xmrig | 8181524e2c951105acdbae62c871e9c70bcbdf5c767feed45da5ee08470e825f

Analysis

max time kernel
135s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
Size

4.1MB
MD5

0666477451c4d0baadab40c8b9ef8730
SHA1

f905948a20e8abc4a58530852cd005a7dd3cb310
SHA256

8181524e2c951105acdbae62c871e9c70bcbdf5c767feed45da5ee08470e825f
SHA512

3d08b2437801221e4dccda66a634a2892fcb0f66acf82b814320bb33adb799b619eb6c7792d34e5299b3081b57c088056ecf4bcc120ee338b16faf803b2b276d
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWw:7bBeSFkk

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral1/memory/2508-0-0x000000013FCC0000-0x00000001400B6000-memory.dmp	xmrig
behavioral1/files/0x000b00000001224c-3.dat	xmrig
behavioral1/memory/2812-9-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2508-8-0x0000000002E10000-0x0000000003206000-memory.dmp	xmrig
behavioral1/files/0x0009000000016332-26.dat	xmrig
behavioral1/files/0x000f0000000006fd-30.dat	xmrig
behavioral1/files/0x0009000000016ccf-37.dat	xmrig
behavioral1/files/0x0007000000016ca9-36.dat	xmrig
behavioral1/memory/2532-31-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2632-46-0x000000013F480000-0x000000013F876000-memory.dmp	xmrig
behavioral1/memory/2440-54-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/files/0x000500000001946f-62.dat	xmrig
behavioral1/files/0x0005000000019485-72.dat	xmrig
behavioral1/files/0x00050000000194a4-77.dat	xmrig
behavioral1/files/0x00040000000194d8-89.dat	xmrig
behavioral1/files/0x00050000000194e8-100.dat	xmrig
behavioral1/files/0x00050000000194f2-119.dat	xmrig
behavioral1/files/0x0005000000019547-135.dat	xmrig
behavioral1/files/0x00050000000195a6-171.dat	xmrig
behavioral1/files/0x00050000000195a8-178.dat	xmrig
behavioral1/memory/2508-286-0x000000013F620000-0x000000013FA16000-memory.dmp	xmrig
behavioral1/memory/2404-306-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/memory/1512-310-0x000000013FF20000-0x0000000140316000-memory.dmp	xmrig
behavioral1/memory/2508-1438-0x000000013FCC0000-0x00000001400B6000-memory.dmp	xmrig
behavioral1/memory/968-302-0x000000013FEB0000-0x00000001402A6000-memory.dmp	xmrig
behavioral1/memory/3060-299-0x000000013FD60000-0x0000000140156000-memory.dmp	xmrig
behavioral1/memory/1740-296-0x000000013FD40000-0x0000000140136000-memory.dmp	xmrig
behavioral1/memory/3028-277-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	xmrig
behavioral1/files/0x00050000000195a8-181.dat	xmrig
behavioral1/files/0x00050000000195a7-173.dat	xmrig
behavioral1/files/0x00050000000195a4-165.dat	xmrig
behavioral1/files/0x00050000000195a2-159.dat	xmrig
behavioral1/files/0x000500000001959c-156.dat	xmrig
behavioral1/files/0x00050000000195a4-162.dat	xmrig
behavioral1/files/0x000500000001950c-127.dat	xmrig
behavioral1/files/0x000500000001959e-148.dat	xmrig
behavioral1/files/0x000500000001959e-146.dat	xmrig
behavioral1/files/0x0005000000019570-140.dat	xmrig
behavioral1/files/0x0005000000019570-138.dat	xmrig
behavioral1/files/0x00050000000194ee-107.dat	xmrig
behavioral1/files/0x0005000000019521-132.dat	xmrig
behavioral1/files/0x00050000000194f4-124.dat	xmrig
behavioral1/files/0x00050000000194f4-122.dat	xmrig
behavioral1/files/0x00050000000194ee-115.dat	xmrig
behavioral1/files/0x00050000000194ef-112.dat	xmrig
behavioral1/files/0x00050000000194ea-103.dat	xmrig
behavioral1/files/0x00050000000194ea-101.dat	xmrig
behavioral1/files/0x00040000000194dc-94.dat	xmrig
behavioral1/files/0x00040000000194dc-92.dat	xmrig
behavioral1/files/0x00040000000194d6-84.dat	xmrig
behavioral1/files/0x0005000000019473-67.dat	xmrig
behavioral1/files/0x000700000001704f-57.dat	xmrig
behavioral1/memory/2724-53-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/2580-44-0x000000013F920000-0x000000013FD16000-memory.dmp	xmrig
behavioral1/files/0x0009000000016cd4-51.dat	xmrig
behavioral1/files/0x0009000000016c90-21.dat	xmrig
behavioral1/memory/2508-18-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	xmrig
behavioral1/files/0x0009000000016c90-17.dat	xmrig
behavioral1/memory/2812-2289-0x000000013FDD0000-0x00000001401C6000-memory.dmp	xmrig
behavioral1/memory/2532-2306-0x000000013F760000-0x000000013FB56000-memory.dmp	xmrig
behavioral1/memory/2580-2351-0x000000013F920000-0x000000013FD16000-memory.dmp	xmrig
behavioral1/memory/2724-2359-0x000000013FAA0000-0x000000013FE96000-memory.dmp	xmrig
behavioral1/memory/3028-2345-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	xmrig
behavioral1/memory/2632-2333-0x000000013F480000-0x000000013F876000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2844	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2812	OydltWi.exe
2532	FOFLmyn.exe
3028	dKGYvSB.exe
2580	UCBRqLM.exe
2632	ufuPRQV.exe
2724	mGAdZSi.exe
2440	gGVtwzM.exe
1740	oyWzzHS.exe
3060	IoyvLYj.exe
968	AwCNHoD.exe
2404	WkIrQDo.exe
1512	LmNkzLW.exe
2696	nHJMFWc.exe
2692	WPbxkjL.exe
1904	KDKbWpb.exe
2492	qspwxXE.exe
1140	eQbIbKk.exe
832	WvIaClP.exe
1520	HNtcjaJ.exe
1968	IgaqTXU.exe
1440	hRSMLtt.exe
1932	SYXNlYw.exe
1896	wHXADRZ.exe
2284	PxmrBOm.exe
1996	bCVnFWd.exe
3032	GjVDbpo.exe
2132	nRdfgzF.exe
2124	aatesct.exe
580	Dkspwrf.exe
768	qGobdrX.exe
3044	atgQPzj.exe
2932	sujWadx.exe
1724	cEtsFRr.exe
1064	FchYDHs.exe
2256	rlCnCvM.exe
1632	NjwaAdg.exe
836	QmjOVbp.exe
956	UsOeJQD.exe
1832	XnGvEOj.exe
1372	PuXKKLD.exe
828	EEsypJn.exe
896	JtQtngJ.exe
904	QqltOeY.exe
2240	DNxwZBC.exe
2184	wxkpKdW.exe
2264	ljhVtSy.exe
2412	sqSnRRv.exe
2484	CcGKHyZ.exe
1180	UaxzAEq.exe
2108	gDGzWTt.exe
1760	aKMnxiq.exe
3008	uKUpvOs.exe
1768	gpIJxxN.exe
1772	ZXJlOIr.exe
2772	dGLaTxZ.exe
2824	GSgpwsW.exe
2936	CuFJIzc.exe
2552	EfYetwS.exe
540	BvfxUiG.exe
2792	lYTPmqF.exe
2480	FdxWMFV.exe
2488	STluMAX.exe
928	gfChdyU.exe
2512	kWAdtrz.exe

Loads dropped DLL 64 IoCs

pid	Process
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2508-0-0x000000013FCC0000-0x00000001400B6000-memory.dmp	upx
behavioral1/files/0x000b00000001224c-3.dat	upx
behavioral1/memory/2812-9-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2508-8-0x0000000002E10000-0x0000000003206000-memory.dmp	upx
behavioral1/files/0x0009000000016332-26.dat	upx
behavioral1/files/0x000f0000000006fd-30.dat	upx
behavioral1/files/0x0009000000016ccf-37.dat	upx
behavioral1/files/0x0007000000016ca9-36.dat	upx
behavioral1/memory/2532-31-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2632-46-0x000000013F480000-0x000000013F876000-memory.dmp	upx
behavioral1/memory/2440-54-0x000000013F620000-0x000000013FA16000-memory.dmp	upx
behavioral1/files/0x000500000001946f-62.dat	upx
behavioral1/files/0x0005000000019485-72.dat	upx
behavioral1/files/0x00050000000194a4-77.dat	upx
behavioral1/files/0x00040000000194d8-89.dat	upx
behavioral1/files/0x00050000000194e8-100.dat	upx
behavioral1/files/0x00050000000194f2-119.dat	upx
behavioral1/files/0x0005000000019547-135.dat	upx
behavioral1/files/0x000500000001950c-152.dat	upx
behavioral1/files/0x00050000000195a6-171.dat	upx
behavioral1/files/0x00050000000195a8-178.dat	upx
behavioral1/memory/2404-306-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/memory/1512-310-0x000000013FF20000-0x0000000140316000-memory.dmp	upx
behavioral1/memory/2508-1438-0x000000013FCC0000-0x00000001400B6000-memory.dmp	upx
behavioral1/memory/968-302-0x000000013FEB0000-0x00000001402A6000-memory.dmp	upx
behavioral1/memory/3060-299-0x000000013FD60000-0x0000000140156000-memory.dmp	upx
behavioral1/memory/1740-296-0x000000013FD40000-0x0000000140136000-memory.dmp	upx
behavioral1/memory/3028-277-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	upx
behavioral1/files/0x00050000000195a8-181.dat	upx
behavioral1/files/0x00050000000195a7-173.dat	upx
behavioral1/files/0x00050000000195a4-165.dat	upx
behavioral1/files/0x00050000000195a2-159.dat	upx
behavioral1/files/0x000500000001959c-156.dat	upx
behavioral1/files/0x00050000000195a4-162.dat	upx
behavioral1/files/0x000500000001950c-127.dat	upx
behavioral1/files/0x000500000001959e-148.dat	upx
behavioral1/files/0x000500000001959e-146.dat	upx
behavioral1/files/0x0005000000019570-140.dat	upx
behavioral1/files/0x0005000000019570-138.dat	upx
behavioral1/files/0x00050000000194ee-107.dat	upx
behavioral1/files/0x0005000000019521-132.dat	upx
behavioral1/files/0x00050000000194f4-124.dat	upx
behavioral1/files/0x00050000000194f4-122.dat	upx
behavioral1/files/0x00050000000194ee-115.dat	upx
behavioral1/files/0x00050000000194ef-112.dat	upx
behavioral1/files/0x00050000000194ea-103.dat	upx
behavioral1/files/0x00050000000194ea-101.dat	upx
behavioral1/files/0x00040000000194dc-94.dat	upx
behavioral1/files/0x00040000000194dc-92.dat	upx
behavioral1/files/0x00040000000194d6-84.dat	upx
behavioral1/files/0x0005000000019473-67.dat	upx
behavioral1/files/0x000700000001704f-57.dat	upx
behavioral1/memory/2724-53-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/2580-44-0x000000013F920000-0x000000013FD16000-memory.dmp	upx
behavioral1/files/0x0009000000016cd4-51.dat	upx
behavioral1/files/0x0009000000016c90-21.dat	upx
behavioral1/memory/2508-18-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	upx
behavioral1/files/0x0009000000016c90-17.dat	upx
behavioral1/memory/2812-2289-0x000000013FDD0000-0x00000001401C6000-memory.dmp	upx
behavioral1/memory/2532-2306-0x000000013F760000-0x000000013FB56000-memory.dmp	upx
behavioral1/memory/2580-2351-0x000000013F920000-0x000000013FD16000-memory.dmp	upx
behavioral1/memory/2724-2359-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/memory/3028-2345-0x000000013F2E0000-0x000000013F6D6000-memory.dmp	upx
behavioral1/memory/2632-2333-0x000000013F480000-0x000000013F876000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zBvYXuP.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ZLxMuZG.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\NXidQyV.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\biCkwJf.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\HLvZfpv.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\QBhYTIg.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\OANbdyF.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\jBdMonL.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ECsTexs.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\EDthTYY.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\KIjOBHZ.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ApqewOs.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ukxaVaR.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\INVsanf.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\nXFCnZS.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\dazeyIb.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\VbhIqxQ.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\idbUpoX.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\KDzIdBu.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\nynXstv.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\thTVfMw.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\EqgjVTz.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\YdcLCSP.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\VzhOmBA.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\lqwjGnJ.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\mqVJTlx.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\nvXdOtF.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\WZWlSiv.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\wvIeFTH.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\xPabLTf.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ZrQbhGX.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\SEfyZhl.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ZXJlOIr.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\BFmvLAq.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\PrTAPUM.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\JLOGVnP.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\qRDMgYb.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\QtisKPW.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\eBhIViO.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\nQdHjDT.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\DeuowXW.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\nkMRUZy.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\bAWRzeT.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\MGjisKD.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\uPxHuyg.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\kavdbVk.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\pDUGVEB.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\pNhxZbG.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\jYaRsBD.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\aiooNEJ.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\CjkDgbP.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\LdYOZAw.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ToakKaF.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\kdsMpoy.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\bIUgjxG.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\gOanMCR.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\hiLuSQF.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\nQFbnmL.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ZdlveEr.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\fAENASx.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\LKzejfT.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\UCWbPUT.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\ksybeql.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
File created	C:\Windows\System\UhbDhfL.exe	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2844	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
Token: SeDebugPrivilege	2844	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2844	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	29
PID 2508 wrote to memory of 2844	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	29
PID 2508 wrote to memory of 2844	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	29
PID 2508 wrote to memory of 2812	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	30
PID 2508 wrote to memory of 2812	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	30
PID 2508 wrote to memory of 2812	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	30
PID 2508 wrote to memory of 3028	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	31
PID 2508 wrote to memory of 3028	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	31
PID 2508 wrote to memory of 3028	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	31
PID 2508 wrote to memory of 2532	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	32
PID 2508 wrote to memory of 2532	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	32
PID 2508 wrote to memory of 2532	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	32
PID 2508 wrote to memory of 2580	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	33
PID 2508 wrote to memory of 2580	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	33
PID 2508 wrote to memory of 2580	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	33
PID 2508 wrote to memory of 2632	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	34
PID 2508 wrote to memory of 2632	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	34
PID 2508 wrote to memory of 2632	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	34
PID 2508 wrote to memory of 2724	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	35
PID 2508 wrote to memory of 2724	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	35
PID 2508 wrote to memory of 2724	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	35
PID 2508 wrote to memory of 2440	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	36
PID 2508 wrote to memory of 2440	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	36
PID 2508 wrote to memory of 2440	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	36
PID 2508 wrote to memory of 1740	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	37
PID 2508 wrote to memory of 1740	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	37
PID 2508 wrote to memory of 1740	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	37
PID 2508 wrote to memory of 3060	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	38
PID 2508 wrote to memory of 3060	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	38
PID 2508 wrote to memory of 3060	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	38
PID 2508 wrote to memory of 968	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	39
PID 2508 wrote to memory of 968	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	39
PID 2508 wrote to memory of 968	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	39
PID 2508 wrote to memory of 2404	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	40
PID 2508 wrote to memory of 2404	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	40
PID 2508 wrote to memory of 2404	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	40
PID 2508 wrote to memory of 1512	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	41
PID 2508 wrote to memory of 1512	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	41
PID 2508 wrote to memory of 1512	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	41
PID 2508 wrote to memory of 2696	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	42
PID 2508 wrote to memory of 2696	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	42
PID 2508 wrote to memory of 2696	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	42
PID 2508 wrote to memory of 2692	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	43
PID 2508 wrote to memory of 2692	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	43
PID 2508 wrote to memory of 2692	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	43
PID 2508 wrote to memory of 1904	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	44
PID 2508 wrote to memory of 1904	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	44
PID 2508 wrote to memory of 1904	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	44
PID 2508 wrote to memory of 2492	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	45
PID 2508 wrote to memory of 2492	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	45
PID 2508 wrote to memory of 2492	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	45
PID 2508 wrote to memory of 1140	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	46
PID 2508 wrote to memory of 1140	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	46
PID 2508 wrote to memory of 1140	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	46
PID 2508 wrote to memory of 1520	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	47
PID 2508 wrote to memory of 1520	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	47
PID 2508 wrote to memory of 1520	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	47
PID 2508 wrote to memory of 832	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	48
PID 2508 wrote to memory of 832	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	48
PID 2508 wrote to memory of 832	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	48
PID 2508 wrote to memory of 1968	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	49
PID 2508 wrote to memory of 1968	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	49
PID 2508 wrote to memory of 1968	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	49
PID 2508 wrote to memory of 1440	2508	0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0666477451c4d0baadab40c8b9ef8730_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2844
- C:\Windows\System\OydltWi.exe
  C:\Windows\System\OydltWi.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\dKGYvSB.exe
  C:\Windows\System\dKGYvSB.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\FOFLmyn.exe
  C:\Windows\System\FOFLmyn.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\UCBRqLM.exe
  C:\Windows\System\UCBRqLM.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ufuPRQV.exe
  C:\Windows\System\ufuPRQV.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\mGAdZSi.exe
  C:\Windows\System\mGAdZSi.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\gGVtwzM.exe
  C:\Windows\System\gGVtwzM.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\oyWzzHS.exe
  C:\Windows\System\oyWzzHS.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\IoyvLYj.exe
  C:\Windows\System\IoyvLYj.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\AwCNHoD.exe
  C:\Windows\System\AwCNHoD.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\WkIrQDo.exe
  C:\Windows\System\WkIrQDo.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\LmNkzLW.exe
  C:\Windows\System\LmNkzLW.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\nHJMFWc.exe
  C:\Windows\System\nHJMFWc.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\WPbxkjL.exe
  C:\Windows\System\WPbxkjL.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\KDKbWpb.exe
  C:\Windows\System\KDKbWpb.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\qspwxXE.exe
  C:\Windows\System\qspwxXE.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\eQbIbKk.exe
  C:\Windows\System\eQbIbKk.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\HNtcjaJ.exe
  C:\Windows\System\HNtcjaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\WvIaClP.exe
  C:\Windows\System\WvIaClP.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\IgaqTXU.exe
  C:\Windows\System\IgaqTXU.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\hRSMLtt.exe
  C:\Windows\System\hRSMLtt.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\bCVnFWd.exe
  C:\Windows\System\bCVnFWd.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\SYXNlYw.exe
  C:\Windows\System\SYXNlYw.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\GjVDbpo.exe
  C:\Windows\System\GjVDbpo.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\wHXADRZ.exe
  C:\Windows\System\wHXADRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\nRdfgzF.exe
  C:\Windows\System\nRdfgzF.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\PxmrBOm.exe
  C:\Windows\System\PxmrBOm.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\aatesct.exe
  C:\Windows\System\aatesct.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\Dkspwrf.exe
  C:\Windows\System\Dkspwrf.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\qGobdrX.exe
  C:\Windows\System\qGobdrX.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\atgQPzj.exe
  C:\Windows\System\atgQPzj.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\sujWadx.exe
  C:\Windows\System\sujWadx.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cEtsFRr.exe
  C:\Windows\System\cEtsFRr.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\FchYDHs.exe
  C:\Windows\System\FchYDHs.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\rlCnCvM.exe
  C:\Windows\System\rlCnCvM.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\NjwaAdg.exe
  C:\Windows\System\NjwaAdg.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\QmjOVbp.exe
  C:\Windows\System\QmjOVbp.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\UsOeJQD.exe
  C:\Windows\System\UsOeJQD.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\XnGvEOj.exe
  C:\Windows\System\XnGvEOj.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\PuXKKLD.exe
  C:\Windows\System\PuXKKLD.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\EEsypJn.exe
  C:\Windows\System\EEsypJn.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\JtQtngJ.exe
  C:\Windows\System\JtQtngJ.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\QqltOeY.exe
  C:\Windows\System\QqltOeY.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\DNxwZBC.exe
  C:\Windows\System\DNxwZBC.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\wxkpKdW.exe
  C:\Windows\System\wxkpKdW.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ljhVtSy.exe
  C:\Windows\System\ljhVtSy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\sqSnRRv.exe
  C:\Windows\System\sqSnRRv.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\CcGKHyZ.exe
  C:\Windows\System\CcGKHyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\UaxzAEq.exe
  C:\Windows\System\UaxzAEq.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\gDGzWTt.exe
  C:\Windows\System\gDGzWTt.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\aKMnxiq.exe
  C:\Windows\System\aKMnxiq.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\uKUpvOs.exe
  C:\Windows\System\uKUpvOs.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\gpIJxxN.exe
  C:\Windows\System\gpIJxxN.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\ZXJlOIr.exe
  C:\Windows\System\ZXJlOIr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\dGLaTxZ.exe
  C:\Windows\System\dGLaTxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\GSgpwsW.exe
  C:\Windows\System\GSgpwsW.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\CuFJIzc.exe
  C:\Windows\System\CuFJIzc.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\EfYetwS.exe
  C:\Windows\System\EfYetwS.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\BvfxUiG.exe
  C:\Windows\System\BvfxUiG.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\lYTPmqF.exe
  C:\Windows\System\lYTPmqF.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\FdxWMFV.exe
  C:\Windows\System\FdxWMFV.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\STluMAX.exe
  C:\Windows\System\STluMAX.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\gfChdyU.exe
  C:\Windows\System\gfChdyU.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\dyBfWCS.exe
  C:\Windows\System\dyBfWCS.exe
  2⤵
  PID:1120
- C:\Windows\System\kWAdtrz.exe
  C:\Windows\System\kWAdtrz.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\dGpnyYS.exe
  C:\Windows\System\dGpnyYS.exe
  2⤵
  PID:2208
- C:\Windows\System\MwIeMUk.exe
  C:\Windows\System\MwIeMUk.exe
  2⤵
  PID:2836
- C:\Windows\System\vVIvtLF.exe
  C:\Windows\System\vVIvtLF.exe
  2⤵
  PID:1540
- C:\Windows\System\NTQwaxq.exe
  C:\Windows\System\NTQwaxq.exe
  2⤵
  PID:1220
- C:\Windows\System\YEKCNiT.exe
  C:\Windows\System\YEKCNiT.exe
  2⤵
  PID:2940
- C:\Windows\System\WlgGnXJ.exe
  C:\Windows\System\WlgGnXJ.exe
  2⤵
  PID:2400
- C:\Windows\System\rrOBplo.exe
  C:\Windows\System\rrOBplo.exe
  2⤵
  PID:1100
- C:\Windows\System\pcMwTgD.exe
  C:\Windows\System\pcMwTgD.exe
  2⤵
  PID:940
- C:\Windows\System\DzYpDVC.exe
  C:\Windows\System\DzYpDVC.exe
  2⤵
  PID:1940
- C:\Windows\System\pSGRmtK.exe
  C:\Windows\System\pSGRmtK.exe
  2⤵
  PID:1820
- C:\Windows\System\gWiNiJG.exe
  C:\Windows\System\gWiNiJG.exe
  2⤵
  PID:2364
- C:\Windows\System\ReEOpvq.exe
  C:\Windows\System\ReEOpvq.exe
  2⤵
  PID:668
- C:\Windows\System\fDKYPRy.exe
  C:\Windows\System\fDKYPRy.exe
  2⤵
  PID:1048
- C:\Windows\System\wDeALeY.exe
  C:\Windows\System\wDeALeY.exe
  2⤵
  PID:2796
- C:\Windows\System\TohvlPh.exe
  C:\Windows\System\TohvlPh.exe
  2⤵
  PID:1036
- C:\Windows\System\qVMzXQz.exe
  C:\Windows\System\qVMzXQz.exe
  2⤵
  PID:1804
- C:\Windows\System\XGaoRqK.exe
  C:\Windows\System\XGaoRqK.exe
  2⤵
  PID:972
- C:\Windows\System\ofycxyN.exe
  C:\Windows\System\ofycxyN.exe
  2⤵
  PID:688
- C:\Windows\System\rhWtNvN.exe
  C:\Windows\System\rhWtNvN.exe
  2⤵
  PID:952
- C:\Windows\System\hZwtuHN.exe
  C:\Windows\System\hZwtuHN.exe
  2⤵
  PID:648
- C:\Windows\System\INVsanf.exe
  C:\Windows\System\INVsanf.exe
  2⤵
  PID:868
- C:\Windows\System\jQauiun.exe
  C:\Windows\System\jQauiun.exe
  2⤵
  PID:624
- C:\Windows\System\GhiawIe.exe
  C:\Windows\System\GhiawIe.exe
  2⤵
  PID:3020
- C:\Windows\System\tcEHkXD.exe
  C:\Windows\System\tcEHkXD.exe
  2⤵
  PID:2984
- C:\Windows\System\VPhIgvc.exe
  C:\Windows\System\VPhIgvc.exe
  2⤵
  PID:2152
- C:\Windows\System\kRtOovx.exe
  C:\Windows\System\kRtOovx.exe
  2⤵
  PID:1260
- C:\Windows\System\azjUBIT.exe
  C:\Windows\System\azjUBIT.exe
  2⤵
  PID:2248
- C:\Windows\System\qAscExU.exe
  C:\Windows\System\qAscExU.exe
  2⤵
  PID:2204
- C:\Windows\System\OHPPSvA.exe
  C:\Windows\System\OHPPSvA.exe
  2⤵
  PID:1700
- C:\Windows\System\btTsKhN.exe
  C:\Windows\System\btTsKhN.exe
  2⤵
  PID:1000
- C:\Windows\System\xBTfJiY.exe
  C:\Windows\System\xBTfJiY.exe
  2⤵
  PID:1784
- C:\Windows\System\VEXwgWs.exe
  C:\Windows\System\VEXwgWs.exe
  2⤵
  PID:1696
- C:\Windows\System\kLxdXWO.exe
  C:\Windows\System\kLxdXWO.exe
  2⤵
  PID:1616
- C:\Windows\System\iyyFohu.exe
  C:\Windows\System\iyyFohu.exe
  2⤵
  PID:2612
- C:\Windows\System\GZelrGb.exe
  C:\Windows\System\GZelrGb.exe
  2⤵
  PID:2720
- C:\Windows\System\SLQYUXV.exe
  C:\Windows\System\SLQYUXV.exe
  2⤵
  PID:2964
- C:\Windows\System\yNDdUHU.exe
  C:\Windows\System\yNDdUHU.exe
  2⤵
  PID:2428
- C:\Windows\System\FLLuKsD.exe
  C:\Windows\System\FLLuKsD.exe
  2⤵
  PID:2600
- C:\Windows\System\RfbGcay.exe
  C:\Windows\System\RfbGcay.exe
  2⤵
  PID:560
- C:\Windows\System\iEnvOjd.exe
  C:\Windows\System\iEnvOjd.exe
  2⤵
  PID:1212
- C:\Windows\System\KOBNuEb.exe
  C:\Windows\System\KOBNuEb.exe
  2⤵
  PID:2032
- C:\Windows\System\VqhnQsN.exe
  C:\Windows\System\VqhnQsN.exe
  2⤵
  PID:2680
- C:\Windows\System\NFwUuoA.exe
  C:\Windows\System\NFwUuoA.exe
  2⤵
  PID:2852
- C:\Windows\System\ugvifzk.exe
  C:\Windows\System\ugvifzk.exe
  2⤵
  PID:1652
- C:\Windows\System\ToezJJz.exe
  C:\Windows\System\ToezJJz.exe
  2⤵
  PID:456
- C:\Windows\System\BxuOTiU.exe
  C:\Windows\System\BxuOTiU.exe
  2⤵
  PID:2652
- C:\Windows\System\FZgAGqh.exe
  C:\Windows\System\FZgAGqh.exe
  2⤵
  PID:2456
- C:\Windows\System\gOanMCR.exe
  C:\Windows\System\gOanMCR.exe
  2⤵
  PID:2520
- C:\Windows\System\IIEVFbn.exe
  C:\Windows\System\IIEVFbn.exe
  2⤵
  PID:1924
- C:\Windows\System\wePbNgO.exe
  C:\Windows\System\wePbNgO.exe
  2⤵
  PID:2956
- C:\Windows\System\ISvhult.exe
  C:\Windows\System\ISvhult.exe
  2⤵
  PID:2140
- C:\Windows\System\mqVJTlx.exe
  C:\Windows\System\mqVJTlx.exe
  2⤵
  PID:1452
- C:\Windows\System\GApsPca.exe
  C:\Windows\System\GApsPca.exe
  2⤵
  PID:1624
- C:\Windows\System\LHAyvsG.exe
  C:\Windows\System\LHAyvsG.exe
  2⤵
  PID:2432
- C:\Windows\System\KwRSekR.exe
  C:\Windows\System\KwRSekR.exe
  2⤵
  PID:2392
- C:\Windows\System\sMAyUTt.exe
  C:\Windows\System\sMAyUTt.exe
  2⤵
  PID:1428
- C:\Windows\System\seWoJKV.exe
  C:\Windows\System\seWoJKV.exe
  2⤵
  PID:108
- C:\Windows\System\UhNcfdQ.exe
  C:\Windows\System\UhNcfdQ.exe
  2⤵
  PID:1488
- C:\Windows\System\KCFZVPm.exe
  C:\Windows\System\KCFZVPm.exe
  2⤵
  PID:1404
- C:\Windows\System\dpNztMM.exe
  C:\Windows\System\dpNztMM.exe
  2⤵
  PID:2352
- C:\Windows\System\XeChPdr.exe
  C:\Windows\System\XeChPdr.exe
  2⤵
  PID:2176
- C:\Windows\System\oalvwsj.exe
  C:\Windows\System\oalvwsj.exe
  2⤵
  PID:2564
- C:\Windows\System\UwHRgKR.exe
  C:\Windows\System\UwHRgKR.exe
  2⤵
  PID:2544
- C:\Windows\System\QdJaEcS.exe
  C:\Windows\System\QdJaEcS.exe
  2⤵
  PID:1104
- C:\Windows\System\sliWeMJ.exe
  C:\Windows\System\sliWeMJ.exe
  2⤵
  PID:1532
- C:\Windows\System\XpJbzDH.exe
  C:\Windows\System\XpJbzDH.exe
  2⤵
  PID:2528
- C:\Windows\System\nVSDRMw.exe
  C:\Windows\System\nVSDRMw.exe
  2⤵
  PID:1272
- C:\Windows\System\tSbmgwe.exe
  C:\Windows\System\tSbmgwe.exe
  2⤵
  PID:1588
- C:\Windows\System\hUqKspm.exe
  C:\Windows\System\hUqKspm.exe
  2⤵
  PID:2360
- C:\Windows\System\pODNnnn.exe
  C:\Windows\System\pODNnnn.exe
  2⤵
  PID:1936
- C:\Windows\System\KYrowId.exe
  C:\Windows\System\KYrowId.exe
  2⤵
  PID:2776
- C:\Windows\System\EVJJecI.exe
  C:\Windows\System\EVJJecI.exe
  2⤵
  PID:1308
- C:\Windows\System\LaLFJNn.exe
  C:\Windows\System\LaLFJNn.exe
  2⤵
  PID:1500
- C:\Windows\System\kUoHnlL.exe
  C:\Windows\System\kUoHnlL.exe
  2⤵
  PID:2216
- C:\Windows\System\GfCVFOL.exe
  C:\Windows\System\GfCVFOL.exe
  2⤵
  PID:2056
- C:\Windows\System\YRDeEiS.exe
  C:\Windows\System\YRDeEiS.exe
  2⤵
  PID:924
- C:\Windows\System\phFeRem.exe
  C:\Windows\System\phFeRem.exe
  2⤵
  PID:3052
- C:\Windows\System\phSQVTT.exe
  C:\Windows\System\phSQVTT.exe
  2⤵
  PID:2876
- C:\Windows\System\YsVKjGt.exe
  C:\Windows\System\YsVKjGt.exe
  2⤵
  PID:936
- C:\Windows\System\RgUUXWC.exe
  C:\Windows\System\RgUUXWC.exe
  2⤵
  PID:2220
- C:\Windows\System\TjEftbN.exe
  C:\Windows\System\TjEftbN.exe
  2⤵
  PID:568
- C:\Windows\System\qHbqyAn.exe
  C:\Windows\System\qHbqyAn.exe
  2⤵
  PID:1392
- C:\Windows\System\UYELMWI.exe
  C:\Windows\System\UYELMWI.exe
  2⤵
  PID:2200
- C:\Windows\System\BwPebyc.exe
  C:\Windows\System\BwPebyc.exe
  2⤵
  PID:3112
- C:\Windows\System\HdNYGHT.exe
  C:\Windows\System\HdNYGHT.exe
  2⤵
  PID:3128
- C:\Windows\System\Bedusjv.exe
  C:\Windows\System\Bedusjv.exe
  2⤵
  PID:3152
- C:\Windows\System\aPhlTRG.exe
  C:\Windows\System\aPhlTRG.exe
  2⤵
  PID:3168
- C:\Windows\System\bvVIWti.exe
  C:\Windows\System\bvVIWti.exe
  2⤵
  PID:3192
- C:\Windows\System\STPhPlr.exe
  C:\Windows\System\STPhPlr.exe
  2⤵
  PID:3208
- C:\Windows\System\xFKmpNy.exe
  C:\Windows\System\xFKmpNy.exe
  2⤵
  PID:3448
- C:\Windows\System\NtXZimW.exe
  C:\Windows\System\NtXZimW.exe
  2⤵
  PID:3472
- C:\Windows\System\uoJTSFI.exe
  C:\Windows\System\uoJTSFI.exe
  2⤵
  PID:3488
- C:\Windows\System\wapdvmB.exe
  C:\Windows\System\wapdvmB.exe
  2⤵
  PID:3508
- C:\Windows\System\CfZcJSV.exe
  C:\Windows\System\CfZcJSV.exe
  2⤵
  PID:3524
- C:\Windows\System\eVEKdVD.exe
  C:\Windows\System\eVEKdVD.exe
  2⤵
  PID:3548
- C:\Windows\System\cVpTvWH.exe
  C:\Windows\System\cVpTvWH.exe
  2⤵
  PID:3568
- C:\Windows\System\IDyjQDD.exe
  C:\Windows\System\IDyjQDD.exe
  2⤵
  PID:3588
- C:\Windows\System\xTwLRdb.exe
  C:\Windows\System\xTwLRdb.exe
  2⤵
  PID:3616
- C:\Windows\System\pJnTmaG.exe
  C:\Windows\System\pJnTmaG.exe
  2⤵
  PID:3632
- C:\Windows\System\DINGSwZ.exe
  C:\Windows\System\DINGSwZ.exe
  2⤵
  PID:3648
- C:\Windows\System\ibPOsGT.exe
  C:\Windows\System\ibPOsGT.exe
  2⤵
  PID:3680
- C:\Windows\System\dQTJLRT.exe
  C:\Windows\System\dQTJLRT.exe
  2⤵
  PID:3696
- C:\Windows\System\cXlHcKk.exe
  C:\Windows\System\cXlHcKk.exe
  2⤵
  PID:3716
- C:\Windows\System\iSFigdk.exe
  C:\Windows\System\iSFigdk.exe
  2⤵
  PID:3732
- C:\Windows\System\UPiqnak.exe
  C:\Windows\System\UPiqnak.exe
  2⤵
  PID:3752
- C:\Windows\System\GhjKoOO.exe
  C:\Windows\System\GhjKoOO.exe
  2⤵
  PID:3772
- C:\Windows\System\xDGcDmc.exe
  C:\Windows\System\xDGcDmc.exe
  2⤵
  PID:3800
- C:\Windows\System\RaccDiS.exe
  C:\Windows\System\RaccDiS.exe
  2⤵
  PID:3816
- C:\Windows\System\fGmUKAF.exe
  C:\Windows\System\fGmUKAF.exe
  2⤵
  PID:3840
- C:\Windows\System\URpSFKD.exe
  C:\Windows\System\URpSFKD.exe
  2⤵
  PID:3856
- C:\Windows\System\THQEEjh.exe
  C:\Windows\System\THQEEjh.exe
  2⤵
  PID:3872
- C:\Windows\System\WXSSFDZ.exe
  C:\Windows\System\WXSSFDZ.exe
  2⤵
  PID:3892
- C:\Windows\System\ZAWPulQ.exe
  C:\Windows\System\ZAWPulQ.exe
  2⤵
  PID:3912
- C:\Windows\System\iSsXkjp.exe
  C:\Windows\System\iSsXkjp.exe
  2⤵
  PID:3928
- C:\Windows\System\LABJsUA.exe
  C:\Windows\System\LABJsUA.exe
  2⤵
  PID:3948
- C:\Windows\System\UnTfvjD.exe
  C:\Windows\System\UnTfvjD.exe
  2⤵
  PID:3964
- C:\Windows\System\AjkBska.exe
  C:\Windows\System\AjkBska.exe
  2⤵
  PID:3992
- C:\Windows\System\nKIpeXx.exe
  C:\Windows\System\nKIpeXx.exe
  2⤵
  PID:4032
- C:\Windows\System\qpAfqGD.exe
  C:\Windows\System\qpAfqGD.exe
  2⤵
  PID:4048
- C:\Windows\System\QIyPDOm.exe
  C:\Windows\System\QIyPDOm.exe
  2⤵
  PID:4064
- C:\Windows\System\IQmpKTu.exe
  C:\Windows\System\IQmpKTu.exe
  2⤵
  PID:4088
- C:\Windows\System\LOZwPuh.exe
  C:\Windows\System\LOZwPuh.exe
  2⤵
  PID:2468
- C:\Windows\System\aFHtIbQ.exe
  C:\Windows\System\aFHtIbQ.exe
  2⤵
  PID:3164
- C:\Windows\System\EhTFQRm.exe
  C:\Windows\System\EhTFQRm.exe
  2⤵
  PID:2472
- C:\Windows\System\WKCDqGH.exe
  C:\Windows\System\WKCDqGH.exe
  2⤵
  PID:3076
- C:\Windows\System\lPLbDNv.exe
  C:\Windows\System\lPLbDNv.exe
  2⤵
  PID:3100
- C:\Windows\System\qRDMgYb.exe
  C:\Windows\System\qRDMgYb.exe
  2⤵
  PID:2008
- C:\Windows\System\GZSXrEx.exe
  C:\Windows\System\GZSXrEx.exe
  2⤵
  PID:3140
- C:\Windows\System\DIDrtqM.exe
  C:\Windows\System\DIDrtqM.exe
  2⤵
  PID:3216
- C:\Windows\System\CanTBPm.exe
  C:\Windows\System\CanTBPm.exe
  2⤵
  PID:3236
- C:\Windows\System\dfDJorJ.exe
  C:\Windows\System\dfDJorJ.exe
  2⤵
  PID:1388
- C:\Windows\System\FRvddAm.exe
  C:\Windows\System\FRvddAm.exe
  2⤵
  PID:3280
- C:\Windows\System\kxWNkQF.exe
  C:\Windows\System\kxWNkQF.exe
  2⤵
  PID:3308
- C:\Windows\System\SMQqPSm.exe
  C:\Windows\System\SMQqPSm.exe
  2⤵
  PID:3332
- C:\Windows\System\hkhzhCo.exe
  C:\Windows\System\hkhzhCo.exe
  2⤵
  PID:3348
- C:\Windows\System\GIMEKfi.exe
  C:\Windows\System\GIMEKfi.exe
  2⤵
  PID:3364
- C:\Windows\System\mhPLxKs.exe
  C:\Windows\System\mhPLxKs.exe
  2⤵
  PID:3380
- C:\Windows\System\LiELaTj.exe
  C:\Windows\System\LiELaTj.exe
  2⤵
  PID:3400
- C:\Windows\System\jBCYAWV.exe
  C:\Windows\System\jBCYAWV.exe
  2⤵
  PID:3420
- C:\Windows\System\iMQWMSt.exe
  C:\Windows\System\iMQWMSt.exe
  2⤵
  PID:3440
- C:\Windows\System\igCWMXC.exe
  C:\Windows\System\igCWMXC.exe
  2⤵
  PID:3456
- C:\Windows\System\vgFeXfa.exe
  C:\Windows\System\vgFeXfa.exe
  2⤵
  PID:2668
- C:\Windows\System\QzryQGs.exe
  C:\Windows\System\QzryQGs.exe
  2⤵
  PID:3500
- C:\Windows\System\KsIQovP.exe
  C:\Windows\System\KsIQovP.exe
  2⤵
  PID:3536
- C:\Windows\System\kLfgDec.exe
  C:\Windows\System\kLfgDec.exe
  2⤵
  PID:3520
- C:\Windows\System\FnkBOgv.exe
  C:\Windows\System\FnkBOgv.exe
  2⤵
  PID:3560
- C:\Windows\System\XRiLmVD.exe
  C:\Windows\System\XRiLmVD.exe
  2⤵
  PID:3612
- C:\Windows\System\QfbQiqO.exe
  C:\Windows\System\QfbQiqO.exe
  2⤵
  PID:2420
- C:\Windows\System\AvHyPqL.exe
  C:\Windows\System\AvHyPqL.exe
  2⤵
  PID:2356
- C:\Windows\System\CSiEuQY.exe
  C:\Windows\System\CSiEuQY.exe
  2⤵
  PID:1384
- C:\Windows\System\usogQEy.exe
  C:\Windows\System\usogQEy.exe
  2⤵
  PID:3708
- C:\Windows\System\wrAPcjS.exe
  C:\Windows\System\wrAPcjS.exe
  2⤵
  PID:2800
- C:\Windows\System\cYlEUkA.exe
  C:\Windows\System\cYlEUkA.exe
  2⤵
  PID:3728
- C:\Windows\System\WVcGNxn.exe
  C:\Windows\System\WVcGNxn.exe
  2⤵
  PID:3764
- C:\Windows\System\VZmYfBO.exe
  C:\Windows\System\VZmYfBO.exe
  2⤵
  PID:3796
- C:\Windows\System\lTLTyvE.exe
  C:\Windows\System\lTLTyvE.exe
  2⤵
  PID:3676
- C:\Windows\System\FPfGApF.exe
  C:\Windows\System\FPfGApF.exe
  2⤵
  PID:3868
- C:\Windows\System\fvntYIG.exe
  C:\Windows\System\fvntYIG.exe
  2⤵
  PID:1072
- C:\Windows\System\aUaEkml.exe
  C:\Windows\System\aUaEkml.exe
  2⤵
  PID:3984
- C:\Windows\System\ZEtFfan.exe
  C:\Windows\System\ZEtFfan.exe
  2⤵
  PID:3888
- C:\Windows\System\zaVxUVw.exe
  C:\Windows\System\zaVxUVw.exe
  2⤵
  PID:3960
- C:\Windows\System\ccWTcaY.exe
  C:\Windows\System\ccWTcaY.exe
  2⤵
  PID:4008
- C:\Windows\System\XekDpVn.exe
  C:\Windows\System\XekDpVn.exe
  2⤵
  PID:4072
- C:\Windows\System\FVDtyDk.exe
  C:\Windows\System\FVDtyDk.exe
  2⤵
  PID:2136
- C:\Windows\System\fjeeApj.exe
  C:\Windows\System\fjeeApj.exe
  2⤵
  PID:2808
- C:\Windows\System\wLayFyJ.exe
  C:\Windows\System\wLayFyJ.exe
  2⤵
  PID:2084
- C:\Windows\System\jQfBjEa.exe
  C:\Windows\System\jQfBjEa.exe
  2⤵
  PID:1964
- C:\Windows\System\EGLJRLQ.exe
  C:\Windows\System\EGLJRLQ.exe
  2⤵
  PID:3096
- C:\Windows\System\uPxHuyg.exe
  C:\Windows\System\uPxHuyg.exe
  2⤵
  PID:3176
- C:\Windows\System\TtFteHR.exe
  C:\Windows\System\TtFteHR.exe
  2⤵
  PID:3184
- C:\Windows\System\raziMVx.exe
  C:\Windows\System\raziMVx.exe
  2⤵
  PID:3260
- C:\Windows\System\QxpmhTL.exe
  C:\Windows\System\QxpmhTL.exe
  2⤵
  PID:3228
- C:\Windows\System\oKqQrvx.exe
  C:\Windows\System\oKqQrvx.exe
  2⤵
  PID:3340
- C:\Windows\System\qgwSDOL.exe
  C:\Windows\System\qgwSDOL.exe
  2⤵
  PID:3224
- C:\Windows\System\CEgAHyX.exe
  C:\Windows\System\CEgAHyX.exe
  2⤵
  PID:3544
- C:\Windows\System\FitvxBj.exe
  C:\Windows\System\FitvxBj.exe
  2⤵
  PID:3324
- C:\Windows\System\VEyKJlc.exe
  C:\Windows\System\VEyKJlc.exe
  2⤵
  PID:3656
- C:\Windows\System\RCONAIv.exe
  C:\Windows\System\RCONAIv.exe
  2⤵
  PID:3320
- C:\Windows\System\dvzimPo.exe
  C:\Windows\System\dvzimPo.exe
  2⤵
  PID:2536
- C:\Windows\System\undFxHN.exe
  C:\Windows\System\undFxHN.exe
  2⤵
  PID:3388
- C:\Windows\System\cgawITD.exe
  C:\Windows\System\cgawITD.exe
  2⤵
  PID:3436
- C:\Windows\System\xDbTeWx.exe
  C:\Windows\System\xDbTeWx.exe
  2⤵
  PID:3532
- C:\Windows\System\WTYhsyw.exe
  C:\Windows\System\WTYhsyw.exe
  2⤵
  PID:3788
- C:\Windows\System\llnanSh.exe
  C:\Windows\System\llnanSh.exe
  2⤵
  PID:3668
- C:\Windows\System\PSHYqRz.exe
  C:\Windows\System\PSHYqRz.exe
  2⤵
  PID:3808
- C:\Windows\System\CwxheVZ.exe
  C:\Windows\System\CwxheVZ.exe
  2⤵
  PID:3780
- C:\Windows\System\DWULTjG.exe
  C:\Windows\System\DWULTjG.exe
  2⤵
  PID:3944
- C:\Windows\System\YwVbNLr.exe
  C:\Windows\System\YwVbNLr.exe
  2⤵
  PID:4044
- C:\Windows\System\kPRjpPR.exe
  C:\Windows\System\kPRjpPR.exe
  2⤵
  PID:2300
- C:\Windows\System\lmkaaKV.exe
  C:\Windows\System\lmkaaKV.exe
  2⤵
  PID:3248
- C:\Windows\System\lqwjGnJ.exe
  C:\Windows\System\lqwjGnJ.exe
  2⤵
  PID:2336
- C:\Windows\System\CmuiDcK.exe
  C:\Windows\System\CmuiDcK.exe
  2⤵
  PID:2276
- C:\Windows\System\zbSwqxm.exe
  C:\Windows\System\zbSwqxm.exe
  2⤵
  PID:2764
- C:\Windows\System\OOSVSqQ.exe
  C:\Windows\System\OOSVSqQ.exe
  2⤵
  PID:1580
- C:\Windows\System\ubPjXvq.exe
  C:\Windows\System\ubPjXvq.exe
  2⤵
  PID:3976
- C:\Windows\System\xrQwAGQ.exe
  C:\Windows\System\xrQwAGQ.exe
  2⤵
  PID:3148
- C:\Windows\System\JcBqjeK.exe
  C:\Windows\System\JcBqjeK.exe
  2⤵
  PID:3088
- C:\Windows\System\ygxOrdS.exe
  C:\Windows\System\ygxOrdS.exe
  2⤵
  PID:3416
- C:\Windows\System\wVEHZZA.exe
  C:\Windows\System\wVEHZZA.exe
  2⤵
  PID:3412
- C:\Windows\System\BZfdynJ.exe
  C:\Windows\System\BZfdynJ.exe
  2⤵
  PID:3644
- C:\Windows\System\irMgHgj.exe
  C:\Windows\System\irMgHgj.exe
  2⤵
  PID:3556
- C:\Windows\System\GDNGzSp.exe
  C:\Windows\System\GDNGzSp.exe
  2⤵
  PID:3608
- C:\Windows\System\eOxmHyo.exe
  C:\Windows\System\eOxmHyo.exe
  2⤵
  PID:2268
- C:\Windows\System\BCOGHkM.exe
  C:\Windows\System\BCOGHkM.exe
  2⤵
  PID:1096
- C:\Windows\System\thTVfMw.exe
  C:\Windows\System\thTVfMw.exe
  2⤵
  PID:3744
- C:\Windows\System\cluHCfj.exe
  C:\Windows\System\cluHCfj.exe
  2⤵
  PID:3864
- C:\Windows\System\VSGOmsq.exe
  C:\Windows\System\VSGOmsq.exe
  2⤵
  PID:1552
- C:\Windows\System\diiXwcl.exe
  C:\Windows\System\diiXwcl.exe
  2⤵
  PID:1836
- C:\Windows\System\YTvZPfe.exe
  C:\Windows\System\YTvZPfe.exe
  2⤵
  PID:2648
- C:\Windows\System\fOSBvKj.exe
  C:\Windows\System\fOSBvKj.exe
  2⤵
  PID:3832
- C:\Windows\System\ArfOknU.exe
  C:\Windows\System\ArfOknU.exe
  2⤵
  PID:1276
- C:\Windows\System\xBhiEJo.exe
  C:\Windows\System\xBhiEJo.exe
  2⤵
  PID:3108
- C:\Windows\System\HuVLkeF.exe
  C:\Windows\System\HuVLkeF.exe
  2⤵
  PID:3596
- C:\Windows\System\VDzNYxj.exe
  C:\Windows\System\VDzNYxj.exe
  2⤵
  PID:3084
- C:\Windows\System\yJAADol.exe
  C:\Windows\System\yJAADol.exe
  2⤵
  PID:3232
- C:\Windows\System\zBrOOIL.exe
  C:\Windows\System\zBrOOIL.exe
  2⤵
  PID:3604
- C:\Windows\System\uodPqNV.exe
  C:\Windows\System\uodPqNV.exe
  2⤵
  PID:3428
- C:\Windows\System\rYIvGDz.exe
  C:\Windows\System\rYIvGDz.exe
  2⤵
  PID:1376
- C:\Windows\System\wbJeozQ.exe
  C:\Windows\System\wbJeozQ.exe
  2⤵
  PID:2524
- C:\Windows\System\VHacBOu.exe
  C:\Windows\System\VHacBOu.exe
  2⤵
  PID:3204
- C:\Windows\System\HlwuhvJ.exe
  C:\Windows\System\HlwuhvJ.exe
  2⤵
  PID:3396
- C:\Windows\System\qQUaABk.exe
  C:\Windows\System\qQUaABk.exe
  2⤵
  PID:3904
- C:\Windows\System\bbNIOcS.exe
  C:\Windows\System\bbNIOcS.exe
  2⤵
  PID:3496
- C:\Windows\System\VIIpDaw.exe
  C:\Windows\System\VIIpDaw.exe
  2⤵
  PID:3936
- C:\Windows\System\bdwlSFP.exe
  C:\Windows\System\bdwlSFP.exe
  2⤵
  PID:588
- C:\Windows\System\QImmtNn.exe
  C:\Windows\System\QImmtNn.exe
  2⤵
  PID:3628
- C:\Windows\System\zYXNdQN.exe
  C:\Windows\System\zYXNdQN.exe
  2⤵
  PID:464
- C:\Windows\System\Ldjtooi.exe
  C:\Windows\System\Ldjtooi.exe
  2⤵
  PID:1200
- C:\Windows\System\DVJVTLI.exe
  C:\Windows\System\DVJVTLI.exe
  2⤵
  PID:2024
- C:\Windows\System\oUBpzyD.exe
  C:\Windows\System\oUBpzyD.exe
  2⤵
  PID:2716
- C:\Windows\System\TPPXMUi.exe
  C:\Windows\System\TPPXMUi.exe
  2⤵
  PID:4056
- C:\Windows\System\EILRDUW.exe
  C:\Windows\System\EILRDUW.exe
  2⤵
  PID:3908
- C:\Windows\System\PfxtYgn.exe
  C:\Windows\System\PfxtYgn.exe
  2⤵
  PID:1216
- C:\Windows\System\EgQRydg.exe
  C:\Windows\System\EgQRydg.exe
  2⤵
  PID:3836
- C:\Windows\System\LnPbVvS.exe
  C:\Windows\System\LnPbVvS.exe
  2⤵
  PID:2376
- C:\Windows\System\DTkxMSL.exe
  C:\Windows\System\DTkxMSL.exe
  2⤵
  PID:2320
- C:\Windows\System\MgcSchd.exe
  C:\Windows\System\MgcSchd.exe
  2⤵
  PID:3432
- C:\Windows\System\RbVgWap.exe
  C:\Windows\System\RbVgWap.exe
  2⤵
  PID:4012
- C:\Windows\System\hUyoZTZ.exe
  C:\Windows\System\hUyoZTZ.exe
  2⤵
  PID:4120
- C:\Windows\System\TPrDqlt.exe
  C:\Windows\System\TPrDqlt.exe
  2⤵
  PID:4136
- C:\Windows\System\yYqhCCM.exe
  C:\Windows\System\yYqhCCM.exe
  2⤵
  PID:4160
- C:\Windows\System\HxRXzOc.exe
  C:\Windows\System\HxRXzOc.exe
  2⤵
  PID:4180
- C:\Windows\System\OkzDFxt.exe
  C:\Windows\System\OkzDFxt.exe
  2⤵
  PID:4196
- C:\Windows\System\sgZoeIa.exe
  C:\Windows\System\sgZoeIa.exe
  2⤵
  PID:4212
- C:\Windows\System\aCXTliV.exe
  C:\Windows\System\aCXTliV.exe
  2⤵
  PID:4228
- C:\Windows\System\dJxjWlW.exe
  C:\Windows\System\dJxjWlW.exe
  2⤵
  PID:4248
- C:\Windows\System\uXRfEbd.exe
  C:\Windows\System\uXRfEbd.exe
  2⤵
  PID:4268
- C:\Windows\System\RbIPLdV.exe
  C:\Windows\System\RbIPLdV.exe
  2⤵
  PID:4292
- C:\Windows\System\rQNLQhf.exe
  C:\Windows\System\rQNLQhf.exe
  2⤵
  PID:4312
- C:\Windows\System\lRXSyxI.exe
  C:\Windows\System\lRXSyxI.exe
  2⤵
  PID:4340
- C:\Windows\System\HgwhKzT.exe
  C:\Windows\System\HgwhKzT.exe
  2⤵
  PID:4360
- C:\Windows\System\IzxOlEn.exe
  C:\Windows\System\IzxOlEn.exe
  2⤵
  PID:4384
- C:\Windows\System\LyzeEXQ.exe
  C:\Windows\System\LyzeEXQ.exe
  2⤵
  PID:4408
- C:\Windows\System\EGhgFjX.exe
  C:\Windows\System\EGhgFjX.exe
  2⤵
  PID:4424
- C:\Windows\System\oWifiYl.exe
  C:\Windows\System\oWifiYl.exe
  2⤵
  PID:4444
- C:\Windows\System\ZdlveEr.exe
  C:\Windows\System\ZdlveEr.exe
  2⤵
  PID:4464
- C:\Windows\System\yyqtNir.exe
  C:\Windows\System\yyqtNir.exe
  2⤵
  PID:4480
- C:\Windows\System\BGarclx.exe
  C:\Windows\System\BGarclx.exe
  2⤵
  PID:4500
- C:\Windows\System\RxCjjqI.exe
  C:\Windows\System\RxCjjqI.exe
  2⤵
  PID:4516
- C:\Windows\System\ZFGoZia.exe
  C:\Windows\System\ZFGoZia.exe
  2⤵
  PID:4536
- C:\Windows\System\IZuGHsz.exe
  C:\Windows\System\IZuGHsz.exe
  2⤵
  PID:4564
- C:\Windows\System\smJBLbs.exe
  C:\Windows\System\smJBLbs.exe
  2⤵
  PID:4588
- C:\Windows\System\bIUgjxG.exe
  C:\Windows\System\bIUgjxG.exe
  2⤵
  PID:4608
- C:\Windows\System\unlBCdp.exe
  C:\Windows\System\unlBCdp.exe
  2⤵
  PID:4624
- C:\Windows\System\CNjDIkS.exe
  C:\Windows\System\CNjDIkS.exe
  2⤵
  PID:4648
- C:\Windows\System\xIzbbHo.exe
  C:\Windows\System\xIzbbHo.exe
  2⤵
  PID:4664
- C:\Windows\System\ojSymWk.exe
  C:\Windows\System\ojSymWk.exe
  2⤵
  PID:4688
- C:\Windows\System\oMhnoIy.exe
  C:\Windows\System\oMhnoIy.exe
  2⤵
  PID:4704
- C:\Windows\System\qAbKOgT.exe
  C:\Windows\System\qAbKOgT.exe
  2⤵
  PID:4724
- C:\Windows\System\mPIqcjx.exe
  C:\Windows\System\mPIqcjx.exe
  2⤵
  PID:4744
- C:\Windows\System\igrvzHU.exe
  C:\Windows\System\igrvzHU.exe
  2⤵
  PID:4768
- C:\Windows\System\CeMQdgk.exe
  C:\Windows\System\CeMQdgk.exe
  2⤵
  PID:4784
- C:\Windows\System\xqYnORz.exe
  C:\Windows\System\xqYnORz.exe
  2⤵
  PID:4800
- C:\Windows\System\piBRrRa.exe
  C:\Windows\System\piBRrRa.exe
  2⤵
  PID:4816
- C:\Windows\System\jzfcHhp.exe
  C:\Windows\System\jzfcHhp.exe
  2⤵
  PID:4832
- C:\Windows\System\dnLtHpE.exe
  C:\Windows\System\dnLtHpE.exe
  2⤵
  PID:4868
- C:\Windows\System\lzJfUIs.exe
  C:\Windows\System\lzJfUIs.exe
  2⤵
  PID:4888
- C:\Windows\System\TiSoytu.exe
  C:\Windows\System\TiSoytu.exe
  2⤵
  PID:4904
- C:\Windows\System\Dyilwqn.exe
  C:\Windows\System\Dyilwqn.exe
  2⤵
  PID:4920
- C:\Windows\System\wUhmnIC.exe
  C:\Windows\System\wUhmnIC.exe
  2⤵
  PID:4936
- C:\Windows\System\oXFazMI.exe
  C:\Windows\System\oXFazMI.exe
  2⤵
  PID:4956
- C:\Windows\System\AjIVuut.exe
  C:\Windows\System\AjIVuut.exe
  2⤵
  PID:4972
- C:\Windows\System\YuqLlUm.exe
  C:\Windows\System\YuqLlUm.exe
  2⤵
  PID:4988
- C:\Windows\System\FRytNfg.exe
  C:\Windows\System\FRytNfg.exe
  2⤵
  PID:5008
- C:\Windows\System\QVjYKpm.exe
  C:\Windows\System\QVjYKpm.exe
  2⤵
  PID:5036
- C:\Windows\System\HLvZfpv.exe
  C:\Windows\System\HLvZfpv.exe
  2⤵
  PID:5064
- C:\Windows\System\MNmEZcS.exe
  C:\Windows\System\MNmEZcS.exe
  2⤵
  PID:5084
- C:\Windows\System\aWbQmRn.exe
  C:\Windows\System\aWbQmRn.exe
  2⤵
  PID:5100
- C:\Windows\System\KLBhiLa.exe
  C:\Windows\System\KLBhiLa.exe
  2⤵
  PID:1908
- C:\Windows\System\rsqfFqa.exe
  C:\Windows\System\rsqfFqa.exe
  2⤵
  PID:4060
- C:\Windows\System\UZGDgDw.exe
  C:\Windows\System\UZGDgDw.exe
  2⤵
  PID:3580
- C:\Windows\System\eVYpYnP.exe
  C:\Windows\System\eVYpYnP.exe
  2⤵
  PID:4116
- C:\Windows\System\FEWWfxH.exe
  C:\Windows\System\FEWWfxH.exe
  2⤵
  PID:1088
- C:\Windows\System\Hqmndfb.exe
  C:\Windows\System\Hqmndfb.exe
  2⤵
  PID:4192
- C:\Windows\System\KDMySxW.exe
  C:\Windows\System\KDMySxW.exe
  2⤵
  PID:4264
- C:\Windows\System\LGfBtwl.exe
  C:\Windows\System\LGfBtwl.exe
  2⤵
  PID:4284
- C:\Windows\System\dXOgfnx.exe
  C:\Windows\System\dXOgfnx.exe
  2⤵
  PID:4236
- C:\Windows\System\VrNGpQB.exe
  C:\Windows\System\VrNGpQB.exe
  2⤵
  PID:4352
- C:\Windows\System\hiLuSQF.exe
  C:\Windows\System\hiLuSQF.exe
  2⤵
  PID:4276
- C:\Windows\System\iAPFiqn.exe
  C:\Windows\System\iAPFiqn.exe
  2⤵
  PID:4404
- C:\Windows\System\qbmvBPT.exe
  C:\Windows\System\qbmvBPT.exe
  2⤵
  PID:4440
- C:\Windows\System\XUKBYtX.exe
  C:\Windows\System\XUKBYtX.exe
  2⤵
  PID:4452
- C:\Windows\System\kJZiNlO.exe
  C:\Windows\System\kJZiNlO.exe
  2⤵
  PID:4548
- C:\Windows\System\bVhCuiJ.exe
  C:\Windows\System\bVhCuiJ.exe
  2⤵
  PID:4524
- C:\Windows\System\DPcBiRG.exe
  C:\Windows\System\DPcBiRG.exe
  2⤵
  PID:4496
- C:\Windows\System\iQJtAes.exe
  C:\Windows\System\iQJtAes.exe
  2⤵
  PID:4604
- C:\Windows\System\YvjeDHk.exe
  C:\Windows\System\YvjeDHk.exe
  2⤵
  PID:4644
- C:\Windows\System\mDCncrG.exe
  C:\Windows\System\mDCncrG.exe
  2⤵
  PID:4672
- C:\Windows\System\DhDTCBt.exe
  C:\Windows\System\DhDTCBt.exe
  2⤵
  PID:4700
- C:\Windows\System\HZmqKbA.exe
  C:\Windows\System\HZmqKbA.exe
  2⤵
  PID:4760
- C:\Windows\System\TMzCflM.exe
  C:\Windows\System\TMzCflM.exe
  2⤵
  PID:4756
- C:\Windows\System\HAnzHPm.exe
  C:\Windows\System\HAnzHPm.exe
  2⤵
  PID:4828
- C:\Windows\System\HVxbsnT.exe
  C:\Windows\System\HVxbsnT.exe
  2⤵
  PID:4812
- C:\Windows\System\UdyQtHz.exe
  C:\Windows\System\UdyQtHz.exe
  2⤵
  PID:4876
- C:\Windows\System\lEbFtvQ.exe
  C:\Windows\System\lEbFtvQ.exe
  2⤵
  PID:4912
- C:\Windows\System\gNGmihi.exe
  C:\Windows\System\gNGmihi.exe
  2⤵
  PID:4980
- C:\Windows\System\BrcPnDo.exe
  C:\Windows\System\BrcPnDo.exe
  2⤵
  PID:5028
- C:\Windows\System\wDYkZLP.exe
  C:\Windows\System\wDYkZLP.exe
  2⤵
  PID:4964
- C:\Windows\System\bfVzhrN.exe
  C:\Windows\System\bfVzhrN.exe
  2⤵
  PID:5080
- C:\Windows\System\JGvYaTG.exe
  C:\Windows\System\JGvYaTG.exe
  2⤵
  PID:5044
- C:\Windows\System\uEjbqcs.exe
  C:\Windows\System\uEjbqcs.exe
  2⤵
  PID:2424
- C:\Windows\System\ROHekPF.exe
  C:\Windows\System\ROHekPF.exe
  2⤵
  PID:4104
- C:\Windows\System\NcYJSIo.exe
  C:\Windows\System\NcYJSIo.exe
  2⤵
  PID:3692
- C:\Windows\System\VXJMUPm.exe
  C:\Windows\System\VXJMUPm.exe
  2⤵
  PID:4156
- C:\Windows\System\dTTInZy.exe
  C:\Windows\System\dTTInZy.exe
  2⤵
  PID:4260
- C:\Windows\System\nlATrNK.exe
  C:\Windows\System\nlATrNK.exe
  2⤵
  PID:4188
- C:\Windows\System\nYGZyLr.exe
  C:\Windows\System\nYGZyLr.exe
  2⤵
  PID:4348
- C:\Windows\System\GfXYCgW.exe
  C:\Windows\System\GfXYCgW.exe
  2⤵
  PID:4400
- C:\Windows\System\ySCCaqQ.exe
  C:\Windows\System\ySCCaqQ.exe
  2⤵
  PID:4508
- C:\Windows\System\kMWUQNd.exe
  C:\Windows\System\kMWUQNd.exe
  2⤵
  PID:4528
- C:\Windows\System\nvXdOtF.exe
  C:\Windows\System\nvXdOtF.exe
  2⤵
  PID:4456
- C:\Windows\System\bRdNrRn.exe
  C:\Windows\System\bRdNrRn.exe
  2⤵
  PID:4576
- C:\Windows\System\pQnmyYQ.exe
  C:\Windows\System\pQnmyYQ.exe
  2⤵
  PID:4680
- C:\Windows\System\jnswmyr.exe
  C:\Windows\System\jnswmyr.exe
  2⤵
  PID:4720
- C:\Windows\System\TekAuAo.exe
  C:\Windows\System\TekAuAo.exe
  2⤵
  PID:4840
- C:\Windows\System\pLlMKVg.exe
  C:\Windows\System\pLlMKVg.exe
  2⤵
  PID:4796
- C:\Windows\System\GJnRipD.exe
  C:\Windows\System\GJnRipD.exe
  2⤵
  PID:4860
- C:\Windows\System\YcqalWU.exe
  C:\Windows\System\YcqalWU.exe
  2⤵
  PID:4932
- C:\Windows\System\AIaYpWc.exe
  C:\Windows\System\AIaYpWc.exe
  2⤵
  PID:4928
- C:\Windows\System\VxHJhTD.exe
  C:\Windows\System\VxHJhTD.exe
  2⤵
  PID:5072
- C:\Windows\System\tpNhuTY.exe
  C:\Windows\System\tpNhuTY.exe
  2⤵
  PID:2436
- C:\Windows\System\KXVOIFH.exe
  C:\Windows\System\KXVOIFH.exe
  2⤵
  PID:5056
- C:\Windows\System\ziRyfBM.exe
  C:\Windows\System\ziRyfBM.exe
  2⤵
  PID:4220
- C:\Windows\System\jluSyZl.exe
  C:\Windows\System\jluSyZl.exe
  2⤵
  PID:4328
- C:\Windows\System\mzDWWcL.exe
  C:\Windows\System\mzDWWcL.exe
  2⤵
  PID:4432
- C:\Windows\System\dFtTwjT.exe
  C:\Windows\System\dFtTwjT.exe
  2⤵
  PID:4332
- C:\Windows\System\LDPCLmS.exe
  C:\Windows\System\LDPCLmS.exe
  2⤵
  PID:4556
- C:\Windows\System\NoQPYms.exe
  C:\Windows\System\NoQPYms.exe
  2⤵
  PID:4740
- C:\Windows\System\CXehPfV.exe
  C:\Windows\System\CXehPfV.exe
  2⤵
  PID:4600
- C:\Windows\System\qzSHqtr.exe
  C:\Windows\System\qzSHqtr.exe
  2⤵
  PID:4864
- C:\Windows\System\OvbhuNZ.exe
  C:\Windows\System\OvbhuNZ.exe
  2⤵
  PID:5016
- C:\Windows\System\iuwquQy.exe
  C:\Windows\System\iuwquQy.exe
  2⤵
  PID:5060
- C:\Windows\System\GJidoCE.exe
  C:\Windows\System\GJidoCE.exe
  2⤵
  PID:5108
- C:\Windows\System\DsUkOgj.exe
  C:\Windows\System\DsUkOgj.exe
  2⤵
  PID:4152
- C:\Windows\System\YyQHsSY.exe
  C:\Windows\System\YyQHsSY.exe
  2⤵
  PID:4244
- C:\Windows\System\YImWGzL.exe
  C:\Windows\System\YImWGzL.exe
  2⤵
  PID:4336
- C:\Windows\System\uFLOPuS.exe
  C:\Windows\System\uFLOPuS.exe
  2⤵
  PID:4476
- C:\Windows\System\UajUonY.exe
  C:\Windows\System\UajUonY.exe
  2⤵
  PID:4852
- C:\Windows\System\RaaBDgp.exe
  C:\Windows\System\RaaBDgp.exe
  2⤵
  PID:4996
- C:\Windows\System\gfCvLcA.exe
  C:\Windows\System\gfCvLcA.exe
  2⤵
  PID:4944
- C:\Windows\System\EqgjVTz.exe
  C:\Windows\System\EqgjVTz.exe
  2⤵
  PID:4132
- C:\Windows\System\vZDgtVS.exe
  C:\Windows\System\vZDgtVS.exe
  2⤵
  PID:4584
- C:\Windows\System\NmtQwdJ.exe
  C:\Windows\System\NmtQwdJ.exe
  2⤵
  PID:4684
- C:\Windows\System\lGQhjgV.exe
  C:\Windows\System\lGQhjgV.exe
  2⤵
  PID:4948
- C:\Windows\System\vUmOThK.exe
  C:\Windows\System\vUmOThK.exe
  2⤵
  PID:5048
- C:\Windows\System\PbBgXcW.exe
  C:\Windows\System\PbBgXcW.exe
  2⤵
  PID:4324
- C:\Windows\System\vFMTHhm.exe
  C:\Windows\System\vFMTHhm.exe
  2⤵
  PID:5000
- C:\Windows\System\hRBvDNN.exe
  C:\Windows\System\hRBvDNN.exe
  2⤵
  PID:4880
- C:\Windows\System\fqDezqw.exe
  C:\Windows\System\fqDezqw.exe
  2⤵
  PID:4560
- C:\Windows\System\AeawvQM.exe
  C:\Windows\System\AeawvQM.exe
  2⤵
  PID:5136
- C:\Windows\System\MXFnCIf.exe
  C:\Windows\System\MXFnCIf.exe
  2⤵
  PID:5152
- C:\Windows\System\dbdvpUh.exe
  C:\Windows\System\dbdvpUh.exe
  2⤵
  PID:5168
- C:\Windows\System\mrLPTTO.exe
  C:\Windows\System\mrLPTTO.exe
  2⤵
  PID:5192
- C:\Windows\System\vGbfDpD.exe
  C:\Windows\System\vGbfDpD.exe
  2⤵
  PID:5216
- C:\Windows\System\TYuCPaX.exe
  C:\Windows\System\TYuCPaX.exe
  2⤵
  PID:5232
- C:\Windows\System\UiCCrRg.exe
  C:\Windows\System\UiCCrRg.exe
  2⤵
  PID:5256
- C:\Windows\System\DHVAaCN.exe
  C:\Windows\System\DHVAaCN.exe
  2⤵
  PID:5272
- C:\Windows\System\khKnujA.exe
  C:\Windows\System\khKnujA.exe
  2⤵
  PID:5288
- C:\Windows\System\BKpQNei.exe
  C:\Windows\System\BKpQNei.exe
  2⤵
  PID:5308
- C:\Windows\System\Qssaidw.exe
  C:\Windows\System\Qssaidw.exe
  2⤵
  PID:5344
- C:\Windows\System\splPGCd.exe
  C:\Windows\System\splPGCd.exe
  2⤵
  PID:5360
- C:\Windows\System\KveTgbr.exe
  C:\Windows\System\KveTgbr.exe
  2⤵
  PID:5384
- C:\Windows\System\bqpcdPY.exe
  C:\Windows\System\bqpcdPY.exe
  2⤵
  PID:5412
- C:\Windows\System\kFMSCiq.exe
  C:\Windows\System\kFMSCiq.exe
  2⤵
  PID:5428
- C:\Windows\System\euuWFQb.exe
  C:\Windows\System\euuWFQb.exe
  2⤵
  PID:5444
- C:\Windows\System\BNmdvao.exe
  C:\Windows\System\BNmdvao.exe
  2⤵
  PID:5464
- C:\Windows\System\cAFzqHx.exe
  C:\Windows\System\cAFzqHx.exe
  2⤵
  PID:5480
- C:\Windows\System\iQGlxSm.exe
  C:\Windows\System\iQGlxSm.exe
  2⤵
  PID:5496
- C:\Windows\System\obbJHPK.exe
  C:\Windows\System\obbJHPK.exe
  2⤵
  PID:5516
- C:\Windows\System\lOuLXvW.exe
  C:\Windows\System\lOuLXvW.exe
  2⤵
  PID:5532
- C:\Windows\System\CjkDgbP.exe
  C:\Windows\System\CjkDgbP.exe
  2⤵
  PID:5572
- C:\Windows\System\gAvmaGk.exe
  C:\Windows\System\gAvmaGk.exe
  2⤵
  PID:5592
- C:\Windows\System\ibfhLqV.exe
  C:\Windows\System\ibfhLqV.exe
  2⤵
  PID:5612
- C:\Windows\System\csfRPtN.exe
  C:\Windows\System\csfRPtN.exe
  2⤵
  PID:5628
- C:\Windows\System\YoTCxYo.exe
  C:\Windows\System\YoTCxYo.exe
  2⤵
  PID:5652
- C:\Windows\System\SenoJQj.exe
  C:\Windows\System\SenoJQj.exe
  2⤵
  PID:5672
- C:\Windows\System\qddBNXZ.exe
  C:\Windows\System\qddBNXZ.exe
  2⤵
  PID:5688
- C:\Windows\System\mRHtRpL.exe
  C:\Windows\System\mRHtRpL.exe
  2⤵
  PID:5708
- C:\Windows\System\tsOjXTQ.exe
  C:\Windows\System\tsOjXTQ.exe
  2⤵
  PID:5732
- C:\Windows\System\GmpjPwl.exe
  C:\Windows\System\GmpjPwl.exe
  2⤵
  PID:5748
- C:\Windows\System\zAOwNmK.exe
  C:\Windows\System\zAOwNmK.exe
  2⤵
  PID:5768
- C:\Windows\System\jecwVoV.exe
  C:\Windows\System\jecwVoV.exe
  2⤵
  PID:5796
- C:\Windows\System\QHQjcMI.exe
  C:\Windows\System\QHQjcMI.exe
  2⤵
  PID:5812
- C:\Windows\System\dKkJRWq.exe
  C:\Windows\System\dKkJRWq.exe
  2⤵
  PID:5832
- C:\Windows\System\iasOrhd.exe
  C:\Windows\System\iasOrhd.exe
  2⤵
  PID:5848
- C:\Windows\System\vlvrCZd.exe
  C:\Windows\System\vlvrCZd.exe
  2⤵
  PID:5868
- C:\Windows\System\YKskNuk.exe
  C:\Windows\System\YKskNuk.exe
  2⤵
  PID:5896
- C:\Windows\System\YkCsktm.exe
  C:\Windows\System\YkCsktm.exe
  2⤵
  PID:5912
- C:\Windows\System\wJuHYCZ.exe
  C:\Windows\System\wJuHYCZ.exe
  2⤵
  PID:5932
- C:\Windows\System\PHMaINZ.exe
  C:\Windows\System\PHMaINZ.exe
  2⤵
  PID:5952
- C:\Windows\System\AuLUgbL.exe
  C:\Windows\System\AuLUgbL.exe
  2⤵
  PID:5968
- C:\Windows\System\RarWViQ.exe
  C:\Windows\System\RarWViQ.exe
  2⤵
  PID:5992
- C:\Windows\System\DWwkFkM.exe
  C:\Windows\System\DWwkFkM.exe
  2⤵
  PID:6008
- C:\Windows\System\ECsTexs.exe
  C:\Windows\System\ECsTexs.exe
  2⤵
  PID:6028
- C:\Windows\System\ndmGmIA.exe
  C:\Windows\System\ndmGmIA.exe
  2⤵
  PID:6048
- C:\Windows\System\gDNCSPT.exe
  C:\Windows\System\gDNCSPT.exe
  2⤵
  PID:6064
- C:\Windows\System\KOdSobx.exe
  C:\Windows\System\KOdSobx.exe
  2⤵
  PID:6092
- C:\Windows\System\CnjxqMQ.exe
  C:\Windows\System\CnjxqMQ.exe
  2⤵
  PID:6112
- C:\Windows\System\mSxRUgl.exe
  C:\Windows\System\mSxRUgl.exe
  2⤵
  PID:6128
- C:\Windows\System\CTlvOgT.exe
  C:\Windows\System\CTlvOgT.exe
  2⤵
  PID:4148
- C:\Windows\System\wkiIzHW.exe
  C:\Windows\System\wkiIzHW.exe
  2⤵
  PID:5296
- C:\Windows\System\HIOPCSX.exe
  C:\Windows\System\HIOPCSX.exe
  2⤵
  PID:5164
- C:\Windows\System\xJFqCcb.exe
  C:\Windows\System\xJFqCcb.exe
  2⤵
  PID:5284
- C:\Windows\System\SBjQtkB.exe
  C:\Windows\System\SBjQtkB.exe
  2⤵
  PID:5208
- C:\Windows\System\ahTbpyX.exe
  C:\Windows\System\ahTbpyX.exe
  2⤵
  PID:5392
- C:\Windows\System\QTOurgG.exe
  C:\Windows\System\QTOurgG.exe
  2⤵
  PID:5356
- C:\Windows\System\QYPhtSG.exe
  C:\Windows\System\QYPhtSG.exe
  2⤵
  PID:5340
- C:\Windows\System\ISietMP.exe
  C:\Windows\System\ISietMP.exe
  2⤵
  PID:5440
- C:\Windows\System\xLqkAyR.exe
  C:\Windows\System\xLqkAyR.exe
  2⤵
  PID:5544
- C:\Windows\System\pMgypbD.exe
  C:\Windows\System\pMgypbD.exe
  2⤵
  PID:5460
- C:\Windows\System\LQVyzuN.exe
  C:\Windows\System\LQVyzuN.exe
  2⤵
  PID:5528
- C:\Windows\System\uvZTEFD.exe
  C:\Windows\System\uvZTEFD.exe
  2⤵
  PID:5452
- C:\Windows\System\ssbbjwJ.exe
  C:\Windows\System\ssbbjwJ.exe
  2⤵
  PID:5600
- C:\Windows\System\Lcwksru.exe
  C:\Windows\System\Lcwksru.exe
  2⤵
  PID:5636
- C:\Windows\System\PFvfRds.exe
  C:\Windows\System\PFvfRds.exe
  2⤵
  PID:5664
- C:\Windows\System\fawHMyT.exe
  C:\Windows\System\fawHMyT.exe
  2⤵
  PID:5716
- C:\Windows\System\fqJhItT.exe
  C:\Windows\System\fqJhItT.exe
  2⤵
  PID:5724
- C:\Windows\System\idazrWA.exe
  C:\Windows\System\idazrWA.exe
  2⤵
  PID:5760
- C:\Windows\System\woHKFMk.exe
  C:\Windows\System\woHKFMk.exe
  2⤵
  PID:5792
- C:\Windows\System\WxPMbjP.exe
  C:\Windows\System\WxPMbjP.exe
  2⤵
  PID:5840
- C:\Windows\System\ETOpbii.exe
  C:\Windows\System\ETOpbii.exe
  2⤵
  PID:5856
- C:\Windows\System\rxLCJsB.exe
  C:\Windows\System\rxLCJsB.exe
  2⤵
  PID:5892
- C:\Windows\System\fNTlMcV.exe
  C:\Windows\System\fNTlMcV.exe
  2⤵
  PID:5908
- C:\Windows\System\cFPDMaV.exe
  C:\Windows\System\cFPDMaV.exe
  2⤵
  PID:5940
- C:\Windows\System\aZxGCtH.exe
  C:\Windows\System\aZxGCtH.exe
  2⤵
  PID:6036
- C:\Windows\System\boUJMzF.exe
  C:\Windows\System\boUJMzF.exe
  2⤵
  PID:5976
- C:\Windows\System\qOaCcBd.exe
  C:\Windows\System\qOaCcBd.exe
  2⤵
  PID:6020
- C:\Windows\System\BlYoyMT.exe
  C:\Windows\System\BlYoyMT.exe
  2⤵
  PID:6088
- C:\Windows\System\qrNVKOq.exe
  C:\Windows\System\qrNVKOq.exe
  2⤵
  PID:6056
- C:\Windows\System\cAFdHPD.exe
  C:\Windows\System\cAFdHPD.exe
  2⤵
  PID:6136
- C:\Windows\System\dziHiFu.exe
  C:\Windows\System\dziHiFu.exe
  2⤵
  PID:6104
- C:\Windows\System\OJvXUyF.exe
  C:\Windows\System\OJvXUyF.exe
  2⤵
  PID:5180
- C:\Windows\System\ZMDtEXf.exe
  C:\Windows\System\ZMDtEXf.exe
  2⤵
  PID:5124
- C:\Windows\System\FMPmEsX.exe
  C:\Windows\System\FMPmEsX.exe
  2⤵
  PID:5332
- C:\Windows\System\WRcJMUD.exe
  C:\Windows\System\WRcJMUD.exe
  2⤵
  PID:5540
- C:\Windows\System\vTrWKUE.exe
  C:\Windows\System\vTrWKUE.exe
  2⤵
  PID:5376
- C:\Windows\System\WDdVevd.exe
  C:\Windows\System\WDdVevd.exe
  2⤵
  PID:5556
- C:\Windows\System\vQAUJLh.exe
  C:\Windows\System\vQAUJLh.exe
  2⤵
  PID:5424
- C:\Windows\System\YbHWhLo.exe
  C:\Windows\System\YbHWhLo.exe
  2⤵
  PID:5588
- C:\Windows\System\tHBbIYW.exe
  C:\Windows\System\tHBbIYW.exe
  2⤵
  PID:5640
- C:\Windows\System\OpSTYGX.exe
  C:\Windows\System\OpSTYGX.exe
  2⤵
  PID:5764
- C:\Windows\System\HUhEjjd.exe
  C:\Windows\System\HUhEjjd.exe
  2⤵
  PID:5964
- C:\Windows\System\mhupCzC.exe
  C:\Windows\System\mhupCzC.exe
  2⤵
  PID:6004
- C:\Windows\System\lSQkwcT.exe
  C:\Windows\System\lSQkwcT.exe
  2⤵
  PID:6120
- C:\Windows\System\QezPiBg.exe
  C:\Windows\System\QezPiBg.exe
  2⤵
  PID:5184
- C:\Windows\System\GIuiTYJ.exe
  C:\Windows\System\GIuiTYJ.exe
  2⤵
  PID:5508
- C:\Windows\System\xEdUjQl.exe
  C:\Windows\System\xEdUjQl.exe
  2⤵
  PID:5808
- C:\Windows\System\GPdOjrI.exe
  C:\Windows\System\GPdOjrI.exe
  2⤵
  PID:5524
- C:\Windows\System\mLKtoPo.exe
  C:\Windows\System\mLKtoPo.exe
  2⤵
  PID:5876
- C:\Windows\System\nxUCBkE.exe
  C:\Windows\System\nxUCBkE.exe
  2⤵
  PID:6080
- C:\Windows\System\AZtndtA.exe
  C:\Windows\System\AZtndtA.exe
  2⤵
  PID:5268
- C:\Windows\System\YVNBeAs.exe
  C:\Windows\System\YVNBeAs.exe
  2⤵
  PID:5436
- C:\Windows\System\ykSALSq.exe
  C:\Windows\System\ykSALSq.exe
  2⤵
  PID:5244
- C:\Windows\System\NMIVelN.exe
  C:\Windows\System\NMIVelN.exe
  2⤵
  PID:6016
- C:\Windows\System\zeCtyrx.exe
  C:\Windows\System\zeCtyrx.exe
  2⤵
  PID:3972
- C:\Windows\System\SLKpMIX.exe
  C:\Windows\System\SLKpMIX.exe
  2⤵
  PID:5820
- C:\Windows\System\ejmGOZp.exe
  C:\Windows\System\ejmGOZp.exe
  2⤵
  PID:6000
- C:\Windows\System\vVKSCUy.exe
  C:\Windows\System\vVKSCUy.exe
  2⤵
  PID:5864
- C:\Windows\System\AOaELdJ.exe
  C:\Windows\System\AOaELdJ.exe
  2⤵
  PID:5504
- C:\Windows\System\TWtxSJc.exe
  C:\Windows\System\TWtxSJc.exe
  2⤵
  PID:5188
- C:\Windows\System\OoJMvhN.exe
  C:\Windows\System\OoJMvhN.exe
  2⤵
  PID:5492
- C:\Windows\System\aizIrqs.exe
  C:\Windows\System\aizIrqs.exe
  2⤵
  PID:5252
- C:\Windows\System\qnhjoJM.exe
  C:\Windows\System\qnhjoJM.exe
  2⤵
  PID:5880
- C:\Windows\System\RClxkQd.exe
  C:\Windows\System\RClxkQd.exe
  2⤵
  PID:3160
- C:\Windows\System\IMNdogM.exe
  C:\Windows\System\IMNdogM.exe
  2⤵
  PID:5660
- C:\Windows\System\cfZtEBO.exe
  C:\Windows\System\cfZtEBO.exe
  2⤵
  PID:6148
- C:\Windows\System\RXpiPyY.exe
  C:\Windows\System\RXpiPyY.exe
  2⤵
  PID:6164
- C:\Windows\System\XlEHAsz.exe
  C:\Windows\System\XlEHAsz.exe
  2⤵
  PID:6184
- C:\Windows\System\sfHIXmL.exe
  C:\Windows\System\sfHIXmL.exe
  2⤵
  PID:6200
- C:\Windows\System\OIGsYRl.exe
  C:\Windows\System\OIGsYRl.exe
  2⤵
  PID:6224
- C:\Windows\System\hsfAXTw.exe
  C:\Windows\System\hsfAXTw.exe
  2⤵
  PID:6240
- C:\Windows\System\nDtrlFr.exe
  C:\Windows\System\nDtrlFr.exe
  2⤵
  PID:6256
- C:\Windows\System\FHVJiDO.exe
  C:\Windows\System\FHVJiDO.exe
  2⤵
  PID:6304
- C:\Windows\System\laarkhp.exe
  C:\Windows\System\laarkhp.exe
  2⤵
  PID:6320
- C:\Windows\System\GrgxJdn.exe
  C:\Windows\System\GrgxJdn.exe
  2⤵
  PID:6344
- C:\Windows\System\IKDthEy.exe
  C:\Windows\System\IKDthEy.exe
  2⤵
  PID:6364
- C:\Windows\System\iCoxpoJ.exe
  C:\Windows\System\iCoxpoJ.exe
  2⤵
  PID:6380
- C:\Windows\System\SKvdzws.exe
  C:\Windows\System\SKvdzws.exe
  2⤵
  PID:6408
- C:\Windows\System\TVcOkOh.exe
  C:\Windows\System\TVcOkOh.exe
  2⤵
  PID:6424
- C:\Windows\System\mRANBtU.exe
  C:\Windows\System\mRANBtU.exe
  2⤵
  PID:6444
- C:\Windows\System\iifyWyG.exe
  C:\Windows\System\iifyWyG.exe
  2⤵
  PID:6460
- C:\Windows\System\CqxSovZ.exe
  C:\Windows\System\CqxSovZ.exe
  2⤵
  PID:6476
- C:\Windows\System\Nbkvavp.exe
  C:\Windows\System\Nbkvavp.exe
  2⤵
  PID:6496
- C:\Windows\System\SmsEcAY.exe
  C:\Windows\System\SmsEcAY.exe
  2⤵
  PID:6512
- C:\Windows\System\gPNudtv.exe
  C:\Windows\System\gPNudtv.exe
  2⤵
  PID:6548
- C:\Windows\System\vBJFrLJ.exe
  C:\Windows\System\vBJFrLJ.exe
  2⤵
  PID:6564
- C:\Windows\System\LObFkPG.exe
  C:\Windows\System\LObFkPG.exe
  2⤵
  PID:6588
- C:\Windows\System\JfMgwtS.exe
  C:\Windows\System\JfMgwtS.exe
  2⤵
  PID:6604
- C:\Windows\System\iLbvtsy.exe
  C:\Windows\System\iLbvtsy.exe
  2⤵
  PID:6620
- C:\Windows\System\JatNEyo.exe
  C:\Windows\System\JatNEyo.exe
  2⤵
  PID:6640
- C:\Windows\System\qdRwgoy.exe
  C:\Windows\System\qdRwgoy.exe
  2⤵
  PID:6664
- C:\Windows\System\cOMsiye.exe
  C:\Windows\System\cOMsiye.exe
  2⤵
  PID:6684
- C:\Windows\System\Kghtyxb.exe
  C:\Windows\System\Kghtyxb.exe
  2⤵
  PID:6700
- C:\Windows\System\kTKKORs.exe
  C:\Windows\System\kTKKORs.exe
  2⤵
  PID:6716
- C:\Windows\System\JniJmqZ.exe
  C:\Windows\System\JniJmqZ.exe
  2⤵
  PID:6740
- C:\Windows\System\TWCVyMT.exe
  C:\Windows\System\TWCVyMT.exe
  2⤵
  PID:6756
- C:\Windows\System\JbRAEgt.exe
  C:\Windows\System\JbRAEgt.exe
  2⤵
  PID:6776
- C:\Windows\System\jIQjMNs.exe
  C:\Windows\System\jIQjMNs.exe
  2⤵
  PID:6808
- C:\Windows\System\CHNonjO.exe
  C:\Windows\System\CHNonjO.exe
  2⤵
  PID:6828
- C:\Windows\System\JYBQKVA.exe
  C:\Windows\System\JYBQKVA.exe
  2⤵
  PID:6844
- C:\Windows\System\HcvGLqd.exe
  C:\Windows\System\HcvGLqd.exe
  2⤵
  PID:6860
- C:\Windows\System\vTybxOb.exe
  C:\Windows\System\vTybxOb.exe
  2⤵
  PID:6880
- C:\Windows\System\KLlAkBd.exe
  C:\Windows\System\KLlAkBd.exe
  2⤵
  PID:6904
- C:\Windows\System\lXZmJbo.exe
  C:\Windows\System\lXZmJbo.exe
  2⤵
  PID:6920
- C:\Windows\System\nynXstv.exe
  C:\Windows\System\nynXstv.exe
  2⤵
  PID:6940
- C:\Windows\System\CdPKmhH.exe
  C:\Windows\System\CdPKmhH.exe
  2⤵
  PID:6968
- C:\Windows\System\kavdbVk.exe
  C:\Windows\System\kavdbVk.exe
  2⤵
  PID:6988
- C:\Windows\System\vIiTNnb.exe
  C:\Windows\System\vIiTNnb.exe
  2⤵
  PID:7008
- C:\Windows\System\BARcFyi.exe
  C:\Windows\System\BARcFyi.exe
  2⤵
  PID:7024
- C:\Windows\System\RmGFvaA.exe
  C:\Windows\System\RmGFvaA.exe
  2⤵
  PID:7040
- C:\Windows\System\NTaJuFz.exe
  C:\Windows\System\NTaJuFz.exe
  2⤵
  PID:7060
- C:\Windows\System\HfozXZV.exe
  C:\Windows\System\HfozXZV.exe
  2⤵
  PID:7092
- C:\Windows\System\EHHDBgP.exe
  C:\Windows\System\EHHDBgP.exe
  2⤵
  PID:7112
- C:\Windows\System\QGMcjXg.exe
  C:\Windows\System\QGMcjXg.exe
  2⤵
  PID:7128
- C:\Windows\System\REEiCBu.exe
  C:\Windows\System\REEiCBu.exe
  2⤵
  PID:7144
- C:\Windows\System\tnAcYHL.exe
  C:\Windows\System\tnAcYHL.exe
  2⤵
  PID:7160
- C:\Windows\System\hCjGgHW.exe
  C:\Windows\System\hCjGgHW.exe
  2⤵
  PID:5580
- C:\Windows\System\OqQiCfw.exe
  C:\Windows\System\OqQiCfw.exe
  2⤵
  PID:6160
- C:\Windows\System\FgMMwPQ.exe
  C:\Windows\System\FgMMwPQ.exe
  2⤵
  PID:5280
- C:\Windows\System\OwXxlsp.exe
  C:\Windows\System\OwXxlsp.exe
  2⤵
  PID:6276
- C:\Windows\System\vpCnYiD.exe
  C:\Windows\System\vpCnYiD.exe
  2⤵
  PID:6288
- C:\Windows\System\RvWjePK.exe
  C:\Windows\System\RvWjePK.exe
  2⤵
  PID:6208
- C:\Windows\System\KDvfXjW.exe
  C:\Windows\System\KDvfXjW.exe
  2⤵
  PID:5488
- C:\Windows\System\VWguenH.exe
  C:\Windows\System\VWguenH.exe
  2⤵
  PID:6176
- C:\Windows\System\agGmzJs.exe
  C:\Windows\System\agGmzJs.exe
  2⤵
  PID:6248
- C:\Windows\System\WkInblD.exe
  C:\Windows\System\WkInblD.exe
  2⤵
  PID:6328
- C:\Windows\System\wScCsXT.exe
  C:\Windows\System\wScCsXT.exe
  2⤵
  PID:6316
- C:\Windows\System\IhaghNv.exe
  C:\Windows\System\IhaghNv.exe
  2⤵
  PID:6376
- C:\Windows\System\vaDdEwX.exe
  C:\Windows\System\vaDdEwX.exe
  2⤵
  PID:6400
- C:\Windows\System\HUbWHcy.exe
  C:\Windows\System\HUbWHcy.exe
  2⤵
  PID:6520
- C:\Windows\System\QhOUTaU.exe
  C:\Windows\System\QhOUTaU.exe
  2⤵
  PID:6532
- C:\Windows\System\iuFRSTn.exe
  C:\Windows\System\iuFRSTn.exe
  2⤵
  PID:6508
- C:\Windows\System\fhxdLHa.exe
  C:\Windows\System\fhxdLHa.exe
  2⤵
  PID:6556
- C:\Windows\System\sZfnrHv.exe
  C:\Windows\System\sZfnrHv.exe
  2⤵
  PID:6580
- C:\Windows\System\HVbmVTI.exe
  C:\Windows\System\HVbmVTI.exe
  2⤵
  PID:6560
- C:\Windows\System\jjVJcIz.exe
  C:\Windows\System\jjVJcIz.exe
  2⤵
  PID:6652
- C:\Windows\System\otbgrDF.exe
  C:\Windows\System\otbgrDF.exe
  2⤵
  PID:6676
- C:\Windows\System\LKzejfT.exe
  C:\Windows\System\LKzejfT.exe
  2⤵
  PID:6748
- C:\Windows\System\murNVKJ.exe
  C:\Windows\System\murNVKJ.exe
  2⤵
  PID:6696
- C:\Windows\System\ZjFeLbm.exe
  C:\Windows\System\ZjFeLbm.exe
  2⤵
  PID:6764
- C:\Windows\System\HEvXdKE.exe
  C:\Windows\System\HEvXdKE.exe
  2⤵
  PID:6892
- C:\Windows\System\JIAWcrp.exe
  C:\Windows\System\JIAWcrp.exe
  2⤵
  PID:6872
- C:\Windows\System\Kmgszmg.exe
  C:\Windows\System\Kmgszmg.exe
  2⤵
  PID:6800
- C:\Windows\System\wHWuwfB.exe
  C:\Windows\System\wHWuwfB.exe
  2⤵
  PID:6868
- C:\Windows\System\vRbhTsC.exe
  C:\Windows\System\vRbhTsC.exe
  2⤵
  PID:6956
- C:\Windows\System\hIyPIHA.exe
  C:\Windows\System\hIyPIHA.exe
  2⤵
  PID:7016
- C:\Windows\System\BejVVkx.exe
  C:\Windows\System\BejVVkx.exe
  2⤵
  PID:7052
- C:\Windows\System\dVsGgNR.exe
  C:\Windows\System\dVsGgNR.exe
  2⤵
  PID:7088
- C:\Windows\System\xjBRZZW.exe
  C:\Windows\System\xjBRZZW.exe
  2⤵
  PID:7084
- C:\Windows\System\vwpuCYA.exe
  C:\Windows\System\vwpuCYA.exe
  2⤵
  PID:7136
- C:\Windows\System\lZfbMFX.exe
  C:\Windows\System\lZfbMFX.exe
  2⤵
  PID:7140
- C:\Windows\System\JYRHyxN.exe
  C:\Windows\System\JYRHyxN.exe
  2⤵
  PID:6156
- C:\Windows\System\ceVnpeP.exe
  C:\Windows\System\ceVnpeP.exe
  2⤵
  PID:6192
- C:\Windows\System\OPBIXdg.exe
  C:\Windows\System\OPBIXdg.exe
  2⤵
  PID:5176
- C:\Windows\System\VXYvnhf.exe
  C:\Windows\System\VXYvnhf.exe
  2⤵
  PID:5352
- C:\Windows\System\NqGDWEt.exe
  C:\Windows\System\NqGDWEt.exe
  2⤵
  PID:6172
- C:\Windows\System\zVjKLaw.exe
  C:\Windows\System\zVjKLaw.exe
  2⤵
  PID:6332
- C:\Windows\System\kZXDvNB.exe
  C:\Windows\System\kZXDvNB.exe
  2⤵
  PID:6352
- C:\Windows\System\GkYqafx.exe
  C:\Windows\System\GkYqafx.exe
  2⤵
  PID:6420
- C:\Windows\System\seugOcd.exe
  C:\Windows\System\seugOcd.exe
  2⤵
  PID:6488
- C:\Windows\System\iUjNMUJ.exe
  C:\Windows\System\iUjNMUJ.exe
  2⤵
  PID:6472
- C:\Windows\System\guXndRD.exe
  C:\Windows\System\guXndRD.exe
  2⤵
  PID:6656
- C:\Windows\System\ldfQXkz.exe
  C:\Windows\System\ldfQXkz.exe
  2⤵
  PID:6728
- C:\Windows\System\GOvqzWq.exe
  C:\Windows\System\GOvqzWq.exe
  2⤵
  PID:6692
- C:\Windows\System\jnjAaGD.exe
  C:\Windows\System\jnjAaGD.exe
  2⤵
  PID:6852
- C:\Windows\System\naqeDrJ.exe
  C:\Windows\System\naqeDrJ.exe
  2⤵
  PID:6724
- C:\Windows\System\tdiecTu.exe
  C:\Windows\System\tdiecTu.exe
  2⤵
  PID:6936
- C:\Windows\System\IrGPhmx.exe
  C:\Windows\System\IrGPhmx.exe
  2⤵
  PID:6916
- C:\Windows\System\XECVgDA.exe
  C:\Windows\System\XECVgDA.exe
  2⤵
  PID:6976
- C:\Windows\System\IEYaZTK.exe
  C:\Windows\System\IEYaZTK.exe
  2⤵
  PID:7000
- C:\Windows\System\JXYhGBR.exe
  C:\Windows\System\JXYhGBR.exe
  2⤵
  PID:7080
- C:\Windows\System\CIceShw.exe
  C:\Windows\System\CIceShw.exe
  2⤵
  PID:7108
- C:\Windows\System\KmrUyMi.exe
  C:\Windows\System\KmrUyMi.exe
  2⤵
  PID:5988
- C:\Windows\System\oTLsWiq.exe
  C:\Windows\System\oTLsWiq.exe
  2⤵
  PID:6392
- C:\Windows\System\zvqrZpL.exe
  C:\Windows\System\zvqrZpL.exe
  2⤵
  PID:6236
- C:\Windows\System\DbdapuF.exe
  C:\Windows\System\DbdapuF.exe
  2⤵
  PID:6140
- C:\Windows\System\EEHMfps.exe
  C:\Windows\System\EEHMfps.exe
  2⤵
  PID:6416
- C:\Windows\System\oOfhSVV.exe
  C:\Windows\System\oOfhSVV.exe
  2⤵
  PID:6456
- C:\Windows\System\irfSevU.exe
  C:\Windows\System\irfSevU.exe
  2⤵
  PID:6576
- C:\Windows\System\lexOjmH.exe
  C:\Windows\System\lexOjmH.exe
  2⤵
  PID:6388
- C:\Windows\System\HUFNEmV.exe
  C:\Windows\System\HUFNEmV.exe
  2⤵
  PID:6816
- C:\Windows\System\wHWSJab.exe
  C:\Windows\System\wHWSJab.exe
  2⤵
  PID:6804
- C:\Windows\System\grFuBfg.exe
  C:\Windows\System\grFuBfg.exe
  2⤵
  PID:6736
- C:\Windows\System\HhpRsFK.exe
  C:\Windows\System\HhpRsFK.exe
  2⤵
  PID:6060
- C:\Windows\System\KxxKGOC.exe
  C:\Windows\System\KxxKGOC.exe
  2⤵
  PID:7036
- C:\Windows\System\FexMVCX.exe
  C:\Windows\System\FexMVCX.exe
  2⤵
  PID:5780
- C:\Windows\System\QfhyJfV.exe
  C:\Windows\System\QfhyJfV.exe
  2⤵
  PID:5948
- C:\Windows\System\OYuurlP.exe
  C:\Windows\System\OYuurlP.exe
  2⤵
  PID:6300
- C:\Windows\System\DZgNCrr.exe
  C:\Windows\System\DZgNCrr.exe
  2⤵
  PID:6540
- C:\Windows\System\HaXKZyR.exe
  C:\Windows\System\HaXKZyR.exe
  2⤵
  PID:6784
- C:\Windows\System\VKXNsQs.exe
  C:\Windows\System\VKXNsQs.exe
  2⤵
  PID:6636
- C:\Windows\System\afFTsrE.exe
  C:\Windows\System\afFTsrE.exe
  2⤵
  PID:6732
- C:\Windows\System\zdQXZkD.exe
  C:\Windows\System\zdQXZkD.exe
  2⤵
  PID:7124
- C:\Windows\System\duwBiSA.exe
  C:\Windows\System\duwBiSA.exe
  2⤵
  PID:5924
- C:\Windows\System\wLROgzj.exe
  C:\Windows\System\wLROgzj.exe
  2⤵
  PID:6900
- C:\Windows\System\ziEOhKD.exe
  C:\Windows\System\ziEOhKD.exe
  2⤵
  PID:6544
- C:\Windows\System\ZHznVGw.exe
  C:\Windows\System\ZHznVGw.exe
  2⤵
  PID:6660
- C:\Windows\System\mmlLgPc.exe
  C:\Windows\System\mmlLgPc.exe
  2⤵
  PID:6836
- C:\Windows\System\komDraQ.exe
  C:\Windows\System\komDraQ.exe
  2⤵
  PID:6264
- C:\Windows\System\aziPhxm.exe
  C:\Windows\System\aziPhxm.exe
  2⤵
  PID:3064
- C:\Windows\System\dUwutPs.exe
  C:\Windows\System\dUwutPs.exe
  2⤵
  PID:7192
- C:\Windows\System\cPcsSFv.exe
  C:\Windows\System\cPcsSFv.exe
  2⤵
  PID:7208
- C:\Windows\System\qMLtDpF.exe
  C:\Windows\System\qMLtDpF.exe
  2⤵
  PID:7232
- C:\Windows\System\PSuWYNX.exe
  C:\Windows\System\PSuWYNX.exe
  2⤵
  PID:7248
- C:\Windows\System\olCzrFW.exe
  C:\Windows\System\olCzrFW.exe
  2⤵
  PID:7264
- C:\Windows\System\MUNLgzF.exe
  C:\Windows\System\MUNLgzF.exe
  2⤵
  PID:7284
- C:\Windows\System\LVHwOis.exe
  C:\Windows\System\LVHwOis.exe
  2⤵
  PID:7308
- C:\Windows\System\nttJNKs.exe
  C:\Windows\System\nttJNKs.exe
  2⤵
  PID:7344
- C:\Windows\System\GlTDhgr.exe
  C:\Windows\System\GlTDhgr.exe
  2⤵
  PID:7364
- C:\Windows\System\uQfLtYI.exe
  C:\Windows\System\uQfLtYI.exe
  2⤵
  PID:7384
- C:\Windows\System\awvXGLR.exe
  C:\Windows\System\awvXGLR.exe
  2⤵
  PID:7400
- C:\Windows\System\ZWPMxeQ.exe
  C:\Windows\System\ZWPMxeQ.exe
  2⤵
  PID:7420
- C:\Windows\System\NbCEweZ.exe
  C:\Windows\System\NbCEweZ.exe
  2⤵
  PID:7436
- C:\Windows\System\jCNHjGO.exe
  C:\Windows\System\jCNHjGO.exe
  2⤵
  PID:7456
- C:\Windows\System\NZmdEaq.exe
  C:\Windows\System\NZmdEaq.exe
  2⤵
  PID:7476
- C:\Windows\System\eYMBeDo.exe
  C:\Windows\System\eYMBeDo.exe
  2⤵
  PID:7492
- C:\Windows\System\pXOyNEQ.exe
  C:\Windows\System\pXOyNEQ.exe
  2⤵
  PID:7516
- C:\Windows\System\dgomDrF.exe
  C:\Windows\System\dgomDrF.exe
  2⤵
  PID:7532
- C:\Windows\System\lKVvsQi.exe
  C:\Windows\System\lKVvsQi.exe
  2⤵
  PID:7552
- C:\Windows\System\ETIYLBV.exe
  C:\Windows\System\ETIYLBV.exe
  2⤵
  PID:7584
- C:\Windows\System\rdqXHAw.exe
  C:\Windows\System\rdqXHAw.exe
  2⤵
  PID:7604
- C:\Windows\System\xnCRinE.exe
  C:\Windows\System\xnCRinE.exe
  2⤵
  PID:7620
- C:\Windows\System\NvSKaAq.exe
  C:\Windows\System\NvSKaAq.exe
  2⤵
  PID:7640
- C:\Windows\System\ISfALGt.exe
  C:\Windows\System\ISfALGt.exe
  2⤵
  PID:7660
- C:\Windows\System\iabMJcZ.exe
  C:\Windows\System\iabMJcZ.exe
  2⤵
  PID:7680
- C:\Windows\System\WZWlSiv.exe
  C:\Windows\System\WZWlSiv.exe
  2⤵
  PID:7700
- C:\Windows\System\RLuxxKE.exe
  C:\Windows\System\RLuxxKE.exe
  2⤵
  PID:7716
- C:\Windows\System\ciAWguh.exe
  C:\Windows\System\ciAWguh.exe
  2⤵
  PID:7736
- C:\Windows\System\ArhqjkR.exe
  C:\Windows\System\ArhqjkR.exe
  2⤵
  PID:7756
- C:\Windows\System\PJnOPua.exe
  C:\Windows\System\PJnOPua.exe
  2⤵
  PID:7780
- C:\Windows\System\bFjJMUx.exe
  C:\Windows\System\bFjJMUx.exe
  2⤵
  PID:7796
- C:\Windows\System\kjrIfgm.exe
  C:\Windows\System\kjrIfgm.exe
  2⤵
  PID:7816
- C:\Windows\System\dlRiohJ.exe
  C:\Windows\System\dlRiohJ.exe
  2⤵
  PID:7832
- C:\Windows\System\jcrxYMz.exe
  C:\Windows\System\jcrxYMz.exe
  2⤵
  PID:7856
- C:\Windows\System\vvbiMOh.exe
  C:\Windows\System\vvbiMOh.exe
  2⤵
  PID:7876
- C:\Windows\System\QtIPwkh.exe
  C:\Windows\System\QtIPwkh.exe
  2⤵
  PID:7892
- C:\Windows\System\kTnaNAC.exe
  C:\Windows\System\kTnaNAC.exe
  2⤵
  PID:7908
- C:\Windows\System\LUCIGvk.exe
  C:\Windows\System\LUCIGvk.exe
  2⤵
  PID:7936
- C:\Windows\System\PIclVtz.exe
  C:\Windows\System\PIclVtz.exe
  2⤵
  PID:7952
- C:\Windows\System\ADCEJTs.exe
  C:\Windows\System\ADCEJTs.exe
  2⤵
  PID:7968
- C:\Windows\System\TvbTsyF.exe
  C:\Windows\System\TvbTsyF.exe
  2⤵
  PID:7996
- C:\Windows\System\KKyolrg.exe
  C:\Windows\System\KKyolrg.exe
  2⤵
  PID:8016
- C:\Windows\System\TCzrUDM.exe
  C:\Windows\System\TCzrUDM.exe
  2⤵
  PID:8044
- C:\Windows\System\nIWLmpw.exe
  C:\Windows\System\nIWLmpw.exe
  2⤵
  PID:8064
- C:\Windows\System\CxFQqSX.exe
  C:\Windows\System\CxFQqSX.exe
  2⤵
  PID:8096
- C:\Windows\System\qzFEtzU.exe
  C:\Windows\System\qzFEtzU.exe
  2⤵
  PID:8116
- C:\Windows\System\RgRjkya.exe
  C:\Windows\System\RgRjkya.exe
  2⤵
  PID:8132
- C:\Windows\System\nGMyxXC.exe
  C:\Windows\System\nGMyxXC.exe
  2⤵
  PID:8156
- C:\Windows\System\bfkAfWS.exe
  C:\Windows\System\bfkAfWS.exe
  2⤵
  PID:8172
- C:\Windows\System\ruoWucQ.exe
  C:\Windows\System\ruoWucQ.exe
  2⤵
  PID:8188
- C:\Windows\System\BjouBJM.exe
  C:\Windows\System\BjouBJM.exe
  2⤵
  PID:7176
- C:\Windows\System\UgnpfOg.exe
  C:\Windows\System\UgnpfOg.exe
  2⤵
  PID:7180
- C:\Windows\System\rJotquQ.exe
  C:\Windows\System\rJotquQ.exe
  2⤵
  PID:7256
- C:\Windows\System\TMOqhgC.exe
  C:\Windows\System\TMOqhgC.exe
  2⤵
  PID:7280
- C:\Windows\System\XEIioEd.exe
  C:\Windows\System\XEIioEd.exe
  2⤵
  PID:7200
- C:\Windows\System\pAMnwnc.exe
  C:\Windows\System\pAMnwnc.exe
  2⤵
  PID:7240
- C:\Windows\System\SCkAZbk.exe
  C:\Windows\System\SCkAZbk.exe
  2⤵
  PID:7328
- C:\Windows\System\MikrRoW.exe
  C:\Windows\System\MikrRoW.exe
  2⤵
  PID:7356
- C:\Windows\System\kwZcfGi.exe
  C:\Windows\System\kwZcfGi.exe
  2⤵
  PID:7376
- C:\Windows\System\nyWxPgI.exe
  C:\Windows\System\nyWxPgI.exe
  2⤵
  PID:7468
- C:\Windows\System\oULdprR.exe
  C:\Windows\System\oULdprR.exe
  2⤵
  PID:7408
- C:\Windows\System\gCcAjEB.exe
  C:\Windows\System\gCcAjEB.exe
  2⤵
  PID:7544
- C:\Windows\System\nEoCtKi.exe
  C:\Windows\System\nEoCtKi.exe
  2⤵
  PID:7524
- C:\Windows\System\WSxnzrA.exe
  C:\Windows\System\WSxnzrA.exe
  2⤵
  PID:7576
- C:\Windows\System\nFtWvnc.exe
  C:\Windows\System\nFtWvnc.exe
  2⤵
  PID:7600
- C:\Windows\System\eaDsBaE.exe
  C:\Windows\System\eaDsBaE.exe
  2⤵
  PID:7676
- C:\Windows\System\NWpiMgZ.exe
  C:\Windows\System\NWpiMgZ.exe
  2⤵
  PID:7652
- C:\Windows\System\QOmoVUe.exe
  C:\Windows\System\QOmoVUe.exe
  2⤵
  PID:7712
- C:\Windows\System\SKLOXSj.exe
  C:\Windows\System\SKLOXSj.exe
  2⤵
  PID:7788
- C:\Windows\System\UFIudho.exe
  C:\Windows\System\UFIudho.exe
  2⤵
  PID:7812
- C:\Windows\System\iddTpxF.exe
  C:\Windows\System\iddTpxF.exe
  2⤵
  PID:7728
- C:\Windows\System\umoAAKD.exe
  C:\Windows\System\umoAAKD.exe
  2⤵
  PID:7868
- C:\Windows\System\neyISRa.exe
  C:\Windows\System\neyISRa.exe
  2⤵
  PID:7764
- C:\Windows\System\xNXdGAl.exe
  C:\Windows\System\xNXdGAl.exe
  2⤵
  PID:7844
- C:\Windows\System\wvIeFTH.exe
  C:\Windows\System\wvIeFTH.exe
  2⤵
  PID:7948
- C:\Windows\System\UEtAOaP.exe
  C:\Windows\System\UEtAOaP.exe
  2⤵
  PID:7932
- C:\Windows\System\eOXrRlr.exe
  C:\Windows\System\eOXrRlr.exe
  2⤵
  PID:7984
- C:\Windows\System\zBvYXuP.exe
  C:\Windows\System\zBvYXuP.exe
  2⤵
  PID:8032
- C:\Windows\System\MHEIAPW.exe
  C:\Windows\System\MHEIAPW.exe
  2⤵
  PID:8052
- C:\Windows\System\DFPtkye.exe
  C:\Windows\System\DFPtkye.exe
  2⤵
  PID:8164
- C:\Windows\System\LNSHBav.exe
  C:\Windows\System\LNSHBav.exe
  2⤵
  PID:7216
- C:\Windows\System\ScuCstg.exe
  C:\Windows\System\ScuCstg.exe
  2⤵
  PID:7204
- C:\Windows\System\RYLbbhY.exe
  C:\Windows\System\RYLbbhY.exe
  2⤵
  PID:7296
- C:\Windows\System\tlpIPij.exe
  C:\Windows\System\tlpIPij.exe
  2⤵
  PID:7244
- C:\Windows\System\YNWBhQj.exe
  C:\Windows\System\YNWBhQj.exe
  2⤵
  PID:7500
- C:\Windows\System\dpufvOj.exe
  C:\Windows\System\dpufvOj.exe
  2⤵
  PID:7464
- C:\Windows\System\DcjoLpB.exe
  C:\Windows\System\DcjoLpB.exe
  2⤵
  PID:7564
- C:\Windows\System\xSlsfNY.exe
  C:\Windows\System\xSlsfNY.exe
  2⤵
  PID:7656
- C:\Windows\System\omjKeTn.exe
  C:\Windows\System\omjKeTn.exe
  2⤵
  PID:7668
- C:\Windows\System\LSUrHVV.exe
  C:\Windows\System\LSUrHVV.exe
  2⤵
  PID:7696
- C:\Windows\System\WICeeOg.exe
  C:\Windows\System\WICeeOg.exe
  2⤵
  PID:7804
- C:\Windows\System\kLsQEyh.exe
  C:\Windows\System\kLsQEyh.exe
  2⤵
  PID:7828
- C:\Windows\System\ZeLJecN.exe
  C:\Windows\System\ZeLJecN.exe
  2⤵
  PID:7872
- C:\Windows\System\bTlXduS.exe
  C:\Windows\System\bTlXduS.exe
  2⤵
  PID:7992
- C:\Windows\System\cmXMIuC.exe
  C:\Windows\System\cmXMIuC.exe
  2⤵
  PID:8028
- C:\Windows\System\QKCFGvB.exe
  C:\Windows\System\QKCFGvB.exe
  2⤵
  PID:8072
- C:\Windows\System\JLjSQqc.exe
  C:\Windows\System\JLjSQqc.exe
  2⤵
  PID:6672
- C:\Windows\System\xeWvfpQ.exe
  C:\Windows\System\xeWvfpQ.exe
  2⤵
  PID:8168
- C:\Windows\System\dTLDEhw.exe
  C:\Windows\System\dTLDEhw.exe
  2⤵
  PID:7988
- C:\Windows\System\gUgztlI.exe
  C:\Windows\System\gUgztlI.exe
  2⤵
  PID:7452
- C:\Windows\System\RwlgGix.exe
  C:\Windows\System\RwlgGix.exe
  2⤵
  PID:7320
- C:\Windows\System\Wkhhtlg.exe
  C:\Windows\System\Wkhhtlg.exe
  2⤵
  PID:7392
- C:\Windows\System\pTyVEAx.exe
  C:\Windows\System\pTyVEAx.exe
  2⤵
  PID:7484
- C:\Windows\System\FqAsnbu.exe
  C:\Windows\System\FqAsnbu.exe
  2⤵
  PID:7616
- C:\Windows\System\LPZtWqc.exe
  C:\Windows\System\LPZtWqc.exe
  2⤵
  PID:7768
- C:\Windows\System\apnGUFL.exe
  C:\Windows\System\apnGUFL.exe
  2⤵
  PID:7848
- C:\Windows\System\UQEokok.exe
  C:\Windows\System\UQEokok.exe
  2⤵
  PID:8024
- C:\Windows\System\ybyOYje.exe
  C:\Windows\System\ybyOYje.exe
  2⤵
  PID:7924
- C:\Windows\System\ZuJEyQV.exe
  C:\Windows\System\ZuJEyQV.exe
  2⤵
  PID:8104
- C:\Windows\System\UjSaESh.exe
  C:\Windows\System\UjSaESh.exe
  2⤵
  PID:7292
- C:\Windows\System\xnVOOBE.exe
  C:\Windows\System\xnVOOBE.exe
  2⤵
  PID:7360
- C:\Windows\System\kWdEkwS.exe
  C:\Windows\System\kWdEkwS.exe
  2⤵
  PID:7416
- C:\Windows\System\rOdQSRD.exe
  C:\Windows\System\rOdQSRD.exe
  2⤵
  PID:7632
- C:\Windows\System\LpukaeT.exe
  C:\Windows\System\LpukaeT.exe
  2⤵
  PID:7188
- C:\Windows\System\TnkmvUm.exe
  C:\Windows\System\TnkmvUm.exe
  2⤵
  PID:7752
- C:\Windows\System\kuYKMLy.exe
  C:\Windows\System\kuYKMLy.exe
  2⤵
  PID:7916
- C:\Windows\System\wJApxDJ.exe
  C:\Windows\System\wJApxDJ.exe
  2⤵
  PID:7224
- C:\Windows\System\LZjvbUT.exe
  C:\Windows\System\LZjvbUT.exe
  2⤵
  PID:7432
- C:\Windows\System\EktGNRo.exe
  C:\Windows\System\EktGNRo.exe
  2⤵
  PID:7540
- C:\Windows\System\deZzrRr.exe
  C:\Windows\System\deZzrRr.exe
  2⤵
  PID:7980
- C:\Windows\System\XlMEWeG.exe
  C:\Windows\System\XlMEWeG.exe
  2⤵
  PID:8060
- C:\Windows\System\moQokGS.exe
  C:\Windows\System\moQokGS.exe
  2⤵
  PID:7372
- C:\Windows\System\RBlYdLs.exe
  C:\Windows\System\RBlYdLs.exe
  2⤵
  PID:7904
- C:\Windows\System\YdcLCSP.exe
  C:\Windows\System\YdcLCSP.exe
  2⤵
  PID:7504
- C:\Windows\System\zxgUHJx.exe
  C:\Windows\System\zxgUHJx.exe
  2⤵
  PID:8196
- C:\Windows\System\yqddQXM.exe
  C:\Windows\System\yqddQXM.exe
  2⤵
  PID:8216
- C:\Windows\System\suSUfgV.exe
  C:\Windows\System\suSUfgV.exe
  2⤵
  PID:8232
- C:\Windows\System\eZIzYPJ.exe
  C:\Windows\System\eZIzYPJ.exe
  2⤵
  PID:8252
- C:\Windows\System\gksGJfC.exe
  C:\Windows\System\gksGJfC.exe
  2⤵
  PID:8268
- C:\Windows\System\TTpnMTu.exe
  C:\Windows\System\TTpnMTu.exe
  2⤵
  PID:8304
- C:\Windows\System\lgTUHKY.exe
  C:\Windows\System\lgTUHKY.exe
  2⤵
  PID:8320
- C:\Windows\System\HMxJXJl.exe
  C:\Windows\System\HMxJXJl.exe
  2⤵
  PID:8344
- C:\Windows\System\LjZjCUH.exe
  C:\Windows\System\LjZjCUH.exe
  2⤵
  PID:8368
- C:\Windows\System\nxUBtoy.exe
  C:\Windows\System\nxUBtoy.exe
  2⤵
  PID:8384
- C:\Windows\System\rXvsZUj.exe
  C:\Windows\System\rXvsZUj.exe
  2⤵
  PID:8400
- C:\Windows\System\tIVEaRx.exe
  C:\Windows\System\tIVEaRx.exe
  2⤵
  PID:8416
- C:\Windows\System\rdQPghh.exe
  C:\Windows\System\rdQPghh.exe
  2⤵
  PID:8432
- C:\Windows\System\ScWHbTL.exe
  C:\Windows\System\ScWHbTL.exe
  2⤵
  PID:8448
- C:\Windows\System\JUqRSdM.exe
  C:\Windows\System\JUqRSdM.exe
  2⤵
  PID:8476
- C:\Windows\System\lgfKOOM.exe
  C:\Windows\System\lgfKOOM.exe
  2⤵
  PID:8500
- C:\Windows\System\nZrPEao.exe
  C:\Windows\System\nZrPEao.exe
  2⤵
  PID:8520
- C:\Windows\System\XLebpbf.exe
  C:\Windows\System\XLebpbf.exe
  2⤵
  PID:8540
- C:\Windows\System\xzZbwoj.exe
  C:\Windows\System\xzZbwoj.exe
  2⤵
  PID:8572
- C:\Windows\System\IlklVwH.exe
  C:\Windows\System\IlklVwH.exe
  2⤵
  PID:8588
- C:\Windows\System\TtFPJrT.exe
  C:\Windows\System\TtFPJrT.exe
  2⤵
  PID:8604
- C:\Windows\System\tNnFUXb.exe
  C:\Windows\System\tNnFUXb.exe
  2⤵
  PID:8620
- C:\Windows\System\txCPcfW.exe
  C:\Windows\System\txCPcfW.exe
  2⤵
  PID:8644
- C:\Windows\System\NdJHQbS.exe
  C:\Windows\System\NdJHQbS.exe
  2⤵
  PID:8672
- C:\Windows\System\YMnkYaV.exe
  C:\Windows\System\YMnkYaV.exe
  2⤵
  PID:8692
- C:\Windows\System\lSwmKvx.exe
  C:\Windows\System\lSwmKvx.exe
  2⤵
  PID:8712
- C:\Windows\System\vPMpjdo.exe
  C:\Windows\System\vPMpjdo.exe
  2⤵
  PID:8732
- C:\Windows\System\rlERlNP.exe
  C:\Windows\System\rlERlNP.exe
  2⤵
  PID:8760
- C:\Windows\System\IgaPrCJ.exe
  C:\Windows\System\IgaPrCJ.exe
  2⤵
  PID:8776
- C:\Windows\System\xlFiABz.exe
  C:\Windows\System\xlFiABz.exe
  2⤵
  PID:8796
- C:\Windows\System\ahnzRPz.exe
  C:\Windows\System\ahnzRPz.exe
  2⤵
  PID:8812
- C:\Windows\System\WOThRui.exe
  C:\Windows\System\WOThRui.exe
  2⤵
  PID:8840
- C:\Windows\System\qhWkcZl.exe
  C:\Windows\System\qhWkcZl.exe
  2⤵
  PID:8860
- C:\Windows\System\vVsRVUF.exe
  C:\Windows\System\vVsRVUF.exe
  2⤵
  PID:8876
- C:\Windows\System\mpJlxuX.exe
  C:\Windows\System\mpJlxuX.exe
  2⤵
  PID:8900
- C:\Windows\System\QVbXAPI.exe
  C:\Windows\System\QVbXAPI.exe
  2⤵
  PID:8916
- C:\Windows\System\XWwVscI.exe
  C:\Windows\System\XWwVscI.exe
  2⤵
  PID:8940
- C:\Windows\System\wqAAvOL.exe
  C:\Windows\System\wqAAvOL.exe
  2⤵
  PID:8956
- C:\Windows\System\ruBVdlv.exe
  C:\Windows\System\ruBVdlv.exe
  2⤵
  PID:8984
- C:\Windows\System\qBHNnjw.exe
  C:\Windows\System\qBHNnjw.exe
  2⤵
  PID:9000
- C:\Windows\System\vALLStb.exe
  C:\Windows\System\vALLStb.exe
  2⤵
  PID:9016
- C:\Windows\System\qAZmqhI.exe
  C:\Windows\System\qAZmqhI.exe
  2⤵
  PID:9032
- C:\Windows\System\JwzsHXj.exe
  C:\Windows\System\JwzsHXj.exe
  2⤵
  PID:9052
- C:\Windows\System\HVQUUQD.exe
  C:\Windows\System\HVQUUQD.exe
  2⤵
  PID:9076
- C:\Windows\System\CpPdYSw.exe
  C:\Windows\System\CpPdYSw.exe
  2⤵
  PID:9092
- C:\Windows\System\AccrrGs.exe
  C:\Windows\System\AccrrGs.exe
  2⤵
  PID:9112
- C:\Windows\System\xdHGmbb.exe
  C:\Windows\System\xdHGmbb.exe
  2⤵
  PID:9144
- C:\Windows\System\kTVMPJp.exe
  C:\Windows\System\kTVMPJp.exe
  2⤵
  PID:9160
- C:\Windows\System\gHftAkB.exe
  C:\Windows\System\gHftAkB.exe
  2⤵
  PID:9180
- C:\Windows\System\vrzApyd.exe
  C:\Windows\System\vrzApyd.exe
  2⤵
  PID:9200
- C:\Windows\System\LLrgsok.exe
  C:\Windows\System\LLrgsok.exe
  2⤵
  PID:7300
- C:\Windows\System\ZxuXOGk.exe
  C:\Windows\System\ZxuXOGk.exe
  2⤵
  PID:8208
- C:\Windows\System\oXWbIgd.exe
  C:\Windows\System\oXWbIgd.exe
  2⤵
  PID:8212
- C:\Windows\System\RduYSwX.exe
  C:\Windows\System\RduYSwX.exe
  2⤵
  PID:8244
- C:\Windows\System\lKujPlb.exe
  C:\Windows\System\lKujPlb.exe
  2⤵
  PID:8292
- C:\Windows\System\jxDuUbZ.exe
  C:\Windows\System\jxDuUbZ.exe
  2⤵
  PID:8328
- C:\Windows\System\tAmiiSp.exe
  C:\Windows\System\tAmiiSp.exe
  2⤵
  PID:8364
- C:\Windows\System\EisZzKO.exe
  C:\Windows\System\EisZzKO.exe
  2⤵
  PID:8380
- C:\Windows\System\DVkgFEc.exe
  C:\Windows\System\DVkgFEc.exe
  2⤵
  PID:8472
- C:\Windows\System\IzPdkJF.exe
  C:\Windows\System\IzPdkJF.exe
  2⤵
  PID:8484
- C:\Windows\System\GCaWPRt.exe
  C:\Windows\System\GCaWPRt.exe
  2⤵
  PID:8508
- C:\Windows\System\xPabLTf.exe
  C:\Windows\System\xPabLTf.exe
  2⤵
  PID:8516
- C:\Windows\System\JKnIdlE.exe
  C:\Windows\System\JKnIdlE.exe
  2⤵
  PID:8560
- C:\Windows\System\YRZABYD.exe
  C:\Windows\System\YRZABYD.exe
  2⤵
  PID:8612
- C:\Windows\System\OpmEItl.exe
  C:\Windows\System\OpmEItl.exe
  2⤵
  PID:8636
- C:\Windows\System\UCWbPUT.exe
  C:\Windows\System\UCWbPUT.exe
  2⤵
  PID:8688
- C:\Windows\System\YGSMtrp.exe
  C:\Windows\System\YGSMtrp.exe
  2⤵
  PID:8720
- C:\Windows\System\yERHLgK.exe
  C:\Windows\System\yERHLgK.exe
  2⤵
  PID:8740
- C:\Windows\System\LcfLXZw.exe
  C:\Windows\System\LcfLXZw.exe
  2⤵
  PID:8768
- C:\Windows\System\VFfZvfa.exe
  C:\Windows\System\VFfZvfa.exe
  2⤵
  PID:8804
- C:\Windows\System\xpjSjth.exe
  C:\Windows\System\xpjSjth.exe
  2⤵
  PID:8832
- C:\Windows\System\sLMZdji.exe
  C:\Windows\System\sLMZdji.exe
  2⤵
  PID:8564
- C:\Windows\System\xbPgSwL.exe
  C:\Windows\System\xbPgSwL.exe
  2⤵
  PID:8888
- C:\Windows\System\zNJETRn.exe
  C:\Windows\System\zNJETRn.exe
  2⤵
  PID:8908
- C:\Windows\System\zrzcUjS.exe
  C:\Windows\System\zrzcUjS.exe
  2⤵
  PID:8936
- C:\Windows\System\FMLwdca.exe
  C:\Windows\System\FMLwdca.exe
  2⤵
  PID:9008
- C:\Windows\System\UGBxSVK.exe
  C:\Windows\System\UGBxSVK.exe
  2⤵
  PID:8996
- C:\Windows\System\ttxKEOS.exe
  C:\Windows\System\ttxKEOS.exe
  2⤵
  PID:9028
- C:\Windows\System\SiRJJRd.exe
  C:\Windows\System\SiRJJRd.exe
  2⤵
  PID:9136
- C:\Windows\System\MxrDPKC.exe
  C:\Windows\System\MxrDPKC.exe
  2⤵
  PID:9104
- C:\Windows\System\kXvsdZs.exe
  C:\Windows\System\kXvsdZs.exe
  2⤵
  PID:9168
- C:\Windows\System\fEZmomP.exe
  C:\Windows\System\fEZmomP.exe
  2⤵
  PID:9208
- C:\Windows\System\XghEJph.exe
  C:\Windows\System\XghEJph.exe
  2⤵
  PID:8228
- C:\Windows\System\NsGtfej.exe
  C:\Windows\System\NsGtfej.exe
  2⤵
  PID:9196
- C:\Windows\System\uHktlgI.exe
  C:\Windows\System\uHktlgI.exe
  2⤵
  PID:7864
- C:\Windows\System\KQTaEIs.exe
  C:\Windows\System\KQTaEIs.exe
  2⤵
  PID:8408
- C:\Windows\System\NWqhEOi.exe
  C:\Windows\System\NWqhEOi.exe
  2⤵
  PID:8316
- C:\Windows\System\mfIUNLl.exe
  C:\Windows\System\mfIUNLl.exe
  2⤵
  PID:8440
- C:\Windows\System\hkxLLGL.exe
  C:\Windows\System\hkxLLGL.exe
  2⤵
  PID:8412
- C:\Windows\System\KfqCTxe.exe
  C:\Windows\System\KfqCTxe.exe
  2⤵
  PID:8152
- C:\Windows\System\MDDJEkB.exe
  C:\Windows\System\MDDJEkB.exe
  2⤵
  PID:8628
- C:\Windows\System\wzgSJnt.exe
  C:\Windows\System\wzgSJnt.exe
  2⤵
  PID:8660
- C:\Windows\System\KjcvUAt.exe
  C:\Windows\System\KjcvUAt.exe
  2⤵
  PID:8708
- C:\Windows\System\aZJRxUe.exe
  C:\Windows\System\aZJRxUe.exe
  2⤵
  PID:8752
- C:\Windows\System\OZpBZyG.exe
  C:\Windows\System\OZpBZyG.exe
  2⤵
  PID:8788
- C:\Windows\System\TbpJCek.exe
  C:\Windows\System\TbpJCek.exe
  2⤵
  PID:8828
- C:\Windows\System\PrTAPUM.exe
  C:\Windows\System\PrTAPUM.exe
  2⤵
  PID:8896
- C:\Windows\System\UGkfzjz.exe
  C:\Windows\System\UGkfzjz.exe
  2⤵
  PID:8952
- C:\Windows\System\miPhhHJ.exe
  C:\Windows\System\miPhhHJ.exe
  2⤵
  PID:9044
- C:\Windows\System\UXgCJBK.exe
  C:\Windows\System\UXgCJBK.exe
  2⤵
  PID:9024
- C:\Windows\System\nPwiAUm.exe
  C:\Windows\System\nPwiAUm.exe
  2⤵
  PID:9132
- C:\Windows\System\eTJvCuX.exe
  C:\Windows\System\eTJvCuX.exe
  2⤵
  PID:9172
- C:\Windows\System\NJnnhvk.exe
  C:\Windows\System\NJnnhvk.exe
  2⤵
  PID:8924
- C:\Windows\System\qPYSJId.exe
  C:\Windows\System\qPYSJId.exe
  2⤵
  PID:8296
- C:\Windows\System\BQqWzCk.exe
  C:\Windows\System\BQqWzCk.exe
  2⤵
  PID:8280
- C:\Windows\System\REXEVzD.exe
  C:\Windows\System\REXEVzD.exe
  2⤵
  PID:8336
- C:\Windows\System\EzTdnZj.exe
  C:\Windows\System\EzTdnZj.exe
  2⤵
  PID:8536
- C:\Windows\System\EocsCug.exe
  C:\Windows\System\EocsCug.exe
  2⤵
  PID:8392
- C:\Windows\System\eoYNSxB.exe
  C:\Windows\System\eoYNSxB.exe
  2⤵
  PID:8700
- C:\Windows\System\pCceePO.exe
  C:\Windows\System\pCceePO.exe
  2⤵
  PID:8872
- C:\Windows\System\jLzQfMh.exe
  C:\Windows\System\jLzQfMh.exe
  2⤵
  PID:8124
- C:\Windows\System\pVHYKOe.exe
  C:\Windows\System\pVHYKOe.exe
  2⤵
  PID:9048
- C:\Windows\System\LbyOMJZ.exe
  C:\Windows\System\LbyOMJZ.exe
  2⤵
  PID:9152
- C:\Windows\System\lGhHcsk.exe
  C:\Windows\System\lGhHcsk.exe
  2⤵
  PID:9176
- C:\Windows\System\rVZIiWA.exe
  C:\Windows\System\rVZIiWA.exe
  2⤵
  PID:8356
- C:\Windows\System\alVBRZG.exe
  C:\Windows\System\alVBRZG.exe
  2⤵
  PID:8312
- C:\Windows\System\EZKhSLl.exe
  C:\Windows\System\EZKhSLl.exe
  2⤵
  PID:8596
- C:\Windows\System\ximjDRM.exe
  C:\Windows\System\ximjDRM.exe
  2⤵
  PID:8848
- C:\Windows\System\nVttZDz.exe
  C:\Windows\System\nVttZDz.exe
  2⤵
  PID:8664
- C:\Windows\System\LBiVFPu.exe
  C:\Windows\System\LBiVFPu.exe
  2⤵
  PID:8856
- C:\Windows\System\ZrQbhGX.exe
  C:\Windows\System\ZrQbhGX.exe
  2⤵
  PID:9188
- C:\Windows\System\wbfbmdB.exe
  C:\Windows\System\wbfbmdB.exe
  2⤵
  PID:8556
- C:\Windows\System\MIThish.exe
  C:\Windows\System\MIThish.exe
  2⤵
  PID:9072
- C:\Windows\System\HbKOHCu.exe
  C:\Windows\System\HbKOHCu.exe
  2⤵
  PID:9192
- C:\Windows\System\fQIXYoZ.exe
  C:\Windows\System\fQIXYoZ.exe
  2⤵
  PID:8968
- C:\Windows\System\TQMlCkB.exe
  C:\Windows\System\TQMlCkB.exe
  2⤵
  PID:9060
- C:\Windows\System\hOWIbBg.exe
  C:\Windows\System\hOWIbBg.exe
  2⤵
  PID:8332
- C:\Windows\System\FeQvQVL.exe
  C:\Windows\System\FeQvQVL.exe
  2⤵
  PID:8884
- C:\Windows\System\hKRsabn.exe
  C:\Windows\System\hKRsabn.exe
  2⤵
  PID:8528
- C:\Windows\System\yZdBdqh.exe
  C:\Windows\System\yZdBdqh.exe
  2⤵
  PID:9220
- C:\Windows\System\pDRnYhe.exe
  C:\Windows\System\pDRnYhe.exe
  2⤵
  PID:9244
- C:\Windows\System\WmboofV.exe
  C:\Windows\System\WmboofV.exe
  2⤵
  PID:9264
- C:\Windows\System\lmUIuQA.exe
  C:\Windows\System\lmUIuQA.exe
  2⤵
  PID:9284
- C:\Windows\System\iVItLfi.exe
  C:\Windows\System\iVItLfi.exe
  2⤵
  PID:9300
- C:\Windows\System\OmUVqmC.exe
  C:\Windows\System\OmUVqmC.exe
  2⤵
  PID:9320
- C:\Windows\System\nQdHjDT.exe
  C:\Windows\System\nQdHjDT.exe
  2⤵
  PID:9344
- C:\Windows\System\TfrNpOy.exe
  C:\Windows\System\TfrNpOy.exe
  2⤵
  PID:9364
- C:\Windows\System\yprcHIg.exe
  C:\Windows\System\yprcHIg.exe
  2⤵
  PID:9380
- C:\Windows\System\okjCstX.exe
  C:\Windows\System\okjCstX.exe
  2⤵
  PID:9400
- C:\Windows\System\gJzBvam.exe
  C:\Windows\System\gJzBvam.exe
  2⤵
  PID:9420
- C:\Windows\System\okKRsAL.exe
  C:\Windows\System\okKRsAL.exe
  2⤵
  PID:9448
- C:\Windows\System\jXiVJBG.exe
  C:\Windows\System\jXiVJBG.exe
  2⤵
  PID:9464
- C:\Windows\System\MDNOXGw.exe
  C:\Windows\System\MDNOXGw.exe
  2⤵
  PID:9488
- C:\Windows\System\xMHrtxR.exe
  C:\Windows\System\xMHrtxR.exe
  2⤵
  PID:9504
- C:\Windows\System\BdsCoFs.exe
  C:\Windows\System\BdsCoFs.exe
  2⤵
  PID:9528
- C:\Windows\System\sVGFSPZ.exe
  C:\Windows\System\sVGFSPZ.exe
  2⤵
  PID:9548
- C:\Windows\System\oLUEZFF.exe
  C:\Windows\System\oLUEZFF.exe
  2⤵
  PID:9564
- C:\Windows\System\mjFLgrS.exe
  C:\Windows\System\mjFLgrS.exe
  2⤵
  PID:9588
- C:\Windows\System\veJWutK.exe
  C:\Windows\System\veJWutK.exe
  2⤵
  PID:9604
- C:\Windows\System\SEfyZhl.exe
  C:\Windows\System\SEfyZhl.exe
  2⤵
  PID:9620
- C:\Windows\System\ZLTHlPy.exe
  C:\Windows\System\ZLTHlPy.exe
  2⤵
  PID:9672
- C:\Windows\System\yHeMmna.exe
  C:\Windows\System\yHeMmna.exe
  2⤵
  PID:9688
- C:\Windows\System\mCAjjvD.exe
  C:\Windows\System\mCAjjvD.exe
  2⤵
  PID:9704
- C:\Windows\System\nXFCnZS.exe
  C:\Windows\System\nXFCnZS.exe
  2⤵
  PID:9724
- C:\Windows\System\IYpvYYS.exe
  C:\Windows\System\IYpvYYS.exe
  2⤵
  PID:9744
- C:\Windows\System\dGKcPzG.exe
  C:\Windows\System\dGKcPzG.exe
  2⤵
  PID:9776
- C:\Windows\System\GIxtVPy.exe
  C:\Windows\System\GIxtVPy.exe
  2⤵
  PID:9796
- C:\Windows\System\pfIyyWP.exe
  C:\Windows\System\pfIyyWP.exe
  2⤵
  PID:9812
- C:\Windows\System\jBdMonL.exe
  C:\Windows\System\jBdMonL.exe
  2⤵
  PID:9828
- C:\Windows\System\aBCIrtA.exe
  C:\Windows\System\aBCIrtA.exe
  2⤵
  PID:9844
- C:\Windows\System\EZYNZQO.exe
  C:\Windows\System\EZYNZQO.exe
  2⤵
  PID:9860
- C:\Windows\System\IjBJIQk.exe
  C:\Windows\System\IjBJIQk.exe
  2⤵
  PID:9896
- C:\Windows\System\cMknmzN.exe
  C:\Windows\System\cMknmzN.exe
  2⤵
  PID:9912
- C:\Windows\System\UpaFLVr.exe
  C:\Windows\System\UpaFLVr.exe
  2⤵
  PID:9936
- C:\Windows\System\BSXBgRM.exe
  C:\Windows\System\BSXBgRM.exe
  2⤵
  PID:9956
- C:\Windows\System\ilKwOmg.exe
  C:\Windows\System\ilKwOmg.exe
  2⤵
  PID:9976
- C:\Windows\System\LwCfLnd.exe
  C:\Windows\System\LwCfLnd.exe
  2⤵
  PID:9992
- C:\Windows\System\IXlxLJM.exe
  C:\Windows\System\IXlxLJM.exe
  2⤵
  PID:10020
- C:\Windows\System\nIrWPcM.exe
  C:\Windows\System\nIrWPcM.exe
  2⤵
  PID:10036
- C:\Windows\System\BflymHh.exe
  C:\Windows\System\BflymHh.exe
  2⤵
  PID:10056
- C:\Windows\System\sLCVLYw.exe
  C:\Windows\System\sLCVLYw.exe
  2⤵
  PID:10072
- C:\Windows\System\NeGiXLM.exe
  C:\Windows\System\NeGiXLM.exe
  2⤵
  PID:10088
- C:\Windows\System\JaYusQk.exe
  C:\Windows\System\JaYusQk.exe
  2⤵
  PID:10108
- C:\Windows\System\DZnblMt.exe
  C:\Windows\System\DZnblMt.exe
  2⤵
  PID:10128
- C:\Windows\System\gDMnBOa.exe
  C:\Windows\System\gDMnBOa.exe
  2⤵
  PID:10148
- C:\Windows\System\TdkjyLY.exe
  C:\Windows\System\TdkjyLY.exe
  2⤵
  PID:10164
- C:\Windows\System\SjOgCsQ.exe
  C:\Windows\System\SjOgCsQ.exe
  2⤵
  PID:10180
- C:\Windows\System\jRhrxvG.exe
  C:\Windows\System\jRhrxvG.exe
  2⤵
  PID:10200
- C:\Windows\System\pxuHRoC.exe
  C:\Windows\System\pxuHRoC.exe
  2⤵
  PID:10224
- C:\Windows\System\HUwVXPD.exe
  C:\Windows\System\HUwVXPD.exe
  2⤵
  PID:9232
- C:\Windows\System\SGxdclK.exe
  C:\Windows\System\SGxdclK.exe
  2⤵
  PID:9236
- C:\Windows\System\wFpgXNj.exe
  C:\Windows\System\wFpgXNj.exe
  2⤵
  PID:9280
- C:\Windows\System\eUoTibn.exe
  C:\Windows\System\eUoTibn.exe
  2⤵
  PID:9296
- C:\Windows\System\CXkGWfH.exe
  C:\Windows\System\CXkGWfH.exe
  2⤵
  PID:9332
- C:\Windows\System\OCwtvUJ.exe
  C:\Windows\System\OCwtvUJ.exe
  2⤵
  PID:9356
- C:\Windows\System\xzvlqqL.exe
  C:\Windows\System\xzvlqqL.exe
  2⤵
  PID:9376
- C:\Windows\System\LwdEXHs.exe
  C:\Windows\System\LwdEXHs.exe
  2⤵
  PID:8456
- C:\Windows\System\OjSlJIL.exe
  C:\Windows\System\OjSlJIL.exe
  2⤵
  PID:9484
- C:\Windows\System\bzcmVCz.exe
  C:\Windows\System\bzcmVCz.exe
  2⤵
  PID:9516
- C:\Windows\System\TfBJNwE.exe
  C:\Windows\System\TfBJNwE.exe
  2⤵
  PID:9556
- C:\Windows\System\yWitbDH.exe
  C:\Windows\System\yWitbDH.exe
  2⤵
  PID:9600
- C:\Windows\System\VBzgMud.exe
  C:\Windows\System\VBzgMud.exe
  2⤵
  PID:9572
- C:\Windows\System\AplxLiR.exe
  C:\Windows\System\AplxLiR.exe
  2⤵
  PID:9616
- C:\Windows\System\xIdMgWG.exe
  C:\Windows\System\xIdMgWG.exe
  2⤵
  PID:9668
- C:\Windows\System\tOMBCzs.exe
  C:\Windows\System\tOMBCzs.exe
  2⤵
  PID:9716
- C:\Windows\System\qMOakgA.exe
  C:\Windows\System\qMOakgA.exe
  2⤵
  PID:9740
- C:\Windows\System\oStvkmZ.exe
  C:\Windows\System\oStvkmZ.exe
  2⤵
  PID:9764
- C:\Windows\System\VLMAzHY.exe
  C:\Windows\System\VLMAzHY.exe
  2⤵
  PID:9876
- C:\Windows\System\ybmoHpP.exe
  C:\Windows\System\ybmoHpP.exe
  2⤵
  PID:9880
- C:\Windows\System\xnywhsS.exe
  C:\Windows\System\xnywhsS.exe
  2⤵
  PID:9892
- C:\Windows\System\FyIEmhT.exe
  C:\Windows\System\FyIEmhT.exe
  2⤵
  PID:9872
- C:\Windows\System\GAilFsj.exe
  C:\Windows\System\GAilFsj.exe
  2⤵
  PID:9964
- C:\Windows\System\QfqQEvw.exe
  C:\Windows\System\QfqQEvw.exe
  2⤵
  PID:10000
- C:\Windows\System\rlzqbNR.exe
  C:\Windows\System\rlzqbNR.exe
  2⤵
  PID:10032
- C:\Windows\System\OYlwSHW.exe
  C:\Windows\System\OYlwSHW.exe
  2⤵
  PID:10100
- C:\Windows\System\OrmmXHI.exe
  C:\Windows\System\OrmmXHI.exe
  2⤵
  PID:10016
- C:\Windows\System\Vgmjyxz.exe
  C:\Windows\System\Vgmjyxz.exe
  2⤵
  PID:10140
- C:\Windows\System\xBBhWot.exe
  C:\Windows\System\xBBhWot.exe
  2⤵
  PID:10084
- C:\Windows\System\OrLolOK.exe
  C:\Windows\System\OrLolOK.exe
  2⤵
  PID:10160
- C:\Windows\System\IahFuND.exe
  C:\Windows\System\IahFuND.exe
  2⤵
  PID:10208
- C:\Windows\System\jPHuCIx.exe
  C:\Windows\System\jPHuCIx.exe
  2⤵
  PID:10220
- C:\Windows\System\zStpTxM.exe
  C:\Windows\System\zStpTxM.exe
  2⤵
  PID:8276
- C:\Windows\System\pLiWexl.exe
  C:\Windows\System\pLiWexl.exe
  2⤵
  PID:10232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AwCNHoD.exe

Filesize
4.1MB

MD5
5de4d3183762f64cceb1bcf2bfa36e37

SHA1
094de2a5e8aef18dc71feeb03d8d3ed40b82eb1f

SHA256
1e665bcd13017da6849c90827a1a40800af4b633ac13832d75fcbfadb9f91523

SHA512
882efe488534b48b665292db1314a0b67182c1852c5d1b8c27f8459dbababa8f3e5a686bad08b8b64ee1948743c7c6ddc009f403c0070e63086ade3b77a9901f

Download Submit
C:\Windows\system\Dkspwrf.exe

Filesize
1.8MB

MD5
e76a3d67c595f2eb05fa69b0ede27973

SHA1
1f96ecc899eafd07933428c4ec34e8c018bf50b2

SHA256
62c242face2a3b08414e49c0563015c16c7546ad16483da440a04581c1b48f53

SHA512
12d4a7573f2a5aa665f717080d58b4a2cb301c8f8da349db4d997c747b8e0f77ed9e8d009bb8ea9f8a8dc56c1a58e962f65ca7dcd698ab4444670517c11c9645

Download Submit
C:\Windows\system\FOFLmyn.exe

Filesize
4.1MB

MD5
ecce05408921f4fa41e298ebf9ce7e0c

SHA1
2eb6865ea07b21494bbaba69c8258e2fd23bdbdf

SHA256
5e29e168206468d735e467867d952c26e581556d0a5dc75b7c8068154d486aaf

SHA512
ea0c6f7788a43f8a12e35cd3c6ea3c351a3b38a3ce9e61d01b1af108cd79d71c3aa26ab8083619ed0bc89b8e3aaa31fa6e2296c4319a67734b15693aa45c8af6

Download Submit
C:\Windows\system\HNtcjaJ.exe

Filesize
2.8MB

MD5
9f7f1671ce640c32294993a98dce6d01

SHA1
6fe5e12b585ad20fcb0f69cf8c158712712a2a2e

SHA256
c4f535b9a72999ee2b7d58c219b798f1b0a956cea8604cbba96862310d6d45f4

SHA512
b26f056817ef00314d96ce4e2d8f99f1c102096b4212ee7cac2878d495bc917e91f3a8c0934c77a26b9deaa27bb01e1e3123bfc6b04f64bd3c8cdb0fbb96dbf2

Download Submit
C:\Windows\system\IgaqTXU.exe

Filesize
4.1MB

MD5
f7793dcf7c20047853a2ff3b2fbe024c

SHA1
1cd259524ebdae484cd507ba60c2861869270c7e

SHA256
f2ad19fd974c4de49160027dcc1eb854e22efcdf67c75fd10fab6abecad4a611

SHA512
570d8e288c02ee1062a2401de39cfbe0b91c471ef942d76d6eadc7de2b8cd1d0672288b3c0f2e4c01b7afc7a9ac9cf79520b3b4f164c81f9e8d7f96abea5c6b6

Download Submit
C:\Windows\system\IoyvLYj.exe

Filesize
4.1MB

MD5
efcba71460be98deb860e17a11b74887

SHA1
2794ff8d861b22b8e83cb733c554df804c541125

SHA256
85a02cf14c6bd23da8851e57701c4308bc880a6f6a459eb9546923f7b9b1d7b9

SHA512
a8a08fb667e778bc3a1d300b5c926de37be7184013fe4067dba7db5d64cec95c10e878e3ce6a9fcc41a40962f3d3f2188e1365527f45e439371bef4bd79b3bae

Download Submit
C:\Windows\system\KDKbWpb.exe

Filesize
4.1MB

MD5
7364835ff4b417b79e7316a2a9b46271

SHA1
bac5715162ab902b6e89312e89ea77c740907363

SHA256
b7fd4ae23242d1c207669adf8ccdc6abcb8cb190d186fa5e6360c618eda719c8

SHA512
2b7d65af5f927bea4c2901dfea2933bb465f6211bb942d78217dd71c18e457095cf95ce73a9cbf768a4614092fa4295b04ce7c9749eb32a67c742aae3762bcb1

Download Submit
C:\Windows\system\LmNkzLW.exe

Filesize
4.1MB

MD5
f3b502e1d7188e69cec1453d7d130ef5

SHA1
fdbe51350ae5f324ccf140f2070cef0dcdbbcbda

SHA256
8f0a33700e1709fb88f4eb16911b36afd0fba4cb24b57123a770aa401c3f066f

SHA512
b16df46b08430ecc331508833e1d31fd2e66129ad6efc8d9b3f36843d888d55083b7d56000c47939509f0ecbbd26dc4c4ae403fcd49a75c1911df3efe035a7cf

Download Submit
C:\Windows\system\PxmrBOm.exe

Filesize
4.1MB

MD5
f9eeb513efff1e0556bc88d057add6d0

SHA1
e96ce5d00ab5954ac5a9e70d9024f828f3493083

SHA256
595963b6c10d833405a58078321ccfc79dbb7e77899099db6ad01113b925ec18

SHA512
97b04482c94357e7e88247c8c81aa75ad79858d478431be5990005081a8ad6179ca835820f0c03a6a5d4b001cab84eb1b9d79a1dead86045ba2171112fff7a0d

Download Submit
C:\Windows\system\SYXNlYw.exe

Filesize
4.1MB

MD5
42a851291df300a85e53f14679a2408a

SHA1
e6c0761b459f3bc67a6781211bc81f62299b62d0

SHA256
1216ec0831b3ee6c82e7886e1142ab975b47f61fbc0057aa30d0bd6173386a2c

SHA512
0be686592511d2e3ba95de2fdabc51261533d627ca54175d00f2b3382f95e1807e3bba376c09345686e416d1f80b475633a73aaa3343804174384cdf7f9f03e9

Download Submit
C:\Windows\system\UCBRqLM.exe

Filesize
4.1MB

MD5
46a73efec210cdd02292277a6fcef4ad

SHA1
7a5b4984c426b8f630114d7c81571d48a885a2ac

SHA256
c7da8cd1f0c1221c7ee50c0d902b95436af4a9f03d1b7abe8787304e488e0d7f

SHA512
e94f3143a0d53e1258fb15c9c07b8efbec7a6effcf69407a194aa141bd7b7b6e74ef3325eaaa42252e790f6e4d57b210d5f4d840f5fa6adf699960c9bbdd76a3

Download Submit
C:\Windows\system\WPbxkjL.exe

Filesize
4.1MB

MD5
167b3269cadbdad72cf4ef52c6d35423

SHA1
b59eb3177edddda94b17dfb7bd1cc1d1fd6c66b8

SHA256
584f3682b0fbf907163f58b4fd3a9636926f20ce6b4170063a02d4897fcdb3c2

SHA512
80216b6c4f0ce22d816dfe0782a7d1d3a5f8391cd5d7b269ca30630d0211308b4719bc6eaf746e56695791fa889eefb91743f533e066602ebbd7c54077301404

Download Submit
C:\Windows\system\WkIrQDo.exe

Filesize
4.1MB

MD5
6bbd96a6414a0ce0999f0fcca7d321b9

SHA1
0f585e3c40ec6e84865abf9cc896f982cc6e6cea

SHA256
9bdea401fad05cb6b6db1d76e2d545f7ef94f38b23fc841a11be25b5d1ec0a80

SHA512
fbecbab9a1602daf856a99d0d1d1c1854e01f14b2e63d530f64819db385807b110d8df793078e0576c6b615683f62507fc009501bec66dee37d199e9d318262b

Download Submit
C:\Windows\system\WvIaClP.exe

Filesize
4.1MB

MD5
122b2c29e97f13027e515fb359bd4df0

SHA1
c3623fff4ff48b216e1132dd9ec04aa47a42b244

SHA256
e8cf9f2921843ed84bb48572422c0d2885379cee86910c15ba33d2acd87a007e

SHA512
20b00ae12cafeddf8a907c3aac56b33660e844d68aac01ec11cfa20b15601a49a39ca5f8910f26ca7181508f844f3bfb8a2889b996d29053a6b35cfa9a19c96d

Download Submit
C:\Windows\system\aatesct.exe

Filesize
4.1MB

MD5
b39e9f76a79c57df7ad82f21c07cf746

SHA1
b68909a681b2859b33e49773c7616fdf8f5e191f

SHA256
393d961b6eba756aa8710c4d1d73a6ed0ae0d081d5961ad9d72bd706499f9a81

SHA512
1ca098ac07018866458b78837af6742cafc641003f72bc8e592de41a15b7ae57ba8c21abdfb961e20d7bd973fee7fcc76c0b03f9c7bb25518ff6f4b591501161

Download Submit
C:\Windows\system\bCVnFWd.exe

Filesize
1.1MB

MD5
3e6c3698a81e7e935733a667a645c229

SHA1
adadcc52827f0bc8aca05847e89053e8c723bd75

SHA256
ff4ba6951d2ef6dc827b54a6fe5c97e2a18ddfd1436d007fcff169756fce3c0f

SHA512
cb0434fcaebda31e49fb1fec6cee06ccec58e4a27617ec407444fe1d18b93b92b40267547a303a32f128d4e605b1e5980754232260a44db06e54431e4f57f6b3

Download Submit
C:\Windows\system\dKGYvSB.exe

Filesize
4.1MB

MD5
b4cc2d28fd4432b9836de7ac0b2bcb4d

SHA1
60f7f0bf62b6dcf441d9b20f7b9e019efdc82617

SHA256
96fce3801f6cd324d683c34b6a6cf894d3d9949217db00b3fccc686e85c06ccd

SHA512
58e9e50753b52573bdb2856f864cb62cf38749a69356c5900fda6c5b3e61d376e051ee6b5dfc9522d992f49b96a23a2c297b286d876cb9eca1fb6682c308b80d

Download Submit
C:\Windows\system\eQbIbKk.exe

Filesize
4.1MB

MD5
d36d525dd19561c6a69b157d41a2f7c9

SHA1
8de7fd036616f2efeca33bb2da0b05af56651e8f

SHA256
424624129db77161452427c3c580a31d0657215f6c13def05d869e0069df7879

SHA512
fac74af9464053d8479022d0c3b566097c57d683a7ca6ca8bc96960389b374561dec58d2421e0fd7b67175faace3c9a92c63157a46d8ec79564814464235999f

Download Submit
C:\Windows\system\gGVtwzM.exe

Filesize
4.1MB

MD5
f2c6f108226f56a06bf9103f4a772b2a

SHA1
e76a65c86bf1fa95f67f08611538cfbc29b0c8c9

SHA256
dfa60c53bc8dd180bbcf946e98c26208826d543d86b914f7b45ee7c5af9bdcb3

SHA512
a6140e0603460736286ad792e48ab48ce30179a586c437614054f31b2f7bdc294d5d55356fb28dec4a0199700b5ed6d39f3b2c8d1c25353f0b6bb723ed951aed

Download Submit
C:\Windows\system\hRSMLtt.exe

Filesize
3.8MB

MD5
66ee06da80884ba6c08f276cee82eb08

SHA1
5c96083c9d21a70de87b0d25ffd78cc4296e1635

SHA256
ab99ed42b3997a37bed6e3b6f63ba9d29416a20927b3237cab6fa7b877915c83

SHA512
e800375bba29e03f8748ea020790762ad70cc15985a95a74d03db5f2612739734197cff763d555dd724dbcaaa26a2279c48d7ddf85480c8bc7c01192f14fd5e6

Download Submit
C:\Windows\system\nHJMFWc.exe

Filesize
4.1MB

MD5
1a0f985214714c6c74bbdf9c56f72117

SHA1
795daf5496ef6d9055a1b3f78b4fbe48903a3668

SHA256
7519385fc918d37ed39c668ac29069b8308e70242a5c8700c28c971ed91551e9

SHA512
cebbae96d84a79ffce2bc85278d7e68d5a5b54e1c21c2622e2c6300945bcd4939907535344cd37df45772b8d783e0cb95ec7b99124e8b866a5479fc5bb094bcc

Download Submit
C:\Windows\system\nRdfgzF.exe

Filesize
4.1MB

MD5
1830ccab5ea08ed6eadf05c427657ffc

SHA1
a634cac372d8094306651c8e3f592b3dbe8f930f

SHA256
e935dba0f48ae30ec39797f9cfa621ff4d72f9ac55445bcaaa942fc1bf56a001

SHA512
c20f6c3012ab1eda30d1c148a9f903804765637220bd60b933e3dfd8844a86862d7de0e92fe6b8786308f124ae635cd91bce1d42ab524f951bb6a6dccdc27f09

Download Submit
C:\Windows\system\oyWzzHS.exe

Filesize
4.1MB

MD5
a027e69d63bfa3d4533c96da18cc4da1

SHA1
df503b5b11733685a7eabf0ae80acc67eaec474a

SHA256
dacf7bbe9d33016a19961e811cd1040c91f9a74f66c4b40e378959b94fbfa7f4

SHA512
7509e46dab028605149c1cdd18a99529b01a4281348cd6c0971526b688f2f64b7035f77410d3336c4580a2ee10f192bfec9fa080db9f6fd83afbe6299d453b6c

Download Submit
C:\Windows\system\qGobdrX.exe

Filesize
4.1MB

MD5
3c77cbd44334802997f033510c64da66

SHA1
defc9cefaa8930eb91995730d61d2cba8eca8836

SHA256
5eb85893c4232119ebabf09676c4af1061d013852336c4b5f9645536c655e515

SHA512
523a03bc58ddaed4337af90bf5b1733bb3c0478e6d88ffcc91e8ba4e35332ae775d1d0abadcb12501ffeb2da8b40344733eac8b3b95a16d7727177b21500963e

Download Submit
C:\Windows\system\qspwxXE.exe

Filesize
1.2MB

MD5
63996e8fa9213dc4223dc163983de700

SHA1
478ab95d32c139a8bf608d3c3fbe3565bebaa36f

SHA256
a47646ed0549429179988d2667dea27177d60df2c3a172cfd71129d3e0ad1255

SHA512
683938b5fb510c9defb1fb04d6af76162624b4675b9724ae0286cdce4110287e33d934bde43353aaae012d7aa52cdad759c1da4e2a2b062671d57229cac09e06

Download Submit
C:\Windows\system\sujWadx.exe

Filesize
1.6MB

MD5
89b68588ab977e2c19d965c0d2852c4b

SHA1
52530f05e7b916801682b503d58bc88b6d0a0103

SHA256
f14fe14f18cf136e23d236c5d5eece2c7db263964d40fa0f670fd6ea44f793b9

SHA512
aa0c145f7e0b0efcba9824321588b84cdb67ec0254fdc1308bde0704a3c1f312cf3405f7e126ab9fb2253dc2654515cf3b1ddb6ecd584a6a244e97440c262f6d

Download Submit
C:\Windows\system\ufuPRQV.exe

Filesize
4.1MB

MD5
491a9d2d19c22f85794e74b923d4042f

SHA1
4e3ce994b7e6a79eea2d415c62695cac4ac76037

SHA256
352706b4b1fd1b4467fb5e79392c4eda3e74c576bce49d1b8634b2b04d2c9d63

SHA512
3687478344719a05401602142ecb9fbeb30c3b193780a31cae6e5dedd6b25ab2aeeb21c551d844204bdff940f823d730aba4048ff1da4e32ba9dcb1d7db41701

Download Submit
C:\Windows\system\wHXADRZ.exe

Filesize
4.1MB

MD5
11d7012390818bcbca1dfa2418003807

SHA1
2b267957021da9f74629b739a37146265e79945d

SHA256
c8517ec15abd56fe553907b54bf19c4ad72b75753bf31a21534217a179330449

SHA512
748d7ccb40d02189196b82b5aef7620e4f95da9bd30649e4f66aa9640a7d98d613a0857d08a952eb2b40f8f90daace17ad677e98289499c8d3a57eddfa8dc36d

Download Submit
\Windows\system\Dkspwrf.exe

Filesize
4.1MB

MD5
05f0defa4f153c209f8878c93ebc67cd

SHA1
19787d52179166bf71a96fbb1776c0925ec9c823

SHA256
47d3f01fefc22edfb1e89a2190ad139024409f469d0bb620f1331133939928d9

SHA512
9caf145cfeab6ad01fa85973e79a4d85a8ae40db783fa6cb5e6b962a03744d98f8ae283b85a25de33df386ee49607af3e71538a1a71e8095af746ffed7068fbd

Download Submit
\Windows\system\FOFLmyn.exe

Filesize
4.0MB

MD5
384bd44f25299f3843821354f903f03d

SHA1
bcd974f6af3d50967ae226120a8ee3c9ea58d45b

SHA256
379c6d63778e4377fcf290a253eca9b07c0aed2a57184689a21dc4979cbbb00a

SHA512
e7e6b0cf00d74fc1dc41e2292ad1d9cf4de5583e629024e838de54a4d63e9cefe59b161ccbb15b498b088954cae2c0d7d32c8136c5fb3b02dbe3661d6b13e669

Download Submit
\Windows\system\GjVDbpo.exe

Filesize
4.1MB

MD5
0ca0fdad15b581ea88616cfd3b3b4313

SHA1
f52adf0f055343b16b692738e463ae51378a90fd

SHA256
8ce178a69a739009ff26877ec381da141f5ae954f175f7c2843d49f7dfe46405

SHA512
ed12f8c8d8200bf213c3eddb1c10f2b69c05b4adea1eb4753dd765c3c32d24c117eb842d34b07f4b9fc5eb8830cbc39be8ffd84ac0fba1132a20ac9ab8b55827

Download Submit
\Windows\system\HNtcjaJ.exe

Filesize
4.1MB

MD5
bb0a4babd604efc627193797c403c250

SHA1
ef2e42c8d109e17b230548113d7d83710fcfaed8

SHA256
0c924974dda7e36647d416181a758193336170fb71075637f8f81e781fc707c3

SHA512
e2fd60111f80df7ec7cb2ac82975c629dc5ba91569d2f5c947031fd3944e28d9a51b2b98ff052533c8b7ceb3a5d254360cba619954dce54277e1b45bdee04ad0

Download Submit
\Windows\system\KDKbWpb.exe

Filesize
2.6MB

MD5
dce065ccee96b3517e6f73200e33fcee

SHA1
86c68120ee1384c3ae70a696cb7ee2027aac50a9

SHA256
1c3a2181d16b0bf65a176e75cad29a62ca6144a621aee68a2c7ebc20ad9a718c

SHA512
3f8bd6f8a041316acd27d003899ceef1222a7fb45b132f1310d29792e13f34cfbcaf84cd002080deaa027c1e045e36fff1383aa8abbc16c0317eedc27b4eecb8

Download Submit
\Windows\system\OydltWi.exe

Filesize
4.1MB

MD5
e5c92ea06b9d3e5d61400a19ebb3fa3c

SHA1
0ae4e9b63ebbac679e68c1d25d70d6b2986994e8

SHA256
1603489e91c1e7d7e649324ff9f755a84e2a703cd22052b5bb0e86afaa33cfdd

SHA512
b196063ac7fc384b463977024455f5a53000a30e9bbbdbaad14fb2a338489ac24493df1d03ee58bfd96583ad251e8e027c988d150dfbb2a7ff63312db53a637a

Download Submit
\Windows\system\PxmrBOm.exe

Filesize
2.4MB

MD5
31cfd07bb080059667f6c7593ad2e5e5

SHA1
6497db414ea917478d6852b0921afb0ea82ae039

SHA256
4f66501a62760a584f3360ae619343636c71bf4258f06ce0da2294d95164d253

SHA512
cb5fbe225c900a7ff09171b8111d4dee79eb2c77c2ef977a5591c4db87a234c088f26471ac44999212d08a9bd775b44d4980d8ec2bcea4e5adf8e5fb369ddb33

Download Submit
\Windows\system\atgQPzj.exe

Filesize
1.5MB

MD5
14e77b11097002d530b981ee5c1bb828

SHA1
a306e0873764751b8c90059ee93e1ff9f2e5dcef

SHA256
09d7c754c538f159cecebb058db316c09e507ce1fc46e5e4e5d63b587f253dac

SHA512
9fde5515c24c2f460a71d78a652a4f8fd489387f27f09ea6f90d7c6eaf0e751df1bdf95cf4d988ba9fabfb077c8709ad3db26ac9bbf7aff7ab9afceaa3bebf60

Download Submit
\Windows\system\bCVnFWd.exe

Filesize
4.1MB

MD5
631e0445c0477ad6393ad6920341b905

SHA1
c742740c64c41e714d77438a1d9863804807cf13

SHA256
1db33dcedd17b3a9c0a3a40d13403e8a8b5d749df3b2c4ff08721a3913c3519b

SHA512
9bb811acf2a18c1b4eef0a041655b3fb733a0d5f3bc7d1947fe8c56dd21cd014061f73380239ef83b5828b5c188ba4563896f63fc5abf2290c1a66dfac38b7ea

Download Submit
\Windows\system\eQbIbKk.exe

Filesize
2.6MB

MD5
993b66e3acf344439515ebc97ad21182

SHA1
9317917b1faaaf00c44e6fcc2f1041d947527e37

SHA256
6b90351172b14b9a2531573b5683fa78fcaeafcca897e79d358620c6764348a3

SHA512
40e9aadf04c37e3fa574c730542195d8936469c452e8c58b8af78c5769445745d17a0ae4bb116f0bea026669be282aef6b4d5df448ac992eae47d27fedb45cde

Download Submit
\Windows\system\hRSMLtt.exe

Filesize
4.1MB

MD5
b865f119d860667c5488e97caff2cc93

SHA1
2ae1a21e987c5549a1bceb761255374792f741a2

SHA256
bfc69310bb39f7be44d29d002bf11557fa9df9d12e2b6eb8e4d11387c5540607

SHA512
dbcb27b80376afd59a29a4a6a7e45549a9c5f538cf76dc6122ba08e74b888006893be708fc7dee9c28c53b76cdc13be34ba7b8ab1aa91f434458ba705fba6932

Download Submit
\Windows\system\mGAdZSi.exe

Filesize
4.1MB

MD5
2f4a94801e9a414c6bc4be75d052b878

SHA1
2a6363d2419d8ab8a2021b5aea0f9194cabc9575

SHA256
033075a21515583539c56f0b9a4708ec37a7d875b6cbd4d009b4178874c8227a

SHA512
b346875d10d89698ce09d65f675502849953a727ba7d379fae5db4523fd394759a4e42f49c4767c690acc26a30c5d46367d1507d63b455ae92494fa5a2b5a505

Download Submit
\Windows\system\sujWadx.exe

Filesize
4.1MB

MD5
25609ba02d877a2e156b887578a6a3de

SHA1
98e00ba77652efc6d61c1406f0e2d6460f7302ad

SHA256
269ecf42745470be584827ec193f8149829dbda26c534afe5c62369e6e43cefb

SHA512
4d6ca6fc338481843b747302fd76b439adc5722f036420eee31334e67239dd0bfd7b7df9ab4943ada962eb8efb223da71daf12ba071ec90d2ba59ae12c5f6ad4

Download Submit
\Windows\system\wHXADRZ.exe

Filesize
2.0MB

MD5
aff88516dc3e311b947fe2dd71245ac5

SHA1
7ce72067b6ba38bbb4cad010702c6c5b28201fd3

SHA256
7fbf6b2cc2bd37d01af4f67b3232c4ef25148a5c264254ac8d2e3c9187cd6bea

SHA512
e82617039d472a4a5f3bfcac21188d5ac50d120aada9b68ed995a8a55d46b51619bae3af92571493f9376294b813e9ebefad7f2cd4fdec2d8f488687e3e098ca

Download Submit
memory/968-302-0x000000013FEB0000-0x00000001402A6000-memory.dmp

Filesize
4.0MB

Download
memory/968-2395-0x000000013FEB0000-0x00000001402A6000-memory.dmp

Filesize
4.0MB

Download
memory/1512-2399-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/1512-310-0x000000013FF20000-0x0000000140316000-memory.dmp

Filesize
4.0MB

Download
memory/1740-2394-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/1740-296-0x000000013FD40000-0x0000000140136000-memory.dmp

Filesize
4.0MB

Download
memory/2404-306-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2404-2392-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2440-54-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2440-2385-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2508-32-0x0000000002E10000-0x0000000003206000-memory.dmp

Filesize
4.0MB

Download
memory/2508-18-0x000000013F2E0000-0x000000013F6D6000-memory.dmp

Filesize
4.0MB

Download
memory/2508-3562-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-311-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-22-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2508-307-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-286-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2508-0-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2993-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2508-297-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-1438-0x000000013FCC0000-0x00000001400B6000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2986-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-280-0x000000013F480000-0x000000013F876000-memory.dmp

Filesize
4.0MB

Download
memory/2508-1441-0x0000000002E10000-0x0000000003206000-memory.dmp

Filesize
4.0MB

Download
memory/2508-8-0x0000000002E10000-0x0000000003206000-memory.dmp

Filesize
4.0MB

Download
memory/2508-47-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2729-0x0000000002E10000-0x0000000003206000-memory.dmp

Filesize
4.0MB

Download
memory/2508-300-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2995-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2735-0x0000000002F60000-0x0000000003356000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2980-0x000000013F620000-0x000000013FA16000-memory.dmp

Filesize
4.0MB

Download
memory/2508-2965-0x000000013F480000-0x000000013F876000-memory.dmp

Filesize
4.0MB

Download
memory/2508-303-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2508-1-0x0000000001B20000-0x0000000001B30000-memory.dmp

Filesize
64KB

Download
memory/2532-2306-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2532-31-0x000000013F760000-0x000000013FB56000-memory.dmp

Filesize
4.0MB

Download
memory/2580-44-0x000000013F920000-0x000000013FD16000-memory.dmp

Filesize
4.0MB

Download
memory/2580-2351-0x000000013F920000-0x000000013FD16000-memory.dmp

Filesize
4.0MB

Download
memory/2632-46-0x000000013F480000-0x000000013F876000-memory.dmp

Filesize
4.0MB

Download
memory/2632-2333-0x000000013F480000-0x000000013F876000-memory.dmp

Filesize
4.0MB

Download
memory/2724-2359-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2724-53-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2812-9-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2812-2289-0x000000013FDD0000-0x00000001401C6000-memory.dmp

Filesize
4.0MB

Download
memory/2844-24-0x00000000029B0000-0x0000000002A30000-memory.dmp

Filesize
512KB

Download
memory/2844-2713-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

Filesize
9.6MB

Download
memory/2844-167-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/2844-25-0x000007FEF53CE000-0x000007FEF53CF000-memory.dmp

Filesize
4KB

Download
memory/2844-80-0x000000001B2E0000-0x000000001B5C2000-memory.dmp

Filesize
2.9MB

Download
memory/2844-81-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2844-276-0x000007FEF5110000-0x000007FEF5AAD000-memory.dmp

Filesize
9.6MB

Download
memory/3028-277-0x000000013F2E0000-0x000000013F6D6000-memory.dmp

Filesize
4.0MB

Download
memory/3028-2345-0x000000013F2E0000-0x000000013F6D6000-memory.dmp

Filesize
4.0MB

Download
memory/3060-2390-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download
memory/3060-299-0x000000013FD60000-0x0000000140156000-memory.dmp

Filesize
4.0MB

Download