xmrig | 6306c75ece0a398a202032f6f569f72dc3b9018f448f7d9f7f0422970f4d4916

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
Size 3.0MB
Sample240613-psep2syflg
SHA256 6306c75ece0a398a202032f6f569f72dc3b9018f448f7d9f7f0422970f4d4916
MD5 7cc6ab9c0c75362a5d53590645abd500
SHA1 97bc5d1fb4f8de80daeb126b817524fadbde6ab6
SHA512 2be0c337b16a6c11050a8de19217d7896c4414e2e8d5e039b2360b95fd1dcba91c9a624c51538d6d8d78b023686f91988819b1aa264b4910d8c27fb91ce96bd4
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cq:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 56 IoCs

miner

resource	yara_rule
behavioral1/memory/1276-1-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	xmrig
behavioral1/files/0x000d000000012287-5.dat	xmrig
behavioral1/memory/1380-9-0x000000013F030000-0x000000013F426000-memory.dmp	xmrig
behavioral1/files/0x0037000000014335-17.dat	xmrig
behavioral1/files/0x000d00000000549e-22.dat	xmrig
behavioral1/memory/1276-23-0x0000000003600000-0x00000000039F6000-memory.dmp	xmrig
behavioral1/memory/2732-19-0x000000013FAE0000-0x000000013FED6000-memory.dmp	xmrig
behavioral1/files/0x00080000000145be-31.dat	xmrig
behavioral1/files/0x0007000000014691-36.dat	xmrig
behavioral1/files/0x000700000001471a-39.dat	xmrig
behavioral1/files/0x0006000000015b6e-51.dat	xmrig
behavioral1/files/0x0006000000015bf4-55.dat	xmrig
behavioral1/files/0x0006000000015cb8-59.dat	xmrig
behavioral1/files/0x0006000000015cc7-64.dat	xmrig
behavioral1/files/0x0006000000015cf0-76.dat	xmrig
behavioral1/memory/2960-96-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/files/0x0037000000014349-119.dat	xmrig
behavioral1/memory/2528-132-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d7b-131.dat	xmrig
behavioral1/files/0x0006000000015ce8-72.dat	xmrig
behavioral1/files/0x000600000001615c-193.dat	xmrig
behavioral1/files/0x000600000001611e-188.dat	xmrig
behavioral1/files/0x0006000000015fef-183.dat	xmrig
behavioral1/files/0x0006000000015f73-178.dat	xmrig
behavioral1/files/0x0006000000015e1d-173.dat	xmrig
behavioral1/files/0x0006000000015d9f-160.dat	xmrig
behavioral1/files/0x0006000000015d73-152.dat	xmrig
behavioral1/files/0x0006000000015d53-150.dat	xmrig
behavioral1/files/0x0006000000015d24-148.dat	xmrig
behavioral1/files/0x0006000000015dca-166.dat	xmrig
behavioral1/memory/1748-138-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d83-133.dat	xmrig
behavioral1/memory/3012-115-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/2588-113-0x000000013FF40000-0x0000000140336000-memory.dmp	xmrig
behavioral1/memory/2524-110-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/memory/2708-108-0x000000013F790000-0x000000013FB86000-memory.dmp	xmrig
behavioral1/memory/2612-90-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d90-155.dat	xmrig
behavioral1/files/0x0006000000015d08-80.dat	xmrig
behavioral1/memory/1276-129-0x000000013FE60000-0x0000000140256000-memory.dmp	xmrig
behavioral1/memory/2976-122-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d3b-95.dat	xmrig
behavioral1/files/0x0006000000015d12-85.dat	xmrig
behavioral1/files/0x0006000000015cdf-68.dat	xmrig
behavioral1/memory/1276-2814-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	xmrig
behavioral1/files/0x0007000000015693-47.dat	xmrig
behavioral1/files/0x000900000001472b-44.dat	xmrig
behavioral1/memory/2732-4722-0x000000013FAE0000-0x000000013FED6000-memory.dmp	xmrig
behavioral1/memory/2524-7948-0x000000013F860000-0x000000013FC56000-memory.dmp	xmrig
behavioral1/memory/3012-7952-0x000000013FE30000-0x0000000140226000-memory.dmp	xmrig
behavioral1/memory/2612-7961-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	xmrig
behavioral1/memory/2960-7963-0x000000013F160000-0x000000013F556000-memory.dmp	xmrig
behavioral1/memory/1748-8000-0x000000013F640000-0x000000013FA36000-memory.dmp	xmrig
behavioral1/memory/2976-7989-0x000000013F050000-0x000000013F446000-memory.dmp	xmrig
behavioral1/memory/2588-7997-0x000000013FF40000-0x0000000140336000-memory.dmp	xmrig
behavioral1/memory/2708-7992-0x000000013F790000-0x000000013FB86000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1640	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1380	BFMcyrR.exe
2732	upznrTH.exe
2888	eyopNxb.exe
2612	SLpjGBC.exe
2960	WmcAihU.exe
2708	cabFgaq.exe
2524	HidRuWA.exe
2588	dXjxrCl.exe
3012	WqRKGWa.exe
2976	FPwuiwM.exe
2528	SlPauNv.exe
1748	raVQNjc.exe
2776	MmCvuME.exe
2832	RcnEbMV.exe
2848	FFDYypm.exe
2968	xigmjOG.exe
1764	pHbEZVr.exe
2200	fHyKlrG.exe
1424	umdHwSA.exe
1680	VSujjVl.exe
1796	HFFqGAO.exe
812	lqvBqkM.exe
2204	IsNEfXG.exe
540	WdJoYVZ.exe
1592	YMoVqdw.exe
1916	kpIifEn.exe
580	SfOeKpQ.exe
1684	azaznRp.exe
340	qsufpdO.exe
2484	INkCBwW.exe
2332	FSTSdTt.exe
1728	GHtkoia.exe
1776	HoAHPvd.exe
964	JlppOWR.exe
736	biyfkWw.exe
1696	BnbyRtD.exe
1908	qZlJxlp.exe
904	lcNiYza.exe
880	qlvsRaB.exe
3040	hZRsAdR.exe
2412	xjIwHqa.exe
864	RLOytDD.exe
984	jdSgUSJ.exe
2132	mgjhxjq.exe
988	KiypyYV.exe
896	KaXuMqR.exe
1888	OIaZcWt.exe
2208	SxgzUZf.exe
308	PzJJKCs.exe
1604	faAgMMk.exe
2604	qNruPPU.exe
2660	GkkwwFq.exe
3044	GcWOJpB.exe
2548	pLZwkNK.exe
2560	cMrDTsf.exe
2440	KHbIWlN.exe
1884	IvUCRmF.exe
2824	CkwDrpR.exe
764	NWIJGQD.exe
1868	TiEHKWC.exe
2476	JtAFoWf.exe
1820	hHjprRv.exe
2984	OGYRAVl.exe
1492	wsJqTgj.exe

Loads dropped DLL 64 IoCs

pid	Process
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1276-1-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	upx
behavioral1/files/0x000d000000012287-5.dat	upx
behavioral1/memory/1380-9-0x000000013F030000-0x000000013F426000-memory.dmp	upx
behavioral1/files/0x0037000000014335-17.dat	upx
behavioral1/files/0x000d00000000549e-22.dat	upx
behavioral1/memory/1276-23-0x0000000003600000-0x00000000039F6000-memory.dmp	upx
behavioral1/memory/2732-19-0x000000013FAE0000-0x000000013FED6000-memory.dmp	upx
behavioral1/files/0x00080000000145be-31.dat	upx
behavioral1/files/0x0007000000014691-36.dat	upx
behavioral1/files/0x000700000001471a-39.dat	upx
behavioral1/files/0x0006000000015b6e-51.dat	upx
behavioral1/files/0x0006000000015bf4-55.dat	upx
behavioral1/files/0x0006000000015cb8-59.dat	upx
behavioral1/files/0x0006000000015cc7-64.dat	upx
behavioral1/files/0x0006000000015cf0-76.dat	upx
behavioral1/memory/2960-96-0x000000013F160000-0x000000013F556000-memory.dmp	upx
behavioral1/files/0x0037000000014349-119.dat	upx
behavioral1/memory/2528-132-0x000000013FE60000-0x0000000140256000-memory.dmp	upx
behavioral1/files/0x0006000000015d7b-131.dat	upx
behavioral1/files/0x0006000000015ce8-72.dat	upx
behavioral1/files/0x000600000001615c-193.dat	upx
behavioral1/files/0x000600000001611e-188.dat	upx
behavioral1/files/0x0006000000015fef-183.dat	upx
behavioral1/files/0x0006000000015f73-178.dat	upx
behavioral1/files/0x0006000000015e1d-173.dat	upx
behavioral1/files/0x0006000000015d9f-160.dat	upx
behavioral1/files/0x0006000000015d73-152.dat	upx
behavioral1/files/0x0006000000015d53-150.dat	upx
behavioral1/files/0x0006000000015d24-148.dat	upx
behavioral1/files/0x0006000000015dca-166.dat	upx
behavioral1/memory/1748-138-0x000000013F640000-0x000000013FA36000-memory.dmp	upx
behavioral1/files/0x0006000000015d83-133.dat	upx
behavioral1/memory/3012-115-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/2588-113-0x000000013FF40000-0x0000000140336000-memory.dmp	upx
behavioral1/memory/2524-110-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/memory/2708-108-0x000000013F790000-0x000000013FB86000-memory.dmp	upx
behavioral1/memory/2612-90-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx
behavioral1/files/0x0006000000015d90-155.dat	upx
behavioral1/files/0x0006000000015d08-80.dat	upx
behavioral1/memory/2976-122-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/files/0x0006000000015d3b-95.dat	upx
behavioral1/files/0x0006000000015d12-85.dat	upx
behavioral1/files/0x0006000000015cdf-68.dat	upx
behavioral1/memory/1276-2814-0x000000013F3B0000-0x000000013F7A6000-memory.dmp	upx
behavioral1/files/0x0007000000015693-47.dat	upx
behavioral1/files/0x000900000001472b-44.dat	upx
behavioral1/memory/2732-4722-0x000000013FAE0000-0x000000013FED6000-memory.dmp	upx
behavioral1/memory/2524-7948-0x000000013F860000-0x000000013FC56000-memory.dmp	upx
behavioral1/memory/3012-7952-0x000000013FE30000-0x0000000140226000-memory.dmp	upx
behavioral1/memory/2612-7961-0x000000013F6F0000-0x000000013FAE6000-memory.dmp	upx
behavioral1/memory/2960-7963-0x000000013F160000-0x000000013F556000-memory.dmp	upx
behavioral1/memory/1748-8000-0x000000013F640000-0x000000013FA36000-memory.dmp	upx
behavioral1/memory/2976-7989-0x000000013F050000-0x000000013F446000-memory.dmp	upx
behavioral1/memory/2588-7997-0x000000013FF40000-0x0000000140336000-memory.dmp	upx
behavioral1/memory/2708-7992-0x000000013F790000-0x000000013FB86000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jAhEtRA.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\BTsseJa.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\Rzgmksj.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\abCAmIV.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\vsidKJr.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\gHZMJNO.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\sjqlKIu.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\cnDmmfq.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\NaDjrOa.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\OvgThqz.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\CnTObXE.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\JElLdsH.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\aBidpYP.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\COcoGKg.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\uOZkXbR.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\lNYFCsp.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\skkdJKF.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\QIyzrVv.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\WmmKyyt.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\flOxGYa.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\lnJXtgw.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\AEzeJXH.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\Fylsmgn.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\BaFVEHO.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\luyrYbR.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\vONkWpH.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\QaORLwE.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\VVyhsFU.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\aEgrMCK.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\MibffvO.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\SNgmQde.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\CLYvfzG.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\YfbDCCI.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\gLeeYBX.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\EQAxEJM.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\JWZSRdP.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\YwndNHT.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\nukroqw.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\rJZeWfp.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\Icwdhda.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\GPjoDjf.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\TCSxEqr.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\sQwOxFF.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\RYsqnBM.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\SRBbBJk.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\mRuuWJi.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\KTIlQhA.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\YNZaUyk.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\CUWiozc.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\UQNDMkt.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\hnpunHY.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\NAVJcxE.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\vSNHZws.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\IblRvoB.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\rnnapSh.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\AiUNmlK.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\PQGshfa.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\fxTqFYp.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\IFdjCzg.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\DWaygYR.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\XvZdjBx.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\PMlpnNo.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\zaqCPAW.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
File created	C:\Windows\System\EJiORoL.exe	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1640	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
Token: SeDebugPrivilege	1640	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1640	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	29
PID 1276 wrote to memory of 1640	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	29
PID 1276 wrote to memory of 1640	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	29
PID 1276 wrote to memory of 1380	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	30
PID 1276 wrote to memory of 1380	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	30
PID 1276 wrote to memory of 1380	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	30
PID 1276 wrote to memory of 2732	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	31
PID 1276 wrote to memory of 2732	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	31
PID 1276 wrote to memory of 2732	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	31
PID 1276 wrote to memory of 2888	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	32
PID 1276 wrote to memory of 2888	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	32
PID 1276 wrote to memory of 2888	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	32
PID 1276 wrote to memory of 2612	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	33
PID 1276 wrote to memory of 2612	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	33
PID 1276 wrote to memory of 2612	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	33
PID 1276 wrote to memory of 2960	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	34
PID 1276 wrote to memory of 2960	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	34
PID 1276 wrote to memory of 2960	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	34
PID 1276 wrote to memory of 2708	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	35
PID 1276 wrote to memory of 2708	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	35
PID 1276 wrote to memory of 2708	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	35
PID 1276 wrote to memory of 2524	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	36
PID 1276 wrote to memory of 2524	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	36
PID 1276 wrote to memory of 2524	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	36
PID 1276 wrote to memory of 2588	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	37
PID 1276 wrote to memory of 2588	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	37
PID 1276 wrote to memory of 2588	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	37
PID 1276 wrote to memory of 3012	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	38
PID 1276 wrote to memory of 3012	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	38
PID 1276 wrote to memory of 3012	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	38
PID 1276 wrote to memory of 2976	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	39
PID 1276 wrote to memory of 2976	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	39
PID 1276 wrote to memory of 2976	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	39
PID 1276 wrote to memory of 2528	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	40
PID 1276 wrote to memory of 2528	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	40
PID 1276 wrote to memory of 2528	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	40
PID 1276 wrote to memory of 1748	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	41
PID 1276 wrote to memory of 1748	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	41
PID 1276 wrote to memory of 1748	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	41
PID 1276 wrote to memory of 2776	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	42
PID 1276 wrote to memory of 2776	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	42
PID 1276 wrote to memory of 2776	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	42
PID 1276 wrote to memory of 2832	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	43
PID 1276 wrote to memory of 2832	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	43
PID 1276 wrote to memory of 2832	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	43
PID 1276 wrote to memory of 2848	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	44
PID 1276 wrote to memory of 2848	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	44
PID 1276 wrote to memory of 2848	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	44
PID 1276 wrote to memory of 2968	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	45
PID 1276 wrote to memory of 2968	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	45
PID 1276 wrote to memory of 2968	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	45
PID 1276 wrote to memory of 1764	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	46
PID 1276 wrote to memory of 1764	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	46
PID 1276 wrote to memory of 1764	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	46
PID 1276 wrote to memory of 1796	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	47
PID 1276 wrote to memory of 1796	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	47
PID 1276 wrote to memory of 1796	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	47
PID 1276 wrote to memory of 2200	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	48
PID 1276 wrote to memory of 2200	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	48
PID 1276 wrote to memory of 2200	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	48
PID 1276 wrote to memory of 812	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	49
PID 1276 wrote to memory of 812	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	49
PID 1276 wrote to memory of 812	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	49
PID 1276 wrote to memory of 1424	1276	7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\7cc6ab9c0c75362a5d53590645abd500_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\System\BFMcyrR.exe
  C:\Windows\System\BFMcyrR.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\upznrTH.exe
  C:\Windows\System\upznrTH.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\eyopNxb.exe
  C:\Windows\System\eyopNxb.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\SLpjGBC.exe
  C:\Windows\System\SLpjGBC.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\WmcAihU.exe
  C:\Windows\System\WmcAihU.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\cabFgaq.exe
  C:\Windows\System\cabFgaq.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\HidRuWA.exe
  C:\Windows\System\HidRuWA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\dXjxrCl.exe
  C:\Windows\System\dXjxrCl.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\WqRKGWa.exe
  C:\Windows\System\WqRKGWa.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\FPwuiwM.exe
  C:\Windows\System\FPwuiwM.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\SlPauNv.exe
  C:\Windows\System\SlPauNv.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\raVQNjc.exe
  C:\Windows\System\raVQNjc.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\MmCvuME.exe
  C:\Windows\System\MmCvuME.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\RcnEbMV.exe
  C:\Windows\System\RcnEbMV.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\FFDYypm.exe
  C:\Windows\System\FFDYypm.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\xigmjOG.exe
  C:\Windows\System\xigmjOG.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\pHbEZVr.exe
  C:\Windows\System\pHbEZVr.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\HFFqGAO.exe
  C:\Windows\System\HFFqGAO.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fHyKlrG.exe
  C:\Windows\System\fHyKlrG.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\lqvBqkM.exe
  C:\Windows\System\lqvBqkM.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\umdHwSA.exe
  C:\Windows\System\umdHwSA.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\IsNEfXG.exe
  C:\Windows\System\IsNEfXG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\VSujjVl.exe
  C:\Windows\System\VSujjVl.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\YMoVqdw.exe
  C:\Windows\System\YMoVqdw.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\WdJoYVZ.exe
  C:\Windows\System\WdJoYVZ.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\SfOeKpQ.exe
  C:\Windows\System\SfOeKpQ.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\kpIifEn.exe
  C:\Windows\System\kpIifEn.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\azaznRp.exe
  C:\Windows\System\azaznRp.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\qsufpdO.exe
  C:\Windows\System\qsufpdO.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\INkCBwW.exe
  C:\Windows\System\INkCBwW.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\FSTSdTt.exe
  C:\Windows\System\FSTSdTt.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\GHtkoia.exe
  C:\Windows\System\GHtkoia.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\HoAHPvd.exe
  C:\Windows\System\HoAHPvd.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\JlppOWR.exe
  C:\Windows\System\JlppOWR.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\biyfkWw.exe
  C:\Windows\System\biyfkWw.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\BnbyRtD.exe
  C:\Windows\System\BnbyRtD.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\qZlJxlp.exe
  C:\Windows\System\qZlJxlp.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\lcNiYza.exe
  C:\Windows\System\lcNiYza.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\qlvsRaB.exe
  C:\Windows\System\qlvsRaB.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\hZRsAdR.exe
  C:\Windows\System\hZRsAdR.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\xjIwHqa.exe
  C:\Windows\System\xjIwHqa.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\RLOytDD.exe
  C:\Windows\System\RLOytDD.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\jdSgUSJ.exe
  C:\Windows\System\jdSgUSJ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\mgjhxjq.exe
  C:\Windows\System\mgjhxjq.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\KiypyYV.exe
  C:\Windows\System\KiypyYV.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\KaXuMqR.exe
  C:\Windows\System\KaXuMqR.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\OIaZcWt.exe
  C:\Windows\System\OIaZcWt.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\SxgzUZf.exe
  C:\Windows\System\SxgzUZf.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\PzJJKCs.exe
  C:\Windows\System\PzJJKCs.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\faAgMMk.exe
  C:\Windows\System\faAgMMk.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\qNruPPU.exe
  C:\Windows\System\qNruPPU.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\GkkwwFq.exe
  C:\Windows\System\GkkwwFq.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\GcWOJpB.exe
  C:\Windows\System\GcWOJpB.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\pLZwkNK.exe
  C:\Windows\System\pLZwkNK.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\cMrDTsf.exe
  C:\Windows\System\cMrDTsf.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\KHbIWlN.exe
  C:\Windows\System\KHbIWlN.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\IvUCRmF.exe
  C:\Windows\System\IvUCRmF.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\CkwDrpR.exe
  C:\Windows\System\CkwDrpR.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\NWIJGQD.exe
  C:\Windows\System\NWIJGQD.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\TiEHKWC.exe
  C:\Windows\System\TiEHKWC.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\JtAFoWf.exe
  C:\Windows\System\JtAFoWf.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\hHjprRv.exe
  C:\Windows\System\hHjprRv.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\OGYRAVl.exe
  C:\Windows\System\OGYRAVl.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\wsJqTgj.exe
  C:\Windows\System\wsJqTgj.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\iFFIiOY.exe
  C:\Windows\System\iFFIiOY.exe
  2⤵
  PID:552
- C:\Windows\System\jcaNrcl.exe
  C:\Windows\System\jcaNrcl.exe
  2⤵
  PID:1268
- C:\Windows\System\bBovtIi.exe
  C:\Windows\System\bBovtIi.exe
  2⤵
  PID:2316
- C:\Windows\System\lmtLIju.exe
  C:\Windows\System\lmtLIju.exe
  2⤵
  PID:2080
- C:\Windows\System\XHITJDD.exe
  C:\Windows\System\XHITJDD.exe
  2⤵
  PID:2244
- C:\Windows\System\CFItXSJ.exe
  C:\Windows\System\CFItXSJ.exe
  2⤵
  PID:448
- C:\Windows\System\FNEsavf.exe
  C:\Windows\System\FNEsavf.exe
  2⤵
  PID:1852
- C:\Windows\System\DnQrFxR.exe
  C:\Windows\System\DnQrFxR.exe
  2⤵
  PID:1800
- C:\Windows\System\ifkWxCL.exe
  C:\Windows\System\ifkWxCL.exe
  2⤵
  PID:1344
- C:\Windows\System\eXdNbis.exe
  C:\Windows\System\eXdNbis.exe
  2⤵
  PID:2924
- C:\Windows\System\qCEEHOD.exe
  C:\Windows\System\qCEEHOD.exe
  2⤵
  PID:1632
- C:\Windows\System\UYECfcG.exe
  C:\Windows\System\UYECfcG.exe
  2⤵
  PID:576
- C:\Windows\System\yFCBIfv.exe
  C:\Windows\System\yFCBIfv.exe
  2⤵
  PID:2964
- C:\Windows\System\wnhDRUV.exe
  C:\Windows\System\wnhDRUV.exe
  2⤵
  PID:1052
- C:\Windows\System\rTrSbsR.exe
  C:\Windows\System\rTrSbsR.exe
  2⤵
  PID:1624
- C:\Windows\System\IbxaQhs.exe
  C:\Windows\System\IbxaQhs.exe
  2⤵
  PID:556
- C:\Windows\System\UrOzMcf.exe
  C:\Windows\System\UrOzMcf.exe
  2⤵
  PID:1596
- C:\Windows\System\UoAOhFT.exe
  C:\Windows\System\UoAOhFT.exe
  2⤵
  PID:1580
- C:\Windows\System\eQtlVBV.exe
  C:\Windows\System\eQtlVBV.exe
  2⤵
  PID:2620
- C:\Windows\System\ILLaeIG.exe
  C:\Windows\System\ILLaeIG.exe
  2⤵
  PID:2060
- C:\Windows\System\uGcoQQR.exe
  C:\Windows\System\uGcoQQR.exe
  2⤵
  PID:2720
- C:\Windows\System\sHoTubk.exe
  C:\Windows\System\sHoTubk.exe
  2⤵
  PID:2676
- C:\Windows\System\ZGtBvqW.exe
  C:\Windows\System\ZGtBvqW.exe
  2⤵
  PID:2992
- C:\Windows\System\iZqBrYT.exe
  C:\Windows\System\iZqBrYT.exe
  2⤵
  PID:2156
- C:\Windows\System\wCrIkhL.exe
  C:\Windows\System\wCrIkhL.exe
  2⤵
  PID:2324
- C:\Windows\System\QAoebkD.exe
  C:\Windows\System\QAoebkD.exe
  2⤵
  PID:1740
- C:\Windows\System\ODrnPru.exe
  C:\Windows\System\ODrnPru.exe
  2⤵
  PID:2840
- C:\Windows\System\xZThGTn.exe
  C:\Windows\System\xZThGTn.exe
  2⤵
  PID:796
- C:\Windows\System\RHHkyNT.exe
  C:\Windows\System\RHHkyNT.exe
  2⤵
  PID:3092
- C:\Windows\System\Kxtlclf.exe
  C:\Windows\System\Kxtlclf.exe
  2⤵
  PID:3112
- C:\Windows\System\YbWiGqM.exe
  C:\Windows\System\YbWiGqM.exe
  2⤵
  PID:3132
- C:\Windows\System\TbQqyUK.exe
  C:\Windows\System\TbQqyUK.exe
  2⤵
  PID:3156
- C:\Windows\System\BhfXNEu.exe
  C:\Windows\System\BhfXNEu.exe
  2⤵
  PID:3176
- C:\Windows\System\YSyaehb.exe
  C:\Windows\System\YSyaehb.exe
  2⤵
  PID:3192
- C:\Windows\System\GrxdrEu.exe
  C:\Windows\System\GrxdrEu.exe
  2⤵
  PID:3212
- C:\Windows\System\qEFGSVB.exe
  C:\Windows\System\qEFGSVB.exe
  2⤵
  PID:3228
- C:\Windows\System\WvJSpki.exe
  C:\Windows\System\WvJSpki.exe
  2⤵
  PID:3252
- C:\Windows\System\AdPKVBr.exe
  C:\Windows\System\AdPKVBr.exe
  2⤵
  PID:3272
- C:\Windows\System\yCCpgek.exe
  C:\Windows\System\yCCpgek.exe
  2⤵
  PID:3304
- C:\Windows\System\pHBuZjU.exe
  C:\Windows\System\pHBuZjU.exe
  2⤵
  PID:3324
- C:\Windows\System\cCzuTWs.exe
  C:\Windows\System\cCzuTWs.exe
  2⤵
  PID:3340
- C:\Windows\System\iqzIwhE.exe
  C:\Windows\System\iqzIwhE.exe
  2⤵
  PID:3364
- C:\Windows\System\DBBgRxm.exe
  C:\Windows\System\DBBgRxm.exe
  2⤵
  PID:3380
- C:\Windows\System\KJVgvXQ.exe
  C:\Windows\System\KJVgvXQ.exe
  2⤵
  PID:3400
- C:\Windows\System\unhbnGL.exe
  C:\Windows\System\unhbnGL.exe
  2⤵
  PID:3416
- C:\Windows\System\sMZiqaB.exe
  C:\Windows\System\sMZiqaB.exe
  2⤵
  PID:3436
- C:\Windows\System\tesKzjv.exe
  C:\Windows\System\tesKzjv.exe
  2⤵
  PID:3464
- C:\Windows\System\dpGgqRb.exe
  C:\Windows\System\dpGgqRb.exe
  2⤵
  PID:3484
- C:\Windows\System\nfxkEjL.exe
  C:\Windows\System\nfxkEjL.exe
  2⤵
  PID:3500
- C:\Windows\System\ufVAGLN.exe
  C:\Windows\System\ufVAGLN.exe
  2⤵
  PID:3524
- C:\Windows\System\zjkhqkb.exe
  C:\Windows\System\zjkhqkb.exe
  2⤵
  PID:3540
- C:\Windows\System\Fylsmgn.exe
  C:\Windows\System\Fylsmgn.exe
  2⤵
  PID:3560
- C:\Windows\System\mpSiyLn.exe
  C:\Windows\System\mpSiyLn.exe
  2⤵
  PID:3584
- C:\Windows\System\tfpSJzA.exe
  C:\Windows\System\tfpSJzA.exe
  2⤵
  PID:3604
- C:\Windows\System\HzVzvZY.exe
  C:\Windows\System\HzVzvZY.exe
  2⤵
  PID:3624
- C:\Windows\System\JOLlmPq.exe
  C:\Windows\System\JOLlmPq.exe
  2⤵
  PID:3640
- C:\Windows\System\IeaDKeA.exe
  C:\Windows\System\IeaDKeA.exe
  2⤵
  PID:3660
- C:\Windows\System\gtHdxZW.exe
  C:\Windows\System\gtHdxZW.exe
  2⤵
  PID:3680
- C:\Windows\System\XHPZuQY.exe
  C:\Windows\System\XHPZuQY.exe
  2⤵
  PID:3704
- C:\Windows\System\GjNmtsR.exe
  C:\Windows\System\GjNmtsR.exe
  2⤵
  PID:3720
- C:\Windows\System\imXLEls.exe
  C:\Windows\System\imXLEls.exe
  2⤵
  PID:3744
- C:\Windows\System\GZPtmaV.exe
  C:\Windows\System\GZPtmaV.exe
  2⤵
  PID:3760
- C:\Windows\System\zjUcrmj.exe
  C:\Windows\System\zjUcrmj.exe
  2⤵
  PID:3780
- C:\Windows\System\pLCqmrB.exe
  C:\Windows\System\pLCqmrB.exe
  2⤵
  PID:3800
- C:\Windows\System\RvVLGFY.exe
  C:\Windows\System\RvVLGFY.exe
  2⤵
  PID:3824
- C:\Windows\System\Mymeaqe.exe
  C:\Windows\System\Mymeaqe.exe
  2⤵
  PID:3844
- C:\Windows\System\Qjitztw.exe
  C:\Windows\System\Qjitztw.exe
  2⤵
  PID:3864
- C:\Windows\System\XsNafCn.exe
  C:\Windows\System\XsNafCn.exe
  2⤵
  PID:3884
- C:\Windows\System\jctfqnF.exe
  C:\Windows\System\jctfqnF.exe
  2⤵
  PID:3904
- C:\Windows\System\ePPYKKl.exe
  C:\Windows\System\ePPYKKl.exe
  2⤵
  PID:3920
- C:\Windows\System\QFPGBPn.exe
  C:\Windows\System\QFPGBPn.exe
  2⤵
  PID:3940
- C:\Windows\System\YMXyNZP.exe
  C:\Windows\System\YMXyNZP.exe
  2⤵
  PID:3960
- C:\Windows\System\fhPJRWF.exe
  C:\Windows\System\fhPJRWF.exe
  2⤵
  PID:3980
- C:\Windows\System\KmOtrpW.exe
  C:\Windows\System\KmOtrpW.exe
  2⤵
  PID:4000
- C:\Windows\System\rnnapSh.exe
  C:\Windows\System\rnnapSh.exe
  2⤵
  PID:4020
- C:\Windows\System\MTyvMRo.exe
  C:\Windows\System\MTyvMRo.exe
  2⤵
  PID:4040
- C:\Windows\System\FozUtEo.exe
  C:\Windows\System\FozUtEo.exe
  2⤵
  PID:4064
- C:\Windows\System\qoelHoV.exe
  C:\Windows\System\qoelHoV.exe
  2⤵
  PID:4084
- C:\Windows\System\aCnhUTJ.exe
  C:\Windows\System\aCnhUTJ.exe
  2⤵
  PID:1660
- C:\Windows\System\WgTuXSR.exe
  C:\Windows\System\WgTuXSR.exe
  2⤵
  PID:1188
- C:\Windows\System\EXrEMLs.exe
  C:\Windows\System\EXrEMLs.exe
  2⤵
  PID:1876
- C:\Windows\System\xzoXqrr.exe
  C:\Windows\System\xzoXqrr.exe
  2⤵
  PID:1152
- C:\Windows\System\tIdAzgc.exe
  C:\Windows\System\tIdAzgc.exe
  2⤵
  PID:772
- C:\Windows\System\RKqKPAN.exe
  C:\Windows\System\RKqKPAN.exe
  2⤵
  PID:2348
- C:\Windows\System\RbAWXrR.exe
  C:\Windows\System\RbAWXrR.exe
  2⤵
  PID:1864
- C:\Windows\System\ZgBAdPM.exe
  C:\Windows\System\ZgBAdPM.exe
  2⤵
  PID:2460
- C:\Windows\System\LXrTjoH.exe
  C:\Windows\System\LXrTjoH.exe
  2⤵
  PID:2232
- C:\Windows\System\YdUzadk.exe
  C:\Windows\System\YdUzadk.exe
  2⤵
  PID:1520
- C:\Windows\System\skZHxiT.exe
  C:\Windows\System\skZHxiT.exe
  2⤵
  PID:884
- C:\Windows\System\yobySgh.exe
  C:\Windows\System\yobySgh.exe
  2⤵
  PID:2300
- C:\Windows\System\zgLtNsN.exe
  C:\Windows\System\zgLtNsN.exe
  2⤵
  PID:876
- C:\Windows\System\XNYRQQD.exe
  C:\Windows\System\XNYRQQD.exe
  2⤵
  PID:3108
- C:\Windows\System\sdoSZic.exe
  C:\Windows\System\sdoSZic.exe
  2⤵
  PID:2384
- C:\Windows\System\KChaXVx.exe
  C:\Windows\System\KChaXVx.exe
  2⤵
  PID:3184
- C:\Windows\System\iuvQvNk.exe
  C:\Windows\System\iuvQvNk.exe
  2⤵
  PID:2844
- C:\Windows\System\pmZQbVB.exe
  C:\Windows\System\pmZQbVB.exe
  2⤵
  PID:3084
- C:\Windows\System\hrQVXUZ.exe
  C:\Windows\System\hrQVXUZ.exe
  2⤵
  PID:3260
- C:\Windows\System\vypcDaA.exe
  C:\Windows\System\vypcDaA.exe
  2⤵
  PID:3128
- C:\Windows\System\efdAIEU.exe
  C:\Windows\System\efdAIEU.exe
  2⤵
  PID:3240
- C:\Windows\System\sWSgGFN.exe
  C:\Windows\System\sWSgGFN.exe
  2⤵
  PID:3168
- C:\Windows\System\aQvZjcJ.exe
  C:\Windows\System\aQvZjcJ.exe
  2⤵
  PID:3312
- C:\Windows\System\VzMYbyR.exe
  C:\Windows\System\VzMYbyR.exe
  2⤵
  PID:3348
- C:\Windows\System\NmRkwON.exe
  C:\Windows\System\NmRkwON.exe
  2⤵
  PID:3388
- C:\Windows\System\pNKlpOm.exe
  C:\Windows\System\pNKlpOm.exe
  2⤵
  PID:3428
- C:\Windows\System\kLxyPNX.exe
  C:\Windows\System\kLxyPNX.exe
  2⤵
  PID:3476
- C:\Windows\System\fVKiolw.exe
  C:\Windows\System\fVKiolw.exe
  2⤵
  PID:3516
- C:\Windows\System\oKkFFNS.exe
  C:\Windows\System\oKkFFNS.exe
  2⤵
  PID:3452
- C:\Windows\System\xPqyIwy.exe
  C:\Windows\System\xPqyIwy.exe
  2⤵
  PID:3460
- C:\Windows\System\DrJybqc.exe
  C:\Windows\System\DrJybqc.exe
  2⤵
  PID:3592
- C:\Windows\System\xcSukum.exe
  C:\Windows\System\xcSukum.exe
  2⤵
  PID:3532
- C:\Windows\System\iaZFmkp.exe
  C:\Windows\System\iaZFmkp.exe
  2⤵
  PID:3668
- C:\Windows\System\gCAnyHa.exe
  C:\Windows\System\gCAnyHa.exe
  2⤵
  PID:3716
- C:\Windows\System\kxAlGji.exe
  C:\Windows\System\kxAlGji.exe
  2⤵
  PID:3656
- C:\Windows\System\VHsFqMV.exe
  C:\Windows\System\VHsFqMV.exe
  2⤵
  PID:3620
- C:\Windows\System\JBGwIad.exe
  C:\Windows\System\JBGwIad.exe
  2⤵
  PID:3700
- C:\Windows\System\juOfdeF.exe
  C:\Windows\System\juOfdeF.exe
  2⤵
  PID:3740
- C:\Windows\System\lIfGmzF.exe
  C:\Windows\System\lIfGmzF.exe
  2⤵
  PID:3872
- C:\Windows\System\sFYjqAi.exe
  C:\Windows\System\sFYjqAi.exe
  2⤵
  PID:3820
- C:\Windows\System\QWuZkaa.exe
  C:\Windows\System\QWuZkaa.exe
  2⤵
  PID:3856
- C:\Windows\System\hUxHQnz.exe
  C:\Windows\System\hUxHQnz.exe
  2⤵
  PID:3992
- C:\Windows\System\YvfXXfM.exe
  C:\Windows\System\YvfXXfM.exe
  2⤵
  PID:4036
- C:\Windows\System\aZOcxGa.exe
  C:\Windows\System\aZOcxGa.exe
  2⤵
  PID:4076
- C:\Windows\System\sdMlBxA.exe
  C:\Windows\System\sdMlBxA.exe
  2⤵
  PID:3932
- C:\Windows\System\TiRnYVt.exe
  C:\Windows\System\TiRnYVt.exe
  2⤵
  PID:1476
- C:\Windows\System\yyjhaJs.exe
  C:\Windows\System\yyjhaJs.exe
  2⤵
  PID:4012
- C:\Windows\System\JNfMxKb.exe
  C:\Windows\System\JNfMxKb.exe
  2⤵
  PID:2592
- C:\Windows\System\VOzyWDx.exe
  C:\Windows\System\VOzyWDx.exe
  2⤵
  PID:4060
- C:\Windows\System\wvDTYol.exe
  C:\Windows\System\wvDTYol.exe
  2⤵
  PID:1036
- C:\Windows\System\CmIFubW.exe
  C:\Windows\System\CmIFubW.exe
  2⤵
  PID:2728
- C:\Windows\System\FVvlCNb.exe
  C:\Windows\System\FVvlCNb.exe
  2⤵
  PID:1480
- C:\Windows\System\CxQgPnl.exe
  C:\Windows\System\CxQgPnl.exe
  2⤵
  PID:1644
- C:\Windows\System\GPPMRjN.exe
  C:\Windows\System\GPPMRjN.exe
  2⤵
  PID:2700
- C:\Windows\System\kpLrBYC.exe
  C:\Windows\System\kpLrBYC.exe
  2⤵
  PID:1560
- C:\Windows\System\ICaVmCl.exe
  C:\Windows\System\ICaVmCl.exe
  2⤵
  PID:1692
- C:\Windows\System\BMVWlTp.exe
  C:\Windows\System\BMVWlTp.exe
  2⤵
  PID:3280
- C:\Windows\System\qgetcTV.exe
  C:\Windows\System\qgetcTV.exe
  2⤵
  PID:3424
- C:\Windows\System\PUoSNdk.exe
  C:\Windows\System\PUoSNdk.exe
  2⤵
  PID:3408
- C:\Windows\System\PxlaEhc.exe
  C:\Windows\System\PxlaEhc.exe
  2⤵
  PID:3104
- C:\Windows\System\EXTktmD.exe
  C:\Windows\System\EXTktmD.exe
  2⤵
  PID:2788
- C:\Windows\System\lMSOydr.exe
  C:\Windows\System\lMSOydr.exe
  2⤵
  PID:3208
- C:\Windows\System\AuKDLzR.exe
  C:\Windows\System\AuKDLzR.exe
  2⤵
  PID:3360
- C:\Windows\System\WLTRNfL.exe
  C:\Windows\System\WLTRNfL.exe
  2⤵
  PID:3788
- C:\Windows\System\caiQRlW.exe
  C:\Windows\System\caiQRlW.exe
  2⤵
  PID:3472
- C:\Windows\System\yAxzcEJ.exe
  C:\Windows\System\yAxzcEJ.exe
  2⤵
  PID:3840
- C:\Windows\System\TSUMklB.exe
  C:\Windows\System\TSUMklB.exe
  2⤵
  PID:3376
- C:\Windows\System\CFBchXa.exe
  C:\Windows\System\CFBchXa.exe
  2⤵
  PID:3552
- C:\Windows\System\VcJkcNq.exe
  C:\Windows\System\VcJkcNq.exe
  2⤵
  PID:3988
- C:\Windows\System\wGBkncu.exe
  C:\Windows\System\wGBkncu.exe
  2⤵
  PID:3836
- C:\Windows\System\VyyZnXU.exe
  C:\Windows\System\VyyZnXU.exe
  2⤵
  PID:3616
- C:\Windows\System\VSpYgvZ.exe
  C:\Windows\System\VSpYgvZ.exe
  2⤵
  PID:3952
- C:\Windows\System\vVkTcEy.exe
  C:\Windows\System\vVkTcEy.exe
  2⤵
  PID:1608
- C:\Windows\System\JtUZLsw.exe
  C:\Windows\System\JtUZLsw.exe
  2⤵
  PID:2284
- C:\Windows\System\WoRIWuU.exe
  C:\Windows\System\WoRIWuU.exe
  2⤵
  PID:4028
- C:\Windows\System\svAXISP.exe
  C:\Windows\System\svAXISP.exe
  2⤵
  PID:3976
- C:\Windows\System\NBJAdKK.exe
  C:\Windows\System\NBJAdKK.exe
  2⤵
  PID:4056
- C:\Windows\System\DCHIblE.exe
  C:\Windows\System\DCHIblE.exe
  2⤵
  PID:3264
- C:\Windows\System\KXfkmNT.exe
  C:\Windows\System\KXfkmNT.exe
  2⤵
  PID:3296
- C:\Windows\System\UlYWKRo.exe
  C:\Windows\System\UlYWKRo.exe
  2⤵
  PID:1956
- C:\Windows\System\ZuvRdbu.exe
  C:\Windows\System\ZuvRdbu.exe
  2⤵
  PID:1652
- C:\Windows\System\oFwHRyn.exe
  C:\Windows\System\oFwHRyn.exe
  2⤵
  PID:2864
- C:\Windows\System\jnVqBYd.exe
  C:\Windows\System\jnVqBYd.exe
  2⤵
  PID:3204
- C:\Windows\System\eCEbnoE.exe
  C:\Windows\System\eCEbnoE.exe
  2⤵
  PID:3292
- C:\Windows\System\hfiTjZg.exe
  C:\Windows\System\hfiTjZg.exe
  2⤵
  PID:3732
- C:\Windows\System\BOeVLRR.exe
  C:\Windows\System\BOeVLRR.exe
  2⤵
  PID:3336
- C:\Windows\System\vUdzfiA.exe
  C:\Windows\System\vUdzfiA.exe
  2⤵
  PID:3776
- C:\Windows\System\ontsksp.exe
  C:\Windows\System\ontsksp.exe
  2⤵
  PID:3648
- C:\Windows\System\xPONPyD.exe
  C:\Windows\System\xPONPyD.exe
  2⤵
  PID:3880
- C:\Windows\System\RvoUKeH.exe
  C:\Windows\System\RvoUKeH.exe
  2⤵
  PID:1920
- C:\Windows\System\nFehPQn.exe
  C:\Windows\System\nFehPQn.exe
  2⤵
  PID:2672
- C:\Windows\System\QIBRDuL.exe
  C:\Windows\System\QIBRDuL.exe
  2⤵
  PID:1132
- C:\Windows\System\xuIufvB.exe
  C:\Windows\System\xuIufvB.exe
  2⤵
  PID:4052
- C:\Windows\System\xuKmCPn.exe
  C:\Windows\System\xuKmCPn.exe
  2⤵
  PID:3152
- C:\Windows\System\MnOCFDY.exe
  C:\Windows\System\MnOCFDY.exe
  2⤵
  PID:2616
- C:\Windows\System\Ulxjmho.exe
  C:\Windows\System\Ulxjmho.exe
  2⤵
  PID:1900
- C:\Windows\System\BDJmiUt.exe
  C:\Windows\System\BDJmiUt.exe
  2⤵
  PID:2872
- C:\Windows\System\vGzCYur.exe
  C:\Windows\System\vGzCYur.exe
  2⤵
  PID:2568
- C:\Windows\System\AQPkAPy.exe
  C:\Windows\System\AQPkAPy.exe
  2⤵
  PID:2520
- C:\Windows\System\JrsXwnU.exe
  C:\Windows\System\JrsXwnU.exe
  2⤵
  PID:1484
- C:\Windows\System\yvuFjmT.exe
  C:\Windows\System\yvuFjmT.exe
  2⤵
  PID:2148
- C:\Windows\System\MjCBzDo.exe
  C:\Windows\System\MjCBzDo.exe
  2⤵
  PID:108
- C:\Windows\System\JQprLgh.exe
  C:\Windows\System\JQprLgh.exe
  2⤵
  PID:3248
- C:\Windows\System\VcKaLiO.exe
  C:\Windows\System\VcKaLiO.exe
  2⤵
  PID:2584
- C:\Windows\System\HULKwKR.exe
  C:\Windows\System\HULKwKR.exe
  2⤵
  PID:2784
- C:\Windows\System\NJDRQQj.exe
  C:\Windows\System\NJDRQQj.exe
  2⤵
  PID:1984
- C:\Windows\System\RWLZcmS.exe
  C:\Windows\System\RWLZcmS.exe
  2⤵
  PID:2580
- C:\Windows\System\cornTxJ.exe
  C:\Windows\System\cornTxJ.exe
  2⤵
  PID:1080
- C:\Windows\System\CmCSzoj.exe
  C:\Windows\System\CmCSzoj.exe
  2⤵
  PID:3548
- C:\Windows\System\iysHjhj.exe
  C:\Windows\System\iysHjhj.exe
  2⤵
  PID:3596
- C:\Windows\System\HBAEaTj.exe
  C:\Windows\System\HBAEaTj.exe
  2⤵
  PID:1712
- C:\Windows\System\POBFguT.exe
  C:\Windows\System\POBFguT.exe
  2⤵
  PID:2536
- C:\Windows\System\OPNuavh.exe
  C:\Windows\System\OPNuavh.exe
  2⤵
  PID:3000
- C:\Windows\System\WyyQXTx.exe
  C:\Windows\System\WyyQXTx.exe
  2⤵
  PID:3652
- C:\Windows\System\JTapOpE.exe
  C:\Windows\System\JTapOpE.exe
  2⤵
  PID:2740
- C:\Windows\System\uSRDpva.exe
  C:\Windows\System\uSRDpva.exe
  2⤵
  PID:2648
- C:\Windows\System\LTUfprN.exe
  C:\Windows\System\LTUfprN.exe
  2⤵
  PID:2644
- C:\Windows\System\kTNUcRk.exe
  C:\Windows\System\kTNUcRk.exe
  2⤵
  PID:1824
- C:\Windows\System\UqSQGWe.exe
  C:\Windows\System\UqSQGWe.exe
  2⤵
  PID:1568
- C:\Windows\System\BSgtlVH.exe
  C:\Windows\System\BSgtlVH.exe
  2⤵
  PID:932
- C:\Windows\System\RrztsWz.exe
  C:\Windows\System\RrztsWz.exe
  2⤵
  PID:1664
- C:\Windows\System\QzDgQnd.exe
  C:\Windows\System\QzDgQnd.exe
  2⤵
  PID:1628
- C:\Windows\System\RFlvZzN.exe
  C:\Windows\System\RFlvZzN.exe
  2⤵
  PID:1032
- C:\Windows\System\cPdDAIF.exe
  C:\Windows\System\cPdDAIF.exe
  2⤵
  PID:3816
- C:\Windows\System\sLUIslw.exe
  C:\Windows\System\sLUIslw.exe
  2⤵
  PID:676
- C:\Windows\System\BGOMgsI.exe
  C:\Windows\System\BGOMgsI.exe
  2⤵
  PID:2756
- C:\Windows\System\vXBDQTt.exe
  C:\Windows\System\vXBDQTt.exe
  2⤵
  PID:1676
- C:\Windows\System\nLmgbiS.exe
  C:\Windows\System\nLmgbiS.exe
  2⤵
  PID:2904
- C:\Windows\System\ABMRrzt.exe
  C:\Windows\System\ABMRrzt.exe
  2⤵
  PID:3928
- C:\Windows\System\JEeETsw.exe
  C:\Windows\System\JEeETsw.exe
  2⤵
  PID:2636
- C:\Windows\System\gqwPZDg.exe
  C:\Windows\System\gqwPZDg.exe
  2⤵
  PID:3536
- C:\Windows\System\wiEyeNp.exe
  C:\Windows\System\wiEyeNp.exe
  2⤵
  PID:3568
- C:\Windows\System\QbrhffP.exe
  C:\Windows\System\QbrhffP.exe
  2⤵
  PID:3796
- C:\Windows\System\dYOFonX.exe
  C:\Windows\System\dYOFonX.exe
  2⤵
  PID:1804
- C:\Windows\System\VKYISBq.exe
  C:\Windows\System\VKYISBq.exe
  2⤵
  PID:2624
- C:\Windows\System\PWtTQqA.exe
  C:\Windows\System\PWtTQqA.exe
  2⤵
  PID:1856
- C:\Windows\System\NxkBNAd.exe
  C:\Windows\System\NxkBNAd.exe
  2⤵
  PID:692
- C:\Windows\System\bVFcKoA.exe
  C:\Windows\System\bVFcKoA.exe
  2⤵
  PID:2544
- C:\Windows\System\fWZsPJe.exe
  C:\Windows\System\fWZsPJe.exe
  2⤵
  PID:1636
- C:\Windows\System\qnRsbuv.exe
  C:\Windows\System\qnRsbuv.exe
  2⤵
  PID:960
- C:\Windows\System\nmPcXmL.exe
  C:\Windows\System\nmPcXmL.exe
  2⤵
  PID:3756
- C:\Windows\System\qlOliiW.exe
  C:\Windows\System\qlOliiW.exe
  2⤵
  PID:4112
- C:\Windows\System\NljPZyW.exe
  C:\Windows\System\NljPZyW.exe
  2⤵
  PID:4132
- C:\Windows\System\VZaxFtc.exe
  C:\Windows\System\VZaxFtc.exe
  2⤵
  PID:4148
- C:\Windows\System\TbTJSJI.exe
  C:\Windows\System\TbTJSJI.exe
  2⤵
  PID:4164
- C:\Windows\System\iETmiuU.exe
  C:\Windows\System\iETmiuU.exe
  2⤵
  PID:4184
- C:\Windows\System\gVgtnsv.exe
  C:\Windows\System\gVgtnsv.exe
  2⤵
  PID:4204
- C:\Windows\System\JWxKZkX.exe
  C:\Windows\System\JWxKZkX.exe
  2⤵
  PID:4220
- C:\Windows\System\paRWMsM.exe
  C:\Windows\System\paRWMsM.exe
  2⤵
  PID:4240
- C:\Windows\System\wfNVEcf.exe
  C:\Windows\System\wfNVEcf.exe
  2⤵
  PID:4260
- C:\Windows\System\wlxnCNq.exe
  C:\Windows\System\wlxnCNq.exe
  2⤵
  PID:4280
- C:\Windows\System\mwUQpBF.exe
  C:\Windows\System\mwUQpBF.exe
  2⤵
  PID:4296
- C:\Windows\System\YFnOfJq.exe
  C:\Windows\System\YFnOfJq.exe
  2⤵
  PID:4316
- C:\Windows\System\xYPcmJA.exe
  C:\Windows\System\xYPcmJA.exe
  2⤵
  PID:4336
- C:\Windows\System\Elefbao.exe
  C:\Windows\System\Elefbao.exe
  2⤵
  PID:4352
- C:\Windows\System\NyCskVR.exe
  C:\Windows\System\NyCskVR.exe
  2⤵
  PID:4372
- C:\Windows\System\uteLSOI.exe
  C:\Windows\System\uteLSOI.exe
  2⤵
  PID:4392
- C:\Windows\System\skCawnU.exe
  C:\Windows\System\skCawnU.exe
  2⤵
  PID:4408
- C:\Windows\System\ZykWhuQ.exe
  C:\Windows\System\ZykWhuQ.exe
  2⤵
  PID:4428
- C:\Windows\System\pUEkgwn.exe
  C:\Windows\System\pUEkgwn.exe
  2⤵
  PID:4448
- C:\Windows\System\WmJXhAK.exe
  C:\Windows\System\WmJXhAK.exe
  2⤵
  PID:4468
- C:\Windows\System\iaEexDQ.exe
  C:\Windows\System\iaEexDQ.exe
  2⤵
  PID:4488
- C:\Windows\System\WVkKKPQ.exe
  C:\Windows\System\WVkKKPQ.exe
  2⤵
  PID:4508
- C:\Windows\System\wrRqUoW.exe
  C:\Windows\System\wrRqUoW.exe
  2⤵
  PID:4528
- C:\Windows\System\IkyNxXz.exe
  C:\Windows\System\IkyNxXz.exe
  2⤵
  PID:4548
- C:\Windows\System\WaFFGUc.exe
  C:\Windows\System\WaFFGUc.exe
  2⤵
  PID:4568
- C:\Windows\System\QzIpDXV.exe
  C:\Windows\System\QzIpDXV.exe
  2⤵
  PID:4588
- C:\Windows\System\EFPMdDT.exe
  C:\Windows\System\EFPMdDT.exe
  2⤵
  PID:4604
- C:\Windows\System\wnuGNKe.exe
  C:\Windows\System\wnuGNKe.exe
  2⤵
  PID:4620
- C:\Windows\System\JjOBuby.exe
  C:\Windows\System\JjOBuby.exe
  2⤵
  PID:4640
- C:\Windows\System\sLyGtmU.exe
  C:\Windows\System\sLyGtmU.exe
  2⤵
  PID:4660
- C:\Windows\System\mvhzTxb.exe
  C:\Windows\System\mvhzTxb.exe
  2⤵
  PID:4676
- C:\Windows\System\IaJsKpt.exe
  C:\Windows\System\IaJsKpt.exe
  2⤵
  PID:4700
- C:\Windows\System\PUqyyKl.exe
  C:\Windows\System\PUqyyKl.exe
  2⤵
  PID:4724
- C:\Windows\System\cJvvoWR.exe
  C:\Windows\System\cJvvoWR.exe
  2⤵
  PID:4740
- C:\Windows\System\ieLZgiD.exe
  C:\Windows\System\ieLZgiD.exe
  2⤵
  PID:4760
- C:\Windows\System\gqaVhzP.exe
  C:\Windows\System\gqaVhzP.exe
  2⤵
  PID:4780
- C:\Windows\System\gEGexLg.exe
  C:\Windows\System\gEGexLg.exe
  2⤵
  PID:4796
- C:\Windows\System\fpPQbKc.exe
  C:\Windows\System\fpPQbKc.exe
  2⤵
  PID:4896
- C:\Windows\System\wcsXCih.exe
  C:\Windows\System\wcsXCih.exe
  2⤵
  PID:4912
- C:\Windows\System\tgVgRZl.exe
  C:\Windows\System\tgVgRZl.exe
  2⤵
  PID:4928
- C:\Windows\System\YhSPPSd.exe
  C:\Windows\System\YhSPPSd.exe
  2⤵
  PID:4944
- C:\Windows\System\tKKiFby.exe
  C:\Windows\System\tKKiFby.exe
  2⤵
  PID:4960
- C:\Windows\System\DMFohIu.exe
  C:\Windows\System\DMFohIu.exe
  2⤵
  PID:4976
- C:\Windows\System\LRHXgxf.exe
  C:\Windows\System\LRHXgxf.exe
  2⤵
  PID:4992
- C:\Windows\System\iLNUbcN.exe
  C:\Windows\System\iLNUbcN.exe
  2⤵
  PID:5008
- C:\Windows\System\kkxRtiP.exe
  C:\Windows\System\kkxRtiP.exe
  2⤵
  PID:5024
- C:\Windows\System\uFDtOIV.exe
  C:\Windows\System\uFDtOIV.exe
  2⤵
  PID:5040
- C:\Windows\System\xCqIJxk.exe
  C:\Windows\System\xCqIJxk.exe
  2⤵
  PID:5060
- C:\Windows\System\aztgyLm.exe
  C:\Windows\System\aztgyLm.exe
  2⤵
  PID:5076
- C:\Windows\System\uNiTLBk.exe
  C:\Windows\System\uNiTLBk.exe
  2⤵
  PID:5092
- C:\Windows\System\nMpellp.exe
  C:\Windows\System\nMpellp.exe
  2⤵
  PID:5108
- C:\Windows\System\DEFYMxc.exe
  C:\Windows\System\DEFYMxc.exe
  2⤵
  PID:2572
- C:\Windows\System\wbrCNWD.exe
  C:\Windows\System\wbrCNWD.exe
  2⤵
  PID:1448
- C:\Windows\System\zMPlhQE.exe
  C:\Windows\System\zMPlhQE.exe
  2⤵
  PID:2952
- C:\Windows\System\VooZuQW.exe
  C:\Windows\System\VooZuQW.exe
  2⤵
  PID:4120
- C:\Windows\System\QqXGzsf.exe
  C:\Windows\System\QqXGzsf.exe
  2⤵
  PID:4196
- C:\Windows\System\RUnxteK.exe
  C:\Windows\System\RUnxteK.exe
  2⤵
  PID:4236
- C:\Windows\System\IREwTtj.exe
  C:\Windows\System\IREwTtj.exe
  2⤵
  PID:4308
- C:\Windows\System\LgwkLBf.exe
  C:\Windows\System\LgwkLBf.exe
  2⤵
  PID:4348
- C:\Windows\System\JjTCyEy.exe
  C:\Windows\System\JjTCyEy.exe
  2⤵
  PID:4420
- C:\Windows\System\iITrbxu.exe
  C:\Windows\System\iITrbxu.exe
  2⤵
  PID:4464
- C:\Windows\System\lRzyIoE.exe
  C:\Windows\System\lRzyIoE.exe
  2⤵
  PID:4540
- C:\Windows\System\sGDusbb.exe
  C:\Windows\System\sGDusbb.exe
  2⤵
  PID:4584
- C:\Windows\System\pqnsvwP.exe
  C:\Windows\System\pqnsvwP.exe
  2⤵
  PID:4656
- C:\Windows\System\eGcVlWJ.exe
  C:\Windows\System\eGcVlWJ.exe
  2⤵
  PID:4732
- C:\Windows\System\MmoTzkI.exe
  C:\Windows\System\MmoTzkI.exe
  2⤵
  PID:4776
- C:\Windows\System\bTkmMJJ.exe
  C:\Windows\System\bTkmMJJ.exe
  2⤵
  PID:4820
- C:\Windows\System\vGqbkfM.exe
  C:\Windows\System\vGqbkfM.exe
  2⤵
  PID:2652
- C:\Windows\System\UOLbNTM.exe
  C:\Windows\System\UOLbNTM.exe
  2⤵
  PID:4176
- C:\Windows\System\yoDzJgV.exe
  C:\Windows\System\yoDzJgV.exe
  2⤵
  PID:4172
- C:\Windows\System\VdjKBCt.exe
  C:\Windows\System\VdjKBCt.exe
  2⤵
  PID:4668
- C:\Windows\System\VpArYFL.exe
  C:\Windows\System\VpArYFL.exe
  2⤵
  PID:4360
- C:\Windows\System\EqbHNnC.exe
  C:\Windows\System\EqbHNnC.exe
  2⤵
  PID:4436
- C:\Windows\System\NNmXqbv.exe
  C:\Windows\System\NNmXqbv.exe
  2⤵
  PID:4480
- C:\Windows\System\BPKKTSb.exe
  C:\Windows\System\BPKKTSb.exe
  2⤵
  PID:4596
- C:\Windows\System\tWvxjQi.exe
  C:\Windows\System\tWvxjQi.exe
  2⤵
  PID:4672
- C:\Windows\System\JijBklT.exe
  C:\Windows\System\JijBklT.exe
  2⤵
  PID:4720
- C:\Windows\System\jXaLLxG.exe
  C:\Windows\System\jXaLLxG.exe
  2⤵
  PID:4788
- C:\Windows\System\uUkxfmb.exe
  C:\Windows\System\uUkxfmb.exe
  2⤵
  PID:4888
- C:\Windows\System\jVRpMrZ.exe
  C:\Windows\System\jVRpMrZ.exe
  2⤵
  PID:4840
- C:\Windows\System\JLsTqGy.exe
  C:\Windows\System\JLsTqGy.exe
  2⤵
  PID:4860
- C:\Windows\System\uOzbHfO.exe
  C:\Windows\System\uOzbHfO.exe
  2⤵
  PID:4880
- C:\Windows\System\QcHfrGw.exe
  C:\Windows\System\QcHfrGw.exe
  2⤵
  PID:4924
- C:\Windows\System\ubzeJXk.exe
  C:\Windows\System\ubzeJXk.exe
  2⤵
  PID:2008
- C:\Windows\System\qxiGjVw.exe
  C:\Windows\System\qxiGjVw.exe
  2⤵
  PID:5056
- C:\Windows\System\iQJXFSG.exe
  C:\Windows\System\iQJXFSG.exe
  2⤵
  PID:5116
- C:\Windows\System\PafVHmj.exe
  C:\Windows\System\PafVHmj.exe
  2⤵
  PID:4160
- C:\Windows\System\yVgPFSX.exe
  C:\Windows\System\yVgPFSX.exe
  2⤵
  PID:4304
- C:\Windows\System\KujoFVt.exe
  C:\Windows\System\KujoFVt.exe
  2⤵
  PID:4500
- C:\Windows\System\weIDtos.exe
  C:\Windows\System\weIDtos.exe
  2⤵
  PID:4648
- C:\Windows\System\hXTAvLw.exe
  C:\Windows\System\hXTAvLw.exe
  2⤵
  PID:4824
- C:\Windows\System\bPhtiaX.exe
  C:\Windows\System\bPhtiaX.exe
  2⤵
  PID:4968
- C:\Windows\System\NIjUCLY.exe
  C:\Windows\System\NIjUCLY.exe
  2⤵
  PID:4332
- C:\Windows\System\ulMeCZn.exe
  C:\Windows\System\ulMeCZn.exe
  2⤵
  PID:4632
- C:\Windows\System\EqgrGTg.exe
  C:\Windows\System\EqgrGTg.exe
  2⤵
  PID:4832
- C:\Windows\System\iahifTD.exe
  C:\Windows\System\iahifTD.exe
  2⤵
  PID:4876
- C:\Windows\System\qDPwdCd.exe
  C:\Windows\System\qDPwdCd.exe
  2⤵
  PID:5084
- C:\Windows\System\ugavRbe.exe
  C:\Windows\System\ugavRbe.exe
  2⤵
  PID:4476
- C:\Windows\System\EjEYHxR.exe
  C:\Windows\System\EjEYHxR.exe
  2⤵
  PID:5140
- C:\Windows\System\ZKSTBad.exe
  C:\Windows\System\ZKSTBad.exe
  2⤵
  PID:5172
- C:\Windows\System\KWDhltJ.exe
  C:\Windows\System\KWDhltJ.exe
  2⤵
  PID:5192
- C:\Windows\System\KVMdfYd.exe
  C:\Windows\System\KVMdfYd.exe
  2⤵
  PID:5208
- C:\Windows\System\VJlHVSj.exe
  C:\Windows\System\VJlHVSj.exe
  2⤵
  PID:5228
- C:\Windows\System\fFuEzkv.exe
  C:\Windows\System\fFuEzkv.exe
  2⤵
  PID:5244
- C:\Windows\System\SBqtOSa.exe
  C:\Windows\System\SBqtOSa.exe
  2⤵
  PID:5260
- C:\Windows\System\CZEtrls.exe
  C:\Windows\System\CZEtrls.exe
  2⤵
  PID:5276
- C:\Windows\System\IUdNwii.exe
  C:\Windows\System\IUdNwii.exe
  2⤵
  PID:5292
- C:\Windows\System\awCLEEb.exe
  C:\Windows\System\awCLEEb.exe
  2⤵
  PID:5308
- C:\Windows\System\EFztUbM.exe
  C:\Windows\System\EFztUbM.exe
  2⤵
  PID:5324
- C:\Windows\System\mRcTtrd.exe
  C:\Windows\System\mRcTtrd.exe
  2⤵
  PID:5340
- C:\Windows\System\DfZriVQ.exe
  C:\Windows\System\DfZriVQ.exe
  2⤵
  PID:5360
- C:\Windows\System\XleIEbf.exe
  C:\Windows\System\XleIEbf.exe
  2⤵
  PID:5376
- C:\Windows\System\CgPfNKN.exe
  C:\Windows\System\CgPfNKN.exe
  2⤵
  PID:5396
- C:\Windows\System\BRAoUgi.exe
  C:\Windows\System\BRAoUgi.exe
  2⤵
  PID:5412
- C:\Windows\System\JPKWgLe.exe
  C:\Windows\System\JPKWgLe.exe
  2⤵
  PID:5428
- C:\Windows\System\TaJHqil.exe
  C:\Windows\System\TaJHqil.exe
  2⤵
  PID:5444
- C:\Windows\System\MiVNodh.exe
  C:\Windows\System\MiVNodh.exe
  2⤵
  PID:5468
- C:\Windows\System\cEJNBFm.exe
  C:\Windows\System\cEJNBFm.exe
  2⤵
  PID:5484
- C:\Windows\System\bpAAnpH.exe
  C:\Windows\System\bpAAnpH.exe
  2⤵
  PID:5500
- C:\Windows\System\IBjAuZD.exe
  C:\Windows\System\IBjAuZD.exe
  2⤵
  PID:5516
- C:\Windows\System\ipXDiZN.exe
  C:\Windows\System\ipXDiZN.exe
  2⤵
  PID:5532
- C:\Windows\System\crsheeP.exe
  C:\Windows\System\crsheeP.exe
  2⤵
  PID:5548
- C:\Windows\System\ZraEbTH.exe
  C:\Windows\System\ZraEbTH.exe
  2⤵
  PID:5564
- C:\Windows\System\XTdObcg.exe
  C:\Windows\System\XTdObcg.exe
  2⤵
  PID:5580
- C:\Windows\System\UmKPXYU.exe
  C:\Windows\System\UmKPXYU.exe
  2⤵
  PID:5596
- C:\Windows\System\yWpLBXN.exe
  C:\Windows\System\yWpLBXN.exe
  2⤵
  PID:5612
- C:\Windows\System\eJzxUGq.exe
  C:\Windows\System\eJzxUGq.exe
  2⤵
  PID:5628
- C:\Windows\System\PmLQyXq.exe
  C:\Windows\System\PmLQyXq.exe
  2⤵
  PID:5644
- C:\Windows\System\wsBMJBx.exe
  C:\Windows\System\wsBMJBx.exe
  2⤵
  PID:5660
- C:\Windows\System\AviDqAh.exe
  C:\Windows\System\AviDqAh.exe
  2⤵
  PID:5676
- C:\Windows\System\AnMGsYD.exe
  C:\Windows\System\AnMGsYD.exe
  2⤵
  PID:5692
- C:\Windows\System\wjEcaQN.exe
  C:\Windows\System\wjEcaQN.exe
  2⤵
  PID:5708
- C:\Windows\System\nEpsKqs.exe
  C:\Windows\System\nEpsKqs.exe
  2⤵
  PID:5728
- C:\Windows\System\DhRAwDs.exe
  C:\Windows\System\DhRAwDs.exe
  2⤵
  PID:5744
- C:\Windows\System\UsWaPej.exe
  C:\Windows\System\UsWaPej.exe
  2⤵
  PID:5764
- C:\Windows\System\tAUkxXx.exe
  C:\Windows\System\tAUkxXx.exe
  2⤵
  PID:5780
- C:\Windows\System\zbNwuRy.exe
  C:\Windows\System\zbNwuRy.exe
  2⤵
  PID:5796
- C:\Windows\System\CwMLpdb.exe
  C:\Windows\System\CwMLpdb.exe
  2⤵
  PID:5812
- C:\Windows\System\DYIqZCB.exe
  C:\Windows\System\DYIqZCB.exe
  2⤵
  PID:5836
- C:\Windows\System\YPCuXWv.exe
  C:\Windows\System\YPCuXWv.exe
  2⤵
  PID:5856
- C:\Windows\System\xeRawLR.exe
  C:\Windows\System\xeRawLR.exe
  2⤵
  PID:5872
- C:\Windows\System\wacabGZ.exe
  C:\Windows\System\wacabGZ.exe
  2⤵
  PID:5892
- C:\Windows\System\fKXxoEL.exe
  C:\Windows\System\fKXxoEL.exe
  2⤵
  PID:5908
- C:\Windows\System\MDhccxS.exe
  C:\Windows\System\MDhccxS.exe
  2⤵
  PID:5924
- C:\Windows\System\UDqcZhx.exe
  C:\Windows\System\UDqcZhx.exe
  2⤵
  PID:5940
- C:\Windows\System\LAXEPpc.exe
  C:\Windows\System\LAXEPpc.exe
  2⤵
  PID:5956
- C:\Windows\System\JSMQhoR.exe
  C:\Windows\System\JSMQhoR.exe
  2⤵
  PID:5976
- C:\Windows\System\fdpzpbT.exe
  C:\Windows\System\fdpzpbT.exe
  2⤵
  PID:5992
- C:\Windows\System\FAkTHtQ.exe
  C:\Windows\System\FAkTHtQ.exe
  2⤵
  PID:6008
- C:\Windows\System\IYQerle.exe
  C:\Windows\System\IYQerle.exe
  2⤵
  PID:6024
- C:\Windows\System\zAjsjKz.exe
  C:\Windows\System\zAjsjKz.exe
  2⤵
  PID:6044
- C:\Windows\System\EWfJfau.exe
  C:\Windows\System\EWfJfau.exe
  2⤵
  PID:6060
- C:\Windows\System\FwlysRb.exe
  C:\Windows\System\FwlysRb.exe
  2⤵
  PID:6076
- C:\Windows\System\wYtOpaZ.exe
  C:\Windows\System\wYtOpaZ.exe
  2⤵
  PID:6092
- C:\Windows\System\wPTEIHP.exe
  C:\Windows\System\wPTEIHP.exe
  2⤵
  PID:6108
- C:\Windows\System\BhnGLWZ.exe
  C:\Windows\System\BhnGLWZ.exe
  2⤵
  PID:6124
- C:\Windows\System\JUxVxlG.exe
  C:\Windows\System\JUxVxlG.exe
  2⤵
  PID:6140
- C:\Windows\System\tYaVzPU.exe
  C:\Windows\System\tYaVzPU.exe
  2⤵
  PID:4276
- C:\Windows\System\jJcgKLg.exe
  C:\Windows\System\jJcgKLg.exe
  2⤵
  PID:4144
- C:\Windows\System\ROipnLT.exe
  C:\Windows\System\ROipnLT.exe
  2⤵
  PID:4972
- C:\Windows\System\EkssgdC.exe
  C:\Windows\System\EkssgdC.exe
  2⤵
  PID:5036
- C:\Windows\System\bSPEreP.exe
  C:\Windows\System\bSPEreP.exe
  2⤵
  PID:5104
- C:\Windows\System\bxAtTUw.exe
  C:\Windows\System\bxAtTUw.exe
  2⤵
  PID:1976
- C:\Windows\System\kTCjZlw.exe
  C:\Windows\System\kTCjZlw.exe
  2⤵
  PID:5152
- C:\Windows\System\RYlAjBO.exe
  C:\Windows\System\RYlAjBO.exe
  2⤵
  PID:4984
- C:\Windows\System\kHPZYwf.exe
  C:\Windows\System\kHPZYwf.exe
  2⤵
  PID:2252
- C:\Windows\System\vpaYygg.exe
  C:\Windows\System\vpaYygg.exe
  2⤵
  PID:4232
- C:\Windows\System\lJCKclp.exe
  C:\Windows\System\lJCKclp.exe
  2⤵
  PID:4460
- C:\Windows\System\SHdtFTB.exe
  C:\Windows\System\SHdtFTB.exe
  2⤵
  PID:4692
- C:\Windows\System\bNmPXYC.exe
  C:\Windows\System\bNmPXYC.exe
  2⤵
  PID:484
- C:\Windows\System\yawFAIY.exe
  C:\Windows\System\yawFAIY.exe
  2⤵
  PID:4212
- C:\Windows\System\AkZusGZ.exe
  C:\Windows\System\AkZusGZ.exe
  2⤵
  PID:4368
- C:\Windows\System\rITHjLa.exe
  C:\Windows\System\rITHjLa.exe
  2⤵
  PID:4516
- C:\Windows\System\HbCHlNR.exe
  C:\Windows\System\HbCHlNR.exe
  2⤵
  PID:4696
- C:\Windows\System\Ywkzogm.exe
  C:\Windows\System\Ywkzogm.exe
  2⤵
  PID:4904
- C:\Windows\System\UUeRpyd.exe
  C:\Windows\System\UUeRpyd.exe
  2⤵
  PID:4856
- C:\Windows\System\cYFxLVF.exe
  C:\Windows\System\cYFxLVF.exe
  2⤵
  PID:5052
- C:\Windows\System\NqnuDtE.exe
  C:\Windows\System\NqnuDtE.exe
  2⤵
  PID:4388
- C:\Windows\System\KczZCpR.exe
  C:\Windows\System\KczZCpR.exe
  2⤵
  PID:4324
- C:\Windows\System\BRUMAva.exe
  C:\Windows\System\BRUMAva.exe
  2⤵
  PID:5124
- C:\Windows\System\DpoAxap.exe
  C:\Windows\System\DpoAxap.exe
  2⤵
  PID:5164
- C:\Windows\System\HhWrOWU.exe
  C:\Windows\System\HhWrOWU.exe
  2⤵
  PID:1720
- C:\Windows\System\sZOQnQX.exe
  C:\Windows\System\sZOQnQX.exe
  2⤵
  PID:5216
- C:\Windows\System\YsMHvtt.exe
  C:\Windows\System\YsMHvtt.exe
  2⤵
  PID:5256
- C:\Windows\System\ioSYTHO.exe
  C:\Windows\System\ioSYTHO.exe
  2⤵
  PID:5288
- C:\Windows\System\UaSaPNX.exe
  C:\Windows\System\UaSaPNX.exe
  2⤵
  PID:5336
- C:\Windows\System\FUvvXtN.exe
  C:\Windows\System\FUvvXtN.exe
  2⤵
  PID:5404
- C:\Windows\System\gompcPz.exe
  C:\Windows\System\gompcPz.exe
  2⤵
  PID:5440
- C:\Windows\System\WFrcUtB.exe
  C:\Windows\System\WFrcUtB.exe
  2⤵
  PID:2320
- C:\Windows\System\cQSPbKm.exe
  C:\Windows\System\cQSPbKm.exe
  2⤵
  PID:5420
- C:\Windows\System\xPEMNik.exe
  C:\Windows\System\xPEMNik.exe
  2⤵
  PID:5476
- C:\Windows\System\mOZCKoc.exe
  C:\Windows\System\mOZCKoc.exe
  2⤵
  PID:5464
- C:\Windows\System\hMNKsNK.exe
  C:\Windows\System\hMNKsNK.exe
  2⤵
  PID:5572
- C:\Windows\System\fTpUwJZ.exe
  C:\Windows\System\fTpUwJZ.exe
  2⤵
  PID:5608
- C:\Windows\System\mIkRnOv.exe
  C:\Windows\System\mIkRnOv.exe
  2⤵
  PID:5668
- C:\Windows\System\ASZoDNT.exe
  C:\Windows\System\ASZoDNT.exe
  2⤵
  PID:5492
- C:\Windows\System\hKQtFKi.exe
  C:\Windows\System\hKQtFKi.exe
  2⤵
  PID:5556
- C:\Windows\System\pnKvLJd.exe
  C:\Windows\System\pnKvLJd.exe
  2⤵
  PID:5656
- C:\Windows\System\oOWgTfr.exe
  C:\Windows\System\oOWgTfr.exe
  2⤵
  PID:5752
- C:\Windows\System\RGKZFbS.exe
  C:\Windows\System\RGKZFbS.exe
  2⤵
  PID:4228
- C:\Windows\System\AdWgDnD.exe
  C:\Windows\System\AdWgDnD.exe
  2⤵
  PID:5348
- C:\Windows\System\rTjlxuy.exe
  C:\Windows\System\rTjlxuy.exe
  2⤵
  PID:4716
- C:\Windows\System\TCdWHaR.exe
  C:\Windows\System\TCdWHaR.exe
  2⤵
  PID:4768
- C:\Windows\System\prUKDYZ.exe
  C:\Windows\System\prUKDYZ.exe
  2⤵
  PID:5268
- C:\Windows\System\pvjQOeT.exe
  C:\Windows\System\pvjQOeT.exe
  2⤵
  PID:5508
- C:\Windows\System\TvqvEgC.exe
  C:\Windows\System\TvqvEgC.exe
  2⤵
  PID:5528
- C:\Windows\System\pvrPvgr.exe
  C:\Windows\System\pvrPvgr.exe
  2⤵
  PID:5592
- C:\Windows\System\WyaACiO.exe
  C:\Windows\System\WyaACiO.exe
  2⤵
  PID:5688
- C:\Windows\System\tOnvDXy.exe
  C:\Windows\System\tOnvDXy.exe
  2⤵
  PID:5776
- C:\Windows\System\lfZWhdl.exe
  C:\Windows\System\lfZWhdl.exe
  2⤵
  PID:5904
- C:\Windows\System\siMFYWs.exe
  C:\Windows\System\siMFYWs.exe
  2⤵
  PID:5920
- C:\Windows\System\Tlendpv.exe
  C:\Windows\System\Tlendpv.exe
  2⤵
  PID:6000
- C:\Windows\System\ZKAdaHy.exe
  C:\Windows\System\ZKAdaHy.exe
  2⤵
  PID:5988
- C:\Windows\System\YmnoiIj.exe
  C:\Windows\System\YmnoiIj.exe
  2⤵
  PID:6056
- C:\Windows\System\TzPwCHO.exe
  C:\Windows\System\TzPwCHO.exe
  2⤵
  PID:6084
- C:\Windows\System\iWDgLYE.exe
  C:\Windows\System\iWDgLYE.exe
  2⤵
  PID:4272
- C:\Windows\System\twFKDhr.exe
  C:\Windows\System\twFKDhr.exe
  2⤵
  PID:6036
- C:\Windows\System\pqPNXmq.exe
  C:\Windows\System\pqPNXmq.exe
  2⤵
  PID:2360
- C:\Windows\System\pJhGKTL.exe
  C:\Windows\System\pJhGKTL.exe
  2⤵
  PID:4248
- C:\Windows\System\sNcKkwt.exe
  C:\Windows\System\sNcKkwt.exe
  2⤵
  PID:4580
- C:\Windows\System\qYsCFhC.exe
  C:\Windows\System\qYsCFhC.exe
  2⤵
  PID:4404
- C:\Windows\System\zmaWAuC.exe
  C:\Windows\System\zmaWAuC.exe
  2⤵
  PID:5204
- C:\Windows\System\VvOhBEM.exe
  C:\Windows\System\VvOhBEM.exe
  2⤵
  PID:1672
- C:\Windows\System\TWkdAVD.exe
  C:\Windows\System\TWkdAVD.exe
  2⤵
  PID:6132
- C:\Windows\System\PDjKUsb.exe
  C:\Windows\System\PDjKUsb.exe
  2⤵
  PID:5004
- C:\Windows\System\sVhFIiC.exe
  C:\Windows\System\sVhFIiC.exe
  2⤵
  PID:1364
- C:\Windows\System\tFjRePg.exe
  C:\Windows\System\tFjRePg.exe
  2⤵
  PID:5408
- C:\Windows\System\Rzouxsl.exe
  C:\Windows\System\Rzouxsl.exe
  2⤵
  PID:5788
- C:\Windows\System\cqgEXam.exe
  C:\Windows\System\cqgEXam.exe
  2⤵
  PID:5452
- C:\Windows\System\kqeYEpW.exe
  C:\Windows\System\kqeYEpW.exe
  2⤵
  PID:5604
- C:\Windows\System\oSFddAs.exe
  C:\Windows\System\oSFddAs.exe
  2⤵
  PID:5700
- C:\Windows\System\fxGUbEy.exe
  C:\Windows\System\fxGUbEy.exe
  2⤵
  PID:5624
- C:\Windows\System\MSTIQfh.exe
  C:\Windows\System\MSTIQfh.exe
  2⤵
  PID:5804
- C:\Windows\System\EomnQeL.exe
  C:\Windows\System\EomnQeL.exe
  2⤵
  PID:5828
- C:\Windows\System\zFmAwCW.exe
  C:\Windows\System\zFmAwCW.exe
  2⤵
  PID:5864
- C:\Windows\System\AfrDwwg.exe
  C:\Windows\System\AfrDwwg.exe
  2⤵
  PID:5936
- C:\Windows\System\FqVZQKs.exe
  C:\Windows\System\FqVZQKs.exe
  2⤵
  PID:6116
- C:\Windows\System\JTUWCqS.exe
  C:\Windows\System\JTUWCqS.exe
  2⤵
  PID:4556
- C:\Windows\System\ilFukNP.exe
  C:\Windows\System\ilFukNP.exe
  2⤵
  PID:5932
- C:\Windows\System\xSkrQnn.exe
  C:\Windows\System\xSkrQnn.exe
  2⤵
  PID:5964
- C:\Windows\System\lNFNpHG.exe
  C:\Windows\System\lNFNpHG.exe
  2⤵
  PID:5972
- C:\Windows\System\IirVUEQ.exe
  C:\Windows\System\IirVUEQ.exe
  2⤵
  PID:2508
- C:\Windows\System\AjfbxeE.exe
  C:\Windows\System\AjfbxeE.exe
  2⤵
  PID:5304
- C:\Windows\System\KSOzSIp.exe
  C:\Windows\System\KSOzSIp.exe
  2⤵
  PID:4616
- C:\Windows\System\zrRgFFp.exe
  C:\Windows\System\zrRgFFp.exe
  2⤵
  PID:5332
- C:\Windows\System\sXXAvjD.exe
  C:\Windows\System\sXXAvjD.exe
  2⤵
  PID:5020
- C:\Windows\System\KNNJJsG.exe
  C:\Windows\System\KNNJJsG.exe
  2⤵
  PID:2488
- C:\Windows\System\YefCzmz.exe
  C:\Windows\System\YefCzmz.exe
  2⤵
  PID:5852
- C:\Windows\System\HIIvgFc.exe
  C:\Windows\System\HIIvgFc.exe
  2⤵
  PID:4812
- C:\Windows\System\NTlHaWp.exe
  C:\Windows\System\NTlHaWp.exe
  2⤵
  PID:5884
- C:\Windows\System\AKngnCj.exe
  C:\Windows\System\AKngnCj.exe
  2⤵
  PID:2656
- C:\Windows\System\uCjepWX.exe
  C:\Windows\System\uCjepWX.exe
  2⤵
  PID:5792
- C:\Windows\System\RnUNQsN.exe
  C:\Windows\System\RnUNQsN.exe
  2⤵
  PID:5576
- C:\Windows\System\pteRAMc.exe
  C:\Windows\System\pteRAMc.exe
  2⤵
  PID:5844
- C:\Windows\System\HhSQZdZ.exe
  C:\Windows\System\HhSQZdZ.exe
  2⤵
  PID:5916
- C:\Windows\System\wdIwdGZ.exe
  C:\Windows\System\wdIwdGZ.exe
  2⤵
  PID:6020
- C:\Windows\System\ExImLsd.exe
  C:\Windows\System\ExImLsd.exe
  2⤵
  PID:5200
- C:\Windows\System\WXxWYUQ.exe
  C:\Windows\System\WXxWYUQ.exe
  2⤵
  PID:4128
- C:\Windows\System\DHDibBb.exe
  C:\Windows\System\DHDibBb.exe
  2⤵
  PID:5652
- C:\Windows\System\fapuFha.exe
  C:\Windows\System\fapuFha.exe
  2⤵
  PID:5372
- C:\Windows\System\sXfnWso.exe
  C:\Windows\System\sXfnWso.exe
  2⤵
  PID:5368
- C:\Windows\System\irqZhDH.exe
  C:\Windows\System\irqZhDH.exe
  2⤵
  PID:6160
- C:\Windows\System\gUHZVJP.exe
  C:\Windows\System\gUHZVJP.exe
  2⤵
  PID:6180
- C:\Windows\System\pUdMWkX.exe
  C:\Windows\System\pUdMWkX.exe
  2⤵
  PID:6196
- C:\Windows\System\QhmGgRR.exe
  C:\Windows\System\QhmGgRR.exe
  2⤵
  PID:6220
- C:\Windows\System\IqTrAkI.exe
  C:\Windows\System\IqTrAkI.exe
  2⤵
  PID:6244
- C:\Windows\System\EiJPBpK.exe
  C:\Windows\System\EiJPBpK.exe
  2⤵
  PID:6260
- C:\Windows\System\oEJBMiZ.exe
  C:\Windows\System\oEJBMiZ.exe
  2⤵
  PID:6280
- C:\Windows\System\aaHuWXk.exe
  C:\Windows\System\aaHuWXk.exe
  2⤵
  PID:6300
- C:\Windows\System\wSjDkJX.exe
  C:\Windows\System\wSjDkJX.exe
  2⤵
  PID:6316
- C:\Windows\System\WkoJYyu.exe
  C:\Windows\System\WkoJYyu.exe
  2⤵
  PID:6340
- C:\Windows\System\DMwoSAJ.exe
  C:\Windows\System\DMwoSAJ.exe
  2⤵
  PID:6356
- C:\Windows\System\YRDVClY.exe
  C:\Windows\System\YRDVClY.exe
  2⤵
  PID:6376
- C:\Windows\System\aBMptHp.exe
  C:\Windows\System\aBMptHp.exe
  2⤵
  PID:6396
- C:\Windows\System\hPocbPo.exe
  C:\Windows\System\hPocbPo.exe
  2⤵
  PID:6416
- C:\Windows\System\QbVmNow.exe
  C:\Windows\System\QbVmNow.exe
  2⤵
  PID:6436
- C:\Windows\System\dkWXnvT.exe
  C:\Windows\System\dkWXnvT.exe
  2⤵
  PID:6464
- C:\Windows\System\vBxpdaV.exe
  C:\Windows\System\vBxpdaV.exe
  2⤵
  PID:6484
- C:\Windows\System\mdMNTGJ.exe
  C:\Windows\System\mdMNTGJ.exe
  2⤵
  PID:6504
- C:\Windows\System\sSUHtcp.exe
  C:\Windows\System\sSUHtcp.exe
  2⤵
  PID:6528
- C:\Windows\System\glZsiJv.exe
  C:\Windows\System\glZsiJv.exe
  2⤵
  PID:6544
- C:\Windows\System\NwTVkPv.exe
  C:\Windows\System\NwTVkPv.exe
  2⤵
  PID:6564
- C:\Windows\System\lgvKkfZ.exe
  C:\Windows\System\lgvKkfZ.exe
  2⤵
  PID:6592
- C:\Windows\System\CfwYGDe.exe
  C:\Windows\System\CfwYGDe.exe
  2⤵
  PID:6616
- C:\Windows\System\aEgrMCK.exe
  C:\Windows\System\aEgrMCK.exe
  2⤵
  PID:6640
- C:\Windows\System\LxmNCXh.exe
  C:\Windows\System\LxmNCXh.exe
  2⤵
  PID:6656
- C:\Windows\System\kUsMirT.exe
  C:\Windows\System\kUsMirT.exe
  2⤵
  PID:6680
- C:\Windows\System\RBEhsgS.exe
  C:\Windows\System\RBEhsgS.exe
  2⤵
  PID:6696
- C:\Windows\System\RXuYbDW.exe
  C:\Windows\System\RXuYbDW.exe
  2⤵
  PID:6720
- C:\Windows\System\qTHXbIN.exe
  C:\Windows\System\qTHXbIN.exe
  2⤵
  PID:6736
- C:\Windows\System\tTeUmph.exe
  C:\Windows\System\tTeUmph.exe
  2⤵
  PID:6752
- C:\Windows\System\swWfVyG.exe
  C:\Windows\System\swWfVyG.exe
  2⤵
  PID:6776
- C:\Windows\System\bjdARES.exe
  C:\Windows\System\bjdARES.exe
  2⤵
  PID:6796
- C:\Windows\System\lPwJFJC.exe
  C:\Windows\System\lPwJFJC.exe
  2⤵
  PID:6812
- C:\Windows\System\aKlffyP.exe
  C:\Windows\System\aKlffyP.exe
  2⤵
  PID:6832
- C:\Windows\System\hhLaXcF.exe
  C:\Windows\System\hhLaXcF.exe
  2⤵
  PID:6852
- C:\Windows\System\UDBVLyK.exe
  C:\Windows\System\UDBVLyK.exe
  2⤵
  PID:6876
- C:\Windows\System\SazLYEb.exe
  C:\Windows\System\SazLYEb.exe
  2⤵
  PID:6892
- C:\Windows\System\qdAVsTK.exe
  C:\Windows\System\qdAVsTK.exe
  2⤵
  PID:6916
- C:\Windows\System\bbHPtRM.exe
  C:\Windows\System\bbHPtRM.exe
  2⤵
  PID:6940
- C:\Windows\System\sQjogdw.exe
  C:\Windows\System\sQjogdw.exe
  2⤵
  PID:6960
- C:\Windows\System\FAgHCHV.exe
  C:\Windows\System\FAgHCHV.exe
  2⤵
  PID:6976
- C:\Windows\System\vyPnPjj.exe
  C:\Windows\System\vyPnPjj.exe
  2⤵
  PID:6996
- C:\Windows\System\HYGapmH.exe
  C:\Windows\System\HYGapmH.exe
  2⤵
  PID:7020
- C:\Windows\System\zHtEQxU.exe
  C:\Windows\System\zHtEQxU.exe
  2⤵
  PID:7044
- C:\Windows\System\cCocItb.exe
  C:\Windows\System\cCocItb.exe
  2⤵
  PID:7064
- C:\Windows\System\UbaLMDw.exe
  C:\Windows\System\UbaLMDw.exe
  2⤵
  PID:7080
- C:\Windows\System\BQAdUsR.exe
  C:\Windows\System\BQAdUsR.exe
  2⤵
  PID:7096
- C:\Windows\System\jJCJLRI.exe
  C:\Windows\System\jJCJLRI.exe
  2⤵
  PID:7124
- C:\Windows\System\TQeoMfo.exe
  C:\Windows\System\TQeoMfo.exe
  2⤵
  PID:7140
- C:\Windows\System\oFJuZuQ.exe
  C:\Windows\System\oFJuZuQ.exe
  2⤵
  PID:7160
- C:\Windows\System\lfKVgEb.exe
  C:\Windows\System\lfKVgEb.exe
  2⤵
  PID:6188
- C:\Windows\System\LSdRKqU.exe
  C:\Windows\System\LSdRKqU.exe
  2⤵
  PID:6236
- C:\Windows\System\hJhecYX.exe
  C:\Windows\System\hJhecYX.exe
  2⤵
  PID:6276
- C:\Windows\System\wOiongz.exe
  C:\Windows\System\wOiongz.exe
  2⤵
  PID:4872
- C:\Windows\System\vjONacV.exe
  C:\Windows\System\vjONacV.exe
  2⤵
  PID:6352
- C:\Windows\System\PxyTqsY.exe
  C:\Windows\System\PxyTqsY.exe
  2⤵
  PID:6424
- C:\Windows\System\QyxyOZL.exe
  C:\Windows\System\QyxyOZL.exe
  2⤵
  PID:1584
- C:\Windows\System\uGVMrot.exe
  C:\Windows\System\uGVMrot.exe
  2⤵
  PID:2404
- C:\Windows\System\XEoKGaJ.exe
  C:\Windows\System\XEoKGaJ.exe
  2⤵
  PID:6520
- C:\Windows\System\coGojjI.exe
  C:\Windows\System\coGojjI.exe
  2⤵
  PID:6524
- C:\Windows\System\enrgKFO.exe
  C:\Windows\System\enrgKFO.exe
  2⤵
  PID:788
- C:\Windows\System\aggCTnd.exe
  C:\Windows\System\aggCTnd.exe
  2⤵
  PID:6560
- C:\Windows\System\zIgPUWm.exe
  C:\Windows\System\zIgPUWm.exe
  2⤵
  PID:6364
- C:\Windows\System\rIwOpLQ.exe
  C:\Windows\System\rIwOpLQ.exe
  2⤵
  PID:6208
- C:\Windows\System\NFqiARt.exe
  C:\Windows\System\NFqiARt.exe
  2⤵
  PID:6612
- C:\Windows\System\AumIxta.exe
  C:\Windows\System\AumIxta.exe
  2⤵
  PID:6328
- C:\Windows\System\JxpDyru.exe
  C:\Windows\System\JxpDyru.exe
  2⤵
  PID:6412
- C:\Windows\System\xKAShWR.exe
  C:\Windows\System\xKAShWR.exe
  2⤵
  PID:6456
- C:\Windows\System\dEMpJDy.exe
  C:\Windows\System\dEMpJDy.exe
  2⤵
  PID:6628
- C:\Windows\System\UfgUDIU.exe
  C:\Windows\System\UfgUDIU.exe
  2⤵
  PID:6536
- C:\Windows\System\JjyGIfd.exe
  C:\Windows\System\JjyGIfd.exe
  2⤵
  PID:6624
- C:\Windows\System\HasZwRQ.exe
  C:\Windows\System\HasZwRQ.exe
  2⤵
  PID:6668
- C:\Windows\System\QCvKBxW.exe
  C:\Windows\System\QCvKBxW.exe
  2⤵
  PID:6732
- C:\Windows\System\koWcEVk.exe
  C:\Windows\System\koWcEVk.exe
  2⤵
  PID:6768
- C:\Windows\System\hyboJrT.exe
  C:\Windows\System\hyboJrT.exe
  2⤵
  PID:6704
- C:\Windows\System\lLWdMaf.exe
  C:\Windows\System\lLWdMaf.exe
  2⤵
  PID:6716
- C:\Windows\System\kenEUaM.exe
  C:\Windows\System\kenEUaM.exe
  2⤵
  PID:6744
- C:\Windows\System\xymdpgV.exe
  C:\Windows\System\xymdpgV.exe
  2⤵
  PID:6860
- C:\Windows\System\syEcdCD.exe
  C:\Windows\System\syEcdCD.exe
  2⤵
  PID:6820
- C:\Windows\System\xycKmYo.exe
  C:\Windows\System\xycKmYo.exe
  2⤵
  PID:6872
- C:\Windows\System\LOCcIYQ.exe
  C:\Windows\System\LOCcIYQ.exe
  2⤵
  PID:6912
- C:\Windows\System\OaDPWrK.exe
  C:\Windows\System\OaDPWrK.exe
  2⤵
  PID:6952
- C:\Windows\System\WBSXeOt.exe
  C:\Windows\System\WBSXeOt.exe
  2⤵
  PID:7008
- C:\Windows\System\xcfeCIF.exe
  C:\Windows\System\xcfeCIF.exe
  2⤵
  PID:6992
- C:\Windows\System\ZdvKauC.exe
  C:\Windows\System\ZdvKauC.exe
  2⤵
  PID:7040
- C:\Windows\System\OlIBOan.exe
  C:\Windows\System\OlIBOan.exe
  2⤵
  PID:7060
- C:\Windows\System\iqPNzRU.exe
  C:\Windows\System\iqPNzRU.exe
  2⤵
  PID:7132
- C:\Windows\System\jwBNtRN.exe
  C:\Windows\System\jwBNtRN.exe
  2⤵
  PID:6268
- C:\Windows\System\NxpcwJh.exe
  C:\Windows\System\NxpcwJh.exe
  2⤵
  PID:7104
- C:\Windows\System\iGMSNoY.exe
  C:\Windows\System\iGMSNoY.exe
  2⤵
  PID:4400
- C:\Windows\System\MbsSWZw.exe
  C:\Windows\System\MbsSWZw.exe
  2⤵
  PID:5132
- C:\Windows\System\plcszeG.exe
  C:\Windows\System\plcszeG.exe
  2⤵
  PID:7152
- C:\Windows\System\XADdYLT.exe
  C:\Windows\System\XADdYLT.exe
  2⤵
  PID:6232
- C:\Windows\System\jirheSb.exe
  C:\Windows\System\jirheSb.exe
  2⤵
  PID:6292
- C:\Windows\System\yqPUBsV.exe
  C:\Windows\System\yqPUBsV.exe
  2⤵
  PID:6256
- C:\Windows\System\qnexqNY.exe
  C:\Windows\System\qnexqNY.exe
  2⤵
  PID:6228
- C:\Windows\System\FSVxCJE.exe
  C:\Windows\System\FSVxCJE.exe
  2⤵
  PID:6368
- C:\Windows\System\UpOOidy.exe
  C:\Windows\System\UpOOidy.exe
  2⤵
  PID:6584
- C:\Windows\System\stxliyg.exe
  C:\Windows\System\stxliyg.exe
  2⤵
  PID:6728
- C:\Windows\System\edxxThM.exe
  C:\Windows\System\edxxThM.exe
  2⤵
  PID:6480
- C:\Windows\System\XEsUylq.exe
  C:\Windows\System\XEsUylq.exe
  2⤵
  PID:4956
- C:\Windows\System\jIctYMq.exe
  C:\Windows\System\jIctYMq.exe
  2⤵
  PID:6176
- C:\Windows\System\PEfKFLN.exe
  C:\Windows\System\PEfKFLN.exe
  2⤵
  PID:6868
- C:\Windows\System\qBmLRzE.exe
  C:\Windows\System\qBmLRzE.exe
  2⤵
  PID:6908
- C:\Windows\System\wPjTXnE.exe
  C:\Windows\System\wPjTXnE.exe
  2⤵
  PID:7004
- C:\Windows\System\lOGUDTH.exe
  C:\Windows\System\lOGUDTH.exe
  2⤵
  PID:7076
- C:\Windows\System\UuyBluT.exe
  C:\Windows\System\UuyBluT.exe
  2⤵
  PID:4756
- C:\Windows\System\LkvqrmH.exe
  C:\Windows\System\LkvqrmH.exe
  2⤵
  PID:6408
- C:\Windows\System\jNKvZGy.exe
  C:\Windows\System\jNKvZGy.exe
  2⤵
  PID:6500
- C:\Windows\System\bhESnMu.exe
  C:\Windows\System\bhESnMu.exe
  2⤵
  PID:6692
- C:\Windows\System\OkcKWYC.exe
  C:\Windows\System\OkcKWYC.exe
  2⤵
  PID:6772
- C:\Windows\System\TTRezbq.exe
  C:\Windows\System\TTRezbq.exe
  2⤵
  PID:6884
- C:\Windows\System\BaFPxCJ.exe
  C:\Windows\System\BaFPxCJ.exe
  2⤵
  PID:6932
- C:\Windows\System\OdiwPxV.exe
  C:\Windows\System\OdiwPxV.exe
  2⤵
  PID:7056
- C:\Windows\System\RoXaTBD.exe
  C:\Windows\System\RoXaTBD.exe
  2⤵
  PID:6428
- C:\Windows\System\NWFyLPo.exe
  C:\Windows\System\NWFyLPo.exe
  2⤵
  PID:6600
- C:\Windows\System\pmOBLAY.exe
  C:\Windows\System\pmOBLAY.exe
  2⤵
  PID:6308
- C:\Windows\System\nwIKrxc.exe
  C:\Windows\System\nwIKrxc.exe
  2⤵
  PID:6652
- C:\Windows\System\ihFcMmb.exe
  C:\Windows\System\ihFcMmb.exe
  2⤵
  PID:1732
- C:\Windows\System\CGOiKKr.exe
  C:\Windows\System\CGOiKKr.exe
  2⤵
  PID:6392
- C:\Windows\System\FOgqMzg.exe
  C:\Windows\System\FOgqMzg.exe
  2⤵
  PID:5392
- C:\Windows\System\RnlqLeo.exe
  C:\Windows\System\RnlqLeo.exe
  2⤵
  PID:7028
- C:\Windows\System\VaNRlQV.exe
  C:\Windows\System\VaNRlQV.exe
  2⤵
  PID:7116
- C:\Windows\System\PRnmTxR.exe
  C:\Windows\System\PRnmTxR.exe
  2⤵
  PID:6968
- C:\Windows\System\yaZrOjA.exe
  C:\Windows\System\yaZrOjA.exe
  2⤵
  PID:6580
- C:\Windows\System\zyBRXkg.exe
  C:\Windows\System\zyBRXkg.exe
  2⤵
  PID:6788
- C:\Windows\System\ljqiaRf.exe
  C:\Windows\System\ljqiaRf.exe
  2⤵
  PID:6848
- C:\Windows\System\uEyJTVM.exe
  C:\Windows\System\uEyJTVM.exe
  2⤵
  PID:5560
- C:\Windows\System\eJIpXzx.exe
  C:\Windows\System\eJIpXzx.exe
  2⤵
  PID:6288
- C:\Windows\System\wrdfonQ.exe
  C:\Windows\System\wrdfonQ.exe
  2⤵
  PID:6040
- C:\Windows\System\OXGisIR.exe
  C:\Windows\System\OXGisIR.exe
  2⤵
  PID:4852
- C:\Windows\System\omjCjjl.exe
  C:\Windows\System\omjCjjl.exe
  2⤵
  PID:6492
- C:\Windows\System\PCXgIJO.exe
  C:\Windows\System\PCXgIJO.exe
  2⤵
  PID:6496
- C:\Windows\System\bumjlbH.exe
  C:\Windows\System\bumjlbH.exe
  2⤵
  PID:7156
- C:\Windows\System\UDtiJwv.exe
  C:\Windows\System\UDtiJwv.exe
  2⤵
  PID:6808
- C:\Windows\System\PluJJpH.exe
  C:\Windows\System\PluJJpH.exe
  2⤵
  PID:1980
- C:\Windows\System\FAOjlJi.exe
  C:\Windows\System\FAOjlJi.exe
  2⤵
  PID:7052
- C:\Windows\System\SYZfxGN.exe
  C:\Windows\System\SYZfxGN.exe
  2⤵
  PID:7180
- C:\Windows\System\erDGJwc.exe
  C:\Windows\System\erDGJwc.exe
  2⤵
  PID:7196
- C:\Windows\System\JuEMrgb.exe
  C:\Windows\System\JuEMrgb.exe
  2⤵
  PID:7212
- C:\Windows\System\ODEgUjm.exe
  C:\Windows\System\ODEgUjm.exe
  2⤵
  PID:7228
- C:\Windows\System\bLcZAYr.exe
  C:\Windows\System\bLcZAYr.exe
  2⤵
  PID:7244
- C:\Windows\System\mPXsdnS.exe
  C:\Windows\System\mPXsdnS.exe
  2⤵
  PID:7260
- C:\Windows\System\pnDuPOY.exe
  C:\Windows\System\pnDuPOY.exe
  2⤵
  PID:7276
- C:\Windows\System\uJbeXhU.exe
  C:\Windows\System\uJbeXhU.exe
  2⤵
  PID:7292
- C:\Windows\System\vEPRHhv.exe
  C:\Windows\System\vEPRHhv.exe
  2⤵
  PID:7308
- C:\Windows\System\pwNgspV.exe
  C:\Windows\System\pwNgspV.exe
  2⤵
  PID:7324
- C:\Windows\System\odpahbU.exe
  C:\Windows\System\odpahbU.exe
  2⤵
  PID:7364
- C:\Windows\System\GydnDzA.exe
  C:\Windows\System\GydnDzA.exe
  2⤵
  PID:7380
- C:\Windows\System\ujsDNYu.exe
  C:\Windows\System\ujsDNYu.exe
  2⤵
  PID:7396
- C:\Windows\System\YDRRpnT.exe
  C:\Windows\System\YDRRpnT.exe
  2⤵
  PID:7412
- C:\Windows\System\cHHwUKy.exe
  C:\Windows\System\cHHwUKy.exe
  2⤵
  PID:7428
- C:\Windows\System\NszRVKq.exe
  C:\Windows\System\NszRVKq.exe
  2⤵
  PID:7444
- C:\Windows\System\RXMCieF.exe
  C:\Windows\System\RXMCieF.exe
  2⤵
  PID:7460
- C:\Windows\System\DtGwqch.exe
  C:\Windows\System\DtGwqch.exe
  2⤵
  PID:7476
- C:\Windows\System\boNmXgc.exe
  C:\Windows\System\boNmXgc.exe
  2⤵
  PID:7496
- C:\Windows\System\ttVADtY.exe
  C:\Windows\System\ttVADtY.exe
  2⤵
  PID:7512
- C:\Windows\System\HTURycO.exe
  C:\Windows\System\HTURycO.exe
  2⤵
  PID:7528
- C:\Windows\System\lGrSVON.exe
  C:\Windows\System\lGrSVON.exe
  2⤵
  PID:7548
- C:\Windows\System\hoBHQbe.exe
  C:\Windows\System\hoBHQbe.exe
  2⤵
  PID:7564
- C:\Windows\System\MGFDbUa.exe
  C:\Windows\System\MGFDbUa.exe
  2⤵
  PID:7584
- C:\Windows\System\acodEFb.exe
  C:\Windows\System\acodEFb.exe
  2⤵
  PID:7600
- C:\Windows\System\KshdfZz.exe
  C:\Windows\System\KshdfZz.exe
  2⤵
  PID:7620
- C:\Windows\System\LlpMuAX.exe
  C:\Windows\System\LlpMuAX.exe
  2⤵
  PID:7636
- C:\Windows\System\tusCaPo.exe
  C:\Windows\System\tusCaPo.exe
  2⤵
  PID:7652
- C:\Windows\System\qEIjlVk.exe
  C:\Windows\System\qEIjlVk.exe
  2⤵
  PID:7668
- C:\Windows\System\FvSrGDX.exe
  C:\Windows\System\FvSrGDX.exe
  2⤵
  PID:7684
- C:\Windows\System\hyLPgKy.exe
  C:\Windows\System\hyLPgKy.exe
  2⤵
  PID:7700
- C:\Windows\System\kISxgLk.exe
  C:\Windows\System\kISxgLk.exe
  2⤵
  PID:7720
- C:\Windows\System\bSGhiFW.exe
  C:\Windows\System\bSGhiFW.exe
  2⤵
  PID:7736
- C:\Windows\System\iHvMygC.exe
  C:\Windows\System\iHvMygC.exe
  2⤵
  PID:7752
- C:\Windows\System\eqZmRrg.exe
  C:\Windows\System\eqZmRrg.exe
  2⤵
  PID:7768
- C:\Windows\System\LUJUlOQ.exe
  C:\Windows\System\LUJUlOQ.exe
  2⤵
  PID:7784
- C:\Windows\System\okmfmEo.exe
  C:\Windows\System\okmfmEo.exe
  2⤵
  PID:7808
- C:\Windows\System\dykBhHI.exe
  C:\Windows\System\dykBhHI.exe
  2⤵
  PID:7824
- C:\Windows\System\fUtkFeY.exe
  C:\Windows\System\fUtkFeY.exe
  2⤵
  PID:7840
- C:\Windows\System\ZlDAmlA.exe
  C:\Windows\System\ZlDAmlA.exe
  2⤵
  PID:7856
- C:\Windows\System\kQVmzaZ.exe
  C:\Windows\System\kQVmzaZ.exe
  2⤵
  PID:7872
- C:\Windows\System\aZNrVua.exe
  C:\Windows\System\aZNrVua.exe
  2⤵
  PID:7888
- C:\Windows\System\JUYhhod.exe
  C:\Windows\System\JUYhhod.exe
  2⤵
  PID:7908
- C:\Windows\System\GTcUNKo.exe
  C:\Windows\System\GTcUNKo.exe
  2⤵
  PID:7924
- C:\Windows\System\jPiHnVS.exe
  C:\Windows\System\jPiHnVS.exe
  2⤵
  PID:7940
- C:\Windows\System\LMrtFQW.exe
  C:\Windows\System\LMrtFQW.exe
  2⤵
  PID:7960
- C:\Windows\System\ZXDxExc.exe
  C:\Windows\System\ZXDxExc.exe
  2⤵
  PID:7976
- C:\Windows\System\wnBcJUy.exe
  C:\Windows\System\wnBcJUy.exe
  2⤵
  PID:7992
- C:\Windows\System\gIyLJhr.exe
  C:\Windows\System\gIyLJhr.exe
  2⤵
  PID:8008
- C:\Windows\System\QYTFSUX.exe
  C:\Windows\System\QYTFSUX.exe
  2⤵
  PID:8024
- C:\Windows\System\YHIxbXD.exe
  C:\Windows\System\YHIxbXD.exe
  2⤵
  PID:8044
- C:\Windows\System\SFBWATQ.exe
  C:\Windows\System\SFBWATQ.exe
  2⤵
  PID:8060
- C:\Windows\System\zqaOXhw.exe
  C:\Windows\System\zqaOXhw.exe
  2⤵
  PID:8076
- C:\Windows\System\eYooQBO.exe
  C:\Windows\System\eYooQBO.exe
  2⤵
  PID:8096
- C:\Windows\System\hZaZenb.exe
  C:\Windows\System\hZaZenb.exe
  2⤵
  PID:8112
- C:\Windows\System\FCKXuMS.exe
  C:\Windows\System\FCKXuMS.exe
  2⤵
  PID:8128
- C:\Windows\System\UoOaZDF.exe
  C:\Windows\System\UoOaZDF.exe
  2⤵
  PID:8144
- C:\Windows\System\mjICsiK.exe
  C:\Windows\System\mjICsiK.exe
  2⤵
  PID:8160
- C:\Windows\System\ueEcZcv.exe
  C:\Windows\System\ueEcZcv.exe
  2⤵
  PID:8176
- C:\Windows\System\cIeARki.exe
  C:\Windows\System\cIeARki.exe
  2⤵
  PID:4816
- C:\Windows\System\vrvhjas.exe
  C:\Windows\System\vrvhjas.exe
  2⤵
  PID:1360
- C:\Windows\System\qJMNNUa.exe
  C:\Windows\System\qJMNNUa.exe
  2⤵
  PID:7256
- C:\Windows\System\oAxxbrJ.exe
  C:\Windows\System\oAxxbrJ.exe
  2⤵
  PID:7320
- C:\Windows\System\dLkbyxT.exe
  C:\Windows\System\dLkbyxT.exe
  2⤵
  PID:5180
- C:\Windows\System\IkKzZMp.exe
  C:\Windows\System\IkKzZMp.exe
  2⤵
  PID:7176
- C:\Windows\System\QgFwUrw.exe
  C:\Windows\System\QgFwUrw.exe
  2⤵
  PID:7268
- C:\Windows\System\uLWdSsc.exe
  C:\Windows\System\uLWdSsc.exe
  2⤵
  PID:7372
- C:\Windows\System\sUqFHVX.exe
  C:\Windows\System\sUqFHVX.exe
  2⤵
  PID:7348
- C:\Windows\System\allMMYG.exe
  C:\Windows\System\allMMYG.exe
  2⤵
  PID:7360
- C:\Windows\System\OtAGJNb.exe
  C:\Windows\System\OtAGJNb.exe
  2⤵
  PID:7388
- C:\Windows\System\VRQeOeS.exe
  C:\Windows\System\VRQeOeS.exe
  2⤵
  PID:7472
- C:\Windows\System\aGKmCSu.exe
  C:\Windows\System\aGKmCSu.exe
  2⤵
  PID:7536
- C:\Windows\System\rAUcCxf.exe
  C:\Windows\System\rAUcCxf.exe
  2⤵
  PID:7420
- C:\Windows\System\HfiBBZz.exe
  C:\Windows\System\HfiBBZz.exe
  2⤵
  PID:7492
- C:\Windows\System\VvikBGo.exe
  C:\Windows\System\VvikBGo.exe
  2⤵
  PID:7572
- C:\Windows\System\GTkhCJy.exe
  C:\Windows\System\GTkhCJy.exe
  2⤵
  PID:7616
- C:\Windows\System\foDzHfv.exe
  C:\Windows\System\foDzHfv.exe
  2⤵
  PID:7680
- C:\Windows\System\YJmzyVv.exe
  C:\Windows\System\YJmzyVv.exe
  2⤵
  PID:7744
- C:\Windows\System\BiGMJED.exe
  C:\Windows\System\BiGMJED.exe
  2⤵
  PID:7556
- C:\Windows\System\XbQAvXY.exe
  C:\Windows\System\XbQAvXY.exe
  2⤵
  PID:7692
- C:\Windows\System\QjWypOh.exe
  C:\Windows\System\QjWypOh.exe
  2⤵
  PID:7816
- C:\Windows\System\uLlKEwN.exe
  C:\Windows\System\uLlKEwN.exe
  2⤵
  PID:7760
- C:\Windows\System\HyxzTSu.exe
  C:\Windows\System\HyxzTSu.exe
  2⤵
  PID:7800
- C:\Windows\System\jSLkczs.exe
  C:\Windows\System\jSLkczs.exe
  2⤵
  PID:7804
- C:\Windows\System\JGnnehT.exe
  C:\Windows\System\JGnnehT.exe
  2⤵
  PID:7796
- C:\Windows\System\vIyoarq.exe
  C:\Windows\System\vIyoarq.exe
  2⤵
  PID:7836
- C:\Windows\System\UzFBtOu.exe
  C:\Windows\System\UzFBtOu.exe
  2⤵
  PID:7904
- C:\Windows\System\wYMYozS.exe
  C:\Windows\System\wYMYozS.exe
  2⤵
  PID:7956
- C:\Windows\System\FffBDcw.exe
  C:\Windows\System\FffBDcw.exe
  2⤵
  PID:8020
- C:\Windows\System\RmiCKiA.exe
  C:\Windows\System\RmiCKiA.exe
  2⤵
  PID:8000
- C:\Windows\System\VmrRezD.exe
  C:\Windows\System\VmrRezD.exe
  2⤵
  PID:8068
- C:\Windows\System\eQAYJHx.exe
  C:\Windows\System\eQAYJHx.exe
  2⤵
  PID:8104
- C:\Windows\System\UNnERhj.exe
  C:\Windows\System\UNnERhj.exe
  2⤵
  PID:8172
- C:\Windows\System\aYtbHYr.exe
  C:\Windows\System\aYtbHYr.exe
  2⤵
  PID:8120
- C:\Windows\System\MHYAyeg.exe
  C:\Windows\System\MHYAyeg.exe
  2⤵
  PID:7316
- C:\Windows\System\HKUvFjC.exe
  C:\Windows\System\HKUvFjC.exe
  2⤵
  PID:7376
- C:\Windows\System\tRvcTIL.exe
  C:\Windows\System\tRvcTIL.exe
  2⤵
  PID:8156
- C:\Windows\System\QMhsyos.exe
  C:\Windows\System\QMhsyos.exe
  2⤵
  PID:7252
- C:\Windows\System\OhiBQwm.exe
  C:\Windows\System\OhiBQwm.exe
  2⤵
  PID:7468
- C:\Windows\System\HbKRzzZ.exe
  C:\Windows\System\HbKRzzZ.exe
  2⤵
  PID:7236
- C:\Windows\System\KxOIFQM.exe
  C:\Windows\System\KxOIFQM.exe
  2⤵
  PID:7484
- C:\Windows\System\CdTrvDb.exe
  C:\Windows\System\CdTrvDb.exe
  2⤵
  PID:7612
- C:\Windows\System\flmCVnc.exe
  C:\Windows\System\flmCVnc.exe
  2⤵
  PID:7596
- C:\Windows\System\CmkIzUY.exe
  C:\Windows\System\CmkIzUY.exe
  2⤵
  PID:7392
- C:\Windows\System\KWwJFpc.exe
  C:\Windows\System\KWwJFpc.exe
  2⤵
  PID:7660
- C:\Windows\System\qWoQQSI.exe
  C:\Windows\System\qWoQQSI.exe
  2⤵
  PID:7820
- C:\Windows\System\LnnTGAw.exe
  C:\Windows\System\LnnTGAw.exe
  2⤵
  PID:7988
- C:\Windows\System\brYdZxP.exe
  C:\Windows\System\brYdZxP.exe
  2⤵
  PID:8108
- C:\Windows\System\ScWPANt.exe
  C:\Windows\System\ScWPANt.exe
  2⤵
  PID:748
- C:\Windows\System\iRwgPtX.exe
  C:\Windows\System\iRwgPtX.exe
  2⤵
  PID:7508
- C:\Windows\System\szlRYag.exe
  C:\Windows\System\szlRYag.exe
  2⤵
  PID:7732
- C:\Windows\System\JpCVLYh.exe
  C:\Windows\System\JpCVLYh.exe
  2⤵
  PID:7864
- C:\Windows\System\rAUqWmk.exe
  C:\Windows\System\rAUqWmk.exe
  2⤵
  PID:8052
- C:\Windows\System\vSiGRQt.exe
  C:\Windows\System\vSiGRQt.exe
  2⤵
  PID:7780
- C:\Windows\System\AXgYzAa.exe
  C:\Windows\System\AXgYzAa.exe
  2⤵
  PID:8004
- C:\Windows\System\aUSCUJs.exe
  C:\Windows\System\aUSCUJs.exe
  2⤵
  PID:7288
- C:\Windows\System\ATVeXaJ.exe
  C:\Windows\System\ATVeXaJ.exe
  2⤵
  PID:7344
- C:\Windows\System\kvoRnUl.exe
  C:\Windows\System\kvoRnUl.exe
  2⤵
  PID:7916
- C:\Windows\System\wkuOIIq.exe
  C:\Windows\System\wkuOIIq.exe
  2⤵
  PID:7664
- C:\Windows\System\bwuvClN.exe
  C:\Windows\System\bwuvClN.exe
  2⤵
  PID:7544
- C:\Windows\System\kZIOQcJ.exe
  C:\Windows\System\kZIOQcJ.exe
  2⤵
  PID:8168
- C:\Windows\System\PYTnCyL.exe
  C:\Windows\System\PYTnCyL.exe
  2⤵
  PID:7592
- C:\Windows\System\ilYQeUG.exe
  C:\Windows\System\ilYQeUG.exe
  2⤵
  PID:8196
- C:\Windows\System\WRbkhMd.exe
  C:\Windows\System\WRbkhMd.exe
  2⤵
  PID:8212
- C:\Windows\System\lNYFCsp.exe
  C:\Windows\System\lNYFCsp.exe
  2⤵
  PID:8236
- C:\Windows\System\uJxWSRG.exe
  C:\Windows\System\uJxWSRG.exe
  2⤵
  PID:8256
- C:\Windows\System\JyFaEDC.exe
  C:\Windows\System\JyFaEDC.exe
  2⤵
  PID:8272
- C:\Windows\System\HohBHdx.exe
  C:\Windows\System\HohBHdx.exe
  2⤵
  PID:8288
- C:\Windows\System\iHsfjow.exe
  C:\Windows\System\iHsfjow.exe
  2⤵
  PID:8308
- C:\Windows\System\CBAGUPk.exe
  C:\Windows\System\CBAGUPk.exe
  2⤵
  PID:8324
- C:\Windows\System\WxiRFhS.exe
  C:\Windows\System\WxiRFhS.exe
  2⤵
  PID:8344
- C:\Windows\System\WFhOcZo.exe
  C:\Windows\System\WFhOcZo.exe
  2⤵
  PID:8360
- C:\Windows\System\YVVqvkz.exe
  C:\Windows\System\YVVqvkz.exe
  2⤵
  PID:8380
- C:\Windows\System\AFEgORN.exe
  C:\Windows\System\AFEgORN.exe
  2⤵
  PID:8396
- C:\Windows\System\NRZGDYY.exe
  C:\Windows\System\NRZGDYY.exe
  2⤵
  PID:8412
- C:\Windows\System\FkEtJrY.exe
  C:\Windows\System\FkEtJrY.exe
  2⤵
  PID:8432
- C:\Windows\System\flKDjqO.exe
  C:\Windows\System\flKDjqO.exe
  2⤵
  PID:8448
- C:\Windows\System\aSfnAwp.exe
  C:\Windows\System\aSfnAwp.exe
  2⤵
  PID:8464
- C:\Windows\System\YrSWBQp.exe
  C:\Windows\System\YrSWBQp.exe
  2⤵
  PID:8480
- C:\Windows\System\bnwPqlS.exe
  C:\Windows\System\bnwPqlS.exe
  2⤵
  PID:8536
- C:\Windows\System\fltGuFV.exe
  C:\Windows\System\fltGuFV.exe
  2⤵
  PID:8552
- C:\Windows\System\uRPsEGs.exe
  C:\Windows\System\uRPsEGs.exe
  2⤵
  PID:8568
- C:\Windows\System\aMDMYIj.exe
  C:\Windows\System\aMDMYIj.exe
  2⤵
  PID:8588
- C:\Windows\System\jlwWJjv.exe
  C:\Windows\System\jlwWJjv.exe
  2⤵
  PID:8712
- C:\Windows\System\bfNrOLU.exe
  C:\Windows\System\bfNrOLU.exe
  2⤵
  PID:8768
- C:\Windows\System\hBIkoCE.exe
  C:\Windows\System\hBIkoCE.exe
  2⤵
  PID:8816
- C:\Windows\System\lMMvPXx.exe
  C:\Windows\System\lMMvPXx.exe
  2⤵
  PID:8856
- C:\Windows\System\hmaFAMX.exe
  C:\Windows\System\hmaFAMX.exe
  2⤵
  PID:8876
- C:\Windows\System\OqSAmJd.exe
  C:\Windows\System\OqSAmJd.exe
  2⤵
  PID:8892
- C:\Windows\System\KEEoiHc.exe
  C:\Windows\System\KEEoiHc.exe
  2⤵
  PID:8908
- C:\Windows\System\zThoXcm.exe
  C:\Windows\System\zThoXcm.exe
  2⤵
  PID:8924
- C:\Windows\System\WXekqJX.exe
  C:\Windows\System\WXekqJX.exe
  2⤵
  PID:8940
- C:\Windows\System\jBbSBzI.exe
  C:\Windows\System\jBbSBzI.exe
  2⤵
  PID:8956
- C:\Windows\System\YwgjkpU.exe
  C:\Windows\System\YwgjkpU.exe
  2⤵
  PID:8972
- C:\Windows\System\OONpetY.exe
  C:\Windows\System\OONpetY.exe
  2⤵
  PID:8988
- C:\Windows\System\ghZKBAt.exe
  C:\Windows\System\ghZKBAt.exe
  2⤵
  PID:9004
- C:\Windows\System\DgdEmdn.exe
  C:\Windows\System\DgdEmdn.exe
  2⤵
  PID:9020
- C:\Windows\System\BKSKLov.exe
  C:\Windows\System\BKSKLov.exe
  2⤵
  PID:9036
- C:\Windows\System\nPjdacV.exe
  C:\Windows\System\nPjdacV.exe
  2⤵
  PID:9068
- C:\Windows\System\IOFiiOw.exe
  C:\Windows\System\IOFiiOw.exe
  2⤵
  PID:9084
- C:\Windows\System\PohmdRw.exe
  C:\Windows\System\PohmdRw.exe
  2⤵
  PID:9100
- C:\Windows\System\uMwxUdB.exe
  C:\Windows\System\uMwxUdB.exe
  2⤵
  PID:9116
- C:\Windows\System\ZuiefwU.exe
  C:\Windows\System\ZuiefwU.exe
  2⤵
  PID:9132
- C:\Windows\System\fZQKGWR.exe
  C:\Windows\System\fZQKGWR.exe
  2⤵
  PID:9148
- C:\Windows\System\roCalwt.exe
  C:\Windows\System\roCalwt.exe
  2⤵
  PID:9176
- C:\Windows\System\haNYSBA.exe
  C:\Windows\System\haNYSBA.exe
  2⤵
  PID:9192
- C:\Windows\System\XxgePOQ.exe
  C:\Windows\System\XxgePOQ.exe
  2⤵
  PID:9212
- C:\Windows\System\yJgycLx.exe
  C:\Windows\System\yJgycLx.exe
  2⤵
  PID:8032
- C:\Windows\System\tplVhhX.exe
  C:\Windows\System\tplVhhX.exe
  2⤵
  PID:8188
- C:\Windows\System\basLuvl.exe
  C:\Windows\System\basLuvl.exe
  2⤵
  PID:8496
- C:\Windows\System\AfBoQIT.exe
  C:\Windows\System\AfBoQIT.exe
  2⤵
  PID:8516
- C:\Windows\System\MDwKfqR.exe
  C:\Windows\System\MDwKfqR.exe
  2⤵
  PID:8524
- C:\Windows\System\DLqlMdu.exe
  C:\Windows\System\DLqlMdu.exe
  2⤵
  PID:8564
- C:\Windows\System\jgkHlmZ.exe
  C:\Windows\System\jgkHlmZ.exe
  2⤵
  PID:8644
- C:\Windows\System\vjAdSdA.exe
  C:\Windows\System\vjAdSdA.exe
  2⤵
  PID:8688
- C:\Windows\System\RuxsJcA.exe
  C:\Windows\System\RuxsJcA.exe
  2⤵
  PID:8708
- C:\Windows\System\uwIZwMZ.exe
  C:\Windows\System\uwIZwMZ.exe
  2⤵
  PID:8736
- C:\Windows\System\mYTjezm.exe
  C:\Windows\System\mYTjezm.exe
  2⤵
  PID:8752
- C:\Windows\System\llCtjJK.exe
  C:\Windows\System\llCtjJK.exe
  2⤵
  PID:8720
- C:\Windows\System\CicjPEj.exe
  C:\Windows\System\CicjPEj.exe
  2⤵
  PID:8704
- C:\Windows\System\POXkwvL.exe
  C:\Windows\System\POXkwvL.exe
  2⤵
  PID:8836
- C:\Windows\System\xLIgVWe.exe
  C:\Windows\System\xLIgVWe.exe
  2⤵
  PID:8840
- C:\Windows\System\wgfXcen.exe
  C:\Windows\System\wgfXcen.exe
  2⤵
  PID:8808
- C:\Windows\System\OgyShdQ.exe
  C:\Windows\System\OgyShdQ.exe
  2⤵
  PID:8916
- C:\Windows\System\pRffwPs.exe
  C:\Windows\System\pRffwPs.exe
  2⤵
  PID:8980
- C:\Windows\System\wAzQrfP.exe
  C:\Windows\System\wAzQrfP.exe
  2⤵
  PID:8848
- C:\Windows\System\zVLzAQe.exe
  C:\Windows\System\zVLzAQe.exe
  2⤵
  PID:9060
- C:\Windows\System\AadBGuj.exe
  C:\Windows\System\AadBGuj.exe
  2⤵
  PID:7968
- C:\Windows\System\SBjcNJI.exe
  C:\Windows\System\SBjcNJI.exe
  2⤵
  PID:9124
- C:\Windows\System\fSOqDAz.exe
  C:\Windows\System\fSOqDAz.exe
  2⤵
  PID:8900
- C:\Windows\System\qVuwDMX.exe
  C:\Windows\System\qVuwDMX.exe
  2⤵
  PID:8964
- C:\Windows\System\vPeiMUY.exe
  C:\Windows\System\vPeiMUY.exe
  2⤵
  PID:9028
- C:\Windows\System\cmOpbGr.exe
  C:\Windows\System\cmOpbGr.exe
  2⤵
  PID:9108
- C:\Windows\System\gZLuzly.exe
  C:\Windows\System\gZLuzly.exe
  2⤵
  PID:9140
- C:\Windows\System\MVeQslp.exe
  C:\Windows\System\MVeQslp.exe
  2⤵
  PID:9200
- C:\Windows\System\IBJojHs.exe
  C:\Windows\System\IBJojHs.exe
  2⤵
  PID:8088
- C:\Windows\System\Yiwqmnc.exe
  C:\Windows\System\Yiwqmnc.exe
  2⤵
  PID:8152
- C:\Windows\System\ALQgLCs.exe
  C:\Windows\System\ALQgLCs.exe
  2⤵
  PID:7936
- C:\Windows\System\uZoUCwl.exe
  C:\Windows\System\uZoUCwl.exe
  2⤵
  PID:6828
- C:\Windows\System\GDCvYHE.exe
  C:\Windows\System\GDCvYHE.exe
  2⤵
  PID:8224
- C:\Windows\System\EBNnTaQ.exe
  C:\Windows\System\EBNnTaQ.exe
  2⤵
  PID:8376
- C:\Windows\System\JbWucYJ.exe
  C:\Windows\System\JbWucYJ.exe
  2⤵
  PID:8356
- C:\Windows\System\pwuJBCH.exe
  C:\Windows\System\pwuJBCH.exe
  2⤵
  PID:8428
- C:\Windows\System\YXZLFzC.exe
  C:\Windows\System\YXZLFzC.exe
  2⤵
  PID:8472
- C:\Windows\System\tZqcwKQ.exe
  C:\Windows\System\tZqcwKQ.exe
  2⤵
  PID:8264
- C:\Windows\System\iDXgmyK.exe
  C:\Windows\System\iDXgmyK.exe
  2⤵
  PID:8280
- C:\Windows\System\nOgECRL.exe
  C:\Windows\System\nOgECRL.exe
  2⤵
  PID:8296
- C:\Windows\System\uwrDYnI.exe
  C:\Windows\System\uwrDYnI.exe
  2⤵
  PID:8336
- C:\Windows\System\bbRIiXK.exe
  C:\Windows\System\bbRIiXK.exe
  2⤵
  PID:8504
- C:\Windows\System\cWmkDBq.exe
  C:\Windows\System\cWmkDBq.exe
  2⤵
  PID:8532
- C:\Windows\System\ulfibAa.exe
  C:\Windows\System\ulfibAa.exe
  2⤵
  PID:8600
- C:\Windows\System\LSvmJOG.exe
  C:\Windows\System\LSvmJOG.exe
  2⤵
  PID:8604
- C:\Windows\System\EMQoDun.exe
  C:\Windows\System\EMQoDun.exe
  2⤵
  PID:8624
- C:\Windows\System\IJtGXUT.exe
  C:\Windows\System\IJtGXUT.exe
  2⤵
  PID:8640
- C:\Windows\System\binfEfB.exe
  C:\Windows\System\binfEfB.exe
  2⤵
  PID:8676
- C:\Windows\System\fMvyHoh.exe
  C:\Windows\System\fMvyHoh.exe
  2⤵
  PID:8696
- C:\Windows\System\WrtnZxL.exe
  C:\Windows\System\WrtnZxL.exe
  2⤵
  PID:8784
- C:\Windows\System\jyqkfhg.exe
  C:\Windows\System\jyqkfhg.exe
  2⤵
  PID:8936
- C:\Windows\System\xGKziCX.exe
  C:\Windows\System\xGKziCX.exe
  2⤵
  PID:8244
- C:\Windows\System\yuTaPrp.exe
  C:\Windows\System\yuTaPrp.exe
  2⤵
  PID:8316
- C:\Windows\System\xxOeWgk.exe
  C:\Windows\System\xxOeWgk.exe
  2⤵
  PID:9172
- C:\Windows\System\yGCjULB.exe
  C:\Windows\System\yGCjULB.exe
  2⤵
  PID:8300
- C:\Windows\System\rTDfwMB.exe
  C:\Windows\System\rTDfwMB.exe
  2⤵
  PID:9000
- C:\Windows\System\PXFBrVk.exe
  C:\Windows\System\PXFBrVk.exe
  2⤵
  PID:8368
- C:\Windows\System\ZjkaiQY.exe
  C:\Windows\System\ZjkaiQY.exe
  2⤵
  PID:8748
- C:\Windows\System\UQNDMkt.exe
  C:\Windows\System\UQNDMkt.exe
  2⤵
  PID:9016
- C:\Windows\System\GpVbjQM.exe
  C:\Windows\System\GpVbjQM.exe
  2⤵
  PID:8476
- C:\Windows\System\nHSQAuI.exe
  C:\Windows\System\nHSQAuI.exe
  2⤵
  PID:8444
- C:\Windows\System\bMRsMPD.exe
  C:\Windows\System\bMRsMPD.exe
  2⤵
  PID:8948
- C:\Windows\System\GEubgMJ.exe
  C:\Windows\System\GEubgMJ.exe
  2⤵
  PID:8744
- C:\Windows\System\wRAVAOK.exe
  C:\Windows\System\wRAVAOK.exe
  2⤵
  PID:9056
- C:\Windows\System\MmnHKtz.exe
  C:\Windows\System\MmnHKtz.exe
  2⤵
  PID:8824
- C:\Windows\System\frDNwXF.exe
  C:\Windows\System\frDNwXF.exe
  2⤵
  PID:7900
- C:\Windows\System\AWVVKuF.exe
  C:\Windows\System\AWVVKuF.exe
  2⤵
  PID:8424
- C:\Windows\System\eFhPmgY.exe
  C:\Windows\System\eFhPmgY.exe
  2⤵
  PID:8692
- C:\Windows\System\tfqDrIy.exe
  C:\Windows\System\tfqDrIy.exe
  2⤵
  PID:8728
- C:\Windows\System\uPdyNMX.exe
  C:\Windows\System\uPdyNMX.exe
  2⤵
  PID:8672
- C:\Windows\System\zxLfHDM.exe
  C:\Windows\System\zxLfHDM.exe
  2⤵
  PID:7580
- C:\Windows\System\eLAiDND.exe
  C:\Windows\System\eLAiDND.exe
  2⤵
  PID:9156
- C:\Windows\System\uIYuAQu.exe
  C:\Windows\System\uIYuAQu.exe
  2⤵
  PID:1768
- C:\Windows\System\ZQUlQEx.exe
  C:\Windows\System\ZQUlQEx.exe
  2⤵
  PID:1576
- C:\Windows\System\BsMEKja.exe
  C:\Windows\System\BsMEKja.exe
  2⤵
  PID:9220
- C:\Windows\System\MogpXez.exe
  C:\Windows\System\MogpXez.exe
  2⤵
  PID:9236
- C:\Windows\System\WUnsjtV.exe
  C:\Windows\System\WUnsjtV.exe
  2⤵
  PID:9252
- C:\Windows\System\JzFJUXK.exe
  C:\Windows\System\JzFJUXK.exe
  2⤵
  PID:9272
- C:\Windows\System\ERHKIwM.exe
  C:\Windows\System\ERHKIwM.exe
  2⤵
  PID:9288
- C:\Windows\System\XbKBGib.exe
  C:\Windows\System\XbKBGib.exe
  2⤵
  PID:9304
- C:\Windows\System\gOFsMJM.exe
  C:\Windows\System\gOFsMJM.exe
  2⤵
  PID:9320
- C:\Windows\System\tpblDnL.exe
  C:\Windows\System\tpblDnL.exe
  2⤵
  PID:9388
- C:\Windows\System\VExGJbu.exe
  C:\Windows\System\VExGJbu.exe
  2⤵
  PID:9408
- C:\Windows\System\zKGJOYT.exe
  C:\Windows\System\zKGJOYT.exe
  2⤵
  PID:9428
- C:\Windows\System\uLczueA.exe
  C:\Windows\System\uLczueA.exe
  2⤵
  PID:9452
- C:\Windows\System\cziRHqb.exe
  C:\Windows\System\cziRHqb.exe
  2⤵
  PID:9476
- C:\Windows\System\DtegUoR.exe
  C:\Windows\System\DtegUoR.exe
  2⤵
  PID:9492
- C:\Windows\System\AKxaUWa.exe
  C:\Windows\System\AKxaUWa.exe
  2⤵
  PID:9508
- C:\Windows\System\lfpSSbI.exe
  C:\Windows\System\lfpSSbI.exe
  2⤵
  PID:9532
- C:\Windows\System\zsmOplk.exe
  C:\Windows\System\zsmOplk.exe
  2⤵
  PID:9548
- C:\Windows\System\aVYZUFk.exe
  C:\Windows\System\aVYZUFk.exe
  2⤵
  PID:9564
- C:\Windows\System\APEunNW.exe
  C:\Windows\System\APEunNW.exe
  2⤵
  PID:9580
- C:\Windows\System\CRrHACm.exe
  C:\Windows\System\CRrHACm.exe
  2⤵
  PID:9596
- C:\Windows\System\qlLoyGz.exe
  C:\Windows\System\qlLoyGz.exe
  2⤵
  PID:9612
- C:\Windows\System\PyeKfKE.exe
  C:\Windows\System\PyeKfKE.exe
  2⤵
  PID:9628
- C:\Windows\System\eNUGgxq.exe
  C:\Windows\System\eNUGgxq.exe
  2⤵
  PID:9644
- C:\Windows\System\FgnfIfM.exe
  C:\Windows\System\FgnfIfM.exe
  2⤵
  PID:9660
- C:\Windows\System\kZJYkWR.exe
  C:\Windows\System\kZJYkWR.exe
  2⤵
  PID:9676
- C:\Windows\System\othBTZh.exe
  C:\Windows\System\othBTZh.exe
  2⤵
  PID:9696
- C:\Windows\System\RDUItPa.exe
  C:\Windows\System\RDUItPa.exe
  2⤵
  PID:9712
- C:\Windows\System\RuTuXqZ.exe
  C:\Windows\System\RuTuXqZ.exe
  2⤵
  PID:9728
- C:\Windows\System\aivUrbA.exe
  C:\Windows\System\aivUrbA.exe
  2⤵
  PID:9744
- C:\Windows\System\xCVucDu.exe
  C:\Windows\System\xCVucDu.exe
  2⤵
  PID:9760
- C:\Windows\System\MXvaxIx.exe
  C:\Windows\System\MXvaxIx.exe
  2⤵
  PID:9776
- C:\Windows\System\uplKuDR.exe
  C:\Windows\System\uplKuDR.exe
  2⤵
  PID:9800
- C:\Windows\System\yDmagrY.exe
  C:\Windows\System\yDmagrY.exe
  2⤵
  PID:9820
- C:\Windows\System\ffMUDqc.exe
  C:\Windows\System\ffMUDqc.exe
  2⤵
  PID:9836
- C:\Windows\System\crIfPYI.exe
  C:\Windows\System\crIfPYI.exe
  2⤵
  PID:9852
- C:\Windows\System\mqEjtiX.exe
  C:\Windows\System\mqEjtiX.exe
  2⤵
  PID:9868
- C:\Windows\System\BjxOfOb.exe
  C:\Windows\System\BjxOfOb.exe
  2⤵
  PID:9884
- C:\Windows\System\UPajYIM.exe
  C:\Windows\System\UPajYIM.exe
  2⤵
  PID:9900
- C:\Windows\System\CVzYXDf.exe
  C:\Windows\System\CVzYXDf.exe
  2⤵
  PID:9924
- C:\Windows\System\BrAfRuY.exe
  C:\Windows\System\BrAfRuY.exe
  2⤵
  PID:9948
- C:\Windows\System\ghHpnUt.exe
  C:\Windows\System\ghHpnUt.exe
  2⤵
  PID:10028
- C:\Windows\System\qoqrFTq.exe
  C:\Windows\System\qoqrFTq.exe
  2⤵
  PID:10044
- C:\Windows\System\KBiNawS.exe
  C:\Windows\System\KBiNawS.exe
  2⤵
  PID:10064
- C:\Windows\System\YqbaYIM.exe
  C:\Windows\System\YqbaYIM.exe
  2⤵
  PID:10084
- C:\Windows\System\grCXnHO.exe
  C:\Windows\System\grCXnHO.exe
  2⤵
  PID:10104
- C:\Windows\System\ZcqDZvw.exe
  C:\Windows\System\ZcqDZvw.exe
  2⤵
  PID:10120
- C:\Windows\System\WeQNUGk.exe
  C:\Windows\System\WeQNUGk.exe
  2⤵
  PID:10136
- C:\Windows\System\ISUSEUR.exe
  C:\Windows\System\ISUSEUR.exe
  2⤵
  PID:10152
- C:\Windows\System\EGJSKAj.exe
  C:\Windows\System\EGJSKAj.exe
  2⤵
  PID:10172
- C:\Windows\System\PwqdywU.exe
  C:\Windows\System\PwqdywU.exe
  2⤵
  PID:10188
- C:\Windows\System\JSrZuvt.exe
  C:\Windows\System\JSrZuvt.exe
  2⤵
  PID:10204
- C:\Windows\System\YxWvRZi.exe
  C:\Windows\System\YxWvRZi.exe
  2⤵
  PID:10220
- C:\Windows\System\AOawYyS.exe
  C:\Windows\System\AOawYyS.exe
  2⤵
  PID:10236
- C:\Windows\System\aAWVXCs.exe
  C:\Windows\System\aAWVXCs.exe
  2⤵
  PID:8404
- C:\Windows\System\xVUOuwQ.exe
  C:\Windows\System\xVUOuwQ.exe
  2⤵
  PID:8492
- C:\Windows\System\oQlrfPT.exe
  C:\Windows\System\oQlrfPT.exe
  2⤵
  PID:8932
- C:\Windows\System\qMBedvp.exe
  C:\Windows\System\qMBedvp.exe
  2⤵
  PID:9328
- C:\Windows\System\FZvlwaF.exe
  C:\Windows\System\FZvlwaF.exe
  2⤵
  PID:9112
- C:\Windows\System\GFNZsXm.exe
  C:\Windows\System\GFNZsXm.exe
  2⤵
  PID:8580
- C:\Windows\System\SGVRdIL.exe
  C:\Windows\System\SGVRdIL.exe
  2⤵
  PID:8984
- C:\Windows\System\vRvaaLy.exe
  C:\Windows\System\vRvaaLy.exe
  2⤵
  PID:9264
- C:\Windows\System\IrBvVzM.exe
  C:\Windows\System\IrBvVzM.exe
  2⤵
  PID:9248
- C:\Windows\System\afBANvt.exe
  C:\Windows\System\afBANvt.exe
  2⤵
  PID:9316
- C:\Windows\System\mzWfKcY.exe
  C:\Windows\System\mzWfKcY.exe
  2⤵
  PID:9352
- C:\Windows\System\RHCxbJw.exe
  C:\Windows\System\RHCxbJw.exe
  2⤵
  PID:9368
- C:\Windows\System\NdHbbNd.exe
  C:\Windows\System\NdHbbNd.exe
  2⤵
  PID:9436
- C:\Windows\System\OthPvbV.exe
  C:\Windows\System\OthPvbV.exe
  2⤵
  PID:9484
- C:\Windows\System\GhLCGPG.exe
  C:\Windows\System\GhLCGPG.exe
  2⤵
  PID:8544
- C:\Windows\System\pxhRdev.exe
  C:\Windows\System\pxhRdev.exe
  2⤵
  PID:9656
- C:\Windows\System\VIhTTmn.exe
  C:\Windows\System\VIhTTmn.exe
  2⤵
  PID:9720
- C:\Windows\System\jlhLmHr.exe
  C:\Windows\System\jlhLmHr.exe
  2⤵
  PID:9788
- C:\Windows\System\rOzYIRe.exe
  C:\Windows\System\rOzYIRe.exe
  2⤵
  PID:9832
- C:\Windows\System\iEEzJtI.exe
  C:\Windows\System\iEEzJtI.exe
  2⤵
  PID:9416
- C:\Windows\System\iXbVOns.exe
  C:\Windows\System\iXbVOns.exe
  2⤵
  PID:9808
- C:\Windows\System\NSMWUjN.exe
  C:\Windows\System\NSMWUjN.exe
  2⤵
  PID:9540
- C:\Windows\System\sXQJbIw.exe
  C:\Windows\System\sXQJbIw.exe
  2⤵
  PID:9604
- C:\Windows\System\RSfqGDQ.exe
  C:\Windows\System\RSfqGDQ.exe
  2⤵
  PID:9672
- C:\Windows\System\JltKlXQ.exe
  C:\Windows\System\JltKlXQ.exe
  2⤵
  PID:9740
- C:\Windows\System\tEgpjLx.exe
  C:\Windows\System\tEgpjLx.exe
  2⤵
  PID:9816
- C:\Windows\System\xpYoXNy.exe
  C:\Windows\System\xpYoXNy.exe
  2⤵
  PID:9920
- C:\Windows\System\dPbNVaR.exe
  C:\Windows\System\dPbNVaR.exe
  2⤵
  PID:9972
- C:\Windows\System\BwWGXih.exe
  C:\Windows\System\BwWGXih.exe
  2⤵
  PID:9988
- C:\Windows\System\uqGungv.exe
  C:\Windows\System\uqGungv.exe
  2⤵
  PID:9932
- C:\Windows\System\ogtWXLI.exe
  C:\Windows\System\ogtWXLI.exe
  2⤵
  PID:9996
- C:\Windows\System\DSQStFS.exe
  C:\Windows\System\DSQStFS.exe
  2⤵
  PID:10012
- C:\Windows\System\rPYUoSl.exe
  C:\Windows\System\rPYUoSl.exe
  2⤵
  PID:10020
- C:\Windows\System\vVBYzsJ.exe
  C:\Windows\System\vVBYzsJ.exe
  2⤵
  PID:10092
- C:\Windows\System\aPnKMvu.exe
  C:\Windows\System\aPnKMvu.exe
  2⤵
  PID:10132
- C:\Windows\System\xoHtQJZ.exe
  C:\Windows\System\xoHtQJZ.exe
  2⤵
  PID:10164
- C:\Windows\System\LmaNBog.exe
  C:\Windows\System\LmaNBog.exe
  2⤵
  PID:10228
- C:\Windows\System\PolhRoP.exe
  C:\Windows\System\PolhRoP.exe
  2⤵
  PID:9232
- C:\Windows\System\GJrHmTv.exe
  C:\Windows\System\GJrHmTv.exe
  2⤵
  PID:8332
- C:\Windows\System\okWfqsJ.exe
  C:\Windows\System\okWfqsJ.exe
  2⤵
  PID:9364
- C:\Windows\System\xrvLCXa.exe
  C:\Windows\System\xrvLCXa.exe
  2⤵
  PID:9652
- C:\Windows\System\CFPkzJi.exe
  C:\Windows\System\CFPkzJi.exe
  2⤵
  PID:9420
- C:\Windows\System\RXPocKI.exe
  C:\Windows\System\RXPocKI.exe
  2⤵
  PID:10076
- C:\Windows\System\tucNzGg.exe
  C:\Windows\System\tucNzGg.exe
  2⤵
  PID:10040
- C:\Windows\System\yLbseNc.exe
  C:\Windows\System\yLbseNc.exe
  2⤵
  PID:10256
- C:\Windows\System\lmVqYtb.exe
  C:\Windows\System\lmVqYtb.exe
  2⤵
  PID:10276
- C:\Windows\System\oZbeijI.exe
  C:\Windows\System\oZbeijI.exe
  2⤵
  PID:10292
- C:\Windows\System\MgBvYdk.exe
  C:\Windows\System\MgBvYdk.exe
  2⤵
  PID:10316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BFMcyrR.exe

Path C:\Windows\system\BFMcyrR.exe
Size 3.0MB
SHA256 7a68602025abf4faad8dbec6cd1fc97ce8f8019065f8bd64d41133b860ca3b38
MD5 8409779b1acc8fc9762139f38c5c60a2
SHA1 6c8c33093ebec9c08537877cb4d2cd7ece9151e8
SHA512 3938c01f64d4f044100987ddeffb2ca16ca2a9ea59e6e1fd8ad6d4ba786a674c77df6108d284f39c92978a43df622363443ade4c56fa4d6395f524d283e61289
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c8:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FFDYypm.exe

Path C:\Windows\system\FFDYypm.exe
Size 3.0MB
SHA256 bd44e5540a78739e633fb206d550f37cb82c777a47481295ac585ebdcab87c15
MD5 af163b15a7c95b59148301023fb99ca3
SHA1 1ca05d6c3297712bcac7ba1c71b25d0ef642bae8
SHA512 1d1f39f51ca30a13b7129218db672df4aab6fd0438f4dc01e755148031e8d9feb0b26313730f86a7de20867f1b191961c97852bab3defd7c2df731dfc04abc64
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cM:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RU
MD5 SHA1 SHA512 SSDEEP

Submit Download

FPwuiwM.exe

Path C:\Windows\system\FPwuiwM.exe
Size 3.0MB
SHA256 2beab26e885fe9b313431eb9eee194eb93ac3eceb9fd4293ca151362b2e93519
MD5 6ef9e590bc343d8bde8375daaad165a0
SHA1 18c4feb12be5501bb9432d3324f1bd24c9310a42
SHA512 8524b94127bc1505a25e539bb24bc9952c42e46fca6efdead5885dd042b8d43d5d9efd6ba7d8f22859bc5c1c949810b2d7b31602c32dd070bfd07fe340ebbe82
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cb:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSTSdTt.exe

Path C:\Windows\system\FSTSdTt.exe
Size 3.0MB
SHA256 12f9261a0ab85d61ee273b1e962c51ce4296b30a9e930ac327c3f24d7b5fee77
MD5 46e740541d00e193a8a067ec85645208
SHA1 6cdb7428391cc3176d77cae1638fbc959680f508
SHA512 efab99cba614b192ce7c68dc45034bf0d4dd40acce842553664d248ea0bdc34e81fd7343664904b9185e8c4d0ad450c45d263377d243434d47ddd7c6c3b7c8a3
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cG:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RO
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHtkoia.exe

Path C:\Windows\system\GHtkoia.exe
Size 3.0MB
SHA256 047236b8bbdb178a16dacf339f360168fe3ce4256241c0b3538171f4d5e2915c
MD5 d403c410a6af2839dda595bfa5af95d2
SHA1 5faad4d7a5426fda8d8a7082d9b30ec518f5b2f3
SHA512 7f48189de970f569bd76a1af7b469f6d82ff340983098d2f0412a106e741398412399574e956f6271ae7b31f405e6a79dd256b65b69ef04abf2e7defd2515984
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c+:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

HFFqGAO.exe

Path C:\Windows\system\HFFqGAO.exe
Size 3.0MB
SHA256 7b72d05a6c373288a17fba87ee5cc6b35b02d640ebda83fe582cc7e7abd61bd4
MD5 f2b608f64883d8f006a06e1bd845545f
SHA1 a365a72c4c23ab833d55a9cc6e0483b1a685349d
SHA512 731d3a29a83256490095c77d5182d7ca413748afef8351f86d998dcf3e1efd0e141c144a6cccdb6091dd97dbd3fb28df6ec412749fd38775cf07aab5e1566c24
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ct:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rl
MD5 SHA1 SHA512 SSDEEP

Submit Download

HidRuWA.exe

Path C:\Windows\system\HidRuWA.exe
Size 3.0MB
SHA256 1cc4e1c212ad19e95e803c94a6ad289dd28ded928b9b7d5cfe0ff4fc357e2c36
MD5 1579497d105632ec65c764ec5a2282ee
SHA1 01f671fe0b24c8df61a3fd89d7bf0ce6089729d4
SHA512 fdef459963faa3a5c5069c678f3731d5ccc24934dfa80e3c24906ce32559fa5289e8008da372fd5053b299dc36d59a862c260d4668063bc5b89823f5f3199fd6
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ca:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

INkCBwW.exe

Path C:\Windows\system\INkCBwW.exe
Size 3.0MB
SHA256 d855ff1809eae38e4609cbb4b2f7b145e76fa6376f5341108fb4563814cec5f1
MD5 4f4cfc6eef6fcb779ad740c8861e8985
SHA1 5d6eed4f6dc245250ab707e51d12cb2b6c7d66ca
SHA512 bf3548f4ba4d36efdc830ca92d6f6c17e39021ec3945c121c1260713817f813e501f421e037d0b005b3b9105a33ff1b430a6770048df093eab1ea41ca17e0c64
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cz:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R7
MD5 SHA1 SHA512 SSDEEP

Submit Download

IsNEfXG.exe

Path C:\Windows\system\IsNEfXG.exe
Size 3.0MB
SHA256 3abf9e29abe91e1707112777df0c6736c6f8efc6d7fd39e7fac25d436aca9de3
MD5 a1016509890dafe554ca11913256a396
SHA1 89940e2442ff52da3c2feeb9cebb89acd7337850
SHA512 1aa146c5de1d138dfe8d2ef497b8a57e29afa9a17b37e093a40f97f76908b70c77b50ae37fc04020f4699938691faf219ff38f6b2ce10400e0d490d4e5ff837b
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cr:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

MmCvuME.exe

Path C:\Windows\system\MmCvuME.exe
Size 3.0MB
SHA256 c415de97fdeaf6cb01b13f887c5973a472f9294d5f175e3ac95e0bf0f80cbe95
MD5 24864cb704ae1e0310fdd4ee88571b7d
SHA1 9b29c619f1951ffe62978a2983c5fc0fc9d2b31c
SHA512 ede8b515d92ca5279e24a8edc8ab04ab2b199f55d175db17cfc618f208e2cf5ce73cb5b97152351ea39dc984092a72952a8b3130b32a68780d92a56e267abb53
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cS:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

RcnEbMV.exe

Path C:\Windows\system\RcnEbMV.exe
Size 3.0MB
SHA256 53f6999b01caa4bfc8d3bd898f3a7c402a06f516998756a84884ed6bd45e8912
MD5 2f9bad68e60178bc8a8af510c17fe55a
SHA1 6c53c6cc57cd9210c83fc9746355b8276b013f0d
SHA512 bc70c35e4805e4b44151a39d267179629be2987cfe70bc8f923c8af7869715350a88c8553082d5679909adf2f949d2d6f8c44e115bd4c1fa2dda9bcd1ab4e8d0
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cF:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R9
MD5 SHA1 SHA512 SSDEEP

Submit Download

SLpjGBC.exe

Path C:\Windows\system\SLpjGBC.exe
Size 3.0MB
SHA256 21cecc0a6dd2c7aa81df819636c9690f347ee613864ed8de95a0cc3b85f061b0
MD5 ed018a0890c4c4ea88dea84f93aa07eb
SHA1 5ef997110a7c349339c322632051e9752c3f8407
SHA512 275aad426c15df45ba8e9e83275ca1050e96537fe0b4c1d50533bddde5d899f4abb484f7476f9238c25fd1bb4328edc8c4cbd1a30c77f4ae85f860275d87e57f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cL:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SYGbFnD.exe

Path C:\Windows\system\SYGbFnD.exe
Size 18B
SHA256 2919f5d8dd5986d9f526c9a7657a6044cc4722033b9b179436129a1b2c29a7ef
MD5 b02e9d05e686e129bef05d00ff5203c3
SHA1 e698aa4adc847d754b01445cc92d3a936eccd81f
SHA512 497cfb1093b4d57bd1ca17f696a7734788d13484dbf26768c2397dc958c254adf1d920ff41694a8e8f487ef695df48cfa4dee2cc40c4be8b8dc4c01a0c0839c3
MD5 SHA1 SHA512

Submit Download

SlPauNv.exe

Path C:\Windows\system\SlPauNv.exe
Size 3.0MB
SHA256 35bbcf7347c9106ba7654df99f98fc0670a4d2f2b651c9f493e968c34c843900
MD5 5bdd5839a98e6fcb8c711bb63feced02
SHA1 3c7b548682dda8f7a6918b318f8d852b9bfb4251
SHA512 9c0b639f54dd30593c6e8e21e55f7c013386fe74afc3e69cc40db5bc5fe8d950283452d9a758f4c64ec20928cbf8061f3ea22229aa384787b13c3702929ed3b7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cu:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSujjVl.exe

Path C:\Windows\system\VSujjVl.exe
Size 3.0MB
SHA256 ca1ffc223d68a2191114e19c1be4343840bf79f523aa477840fa08806f7791b7
MD5 330588222188740bea57c57fef92199a
SHA1 4186d0a3e0ee205b957daf5eb1d591da89efad06
SHA512 ab7ded01bfb4eede22e2ae640dbabc2e4127a2c64c51c30d50471063a9542e0031deef3fa8e75b1a54e0006e61afd7803e0f0b46c63d5fb6d5fb73891cd73a21
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WdJoYVZ.exe

Path C:\Windows\system\WdJoYVZ.exe
Size 3.0MB
SHA256 1f9a0ca26e2b47b72d465885df7916e3e05c122509e27160aa198ebaaa7a34a1
MD5 5be48ba1a7aa76069c9ebb0de426aaef
SHA1 95bc5578015bf33247a176fa4ee5bc4c8af94ae6
SHA512 c92597c0fe082b625c7c34848b83ffda89a759e8908295acb7a3dc10a35bdcd802b8b17c7db6184f23e09802565af6d3cc3a6cf4e6d681899d2a769aec198095
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c9:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmcAihU.exe

Path C:\Windows\system\WmcAihU.exe
Size 3.0MB
SHA256 d9346e0cbf1798d7f6811d55adc620157a208d3ffe599a1825ba8e87c75e9008
MD5 048f46e03ff0b5ccc6733315ba1db387
SHA1 183fa3a1bf6be3ed683a539f39aa7a5b08035aee
SHA512 29ac7736a54175503f66fb213624357496019e42b19e9781e3c40b4170b81d5ff514cbb3604af48926ab461779b3952a6dd3d5618e85ca11739e107f7f0eab75
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cW:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ru
MD5 SHA1 SHA512 SSDEEP

Submit Download

WqRKGWa.exe

Path C:\Windows\system\WqRKGWa.exe
Size 3.0MB
SHA256 7ae57daece75c2dda690d195e1f64d3d6423855ebfd37e5e9ca5d7345177331b
MD5 4e858077d8491dd33131a85a0df6fab4
SHA1 8f6433c71eb7b23facf13c939133f4cacf86e775
SHA512 3f1ee9ed0166df58cf3ca42ab4130a3cdd3562a7b081bc476ea6509a942d483d974028614d3bbd981580248a907ce33f557acbad1cbad9cb6822dd6ad6a27652
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cC:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

azaznRp.exe

Path C:\Windows\system\azaznRp.exe
Size 3.0MB
SHA256 b908eb0b97a13e1d59378eebb3b6cc6c7d5957c558be49cad8919dbefef6ec1c
MD5 df0dddbbe0e1d38f090084738e078715
SHA1 48c537768f9b7d64640e9b49becd3e6ba3211a17
SHA512 df8ac5a2450476a51bcfe876eb2bac4d540ab6d96c0e494bc58d570f424fbdcacd7c0a998c18f9d0636ebb598fdbea773dbad96feed1dc61f1c4dc32906836da
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ck:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Submit Download

cabFgaq.exe

Path C:\Windows\system\cabFgaq.exe
Size 3.0MB
SHA256 ae9c91c868dea08b490e86316a97b50653949e3f54f80c612f8b054bfa52a2fe
MD5 88ced5b0a9a385f48386a8d8b75489c3
SHA1 30dbc44695e132ffdd52f025dfb8b79f3fd480ab
SHA512 cb26c3c7684214207a06f361f693b8699e10eeecf752412527dda7cf704a588e10a5d9dc2967160d3889a5c83b8efb9ef8814d7721a8ad0f0a5ee3427b4b6c57
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c/:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RH
MD5 SHA1 SHA512 SSDEEP

Submit Download

dXjxrCl.exe

Path C:\Windows\system\dXjxrCl.exe
Size 3.0MB
SHA256 abf87cc299ce3669fee1d168ae4535345c8846582bde99df5e9aec089b78c261
MD5 24bc642357cca8df045c179507a84f30
SHA1 992b79ba922cbc558912b6a71fe6f50f29f59ba3
SHA512 8037c3d7bac9753f19be2d57697d72f5aa520e9c6fa88faae786ec9d1706a5ae4a8c4b6c838b5113a11aeb76186871816b8efbba808bc529da7c1d87b7f59623
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cZ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

fHyKlrG.exe

Path C:\Windows\system\fHyKlrG.exe
Size 3.0MB
SHA256 7cf02d3a69eac9265815e09d9c9b64b0cc7b520aae58cb3701091525797baf3c
MD5 42d7b8a6684496eb0f63be311394c39c
SHA1 b7f3e55b751ec8e37455fc989ee0ce86c37173d8
SHA512 7888ad52ae0c312438bdf1b0a3d7c6948a8c796a5211c0d1fac3696dae5c5efe3fc2893174490ab73824b32fa0ffa7ed12961991731f608a2d7ef541abc3be19
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cd:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

kpIifEn.exe

Path C:\Windows\system\kpIifEn.exe
Size 3.0MB
SHA256 84d96d815809010f11b862b38bf8ac2b278b6138aea310241a62cb0231ba5eba
MD5 c8f661549b49ef31a52c9aec8514435f
SHA1 573bfbaeb8485024df111b637825a1aeec7af79a
SHA512 e27d8ac996c8ea16ad5eadfb7150a35bcc2f62e010d555773a77bd1e3d389ddce824e9d7abeff5ebf48987ab0a05fe58136e4e5780bea7abf4b309c28568487f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cv:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

lqvBqkM.exe

Path C:\Windows\system\lqvBqkM.exe
Size 3.0MB
SHA256 2228a8be26552745c4a33489e469a2a4fe112eae9e733f612702a34572b95f85
MD5 feb14cdb554da4a9d2db1d0cc766b493
SHA1 cc18f82cfc2545ef80fc7efb0ca703c31e3228cd
SHA512 30a110fa08d4060511a5129d101125f6baecf78b401e4cceae40ad883a859876326d3b8ba2ce583cd3a4faaa7ac6836a65cce689ff89e37d17c5bbf4dee83a6a
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

pHbEZVr.exe

Path C:\Windows\system\pHbEZVr.exe
Size 3.0MB
SHA256 101faf68a0b7cbe02b28dbf5053f9293e9b1a9ad9223addbe445a174c6d8e629
MD5 ddb19d44a80271d0e5be15a48bb91b3a
SHA1 f17fe7398344dcda83ed30ca63baf8cffcf2edfa
SHA512 11299125d76650df826658d625c29f6bd81736d1bb040b6197dd2ac416f5ab8953aeffedcd53da1339acd8b8539e57bedeb6d4cd5c7b3a0778214941a54592f9
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ca:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsufpdO.exe

Path C:\Windows\system\qsufpdO.exe
Size 3.0MB
SHA256 34ea0d651857f0acc00fd893bf61fdd5d361a81ed231994c46041680bf76cc7b
MD5 a96a43d363a7e1ce502034ef93692d67
SHA1 69ae407bd9dbb69a5b0360e455ee526065ac10c7
SHA512 972bebf50965980b8431dac88bcee1ffeb4ea441280356784ab2e6cfc95fd374cd2a4242e0e1a697d7246db165182e7ada8c4d1fa1b9a2a7ed884fbfb9ccd529
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ce:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

raVQNjc.exe

Path C:\Windows\system\raVQNjc.exe
Size 3.0MB
SHA256 00a222db5ee24d81a4dc7994e8d81070fdde8859e0a839ffbd3a29fd65939ba2
MD5 dbaae60d1f0296376617b494c243c738
SHA1 bff185be2ba6948b44602489a1275a87d4ce4152
SHA512 4366ffe0a445d266adf7a6499083d11fb2240a2a7df788da6e53b05e23f722a7adf00111d3ff284abeab6e204d3ddfdb3b50c562bfb412b62f06277f9dc48b47
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5ct:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

spYmkBN.exe

Path C:\Windows\system\spYmkBN.exe
Size 8B
SHA256 35ac8b6a943f09a1cde24cd02afff8a0c7d652f165d54e16f6413276f4896cb0
MD5 910de5e4823f1b594342aaa45a243c27
SHA1 e685fe344492ae089d7952151010d07f38420dbc
SHA512 734b56228ae9283d7a41492191ea523ba29a1fabe1bd71428c57f89031a65c2affd92f940176ff946aa90efb62794a49b666566dba8320bb35feeeb83e9c2a4f
MD5 SHA1 SHA512

Submit Download

upznrTH.exe

Path C:\Windows\system\upznrTH.exe
Size 3.0MB
SHA256 cb39e33ebaa3599ae8fd47f44d46d3e8865ceb277846dce4df960a3a1c6ceca0
MD5 58e97755a18c60b3043f60e8530d0687
SHA1 19aa4d414a999b6bab31c14ee3d8af0ad83a7152
SHA512 975727182b0c13b7a1e68d7931aebb069f1f0629b8d5416c3e30d516d912a491f7c7d1ad7fd8bc4be9377aebaaab6b99682c2a2b0a30eaba2a69d2feb3286ced
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cN:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xigmjOG.exe

Path C:\Windows\system\xigmjOG.exe
Size 3.0MB
SHA256 aa4bbd0e76c93e19c21c99e8c538c3ece6d1010b2c21dfeaae05734f685feb2b
MD5 cf318123b8d6e2819ad1ec84679f6575
SHA1 dcc27433705dae54d09eadb42924fa023add9ae0
SHA512 79fc1da27a5dca713b3f4937c58fdf57609c2fe5d0d5902d2a97023661c3fcfd8092698adadfa2b96b69275683f420c5e3cee1d377b6ebfa1596b588ac0749bd
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

SfOeKpQ.exe

Path \Windows\system\SfOeKpQ.exe
Size 3.0MB
SHA256 b753f5058d0e2fcdcb52088f843d14f15a4c146a677f1b655c5f1b3218da0f57
MD5 6896053e2484c254d0b44d2e49cb89f0
SHA1 0f81d8d42ca095af9a0cdc07f08480ac36611779
SHA512 1d556c25f1023e80b91dfee8722df8785408a7d42d828b77d02f65dcdf4fe643e7145af2858b740fc3a6b2ceabba805226d53c250f377596b3aba4b64d8fc26f
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cX:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

YMoVqdw.exe

Path \Windows\system\YMoVqdw.exe
Size 3.0MB
SHA256 27ea5eb613bcea98a7d2ae58d29ac2e5ff40b6d0d7111ca21a1cf6c471508b44
MD5 5f675679ee95c1e93d31c28b1b04bd97
SHA1 c86c42bd2af4489c8aa129607d2fdb7df995d1f8
SHA512 2e33b65f15dc409953ec1889c4cae32c5c150e569d4874ff6dc22697decb32d729885cae56f1aedf25f5932df2fe32a1ca2c43db64b08d7a882a71e72f694df7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5c7:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RT
MD5 SHA1 SHA512 SSDEEP

Submit Download

eyopNxb.exe

Path \Windows\system\eyopNxb.exe
Size 3.0MB
SHA256 371a87c9eedf47ddc677e65bd85faa15b1d067e8c50423b373cf43c04e1d5b4f
MD5 bc776d23f80926e2851c5b2d1f192a1f
SHA1 b37d4e5aa9fb171eb66b0c89805c5490fffffad5
SHA512 e9f7aaf7d86c8c91ce352d6ce61891522e8272df91052528001af3ee4a00611f0e8fcfd6c80e8507314d16f9057705ca883f4c357812d8ed26b614bc6b4b0f39
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cJ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

umdHwSA.exe

Path \Windows\system\umdHwSA.exe
Size 3.0MB
SHA256 b758fcd1f2b9408206a6bc9668a8284ff94ccae1c418618bfac62f4f2e4fa9e9
MD5 93f1ab3da681c11598e6594e91e45eb2
SHA1 c6a2ab2b8ce0758053c26c184225c0110db9c07b
SHA512 0960c9e806ed4c735c8d6880e150d7d80d8e9cb642b151894c623ed0826d9f2482d636c30a5b69a3444ed9ea26657684250b063b4df57ab00e7082372619b4c7
SSDEEP 49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdgIZohteb5cS:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1276-93-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-0-0x0000000000080000-0x0000000000090000-memory.dmp

Download

memory/1276-18-0x000000013FAE0000-0x000000013FED6000-memory.dmp

Download

memory/1276-23-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-8-0x0000000002DB0000-0x00000000031A6000-memory.dmp

Download

memory/1276-139-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-8113-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-135-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-2814-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Download

memory/1276-1-0x000000013F3B0000-0x000000013F7A6000-memory.dmp

Download

memory/1276-116-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-8079-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-114-0x000000013FE30000-0x0000000140226000-memory.dmp

Download

memory/1276-97-0x0000000003600000-0x00000000039F6000-memory.dmp

Download

memory/1276-111-0x000000013FF40000-0x0000000140336000-memory.dmp

Download

memory/1276-129-0x000000013FE60000-0x0000000140256000-memory.dmp

Download

memory/1276-109-0x000000013F860000-0x000000013FC56000-memory.dmp

Download

memory/1380-9-0x000000013F030000-0x000000013F426000-memory.dmp

Download

memory/1640-20-0x0000000002F10000-0x0000000002F90000-memory.dmp

Download

memory/1640-82-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

Download

memory/1640-98-0x0000000002390000-0x0000000002398000-memory.dmp

Download

memory/1640-61-0x000000001B820000-0x000000001BB02000-memory.dmp

Download

memory/1640-134-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

Download

memory/1640-1060-0x000007FEF5670000-0x000007FEF600D000-memory.dmp

Download

memory/1640-21-0x000007FEF592E000-0x000007FEF592F000-memory.dmp

Download

memory/1748-138-0x000000013F640000-0x000000013FA36000-memory.dmp

Download

memory/1748-8000-0x000000013F640000-0x000000013FA36000-memory.dmp

Download

memory/2524-110-0x000000013F860000-0x000000013FC56000-memory.dmp

Download

memory/2524-7948-0x000000013F860000-0x000000013FC56000-memory.dmp

Download

memory/2528-132-0x000000013FE60000-0x0000000140256000-memory.dmp

Download

memory/2588-113-0x000000013FF40000-0x0000000140336000-memory.dmp

Download

memory/2588-7997-0x000000013FF40000-0x0000000140336000-memory.dmp

Download

memory/2612-7961-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Download

memory/2612-90-0x000000013F6F0000-0x000000013FAE6000-memory.dmp

Download

memory/2708-7992-0x000000013F790000-0x000000013FB86000-memory.dmp

Download

memory/2708-108-0x000000013F790000-0x000000013FB86000-memory.dmp

Download

memory/2732-19-0x000000013FAE0000-0x000000013FED6000-memory.dmp

Download

memory/2732-4722-0x000000013FAE0000-0x000000013FED6000-memory.dmp

Download

memory/2960-7963-0x000000013F160000-0x000000013F556000-memory.dmp

Download

memory/2960-96-0x000000013F160000-0x000000013F556000-memory.dmp

Download

memory/2976-7989-0x000000013F050000-0x000000013F446000-memory.dmp

Download

memory/2976-122-0x000000013F050000-0x000000013F446000-memory.dmp

Download

memory/3012-7952-0x000000013FE30000-0x0000000140226000-memory.dmp

Download

memory/3012-115-0x000000013FE30000-0x0000000140226000-memory.dmp

Download