xmrig | 1f132c8e6fb51b01e3d7e322e38cd49ecf74233f8dc9516fd6f59ea3db335730

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
Size

1.2MB
MD5

774a0f2d09bddbb80b8c3ef572d0f540
SHA1

dc1100547618337e902e39567023e3b789e45e06
SHA256

1f132c8e6fb51b01e3d7e322e38cd49ecf74233f8dc9516fd6f59ea3db335730
SHA512

82f1677a11fa51c6030c8d94b3eef0470de1d33efbbffe8ee4d7dd74347dfe7e4b07f5b00569a9fa926ae1f2e25dbad26d7694d6f82d727c579bd1f4da169166
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbBwlKenUT5J33PzVwUzASZbElUxJ:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbVZ

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

Processes:

resource	yara_rule
C:\Windows\System\yyuzxRi.exe	xmrig
C:\Windows\System\EvcXylg.exe	xmrig
C:\Windows\System\ZSTLuAy.exe	xmrig
C:\Windows\System\ZhgoHlN.exe	xmrig
C:\Windows\System\XsuWzZJ.exe	xmrig
C:\Windows\System\DvnzeQK.exe	xmrig
C:\Windows\System\IpDxGBZ.exe	xmrig
C:\Windows\System\qLzXXjO.exe	xmrig
C:\Windows\System\igaEaec.exe	xmrig
C:\Windows\System\ZHxyvDS.exe	xmrig
C:\Windows\System\JyHFRyK.exe	xmrig
C:\Windows\System\TxOmAcJ.exe	xmrig
C:\Windows\System\nveSJHp.exe	xmrig
C:\Windows\System\uSmvVmV.exe	xmrig
C:\Windows\System\SEBCudI.exe	xmrig
C:\Windows\System\xXwAYrD.exe	xmrig
C:\Windows\System\DUhNemy.exe	xmrig
C:\Windows\System\KFUMbXS.exe	xmrig
C:\Windows\System\NMwcGJN.exe	xmrig
C:\Windows\System\gFZmbjk.exe	xmrig
C:\Windows\System\IInjNjq.exe	xmrig
C:\Windows\System\MRQFhKP.exe	xmrig
C:\Windows\System\MJXbHrw.exe	xmrig
C:\Windows\System\DwDPORW.exe	xmrig
C:\Windows\System\eZuJKOk.exe	xmrig
C:\Windows\System\JVefdOl.exe	xmrig
C:\Windows\System\MQRhCGW.exe	xmrig
C:\Windows\System\vZNtOJr.exe	xmrig
C:\Windows\System\YaQhqWy.exe	xmrig
C:\Windows\System\hnbCoPr.exe	xmrig
C:\Windows\System\GrupnEG.exe	xmrig
C:\Windows\System\HztTSkb.exe	xmrig
C:\Windows\System\OyPwhZj.exe	xmrig

Executes dropped EXE 64 IoCs

Processes:

yyuzxRi.exeEvcXylg.exeZSTLuAy.exeZhgoHlN.exeOyPwhZj.exeHztTSkb.exeGrupnEG.exeXsuWzZJ.exehnbCoPr.exeDvnzeQK.exeIpDxGBZ.exeYaQhqWy.exevZNtOJr.exeqLzXXjO.exeMQRhCGW.exeigaEaec.exeJVefdOl.exeeZuJKOk.exeDwDPORW.exeMJXbHrw.exeMRQFhKP.exeIInjNjq.exegFZmbjk.exeNMwcGJN.exeKFUMbXS.exeZHxyvDS.exeDUhNemy.exexXwAYrD.exeSEBCudI.exeJyHFRyK.exenveSJHp.exeuSmvVmV.exeTxOmAcJ.exeKMgWihl.exezdrgwBn.exeSyOMJmy.exenNXXhLG.exejmcgOhw.execIUqHRS.exeHFzBmfB.exekBoutsp.exeyNCGQiS.exenmOIlvR.exeemDwjlq.exesierFdE.exesaOsyPK.exeWfLadPv.exemQfOmHc.exeNIkEQSB.exeqWnMhTC.exeTdqdkYV.exeBcMfjSb.exeJKJPOvS.exejHQnGNt.exeOSGsNHF.exevaavjJl.exesFRLYlf.exeKXnaKTo.exeuvAGuuA.exeGVMazzD.execuodfON.exePYESheL.exeWShRwAm.exeucXPDqY.exe

pid	process
232	yyuzxRi.exe
944	EvcXylg.exe
1148	ZSTLuAy.exe
3176	ZhgoHlN.exe
4144	OyPwhZj.exe
3492	HztTSkb.exe
1968	GrupnEG.exe
3948	XsuWzZJ.exe
1688	hnbCoPr.exe
4044	DvnzeQK.exe
2940	IpDxGBZ.exe
4520	YaQhqWy.exe
2544	vZNtOJr.exe
3648	qLzXXjO.exe
2764	MQRhCGW.exe
3680	igaEaec.exe
1604	JVefdOl.exe
3684	eZuJKOk.exe
4668	DwDPORW.exe
996	MJXbHrw.exe
1648	MRQFhKP.exe
4700	IInjNjq.exe
4540	gFZmbjk.exe
4068	NMwcGJN.exe
2252	KFUMbXS.exe
5104	ZHxyvDS.exe
3856	DUhNemy.exe
1156	xXwAYrD.exe
3876	SEBCudI.exe
3916	JyHFRyK.exe
3140	nveSJHp.exe
1540	uSmvVmV.exe
2760	TxOmAcJ.exe
2212	KMgWihl.exe
4820	zdrgwBn.exe
4448	SyOMJmy.exe
2792	nNXXhLG.exe
3540	jmcgOhw.exe
4432	cIUqHRS.exe
4908	HFzBmfB.exe
4816	kBoutsp.exe
5108	yNCGQiS.exe
3928	nmOIlvR.exe
2380	emDwjlq.exe
436	sierFdE.exe
2592	saOsyPK.exe
2876	WfLadPv.exe
3068	mQfOmHc.exe
3688	NIkEQSB.exe
632	qWnMhTC.exe
4512	TdqdkYV.exe
220	BcMfjSb.exe
348	JKJPOvS.exe
1464	jHQnGNt.exe
4456	OSGsNHF.exe
2632	vaavjJl.exe
1672	sFRLYlf.exe
4852	KXnaKTo.exe
5028	uvAGuuA.exe
2576	GVMazzD.exe
5020	cuodfON.exe
1888	PYESheL.exe
2444	WShRwAm.exe
1256	ucXPDqY.exe

Drops file in Windows directory 64 IoCs

Processes:

774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\xmeoYSF.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\coVISPJ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\JJPMyxm.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\jHQnGNt.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\IeGrJoz.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\LdVVSLL.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\MRAvjwC.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\lSpZEPg.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\TMRyDBO.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\PvIVAYt.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\esITMsy.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\OoLPgDJ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\yIQeAHm.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\ZrmJwKI.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\rADrCoA.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\yyuzxRi.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\CVrFYSW.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\IbapSmH.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\AfUueWY.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\VcBNDNJ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\pUvYqbv.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\GWYHJBS.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\jGEZfJb.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\tdMtyWt.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\FpIAnig.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\zFPxrXU.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\DbVoHoh.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\PwXgNSG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\OOsWwXR.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\RafaiBR.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\DPZPeME.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\gbvrdWD.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\Ktvlcxw.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\fbmtavy.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\dyUKqPX.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\GdGpJCs.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\KCxqnQF.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\hnNEZge.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\pHquSum.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\vQSkycb.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\hnOWbNA.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\qWnMhTC.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\uPcepnw.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\WWJLVyN.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\kuWMVnx.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\nKKhWPa.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\udRQaRG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\RJkOVeV.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\lkTHWqA.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\wcJVGKx.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\HVyTEqo.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\FvPSEFy.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\jbPpCdg.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\MWkZYkx.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\PpfHGKQ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\CzNzxwC.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\AqihAhl.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\qGBIhfE.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\IpDxGBZ.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\nhPBpbG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\yRdaCKG.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\CxKeXSe.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\ZGISoyI.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
File created	C:\Windows\System\LyFoFyI.exe	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

Processes:

dwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dwm.exe

description	pid	process
Token: SeCreateGlobalPrivilege	17260	dwm.exe
Token: SeChangeNotifyPrivilege	17260	dwm.exe
Token: 33	17260	dwm.exe
Token: SeIncBasePriorityPrivilege	17260	dwm.exe
Token: SeShutdownPrivilege	17260	dwm.exe
Token: SeCreatePagefilePrivilege	17260	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe

description	pid	process	target process
PID 2100 wrote to memory of 232	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	yyuzxRi.exe
PID 2100 wrote to memory of 232	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	yyuzxRi.exe
PID 2100 wrote to memory of 944	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	EvcXylg.exe
PID 2100 wrote to memory of 944	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	EvcXylg.exe
PID 2100 wrote to memory of 1148	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	ZSTLuAy.exe
PID 2100 wrote to memory of 1148	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	ZSTLuAy.exe
PID 2100 wrote to memory of 3176	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	ZhgoHlN.exe
PID 2100 wrote to memory of 3176	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	ZhgoHlN.exe
PID 2100 wrote to memory of 4144	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	OyPwhZj.exe
PID 2100 wrote to memory of 4144	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	OyPwhZj.exe
PID 2100 wrote to memory of 3492	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	HztTSkb.exe
PID 2100 wrote to memory of 3492	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	HztTSkb.exe
PID 2100 wrote to memory of 1968	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	GrupnEG.exe
PID 2100 wrote to memory of 1968	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	GrupnEG.exe
PID 2100 wrote to memory of 3948	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	XsuWzZJ.exe
PID 2100 wrote to memory of 3948	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	XsuWzZJ.exe
PID 2100 wrote to memory of 1688	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	hnbCoPr.exe
PID 2100 wrote to memory of 1688	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	hnbCoPr.exe
PID 2100 wrote to memory of 4044	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	DvnzeQK.exe
PID 2100 wrote to memory of 4044	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	DvnzeQK.exe
PID 2100 wrote to memory of 2940	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	IpDxGBZ.exe
PID 2100 wrote to memory of 2940	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	IpDxGBZ.exe
PID 2100 wrote to memory of 4520	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	YaQhqWy.exe
PID 2100 wrote to memory of 4520	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	YaQhqWy.exe
PID 2100 wrote to memory of 2544	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	vZNtOJr.exe
PID 2100 wrote to memory of 2544	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	vZNtOJr.exe
PID 2100 wrote to memory of 3648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	qLzXXjO.exe
PID 2100 wrote to memory of 3648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	qLzXXjO.exe
PID 2100 wrote to memory of 2764	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	MQRhCGW.exe
PID 2100 wrote to memory of 2764	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	MQRhCGW.exe
PID 2100 wrote to memory of 3680	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	igaEaec.exe
PID 2100 wrote to memory of 3680	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	igaEaec.exe
PID 2100 wrote to memory of 1604	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	JVefdOl.exe
PID 2100 wrote to memory of 1604	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	JVefdOl.exe
PID 2100 wrote to memory of 3684	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	eZuJKOk.exe
PID 2100 wrote to memory of 3684	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	eZuJKOk.exe
PID 2100 wrote to memory of 4668	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	DwDPORW.exe
PID 2100 wrote to memory of 4668	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	DwDPORW.exe
PID 2100 wrote to memory of 996	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	MJXbHrw.exe
PID 2100 wrote to memory of 996	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	MJXbHrw.exe
PID 2100 wrote to memory of 1648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	MRQFhKP.exe
PID 2100 wrote to memory of 1648	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	MRQFhKP.exe
PID 2100 wrote to memory of 4700	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	IInjNjq.exe
PID 2100 wrote to memory of 4700	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	IInjNjq.exe
PID 2100 wrote to memory of 4540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	gFZmbjk.exe
PID 2100 wrote to memory of 4540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	gFZmbjk.exe
PID 2100 wrote to memory of 4068	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	NMwcGJN.exe
PID 2100 wrote to memory of 4068	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	NMwcGJN.exe
PID 2100 wrote to memory of 2252	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	KFUMbXS.exe
PID 2100 wrote to memory of 2252	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	KFUMbXS.exe
PID 2100 wrote to memory of 5104	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	ZHxyvDS.exe
PID 2100 wrote to memory of 5104	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	ZHxyvDS.exe
PID 2100 wrote to memory of 3856	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	DUhNemy.exe
PID 2100 wrote to memory of 3856	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	DUhNemy.exe
PID 2100 wrote to memory of 1156	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	xXwAYrD.exe
PID 2100 wrote to memory of 1156	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	xXwAYrD.exe
PID 2100 wrote to memory of 3876	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	SEBCudI.exe
PID 2100 wrote to memory of 3876	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	SEBCudI.exe
PID 2100 wrote to memory of 3916	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	JyHFRyK.exe
PID 2100 wrote to memory of 3916	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	JyHFRyK.exe
PID 2100 wrote to memory of 3140	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	nveSJHp.exe
PID 2100 wrote to memory of 3140	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	nveSJHp.exe
PID 2100 wrote to memory of 1540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	uSmvVmV.exe
PID 2100 wrote to memory of 1540	2100	774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe	uSmvVmV.exe

C:\Users\Admin\AppData\Local\Temp\774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\774a0f2d09bddbb80b8c3ef572d0f540_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\System\yyuzxRi.exe
  C:\Windows\System\yyuzxRi.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\EvcXylg.exe
  C:\Windows\System\EvcXylg.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ZSTLuAy.exe
  C:\Windows\System\ZSTLuAy.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\ZhgoHlN.exe
  C:\Windows\System\ZhgoHlN.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\OyPwhZj.exe
  C:\Windows\System\OyPwhZj.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\HztTSkb.exe
  C:\Windows\System\HztTSkb.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\GrupnEG.exe
  C:\Windows\System\GrupnEG.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\XsuWzZJ.exe
  C:\Windows\System\XsuWzZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hnbCoPr.exe
  C:\Windows\System\hnbCoPr.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\DvnzeQK.exe
  C:\Windows\System\DvnzeQK.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\IpDxGBZ.exe
  C:\Windows\System\IpDxGBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\YaQhqWy.exe
  C:\Windows\System\YaQhqWy.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\vZNtOJr.exe
  C:\Windows\System\vZNtOJr.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\qLzXXjO.exe
  C:\Windows\System\qLzXXjO.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\MQRhCGW.exe
  C:\Windows\System\MQRhCGW.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\igaEaec.exe
  C:\Windows\System\igaEaec.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\JVefdOl.exe
  C:\Windows\System\JVefdOl.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\eZuJKOk.exe
  C:\Windows\System\eZuJKOk.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\DwDPORW.exe
  C:\Windows\System\DwDPORW.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\MJXbHrw.exe
  C:\Windows\System\MJXbHrw.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\MRQFhKP.exe
  C:\Windows\System\MRQFhKP.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\IInjNjq.exe
  C:\Windows\System\IInjNjq.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\gFZmbjk.exe
  C:\Windows\System\gFZmbjk.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\NMwcGJN.exe
  C:\Windows\System\NMwcGJN.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\KFUMbXS.exe
  C:\Windows\System\KFUMbXS.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ZHxyvDS.exe
  C:\Windows\System\ZHxyvDS.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\DUhNemy.exe
  C:\Windows\System\DUhNemy.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\xXwAYrD.exe
  C:\Windows\System\xXwAYrD.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\SEBCudI.exe
  C:\Windows\System\SEBCudI.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\JyHFRyK.exe
  C:\Windows\System\JyHFRyK.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\nveSJHp.exe
  C:\Windows\System\nveSJHp.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\uSmvVmV.exe
  C:\Windows\System\uSmvVmV.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\TxOmAcJ.exe
  C:\Windows\System\TxOmAcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\KMgWihl.exe
  C:\Windows\System\KMgWihl.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\zdrgwBn.exe
  C:\Windows\System\zdrgwBn.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\SyOMJmy.exe
  C:\Windows\System\SyOMJmy.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\nNXXhLG.exe
  C:\Windows\System\nNXXhLG.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\jmcgOhw.exe
  C:\Windows\System\jmcgOhw.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\cIUqHRS.exe
  C:\Windows\System\cIUqHRS.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\HFzBmfB.exe
  C:\Windows\System\HFzBmfB.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\kBoutsp.exe
  C:\Windows\System\kBoutsp.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\yNCGQiS.exe
  C:\Windows\System\yNCGQiS.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\nmOIlvR.exe
  C:\Windows\System\nmOIlvR.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\emDwjlq.exe
  C:\Windows\System\emDwjlq.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\sierFdE.exe
  C:\Windows\System\sierFdE.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\saOsyPK.exe
  C:\Windows\System\saOsyPK.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\WfLadPv.exe
  C:\Windows\System\WfLadPv.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\mQfOmHc.exe
  C:\Windows\System\mQfOmHc.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\NIkEQSB.exe
  C:\Windows\System\NIkEQSB.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\qWnMhTC.exe
  C:\Windows\System\qWnMhTC.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\TdqdkYV.exe
  C:\Windows\System\TdqdkYV.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\BcMfjSb.exe
  C:\Windows\System\BcMfjSb.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\JKJPOvS.exe
  C:\Windows\System\JKJPOvS.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\jHQnGNt.exe
  C:\Windows\System\jHQnGNt.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\OSGsNHF.exe
  C:\Windows\System\OSGsNHF.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\vaavjJl.exe
  C:\Windows\System\vaavjJl.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\sFRLYlf.exe
  C:\Windows\System\sFRLYlf.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\KXnaKTo.exe
  C:\Windows\System\KXnaKTo.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\uvAGuuA.exe
  C:\Windows\System\uvAGuuA.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\GVMazzD.exe
  C:\Windows\System\GVMazzD.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\cuodfON.exe
  C:\Windows\System\cuodfON.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\PYESheL.exe
  C:\Windows\System\PYESheL.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\WShRwAm.exe
  C:\Windows\System\WShRwAm.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ucXPDqY.exe
  C:\Windows\System\ucXPDqY.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\YWXGlKH.exe
  C:\Windows\System\YWXGlKH.exe
  2⤵
  PID:1924
- C:\Windows\System\sDwnMJd.exe
  C:\Windows\System\sDwnMJd.exe
  2⤵
  PID:1404
- C:\Windows\System\bEyrspC.exe
  C:\Windows\System\bEyrspC.exe
  2⤵
  PID:4440
- C:\Windows\System\ndIpGNX.exe
  C:\Windows\System\ndIpGNX.exe
  2⤵
  PID:3048
- C:\Windows\System\ShVsina.exe
  C:\Windows\System\ShVsina.exe
  2⤵
  PID:3716
- C:\Windows\System\beIzIuS.exe
  C:\Windows\System\beIzIuS.exe
  2⤵
  PID:3548
- C:\Windows\System\hiDgmIE.exe
  C:\Windows\System\hiDgmIE.exe
  2⤵
  PID:4616
- C:\Windows\System\RfdbQIE.exe
  C:\Windows\System\RfdbQIE.exe
  2⤵
  PID:4784
- C:\Windows\System\dznFvJj.exe
  C:\Windows\System\dznFvJj.exe
  2⤵
  PID:4528
- C:\Windows\System\kEJQBAU.exe
  C:\Windows\System\kEJQBAU.exe
  2⤵
  PID:4292
- C:\Windows\System\VoIQcPS.exe
  C:\Windows\System\VoIQcPS.exe
  2⤵
  PID:3712
- C:\Windows\System\kIGsVRF.exe
  C:\Windows\System\kIGsVRF.exe
  2⤵
  PID:1068
- C:\Windows\System\tKjIytO.exe
  C:\Windows\System\tKjIytO.exe
  2⤵
  PID:816
- C:\Windows\System\PFnrVMa.exe
  C:\Windows\System\PFnrVMa.exe
  2⤵
  PID:4752
- C:\Windows\System\sXTiMYB.exe
  C:\Windows\System\sXTiMYB.exe
  2⤵
  PID:5168
- C:\Windows\System\CzIDZRa.exe
  C:\Windows\System\CzIDZRa.exe
  2⤵
  PID:5192
- C:\Windows\System\oUFFhuT.exe
  C:\Windows\System\oUFFhuT.exe
  2⤵
  PID:5212
- C:\Windows\System\GpmQDKH.exe
  C:\Windows\System\GpmQDKH.exe
  2⤵
  PID:5236
- C:\Windows\System\jPVTRYH.exe
  C:\Windows\System\jPVTRYH.exe
  2⤵
  PID:5264
- C:\Windows\System\ZjnRMKk.exe
  C:\Windows\System\ZjnRMKk.exe
  2⤵
  PID:5284
- C:\Windows\System\DPZPeME.exe
  C:\Windows\System\DPZPeME.exe
  2⤵
  PID:5312
- C:\Windows\System\JrMaokh.exe
  C:\Windows\System\JrMaokh.exe
  2⤵
  PID:5340
- C:\Windows\System\GZtdIHL.exe
  C:\Windows\System\GZtdIHL.exe
  2⤵
  PID:5368
- C:\Windows\System\sjrQdAH.exe
  C:\Windows\System\sjrQdAH.exe
  2⤵
  PID:5396
- C:\Windows\System\JKmjzhn.exe
  C:\Windows\System\JKmjzhn.exe
  2⤵
  PID:5424
- C:\Windows\System\ChfHFhL.exe
  C:\Windows\System\ChfHFhL.exe
  2⤵
  PID:5452
- C:\Windows\System\pREhwWi.exe
  C:\Windows\System\pREhwWi.exe
  2⤵
  PID:5476
- C:\Windows\System\IiNbDTr.exe
  C:\Windows\System\IiNbDTr.exe
  2⤵
  PID:5508
- C:\Windows\System\gdgAglC.exe
  C:\Windows\System\gdgAglC.exe
  2⤵
  PID:5536
- C:\Windows\System\gYCgfwL.exe
  C:\Windows\System\gYCgfwL.exe
  2⤵
  PID:5564
- C:\Windows\System\JEJOSBH.exe
  C:\Windows\System\JEJOSBH.exe
  2⤵
  PID:5592
- C:\Windows\System\oQbAqhA.exe
  C:\Windows\System\oQbAqhA.exe
  2⤵
  PID:5620
- C:\Windows\System\mJNUxzp.exe
  C:\Windows\System\mJNUxzp.exe
  2⤵
  PID:5648
- C:\Windows\System\ppOtTYy.exe
  C:\Windows\System\ppOtTYy.exe
  2⤵
  PID:5676
- C:\Windows\System\GZVwmMX.exe
  C:\Windows\System\GZVwmMX.exe
  2⤵
  PID:5704
- C:\Windows\System\pWvhKce.exe
  C:\Windows\System\pWvhKce.exe
  2⤵
  PID:5732
- C:\Windows\System\rQZuXlT.exe
  C:\Windows\System\rQZuXlT.exe
  2⤵
  PID:5760
- C:\Windows\System\bJpgKNi.exe
  C:\Windows\System\bJpgKNi.exe
  2⤵
  PID:5788
- C:\Windows\System\KCxqnQF.exe
  C:\Windows\System\KCxqnQF.exe
  2⤵
  PID:5816
- C:\Windows\System\wVhmFtP.exe
  C:\Windows\System\wVhmFtP.exe
  2⤵
  PID:5844
- C:\Windows\System\sErDAJZ.exe
  C:\Windows\System\sErDAJZ.exe
  2⤵
  PID:5880
- C:\Windows\System\OOsWwXR.exe
  C:\Windows\System\OOsWwXR.exe
  2⤵
  PID:5900
- C:\Windows\System\YBsJhiU.exe
  C:\Windows\System\YBsJhiU.exe
  2⤵
  PID:5928
- C:\Windows\System\hnNEZge.exe
  C:\Windows\System\hnNEZge.exe
  2⤵
  PID:5956
- C:\Windows\System\kosnEHe.exe
  C:\Windows\System\kosnEHe.exe
  2⤵
  PID:5984
- C:\Windows\System\YDbYcEG.exe
  C:\Windows\System\YDbYcEG.exe
  2⤵
  PID:6016
- C:\Windows\System\zuSSwaE.exe
  C:\Windows\System\zuSSwaE.exe
  2⤵
  PID:6040
- C:\Windows\System\uWibXUz.exe
  C:\Windows\System\uWibXUz.exe
  2⤵
  PID:6072
- C:\Windows\System\GkYROga.exe
  C:\Windows\System\GkYROga.exe
  2⤵
  PID:6100
- C:\Windows\System\sQtPhSt.exe
  C:\Windows\System\sQtPhSt.exe
  2⤵
  PID:6128
- C:\Windows\System\AeeOuRO.exe
  C:\Windows\System\AeeOuRO.exe
  2⤵
  PID:688
- C:\Windows\System\gCdUyue.exe
  C:\Windows\System\gCdUyue.exe
  2⤵
  PID:4372
- C:\Windows\System\sErDtBh.exe
  C:\Windows\System\sErDtBh.exe
  2⤵
  PID:1744
- C:\Windows\System\pSeZvEb.exe
  C:\Windows\System\pSeZvEb.exe
  2⤵
  PID:2572
- C:\Windows\System\fdiMWDZ.exe
  C:\Windows\System\fdiMWDZ.exe
  2⤵
  PID:1472
- C:\Windows\System\vuwItrL.exe
  C:\Windows\System\vuwItrL.exe
  2⤵
  PID:4844
- C:\Windows\System\OoLPgDJ.exe
  C:\Windows\System\OoLPgDJ.exe
  2⤵
  PID:1420
- C:\Windows\System\cRCCVxD.exe
  C:\Windows\System\cRCCVxD.exe
  2⤵
  PID:5128
- C:\Windows\System\gbvrdWD.exe
  C:\Windows\System\gbvrdWD.exe
  2⤵
  PID:5188
- C:\Windows\System\zCYuCCw.exe
  C:\Windows\System\zCYuCCw.exe
  2⤵
  PID:5256
- C:\Windows\System\YpFPpBa.exe
  C:\Windows\System\YpFPpBa.exe
  2⤵
  PID:5304
- C:\Windows\System\VGrjkAt.exe
  C:\Windows\System\VGrjkAt.exe
  2⤵
  PID:5388
- C:\Windows\System\xpSInkP.exe
  C:\Windows\System\xpSInkP.exe
  2⤵
  PID:5444
- C:\Windows\System\IGVSZep.exe
  C:\Windows\System\IGVSZep.exe
  2⤵
  PID:5520
- C:\Windows\System\lzToAOK.exe
  C:\Windows\System\lzToAOK.exe
  2⤵
  PID:5580
- C:\Windows\System\xzEywyd.exe
  C:\Windows\System\xzEywyd.exe
  2⤵
  PID:5636
- C:\Windows\System\tNXXgKq.exe
  C:\Windows\System\tNXXgKq.exe
  2⤵
  PID:5692
- C:\Windows\System\PerlBWl.exe
  C:\Windows\System\PerlBWl.exe
  2⤵
  PID:5748
- C:\Windows\System\ScEkgeh.exe
  C:\Windows\System\ScEkgeh.exe
  2⤵
  PID:5808
- C:\Windows\System\NPKurXa.exe
  C:\Windows\System\NPKurXa.exe
  2⤵
  PID:5872
- C:\Windows\System\HcTFSLv.exe
  C:\Windows\System\HcTFSLv.exe
  2⤵
  PID:5920
- C:\Windows\System\fVRBDki.exe
  C:\Windows\System\fVRBDki.exe
  2⤵
  PID:5996
- C:\Windows\System\YROfqyn.exe
  C:\Windows\System\YROfqyn.exe
  2⤵
  PID:6056
- C:\Windows\System\AkDamqN.exe
  C:\Windows\System\AkDamqN.exe
  2⤵
  PID:6120
- C:\Windows\System\ekeIdMe.exe
  C:\Windows\System\ekeIdMe.exe
  2⤵
  PID:2268
- C:\Windows\System\KUXFjUx.exe
  C:\Windows\System\KUXFjUx.exe
  2⤵
  PID:3244
- C:\Windows\System\bGnXods.exe
  C:\Windows\System\bGnXods.exe
  2⤵
  PID:3192
- C:\Windows\System\DxXNuFH.exe
  C:\Windows\System\DxXNuFH.exe
  2⤵
  PID:5224
- C:\Windows\System\SuYmdCA.exe
  C:\Windows\System\SuYmdCA.exe
  2⤵
  PID:5356
- C:\Windows\System\pSUmfyz.exe
  C:\Windows\System\pSUmfyz.exe
  2⤵
  PID:5496
- C:\Windows\System\ClHBMzq.exe
  C:\Windows\System\ClHBMzq.exe
  2⤵
  PID:5664
- C:\Windows\System\bEjKCvS.exe
  C:\Windows\System\bEjKCvS.exe
  2⤵
  PID:6168
- C:\Windows\System\bGEFewo.exe
  C:\Windows\System\bGEFewo.exe
  2⤵
  PID:6184
- C:\Windows\System\lCeKNER.exe
  C:\Windows\System\lCeKNER.exe
  2⤵
  PID:6216
- C:\Windows\System\BBcmGqk.exe
  C:\Windows\System\BBcmGqk.exe
  2⤵
  PID:6240
- C:\Windows\System\YuwvvJi.exe
  C:\Windows\System\YuwvvJi.exe
  2⤵
  PID:6268
- C:\Windows\System\uPcepnw.exe
  C:\Windows\System\uPcepnw.exe
  2⤵
  PID:6296
- C:\Windows\System\GVnBPpo.exe
  C:\Windows\System\GVnBPpo.exe
  2⤵
  PID:6324
- C:\Windows\System\PYskPnJ.exe
  C:\Windows\System\PYskPnJ.exe
  2⤵
  PID:6352
- C:\Windows\System\XyzeyoA.exe
  C:\Windows\System\XyzeyoA.exe
  2⤵
  PID:6380
- C:\Windows\System\nhPBpbG.exe
  C:\Windows\System\nhPBpbG.exe
  2⤵
  PID:6408
- C:\Windows\System\YdVEWut.exe
  C:\Windows\System\YdVEWut.exe
  2⤵
  PID:6436
- C:\Windows\System\WVgbZOT.exe
  C:\Windows\System\WVgbZOT.exe
  2⤵
  PID:6464
- C:\Windows\System\yRdaCKG.exe
  C:\Windows\System\yRdaCKG.exe
  2⤵
  PID:6492
- C:\Windows\System\JjcAYyj.exe
  C:\Windows\System\JjcAYyj.exe
  2⤵
  PID:6516
- C:\Windows\System\HCyxJxe.exe
  C:\Windows\System\HCyxJxe.exe
  2⤵
  PID:6548
- C:\Windows\System\wrbNGBC.exe
  C:\Windows\System\wrbNGBC.exe
  2⤵
  PID:6576
- C:\Windows\System\oftuWgJ.exe
  C:\Windows\System\oftuWgJ.exe
  2⤵
  PID:6604
- C:\Windows\System\icNMhwq.exe
  C:\Windows\System\icNMhwq.exe
  2⤵
  PID:6632
- C:\Windows\System\KJAMXOQ.exe
  C:\Windows\System\KJAMXOQ.exe
  2⤵
  PID:6660
- C:\Windows\System\CrdNOqb.exe
  C:\Windows\System\CrdNOqb.exe
  2⤵
  PID:6688
- C:\Windows\System\yyZmTcJ.exe
  C:\Windows\System\yyZmTcJ.exe
  2⤵
  PID:6716
- C:\Windows\System\jbpRnnt.exe
  C:\Windows\System\jbpRnnt.exe
  2⤵
  PID:6744
- C:\Windows\System\kKDAkod.exe
  C:\Windows\System\kKDAkod.exe
  2⤵
  PID:6772
- C:\Windows\System\CxKeXSe.exe
  C:\Windows\System\CxKeXSe.exe
  2⤵
  PID:6800
- C:\Windows\System\qCfGOWM.exe
  C:\Windows\System\qCfGOWM.exe
  2⤵
  PID:6828
- C:\Windows\System\qEbQGPJ.exe
  C:\Windows\System\qEbQGPJ.exe
  2⤵
  PID:6856
- C:\Windows\System\ehRvvWm.exe
  C:\Windows\System\ehRvvWm.exe
  2⤵
  PID:6880
- C:\Windows\System\wmGitDA.exe
  C:\Windows\System\wmGitDA.exe
  2⤵
  PID:6912
- C:\Windows\System\SeWHFdE.exe
  C:\Windows\System\SeWHFdE.exe
  2⤵
  PID:6940
- C:\Windows\System\bLcxQmy.exe
  C:\Windows\System\bLcxQmy.exe
  2⤵
  PID:6968
- C:\Windows\System\JROwRBV.exe
  C:\Windows\System\JROwRBV.exe
  2⤵
  PID:6996
- C:\Windows\System\NqARvzL.exe
  C:\Windows\System\NqARvzL.exe
  2⤵
  PID:7088
- C:\Windows\System\fxxWOif.exe
  C:\Windows\System\fxxWOif.exe
  2⤵
  PID:7112
- C:\Windows\System\aPMLxMt.exe
  C:\Windows\System\aPMLxMt.exe
  2⤵
  PID:7136
- C:\Windows\System\ESdkRex.exe
  C:\Windows\System\ESdkRex.exe
  2⤵
  PID:7156
- C:\Windows\System\vOiUusj.exe
  C:\Windows\System\vOiUusj.exe
  2⤵
  PID:5896
- C:\Windows\System\FzAWETe.exe
  C:\Windows\System\FzAWETe.exe
  2⤵
  PID:6032
- C:\Windows\System\zxMuHfD.exe
  C:\Windows\System\zxMuHfD.exe
  2⤵
  PID:4552
- C:\Windows\System\IbapSmH.exe
  C:\Windows\System\IbapSmH.exe
  2⤵
  PID:924
- C:\Windows\System\bFEuMJD.exe
  C:\Windows\System\bFEuMJD.exe
  2⤵
  PID:2136
- C:\Windows\System\VWGTvSG.exe
  C:\Windows\System\VWGTvSG.exe
  2⤵
  PID:5300
- C:\Windows\System\GfzmuhM.exe
  C:\Windows\System\GfzmuhM.exe
  2⤵
  PID:2320
- C:\Windows\System\LhINCBe.exe
  C:\Windows\System\LhINCBe.exe
  2⤵
  PID:6180
- C:\Windows\System\wjMmIdv.exe
  C:\Windows\System\wjMmIdv.exe
  2⤵
  PID:6232
- C:\Windows\System\qRWWyOA.exe
  C:\Windows\System\qRWWyOA.exe
  2⤵
  PID:6364
- C:\Windows\System\FVXFvwq.exe
  C:\Windows\System\FVXFvwq.exe
  2⤵
  PID:6420
- C:\Windows\System\jjJKdzt.exe
  C:\Windows\System\jjJKdzt.exe
  2⤵
  PID:6456
- C:\Windows\System\faPojei.exe
  C:\Windows\System\faPojei.exe
  2⤵
  PID:6508
- C:\Windows\System\qeebKZc.exe
  C:\Windows\System\qeebKZc.exe
  2⤵
  PID:6536
- C:\Windows\System\XmVMrSQ.exe
  C:\Windows\System\XmVMrSQ.exe
  2⤵
  PID:6592
- C:\Windows\System\xmeoYSF.exe
  C:\Windows\System\xmeoYSF.exe
  2⤵
  PID:5088
- C:\Windows\System\FzIahLu.exe
  C:\Windows\System\FzIahLu.exe
  2⤵
  PID:3972
- C:\Windows\System\gdIvqbv.exe
  C:\Windows\System\gdIvqbv.exe
  2⤵
  PID:6704
- C:\Windows\System\jbPpCdg.exe
  C:\Windows\System\jbPpCdg.exe
  2⤵
  PID:6756
- C:\Windows\System\SvOzIaw.exe
  C:\Windows\System\SvOzIaw.exe
  2⤵
  PID:4188
- C:\Windows\System\FMUvxXF.exe
  C:\Windows\System\FMUvxXF.exe
  2⤵
  PID:3396
- C:\Windows\System\JADFFCi.exe
  C:\Windows\System\JADFFCi.exe
  2⤵
  PID:6820
- C:\Windows\System\DDxxMRx.exe
  C:\Windows\System\DDxxMRx.exe
  2⤵
  PID:4772
- C:\Windows\System\mVHCVaK.exe
  C:\Windows\System\mVHCVaK.exe
  2⤵
  PID:1848
- C:\Windows\System\teUQUMN.exe
  C:\Windows\System\teUQUMN.exe
  2⤵
  PID:7008
- C:\Windows\System\AqihAhl.exe
  C:\Windows\System\AqihAhl.exe
  2⤵
  PID:1440
- C:\Windows\System\qoIYDXw.exe
  C:\Windows\System\qoIYDXw.exe
  2⤵
  PID:540
- C:\Windows\System\xsYeGtP.exe
  C:\Windows\System\xsYeGtP.exe
  2⤵
  PID:6876
- C:\Windows\System\CXIkvfe.exe
  C:\Windows\System\CXIkvfe.exe
  2⤵
  PID:4684
- C:\Windows\System\AfUueWY.exe
  C:\Windows\System\AfUueWY.exe
  2⤵
  PID:7152
- C:\Windows\System\TxYeZCr.exe
  C:\Windows\System\TxYeZCr.exe
  2⤵
  PID:4976
- C:\Windows\System\HCwWWCH.exe
  C:\Windows\System\HCwWWCH.exe
  2⤵
  PID:6344
- C:\Windows\System\wDEWgzs.exe
  C:\Windows\System\wDEWgzs.exe
  2⤵
  PID:6452
- C:\Windows\System\pEnUqKT.exe
  C:\Windows\System\pEnUqKT.exe
  2⤵
  PID:2412
- C:\Windows\System\pHquSum.exe
  C:\Windows\System\pHquSum.exe
  2⤵
  PID:1920
- C:\Windows\System\obxGvvs.exe
  C:\Windows\System\obxGvvs.exe
  2⤵
  PID:6700
- C:\Windows\System\yQNUHJk.exe
  C:\Windows\System\yQNUHJk.exe
  2⤵
  PID:6848
- C:\Windows\System\NXQldBk.exe
  C:\Windows\System\NXQldBk.exe
  2⤵
  PID:4424
- C:\Windows\System\VdMKfrp.exe
  C:\Windows\System\VdMKfrp.exe
  2⤵
  PID:6984
- C:\Windows\System\jTgkOZn.exe
  C:\Windows\System\jTgkOZn.exe
  2⤵
  PID:2060
- C:\Windows\System\EtxqPtT.exe
  C:\Windows\System\EtxqPtT.exe
  2⤵
  PID:5836
- C:\Windows\System\Kjyulbh.exe
  C:\Windows\System\Kjyulbh.exe
  2⤵
  PID:5436
- C:\Windows\System\XkaZhMU.exe
  C:\Windows\System\XkaZhMU.exe
  2⤵
  PID:6176
- C:\Windows\System\BLmUyTQ.exe
  C:\Windows\System\BLmUyTQ.exe
  2⤵
  PID:6644
- C:\Windows\System\LrnVIXZ.exe
  C:\Windows\System\LrnVIXZ.exe
  2⤵
  PID:6652
- C:\Windows\System\SkmqIBQ.exe
  C:\Windows\System\SkmqIBQ.exe
  2⤵
  PID:6788
- C:\Windows\System\eLttuOo.exe
  C:\Windows\System\eLttuOo.exe
  2⤵
  PID:3732
- C:\Windows\System\hBMKssG.exe
  C:\Windows\System\hBMKssG.exe
  2⤵
  PID:7124
- C:\Windows\System\upiYwHq.exe
  C:\Windows\System\upiYwHq.exe
  2⤵
  PID:6212
- C:\Windows\System\zRrHQad.exe
  C:\Windows\System\zRrHQad.exe
  2⤵
  PID:6792
- C:\Windows\System\aYAfXue.exe
  C:\Windows\System\aYAfXue.exe
  2⤵
  PID:4172
- C:\Windows\System\dmfWIFO.exe
  C:\Windows\System\dmfWIFO.exe
  2⤵
  PID:7192
- C:\Windows\System\arzUvjQ.exe
  C:\Windows\System\arzUvjQ.exe
  2⤵
  PID:7208
- C:\Windows\System\DuvjPiq.exe
  C:\Windows\System\DuvjPiq.exe
  2⤵
  PID:7240
- C:\Windows\System\PHmfSiG.exe
  C:\Windows\System\PHmfSiG.exe
  2⤵
  PID:7272
- C:\Windows\System\ptJJqQY.exe
  C:\Windows\System\ptJJqQY.exe
  2⤵
  PID:7296
- C:\Windows\System\NIVTEIJ.exe
  C:\Windows\System\NIVTEIJ.exe
  2⤵
  PID:7352
- C:\Windows\System\jGEZfJb.exe
  C:\Windows\System\jGEZfJb.exe
  2⤵
  PID:7376
- C:\Windows\System\gVOTolV.exe
  C:\Windows\System\gVOTolV.exe
  2⤵
  PID:7404
- C:\Windows\System\NjbDepD.exe
  C:\Windows\System\NjbDepD.exe
  2⤵
  PID:7428
- C:\Windows\System\GFOfdoy.exe
  C:\Windows\System\GFOfdoy.exe
  2⤵
  PID:7448
- C:\Windows\System\iipiqkV.exe
  C:\Windows\System\iipiqkV.exe
  2⤵
  PID:7472
- C:\Windows\System\skmOrBI.exe
  C:\Windows\System\skmOrBI.exe
  2⤵
  PID:7500
- C:\Windows\System\vvZnZuW.exe
  C:\Windows\System\vvZnZuW.exe
  2⤵
  PID:7524
- C:\Windows\System\CjmKVOA.exe
  C:\Windows\System\CjmKVOA.exe
  2⤵
  PID:7552
- C:\Windows\System\MhchBlm.exe
  C:\Windows\System\MhchBlm.exe
  2⤵
  PID:7596
- C:\Windows\System\AASYAmx.exe
  C:\Windows\System\AASYAmx.exe
  2⤵
  PID:7632
- C:\Windows\System\IfCiFkr.exe
  C:\Windows\System\IfCiFkr.exe
  2⤵
  PID:7660
- C:\Windows\System\JUhDMjH.exe
  C:\Windows\System\JUhDMjH.exe
  2⤵
  PID:7684
- C:\Windows\System\zWEczMT.exe
  C:\Windows\System\zWEczMT.exe
  2⤵
  PID:7728
- C:\Windows\System\onBpWdN.exe
  C:\Windows\System\onBpWdN.exe
  2⤵
  PID:7756
- C:\Windows\System\ANaulAd.exe
  C:\Windows\System\ANaulAd.exe
  2⤵
  PID:7772
- C:\Windows\System\dgDaaSW.exe
  C:\Windows\System\dgDaaSW.exe
  2⤵
  PID:7812
- C:\Windows\System\pOPfdDY.exe
  C:\Windows\System\pOPfdDY.exe
  2⤵
  PID:7828
- C:\Windows\System\kqWCPLJ.exe
  C:\Windows\System\kqWCPLJ.exe
  2⤵
  PID:7856
- C:\Windows\System\WsVKvRU.exe
  C:\Windows\System\WsVKvRU.exe
  2⤵
  PID:7904
- C:\Windows\System\kLhnjiD.exe
  C:\Windows\System\kLhnjiD.exe
  2⤵
  PID:7920
- C:\Windows\System\udRQaRG.exe
  C:\Windows\System\udRQaRG.exe
  2⤵
  PID:7948
- C:\Windows\System\BGcZHvu.exe
  C:\Windows\System\BGcZHvu.exe
  2⤵
  PID:7976
- C:\Windows\System\hqHKHNW.exe
  C:\Windows\System\hqHKHNW.exe
  2⤵
  PID:8004
- C:\Windows\System\RJeUPiv.exe
  C:\Windows\System\RJeUPiv.exe
  2⤵
  PID:8020
- C:\Windows\System\aIAsxgy.exe
  C:\Windows\System\aIAsxgy.exe
  2⤵
  PID:8048
- C:\Windows\System\dbRQGMu.exe
  C:\Windows\System\dbRQGMu.exe
  2⤵
  PID:8072
- C:\Windows\System\gdFuDGg.exe
  C:\Windows\System\gdFuDGg.exe
  2⤵
  PID:8096
- C:\Windows\System\ctxecXc.exe
  C:\Windows\System\ctxecXc.exe
  2⤵
  PID:8120
- C:\Windows\System\xjfJmTF.exe
  C:\Windows\System\xjfJmTF.exe
  2⤵
  PID:8156
- C:\Windows\System\AiGqlFw.exe
  C:\Windows\System\AiGqlFw.exe
  2⤵
  PID:8176
- C:\Windows\System\AHvVcAE.exe
  C:\Windows\System\AHvVcAE.exe
  2⤵
  PID:3256
- C:\Windows\System\nRWQSEi.exe
  C:\Windows\System\nRWQSEi.exe
  2⤵
  PID:4436
- C:\Windows\System\XZEsCFM.exe
  C:\Windows\System\XZEsCFM.exe
  2⤵
  PID:7264
- C:\Windows\System\djjFtQG.exe
  C:\Windows\System\djjFtQG.exe
  2⤵
  PID:7288
- C:\Windows\System\JmqeElS.exe
  C:\Windows\System\JmqeElS.exe
  2⤵
  PID:7652
- C:\Windows\System\QDgePDP.exe
  C:\Windows\System\QDgePDP.exe
  2⤵
  PID:7720
- C:\Windows\System\lqkuFTJ.exe
  C:\Windows\System\lqkuFTJ.exe
  2⤵
  PID:7748
- C:\Windows\System\XMKNOlx.exe
  C:\Windows\System\XMKNOlx.exe
  2⤵
  PID:7984
- C:\Windows\System\ukhgUPW.exe
  C:\Windows\System\ukhgUPW.exe
  2⤵
  PID:8056
- C:\Windows\System\UsoKIJe.exe
  C:\Windows\System\UsoKIJe.exe
  2⤵
  PID:8080
- C:\Windows\System\RfVWZCi.exe
  C:\Windows\System\RfVWZCi.exe
  2⤵
  PID:8136
- C:\Windows\System\BYYQXKd.exe
  C:\Windows\System\BYYQXKd.exe
  2⤵
  PID:7344
- C:\Windows\System\bFbYQTz.exe
  C:\Windows\System\bFbYQTz.exe
  2⤵
  PID:7420
- C:\Windows\System\IZhbIDE.exe
  C:\Windows\System\IZhbIDE.exe
  2⤵
  PID:7456
- C:\Windows\System\vQSkycb.exe
  C:\Windows\System\vQSkycb.exe
  2⤵
  PID:7484
- C:\Windows\System\fhKTgTr.exe
  C:\Windows\System\fhKTgTr.exe
  2⤵
  PID:7520
- C:\Windows\System\IeGrJoz.exe
  C:\Windows\System\IeGrJoz.exe
  2⤵
  PID:7740
- C:\Windows\System\uAnmgBu.exe
  C:\Windows\System\uAnmgBu.exe
  2⤵
  PID:7232
- C:\Windows\System\MObJMMu.exe
  C:\Windows\System\MObJMMu.exe
  2⤵
  PID:7752
- C:\Windows\System\XrHIftK.exe
  C:\Windows\System\XrHIftK.exe
  2⤵
  PID:8040
- C:\Windows\System\EATqxKV.exe
  C:\Windows\System\EATqxKV.exe
  2⤵
  PID:8172
- C:\Windows\System\ddkbNNQ.exe
  C:\Windows\System\ddkbNNQ.exe
  2⤵
  PID:7604
- C:\Windows\System\dVTgXca.exe
  C:\Windows\System\dVTgXca.exe
  2⤵
  PID:8188
- C:\Windows\System\KdfruaR.exe
  C:\Windows\System\KdfruaR.exe
  2⤵
  PID:7704
- C:\Windows\System\eSnXeFl.exe
  C:\Windows\System\eSnXeFl.exe
  2⤵
  PID:7320
- C:\Windows\System\PTQszvM.exe
  C:\Windows\System\PTQszvM.exe
  2⤵
  PID:7444
- C:\Windows\System\OyVKRYS.exe
  C:\Windows\System\OyVKRYS.exe
  2⤵
  PID:8196
- C:\Windows\System\vAqnrQQ.exe
  C:\Windows\System\vAqnrQQ.exe
  2⤵
  PID:8224
- C:\Windows\System\VFgRCYa.exe
  C:\Windows\System\VFgRCYa.exe
  2⤵
  PID:8248
- C:\Windows\System\wTcgGzI.exe
  C:\Windows\System\wTcgGzI.exe
  2⤵
  PID:8276
- C:\Windows\System\wZQFJBD.exe
  C:\Windows\System\wZQFJBD.exe
  2⤵
  PID:8308
- C:\Windows\System\ESDylyO.exe
  C:\Windows\System\ESDylyO.exe
  2⤵
  PID:8332
- C:\Windows\System\fbYNEVb.exe
  C:\Windows\System\fbYNEVb.exe
  2⤵
  PID:8360
- C:\Windows\System\JqGYBvs.exe
  C:\Windows\System\JqGYBvs.exe
  2⤵
  PID:8384
- C:\Windows\System\BYKmlNr.exe
  C:\Windows\System\BYKmlNr.exe
  2⤵
  PID:8408
- C:\Windows\System\oZzPvwt.exe
  C:\Windows\System\oZzPvwt.exe
  2⤵
  PID:8464
- C:\Windows\System\JhxJZSb.exe
  C:\Windows\System\JhxJZSb.exe
  2⤵
  PID:8496
- C:\Windows\System\puccyGi.exe
  C:\Windows\System\puccyGi.exe
  2⤵
  PID:8516
- C:\Windows\System\NLHbQgR.exe
  C:\Windows\System\NLHbQgR.exe
  2⤵
  PID:8536
- C:\Windows\System\SUiogzu.exe
  C:\Windows\System\SUiogzu.exe
  2⤵
  PID:8568
- C:\Windows\System\QWoUIpz.exe
  C:\Windows\System\QWoUIpz.exe
  2⤵
  PID:8612
- C:\Windows\System\pknpaAn.exe
  C:\Windows\System\pknpaAn.exe
  2⤵
  PID:8636
- C:\Windows\System\ApAzuDA.exe
  C:\Windows\System\ApAzuDA.exe
  2⤵
  PID:8656
- C:\Windows\System\UPnzJRR.exe
  C:\Windows\System\UPnzJRR.exe
  2⤵
  PID:8688
- C:\Windows\System\JiEQanB.exe
  C:\Windows\System\JiEQanB.exe
  2⤵
  PID:8724
- C:\Windows\System\isUDpkM.exe
  C:\Windows\System\isUDpkM.exe
  2⤵
  PID:8752
- C:\Windows\System\lrKGpLA.exe
  C:\Windows\System\lrKGpLA.exe
  2⤵
  PID:8780
- C:\Windows\System\GSHIQec.exe
  C:\Windows\System\GSHIQec.exe
  2⤵
  PID:8808
- C:\Windows\System\MDYWFHN.exe
  C:\Windows\System\MDYWFHN.exe
  2⤵
  PID:8824
- C:\Windows\System\RJkOVeV.exe
  C:\Windows\System\RJkOVeV.exe
  2⤵
  PID:8844
- C:\Windows\System\acrbQQW.exe
  C:\Windows\System\acrbQQW.exe
  2⤵
  PID:8876
- C:\Windows\System\ZGBNLJB.exe
  C:\Windows\System\ZGBNLJB.exe
  2⤵
  PID:8896
- C:\Windows\System\ptfjIqz.exe
  C:\Windows\System\ptfjIqz.exe
  2⤵
  PID:8912
- C:\Windows\System\WdvRbeh.exe
  C:\Windows\System\WdvRbeh.exe
  2⤵
  PID:8928
- C:\Windows\System\nThehDs.exe
  C:\Windows\System\nThehDs.exe
  2⤵
  PID:8956
- C:\Windows\System\XGMLGhb.exe
  C:\Windows\System\XGMLGhb.exe
  2⤵
  PID:8996
- C:\Windows\System\oxXObEc.exe
  C:\Windows\System\oxXObEc.exe
  2⤵
  PID:9044
- C:\Windows\System\OjlGMuK.exe
  C:\Windows\System\OjlGMuK.exe
  2⤵
  PID:9072
- C:\Windows\System\GWASokB.exe
  C:\Windows\System\GWASokB.exe
  2⤵
  PID:9100
- C:\Windows\System\RafaiBR.exe
  C:\Windows\System\RafaiBR.exe
  2⤵
  PID:9120
- C:\Windows\System\jecVtrP.exe
  C:\Windows\System\jecVtrP.exe
  2⤵
  PID:9148
- C:\Windows\System\OgFgEbo.exe
  C:\Windows\System\OgFgEbo.exe
  2⤵
  PID:9172
- C:\Windows\System\WjNNqOc.exe
  C:\Windows\System\WjNNqOc.exe
  2⤵
  PID:9212
- C:\Windows\System\GsfPsKB.exe
  C:\Windows\System\GsfPsKB.exe
  2⤵
  PID:8236
- C:\Windows\System\hnOWbNA.exe
  C:\Windows\System\hnOWbNA.exe
  2⤵
  PID:8320
- C:\Windows\System\eZRqSqN.exe
  C:\Windows\System\eZRqSqN.exe
  2⤵
  PID:8296
- C:\Windows\System\NmGqMBB.exe
  C:\Windows\System\NmGqMBB.exe
  2⤵
  PID:8436
- C:\Windows\System\VcBNDNJ.exe
  C:\Windows\System\VcBNDNJ.exe
  2⤵
  PID:8460
- C:\Windows\System\BElIQTA.exe
  C:\Windows\System\BElIQTA.exe
  2⤵
  PID:8492
- C:\Windows\System\hdHevKC.exe
  C:\Windows\System\hdHevKC.exe
  2⤵
  PID:8556
- C:\Windows\System\qFcfqWt.exe
  C:\Windows\System\qFcfqWt.exe
  2⤵
  PID:8676
- C:\Windows\System\PKkoJGX.exe
  C:\Windows\System\PKkoJGX.exe
  2⤵
  PID:8744
- C:\Windows\System\YcNctga.exe
  C:\Windows\System\YcNctga.exe
  2⤵
  PID:8800
- C:\Windows\System\rBqqrAQ.exe
  C:\Windows\System\rBqqrAQ.exe
  2⤵
  PID:8860
- C:\Windows\System\mImUAiq.exe
  C:\Windows\System\mImUAiq.exe
  2⤵
  PID:8940
- C:\Windows\System\MWkZYkx.exe
  C:\Windows\System\MWkZYkx.exe
  2⤵
  PID:8992
- C:\Windows\System\mGXHABV.exe
  C:\Windows\System\mGXHABV.exe
  2⤵
  PID:9064
- C:\Windows\System\sJcEcUx.exe
  C:\Windows\System\sJcEcUx.exe
  2⤵
  PID:9188
- C:\Windows\System\AUhklNG.exe
  C:\Windows\System\AUhklNG.exe
  2⤵
  PID:8036
- C:\Windows\System\uwsZmSw.exe
  C:\Windows\System\uwsZmSw.exe
  2⤵
  PID:8376
- C:\Windows\System\TPkMNOj.exe
  C:\Windows\System\TPkMNOj.exe
  2⤵
  PID:8488
- C:\Windows\System\tjizrPs.exe
  C:\Windows\System\tjizrPs.exe
  2⤵
  PID:8632
- C:\Windows\System\AzPDfRE.exe
  C:\Windows\System\AzPDfRE.exe
  2⤵
  PID:8708
- C:\Windows\System\ZfDiNpR.exe
  C:\Windows\System\ZfDiNpR.exe
  2⤵
  PID:8892
- C:\Windows\System\vUNiPUB.exe
  C:\Windows\System\vUNiPUB.exe
  2⤵
  PID:9036
- C:\Windows\System\psLYXOF.exe
  C:\Windows\System\psLYXOF.exe
  2⤵
  PID:8208
- C:\Windows\System\sZlSFNz.exe
  C:\Windows\System\sZlSFNz.exe
  2⤵
  PID:8392
- C:\Windows\System\GflVgvC.exe
  C:\Windows\System\GflVgvC.exe
  2⤵
  PID:8836
- C:\Windows\System\qNxubmy.exe
  C:\Windows\System\qNxubmy.exe
  2⤵
  PID:9016
- C:\Windows\System\bRTdFEm.exe
  C:\Windows\System\bRTdFEm.exe
  2⤵
  PID:8716
- C:\Windows\System\fETofWM.exe
  C:\Windows\System\fETofWM.exe
  2⤵
  PID:9224
- C:\Windows\System\Ktvlcxw.exe
  C:\Windows\System\Ktvlcxw.exe
  2⤵
  PID:9248
- C:\Windows\System\ScOFTMV.exe
  C:\Windows\System\ScOFTMV.exe
  2⤵
  PID:9308
- C:\Windows\System\wckHqLA.exe
  C:\Windows\System\wckHqLA.exe
  2⤵
  PID:9332
- C:\Windows\System\gkabyUr.exe
  C:\Windows\System\gkabyUr.exe
  2⤵
  PID:9360
- C:\Windows\System\ageaNMx.exe
  C:\Windows\System\ageaNMx.exe
  2⤵
  PID:9384
- C:\Windows\System\mifMHrD.exe
  C:\Windows\System\mifMHrD.exe
  2⤵
  PID:9412
- C:\Windows\System\dDDyZMf.exe
  C:\Windows\System\dDDyZMf.exe
  2⤵
  PID:9440
- C:\Windows\System\KEnJjoc.exe
  C:\Windows\System\KEnJjoc.exe
  2⤵
  PID:9480
- C:\Windows\System\Brvagqy.exe
  C:\Windows\System\Brvagqy.exe
  2⤵
  PID:9508
- C:\Windows\System\FaQZeAL.exe
  C:\Windows\System\FaQZeAL.exe
  2⤵
  PID:9528
- C:\Windows\System\fcJYAXL.exe
  C:\Windows\System\fcJYAXL.exe
  2⤵
  PID:9556
- C:\Windows\System\gHmUYhh.exe
  C:\Windows\System\gHmUYhh.exe
  2⤵
  PID:9596
- C:\Windows\System\pUvYqbv.exe
  C:\Windows\System\pUvYqbv.exe
  2⤵
  PID:9616
- C:\Windows\System\vyCowUq.exe
  C:\Windows\System\vyCowUq.exe
  2⤵
  PID:9640
- C:\Windows\System\UJisOBv.exe
  C:\Windows\System\UJisOBv.exe
  2⤵
  PID:9664
- C:\Windows\System\TnXErtq.exe
  C:\Windows\System\TnXErtq.exe
  2⤵
  PID:9692
- C:\Windows\System\hljyLEy.exe
  C:\Windows\System\hljyLEy.exe
  2⤵
  PID:9724
- C:\Windows\System\CVKjVPX.exe
  C:\Windows\System\CVKjVPX.exe
  2⤵
  PID:9740
- C:\Windows\System\VWvmhhu.exe
  C:\Windows\System\VWvmhhu.exe
  2⤵
  PID:9780
- C:\Windows\System\SHCsNAU.exe
  C:\Windows\System\SHCsNAU.exe
  2⤵
  PID:9804
- C:\Windows\System\BVWdrin.exe
  C:\Windows\System\BVWdrin.exe
  2⤵
  PID:9840
- C:\Windows\System\auNFNxu.exe
  C:\Windows\System\auNFNxu.exe
  2⤵
  PID:9876
- C:\Windows\System\OSePDPL.exe
  C:\Windows\System\OSePDPL.exe
  2⤵
  PID:9896
- C:\Windows\System\tIXuLcg.exe
  C:\Windows\System\tIXuLcg.exe
  2⤵
  PID:9920
- C:\Windows\System\tnaWbED.exe
  C:\Windows\System\tnaWbED.exe
  2⤵
  PID:9940
- C:\Windows\System\INNhmYI.exe
  C:\Windows\System\INNhmYI.exe
  2⤵
  PID:9964
- C:\Windows\System\TVcdyRg.exe
  C:\Windows\System\TVcdyRg.exe
  2⤵
  PID:9992
- C:\Windows\System\geSMyrE.exe
  C:\Windows\System\geSMyrE.exe
  2⤵
  PID:10012
- C:\Windows\System\NCONDNP.exe
  C:\Windows\System\NCONDNP.exe
  2⤵
  PID:10036
- C:\Windows\System\wlHsirz.exe
  C:\Windows\System\wlHsirz.exe
  2⤵
  PID:10064
- C:\Windows\System\eJIivcx.exe
  C:\Windows\System\eJIivcx.exe
  2⤵
  PID:10092
- C:\Windows\System\xhKYgne.exe
  C:\Windows\System\xhKYgne.exe
  2⤵
  PID:10124
- C:\Windows\System\LCEafbl.exe
  C:\Windows\System\LCEafbl.exe
  2⤵
  PID:10148
- C:\Windows\System\ybZhcyW.exe
  C:\Windows\System\ybZhcyW.exe
  2⤵
  PID:10188
- C:\Windows\System\JwtAPPZ.exe
  C:\Windows\System\JwtAPPZ.exe
  2⤵
  PID:10216
- C:\Windows\System\ziwxUzx.exe
  C:\Windows\System\ziwxUzx.exe
  2⤵
  PID:9132
- C:\Windows\System\HWumWoS.exe
  C:\Windows\System\HWumWoS.exe
  2⤵
  PID:9220
- C:\Windows\System\PpfHGKQ.exe
  C:\Windows\System\PpfHGKQ.exe
  2⤵
  PID:9316
- C:\Windows\System\AjpIZNM.exe
  C:\Windows\System\AjpIZNM.exe
  2⤵
  PID:9348
- C:\Windows\System\RRKTqIj.exe
  C:\Windows\System\RRKTqIj.exe
  2⤵
  PID:9476
- C:\Windows\System\gijjNVB.exe
  C:\Windows\System\gijjNVB.exe
  2⤵
  PID:9544
- C:\Windows\System\tdMtyWt.exe
  C:\Windows\System\tdMtyWt.exe
  2⤵
  PID:9572
- C:\Windows\System\rIupvxV.exe
  C:\Windows\System\rIupvxV.exe
  2⤵
  PID:9636
- C:\Windows\System\nfhddCB.exe
  C:\Windows\System\nfhddCB.exe
  2⤵
  PID:9708
- C:\Windows\System\nzUkutz.exe
  C:\Windows\System\nzUkutz.exe
  2⤵
  PID:9764
- C:\Windows\System\ARhoLBc.exe
  C:\Windows\System\ARhoLBc.exe
  2⤵
  PID:9824
- C:\Windows\System\mBNojuw.exe
  C:\Windows\System\mBNojuw.exe
  2⤵
  PID:9912
- C:\Windows\System\qqvQrRX.exe
  C:\Windows\System\qqvQrRX.exe
  2⤵
  PID:9960
- C:\Windows\System\MLgFhDu.exe
  C:\Windows\System\MLgFhDu.exe
  2⤵
  PID:10008
- C:\Windows\System\hXcWewX.exe
  C:\Windows\System\hXcWewX.exe
  2⤵
  PID:10120
- C:\Windows\System\pBKYxwE.exe
  C:\Windows\System\pBKYxwE.exe
  2⤵
  PID:10180
- C:\Windows\System\qnBdyXX.exe
  C:\Windows\System\qnBdyXX.exe
  2⤵
  PID:10208
- C:\Windows\System\MrQPjyk.exe
  C:\Windows\System\MrQPjyk.exe
  2⤵
  PID:9328
- C:\Windows\System\cpcYpkJ.exe
  C:\Windows\System\cpcYpkJ.exe
  2⤵
  PID:9408
- C:\Windows\System\ACTQPzN.exe
  C:\Windows\System\ACTQPzN.exe
  2⤵
  PID:9716
- C:\Windows\System\KGyfCxK.exe
  C:\Windows\System\KGyfCxK.exe
  2⤵
  PID:9632
- C:\Windows\System\xtyHEpJ.exe
  C:\Windows\System\xtyHEpJ.exe
  2⤵
  PID:9812
- C:\Windows\System\iYwKeaM.exe
  C:\Windows\System\iYwKeaM.exe
  2⤵
  PID:10084
- C:\Windows\System\zNBjpXv.exe
  C:\Windows\System\zNBjpXv.exe
  2⤵
  PID:9344
- C:\Windows\System\AxNogkj.exe
  C:\Windows\System\AxNogkj.exe
  2⤵
  PID:9380
- C:\Windows\System\PEZQbfp.exe
  C:\Windows\System\PEZQbfp.exe
  2⤵
  PID:9868
- C:\Windows\System\feKENTM.exe
  C:\Windows\System\feKENTM.exe
  2⤵
  PID:9236
- C:\Windows\System\vnwTlny.exe
  C:\Windows\System\vnwTlny.exe
  2⤵
  PID:10244
- C:\Windows\System\GErpYLk.exe
  C:\Windows\System\GErpYLk.exe
  2⤵
  PID:10284
- C:\Windows\System\LcQbQnE.exe
  C:\Windows\System\LcQbQnE.exe
  2⤵
  PID:10304
- C:\Windows\System\zfhZBOD.exe
  C:\Windows\System\zfhZBOD.exe
  2⤵
  PID:10324
- C:\Windows\System\DwPVVzK.exe
  C:\Windows\System\DwPVVzK.exe
  2⤵
  PID:10360
- C:\Windows\System\tvyGYae.exe
  C:\Windows\System\tvyGYae.exe
  2⤵
  PID:10400
- C:\Windows\System\Pqdrrvj.exe
  C:\Windows\System\Pqdrrvj.exe
  2⤵
  PID:10428
- C:\Windows\System\UWwGWHM.exe
  C:\Windows\System\UWwGWHM.exe
  2⤵
  PID:10444
- C:\Windows\System\inKwWKK.exe
  C:\Windows\System\inKwWKK.exe
  2⤵
  PID:10472
- C:\Windows\System\ltnvNDS.exe
  C:\Windows\System\ltnvNDS.exe
  2⤵
  PID:10504
- C:\Windows\System\ZOWbwkF.exe
  C:\Windows\System\ZOWbwkF.exe
  2⤵
  PID:10528
- C:\Windows\System\ZTJRtUO.exe
  C:\Windows\System\ZTJRtUO.exe
  2⤵
  PID:10548
- C:\Windows\System\eRNiegN.exe
  C:\Windows\System\eRNiegN.exe
  2⤵
  PID:10584
- C:\Windows\System\nDuaWYI.exe
  C:\Windows\System\nDuaWYI.exe
  2⤵
  PID:10604
- C:\Windows\System\TzakWEP.exe
  C:\Windows\System\TzakWEP.exe
  2⤵
  PID:10624
- C:\Windows\System\gJvbDXC.exe
  C:\Windows\System\gJvbDXC.exe
  2⤵
  PID:10656
- C:\Windows\System\UFNPfjt.exe
  C:\Windows\System\UFNPfjt.exe
  2⤵
  PID:10680
- C:\Windows\System\UiVXoWG.exe
  C:\Windows\System\UiVXoWG.exe
  2⤵
  PID:10704
- C:\Windows\System\FkyHcqv.exe
  C:\Windows\System\FkyHcqv.exe
  2⤵
  PID:10728
- C:\Windows\System\bIJvCtA.exe
  C:\Windows\System\bIJvCtA.exe
  2⤵
  PID:10748
- C:\Windows\System\iWVvSWp.exe
  C:\Windows\System\iWVvSWp.exe
  2⤵
  PID:10768
- C:\Windows\System\Qqjjfvz.exe
  C:\Windows\System\Qqjjfvz.exe
  2⤵
  PID:10796
- C:\Windows\System\oIrhFzx.exe
  C:\Windows\System\oIrhFzx.exe
  2⤵
  PID:10836
- C:\Windows\System\irZyVLc.exe
  C:\Windows\System\irZyVLc.exe
  2⤵
  PID:10896
- C:\Windows\System\KPhRvdH.exe
  C:\Windows\System\KPhRvdH.exe
  2⤵
  PID:10920
- C:\Windows\System\zGGAKUz.exe
  C:\Windows\System\zGGAKUz.exe
  2⤵
  PID:10936
- C:\Windows\System\SJTmHSi.exe
  C:\Windows\System\SJTmHSi.exe
  2⤵
  PID:10968
- C:\Windows\System\LtdHbLd.exe
  C:\Windows\System\LtdHbLd.exe
  2⤵
  PID:10992
- C:\Windows\System\aHTIWgN.exe
  C:\Windows\System\aHTIWgN.exe
  2⤵
  PID:11012
- C:\Windows\System\SPUDAsI.exe
  C:\Windows\System\SPUDAsI.exe
  2⤵
  PID:11060
- C:\Windows\System\vWghOLq.exe
  C:\Windows\System\vWghOLq.exe
  2⤵
  PID:11076
- C:\Windows\System\jqaemCP.exe
  C:\Windows\System\jqaemCP.exe
  2⤵
  PID:11100
- C:\Windows\System\KyRZokb.exe
  C:\Windows\System\KyRZokb.exe
  2⤵
  PID:11156
- C:\Windows\System\FpIAnig.exe
  C:\Windows\System\FpIAnig.exe
  2⤵
  PID:11176
- C:\Windows\System\rnMsvkG.exe
  C:\Windows\System\rnMsvkG.exe
  2⤵
  PID:11204
- C:\Windows\System\dECaufc.exe
  C:\Windows\System\dECaufc.exe
  2⤵
  PID:11244
- C:\Windows\System\OGvrTLL.exe
  C:\Windows\System\OGvrTLL.exe
  2⤵
  PID:11260
- C:\Windows\System\YMEajZC.exe
  C:\Windows\System\YMEajZC.exe
  2⤵
  PID:10356
- C:\Windows\System\BXWRRNJ.exe
  C:\Windows\System\BXWRRNJ.exe
  2⤵
  PID:10420
- C:\Windows\System\AtYJRHG.exe
  C:\Windows\System\AtYJRHG.exe
  2⤵
  PID:10456
- C:\Windows\System\PayeFuZ.exe
  C:\Windows\System\PayeFuZ.exe
  2⤵
  PID:10520
- C:\Windows\System\WdhiMfV.exe
  C:\Windows\System\WdhiMfV.exe
  2⤵
  PID:10536
- C:\Windows\System\hiDjHNu.exe
  C:\Windows\System\hiDjHNu.exe
  2⤵
  PID:10572
- C:\Windows\System\FKOwmbx.exe
  C:\Windows\System\FKOwmbx.exe
  2⤵
  PID:10700
- C:\Windows\System\MRAvjwC.exe
  C:\Windows\System\MRAvjwC.exe
  2⤵
  PID:10736
- C:\Windows\System\oUwzrfP.exe
  C:\Windows\System\oUwzrfP.exe
  2⤵
  PID:10764
- C:\Windows\System\YkJEehL.exe
  C:\Windows\System\YkJEehL.exe
  2⤵
  PID:10852
- C:\Windows\System\rMryBdK.exe
  C:\Windows\System\rMryBdK.exe
  2⤵
  PID:10908
- C:\Windows\System\OleeSBc.exe
  C:\Windows\System\OleeSBc.exe
  2⤵
  PID:11008
- C:\Windows\System\siqLrcR.exe
  C:\Windows\System\siqLrcR.exe
  2⤵
  PID:11044
- C:\Windows\System\XFafftV.exe
  C:\Windows\System\XFafftV.exe
  2⤵
  PID:10212
- C:\Windows\System\YkWaLlz.exe
  C:\Windows\System\YkWaLlz.exe
  2⤵
  PID:11192
- C:\Windows\System\mszXFhn.exe
  C:\Windows\System\mszXFhn.exe
  2⤵
  PID:5064
- C:\Windows\System\cHrWBmM.exe
  C:\Windows\System\cHrWBmM.exe
  2⤵
  PID:10396
- C:\Windows\System\PFBXmEY.exe
  C:\Windows\System\PFBXmEY.exe
  2⤵
  PID:10416
- C:\Windows\System\bxQCJRg.exe
  C:\Windows\System\bxQCJRg.exe
  2⤵
  PID:10512
- C:\Windows\System\GUgCPNe.exe
  C:\Windows\System\GUgCPNe.exe
  2⤵
  PID:10636
- C:\Windows\System\LithRFX.exe
  C:\Windows\System\LithRFX.exe
  2⤵
  PID:10804
- C:\Windows\System\nsVLupu.exe
  C:\Windows\System\nsVLupu.exe
  2⤵
  PID:10980
- C:\Windows\System\yIQeAHm.exe
  C:\Windows\System\yIQeAHm.exe
  2⤵
  PID:11164
- C:\Windows\System\jHvqPvy.exe
  C:\Windows\System\jHvqPvy.exe
  2⤵
  PID:1560
- C:\Windows\System\vdiruYu.exe
  C:\Windows\System\vdiruYu.exe
  2⤵
  PID:10384
- C:\Windows\System\LCaUNTw.exe
  C:\Windows\System\LCaUNTw.exe
  2⤵
  PID:10488
- C:\Windows\System\XBSdSHC.exe
  C:\Windows\System\XBSdSHC.exe
  2⤵
  PID:11188
- C:\Windows\System\gsZRzre.exe
  C:\Windows\System\gsZRzre.exe
  2⤵
  PID:11000
- C:\Windows\System\kluwdAA.exe
  C:\Windows\System\kluwdAA.exe
  2⤵
  PID:10592
- C:\Windows\System\voXftrO.exe
  C:\Windows\System\voXftrO.exe
  2⤵
  PID:11292
- C:\Windows\System\MOdqmdA.exe
  C:\Windows\System\MOdqmdA.exe
  2⤵
  PID:11348
- C:\Windows\System\fwBhZOZ.exe
  C:\Windows\System\fwBhZOZ.exe
  2⤵
  PID:11368
- C:\Windows\System\apzeRxx.exe
  C:\Windows\System\apzeRxx.exe
  2⤵
  PID:11388
- C:\Windows\System\NrBcglk.exe
  C:\Windows\System\NrBcglk.exe
  2⤵
  PID:11432
- C:\Windows\System\PNkKZUC.exe
  C:\Windows\System\PNkKZUC.exe
  2⤵
  PID:11468
- C:\Windows\System\jnSzKRr.exe
  C:\Windows\System\jnSzKRr.exe
  2⤵
  PID:11488
- C:\Windows\System\yAGDPid.exe
  C:\Windows\System\yAGDPid.exe
  2⤵
  PID:11516
- C:\Windows\System\PnkzYmY.exe
  C:\Windows\System\PnkzYmY.exe
  2⤵
  PID:11540
- C:\Windows\System\iIqiCWg.exe
  C:\Windows\System\iIqiCWg.exe
  2⤵
  PID:11576
- C:\Windows\System\QKBvMcU.exe
  C:\Windows\System\QKBvMcU.exe
  2⤵
  PID:11604
- C:\Windows\System\ijzETAm.exe
  C:\Windows\System\ijzETAm.exe
  2⤵
  PID:11636
- C:\Windows\System\ZuFVhfr.exe
  C:\Windows\System\ZuFVhfr.exe
  2⤵
  PID:11684
- C:\Windows\System\fsjUPFb.exe
  C:\Windows\System\fsjUPFb.exe
  2⤵
  PID:11716
- C:\Windows\System\rFmgHjG.exe
  C:\Windows\System\rFmgHjG.exe
  2⤵
  PID:11736
- C:\Windows\System\fbmtavy.exe
  C:\Windows\System\fbmtavy.exe
  2⤵
  PID:11764
- C:\Windows\System\vFYqiEe.exe
  C:\Windows\System\vFYqiEe.exe
  2⤵
  PID:11788
- C:\Windows\System\IiiThxw.exe
  C:\Windows\System\IiiThxw.exe
  2⤵
  PID:11804
- C:\Windows\System\lbFTrKJ.exe
  C:\Windows\System\lbFTrKJ.exe
  2⤵
  PID:11832
- C:\Windows\System\ypVbUYN.exe
  C:\Windows\System\ypVbUYN.exe
  2⤵
  PID:11848
- C:\Windows\System\GWYHJBS.exe
  C:\Windows\System\GWYHJBS.exe
  2⤵
  PID:11916
- C:\Windows\System\JCFSZcY.exe
  C:\Windows\System\JCFSZcY.exe
  2⤵
  PID:11944
- C:\Windows\System\HfBDxNH.exe
  C:\Windows\System\HfBDxNH.exe
  2⤵
  PID:11968
- C:\Windows\System\aVzoeww.exe
  C:\Windows\System\aVzoeww.exe
  2⤵
  PID:11996
- C:\Windows\System\NtjNbvG.exe
  C:\Windows\System\NtjNbvG.exe
  2⤵
  PID:12032
- C:\Windows\System\uJeyGxM.exe
  C:\Windows\System\uJeyGxM.exe
  2⤵
  PID:12064
- C:\Windows\System\vSmpSSe.exe
  C:\Windows\System\vSmpSSe.exe
  2⤵
  PID:12092
- C:\Windows\System\bpTipHK.exe
  C:\Windows\System\bpTipHK.exe
  2⤵
  PID:12128
- C:\Windows\System\CEsBrnM.exe
  C:\Windows\System\CEsBrnM.exe
  2⤵
  PID:12148
- C:\Windows\System\AZspygl.exe
  C:\Windows\System\AZspygl.exe
  2⤵
  PID:12172
- C:\Windows\System\jbTCrVx.exe
  C:\Windows\System\jbTCrVx.exe
  2⤵
  PID:12216
- C:\Windows\System\jDlqfNL.exe
  C:\Windows\System\jDlqfNL.exe
  2⤵
  PID:12232
- C:\Windows\System\mOTWIpw.exe
  C:\Windows\System\mOTWIpw.exe
  2⤵
  PID:12260
- C:\Windows\System\oUpbBxx.exe
  C:\Windows\System\oUpbBxx.exe
  2⤵
  PID:12280
- C:\Windows\System\aextDqL.exe
  C:\Windows\System\aextDqL.exe
  2⤵
  PID:10436
- C:\Windows\System\JiNUdtm.exe
  C:\Windows\System\JiNUdtm.exe
  2⤵
  PID:11308
- C:\Windows\System\zFPxrXU.exe
  C:\Windows\System\zFPxrXU.exe
  2⤵
  PID:11364
- C:\Windows\System\OewLonR.exe
  C:\Windows\System\OewLonR.exe
  2⤵
  PID:11444
- C:\Windows\System\qcFGQQm.exe
  C:\Windows\System\qcFGQQm.exe
  2⤵
  PID:11428
- C:\Windows\System\OuUbuNh.exe
  C:\Windows\System\OuUbuNh.exe
  2⤵
  PID:11476
- C:\Windows\System\QAHDOgg.exe
  C:\Windows\System\QAHDOgg.exe
  2⤵
  PID:11564
- C:\Windows\System\yWsjAuV.exe
  C:\Windows\System\yWsjAuV.exe
  2⤵
  PID:11732
- C:\Windows\System\CMYvDyU.exe
  C:\Windows\System\CMYvDyU.exe
  2⤵
  PID:11796
- C:\Windows\System\yKbpCPw.exe
  C:\Windows\System\yKbpCPw.exe
  2⤵
  PID:11816
- C:\Windows\System\sJKRjDe.exe
  C:\Windows\System\sJKRjDe.exe
  2⤵
  PID:11984
- C:\Windows\System\XpVyORi.exe
  C:\Windows\System\XpVyORi.exe
  2⤵
  PID:12028
- C:\Windows\System\dZbgmVf.exe
  C:\Windows\System\dZbgmVf.exe
  2⤵
  PID:12076
- C:\Windows\System\coVISPJ.exe
  C:\Windows\System\coVISPJ.exe
  2⤵
  PID:12120
- C:\Windows\System\YoEcseM.exe
  C:\Windows\System\YoEcseM.exe
  2⤵
  PID:12228
- C:\Windows\System\PYxWRoT.exe
  C:\Windows\System\PYxWRoT.exe
  2⤵
  PID:10828
- C:\Windows\System\MEAQSBY.exe
  C:\Windows\System\MEAQSBY.exe
  2⤵
  PID:11412
- C:\Windows\System\vGJsjzD.exe
  C:\Windows\System\vGJsjzD.exe
  2⤵
  PID:11384
- C:\Windows\System\yrkSvPu.exe
  C:\Windows\System\yrkSvPu.exe
  2⤵
  PID:11592
- C:\Windows\System\cjfrFaA.exe
  C:\Windows\System\cjfrFaA.exe
  2⤵
  PID:11668
- C:\Windows\System\xqjskAh.exe
  C:\Windows\System\xqjskAh.exe
  2⤵
  PID:11872
- C:\Windows\System\xQGrYYM.exe
  C:\Windows\System\xQGrYYM.exe
  2⤵
  PID:12012
- C:\Windows\System\ExadgMZ.exe
  C:\Windows\System\ExadgMZ.exe
  2⤵
  PID:12084
- C:\Windows\System\prqEUFX.exe
  C:\Windows\System\prqEUFX.exe
  2⤵
  PID:12244
- C:\Windows\System\RbvudTC.exe
  C:\Windows\System\RbvudTC.exe
  2⤵
  PID:11280
- C:\Windows\System\GsIrCGQ.exe
  C:\Windows\System\GsIrCGQ.exe
  2⤵
  PID:12016
- C:\Windows\System\omMIltF.exe
  C:\Windows\System\omMIltF.exe
  2⤵
  PID:12304
- C:\Windows\System\RRSoUni.exe
  C:\Windows\System\RRSoUni.exe
  2⤵
  PID:12336
- C:\Windows\System\oYIALtM.exe
  C:\Windows\System\oYIALtM.exe
  2⤵
  PID:12352
- C:\Windows\System\TMRyDBO.exe
  C:\Windows\System\TMRyDBO.exe
  2⤵
  PID:12380
- C:\Windows\System\IuyhNAF.exe
  C:\Windows\System\IuyhNAF.exe
  2⤵
  PID:12404
- C:\Windows\System\VIygdWJ.exe
  C:\Windows\System\VIygdWJ.exe
  2⤵
  PID:12436
- C:\Windows\System\GDWoBBt.exe
  C:\Windows\System\GDWoBBt.exe
  2⤵
  PID:12456
- C:\Windows\System\AfgeQGe.exe
  C:\Windows\System\AfgeQGe.exe
  2⤵
  PID:12488
- C:\Windows\System\LMvGCTh.exe
  C:\Windows\System\LMvGCTh.exe
  2⤵
  PID:12512
- C:\Windows\System\JZIFQwa.exe
  C:\Windows\System\JZIFQwa.exe
  2⤵
  PID:12540
- C:\Windows\System\IjXPnbj.exe
  C:\Windows\System\IjXPnbj.exe
  2⤵
  PID:12564
- C:\Windows\System\VwoOaky.exe
  C:\Windows\System\VwoOaky.exe
  2⤵
  PID:12592
- C:\Windows\System\zxdyUnF.exe
  C:\Windows\System\zxdyUnF.exe
  2⤵
  PID:12620
- C:\Windows\System\mcpXhSN.exe
  C:\Windows\System\mcpXhSN.exe
  2⤵
  PID:12644
- C:\Windows\System\zKTWWAx.exe
  C:\Windows\System\zKTWWAx.exe
  2⤵
  PID:12668
- C:\Windows\System\yONTJyH.exe
  C:\Windows\System\yONTJyH.exe
  2⤵
  PID:12700
- C:\Windows\System\IVpyJER.exe
  C:\Windows\System\IVpyJER.exe
  2⤵
  PID:12720
- C:\Windows\System\pOagXfG.exe
  C:\Windows\System\pOagXfG.exe
  2⤵
  PID:12768
- C:\Windows\System\jpoggAb.exe
  C:\Windows\System\jpoggAb.exe
  2⤵
  PID:12792
- C:\Windows\System\kRfWkow.exe
  C:\Windows\System\kRfWkow.exe
  2⤵
  PID:12812
- C:\Windows\System\XviZnFj.exe
  C:\Windows\System\XviZnFj.exe
  2⤵
  PID:12860
- C:\Windows\System\lkTHWqA.exe
  C:\Windows\System\lkTHWqA.exe
  2⤵
  PID:12876
- C:\Windows\System\KSxmQZW.exe
  C:\Windows\System\KSxmQZW.exe
  2⤵
  PID:12916
- C:\Windows\System\ZUEHeSW.exe
  C:\Windows\System\ZUEHeSW.exe
  2⤵
  PID:12944
- C:\Windows\System\JInVfJO.exe
  C:\Windows\System\JInVfJO.exe
  2⤵
  PID:12960
- C:\Windows\System\VijwlhN.exe
  C:\Windows\System\VijwlhN.exe
  2⤵
  PID:12984
- C:\Windows\System\YbiuKLT.exe
  C:\Windows\System\YbiuKLT.exe
  2⤵
  PID:13004
- C:\Windows\System\ImsjBvG.exe
  C:\Windows\System\ImsjBvG.exe
  2⤵
  PID:13028
- C:\Windows\System\nriOcwn.exe
  C:\Windows\System\nriOcwn.exe
  2⤵
  PID:13084
- C:\Windows\System\egQGTYT.exe
  C:\Windows\System\egQGTYT.exe
  2⤵
  PID:13124
- C:\Windows\System\vDRxjIV.exe
  C:\Windows\System\vDRxjIV.exe
  2⤵
  PID:13144
- C:\Windows\System\ZKsbggQ.exe
  C:\Windows\System\ZKsbggQ.exe
  2⤵
  PID:13168
- C:\Windows\System\UXcpyAh.exe
  C:\Windows\System\UXcpyAh.exe
  2⤵
  PID:13184
- C:\Windows\System\GSZYKtn.exe
  C:\Windows\System\GSZYKtn.exe
  2⤵
  PID:13236
- C:\Windows\System\ovivcbF.exe
  C:\Windows\System\ovivcbF.exe
  2⤵
  PID:13264
- C:\Windows\System\YPJAuEP.exe
  C:\Windows\System\YPJAuEP.exe
  2⤵
  PID:13292
- C:\Windows\System\WndWNJP.exe
  C:\Windows\System\WndWNJP.exe
  2⤵
  PID:13308
- C:\Windows\System\LMBNzVd.exe
  C:\Windows\System\LMBNzVd.exe
  2⤵
  PID:11956
- C:\Windows\System\cvShDkr.exe
  C:\Windows\System\cvShDkr.exe
  2⤵
  PID:12376
- C:\Windows\System\eUsbtHZ.exe
  C:\Windows\System\eUsbtHZ.exe
  2⤵
  PID:12420
- C:\Windows\System\dVlxmeC.exe
  C:\Windows\System\dVlxmeC.exe
  2⤵
  PID:12504
- C:\Windows\System\HZvrXPl.exe
  C:\Windows\System\HZvrXPl.exe
  2⤵
  PID:12556
- C:\Windows\System\hNYeBhm.exe
  C:\Windows\System\hNYeBhm.exe
  2⤵
  PID:12588
- C:\Windows\System\NhiABoK.exe
  C:\Windows\System\NhiABoK.exe
  2⤵
  PID:12680
- C:\Windows\System\tbehErD.exe
  C:\Windows\System\tbehErD.exe
  2⤵
  PID:12736
- C:\Windows\System\aubDRKo.exe
  C:\Windows\System\aubDRKo.exe
  2⤵
  PID:12800
- C:\Windows\System\fEAGHIv.exe
  C:\Windows\System\fEAGHIv.exe
  2⤵
  PID:12900
- C:\Windows\System\PvIVAYt.exe
  C:\Windows\System\PvIVAYt.exe
  2⤵
  PID:12932
- C:\Windows\System\JSJLHiw.exe
  C:\Windows\System\JSJLHiw.exe
  2⤵
  PID:13000
- C:\Windows\System\RvedYBX.exe
  C:\Windows\System\RvedYBX.exe
  2⤵
  PID:13052
- C:\Windows\System\hQxMRbR.exe
  C:\Windows\System\hQxMRbR.exe
  2⤵
  PID:13140
- C:\Windows\System\yDDkuth.exe
  C:\Windows\System\yDDkuth.exe
  2⤵
  PID:13180
- C:\Windows\System\XNNMyUZ.exe
  C:\Windows\System\XNNMyUZ.exe
  2⤵
  PID:13224
- C:\Windows\System\CzNzxwC.exe
  C:\Windows\System\CzNzxwC.exe
  2⤵
  PID:13280
- C:\Windows\System\kFPQfgS.exe
  C:\Windows\System\kFPQfgS.exe
  2⤵
  PID:12144
- C:\Windows\System\JMpbGqG.exe
  C:\Windows\System\JMpbGqG.exe
  2⤵
  PID:12424
- C:\Windows\System\ZhjjOYo.exe
  C:\Windows\System\ZhjjOYo.exe
  2⤵
  PID:12480
- C:\Windows\System\QeJPZXt.exe
  C:\Windows\System\QeJPZXt.exe
  2⤵
  PID:12744
- C:\Windows\System\AUHrXgY.exe
  C:\Windows\System\AUHrXgY.exe
  2⤵
  PID:12872
- C:\Windows\System\OwrTsva.exe
  C:\Windows\System\OwrTsva.exe
  2⤵
  PID:11868
- C:\Windows\System\eMvpDXk.exe
  C:\Windows\System\eMvpDXk.exe
  2⤵
  PID:12992
- C:\Windows\System\JisVCVg.exe
  C:\Windows\System\JisVCVg.exe
  2⤵
  PID:13196
- C:\Windows\System\ZFraPDD.exe
  C:\Windows\System\ZFraPDD.exe
  2⤵
  PID:12584
- C:\Windows\System\SPTccFe.exe
  C:\Windows\System\SPTccFe.exe
  2⤵
  PID:13208
- C:\Windows\System\EvoIgFG.exe
  C:\Windows\System\EvoIgFG.exe
  2⤵
  PID:12952
- C:\Windows\System\dyUKqPX.exe
  C:\Windows\System\dyUKqPX.exe
  2⤵
  PID:13328
- C:\Windows\System\NoHnWsO.exe
  C:\Windows\System\NoHnWsO.exe
  2⤵
  PID:13352
- C:\Windows\System\RVqHRFs.exe
  C:\Windows\System\RVqHRFs.exe
  2⤵
  PID:13368
- C:\Windows\System\cCUPWUp.exe
  C:\Windows\System\cCUPWUp.exe
  2⤵
  PID:13388
- C:\Windows\System\yBdGepE.exe
  C:\Windows\System\yBdGepE.exe
  2⤵
  PID:13416
- C:\Windows\System\fjvZNri.exe
  C:\Windows\System\fjvZNri.exe
  2⤵
  PID:13432
- C:\Windows\System\NtzjhYH.exe
  C:\Windows\System\NtzjhYH.exe
  2⤵
  PID:13472
- C:\Windows\System\tRxBDIs.exe
  C:\Windows\System\tRxBDIs.exe
  2⤵
  PID:13500
- C:\Windows\System\ZyTezcW.exe
  C:\Windows\System\ZyTezcW.exe
  2⤵
  PID:13528
- C:\Windows\System\tHdvzKz.exe
  C:\Windows\System\tHdvzKz.exe
  2⤵
  PID:13552
- C:\Windows\System\KqFcYmX.exe
  C:\Windows\System\KqFcYmX.exe
  2⤵
  PID:13568
- C:\Windows\System\RpivFEP.exe
  C:\Windows\System\RpivFEP.exe
  2⤵
  PID:13592
- C:\Windows\System\mcFNvHF.exe
  C:\Windows\System\mcFNvHF.exe
  2⤵
  PID:13660
- C:\Windows\System\BDEoUsC.exe
  C:\Windows\System\BDEoUsC.exe
  2⤵
  PID:13680
- C:\Windows\System\dosHyyr.exe
  C:\Windows\System\dosHyyr.exe
  2⤵
  PID:13704
- C:\Windows\System\jnnQAeT.exe
  C:\Windows\System\jnnQAeT.exe
  2⤵
  PID:13736
- C:\Windows\System\sBkunkJ.exe
  C:\Windows\System\sBkunkJ.exe
  2⤵
  PID:13756
- C:\Windows\System\zkbWcHq.exe
  C:\Windows\System\zkbWcHq.exe
  2⤵
  PID:13796
- C:\Windows\System\Pxmdtkz.exe
  C:\Windows\System\Pxmdtkz.exe
  2⤵
  PID:13832
- C:\Windows\System\ZjOyFGY.exe
  C:\Windows\System\ZjOyFGY.exe
  2⤵
  PID:13856
- C:\Windows\System\GqSlaeO.exe
  C:\Windows\System\GqSlaeO.exe
  2⤵
  PID:13880
- C:\Windows\System\ViBTVNg.exe
  C:\Windows\System\ViBTVNg.exe
  2⤵
  PID:13904
- C:\Windows\System\zTwATFf.exe
  C:\Windows\System\zTwATFf.exe
  2⤵
  PID:13948
- C:\Windows\System\QCnAUXF.exe
  C:\Windows\System\QCnAUXF.exe
  2⤵
  PID:13968
- C:\Windows\System\cgchdOy.exe
  C:\Windows\System\cgchdOy.exe
  2⤵
  PID:13988
- C:\Windows\System\BWNlYvd.exe
  C:\Windows\System\BWNlYvd.exe
  2⤵
  PID:14028
- C:\Windows\System\ToYghyd.exe
  C:\Windows\System\ToYghyd.exe
  2⤵
  PID:14048
- C:\Windows\System\nTsecJh.exe
  C:\Windows\System\nTsecJh.exe
  2⤵
  PID:14084
- C:\Windows\System\BXjqFEB.exe
  C:\Windows\System\BXjqFEB.exe
  2⤵
  PID:14100
- C:\Windows\System\EhGEjdZ.exe
  C:\Windows\System\EhGEjdZ.exe
  2⤵
  PID:14116
- C:\Windows\System\WWJLVyN.exe
  C:\Windows\System\WWJLVyN.exe
  2⤵
  PID:14148
- C:\Windows\System\TRuiLSp.exe
  C:\Windows\System\TRuiLSp.exe
  2⤵
  PID:14192
- C:\Windows\System\LdVVSLL.exe
  C:\Windows\System\LdVVSLL.exe
  2⤵
  PID:14220
- C:\Windows\System\cbvFYwA.exe
  C:\Windows\System\cbvFYwA.exe
  2⤵
  PID:14244
- C:\Windows\System\nJYkiac.exe
  C:\Windows\System\nJYkiac.exe
  2⤵
  PID:14268
- C:\Windows\System\NZKsZNU.exe
  C:\Windows\System\NZKsZNU.exe
  2⤵
  PID:14300
- C:\Windows\System\LciHvGc.exe
  C:\Windows\System\LciHvGc.exe
  2⤵
  PID:14324
- C:\Windows\System\AehIrTB.exe
  C:\Windows\System\AehIrTB.exe
  2⤵
  PID:13344
- C:\Windows\System\gZHSvuz.exe
  C:\Windows\System\gZHSvuz.exe
  2⤵
  PID:13396
- C:\Windows\System\vWkewLf.exe
  C:\Windows\System\vWkewLf.exe
  2⤵
  PID:13428
- C:\Windows\System\aZiOimK.exe
  C:\Windows\System\aZiOimK.exe
  2⤵
  PID:13540
- C:\Windows\System\kntCzTJ.exe
  C:\Windows\System\kntCzTJ.exe
  2⤵
  PID:13616
- C:\Windows\System\hyzPDlM.exe
  C:\Windows\System\hyzPDlM.exe
  2⤵
  PID:13676
- C:\Windows\System\EcEBvWk.exe
  C:\Windows\System\EcEBvWk.exe
  2⤵
  PID:13752
- C:\Windows\System\jivTTIJ.exe
  C:\Windows\System\jivTTIJ.exe
  2⤵
  PID:13788
- C:\Windows\System\yqfHXFf.exe
  C:\Windows\System\yqfHXFf.exe
  2⤵
  PID:13864
- C:\Windows\System\xDudLqx.exe
  C:\Windows\System\xDudLqx.exe
  2⤵
  PID:13872
- C:\Windows\System\qmRxJfB.exe
  C:\Windows\System\qmRxJfB.exe
  2⤵
  PID:1816
- C:\Windows\System\eDGTHYE.exe
  C:\Windows\System\eDGTHYE.exe
  2⤵
  PID:14068
- C:\Windows\System\JrZMerm.exe
  C:\Windows\System\JrZMerm.exe
  2⤵
  PID:14092
- C:\Windows\System\WIYmmzf.exe
  C:\Windows\System\WIYmmzf.exe
  2⤵
  PID:4912
- C:\Windows\System\pExeMtL.exe
  C:\Windows\System\pExeMtL.exe
  2⤵
  PID:14176
- C:\Windows\System\ZrmJwKI.exe
  C:\Windows\System\ZrmJwKI.exe
  2⤵
  PID:14232
- C:\Windows\System\WJaiUvd.exe
  C:\Windows\System\WJaiUvd.exe
  2⤵
  PID:14252
- C:\Windows\System\zrNqofE.exe
  C:\Windows\System\zrNqofE.exe
  2⤵
  PID:13424
- C:\Windows\System\UWYcwKl.exe
  C:\Windows\System\UWYcwKl.exe
  2⤵
  PID:13492
- C:\Windows\System\dbKKKoE.exe
  C:\Windows\System\dbKKKoE.exe
  2⤵
  PID:13588
- C:\Windows\System\zhoPYSm.exe
  C:\Windows\System\zhoPYSm.exe
  2⤵
  PID:13808
- C:\Windows\System\sBKBLyh.exe
  C:\Windows\System\sBKBLyh.exe
  2⤵
  PID:13896
- C:\Windows\System\LgSttuh.exe
  C:\Windows\System\LgSttuh.exe
  2⤵
  PID:4116
- C:\Windows\System\EhkYiiz.exe
  C:\Windows\System\EhkYiiz.exe
  2⤵
  PID:14156
- C:\Windows\System\PEeQGPh.exe
  C:\Windows\System\PEeQGPh.exe
  2⤵
  PID:14312
- C:\Windows\System\CVrFYSW.exe
  C:\Windows\System\CVrFYSW.exe
  2⤵
  PID:13480
- C:\Windows\System\hrQyYLm.exe
  C:\Windows\System\hrQyYLm.exe
  2⤵
  PID:13748
- C:\Windows\System\rhWmkmJ.exe
  C:\Windows\System\rhWmkmJ.exe
  2⤵
  PID:12808
- C:\Windows\System\CMEbeqv.exe
  C:\Windows\System\CMEbeqv.exe
  2⤵
  PID:14228
- C:\Windows\System\NrTKXZY.exe
  C:\Windows\System\NrTKXZY.exe
  2⤵
  PID:14344
- C:\Windows\System\ebFuvIm.exe
  C:\Windows\System\ebFuvIm.exe
  2⤵
  PID:14364
- C:\Windows\System\MrgRdtL.exe
  C:\Windows\System\MrgRdtL.exe
  2⤵
  PID:14388
- C:\Windows\System\GdGpJCs.exe
  C:\Windows\System\GdGpJCs.exe
  2⤵
  PID:14408
- C:\Windows\System\CCDcAwS.exe
  C:\Windows\System\CCDcAwS.exe
  2⤵
  PID:14436
- C:\Windows\System\ThBcmKv.exe
  C:\Windows\System\ThBcmKv.exe
  2⤵
  PID:14460
- C:\Windows\System\nuwKjLU.exe
  C:\Windows\System\nuwKjLU.exe
  2⤵
  PID:14480
- C:\Windows\System\miYwlrt.exe
  C:\Windows\System\miYwlrt.exe
  2⤵
  PID:14500
- C:\Windows\System\NiGQbIW.exe
  C:\Windows\System\NiGQbIW.exe
  2⤵
  PID:14556
- C:\Windows\System\FLJvCFa.exe
  C:\Windows\System\FLJvCFa.exe
  2⤵
  PID:14572
- C:\Windows\System\bYiAaik.exe
  C:\Windows\System\bYiAaik.exe
  2⤵
  PID:14588
- C:\Windows\System\BVppfPJ.exe
  C:\Windows\System\BVppfPJ.exe
  2⤵
  PID:14648
- C:\Windows\System\tjhXMUS.exe
  C:\Windows\System\tjhXMUS.exe
  2⤵
  PID:14680
- C:\Windows\System\axpShac.exe
  C:\Windows\System\axpShac.exe
  2⤵
  PID:14696
- C:\Windows\System\eOOMLld.exe
  C:\Windows\System\eOOMLld.exe
  2⤵
  PID:14740
- C:\Windows\System\bLDgaAV.exe
  C:\Windows\System\bLDgaAV.exe
  2⤵
  PID:14756
- C:\Windows\System\UvpDrsX.exe
  C:\Windows\System\UvpDrsX.exe
  2⤵
  PID:14784
- C:\Windows\System\BFetjbW.exe
  C:\Windows\System\BFetjbW.exe
  2⤵
  PID:14804
- C:\Windows\System\IjSffOv.exe
  C:\Windows\System\IjSffOv.exe
  2⤵
  PID:14848
- C:\Windows\System\rADrCoA.exe
  C:\Windows\System\rADrCoA.exe
  2⤵
  PID:14872
- C:\Windows\System\WlVeZXm.exe
  C:\Windows\System\WlVeZXm.exe
  2⤵
  PID:14916
- C:\Windows\System\LbgzymL.exe
  C:\Windows\System\LbgzymL.exe
  2⤵
  PID:14944
- C:\Windows\System\wcJVGKx.exe
  C:\Windows\System\wcJVGKx.exe
  2⤵
  PID:14964
- C:\Windows\System\utcVgEe.exe
  C:\Windows\System\utcVgEe.exe
  2⤵
  PID:14984
- C:\Windows\System\ZEcIIUt.exe
  C:\Windows\System\ZEcIIUt.exe
  2⤵
  PID:15020
- C:\Windows\System\QQeBths.exe
  C:\Windows\System\QQeBths.exe
  2⤵
  PID:15060
- C:\Windows\System\JtbrDWK.exe
  C:\Windows\System\JtbrDWK.exe
  2⤵
  PID:15088
- C:\Windows\System\PBiNPjV.exe
  C:\Windows\System\PBiNPjV.exe
  2⤵
  PID:15116
- C:\Windows\System\gTAFFqB.exe
  C:\Windows\System\gTAFFqB.exe
  2⤵
  PID:15136
- C:\Windows\System\qblsmbB.exe
  C:\Windows\System\qblsmbB.exe
  2⤵
  PID:15160
- C:\Windows\System\vJgxqsH.exe
  C:\Windows\System\vJgxqsH.exe
  2⤵
  PID:15188
- C:\Windows\System\ZvAztSP.exe
  C:\Windows\System\ZvAztSP.exe
  2⤵
  PID:15244
- C:\Windows\System\fcTamEr.exe
  C:\Windows\System\fcTamEr.exe
  2⤵
  PID:15260
- C:\Windows\System\KZzROFq.exe
  C:\Windows\System\KZzROFq.exe
  2⤵
  PID:15276
- C:\Windows\System\CbsSidq.exe
  C:\Windows\System\CbsSidq.exe
  2⤵
  PID:15292
- C:\Windows\System\OHENvYA.exe
  C:\Windows\System\OHENvYA.exe
  2⤵
  PID:15312
- C:\Windows\System\ZGISoyI.exe
  C:\Windows\System\ZGISoyI.exe
  2⤵
  PID:15336
- C:\Windows\System\ZmoDsOv.exe
  C:\Windows\System\ZmoDsOv.exe
  2⤵
  PID:15352
- C:\Windows\System\UDnLiNM.exe
  C:\Windows\System\UDnLiNM.exe
  2⤵
  PID:14352
- C:\Windows\System\vMPrAaT.exe
  C:\Windows\System\vMPrAaT.exe
  2⤵
  PID:14524
- C:\Windows\System\vlLcunU.exe
  C:\Windows\System\vlLcunU.exe
  2⤵
  PID:404
- C:\Windows\System\xCphxEd.exe
  C:\Windows\System\xCphxEd.exe
  2⤵
  PID:14688
- C:\Windows\System\UdVswMu.exe
  C:\Windows\System\UdVswMu.exe
  2⤵
  PID:14732
- C:\Windows\System\HVyTEqo.exe
  C:\Windows\System\HVyTEqo.exe
  2⤵
  PID:14768
- C:\Windows\System\DXJlNWc.exe
  C:\Windows\System\DXJlNWc.exe
  2⤵
  PID:14812
- C:\Windows\System\WqrIJGa.exe
  C:\Windows\System\WqrIJGa.exe
  2⤵
  PID:14904
- C:\Windows\System\QwNglPH.exe
  C:\Windows\System\QwNglPH.exe
  2⤵
  PID:14992
- C:\Windows\System\BiqspUv.exe
  C:\Windows\System\BiqspUv.exe
  2⤵
  PID:15044
- C:\Windows\System\piwkypp.exe
  C:\Windows\System\piwkypp.exe
  2⤵
  PID:15124
- C:\Windows\System\MpUfqlW.exe
  C:\Windows\System\MpUfqlW.exe
  2⤵
  PID:15228
- C:\Windows\System\VylLMKB.exe
  C:\Windows\System\VylLMKB.exe
  2⤵
  PID:15220
- C:\Windows\System\rukUiCp.exe
  C:\Windows\System\rukUiCp.exe
  2⤵
  PID:15268
- C:\Windows\System\GNvWYpl.exe
  C:\Windows\System\GNvWYpl.exe
  2⤵
  PID:15348
- C:\Windows\System\jTBGLnN.exe
  C:\Windows\System\jTBGLnN.exe
  2⤵
  PID:14432
- C:\Windows\System\tdOfqwP.exe
  C:\Windows\System\tdOfqwP.exe
  2⤵
  PID:2796
- C:\Windows\System\ymKvUSP.exe
  C:\Windows\System\ymKvUSP.exe
  2⤵
  PID:14716
- C:\Windows\System\RIZDvsK.exe
  C:\Windows\System\RIZDvsK.exe
  2⤵
  PID:14956
- C:\Windows\System\WSFbYcj.exe
  C:\Windows\System\WSFbYcj.exe
  2⤵
  PID:14456
- C:\Windows\System\UTpnopy.exe
  C:\Windows\System\UTpnopy.exe
  2⤵
  PID:15324
- C:\Windows\System\IxgZMmV.exe
  C:\Windows\System\IxgZMmV.exe
  2⤵
  PID:14372
- C:\Windows\System\hbEzCBW.exe
  C:\Windows\System\hbEzCBW.exe
  2⤵
  PID:14728
- C:\Windows\System\SmuguuZ.exe
  C:\Windows\System\SmuguuZ.exe
  2⤵
  PID:15172
- C:\Windows\System\PGjZLox.exe
  C:\Windows\System\PGjZLox.exe
  2⤵
  PID:15056
- C:\Windows\System\jwKAVYX.exe
  C:\Windows\System\jwKAVYX.exe
  2⤵
  PID:14864
- C:\Windows\System\jHrEVlN.exe
  C:\Windows\System\jHrEVlN.exe
  2⤵
  PID:15364
- C:\Windows\System\lSpZEPg.exe
  C:\Windows\System\lSpZEPg.exe
  2⤵
  PID:15392
- C:\Windows\System\REtEeDp.exe
  C:\Windows\System\REtEeDp.exe
  2⤵
  PID:15420
- C:\Windows\System\bItIljY.exe
  C:\Windows\System\bItIljY.exe
  2⤵
  PID:15468
- C:\Windows\System\MqcOWpx.exe
  C:\Windows\System\MqcOWpx.exe
  2⤵
  PID:15488
- C:\Windows\System\JJSkvtM.exe
  C:\Windows\System\JJSkvtM.exe
  2⤵
  PID:15516
- C:\Windows\System\PqxZGiu.exe
  C:\Windows\System\PqxZGiu.exe
  2⤵
  PID:15560
- C:\Windows\System\jYUJhhH.exe
  C:\Windows\System\jYUJhhH.exe
  2⤵
  PID:15576
- C:\Windows\System\bXpzuZm.exe
  C:\Windows\System\bXpzuZm.exe
  2⤵
  PID:15596
- C:\Windows\System\cOUiapy.exe
  C:\Windows\System\cOUiapy.exe
  2⤵
  PID:15632
- C:\Windows\System\wvgzMir.exe
  C:\Windows\System\wvgzMir.exe
  2⤵
  PID:15648
- C:\Windows\System\LyFoFyI.exe
  C:\Windows\System\LyFoFyI.exe
  2⤵
  PID:15672
- C:\Windows\System\Vdaotbp.exe
  C:\Windows\System\Vdaotbp.exe
  2⤵
  PID:15692
- C:\Windows\System\kDtlwwz.exe
  C:\Windows\System\kDtlwwz.exe
  2⤵
  PID:15720
- C:\Windows\System\aEuDfKb.exe
  C:\Windows\System\aEuDfKb.exe
  2⤵
  PID:15756
- C:\Windows\System\vZcLSqf.exe
  C:\Windows\System\vZcLSqf.exe
  2⤵
  PID:15784
- C:\Windows\System\kuWMVnx.exe
  C:\Windows\System\kuWMVnx.exe
  2⤵
  PID:15812
- C:\Windows\System\osxfRLa.exe
  C:\Windows\System\osxfRLa.exe
  2⤵
  PID:15860
- C:\Windows\System\VYnljpI.exe
  C:\Windows\System\VYnljpI.exe
  2⤵
  PID:15876
- C:\Windows\System\OYkxTCA.exe
  C:\Windows\System\OYkxTCA.exe
  2⤵
  PID:15900
- C:\Windows\System\kCUAKyl.exe
  C:\Windows\System\kCUAKyl.exe
  2⤵
  PID:15956
- C:\Windows\System\KQuXqvh.exe
  C:\Windows\System\KQuXqvh.exe
  2⤵
  PID:15984
- C:\Windows\System\fNlPSOx.exe
  C:\Windows\System\fNlPSOx.exe
  2⤵
  PID:16012
- C:\Windows\System\gQpiLqv.exe
  C:\Windows\System\gQpiLqv.exe
  2⤵
  PID:16032
- C:\Windows\System\JCWKQyy.exe
  C:\Windows\System\JCWKQyy.exe
  2⤵
  PID:16056
- C:\Windows\System\QiGKaaw.exe
  C:\Windows\System\QiGKaaw.exe
  2⤵
  PID:16096
- C:\Windows\System\pvIYCmi.exe
  C:\Windows\System\pvIYCmi.exe
  2⤵
  PID:16124
- C:\Windows\System\JDaBUDr.exe
  C:\Windows\System\JDaBUDr.exe
  2⤵
  PID:16144
- C:\Windows\System\CXIHKrJ.exe
  C:\Windows\System\CXIHKrJ.exe
  2⤵
  PID:16168
- C:\Windows\System\tdpekdU.exe
  C:\Windows\System\tdpekdU.exe
  2⤵
  PID:16184
- C:\Windows\System\IyGTKEh.exe
  C:\Windows\System\IyGTKEh.exe
  2⤵
  PID:16212
- C:\Windows\System\aSzSJNY.exe
  C:\Windows\System\aSzSJNY.exe
  2⤵
  PID:16236
- C:\Windows\System\OgcPutW.exe
  C:\Windows\System\OgcPutW.exe
  2⤵
  PID:16272
- C:\Windows\System\xnKdrYg.exe
  C:\Windows\System\xnKdrYg.exe
  2⤵
  PID:16300
- C:\Windows\System\muTOuSD.exe
  C:\Windows\System\muTOuSD.exe
  2⤵
  PID:16320
- C:\Windows\System\qZvlgGU.exe
  C:\Windows\System\qZvlgGU.exe
  2⤵
  PID:16348
- C:\Windows\System\LDFiSlh.exe
  C:\Windows\System\LDFiSlh.exe
  2⤵
  PID:16368
- C:\Windows\System\nKKhWPa.exe
  C:\Windows\System\nKKhWPa.exe
  2⤵
  PID:15300
- C:\Windows\System\bDsTBwP.exe
  C:\Windows\System\bDsTBwP.exe
  2⤵
  PID:15416
- C:\Windows\System\CcZpsDk.exe
  C:\Windows\System\CcZpsDk.exe
  2⤵
  PID:15568
- C:\Windows\System\AtGltAU.exe
  C:\Windows\System\AtGltAU.exe
  2⤵
  PID:15616
- C:\Windows\System\leJDAqg.exe
  C:\Windows\System\leJDAqg.exe
  2⤵
  PID:15684
- C:\Windows\System\MIfuTBu.exe
  C:\Windows\System\MIfuTBu.exe
  2⤵
  PID:15776
- C:\Windows\System\mWPKMjO.exe
  C:\Windows\System\mWPKMjO.exe
  2⤵
  PID:15808
- C:\Windows\System\sPlyVIO.exe
  C:\Windows\System\sPlyVIO.exe
  2⤵
  PID:15872
- C:\Windows\System\UFZfPTB.exe
  C:\Windows\System\UFZfPTB.exe
  2⤵
  PID:15928
- C:\Windows\System\hQfzXpI.exe
  C:\Windows\System\hQfzXpI.exe
  2⤵
  PID:16004
- C:\Windows\System\tIblGYS.exe
  C:\Windows\System\tIblGYS.exe
  2⤵
  PID:16076
- C:\Windows\System\VKvraiJ.exe
  C:\Windows\System\VKvraiJ.exe
  2⤵
  PID:16088
- C:\Windows\System\FvPSEFy.exe
  C:\Windows\System\FvPSEFy.exe
  2⤵
  PID:16132
- C:\Windows\System\UlMCXTR.exe
  C:\Windows\System\UlMCXTR.exe
  2⤵
  PID:3360
- C:\Windows\System\egJPnNK.exe
  C:\Windows\System\egJPnNK.exe
  2⤵
  PID:16268
- C:\Windows\System\piGPhhZ.exe
  C:\Windows\System\piGPhhZ.exe
  2⤵
  PID:1140
- C:\Windows\System\qMgURcY.exe
  C:\Windows\System\qMgURcY.exe
  2⤵
  PID:16344
- C:\Windows\System\rhNKnPn.exe
  C:\Windows\System\rhNKnPn.exe
  2⤵
  PID:15372
- C:\Windows\System\SqtwqET.exe
  C:\Windows\System\SqtwqET.exe
  2⤵
  PID:15512
- C:\Windows\System\AlzPXOI.exe
  C:\Windows\System\AlzPXOI.exe
  2⤵
  PID:15604
- C:\Windows\System\nBrbXui.exe
  C:\Windows\System\nBrbXui.exe
  2⤵
  PID:15744
- C:\Windows\System\opvLEtc.exe
  C:\Windows\System\opvLEtc.exe
  2⤵
  PID:16048
- C:\Windows\System\DbVoHoh.exe
  C:\Windows\System\DbVoHoh.exe
  2⤵
  PID:16204
- C:\Windows\System\xVeBzJh.exe
  C:\Windows\System\xVeBzJh.exe
  2⤵
  PID:16296
- C:\Windows\System\fyISDPo.exe
  C:\Windows\System\fyISDPo.exe
  2⤵
  PID:16380
- C:\Windows\System\JBfXNrh.exe
  C:\Windows\System\JBfXNrh.exe
  2⤵
  PID:15668
- C:\Windows\System\svpBVpi.exe
  C:\Windows\System\svpBVpi.exe
  2⤵
  PID:15896
- C:\Windows\System\noOEDsb.exe
  C:\Windows\System\noOEDsb.exe
  2⤵
  PID:15436
- C:\Windows\System\PSEOtzn.exe
  C:\Windows\System\PSEOtzn.exe
  2⤵
  PID:16400
- C:\Windows\System\PwXgNSG.exe
  C:\Windows\System\PwXgNSG.exe
  2⤵
  PID:16428
- C:\Windows\System\mBaJelQ.exe
  C:\Windows\System\mBaJelQ.exe
  2⤵
  PID:16444
- C:\Windows\System\ijLVBtz.exe
  C:\Windows\System\ijLVBtz.exe
  2⤵
  PID:16460
- C:\Windows\System\jYcYWCt.exe
  C:\Windows\System\jYcYWCt.exe
  2⤵
  PID:16508
- C:\Windows\System\KltmuYS.exe
  C:\Windows\System\KltmuYS.exe
  2⤵
  PID:16528
- C:\Windows\System\ZfSTItY.exe
  C:\Windows\System\ZfSTItY.exe
  2⤵
  PID:16548
- C:\Windows\System\GKgJgGT.exe
  C:\Windows\System\GKgJgGT.exe
  2⤵
  PID:16572
- C:\Windows\System\InyTDcn.exe
  C:\Windows\System\InyTDcn.exe
  2⤵
  PID:16600
- C:\Windows\System\hxXnYok.exe
  C:\Windows\System\hxXnYok.exe
  2⤵
  PID:16636
- C:\Windows\System\DvgawBB.exe
  C:\Windows\System\DvgawBB.exe
  2⤵
  PID:16692
- C:\Windows\System\ReNlQXn.exe
  C:\Windows\System\ReNlQXn.exe
  2⤵
  PID:16712
- C:\Windows\System\swmBtDG.exe
  C:\Windows\System\swmBtDG.exe
  2⤵
  PID:16748
- C:\Windows\System\vcWKYuW.exe
  C:\Windows\System\vcWKYuW.exe
  2⤵
  PID:16776
- C:\Windows\System\nrvGdGo.exe
  C:\Windows\System\nrvGdGo.exe
  2⤵
  PID:16796
- C:\Windows\System\xHLjHWb.exe
  C:\Windows\System\xHLjHWb.exe
  2⤵
  PID:16832
- C:\Windows\System\YBLYHzC.exe
  C:\Windows\System\YBLYHzC.exe
  2⤵
  PID:16856
- C:\Windows\System\TgZtRws.exe
  C:\Windows\System\TgZtRws.exe
  2⤵
  PID:16876
- C:\Windows\System\EhVKhlu.exe
  C:\Windows\System\EhVKhlu.exe
  2⤵
  PID:16912
- C:\Windows\System\bwDnliX.exe
  C:\Windows\System\bwDnliX.exe
  2⤵
  PID:16928
- C:\Windows\System\ucqQRui.exe
  C:\Windows\System\ucqQRui.exe
  2⤵
  PID:16948
- C:\Windows\System\QQYITVG.exe
  C:\Windows\System\QQYITVG.exe
  2⤵
  PID:16980
- C:\Windows\System\FCmvoju.exe
  C:\Windows\System\FCmvoju.exe
  2⤵
  PID:17024
- C:\Windows\System\DBnQQkw.exe
  C:\Windows\System\DBnQQkw.exe
  2⤵
  PID:17040
- C:\Windows\System\OHVqztu.exe
  C:\Windows\System\OHVqztu.exe
  2⤵
  PID:17060
- C:\Windows\System\ZdXGXLy.exe
  C:\Windows\System\ZdXGXLy.exe
  2⤵
  PID:17080
- C:\Windows\System\FmIwloD.exe
  C:\Windows\System\FmIwloD.exe
  2⤵
  PID:17096
- C:\Windows\System\catRdaP.exe
  C:\Windows\System\catRdaP.exe
  2⤵
  PID:17128
- C:\Windows\System\sSOxIsF.exe
  C:\Windows\System\sSOxIsF.exe
  2⤵
  PID:17144
- C:\Windows\System\fGYgLoQ.exe
  C:\Windows\System\fGYgLoQ.exe
  2⤵
  PID:17172
- C:\Windows\System\wBGSLDJ.exe
  C:\Windows\System\wBGSLDJ.exe
  2⤵
  PID:17196
- C:\Windows\System\fPdbWGz.exe
  C:\Windows\System\fPdbWGz.exe
  2⤵
  PID:17220
- C:\Windows\System\BqxyBrq.exe
  C:\Windows\System\BqxyBrq.exe
  2⤵
  PID:17372
- C:\Windows\System\VnsFvAO.exe
  C:\Windows\System\VnsFvAO.exe
  2⤵
  PID:17392
- C:\Windows\System\eOkCiXe.exe
  C:\Windows\System\eOkCiXe.exe
  2⤵
  PID:16176

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DUhNemy.exe

Filesize
1.2MB

MD5
4c2c92e3547b03c7d5f9361df9ffadb5

SHA1
0015cfd8d6ecb6d56086823738bfeba553819936

SHA256
78022168b4e378bc1378ab8bc886a1813d000bf2908c28fb66aebf157e22920c

SHA512
7e895f613087d85a9ff031ab1decafb096e8decbd632e03a822e90d83b4a96a788ac5b437f71f233f5019dab97cf90e6dcc63fbbb4eb4abf638e8daab6a8f476

Download Submit
C:\Windows\System\DvnzeQK.exe

Filesize
1.2MB

MD5
8bb37cf599eb09632ff0a531a3d94b24

SHA1
25aa817fcf5b981a1426751487e73017812e01bc

SHA256
b9f7a89dba75cfd5a5beb12cd9ab9924db133b8e63d061df6f5f89b2337fbc3f

SHA512
46f7028be336ad74d0ffa983904a444272d74e90a53bcadab39afde295f76df0350fb284041090fd188c31cc4e8620b47744f2f33945afb21eccb21ac459ed3b

Download Submit
C:\Windows\System\DwDPORW.exe

Filesize
1.2MB

MD5
fccc5c605cd520e53f265e48d346d29b

SHA1
9f27512cfdb2db07364fcbc6197e05b44e61cdad

SHA256
e270c71c76aaf7c478cd1cb2ed2a7fcf1c3eca363694bc9d274e083bd2347ab8

SHA512
5fad14bd96efbdc2c4cb14cbdee85bbfc0da89a2410988b6f5cf08604feb52749cfb4d1ed1a48a103f0830d44e9e05381e5fd762cb4bd5fc52c1efdd266349ff

Download Submit
C:\Windows\System\EvcXylg.exe

Filesize
1.2MB

MD5
4c2dfc536e39d9af1168ba66ee476186

SHA1
ca7a56ff7b303daf1b57d2b38ad2d1d560b3275f

SHA256
9dc1566b9c3269a6837a28630a8a7f59f2b73d541356ee245e6f61b909550364

SHA512
cc56ef9386ee950cd9b5cc878df6de619a91203e386fa56a9d3eb1963c1d55b1b7139d018b40459fcf632258d9ddd299e048bef4626f70a881a9fb3fc5d043f0

Download Submit
C:\Windows\System\GrupnEG.exe

Filesize
1.2MB

MD5
1fb6c913526d6966421cbc6d58dfbad3

SHA1
9d08e6123cd9ae74000b57de3d8ae26d34898e7a

SHA256
6b3bd1838914651ee9b7439e6f9ca9716d75fceed1f77e6d67da8b5864b419fc

SHA512
6675f1d083d3e588e6db62e7ab1ecdca5b270cf60e4078d7bce67c838f9329214a1d5b15f569ccb033197969fc0475c8dc967712d7b4169253f637b91bc9e1c7

Download Submit
C:\Windows\System\HztTSkb.exe

Filesize
1.2MB

MD5
34a2b69ca73fb2465c6fbc66c13c3c22

SHA1
4a95b3b38afc00d8793aa7d67769409806890b47

SHA256
67de67febb93b00e9345408bd724f34435dc8b580874b0ab0cfa1cb31b3d4d4b

SHA512
4e9d2533ff3922e4e72e441e25bdc7e799bfd5f2f37a88f29896a6c6f3fb26244273e1ff643f8e2ce77107465749abd0ce89b264377f8663df41f48bec9f0abe

Download Submit
C:\Windows\System\IInjNjq.exe

Filesize
1.2MB

MD5
a60298ec06d38471ecdb6689f04ed26f

SHA1
03c4f0fc0ff6c0d8e9ad21021da1f7f347c956e5

SHA256
6441272070791924f8252212024240c1871080a218e070f33a13f5fc1cc584de

SHA512
a2b976d316d00b48c00a4909c8d2058e9bc5467b0623191b5d5d19460d2d38a8f4297fe4c049a7be291a204532b5ddbc188131898bfe1d3a03e9f11626250720

Download Submit
C:\Windows\System\IpDxGBZ.exe

Filesize
1.2MB

MD5
34a9825aa9502d93e81c371bd44a26ef

SHA1
cd662a614e6f05b523f2de6df5df96434dd96e1d

SHA256
62c40d4f8f3bbfa58f6a20e379b57a9391c72cfcd45452f07ceca98f6c9e6a75

SHA512
893e15ee4398eb86f573620f2380027003fe4c003da3912be79ce3efc984d7e6a6f483f42a5f641b55eaaa44fcf58606a00290b2ff96f89ed9e1d8d5fac1c564

Download Submit
C:\Windows\System\JVefdOl.exe

Filesize
1.2MB

MD5
9ca416c5522805a4fabe91c5a23ead59

SHA1
e8408d4b2ad77c0788ea2bafb82845221e6dc1a8

SHA256
0871c6dfab85936feffae69822e272eb8b759faf79b393d6d0fcefbc5f1d2d14

SHA512
cd778d6033c96ed545304f17ef0a0737ca55e0011908eea11be94a510daee6a0b698257cfd73fb64f708f1d613b2b0ce556fdde70e5c39b70439b673b71d344e

Download Submit
C:\Windows\System\JyHFRyK.exe

Filesize
1.2MB

MD5
fbf5c2b82e7d0b9a60241d46f0aeda94

SHA1
f32c9c572d5bc4c30fa9e2bb060871767fe0c020

SHA256
b49e071da3c8857ab854d6c5167f9fa8a8458299aa4f913bde0a0c3f7eaa2a26

SHA512
f5d5d919b6cdb8ebdd86679d624587ff72ab5f4e786d03409809c2009731fc23207e9cd65eb4c6443434702f6e908fd61b02deb585f3032b32f8ee56c4f3a3e3

Download Submit
C:\Windows\System\KFUMbXS.exe

Filesize
1.2MB

MD5
27c98ce85a5d4e438c5b44de059d5077

SHA1
59747012e9231f83d3edd4e780ab3d8e5fcec74f

SHA256
4ef65bdcc3b2837635af54b2b7ffca789b73a0a269346f53703d3e8f7c9c0683

SHA512
c8c560b0ea69bf6f3322dac9041dd2674c8f1b42bae6e3ecc0441d879f26ad4b6ef799fd8f7e65a5b556c3214cb360fa009f04634dc28574ac0a66543e7743de

Download Submit
C:\Windows\System\MJXbHrw.exe

Filesize
1.2MB

MD5
0aa19a57ed2aa56fe210309d1fefc27b

SHA1
3f7e8f3874bd703633b9a2b4c947a7d4303e319f

SHA256
e719fcadb9ef0456771f7b4d103d42ed732dcd0f0e711f853fcb6ef50908f11d

SHA512
c1fb31e24126f52b2c684c9bdf52e2037818cb9edb20eefce98c5b0d0e9f3535240331afeba41b9624b6ea354d23e9b3bb51c32d788cd9d3c110c18e3c0f8f87

Download Submit
C:\Windows\System\MQRhCGW.exe

Filesize
1.2MB

MD5
2455303c95ed69bea9f3ba5607d9ba10

SHA1
605b09f282a212b0e4e6402a8152c778bc71b0da

SHA256
a58e12656c90815a991123c227222dcbd39af365d8139bbb87b6426e7c8b6f21

SHA512
f761b49302eddb19dfc367c781704ff144f9d2750c2742b0384b8582201d63f694f62682ee0db03e98a27e2245e8c3c86535eddad4a71a69cdc4b801b81ff65f

Download Submit
C:\Windows\System\MRQFhKP.exe

Filesize
1.2MB

MD5
507e9f325d2f725e11b545e63d6c86e0

SHA1
8218f36366884c0b52baa95e6f539dd70513aee3

SHA256
2a2fada3849614b1e3ca9f70d3c0716cb2b9decda87d7f3362451f45ec27ae4e

SHA512
15b8c450aeaafc73f18154cb5d81c7c4926a0c8fdaf56f2e0ddc7f6ad25226fc6306862b032beaf1757d69bca38fcfa22e0c05818b960e3ab26daf1e0342b306

Download Submit
C:\Windows\System\NMwcGJN.exe

Filesize
1.2MB

MD5
7c519c8cac173aaf99c22e6ed2a938a4

SHA1
24bcafc33b6c7b55f03bb5249578aafaaabdc9a2

SHA256
f50605297e1e52067c3ed007cf55e41fa89b6a6c61ba5585e5ee4999a6932d4e

SHA512
4b04156b484b39a2084e5353ffded887bd633bdc338631b80032aad24ecca464755cad28f57a855ab0747ab53b2b9763ef14aebf5d6783ca18b2b948f7a38908

Download Submit
C:\Windows\System\OyPwhZj.exe

Filesize
1.2MB

MD5
6faa183a905c87077393d0ad189f4e80

SHA1
96ba48172940817f5f14b4c3ca448c66b33cacbd

SHA256
f7d4fe8e5ba6ee35aab9017621f71956953d6329dd476f40b1d8d527d1fd57c8

SHA512
05c4101d1a70eee2bcafc79995b476fe1649198bf09387a26eee4ecfc1e86a40f294201bad8586b56da3402c093ec41a9b72fb32549ed90aca3a139d420998a4

Download Submit
C:\Windows\System\SEBCudI.exe

Filesize
1.2MB

MD5
8ff9a991d505d2df8fbcda406e50a26a

SHA1
dd4c17b194797ee4d91287d6bb264170a5e4ec03

SHA256
ae7828e41578553c65aac99436e477d6abf203f8d438511593e8bb1f9973f534

SHA512
e3bbb6aeab5489203ea9045b7bef3f7278a8edc741678d9f46475ae5600d93b0115d2a75864177cb4115d1114284372cd0a882dbae72d79e004994a0e62a80b9

Download Submit
C:\Windows\System\TxOmAcJ.exe

Filesize
1.2MB

MD5
b3ebfdb7ddee694a19348ae9dc6063e2

SHA1
ff92a2e284940702b2b6e814a8cb7c62ffb02611

SHA256
eee299863b9e52d679c59d3d2260bb846305c88ad6f58d31f3eac0a9ccbf4185

SHA512
498d0cec243ad782b886bd98450eb9a4a60eff0ff0175d67d7217a466adaa800729cbbdbc1b47fc9402edbf7eb9f58149c13cf28037c0fb9ac3aa1e0e80b5ec2

Download Submit
C:\Windows\System\XsuWzZJ.exe

Filesize
1.2MB

MD5
1ef2dc9fe4fdcfc75799828197593c98

SHA1
b7394ee2c87925897195969d8ced802bb54eeadd

SHA256
0b92117022148b0ba7980e901e7b027ce44a49ba929aa3288fc3253489535496

SHA512
e72079dc8b85f83dd8f7928a9cdf9d04ec86147d1261702ba005beb889ed67e086b845764759e7c78dd842e42a5d10951a07b4c87de6db27d217de128e847d36

Download Submit
C:\Windows\System\YaQhqWy.exe

Filesize
1.2MB

MD5
c9c3705b55f6907031139679a3d91a3f

SHA1
3e13b49be6e75b9aa1f9cf54f53452f2038bceb3

SHA256
357586950198594503fc91908e96f5f0dff4dd1e1d1bebbbfcfdf7115e4c4e51

SHA512
f8bff0c6050ba3fdb72ad1b70917a2ce92f83046c56df04822425436d81817c920428a57cdb0bd40bd1a273d17c2c6f1099f2f9495ed693b2c0ad3db6a49fa19

Download Submit
C:\Windows\System\ZHxyvDS.exe

Filesize
1.2MB

MD5
cf52ed293b07e34034f900a8d635ee18

SHA1
c3f0a7e033071fa2ecb18cfb75aaec424da0c25a

SHA256
9c206c841a5bd232955939eb59ceea033302cece0abc9c88ff16f74168c4df70

SHA512
2dee303d30716b12ccafdc728b0129bd741c9b5b3e0bee3d5f48ed34c1fabf563432858bae3d00b5f8ae3c45b0090db80eabdc1d33b6bba6ddd03433b1fb3d50

Download Submit
C:\Windows\System\ZSTLuAy.exe

Filesize
1.2MB

MD5
6b83962a207af02b6db7045250f0f38b

SHA1
9759095a5d91393ae8143f5a6af8a32c60ccfeb9

SHA256
14cc000a7cf1aabeb1d18397311f9c971ba23867f4b15e76b34df544858d6fa8

SHA512
bb25ac3aaa634583cbd8cfdbfe760dcaf9108d6bfd472dc9f050f90ccd78c484909effe0e7d30b2d2a15504e9174f6ad5b9b2545a58e94cc92dbae5cfe515c1c

Download Submit
C:\Windows\System\ZhgoHlN.exe

Filesize
1.2MB

MD5
abfbfc31445f321f10e024d47ce42899

SHA1
5b7e933886a4ec867801b06a9759f6bb203a3da3

SHA256
4be874966b349a9cece2ee817bb025399a3698e246021a57fe065fccea30dbe5

SHA512
cd1eddda29d4edf58d31850505228b97e3b2a9202f13c66f3cc4940a1fafbeabd20b40f4bb2a09523ffb5bf775ed191574c03ae4300388a7357210a4a6d4a28c

Download Submit
C:\Windows\System\eZuJKOk.exe

Filesize
1.2MB

MD5
54dd61fa2c756c0b94a0ecda83e0c745

SHA1
98875fecc61f8fe15ec568f7ab940194677040fc

SHA256
858ac790243b218933ff7d1c52a5b9ebc783d5e5ac40e27eaa78c80c61aa81fe

SHA512
a29c2e74eb9989f24a19fa6f191c7cb782c8520c9e584bbdec6b6bc99e5ce6dd74ba7a6988a12d4e7b17d18092fb96ad50b845f3caafad4ad5dff4837c67aa38

Download Submit
C:\Windows\System\gFZmbjk.exe

Filesize
1.2MB

MD5
b0b1c7f9ba65fac489c80d4d72f7404b

SHA1
38f42a912e9a1fbf567de5dcad79cb96abfeb94d

SHA256
16d14e726f37b7ec3baf5807a22c4f11001b3b944992f051b9d65d9baface663

SHA512
115c4d6a20f3d4b08f1ec8cb3c01bc93dc519cbec589cea6541f6ff5bf9b033db6979960c84fc29688cb87163279d26f0b8a62c3d23939e3f48fe1968f8f9008

Download Submit
C:\Windows\System\hnbCoPr.exe

Filesize
1.2MB

MD5
5cafbda6ec0501c12f10756462691c44

SHA1
71b211e4ef4d83c44eea5a9eb3e7e19e63204ec6

SHA256
5574b98cade2df90f911af8dfef4726af90255ccd3ed61ecfe885afe2d937321

SHA512
726c68493b7cea61649f4d1917ffe120cc4f9c667342c36cd8c770e52426e80381b629a204c6583ff0a7a54e5a12c1f7ffb386ff45840adfff34991880c8d05b

Download Submit
C:\Windows\System\igaEaec.exe

Filesize
1.2MB

MD5
f0886d42546f8e1b4b9bd7af24602339

SHA1
d14bc932337770d3bf9293769c840151ec175e6d

SHA256
9791dbb5eba4d7d7b605265f27921c798e462799889143f68c2b5142423ceeab

SHA512
eb1950819748d72f0f7fdb2bd32daad8fdf5ecb18b98afc24559d909629a7155c13e1f7218f5a29cf5bb55394b56ac4221306741c5c10fa77de9a25599985ee8

Download Submit
C:\Windows\System\nveSJHp.exe

Filesize
1.2MB

MD5
1d5ccea9d6a4f2f5624271154991e6bd

SHA1
4317a79ce5fa0c02b86511c1051e03b81f03c290

SHA256
18d163a9ec02fc192943bd4d19c18ca76679e637706c47b865e87ad893029afc

SHA512
0ad65195e9b0aac73d365821f762deb568af32523478f3b7f5830df932533b38ac88d3b7d0e7d7888873dea22757c3c102b4955333789116cee116d2ede83c0e

Download Submit
C:\Windows\System\qLzXXjO.exe

Filesize
1.2MB

MD5
c64cfaf52846a84479d204bb64036f8e

SHA1
66397d1ca6c950dc2d04be278d58496c8b91e454

SHA256
0d28bf07ccd1008c62db471075f87637a07272dfef2d860e13394b4372ab82a0

SHA512
c7bf7c66e7078bd405eb12857ce5c6cf5f24f395add90206c194c9d3d02cb89921b3ae8a1c1c6d0df12f07882a1fc4c6079da2e3dfb5461f2f29e429366f203d

Download Submit
C:\Windows\System\uSmvVmV.exe

Filesize
1.2MB

MD5
b02dd7eedca674a2108acb6d3256d0e1

SHA1
30dfe464a89528bea95f795e1288b6cd89e5fad1

SHA256
78db1d8fcb7b9ed54944fc775ab3456b07338e468e5dc9b1cf210a1af3cf927e

SHA512
b84c4e15c0a0c8ebca826bcb63332cec00b4b697b724f13c7d938724c52d43614cb527b279c0867c687c4baacf3aca1bbcefc71f178f0c406f405810411b8491

Download Submit
C:\Windows\System\vZNtOJr.exe

Filesize
1.2MB

MD5
6bc13d0bcce306d42445a711867e2e10

SHA1
8aecfca8196a7593eecaccf849dfccd28cab6e37

SHA256
e52127bf26def755e2cdfeaafeef010ca71e3b4dc9d06cc28aee0778cd29accc

SHA512
740cfa1c1380b148f141cc001309b9ded3b3e2f71a7b611d25d033214e211d943ebe2cd8e18f6a0fd8594b81a101bbeed6838211c47aa083be099208682b6dda

Download Submit
C:\Windows\System\xXwAYrD.exe

Filesize
1.2MB

MD5
2f31aff9e744f3c85e2396c90acffb9b

SHA1
121513e96f8afdcf56861d530bd5d4b296ead9e8

SHA256
930343db08962883b7ba9d30c45878be86e5dcee33b0083cb66246599da66d68

SHA512
0d2e1a1e28c8bdfb0e942b9a3ff474d013f5c5ef062e0a3755594e107ba96babbc4606b95e043fd629d924d6c1adb230cc6ce28f1e1d4f3c2c644f3f91384ceb

Download Submit
C:\Windows\System\yyuzxRi.exe

Filesize
1.2MB

MD5
e3f82623dac2df14a73f160bc084d133

SHA1
8aebe7b63c98df4e4e44064be97114564cb68b7f

SHA256
08931a30e74065e30b69a554c165b13a00115b1e3b15ba521d2756af7e5c9b4d

SHA512
7dbd4e0944a415f0ed4a4cc6802864ccb90bfb1ac4bb62b4a7a8102ec3947451e6abfdd2fdceb28f6be17ef42ab034614af7deceb72eaf923daf59fec4f28d08

Download Submit
memory/2100-0-0x000001CAB4050000-0x000001CAB4060000-memory.dmp

Filesize
64KB

Download