xmrig | 4406d06bd1c9db6337c49b807720328ed10a482bf4211a31660db10683395edb

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
Size

1.9MB
MD5

4db9b8380ccb2c40031a3fd1958a57c0
SHA1

17c8428e2c7eeadd5adc6a304f497ef4faca33c0
SHA256

4406d06bd1c9db6337c49b807720328ed10a482bf4211a31660db10683395edb
SHA512

668d6407ffba3df708399fe46c6962a215a6dff3587d9c16bce1998a8eff2d830375768c7165cf6355ab4b1014fe858252218426d11c7a24341d53545c7e9a6b
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SIIQWs:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 16 IoCs

miner

resource	yara_rule
behavioral1/memory/2920-128-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/1028-135-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2744-98-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2960-81-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2948-72-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2604-136-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2724-131-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2836-120-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/1516-92-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2920-6538-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2744-6539-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2836-6542-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2724-6541-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2948-6540-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2960-6545-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/1516-6548-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1580	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2948	BUTpuyj.exe
2960	iwDAqYs.exe
1516	YxbWJUJ.exe
2744	rLFDtro.exe
2836	HJQCliC.exe
2920	geJLHuo.exe
2724	NuhWLrG.exe
1028	ZxFdtad.exe
2604	kuKVxAj.exe
3048	fDfBicu.exe
2672	dusOFUG.exe
2928	Whqriee.exe
1996	ONYKUuL.exe
952	NNpRHDI.exe
1632	aQLMoFC.exe
2512	imXtfVa.exe
2780	Ccysyhf.exe
1444	xVHGqcT.exe
2756	KhKbXTw.exe
2664	uIodFzV.exe
2544	cvYEqlM.exe
1640	Dzozlzq.exe
1220	pySssRg.exe
2616	dvXViFt.exe
2932	FZapidp.exe
3064	RttKwfP.exe
2792	xRzpKmk.exe
1396	ZuSwRGt.exe
2868	GvDklzX.exe
892	GjsIkjl.exe
2012	zezVKcq.exe
668	jRrytdZ.exe
792	GLnzAya.exe
1768	kOqNtYl.exe
1328	EvCEZDT.exe
2392	OfeVkYV.exe
2224	ctFZCrz.exe
1960	tbsGTsl.exe
928	RUnodYO.exe
1324	khCHBSx.exe
684	mNYExMk.exe
2172	ZWdRGDP.exe
1096	VsQnaYO.exe
812	tmtdwfX.exe
2168	aUmnijA.exe
2140	ZOutNGs.exe
884	uqluubC.exe
1740	sfiyarV.exe
1604	UqlraoO.exe
2848	VmntEVA.exe
2560	LfgsBLs.exe
2696	WRjCOWR.exe
2924	xiYqQlY.exe
2704	iqHHJca.exe
2984	tGtHtda.exe
1884	CGKwONK.exe
2740	aiPWSvF.exe
2888	fZgiCgB.exe
1728	AlhNKho.exe
3068	BejlXZu.exe
2804	oMkPMYh.exe
692	zIsnjgm.exe
1212	jjMhsuu.exe
1216	sVWyjkX.exe

Loads dropped DLL 64 IoCs

pid	Process
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3008-0-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x000e000000012279-3.dat	upx
behavioral1/files/0x0036000000013362-7.dat	upx
behavioral1/files/0x0008000000013a15-12.dat	upx
behavioral1/files/0x0008000000013a65-18.dat	upx
behavioral1/files/0x000600000001475f-57.dat	upx
behavioral1/memory/2920-128-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/1028-135-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x00060000000148af-166.dat	upx
behavioral1/files/0x0006000000014fac-170.dat	upx
behavioral1/files/0x0006000000015b72-181.dat	upx
behavioral1/files/0x0006000000015a15-179.dat	upx
behavioral1/files/0x000600000001543a-177.dat	upx
behavioral1/files/0x00060000000150aa-175.dat	upx
behavioral1/files/0x00130000000054a8-171.dat	upx
behavioral1/files/0x00060000000146a7-157.dat	upx
behavioral1/files/0x00060000000145c9-155.dat	upx
behavioral1/files/0x000700000001451d-149.dat	upx
behavioral1/files/0x0006000000015c91-145.dat	upx
behavioral1/files/0x0006000000015b37-124.dat	upx
behavioral1/files/0x00060000000155e8-123.dat	upx
behavioral1/files/0x0006000000015077-99.dat	upx
behavioral1/memory/2744-98-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x0006000000014d0f-89.dat	upx
behavioral1/memory/2960-81-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0006000000014a29-79.dat	upx
behavioral1/files/0x0006000000014c0b-77.dat	upx
behavioral1/memory/2948-72-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x0008000000013a85-65.dat	upx
behavioral1/files/0x0006000000014730-56.dat	upx
behavioral1/files/0x00060000000145d4-55.dat	upx
behavioral1/files/0x000600000001474b-52.dat	upx
behavioral1/files/0x0006000000014525-38.dat	upx
behavioral1/files/0x000b000000013b02-37.dat	upx
behavioral1/files/0x003500000001340e-185.dat	upx
behavioral1/files/0x0006000000015c9b-161.dat	upx
behavioral1/files/0x0008000000013735-16.dat	upx
behavioral1/memory/2604-136-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2724-131-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/files/0x0006000000015bb5-130.dat	upx
behavioral1/memory/2836-120-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x000600000001523e-110.dat	upx
behavioral1/memory/1516-92-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2920-6538-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2744-6539-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2836-6542-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2724-6541-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2948-6540-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2960-6545-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/1516-6548-0x000000013F330000-0x000000013F722000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QQukYTW.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\povhydy.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\FwZPJRu.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\IZDQKZQ.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\bdHHQJI.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\hReQoaR.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\BacdoME.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\HriIaee.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\eZctkQg.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\nCQIDev.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\NGDJidh.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\EjtNYfv.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\zuocGrZ.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\tYUxetv.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\snoKUGD.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\kfsjkjt.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\aasmZwd.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\LyRyBXu.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\wsLsXFe.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\fPIwMxa.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\QJicReo.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\KxaLpKs.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\nqNBsGZ.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\ULpuAGq.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\QaQjTHd.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\inIRLrZ.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\XdVdufT.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\SVTMtpj.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\bdcHlsQ.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\XeRXSGX.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\UJhkJGp.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\PEkkrYs.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\yqOcYDj.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\mQiUeVA.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\QTveWrV.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\HsvNUyc.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\VpDJQZx.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\twVGukJ.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\VnNKKdo.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\tGTicip.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\ZyymsNf.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\KCZpIBC.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\xKRDtHf.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\SAxVlmn.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\DlFnLwu.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\ptPMZzP.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\TbTYXrL.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\zKPBiDx.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\fsLcViS.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\XJQRGEs.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\MDsyyjj.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\eaGkbcH.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\WTUboNy.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\ZmwwuJT.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\bsSYfIV.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\GUKPTat.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\vDfFTHA.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\JUBXzwr.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\buDDgih.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\CmKbVbY.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\PjIrSkq.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\dCnDOUT.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\cIRseWX.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
File created	C:\Windows\System\NmddfJm.exe	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1580	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 1580	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	29
PID 3008 wrote to memory of 1580	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	29
PID 3008 wrote to memory of 1580	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	29
PID 3008 wrote to memory of 2948	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	30
PID 3008 wrote to memory of 2948	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	30
PID 3008 wrote to memory of 2948	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	30
PID 3008 wrote to memory of 1516	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	31
PID 3008 wrote to memory of 1516	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	31
PID 3008 wrote to memory of 1516	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	31
PID 3008 wrote to memory of 2960	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	32
PID 3008 wrote to memory of 2960	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	32
PID 3008 wrote to memory of 2960	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	32
PID 3008 wrote to memory of 2724	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	33
PID 3008 wrote to memory of 2724	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	33
PID 3008 wrote to memory of 2724	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	33
PID 3008 wrote to memory of 2744	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	34
PID 3008 wrote to memory of 2744	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	34
PID 3008 wrote to memory of 2744	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	34
PID 3008 wrote to memory of 2672	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	35
PID 3008 wrote to memory of 2672	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	35
PID 3008 wrote to memory of 2672	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	35
PID 3008 wrote to memory of 2836	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	36
PID 3008 wrote to memory of 2836	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	36
PID 3008 wrote to memory of 2836	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	36
PID 3008 wrote to memory of 2756	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	37
PID 3008 wrote to memory of 2756	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	37
PID 3008 wrote to memory of 2756	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	37
PID 3008 wrote to memory of 2920	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	38
PID 3008 wrote to memory of 2920	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	38
PID 3008 wrote to memory of 2920	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	38
PID 3008 wrote to memory of 2664	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	39
PID 3008 wrote to memory of 2664	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	39
PID 3008 wrote to memory of 2664	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	39
PID 3008 wrote to memory of 1028	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	40
PID 3008 wrote to memory of 1028	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	40
PID 3008 wrote to memory of 1028	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	40
PID 3008 wrote to memory of 2544	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	41
PID 3008 wrote to memory of 2544	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	41
PID 3008 wrote to memory of 2544	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	41
PID 3008 wrote to memory of 2604	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	42
PID 3008 wrote to memory of 2604	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	42
PID 3008 wrote to memory of 2604	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	42
PID 3008 wrote to memory of 1220	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	43
PID 3008 wrote to memory of 1220	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	43
PID 3008 wrote to memory of 1220	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	43
PID 3008 wrote to memory of 3048	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	44
PID 3008 wrote to memory of 3048	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	44
PID 3008 wrote to memory of 3048	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	44
PID 3008 wrote to memory of 2616	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	45
PID 3008 wrote to memory of 2616	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	45
PID 3008 wrote to memory of 2616	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	45
PID 3008 wrote to memory of 2928	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	46
PID 3008 wrote to memory of 2928	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	46
PID 3008 wrote to memory of 2928	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	46
PID 3008 wrote to memory of 2932	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	47
PID 3008 wrote to memory of 2932	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	47
PID 3008 wrote to memory of 2932	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	47
PID 3008 wrote to memory of 1996	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	48
PID 3008 wrote to memory of 1996	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	48
PID 3008 wrote to memory of 1996	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	48
PID 3008 wrote to memory of 3064	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	49
PID 3008 wrote to memory of 3064	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	49
PID 3008 wrote to memory of 3064	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	49
PID 3008 wrote to memory of 952	3008	4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4db9b8380ccb2c40031a3fd1958a57c0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\System\BUTpuyj.exe
  C:\Windows\System\BUTpuyj.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\YxbWJUJ.exe
  C:\Windows\System\YxbWJUJ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\iwDAqYs.exe
  C:\Windows\System\iwDAqYs.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\NuhWLrG.exe
  C:\Windows\System\NuhWLrG.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\rLFDtro.exe
  C:\Windows\System\rLFDtro.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\dusOFUG.exe
  C:\Windows\System\dusOFUG.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\HJQCliC.exe
  C:\Windows\System\HJQCliC.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\KhKbXTw.exe
  C:\Windows\System\KhKbXTw.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\geJLHuo.exe
  C:\Windows\System\geJLHuo.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\uIodFzV.exe
  C:\Windows\System\uIodFzV.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\ZxFdtad.exe
  C:\Windows\System\ZxFdtad.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\cvYEqlM.exe
  C:\Windows\System\cvYEqlM.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\kuKVxAj.exe
  C:\Windows\System\kuKVxAj.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\pySssRg.exe
  C:\Windows\System\pySssRg.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\fDfBicu.exe
  C:\Windows\System\fDfBicu.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\dvXViFt.exe
  C:\Windows\System\dvXViFt.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\Whqriee.exe
  C:\Windows\System\Whqriee.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\FZapidp.exe
  C:\Windows\System\FZapidp.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ONYKUuL.exe
  C:\Windows\System\ONYKUuL.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\RttKwfP.exe
  C:\Windows\System\RttKwfP.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\NNpRHDI.exe
  C:\Windows\System\NNpRHDI.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\xRzpKmk.exe
  C:\Windows\System\xRzpKmk.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\aQLMoFC.exe
  C:\Windows\System\aQLMoFC.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ZuSwRGt.exe
  C:\Windows\System\ZuSwRGt.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\imXtfVa.exe
  C:\Windows\System\imXtfVa.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\GvDklzX.exe
  C:\Windows\System\GvDklzX.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\Ccysyhf.exe
  C:\Windows\System\Ccysyhf.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\GjsIkjl.exe
  C:\Windows\System\GjsIkjl.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\xVHGqcT.exe
  C:\Windows\System\xVHGqcT.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\jRrytdZ.exe
  C:\Windows\System\jRrytdZ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\Dzozlzq.exe
  C:\Windows\System\Dzozlzq.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\GLnzAya.exe
  C:\Windows\System\GLnzAya.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\zezVKcq.exe
  C:\Windows\System\zezVKcq.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\OfeVkYV.exe
  C:\Windows\System\OfeVkYV.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\kOqNtYl.exe
  C:\Windows\System\kOqNtYl.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\tbsGTsl.exe
  C:\Windows\System\tbsGTsl.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\EvCEZDT.exe
  C:\Windows\System\EvCEZDT.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\RUnodYO.exe
  C:\Windows\System\RUnodYO.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\ctFZCrz.exe
  C:\Windows\System\ctFZCrz.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\khCHBSx.exe
  C:\Windows\System\khCHBSx.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\mNYExMk.exe
  C:\Windows\System\mNYExMk.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ZWdRGDP.exe
  C:\Windows\System\ZWdRGDP.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\VsQnaYO.exe
  C:\Windows\System\VsQnaYO.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\tmtdwfX.exe
  C:\Windows\System\tmtdwfX.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\aUmnijA.exe
  C:\Windows\System\aUmnijA.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ZOutNGs.exe
  C:\Windows\System\ZOutNGs.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\uqluubC.exe
  C:\Windows\System\uqluubC.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\XSkyHHw.exe
  C:\Windows\System\XSkyHHw.exe
  2⤵
  PID:1656
- C:\Windows\System\sfiyarV.exe
  C:\Windows\System\sfiyarV.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\KtBnQGL.exe
  C:\Windows\System\KtBnQGL.exe
  2⤵
  PID:1276
- C:\Windows\System\UqlraoO.exe
  C:\Windows\System\UqlraoO.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\mzcWskg.exe
  C:\Windows\System\mzcWskg.exe
  2⤵
  PID:1600
- C:\Windows\System\VmntEVA.exe
  C:\Windows\System\VmntEVA.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\mLFucwU.exe
  C:\Windows\System\mLFucwU.exe
  2⤵
  PID:2680
- C:\Windows\System\LfgsBLs.exe
  C:\Windows\System\LfgsBLs.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\WpWGRmd.exe
  C:\Windows\System\WpWGRmd.exe
  2⤵
  PID:2564
- C:\Windows\System\WRjCOWR.exe
  C:\Windows\System\WRjCOWR.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\TfKIfdm.exe
  C:\Windows\System\TfKIfdm.exe
  2⤵
  PID:1820
- C:\Windows\System\xiYqQlY.exe
  C:\Windows\System\xiYqQlY.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\BHmUIcn.exe
  C:\Windows\System\BHmUIcn.exe
  2⤵
  PID:1652
- C:\Windows\System\iqHHJca.exe
  C:\Windows\System\iqHHJca.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\zXKQBXu.exe
  C:\Windows\System\zXKQBXu.exe
  2⤵
  PID:1988
- C:\Windows\System\tGtHtda.exe
  C:\Windows\System\tGtHtda.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\WiLEWOe.exe
  C:\Windows\System\WiLEWOe.exe
  2⤵
  PID:536
- C:\Windows\System\CGKwONK.exe
  C:\Windows\System\CGKwONK.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\XrPYuGu.exe
  C:\Windows\System\XrPYuGu.exe
  2⤵
  PID:2324
- C:\Windows\System\aiPWSvF.exe
  C:\Windows\System\aiPWSvF.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ZRXtazC.exe
  C:\Windows\System\ZRXtazC.exe
  2⤵
  PID:2240
- C:\Windows\System\fZgiCgB.exe
  C:\Windows\System\fZgiCgB.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\CvQVQTf.exe
  C:\Windows\System\CvQVQTf.exe
  2⤵
  PID:2036
- C:\Windows\System\AlhNKho.exe
  C:\Windows\System\AlhNKho.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\wGxrLNx.exe
  C:\Windows\System\wGxrLNx.exe
  2⤵
  PID:2884
- C:\Windows\System\BejlXZu.exe
  C:\Windows\System\BejlXZu.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\UWXeJnz.exe
  C:\Windows\System\UWXeJnz.exe
  2⤵
  PID:1660
- C:\Windows\System\oMkPMYh.exe
  C:\Windows\System\oMkPMYh.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\pScTsur.exe
  C:\Windows\System\pScTsur.exe
  2⤵
  PID:860
- C:\Windows\System\zIsnjgm.exe
  C:\Windows\System\zIsnjgm.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\uVahhKr.exe
  C:\Windows\System\uVahhKr.exe
  2⤵
  PID:2380
- C:\Windows\System\jjMhsuu.exe
  C:\Windows\System\jjMhsuu.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\RAnfTpE.exe
  C:\Windows\System\RAnfTpE.exe
  2⤵
  PID:448
- C:\Windows\System\sVWyjkX.exe
  C:\Windows\System\sVWyjkX.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\YqQjuLn.exe
  C:\Windows\System\YqQjuLn.exe
  2⤵
  PID:1040
- C:\Windows\System\svRGcae.exe
  C:\Windows\System\svRGcae.exe
  2⤵
  PID:1704
- C:\Windows\System\uAZTxMo.exe
  C:\Windows\System\uAZTxMo.exe
  2⤵
  PID:2368
- C:\Windows\System\dRXDBnh.exe
  C:\Windows\System\dRXDBnh.exe
  2⤵
  PID:900
- C:\Windows\System\ZxvsQjv.exe
  C:\Windows\System\ZxvsQjv.exe
  2⤵
  PID:2180
- C:\Windows\System\CsJojNF.exe
  C:\Windows\System\CsJojNF.exe
  2⤵
  PID:2388
- C:\Windows\System\LjUcfsg.exe
  C:\Windows\System\LjUcfsg.exe
  2⤵
  PID:1240
- C:\Windows\System\Bhyskss.exe
  C:\Windows\System\Bhyskss.exe
  2⤵
  PID:1504
- C:\Windows\System\uFtiVhD.exe
  C:\Windows\System\uFtiVhD.exe
  2⤵
  PID:1832
- C:\Windows\System\vLUYoki.exe
  C:\Windows\System\vLUYoki.exe
  2⤵
  PID:2056
- C:\Windows\System\llpUElP.exe
  C:\Windows\System\llpUElP.exe
  2⤵
  PID:2716
- C:\Windows\System\YbDpDgQ.exe
  C:\Windows\System\YbDpDgQ.exe
  2⤵
  PID:2800
- C:\Windows\System\XbYMonr.exe
  C:\Windows\System\XbYMonr.exe
  2⤵
  PID:2076
- C:\Windows\System\guBbkUI.exe
  C:\Windows\System\guBbkUI.exe
  2⤵
  PID:544
- C:\Windows\System\FyYkKAF.exe
  C:\Windows\System\FyYkKAF.exe
  2⤵
  PID:1844
- C:\Windows\System\JbpypfM.exe
  C:\Windows\System\JbpypfM.exe
  2⤵
  PID:1160
- C:\Windows\System\LhFmdXP.exe
  C:\Windows\System\LhFmdXP.exe
  2⤵
  PID:2820
- C:\Windows\System\TkdyVAh.exe
  C:\Windows\System\TkdyVAh.exe
  2⤵
  PID:2904
- C:\Windows\System\rdhbZIx.exe
  C:\Windows\System\rdhbZIx.exe
  2⤵
  PID:2280
- C:\Windows\System\RjrHzri.exe
  C:\Windows\System\RjrHzri.exe
  2⤵
  PID:1292
- C:\Windows\System\gAcpWrW.exe
  C:\Windows\System\gAcpWrW.exe
  2⤵
  PID:1776
- C:\Windows\System\sSWgEZb.exe
  C:\Windows\System\sSWgEZb.exe
  2⤵
  PID:1756
- C:\Windows\System\argtMFH.exe
  C:\Windows\System\argtMFH.exe
  2⤵
  PID:1724
- C:\Windows\System\mRJWFtT.exe
  C:\Windows\System\mRJWFtT.exe
  2⤵
  PID:2524
- C:\Windows\System\wisnUfb.exe
  C:\Windows\System\wisnUfb.exe
  2⤵
  PID:2532
- C:\Windows\System\KxIlSqI.exe
  C:\Windows\System\KxIlSqI.exe
  2⤵
  PID:3084
- C:\Windows\System\ZWlIPSj.exe
  C:\Windows\System\ZWlIPSj.exe
  2⤵
  PID:3100
- C:\Windows\System\LqjwXoo.exe
  C:\Windows\System\LqjwXoo.exe
  2⤵
  PID:3116
- C:\Windows\System\VGKtSpA.exe
  C:\Windows\System\VGKtSpA.exe
  2⤵
  PID:3132
- C:\Windows\System\jpcdUFh.exe
  C:\Windows\System\jpcdUFh.exe
  2⤵
  PID:3148
- C:\Windows\System\YJpVJbR.exe
  C:\Windows\System\YJpVJbR.exe
  2⤵
  PID:3164
- C:\Windows\System\YjYetVG.exe
  C:\Windows\System\YjYetVG.exe
  2⤵
  PID:3180
- C:\Windows\System\IyfgItK.exe
  C:\Windows\System\IyfgItK.exe
  2⤵
  PID:3196
- C:\Windows\System\aFwOitZ.exe
  C:\Windows\System\aFwOitZ.exe
  2⤵
  PID:3212
- C:\Windows\System\IaPJQtU.exe
  C:\Windows\System\IaPJQtU.exe
  2⤵
  PID:3228
- C:\Windows\System\hwdsQZX.exe
  C:\Windows\System\hwdsQZX.exe
  2⤵
  PID:3244
- C:\Windows\System\yKWHaiu.exe
  C:\Windows\System\yKWHaiu.exe
  2⤵
  PID:3260
- C:\Windows\System\GoShExI.exe
  C:\Windows\System\GoShExI.exe
  2⤵
  PID:3276
- C:\Windows\System\kSvOfFT.exe
  C:\Windows\System\kSvOfFT.exe
  2⤵
  PID:3292
- C:\Windows\System\diiogIU.exe
  C:\Windows\System\diiogIU.exe
  2⤵
  PID:3308
- C:\Windows\System\HPtDNKk.exe
  C:\Windows\System\HPtDNKk.exe
  2⤵
  PID:3324
- C:\Windows\System\WMneYvA.exe
  C:\Windows\System\WMneYvA.exe
  2⤵
  PID:3340
- C:\Windows\System\EezUNwH.exe
  C:\Windows\System\EezUNwH.exe
  2⤵
  PID:3356
- C:\Windows\System\IQeQJtP.exe
  C:\Windows\System\IQeQJtP.exe
  2⤵
  PID:3372
- C:\Windows\System\zfYOgHZ.exe
  C:\Windows\System\zfYOgHZ.exe
  2⤵
  PID:3388
- C:\Windows\System\EYjuSyz.exe
  C:\Windows\System\EYjuSyz.exe
  2⤵
  PID:3404
- C:\Windows\System\yAGjqoP.exe
  C:\Windows\System\yAGjqoP.exe
  2⤵
  PID:3420
- C:\Windows\System\BWaGvgY.exe
  C:\Windows\System\BWaGvgY.exe
  2⤵
  PID:3436
- C:\Windows\System\HFtYWXY.exe
  C:\Windows\System\HFtYWXY.exe
  2⤵
  PID:3452
- C:\Windows\System\TMxxtop.exe
  C:\Windows\System\TMxxtop.exe
  2⤵
  PID:3468
- C:\Windows\System\JfpPyfl.exe
  C:\Windows\System\JfpPyfl.exe
  2⤵
  PID:3484
- C:\Windows\System\sTreGwn.exe
  C:\Windows\System\sTreGwn.exe
  2⤵
  PID:3500
- C:\Windows\System\yLrHXFz.exe
  C:\Windows\System\yLrHXFz.exe
  2⤵
  PID:3516
- C:\Windows\System\oUaZotR.exe
  C:\Windows\System\oUaZotR.exe
  2⤵
  PID:3532
- C:\Windows\System\UEitSiW.exe
  C:\Windows\System\UEitSiW.exe
  2⤵
  PID:3548
- C:\Windows\System\psoaQJb.exe
  C:\Windows\System\psoaQJb.exe
  2⤵
  PID:3564
- C:\Windows\System\ogUtpKh.exe
  C:\Windows\System\ogUtpKh.exe
  2⤵
  PID:3580
- C:\Windows\System\JAFWVCq.exe
  C:\Windows\System\JAFWVCq.exe
  2⤵
  PID:3596
- C:\Windows\System\VbfuoYo.exe
  C:\Windows\System\VbfuoYo.exe
  2⤵
  PID:3612
- C:\Windows\System\HrTvxrG.exe
  C:\Windows\System\HrTvxrG.exe
  2⤵
  PID:3628
- C:\Windows\System\yijZYEo.exe
  C:\Windows\System\yijZYEo.exe
  2⤵
  PID:3644
- C:\Windows\System\qSZdlEs.exe
  C:\Windows\System\qSZdlEs.exe
  2⤵
  PID:3660
- C:\Windows\System\WqxzGQn.exe
  C:\Windows\System\WqxzGQn.exe
  2⤵
  PID:3676
- C:\Windows\System\aIaIIjY.exe
  C:\Windows\System\aIaIIjY.exe
  2⤵
  PID:3692
- C:\Windows\System\QXdjBTS.exe
  C:\Windows\System\QXdjBTS.exe
  2⤵
  PID:3708
- C:\Windows\System\saYEYxe.exe
  C:\Windows\System\saYEYxe.exe
  2⤵
  PID:3724
- C:\Windows\System\qDdfMpw.exe
  C:\Windows\System\qDdfMpw.exe
  2⤵
  PID:3740
- C:\Windows\System\VhGueuS.exe
  C:\Windows\System\VhGueuS.exe
  2⤵
  PID:3756
- C:\Windows\System\bPfjghV.exe
  C:\Windows\System\bPfjghV.exe
  2⤵
  PID:3772
- C:\Windows\System\UWjNqpN.exe
  C:\Windows\System\UWjNqpN.exe
  2⤵
  PID:3788
- C:\Windows\System\kkseJQW.exe
  C:\Windows\System\kkseJQW.exe
  2⤵
  PID:3804
- C:\Windows\System\EnhaKAU.exe
  C:\Windows\System\EnhaKAU.exe
  2⤵
  PID:3820
- C:\Windows\System\jzmjdoX.exe
  C:\Windows\System\jzmjdoX.exe
  2⤵
  PID:3836
- C:\Windows\System\mvRVyiQ.exe
  C:\Windows\System\mvRVyiQ.exe
  2⤵
  PID:3852
- C:\Windows\System\AuJYpPE.exe
  C:\Windows\System\AuJYpPE.exe
  2⤵
  PID:3868
- C:\Windows\System\khdlHTR.exe
  C:\Windows\System\khdlHTR.exe
  2⤵
  PID:3884
- C:\Windows\System\yvpNPhU.exe
  C:\Windows\System\yvpNPhU.exe
  2⤵
  PID:3900
- C:\Windows\System\tHlXUuc.exe
  C:\Windows\System\tHlXUuc.exe
  2⤵
  PID:3916
- C:\Windows\System\ROkUDKc.exe
  C:\Windows\System\ROkUDKc.exe
  2⤵
  PID:3932
- C:\Windows\System\yPjGoXd.exe
  C:\Windows\System\yPjGoXd.exe
  2⤵
  PID:3948
- C:\Windows\System\VvOBBpZ.exe
  C:\Windows\System\VvOBBpZ.exe
  2⤵
  PID:3964
- C:\Windows\System\LKXAbbq.exe
  C:\Windows\System\LKXAbbq.exe
  2⤵
  PID:3980
- C:\Windows\System\kahLwpf.exe
  C:\Windows\System\kahLwpf.exe
  2⤵
  PID:3996
- C:\Windows\System\bwGQASG.exe
  C:\Windows\System\bwGQASG.exe
  2⤵
  PID:4012
- C:\Windows\System\CHChkSM.exe
  C:\Windows\System\CHChkSM.exe
  2⤵
  PID:4028
- C:\Windows\System\QaEbHbA.exe
  C:\Windows\System\QaEbHbA.exe
  2⤵
  PID:4048
- C:\Windows\System\YJwWvns.exe
  C:\Windows\System\YJwWvns.exe
  2⤵
  PID:4064
- C:\Windows\System\uZXTnEN.exe
  C:\Windows\System\uZXTnEN.exe
  2⤵
  PID:4080
- C:\Windows\System\RSuvtuk.exe
  C:\Windows\System\RSuvtuk.exe
  2⤵
  PID:1256
- C:\Windows\System\bsyyxjy.exe
  C:\Windows\System\bsyyxjy.exe
  2⤵
  PID:2372
- C:\Windows\System\VZYSYje.exe
  C:\Windows\System\VZYSYje.exe
  2⤵
  PID:836
- C:\Windows\System\yGJmQQV.exe
  C:\Windows\System\yGJmQQV.exe
  2⤵
  PID:3096
- C:\Windows\System\RkztBqj.exe
  C:\Windows\System\RkztBqj.exe
  2⤵
  PID:3124
- C:\Windows\System\vzvzjza.exe
  C:\Windows\System\vzvzjza.exe
  2⤵
  PID:3188
- C:\Windows\System\xhwNWJq.exe
  C:\Windows\System\xhwNWJq.exe
  2⤵
  PID:3224
- C:\Windows\System\axinctJ.exe
  C:\Windows\System\axinctJ.exe
  2⤵
  PID:3284
- C:\Windows\System\ivmXeSB.exe
  C:\Windows\System\ivmXeSB.exe
  2⤵
  PID:3348
- C:\Windows\System\cciXuOt.exe
  C:\Windows\System\cciXuOt.exe
  2⤵
  PID:3412
- C:\Windows\System\WzJnFiz.exe
  C:\Windows\System\WzJnFiz.exe
  2⤵
  PID:3476
- C:\Windows\System\eaCdfKD.exe
  C:\Windows\System\eaCdfKD.exe
  2⤵
  PID:3540
- C:\Windows\System\ScknAYj.exe
  C:\Windows\System\ScknAYj.exe
  2⤵
  PID:3604
- C:\Windows\System\UXAxQLt.exe
  C:\Windows\System\UXAxQLt.exe
  2⤵
  PID:3668
- C:\Windows\System\fAieFfZ.exe
  C:\Windows\System\fAieFfZ.exe
  2⤵
  PID:3704
- C:\Windows\System\LxpyyCZ.exe
  C:\Windows\System\LxpyyCZ.exe
  2⤵
  PID:3768
- C:\Windows\System\pUvIxRG.exe
  C:\Windows\System\pUvIxRG.exe
  2⤵
  PID:3800
- C:\Windows\System\pyBcvlB.exe
  C:\Windows\System\pyBcvlB.exe
  2⤵
  PID:3860
- C:\Windows\System\yFADmBR.exe
  C:\Windows\System\yFADmBR.exe
  2⤵
  PID:2020
- C:\Windows\System\GOjHpdQ.exe
  C:\Windows\System\GOjHpdQ.exe
  2⤵
  PID:3892
- C:\Windows\System\JphvdUT.exe
  C:\Windows\System\JphvdUT.exe
  2⤵
  PID:3956
- C:\Windows\System\eUWAZIv.exe
  C:\Windows\System\eUWAZIv.exe
  2⤵
  PID:2276
- C:\Windows\System\XWGzhRB.exe
  C:\Windows\System\XWGzhRB.exe
  2⤵
  PID:4020
- C:\Windows\System\kxbtVZY.exe
  C:\Windows\System\kxbtVZY.exe
  2⤵
  PID:2964
- C:\Windows\System\IXhNGeS.exe
  C:\Windows\System\IXhNGeS.exe
  2⤵
  PID:840
- C:\Windows\System\qqCCDcu.exe
  C:\Windows\System\qqCCDcu.exe
  2⤵
  PID:4056
- C:\Windows\System\cfwlwUC.exe
  C:\Windows\System\cfwlwUC.exe
  2⤵
  PID:1848
- C:\Windows\System\veXgEmo.exe
  C:\Windows\System\veXgEmo.exe
  2⤵
  PID:2260
- C:\Windows\System\iCvaYFc.exe
  C:\Windows\System\iCvaYFc.exe
  2⤵
  PID:3444
- C:\Windows\System\npLokKQ.exe
  C:\Windows\System\npLokKQ.exe
  2⤵
  PID:3700
- C:\Windows\System\RTOYchI.exe
  C:\Windows\System\RTOYchI.exe
  2⤵
  PID:4172
- C:\Windows\System\QFSryWd.exe
  C:\Windows\System\QFSryWd.exe
  2⤵
  PID:4224
- C:\Windows\System\tPjRHYL.exe
  C:\Windows\System\tPjRHYL.exe
  2⤵
  PID:4292
- C:\Windows\System\TMYMGOq.exe
  C:\Windows\System\TMYMGOq.exe
  2⤵
  PID:4388
- C:\Windows\System\AvnMdLA.exe
  C:\Windows\System\AvnMdLA.exe
  2⤵
  PID:4404
- C:\Windows\System\caxkNtD.exe
  C:\Windows\System\caxkNtD.exe
  2⤵
  PID:4420
- C:\Windows\System\VJXBzXE.exe
  C:\Windows\System\VJXBzXE.exe
  2⤵
  PID:4436
- C:\Windows\System\fnaZmbM.exe
  C:\Windows\System\fnaZmbM.exe
  2⤵
  PID:4452
- C:\Windows\System\RkBAxZq.exe
  C:\Windows\System\RkBAxZq.exe
  2⤵
  PID:4468
- C:\Windows\System\aRqaueq.exe
  C:\Windows\System\aRqaueq.exe
  2⤵
  PID:4484
- C:\Windows\System\GcvxXyZ.exe
  C:\Windows\System\GcvxXyZ.exe
  2⤵
  PID:4500
- C:\Windows\System\NWVDnfu.exe
  C:\Windows\System\NWVDnfu.exe
  2⤵
  PID:4516
- C:\Windows\System\sAWfInp.exe
  C:\Windows\System\sAWfInp.exe
  2⤵
  PID:4532
- C:\Windows\System\nmUEPjs.exe
  C:\Windows\System\nmUEPjs.exe
  2⤵
  PID:4548
- C:\Windows\System\QNadxkB.exe
  C:\Windows\System\QNadxkB.exe
  2⤵
  PID:4568
- C:\Windows\System\CnRRrJj.exe
  C:\Windows\System\CnRRrJj.exe
  2⤵
  PID:4592
- C:\Windows\System\hKKSebh.exe
  C:\Windows\System\hKKSebh.exe
  2⤵
  PID:4608
- C:\Windows\System\WjDMxVq.exe
  C:\Windows\System\WjDMxVq.exe
  2⤵
  PID:4624
- C:\Windows\System\pSEMjDc.exe
  C:\Windows\System\pSEMjDc.exe
  2⤵
  PID:4640
- C:\Windows\System\JcHrDDG.exe
  C:\Windows\System\JcHrDDG.exe
  2⤵
  PID:4656
- C:\Windows\System\yuaPUWL.exe
  C:\Windows\System\yuaPUWL.exe
  2⤵
  PID:4672
- C:\Windows\System\mnZvPQa.exe
  C:\Windows\System\mnZvPQa.exe
  2⤵
  PID:4688
- C:\Windows\System\QvbWUgn.exe
  C:\Windows\System\QvbWUgn.exe
  2⤵
  PID:4704
- C:\Windows\System\onmvGsT.exe
  C:\Windows\System\onmvGsT.exe
  2⤵
  PID:4720
- C:\Windows\System\nTBpwCo.exe
  C:\Windows\System\nTBpwCo.exe
  2⤵
  PID:4736
- C:\Windows\System\GxByNYA.exe
  C:\Windows\System\GxByNYA.exe
  2⤵
  PID:4752
- C:\Windows\System\dqRpEhr.exe
  C:\Windows\System\dqRpEhr.exe
  2⤵
  PID:4768
- C:\Windows\System\EZnjZMf.exe
  C:\Windows\System\EZnjZMf.exe
  2⤵
  PID:4784
- C:\Windows\System\xSWjYeb.exe
  C:\Windows\System\xSWjYeb.exe
  2⤵
  PID:4800
- C:\Windows\System\WhIbxIJ.exe
  C:\Windows\System\WhIbxIJ.exe
  2⤵
  PID:4840
- C:\Windows\System\HhgdfCl.exe
  C:\Windows\System\HhgdfCl.exe
  2⤵
  PID:5036
- C:\Windows\System\TJJCrWk.exe
  C:\Windows\System\TJJCrWk.exe
  2⤵
  PID:5056
- C:\Windows\System\vEbARAW.exe
  C:\Windows\System\vEbARAW.exe
  2⤵
  PID:5072
- C:\Windows\System\dLZTBLR.exe
  C:\Windows\System\dLZTBLR.exe
  2⤵
  PID:5088
- C:\Windows\System\SHbAtnM.exe
  C:\Windows\System\SHbAtnM.exe
  2⤵
  PID:5104
- C:\Windows\System\aOOoYOh.exe
  C:\Windows\System\aOOoYOh.exe
  2⤵
  PID:1752
- C:\Windows\System\vSwYZky.exe
  C:\Windows\System\vSwYZky.exe
  2⤵
  PID:2000
- C:\Windows\System\ZdSGczF.exe
  C:\Windows\System\ZdSGczF.exe
  2⤵
  PID:3992
- C:\Windows\System\wlzlSnv.exe
  C:\Windows\System\wlzlSnv.exe
  2⤵
  PID:3316
- C:\Windows\System\uDmUeqR.exe
  C:\Windows\System\uDmUeqR.exe
  2⤵
  PID:4116
- C:\Windows\System\kmpkGWb.exe
  C:\Windows\System\kmpkGWb.exe
  2⤵
  PID:4132
- C:\Windows\System\wOQPtEK.exe
  C:\Windows\System\wOQPtEK.exe
  2⤵
  PID:4148
- C:\Windows\System\GtggAeU.exe
  C:\Windows\System\GtggAeU.exe
  2⤵
  PID:4168
- C:\Windows\System\vUPlINZ.exe
  C:\Windows\System\vUPlINZ.exe
  2⤵
  PID:4240
- C:\Windows\System\SkkRQdr.exe
  C:\Windows\System\SkkRQdr.exe
  2⤵
  PID:4260
- C:\Windows\System\phBbhjW.exe
  C:\Windows\System\phBbhjW.exe
  2⤵
  PID:4280
- C:\Windows\System\hFOvwjy.exe
  C:\Windows\System\hFOvwjy.exe
  2⤵
  PID:4492
- C:\Windows\System\itDdNqM.exe
  C:\Windows\System\itDdNqM.exe
  2⤵
  PID:4432
- C:\Windows\System\uKbZJjE.exe
  C:\Windows\System\uKbZJjE.exe
  2⤵
  PID:4524
- C:\Windows\System\ZPUcedg.exe
  C:\Windows\System\ZPUcedg.exe
  2⤵
  PID:4564
- C:\Windows\System\INqnlGE.exe
  C:\Windows\System\INqnlGE.exe
  2⤵
  PID:4636
- C:\Windows\System\VBcXxht.exe
  C:\Windows\System\VBcXxht.exe
  2⤵
  PID:4700
- C:\Windows\System\cZhSxCR.exe
  C:\Windows\System\cZhSxCR.exe
  2⤵
  PID:4764
- C:\Windows\System\ClikIvC.exe
  C:\Windows\System\ClikIvC.exe
  2⤵
  PID:2520
- C:\Windows\System\bpHzyBf.exe
  C:\Windows\System\bpHzyBf.exe
  2⤵
  PID:2628
- C:\Windows\System\fvVZtSI.exe
  C:\Windows\System\fvVZtSI.exe
  2⤵
  PID:2480
- C:\Windows\System\dpBxfAe.exe
  C:\Windows\System\dpBxfAe.exe
  2⤵
  PID:2900
- C:\Windows\System\tGTicip.exe
  C:\Windows\System\tGTicip.exe
  2⤵
  PID:376
- C:\Windows\System\yGXggQo.exe
  C:\Windows\System\yGXggQo.exe
  2⤵
  PID:984
- C:\Windows\System\OOVMRTr.exe
  C:\Windows\System\OOVMRTr.exe
  2⤵
  PID:1784
- C:\Windows\System\fOXDPiN.exe
  C:\Windows\System\fOXDPiN.exe
  2⤵
  PID:4864
- C:\Windows\System\rBdcufZ.exe
  C:\Windows\System\rBdcufZ.exe
  2⤵
  PID:2908
- C:\Windows\System\dDzkCtz.exe
  C:\Windows\System\dDzkCtz.exe
  2⤵
  PID:2760
- C:\Windows\System\CJonEDd.exe
  C:\Windows\System\CJonEDd.exe
  2⤵
  PID:908
- C:\Windows\System\PKDNFrl.exe
  C:\Windows\System\PKDNFrl.exe
  2⤵
  PID:5136
- C:\Windows\System\HkkrhjK.exe
  C:\Windows\System\HkkrhjK.exe
  2⤵
  PID:5152
- C:\Windows\System\LGcjtVS.exe
  C:\Windows\System\LGcjtVS.exe
  2⤵
  PID:5168
- C:\Windows\System\yqVOWEf.exe
  C:\Windows\System\yqVOWEf.exe
  2⤵
  PID:5188
- C:\Windows\System\mqrOrqp.exe
  C:\Windows\System\mqrOrqp.exe
  2⤵
  PID:5204
- C:\Windows\System\mTFvVln.exe
  C:\Windows\System\mTFvVln.exe
  2⤵
  PID:5220
- C:\Windows\System\oEotkqd.exe
  C:\Windows\System\oEotkqd.exe
  2⤵
  PID:5236
- C:\Windows\System\YfjYoKy.exe
  C:\Windows\System\YfjYoKy.exe
  2⤵
  PID:5252
- C:\Windows\System\oPzsXiJ.exe
  C:\Windows\System\oPzsXiJ.exe
  2⤵
  PID:5268
- C:\Windows\System\NVKoeSi.exe
  C:\Windows\System\NVKoeSi.exe
  2⤵
  PID:5284
- C:\Windows\System\IHsUNLE.exe
  C:\Windows\System\IHsUNLE.exe
  2⤵
  PID:5300
- C:\Windows\System\fDcshri.exe
  C:\Windows\System\fDcshri.exe
  2⤵
  PID:5320
- C:\Windows\System\SHGXZmF.exe
  C:\Windows\System\SHGXZmF.exe
  2⤵
  PID:5336
- C:\Windows\System\GcgXCSh.exe
  C:\Windows\System\GcgXCSh.exe
  2⤵
  PID:5352
- C:\Windows\System\dcyLXLb.exe
  C:\Windows\System\dcyLXLb.exe
  2⤵
  PID:5368
- C:\Windows\System\PeQAIzM.exe
  C:\Windows\System\PeQAIzM.exe
  2⤵
  PID:5384
- C:\Windows\System\DguHylL.exe
  C:\Windows\System\DguHylL.exe
  2⤵
  PID:5400
- C:\Windows\System\PHOhWmv.exe
  C:\Windows\System\PHOhWmv.exe
  2⤵
  PID:5420
- C:\Windows\System\FaFIxww.exe
  C:\Windows\System\FaFIxww.exe
  2⤵
  PID:5436
- C:\Windows\System\ZBcrqOh.exe
  C:\Windows\System\ZBcrqOh.exe
  2⤵
  PID:5452
- C:\Windows\System\nIzJDdQ.exe
  C:\Windows\System\nIzJDdQ.exe
  2⤵
  PID:5468
- C:\Windows\System\sPryhkX.exe
  C:\Windows\System\sPryhkX.exe
  2⤵
  PID:5484
- C:\Windows\System\VpFfWTQ.exe
  C:\Windows\System\VpFfWTQ.exe
  2⤵
  PID:5500
- C:\Windows\System\jpfmIub.exe
  C:\Windows\System\jpfmIub.exe
  2⤵
  PID:5516
- C:\Windows\System\SshsjpT.exe
  C:\Windows\System\SshsjpT.exe
  2⤵
  PID:5536
- C:\Windows\System\dZnybpB.exe
  C:\Windows\System\dZnybpB.exe
  2⤵
  PID:5552
- C:\Windows\System\etfDGsR.exe
  C:\Windows\System\etfDGsR.exe
  2⤵
  PID:5568
- C:\Windows\System\TlgwScP.exe
  C:\Windows\System\TlgwScP.exe
  2⤵
  PID:5584
- C:\Windows\System\JkCmdAF.exe
  C:\Windows\System\JkCmdAF.exe
  2⤵
  PID:5708
- C:\Windows\System\OqbrMQh.exe
  C:\Windows\System\OqbrMQh.exe
  2⤵
  PID:5780
- C:\Windows\System\viKFziT.exe
  C:\Windows\System\viKFziT.exe
  2⤵
  PID:5796
- C:\Windows\System\MOGBEFC.exe
  C:\Windows\System\MOGBEFC.exe
  2⤵
  PID:5812
- C:\Windows\System\wIvXVDn.exe
  C:\Windows\System\wIvXVDn.exe
  2⤵
  PID:5896
- C:\Windows\System\zkPYFGf.exe
  C:\Windows\System\zkPYFGf.exe
  2⤵
  PID:5912
- C:\Windows\System\FZZLgKY.exe
  C:\Windows\System\FZZLgKY.exe
  2⤵
  PID:5928
- C:\Windows\System\dKpYdUU.exe
  C:\Windows\System\dKpYdUU.exe
  2⤵
  PID:5944
- C:\Windows\System\RygKgtJ.exe
  C:\Windows\System\RygKgtJ.exe
  2⤵
  PID:5960
- C:\Windows\System\CCpEDlV.exe
  C:\Windows\System\CCpEDlV.exe
  2⤵
  PID:5976
- C:\Windows\System\mpMxjpJ.exe
  C:\Windows\System\mpMxjpJ.exe
  2⤵
  PID:5992
- C:\Windows\System\xqBKPyK.exe
  C:\Windows\System\xqBKPyK.exe
  2⤵
  PID:6008
- C:\Windows\System\wAUQeRt.exe
  C:\Windows\System\wAUQeRt.exe
  2⤵
  PID:6024
- C:\Windows\System\RRuWzpm.exe
  C:\Windows\System\RRuWzpm.exe
  2⤵
  PID:6040
- C:\Windows\System\PkAmBdn.exe
  C:\Windows\System\PkAmBdn.exe
  2⤵
  PID:6056
- C:\Windows\System\YRpMmOU.exe
  C:\Windows\System\YRpMmOU.exe
  2⤵
  PID:6072
- C:\Windows\System\RHKePgu.exe
  C:\Windows\System\RHKePgu.exe
  2⤵
  PID:6088
- C:\Windows\System\UtlXuaK.exe
  C:\Windows\System\UtlXuaK.exe
  2⤵
  PID:6104
- C:\Windows\System\nMgPkTj.exe
  C:\Windows\System\nMgPkTj.exe
  2⤵
  PID:6120
- C:\Windows\System\KCBUMue.exe
  C:\Windows\System\KCBUMue.exe
  2⤵
  PID:4936
- C:\Windows\System\bdepxSH.exe
  C:\Windows\System\bdepxSH.exe
  2⤵
  PID:3624
- C:\Windows\System\xbrxbpS.exe
  C:\Windows\System\xbrxbpS.exe
  2⤵
  PID:3716
- C:\Windows\System\wfIfQLj.exe
  C:\Windows\System\wfIfQLj.exe
  2⤵
  PID:3780
- C:\Windows\System\KxesGLO.exe
  C:\Windows\System\KxesGLO.exe
  2⤵
  PID:3844
- C:\Windows\System\gVipBkj.exe
  C:\Windows\System\gVipBkj.exe
  2⤵
  PID:2208
- C:\Windows\System\vVIquoT.exe
  C:\Windows\System\vVIquoT.exe
  2⤵
  PID:1664
- C:\Windows\System\coFsJjZ.exe
  C:\Windows\System\coFsJjZ.exe
  2⤵
  PID:2116
- C:\Windows\System\slwKGNU.exe
  C:\Windows\System\slwKGNU.exe
  2⤵
  PID:3640
- C:\Windows\System\ZJposuj.exe
  C:\Windows\System\ZJposuj.exe
  2⤵
  PID:1272
- C:\Windows\System\WurwwzR.exe
  C:\Windows\System\WurwwzR.exe
  2⤵
  PID:2844
- C:\Windows\System\paINCkq.exe
  C:\Windows\System\paINCkq.exe
  2⤵
  PID:1284
- C:\Windows\System\DWpIFcI.exe
  C:\Windows\System\DWpIFcI.exe
  2⤵
  PID:4992
- C:\Windows\System\cgNoSkG.exe
  C:\Windows\System\cgNoSkG.exe
  2⤵
  PID:2104
- C:\Windows\System\IJFtLPP.exe
  C:\Windows\System\IJFtLPP.exe
  2⤵
  PID:5020
- C:\Windows\System\vLXFBel.exe
  C:\Windows\System\vLXFBel.exe
  2⤵
  PID:5068
- C:\Windows\System\jHGJqRY.exe
  C:\Windows\System\jHGJqRY.exe
  2⤵
  PID:1596
- C:\Windows\System\uuTPlon.exe
  C:\Windows\System\uuTPlon.exe
  2⤵
  PID:2580
- C:\Windows\System\QGSENJZ.exe
  C:\Windows\System\QGSENJZ.exe
  2⤵
  PID:5360
- C:\Windows\System\uKIrGco.exe
  C:\Windows\System\uKIrGco.exe
  2⤵
  PID:5560
- C:\Windows\System\HTkbpWr.exe
  C:\Windows\System\HTkbpWr.exe
  2⤵
  PID:5620
- C:\Windows\System\MXnTWix.exe
  C:\Windows\System\MXnTWix.exe
  2⤵
  PID:5636
- C:\Windows\System\xwrQfLX.exe
  C:\Windows\System\xwrQfLX.exe
  2⤵
  PID:5652
- C:\Windows\System\tYIYuaQ.exe
  C:\Windows\System\tYIYuaQ.exe
  2⤵
  PID:5668
- C:\Windows\System\MNMwYSW.exe
  C:\Windows\System\MNMwYSW.exe
  2⤵
  PID:5684
- C:\Windows\System\FfTVQUR.exe
  C:\Windows\System\FfTVQUR.exe
  2⤵
  PID:5700
- C:\Windows\System\goXpqHp.exe
  C:\Windows\System\goXpqHp.exe
  2⤵
  PID:3028
- C:\Windows\System\ktHBtnb.exe
  C:\Windows\System\ktHBtnb.exe
  2⤵
  PID:2636
- C:\Windows\System\yoJGKuR.exe
  C:\Windows\System\yoJGKuR.exe
  2⤵
  PID:2916
- C:\Windows\System\vGbOPxO.exe
  C:\Windows\System\vGbOPxO.exe
  2⤵
  PID:2496
- C:\Windows\System\OKKzlpH.exe
  C:\Windows\System\OKKzlpH.exe
  2⤵
  PID:1816
- C:\Windows\System\cfKYXjj.exe
  C:\Windows\System\cfKYXjj.exe
  2⤵
  PID:2336
- C:\Windows\System\nQGjbJz.exe
  C:\Windows\System\nQGjbJz.exe
  2⤵
  PID:5820
- C:\Windows\System\nrcKdha.exe
  C:\Windows\System\nrcKdha.exe
  2⤵
  PID:5836
- C:\Windows\System\XwCePAZ.exe
  C:\Windows\System\XwCePAZ.exe
  2⤵
  PID:1616
- C:\Windows\System\xuAhZLI.exe
  C:\Windows\System\xuAhZLI.exe
  2⤵
  PID:5864
- C:\Windows\System\zzbNVks.exe
  C:\Windows\System\zzbNVks.exe
  2⤵
  PID:5880
- C:\Windows\System\vBgcnZE.exe
  C:\Windows\System\vBgcnZE.exe
  2⤵
  PID:4188
- C:\Windows\System\HHIzmGZ.exe
  C:\Windows\System\HHIzmGZ.exe
  2⤵
  PID:4204
- C:\Windows\System\yFqHpPH.exe
  C:\Windows\System\yFqHpPH.exe
  2⤵
  PID:4216
- C:\Windows\System\RzxRgGK.exe
  C:\Windows\System\RzxRgGK.exe
  2⤵
  PID:4312
- C:\Windows\System\emrEKeH.exe
  C:\Windows\System\emrEKeH.exe
  2⤵
  PID:4328
- C:\Windows\System\oNypZnc.exe
  C:\Windows\System\oNypZnc.exe
  2⤵
  PID:4344
- C:\Windows\System\XJuunOf.exe
  C:\Windows\System\XJuunOf.exe
  2⤵
  PID:4360
- C:\Windows\System\ydsfWaV.exe
  C:\Windows\System\ydsfWaV.exe
  2⤵
  PID:4376
- C:\Windows\System\AJnZbql.exe
  C:\Windows\System\AJnZbql.exe
  2⤵
  PID:4416
- C:\Windows\System\jNRxzng.exe
  C:\Windows\System\jNRxzng.exe
  2⤵
  PID:4480
- C:\Windows\System\bdEYBDA.exe
  C:\Windows\System\bdEYBDA.exe
  2⤵
  PID:4544
- C:\Windows\System\JZkrGlL.exe
  C:\Windows\System\JZkrGlL.exe
  2⤵
  PID:4588
- C:\Windows\System\KsKwtdR.exe
  C:\Windows\System\KsKwtdR.exe
  2⤵
  PID:4652
- C:\Windows\System\UvpziOn.exe
  C:\Windows\System\UvpziOn.exe
  2⤵
  PID:4712
- C:\Windows\System\QjtnvxR.exe
  C:\Windows\System\QjtnvxR.exe
  2⤵
  PID:4776
- C:\Windows\System\OChBKxm.exe
  C:\Windows\System\OChBKxm.exe
  2⤵
  PID:4816
- C:\Windows\System\GMkHnIe.exe
  C:\Windows\System\GMkHnIe.exe
  2⤵
  PID:4832
- C:\Windows\System\EfOYtxq.exe
  C:\Windows\System\EfOYtxq.exe
  2⤵
  PID:5048
- C:\Windows\System\LXVwlbK.exe
  C:\Windows\System\LXVwlbK.exe
  2⤵
  PID:5116
- C:\Windows\System\zgYWNSl.exe
  C:\Windows\System\zgYWNSl.exe
  2⤵
  PID:4140
- C:\Windows\System\NKVKszi.exe
  C:\Windows\System\NKVKszi.exe
  2⤵
  PID:4268
- C:\Windows\System\RfRxuqD.exe
  C:\Windows\System\RfRxuqD.exe
  2⤵
  PID:4428
- C:\Windows\System\JviupHm.exe
  C:\Windows\System\JviupHm.exe
  2⤵
  PID:4696
- C:\Windows\System\mWhFDKB.exe
  C:\Windows\System\mWhFDKB.exe
  2⤵
  PID:1104
- C:\Windows\System\oIRfcLe.exe
  C:\Windows\System\oIRfcLe.exe
  2⤵
  PID:1976
- C:\Windows\System\JyUofji.exe
  C:\Windows\System\JyUofji.exe
  2⤵
  PID:1264
- C:\Windows\System\EqCuqTG.exe
  C:\Windows\System\EqCuqTG.exe
  2⤵
  PID:5176
- C:\Windows\System\WBXfbue.exe
  C:\Windows\System\WBXfbue.exe
  2⤵
  PID:5216
- C:\Windows\System\pQTafHq.exe
  C:\Windows\System\pQTafHq.exe
  2⤵
  PID:5280
- C:\Windows\System\VaqmdFh.exe
  C:\Windows\System\VaqmdFh.exe
  2⤵
  PID:5344
- C:\Windows\System\JawVrON.exe
  C:\Windows\System\JawVrON.exe
  2⤵
  PID:5408
- C:\Windows\System\ANuvLdj.exe
  C:\Windows\System\ANuvLdj.exe
  2⤵
  PID:5448
- C:\Windows\System\EXXLyyL.exe
  C:\Windows\System\EXXLyyL.exe
  2⤵
  PID:2576
- C:\Windows\System\BFfibUg.exe
  C:\Windows\System\BFfibUg.exe
  2⤵
  PID:5920
- C:\Windows\System\vKiEEdl.exe
  C:\Windows\System\vKiEEdl.exe
  2⤵
  PID:5936
- C:\Windows\System\zicbRgV.exe
  C:\Windows\System\zicbRgV.exe
  2⤵
  PID:5968
- C:\Windows\System\NRguwzt.exe
  C:\Windows\System\NRguwzt.exe
  2⤵
  PID:6016
- C:\Windows\System\epEpSNj.exe
  C:\Windows\System\epEpSNj.exe
  2⤵
  PID:6052
- C:\Windows\System\tqanjbQ.exe
  C:\Windows\System\tqanjbQ.exe
  2⤵
  PID:6064
- C:\Windows\System\NGsCdTd.exe
  C:\Windows\System\NGsCdTd.exe
  2⤵
  PID:6112
- C:\Windows\System\oQUBnem.exe
  C:\Windows\System\oQUBnem.exe
  2⤵
  PID:6100
- C:\Windows\System\xusgjxt.exe
  C:\Windows\System\xusgjxt.exe
  2⤵
  PID:6140
- C:\Windows\System\MJLGlfA.exe
  C:\Windows\System\MJLGlfA.exe
  2⤵
  PID:3080
- C:\Windows\System\MgjbYPS.exe
  C:\Windows\System\MgjbYPS.exe
  2⤵
  PID:3144
- C:\Windows\System\bfpTdrd.exe
  C:\Windows\System\bfpTdrd.exe
  2⤵
  PID:3236
- C:\Windows\System\FrpnmHq.exe
  C:\Windows\System\FrpnmHq.exe
  2⤵
  PID:5028
- C:\Windows\System\vLRAOtO.exe
  C:\Windows\System\vLRAOtO.exe
  2⤵
  PID:4876
- C:\Windows\System\EauFvBE.exe
  C:\Windows\System\EauFvBE.exe
  2⤵
  PID:4888
- C:\Windows\System\hLbITvP.exe
  C:\Windows\System\hLbITvP.exe
  2⤵
  PID:5724
- C:\Windows\System\upbyZJo.exe
  C:\Windows\System\upbyZJo.exe
  2⤵
  PID:4896
- C:\Windows\System\SIBPhXq.exe
  C:\Windows\System\SIBPhXq.exe
  2⤵
  PID:4904
- C:\Windows\System\feJCMrQ.exe
  C:\Windows\System\feJCMrQ.exe
  2⤵
  PID:1156
- C:\Windows\System\CPBnAZB.exe
  C:\Windows\System\CPBnAZB.exe
  2⤵
  PID:4912
- C:\Windows\System\GpvyIgt.exe
  C:\Windows\System\GpvyIgt.exe
  2⤵
  PID:4916
- C:\Windows\System\gRsYtSr.exe
  C:\Windows\System\gRsYtSr.exe
  2⤵
  PID:1336
- C:\Windows\System\ShxSfjW.exe
  C:\Windows\System\ShxSfjW.exe
  2⤵
  PID:3428
- C:\Windows\System\kyMxipK.exe
  C:\Windows\System\kyMxipK.exe
  2⤵
  PID:3492
- C:\Windows\System\gNSBTZt.exe
  C:\Windows\System\gNSBTZt.exe
  2⤵
  PID:3592
- C:\Windows\System\nAqRrfR.exe
  C:\Windows\System\nAqRrfR.exe
  2⤵
  PID:3880
- C:\Windows\System\zNVuPHT.exe
  C:\Windows\System\zNVuPHT.exe
  2⤵
  PID:3940
- C:\Windows\System\DLAmLQJ.exe
  C:\Windows\System\DLAmLQJ.exe
  2⤵
  PID:4040
- C:\Windows\System\Lxdferu.exe
  C:\Windows\System\Lxdferu.exe
  2⤵
  PID:4004
- C:\Windows\System\jrtjdWx.exe
  C:\Windows\System\jrtjdWx.exe
  2⤵
  PID:4044
- C:\Windows\System\ZucJbdT.exe
  C:\Windows\System\ZucJbdT.exe
  2⤵
  PID:3764
- C:\Windows\System\PkZmdOx.exe
  C:\Windows\System\PkZmdOx.exe
  2⤵
  PID:3832
- C:\Windows\System\oPGCXPS.exe
  C:\Windows\System\oPGCXPS.exe
  2⤵
  PID:3688
- C:\Windows\System\xsMOqMk.exe
  C:\Windows\System\xsMOqMk.exe
  2⤵
  PID:4968
- C:\Windows\System\yuCkdhn.exe
  C:\Windows\System\yuCkdhn.exe
  2⤵
  PID:5064
- C:\Windows\System\PFeCEeS.exe
  C:\Windows\System\PFeCEeS.exe
  2⤵
  PID:1308
- C:\Windows\System\JbwkZql.exe
  C:\Windows\System\JbwkZql.exe
  2⤵
  PID:2416
- C:\Windows\System\uyQXAne.exe
  C:\Windows\System\uyQXAne.exe
  2⤵
  PID:2676
- C:\Windows\System\vmagNLq.exe
  C:\Windows\System\vmagNLq.exe
  2⤵
  PID:1400
- C:\Windows\System\WBYkrpg.exe
  C:\Windows\System\WBYkrpg.exe
  2⤵
  PID:5008
- C:\Windows\System\ecABQBY.exe
  C:\Windows\System\ecABQBY.exe
  2⤵
  PID:5100
- C:\Windows\System\dbiDstu.exe
  C:\Windows\System\dbiDstu.exe
  2⤵
  PID:4124
- C:\Windows\System\JYJtpKV.exe
  C:\Windows\System\JYJtpKV.exe
  2⤵
  PID:4256
- C:\Windows\System\pdnfYCH.exe
  C:\Windows\System\pdnfYCH.exe
  2⤵
  PID:4496
- C:\Windows\System\Iycfsrx.exe
  C:\Windows\System\Iycfsrx.exe
  2⤵
  PID:4760
- C:\Windows\System\tuwZASR.exe
  C:\Windows\System\tuwZASR.exe
  2⤵
  PID:2592
- C:\Windows\System\IXPoGUl.exe
  C:\Windows\System\IXPoGUl.exe
  2⤵
  PID:4856
- C:\Windows\System\OBcwInR.exe
  C:\Windows\System\OBcwInR.exe
  2⤵
  PID:5396
- C:\Windows\System\jdVdmLi.exe
  C:\Windows\System\jdVdmLi.exe
  2⤵
  PID:5332
- C:\Windows\System\jAOupah.exe
  C:\Windows\System\jAOupah.exe
  2⤵
  PID:5200
- C:\Windows\System\LoHLUwv.exe
  C:\Windows\System\LoHLUwv.exe
  2⤵
  PID:3364
- C:\Windows\System\wQEliUQ.exe
  C:\Windows\System\wQEliUQ.exe
  2⤵
  PID:5432
- C:\Windows\System\VcfkfPP.exe
  C:\Windows\System\VcfkfPP.exe
  2⤵
  PID:5528
- C:\Windows\System\QLyTkrF.exe
  C:\Windows\System\QLyTkrF.exe
  2⤵
  PID:5632
- C:\Windows\System\FoIYPRh.exe
  C:\Windows\System\FoIYPRh.exe
  2⤵
  PID:5644
- C:\Windows\System\uEArFnd.exe
  C:\Windows\System\uEArFnd.exe
  2⤵
  PID:1184
- C:\Windows\System\PTGzKPx.exe
  C:\Windows\System\PTGzKPx.exe
  2⤵
  PID:2812
- C:\Windows\System\JewFhgb.exe
  C:\Windows\System\JewFhgb.exe
  2⤵
  PID:5832
- C:\Windows\System\Njaqwbg.exe
  C:\Windows\System\Njaqwbg.exe
  2⤵
  PID:5692
- C:\Windows\System\gczVxkh.exe
  C:\Windows\System\gczVxkh.exe
  2⤵
  PID:5860
- C:\Windows\System\YcmygCP.exe
  C:\Windows\System\YcmygCP.exe
  2⤵
  PID:1136
- C:\Windows\System\nJuwEnA.exe
  C:\Windows\System\nJuwEnA.exe
  2⤵
  PID:5792
- C:\Windows\System\jiQzqsc.exe
  C:\Windows\System\jiQzqsc.exe
  2⤵
  PID:4352
- C:\Windows\System\XsgwYBJ.exe
  C:\Windows\System\XsgwYBJ.exe
  2⤵
  PID:4512
- C:\Windows\System\wahjjKO.exe
  C:\Windows\System\wahjjKO.exe
  2⤵
  PID:5844
- C:\Windows\System\qnEjxQT.exe
  C:\Windows\System\qnEjxQT.exe
  2⤵
  PID:2700
- C:\Windows\System\ZFjPsBZ.exe
  C:\Windows\System\ZFjPsBZ.exe
  2⤵
  PID:4584
- C:\Windows\System\DWhUsyb.exe
  C:\Windows\System\DWhUsyb.exe
  2⤵
  PID:1720
- C:\Windows\System\BacdoME.exe
  C:\Windows\System\BacdoME.exe
  2⤵
  PID:4336
- C:\Windows\System\TzXTLVX.exe
  C:\Windows\System\TzXTLVX.exe
  2⤵
  PID:1044
- C:\Windows\System\wnGRneu.exe
  C:\Windows\System\wnGRneu.exe
  2⤵
  PID:5808
- C:\Windows\System\krDlZeb.exe
  C:\Windows\System\krDlZeb.exe
  2⤵
  PID:4108
- C:\Windows\System\pDVgiWz.exe
  C:\Windows\System\pDVgiWz.exe
  2⤵
  PID:4744
- C:\Windows\System\EWnjmpu.exe
  C:\Windows\System\EWnjmpu.exe
  2⤵
  PID:5084
- C:\Windows\System\rghwsSh.exe
  C:\Windows\System\rghwsSh.exe
  2⤵
  PID:4236
- C:\Windows\System\IcBhbZX.exe
  C:\Windows\System\IcBhbZX.exe
  2⤵
  PID:5148
- C:\Windows\System\dnvTleO.exe
  C:\Windows\System\dnvTleO.exe
  2⤵
  PID:5276
- C:\Windows\System\wEtrNat.exe
  C:\Windows\System\wEtrNat.exe
  2⤵
  PID:5184
- C:\Windows\System\CliFlUp.exe
  C:\Windows\System\CliFlUp.exe
  2⤵
  PID:5316
- C:\Windows\System\opgpYAf.exe
  C:\Windows\System\opgpYAf.exe
  2⤵
  PID:5508
- C:\Windows\System\zHlmyJo.exe
  C:\Windows\System\zHlmyJo.exe
  2⤵
  PID:5512
- C:\Windows\System\yGqZRoS.exe
  C:\Windows\System\yGqZRoS.exe
  2⤵
  PID:5716
- C:\Windows\System\KKbYKch.exe
  C:\Windows\System\KKbYKch.exe
  2⤵
  PID:3040
- C:\Windows\System\RAKXvxM.exe
  C:\Windows\System\RAKXvxM.exe
  2⤵
  PID:6000
- C:\Windows\System\HREvnek.exe
  C:\Windows\System\HREvnek.exe
  2⤵
  PID:5892
- C:\Windows\System\yBLUgoy.exe
  C:\Windows\System\yBLUgoy.exe
  2⤵
  PID:5988
- C:\Windows\System\owWMiPG.exe
  C:\Windows\System\owWMiPG.exe
  2⤵
  PID:4956
- C:\Windows\System\zWFbuOI.exe
  C:\Windows\System\zWFbuOI.exe
  2⤵
  PID:6020
- C:\Windows\System\egIJclf.exe
  C:\Windows\System\egIJclf.exe
  2⤵
  PID:6068
- C:\Windows\System\FsPKAQd.exe
  C:\Windows\System\FsPKAQd.exe
  2⤵
  PID:4884
- C:\Windows\System\ZwftQuW.exe
  C:\Windows\System\ZwftQuW.exe
  2⤵
  PID:3176
- C:\Windows\System\hDnYBGw.exe
  C:\Windows\System\hDnYBGw.exe
  2⤵
  PID:1032
- C:\Windows\System\JwYfpGZ.exe
  C:\Windows\System\JwYfpGZ.exe
  2⤵
  PID:1500
- C:\Windows\System\VQMrwTW.exe
  C:\Windows\System\VQMrwTW.exe
  2⤵
  PID:3336
- C:\Windows\System\FJLqEoq.exe
  C:\Windows\System\FJLqEoq.exe
  2⤵
  PID:3304
- C:\Windows\System\NeXnEXY.exe
  C:\Windows\System\NeXnEXY.exe
  2⤵
  PID:3528
- C:\Windows\System\KRHGiew.exe
  C:\Windows\System\KRHGiew.exe
  2⤵
  PID:2032
- C:\Windows\System\kGWOnir.exe
  C:\Windows\System\kGWOnir.exe
  2⤵
  PID:1796
- C:\Windows\System\qxPuzmG.exe
  C:\Windows\System\qxPuzmG.exe
  2⤵
  PID:3256
- C:\Windows\System\ZsEtBsa.exe
  C:\Windows\System\ZsEtBsa.exe
  2⤵
  PID:2136
- C:\Windows\System\ObDGrJQ.exe
  C:\Windows\System\ObDGrJQ.exe
  2⤵
  PID:5012
- C:\Windows\System\yzfabqg.exe
  C:\Windows\System\yzfabqg.exe
  2⤵
  PID:3976
- C:\Windows\System\kfyavnf.exe
  C:\Windows\System\kfyavnf.exe
  2⤵
  PID:3684
- C:\Windows\System\ffFCnpI.exe
  C:\Windows\System\ffFCnpI.exe
  2⤵
  PID:4980
- C:\Windows\System\GTKCthY.exe
  C:\Windows\System\GTKCthY.exe
  2⤵
  PID:4164
- C:\Windows\System\HXIibXP.exe
  C:\Windows\System\HXIibXP.exe
  2⤵
  PID:2308
- C:\Windows\System\VkzaGDV.exe
  C:\Windows\System\VkzaGDV.exe
  2⤵
  PID:5160
- C:\Windows\System\NbiUuJp.exe
  C:\Windows\System\NbiUuJp.exe
  2⤵
  PID:5608
- C:\Windows\System\vuWeDIN.exe
  C:\Windows\System\vuWeDIN.exe
  2⤵
  PID:5660
- C:\Windows\System\zOQRRxC.exe
  C:\Windows\System\zOQRRxC.exe
  2⤵
  PID:4320
- C:\Windows\System\bskEBaw.exe
  C:\Windows\System\bskEBaw.exe
  2⤵
  PID:4448
- C:\Windows\System\qRBUWSq.exe
  C:\Windows\System\qRBUWSq.exe
  2⤵
  PID:5132
- C:\Windows\System\rDKXLhP.exe
  C:\Windows\System\rDKXLhP.exe
  2⤵
  PID:4288
- C:\Windows\System\CrPFJJh.exe
  C:\Windows\System\CrPFJJh.exe
  2⤵
  PID:4092
- C:\Windows\System\DcTXpNq.exe
  C:\Windows\System\DcTXpNq.exe
  2⤵
  PID:1548
- C:\Windows\System\DwOWDDK.exe
  C:\Windows\System\DwOWDDK.exe
  2⤵
  PID:5232
- C:\Windows\System\rbqSoBl.exe
  C:\Windows\System\rbqSoBl.exe
  2⤵
  PID:5628
- C:\Windows\System\hzQHbJV.exe
  C:\Windows\System\hzQHbJV.exe
  2⤵
  PID:4580
- C:\Windows\System\VPdFiSN.exe
  C:\Windows\System\VPdFiSN.exe
  2⤵
  PID:1036
- C:\Windows\System\nbTIgUy.exe
  C:\Windows\System\nbTIgUy.exe
  2⤵
  PID:4220
- C:\Windows\System\apxspyN.exe
  C:\Windows\System\apxspyN.exe
  2⤵
  PID:4200
- C:\Windows\System\IVCfNhz.exe
  C:\Windows\System\IVCfNhz.exe
  2⤵
  PID:4400
- C:\Windows\System\rgRQhVQ.exe
  C:\Windows\System\rgRQhVQ.exe
  2⤵
  PID:5212
- C:\Windows\System\BdYOuGY.exe
  C:\Windows\System\BdYOuGY.exe
  2⤵
  PID:2860
- C:\Windows\System\OUNORgH.exe
  C:\Windows\System\OUNORgH.exe
  2⤵
  PID:3208
- C:\Windows\System\ililQMD.exe
  C:\Windows\System\ililQMD.exe
  2⤵
  PID:3140
- C:\Windows\System\sLsNRDF.exe
  C:\Windows\System\sLsNRDF.exe
  2⤵
  PID:1048
- C:\Windows\System\FPVGchG.exe
  C:\Windows\System\FPVGchG.exe
  2⤵
  PID:5580
- C:\Windows\System\hklqeLQ.exe
  C:\Windows\System\hklqeLQ.exe
  2⤵
  PID:3588
- C:\Windows\System\luqyPkw.exe
  C:\Windows\System\luqyPkw.exe
  2⤵
  PID:4100
- C:\Windows\System\HezfltL.exe
  C:\Windows\System\HezfltL.exe
  2⤵
  PID:4848
- C:\Windows\System\ZbcZiYt.exe
  C:\Windows\System\ZbcZiYt.exe
  2⤵
  PID:5380
- C:\Windows\System\zSxCkHy.exe
  C:\Windows\System\zSxCkHy.exe
  2⤵
  PID:3636
- C:\Windows\System\xFtUKhR.exe
  C:\Windows\System\xFtUKhR.exe
  2⤵
  PID:5940
- C:\Windows\System\MBFqhHo.exe
  C:\Windows\System\MBFqhHo.exe
  2⤵
  PID:2796
- C:\Windows\System\DwiqlKP.exe
  C:\Windows\System\DwiqlKP.exe
  2⤵
  PID:4952
- C:\Windows\System\xJMqhZB.exe
  C:\Windows\System\xJMqhZB.exe
  2⤵
  PID:5296
- C:\Windows\System\vigzIDe.exe
  C:\Windows\System\vigzIDe.exe
  2⤵
  PID:3908
- C:\Windows\System\ySvuZif.exe
  C:\Windows\System\ySvuZif.exe
  2⤵
  PID:2552
- C:\Windows\System\LSTgFld.exe
  C:\Windows\System\LSTgFld.exe
  2⤵
  PID:5600
- C:\Windows\System\fNBWxSL.exe
  C:\Windows\System\fNBWxSL.exe
  2⤵
  PID:4412
- C:\Windows\System\CuSTTEw.exe
  C:\Windows\System\CuSTTEw.exe
  2⤵
  PID:3512
- C:\Windows\System\CEjKFFe.exe
  C:\Windows\System\CEjKFFe.exe
  2⤵
  PID:3972
- C:\Windows\System\racZfmV.exe
  C:\Windows\System\racZfmV.exe
  2⤵
  PID:5828
- C:\Windows\System\qqhQSDF.exe
  C:\Windows\System\qqhQSDF.exe
  2⤵
  PID:1892
- C:\Windows\System\ZzcMaOs.exe
  C:\Windows\System\ZzcMaOs.exe
  2⤵
  PID:5016
- C:\Windows\System\nosWlCz.exe
  C:\Windows\System\nosWlCz.exe
  2⤵
  PID:4196
- C:\Windows\System\VCNZZkg.exe
  C:\Windows\System\VCNZZkg.exe
  2⤵
  PID:880
- C:\Windows\System\nkRvPhh.exe
  C:\Windows\System\nkRvPhh.exe
  2⤵
  PID:4112
- C:\Windows\System\VSUWVQe.exe
  C:\Windows\System\VSUWVQe.exe
  2⤵
  PID:4372
- C:\Windows\System\qTuvZaG.exe
  C:\Windows\System\qTuvZaG.exe
  2⤵
  PID:4276
- C:\Windows\System\xAeRwbc.exe
  C:\Windows\System\xAeRwbc.exe
  2⤵
  PID:4828
- C:\Windows\System\Fwczkfl.exe
  C:\Windows\System\Fwczkfl.exe
  2⤵
  PID:4932
- C:\Windows\System\qezWbmI.exe
  C:\Windows\System\qezWbmI.exe
  2⤵
  PID:5312
- C:\Windows\System\zKGzLST.exe
  C:\Windows\System\zKGzLST.exe
  2⤵
  PID:4156
- C:\Windows\System\ksXUZqX.exe
  C:\Windows\System\ksXUZqX.exe
  2⤵
  PID:5788
- C:\Windows\System\rhAXiye.exe
  C:\Windows\System\rhAXiye.exe
  2⤵
  PID:5680
- C:\Windows\System\dSNpemD.exe
  C:\Windows\System\dSNpemD.exe
  2⤵
  PID:2644
- C:\Windows\System\eJoFdWV.exe
  C:\Windows\System\eJoFdWV.exe
  2⤵
  PID:3300
- C:\Windows\System\TTMoMJy.exe
  C:\Windows\System\TTMoMJy.exe
  2⤵
  PID:844
- C:\Windows\System\NPewFZi.exe
  C:\Windows\System\NPewFZi.exe
  2⤵
  PID:716
- C:\Windows\System\pndJVUg.exe
  C:\Windows\System\pndJVUg.exe
  2⤵
  PID:3752
- C:\Windows\System\BehYeLv.exe
  C:\Windows\System\BehYeLv.exe
  2⤵
  PID:3828
- C:\Windows\System\AstKRCm.exe
  C:\Windows\System\AstKRCm.exe
  2⤵
  PID:1088
- C:\Windows\System\KTCMhMB.exe
  C:\Windows\System\KTCMhMB.exe
  2⤵
  PID:4872
- C:\Windows\System\IZRmGrH.exe
  C:\Windows\System\IZRmGrH.exe
  2⤵
  PID:648
- C:\Windows\System\HlFullQ.exe
  C:\Windows\System\HlFullQ.exe
  2⤵
  PID:4232
- C:\Windows\System\jMHwBRz.exe
  C:\Windows\System\jMHwBRz.exe
  2⤵
  PID:4620
- C:\Windows\System\KISFhEg.exe
  C:\Windows\System\KISFhEg.exe
  2⤵
  PID:4464
- C:\Windows\System\YKnYQGe.exe
  C:\Windows\System\YKnYQGe.exe
  2⤵
  PID:5052
- C:\Windows\System\PUJzjNM.exe
  C:\Windows\System\PUJzjNM.exe
  2⤵
  PID:832
- C:\Windows\System\KBjiQPH.exe
  C:\Windows\System\KBjiQPH.exe
  2⤵
  PID:3524
- C:\Windows\System\dGlRHTb.exe
  C:\Windows\System\dGlRHTb.exe
  2⤵
  PID:3656
- C:\Windows\System\WyLqgzX.exe
  C:\Windows\System\WyLqgzX.exe
  2⤵
  PID:2956
- C:\Windows\System\LWDWzeH.exe
  C:\Windows\System\LWDWzeH.exe
  2⤵
  PID:6164
- C:\Windows\System\kXRQCql.exe
  C:\Windows\System\kXRQCql.exe
  2⤵
  PID:6180
- C:\Windows\System\gKWMuog.exe
  C:\Windows\System\gKWMuog.exe
  2⤵
  PID:6196
- C:\Windows\System\tpsWzqc.exe
  C:\Windows\System\tpsWzqc.exe
  2⤵
  PID:6212
- C:\Windows\System\qByvOPE.exe
  C:\Windows\System\qByvOPE.exe
  2⤵
  PID:6228
- C:\Windows\System\oECYfNU.exe
  C:\Windows\System\oECYfNU.exe
  2⤵
  PID:6244
- C:\Windows\System\phZUHwM.exe
  C:\Windows\System\phZUHwM.exe
  2⤵
  PID:6260
- C:\Windows\System\OgsPknR.exe
  C:\Windows\System\OgsPknR.exe
  2⤵
  PID:6276
- C:\Windows\System\iCTrEOh.exe
  C:\Windows\System\iCTrEOh.exe
  2⤵
  PID:6292
- C:\Windows\System\XdaXceW.exe
  C:\Windows\System\XdaXceW.exe
  2⤵
  PID:6308
- C:\Windows\System\SHqCKkd.exe
  C:\Windows\System\SHqCKkd.exe
  2⤵
  PID:6324
- C:\Windows\System\jnlqqLo.exe
  C:\Windows\System\jnlqqLo.exe
  2⤵
  PID:6340
- C:\Windows\System\ILIGEfS.exe
  C:\Windows\System\ILIGEfS.exe
  2⤵
  PID:6356
- C:\Windows\System\eugRmsr.exe
  C:\Windows\System\eugRmsr.exe
  2⤵
  PID:6372
- C:\Windows\System\XHBSyWF.exe
  C:\Windows\System\XHBSyWF.exe
  2⤵
  PID:6388
- C:\Windows\System\qBRMQrK.exe
  C:\Windows\System\qBRMQrK.exe
  2⤵
  PID:6404
- C:\Windows\System\pRjhrEW.exe
  C:\Windows\System\pRjhrEW.exe
  2⤵
  PID:6420
- C:\Windows\System\eprPkBx.exe
  C:\Windows\System\eprPkBx.exe
  2⤵
  PID:6436
- C:\Windows\System\aWzXkru.exe
  C:\Windows\System\aWzXkru.exe
  2⤵
  PID:6452
- C:\Windows\System\istxOAS.exe
  C:\Windows\System\istxOAS.exe
  2⤵
  PID:6468
- C:\Windows\System\sTqrCnf.exe
  C:\Windows\System\sTqrCnf.exe
  2⤵
  PID:6484
- C:\Windows\System\ddRCMxP.exe
  C:\Windows\System\ddRCMxP.exe
  2⤵
  PID:6500
- C:\Windows\System\dZeONbW.exe
  C:\Windows\System\dZeONbW.exe
  2⤵
  PID:6516
- C:\Windows\System\lnaMosM.exe
  C:\Windows\System\lnaMosM.exe
  2⤵
  PID:6532
- C:\Windows\System\lzioKvp.exe
  C:\Windows\System\lzioKvp.exe
  2⤵
  PID:6548
- C:\Windows\System\EkGFVWI.exe
  C:\Windows\System\EkGFVWI.exe
  2⤵
  PID:6564
- C:\Windows\System\GTgqigv.exe
  C:\Windows\System\GTgqigv.exe
  2⤵
  PID:6580
- C:\Windows\System\CAkjUOk.exe
  C:\Windows\System\CAkjUOk.exe
  2⤵
  PID:6596
- C:\Windows\System\ELNSnOy.exe
  C:\Windows\System\ELNSnOy.exe
  2⤵
  PID:6612
- C:\Windows\System\aIbxmxv.exe
  C:\Windows\System\aIbxmxv.exe
  2⤵
  PID:6628
- C:\Windows\System\ttwQlKy.exe
  C:\Windows\System\ttwQlKy.exe
  2⤵
  PID:6644
- C:\Windows\System\eVapsmL.exe
  C:\Windows\System\eVapsmL.exe
  2⤵
  PID:6660
- C:\Windows\System\nAvJhRM.exe
  C:\Windows\System\nAvJhRM.exe
  2⤵
  PID:6676
- C:\Windows\System\hqpJOQB.exe
  C:\Windows\System\hqpJOQB.exe
  2⤵
  PID:6692
- C:\Windows\System\hVkPVgS.exe
  C:\Windows\System\hVkPVgS.exe
  2⤵
  PID:6708
- C:\Windows\System\fOlRZxE.exe
  C:\Windows\System\fOlRZxE.exe
  2⤵
  PID:6724
- C:\Windows\System\UxyUppA.exe
  C:\Windows\System\UxyUppA.exe
  2⤵
  PID:6740
- C:\Windows\System\qEdAbZI.exe
  C:\Windows\System\qEdAbZI.exe
  2⤵
  PID:6756
- C:\Windows\System\SRqTIAQ.exe
  C:\Windows\System\SRqTIAQ.exe
  2⤵
  PID:6772
- C:\Windows\System\tjLqOWl.exe
  C:\Windows\System\tjLqOWl.exe
  2⤵
  PID:6788
- C:\Windows\System\OmIYTDH.exe
  C:\Windows\System\OmIYTDH.exe
  2⤵
  PID:6804
- C:\Windows\System\PBEbCJS.exe
  C:\Windows\System\PBEbCJS.exe
  2⤵
  PID:6820
- C:\Windows\System\alXiTsz.exe
  C:\Windows\System\alXiTsz.exe
  2⤵
  PID:6836
- C:\Windows\System\erkeLAw.exe
  C:\Windows\System\erkeLAw.exe
  2⤵
  PID:6852
- C:\Windows\System\vHJRmLr.exe
  C:\Windows\System\vHJRmLr.exe
  2⤵
  PID:6868
- C:\Windows\System\ciyNVcP.exe
  C:\Windows\System\ciyNVcP.exe
  2⤵
  PID:6884
- C:\Windows\System\QiQjkDV.exe
  C:\Windows\System\QiQjkDV.exe
  2⤵
  PID:6900
- C:\Windows\System\exMRvcg.exe
  C:\Windows\System\exMRvcg.exe
  2⤵
  PID:6916
- C:\Windows\System\oBwVYGk.exe
  C:\Windows\System\oBwVYGk.exe
  2⤵
  PID:6932
- C:\Windows\System\kKelhQS.exe
  C:\Windows\System\kKelhQS.exe
  2⤵
  PID:6948
- C:\Windows\System\lJTMjGc.exe
  C:\Windows\System\lJTMjGc.exe
  2⤵
  PID:6964
- C:\Windows\System\aSPvBuc.exe
  C:\Windows\System\aSPvBuc.exe
  2⤵
  PID:6980
- C:\Windows\System\nBTZydS.exe
  C:\Windows\System\nBTZydS.exe
  2⤵
  PID:7000
- C:\Windows\System\cgnpkxK.exe
  C:\Windows\System\cgnpkxK.exe
  2⤵
  PID:7016
- C:\Windows\System\wsFOElZ.exe
  C:\Windows\System\wsFOElZ.exe
  2⤵
  PID:7032
- C:\Windows\System\GnRoEDN.exe
  C:\Windows\System\GnRoEDN.exe
  2⤵
  PID:7048
- C:\Windows\System\bIJHZuO.exe
  C:\Windows\System\bIJHZuO.exe
  2⤵
  PID:7064
- C:\Windows\System\avgFwmP.exe
  C:\Windows\System\avgFwmP.exe
  2⤵
  PID:7088
- C:\Windows\System\kQgGMZg.exe
  C:\Windows\System\kQgGMZg.exe
  2⤵
  PID:7104
- C:\Windows\System\ccVGmNv.exe
  C:\Windows\System\ccVGmNv.exe
  2⤵
  PID:7120
- C:\Windows\System\gCDUyIV.exe
  C:\Windows\System\gCDUyIV.exe
  2⤵
  PID:7136
- C:\Windows\System\snnhUbS.exe
  C:\Windows\System\snnhUbS.exe
  2⤵
  PID:7152
- C:\Windows\System\vfznINs.exe
  C:\Windows\System\vfznINs.exe
  2⤵
  PID:6148
- C:\Windows\System\KbwlbsI.exe
  C:\Windows\System\KbwlbsI.exe
  2⤵
  PID:6160
- C:\Windows\System\pIwmgxP.exe
  C:\Windows\System\pIwmgxP.exe
  2⤵
  PID:6176
- C:\Windows\System\asCgufG.exe
  C:\Windows\System\asCgufG.exe
  2⤵
  PID:6208
- C:\Windows\System\mevOJTx.exe
  C:\Windows\System\mevOJTx.exe
  2⤵
  PID:6300
- C:\Windows\System\iGRAWqd.exe
  C:\Windows\System\iGRAWqd.exe
  2⤵
  PID:6220
- C:\Windows\System\gBuKlCr.exe
  C:\Windows\System\gBuKlCr.exe
  2⤵
  PID:6284
- C:\Windows\System\toXYCxy.exe
  C:\Windows\System\toXYCxy.exe
  2⤵
  PID:6348
- C:\Windows\System\VlMGKcf.exe
  C:\Windows\System\VlMGKcf.exe
  2⤵
  PID:6364
- C:\Windows\System\hKCiYmA.exe
  C:\Windows\System\hKCiYmA.exe
  2⤵
  PID:6384
- C:\Windows\System\wiQHlZC.exe
  C:\Windows\System\wiQHlZC.exe
  2⤵
  PID:6448
- C:\Windows\System\mdyTKEf.exe
  C:\Windows\System\mdyTKEf.exe
  2⤵
  PID:6432
- C:\Windows\System\XuayTAm.exe
  C:\Windows\System\XuayTAm.exe
  2⤵
  PID:6464
- C:\Windows\System\ZPPvJmg.exe
  C:\Windows\System\ZPPvJmg.exe
  2⤵
  PID:6460
- C:\Windows\System\sNnTUmO.exe
  C:\Windows\System\sNnTUmO.exe
  2⤵
  PID:6528
- C:\Windows\System\BwSNlwG.exe
  C:\Windows\System\BwSNlwG.exe
  2⤵
  PID:6636
- C:\Windows\System\ARsNRFV.exe
  C:\Windows\System\ARsNRFV.exe
  2⤵
  PID:6672
- C:\Windows\System\kCdkTwJ.exe
  C:\Windows\System\kCdkTwJ.exe
  2⤵
  PID:6592
- C:\Windows\System\MEjywcb.exe
  C:\Windows\System\MEjywcb.exe
  2⤵
  PID:6768
- C:\Windows\System\zSMUZeJ.exe
  C:\Windows\System\zSMUZeJ.exe
  2⤵
  PID:6832
- C:\Windows\System\VlXxqZI.exe
  C:\Windows\System\VlXxqZI.exe
  2⤵
  PID:6896
- C:\Windows\System\mwnYKRf.exe
  C:\Windows\System\mwnYKRf.exe
  2⤵
  PID:6928
- C:\Windows\System\ApyKZZu.exe
  C:\Windows\System\ApyKZZu.exe
  2⤵
  PID:6752
- C:\Windows\System\ucluZEl.exe
  C:\Windows\System\ucluZEl.exe
  2⤵
  PID:6624
- C:\Windows\System\pGzxPUh.exe
  C:\Windows\System\pGzxPUh.exe
  2⤵
  PID:6880
- C:\Windows\System\OmZcxSD.exe
  C:\Windows\System\OmZcxSD.exe
  2⤵
  PID:6716
- C:\Windows\System\QCVlqVL.exe
  C:\Windows\System\QCVlqVL.exe
  2⤵
  PID:6848
- C:\Windows\System\Vjxtewo.exe
  C:\Windows\System\Vjxtewo.exe
  2⤵
  PID:7008
- C:\Windows\System\RmozDYN.exe
  C:\Windows\System\RmozDYN.exe
  2⤵
  PID:7040
- C:\Windows\System\blhjECU.exe
  C:\Windows\System\blhjECU.exe
  2⤵
  PID:7024
- C:\Windows\System\VGjbiLw.exe
  C:\Windows\System\VGjbiLw.exe
  2⤵
  PID:2320
- C:\Windows\System\zLZTWua.exe
  C:\Windows\System\zLZTWua.exe
  2⤵
  PID:7132
- C:\Windows\System\Gwfajvo.exe
  C:\Windows\System\Gwfajvo.exe
  2⤵
  PID:6188
- C:\Windows\System\LkcJFiu.exe
  C:\Windows\System\LkcJFiu.exe
  2⤵
  PID:6256
- C:\Windows\System\FdhmjbF.exe
  C:\Windows\System\FdhmjbF.exe
  2⤵
  PID:6416
- C:\Windows\System\uglBDXs.exe
  C:\Windows\System\uglBDXs.exe
  2⤵
  PID:6608
- C:\Windows\System\mNwIHoj.exe
  C:\Windows\System\mNwIHoj.exe
  2⤵
  PID:6152
- C:\Windows\System\IQijcMS.exe
  C:\Windows\System\IQijcMS.exe
  2⤵
  PID:7112
- C:\Windows\System\nFcFeYL.exe
  C:\Windows\System\nFcFeYL.exe
  2⤵
  PID:6332
- C:\Windows\System\AvMxHRs.exe
  C:\Windows\System\AvMxHRs.exe
  2⤵
  PID:6400
- C:\Windows\System\kRfCCUp.exe
  C:\Windows\System\kRfCCUp.exe
  2⤵
  PID:6556
- C:\Windows\System\SFpjePR.exe
  C:\Windows\System\SFpjePR.exe
  2⤵
  PID:6668
- C:\Windows\System\jywLHfX.exe
  C:\Windows\System\jywLHfX.exe
  2⤵
  PID:6892
- C:\Windows\System\AEdAeHj.exe
  C:\Windows\System\AEdAeHj.exe
  2⤵
  PID:6844
- C:\Windows\System\sCXDujJ.exe
  C:\Windows\System\sCXDujJ.exe
  2⤵
  PID:7060
- C:\Windows\System\WvsmkvP.exe
  C:\Windows\System\WvsmkvP.exe
  2⤵
  PID:6800
- C:\Windows\System\LuoqiUg.exe
  C:\Windows\System\LuoqiUg.exe
  2⤵
  PID:6876
- C:\Windows\System\FMPczui.exe
  C:\Windows\System\FMPczui.exe
  2⤵
  PID:6940
- C:\Windows\System\oJXSHci.exe
  C:\Windows\System\oJXSHci.exe
  2⤵
  PID:7100
- C:\Windows\System\ooGWjJR.exe
  C:\Windows\System\ooGWjJR.exe
  2⤵
  PID:6492
- C:\Windows\System\DmJnKpj.exe
  C:\Windows\System\DmJnKpj.exe
  2⤵
  PID:6368
- C:\Windows\System\ncnCXvo.exe
  C:\Windows\System\ncnCXvo.exe
  2⤵
  PID:7148
- C:\Windows\System\ikupodW.exe
  C:\Windows\System\ikupodW.exe
  2⤵
  PID:6480
- C:\Windows\System\CvlOGWe.exe
  C:\Windows\System\CvlOGWe.exe
  2⤵
  PID:6604
- C:\Windows\System\pXACovr.exe
  C:\Windows\System\pXACovr.exe
  2⤵
  PID:6960
- C:\Windows\System\axXByIC.exe
  C:\Windows\System\axXByIC.exe
  2⤵
  PID:6720
- C:\Windows\System\iBgjBuT.exe
  C:\Windows\System\iBgjBuT.exe
  2⤵
  PID:6684
- C:\Windows\System\pnfApuY.exe
  C:\Windows\System\pnfApuY.exe
  2⤵
  PID:7084
- C:\Windows\System\cPceZmX.exe
  C:\Windows\System\cPceZmX.exe
  2⤵
  PID:6864
- C:\Windows\System\xNdfAge.exe
  C:\Windows\System\xNdfAge.exe
  2⤵
  PID:7184
- C:\Windows\System\LmYoKNR.exe
  C:\Windows\System\LmYoKNR.exe
  2⤵
  PID:7200
- C:\Windows\System\LQwLhtq.exe
  C:\Windows\System\LQwLhtq.exe
  2⤵
  PID:7216
- C:\Windows\System\FbJYZDk.exe
  C:\Windows\System\FbJYZDk.exe
  2⤵
  PID:7232
- C:\Windows\System\jjYTHOE.exe
  C:\Windows\System\jjYTHOE.exe
  2⤵
  PID:7248
- C:\Windows\System\UcaBiAm.exe
  C:\Windows\System\UcaBiAm.exe
  2⤵
  PID:7264
- C:\Windows\System\kpjVVQx.exe
  C:\Windows\System\kpjVVQx.exe
  2⤵
  PID:7280
- C:\Windows\System\rTPQwfC.exe
  C:\Windows\System\rTPQwfC.exe
  2⤵
  PID:7296
- C:\Windows\System\KELkHgl.exe
  C:\Windows\System\KELkHgl.exe
  2⤵
  PID:7312
- C:\Windows\System\qKrdLgu.exe
  C:\Windows\System\qKrdLgu.exe
  2⤵
  PID:7328
- C:\Windows\System\PZnVCIh.exe
  C:\Windows\System\PZnVCIh.exe
  2⤵
  PID:7348
- C:\Windows\System\FceFcWZ.exe
  C:\Windows\System\FceFcWZ.exe
  2⤵
  PID:7364
- C:\Windows\System\IBnKYAA.exe
  C:\Windows\System\IBnKYAA.exe
  2⤵
  PID:7380
- C:\Windows\System\VEfDbUb.exe
  C:\Windows\System\VEfDbUb.exe
  2⤵
  PID:7396
- C:\Windows\System\FwjmwNw.exe
  C:\Windows\System\FwjmwNw.exe
  2⤵
  PID:7412
- C:\Windows\System\jnTkqar.exe
  C:\Windows\System\jnTkqar.exe
  2⤵
  PID:7428
- C:\Windows\System\ULpuAGq.exe
  C:\Windows\System\ULpuAGq.exe
  2⤵
  PID:7448
- C:\Windows\System\BmgnPaW.exe
  C:\Windows\System\BmgnPaW.exe
  2⤵
  PID:7464
- C:\Windows\System\pKCBMRV.exe
  C:\Windows\System\pKCBMRV.exe
  2⤵
  PID:7484
- C:\Windows\System\kxqwtVk.exe
  C:\Windows\System\kxqwtVk.exe
  2⤵
  PID:7616
- C:\Windows\System\EyGDTLu.exe
  C:\Windows\System\EyGDTLu.exe
  2⤵
  PID:7632
- C:\Windows\System\DhEwUAr.exe
  C:\Windows\System\DhEwUAr.exe
  2⤵
  PID:7648
- C:\Windows\System\qUTOsEk.exe
  C:\Windows\System\qUTOsEk.exe
  2⤵
  PID:7668
- C:\Windows\System\LbqBISN.exe
  C:\Windows\System\LbqBISN.exe
  2⤵
  PID:7684
- C:\Windows\System\ataMQIQ.exe
  C:\Windows\System\ataMQIQ.exe
  2⤵
  PID:7700
- C:\Windows\System\UgVRKSq.exe
  C:\Windows\System\UgVRKSq.exe
  2⤵
  PID:7716
- C:\Windows\System\aLOSkDV.exe
  C:\Windows\System\aLOSkDV.exe
  2⤵
  PID:7736
- C:\Windows\System\fjKhpYy.exe
  C:\Windows\System\fjKhpYy.exe
  2⤵
  PID:7752
- C:\Windows\System\szujxqD.exe
  C:\Windows\System\szujxqD.exe
  2⤵
  PID:7768
- C:\Windows\System\hKQgyBS.exe
  C:\Windows\System\hKQgyBS.exe
  2⤵
  PID:7788
- C:\Windows\System\IZGXOGa.exe
  C:\Windows\System\IZGXOGa.exe
  2⤵
  PID:7804
- C:\Windows\System\IGHedCk.exe
  C:\Windows\System\IGHedCk.exe
  2⤵
  PID:7820
- C:\Windows\System\xcRIpGG.exe
  C:\Windows\System\xcRIpGG.exe
  2⤵
  PID:7836
- C:\Windows\System\ouxCWIA.exe
  C:\Windows\System\ouxCWIA.exe
  2⤵
  PID:7852
- C:\Windows\System\opOWeDm.exe
  C:\Windows\System\opOWeDm.exe
  2⤵
  PID:7868
- C:\Windows\System\ZglDrMA.exe
  C:\Windows\System\ZglDrMA.exe
  2⤵
  PID:7884
- C:\Windows\System\RXaApXI.exe
  C:\Windows\System\RXaApXI.exe
  2⤵
  PID:7900
- C:\Windows\System\rmisqtE.exe
  C:\Windows\System\rmisqtE.exe
  2⤵
  PID:7916
- C:\Windows\System\JMoSEpR.exe
  C:\Windows\System\JMoSEpR.exe
  2⤵
  PID:7932
- C:\Windows\System\UbVAtcu.exe
  C:\Windows\System\UbVAtcu.exe
  2⤵
  PID:7948
- C:\Windows\System\yJKkJrI.exe
  C:\Windows\System\yJKkJrI.exe
  2⤵
  PID:7968
- C:\Windows\System\UKPGALs.exe
  C:\Windows\System\UKPGALs.exe
  2⤵
  PID:7984
- C:\Windows\System\YhsEZju.exe
  C:\Windows\System\YhsEZju.exe
  2⤵
  PID:8000
- C:\Windows\System\ebpucUj.exe
  C:\Windows\System\ebpucUj.exe
  2⤵
  PID:8020
- C:\Windows\System\MzREXXl.exe
  C:\Windows\System\MzREXXl.exe
  2⤵
  PID:8036
- C:\Windows\System\lvcNKgU.exe
  C:\Windows\System\lvcNKgU.exe
  2⤵
  PID:8052
- C:\Windows\System\skcWiDV.exe
  C:\Windows\System\skcWiDV.exe
  2⤵
  PID:8076
- C:\Windows\System\VTqvvWk.exe
  C:\Windows\System\VTqvvWk.exe
  2⤵
  PID:8092
- C:\Windows\System\gGfdrqR.exe
  C:\Windows\System\gGfdrqR.exe
  2⤵
  PID:8108
- C:\Windows\System\jcCpPNE.exe
  C:\Windows\System\jcCpPNE.exe
  2⤵
  PID:8124
- C:\Windows\System\oNtxePz.exe
  C:\Windows\System\oNtxePz.exe
  2⤵
  PID:8140
- C:\Windows\System\iovLsFP.exe
  C:\Windows\System\iovLsFP.exe
  2⤵
  PID:8156
- C:\Windows\System\bvihtuF.exe
  C:\Windows\System\bvihtuF.exe
  2⤵
  PID:8172
- C:\Windows\System\LiPgEdd.exe
  C:\Windows\System\LiPgEdd.exe
  2⤵
  PID:8188
- C:\Windows\System\bcqcKBm.exe
  C:\Windows\System\bcqcKBm.exe
  2⤵
  PID:7080
- C:\Windows\System\wIJbEvj.exe
  C:\Windows\System\wIJbEvj.exe
  2⤵
  PID:4368
- C:\Windows\System\KRRmOnI.exe
  C:\Windows\System\KRRmOnI.exe
  2⤵
  PID:7144
- C:\Windows\System\kEvcsvA.exe
  C:\Windows\System\kEvcsvA.exe
  2⤵
  PID:7176
- C:\Windows\System\VgQIcWx.exe
  C:\Windows\System\VgQIcWx.exe
  2⤵
  PID:7056
- C:\Windows\System\loiLSWr.exe
  C:\Windows\System\loiLSWr.exe
  2⤵
  PID:7192
- C:\Windows\System\sHKfcNr.exe
  C:\Windows\System\sHKfcNr.exe
  2⤵
  PID:7228
- C:\Windows\System\EYbwWDi.exe
  C:\Windows\System\EYbwWDi.exe
  2⤵
  PID:7292
- C:\Windows\System\ymvlZUT.exe
  C:\Windows\System\ymvlZUT.exe
  2⤵
  PID:7276
- C:\Windows\System\GvUWIkp.exe
  C:\Windows\System\GvUWIkp.exe
  2⤵
  PID:7408
- C:\Windows\System\banvFuv.exe
  C:\Windows\System\banvFuv.exe
  2⤵
  PID:7372
- C:\Windows\System\PwmfrQV.exe
  C:\Windows\System\PwmfrQV.exe
  2⤵
  PID:7444
- C:\Windows\System\FjDcauc.exe
  C:\Windows\System\FjDcauc.exe
  2⤵
  PID:7420
- C:\Windows\System\FmvIqTd.exe
  C:\Windows\System\FmvIqTd.exe
  2⤵
  PID:7424
- C:\Windows\System\wbfOqIL.exe
  C:\Windows\System\wbfOqIL.exe
  2⤵
  PID:7496
- C:\Windows\System\fbFjmwr.exe
  C:\Windows\System\fbFjmwr.exe
  2⤵
  PID:7512
- C:\Windows\System\qXUDKeC.exe
  C:\Windows\System\qXUDKeC.exe
  2⤵
  PID:7528
- C:\Windows\System\LfgfPrW.exe
  C:\Windows\System\LfgfPrW.exe
  2⤵
  PID:7532
- C:\Windows\System\uKLLGiH.exe
  C:\Windows\System\uKLLGiH.exe
  2⤵
  PID:7564
- C:\Windows\System\SXJWMQX.exe
  C:\Windows\System\SXJWMQX.exe
  2⤵
  PID:7624
- C:\Windows\System\brMWrie.exe
  C:\Windows\System\brMWrie.exe
  2⤵
  PID:7660
- C:\Windows\System\iSKndOh.exe
  C:\Windows\System\iSKndOh.exe
  2⤵
  PID:7724
- C:\Windows\System\YftuZSO.exe
  C:\Windows\System\YftuZSO.exe
  2⤵
  PID:7580
- C:\Windows\System\wSCIJpl.exe
  C:\Windows\System\wSCIJpl.exe
  2⤵
  PID:7588
- C:\Windows\System\hfqHTas.exe
  C:\Windows\System\hfqHTas.exe
  2⤵
  PID:7640
- C:\Windows\System\goRrNCj.exe
  C:\Windows\System\goRrNCj.exe
  2⤵
  PID:7708
- C:\Windows\System\ClNNzOg.exe
  C:\Windows\System\ClNNzOg.exe
  2⤵
  PID:7776
- C:\Windows\System\dCnDOUT.exe
  C:\Windows\System\dCnDOUT.exe
  2⤵
  PID:7800
- C:\Windows\System\JsxShNp.exe
  C:\Windows\System\JsxShNp.exe
  2⤵
  PID:7816
- C:\Windows\System\uYBZzFh.exe
  C:\Windows\System\uYBZzFh.exe
  2⤵
  PID:7880
- C:\Windows\System\lusKxkB.exe
  C:\Windows\System\lusKxkB.exe
  2⤵
  PID:7912
- C:\Windows\System\icEDRkX.exe
  C:\Windows\System\icEDRkX.exe
  2⤵
  PID:7980
- C:\Windows\System\eaEJdrX.exe
  C:\Windows\System\eaEJdrX.exe
  2⤵
  PID:8044
- C:\Windows\System\wPWZnjS.exe
  C:\Windows\System\wPWZnjS.exe
  2⤵
  PID:8116
- C:\Windows\System\FXMsUul.exe
  C:\Windows\System\FXMsUul.exe
  2⤵
  PID:8180
- C:\Windows\System\JEVLaxc.exe
  C:\Windows\System\JEVLaxc.exe
  2⤵
  PID:7896
- C:\Windows\System\MdUzyFq.exe
  C:\Windows\System\MdUzyFq.exe
  2⤵
  PID:8168
- C:\Windows\System\pLuvijt.exe
  C:\Windows\System\pLuvijt.exe
  2⤵
  PID:7964
- C:\Windows\System\nzOGMeF.exe
  C:\Windows\System\nzOGMeF.exe
  2⤵
  PID:8032
- C:\Windows\System\rkZviTd.exe
  C:\Windows\System\rkZviTd.exe
  2⤵
  PID:8132
- C:\Windows\System\viJnBJd.exe
  C:\Windows\System\viJnBJd.exe
  2⤵
  PID:6272
- C:\Windows\System\EWfCQJy.exe
  C:\Windows\System\EWfCQJy.exe
  2⤵
  PID:7028
- C:\Windows\System\QowytUi.exe
  C:\Windows\System\QowytUi.exe
  2⤵
  PID:6128
- C:\Windows\System\ZzsHxGe.exe
  C:\Windows\System\ZzsHxGe.exe
  2⤵
  PID:7376
- C:\Windows\System\PHbdRYj.exe
  C:\Windows\System\PHbdRYj.exe
  2⤵
  PID:7460
- C:\Windows\System\IBrrADG.exe
  C:\Windows\System\IBrrADG.exe
  2⤵
  PID:7540
- C:\Windows\System\IzUJTGP.exe
  C:\Windows\System\IzUJTGP.exe
  2⤵
  PID:7548
- C:\Windows\System\WvZuWfp.exe
  C:\Windows\System\WvZuWfp.exe
  2⤵
  PID:7472
- C:\Windows\System\oYaFrCg.exe
  C:\Windows\System\oYaFrCg.exe
  2⤵
  PID:7308
- C:\Windows\System\YpnkKcw.exe
  C:\Windows\System\YpnkKcw.exe
  2⤵
  PID:7476
- C:\Windows\System\WIXrAnn.exe
  C:\Windows\System\WIXrAnn.exe
  2⤵
  PID:7656
- C:\Windows\System\TPkmtIe.exe
  C:\Windows\System\TPkmtIe.exe
  2⤵
  PID:7764
- C:\Windows\System\AEhEawY.exe
  C:\Windows\System\AEhEawY.exe
  2⤵
  PID:7676
- C:\Windows\System\QILSfYv.exe
  C:\Windows\System\QILSfYv.exe
  2⤵
  PID:7848
- C:\Windows\System\QzYwqwN.exe
  C:\Windows\System\QzYwqwN.exe
  2⤵
  PID:7744
- C:\Windows\System\SEVcyBB.exe
  C:\Windows\System\SEVcyBB.exe
  2⤵
  PID:7908
- C:\Windows\System\QDCmgmx.exe
  C:\Windows\System\QDCmgmx.exe
  2⤵
  PID:7596
- C:\Windows\System\oUOdfzF.exe
  C:\Windows\System\oUOdfzF.exe
  2⤵
  PID:8100
- C:\Windows\System\rbABpKW.exe
  C:\Windows\System\rbABpKW.exe
  2⤵
  PID:7860
- C:\Windows\System\DvrJwWG.exe
  C:\Windows\System\DvrJwWG.exe
  2⤵
  PID:8012
- C:\Windows\System\WuyIFnK.exe
  C:\Windows\System\WuyIFnK.exe
  2⤵
  PID:7340
- C:\Windows\System\oojHzAh.exe
  C:\Windows\System\oojHzAh.exe
  2⤵
  PID:8072
- C:\Windows\System\WCnLOkd.exe
  C:\Windows\System\WCnLOkd.exe
  2⤵
  PID:7692
- C:\Windows\System\ZGnLtwq.exe
  C:\Windows\System\ZGnLtwq.exe
  2⤵
  PID:8152
- C:\Windows\System\fZrNBfH.exe
  C:\Windows\System\fZrNBfH.exe
  2⤵
  PID:8164
- C:\Windows\System\pOTspvP.exe
  C:\Windows\System\pOTspvP.exe
  2⤵
  PID:8084
- C:\Windows\System\NofKGUS.exe
  C:\Windows\System\NofKGUS.exe
  2⤵
  PID:7924
- C:\Windows\System\DYLYHIy.exe
  C:\Windows\System\DYLYHIy.exe
  2⤵
  PID:7976
- C:\Windows\System\nHCtnqX.exe
  C:\Windows\System\nHCtnqX.exe
  2⤵
  PID:7356
- C:\Windows\System\VswnGak.exe
  C:\Windows\System\VswnGak.exe
  2⤵
  PID:7864
- C:\Windows\System\EdaTFVb.exe
  C:\Windows\System\EdaTFVb.exe
  2⤵
  PID:6252
- C:\Windows\System\AqSFtZE.exe
  C:\Windows\System\AqSFtZE.exe
  2⤵
  PID:7812
- C:\Windows\System\YLJYIQK.exe
  C:\Windows\System\YLJYIQK.exe
  2⤵
  PID:7928
- C:\Windows\System\eMzVRNT.exe
  C:\Windows\System\eMzVRNT.exe
  2⤵
  PID:8148
- C:\Windows\System\nJtknoG.exe
  C:\Windows\System\nJtknoG.exe
  2⤵
  PID:8196
- C:\Windows\System\dTPFkZW.exe
  C:\Windows\System\dTPFkZW.exe
  2⤵
  PID:8212
- C:\Windows\System\yRSVDPj.exe
  C:\Windows\System\yRSVDPj.exe
  2⤵
  PID:8228
- C:\Windows\System\ftNDoDM.exe
  C:\Windows\System\ftNDoDM.exe
  2⤵
  PID:8244
- C:\Windows\System\WrRyEYN.exe
  C:\Windows\System\WrRyEYN.exe
  2⤵
  PID:8260
- C:\Windows\System\uhIwfpq.exe
  C:\Windows\System\uhIwfpq.exe
  2⤵
  PID:8276
- C:\Windows\System\mlfLjPs.exe
  C:\Windows\System\mlfLjPs.exe
  2⤵
  PID:8292
- C:\Windows\System\XsbnSSV.exe
  C:\Windows\System\XsbnSSV.exe
  2⤵
  PID:8308
- C:\Windows\System\NTcZFdn.exe
  C:\Windows\System\NTcZFdn.exe
  2⤵
  PID:8324
- C:\Windows\System\AFYZEGo.exe
  C:\Windows\System\AFYZEGo.exe
  2⤵
  PID:8340
- C:\Windows\System\qkmaWVF.exe
  C:\Windows\System\qkmaWVF.exe
  2⤵
  PID:8356
- C:\Windows\System\Zqiirvf.exe
  C:\Windows\System\Zqiirvf.exe
  2⤵
  PID:8372
- C:\Windows\System\FydDRed.exe
  C:\Windows\System\FydDRed.exe
  2⤵
  PID:8388
- C:\Windows\System\aHpcUKZ.exe
  C:\Windows\System\aHpcUKZ.exe
  2⤵
  PID:8404
- C:\Windows\System\PPyWZWQ.exe
  C:\Windows\System\PPyWZWQ.exe
  2⤵
  PID:8420
- C:\Windows\System\FBwocBw.exe
  C:\Windows\System\FBwocBw.exe
  2⤵
  PID:8436
- C:\Windows\System\OhxDISz.exe
  C:\Windows\System\OhxDISz.exe
  2⤵
  PID:8452
- C:\Windows\System\NHFfsIv.exe
  C:\Windows\System\NHFfsIv.exe
  2⤵
  PID:8476
- C:\Windows\System\hMAimpX.exe
  C:\Windows\System\hMAimpX.exe
  2⤵
  PID:8492
- C:\Windows\System\IuIuqOg.exe
  C:\Windows\System\IuIuqOg.exe
  2⤵
  PID:8508
- C:\Windows\System\jlcXpAh.exe
  C:\Windows\System\jlcXpAh.exe
  2⤵
  PID:8524
- C:\Windows\System\PRIBPte.exe
  C:\Windows\System\PRIBPte.exe
  2⤵
  PID:8540
- C:\Windows\System\XtPzpUe.exe
  C:\Windows\System\XtPzpUe.exe
  2⤵
  PID:8556
- C:\Windows\System\aIljRHY.exe
  C:\Windows\System\aIljRHY.exe
  2⤵
  PID:8572
- C:\Windows\System\aQOzpdV.exe
  C:\Windows\System\aQOzpdV.exe
  2⤵
  PID:8588
- C:\Windows\System\TFYSdvC.exe
  C:\Windows\System\TFYSdvC.exe
  2⤵
  PID:8604
- C:\Windows\System\GBbFWIJ.exe
  C:\Windows\System\GBbFWIJ.exe
  2⤵
  PID:8620
- C:\Windows\System\CmGGYnx.exe
  C:\Windows\System\CmGGYnx.exe
  2⤵
  PID:8636
- C:\Windows\System\AUbamFg.exe
  C:\Windows\System\AUbamFg.exe
  2⤵
  PID:8652
- C:\Windows\System\JZjxUal.exe
  C:\Windows\System\JZjxUal.exe
  2⤵
  PID:8668
- C:\Windows\System\jSmEcSU.exe
  C:\Windows\System\jSmEcSU.exe
  2⤵
  PID:8684
- C:\Windows\System\KXpPBMY.exe
  C:\Windows\System\KXpPBMY.exe
  2⤵
  PID:8700
- C:\Windows\System\jrgkJPg.exe
  C:\Windows\System\jrgkJPg.exe
  2⤵
  PID:8716
- C:\Windows\System\TMqdLSZ.exe
  C:\Windows\System\TMqdLSZ.exe
  2⤵
  PID:8732
- C:\Windows\System\OoIUNhZ.exe
  C:\Windows\System\OoIUNhZ.exe
  2⤵
  PID:8748
- C:\Windows\System\flRSHNe.exe
  C:\Windows\System\flRSHNe.exe
  2⤵
  PID:8764
- C:\Windows\System\AUVxYjm.exe
  C:\Windows\System\AUVxYjm.exe
  2⤵
  PID:8780
- C:\Windows\System\MysDTOh.exe
  C:\Windows\System\MysDTOh.exe
  2⤵
  PID:8796
- C:\Windows\System\ABjOFKo.exe
  C:\Windows\System\ABjOFKo.exe
  2⤵
  PID:8812
- C:\Windows\System\VAUhKSS.exe
  C:\Windows\System\VAUhKSS.exe
  2⤵
  PID:8828
- C:\Windows\System\onQtYIn.exe
  C:\Windows\System\onQtYIn.exe
  2⤵
  PID:8844
- C:\Windows\System\klfssTP.exe
  C:\Windows\System\klfssTP.exe
  2⤵
  PID:8860
- C:\Windows\System\iCrMRtV.exe
  C:\Windows\System\iCrMRtV.exe
  2⤵
  PID:8880
- C:\Windows\System\dPiaIuk.exe
  C:\Windows\System\dPiaIuk.exe
  2⤵
  PID:8896
- C:\Windows\System\asVKIga.exe
  C:\Windows\System\asVKIga.exe
  2⤵
  PID:8912
- C:\Windows\System\BsDqQTd.exe
  C:\Windows\System\BsDqQTd.exe
  2⤵
  PID:8928
- C:\Windows\System\APGkBHO.exe
  C:\Windows\System\APGkBHO.exe
  2⤵
  PID:8948
- C:\Windows\System\gTdgdXe.exe
  C:\Windows\System\gTdgdXe.exe
  2⤵
  PID:8964
- C:\Windows\System\tyeygyR.exe
  C:\Windows\System\tyeygyR.exe
  2⤵
  PID:8980
- C:\Windows\System\MaGWblp.exe
  C:\Windows\System\MaGWblp.exe
  2⤵
  PID:8996
- C:\Windows\System\WxXWhkP.exe
  C:\Windows\System\WxXWhkP.exe
  2⤵
  PID:9012
- C:\Windows\System\dTacTPh.exe
  C:\Windows\System\dTacTPh.exe
  2⤵
  PID:9028
- C:\Windows\System\rXyHCCx.exe
  C:\Windows\System\rXyHCCx.exe
  2⤵
  PID:9044
- C:\Windows\System\OhTBQzu.exe
  C:\Windows\System\OhTBQzu.exe
  2⤵
  PID:9064
- C:\Windows\System\ROLruHd.exe
  C:\Windows\System\ROLruHd.exe
  2⤵
  PID:9080
- C:\Windows\System\wZqbtGe.exe
  C:\Windows\System\wZqbtGe.exe
  2⤵
  PID:9096
- C:\Windows\System\iWRtIZq.exe
  C:\Windows\System\iWRtIZq.exe
  2⤵
  PID:9112
- C:\Windows\System\glcGqjB.exe
  C:\Windows\System\glcGqjB.exe
  2⤵
  PID:9128
- C:\Windows\System\lYluLnv.exe
  C:\Windows\System\lYluLnv.exe
  2⤵
  PID:9144
- C:\Windows\System\MeLPumI.exe
  C:\Windows\System\MeLPumI.exe
  2⤵
  PID:9164
- C:\Windows\System\JIZokzk.exe
  C:\Windows\System\JIZokzk.exe
  2⤵
  PID:9180
- C:\Windows\System\rOWNtMQ.exe
  C:\Windows\System\rOWNtMQ.exe
  2⤵
  PID:9196
- C:\Windows\System\bYhwyfi.exe
  C:\Windows\System\bYhwyfi.exe
  2⤵
  PID:9212
- C:\Windows\System\mdssWNl.exe
  C:\Windows\System\mdssWNl.exe
  2⤵
  PID:7536
- C:\Windows\System\LjiUTIQ.exe
  C:\Windows\System\LjiUTIQ.exe
  2⤵
  PID:8272
- C:\Windows\System\DSFsfhf.exe
  C:\Windows\System\DSFsfhf.exe
  2⤵
  PID:8224
- C:\Windows\System\TVRxWlp.exe
  C:\Windows\System\TVRxWlp.exe
  2⤵
  PID:7480
- C:\Windows\System\NRcyjNF.exe
  C:\Windows\System\NRcyjNF.exe
  2⤵
  PID:6428
- C:\Windows\System\UJNdBng.exe
  C:\Windows\System\UJNdBng.exe
  2⤵
  PID:7344
- C:\Windows\System\UNUpsGj.exe
  C:\Windows\System\UNUpsGj.exe
  2⤵
  PID:7324
- C:\Windows\System\yJhdSKZ.exe
  C:\Windows\System\yJhdSKZ.exe
  2⤵
  PID:8316
- C:\Windows\System\ZhNOEAp.exe
  C:\Windows\System\ZhNOEAp.exe
  2⤵
  PID:8368
- C:\Windows\System\bfVbGAI.exe
  C:\Windows\System\bfVbGAI.exe
  2⤵
  PID:8428
- C:\Windows\System\rHXqzXC.exe
  C:\Windows\System\rHXqzXC.exe
  2⤵
  PID:8464
- C:\Windows\System\cbsONwz.exe
  C:\Windows\System\cbsONwz.exe
  2⤵
  PID:8448
- C:\Windows\System\gdmvuIw.exe
  C:\Windows\System\gdmvuIw.exe
  2⤵
  PID:8564
- C:\Windows\System\XxYttVH.exe
  C:\Windows\System\XxYttVH.exe
  2⤵
  PID:8628
- C:\Windows\System\jylFMUM.exe
  C:\Windows\System\jylFMUM.exe
  2⤵
  PID:8692
- C:\Windows\System\zfJvaYd.exe
  C:\Windows\System\zfJvaYd.exe
  2⤵
  PID:8584
- C:\Windows\System\gAdiCiJ.exe
  C:\Windows\System\gAdiCiJ.exe
  2⤵
  PID:8820
- C:\Windows\System\WnERhqR.exe
  C:\Windows\System\WnERhqR.exe
  2⤵
  PID:8680
- C:\Windows\System\zsFiZeY.exe
  C:\Windows\System\zsFiZeY.exe
  2⤵
  PID:8876
- C:\Windows\System\PPHfVnX.exe
  C:\Windows\System\PPHfVnX.exe
  2⤵
  PID:8956
- C:\Windows\System\gDMaDvU.exe
  C:\Windows\System\gDMaDvU.exe
  2⤵
  PID:9020
- C:\Windows\System\mGiulmp.exe
  C:\Windows\System\mGiulmp.exe
  2⤵
  PID:8936
- C:\Windows\System\sFNfGGG.exe
  C:\Windows\System\sFNfGGG.exe
  2⤵
  PID:9088
- C:\Windows\System\NwEtMsm.exe
  C:\Windows\System\NwEtMsm.exe
  2⤵
  PID:9124
- C:\Windows\System\dtazntG.exe
  C:\Windows\System\dtazntG.exe
  2⤵
  PID:9156
- C:\Windows\System\jfEyfwm.exe
  C:\Windows\System\jfEyfwm.exe
  2⤵
  PID:9104
- C:\Windows\System\SKEbzcl.exe
  C:\Windows\System\SKEbzcl.exe
  2⤵
  PID:8236
- C:\Windows\System\DAmCCUy.exe
  C:\Windows\System\DAmCCUy.exe
  2⤵
  PID:8220
- C:\Windows\System\OfaTkUQ.exe
  C:\Windows\System\OfaTkUQ.exe
  2⤵
  PID:9172
- C:\Windows\System\lBPRffC.exe
  C:\Windows\System\lBPRffC.exe
  2⤵
  PID:9204
- C:\Windows\System\yBgPahl.exe
  C:\Windows\System\yBgPahl.exe
  2⤵
  PID:8064
- C:\Windows\System\pgKrCiv.exe
  C:\Windows\System\pgKrCiv.exe
  2⤵
  PID:8348
- C:\Windows\System\xNNxSEq.exe
  C:\Windows\System\xNNxSEq.exe
  2⤵
  PID:8412
- C:\Windows\System\gogOzbh.exe
  C:\Windows\System\gogOzbh.exe
  2⤵
  PID:8500
- C:\Windows\System\yVBFoqz.exe
  C:\Windows\System\yVBFoqz.exe
  2⤵
  PID:8256
- C:\Windows\System\IHtCewe.exe
  C:\Windows\System\IHtCewe.exe
  2⤵
  PID:8536
- C:\Windows\System\UjgRmNw.exe
  C:\Windows\System\UjgRmNw.exe
  2⤵
  PID:8596
- C:\Windows\System\CdwWRXl.exe
  C:\Windows\System\CdwWRXl.exe
  2⤵
  PID:8696
- C:\Windows\System\OQrUaRj.exe
  C:\Windows\System\OQrUaRj.exe
  2⤵
  PID:8728
- C:\Windows\System\FvRAiln.exe
  C:\Windows\System\FvRAiln.exe
  2⤵
  PID:8648
- C:\Windows\System\kvuMSbM.exe
  C:\Windows\System\kvuMSbM.exe
  2⤵
  PID:8788
- C:\Windows\System\yDljixy.exe
  C:\Windows\System\yDljixy.exe
  2⤵
  PID:8888
- C:\Windows\System\xfofjul.exe
  C:\Windows\System\xfofjul.exe
  2⤵
  PID:8836
- C:\Windows\System\ITdopyE.exe
  C:\Windows\System\ITdopyE.exe
  2⤵
  PID:8772
- C:\Windows\System\NmgatjX.exe
  C:\Windows\System\NmgatjX.exe
  2⤵
  PID:8840
- C:\Windows\System\gRFJtCi.exe
  C:\Windows\System\gRFJtCi.exe
  2⤵
  PID:9052
- C:\Windows\System\UbwcGlu.exe
  C:\Windows\System\UbwcGlu.exe
  2⤵
  PID:8944
- C:\Windows\System\yAgISzO.exe
  C:\Windows\System\yAgISzO.exe
  2⤵
  PID:9056
- C:\Windows\System\ZVJhiqX.exe
  C:\Windows\System\ZVJhiqX.exe
  2⤵
  PID:9140
- C:\Windows\System\OYIpsvh.exe
  C:\Windows\System\OYIpsvh.exe
  2⤵
  PID:9192
- C:\Windows\System\qiDqqPU.exe
  C:\Windows\System\qiDqqPU.exe
  2⤵
  PID:9136
- C:\Windows\System\SHIMKlD.exe
  C:\Windows\System\SHIMKlD.exe
  2⤵
  PID:8432
- C:\Windows\System\ChGcYGy.exe
  C:\Windows\System\ChGcYGy.exe
  2⤵
  PID:8252
- C:\Windows\System\sjUkVyR.exe
  C:\Windows\System\sjUkVyR.exe
  2⤵
  PID:8664
- C:\Windows\System\OOgaHqP.exe
  C:\Windows\System\OOgaHqP.exe
  2⤵
  PID:8444
- C:\Windows\System\LsFiPnm.exe
  C:\Windows\System\LsFiPnm.exe
  2⤵
  PID:8892
- C:\Windows\System\DYETosG.exe
  C:\Windows\System\DYETosG.exe
  2⤵
  PID:8988
- C:\Windows\System\uWroSSE.exe
  C:\Windows\System\uWroSSE.exe
  2⤵
  PID:8612
- C:\Windows\System\WDcGDdT.exe
  C:\Windows\System\WDcGDdT.exe
  2⤵
  PID:7224
- C:\Windows\System\JIMrItu.exe
  C:\Windows\System\JIMrItu.exe
  2⤵
  PID:8924
- C:\Windows\System\iTtWIvS.exe
  C:\Windows\System\iTtWIvS.exe
  2⤵
  PID:8872
- C:\Windows\System\fUSXDos.exe
  C:\Windows\System\fUSXDos.exe
  2⤵
  PID:7212
- C:\Windows\System\WdxNyIe.exe
  C:\Windows\System\WdxNyIe.exe
  2⤵
  PID:9232
- C:\Windows\System\mSsSjAN.exe
  C:\Windows\System\mSsSjAN.exe
  2⤵
  PID:9248
- C:\Windows\System\czPKvzb.exe
  C:\Windows\System\czPKvzb.exe
  2⤵
  PID:9264
- C:\Windows\System\yfcMHIH.exe
  C:\Windows\System\yfcMHIH.exe
  2⤵
  PID:9280
- C:\Windows\System\OGewicP.exe
  C:\Windows\System\OGewicP.exe
  2⤵
  PID:9296
- C:\Windows\System\jrghxkE.exe
  C:\Windows\System\jrghxkE.exe
  2⤵
  PID:9312
- C:\Windows\System\qAaBQuI.exe
  C:\Windows\System\qAaBQuI.exe
  2⤵
  PID:9328
- C:\Windows\System\UzTUJoj.exe
  C:\Windows\System\UzTUJoj.exe
  2⤵
  PID:9344
- C:\Windows\System\NwbOfIy.exe
  C:\Windows\System\NwbOfIy.exe
  2⤵
  PID:9364
- C:\Windows\System\QBYQRwP.exe
  C:\Windows\System\QBYQRwP.exe
  2⤵
  PID:9380
- C:\Windows\System\ISQiAQh.exe
  C:\Windows\System\ISQiAQh.exe
  2⤵
  PID:9396
- C:\Windows\System\gZPtAQQ.exe
  C:\Windows\System\gZPtAQQ.exe
  2⤵
  PID:9412
- C:\Windows\System\GOnoRLv.exe
  C:\Windows\System\GOnoRLv.exe
  2⤵
  PID:9428
- C:\Windows\System\NlemlAb.exe
  C:\Windows\System\NlemlAb.exe
  2⤵
  PID:9444
- C:\Windows\System\BqXVeKS.exe
  C:\Windows\System\BqXVeKS.exe
  2⤵
  PID:9460
- C:\Windows\System\GhAaAvy.exe
  C:\Windows\System\GhAaAvy.exe
  2⤵
  PID:9476
- C:\Windows\System\AbAcivN.exe
  C:\Windows\System\AbAcivN.exe
  2⤵
  PID:9492
- C:\Windows\System\Hseielt.exe
  C:\Windows\System\Hseielt.exe
  2⤵
  PID:9508
- C:\Windows\System\IbxWyCL.exe
  C:\Windows\System\IbxWyCL.exe
  2⤵
  PID:9524
- C:\Windows\System\hYAfAIR.exe
  C:\Windows\System\hYAfAIR.exe
  2⤵
  PID:9540
- C:\Windows\System\iuneeIV.exe
  C:\Windows\System\iuneeIV.exe
  2⤵
  PID:9556
- C:\Windows\System\MAqCZwd.exe
  C:\Windows\System\MAqCZwd.exe
  2⤵
  PID:9572
- C:\Windows\System\YtvtMZH.exe
  C:\Windows\System\YtvtMZH.exe
  2⤵
  PID:9588
- C:\Windows\System\CLTCofN.exe
  C:\Windows\System\CLTCofN.exe
  2⤵
  PID:9604
- C:\Windows\System\sMRoiEV.exe
  C:\Windows\System\sMRoiEV.exe
  2⤵
  PID:9620
- C:\Windows\System\MszOrXi.exe
  C:\Windows\System\MszOrXi.exe
  2⤵
  PID:9636
- C:\Windows\System\CvlkTKk.exe
  C:\Windows\System\CvlkTKk.exe
  2⤵
  PID:9652
- C:\Windows\System\DIKZmcV.exe
  C:\Windows\System\DIKZmcV.exe
  2⤵
  PID:9668
- C:\Windows\System\mIjeITv.exe
  C:\Windows\System\mIjeITv.exe
  2⤵
  PID:9684
- C:\Windows\System\HVJCsIZ.exe
  C:\Windows\System\HVJCsIZ.exe
  2⤵
  PID:9700
- C:\Windows\System\CrnpYZF.exe
  C:\Windows\System\CrnpYZF.exe
  2⤵
  PID:9716
- C:\Windows\System\rzxgMjt.exe
  C:\Windows\System\rzxgMjt.exe
  2⤵
  PID:9732
- C:\Windows\System\ivCtOxi.exe
  C:\Windows\System\ivCtOxi.exe
  2⤵
  PID:9752
- C:\Windows\System\PubYXhD.exe
  C:\Windows\System\PubYXhD.exe
  2⤵
  PID:9768
- C:\Windows\System\BzXytAw.exe
  C:\Windows\System\BzXytAw.exe
  2⤵
  PID:9784
- C:\Windows\System\RAoAqTn.exe
  C:\Windows\System\RAoAqTn.exe
  2⤵
  PID:9800
- C:\Windows\System\CkbGETW.exe
  C:\Windows\System\CkbGETW.exe
  2⤵
  PID:9816
- C:\Windows\System\dFKsADk.exe
  C:\Windows\System\dFKsADk.exe
  2⤵
  PID:9832
- C:\Windows\System\hPnrzRV.exe
  C:\Windows\System\hPnrzRV.exe
  2⤵
  PID:9848
- C:\Windows\System\oktMMyg.exe
  C:\Windows\System\oktMMyg.exe
  2⤵
  PID:9864
- C:\Windows\System\bonchNY.exe
  C:\Windows\System\bonchNY.exe
  2⤵
  PID:9880
- C:\Windows\System\kdusCSD.exe
  C:\Windows\System\kdusCSD.exe
  2⤵
  PID:9896
- C:\Windows\System\HjnREni.exe
  C:\Windows\System\HjnREni.exe
  2⤵
  PID:9912
- C:\Windows\System\CDCBQkD.exe
  C:\Windows\System\CDCBQkD.exe
  2⤵
  PID:9928
- C:\Windows\System\rurgJDq.exe
  C:\Windows\System\rurgJDq.exe
  2⤵
  PID:9944
- C:\Windows\System\sijwSBk.exe
  C:\Windows\System\sijwSBk.exe
  2⤵
  PID:9960
- C:\Windows\System\wOeRoeY.exe
  C:\Windows\System\wOeRoeY.exe
  2⤵
  PID:9976
- C:\Windows\System\IHiSVHH.exe
  C:\Windows\System\IHiSVHH.exe
  2⤵
  PID:9996
- C:\Windows\System\mzWOaYW.exe
  C:\Windows\System\mzWOaYW.exe
  2⤵
  PID:10012
- C:\Windows\System\NZQVCxK.exe
  C:\Windows\System\NZQVCxK.exe
  2⤵
  PID:10028
- C:\Windows\System\slAULLU.exe
  C:\Windows\System\slAULLU.exe
  2⤵
  PID:10044
- C:\Windows\System\GYSBZgw.exe
  C:\Windows\System\GYSBZgw.exe
  2⤵
  PID:10060
- C:\Windows\System\RiqGkYD.exe
  C:\Windows\System\RiqGkYD.exe
  2⤵
  PID:10076
- C:\Windows\System\RoBKpvE.exe
  C:\Windows\System\RoBKpvE.exe
  2⤵
  PID:10092
- C:\Windows\System\pJlfSeW.exe
  C:\Windows\System\pJlfSeW.exe
  2⤵
  PID:10108
- C:\Windows\System\TBDrMoR.exe
  C:\Windows\System\TBDrMoR.exe
  2⤵
  PID:10124
- C:\Windows\System\ufIUQnj.exe
  C:\Windows\System\ufIUQnj.exe
  2⤵
  PID:10140
- C:\Windows\System\TmFgnJw.exe
  C:\Windows\System\TmFgnJw.exe
  2⤵
  PID:10156
- C:\Windows\System\cglCaoe.exe
  C:\Windows\System\cglCaoe.exe
  2⤵
  PID:10172
- C:\Windows\System\mFuWWRp.exe
  C:\Windows\System\mFuWWRp.exe
  2⤵
  PID:10188
- C:\Windows\System\QxavgqW.exe
  C:\Windows\System\QxavgqW.exe
  2⤵
  PID:10204
- C:\Windows\System\VnPbqHG.exe
  C:\Windows\System\VnPbqHG.exe
  2⤵
  PID:10220
- C:\Windows\System\rqTiTJW.exe
  C:\Windows\System\rqTiTJW.exe
  2⤵
  PID:10236
- C:\Windows\System\mwlopDF.exe
  C:\Windows\System\mwlopDF.exe
  2⤵
  PID:8616
- C:\Windows\System\rjFEcEn.exe
  C:\Windows\System\rjFEcEn.exe
  2⤵
  PID:9060
- C:\Windows\System\AAFWwAg.exe
  C:\Windows\System\AAFWwAg.exe
  2⤵
  PID:8332
- C:\Windows\System\mhgRCQG.exe
  C:\Windows\System\mhgRCQG.exe
  2⤵
  PID:8808
- C:\Windows\System\MOqXRxN.exe
  C:\Windows\System\MOqXRxN.exe
  2⤵
  PID:7560
- C:\Windows\System\zecXsRg.exe
  C:\Windows\System\zecXsRg.exe
  2⤵
  PID:9288
- C:\Windows\System\txvRarS.exe
  C:\Windows\System\txvRarS.exe
  2⤵
  PID:9352
- C:\Windows\System\TCxcthO.exe
  C:\Windows\System\TCxcthO.exe
  2⤵
  PID:9420
- C:\Windows\System\BNjSQtq.exe
  C:\Windows\System\BNjSQtq.exe
  2⤵
  PID:9456
- C:\Windows\System\SGGWXKk.exe
  C:\Windows\System\SGGWXKk.exe
  2⤵
  PID:9520
- C:\Windows\System\LJCIKgl.exe
  C:\Windows\System\LJCIKgl.exe
  2⤵
  PID:9580
- C:\Windows\System\QdeLEHR.exe
  C:\Windows\System\QdeLEHR.exe
  2⤵
  PID:9308
- C:\Windows\System\oFEHXEi.exe
  C:\Windows\System\oFEHXEi.exe
  2⤵
  PID:9244
- C:\Windows\System\rFpLDNN.exe
  C:\Windows\System\rFpLDNN.exe
  2⤵
  PID:9468
- C:\Windows\System\qWAJDsV.exe
  C:\Windows\System\qWAJDsV.exe
  2⤵
  PID:9372
- C:\Windows\System\iuzOLNK.exe
  C:\Windows\System\iuzOLNK.exe
  2⤵
  PID:9472
- C:\Windows\System\vZrklrt.exe
  C:\Windows\System\vZrklrt.exe
  2⤵
  PID:9600
- C:\Windows\System\jjccUOX.exe
  C:\Windows\System\jjccUOX.exe
  2⤵
  PID:9632
- C:\Windows\System\gxpilhW.exe
  C:\Windows\System\gxpilhW.exe
  2⤵
  PID:9676
- C:\Windows\System\FmuvaEc.exe
  C:\Windows\System\FmuvaEc.exe
  2⤵
  PID:9740
- C:\Windows\System\CQhgwdD.exe
  C:\Windows\System\CQhgwdD.exe
  2⤵
  PID:9780
- C:\Windows\System\FdMbxTa.exe
  C:\Windows\System\FdMbxTa.exe
  2⤵
  PID:9844
- C:\Windows\System\VsuSeza.exe
  C:\Windows\System\VsuSeza.exe
  2⤵
  PID:9908
- C:\Windows\System\fLHFbbc.exe
  C:\Windows\System\fLHFbbc.exe
  2⤵
  PID:9972
- C:\Windows\System\bEhwmjp.exe
  C:\Windows\System\bEhwmjp.exe
  2⤵
  PID:9796
- C:\Windows\System\rORxQju.exe
  C:\Windows\System\rORxQju.exe
  2⤵
  PID:9764
- C:\Windows\System\Ihkosol.exe
  C:\Windows\System\Ihkosol.exe
  2⤵
  PID:9920
- C:\Windows\System\nNGDrpK.exe
  C:\Windows\System\nNGDrpK.exe
  2⤵
  PID:10040
- C:\Windows\System\Gpxgyxb.exe
  C:\Windows\System\Gpxgyxb.exe
  2⤵
  PID:10072
- C:\Windows\System\gPoKcJm.exe
  C:\Windows\System\gPoKcJm.exe
  2⤵
  PID:9828
- C:\Windows\System\uScKfoH.exe
  C:\Windows\System\uScKfoH.exe
  2⤵
  PID:10132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Ccysyhf.exe

Filesize
1.9MB

MD5
3ce0b6d0ea15d3e699215975604eca68

SHA1
c10664a02099d10ce37ee1e09e8d61881d7136e6

SHA256
de7b7d8636b5cd8fd87f8ebc679b9205c88bf4ddb31caaa4267d6855cc9ec503

SHA512
a9118b610b09c0c7dc336c7a631b62767a6f276c2deab07858012f923aebd62f5226d11e4eeeaba69f800ac410a1c6dff48a690d1932d9279970bc99d1925b01

Download Submit
C:\Windows\system\Dzozlzq.exe

Filesize
1.9MB

MD5
6e60a70c35c296974edbaaecb95d5600

SHA1
c57cc56c3861c5966a8c9da463226f807061836d

SHA256
7ffc8f5ed1ad125c7a520aaebe8f377faa45367ea28789afd84a267deacc6f88

SHA512
dc7337b48574217798d13c9a4cd0978abde2212747f642a602b88467716b99952e12277cf5e6c6e78797dc4d219ed97830800b2137f4a3b4041d681c7b9c46c2

Download Submit
C:\Windows\system\GHGqHZk.exe

Filesize
8B

MD5
79f78eb3a94af1e8d3383212d19c8aef

SHA1
9f73709cb44793dec13f47234f373ba5cee8938f

SHA256
cd1d915cb9f17f73bfed538bd6e9d6b103c93f2442ef26f56b842d011a521b84

SHA512
fb2cd0c974954d795632c6d8dbb6226904e8ad7b37ad59fc32f16284024887acfcac310bbfe118938eeab8ef347fbecbb02c66bc35d8f39d09bd84c9c986005d

Download Submit
C:\Windows\system\GjsIkjl.exe

Filesize
1.9MB

MD5
6fe54078f29ee7693c40f53670e061f3

SHA1
9bc80fdfd2b99b248a1e1294f5fe7b260c177345

SHA256
f731d57216810e3ffdfeee5294f9a8594c2c713c060157231e3dbdb96c37fb5f

SHA512
ee78238b1e908bea38dfa9c071600512303164c34e7f11755b878a73869d7e8ddc38203c4eeb2536a2181dd56ab3a48d924a53108bedf80aa28a85c7eee4f362

Download Submit
C:\Windows\system\GvDklzX.exe

Filesize
1.9MB

MD5
c2dece1e32d47b01876b472c8f3d65a5

SHA1
9e8618556da7b23e7c938ec7787469a9c2fcb794

SHA256
d08c2d3a889161552792747ef0541071bcf19a785ed27ac93d501e43ab319021

SHA512
187f1fb05ac43493b1116070813d5ea9f51fdeaddee2e7e08c79fc2ae9a1b9042acb28f0b11e291f12459a737a9a9b8d9ffd4e7c0076312ee46f5711b0a544db

Download Submit
C:\Windows\system\HJQCliC.exe

Filesize
1.9MB

MD5
c900405107590e571a609dda1906208d

SHA1
32c5944e3a4d513f3718f28c796c1ab21c933430

SHA256
7b9abdd0a9bb0ff4851112812f1e9bef01a9d48f40ffe2a83338903088fbe0c3

SHA512
8f9d759913711e45310bb07355758103c17dd8999308f2c9e2f5d2cd3d93115b3bd511603f27ac5e8d3b8c7e210e33a7010a6475db1077b0aeba79d42fd924ff

Download Submit
C:\Windows\system\KhKbXTw.exe

Filesize
1.9MB

MD5
ae2a939747b0eab5a5470cbbdd13189c

SHA1
eb51dc9afcd031e9a3edc0c1fa2ba7a2a10deb63

SHA256
6fb086929826832d21adb8eed7dd2830e3ab122e245b77d723606abb92df015f

SHA512
bd0c362e8ddd7e3f52cc6c41d69d76a4208a3b3a5387b9d56e17245032ca6e847ca4c376780cd0ae67da6fe6169fdd40da06a4240a3d4df8b145730a155f7995

Download Submit
C:\Windows\system\NNpRHDI.exe

Filesize
1.9MB

MD5
4738cd819ac5ce20c5e9637643193044

SHA1
c98ac4defd5d111c99967d408aa576d43157f1aa

SHA256
eeaf85fae707181a3de74a4cca8e06c8b45818783fddf6feb9415865126666a7

SHA512
515d6728a467c2b48e5d1e6ebe132a7fd864e1998ba86db88b2741f23b2ffd796a445bf3d94e56bf21091ae6e98c131de8391334d8449b55d70a93cb9b8644ce

Download Submit
C:\Windows\system\NuhWLrG.exe

Filesize
1.9MB

MD5
76896cc137a6da9f750b50c272bf5cf5

SHA1
c13bd178023233b017ba39b2b606e534c6a4dadc

SHA256
b1a727e0a569f2c6cc6c87640fb7c339c39795ce29544ed646e41deab27dc643

SHA512
54c604d73e64628a9b4142f6e48eec7adc71f4974d4fd89a59bb48f4af7ab6acf11ef2e4881ad6a79d9ccf8ce3c91122722227ea4ad485ec3af09e61eff26bf4

Download Submit
C:\Windows\system\ONYKUuL.exe

Filesize
1.9MB

MD5
0c8699156fd298c25ee5ae965a1daab5

SHA1
795270e1343e014f6db6a65d5e9d72a74c6ca048

SHA256
922bb0defdb8bc02872bcbedfc9679154ad35112b89ea953993a2a93c2d86f82

SHA512
9f31457f99bc992b02a4bc784a7774f019c8aef67c4bcbb3e659587923cca1d0b8f775ea4a18d14da9c6e135de7163fac898bdd074a54ca2fc43a6b40b06ee0f

Download Submit
C:\Windows\system\RttKwfP.exe

Filesize
1.9MB

MD5
b25122cd5c057d6530972734ae71eabc

SHA1
3d05ce40959328e6820f74fc3e34e401b1bfb080

SHA256
4fb8c70aada8fcde84f80f8fc316caf20e92af01a92ec14f9ad024a62de3d8e7

SHA512
7d5e607df2f643db4b0be70bde172515079cbea2b618301fc2b284bbc53013eb7d09b758112ecb5248af852ae1c8da36fbbf389611280c6ba39726b5570edd76

Download Submit
C:\Windows\system\Whqriee.exe

Filesize
1.9MB

MD5
e571476bbef3e6cd26512c2201634c53

SHA1
298d26304b4085f94559801d9eaac88c7fa11203

SHA256
d127bf50eebff56f11598af6ebf5e3e0c6f3bdcef5d7514fb43c922cb981c408

SHA512
cb8415bea6f70177a54967900107d606488b9793b1a84898110eec796445c40e2ad07374cd1108dee3ed57eb9245ea6f74a47d94410575a1a6f9fada2ae4ca90

Download Submit
C:\Windows\system\ZuSwRGt.exe

Filesize
1.9MB

MD5
b2af04eab0056837ed43f04278c3c449

SHA1
adfbcaa29aa98d15d03a0399de0cd8c2442df626

SHA256
d1593b0fc7cf9867952386c7b65d3710d0b55ead518ca6069926200d6316dcd5

SHA512
0fa70eaf5596bc83458b87b8719430e9429b782c0a822704b0e567a59490b745b04d0402a75733272e602fb844af7468fb88e8bb5677cc66b2b518038397978b

Download Submit
C:\Windows\system\ZxFdtad.exe

Filesize
1.9MB

MD5
fc208c9d5866c3de71fb04c7416432a7

SHA1
85f068dc5f9a2aa06db2841189405f0bb3a4e3f9

SHA256
fcb96295f34bd4322318a4c1ed8a467720ead020a0354cec67848f180b545a67

SHA512
3b30ad40c9aae8b272811d8ce1949014c453b6709aeb5e2229b95a014ff5c11baa6cc8ea7a7b676d66f723195ce5cfb7d4f8cb4491b64bcd2961e55def52be94

Download Submit
C:\Windows\system\aQLMoFC.exe

Filesize
1.9MB

MD5
73bbf84717b9b358ba4b14a285acf9c4

SHA1
ea92eae735a8c1c616cd07bdafd45aef38a5de16

SHA256
ce9655c856c0678c7af76f802fcb006eece4dfea43702bd24a810437ba23754f

SHA512
ae4152b4b965d924a75d577ecaef42cb42cc31e7cfa7c769b142886d60fd4cea6ad501ab783821b36e03926d1a951425e472147ea013b206090274002e2bb417

Download Submit
C:\Windows\system\cvYEqlM.exe

Filesize
1.9MB

MD5
2f385e980416f207cc524213f94c324e

SHA1
f305306e86e0b49ddf02d4db7f39c66fbb688a8c

SHA256
a4acb189f3f1bc4dc5be2a9892f2e9b6cae1c00c93dc0ff7e6d1c7723fef1d62

SHA512
672bff01aaa3107a450eafeca2afc4ac8b6328e02c9b50e4ea4db5f31bd0ae18602e53b7aa261300dd6826a0475268a5af6fdd1efa22e041333907b1f2f71078

Download Submit
C:\Windows\system\dusOFUG.exe

Filesize
1.9MB

MD5
cd11e045a774f84adfb15be42cd452cf

SHA1
0b049bc076daa38d865c644662dd8d7fe48ebc76

SHA256
62db24706d815bfb0f08ea38bc3434166eb2451467de5f88ccb338d4e85c0105

SHA512
f25d0274f291d0af35ba90a1cdc90d02b0ed0cc48e30bfa2a01b6f92386c036b3daed381ab27d424460f47fafe804ef53101f971c6e42633b56d22392de4de41

Download Submit
C:\Windows\system\dvXViFt.exe

Filesize
1.9MB

MD5
806a1a04dd4bc5214cb3e89e7ab7a987

SHA1
69c26e7679b0bba8329d3a347233024bf430a2a8

SHA256
cd4ced7d6a134e841c5cc2900665c64c301459f26d1b41feab401b709e3f2d84

SHA512
4f78d446910d379e18224701f42b8f20f8ad22c5772c99936fece74df32a916a28d9d1d59104eb0fc375ccf7ea90f62e4b0b7ef6f50b23c92701655ab7f7947e

Download Submit
C:\Windows\system\geJLHuo.exe

Filesize
1.9MB

MD5
00e61474b7012406c43fe4032de6a492

SHA1
567ce7ddbbb4af6d619c38f3a759d614f21ef680

SHA256
5cf76e8e611324b7b3c27528ad8fda13e5c52eb64d67eb26031b3f598a50d1c5

SHA512
0ab2aff07be4ed181d09b54cbf0829797dd164b7a616e760cd7754db45d763da8db6eb1585c947a0dd12d844960cbbfbda573b5c9e7a735d805062a57a9ab7c5

Download Submit
C:\Windows\system\imXtfVa.exe

Filesize
1.9MB

MD5
0e08e22bf4e2238f4dce2f4882e34db7

SHA1
884cc31851959b1887063c823b3fae78a325009c

SHA256
8afc3bc01f5d8586cb2d8e3aef9d955bafb9761355a5f9336bfea58466ffd266

SHA512
fca0ff86852fb95e38f2f556bcdd36209967cbc8997ec6c3e2b1c317996b940105d9db66ded9ebdde5add23296f886f54d1a08550422918cda001c4f3f63c287

Download Submit
C:\Windows\system\iwDAqYs.exe

Filesize
1.9MB

MD5
c6252a727789d27e9353a74d9379495e

SHA1
da30e4edb84e9a5e686ad914105a23cda94d8fe4

SHA256
5f4a45e01cc1d6601163dafbad845c0227653fbf7a449ce205ca7bc3a8a82e9f

SHA512
00115a8618b31637ddc4b45d00f2e25c07326acc80f6c9ca74f4ddc24b3dae321d6e5e9c48a8e9753c425880eebf8e54c734cddf6a29c48d205109ab0be144f6

Download Submit
C:\Windows\system\kuKVxAj.exe

Filesize
1.9MB

MD5
9f6dc37ea6666ec741141f2fa0e7407d

SHA1
59bf432a15f71b5d93d29f0448d4b9ff6c03d66f

SHA256
c3c55332dc08a3872e90efcfddc378fea79bffef550f764807c6ede8af13f808

SHA512
0ece714decb1a44371e6e61c71f50d285e37f0b6635ace64a5c8266795c8d6ef0f3bfb24a93515d830cc2a9dd2929cb8c4b369613b2712afbabe64f3fc32e517

Download Submit
C:\Windows\system\uIodFzV.exe

Filesize
1.9MB

MD5
051465a091bede8cffb5b05ee9c2d6e7

SHA1
1bc47be965783e77eb4db906bef4993e2989a9a7

SHA256
bc22dca19b93c24ee1bd3e10553148aec87a52fa389bb8d0ac0b3efe74455a7e

SHA512
2f01cb06e430f481aed7d03b267fbcd117cc05f549f97e62e1888bf53e2794c9b7141212b50bc58dd98cdb1cd1485009ce3c7b65bd7b39f7536f9abc0e09b114

Download Submit
C:\Windows\system\xRzpKmk.exe

Filesize
1.9MB

MD5
2cc51b2b9f409ee23fd02344855e68de

SHA1
2530a2e7ba87cc2787808dbd11df3fb5c60f135e

SHA256
047fc2f92d9457ad74f91f0aa082f57ad1b7cea559c488bd09da16a90b4c5761

SHA512
3b249056e2c0d05682ac2c3fd2228a7939cf2061da6881aaa31618b4baf1e2d738ac847857f0c3b4c31af3ddf1133068214538516de5767c9a55bd440a6e127c

Download Submit
C:\Windows\system\xVHGqcT.exe

Filesize
1.9MB

MD5
a59ea502bff3bae7ba7081cfc5b8896a

SHA1
5f15f3ac17beba82e4b1e06a91193584139c9ff0

SHA256
d136470c666a22cb93c0038dda9cb2b153f700534f52e1afe408d82a9037bde6

SHA512
f3b41103a432bee604f29a4958408a93bcb1c1b03b2386c3012d959abdf6ea1a92a643c2076948ac6933560beb4348850f7994609f73989fedd26a1ab24b1d15

Download Submit
C:\Windows\system\zezVKcq.exe

Filesize
1.9MB

MD5
4fbf5a648a76fa063be66c46c1b3a00e

SHA1
e4da7ca9bc9eb5dc9fcb426031a4782ce2f74163

SHA256
a2a805cbd7aa44f0a1972d984c4f84f62e5250fc6aec3595cbf8ff93e338e14e

SHA512
43ead7fa75c5e80f6e9aa08125125d683479277d0c019ecc62c8e346b5eacf376057bfc42626db92441be60fbe397780be90146938386123e2c188d56b933b2a

Download Submit
\Windows\system\BUTpuyj.exe

Filesize
1.9MB

MD5
f9ee6170f4ccdd4659a6d6a47c299001

SHA1
4dc0a9af46e48a643b03ed778722931ea2b55783

SHA256
35a74d3e46dbb6707a89ee68bc61980989092bb4036cee4f07b654fd9e156b03

SHA512
f1752f7b5dbfbd38a19993f78baf57af8158faa3f0b3b8e6d64f9f0c55cd934e70b62f60536e9145186a2c3712abb03a65f8c587d507c87c5c71d7f0d314e63a

Download Submit
\Windows\system\FZapidp.exe

Filesize
1.9MB

MD5
57d10a1f14a8921189d7113f4320cfab

SHA1
b89f974424f9b8b61dc6b3f2f138e4cea9665e49

SHA256
747b7e923710948b2c2166308d9c586b2f4a69c787f4796f803f945dd1b64b9e

SHA512
d4b23a3e1b99fae0e3f8fd9aaa5f4e463ab3ecb4f64f3f325c986fa273ba9ef32c631defb43faa110a65d8125a711e52680dae6c8e4e2b227d1384c71fea933f

Download Submit
\Windows\system\GLnzAya.exe

Filesize
1.9MB

MD5
b12524fd2d72f2414a22d66523fe01de

SHA1
31df648525b08e719e9b49405db069eb23f11149

SHA256
8dc36ac23db9c70e92831a2cf9c6ac6055397d83f0a7f95259763800e31f4f40

SHA512
0c918aac94dc3d87ef69dee84c357f81b7ac1f161b57752f581bff6145c0687925f44231381f4c1658fcc30ab52bffd6dc04b7b631670e42ae87c4a1c0fe9441

Download Submit
\Windows\system\YxbWJUJ.exe

Filesize
1.9MB

MD5
fe8b828f85f8563326706a26ed97989b

SHA1
7a9ae2a26dc28e3ee0f397ac616b434d1943300a

SHA256
80e2075072b352f9d6984c1f3355aec593b7c5afb569d6b3375c5b79ef416925

SHA512
29639a62cd8921bb97b6a2d189c0cd479841723b8d68672ce64823fba3390927cbc677c324a19df0bcf13d9bfbac1172d42d3986a01ee1fe9a12a70a96e67b8f

Download Submit
\Windows\system\fDfBicu.exe

Filesize
1.9MB

MD5
845c675ba041f98acd7c175b866d6ff1

SHA1
d91fe3387247321e34e4b5893b8801309c66a3b2

SHA256
4ee7cdfd236c40f71ce78030885d56b3e2747e05b95ae8f2a43598fedb9894f0

SHA512
dfa04d4ef8cf73fc598d69470d3933fc131306dbd865dd2d04b90697af10a8f475b734e020fe3fcae5328ad383243fce3301269420f19df3f618d8db2e855596

Download Submit
\Windows\system\jRrytdZ.exe

Filesize
1.9MB

MD5
9c3dad3867ca7371ee677e94842b8867

SHA1
6226d0a68e3bda50c0433a1988b172b1832827fc

SHA256
7b6fd7ee4028c03733a508206f5f04552074a19ebc595c2b957543aeaf5889f6

SHA512
616114479f558e02c638d30ea61be5a6455a6a3c4ee4d15b70d09b8281d5188fd22bbf124c522d13abe80d2bf3bcabe9b37970fbcf36a6f948388033d43f6aa7

Download Submit
\Windows\system\pySssRg.exe

Filesize
1.9MB

MD5
2afc087e9b973d8f051ff12d0f8eead9

SHA1
62e073bdc7b6757ff814b6174bcdcb8be41dd31b

SHA256
dd304e2ce7236586f316bb566400a79705aa23fa0c70c76458df7641c9dc1f58

SHA512
d406387c64b6f1cdbb63cb075a60a9d6a1cf42d60d164d7bdc6e3358dce6b8443a9712e6f16a542950ddecda54948938f77a59caf29dc50d9a0064180a7e4652

Download Submit
\Windows\system\rLFDtro.exe

Filesize
1.9MB

MD5
0ed16f60cc752c53dc9ffea1687d7898

SHA1
789acc503b61f34d13c5e075b20ebf4bcbbc69fe

SHA256
88b63a20fcdd18bb07087ddf414a9d9545cd28b0158033337302636bb890c624

SHA512
4acdb710eab1469b716d8b9218bd3465ed55ae350a60ac35edd2fc5476bf6c5d2129fd081ff36dc304cbb5f9a1237d45a203a316a1f6dab0d73f0d9983e7d5a9

Download Submit
memory/1028-135-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/1516-6548-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/1516-92-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/1580-230-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/1580-229-0x000000001B710000-0x000000001B9F2000-memory.dmp

Filesize
2.9MB

Download
memory/2604-136-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-6541-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2724-131-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2744-98-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2744-6539-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2836-6542-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-120-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2920-6538-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2920-128-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2948-6540-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-72-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-6545-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-81-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-73-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/3008-137-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/3008-85-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/3008-133-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-134-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/3008-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/3008-132-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/3008-112-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/3008-103-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-91-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/3008-0-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/3008-107-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/3008-116-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download