xmrig | 474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 09:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
Size

1.9MB
MD5

f2f74aaad99068a4029347ab0ab02a20
SHA1

66f20667b342a22e7f3e62cb580fe302d19e5a7e
SHA256

474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24
SHA512

daffd12db60e713e24ecaa01496ec9b9e38ea9af71a5cf6d68e990de45fb0df3cfc320bf2b4e16a23b0f5407898fae10a19e04e9a978a8f2fca21accf21580e3
SSDEEP

49152:BezaTF8FcNkNdfE0pZ9ozt4wIXIZbGb+7Mxexn24:BemTLkNdfE0pZr8

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 61 IoCs

miner

resource	yara_rule
behavioral1/memory/552-0-0x000000013F6D0000-0x000000013FA24000-memory.dmp	xmrig
behavioral1/files/0x000a0000000122b8-5.dat	xmrig
behavioral1/files/0x00300000000143fd-7.dat	xmrig
behavioral1/files/0x00110000000144f0-9.dat	xmrig
behavioral1/files/0x000700000001471d-29.dat	xmrig
behavioral1/files/0x0006000000015ce1-69.dat	xmrig
behavioral1/files/0x0006000000015ceb-74.dat	xmrig
behavioral1/files/0x0006000000015d5e-99.dat	xmrig
behavioral1/files/0x0006000000015d6f-109.dat	xmrig
behavioral1/files/0x0006000000016117-159.dat	xmrig
behavioral1/memory/1516-536-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/files/0x0031000000014454-154.dat	xmrig
behavioral1/memory/2904-600-0x000000013F040000-0x000000013F394000-memory.dmp	xmrig
behavioral1/memory/2480-598-0x000000013FDF0000-0x0000000140144000-memory.dmp	xmrig
behavioral1/memory/2424-596-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2472-594-0x000000013F210000-0x000000013F564000-memory.dmp	xmrig
behavioral1/memory/2740-592-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/memory/2652-569-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/3020-552-0x000000013F580000-0x000000013F8D4000-memory.dmp	xmrig
behavioral1/memory/1912-542-0x000000013FBC0000-0x000000013FF14000-memory.dmp	xmrig
behavioral1/memory/2684-590-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2792-588-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/memory/2548-576-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2628-560-0x000000013FB50000-0x000000013FEA4000-memory.dmp	xmrig
behavioral1/memory/2996-545-0x000000013FF30000-0x0000000140284000-memory.dmp	xmrig
behavioral1/files/0x0006000000015fe9-150.dat	xmrig
behavioral1/files/0x0006000000015f6d-144.dat	xmrig
behavioral1/files/0x0006000000015e3a-135.dat	xmrig
behavioral1/files/0x0006000000015eaf-139.dat	xmrig
behavioral1/files/0x0006000000015d8f-124.dat	xmrig
behavioral1/files/0x0006000000015d9b-129.dat	xmrig
behavioral1/files/0x0006000000015d79-114.dat	xmrig
behavioral1/files/0x0006000000015d87-119.dat	xmrig
behavioral1/files/0x0006000000015d67-104.dat	xmrig
behavioral1/files/0x0006000000015d56-94.dat	xmrig
behavioral1/files/0x0006000000015d4a-89.dat	xmrig
behavioral1/files/0x0006000000015d28-84.dat	xmrig
behavioral1/files/0x0006000000015d07-79.dat	xmrig
behavioral1/files/0x0006000000015cd5-64.dat	xmrig
behavioral1/files/0x0006000000015cba-59.dat	xmrig
behavioral1/files/0x0006000000015ca6-54.dat	xmrig
behavioral1/files/0x0006000000015be6-49.dat	xmrig
behavioral1/files/0x000800000001568c-44.dat	xmrig
behavioral1/files/0x0007000000014857-40.dat	xmrig
behavioral1/files/0x0007000000014726-35.dat	xmrig
behavioral1/files/0x00080000000146e6-25.dat	xmrig
behavioral1/files/0x0008000000014594-20.dat	xmrig
behavioral1/memory/552-2701-0x000000013F6D0000-0x000000013FA24000-memory.dmp	xmrig
behavioral1/memory/1516-4020-0x000000013FC50000-0x000000013FFA4000-memory.dmp	xmrig
behavioral1/memory/2628-4021-0x000000013FB50000-0x000000013FEA4000-memory.dmp	xmrig
behavioral1/memory/1912-4022-0x000000013FBC0000-0x000000013FF14000-memory.dmp	xmrig
behavioral1/memory/2424-4024-0x000000013F890000-0x000000013FBE4000-memory.dmp	xmrig
behavioral1/memory/2740-4030-0x000000013FA60000-0x000000013FDB4000-memory.dmp	xmrig
behavioral1/memory/2472-4031-0x000000013F210000-0x000000013F564000-memory.dmp	xmrig
behavioral1/memory/2480-4029-0x000000013FDF0000-0x0000000140144000-memory.dmp	xmrig
behavioral1/memory/2792-4028-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	xmrig
behavioral1/memory/2652-4027-0x000000013FD30000-0x0000000140084000-memory.dmp	xmrig
behavioral1/memory/2548-4026-0x000000013F940000-0x000000013FC94000-memory.dmp	xmrig
behavioral1/memory/2904-4025-0x000000013F040000-0x000000013F394000-memory.dmp	xmrig
behavioral1/memory/2684-4023-0x000000013F380000-0x000000013F6D4000-memory.dmp	xmrig
behavioral1/memory/2996-4032-0x000000013FF30000-0x0000000140284000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1516	uJZhJUj.exe
1912	lMnrFtI.exe
2996	OOszyDb.exe
3020	jgcvXwv.exe
2628	BdnCiUl.exe
2652	JQiahPy.exe
2548	umJpoBS.exe
2792	FEaescP.exe
2684	xQQyLgz.exe
2740	gVpoNew.exe
2472	GIYFIBP.exe
2424	SsDVWrm.exe
2480	rQyNKCd.exe
2904	vydHIep.exe
1808	IVrkpJw.exe
1952	dvSxUCM.exe
2412	wFQXEtY.exe
2708	LxCIhhr.exe
2760	dyYOqPy.exe
920	peqEVSd.exe
1944	yrpzKFc.exe
844	qoPgJTa.exe
1716	xqQMmeE.exe
2320	XUGEiTp.exe
2256	KEqoQMB.exe
620	YyKHONR.exe
2852	GaBKPNy.exe
1624	LUVlMWr.exe
336	DxJonyL.exe
2816	dEJknDe.exe
2092	dOePsKf.exe
688	MZkpdpL.exe
592	CFgWeZI.exe
1056	brdksml.exe
1488	FOvjlvn.exe
2188	FUibgGP.exe
1504	yqdhvXY.exe
1100	qYqaaCl.exe
1936	JOnvhSQ.exe
852	vpRXPGq.exe
2056	aEiKkzV.exe
1756	WKRWAMl.exe
400	tWehHAg.exe
3052	ApFXerH.exe
1924	Yyhaydq.exe
1388	eiuRdqn.exe
2012	CTKfDun.exe
2000	gDKjAHW.exe
912	YSBUJSc.exe
3040	BEMuMJa.exe
2504	xvzxmAR.exe
1844	PoGKjwq.exe
1492	xdhPwyK.exe
1668	fdIwKmM.exe
2976	dnhHFLh.exe
580	NZsrRJe.exe
1748	bsOPRqX.exe
2380	qRadRJA.exe
2856	NrYuuFy.exe
2860	uEZCEZH.exe
1564	QLwLchO.exe
1788	TZRHDUb.exe
2612	CVumtvV.exe
2620	oFBwets.exe

Loads dropped DLL 64 IoCs

pid	Process
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/552-0-0x000000013F6D0000-0x000000013FA24000-memory.dmp	upx
behavioral1/files/0x000a0000000122b8-5.dat	upx
behavioral1/files/0x00300000000143fd-7.dat	upx
behavioral1/files/0x00110000000144f0-9.dat	upx
behavioral1/files/0x000700000001471d-29.dat	upx
behavioral1/files/0x0006000000015ce1-69.dat	upx
behavioral1/files/0x0006000000015ceb-74.dat	upx
behavioral1/files/0x0006000000015d5e-99.dat	upx
behavioral1/files/0x0006000000015d6f-109.dat	upx
behavioral1/files/0x0006000000016117-159.dat	upx
behavioral1/memory/1516-536-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/files/0x0031000000014454-154.dat	upx
behavioral1/memory/2904-600-0x000000013F040000-0x000000013F394000-memory.dmp	upx
behavioral1/memory/2480-598-0x000000013FDF0000-0x0000000140144000-memory.dmp	upx
behavioral1/memory/2424-596-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2472-594-0x000000013F210000-0x000000013F564000-memory.dmp	upx
behavioral1/memory/2740-592-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/memory/2652-569-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/3020-552-0x000000013F580000-0x000000013F8D4000-memory.dmp	upx
behavioral1/memory/1912-542-0x000000013FBC0000-0x000000013FF14000-memory.dmp	upx
behavioral1/memory/2684-590-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2792-588-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/memory/2548-576-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2628-560-0x000000013FB50000-0x000000013FEA4000-memory.dmp	upx
behavioral1/memory/2996-545-0x000000013FF30000-0x0000000140284000-memory.dmp	upx
behavioral1/files/0x0006000000015fe9-150.dat	upx
behavioral1/files/0x0006000000015f6d-144.dat	upx
behavioral1/files/0x0006000000015e3a-135.dat	upx
behavioral1/files/0x0006000000015eaf-139.dat	upx
behavioral1/files/0x0006000000015d8f-124.dat	upx
behavioral1/files/0x0006000000015d9b-129.dat	upx
behavioral1/files/0x0006000000015d79-114.dat	upx
behavioral1/files/0x0006000000015d87-119.dat	upx
behavioral1/files/0x0006000000015d67-104.dat	upx
behavioral1/files/0x0006000000015d56-94.dat	upx
behavioral1/files/0x0006000000015d4a-89.dat	upx
behavioral1/files/0x0006000000015d28-84.dat	upx
behavioral1/files/0x0006000000015d07-79.dat	upx
behavioral1/files/0x0006000000015cd5-64.dat	upx
behavioral1/files/0x0006000000015cba-59.dat	upx
behavioral1/files/0x0006000000015ca6-54.dat	upx
behavioral1/files/0x0006000000015be6-49.dat	upx
behavioral1/files/0x000800000001568c-44.dat	upx
behavioral1/files/0x0007000000014857-40.dat	upx
behavioral1/files/0x0007000000014726-35.dat	upx
behavioral1/files/0x00080000000146e6-25.dat	upx
behavioral1/files/0x0008000000014594-20.dat	upx
behavioral1/memory/552-2701-0x000000013F6D0000-0x000000013FA24000-memory.dmp	upx
behavioral1/memory/1516-4020-0x000000013FC50000-0x000000013FFA4000-memory.dmp	upx
behavioral1/memory/2628-4021-0x000000013FB50000-0x000000013FEA4000-memory.dmp	upx
behavioral1/memory/1912-4022-0x000000013FBC0000-0x000000013FF14000-memory.dmp	upx
behavioral1/memory/2424-4024-0x000000013F890000-0x000000013FBE4000-memory.dmp	upx
behavioral1/memory/2740-4030-0x000000013FA60000-0x000000013FDB4000-memory.dmp	upx
behavioral1/memory/2472-4031-0x000000013F210000-0x000000013F564000-memory.dmp	upx
behavioral1/memory/2480-4029-0x000000013FDF0000-0x0000000140144000-memory.dmp	upx
behavioral1/memory/2792-4028-0x000000013F1A0000-0x000000013F4F4000-memory.dmp	upx
behavioral1/memory/2652-4027-0x000000013FD30000-0x0000000140084000-memory.dmp	upx
behavioral1/memory/2548-4026-0x000000013F940000-0x000000013FC94000-memory.dmp	upx
behavioral1/memory/2904-4025-0x000000013F040000-0x000000013F394000-memory.dmp	upx
behavioral1/memory/2684-4023-0x000000013F380000-0x000000013F6D4000-memory.dmp	upx
behavioral1/memory/2996-4032-0x000000013FF30000-0x0000000140284000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\csdeezm.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\OCuLuLc.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\rsfRsIB.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\pbaGZYb.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\UBzbyBT.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\racGimf.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\auNPYMk.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\weNMFwy.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\ymczlVA.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\YfXfWuJ.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\rAyHdLL.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\vSKwqEt.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\pOOFSvW.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\cMTPPvl.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\LkPsdii.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\TOfFywY.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\cNsMpvH.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\jhSinuu.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\BwtidsI.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\NTkUuaL.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\WrNyoXf.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\nkonapQ.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\MeGqCQE.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\wyFNHoY.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\evtROvm.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\GXyzjPW.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\LMvGUgx.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\zpkJifc.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\TnejhJL.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\WqsaQnY.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\BgVamEl.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\LxJRmBX.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\eLKQvtE.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\NfRaQKW.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\MbwVzeg.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\DFVjEkC.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\RJjdHRQ.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\QQtDjqJ.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\wYublTY.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\tJNqkwx.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\ZQjpiCK.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\OwnvtZo.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\rLCPotP.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\FnhiUKv.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\VUlakvX.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\tNJpKjd.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\daQMOgz.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\YyKHONR.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\TzKeHmc.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\qLaaQLU.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\XvDbmCE.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\nXOHoMg.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\colZcVc.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\RAboxkS.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\WyTgyhU.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\KQbZUDX.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\VuLrWOr.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\ceDrtzz.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\gLJJwVS.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\hZvtptw.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\vbwQdSC.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\LgUAcOx.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\GhUfCxf.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
File created	C:\Windows\System\HiNOBum.exe	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1516	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	29
PID 552 wrote to memory of 1516	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	29
PID 552 wrote to memory of 1516	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	29
PID 552 wrote to memory of 1912	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	30
PID 552 wrote to memory of 1912	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	30
PID 552 wrote to memory of 1912	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	30
PID 552 wrote to memory of 2996	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	31
PID 552 wrote to memory of 2996	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	31
PID 552 wrote to memory of 2996	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	31
PID 552 wrote to memory of 3020	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	32
PID 552 wrote to memory of 3020	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	32
PID 552 wrote to memory of 3020	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	32
PID 552 wrote to memory of 2628	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	33
PID 552 wrote to memory of 2628	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	33
PID 552 wrote to memory of 2628	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	33
PID 552 wrote to memory of 2652	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	34
PID 552 wrote to memory of 2652	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	34
PID 552 wrote to memory of 2652	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	34
PID 552 wrote to memory of 2548	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	35
PID 552 wrote to memory of 2548	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	35
PID 552 wrote to memory of 2548	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	35
PID 552 wrote to memory of 2792	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	36
PID 552 wrote to memory of 2792	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	36
PID 552 wrote to memory of 2792	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	36
PID 552 wrote to memory of 2684	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	37
PID 552 wrote to memory of 2684	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	37
PID 552 wrote to memory of 2684	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	37
PID 552 wrote to memory of 2740	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	38
PID 552 wrote to memory of 2740	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	38
PID 552 wrote to memory of 2740	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	38
PID 552 wrote to memory of 2472	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	39
PID 552 wrote to memory of 2472	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	39
PID 552 wrote to memory of 2472	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	39
PID 552 wrote to memory of 2424	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	40
PID 552 wrote to memory of 2424	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	40
PID 552 wrote to memory of 2424	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	40
PID 552 wrote to memory of 2480	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	41
PID 552 wrote to memory of 2480	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	41
PID 552 wrote to memory of 2480	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	41
PID 552 wrote to memory of 2904	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	42
PID 552 wrote to memory of 2904	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	42
PID 552 wrote to memory of 2904	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	42
PID 552 wrote to memory of 1808	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	43
PID 552 wrote to memory of 1808	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	43
PID 552 wrote to memory of 1808	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	43
PID 552 wrote to memory of 1952	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	44
PID 552 wrote to memory of 1952	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	44
PID 552 wrote to memory of 1952	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	44
PID 552 wrote to memory of 2412	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	45
PID 552 wrote to memory of 2412	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	45
PID 552 wrote to memory of 2412	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	45
PID 552 wrote to memory of 2708	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	46
PID 552 wrote to memory of 2708	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	46
PID 552 wrote to memory of 2708	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	46
PID 552 wrote to memory of 2760	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	47
PID 552 wrote to memory of 2760	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	47
PID 552 wrote to memory of 2760	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	47
PID 552 wrote to memory of 920	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	48
PID 552 wrote to memory of 920	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	48
PID 552 wrote to memory of 920	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	48
PID 552 wrote to memory of 1944	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	49
PID 552 wrote to memory of 1944	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	49
PID 552 wrote to memory of 1944	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	49
PID 552 wrote to memory of 844	552	474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\474f08855dcb3089df306c56ae400348e37f0cc0e4a96b119f733f4c9935be24_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\System\uJZhJUj.exe
  C:\Windows\System\uJZhJUj.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\lMnrFtI.exe
  C:\Windows\System\lMnrFtI.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\OOszyDb.exe
  C:\Windows\System\OOszyDb.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\jgcvXwv.exe
  C:\Windows\System\jgcvXwv.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\BdnCiUl.exe
  C:\Windows\System\BdnCiUl.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\JQiahPy.exe
  C:\Windows\System\JQiahPy.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\umJpoBS.exe
  C:\Windows\System\umJpoBS.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\FEaescP.exe
  C:\Windows\System\FEaescP.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\xQQyLgz.exe
  C:\Windows\System\xQQyLgz.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\gVpoNew.exe
  C:\Windows\System\gVpoNew.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\GIYFIBP.exe
  C:\Windows\System\GIYFIBP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\SsDVWrm.exe
  C:\Windows\System\SsDVWrm.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\rQyNKCd.exe
  C:\Windows\System\rQyNKCd.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\vydHIep.exe
  C:\Windows\System\vydHIep.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\IVrkpJw.exe
  C:\Windows\System\IVrkpJw.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\dvSxUCM.exe
  C:\Windows\System\dvSxUCM.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\wFQXEtY.exe
  C:\Windows\System\wFQXEtY.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\LxCIhhr.exe
  C:\Windows\System\LxCIhhr.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\dyYOqPy.exe
  C:\Windows\System\dyYOqPy.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\peqEVSd.exe
  C:\Windows\System\peqEVSd.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\yrpzKFc.exe
  C:\Windows\System\yrpzKFc.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\qoPgJTa.exe
  C:\Windows\System\qoPgJTa.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\xqQMmeE.exe
  C:\Windows\System\xqQMmeE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\XUGEiTp.exe
  C:\Windows\System\XUGEiTp.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\KEqoQMB.exe
  C:\Windows\System\KEqoQMB.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\YyKHONR.exe
  C:\Windows\System\YyKHONR.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\GaBKPNy.exe
  C:\Windows\System\GaBKPNy.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\LUVlMWr.exe
  C:\Windows\System\LUVlMWr.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\DxJonyL.exe
  C:\Windows\System\DxJonyL.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\dEJknDe.exe
  C:\Windows\System\dEJknDe.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\dOePsKf.exe
  C:\Windows\System\dOePsKf.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\MZkpdpL.exe
  C:\Windows\System\MZkpdpL.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\CFgWeZI.exe
  C:\Windows\System\CFgWeZI.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\brdksml.exe
  C:\Windows\System\brdksml.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\FOvjlvn.exe
  C:\Windows\System\FOvjlvn.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\FUibgGP.exe
  C:\Windows\System\FUibgGP.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\yqdhvXY.exe
  C:\Windows\System\yqdhvXY.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\qYqaaCl.exe
  C:\Windows\System\qYqaaCl.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\JOnvhSQ.exe
  C:\Windows\System\JOnvhSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\vpRXPGq.exe
  C:\Windows\System\vpRXPGq.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\aEiKkzV.exe
  C:\Windows\System\aEiKkzV.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\WKRWAMl.exe
  C:\Windows\System\WKRWAMl.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\tWehHAg.exe
  C:\Windows\System\tWehHAg.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\ApFXerH.exe
  C:\Windows\System\ApFXerH.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\Yyhaydq.exe
  C:\Windows\System\Yyhaydq.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\eiuRdqn.exe
  C:\Windows\System\eiuRdqn.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\CTKfDun.exe
  C:\Windows\System\CTKfDun.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\gDKjAHW.exe
  C:\Windows\System\gDKjAHW.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\YSBUJSc.exe
  C:\Windows\System\YSBUJSc.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\BEMuMJa.exe
  C:\Windows\System\BEMuMJa.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\xvzxmAR.exe
  C:\Windows\System\xvzxmAR.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\PoGKjwq.exe
  C:\Windows\System\PoGKjwq.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\xdhPwyK.exe
  C:\Windows\System\xdhPwyK.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\fdIwKmM.exe
  C:\Windows\System\fdIwKmM.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\dnhHFLh.exe
  C:\Windows\System\dnhHFLh.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\NZsrRJe.exe
  C:\Windows\System\NZsrRJe.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\bsOPRqX.exe
  C:\Windows\System\bsOPRqX.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\qRadRJA.exe
  C:\Windows\System\qRadRJA.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\NrYuuFy.exe
  C:\Windows\System\NrYuuFy.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\uEZCEZH.exe
  C:\Windows\System\uEZCEZH.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\QLwLchO.exe
  C:\Windows\System\QLwLchO.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\TZRHDUb.exe
  C:\Windows\System\TZRHDUb.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\CVumtvV.exe
  C:\Windows\System\CVumtvV.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\oFBwets.exe
  C:\Windows\System\oFBwets.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\CwiVQrR.exe
  C:\Windows\System\CwiVQrR.exe
  2⤵
  PID:2532
- C:\Windows\System\DHoYRiX.exe
  C:\Windows\System\DHoYRiX.exe
  2⤵
  PID:2584
- C:\Windows\System\SqGTKbo.exe
  C:\Windows\System\SqGTKbo.exe
  2⤵
  PID:2448
- C:\Windows\System\zKrlKpQ.exe
  C:\Windows\System\zKrlKpQ.exe
  2⤵
  PID:2616
- C:\Windows\System\vQHnAsj.exe
  C:\Windows\System\vQHnAsj.exe
  2⤵
  PID:2444
- C:\Windows\System\XWtPoiM.exe
  C:\Windows\System\XWtPoiM.exe
  2⤵
  PID:2184
- C:\Windows\System\CHLFpba.exe
  C:\Windows\System\CHLFpba.exe
  2⤵
  PID:1932
- C:\Windows\System\IhaxKtR.exe
  C:\Windows\System\IhaxKtR.exe
  2⤵
  PID:2744
- C:\Windows\System\REBkekh.exe
  C:\Windows\System\REBkekh.exe
  2⤵
  PID:1280
- C:\Windows\System\ptfVtnD.exe
  C:\Windows\System\ptfVtnD.exe
  2⤵
  PID:2876
- C:\Windows\System\zNYQWNp.exe
  C:\Windows\System\zNYQWNp.exe
  2⤵
  PID:1284
- C:\Windows\System\efzhuXm.exe
  C:\Windows\System\efzhuXm.exe
  2⤵
  PID:1104
- C:\Windows\System\dusroJL.exe
  C:\Windows\System\dusroJL.exe
  2⤵
  PID:2520
- C:\Windows\System\XtLJRxL.exe
  C:\Windows\System\XtLJRxL.exe
  2⤵
  PID:2288
- C:\Windows\System\OaiVPuo.exe
  C:\Windows\System\OaiVPuo.exe
  2⤵
  PID:1908
- C:\Windows\System\kazGmhp.exe
  C:\Windows\System\kazGmhp.exe
  2⤵
  PID:2408
- C:\Windows\System\mkrQxaG.exe
  C:\Windows\System\mkrQxaG.exe
  2⤵
  PID:780
- C:\Windows\System\qCsSqSA.exe
  C:\Windows\System\qCsSqSA.exe
  2⤵
  PID:984
- C:\Windows\System\pblYOiz.exe
  C:\Windows\System\pblYOiz.exe
  2⤵
  PID:2060
- C:\Windows\System\cKzjzih.exe
  C:\Windows\System\cKzjzih.exe
  2⤵
  PID:2772
- C:\Windows\System\FkRHRgS.exe
  C:\Windows\System\FkRHRgS.exe
  2⤵
  PID:640
- C:\Windows\System\SWPjqAV.exe
  C:\Windows\System\SWPjqAV.exe
  2⤵
  PID:2276
- C:\Windows\System\jcgkePT.exe
  C:\Windows\System\jcgkePT.exe
  2⤵
  PID:2128
- C:\Windows\System\EfHBGVB.exe
  C:\Windows\System\EfHBGVB.exe
  2⤵
  PID:1768
- C:\Windows\System\IltGyPq.exe
  C:\Windows\System\IltGyPq.exe
  2⤵
  PID:960
- C:\Windows\System\EVGBpoL.exe
  C:\Windows\System\EVGBpoL.exe
  2⤵
  PID:820
- C:\Windows\System\OqYrcaA.exe
  C:\Windows\System\OqYrcaA.exe
  2⤵
  PID:1992
- C:\Windows\System\asqBbaN.exe
  C:\Windows\System\asqBbaN.exe
  2⤵
  PID:1568
- C:\Windows\System\HaMXUSr.exe
  C:\Windows\System\HaMXUSr.exe
  2⤵
  PID:1572
- C:\Windows\System\AAECgRn.exe
  C:\Windows\System\AAECgRn.exe
  2⤵
  PID:2052
- C:\Windows\System\QnOWANQ.exe
  C:\Windows\System\QnOWANQ.exe
  2⤵
  PID:2212
- C:\Windows\System\AVlukQF.exe
  C:\Windows\System\AVlukQF.exe
  2⤵
  PID:2956
- C:\Windows\System\bONoLne.exe
  C:\Windows\System\bONoLne.exe
  2⤵
  PID:1732
- C:\Windows\System\vIzMrGq.exe
  C:\Windows\System\vIzMrGq.exe
  2⤵
  PID:2096
- C:\Windows\System\noxqsnu.exe
  C:\Windows\System\noxqsnu.exe
  2⤵
  PID:1680
- C:\Windows\System\VrckMJZ.exe
  C:\Windows\System\VrckMJZ.exe
  2⤵
  PID:1636
- C:\Windows\System\QOEzBJt.exe
  C:\Windows\System\QOEzBJt.exe
  2⤵
  PID:2572
- C:\Windows\System\cPJFfPX.exe
  C:\Windows\System\cPJFfPX.exe
  2⤵
  PID:2680
- C:\Windows\System\LrfcWAb.exe
  C:\Windows\System\LrfcWAb.exe
  2⤵
  PID:2456
- C:\Windows\System\lQZmgie.exe
  C:\Windows\System\lQZmgie.exe
  2⤵
  PID:2592
- C:\Windows\System\poAMzUj.exe
  C:\Windows\System\poAMzUj.exe
  2⤵
  PID:2748
- C:\Windows\System\rKmkkTn.exe
  C:\Windows\System\rKmkkTn.exe
  2⤵
  PID:2884
- C:\Windows\System\aPVhRJi.exe
  C:\Windows\System\aPVhRJi.exe
  2⤵
  PID:2216
- C:\Windows\System\vcuQVEF.exe
  C:\Windows\System\vcuQVEF.exe
  2⤵
  PID:2352
- C:\Windows\System\jwAYfwF.exe
  C:\Windows\System\jwAYfwF.exe
  2⤵
  PID:2940
- C:\Windows\System\NcNgrpI.exe
  C:\Windows\System\NcNgrpI.exe
  2⤵
  PID:2112
- C:\Windows\System\EFhKXtg.exe
  C:\Windows\System\EFhKXtg.exe
  2⤵
  PID:576
- C:\Windows\System\uXtGGnS.exe
  C:\Windows\System\uXtGGnS.exe
  2⤵
  PID:816
- C:\Windows\System\LCSUAiD.exe
  C:\Windows\System\LCSUAiD.exe
  2⤵
  PID:2100
- C:\Windows\System\uoeiRKg.exe
  C:\Windows\System\uoeiRKg.exe
  2⤵
  PID:1996
- C:\Windows\System\racGimf.exe
  C:\Windows\System\racGimf.exe
  2⤵
  PID:1772
- C:\Windows\System\XtPXPjD.exe
  C:\Windows\System\XtPXPjD.exe
  2⤵
  PID:1364
- C:\Windows\System\HmDAMUU.exe
  C:\Windows\System\HmDAMUU.exe
  2⤵
  PID:956
- C:\Windows\System\LkbBVBs.exe
  C:\Windows\System\LkbBVBs.exe
  2⤵
  PID:784
- C:\Windows\System\eNTfkZG.exe
  C:\Windows\System\eNTfkZG.exe
  2⤵
  PID:2124
- C:\Windows\System\VKWWMmD.exe
  C:\Windows\System\VKWWMmD.exe
  2⤵
  PID:2844
- C:\Windows\System\oVKdvpn.exe
  C:\Windows\System\oVKdvpn.exe
  2⤵
  PID:1584
- C:\Windows\System\iRxQdRt.exe
  C:\Windows\System\iRxQdRt.exe
  2⤵
  PID:2668
- C:\Windows\System\VIdowFH.exe
  C:\Windows\System\VIdowFH.exe
  2⤵
  PID:2712
- C:\Windows\System\HDsVPZY.exe
  C:\Windows\System\HDsVPZY.exe
  2⤵
  PID:2900
- C:\Windows\System\hXDZjQb.exe
  C:\Windows\System\hXDZjQb.exe
  2⤵
  PID:1040
- C:\Windows\System\QEONgey.exe
  C:\Windows\System\QEONgey.exe
  2⤵
  PID:1308
- C:\Windows\System\uXePgsv.exe
  C:\Windows\System\uXePgsv.exe
  2⤵
  PID:3088
- C:\Windows\System\nxEiiRB.exe
  C:\Windows\System\nxEiiRB.exe
  2⤵
  PID:3108
- C:\Windows\System\QaeALrn.exe
  C:\Windows\System\QaeALrn.exe
  2⤵
  PID:3128
- C:\Windows\System\QTNbeOd.exe
  C:\Windows\System\QTNbeOd.exe
  2⤵
  PID:3148
- C:\Windows\System\lkYIoTA.exe
  C:\Windows\System\lkYIoTA.exe
  2⤵
  PID:3168
- C:\Windows\System\vHFjwaJ.exe
  C:\Windows\System\vHFjwaJ.exe
  2⤵
  PID:3188
- C:\Windows\System\cBQNrQU.exe
  C:\Windows\System\cBQNrQU.exe
  2⤵
  PID:3208
- C:\Windows\System\CnokzVH.exe
  C:\Windows\System\CnokzVH.exe
  2⤵
  PID:3228
- C:\Windows\System\okFueaH.exe
  C:\Windows\System\okFueaH.exe
  2⤵
  PID:3248
- C:\Windows\System\YfXfWuJ.exe
  C:\Windows\System\YfXfWuJ.exe
  2⤵
  PID:3264
- C:\Windows\System\OEsLBlp.exe
  C:\Windows\System\OEsLBlp.exe
  2⤵
  PID:3288
- C:\Windows\System\GBmDyHs.exe
  C:\Windows\System\GBmDyHs.exe
  2⤵
  PID:3304
- C:\Windows\System\MGZlJQD.exe
  C:\Windows\System\MGZlJQD.exe
  2⤵
  PID:3324
- C:\Windows\System\POZWphz.exe
  C:\Windows\System\POZWphz.exe
  2⤵
  PID:3348
- C:\Windows\System\OeHAoCI.exe
  C:\Windows\System\OeHAoCI.exe
  2⤵
  PID:3368
- C:\Windows\System\JfrQnkC.exe
  C:\Windows\System\JfrQnkC.exe
  2⤵
  PID:3388
- C:\Windows\System\kWBumgB.exe
  C:\Windows\System\kWBumgB.exe
  2⤵
  PID:3408
- C:\Windows\System\qCtORrh.exe
  C:\Windows\System\qCtORrh.exe
  2⤵
  PID:3428
- C:\Windows\System\SeEmuAS.exe
  C:\Windows\System\SeEmuAS.exe
  2⤵
  PID:3448
- C:\Windows\System\RBbpKHf.exe
  C:\Windows\System\RBbpKHf.exe
  2⤵
  PID:3468
- C:\Windows\System\IVSFkkC.exe
  C:\Windows\System\IVSFkkC.exe
  2⤵
  PID:3488
- C:\Windows\System\AdIJdsu.exe
  C:\Windows\System\AdIJdsu.exe
  2⤵
  PID:3508
- C:\Windows\System\HGyBSkg.exe
  C:\Windows\System\HGyBSkg.exe
  2⤵
  PID:3528
- C:\Windows\System\PnyWySN.exe
  C:\Windows\System\PnyWySN.exe
  2⤵
  PID:3548
- C:\Windows\System\bVvsJJW.exe
  C:\Windows\System\bVvsJJW.exe
  2⤵
  PID:3568
- C:\Windows\System\WvRjQab.exe
  C:\Windows\System\WvRjQab.exe
  2⤵
  PID:3588
- C:\Windows\System\gqKgXYX.exe
  C:\Windows\System\gqKgXYX.exe
  2⤵
  PID:3608
- C:\Windows\System\fFPCWir.exe
  C:\Windows\System\fFPCWir.exe
  2⤵
  PID:3628
- C:\Windows\System\OHTVezP.exe
  C:\Windows\System\OHTVezP.exe
  2⤵
  PID:3644
- C:\Windows\System\areklbw.exe
  C:\Windows\System\areklbw.exe
  2⤵
  PID:3664
- C:\Windows\System\LEoRyVS.exe
  C:\Windows\System\LEoRyVS.exe
  2⤵
  PID:3704
- C:\Windows\System\YieQMHo.exe
  C:\Windows\System\YieQMHo.exe
  2⤵
  PID:3724
- C:\Windows\System\gLJJwVS.exe
  C:\Windows\System\gLJJwVS.exe
  2⤵
  PID:3748
- C:\Windows\System\PmKFQJd.exe
  C:\Windows\System\PmKFQJd.exe
  2⤵
  PID:3768
- C:\Windows\System\qlYiXxY.exe
  C:\Windows\System\qlYiXxY.exe
  2⤵
  PID:3788
- C:\Windows\System\OPcJTpd.exe
  C:\Windows\System\OPcJTpd.exe
  2⤵
  PID:3804
- C:\Windows\System\FkACRuf.exe
  C:\Windows\System\FkACRuf.exe
  2⤵
  PID:3824
- C:\Windows\System\yelYcYz.exe
  C:\Windows\System\yelYcYz.exe
  2⤵
  PID:3844
- C:\Windows\System\ZgHOldp.exe
  C:\Windows\System\ZgHOldp.exe
  2⤵
  PID:3860
- C:\Windows\System\ViKMkxC.exe
  C:\Windows\System\ViKMkxC.exe
  2⤵
  PID:3880
- C:\Windows\System\zjdEyET.exe
  C:\Windows\System\zjdEyET.exe
  2⤵
  PID:3900
- C:\Windows\System\mounXOc.exe
  C:\Windows\System\mounXOc.exe
  2⤵
  PID:3916
- C:\Windows\System\RjdnZxw.exe
  C:\Windows\System\RjdnZxw.exe
  2⤵
  PID:3936
- C:\Windows\System\oPjsGxj.exe
  C:\Windows\System\oPjsGxj.exe
  2⤵
  PID:3956
- C:\Windows\System\jCFTRar.exe
  C:\Windows\System\jCFTRar.exe
  2⤵
  PID:3972
- C:\Windows\System\zGSwQmA.exe
  C:\Windows\System\zGSwQmA.exe
  2⤵
  PID:3992
- C:\Windows\System\rySMBhg.exe
  C:\Windows\System\rySMBhg.exe
  2⤵
  PID:4008
- C:\Windows\System\GFiqwaZ.exe
  C:\Windows\System\GFiqwaZ.exe
  2⤵
  PID:4024
- C:\Windows\System\TzKeHmc.exe
  C:\Windows\System\TzKeHmc.exe
  2⤵
  PID:4048
- C:\Windows\System\ZTBeCjl.exe
  C:\Windows\System\ZTBeCjl.exe
  2⤵
  PID:2200
- C:\Windows\System\fCikuSC.exe
  C:\Windows\System\fCikuSC.exe
  2⤵
  PID:1444
- C:\Windows\System\fNFNfeV.exe
  C:\Windows\System\fNFNfeV.exe
  2⤵
  PID:2568
- C:\Windows\System\Umqlfkk.exe
  C:\Windows\System\Umqlfkk.exe
  2⤵
  PID:3004
- C:\Windows\System\YmirPjE.exe
  C:\Windows\System\YmirPjE.exe
  2⤵
  PID:3076
- C:\Windows\System\tAezxAJ.exe
  C:\Windows\System\tAezxAJ.exe
  2⤵
  PID:3124
- C:\Windows\System\BrWurmM.exe
  C:\Windows\System\BrWurmM.exe
  2⤵
  PID:3144
- C:\Windows\System\RNjWAgY.exe
  C:\Windows\System\RNjWAgY.exe
  2⤵
  PID:3160
- C:\Windows\System\cNsMpvH.exe
  C:\Windows\System\cNsMpvH.exe
  2⤵
  PID:3180
- C:\Windows\System\DVcSkuj.exe
  C:\Windows\System\DVcSkuj.exe
  2⤵
  PID:3224
- C:\Windows\System\phgGvZs.exe
  C:\Windows\System\phgGvZs.exe
  2⤵
  PID:3276
- C:\Windows\System\VFDLzHG.exe
  C:\Windows\System\VFDLzHG.exe
  2⤵
  PID:3312
- C:\Windows\System\iaJtVLp.exe
  C:\Windows\System\iaJtVLp.exe
  2⤵
  PID:3356
- C:\Windows\System\jULSovb.exe
  C:\Windows\System\jULSovb.exe
  2⤵
  PID:3332
- C:\Windows\System\DytrgJd.exe
  C:\Windows\System\DytrgJd.exe
  2⤵
  PID:3396
- C:\Windows\System\LxopGXB.exe
  C:\Windows\System\LxopGXB.exe
  2⤵
  PID:3440
- C:\Windows\System\bnUWbkJ.exe
  C:\Windows\System\bnUWbkJ.exe
  2⤵
  PID:3476
- C:\Windows\System\wzdAFtC.exe
  C:\Windows\System\wzdAFtC.exe
  2⤵
  PID:3516
- C:\Windows\System\hUYIhdm.exe
  C:\Windows\System\hUYIhdm.exe
  2⤵
  PID:3536
- C:\Windows\System\ZmDwTtj.exe
  C:\Windows\System\ZmDwTtj.exe
  2⤵
  PID:3564
- C:\Windows\System\mgVeeIM.exe
  C:\Windows\System\mgVeeIM.exe
  2⤵
  PID:3596
- C:\Windows\System\FnhiUKv.exe
  C:\Windows\System\FnhiUKv.exe
  2⤵
  PID:3624
- C:\Windows\System\XUYZVea.exe
  C:\Windows\System\XUYZVea.exe
  2⤵
  PID:3656
- C:\Windows\System\bzgjiix.exe
  C:\Windows\System\bzgjiix.exe
  2⤵
  PID:2656
- C:\Windows\System\rBkjXVh.exe
  C:\Windows\System\rBkjXVh.exe
  2⤵
  PID:2328
- C:\Windows\System\dHGmXbJ.exe
  C:\Windows\System\dHGmXbJ.exe
  2⤵
  PID:1304
- C:\Windows\System\zTxMRfw.exe
  C:\Windows\System\zTxMRfw.exe
  2⤵
  PID:2028
- C:\Windows\System\ldXEGOC.exe
  C:\Windows\System\ldXEGOC.exe
  2⤵
  PID:2928
- C:\Windows\System\nXOHoMg.exe
  C:\Windows\System\nXOHoMg.exe
  2⤵
  PID:2804
- C:\Windows\System\wYublTY.exe
  C:\Windows\System\wYublTY.exe
  2⤵
  PID:1980
- C:\Windows\System\gUKLEdR.exe
  C:\Windows\System\gUKLEdR.exe
  2⤵
  PID:2384
- C:\Windows\System\lRugXza.exe
  C:\Windows\System\lRugXza.exe
  2⤵
  PID:2316
- C:\Windows\System\BDrLWsr.exe
  C:\Windows\System\BDrLWsr.exe
  2⤵
  PID:1248
- C:\Windows\System\LrLwCwK.exe
  C:\Windows\System\LrLwCwK.exe
  2⤵
  PID:1600
- C:\Windows\System\ssWyrnt.exe
  C:\Windows\System\ssWyrnt.exe
  2⤵
  PID:2972
- C:\Windows\System\jTgLISB.exe
  C:\Windows\System\jTgLISB.exe
  2⤵
  PID:2560
- C:\Windows\System\mDXQDuo.exe
  C:\Windows\System\mDXQDuo.exe
  2⤵
  PID:2944
- C:\Windows\System\pZwtoSU.exe
  C:\Windows\System\pZwtoSU.exe
  2⤵
  PID:3692
- C:\Windows\System\tnbZytZ.exe
  C:\Windows\System\tnbZytZ.exe
  2⤵
  PID:3876
- C:\Windows\System\IeADkVW.exe
  C:\Windows\System\IeADkVW.exe
  2⤵
  PID:3984
- C:\Windows\System\WcnoALk.exe
  C:\Windows\System\WcnoALk.exe
  2⤵
  PID:3764
- C:\Windows\System\GWhFcJO.exe
  C:\Windows\System\GWhFcJO.exe
  2⤵
  PID:3840
- C:\Windows\System\bqVcUPl.exe
  C:\Windows\System\bqVcUPl.exe
  2⤵
  PID:3780
- C:\Windows\System\Bmnquvq.exe
  C:\Windows\System\Bmnquvq.exe
  2⤵
  PID:3888
- C:\Windows\System\URFkfdT.exe
  C:\Windows\System\URFkfdT.exe
  2⤵
  PID:3964
- C:\Windows\System\GnwIBan.exe
  C:\Windows\System\GnwIBan.exe
  2⤵
  PID:1148
- C:\Windows\System\aAaicfh.exe
  C:\Windows\System\aAaicfh.exe
  2⤵
  PID:1200
- C:\Windows\System\yJDNYDI.exe
  C:\Windows\System\yJDNYDI.exe
  2⤵
  PID:1052
- C:\Windows\System\ypISOqE.exe
  C:\Windows\System\ypISOqE.exe
  2⤵
  PID:2160
- C:\Windows\System\TQaEQxE.exe
  C:\Windows\System\TQaEQxE.exe
  2⤵
  PID:880
- C:\Windows\System\EGbVhAz.exe
  C:\Windows\System\EGbVhAz.exe
  2⤵
  PID:1512
- C:\Windows\System\KpTFbAP.exe
  C:\Windows\System\KpTFbAP.exe
  2⤵
  PID:3116
- C:\Windows\System\BkRxMlx.exe
  C:\Windows\System\BkRxMlx.exe
  2⤵
  PID:3156
- C:\Windows\System\SSGQDNA.exe
  C:\Windows\System\SSGQDNA.exe
  2⤵
  PID:3204
- C:\Windows\System\ukirEAl.exe
  C:\Windows\System\ukirEAl.exe
  2⤵
  PID:3256
- C:\Windows\System\xuuhmRr.exe
  C:\Windows\System\xuuhmRr.exe
  2⤵
  PID:3296
- C:\Windows\System\iiYyfFo.exe
  C:\Windows\System\iiYyfFo.exe
  2⤵
  PID:3416
- C:\Windows\System\jaoabIj.exe
  C:\Windows\System\jaoabIj.exe
  2⤵
  PID:3384
- C:\Windows\System\sidWiNX.exe
  C:\Windows\System\sidWiNX.exe
  2⤵
  PID:3456
- C:\Windows\System\PNRAHGW.exe
  C:\Windows\System\PNRAHGW.exe
  2⤵
  PID:3556
- C:\Windows\System\qbYdPlL.exe
  C:\Windows\System\qbYdPlL.exe
  2⤵
  PID:3616
- C:\Windows\System\xmSaBuQ.exe
  C:\Windows\System\xmSaBuQ.exe
  2⤵
  PID:3584
- C:\Windows\System\ICHhxHz.exe
  C:\Windows\System\ICHhxHz.exe
  2⤵
  PID:3636
- C:\Windows\System\NMvpvEi.exe
  C:\Windows\System\NMvpvEi.exe
  2⤵
  PID:2752
- C:\Windows\System\TtVxoRH.exe
  C:\Windows\System\TtVxoRH.exe
  2⤵
  PID:1296
- C:\Windows\System\ZIhYZBn.exe
  C:\Windows\System\ZIhYZBn.exe
  2⤵
  PID:3680
- C:\Windows\System\UHRdjNA.exe
  C:\Windows\System\UHRdjNA.exe
  2⤵
  PID:1964
- C:\Windows\System\FsByRJE.exe
  C:\Windows\System\FsByRJE.exe
  2⤵
  PID:1928
- C:\Windows\System\mahcuxq.exe
  C:\Windows\System\mahcuxq.exe
  2⤵
  PID:1536
- C:\Windows\System\fcewMYI.exe
  C:\Windows\System\fcewMYI.exe
  2⤵
  PID:884
- C:\Windows\System\QQqnxvE.exe
  C:\Windows\System\QQqnxvE.exe
  2⤵
  PID:3684
- C:\Windows\System\RdKKCYO.exe
  C:\Windows\System\RdKKCYO.exe
  2⤵
  PID:1268
- C:\Windows\System\OEWPIyp.exe
  C:\Windows\System\OEWPIyp.exe
  2⤵
  PID:3988
- C:\Windows\System\kMpkhof.exe
  C:\Windows\System\kMpkhof.exe
  2⤵
  PID:4032
- C:\Windows\System\wfAdanK.exe
  C:\Windows\System\wfAdanK.exe
  2⤵
  PID:3872
- C:\Windows\System\colZcVc.exe
  C:\Windows\System\colZcVc.exe
  2⤵
  PID:924
- C:\Windows\System\CEtdCZu.exe
  C:\Windows\System\CEtdCZu.exe
  2⤵
  PID:3736
- C:\Windows\System\UibwewB.exe
  C:\Windows\System\UibwewB.exe
  2⤵
  PID:2312
- C:\Windows\System\knbBTCR.exe
  C:\Windows\System\knbBTCR.exe
  2⤵
  PID:1008
- C:\Windows\System\VRVqfDP.exe
  C:\Windows\System\VRVqfDP.exe
  2⤵
  PID:3200
- C:\Windows\System\xyUsiPH.exe
  C:\Windows\System\xyUsiPH.exe
  2⤵
  PID:1692
- C:\Windows\System\mgvlXvJ.exe
  C:\Windows\System\mgvlXvJ.exe
  2⤵
  PID:3240
- C:\Windows\System\pWmDJPl.exe
  C:\Windows\System\pWmDJPl.exe
  2⤵
  PID:3176
- C:\Windows\System\ASDawvc.exe
  C:\Windows\System\ASDawvc.exe
  2⤵
  PID:3460
- C:\Windows\System\KDQdPYn.exe
  C:\Windows\System\KDQdPYn.exe
  2⤵
  PID:3544
- C:\Windows\System\SJXkmcR.exe
  C:\Windows\System\SJXkmcR.exe
  2⤵
  PID:3520
- C:\Windows\System\arcangF.exe
  C:\Windows\System\arcangF.exe
  2⤵
  PID:2440
- C:\Windows\System\XGLUecw.exe
  C:\Windows\System\XGLUecw.exe
  2⤵
  PID:316
- C:\Windows\System\NRCeSDr.exe
  C:\Windows\System\NRCeSDr.exe
  2⤵
  PID:2460
- C:\Windows\System\SxPFtji.exe
  C:\Windows\System\SxPFtji.exe
  2⤵
  PID:2892
- C:\Windows\System\TnejhJL.exe
  C:\Windows\System\TnejhJL.exe
  2⤵
  PID:3944
- C:\Windows\System\tJNqkwx.exe
  C:\Windows\System\tJNqkwx.exe
  2⤵
  PID:3820
- C:\Windows\System\kAtcyUy.exe
  C:\Windows\System\kAtcyUy.exe
  2⤵
  PID:2580
- C:\Windows\System\kKWBQgC.exe
  C:\Windows\System\kKWBQgC.exe
  2⤵
  PID:3800
- C:\Windows\System\KgsWgTp.exe
  C:\Windows\System\KgsWgTp.exe
  2⤵
  PID:3756
- C:\Windows\System\jbJGVDI.exe
  C:\Windows\System\jbJGVDI.exe
  2⤵
  PID:3924
- C:\Windows\System\auNPYMk.exe
  C:\Windows\System\auNPYMk.exe
  2⤵
  PID:428
- C:\Windows\System\ujBDyNm.exe
  C:\Windows\System\ujBDyNm.exe
  2⤵
  PID:2360
- C:\Windows\System\WFmieaW.exe
  C:\Windows\System\WFmieaW.exe
  2⤵
  PID:3344
- C:\Windows\System\CfbDhWG.exe
  C:\Windows\System\CfbDhWG.exe
  2⤵
  PID:3244
- C:\Windows\System\ZpIjQiK.exe
  C:\Windows\System\ZpIjQiK.exe
  2⤵
  PID:2664
- C:\Windows\System\flCMXni.exe
  C:\Windows\System\flCMXni.exe
  2⤵
  PID:2136
- C:\Windows\System\JSrcWxm.exe
  C:\Windows\System\JSrcWxm.exe
  2⤵
  PID:1800
- C:\Windows\System\fhpvXJf.exe
  C:\Windows\System\fhpvXJf.exe
  2⤵
  PID:2820
- C:\Windows\System\vSOyVqv.exe
  C:\Windows\System\vSOyVqv.exe
  2⤵
  PID:4056
- C:\Windows\System\VETzBEk.exe
  C:\Windows\System\VETzBEk.exe
  2⤵
  PID:2700
- C:\Windows\System\usbVQvz.exe
  C:\Windows\System\usbVQvz.exe
  2⤵
  PID:3932
- C:\Windows\System\URgRcnz.exe
  C:\Windows\System\URgRcnz.exe
  2⤵
  PID:3164
- C:\Windows\System\jnesocr.exe
  C:\Windows\System\jnesocr.exe
  2⤵
  PID:3260
- C:\Windows\System\csdeezm.exe
  C:\Windows\System\csdeezm.exe
  2⤵
  PID:2676
- C:\Windows\System\mxionhU.exe
  C:\Windows\System\mxionhU.exe
  2⤵
  PID:2968
- C:\Windows\System\hoPhjlb.exe
  C:\Windows\System\hoPhjlb.exe
  2⤵
  PID:3796
- C:\Windows\System\ZQjpiCK.exe
  C:\Windows\System\ZQjpiCK.exe
  2⤵
  PID:4108
- C:\Windows\System\RaLqAKT.exe
  C:\Windows\System\RaLqAKT.exe
  2⤵
  PID:4128
- C:\Windows\System\PHGbsqD.exe
  C:\Windows\System\PHGbsqD.exe
  2⤵
  PID:4148
- C:\Windows\System\TMDqfya.exe
  C:\Windows\System\TMDqfya.exe
  2⤵
  PID:4168
- C:\Windows\System\edzuDzc.exe
  C:\Windows\System\edzuDzc.exe
  2⤵
  PID:4188
- C:\Windows\System\mhHAmIV.exe
  C:\Windows\System\mhHAmIV.exe
  2⤵
  PID:4208
- C:\Windows\System\yRdzHVi.exe
  C:\Windows\System\yRdzHVi.exe
  2⤵
  PID:4228
- C:\Windows\System\NUKqJjc.exe
  C:\Windows\System\NUKqJjc.exe
  2⤵
  PID:4248
- C:\Windows\System\rAyHdLL.exe
  C:\Windows\System\rAyHdLL.exe
  2⤵
  PID:4264
- C:\Windows\System\XDedEga.exe
  C:\Windows\System\XDedEga.exe
  2⤵
  PID:4284
- C:\Windows\System\YifmPRg.exe
  C:\Windows\System\YifmPRg.exe
  2⤵
  PID:4304
- C:\Windows\System\bqFqaFX.exe
  C:\Windows\System\bqFqaFX.exe
  2⤵
  PID:4328
- C:\Windows\System\BvFSRqH.exe
  C:\Windows\System\BvFSRqH.exe
  2⤵
  PID:4348
- C:\Windows\System\gfOrjdQ.exe
  C:\Windows\System\gfOrjdQ.exe
  2⤵
  PID:4368
- C:\Windows\System\YltIhpp.exe
  C:\Windows\System\YltIhpp.exe
  2⤵
  PID:4388
- C:\Windows\System\kUWByWU.exe
  C:\Windows\System\kUWByWU.exe
  2⤵
  PID:4408
- C:\Windows\System\IUuRXHf.exe
  C:\Windows\System\IUuRXHf.exe
  2⤵
  PID:4428
- C:\Windows\System\NmrACAU.exe
  C:\Windows\System\NmrACAU.exe
  2⤵
  PID:4448
- C:\Windows\System\weNMFwy.exe
  C:\Windows\System\weNMFwy.exe
  2⤵
  PID:4464
- C:\Windows\System\GuIOFJC.exe
  C:\Windows\System\GuIOFJC.exe
  2⤵
  PID:4488
- C:\Windows\System\CRehBHA.exe
  C:\Windows\System\CRehBHA.exe
  2⤵
  PID:4504
- C:\Windows\System\MdGnxHu.exe
  C:\Windows\System\MdGnxHu.exe
  2⤵
  PID:4524
- C:\Windows\System\NtmEuSl.exe
  C:\Windows\System\NtmEuSl.exe
  2⤵
  PID:4544
- C:\Windows\System\PgwyVJx.exe
  C:\Windows\System\PgwyVJx.exe
  2⤵
  PID:4560
- C:\Windows\System\cNBpgNe.exe
  C:\Windows\System\cNBpgNe.exe
  2⤵
  PID:4588
- C:\Windows\System\CGEutbV.exe
  C:\Windows\System\CGEutbV.exe
  2⤵
  PID:4608
- C:\Windows\System\rSdvqtz.exe
  C:\Windows\System\rSdvqtz.exe
  2⤵
  PID:4628
- C:\Windows\System\LgYpXhs.exe
  C:\Windows\System\LgYpXhs.exe
  2⤵
  PID:4648
- C:\Windows\System\pRPBURF.exe
  C:\Windows\System\pRPBURF.exe
  2⤵
  PID:4668
- C:\Windows\System\wpdpSIS.exe
  C:\Windows\System\wpdpSIS.exe
  2⤵
  PID:4688
- C:\Windows\System\GATLfXR.exe
  C:\Windows\System\GATLfXR.exe
  2⤵
  PID:4708
- C:\Windows\System\eFhsosS.exe
  C:\Windows\System\eFhsosS.exe
  2⤵
  PID:4732
- C:\Windows\System\wyFNHoY.exe
  C:\Windows\System\wyFNHoY.exe
  2⤵
  PID:4752
- C:\Windows\System\lPrpdyl.exe
  C:\Windows\System\lPrpdyl.exe
  2⤵
  PID:4772
- C:\Windows\System\ZtSIsMO.exe
  C:\Windows\System\ZtSIsMO.exe
  2⤵
  PID:4788
- C:\Windows\System\ezPmrko.exe
  C:\Windows\System\ezPmrko.exe
  2⤵
  PID:4812
- C:\Windows\System\HSKUgIa.exe
  C:\Windows\System\HSKUgIa.exe
  2⤵
  PID:4832
- C:\Windows\System\aVNRCoq.exe
  C:\Windows\System\aVNRCoq.exe
  2⤵
  PID:4852
- C:\Windows\System\iFGYsPq.exe
  C:\Windows\System\iFGYsPq.exe
  2⤵
  PID:4868
- C:\Windows\System\BQUJNef.exe
  C:\Windows\System\BQUJNef.exe
  2⤵
  PID:4892
- C:\Windows\System\DWgqbVz.exe
  C:\Windows\System\DWgqbVz.exe
  2⤵
  PID:4912
- C:\Windows\System\BSmMGLv.exe
  C:\Windows\System\BSmMGLv.exe
  2⤵
  PID:4932
- C:\Windows\System\LTmhTKQ.exe
  C:\Windows\System\LTmhTKQ.exe
  2⤵
  PID:4952
- C:\Windows\System\FbsFIMu.exe
  C:\Windows\System\FbsFIMu.exe
  2⤵
  PID:4972
- C:\Windows\System\yonJohw.exe
  C:\Windows\System\yonJohw.exe
  2⤵
  PID:4992
- C:\Windows\System\ZlmMAre.exe
  C:\Windows\System\ZlmMAre.exe
  2⤵
  PID:5012
- C:\Windows\System\UHMdMuu.exe
  C:\Windows\System\UHMdMuu.exe
  2⤵
  PID:5032
- C:\Windows\System\TxYXSNi.exe
  C:\Windows\System\TxYXSNi.exe
  2⤵
  PID:5052
- C:\Windows\System\sVwJgDw.exe
  C:\Windows\System\sVwJgDw.exe
  2⤵
  PID:5072
- C:\Windows\System\GKWJWCb.exe
  C:\Windows\System\GKWJWCb.exe
  2⤵
  PID:5092
- C:\Windows\System\sarwLUB.exe
  C:\Windows\System\sarwLUB.exe
  2⤵
  PID:5108
- C:\Windows\System\FoOiwql.exe
  C:\Windows\System\FoOiwql.exe
  2⤵
  PID:2800
- C:\Windows\System\uxNiBbV.exe
  C:\Windows\System\uxNiBbV.exe
  2⤵
  PID:3100
- C:\Windows\System\sKIQJTA.exe
  C:\Windows\System\sKIQJTA.exe
  2⤵
  PID:3540
- C:\Windows\System\XZGzSiP.exe
  C:\Windows\System\XZGzSiP.exe
  2⤵
  PID:2768
- C:\Windows\System\ckfrtng.exe
  C:\Windows\System\ckfrtng.exe
  2⤵
  PID:4120
- C:\Windows\System\DFVjEkC.exe
  C:\Windows\System\DFVjEkC.exe
  2⤵
  PID:4136
- C:\Windows\System\yeQNlXk.exe
  C:\Windows\System\yeQNlXk.exe
  2⤵
  PID:4204
- C:\Windows\System\BoCLNar.exe
  C:\Windows\System\BoCLNar.exe
  2⤵
  PID:4180
- C:\Windows\System\jFpmcRX.exe
  C:\Windows\System\jFpmcRX.exe
  2⤵
  PID:4224
- C:\Windows\System\QXmwxoX.exe
  C:\Windows\System\QXmwxoX.exe
  2⤵
  PID:4260
- C:\Windows\System\zyvSxfx.exe
  C:\Windows\System\zyvSxfx.exe
  2⤵
  PID:4296
- C:\Windows\System\LBjuivi.exe
  C:\Windows\System\LBjuivi.exe
  2⤵
  PID:4404
- C:\Windows\System\SNSpOVO.exe
  C:\Windows\System\SNSpOVO.exe
  2⤵
  PID:4292
- C:\Windows\System\fBLDMFG.exe
  C:\Windows\System\fBLDMFG.exe
  2⤵
  PID:4472
- C:\Windows\System\pzmtPUM.exe
  C:\Windows\System\pzmtPUM.exe
  2⤵
  PID:4416
- C:\Windows\System\QlesBvK.exe
  C:\Windows\System\QlesBvK.exe
  2⤵
  PID:4480
- C:\Windows\System\DDDhQaX.exe
  C:\Windows\System\DDDhQaX.exe
  2⤵
  PID:4460
- C:\Windows\System\ZGgLaTs.exe
  C:\Windows\System\ZGgLaTs.exe
  2⤵
  PID:4556
- C:\Windows\System\iuoyuPl.exe
  C:\Windows\System\iuoyuPl.exe
  2⤵
  PID:4532
- C:\Windows\System\jhSinuu.exe
  C:\Windows\System\jhSinuu.exe
  2⤵
  PID:4596
- C:\Windows\System\KtBXQqJ.exe
  C:\Windows\System\KtBXQqJ.exe
  2⤵
  PID:4640
- C:\Windows\System\zsxmEpB.exe
  C:\Windows\System\zsxmEpB.exe
  2⤵
  PID:4656
- C:\Windows\System\owCUORa.exe
  C:\Windows\System\owCUORa.exe
  2⤵
  PID:4680
- C:\Windows\System\vSKwqEt.exe
  C:\Windows\System\vSKwqEt.exe
  2⤵
  PID:4700
- C:\Windows\System\zUPfPLw.exe
  C:\Windows\System\zUPfPLw.exe
  2⤵
  PID:4744
- C:\Windows\System\HyUMTXE.exe
  C:\Windows\System\HyUMTXE.exe
  2⤵
  PID:4804
- C:\Windows\System\yVblKUa.exe
  C:\Windows\System\yVblKUa.exe
  2⤵
  PID:4840
- C:\Windows\System\mQXjFBA.exe
  C:\Windows\System\mQXjFBA.exe
  2⤵
  PID:4844
- C:\Windows\System\sXPNpSr.exe
  C:\Windows\System\sXPNpSr.exe
  2⤵
  PID:4884
- C:\Windows\System\ZgAYcEi.exe
  C:\Windows\System\ZgAYcEi.exe
  2⤵
  PID:4900
- C:\Windows\System\afbBIsh.exe
  C:\Windows\System\afbBIsh.exe
  2⤵
  PID:4968
- C:\Windows\System\IGOhkVH.exe
  C:\Windows\System\IGOhkVH.exe
  2⤵
  PID:5000
- C:\Windows\System\uCHfDwv.exe
  C:\Windows\System\uCHfDwv.exe
  2⤵
  PID:4984
- C:\Windows\System\MLpykqT.exe
  C:\Windows\System\MLpykqT.exe
  2⤵
  PID:5020
- C:\Windows\System\ZmTtrJv.exe
  C:\Windows\System\ZmTtrJv.exe
  2⤵
  PID:5084
- C:\Windows\System\jFACACT.exe
  C:\Windows\System\jFACACT.exe
  2⤵
  PID:1724
- C:\Windows\System\CiImHTo.exe
  C:\Windows\System\CiImHTo.exe
  2⤵
  PID:1312
- C:\Windows\System\evtROvm.exe
  C:\Windows\System\evtROvm.exe
  2⤵
  PID:2420
- C:\Windows\System\RAboxkS.exe
  C:\Windows\System\RAboxkS.exe
  2⤵
  PID:4196
- C:\Windows\System\CyGTkmW.exe
  C:\Windows\System\CyGTkmW.exe
  2⤵
  PID:4100
- C:\Windows\System\dRDHzZj.exe
  C:\Windows\System\dRDHzZj.exe
  2⤵
  PID:4176
- C:\Windows\System\EZRWxGf.exe
  C:\Windows\System\EZRWxGf.exe
  2⤵
  PID:4256
- C:\Windows\System\oNDQQsu.exe
  C:\Windows\System\oNDQQsu.exe
  2⤵
  PID:4364
- C:\Windows\System\yDaJyKP.exe
  C:\Windows\System\yDaJyKP.exe
  2⤵
  PID:3776
- C:\Windows\System\nYDGtrW.exe
  C:\Windows\System\nYDGtrW.exe
  2⤵
  PID:4436
- C:\Windows\System\OwnvtZo.exe
  C:\Windows\System\OwnvtZo.exe
  2⤵
  PID:3892
- C:\Windows\System\pOOFSvW.exe
  C:\Windows\System\pOOFSvW.exe
  2⤵
  PID:4484
- C:\Windows\System\RmCvzpL.exe
  C:\Windows\System\RmCvzpL.exe
  2⤵
  PID:4536
- C:\Windows\System\oxgUjsb.exe
  C:\Windows\System\oxgUjsb.exe
  2⤵
  PID:4644
- C:\Windows\System\rYafoaX.exe
  C:\Windows\System\rYafoaX.exe
  2⤵
  PID:4036
- C:\Windows\System\qrRAPYt.exe
  C:\Windows\System\qrRAPYt.exe
  2⤵
  PID:4624
- C:\Windows\System\QbOxGjD.exe
  C:\Windows\System\QbOxGjD.exe
  2⤵
  PID:4660
- C:\Windows\System\xNUmMWi.exe
  C:\Windows\System\xNUmMWi.exe
  2⤵
  PID:4748
- C:\Windows\System\ZkHwpuC.exe
  C:\Windows\System\ZkHwpuC.exe
  2⤵
  PID:4820
- C:\Windows\System\RucrjdN.exe
  C:\Windows\System\RucrjdN.exe
  2⤵
  PID:4860
- C:\Windows\System\CAoYDjk.exe
  C:\Windows\System\CAoYDjk.exe
  2⤵
  PID:4960
- C:\Windows\System\chkPigd.exe
  C:\Windows\System\chkPigd.exe
  2⤵
  PID:3948
- C:\Windows\System\HnEaGjf.exe
  C:\Windows\System\HnEaGjf.exe
  2⤵
  PID:4944
- C:\Windows\System\deviOhi.exe
  C:\Windows\System\deviOhi.exe
  2⤵
  PID:5048
- C:\Windows\System\ZFfoYuX.exe
  C:\Windows\System\ZFfoYuX.exe
  2⤵
  PID:840
- C:\Windows\System\IZIFDTR.exe
  C:\Windows\System\IZIFDTR.exe
  2⤵
  PID:1976
- C:\Windows\System\Jhslqum.exe
  C:\Windows\System\Jhslqum.exe
  2⤵
  PID:4080
- C:\Windows\System\kJpPdBd.exe
  C:\Windows\System\kJpPdBd.exe
  2⤵
  PID:5068
- C:\Windows\System\KFUHNZX.exe
  C:\Windows\System\KFUHNZX.exe
  2⤵
  PID:4020
- C:\Windows\System\DbOilUE.exe
  C:\Windows\System\DbOilUE.exe
  2⤵
  PID:3672
- C:\Windows\System\hZvtptw.exe
  C:\Windows\System\hZvtptw.exe
  2⤵
  PID:4272
- C:\Windows\System\AFMuUTg.exe
  C:\Windows\System\AFMuUTg.exe
  2⤵
  PID:4324
- C:\Windows\System\OaDXttZ.exe
  C:\Windows\System\OaDXttZ.exe
  2⤵
  PID:4340
- C:\Windows\System\SxZkryW.exe
  C:\Windows\System\SxZkryW.exe
  2⤵
  PID:4500
- C:\Windows\System\HiNOBum.exe
  C:\Windows\System\HiNOBum.exe
  2⤵
  PID:3980
- C:\Windows\System\QPMslQw.exe
  C:\Windows\System\QPMslQw.exe
  2⤵
  PID:4684
- C:\Windows\System\rhKIUwR.exe
  C:\Windows\System\rhKIUwR.exe
  2⤵
  PID:4720
- C:\Windows\System\lXjppuR.exe
  C:\Windows\System\lXjppuR.exe
  2⤵
  PID:4864
- C:\Windows\System\WjkhKSN.exe
  C:\Windows\System\WjkhKSN.exe
  2⤵
  PID:3760
- C:\Windows\System\IMVguSq.exe
  C:\Windows\System\IMVguSq.exe
  2⤵
  PID:4848
- C:\Windows\System\eEEYlOq.exe
  C:\Windows\System\eEEYlOq.exe
  2⤵
  PID:4980
- C:\Windows\System\NhXJReb.exe
  C:\Windows\System\NhXJReb.exe
  2⤵
  PID:4076
- C:\Windows\System\NrnGTjJ.exe
  C:\Windows\System\NrnGTjJ.exe
  2⤵
  PID:4064
- C:\Windows\System\qfMbSTd.exe
  C:\Windows\System\qfMbSTd.exe
  2⤵
  PID:4216
- C:\Windows\System\ywimvHE.exe
  C:\Windows\System\ywimvHE.exe
  2⤵
  PID:4520
- C:\Windows\System\XDwCzyT.exe
  C:\Windows\System\XDwCzyT.exe
  2⤵
  PID:3080
- C:\Windows\System\ZFXEMfx.exe
  C:\Windows\System\ZFXEMfx.exe
  2⤵
  PID:5044
- C:\Windows\System\BwtidsI.exe
  C:\Windows\System\BwtidsI.exe
  2⤵
  PID:4616
- C:\Windows\System\qAeNdlg.exe
  C:\Windows\System\qAeNdlg.exe
  2⤵
  PID:3928
- C:\Windows\System\gKKxPWT.exe
  C:\Windows\System\gKKxPWT.exe
  2⤵
  PID:5080
- C:\Windows\System\CMooFNm.exe
  C:\Windows\System\CMooFNm.exe
  2⤵
  PID:5060
- C:\Windows\System\TgBDqvK.exe
  C:\Windows\System\TgBDqvK.exe
  2⤵
  PID:4904
- C:\Windows\System\nEegKOg.exe
  C:\Windows\System\nEegKOg.exe
  2⤵
  PID:4380
- C:\Windows\System\ieVVFob.exe
  C:\Windows\System\ieVVFob.exe
  2⤵
  PID:544
- C:\Windows\System\GdWBBWR.exe
  C:\Windows\System\GdWBBWR.exe
  2⤵
  PID:4088
- C:\Windows\System\Acsufyv.exe
  C:\Windows\System\Acsufyv.exe
  2⤵
  PID:1696
- C:\Windows\System\lOnDpFg.exe
  C:\Windows\System\lOnDpFg.exe
  2⤵
  PID:4780
- C:\Windows\System\WtvdHjG.exe
  C:\Windows\System\WtvdHjG.exe
  2⤵
  PID:4240
- C:\Windows\System\etSBPcE.exe
  C:\Windows\System\etSBPcE.exe
  2⤵
  PID:3740
- C:\Windows\System\VfRhdqr.exe
  C:\Windows\System\VfRhdqr.exe
  2⤵
  PID:5132
- C:\Windows\System\vbwQdSC.exe
  C:\Windows\System\vbwQdSC.exe
  2⤵
  PID:5148
- C:\Windows\System\qrTXeDr.exe
  C:\Windows\System\qrTXeDr.exe
  2⤵
  PID:5172
- C:\Windows\System\kIffWLX.exe
  C:\Windows\System\kIffWLX.exe
  2⤵
  PID:5188
- C:\Windows\System\mBBIriq.exe
  C:\Windows\System\mBBIriq.exe
  2⤵
  PID:5216
- C:\Windows\System\QIYjFba.exe
  C:\Windows\System\QIYjFba.exe
  2⤵
  PID:5232
- C:\Windows\System\zMebJzJ.exe
  C:\Windows\System\zMebJzJ.exe
  2⤵
  PID:5252
- C:\Windows\System\EOeDBEM.exe
  C:\Windows\System\EOeDBEM.exe
  2⤵
  PID:5284
- C:\Windows\System\vpHTxJx.exe
  C:\Windows\System\vpHTxJx.exe
  2⤵
  PID:5300
- C:\Windows\System\ILIwgiQ.exe
  C:\Windows\System\ILIwgiQ.exe
  2⤵
  PID:5316
- C:\Windows\System\LHzjlEt.exe
  C:\Windows\System\LHzjlEt.exe
  2⤵
  PID:5332
- C:\Windows\System\CwcqRcH.exe
  C:\Windows\System\CwcqRcH.exe
  2⤵
  PID:5352
- C:\Windows\System\APRtXnk.exe
  C:\Windows\System\APRtXnk.exe
  2⤵
  PID:5368
- C:\Windows\System\IOovISo.exe
  C:\Windows\System\IOovISo.exe
  2⤵
  PID:5384
- C:\Windows\System\fpcspmr.exe
  C:\Windows\System\fpcspmr.exe
  2⤵
  PID:5400
- C:\Windows\System\IKpIdpS.exe
  C:\Windows\System\IKpIdpS.exe
  2⤵
  PID:5416
- C:\Windows\System\XAvuDdn.exe
  C:\Windows\System\XAvuDdn.exe
  2⤵
  PID:5432
- C:\Windows\System\crDspYp.exe
  C:\Windows\System\crDspYp.exe
  2⤵
  PID:5452
- C:\Windows\System\eYlUtTE.exe
  C:\Windows\System\eYlUtTE.exe
  2⤵
  PID:5476
- C:\Windows\System\HNdqFFv.exe
  C:\Windows\System\HNdqFFv.exe
  2⤵
  PID:5512
- C:\Windows\System\NBMRzvn.exe
  C:\Windows\System\NBMRzvn.exe
  2⤵
  PID:5528
- C:\Windows\System\gkuHSQF.exe
  C:\Windows\System\gkuHSQF.exe
  2⤵
  PID:5544
- C:\Windows\System\jNeHGOT.exe
  C:\Windows\System\jNeHGOT.exe
  2⤵
  PID:5560
- C:\Windows\System\OYLBZmQ.exe
  C:\Windows\System\OYLBZmQ.exe
  2⤵
  PID:5580
- C:\Windows\System\WqsaQnY.exe
  C:\Windows\System\WqsaQnY.exe
  2⤵
  PID:5596
- C:\Windows\System\xTiJkii.exe
  C:\Windows\System\xTiJkii.exe
  2⤵
  PID:5612
- C:\Windows\System\fQkTVjs.exe
  C:\Windows\System\fQkTVjs.exe
  2⤵
  PID:5628
- C:\Windows\System\ohDoACj.exe
  C:\Windows\System\ohDoACj.exe
  2⤵
  PID:5644
- C:\Windows\System\ELVVCrA.exe
  C:\Windows\System\ELVVCrA.exe
  2⤵
  PID:5660
- C:\Windows\System\jOEfAPh.exe
  C:\Windows\System\jOEfAPh.exe
  2⤵
  PID:5680
- C:\Windows\System\TBsvznt.exe
  C:\Windows\System\TBsvznt.exe
  2⤵
  PID:5696
- C:\Windows\System\pbdPyHf.exe
  C:\Windows\System\pbdPyHf.exe
  2⤵
  PID:5712
- C:\Windows\System\ASrKEFQ.exe
  C:\Windows\System\ASrKEFQ.exe
  2⤵
  PID:5728
- C:\Windows\System\ndiJQFA.exe
  C:\Windows\System\ndiJQFA.exe
  2⤵
  PID:5744
- C:\Windows\System\pOXBfSN.exe
  C:\Windows\System\pOXBfSN.exe
  2⤵
  PID:5760
- C:\Windows\System\ZzlUFUw.exe
  C:\Windows\System\ZzlUFUw.exe
  2⤵
  PID:5776
- C:\Windows\System\JwcTIta.exe
  C:\Windows\System\JwcTIta.exe
  2⤵
  PID:5792
- C:\Windows\System\XOHvrkQ.exe
  C:\Windows\System\XOHvrkQ.exe
  2⤵
  PID:5808
- C:\Windows\System\WGJIYqk.exe
  C:\Windows\System\WGJIYqk.exe
  2⤵
  PID:5824
- C:\Windows\System\GXyzjPW.exe
  C:\Windows\System\GXyzjPW.exe
  2⤵
  PID:5840
- C:\Windows\System\lriWxGx.exe
  C:\Windows\System\lriWxGx.exe
  2⤵
  PID:5856
- C:\Windows\System\JWmfhOy.exe
  C:\Windows\System\JWmfhOy.exe
  2⤵
  PID:5872
- C:\Windows\System\rGFKHDq.exe
  C:\Windows\System\rGFKHDq.exe
  2⤵
  PID:5888
- C:\Windows\System\fqxNGMy.exe
  C:\Windows\System\fqxNGMy.exe
  2⤵
  PID:5904
- C:\Windows\System\KIDAIJt.exe
  C:\Windows\System\KIDAIJt.exe
  2⤵
  PID:5920
- C:\Windows\System\WGLCjDe.exe
  C:\Windows\System\WGLCjDe.exe
  2⤵
  PID:5936
- C:\Windows\System\JdgZnAf.exe
  C:\Windows\System\JdgZnAf.exe
  2⤵
  PID:5952
- C:\Windows\System\OObIodT.exe
  C:\Windows\System\OObIodT.exe
  2⤵
  PID:5968
- C:\Windows\System\NTxiVry.exe
  C:\Windows\System\NTxiVry.exe
  2⤵
  PID:5984
- C:\Windows\System\LMXWDGM.exe
  C:\Windows\System\LMXWDGM.exe
  2⤵
  PID:6000
- C:\Windows\System\rdaVwAS.exe
  C:\Windows\System\rdaVwAS.exe
  2⤵
  PID:6020
- C:\Windows\System\KXJlSga.exe
  C:\Windows\System\KXJlSga.exe
  2⤵
  PID:6036
- C:\Windows\System\pqTkxMZ.exe
  C:\Windows\System\pqTkxMZ.exe
  2⤵
  PID:6052
- C:\Windows\System\yWllstW.exe
  C:\Windows\System\yWllstW.exe
  2⤵
  PID:6068
- C:\Windows\System\dpFuGrS.exe
  C:\Windows\System\dpFuGrS.exe
  2⤵
  PID:6084
- C:\Windows\System\OuwrAgN.exe
  C:\Windows\System\OuwrAgN.exe
  2⤵
  PID:6100
- C:\Windows\System\rTTffuP.exe
  C:\Windows\System\rTTffuP.exe
  2⤵
  PID:6116
- C:\Windows\System\pTSDMfK.exe
  C:\Windows\System\pTSDMfK.exe
  2⤵
  PID:6132
- C:\Windows\System\BmHiZsE.exe
  C:\Windows\System\BmHiZsE.exe
  2⤵
  PID:5128
- C:\Windows\System\qTzaOCT.exe
  C:\Windows\System\qTzaOCT.exe
  2⤵
  PID:5164
- C:\Windows\System\hkmMuzC.exe
  C:\Windows\System\hkmMuzC.exe
  2⤵
  PID:5196
- C:\Windows\System\qLaaQLU.exe
  C:\Windows\System\qLaaQLU.exe
  2⤵
  PID:4084
- C:\Windows\System\WGyNhum.exe
  C:\Windows\System\WGyNhum.exe
  2⤵
  PID:4768
- C:\Windows\System\ybVUnLI.exe
  C:\Windows\System\ybVUnLI.exe
  2⤵
  PID:5180
- C:\Windows\System\JWvWdEW.exe
  C:\Windows\System\JWvWdEW.exe
  2⤵
  PID:5144
- C:\Windows\System\iGWVrCE.exe
  C:\Windows\System\iGWVrCE.exe
  2⤵
  PID:5240
- C:\Windows\System\KIMFTcp.exe
  C:\Windows\System\KIMFTcp.exe
  2⤵
  PID:5324
- C:\Windows\System\RkgwQlb.exe
  C:\Windows\System\RkgwQlb.exe
  2⤵
  PID:5392
- C:\Windows\System\OxzWQmY.exe
  C:\Windows\System\OxzWQmY.exe
  2⤵
  PID:5424
- C:\Windows\System\xOMxRVt.exe
  C:\Windows\System\xOMxRVt.exe
  2⤵
  PID:5460
- C:\Windows\System\aQMDWDF.exe
  C:\Windows\System\aQMDWDF.exe
  2⤵
  PID:5520
- C:\Windows\System\tKzPXZN.exe
  C:\Windows\System\tKzPXZN.exe
  2⤵
  PID:5588
- C:\Windows\System\OcbtALM.exe
  C:\Windows\System\OcbtALM.exe
  2⤵
  PID:5652
- C:\Windows\System\WyTgyhU.exe
  C:\Windows\System\WyTgyhU.exe
  2⤵
  PID:5272
- C:\Windows\System\JasCgat.exe
  C:\Windows\System\JasCgat.exe
  2⤵
  PID:5496
- C:\Windows\System\FnXCBzL.exe
  C:\Windows\System\FnXCBzL.exe
  2⤵
  PID:5348
- C:\Windows\System\btokEpx.exe
  C:\Windows\System\btokEpx.exe
  2⤵
  PID:5448
- C:\Windows\System\HnMymfj.exe
  C:\Windows\System\HnMymfj.exe
  2⤵
  PID:5504
- C:\Windows\System\AqbKhSg.exe
  C:\Windows\System\AqbKhSg.exe
  2⤵
  PID:5572
- C:\Windows\System\JaUiDsn.exe
  C:\Windows\System\JaUiDsn.exe
  2⤵
  PID:5640
- C:\Windows\System\LMvGUgx.exe
  C:\Windows\System\LMvGUgx.exe
  2⤵
  PID:5412
- C:\Windows\System\nGAUXfb.exe
  C:\Windows\System\nGAUXfb.exe
  2⤵
  PID:5720
- C:\Windows\System\MYPicRY.exe
  C:\Windows\System\MYPicRY.exe
  2⤵
  PID:5784
- C:\Windows\System\GdOVMBp.exe
  C:\Windows\System\GdOVMBp.exe
  2⤵
  PID:5852
- C:\Windows\System\AUtZPRX.exe
  C:\Windows\System\AUtZPRX.exe
  2⤵
  PID:5976
- C:\Windows\System\FkAlrDb.exe
  C:\Windows\System\FkAlrDb.exe
  2⤵
  PID:5896
- C:\Windows\System\egXdtEc.exe
  C:\Windows\System\egXdtEc.exe
  2⤵
  PID:6076
- C:\Windows\System\PwXIKxI.exe
  C:\Windows\System\PwXIKxI.exe
  2⤵
  PID:6032
- C:\Windows\System\KQbZUDX.exe
  C:\Windows\System\KQbZUDX.exe
  2⤵
  PID:4156
- C:\Windows\System\IGUxjxb.exe
  C:\Windows\System\IGUxjxb.exe
  2⤵
  PID:2924
- C:\Windows\System\WxBEOsF.exe
  C:\Windows\System\WxBEOsF.exe
  2⤵
  PID:5208
- C:\Windows\System\Myxxxqz.exe
  C:\Windows\System\Myxxxqz.exe
  2⤵
  PID:5364
- C:\Windows\System\QuTzjTo.exe
  C:\Windows\System\QuTzjTo.exe
  2⤵
  PID:5464
- C:\Windows\System\nfwjLFs.exe
  C:\Windows\System\nfwjLFs.exe
  2⤵
  PID:5624
- C:\Windows\System\DMqqvAV.exe
  C:\Windows\System\DMqqvAV.exe
  2⤵
  PID:5276
- C:\Windows\System\amqnuMT.exe
  C:\Windows\System\amqnuMT.exe
  2⤵
  PID:5752
- C:\Windows\System\NTkUuaL.exe
  C:\Windows\System\NTkUuaL.exe
  2⤵
  PID:5376
- C:\Windows\System\YqAJqNz.exe
  C:\Windows\System\YqAJqNz.exe
  2⤵
  PID:5536
- C:\Windows\System\umIKzTQ.exe
  C:\Windows\System\umIKzTQ.exe
  2⤵
  PID:5848
- C:\Windows\System\DNhbRBd.exe
  C:\Windows\System\DNhbRBd.exe
  2⤵
  PID:5916
- C:\Windows\System\dVoKTXb.exe
  C:\Windows\System\dVoKTXb.exe
  2⤵
  PID:5704
- C:\Windows\System\eqCmOZE.exe
  C:\Windows\System\eqCmOZE.exe
  2⤵
  PID:5960
- C:\Windows\System\YSbkZvo.exe
  C:\Windows\System\YSbkZvo.exe
  2⤵
  PID:5804
- C:\Windows\System\BKMCbuE.exe
  C:\Windows\System\BKMCbuE.exe
  2⤵
  PID:5740
- C:\Windows\System\OzWwMVu.exe
  C:\Windows\System\OzWwMVu.exe
  2⤵
  PID:6012
- C:\Windows\System\yJvgzqq.exe
  C:\Windows\System\yJvgzqq.exe
  2⤵
  PID:6048
- C:\Windows\System\NVQaMiB.exe
  C:\Windows\System\NVQaMiB.exe
  2⤵
  PID:6108
- C:\Windows\System\BgVamEl.exe
  C:\Windows\System\BgVamEl.exe
  2⤵
  PID:6028
- C:\Windows\System\fVrafmE.exe
  C:\Windows\System\fVrafmE.exe
  2⤵
  PID:4796
- C:\Windows\System\MvdBtsH.exe
  C:\Windows\System\MvdBtsH.exe
  2⤵
  PID:5308
- C:\Windows\System\jDCphvJ.exe
  C:\Windows\System\jDCphvJ.exe
  2⤵
  PID:6096
- C:\Windows\System\EaZzmNn.exe
  C:\Windows\System\EaZzmNn.exe
  2⤵
  PID:5156
- C:\Windows\System\ahgcLZB.exe
  C:\Windows\System\ahgcLZB.exe
  2⤵
  PID:5224
- C:\Windows\System\sZdhVIv.exe
  C:\Windows\System\sZdhVIv.exe
  2⤵
  PID:5540
- C:\Windows\System\uwIzOeP.exe
  C:\Windows\System\uwIzOeP.exe
  2⤵
  PID:5408
- C:\Windows\System\apqiIDc.exe
  C:\Windows\System\apqiIDc.exe
  2⤵
  PID:5688
- C:\Windows\System\QWKMjUt.exe
  C:\Windows\System\QWKMjUt.exe
  2⤵
  PID:5820
- C:\Windows\System\oEqRyKQ.exe
  C:\Windows\System\oEqRyKQ.exe
  2⤵
  PID:5912
- C:\Windows\System\rAoYYaV.exe
  C:\Windows\System\rAoYYaV.exe
  2⤵
  PID:5800
- C:\Windows\System\odkpgTf.exe
  C:\Windows\System\odkpgTf.exe
  2⤵
  PID:6044
- C:\Windows\System\iNbuzmM.exe
  C:\Windows\System\iNbuzmM.exe
  2⤵
  PID:6092
- C:\Windows\System\AXfnQQm.exe
  C:\Windows\System\AXfnQQm.exe
  2⤵
  PID:5360
- C:\Windows\System\XMeZnbt.exe
  C:\Windows\System\XMeZnbt.exe
  2⤵
  PID:5380
- C:\Windows\System\lveMDnm.exe
  C:\Windows\System\lveMDnm.exe
  2⤵
  PID:5492
- C:\Windows\System\zpkJifc.exe
  C:\Windows\System\zpkJifc.exe
  2⤵
  PID:5932
- C:\Windows\System\obHazOJ.exe
  C:\Windows\System\obHazOJ.exe
  2⤵
  PID:5736
- C:\Windows\System\LeMRntq.exe
  C:\Windows\System\LeMRntq.exe
  2⤵
  PID:5268
- C:\Windows\System\qnMOptH.exe
  C:\Windows\System\qnMOptH.exe
  2⤵
  PID:5708
- C:\Windows\System\wgvCCgJ.exe
  C:\Windows\System\wgvCCgJ.exe
  2⤵
  PID:5568
- C:\Windows\System\FVJUQtZ.exe
  C:\Windows\System\FVJUQtZ.exe
  2⤵
  PID:5864
- C:\Windows\System\VbKxahi.exe
  C:\Windows\System\VbKxahi.exe
  2⤵
  PID:5608
- C:\Windows\System\IjLlZcE.exe
  C:\Windows\System\IjLlZcE.exe
  2⤵
  PID:5344
- C:\Windows\System\dHCmzRV.exe
  C:\Windows\System\dHCmzRV.exe
  2⤵
  PID:6156
- C:\Windows\System\JrerNQh.exe
  C:\Windows\System\JrerNQh.exe
  2⤵
  PID:6172
- C:\Windows\System\ywgsrZj.exe
  C:\Windows\System\ywgsrZj.exe
  2⤵
  PID:6188
- C:\Windows\System\OnZBRUc.exe
  C:\Windows\System\OnZBRUc.exe
  2⤵
  PID:6204
- C:\Windows\System\qfpoHnQ.exe
  C:\Windows\System\qfpoHnQ.exe
  2⤵
  PID:6220
- C:\Windows\System\zlmLJfP.exe
  C:\Windows\System\zlmLJfP.exe
  2⤵
  PID:6236
- C:\Windows\System\KPxGFbk.exe
  C:\Windows\System\KPxGFbk.exe
  2⤵
  PID:6256
- C:\Windows\System\ikEvVbQ.exe
  C:\Windows\System\ikEvVbQ.exe
  2⤵
  PID:6276
- C:\Windows\System\SFgKyFZ.exe
  C:\Windows\System\SFgKyFZ.exe
  2⤵
  PID:6292
- C:\Windows\System\MQXMwhG.exe
  C:\Windows\System\MQXMwhG.exe
  2⤵
  PID:6308
- C:\Windows\System\fzdBZEi.exe
  C:\Windows\System\fzdBZEi.exe
  2⤵
  PID:6324
- C:\Windows\System\mCwfyee.exe
  C:\Windows\System\mCwfyee.exe
  2⤵
  PID:6340
- C:\Windows\System\ZglfIYU.exe
  C:\Windows\System\ZglfIYU.exe
  2⤵
  PID:6356
- C:\Windows\System\tCiqABj.exe
  C:\Windows\System\tCiqABj.exe
  2⤵
  PID:6372
- C:\Windows\System\dFmLprS.exe
  C:\Windows\System\dFmLprS.exe
  2⤵
  PID:6392
- C:\Windows\System\GomkYeD.exe
  C:\Windows\System\GomkYeD.exe
  2⤵
  PID:6408
- C:\Windows\System\bFWmSmq.exe
  C:\Windows\System\bFWmSmq.exe
  2⤵
  PID:6424
- C:\Windows\System\QvAWfSG.exe
  C:\Windows\System\QvAWfSG.exe
  2⤵
  PID:6440
- C:\Windows\System\jWjqTHh.exe
  C:\Windows\System\jWjqTHh.exe
  2⤵
  PID:6456
- C:\Windows\System\UOMcCnk.exe
  C:\Windows\System\UOMcCnk.exe
  2⤵
  PID:6472
- C:\Windows\System\LqZNAwf.exe
  C:\Windows\System\LqZNAwf.exe
  2⤵
  PID:6488
- C:\Windows\System\GncisLX.exe
  C:\Windows\System\GncisLX.exe
  2⤵
  PID:6504
- C:\Windows\System\gLHkANA.exe
  C:\Windows\System\gLHkANA.exe
  2⤵
  PID:6520
- C:\Windows\System\tOGXtcs.exe
  C:\Windows\System\tOGXtcs.exe
  2⤵
  PID:6536
- C:\Windows\System\OCuLuLc.exe
  C:\Windows\System\OCuLuLc.exe
  2⤵
  PID:6556
- C:\Windows\System\gWrPhtD.exe
  C:\Windows\System\gWrPhtD.exe
  2⤵
  PID:6572
- C:\Windows\System\mezcylS.exe
  C:\Windows\System\mezcylS.exe
  2⤵
  PID:6588
- C:\Windows\System\RmwBZQN.exe
  C:\Windows\System\RmwBZQN.exe
  2⤵
  PID:6620
- C:\Windows\System\MqrjQRa.exe
  C:\Windows\System\MqrjQRa.exe
  2⤵
  PID:6680
- C:\Windows\System\IAjvtPt.exe
  C:\Windows\System\IAjvtPt.exe
  2⤵
  PID:6696
- C:\Windows\System\TkKlIjm.exe
  C:\Windows\System\TkKlIjm.exe
  2⤵
  PID:6712
- C:\Windows\System\DusKlym.exe
  C:\Windows\System\DusKlym.exe
  2⤵
  PID:6736
- C:\Windows\System\snBHrUf.exe
  C:\Windows\System\snBHrUf.exe
  2⤵
  PID:6756
- C:\Windows\System\OtDmrXI.exe
  C:\Windows\System\OtDmrXI.exe
  2⤵
  PID:6772
- C:\Windows\System\LxJRmBX.exe
  C:\Windows\System\LxJRmBX.exe
  2⤵
  PID:6788
- C:\Windows\System\XuyMxZt.exe
  C:\Windows\System\XuyMxZt.exe
  2⤵
  PID:6804
- C:\Windows\System\CRefzRM.exe
  C:\Windows\System\CRefzRM.exe
  2⤵
  PID:6820
- C:\Windows\System\nxALLWQ.exe
  C:\Windows\System\nxALLWQ.exe
  2⤵
  PID:6836
- C:\Windows\System\ymczlVA.exe
  C:\Windows\System\ymczlVA.exe
  2⤵
  PID:6852
- C:\Windows\System\kRPSytA.exe
  C:\Windows\System\kRPSytA.exe
  2⤵
  PID:6868
- C:\Windows\System\EXnPpTt.exe
  C:\Windows\System\EXnPpTt.exe
  2⤵
  PID:6888
- C:\Windows\System\QTBrnnc.exe
  C:\Windows\System\QTBrnnc.exe
  2⤵
  PID:6904
- C:\Windows\System\HdYFmrn.exe
  C:\Windows\System\HdYFmrn.exe
  2⤵
  PID:6920
- C:\Windows\System\MLWhmNy.exe
  C:\Windows\System\MLWhmNy.exe
  2⤵
  PID:6936
- C:\Windows\System\gzOXNjD.exe
  C:\Windows\System\gzOXNjD.exe
  2⤵
  PID:6952
- C:\Windows\System\MYfqIhQ.exe
  C:\Windows\System\MYfqIhQ.exe
  2⤵
  PID:6968
- C:\Windows\System\xwPmKHr.exe
  C:\Windows\System\xwPmKHr.exe
  2⤵
  PID:6984
- C:\Windows\System\PeqrZjC.exe
  C:\Windows\System\PeqrZjC.exe
  2⤵
  PID:7000
- C:\Windows\System\WLteejU.exe
  C:\Windows\System\WLteejU.exe
  2⤵
  PID:7016
- C:\Windows\System\skKhAQn.exe
  C:\Windows\System\skKhAQn.exe
  2⤵
  PID:7032
- C:\Windows\System\ySxBtZp.exe
  C:\Windows\System\ySxBtZp.exe
  2⤵
  PID:7048
- C:\Windows\System\XhKZGtf.exe
  C:\Windows\System\XhKZGtf.exe
  2⤵
  PID:7064
- C:\Windows\System\RiGinsT.exe
  C:\Windows\System\RiGinsT.exe
  2⤵
  PID:7080
- C:\Windows\System\SZxWCPW.exe
  C:\Windows\System\SZxWCPW.exe
  2⤵
  PID:7096
- C:\Windows\System\dyyuOqT.exe
  C:\Windows\System\dyyuOqT.exe
  2⤵
  PID:7112
- C:\Windows\System\EXMZIVh.exe
  C:\Windows\System\EXMZIVh.exe
  2⤵
  PID:7128
- C:\Windows\System\LckgrLA.exe
  C:\Windows\System\LckgrLA.exe
  2⤵
  PID:7144
- C:\Windows\System\devBGKe.exe
  C:\Windows\System\devBGKe.exe
  2⤵
  PID:7160
- C:\Windows\System\aiMCgdk.exe
  C:\Windows\System\aiMCgdk.exe
  2⤵
  PID:6180
- C:\Windows\System\OPElkbM.exe
  C:\Windows\System\OPElkbM.exe
  2⤵
  PID:5296
- C:\Windows\System\fllvmZh.exe
  C:\Windows\System\fllvmZh.exe
  2⤵
  PID:6112
- C:\Windows\System\LSEtZvY.exe
  C:\Windows\System\LSEtZvY.exe
  2⤵
  PID:6228
- C:\Windows\System\YggLqUN.exe
  C:\Windows\System\YggLqUN.exe
  2⤵
  PID:6232
- C:\Windows\System\cSpTrgK.exe
  C:\Windows\System\cSpTrgK.exe
  2⤵
  PID:6288
- C:\Windows\System\dxeUssM.exe
  C:\Windows\System\dxeUssM.exe
  2⤵
  PID:6320
- C:\Windows\System\KTGlVJV.exe
  C:\Windows\System\KTGlVJV.exe
  2⤵
  PID:6348
- C:\Windows\System\IymczUd.exe
  C:\Windows\System\IymczUd.exe
  2⤵
  PID:6332
- C:\Windows\System\KijGKmm.exe
  C:\Windows\System\KijGKmm.exe
  2⤵
  PID:6420
- C:\Windows\System\sdNiGMs.exe
  C:\Windows\System\sdNiGMs.exe
  2⤵
  PID:6432
- C:\Windows\System\wOhfSAh.exe
  C:\Windows\System\wOhfSAh.exe
  2⤵
  PID:6364
- C:\Windows\System\rsfRsIB.exe
  C:\Windows\System\rsfRsIB.exe
  2⤵
  PID:6484
- C:\Windows\System\otzMcVt.exe
  C:\Windows\System\otzMcVt.exe
  2⤵
  PID:6544
- C:\Windows\System\ZFsxniL.exe
  C:\Windows\System\ZFsxniL.exe
  2⤵
  PID:6584
- C:\Windows\System\nIBvOhS.exe
  C:\Windows\System\nIBvOhS.exe
  2⤵
  PID:6564
- C:\Windows\System\reqTwnA.exe
  C:\Windows\System\reqTwnA.exe
  2⤵
  PID:6612
- C:\Windows\System\vMAifHZ.exe
  C:\Windows\System\vMAifHZ.exe
  2⤵
  PID:6628
- C:\Windows\System\kYrIAZD.exe
  C:\Windows\System\kYrIAZD.exe
  2⤵
  PID:6648
- C:\Windows\System\EfhFSOW.exe
  C:\Windows\System\EfhFSOW.exe
  2⤵
  PID:6664
- C:\Windows\System\SvNugjX.exe
  C:\Windows\System\SvNugjX.exe
  2⤵
  PID:6704
- C:\Windows\System\EepwDUS.exe
  C:\Windows\System\EepwDUS.exe
  2⤵
  PID:6720
- C:\Windows\System\BKcNqKE.exe
  C:\Windows\System\BKcNqKE.exe
  2⤵
  PID:6812
- C:\Windows\System\gRjgCrR.exe
  C:\Windows\System\gRjgCrR.exe
  2⤵
  PID:6732
- C:\Windows\System\ZoVQEHT.exe
  C:\Windows\System\ZoVQEHT.exe
  2⤵
  PID:6764
- C:\Windows\System\AUqrSAJ.exe
  C:\Windows\System\AUqrSAJ.exe
  2⤵
  PID:6876
- C:\Windows\System\FCRtfWn.exe
  C:\Windows\System\FCRtfWn.exe
  2⤵
  PID:6912
- C:\Windows\System\UlEOGAW.exe
  C:\Windows\System\UlEOGAW.exe
  2⤵
  PID:6928
- C:\Windows\System\CVJXgFq.exe
  C:\Windows\System\CVJXgFq.exe
  2⤵
  PID:6932
- C:\Windows\System\oiBoOHB.exe
  C:\Windows\System\oiBoOHB.exe
  2⤵
  PID:7044
- C:\Windows\System\dfdNyuK.exe
  C:\Windows\System\dfdNyuK.exe
  2⤵
  PID:6996
- C:\Windows\System\LhkGUJb.exe
  C:\Windows\System\LhkGUJb.exe
  2⤵
  PID:7140
- C:\Windows\System\pbaGZYb.exe
  C:\Windows\System\pbaGZYb.exe
  2⤵
  PID:6212
- C:\Windows\System\tLWitmu.exe
  C:\Windows\System\tLWitmu.exe
  2⤵
  PID:6164
- C:\Windows\System\RBJOKIf.exe
  C:\Windows\System\RBJOKIf.exe
  2⤵
  PID:6516
- C:\Windows\System\pzXIllZ.exe
  C:\Windows\System\pzXIllZ.exe
  2⤵
  PID:6616
- C:\Windows\System\bnIyMff.exe
  C:\Windows\System\bnIyMff.exe
  2⤵
  PID:6640
- C:\Windows\System\sKNGUJU.exe
  C:\Windows\System\sKNGUJU.exe
  2⤵
  PID:6744
- C:\Windows\System\vqDycES.exe
  C:\Windows\System\vqDycES.exe
  2⤵
  PID:6800
- C:\Windows\System\sDnCxaA.exe
  C:\Windows\System\sDnCxaA.exe
  2⤵
  PID:6768
- C:\Windows\System\vrhufdg.exe
  C:\Windows\System\vrhufdg.exe
  2⤵
  PID:7008
- C:\Windows\System\anYPAXk.exe
  C:\Windows\System\anYPAXk.exe
  2⤵
  PID:6948
- C:\Windows\System\LbcCFev.exe
  C:\Windows\System\LbcCFev.exe
  2⤵
  PID:7028
- C:\Windows\System\IKyVlRx.exe
  C:\Windows\System\IKyVlRx.exe
  2⤵
  PID:6964
- C:\Windows\System\TIIHxfU.exe
  C:\Windows\System\TIIHxfU.exe
  2⤵
  PID:7108
- C:\Windows\System\pVYvtvU.exe
  C:\Windows\System\pVYvtvU.exe
  2⤵
  PID:7088
- C:\Windows\System\EjkJAmw.exe
  C:\Windows\System\EjkJAmw.exe
  2⤵
  PID:6216
- C:\Windows\System\FnoaYPK.exe
  C:\Windows\System\FnoaYPK.exe
  2⤵
  PID:6248
- C:\Windows\System\UmgmzYR.exe
  C:\Windows\System\UmgmzYR.exe
  2⤵
  PID:6300
- C:\Windows\System\NVphkDH.exe
  C:\Windows\System\NVphkDH.exe
  2⤵
  PID:6452
- C:\Windows\System\ofXSvbf.exe
  C:\Windows\System\ofXSvbf.exe
  2⤵
  PID:6404
- C:\Windows\System\IDKNpyc.exe
  C:\Windows\System\IDKNpyc.exe
  2⤵
  PID:6468
- C:\Windows\System\LBPkTTt.exe
  C:\Windows\System\LBPkTTt.exe
  2⤵
  PID:6496
- C:\Windows\System\RNEpegF.exe
  C:\Windows\System\RNEpegF.exe
  2⤵
  PID:6660
- C:\Windows\System\QtFfTcF.exe
  C:\Windows\System\QtFfTcF.exe
  2⤵
  PID:6896
- C:\Windows\System\ZMhdJzH.exe
  C:\Windows\System\ZMhdJzH.exe
  2⤵
  PID:6692
- C:\Windows\System\bnIbTCR.exe
  C:\Windows\System\bnIbTCR.exe
  2⤵
  PID:6828
- C:\Windows\System\tfHvOmK.exe
  C:\Windows\System\tfHvOmK.exe
  2⤵
  PID:7024
- C:\Windows\System\zSUiCCt.exe
  C:\Windows\System\zSUiCCt.exe
  2⤵
  PID:6184
- C:\Windows\System\gfzThOv.exe
  C:\Windows\System\gfzThOv.exe
  2⤵
  PID:6148
- C:\Windows\System\XVrhLct.exe
  C:\Windows\System\XVrhLct.exe
  2⤵
  PID:6400
- C:\Windows\System\iKFrUQx.exe
  C:\Windows\System\iKFrUQx.exe
  2⤵
  PID:6784
- C:\Windows\System\ULHRbxj.exe
  C:\Windows\System\ULHRbxj.exe
  2⤵
  PID:6672
- C:\Windows\System\uUFJAjs.exe
  C:\Windows\System\uUFJAjs.exe
  2⤵
  PID:7060
- C:\Windows\System\jAOqVbJ.exe
  C:\Windows\System\jAOqVbJ.exe
  2⤵
  PID:7156
- C:\Windows\System\FZFHhXp.exe
  C:\Windows\System\FZFHhXp.exe
  2⤵
  PID:6728
- C:\Windows\System\xqakFXK.exe
  C:\Windows\System\xqakFXK.exe
  2⤵
  PID:6464
- C:\Windows\System\VMEwJYG.exe
  C:\Windows\System\VMEwJYG.exe
  2⤵
  PID:876
- C:\Windows\System\OZrngjP.exe
  C:\Windows\System\OZrngjP.exe
  2⤵
  PID:6336
- C:\Windows\System\eLKQvtE.exe
  C:\Windows\System\eLKQvtE.exe
  2⤵
  PID:7176
- C:\Windows\System\QcyISRF.exe
  C:\Windows\System\QcyISRF.exe
  2⤵
  PID:7192
- C:\Windows\System\dDdbgiK.exe
  C:\Windows\System\dDdbgiK.exe
  2⤵
  PID:7208
- C:\Windows\System\QUUdUEk.exe
  C:\Windows\System\QUUdUEk.exe
  2⤵
  PID:7224
- C:\Windows\System\mZmUYkb.exe
  C:\Windows\System\mZmUYkb.exe
  2⤵
  PID:7244
- C:\Windows\System\UCVdUmJ.exe
  C:\Windows\System\UCVdUmJ.exe
  2⤵
  PID:7260
- C:\Windows\System\NnyBgkt.exe
  C:\Windows\System\NnyBgkt.exe
  2⤵
  PID:7276
- C:\Windows\System\cjiSwnd.exe
  C:\Windows\System\cjiSwnd.exe
  2⤵
  PID:7296
- C:\Windows\System\EttYnjr.exe
  C:\Windows\System\EttYnjr.exe
  2⤵
  PID:7312
- C:\Windows\System\DLZDEVg.exe
  C:\Windows\System\DLZDEVg.exe
  2⤵
  PID:7328
- C:\Windows\System\rrZijJq.exe
  C:\Windows\System\rrZijJq.exe
  2⤵
  PID:7352
- C:\Windows\System\BcZdfTD.exe
  C:\Windows\System\BcZdfTD.exe
  2⤵
  PID:7368
- C:\Windows\System\brpbJzx.exe
  C:\Windows\System\brpbJzx.exe
  2⤵
  PID:7388
- C:\Windows\System\tCeNTvH.exe
  C:\Windows\System\tCeNTvH.exe
  2⤵
  PID:7404
- C:\Windows\System\NtELSyf.exe
  C:\Windows\System\NtELSyf.exe
  2⤵
  PID:7420
- C:\Windows\System\WrNyoXf.exe
  C:\Windows\System\WrNyoXf.exe
  2⤵
  PID:7436
- C:\Windows\System\PEODCwl.exe
  C:\Windows\System\PEODCwl.exe
  2⤵
  PID:7452
- C:\Windows\System\ftKDkdl.exe
  C:\Windows\System\ftKDkdl.exe
  2⤵
  PID:7472
- C:\Windows\System\GGNGxVp.exe
  C:\Windows\System\GGNGxVp.exe
  2⤵
  PID:7488
- C:\Windows\System\VImChtK.exe
  C:\Windows\System\VImChtK.exe
  2⤵
  PID:7504
- C:\Windows\System\oQYElRS.exe
  C:\Windows\System\oQYElRS.exe
  2⤵
  PID:7520
- C:\Windows\System\WGggCBF.exe
  C:\Windows\System\WGggCBF.exe
  2⤵
  PID:7536
- C:\Windows\System\pEEASwP.exe
  C:\Windows\System\pEEASwP.exe
  2⤵
  PID:7556
- C:\Windows\System\glIHWdn.exe
  C:\Windows\System\glIHWdn.exe
  2⤵
  PID:7572
- C:\Windows\System\wYjuqiY.exe
  C:\Windows\System\wYjuqiY.exe
  2⤵
  PID:7592
- C:\Windows\System\XluxNIu.exe
  C:\Windows\System\XluxNIu.exe
  2⤵
  PID:7608
- C:\Windows\System\zvMyajD.exe
  C:\Windows\System\zvMyajD.exe
  2⤵
  PID:7624
- C:\Windows\System\fHQZYxu.exe
  C:\Windows\System\fHQZYxu.exe
  2⤵
  PID:7640
- C:\Windows\System\wZNkzMV.exe
  C:\Windows\System\wZNkzMV.exe
  2⤵
  PID:7656
- C:\Windows\System\LPphXwQ.exe
  C:\Windows\System\LPphXwQ.exe
  2⤵
  PID:7672
- C:\Windows\System\AkLOMiA.exe
  C:\Windows\System\AkLOMiA.exe
  2⤵
  PID:7688
- C:\Windows\System\omHFYxS.exe
  C:\Windows\System\omHFYxS.exe
  2⤵
  PID:7704
- C:\Windows\System\uhxSCUC.exe
  C:\Windows\System\uhxSCUC.exe
  2⤵
  PID:7720
- C:\Windows\System\aKOzPTf.exe
  C:\Windows\System\aKOzPTf.exe
  2⤵
  PID:7736
- C:\Windows\System\YExKOSe.exe
  C:\Windows\System\YExKOSe.exe
  2⤵
  PID:7752
- C:\Windows\System\aNLrnth.exe
  C:\Windows\System\aNLrnth.exe
  2⤵
  PID:7768
- C:\Windows\System\LNgRBVK.exe
  C:\Windows\System\LNgRBVK.exe
  2⤵
  PID:7784
- C:\Windows\System\FjcQXdG.exe
  C:\Windows\System\FjcQXdG.exe
  2⤵
  PID:7800
- C:\Windows\System\VZFowHB.exe
  C:\Windows\System\VZFowHB.exe
  2⤵
  PID:7816
- C:\Windows\System\zIxlGcw.exe
  C:\Windows\System\zIxlGcw.exe
  2⤵
  PID:7832
- C:\Windows\System\EoYQIuA.exe
  C:\Windows\System\EoYQIuA.exe
  2⤵
  PID:7848
- C:\Windows\System\wDBCktS.exe
  C:\Windows\System\wDBCktS.exe
  2⤵
  PID:7864
- C:\Windows\System\YulVBAt.exe
  C:\Windows\System\YulVBAt.exe
  2⤵
  PID:7880
- C:\Windows\System\TuCWcWR.exe
  C:\Windows\System\TuCWcWR.exe
  2⤵
  PID:7904
- C:\Windows\System\tJgrjlT.exe
  C:\Windows\System\tJgrjlT.exe
  2⤵
  PID:7920
- C:\Windows\System\SvuhEcf.exe
  C:\Windows\System\SvuhEcf.exe
  2⤵
  PID:7948
- C:\Windows\System\ssaBcFb.exe
  C:\Windows\System\ssaBcFb.exe
  2⤵
  PID:7968
- C:\Windows\System\tnLYqim.exe
  C:\Windows\System\tnLYqim.exe
  2⤵
  PID:7984
- C:\Windows\System\RIkzCRh.exe
  C:\Windows\System\RIkzCRh.exe
  2⤵
  PID:8000
- C:\Windows\System\WBSWRVI.exe
  C:\Windows\System\WBSWRVI.exe
  2⤵
  PID:8016
- C:\Windows\System\kDOVOYo.exe
  C:\Windows\System\kDOVOYo.exe
  2⤵
  PID:8032
- C:\Windows\System\uTTFrsG.exe
  C:\Windows\System\uTTFrsG.exe
  2⤵
  PID:8048
- C:\Windows\System\zxmfjts.exe
  C:\Windows\System\zxmfjts.exe
  2⤵
  PID:8076
- C:\Windows\System\COsFFuB.exe
  C:\Windows\System\COsFFuB.exe
  2⤵
  PID:8156
- C:\Windows\System\RvKSVwL.exe
  C:\Windows\System\RvKSVwL.exe
  2⤵
  PID:8172
- C:\Windows\System\MGobaRl.exe
  C:\Windows\System\MGobaRl.exe
  2⤵
  PID:6268
- C:\Windows\System\JcoVXRF.exe
  C:\Windows\System\JcoVXRF.exe
  2⤵
  PID:6864
- C:\Windows\System\fkoUkvh.exe
  C:\Windows\System\fkoUkvh.exe
  2⤵
  PID:7204
- C:\Windows\System\GOrlZlX.exe
  C:\Windows\System\GOrlZlX.exe
  2⤵
  PID:7232
- C:\Windows\System\xyEzWmQ.exe
  C:\Windows\System\xyEzWmQ.exe
  2⤵
  PID:7288
- C:\Windows\System\UoGOkDH.exe
  C:\Windows\System\UoGOkDH.exe
  2⤵
  PID:7308
- C:\Windows\System\kVeJIyr.exe
  C:\Windows\System\kVeJIyr.exe
  2⤵
  PID:7344
- C:\Windows\System\qDNOeNK.exe
  C:\Windows\System\qDNOeNK.exe
  2⤵
  PID:7380
- C:\Windows\System\sXmlgBI.exe
  C:\Windows\System\sXmlgBI.exe
  2⤵
  PID:7412
- C:\Windows\System\VUlakvX.exe
  C:\Windows\System\VUlakvX.exe
  2⤵
  PID:7464
- C:\Windows\System\jRrKWCe.exe
  C:\Windows\System\jRrKWCe.exe
  2⤵
  PID:7448
- C:\Windows\System\RJjdHRQ.exe
  C:\Windows\System\RJjdHRQ.exe
  2⤵
  PID:7480
- C:\Windows\System\RVUSPRX.exe
  C:\Windows\System\RVUSPRX.exe
  2⤵
  PID:7552
- C:\Windows\System\WyKVLRW.exe
  C:\Windows\System\WyKVLRW.exe
  2⤵
  PID:7604
- C:\Windows\System\aSmMyUf.exe
  C:\Windows\System\aSmMyUf.exe
  2⤵
  PID:7584
- C:\Windows\System\levKgEI.exe
  C:\Windows\System\levKgEI.exe
  2⤵
  PID:7728
- C:\Windows\System\knNQKOQ.exe
  C:\Windows\System\knNQKOQ.exe
  2⤵
  PID:7648
- C:\Windows\System\NQCBmHm.exe
  C:\Windows\System\NQCBmHm.exe
  2⤵
  PID:7716
- C:\Windows\System\JWXOkHb.exe
  C:\Windows\System\JWXOkHb.exe
  2⤵
  PID:7812
- C:\Windows\System\hCAdLaX.exe
  C:\Windows\System\hCAdLaX.exe
  2⤵
  PID:7840
- C:\Windows\System\RWfgGbf.exe
  C:\Windows\System\RWfgGbf.exe
  2⤵
  PID:7900
- C:\Windows\System\DbiWNyx.exe
  C:\Windows\System\DbiWNyx.exe
  2⤵
  PID:7916
- C:\Windows\System\DjVOiyD.exe
  C:\Windows\System\DjVOiyD.exe
  2⤵
  PID:7940
- C:\Windows\System\PQYLYxT.exe
  C:\Windows\System\PQYLYxT.exe
  2⤵
  PID:7976
- C:\Windows\System\GQiVGtS.exe
  C:\Windows\System\GQiVGtS.exe
  2⤵
  PID:8040
- C:\Windows\System\QgivoIF.exe
  C:\Windows\System\QgivoIF.exe
  2⤵
  PID:8028
- C:\Windows\System\FtpzfgU.exe
  C:\Windows\System\FtpzfgU.exe
  2⤵
  PID:8056
- C:\Windows\System\SeStMYS.exe
  C:\Windows\System\SeStMYS.exe
  2⤵
  PID:8084
- C:\Windows\System\zoyYSDa.exe
  C:\Windows\System\zoyYSDa.exe
  2⤵
  PID:8100
- C:\Windows\System\ohCfVcM.exe
  C:\Windows\System\ohCfVcM.exe
  2⤵
  PID:8116
- C:\Windows\System\LptQdRC.exe
  C:\Windows\System\LptQdRC.exe
  2⤵
  PID:8136
- C:\Windows\System\ewVsHIu.exe
  C:\Windows\System\ewVsHIu.exe
  2⤵
  PID:8152
- C:\Windows\System\lKDxqPv.exe
  C:\Windows\System\lKDxqPv.exe
  2⤵
  PID:7188
- C:\Windows\System\KqIYNvq.exe
  C:\Windows\System\KqIYNvq.exe
  2⤵
  PID:7496
- C:\Windows\System\xImrYVR.exe
  C:\Windows\System\xImrYVR.exe
  2⤵
  PID:7256
- C:\Windows\System\dICWLOQ.exe
  C:\Windows\System\dICWLOQ.exe
  2⤵
  PID:6380
- C:\Windows\System\OqFkvGU.exe
  C:\Windows\System\OqFkvGU.exe
  2⤵
  PID:7432
- C:\Windows\System\zgkFWuv.exe
  C:\Windows\System\zgkFWuv.exe
  2⤵
  PID:7844
- C:\Windows\System\LgUAcOx.exe
  C:\Windows\System\LgUAcOx.exe
  2⤵
  PID:7960
- C:\Windows\System\IdwHQSO.exe
  C:\Windows\System\IdwHQSO.exe
  2⤵
  PID:7564
- C:\Windows\System\cfPPjrY.exe
  C:\Windows\System\cfPPjrY.exe
  2⤵
  PID:7460
- C:\Windows\System\LUPVoNl.exe
  C:\Windows\System\LUPVoNl.exe
  2⤵
  PID:7348
- C:\Windows\System\NfRaQKW.exe
  C:\Windows\System\NfRaQKW.exe
  2⤵
  PID:7732
- C:\Windows\System\VICzDHs.exe
  C:\Windows\System\VICzDHs.exe
  2⤵
  PID:8060
- C:\Windows\System\ulIfWzi.exe
  C:\Windows\System\ulIfWzi.exe
  2⤵
  PID:7696
- C:\Windows\System\ZsggrtT.exe
  C:\Windows\System\ZsggrtT.exe
  2⤵
  PID:7620
- C:\Windows\System\lHjnloe.exe
  C:\Windows\System\lHjnloe.exe
  2⤵
  PID:8072
- C:\Windows\System\pYAydcj.exe
  C:\Windows\System\pYAydcj.exe
  2⤵
  PID:8068
- C:\Windows\System\nEzNdoO.exe
  C:\Windows\System\nEzNdoO.exe
  2⤵
  PID:7184
- C:\Windows\System\InKRKqh.exe
  C:\Windows\System\InKRKqh.exe
  2⤵
  PID:7764
- C:\Windows\System\stbVyHn.exe
  C:\Windows\System\stbVyHn.exe
  2⤵
  PID:7780
- C:\Windows\System\VfVIdSE.exe
  C:\Windows\System\VfVIdSE.exe
  2⤵
  PID:7828
- C:\Windows\System\PJUrIKd.exe
  C:\Windows\System\PJUrIKd.exe
  2⤵
  PID:8008
- C:\Windows\System\oZwYcWe.exe
  C:\Windows\System\oZwYcWe.exe
  2⤵
  PID:7824
- C:\Windows\System\dywsFqA.exe
  C:\Windows\System\dywsFqA.exe
  2⤵
  PID:7548
- C:\Windows\System\fSqdUEI.exe
  C:\Windows\System\fSqdUEI.exe
  2⤵
  PID:8124
- C:\Windows\System\rCIGvIC.exe
  C:\Windows\System\rCIGvIC.exe
  2⤵
  PID:8184
- C:\Windows\System\rXLonBJ.exe
  C:\Windows\System\rXLonBJ.exe
  2⤵
  PID:7664
- C:\Windows\System\bdneFFz.exe
  C:\Windows\System\bdneFFz.exe
  2⤵
  PID:7856
- C:\Windows\System\httJLVJ.exe
  C:\Windows\System\httJLVJ.exe
  2⤵
  PID:7944
- C:\Windows\System\XSvHADk.exe
  C:\Windows\System\XSvHADk.exe
  2⤵
  PID:8012
- C:\Windows\System\AcZVuZU.exe
  C:\Windows\System\AcZVuZU.exe
  2⤵
  PID:8144
- C:\Windows\System\CALhHnZ.exe
  C:\Windows\System\CALhHnZ.exe
  2⤵
  PID:7796
- C:\Windows\System\yjCzPtC.exe
  C:\Windows\System\yjCzPtC.exe
  2⤵
  PID:7936
- C:\Windows\System\BzlKGok.exe
  C:\Windows\System\BzlKGok.exe
  2⤵
  PID:8112
- C:\Windows\System\GVCPrOm.exe
  C:\Windows\System\GVCPrOm.exe
  2⤵
  PID:7700
- C:\Windows\System\bqZWKnK.exe
  C:\Windows\System\bqZWKnK.exe
  2⤵
  PID:7932
- C:\Windows\System\zqKhfRf.exe
  C:\Windows\System\zqKhfRf.exe
  2⤵
  PID:7896
- C:\Windows\System\NPXYKRX.exe
  C:\Windows\System\NPXYKRX.exe
  2⤵
  PID:8212
- C:\Windows\System\bzoUwxl.exe
  C:\Windows\System\bzoUwxl.exe
  2⤵
  PID:8228
- C:\Windows\System\QQtDjqJ.exe
  C:\Windows\System\QQtDjqJ.exe
  2⤵
  PID:8244
- C:\Windows\System\UfutBQp.exe
  C:\Windows\System\UfutBQp.exe
  2⤵
  PID:8264
- C:\Windows\System\qjimNSL.exe
  C:\Windows\System\qjimNSL.exe
  2⤵
  PID:8308
- C:\Windows\System\fMzMciO.exe
  C:\Windows\System\fMzMciO.exe
  2⤵
  PID:8324
- C:\Windows\System\RHsyQOd.exe
  C:\Windows\System\RHsyQOd.exe
  2⤵
  PID:8340
- C:\Windows\System\fzrDSYO.exe
  C:\Windows\System\fzrDSYO.exe
  2⤵
  PID:8364
- C:\Windows\System\sBinLTf.exe
  C:\Windows\System\sBinLTf.exe
  2⤵
  PID:8380
- C:\Windows\System\xEissRo.exe
  C:\Windows\System\xEissRo.exe
  2⤵
  PID:8408
- C:\Windows\System\paTDDlt.exe
  C:\Windows\System\paTDDlt.exe
  2⤵
  PID:8428
- C:\Windows\System\BqAMami.exe
  C:\Windows\System\BqAMami.exe
  2⤵
  PID:8444
- C:\Windows\System\QgFdyjR.exe
  C:\Windows\System\QgFdyjR.exe
  2⤵
  PID:8472
- C:\Windows\System\cqGLUbx.exe
  C:\Windows\System\cqGLUbx.exe
  2⤵
  PID:8492
- C:\Windows\System\uCJMlNB.exe
  C:\Windows\System\uCJMlNB.exe
  2⤵
  PID:8512
- C:\Windows\System\ALyoklM.exe
  C:\Windows\System\ALyoklM.exe
  2⤵
  PID:8528
- C:\Windows\System\uuMfouz.exe
  C:\Windows\System\uuMfouz.exe
  2⤵
  PID:8544
- C:\Windows\System\iYsLjdD.exe
  C:\Windows\System\iYsLjdD.exe
  2⤵
  PID:8560
- C:\Windows\System\DMGkFfE.exe
  C:\Windows\System\DMGkFfE.exe
  2⤵
  PID:8576
- C:\Windows\System\oFwhbnO.exe
  C:\Windows\System\oFwhbnO.exe
  2⤵
  PID:8592
- C:\Windows\System\NtbOGXe.exe
  C:\Windows\System\NtbOGXe.exe
  2⤵
  PID:8608
- C:\Windows\System\DQcXeeJ.exe
  C:\Windows\System\DQcXeeJ.exe
  2⤵
  PID:8632
- C:\Windows\System\auElImR.exe
  C:\Windows\System\auElImR.exe
  2⤵
  PID:8648
- C:\Windows\System\wytHjsn.exe
  C:\Windows\System\wytHjsn.exe
  2⤵
  PID:8680
- C:\Windows\System\GvkSaGW.exe
  C:\Windows\System\GvkSaGW.exe
  2⤵
  PID:8700
- C:\Windows\System\bDqBmzS.exe
  C:\Windows\System\bDqBmzS.exe
  2⤵
  PID:8716
- C:\Windows\System\zbNoXbl.exe
  C:\Windows\System\zbNoXbl.exe
  2⤵
  PID:8736
- C:\Windows\System\ndzyuCg.exe
  C:\Windows\System\ndzyuCg.exe
  2⤵
  PID:8760
- C:\Windows\System\iwfiTNJ.exe
  C:\Windows\System\iwfiTNJ.exe
  2⤵
  PID:8776
- C:\Windows\System\ZfbyMZi.exe
  C:\Windows\System\ZfbyMZi.exe
  2⤵
  PID:8816
- C:\Windows\System\GhUfCxf.exe
  C:\Windows\System\GhUfCxf.exe
  2⤵
  PID:8836
- C:\Windows\System\VITCAiG.exe
  C:\Windows\System\VITCAiG.exe
  2⤵
  PID:8852
- C:\Windows\System\zdonpYc.exe
  C:\Windows\System\zdonpYc.exe
  2⤵
  PID:8872
- C:\Windows\System\ZpZoESQ.exe
  C:\Windows\System\ZpZoESQ.exe
  2⤵
  PID:8896
- C:\Windows\System\gByMZZr.exe
  C:\Windows\System\gByMZZr.exe
  2⤵
  PID:8916
- C:\Windows\System\nICdpdy.exe
  C:\Windows\System\nICdpdy.exe
  2⤵
  PID:8932
- C:\Windows\System\vxTWrrN.exe
  C:\Windows\System\vxTWrrN.exe
  2⤵
  PID:8948
- C:\Windows\System\tNJpKjd.exe
  C:\Windows\System\tNJpKjd.exe
  2⤵
  PID:8968
- C:\Windows\System\TRVribZ.exe
  C:\Windows\System\TRVribZ.exe
  2⤵
  PID:8988
- C:\Windows\System\TXerbBm.exe
  C:\Windows\System\TXerbBm.exe
  2⤵
  PID:9008
- C:\Windows\System\cNoplaQ.exe
  C:\Windows\System\cNoplaQ.exe
  2⤵
  PID:9024
- C:\Windows\System\GkwiDsO.exe
  C:\Windows\System\GkwiDsO.exe
  2⤵
  PID:9048
- C:\Windows\System\XKZeqhP.exe
  C:\Windows\System\XKZeqhP.exe
  2⤵
  PID:9072
- C:\Windows\System\cRshfEM.exe
  C:\Windows\System\cRshfEM.exe
  2⤵
  PID:9092
- C:\Windows\System\TRBPRDr.exe
  C:\Windows\System\TRBPRDr.exe
  2⤵
  PID:9112
- C:\Windows\System\uwyqwLC.exe
  C:\Windows\System\uwyqwLC.exe
  2⤵
  PID:9128
- C:\Windows\System\vvRGCcq.exe
  C:\Windows\System\vvRGCcq.exe
  2⤵
  PID:9148
- C:\Windows\System\nkonapQ.exe
  C:\Windows\System\nkonapQ.exe
  2⤵
  PID:9172
- C:\Windows\System\OrAoIjF.exe
  C:\Windows\System\OrAoIjF.exe
  2⤵
  PID:9188
- C:\Windows\System\kHEmGCf.exe
  C:\Windows\System\kHEmGCf.exe
  2⤵
  PID:9212
- C:\Windows\System\mkowhxJ.exe
  C:\Windows\System\mkowhxJ.exe
  2⤵
  PID:8240
- C:\Windows\System\iBGKOiw.exe
  C:\Windows\System\iBGKOiw.exe
  2⤵
  PID:8220
- C:\Windows\System\NSuuZKE.exe
  C:\Windows\System\NSuuZKE.exe
  2⤵
  PID:7792
- C:\Windows\System\HEZaCpO.exe
  C:\Windows\System\HEZaCpO.exe
  2⤵
  PID:8260
- C:\Windows\System\IHlxfBg.exe
  C:\Windows\System\IHlxfBg.exe
  2⤵
  PID:8304
- C:\Windows\System\XqkqfkK.exe
  C:\Windows\System\XqkqfkK.exe
  2⤵
  PID:8352
- C:\Windows\System\NBHtwHq.exe
  C:\Windows\System\NBHtwHq.exe
  2⤵
  PID:8400
- C:\Windows\System\phBWWXn.exe
  C:\Windows\System\phBWWXn.exe
  2⤵
  PID:8436
- C:\Windows\System\NSxZKBO.exe
  C:\Windows\System\NSxZKBO.exe
  2⤵
  PID:8300
- C:\Windows\System\CNiqPEw.exe
  C:\Windows\System\CNiqPEw.exe
  2⤵
  PID:8484
- C:\Windows\System\SqgMkXt.exe
  C:\Windows\System\SqgMkXt.exe
  2⤵
  PID:8536
- C:\Windows\System\IWWZilg.exe
  C:\Windows\System\IWWZilg.exe
  2⤵
  PID:8572
- C:\Windows\System\CxLlbXB.exe
  C:\Windows\System\CxLlbXB.exe
  2⤵
  PID:8640
- C:\Windows\System\ZGtZIFP.exe
  C:\Windows\System\ZGtZIFP.exe
  2⤵
  PID:8620
- C:\Windows\System\zfiQmqv.exe
  C:\Windows\System\zfiQmqv.exe
  2⤵
  PID:8656
- C:\Windows\System\RgrECDo.exe
  C:\Windows\System\RgrECDo.exe
  2⤵
  PID:8732
- C:\Windows\System\aeegdPs.exe
  C:\Windows\System\aeegdPs.exe
  2⤵
  PID:8712
- C:\Windows\System\oYwntzT.exe
  C:\Windows\System\oYwntzT.exe
  2⤵
  PID:8788
- C:\Windows\System\jDDcgyB.exe
  C:\Windows\System\jDDcgyB.exe
  2⤵
  PID:8804
- C:\Windows\System\RjEOkfu.exe
  C:\Windows\System\RjEOkfu.exe
  2⤵
  PID:8832
- C:\Windows\System\vCWhbVS.exe
  C:\Windows\System\vCWhbVS.exe
  2⤵
  PID:8860
- C:\Windows\System\GUSOIlV.exe
  C:\Windows\System\GUSOIlV.exe
  2⤵
  PID:8884
- C:\Windows\System\gMfIGfL.exe
  C:\Windows\System\gMfIGfL.exe
  2⤵
  PID:8924
- C:\Windows\System\oaXwTQk.exe
  C:\Windows\System\oaXwTQk.exe
  2⤵
  PID:8984
- C:\Windows\System\NgGqBGE.exe
  C:\Windows\System\NgGqBGE.exe
  2⤵
  PID:8996
- C:\Windows\System\wnLZlcS.exe
  C:\Windows\System\wnLZlcS.exe
  2⤵
  PID:9036
- C:\Windows\System\gCJAnkS.exe
  C:\Windows\System\gCJAnkS.exe
  2⤵
  PID:9040
- C:\Windows\System\NbkUahx.exe
  C:\Windows\System\NbkUahx.exe
  2⤵
  PID:9104
- C:\Windows\System\ngkUfZm.exe
  C:\Windows\System\ngkUfZm.exe
  2⤵
  PID:9144
- C:\Windows\System\hzSPzpr.exe
  C:\Windows\System\hzSPzpr.exe
  2⤵
  PID:9160
- C:\Windows\System\tqLGmhs.exe
  C:\Windows\System\tqLGmhs.exe
  2⤵
  PID:8236
- C:\Windows\System\VuLrWOr.exe
  C:\Windows\System\VuLrWOr.exe
  2⤵
  PID:8296
- C:\Windows\System\BbKdzsW.exe
  C:\Windows\System\BbKdzsW.exe
  2⤵
  PID:6580
- C:\Windows\System\VWhSbIz.exe
  C:\Windows\System\VWhSbIz.exe
  2⤵
  PID:8336
- C:\Windows\System\lYhFXUC.exe
  C:\Windows\System\lYhFXUC.exe
  2⤵
  PID:8388
- C:\Windows\System\rLCPotP.exe
  C:\Windows\System\rLCPotP.exe
  2⤵
  PID:8396
- C:\Windows\System\PkNpnaS.exe
  C:\Windows\System\PkNpnaS.exe
  2⤵
  PID:8424
- C:\Windows\System\DQGxttV.exe
  C:\Windows\System\DQGxttV.exe
  2⤵
  PID:8480
- C:\Windows\System\DIpYGfu.exe
  C:\Windows\System\DIpYGfu.exe
  2⤵
  PID:8660
- C:\Windows\System\uCKgqJS.exe
  C:\Windows\System\uCKgqJS.exe
  2⤵
  PID:8692
- C:\Windows\System\cFMpltI.exe
  C:\Windows\System\cFMpltI.exe
  2⤵
  PID:8696
- C:\Windows\System\wUJrLUJ.exe
  C:\Windows\System\wUJrLUJ.exe
  2⤵
  PID:8772
- C:\Windows\System\ywosJlh.exe
  C:\Windows\System\ywosJlh.exe
  2⤵
  PID:8604
- C:\Windows\System\PfJpfQO.exe
  C:\Windows\System\PfJpfQO.exe
  2⤵
  PID:8912
- C:\Windows\System\DmiqZtH.exe
  C:\Windows\System\DmiqZtH.exe
  2⤵
  PID:8824
- C:\Windows\System\brjuxjo.exe
  C:\Windows\System\brjuxjo.exe
  2⤵
  PID:8944
- C:\Windows\System\dKWlqoI.exe
  C:\Windows\System\dKWlqoI.exe
  2⤵
  PID:9060
- C:\Windows\System\TuyYWVn.exe
  C:\Windows\System\TuyYWVn.exe
  2⤵
  PID:9080
- C:\Windows\System\bgrLZBK.exe
  C:\Windows\System\bgrLZBK.exe
  2⤵
  PID:9088
- C:\Windows\System\xAQSIXp.exe
  C:\Windows\System\xAQSIXp.exe
  2⤵
  PID:9100
- C:\Windows\System\mpUgMzA.exe
  C:\Windows\System\mpUgMzA.exe
  2⤵
  PID:8252
- C:\Windows\System\xectIyB.exe
  C:\Windows\System\xectIyB.exe
  2⤵
  PID:8372
- C:\Windows\System\UwprSse.exe
  C:\Windows\System\UwprSse.exe
  2⤵
  PID:8460
- C:\Windows\System\cegHnxF.exe
  C:\Windows\System\cegHnxF.exe
  2⤵
  PID:8524
- C:\Windows\System\DHzGAuf.exe
  C:\Windows\System\DHzGAuf.exe
  2⤵
  PID:8584
- C:\Windows\System\vWVuxXs.exe
  C:\Windows\System\vWVuxXs.exe
  2⤵
  PID:8552
- C:\Windows\System\vkGSDTU.exe
  C:\Windows\System\vkGSDTU.exe
  2⤵
  PID:8748
- C:\Windows\System\kKZDHLc.exe
  C:\Windows\System\kKZDHLc.exe
  2⤵
  PID:8888
- C:\Windows\System\GEjrHeq.exe
  C:\Windows\System\GEjrHeq.exe
  2⤵
  PID:8880
- C:\Windows\System\ahCTaqZ.exe
  C:\Windows\System\ahCTaqZ.exe
  2⤵
  PID:9140
- C:\Windows\System\GHAdgAw.exe
  C:\Windows\System\GHAdgAw.exe
  2⤵
  PID:9020
- C:\Windows\System\bgKexFY.exe
  C:\Windows\System\bgKexFY.exe
  2⤵
  PID:9208
- C:\Windows\System\RwKhcci.exe
  C:\Windows\System\RwKhcci.exe
  2⤵
  PID:8504
- C:\Windows\System\WiRKuZH.exe
  C:\Windows\System\WiRKuZH.exe
  2⤵
  PID:8960
- C:\Windows\System\UBzbyBT.exe
  C:\Windows\System\UBzbyBT.exe
  2⤵
  PID:8280
- C:\Windows\System\ktoNKfn.exe
  C:\Windows\System\ktoNKfn.exe
  2⤵
  PID:8796
- C:\Windows\System\eUQQhiB.exe
  C:\Windows\System\eUQQhiB.exe
  2⤵
  PID:8844
- C:\Windows\System\kwyEmSb.exe
  C:\Windows\System\kwyEmSb.exe
  2⤵
  PID:9056
- C:\Windows\System\lRHCLrL.exe
  C:\Windows\System\lRHCLrL.exe
  2⤵
  PID:8488
- C:\Windows\System\rShuvfx.exe
  C:\Windows\System\rShuvfx.exe
  2⤵
  PID:8668
- C:\Windows\System\UeNPcsB.exe
  C:\Windows\System\UeNPcsB.exe
  2⤵
  PID:9204
- C:\Windows\System\CDpAggU.exe
  C:\Windows\System\CDpAggU.exe
  2⤵
  PID:9044
- C:\Windows\System\NXZivwz.exe
  C:\Windows\System\NXZivwz.exe
  2⤵
  PID:8256
- C:\Windows\System\XcukRYM.exe
  C:\Windows\System\XcukRYM.exe
  2⤵
  PID:8672
- C:\Windows\System\OyDnveB.exe
  C:\Windows\System\OyDnveB.exe
  2⤵
  PID:8928
- C:\Windows\System\UphwYIP.exe
  C:\Windows\System\UphwYIP.exe
  2⤵
  PID:9164
- C:\Windows\System\VNRuMaK.exe
  C:\Windows\System\VNRuMaK.exe
  2⤵
  PID:9016
- C:\Windows\System\xdiukPf.exe
  C:\Windows\System\xdiukPf.exe
  2⤵
  PID:9224
- C:\Windows\System\merlmcX.exe
  C:\Windows\System\merlmcX.exe
  2⤵
  PID:9240
- C:\Windows\System\HDyytcL.exe
  C:\Windows\System\HDyytcL.exe
  2⤵
  PID:9260
- C:\Windows\System\CzFVbmv.exe
  C:\Windows\System\CzFVbmv.exe
  2⤵
  PID:9280
- C:\Windows\System\xijbHVT.exe
  C:\Windows\System\xijbHVT.exe
  2⤵
  PID:9296
- C:\Windows\System\ENEdAOS.exe
  C:\Windows\System\ENEdAOS.exe
  2⤵
  PID:9320
- C:\Windows\System\qZTgvAT.exe
  C:\Windows\System\qZTgvAT.exe
  2⤵
  PID:9344
- C:\Windows\System\IdJBwfb.exe
  C:\Windows\System\IdJBwfb.exe
  2⤵
  PID:9360
- C:\Windows\System\AEYYqro.exe
  C:\Windows\System\AEYYqro.exe
  2⤵
  PID:9376
- C:\Windows\System\zijBJHg.exe
  C:\Windows\System\zijBJHg.exe
  2⤵
  PID:9396
- C:\Windows\System\SOEEgyg.exe
  C:\Windows\System\SOEEgyg.exe
  2⤵
  PID:9420
- C:\Windows\System\YegdxgD.exe
  C:\Windows\System\YegdxgD.exe
  2⤵
  PID:9436
- C:\Windows\System\jqmsqtV.exe
  C:\Windows\System\jqmsqtV.exe
  2⤵
  PID:9456
- C:\Windows\System\fBvuKEU.exe
  C:\Windows\System\fBvuKEU.exe
  2⤵
  PID:9500
- C:\Windows\System\kvZVowB.exe
  C:\Windows\System\kvZVowB.exe
  2⤵
  PID:9528
- C:\Windows\System\YGDCIxh.exe
  C:\Windows\System\YGDCIxh.exe
  2⤵
  PID:9544
- C:\Windows\System\UXECfWt.exe
  C:\Windows\System\UXECfWt.exe
  2⤵
  PID:9560
- C:\Windows\System\yhBJPhx.exe
  C:\Windows\System\yhBJPhx.exe
  2⤵
  PID:9580
- C:\Windows\System\cGmYHPa.exe
  C:\Windows\System\cGmYHPa.exe
  2⤵
  PID:9600
- C:\Windows\System\ImMKBLo.exe
  C:\Windows\System\ImMKBLo.exe
  2⤵
  PID:9620
- C:\Windows\System\ZxPgKRD.exe
  C:\Windows\System\ZxPgKRD.exe
  2⤵
  PID:9644
- C:\Windows\System\zsfmOwg.exe
  C:\Windows\System\zsfmOwg.exe
  2⤵
  PID:9664
- C:\Windows\System\ZoprdBc.exe
  C:\Windows\System\ZoprdBc.exe
  2⤵
  PID:9680
- C:\Windows\System\brhvnSN.exe
  C:\Windows\System\brhvnSN.exe
  2⤵
  PID:9700
- C:\Windows\System\TavUPjw.exe
  C:\Windows\System\TavUPjw.exe
  2⤵
  PID:9724
- C:\Windows\System\lpIyKhE.exe
  C:\Windows\System\lpIyKhE.exe
  2⤵
  PID:9744
- C:\Windows\System\AzDuiVZ.exe
  C:\Windows\System\AzDuiVZ.exe
  2⤵
  PID:9764
- C:\Windows\System\HhWlndL.exe
  C:\Windows\System\HhWlndL.exe
  2⤵
  PID:9780
- C:\Windows\System\ofwRJgp.exe
  C:\Windows\System\ofwRJgp.exe
  2⤵
  PID:9804
- C:\Windows\System\iUpFNdp.exe
  C:\Windows\System\iUpFNdp.exe
  2⤵
  PID:9820
- C:\Windows\System\NWNLNlG.exe
  C:\Windows\System\NWNLNlG.exe
  2⤵
  PID:9876
- C:\Windows\System\IBUjqXa.exe
  C:\Windows\System\IBUjqXa.exe
  2⤵
  PID:9896
- C:\Windows\System\KKBfSJr.exe
  C:\Windows\System\KKBfSJr.exe
  2⤵
  PID:9912
- C:\Windows\System\tjqtUMU.exe
  C:\Windows\System\tjqtUMU.exe
  2⤵
  PID:9944
- C:\Windows\System\JxPkrQh.exe
  C:\Windows\System\JxPkrQh.exe
  2⤵
  PID:9964
- C:\Windows\System\szmzBCO.exe
  C:\Windows\System\szmzBCO.exe
  2⤵
  PID:9980
- C:\Windows\System\HcvxFcz.exe
  C:\Windows\System\HcvxFcz.exe
  2⤵
  PID:10008
- C:\Windows\System\NRqMvie.exe
  C:\Windows\System\NRqMvie.exe
  2⤵
  PID:10024
- C:\Windows\System\GlTxtOS.exe
  C:\Windows\System\GlTxtOS.exe
  2⤵
  PID:10048
- C:\Windows\System\KdmpUzF.exe
  C:\Windows\System\KdmpUzF.exe
  2⤵
  PID:10064
- C:\Windows\System\WzlQjxV.exe
  C:\Windows\System\WzlQjxV.exe
  2⤵
  PID:10084
- C:\Windows\System\EBgTDbH.exe
  C:\Windows\System\EBgTDbH.exe
  2⤵
  PID:10100
- C:\Windows\System\PkPgcpw.exe
  C:\Windows\System\PkPgcpw.exe
  2⤵
  PID:10116
- C:\Windows\System\EZJxruq.exe
  C:\Windows\System\EZJxruq.exe
  2⤵
  PID:10136
- C:\Windows\System\zZSTJOW.exe
  C:\Windows\System\zZSTJOW.exe
  2⤵
  PID:10152
- C:\Windows\System\lQXJDHY.exe
  C:\Windows\System\lQXJDHY.exe
  2⤵
  PID:10168
- C:\Windows\System\flEVXFn.exe
  C:\Windows\System\flEVXFn.exe
  2⤵
  PID:10184
- C:\Windows\System\ZMQqrTl.exe
  C:\Windows\System\ZMQqrTl.exe
  2⤵
  PID:10200
- C:\Windows\System\wvGmRju.exe
  C:\Windows\System\wvGmRju.exe
  2⤵
  PID:10216
- C:\Windows\System\zJvCXTk.exe
  C:\Windows\System\zJvCXTk.exe
  2⤵
  PID:10232
- C:\Windows\System\pyzhggy.exe
  C:\Windows\System\pyzhggy.exe
  2⤵
  PID:9236
- C:\Windows\System\wdNHRim.exe
  C:\Windows\System\wdNHRim.exe
  2⤵
  PID:9276
- C:\Windows\System\yOODnno.exe
  C:\Windows\System\yOODnno.exe
  2⤵
  PID:9316
- C:\Windows\System\aKusLak.exe
  C:\Windows\System\aKusLak.exe
  2⤵
  PID:9356
- C:\Windows\System\esFahlO.exe
  C:\Windows\System\esFahlO.exe
  2⤵
  PID:9428
- C:\Windows\System\RZDGoYZ.exe
  C:\Windows\System\RZDGoYZ.exe
  2⤵
  PID:9336
- C:\Windows\System\YVwznEE.exe
  C:\Windows\System\YVwznEE.exe
  2⤵
  PID:9416
- C:\Windows\System\izOVvWh.exe
  C:\Windows\System\izOVvWh.exe
  2⤵
  PID:9412
- C:\Windows\System\SmadYpY.exe
  C:\Windows\System\SmadYpY.exe
  2⤵
  PID:9472
- C:\Windows\System\unvSNUV.exe
  C:\Windows\System\unvSNUV.exe
  2⤵
  PID:1012
- C:\Windows\System\iYEXEmT.exe
  C:\Windows\System\iYEXEmT.exe
  2⤵
  PID:9608
- C:\Windows\System\SrSVUPg.exe
  C:\Windows\System\SrSVUPg.exe
  2⤵
  PID:9660
- C:\Windows\System\OkryCRd.exe
  C:\Windows\System\OkryCRd.exe
  2⤵
  PID:9688
- C:\Windows\System\PSUywcT.exe
  C:\Windows\System\PSUywcT.exe
  2⤵
  PID:9732
- C:\Windows\System\bzSyxNN.exe
  C:\Windows\System\bzSyxNN.exe
  2⤵
  PID:9816
- C:\Windows\System\OoXvlfw.exe
  C:\Windows\System\OoXvlfw.exe
  2⤵
  PID:9632
- C:\Windows\System\MeGqCQE.exe
  C:\Windows\System\MeGqCQE.exe
  2⤵
  PID:9716
- C:\Windows\System\sPQfpFD.exe
  C:\Windows\System\sPQfpFD.exe
  2⤵
  PID:9756
- C:\Windows\System\VGWdeRW.exe
  C:\Windows\System\VGWdeRW.exe
  2⤵
  PID:9928
- C:\Windows\System\NUCYSYV.exe
  C:\Windows\System\NUCYSYV.exe
  2⤵
  PID:9940
- C:\Windows\System\AOluuLg.exe
  C:\Windows\System\AOluuLg.exe
  2⤵
  PID:9868
- C:\Windows\System\BjMAywy.exe
  C:\Windows\System\BjMAywy.exe
  2⤵
  PID:9976
- C:\Windows\System\ivQLDKk.exe
  C:\Windows\System\ivQLDKk.exe
  2⤵
  PID:9952
- C:\Windows\System\KMNbLRu.exe
  C:\Windows\System\KMNbLRu.exe
  2⤵
  PID:10004
- C:\Windows\System\oQiZKXF.exe
  C:\Windows\System\oQiZKXF.exe
  2⤵
  PID:10036
- C:\Windows\System\sSApOUb.exe
  C:\Windows\System\sSApOUb.exe
  2⤵
  PID:10076
- C:\Windows\System\mJZdMZS.exe
  C:\Windows\System\mJZdMZS.exe
  2⤵
  PID:10132
- C:\Windows\System\BFglKHd.exe
  C:\Windows\System\BFglKHd.exe
  2⤵
  PID:10192
- C:\Windows\System\wqALNkG.exe
  C:\Windows\System\wqALNkG.exe
  2⤵
  PID:9272
- C:\Windows\System\gFnblEz.exe
  C:\Windows\System\gFnblEz.exe
  2⤵
  PID:10108
- C:\Windows\System\giKqOcJ.exe
  C:\Windows\System\giKqOcJ.exe
  2⤵
  PID:9404
- C:\Windows\System\sXRIYnn.exe
  C:\Windows\System\sXRIYnn.exe
  2⤵
  PID:9480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BdnCiUl.exe

Filesize
1.9MB

MD5
ecfd241723c905fbcbe6ff653fd6dba5

SHA1
01a10c13e371878dc5be02bae0e58774308c46b4

SHA256
44c2da382791206d95cc7b073897b86d03e2afe143fed5578d53c8ed686fc75a

SHA512
f22bbe2d3650c869005b4e6952dc46088338d20ae35314dd84c1cd4c910cd8887c1a01da504ba8ee154dbacdb5bdcbc2f280b050c1f6ba25b91345503afa134a

Download Submit
C:\Windows\system\DxJonyL.exe

Filesize
1.9MB

MD5
088ac6fd2ea138e68fba6ad687e60e5b

SHA1
fdbdacebd415f99050ba17111ee2dd20c8f3c799

SHA256
d39b95d137598902264a209b07622e94d96d077c7246829d3319122ff883a2dd

SHA512
72a28f1909f666040ccb9149e373ffcfcea219bcd486fe1f11c06689f3dd4b331cdf8095bb4c85f4d46eea5fc931317fe891eb3a3c891e45943d2b99f13a8df6

Download Submit
C:\Windows\system\FEaescP.exe

Filesize
1.9MB

MD5
3e2021a9af2f4fa132d3f5f7d15c86f8

SHA1
4537632e7a95db2bb418a0f95c390f6653cdbca2

SHA256
18bd94c4832d7f5ab1691e445c04afc959742740ed65d51828a4f39141c223d7

SHA512
cd35d665bb5e1731a0e5fa3353b21bc90717a3f40278701b34b10953c7119e4b9c011d870f6d822e5a6ca792cb3c97d9825fb308ed0cc36305906d51b8d33a54

Download Submit
C:\Windows\system\GIYFIBP.exe

Filesize
1.9MB

MD5
70898cc4a44af116e0f6cf667e0e13f9

SHA1
f7618865dab21b15d2372a4d95c4b32d2a559328

SHA256
cf958043fd3a5f57d6a09ce3a802d952e66cb154ba2ea1e459f50dfb247bfb25

SHA512
d70c243b4a3562828ac7c97b574dac687eab13a1b574f15a66b44bbe3e54db08ed9e4616bee4b7cabcc97a959e81334a4c08a7ac6d37a3dfa615edcdc1d14bd6

Download Submit
C:\Windows\system\GaBKPNy.exe

Filesize
1.9MB

MD5
8b321a619320e633c23da10dbcb7811f

SHA1
edf29517d99a6924e0270e1010447544a0d4ae51

SHA256
f7f2fd4a456174bc2a4cb896f6293047881d34e508178ba45ff14203a31364e5

SHA512
2e83efb2b50718e65d0b2a6f8ca909bb0724d77f07ecb358cbec2d76361fb14f2371984cd80584b95bebac494e5bb8c8b49fe503a99968948f3bb3df9728f4de

Download Submit
C:\Windows\system\IVrkpJw.exe

Filesize
1.9MB

MD5
153de4df2eaa3319b6dca5508f506b1c

SHA1
092bee868605e3defd62d9812d18cb5a79c42d8c

SHA256
c6b081a7485f31baf9a423ce7f16a020ca51eb5fd3895ef60689947111a80a84

SHA512
0080c12cd3cb49b26af9ebe55d776c6672c51dbfce5b103fe17fc145e6f70ef97f6338cdd0cfdce4202a96a5fead85d8d3195b7b7dd255c9bb2ddb0d864952b7

Download Submit
C:\Windows\system\JQiahPy.exe

Filesize
1.9MB

MD5
b35fc24729882bc4c390820e1eb890d3

SHA1
b1e2e1e2001d016f5b7b376d291ca07baee47114

SHA256
9e5a171980c71d73c6493237e74da6e7d8c11f245ca672ca49367cc18756f4d7

SHA512
f4410d322ec456d5bec82e07c2b32caa773cb43b4307b1c64835aaee58af5012cf37b761501792b1bafc6f5226e86ea507a7570fea786fda515ff9e05e75d967

Download Submit
C:\Windows\system\KEqoQMB.exe

Filesize
1.9MB

MD5
1c20d7968fcc0672324b585c8ae7b24c

SHA1
aabc4118e45a7a8d3a943ec15db076407901025b

SHA256
fa3fa3bbf33f4c898e1d26d6b4cf436fd946cabe317139fb2db1e7eff952588a

SHA512
2d30176db2626d0e4ca53eec6a362fc2c462ea27dd55b27b371d6a6ab3bde1912a45d00e7c96bcda5f1793469d17bbd3e788f2171ffb4f3bff3f972f524f93ff

Download Submit
C:\Windows\system\LUVlMWr.exe

Filesize
1.9MB

MD5
580b3f92a28246a6d9e864da469f7ce3

SHA1
908d52d5c3557a9cafa67a4e9d623769155d0650

SHA256
9fff61b5d8ebc0ea04307be8317999aee290cab5e9e9129865883a3c0959e50d

SHA512
f287249f25e395aa05fe5392602573123465b89863c2af5673411af08d3acd46dfc4ef002d510fa7ca620d9c7390516ca8fb856dd1adba873bdb69ffd4df1b45

Download Submit
C:\Windows\system\LxCIhhr.exe

Filesize
1.9MB

MD5
24db79ba9182cfbf6f81c2720af3f7cd

SHA1
ed443d42db26f0239b6aa90c5f1307be532669e0

SHA256
e7e0682375a9b021ec708d50cc9f434bd05b9eeca7a29a77a4951f62c5274bda

SHA512
5e954ecd13d97f259d78f75478837ec12e7a3e7de3348a010a84b41832590e71cd058aeaf15549a5c1bd8eecdfbbe4bfd0b9e20edfb0af5d30f306c70061c0fb

Download Submit
C:\Windows\system\MZkpdpL.exe

Filesize
1.9MB

MD5
d4863d264298ea7cee41406de57942e1

SHA1
5f00a8e2968643e793ce483a7d9266768bce561a

SHA256
684905a32be78e9b98294c0363cea08903007534800ad188af327a33e6408813

SHA512
48e285060ce441d71f1822fbe3df382249c3d2ae6f766a932fb979295d9deea82c8a187b8b573831d171ff13b9fd8c360e495c18b7efddfcd2f000a3abc96d0f

Download Submit
C:\Windows\system\OOszyDb.exe

Filesize
1.9MB

MD5
f4548d6313ef9040cbfb521e21df3f9c

SHA1
08961b6f651000b8905420589b644d24c78a6dc2

SHA256
ea8c7454e5de5cd82948987d31c330b941bae94a83e4c17e518996b38a4a6ed0

SHA512
1826439e187a986f70058509f0fed9562f55fb771e023b8951887c8d8a2b10fab21894dfba8a0d8f011494e4065fe6ac600666e92769e7d70a76a4c28186f4c3

Download Submit
C:\Windows\system\SsDVWrm.exe

Filesize
1.9MB

MD5
6c8d975936b1c63af3e0b14955a6b4e5

SHA1
95d8f9f3bec758d265484221d397d7299fb2f5c5

SHA256
9896bf6fc76cdf5efe7134b701d452b0df9ea6aedac6ae30dbe2e9e88dcf3e71

SHA512
d400420c897427317ac018d9bc3aa53795f84378ed24e5a68ccea195c47db81cf95c62ceb5e5b01392f1a30e789644e829403c1462a2e3390319f29a1f8f841d

Download Submit
C:\Windows\system\XUGEiTp.exe

Filesize
1.9MB

MD5
cd6dd0f5c8b8f0081cd1b557e9a354c5

SHA1
55e9eee9fba32fda9b3e20174bb0cd8c6b13762d

SHA256
91610eba0826ef99fcec3659233c58bd9bd71600e6bc626135e161b7d3b19baa

SHA512
d3467881e63d46465ddb6f34d1387223bfcde9534e57c2717646eee639c7c604847957fde19f7da00f1b98ac7fc4f994e6ce1f311fdec3e4f4f98138bc9ede13

Download Submit
C:\Windows\system\YyKHONR.exe

Filesize
1.9MB

MD5
82e216bc32457ed714615d6586daae98

SHA1
8223464d22b5a3f61e9c3acc820ff7bb2505d54c

SHA256
4f6209879748f8efc33b95e35190dee11f3d51b5e56cfec2ed0867d9280dc959

SHA512
68de06e49c4417a2a7935696e70f2b764fc47127f78b68621dd10595d9103afbe59cc7d50c172dfbb2b301d6186d638912b4a3e581ff2f17648f093ba09603fe

Download Submit
C:\Windows\system\dEJknDe.exe

Filesize
1.9MB

MD5
b0bb5b1ae48d5de1920cb92e2c153ecd

SHA1
bea6f70564dac11285ed7ab72c85bac54add5268

SHA256
fff549a3c17db62c361e47afcd5db096dba0a7779a25a563c09455b45c84fedf

SHA512
75d3b57b8b2060ec6411a68f28a81c2d2366d375b9d2d769799ca825fa6a5cc2490b5f326f862f3e22aece93f9e6d7937b4541c234b7064b892e034378ff5b21

Download Submit
C:\Windows\system\dOePsKf.exe

Filesize
1.9MB

MD5
10af24e11eca0317cc828d7bd6fa1b60

SHA1
ff663b9f03b32967283592ab6c1b27baf6b49990

SHA256
3b8266e472bef13f5088de14d02ad38cdb843539a0ff29a6b711e7be40cca344

SHA512
762126aaefc3fb7cd0af31330cc72e64282962aa2111857e3678e8976d004b5fb9efe48c712555db86b461b18bbef34a97fad83f7b6662877cb44abdd809ca87

Download Submit
C:\Windows\system\dvSxUCM.exe

Filesize
1.9MB

MD5
e4f1e6c5cd2fbb79a2c9776ba130548b

SHA1
49af4c173f04a5df665d72a7dc3f0588ca9f9b4a

SHA256
71d1efb3331d13c1722ab367cf163c42b382e4106a9d51f9c665bd3dd1365a73

SHA512
df6383d1bbbaca9b8a45e144573e032d48284835887eee3ce0109cb7e763ae965d17bc913ff0faa3e9800c5e080effb64dfa59c2cf119cad2da65679877503a7

Download Submit
C:\Windows\system\dyYOqPy.exe

Filesize
1.9MB

MD5
b6084a284e33139f0a1830e9b100b2bd

SHA1
e8ba2dd512e3fbdf0ab86762042b4941ffe6f9ab

SHA256
be8765f009772d3c732727f8e026ae7e76d6d55a1dda88c53e0f3f3f1d6e84e9

SHA512
45c364c9a9ad39717799720ad48b3d51535792ad6da38f20c72248753f76007e1186dcdf42c7afb83da697da2ae2b2e4e0f4ae12e79002f15b6e8f0786d24539

Download Submit
C:\Windows\system\gVpoNew.exe

Filesize
1.9MB

MD5
2fcec2b8528be5b6ef73476098a547df

SHA1
935ec46efdddf92939eb33c6389dba0b1db480b2

SHA256
f6e4a45120e3fe6ad471657158bef3f572807c67bee501169a3145b14f4b5505

SHA512
6b266f3a831524715c26b4b145cbe476b4fc96de783fb66f561114d0f68fd017d8e159e2a0f809792cd975773267baf03febdd1520c9487e7d3511c2aba26c14

Download Submit
C:\Windows\system\jgcvXwv.exe

Filesize
1.9MB

MD5
2d0a7cf453ea226f3f5ad12c06f4308b

SHA1
f3766f25106edb2e74d4f06d326b75f2d110f911

SHA256
79e74be28b78e0bf9c762518ed4f5a3c710fb40de93a10c68dc6f0701eb81a16

SHA512
533c6664ad61e3b98af2ee39479eb8045f07dd7b7ccbf79f680ed098a921004ac33358927b4990e43995ddd782c975f87240ac5f6584c22215c27cf81ff941c6

Download Submit
C:\Windows\system\peqEVSd.exe

Filesize
1.9MB

MD5
6e4b5c9df5057244b1122a9aab7a55b4

SHA1
91e6dfb8e33760c8814b4f4badbf35fbef181a76

SHA256
5cdeb8dc90e0597bed50970cd0446743be6f5e7fbfd26320acd56a338cd831e7

SHA512
0df5375ff224ba7b791e13418614b0da0cd23972887d756de781d4245b18b116567acfffe15a3b260d607a83379d566727b34fdab69cc91f27af0a9500366669

Download Submit
C:\Windows\system\qoPgJTa.exe

Filesize
1.9MB

MD5
51e447ceb9a1bdf09330532f003595d2

SHA1
7fba1b0a1a0d4b543089b00a02629e7353df7f40

SHA256
1f4b8e057274d7a224f311269e636cb58908bd29da7ac826e5ebf7303ecba02f

SHA512
1f2e2c058ece601984adde513ba83a2bcdc48d1cd77da95add6f7477394b65063901f5cd2341cd4e78497e81a53405ac05e73149a8e208a477121bdced7a51e2

Download Submit
C:\Windows\system\rQyNKCd.exe

Filesize
1.9MB

MD5
97cb305ca4248a2053ec0a857d008102

SHA1
f3ef30f20f76be533dc1cb6b682b1a03acf62bd6

SHA256
8bcd51994fbcc1d022d804582d49b7b8c082a674c0e6ea6f8a833584e839d375

SHA512
8688267b754252790d2e38e7bab6fc9df92efe66797761a0dba82dc9e8b66d7992c34a7980f8aa32f59a20a966214b157dd81d7431db4262da892691ecac8377

Download Submit
C:\Windows\system\uJZhJUj.exe

Filesize
1.9MB

MD5
503519a59a8a516cd64c902c3a1b67d1

SHA1
7e6b32b17b84ab8dd22289586ce7e27db4b4a07f

SHA256
40c2a59fd63ba26712fc4e03b6a37ab4013080838ee1a245fe4b79024bb4eeb3

SHA512
d60795b630546ce4c1460ac192346ed35ebfa45fa4d032d329d548d4d698105df8b9ecd8c4ff18a9fb3bac1b2f69adb9ccc8532b9984d921745c11f442d3f989

Download Submit
C:\Windows\system\umJpoBS.exe

Filesize
1.9MB

MD5
5500fdab8984eb10b07a6cf48072bddc

SHA1
6a91b4d0ba0e5ac5ccb18464c3f81882e56feff6

SHA256
ed9a0c10efc472a199db44df92b05df6205ef619530240186efb921cf4040e38

SHA512
4e4ec6a9aa80a38099063c27db8b8b61fd63cd100d6f77581e62b16070e8933d73d83d4704356b70474834386edceb99c9e8c5db3a0be200f6dcd7ee2362ea1b

Download Submit
C:\Windows\system\vydHIep.exe

Filesize
1.9MB

MD5
5bf9f861a224a79efcc2c9953d9ca32e

SHA1
d8b0a003c89d5f9d809dc3537c45ff69e94c6cee

SHA256
eb6010328ec3ce09be3b04613fd554bc8fe3e986f8d923a2bc24bfb8c48e34fd

SHA512
c0364040e60761d181e9cb85dbae6a5390d1a4df1d5163a947c23833c4f8857fd037b06c7cf765833da60cff5e15803149c7c48b5c455a7b8b37072c0978f79f

Download Submit
C:\Windows\system\wFQXEtY.exe

Filesize
1.9MB

MD5
526513e22dd00b056d36cef986aa5132

SHA1
1e2df49b7eea5bc557a1cfdd81b0fe20e61d3ed8

SHA256
410483ea4ad132bae7ea0601084b579b508e5b1f12e483a41ee7c149765683d7

SHA512
2e3b03b2bc3904fe9c9fa87382e7eae6d54786398a3ae4423ac6a1988a750752eec0fc7b1392ca79705c06d168fb97291386e4d5c5f51babfbb56be4053057ea

Download Submit
C:\Windows\system\xQQyLgz.exe

Filesize
1.9MB

MD5
fd14baefa1e11d5ff186862893c0460a

SHA1
dc7f02e9e0b77ee7047b8afc226d796e3d218b67

SHA256
8fca9fd6d7047c7df2986f5e4d987853aa25ae96735f3f9c2081dfbde03cebf6

SHA512
b54a1ce4625df2feb20c7e540e7d82ba43298fa30626a511f5ecc13e80e1cc9d8bc29a2bd85fcfc5b398911d12031dd55dd4be9e0153c10f4769e9c4d1e9c286

Download Submit
C:\Windows\system\xqQMmeE.exe

Filesize
1.9MB

MD5
f607634db26de63f8085b3352f18af70

SHA1
f30817a8b289148fc908336f4c879e0186544242

SHA256
0470b681da1968627af1d8f87ac0058ad6ed562fbd81fc2402b6ba681a82b9be

SHA512
e92e97f09df05c252f4c2936d177705a6db4aaf04cdb879b44d02a2171dec4ec3bcec5078515bdb347e01bb3fff2535b9a56e39aaa52f156860781b4fb13724c

Download Submit
C:\Windows\system\yrpzKFc.exe

Filesize
1.9MB

MD5
218bcbbafcafa99fd33c1aa04808d73b

SHA1
f63524e58d3114cce6a7f93d3f5744e611cd73df

SHA256
2677efe267b449a00d4573d86be4398b0d3ce6276a517384a4524be2aa6fc0a7

SHA512
3edd7f9329a5976dc9386691a31a48f94d1cc91361ba47167c3a0edce4c630aa6e454ed8f2f4cab436f8298a3e218b16e28fd88cfb5ca0447a5ea9ada3063b64

Download Submit
\Windows\system\lMnrFtI.exe

Filesize
1.9MB

MD5
115aa52dc6edaa8eec3ce6dfa5974885

SHA1
aef50c99499f8e261e2fd117c6fea92460ae9da6

SHA256
466e17ea54fecc82674597ab6018d13dc650dc8f35991ca53917bddda1f07ee0

SHA512
38ead353587b9235cdef1fccc6c5d8faf3cd0213a7ceeb429498e24c796e24047f562e1d2364a422e681c6753e0a7f1c0b67a0d764dacfa55e5bc3524e18c530

Download Submit
memory/552-2962-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/552-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/552-3191-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/552-2968-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-572-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-2979-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/552-556-0x000000013FB50000-0x000000013FEA4000-memory.dmp

Filesize
3.3MB

Download
memory/552-2972-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/552-537-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Filesize
3.3MB

Download
memory/552-2996-0x000000013FDF0000-0x0000000140144000-memory.dmp

Filesize
3.3MB

Download
memory/552-547-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-3003-0x000000013F040000-0x000000013F394000-memory.dmp

Filesize
3.3MB

Download
memory/552-564-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/552-3007-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-589-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-591-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/552-2993-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-593-0x000000013F210000-0x000000013F564000-memory.dmp

Filesize
3.3MB

Download
memory/552-2987-0x000000013F210000-0x000000013F564000-memory.dmp

Filesize
3.3MB

Download
memory/552-595-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-2974-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-0-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download
memory/552-584-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/552-2961-0x000000013FB50000-0x000000013FEA4000-memory.dmp

Filesize
3.3MB

Download
memory/552-601-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-602-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/552-599-0x000000013F040000-0x000000013F394000-memory.dmp

Filesize
3.3MB

Download
memory/552-597-0x000000013FDF0000-0x0000000140144000-memory.dmp

Filesize
3.3MB

Download
memory/552-2957-0x0000000001EB0000-0x0000000002204000-memory.dmp

Filesize
3.3MB

Download
memory/552-533-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/552-2701-0x000000013F6D0000-0x000000013FA24000-memory.dmp

Filesize
3.3MB

Download
memory/1516-536-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/1516-4020-0x000000013FC50000-0x000000013FFA4000-memory.dmp

Filesize
3.3MB

Download
memory/1912-4022-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Filesize
3.3MB

Download
memory/1912-542-0x000000013FBC0000-0x000000013FF14000-memory.dmp

Filesize
3.3MB

Download
memory/2424-4024-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2424-596-0x000000013F890000-0x000000013FBE4000-memory.dmp

Filesize
3.3MB

Download
memory/2472-594-0x000000013F210000-0x000000013F564000-memory.dmp

Filesize
3.3MB

Download
memory/2472-4031-0x000000013F210000-0x000000013F564000-memory.dmp

Filesize
3.3MB

Download
memory/2480-4029-0x000000013FDF0000-0x0000000140144000-memory.dmp

Filesize
3.3MB

Download
memory/2480-598-0x000000013FDF0000-0x0000000140144000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4026-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2548-576-0x000000013F940000-0x000000013FC94000-memory.dmp

Filesize
3.3MB

Download
memory/2628-560-0x000000013FB50000-0x000000013FEA4000-memory.dmp

Filesize
3.3MB

Download
memory/2628-4021-0x000000013FB50000-0x000000013FEA4000-memory.dmp

Filesize
3.3MB

Download
memory/2652-4027-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2652-569-0x000000013FD30000-0x0000000140084000-memory.dmp

Filesize
3.3MB

Download
memory/2684-590-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2684-4023-0x000000013F380000-0x000000013F6D4000-memory.dmp

Filesize
3.3MB

Download
memory/2740-592-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2740-4030-0x000000013FA60000-0x000000013FDB4000-memory.dmp

Filesize
3.3MB

Download
memory/2792-588-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2792-4028-0x000000013F1A0000-0x000000013F4F4000-memory.dmp

Filesize
3.3MB

Download
memory/2904-4025-0x000000013F040000-0x000000013F394000-memory.dmp

Filesize
3.3MB

Download
memory/2904-600-0x000000013F040000-0x000000013F394000-memory.dmp

Filesize
3.3MB

Download
memory/2996-545-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/2996-4032-0x000000013FF30000-0x0000000140284000-memory.dmp

Filesize
3.3MB

Download
memory/3020-552-0x000000013F580000-0x000000013F8D4000-memory.dmp

Filesize
3.3MB

Download