xmrig | ea501bb44e0d7a8c36b291c4422dd91aeb61756d76e0d76d9865a86e67a35e6d

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
Size

2.7MB
MD5

3be467544252ab37e40443f20ae24700
SHA1

652d37de8e1698d818c84d880b5103ebd14850b4
SHA256

ea501bb44e0d7a8c36b291c4422dd91aeb61756d76e0d76d9865a86e67a35e6d
SHA512

446fa5e91dbf4020a2b2110344976a07dec9aa17b8be27fd550a889541b077afefd5742e2d7da1f98eacabe09492370b978893889cdbb4fb4fe865132d23a27c
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6lgVJ66Q81:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral1/memory/1688-2-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	xmrig
behavioral1/files/0x000d000000014713-8.dat	xmrig
behavioral1/files/0x0016000000005586-15.dat	xmrig
behavioral1/files/0x0016000000005586-12.dat	xmrig
behavioral1/files/0x00090000000153ee-14.dat	xmrig
behavioral1/files/0x00090000000153ee-19.dat	xmrig
behavioral1/files/0x000700000001565a-23.dat	xmrig
behavioral1/files/0x0007000000015662-28.dat	xmrig
behavioral1/files/0x0007000000015662-31.dat	xmrig
behavioral1/files/0x00070000000158d9-35.dat	xmrig
behavioral1/files/0x0007000000015ae3-44.dat	xmrig
behavioral1/files/0x0006000000016013-73.dat	xmrig
behavioral1/files/0x00060000000164ec-92.dat	xmrig
behavioral1/memory/2708-135-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/memory/2560-144-0x000000013F380000-0x000000013F776000-memory.dmp	xmrig
behavioral1/memory/2620-148-0x000000013F360000-0x000000013F756000-memory.dmp	xmrig
behavioral1/memory/2524-151-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig
behavioral1/files/0x0006000000016cfd-192.dat	xmrig
behavioral1/memory/2580-125-0x000000013FDA0000-0x0000000140196000-memory.dmp	xmrig
behavioral1/memory/2564-133-0x000000013FF50000-0x0000000140346000-memory.dmp	xmrig
behavioral1/files/0x0006000000016575-93.dat	xmrig
behavioral1/files/0x00060000000163eb-82.dat	xmrig
behavioral1/files/0x0006000000015f23-72.dat	xmrig
behavioral1/files/0x0006000000016013-68.dat	xmrig
behavioral1/files/0x0006000000015f23-57.dat	xmrig
behavioral1/files/0x0007000000015d85-48.dat	xmrig
behavioral1/memory/2652-7182-0x000000013F500000-0x000000013F8F6000-memory.dmp	xmrig
behavioral1/memory/2972-7209-0x000000013FD80000-0x0000000140176000-memory.dmp	xmrig
behavioral1/memory/2580-7215-0x000000013FDA0000-0x0000000140196000-memory.dmp	xmrig
behavioral1/memory/2708-7214-0x000000013F490000-0x000000013F886000-memory.dmp	xmrig
behavioral1/memory/2564-7211-0x000000013FF50000-0x0000000140346000-memory.dmp	xmrig
behavioral1/memory/2676-7208-0x000000013FE10000-0x0000000140206000-memory.dmp	xmrig
behavioral1/memory/2524-7192-0x000000013F770000-0x000000013FB66000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1052	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2076	PrjqXEw.exe
2652	ZKrpcga.exe
2676	zoytaxq.exe
2580	gCtsEtW.exe
2564	fJnKzro.exe
2708	caoZnWp.exe
2560	KMFxKUw.exe
2620	ZQBNqMx.exe
2460	KyQaHmL.exe
2524	ROByLyo.exe
2972	qtErurt.exe
2744	vUMWGro.exe
800	cFnhZLn.exe
2784	oCwlUDf.exe
1536	rIOWbhL.exe
2704	RtHnCXs.exe
1524	vghaajb.exe
2932	FbgsyTn.exe
1592	bbBwQdB.exe
2320	mWhfKZf.exe
2756	hoHvroH.exe
1696	ajPteIx.exe
2772	gXoIciI.exe
1768	KPIpEVh.exe
772	jQSNbac.exe
932	LddkEuq.exe
2276	GnmlUsv.exe
1140	AGolKKg.exe
948	ctqvCIT.exe
888	tObGhvF.exe
1112	cirnJTu.exe
1544	qzRHhwB.exe
1048	feGbEBX.exe
1636	pDYUyvN.exe
2728	ffxhMRn.exe
2988	UJJLnMN.exe
1644	DPcFEHQ.exe
912	AeJjolw.exe
680	BJuweDO.exe
1564	rygoABz.exe
1692	QBUusAy.exe
292	KkhpjCv.exe
1672	nnYgcMd.exe
796	qNRFhhx.exe
352	VeLvQMU.exe
2888	IDymdeo.exe
1712	glPcfBn.exe
2040	xUGAeLN.exe
2636	drOCrJB.exe
1724	ifAOVmo.exe
1612	PcXkJjm.exe
1248	yeuKlYq.exe
2576	GGCMgEK.exe
2584	XbaoZJw.exe
2496	oBQennv.exe
2692	aBlBoTC.exe
2916	KsXyRUc.exe
2640	OQiPouN.exe
2324	xpdSmTz.exe
1448	yfMrKdx.exe
308	BHjngLW.exe
2236	nFqgBeL.exe
544	BWbzcbx.exe
3032	WtcusCR.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-2-0x000000013F1B0000-0x000000013F5A6000-memory.dmp	upx
behavioral1/files/0x000d000000014713-8.dat	upx
behavioral1/files/0x0016000000005586-15.dat	upx
behavioral1/files/0x0016000000005586-12.dat	upx
behavioral1/files/0x00090000000153ee-14.dat	upx
behavioral1/files/0x00090000000153ee-19.dat	upx
behavioral1/files/0x000700000001565a-23.dat	upx
behavioral1/files/0x0007000000015662-28.dat	upx
behavioral1/files/0x0007000000015662-31.dat	upx
behavioral1/files/0x00070000000158d9-35.dat	upx
behavioral1/files/0x00070000000158d9-33.dat	upx
behavioral1/files/0x0007000000015ae3-44.dat	upx
behavioral1/files/0x0006000000016013-73.dat	upx
behavioral1/files/0x00060000000164ec-87.dat	upx
behavioral1/files/0x00060000000164ec-92.dat	upx
behavioral1/files/0x00060000000167bf-104.dat	upx
behavioral1/memory/2708-135-0x000000013F490000-0x000000013F886000-memory.dmp	upx
behavioral1/memory/2560-144-0x000000013F380000-0x000000013F776000-memory.dmp	upx
behavioral1/memory/2620-148-0x000000013F360000-0x000000013F756000-memory.dmp	upx
behavioral1/memory/2524-151-0x000000013F770000-0x000000013FB66000-memory.dmp	upx
behavioral1/memory/2972-154-0x000000013FD80000-0x0000000140176000-memory.dmp	upx
behavioral1/files/0x0006000000016cfd-192.dat	upx
behavioral1/files/0x0006000000016cf3-177.dat	upx
behavioral1/memory/2460-150-0x000000013FAC0000-0x000000013FEB6000-memory.dmp	upx
behavioral1/memory/2676-116-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/memory/2580-125-0x000000013FDA0000-0x0000000140196000-memory.dmp	upx
behavioral1/memory/2652-108-0x000000013F500000-0x000000013F8F6000-memory.dmp	upx
behavioral1/memory/2564-133-0x000000013FF50000-0x0000000140346000-memory.dmp	upx
behavioral1/files/0x0006000000016575-93.dat	upx
behavioral1/memory/2076-86-0x000000013FAA0000-0x000000013FE96000-memory.dmp	upx
behavioral1/files/0x0006000000015fa6-85.dat	upx
behavioral1/files/0x00060000000163eb-82.dat	upx
behavioral1/files/0x0006000000015f23-72.dat	upx
behavioral1/files/0x0006000000016013-68.dat	upx
behavioral1/files/0x0006000000015f23-57.dat	upx
behavioral1/files/0x0007000000015d85-48.dat	upx
behavioral1/files/0x000700000001565a-25.dat	upx
behavioral1/memory/2652-7182-0x000000013F500000-0x000000013F8F6000-memory.dmp	upx
behavioral1/memory/2972-7209-0x000000013FD80000-0x0000000140176000-memory.dmp	upx
behavioral1/memory/2580-7215-0x000000013FDA0000-0x0000000140196000-memory.dmp	upx
behavioral1/memory/2708-7214-0x000000013F490000-0x000000013F886000-memory.dmp	upx
behavioral1/memory/2564-7211-0x000000013FF50000-0x0000000140346000-memory.dmp	upx
behavioral1/memory/2676-7208-0x000000013FE10000-0x0000000140206000-memory.dmp	upx
behavioral1/memory/2524-7192-0x000000013F770000-0x000000013FB66000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TWiMKIq.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\HQyhHKh.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\sVGKkdi.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\hQhAveF.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\QwjWFcX.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\pnWTjer.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\zVTiigO.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\aFHxzdH.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\VbewTCg.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\OZrvtpp.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\qOnpaWa.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\bENiswt.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\TlwEWSa.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\kilOnVT.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\YixDWpw.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\meqyfhQ.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\rwDhRux.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\HFSynug.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\PspHltK.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\VEqZkvM.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\fBNwDji.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\UOPuyQP.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\kcLlkqL.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\XoxwFsW.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\uaTbjyq.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\FzRdFjU.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\olELOEQ.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\tRmrSGv.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\UGjedTq.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\OseNVuz.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\gksATOs.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\HSASlMW.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\FSgpllw.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\WlLrrCy.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\hHvkpab.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\NcmlgdP.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\htSpdJp.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\ZUHtEPd.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\IlDBWTf.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\YVDzROX.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\vbIVAbf.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\EgALSpb.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\ioGiqNr.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\zMrBSqL.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\rlWkwPk.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\ZxYKlvf.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\HynxsUK.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\UPBOEqJ.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\dQATwrE.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\VfrrUpy.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\UxENSJP.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\jxbkDox.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\pBaXGKD.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\mxuxVmL.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\SRLTQsw.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\UryqzEh.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\DJpztmG.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\qCZGvtL.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\jGbLzIH.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\UwhCGbW.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\USSFcCT.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\zJuIEIw.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\TBEWzCj.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
File created	C:\Windows\System\OiXOQIp.exe	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1052	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1052	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	29
PID 1688 wrote to memory of 1052	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	29
PID 1688 wrote to memory of 1052	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	29
PID 1688 wrote to memory of 2076	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	30
PID 1688 wrote to memory of 2076	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	30
PID 1688 wrote to memory of 2076	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	30
PID 1688 wrote to memory of 2652	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	31
PID 1688 wrote to memory of 2652	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	31
PID 1688 wrote to memory of 2652	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	31
PID 1688 wrote to memory of 2676	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	32
PID 1688 wrote to memory of 2676	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	32
PID 1688 wrote to memory of 2676	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	32
PID 1688 wrote to memory of 2580	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	33
PID 1688 wrote to memory of 2580	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	33
PID 1688 wrote to memory of 2580	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	33
PID 1688 wrote to memory of 2564	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	34
PID 1688 wrote to memory of 2564	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	34
PID 1688 wrote to memory of 2564	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	34
PID 1688 wrote to memory of 2708	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	35
PID 1688 wrote to memory of 2708	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	35
PID 1688 wrote to memory of 2708	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	35
PID 1688 wrote to memory of 2560	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	36
PID 1688 wrote to memory of 2560	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	36
PID 1688 wrote to memory of 2560	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	36
PID 1688 wrote to memory of 2620	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	37
PID 1688 wrote to memory of 2620	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	37
PID 1688 wrote to memory of 2620	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	37
PID 1688 wrote to memory of 2460	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	38
PID 1688 wrote to memory of 2460	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	38
PID 1688 wrote to memory of 2460	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	38
PID 1688 wrote to memory of 2524	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	39
PID 1688 wrote to memory of 2524	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	39
PID 1688 wrote to memory of 2524	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	39
PID 1688 wrote to memory of 2972	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	40
PID 1688 wrote to memory of 2972	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	40
PID 1688 wrote to memory of 2972	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	40
PID 1688 wrote to memory of 800	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	41
PID 1688 wrote to memory of 800	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	41
PID 1688 wrote to memory of 800	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	41
PID 1688 wrote to memory of 2744	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	42
PID 1688 wrote to memory of 2744	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	42
PID 1688 wrote to memory of 2744	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	42
PID 1688 wrote to memory of 2704	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	43
PID 1688 wrote to memory of 2704	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	43
PID 1688 wrote to memory of 2704	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	43
PID 1688 wrote to memory of 2784	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	44
PID 1688 wrote to memory of 2784	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	44
PID 1688 wrote to memory of 2784	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	44
PID 1688 wrote to memory of 2932	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	45
PID 1688 wrote to memory of 2932	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	45
PID 1688 wrote to memory of 2932	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	45
PID 1688 wrote to memory of 1536	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	46
PID 1688 wrote to memory of 1536	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	46
PID 1688 wrote to memory of 1536	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	46
PID 1688 wrote to memory of 1592	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	47
PID 1688 wrote to memory of 1592	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	47
PID 1688 wrote to memory of 1592	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	47
PID 1688 wrote to memory of 1524	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	48
PID 1688 wrote to memory of 1524	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	48
PID 1688 wrote to memory of 1524	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	48
PID 1688 wrote to memory of 2320	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	49
PID 1688 wrote to memory of 2320	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	49
PID 1688 wrote to memory of 2320	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	49
PID 1688 wrote to memory of 2756	1688	3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3be467544252ab37e40443f20ae24700_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\System\PrjqXEw.exe
  C:\Windows\System\PrjqXEw.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\ZKrpcga.exe
  C:\Windows\System\ZKrpcga.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\zoytaxq.exe
  C:\Windows\System\zoytaxq.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\gCtsEtW.exe
  C:\Windows\System\gCtsEtW.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\fJnKzro.exe
  C:\Windows\System\fJnKzro.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\caoZnWp.exe
  C:\Windows\System\caoZnWp.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\KMFxKUw.exe
  C:\Windows\System\KMFxKUw.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ZQBNqMx.exe
  C:\Windows\System\ZQBNqMx.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\KyQaHmL.exe
  C:\Windows\System\KyQaHmL.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\ROByLyo.exe
  C:\Windows\System\ROByLyo.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\qtErurt.exe
  C:\Windows\System\qtErurt.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\cFnhZLn.exe
  C:\Windows\System\cFnhZLn.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\vUMWGro.exe
  C:\Windows\System\vUMWGro.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\RtHnCXs.exe
  C:\Windows\System\RtHnCXs.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\oCwlUDf.exe
  C:\Windows\System\oCwlUDf.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\FbgsyTn.exe
  C:\Windows\System\FbgsyTn.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\rIOWbhL.exe
  C:\Windows\System\rIOWbhL.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\bbBwQdB.exe
  C:\Windows\System\bbBwQdB.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\vghaajb.exe
  C:\Windows\System\vghaajb.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\mWhfKZf.exe
  C:\Windows\System\mWhfKZf.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\hoHvroH.exe
  C:\Windows\System\hoHvroH.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\gXoIciI.exe
  C:\Windows\System\gXoIciI.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\ajPteIx.exe
  C:\Windows\System\ajPteIx.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\KPIpEVh.exe
  C:\Windows\System\KPIpEVh.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\jQSNbac.exe
  C:\Windows\System\jQSNbac.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\LddkEuq.exe
  C:\Windows\System\LddkEuq.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\GnmlUsv.exe
  C:\Windows\System\GnmlUsv.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\AGolKKg.exe
  C:\Windows\System\AGolKKg.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\ctqvCIT.exe
  C:\Windows\System\ctqvCIT.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\cirnJTu.exe
  C:\Windows\System\cirnJTu.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\tObGhvF.exe
  C:\Windows\System\tObGhvF.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\qzRHhwB.exe
  C:\Windows\System\qzRHhwB.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\feGbEBX.exe
  C:\Windows\System\feGbEBX.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\pDYUyvN.exe
  C:\Windows\System\pDYUyvN.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ffxhMRn.exe
  C:\Windows\System\ffxhMRn.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\UJJLnMN.exe
  C:\Windows\System\UJJLnMN.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\DPcFEHQ.exe
  C:\Windows\System\DPcFEHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\AeJjolw.exe
  C:\Windows\System\AeJjolw.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\BJuweDO.exe
  C:\Windows\System\BJuweDO.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\rygoABz.exe
  C:\Windows\System\rygoABz.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\QBUusAy.exe
  C:\Windows\System\QBUusAy.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\KkhpjCv.exe
  C:\Windows\System\KkhpjCv.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\nnYgcMd.exe
  C:\Windows\System\nnYgcMd.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qNRFhhx.exe
  C:\Windows\System\qNRFhhx.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\VeLvQMU.exe
  C:\Windows\System\VeLvQMU.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\IDymdeo.exe
  C:\Windows\System\IDymdeo.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\glPcfBn.exe
  C:\Windows\System\glPcfBn.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\xUGAeLN.exe
  C:\Windows\System\xUGAeLN.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\drOCrJB.exe
  C:\Windows\System\drOCrJB.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\ifAOVmo.exe
  C:\Windows\System\ifAOVmo.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\PcXkJjm.exe
  C:\Windows\System\PcXkJjm.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\yeuKlYq.exe
  C:\Windows\System\yeuKlYq.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\aBlBoTC.exe
  C:\Windows\System\aBlBoTC.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\GGCMgEK.exe
  C:\Windows\System\GGCMgEK.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\OQiPouN.exe
  C:\Windows\System\OQiPouN.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\XbaoZJw.exe
  C:\Windows\System\XbaoZJw.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\khDqtKb.exe
  C:\Windows\System\khDqtKb.exe
  2⤵
  PID:2456
- C:\Windows\System\oBQennv.exe
  C:\Windows\System\oBQennv.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\yDhEWPw.exe
  C:\Windows\System\yDhEWPw.exe
  2⤵
  PID:2944
- C:\Windows\System\KsXyRUc.exe
  C:\Windows\System\KsXyRUc.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\gLQknAr.exe
  C:\Windows\System\gLQknAr.exe
  2⤵
  PID:1432
- C:\Windows\System\xpdSmTz.exe
  C:\Windows\System\xpdSmTz.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\rlqAioT.exe
  C:\Windows\System\rlqAioT.exe
  2⤵
  PID:1764
- C:\Windows\System\yfMrKdx.exe
  C:\Windows\System\yfMrKdx.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\ABDUsmF.exe
  C:\Windows\System\ABDUsmF.exe
  2⤵
  PID:1932
- C:\Windows\System\BHjngLW.exe
  C:\Windows\System\BHjngLW.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\xKOHJjH.exe
  C:\Windows\System\xKOHJjH.exe
  2⤵
  PID:864
- C:\Windows\System\nFqgBeL.exe
  C:\Windows\System\nFqgBeL.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\qwSAcBj.exe
  C:\Windows\System\qwSAcBj.exe
  2⤵
  PID:2132
- C:\Windows\System\BWbzcbx.exe
  C:\Windows\System\BWbzcbx.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\VSHckod.exe
  C:\Windows\System\VSHckod.exe
  2⤵
  PID:1684
- C:\Windows\System\WtcusCR.exe
  C:\Windows\System\WtcusCR.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VRyaefQ.exe
  C:\Windows\System\VRyaefQ.exe
  2⤵
  PID:1780
- C:\Windows\System\LKBjXIS.exe
  C:\Windows\System\LKBjXIS.exe
  2⤵
  PID:1804
- C:\Windows\System\FHRYubG.exe
  C:\Windows\System\FHRYubG.exe
  2⤵
  PID:2556
- C:\Windows\System\iAAfqEz.exe
  C:\Windows\System\iAAfqEz.exe
  2⤵
  PID:1660
- C:\Windows\System\ycNdeHC.exe
  C:\Windows\System\ycNdeHC.exe
  2⤵
  PID:916
- C:\Windows\System\XMQxpir.exe
  C:\Windows\System\XMQxpir.exe
  2⤵
  PID:1676
- C:\Windows\System\knKzfMj.exe
  C:\Windows\System\knKzfMj.exe
  2⤵
  PID:1872
- C:\Windows\System\QFfiKty.exe
  C:\Windows\System\QFfiKty.exe
  2⤵
  PID:2848
- C:\Windows\System\HNgAwfz.exe
  C:\Windows\System\HNgAwfz.exe
  2⤵
  PID:1156
- C:\Windows\System\qUDoInZ.exe
  C:\Windows\System\qUDoInZ.exe
  2⤵
  PID:2956
- C:\Windows\System\bFOlEWN.exe
  C:\Windows\System\bFOlEWN.exe
  2⤵
  PID:1032
- C:\Windows\System\aljuZFO.exe
  C:\Windows\System\aljuZFO.exe
  2⤵
  PID:2896
- C:\Windows\System\LKVibwo.exe
  C:\Windows\System\LKVibwo.exe
  2⤵
  PID:2664
- C:\Windows\System\BsuRVbD.exe
  C:\Windows\System\BsuRVbD.exe
  2⤵
  PID:2920
- C:\Windows\System\WcENNcL.exe
  C:\Windows\System\WcENNcL.exe
  2⤵
  PID:2100
- C:\Windows\System\fgqZWmd.exe
  C:\Windows\System\fgqZWmd.exe
  2⤵
  PID:1336
- C:\Windows\System\emcOQhG.exe
  C:\Windows\System\emcOQhG.exe
  2⤵
  PID:632
- C:\Windows\System\ODFBIUd.exe
  C:\Windows\System\ODFBIUd.exe
  2⤵
  PID:3048
- C:\Windows\System\BOndxwg.exe
  C:\Windows\System\BOndxwg.exe
  2⤵
  PID:2808
- C:\Windows\System\AcIfUoL.exe
  C:\Windows\System\AcIfUoL.exe
  2⤵
  PID:1952
- C:\Windows\System\KGWtuDl.exe
  C:\Windows\System\KGWtuDl.exe
  2⤵
  PID:1444
- C:\Windows\System\fsfSJUl.exe
  C:\Windows\System\fsfSJUl.exe
  2⤵
  PID:2256
- C:\Windows\System\glvRzYw.exe
  C:\Windows\System\glvRzYw.exe
  2⤵
  PID:2272
- C:\Windows\System\YtDPpEa.exe
  C:\Windows\System\YtDPpEa.exe
  2⤵
  PID:1096
- C:\Windows\System\EGFLfqR.exe
  C:\Windows\System\EGFLfqR.exe
  2⤵
  PID:2016
- C:\Windows\System\zucAlRK.exe
  C:\Windows\System\zucAlRK.exe
  2⤵
  PID:1956
- C:\Windows\System\ywJLevF.exe
  C:\Windows\System\ywJLevF.exe
  2⤵
  PID:1308
- C:\Windows\System\cOpNakP.exe
  C:\Windows\System\cOpNakP.exe
  2⤵
  PID:1864
- C:\Windows\System\zuKUGrf.exe
  C:\Windows\System\zuKUGrf.exe
  2⤵
  PID:2984
- C:\Windows\System\CXgaXcU.exe
  C:\Windows\System\CXgaXcU.exe
  2⤵
  PID:2308
- C:\Windows\System\jblPHay.exe
  C:\Windows\System\jblPHay.exe
  2⤵
  PID:2480
- C:\Windows\System\KdIMpuM.exe
  C:\Windows\System\KdIMpuM.exe
  2⤵
  PID:2492
- C:\Windows\System\GjnicLm.exe
  C:\Windows\System\GjnicLm.exe
  2⤵
  PID:2112
- C:\Windows\System\EBLnbSd.exe
  C:\Windows\System\EBLnbSd.exe
  2⤵
  PID:2608
- C:\Windows\System\FJwtZvN.exe
  C:\Windows\System\FJwtZvN.exe
  2⤵
  PID:2912
- C:\Windows\System\IQjPVSO.exe
  C:\Windows\System\IQjPVSO.exe
  2⤵
  PID:2844
- C:\Windows\System\SGYFHIv.exe
  C:\Windows\System\SGYFHIv.exe
  2⤵
  PID:2352
- C:\Windows\System\KqQYYmK.exe
  C:\Windows\System\KqQYYmK.exe
  2⤵
  PID:1856
- C:\Windows\System\MMNEnRL.exe
  C:\Windows\System\MMNEnRL.exe
  2⤵
  PID:2192
- C:\Windows\System\czPvzPO.exe
  C:\Windows\System\czPvzPO.exe
  2⤵
  PID:2532
- C:\Windows\System\eRDKaaV.exe
  C:\Windows\System\eRDKaaV.exe
  2⤵
  PID:1796
- C:\Windows\System\cCqVtIB.exe
  C:\Windows\System\cCqVtIB.exe
  2⤵
  PID:1508
- C:\Windows\System\ULkylRh.exe
  C:\Windows\System\ULkylRh.exe
  2⤵
  PID:1608
- C:\Windows\System\fqXqRSJ.exe
  C:\Windows\System\fqXqRSJ.exe
  2⤵
  PID:2432
- C:\Windows\System\sjtOpNT.exe
  C:\Windows\System\sjtOpNT.exe
  2⤵
  PID:2996
- C:\Windows\System\AJzEOft.exe
  C:\Windows\System\AJzEOft.exe
  2⤵
  PID:3028
- C:\Windows\System\sWtHmnk.exe
  C:\Windows\System\sWtHmnk.exe
  2⤵
  PID:2280
- C:\Windows\System\uPBjmZV.exe
  C:\Windows\System\uPBjmZV.exe
  2⤵
  PID:1980
- C:\Windows\System\SeJvdxu.exe
  C:\Windows\System\SeJvdxu.exe
  2⤵
  PID:1368
- C:\Windows\System\fMmAoaB.exe
  C:\Windows\System\fMmAoaB.exe
  2⤵
  PID:1520
- C:\Windows\System\ViJNwxw.exe
  C:\Windows\System\ViJNwxw.exe
  2⤵
  PID:2440
- C:\Windows\System\oWIlTPy.exe
  C:\Windows\System\oWIlTPy.exe
  2⤵
  PID:2020
- C:\Windows\System\xOQBXOH.exe
  C:\Windows\System\xOQBXOH.exe
  2⤵
  PID:2732
- C:\Windows\System\vrqBegl.exe
  C:\Windows\System\vrqBegl.exe
  2⤵
  PID:1588
- C:\Windows\System\zGKwnvO.exe
  C:\Windows\System\zGKwnvO.exe
  2⤵
  PID:2160
- C:\Windows\System\gVDTDTF.exe
  C:\Windows\System\gVDTDTF.exe
  2⤵
  PID:1160
- C:\Windows\System\WjpekZT.exe
  C:\Windows\System\WjpekZT.exe
  2⤵
  PID:3092
- C:\Windows\System\EhDLeCh.exe
  C:\Windows\System\EhDLeCh.exe
  2⤵
  PID:3112
- C:\Windows\System\bhecnoe.exe
  C:\Windows\System\bhecnoe.exe
  2⤵
  PID:3132
- C:\Windows\System\rvCNZQh.exe
  C:\Windows\System\rvCNZQh.exe
  2⤵
  PID:3148
- C:\Windows\System\NLaoOfd.exe
  C:\Windows\System\NLaoOfd.exe
  2⤵
  PID:3164
- C:\Windows\System\oEJdYUu.exe
  C:\Windows\System\oEJdYUu.exe
  2⤵
  PID:3184
- C:\Windows\System\qozvhIT.exe
  C:\Windows\System\qozvhIT.exe
  2⤵
  PID:3204
- C:\Windows\System\LHkSTfE.exe
  C:\Windows\System\LHkSTfE.exe
  2⤵
  PID:3224
- C:\Windows\System\ifWSxym.exe
  C:\Windows\System\ifWSxym.exe
  2⤵
  PID:3268
- C:\Windows\System\ZotWDKL.exe
  C:\Windows\System\ZotWDKL.exe
  2⤵
  PID:3284
- C:\Windows\System\PtHjzbV.exe
  C:\Windows\System\PtHjzbV.exe
  2⤵
  PID:3304
- C:\Windows\System\fqjprmb.exe
  C:\Windows\System\fqjprmb.exe
  2⤵
  PID:3320
- C:\Windows\System\seqPgSX.exe
  C:\Windows\System\seqPgSX.exe
  2⤵
  PID:3336
- C:\Windows\System\cyzDnzv.exe
  C:\Windows\System\cyzDnzv.exe
  2⤵
  PID:3356
- C:\Windows\System\tsXChun.exe
  C:\Windows\System\tsXChun.exe
  2⤵
  PID:3372
- C:\Windows\System\fNTygvO.exe
  C:\Windows\System\fNTygvO.exe
  2⤵
  PID:3392
- C:\Windows\System\xAdSpCo.exe
  C:\Windows\System\xAdSpCo.exe
  2⤵
  PID:3412
- C:\Windows\System\KmeWCMz.exe
  C:\Windows\System\KmeWCMz.exe
  2⤵
  PID:3428
- C:\Windows\System\LrrmgoS.exe
  C:\Windows\System\LrrmgoS.exe
  2⤵
  PID:3448
- C:\Windows\System\sjDETxt.exe
  C:\Windows\System\sjDETxt.exe
  2⤵
  PID:3504
- C:\Windows\System\lxHEQcZ.exe
  C:\Windows\System\lxHEQcZ.exe
  2⤵
  PID:3520
- C:\Windows\System\zwTXVVH.exe
  C:\Windows\System\zwTXVVH.exe
  2⤵
  PID:3536
- C:\Windows\System\nxQVHGx.exe
  C:\Windows\System\nxQVHGx.exe
  2⤵
  PID:3552
- C:\Windows\System\wiuOytv.exe
  C:\Windows\System\wiuOytv.exe
  2⤵
  PID:3568
- C:\Windows\System\gLQbUFY.exe
  C:\Windows\System\gLQbUFY.exe
  2⤵
  PID:3584
- C:\Windows\System\JiNHGpf.exe
  C:\Windows\System\JiNHGpf.exe
  2⤵
  PID:3604
- C:\Windows\System\ciBkcsk.exe
  C:\Windows\System\ciBkcsk.exe
  2⤵
  PID:3624
- C:\Windows\System\pBTKmvX.exe
  C:\Windows\System\pBTKmvX.exe
  2⤵
  PID:3640
- C:\Windows\System\QoKNgRN.exe
  C:\Windows\System\QoKNgRN.exe
  2⤵
  PID:3660
- C:\Windows\System\IRqCMqS.exe
  C:\Windows\System\IRqCMqS.exe
  2⤵
  PID:3676
- C:\Windows\System\tQWHFmz.exe
  C:\Windows\System\tQWHFmz.exe
  2⤵
  PID:3692
- C:\Windows\System\OvVknjW.exe
  C:\Windows\System\OvVknjW.exe
  2⤵
  PID:3708
- C:\Windows\System\PtSzxzH.exe
  C:\Windows\System\PtSzxzH.exe
  2⤵
  PID:3752
- C:\Windows\System\QysrZvC.exe
  C:\Windows\System\QysrZvC.exe
  2⤵
  PID:3772
- C:\Windows\System\aORmKQy.exe
  C:\Windows\System\aORmKQy.exe
  2⤵
  PID:3792
- C:\Windows\System\pdEcoRq.exe
  C:\Windows\System\pdEcoRq.exe
  2⤵
  PID:3812
- C:\Windows\System\ViMxFjE.exe
  C:\Windows\System\ViMxFjE.exe
  2⤵
  PID:3828
- C:\Windows\System\CvZKtYK.exe
  C:\Windows\System\CvZKtYK.exe
  2⤵
  PID:3844
- C:\Windows\System\aVnKxvO.exe
  C:\Windows\System\aVnKxvO.exe
  2⤵
  PID:3864
- C:\Windows\System\EZdHPno.exe
  C:\Windows\System\EZdHPno.exe
  2⤵
  PID:3912
- C:\Windows\System\ltsKzqy.exe
  C:\Windows\System\ltsKzqy.exe
  2⤵
  PID:3928
- C:\Windows\System\uDKnohd.exe
  C:\Windows\System\uDKnohd.exe
  2⤵
  PID:3948
- C:\Windows\System\WEUtsYL.exe
  C:\Windows\System\WEUtsYL.exe
  2⤵
  PID:3964
- C:\Windows\System\rBvoWoN.exe
  C:\Windows\System\rBvoWoN.exe
  2⤵
  PID:4000
- C:\Windows\System\WqleMqV.exe
  C:\Windows\System\WqleMqV.exe
  2⤵
  PID:4016
- C:\Windows\System\tUwDyTs.exe
  C:\Windows\System\tUwDyTs.exe
  2⤵
  PID:4032
- C:\Windows\System\SjJZndz.exe
  C:\Windows\System\SjJZndz.exe
  2⤵
  PID:4048
- C:\Windows\System\SrRgqCK.exe
  C:\Windows\System\SrRgqCK.exe
  2⤵
  PID:4064
- C:\Windows\System\YezeEAa.exe
  C:\Windows\System\YezeEAa.exe
  2⤵
  PID:4084
- C:\Windows\System\kLqztsl.exe
  C:\Windows\System\kLqztsl.exe
  2⤵
  PID:2900
- C:\Windows\System\qPGewfb.exe
  C:\Windows\System\qPGewfb.exe
  2⤵
  PID:3120
- C:\Windows\System\eafnBmB.exe
  C:\Windows\System\eafnBmB.exe
  2⤵
  PID:3160
- C:\Windows\System\WPRxcqz.exe
  C:\Windows\System\WPRxcqz.exe
  2⤵
  PID:2596
- C:\Windows\System\Dznztkh.exe
  C:\Windows\System\Dznztkh.exe
  2⤵
  PID:3216
- C:\Windows\System\xWyzktZ.exe
  C:\Windows\System\xWyzktZ.exe
  2⤵
  PID:3212
- C:\Windows\System\gAZkxEV.exe
  C:\Windows\System\gAZkxEV.exe
  2⤵
  PID:3052
- C:\Windows\System\qfyURqT.exe
  C:\Windows\System\qfyURqT.exe
  2⤵
  PID:3176
- C:\Windows\System\dDhjrpO.exe
  C:\Windows\System\dDhjrpO.exe
  2⤵
  PID:3264
- C:\Windows\System\XLFBYSQ.exe
  C:\Windows\System\XLFBYSQ.exe
  2⤵
  PID:3296
- C:\Windows\System\gKZXcjQ.exe
  C:\Windows\System\gKZXcjQ.exe
  2⤵
  PID:3408
- C:\Windows\System\drEAcsY.exe
  C:\Windows\System\drEAcsY.exe
  2⤵
  PID:3276
- C:\Windows\System\PfqIVyM.exe
  C:\Windows\System\PfqIVyM.exe
  2⤵
  PID:3344
- C:\Windows\System\pGhhfkG.exe
  C:\Windows\System\pGhhfkG.exe
  2⤵
  PID:3380
- C:\Windows\System\tUwyZwo.exe
  C:\Windows\System\tUwyZwo.exe
  2⤵
  PID:3460
- C:\Windows\System\mXKoRFV.exe
  C:\Windows\System\mXKoRFV.exe
  2⤵
  PID:3512
- C:\Windows\System\ngbdNbC.exe
  C:\Windows\System\ngbdNbC.exe
  2⤵
  PID:3580
- C:\Windows\System\ciuCpFQ.exe
  C:\Windows\System\ciuCpFQ.exe
  2⤵
  PID:3616
- C:\Windows\System\BIYpJcU.exe
  C:\Windows\System\BIYpJcU.exe
  2⤵
  PID:3672
- C:\Windows\System\EMLCqjl.exe
  C:\Windows\System\EMLCqjl.exe
  2⤵
  PID:3724
- C:\Windows\System\xqqGNHL.exe
  C:\Windows\System\xqqGNHL.exe
  2⤵
  PID:3684
- C:\Windows\System\UGzayFS.exe
  C:\Windows\System\UGzayFS.exe
  2⤵
  PID:3784
- C:\Windows\System\DuJLUnp.exe
  C:\Windows\System\DuJLUnp.exe
  2⤵
  PID:3856
- C:\Windows\System\kAFeAKh.exe
  C:\Windows\System\kAFeAKh.exe
  2⤵
  PID:3956
- C:\Windows\System\aHWHeOb.exe
  C:\Windows\System\aHWHeOb.exe
  2⤵
  PID:3760
- C:\Windows\System\MBagmiz.exe
  C:\Windows\System\MBagmiz.exe
  2⤵
  PID:3804
- C:\Windows\System\dspGrZo.exe
  C:\Windows\System\dspGrZo.exe
  2⤵
  PID:3872
- C:\Windows\System\GljnLQT.exe
  C:\Windows\System\GljnLQT.exe
  2⤵
  PID:4080
- C:\Windows\System\CnQStwc.exe
  C:\Windows\System\CnQStwc.exe
  2⤵
  PID:3200
- C:\Windows\System\IEeBvlE.exe
  C:\Windows\System\IEeBvlE.exe
  2⤵
  PID:3100
- C:\Windows\System\mpPEUPK.exe
  C:\Windows\System\mpPEUPK.exe
  2⤵
  PID:3444
- C:\Windows\System\oWdEJXR.exe
  C:\Windows\System\oWdEJXR.exe
  2⤵
  PID:3384
- C:\Windows\System\QJmLGcg.exe
  C:\Windows\System\QJmLGcg.exe
  2⤵
  PID:3480
- C:\Windows\System\KytNxlS.exe
  C:\Windows\System\KytNxlS.exe
  2⤵
  PID:3064
- C:\Windows\System\MMyLNPB.exe
  C:\Windows\System\MMyLNPB.exe
  2⤵
  PID:3904
- C:\Windows\System\vNesYeY.exe
  C:\Windows\System\vNesYeY.exe
  2⤵
  PID:3976
- C:\Windows\System\XUKFlII.exe
  C:\Windows\System\XUKFlII.exe
  2⤵
  PID:3548
- C:\Windows\System\mtzxFZg.exe
  C:\Windows\System\mtzxFZg.exe
  2⤵
  PID:2172
- C:\Windows\System\kJOiAUc.exe
  C:\Windows\System\kJOiAUc.exe
  2⤵
  PID:3240
- C:\Windows\System\OjeDkCH.exe
  C:\Windows\System\OjeDkCH.exe
  2⤵
  PID:3252
- C:\Windows\System\bbyUaaT.exe
  C:\Windows\System\bbyUaaT.exe
  2⤵
  PID:2716
- C:\Windows\System\eoQYhHr.exe
  C:\Windows\System\eoQYhHr.exe
  2⤵
  PID:3400
- C:\Windows\System\TlxpHrY.exe
  C:\Windows\System\TlxpHrY.exe
  2⤵
  PID:3420
- C:\Windows\System\CTHncCk.exe
  C:\Windows\System\CTHncCk.exe
  2⤵
  PID:3500
- C:\Windows\System\DtXBvtz.exe
  C:\Windows\System\DtXBvtz.exe
  2⤵
  PID:3560
- C:\Windows\System\TBEWzCj.exe
  C:\Windows\System\TBEWzCj.exe
  2⤵
  PID:3600
- C:\Windows\System\bLgsGeo.exe
  C:\Windows\System\bLgsGeo.exe
  2⤵
  PID:3668
- C:\Windows\System\MfPrbSV.exe
  C:\Windows\System\MfPrbSV.exe
  2⤵
  PID:3716
- C:\Windows\System\IswdUYE.exe
  C:\Windows\System\IswdUYE.exe
  2⤵
  PID:4044
- C:\Windows\System\hheUMDd.exe
  C:\Windows\System\hheUMDd.exe
  2⤵
  PID:3088
- C:\Windows\System\IkuuSDZ.exe
  C:\Windows\System\IkuuSDZ.exe
  2⤵
  PID:3612
- C:\Windows\System\QEzsitY.exe
  C:\Windows\System\QEzsitY.exe
  2⤵
  PID:3944
- C:\Windows\System\vaJWDJP.exe
  C:\Windows\System\vaJWDJP.exe
  2⤵
  PID:4104
- C:\Windows\System\UezhiBT.exe
  C:\Windows\System\UezhiBT.exe
  2⤵
  PID:4120
- C:\Windows\System\mniznun.exe
  C:\Windows\System\mniznun.exe
  2⤵
  PID:4136
- C:\Windows\System\bGEmyGb.exe
  C:\Windows\System\bGEmyGb.exe
  2⤵
  PID:4152
- C:\Windows\System\DrRVrnp.exe
  C:\Windows\System\DrRVrnp.exe
  2⤵
  PID:4168
- C:\Windows\System\sdZAQcd.exe
  C:\Windows\System\sdZAQcd.exe
  2⤵
  PID:4184
- C:\Windows\System\UubKaAI.exe
  C:\Windows\System\UubKaAI.exe
  2⤵
  PID:4200
- C:\Windows\System\JzPdqUm.exe
  C:\Windows\System\JzPdqUm.exe
  2⤵
  PID:4216
- C:\Windows\System\Ssjxgdj.exe
  C:\Windows\System\Ssjxgdj.exe
  2⤵
  PID:4232
- C:\Windows\System\WQXKPPk.exe
  C:\Windows\System\WQXKPPk.exe
  2⤵
  PID:4380
- C:\Windows\System\lrErukJ.exe
  C:\Windows\System\lrErukJ.exe
  2⤵
  PID:4396
- C:\Windows\System\JpOvOHk.exe
  C:\Windows\System\JpOvOHk.exe
  2⤵
  PID:4412
- C:\Windows\System\RJqHQor.exe
  C:\Windows\System\RJqHQor.exe
  2⤵
  PID:4428
- C:\Windows\System\vNMosPk.exe
  C:\Windows\System\vNMosPk.exe
  2⤵
  PID:4448
- C:\Windows\System\CQdfFaN.exe
  C:\Windows\System\CQdfFaN.exe
  2⤵
  PID:4464
- C:\Windows\System\DvWtMWF.exe
  C:\Windows\System\DvWtMWF.exe
  2⤵
  PID:4484
- C:\Windows\System\IHZLLJG.exe
  C:\Windows\System\IHZLLJG.exe
  2⤵
  PID:4504
- C:\Windows\System\uiiXWoy.exe
  C:\Windows\System\uiiXWoy.exe
  2⤵
  PID:4520
- C:\Windows\System\ShxbiGr.exe
  C:\Windows\System\ShxbiGr.exe
  2⤵
  PID:4536
- C:\Windows\System\MWadgAs.exe
  C:\Windows\System\MWadgAs.exe
  2⤵
  PID:4552
- C:\Windows\System\rkctEXq.exe
  C:\Windows\System\rkctEXq.exe
  2⤵
  PID:4568
- C:\Windows\System\dxOyxqW.exe
  C:\Windows\System\dxOyxqW.exe
  2⤵
  PID:4588
- C:\Windows\System\JCMChjj.exe
  C:\Windows\System\JCMChjj.exe
  2⤵
  PID:4604
- C:\Windows\System\MRRWOdJ.exe
  C:\Windows\System\MRRWOdJ.exe
  2⤵
  PID:4620
- C:\Windows\System\wLRcAlL.exe
  C:\Windows\System\wLRcAlL.exe
  2⤵
  PID:4636
- C:\Windows\System\wNWKSeG.exe
  C:\Windows\System\wNWKSeG.exe
  2⤵
  PID:4652
- C:\Windows\System\yopCVEJ.exe
  C:\Windows\System\yopCVEJ.exe
  2⤵
  PID:4668
- C:\Windows\System\QTtyUKg.exe
  C:\Windows\System\QTtyUKg.exe
  2⤵
  PID:4684
- C:\Windows\System\tEYhOMm.exe
  C:\Windows\System\tEYhOMm.exe
  2⤵
  PID:4700
- C:\Windows\System\JkMjmsx.exe
  C:\Windows\System\JkMjmsx.exe
  2⤵
  PID:4716
- C:\Windows\System\tMRCBBg.exe
  C:\Windows\System\tMRCBBg.exe
  2⤵
  PID:4736
- C:\Windows\System\WCNeMvU.exe
  C:\Windows\System\WCNeMvU.exe
  2⤵
  PID:4756
- C:\Windows\System\DbVsNXR.exe
  C:\Windows\System\DbVsNXR.exe
  2⤵
  PID:4772
- C:\Windows\System\syoCPPF.exe
  C:\Windows\System\syoCPPF.exe
  2⤵
  PID:4792
- C:\Windows\System\jiKHbqV.exe
  C:\Windows\System\jiKHbqV.exe
  2⤵
  PID:4880
- C:\Windows\System\kFyGDTo.exe
  C:\Windows\System\kFyGDTo.exe
  2⤵
  PID:4896
- C:\Windows\System\XrLSxSy.exe
  C:\Windows\System\XrLSxSy.exe
  2⤵
  PID:4912
- C:\Windows\System\FjVoPsw.exe
  C:\Windows\System\FjVoPsw.exe
  2⤵
  PID:4928
- C:\Windows\System\tkNgHZh.exe
  C:\Windows\System\tkNgHZh.exe
  2⤵
  PID:4948
- C:\Windows\System\vpdYISh.exe
  C:\Windows\System\vpdYISh.exe
  2⤵
  PID:4964
- C:\Windows\System\yjtEnzO.exe
  C:\Windows\System\yjtEnzO.exe
  2⤵
  PID:4984
- C:\Windows\System\EzEYgex.exe
  C:\Windows\System\EzEYgex.exe
  2⤵
  PID:5004
- C:\Windows\System\sOAkxzU.exe
  C:\Windows\System\sOAkxzU.exe
  2⤵
  PID:5020
- C:\Windows\System\NMDKkEL.exe
  C:\Windows\System\NMDKkEL.exe
  2⤵
  PID:5040
- C:\Windows\System\HmKGHoX.exe
  C:\Windows\System\HmKGHoX.exe
  2⤵
  PID:5056
- C:\Windows\System\xCfrApQ.exe
  C:\Windows\System\xCfrApQ.exe
  2⤵
  PID:5076
- C:\Windows\System\RkkRSCS.exe
  C:\Windows\System\RkkRSCS.exe
  2⤵
  PID:5096
- C:\Windows\System\giySZIy.exe
  C:\Windows\System\giySZIy.exe
  2⤵
  PID:5112
- C:\Windows\System\tmsXREp.exe
  C:\Windows\System\tmsXREp.exe
  2⤵
  PID:3236
- C:\Windows\System\mwktrMf.exe
  C:\Windows\System\mwktrMf.exe
  2⤵
  PID:3424
- C:\Windows\System\LJuUzOs.exe
  C:\Windows\System\LJuUzOs.exe
  2⤵
  PID:3704
- C:\Windows\System\jCDRzYq.exe
  C:\Windows\System\jCDRzYq.exe
  2⤵
  PID:4112
- C:\Windows\System\lgkCDFC.exe
  C:\Windows\System\lgkCDFC.exe
  2⤵
  PID:4176
- C:\Windows\System\kibfzcc.exe
  C:\Windows\System\kibfzcc.exe
  2⤵
  PID:4252
- C:\Windows\System\HgRowgW.exe
  C:\Windows\System\HgRowgW.exe
  2⤵
  PID:4272
- C:\Windows\System\zDgUOjG.exe
  C:\Windows\System\zDgUOjG.exe
  2⤵
  PID:4292
- C:\Windows\System\rsbNmpo.exe
  C:\Windows\System\rsbNmpo.exe
  2⤵
  PID:4256
- C:\Windows\System\nShtYaY.exe
  C:\Windows\System\nShtYaY.exe
  2⤵
  PID:3840
- C:\Windows\System\sgPBGrY.exe
  C:\Windows\System\sgPBGrY.exe
  2⤵
  PID:4328
- C:\Windows\System\yolwRqA.exe
  C:\Windows\System\yolwRqA.exe
  2⤵
  PID:4316
- C:\Windows\System\lfSsjUC.exe
  C:\Windows\System\lfSsjUC.exe
  2⤵
  PID:3732
- C:\Windows\System\AWoXfOP.exe
  C:\Windows\System\AWoXfOP.exe
  2⤵
  PID:3988
- C:\Windows\System\cWaNfSF.exe
  C:\Windows\System\cWaNfSF.exe
  2⤵
  PID:3084
- C:\Windows\System\aSHtYuy.exe
  C:\Windows\System\aSHtYuy.exe
  2⤵
  PID:564
- C:\Windows\System\OEzixUS.exe
  C:\Windows\System\OEzixUS.exe
  2⤵
  PID:3688
- C:\Windows\System\zqCIGgY.exe
  C:\Windows\System\zqCIGgY.exe
  2⤵
  PID:4372
- C:\Windows\System\kWLKsFw.exe
  C:\Windows\System\kWLKsFw.exe
  2⤵
  PID:4364
- C:\Windows\System\OiXOQIp.exe
  C:\Windows\System\OiXOQIp.exe
  2⤵
  PID:4444
- C:\Windows\System\ITNCsEC.exe
  C:\Windows\System\ITNCsEC.exe
  2⤵
  PID:4012
- C:\Windows\System\tLGEhkt.exe
  C:\Windows\System\tLGEhkt.exe
  2⤵
  PID:4100
- C:\Windows\System\LCMwRUH.exe
  C:\Windows\System\LCMwRUH.exe
  2⤵
  PID:4196
- C:\Windows\System\FSuSmhi.exe
  C:\Windows\System\FSuSmhi.exe
  2⤵
  PID:4512
- C:\Windows\System\pEJQxtb.exe
  C:\Windows\System\pEJQxtb.exe
  2⤵
  PID:4584
- C:\Windows\System\LgIzWiC.exe
  C:\Windows\System\LgIzWiC.exe
  2⤵
  PID:4708
- C:\Windows\System\jWEUIVe.exe
  C:\Windows\System\jWEUIVe.exe
  2⤵
  PID:4456
- C:\Windows\System\GYDHYDS.exe
  C:\Windows\System\GYDHYDS.exe
  2⤵
  PID:4528
- C:\Windows\System\psiYQzM.exe
  C:\Windows\System\psiYQzM.exe
  2⤵
  PID:4600
- C:\Windows\System\ocPdFjQ.exe
  C:\Windows\System\ocPdFjQ.exe
  2⤵
  PID:4660
- C:\Windows\System\MauoUoi.exe
  C:\Windows\System\MauoUoi.exe
  2⤵
  PID:4728
- C:\Windows\System\ktkAmlC.exe
  C:\Windows\System\ktkAmlC.exe
  2⤵
  PID:4800
- C:\Windows\System\zgPjIUw.exe
  C:\Windows\System\zgPjIUw.exe
  2⤵
  PID:4824
- C:\Windows\System\psZMUZr.exe
  C:\Windows\System\psZMUZr.exe
  2⤵
  PID:4844
- C:\Windows\System\MoNMcEU.exe
  C:\Windows\System\MoNMcEU.exe
  2⤵
  PID:4860
- C:\Windows\System\XJRiMXy.exe
  C:\Windows\System\XJRiMXy.exe
  2⤵
  PID:4876
- C:\Windows\System\JisFWcE.exe
  C:\Windows\System\JisFWcE.exe
  2⤵
  PID:4960
- C:\Windows\System\bgTuhti.exe
  C:\Windows\System\bgTuhti.exe
  2⤵
  PID:5036
- C:\Windows\System\gEBFSRn.exe
  C:\Windows\System\gEBFSRn.exe
  2⤵
  PID:5064
- C:\Windows\System\XgztSIw.exe
  C:\Windows\System\XgztSIw.exe
  2⤵
  PID:5108
- C:\Windows\System\DmKoqSP.exe
  C:\Windows\System\DmKoqSP.exe
  2⤵
  PID:3936
- C:\Windows\System\pDqXVSr.exe
  C:\Windows\System\pDqXVSr.exe
  2⤵
  PID:4284
- C:\Windows\System\DBCpCHV.exe
  C:\Windows\System\DBCpCHV.exe
  2⤵
  PID:4336
- C:\Windows\System\DynEIsP.exe
  C:\Windows\System\DynEIsP.exe
  2⤵
  PID:4324
- C:\Windows\System\blOYQTo.exe
  C:\Windows\System\blOYQTo.exe
  2⤵
  PID:4972
- C:\Windows\System\pnWuQqY.exe
  C:\Windows\System\pnWuQqY.exe
  2⤵
  PID:5052
- C:\Windows\System\OsRfwSo.exe
  C:\Windows\System\OsRfwSo.exe
  2⤵
  PID:4028
- C:\Windows\System\EQDJvOa.exe
  C:\Windows\System\EQDJvOa.exe
  2⤵
  PID:3780
- C:\Windows\System\rHfGsIk.exe
  C:\Windows\System\rHfGsIk.exe
  2⤵
  PID:3744
- C:\Windows\System\elddTnR.exe
  C:\Windows\System\elddTnR.exe
  2⤵
  PID:4076
- C:\Windows\System\WDcUbIP.exe
  C:\Windows\System\WDcUbIP.exe
  2⤵
  PID:3484
- C:\Windows\System\KMTCpdM.exe
  C:\Windows\System\KMTCpdM.exe
  2⤵
  PID:4268
- C:\Windows\System\UgZwrVT.exe
  C:\Windows\System\UgZwrVT.exe
  2⤵
  PID:4312
- C:\Windows\System\WpMJKVr.exe
  C:\Windows\System\WpMJKVr.exe
  2⤵
  PID:3528
- C:\Windows\System\ajISimr.exe
  C:\Windows\System\ajISimr.exe
  2⤵
  PID:4164
- C:\Windows\System\VmQYvGx.exe
  C:\Windows\System\VmQYvGx.exe
  2⤵
  PID:3836
- C:\Windows\System\HDQXcfU.exe
  C:\Windows\System\HDQXcfU.exe
  2⤵
  PID:4368
- C:\Windows\System\DFsXJvH.exe
  C:\Windows\System\DFsXJvH.exe
  2⤵
  PID:3472
- C:\Windows\System\ZViawaw.exe
  C:\Windows\System\ZViawaw.exe
  2⤵
  PID:4476
- C:\Windows\System\UEXJczq.exe
  C:\Windows\System\UEXJczq.exe
  2⤵
  PID:4712
- C:\Windows\System\BnHCOCF.exe
  C:\Windows\System\BnHCOCF.exe
  2⤵
  PID:4748
- C:\Windows\System\THeeQwp.exe
  C:\Windows\System\THeeQwp.exe
  2⤵
  PID:4648
- C:\Windows\System\UjsYjWv.exe
  C:\Windows\System\UjsYjWv.exe
  2⤵
  PID:1040
- C:\Windows\System\NgGybVi.exe
  C:\Windows\System\NgGybVi.exe
  2⤵
  PID:4632
- C:\Windows\System\IQBlxZj.exe
  C:\Windows\System\IQBlxZj.exe
  2⤵
  PID:4836
- C:\Windows\System\UmAuIpT.exe
  C:\Windows\System\UmAuIpT.exe
  2⤵
  PID:4868
- C:\Windows\System\jPPZIvW.exe
  C:\Windows\System\jPPZIvW.exe
  2⤵
  PID:4596
- C:\Windows\System\NEHSOUi.exe
  C:\Windows\System\NEHSOUi.exe
  2⤵
  PID:4852
- C:\Windows\System\nCeTuQE.exe
  C:\Windows\System\nCeTuQE.exe
  2⤵
  PID:5072
- C:\Windows\System\SaPwnNw.exe
  C:\Windows\System\SaPwnNw.exe
  2⤵
  PID:4276
- C:\Windows\System\tWAPojM.exe
  C:\Windows\System\tWAPojM.exe
  2⤵
  PID:4564
- C:\Windows\System\ExWidOO.exe
  C:\Windows\System\ExWidOO.exe
  2⤵
  PID:4056
- C:\Windows\System\JrmtUGi.exe
  C:\Windows\System\JrmtUGi.exe
  2⤵
  PID:4244
- C:\Windows\System\RmoxVcl.exe
  C:\Windows\System\RmoxVcl.exe
  2⤵
  PID:4356
- C:\Windows\System\YmPdsQA.exe
  C:\Windows\System\YmPdsQA.exe
  2⤵
  PID:3312
- C:\Windows\System\rQroSqE.exe
  C:\Windows\System\rQroSqE.exe
  2⤵
  PID:4744
- C:\Windows\System\YKAJZYt.exe
  C:\Windows\System\YKAJZYt.exe
  2⤵
  PID:4560
- C:\Windows\System\ObeVYET.exe
  C:\Windows\System\ObeVYET.exe
  2⤵
  PID:5032
- C:\Windows\System\fCBAEax.exe
  C:\Windows\System\fCBAEax.exe
  2⤵
  PID:4936
- C:\Windows\System\kFnFozD.exe
  C:\Windows\System\kFnFozD.exe
  2⤵
  PID:5124
- C:\Windows\System\DGQaKvR.exe
  C:\Windows\System\DGQaKvR.exe
  2⤵
  PID:5144
- C:\Windows\System\jpEcmwe.exe
  C:\Windows\System\jpEcmwe.exe
  2⤵
  PID:5160
- C:\Windows\System\NZNOoDM.exe
  C:\Windows\System\NZNOoDM.exe
  2⤵
  PID:5176
- C:\Windows\System\WtVeenT.exe
  C:\Windows\System\WtVeenT.exe
  2⤵
  PID:5296
- C:\Windows\System\wJxcCVL.exe
  C:\Windows\System\wJxcCVL.exe
  2⤵
  PID:5312
- C:\Windows\System\dVwOdyL.exe
  C:\Windows\System\dVwOdyL.exe
  2⤵
  PID:5328
- C:\Windows\System\nFhWBuY.exe
  C:\Windows\System\nFhWBuY.exe
  2⤵
  PID:5344
- C:\Windows\System\fCdBzlg.exe
  C:\Windows\System\fCdBzlg.exe
  2⤵
  PID:5376
- C:\Windows\System\JbhzKpP.exe
  C:\Windows\System\JbhzKpP.exe
  2⤵
  PID:5392
- C:\Windows\System\uMUwNWZ.exe
  C:\Windows\System\uMUwNWZ.exe
  2⤵
  PID:5408
- C:\Windows\System\IBwHcWS.exe
  C:\Windows\System\IBwHcWS.exe
  2⤵
  PID:5424
- C:\Windows\System\CLjjNoR.exe
  C:\Windows\System\CLjjNoR.exe
  2⤵
  PID:5440
- C:\Windows\System\xMEgOJn.exe
  C:\Windows\System\xMEgOJn.exe
  2⤵
  PID:5460
- C:\Windows\System\QbiLYSa.exe
  C:\Windows\System\QbiLYSa.exe
  2⤵
  PID:5480
- C:\Windows\System\UeWljeg.exe
  C:\Windows\System\UeWljeg.exe
  2⤵
  PID:5496
- C:\Windows\System\NDDBZDp.exe
  C:\Windows\System\NDDBZDp.exe
  2⤵
  PID:5516
- C:\Windows\System\DfGTewS.exe
  C:\Windows\System\DfGTewS.exe
  2⤵
  PID:5536
- C:\Windows\System\WyqUZeu.exe
  C:\Windows\System\WyqUZeu.exe
  2⤵
  PID:5552
- C:\Windows\System\JcPbvhf.exe
  C:\Windows\System\JcPbvhf.exe
  2⤵
  PID:5572
- C:\Windows\System\kPmjSvM.exe
  C:\Windows\System\kPmjSvM.exe
  2⤵
  PID:5588
- C:\Windows\System\HtxqlAF.exe
  C:\Windows\System\HtxqlAF.exe
  2⤵
  PID:5604
- C:\Windows\System\hcOAxYO.exe
  C:\Windows\System\hcOAxYO.exe
  2⤵
  PID:5628
- C:\Windows\System\RuhYCwU.exe
  C:\Windows\System\RuhYCwU.exe
  2⤵
  PID:5644
- C:\Windows\System\eIhPEDy.exe
  C:\Windows\System\eIhPEDy.exe
  2⤵
  PID:5664
- C:\Windows\System\UIKsIgr.exe
  C:\Windows\System\UIKsIgr.exe
  2⤵
  PID:5680
- C:\Windows\System\nNMpgCJ.exe
  C:\Windows\System\nNMpgCJ.exe
  2⤵
  PID:5696
- C:\Windows\System\YEAKpag.exe
  C:\Windows\System\YEAKpag.exe
  2⤵
  PID:5712
- C:\Windows\System\soUHDEv.exe
  C:\Windows\System\soUHDEv.exe
  2⤵
  PID:5732
- C:\Windows\System\FXAgBGh.exe
  C:\Windows\System\FXAgBGh.exe
  2⤵
  PID:5752
- C:\Windows\System\mbInncC.exe
  C:\Windows\System\mbInncC.exe
  2⤵
  PID:5812
- C:\Windows\System\NKXwXlx.exe
  C:\Windows\System\NKXwXlx.exe
  2⤵
  PID:5828
- C:\Windows\System\FARmkES.exe
  C:\Windows\System\FARmkES.exe
  2⤵
  PID:5844
- C:\Windows\System\pCTAPeL.exe
  C:\Windows\System\pCTAPeL.exe
  2⤵
  PID:5860
- C:\Windows\System\OEcljMR.exe
  C:\Windows\System\OEcljMR.exe
  2⤵
  PID:5880
- C:\Windows\System\xJnQhOB.exe
  C:\Windows\System\xJnQhOB.exe
  2⤵
  PID:5900
- C:\Windows\System\NTVyPVM.exe
  C:\Windows\System\NTVyPVM.exe
  2⤵
  PID:5916
- C:\Windows\System\JqgrmzO.exe
  C:\Windows\System\JqgrmzO.exe
  2⤵
  PID:5932
- C:\Windows\System\KwlwGJh.exe
  C:\Windows\System\KwlwGJh.exe
  2⤵
  PID:5948
- C:\Windows\System\tyeAJVh.exe
  C:\Windows\System\tyeAJVh.exe
  2⤵
  PID:5964
- C:\Windows\System\ZNUGzqd.exe
  C:\Windows\System\ZNUGzqd.exe
  2⤵
  PID:5984
- C:\Windows\System\mKlKBsq.exe
  C:\Windows\System\mKlKBsq.exe
  2⤵
  PID:6004
- C:\Windows\System\OWvHaSq.exe
  C:\Windows\System\OWvHaSq.exe
  2⤵
  PID:6020
- C:\Windows\System\XFgCkQY.exe
  C:\Windows\System\XFgCkQY.exe
  2⤵
  PID:6068
- C:\Windows\System\sczrnOd.exe
  C:\Windows\System\sczrnOd.exe
  2⤵
  PID:6084
- C:\Windows\System\OKoFzUi.exe
  C:\Windows\System\OKoFzUi.exe
  2⤵
  PID:6100
- C:\Windows\System\JNuIaXk.exe
  C:\Windows\System\JNuIaXk.exe
  2⤵
  PID:6136
- C:\Windows\System\sZbLMDN.exe
  C:\Windows\System\sZbLMDN.exe
  2⤵
  PID:5012
- C:\Windows\System\Nrvowod.exe
  C:\Windows\System\Nrvowod.exe
  2⤵
  PID:4420
- C:\Windows\System\hVArMYt.exe
  C:\Windows\System\hVArMYt.exe
  2⤵
  PID:5132
- C:\Windows\System\EjDmJrr.exe
  C:\Windows\System\EjDmJrr.exe
  2⤵
  PID:3720
- C:\Windows\System\yBtLeIP.exe
  C:\Windows\System\yBtLeIP.exe
  2⤵
  PID:4344
- C:\Windows\System\tNVbxYz.exe
  C:\Windows\System\tNVbxYz.exe
  2⤵
  PID:3128
- C:\Windows\System\AWNOXhQ.exe
  C:\Windows\System\AWNOXhQ.exe
  2⤵
  PID:4440
- C:\Windows\System\LeLDcxL.exe
  C:\Windows\System\LeLDcxL.exe
  2⤵
  PID:1740
- C:\Windows\System\csJGYeH.exe
  C:\Windows\System\csJGYeH.exe
  2⤵
  PID:1832
- C:\Windows\System\lslXxAl.exe
  C:\Windows\System\lslXxAl.exe
  2⤵
  PID:4500
- C:\Windows\System\IYnVysZ.exe
  C:\Windows\System\IYnVysZ.exe
  2⤵
  PID:4816
- C:\Windows\System\UdOwCDP.exe
  C:\Windows\System\UdOwCDP.exe
  2⤵
  PID:4304
- C:\Windows\System\xFHXQgS.exe
  C:\Windows\System\xFHXQgS.exe
  2⤵
  PID:3328
- C:\Windows\System\ocDtzkl.exe
  C:\Windows\System\ocDtzkl.exe
  2⤵
  PID:5184
- C:\Windows\System\YTPBoiQ.exe
  C:\Windows\System\YTPBoiQ.exe
  2⤵
  PID:5196
- C:\Windows\System\MqtZOBv.exe
  C:\Windows\System\MqtZOBv.exe
  2⤵
  PID:5216
- C:\Windows\System\PmbvNAO.exe
  C:\Windows\System\PmbvNAO.exe
  2⤵
  PID:5236
- C:\Windows\System\JWIruqm.exe
  C:\Windows\System\JWIruqm.exe
  2⤵
  PID:5256
- C:\Windows\System\NKQKvck.exe
  C:\Windows\System\NKQKvck.exe
  2⤵
  PID:3544
- C:\Windows\System\tDMDCyZ.exe
  C:\Windows\System\tDMDCyZ.exe
  2⤵
  PID:3824
- C:\Windows\System\emoJpsK.exe
  C:\Windows\System\emoJpsK.exe
  2⤵
  PID:5284
- C:\Windows\System\kblaLvd.exe
  C:\Windows\System\kblaLvd.exe
  2⤵
  PID:5360
- C:\Windows\System\hUuhWAi.exe
  C:\Windows\System\hUuhWAi.exe
  2⤵
  PID:5304
- C:\Windows\System\ZlTDikM.exe
  C:\Windows\System\ZlTDikM.exe
  2⤵
  PID:5340
- C:\Windows\System\JvwpsVI.exe
  C:\Windows\System\JvwpsVI.exe
  2⤵
  PID:5436
- C:\Windows\System\qPxuDNI.exe
  C:\Windows\System\qPxuDNI.exe
  2⤵
  PID:5504
- C:\Windows\System\KSsWDjM.exe
  C:\Windows\System\KSsWDjM.exe
  2⤵
  PID:5584
- C:\Windows\System\vbeWHLU.exe
  C:\Windows\System\vbeWHLU.exe
  2⤵
  PID:5652
- C:\Windows\System\ttwQNmR.exe
  C:\Windows\System\ttwQNmR.exe
  2⤵
  PID:5688
- C:\Windows\System\XQeMpGF.exe
  C:\Windows\System\XQeMpGF.exe
  2⤵
  PID:5528
- C:\Windows\System\ctdGaKx.exe
  C:\Windows\System\ctdGaKx.exe
  2⤵
  PID:5768
- C:\Windows\System\QYWUNXX.exe
  C:\Windows\System\QYWUNXX.exe
  2⤵
  PID:5796
- C:\Windows\System\hqQSWei.exe
  C:\Windows\System\hqQSWei.exe
  2⤵
  PID:5600
- C:\Windows\System\Fjqtyhg.exe
  C:\Windows\System\Fjqtyhg.exe
  2⤵
  PID:5420
- C:\Windows\System\oxpkGBt.exe
  C:\Windows\System\oxpkGBt.exe
  2⤵
  PID:5764
- C:\Windows\System\BTSlllh.exe
  C:\Windows\System\BTSlllh.exe
  2⤵
  PID:5676
- C:\Windows\System\xmpJEwO.exe
  C:\Windows\System\xmpJEwO.exe
  2⤵
  PID:5748
- C:\Windows\System\HceldYL.exe
  C:\Windows\System\HceldYL.exe
  2⤵
  PID:5908
- C:\Windows\System\YpmLXbt.exe
  C:\Windows\System\YpmLXbt.exe
  2⤵
  PID:6012
- C:\Windows\System\SFAAAlP.exe
  C:\Windows\System\SFAAAlP.exe
  2⤵
  PID:6080
- C:\Windows\System\DzQIiQB.exe
  C:\Windows\System\DzQIiQB.exe
  2⤵
  PID:5888
- C:\Windows\System\BZIqwBm.exe
  C:\Windows\System\BZIqwBm.exe
  2⤵
  PID:6112
- C:\Windows\System\GZssZmA.exe
  C:\Windows\System\GZssZmA.exe
  2⤵
  PID:6128
- C:\Windows\System\DNZyaDb.exe
  C:\Windows\System\DNZyaDb.exe
  2⤵
  PID:6060
- C:\Windows\System\fDzlqzB.exe
  C:\Windows\System\fDzlqzB.exe
  2⤵
  PID:5928
- C:\Windows\System\bJPeFgM.exe
  C:\Windows\System\bJPeFgM.exe
  2⤵
  PID:5992
- C:\Windows\System\SfnvvQF.exe
  C:\Windows\System\SfnvvQF.exe
  2⤵
  PID:6044
- C:\Windows\System\tgzSNtq.exe
  C:\Windows\System\tgzSNtq.exe
  2⤵
  PID:3768
- C:\Windows\System\iksppdC.exe
  C:\Windows\System\iksppdC.exe
  2⤵
  PID:6036
- C:\Windows\System\DhQkuBZ.exe
  C:\Windows\System\DhQkuBZ.exe
  2⤵
  PID:4492
- C:\Windows\System\QwuiqJD.exe
  C:\Windows\System\QwuiqJD.exe
  2⤵
  PID:5088
- C:\Windows\System\GldIbSa.exe
  C:\Windows\System\GldIbSa.exe
  2⤵
  PID:5208
- C:\Windows\System\khKudKt.exe
  C:\Windows\System\khKudKt.exe
  2⤵
  PID:5248
- C:\Windows\System\CdTzApi.exe
  C:\Windows\System\CdTzApi.exe
  2⤵
  PID:4940
- C:\Windows\System\dyjdrkV.exe
  C:\Windows\System\dyjdrkV.exe
  2⤵
  PID:4980
- C:\Windows\System\itSCQMh.exe
  C:\Windows\System\itSCQMh.exe
  2⤵
  PID:5336
- C:\Windows\System\WcbTsQV.exe
  C:\Windows\System\WcbTsQV.exe
  2⤵
  PID:5616
- C:\Windows\System\GwMHppv.exe
  C:\Windows\System\GwMHppv.exe
  2⤵
  PID:5728
- C:\Windows\System\WrFNJql.exe
  C:\Windows\System\WrFNJql.exe
  2⤵
  PID:5944
- C:\Windows\System\IOtKqGt.exe
  C:\Windows\System\IOtKqGt.exe
  2⤵
  PID:5224
- C:\Windows\System\PBsBaqq.exe
  C:\Windows\System\PBsBaqq.exe
  2⤵
  PID:2164
- C:\Windows\System\WrpSFbh.exe
  C:\Windows\System\WrpSFbh.exe
  2⤵
  PID:6048
- C:\Windows\System\YCrrFsN.exe
  C:\Windows\System\YCrrFsN.exe
  2⤵
  PID:5140
- C:\Windows\System\XMeHGIy.exe
  C:\Windows\System\XMeHGIy.exe
  2⤵
  PID:4924
- C:\Windows\System\uOEGFmL.exe
  C:\Windows\System\uOEGFmL.exe
  2⤵
  PID:5092
- C:\Windows\System\FfMANHO.exe
  C:\Windows\System\FfMANHO.exe
  2⤵
  PID:5720
- C:\Windows\System\oNCxCvA.exe
  C:\Windows\System\oNCxCvA.exe
  2⤵
  PID:5896
- C:\Windows\System\VQUfVKJ.exe
  C:\Windows\System\VQUfVKJ.exe
  2⤵
  PID:4424
- C:\Windows\System\QBLoynz.exe
  C:\Windows\System\QBLoynz.exe
  2⤵
  PID:6152
- C:\Windows\System\WKCIvms.exe
  C:\Windows\System\WKCIvms.exe
  2⤵
  PID:6168
- C:\Windows\System\hvcXheD.exe
  C:\Windows\System\hvcXheD.exe
  2⤵
  PID:6184
- C:\Windows\System\IkZYTcg.exe
  C:\Windows\System\IkZYTcg.exe
  2⤵
  PID:6200
- C:\Windows\System\lUxNgPa.exe
  C:\Windows\System\lUxNgPa.exe
  2⤵
  PID:6216
- C:\Windows\System\ljspIij.exe
  C:\Windows\System\ljspIij.exe
  2⤵
  PID:6232
- C:\Windows\System\BVzpjfI.exe
  C:\Windows\System\BVzpjfI.exe
  2⤵
  PID:6248
- C:\Windows\System\xLiTKnW.exe
  C:\Windows\System\xLiTKnW.exe
  2⤵
  PID:6264
- C:\Windows\System\oBQbiXW.exe
  C:\Windows\System\oBQbiXW.exe
  2⤵
  PID:6284
- C:\Windows\System\DuhxTEa.exe
  C:\Windows\System\DuhxTEa.exe
  2⤵
  PID:6304
- C:\Windows\System\fKymZct.exe
  C:\Windows\System\fKymZct.exe
  2⤵
  PID:6324
- C:\Windows\System\WxALuSg.exe
  C:\Windows\System\WxALuSg.exe
  2⤵
  PID:6348
- C:\Windows\System\kpbuxyY.exe
  C:\Windows\System\kpbuxyY.exe
  2⤵
  PID:6368
- C:\Windows\System\mPaqxhN.exe
  C:\Windows\System\mPaqxhN.exe
  2⤵
  PID:6384
- C:\Windows\System\hynGIuB.exe
  C:\Windows\System\hynGIuB.exe
  2⤵
  PID:6400
- C:\Windows\System\xETHNcI.exe
  C:\Windows\System\xETHNcI.exe
  2⤵
  PID:6420
- C:\Windows\System\esUOrkL.exe
  C:\Windows\System\esUOrkL.exe
  2⤵
  PID:6440
- C:\Windows\System\AkXjcAh.exe
  C:\Windows\System\AkXjcAh.exe
  2⤵
  PID:6456
- C:\Windows\System\VEMrgPv.exe
  C:\Windows\System\VEMrgPv.exe
  2⤵
  PID:6476
- C:\Windows\System\FemCIBU.exe
  C:\Windows\System\FemCIBU.exe
  2⤵
  PID:6496
- C:\Windows\System\kgWzalq.exe
  C:\Windows\System\kgWzalq.exe
  2⤵
  PID:6516
- C:\Windows\System\oNlVbnk.exe
  C:\Windows\System\oNlVbnk.exe
  2⤵
  PID:6536
- C:\Windows\System\efdNPxG.exe
  C:\Windows\System\efdNPxG.exe
  2⤵
  PID:6564
- C:\Windows\System\NArflND.exe
  C:\Windows\System\NArflND.exe
  2⤵
  PID:6584
- C:\Windows\System\qOigAwS.exe
  C:\Windows\System\qOigAwS.exe
  2⤵
  PID:6604
- C:\Windows\System\iUrlaGx.exe
  C:\Windows\System\iUrlaGx.exe
  2⤵
  PID:6720
- C:\Windows\System\Xbkavaa.exe
  C:\Windows\System\Xbkavaa.exe
  2⤵
  PID:6736
- C:\Windows\System\zaaOEMy.exe
  C:\Windows\System\zaaOEMy.exe
  2⤵
  PID:6752
- C:\Windows\System\cVZzgTx.exe
  C:\Windows\System\cVZzgTx.exe
  2⤵
  PID:6772
- C:\Windows\System\xIaWxhM.exe
  C:\Windows\System\xIaWxhM.exe
  2⤵
  PID:6788
- C:\Windows\System\crGULLY.exe
  C:\Windows\System\crGULLY.exe
  2⤵
  PID:6808
- C:\Windows\System\BvlueEk.exe
  C:\Windows\System\BvlueEk.exe
  2⤵
  PID:6824
- C:\Windows\System\yYMUzbK.exe
  C:\Windows\System\yYMUzbK.exe
  2⤵
  PID:6840
- C:\Windows\System\vEwezWC.exe
  C:\Windows\System\vEwezWC.exe
  2⤵
  PID:6864
- C:\Windows\System\dqgBOib.exe
  C:\Windows\System\dqgBOib.exe
  2⤵
  PID:6884
- C:\Windows\System\jLIeDaA.exe
  C:\Windows\System\jLIeDaA.exe
  2⤵
  PID:6900
- C:\Windows\System\HDdjBCO.exe
  C:\Windows\System\HDdjBCO.exe
  2⤵
  PID:6920
- C:\Windows\System\nfgMhPV.exe
  C:\Windows\System\nfgMhPV.exe
  2⤵
  PID:6936
- C:\Windows\System\SZqcjeK.exe
  C:\Windows\System\SZqcjeK.exe
  2⤵
  PID:6956
- C:\Windows\System\xldgQOi.exe
  C:\Windows\System\xldgQOi.exe
  2⤵
  PID:6972
- C:\Windows\System\foDmMzl.exe
  C:\Windows\System\foDmMzl.exe
  2⤵
  PID:7004
- C:\Windows\System\jlxMUai.exe
  C:\Windows\System\jlxMUai.exe
  2⤵
  PID:7020
- C:\Windows\System\jzXbyRn.exe
  C:\Windows\System\jzXbyRn.exe
  2⤵
  PID:7040
- C:\Windows\System\NKXLAEh.exe
  C:\Windows\System\NKXLAEh.exe
  2⤵
  PID:7080
- C:\Windows\System\MEfCwvE.exe
  C:\Windows\System\MEfCwvE.exe
  2⤵
  PID:7096
- C:\Windows\System\fkYdiWq.exe
  C:\Windows\System\fkYdiWq.exe
  2⤵
  PID:7116
- C:\Windows\System\hVAxIJI.exe
  C:\Windows\System\hVAxIJI.exe
  2⤵
  PID:7136
- C:\Windows\System\VWuYKhA.exe
  C:\Windows\System\VWuYKhA.exe
  2⤵
  PID:7160
- C:\Windows\System\eRqOOyz.exe
  C:\Windows\System\eRqOOyz.exe
  2⤵
  PID:5192
- C:\Windows\System\dlfvhTn.exe
  C:\Windows\System\dlfvhTn.exe
  2⤵
  PID:5264
- C:\Windows\System\MGnQhAx.exe
  C:\Windows\System\MGnQhAx.exe
  2⤵
  PID:5280
- C:\Windows\System\SmTKfLp.exe
  C:\Windows\System\SmTKfLp.exe
  2⤵
  PID:6164
- C:\Windows\System\IcGhKBs.exe
  C:\Windows\System\IcGhKBs.exe
  2⤵
  PID:6256
- C:\Windows\System\GZNdRDT.exe
  C:\Windows\System\GZNdRDT.exe
  2⤵
  PID:6160
- C:\Windows\System\pwoYBRB.exe
  C:\Windows\System\pwoYBRB.exe
  2⤵
  PID:6380
- C:\Windows\System\nmVmmOl.exe
  C:\Windows\System\nmVmmOl.exe
  2⤵
  PID:6488
- C:\Windows\System\IrXpiOC.exe
  C:\Windows\System\IrXpiOC.exe
  2⤵
  PID:6532
- C:\Windows\System\WRlFvlx.exe
  C:\Windows\System\WRlFvlx.exe
  2⤵
  PID:6612
- C:\Windows\System\Uqhmxwr.exe
  C:\Windows\System\Uqhmxwr.exe
  2⤵
  PID:6636
- C:\Windows\System\cBXxXBT.exe
  C:\Windows\System\cBXxXBT.exe
  2⤵
  PID:6648
- C:\Windows\System\mDkxdBH.exe
  C:\Windows\System\mDkxdBH.exe
  2⤵
  PID:6664
- C:\Windows\System\dBWWFyO.exe
  C:\Windows\System\dBWWFyO.exe
  2⤵
  PID:6680
- C:\Windows\System\cwWQhkA.exe
  C:\Windows\System\cwWQhkA.exe
  2⤵
  PID:6696
- C:\Windows\System\AXAIGSW.exe
  C:\Windows\System\AXAIGSW.exe
  2⤵
  PID:6708
- C:\Windows\System\GaSOYdF.exe
  C:\Windows\System\GaSOYdF.exe
  2⤵
  PID:6716
- C:\Windows\System\tJGqBVa.exe
  C:\Windows\System\tJGqBVa.exe
  2⤵
  PID:5432
- C:\Windows\System\GcYDhOt.exe
  C:\Windows\System\GcYDhOt.exe
  2⤵
  PID:5580
- C:\Windows\System\dfijUbw.exe
  C:\Windows\System\dfijUbw.exe
  2⤵
  PID:5388
- C:\Windows\System\QYQZvlS.exe
  C:\Windows\System\QYQZvlS.exe
  2⤵
  PID:5760
- C:\Windows\System\xIwOzLD.exe
  C:\Windows\System\xIwOzLD.exe
  2⤵
  PID:5704
- C:\Windows\System\IMxRgIF.exe
  C:\Windows\System\IMxRgIF.exe
  2⤵
  PID:5852
- C:\Windows\System\XcFLqox.exe
  C:\Windows\System\XcFLqox.exe
  2⤵
  PID:6392
- C:\Windows\System\gKqpJNB.exe
  C:\Windows\System\gKqpJNB.exe
  2⤵
  PID:6028
- C:\Windows\System\IUjSroz.exe
  C:\Windows\System\IUjSroz.exe
  2⤵
  PID:6064
- C:\Windows\System\mxGezAw.exe
  C:\Windows\System\mxGezAw.exe
  2⤵
  PID:4616
- C:\Windows\System\zuUQwZZ.exe
  C:\Windows\System\zuUQwZZ.exe
  2⤵
  PID:5356
- C:\Windows\System\nEtddWa.exe
  C:\Windows\System\nEtddWa.exe
  2⤵
  PID:5792
- C:\Windows\System\HikcmzR.exe
  C:\Windows\System\HikcmzR.exe
  2⤵
  PID:4872
- C:\Windows\System\DNoPkId.exe
  C:\Windows\System\DNoPkId.exe
  2⤵
  PID:6176
- C:\Windows\System\yQZrgHE.exe
  C:\Windows\System\yQZrgHE.exe
  2⤵
  PID:6240
- C:\Windows\System\TPcJzLv.exe
  C:\Windows\System\TPcJzLv.exe
  2⤵
  PID:6780
- C:\Windows\System\hYJfxuh.exe
  C:\Windows\System\hYJfxuh.exe
  2⤵
  PID:6820
- C:\Windows\System\YJiIPIT.exe
  C:\Windows\System\YJiIPIT.exe
  2⤵
  PID:6856
- C:\Windows\System\hlSuctH.exe
  C:\Windows\System\hlSuctH.exe
  2⤵
  PID:6344
- C:\Windows\System\pFGNMec.exe
  C:\Windows\System\pFGNMec.exe
  2⤵
  PID:6364
- C:\Windows\System\ScWuiBR.exe
  C:\Windows\System\ScWuiBR.exe
  2⤵
  PID:6428
- C:\Windows\System\rjVAHdI.exe
  C:\Windows\System\rjVAHdI.exe
  2⤵
  PID:6472
- C:\Windows\System\xlfRDVY.exe
  C:\Windows\System\xlfRDVY.exe
  2⤵
  PID:6560
- C:\Windows\System\GJsOEmS.exe
  C:\Windows\System\GJsOEmS.exe
  2⤵
  PID:6932
- C:\Windows\System\iYHGyGO.exe
  C:\Windows\System\iYHGyGO.exe
  2⤵
  PID:6760
- C:\Windows\System\GbrxZex.exe
  C:\Windows\System\GbrxZex.exe
  2⤵
  PID:6796
- C:\Windows\System\CRsHoZw.exe
  C:\Windows\System\CRsHoZw.exe
  2⤵
  PID:7056
- C:\Windows\System\RHkcKdo.exe
  C:\Windows\System\RHkcKdo.exe
  2⤵
  PID:6984
- C:\Windows\System\pKSpFFU.exe
  C:\Windows\System\pKSpFFU.exe
  2⤵
  PID:6836
- C:\Windows\System\VbewTCg.exe
  C:\Windows\System\VbewTCg.exe
  2⤵
  PID:6912
- C:\Windows\System\DmeOBVQ.exe
  C:\Windows\System\DmeOBVQ.exe
  2⤵
  PID:6980
- C:\Windows\System\CbPGAdO.exe
  C:\Windows\System\CbPGAdO.exe
  2⤵
  PID:7000
- C:\Windows\System\FLtEZeL.exe
  C:\Windows\System\FLtEZeL.exe
  2⤵
  PID:7032
- C:\Windows\System\lBahrzo.exe
  C:\Windows\System\lBahrzo.exe
  2⤵
  PID:7144
- C:\Windows\System\vDETNuz.exe
  C:\Windows\System\vDETNuz.exe
  2⤵
  PID:4544
- C:\Windows\System\wKNSkod.exe
  C:\Windows\System\wKNSkod.exe
  2⤵
  PID:5156
- C:\Windows\System\wngUXzK.exe
  C:\Windows\System\wngUXzK.exe
  2⤵
  PID:5876
- C:\Windows\System\HoFozrU.exe
  C:\Windows\System\HoFozrU.exe
  2⤵
  PID:6484
- C:\Windows\System\IsbpWyh.exe
  C:\Windows\System\IsbpWyh.exe
  2⤵
  PID:6224
- C:\Windows\System\yCPVsLz.exe
  C:\Windows\System\yCPVsLz.exe
  2⤵
  PID:6376
- C:\Windows\System\wIiXatk.exe
  C:\Windows\System\wIiXatk.exe
  2⤵
  PID:6580
- C:\Windows\System\MVrKfZw.exe
  C:\Windows\System\MVrKfZw.exe
  2⤵
  PID:6676
- C:\Windows\System\oFvisbD.exe
  C:\Windows\System\oFvisbD.exe
  2⤵
  PID:1332
- C:\Windows\System\QgZPZlv.exe
  C:\Windows\System\QgZPZlv.exe
  2⤵
  PID:6656
- C:\Windows\System\EjZwUJq.exe
  C:\Windows\System\EjZwUJq.exe
  2⤵
  PID:6692
- C:\Windows\System\zhtvWzJ.exe
  C:\Windows\System\zhtvWzJ.exe
  2⤵
  PID:5384
- C:\Windows\System\JaIwthu.exe
  C:\Windows\System\JaIwthu.exe
  2⤵
  PID:5524
- C:\Windows\System\sPOIFZY.exe
  C:\Windows\System\sPOIFZY.exe
  2⤵
  PID:6592
- C:\Windows\System\dpZINdu.exe
  C:\Windows\System\dpZINdu.exe
  2⤵
  PID:5456
- C:\Windows\System\sooKRPJ.exe
  C:\Windows\System\sooKRPJ.exe
  2⤵
  PID:5960
- C:\Windows\System\ZNCHYwu.exe
  C:\Windows\System\ZNCHYwu.exe
  2⤵
  PID:5512
- C:\Windows\System\gkzYkSN.exe
  C:\Windows\System\gkzYkSN.exe
  2⤵
  PID:6276
- C:\Windows\System\BuSpKUS.exe
  C:\Windows\System\BuSpKUS.exe
  2⤵
  PID:6552
- C:\Windows\System\IIVMlde.exe
  C:\Windows\System\IIVMlde.exe
  2⤵
  PID:7016
- C:\Windows\System\rcIJJAG.exe
  C:\Windows\System\rcIJJAG.exe
  2⤵
  PID:6948
- C:\Windows\System\cvzQHxx.exe
  C:\Windows\System\cvzQHxx.exe
  2⤵
  PID:7048
- C:\Windows\System\bOtUVMn.exe
  C:\Windows\System\bOtUVMn.exe
  2⤵
  PID:6988
- C:\Windows\System\ZYZPLfc.exe
  C:\Windows\System\ZYZPLfc.exe
  2⤵
  PID:4576
- C:\Windows\System\NDdFeQq.exe
  C:\Windows\System\NDdFeQq.exe
  2⤵
  PID:6492
- C:\Windows\System\zqLwgWW.exe
  C:\Windows\System\zqLwgWW.exe
  2⤵
  PID:6704
- C:\Windows\System\QLRHivV.exe
  C:\Windows\System\QLRHivV.exe
  2⤵
  PID:5596
- C:\Windows\System\WGNGKps.exe
  C:\Windows\System\WGNGKps.exe
  2⤵
  PID:5672
- C:\Windows\System\ZmzRRwJ.exe
  C:\Windows\System\ZmzRRwJ.exe
  2⤵
  PID:6768
- C:\Windows\System\cgqHjTp.exe
  C:\Windows\System\cgqHjTp.exe
  2⤵
  PID:4472
- C:\Windows\System\uUsQyRY.exe
  C:\Windows\System\uUsQyRY.exe
  2⤵
  PID:6860
- C:\Windows\System\eHBUDFd.exe
  C:\Windows\System\eHBUDFd.exe
  2⤵
  PID:6092
- C:\Windows\System\VHhxGcK.exe
  C:\Windows\System\VHhxGcK.exe
  2⤵
  PID:7124
- C:\Windows\System\YPNYWAq.exe
  C:\Windows\System\YPNYWAq.exe
  2⤵
  PID:3636
- C:\Windows\System\JuMFFHe.exe
  C:\Windows\System\JuMFFHe.exe
  2⤵
  PID:5404
- C:\Windows\System\IDuttVB.exe
  C:\Windows\System\IDuttVB.exe
  2⤵
  PID:6852
- C:\Windows\System\XAzXVeo.exe
  C:\Windows\System\XAzXVeo.exe
  2⤵
  PID:5788
- C:\Windows\System\nYRxyWz.exe
  C:\Windows\System\nYRxyWz.exe
  2⤵
  PID:5856
- C:\Windows\System\DZqrXNK.exe
  C:\Windows\System\DZqrXNK.exe
  2⤵
  PID:5924
- C:\Windows\System\wZKMTMv.exe
  C:\Windows\System\wZKMTMv.exe
  2⤵
  PID:6672
- C:\Windows\System\YgNufrE.exe
  C:\Windows\System\YgNufrE.exe
  2⤵
  PID:5976
- C:\Windows\System\QlvAkLV.exe
  C:\Windows\System\QlvAkLV.exe
  2⤵
  PID:6432
- C:\Windows\System\DaTIQgt.exe
  C:\Windows\System\DaTIQgt.exe
  2⤵
  PID:6728
- C:\Windows\System\qXrjYEf.exe
  C:\Windows\System\qXrjYEf.exe
  2⤵
  PID:7104
- C:\Windows\System\BcFXLkp.exe
  C:\Windows\System\BcFXLkp.exe
  2⤵
  PID:6196
- C:\Windows\System\WgFrxqO.exe
  C:\Windows\System\WgFrxqO.exe
  2⤵
  PID:4212
- C:\Windows\System\QIlgSpW.exe
  C:\Windows\System\QIlgSpW.exe
  2⤵
  PID:5624
- C:\Windows\System\jbJLMpy.exe
  C:\Windows\System\jbJLMpy.exe
  2⤵
  PID:6748
- C:\Windows\System\UoStmAg.exe
  C:\Windows\System\UoStmAg.exe
  2⤵
  PID:5492
- C:\Windows\System\wIxQSYr.exe
  C:\Windows\System\wIxQSYr.exe
  2⤵
  PID:6908
- C:\Windows\System\bIUaxVG.exe
  C:\Windows\System\bIUaxVG.exe
  2⤵
  PID:6108
- C:\Windows\System\hPAfTmb.exe
  C:\Windows\System\hPAfTmb.exe
  2⤵
  PID:6464
- C:\Windows\System\yFRjYZs.exe
  C:\Windows\System\yFRjYZs.exe
  2⤵
  PID:6712
- C:\Windows\System\mUqRznY.exe
  C:\Windows\System\mUqRznY.exe
  2⤵
  PID:5448
- C:\Windows\System\kjunRsP.exe
  C:\Windows\System\kjunRsP.exe
  2⤵
  PID:6452
- C:\Windows\System\ETvdCoL.exe
  C:\Windows\System\ETvdCoL.exe
  2⤵
  PID:6784
- C:\Windows\System\tJCqyIl.exe
  C:\Windows\System\tJCqyIl.exe
  2⤵
  PID:7108
- C:\Windows\System\zEamnYE.exe
  C:\Windows\System\zEamnYE.exe
  2⤵
  PID:7132
- C:\Windows\System\Udbnrom.exe
  C:\Windows\System\Udbnrom.exe
  2⤵
  PID:6992
- C:\Windows\System\Xzsljil.exe
  C:\Windows\System\Xzsljil.exe
  2⤵
  PID:7156
- C:\Windows\System\uIWTVTh.exe
  C:\Windows\System\uIWTVTh.exe
  2⤵
  PID:6832
- C:\Windows\System\KQvGqGE.exe
  C:\Windows\System\KQvGqGE.exe
  2⤵
  PID:6468
- C:\Windows\System\QVgmWKP.exe
  C:\Windows\System\QVgmWKP.exe
  2⤵
  PID:7180
- C:\Windows\System\RstfBsH.exe
  C:\Windows\System\RstfBsH.exe
  2⤵
  PID:7196
- C:\Windows\System\nXdxEJJ.exe
  C:\Windows\System\nXdxEJJ.exe
  2⤵
  PID:7212
- C:\Windows\System\cxsyfEv.exe
  C:\Windows\System\cxsyfEv.exe
  2⤵
  PID:7232
- C:\Windows\System\aDJmMSm.exe
  C:\Windows\System\aDJmMSm.exe
  2⤵
  PID:7248
- C:\Windows\System\eeEwIyT.exe
  C:\Windows\System\eeEwIyT.exe
  2⤵
  PID:7268
- C:\Windows\System\hBgvvmq.exe
  C:\Windows\System\hBgvvmq.exe
  2⤵
  PID:7292
- C:\Windows\System\dZUGmeV.exe
  C:\Windows\System\dZUGmeV.exe
  2⤵
  PID:7312
- C:\Windows\System\kvJWXtK.exe
  C:\Windows\System\kvJWXtK.exe
  2⤵
  PID:7332
- C:\Windows\System\UYkviow.exe
  C:\Windows\System\UYkviow.exe
  2⤵
  PID:7356
- C:\Windows\System\zqQAedn.exe
  C:\Windows\System\zqQAedn.exe
  2⤵
  PID:7376
- C:\Windows\System\uvCwDsq.exe
  C:\Windows\System\uvCwDsq.exe
  2⤵
  PID:7444
- C:\Windows\System\EfChHoJ.exe
  C:\Windows\System\EfChHoJ.exe
  2⤵
  PID:7460
- C:\Windows\System\PdbmMVv.exe
  C:\Windows\System\PdbmMVv.exe
  2⤵
  PID:7480
- C:\Windows\System\bRukTSJ.exe
  C:\Windows\System\bRukTSJ.exe
  2⤵
  PID:7496
- C:\Windows\System\SOPVqXU.exe
  C:\Windows\System\SOPVqXU.exe
  2⤵
  PID:7520
- C:\Windows\System\jMTEitF.exe
  C:\Windows\System\jMTEitF.exe
  2⤵
  PID:7540
- C:\Windows\System\mXhujaH.exe
  C:\Windows\System\mXhujaH.exe
  2⤵
  PID:7556
- C:\Windows\System\gZMbnhf.exe
  C:\Windows\System\gZMbnhf.exe
  2⤵
  PID:7572
- C:\Windows\System\VkwKqdG.exe
  C:\Windows\System\VkwKqdG.exe
  2⤵
  PID:7592
- C:\Windows\System\QlAwlwY.exe
  C:\Windows\System\QlAwlwY.exe
  2⤵
  PID:7608
- C:\Windows\System\OLhHErj.exe
  C:\Windows\System\OLhHErj.exe
  2⤵
  PID:7624
- C:\Windows\System\amSNgPP.exe
  C:\Windows\System\amSNgPP.exe
  2⤵
  PID:7640
- C:\Windows\System\Qrcxecb.exe
  C:\Windows\System\Qrcxecb.exe
  2⤵
  PID:7656
- C:\Windows\System\ZWqHbpc.exe
  C:\Windows\System\ZWqHbpc.exe
  2⤵
  PID:7676
- C:\Windows\System\NYVHmxb.exe
  C:\Windows\System\NYVHmxb.exe
  2⤵
  PID:7700
- C:\Windows\System\qBbfbDg.exe
  C:\Windows\System\qBbfbDg.exe
  2⤵
  PID:7720
- C:\Windows\System\yVVMULT.exe
  C:\Windows\System\yVVMULT.exe
  2⤵
  PID:7740
- C:\Windows\System\fPklxHX.exe
  C:\Windows\System\fPklxHX.exe
  2⤵
  PID:7756
- C:\Windows\System\NrLVQkh.exe
  C:\Windows\System\NrLVQkh.exe
  2⤵
  PID:7776
- C:\Windows\System\XYAWBGI.exe
  C:\Windows\System\XYAWBGI.exe
  2⤵
  PID:7792
- C:\Windows\System\ufCaUUp.exe
  C:\Windows\System\ufCaUUp.exe
  2⤵
  PID:7812
- C:\Windows\System\kOxtjWo.exe
  C:\Windows\System\kOxtjWo.exe
  2⤵
  PID:7836
- C:\Windows\System\SruDuAk.exe
  C:\Windows\System\SruDuAk.exe
  2⤵
  PID:7852
- C:\Windows\System\hkkMCkn.exe
  C:\Windows\System\hkkMCkn.exe
  2⤵
  PID:7868
- C:\Windows\System\mMVcows.exe
  C:\Windows\System\mMVcows.exe
  2⤵
  PID:7888
- C:\Windows\System\ANJCMGo.exe
  C:\Windows\System\ANJCMGo.exe
  2⤵
  PID:7908
- C:\Windows\System\GNCSJMC.exe
  C:\Windows\System\GNCSJMC.exe
  2⤵
  PID:7928
- C:\Windows\System\xEPCwqR.exe
  C:\Windows\System\xEPCwqR.exe
  2⤵
  PID:7948
- C:\Windows\System\VEQcMHs.exe
  C:\Windows\System\VEQcMHs.exe
  2⤵
  PID:7964
- C:\Windows\System\HtVMyEF.exe
  C:\Windows\System\HtVMyEF.exe
  2⤵
  PID:7984
- C:\Windows\System\WuIIknA.exe
  C:\Windows\System\WuIIknA.exe
  2⤵
  PID:8000
- C:\Windows\System\krqnMxB.exe
  C:\Windows\System\krqnMxB.exe
  2⤵
  PID:8020
- C:\Windows\System\uOTwcRx.exe
  C:\Windows\System\uOTwcRx.exe
  2⤵
  PID:8036
- C:\Windows\System\DPayMET.exe
  C:\Windows\System\DPayMET.exe
  2⤵
  PID:8056
- C:\Windows\System\nsxMLiN.exe
  C:\Windows\System\nsxMLiN.exe
  2⤵
  PID:8072
- C:\Windows\System\CGMbpWe.exe
  C:\Windows\System\CGMbpWe.exe
  2⤵
  PID:8092
- C:\Windows\System\qFyqcXr.exe
  C:\Windows\System\qFyqcXr.exe
  2⤵
  PID:8128
- C:\Windows\System\VjLFuGz.exe
  C:\Windows\System\VjLFuGz.exe
  2⤵
  PID:8188
- C:\Windows\System\GagorBw.exe
  C:\Windows\System\GagorBw.exe
  2⤵
  PID:4696
- C:\Windows\System\ewwGlGP.exe
  C:\Windows\System\ewwGlGP.exe
  2⤵
  PID:6876
- C:\Windows\System\QLznrsG.exe
  C:\Windows\System\QLznrsG.exe
  2⤵
  PID:7176
- C:\Windows\System\oumMPxN.exe
  C:\Windows\System\oumMPxN.exe
  2⤵
  PID:7240
- C:\Windows\System\GOJjCAO.exe
  C:\Windows\System\GOJjCAO.exe
  2⤵
  PID:2624
- C:\Windows\System\BhSMlzu.exe
  C:\Windows\System\BhSMlzu.exe
  2⤵
  PID:7276
- C:\Windows\System\mtNDObe.exe
  C:\Windows\System\mtNDObe.exe
  2⤵
  PID:7284
- C:\Windows\System\bkbQZje.exe
  C:\Windows\System\bkbQZje.exe
  2⤵
  PID:2244
- C:\Windows\System\iBPYMKs.exe
  C:\Windows\System\iBPYMKs.exe
  2⤵
  PID:5560
- C:\Windows\System\zTsfRyA.exe
  C:\Windows\System\zTsfRyA.exe
  2⤵
  PID:6120
- C:\Windows\System\asfPJUF.exe
  C:\Windows\System\asfPJUF.exe
  2⤵
  PID:7188
- C:\Windows\System\SZJmXav.exe
  C:\Windows\System\SZJmXav.exe
  2⤵
  PID:7260
- C:\Windows\System\fOxqaAK.exe
  C:\Windows\System\fOxqaAK.exe
  2⤵
  PID:7308
- C:\Windows\System\jNQgUWu.exe
  C:\Windows\System\jNQgUWu.exe
  2⤵
  PID:7348
- C:\Windows\System\BdjzWDp.exe
  C:\Windows\System\BdjzWDp.exe
  2⤵
  PID:7404
- C:\Windows\System\lbLzHgl.exe
  C:\Windows\System\lbLzHgl.exe
  2⤵
  PID:7424
- C:\Windows\System\FBpoRYK.exe
  C:\Windows\System\FBpoRYK.exe
  2⤵
  PID:7440
- C:\Windows\System\aJiOZDJ.exe
  C:\Windows\System\aJiOZDJ.exe
  2⤵
  PID:7492
- C:\Windows\System\EKxilYT.exe
  C:\Windows\System\EKxilYT.exe
  2⤵
  PID:7568
- C:\Windows\System\LRiyqNB.exe
  C:\Windows\System\LRiyqNB.exe
  2⤵
  PID:7632
- C:\Windows\System\HwxxslP.exe
  C:\Windows\System\HwxxslP.exe
  2⤵
  PID:7600
- C:\Windows\System\HynxsUK.exe
  C:\Windows\System\HynxsUK.exe
  2⤵
  PID:7748
- C:\Windows\System\UZJeVgA.exe
  C:\Windows\System\UZJeVgA.exe
  2⤵
  PID:7824
- C:\Windows\System\BcDhoSp.exe
  C:\Windows\System\BcDhoSp.exe
  2⤵
  PID:7864
- C:\Windows\System\IARqCfm.exe
  C:\Windows\System\IARqCfm.exe
  2⤵
  PID:7940
- C:\Windows\System\RECrKHO.exe
  C:\Windows\System\RECrKHO.exe
  2⤵
  PID:7976
- C:\Windows\System\ttVmUJm.exe
  C:\Windows\System\ttVmUJm.exe
  2⤵
  PID:8044
- C:\Windows\System\TtQIgFq.exe
  C:\Windows\System\TtQIgFq.exe
  2⤵
  PID:7536
- C:\Windows\System\hsRVJRt.exe
  C:\Windows\System\hsRVJRt.exe
  2⤵
  PID:7584
- C:\Windows\System\LXmIdMg.exe
  C:\Windows\System\LXmIdMg.exe
  2⤵
  PID:7684
- C:\Windows\System\LGZjYYW.exe
  C:\Windows\System\LGZjYYW.exe
  2⤵
  PID:7768
- C:\Windows\System\ejaphOY.exe
  C:\Windows\System\ejaphOY.exe
  2⤵
  PID:7808
- C:\Windows\System\NTjUiME.exe
  C:\Windows\System\NTjUiME.exe
  2⤵
  PID:8028
- C:\Windows\System\LmEefxu.exe
  C:\Windows\System\LmEefxu.exe
  2⤵
  PID:8088
- C:\Windows\System\sKGlvRY.exe
  C:\Windows\System\sKGlvRY.exe
  2⤵
  PID:8124
- C:\Windows\System\fpmtNIV.exe
  C:\Windows\System\fpmtNIV.exe
  2⤵
  PID:8140
- C:\Windows\System\JWcartR.exe
  C:\Windows\System\JWcartR.exe
  2⤵
  PID:8164
- C:\Windows\System\CqWRbwl.exe
  C:\Windows\System\CqWRbwl.exe
  2⤵
  PID:1648
- C:\Windows\System\vcWgTOI.exe
  C:\Windows\System\vcWgTOI.exe
  2⤵
  PID:2468
- C:\Windows\System\ylzKUeT.exe
  C:\Windows\System\ylzKUeT.exe
  2⤵
  PID:8184
- C:\Windows\System\hQhAveF.exe
  C:\Windows\System\hQhAveF.exe
  2⤵
  PID:7092
- C:\Windows\System\aJivZZd.exe
  C:\Windows\System\aJivZZd.exe
  2⤵
  PID:1968
- C:\Windows\System\nLJLemA.exe
  C:\Windows\System\nLJLemA.exe
  2⤵
  PID:5744
- C:\Windows\System\mwQaFnz.exe
  C:\Windows\System\mwQaFnz.exe
  2⤵
  PID:7224
- C:\Windows\System\mbLstsn.exe
  C:\Windows\System\mbLstsn.exe
  2⤵
  PID:7344
- C:\Windows\System\vBIHwSw.exe
  C:\Windows\System\vBIHwSw.exe
  2⤵
  PID:7420
- C:\Windows\System\fPbnjEz.exe
  C:\Windows\System\fPbnjEz.exe
  2⤵
  PID:7476
- C:\Windows\System\ETVbQMr.exe
  C:\Windows\System\ETVbQMr.exe
  2⤵
  PID:7716
- C:\Windows\System\NAgZexp.exe
  C:\Windows\System\NAgZexp.exe
  2⤵
  PID:7972
- C:\Windows\System\oCbuMgT.exe
  C:\Windows\System\oCbuMgT.exe
  2⤵
  PID:6212
- C:\Windows\System\SNcMypJ.exe
  C:\Windows\System\SNcMypJ.exe
  2⤵
  PID:7172
- C:\Windows\System\iezShgU.exe
  C:\Windows\System\iezShgU.exe
  2⤵
  PID:8016
- C:\Windows\System\pqICBYY.exe
  C:\Windows\System\pqICBYY.exe
  2⤵
  PID:7784
- C:\Windows\System\YiOqHaK.exe
  C:\Windows\System\YiOqHaK.exe
  2⤵
  PID:7904
- C:\Windows\System\ssTwUWL.exe
  C:\Windows\System\ssTwUWL.exe
  2⤵
  PID:7648
- C:\Windows\System\BUmJVLI.exe
  C:\Windows\System\BUmJVLI.exe
  2⤵
  PID:7508
- C:\Windows\System\shFiXZX.exe
  C:\Windows\System\shFiXZX.exe
  2⤵
  PID:2628
- C:\Windows\System\wfIhDGi.exe
  C:\Windows\System\wfIhDGi.exe
  2⤵
  PID:7736
- C:\Windows\System\GdKTeYt.exe
  C:\Windows\System\GdKTeYt.exe
  2⤵
  PID:8116
- C:\Windows\System\OdSrarg.exe
  C:\Windows\System\OdSrarg.exe
  2⤵
  PID:7880
- C:\Windows\System\tEOdWAY.exe
  C:\Windows\System\tEOdWAY.exe
  2⤵
  PID:7916
- C:\Windows\System\oopPXls.exe
  C:\Windows\System\oopPXls.exe
  2⤵
  PID:7992
- C:\Windows\System\ZjowxcC.exe
  C:\Windows\System\ZjowxcC.exe
  2⤵
  PID:7996
- C:\Windows\System\TQYCVDx.exe
  C:\Windows\System\TQYCVDx.exe
  2⤵
  PID:8108
- C:\Windows\System\QDUDTwI.exe
  C:\Windows\System\QDUDTwI.exe
  2⤵
  PID:8112
- C:\Windows\System\NqdFmou.exe
  C:\Windows\System\NqdFmou.exe
  2⤵
  PID:8136
- C:\Windows\System\uEfVEsq.exe
  C:\Windows\System\uEfVEsq.exe
  2⤵
  PID:8180
- C:\Windows\System\BEtvGAD.exe
  C:\Windows\System\BEtvGAD.exe
  2⤵
  PID:7256
- C:\Windows\System\YEBuZbW.exe
  C:\Windows\System\YEBuZbW.exe
  2⤵
  PID:7416
- C:\Windows\System\ijGeOaM.exe
  C:\Windows\System\ijGeOaM.exe
  2⤵
  PID:8080
- C:\Windows\System\RHNDULd.exe
  C:\Windows\System\RHNDULd.exe
  2⤵
  PID:5488
- C:\Windows\System\Rljxrzk.exe
  C:\Windows\System\Rljxrzk.exe
  2⤵
  PID:2000
- C:\Windows\System\EwoUbzf.exe
  C:\Windows\System\EwoUbzf.exe
  2⤵
  PID:7052
- C:\Windows\System\ZtniukK.exe
  C:\Windows\System\ZtniukK.exe
  2⤵
  PID:7340
- C:\Windows\System\AEGxpiK.exe
  C:\Windows\System\AEGxpiK.exe
  2⤵
  PID:6644
- C:\Windows\System\xPDUMvC.exe
  C:\Windows\System\xPDUMvC.exe
  2⤵
  PID:7564
- C:\Windows\System\pMUShiA.exe
  C:\Windows\System\pMUShiA.exe
  2⤵
  PID:7532
- C:\Windows\System\eWmyrKE.exe
  C:\Windows\System\eWmyrKE.exe
  2⤵
  PID:284
- C:\Windows\System\IcQLzyM.exe
  C:\Windows\System\IcQLzyM.exe
  2⤵
  PID:7804
- C:\Windows\System\cbwNvrr.exe
  C:\Windows\System\cbwNvrr.exe
  2⤵
  PID:7956
- C:\Windows\System\UmlXaDO.exe
  C:\Windows\System\UmlXaDO.exe
  2⤵
  PID:8012
- C:\Windows\System\OsYIHwQ.exe
  C:\Windows\System\OsYIHwQ.exe
  2⤵
  PID:1664
- C:\Windows\System\XvhCnCL.exe
  C:\Windows\System\XvhCnCL.exe
  2⤵
  PID:8068
- C:\Windows\System\fUkMhnf.exe
  C:\Windows\System\fUkMhnf.exe
  2⤵
  PID:7692
- C:\Windows\System\dYUpwBX.exe
  C:\Windows\System\dYUpwBX.exe
  2⤵
  PID:6996
- C:\Windows\System\PrKnAXs.exe
  C:\Windows\System\PrKnAXs.exe
  2⤵
  PID:2416
- C:\Windows\System\uaXHexP.exe
  C:\Windows\System\uaXHexP.exe
  2⤵
  PID:2696
- C:\Windows\System\TJrBFAx.exe
  C:\Windows\System\TJrBFAx.exe
  2⤵
  PID:8152
- C:\Windows\System\XNbzoUb.exe
  C:\Windows\System\XNbzoUb.exe
  2⤵
  PID:2056
- C:\Windows\System\jOsVHLs.exe
  C:\Windows\System\jOsVHLs.exe
  2⤵
  PID:1776
- C:\Windows\System\myXfYLu.exe
  C:\Windows\System\myXfYLu.exe
  2⤵
  PID:7616
- C:\Windows\System\bQmKrma.exe
  C:\Windows\System\bQmKrma.exe
  2⤵
  PID:7368
- C:\Windows\System\gtBImic.exe
  C:\Windows\System\gtBImic.exe
  2⤵
  PID:7512
- C:\Windows\System\scJEXwE.exe
  C:\Windows\System\scJEXwE.exe
  2⤵
  PID:5452
- C:\Windows\System\wXHcgEP.exe
  C:\Windows\System\wXHcgEP.exe
  2⤵
  PID:1996
- C:\Windows\System\jUtaZEs.exe
  C:\Windows\System\jUtaZEs.exe
  2⤵
  PID:7516
- C:\Windows\System\XshILAn.exe
  C:\Windows\System\XshILAn.exe
  2⤵
  PID:2420
- C:\Windows\System\hcQylsX.exe
  C:\Windows\System\hcQylsX.exe
  2⤵
  PID:540
- C:\Windows\System\RXYMwee.exe
  C:\Windows\System\RXYMwee.exe
  2⤵
  PID:552
- C:\Windows\System\qSabTec.exe
  C:\Windows\System\qSabTec.exe
  2⤵
  PID:7328
- C:\Windows\System\GTVeaNb.exe
  C:\Windows\System\GTVeaNb.exe
  2⤵
  PID:8104
- C:\Windows\System\TGZlSZg.exe
  C:\Windows\System\TGZlSZg.exe
  2⤵
  PID:7388
- C:\Windows\System\qLQNdaX.exe
  C:\Windows\System\qLQNdaX.exe
  2⤵
  PID:1288
- C:\Windows\System\gEShksa.exe
  C:\Windows\System\gEShksa.exe
  2⤵
  PID:684
- C:\Windows\System\QxzQdrF.exe
  C:\Windows\System\QxzQdrF.exe
  2⤵
  PID:7620
- C:\Windows\System\mydZBuo.exe
  C:\Windows\System\mydZBuo.exe
  2⤵
  PID:4360
- C:\Windows\System\NMvnFyR.exe
  C:\Windows\System\NMvnFyR.exe
  2⤵
  PID:7400
- C:\Windows\System\IuBVvtl.exe
  C:\Windows\System\IuBVvtl.exe
  2⤵
  PID:8196
- C:\Windows\System\tzqiqZN.exe
  C:\Windows\System\tzqiqZN.exe
  2⤵
  PID:8212
- C:\Windows\System\Jpqkyfw.exe
  C:\Windows\System\Jpqkyfw.exe
  2⤵
  PID:8232
- C:\Windows\System\wYYeDij.exe
  C:\Windows\System\wYYeDij.exe
  2⤵
  PID:8276
- C:\Windows\System\JrjllsY.exe
  C:\Windows\System\JrjllsY.exe
  2⤵
  PID:8292
- C:\Windows\System\YfvBlhF.exe
  C:\Windows\System\YfvBlhF.exe
  2⤵
  PID:8312
- C:\Windows\System\nKAZjrZ.exe
  C:\Windows\System\nKAZjrZ.exe
  2⤵
  PID:8328
- C:\Windows\System\PFtkwfU.exe
  C:\Windows\System\PFtkwfU.exe
  2⤵
  PID:8344
- C:\Windows\System\BLGnjlO.exe
  C:\Windows\System\BLGnjlO.exe
  2⤵
  PID:8364
- C:\Windows\System\amZHQNb.exe
  C:\Windows\System\amZHQNb.exe
  2⤵
  PID:8380
- C:\Windows\System\dQfKNcw.exe
  C:\Windows\System\dQfKNcw.exe
  2⤵
  PID:8404
- C:\Windows\System\emgbuRE.exe
  C:\Windows\System\emgbuRE.exe
  2⤵
  PID:8420
- C:\Windows\System\AumLQch.exe
  C:\Windows\System\AumLQch.exe
  2⤵
  PID:8468
- C:\Windows\System\ldkqsCt.exe
  C:\Windows\System\ldkqsCt.exe
  2⤵
  PID:8484
- C:\Windows\System\ANDyLSU.exe
  C:\Windows\System\ANDyLSU.exe
  2⤵
  PID:8500
- C:\Windows\System\QAvLZAe.exe
  C:\Windows\System\QAvLZAe.exe
  2⤵
  PID:8520
- C:\Windows\System\ZwjtFyv.exe
  C:\Windows\System\ZwjtFyv.exe
  2⤵
  PID:8540
- C:\Windows\System\dnaaVDD.exe
  C:\Windows\System\dnaaVDD.exe
  2⤵
  PID:8560
- C:\Windows\System\kZhLhlm.exe
  C:\Windows\System\kZhLhlm.exe
  2⤵
  PID:8580
- C:\Windows\System\brTXEoV.exe
  C:\Windows\System\brTXEoV.exe
  2⤵
  PID:8608
- C:\Windows\System\DVUbdeD.exe
  C:\Windows\System\DVUbdeD.exe
  2⤵
  PID:8624
- C:\Windows\System\uZBgwje.exe
  C:\Windows\System\uZBgwje.exe
  2⤵
  PID:8640
- C:\Windows\System\zRQXJcT.exe
  C:\Windows\System\zRQXJcT.exe
  2⤵
  PID:8656
- C:\Windows\System\ptqgVqP.exe
  C:\Windows\System\ptqgVqP.exe
  2⤵
  PID:8672
- C:\Windows\System\REVVDWr.exe
  C:\Windows\System\REVVDWr.exe
  2⤵
  PID:8692
- C:\Windows\System\vhwSXnn.exe
  C:\Windows\System\vhwSXnn.exe
  2⤵
  PID:8728
- C:\Windows\System\dQIFGOr.exe
  C:\Windows\System\dQIFGOr.exe
  2⤵
  PID:8744
- C:\Windows\System\UqydzJE.exe
  C:\Windows\System\UqydzJE.exe
  2⤵
  PID:8760
- C:\Windows\System\PVxKCks.exe
  C:\Windows\System\PVxKCks.exe
  2⤵
  PID:8776
- C:\Windows\System\ZoNLgzd.exe
  C:\Windows\System\ZoNLgzd.exe
  2⤵
  PID:8796
- C:\Windows\System\fpDTJhj.exe
  C:\Windows\System\fpDTJhj.exe
  2⤵
  PID:8812
- C:\Windows\System\DScyOEU.exe
  C:\Windows\System\DScyOEU.exe
  2⤵
  PID:8828
- C:\Windows\System\zByIHTc.exe
  C:\Windows\System\zByIHTc.exe
  2⤵
  PID:8848
- C:\Windows\System\ZlLDQCf.exe
  C:\Windows\System\ZlLDQCf.exe
  2⤵
  PID:8868
- C:\Windows\System\uBdXNfr.exe
  C:\Windows\System\uBdXNfr.exe
  2⤵
  PID:8888
- C:\Windows\System\GkKWetK.exe
  C:\Windows\System\GkKWetK.exe
  2⤵
  PID:8904
- C:\Windows\System\UHLrkzq.exe
  C:\Windows\System\UHLrkzq.exe
  2⤵
  PID:8956
- C:\Windows\System\nZyTlZq.exe
  C:\Windows\System\nZyTlZq.exe
  2⤵
  PID:8972
- C:\Windows\System\BAWBUEK.exe
  C:\Windows\System\BAWBUEK.exe
  2⤵
  PID:8988
- C:\Windows\System\ayQypBE.exe
  C:\Windows\System\ayQypBE.exe
  2⤵
  PID:9004
- C:\Windows\System\bkXFTTD.exe
  C:\Windows\System\bkXFTTD.exe
  2⤵
  PID:9020
- C:\Windows\System\hkbCfnc.exe
  C:\Windows\System\hkbCfnc.exe
  2⤵
  PID:9040
- C:\Windows\System\daSVQga.exe
  C:\Windows\System\daSVQga.exe
  2⤵
  PID:9072
- C:\Windows\System\Qoavcxw.exe
  C:\Windows\System\Qoavcxw.exe
  2⤵
  PID:9088
- C:\Windows\System\YNacdTC.exe
  C:\Windows\System\YNacdTC.exe
  2⤵
  PID:9104
- C:\Windows\System\GbOLIRG.exe
  C:\Windows\System\GbOLIRG.exe
  2⤵
  PID:9120
- C:\Windows\System\sijFqiA.exe
  C:\Windows\System\sijFqiA.exe
  2⤵
  PID:9140
- C:\Windows\System\QqEBARb.exe
  C:\Windows\System\QqEBARb.exe
  2⤵
  PID:9156
- C:\Windows\System\JjNtTmx.exe
  C:\Windows\System\JjNtTmx.exe
  2⤵
  PID:9176
- C:\Windows\System\tiYPbAA.exe
  C:\Windows\System\tiYPbAA.exe
  2⤵
  PID:9208
- C:\Windows\System\CpeZcgt.exe
  C:\Windows\System\CpeZcgt.exe
  2⤵
  PID:1340
- C:\Windows\System\EpiKNnf.exe
  C:\Windows\System\EpiKNnf.exe
  2⤵
  PID:7580
- C:\Windows\System\WkSroQN.exe
  C:\Windows\System\WkSroQN.exe
  2⤵
  PID:7208
- C:\Windows\System\ZCAzmwp.exe
  C:\Windows\System\ZCAzmwp.exe
  2⤵
  PID:2228
- C:\Windows\System\SPlMEmg.exe
  C:\Windows\System\SPlMEmg.exe
  2⤵
  PID:8260
- C:\Windows\System\vzofIcF.exe
  C:\Windows\System\vzofIcF.exe
  2⤵
  PID:8268
- C:\Windows\System\QFCcfAZ.exe
  C:\Windows\System\QFCcfAZ.exe
  2⤵
  PID:8324
- C:\Windows\System\sIJOgKi.exe
  C:\Windows\System\sIJOgKi.exe
  2⤵
  PID:8392
- C:\Windows\System\ydaVMbz.exe
  C:\Windows\System\ydaVMbz.exe
  2⤵
  PID:8412
- C:\Windows\System\xCPQJKc.exe
  C:\Windows\System\xCPQJKc.exe
  2⤵
  PID:8372
- C:\Windows\System\Txosdke.exe
  C:\Windows\System\Txosdke.exe
  2⤵
  PID:8448
- C:\Windows\System\vAAmped.exe
  C:\Windows\System\vAAmped.exe
  2⤵
  PID:2796
- C:\Windows\System\JUdluXO.exe
  C:\Windows\System\JUdluXO.exe
  2⤵
  PID:8492
- C:\Windows\System\xcInPnM.exe
  C:\Windows\System\xcInPnM.exe
  2⤵
  PID:8536
- C:\Windows\System\alCWXfD.exe
  C:\Windows\System\alCWXfD.exe
  2⤵
  PID:8588
- C:\Windows\System\JOnBuQM.exe
  C:\Windows\System\JOnBuQM.exe
  2⤵
  PID:8592
- C:\Windows\System\MYfeYAV.exe
  C:\Windows\System\MYfeYAV.exe
  2⤵
  PID:8616
- C:\Windows\System\MzqvtJP.exe
  C:\Windows\System\MzqvtJP.exe
  2⤵
  PID:8680
- C:\Windows\System\MSUYZAd.exe
  C:\Windows\System\MSUYZAd.exe
  2⤵
  PID:8664
- C:\Windows\System\TmybdBs.exe
  C:\Windows\System\TmybdBs.exe
  2⤵
  PID:8712
- C:\Windows\System\GawHQlW.exe
  C:\Windows\System\GawHQlW.exe
  2⤵
  PID:8460
- C:\Windows\System\mtFAljP.exe
  C:\Windows\System\mtFAljP.exe
  2⤵
  PID:8804
- C:\Windows\System\ntFmjuQ.exe
  C:\Windows\System\ntFmjuQ.exe
  2⤵
  PID:8840
- C:\Windows\System\BiZULTC.exe
  C:\Windows\System\BiZULTC.exe
  2⤵
  PID:8912
- C:\Windows\System\olDDfnq.exe
  C:\Windows\System\olDDfnq.exe
  2⤵
  PID:8784
- C:\Windows\System\DVVblmB.exe
  C:\Windows\System\DVVblmB.exe
  2⤵
  PID:8824
- C:\Windows\System\RwQoWOV.exe
  C:\Windows\System\RwQoWOV.exe
  2⤵
  PID:8928
- C:\Windows\System\CKvBDyK.exe
  C:\Windows\System\CKvBDyK.exe
  2⤵
  PID:2092
- C:\Windows\System\bfOVRBW.exe
  C:\Windows\System\bfOVRBW.exe
  2⤵
  PID:8968
- C:\Windows\System\ryTnbav.exe
  C:\Windows\System\ryTnbav.exe
  2⤵
  PID:9016
- C:\Windows\System\QhYpqvZ.exe
  C:\Windows\System\QhYpqvZ.exe
  2⤵
  PID:9000
- C:\Windows\System\rGgHfoj.exe
  C:\Windows\System\rGgHfoj.exe
  2⤵
  PID:9056
- C:\Windows\System\etksGmJ.exe
  C:\Windows\System\etksGmJ.exe
  2⤵
  PID:9068
- C:\Windows\System\eIytsCF.exe
  C:\Windows\System\eIytsCF.exe
  2⤵
  PID:9100
- C:\Windows\System\lNTUveW.exe
  C:\Windows\System\lNTUveW.exe
  2⤵
  PID:1600
- C:\Windows\System\UzmgsEk.exe
  C:\Windows\System\UzmgsEk.exe
  2⤵
  PID:272
- C:\Windows\System\ocjKpge.exe
  C:\Windows\System\ocjKpge.exe
  2⤵
  PID:7876
- C:\Windows\System\nFnfplc.exe
  C:\Windows\System\nFnfplc.exe
  2⤵
  PID:8156
- C:\Windows\System\NVZNCHq.exe
  C:\Windows\System\NVZNCHq.exe
  2⤵
  PID:8284
- C:\Windows\System\EBRaNJE.exe
  C:\Windows\System\EBRaNJE.exe
  2⤵
  PID:8288
- C:\Windows\System\wtFburu.exe
  C:\Windows\System\wtFburu.exe
  2⤵
  PID:8388
- C:\Windows\System\SObuwOh.exe
  C:\Windows\System\SObuwOh.exe
  2⤵
  PID:8428
- C:\Windows\System\MAmwgKw.exe
  C:\Windows\System\MAmwgKw.exe
  2⤵
  PID:8440
- C:\Windows\System\qhUojOZ.exe
  C:\Windows\System\qhUojOZ.exe
  2⤵
  PID:8556
- C:\Windows\System\wlDjRQS.exe
  C:\Windows\System\wlDjRQS.exe
  2⤵
  PID:8508
- C:\Windows\System\Tswgekz.exe
  C:\Windows\System\Tswgekz.exe
  2⤵
  PID:8688
- C:\Windows\System\QttKLSZ.exe
  C:\Windows\System\QttKLSZ.exe
  2⤵
  PID:8720
- C:\Windows\System\WBXRyre.exe
  C:\Windows\System\WBXRyre.exe
  2⤵
  PID:8700
- C:\Windows\System\gMsNLSO.exe
  C:\Windows\System\gMsNLSO.exe
  2⤵
  PID:8736
- C:\Windows\System\YxhmPKG.exe
  C:\Windows\System\YxhmPKG.exe
  2⤵
  PID:8768
- C:\Windows\System\eKBiTEp.exe
  C:\Windows\System\eKBiTEp.exe
  2⤵
  PID:8876
- C:\Windows\System\pNsimeA.exe
  C:\Windows\System\pNsimeA.exe
  2⤵
  PID:8952
- C:\Windows\System\zBKYlky.exe
  C:\Windows\System\zBKYlky.exe
  2⤵
  PID:8996
- C:\Windows\System\gJxCyRl.exe
  C:\Windows\System\gJxCyRl.exe
  2⤵
  PID:9128
- C:\Windows\System\zxOLKvt.exe
  C:\Windows\System\zxOLKvt.exe
  2⤵
  PID:8936
- C:\Windows\System\aTsXeWB.exe
  C:\Windows\System\aTsXeWB.exe
  2⤵
  PID:9096
- C:\Windows\System\MYKbMBs.exe
  C:\Windows\System\MYKbMBs.exe
  2⤵
  PID:9164
- C:\Windows\System\lglNooH.exe
  C:\Windows\System\lglNooH.exe
  2⤵
  PID:8224
- C:\Windows\System\ZUUzdIP.exe
  C:\Windows\System\ZUUzdIP.exe
  2⤵
  PID:2668
- C:\Windows\System\pHuQBhM.exe
  C:\Windows\System\pHuQBhM.exe
  2⤵
  PID:8160
- C:\Windows\System\WbPDbNb.exe
  C:\Windows\System\WbPDbNb.exe
  2⤵
  PID:8240
- C:\Windows\System\seDngFp.exe
  C:\Windows\System\seDngFp.exe
  2⤵
  PID:8256
- C:\Windows\System\MAxntZK.exe
  C:\Windows\System\MAxntZK.exe
  2⤵
  PID:2812
- C:\Windows\System\zyOqbnc.exe
  C:\Windows\System\zyOqbnc.exe
  2⤵
  PID:8416
- C:\Windows\System\XEqBFmj.exe
  C:\Windows\System\XEqBFmj.exe
  2⤵
  PID:8572
- C:\Windows\System\EQGvUup.exe
  C:\Windows\System\EQGvUup.exe
  2⤵
  PID:8880
- C:\Windows\System\qoyJrgz.exe
  C:\Windows\System\qoyJrgz.exe
  2⤵
  PID:8648
- C:\Windows\System\OBwvqXq.exe
  C:\Windows\System\OBwvqXq.exe
  2⤵
  PID:8788
- C:\Windows\System\gQmJhbm.exe
  C:\Windows\System\gQmJhbm.exe
  2⤵
  PID:9048
- C:\Windows\System\fnjeYIM.exe
  C:\Windows\System\fnjeYIM.exe
  2⤵
  PID:9012
- C:\Windows\System\youcUQW.exe
  C:\Windows\System\youcUQW.exe
  2⤵
  PID:9184
- C:\Windows\System\grsuWkC.exe
  C:\Windows\System\grsuWkC.exe
  2⤵
  PID:8320
- C:\Windows\System\rwWhRnm.exe
  C:\Windows\System\rwWhRnm.exe
  2⤵
  PID:9132
- C:\Windows\System\rXqmKlJ.exe
  C:\Windows\System\rXqmKlJ.exe
  2⤵
  PID:2604
- C:\Windows\System\BykgwBq.exe
  C:\Windows\System\BykgwBq.exe
  2⤵
  PID:9204
- C:\Windows\System\iIjeHFy.exe
  C:\Windows\System\iIjeHFy.exe
  2⤵
  PID:9200
- C:\Windows\System\EkqshKa.exe
  C:\Windows\System\EkqshKa.exe
  2⤵
  PID:9168
- C:\Windows\System\CjEDxOW.exe
  C:\Windows\System\CjEDxOW.exe
  2⤵
  PID:8360
- C:\Windows\System\HBklwYW.exe
  C:\Windows\System\HBklwYW.exe
  2⤵
  PID:8636
- C:\Windows\System\DDPpCzP.exe
  C:\Windows\System\DDPpCzP.exe
  2⤵
  PID:8528
- C:\Windows\System\MavXKDa.exe
  C:\Windows\System\MavXKDa.exe
  2⤵
  PID:612
- C:\Windows\System\UPBOEqJ.exe
  C:\Windows\System\UPBOEqJ.exe
  2⤵
  PID:9080
- C:\Windows\System\BZvKUaq.exe
  C:\Windows\System\BZvKUaq.exe
  2⤵
  PID:1036
- C:\Windows\System\xHCGSUN.exe
  C:\Windows\System\xHCGSUN.exe
  2⤵
  PID:8940
- C:\Windows\System\AweLzCR.exe
  C:\Windows\System\AweLzCR.exe
  2⤵
  PID:8512
- C:\Windows\System\WzLQCkv.exe
  C:\Windows\System\WzLQCkv.exe
  2⤵
  PID:764
- C:\Windows\System\ZxIMhtE.exe
  C:\Windows\System\ZxIMhtE.exe
  2⤵
  PID:9116
- C:\Windows\System\hgLkKuG.exe
  C:\Windows\System\hgLkKuG.exe
  2⤵
  PID:2824
- C:\Windows\System\QBKXEGp.exe
  C:\Windows\System\QBKXEGp.exe
  2⤵
  PID:880
- C:\Windows\System\gJmCiLw.exe
  C:\Windows\System\gJmCiLw.exe
  2⤵
  PID:8480
- C:\Windows\System\EAZywNT.exe
  C:\Windows\System\EAZywNT.exe
  2⤵
  PID:8652
- C:\Windows\System\LjChzSR.exe
  C:\Windows\System\LjChzSR.exe
  2⤵
  PID:9224
- C:\Windows\System\KnWGUXe.exe
  C:\Windows\System\KnWGUXe.exe
  2⤵
  PID:9240
- C:\Windows\System\ordbNIt.exe
  C:\Windows\System\ordbNIt.exe
  2⤵
  PID:9256
- C:\Windows\System\GyOIlYd.exe
  C:\Windows\System\GyOIlYd.exe
  2⤵
  PID:9272
- C:\Windows\System\mztMJpI.exe
  C:\Windows\System\mztMJpI.exe
  2⤵
  PID:9288
- C:\Windows\System\lcJlCUJ.exe
  C:\Windows\System\lcJlCUJ.exe
  2⤵
  PID:9304
- C:\Windows\System\HaCBqEN.exe
  C:\Windows\System\HaCBqEN.exe
  2⤵
  PID:9320
- C:\Windows\System\wsEVCzu.exe
  C:\Windows\System\wsEVCzu.exe
  2⤵
  PID:9336
- C:\Windows\System\FrERtVE.exe
  C:\Windows\System\FrERtVE.exe
  2⤵
  PID:9352
- C:\Windows\System\xZKEPTM.exe
  C:\Windows\System\xZKEPTM.exe
  2⤵
  PID:9368
- C:\Windows\System\Zlvrxde.exe
  C:\Windows\System\Zlvrxde.exe
  2⤵
  PID:9392
- C:\Windows\System\xLiPeAg.exe
  C:\Windows\System\xLiPeAg.exe
  2⤵
  PID:9432
- C:\Windows\System\DwpaLPu.exe
  C:\Windows\System\DwpaLPu.exe
  2⤵
  PID:9448
- C:\Windows\System\KRIlNtC.exe
  C:\Windows\System\KRIlNtC.exe
  2⤵
  PID:9464
- C:\Windows\System\cstoafY.exe
  C:\Windows\System\cstoafY.exe
  2⤵
  PID:9480
- C:\Windows\System\eLuJiFQ.exe
  C:\Windows\System\eLuJiFQ.exe
  2⤵
  PID:9496
- C:\Windows\System\mHuDoIA.exe
  C:\Windows\System\mHuDoIA.exe
  2⤵
  PID:9512
- C:\Windows\System\tjoUPrP.exe
  C:\Windows\System\tjoUPrP.exe
  2⤵
  PID:9528
- C:\Windows\System\KBUSNJe.exe
  C:\Windows\System\KBUSNJe.exe
  2⤵
  PID:9544
- C:\Windows\System\WmliJEI.exe
  C:\Windows\System\WmliJEI.exe
  2⤵
  PID:9560
- C:\Windows\System\xxjGUJp.exe
  C:\Windows\System\xxjGUJp.exe
  2⤵
  PID:9576
- C:\Windows\System\YSZuVxm.exe
  C:\Windows\System\YSZuVxm.exe
  2⤵
  PID:9592
- C:\Windows\System\KXgQZTl.exe
  C:\Windows\System\KXgQZTl.exe
  2⤵
  PID:9608
- C:\Windows\System\ZEmkHid.exe
  C:\Windows\System\ZEmkHid.exe
  2⤵
  PID:9624
- C:\Windows\System\bGijFOo.exe
  C:\Windows\System\bGijFOo.exe
  2⤵
  PID:9640
- C:\Windows\System\tDRpJyp.exe
  C:\Windows\System\tDRpJyp.exe
  2⤵
  PID:9656
- C:\Windows\System\vHVaHuj.exe
  C:\Windows\System\vHVaHuj.exe
  2⤵
  PID:9672
- C:\Windows\System\nXGIieX.exe
  C:\Windows\System\nXGIieX.exe
  2⤵
  PID:9688
- C:\Windows\System\alzQwRP.exe
  C:\Windows\System\alzQwRP.exe
  2⤵
  PID:9704
- C:\Windows\System\hWIiUzj.exe
  C:\Windows\System\hWIiUzj.exe
  2⤵
  PID:9720
- C:\Windows\System\qoRxKrW.exe
  C:\Windows\System\qoRxKrW.exe
  2⤵
  PID:9736
- C:\Windows\System\FCMLJll.exe
  C:\Windows\System\FCMLJll.exe
  2⤵
  PID:9752
- C:\Windows\System\HHSskUd.exe
  C:\Windows\System\HHSskUd.exe
  2⤵
  PID:9768
- C:\Windows\System\KlzPpXg.exe
  C:\Windows\System\KlzPpXg.exe
  2⤵
  PID:9784
- C:\Windows\System\ycxxomj.exe
  C:\Windows\System\ycxxomj.exe
  2⤵
  PID:9800
- C:\Windows\System\WmpScgK.exe
  C:\Windows\System\WmpScgK.exe
  2⤵
  PID:9816
- C:\Windows\System\XNOFvXN.exe
  C:\Windows\System\XNOFvXN.exe
  2⤵
  PID:9832
- C:\Windows\System\JLFaqVh.exe
  C:\Windows\System\JLFaqVh.exe
  2⤵
  PID:9848
- C:\Windows\System\YdiupPO.exe
  C:\Windows\System\YdiupPO.exe
  2⤵
  PID:10000
- C:\Windows\System\MfMatBx.exe
  C:\Windows\System\MfMatBx.exe
  2⤵
  PID:10028
- C:\Windows\System\jdciAVd.exe
  C:\Windows\System\jdciAVd.exe
  2⤵
  PID:10044
- C:\Windows\System\FVsDkDc.exe
  C:\Windows\System\FVsDkDc.exe
  2⤵
  PID:10068
- C:\Windows\System\NGotoQN.exe
  C:\Windows\System\NGotoQN.exe
  2⤵
  PID:10092
- C:\Windows\System\vEPxLAV.exe
  C:\Windows\System\vEPxLAV.exe
  2⤵
  PID:10108
- C:\Windows\System\tWRqPTe.exe
  C:\Windows\System\tWRqPTe.exe
  2⤵
  PID:10132
- C:\Windows\System\WlxSiIf.exe
  C:\Windows\System\WlxSiIf.exe
  2⤵
  PID:10152
- C:\Windows\System\RhmxWcv.exe
  C:\Windows\System\RhmxWcv.exe
  2⤵
  PID:10168
- C:\Windows\System\MWLIsvX.exe
  C:\Windows\System\MWLIsvX.exe
  2⤵
  PID:10192
- C:\Windows\System\sYGASLD.exe
  C:\Windows\System\sYGASLD.exe
  2⤵
  PID:10208
- C:\Windows\System\zYPAmER.exe
  C:\Windows\System\zYPAmER.exe
  2⤵
  PID:10232
- C:\Windows\System\hlPHCBe.exe
  C:\Windows\System\hlPHCBe.exe
  2⤵
  PID:8604
- C:\Windows\System\YDOeLUt.exe
  C:\Windows\System\YDOeLUt.exe
  2⤵
  PID:8752
- C:\Windows\System\DEuAers.exe
  C:\Windows\System\DEuAers.exe
  2⤵
  PID:2448
- C:\Windows\System\nMtdQIR.exe
  C:\Windows\System\nMtdQIR.exe
  2⤵
  PID:9300
- C:\Windows\System\TvgoZOh.exe
  C:\Windows\System\TvgoZOh.exe
  2⤵
  PID:9280
- C:\Windows\System\zuhIzVF.exe
  C:\Windows\System\zuhIzVF.exe
  2⤵
  PID:9360
- C:\Windows\System\XcSpFON.exe
  C:\Windows\System\XcSpFON.exe
  2⤵
  PID:9400
- C:\Windows\System\qfYVPaM.exe
  C:\Windows\System\qfYVPaM.exe
  2⤵
  PID:9408
- C:\Windows\System\IFkMXpr.exe
  C:\Windows\System\IFkMXpr.exe
  2⤵
  PID:9412
- C:\Windows\System\iyFUQku.exe
  C:\Windows\System\iyFUQku.exe
  2⤵
  PID:9472
- C:\Windows\System\bucxVLO.exe
  C:\Windows\System\bucxVLO.exe
  2⤵
  PID:9536
- C:\Windows\System\Okfrufs.exe
  C:\Windows\System\Okfrufs.exe
  2⤵
  PID:9568
- C:\Windows\System\BuYHMbp.exe
  C:\Windows\System\BuYHMbp.exe
  2⤵
  PID:9520
- C:\Windows\System\MUpvZVh.exe
  C:\Windows\System\MUpvZVh.exe
  2⤵
  PID:9584
- C:\Windows\System\DbHsQof.exe
  C:\Windows\System\DbHsQof.exe
  2⤵
  PID:9684
- C:\Windows\System\hzGVuwt.exe
  C:\Windows\System\hzGVuwt.exe
  2⤵
  PID:9700
- C:\Windows\System\OjOzWMo.exe
  C:\Windows\System\OjOzWMo.exe
  2⤵
  PID:9748
- C:\Windows\System\gltptgJ.exe
  C:\Windows\System\gltptgJ.exe
  2⤵
  PID:9824
- C:\Windows\System\rUUpHkp.exe
  C:\Windows\System\rUUpHkp.exe
  2⤵
  PID:9812
- C:\Windows\System\WeBFDvJ.exe
  C:\Windows\System\WeBFDvJ.exe
  2⤵
  PID:1028
- C:\Windows\System\FhmThaH.exe
  C:\Windows\System\FhmThaH.exe
  2⤵
  PID:9876
- C:\Windows\System\kLrHQVP.exe
  C:\Windows\System\kLrHQVP.exe
  2⤵
  PID:9892
- C:\Windows\System\WIjVrwS.exe
  C:\Windows\System\WIjVrwS.exe
  2⤵
  PID:9908
- C:\Windows\System\SrHnrdt.exe
  C:\Windows\System\SrHnrdt.exe
  2⤵
  PID:9932
- C:\Windows\System\SnaCJCI.exe
  C:\Windows\System\SnaCJCI.exe
  2⤵
  PID:9952
- C:\Windows\System\UOjgLfU.exe
  C:\Windows\System\UOjgLfU.exe
  2⤵
  PID:9968
- C:\Windows\System\fCYegLl.exe
  C:\Windows\System\fCYegLl.exe
  2⤵
  PID:9992
- C:\Windows\System\VIiEMsL.exe
  C:\Windows\System\VIiEMsL.exe
  2⤵
  PID:10020
- C:\Windows\System\ueXdirS.exe
  C:\Windows\System\ueXdirS.exe
  2⤵
  PID:8476
- C:\Windows\System\mMUzXKe.exe
  C:\Windows\System\mMUzXKe.exe
  2⤵
  PID:10064
- C:\Windows\System\SryIKZm.exe
  C:\Windows\System\SryIKZm.exe
  2⤵
  PID:10104
- C:\Windows\System\mCKkmRY.exe
  C:\Windows\System\mCKkmRY.exe
  2⤵
  PID:10124
- C:\Windows\System\WBdEwKO.exe
  C:\Windows\System\WBdEwKO.exe
  2⤵
  PID:10160
- C:\Windows\System\mIedBmy.exe
  C:\Windows\System\mIedBmy.exe
  2⤵
  PID:2124
- C:\Windows\System\RbxnBUK.exe
  C:\Windows\System\RbxnBUK.exe
  2⤵
  PID:10204
- C:\Windows\System\VHAAmuf.exe
  C:\Windows\System\VHAAmuf.exe
  2⤵
  PID:9192
- C:\Windows\System\gHjJRbD.exe
  C:\Windows\System\gHjJRbD.exe
  2⤵
  PID:9220
- C:\Windows\System\uRJvSdB.exe
  C:\Windows\System\uRJvSdB.exe
  2⤵
  PID:9296
- C:\Windows\System\xtUWduw.exe
  C:\Windows\System\xtUWduw.exe
  2⤵
  PID:9420
- C:\Windows\System\XXKEGUi.exe
  C:\Windows\System\XXKEGUi.exe
  2⤵
  PID:9444
- C:\Windows\System\IIfiDZa.exe
  C:\Windows\System\IIfiDZa.exe
  2⤵
  PID:9552
- C:\Windows\System\WezPgBr.exe
  C:\Windows\System\WezPgBr.exe
  2⤵
  PID:9488
- C:\Windows\System\uGhRnGS.exe
  C:\Windows\System\uGhRnGS.exe
  2⤵
  PID:9604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\KMFxKUw.exe

Filesize
1.2MB

MD5
63996e8fa9213dc4223dc163983de700

SHA1
478ab95d32c139a8bf608d3c3fbe3565bebaa36f

SHA256
a47646ed0549429179988d2667dea27177d60df2c3a172cfd71129d3e0ad1255

SHA512
683938b5fb510c9defb1fb04d6af76162624b4675b9724ae0286cdce4110287e33d934bde43353aaae012d7aa52cdad759c1da4e2a2b062671d57229cac09e06

Download Submit
C:\Windows\system\TPqOYlQ.exe

Filesize
8B

MD5
f784b25815939eae756df140ec88bcce

SHA1
959f992ef3b023dc7011c892ef46609e93e446e0

SHA256
b07841838fb38c8a648dce4081c46e746b7428b7dd7a7af6337f780fa28df267

SHA512
d5eae32a5e30d2ab87f7e6f15452bb24385399c780ce67a1cb32fbbe5926efc5a7eeebcaf183f72d069f30884e841fbb8be09ab0434efbd78c17d304e8b87e92

Download Submit
C:\Windows\system\ZKrpcga.exe

Filesize
2.2MB

MD5
a40db87262f790c9b440ae58e66fac8f

SHA1
6b238c3e228939bc3b587a93b808d64c5855e9f1

SHA256
abcc5a077fda8ff9deead934ac97ed7a4546fda7be0c7a9d8a7ca967352f3786

SHA512
f651a94f196c06e6ade37d38b04c22e2e816f497b17797fa0dea9a9f6ff5d411794e063f6bb60f56ccfb166afc7e0801cb19675eac7a79de2b768dfa2d5c4c26

Download Submit
C:\Windows\system\cFnhZLn.exe

Filesize
576KB

MD5
d275943da2fa2cc83ccf3b6e4be847f3

SHA1
443f7dc7567428a03f27024ee74b1445249cd32a

SHA256
dd041ded26d1bcae0a6759a775661aa961cd6f2aaf49ccfab4f222edae9832d6

SHA512
85bd54a6bf148d1d2ae93e7d2704021c090e74d11cd604825de88887b16809eb9d0171a0f35309de3071d43ae795fa3c63c766c728c8f4893235686470e18d00

Download Submit
C:\Windows\system\caoZnWp.exe

Filesize
1.4MB

MD5
1a9375057e44e9fca4d0e502068b08ab

SHA1
7dcad7dcb89ccae0a42d26404f281fc3e231e449

SHA256
5889b85e779324c9201c19f25102619745b1204d7670bf568478ad1ff6c7455b

SHA512
80826bdf9f677a2d75f88d38e8c134d568ec98325d99acad887cf9c3f64f87a5832f9a1802a0960d9685e440b8fca617dcf52333452030f89e2cef1f5f6dec81

Download Submit
C:\Windows\system\cirnJTu.exe

Filesize
2.7MB

MD5
daaae10370e202568a98097659c57e0e

SHA1
1d9b8fed8af4046648abee257fee8fe4e70711bf

SHA256
2aed4a595facd72ddde0be004dad2c5f5cb8742a6c7d08a2b515bd54832cfd93

SHA512
e54dd7bd3b5c21922b48b7fece04d8c242ec8c22908ef2d658eb6021749316239566e952256f8883a3eff212f669e4987f3260b0fe87cd5569ffd0b718e95645

Download Submit
C:\Windows\system\fJnKzro.exe

Filesize
1.9MB

MD5
2cf9c02734c6fc70f261d2274badb121

SHA1
bf7f8f029d9f2968425a187db2b77d0087b7851a

SHA256
ea42f0eb9bd7cce7b9b16be6fb80af5e04cdf59642a55abc43f20274638da12c

SHA512
35b89a2c94a8f85d447722f60ec6a0242854d55741fe59d3ebc86fc4d8e8b64cc73ffc6e99e65cf28b8f774d3df8b12615aa90a366077d074de3b838cc541de5

Download Submit
C:\Windows\system\gCtsEtW.exe

Filesize
832KB

MD5
c5bb0f8216cadf82453e4a5e911160b2

SHA1
bd4c00a7dcf2aa9168f88c787ce0714004b86476

SHA256
40fcdef5ad179652e82ef9141da2a50be3e4a45d7d100bbc189e02a198279562

SHA512
64fd8d5fe51952b5a286d2874b050c849318f682df619567712301ccd7bc6ddffb9b777989a3721697e4f2b9d3ad54de866fc110cf87c2bcd6b5c793dfdc7584

Download Submit
C:\Windows\system\qtErurt.exe

Filesize
1.5MB

MD5
14e77b11097002d530b981ee5c1bb828

SHA1
a306e0873764751b8c90059ee93e1ff9f2e5dcef

SHA256
09d7c754c538f159cecebb058db316c09e507ce1fc46e5e4e5d63b587f253dac

SHA512
9fde5515c24c2f460a71d78a652a4f8fd489387f27f09ea6f90d7c6eaf0e751df1bdf95cf4d988ba9fabfb077c8709ad3db26ac9bbf7aff7ab9afceaa3bebf60

Download Submit
C:\Windows\system\rIOWbhL.exe

Filesize
2.1MB

MD5
b85c4d3f5ac7ad0b83fceeed0a052520

SHA1
ab4be34add5c49699c710e060f418149b6fc5013

SHA256
159174d61b5ba3d2541613e4879597e14128027d2bcd2a6e77d17aaedda82155

SHA512
a0287deedf83f25504c676d1cbaeba72ece058c3dd4592fe8732f58eb88704dd23976ced1fc77ef102652f31fbf079483fb2259d51c3e60c226fd9ad28b2668b

Download Submit
C:\Windows\system\vUMWGro.exe

Filesize
2.7MB

MD5
a90ba02820921cbf18b5d0f818d74d73

SHA1
1f57e8c56d4e5252b79f8c5103b21ccd73a48fb1

SHA256
5767a0219a3d8e28004809a82fde52f9b841ff7816bdb0e98a8ffb020f7fa759

SHA512
9313de276ba4ae3e82a0e042352a73c7e6f4e73fc63fd47f8809dab0decc7e973d27fed6bda69d5139a028d3cefda4a283cd7b2429cc1dfc6bcb3393e627c234

Download Submit
C:\Windows\system\vghaajb.exe

Filesize
448KB

MD5
735d5820e9c366ca9b3259dfece42fe2

SHA1
ce4bfd1b7aa4fb119fad50b989f8d1c87292d632

SHA256
5bd29f0189e520b7f0309ef90d85f2daa3e0f5683a42ed1ecf80133656dcf3ba

SHA512
b202e277e3fbce2080fd74fc5f75d48a37e74f6d2f4308e3be76723dc401b8f1f2be92debcfc66373c89862c9423dc599a491e1fe3f9395ec334ab3e6f93bba2

Download Submit
C:\Windows\system\zoytaxq.exe

Filesize
2.6MB

MD5
7b6e30e2173e7bcc213d6e0f80238036

SHA1
588cd2b0785eab636b419adca399b6507fe76bd5

SHA256
8d773c8b8d8cd31545a3a8ac03c0b064eab4900deb02bef59e54fd656aff75f9

SHA512
e6abf07991e7f2cb1480200a57705cd695a9018e06edea5bdf5338a0b0e984832182a14921a5157ab5c5d7b01094118ac0f92dd3aecb5ac55fd3b6ab9503fb2c

Download Submit
C:\Windows\system\zoytaxq.exe

Filesize
2.5MB

MD5
c2318437d7dfbbee3c8c90d655c9e0bc

SHA1
3bc3622d5509e8558b7124fd31dd81b80e8ba092

SHA256
981e90bc54e3b874cb699c61374630810944184c3982a13f770b5be9b4a58870

SHA512
64667d430bc6bfd085b42714b902048e2b5e6977d82b1c6338c8272b02b7a4c0c7f10ba07eec1bba2ac1345b7c8d1abe31ffda19ca9afc7a21e97ad3141db01e

Download Submit
\Windows\system\FbgsyTn.exe

Filesize
2.7MB

MD5
72859b9a299e8989434743a1855f5754

SHA1
a9038e6ea4fff306aa02c975cce7a4c9e78fc59c

SHA256
c455a9f5672edfee46e2d4206d35abfb9fb0e70f6ee923d556f1b063b47a5ee1

SHA512
cb2e73697debd3c39f70672a23d77770c1b0533572892ba7374c3512379e8314809f611e158a799f9b2588b657b7462f2f7241b7d8202fb48ad7e92994267909

Download Submit
\Windows\system\KyQaHmL.exe

Filesize
2.7MB

MD5
45c67be7e7772a1d181a5b027a0a18a7

SHA1
a17d1067891b27acb112c4a6d4ea226087d7410b

SHA256
2e6b4724167853599a42dcaf37533844e6d6077b2686f315181c80b8d90f66b4

SHA512
ad8c6ead54351a6f967f7e45ea0fc27416e452b896319f0e4fda69459905e93a261129177950897b639ac1c9e82be2b1a2a97c3b0b8d8c65b3ee14d81b289413

Download Submit
\Windows\system\PrjqXEw.exe

Filesize
2.7MB

MD5
cbbfa17ea4bd2db9efad1e70237a1308

SHA1
6980d1331d32e8f361a4d7a27ffe2d50d1f2453e

SHA256
49f822a243e980c79dbff63a61434f942b724b09c940c9803157a0ba5fd63a7b

SHA512
c259ec90414fa4c905bb4c0a5c1d7610138efcd04362ad1cae12391a68acc3ad6f8344ac7676521761757b8ac4da84bba6c7c0a2eb7a0991896c0576d1a048e8

Download Submit
\Windows\system\ZKrpcga.exe

Filesize
2.6MB

MD5
5e25c228ca92d6199b00b1eb2e374e6a

SHA1
5c04a6148c00058b2717e5ec8186a4d2bf32fe70

SHA256
78ffee630d67b401752e1da883a62d8fab9225cd4ebe048d1d31eebe030ba7a6

SHA512
d1b2e64e79feab6192e45aeb3182a920c5e28e16154dfd963d66d17cd1dd094c047e2e1a89a4bdc26afe7539143eac40300b07354a0a14f66e88ee85d5e3b5c1

Download Submit
\Windows\system\bbBwQdB.exe

Filesize
1.9MB

MD5
8c6c56f3d0e149f1bd14c2f11c81f3f0

SHA1
37c3fdc60e9e84f8d17924fea8a94c7b915ba7ea

SHA256
5fea8a6b0e78d555b14dc844c92dce5428a7db39e2b876ff9572a1adba0b122b

SHA512
9016f7a7d566cb5f9316ad37ccc1e2526a70db48ec8848c15544c9a0114d4a10476336dd28628567755ddda7870209abc555dd102dce742b0deb0307a950d539

Download Submit
\Windows\system\caoZnWp.exe

Filesize
1024KB

MD5
a073976e105acc4e0104bf9bd36d5af6

SHA1
daba338e1b266483bdf0a22acc452fa635684057

SHA256
d4d06abf9c0b7dbae93c62ca2eb615a03cb9fe22f22cca24c2f9a4f77cb68398

SHA512
47d4e1c9e81ac731c511cd3b8206ed198c86dd238b51c1895b041a9be941f6b26bcc56bdc9a6d51d65e3a50611a13bdbaf7ecd5a53226fddd6fdd9771b4cd04f

Download Submit
\Windows\system\ctqvCIT.exe

Filesize
384KB

MD5
09b49c51a0f7a1e469478a252a9eac35

SHA1
b9c6b46840d32a792c11aa8fc6a6b56712cdc8c1

SHA256
e7b440de1dbf6e161210faadf15a0d6d3f3da7d041b4d0bbc51210708d5fe6fa

SHA512
48dae0139e590cee37870dcfee1bf0ca00a74ae0c394291a3f52adfeb5874027ea32f64d5a319653c9e73cd21d6c8c12af97ebf84b97dfd4ac4d6758edab73dc

Download Submit
\Windows\system\fJnKzro.exe

Filesize
2.3MB

MD5
8c686170558876b30d1fe52bdd1a2361

SHA1
26b4f993ea054002a2f58253e05c4dfc271e24dc

SHA256
9d2877b63ab3101458d04f4144f53d9e017c0d7795e14fbf4b5263d7f1b8730f

SHA512
9df1b65472fd2d66b517f94e0d654af1cdb3bc612536253402cd33cb827c9b4f31d847f99028d74de1007eeb1335f56644345f1b508aa511f310b85222dca407

Download Submit
\Windows\system\gCtsEtW.exe

Filesize
1.3MB

MD5
cab1cac2912df43904e50d743f6fc196

SHA1
b2e8cf07f6cc128a8e881b83c4fe3e5054d6baa8

SHA256
4f2b74aa2c90ce4b210535d91cb132262eab48f25b93e5036d1b8c4d2e589bd1

SHA512
f1cef088b2fa90e946999a37718b0f44d1796b0f4f44e6e9784ed01a9216050c66dcfa861357dba41859151760d43ce1ea4015d82678dd94487f37001a7490ca

Download Submit
\Windows\system\qtErurt.exe

Filesize
2.7MB

MD5
1e1d7e297d73ac15157efa3dc919ce27

SHA1
e2633c71639357e7fb8e2c964209260b696dcec9

SHA256
7e0959c39a4305786ff8ebbc99417ffecaa8ec2f0c9020afba6e500bd8ab7c6a

SHA512
fad7d0ebc5e3babee993d2485e48a4e7cb96dcf2bb0ecd2effc440a05dc1b4a12ccec0f8e528c0ca27b38fd1f80cab4fd2496c05b6468521a23b51f57939e0c4

Download Submit
\Windows\system\rIOWbhL.exe

Filesize
1.1MB

MD5
3e6c3698a81e7e935733a667a645c229

SHA1
adadcc52827f0bc8aca05847e89053e8c723bd75

SHA256
ff4ba6951d2ef6dc827b54a6fe5c97e2a18ddfd1436d007fcff169756fce3c0f

SHA512
cb0434fcaebda31e49fb1fec6cee06ccec58e4a27617ec407444fe1d18b93b92b40267547a303a32f128d4e605b1e5980754232260a44db06e54431e4f57f6b3

Download Submit
\Windows\system\vUMWGro.exe

Filesize
2.4MB

MD5
7741bff6b6979236c2b43f285635ada8

SHA1
479b13bdc5514bf354e44f96382a8dd6b7f8fe61

SHA256
307db5a6c98a37c68178bd9dec2105808adf309dbb939c050856edb57016137d

SHA512
4c7d79e1743a50a3eccd5d7940d81a26bd1b41103aa5df7c1fbafcd6c2842038aafe1bba9f471a9c212bc1a4fcbf76a95ec4952259196876135552e62f24f1f1

Download Submit
memory/1052-184-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

Filesize
9.6MB

Download
memory/1052-139-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

Filesize
9.6MB

Download
memory/1052-39-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/1052-37-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1052-40-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

Filesize
9.6MB

Download
memory/1052-160-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

Filesize
9.6MB

Download
memory/1052-71-0x000007FEF5120000-0x000007FEF5ABD000-memory.dmp

Filesize
9.6MB

Download
memory/1052-7-0x000007FEF53DE000-0x000007FEF53DF000-memory.dmp

Filesize
4KB

Download
memory/1688-96-0x0000000003060000-0x0000000003456000-memory.dmp

Filesize
4.0MB

Download
memory/1688-162-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/1688-149-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/1688-147-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/1688-140-0x0000000003510000-0x0000000003906000-memory.dmp

Filesize
4.0MB

Download
memory/1688-152-0x000000013FF00000-0x00000001402F6000-memory.dmp

Filesize
4.0MB

Download
memory/1688-2-0x000000013F1B0000-0x000000013F5A6000-memory.dmp

Filesize
4.0MB

Download
memory/1688-4361-0x0000000003510000-0x0000000003906000-memory.dmp

Filesize
4.0MB

Download
memory/1688-117-0x000000013FDA0000-0x0000000140196000-memory.dmp

Filesize
4.0MB

Download
memory/1688-134-0x0000000003510000-0x0000000003906000-memory.dmp

Filesize
4.0MB

Download
memory/1688-111-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/1688-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1688-51-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/1688-4365-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/1688-130-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/1688-161-0x0000000003510000-0x0000000003906000-memory.dmp

Filesize
4.0MB

Download
memory/1688-153-0x0000000003510000-0x0000000003906000-memory.dmp

Filesize
4.0MB

Download
memory/2076-86-0x000000013FAA0000-0x000000013FE96000-memory.dmp

Filesize
4.0MB

Download
memory/2460-150-0x000000013FAC0000-0x000000013FEB6000-memory.dmp

Filesize
4.0MB

Download
memory/2524-151-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2524-7192-0x000000013F770000-0x000000013FB66000-memory.dmp

Filesize
4.0MB

Download
memory/2560-144-0x000000013F380000-0x000000013F776000-memory.dmp

Filesize
4.0MB

Download
memory/2564-133-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/2564-7211-0x000000013FF50000-0x0000000140346000-memory.dmp

Filesize
4.0MB

Download
memory/2580-7215-0x000000013FDA0000-0x0000000140196000-memory.dmp

Filesize
4.0MB

Download
memory/2580-125-0x000000013FDA0000-0x0000000140196000-memory.dmp

Filesize
4.0MB

Download
memory/2620-148-0x000000013F360000-0x000000013F756000-memory.dmp

Filesize
4.0MB

Download
memory/2652-108-0x000000013F500000-0x000000013F8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2652-7182-0x000000013F500000-0x000000013F8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2676-116-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2676-7208-0x000000013FE10000-0x0000000140206000-memory.dmp

Filesize
4.0MB

Download
memory/2708-7214-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2708-135-0x000000013F490000-0x000000013F886000-memory.dmp

Filesize
4.0MB

Download
memory/2972-7209-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download
memory/2972-154-0x000000013FD80000-0x0000000140176000-memory.dmp

Filesize
4.0MB

Download