xmrig | 98a8665dde812c68f5f66a05106bdd551e858856b1d65c27c5652500f01d0e1b

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
Size

1.4MB
MD5

ebe216c23c110aac77cfeeea1e196f60
SHA1

1f5579de6084cdc0c7d3d85711361ef4cdf39ba7
SHA256

98a8665dde812c68f5f66a05106bdd551e858856b1d65c27c5652500f01d0e1b
SHA512

32cfb9308a28073c1ea3d4121e7bb226d8442d558385c623bcc98e3b17981ac8e43bbbc2e159355ddae2757a1c7a051091491fd9ede45450766ec7c98c1edfe6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKQEFfG07:Lz071uv4BPMkFfdk2awGc

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2364-9-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2336-399-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2008-87-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2000-85-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/1760-83-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/1972-81-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/1320-79-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2364-1733-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2000-1753-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/1972-1751-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/1320-1763-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/1760-1765-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/596-2243-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/548-2216-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2336-2660-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/1736-2805-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2404-2804-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/776-2696-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2008-2685-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/564-2658-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2344	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2364	uoKMKuS.exe
1320	eSxboyB.exe
1972	gyJRCBO.exe
1760	uXEzHgI.exe
2000	uEVdUKK.exe
2008	ZpIJfFA.exe
596	AYTXRyU.exe
776	DVkSRWa.exe
548	FZsgGtY.exe
1736	RRRvmvf.exe
564	lZcwadC.exe
2404	SmLLbcR.exe
1100	mRryLLS.exe
364	ORvdwps.exe
2772	QDslbhU.exe
2532	XvDVtYK.exe
2632	jZdvrKZ.exe
2836	QnDxLuD.exe
2648	cUkNQbI.exe
2652	KjsSMFr.exe
2860	xWKDejC.exe
2620	weNtjiH.exe
2520	SMgeKBw.exe
1804	QvFyDrp.exe
2920	CzkHbjP.exe
2924	TEiJgtT.exe
2908	CdxmZFz.exe
3048	DCBdkEk.exe
3016	aZEpbYR.exe
2104	fNNhQpI.exe
2980	dUveXuR.exe
2100	oAMQQfw.exe
984	IkKnLXa.exe
980	mFLeEPw.exe
908	nQCOvNv.exe
1688	gfZIADP.exe
2764	qlSeeAI.exe
2820	YEeFSCf.exe
1456	WlTaUsW.exe
1556	XZrdRMR.exe
2712	vkYFWyL.exe
896	nLSgZxU.exe
632	uuiCmuh.exe
1432	jMrCiVk.exe
2796	vKKQKGD.exe
2060	JswUqmd.exe
1660	pwCcjBI.exe
2068	ZrrqxkH.exe
2812	UAwdIDH.exe
1728	olOMorU.exe
1784	MptYfUc.exe
2296	cqFWHtl.exe
692	xcMzuut.exe
2052	yLSETWA.exe
2288	EaNOtqF.exe
2116	kqjGwoF.exe
1768	tBVPWnr.exe
2316	olwcHnn.exe
2232	CNPdUee.exe
2268	GLbEuFI.exe
2576	vANooLA.exe
772	SCmWbcA.exe
988	FUQjUle.exe
1584	SZOrVnu.exe

Loads dropped DLL 64 IoCs

pid	Process
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x0009000000016d24-3.dat	upx
behavioral1/memory/2364-9-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0007000000016d84-18.dat	upx
behavioral1/files/0x000f0000000006fd-22.dat	upx
behavioral1/files/0x00030000000180e5-23.dat	upx
behavioral1/files/0x000500000001868c-29.dat	upx
behavioral1/files/0x0005000000018698-38.dat	upx
behavioral1/files/0x0007000000016d89-45.dat	upx
behavioral1/files/0x0006000000018ae2-49.dat	upx
behavioral1/files/0x0006000000018ae8-53.dat	upx
behavioral1/files/0x0006000000018b37-65.dat	upx
behavioral1/memory/2404-97-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/files/0x0005000000019377-141.dat	upx
behavioral1/files/0x0005000000019410-153.dat	upx
behavioral1/files/0x000500000001946f-161.dat	upx
behavioral1/files/0x0005000000019473-165.dat	upx
behavioral1/memory/2336-399-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x000500000001946b-157.dat	upx
behavioral1/files/0x00050000000193b0-149.dat	upx
behavioral1/files/0x000500000001939b-145.dat	upx
behavioral1/files/0x0005000000019368-137.dat	upx
behavioral1/files/0x0005000000019333-133.dat	upx
behavioral1/files/0x000500000001931b-129.dat	upx
behavioral1/files/0x00050000000192f4-125.dat	upx
behavioral1/files/0x00050000000192c9-121.dat	upx
behavioral1/files/0x0006000000018d06-117.dat	upx
behavioral1/files/0x0006000000018ba2-113.dat	upx
behavioral1/files/0x0006000000018b96-109.dat	upx
behavioral1/files/0x0006000000018b73-105.dat	upx
behavioral1/files/0x0006000000018b6a-102.dat	upx
behavioral1/memory/564-95-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/1736-94-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/548-92-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/776-91-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/596-89-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2008-87-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2000-85-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/1760-83-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/1972-81-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/1320-79-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0006000000018b4a-74.dat	upx
behavioral1/files/0x0006000000018b42-69.dat	upx
behavioral1/files/0x0006000000018b33-61.dat	upx
behavioral1/files/0x0006000000018b15-57.dat	upx
behavioral1/files/0x00050000000186a0-42.dat	upx
behavioral1/memory/2364-1733-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2000-1753-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/1972-1751-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/1320-1763-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/1760-1765-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/596-2243-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/548-2216-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2336-2660-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/1736-2805-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2404-2804-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/memory/776-2696-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/2008-2685-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/564-2658-0x000000013F130000-0x000000013F522000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uoKMKuS.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\hczmvmp.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\LimrxWK.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\PSMAwsr.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\gNeCmnZ.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\ZjsLUlM.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\KuTjOJM.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\HOALIdb.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\mXzMtoc.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\TZlDJka.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\CVIZZwx.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\oibjfoz.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\WqrtKen.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\ONNhyGc.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\EcQmnFj.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\uvEbDIP.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\IVMLYBb.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\XfOaaKO.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\vLwffUB.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\LbsUwQB.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\cHyahbU.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\JvNrgWg.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\cRjMaAj.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\EDRENQe.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\HIcgyrb.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\gmyWLhD.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\BofXnFy.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\molxQIO.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\jzbPruW.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\zMMeXCh.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\DAaxDIq.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\YYVYxlF.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\sYPYiJj.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\iJlvYyh.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\UhuCaea.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\cTOnYit.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\StVFQUA.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\WgpFHkI.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\QVXbohx.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\YStYIGU.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\VmFBPji.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\QpmDldI.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\KFophaB.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\OaQnKKD.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\aevqnjL.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\LoUmZDO.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\aimmbBx.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\ALaERwj.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\TAaTkdp.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\uUBtoYT.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\taNrwUA.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\urcxOBX.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\wfceuyA.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\ACbnxGB.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\zODuffB.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\wggvayX.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\dWNVzkR.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\lCVNcMb.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\eVhICrK.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\MUhWCTG.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\yuvVGjL.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\JyuSjKr.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\onXTFim.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
File created	C:\Windows\System\eNhCwVT.exe	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2344	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
Token: SeDebugPrivilege	2344	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2344	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	31
PID 2336 wrote to memory of 2344	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	31
PID 2336 wrote to memory of 2344	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	31
PID 2336 wrote to memory of 2364	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	32
PID 2336 wrote to memory of 2364	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	32
PID 2336 wrote to memory of 2364	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	32
PID 2336 wrote to memory of 1320	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	33
PID 2336 wrote to memory of 1320	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	33
PID 2336 wrote to memory of 1320	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	33
PID 2336 wrote to memory of 1972	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	34
PID 2336 wrote to memory of 1972	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	34
PID 2336 wrote to memory of 1972	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	34
PID 2336 wrote to memory of 1760	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	35
PID 2336 wrote to memory of 1760	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	35
PID 2336 wrote to memory of 1760	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	35
PID 2336 wrote to memory of 2000	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	36
PID 2336 wrote to memory of 2000	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	36
PID 2336 wrote to memory of 2000	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	36
PID 2336 wrote to memory of 2008	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	37
PID 2336 wrote to memory of 2008	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	37
PID 2336 wrote to memory of 2008	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	37
PID 2336 wrote to memory of 596	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	38
PID 2336 wrote to memory of 596	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	38
PID 2336 wrote to memory of 596	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	38
PID 2336 wrote to memory of 776	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	39
PID 2336 wrote to memory of 776	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	39
PID 2336 wrote to memory of 776	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	39
PID 2336 wrote to memory of 548	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	40
PID 2336 wrote to memory of 548	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	40
PID 2336 wrote to memory of 548	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	40
PID 2336 wrote to memory of 1736	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	41
PID 2336 wrote to memory of 1736	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	41
PID 2336 wrote to memory of 1736	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	41
PID 2336 wrote to memory of 564	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	42
PID 2336 wrote to memory of 564	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	42
PID 2336 wrote to memory of 564	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	42
PID 2336 wrote to memory of 2404	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	43
PID 2336 wrote to memory of 2404	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	43
PID 2336 wrote to memory of 2404	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	43
PID 2336 wrote to memory of 1100	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	44
PID 2336 wrote to memory of 1100	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	44
PID 2336 wrote to memory of 1100	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	44
PID 2336 wrote to memory of 364	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	45
PID 2336 wrote to memory of 364	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	45
PID 2336 wrote to memory of 364	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	45
PID 2336 wrote to memory of 2772	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	46
PID 2336 wrote to memory of 2772	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	46
PID 2336 wrote to memory of 2772	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	46
PID 2336 wrote to memory of 2532	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	47
PID 2336 wrote to memory of 2532	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	47
PID 2336 wrote to memory of 2532	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	47
PID 2336 wrote to memory of 2632	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	48
PID 2336 wrote to memory of 2632	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	48
PID 2336 wrote to memory of 2632	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	48
PID 2336 wrote to memory of 2836	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	49
PID 2336 wrote to memory of 2836	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	49
PID 2336 wrote to memory of 2836	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	49
PID 2336 wrote to memory of 2648	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	50
PID 2336 wrote to memory of 2648	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	50
PID 2336 wrote to memory of 2648	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	50
PID 2336 wrote to memory of 2652	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	51
PID 2336 wrote to memory of 2652	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	51
PID 2336 wrote to memory of 2652	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	51
PID 2336 wrote to memory of 2860	2336	ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe	52

C:\Users\Admin\AppData\Local\Temp\ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ebe216c23c110aac77cfeeea1e196f60_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\System\uoKMKuS.exe
  C:\Windows\System\uoKMKuS.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\eSxboyB.exe
  C:\Windows\System\eSxboyB.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\gyJRCBO.exe
  C:\Windows\System\gyJRCBO.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\uXEzHgI.exe
  C:\Windows\System\uXEzHgI.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\uEVdUKK.exe
  C:\Windows\System\uEVdUKK.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ZpIJfFA.exe
  C:\Windows\System\ZpIJfFA.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\AYTXRyU.exe
  C:\Windows\System\AYTXRyU.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\DVkSRWa.exe
  C:\Windows\System\DVkSRWa.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\FZsgGtY.exe
  C:\Windows\System\FZsgGtY.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\RRRvmvf.exe
  C:\Windows\System\RRRvmvf.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\lZcwadC.exe
  C:\Windows\System\lZcwadC.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\SmLLbcR.exe
  C:\Windows\System\SmLLbcR.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\mRryLLS.exe
  C:\Windows\System\mRryLLS.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\ORvdwps.exe
  C:\Windows\System\ORvdwps.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\QDslbhU.exe
  C:\Windows\System\QDslbhU.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\XvDVtYK.exe
  C:\Windows\System\XvDVtYK.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\jZdvrKZ.exe
  C:\Windows\System\jZdvrKZ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\QnDxLuD.exe
  C:\Windows\System\QnDxLuD.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\cUkNQbI.exe
  C:\Windows\System\cUkNQbI.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\KjsSMFr.exe
  C:\Windows\System\KjsSMFr.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\xWKDejC.exe
  C:\Windows\System\xWKDejC.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\weNtjiH.exe
  C:\Windows\System\weNtjiH.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\SMgeKBw.exe
  C:\Windows\System\SMgeKBw.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\QvFyDrp.exe
  C:\Windows\System\QvFyDrp.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\CzkHbjP.exe
  C:\Windows\System\CzkHbjP.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\TEiJgtT.exe
  C:\Windows\System\TEiJgtT.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\CdxmZFz.exe
  C:\Windows\System\CdxmZFz.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\DCBdkEk.exe
  C:\Windows\System\DCBdkEk.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\aZEpbYR.exe
  C:\Windows\System\aZEpbYR.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\fNNhQpI.exe
  C:\Windows\System\fNNhQpI.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\dUveXuR.exe
  C:\Windows\System\dUveXuR.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\oAMQQfw.exe
  C:\Windows\System\oAMQQfw.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\IkKnLXa.exe
  C:\Windows\System\IkKnLXa.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\mFLeEPw.exe
  C:\Windows\System\mFLeEPw.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\nQCOvNv.exe
  C:\Windows\System\nQCOvNv.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\gfZIADP.exe
  C:\Windows\System\gfZIADP.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\qlSeeAI.exe
  C:\Windows\System\qlSeeAI.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\YEeFSCf.exe
  C:\Windows\System\YEeFSCf.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\WlTaUsW.exe
  C:\Windows\System\WlTaUsW.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\XZrdRMR.exe
  C:\Windows\System\XZrdRMR.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\vkYFWyL.exe
  C:\Windows\System\vkYFWyL.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\nLSgZxU.exe
  C:\Windows\System\nLSgZxU.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\uuiCmuh.exe
  C:\Windows\System\uuiCmuh.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\jMrCiVk.exe
  C:\Windows\System\jMrCiVk.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\vKKQKGD.exe
  C:\Windows\System\vKKQKGD.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\JswUqmd.exe
  C:\Windows\System\JswUqmd.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\pwCcjBI.exe
  C:\Windows\System\pwCcjBI.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ZrrqxkH.exe
  C:\Windows\System\ZrrqxkH.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\UAwdIDH.exe
  C:\Windows\System\UAwdIDH.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\olOMorU.exe
  C:\Windows\System\olOMorU.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\MptYfUc.exe
  C:\Windows\System\MptYfUc.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\cqFWHtl.exe
  C:\Windows\System\cqFWHtl.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\xcMzuut.exe
  C:\Windows\System\xcMzuut.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\yLSETWA.exe
  C:\Windows\System\yLSETWA.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\EaNOtqF.exe
  C:\Windows\System\EaNOtqF.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\kqjGwoF.exe
  C:\Windows\System\kqjGwoF.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\tBVPWnr.exe
  C:\Windows\System\tBVPWnr.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\olwcHnn.exe
  C:\Windows\System\olwcHnn.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\CNPdUee.exe
  C:\Windows\System\CNPdUee.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\GLbEuFI.exe
  C:\Windows\System\GLbEuFI.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\vANooLA.exe
  C:\Windows\System\vANooLA.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\SCmWbcA.exe
  C:\Windows\System\SCmWbcA.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\FUQjUle.exe
  C:\Windows\System\FUQjUle.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\SZOrVnu.exe
  C:\Windows\System\SZOrVnu.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\YTZUWcs.exe
  C:\Windows\System\YTZUWcs.exe
  2⤵
  PID:1588
- C:\Windows\System\eLmXAco.exe
  C:\Windows\System\eLmXAco.exe
  2⤵
  PID:2332
- C:\Windows\System\QJpygpx.exe
  C:\Windows\System\QJpygpx.exe
  2⤵
  PID:1608
- C:\Windows\System\yOUyHVo.exe
  C:\Windows\System\yOUyHVo.exe
  2⤵
  PID:1980
- C:\Windows\System\DFvtjtR.exe
  C:\Windows\System\DFvtjtR.exe
  2⤵
  PID:1048
- C:\Windows\System\vtsnYXf.exe
  C:\Windows\System\vtsnYXf.exe
  2⤵
  PID:944
- C:\Windows\System\OfSeTJF.exe
  C:\Windows\System\OfSeTJF.exe
  2⤵
  PID:2032
- C:\Windows\System\eWSRPUN.exe
  C:\Windows\System\eWSRPUN.exe
  2⤵
  PID:572
- C:\Windows\System\hmMENDR.exe
  C:\Windows\System\hmMENDR.exe
  2⤵
  PID:464
- C:\Windows\System\IlldOfl.exe
  C:\Windows\System\IlldOfl.exe
  2⤵
  PID:1388
- C:\Windows\System\coUdEeT.exe
  C:\Windows\System\coUdEeT.exe
  2⤵
  PID:2408
- C:\Windows\System\ahGXJBr.exe
  C:\Windows\System\ahGXJBr.exe
  2⤵
  PID:1844
- C:\Windows\System\ZxKNWaF.exe
  C:\Windows\System\ZxKNWaF.exe
  2⤵
  PID:1964
- C:\Windows\System\VrWqfcV.exe
  C:\Windows\System\VrWqfcV.exe
  2⤵
  PID:2560
- C:\Windows\System\fWmjyeH.exe
  C:\Windows\System\fWmjyeH.exe
  2⤵
  PID:2640
- C:\Windows\System\KUVyWgc.exe
  C:\Windows\System\KUVyWgc.exe
  2⤵
  PID:2852
- C:\Windows\System\qEVatJl.exe
  C:\Windows\System\qEVatJl.exe
  2⤵
  PID:2436
- C:\Windows\System\fJicUxc.exe
  C:\Windows\System\fJicUxc.exe
  2⤵
  PID:2940
- C:\Windows\System\AZSfxSz.exe
  C:\Windows\System\AZSfxSz.exe
  2⤵
  PID:2912
- C:\Windows\System\gbaaFRf.exe
  C:\Windows\System\gbaaFRf.exe
  2⤵
  PID:3020
- C:\Windows\System\HLGmqSt.exe
  C:\Windows\System\HLGmqSt.exe
  2⤵
  PID:1160
- C:\Windows\System\FClGfsV.exe
  C:\Windows\System\FClGfsV.exe
  2⤵
  PID:2984
- C:\Windows\System\SQdFTvJ.exe
  C:\Windows\System\SQdFTvJ.exe
  2⤵
  PID:1404
- C:\Windows\System\FVaJyVl.exe
  C:\Windows\System\FVaJyVl.exe
  2⤵
  PID:2600
- C:\Windows\System\fWYgaiP.exe
  C:\Windows\System\fWYgaiP.exe
  2⤵
  PID:2608
- C:\Windows\System\mFaoaMj.exe
  C:\Windows\System\mFaoaMj.exe
  2⤵
  PID:2492
- C:\Windows\System\khAIRAn.exe
  C:\Windows\System\khAIRAn.exe
  2⤵
  PID:1044
- C:\Windows\System\xtqhCPi.exe
  C:\Windows\System\xtqhCPi.exe
  2⤵
  PID:784
- C:\Windows\System\bhPYDAW.exe
  C:\Windows\System\bhPYDAW.exe
  2⤵
  PID:2568
- C:\Windows\System\XERHTCd.exe
  C:\Windows\System\XERHTCd.exe
  2⤵
  PID:1880
- C:\Windows\System\DjNTxLG.exe
  C:\Windows\System\DjNTxLG.exe
  2⤵
  PID:2440
- C:\Windows\System\JQRoRTj.exe
  C:\Windows\System\JQRoRTj.exe
  2⤵
  PID:1056
- C:\Windows\System\gRQXqUj.exe
  C:\Windows\System\gRQXqUj.exe
  2⤵
  PID:960
- C:\Windows\System\VdrnkME.exe
  C:\Windows\System\VdrnkME.exe
  2⤵
  PID:2488
- C:\Windows\System\mmWMVRg.exe
  C:\Windows\System\mmWMVRg.exe
  2⤵
  PID:2844
- C:\Windows\System\OgHefba.exe
  C:\Windows\System\OgHefba.exe
  2⤵
  PID:2064
- C:\Windows\System\UrVOANS.exe
  C:\Windows\System\UrVOANS.exe
  2⤵
  PID:2112
- C:\Windows\System\EdtbXPC.exe
  C:\Windows\System\EdtbXPC.exe
  2⤵
  PID:2272
- C:\Windows\System\IXfPjtR.exe
  C:\Windows\System\IXfPjtR.exe
  2⤵
  PID:1764
- C:\Windows\System\EVZtIVE.exe
  C:\Windows\System\EVZtIVE.exe
  2⤵
  PID:2124
- C:\Windows\System\DVwzeoa.exe
  C:\Windows\System\DVwzeoa.exe
  2⤵
  PID:2092
- C:\Windows\System\DQviEjg.exe
  C:\Windows\System\DQviEjg.exe
  2⤵
  PID:1776
- C:\Windows\System\iGyWldp.exe
  C:\Windows\System\iGyWldp.exe
  2⤵
  PID:1684
- C:\Windows\System\EjnNlQI.exe
  C:\Windows\System\EjnNlQI.exe
  2⤵
  PID:1668
- C:\Windows\System\wFhtdlA.exe
  C:\Windows\System\wFhtdlA.exe
  2⤵
  PID:2152
- C:\Windows\System\wNvEGWE.exe
  C:\Windows\System\wNvEGWE.exe
  2⤵
  PID:2012
- C:\Windows\System\daqapgS.exe
  C:\Windows\System\daqapgS.exe
  2⤵
  PID:592
- C:\Windows\System\hwfWISE.exe
  C:\Windows\System\hwfWISE.exe
  2⤵
  PID:1520
- C:\Windows\System\cRjMaAj.exe
  C:\Windows\System\cRjMaAj.exe
  2⤵
  PID:1848
- C:\Windows\System\lGtlWhG.exe
  C:\Windows\System\lGtlWhG.exe
  2⤵
  PID:2856
- C:\Windows\System\gtKbJus.exe
  C:\Windows\System\gtKbJus.exe
  2⤵
  PID:2692
- C:\Windows\System\kFtaKrJ.exe
  C:\Windows\System\kFtaKrJ.exe
  2⤵
  PID:2904
- C:\Windows\System\YROFvXy.exe
  C:\Windows\System\YROFvXy.exe
  2⤵
  PID:1384
- C:\Windows\System\WlxNunt.exe
  C:\Windows\System\WlxNunt.exe
  2⤵
  PID:2020
- C:\Windows\System\gyyQQoE.exe
  C:\Windows\System\gyyQQoE.exe
  2⤵
  PID:3052
- C:\Windows\System\cXrSAbi.exe
  C:\Windows\System\cXrSAbi.exe
  2⤵
  PID:2896
- C:\Windows\System\vsaqWXJ.exe
  C:\Windows\System\vsaqWXJ.exe
  2⤵
  PID:1016
- C:\Windows\System\MENKczS.exe
  C:\Windows\System\MENKczS.exe
  2⤵
  PID:2960
- C:\Windows\System\tOHCuHR.exe
  C:\Windows\System\tOHCuHR.exe
  2⤵
  PID:1576
- C:\Windows\System\InASFNP.exe
  C:\Windows\System\InASFNP.exe
  2⤵
  PID:1744
- C:\Windows\System\ykzkDfW.exe
  C:\Windows\System\ykzkDfW.exe
  2⤵
  PID:2160
- C:\Windows\System\iofxrOD.exe
  C:\Windows\System\iofxrOD.exe
  2⤵
  PID:1032
- C:\Windows\System\ZlUEABz.exe
  C:\Windows\System\ZlUEABz.exe
  2⤵
  PID:1888
- C:\Windows\System\UdNewRU.exe
  C:\Windows\System\UdNewRU.exe
  2⤵
  PID:2108
- C:\Windows\System\fOmVcUw.exe
  C:\Windows\System\fOmVcUw.exe
  2⤵
  PID:1748
- C:\Windows\System\ZiKtEZR.exe
  C:\Windows\System\ZiKtEZR.exe
  2⤵
  PID:2284
- C:\Windows\System\mJJdmlO.exe
  C:\Windows\System\mJJdmlO.exe
  2⤵
  PID:1568
- C:\Windows\System\OcZxFAq.exe
  C:\Windows\System\OcZxFAq.exe
  2⤵
  PID:1276
- C:\Windows\System\xDogTIN.exe
  C:\Windows\System\xDogTIN.exe
  2⤵
  PID:1168
- C:\Windows\System\BttZvCe.exe
  C:\Windows\System\BttZvCe.exe
  2⤵
  PID:2456
- C:\Windows\System\BynuYPW.exe
  C:\Windows\System\BynuYPW.exe
  2⤵
  PID:2624
- C:\Windows\System\iibbyNd.exe
  C:\Windows\System\iibbyNd.exe
  2⤵
  PID:3036
- C:\Windows\System\JYsWOhN.exe
  C:\Windows\System\JYsWOhN.exe
  2⤵
  PID:1512
- C:\Windows\System\xnAGycA.exe
  C:\Windows\System\xnAGycA.exe
  2⤵
  PID:2816
- C:\Windows\System\UFStiTW.exe
  C:\Windows\System\UFStiTW.exe
  2⤵
  PID:2592
- C:\Windows\System\fHCAOFd.exe
  C:\Windows\System\fHCAOFd.exe
  2⤵
  PID:1472
- C:\Windows\System\VPBLssC.exe
  C:\Windows\System\VPBLssC.exe
  2⤵
  PID:1268
- C:\Windows\System\HEJcMxq.exe
  C:\Windows\System\HEJcMxq.exe
  2⤵
  PID:1840
- C:\Windows\System\JCodgYd.exe
  C:\Windows\System\JCodgYd.exe
  2⤵
  PID:2128
- C:\Windows\System\PWHymQU.exe
  C:\Windows\System\PWHymQU.exe
  2⤵
  PID:1412
- C:\Windows\System\QvyOiRE.exe
  C:\Windows\System\QvyOiRE.exe
  2⤵
  PID:2660
- C:\Windows\System\kUMyZve.exe
  C:\Windows\System\kUMyZve.exe
  2⤵
  PID:1272
- C:\Windows\System\XbGYqdL.exe
  C:\Windows\System\XbGYqdL.exe
  2⤵
  PID:876
- C:\Windows\System\KzhOTPS.exe
  C:\Windows\System\KzhOTPS.exe
  2⤵
  PID:1628
- C:\Windows\System\XtFPChB.exe
  C:\Windows\System\XtFPChB.exe
  2⤵
  PID:3092
- C:\Windows\System\btqQhzi.exe
  C:\Windows\System\btqQhzi.exe
  2⤵
  PID:3108
- C:\Windows\System\lHLirFJ.exe
  C:\Windows\System\lHLirFJ.exe
  2⤵
  PID:3124
- C:\Windows\System\kViaOAW.exe
  C:\Windows\System\kViaOAW.exe
  2⤵
  PID:3140
- C:\Windows\System\ocahfar.exe
  C:\Windows\System\ocahfar.exe
  2⤵
  PID:3160
- C:\Windows\System\DcFuwiI.exe
  C:\Windows\System\DcFuwiI.exe
  2⤵
  PID:3180
- C:\Windows\System\ssOoRSo.exe
  C:\Windows\System\ssOoRSo.exe
  2⤵
  PID:3196
- C:\Windows\System\rxLPXUL.exe
  C:\Windows\System\rxLPXUL.exe
  2⤵
  PID:3212
- C:\Windows\System\RMwJivM.exe
  C:\Windows\System\RMwJivM.exe
  2⤵
  PID:3228
- C:\Windows\System\reyxYQB.exe
  C:\Windows\System\reyxYQB.exe
  2⤵
  PID:3244
- C:\Windows\System\mywgdWT.exe
  C:\Windows\System\mywgdWT.exe
  2⤵
  PID:3260
- C:\Windows\System\cRhmJrX.exe
  C:\Windows\System\cRhmJrX.exe
  2⤵
  PID:3276
- C:\Windows\System\lqXcwbX.exe
  C:\Windows\System\lqXcwbX.exe
  2⤵
  PID:3292
- C:\Windows\System\WeinMxV.exe
  C:\Windows\System\WeinMxV.exe
  2⤵
  PID:3308
- C:\Windows\System\TRFBzcR.exe
  C:\Windows\System\TRFBzcR.exe
  2⤵
  PID:3324
- C:\Windows\System\EcGCwlY.exe
  C:\Windows\System\EcGCwlY.exe
  2⤵
  PID:3340
- C:\Windows\System\TWQMCuY.exe
  C:\Windows\System\TWQMCuY.exe
  2⤵
  PID:3356
- C:\Windows\System\sbgOdQY.exe
  C:\Windows\System\sbgOdQY.exe
  2⤵
  PID:3372
- C:\Windows\System\PeZyZXD.exe
  C:\Windows\System\PeZyZXD.exe
  2⤵
  PID:3388
- C:\Windows\System\MACAmSc.exe
  C:\Windows\System\MACAmSc.exe
  2⤵
  PID:3404
- C:\Windows\System\weRvMvH.exe
  C:\Windows\System\weRvMvH.exe
  2⤵
  PID:3420
- C:\Windows\System\GKHCeVZ.exe
  C:\Windows\System\GKHCeVZ.exe
  2⤵
  PID:3436
- C:\Windows\System\rjWlprS.exe
  C:\Windows\System\rjWlprS.exe
  2⤵
  PID:3452
- C:\Windows\System\lNIMDYa.exe
  C:\Windows\System\lNIMDYa.exe
  2⤵
  PID:3468
- C:\Windows\System\rJvccQB.exe
  C:\Windows\System\rJvccQB.exe
  2⤵
  PID:3484
- C:\Windows\System\fycAloC.exe
  C:\Windows\System\fycAloC.exe
  2⤵
  PID:3500
- C:\Windows\System\urcxOBX.exe
  C:\Windows\System\urcxOBX.exe
  2⤵
  PID:3516
- C:\Windows\System\XvSZuky.exe
  C:\Windows\System\XvSZuky.exe
  2⤵
  PID:3532
- C:\Windows\System\xJWFewK.exe
  C:\Windows\System\xJWFewK.exe
  2⤵
  PID:3548
- C:\Windows\System\djDMrCc.exe
  C:\Windows\System\djDMrCc.exe
  2⤵
  PID:3564
- C:\Windows\System\VnaCeVg.exe
  C:\Windows\System\VnaCeVg.exe
  2⤵
  PID:3580
- C:\Windows\System\gnnKMPo.exe
  C:\Windows\System\gnnKMPo.exe
  2⤵
  PID:3600
- C:\Windows\System\dkWylEp.exe
  C:\Windows\System\dkWylEp.exe
  2⤵
  PID:3616
- C:\Windows\System\GiNLLBy.exe
  C:\Windows\System\GiNLLBy.exe
  2⤵
  PID:3632
- C:\Windows\System\bJhehzu.exe
  C:\Windows\System\bJhehzu.exe
  2⤵
  PID:4088
- C:\Windows\System\aubBAJf.exe
  C:\Windows\System\aubBAJf.exe
  2⤵
  PID:1680
- C:\Windows\System\YqkJAEO.exe
  C:\Windows\System\YqkJAEO.exe
  2⤵
  PID:560
- C:\Windows\System\mjVvord.exe
  C:\Windows\System\mjVvord.exe
  2⤵
  PID:2964
- C:\Windows\System\edblQnB.exe
  C:\Windows\System\edblQnB.exe
  2⤵
  PID:3480
- C:\Windows\System\uqyqDfa.exe
  C:\Windows\System\uqyqDfa.exe
  2⤵
  PID:3544
- C:\Windows\System\wxFHXSY.exe
  C:\Windows\System\wxFHXSY.exe
  2⤵
  PID:3668
- C:\Windows\System\WuUeFxo.exe
  C:\Windows\System\WuUeFxo.exe
  2⤵
  PID:3652
- C:\Windows\System\iOSaPic.exe
  C:\Windows\System\iOSaPic.exe
  2⤵
  PID:3680
- C:\Windows\System\YbaruXu.exe
  C:\Windows\System\YbaruXu.exe
  2⤵
  PID:3676
- C:\Windows\System\mgDupqs.exe
  C:\Windows\System\mgDupqs.exe
  2⤵
  PID:3792
- C:\Windows\System\JKAGlhW.exe
  C:\Windows\System\JKAGlhW.exe
  2⤵
  PID:2992
- C:\Windows\System\uDgTJcQ.exe
  C:\Windows\System\uDgTJcQ.exe
  2⤵
  PID:2708
- C:\Windows\System\xeXVFtg.exe
  C:\Windows\System\xeXVFtg.exe
  2⤵
  PID:2180
- C:\Windows\System\CzVRjTe.exe
  C:\Windows\System\CzVRjTe.exe
  2⤵
  PID:3856
- C:\Windows\System\rszdxir.exe
  C:\Windows\System\rszdxir.exe
  2⤵
  PID:3872
- C:\Windows\System\HMdbaCe.exe
  C:\Windows\System\HMdbaCe.exe
  2⤵
  PID:3888
- C:\Windows\System\VrUPVSq.exe
  C:\Windows\System\VrUPVSq.exe
  2⤵
  PID:3912
- C:\Windows\System\iNiXpqo.exe
  C:\Windows\System\iNiXpqo.exe
  2⤵
  PID:3928
- C:\Windows\System\BCOibLA.exe
  C:\Windows\System\BCOibLA.exe
  2⤵
  PID:3944
- C:\Windows\System\nInTQTW.exe
  C:\Windows\System\nInTQTW.exe
  2⤵
  PID:3960
- C:\Windows\System\BJnNZid.exe
  C:\Windows\System\BJnNZid.exe
  2⤵
  PID:3992
- C:\Windows\System\vDbPXPU.exe
  C:\Windows\System\vDbPXPU.exe
  2⤵
  PID:1052
- C:\Windows\System\GFWfkIW.exe
  C:\Windows\System\GFWfkIW.exe
  2⤵
  PID:808
- C:\Windows\System\jtQEnQt.exe
  C:\Windows\System\jtQEnQt.exe
  2⤵
  PID:2548
- C:\Windows\System\ChAAnMt.exe
  C:\Windows\System\ChAAnMt.exe
  2⤵
  PID:2928
- C:\Windows\System\ztUrhTf.exe
  C:\Windows\System\ztUrhTf.exe
  2⤵
  PID:2676
- C:\Windows\System\GouPiQd.exe
  C:\Windows\System\GouPiQd.exe
  2⤵
  PID:3116
- C:\Windows\System\sAGAwjM.exe
  C:\Windows\System\sAGAwjM.exe
  2⤵
  PID:3540
- C:\Windows\System\cTOnYit.exe
  C:\Windows\System\cTOnYit.exe
  2⤵
  PID:3572
- C:\Windows\System\pgrkKri.exe
  C:\Windows\System\pgrkKri.exe
  2⤵
  PID:4016
- C:\Windows\System\Soxfldq.exe
  C:\Windows\System\Soxfldq.exe
  2⤵
  PID:4036
- C:\Windows\System\BKbyRKF.exe
  C:\Windows\System\BKbyRKF.exe
  2⤵
  PID:4052
- C:\Windows\System\aqNOmVB.exe
  C:\Windows\System\aqNOmVB.exe
  2⤵
  PID:4076
- C:\Windows\System\CGhztwS.exe
  C:\Windows\System\CGhztwS.exe
  2⤵
  PID:276
- C:\Windows\System\KZuSDse.exe
  C:\Windows\System\KZuSDse.exe
  2⤵
  PID:3320
- C:\Windows\System\KnnPZoS.exe
  C:\Windows\System\KnnPZoS.exe
  2⤵
  PID:3188
- C:\Windows\System\hYyERGL.exe
  C:\Windows\System\hYyERGL.exe
  2⤵
  PID:3224
- C:\Windows\System\SEFBqGT.exe
  C:\Windows\System\SEFBqGT.exe
  2⤵
  PID:3380
- C:\Windows\System\TsosnEc.exe
  C:\Windows\System\TsosnEc.exe
  2⤵
  PID:3608
- C:\Windows\System\BdAiHGO.exe
  C:\Windows\System\BdAiHGO.exe
  2⤵
  PID:3696
- C:\Windows\System\oQEDeyk.exe
  C:\Windows\System\oQEDeyk.exe
  2⤵
  PID:3700
- C:\Windows\System\aevqnjL.exe
  C:\Windows\System\aevqnjL.exe
  2⤵
  PID:3000
- C:\Windows\System\uFFFxVH.exe
  C:\Windows\System\uFFFxVH.exe
  2⤵
  PID:2700
- C:\Windows\System\GJMgyAM.exe
  C:\Windows\System\GJMgyAM.exe
  2⤵
  PID:2948
- C:\Windows\System\aXjOYYK.exe
  C:\Windows\System\aXjOYYK.exe
  2⤵
  PID:3432
- C:\Windows\System\VjitAeo.exe
  C:\Windows\System\VjitAeo.exe
  2⤵
  PID:3772
- C:\Windows\System\dIxuecJ.exe
  C:\Windows\System\dIxuecJ.exe
  2⤵
  PID:3720
- C:\Windows\System\mUDxQrl.exe
  C:\Windows\System\mUDxQrl.exe
  2⤵
  PID:3736
- C:\Windows\System\mDGGJDq.exe
  C:\Windows\System\mDGGJDq.exe
  2⤵
  PID:3752
- C:\Windows\System\wLbvpJs.exe
  C:\Windows\System\wLbvpJs.exe
  2⤵
  PID:3100
- C:\Windows\System\mqnRtLE.exe
  C:\Windows\System\mqnRtLE.exe
  2⤵
  PID:3300
- C:\Windows\System\XmxWKlx.exe
  C:\Windows\System\XmxWKlx.exe
  2⤵
  PID:3396
- C:\Windows\System\ifVgbms.exe
  C:\Windows\System\ifVgbms.exe
  2⤵
  PID:3524
- C:\Windows\System\oMtmKeg.exe
  C:\Windows\System\oMtmKeg.exe
  2⤵
  PID:3592
- C:\Windows\System\ibFZKvI.exe
  C:\Windows\System\ibFZKvI.exe
  2⤵
  PID:3768
- C:\Windows\System\ynKwVIE.exe
  C:\Windows\System\ynKwVIE.exe
  2⤵
  PID:3824
- C:\Windows\System\ETpPZZl.exe
  C:\Windows\System\ETpPZZl.exe
  2⤵
  PID:3848
- C:\Windows\System\axTVMgY.exe
  C:\Windows\System\axTVMgY.exe
  2⤵
  PID:3908
- C:\Windows\System\HbYaUwr.exe
  C:\Windows\System\HbYaUwr.exe
  2⤵
  PID:3940
- C:\Windows\System\hOpnLvm.exe
  C:\Windows\System\hOpnLvm.exe
  2⤵
  PID:3976
- C:\Windows\System\UsOXsFC.exe
  C:\Windows\System\UsOXsFC.exe
  2⤵
  PID:1116
- C:\Windows\System\IMaZPYd.exe
  C:\Windows\System\IMaZPYd.exe
  2⤵
  PID:2668
- C:\Windows\System\iviaGhO.exe
  C:\Windows\System\iviaGhO.exe
  2⤵
  PID:1808
- C:\Windows\System\XMNpkkb.exe
  C:\Windows\System\XMNpkkb.exe
  2⤵
  PID:1836
- C:\Windows\System\vqKaUmW.exe
  C:\Windows\System\vqKaUmW.exe
  2⤵
  PID:2360
- C:\Windows\System\eTYGsPe.exe
  C:\Windows\System\eTYGsPe.exe
  2⤵
  PID:2464
- C:\Windows\System\KNoTZLC.exe
  C:\Windows\System\KNoTZLC.exe
  2⤵
  PID:2584
- C:\Windows\System\NKSXqHh.exe
  C:\Windows\System\NKSXqHh.exe
  2⤵
  PID:4028
- C:\Windows\System\YZayaaQ.exe
  C:\Windows\System\YZayaaQ.exe
  2⤵
  PID:4060
- C:\Windows\System\EcxxnlI.exe
  C:\Windows\System\EcxxnlI.exe
  2⤵
  PID:1124
- C:\Windows\System\OjHbquB.exe
  C:\Windows\System\OjHbquB.exe
  2⤵
  PID:1960
- C:\Windows\System\yLxJpBr.exe
  C:\Windows\System\yLxJpBr.exe
  2⤵
  PID:2572
- C:\Windows\System\afKYZsa.exe
  C:\Windows\System\afKYZsa.exe
  2⤵
  PID:2564
- C:\Windows\System\dayUnBv.exe
  C:\Windows\System\dayUnBv.exe
  2⤵
  PID:2664
- C:\Windows\System\wIWqhZN.exe
  C:\Windows\System\wIWqhZN.exe
  2⤵
  PID:3192
- C:\Windows\System\kriAfPz.exe
  C:\Windows\System\kriAfPz.exe
  2⤵
  PID:3288
- C:\Windows\System\hDapIjF.exe
  C:\Windows\System\hDapIjF.exe
  2⤵
  PID:3444
- C:\Windows\System\phMObFI.exe
  C:\Windows\System\phMObFI.exe
  2⤵
  PID:2644
- C:\Windows\System\JCGdpBo.exe
  C:\Windows\System\JCGdpBo.exe
  2⤵
  PID:2628
- C:\Windows\System\qSwAHSF.exe
  C:\Windows\System\qSwAHSF.exe
  2⤵
  PID:3236
- C:\Windows\System\CmruAGY.exe
  C:\Windows\System\CmruAGY.exe
  2⤵
  PID:2888
- C:\Windows\System\bpMiToC.exe
  C:\Windows\System\bpMiToC.exe
  2⤵
  PID:1548
- C:\Windows\System\Wjjswrh.exe
  C:\Windows\System\Wjjswrh.exe
  2⤵
  PID:3624
- C:\Windows\System\ssAXerb.exe
  C:\Windows\System\ssAXerb.exe
  2⤵
  PID:3400
- C:\Windows\System\SDSMOtF.exe
  C:\Windows\System\SDSMOtF.exe
  2⤵
  PID:3492
- C:\Windows\System\jwkTqQf.exe
  C:\Windows\System\jwkTqQf.exe
  2⤵
  PID:3896
- C:\Windows\System\RBAmSAE.exe
  C:\Windows\System\RBAmSAE.exe
  2⤵
  PID:3844
- C:\Windows\System\OfhAdVi.exe
  C:\Windows\System\OfhAdVi.exe
  2⤵
  PID:1944
- C:\Windows\System\oyxVIbr.exe
  C:\Windows\System\oyxVIbr.exe
  2⤵
  PID:3936
- C:\Windows\System\CzDEirx.exe
  C:\Windows\System\CzDEirx.exe
  2⤵
  PID:4000
- C:\Windows\System\YPDakhl.exe
  C:\Windows\System\YPDakhl.exe
  2⤵
  PID:1252
- C:\Windows\System\SyButJj.exe
  C:\Windows\System\SyButJj.exe
  2⤵
  PID:3884
- C:\Windows\System\CCvIjin.exe
  C:\Windows\System\CCvIjin.exe
  2⤵
  PID:3956
- C:\Windows\System\ONoCath.exe
  C:\Windows\System\ONoCath.exe
  2⤵
  PID:2972
- C:\Windows\System\wzYKfjO.exe
  C:\Windows\System\wzYKfjO.exe
  2⤵
  PID:4044
- C:\Windows\System\dZrMSbo.exe
  C:\Windows\System\dZrMSbo.exe
  2⤵
  PID:3132
- C:\Windows\System\NlMIGjA.exe
  C:\Windows\System\NlMIGjA.exe
  2⤵
  PID:680
- C:\Windows\System\nXVtqIQ.exe
  C:\Windows\System\nXVtqIQ.exe
  2⤵
  PID:1516
- C:\Windows\System\zvLBKVN.exe
  C:\Windows\System\zvLBKVN.exe
  2⤵
  PID:2872
- C:\Windows\System\nxrApiK.exe
  C:\Windows\System\nxrApiK.exe
  2⤵
  PID:3316
- C:\Windows\System\DaezGiv.exe
  C:\Windows\System\DaezGiv.exe
  2⤵
  PID:3448
- C:\Windows\System\pJZoiRE.exe
  C:\Windows\System\pJZoiRE.exe
  2⤵
  PID:3708
- C:\Windows\System\jxUjJGf.exe
  C:\Windows\System\jxUjJGf.exe
  2⤵
  PID:3732
- C:\Windows\System\DoFNDId.exe
  C:\Windows\System\DoFNDId.exe
  2⤵
  PID:1524
- C:\Windows\System\jouWPxa.exe
  C:\Windows\System\jouWPxa.exe
  2⤵
  PID:3556
- C:\Windows\System\HZtgtRF.exe
  C:\Windows\System\HZtgtRF.exe
  2⤵
  PID:3760
- C:\Windows\System\zauaZlT.exe
  C:\Windows\System\zauaZlT.exe
  2⤵
  PID:3784
- C:\Windows\System\ocRmwrb.exe
  C:\Windows\System\ocRmwrb.exe
  2⤵
  PID:3748
- C:\Windows\System\obsvlRu.exe
  C:\Windows\System\obsvlRu.exe
  2⤵
  PID:1296
- C:\Windows\System\pZPwmKd.exe
  C:\Windows\System\pZPwmKd.exe
  2⤵
  PID:4008
- C:\Windows\System\ZMviNBZ.exe
  C:\Windows\System\ZMviNBZ.exe
  2⤵
  PID:1136
- C:\Windows\System\BtnwGQd.exe
  C:\Windows\System\BtnwGQd.exe
  2⤵
  PID:1884
- C:\Windows\System\mxFukXs.exe
  C:\Windows\System\mxFukXs.exe
  2⤵
  PID:3464
- C:\Windows\System\xjmcvcn.exe
  C:\Windows\System\xjmcvcn.exe
  2⤵
  PID:3744
- C:\Windows\System\xkavEoA.exe
  C:\Windows\System\xkavEoA.exe
  2⤵
  PID:2884
- C:\Windows\System\hrcGubk.exe
  C:\Windows\System\hrcGubk.exe
  2⤵
  PID:3900
- C:\Windows\System\EsUQRtG.exe
  C:\Windows\System\EsUQRtG.exe
  2⤵
  PID:3988
- C:\Windows\System\MYxmtrf.exe
  C:\Windows\System\MYxmtrf.exe
  2⤵
  PID:3268
- C:\Windows\System\ZjsLUlM.exe
  C:\Windows\System\ZjsLUlM.exe
  2⤵
  PID:1620
- C:\Windows\System\fAeotUr.exe
  C:\Windows\System\fAeotUr.exe
  2⤵
  PID:2396
- C:\Windows\System\qdbzMOa.exe
  C:\Windows\System\qdbzMOa.exe
  2⤵
  PID:1348
- C:\Windows\System\nVAXkTx.exe
  C:\Windows\System\nVAXkTx.exe
  2⤵
  PID:3836
- C:\Windows\System\HgVniBk.exe
  C:\Windows\System\HgVniBk.exe
  2⤵
  PID:3176
- C:\Windows\System\nLEexZl.exe
  C:\Windows\System\nLEexZl.exe
  2⤵
  PID:3628
- C:\Windows\System\AVyxmlj.exe
  C:\Windows\System\AVyxmlj.exe
  2⤵
  PID:3304
- C:\Windows\System\SipbqQy.exe
  C:\Windows\System\SipbqQy.exe
  2⤵
  PID:2832
- C:\Windows\System\TjAmojl.exe
  C:\Windows\System\TjAmojl.exe
  2⤵
  PID:3904
- C:\Windows\System\raeFGzP.exe
  C:\Windows\System\raeFGzP.exe
  2⤵
  PID:2684
- C:\Windows\System\VkoGwLu.exe
  C:\Windows\System\VkoGwLu.exe
  2⤵
  PID:3104
- C:\Windows\System\jVMKuvW.exe
  C:\Windows\System\jVMKuvW.exe
  2⤵
  PID:4112
- C:\Windows\System\kEzVGWg.exe
  C:\Windows\System\kEzVGWg.exe
  2⤵
  PID:4132
- C:\Windows\System\HIQMlSf.exe
  C:\Windows\System\HIQMlSf.exe
  2⤵
  PID:4148
- C:\Windows\System\GDuzQvx.exe
  C:\Windows\System\GDuzQvx.exe
  2⤵
  PID:4164
- C:\Windows\System\mAsRHTV.exe
  C:\Windows\System\mAsRHTV.exe
  2⤵
  PID:4180
- C:\Windows\System\KJTxokd.exe
  C:\Windows\System\KJTxokd.exe
  2⤵
  PID:4196
- C:\Windows\System\vzVckCp.exe
  C:\Windows\System\vzVckCp.exe
  2⤵
  PID:4212
- C:\Windows\System\ygyjANP.exe
  C:\Windows\System\ygyjANP.exe
  2⤵
  PID:4228
- C:\Windows\System\cjWPURt.exe
  C:\Windows\System\cjWPURt.exe
  2⤵
  PID:4244
- C:\Windows\System\MfvUadR.exe
  C:\Windows\System\MfvUadR.exe
  2⤵
  PID:4360
- C:\Windows\System\xcjLeWQ.exe
  C:\Windows\System\xcjLeWQ.exe
  2⤵
  PID:4376
- C:\Windows\System\KxmKYjl.exe
  C:\Windows\System\KxmKYjl.exe
  2⤵
  PID:4396
- C:\Windows\System\igTcAug.exe
  C:\Windows\System\igTcAug.exe
  2⤵
  PID:4420
- C:\Windows\System\AFiZDdM.exe
  C:\Windows\System\AFiZDdM.exe
  2⤵
  PID:4436
- C:\Windows\System\tbgKmcP.exe
  C:\Windows\System\tbgKmcP.exe
  2⤵
  PID:4460
- C:\Windows\System\JuuXjan.exe
  C:\Windows\System\JuuXjan.exe
  2⤵
  PID:4476
- C:\Windows\System\TSoJeYf.exe
  C:\Windows\System\TSoJeYf.exe
  2⤵
  PID:4492
- C:\Windows\System\OpnpAuD.exe
  C:\Windows\System\OpnpAuD.exe
  2⤵
  PID:4508
- C:\Windows\System\DBIjpmN.exe
  C:\Windows\System\DBIjpmN.exe
  2⤵
  PID:4528
- C:\Windows\System\zoxuJlv.exe
  C:\Windows\System\zoxuJlv.exe
  2⤵
  PID:4544
- C:\Windows\System\ijoYlWQ.exe
  C:\Windows\System\ijoYlWQ.exe
  2⤵
  PID:4560
- C:\Windows\System\stwGqaG.exe
  C:\Windows\System\stwGqaG.exe
  2⤵
  PID:4580
- C:\Windows\System\RxbkNgt.exe
  C:\Windows\System\RxbkNgt.exe
  2⤵
  PID:4600
- C:\Windows\System\vhEltyO.exe
  C:\Windows\System\vhEltyO.exe
  2⤵
  PID:4664
- C:\Windows\System\Zgjylgi.exe
  C:\Windows\System\Zgjylgi.exe
  2⤵
  PID:4684
- C:\Windows\System\zrfUKqS.exe
  C:\Windows\System\zrfUKqS.exe
  2⤵
  PID:4700
- C:\Windows\System\XBarfXS.exe
  C:\Windows\System\XBarfXS.exe
  2⤵
  PID:4720
- C:\Windows\System\QhxuMgQ.exe
  C:\Windows\System\QhxuMgQ.exe
  2⤵
  PID:4740
- C:\Windows\System\ggQMmHw.exe
  C:\Windows\System\ggQMmHw.exe
  2⤵
  PID:4756
- C:\Windows\System\StVFQUA.exe
  C:\Windows\System\StVFQUA.exe
  2⤵
  PID:4804
- C:\Windows\System\RHACMvN.exe
  C:\Windows\System\RHACMvN.exe
  2⤵
  PID:4868
- C:\Windows\System\naNemUk.exe
  C:\Windows\System\naNemUk.exe
  2⤵
  PID:4884
- C:\Windows\System\xoSBipl.exe
  C:\Windows\System\xoSBipl.exe
  2⤵
  PID:4900
- C:\Windows\System\unPmNmu.exe
  C:\Windows\System\unPmNmu.exe
  2⤵
  PID:4932
- C:\Windows\System\NkPYtXK.exe
  C:\Windows\System\NkPYtXK.exe
  2⤵
  PID:4952
- C:\Windows\System\momCokh.exe
  C:\Windows\System\momCokh.exe
  2⤵
  PID:4968
- C:\Windows\System\KAsOCLp.exe
  C:\Windows\System\KAsOCLp.exe
  2⤵
  PID:4984
- C:\Windows\System\PqIfQdp.exe
  C:\Windows\System\PqIfQdp.exe
  2⤵
  PID:5004
- C:\Windows\System\yuvVGjL.exe
  C:\Windows\System\yuvVGjL.exe
  2⤵
  PID:5024
- C:\Windows\System\Jfbxscu.exe
  C:\Windows\System\Jfbxscu.exe
  2⤵
  PID:5044
- C:\Windows\System\cFfrkpL.exe
  C:\Windows\System\cFfrkpL.exe
  2⤵
  PID:5100
- C:\Windows\System\vkTCmBv.exe
  C:\Windows\System\vkTCmBv.exe
  2⤵
  PID:4084
- C:\Windows\System\jsCDjVA.exe
  C:\Windows\System\jsCDjVA.exe
  2⤵
  PID:524
- C:\Windows\System\udXQBMO.exe
  C:\Windows\System\udXQBMO.exe
  2⤵
  PID:4172
- C:\Windows\System\zxzGUCe.exe
  C:\Windows\System\zxzGUCe.exe
  2⤵
  PID:4256
- C:\Windows\System\hkRjusg.exe
  C:\Windows\System\hkRjusg.exe
  2⤵
  PID:4336
- C:\Windows\System\kTUlirZ.exe
  C:\Windows\System\kTUlirZ.exe
  2⤵
  PID:4356
- C:\Windows\System\wwfVUXQ.exe
  C:\Windows\System\wwfVUXQ.exe
  2⤵
  PID:4368
- C:\Windows\System\yEiBkUO.exe
  C:\Windows\System\yEiBkUO.exe
  2⤵
  PID:4468
- C:\Windows\System\JnrrKtM.exe
  C:\Windows\System\JnrrKtM.exe
  2⤵
  PID:4504
- C:\Windows\System\JqBBmwd.exe
  C:\Windows\System\JqBBmwd.exe
  2⤵
  PID:4416
- C:\Windows\System\VWpuJTu.exe
  C:\Windows\System\VWpuJTu.exe
  2⤵
  PID:4612
- C:\Windows\System\KVdNRUY.exe
  C:\Windows\System\KVdNRUY.exe
  2⤵
  PID:4620
- C:\Windows\System\ITsBtPn.exe
  C:\Windows\System\ITsBtPn.exe
  2⤵
  PID:4632
- C:\Windows\System\EMeVoaq.exe
  C:\Windows\System\EMeVoaq.exe
  2⤵
  PID:4648
- C:\Windows\System\ztMirvn.exe
  C:\Windows\System\ztMirvn.exe
  2⤵
  PID:4660
- C:\Windows\System\YkvdiXW.exe
  C:\Windows\System\YkvdiXW.exe
  2⤵
  PID:4728
- C:\Windows\System\KfcSvJK.exe
  C:\Windows\System\KfcSvJK.exe
  2⤵
  PID:4488
- C:\Windows\System\bNNBejt.exe
  C:\Windows\System\bNNBejt.exe
  2⤵
  PID:4552
- C:\Windows\System\UyTUiWM.exe
  C:\Windows\System\UyTUiWM.exe
  2⤵
  PID:4764
- C:\Windows\System\maLQobg.exe
  C:\Windows\System\maLQobg.exe
  2⤵
  PID:4596
- C:\Windows\System\vUfOzuD.exe
  C:\Windows\System\vUfOzuD.exe
  2⤵
  PID:4712
- C:\Windows\System\LoUmZDO.exe
  C:\Windows\System\LoUmZDO.exe
  2⤵
  PID:4784
- C:\Windows\System\CzNkwUz.exe
  C:\Windows\System\CzNkwUz.exe
  2⤵
  PID:4800
- C:\Windows\System\hGiMiZo.exe
  C:\Windows\System\hGiMiZo.exe
  2⤵
  PID:4812
- C:\Windows\System\EcQmnFj.exe
  C:\Windows\System\EcQmnFj.exe
  2⤵
  PID:4832
- C:\Windows\System\CUxfvOa.exe
  C:\Windows\System\CUxfvOa.exe
  2⤵
  PID:4924
- C:\Windows\System\BVvYnGx.exe
  C:\Windows\System\BVvYnGx.exe
  2⤵
  PID:4896
- C:\Windows\System\mmvDnZf.exe
  C:\Windows\System\mmvDnZf.exe
  2⤵
  PID:4820
- C:\Windows\System\eBsfMkZ.exe
  C:\Windows\System\eBsfMkZ.exe
  2⤵
  PID:4964
- C:\Windows\System\QnNjBgj.exe
  C:\Windows\System\QnNjBgj.exe
  2⤵
  PID:4864
- C:\Windows\System\ofwMXaA.exe
  C:\Windows\System\ofwMXaA.exe
  2⤵
  PID:4940
- C:\Windows\System\vBfmqwS.exe
  C:\Windows\System\vBfmqwS.exe
  2⤵
  PID:4284
- C:\Windows\System\PcYBiZe.exe
  C:\Windows\System\PcYBiZe.exe
  2⤵
  PID:4276
- C:\Windows\System\zDrpMgp.exe
  C:\Windows\System\zDrpMgp.exe
  2⤵
  PID:4304
- C:\Windows\System\uZvIfQw.exe
  C:\Windows\System\uZvIfQw.exe
  2⤵
  PID:4384
- C:\Windows\System\xZpCssA.exe
  C:\Windows\System\xZpCssA.exe
  2⤵
  PID:4500
- C:\Windows\System\unYyvGL.exe
  C:\Windows\System\unYyvGL.exe
  2⤵
  PID:4456
- C:\Windows\System\FseArcY.exe
  C:\Windows\System\FseArcY.exe
  2⤵
  PID:4644
- C:\Windows\System\esQjKuz.exe
  C:\Windows\System\esQjKuz.exe
  2⤵
  PID:4448
- C:\Windows\System\MJBEcBI.exe
  C:\Windows\System\MJBEcBI.exe
  2⤵
  PID:4592
- C:\Windows\System\UhedtFH.exe
  C:\Windows\System\UhedtFH.exe
  2⤵
  PID:4796
- C:\Windows\System\EATNvBs.exe
  C:\Windows\System\EATNvBs.exe
  2⤵
  PID:4828
- C:\Windows\System\VVaCSPp.exe
  C:\Windows\System\VVaCSPp.exe
  2⤵
  PID:4520
- C:\Windows\System\vfIFYbp.exe
  C:\Windows\System\vfIFYbp.exe
  2⤵
  PID:4708
- C:\Windows\System\gRYDMhj.exe
  C:\Windows\System\gRYDMhj.exe
  2⤵
  PID:4776
- C:\Windows\System\gnKxfFz.exe
  C:\Windows\System\gnKxfFz.exe
  2⤵
  PID:5032
- C:\Windows\System\RRiHyYW.exe
  C:\Windows\System\RRiHyYW.exe
  2⤵
  PID:5036
- C:\Windows\System\cdwYSnG.exe
  C:\Windows\System\cdwYSnG.exe
  2⤵
  PID:5060
- C:\Windows\System\YAmpbOA.exe
  C:\Windows\System\YAmpbOA.exe
  2⤵
  PID:4908
- C:\Windows\System\KqTbIgj.exe
  C:\Windows\System\KqTbIgj.exe
  2⤵
  PID:4124
- C:\Windows\System\WgpFHkI.exe
  C:\Windows\System\WgpFHkI.exe
  2⤵
  PID:4840
- C:\Windows\System\ZMEIjAh.exe
  C:\Windows\System\ZMEIjAh.exe
  2⤵
  PID:4848
- C:\Windows\System\xrSOCpS.exe
  C:\Windows\System\xrSOCpS.exe
  2⤵
  PID:4144
- C:\Windows\System\tJDNEkK.exe
  C:\Windows\System\tJDNEkK.exe
  2⤵
  PID:4628
- C:\Windows\System\DAaxDIq.exe
  C:\Windows\System\DAaxDIq.exe
  2⤵
  PID:4816
- C:\Windows\System\rJcUDAl.exe
  C:\Windows\System\rJcUDAl.exe
  2⤵
  PID:4536
- C:\Windows\System\rcCvYHU.exe
  C:\Windows\System\rcCvYHU.exe
  2⤵
  PID:4220
- C:\Windows\System\aUObaMs.exe
  C:\Windows\System\aUObaMs.exe
  2⤵
  PID:5088
- C:\Windows\System\QOANNHr.exe
  C:\Windows\System\QOANNHr.exe
  2⤵
  PID:4824
- C:\Windows\System\SRmuyVg.exe
  C:\Windows\System\SRmuyVg.exe
  2⤵
  PID:4272
- C:\Windows\System\XTiICCJ.exe
  C:\Windows\System\XTiICCJ.exe
  2⤵
  PID:4676
- C:\Windows\System\ZvPVOMk.exe
  C:\Windows\System\ZvPVOMk.exe
  2⤵
  PID:4264
- C:\Windows\System\kCLtBqe.exe
  C:\Windows\System\kCLtBqe.exe
  2⤵
  PID:4780
- C:\Windows\System\NsrnGWM.exe
  C:\Windows\System\NsrnGWM.exe
  2⤵
  PID:4732
- C:\Windows\System\ZwCEPoZ.exe
  C:\Windows\System\ZwCEPoZ.exe
  2⤵
  PID:5096
- C:\Windows\System\NZiGuXy.exe
  C:\Windows\System\NZiGuXy.exe
  2⤵
  PID:4892
- C:\Windows\System\oUbuvYl.exe
  C:\Windows\System\oUbuvYl.exe
  2⤵
  PID:5080
- C:\Windows\System\sXPPbBt.exe
  C:\Windows\System\sXPPbBt.exe
  2⤵
  PID:5116
- C:\Windows\System\yIpMZwr.exe
  C:\Windows\System\yIpMZwr.exe
  2⤵
  PID:4916
- C:\Windows\System\TUORocL.exe
  C:\Windows\System\TUORocL.exe
  2⤵
  PID:5092
- C:\Windows\System\ANcyzft.exe
  C:\Windows\System\ANcyzft.exe
  2⤵
  PID:5232
- C:\Windows\System\bTUrjjw.exe
  C:\Windows\System\bTUrjjw.exe
  2⤵
  PID:5248
- C:\Windows\System\UEYKZBK.exe
  C:\Windows\System\UEYKZBK.exe
  2⤵
  PID:5264
- C:\Windows\System\juBCbVn.exe
  C:\Windows\System\juBCbVn.exe
  2⤵
  PID:5280
- C:\Windows\System\rSizrBN.exe
  C:\Windows\System\rSizrBN.exe
  2⤵
  PID:5296
- C:\Windows\System\pwsjkRW.exe
  C:\Windows\System\pwsjkRW.exe
  2⤵
  PID:5312
- C:\Windows\System\PThQMMi.exe
  C:\Windows\System\PThQMMi.exe
  2⤵
  PID:5328
- C:\Windows\System\hzgqNWs.exe
  C:\Windows\System\hzgqNWs.exe
  2⤵
  PID:5344
- C:\Windows\System\WGMvmTC.exe
  C:\Windows\System\WGMvmTC.exe
  2⤵
  PID:5360
- C:\Windows\System\BTXgmsB.exe
  C:\Windows\System\BTXgmsB.exe
  2⤵
  PID:5376
- C:\Windows\System\uPjchth.exe
  C:\Windows\System\uPjchth.exe
  2⤵
  PID:5392
- C:\Windows\System\BlyioUT.exe
  C:\Windows\System\BlyioUT.exe
  2⤵
  PID:5408
- C:\Windows\System\Fflnson.exe
  C:\Windows\System\Fflnson.exe
  2⤵
  PID:5428
- C:\Windows\System\DvInLWT.exe
  C:\Windows\System\DvInLWT.exe
  2⤵
  PID:5488
- C:\Windows\System\ELnetTA.exe
  C:\Windows\System\ELnetTA.exe
  2⤵
  PID:5504
- C:\Windows\System\rODrStd.exe
  C:\Windows\System\rODrStd.exe
  2⤵
  PID:5520
- C:\Windows\System\JxtZtZp.exe
  C:\Windows\System\JxtZtZp.exe
  2⤵
  PID:5540
- C:\Windows\System\nytOYRi.exe
  C:\Windows\System\nytOYRi.exe
  2⤵
  PID:5560
- C:\Windows\System\vjJBoLz.exe
  C:\Windows\System\vjJBoLz.exe
  2⤵
  PID:5576
- C:\Windows\System\IdJVSQa.exe
  C:\Windows\System\IdJVSQa.exe
  2⤵
  PID:5596
- C:\Windows\System\EnuClaU.exe
  C:\Windows\System\EnuClaU.exe
  2⤵
  PID:5612
- C:\Windows\System\VmFBPji.exe
  C:\Windows\System\VmFBPji.exe
  2⤵
  PID:5628
- C:\Windows\System\KGCSrKj.exe
  C:\Windows\System\KGCSrKj.exe
  2⤵
  PID:5648
- C:\Windows\System\dScoxkr.exe
  C:\Windows\System\dScoxkr.exe
  2⤵
  PID:5664
- C:\Windows\System\UAeIqmv.exe
  C:\Windows\System\UAeIqmv.exe
  2⤵
  PID:5680
- C:\Windows\System\ytBuzkb.exe
  C:\Windows\System\ytBuzkb.exe
  2⤵
  PID:5700
- C:\Windows\System\UvPBbAA.exe
  C:\Windows\System\UvPBbAA.exe
  2⤵
  PID:5716
- C:\Windows\System\sHOCTCU.exe
  C:\Windows\System\sHOCTCU.exe
  2⤵
  PID:5732
- C:\Windows\System\OeiKQfD.exe
  C:\Windows\System\OeiKQfD.exe
  2⤵
  PID:5752
- C:\Windows\System\bwlitFG.exe
  C:\Windows\System\bwlitFG.exe
  2⤵
  PID:5768
- C:\Windows\System\dpikddJ.exe
  C:\Windows\System\dpikddJ.exe
  2⤵
  PID:5784
- C:\Windows\System\EFQQuZU.exe
  C:\Windows\System\EFQQuZU.exe
  2⤵
  PID:5804
- C:\Windows\System\CvZiihN.exe
  C:\Windows\System\CvZiihN.exe
  2⤵
  PID:5820
- C:\Windows\System\lhzgUsD.exe
  C:\Windows\System\lhzgUsD.exe
  2⤵
  PID:5836
- C:\Windows\System\ovRTGrv.exe
  C:\Windows\System\ovRTGrv.exe
  2⤵
  PID:5856
- C:\Windows\System\TZJxmsp.exe
  C:\Windows\System\TZJxmsp.exe
  2⤵
  PID:5872
- C:\Windows\System\aWAOJmS.exe
  C:\Windows\System\aWAOJmS.exe
  2⤵
  PID:5892
- C:\Windows\System\iFuMTMb.exe
  C:\Windows\System\iFuMTMb.exe
  2⤵
  PID:5908
- C:\Windows\System\nUlUsGH.exe
  C:\Windows\System\nUlUsGH.exe
  2⤵
  PID:5980
- C:\Windows\System\XMLrfUY.exe
  C:\Windows\System\XMLrfUY.exe
  2⤵
  PID:6000
- C:\Windows\System\JDUsLOQ.exe
  C:\Windows\System\JDUsLOQ.exe
  2⤵
  PID:6016
- C:\Windows\System\DOvHevl.exe
  C:\Windows\System\DOvHevl.exe
  2⤵
  PID:6040
- C:\Windows\System\knEIdiD.exe
  C:\Windows\System\knEIdiD.exe
  2⤵
  PID:6056
- C:\Windows\System\IhfZWpV.exe
  C:\Windows\System\IhfZWpV.exe
  2⤵
  PID:6072
- C:\Windows\System\kiaNJyX.exe
  C:\Windows\System\kiaNJyX.exe
  2⤵
  PID:6092
- C:\Windows\System\gmyWLhD.exe
  C:\Windows\System\gmyWLhD.exe
  2⤵
  PID:6112
- C:\Windows\System\DxpLnZe.exe
  C:\Windows\System\DxpLnZe.exe
  2⤵
  PID:6128
- C:\Windows\System\qXfQTbW.exe
  C:\Windows\System\qXfQTbW.exe
  2⤵
  PID:4308
- C:\Windows\System\QUaILdR.exe
  C:\Windows\System\QUaILdR.exe
  2⤵
  PID:5112
- C:\Windows\System\NxcZOsI.exe
  C:\Windows\System\NxcZOsI.exe
  2⤵
  PID:4352
- C:\Windows\System\fLYJbrK.exe
  C:\Windows\System\fLYJbrK.exe
  2⤵
  PID:5124
- C:\Windows\System\kTHcLJq.exe
  C:\Windows\System\kTHcLJq.exe
  2⤵
  PID:4856
- C:\Windows\System\zgXZsAT.exe
  C:\Windows\System\zgXZsAT.exe
  2⤵
  PID:5144
- C:\Windows\System\HbfdObT.exe
  C:\Windows\System\HbfdObT.exe
  2⤵
  PID:5184
- C:\Windows\System\QLlhlVh.exe
  C:\Windows\System\QLlhlVh.exe
  2⤵
  PID:4860
- C:\Windows\System\gtDFpzE.exe
  C:\Windows\System\gtDFpzE.exe
  2⤵
  PID:5204
- C:\Windows\System\lgypmAY.exe
  C:\Windows\System\lgypmAY.exe
  2⤵
  PID:4324
- C:\Windows\System\KuTjOJM.exe
  C:\Windows\System\KuTjOJM.exe
  2⤵
  PID:5220
- C:\Windows\System\Ritlwzz.exe
  C:\Windows\System\Ritlwzz.exe
  2⤵
  PID:5276
- C:\Windows\System\YYVYxlF.exe
  C:\Windows\System\YYVYxlF.exe
  2⤵
  PID:5320
- C:\Windows\System\XmcgTWG.exe
  C:\Windows\System\XmcgTWG.exe
  2⤵
  PID:5424
- C:\Windows\System\qrhupwC.exe
  C:\Windows\System\qrhupwC.exe
  2⤵
  PID:5240
- C:\Windows\System\CEDOqug.exe
  C:\Windows\System\CEDOqug.exe
  2⤵
  PID:5536
- C:\Windows\System\KMtPUCt.exe
  C:\Windows\System\KMtPUCt.exe
  2⤵
  PID:5604
- C:\Windows\System\jzFOGmz.exe
  C:\Windows\System\jzFOGmz.exe
  2⤵
  PID:5640
- C:\Windows\System\gOXVYaN.exe
  C:\Windows\System\gOXVYaN.exe
  2⤵
  PID:5340
- C:\Windows\System\pGInBeh.exe
  C:\Windows\System\pGInBeh.exe
  2⤵
  PID:5436
- C:\Windows\System\zDJeAKy.exe
  C:\Windows\System\zDJeAKy.exe
  2⤵
  PID:5512
- C:\Windows\System\YrciAGU.exe
  C:\Windows\System\YrciAGU.exe
  2⤵
  PID:5880
- C:\Windows\System\vRCfPmp.exe
  C:\Windows\System\vRCfPmp.exe
  2⤵
  PID:5812
- C:\Windows\System\XWTviJk.exe
  C:\Windows\System\XWTviJk.exe
  2⤵
  PID:5852
- C:\Windows\System\KqbXQnZ.exe
  C:\Windows\System\KqbXQnZ.exe
  2⤵
  PID:5728
- C:\Windows\System\PhDLZHG.exe
  C:\Windows\System\PhDLZHG.exe
  2⤵
  PID:5476
- C:\Windows\System\vJAXhsE.exe
  C:\Windows\System\vJAXhsE.exe
  2⤵
  PID:5968
- C:\Windows\System\hRENnRA.exe
  C:\Windows\System\hRENnRA.exe
  2⤵
  PID:5972
- C:\Windows\System\qHBpOsd.exe
  C:\Windows\System\qHBpOsd.exe
  2⤵
  PID:5584
- C:\Windows\System\tXwrxta.exe
  C:\Windows\System\tXwrxta.exe
  2⤵
  PID:5624
- C:\Windows\System\rSkBhdU.exe
  C:\Windows\System\rSkBhdU.exe
  2⤵
  PID:5792
- C:\Windows\System\QzdnltN.exe
  C:\Windows\System\QzdnltN.exe
  2⤵
  PID:5832
- C:\Windows\System\sYPYiJj.exe
  C:\Windows\System\sYPYiJj.exe
  2⤵
  PID:6052
- C:\Windows\System\avINttl.exe
  C:\Windows\System\avINttl.exe
  2⤵
  PID:6120
- C:\Windows\System\VGJJdmv.exe
  C:\Windows\System\VGJJdmv.exe
  2⤵
  PID:4412
- C:\Windows\System\nrZTBNd.exe
  C:\Windows\System\nrZTBNd.exe
  2⤵
  PID:6032
- C:\Windows\System\oQICUDA.exe
  C:\Windows\System\oQICUDA.exe
  2⤵
  PID:5992
- C:\Windows\System\ysFEJHK.exe
  C:\Windows\System\ysFEJHK.exe
  2⤵
  PID:6064
- C:\Windows\System\VfKtgdj.exe
  C:\Windows\System\VfKtgdj.exe
  2⤵
  PID:5156
- C:\Windows\System\DyJycJR.exe
  C:\Windows\System\DyJycJR.exe
  2⤵
  PID:5216
- C:\Windows\System\WqrtKen.exe
  C:\Windows\System\WqrtKen.exe
  2⤵
  PID:4696
- C:\Windows\System\HeXjpmI.exe
  C:\Windows\System\HeXjpmI.exe
  2⤵
  PID:5172
- C:\Windows\System\pKtieWi.exe
  C:\Windows\System\pKtieWi.exe
  2⤵
  PID:5180
- C:\Windows\System\HcBLUnf.exe
  C:\Windows\System\HcBLUnf.exe
  2⤵
  PID:5372
- C:\Windows\System\TJFVmwT.exe
  C:\Windows\System\TJFVmwT.exe
  2⤵
  PID:5384
- C:\Windows\System\jWtZPow.exe
  C:\Windows\System\jWtZPow.exe
  2⤵
  PID:1716
- C:\Windows\System\SotAZxl.exe
  C:\Windows\System\SotAZxl.exe
  2⤵
  PID:968
- C:\Windows\System\LimrxWK.exe
  C:\Windows\System\LimrxWK.exe
  2⤵
  PID:5404
- C:\Windows\System\LtUrfsP.exe
  C:\Windows\System\LtUrfsP.exe
  2⤵
  PID:5776
- C:\Windows\System\zcRrZwT.exe
  C:\Windows\System\zcRrZwT.exe
  2⤵
  PID:5468
- C:\Windows\System\agyZSBm.exe
  C:\Windows\System\agyZSBm.exe
  2⤵
  PID:5940
- C:\Windows\System\uSqAYpl.exe
  C:\Windows\System\uSqAYpl.exe
  2⤵
  PID:5724
- C:\Windows\System\MgiJYae.exe
  C:\Windows\System\MgiJYae.exe
  2⤵
  PID:5548
- C:\Windows\System\YynPjDC.exe
  C:\Windows\System\YynPjDC.exe
  2⤵
  PID:6012
- C:\Windows\System\TVUGfUb.exe
  C:\Windows\System\TVUGfUb.exe
  2⤵
  PID:5356
- C:\Windows\System\bXwGeJX.exe
  C:\Windows\System\bXwGeJX.exe
  2⤵
  PID:5552
- C:\Windows\System\KxkZpIl.exe
  C:\Windows\System\KxkZpIl.exe
  2⤵
  PID:6084
- C:\Windows\System\PPBbcEy.exe
  C:\Windows\System\PPBbcEy.exe
  2⤵
  PID:6028
- C:\Windows\System\rOqffBb.exe
  C:\Windows\System\rOqffBb.exe
  2⤵
  PID:5988
- C:\Windows\System\tEpSPGs.exe
  C:\Windows\System\tEpSPGs.exe
  2⤵
  PID:4392
- C:\Windows\System\jFDqMGk.exe
  C:\Windows\System\jFDqMGk.exe
  2⤵
  PID:6136
- C:\Windows\System\vUQpQJJ.exe
  C:\Windows\System\vUQpQJJ.exe
  2⤵
  PID:5388
- C:\Windows\System\RWAwkSy.exe
  C:\Windows\System\RWAwkSy.exe
  2⤵
  PID:5260
- C:\Windows\System\yyxsWGq.exe
  C:\Windows\System\yyxsWGq.exe
  2⤵
  PID:5712
- C:\Windows\System\GgMgoPR.exe
  C:\Windows\System\GgMgoPR.exe
  2⤵
  PID:5920
- C:\Windows\System\QWcdjFh.exe
  C:\Windows\System\QWcdjFh.exe
  2⤵
  PID:5952
- C:\Windows\System\zZMmsOu.exe
  C:\Windows\System\zZMmsOu.exe
  2⤵
  PID:5780
- C:\Windows\System\AAWjOrK.exe
  C:\Windows\System\AAWjOrK.exe
  2⤵
  PID:5932
- C:\Windows\System\dbkMbRK.exe
  C:\Windows\System\dbkMbRK.exe
  2⤵
  PID:5688
- C:\Windows\System\yxgCtXb.exe
  C:\Windows\System\yxgCtXb.exe
  2⤵
  PID:5904
- C:\Windows\System\bskGjQI.exe
  C:\Windows\System\bskGjQI.exe
  2⤵
  PID:6048
- C:\Windows\System\srZzzpk.exe
  C:\Windows\System\srZzzpk.exe
  2⤵
  PID:4656
- C:\Windows\System\feBimII.exe
  C:\Windows\System\feBimII.exe
  2⤵
  PID:4540
- C:\Windows\System\djlvfyH.exe
  C:\Windows\System\djlvfyH.exe
  2⤵
  PID:5936
- C:\Windows\System\ggxsUan.exe
  C:\Windows\System\ggxsUan.exe
  2⤵
  PID:5256
- C:\Windows\System\bFPkkGv.exe
  C:\Windows\System\bFPkkGv.exe
  2⤵
  PID:5128
- C:\Windows\System\qBbJIDC.exe
  C:\Windows\System\qBbJIDC.exe
  2⤵
  PID:5292
- C:\Windows\System\hQOzJJv.exe
  C:\Windows\System\hQOzJJv.exe
  2⤵
  PID:5400
- C:\Windows\System\fczEoWv.exe
  C:\Windows\System\fczEoWv.exe
  2⤵
  PID:5168
- C:\Windows\System\XDdhRSR.exe
  C:\Windows\System\XDdhRSR.exe
  2⤵
  PID:5740
- C:\Windows\System\WINhOai.exe
  C:\Windows\System\WINhOai.exe
  2⤵
  PID:5456
- C:\Windows\System\HzJdWBC.exe
  C:\Windows\System\HzJdWBC.exe
  2⤵
  PID:5960
- C:\Windows\System\RteUngR.exe
  C:\Windows\System\RteUngR.exe
  2⤵
  PID:4176
- C:\Windows\System\wHTfQle.exe
  C:\Windows\System\wHTfQle.exe
  2⤵
  PID:2416
- C:\Windows\System\aqzVceC.exe
  C:\Windows\System\aqzVceC.exe
  2⤵
  PID:5152
- C:\Windows\System\KTcZGwB.exe
  C:\Windows\System\KTcZGwB.exe
  2⤵
  PID:6108
- C:\Windows\System\TUPmXOh.exe
  C:\Windows\System\TUPmXOh.exe
  2⤵
  PID:4252
- C:\Windows\System\yJaXhdU.exe
  C:\Windows\System\yJaXhdU.exe
  2⤵
  PID:5200
- C:\Windows\System\DxHCJGR.exe
  C:\Windows\System\DxHCJGR.exe
  2⤵
  PID:4224
- C:\Windows\System\OBlioGD.exe
  C:\Windows\System\OBlioGD.exe
  2⤵
  PID:5528
- C:\Windows\System\Qfarptm.exe
  C:\Windows\System\Qfarptm.exe
  2⤵
  PID:5696
- C:\Windows\System\pxhcRBO.exe
  C:\Windows\System\pxhcRBO.exe
  2⤵
  PID:5464
- C:\Windows\System\AqknQlU.exe
  C:\Windows\System\AqknQlU.exe
  2⤵
  PID:6140
- C:\Windows\System\yCUbHqc.exe
  C:\Windows\System\yCUbHqc.exe
  2⤵
  PID:5068
- C:\Windows\System\RevigXR.exe
  C:\Windows\System\RevigXR.exe
  2⤵
  PID:4944
- C:\Windows\System\JeTxSBo.exe
  C:\Windows\System\JeTxSBo.exe
  2⤵
  PID:6152
- C:\Windows\System\ENxSImn.exe
  C:\Windows\System\ENxSImn.exe
  2⤵
  PID:6168
- C:\Windows\System\dYDjqMZ.exe
  C:\Windows\System\dYDjqMZ.exe
  2⤵
  PID:6184
- C:\Windows\System\oqOYTxL.exe
  C:\Windows\System\oqOYTxL.exe
  2⤵
  PID:6200
- C:\Windows\System\WcUIavv.exe
  C:\Windows\System\WcUIavv.exe
  2⤵
  PID:6220
- C:\Windows\System\iBPtLFu.exe
  C:\Windows\System\iBPtLFu.exe
  2⤵
  PID:6236
- C:\Windows\System\ZVePbjX.exe
  C:\Windows\System\ZVePbjX.exe
  2⤵
  PID:6252
- C:\Windows\System\gqtUMSM.exe
  C:\Windows\System\gqtUMSM.exe
  2⤵
  PID:6268
- C:\Windows\System\sWiyfqN.exe
  C:\Windows\System\sWiyfqN.exe
  2⤵
  PID:6284
- C:\Windows\System\DwXaWJW.exe
  C:\Windows\System\DwXaWJW.exe
  2⤵
  PID:6300
- C:\Windows\System\PWrsEFx.exe
  C:\Windows\System\PWrsEFx.exe
  2⤵
  PID:6324
- C:\Windows\System\VqhHbxp.exe
  C:\Windows\System\VqhHbxp.exe
  2⤵
  PID:6340
- C:\Windows\System\oCrYFRI.exe
  C:\Windows\System\oCrYFRI.exe
  2⤵
  PID:6360
- C:\Windows\System\QpmDldI.exe
  C:\Windows\System\QpmDldI.exe
  2⤵
  PID:6376
- C:\Windows\System\HRmoAeB.exe
  C:\Windows\System\HRmoAeB.exe
  2⤵
  PID:6392
- C:\Windows\System\gisqSuM.exe
  C:\Windows\System\gisqSuM.exe
  2⤵
  PID:6408
- C:\Windows\System\KbnmDdS.exe
  C:\Windows\System\KbnmDdS.exe
  2⤵
  PID:6424
- C:\Windows\System\DFwIaZm.exe
  C:\Windows\System\DFwIaZm.exe
  2⤵
  PID:6440
- C:\Windows\System\njwDJLH.exe
  C:\Windows\System\njwDJLH.exe
  2⤵
  PID:6460
- C:\Windows\System\wDrrGbT.exe
  C:\Windows\System\wDrrGbT.exe
  2⤵
  PID:6488
- C:\Windows\System\SjzDdfc.exe
  C:\Windows\System\SjzDdfc.exe
  2⤵
  PID:6504
- C:\Windows\System\ogObbAh.exe
  C:\Windows\System\ogObbAh.exe
  2⤵
  PID:6528
- C:\Windows\System\KGDYeiZ.exe
  C:\Windows\System\KGDYeiZ.exe
  2⤵
  PID:6544
- C:\Windows\System\GaNSGkE.exe
  C:\Windows\System\GaNSGkE.exe
  2⤵
  PID:6560
- C:\Windows\System\yCQomhV.exe
  C:\Windows\System\yCQomhV.exe
  2⤵
  PID:6576
- C:\Windows\System\pyjzxxx.exe
  C:\Windows\System\pyjzxxx.exe
  2⤵
  PID:6592
- C:\Windows\System\ToMdVBG.exe
  C:\Windows\System\ToMdVBG.exe
  2⤵
  PID:6608
- C:\Windows\System\aSDXHVo.exe
  C:\Windows\System\aSDXHVo.exe
  2⤵
  PID:6624
- C:\Windows\System\BuFLBFC.exe
  C:\Windows\System\BuFLBFC.exe
  2⤵
  PID:6640
- C:\Windows\System\FwRtCKo.exe
  C:\Windows\System\FwRtCKo.exe
  2⤵
  PID:6656
- C:\Windows\System\KWOFKKa.exe
  C:\Windows\System\KWOFKKa.exe
  2⤵
  PID:6672
- C:\Windows\System\wjVcduK.exe
  C:\Windows\System\wjVcduK.exe
  2⤵
  PID:6696
- C:\Windows\System\xiaffVd.exe
  C:\Windows\System\xiaffVd.exe
  2⤵
  PID:6712
- C:\Windows\System\TNagSaE.exe
  C:\Windows\System\TNagSaE.exe
  2⤵
  PID:6728
- C:\Windows\System\LtmoAge.exe
  C:\Windows\System\LtmoAge.exe
  2⤵
  PID:6744
- C:\Windows\System\mBebTWg.exe
  C:\Windows\System\mBebTWg.exe
  2⤵
  PID:6760
- C:\Windows\System\oLavBKP.exe
  C:\Windows\System\oLavBKP.exe
  2⤵
  PID:6780
- C:\Windows\System\MkUqgNn.exe
  C:\Windows\System\MkUqgNn.exe
  2⤵
  PID:6796
- C:\Windows\System\dNNsQDm.exe
  C:\Windows\System\dNNsQDm.exe
  2⤵
  PID:6812
- C:\Windows\System\MdzObRi.exe
  C:\Windows\System\MdzObRi.exe
  2⤵
  PID:6828
- C:\Windows\System\JyuSjKr.exe
  C:\Windows\System\JyuSjKr.exe
  2⤵
  PID:6908
- C:\Windows\System\TewYwem.exe
  C:\Windows\System\TewYwem.exe
  2⤵
  PID:6924
- C:\Windows\System\SPWkVzG.exe
  C:\Windows\System\SPWkVzG.exe
  2⤵
  PID:6940
- C:\Windows\System\NqUJgwV.exe
  C:\Windows\System\NqUJgwV.exe
  2⤵
  PID:6964
- C:\Windows\System\POAyCcw.exe
  C:\Windows\System\POAyCcw.exe
  2⤵
  PID:6980
- C:\Windows\System\msAgzEL.exe
  C:\Windows\System\msAgzEL.exe
  2⤵
  PID:6996
- C:\Windows\System\oRtfhCs.exe
  C:\Windows\System\oRtfhCs.exe
  2⤵
  PID:7012
- C:\Windows\System\tCvlrUx.exe
  C:\Windows\System\tCvlrUx.exe
  2⤵
  PID:7028
- C:\Windows\System\sOcwDLF.exe
  C:\Windows\System\sOcwDLF.exe
  2⤵
  PID:7044
- C:\Windows\System\GAiMWnW.exe
  C:\Windows\System\GAiMWnW.exe
  2⤵
  PID:7060
- C:\Windows\System\yNfOaLK.exe
  C:\Windows\System\yNfOaLK.exe
  2⤵
  PID:7076
- C:\Windows\System\aYnIcnV.exe
  C:\Windows\System\aYnIcnV.exe
  2⤵
  PID:7092
- C:\Windows\System\qEySTxj.exe
  C:\Windows\System\qEySTxj.exe
  2⤵
  PID:7112
- C:\Windows\System\azdGlZX.exe
  C:\Windows\System\azdGlZX.exe
  2⤵
  PID:7136
- C:\Windows\System\ACkUfXS.exe
  C:\Windows\System\ACkUfXS.exe
  2⤵
  PID:7152
- C:\Windows\System\lAMoqyz.exe
  C:\Windows\System\lAMoqyz.exe
  2⤵
  PID:5572
- C:\Windows\System\KnawyCw.exe
  C:\Windows\System\KnawyCw.exe
  2⤵
  PID:6208
- C:\Windows\System\pYURByk.exe
  C:\Windows\System\pYURByk.exe
  2⤵
  PID:6248
- C:\Windows\System\LLWIQlJ.exe
  C:\Windows\System\LLWIQlJ.exe
  2⤵
  PID:6260
- C:\Windows\System\ORJcgLH.exe
  C:\Windows\System\ORJcgLH.exe
  2⤵
  PID:6160
- C:\Windows\System\MmNCLAI.exe
  C:\Windows\System\MmNCLAI.exe
  2⤵
  PID:6316
- C:\Windows\System\hjesWJl.exe
  C:\Windows\System\hjesWJl.exe
  2⤵
  PID:6352
- C:\Windows\System\jimEQaw.exe
  C:\Windows\System\jimEQaw.exe
  2⤵
  PID:6356
- C:\Windows\System\tseNTpM.exe
  C:\Windows\System\tseNTpM.exe
  2⤵
  PID:6372
- C:\Windows\System\uEnwuHL.exe
  C:\Windows\System\uEnwuHL.exe
  2⤵
  PID:5924
- C:\Windows\System\xxnNMBr.exe
  C:\Windows\System\xxnNMBr.exe
  2⤵
  PID:6540
- C:\Windows\System\OuoQrwa.exe
  C:\Windows\System\OuoQrwa.exe
  2⤵
  PID:6568
- C:\Windows\System\CiQosBW.exe
  C:\Windows\System\CiQosBW.exe
  2⤵
  PID:6632
- C:\Windows\System\jvefzQr.exe
  C:\Windows\System\jvefzQr.exe
  2⤵
  PID:6652
- C:\Windows\System\SHgHySJ.exe
  C:\Windows\System\SHgHySJ.exe
  2⤵
  PID:6588
- C:\Windows\System\AqYTvYo.exe
  C:\Windows\System\AqYTvYo.exe
  2⤵
  PID:6704
- C:\Windows\System\kmxdVuf.exe
  C:\Windows\System\kmxdVuf.exe
  2⤵
  PID:6768
- C:\Windows\System\QVXbohx.exe
  C:\Windows\System\QVXbohx.exe
  2⤵
  PID:6804
- C:\Windows\System\lHgpYqg.exe
  C:\Windows\System\lHgpYqg.exe
  2⤵
  PID:6752
- C:\Windows\System\CTOcMcz.exe
  C:\Windows\System\CTOcMcz.exe
  2⤵
  PID:6788
- C:\Windows\System\UdflCiv.exe
  C:\Windows\System\UdflCiv.exe
  2⤵
  PID:6840
- C:\Windows\System\sxEnuvx.exe
  C:\Windows\System\sxEnuvx.exe
  2⤵
  PID:6864
- C:\Windows\System\PSTPtuy.exe
  C:\Windows\System\PSTPtuy.exe
  2⤵
  PID:6880
- C:\Windows\System\sQAkbus.exe
  C:\Windows\System\sQAkbus.exe
  2⤵
  PID:6900
- C:\Windows\System\rRbdnFR.exe
  C:\Windows\System\rRbdnFR.exe
  2⤵
  PID:6916
- C:\Windows\System\hrplYRJ.exe
  C:\Windows\System\hrplYRJ.exe
  2⤵
  PID:6972
- C:\Windows\System\uFmlDjc.exe
  C:\Windows\System\uFmlDjc.exe
  2⤵
  PID:7004
- C:\Windows\System\YUmWQFM.exe
  C:\Windows\System\YUmWQFM.exe
  2⤵
  PID:6180
- C:\Windows\System\JxUpgLw.exe
  C:\Windows\System\JxUpgLw.exe
  2⤵
  PID:6228
- C:\Windows\System\USfJWEQ.exe
  C:\Windows\System\USfJWEQ.exe
  2⤵
  PID:6308
- C:\Windows\System\JplfeiV.exe
  C:\Windows\System\JplfeiV.exe
  2⤵
  PID:6216
- C:\Windows\System\MhgGork.exe
  C:\Windows\System\MhgGork.exe
  2⤵
  PID:7020
- C:\Windows\System\TlcxGPe.exe
  C:\Windows\System\TlcxGPe.exe
  2⤵
  PID:7056
- C:\Windows\System\OcJblfL.exe
  C:\Windows\System\OcJblfL.exe
  2⤵
  PID:7132
- C:\Windows\System\daDTUIH.exe
  C:\Windows\System\daDTUIH.exe
  2⤵
  PID:6192
- C:\Windows\System\xfbOfWK.exe
  C:\Windows\System\xfbOfWK.exe
  2⤵
  PID:6348
- C:\Windows\System\uFNgwmV.exe
  C:\Windows\System\uFNgwmV.exe
  2⤵
  PID:6416
- C:\Windows\System\HuxWjQI.exe
  C:\Windows\System\HuxWjQI.exe
  2⤵
  PID:6432
- C:\Windows\System\AjDfhml.exe
  C:\Windows\System\AjDfhml.exe
  2⤵
  PID:6404
- C:\Windows\System\AXDeKUP.exe
  C:\Windows\System\AXDeKUP.exe
  2⤵
  PID:6516
- C:\Windows\System\lelCOZL.exe
  C:\Windows\System\lelCOZL.exe
  2⤵
  PID:6520
- C:\Windows\System\kHBlCmU.exe
  C:\Windows\System\kHBlCmU.exe
  2⤵
  PID:6600
- C:\Windows\System\XtpGndV.exe
  C:\Windows\System\XtpGndV.exe
  2⤵
  PID:6680
- C:\Windows\System\XODrZnE.exe
  C:\Windows\System\XODrZnE.exe
  2⤵
  PID:6736
- C:\Windows\System\oAROVbt.exe
  C:\Windows\System\oAROVbt.exe
  2⤵
  PID:6860
- C:\Windows\System\CKKilpO.exe
  C:\Windows\System\CKKilpO.exe
  2⤵
  PID:6892
- C:\Windows\System\trfUxtB.exe
  C:\Windows\System\trfUxtB.exe
  2⤵
  PID:7068
- C:\Windows\System\kSYGZZE.exe
  C:\Windows\System\kSYGZZE.exe
  2⤵
  PID:6820
- C:\Windows\System\gkuhUVZ.exe
  C:\Windows\System\gkuhUVZ.exe
  2⤵
  PID:7040
- C:\Windows\System\ChsZZSY.exe
  C:\Windows\System\ChsZZSY.exe
  2⤵
  PID:6872
- C:\Windows\System\umIjVJs.exe
  C:\Windows\System\umIjVJs.exe
  2⤵
  PID:6988
- C:\Windows\System\OSvzecn.exe
  C:\Windows\System\OSvzecn.exe
  2⤵
  PID:6264
- C:\Windows\System\DwpjCTO.exe
  C:\Windows\System\DwpjCTO.exe
  2⤵
  PID:6320
- C:\Windows\System\KMFPDey.exe
  C:\Windows\System\KMFPDey.exe
  2⤵
  PID:6476
- C:\Windows\System\ZskmKAR.exe
  C:\Windows\System\ZskmKAR.exe
  2⤵
  PID:6484
- C:\Windows\System\fOqULtr.exe
  C:\Windows\System\fOqULtr.exe
  2⤵
  PID:6280
- C:\Windows\System\aWLUKyV.exe
  C:\Windows\System\aWLUKyV.exe
  2⤵
  PID:6420
- C:\Windows\System\dsVACSA.exe
  C:\Windows\System\dsVACSA.exe
  2⤵
  PID:6836
- C:\Windows\System\NzgPNGK.exe
  C:\Windows\System\NzgPNGK.exe
  2⤵
  PID:7072
- C:\Windows\System\LEROZxc.exe
  C:\Windows\System\LEROZxc.exe
  2⤵
  PID:7124
- C:\Windows\System\wetVTUb.exe
  C:\Windows\System\wetVTUb.exe
  2⤵
  PID:6620
- C:\Windows\System\tEHYTAd.exe
  C:\Windows\System\tEHYTAd.exe
  2⤵
  PID:6848
- C:\Windows\System\ZuSiixq.exe
  C:\Windows\System\ZuSiixq.exe
  2⤵
  PID:7160
- C:\Windows\System\WKyheEi.exe
  C:\Windows\System\WKyheEi.exe
  2⤵
  PID:7052
- C:\Windows\System\idjIeNl.exe
  C:\Windows\System\idjIeNl.exe
  2⤵
  PID:7148
- C:\Windows\System\GhvpGdH.exe
  C:\Windows\System\GhvpGdH.exe
  2⤵
  PID:6480
- C:\Windows\System\OWuVygy.exe
  C:\Windows\System\OWuVygy.exe
  2⤵
  PID:6148
- C:\Windows\System\SXvrXYc.exe
  C:\Windows\System\SXvrXYc.exe
  2⤵
  PID:7184
- C:\Windows\System\rPypNzr.exe
  C:\Windows\System\rPypNzr.exe
  2⤵
  PID:7200
- C:\Windows\System\NZUiFXT.exe
  C:\Windows\System\NZUiFXT.exe
  2⤵
  PID:7216
- C:\Windows\System\XtjvZcT.exe
  C:\Windows\System\XtjvZcT.exe
  2⤵
  PID:7232
- C:\Windows\System\TdtBjjQ.exe
  C:\Windows\System\TdtBjjQ.exe
  2⤵
  PID:7268
- C:\Windows\System\gkfXGDI.exe
  C:\Windows\System\gkfXGDI.exe
  2⤵
  PID:7324
- C:\Windows\System\nqkjEiY.exe
  C:\Windows\System\nqkjEiY.exe
  2⤵
  PID:7352
- C:\Windows\System\eCTleSq.exe
  C:\Windows\System\eCTleSq.exe
  2⤵
  PID:7372
- C:\Windows\System\BpxwnLN.exe
  C:\Windows\System\BpxwnLN.exe
  2⤵
  PID:7388
- C:\Windows\System\Mprkrrw.exe
  C:\Windows\System\Mprkrrw.exe
  2⤵
  PID:7408
- C:\Windows\System\CYzpNBg.exe
  C:\Windows\System\CYzpNBg.exe
  2⤵
  PID:7436
- C:\Windows\System\EDRENQe.exe
  C:\Windows\System\EDRENQe.exe
  2⤵
  PID:7452
- C:\Windows\System\PqfoxmE.exe
  C:\Windows\System\PqfoxmE.exe
  2⤵
  PID:7632
- C:\Windows\System\vgnFque.exe
  C:\Windows\System\vgnFque.exe
  2⤵
  PID:7680
- C:\Windows\System\hYmQDhI.exe
  C:\Windows\System\hYmQDhI.exe
  2⤵
  PID:7696
- C:\Windows\System\OFDDkgl.exe
  C:\Windows\System\OFDDkgl.exe
  2⤵
  PID:7716
- C:\Windows\System\TOpXonL.exe
  C:\Windows\System\TOpXonL.exe
  2⤵
  PID:7736
- C:\Windows\System\oxWMwQz.exe
  C:\Windows\System\oxWMwQz.exe
  2⤵
  PID:7752
- C:\Windows\System\BeTaTxA.exe
  C:\Windows\System\BeTaTxA.exe
  2⤵
  PID:7768
- C:\Windows\System\sBLqIvF.exe
  C:\Windows\System\sBLqIvF.exe
  2⤵
  PID:7788
- C:\Windows\System\lXbhQEX.exe
  C:\Windows\System\lXbhQEX.exe
  2⤵
  PID:7864
- C:\Windows\System\duIgktr.exe
  C:\Windows\System\duIgktr.exe
  2⤵
  PID:7880
- C:\Windows\System\wfceuyA.exe
  C:\Windows\System\wfceuyA.exe
  2⤵
  PID:7896
- C:\Windows\System\eQduXPI.exe
  C:\Windows\System\eQduXPI.exe
  2⤵
  PID:7912
- C:\Windows\System\gSsjEzG.exe
  C:\Windows\System\gSsjEzG.exe
  2⤵
  PID:7928
- C:\Windows\System\nbTQctg.exe
  C:\Windows\System\nbTQctg.exe
  2⤵
  PID:7944
- C:\Windows\System\lmKGcdh.exe
  C:\Windows\System\lmKGcdh.exe
  2⤵
  PID:7960
- C:\Windows\System\JpESFru.exe
  C:\Windows\System\JpESFru.exe
  2⤵
  PID:7976
- C:\Windows\System\icWcIdp.exe
  C:\Windows\System\icWcIdp.exe
  2⤵
  PID:7992
- C:\Windows\System\WZnOOjh.exe
  C:\Windows\System\WZnOOjh.exe
  2⤵
  PID:8008
- C:\Windows\System\yKiHePz.exe
  C:\Windows\System\yKiHePz.exe
  2⤵
  PID:8024
- C:\Windows\System\QanTYBZ.exe
  C:\Windows\System\QanTYBZ.exe
  2⤵
  PID:8040
- C:\Windows\System\mfNhVLE.exe
  C:\Windows\System\mfNhVLE.exe
  2⤵
  PID:8056
- C:\Windows\System\CxYqsxI.exe
  C:\Windows\System\CxYqsxI.exe
  2⤵
  PID:8072
- C:\Windows\System\bsPbKTk.exe
  C:\Windows\System\bsPbKTk.exe
  2⤵
  PID:8088
- C:\Windows\System\upfMDhb.exe
  C:\Windows\System\upfMDhb.exe
  2⤵
  PID:8104
- C:\Windows\System\TcUwvcS.exe
  C:\Windows\System\TcUwvcS.exe
  2⤵
  PID:7508
- C:\Windows\System\lGkXrVm.exe
  C:\Windows\System\lGkXrVm.exe
  2⤵
  PID:6948
- C:\Windows\System\XjwZDQN.exe
  C:\Windows\System\XjwZDQN.exe
  2⤵
  PID:6436
- C:\Windows\System\cuFbizG.exe
  C:\Windows\System\cuFbizG.exe
  2⤵
  PID:7224
- C:\Windows\System\tIILayr.exe
  C:\Windows\System\tIILayr.exe
  2⤵
  PID:7244
- C:\Windows\System\zzcwVqI.exe
  C:\Windows\System\zzcwVqI.exe
  2⤵
  PID:7296
- C:\Windows\System\mIJHMMx.exe
  C:\Windows\System\mIJHMMx.exe
  2⤵
  PID:7336
- C:\Windows\System\VgdHGcc.exe
  C:\Windows\System\VgdHGcc.exe
  2⤵
  PID:7616
- C:\Windows\System\DaHMocK.exe
  C:\Windows\System\DaHMocK.exe
  2⤵
  PID:7692
- C:\Windows\System\WJwqRtK.exe
  C:\Windows\System\WJwqRtK.exe
  2⤵
  PID:7648
- C:\Windows\System\HAvNBns.exe
  C:\Windows\System\HAvNBns.exe
  2⤵
  PID:7748
- C:\Windows\System\uGNSgbY.exe
  C:\Windows\System\uGNSgbY.exe
  2⤵
  PID:8068
- C:\Windows\System\IpTBYcO.exe
  C:\Windows\System\IpTBYcO.exe
  2⤵
  PID:7824
- C:\Windows\System\JJaKTZP.exe
  C:\Windows\System\JJaKTZP.exe
  2⤵
  PID:7804
- C:\Windows\System\akAPoXZ.exe
  C:\Windows\System\akAPoXZ.exe
  2⤵
  PID:7668
- C:\Windows\System\VljWCRZ.exe
  C:\Windows\System\VljWCRZ.exe
  2⤵
  PID:7816
- C:\Windows\System\KHLJfdh.exe
  C:\Windows\System\KHLJfdh.exe
  2⤵
  PID:7180
- C:\Windows\System\Bwmexfd.exe
  C:\Windows\System\Bwmexfd.exe
  2⤵
  PID:7488
- C:\Windows\System\eGyBway.exe
  C:\Windows\System\eGyBway.exe
  2⤵
  PID:8208
- C:\Windows\System\digTSHc.exe
  C:\Windows\System\digTSHc.exe
  2⤵
  PID:8224
- C:\Windows\System\xVewtvK.exe
  C:\Windows\System\xVewtvK.exe
  2⤵
  PID:8240
- C:\Windows\System\FgdqMKY.exe
  C:\Windows\System\FgdqMKY.exe
  2⤵
  PID:8256
- C:\Windows\System\fpMbKud.exe
  C:\Windows\System\fpMbKud.exe
  2⤵
  PID:8272
- C:\Windows\System\KKKQjkR.exe
  C:\Windows\System\KKKQjkR.exe
  2⤵
  PID:8312
- C:\Windows\System\QgFlPHx.exe
  C:\Windows\System\QgFlPHx.exe
  2⤵
  PID:8464
- C:\Windows\System\UFWDOoU.exe
  C:\Windows\System\UFWDOoU.exe
  2⤵
  PID:8484
- C:\Windows\System\yzqfYZy.exe
  C:\Windows\System\yzqfYZy.exe
  2⤵
  PID:8508
- C:\Windows\System\IwudOMU.exe
  C:\Windows\System\IwudOMU.exe
  2⤵
  PID:8580
- C:\Windows\System\MkLOfbJ.exe
  C:\Windows\System\MkLOfbJ.exe
  2⤵
  PID:8596
- C:\Windows\System\BofXnFy.exe
  C:\Windows\System\BofXnFy.exe
  2⤵
  PID:8612
- C:\Windows\System\YhCdgxY.exe
  C:\Windows\System\YhCdgxY.exe
  2⤵
  PID:8628
- C:\Windows\System\kRTxvYG.exe
  C:\Windows\System\kRTxvYG.exe
  2⤵
  PID:8644
- C:\Windows\System\MfUkwGY.exe
  C:\Windows\System\MfUkwGY.exe
  2⤵
  PID:8660
- C:\Windows\System\kFQfFsF.exe
  C:\Windows\System\kFQfFsF.exe
  2⤵
  PID:8676
- C:\Windows\System\oUyrhvx.exe
  C:\Windows\System\oUyrhvx.exe
  2⤵
  PID:8692
- C:\Windows\System\PxsZSIo.exe
  C:\Windows\System\PxsZSIo.exe
  2⤵
  PID:8708
- C:\Windows\System\vzwaIZh.exe
  C:\Windows\System\vzwaIZh.exe
  2⤵
  PID:8724
- C:\Windows\System\HfsSULx.exe
  C:\Windows\System\HfsSULx.exe
  2⤵
  PID:8740
- C:\Windows\System\bivajuh.exe
  C:\Windows\System\bivajuh.exe
  2⤵
  PID:8756
- C:\Windows\System\AhNfAtA.exe
  C:\Windows\System\AhNfAtA.exe
  2⤵
  PID:8772
- C:\Windows\System\WejNyzi.exe
  C:\Windows\System\WejNyzi.exe
  2⤵
  PID:8816
- C:\Windows\System\wggvayX.exe
  C:\Windows\System\wggvayX.exe
  2⤵
  PID:8844
- C:\Windows\System\iiGSITO.exe
  C:\Windows\System\iiGSITO.exe
  2⤵
  PID:8872
- C:\Windows\System\EKPrWEx.exe
  C:\Windows\System\EKPrWEx.exe
  2⤵
  PID:8892
- C:\Windows\System\GXOQnlP.exe
  C:\Windows\System\GXOQnlP.exe
  2⤵
  PID:8908
- C:\Windows\System\AcJHLxn.exe
  C:\Windows\System\AcJHLxn.exe
  2⤵
  PID:8928
- C:\Windows\System\hZKSVWL.exe
  C:\Windows\System\hZKSVWL.exe
  2⤵
  PID:8972
- C:\Windows\System\TtugLDF.exe
  C:\Windows\System\TtugLDF.exe
  2⤵
  PID:8988
- C:\Windows\System\WafOQDR.exe
  C:\Windows\System\WafOQDR.exe
  2⤵
  PID:9004
- C:\Windows\System\RBIFRAj.exe
  C:\Windows\System\RBIFRAj.exe
  2⤵
  PID:9020
- C:\Windows\System\UrIXzmx.exe
  C:\Windows\System\UrIXzmx.exe
  2⤵
  PID:9036
- C:\Windows\System\SvZlBBE.exe
  C:\Windows\System\SvZlBBE.exe
  2⤵
  PID:9052
- C:\Windows\System\ulMjoNZ.exe
  C:\Windows\System\ulMjoNZ.exe
  2⤵
  PID:9068
- C:\Windows\System\ctfXTMD.exe
  C:\Windows\System\ctfXTMD.exe
  2⤵
  PID:9084
- C:\Windows\System\zIAByVj.exe
  C:\Windows\System\zIAByVj.exe
  2⤵
  PID:9100
- C:\Windows\System\nexwdkI.exe
  C:\Windows\System\nexwdkI.exe
  2⤵
  PID:9116
- C:\Windows\System\dTScGUy.exe
  C:\Windows\System\dTScGUy.exe
  2⤵
  PID:9132
- C:\Windows\System\wwiXOtB.exe
  C:\Windows\System\wwiXOtB.exe
  2⤵
  PID:9148
- C:\Windows\System\yvWvgoj.exe
  C:\Windows\System\yvWvgoj.exe
  2⤵
  PID:9164
- C:\Windows\System\AmJrPge.exe
  C:\Windows\System\AmJrPge.exe
  2⤵
  PID:9180
- C:\Windows\System\wRfnyfv.exe
  C:\Windows\System\wRfnyfv.exe
  2⤵
  PID:9196
- C:\Windows\System\WLQcKij.exe
  C:\Windows\System\WLQcKij.exe
  2⤵
  PID:9212
- C:\Windows\System\FHdMcRh.exe
  C:\Windows\System\FHdMcRh.exe
  2⤵
  PID:8236
- C:\Windows\System\WjTLtAv.exe
  C:\Windows\System\WjTLtAv.exe
  2⤵
  PID:7420
- C:\Windows\System\WIuffxx.exe
  C:\Windows\System\WIuffxx.exe
  2⤵
  PID:7476
- C:\Windows\System\uYCrMgJ.exe
  C:\Windows\System\uYCrMgJ.exe
  2⤵
  PID:7504
- C:\Windows\System\rnsJKTp.exe
  C:\Windows\System\rnsJKTp.exe
  2⤵
  PID:6920
- C:\Windows\System\RRuigCV.exe
  C:\Windows\System\RRuigCV.exe
  2⤵
  PID:7524
- C:\Windows\System\ikHfvgn.exe
  C:\Windows\System\ikHfvgn.exe
  2⤵
  PID:7240
- C:\Windows\System\JKVkfGf.exe
  C:\Windows\System\JKVkfGf.exe
  2⤵
  PID:7448
- C:\Windows\System\ozSzIKV.exe
  C:\Windows\System\ozSzIKV.exe
  2⤵
  PID:7952
- C:\Windows\System\CaPucCp.exe
  C:\Windows\System\CaPucCp.exe
  2⤵
  PID:7428
- C:\Windows\System\etoEiRK.exe
  C:\Windows\System\etoEiRK.exe
  2⤵
  PID:6688
- C:\Windows\System\iEQCmtL.exe
  C:\Windows\System\iEQCmtL.exe
  2⤵
  PID:7172
- C:\Windows\System\sbfFfOM.exe
  C:\Windows\System\sbfFfOM.exe
  2⤵
  PID:7364
- C:\Windows\System\FVbSKhc.exe
  C:\Windows\System\FVbSKhc.exe
  2⤵
  PID:7360
- C:\Windows\System\AXmNKNp.exe
  C:\Windows\System\AXmNKNp.exe
  2⤵
  PID:844
- C:\Windows\System\zhwJRom.exe
  C:\Windows\System\zhwJRom.exe
  2⤵
  PID:7500
- C:\Windows\System\demFGQS.exe
  C:\Windows\System\demFGQS.exe
  2⤵
  PID:8252
- C:\Windows\System\TxGhJFG.exe
  C:\Windows\System\TxGhJFG.exe
  2⤵
  PID:8320
- C:\Windows\System\tPOaWnn.exe
  C:\Windows\System\tPOaWnn.exe
  2⤵
  PID:8336
- C:\Windows\System\qUUqQUb.exe
  C:\Windows\System\qUUqQUb.exe
  2⤵
  PID:8284
- C:\Windows\System\QfVakcj.exe
  C:\Windows\System\QfVakcj.exe
  2⤵
  PID:8364
- C:\Windows\System\pxpEspN.exe
  C:\Windows\System\pxpEspN.exe
  2⤵
  PID:8380
- C:\Windows\System\yXyuhgy.exe
  C:\Windows\System\yXyuhgy.exe
  2⤵
  PID:8400
- C:\Windows\System\jBNrEOR.exe
  C:\Windows\System\jBNrEOR.exe
  2⤵
  PID:8412
- C:\Windows\System\KzLeqda.exe
  C:\Windows\System\KzLeqda.exe
  2⤵
  PID:8432
- C:\Windows\System\BERldWW.exe
  C:\Windows\System\BERldWW.exe
  2⤵
  PID:8416
- C:\Windows\System\nPtjmwL.exe
  C:\Windows\System\nPtjmwL.exe
  2⤵
  PID:8684
- C:\Windows\System\RWzBevx.exe
  C:\Windows\System\RWzBevx.exe
  2⤵
  PID:8592
- C:\Windows\System\aoaiLfH.exe
  C:\Windows\System\aoaiLfH.exe
  2⤵
  PID:8504
- C:\Windows\System\xdKuUxg.exe
  C:\Windows\System\xdKuUxg.exe
  2⤵
  PID:8720
- C:\Windows\System\LrlTrtq.exe
  C:\Windows\System\LrlTrtq.exe
  2⤵
  PID:8780
- C:\Windows\System\PgeRIkw.exe
  C:\Windows\System\PgeRIkw.exe
  2⤵
  PID:8800
- C:\Windows\System\xzHbSjt.exe
  C:\Windows\System\xzHbSjt.exe
  2⤵
  PID:8812
- C:\Windows\System\XfOaaKO.exe
  C:\Windows\System\XfOaaKO.exe
  2⤵
  PID:8864
- C:\Windows\System\tCpSraq.exe
  C:\Windows\System\tCpSraq.exe
  2⤵
  PID:8904
- C:\Windows\System\jcgqMNz.exe
  C:\Windows\System\jcgqMNz.exe
  2⤵
  PID:8956
- C:\Windows\System\COBDvtJ.exe
  C:\Windows\System\COBDvtJ.exe
  2⤵
  PID:8524
- C:\Windows\System\AdtikoF.exe
  C:\Windows\System\AdtikoF.exe
  2⤵
  PID:8940
- C:\Windows\System\qpfflbG.exe
  C:\Windows\System\qpfflbG.exe
  2⤵
  PID:9000
- C:\Windows\System\WCdDDou.exe
  C:\Windows\System\WCdDDou.exe
  2⤵
  PID:9092
- C:\Windows\System\GKTZoGA.exe
  C:\Windows\System\GKTZoGA.exe
  2⤵
  PID:8568
- C:\Windows\System\XwIYglv.exe
  C:\Windows\System\XwIYglv.exe
  2⤵
  PID:8672
- C:\Windows\System\eRNuUJA.exe
  C:\Windows\System\eRNuUJA.exe
  2⤵
  PID:8768
- C:\Windows\System\jtxRfel.exe
  C:\Windows\System\jtxRfel.exe
  2⤵
  PID:9188
- C:\Windows\System\HFbljLj.exe
  C:\Windows\System\HFbljLj.exe
  2⤵
  PID:7468
- C:\Windows\System\iknPquR.exe
  C:\Windows\System\iknPquR.exe
  2⤵
  PID:2320
- C:\Windows\System\PZvgfvt.exe
  C:\Windows\System\PZvgfvt.exe
  2⤵
  PID:8832
- C:\Windows\System\YuOmNCe.exe
  C:\Windows\System\YuOmNCe.exe
  2⤵
  PID:8460
- C:\Windows\System\WaoeabM.exe
  C:\Windows\System\WaoeabM.exe
  2⤵
  PID:8984
- C:\Windows\System\JEkcrLS.exe
  C:\Windows\System\JEkcrLS.exe
  2⤵
  PID:9016
- C:\Windows\System\ngMgRAC.exe
  C:\Windows\System\ngMgRAC.exe
  2⤵
  PID:9112
- C:\Windows\System\jdkFibD.exe
  C:\Windows\System\jdkFibD.exe
  2⤵
  PID:7644
- C:\Windows\System\Pbxwyjq.exe
  C:\Windows\System\Pbxwyjq.exe
  2⤵
  PID:7796
- C:\Windows\System\yBSUccb.exe
  C:\Windows\System\yBSUccb.exe
  2⤵
  PID:9140
- C:\Windows\System\OaspMmR.exe
  C:\Windows\System\OaspMmR.exe
  2⤵
  PID:7248
- C:\Windows\System\WyPvXsu.exe
  C:\Windows\System\WyPvXsu.exe
  2⤵
  PID:7544
- C:\Windows\System\krpLvpS.exe
  C:\Windows\System\krpLvpS.exe
  2⤵
  PID:7808
- C:\Windows\System\TwKwAgH.exe
  C:\Windows\System\TwKwAgH.exe
  2⤵
  PID:7464
- C:\Windows\System\btmXypB.exe
  C:\Windows\System\btmXypB.exe
  2⤵
  PID:7828
- C:\Windows\System\rLbGiQC.exe
  C:\Windows\System\rLbGiQC.exe
  2⤵
  PID:8048
- C:\Windows\System\mxiIVHS.exe
  C:\Windows\System\mxiIVHS.exe
  2⤵
  PID:8180
- C:\Windows\System\wFYxIIS.exe
  C:\Windows\System\wFYxIIS.exe
  2⤵
  PID:1612
- C:\Windows\System\pNvTYHD.exe
  C:\Windows\System\pNvTYHD.exe
  2⤵
  PID:7404
- C:\Windows\System\WWdPakl.exe
  C:\Windows\System\WWdPakl.exe
  2⤵
  PID:8404
- C:\Windows\System\FEynPbL.exe
  C:\Windows\System\FEynPbL.exe
  2⤵
  PID:8688
- C:\Windows\System\sYahEfv.exe
  C:\Windows\System\sYahEfv.exe
  2⤵
  PID:7608
- C:\Windows\System\uIKKVtv.exe
  C:\Windows\System\uIKKVtv.exe
  2⤵
  PID:7856
- C:\Windows\System\GwEGZWi.exe
  C:\Windows\System\GwEGZWi.exe
  2⤵
  PID:7988
- C:\Windows\System\aimmbBx.exe
  C:\Windows\System\aimmbBx.exe
  2⤵
  PID:8188
- C:\Windows\System\eRxJvuA.exe
  C:\Windows\System\eRxJvuA.exe
  2⤵
  PID:8136
- C:\Windows\System\YSRNMyF.exe
  C:\Windows\System\YSRNMyF.exe
  2⤵
  PID:7212
- C:\Windows\System\wEcAzRV.exe
  C:\Windows\System\wEcAzRV.exe
  2⤵
  PID:7264
- C:\Windows\System\UUTFQAX.exe
  C:\Windows\System\UUTFQAX.exe
  2⤵
  PID:7620
- C:\Windows\System\KCnbdRu.exe
  C:\Windows\System\KCnbdRu.exe
  2⤵
  PID:7732
- C:\Windows\System\yNGEKYl.exe
  C:\Windows\System\yNGEKYl.exe
  2⤵
  PID:7664
- C:\Windows\System\ggYcbhi.exe
  C:\Windows\System\ggYcbhi.exe
  2⤵
  PID:7744
- C:\Windows\System\xlNeYGX.exe
  C:\Windows\System\xlNeYGX.exe
  2⤵
  PID:7780
- C:\Windows\System\BczOhaH.exe
  C:\Windows\System\BczOhaH.exe
  2⤵
  PID:8100
- C:\Windows\System\aCElEYV.exe
  C:\Windows\System\aCElEYV.exe
  2⤵
  PID:7532
- C:\Windows\System\BiAVqgd.exe
  C:\Windows\System\BiAVqgd.exe
  2⤵
  PID:6584
- C:\Windows\System\xNURrpn.exe
  C:\Windows\System\xNURrpn.exe
  2⤵
  PID:7276
- C:\Windows\System\curzhYv.exe
  C:\Windows\System\curzhYv.exe
  2⤵
  PID:7368
- C:\Windows\System\sLhduHf.exe
  C:\Windows\System\sLhduHf.exe
  2⤵
  PID:8332
- C:\Windows\System\FxtJvkO.exe
  C:\Windows\System\FxtJvkO.exe
  2⤵
  PID:8392
- C:\Windows\System\ZZZoeYH.exe
  C:\Windows\System\ZZZoeYH.exe
  2⤵
  PID:8456
- C:\Windows\System\dDKxJRW.exe
  C:\Windows\System\dDKxJRW.exe
  2⤵
  PID:8804
- C:\Windows\System\aftxaNi.exe
  C:\Windows\System\aftxaNi.exe
  2⤵
  PID:8964
- C:\Windows\System\tamOmvN.exe
  C:\Windows\System\tamOmvN.exe
  2⤵
  PID:8548
- C:\Windows\System\UUaDmTH.exe
  C:\Windows\System\UUaDmTH.exe
  2⤵
  PID:8948
- C:\Windows\System\afLBahD.exe
  C:\Windows\System\afLBahD.exe
  2⤵
  PID:8764
- C:\Windows\System\VpexjqI.exe
  C:\Windows\System\VpexjqI.exe
  2⤵
  PID:8828
- C:\Windows\System\jQchCtX.exe
  C:\Windows\System\jQchCtX.exe
  2⤵
  PID:8300
- C:\Windows\System\mByBdzD.exe
  C:\Windows\System\mByBdzD.exe
  2⤵
  PID:9080
- C:\Windows\System\nycbfgA.exe
  C:\Windows\System\nycbfgA.exe
  2⤵
  PID:8096
- C:\Windows\System\VYTfTmR.exe
  C:\Windows\System\VYTfTmR.exe
  2⤵
  PID:8916
- C:\Windows\System\ZMqwEJO.exe
  C:\Windows\System\ZMqwEJO.exe
  2⤵
  PID:8268
- C:\Windows\System\ELYjdxg.exe
  C:\Windows\System\ELYjdxg.exe
  2⤵
  PID:8920
- C:\Windows\System\selVAdT.exe
  C:\Windows\System\selVAdT.exe
  2⤵
  PID:8540
- C:\Windows\System\PHbqwwz.exe
  C:\Windows\System\PHbqwwz.exe
  2⤵
  PID:8572
- C:\Windows\System\jYTUPpa.exe
  C:\Windows\System\jYTUPpa.exe
  2⤵
  PID:7516
- C:\Windows\System\HnNkbdI.exe
  C:\Windows\System\HnNkbdI.exe
  2⤵
  PID:9044
- C:\Windows\System\hAYbsBi.exe
  C:\Windows\System\hAYbsBi.exe
  2⤵
  PID:8532
- C:\Windows\System\UqRyrZQ.exe
  C:\Windows\System\UqRyrZQ.exe
  2⤵
  PID:952
- C:\Windows\System\lMceQzp.exe
  C:\Windows\System\lMceQzp.exe
  2⤵
  PID:8184
- C:\Windows\System\XEFjmeB.exe
  C:\Windows\System\XEFjmeB.exe
  2⤵
  PID:8112
- C:\Windows\System\zpipnxj.exe
  C:\Windows\System\zpipnxj.exe
  2⤵
  PID:1396
- C:\Windows\System\xIHNpcV.exe
  C:\Windows\System\xIHNpcV.exe
  2⤵
  PID:7984
- C:\Windows\System\cAssBxI.exe
  C:\Windows\System\cAssBxI.exe
  2⤵
  PID:2056
- C:\Windows\System\cSRMxcT.exe
  C:\Windows\System\cSRMxcT.exe
  2⤵
  PID:8128
- C:\Windows\System\wgpwVJH.exe
  C:\Windows\System\wgpwVJH.exe
  2⤵
  PID:2740
- C:\Windows\System\GhOvTEQ.exe
  C:\Windows\System\GhOvTEQ.exe
  2⤵
  PID:8348
- C:\Windows\System\YoQHoWJ.exe
  C:\Windows\System\YoQHoWJ.exe
  2⤵
  PID:8304
- C:\Windows\System\KkKjAnu.exe
  C:\Windows\System\KkKjAnu.exe
  2⤵
  PID:8376
- C:\Windows\System\MLBHvqR.exe
  C:\Windows\System\MLBHvqR.exe
  2⤵
  PID:7852
- C:\Windows\System\EuOrhWy.exe
  C:\Windows\System\EuOrhWy.exe
  2⤵
  PID:8084
- C:\Windows\System\brrjkJp.exe
  C:\Windows\System\brrjkJp.exe
  2⤵
  PID:6648
- C:\Windows\System\CKkmLti.exe
  C:\Windows\System\CKkmLti.exe
  2⤵
  PID:7872
- C:\Windows\System\WjJvKdt.exe
  C:\Windows\System\WjJvKdt.exe
  2⤵
  PID:7308
- C:\Windows\System\gpTiZmC.exe
  C:\Windows\System\gpTiZmC.exe
  2⤵
  PID:7708
- C:\Windows\System\QTJTGrz.exe
  C:\Windows\System\QTJTGrz.exe
  2⤵
  PID:8064
- C:\Windows\System\PgWrxFm.exe
  C:\Windows\System\PgWrxFm.exe
  2⤵
  PID:7892
- C:\Windows\System\xVCTbQj.exe
  C:\Windows\System\xVCTbQj.exe
  2⤵
  PID:8220
- C:\Windows\System\xDIcMwc.exe
  C:\Windows\System\xDIcMwc.exe
  2⤵
  PID:7280
- C:\Windows\System\ZNzzqig.exe
  C:\Windows\System\ZNzzqig.exe
  2⤵
  PID:8748
- C:\Windows\System\yBvtAAs.exe
  C:\Windows\System\yBvtAAs.exe
  2⤵
  PID:8856
- C:\Windows\System\EERanOK.exe
  C:\Windows\System\EERanOK.exe
  2⤵
  PID:8996
- C:\Windows\System\bGuTCis.exe
  C:\Windows\System\bGuTCis.exe
  2⤵
  PID:8792
- C:\Windows\System\mMUixAW.exe
  C:\Windows\System\mMUixAW.exe
  2⤵
  PID:8952
- C:\Windows\System\LDaQtIT.exe
  C:\Windows\System\LDaQtIT.exe
  2⤵
  PID:9204
- C:\Windows\System\QGsqrJl.exe
  C:\Windows\System\QGsqrJl.exe
  2⤵
  PID:8732
- C:\Windows\System\lgOaWKg.exe
  C:\Windows\System\lgOaWKg.exe
  2⤵
  PID:9064
- C:\Windows\System\vVAPXRY.exe
  C:\Windows\System\vVAPXRY.exe
  2⤵
  PID:9160
- C:\Windows\System\ltxzLIf.exe
  C:\Windows\System\ltxzLIf.exe
  2⤵
  PID:9048
- C:\Windows\System\vwQtsMu.exe
  C:\Windows\System\vwQtsMu.exe
  2⤵
  PID:7312
- C:\Windows\System\JtPmlIX.exe
  C:\Windows\System\JtPmlIX.exe
  2⤵
  PID:8152
- C:\Windows\System\viTFpQq.exe
  C:\Windows\System\viTFpQq.exe
  2⤵
  PID:7340
- C:\Windows\System\XPwzsuJ.exe
  C:\Windows\System\XPwzsuJ.exe
  2⤵
  PID:8156
- C:\Windows\System\rMDiKzF.exe
  C:\Windows\System\rMDiKzF.exe
  2⤵
  PID:7924
- C:\Windows\System\ZLZsTow.exe
  C:\Windows\System\ZLZsTow.exe
  2⤵
  PID:8308
- C:\Windows\System\QqspYTp.exe
  C:\Windows\System\QqspYTp.exe
  2⤵
  PID:7704
- C:\Windows\System\WeXIqcg.exe
  C:\Windows\System\WeXIqcg.exe
  2⤵
  PID:7288
- C:\Windows\System\BnrHCsh.exe
  C:\Windows\System\BnrHCsh.exe
  2⤵
  PID:8560
- C:\Windows\System\KrlmGwz.exe
  C:\Windows\System\KrlmGwz.exe
  2⤵
  PID:7876
- C:\Windows\System\LugGxbC.exe
  C:\Windows\System\LugGxbC.exe
  2⤵
  PID:7724
- C:\Windows\System\MSdIhBK.exe
  C:\Windows\System\MSdIhBK.exe
  2⤵
  PID:8160
- C:\Windows\System\isEvkTG.exe
  C:\Windows\System\isEvkTG.exe
  2⤵
  PID:2156
- C:\Windows\System\ALaERwj.exe
  C:\Windows\System\ALaERwj.exe
  2⤵
  PID:8360
- C:\Windows\System\GwZHrFu.exe
  C:\Windows\System\GwZHrFu.exe
  2⤵
  PID:8388
- C:\Windows\System\PNynSVj.exe
  C:\Windows\System\PNynSVj.exe
  2⤵
  PID:7612
- C:\Windows\System\NxpPMfC.exe
  C:\Windows\System\NxpPMfC.exe
  2⤵
  PID:8148
- C:\Windows\System\jBYsmOg.exe
  C:\Windows\System\jBYsmOg.exe
  2⤵
  PID:7444
- C:\Windows\System\HPtJxHI.exe
  C:\Windows\System\HPtJxHI.exe
  2⤵
  PID:7652
- C:\Windows\System\kFcziMq.exe
  C:\Windows\System\kFcziMq.exe
  2⤵
  PID:8704
- C:\Windows\System\hoBTwjG.exe
  C:\Windows\System\hoBTwjG.exe
  2⤵
  PID:6904
- C:\Windows\System\MzsQyVh.exe
  C:\Windows\System\MzsQyVh.exe
  2⤵
  PID:8868
- C:\Windows\System\MkYUCji.exe
  C:\Windows\System\MkYUCji.exe
  2⤵
  PID:8736
- C:\Windows\System\uNAtRMf.exe
  C:\Windows\System\uNAtRMf.exe
  2⤵
  PID:8636
- C:\Windows\System\RmbORFz.exe
  C:\Windows\System\RmbORFz.exe
  2⤵
  PID:9096
- C:\Windows\System\AaUaHvR.exe
  C:\Windows\System\AaUaHvR.exe
  2⤵
  PID:8124
- C:\Windows\System\DoPshQS.exe
  C:\Windows\System\DoPshQS.exe
  2⤵
  PID:9224
- C:\Windows\System\mErSYeM.exe
  C:\Windows\System\mErSYeM.exe
  2⤵
  PID:9240
- C:\Windows\System\nbKLPvZ.exe
  C:\Windows\System\nbKLPvZ.exe
  2⤵
  PID:9256
- C:\Windows\System\ExuGrII.exe
  C:\Windows\System\ExuGrII.exe
  2⤵
  PID:9272
- C:\Windows\System\GPRRLJG.exe
  C:\Windows\System\GPRRLJG.exe
  2⤵
  PID:9292
- C:\Windows\System\FsKyizS.exe
  C:\Windows\System\FsKyizS.exe
  2⤵
  PID:9308
- C:\Windows\System\KPhBfol.exe
  C:\Windows\System\KPhBfol.exe
  2⤵
  PID:9324
- C:\Windows\System\UAzwkLL.exe
  C:\Windows\System\UAzwkLL.exe
  2⤵
  PID:9340
- C:\Windows\System\clARrcg.exe
  C:\Windows\System\clARrcg.exe
  2⤵
  PID:9356
- C:\Windows\System\XjvMAta.exe
  C:\Windows\System\XjvMAta.exe
  2⤵
  PID:9372
- C:\Windows\System\uzfsnxk.exe
  C:\Windows\System\uzfsnxk.exe
  2⤵
  PID:9388
- C:\Windows\System\NDXzgVJ.exe
  C:\Windows\System\NDXzgVJ.exe
  2⤵
  PID:9404
- C:\Windows\System\XxznigZ.exe
  C:\Windows\System\XxznigZ.exe
  2⤵
  PID:9420
- C:\Windows\System\mcUsgmq.exe
  C:\Windows\System\mcUsgmq.exe
  2⤵
  PID:9436
- C:\Windows\System\KFophaB.exe
  C:\Windows\System\KFophaB.exe
  2⤵
  PID:9452
- C:\Windows\System\fPNMjqw.exe
  C:\Windows\System\fPNMjqw.exe
  2⤵
  PID:9468
- C:\Windows\System\UqcrGTm.exe
  C:\Windows\System\UqcrGTm.exe
  2⤵
  PID:9484
- C:\Windows\System\YMmYaXV.exe
  C:\Windows\System\YMmYaXV.exe
  2⤵
  PID:9500
- C:\Windows\System\iBhpONk.exe
  C:\Windows\System\iBhpONk.exe
  2⤵
  PID:9516
- C:\Windows\System\CLWGXOZ.exe
  C:\Windows\System\CLWGXOZ.exe
  2⤵
  PID:9532
- C:\Windows\System\Oflspnv.exe
  C:\Windows\System\Oflspnv.exe
  2⤵
  PID:9548
- C:\Windows\System\WkfhmFB.exe
  C:\Windows\System\WkfhmFB.exe
  2⤵
  PID:9564
- C:\Windows\System\qlUvaHr.exe
  C:\Windows\System\qlUvaHr.exe
  2⤵
  PID:9580
- C:\Windows\System\RidOJDh.exe
  C:\Windows\System\RidOJDh.exe
  2⤵
  PID:9596
- C:\Windows\System\CzAJfnb.exe
  C:\Windows\System\CzAJfnb.exe
  2⤵
  PID:9612
- C:\Windows\System\IfFnDAc.exe
  C:\Windows\System\IfFnDAc.exe
  2⤵
  PID:9628
- C:\Windows\System\dWNVzkR.exe
  C:\Windows\System\dWNVzkR.exe
  2⤵
  PID:9644
- C:\Windows\System\shzFwRa.exe
  C:\Windows\System\shzFwRa.exe
  2⤵
  PID:9660
- C:\Windows\System\dsnHGnY.exe
  C:\Windows\System\dsnHGnY.exe
  2⤵
  PID:9676
- C:\Windows\System\fqmbBGl.exe
  C:\Windows\System\fqmbBGl.exe
  2⤵
  PID:9692
- C:\Windows\System\cGqlQtw.exe
  C:\Windows\System\cGqlQtw.exe
  2⤵
  PID:9708
- C:\Windows\System\wlhEchD.exe
  C:\Windows\System\wlhEchD.exe
  2⤵
  PID:9724
- C:\Windows\System\WubWlSW.exe
  C:\Windows\System\WubWlSW.exe
  2⤵
  PID:9740
- C:\Windows\System\ILlJwFD.exe
  C:\Windows\System\ILlJwFD.exe
  2⤵
  PID:9756
- C:\Windows\System\GehJeLA.exe
  C:\Windows\System\GehJeLA.exe
  2⤵
  PID:9772
- C:\Windows\System\QPgCYUI.exe
  C:\Windows\System\QPgCYUI.exe
  2⤵
  PID:9788
- C:\Windows\System\HYQugTj.exe
  C:\Windows\System\HYQugTj.exe
  2⤵
  PID:9804
- C:\Windows\System\VLJlNch.exe
  C:\Windows\System\VLJlNch.exe
  2⤵
  PID:9820
- C:\Windows\System\lCVNcMb.exe
  C:\Windows\System\lCVNcMb.exe
  2⤵
  PID:9836
- C:\Windows\System\QiYpfJv.exe
  C:\Windows\System\QiYpfJv.exe
  2⤵
  PID:9852
- C:\Windows\System\SzvSmWf.exe
  C:\Windows\System\SzvSmWf.exe
  2⤵
  PID:9868
- C:\Windows\System\DTLKcPt.exe
  C:\Windows\System\DTLKcPt.exe
  2⤵
  PID:9884
- C:\Windows\System\HfixowI.exe
  C:\Windows\System\HfixowI.exe
  2⤵
  PID:9900
- C:\Windows\System\liRaHiq.exe
  C:\Windows\System\liRaHiq.exe
  2⤵
  PID:9916
- C:\Windows\System\mhGJham.exe
  C:\Windows\System\mhGJham.exe
  2⤵
  PID:9932
- C:\Windows\System\szzCjvF.exe
  C:\Windows\System\szzCjvF.exe
  2⤵
  PID:9948
- C:\Windows\System\JxtFuYm.exe
  C:\Windows\System\JxtFuYm.exe
  2⤵
  PID:9964
- C:\Windows\System\RRmHsTN.exe
  C:\Windows\System\RRmHsTN.exe
  2⤵
  PID:9980
- C:\Windows\System\FVmrVHT.exe
  C:\Windows\System\FVmrVHT.exe
  2⤵
  PID:9996
- C:\Windows\System\hFFevhp.exe
  C:\Windows\System\hFFevhp.exe
  2⤵
  PID:10012
- C:\Windows\System\TFYuAiS.exe
  C:\Windows\System\TFYuAiS.exe
  2⤵
  PID:10028
- C:\Windows\System\LiMzyvG.exe
  C:\Windows\System\LiMzyvG.exe
  2⤵
  PID:10044
- C:\Windows\System\yUxbSsv.exe
  C:\Windows\System\yUxbSsv.exe
  2⤵
  PID:10060
- C:\Windows\System\EaMWAwt.exe
  C:\Windows\System\EaMWAwt.exe
  2⤵
  PID:10076
- C:\Windows\System\yTVhRio.exe
  C:\Windows\System\yTVhRio.exe
  2⤵
  PID:10092
- C:\Windows\System\espBmWj.exe
  C:\Windows\System\espBmWj.exe
  2⤵
  PID:10108
- C:\Windows\System\dHEwPzS.exe
  C:\Windows\System\dHEwPzS.exe
  2⤵
  PID:10124
- C:\Windows\System\WlRSuNb.exe
  C:\Windows\System\WlRSuNb.exe
  2⤵
  PID:10140
- C:\Windows\System\ujpwpIi.exe
  C:\Windows\System\ujpwpIi.exe
  2⤵
  PID:10156
- C:\Windows\System\ewsrLvI.exe
  C:\Windows\System\ewsrLvI.exe
  2⤵
  PID:10172
- C:\Windows\System\DiDhqYa.exe
  C:\Windows\System\DiDhqYa.exe
  2⤵
  PID:10188
- C:\Windows\System\vabNoHm.exe
  C:\Windows\System\vabNoHm.exe
  2⤵
  PID:10204
- C:\Windows\System\DbnwCLh.exe
  C:\Windows\System\DbnwCLh.exe
  2⤵
  PID:10220
- C:\Windows\System\qCEHDEC.exe
  C:\Windows\System\qCEHDEC.exe
  2⤵
  PID:10236
- C:\Windows\System\OUhZAcW.exe
  C:\Windows\System\OUhZAcW.exe
  2⤵
  PID:8880
- C:\Windows\System\tPiMLnZ.exe
  C:\Windows\System\tPiMLnZ.exe
  2⤵
  PID:9268
- C:\Windows\System\ouTImtE.exe
  C:\Windows\System\ouTImtE.exe
  2⤵
  PID:9300
- C:\Windows\System\xqDzwBX.exe
  C:\Windows\System\xqDzwBX.exe
  2⤵
  PID:8472
- C:\Windows\System\bCKUWVU.exe
  C:\Windows\System\bCKUWVU.exe
  2⤵
  PID:9280
- C:\Windows\System\HkkQbrc.exe
  C:\Windows\System\HkkQbrc.exe
  2⤵
  PID:9348
- C:\Windows\System\vxOYoJo.exe
  C:\Windows\System\vxOYoJo.exe
  2⤵
  PID:9396
- C:\Windows\System\OsPBlAX.exe
  C:\Windows\System\OsPBlAX.exe
  2⤵
  PID:9400
- C:\Windows\System\LWBphaO.exe
  C:\Windows\System\LWBphaO.exe
  2⤵
  PID:9432
- C:\Windows\System\YsgnCsU.exe
  C:\Windows\System\YsgnCsU.exe
  2⤵
  PID:9464
- C:\Windows\System\bLDNuZO.exe
  C:\Windows\System\bLDNuZO.exe
  2⤵
  PID:9524
- C:\Windows\System\dlbXVEJ.exe
  C:\Windows\System\dlbXVEJ.exe
  2⤵
  PID:9556
- C:\Windows\System\JLhQHOG.exe
  C:\Windows\System\JLhQHOG.exe
  2⤵
  PID:9576
- C:\Windows\System\fFcNafZ.exe
  C:\Windows\System\fFcNafZ.exe
  2⤵
  PID:9508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AYTXRyU.exe

Filesize
1.4MB

MD5
3d92d6f22d31d960aa980fc0cf0c1281

SHA1
23ca64d33b67feb8310bd519f80b93a81e722298

SHA256
afd963c1a96bbdfc0b83725b15beff9de844fe491d1e3cb1c2207e28ed0aadb9

SHA512
aa4e033805a275e404c3fd3fbbd0e7530bed5b71ad95a13038e99b818f8be43d40fe8e859863c039055566e6dcd62a73e9200cbd9063f149a27cec36b9305d23

Download Submit
C:\Windows\system\CdxmZFz.exe

Filesize
1.4MB

MD5
f1605ae4c0a6b41724c02185ead8defe

SHA1
ad0e12ad6b447e82e55148fa1aca9766e4f59777

SHA256
470882018d795b2286037232d589fd798658b724e96d4ec1bc3d5799ceed5b51

SHA512
eacdcb21ba2273e55d711da3da4fb31639c2b2dc273742f59637891175c518b1e06e655ce49fa0752efa7db17a5c56606654b8551426fce95eb9cb883c60b5fd

Download Submit
C:\Windows\system\CzkHbjP.exe

Filesize
1.4MB

MD5
78028b13cb5f0ff3c7c604693f58f79a

SHA1
b5003f9d26ffda4a754b0a7fc12c2ef199b3f6bf

SHA256
8fa3069be980004cdd6f527f614757412c571c3dcafaf518dfc0770e4b8bbbba

SHA512
0f1589611e975e7af5d11755c692a2e11d9349455fb85e92f05f9fe5643ee2d30d7ba673d9e29ca394c7ffaa4483d76dd45f8ac6a5ab133834587875209a2d26

Download Submit
C:\Windows\system\DCBdkEk.exe

Filesize
1.4MB

MD5
6d79aeb3d423e564f91da66f23fbb88f

SHA1
6e3a026faa85a91700c01c2b059ee79d169e5172

SHA256
b8a73f7545fd6774f901e333d9f186a0cef9369fe611d21c4b6a517b2d8ea01f

SHA512
687b4ca6b647912de17e779026598eb3c33e8b5ff2ec8a9cfd64284e4b62c7a319afd8ff3049b51c8cc7ab0bfd7f0e29df02f365445aa7d0afb27e3c43f3aaa3

Download Submit
C:\Windows\system\DVkSRWa.exe

Filesize
1.4MB

MD5
edeb8266de364e504ab4dc6bc7c896ff

SHA1
4f692b438a53af2233a6219d56305d24b3a5604e

SHA256
5cdfa0b9c8e885bb3e714e2788eb90649a6b51398e66f1e476f265db06693a74

SHA512
97ac3de392e8430e30f730ee9ccae4d0b99c9e8a4a344eed39bdc4e403c6163640e383218e0d8bd812dbe6c50e9b6c65ae998425d6669a34502b9ecfab227526

Download Submit
C:\Windows\system\FZsgGtY.exe

Filesize
1.4MB

MD5
0732b88fcef73ceaf86caff70db0ccbf

SHA1
cf45477e25aa155cae6ea09a965e08d3275f164c

SHA256
a40315de7ad2927a186946e31f995fcce9b3af39ea9bb0b1036d3e365e9880ab

SHA512
24ffe731274fb1b55b5681bf09f8de1ecb49b005801b2d28b3d11269489bd0d1747f7c147616935609b4b5bff49352054ef5f1acdbb83e298f048f07c76778ad

Download Submit
C:\Windows\system\KjsSMFr.exe

Filesize
1.4MB

MD5
e2322bb44d9a3ccd1f0652135fb6cedc

SHA1
8de7cf07f841387eb0926e1802c7d94919ba7d69

SHA256
691fdb7d4257389e2632b4f20d9b3b375febe4febdca0b5eb42ac8d6ea50938d

SHA512
10317f59b5c3eafc4a7d83297cf86b5fbd6233b5578ff877b7c5433148a3aca6e0d6702c334ccbd40461124bb9eb16645c8cc9cc790a7046a2db3cd1a1856562

Download Submit
C:\Windows\system\ORvdwps.exe

Filesize
1.4MB

MD5
10a14be98c2874341d5900c58c2dbb04

SHA1
5cf14e6592019f1abc5c457d6ebde70bf1d25cd4

SHA256
4ff5bdb711db4aa46c204000f19479ef507ed87da8ff87d22bb987cab31eca32

SHA512
71263807eade9c9196780a9ed108fd5ca531ea2a02e2e4230cec17513883d01ac3c1e4fb764fcb863efbe97e12206b0e4a35ee1479ad8ff58c7f77e45bcf072e

Download Submit
C:\Windows\system\QDslbhU.exe

Filesize
1.4MB

MD5
f4472ab731cfa2ad1875551450a6c0ad

SHA1
dec770edbb31387b26f3add5147c2e8ce2f37bfe

SHA256
a12743987266b3f618d848a98afa313e7a3a717f1a09d64726c81a4f4aca42bc

SHA512
f3bd3a551e774be5170e8485552bbd1416eb0b9dcb3934dd1dd9a6a69bbde3ffc9def11afcc35d7d2fa5de39b5e1eb31642be91814ae226f54d07ba560d3f210

Download Submit
C:\Windows\system\QnDxLuD.exe

Filesize
1.4MB

MD5
45c2ffc1d56ff540d5d150ffd8e8ce10

SHA1
992c8b864bd7657b26ce0ee9fef9fbd066ff1418

SHA256
9eb64c1e0b9d10fd1b34a9f13980de4dcf3d0338e9da3f18afa1519c4e11f3e6

SHA512
591964636feb70d3d694b07063e18cd3d5d632e4d9059b06d7697efe4021bba3bac5ed27d60fc5159ab600db899b200c4d7df87300cd24ee39cba99f5047ea0a

Download Submit
C:\Windows\system\QvFyDrp.exe

Filesize
1.4MB

MD5
3efd901d51626d9b71945b2252ac54cf

SHA1
44e934d6fe7c681a6f786a9f0ce83ef125960626

SHA256
2b5ddf03e9d2ddf600ce1c294795bd25449da595839583756f58c7c0207a839c

SHA512
c8316e02f4ee8a94826170a547807dc65f80b382dddc4c23016dbe5f70e23485ed7a6417ffb8473b6cb53cf709c967ba7e9712345e86c26b31bc6ccf909e6c17

Download Submit
C:\Windows\system\RRRvmvf.exe

Filesize
1.4MB

MD5
a74f2012f05153155f8b4e1413328838

SHA1
ec3247e1b59ec7222b0fc820ed105ae7e91f1b2c

SHA256
cc4fa63c2e48de81a73d6c4c076943f4e26794e74b81f750b1778833acf4fb35

SHA512
423d647b6b8a17672999e29bc50d98e5eb526586eaf8920402e9580f6e2ac0e22623e43ad2bd376b7f736b2e5ba4e682b9a30a16c607af4362e32fe7b621b1ae

Download Submit
C:\Windows\system\SMgeKBw.exe

Filesize
1.4MB

MD5
ee3fcecfc11910672ed305590fd9dacc

SHA1
b2da459a19456b6f45d3cf35f1ba220cbeda0a87

SHA256
d1ecabb12d10a9d2587a56930ed3050560f67e8678aec02558bb163e63c2d138

SHA512
fcf6d38d455a063cd35fb1c1cbc49276a6b9166bae14ca79014b4c992cb2175e19d4ba7a5db4d712635712ab1dc7dd7bfdaf03c7d5e8ee5100784c832cda506e

Download Submit
C:\Windows\system\SmLLbcR.exe

Filesize
1.4MB

MD5
5da52f8b91317b60101ce211badd9355

SHA1
22d359d8b6deb501ee6c4cf7087d410acf2fa9c8

SHA256
e09fd31738c8db521163107c6de96dee5d3bffceaf03ece5c072167566dc4a07

SHA512
905020eabcf28601221a31dbb89f3ead7a9ae1b4e4b96ec1784b548211b0776454cf7d484cad5a792d0f3fb2fd2f81afcbdcd239bba6a5544524357a76455c97

Download Submit
C:\Windows\system\TEiJgtT.exe

Filesize
1.4MB

MD5
5128ccc4cea068f6dbcae7f2e82f66a4

SHA1
f087bbff8d48300efd3d3f51ed5591891937a696

SHA256
5bfd3f38c84443fa42bb22cddd4bee1260aa8f4f71a7e8939fbba135102b0621

SHA512
6865c24ca9324e9775303ac0fd72dd8753269721c73adf28c4301839db1e9add3b637f36fd4229c45d81102a459b1925f838808388d4e92c8317b64d0e357b06

Download Submit
C:\Windows\system\XvDVtYK.exe

Filesize
1.4MB

MD5
322ac4360c19edd27ac9c0d2aead5a60

SHA1
f558a803689f304d4ed536caba590dbc7444c650

SHA256
458e9f7d5908d500b920461baffc3c4d6d0ccb57e1e7c75c089d9b8963a2ab84

SHA512
0bc4f077579ad395950419f8065fbc391d053f9ecc759749992fe2c8fbc662493791db6da82c7f33699f8f4398246aada310220c224bddb95a26313eeb4ed538

Download Submit
C:\Windows\system\ZpIJfFA.exe

Filesize
1.4MB

MD5
b1cf5a21af2cd8d87252947dcd4e1178

SHA1
d9bca62232ee698710f3ea61b8865e1216f8b4d3

SHA256
7ffbfdced4c6a898a621000fe85591fd5e967abb85d1b5c592f2a497b95ae5d8

SHA512
3e00d0d06806c12c7f6e8e71466a64dfa7674d0645df661da103dd42eb4c5358e2c4df42b48ac4089d57c2bd1707ec51d5c1fb4ce1e5fa3b3fc37fabd2699617

Download Submit
C:\Windows\system\aZEpbYR.exe

Filesize
1.4MB

MD5
65b28a58e2aa1ea611dc5c4e4e1d508e

SHA1
8a249b9c74101eb82665d1ea20bb07325550bada

SHA256
707eca1d4d706c21320dedd4a4d6280a34541c2dd8bdff3d2b2e0820364fc990

SHA512
780cb858903fe9c1592ffd8f340f4ae680f467c5d38e7c6d4ad9efedd7606ed3a894780bd47c0689ab365f47c9e84dbd238191a71e5e2ce422b25022a67efd21

Download Submit
C:\Windows\system\cUkNQbI.exe

Filesize
1.4MB

MD5
f2476992e762c6fe3bc8127719147bdb

SHA1
ebc66209be36e4091da5b80cfece6c5e016525c6

SHA256
789a34729a4f910dc7a8682a114c8ca5fb6a65aa0402e27a6885c4f81b4ab3db

SHA512
e74048b060ac4762148a90bb5b05f40f29b58e836d71466a92676c583c3f6936949ddd8875f3ae6d02c22625356b3ad841998d3d45bf9402478c5456ccb2c066

Download Submit
C:\Windows\system\dUveXuR.exe

Filesize
1.4MB

MD5
85c9c3ab3ec2f89327ab2b7325306dae

SHA1
8df69eb1b1ec88e8f9d215635b7c7db7a15da236

SHA256
a664ce7b85ee853d1254006b17fa8ed1afe0dcf10ea04edebafab7aa96d7517c

SHA512
29af4eb56d6988ebd5f1140f2028cf16d0a381f0de5a2969ef53061a3faf6dbbd686c83ce0088a010f3cad4e6c3f878fdd364c3d82af580caa2ca0bc9c01a36a

Download Submit
C:\Windows\system\eSxboyB.exe

Filesize
1.4MB

MD5
d562b0072e63cf925ecafe6c6278460b

SHA1
4988786f2bed496eea6836fd71460580f3ac383f

SHA256
fd5f11fda5cf5eedd3ee550403958fb002f9101e702516fd6005ea4e0360cde0

SHA512
214b7619778ae420e85232fcba4e6951d54650e74b97c6f163893851590059076c3c8737a8a1557194d858756fff2b90cb341ccb1b47886c000b76441017fb18

Download Submit
C:\Windows\system\fNNhQpI.exe

Filesize
1.4MB

MD5
b39a21b892b56dab1942297d66913b3a

SHA1
922a71cb11945c6c1af0266485173c47e15e8215

SHA256
732d38c33fcf9742b431ad833589f438ea744b84be9c9e5f3ec91a984f30802d

SHA512
7f7fc67d1d68a7b10ff5ed162efea4554bd164edb8ea23a0b9a1909b5641b74ae8e4617e95a7365174e5a1ceb86d42772a809e050f5b4b8e56bf061588124cec

Download Submit
C:\Windows\system\gyJRCBO.exe

Filesize
1.4MB

MD5
0fcde50d76fe404d751645c36a82e7d3

SHA1
608a5835bb8aea0ea3f7c92a85a1ef75e6c87b48

SHA256
f22a58f35e950bd206c7ee33c3c4ee5636ad0e8a3da3ac5bc830836626bb0130

SHA512
09eeb46b7303261f1e55326b172c5188be79295ff2bae117672358c3949091e9a1f73fb29393a17512fbf67f698cd236d98fea867a98cbc704fd320c0647621f

Download Submit
C:\Windows\system\jZdvrKZ.exe

Filesize
1.4MB

MD5
38bfbcb5dc8ed355a5ee678b788bc682

SHA1
f7bced06162639a9872c8a1f8996e08e23d7cbb4

SHA256
731003d4866632fbaba5671b2e47ac818ea1ad7687ba6ed4b6a3a748f9401101

SHA512
f008d70d7d8a529ca4c8ba8e7069ef5a6ec669b1b7110e18d180d328cabb8bcdbd1174a16a8be898aa19bdc99182393a0ed56ab087648597e8ff1313ab4ddf13

Download Submit
C:\Windows\system\lZcwadC.exe

Filesize
1.4MB

MD5
aee3ee062226d950106203efd8a52f19

SHA1
93b29fe8171fd9c41c72313f459055b1ff9116ce

SHA256
43ab95430cd911a25b690ff3843ab97ec0f1e9d31091fd64a63c427c83eca893

SHA512
0978a12418d72e3417605615ce35a03dc3ff2d9938d679cf6ed1f801f3133025cc1fd9220062310f9c46fa8c24ba4a716c95a0665db24ef4272db73820f917d5

Download Submit
C:\Windows\system\mRryLLS.exe

Filesize
1.4MB

MD5
b9413608671dc0f4e78789f0d367cf53

SHA1
ce5831fc62d7f582210170a22119a47e0993bc56

SHA256
d3fe01685cc39f589d2793506b3214b9d958c469d05d84cb8889be50106cc2ef

SHA512
cf3e321e8303d77384f40cf6dff93e75a204940d2376b4fb040d821d1c2ce193c5d462faf8ecdbacf5b53e982b5ef5332b60a016916a8da6147af3c3a474d6ab

Download Submit
C:\Windows\system\oAMQQfw.exe

Filesize
1.4MB

MD5
8df9d7ab28d324caa5dc3f3f79dfdf1e

SHA1
47e15222ee7299186de2a28c598f1e455c94ea9c

SHA256
1c3521bdc49c1a33d12aa58cacee68effc93db88cd5f8895db56f245b395eb06

SHA512
31bc5891e840138d5fb02b6fc22eb4320dc65de294c07fcbc12841729a14045cc6d3078ddff33e226448b13df04b4752ad134da3f666fec53651bbfcde8b0aa3

Download Submit
C:\Windows\system\weNtjiH.exe

Filesize
1.4MB

MD5
4b649217da5865257f9ca7a373b16f27

SHA1
9260b6c56b85762dc071c786705baa954cd917f7

SHA256
16ff22f3660b05830e503c8fd44827f4e4a81b9c03fcb082db02de14a290509d

SHA512
feaa45e5b6fdaa51cb29d3fa3605f562ca216c98154d0086589efb6e01c900fd7c22ca2a9df0c6df0d526656d8e6696dad3aa00ff86002247292e6f0b6d80cf3

Download Submit
C:\Windows\system\xWKDejC.exe

Filesize
1.4MB

MD5
0265ddf796c751c24ebe98a0d0840c5a

SHA1
d35c609b0306071f3cf296cb3d57da7cf9125181

SHA256
b4afdd7c9a345169419942eb96d9b42df3362cdadc8e1ea0154ba5258338d551

SHA512
109940a52c1aae7b0148b36a93f2fc8e504f3c9a7bda1532ebc58a77916e35a25b4d0f0b2a78e02744b9adf491bbdaee8ccc91b461a0070613413594eda8fabe

Download Submit
\Windows\system\uEVdUKK.exe

Filesize
1.4MB

MD5
4682cbeda76ab926dd703ffcbd511014

SHA1
65a1a7f88b432cc3dcd75233c7a140ef3a9b99b9

SHA256
bd10f0c4ad75cdb498afd1aee2dbb5af05737b4287c940429926a146ada14d1a

SHA512
b292dfc50696fc64bdcbddc8c7710d2dac5ee1d5bdb0440ea0c7f3128a57e0fd6f5b31baf5e045a9e2bf5a127d8bf1df1f353a4a30d3ad08b691aa6b05b9d548

Download Submit
\Windows\system\uXEzHgI.exe

Filesize
1.4MB

MD5
0c34d6aaf961a0d6ad3aabd5824a0186

SHA1
2493e6286a2e53d622df714526bf4b9e28012c1e

SHA256
4f74ddf12150a5558f1dbd46bf1980ee00cda7d424b520bea4b675556bc3622a

SHA512
222d23134f9fd3f6b5425a1f2138f3c6888ba5ca1784d2270b1e1c2f349fc9f567c8324494a4097d04a484ce99c9a7ad891f7b7e402ad19d394c97be6ec1b066

Download Submit
\Windows\system\uoKMKuS.exe

Filesize
1.4MB

MD5
d59ece7855d0bdf84fe9c79ab6d63359

SHA1
d1bb2ca590d58a8ebdaecb5133995a8cecbd3f1b

SHA256
3e6cc345f510b42e9cab958caa8a630c5af57e053a9255e77f3667a8f74f5d0f

SHA512
486e78947fe2f324fab92b619684198f619c63d005ef67413a0ad7fd5ed8af841ff12ccc1654eacf403ad48d57e24d55ca46f559791609fe8307c8ad1b7d2bec

Download Submit
memory/548-92-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/548-2216-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/564-2658-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/564-95-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/596-89-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/596-2243-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/776-91-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/776-2696-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/1320-79-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1320-1763-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1736-94-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1736-2805-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1760-1765-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1760-83-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/1972-81-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/1972-1751-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2000-1753-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2000-85-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2008-2685-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2008-87-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2336-93-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2336-96-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2336-78-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2336-399-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-0-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-2660-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-8-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2336-80-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2336-82-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2336-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2336-90-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/2336-88-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2336-84-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2336-86-0x00000000031E0000-0x00000000035D2000-memory.dmp

Filesize
3.9MB

Download
memory/2344-760-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2344-71-0x000000001B320000-0x000000001B602000-memory.dmp

Filesize
2.9MB

Download
memory/2344-14-0x000007FEF67EE000-0x000007FEF67EF000-memory.dmp

Filesize
4KB

Download
memory/2344-101-0x0000000001FC0000-0x0000000001FC8000-memory.dmp

Filesize
32KB

Download
memory/2344-76-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2344-77-0x000007FEF6530000-0x000007FEF6ECD000-memory.dmp

Filesize
9.6MB

Download
memory/2364-1733-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2364-9-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2404-2804-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2404-97-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download