92f3c2ffff9668fceb9833dde6

SHA1
b18e2b42de300281f4be10e4cf66f93a9e46c258

SHA256
0c5fb779e5209f322a7b3e343ad547d8aaf0605190712ca1f609200836d94650

SHA512
12e479cf9e59f98cda5be80e9145ee71bc00afb103543d034aba0292c5b4b9422ebfe9b7d7b2a740cbb92c7affa080138ecb8e7273d340ce3b574d7b841f2819

Download Submit
C:\Windows\system\bIuMwhE.exe

Filesize
1.7MB

MD5
a7ef087519fd0bb546e9480e66380462

SHA1
a5dc44efd686c739df9dc507b0bd1cf82942f6b4

SHA256
dc308983e523c1fdf0b7bde5d399b656f0d5d49bd9f6a91a04f5c4b9df66a5c2

SHA512
1a9f1b8095f3b03c18e63ab3fb92150625b5ea612e05d09aec4915212d88d361a4769603a6a4c0facae99b79d3e3a013ea3f2d29c8446e41aaf94cc2c51c0285

Download Submit
C:\Windows\system\cFrNEBa.exe

Filesize
1.7MB

MD5
684e4417eecb385f3a0b2295046c7297

SHA1
dd85d5b4dba53f39b13f80233e1693c2c57ecaf0

SHA256
fb18465f9416c4c5f7e897e5ad25a70bcdd1c1b77feedf02dbfd4d33c357797e

SHA512
e4b9f554a7b00105a93c0a3562876921511ce6b6885cebfba69fb26cd9671529d60238cb24f815345ab692fa48f90bcebbbcc5a18ae4c495c8ae5e24825780b4

Download Submit
C:\Windows\system\jWEcpTz.exe

Filesize
1.7MB

MD5
ab994dc51fc9fbe07d50bacd68c872ab

SHA1
b900958d670cf6b97c15732ed62b824ae28e098d

SHA256
9be52b150fd1d7121ee89d93e8c5b0b0017e618328ac4b22bbc50e1cdd1d835e

SHA512
9f5ed3404684d238c9dbab5bdfbc4edd714d592e60531ff14b3ef22dd9e02751fd8155f2e12dc582548a1fd187d8687bc951d064fcf0a07854dfc00f75a15163

Download Submit
C:\Windows\system\kGVKQHv.exe

Filesize
1.7MB

MD5
63282b9ba23512e45c9190564e1c146b

SHA1
1c407e02687bbb281301e3f9539f337de1a61d4d

SHA256
66d0dda9033942893036c990fda498c6067c02683007d5525594da1943264cdf

SHA512
120a36c077248269926089acc52bc57e8bcb8aa55d59704e19fa53f169345c960dc1d69ba47f74460a45fef0cdcb4c9b747ab3cb80f250cb6d21efd1a76a81d3

Download Submit
C:\Windows\system\nEiuPQW.exe

Filesize
1.7MB

MD5
6c79a6ffd7753ef024e42d181d697c77

SHA1
cb8fac1f54ac3378e31240b04a2ba3b6c7454ba3

SHA256
11fdb7aa0c5e84678d2736f41c3497b13a90b7a28eceefee430361b9a1010717

SHA512
a62ce84ee46d1d1f83876f7e3e8ba46ba22a0aee3aeaaf26aeec1ab02b28f8e0a6be4ee8645c6c59acecdeb5bb53a16e8af6a985bb2a2f66317433714e1994ca

Download Submit
C:\Windows\system\ohnjINb.exe

Filesize
1.7MB

MD5
9c41306d5d3357603fa660c596aee262

SHA1
bf1d370d994339612313be13940693622446883d

SHA256
bc7f770351e433288525382783ca1a381d7b0d1b0e779c0927498b1c4a85b38b

SHA512
1a6f21d23c5d9c7ba0353a142e843fb6a526f2a5544cdaef6784f816ee964bfceecb826cde66c9218bc05a86f4f0df8f24e228a4771ca1b23999d26f8f8e9aef

Download Submit
C:\Windows\system\pQXccDy.exe

Filesize
1.7MB

MD5
2aa5aaf8545156dae36bc8d7b604bfb8

SHA1
e857191eeeab3c8ef158877ff2656b90aacf9c89

SHA256
af5e539ccc98a7f545a38e3bcb1e5dd495c83211bffc7a125be631d712a7a3cf

SHA512
d1fc98f57fbbbf179441ed985d9a48c0e218c7933727a0524e29fcc19ab8ef59da7ecfb5fe73bf0056f9c5500cec6595c6963d0acb36093d492e63067b8c120f

Download Submit
C:\Windows\system\prgyvcq.exe

Filesize
1.7MB

MD5
20c052ed906d663a2045732c67cf574a

SHA1
d96b4ca8c763fc11acf7bbef1c746eaca15a95aa

SHA256
76b7b38cf3f42d9ba60854beb8fb185e9ebf2d6640a974dc7b8cee033879159c

SHA512
f8a12443ec69f2321f12384de8b60ac045026ea1d8b30b9a473b460c46f856e2cda45e5857f75c4351de83ddea0a166370a58d1316ea93e11137eaa935e2942d

Download Submit
C:\Windows\system\rnHpCjk.exe

Filesize
1.7MB

MD5
c8f2297d36234febf91955c147622417

SHA1
0651918a2ff16c01421a14006602b0f60fe6e210

SHA256
48a095f93892d969056c7dbc579d29c858ed056edb6b89bcd9b4de12c0e296be

SHA512
3e3fb0bbdfe0fb8444a3ff90a561b240758604046f12e98ebe52211759e7f13cbdf9e47cf02c546ecd434c73b4316b3b4ce9e1335dac197b4809c2d7c14875f8

Download Submit
C:\Windows\system\uZEnWWx.exe

Filesize
1.7MB

MD5
74d5510ef69b43c2133163ddd941d018

SHA1
7e969065e1b8b28eca8a373ddec2a9f0f87654aa

SHA256
5831dca402c3c365d31e920b26a8a3d0d2104af4c5a51b5c6dca9498fa33e32c

SHA512
2055cc9ea3d21e8fe286505226b5fd5f8a528b84ecbcbbc0e887b3cf9e0d300ccb647bb6bdffcd29c6b0e8ee26b0c6c30c9c6e90dc23c3638861833b2f2caf7f

Download Submit
C:\Windows\system\vXQkCRy.exe

Filesize
1.7MB

MD5
11602063d76a17dc2ea730d9ef82aaf3

SHA1
646cdda31fc2150b7d7a654c35ab15992a4d5b6b

SHA256
924a09baa5dabd38e81bebcb7b184e29e95a6da7754e17e657df64632bb8dd6a

SHA512
4a1e7b2549f5a3900845576342fcc39c389c4ec4c58039f5fb4735b2246ff0252a3245263f6e43f68caee6ab686a374edff0c2dbf9fe36f39842ca60c416b19c

Download Submit
C:\Windows\system\yOrxIJM.exe

Filesize
1.7MB

MD5
465f89d55bb33916fe703b0d029a1fe1

SHA1
bb9eb10a8c6e822af2886a77f8d850b2acd41925

SHA256
cfabbcc01dd968ef70d98551022b4e74bc4f62c5df6e9bfdb9e38953a8f14468

SHA512
83f3fef07a75c8f28b8e1b5c506d8cfeb81e814b427c55644ac0b63156835d2fb8c15653302cb6687fc423fdd8c2c96923db0d72532130d10460bec83bc32644

Download Submit
\Windows\system\INGHPoa.exe

Filesize
1.7MB

MD5
659688fa2b6c44eaf15c3a14813c865f

SHA1
3117fe85927b9e76fd60fb480b4f2c500d30712c

SHA256
6531fe50bec46438dc9c22a3db83d18c31f7271a7d61a6292f23bf7f3996ac68

SHA512
9ad83d966ef2695ad6516dcf5110e6135c9e50aa1da83578529e53200e081c3992bcc7d9e491374cf4fbdc2716dbe5529730ae311371fc0a5600ee0c70309366

Download Submit
\Windows\system\VhZgMat.exe

Filesize
1.7MB

MD5
3655713db636776ac50f3a502d111842

SHA1
ff309ed0f0a1aa8ad6bb8c56311dfd65f14b8cf9

SHA256
587a944852e23d56883df47aba39be0dd3ebc5a61f13add749f452541419a96b

SHA512
01ef25524075d31a69e7b8e1aa5cda9708c358af566acfb74293ff9a4ece486da50601746f53144c5652030c50801429f2c7c29bdc5231bff6be181e37855fdc

Download Submit
\Windows\system\aHNtZrl.exe

Filesize
1.7MB

MD5
45e08c4ec2e82a54da313ca42d28dc13

SHA1
5f265956160b61bf9fc73344b8a289e4ae056a72

SHA256
b832413e56beaa13d57e278103c27795cc9e9e0ff793ab80f9598694abd52c17

SHA512
69624d4f09f556fda21261ae9f5942145ff9d616326d451a2809c6624b13f4df569abc8bd3a737b576aefff33d9d41f2417c13a42445038f2d9de15ccc4704b2

Download Submit
\Windows\system\gOyoxmV.exe

Filesize
1.7MB

MD5
ba4c7033d8a18c1fd64b052b5ec593a5

SHA1
040dbcf6e7f37c6429fc9f5ac47cf4b75b31c83d

SHA256
b77c633dd234a1e171ee3bc32b30f0dc17043de793fc9b0e98aad35a1ccad5f2

SHA512
5e6a3452b7d6aa3455f877893a0e50dfed4155250cbc894dd90e037db63cbe0f39028d09d57c4ea086de46e5e69e82ce7503a7a8490c5c878363f9118281b756

Download Submit
\Windows\system\sbisJDo.exe

Filesize
1.7MB

MD5
95b13da4405544644a8a28a6873a52cc

SHA1
def11f03e0bd4ec3563114bd17a13d589a1ab483

SHA256
a47160914dd31e2121177bf1f1248aaf4cddb9fcb8cb76b7bd64d1d1626034fb

SHA512
fd23c30856fc47fd506d583aaa6a2822256a0f00813080624cfe058973b01beb27f426fc56f6b75924a3e0e5df723298d3bba43308d88e68da0af774be7de92b

Download Submit
\Windows\system\vXpWZNJ.exe

Filesize
1.7MB

MD5
6682f38a7183bfcf193e8b3ba36cea11

SHA1
827ff48fa02296e53496510f565dbb85555f52da

SHA256
a682503484b4a9e3e7f0d96f45e84b552a15f2ed9125229a2582321d11fae82e

SHA512
073a85162fc3a13b48e55efd5189ca5a835f3624a4fb3525fca8d180c941fd8811cabf07ba373d748923644af8d26c3884ce551e6fab1f3456ccf49788cb99b3

Download Submit
memory/2196-478-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6210-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6215-0x000000013F060000-0x000000013F3B1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-506-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2196-5952-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2196-504-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6216-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6217-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2196-472-0x000000013FCA0000-0x000000013FFF1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6219-0x000000013FE60000-0x00000001401B1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-512-0x000000013F060000-0x000000013F3B1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-514-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6211-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2196-5957-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-518-0x000000013FE60000-0x00000001401B1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-521-0x000000013FB90000-0x000000013FEE1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-520-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2196-5975-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2196-516-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2196-510-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-0-0x000000013F600000-0x000000013F951000-memory.dmp

Filesize
3.3MB

Download
memory/2196-508-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6126-0x000000013FCA0000-0x000000013FFF1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-502-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6184-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6213-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6155-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2196-13-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6260-0x000000013FB90000-0x000000013FEE1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2196-6214-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2196-6221-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2312-4527-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2312-505-0x000000013FDC0000-0x0000000140111000-memory.dmp

Filesize
3.3MB

Download
memory/2444-4217-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2444-517-0x000000013FBC0000-0x000000013FF11000-memory.dmp

Filesize
3.3MB

Download
memory/2456-4516-0x000000013FE60000-0x00000001401B1000-memory.dmp

Filesize
3.3MB

Download
memory/2456-519-0x000000013FE60000-0x00000001401B1000-memory.dmp

Filesize
3.3MB

Download
memory/2480-4521-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2480-509-0x000000013F3E0000-0x000000013F731000-memory.dmp

Filesize
3.3MB

Download
memory/2544-511-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2544-4520-0x000000013F4F0000-0x000000013F841000-memory.dmp

Filesize
3.3MB

Download
memory/2576-7-0x000000013F700000-0x000000013FA51000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4503-0x000000013F700000-0x000000013FA51000-memory.dmp

Filesize
3.3MB

Download
memory/2584-4524-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2584-507-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/2596-4515-0x000000013FCA0000-0x000000013FFF1000-memory.dmp

Filesize
3.3MB

Download
memory/2596-475-0x000000013FCA0000-0x000000013FFF1000-memory.dmp

Filesize
3.3MB

Download
memory/2632-491-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2632-4534-0x000000013F140000-0x000000013F491000-memory.dmp

Filesize
3.3MB

Download
memory/2668-465-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2668-4417-0x000000013F130000-0x000000013F481000-memory.dmp

Filesize
3.3MB

Download
memory/2700-471-0x000000013FB90000-0x000000013FEE1000-memory.dmp

Filesize
3.3MB

Download
memory/2700-4533-0x000000013FB90000-0x000000013FEE1000-memory.dmp

Filesize
3.3MB

Download
memory/2828-503-0x000000013F820000-0x000000013FB71000-memory.dmp

Filesize
3.3MB

Download
memory/2828-4522-0x000000013F820000-0x000000013FB71000-memory.dmp

Filesize
3.3MB

Download
memory/2940-515-0x000000013F550000-0x000000013F8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2940-4518-0x000000013F550000-0x000000013F8A1000-memory.dmp

Filesize
3.3MB

Download
memory/2980-4525-0x000000013F060000-0x000000013F3B1000-memory.dmp

Filesize
3.3MB

Download
memory/2980-513-0x000000013F060000-0x000000013F3B1000-memory.dmp

Filesize
3.3MB

Download