xmrig | 4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
Size

1.5MB
MD5

0b8e999cbd596b05a9b2a0f1cfe4d1b0
SHA1

98051048bb0f782d8d441f85a6ced5f927d498b5
SHA256

4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da
SHA512

52bf9e11bbf5c22fe3c23d442c4d61e5c1e809111a3b1236679ed15d4af26623c9be74354649d6d3ac7ab1bc81fb1b36d64698576b3764de605b25c1ab355ede
SSDEEP

24576:RVIl/WDGCi7/qkatXBF6727uROGdN1W/x5qrWHJWf5LmKNGY35JuXb:ROdWCCi7/rahwNGx5c5Lm6eXb

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/3056-15-0x000000013F6D0000-0x000000013FA21000-memory.dmp	xmrig
behavioral1/memory/2140-407-0x000000013F5D0000-0x000000013F921000-memory.dmp	xmrig
behavioral1/memory/2652-73-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	xmrig
behavioral1/memory/1720-142-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig
behavioral1/memory/2140-76-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	xmrig
behavioral1/memory/756-96-0x000000013F980000-0x000000013FCD1000-memory.dmp	xmrig
behavioral1/memory/1996-81-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	xmrig
behavioral1/memory/2772-57-0x000000013F260000-0x000000013F5B1000-memory.dmp	xmrig
behavioral1/memory/2140-56-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	xmrig
behavioral1/memory/2508-55-0x000000013F5F0000-0x000000013F941000-memory.dmp	xmrig
behavioral1/memory/2636-49-0x000000013FB30000-0x000000013FE81000-memory.dmp	xmrig
behavioral1/memory/2728-24-0x000000013F4D0000-0x000000013F821000-memory.dmp	xmrig
behavioral1/memory/2576-13-0x000000013F040000-0x000000013F391000-memory.dmp	xmrig
behavioral1/memory/1996-3047-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	xmrig
behavioral1/memory/756-3694-0x000000013F980000-0x000000013FCD1000-memory.dmp	xmrig
behavioral1/memory/2868-3944-0x000000013F310000-0x000000013F661000-memory.dmp	xmrig
behavioral1/memory/2772-4118-0x000000013F260000-0x000000013F5B1000-memory.dmp	xmrig
behavioral1/memory/2508-4582-0x000000013F5F0000-0x000000013F941000-memory.dmp	xmrig
behavioral1/memory/2576-4584-0x000000013F040000-0x000000013F391000-memory.dmp	xmrig
behavioral1/memory/2728-4623-0x000000013F4D0000-0x000000013F821000-memory.dmp	xmrig
behavioral1/memory/2520-4640-0x000000013F5D0000-0x000000013F921000-memory.dmp	xmrig
behavioral1/memory/2652-4646-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	xmrig
behavioral1/memory/3056-4647-0x000000013F6D0000-0x000000013FA21000-memory.dmp	xmrig
behavioral1/memory/2636-4653-0x000000013FB30000-0x000000013FE81000-memory.dmp	xmrig
behavioral1/memory/1720-4652-0x000000013F640000-0x000000013F991000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2576	CmAMkFM.exe
3056	lxhFzBE.exe
2728	zYYaDtL.exe
2868	AvYzenK.exe
2636	bNSBgEA.exe
2508	TEeaRBh.exe
2772	YHzoiXe.exe
2520	CHcJTsA.exe
2652	JFeQMDQ.exe
1996	yIQBmaK.exe
1720	GSOnCtP.exe
756	OmbmLNF.exe
568	MVavcCn.exe
1640	CzjZGMp.exe
2844	bswXcIX.exe
656	SQiaqFJ.exe
2004	bgVZUiB.exe
2584	sMqpaSa.exe
2176	BxSUgNm.exe
1924	ZECGbef.exe
2096	sChwIYo.exe
976	jCurAtU.exe
752	nycNYDW.exe
1708	GvkqyTe.exe
796	UiimgTV.exe
2280	aWIqqKo.exe
2360	KKDMOPx.exe
3048	svNqSNr.exe
924	VoGKCEt.exe
2412	LyvTjZf.exe
2428	bgQUwAX.exe
1792	GisNqSc.exe
2296	IwgdbVA.exe
852	hlrbNOg.exe
2660	woQQvjl.exe
1976	zuXdVCt.exe
2444	LEEyHLG.exe
1576	KpExMET.exe
1620	NJuYweh.exe
1908	fLesUcj.exe
560	OlRlZse.exe
2012	raVweOp.exe
2680	oxSsJnN.exe
1760	xjJAMAM.exe
324	XyPyQyg.exe
1028	VbPCSYt.exe
2256	uFCmpBm.exe
1452	vvnxRWd.exe
316	YMwnLsO.exe
2976	itxLuoz.exe
1208	hhFNpLc.exe
2024	SLsSWgk.exe
2932	llPiaoK.exe
524	rwHmABB.exe
2236	ZSQjOWI.exe
2136	CbncNWI.exe
1512	qNzqKIS.exe
2916	ShGxnaV.exe
2912	fgDQQwQ.exe
2980	garnxUZ.exe
2752	QyLsHyS.exe
2480	EVjgaBm.exe
2168	QsWnEIc.exe
2696	PErOlJF.exe

Loads dropped DLL 64 IoCs

pid	Process
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2140-0-0x000000013F5D0000-0x000000013F921000-memory.dmp	upx
behavioral1/files/0x000b000000012294-3.dat	upx
behavioral1/memory/3056-15-0x000000013F6D0000-0x000000013FA21000-memory.dmp	upx
behavioral1/files/0x0008000000015c58-16.dat	upx
behavioral1/files/0x0009000000015c83-40.dat	upx
behavioral1/files/0x000c000000015602-65.dat	upx
behavioral1/files/0x0006000000016c76-99.dat	upx
behavioral1/files/0x0006000000016d5b-173.dat	upx
behavioral1/files/0x0006000000016d0a-187.dat	upx
behavioral1/memory/2140-407-0x000000013F5D0000-0x000000013F921000-memory.dmp	upx
behavioral1/files/0x0006000000016e6b-183.dat	upx
behavioral1/files/0x0006000000016d94-176.dat	upx
behavioral1/files/0x0006000000016d4c-167.dat	upx
behavioral1/files/0x0006000000016d2b-159.dat	upx
behavioral1/files/0x0006000000016cf8-153.dat	upx
behavioral1/files/0x0006000000016ce4-151.dat	upx
behavioral1/files/0x0006000000016ccb-147.dat	upx
behavioral1/files/0x0006000000017090-188.dat	upx
behavioral1/files/0x0006000000016af1-82.dat	upx
behavioral1/files/0x0006000000016d98-181.dat	upx
behavioral1/files/0x0006000000016d3c-164.dat	upx
behavioral1/files/0x0006000000016d0f-158.dat	upx
behavioral1/memory/2652-73-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	upx
behavioral1/memory/1720-142-0x000000013F640000-0x000000013F991000-memory.dmp	upx
behavioral1/files/0x0006000000016cfe-140.dat	upx
behavioral1/files/0x0006000000016cec-130.dat	upx
behavioral1/files/0x0006000000016c2a-102.dat	upx
behavioral1/files/0x0006000000016c07-101.dat	upx
behavioral1/files/0x0006000000016c21-125.dat	upx
behavioral1/files/0x0006000000016cdc-115.dat	upx
behavioral1/files/0x0006000000016c9d-113.dat	upx
behavioral1/files/0x0006000000016812-85.dat	upx
behavioral1/files/0x00060000000165fd-98.dat	upx
behavioral1/memory/756-96-0x000000013F980000-0x000000013FCD1000-memory.dmp	upx
behavioral1/memory/1996-81-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	upx
behavioral1/files/0x000600000001657c-80.dat	upx
behavioral1/files/0x00070000000162fd-42.dat	upx
behavioral1/memory/2868-34-0x000000013F310000-0x000000013F661000-memory.dmp	upx
behavioral1/memory/2520-59-0x000000013F5D0000-0x000000013F921000-memory.dmp	upx
behavioral1/memory/2772-57-0x000000013F260000-0x000000013F5B1000-memory.dmp	upx
behavioral1/files/0x000a000000015c79-32.dat	upx
behavioral1/memory/2508-55-0x000000013F5F0000-0x000000013F941000-memory.dmp	upx
behavioral1/files/0x000600000001644e-50.dat	upx
behavioral1/memory/2636-49-0x000000013FB30000-0x000000013FE81000-memory.dmp	upx
behavioral1/memory/2728-24-0x000000013F4D0000-0x000000013F821000-memory.dmp	upx
behavioral1/files/0x0007000000015c60-31.dat	upx
behavioral1/files/0x0007000000015c68-28.dat	upx
behavioral1/memory/2576-13-0x000000013F040000-0x000000013F391000-memory.dmp	upx
behavioral1/files/0x002f000000015561-10.dat	upx
behavioral1/memory/1996-3047-0x000000013F1A0000-0x000000013F4F1000-memory.dmp	upx
behavioral1/memory/756-3694-0x000000013F980000-0x000000013FCD1000-memory.dmp	upx
behavioral1/memory/2868-3944-0x000000013F310000-0x000000013F661000-memory.dmp	upx
behavioral1/memory/2772-4118-0x000000013F260000-0x000000013F5B1000-memory.dmp	upx
behavioral1/memory/2508-4582-0x000000013F5F0000-0x000000013F941000-memory.dmp	upx
behavioral1/memory/2576-4584-0x000000013F040000-0x000000013F391000-memory.dmp	upx
behavioral1/memory/2728-4623-0x000000013F4D0000-0x000000013F821000-memory.dmp	upx
behavioral1/memory/2520-4640-0x000000013F5D0000-0x000000013F921000-memory.dmp	upx
behavioral1/memory/2652-4646-0x000000013F9A0000-0x000000013FCF1000-memory.dmp	upx
behavioral1/memory/3056-4647-0x000000013F6D0000-0x000000013FA21000-memory.dmp	upx
behavioral1/memory/2636-4653-0x000000013FB30000-0x000000013FE81000-memory.dmp	upx
behavioral1/memory/1720-4652-0x000000013F640000-0x000000013F991000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rVzodJH.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\QGKhsiE.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\jejBdAf.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\egqrCVy.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\DziVrFF.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\RGPmibq.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\EafXwWo.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\OAvhwlZ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\RJvGWfX.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\UybOEBb.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\PnStPOC.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\bszFsZa.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\tXaWxZg.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\EkbsaTu.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\boxtequ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\LRsexrw.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\pFVzYHU.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\MztLWwD.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\vXFkPNx.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\sStjRiY.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\Gdmpoda.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\yhTGRLY.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\thooVtF.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\tnQckOX.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\lrRQvMb.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\qHRRuZE.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\mIsKvgf.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\RyOcLzd.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\jWNTGKt.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\TRsiqcH.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\WGeFhOd.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\LyymCtA.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\HUmWRLU.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\nNfVvsL.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\SsMHHeQ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\RufIOTZ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\EbykdBe.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\OytwmRX.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\SrrMKaq.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\lqFgoGn.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\OmkdMrb.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\saBxfCh.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\lOcyXsO.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\UiimgTV.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\VtybaxZ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\FsJArOJ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\BgIlcOZ.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\YDEQQwW.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\PObRUyx.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\CzdpsiX.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\pOoEnCw.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\VTYBgAj.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\wqFgefB.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\WJOlVfA.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\pruvavK.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\mQkuayh.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\QgvtxEo.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\RYTFDnc.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\nEYVqvV.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\OirCGmc.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\pGYUpie.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\KHUvFmU.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\tXxQOVX.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
File created	C:\Windows\System\RIZfqgA.exe	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2576	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	29
PID 2140 wrote to memory of 2576	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	29
PID 2140 wrote to memory of 2576	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	29
PID 2140 wrote to memory of 3056	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	30
PID 2140 wrote to memory of 3056	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	30
PID 2140 wrote to memory of 3056	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	30
PID 2140 wrote to memory of 2728	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2728	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2728	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	31
PID 2140 wrote to memory of 2636	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	32
PID 2140 wrote to memory of 2636	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	32
PID 2140 wrote to memory of 2636	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	32
PID 2140 wrote to memory of 2868	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	33
PID 2140 wrote to memory of 2868	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	33
PID 2140 wrote to memory of 2868	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	33
PID 2140 wrote to memory of 2520	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	34
PID 2140 wrote to memory of 2520	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	34
PID 2140 wrote to memory of 2520	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	34
PID 2140 wrote to memory of 2508	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	35
PID 2140 wrote to memory of 2508	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	35
PID 2140 wrote to memory of 2508	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	35
PID 2140 wrote to memory of 2652	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	36
PID 2140 wrote to memory of 2652	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	36
PID 2140 wrote to memory of 2652	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	36
PID 2140 wrote to memory of 2772	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	37
PID 2140 wrote to memory of 2772	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	37
PID 2140 wrote to memory of 2772	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	37
PID 2140 wrote to memory of 1720	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	38
PID 2140 wrote to memory of 1720	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	38
PID 2140 wrote to memory of 1720	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	38
PID 2140 wrote to memory of 1996	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	39
PID 2140 wrote to memory of 1996	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	39
PID 2140 wrote to memory of 1996	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	39
PID 2140 wrote to memory of 568	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	40
PID 2140 wrote to memory of 568	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	40
PID 2140 wrote to memory of 568	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	40
PID 2140 wrote to memory of 756	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	41
PID 2140 wrote to memory of 756	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	41
PID 2140 wrote to memory of 756	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	41
PID 2140 wrote to memory of 560	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	42
PID 2140 wrote to memory of 560	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	42
PID 2140 wrote to memory of 560	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	42
PID 2140 wrote to memory of 1640	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	43
PID 2140 wrote to memory of 1640	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	43
PID 2140 wrote to memory of 1640	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	43
PID 2140 wrote to memory of 2584	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	44
PID 2140 wrote to memory of 2584	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	44
PID 2140 wrote to memory of 2584	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	44
PID 2140 wrote to memory of 2844	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	45
PID 2140 wrote to memory of 2844	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	45
PID 2140 wrote to memory of 2844	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	45
PID 2140 wrote to memory of 2176	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	46
PID 2140 wrote to memory of 2176	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	46
PID 2140 wrote to memory of 2176	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	46
PID 2140 wrote to memory of 656	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	47
PID 2140 wrote to memory of 656	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	47
PID 2140 wrote to memory of 656	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	47
PID 2140 wrote to memory of 976	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	48
PID 2140 wrote to memory of 976	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	48
PID 2140 wrote to memory of 976	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	48
PID 2140 wrote to memory of 2004	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	49
PID 2140 wrote to memory of 2004	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	49
PID 2140 wrote to memory of 2004	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	49
PID 2140 wrote to memory of 752	2140	4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4fe15ff8fa11d9ad011ad8685dfe0b3ec7993468dff5462d7783ad5c616d62da_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Windows\System\CmAMkFM.exe
  C:\Windows\System\CmAMkFM.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\lxhFzBE.exe
  C:\Windows\System\lxhFzBE.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\zYYaDtL.exe
  C:\Windows\System\zYYaDtL.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\bNSBgEA.exe
  C:\Windows\System\bNSBgEA.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\AvYzenK.exe
  C:\Windows\System\AvYzenK.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\CHcJTsA.exe
  C:\Windows\System\CHcJTsA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\TEeaRBh.exe
  C:\Windows\System\TEeaRBh.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\JFeQMDQ.exe
  C:\Windows\System\JFeQMDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\YHzoiXe.exe
  C:\Windows\System\YHzoiXe.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\GSOnCtP.exe
  C:\Windows\System\GSOnCtP.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\yIQBmaK.exe
  C:\Windows\System\yIQBmaK.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\MVavcCn.exe
  C:\Windows\System\MVavcCn.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\OmbmLNF.exe
  C:\Windows\System\OmbmLNF.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\OlRlZse.exe
  C:\Windows\System\OlRlZse.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\CzjZGMp.exe
  C:\Windows\System\CzjZGMp.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\sMqpaSa.exe
  C:\Windows\System\sMqpaSa.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\bswXcIX.exe
  C:\Windows\System\bswXcIX.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\BxSUgNm.exe
  C:\Windows\System\BxSUgNm.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\SQiaqFJ.exe
  C:\Windows\System\SQiaqFJ.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\jCurAtU.exe
  C:\Windows\System\jCurAtU.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\bgVZUiB.exe
  C:\Windows\System\bgVZUiB.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\nycNYDW.exe
  C:\Windows\System\nycNYDW.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\ZECGbef.exe
  C:\Windows\System\ZECGbef.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\GvkqyTe.exe
  C:\Windows\System\GvkqyTe.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\sChwIYo.exe
  C:\Windows\System\sChwIYo.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\VoGKCEt.exe
  C:\Windows\System\VoGKCEt.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\UiimgTV.exe
  C:\Windows\System\UiimgTV.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\GisNqSc.exe
  C:\Windows\System\GisNqSc.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\aWIqqKo.exe
  C:\Windows\System\aWIqqKo.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\IwgdbVA.exe
  C:\Windows\System\IwgdbVA.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\KKDMOPx.exe
  C:\Windows\System\KKDMOPx.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\woQQvjl.exe
  C:\Windows\System\woQQvjl.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\svNqSNr.exe
  C:\Windows\System\svNqSNr.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\LEEyHLG.exe
  C:\Windows\System\LEEyHLG.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\LyvTjZf.exe
  C:\Windows\System\LyvTjZf.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\fLesUcj.exe
  C:\Windows\System\fLesUcj.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\bgQUwAX.exe
  C:\Windows\System\bgQUwAX.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\raVweOp.exe
  C:\Windows\System\raVweOp.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\hlrbNOg.exe
  C:\Windows\System\hlrbNOg.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\oxSsJnN.exe
  C:\Windows\System\oxSsJnN.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\zuXdVCt.exe
  C:\Windows\System\zuXdVCt.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\xjJAMAM.exe
  C:\Windows\System\xjJAMAM.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\KpExMET.exe
  C:\Windows\System\KpExMET.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\XyPyQyg.exe
  C:\Windows\System\XyPyQyg.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\NJuYweh.exe
  C:\Windows\System\NJuYweh.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\VbPCSYt.exe
  C:\Windows\System\VbPCSYt.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\uFCmpBm.exe
  C:\Windows\System\uFCmpBm.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\YMwnLsO.exe
  C:\Windows\System\YMwnLsO.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\vvnxRWd.exe
  C:\Windows\System\vvnxRWd.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\itxLuoz.exe
  C:\Windows\System\itxLuoz.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\hhFNpLc.exe
  C:\Windows\System\hhFNpLc.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\SLsSWgk.exe
  C:\Windows\System\SLsSWgk.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\llPiaoK.exe
  C:\Windows\System\llPiaoK.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\CbncNWI.exe
  C:\Windows\System\CbncNWI.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\rwHmABB.exe
  C:\Windows\System\rwHmABB.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\qNzqKIS.exe
  C:\Windows\System\qNzqKIS.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\ZSQjOWI.exe
  C:\Windows\System\ZSQjOWI.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ShGxnaV.exe
  C:\Windows\System\ShGxnaV.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\fgDQQwQ.exe
  C:\Windows\System\fgDQQwQ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\PErOlJF.exe
  C:\Windows\System\PErOlJF.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\garnxUZ.exe
  C:\Windows\System\garnxUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\vIGmwrl.exe
  C:\Windows\System\vIGmwrl.exe
  2⤵
  PID:3036
- C:\Windows\System\QyLsHyS.exe
  C:\Windows\System\QyLsHyS.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\PmoiDRx.exe
  C:\Windows\System\PmoiDRx.exe
  2⤵
  PID:2884
- C:\Windows\System\EVjgaBm.exe
  C:\Windows\System\EVjgaBm.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\rCoOVVi.exe
  C:\Windows\System\rCoOVVi.exe
  2⤵
  PID:2528
- C:\Windows\System\QsWnEIc.exe
  C:\Windows\System\QsWnEIc.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\PCSttpX.exe
  C:\Windows\System\PCSttpX.exe
  2⤵
  PID:2956
- C:\Windows\System\WbgKPsZ.exe
  C:\Windows\System\WbgKPsZ.exe
  2⤵
  PID:1232
- C:\Windows\System\hqjPyEv.exe
  C:\Windows\System\hqjPyEv.exe
  2⤵
  PID:536
- C:\Windows\System\WPoSydK.exe
  C:\Windows\System\WPoSydK.exe
  2⤵
  PID:2688
- C:\Windows\System\WwQrHXy.exe
  C:\Windows\System\WwQrHXy.exe
  2⤵
  PID:2836
- C:\Windows\System\swhOPyW.exe
  C:\Windows\System\swhOPyW.exe
  2⤵
  PID:1676
- C:\Windows\System\vJPfSmw.exe
  C:\Windows\System\vJPfSmw.exe
  2⤵
  PID:932
- C:\Windows\System\GSkxOaZ.exe
  C:\Windows\System\GSkxOaZ.exe
  2⤵
  PID:2900
- C:\Windows\System\roXoogN.exe
  C:\Windows\System\roXoogN.exe
  2⤵
  PID:1684
- C:\Windows\System\ybyPDJB.exe
  C:\Windows\System\ybyPDJB.exe
  2⤵
  PID:2276
- C:\Windows\System\evCUFUJ.exe
  C:\Windows\System\evCUFUJ.exe
  2⤵
  PID:436
- C:\Windows\System\ZLCJbMe.exe
  C:\Windows\System\ZLCJbMe.exe
  2⤵
  PID:1252
- C:\Windows\System\KOwIroA.exe
  C:\Windows\System\KOwIroA.exe
  2⤵
  PID:2780
- C:\Windows\System\rtUEBRz.exe
  C:\Windows\System\rtUEBRz.exe
  2⤵
  PID:2364
- C:\Windows\System\mvvhQwG.exe
  C:\Windows\System\mvvhQwG.exe
  2⤵
  PID:884
- C:\Windows\System\sXLwAZi.exe
  C:\Windows\System\sXLwAZi.exe
  2⤵
  PID:2456
- C:\Windows\System\PvxipVy.exe
  C:\Windows\System\PvxipVy.exe
  2⤵
  PID:968
- C:\Windows\System\ZoyezhW.exe
  C:\Windows\System\ZoyezhW.exe
  2⤵
  PID:1808
- C:\Windows\System\ksNYlTT.exe
  C:\Windows\System\ksNYlTT.exe
  2⤵
  PID:972
- C:\Windows\System\PGxXvsP.exe
  C:\Windows\System\PGxXvsP.exe
  2⤵
  PID:1332
- C:\Windows\System\IHTIfuj.exe
  C:\Windows\System\IHTIfuj.exe
  2⤵
  PID:1732
- C:\Windows\System\uvZctwL.exe
  C:\Windows\System\uvZctwL.exe
  2⤵
  PID:1960
- C:\Windows\System\sUmSmxe.exe
  C:\Windows\System\sUmSmxe.exe
  2⤵
  PID:1244
- C:\Windows\System\BOxysrS.exe
  C:\Windows\System\BOxysrS.exe
  2⤵
  PID:2964
- C:\Windows\System\HsLICmg.exe
  C:\Windows\System\HsLICmg.exe
  2⤵
  PID:2020
- C:\Windows\System\tMYtdGy.exe
  C:\Windows\System\tMYtdGy.exe
  2⤵
  PID:2172
- C:\Windows\System\ehfayDq.exe
  C:\Windows\System\ehfayDq.exe
  2⤵
  PID:1596
- C:\Windows\System\fgHxJdD.exe
  C:\Windows\System\fgHxJdD.exe
  2⤵
  PID:2732
- C:\Windows\System\zWsBJgc.exe
  C:\Windows\System\zWsBJgc.exe
  2⤵
  PID:2300
- C:\Windows\System\oQgRcRC.exe
  C:\Windows\System\oQgRcRC.exe
  2⤵
  PID:2864
- C:\Windows\System\EsRkMUC.exe
  C:\Windows\System\EsRkMUC.exe
  2⤵
  PID:576
- C:\Windows\System\zapsPZi.exe
  C:\Windows\System\zapsPZi.exe
  2⤵
  PID:2748
- C:\Windows\System\MmyTzpn.exe
  C:\Windows\System\MmyTzpn.exe
  2⤵
  PID:2504
- C:\Windows\System\VygVbEz.exe
  C:\Windows\System\VygVbEz.exe
  2⤵
  PID:2712
- C:\Windows\System\AoZaHNK.exe
  C:\Windows\System\AoZaHNK.exe
  2⤵
  PID:2856
- C:\Windows\System\EZfgTUI.exe
  C:\Windows\System\EZfgTUI.exe
  2⤵
  PID:1696
- C:\Windows\System\TwlWAjr.exe
  C:\Windows\System\TwlWAjr.exe
  2⤵
  PID:2184
- C:\Windows\System\fkgYDWw.exe
  C:\Windows\System\fkgYDWw.exe
  2⤵
  PID:2612
- C:\Windows\System\WzWuiga.exe
  C:\Windows\System\WzWuiga.exe
  2⤵
  PID:2268
- C:\Windows\System\TdcaGWS.exe
  C:\Windows\System\TdcaGWS.exe
  2⤵
  PID:2668
- C:\Windows\System\WGeFhOd.exe
  C:\Windows\System\WGeFhOd.exe
  2⤵
  PID:928
- C:\Windows\System\UWmtATD.exe
  C:\Windows\System\UWmtATD.exe
  2⤵
  PID:2388
- C:\Windows\System\ANWvSmI.exe
  C:\Windows\System\ANWvSmI.exe
  2⤵
  PID:1536
- C:\Windows\System\PwtBtJl.exe
  C:\Windows\System\PwtBtJl.exe
  2⤵
  PID:2896
- C:\Windows\System\ecesVlY.exe
  C:\Windows\System\ecesVlY.exe
  2⤵
  PID:2744
- C:\Windows\System\ZKbcFyu.exe
  C:\Windows\System\ZKbcFyu.exe
  2⤵
  PID:264
- C:\Windows\System\dykXGAx.exe
  C:\Windows\System\dykXGAx.exe
  2⤵
  PID:1612
- C:\Windows\System\OYbXKof.exe
  C:\Windows\System\OYbXKof.exe
  2⤵
  PID:3060
- C:\Windows\System\jPfcLIL.exe
  C:\Windows\System\jPfcLIL.exe
  2⤵
  PID:1952
- C:\Windows\System\kvLxLyH.exe
  C:\Windows\System\kvLxLyH.exe
  2⤵
  PID:2716
- C:\Windows\System\RIYeZGe.exe
  C:\Windows\System\RIYeZGe.exe
  2⤵
  PID:2968
- C:\Windows\System\FbBpZxw.exe
  C:\Windows\System\FbBpZxw.exe
  2⤵
  PID:2800
- C:\Windows\System\coInPzJ.exe
  C:\Windows\System\coInPzJ.exe
  2⤵
  PID:2936
- C:\Windows\System\DkqnbcF.exe
  C:\Windows\System\DkqnbcF.exe
  2⤵
  PID:2068
- C:\Windows\System\LTJYBmq.exe
  C:\Windows\System\LTJYBmq.exe
  2⤵
  PID:2768
- C:\Windows\System\spZWOOW.exe
  C:\Windows\System\spZWOOW.exe
  2⤵
  PID:2436
- C:\Windows\System\ZnMyyjV.exe
  C:\Windows\System\ZnMyyjV.exe
  2⤵
  PID:744
- C:\Windows\System\tPMDkQW.exe
  C:\Windows\System\tPMDkQW.exe
  2⤵
  PID:2588
- C:\Windows\System\hxoAIbz.exe
  C:\Windows\System\hxoAIbz.exe
  2⤵
  PID:544
- C:\Windows\System\CLbEdbJ.exe
  C:\Windows\System\CLbEdbJ.exe
  2⤵
  PID:2832
- C:\Windows\System\HRfdvAs.exe
  C:\Windows\System\HRfdvAs.exe
  2⤵
  PID:1652
- C:\Windows\System\JwOWLlK.exe
  C:\Windows\System\JwOWLlK.exe
  2⤵
  PID:1904
- C:\Windows\System\PiCQtOg.exe
  C:\Windows\System\PiCQtOg.exe
  2⤵
  PID:2792
- C:\Windows\System\vgqfgUK.exe
  C:\Windows\System\vgqfgUK.exe
  2⤵
  PID:2804
- C:\Windows\System\qgGsndM.exe
  C:\Windows\System\qgGsndM.exe
  2⤵
  PID:612
- C:\Windows\System\dTPtAmG.exe
  C:\Windows\System\dTPtAmG.exe
  2⤵
  PID:520
- C:\Windows\System\TfXkqWJ.exe
  C:\Windows\System\TfXkqWJ.exe
  2⤵
  PID:1992
- C:\Windows\System\RzaNZZi.exe
  C:\Windows\System\RzaNZZi.exe
  2⤵
  PID:2656
- C:\Windows\System\HZkFpou.exe
  C:\Windows\System\HZkFpou.exe
  2⤵
  PID:864
- C:\Windows\System\DuomlPY.exe
  C:\Windows\System\DuomlPY.exe
  2⤵
  PID:1556
- C:\Windows\System\EbykdBe.exe
  C:\Windows\System\EbykdBe.exe
  2⤵
  PID:1848
- C:\Windows\System\BnDkKgY.exe
  C:\Windows\System\BnDkKgY.exe
  2⤵
  PID:272
- C:\Windows\System\BogoyeJ.exe
  C:\Windows\System\BogoyeJ.exe
  2⤵
  PID:908
- C:\Windows\System\DkHQqza.exe
  C:\Windows\System\DkHQqza.exe
  2⤵
  PID:2788
- C:\Windows\System\NJAGOwU.exe
  C:\Windows\System\NJAGOwU.exe
  2⤵
  PID:904
- C:\Windows\System\EsNnqkW.exe
  C:\Windows\System\EsNnqkW.exe
  2⤵
  PID:3028
- C:\Windows\System\tHKLXkT.exe
  C:\Windows\System\tHKLXkT.exe
  2⤵
  PID:2724
- C:\Windows\System\GDtOYZZ.exe
  C:\Windows\System\GDtOYZZ.exe
  2⤵
  PID:1324
- C:\Windows\System\gLPCABy.exe
  C:\Windows\System\gLPCABy.exe
  2⤵
  PID:2952
- C:\Windows\System\neOSJvg.exe
  C:\Windows\System\neOSJvg.exe
  2⤵
  PID:1748
- C:\Windows\System\ypcLkoj.exe
  C:\Windows\System\ypcLkoj.exe
  2⤵
  PID:2620
- C:\Windows\System\ykGoeWP.exe
  C:\Windows\System\ykGoeWP.exe
  2⤵
  PID:1284
- C:\Windows\System\gjpJwev.exe
  C:\Windows\System\gjpJwev.exe
  2⤵
  PID:1660
- C:\Windows\System\kqFvmKG.exe
  C:\Windows\System\kqFvmKG.exe
  2⤵
  PID:1800
- C:\Windows\System\ZNldhag.exe
  C:\Windows\System\ZNldhag.exe
  2⤵
  PID:1836
- C:\Windows\System\cBuxazL.exe
  C:\Windows\System\cBuxazL.exe
  2⤵
  PID:3016
- C:\Windows\System\WIAPkoj.exe
  C:\Windows\System\WIAPkoj.exe
  2⤵
  PID:1240
- C:\Windows\System\WJPFTZM.exe
  C:\Windows\System\WJPFTZM.exe
  2⤵
  PID:2100
- C:\Windows\System\pcPNXFD.exe
  C:\Windows\System\pcPNXFD.exe
  2⤵
  PID:1700
- C:\Windows\System\ElnVHDx.exe
  C:\Windows\System\ElnVHDx.exe
  2⤵
  PID:1656
- C:\Windows\System\IqLNKRf.exe
  C:\Windows\System\IqLNKRf.exe
  2⤵
  PID:1632
- C:\Windows\System\XHDcXhc.exe
  C:\Windows\System\XHDcXhc.exe
  2⤵
  PID:1300
- C:\Windows\System\UzmuziA.exe
  C:\Windows\System\UzmuziA.exe
  2⤵
  PID:2304
- C:\Windows\System\DmcGLkk.exe
  C:\Windows\System\DmcGLkk.exe
  2⤵
  PID:2076
- C:\Windows\System\XToxtKX.exe
  C:\Windows\System\XToxtKX.exe
  2⤵
  PID:2032
- C:\Windows\System\tVTJDuj.exe
  C:\Windows\System\tVTJDuj.exe
  2⤵
  PID:1584
- C:\Windows\System\BifcBAi.exe
  C:\Windows\System\BifcBAi.exe
  2⤵
  PID:1444
- C:\Windows\System\prPfRRg.exe
  C:\Windows\System\prPfRRg.exe
  2⤵
  PID:1528
- C:\Windows\System\EXBVqDp.exe
  C:\Windows\System\EXBVqDp.exe
  2⤵
  PID:820
- C:\Windows\System\eFDELRI.exe
  C:\Windows\System\eFDELRI.exe
  2⤵
  PID:664
- C:\Windows\System\QhHkGMA.exe
  C:\Windows\System\QhHkGMA.exe
  2⤵
  PID:2880
- C:\Windows\System\GPVxmdi.exe
  C:\Windows\System\GPVxmdi.exe
  2⤵
  PID:1132
- C:\Windows\System\xvRdWRg.exe
  C:\Windows\System\xvRdWRg.exe
  2⤵
  PID:2908
- C:\Windows\System\DAKQfGO.exe
  C:\Windows\System\DAKQfGO.exe
  2⤵
  PID:2552
- C:\Windows\System\wmhGMVp.exe
  C:\Windows\System\wmhGMVp.exe
  2⤵
  PID:2348
- C:\Windows\System\MaVubaK.exe
  C:\Windows\System\MaVubaK.exe
  2⤵
  PID:1740
- C:\Windows\System\zwTRkHS.exe
  C:\Windows\System\zwTRkHS.exe
  2⤵
  PID:2196
- C:\Windows\System\LjIrfsx.exe
  C:\Windows\System\LjIrfsx.exe
  2⤵
  PID:2488
- C:\Windows\System\CvPSrbn.exe
  C:\Windows\System\CvPSrbn.exe
  2⤵
  PID:464
- C:\Windows\System\TrQuzym.exe
  C:\Windows\System\TrQuzym.exe
  2⤵
  PID:2040
- C:\Windows\System\OytwmRX.exe
  C:\Windows\System\OytwmRX.exe
  2⤵
  PID:2328
- C:\Windows\System\EukBLWc.exe
  C:\Windows\System\EukBLWc.exe
  2⤵
  PID:872
- C:\Windows\System\AjHcEmx.exe
  C:\Windows\System\AjHcEmx.exe
  2⤵
  PID:2116
- C:\Windows\System\ldihfhF.exe
  C:\Windows\System\ldihfhF.exe
  2⤵
  PID:1844
- C:\Windows\System\PtZSCxb.exe
  C:\Windows\System\PtZSCxb.exe
  2⤵
  PID:1776
- C:\Windows\System\GbbqFHu.exe
  C:\Windows\System\GbbqFHu.exe
  2⤵
  PID:2948
- C:\Windows\System\ziPFost.exe
  C:\Windows\System\ziPFost.exe
  2⤵
  PID:1988
- C:\Windows\System\BeOCalB.exe
  C:\Windows\System\BeOCalB.exe
  2⤵
  PID:2648
- C:\Windows\System\lknvdbD.exe
  C:\Windows\System\lknvdbD.exe
  2⤵
  PID:1304
- C:\Windows\System\nOmggGR.exe
  C:\Windows\System\nOmggGR.exe
  2⤵
  PID:1796
- C:\Windows\System\CzqVMQr.exe
  C:\Windows\System\CzqVMQr.exe
  2⤵
  PID:3076
- C:\Windows\System\vUYcOqD.exe
  C:\Windows\System\vUYcOqD.exe
  2⤵
  PID:3092
- C:\Windows\System\HQmsxuL.exe
  C:\Windows\System\HQmsxuL.exe
  2⤵
  PID:3108
- C:\Windows\System\VpEHSjA.exe
  C:\Windows\System\VpEHSjA.exe
  2⤵
  PID:3128
- C:\Windows\System\xgUQrdk.exe
  C:\Windows\System\xgUQrdk.exe
  2⤵
  PID:3144
- C:\Windows\System\CZaaxvG.exe
  C:\Windows\System\CZaaxvG.exe
  2⤵
  PID:3160
- C:\Windows\System\pJzFOom.exe
  C:\Windows\System\pJzFOom.exe
  2⤵
  PID:3180
- C:\Windows\System\saYEYyo.exe
  C:\Windows\System\saYEYyo.exe
  2⤵
  PID:3196
- C:\Windows\System\FLncogs.exe
  C:\Windows\System\FLncogs.exe
  2⤵
  PID:3212
- C:\Windows\System\RqlRoZz.exe
  C:\Windows\System\RqlRoZz.exe
  2⤵
  PID:3228
- C:\Windows\System\FELGAAd.exe
  C:\Windows\System\FELGAAd.exe
  2⤵
  PID:3244
- C:\Windows\System\nEYVqvV.exe
  C:\Windows\System\nEYVqvV.exe
  2⤵
  PID:3260
- C:\Windows\System\XujwbRq.exe
  C:\Windows\System\XujwbRq.exe
  2⤵
  PID:3276
- C:\Windows\System\iGLgtEl.exe
  C:\Windows\System\iGLgtEl.exe
  2⤵
  PID:3292
- C:\Windows\System\MoQFPsY.exe
  C:\Windows\System\MoQFPsY.exe
  2⤵
  PID:3308
- C:\Windows\System\dfZIdGE.exe
  C:\Windows\System\dfZIdGE.exe
  2⤵
  PID:3324
- C:\Windows\System\bdOuqjk.exe
  C:\Windows\System\bdOuqjk.exe
  2⤵
  PID:3344
- C:\Windows\System\yrXVdGf.exe
  C:\Windows\System\yrXVdGf.exe
  2⤵
  PID:3360
- C:\Windows\System\PtHBVnp.exe
  C:\Windows\System\PtHBVnp.exe
  2⤵
  PID:3376
- C:\Windows\System\SCRgzaE.exe
  C:\Windows\System\SCRgzaE.exe
  2⤵
  PID:3436
- C:\Windows\System\uIiXWdK.exe
  C:\Windows\System\uIiXWdK.exe
  2⤵
  PID:3452
- C:\Windows\System\KquPsQS.exe
  C:\Windows\System\KquPsQS.exe
  2⤵
  PID:3468
- C:\Windows\System\sjRSDWX.exe
  C:\Windows\System\sjRSDWX.exe
  2⤵
  PID:3484
- C:\Windows\System\EXgslJO.exe
  C:\Windows\System\EXgslJO.exe
  2⤵
  PID:3500
- C:\Windows\System\lkMWkuz.exe
  C:\Windows\System\lkMWkuz.exe
  2⤵
  PID:3516
- C:\Windows\System\QugBEPZ.exe
  C:\Windows\System\QugBEPZ.exe
  2⤵
  PID:3532
- C:\Windows\System\sHDksxR.exe
  C:\Windows\System\sHDksxR.exe
  2⤵
  PID:3644
- C:\Windows\System\ayGWSSw.exe
  C:\Windows\System\ayGWSSw.exe
  2⤵
  PID:3660
- C:\Windows\System\XLejZXb.exe
  C:\Windows\System\XLejZXb.exe
  2⤵
  PID:3676
- C:\Windows\System\iAMFKNf.exe
  C:\Windows\System\iAMFKNf.exe
  2⤵
  PID:3692
- C:\Windows\System\NHVUnoc.exe
  C:\Windows\System\NHVUnoc.exe
  2⤵
  PID:3716
- C:\Windows\System\SXThnjX.exe
  C:\Windows\System\SXThnjX.exe
  2⤵
  PID:3736
- C:\Windows\System\SwbRuch.exe
  C:\Windows\System\SwbRuch.exe
  2⤵
  PID:3752
- C:\Windows\System\mBsmhdE.exe
  C:\Windows\System\mBsmhdE.exe
  2⤵
  PID:3768
- C:\Windows\System\pJUatNz.exe
  C:\Windows\System\pJUatNz.exe
  2⤵
  PID:3788
- C:\Windows\System\vEYpmpc.exe
  C:\Windows\System\vEYpmpc.exe
  2⤵
  PID:3804
- C:\Windows\System\WgXLkpx.exe
  C:\Windows\System\WgXLkpx.exe
  2⤵
  PID:3820
- C:\Windows\System\KCZuEuY.exe
  C:\Windows\System\KCZuEuY.exe
  2⤵
  PID:3844
- C:\Windows\System\DuCfBNw.exe
  C:\Windows\System\DuCfBNw.exe
  2⤵
  PID:3860
- C:\Windows\System\IHaCaQj.exe
  C:\Windows\System\IHaCaQj.exe
  2⤵
  PID:3876
- C:\Windows\System\ekIMYTv.exe
  C:\Windows\System\ekIMYTv.exe
  2⤵
  PID:3892
- C:\Windows\System\uQMYkGJ.exe
  C:\Windows\System\uQMYkGJ.exe
  2⤵
  PID:3912
- C:\Windows\System\vfFXftb.exe
  C:\Windows\System\vfFXftb.exe
  2⤵
  PID:3928
- C:\Windows\System\ovUdIdK.exe
  C:\Windows\System\ovUdIdK.exe
  2⤵
  PID:3944
- C:\Windows\System\ehzfgfX.exe
  C:\Windows\System\ehzfgfX.exe
  2⤵
  PID:3964
- C:\Windows\System\MPDgXnS.exe
  C:\Windows\System\MPDgXnS.exe
  2⤵
  PID:3984
- C:\Windows\System\heeUnzv.exe
  C:\Windows\System\heeUnzv.exe
  2⤵
  PID:4048
- C:\Windows\System\gNHBBzG.exe
  C:\Windows\System\gNHBBzG.exe
  2⤵
  PID:4064
- C:\Windows\System\awqpcrD.exe
  C:\Windows\System\awqpcrD.exe
  2⤵
  PID:4080
- C:\Windows\System\OtenmpS.exe
  C:\Windows\System\OtenmpS.exe
  2⤵
  PID:2760
- C:\Windows\System\pEAywXW.exe
  C:\Windows\System\pEAywXW.exe
  2⤵
  PID:2288
- C:\Windows\System\nchbmbd.exe
  C:\Windows\System\nchbmbd.exe
  2⤵
  PID:3088
- C:\Windows\System\stOzgSj.exe
  C:\Windows\System\stOzgSj.exe
  2⤵
  PID:3188
- C:\Windows\System\DQymiBk.exe
  C:\Windows\System\DQymiBk.exe
  2⤵
  PID:3224
- C:\Windows\System\JRMhJfi.exe
  C:\Windows\System\JRMhJfi.exe
  2⤵
  PID:3288
- C:\Windows\System\gTXXkpt.exe
  C:\Windows\System\gTXXkpt.exe
  2⤵
  PID:3432
- C:\Windows\System\plYagcO.exe
  C:\Windows\System\plYagcO.exe
  2⤵
  PID:3404
- C:\Windows\System\YRwozdH.exe
  C:\Windows\System\YRwozdH.exe
  2⤵
  PID:3420
- C:\Windows\System\EkbsaTu.exe
  C:\Windows\System\EkbsaTu.exe
  2⤵
  PID:2988
- C:\Windows\System\XsOuhtP.exe
  C:\Windows\System\XsOuhtP.exe
  2⤵
  PID:1012
- C:\Windows\System\YrtWNZR.exe
  C:\Windows\System\YrtWNZR.exe
  2⤵
  PID:3136
- C:\Windows\System\LyymCtA.exe
  C:\Windows\System\LyymCtA.exe
  2⤵
  PID:3172
- C:\Windows\System\ZRrGuOh.exe
  C:\Windows\System\ZRrGuOh.exe
  2⤵
  PID:3332
- C:\Windows\System\HtqJxsQ.exe
  C:\Windows\System\HtqJxsQ.exe
  2⤵
  PID:3372
- C:\Windows\System\roEGrBo.exe
  C:\Windows\System\roEGrBo.exe
  2⤵
  PID:3480
- C:\Windows\System\MwHgoxB.exe
  C:\Windows\System\MwHgoxB.exe
  2⤵
  PID:3548
- C:\Windows\System\MzBmgIW.exe
  C:\Windows\System\MzBmgIW.exe
  2⤵
  PID:3588
- C:\Windows\System\uIlXTmd.exe
  C:\Windows\System\uIlXTmd.exe
  2⤵
  PID:3616
- C:\Windows\System\IWAXymp.exe
  C:\Windows\System\IWAXymp.exe
  2⤵
  PID:3632
- C:\Windows\System\Lnroopc.exe
  C:\Windows\System\Lnroopc.exe
  2⤵
  PID:3652
- C:\Windows\System\wbWXKvy.exe
  C:\Windows\System\wbWXKvy.exe
  2⤵
  PID:3656
- C:\Windows\System\GcVVHUv.exe
  C:\Windows\System\GcVVHUv.exe
  2⤵
  PID:3712
- C:\Windows\System\riFLFuS.exe
  C:\Windows\System\riFLFuS.exe
  2⤵
  PID:3796
- C:\Windows\System\rYqcsps.exe
  C:\Windows\System\rYqcsps.exe
  2⤵
  PID:3800
- C:\Windows\System\TroLYJZ.exe
  C:\Windows\System\TroLYJZ.exe
  2⤵
  PID:3900
- C:\Windows\System\VSQsQRC.exe
  C:\Windows\System\VSQsQRC.exe
  2⤵
  PID:3908
- C:\Windows\System\kGdacku.exe
  C:\Windows\System\kGdacku.exe
  2⤵
  PID:3972
- C:\Windows\System\dHXsbfw.exe
  C:\Windows\System\dHXsbfw.exe
  2⤵
  PID:3884
- C:\Windows\System\psdSxxH.exe
  C:\Windows\System\psdSxxH.exe
  2⤵
  PID:3780
- C:\Windows\System\XqhAVdU.exe
  C:\Windows\System\XqhAVdU.exe
  2⤵
  PID:3856
- C:\Windows\System\tHUCrTu.exe
  C:\Windows\System\tHUCrTu.exe
  2⤵
  PID:3952
- C:\Windows\System\LKBrAzJ.exe
  C:\Windows\System\LKBrAzJ.exe
  2⤵
  PID:4008
- C:\Windows\System\VtybaxZ.exe
  C:\Windows\System\VtybaxZ.exe
  2⤵
  PID:4028
- C:\Windows\System\UxaTNUx.exe
  C:\Windows\System\UxaTNUx.exe
  2⤵
  PID:4040
- C:\Windows\System\VLxqafy.exe
  C:\Windows\System\VLxqafy.exe
  2⤵
  PID:4060
- C:\Windows\System\YaIOvvt.exe
  C:\Windows\System\YaIOvvt.exe
  2⤵
  PID:3416
- C:\Windows\System\meWrGpt.exe
  C:\Windows\System\meWrGpt.exe
  2⤵
  PID:4072
- C:\Windows\System\LsJmyNe.exe
  C:\Windows\System\LsJmyNe.exe
  2⤵
  PID:3156
- C:\Windows\System\DZRjerp.exe
  C:\Windows\System\DZRjerp.exe
  2⤵
  PID:3464
- C:\Windows\System\LIJiCGk.exe
  C:\Windows\System\LIJiCGk.exe
  2⤵
  PID:3460
- C:\Windows\System\boxtequ.exe
  C:\Windows\System\boxtequ.exe
  2⤵
  PID:3528
- C:\Windows\System\HwUqneH.exe
  C:\Windows\System\HwUqneH.exe
  2⤵
  PID:3272
- C:\Windows\System\GbtESax.exe
  C:\Windows\System\GbtESax.exe
  2⤵
  PID:3320
- C:\Windows\System\YAerDHl.exe
  C:\Windows\System\YAerDHl.exe
  2⤵
  PID:3444
- C:\Windows\System\dFoxlBX.exe
  C:\Windows\System\dFoxlBX.exe
  2⤵
  PID:3552
- C:\Windows\System\LAKBOjn.exe
  C:\Windows\System\LAKBOjn.exe
  2⤵
  PID:3812
- C:\Windows\System\aOjvPqB.exe
  C:\Windows\System\aOjvPqB.exe
  2⤵
  PID:3924
- C:\Windows\System\RxJOHVk.exe
  C:\Windows\System\RxJOHVk.exe
  2⤵
  PID:2708
- C:\Windows\System\Gdmpoda.exe
  C:\Windows\System\Gdmpoda.exe
  2⤵
  PID:3284
- C:\Windows\System\TSWseTn.exe
  C:\Windows\System\TSWseTn.exe
  2⤵
  PID:3448
- C:\Windows\System\CHOBBxO.exe
  C:\Windows\System\CHOBBxO.exe
  2⤵
  PID:3700
- C:\Windows\System\ZKmDuPb.exe
  C:\Windows\System\ZKmDuPb.exe
  2⤵
  PID:3124
- C:\Windows\System\FjnxxRN.exe
  C:\Windows\System\FjnxxRN.exe
  2⤵
  PID:3352
- C:\Windows\System\VNtHhXB.exe
  C:\Windows\System\VNtHhXB.exe
  2⤵
  PID:3744
- C:\Windows\System\SKuRclz.exe
  C:\Windows\System\SKuRclz.exe
  2⤵
  PID:4004
- C:\Windows\System\xDfxtpD.exe
  C:\Windows\System\xDfxtpD.exe
  2⤵
  PID:3412
- C:\Windows\System\LRnWCdj.exe
  C:\Windows\System\LRnWCdj.exe
  2⤵
  PID:3356
- C:\Windows\System\GCqJIkW.exe
  C:\Windows\System\GCqJIkW.exe
  2⤵
  PID:2940
- C:\Windows\System\yxiSFKp.exe
  C:\Windows\System\yxiSFKp.exe
  2⤵
  PID:3596
- C:\Windows\System\PlhRFYx.exe
  C:\Windows\System\PlhRFYx.exe
  2⤵
  PID:3636
- C:\Windows\System\zbWvTyy.exe
  C:\Windows\System\zbWvTyy.exe
  2⤵
  PID:3732
- C:\Windows\System\KuuzRdu.exe
  C:\Windows\System\KuuzRdu.exe
  2⤵
  PID:2312
- C:\Windows\System\MnyKetg.exe
  C:\Windows\System\MnyKetg.exe
  2⤵
  PID:3832
- C:\Windows\System\VLJwYua.exe
  C:\Windows\System\VLJwYua.exe
  2⤵
  PID:4092
- C:\Windows\System\TBJwtnJ.exe
  C:\Windows\System\TBJwtnJ.exe
  2⤵
  PID:3476
- C:\Windows\System\XylUXgj.exe
  C:\Windows\System\XylUXgj.exe
  2⤵
  PID:3268
- C:\Windows\System\YSkIlur.exe
  C:\Windows\System\YSkIlur.exe
  2⤵
  PID:3956
- C:\Windows\System\cvooTOB.exe
  C:\Windows\System\cvooTOB.exe
  2⤵
  PID:3392
- C:\Windows\System\NoOuETC.exe
  C:\Windows\System\NoOuETC.exe
  2⤵
  PID:3240
- C:\Windows\System\ZLKxUVS.exe
  C:\Windows\System\ZLKxUVS.exe
  2⤵
  PID:3584
- C:\Windows\System\RMlaMMq.exe
  C:\Windows\System\RMlaMMq.exe
  2⤵
  PID:3628
- C:\Windows\System\pwUgrCO.exe
  C:\Windows\System\pwUgrCO.exe
  2⤵
  PID:3608
- C:\Windows\System\lHVgqAU.exe
  C:\Windows\System\lHVgqAU.exe
  2⤵
  PID:3400
- C:\Windows\System\ouGLcKy.exe
  C:\Windows\System\ouGLcKy.exe
  2⤵
  PID:3996
- C:\Windows\System\OYeMJwm.exe
  C:\Windows\System\OYeMJwm.exe
  2⤵
  PID:3976
- C:\Windows\System\UKKZEwO.exe
  C:\Windows\System\UKKZEwO.exe
  2⤵
  PID:4116
- C:\Windows\System\KwFVuWc.exe
  C:\Windows\System\KwFVuWc.exe
  2⤵
  PID:4132
- C:\Windows\System\xIcDNuE.exe
  C:\Windows\System\xIcDNuE.exe
  2⤵
  PID:4148
- C:\Windows\System\LGDwRUo.exe
  C:\Windows\System\LGDwRUo.exe
  2⤵
  PID:4164
- C:\Windows\System\tXxQOVX.exe
  C:\Windows\System\tXxQOVX.exe
  2⤵
  PID:4184
- C:\Windows\System\hwNrBJc.exe
  C:\Windows\System\hwNrBJc.exe
  2⤵
  PID:4256
- C:\Windows\System\UcLtjgd.exe
  C:\Windows\System\UcLtjgd.exe
  2⤵
  PID:4284
- C:\Windows\System\JjXndpq.exe
  C:\Windows\System\JjXndpq.exe
  2⤵
  PID:4300
- C:\Windows\System\YuJNaZk.exe
  C:\Windows\System\YuJNaZk.exe
  2⤵
  PID:4320
- C:\Windows\System\gkwBagm.exe
  C:\Windows\System\gkwBagm.exe
  2⤵
  PID:4336
- C:\Windows\System\aNJTWkL.exe
  C:\Windows\System\aNJTWkL.exe
  2⤵
  PID:4372
- C:\Windows\System\qMrYRYs.exe
  C:\Windows\System\qMrYRYs.exe
  2⤵
  PID:4396
- C:\Windows\System\ndNsMXm.exe
  C:\Windows\System\ndNsMXm.exe
  2⤵
  PID:4416
- C:\Windows\System\kvaphxa.exe
  C:\Windows\System\kvaphxa.exe
  2⤵
  PID:4432
- C:\Windows\System\riTVwqi.exe
  C:\Windows\System\riTVwqi.exe
  2⤵
  PID:4448
- C:\Windows\System\fpJppsc.exe
  C:\Windows\System\fpJppsc.exe
  2⤵
  PID:4468
- C:\Windows\System\DlwfKKu.exe
  C:\Windows\System\DlwfKKu.exe
  2⤵
  PID:4484
- C:\Windows\System\sDFQHLr.exe
  C:\Windows\System\sDFQHLr.exe
  2⤵
  PID:4500
- C:\Windows\System\OtgsvCZ.exe
  C:\Windows\System\OtgsvCZ.exe
  2⤵
  PID:4516
- C:\Windows\System\SrrMKaq.exe
  C:\Windows\System\SrrMKaq.exe
  2⤵
  PID:4532
- C:\Windows\System\pgesrco.exe
  C:\Windows\System\pgesrco.exe
  2⤵
  PID:4548
- C:\Windows\System\HXibwmn.exe
  C:\Windows\System\HXibwmn.exe
  2⤵
  PID:4564
- C:\Windows\System\VKfgJto.exe
  C:\Windows\System\VKfgJto.exe
  2⤵
  PID:4580
- C:\Windows\System\JaKSYyv.exe
  C:\Windows\System\JaKSYyv.exe
  2⤵
  PID:4596
- C:\Windows\System\TTOHagT.exe
  C:\Windows\System\TTOHagT.exe
  2⤵
  PID:4612
- C:\Windows\System\xQGAdNL.exe
  C:\Windows\System\xQGAdNL.exe
  2⤵
  PID:4632
- C:\Windows\System\HPdAOWm.exe
  C:\Windows\System\HPdAOWm.exe
  2⤵
  PID:4648
- C:\Windows\System\RGPmibq.exe
  C:\Windows\System\RGPmibq.exe
  2⤵
  PID:4668
- C:\Windows\System\sJJkXJT.exe
  C:\Windows\System\sJJkXJT.exe
  2⤵
  PID:4684
- C:\Windows\System\Suspebl.exe
  C:\Windows\System\Suspebl.exe
  2⤵
  PID:4700
- C:\Windows\System\LXuoLMK.exe
  C:\Windows\System\LXuoLMK.exe
  2⤵
  PID:4716
- C:\Windows\System\kbbGWBh.exe
  C:\Windows\System\kbbGWBh.exe
  2⤵
  PID:4732
- C:\Windows\System\dBpvxMy.exe
  C:\Windows\System\dBpvxMy.exe
  2⤵
  PID:4748
- C:\Windows\System\TKyXDre.exe
  C:\Windows\System\TKyXDre.exe
  2⤵
  PID:4764
- C:\Windows\System\OBPBIgL.exe
  C:\Windows\System\OBPBIgL.exe
  2⤵
  PID:4780
- C:\Windows\System\LRsexrw.exe
  C:\Windows\System\LRsexrw.exe
  2⤵
  PID:4796
- C:\Windows\System\BXPCAih.exe
  C:\Windows\System\BXPCAih.exe
  2⤵
  PID:4812
- C:\Windows\System\fOInyEX.exe
  C:\Windows\System\fOInyEX.exe
  2⤵
  PID:4828
- C:\Windows\System\aYFOVVA.exe
  C:\Windows\System\aYFOVVA.exe
  2⤵
  PID:4844
- C:\Windows\System\YVQWqOX.exe
  C:\Windows\System\YVQWqOX.exe
  2⤵
  PID:4892
- C:\Windows\System\zwbmyrZ.exe
  C:\Windows\System\zwbmyrZ.exe
  2⤵
  PID:4908
- C:\Windows\System\twafwGv.exe
  C:\Windows\System\twafwGv.exe
  2⤵
  PID:4940
- C:\Windows\System\oxCEETH.exe
  C:\Windows\System\oxCEETH.exe
  2⤵
  PID:4960
- C:\Windows\System\mWNdCuJ.exe
  C:\Windows\System\mWNdCuJ.exe
  2⤵
  PID:4976
- C:\Windows\System\pKFPzVu.exe
  C:\Windows\System\pKFPzVu.exe
  2⤵
  PID:4992
- C:\Windows\System\KnlwyMe.exe
  C:\Windows\System\KnlwyMe.exe
  2⤵
  PID:5008
- C:\Windows\System\EGADUzR.exe
  C:\Windows\System\EGADUzR.exe
  2⤵
  PID:5024
- C:\Windows\System\TLHdOnR.exe
  C:\Windows\System\TLHdOnR.exe
  2⤵
  PID:5040
- C:\Windows\System\VbYNZBi.exe
  C:\Windows\System\VbYNZBi.exe
  2⤵
  PID:5056
- C:\Windows\System\HcVHzni.exe
  C:\Windows\System\HcVHzni.exe
  2⤵
  PID:5072
- C:\Windows\System\mydZmQg.exe
  C:\Windows\System\mydZmQg.exe
  2⤵
  PID:5088
- C:\Windows\System\dPUpOik.exe
  C:\Windows\System\dPUpOik.exe
  2⤵
  PID:5108
- C:\Windows\System\mIsKvgf.exe
  C:\Windows\System\mIsKvgf.exe
  2⤵
  PID:3980
- C:\Windows\System\BozhwVr.exe
  C:\Windows\System\BozhwVr.exe
  2⤵
  PID:2776
- C:\Windows\System\ulrYKVE.exe
  C:\Windows\System\ulrYKVE.exe
  2⤵
  PID:3220
- C:\Windows\System\xXNqCgc.exe
  C:\Windows\System\xXNqCgc.exe
  2⤵
  PID:4144
- C:\Windows\System\wjDQBvc.exe
  C:\Windows\System\wjDQBvc.exe
  2⤵
  PID:3816
- C:\Windows\System\XhPfOLO.exe
  C:\Windows\System\XhPfOLO.exe
  2⤵
  PID:1488
- C:\Windows\System\VqmvrLw.exe
  C:\Windows\System\VqmvrLw.exe
  2⤵
  PID:3920
- C:\Windows\System\tnjcHss.exe
  C:\Windows\System\tnjcHss.exe
  2⤵
  PID:4196
- C:\Windows\System\zfPLbku.exe
  C:\Windows\System\zfPLbku.exe
  2⤵
  PID:4208
- C:\Windows\System\ucMXVMZ.exe
  C:\Windows\System\ucMXVMZ.exe
  2⤵
  PID:4224
- C:\Windows\System\QiqqIzk.exe
  C:\Windows\System\QiqqIzk.exe
  2⤵
  PID:4240
- C:\Windows\System\ifhihMg.exe
  C:\Windows\System\ifhihMg.exe
  2⤵
  PID:4268
- C:\Windows\System\BMDKDaq.exe
  C:\Windows\System\BMDKDaq.exe
  2⤵
  PID:4276
- C:\Windows\System\BHnVlyv.exe
  C:\Windows\System\BHnVlyv.exe
  2⤵
  PID:4308
- C:\Windows\System\tuRRCdY.exe
  C:\Windows\System\tuRRCdY.exe
  2⤵
  PID:4344
- C:\Windows\System\zuLFESy.exe
  C:\Windows\System\zuLFESy.exe
  2⤵
  PID:4360
- C:\Windows\System\xNdxnOC.exe
  C:\Windows\System\xNdxnOC.exe
  2⤵
  PID:4404
- C:\Windows\System\dhGRXxV.exe
  C:\Windows\System\dhGRXxV.exe
  2⤵
  PID:4408
- C:\Windows\System\VSGisOg.exe
  C:\Windows\System\VSGisOg.exe
  2⤵
  PID:4440
- C:\Windows\System\LDYPcJl.exe
  C:\Windows\System\LDYPcJl.exe
  2⤵
  PID:4492
- C:\Windows\System\wGWbhZX.exe
  C:\Windows\System\wGWbhZX.exe
  2⤵
  PID:4528
- C:\Windows\System\LMcjhai.exe
  C:\Windows\System\LMcjhai.exe
  2⤵
  PID:4560
- C:\Windows\System\rVzodJH.exe
  C:\Windows\System\rVzodJH.exe
  2⤵
  PID:4544
- C:\Windows\System\HOGKWwH.exe
  C:\Windows\System\HOGKWwH.exe
  2⤵
  PID:4664
- C:\Windows\System\oWeEnpl.exe
  C:\Windows\System\oWeEnpl.exe
  2⤵
  PID:4696
- C:\Windows\System\ZgcqQYn.exe
  C:\Windows\System\ZgcqQYn.exe
  2⤵
  PID:4680
- C:\Windows\System\MjIsdWV.exe
  C:\Windows\System\MjIsdWV.exe
  2⤵
  PID:4708
- C:\Windows\System\XnYUGmi.exe
  C:\Windows\System\XnYUGmi.exe
  2⤵
  PID:4608
- C:\Windows\System\tElnfQP.exe
  C:\Windows\System\tElnfQP.exe
  2⤵
  PID:4820
- C:\Windows\System\kqPVxqX.exe
  C:\Windows\System\kqPVxqX.exe
  2⤵
  PID:4744
- C:\Windows\System\PHZIpzr.exe
  C:\Windows\System\PHZIpzr.exe
  2⤵
  PID:4852
- C:\Windows\System\XIvpKkJ.exe
  C:\Windows\System\XIvpKkJ.exe
  2⤵
  PID:4856
- C:\Windows\System\BJaNhCP.exe
  C:\Windows\System\BJaNhCP.exe
  2⤵
  PID:4872
- C:\Windows\System\BGmIMyM.exe
  C:\Windows\System\BGmIMyM.exe
  2⤵
  PID:4916
- C:\Windows\System\SzVfyVi.exe
  C:\Windows\System\SzVfyVi.exe
  2⤵
  PID:4920
- C:\Windows\System\PoatrmE.exe
  C:\Windows\System\PoatrmE.exe
  2⤵
  PID:4988
- C:\Windows\System\xilCrVo.exe
  C:\Windows\System\xilCrVo.exe
  2⤵
  PID:4956
- C:\Windows\System\ipolbKZ.exe
  C:\Windows\System\ipolbKZ.exe
  2⤵
  PID:5084
- C:\Windows\System\pCvOZUa.exe
  C:\Windows\System\pCvOZUa.exe
  2⤵
  PID:4020
- C:\Windows\System\zQtsvnV.exe
  C:\Windows\System\zQtsvnV.exe
  2⤵
  PID:3316
- C:\Windows\System\jNTGRer.exe
  C:\Windows\System\jNTGRer.exe
  2⤵
  PID:5004
- C:\Windows\System\RqbmXDg.exe
  C:\Windows\System\RqbmXDg.exe
  2⤵
  PID:5068
- C:\Windows\System\vHkNMSb.exe
  C:\Windows\System\vHkNMSb.exe
  2⤵
  PID:3540
- C:\Windows\System\GuEwiJh.exe
  C:\Windows\System\GuEwiJh.exe
  2⤵
  PID:4140
- C:\Windows\System\qDtJGHZ.exe
  C:\Windows\System\qDtJGHZ.exe
  2⤵
  PID:4156
- C:\Windows\System\XijgInB.exe
  C:\Windows\System\XijgInB.exe
  2⤵
  PID:4220
- C:\Windows\System\akUBeiQ.exe
  C:\Windows\System\akUBeiQ.exe
  2⤵
  PID:4296
- C:\Windows\System\uJuoBvi.exe
  C:\Windows\System\uJuoBvi.exe
  2⤵
  PID:4392
- C:\Windows\System\IBFDNnG.exe
  C:\Windows\System\IBFDNnG.exe
  2⤵
  PID:4316
- C:\Windows\System\kxaSdyC.exe
  C:\Windows\System\kxaSdyC.exe
  2⤵
  PID:4364
- C:\Windows\System\lkkFMSc.exe
  C:\Windows\System\lkkFMSc.exe
  2⤵
  PID:4428
- C:\Windows\System\TjJIjMC.exe
  C:\Windows\System\TjJIjMC.exe
  2⤵
  PID:4480
- C:\Windows\System\xWyEAnO.exe
  C:\Windows\System\xWyEAnO.exe
  2⤵
  PID:4624
- C:\Windows\System\SUQZnsS.exe
  C:\Windows\System\SUQZnsS.exe
  2⤵
  PID:4660
- C:\Windows\System\QtSizsZ.exe
  C:\Windows\System\QtSizsZ.exe
  2⤵
  PID:4692
- C:\Windows\System\ifkjGeO.exe
  C:\Windows\System\ifkjGeO.exe
  2⤵
  PID:4792
- C:\Windows\System\YMyFUyh.exe
  C:\Windows\System\YMyFUyh.exe
  2⤵
  PID:4776
- C:\Windows\System\UfrsnzU.exe
  C:\Windows\System\UfrsnzU.exe
  2⤵
  PID:4840
- C:\Windows\System\FTvDToX.exe
  C:\Windows\System\FTvDToX.exe
  2⤵
  PID:4952
- C:\Windows\System\vJXIGtR.exe
  C:\Windows\System\vJXIGtR.exe
  2⤵
  PID:4932
- C:\Windows\System\qvUnfUu.exe
  C:\Windows\System\qvUnfUu.exe
  2⤵
  PID:3840
- C:\Windows\System\MwWqaZH.exe
  C:\Windows\System\MwWqaZH.exe
  2⤵
  PID:4264
- C:\Windows\System\MaJfeka.exe
  C:\Windows\System\MaJfeka.exe
  2⤵
  PID:4212
- C:\Windows\System\uImjbRG.exe
  C:\Windows\System\uImjbRG.exe
  2⤵
  PID:3208
- C:\Windows\System\pFVzYHU.exe
  C:\Windows\System\pFVzYHU.exe
  2⤵
  PID:4112
- C:\Windows\System\KTyQhPz.exe
  C:\Windows\System\KTyQhPz.exe
  2⤵
  PID:4388
- C:\Windows\System\JJFzGMn.exe
  C:\Windows\System\JJFzGMn.exe
  2⤵
  PID:4292
- C:\Windows\System\LeAkGDa.exe
  C:\Windows\System\LeAkGDa.exe
  2⤵
  PID:4628
- C:\Windows\System\wkmuRwG.exe
  C:\Windows\System\wkmuRwG.exe
  2⤵
  PID:4620
- C:\Windows\System\XWnkUBU.exe
  C:\Windows\System\XWnkUBU.exe
  2⤵
  PID:4524
- C:\Windows\System\hEaKrpj.exe
  C:\Windows\System\hEaKrpj.exe
  2⤵
  PID:4884
- C:\Windows\System\IJVdjvZ.exe
  C:\Windows\System\IJVdjvZ.exe
  2⤵
  PID:3704
- C:\Windows\System\yAFLGMu.exe
  C:\Windows\System\yAFLGMu.exe
  2⤵
  PID:4128
- C:\Windows\System\nyQXxfl.exe
  C:\Windows\System\nyQXxfl.exe
  2⤵
  PID:5104
- C:\Windows\System\YGfUCKY.exe
  C:\Windows\System\YGfUCKY.exe
  2⤵
  PID:5064
- C:\Windows\System\IprIQxv.exe
  C:\Windows\System\IprIQxv.exe
  2⤵
  PID:4232
- C:\Windows\System\qzxKkLg.exe
  C:\Windows\System\qzxKkLg.exe
  2⤵
  PID:4236
- C:\Windows\System\ZxHQIQv.exe
  C:\Windows\System\ZxHQIQv.exe
  2⤵
  PID:4808
- C:\Windows\System\iLkTyOC.exe
  C:\Windows\System\iLkTyOC.exe
  2⤵
  PID:4760
- C:\Windows\System\HCPIVEb.exe
  C:\Windows\System\HCPIVEb.exe
  2⤵
  PID:4540
- C:\Windows\System\yPHRLNW.exe
  C:\Windows\System\yPHRLNW.exe
  2⤵
  PID:5136
- C:\Windows\System\mInCXpX.exe
  C:\Windows\System\mInCXpX.exe
  2⤵
  PID:5152
- C:\Windows\System\KUBcvSV.exe
  C:\Windows\System\KUBcvSV.exe
  2⤵
  PID:5172
- C:\Windows\System\HCkqmGD.exe
  C:\Windows\System\HCkqmGD.exe
  2⤵
  PID:5188
- C:\Windows\System\AQBABQh.exe
  C:\Windows\System\AQBABQh.exe
  2⤵
  PID:5204
- C:\Windows\System\vMzdsUv.exe
  C:\Windows\System\vMzdsUv.exe
  2⤵
  PID:5220
- C:\Windows\System\eQcRjuk.exe
  C:\Windows\System\eQcRjuk.exe
  2⤵
  PID:5244
- C:\Windows\System\dlunUEG.exe
  C:\Windows\System\dlunUEG.exe
  2⤵
  PID:5260
- C:\Windows\System\LxODKZl.exe
  C:\Windows\System\LxODKZl.exe
  2⤵
  PID:5276
- C:\Windows\System\xzHloSa.exe
  C:\Windows\System\xzHloSa.exe
  2⤵
  PID:5292
- C:\Windows\System\BstxABS.exe
  C:\Windows\System\BstxABS.exe
  2⤵
  PID:5312
- C:\Windows\System\dJuLjYc.exe
  C:\Windows\System\dJuLjYc.exe
  2⤵
  PID:5336
- C:\Windows\System\uALCBpi.exe
  C:\Windows\System\uALCBpi.exe
  2⤵
  PID:5352
- C:\Windows\System\WALySeE.exe
  C:\Windows\System\WALySeE.exe
  2⤵
  PID:5368
- C:\Windows\System\FsJArOJ.exe
  C:\Windows\System\FsJArOJ.exe
  2⤵
  PID:5384
- C:\Windows\System\MxjjEZz.exe
  C:\Windows\System\MxjjEZz.exe
  2⤵
  PID:5400
- C:\Windows\System\jlMTCSD.exe
  C:\Windows\System\jlMTCSD.exe
  2⤵
  PID:5416
- C:\Windows\System\WmDBhZM.exe
  C:\Windows\System\WmDBhZM.exe
  2⤵
  PID:5432
- C:\Windows\System\HunUlhv.exe
  C:\Windows\System\HunUlhv.exe
  2⤵
  PID:5448
- C:\Windows\System\ytwVJfq.exe
  C:\Windows\System\ytwVJfq.exe
  2⤵
  PID:5464
- C:\Windows\System\aGlXmIz.exe
  C:\Windows\System\aGlXmIz.exe
  2⤵
  PID:5480
- C:\Windows\System\UJoOFEd.exe
  C:\Windows\System\UJoOFEd.exe
  2⤵
  PID:5496
- C:\Windows\System\JsrpsLb.exe
  C:\Windows\System\JsrpsLb.exe
  2⤵
  PID:5512
- C:\Windows\System\MoXXWxD.exe
  C:\Windows\System\MoXXWxD.exe
  2⤵
  PID:5528
- C:\Windows\System\ogogWog.exe
  C:\Windows\System\ogogWog.exe
  2⤵
  PID:5548
- C:\Windows\System\HWLuiSk.exe
  C:\Windows\System\HWLuiSk.exe
  2⤵
  PID:5564
- C:\Windows\System\bksMuDL.exe
  C:\Windows\System\bksMuDL.exe
  2⤵
  PID:5612
- C:\Windows\System\LYDqlLl.exe
  C:\Windows\System\LYDqlLl.exe
  2⤵
  PID:5652
- C:\Windows\System\CzdpsiX.exe
  C:\Windows\System\CzdpsiX.exe
  2⤵
  PID:5676
- C:\Windows\System\gWWthrt.exe
  C:\Windows\System\gWWthrt.exe
  2⤵
  PID:5692
- C:\Windows\System\QHitYVh.exe
  C:\Windows\System\QHitYVh.exe
  2⤵
  PID:5708
- C:\Windows\System\GORgXqa.exe
  C:\Windows\System\GORgXqa.exe
  2⤵
  PID:5724
- C:\Windows\System\gKxXKyg.exe
  C:\Windows\System\gKxXKyg.exe
  2⤵
  PID:5748
- C:\Windows\System\sgCsOzQ.exe
  C:\Windows\System\sgCsOzQ.exe
  2⤵
  PID:5852
- C:\Windows\System\bRvTSiS.exe
  C:\Windows\System\bRvTSiS.exe
  2⤵
  PID:5872
- C:\Windows\System\gwQuLkN.exe
  C:\Windows\System\gwQuLkN.exe
  2⤵
  PID:5892
- C:\Windows\System\LedAwpx.exe
  C:\Windows\System\LedAwpx.exe
  2⤵
  PID:5908
- C:\Windows\System\tHoIOzm.exe
  C:\Windows\System\tHoIOzm.exe
  2⤵
  PID:5924
- C:\Windows\System\SsEfxfN.exe
  C:\Windows\System\SsEfxfN.exe
  2⤵
  PID:5968
- C:\Windows\System\dpkLIaa.exe
  C:\Windows\System\dpkLIaa.exe
  2⤵
  PID:5988
- C:\Windows\System\ThaPpVk.exe
  C:\Windows\System\ThaPpVk.exe
  2⤵
  PID:6016
- C:\Windows\System\fYmKrFU.exe
  C:\Windows\System\fYmKrFU.exe
  2⤵
  PID:6036
- C:\Windows\System\KSCNHxE.exe
  C:\Windows\System\KSCNHxE.exe
  2⤵
  PID:6052
- C:\Windows\System\cmifboy.exe
  C:\Windows\System\cmifboy.exe
  2⤵
  PID:5200
- C:\Windows\System\QcQOinh.exe
  C:\Windows\System\QcQOinh.exe
  2⤵
  PID:5240
- C:\Windows\System\HUmWRLU.exe
  C:\Windows\System\HUmWRLU.exe
  2⤵
  PID:5308
- C:\Windows\System\PgdWupc.exe
  C:\Windows\System\PgdWupc.exe
  2⤵
  PID:4272
- C:\Windows\System\ezAqSov.exe
  C:\Windows\System\ezAqSov.exe
  2⤵
  PID:5256
- C:\Windows\System\VIwpGHm.exe
  C:\Windows\System\VIwpGHm.exe
  2⤵
  PID:5328
- C:\Windows\System\TwupvsC.exe
  C:\Windows\System\TwupvsC.exe
  2⤵
  PID:5360
- C:\Windows\System\LuwTMrJ.exe
  C:\Windows\System\LuwTMrJ.exe
  2⤵
  PID:5396
- C:\Windows\System\ABOWGaY.exe
  C:\Windows\System\ABOWGaY.exe
  2⤵
  PID:5488
- C:\Windows\System\oCKSrHL.exe
  C:\Windows\System\oCKSrHL.exe
  2⤵
  PID:5520
- C:\Windows\System\AGhlGPB.exe
  C:\Windows\System\AGhlGPB.exe
  2⤵
  PID:5572
- C:\Windows\System\YaUwmlC.exe
  C:\Windows\System\YaUwmlC.exe
  2⤵
  PID:5584
- C:\Windows\System\TzYLpFE.exe
  C:\Windows\System\TzYLpFE.exe
  2⤵
  PID:5608
- C:\Windows\System\jNRTocf.exe
  C:\Windows\System\jNRTocf.exe
  2⤵
  PID:5664
- C:\Windows\System\jBEKiqD.exe
  C:\Windows\System\jBEKiqD.exe
  2⤵
  PID:5636
- C:\Windows\System\QwxkFQv.exe
  C:\Windows\System\QwxkFQv.exe
  2⤵
  PID:5684
- C:\Windows\System\Pzzmfbe.exe
  C:\Windows\System\Pzzmfbe.exe
  2⤵
  PID:5732
- C:\Windows\System\qLTLLkJ.exe
  C:\Windows\System\qLTLLkJ.exe
  2⤵
  PID:5756
- C:\Windows\System\ouyUDDU.exe
  C:\Windows\System\ouyUDDU.exe
  2⤵
  PID:5864
- C:\Windows\System\dbKKRnf.exe
  C:\Windows\System\dbKKRnf.exe
  2⤵
  PID:5960
- C:\Windows\System\KAEBPRT.exe
  C:\Windows\System\KAEBPRT.exe
  2⤵
  PID:6044
- C:\Windows\System\NbIKIou.exe
  C:\Windows\System\NbIKIou.exe
  2⤵
  PID:6072
- C:\Windows\System\KgcwBnV.exe
  C:\Windows\System\KgcwBnV.exe
  2⤵
  PID:4948
- C:\Windows\System\yzBdzeE.exe
  C:\Windows\System\yzBdzeE.exe
  2⤵
  PID:5236
- C:\Windows\System\NsjysYf.exe
  C:\Windows\System\NsjysYf.exe
  2⤵
  PID:5800
- C:\Windows\System\faEHzGt.exe
  C:\Windows\System\faEHzGt.exe
  2⤵
  PID:5816
- C:\Windows\System\MqBQWcx.exe
  C:\Windows\System\MqBQWcx.exe
  2⤵
  PID:6024
- C:\Windows\System\PTwbBRS.exe
  C:\Windows\System\PTwbBRS.exe
  2⤵
  PID:6068
- C:\Windows\System\GauuYLT.exe
  C:\Windows\System\GauuYLT.exe
  2⤵
  PID:6088
- C:\Windows\System\AQhbRul.exe
  C:\Windows\System\AQhbRul.exe
  2⤵
  PID:6108
- C:\Windows\System\JuWiijb.exe
  C:\Windows\System\JuWiijb.exe
  2⤵
  PID:6128
- C:\Windows\System\OjLEtfC.exe
  C:\Windows\System\OjLEtfC.exe
  2⤵
  PID:4464
- C:\Windows\System\ttOeXrf.exe
  C:\Windows\System\ttOeXrf.exe
  2⤵
  PID:5196
- C:\Windows\System\nVWTZpQ.exe
  C:\Windows\System\nVWTZpQ.exe
  2⤵
  PID:4356
- C:\Windows\System\mMzMXYS.exe
  C:\Windows\System\mMzMXYS.exe
  2⤵
  PID:4572
- C:\Windows\System\qHgEdyA.exe
  C:\Windows\System\qHgEdyA.exe
  2⤵
  PID:5144
- C:\Windows\System\ooMwYKT.exe
  C:\Windows\System\ooMwYKT.exe
  2⤵
  PID:5216
- C:\Windows\System\qsZZALf.exe
  C:\Windows\System\qsZZALf.exe
  2⤵
  PID:5380
- C:\Windows\System\foBrcwC.exe
  C:\Windows\System\foBrcwC.exe
  2⤵
  PID:5444
- C:\Windows\System\LOHPiXe.exe
  C:\Windows\System\LOHPiXe.exe
  2⤵
  PID:5456
- C:\Windows\System\EVaZXhY.exe
  C:\Windows\System\EVaZXhY.exe
  2⤵
  PID:5544
- C:\Windows\System\oihKHzl.exe
  C:\Windows\System\oihKHzl.exe
  2⤵
  PID:5508
- C:\Windows\System\AJwYOLF.exe
  C:\Windows\System\AJwYOLF.exe
  2⤵
  PID:5576
- C:\Windows\System\eNbnDTd.exe
  C:\Windows\System\eNbnDTd.exe
  2⤵
  PID:236
- C:\Windows\System\BdXZbnM.exe
  C:\Windows\System\BdXZbnM.exe
  2⤵
  PID:5624
- C:\Windows\System\KfvCqjp.exe
  C:\Windows\System\KfvCqjp.exe
  2⤵
  PID:5716
- C:\Windows\System\RIMPaQg.exe
  C:\Windows\System\RIMPaQg.exe
  2⤵
  PID:5672
- C:\Windows\System\DqvceHN.exe
  C:\Windows\System\DqvceHN.exe
  2⤵
  PID:5736
- C:\Windows\System\lqFgoGn.exe
  C:\Windows\System\lqFgoGn.exe
  2⤵
  PID:5900
- C:\Windows\System\eXZXHwg.exe
  C:\Windows\System\eXZXHwg.exe
  2⤵
  PID:6012
- C:\Windows\System\TgwfWVm.exe
  C:\Windows\System\TgwfWVm.exe
  2⤵
  PID:5796
- C:\Windows\System\UYsVapr.exe
  C:\Windows\System\UYsVapr.exe
  2⤵
  PID:5920
- C:\Windows\System\VMgaqkl.exe
  C:\Windows\System\VMgaqkl.exe
  2⤵
  PID:5844
- C:\Windows\System\ZenoeyX.exe
  C:\Windows\System\ZenoeyX.exe
  2⤵
  PID:5888
- C:\Windows\System\LlGPovJ.exe
  C:\Windows\System\LlGPovJ.exe
  2⤵
  PID:6100
- C:\Windows\System\trbvhdD.exe
  C:\Windows\System\trbvhdD.exe
  2⤵
  PID:6136
- C:\Windows\System\zwqYqxk.exe
  C:\Windows\System\zwqYqxk.exe
  2⤵
  PID:5128
- C:\Windows\System\YfoiRDK.exe
  C:\Windows\System\YfoiRDK.exe
  2⤵
  PID:5036
- C:\Windows\System\htfOEka.exe
  C:\Windows\System\htfOEka.exe
  2⤵
  PID:4972
- C:\Windows\System\iFdpaGU.exe
  C:\Windows\System\iFdpaGU.exe
  2⤵
  PID:5440
- C:\Windows\System\AwoRvsk.exe
  C:\Windows\System\AwoRvsk.exe
  2⤵
  PID:5348
- C:\Windows\System\ZxUhJUl.exe
  C:\Windows\System\ZxUhJUl.exe
  2⤵
  PID:5556
- C:\Windows\System\RFiijWP.exe
  C:\Windows\System\RFiijWP.exe
  2⤵
  PID:5644
- C:\Windows\System\SduGIpn.exe
  C:\Windows\System\SduGIpn.exe
  2⤵
  PID:5904
- C:\Windows\System\GCUSSgg.exe
  C:\Windows\System\GCUSSgg.exe
  2⤵
  PID:6096
- C:\Windows\System\BytoPxS.exe
  C:\Windows\System\BytoPxS.exe
  2⤵
  PID:5812
- C:\Windows\System\ryNRDDy.exe
  C:\Windows\System\ryNRDDy.exe
  2⤵
  PID:6124
- C:\Windows\System\oyfwBsI.exe
  C:\Windows\System\oyfwBsI.exe
  2⤵
  PID:5880
- C:\Windows\System\GacAGqq.exe
  C:\Windows\System\GacAGqq.exe
  2⤵
  PID:5300
- C:\Windows\System\DfDnDht.exe
  C:\Windows\System\DfDnDht.exe
  2⤵
  PID:5828
- C:\Windows\System\cyyxPcA.exe
  C:\Windows\System\cyyxPcA.exe
  2⤵
  PID:6116
- C:\Windows\System\ZBzFjRu.exe
  C:\Windows\System\ZBzFjRu.exe
  2⤵
  PID:5392
- C:\Windows\System\WuDoCLD.exe
  C:\Windows\System\WuDoCLD.exe
  2⤵
  PID:5720
- C:\Windows\System\fRrMGNW.exe
  C:\Windows\System\fRrMGNW.exe
  2⤵
  PID:5824
- C:\Windows\System\rxNjnzv.exe
  C:\Windows\System\rxNjnzv.exe
  2⤵
  PID:6008
- C:\Windows\System\sPwnkSi.exe
  C:\Windows\System\sPwnkSi.exe
  2⤵
  PID:5132
- C:\Windows\System\KeMIhqK.exe
  C:\Windows\System\KeMIhqK.exe
  2⤵
  PID:6080
- C:\Windows\System\adMXTmV.exe
  C:\Windows\System\adMXTmV.exe
  2⤵
  PID:6120
- C:\Windows\System\TVNmqPv.exe
  C:\Windows\System\TVNmqPv.exe
  2⤵
  PID:5320
- C:\Windows\System\vzvBeON.exe
  C:\Windows\System\vzvBeON.exe
  2⤵
  PID:6152
- C:\Windows\System\UcaEGbZ.exe
  C:\Windows\System\UcaEGbZ.exe
  2⤵
  PID:6172
- C:\Windows\System\ScTGLLd.exe
  C:\Windows\System\ScTGLLd.exe
  2⤵
  PID:6188
- C:\Windows\System\fuffCLB.exe
  C:\Windows\System\fuffCLB.exe
  2⤵
  PID:6204
- C:\Windows\System\JCvwdKO.exe
  C:\Windows\System\JCvwdKO.exe
  2⤵
  PID:6220
- C:\Windows\System\xONErMV.exe
  C:\Windows\System\xONErMV.exe
  2⤵
  PID:6236
- C:\Windows\System\FCAbQVP.exe
  C:\Windows\System\FCAbQVP.exe
  2⤵
  PID:6252
- C:\Windows\System\Jhydcxd.exe
  C:\Windows\System\Jhydcxd.exe
  2⤵
  PID:6268
- C:\Windows\System\yoeoxUv.exe
  C:\Windows\System\yoeoxUv.exe
  2⤵
  PID:6284
- C:\Windows\System\IGoaZHa.exe
  C:\Windows\System\IGoaZHa.exe
  2⤵
  PID:6300
- C:\Windows\System\CGgYrfw.exe
  C:\Windows\System\CGgYrfw.exe
  2⤵
  PID:6316
- C:\Windows\System\QkCiglg.exe
  C:\Windows\System\QkCiglg.exe
  2⤵
  PID:6332
- C:\Windows\System\VoKpepo.exe
  C:\Windows\System\VoKpepo.exe
  2⤵
  PID:6348
- C:\Windows\System\yrjgyFj.exe
  C:\Windows\System\yrjgyFj.exe
  2⤵
  PID:6364
- C:\Windows\System\CNLrTsN.exe
  C:\Windows\System\CNLrTsN.exe
  2⤵
  PID:6380
- C:\Windows\System\FGCuqss.exe
  C:\Windows\System\FGCuqss.exe
  2⤵
  PID:6396
- C:\Windows\System\mLdqnhU.exe
  C:\Windows\System\mLdqnhU.exe
  2⤵
  PID:6412
- C:\Windows\System\elsGiUD.exe
  C:\Windows\System\elsGiUD.exe
  2⤵
  PID:6428
- C:\Windows\System\AgJyjBV.exe
  C:\Windows\System\AgJyjBV.exe
  2⤵
  PID:6444
- C:\Windows\System\TwJeDuQ.exe
  C:\Windows\System\TwJeDuQ.exe
  2⤵
  PID:6460
- C:\Windows\System\TCdFebf.exe
  C:\Windows\System\TCdFebf.exe
  2⤵
  PID:6476
- C:\Windows\System\EIODZSN.exe
  C:\Windows\System\EIODZSN.exe
  2⤵
  PID:6492
- C:\Windows\System\qOpDIRs.exe
  C:\Windows\System\qOpDIRs.exe
  2⤵
  PID:6508
- C:\Windows\System\XqILltj.exe
  C:\Windows\System\XqILltj.exe
  2⤵
  PID:6524
- C:\Windows\System\bnCJUFk.exe
  C:\Windows\System\bnCJUFk.exe
  2⤵
  PID:6540
- C:\Windows\System\CwdZQVX.exe
  C:\Windows\System\CwdZQVX.exe
  2⤵
  PID:6556
- C:\Windows\System\xETohRq.exe
  C:\Windows\System\xETohRq.exe
  2⤵
  PID:6572
- C:\Windows\System\mjeRrzh.exe
  C:\Windows\System\mjeRrzh.exe
  2⤵
  PID:6588
- C:\Windows\System\ByputtD.exe
  C:\Windows\System\ByputtD.exe
  2⤵
  PID:6604
- C:\Windows\System\qTzUJXj.exe
  C:\Windows\System\qTzUJXj.exe
  2⤵
  PID:6620
- C:\Windows\System\hMWoeAT.exe
  C:\Windows\System\hMWoeAT.exe
  2⤵
  PID:6636
- C:\Windows\System\XThfJhl.exe
  C:\Windows\System\XThfJhl.exe
  2⤵
  PID:6652
- C:\Windows\System\iZoPwav.exe
  C:\Windows\System\iZoPwav.exe
  2⤵
  PID:6668
- C:\Windows\System\JeJTyiF.exe
  C:\Windows\System\JeJTyiF.exe
  2⤵
  PID:6684
- C:\Windows\System\lBDIEVL.exe
  C:\Windows\System\lBDIEVL.exe
  2⤵
  PID:6700
- C:\Windows\System\MqNpiXM.exe
  C:\Windows\System\MqNpiXM.exe
  2⤵
  PID:6716
- C:\Windows\System\ZVsOXiC.exe
  C:\Windows\System\ZVsOXiC.exe
  2⤵
  PID:6732
- C:\Windows\System\EbUXytS.exe
  C:\Windows\System\EbUXytS.exe
  2⤵
  PID:6748
- C:\Windows\System\YNUlKza.exe
  C:\Windows\System\YNUlKza.exe
  2⤵
  PID:6768
- C:\Windows\System\rCilhWh.exe
  C:\Windows\System\rCilhWh.exe
  2⤵
  PID:6784
- C:\Windows\System\HqUpufT.exe
  C:\Windows\System\HqUpufT.exe
  2⤵
  PID:6804
- C:\Windows\System\nTuGtax.exe
  C:\Windows\System\nTuGtax.exe
  2⤵
  PID:6820
- C:\Windows\System\hVgZnrD.exe
  C:\Windows\System\hVgZnrD.exe
  2⤵
  PID:6840
- C:\Windows\System\zzxImBb.exe
  C:\Windows\System\zzxImBb.exe
  2⤵
  PID:6856
- C:\Windows\System\DOpvIvF.exe
  C:\Windows\System\DOpvIvF.exe
  2⤵
  PID:6876
- C:\Windows\System\KoZWrRl.exe
  C:\Windows\System\KoZWrRl.exe
  2⤵
  PID:6892
- C:\Windows\System\AQtPJcy.exe
  C:\Windows\System\AQtPJcy.exe
  2⤵
  PID:6908
- C:\Windows\System\CwKRGeF.exe
  C:\Windows\System\CwKRGeF.exe
  2⤵
  PID:6924
- C:\Windows\System\margnwh.exe
  C:\Windows\System\margnwh.exe
  2⤵
  PID:6940
- C:\Windows\System\GlQlWpe.exe
  C:\Windows\System\GlQlWpe.exe
  2⤵
  PID:6956
- C:\Windows\System\ZtmUppa.exe
  C:\Windows\System\ZtmUppa.exe
  2⤵
  PID:6972
- C:\Windows\System\lzmNisd.exe
  C:\Windows\System\lzmNisd.exe
  2⤵
  PID:6988
- C:\Windows\System\zOnrkrT.exe
  C:\Windows\System\zOnrkrT.exe
  2⤵
  PID:7004
- C:\Windows\System\SuEwYHo.exe
  C:\Windows\System\SuEwYHo.exe
  2⤵
  PID:7020
- C:\Windows\System\TVwBAjc.exe
  C:\Windows\System\TVwBAjc.exe
  2⤵
  PID:7036
- C:\Windows\System\kJjiVPE.exe
  C:\Windows\System\kJjiVPE.exe
  2⤵
  PID:7052
- C:\Windows\System\fkLFJSR.exe
  C:\Windows\System\fkLFJSR.exe
  2⤵
  PID:7072
- C:\Windows\System\hrWKhRi.exe
  C:\Windows\System\hrWKhRi.exe
  2⤵
  PID:7088
- C:\Windows\System\NKwFTHs.exe
  C:\Windows\System\NKwFTHs.exe
  2⤵
  PID:7104
- C:\Windows\System\EjJccwe.exe
  C:\Windows\System\EjJccwe.exe
  2⤵
  PID:7120
- C:\Windows\System\BiwdyIr.exe
  C:\Windows\System\BiwdyIr.exe
  2⤵
  PID:7136
- C:\Windows\System\NKQvmWz.exe
  C:\Windows\System\NKQvmWz.exe
  2⤵
  PID:7152
- C:\Windows\System\XkNwhNT.exe
  C:\Windows\System\XkNwhNT.exe
  2⤵
  PID:5540
- C:\Windows\System\CrfFfkW.exe
  C:\Windows\System\CrfFfkW.exe
  2⤵
  PID:5232
- C:\Windows\System\KiyNVHO.exe
  C:\Windows\System\KiyNVHO.exe
  2⤵
  PID:5184
- C:\Windows\System\vEILATl.exe
  C:\Windows\System\vEILATl.exe
  2⤵
  PID:5808
- C:\Windows\System\Neisdys.exe
  C:\Windows\System\Neisdys.exe
  2⤵
  PID:6228
- C:\Windows\System\RNHrgZb.exe
  C:\Windows\System\RNHrgZb.exe
  2⤵
  PID:6264
- C:\Windows\System\fpCLgWV.exe
  C:\Windows\System\fpCLgWV.exe
  2⤵
  PID:6184
- C:\Windows\System\kWjGgzR.exe
  C:\Windows\System\kWjGgzR.exe
  2⤵
  PID:6280
- C:\Windows\System\HNPsDOc.exe
  C:\Windows\System\HNPsDOc.exe
  2⤵
  PID:6356
- C:\Windows\System\gIhslCI.exe
  C:\Windows\System\gIhslCI.exe
  2⤵
  PID:6388
- C:\Windows\System\NafFYGI.exe
  C:\Windows\System\NafFYGI.exe
  2⤵
  PID:6424
- C:\Windows\System\ZuYeGPP.exe
  C:\Windows\System\ZuYeGPP.exe
  2⤵
  PID:6468
- C:\Windows\System\lSVzEIC.exe
  C:\Windows\System\lSVzEIC.exe
  2⤵
  PID:6456
- C:\Windows\System\ZxZJOnD.exe
  C:\Windows\System\ZxZJOnD.exe
  2⤵
  PID:6520
- C:\Windows\System\tlXSPTP.exe
  C:\Windows\System\tlXSPTP.exe
  2⤵
  PID:6536
- C:\Windows\System\PKwTueF.exe
  C:\Windows\System\PKwTueF.exe
  2⤵
  PID:6596
- C:\Windows\System\mafsJvz.exe
  C:\Windows\System\mafsJvz.exe
  2⤵
  PID:6660
- C:\Windows\System\oEzjjbL.exe
  C:\Windows\System\oEzjjbL.exe
  2⤵
  PID:6696
- C:\Windows\System\itgVHtF.exe
  C:\Windows\System\itgVHtF.exe
  2⤵
  PID:6676
- C:\Windows\System\VEGpNmv.exe
  C:\Windows\System\VEGpNmv.exe
  2⤵
  PID:6612
- C:\Windows\System\ATFPCHI.exe
  C:\Windows\System\ATFPCHI.exe
  2⤵
  PID:6740
- C:\Windows\System\KXtcHlX.exe
  C:\Windows\System\KXtcHlX.exe
  2⤵
  PID:6884
- C:\Windows\System\vZZJPFX.exe
  C:\Windows\System\vZZJPFX.exe
  2⤵
  PID:6792
- C:\Windows\System\kZYUcgf.exe
  C:\Windows\System\kZYUcgf.exe
  2⤵
  PID:6832
- C:\Windows\System\lYfpFQG.exe
  C:\Windows\System\lYfpFQG.exe
  2⤵
  PID:6900
- C:\Windows\System\LGblTeW.exe
  C:\Windows\System\LGblTeW.exe
  2⤵
  PID:6964
- C:\Windows\System\SpbwkNJ.exe
  C:\Windows\System\SpbwkNJ.exe
  2⤵
  PID:6984
- C:\Windows\System\DnExhRv.exe
  C:\Windows\System\DnExhRv.exe
  2⤵
  PID:6948
- C:\Windows\System\RrIbxql.exe
  C:\Windows\System\RrIbxql.exe
  2⤵
  PID:7000
- C:\Windows\System\NRKPgRf.exe
  C:\Windows\System\NRKPgRf.exe
  2⤵
  PID:7044
- C:\Windows\System\hVxZrfS.exe
  C:\Windows\System\hVxZrfS.exe
  2⤵
  PID:7032
- C:\Windows\System\iWTihTh.exe
  C:\Windows\System\iWTihTh.exe
  2⤵
  PID:7084
- C:\Windows\System\PdmKmpB.exe
  C:\Windows\System\PdmKmpB.exe
  2⤵
  PID:7144
- C:\Windows\System\kSXpYBq.exe
  C:\Windows\System\kSXpYBq.exe
  2⤵
  PID:7100
- C:\Windows\System\AKtYzki.exe
  C:\Windows\System\AKtYzki.exe
  2⤵
  PID:7128
- C:\Windows\System\OmkdMrb.exe
  C:\Windows\System\OmkdMrb.exe
  2⤵
  PID:6312
- C:\Windows\System\BMpOXNZ.exe
  C:\Windows\System\BMpOXNZ.exe
  2⤵
  PID:6260
- C:\Windows\System\avgvWvG.exe
  C:\Windows\System\avgvWvG.exe
  2⤵
  PID:6472
- C:\Windows\System\YlmCzFl.exe
  C:\Windows\System\YlmCzFl.exe
  2⤵
  PID:6160
- C:\Windows\System\qXsBRaO.exe
  C:\Windows\System\qXsBRaO.exe
  2⤵
  PID:6148
- C:\Windows\System\djkqldm.exe
  C:\Windows\System\djkqldm.exe
  2⤵
  PID:6276
- C:\Windows\System\hpvhCFP.exe
  C:\Windows\System\hpvhCFP.exe
  2⤵
  PID:6516
- C:\Windows\System\xbqRsRt.exe
  C:\Windows\System\xbqRsRt.exe
  2⤵
  PID:6632
- C:\Windows\System\RBVUUdi.exe
  C:\Windows\System\RBVUUdi.exe
  2⤵
  PID:6724
- C:\Windows\System\BVJEfnG.exe
  C:\Windows\System\BVJEfnG.exe
  2⤵
  PID:6816
- C:\Windows\System\zLhzsog.exe
  C:\Windows\System\zLhzsog.exe
  2⤵
  PID:6800
- C:\Windows\System\CbXEFNu.exe
  C:\Windows\System\CbXEFNu.exe
  2⤵
  PID:6868
- C:\Windows\System\YxjgSut.exe
  C:\Windows\System\YxjgSut.exe
  2⤵
  PID:6920
- C:\Windows\System\ZrcBVWz.exe
  C:\Windows\System\ZrcBVWz.exe
  2⤵
  PID:6864
- C:\Windows\System\zZfRShJ.exe
  C:\Windows\System\zZfRShJ.exe
  2⤵
  PID:6916
- C:\Windows\System\BgIlcOZ.exe
  C:\Windows\System\BgIlcOZ.exe
  2⤵
  PID:7096
- C:\Windows\System\YIqBFzI.exe
  C:\Windows\System\YIqBFzI.exe
  2⤵
  PID:7132
- C:\Windows\System\RhQmWtQ.exe
  C:\Windows\System\RhQmWtQ.exe
  2⤵
  PID:7164
- C:\Windows\System\pIqljOA.exe
  C:\Windows\System\pIqljOA.exe
  2⤵
  PID:6168
- C:\Windows\System\fOrdjYY.exe
  C:\Windows\System\fOrdjYY.exe
  2⤵
  PID:6408
- C:\Windows\System\ZosSkYl.exe
  C:\Windows\System\ZosSkYl.exe
  2⤵
  PID:6248
- C:\Windows\System\EafXwWo.exe
  C:\Windows\System\EafXwWo.exe
  2⤵
  PID:6552
- C:\Windows\System\stMVYZz.exe
  C:\Windows\System\stMVYZz.exe
  2⤵
  PID:7148
- C:\Windows\System\AtgYTiv.exe
  C:\Windows\System\AtgYTiv.exe
  2⤵
  PID:6180
- C:\Windows\System\Wzzskoi.exe
  C:\Windows\System\Wzzskoi.exe
  2⤵
  PID:7064
- C:\Windows\System\ALqAOzB.exe
  C:\Windows\System\ALqAOzB.exe
  2⤵
  PID:6532
- C:\Windows\System\OQbGoqe.exe
  C:\Windows\System\OQbGoqe.exe
  2⤵
  PID:6644
- C:\Windows\System\kxVocrs.exe
  C:\Windows\System\kxVocrs.exe
  2⤵
  PID:6708
- C:\Windows\System\HEJgAuu.exe
  C:\Windows\System\HEJgAuu.exe
  2⤵
  PID:7184
- C:\Windows\System\hCVwaZy.exe
  C:\Windows\System\hCVwaZy.exe
  2⤵
  PID:7200
- C:\Windows\System\xVZGxwM.exe
  C:\Windows\System\xVZGxwM.exe
  2⤵
  PID:7216
- C:\Windows\System\xbtQRnt.exe
  C:\Windows\System\xbtQRnt.exe
  2⤵
  PID:7232
- C:\Windows\System\fbFpaJW.exe
  C:\Windows\System\fbFpaJW.exe
  2⤵
  PID:7248
- C:\Windows\System\wamfhMB.exe
  C:\Windows\System\wamfhMB.exe
  2⤵
  PID:7264
- C:\Windows\System\UTxrFfN.exe
  C:\Windows\System\UTxrFfN.exe
  2⤵
  PID:7280
- C:\Windows\System\zekFevU.exe
  C:\Windows\System\zekFevU.exe
  2⤵
  PID:7296
- C:\Windows\System\qbaJrlB.exe
  C:\Windows\System\qbaJrlB.exe
  2⤵
  PID:7312
- C:\Windows\System\WDQVzxG.exe
  C:\Windows\System\WDQVzxG.exe
  2⤵
  PID:7328
- C:\Windows\System\Xbtpgma.exe
  C:\Windows\System\Xbtpgma.exe
  2⤵
  PID:7344
- C:\Windows\System\hlFkVHn.exe
  C:\Windows\System\hlFkVHn.exe
  2⤵
  PID:7360
- C:\Windows\System\wCWbHVE.exe
  C:\Windows\System\wCWbHVE.exe
  2⤵
  PID:7376
- C:\Windows\System\zIKoUXu.exe
  C:\Windows\System\zIKoUXu.exe
  2⤵
  PID:7392
- C:\Windows\System\jBWbYLG.exe
  C:\Windows\System\jBWbYLG.exe
  2⤵
  PID:7408
- C:\Windows\System\HsXgsxO.exe
  C:\Windows\System\HsXgsxO.exe
  2⤵
  PID:7424
- C:\Windows\System\rKqAfOS.exe
  C:\Windows\System\rKqAfOS.exe
  2⤵
  PID:7440
- C:\Windows\System\wqFgefB.exe
  C:\Windows\System\wqFgefB.exe
  2⤵
  PID:7456
- C:\Windows\System\jnAbquI.exe
  C:\Windows\System\jnAbquI.exe
  2⤵
  PID:7472
- C:\Windows\System\hXAvBVh.exe
  C:\Windows\System\hXAvBVh.exe
  2⤵
  PID:7488
- C:\Windows\System\KxKwgVQ.exe
  C:\Windows\System\KxKwgVQ.exe
  2⤵
  PID:7504
- C:\Windows\System\EsNmvti.exe
  C:\Windows\System\EsNmvti.exe
  2⤵
  PID:7520
- C:\Windows\System\aFUVDCD.exe
  C:\Windows\System\aFUVDCD.exe
  2⤵
  PID:7540
- C:\Windows\System\MCAGroc.exe
  C:\Windows\System\MCAGroc.exe
  2⤵
  PID:7556
- C:\Windows\System\jzPiUeD.exe
  C:\Windows\System\jzPiUeD.exe
  2⤵
  PID:7572
- C:\Windows\System\ZgErNUU.exe
  C:\Windows\System\ZgErNUU.exe
  2⤵
  PID:7588
- C:\Windows\System\buaOHWc.exe
  C:\Windows\System\buaOHWc.exe
  2⤵
  PID:7604
- C:\Windows\System\JIvCSVc.exe
  C:\Windows\System\JIvCSVc.exe
  2⤵
  PID:7624
- C:\Windows\System\JERGOzj.exe
  C:\Windows\System\JERGOzj.exe
  2⤵
  PID:7640
- C:\Windows\System\pbapOuv.exe
  C:\Windows\System\pbapOuv.exe
  2⤵
  PID:7656
- C:\Windows\System\apuBMTY.exe
  C:\Windows\System\apuBMTY.exe
  2⤵
  PID:7672
- C:\Windows\System\rncAdTe.exe
  C:\Windows\System\rncAdTe.exe
  2⤵
  PID:7688
- C:\Windows\System\GacWbay.exe
  C:\Windows\System\GacWbay.exe
  2⤵
  PID:7704
- C:\Windows\System\WJOlVfA.exe
  C:\Windows\System\WJOlVfA.exe
  2⤵
  PID:7724
- C:\Windows\System\ZHlFmpF.exe
  C:\Windows\System\ZHlFmpF.exe
  2⤵
  PID:7740
- C:\Windows\System\zzfLlOZ.exe
  C:\Windows\System\zzfLlOZ.exe
  2⤵
  PID:7760
- C:\Windows\System\tEWMaFu.exe
  C:\Windows\System\tEWMaFu.exe
  2⤵
  PID:7776
- C:\Windows\System\UQrjDhd.exe
  C:\Windows\System\UQrjDhd.exe
  2⤵
  PID:7796
- C:\Windows\System\mLOlOUs.exe
  C:\Windows\System\mLOlOUs.exe
  2⤵
  PID:7812
- C:\Windows\System\oAYzgkt.exe
  C:\Windows\System\oAYzgkt.exe
  2⤵
  PID:7828
- C:\Windows\System\QRFWZWh.exe
  C:\Windows\System\QRFWZWh.exe
  2⤵
  PID:7848
- C:\Windows\System\vZHfkRG.exe
  C:\Windows\System\vZHfkRG.exe
  2⤵
  PID:7864
- C:\Windows\System\UdRreKk.exe
  C:\Windows\System\UdRreKk.exe
  2⤵
  PID:7880
- C:\Windows\System\KYQbQBG.exe
  C:\Windows\System\KYQbQBG.exe
  2⤵
  PID:7900
- C:\Windows\System\MGDabJz.exe
  C:\Windows\System\MGDabJz.exe
  2⤵
  PID:7920
- C:\Windows\System\RRTIRWr.exe
  C:\Windows\System\RRTIRWr.exe
  2⤵
  PID:7936
- C:\Windows\System\peMGhMq.exe
  C:\Windows\System\peMGhMq.exe
  2⤵
  PID:7952
- C:\Windows\System\OKkGZUo.exe
  C:\Windows\System\OKkGZUo.exe
  2⤵
  PID:7968
- C:\Windows\System\iMhthmv.exe
  C:\Windows\System\iMhthmv.exe
  2⤵
  PID:7984
- C:\Windows\System\DoOsMZW.exe
  C:\Windows\System\DoOsMZW.exe
  2⤵
  PID:8000
- C:\Windows\System\YelUQjc.exe
  C:\Windows\System\YelUQjc.exe
  2⤵
  PID:8020
- C:\Windows\System\FyGzbLg.exe
  C:\Windows\System\FyGzbLg.exe
  2⤵
  PID:8036
- C:\Windows\System\LpUUEOo.exe
  C:\Windows\System\LpUUEOo.exe
  2⤵
  PID:8052
- C:\Windows\System\JiviDtJ.exe
  C:\Windows\System\JiviDtJ.exe
  2⤵
  PID:8068
- C:\Windows\System\yrMZpxU.exe
  C:\Windows\System\yrMZpxU.exe
  2⤵
  PID:8084
- C:\Windows\System\ZJFEpip.exe
  C:\Windows\System\ZJFEpip.exe
  2⤵
  PID:8104
- C:\Windows\System\IzNqJHg.exe
  C:\Windows\System\IzNqJHg.exe
  2⤵
  PID:8124
- C:\Windows\System\vetJIrF.exe
  C:\Windows\System\vetJIrF.exe
  2⤵
  PID:8140
- C:\Windows\System\ryinwzo.exe
  C:\Windows\System\ryinwzo.exe
  2⤵
  PID:8156
- C:\Windows\System\BfZJsiY.exe
  C:\Windows\System\BfZJsiY.exe
  2⤵
  PID:8172
- C:\Windows\System\tyguuVL.exe
  C:\Windows\System\tyguuVL.exe
  2⤵
  PID:8188
- C:\Windows\System\OuFgWbo.exe
  C:\Windows\System\OuFgWbo.exe
  2⤵
  PID:7180
- C:\Windows\System\dUrQMlq.exe
  C:\Windows\System\dUrQMlq.exe
  2⤵
  PID:5252
- C:\Windows\System\pruvavK.exe
  C:\Windows\System\pruvavK.exe
  2⤵
  PID:6376
- C:\Windows\System\MHWjpcs.exe
  C:\Windows\System\MHWjpcs.exe
  2⤵
  PID:7192
- C:\Windows\System\lgowLOl.exe
  C:\Windows\System\lgowLOl.exe
  2⤵
  PID:7276
- C:\Windows\System\YxEtpbR.exe
  C:\Windows\System\YxEtpbR.exe
  2⤵
  PID:7308
- C:\Windows\System\feSgziS.exe
  C:\Windows\System\feSgziS.exe
  2⤵
  PID:7340
- C:\Windows\System\BZjUsDg.exe
  C:\Windows\System\BZjUsDg.exe
  2⤵
  PID:7400
- C:\Windows\System\juzBulp.exe
  C:\Windows\System\juzBulp.exe
  2⤵
  PID:7356
- C:\Windows\System\pZyTvng.exe
  C:\Windows\System\pZyTvng.exe
  2⤵
  PID:7420
- C:\Windows\System\UThsQVs.exe
  C:\Windows\System\UThsQVs.exe
  2⤵
  PID:7464
- C:\Windows\System\UxRfsHn.exe
  C:\Windows\System\UxRfsHn.exe
  2⤵
  PID:7512
- C:\Windows\System\ssgutNd.exe
  C:\Windows\System\ssgutNd.exe
  2⤵
  PID:7500
- C:\Windows\System\VfFMgZa.exe
  C:\Windows\System\VfFMgZa.exe
  2⤵
  PID:7552
- C:\Windows\System\rFrxQbV.exe
  C:\Windows\System\rFrxQbV.exe
  2⤵
  PID:7564
- C:\Windows\System\AZTnvzy.exe
  C:\Windows\System\AZTnvzy.exe
  2⤵
  PID:7620
- C:\Windows\System\tPcjImJ.exe
  C:\Windows\System\tPcjImJ.exe
  2⤵
  PID:7664
- C:\Windows\System\rYSudbb.exe
  C:\Windows\System\rYSudbb.exe
  2⤵
  PID:7712
- C:\Windows\System\qXxOsdW.exe
  C:\Windows\System\qXxOsdW.exe
  2⤵
  PID:7752
- C:\Windows\System\KXxkmlN.exe
  C:\Windows\System\KXxkmlN.exe
  2⤵
  PID:6744
- C:\Windows\System\nNfVvsL.exe
  C:\Windows\System\nNfVvsL.exe
  2⤵
  PID:7792
- C:\Windows\System\mHSYbcQ.exe
  C:\Windows\System\mHSYbcQ.exe
  2⤵
  PID:7736
- C:\Windows\System\IGMasED.exe
  C:\Windows\System\IGMasED.exe
  2⤵
  PID:7872
- C:\Windows\System\cGQkvdC.exe
  C:\Windows\System\cGQkvdC.exe
  2⤵
  PID:7976
- C:\Windows\System\cSmXide.exe
  C:\Windows\System\cSmXide.exe
  2⤵
  PID:8012
- C:\Windows\System\seasOgn.exe
  C:\Windows\System\seasOgn.exe
  2⤵
  PID:7888
- C:\Windows\System\zmVjXRu.exe
  C:\Windows\System\zmVjXRu.exe
  2⤵
  PID:8064
- C:\Windows\System\JnTEbXJ.exe
  C:\Windows\System\JnTEbXJ.exe
  2⤵
  PID:8076
- C:\Windows\System\CwXtxBn.exe
  C:\Windows\System\CwXtxBn.exe
  2⤵
  PID:5660
- C:\Windows\System\OAvhwlZ.exe
  C:\Windows\System\OAvhwlZ.exe
  2⤵
  PID:8132
- C:\Windows\System\IUVZxcW.exe
  C:\Windows\System\IUVZxcW.exe
  2⤵
  PID:8180
- C:\Windows\System\gNtCGas.exe
  C:\Windows\System\gNtCGas.exe
  2⤵
  PID:8168
- C:\Windows\System\dYRhFmg.exe
  C:\Windows\System\dYRhFmg.exe
  2⤵
  PID:7196
- C:\Windows\System\sBEqwjL.exe
  C:\Windows\System\sBEqwjL.exe
  2⤵
  PID:7368
- C:\Windows\System\vVeLOIC.exe
  C:\Windows\System\vVeLOIC.exe
  2⤵
  PID:7336
- C:\Windows\System\BzOAqAh.exe
  C:\Windows\System\BzOAqAh.exe
  2⤵
  PID:7480
- C:\Windows\System\qnwTovg.exe
  C:\Windows\System\qnwTovg.exe
  2⤵
  PID:7612
- C:\Windows\System\mqsfZTv.exe
  C:\Windows\System\mqsfZTv.exe
  2⤵
  PID:7432
- C:\Windows\System\xqVZTam.exe
  C:\Windows\System\xqVZTam.exe
  2⤵
  PID:7600
- C:\Windows\System\mGiWYAm.exe
  C:\Windows\System\mGiWYAm.exe
  2⤵
  PID:7636
- C:\Windows\System\yhTGRLY.exe
  C:\Windows\System\yhTGRLY.exe
  2⤵
  PID:7836
- C:\Windows\System\geGPFmg.exe
  C:\Windows\System\geGPFmg.exe
  2⤵
  PID:7844
- C:\Windows\System\qivochS.exe
  C:\Windows\System\qivochS.exe
  2⤵
  PID:7772
- C:\Windows\System\uHzwege.exe
  C:\Windows\System\uHzwege.exe
  2⤵
  PID:7944
- C:\Windows\System\PxIJXxT.exe
  C:\Windows\System\PxIJXxT.exe
  2⤵
  PID:7860
- C:\Windows\System\uGInOLX.exe
  C:\Windows\System\uGInOLX.exe
  2⤵
  PID:7932
- C:\Windows\System\qbLPeRW.exe
  C:\Windows\System\qbLPeRW.exe
  2⤵
  PID:7996
- C:\Windows\System\RPvVBiN.exe
  C:\Windows\System\RPvVBiN.exe
  2⤵
  PID:8100
- C:\Windows\System\ZGByhAX.exe
  C:\Windows\System\ZGByhAX.exe
  2⤵
  PID:8112
- C:\Windows\System\rhVZOZh.exe
  C:\Windows\System\rhVZOZh.exe
  2⤵
  PID:6244
- C:\Windows\System\MEDolMy.exe
  C:\Windows\System\MEDolMy.exe
  2⤵
  PID:7292
- C:\Windows\System\zvQHnhw.exe
  C:\Windows\System\zvQHnhw.exe
  2⤵
  PID:7584
- C:\Windows\System\DpPCLht.exe
  C:\Windows\System\DpPCLht.exe
  2⤵
  PID:7272
- C:\Windows\System\MknkncF.exe
  C:\Windows\System\MknkncF.exe
  2⤵
  PID:7684
- C:\Windows\System\Iqlorfa.exe
  C:\Windows\System\Iqlorfa.exe
  2⤵
  PID:7992
- C:\Windows\System\wJQkaLI.exe
  C:\Windows\System\wJQkaLI.exe
  2⤵
  PID:7964
- C:\Windows\System\MAzhDrx.exe
  C:\Windows\System\MAzhDrx.exe
  2⤵
  PID:7352
- C:\Windows\System\NSKtOaw.exe
  C:\Windows\System\NSKtOaw.exe
  2⤵
  PID:8096
- C:\Windows\System\JftPblr.exe
  C:\Windows\System\JftPblr.exe
  2⤵
  PID:7748
- C:\Windows\System\LjHgAWa.exe
  C:\Windows\System\LjHgAWa.exe
  2⤵
  PID:8032
- C:\Windows\System\jNunQVO.exe
  C:\Windows\System\jNunQVO.exe
  2⤵
  PID:7528
- C:\Windows\System\CMBDnnA.exe
  C:\Windows\System\CMBDnnA.exe
  2⤵
  PID:8152
- C:\Windows\System\iVboOAL.exe
  C:\Windows\System\iVboOAL.exe
  2⤵
  PID:8048
- C:\Windows\System\iIjpwyY.exe
  C:\Windows\System\iIjpwyY.exe
  2⤵
  PID:8184
- C:\Windows\System\DaAfIqW.exe
  C:\Windows\System\DaAfIqW.exe
  2⤵
  PID:8208
- C:\Windows\System\DkihEhj.exe
  C:\Windows\System\DkihEhj.exe
  2⤵
  PID:8224
- C:\Windows\System\scNPTAd.exe
  C:\Windows\System\scNPTAd.exe
  2⤵
  PID:8244
- C:\Windows\System\pOoEnCw.exe
  C:\Windows\System\pOoEnCw.exe
  2⤵
  PID:8260
- C:\Windows\System\eoFxQkt.exe
  C:\Windows\System\eoFxQkt.exe
  2⤵
  PID:8284
- C:\Windows\System\SKvjnJI.exe
  C:\Windows\System\SKvjnJI.exe
  2⤵
  PID:8300
- C:\Windows\System\EVOKyYq.exe
  C:\Windows\System\EVOKyYq.exe
  2⤵
  PID:8316
- C:\Windows\System\kmlblzK.exe
  C:\Windows\System\kmlblzK.exe
  2⤵
  PID:8332
- C:\Windows\System\pgpRhdf.exe
  C:\Windows\System\pgpRhdf.exe
  2⤵
  PID:8348
- C:\Windows\System\rtGzAXz.exe
  C:\Windows\System\rtGzAXz.exe
  2⤵
  PID:8372
- C:\Windows\System\bfYPeYB.exe
  C:\Windows\System\bfYPeYB.exe
  2⤵
  PID:8388
- C:\Windows\System\lQNWHLz.exe
  C:\Windows\System\lQNWHLz.exe
  2⤵
  PID:8404
- C:\Windows\System\uwGLUGM.exe
  C:\Windows\System\uwGLUGM.exe
  2⤵
  PID:8420
- C:\Windows\System\HNSxyEA.exe
  C:\Windows\System\HNSxyEA.exe
  2⤵
  PID:8440
- C:\Windows\System\aqqhVOK.exe
  C:\Windows\System\aqqhVOK.exe
  2⤵
  PID:8456
- C:\Windows\System\mLXAPbk.exe
  C:\Windows\System\mLXAPbk.exe
  2⤵
  PID:8480
- C:\Windows\System\SjGpqLS.exe
  C:\Windows\System\SjGpqLS.exe
  2⤵
  PID:8496
- C:\Windows\System\diBVhJw.exe
  C:\Windows\System\diBVhJw.exe
  2⤵
  PID:8512
- C:\Windows\System\vpmhktX.exe
  C:\Windows\System\vpmhktX.exe
  2⤵
  PID:8532
- C:\Windows\System\NNEyGMH.exe
  C:\Windows\System\NNEyGMH.exe
  2⤵
  PID:8548
- C:\Windows\System\sfjFMTS.exe
  C:\Windows\System\sfjFMTS.exe
  2⤵
  PID:8564
- C:\Windows\System\MrpQBED.exe
  C:\Windows\System\MrpQBED.exe
  2⤵
  PID:8600
- C:\Windows\System\rLxsZVA.exe
  C:\Windows\System\rLxsZVA.exe
  2⤵
  PID:8616
- C:\Windows\System\weyoVOs.exe
  C:\Windows\System\weyoVOs.exe
  2⤵
  PID:8632
- C:\Windows\System\PBMbSZx.exe
  C:\Windows\System\PBMbSZx.exe
  2⤵
  PID:8652
- C:\Windows\System\UXTWJHc.exe
  C:\Windows\System\UXTWJHc.exe
  2⤵
  PID:8672
- C:\Windows\System\jatUrmQ.exe
  C:\Windows\System\jatUrmQ.exe
  2⤵
  PID:8692
- C:\Windows\System\wjvLWfX.exe
  C:\Windows\System\wjvLWfX.exe
  2⤵
  PID:8708
- C:\Windows\System\KfhfUXa.exe
  C:\Windows\System\KfhfUXa.exe
  2⤵
  PID:8800
- C:\Windows\System\xvwJDXR.exe
  C:\Windows\System\xvwJDXR.exe
  2⤵
  PID:8816
- C:\Windows\System\WCnLimL.exe
  C:\Windows\System\WCnLimL.exe
  2⤵
  PID:8844
- C:\Windows\System\OAvrGOC.exe
  C:\Windows\System\OAvrGOC.exe
  2⤵
  PID:8860
- C:\Windows\System\MztLWwD.exe
  C:\Windows\System\MztLWwD.exe
  2⤵
  PID:8880
- C:\Windows\System\FgEIQYC.exe
  C:\Windows\System\FgEIQYC.exe
  2⤵
  PID:8900
- C:\Windows\System\oGPaHJf.exe
  C:\Windows\System\oGPaHJf.exe
  2⤵
  PID:8916
- C:\Windows\System\cRNNDmr.exe
  C:\Windows\System\cRNNDmr.exe
  2⤵
  PID:8932
- C:\Windows\System\kFIWDMk.exe
  C:\Windows\System\kFIWDMk.exe
  2⤵
  PID:8952
- C:\Windows\System\SNwzdtI.exe
  C:\Windows\System\SNwzdtI.exe
  2⤵
  PID:8968
- C:\Windows\System\eaMkfmB.exe
  C:\Windows\System\eaMkfmB.exe
  2⤵
  PID:8984
- C:\Windows\System\YTxtxAz.exe
  C:\Windows\System\YTxtxAz.exe
  2⤵
  PID:9000
- C:\Windows\System\gHOfBBi.exe
  C:\Windows\System\gHOfBBi.exe
  2⤵
  PID:9016
- C:\Windows\System\LgGtgRb.exe
  C:\Windows\System\LgGtgRb.exe
  2⤵
  PID:9032
- C:\Windows\System\uEmNvOH.exe
  C:\Windows\System\uEmNvOH.exe
  2⤵
  PID:9048
- C:\Windows\System\jnxNtqC.exe
  C:\Windows\System\jnxNtqC.exe
  2⤵
  PID:9064
- C:\Windows\System\plXudnx.exe
  C:\Windows\System\plXudnx.exe
  2⤵
  PID:9084
- C:\Windows\System\ksbGFvp.exe
  C:\Windows\System\ksbGFvp.exe
  2⤵
  PID:9100
- C:\Windows\System\zGeVFIk.exe
  C:\Windows\System\zGeVFIk.exe
  2⤵
  PID:9116
- C:\Windows\System\geOPzZs.exe
  C:\Windows\System\geOPzZs.exe
  2⤵
  PID:9136
- C:\Windows\System\MVrrCii.exe
  C:\Windows\System\MVrrCii.exe
  2⤵
  PID:9152
- C:\Windows\System\QXmojXg.exe
  C:\Windows\System\QXmojXg.exe
  2⤵
  PID:9168
- C:\Windows\System\AKxfRxR.exe
  C:\Windows\System\AKxfRxR.exe
  2⤵
  PID:9192
- C:\Windows\System\wIYMirf.exe
  C:\Windows\System\wIYMirf.exe
  2⤵
  PID:8268
- C:\Windows\System\NtKZRSk.exe
  C:\Windows\System\NtKZRSk.exe
  2⤵
  PID:8428
- C:\Windows\System\oYWfINm.exe
  C:\Windows\System\oYWfINm.exe
  2⤵
  PID:8472
- C:\Windows\System\ukcHYWq.exe
  C:\Windows\System\ukcHYWq.exe
  2⤵
  PID:8572
- C:\Windows\System\fZioklY.exe
  C:\Windows\System\fZioklY.exe
  2⤵
  PID:8340
- C:\Windows\System\foPRoQf.exe
  C:\Windows\System\foPRoQf.exe
  2⤵
  PID:8380
- C:\Windows\System\FsNNfHJ.exe
  C:\Windows\System\FsNNfHJ.exe
  2⤵
  PID:8584
- C:\Windows\System\SUQCMhp.exe
  C:\Windows\System\SUQCMhp.exe
  2⤵
  PID:8588
- C:\Windows\System\JkpsRbj.exe
  C:\Windows\System\JkpsRbj.exe
  2⤵
  PID:8648
- C:\Windows\System\NEBuvoQ.exe
  C:\Windows\System\NEBuvoQ.exe
  2⤵
  PID:8716
- C:\Windows\System\ZEAhLPH.exe
  C:\Windows\System\ZEAhLPH.exe
  2⤵
  PID:7980
- C:\Windows\System\KJuBdmJ.exe
  C:\Windows\System\KJuBdmJ.exe
  2⤵
  PID:8756
- C:\Windows\System\QJpDqBa.exe
  C:\Windows\System\QJpDqBa.exe
  2⤵
  PID:8764
- C:\Windows\System\YDEQQwW.exe
  C:\Windows\System\YDEQQwW.exe
  2⤵
  PID:8788
- C:\Windows\System\eaUbwWE.exe
  C:\Windows\System\eaUbwWE.exe
  2⤵
  PID:8812
- C:\Windows\System\IdzKnzE.exe
  C:\Windows\System\IdzKnzE.exe
  2⤵
  PID:8888
- C:\Windows\System\GPfvyXs.exe
  C:\Windows\System\GPfvyXs.exe
  2⤵
  PID:8840
- C:\Windows\System\ZTNyEfm.exe
  C:\Windows\System\ZTNyEfm.exe
  2⤵
  PID:8868
- C:\Windows\System\sbjSXCe.exe
  C:\Windows\System\sbjSXCe.exe
  2⤵
  PID:8944
- C:\Windows\System\WpUznxx.exe
  C:\Windows\System\WpUznxx.exe
  2⤵
  PID:8960
- C:\Windows\System\hPhOGgp.exe
  C:\Windows\System\hPhOGgp.exe
  2⤵
  PID:8980
- C:\Windows\System\TrPrFYU.exe
  C:\Windows\System\TrPrFYU.exe
  2⤵
  PID:9056
- C:\Windows\System\vNRwYpY.exe
  C:\Windows\System\vNRwYpY.exe
  2⤵
  PID:7208
- C:\Windows\System\IGGeDIj.exe
  C:\Windows\System\IGGeDIj.exe
  2⤵
  PID:7824
- C:\Windows\System\itakziq.exe
  C:\Windows\System\itakziq.exe
  2⤵
  PID:8240
- C:\Windows\System\vbHhyUg.exe
  C:\Windows\System\vbHhyUg.exe
  2⤵
  PID:7700
- C:\Windows\System\FMvNVdq.exe
  C:\Windows\System\FMvNVdq.exe
  2⤵
  PID:8204
- C:\Windows\System\MISKDNS.exe
  C:\Windows\System\MISKDNS.exe
  2⤵
  PID:8216
- C:\Windows\System\msFUXUQ.exe
  C:\Windows\System\msFUXUQ.exe
  2⤵
  PID:8272
- C:\Windows\System\boxQOIC.exe
  C:\Windows\System\boxQOIC.exe
  2⤵
  PID:8312
- C:\Windows\System\wDXIqbl.exe
  C:\Windows\System\wDXIqbl.exe
  2⤵
  PID:8400
- C:\Windows\System\SuFHAbk.exe
  C:\Windows\System\SuFHAbk.exe
  2⤵
  PID:8356
- C:\Windows\System\UwgyQRg.exe
  C:\Windows\System\UwgyQRg.exe
  2⤵
  PID:8364
- C:\Windows\System\yppGYmu.exe
  C:\Windows\System\yppGYmu.exe
  2⤵
  PID:8504
- C:\Windows\System\aqMaRpl.exe
  C:\Windows\System\aqMaRpl.exe
  2⤵
  PID:8488
- C:\Windows\System\FoKEouL.exe
  C:\Windows\System\FoKEouL.exe
  2⤵
  PID:8492
- C:\Windows\System\didIXsP.exe
  C:\Windows\System\didIXsP.exe
  2⤵
  PID:8660
- C:\Windows\System\OtuoIIv.exe
  C:\Windows\System\OtuoIIv.exe
  2⤵
  PID:8612
- C:\Windows\System\RyOcLzd.exe
  C:\Windows\System\RyOcLzd.exe
  2⤵
  PID:8740
- C:\Windows\System\xVbpKVi.exe
  C:\Windows\System\xVbpKVi.exe
  2⤵
  PID:8852
- C:\Windows\System\GdHwoOW.exe
  C:\Windows\System\GdHwoOW.exe
  2⤵
  PID:8928
- C:\Windows\System\OZqmbTb.exe
  C:\Windows\System\OZqmbTb.exe
  2⤵
  PID:9028
- C:\Windows\System\zvtYAMD.exe
  C:\Windows\System\zvtYAMD.exe
  2⤵
  PID:8896
- C:\Windows\System\sEyzoTa.exe
  C:\Windows\System\sEyzoTa.exe
  2⤵
  PID:8976
- C:\Windows\System\wLYTRzM.exe
  C:\Windows\System\wLYTRzM.exe
  2⤵
  PID:8760
- C:\Windows\System\ruFPgKN.exe
  C:\Windows\System\ruFPgKN.exe
  2⤵
  PID:9132
- C:\Windows\System\OebHPuC.exe
  C:\Windows\System\OebHPuC.exe
  2⤵
  PID:9060
- C:\Windows\System\PBSVUMM.exe
  C:\Windows\System\PBSVUMM.exe
  2⤵
  PID:7856
- C:\Windows\System\XZQXlKX.exe
  C:\Windows\System\XZQXlKX.exe
  2⤵
  PID:8468
- C:\Windows\System\YWcgRmR.exe
  C:\Windows\System\YWcgRmR.exe
  2⤵
  PID:9148
- C:\Windows\System\NBAyTir.exe
  C:\Windows\System\NBAyTir.exe
  2⤵
  PID:8508
- C:\Windows\System\zDMClJX.exe
  C:\Windows\System\zDMClJX.exe
  2⤵
  PID:9188
- C:\Windows\System\YHCgFSo.exe
  C:\Windows\System\YHCgFSo.exe
  2⤵
  PID:8996
- C:\Windows\System\yvjeOea.exe
  C:\Windows\System\yvjeOea.exe
  2⤵
  PID:9024
- C:\Windows\System\jNrfyqw.exe
  C:\Windows\System\jNrfyqw.exe
  2⤵
  PID:9124
- C:\Windows\System\TkTmqVx.exe
  C:\Windows\System\TkTmqVx.exe
  2⤵
  PID:8220
- C:\Windows\System\EIIsWbU.exe
  C:\Windows\System\EIIsWbU.exe
  2⤵
  PID:9108
- C:\Windows\System\wXycjGP.exe
  C:\Windows\System\wXycjGP.exe
  2⤵
  PID:9176
- C:\Windows\System\JXaqFiu.exe
  C:\Windows\System\JXaqFiu.exe
  2⤵
  PID:8924
- C:\Windows\System\enOmCuM.exe
  C:\Windows\System\enOmCuM.exe
  2⤵
  PID:8296
- C:\Windows\System\IBkyogL.exe
  C:\Windows\System\IBkyogL.exe
  2⤵
  PID:8596
- C:\Windows\System\HxHpISz.exe
  C:\Windows\System\HxHpISz.exe
  2⤵
  PID:9144
- C:\Windows\System\SsMHHeQ.exe
  C:\Windows\System\SsMHHeQ.exe
  2⤵
  PID:8280
- C:\Windows\System\BKCNMvx.exe
  C:\Windows\System\BKCNMvx.exe
  2⤵
  PID:8528
- C:\Windows\System\hVojPga.exe
  C:\Windows\System\hVojPga.exe
  2⤵
  PID:8668
- C:\Windows\System\cfQQwcs.exe
  C:\Windows\System\cfQQwcs.exe
  2⤵
  PID:9160
- C:\Windows\System\MFiwPUI.exe
  C:\Windows\System\MFiwPUI.exe
  2⤵
  PID:7548
- C:\Windows\System\UCgsIJR.exe
  C:\Windows\System\UCgsIJR.exe
  2⤵
  PID:9224
- C:\Windows\System\ToTYmrN.exe
  C:\Windows\System\ToTYmrN.exe
  2⤵
  PID:9240
- C:\Windows\System\msDEHdw.exe
  C:\Windows\System\msDEHdw.exe
  2⤵
  PID:9260
- C:\Windows\System\UNYufGn.exe
  C:\Windows\System\UNYufGn.exe
  2⤵
  PID:9324
- C:\Windows\System\MwWtNKI.exe
  C:\Windows\System\MwWtNKI.exe
  2⤵
  PID:9372
- C:\Windows\System\jCszjcu.exe
  C:\Windows\System\jCszjcu.exe
  2⤵
  PID:9388
- C:\Windows\System\dZLECYC.exe
  C:\Windows\System\dZLECYC.exe
  2⤵
  PID:9404
- C:\Windows\System\DQcYgas.exe
  C:\Windows\System\DQcYgas.exe
  2⤵
  PID:9420
- C:\Windows\System\SDFcPOp.exe
  C:\Windows\System\SDFcPOp.exe
  2⤵
  PID:9436
- C:\Windows\System\QOFmHAo.exe
  C:\Windows\System\QOFmHAo.exe
  2⤵
  PID:9452
- C:\Windows\System\VlIvZxB.exe
  C:\Windows\System\VlIvZxB.exe
  2⤵
  PID:9468
- C:\Windows\System\uEVWfBy.exe
  C:\Windows\System\uEVWfBy.exe
  2⤵
  PID:9484
- C:\Windows\System\VkbVcSY.exe
  C:\Windows\System\VkbVcSY.exe
  2⤵
  PID:9520
- C:\Windows\System\DpKBDTN.exe
  C:\Windows\System\DpKBDTN.exe
  2⤵
  PID:9536
- C:\Windows\System\OSwqAnX.exe
  C:\Windows\System\OSwqAnX.exe
  2⤵
  PID:9572
- C:\Windows\System\OaYHYne.exe
  C:\Windows\System\OaYHYne.exe
  2⤵
  PID:9632
- C:\Windows\System\Djylitj.exe
  C:\Windows\System\Djylitj.exe
  2⤵
  PID:9660
- C:\Windows\System\QCsJTuU.exe
  C:\Windows\System\QCsJTuU.exe
  2⤵
  PID:9692
- C:\Windows\System\BbiXLyE.exe
  C:\Windows\System\BbiXLyE.exe
  2⤵
  PID:9708
- C:\Windows\System\YkugQwx.exe
  C:\Windows\System\YkugQwx.exe
  2⤵
  PID:9908
- C:\Windows\System\yAuJMyN.exe
  C:\Windows\System\yAuJMyN.exe
  2⤵
  PID:9964
- C:\Windows\System\zSnIwlg.exe
  C:\Windows\System\zSnIwlg.exe
  2⤵
  PID:10016
- C:\Windows\System\hpTCsrd.exe
  C:\Windows\System\hpTCsrd.exe
  2⤵
  PID:10032
- C:\Windows\System\mHRGuRm.exe
  C:\Windows\System\mHRGuRm.exe
  2⤵
  PID:10048
- C:\Windows\System\SwyKaKg.exe
  C:\Windows\System\SwyKaKg.exe
  2⤵
  PID:10068
- C:\Windows\System\noehymP.exe
  C:\Windows\System\noehymP.exe
  2⤵
  PID:10084
- C:\Windows\System\kKpKIYZ.exe
  C:\Windows\System\kKpKIYZ.exe
  2⤵
  PID:10100
- C:\Windows\System\xkLTqTP.exe
  C:\Windows\System\xkLTqTP.exe
  2⤵
  PID:10116
- C:\Windows\System\SqTlzyW.exe
  C:\Windows\System\SqTlzyW.exe
  2⤵
  PID:10136
- C:\Windows\System\CYwoLmw.exe
  C:\Windows\System\CYwoLmw.exe
  2⤵
  PID:10152
- C:\Windows\System\iFrnITT.exe
  C:\Windows\System\iFrnITT.exe
  2⤵
  PID:10172
- C:\Windows\System\zNIGagJ.exe
  C:\Windows\System\zNIGagJ.exe
  2⤵
  PID:10188
- C:\Windows\System\HLZecOC.exe
  C:\Windows\System\HLZecOC.exe
  2⤵
  PID:10204
- C:\Windows\System\AIMUUDv.exe
  C:\Windows\System\AIMUUDv.exe
  2⤵
  PID:10220
- C:\Windows\System\QmtAfSb.exe
  C:\Windows\System\QmtAfSb.exe
  2⤵
  PID:10236
- C:\Windows\System\kJbvJwr.exe
  C:\Windows\System\kJbvJwr.exe
  2⤵
  PID:8828
- C:\Windows\System\AyNCxMa.exe
  C:\Windows\System\AyNCxMa.exe
  2⤵
  PID:9256
- C:\Windows\System\vXFkPNx.exe
  C:\Windows\System\vXFkPNx.exe
  2⤵
  PID:9204
- C:\Windows\System\BaRhaHP.exe
  C:\Windows\System\BaRhaHP.exe
  2⤵
  PID:8448
- C:\Windows\System\tErxTYX.exe
  C:\Windows\System\tErxTYX.exe
  2⤵
  PID:9268
- C:\Windows\System\WIapYjU.exe
  C:\Windows\System\WIapYjU.exe
  2⤵
  PID:9012
- C:\Windows\System\FxbYgtb.exe
  C:\Windows\System\FxbYgtb.exe
  2⤵
  PID:8576
- C:\Windows\System\mbClYbJ.exe
  C:\Windows\System\mbClYbJ.exe
  2⤵
  PID:8784
- C:\Windows\System\uAdpShq.exe
  C:\Windows\System\uAdpShq.exe
  2⤵
  PID:9280
- C:\Windows\System\bszFsZa.exe
  C:\Windows\System\bszFsZa.exe
  2⤵
  PID:9300
- C:\Windows\System\RtfANNm.exe
  C:\Windows\System\RtfANNm.exe
  2⤵
  PID:9312
- C:\Windows\System\yLNnHhz.exe
  C:\Windows\System\yLNnHhz.exe
  2⤵
  PID:9336
- C:\Windows\System\NHlWXOA.exe
  C:\Windows\System\NHlWXOA.exe
  2⤵
  PID:9352
- C:\Windows\System\chYVJuY.exe
  C:\Windows\System\chYVJuY.exe
  2⤵
  PID:9416
- C:\Windows\System\FqXveIh.exe
  C:\Windows\System\FqXveIh.exe
  2⤵
  PID:9396
- C:\Windows\System\nbwnZdx.exe
  C:\Windows\System\nbwnZdx.exe
  2⤵
  PID:9532
- C:\Windows\System\aBoiczZ.exe
  C:\Windows\System\aBoiczZ.exe
  2⤵
  PID:9956
- C:\Windows\System\yUfrVBP.exe
  C:\Windows\System\yUfrVBP.exe
  2⤵
  PID:10132
- C:\Windows\System\surxFHu.exe
  C:\Windows\System\surxFHu.exe
  2⤵
  PID:9840
- C:\Windows\System\NprJYty.exe
  C:\Windows\System\NprJYty.exe
  2⤵
  PID:10076
- C:\Windows\System\mwrJvIp.exe
  C:\Windows\System\mwrJvIp.exe
  2⤵
  PID:10180
- C:\Windows\System\iZbZcvs.exe
  C:\Windows\System\iZbZcvs.exe
  2⤵
  PID:9384
- C:\Windows\System\mqcBFcr.exe
  C:\Windows\System\mqcBFcr.exe
  2⤵
  PID:9316
- C:\Windows\System\WmjmtyD.exe
  C:\Windows\System\WmjmtyD.exe
  2⤵
  PID:9900
- C:\Windows\System\qcSmGGo.exe
  C:\Windows\System\qcSmGGo.exe
  2⤵
  PID:9464
- C:\Windows\System\ECVwXTJ.exe
  C:\Windows\System\ECVwXTJ.exe
  2⤵
  PID:9512
- C:\Windows\System\JcFEFoC.exe
  C:\Windows\System\JcFEFoC.exe
  2⤵
  PID:9716
- C:\Windows\System\hVlvdDx.exe
  C:\Windows\System\hVlvdDx.exe
  2⤵
  PID:9792
- C:\Windows\System\vqqvPfy.exe
  C:\Windows\System\vqqvPfy.exe
  2⤵
  PID:9508
- C:\Windows\System\CBcvlfG.exe
  C:\Windows\System\CBcvlfG.exe
  2⤵
  PID:9568
- C:\Windows\System\JmfQjTX.exe
  C:\Windows\System\JmfQjTX.exe
  2⤵
  PID:9564
- C:\Windows\System\QKsxnQs.exe
  C:\Windows\System\QKsxnQs.exe
  2⤵
  PID:9588
- C:\Windows\System\LRxevmt.exe
  C:\Windows\System\LRxevmt.exe
  2⤵
  PID:9608
- C:\Windows\System\VrDUqAj.exe
  C:\Windows\System\VrDUqAj.exe
  2⤵
  PID:9620
- C:\Windows\System\ANUfPcU.exe
  C:\Windows\System\ANUfPcU.exe
  2⤵
  PID:9680
- C:\Windows\System\KmgnspF.exe
  C:\Windows\System\KmgnspF.exe
  2⤵
  PID:9656
- C:\Windows\System\ZysjXfI.exe
  C:\Windows\System\ZysjXfI.exe
  2⤵
  PID:9720
- C:\Windows\System\xpJlSOE.exe
  C:\Windows\System\xpJlSOE.exe
  2⤵
  PID:9736
- C:\Windows\System\NdshkRY.exe
  C:\Windows\System\NdshkRY.exe
  2⤵
  PID:9756
- C:\Windows\System\eYdxXqP.exe
  C:\Windows\System\eYdxXqP.exe
  2⤵
  PID:9812
- C:\Windows\System\thooVtF.exe
  C:\Windows\System\thooVtF.exe
  2⤵
  PID:9796
- C:\Windows\System\pKuJsvU.exe
  C:\Windows\System\pKuJsvU.exe
  2⤵
  PID:9832
- C:\Windows\System\jdmIeOy.exe
  C:\Windows\System\jdmIeOy.exe
  2⤵
  PID:9884
- C:\Windows\System\wUdLclx.exe
  C:\Windows\System\wUdLclx.exe
  2⤵
  PID:9284
- C:\Windows\System\jWNTGKt.exe
  C:\Windows\System\jWNTGKt.exe
  2⤵
  PID:9248
- C:\Windows\System\ztMGqxb.exe
  C:\Windows\System\ztMGqxb.exe
  2⤵
  PID:9776
- C:\Windows\System\QVWsbRE.exe
  C:\Windows\System\QVWsbRE.exe
  2⤵
  PID:9476
- C:\Windows\System\KMhRzfa.exe
  C:\Windows\System\KMhRzfa.exe
  2⤵
  PID:8724
- C:\Windows\System\gqlVIsK.exe
  C:\Windows\System\gqlVIsK.exe
  2⤵
  PID:10040
- C:\Windows\System\VtFthcc.exe
  C:\Windows\System\VtFthcc.exe
  2⤵
  PID:9600
- C:\Windows\System\XFRigKN.exe
  C:\Windows\System\XFRigKN.exe
  2⤵
  PID:9976
- C:\Windows\System\BjlUdAW.exe
  C:\Windows\System\BjlUdAW.exe
  2⤵
  PID:9996
- C:\Windows\System\LUwSBFE.exe
  C:\Windows\System\LUwSBFE.exe
  2⤵
  PID:9628
- C:\Windows\System\HgzjknV.exe
  C:\Windows\System\HgzjknV.exe
  2⤵
  PID:9584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AvYzenK.exe

Filesize
1.5MB

MD5
d654a95a6a8bdcf03347355716b7f40b

SHA1
4cb3fb572a36cfa1a200dad8a5e3c55abfaff7a1

SHA256
de2df765a4c77d2def30c2348852a12cb04a7f73c31c975cae2be7b2a26a7f75

SHA512
61c076d3a089ad39784e5ab48fc9250cb46963a4c0ce3e9269268bede8ff44dd34b1b00dfc7d9e3176721d3cd367e42dfcaabdffa9b4a1a24339d24b8540db09

Download Submit
C:\Windows\system\CzjZGMp.exe

Filesize
1.5MB

MD5
489b575a3283cee94d10db53e6a9ba8b

SHA1
28eb66252eaebdb69a392ebf11e42b6d0019d1df

SHA256
ec39066e19065e76cce410873f6dca15b3e01004e6bb38fd68029485b79a15cf

SHA512
4c331a37984852b50ae33825e6c958f36fe02e8fb7d2d0313655350d67bcf6e155bbe261ab0fe52e40c4f41d524ff58a489d95903f320a5f5c2ca996414be8aa

Download Submit
C:\Windows\system\GSOnCtP.exe

Filesize
1.5MB

MD5
363548423384859a18b2e0569370a005

SHA1
2f85eaaa7883b6335b7da49843e61c75e097db04

SHA256
cc4f7bfa4ede7dcb6df5f30d60080b31eda9914771797cebb68d9c191b4d2daf

SHA512
24675532e16c8abf4782d14e195c5b6ece58fcc0b5345044d5db6a8315c134ce36d51de878d7893ffe3af4ccc45946ada507f06f522cd329ade0c53c3c086373

Download Submit
C:\Windows\system\GvkqyTe.exe

Filesize
1.5MB

MD5
650a118abc3a3ac621efe1d751115013

SHA1
b9b89d53d9d5bf69ea4c2cb8132cc96ebd0d8551

SHA256
2d118b995a694d258bc9f91497d470d6695a26fa2c01a090fadb01436369a28f

SHA512
c9772e03069f7a875c63e28ab6e0c494b087aab3d9ef750bc511fc7c78f95f65cf7adc0f9cd1375bacae8c64635725544579a67d43bae7a3ade21908323731f2

Download Submit
C:\Windows\system\KKDMOPx.exe

Filesize
1.5MB

MD5
9c1a54c8a42843d8697c0cee4e115402

SHA1
324bc60ce3783808f9a2d35e3db133b39f74636f

SHA256
2bb25f363d7f3d06e9bc046fc69b362448b593ec69751c431644c4f0fcdddaa5

SHA512
c7b9733cb02eb9a3d4944b01e6185b58971cd669900e8094804e5d87d7db5fdfb59eb55488d49ddcc323afe604c666d459a0cf40c07ddb81f2215f0444328f82

Download Submit
C:\Windows\system\MVavcCn.exe

Filesize
1.5MB

MD5
c235659fb09943abf5a4baaacf95bbc9

SHA1
2f97810781a8738d3d7d2f12df56abbd0de1dacb

SHA256
cc40663b79f8418d8f537b3a4a24ea5646bd9ea4563dff50c4c9ba20a0741ddd

SHA512
6aff362dc01553606ea5c88d50ac61bf866766d84be61a60d9f719ef38674bdc701776f68be7bb01f4c8614c747689ae2737c3ef2e35b5c7a04201a11794e6bf

Download Submit
C:\Windows\system\OmbmLNF.exe

Filesize
1.5MB

MD5
95792d822db53d362548bc4a3fec29e6

SHA1
e7764c241a8151ed9402a97fe2601f01a8cdb914

SHA256
e1d8f8c02b857a873aba497b791152ef62e983d73cba1b1c6fb0993c3a028984

SHA512
3aedc6a30d2733c902cb207c1bce96cf5051399524cac9886bc30693219da7fbe5b1fffc5bc05a3e7b14e02e9fa59171d1cb95aac2e44a7c08bfd3b7b036881d

Download Submit
C:\Windows\system\SQiaqFJ.exe

Filesize
1.5MB

MD5
453ac96c9789e670fe4cc1a6e8325205

SHA1
62501c86cc2a9911a626b72a101c78bfaef3fa4c

SHA256
4df0bffe33fb21d734f04ee5dfba17b6154a7881381781349b28250df4347c6e

SHA512
9c5080599ae4e2e16d1ea0b3201e25f6e0a672f201cfc9e11071a00f05b21d05e88375363c92b204c5394ce13a5e9bb360aae7ef6326900eae397b7041ecf27b

Download Submit
C:\Windows\system\TEeaRBh.exe

Filesize
1.5MB

MD5
f8dfcffa90c96dd5f7ef3571e168683a

SHA1
c466a107e846a8670d2b87f02004baf1a5250dcc

SHA256
fb8545e60257539146439cbcc52346708ab60a1fb20d0c31527f88ca0f955aa6

SHA512
fe445c83ff0cf6543695699e996049ced82d85c3fe4797fb2e36f583af7d17cd7f51ec607504858d95e90561620bb8ccd2776cb832751f80e3671bf25a509c9f

Download Submit
C:\Windows\system\UiimgTV.exe

Filesize
1.5MB

MD5
8de56be6bda28d540d55be9abd1528f3

SHA1
57fa7e2e031e415f3ae6fb9bd4603df011810264

SHA256
7dd53f3ad03ba87772269d54c6f89ef7635e1b73634e7833f3524e02e32a2c77

SHA512
51f435cab6fb3e5b7f59b29a97826ca985ad69dc5e1cec0d5facc9de85a967610db2e29c046de24ea76614b5437a5ab8a966133ae22dfc9e032145103e158720

Download Submit
C:\Windows\system\VoGKCEt.exe

Filesize
1.5MB

MD5
99e9c13a6373542fe741fabde825d9c3

SHA1
db6e2f85999948305e01ac9b7891921aa611be81

SHA256
a205f296fdf568e81531cd2ceaf2083c1180988ccd167ae11a0d8d6744855742

SHA512
1949522352acaa09f19550d5e6be707b0aee8ae058710270f47f7e3b790565af819dd44221e85d3ffa27756faf467f003e97eaf39d84917a0c7540790e9bbc2d

Download Submit
C:\Windows\system\YHzoiXe.exe

Filesize
1.5MB

MD5
8d4df222c014024cb5a8954fe102971d

SHA1
211e9965b46cdf2f28751320939a8cf2e3ce88e9

SHA256
9fd6edfcaaed19059d258c52a9d41fdde6b66ab72ef8b0e7bcdc3a54fbc902c2

SHA512
78eb11e32a223986a63b84bca2f7a63e050816ff193da7e88e9b9a6beab4ef75115bb5439d7dabd316b82376d8d5d4b3e01b713753ebf69b2a60bdd9861e288a

Download Submit
C:\Windows\system\ZECGbef.exe

Filesize
1.5MB

MD5
43c5ee555b4e24b6e8ac871e05b27a6e

SHA1
3f108ba6f1e0f0bcabedd635fb778bd0fd3b2754

SHA256
9a54a39c12945f9cddcf04cb9a20ee572ca7df5d200d4f7e2a9a7d87bf9752d6

SHA512
8c1ced51e9731ff8d15f24abcfedc05baaf10c47d761f22b4b94455eed8bdc18f77ef5cffefee2f51e914d48947b6dc7c17d440329bffb34649ed39cc2ac6760

Download Submit
C:\Windows\system\aWIqqKo.exe

Filesize
1.5MB

MD5
94c8881577b36a4281ea11dad5e19a3d

SHA1
7dbd6abcf536b847a788679aa4336206adbec86a

SHA256
86722ced61a478e25caa191e5719e03420f8a2fc29041720cc3d1ed06274c1ed

SHA512
15f38722b649f194c668c50e4b19d879d0ccf3e1ab92e3bf44d677c1ed5c34c1369c318a49dc4bce063ce7af2138e9aa418e45cbe09e2182bcccb872ff47f1cd

Download Submit
C:\Windows\system\bNSBgEA.exe

Filesize
1.5MB

MD5
0c861a37fd15a94697fd102c09dc3465

SHA1
fb27d7edc16e0451a8bccd47ba603912e910a53f

SHA256
84c5f893d249689d182ba0f601615a0879476818e450e9ed369bc771304a8abc

SHA512
15bc59f7cafa16d9675010129cb3b6945ef1bab63663d36f489d19c37d57559dcda99a1f333aa51db005e148be393e68e9210cca2ec03fccaf23250dbc95a315

Download Submit
C:\Windows\system\bgVZUiB.exe

Filesize
1.5MB

MD5
72aa416c417bfa2138876de92162b113

SHA1
43db9c411a5b8fb4338d90fe27114af6d1cbfd4b

SHA256
8c12be2e585582ddc71546fa104f7cba421de5ff5731e8665d89050a288e0869

SHA512
185212c09d092f60be3b4ab2a4eced80fd4200ddf41b4050c7bc301f2385a47140f31121394ddaace96c56968c812302a8f0f58d7a8248092d8c85c4c0b0ffa5

Download Submit
C:\Windows\system\bswXcIX.exe

Filesize
1.5MB

MD5
b91b6e27e49731aacd528ea446f7c77d

SHA1
34b0ad879912d0214694dd43eefeecfaac65a858

SHA256
a0d4ddd46cb461159ee629bd2498a35c3b15f69c64d3639819d5d6fd9b5d4e67

SHA512
c08c5f300dc383097f3aec4f4616d053350b4b532985c423c67b9bb97087c7634ca2b7919c0ce97dfafa1d12c107e054d1a590cf6319404345584734207569b2

Download Submit
C:\Windows\system\jCurAtU.exe

Filesize
1.5MB

MD5
d435f1a4f00c7c8c1640ce12a25f5bb9

SHA1
8f6c32e10dfd55a36a7716fb6dc78d66102efc45

SHA256
1eeef0271fcbbf45b50791ea61c9bf0f94ae2a9a67d1d8fb1390a8fe49b3b96b

SHA512
9214a3307900aa2a364525f88b20a6f3f02e92b27966fcb5c08a364f57bcaa95baabbc6e62003c4518cd00d9fd9a5d9cc107a9ac9a9f79df29bf64b691bafcb2

Download Submit
C:\Windows\system\lxhFzBE.exe

Filesize
1.5MB

MD5
aed89ee36a8dcb2151292908a02f83bf

SHA1
23aa35588dff3e2b07582be0702fae87378ab1db

SHA256
e35c223116246f608060d5426c0dea4c5121c90ddbb361ab8563683d7657bf20

SHA512
534200582d0c03f7c5cc0fdf1962f2cb742ed108b6f30deb5456479eda2effc87cf7e0fbd5ba9c76fcbb7ba18ab189ee90f300dbd29430acd3e9ed8fd073e17a

Download Submit
C:\Windows\system\nycNYDW.exe

Filesize
1.5MB

MD5
1776916cc322c79a63b92b04247bc972

SHA1
1722a7591baea9b7eccaac5c23b79654b8bb0ee7

SHA256
ed3bfd53b13694299d6a7a511124852fbdc4d180f1bfd8c9535aa37101265120

SHA512
db45f2aa8ae4ed2a83043be9febebfa9f6cceea14e788bf084633340d9db607a6fd7327c5ee16cc05a5c644b997eea06249cddbc763b4843d501a4b8b48c14b5

Download Submit
C:\Windows\system\sChwIYo.exe

Filesize
1.5MB

MD5
e24bef6dc2c12612add7e7be9b312cc4

SHA1
465a2127cc87764bcf50949bfd1ebe62c8f3df89

SHA256
a9f31dc449c8d7cc001082c60184b52663d1e60b9ffe5aab64dea47ed46da3cd

SHA512
5b34fff0e4300298f0126602c8c70559cadd494ff0bb67f1c3221f1ad9bded0e466dd7f299871639f036366790bc8c32148bd103938dcd0617f0be0b1ca809ef

Download Submit
C:\Windows\system\sMqpaSa.exe

Filesize
1.5MB

MD5
84a8b27be8467ee6cf20e612b091140b

SHA1
ec08de8214f71af7481b190675afbd508682768d

SHA256
f2adf441b1e311fe5ef45b8465a470b9464175409068a0b3089f7b2378b3be07

SHA512
39c81a8c0397535231485f701a2b3b3b7902ff7a98fc42c2bab02f800727ac18eae08da5db89273364af406e8bbe625c8815ae90907661f45f6e28a7eb069aea

Download Submit
C:\Windows\system\svNqSNr.exe

Filesize
1.5MB

MD5
9cc0159174ccc0d69adc52ff2f053139

SHA1
ebbd2ed03ac7806f4abf3a9dccc15f019da4557e

SHA256
c78116c61f9fbae718af4ef2bca364ddd451c215b3ffed676034dd3d7f347b59

SHA512
a22b91874d06a6431072ec86cb880f8e5b22dd26a6c835f8e1fba5871599f7d5e2ce591fd440d62f8d4be45761b7e6578e8e6660e83029ac7723c1d4ffdf2ca2

Download Submit
\Windows\system\BxSUgNm.exe

Filesize
1.5MB

MD5
abcc5d3b266e1672c0c93da5bf1d68d0

SHA1
5dba81d445dbba26afdc66b1ec00cad89ac29e70

SHA256
1ef787fb507d0435e0e796614f4a2fba4bb01b5ec0f13f6ada3b3dea019f6c19

SHA512
4add19123180da286fd65f86d612bd6a7f04907446301c93891d145c31b5387b3306f8207164b2f027f2e3f347657f15d699f096b844f382f9c270206c7be215

Download Submit
\Windows\system\CHcJTsA.exe

Filesize
1.5MB

MD5
0646ede93af17a953141c150b69e594f

SHA1
276acbb9dabac914bef10e87ee2697cb6cc793b4

SHA256
8e6f84c872d33011792ffc2168d8d76e3d91653e606b9d05d880421277bf00c6

SHA512
6f310101146162b793d9f1e8a84b724c1058325ed9329e62f22c61960130ef3f09db9dcb160930259cee0b7418b45f174b020acfa9025038145890f7d7c297d7

Download Submit
\Windows\system\CmAMkFM.exe

Filesize
1.5MB

MD5
b4382793559e7b12bc118e808a4be6f2

SHA1
39da666436e2df2028efa37e85fb9c952be451ef

SHA256
2dd641f57a92c2a72feffce330d2e447ed5d25dae83389599f108533aed4f60c

SHA512
479e2344f94503403328dc5c6e5e95e40bfb71e04f02c72dfe12872dc31c35d24704d23eb9905f4268467de1ee4a36ea7391edda658fbab65b52050878eb770c

Download Submit
\Windows\system\GisNqSc.exe

Filesize
1.5MB

MD5
5596f48dfd6d7943d414f6bf25b456af

SHA1
a4c975123a920fafabebd129d21ef112f174028b

SHA256
8f49b8cc98190492c927263871082703ff4dba1005b3dd898ccdddcfa8077d24

SHA512
e8c27c089579175b26a9dcde5637302b05a47680a818b4a7a27b17f83726c7a3c1aab39c72b79e400aa83e6d56eeff49c15eacc0244925398e1b530b80345510

Download Submit
\Windows\system\IwgdbVA.exe

Filesize
1.5MB

MD5
4f397c566a6d7c15b5d93eaf01a91962

SHA1
549eacc979186ac7859e4a17d9fadd46dc329fc6

SHA256
26f2106cc8926637b573b61e26848baf7d1e50b6756514980f635d7112e50e23

SHA512
dece76b892ecd23a079e7c207353c674aaa00406207104faa615cf195aa2fb3c7f99895e2897cd2ca9f1c7a500fd7533452f54127d40b294880aa38fce8f4e96

Download Submit
\Windows\system\JFeQMDQ.exe

Filesize
1.5MB

MD5
5c006a013aa75b33f9598874734c5aad

SHA1
d72770c00068d86f48ca9cd364c7d4c9ab93220d

SHA256
579b1470b17cb6c65fb374b698cf094be744f12d7caf26d9068d765c18dc1604

SHA512
a2d980b7e0c6b87a79c70b24dfdd3f9e3cd57cffa70a3afcca0fc21f51689b298a8f00bfdc448529c67dc2af079a4cce813b105fedfb1a1392ddae96aaf3b7f6

Download Submit
\Windows\system\LEEyHLG.exe

Filesize
1.5MB

MD5
eb9dff1113fb30e442926ef67296c2b2

SHA1
6e3506d47389661b9f4d620f9c3804a75e35bc24

SHA256
520efcf38a8a0a892ee006fd27e6257bd0ea3af77d0de4695606547b620230f4

SHA512
5d66a99c58b7e77fd628b44c0583d43226a75076a3e28c13dc6935b2283b0f62f01d21de545465360fd29f3401614365fe92ac0daa57298060206d3c16c6d7f4

Download Submit
\Windows\system\LyvTjZf.exe

Filesize
1.5MB

MD5
76efe0eab8cfa0cd550a45fffd084606

SHA1
59483e7524630020405e4fe45951dc2d606c57dc

SHA256
0a1f210f4554e49c62caf361fe9fb70d306ecae34358f414395ce8cdfb0114e7

SHA512
db6b0fca513769f262baed971a6948c31ad550770ae67d2fd53c273fb91efc95597bc62163f60e1ba3e1ce664dbb457969dd940cd24ee649c660a1a9e056b079

Download Submit
\Windows\system\OlRlZse.exe

Filesize
1.5MB

MD5
e76dd58b22fdf27d3bc90164293b5a1a

SHA1
76081dc62f8b6275ebd0bc57e43ea9ed12501ebc

SHA256
f8bac5d4794cfbd91e4ac89e9808f80aa1ca3b5c4a82aa15efc5697ff5bf820d

SHA512
9d30278ec091d78b7edf69fca4b268b78dbe07ae8b01fe043b45d41b45bdab58b6f87b5a9655554112e020c473b73c8014a0ce2795fb18d9995c90eb2c037309

Download Submit
\Windows\system\woQQvjl.exe

Filesize
1.5MB

MD5
d857cbd5f06be372a09b504f58a4ae3e

SHA1
92732a800d8c6a06137d49f625f3848240878e19

SHA256
e1b55b7c2862e9d78a4c4809ea85dadce715d37c8dfe8d1b627d0d57d4a1c957

SHA512
c4c6e6a6c46565ed46cd7c1ccea6e1b18906b7e902170adaefb07de636c1d7ae060837b579b65815b01056b67ee7b53184f37d58bb6c5170f9c5ffcc2e4428fb

Download Submit
\Windows\system\yIQBmaK.exe

Filesize
1.5MB

MD5
bcf9accfcbcb5aa95920a7de134a4b36

SHA1
a99c342ca98b5ee930b27fca3ae2a803fc00646a

SHA256
4de701eddf65a44a0526b9e9f2322e233b8186073faa7da40d4dcc84962cea8c

SHA512
3ed638fe3181c6104fc99741f39937491f8556f5e2364ec51751560ba4fb6ea7906746ba38974c93ab1c750e06c85561ca60de35deb63051e781e5271f97dfc5

Download Submit
\Windows\system\zYYaDtL.exe

Filesize
1.5MB

MD5
6afbc1dd473ed9e05746a06d1dcfcb96

SHA1
7f7a37cb6a2be352971ee22a3e84d7a8e7ea9857

SHA256
a73fda1f0fd00db95e3accbea46761f8f182c4d8d4f0d6cea0f519e11d639dbb

SHA512
af51c3d54dc64b84ef1080b140c1146b1ea0fab1f32baf4acecb976b6b4b203a2d307005f2f6883c649d8358d4b78db257fe4a9b75a22a32c489fc0f8bbf5420

Download Submit
memory/756-96-0x000000013F980000-0x000000013FCD1000-memory.dmp

Filesize
3.3MB

Download
memory/756-3694-0x000000013F980000-0x000000013FCD1000-memory.dmp

Filesize
3.3MB

Download
memory/1720-4652-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/1720-142-0x000000013F640000-0x000000013F991000-memory.dmp

Filesize
3.3MB

Download
memory/1996-3047-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/1996-81-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-72-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-41-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-0-0x000000013F5D0000-0x000000013F921000-memory.dmp

Filesize
3.3MB

Download
memory/2140-76-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-407-0x000000013F5D0000-0x000000013F921000-memory.dmp

Filesize
3.3MB

Download
memory/2140-5246-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-127-0x000000013F1A0000-0x000000013F4F1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-141-0x000000013F980000-0x000000013FCD1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-56-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-138-0x000000013FA80000-0x000000013FDD1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-143-0x000000013FF20000-0x0000000140271000-memory.dmp

Filesize
3.3MB

Download
memory/2140-54-0x000000013F260000-0x000000013F5B1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-51-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2140-12-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-29-0x000000013FB30000-0x000000013FE81000-memory.dmp

Filesize
3.3MB

Download
memory/2140-39-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2140-144-0x0000000001F70000-0x00000000022C1000-memory.dmp

Filesize
3.3MB

Download
memory/2508-4582-0x000000013F5F0000-0x000000013F941000-memory.dmp

Filesize
3.3MB

Download
memory/2508-55-0x000000013F5F0000-0x000000013F941000-memory.dmp

Filesize
3.3MB

Download
memory/2520-4640-0x000000013F5D0000-0x000000013F921000-memory.dmp

Filesize
3.3MB

Download
memory/2520-59-0x000000013F5D0000-0x000000013F921000-memory.dmp

Filesize
3.3MB

Download
memory/2576-13-0x000000013F040000-0x000000013F391000-memory.dmp

Filesize
3.3MB

Download
memory/2576-4584-0x000000013F040000-0x000000013F391000-memory.dmp

Filesize
3.3MB

Download
memory/2636-4653-0x000000013FB30000-0x000000013FE81000-memory.dmp

Filesize
3.3MB

Download
memory/2636-49-0x000000013FB30000-0x000000013FE81000-memory.dmp

Filesize
3.3MB

Download
memory/2652-73-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4646-0x000000013F9A0000-0x000000013FCF1000-memory.dmp

Filesize
3.3MB

Download
memory/2728-4623-0x000000013F4D0000-0x000000013F821000-memory.dmp

Filesize
3.3MB

Download
memory/2728-24-0x000000013F4D0000-0x000000013F821000-memory.dmp

Filesize
3.3MB

Download
memory/2772-4118-0x000000013F260000-0x000000013F5B1000-memory.dmp

Filesize
3.3MB

Download
memory/2772-57-0x000000013F260000-0x000000013F5B1000-memory.dmp

Filesize
3.3MB

Download
memory/2868-3944-0x000000013F310000-0x000000013F661000-memory.dmp

Filesize
3.3MB

Download
memory/2868-34-0x000000013F310000-0x000000013F661000-memory.dmp

Filesize
3.3MB

Download
memory/3056-15-0x000000013F6D0000-0x000000013FA21000-memory.dmp

Filesize
3.3MB

Download
memory/3056-4647-0x000000013F6D0000-0x000000013FA21000-memory.dmp

Filesize
3.3MB

Download