xmrig | de5a02e19ae798b3b4d5cecf7932ddef2be51cc0dfbbc5c9babe486172d96daa

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
Size

1.4MB
MD5

484e3ced39ecee52da1cad92822f29e0
SHA1

7b651708919435f1a253346cb61c5cf698c79be6
SHA256

de5a02e19ae798b3b4d5cecf7932ddef2be51cc0dfbbc5c9babe486172d96daa
SHA512

cbe3345de7151cf1cf7c899b958b2473d3615566ac8be89953ad6b7bee579898f1b289a77043c68dd9080816412495dcc4d04f9b0f2395787250b6a7f862eab5
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1cASXv8Bl6rM1k4QMQbDA4iZhn/BjDDF:ROdWCCi7/rahwNUMJH4KZhVDF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 30 IoCs

miner

resource	yara_rule
behavioral1/memory/2156-9-0x000000013F290000-0x000000013F5E1000-memory.dmp	xmrig
behavioral1/memory/2748-16-0x000000013F490000-0x000000013F7E1000-memory.dmp	xmrig
behavioral1/memory/2884-37-0x000000013F690000-0x000000013F9E1000-memory.dmp	xmrig
behavioral1/memory/2552-51-0x000000013FF90000-0x00000001402E1000-memory.dmp	xmrig
behavioral1/memory/2560-67-0x000000013F100000-0x000000013F451000-memory.dmp	xmrig
behavioral1/memory/2208-64-0x000000013F650000-0x000000013F9A1000-memory.dmp	xmrig
behavioral1/memory/2456-62-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/636-106-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig
behavioral1/memory/2784-105-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/2968-1496-0x000000013FF60000-0x00000001402B1000-memory.dmp	xmrig
behavioral1/memory/2556-275-0x000000013F100000-0x000000013F451000-memory.dmp	xmrig
behavioral1/memory/2640-94-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2540-88-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	xmrig
behavioral1/memory/2544-86-0x000000013F630000-0x000000013F981000-memory.dmp	xmrig
behavioral1/memory/2968-77-0x000000013FF60000-0x00000001402B1000-memory.dmp	xmrig
behavioral1/memory/2704-1876-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2748-3844-0x000000013F490000-0x000000013F7E1000-memory.dmp	xmrig
behavioral1/memory/2640-3854-0x000000013FAE0000-0x000000013FE31000-memory.dmp	xmrig
behavioral1/memory/2156-3852-0x000000013F290000-0x000000013F5E1000-memory.dmp	xmrig
behavioral1/memory/2544-3856-0x000000013F630000-0x000000013F981000-memory.dmp	xmrig
behavioral1/memory/2884-3865-0x000000013F690000-0x000000013F9E1000-memory.dmp	xmrig
behavioral1/memory/2556-3932-0x000000013F100000-0x000000013F451000-memory.dmp	xmrig
behavioral1/memory/2552-3935-0x000000013FF90000-0x00000001402E1000-memory.dmp	xmrig
behavioral1/memory/2560-3944-0x000000013F100000-0x000000013F451000-memory.dmp	xmrig
behavioral1/memory/2456-3938-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2968-3952-0x000000013FF60000-0x00000001402B1000-memory.dmp	xmrig
behavioral1/memory/2704-4020-0x000000013FE40000-0x0000000140191000-memory.dmp	xmrig
behavioral1/memory/2540-4000-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	xmrig
behavioral1/memory/2784-4027-0x000000013F970000-0x000000013FCC1000-memory.dmp	xmrig
behavioral1/memory/636-3994-0x000000013F8E0000-0x000000013FC31000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2156	bROFHHl.exe
2748	YWLFMnJ.exe
2544	lOnQuLS.exe
2640	agNdiko.exe
2884	tQhWeUi.exe
2556	GmpBvaN.exe
2552	tdAouOM.exe
2456	UBwUtbO.exe
2560	lgqSXDm.exe
2968	snEnSEw.exe
2704	bWwCzah.exe
2540	oGEpRfd.exe
2784	TupWdCN.exe
636	mIUqgWj.exe
1756	BbDMeyR.exe
1996	CRsRqIM.exe
1640	dqKriLn.exe
1592	YjOvzsr.exe
2688	fieiWTE.exe
1580	FzVHUoT.exe
1388	GepsaRd.exe
1420	ZyGwcTB.exe
1764	HpRDYor.exe
2060	NABpkrH.exe
2988	OQwzDbk.exe
1912	rwKDfLl.exe
2904	EkKVzdz.exe
1932	jNYEqqT.exe
684	enczjVK.exe
1484	eNrXglm.exe
2292	mQDQQth.exe
2852	GfpUMKt.exe
1792	vBwmRcR.exe
696	bZjgbId.exe
1140	IKfpwRL.exe
2132	iCfSpQY.exe
2100	LemzzNj.exe
2020	OTxElBD.exe
1560	YQwtFPd.exe
1772	hGRSrPO.exe
964	jmuaOsz.exe
1868	LZpfdou.exe
2264	SKSWpou.exe
1692	ODxvrkg.exe
968	mHqKXlS.exe
1028	NafwowX.exe
1616	wqqaPdh.exe
2920	solkGxN.exe
1648	mbXMSYY.exe
2072	cJHIXIy.exe
1980	wxsccpR.exe
1732	TufYlQJ.exe
892	DjZiCIy.exe
1064	qUxfUub.exe
2324	RiKYDlA.exe
1600	osLjwye.exe
1604	BGjQzuW.exe
1156	wEwHoIS.exe
1208	VuuBbNs.exe
2284	rZlLfRw.exe
2760	qrFvicC.exe
2488	xwcJofh.exe
2484	mHJCyUu.exe
2684	TBMareP.exe

Loads dropped DLL 64 IoCs

pid	Process
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-0-0x000000013F650000-0x000000013F9A1000-memory.dmp	upx
behavioral1/files/0x000b00000001565d-6.dat	upx
behavioral1/memory/2156-9-0x000000013F290000-0x000000013F5E1000-memory.dmp	upx
behavioral1/files/0x0034000000015cb6-12.dat	upx
behavioral1/memory/2748-16-0x000000013F490000-0x000000013F7E1000-memory.dmp	upx
behavioral1/files/0x0007000000015cff-13.dat	upx
behavioral1/files/0x0007000000015d20-23.dat	upx
behavioral1/memory/2640-28-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/files/0x0007000000015d42-29.dat	upx
behavioral1/memory/2884-37-0x000000013F690000-0x000000013F9E1000-memory.dmp	upx
behavioral1/memory/2544-22-0x000000013F630000-0x000000013F981000-memory.dmp	upx
behavioral1/files/0x0007000000015d4e-40.dat	upx
behavioral1/memory/2556-42-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/files/0x0009000000015d56-48.dat	upx
behavioral1/memory/2552-51-0x000000013FF90000-0x00000001402E1000-memory.dmp	upx
behavioral1/files/0x0034000000015ccd-54.dat	upx
behavioral1/files/0x000800000001658a-57.dat	upx
behavioral1/files/0x0006000000016616-68.dat	upx
behavioral1/memory/2560-67-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/memory/2208-64-0x000000013F650000-0x000000013F9A1000-memory.dmp	upx
behavioral1/memory/2456-62-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2704-78-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/files/0x0006000000016adc-83.dat	upx
behavioral1/files/0x0006000000016c44-91.dat	upx
behavioral1/files/0x0006000000016c5e-99.dat	upx
behavioral1/files/0x0006000000016cb0-112.dat	upx
behavioral1/memory/636-106-0x000000013F8E0000-0x000000013FC31000-memory.dmp	upx
behavioral1/memory/2784-105-0x000000013F970000-0x000000013FCC1000-memory.dmp	upx
behavioral1/files/0x0006000000016c64-100.dat	upx
behavioral1/files/0x0006000000016cdc-115.dat	upx
behavioral1/files/0x0006000000016d20-132.dat	upx
behavioral1/files/0x0006000000016d34-135.dat	upx
behavioral1/files/0x0006000000016d3a-141.dat	upx
behavioral1/files/0x0006000000016d43-149.dat	upx
behavioral1/files/0x0006000000016d5f-153.dat	upx
behavioral1/files/0x0006000000016d9d-169.dat	upx
behavioral1/files/0x0006000000016da5-172.dat	upx
behavioral1/files/0x0006000000016db9-185.dat	upx
behavioral1/memory/2968-1496-0x000000013FF60000-0x00000001402B1000-memory.dmp	upx
behavioral1/memory/2556-275-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/files/0x0006000000016dbe-190.dat	upx
behavioral1/files/0x0006000000016db1-180.dat	upx
behavioral1/files/0x0006000000016d8e-166.dat	upx
behavioral1/files/0x0006000000016d74-159.dat	upx
behavioral1/files/0x0006000000016d3e-145.dat	upx
behavioral1/files/0x0006000000016d18-127.dat	upx
behavioral1/files/0x0006000000016d07-122.dat	upx
behavioral1/memory/2640-94-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/memory/2540-88-0x000000013F5A0000-0x000000013F8F1000-memory.dmp	upx
behavioral1/memory/2544-86-0x000000013F630000-0x000000013F981000-memory.dmp	upx
behavioral1/memory/2968-77-0x000000013FF60000-0x00000001402B1000-memory.dmp	upx
behavioral1/files/0x0006000000016851-76.dat	upx
behavioral1/memory/2704-1876-0x000000013FE40000-0x0000000140191000-memory.dmp	upx
behavioral1/memory/2748-3844-0x000000013F490000-0x000000013F7E1000-memory.dmp	upx
behavioral1/memory/2640-3854-0x000000013FAE0000-0x000000013FE31000-memory.dmp	upx
behavioral1/memory/2156-3852-0x000000013F290000-0x000000013F5E1000-memory.dmp	upx
behavioral1/memory/2544-3856-0x000000013F630000-0x000000013F981000-memory.dmp	upx
behavioral1/memory/2884-3865-0x000000013F690000-0x000000013F9E1000-memory.dmp	upx
behavioral1/memory/2556-3932-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/memory/2552-3935-0x000000013FF90000-0x00000001402E1000-memory.dmp	upx
behavioral1/memory/2560-3944-0x000000013F100000-0x000000013F451000-memory.dmp	upx
behavioral1/memory/2456-3938-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2968-3952-0x000000013FF60000-0x00000001402B1000-memory.dmp	upx
behavioral1/memory/2704-4020-0x000000013FE40000-0x0000000140191000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PhXKlel.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\wofDNPv.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\awmHPie.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\xjlLZzK.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\kSjoYSu.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\BDYFIWc.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\unehsgM.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\TIOogCl.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\KznSOET.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\YfmJJSN.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\bdfKoPY.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\tiAuVpc.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\YYjBirI.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\FsGJsft.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\PJlFYvo.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\tZRURue.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\zhQpadW.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\lAoJNKL.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\RRNPAWw.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\oLmxclj.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\IDtqWda.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\mAwFztU.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\yYluVMY.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\eiLDibB.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\SYPvhLZ.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\MYNWbQN.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\OuwntFX.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\OTlpEgP.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\WRttgmD.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\YgUWIbA.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\qGSkITH.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\SEUTZDB.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\ksyIDJb.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\RlVsUgC.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\rCGrMMD.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\xwcJofh.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\SsnKpHA.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\PzqJcqM.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\xWDrvCx.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\QvVateG.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\BOXrfer.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\HGSUnmp.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\TWLhTvy.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\xmJCEQt.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\BJTXJhN.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\RfFIEWA.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\UBwUtbO.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\jdtGnRU.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\DIJdabC.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\WxeBdgq.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\FfRKqnM.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\QMFwMWd.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\qkYwsQt.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\QODQRWI.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\BPTlngE.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\ViaNPeS.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\ROOaqjQ.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\chVewXW.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\uPRMQQF.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\ilavQUi.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\fwHZMWV.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\VbSMZeE.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\aFRLttD.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
File created	C:\Windows\System\qRubAAc.exe	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2156	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	29
PID 2208 wrote to memory of 2156	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	29
PID 2208 wrote to memory of 2156	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	29
PID 2208 wrote to memory of 2748	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	30
PID 2208 wrote to memory of 2748	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	30
PID 2208 wrote to memory of 2748	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	30
PID 2208 wrote to memory of 2544	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	31
PID 2208 wrote to memory of 2544	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	31
PID 2208 wrote to memory of 2544	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	31
PID 2208 wrote to memory of 2640	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	32
PID 2208 wrote to memory of 2640	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	32
PID 2208 wrote to memory of 2640	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	32
PID 2208 wrote to memory of 2884	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	33
PID 2208 wrote to memory of 2884	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	33
PID 2208 wrote to memory of 2884	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	33
PID 2208 wrote to memory of 2556	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	34
PID 2208 wrote to memory of 2556	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	34
PID 2208 wrote to memory of 2556	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	34
PID 2208 wrote to memory of 2552	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	35
PID 2208 wrote to memory of 2552	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	35
PID 2208 wrote to memory of 2552	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	35
PID 2208 wrote to memory of 2456	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	36
PID 2208 wrote to memory of 2456	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	36
PID 2208 wrote to memory of 2456	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	36
PID 2208 wrote to memory of 2560	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	37
PID 2208 wrote to memory of 2560	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	37
PID 2208 wrote to memory of 2560	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	37
PID 2208 wrote to memory of 2968	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	38
PID 2208 wrote to memory of 2968	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	38
PID 2208 wrote to memory of 2968	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	38
PID 2208 wrote to memory of 2704	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	39
PID 2208 wrote to memory of 2704	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	39
PID 2208 wrote to memory of 2704	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	39
PID 2208 wrote to memory of 2540	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	40
PID 2208 wrote to memory of 2540	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	40
PID 2208 wrote to memory of 2540	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	40
PID 2208 wrote to memory of 2784	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	41
PID 2208 wrote to memory of 2784	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	41
PID 2208 wrote to memory of 2784	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	41
PID 2208 wrote to memory of 636	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	42
PID 2208 wrote to memory of 636	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	42
PID 2208 wrote to memory of 636	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	42
PID 2208 wrote to memory of 1756	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	43
PID 2208 wrote to memory of 1756	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	43
PID 2208 wrote to memory of 1756	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	43
PID 2208 wrote to memory of 1996	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	44
PID 2208 wrote to memory of 1996	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	44
PID 2208 wrote to memory of 1996	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	44
PID 2208 wrote to memory of 1640	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	45
PID 2208 wrote to memory of 1640	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	45
PID 2208 wrote to memory of 1640	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	45
PID 2208 wrote to memory of 1592	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	46
PID 2208 wrote to memory of 1592	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	46
PID 2208 wrote to memory of 1592	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	46
PID 2208 wrote to memory of 2688	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	47
PID 2208 wrote to memory of 2688	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	47
PID 2208 wrote to memory of 2688	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	47
PID 2208 wrote to memory of 1580	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	48
PID 2208 wrote to memory of 1580	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	48
PID 2208 wrote to memory of 1580	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	48
PID 2208 wrote to memory of 1388	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	49
PID 2208 wrote to memory of 1388	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	49
PID 2208 wrote to memory of 1388	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	49
PID 2208 wrote to memory of 1420	2208	484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\484e3ced39ecee52da1cad92822f29e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System\bROFHHl.exe
  C:\Windows\System\bROFHHl.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\YWLFMnJ.exe
  C:\Windows\System\YWLFMnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\lOnQuLS.exe
  C:\Windows\System\lOnQuLS.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\agNdiko.exe
  C:\Windows\System\agNdiko.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\tQhWeUi.exe
  C:\Windows\System\tQhWeUi.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\GmpBvaN.exe
  C:\Windows\System\GmpBvaN.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\tdAouOM.exe
  C:\Windows\System\tdAouOM.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\UBwUtbO.exe
  C:\Windows\System\UBwUtbO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\lgqSXDm.exe
  C:\Windows\System\lgqSXDm.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\snEnSEw.exe
  C:\Windows\System\snEnSEw.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\bWwCzah.exe
  C:\Windows\System\bWwCzah.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\oGEpRfd.exe
  C:\Windows\System\oGEpRfd.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\TupWdCN.exe
  C:\Windows\System\TupWdCN.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\mIUqgWj.exe
  C:\Windows\System\mIUqgWj.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\BbDMeyR.exe
  C:\Windows\System\BbDMeyR.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\CRsRqIM.exe
  C:\Windows\System\CRsRqIM.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\dqKriLn.exe
  C:\Windows\System\dqKriLn.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\YjOvzsr.exe
  C:\Windows\System\YjOvzsr.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\fieiWTE.exe
  C:\Windows\System\fieiWTE.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FzVHUoT.exe
  C:\Windows\System\FzVHUoT.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\GepsaRd.exe
  C:\Windows\System\GepsaRd.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\ZyGwcTB.exe
  C:\Windows\System\ZyGwcTB.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\HpRDYor.exe
  C:\Windows\System\HpRDYor.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\NABpkrH.exe
  C:\Windows\System\NABpkrH.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\OQwzDbk.exe
  C:\Windows\System\OQwzDbk.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\rwKDfLl.exe
  C:\Windows\System\rwKDfLl.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\EkKVzdz.exe
  C:\Windows\System\EkKVzdz.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\jNYEqqT.exe
  C:\Windows\System\jNYEqqT.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\enczjVK.exe
  C:\Windows\System\enczjVK.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\eNrXglm.exe
  C:\Windows\System\eNrXglm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\mQDQQth.exe
  C:\Windows\System\mQDQQth.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\GfpUMKt.exe
  C:\Windows\System\GfpUMKt.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\vBwmRcR.exe
  C:\Windows\System\vBwmRcR.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\bZjgbId.exe
  C:\Windows\System\bZjgbId.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\IKfpwRL.exe
  C:\Windows\System\IKfpwRL.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\iCfSpQY.exe
  C:\Windows\System\iCfSpQY.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\LemzzNj.exe
  C:\Windows\System\LemzzNj.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\OTxElBD.exe
  C:\Windows\System\OTxElBD.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\YQwtFPd.exe
  C:\Windows\System\YQwtFPd.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\hGRSrPO.exe
  C:\Windows\System\hGRSrPO.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\jmuaOsz.exe
  C:\Windows\System\jmuaOsz.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\LZpfdou.exe
  C:\Windows\System\LZpfdou.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\SKSWpou.exe
  C:\Windows\System\SKSWpou.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ODxvrkg.exe
  C:\Windows\System\ODxvrkg.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\mHqKXlS.exe
  C:\Windows\System\mHqKXlS.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\NafwowX.exe
  C:\Windows\System\NafwowX.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\wqqaPdh.exe
  C:\Windows\System\wqqaPdh.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\solkGxN.exe
  C:\Windows\System\solkGxN.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\mbXMSYY.exe
  C:\Windows\System\mbXMSYY.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\cJHIXIy.exe
  C:\Windows\System\cJHIXIy.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\wxsccpR.exe
  C:\Windows\System\wxsccpR.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\TufYlQJ.exe
  C:\Windows\System\TufYlQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DjZiCIy.exe
  C:\Windows\System\DjZiCIy.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\qUxfUub.exe
  C:\Windows\System\qUxfUub.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RiKYDlA.exe
  C:\Windows\System\RiKYDlA.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\osLjwye.exe
  C:\Windows\System\osLjwye.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\BGjQzuW.exe
  C:\Windows\System\BGjQzuW.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\wEwHoIS.exe
  C:\Windows\System\wEwHoIS.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\VuuBbNs.exe
  C:\Windows\System\VuuBbNs.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\rZlLfRw.exe
  C:\Windows\System\rZlLfRw.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\qrFvicC.exe
  C:\Windows\System\qrFvicC.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\xwcJofh.exe
  C:\Windows\System\xwcJofh.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\mHJCyUu.exe
  C:\Windows\System\mHJCyUu.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\TBMareP.exe
  C:\Windows\System\TBMareP.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\aIkXbKc.exe
  C:\Windows\System\aIkXbKc.exe
  2⤵
  PID:3040
- C:\Windows\System\tnHCSkc.exe
  C:\Windows\System\tnHCSkc.exe
  2⤵
  PID:2448
- C:\Windows\System\KBjDDHc.exe
  C:\Windows\System\KBjDDHc.exe
  2⤵
  PID:1940
- C:\Windows\System\OajSLcv.exe
  C:\Windows\System\OajSLcv.exe
  2⤵
  PID:2628
- C:\Windows\System\MTSGYwu.exe
  C:\Windows\System\MTSGYwu.exe
  2⤵
  PID:2472
- C:\Windows\System\GmUoXAH.exe
  C:\Windows\System\GmUoXAH.exe
  2⤵
  PID:1944
- C:\Windows\System\AkxOrcN.exe
  C:\Windows\System\AkxOrcN.exe
  2⤵
  PID:2992
- C:\Windows\System\IBgUEcP.exe
  C:\Windows\System\IBgUEcP.exe
  2⤵
  PID:1532
- C:\Windows\System\VoRjxaQ.exe
  C:\Windows\System\VoRjxaQ.exe
  2⤵
  PID:1520
- C:\Windows\System\ekOXuIU.exe
  C:\Windows\System\ekOXuIU.exe
  2⤵
  PID:2712
- C:\Windows\System\PkDkHlO.exe
  C:\Windows\System\PkDkHlO.exe
  2⤵
  PID:856
- C:\Windows\System\fBITlcV.exe
  C:\Windows\System\fBITlcV.exe
  2⤵
  PID:1160
- C:\Windows\System\okmFxbv.exe
  C:\Windows\System\okmFxbv.exe
  2⤵
  PID:2892
- C:\Windows\System\eIKaZsr.exe
  C:\Windows\System\eIKaZsr.exe
  2⤵
  PID:3056
- C:\Windows\System\rxOGCeX.exe
  C:\Windows\System\rxOGCeX.exe
  2⤵
  PID:2232
- C:\Windows\System\ngaejaS.exe
  C:\Windows\System\ngaejaS.exe
  2⤵
  PID:2012
- C:\Windows\System\lAICgHC.exe
  C:\Windows\System\lAICgHC.exe
  2⤵
  PID:1368
- C:\Windows\System\JBxECJj.exe
  C:\Windows\System\JBxECJj.exe
  2⤵
  PID:1828
- C:\Windows\System\nPYvfZg.exe
  C:\Windows\System\nPYvfZg.exe
  2⤵
  PID:2848
- C:\Windows\System\LGBGcrR.exe
  C:\Windows\System\LGBGcrR.exe
  2⤵
  PID:848
- C:\Windows\System\dxRncvs.exe
  C:\Windows\System\dxRncvs.exe
  2⤵
  PID:2176
- C:\Windows\System\pxFkWjb.exe
  C:\Windows\System\pxFkWjb.exe
  2⤵
  PID:2104
- C:\Windows\System\EUKDHQF.exe
  C:\Windows\System\EUKDHQF.exe
  2⤵
  PID:2632
- C:\Windows\System\yVZEUQd.exe
  C:\Windows\System\yVZEUQd.exe
  2⤵
  PID:2328
- C:\Windows\System\voTheJP.exe
  C:\Windows\System\voTheJP.exe
  2⤵
  PID:1556
- C:\Windows\System\InhdxQq.exe
  C:\Windows\System\InhdxQq.exe
  2⤵
  PID:1344
- C:\Windows\System\aVbwOJJ.exe
  C:\Windows\System\aVbwOJJ.exe
  2⤵
  PID:1332
- C:\Windows\System\TkZMchQ.exe
  C:\Windows\System\TkZMchQ.exe
  2⤵
  PID:1224
- C:\Windows\System\oKgVgrc.exe
  C:\Windows\System\oKgVgrc.exe
  2⤵
  PID:1800
- C:\Windows\System\TIWWqdn.exe
  C:\Windows\System\TIWWqdn.exe
  2⤵
  PID:2136
- C:\Windows\System\JpSztib.exe
  C:\Windows\System\JpSztib.exe
  2⤵
  PID:2940
- C:\Windows\System\XeCjhsH.exe
  C:\Windows\System\XeCjhsH.exe
  2⤵
  PID:980
- C:\Windows\System\RMPMNfi.exe
  C:\Windows\System\RMPMNfi.exe
  2⤵
  PID:1776
- C:\Windows\System\byZumyX.exe
  C:\Windows\System\byZumyX.exe
  2⤵
  PID:2188
- C:\Windows\System\IBtZKrM.exe
  C:\Windows\System\IBtZKrM.exe
  2⤵
  PID:2524
- C:\Windows\System\JgnySRm.exe
  C:\Windows\System\JgnySRm.exe
  2⤵
  PID:2996
- C:\Windows\System\cksLYYR.exe
  C:\Windows\System\cksLYYR.exe
  2⤵
  PID:1612
- C:\Windows\System\ByBrVAr.exe
  C:\Windows\System\ByBrVAr.exe
  2⤵
  PID:2792
- C:\Windows\System\PJYZQLj.exe
  C:\Windows\System\PJYZQLj.exe
  2⤵
  PID:2332
- C:\Windows\System\ZLbWcKm.exe
  C:\Windows\System\ZLbWcKm.exe
  2⤵
  PID:2572
- C:\Windows\System\IYwENaJ.exe
  C:\Windows\System\IYwENaJ.exe
  2⤵
  PID:2512
- C:\Windows\System\LpIXYYz.exe
  C:\Windows\System\LpIXYYz.exe
  2⤵
  PID:2644
- C:\Windows\System\nDGnkro.exe
  C:\Windows\System\nDGnkro.exe
  2⤵
  PID:2672
- C:\Windows\System\mUZHxPo.exe
  C:\Windows\System\mUZHxPo.exe
  2⤵
  PID:2804
- C:\Windows\System\nhlyHYX.exe
  C:\Windows\System\nhlyHYX.exe
  2⤵
  PID:2872
- C:\Windows\System\iMpqipT.exe
  C:\Windows\System\iMpqipT.exe
  2⤵
  PID:832
- C:\Windows\System\VAnYbei.exe
  C:\Windows\System\VAnYbei.exe
  2⤵
  PID:2528
- C:\Windows\System\mJEXtbk.exe
  C:\Windows\System\mJEXtbk.exe
  2⤵
  PID:672
- C:\Windows\System\QwmXTQq.exe
  C:\Windows\System\QwmXTQq.exe
  2⤵
  PID:2948
- C:\Windows\System\BnJpESd.exe
  C:\Windows\System\BnJpESd.exe
  2⤵
  PID:2932
- C:\Windows\System\YIEuVZF.exe
  C:\Windows\System\YIEuVZF.exe
  2⤵
  PID:1356
- C:\Windows\System\dNcHVhN.exe
  C:\Windows\System\dNcHVhN.exe
  2⤵
  PID:2256
- C:\Windows\System\YBuQXaH.exe
  C:\Windows\System\YBuQXaH.exe
  2⤵
  PID:2724
- C:\Windows\System\pNdjJqI.exe
  C:\Windows\System\pNdjJqI.exe
  2⤵
  PID:336
- C:\Windows\System\nWOqIcj.exe
  C:\Windows\System\nWOqIcj.exe
  2⤵
  PID:764
- C:\Windows\System\szCvlFf.exe
  C:\Windows\System\szCvlFf.exe
  2⤵
  PID:2004
- C:\Windows\System\wfKFdGe.exe
  C:\Windows\System\wfKFdGe.exe
  2⤵
  PID:556
- C:\Windows\System\OKUnhpF.exe
  C:\Windows\System\OKUnhpF.exe
  2⤵
  PID:2252
- C:\Windows\System\cVzypYT.exe
  C:\Windows\System\cVzypYT.exe
  2⤵
  PID:2828
- C:\Windows\System\YJJBiGR.exe
  C:\Windows\System\YJJBiGR.exe
  2⤵
  PID:2424
- C:\Windows\System\oHNaADg.exe
  C:\Windows\System\oHNaADg.exe
  2⤵
  PID:1680
- C:\Windows\System\TRuFcuz.exe
  C:\Windows\System\TRuFcuz.exe
  2⤵
  PID:660
- C:\Windows\System\ncVJXtb.exe
  C:\Windows\System\ncVJXtb.exe
  2⤵
  PID:1228
- C:\Windows\System\pWOQGPq.exe
  C:\Windows\System\pWOQGPq.exe
  2⤵
  PID:748
- C:\Windows\System\DuVZTZE.exe
  C:\Windows\System\DuVZTZE.exe
  2⤵
  PID:2936
- C:\Windows\System\OpftKMh.exe
  C:\Windows\System\OpftKMh.exe
  2⤵
  PID:1508
- C:\Windows\System\ycuRSWQ.exe
  C:\Windows\System\ycuRSWQ.exe
  2⤵
  PID:2052
- C:\Windows\System\wMoOUuQ.exe
  C:\Windows\System\wMoOUuQ.exe
  2⤵
  PID:2652
- C:\Windows\System\TLkRfyV.exe
  C:\Windows\System\TLkRfyV.exe
  2⤵
  PID:1452
- C:\Windows\System\fZFXDMW.exe
  C:\Windows\System\fZFXDMW.exe
  2⤵
  PID:2680
- C:\Windows\System\xqNIHmD.exe
  C:\Windows\System\xqNIHmD.exe
  2⤵
  PID:1032
- C:\Windows\System\fTIRxtj.exe
  C:\Windows\System\fTIRxtj.exe
  2⤵
  PID:2592
- C:\Windows\System\TjvrjKj.exe
  C:\Windows\System\TjvrjKj.exe
  2⤵
  PID:1660
- C:\Windows\System\YONWnkb.exe
  C:\Windows\System\YONWnkb.exe
  2⤵
  PID:2024
- C:\Windows\System\OAzYFsB.exe
  C:\Windows\System\OAzYFsB.exe
  2⤵
  PID:2036
- C:\Windows\System\zfjtAOJ.exe
  C:\Windows\System\zfjtAOJ.exe
  2⤵
  PID:1196
- C:\Windows\System\BDLRuIn.exe
  C:\Windows\System\BDLRuIn.exe
  2⤵
  PID:3008
- C:\Windows\System\zHbHJTU.exe
  C:\Windows\System\zHbHJTU.exe
  2⤵
  PID:2184
- C:\Windows\System\HWQgdbi.exe
  C:\Windows\System\HWQgdbi.exe
  2⤵
  PID:2160
- C:\Windows\System\vThkFYH.exe
  C:\Windows\System\vThkFYH.exe
  2⤵
  PID:2796
- C:\Windows\System\ysQldoG.exe
  C:\Windows\System\ysQldoG.exe
  2⤵
  PID:588
- C:\Windows\System\LAqXUAR.exe
  C:\Windows\System\LAqXUAR.exe
  2⤵
  PID:584
- C:\Windows\System\memdGqb.exe
  C:\Windows\System\memdGqb.exe
  2⤵
  PID:2436
- C:\Windows\System\kgAeYcH.exe
  C:\Windows\System\kgAeYcH.exe
  2⤵
  PID:2088
- C:\Windows\System\gGvcwgH.exe
  C:\Windows\System\gGvcwgH.exe
  2⤵
  PID:2376
- C:\Windows\System\XeaQXrK.exe
  C:\Windows\System\XeaQXrK.exe
  2⤵
  PID:1544
- C:\Windows\System\WDKXZJZ.exe
  C:\Windows\System\WDKXZJZ.exe
  2⤵
  PID:876
- C:\Windows\System\OQCNPAi.exe
  C:\Windows\System\OQCNPAi.exe
  2⤵
  PID:1740
- C:\Windows\System\HXlPevP.exe
  C:\Windows\System\HXlPevP.exe
  2⤵
  PID:2124
- C:\Windows\System\TAFIZMb.exe
  C:\Windows\System\TAFIZMb.exe
  2⤵
  PID:2612
- C:\Windows\System\fnksmYy.exe
  C:\Windows\System\fnksmYy.exe
  2⤵
  PID:548
- C:\Windows\System\NaZkRVK.exe
  C:\Windows\System\NaZkRVK.exe
  2⤵
  PID:1300
- C:\Windows\System\yzqRzTq.exe
  C:\Windows\System\yzqRzTq.exe
  2⤵
  PID:2348
- C:\Windows\System\ODIkdON.exe
  C:\Windows\System\ODIkdON.exe
  2⤵
  PID:2844
- C:\Windows\System\pRXmBpu.exe
  C:\Windows\System\pRXmBpu.exe
  2⤵
  PID:2096
- C:\Windows\System\iOUkvcX.exe
  C:\Windows\System\iOUkvcX.exe
  2⤵
  PID:2320
- C:\Windows\System\olCHtUE.exe
  C:\Windows\System\olCHtUE.exe
  2⤵
  PID:2824
- C:\Windows\System\EEYfPoI.exe
  C:\Windows\System\EEYfPoI.exe
  2⤵
  PID:1628
- C:\Windows\System\IpbfWgQ.exe
  C:\Windows\System\IpbfWgQ.exe
  2⤵
  PID:1952
- C:\Windows\System\SNFyWTJ.exe
  C:\Windows\System\SNFyWTJ.exe
  2⤵
  PID:1000
- C:\Windows\System\ICOoCKJ.exe
  C:\Windows\System\ICOoCKJ.exe
  2⤵
  PID:2864
- C:\Windows\System\dxsCpYt.exe
  C:\Windows\System\dxsCpYt.exe
  2⤵
  PID:1644
- C:\Windows\System\NBXRWFC.exe
  C:\Windows\System\NBXRWFC.exe
  2⤵
  PID:1528
- C:\Windows\System\AtiJBsW.exe
  C:\Windows\System\AtiJBsW.exe
  2⤵
  PID:2500
- C:\Windows\System\ustrFIE.exe
  C:\Windows\System\ustrFIE.exe
  2⤵
  PID:1092
- C:\Windows\System\ChXJArb.exe
  C:\Windows\System\ChXJArb.exe
  2⤵
  PID:2380
- C:\Windows\System\ABPbthQ.exe
  C:\Windows\System\ABPbthQ.exe
  2⤵
  PID:2064
- C:\Windows\System\jYfvuLJ.exe
  C:\Windows\System\jYfvuLJ.exe
  2⤵
  PID:884
- C:\Windows\System\DlNjxev.exe
  C:\Windows\System\DlNjxev.exe
  2⤵
  PID:2532
- C:\Windows\System\JYJwIaQ.exe
  C:\Windows\System\JYJwIaQ.exe
  2⤵
  PID:1608
- C:\Windows\System\nJuyebv.exe
  C:\Windows\System\nJuyebv.exe
  2⤵
  PID:2108
- C:\Windows\System\gjPlywK.exe
  C:\Windows\System\gjPlywK.exe
  2⤵
  PID:3032
- C:\Windows\System\NUQaEOI.exe
  C:\Windows\System\NUQaEOI.exe
  2⤵
  PID:1948
- C:\Windows\System\jHLRivv.exe
  C:\Windows\System\jHLRivv.exe
  2⤵
  PID:2668
- C:\Windows\System\fLgZRcz.exe
  C:\Windows\System\fLgZRcz.exe
  2⤵
  PID:2776
- C:\Windows\System\sXUvEGq.exe
  C:\Windows\System\sXUvEGq.exe
  2⤵
  PID:2388
- C:\Windows\System\VIHsqPX.exe
  C:\Windows\System\VIHsqPX.exe
  2⤵
  PID:2908
- C:\Windows\System\eSUMGru.exe
  C:\Windows\System\eSUMGru.exe
  2⤵
  PID:1696
- C:\Windows\System\qGSkITH.exe
  C:\Windows\System\qGSkITH.exe
  2⤵
  PID:3084
- C:\Windows\System\YOlhNqD.exe
  C:\Windows\System\YOlhNqD.exe
  2⤵
  PID:3100
- C:\Windows\System\kIrpaXO.exe
  C:\Windows\System\kIrpaXO.exe
  2⤵
  PID:3120
- C:\Windows\System\HpVykRT.exe
  C:\Windows\System\HpVykRT.exe
  2⤵
  PID:3136
- C:\Windows\System\WZhKwDZ.exe
  C:\Windows\System\WZhKwDZ.exe
  2⤵
  PID:3152
- C:\Windows\System\TpYjBxT.exe
  C:\Windows\System\TpYjBxT.exe
  2⤵
  PID:3192
- C:\Windows\System\VgUnLVh.exe
  C:\Windows\System\VgUnLVh.exe
  2⤵
  PID:3208
- C:\Windows\System\jNjiAiR.exe
  C:\Windows\System\jNjiAiR.exe
  2⤵
  PID:3224
- C:\Windows\System\qkYwsQt.exe
  C:\Windows\System\qkYwsQt.exe
  2⤵
  PID:3240
- C:\Windows\System\LchEHHg.exe
  C:\Windows\System\LchEHHg.exe
  2⤵
  PID:3260
- C:\Windows\System\JjFAfuI.exe
  C:\Windows\System\JjFAfuI.exe
  2⤵
  PID:3276
- C:\Windows\System\isovwHy.exe
  C:\Windows\System\isovwHy.exe
  2⤵
  PID:3292
- C:\Windows\System\qRrATpf.exe
  C:\Windows\System\qRrATpf.exe
  2⤵
  PID:3308
- C:\Windows\System\gYgSodJ.exe
  C:\Windows\System\gYgSodJ.exe
  2⤵
  PID:3328
- C:\Windows\System\pFXNccj.exe
  C:\Windows\System\pFXNccj.exe
  2⤵
  PID:3348
- C:\Windows\System\XCNODEW.exe
  C:\Windows\System\XCNODEW.exe
  2⤵
  PID:3364
- C:\Windows\System\jArqbqe.exe
  C:\Windows\System\jArqbqe.exe
  2⤵
  PID:3380
- C:\Windows\System\iFeFUcu.exe
  C:\Windows\System\iFeFUcu.exe
  2⤵
  PID:3396
- C:\Windows\System\uNzvsIG.exe
  C:\Windows\System\uNzvsIG.exe
  2⤵
  PID:3412
- C:\Windows\System\BOlDGnE.exe
  C:\Windows\System\BOlDGnE.exe
  2⤵
  PID:3428
- C:\Windows\System\QBwWxxq.exe
  C:\Windows\System\QBwWxxq.exe
  2⤵
  PID:3444
- C:\Windows\System\tlpMHUL.exe
  C:\Windows\System\tlpMHUL.exe
  2⤵
  PID:3464
- C:\Windows\System\tjRYtQO.exe
  C:\Windows\System\tjRYtQO.exe
  2⤵
  PID:3576
- C:\Windows\System\SYPvhLZ.exe
  C:\Windows\System\SYPvhLZ.exe
  2⤵
  PID:3596
- C:\Windows\System\QvVateG.exe
  C:\Windows\System\QvVateG.exe
  2⤵
  PID:3612
- C:\Windows\System\ywJBsFi.exe
  C:\Windows\System\ywJBsFi.exe
  2⤵
  PID:3632
- C:\Windows\System\hgfMWuf.exe
  C:\Windows\System\hgfMWuf.exe
  2⤵
  PID:3648
- C:\Windows\System\EkDUKPK.exe
  C:\Windows\System\EkDUKPK.exe
  2⤵
  PID:3664
- C:\Windows\System\FacKKWJ.exe
  C:\Windows\System\FacKKWJ.exe
  2⤵
  PID:3700
- C:\Windows\System\utJlbju.exe
  C:\Windows\System\utJlbju.exe
  2⤵
  PID:3720
- C:\Windows\System\yHsHdtA.exe
  C:\Windows\System\yHsHdtA.exe
  2⤵
  PID:3736
- C:\Windows\System\jXCxXhe.exe
  C:\Windows\System\jXCxXhe.exe
  2⤵
  PID:3756
- C:\Windows\System\SglzcPl.exe
  C:\Windows\System\SglzcPl.exe
  2⤵
  PID:3772
- C:\Windows\System\SgzErgV.exe
  C:\Windows\System\SgzErgV.exe
  2⤵
  PID:3788
- C:\Windows\System\DBuKpWz.exe
  C:\Windows\System\DBuKpWz.exe
  2⤵
  PID:3804
- C:\Windows\System\bpGNSAy.exe
  C:\Windows\System\bpGNSAy.exe
  2⤵
  PID:3824
- C:\Windows\System\rhafAGN.exe
  C:\Windows\System\rhafAGN.exe
  2⤵
  PID:3840
- C:\Windows\System\gzLkSuB.exe
  C:\Windows\System\gzLkSuB.exe
  2⤵
  PID:3856
- C:\Windows\System\fcgbXvF.exe
  C:\Windows\System\fcgbXvF.exe
  2⤵
  PID:3872
- C:\Windows\System\XUUvWME.exe
  C:\Windows\System\XUUvWME.exe
  2⤵
  PID:3896
- C:\Windows\System\aAQqCMG.exe
  C:\Windows\System\aAQqCMG.exe
  2⤵
  PID:3916
- C:\Windows\System\WqrnDPS.exe
  C:\Windows\System\WqrnDPS.exe
  2⤵
  PID:3932
- C:\Windows\System\GeCFRlf.exe
  C:\Windows\System\GeCFRlf.exe
  2⤵
  PID:3948
- C:\Windows\System\YYXRVtD.exe
  C:\Windows\System\YYXRVtD.exe
  2⤵
  PID:3964
- C:\Windows\System\UGWboEy.exe
  C:\Windows\System\UGWboEy.exe
  2⤵
  PID:3984
- C:\Windows\System\lNerujY.exe
  C:\Windows\System\lNerujY.exe
  2⤵
  PID:4004
- C:\Windows\System\tKdoGAE.exe
  C:\Windows\System\tKdoGAE.exe
  2⤵
  PID:4060
- C:\Windows\System\TuBmQpH.exe
  C:\Windows\System\TuBmQpH.exe
  2⤵
  PID:4076
- C:\Windows\System\IMQRUTB.exe
  C:\Windows\System\IMQRUTB.exe
  2⤵
  PID:4092
- C:\Windows\System\PkWJRxE.exe
  C:\Windows\System\PkWJRxE.exe
  2⤵
  PID:1004
- C:\Windows\System\qQABAgD.exe
  C:\Windows\System\qQABAgD.exe
  2⤵
  PID:3076
- C:\Windows\System\NbHdOmW.exe
  C:\Windows\System\NbHdOmW.exe
  2⤵
  PID:3116
- C:\Windows\System\YQkskvf.exe
  C:\Windows\System\YQkskvf.exe
  2⤵
  PID:2780
- C:\Windows\System\KyhbfBD.exe
  C:\Windows\System\KyhbfBD.exe
  2⤵
  PID:3232
- C:\Windows\System\fGRPFYp.exe
  C:\Windows\System\fGRPFYp.exe
  2⤵
  PID:3300
- C:\Windows\System\ZMwnylm.exe
  C:\Windows\System\ZMwnylm.exe
  2⤵
  PID:3128
- C:\Windows\System\HpwERuN.exe
  C:\Windows\System\HpwERuN.exe
  2⤵
  PID:3172
- C:\Windows\System\BuDwIZz.exe
  C:\Windows\System\BuDwIZz.exe
  2⤵
  PID:3184
- C:\Windows\System\SwIlZwy.exe
  C:\Windows\System\SwIlZwy.exe
  2⤵
  PID:3288
- C:\Windows\System\PcbXxgf.exe
  C:\Windows\System\PcbXxgf.exe
  2⤵
  PID:3256
- C:\Windows\System\tEpDleI.exe
  C:\Windows\System\tEpDleI.exe
  2⤵
  PID:3376
- C:\Windows\System\RwDWndv.exe
  C:\Windows\System\RwDWndv.exe
  2⤵
  PID:3440
- C:\Windows\System\xQGKiHS.exe
  C:\Windows\System\xQGKiHS.exe
  2⤵
  PID:3508
- C:\Windows\System\ZHtcumE.exe
  C:\Windows\System\ZHtcumE.exe
  2⤵
  PID:3528
- C:\Windows\System\SlsPcUf.exe
  C:\Windows\System\SlsPcUf.exe
  2⤵
  PID:3540
- C:\Windows\System\cXNWVXm.exe
  C:\Windows\System\cXNWVXm.exe
  2⤵
  PID:3572
- C:\Windows\System\OPHezxK.exe
  C:\Windows\System\OPHezxK.exe
  2⤵
  PID:3644
- C:\Windows\System\xteuUkv.exe
  C:\Windows\System\xteuUkv.exe
  2⤵
  PID:3660
- C:\Windows\System\NLbAJRp.exe
  C:\Windows\System\NLbAJRp.exe
  2⤵
  PID:3680
- C:\Windows\System\XvySkQO.exe
  C:\Windows\System\XvySkQO.exe
  2⤵
  PID:3688
- C:\Windows\System\iWxKxKI.exe
  C:\Windows\System\iWxKxKI.exe
  2⤵
  PID:3728
- C:\Windows\System\VRTzAKY.exe
  C:\Windows\System\VRTzAKY.exe
  2⤵
  PID:3744
- C:\Windows\System\mvOgElj.exe
  C:\Windows\System\mvOgElj.exe
  2⤵
  PID:3820
- C:\Windows\System\QsMjCyw.exe
  C:\Windows\System\QsMjCyw.exe
  2⤵
  PID:3752
- C:\Windows\System\FbvyPUp.exe
  C:\Windows\System\FbvyPUp.exe
  2⤵
  PID:3912
- C:\Windows\System\GARezxw.exe
  C:\Windows\System\GARezxw.exe
  2⤵
  PID:3980
- C:\Windows\System\GXIhhOZ.exe
  C:\Windows\System\GXIhhOZ.exe
  2⤵
  PID:4024
- C:\Windows\System\BgCvkpC.exe
  C:\Windows\System\BgCvkpC.exe
  2⤵
  PID:4044
- C:\Windows\System\rzmgzVb.exe
  C:\Windows\System\rzmgzVb.exe
  2⤵
  PID:3928
- C:\Windows\System\zPEKmGy.exe
  C:\Windows\System\zPEKmGy.exe
  2⤵
  PID:944
- C:\Windows\System\XgcIjzy.exe
  C:\Windows\System\XgcIjzy.exe
  2⤵
  PID:4000
- C:\Windows\System\llMLYvv.exe
  C:\Windows\System\llMLYvv.exe
  2⤵
  PID:3336
- C:\Windows\System\jmJgMKV.exe
  C:\Windows\System\jmJgMKV.exe
  2⤵
  PID:4068
- C:\Windows\System\uyBeLZs.exe
  C:\Windows\System\uyBeLZs.exe
  2⤵
  PID:3132
- C:\Windows\System\bypziSC.exe
  C:\Windows\System\bypziSC.exe
  2⤵
  PID:3160
- C:\Windows\System\NJGOmch.exe
  C:\Windows\System\NJGOmch.exe
  2⤵
  PID:3220
- C:\Windows\System\dksIirg.exe
  C:\Windows\System\dksIirg.exe
  2⤵
  PID:3424
- C:\Windows\System\vaRQoML.exe
  C:\Windows\System\vaRQoML.exe
  2⤵
  PID:3436
- C:\Windows\System\HfMpopC.exe
  C:\Windows\System\HfMpopC.exe
  2⤵
  PID:3476
- C:\Windows\System\BalzVNU.exe
  C:\Windows\System\BalzVNU.exe
  2⤵
  PID:3548
- C:\Windows\System\dLFEqxv.exe
  C:\Windows\System\dLFEqxv.exe
  2⤵
  PID:3568
- C:\Windows\System\dNUDbJy.exe
  C:\Windows\System\dNUDbJy.exe
  2⤵
  PID:3608
- C:\Windows\System\sXnFjqJ.exe
  C:\Windows\System\sXnFjqJ.exe
  2⤵
  PID:3784
- C:\Windows\System\mWNJGOq.exe
  C:\Windows\System\mWNJGOq.exe
  2⤵
  PID:3892
- C:\Windows\System\oefokYI.exe
  C:\Windows\System\oefokYI.exe
  2⤵
  PID:2392
- C:\Windows\System\ACExzAn.exe
  C:\Windows\System\ACExzAn.exe
  2⤵
  PID:1668
- C:\Windows\System\jEXzRKR.exe
  C:\Windows\System\jEXzRKR.exe
  2⤵
  PID:3904
- C:\Windows\System\NVRCAKb.exe
  C:\Windows\System\NVRCAKb.exe
  2⤵
  PID:3976
- C:\Windows\System\GuNIDfr.exe
  C:\Windows\System\GuNIDfr.exe
  2⤵
  PID:4040
- C:\Windows\System\RkLNRjn.exe
  C:\Windows\System\RkLNRjn.exe
  2⤵
  PID:4088
- C:\Windows\System\HtkcwUT.exe
  C:\Windows\System\HtkcwUT.exe
  2⤵
  PID:312
- C:\Windows\System\aPUMmUM.exe
  C:\Windows\System\aPUMmUM.exe
  2⤵
  PID:1748
- C:\Windows\System\fnHfVRY.exe
  C:\Windows\System\fnHfVRY.exe
  2⤵
  PID:3272
- C:\Windows\System\dprdcYz.exe
  C:\Windows\System\dprdcYz.exe
  2⤵
  PID:3216
- C:\Windows\System\OLfVGhL.exe
  C:\Windows\System\OLfVGhL.exe
  2⤵
  PID:3180
- C:\Windows\System\hkmkNSg.exe
  C:\Windows\System\hkmkNSg.exe
  2⤵
  PID:3408
- C:\Windows\System\EeWzBfS.exe
  C:\Windows\System\EeWzBfS.exe
  2⤵
  PID:3604
- C:\Windows\System\vMOWdgV.exe
  C:\Windows\System\vMOWdgV.exe
  2⤵
  PID:3676
- C:\Windows\System\cIpifzb.exe
  C:\Windows\System\cIpifzb.exe
  2⤵
  PID:3868
- C:\Windows\System\xxqXSvY.exe
  C:\Windows\System\xxqXSvY.exe
  2⤵
  PID:3852
- C:\Windows\System\sXhCbAd.exe
  C:\Windows\System\sXhCbAd.exe
  2⤵
  PID:3796
- C:\Windows\System\nWFFrrt.exe
  C:\Windows\System\nWFFrrt.exe
  2⤵
  PID:2812
- C:\Windows\System\VCQGSLF.exe
  C:\Windows\System\VCQGSLF.exe
  2⤵
  PID:3148
- C:\Windows\System\lVCwuGQ.exe
  C:\Windows\System\lVCwuGQ.exe
  2⤵
  PID:3108
- C:\Windows\System\MXWgOpz.exe
  C:\Windows\System\MXWgOpz.exe
  2⤵
  PID:3168
- C:\Windows\System\kejDZDf.exe
  C:\Windows\System\kejDZDf.exe
  2⤵
  PID:3388
- C:\Windows\System\gkBTgbk.exe
  C:\Windows\System\gkBTgbk.exe
  2⤵
  PID:3536
- C:\Windows\System\agYcLLx.exe
  C:\Windows\System\agYcLLx.exe
  2⤵
  PID:3628
- C:\Windows\System\erecncD.exe
  C:\Windows\System\erecncD.exe
  2⤵
  PID:3836
- C:\Windows\System\aqdmDIJ.exe
  C:\Windows\System\aqdmDIJ.exe
  2⤵
  PID:2840
- C:\Windows\System\NIBnQus.exe
  C:\Windows\System\NIBnQus.exe
  2⤵
  PID:3972
- C:\Windows\System\OSfeMcC.exe
  C:\Windows\System\OSfeMcC.exe
  2⤵
  PID:4056
- C:\Windows\System\SavBhgS.exe
  C:\Windows\System\SavBhgS.exe
  2⤵
  PID:3112
- C:\Windows\System\QtOfTHq.exe
  C:\Windows\System\QtOfTHq.exe
  2⤵
  PID:1040
- C:\Windows\System\ElPvIvY.exe
  C:\Windows\System\ElPvIvY.exe
  2⤵
  PID:1860
- C:\Windows\System\nIYiWtp.exe
  C:\Windows\System\nIYiWtp.exe
  2⤵
  PID:3204
- C:\Windows\System\YRoOUWb.exe
  C:\Windows\System\YRoOUWb.exe
  2⤵
  PID:3392
- C:\Windows\System\pSUECBv.exe
  C:\Windows\System\pSUECBv.exe
  2⤵
  PID:3640
- C:\Windows\System\MSRlEKc.exe
  C:\Windows\System\MSRlEKc.exe
  2⤵
  PID:3884
- C:\Windows\System\rcRwMDD.exe
  C:\Windows\System\rcRwMDD.exe
  2⤵
  PID:3748
- C:\Windows\System\peaGHED.exe
  C:\Windows\System\peaGHED.exe
  2⤵
  PID:4052
- C:\Windows\System\FaLpyne.exe
  C:\Windows\System\FaLpyne.exe
  2⤵
  PID:3764
- C:\Windows\System\XViIcWh.exe
  C:\Windows\System\XViIcWh.exe
  2⤵
  PID:3816
- C:\Windows\System\hNusKpt.exe
  C:\Windows\System\hNusKpt.exe
  2⤵
  PID:4104
- C:\Windows\System\GpaADaZ.exe
  C:\Windows\System\GpaADaZ.exe
  2⤵
  PID:4124
- C:\Windows\System\cXhXDgQ.exe
  C:\Windows\System\cXhXDgQ.exe
  2⤵
  PID:4144
- C:\Windows\System\NxGXTGi.exe
  C:\Windows\System\NxGXTGi.exe
  2⤵
  PID:4160
- C:\Windows\System\NUvvXEb.exe
  C:\Windows\System\NUvvXEb.exe
  2⤵
  PID:4180
- C:\Windows\System\fGHsOzm.exe
  C:\Windows\System\fGHsOzm.exe
  2⤵
  PID:4196
- C:\Windows\System\JBHkLLC.exe
  C:\Windows\System\JBHkLLC.exe
  2⤵
  PID:4216
- C:\Windows\System\JOOxFTl.exe
  C:\Windows\System\JOOxFTl.exe
  2⤵
  PID:4240
- C:\Windows\System\onLobyM.exe
  C:\Windows\System\onLobyM.exe
  2⤵
  PID:4272
- C:\Windows\System\hTOZDFe.exe
  C:\Windows\System\hTOZDFe.exe
  2⤵
  PID:4296
- C:\Windows\System\avNBFJb.exe
  C:\Windows\System\avNBFJb.exe
  2⤵
  PID:4312
- C:\Windows\System\pczKzGy.exe
  C:\Windows\System\pczKzGy.exe
  2⤵
  PID:4328
- C:\Windows\System\PGKKulj.exe
  C:\Windows\System\PGKKulj.exe
  2⤵
  PID:4344
- C:\Windows\System\aDvdBtJ.exe
  C:\Windows\System\aDvdBtJ.exe
  2⤵
  PID:4360
- C:\Windows\System\noeHJmf.exe
  C:\Windows\System\noeHJmf.exe
  2⤵
  PID:4376
- C:\Windows\System\lBTxtmZ.exe
  C:\Windows\System\lBTxtmZ.exe
  2⤵
  PID:4392
- C:\Windows\System\akBogtT.exe
  C:\Windows\System\akBogtT.exe
  2⤵
  PID:4412
- C:\Windows\System\gbDzAZt.exe
  C:\Windows\System\gbDzAZt.exe
  2⤵
  PID:4428
- C:\Windows\System\CaOtDGm.exe
  C:\Windows\System\CaOtDGm.exe
  2⤵
  PID:4444
- C:\Windows\System\MKmHbWH.exe
  C:\Windows\System\MKmHbWH.exe
  2⤵
  PID:4460
- C:\Windows\System\YwGEAUZ.exe
  C:\Windows\System\YwGEAUZ.exe
  2⤵
  PID:4480
- C:\Windows\System\bVRnexR.exe
  C:\Windows\System\bVRnexR.exe
  2⤵
  PID:4500
- C:\Windows\System\BMmEFCk.exe
  C:\Windows\System\BMmEFCk.exe
  2⤵
  PID:4564
- C:\Windows\System\KKLOTgQ.exe
  C:\Windows\System\KKLOTgQ.exe
  2⤵
  PID:4580
- C:\Windows\System\TaktUGW.exe
  C:\Windows\System\TaktUGW.exe
  2⤵
  PID:4596
- C:\Windows\System\iuWoJLO.exe
  C:\Windows\System\iuWoJLO.exe
  2⤵
  PID:4612
- C:\Windows\System\jdtGnRU.exe
  C:\Windows\System\jdtGnRU.exe
  2⤵
  PID:4628
- C:\Windows\System\WoPsnfO.exe
  C:\Windows\System\WoPsnfO.exe
  2⤵
  PID:4664
- C:\Windows\System\NAAdwIo.exe
  C:\Windows\System\NAAdwIo.exe
  2⤵
  PID:4680
- C:\Windows\System\CmjzyFF.exe
  C:\Windows\System\CmjzyFF.exe
  2⤵
  PID:4700
- C:\Windows\System\kYhWWAn.exe
  C:\Windows\System\kYhWWAn.exe
  2⤵
  PID:4772
- C:\Windows\System\rrLTptv.exe
  C:\Windows\System\rrLTptv.exe
  2⤵
  PID:4796
- C:\Windows\System\EeUdWTn.exe
  C:\Windows\System\EeUdWTn.exe
  2⤵
  PID:4816
- C:\Windows\System\DuyZQLF.exe
  C:\Windows\System\DuyZQLF.exe
  2⤵
  PID:4836
- C:\Windows\System\RJtoJob.exe
  C:\Windows\System\RJtoJob.exe
  2⤵
  PID:4868
- C:\Windows\System\jwgtJDc.exe
  C:\Windows\System\jwgtJDc.exe
  2⤵
  PID:4888
- C:\Windows\System\sMuDMck.exe
  C:\Windows\System\sMuDMck.exe
  2⤵
  PID:4908
- C:\Windows\System\RgACbvN.exe
  C:\Windows\System\RgACbvN.exe
  2⤵
  PID:4924
- C:\Windows\System\vybwiHu.exe
  C:\Windows\System\vybwiHu.exe
  2⤵
  PID:4944
- C:\Windows\System\joByfSS.exe
  C:\Windows\System\joByfSS.exe
  2⤵
  PID:4960
- C:\Windows\System\KfYkFBQ.exe
  C:\Windows\System\KfYkFBQ.exe
  2⤵
  PID:4984
- C:\Windows\System\AJhRuPV.exe
  C:\Windows\System\AJhRuPV.exe
  2⤵
  PID:5008
- C:\Windows\System\AycpiPo.exe
  C:\Windows\System\AycpiPo.exe
  2⤵
  PID:5024
- C:\Windows\System\TnPiDkp.exe
  C:\Windows\System\TnPiDkp.exe
  2⤵
  PID:5044
- C:\Windows\System\HeHthVA.exe
  C:\Windows\System\HeHthVA.exe
  2⤵
  PID:5060
- C:\Windows\System\sZTDgHs.exe
  C:\Windows\System\sZTDgHs.exe
  2⤵
  PID:5080
- C:\Windows\System\PmMDeQT.exe
  C:\Windows\System\PmMDeQT.exe
  2⤵
  PID:5100
- C:\Windows\System\sJAttHU.exe
  C:\Windows\System\sJAttHU.exe
  2⤵
  PID:3096
- C:\Windows\System\RxboXDs.exe
  C:\Windows\System\RxboXDs.exe
  2⤵
  PID:4116
- C:\Windows\System\tasEBMS.exe
  C:\Windows\System\tasEBMS.exe
  2⤵
  PID:4156
- C:\Windows\System\hcGFAFE.exe
  C:\Windows\System\hcGFAFE.exe
  2⤵
  PID:4224
- C:\Windows\System\oTkGDLL.exe
  C:\Windows\System\oTkGDLL.exe
  2⤵
  PID:4204
- C:\Windows\System\zkVqWzE.exe
  C:\Windows\System\zkVqWzE.exe
  2⤵
  PID:4248
- C:\Windows\System\jstEJZi.exe
  C:\Windows\System\jstEJZi.exe
  2⤵
  PID:2800
- C:\Windows\System\MZnNuCz.exe
  C:\Windows\System\MZnNuCz.exe
  2⤵
  PID:4280
- C:\Windows\System\uUxhofW.exe
  C:\Windows\System\uUxhofW.exe
  2⤵
  PID:4320
- C:\Windows\System\szINAiY.exe
  C:\Windows\System\szINAiY.exe
  2⤵
  PID:4384
- C:\Windows\System\cYUkrYv.exe
  C:\Windows\System\cYUkrYv.exe
  2⤵
  PID:4340
- C:\Windows\System\zUzNGOe.exe
  C:\Windows\System\zUzNGOe.exe
  2⤵
  PID:4404
- C:\Windows\System\YcoDntd.exe
  C:\Windows\System\YcoDntd.exe
  2⤵
  PID:4476
- C:\Windows\System\CPeNMzn.exe
  C:\Windows\System\CPeNMzn.exe
  2⤵
  PID:4452
- C:\Windows\System\iTnfvYR.exe
  C:\Windows\System\iTnfvYR.exe
  2⤵
  PID:4524
- C:\Windows\System\WRZmtcr.exe
  C:\Windows\System\WRZmtcr.exe
  2⤵
  PID:4576
- C:\Windows\System\chVewXW.exe
  C:\Windows\System\chVewXW.exe
  2⤵
  PID:4608
- C:\Windows\System\gOFaYfB.exe
  C:\Windows\System\gOFaYfB.exe
  2⤵
  PID:4644
- C:\Windows\System\KeULAJi.exe
  C:\Windows\System\KeULAJi.exe
  2⤵
  PID:2216
- C:\Windows\System\YcyAmIA.exe
  C:\Windows\System\YcyAmIA.exe
  2⤵
  PID:4556
- C:\Windows\System\IeFzjgV.exe
  C:\Windows\System\IeFzjgV.exe
  2⤵
  PID:4696
- C:\Windows\System\qaMaNlM.exe
  C:\Windows\System\qaMaNlM.exe
  2⤵
  PID:4732
- C:\Windows\System\qYnTFDg.exe
  C:\Windows\System\qYnTFDg.exe
  2⤵
  PID:4752
- C:\Windows\System\YLePqLO.exe
  C:\Windows\System\YLePqLO.exe
  2⤵
  PID:4744
- C:\Windows\System\UaMSqfE.exe
  C:\Windows\System\UaMSqfE.exe
  2⤵
  PID:4784
- C:\Windows\System\YNvwTQL.exe
  C:\Windows\System\YNvwTQL.exe
  2⤵
  PID:4808
- C:\Windows\System\GLyMFMn.exe
  C:\Windows\System\GLyMFMn.exe
  2⤵
  PID:4860
- C:\Windows\System\SbBBzdR.exe
  C:\Windows\System\SbBBzdR.exe
  2⤵
  PID:4940
- C:\Windows\System\wvVpqBO.exe
  C:\Windows\System\wvVpqBO.exe
  2⤵
  PID:4952
- C:\Windows\System\VAhAyyi.exe
  C:\Windows\System\VAhAyyi.exe
  2⤵
  PID:5000
- C:\Windows\System\qGSNduy.exe
  C:\Windows\System\qGSNduy.exe
  2⤵
  PID:5020
- C:\Windows\System\nmXCxmo.exe
  C:\Windows\System\nmXCxmo.exe
  2⤵
  PID:5056
- C:\Windows\System\iJGKNJu.exe
  C:\Windows\System\iJGKNJu.exe
  2⤵
  PID:5096
- C:\Windows\System\ljuPBzS.exe
  C:\Windows\System\ljuPBzS.exe
  2⤵
  PID:2700
- C:\Windows\System\vWLYYWn.exe
  C:\Windows\System\vWLYYWn.exe
  2⤵
  PID:4140
- C:\Windows\System\iFpyGih.exe
  C:\Windows\System\iFpyGih.exe
  2⤵
  PID:4172
- C:\Windows\System\SsnKpHA.exe
  C:\Windows\System\SsnKpHA.exe
  2⤵
  PID:4260
- C:\Windows\System\jIfHJSA.exe
  C:\Windows\System\jIfHJSA.exe
  2⤵
  PID:4232
- C:\Windows\System\HyIfOTb.exe
  C:\Windows\System\HyIfOTb.exe
  2⤵
  PID:4496
- C:\Windows\System\xjJvhzg.exe
  C:\Windows\System\xjJvhzg.exe
  2⤵
  PID:4192
- C:\Windows\System\HloxwqR.exe
  C:\Windows\System\HloxwqR.exe
  2⤵
  PID:4264
- C:\Windows\System\aIpECAD.exe
  C:\Windows\System\aIpECAD.exe
  2⤵
  PID:4548
- C:\Windows\System\LfuBzFz.exe
  C:\Windows\System\LfuBzFz.exe
  2⤵
  PID:4492
- C:\Windows\System\vXJmHep.exe
  C:\Windows\System\vXJmHep.exe
  2⤵
  PID:4572
- C:\Windows\System\PWxYkgo.exe
  C:\Windows\System\PWxYkgo.exe
  2⤵
  PID:4640
- C:\Windows\System\rfnzhUn.exe
  C:\Windows\System\rfnzhUn.exe
  2⤵
  PID:4688
- C:\Windows\System\YiIiUXP.exe
  C:\Windows\System\YiIiUXP.exe
  2⤵
  PID:4760
- C:\Windows\System\udgOEtO.exe
  C:\Windows\System\udgOEtO.exe
  2⤵
  PID:4624
- C:\Windows\System\jljcANu.exe
  C:\Windows\System\jljcANu.exe
  2⤵
  PID:4716
- C:\Windows\System\JsSBKIs.exe
  C:\Windows\System\JsSBKIs.exe
  2⤵
  PID:4660
- C:\Windows\System\bjySasQ.exe
  C:\Windows\System\bjySasQ.exe
  2⤵
  PID:4844
- C:\Windows\System\GotHFiY.exe
  C:\Windows\System\GotHFiY.exe
  2⤵
  PID:4876
- C:\Windows\System\ZJFlAux.exe
  C:\Windows\System\ZJFlAux.exe
  2⤵
  PID:4916
- C:\Windows\System\mcXdNpH.exe
  C:\Windows\System\mcXdNpH.exe
  2⤵
  PID:4996
- C:\Windows\System\jSoECAW.exe
  C:\Windows\System\jSoECAW.exe
  2⤵
  PID:5032
- C:\Windows\System\SNsNVdN.exe
  C:\Windows\System\SNsNVdN.exe
  2⤵
  PID:5004
- C:\Windows\System\JcSFmjR.exe
  C:\Windows\System\JcSFmjR.exe
  2⤵
  PID:4112
- C:\Windows\System\qVFZsUh.exe
  C:\Windows\System\qVFZsUh.exe
  2⤵
  PID:5116
- C:\Windows\System\rdOvjuY.exe
  C:\Windows\System\rdOvjuY.exe
  2⤵
  PID:4440
- C:\Windows\System\PJlFYvo.exe
  C:\Windows\System\PJlFYvo.exe
  2⤵
  PID:4468
- C:\Windows\System\PbILUJy.exe
  C:\Windows\System\PbILUJy.exe
  2⤵
  PID:4456
- C:\Windows\System\tRdQpYK.exe
  C:\Windows\System\tRdQpYK.exe
  2⤵
  PID:5216
- C:\Windows\System\luixWON.exe
  C:\Windows\System\luixWON.exe
  2⤵
  PID:5236
- C:\Windows\System\loyxpXR.exe
  C:\Windows\System\loyxpXR.exe
  2⤵
  PID:5252
- C:\Windows\System\HYOtRNX.exe
  C:\Windows\System\HYOtRNX.exe
  2⤵
  PID:5268
- C:\Windows\System\YhQRvDD.exe
  C:\Windows\System\YhQRvDD.exe
  2⤵
  PID:5284
- C:\Windows\System\gzCKWjM.exe
  C:\Windows\System\gzCKWjM.exe
  2⤵
  PID:5300
- C:\Windows\System\qhhgBvj.exe
  C:\Windows\System\qhhgBvj.exe
  2⤵
  PID:5320
- C:\Windows\System\VYqlxlb.exe
  C:\Windows\System\VYqlxlb.exe
  2⤵
  PID:5336
- C:\Windows\System\nGmgdII.exe
  C:\Windows\System\nGmgdII.exe
  2⤵
  PID:5356
- C:\Windows\System\hZVcMjO.exe
  C:\Windows\System\hZVcMjO.exe
  2⤵
  PID:5372
- C:\Windows\System\AJsSmgP.exe
  C:\Windows\System\AJsSmgP.exe
  2⤵
  PID:5392
- C:\Windows\System\XsYKamv.exe
  C:\Windows\System\XsYKamv.exe
  2⤵
  PID:5408
- C:\Windows\System\FtzdykL.exe
  C:\Windows\System\FtzdykL.exe
  2⤵
  PID:5424
- C:\Windows\System\PbEFYZF.exe
  C:\Windows\System\PbEFYZF.exe
  2⤵
  PID:5440
- C:\Windows\System\uGjyRQG.exe
  C:\Windows\System\uGjyRQG.exe
  2⤵
  PID:5456
- C:\Windows\System\eQeqBpr.exe
  C:\Windows\System\eQeqBpr.exe
  2⤵
  PID:5476
- C:\Windows\System\sHgnCxm.exe
  C:\Windows\System\sHgnCxm.exe
  2⤵
  PID:5492
- C:\Windows\System\EwLUnmf.exe
  C:\Windows\System\EwLUnmf.exe
  2⤵
  PID:5512
- C:\Windows\System\KQcUCIL.exe
  C:\Windows\System\KQcUCIL.exe
  2⤵
  PID:5528
- C:\Windows\System\uqhiRqT.exe
  C:\Windows\System\uqhiRqT.exe
  2⤵
  PID:5548
- C:\Windows\System\GiLVpyC.exe
  C:\Windows\System\GiLVpyC.exe
  2⤵
  PID:5568
- C:\Windows\System\mbydWYt.exe
  C:\Windows\System\mbydWYt.exe
  2⤵
  PID:5584
- C:\Windows\System\vZVZkYp.exe
  C:\Windows\System\vZVZkYp.exe
  2⤵
  PID:5612
- C:\Windows\System\uSvLmoR.exe
  C:\Windows\System\uSvLmoR.exe
  2⤵
  PID:5628
- C:\Windows\System\uNxGcaY.exe
  C:\Windows\System\uNxGcaY.exe
  2⤵
  PID:5648
- C:\Windows\System\HyxibZz.exe
  C:\Windows\System\HyxibZz.exe
  2⤵
  PID:5744
- C:\Windows\System\jzRFOHx.exe
  C:\Windows\System\jzRFOHx.exe
  2⤵
  PID:5760
- C:\Windows\System\uPXKGat.exe
  C:\Windows\System\uPXKGat.exe
  2⤵
  PID:5776
- C:\Windows\System\autpZof.exe
  C:\Windows\System\autpZof.exe
  2⤵
  PID:5796
- C:\Windows\System\LBIxASX.exe
  C:\Windows\System\LBIxASX.exe
  2⤵
  PID:5820
- C:\Windows\System\YlwFNmj.exe
  C:\Windows\System\YlwFNmj.exe
  2⤵
  PID:5872
- C:\Windows\System\FJWbEZs.exe
  C:\Windows\System\FJWbEZs.exe
  2⤵
  PID:5892
- C:\Windows\System\igFRrOz.exe
  C:\Windows\System\igFRrOz.exe
  2⤵
  PID:5940
- C:\Windows\System\gddCwXY.exe
  C:\Windows\System\gddCwXY.exe
  2⤵
  PID:5956
- C:\Windows\System\PCBMSxz.exe
  C:\Windows\System\PCBMSxz.exe
  2⤵
  PID:5972
- C:\Windows\System\DShZPzC.exe
  C:\Windows\System\DShZPzC.exe
  2⤵
  PID:5988
- C:\Windows\System\mZWOfuO.exe
  C:\Windows\System\mZWOfuO.exe
  2⤵
  PID:6004
- C:\Windows\System\CLUztyh.exe
  C:\Windows\System\CLUztyh.exe
  2⤵
  PID:6028
- C:\Windows\System\rkbvMOh.exe
  C:\Windows\System\rkbvMOh.exe
  2⤵
  PID:6044
- C:\Windows\System\GJmNrWb.exe
  C:\Windows\System\GJmNrWb.exe
  2⤵
  PID:6060
- C:\Windows\System\FKGgXXm.exe
  C:\Windows\System\FKGgXXm.exe
  2⤵
  PID:6080
- C:\Windows\System\FTCbJJK.exe
  C:\Windows\System\FTCbJJK.exe
  2⤵
  PID:6096
- C:\Windows\System\NEwoeWs.exe
  C:\Windows\System\NEwoeWs.exe
  2⤵
  PID:6116
- C:\Windows\System\ZdxDiHm.exe
  C:\Windows\System\ZdxDiHm.exe
  2⤵
  PID:6136
- C:\Windows\System\KSxggCt.exe
  C:\Windows\System\KSxggCt.exe
  2⤵
  PID:4728
- C:\Windows\System\staBneX.exe
  C:\Windows\System\staBneX.exe
  2⤵
  PID:4208
- C:\Windows\System\yYjTSws.exe
  C:\Windows\System\yYjTSws.exe
  2⤵
  PID:4724
- C:\Windows\System\pQDRcDP.exe
  C:\Windows\System\pQDRcDP.exe
  2⤵
  PID:4544
- C:\Windows\System\KMfGbAJ.exe
  C:\Windows\System\KMfGbAJ.exe
  2⤵
  PID:4848
- C:\Windows\System\fkzhZvx.exe
  C:\Windows\System\fkzhZvx.exe
  2⤵
  PID:5088
- C:\Windows\System\gbDcIps.exe
  C:\Windows\System\gbDcIps.exe
  2⤵
  PID:5128
- C:\Windows\System\iIMUsDY.exe
  C:\Windows\System\iIMUsDY.exe
  2⤵
  PID:4372
- C:\Windows\System\nynmtlB.exe
  C:\Windows\System\nynmtlB.exe
  2⤵
  PID:4652
- C:\Windows\System\zFToswP.exe
  C:\Windows\System\zFToswP.exe
  2⤵
  PID:4972
- C:\Windows\System\hnEaiJJ.exe
  C:\Windows\System\hnEaiJJ.exe
  2⤵
  PID:5148
- C:\Windows\System\KlQBjiE.exe
  C:\Windows\System\KlQBjiE.exe
  2⤵
  PID:5232
- C:\Windows\System\gRgtbZI.exe
  C:\Windows\System\gRgtbZI.exe
  2⤵
  PID:5292
- C:\Windows\System\DLELEmL.exe
  C:\Windows\System\DLELEmL.exe
  2⤵
  PID:5364
- C:\Windows\System\EVpMufn.exe
  C:\Windows\System\EVpMufn.exe
  2⤵
  PID:5432
- C:\Windows\System\zyriqop.exe
  C:\Windows\System\zyriqop.exe
  2⤵
  PID:5468
- C:\Windows\System\rBsSawj.exe
  C:\Windows\System\rBsSawj.exe
  2⤵
  PID:5540
- C:\Windows\System\yZfzxkN.exe
  C:\Windows\System\yZfzxkN.exe
  2⤵
  PID:5192
- C:\Windows\System\ofpNqJd.exe
  C:\Windows\System\ofpNqJd.exe
  2⤵
  PID:5156
- C:\Windows\System\FPoLoEs.exe
  C:\Windows\System\FPoLoEs.exe
  2⤵
  PID:5276
- C:\Windows\System\aNbVvJa.exe
  C:\Windows\System\aNbVvJa.exe
  2⤵
  PID:5352
- C:\Windows\System\QmIIzaz.exe
  C:\Windows\System\QmIIzaz.exe
  2⤵
  PID:5448
- C:\Windows\System\uiImVey.exe
  C:\Windows\System\uiImVey.exe
  2⤵
  PID:5564
- C:\Windows\System\uIWnKHY.exe
  C:\Windows\System\uIWnKHY.exe
  2⤵
  PID:5660
- C:\Windows\System\mpzSKJT.exe
  C:\Windows\System\mpzSKJT.exe
  2⤵
  PID:5204
- C:\Windows\System\XcxSAxZ.exe
  C:\Windows\System\XcxSAxZ.exe
  2⤵
  PID:5344
- C:\Windows\System\pZGnpuI.exe
  C:\Windows\System\pZGnpuI.exe
  2⤵
  PID:5644
- C:\Windows\System\cRnXDtj.exe
  C:\Windows\System\cRnXDtj.exe
  2⤵
  PID:5704
- C:\Windows\System\zGdQapY.exe
  C:\Windows\System\zGdQapY.exe
  2⤵
  PID:5708
- C:\Windows\System\pFEEwKj.exe
  C:\Windows\System\pFEEwKj.exe
  2⤵
  PID:5768
- C:\Windows\System\PmaMwtW.exe
  C:\Windows\System\PmaMwtW.exe
  2⤵
  PID:5756
- C:\Windows\System\IVTwRQG.exe
  C:\Windows\System\IVTwRQG.exe
  2⤵
  PID:5784
- C:\Windows\System\JTwFPPb.exe
  C:\Windows\System\JTwFPPb.exe
  2⤵
  PID:5840
- C:\Windows\System\BAswnay.exe
  C:\Windows\System\BAswnay.exe
  2⤵
  PID:5844
- C:\Windows\System\rLjbwnP.exe
  C:\Windows\System\rLjbwnP.exe
  2⤵
  PID:4852
- C:\Windows\System\NvnNwiG.exe
  C:\Windows\System\NvnNwiG.exe
  2⤵
  PID:5880
- C:\Windows\System\XYicVGX.exe
  C:\Windows\System\XYicVGX.exe
  2⤵
  PID:5912
- C:\Windows\System\EIZJqIi.exe
  C:\Windows\System\EIZJqIi.exe
  2⤵
  PID:5672
- C:\Windows\System\JtchhQu.exe
  C:\Windows\System\JtchhQu.exe
  2⤵
  PID:5980
- C:\Windows\System\yoeVFte.exe
  C:\Windows\System\yoeVFte.exe
  2⤵
  PID:6016
- C:\Windows\System\cFTsuGz.exe
  C:\Windows\System\cFTsuGz.exe
  2⤵
  PID:6056
- C:\Windows\System\tZRURue.exe
  C:\Windows\System\tZRURue.exe
  2⤵
  PID:6128
- C:\Windows\System\CFPmClS.exe
  C:\Windows\System\CFPmClS.exe
  2⤵
  PID:6068
- C:\Windows\System\pyXHIcd.exe
  C:\Windows\System\pyXHIcd.exe
  2⤵
  PID:4424
- C:\Windows\System\uZSJCCz.exe
  C:\Windows\System\uZSJCCz.exe
  2⤵
  PID:4748
- C:\Windows\System\aHNNdXa.exe
  C:\Windows\System\aHNNdXa.exe
  2⤵
  PID:5144
- C:\Windows\System\FLppnRm.exe
  C:\Windows\System\FLppnRm.exe
  2⤵
  PID:5328
- C:\Windows\System\YGicKMd.exe
  C:\Windows\System\YGicKMd.exe
  2⤵
  PID:5464
- C:\Windows\System\yuSagMn.exe
  C:\Windows\System\yuSagMn.exe
  2⤵
  PID:6108
- C:\Windows\System\nIRMJXu.exe
  C:\Windows\System\nIRMJXu.exe
  2⤵
  PID:5248
- C:\Windows\System\vmlMfgi.exe
  C:\Windows\System\vmlMfgi.exe
  2⤵
  PID:5624
- C:\Windows\System\EONCLHC.exe
  C:\Windows\System\EONCLHC.exe
  2⤵
  PID:5168
- C:\Windows\System\bIhndRf.exe
  C:\Windows\System\bIhndRf.exe
  2⤵
  PID:4512
- C:\Windows\System\sziQAGi.exe
  C:\Windows\System\sziQAGi.exe
  2⤵
  PID:4592
- C:\Windows\System\LbwXBTW.exe
  C:\Windows\System\LbwXBTW.exe
  2⤵
  PID:5608
- C:\Windows\System\MYNWbQN.exe
  C:\Windows\System\MYNWbQN.exe
  2⤵
  PID:5716
- C:\Windows\System\cSFFQfq.exe
  C:\Windows\System\cSFFQfq.exe
  2⤵
  PID:6052
- C:\Windows\System\YBlEMil.exe
  C:\Windows\System\YBlEMil.exe
  2⤵
  PID:5948
- C:\Windows\System\LpkkCMi.exe
  C:\Windows\System\LpkkCMi.exe
  2⤵
  PID:5836
- C:\Windows\System\jpEAkOF.exe
  C:\Windows\System\jpEAkOF.exe
  2⤵
  PID:5728
- C:\Windows\System\vYQEWvq.exe
  C:\Windows\System\vYQEWvq.exe
  2⤵
  PID:5604
- C:\Windows\System\gKeagFh.exe
  C:\Windows\System\gKeagFh.exe
  2⤵
  PID:5524
- C:\Windows\System\UqYMZxG.exe
  C:\Windows\System\UqYMZxG.exe
  2⤵
  PID:5316
- C:\Windows\System\ubOGzPw.exe
  C:\Windows\System\ubOGzPw.exe
  2⤵
  PID:5488
- C:\Windows\System\ozUYNCn.exe
  C:\Windows\System\ozUYNCn.exe
  2⤵
  PID:5400
- C:\Windows\System\MofCEKB.exe
  C:\Windows\System\MofCEKB.exe
  2⤵
  PID:5264
- C:\Windows\System\VBUEQsb.exe
  C:\Windows\System\VBUEQsb.exe
  2⤵
  PID:1664
- C:\Windows\System\hxGqMbC.exe
  C:\Windows\System\hxGqMbC.exe
  2⤵
  PID:5688
- C:\Windows\System\YpgYfXx.exe
  C:\Windows\System\YpgYfXx.exe
  2⤵
  PID:5916
- C:\Windows\System\cONQqBd.exe
  C:\Windows\System\cONQqBd.exe
  2⤵
  PID:6124
- C:\Windows\System\JWLQhUg.exe
  C:\Windows\System\JWLQhUg.exe
  2⤵
  PID:5380
- C:\Windows\System\UBhxWqw.exe
  C:\Windows\System\UBhxWqw.exe
  2⤵
  PID:4672
- C:\Windows\System\SnTvsMO.exe
  C:\Windows\System\SnTvsMO.exe
  2⤵
  PID:5416
- C:\Windows\System\ecYxpQL.exe
  C:\Windows\System\ecYxpQL.exe
  2⤵
  PID:5068
- C:\Windows\System\ywdOxVy.exe
  C:\Windows\System\ywdOxVy.exe
  2⤵
  PID:5576
- C:\Windows\System\DIJdabC.exe
  C:\Windows\System\DIJdabC.exe
  2⤵
  PID:5308
- C:\Windows\System\yEiLDMo.exe
  C:\Windows\System\yEiLDMo.exe
  2⤵
  PID:6112
- C:\Windows\System\EshyWJY.exe
  C:\Windows\System\EshyWJY.exe
  2⤵
  PID:4804
- C:\Windows\System\CyPlZPQ.exe
  C:\Windows\System\CyPlZPQ.exe
  2⤵
  PID:5952
- C:\Windows\System\RtVtPvJ.exe
  C:\Windows\System\RtVtPvJ.exe
  2⤵
  PID:5732
- C:\Windows\System\JhSnddi.exe
  C:\Windows\System\JhSnddi.exe
  2⤵
  PID:5208
- C:\Windows\System\IqpKFNt.exe
  C:\Windows\System\IqpKFNt.exe
  2⤵
  PID:5860
- C:\Windows\System\GssskQW.exe
  C:\Windows\System\GssskQW.exe
  2⤵
  PID:5640
- C:\Windows\System\AyvkwUe.exe
  C:\Windows\System\AyvkwUe.exe
  2⤵
  PID:5500
- C:\Windows\System\rGxtGmx.exe
  C:\Windows\System\rGxtGmx.exe
  2⤵
  PID:5596
- C:\Windows\System\YKQgRId.exe
  C:\Windows\System\YKQgRId.exe
  2⤵
  PID:5848
- C:\Windows\System\MqTkbQW.exe
  C:\Windows\System\MqTkbQW.exe
  2⤵
  PID:5676
- C:\Windows\System\hcSrAUo.exe
  C:\Windows\System\hcSrAUo.exe
  2⤵
  PID:4252
- C:\Windows\System\VftOBIk.exe
  C:\Windows\System\VftOBIk.exe
  2⤵
  PID:4980
- C:\Windows\System\xeUlICV.exe
  C:\Windows\System\xeUlICV.exe
  2⤵
  PID:5680
- C:\Windows\System\ZgSCMCc.exe
  C:\Windows\System\ZgSCMCc.exe
  2⤵
  PID:5384
- C:\Windows\System\UpCjgFk.exe
  C:\Windows\System\UpCjgFk.exe
  2⤵
  PID:5052
- C:\Windows\System\LPoXsZp.exe
  C:\Windows\System\LPoXsZp.exe
  2⤵
  PID:5636
- C:\Windows\System\nwVHGmJ.exe
  C:\Windows\System\nwVHGmJ.exe
  2⤵
  PID:6092
- C:\Windows\System\eoYhUZT.exe
  C:\Windows\System\eoYhUZT.exe
  2⤵
  PID:4920
- C:\Windows\System\JfLcCCY.exe
  C:\Windows\System\JfLcCCY.exe
  2⤵
  PID:5184
- C:\Windows\System\CfwCEvg.exe
  C:\Windows\System\CfwCEvg.exe
  2⤵
  PID:5504
- C:\Windows\System\clygfee.exe
  C:\Windows\System\clygfee.exe
  2⤵
  PID:5580
- C:\Windows\System\RONgyDw.exe
  C:\Windows\System\RONgyDw.exe
  2⤵
  PID:6040
- C:\Windows\System\tJuPWZF.exe
  C:\Windows\System\tJuPWZF.exe
  2⤵
  PID:6156
- C:\Windows\System\UuFjGzn.exe
  C:\Windows\System\UuFjGzn.exe
  2⤵
  PID:6176
- C:\Windows\System\SXqKBwC.exe
  C:\Windows\System\SXqKBwC.exe
  2⤵
  PID:6192
- C:\Windows\System\MXIEVbU.exe
  C:\Windows\System\MXIEVbU.exe
  2⤵
  PID:6208
- C:\Windows\System\jbfZCin.exe
  C:\Windows\System\jbfZCin.exe
  2⤵
  PID:6228
- C:\Windows\System\Ffynjrx.exe
  C:\Windows\System\Ffynjrx.exe
  2⤵
  PID:6244
- C:\Windows\System\wFhqTSG.exe
  C:\Windows\System\wFhqTSG.exe
  2⤵
  PID:6260
- C:\Windows\System\AkUkIER.exe
  C:\Windows\System\AkUkIER.exe
  2⤵
  PID:6280
- C:\Windows\System\NcOrnyb.exe
  C:\Windows\System\NcOrnyb.exe
  2⤵
  PID:6300
- C:\Windows\System\hGkulgg.exe
  C:\Windows\System\hGkulgg.exe
  2⤵
  PID:6316
- C:\Windows\System\CSkzDTC.exe
  C:\Windows\System\CSkzDTC.exe
  2⤵
  PID:6332
- C:\Windows\System\rFBzaXi.exe
  C:\Windows\System\rFBzaXi.exe
  2⤵
  PID:6348
- C:\Windows\System\OlygNpg.exe
  C:\Windows\System\OlygNpg.exe
  2⤵
  PID:6376
- C:\Windows\System\QmJAiqM.exe
  C:\Windows\System\QmJAiqM.exe
  2⤵
  PID:6392
- C:\Windows\System\YEoJAoj.exe
  C:\Windows\System\YEoJAoj.exe
  2⤵
  PID:6408
- C:\Windows\System\QHptdoN.exe
  C:\Windows\System\QHptdoN.exe
  2⤵
  PID:6424
- C:\Windows\System\EentpJA.exe
  C:\Windows\System\EentpJA.exe
  2⤵
  PID:6448
- C:\Windows\System\cdebGQV.exe
  C:\Windows\System\cdebGQV.exe
  2⤵
  PID:6468
- C:\Windows\System\xsWBmyJ.exe
  C:\Windows\System\xsWBmyJ.exe
  2⤵
  PID:6484
- C:\Windows\System\uNLdqNL.exe
  C:\Windows\System\uNLdqNL.exe
  2⤵
  PID:6500
- C:\Windows\System\cEOVEFG.exe
  C:\Windows\System\cEOVEFG.exe
  2⤵
  PID:6568
- C:\Windows\System\oiLvVEY.exe
  C:\Windows\System\oiLvVEY.exe
  2⤵
  PID:6584
- C:\Windows\System\OgubRww.exe
  C:\Windows\System\OgubRww.exe
  2⤵
  PID:6600
- C:\Windows\System\cOglUun.exe
  C:\Windows\System\cOglUun.exe
  2⤵
  PID:6620
- C:\Windows\System\SEUTZDB.exe
  C:\Windows\System\SEUTZDB.exe
  2⤵
  PID:6636
- C:\Windows\System\AbwZYLh.exe
  C:\Windows\System\AbwZYLh.exe
  2⤵
  PID:6652
- C:\Windows\System\QhlarGi.exe
  C:\Windows\System\QhlarGi.exe
  2⤵
  PID:6668
- C:\Windows\System\zNlOiWa.exe
  C:\Windows\System\zNlOiWa.exe
  2⤵
  PID:6688
- C:\Windows\System\yuBIQaG.exe
  C:\Windows\System\yuBIQaG.exe
  2⤵
  PID:6704
- C:\Windows\System\ErpNGHy.exe
  C:\Windows\System\ErpNGHy.exe
  2⤵
  PID:6720
- C:\Windows\System\MgIWLNy.exe
  C:\Windows\System\MgIWLNy.exe
  2⤵
  PID:6736
- C:\Windows\System\TgjtXMC.exe
  C:\Windows\System\TgjtXMC.exe
  2⤵
  PID:6756
- C:\Windows\System\CBJyccJ.exe
  C:\Windows\System\CBJyccJ.exe
  2⤵
  PID:6772
- C:\Windows\System\dAlkJxk.exe
  C:\Windows\System\dAlkJxk.exe
  2⤵
  PID:6788
- C:\Windows\System\nGJPXjd.exe
  C:\Windows\System\nGJPXjd.exe
  2⤵
  PID:6804
- C:\Windows\System\iebOMjG.exe
  C:\Windows\System\iebOMjG.exe
  2⤵
  PID:6820
- C:\Windows\System\famhefj.exe
  C:\Windows\System\famhefj.exe
  2⤵
  PID:6836
- C:\Windows\System\geVInkw.exe
  C:\Windows\System\geVInkw.exe
  2⤵
  PID:6928
- C:\Windows\System\FkeAjSv.exe
  C:\Windows\System\FkeAjSv.exe
  2⤵
  PID:6944
- C:\Windows\System\QwNlJux.exe
  C:\Windows\System\QwNlJux.exe
  2⤵
  PID:6964
- C:\Windows\System\PKJtEFC.exe
  C:\Windows\System\PKJtEFC.exe
  2⤵
  PID:6980
- C:\Windows\System\jsdyteH.exe
  C:\Windows\System\jsdyteH.exe
  2⤵
  PID:6996
- C:\Windows\System\oLmxclj.exe
  C:\Windows\System\oLmxclj.exe
  2⤵
  PID:7012
- C:\Windows\System\wsmYxyT.exe
  C:\Windows\System\wsmYxyT.exe
  2⤵
  PID:7028
- C:\Windows\System\btzGnij.exe
  C:\Windows\System\btzGnij.exe
  2⤵
  PID:7048
- C:\Windows\System\toLUinN.exe
  C:\Windows\System\toLUinN.exe
  2⤵
  PID:7064
- C:\Windows\System\KJsOyJI.exe
  C:\Windows\System\KJsOyJI.exe
  2⤵
  PID:7084
- C:\Windows\System\KUldZAE.exe
  C:\Windows\System\KUldZAE.exe
  2⤵
  PID:7100
- C:\Windows\System\ZDwRsuh.exe
  C:\Windows\System\ZDwRsuh.exe
  2⤵
  PID:7120
- C:\Windows\System\TEdqoun.exe
  C:\Windows\System\TEdqoun.exe
  2⤵
  PID:7164
- C:\Windows\System\WkLjxKc.exe
  C:\Windows\System\WkLjxKc.exe
  2⤵
  PID:5684
- C:\Windows\System\JqfZyhA.exe
  C:\Windows\System\JqfZyhA.exe
  2⤵
  PID:6076
- C:\Windows\System\Xafdskr.exe
  C:\Windows\System\Xafdskr.exe
  2⤵
  PID:6252
- C:\Windows\System\BJmzHMV.exe
  C:\Windows\System\BJmzHMV.exe
  2⤵
  PID:5700
- C:\Windows\System\iOoVemL.exe
  C:\Windows\System\iOoVemL.exe
  2⤵
  PID:6164
- C:\Windows\System\bKBNoIm.exe
  C:\Windows\System\bKBNoIm.exe
  2⤵
  PID:6236
- C:\Windows\System\SYoClrS.exe
  C:\Windows\System\SYoClrS.exe
  2⤵
  PID:6276
- C:\Windows\System\mFcrNEW.exe
  C:\Windows\System\mFcrNEW.exe
  2⤵
  PID:6288
- C:\Windows\System\zKCstQb.exe
  C:\Windows\System\zKCstQb.exe
  2⤵
  PID:6324
- C:\Windows\System\NATbqwz.exe
  C:\Windows\System\NATbqwz.exe
  2⤵
  PID:6340
- C:\Windows\System\dLETZqJ.exe
  C:\Windows\System\dLETZqJ.exe
  2⤵
  PID:1572
- C:\Windows\System\EzeeFld.exe
  C:\Windows\System\EzeeFld.exe
  2⤵
  PID:6432
- C:\Windows\System\SAzDlUU.exe
  C:\Windows\System\SAzDlUU.exe
  2⤵
  PID:6476
- C:\Windows\System\WxeBdgq.exe
  C:\Windows\System\WxeBdgq.exe
  2⤵
  PID:6524
- C:\Windows\System\kzACMsN.exe
  C:\Windows\System\kzACMsN.exe
  2⤵
  PID:6456
- C:\Windows\System\iSFotLt.exe
  C:\Windows\System\iSFotLt.exe
  2⤵
  PID:6420
- C:\Windows\System\GOOAIBe.exe
  C:\Windows\System\GOOAIBe.exe
  2⤵
  PID:6540
- C:\Windows\System\zZNavlU.exe
  C:\Windows\System\zZNavlU.exe
  2⤵
  PID:6556
- C:\Windows\System\DjhsYzw.exe
  C:\Windows\System\DjhsYzw.exe
  2⤵
  PID:6660
- C:\Windows\System\XUEygBQ.exe
  C:\Windows\System\XUEygBQ.exe
  2⤵
  PID:6716
- C:\Windows\System\redmFGd.exe
  C:\Windows\System\redmFGd.exe
  2⤵
  PID:6648
- C:\Windows\System\HCAhxXb.exe
  C:\Windows\System\HCAhxXb.exe
  2⤵
  PID:6812
- C:\Windows\System\cejnpFt.exe
  C:\Windows\System\cejnpFt.exe
  2⤵
  PID:6748
- C:\Windows\System\AsThBCE.exe
  C:\Windows\System\AsThBCE.exe
  2⤵
  PID:6852
- C:\Windows\System\QtWPwfK.exe
  C:\Windows\System\QtWPwfK.exe
  2⤵
  PID:6684
- C:\Windows\System\JQOHLgU.exe
  C:\Windows\System\JQOHLgU.exe
  2⤵
  PID:6876
- C:\Windows\System\vqHGteJ.exe
  C:\Windows\System\vqHGteJ.exe
  2⤵
  PID:6832
- C:\Windows\System\TILFTot.exe
  C:\Windows\System\TILFTot.exe
  2⤵
  PID:7004
- C:\Windows\System\ftvUoXr.exe
  C:\Windows\System\ftvUoXr.exe
  2⤵
  PID:6988
- C:\Windows\System\nffBikN.exe
  C:\Windows\System\nffBikN.exe
  2⤵
  PID:7072
- C:\Windows\System\lpHEmRP.exe
  C:\Windows\System\lpHEmRP.exe
  2⤵
  PID:7060
- C:\Windows\System\oEgWQtO.exe
  C:\Windows\System\oEgWQtO.exe
  2⤵
  PID:7080
- C:\Windows\System\wYoOxDw.exe
  C:\Windows\System\wYoOxDw.exe
  2⤵
  PID:7132
- C:\Windows\System\lUbFkBi.exe
  C:\Windows\System\lUbFkBi.exe
  2⤵
  PID:7152
- C:\Windows\System\QcrGLwq.exe
  C:\Windows\System\QcrGLwq.exe
  2⤵
  PID:6216
- C:\Windows\System\tJzzxDh.exe
  C:\Windows\System\tJzzxDh.exe
  2⤵
  PID:6184
- C:\Windows\System\zktlnKW.exe
  C:\Windows\System\zktlnKW.exe
  2⤵
  PID:6344
- C:\Windows\System\eWSfVWV.exe
  C:\Windows\System\eWSfVWV.exe
  2⤵
  PID:4932
- C:\Windows\System\XXfqGdl.exe
  C:\Windows\System\XXfqGdl.exe
  2⤵
  PID:6388
- C:\Windows\System\hAUdnxz.exe
  C:\Windows\System\hAUdnxz.exe
  2⤵
  PID:6536
- C:\Windows\System\LqzTdoy.exe
  C:\Windows\System\LqzTdoy.exe
  2⤵
  PID:6548
- C:\Windows\System\JtGBQjR.exe
  C:\Windows\System\JtGBQjR.exe
  2⤵
  PID:6508
- C:\Windows\System\WCcXgcW.exe
  C:\Windows\System\WCcXgcW.exe
  2⤵
  PID:6356
- C:\Windows\System\CbYRWZt.exe
  C:\Windows\System\CbYRWZt.exe
  2⤵
  PID:6404
- C:\Windows\System\ICXYsHG.exe
  C:\Windows\System\ICXYsHG.exe
  2⤵
  PID:6580
- C:\Windows\System\OGlmYae.exe
  C:\Windows\System\OGlmYae.exe
  2⤵
  PID:6872
- C:\Windows\System\OAmXcqa.exe
  C:\Windows\System\OAmXcqa.exe
  2⤵
  PID:4420
- C:\Windows\System\WYnitTW.exe
  C:\Windows\System\WYnitTW.exe
  2⤵
  PID:6680
- C:\Windows\System\vuIbbyl.exe
  C:\Windows\System\vuIbbyl.exe
  2⤵
  PID:6616
- C:\Windows\System\DAwXpQn.exe
  C:\Windows\System\DAwXpQn.exe
  2⤵
  PID:6728
- C:\Windows\System\cNtHUrt.exe
  C:\Windows\System\cNtHUrt.exe
  2⤵
  PID:6892
- C:\Windows\System\qBWllYn.exe
  C:\Windows\System\qBWllYn.exe
  2⤵
  PID:6904
- C:\Windows\System\XqpxqvJ.exe
  C:\Windows\System\XqpxqvJ.exe
  2⤵
  PID:6368
- C:\Windows\System\gcEIYoM.exe
  C:\Windows\System\gcEIYoM.exe
  2⤵
  PID:6972
- C:\Windows\System\ALwJtBm.exe
  C:\Windows\System\ALwJtBm.exe
  2⤵
  PID:7040
- C:\Windows\System\AwAEdkI.exe
  C:\Windows\System\AwAEdkI.exe
  2⤵
  PID:7096
- C:\Windows\System\QpdkpWN.exe
  C:\Windows\System\QpdkpWN.exe
  2⤵
  PID:7056
- C:\Windows\System\RcRFaht.exe
  C:\Windows\System\RcRFaht.exe
  2⤵
  PID:6520
- C:\Windows\System\ouKNXwb.exe
  C:\Windows\System\ouKNXwb.exe
  2⤵
  PID:6224
- C:\Windows\System\PyqWwWo.exe
  C:\Windows\System\PyqWwWo.exe
  2⤵
  PID:6416
- C:\Windows\System\odkslAF.exe
  C:\Windows\System\odkslAF.exe
  2⤵
  PID:6012
- C:\Windows\System\jXZVWFq.exe
  C:\Windows\System\jXZVWFq.exe
  2⤵
  PID:6612
- C:\Windows\System\ggQeTss.exe
  C:\Windows\System\ggQeTss.exe
  2⤵
  PID:6240
- C:\Windows\System\rvByeZj.exe
  C:\Windows\System\rvByeZj.exe
  2⤵
  PID:6880
- C:\Windows\System\imhqJqw.exe
  C:\Windows\System\imhqJqw.exe
  2⤵
  PID:5900
- C:\Windows\System\FsbAzpV.exe
  C:\Windows\System\FsbAzpV.exe
  2⤵
  PID:6828
- C:\Windows\System\thMdyPw.exe
  C:\Windows\System\thMdyPw.exe
  2⤵
  PID:6512
- C:\Windows\System\kdyFBtb.exe
  C:\Windows\System\kdyFBtb.exe
  2⤵
  PID:6916
- C:\Windows\System\AylXNlA.exe
  C:\Windows\System\AylXNlA.exe
  2⤵
  PID:7128
- C:\Windows\System\SsetzWY.exe
  C:\Windows\System\SsetzWY.exe
  2⤵
  PID:6900
- C:\Windows\System\SyQhxGY.exe
  C:\Windows\System\SyQhxGY.exe
  2⤵
  PID:5964
- C:\Windows\System\dIMKuCp.exe
  C:\Windows\System\dIMKuCp.exe
  2⤵
  PID:6552
- C:\Windows\System\AHMgbOy.exe
  C:\Windows\System\AHMgbOy.exe
  2⤵
  PID:7112
- C:\Windows\System\ngicpai.exe
  C:\Windows\System\ngicpai.exe
  2⤵
  PID:6516
- C:\Windows\System\JjRcFqY.exe
  C:\Windows\System\JjRcFqY.exe
  2⤵
  PID:6460
- C:\Windows\System\USXmBrT.exe
  C:\Windows\System\USXmBrT.exe
  2⤵
  PID:6920
- C:\Windows\System\bMykhed.exe
  C:\Windows\System\bMykhed.exe
  2⤵
  PID:6940
- C:\Windows\System\ffxSWqI.exe
  C:\Windows\System\ffxSWqI.exe
  2⤵
  PID:5928
- C:\Windows\System\wwkZJdG.exe
  C:\Windows\System\wwkZJdG.exe
  2⤵
  PID:7148
- C:\Windows\System\fGZfZWG.exe
  C:\Windows\System\fGZfZWG.exe
  2⤵
  PID:6204
- C:\Windows\System\jbsRSXH.exe
  C:\Windows\System\jbsRSXH.exe
  2⤵
  PID:5228
- C:\Windows\System\qFapCuW.exe
  C:\Windows\System\qFapCuW.exe
  2⤵
  PID:7176
- C:\Windows\System\HkEVoHm.exe
  C:\Windows\System\HkEVoHm.exe
  2⤵
  PID:7196
- C:\Windows\System\KJkNURD.exe
  C:\Windows\System\KJkNURD.exe
  2⤵
  PID:7212
- C:\Windows\System\pMCMqxr.exe
  C:\Windows\System\pMCMqxr.exe
  2⤵
  PID:7228
- C:\Windows\System\MLdHSMP.exe
  C:\Windows\System\MLdHSMP.exe
  2⤵
  PID:7248
- C:\Windows\System\UzTvmdj.exe
  C:\Windows\System\UzTvmdj.exe
  2⤵
  PID:7264
- C:\Windows\System\XQLSnzH.exe
  C:\Windows\System\XQLSnzH.exe
  2⤵
  PID:7284
- C:\Windows\System\UfTiRxg.exe
  C:\Windows\System\UfTiRxg.exe
  2⤵
  PID:7440
- C:\Windows\System\CEYayMZ.exe
  C:\Windows\System\CEYayMZ.exe
  2⤵
  PID:7464
- C:\Windows\System\EPpTKJF.exe
  C:\Windows\System\EPpTKJF.exe
  2⤵
  PID:7480
- C:\Windows\System\TqEeIwH.exe
  C:\Windows\System\TqEeIwH.exe
  2⤵
  PID:7496
- C:\Windows\System\rbWKaOd.exe
  C:\Windows\System\rbWKaOd.exe
  2⤵
  PID:7512
- C:\Windows\System\TVMlyea.exe
  C:\Windows\System\TVMlyea.exe
  2⤵
  PID:7528
- C:\Windows\System\pwGzAOD.exe
  C:\Windows\System\pwGzAOD.exe
  2⤵
  PID:7544
- C:\Windows\System\cAqCjCe.exe
  C:\Windows\System\cAqCjCe.exe
  2⤵
  PID:7560
- C:\Windows\System\IHFwDJs.exe
  C:\Windows\System\IHFwDJs.exe
  2⤵
  PID:7576
- C:\Windows\System\nxYSUBR.exe
  C:\Windows\System\nxYSUBR.exe
  2⤵
  PID:7592
- C:\Windows\System\oioVorZ.exe
  C:\Windows\System\oioVorZ.exe
  2⤵
  PID:7608
- C:\Windows\System\UriyhTX.exe
  C:\Windows\System\UriyhTX.exe
  2⤵
  PID:7624
- C:\Windows\System\QdwMDXu.exe
  C:\Windows\System\QdwMDXu.exe
  2⤵
  PID:7640
- C:\Windows\System\aBuQyzr.exe
  C:\Windows\System\aBuQyzr.exe
  2⤵
  PID:7656
- C:\Windows\System\pIBuToF.exe
  C:\Windows\System\pIBuToF.exe
  2⤵
  PID:7672
- C:\Windows\System\KpIqbfr.exe
  C:\Windows\System\KpIqbfr.exe
  2⤵
  PID:7688
- C:\Windows\System\SDLbHnI.exe
  C:\Windows\System\SDLbHnI.exe
  2⤵
  PID:7704
- C:\Windows\System\XSQHQLb.exe
  C:\Windows\System\XSQHQLb.exe
  2⤵
  PID:7720
- C:\Windows\System\OLvhBNA.exe
  C:\Windows\System\OLvhBNA.exe
  2⤵
  PID:7736
- C:\Windows\System\VZnRiEi.exe
  C:\Windows\System\VZnRiEi.exe
  2⤵
  PID:7752
- C:\Windows\System\vsBsytY.exe
  C:\Windows\System\vsBsytY.exe
  2⤵
  PID:7768
- C:\Windows\System\mseoCJL.exe
  C:\Windows\System\mseoCJL.exe
  2⤵
  PID:7784
- C:\Windows\System\aSixjJH.exe
  C:\Windows\System\aSixjJH.exe
  2⤵
  PID:7800
- C:\Windows\System\vtVumvC.exe
  C:\Windows\System\vtVumvC.exe
  2⤵
  PID:7816
- C:\Windows\System\FhKGnqe.exe
  C:\Windows\System\FhKGnqe.exe
  2⤵
  PID:7832
- C:\Windows\System\fWCxjNL.exe
  C:\Windows\System\fWCxjNL.exe
  2⤵
  PID:7848
- C:\Windows\System\iNreTOB.exe
  C:\Windows\System\iNreTOB.exe
  2⤵
  PID:7864
- C:\Windows\System\bXVuPej.exe
  C:\Windows\System\bXVuPej.exe
  2⤵
  PID:7880
- C:\Windows\System\JUsgUwe.exe
  C:\Windows\System\JUsgUwe.exe
  2⤵
  PID:7896
- C:\Windows\System\yHZsjTn.exe
  C:\Windows\System\yHZsjTn.exe
  2⤵
  PID:7912
- C:\Windows\System\LUNGLpX.exe
  C:\Windows\System\LUNGLpX.exe
  2⤵
  PID:7928
- C:\Windows\System\pOExKoY.exe
  C:\Windows\System\pOExKoY.exe
  2⤵
  PID:7944
- C:\Windows\System\LPXTVUJ.exe
  C:\Windows\System\LPXTVUJ.exe
  2⤵
  PID:7960
- C:\Windows\System\SclJaLO.exe
  C:\Windows\System\SclJaLO.exe
  2⤵
  PID:7976
- C:\Windows\System\NRiniBb.exe
  C:\Windows\System\NRiniBb.exe
  2⤵
  PID:7996
- C:\Windows\System\bnsvxCt.exe
  C:\Windows\System\bnsvxCt.exe
  2⤵
  PID:8012
- C:\Windows\System\lFDVGCZ.exe
  C:\Windows\System\lFDVGCZ.exe
  2⤵
  PID:8028
- C:\Windows\System\yVbhmnd.exe
  C:\Windows\System\yVbhmnd.exe
  2⤵
  PID:8048
- C:\Windows\System\sgOfDjA.exe
  C:\Windows\System\sgOfDjA.exe
  2⤵
  PID:8068
- C:\Windows\System\DXxzbPu.exe
  C:\Windows\System\DXxzbPu.exe
  2⤵
  PID:8084
- C:\Windows\System\HGdWJaI.exe
  C:\Windows\System\HGdWJaI.exe
  2⤵
  PID:8100
- C:\Windows\System\CXUxOdp.exe
  C:\Windows\System\CXUxOdp.exe
  2⤵
  PID:8160
- C:\Windows\System\SVuDxxE.exe
  C:\Windows\System\SVuDxxE.exe
  2⤵
  PID:8176
- C:\Windows\System\sVoijrK.exe
  C:\Windows\System\sVoijrK.exe
  2⤵
  PID:7092
- C:\Windows\System\NMKcpfD.exe
  C:\Windows\System\NMKcpfD.exe
  2⤵
  PID:7192
- C:\Windows\System\PQelFGP.exe
  C:\Windows\System\PQelFGP.exe
  2⤵
  PID:7296
- C:\Windows\System\PjXoGxT.exe
  C:\Windows\System\PjXoGxT.exe
  2⤵
  PID:7280
- C:\Windows\System\nIhuSge.exe
  C:\Windows\System\nIhuSge.exe
  2⤵
  PID:7236
- C:\Windows\System\mrGMAKK.exe
  C:\Windows\System\mrGMAKK.exe
  2⤵
  PID:6496
- C:\Windows\System\BGzPtoD.exe
  C:\Windows\System\BGzPtoD.exe
  2⤵
  PID:7312
- C:\Windows\System\xVvHPty.exe
  C:\Windows\System\xVvHPty.exe
  2⤵
  PID:7328
- C:\Windows\System\qoLPVHt.exe
  C:\Windows\System\qoLPVHt.exe
  2⤵
  PID:7348
- C:\Windows\System\MlFLirY.exe
  C:\Windows\System\MlFLirY.exe
  2⤵
  PID:7364
- C:\Windows\System\PgnQMaf.exe
  C:\Windows\System\PgnQMaf.exe
  2⤵
  PID:7384
- C:\Windows\System\hvTByzr.exe
  C:\Windows\System\hvTByzr.exe
  2⤵
  PID:7416
- C:\Windows\System\fsRwHra.exe
  C:\Windows\System\fsRwHra.exe
  2⤵
  PID:7412
- C:\Windows\System\lAtnsKY.exe
  C:\Windows\System\lAtnsKY.exe
  2⤵
  PID:7680
- C:\Windows\System\ITIaLen.exe
  C:\Windows\System\ITIaLen.exe
  2⤵
  PID:7636
- C:\Windows\System\iPbEGSo.exe
  C:\Windows\System\iPbEGSo.exe
  2⤵
  PID:7744
- C:\Windows\System\ksyIDJb.exe
  C:\Windows\System\ksyIDJb.exe
  2⤵
  PID:7792
- C:\Windows\System\TfbMIvv.exe
  C:\Windows\System\TfbMIvv.exe
  2⤵
  PID:7824
- C:\Windows\System\SXqUOaH.exe
  C:\Windows\System\SXqUOaH.exe
  2⤵
  PID:7844
- C:\Windows\System\BzSUfCq.exe
  C:\Windows\System\BzSUfCq.exe
  2⤵
  PID:7892
- C:\Windows\System\JkLFzvw.exe
  C:\Windows\System\JkLFzvw.exe
  2⤵
  PID:7924
- C:\Windows\System\doWJyYh.exe
  C:\Windows\System\doWJyYh.exe
  2⤵
  PID:7940
- C:\Windows\System\PVaOWMZ.exe
  C:\Windows\System\PVaOWMZ.exe
  2⤵
  PID:7972
- C:\Windows\System\NqTZegc.exe
  C:\Windows\System\NqTZegc.exe
  2⤵
  PID:8020
- C:\Windows\System\hzTAdlp.exe
  C:\Windows\System\hzTAdlp.exe
  2⤵
  PID:8092
- C:\Windows\System\KznSOET.exe
  C:\Windows\System\KznSOET.exe
  2⤵
  PID:8040
- C:\Windows\System\FLIpusf.exe
  C:\Windows\System\FLIpusf.exe
  2⤵
  PID:8108
- C:\Windows\System\eVYmkoE.exe
  C:\Windows\System\eVYmkoE.exe
  2⤵
  PID:8172
- C:\Windows\System\sdhBBtE.exe
  C:\Windows\System\sdhBBtE.exe
  2⤵
  PID:6864
- C:\Windows\System\GlNlpVp.exe
  C:\Windows\System\GlNlpVp.exe
  2⤵
  PID:7316
- C:\Windows\System\dGhyCQS.exe
  C:\Windows\System\dGhyCQS.exe
  2⤵
  PID:7380
- C:\Windows\System\fcHnqJO.exe
  C:\Windows\System\fcHnqJO.exe
  2⤵
  PID:7448
- C:\Windows\System\lUvxIMO.exe
  C:\Windows\System\lUvxIMO.exe
  2⤵
  PID:7472
- C:\Windows\System\dvvCofE.exe
  C:\Windows\System\dvvCofE.exe
  2⤵
  PID:7508
- C:\Windows\System\ozKGuKD.exe
  C:\Windows\System\ozKGuKD.exe
  2⤵
  PID:7536
- C:\Windows\System\VVWxzdL.exe
  C:\Windows\System\VVWxzdL.exe
  2⤵
  PID:7584
- C:\Windows\System\yUaiRgK.exe
  C:\Windows\System\yUaiRgK.exe
  2⤵
  PID:7604
- C:\Windows\System\kDVbEPB.exe
  C:\Windows\System\kDVbEPB.exe
  2⤵
  PID:7664
- C:\Windows\System\ZxWrtWM.exe
  C:\Windows\System\ZxWrtWM.exe
  2⤵
  PID:7700
- C:\Windows\System\udLhQKd.exe
  C:\Windows\System\udLhQKd.exe
  2⤵
  PID:7812
- C:\Windows\System\lLkiGoW.exe
  C:\Windows\System\lLkiGoW.exe
  2⤵
  PID:7936
- C:\Windows\System\eAFmmZh.exe
  C:\Windows\System\eAFmmZh.exe
  2⤵
  PID:7840
- C:\Windows\System\NtpNDdZ.exe
  C:\Windows\System\NtpNDdZ.exe
  2⤵
  PID:8008
- C:\Windows\System\lQAaeNc.exe
  C:\Windows\System\lQAaeNc.exe
  2⤵
  PID:8168
- C:\Windows\System\cbZEAzR.exe
  C:\Windows\System\cbZEAzR.exe
  2⤵
  PID:8064
- C:\Windows\System\obmKbAs.exe
  C:\Windows\System\obmKbAs.exe
  2⤵
  PID:8128
- C:\Windows\System\ziAlXYW.exe
  C:\Windows\System\ziAlXYW.exe
  2⤵
  PID:8036
- C:\Windows\System\DujQXNc.exe
  C:\Windows\System\DujQXNc.exe
  2⤵
  PID:7344
- C:\Windows\System\ZEbgMOb.exe
  C:\Windows\System\ZEbgMOb.exe
  2⤵
  PID:7240
- C:\Windows\System\zEElHEB.exe
  C:\Windows\System\zEElHEB.exe
  2⤵
  PID:7260
- C:\Windows\System\FVdURQM.exe
  C:\Windows\System\FVdURQM.exe
  2⤵
  PID:8184
- C:\Windows\System\nPxiEjU.exe
  C:\Windows\System\nPxiEjU.exe
  2⤵
  PID:7172
- C:\Windows\System\tdEzIsD.exe
  C:\Windows\System\tdEzIsD.exe
  2⤵
  PID:7504
- C:\Windows\System\mATTeUp.exe
  C:\Windows\System\mATTeUp.exe
  2⤵
  PID:7568
- C:\Windows\System\nyiCHXt.exe
  C:\Windows\System\nyiCHXt.exe
  2⤵
  PID:7876
- C:\Windows\System\dkqKSqd.exe
  C:\Windows\System\dkqKSqd.exe
  2⤵
  PID:7224
- C:\Windows\System\ckJBWoG.exe
  C:\Windows\System\ckJBWoG.exe
  2⤵
  PID:7244
- C:\Windows\System\KTcUpbf.exe
  C:\Windows\System\KTcUpbf.exe
  2⤵
  PID:7460
- C:\Windows\System\fHgeieR.exe
  C:\Windows\System\fHgeieR.exe
  2⤵
  PID:7696
- C:\Windows\System\izHwNwJ.exe
  C:\Windows\System\izHwNwJ.exe
  2⤵
  PID:8056
- C:\Windows\System\qRbPVcg.exe
  C:\Windows\System\qRbPVcg.exe
  2⤵
  PID:7308
- C:\Windows\System\OKchZYB.exe
  C:\Windows\System\OKchZYB.exe
  2⤵
  PID:7388
- C:\Windows\System\BbCsGvj.exe
  C:\Windows\System\BbCsGvj.exe
  2⤵
  PID:7396
- C:\Windows\System\frhgLqP.exe
  C:\Windows\System\frhgLqP.exe
  2⤵
  PID:7572
- C:\Windows\System\JgQHJft.exe
  C:\Windows\System\JgQHJft.exe
  2⤵
  PID:7764
- C:\Windows\System\VPgbApx.exe
  C:\Windows\System\VPgbApx.exe
  2⤵
  PID:7992
- C:\Windows\System\ikJkgLy.exe
  C:\Windows\System\ikJkgLy.exe
  2⤵
  PID:7392
- C:\Windows\System\FrVYyaf.exe
  C:\Windows\System\FrVYyaf.exe
  2⤵
  PID:7860
- C:\Windows\System\NtuRXMK.exe
  C:\Windows\System\NtuRXMK.exe
  2⤵
  PID:7492
- C:\Windows\System\rvCsiXu.exe
  C:\Windows\System\rvCsiXu.exe
  2⤵
  PID:8144
- C:\Windows\System\TRPQcRW.exe
  C:\Windows\System\TRPQcRW.exe
  2⤵
  PID:7988
- C:\Windows\System\MXlUSDn.exe
  C:\Windows\System\MXlUSDn.exe
  2⤵
  PID:8148
- C:\Windows\System\KxBLBYk.exe
  C:\Windows\System\KxBLBYk.exe
  2⤵
  PID:8244
- C:\Windows\System\xUJhNfe.exe
  C:\Windows\System\xUJhNfe.exe
  2⤵
  PID:8264
- C:\Windows\System\AtQxlqL.exe
  C:\Windows\System\AtQxlqL.exe
  2⤵
  PID:8280
- C:\Windows\System\guhUqhh.exe
  C:\Windows\System\guhUqhh.exe
  2⤵
  PID:8308
- C:\Windows\System\IrPDWhU.exe
  C:\Windows\System\IrPDWhU.exe
  2⤵
  PID:8324
- C:\Windows\System\irZkViK.exe
  C:\Windows\System\irZkViK.exe
  2⤵
  PID:8340
- C:\Windows\System\WVnimBX.exe
  C:\Windows\System\WVnimBX.exe
  2⤵
  PID:8356
- C:\Windows\System\BantWcU.exe
  C:\Windows\System\BantWcU.exe
  2⤵
  PID:8380
- C:\Windows\System\fzEQWTH.exe
  C:\Windows\System\fzEQWTH.exe
  2⤵
  PID:8400
- C:\Windows\System\lTtKsJZ.exe
  C:\Windows\System\lTtKsJZ.exe
  2⤵
  PID:8420
- C:\Windows\System\yvRmblL.exe
  C:\Windows\System\yvRmblL.exe
  2⤵
  PID:8436
- C:\Windows\System\MGrEkMu.exe
  C:\Windows\System\MGrEkMu.exe
  2⤵
  PID:8452
- C:\Windows\System\zaQiFaI.exe
  C:\Windows\System\zaQiFaI.exe
  2⤵
  PID:8472
- C:\Windows\System\cBHVuwc.exe
  C:\Windows\System\cBHVuwc.exe
  2⤵
  PID:8488
- C:\Windows\System\rPBZEmY.exe
  C:\Windows\System\rPBZEmY.exe
  2⤵
  PID:8504
- C:\Windows\System\hSRejOJ.exe
  C:\Windows\System\hSRejOJ.exe
  2⤵
  PID:8520
- C:\Windows\System\ByZquPp.exe
  C:\Windows\System\ByZquPp.exe
  2⤵
  PID:8536
- C:\Windows\System\ELIzzha.exe
  C:\Windows\System\ELIzzha.exe
  2⤵
  PID:8556
- C:\Windows\System\oEGCSYp.exe
  C:\Windows\System\oEGCSYp.exe
  2⤵
  PID:8572
- C:\Windows\System\kCsOZHR.exe
  C:\Windows\System\kCsOZHR.exe
  2⤵
  PID:8588
- C:\Windows\System\XnNqgUF.exe
  C:\Windows\System\XnNqgUF.exe
  2⤵
  PID:8616
- C:\Windows\System\qSDTCJW.exe
  C:\Windows\System\qSDTCJW.exe
  2⤵
  PID:8692
- C:\Windows\System\fNDtdyV.exe
  C:\Windows\System\fNDtdyV.exe
  2⤵
  PID:8712
- C:\Windows\System\uQmuCWC.exe
  C:\Windows\System\uQmuCWC.exe
  2⤵
  PID:8728
- C:\Windows\System\HhvgYaq.exe
  C:\Windows\System\HhvgYaq.exe
  2⤵
  PID:8748
- C:\Windows\System\JnwuDqa.exe
  C:\Windows\System\JnwuDqa.exe
  2⤵
  PID:8764
- C:\Windows\System\kkvEuFG.exe
  C:\Windows\System\kkvEuFG.exe
  2⤵
  PID:8820
- C:\Windows\System\zpoJOSw.exe
  C:\Windows\System\zpoJOSw.exe
  2⤵
  PID:8836
- C:\Windows\System\ykXQhkb.exe
  C:\Windows\System\ykXQhkb.exe
  2⤵
  PID:8852
- C:\Windows\System\LqLkBoY.exe
  C:\Windows\System\LqLkBoY.exe
  2⤵
  PID:8868
- C:\Windows\System\uUiJdov.exe
  C:\Windows\System\uUiJdov.exe
  2⤵
  PID:8888
- C:\Windows\System\VwEHQpx.exe
  C:\Windows\System\VwEHQpx.exe
  2⤵
  PID:8904
- C:\Windows\System\cjbXKWs.exe
  C:\Windows\System\cjbXKWs.exe
  2⤵
  PID:8924
- C:\Windows\System\ddBqEtU.exe
  C:\Windows\System\ddBqEtU.exe
  2⤵
  PID:8944
- C:\Windows\System\FoHvsyH.exe
  C:\Windows\System\FoHvsyH.exe
  2⤵
  PID:8960
- C:\Windows\System\hMhfcjW.exe
  C:\Windows\System\hMhfcjW.exe
  2⤵
  PID:8976
- C:\Windows\System\gaEZlhH.exe
  C:\Windows\System\gaEZlhH.exe
  2⤵
  PID:8996
- C:\Windows\System\pIVeqHS.exe
  C:\Windows\System\pIVeqHS.exe
  2⤵
  PID:9012
- C:\Windows\System\rjPcJrn.exe
  C:\Windows\System\rjPcJrn.exe
  2⤵
  PID:9032
- C:\Windows\System\AwDMmzp.exe
  C:\Windows\System\AwDMmzp.exe
  2⤵
  PID:9048
- C:\Windows\System\RJkldCj.exe
  C:\Windows\System\RJkldCj.exe
  2⤵
  PID:9104
- C:\Windows\System\AccEPyb.exe
  C:\Windows\System\AccEPyb.exe
  2⤵
  PID:9120
- C:\Windows\System\iKHMPpV.exe
  C:\Windows\System\iKHMPpV.exe
  2⤵
  PID:9144
- C:\Windows\System\RecLYqe.exe
  C:\Windows\System\RecLYqe.exe
  2⤵
  PID:9160
- C:\Windows\System\ltdXsrA.exe
  C:\Windows\System\ltdXsrA.exe
  2⤵
  PID:9180
- C:\Windows\System\IQyaOQq.exe
  C:\Windows\System\IQyaOQq.exe
  2⤵
  PID:9196
- C:\Windows\System\XVDmVDy.exe
  C:\Windows\System\XVDmVDy.exe
  2⤵
  PID:9212
- C:\Windows\System\BQrUoRV.exe
  C:\Windows\System\BQrUoRV.exe
  2⤵
  PID:6796
- C:\Windows\System\CbEiuDv.exe
  C:\Windows\System\CbEiuDv.exe
  2⤵
  PID:7920
- C:\Windows\System\ibhwFgQ.exe
  C:\Windows\System\ibhwFgQ.exe
  2⤵
  PID:7828
- C:\Windows\System\xoIeGrR.exe
  C:\Windows\System\xoIeGrR.exe
  2⤵
  PID:8212
- C:\Windows\System\RazabWy.exe
  C:\Windows\System\RazabWy.exe
  2⤵
  PID:8200
- C:\Windows\System\tvUNptw.exe
  C:\Windows\System\tvUNptw.exe
  2⤵
  PID:8232
- C:\Windows\System\ihKdsDf.exe
  C:\Windows\System\ihKdsDf.exe
  2⤵
  PID:8252
- C:\Windows\System\FEUBcdo.exe
  C:\Windows\System\FEUBcdo.exe
  2⤵
  PID:8276
- C:\Windows\System\gZMKtzM.exe
  C:\Windows\System\gZMKtzM.exe
  2⤵
  PID:8304
- C:\Windows\System\wigpGPh.exe
  C:\Windows\System\wigpGPh.exe
  2⤵
  PID:8336
- C:\Windows\System\drCwEle.exe
  C:\Windows\System\drCwEle.exe
  2⤵
  PID:8376
- C:\Windows\System\mzuQGsm.exe
  C:\Windows\System\mzuQGsm.exe
  2⤵
  PID:8432
- C:\Windows\System\WWhgpVf.exe
  C:\Windows\System\WWhgpVf.exe
  2⤵
  PID:8388
- C:\Windows\System\nctmhsN.exe
  C:\Windows\System\nctmhsN.exe
  2⤵
  PID:8480
- C:\Windows\System\pVsNyMj.exe
  C:\Windows\System\pVsNyMj.exe
  2⤵
  PID:8428
- C:\Windows\System\UhprsgB.exe
  C:\Windows\System\UhprsgB.exe
  2⤵
  PID:8548
- C:\Windows\System\rXkjkkW.exe
  C:\Windows\System\rXkjkkW.exe
  2⤵
  PID:8688
- C:\Windows\System\XpCssio.exe
  C:\Windows\System\XpCssio.exe
  2⤵
  PID:8724
- C:\Windows\System\xTRYRzv.exe
  C:\Windows\System\xTRYRzv.exe
  2⤵
  PID:8760
- C:\Windows\System\rorvJkI.exe
  C:\Windows\System\rorvJkI.exe
  2⤵
  PID:8780
- C:\Windows\System\xkdDHVc.exe
  C:\Windows\System\xkdDHVc.exe
  2⤵
  PID:8808
- C:\Windows\System\MSJRPJV.exe
  C:\Windows\System\MSJRPJV.exe
  2⤵
  PID:8804
- C:\Windows\System\winWSrt.exe
  C:\Windows\System\winWSrt.exe
  2⤵
  PID:8860
- C:\Windows\System\foiUrLu.exe
  C:\Windows\System\foiUrLu.exe
  2⤵
  PID:8884
- C:\Windows\System\IjjYjtz.exe
  C:\Windows\System\IjjYjtz.exe
  2⤵
  PID:8984
- C:\Windows\System\rRMDJuQ.exe
  C:\Windows\System\rRMDJuQ.exe
  2⤵
  PID:8932
- C:\Windows\System\yoAvZpD.exe
  C:\Windows\System\yoAvZpD.exe
  2⤵
  PID:8936
- C:\Windows\System\kdTASlg.exe
  C:\Windows\System\kdTASlg.exe
  2⤵
  PID:8992
- C:\Windows\System\ZcrtkIO.exe
  C:\Windows\System\ZcrtkIO.exe
  2⤵
  PID:9080
- C:\Windows\System\twxqMFn.exe
  C:\Windows\System\twxqMFn.exe
  2⤵
  PID:9060
- C:\Windows\System\cMMoeFf.exe
  C:\Windows\System\cMMoeFf.exe
  2⤵
  PID:7188
- C:\Windows\System\DqpyXXx.exe
  C:\Windows\System\DqpyXXx.exe
  2⤵
  PID:9188
- C:\Windows\System\trBcxvl.exe
  C:\Windows\System\trBcxvl.exe
  2⤵
  PID:9132
- C:\Windows\System\LxqTOGh.exe
  C:\Windows\System\LxqTOGh.exe
  2⤵
  PID:9028
- C:\Windows\System\TtpPKJN.exe
  C:\Windows\System\TtpPKJN.exe
  2⤵
  PID:8348
- C:\Windows\System\BVzvOZk.exe
  C:\Windows\System\BVzvOZk.exe
  2⤵
  PID:8448
- C:\Windows\System\QunJpXe.exe
  C:\Windows\System\QunJpXe.exe
  2⤵
  PID:8416
- C:\Windows\System\WiVdkat.exe
  C:\Windows\System\WiVdkat.exe
  2⤵
  PID:8224
- C:\Windows\System\fvQRfHc.exe
  C:\Windows\System\fvQRfHc.exe
  2⤵
  PID:8516
- C:\Windows\System\MgRdxzn.exe
  C:\Windows\System\MgRdxzn.exe
  2⤵
  PID:8668
- C:\Windows\System\RtFwEuY.exe
  C:\Windows\System\RtFwEuY.exe
  2⤵
  PID:8652
- C:\Windows\System\bsGYiFK.exe
  C:\Windows\System\bsGYiFK.exe
  2⤵
  PID:8468
- C:\Windows\System\NfUwMcq.exe
  C:\Windows\System\NfUwMcq.exe
  2⤵
  PID:8316
- C:\Windows\System\xAcKSxv.exe
  C:\Windows\System\xAcKSxv.exe
  2⤵
  PID:8656
- C:\Windows\System\CcmlCpH.exe
  C:\Windows\System\CcmlCpH.exe
  2⤵
  PID:8528
- C:\Windows\System\FlSAnfY.exe
  C:\Windows\System\FlSAnfY.exe
  2⤵
  PID:9176
- C:\Windows\System\IAjUePT.exe
  C:\Windows\System\IAjUePT.exe
  2⤵
  PID:8460
- C:\Windows\System\ndNKNNd.exe
  C:\Windows\System\ndNKNNd.exe
  2⤵
  PID:8756
- C:\Windows\System\gMWjics.exe
  C:\Windows\System\gMWjics.exe
  2⤵
  PID:8832
- C:\Windows\System\YTxoZkG.exe
  C:\Windows\System\YTxoZkG.exe
  2⤵
  PID:8880
- C:\Windows\System\rPehvoG.exe
  C:\Windows\System\rPehvoG.exe
  2⤵
  PID:8720
- C:\Windows\System\eXYNkIt.exe
  C:\Windows\System\eXYNkIt.exe
  2⤵
  PID:8896
- C:\Windows\System\KkJVmhV.exe
  C:\Windows\System\KkJVmhV.exe
  2⤵
  PID:9004
- C:\Windows\System\vPpXqPz.exe
  C:\Windows\System\vPpXqPz.exe
  2⤵
  PID:9008
- C:\Windows\System\UBXuprl.exe
  C:\Windows\System\UBXuprl.exe
  2⤵
  PID:9056
- C:\Windows\System\ydLFUFP.exe
  C:\Windows\System\ydLFUFP.exe
  2⤵
  PID:8204
- C:\Windows\System\QjUfxkJ.exe
  C:\Windows\System\QjUfxkJ.exe
  2⤵
  PID:8564
- C:\Windows\System\OYrPOPp.exe
  C:\Windows\System\OYrPOPp.exe
  2⤵
  PID:7552
- C:\Windows\System\BGRyVAo.exe
  C:\Windows\System\BGRyVAo.exe
  2⤵
  PID:8648
- C:\Windows\System\EGBfxUq.exe
  C:\Windows\System\EGBfxUq.exe
  2⤵
  PID:8604
- C:\Windows\System\gYRLUiF.exe
  C:\Windows\System\gYRLUiF.exe
  2⤵
  PID:8672
- C:\Windows\System\EnDieUw.exe
  C:\Windows\System\EnDieUw.exe
  2⤵
  PID:9140
- C:\Windows\System\TKYCNib.exe
  C:\Windows\System\TKYCNib.exe
  2⤵
  PID:8700
- C:\Windows\System\fUVcNWf.exe
  C:\Windows\System\fUVcNWf.exe
  2⤵
  PID:8848
- C:\Windows\System\xKJrXvk.exe
  C:\Windows\System\xKJrXvk.exe
  2⤵
  PID:9128
- C:\Windows\System\HqaciCx.exe
  C:\Windows\System\HqaciCx.exe
  2⤵
  PID:7204
- C:\Windows\System\KfzLuLc.exe
  C:\Windows\System\KfzLuLc.exe
  2⤵
  PID:8684
- C:\Windows\System\pvWDBsO.exe
  C:\Windows\System\pvWDBsO.exe
  2⤵
  PID:8216
- C:\Windows\System\KTZXFZY.exe
  C:\Windows\System\KTZXFZY.exe
  2⤵
  PID:7632
- C:\Windows\System\QbbNGQr.exe
  C:\Windows\System\QbbNGQr.exe
  2⤵
  PID:1012
- C:\Windows\System\ZXyJPrV.exe
  C:\Windows\System\ZXyJPrV.exe
  2⤵
  PID:8272
- C:\Windows\System\AGiocFf.exe
  C:\Windows\System\AGiocFf.exe
  2⤵
  PID:8704
- C:\Windows\System\oRAHuSv.exe
  C:\Windows\System\oRAHuSv.exe
  2⤵
  PID:9192
- C:\Windows\System\VzeWKVd.exe
  C:\Windows\System\VzeWKVd.exe
  2⤵
  PID:7780
- C:\Windows\System\hQSHlZd.exe
  C:\Windows\System\hQSHlZd.exe
  2⤵
  PID:8664
- C:\Windows\System\MtOcLjv.exe
  C:\Windows\System\MtOcLjv.exe
  2⤵
  PID:9172
- C:\Windows\System\AxEzEcQ.exe
  C:\Windows\System\AxEzEcQ.exe
  2⤵
  PID:7408
- C:\Windows\System\wfXReen.exe
  C:\Windows\System\wfXReen.exe
  2⤵
  PID:9096
- C:\Windows\System\srWGvjB.exe
  C:\Windows\System\srWGvjB.exe
  2⤵
  PID:9232
- C:\Windows\System\xqnJxTC.exe
  C:\Windows\System\xqnJxTC.exe
  2⤵
  PID:9268
- C:\Windows\System\GEQIGYf.exe
  C:\Windows\System\GEQIGYf.exe
  2⤵
  PID:9288
- C:\Windows\System\eVSBXFQ.exe
  C:\Windows\System\eVSBXFQ.exe
  2⤵
  PID:9304
- C:\Windows\System\hYyVzVO.exe
  C:\Windows\System\hYyVzVO.exe
  2⤵
  PID:9320
- C:\Windows\System\zrRAxvZ.exe
  C:\Windows\System\zrRAxvZ.exe
  2⤵
  PID:9360
- C:\Windows\System\MKQfGvX.exe
  C:\Windows\System\MKQfGvX.exe
  2⤵
  PID:9376
- C:\Windows\System\DPDIGId.exe
  C:\Windows\System\DPDIGId.exe
  2⤵
  PID:9400
- C:\Windows\System\TgEEvps.exe
  C:\Windows\System\TgEEvps.exe
  2⤵
  PID:9424
- C:\Windows\System\odqYhtr.exe
  C:\Windows\System\odqYhtr.exe
  2⤵
  PID:9452
- C:\Windows\System\GxohhKg.exe
  C:\Windows\System\GxohhKg.exe
  2⤵
  PID:9468
- C:\Windows\System\lGafcKO.exe
  C:\Windows\System\lGafcKO.exe
  2⤵
  PID:9484
- C:\Windows\System\ubrhkpL.exe
  C:\Windows\System\ubrhkpL.exe
  2⤵
  PID:9504
- C:\Windows\System\PDUWeWa.exe
  C:\Windows\System\PDUWeWa.exe
  2⤵
  PID:9520
- C:\Windows\System\TVGGgkX.exe
  C:\Windows\System\TVGGgkX.exe
  2⤵
  PID:9540
- C:\Windows\System\aAzzcmA.exe
  C:\Windows\System\aAzzcmA.exe
  2⤵
  PID:9556
- C:\Windows\System\mvzktfq.exe
  C:\Windows\System\mvzktfq.exe
  2⤵
  PID:9572
- C:\Windows\System\fXFgsYk.exe
  C:\Windows\System\fXFgsYk.exe
  2⤵
  PID:9588
- C:\Windows\System\kJUNhjj.exe
  C:\Windows\System\kJUNhjj.exe
  2⤵
  PID:9604
- C:\Windows\System\anRBqvB.exe
  C:\Windows\System\anRBqvB.exe
  2⤵
  PID:9620
- C:\Windows\System\tYvNmYa.exe
  C:\Windows\System\tYvNmYa.exe
  2⤵
  PID:9636
- C:\Windows\System\ksjLdfT.exe
  C:\Windows\System\ksjLdfT.exe
  2⤵
  PID:9652
- C:\Windows\System\ehVRhdd.exe
  C:\Windows\System\ehVRhdd.exe
  2⤵
  PID:9668
- C:\Windows\System\AqKmanX.exe
  C:\Windows\System\AqKmanX.exe
  2⤵
  PID:9684
- C:\Windows\System\WDozQlW.exe
  C:\Windows\System\WDozQlW.exe
  2⤵
  PID:9700
- C:\Windows\System\ZJQfIvE.exe
  C:\Windows\System\ZJQfIvE.exe
  2⤵
  PID:9716
- C:\Windows\System\bbiMXxV.exe
  C:\Windows\System\bbiMXxV.exe
  2⤵
  PID:9732
- C:\Windows\System\xbPsZVD.exe
  C:\Windows\System\xbPsZVD.exe
  2⤵
  PID:9748
- C:\Windows\System\BRKEDhM.exe
  C:\Windows\System\BRKEDhM.exe
  2⤵
  PID:9764
- C:\Windows\System\rMvAxfA.exe
  C:\Windows\System\rMvAxfA.exe
  2⤵
  PID:9780
- C:\Windows\System\PCygMNO.exe
  C:\Windows\System\PCygMNO.exe
  2⤵
  PID:9796
- C:\Windows\System\IDtqWda.exe
  C:\Windows\System\IDtqWda.exe
  2⤵
  PID:9812
- C:\Windows\System\eCthOCT.exe
  C:\Windows\System\eCthOCT.exe
  2⤵
  PID:9828
- C:\Windows\System\cqGAUOR.exe
  C:\Windows\System\cqGAUOR.exe
  2⤵
  PID:9844
- C:\Windows\System\iGsdlip.exe
  C:\Windows\System\iGsdlip.exe
  2⤵
  PID:9864
- C:\Windows\System\JGqZHAY.exe
  C:\Windows\System\JGqZHAY.exe
  2⤵
  PID:9972
- C:\Windows\System\VWvlgmT.exe
  C:\Windows\System\VWvlgmT.exe
  2⤵
  PID:9988
- C:\Windows\System\VeDmMUJ.exe
  C:\Windows\System\VeDmMUJ.exe
  2⤵
  PID:10004
- C:\Windows\System\CyHGgtd.exe
  C:\Windows\System\CyHGgtd.exe
  2⤵
  PID:10020
- C:\Windows\System\LgaMyMi.exe
  C:\Windows\System\LgaMyMi.exe
  2⤵
  PID:10040
- C:\Windows\System\QwLycMd.exe
  C:\Windows\System\QwLycMd.exe
  2⤵
  PID:10056
- C:\Windows\System\VwfElmp.exe
  C:\Windows\System\VwfElmp.exe
  2⤵
  PID:10072
- C:\Windows\System\oURvvjo.exe
  C:\Windows\System\oURvvjo.exe
  2⤵
  PID:10088
- C:\Windows\System\tvZsqqP.exe
  C:\Windows\System\tvZsqqP.exe
  2⤵
  PID:10104
- C:\Windows\System\atflJpb.exe
  C:\Windows\System\atflJpb.exe
  2⤵
  PID:10120
- C:\Windows\System\BhIYqow.exe
  C:\Windows\System\BhIYqow.exe
  2⤵
  PID:10148
- C:\Windows\System\CZtAcjg.exe
  C:\Windows\System\CZtAcjg.exe
  2⤵
  PID:10172
- C:\Windows\System\TZlLqaG.exe
  C:\Windows\System\TZlLqaG.exe
  2⤵
  PID:10188
- C:\Windows\System\cFEiRBN.exe
  C:\Windows\System\cFEiRBN.exe
  2⤵
  PID:10212
- C:\Windows\System\HRIcTIC.exe
  C:\Windows\System\HRIcTIC.exe
  2⤵
  PID:10232
- C:\Windows\System\AlrVQdu.exe
  C:\Windows\System\AlrVQdu.exe
  2⤵
  PID:8800
- C:\Windows\System\xHTWBXE.exe
  C:\Windows\System\xHTWBXE.exe
  2⤵
  PID:8628
- C:\Windows\System\SwWFBKC.exe
  C:\Windows\System\SwWFBKC.exe
  2⤵
  PID:9116
- C:\Windows\System\bSbIITf.exe
  C:\Windows\System\bSbIITf.exe
  2⤵
  PID:9020
- C:\Windows\System\FoeZvlr.exe
  C:\Windows\System\FoeZvlr.exe
  2⤵
  PID:9204
- C:\Windows\System\qkCLtLt.exe
  C:\Windows\System\qkCLtLt.exe
  2⤵
  PID:7436
- C:\Windows\System\EBFFhBQ.exe
  C:\Windows\System\EBFFhBQ.exe
  2⤵
  PID:9092
- C:\Windows\System\POySZtd.exe
  C:\Windows\System\POySZtd.exe
  2⤵
  PID:9276
- C:\Windows\System\EBdKTxm.exe
  C:\Windows\System\EBdKTxm.exe
  2⤵
  PID:9316
- C:\Windows\System\nwGAGwj.exe
  C:\Windows\System\nwGAGwj.exe
  2⤵
  PID:9340
- C:\Windows\System\JGRkoMf.exe
  C:\Windows\System\JGRkoMf.exe
  2⤵
  PID:9352
- C:\Windows\System\HikQMXc.exe
  C:\Windows\System\HikQMXc.exe
  2⤵
  PID:9412
- C:\Windows\System\zrtXzIB.exe
  C:\Windows\System\zrtXzIB.exe
  2⤵
  PID:9384
- C:\Windows\System\NYjuIMv.exe
  C:\Windows\System\NYjuIMv.exe
  2⤵
  PID:9492
- C:\Windows\System\agamnkH.exe
  C:\Windows\System\agamnkH.exe
  2⤵
  PID:9564
- C:\Windows\System\plmQwZW.exe
  C:\Windows\System\plmQwZW.exe
  2⤵
  PID:9444
- C:\Windows\System\MWQPfww.exe
  C:\Windows\System\MWQPfww.exe
  2⤵
  PID:9512
- C:\Windows\System\mrImVZt.exe
  C:\Windows\System\mrImVZt.exe
  2⤵
  PID:9580
- C:\Windows\System\NRAtDrI.exe
  C:\Windows\System\NRAtDrI.exe
  2⤵
  PID:9600
- C:\Windows\System\VMeaRrK.exe
  C:\Windows\System\VMeaRrK.exe
  2⤵
  PID:9628
- C:\Windows\System\wiqnCdT.exe
  C:\Windows\System\wiqnCdT.exe
  2⤵
  PID:9648
- C:\Windows\System\epvWejL.exe
  C:\Windows\System\epvWejL.exe
  2⤵
  PID:9696
- C:\Windows\System\UtAmHNQ.exe
  C:\Windows\System\UtAmHNQ.exe
  2⤵
  PID:9680
- C:\Windows\System\pvOhEJL.exe
  C:\Windows\System\pvOhEJL.exe
  2⤵
  PID:9788
- C:\Windows\System\UEKsKNc.exe
  C:\Windows\System\UEKsKNc.exe
  2⤵
  PID:9824
- C:\Windows\System\FigzOHk.exe
  C:\Windows\System\FigzOHk.exe
  2⤵
  PID:9776
- C:\Windows\System\nSnmVnZ.exe
  C:\Windows\System\nSnmVnZ.exe
  2⤵
  PID:9740
- C:\Windows\System\oQXYJoZ.exe
  C:\Windows\System\oQXYJoZ.exe
  2⤵
  PID:9892
- C:\Windows\System\TqjfISp.exe
  C:\Windows\System\TqjfISp.exe
  2⤵
  PID:9908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CRsRqIM.exe

Filesize
1.4MB

MD5
1d73832c697eb218beefb4c024edcf66

SHA1
7d4bcf028b12f8a54f4185c3b630ea61f6ef8ac7

SHA256
d9dadf7ed202259319a0ed94acdcfe49817135ab28b4a89f0363050c4636a94d

SHA512
917dae07c7b417c2c119b8852065c57369f2e215e7b2bed2dac9c9dc38261c0d8bc908def4a9cf7a1d8de848c7986d6e65eac2d6779604eb4301488fad7f25fd

Download Submit
C:\Windows\system\EkKVzdz.exe

Filesize
1.4MB

MD5
c7a37a692ef8e38c1c8e2a98aac9b001

SHA1
186d2a1e62169ffb9f5b775b316406caa2239a72

SHA256
eb18f236abbb3101a240fd60fee30081046cf69341e1723e870f2eb96290781c

SHA512
4e9ccf26baa4878e3f5c30f4e823a475dce3b79b232a125d0acdd521295f4dc501bd7be9ed7e568ea52194c98b8c6db9d1e5b4eb567fd4ce4058cca42484169f

Download Submit
C:\Windows\system\FzVHUoT.exe

Filesize
1.4MB

MD5
d198d2217f6b7ec5e49a90fa6fc75939

SHA1
d588282b4ed193e0d49ea840cc35110457534511

SHA256
3e0b38563ca4c32fee51e94384501608b2445aecc8547d2d1f78235814d38633

SHA512
f11a611789cdc1b437d60e4d74c990f0c44f6a2e6dfc58c9f2a09094e7257082244b5faa336f070ac55cfe4dff3526c6e70f0fc32660ad72bfe76fce10e5e5e3

Download Submit
C:\Windows\system\GfpUMKt.exe

Filesize
1.4MB

MD5
4541f82e009cbbd9a68abf530f02387a

SHA1
c955b800e25fc60649a1388560f6b93ea4fc55d5

SHA256
910aac276e6ef55139cedac6f793a1780d5bbe35df90a42ff64330fdd65c7e43

SHA512
80e7ac36a54c678a5fe1095af4a06037c59b654fe87ca32129696427fd119bb605aed74f4f91137cf5138739e560d9543438209427e69453b83040409ad9ac97

Download Submit
C:\Windows\system\GmpBvaN.exe

Filesize
1.4MB

MD5
6fa1c00a2d8196361c645a8c28abd0b9

SHA1
5b130db1d11fd8f3d85f42ef333278392f4d492b

SHA256
786a0fa7253aa4583ee7c06fd785315a6cd35a1ee35dc5fcffdda6844941cf30

SHA512
5f848bda36c47382d0537ca5590632c7dfdffce8d3af6e77a5faa4f57f8bc6ad76dab2ad1c0b899e25f4d9729ced8f8ae76d1ae7c3812ca575a3b6a93b01df88

Download Submit
C:\Windows\system\HpRDYor.exe

Filesize
1.4MB

MD5
7d1774be53e8645ae8c332e278c9a360

SHA1
67d956a9ce01edf150ac96adc3a38914ede092f4

SHA256
e92eb4c3847b88585ff7e7e88b64712ce2e2a8ae840e7b5a8a3f892e79a59cf7

SHA512
13df9c937d0e3b33ed84bd5c0cf5f89b0538739b48bf37475fbc6523b1513cc8a24dccc59333bfd061f952858734318b894e5cf3fb928ff3dd09f1eaeb7e0a87

Download Submit
C:\Windows\system\NABpkrH.exe

Filesize
1.4MB

MD5
ca49f5d994fc7bd52690d049cbfb6711

SHA1
c9a373a7e952f387e5ac21df136ff1ee635e102e

SHA256
064e48f26b09d61db1c5f45c7f547a269c97511f278cac8b30db57abd66e07c8

SHA512
d4c7b489cd861e90b4be19283b6e4fb91a5ee33aacc96733b17c176eb914c50584e10a83242f1763707cfbb5a579580f5c2923a3691b048bf2035c3e6b4535af

Download Submit
C:\Windows\system\OQwzDbk.exe

Filesize
1.4MB

MD5
e65a4a1649c4cdadad000b8fd5080966

SHA1
5f9b45fbe7c776d3e96b9a16385893f209facef6

SHA256
4b1e0d996daa7ce4fdc06bc06aa0872ff5633e40a78e8b001ab6de1ca835a89e

SHA512
af1ce0044d339ed9398aedfb250b3c9ed6eea3167d0abd9f9895b5c3b6fe4c1b5ed7da768cd2b5d716e26c48398cd73c928f2886331d124d55a85651e5a2310f

Download Submit
C:\Windows\system\TupWdCN.exe

Filesize
1.4MB

MD5
7b9299f79a3777130d16e8ef39ab2116

SHA1
8be7c12465872cbf302e0f355f1819290565eb22

SHA256
6c1ba8956a25eebea70d1aaae687a33c7f0576d558459692dfe894e7541acc4f

SHA512
ed03f04d9e877251776564653465863d6c6ab671afeb852d8526cbfecb921d87c68eb72d87ded1b8f08f25d8f729fe54b8afdd2ea448d2d5b0737428ede68bb4

Download Submit
C:\Windows\system\UBwUtbO.exe

Filesize
1.4MB

MD5
2c48334fd564c7a3f5d9e695ba514c52

SHA1
300843766c2b98de35e9f562bae3961c8d04554e

SHA256
61399c777ccaee2bb3ba70816ed0aae1b330ec8925f08f65489b31d7173f39d6

SHA512
5d970fe4718a4a81a452f9984f388cd373c91b8ecf52a84911b569d3cc6630a8d801c76c66a68b69247c7e2efad574089ddd14ea0f568b57e15b9958c66421b8

Download Submit
C:\Windows\system\YWLFMnJ.exe

Filesize
1.4MB

MD5
539a1c13eb2d234d81edfc2dc16d0c3e

SHA1
f167c549608cb805d6c02e2174b87a59bd736361

SHA256
96e28043cfc27a5a0204b49ac2a36b436595cc75550e52272fd0f36b54ddbed3

SHA512
7acee56c3144f4799a8e9ed3f0c543ef9dfe77b0d828437cca64fe3808c02f3a49fed3602b8d9b79c9fa77920a09af67c47e8c3d376fbb20f956c5f9bf3f831b

Download Submit
C:\Windows\system\YjOvzsr.exe

Filesize
1.4MB

MD5
b924c3c002b9819e0010d28ddb86590e

SHA1
dfc8ba6d19d08fb1e44b5fc97ddc6da28cca1954

SHA256
1c5036c92e13173c603b69087fd0275b81d86300700ee290d58a693d692e2805

SHA512
ebfb31e9afcc03f58a1a361f592a859513c1212055f1515d01318e80161a888b4455a136411d9d132249d8869a273a4e63831501cb54f6b4e4dbc6e98582c1e2

Download Submit
C:\Windows\system\ZyGwcTB.exe

Filesize
1.4MB

MD5
10f361515480a12d837e1f7f40950f23

SHA1
d2c8e5e2df62b0c1f7e9fcd31893db280782f487

SHA256
362193ad5e6134e232be03063c75cf29d84239b514b0385f889266611b914f24

SHA512
adaaf76dc1c9a5e302192d0a39d758854cb3365e4c26be8148f85a08d97d0d5a467eb5aa78f0b20e425868058e1cf5360270fa9fe17be1c55cfde05fdfefb5e2

Download Submit
C:\Windows\system\bROFHHl.exe

Filesize
1.4MB

MD5
18aa8f8f5904547419da9e110379c43f

SHA1
683df0b322c3b7282e6f735ba2694fc1438b02af

SHA256
1ee86ee9388a97664e990687f42a2272c003e8c32f5bcd4d2fafe101fa90eef2

SHA512
27d0ef093041d95c3338e6213427d70499b9304a0f94114c779a8d8ee31d7cfc684d3c3ce5d6e7eec5dfd7c7597fe3a0fbc5a22e2f035cb523232cbc6858aa32

Download Submit
C:\Windows\system\bWwCzah.exe

Filesize
1.4MB

MD5
9994645afc282b235a5044e418050ad8

SHA1
d07c062fb0579419169bf76613ebcaedf5197c66

SHA256
0a497614228ff3a03288a3731f56d5ca36ebb2fd675bb49f068049e9e32ddcf3

SHA512
7d4cd44bf4d1025f1d84c8e93ed67b29899dbabdf4f41b04e797452439c33b6658b28e7259fbe418e994e95236e660101a6a0ba7c71b9a28e244d0ea84c9efb1

Download Submit
C:\Windows\system\eNrXglm.exe

Filesize
1.4MB

MD5
59f88be81549128592ec27aae91ba941

SHA1
dfddefafdc16824d12f2061a8bf3469770f08b8f

SHA256
9a4ade311929674cb0e867163c09fddfd6eb2d1ed29a3f95e15bea3bfc8f4ac2

SHA512
329e0c4938f635c2148379d92e0147cca8165f10951c57ff0889f6cf0c31961d024c7d96e913e7fcb6d756650f59a0f9b717de16e008a9fd3993ca8b0f667544

Download Submit
C:\Windows\system\fieiWTE.exe

Filesize
1.4MB

MD5
54645c8b165931a2197d48d845436248

SHA1
a0a689f932afb36fd619beacb4bfe50401ef86d2

SHA256
36ff3c42e71b69d06135d10f808dff66c284c7624cc3395a5837df75099f05c6

SHA512
4e8b827c1abf3f930e072528173c5a75a9232a0c7afe361e21b19b05ae20d754f68df39a6ffe6bc9e2e0f9c379babd9a0dd777e723862f7c69e12dfbafdc6db7

Download Submit
C:\Windows\system\jNYEqqT.exe

Filesize
1.4MB

MD5
3397095727feb1d57576900058f58e80

SHA1
67fae997da67ee47c898e5e377e378ddcfeee37e

SHA256
4b2c84e8caf507e99404a1fb5f3a315f835d00511a92a4d3bffe8a5528af8c10

SHA512
8b39ee9062aaca08cb3d0f46cf801197771ded3a6f9cbe0955832d3fcd057af8f9c8d5d942ba887e2552472f1dc2375511cff282f0e678fb0c4c0bc8fe3cb767

Download Submit
C:\Windows\system\lOnQuLS.exe

Filesize
1.4MB

MD5
5734d8543c149f05f2d6b999b741288e

SHA1
524121bb2266c80ac72b3489b9235eafd78e61d6

SHA256
1d21f36551939fd7b4f269baf4f5f8e4fa64f18ccb3d512589ce47689a65ff8b

SHA512
b1ab2fb1b36d15024e2e0a0c9403031cf3643322bf4ae91283aad0ad6fc9fcfa2c0f1e6e4481a9d6bf863662090256571bf802bc33054d22d3d3d6196057a662

Download Submit
C:\Windows\system\mIUqgWj.exe

Filesize
1.4MB

MD5
e87a13a07b8187d721ba1009dbad2f94

SHA1
5b80562d64c3d571ead7c115a56ab92dab95080e

SHA256
b6bc680a14bfa2bce6dfb82e60d0b7251ba87fb35eeffe90f3e7654b96894062

SHA512
9f9386eeac20cd1e077889684a8431a575f4344c5c0449ce5509ba239f67efc097503c90f59886340ee853aea6c16548a202b1b5b80b033de51a6c5e9f3273d6

Download Submit
C:\Windows\system\mQDQQth.exe

Filesize
1.4MB

MD5
c1e6c37b21e82de485caea2f27004b01

SHA1
d4172da6465c634b36d548864bbb60a28bb2f33c

SHA256
5a8a2e01b81a78b6557960da8acd0002f4e4760691871372307d22fc62eaf506

SHA512
510d186a0fc5893f09b48d063e7fbb0e96e3cbd6bef31116f326d4f9d8da94739eb91c7460c94c8b165071d88bb4a3972f1bf8d55e083f05b28282c49469963d

Download Submit
C:\Windows\system\oGEpRfd.exe

Filesize
1.4MB

MD5
e9c10934df3a7e2256b8b43f31b6e8d9

SHA1
69df584a5dd482ddd5a993c2e1a7ef2dbcc3ed10

SHA256
2eb265dd078fc684635cba08b611415307c676feb2f9e9a9f7942536bafbf444

SHA512
9017daa8000b6c17f4ea35a1662720efba2b586c292ea720ff3f427286aa1dfc03b025c9dd256daf5485d73f8079877fd8b5f916ff50ff8be154bf2b54a5632b

Download Submit
C:\Windows\system\rwKDfLl.exe

Filesize
1.4MB

MD5
411410805789d4280d4a7ac8b6d50e2b

SHA1
6f4a65cabff56aec05a0314ea49e3d1f29af4304

SHA256
48638ca40d5c8f2caaec24c7cf72f1f87d4ece7d217293ffdc24c2435447e7fb

SHA512
1e7f6c14009f2e4fe0b5ae6073f4f919d421872e3c62091ed96b3e85ca3c7df4df68206df04c42bb7f1ac3e43d851823ac1f1f17fffde07dcaa7dd0500b366d7

Download Submit
C:\Windows\system\tdAouOM.exe

Filesize
1.4MB

MD5
1e6a3e268d1d60102f539062f0e1c0ae

SHA1
f2cd04543ffe939c07eb3261ce59bfd31f9a6b72

SHA256
46a4c43494b7739521d930db465d473194731de30824a9d75fb77eaf258e3cc3

SHA512
e538be8d06fc01ac893ab868dff0f4815da805c01ec166c28f8fff782ab64b0fed97ed34bbb98b2e2c81d2f50a34cbc77c9afe0f85f9241f6061e4a57c49b6d7

Download Submit
\Windows\system\BbDMeyR.exe

Filesize
1.4MB

MD5
6e8ee822aa95cf4133e5a238dd9dc171

SHA1
8e495901b805bedf7ed449b19c80358e1554aa25

SHA256
cd7b66caff536b4a3cf972eb49cde79d9f06a1ed1377b3eda912ffd69b8c3024

SHA512
ef2a7e3612ac7fcccb8ec91b012f4d3418792d0bdd1113c8053ffa1c863d89ce9987626a8f61c87f35fc3cf43b5a0d3c84cf017907715df6e141b44375bf1902

Download Submit
\Windows\system\GepsaRd.exe

Filesize
1.4MB

MD5
658f3714dc1495d25dbccea743ef791e

SHA1
77aa0c73087d56b30f4b18a7d9e81df05f35433d

SHA256
b0b40f18b089a2e5201c55aa62c6a205f01042e53d2ec68846a0fe88fd55c19f

SHA512
36bcf6285125778cad5aa432f1c5a613adf01551e46fe017e4e579391b89eff9ecf748098fc565bc3a81350adb9acf839513fef9f2d3439e5b0e32d59292c336

Download Submit
\Windows\system\agNdiko.exe

Filesize
1.4MB

MD5
c1a2e354a626b7b822038623d0ca82cc

SHA1
95e7a3f6305052de693b86a0054aa9d1ed037f9a

SHA256
e4b177b89de5c7eeaecce2f9f918c9d076e9ccda0da482f5335e1e0ccc04abf4

SHA512
45781935d525082760d9f383e0823993fd79e670bcd9823be799f048a97bd86b1df0223ccd431efabfe82849f530915268295b099e48b5baf95b0e1b27623951

Download Submit
\Windows\system\dqKriLn.exe

Filesize
1.4MB

MD5
882d2234b508c51efea9e13b2baf8e1a

SHA1
9c993e2790678386f2163d52a6fd3c6ec51201f7

SHA256
c28e2f02d579c5c8f996d36673ab00ad72bee8137f5ebae616e393eeb77f1e86

SHA512
94a4fb657c7148c143c0707b60252e654fb26856042215b0ac1b6925d84df25918ecf7555b24e659e73ceb198d953112a93ce8dbb6efe24c74d13c0fa359cbfd

Download Submit
\Windows\system\enczjVK.exe

Filesize
1.4MB

MD5
a95f93f2600ed587c708442943d7c450

SHA1
58187f9574f4fabd82dbdb8fa9d2c490bb22539d

SHA256
ac6207424ebc7c25168c5758008b2f4fa9a0c872297f0958a0d518476be054d7

SHA512
80ca807444a3681b7fb3e49265b4930cb973e82657f8e79500ec40fc496524340ee7f36a169045696d27d811471c5b4a911c7e3c36817a704cdcb0474ac2f2d0

Download Submit
\Windows\system\lgqSXDm.exe

Filesize
1.4MB

MD5
59e59e87ebd3f677cc31d8fd204ffd9d

SHA1
0633cca8c1b1baea7e53eac7495a7086115b8b4c

SHA256
10df8ba5ff3fb3e8a06e4a2801f91d7b6f43faf03d832571fa6484e5db029e37

SHA512
17ef1b83f119430bebb39cb126c29e3cc413235ec2bede64a6c8d9d94355d317b359b3c48cbe4f6acfcd304c33eee137b79cb992e9bdb316b53ac3b6b3c4217c

Download Submit
\Windows\system\snEnSEw.exe

Filesize
1.4MB

MD5
2cbf003a3ee3dbb1a1f7da60a6d308ea

SHA1
a37aba846fa39d749e5a2348b052e115bb80628e

SHA256
08eb7d118a97c612280738f42258e558a5a968e2a90f1dec451f5210c3c7ad04

SHA512
7919fbad295402270c2f506903c88d62bd3299575cc9e77bb98d261d8a23723c6d97b7e549003f310eec265ce28bbbf88133a5a35370375721f02bff0b7765da

Download Submit
\Windows\system\tQhWeUi.exe

Filesize
1.4MB

MD5
f3660570ade57259763fe89db5f86b74

SHA1
bb54d66be719936fa8c07b8b80379c4083bea0ff

SHA256
2c99635379bbc207ed3db953b537e6f70247fdd43e4788adfa9db20ed31d1093

SHA512
dc75498db8afd1b8035c235e8deb250454ccd6cc1516fb842658feace12743c81861cf348b7959f526a01938a07c01e9bba5c26c1ff22f718c0a384c2d7c9ba9

Download Submit
memory/636-106-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/636-3994-0x000000013F8E0000-0x000000013FC31000-memory.dmp

Filesize
3.3MB

Download
memory/2156-3852-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2156-9-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-50-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-1160-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2208-108-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2208-87-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-59-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-15-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-64-0x000000013F650000-0x000000013F9A1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-66-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2208-95-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-65-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-0-0x000000013F650000-0x000000013F9A1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-109-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-41-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2208-2807-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-80-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-8-0x000000013F290000-0x000000013F5E1000-memory.dmp

Filesize
3.3MB

Download
memory/2208-3529-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-21-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-27-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2208-34-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-3344-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2208-3031-0x0000000001E40000-0x0000000002191000-memory.dmp

Filesize
3.3MB

Download
memory/2456-3938-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2456-62-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-88-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2540-4000-0x000000013F5A0000-0x000000013F8F1000-memory.dmp

Filesize
3.3MB

Download
memory/2544-22-0x000000013F630000-0x000000013F981000-memory.dmp

Filesize
3.3MB

Download
memory/2544-3856-0x000000013F630000-0x000000013F981000-memory.dmp

Filesize
3.3MB

Download
memory/2544-86-0x000000013F630000-0x000000013F981000-memory.dmp

Filesize
3.3MB

Download
memory/2552-51-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2552-3935-0x000000013FF90000-0x00000001402E1000-memory.dmp

Filesize
3.3MB

Download
memory/2556-275-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2556-3932-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2556-42-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2560-67-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2560-3944-0x000000013F100000-0x000000013F451000-memory.dmp

Filesize
3.3MB

Download
memory/2640-94-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2640-28-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2640-3854-0x000000013FAE0000-0x000000013FE31000-memory.dmp

Filesize
3.3MB

Download
memory/2704-4020-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2704-1876-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2704-78-0x000000013FE40000-0x0000000140191000-memory.dmp

Filesize
3.3MB

Download
memory/2748-16-0x000000013F490000-0x000000013F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/2748-3844-0x000000013F490000-0x000000013F7E1000-memory.dmp

Filesize
3.3MB

Download
memory/2784-105-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2784-4027-0x000000013F970000-0x000000013FCC1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-3865-0x000000013F690000-0x000000013F9E1000-memory.dmp

Filesize
3.3MB

Download
memory/2884-37-0x000000013F690000-0x000000013F9E1000-memory.dmp

Filesize
3.3MB

Download
memory/2968-1496-0x000000013FF60000-0x00000001402B1000-memory.dmp

Filesize
3.3MB

Download
memory/2968-77-0x000000013FF60000-0x00000001402B1000-memory.dmp

Filesize
3.3MB

Download
memory/2968-3952-0x000000013FF60000-0x00000001402B1000-memory.dmp

Filesize
3.3MB

Download