xmrig | 8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
Size

1.9MB
MD5

f9c9f6aeeb752f92f9d101631f868fb0
SHA1

f2f2e30dd504cb4ba6a1c8c59eeba91ae21f4231
SHA256

8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c
SHA512

029f4947c25dcbff218a87a3ea48f8d048137d2b61c17c31af5cf332801dc72492b0664dd894f71cb2b16bf8b9d0f542118db4d690575f65912924c7e1c945cf
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTmo6OZXbPbPIdkq8T91EQQsA6:Lz071uv4BPMkiFGlvETbvpEy6gbn

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/3028-17-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2688-33-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/3064-32-0x000000013F240000-0x000000013F632000-memory.dmp	xmrig
behavioral1/memory/2840-179-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2624-177-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/1960-175-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2288-173-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2980-171-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2660-169-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2576-167-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2532-165-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2772-163-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/1704-1573-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2288-4091-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2660-4093-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2624-4095-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2532-4094-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2772-4216-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/1960-4512-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2576-4519-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2840-4627-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2980-4880-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2392	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3028	KKmZwnX.exe
3064	PNBoKRm.exe
2688	gnjZHMN.exe
2772	ydSLuqD.exe
2532	VoVfJlA.exe
2576	TuCkGmY.exe
2660	DVUHdyN.exe
2980	LsQuZMa.exe
2288	DOzdBkT.exe
1960	GCGZWhT.exe
2624	AIIRsPI.exe
2840	NXfhXmi.exe
2848	riNLAvk.exe
2888	ASXjnao.exe
1984	uunCQaL.exe
1980	egNSkPk.exe
1956	ZZCWizA.exe
2020	rMFWxnE.exe
2464	YfmiicI.exe
2496	ggQjcWC.exe
2180	lRXKPNT.exe
828	zaEqMpV.exe
2460	dEfvCUk.exe
1664	LDsZUwv.exe
1660	xuxMiDr.exe
1772	sSCVPDn.exe
2308	iUCxaGP.exe
2728	obfEWZX.exe
2212	QUlZuRj.exe
668	JWexIdX.exe
1524	pcnkcSJ.exe
1672	bzJQqtQ.exe
2300	SEujuIt.exe
1752	KQKOvhB.exe
1496	imAolzj.exe
1780	YKWVsJc.exe
1644	UGNzGUZ.exe
1368	MIBOfIC.exe
1872	eQvdpor.exe
2120	yqAYFvs.exe
2468	GMYmQaN.exe
932	dkDGzZv.exe
2312	nocEOUZ.exe
2072	apnKqtF.exe
2944	yVPrZUH.exe
576	nYLqngZ.exe
1164	yrGamJv.exe
2316	IXRJloL.exe
1748	DGXRNgg.exe
896	LQgZKOP.exe
2492	QMOTZzH.exe
1948	MczroCG.exe
1556	plVFkFw.exe
2184	ZBwQlQh.exe
2628	nUTIchN.exe
2744	rCHFcNA.exe
3048	BONTcDC.exe
540	TJcojPV.exe
2664	MxzqEuO.exe
2560	xVJQlSA.exe
2588	seDhnMu.exe
2600	OlkAWOf.exe
1712	fqOZvmP.exe
2520	dAHaHHe.exe

Loads dropped DLL 64 IoCs

pid	Process
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1704-0-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x000b00000001226d-6.dat	upx
behavioral1/files/0x00350000000149d0-12.dat	upx
behavioral1/memory/3028-17-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x0008000000015038-22.dat	upx
behavioral1/memory/1704-35-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x000f000000003683-34.dat	upx
behavioral1/memory/2688-33-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/3064-32-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/files/0x00080000000153fd-43.dat	upx
behavioral1/files/0x0035000000014b18-44.dat	upx
behavioral1/files/0x000700000001542b-51.dat	upx
behavioral1/files/0x000700000001562c-52.dat	upx
behavioral1/files/0x0008000000015b63-59.dat	upx
behavioral1/files/0x0008000000015d72-62.dat	upx
behavioral1/files/0x0006000000015d97-66.dat	upx
behavioral1/files/0x0006000000015de5-70.dat	upx
behavioral1/files/0x0006000000015fd4-78.dat	upx
behavioral1/files/0x0006000000016448-92.dat	upx
behavioral1/files/0x0006000000016572-98.dat	upx
behavioral1/files/0x0006000000016c5d-118.dat	upx
behavioral1/files/0x0006000000016caf-126.dat	upx
behavioral1/files/0x0006000000016d05-144.dat	upx
behavioral1/files/0x0006000000016d33-195.dat	upx
behavioral1/files/0x0006000000016d2b-190.dat	upx
behavioral1/files/0x0006000000016d22-185.dat	upx
behavioral1/memory/2840-179-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2624-177-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/1960-175-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2288-173-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2980-171-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2660-169-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2576-167-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2532-165-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2772-163-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x0006000000016d1a-149.dat	upx
behavioral1/files/0x0006000000016cde-142.dat	upx
behavioral1/files/0x0006000000016c67-122.dat	upx
behavioral1/files/0x0006000000016c4a-114.dat	upx
behavioral1/files/0x0006000000016a7d-110.dat	upx
behavioral1/files/0x0006000000016824-106.dat	upx
behavioral1/files/0x00060000000165d4-102.dat	upx
behavioral1/files/0x00060000000162cc-90.dat	upx
behavioral1/files/0x0006000000016133-86.dat	upx
behavioral1/files/0x00060000000160f3-82.dat	upx
behavioral1/files/0x0006000000015f54-74.dat	upx
behavioral1/memory/1704-1573-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2288-4091-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2660-4093-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2624-4095-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/memory/2532-4094-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/memory/2772-4216-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/1960-4512-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2576-4519-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2840-4627-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2980-4880-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hBeFvWL.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\FwzcTYa.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\qubTbAu.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\CUTqUIf.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\naDFXlm.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\IXDdVfQ.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\zkYjqiN.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\XUXEXhN.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\wofwRoZ.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\ZGAkubC.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\SOnPtQL.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\bnlRKed.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\tDEDUea.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\yKvjDGz.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\jEmuWEL.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\KwfilYa.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\kKHapTL.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\qVLrHDx.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\IVLXWwM.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\eEyBCay.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\snYdPpv.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\KlieNrz.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\bpIQtZv.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\lrTryYX.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\sAjiwQR.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\YCpwsHr.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\PzOShJO.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\BQKByTc.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\jWdeZHY.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\sFxYzye.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\rGZDctS.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\amLOFCE.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\KUYtqLx.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\gwVyqzK.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\TCBkvbr.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\hJNGOTt.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\hGDpMVw.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\lbVjJQS.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\JTxjhSf.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\CmfsonD.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\EAYUKtg.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\YdUFVqb.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\gRwSZCk.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\OlXKyXG.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\qstOzjA.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\HlTJtLj.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\usZrwwC.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\VoVfJlA.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\EgjXqrw.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\rGUyREr.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\WSyLOmI.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\oQQixNq.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\sXCbpIa.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\NVvPkyf.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\pPFigbt.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\qkIBgYI.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\SDoqGhW.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\GJvUjAR.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\AQQyTSd.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\DeGHalp.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\ciljoZE.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\DXbYLNq.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\vaRtTzD.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
File created	C:\Windows\System\FmefKtL.exe	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2392	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeLockMemoryPrivilege	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2392	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2392	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 2392	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	29
PID 1704 wrote to memory of 3028	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 3028	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 3028	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	30
PID 1704 wrote to memory of 3064	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 3064	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 3064	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	31
PID 1704 wrote to memory of 2688	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2688	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2688	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	32
PID 1704 wrote to memory of 2772	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 2772	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 2772	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	33
PID 1704 wrote to memory of 2532	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2532	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2532	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	34
PID 1704 wrote to memory of 2576	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2576	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2576	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	35
PID 1704 wrote to memory of 2660	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 2660	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 2660	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	36
PID 1704 wrote to memory of 2980	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 2980	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 2980	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	37
PID 1704 wrote to memory of 2288	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 2288	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 2288	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	38
PID 1704 wrote to memory of 1960	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 1960	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 1960	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	39
PID 1704 wrote to memory of 2624	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 2624	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 2624	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	40
PID 1704 wrote to memory of 2840	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 2840	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 2840	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	41
PID 1704 wrote to memory of 2848	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2848	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2848	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	42
PID 1704 wrote to memory of 2888	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	43
PID 1704 wrote to memory of 2888	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	43
PID 1704 wrote to memory of 2888	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	43
PID 1704 wrote to memory of 1984	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	44
PID 1704 wrote to memory of 1984	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	44
PID 1704 wrote to memory of 1984	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	44
PID 1704 wrote to memory of 1980	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	45
PID 1704 wrote to memory of 1980	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	45
PID 1704 wrote to memory of 1980	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	45
PID 1704 wrote to memory of 1956	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	46
PID 1704 wrote to memory of 1956	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	46
PID 1704 wrote to memory of 1956	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	46
PID 1704 wrote to memory of 2020	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	47
PID 1704 wrote to memory of 2020	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	47
PID 1704 wrote to memory of 2020	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	47
PID 1704 wrote to memory of 2464	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	48
PID 1704 wrote to memory of 2464	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	48
PID 1704 wrote to memory of 2464	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	48
PID 1704 wrote to memory of 2496	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	49
PID 1704 wrote to memory of 2496	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	49
PID 1704 wrote to memory of 2496	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	49
PID 1704 wrote to memory of 2180	1704	8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8b64fbe1297caa244ce96f5bc3eb8f51a7bbef712428abd057635b859866632c_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2392
- C:\Windows\System\KKmZwnX.exe
  C:\Windows\System\KKmZwnX.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\PNBoKRm.exe
  C:\Windows\System\PNBoKRm.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\gnjZHMN.exe
  C:\Windows\System\gnjZHMN.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ydSLuqD.exe
  C:\Windows\System\ydSLuqD.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\VoVfJlA.exe
  C:\Windows\System\VoVfJlA.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\TuCkGmY.exe
  C:\Windows\System\TuCkGmY.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\DVUHdyN.exe
  C:\Windows\System\DVUHdyN.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\LsQuZMa.exe
  C:\Windows\System\LsQuZMa.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\DOzdBkT.exe
  C:\Windows\System\DOzdBkT.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\GCGZWhT.exe
  C:\Windows\System\GCGZWhT.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\AIIRsPI.exe
  C:\Windows\System\AIIRsPI.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\NXfhXmi.exe
  C:\Windows\System\NXfhXmi.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\riNLAvk.exe
  C:\Windows\System\riNLAvk.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ASXjnao.exe
  C:\Windows\System\ASXjnao.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\uunCQaL.exe
  C:\Windows\System\uunCQaL.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\egNSkPk.exe
  C:\Windows\System\egNSkPk.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\ZZCWizA.exe
  C:\Windows\System\ZZCWizA.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\rMFWxnE.exe
  C:\Windows\System\rMFWxnE.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\YfmiicI.exe
  C:\Windows\System\YfmiicI.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ggQjcWC.exe
  C:\Windows\System\ggQjcWC.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\lRXKPNT.exe
  C:\Windows\System\lRXKPNT.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\zaEqMpV.exe
  C:\Windows\System\zaEqMpV.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\dEfvCUk.exe
  C:\Windows\System\dEfvCUk.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\LDsZUwv.exe
  C:\Windows\System\LDsZUwv.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\xuxMiDr.exe
  C:\Windows\System\xuxMiDr.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\sSCVPDn.exe
  C:\Windows\System\sSCVPDn.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\iUCxaGP.exe
  C:\Windows\System\iUCxaGP.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\QUlZuRj.exe
  C:\Windows\System\QUlZuRj.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\obfEWZX.exe
  C:\Windows\System\obfEWZX.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\JWexIdX.exe
  C:\Windows\System\JWexIdX.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\pcnkcSJ.exe
  C:\Windows\System\pcnkcSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\bzJQqtQ.exe
  C:\Windows\System\bzJQqtQ.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\SEujuIt.exe
  C:\Windows\System\SEujuIt.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\KQKOvhB.exe
  C:\Windows\System\KQKOvhB.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\imAolzj.exe
  C:\Windows\System\imAolzj.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\YKWVsJc.exe
  C:\Windows\System\YKWVsJc.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\UGNzGUZ.exe
  C:\Windows\System\UGNzGUZ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\MIBOfIC.exe
  C:\Windows\System\MIBOfIC.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\eQvdpor.exe
  C:\Windows\System\eQvdpor.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\yqAYFvs.exe
  C:\Windows\System\yqAYFvs.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\GMYmQaN.exe
  C:\Windows\System\GMYmQaN.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\dkDGzZv.exe
  C:\Windows\System\dkDGzZv.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\nocEOUZ.exe
  C:\Windows\System\nocEOUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\apnKqtF.exe
  C:\Windows\System\apnKqtF.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\yVPrZUH.exe
  C:\Windows\System\yVPrZUH.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\nYLqngZ.exe
  C:\Windows\System\nYLqngZ.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\yrGamJv.exe
  C:\Windows\System\yrGamJv.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\IXRJloL.exe
  C:\Windows\System\IXRJloL.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\DGXRNgg.exe
  C:\Windows\System\DGXRNgg.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\LQgZKOP.exe
  C:\Windows\System\LQgZKOP.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\QMOTZzH.exe
  C:\Windows\System\QMOTZzH.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\MczroCG.exe
  C:\Windows\System\MczroCG.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\plVFkFw.exe
  C:\Windows\System\plVFkFw.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\ZBwQlQh.exe
  C:\Windows\System\ZBwQlQh.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\nUTIchN.exe
  C:\Windows\System\nUTIchN.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\rCHFcNA.exe
  C:\Windows\System\rCHFcNA.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\BONTcDC.exe
  C:\Windows\System\BONTcDC.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\TJcojPV.exe
  C:\Windows\System\TJcojPV.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\MxzqEuO.exe
  C:\Windows\System\MxzqEuO.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\xVJQlSA.exe
  C:\Windows\System\xVJQlSA.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\seDhnMu.exe
  C:\Windows\System\seDhnMu.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\OlkAWOf.exe
  C:\Windows\System\OlkAWOf.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\fqOZvmP.exe
  C:\Windows\System\fqOZvmP.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\dAHaHHe.exe
  C:\Windows\System\dAHaHHe.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\DYREsep.exe
  C:\Windows\System\DYREsep.exe
  2⤵
  PID:2872
- C:\Windows\System\raQfGso.exe
  C:\Windows\System\raQfGso.exe
  2⤵
  PID:2356
- C:\Windows\System\Dwzucts.exe
  C:\Windows\System\Dwzucts.exe
  2⤵
  PID:864
- C:\Windows\System\mkFClCe.exe
  C:\Windows\System\mkFClCe.exe
  2⤵
  PID:2224
- C:\Windows\System\lZyhcdC.exe
  C:\Windows\System\lZyhcdC.exe
  2⤵
  PID:2452
- C:\Windows\System\NnUWGxZ.exe
  C:\Windows\System\NnUWGxZ.exe
  2⤵
  PID:2052
- C:\Windows\System\hkkpfrp.exe
  C:\Windows\System\hkkpfrp.exe
  2⤵
  PID:2516
- C:\Windows\System\XwflsGx.exe
  C:\Windows\System\XwflsGx.exe
  2⤵
  PID:2456
- C:\Windows\System\XQFovQt.exe
  C:\Windows\System\XQFovQt.exe
  2⤵
  PID:1104
- C:\Windows\System\gOfUrAo.exe
  C:\Windows\System\gOfUrAo.exe
  2⤵
  PID:536
- C:\Windows\System\BVdhuzW.exe
  C:\Windows\System\BVdhuzW.exe
  2⤵
  PID:688
- C:\Windows\System\Druezqm.exe
  C:\Windows\System\Druezqm.exe
  2⤵
  PID:2504
- C:\Windows\System\keOeEnX.exe
  C:\Windows\System\keOeEnX.exe
  2⤵
  PID:880
- C:\Windows\System\wFoujVx.exe
  C:\Windows\System\wFoujVx.exe
  2⤵
  PID:2500
- C:\Windows\System\JXVfmwa.exe
  C:\Windows\System\JXVfmwa.exe
  2⤵
  PID:2228
- C:\Windows\System\SJPFNtT.exe
  C:\Windows\System\SJPFNtT.exe
  2⤵
  PID:2684
- C:\Windows\System\wmhlOJc.exe
  C:\Windows\System\wmhlOJc.exe
  2⤵
  PID:1728
- C:\Windows\System\ghHlzJb.exe
  C:\Windows\System\ghHlzJb.exe
  2⤵
  PID:1944
- C:\Windows\System\aRDOZrL.exe
  C:\Windows\System\aRDOZrL.exe
  2⤵
  PID:772
- C:\Windows\System\LvSwhnx.exe
  C:\Windows\System\LvSwhnx.exe
  2⤵
  PID:1876
- C:\Windows\System\dcSvgUR.exe
  C:\Windows\System\dcSvgUR.exe
  2⤵
  PID:1868
- C:\Windows\System\WFGAAzN.exe
  C:\Windows\System\WFGAAzN.exe
  2⤵
  PID:948
- C:\Windows\System\ePwqJCZ.exe
  C:\Windows\System\ePwqJCZ.exe
  2⤵
  PID:1936
- C:\Windows\System\LKmwCNS.exe
  C:\Windows\System\LKmwCNS.exe
  2⤵
  PID:2060
- C:\Windows\System\YPAMdct.exe
  C:\Windows\System\YPAMdct.exe
  2⤵
  PID:2900
- C:\Windows\System\gKeOIkS.exe
  C:\Windows\System\gKeOIkS.exe
  2⤵
  PID:1952
- C:\Windows\System\Txqmoyn.exe
  C:\Windows\System\Txqmoyn.exe
  2⤵
  PID:2432
- C:\Windows\System\cUlnwee.exe
  C:\Windows\System\cUlnwee.exe
  2⤵
  PID:2008
- C:\Windows\System\uiDkclf.exe
  C:\Windows\System\uiDkclf.exe
  2⤵
  PID:2360
- C:\Windows\System\jlkwWRA.exe
  C:\Windows\System\jlkwWRA.exe
  2⤵
  PID:2908
- C:\Windows\System\qnIxeDP.exe
  C:\Windows\System\qnIxeDP.exe
  2⤵
  PID:2916
- C:\Windows\System\CrhjNuX.exe
  C:\Windows\System\CrhjNuX.exe
  2⤵
  PID:2712
- C:\Windows\System\xWrsBWJ.exe
  C:\Windows\System\xWrsBWJ.exe
  2⤵
  PID:2816
- C:\Windows\System\gWUzWFQ.exe
  C:\Windows\System\gWUzWFQ.exe
  2⤵
  PID:2364
- C:\Windows\System\fgwAyiS.exe
  C:\Windows\System\fgwAyiS.exe
  2⤵
  PID:2836
- C:\Windows\System\BkkSVea.exe
  C:\Windows\System\BkkSVea.exe
  2⤵
  PID:2420
- C:\Windows\System\lZUJTLt.exe
  C:\Windows\System\lZUJTLt.exe
  2⤵
  PID:2424
- C:\Windows\System\TUeqdvS.exe
  C:\Windows\System\TUeqdvS.exe
  2⤵
  PID:308
- C:\Windows\System\EornQQR.exe
  C:\Windows\System\EornQQR.exe
  2⤵
  PID:2328
- C:\Windows\System\pfSSLKn.exe
  C:\Windows\System\pfSSLKn.exe
  2⤵
  PID:2112
- C:\Windows\System\KfnCGmQ.exe
  C:\Windows\System\KfnCGmQ.exe
  2⤵
  PID:2512
- C:\Windows\System\XqtPRHG.exe
  C:\Windows\System\XqtPRHG.exe
  2⤵
  PID:608
- C:\Windows\System\UrakKbN.exe
  C:\Windows\System\UrakKbN.exe
  2⤵
  PID:2920
- C:\Windows\System\ECGbLDq.exe
  C:\Windows\System\ECGbLDq.exe
  2⤵
  PID:1864
- C:\Windows\System\plrxgKy.exe
  C:\Windows\System\plrxgKy.exe
  2⤵
  PID:2416
- C:\Windows\System\CRUxcKT.exe
  C:\Windows\System\CRUxcKT.exe
  2⤵
  PID:3060
- C:\Windows\System\zDiherm.exe
  C:\Windows\System\zDiherm.exe
  2⤵
  PID:1052
- C:\Windows\System\UHIhIlj.exe
  C:\Windows\System\UHIhIlj.exe
  2⤵
  PID:960
- C:\Windows\System\QqMKECz.exe
  C:\Windows\System\QqMKECz.exe
  2⤵
  PID:1732
- C:\Windows\System\KxBvACS.exe
  C:\Windows\System\KxBvACS.exe
  2⤵
  PID:3008
- C:\Windows\System\EnaSbsW.exe
  C:\Windows\System\EnaSbsW.exe
  2⤵
  PID:1264
- C:\Windows\System\NCmVwcM.exe
  C:\Windows\System\NCmVwcM.exe
  2⤵
  PID:3024
- C:\Windows\System\prqeLqY.exe
  C:\Windows\System\prqeLqY.exe
  2⤵
  PID:912
- C:\Windows\System\qsVZoKA.exe
  C:\Windows\System\qsVZoKA.exe
  2⤵
  PID:2428
- C:\Windows\System\ccsfDZX.exe
  C:\Windows\System\ccsfDZX.exe
  2⤵
  PID:1256
- C:\Windows\System\DxUnJQw.exe
  C:\Windows\System\DxUnJQw.exe
  2⤵
  PID:2784
- C:\Windows\System\vtZbYbA.exe
  C:\Windows\System\vtZbYbA.exe
  2⤵
  PID:2812
- C:\Windows\System\TjpyFOG.exe
  C:\Windows\System\TjpyFOG.exe
  2⤵
  PID:344
- C:\Windows\System\rJxHbGI.exe
  C:\Windows\System\rJxHbGI.exe
  2⤵
  PID:2680
- C:\Windows\System\ZuRGPIY.exe
  C:\Windows\System\ZuRGPIY.exe
  2⤵
  PID:1636
- C:\Windows\System\gBWnFaS.exe
  C:\Windows\System\gBWnFaS.exe
  2⤵
  PID:2096
- C:\Windows\System\gWLTYxt.exe
  C:\Windows\System\gWLTYxt.exe
  2⤵
  PID:1920
- C:\Windows\System\dJGYYDA.exe
  C:\Windows\System\dJGYYDA.exe
  2⤵
  PID:2760
- C:\Windows\System\lKnCAKy.exe
  C:\Windows\System\lKnCAKy.exe
  2⤵
  PID:1900
- C:\Windows\System\oVcCBhY.exe
  C:\Windows\System\oVcCBhY.exe
  2⤵
  PID:2348
- C:\Windows\System\xAerMBb.exe
  C:\Windows\System\xAerMBb.exe
  2⤵
  PID:1348
- C:\Windows\System\DKeVlOI.exe
  C:\Windows\System\DKeVlOI.exe
  2⤵
  PID:1768
- C:\Windows\System\IxFsVPz.exe
  C:\Windows\System\IxFsVPz.exe
  2⤵
  PID:1160
- C:\Windows\System\nyOczjj.exe
  C:\Windows\System\nyOczjj.exe
  2⤵
  PID:2608
- C:\Windows\System\aWGxXrI.exe
  C:\Windows\System\aWGxXrI.exe
  2⤵
  PID:1592
- C:\Windows\System\bKgrqxM.exe
  C:\Windows\System\bKgrqxM.exe
  2⤵
  PID:2880
- C:\Windows\System\xpRhmGD.exe
  C:\Windows\System\xpRhmGD.exe
  2⤵
  PID:712
- C:\Windows\System\exsTqKq.exe
  C:\Windows\System\exsTqKq.exe
  2⤵
  PID:2548
- C:\Windows\System\LKKhrGN.exe
  C:\Windows\System\LKKhrGN.exe
  2⤵
  PID:2976
- C:\Windows\System\KHACnRD.exe
  C:\Windows\System\KHACnRD.exe
  2⤵
  PID:1188
- C:\Windows\System\cGJCFaH.exe
  C:\Windows\System\cGJCFaH.exe
  2⤵
  PID:2336
- C:\Windows\System\WbuLSTV.exe
  C:\Windows\System\WbuLSTV.exe
  2⤵
  PID:2736
- C:\Windows\System\qLVHFWU.exe
  C:\Windows\System\qLVHFWU.exe
  2⤵
  PID:2256
- C:\Windows\System\fuTIwKI.exe
  C:\Windows\System\fuTIwKI.exe
  2⤵
  PID:2584
- C:\Windows\System\bYkeyFN.exe
  C:\Windows\System\bYkeyFN.exe
  2⤵
  PID:1612
- C:\Windows\System\qBjrAPl.exe
  C:\Windows\System\qBjrAPl.exe
  2⤵
  PID:2996
- C:\Windows\System\ByTGMTH.exe
  C:\Windows\System\ByTGMTH.exe
  2⤵
  PID:336
- C:\Windows\System\ooSXqRa.exe
  C:\Windows\System\ooSXqRa.exe
  2⤵
  PID:1604
- C:\Windows\System\OZwcQdH.exe
  C:\Windows\System\OZwcQdH.exe
  2⤵
  PID:2724
- C:\Windows\System\aQXKRFj.exe
  C:\Windows\System\aQXKRFj.exe
  2⤵
  PID:1924
- C:\Windows\System\FWJmBJO.exe
  C:\Windows\System\FWJmBJO.exe
  2⤵
  PID:2388
- C:\Windows\System\nsZZiEj.exe
  C:\Windows\System\nsZZiEj.exe
  2⤵
  PID:2824
- C:\Windows\System\dGzFGNa.exe
  C:\Windows\System\dGzFGNa.exe
  2⤵
  PID:2552
- C:\Windows\System\CcUEpWV.exe
  C:\Windows\System\CcUEpWV.exe
  2⤵
  PID:824
- C:\Windows\System\UKkUjSJ.exe
  C:\Windows\System\UKkUjSJ.exe
  2⤵
  PID:2108
- C:\Windows\System\SrxNlBq.exe
  C:\Windows\System\SrxNlBq.exe
  2⤵
  PID:1972
- C:\Windows\System\oLJxjmY.exe
  C:\Windows\System\oLJxjmY.exe
  2⤵
  PID:1796
- C:\Windows\System\gJBNJQj.exe
  C:\Windows\System\gJBNJQj.exe
  2⤵
  PID:2808
- C:\Windows\System\sbbDFtm.exe
  C:\Windows\System\sbbDFtm.exe
  2⤵
  PID:2260
- C:\Windows\System\GlqZNYb.exe
  C:\Windows\System\GlqZNYb.exe
  2⤵
  PID:2604
- C:\Windows\System\WDOfvhJ.exe
  C:\Windows\System\WDOfvhJ.exe
  2⤵
  PID:2528
- C:\Windows\System\rOoEVuo.exe
  C:\Windows\System\rOoEVuo.exe
  2⤵
  PID:2104
- C:\Windows\System\AcleQEa.exe
  C:\Windows\System\AcleQEa.exe
  2⤵
  PID:2864
- C:\Windows\System\WWCVuke.exe
  C:\Windows\System\WWCVuke.exe
  2⤵
  PID:316
- C:\Windows\System\RgFGQnO.exe
  C:\Windows\System\RgFGQnO.exe
  2⤵
  PID:2344
- C:\Windows\System\LtRhQEh.exe
  C:\Windows\System\LtRhQEh.exe
  2⤵
  PID:236
- C:\Windows\System\uaSiQGQ.exe
  C:\Windows\System\uaSiQGQ.exe
  2⤵
  PID:792
- C:\Windows\System\tbIVjod.exe
  C:\Windows\System\tbIVjod.exe
  2⤵
  PID:2128
- C:\Windows\System\WwvusLy.exe
  C:\Windows\System\WwvusLy.exe
  2⤵
  PID:2508
- C:\Windows\System\dRVpSZS.exe
  C:\Windows\System\dRVpSZS.exe
  2⤵
  PID:1836
- C:\Windows\System\PZhRvhx.exe
  C:\Windows\System\PZhRvhx.exe
  2⤵
  PID:2632
- C:\Windows\System\CbHSFxM.exe
  C:\Windows\System\CbHSFxM.exe
  2⤵
  PID:2024
- C:\Windows\System\YqJbpuh.exe
  C:\Windows\System\YqJbpuh.exe
  2⤵
  PID:2792
- C:\Windows\System\KyidmCB.exe
  C:\Windows\System\KyidmCB.exe
  2⤵
  PID:2092
- C:\Windows\System\cESmewz.exe
  C:\Windows\System\cESmewz.exe
  2⤵
  PID:3080
- C:\Windows\System\jiSYUxz.exe
  C:\Windows\System\jiSYUxz.exe
  2⤵
  PID:3100
- C:\Windows\System\uwVHedw.exe
  C:\Windows\System\uwVHedw.exe
  2⤵
  PID:3120
- C:\Windows\System\EIsKcgs.exe
  C:\Windows\System\EIsKcgs.exe
  2⤵
  PID:3140
- C:\Windows\System\mWkOlAW.exe
  C:\Windows\System\mWkOlAW.exe
  2⤵
  PID:3160
- C:\Windows\System\VORNdHs.exe
  C:\Windows\System\VORNdHs.exe
  2⤵
  PID:3180
- C:\Windows\System\hsyjJGt.exe
  C:\Windows\System\hsyjJGt.exe
  2⤵
  PID:3204
- C:\Windows\System\LJMCZCs.exe
  C:\Windows\System\LJMCZCs.exe
  2⤵
  PID:3224
- C:\Windows\System\WNNVYAQ.exe
  C:\Windows\System\WNNVYAQ.exe
  2⤵
  PID:3244
- C:\Windows\System\wDqCgVS.exe
  C:\Windows\System\wDqCgVS.exe
  2⤵
  PID:3260
- C:\Windows\System\PVrDphg.exe
  C:\Windows\System\PVrDphg.exe
  2⤵
  PID:3284
- C:\Windows\System\RbsDNyt.exe
  C:\Windows\System\RbsDNyt.exe
  2⤵
  PID:3300
- C:\Windows\System\ASIxGIP.exe
  C:\Windows\System\ASIxGIP.exe
  2⤵
  PID:3324
- C:\Windows\System\ytAWqEi.exe
  C:\Windows\System\ytAWqEi.exe
  2⤵
  PID:3340
- C:\Windows\System\cidovwq.exe
  C:\Windows\System\cidovwq.exe
  2⤵
  PID:3364
- C:\Windows\System\JNrvGee.exe
  C:\Windows\System\JNrvGee.exe
  2⤵
  PID:3380
- C:\Windows\System\QNphcrM.exe
  C:\Windows\System\QNphcrM.exe
  2⤵
  PID:3404
- C:\Windows\System\PrGyWUA.exe
  C:\Windows\System\PrGyWUA.exe
  2⤵
  PID:3420
- C:\Windows\System\WhyPkVv.exe
  C:\Windows\System\WhyPkVv.exe
  2⤵
  PID:3436
- C:\Windows\System\kYGAfZl.exe
  C:\Windows\System\kYGAfZl.exe
  2⤵
  PID:3452
- C:\Windows\System\XPepyOi.exe
  C:\Windows\System\XPepyOi.exe
  2⤵
  PID:3468
- C:\Windows\System\ZNnJFss.exe
  C:\Windows\System\ZNnJFss.exe
  2⤵
  PID:3484
- C:\Windows\System\uxZCKFi.exe
  C:\Windows\System\uxZCKFi.exe
  2⤵
  PID:3540
- C:\Windows\System\qsUZhYG.exe
  C:\Windows\System\qsUZhYG.exe
  2⤵
  PID:3556
- C:\Windows\System\uMByRzF.exe
  C:\Windows\System\uMByRzF.exe
  2⤵
  PID:3572
- C:\Windows\System\cWhEOoB.exe
  C:\Windows\System\cWhEOoB.exe
  2⤵
  PID:3588
- C:\Windows\System\QuEfSNK.exe
  C:\Windows\System\QuEfSNK.exe
  2⤵
  PID:3604
- C:\Windows\System\dAGWCoY.exe
  C:\Windows\System\dAGWCoY.exe
  2⤵
  PID:3620
- C:\Windows\System\PHTgKHC.exe
  C:\Windows\System\PHTgKHC.exe
  2⤵
  PID:3652
- C:\Windows\System\BJOgMqR.exe
  C:\Windows\System\BJOgMqR.exe
  2⤵
  PID:3684
- C:\Windows\System\oXgTHAn.exe
  C:\Windows\System\oXgTHAn.exe
  2⤵
  PID:3700
- C:\Windows\System\lQDRktg.exe
  C:\Windows\System\lQDRktg.exe
  2⤵
  PID:3720
- C:\Windows\System\EcOZQaV.exe
  C:\Windows\System\EcOZQaV.exe
  2⤵
  PID:3736
- C:\Windows\System\ZUpsgJB.exe
  C:\Windows\System\ZUpsgJB.exe
  2⤵
  PID:3752
- C:\Windows\System\FnWdREI.exe
  C:\Windows\System\FnWdREI.exe
  2⤵
  PID:3768
- C:\Windows\System\kzSJimB.exe
  C:\Windows\System\kzSJimB.exe
  2⤵
  PID:3784
- C:\Windows\System\wrBMpLD.exe
  C:\Windows\System\wrBMpLD.exe
  2⤵
  PID:3800
- C:\Windows\System\MYvtXWR.exe
  C:\Windows\System\MYvtXWR.exe
  2⤵
  PID:3836
- C:\Windows\System\YCpwsHr.exe
  C:\Windows\System\YCpwsHr.exe
  2⤵
  PID:3852
- C:\Windows\System\oUXiBQN.exe
  C:\Windows\System\oUXiBQN.exe
  2⤵
  PID:3868
- C:\Windows\System\bXXUHbK.exe
  C:\Windows\System\bXXUHbK.exe
  2⤵
  PID:3884
- C:\Windows\System\CUmrPuY.exe
  C:\Windows\System\CUmrPuY.exe
  2⤵
  PID:3900
- C:\Windows\System\kTlEucS.exe
  C:\Windows\System\kTlEucS.exe
  2⤵
  PID:3916
- C:\Windows\System\kHTADML.exe
  C:\Windows\System\kHTADML.exe
  2⤵
  PID:3936
- C:\Windows\System\tfZpSAM.exe
  C:\Windows\System\tfZpSAM.exe
  2⤵
  PID:3952
- C:\Windows\System\uGepaji.exe
  C:\Windows\System\uGepaji.exe
  2⤵
  PID:3972
- C:\Windows\System\DUJyHkL.exe
  C:\Windows\System\DUJyHkL.exe
  2⤵
  PID:3988
- C:\Windows\System\rRxPmRn.exe
  C:\Windows\System\rRxPmRn.exe
  2⤵
  PID:4004
- C:\Windows\System\wXdOxqz.exe
  C:\Windows\System\wXdOxqz.exe
  2⤵
  PID:4020
- C:\Windows\System\NSNxNuO.exe
  C:\Windows\System\NSNxNuO.exe
  2⤵
  PID:4036
- C:\Windows\System\AlyRheA.exe
  C:\Windows\System\AlyRheA.exe
  2⤵
  PID:4056
- C:\Windows\System\JgYYZCE.exe
  C:\Windows\System\JgYYZCE.exe
  2⤵
  PID:4072
- C:\Windows\System\pLMXyKV.exe
  C:\Windows\System\pLMXyKV.exe
  2⤵
  PID:4088
- C:\Windows\System\mBNIiIG.exe
  C:\Windows\System\mBNIiIG.exe
  2⤵
  PID:2832
- C:\Windows\System\oTXCMUw.exe
  C:\Windows\System\oTXCMUw.exe
  2⤵
  PID:624
- C:\Windows\System\rZQjfMt.exe
  C:\Windows\System\rZQjfMt.exe
  2⤵
  PID:3076
- C:\Windows\System\fHDOdCE.exe
  C:\Windows\System\fHDOdCE.exe
  2⤵
  PID:3088
- C:\Windows\System\GJsOUFv.exe
  C:\Windows\System\GJsOUFv.exe
  2⤵
  PID:3152
- C:\Windows\System\jFmTBow.exe
  C:\Windows\System\jFmTBow.exe
  2⤵
  PID:3156
- C:\Windows\System\qWoDbqF.exe
  C:\Windows\System\qWoDbqF.exe
  2⤵
  PID:3176
- C:\Windows\System\zgDwLFw.exe
  C:\Windows\System\zgDwLFw.exe
  2⤵
  PID:3240
- C:\Windows\System\WYddDdg.exe
  C:\Windows\System\WYddDdg.exe
  2⤵
  PID:3268
- C:\Windows\System\gNIUMuK.exe
  C:\Windows\System\gNIUMuK.exe
  2⤵
  PID:3252
- C:\Windows\System\njyOPls.exe
  C:\Windows\System\njyOPls.exe
  2⤵
  PID:3320
- C:\Windows\System\pqHYOzl.exe
  C:\Windows\System\pqHYOzl.exe
  2⤵
  PID:3356
- C:\Windows\System\eDyqywu.exe
  C:\Windows\System\eDyqywu.exe
  2⤵
  PID:484
- C:\Windows\System\wlpnLDh.exe
  C:\Windows\System\wlpnLDh.exe
  2⤵
  PID:1736
- C:\Windows\System\TexyBXD.exe
  C:\Windows\System\TexyBXD.exe
  2⤵
  PID:3372
- C:\Windows\System\zwCgxCe.exe
  C:\Windows\System\zwCgxCe.exe
  2⤵
  PID:580
- C:\Windows\System\rCBbJZH.exe
  C:\Windows\System\rCBbJZH.exe
  2⤵
  PID:1628
- C:\Windows\System\BrupbxM.exe
  C:\Windows\System\BrupbxM.exe
  2⤵
  PID:1484
- C:\Windows\System\tHcDbNc.exe
  C:\Windows\System\tHcDbNc.exe
  2⤵
  PID:3428
- C:\Windows\System\qoKIwHX.exe
  C:\Windows\System\qoKIwHX.exe
  2⤵
  PID:3564
- C:\Windows\System\voTAWyM.exe
  C:\Windows\System\voTAWyM.exe
  2⤵
  PID:3636
- C:\Windows\System\BGkgwho.exe
  C:\Windows\System\BGkgwho.exe
  2⤵
  PID:3632
- C:\Windows\System\efwbTDA.exe
  C:\Windows\System\efwbTDA.exe
  2⤵
  PID:3664
- C:\Windows\System\atemGtU.exe
  C:\Windows\System\atemGtU.exe
  2⤵
  PID:3580
- C:\Windows\System\juejIRD.exe
  C:\Windows\System\juejIRD.exe
  2⤵
  PID:3692
- C:\Windows\System\vtRsfjG.exe
  C:\Windows\System\vtRsfjG.exe
  2⤵
  PID:3760
- C:\Windows\System\XmaVqty.exe
  C:\Windows\System\XmaVqty.exe
  2⤵
  PID:3796
- C:\Windows\System\QKrcFKG.exe
  C:\Windows\System\QKrcFKG.exe
  2⤵
  PID:3780
- C:\Windows\System\kjCowXK.exe
  C:\Windows\System\kjCowXK.exe
  2⤵
  PID:3712
- C:\Windows\System\oFDyWuw.exe
  C:\Windows\System\oFDyWuw.exe
  2⤵
  PID:3748
- C:\Windows\System\fmJqnNl.exe
  C:\Windows\System\fmJqnNl.exe
  2⤵
  PID:3808
- C:\Windows\System\mKEUboZ.exe
  C:\Windows\System\mKEUboZ.exe
  2⤵
  PID:3864
- C:\Windows\System\zoensiQ.exe
  C:\Windows\System\zoensiQ.exe
  2⤵
  PID:3928
- C:\Windows\System\LnRUhPM.exe
  C:\Windows\System\LnRUhPM.exe
  2⤵
  PID:3968
- C:\Windows\System\yXkXejI.exe
  C:\Windows\System\yXkXejI.exe
  2⤵
  PID:3400
- C:\Windows\System\RUrQoHQ.exe
  C:\Windows\System\RUrQoHQ.exe
  2⤵
  PID:1532
- C:\Windows\System\Ykxpbrd.exe
  C:\Windows\System\Ykxpbrd.exe
  2⤵
  PID:2748
- C:\Windows\System\wMKzKXx.exe
  C:\Windows\System\wMKzKXx.exe
  2⤵
  PID:3200
- C:\Windows\System\iSxcEzF.exe
  C:\Windows\System\iSxcEzF.exe
  2⤵
  PID:3948
- C:\Windows\System\YZeRwTr.exe
  C:\Windows\System\YZeRwTr.exe
  2⤵
  PID:3232
- C:\Windows\System\dwdVkZT.exe
  C:\Windows\System\dwdVkZT.exe
  2⤵
  PID:3348
- C:\Windows\System\HQjSDph.exe
  C:\Windows\System\HQjSDph.exe
  2⤵
  PID:4044
- C:\Windows\System\tJqhAhH.exe
  C:\Windows\System\tJqhAhH.exe
  2⤵
  PID:3492
- C:\Windows\System\cTQugQI.exe
  C:\Windows\System\cTQugQI.exe
  2⤵
  PID:3168
- C:\Windows\System\JtnsJEz.exe
  C:\Windows\System\JtnsJEz.exe
  2⤵
  PID:3360
- C:\Windows\System\AXuVsOT.exe
  C:\Windows\System\AXuVsOT.exe
  2⤵
  PID:704
- C:\Windows\System\IUdritj.exe
  C:\Windows\System\IUdritj.exe
  2⤵
  PID:3500
- C:\Windows\System\TOqQpVn.exe
  C:\Windows\System\TOqQpVn.exe
  2⤵
  PID:3516
- C:\Windows\System\IQTCrBg.exe
  C:\Windows\System\IQTCrBg.exe
  2⤵
  PID:3448
- C:\Windows\System\sdHbwro.exe
  C:\Windows\System\sdHbwro.exe
  2⤵
  PID:1040
- C:\Windows\System\LxQMnmL.exe
  C:\Windows\System\LxQMnmL.exe
  2⤵
  PID:1032
- C:\Windows\System\bGGBzHj.exe
  C:\Windows\System\bGGBzHj.exe
  2⤵
  PID:2780
- C:\Windows\System\hWMBJib.exe
  C:\Windows\System\hWMBJib.exe
  2⤵
  PID:1008
- C:\Windows\System\ZgNwJFm.exe
  C:\Windows\System\ZgNwJFm.exe
  2⤵
  PID:4016
- C:\Windows\System\kQvLVHf.exe
  C:\Windows\System\kQvLVHf.exe
  2⤵
  PID:3092
- C:\Windows\System\ItvKsEb.exe
  C:\Windows\System\ItvKsEb.exe
  2⤵
  PID:3816
- C:\Windows\System\rxJyhHe.exe
  C:\Windows\System\rxJyhHe.exe
  2⤵
  PID:3924
- C:\Windows\System\AodrQWM.exe
  C:\Windows\System\AodrQWM.exe
  2⤵
  PID:3728
- C:\Windows\System\smjUFGv.exe
  C:\Windows\System\smjUFGv.exe
  2⤵
  PID:1788
- C:\Windows\System\QavIzMm.exe
  C:\Windows\System\QavIzMm.exe
  2⤵
  PID:3280
- C:\Windows\System\cRjxLVr.exe
  C:\Windows\System\cRjxLVr.exe
  2⤵
  PID:3216
- C:\Windows\System\eyItJfT.exe
  C:\Windows\System\eyItJfT.exe
  2⤵
  PID:2796
- C:\Windows\System\pRpnrKb.exe
  C:\Windows\System\pRpnrKb.exe
  2⤵
  PID:3508
- C:\Windows\System\PPtByOc.exe
  C:\Windows\System\PPtByOc.exe
  2⤵
  PID:3528
- C:\Windows\System\jpjtwzm.exe
  C:\Windows\System\jpjtwzm.exe
  2⤵
  PID:3628
- C:\Windows\System\fNFhNjt.exe
  C:\Windows\System\fNFhNjt.exe
  2⤵
  PID:3744
- C:\Windows\System\DmdmurJ.exe
  C:\Windows\System\DmdmurJ.exe
  2⤵
  PID:2324
- C:\Windows\System\sGfdXyS.exe
  C:\Windows\System\sGfdXyS.exe
  2⤵
  PID:3696
- C:\Windows\System\tVtbtGT.exe
  C:\Windows\System\tVtbtGT.exe
  2⤵
  PID:3824
- C:\Windows\System\RbLNIiz.exe
  C:\Windows\System\RbLNIiz.exe
  2⤵
  PID:3964
- C:\Windows\System\gtutlbX.exe
  C:\Windows\System\gtutlbX.exe
  2⤵
  PID:4080
- C:\Windows\System\tArmnkv.exe
  C:\Windows\System\tArmnkv.exe
  2⤵
  PID:2732
- C:\Windows\System\uFFqdIE.exe
  C:\Windows\System\uFFqdIE.exe
  2⤵
  PID:3416
- C:\Windows\System\CrbXtSV.exe
  C:\Windows\System\CrbXtSV.exe
  2⤵
  PID:4052
- C:\Windows\System\KFlBTjj.exe
  C:\Windows\System\KFlBTjj.exe
  2⤵
  PID:1148
- C:\Windows\System\pLNlHPR.exe
  C:\Windows\System\pLNlHPR.exe
  2⤵
  PID:3600
- C:\Windows\System\AbKHuUb.exe
  C:\Windows\System\AbKHuUb.exe
  2⤵
  PID:3612
- C:\Windows\System\EjisvUR.exe
  C:\Windows\System\EjisvUR.exe
  2⤵
  PID:3552
- C:\Windows\System\JZKdEjU.exe
  C:\Windows\System\JZKdEjU.exe
  2⤵
  PID:3860
- C:\Windows\System\Nftacla.exe
  C:\Windows\System\Nftacla.exe
  2⤵
  PID:3336
- C:\Windows\System\XPUqUVq.exe
  C:\Windows\System\XPUqUVq.exe
  2⤵
  PID:3944
- C:\Windows\System\bOqPzxB.exe
  C:\Windows\System\bOqPzxB.exe
  2⤵
  PID:3660
- C:\Windows\System\FjXmvHg.exe
  C:\Windows\System\FjXmvHg.exe
  2⤵
  PID:3676
- C:\Windows\System\YfHHqmf.exe
  C:\Windows\System\YfHHqmf.exe
  2⤵
  PID:3192
- C:\Windows\System\xfFuhww.exe
  C:\Windows\System\xfFuhww.exe
  2⤵
  PID:4000
- C:\Windows\System\IzMfvDc.exe
  C:\Windows\System\IzMfvDc.exe
  2⤵
  PID:4104
- C:\Windows\System\aqIKyAB.exe
  C:\Windows\System\aqIKyAB.exe
  2⤵
  PID:4120
- C:\Windows\System\hpptWtV.exe
  C:\Windows\System\hpptWtV.exe
  2⤵
  PID:4140
- C:\Windows\System\YXuWdxB.exe
  C:\Windows\System\YXuWdxB.exe
  2⤵
  PID:4308
- C:\Windows\System\IaZxBsN.exe
  C:\Windows\System\IaZxBsN.exe
  2⤵
  PID:4328
- C:\Windows\System\OLLQNfG.exe
  C:\Windows\System\OLLQNfG.exe
  2⤵
  PID:4344
- C:\Windows\System\fbyBney.exe
  C:\Windows\System\fbyBney.exe
  2⤵
  PID:4360
- C:\Windows\System\ICeRYhu.exe
  C:\Windows\System\ICeRYhu.exe
  2⤵
  PID:4376
- C:\Windows\System\fNCmMBV.exe
  C:\Windows\System\fNCmMBV.exe
  2⤵
  PID:4392
- C:\Windows\System\lOAzHOC.exe
  C:\Windows\System\lOAzHOC.exe
  2⤵
  PID:4408
- C:\Windows\System\vGYaniY.exe
  C:\Windows\System\vGYaniY.exe
  2⤵
  PID:4428
- C:\Windows\System\CYPOSic.exe
  C:\Windows\System\CYPOSic.exe
  2⤵
  PID:4444
- C:\Windows\System\HphJwZf.exe
  C:\Windows\System\HphJwZf.exe
  2⤵
  PID:4460
- C:\Windows\System\jXWTqZS.exe
  C:\Windows\System\jXWTqZS.exe
  2⤵
  PID:4480
- C:\Windows\System\DDGVokK.exe
  C:\Windows\System\DDGVokK.exe
  2⤵
  PID:4496
- C:\Windows\System\TiiaWPC.exe
  C:\Windows\System\TiiaWPC.exe
  2⤵
  PID:4512
- C:\Windows\System\pvaRaXQ.exe
  C:\Windows\System\pvaRaXQ.exe
  2⤵
  PID:4532
- C:\Windows\System\beoeKCr.exe
  C:\Windows\System\beoeKCr.exe
  2⤵
  PID:4548
- C:\Windows\System\vDDjFho.exe
  C:\Windows\System\vDDjFho.exe
  2⤵
  PID:4564
- C:\Windows\System\CwmOSsJ.exe
  C:\Windows\System\CwmOSsJ.exe
  2⤵
  PID:4580
- C:\Windows\System\dWCyYAJ.exe
  C:\Windows\System\dWCyYAJ.exe
  2⤵
  PID:4596
- C:\Windows\System\ivYPsoa.exe
  C:\Windows\System\ivYPsoa.exe
  2⤵
  PID:4616
- C:\Windows\System\UxhDpaR.exe
  C:\Windows\System\UxhDpaR.exe
  2⤵
  PID:4700
- C:\Windows\System\xtuzngH.exe
  C:\Windows\System\xtuzngH.exe
  2⤵
  PID:4716
- C:\Windows\System\gHpTCqR.exe
  C:\Windows\System\gHpTCqR.exe
  2⤵
  PID:4732
- C:\Windows\System\YnYgLtr.exe
  C:\Windows\System\YnYgLtr.exe
  2⤵
  PID:4760
- C:\Windows\System\QNdSDmb.exe
  C:\Windows\System\QNdSDmb.exe
  2⤵
  PID:4776
- C:\Windows\System\OlIYZLP.exe
  C:\Windows\System\OlIYZLP.exe
  2⤵
  PID:4796
- C:\Windows\System\kbNjObc.exe
  C:\Windows\System\kbNjObc.exe
  2⤵
  PID:4816
- C:\Windows\System\fLQItDq.exe
  C:\Windows\System\fLQItDq.exe
  2⤵
  PID:4836
- C:\Windows\System\nTluzaL.exe
  C:\Windows\System\nTluzaL.exe
  2⤵
  PID:4852
- C:\Windows\System\zzijxOX.exe
  C:\Windows\System\zzijxOX.exe
  2⤵
  PID:4872
- C:\Windows\System\CBoaCZS.exe
  C:\Windows\System\CBoaCZS.exe
  2⤵
  PID:4888
- C:\Windows\System\vcrmFOR.exe
  C:\Windows\System\vcrmFOR.exe
  2⤵
  PID:4904
- C:\Windows\System\sfAKlLq.exe
  C:\Windows\System\sfAKlLq.exe
  2⤵
  PID:4920
- C:\Windows\System\dxKaMKS.exe
  C:\Windows\System\dxKaMKS.exe
  2⤵
  PID:4944
- C:\Windows\System\xyWnCkA.exe
  C:\Windows\System\xyWnCkA.exe
  2⤵
  PID:4964
- C:\Windows\System\CUTqUIf.exe
  C:\Windows\System\CUTqUIf.exe
  2⤵
  PID:4980
- C:\Windows\System\jsChteS.exe
  C:\Windows\System\jsChteS.exe
  2⤵
  PID:4996
- C:\Windows\System\NzlxVsK.exe
  C:\Windows\System\NzlxVsK.exe
  2⤵
  PID:5016
- C:\Windows\System\ipcKxBd.exe
  C:\Windows\System\ipcKxBd.exe
  2⤵
  PID:5032
- C:\Windows\System\dtLGeAj.exe
  C:\Windows\System\dtLGeAj.exe
  2⤵
  PID:5048
- C:\Windows\System\uHQlSZf.exe
  C:\Windows\System\uHQlSZf.exe
  2⤵
  PID:5068
- C:\Windows\System\hdjTqUi.exe
  C:\Windows\System\hdjTqUi.exe
  2⤵
  PID:5096
- C:\Windows\System\BuTsnuz.exe
  C:\Windows\System\BuTsnuz.exe
  2⤵
  PID:5112
- C:\Windows\System\lgAXbtS.exe
  C:\Windows\System\lgAXbtS.exe
  2⤵
  PID:4100
- C:\Windows\System\npoAxjL.exe
  C:\Windows\System\npoAxjL.exe
  2⤵
  PID:3640
- C:\Windows\System\Ebxfcgh.exe
  C:\Windows\System\Ebxfcgh.exe
  2⤵
  PID:4156
- C:\Windows\System\FOGKHIX.exe
  C:\Windows\System\FOGKHIX.exe
  2⤵
  PID:4172
- C:\Windows\System\cnFvYMi.exe
  C:\Windows\System\cnFvYMi.exe
  2⤵
  PID:4188
- C:\Windows\System\wEFphVv.exe
  C:\Windows\System\wEFphVv.exe
  2⤵
  PID:4200
- C:\Windows\System\fvkpVJE.exe
  C:\Windows\System\fvkpVJE.exe
  2⤵
  PID:4240
- C:\Windows\System\cnDTKDm.exe
  C:\Windows\System\cnDTKDm.exe
  2⤵
  PID:4220
- C:\Windows\System\OUpBXQC.exe
  C:\Windows\System\OUpBXQC.exe
  2⤵
  PID:4252
- C:\Windows\System\BKSNIss.exe
  C:\Windows\System\BKSNIss.exe
  2⤵
  PID:4296
- C:\Windows\System\laeAeML.exe
  C:\Windows\System\laeAeML.exe
  2⤵
  PID:4324
- C:\Windows\System\RKWHPDG.exe
  C:\Windows\System\RKWHPDG.exe
  2⤵
  PID:4352
- C:\Windows\System\ScfUvIT.exe
  C:\Windows\System\ScfUvIT.exe
  2⤵
  PID:4520
- C:\Windows\System\hOTjvwu.exe
  C:\Windows\System\hOTjvwu.exe
  2⤵
  PID:4452
- C:\Windows\System\boQLfEi.exe
  C:\Windows\System\boQLfEi.exe
  2⤵
  PID:4528
- C:\Windows\System\QrqwvtQ.exe
  C:\Windows\System\QrqwvtQ.exe
  2⤵
  PID:4540
- C:\Windows\System\yvYeTvc.exe
  C:\Windows\System\yvYeTvc.exe
  2⤵
  PID:4440
- C:\Windows\System\qLUOBLy.exe
  C:\Windows\System\qLUOBLy.exe
  2⤵
  PID:4368
- C:\Windows\System\jWuDNiy.exe
  C:\Windows\System\jWuDNiy.exe
  2⤵
  PID:4588
- C:\Windows\System\TZREMoQ.exe
  C:\Windows\System\TZREMoQ.exe
  2⤵
  PID:4632
- C:\Windows\System\FowESSJ.exe
  C:\Windows\System\FowESSJ.exe
  2⤵
  PID:4644
- C:\Windows\System\dqDBAXO.exe
  C:\Windows\System\dqDBAXO.exe
  2⤵
  PID:4660
- C:\Windows\System\XFMaBjX.exe
  C:\Windows\System\XFMaBjX.exe
  2⤵
  PID:4684
- C:\Windows\System\hJuNMFF.exe
  C:\Windows\System\hJuNMFF.exe
  2⤵
  PID:4696
- C:\Windows\System\eNCJPLq.exe
  C:\Windows\System\eNCJPLq.exe
  2⤵
  PID:4728
- C:\Windows\System\uCQbevo.exe
  C:\Windows\System\uCQbevo.exe
  2⤵
  PID:4744
- C:\Windows\System\LjrzpdX.exe
  C:\Windows\System\LjrzpdX.exe
  2⤵
  PID:4792
- C:\Windows\System\jqfwZvl.exe
  C:\Windows\System\jqfwZvl.exe
  2⤵
  PID:4824
- C:\Windows\System\SpkIpIu.exe
  C:\Windows\System\SpkIpIu.exe
  2⤵
  PID:4860
- C:\Windows\System\FWmAiGr.exe
  C:\Windows\System\FWmAiGr.exe
  2⤵
  PID:4844
- C:\Windows\System\zsOzDtJ.exe
  C:\Windows\System\zsOzDtJ.exe
  2⤵
  PID:4912
- C:\Windows\System\zcBGRtx.exe
  C:\Windows\System\zcBGRtx.exe
  2⤵
  PID:4916
- C:\Windows\System\lnKJNOM.exe
  C:\Windows\System\lnKJNOM.exe
  2⤵
  PID:4988
- C:\Windows\System\xANCqNZ.exe
  C:\Windows\System\xANCqNZ.exe
  2⤵
  PID:5056
- C:\Windows\System\hdvPNbx.exe
  C:\Windows\System\hdvPNbx.exe
  2⤵
  PID:5004
- C:\Windows\System\XiIYwOf.exe
  C:\Windows\System\XiIYwOf.exe
  2⤵
  PID:5012
- C:\Windows\System\fSXEVqw.exe
  C:\Windows\System\fSXEVqw.exe
  2⤵
  PID:5092
- C:\Windows\System\GdKThxC.exe
  C:\Windows\System\GdKThxC.exe
  2⤵
  PID:5108
- C:\Windows\System\YUqWsRT.exe
  C:\Windows\System\YUqWsRT.exe
  2⤵
  PID:3352
- C:\Windows\System\HoaZOnH.exe
  C:\Windows\System\HoaZOnH.exe
  2⤵
  PID:4168
- C:\Windows\System\NSkmzWp.exe
  C:\Windows\System\NSkmzWp.exe
  2⤵
  PID:4204
- C:\Windows\System\TWbTEFV.exe
  C:\Windows\System\TWbTEFV.exe
  2⤵
  PID:4208
- C:\Windows\System\YPYOzNC.exe
  C:\Windows\System\YPYOzNC.exe
  2⤵
  PID:4264
- C:\Windows\System\CYJfDhc.exe
  C:\Windows\System\CYJfDhc.exe
  2⤵
  PID:4936
- C:\Windows\System\DpkdtuW.exe
  C:\Windows\System\DpkdtuW.exe
  2⤵
  PID:4752
- C:\Windows\System\modNVWn.exe
  C:\Windows\System\modNVWn.exe
  2⤵
  PID:4880
- C:\Windows\System\ZPsXjnC.exe
  C:\Windows\System\ZPsXjnC.exe
  2⤵
  PID:4940
- C:\Windows\System\DrktVXH.exe
  C:\Windows\System\DrktVXH.exe
  2⤵
  PID:3596
- C:\Windows\System\xVGFWCs.exe
  C:\Windows\System\xVGFWCs.exe
  2⤵
  PID:5088
- C:\Windows\System\zfInVXx.exe
  C:\Windows\System\zfInVXx.exe
  2⤵
  PID:4152
- C:\Windows\System\IPHoFum.exe
  C:\Windows\System\IPHoFum.exe
  2⤵
  PID:4772
- C:\Windows\System\wDExDPC.exe
  C:\Windows\System\wDExDPC.exe
  2⤵
  PID:4672
- C:\Windows\System\KzLFKeF.exe
  C:\Windows\System\KzLFKeF.exe
  2⤵
  PID:4556
- C:\Windows\System\peTLNcB.exe
  C:\Windows\System\peTLNcB.exe
  2⤵
  PID:4828
- C:\Windows\System\VNJrVEa.exe
  C:\Windows\System\VNJrVEa.exe
  2⤵
  PID:5060
- C:\Windows\System\anWjCIm.exe
  C:\Windows\System\anWjCIm.exe
  2⤵
  PID:4388
- C:\Windows\System\cqlJKuf.exe
  C:\Windows\System\cqlJKuf.exe
  2⤵
  PID:4276
- C:\Windows\System\QAhToxZ.exe
  C:\Windows\System\QAhToxZ.exe
  2⤵
  PID:4288
- C:\Windows\System\asMExYn.exe
  C:\Windows\System\asMExYn.exe
  2⤵
  PID:4372
- C:\Windows\System\PsGxjLE.exe
  C:\Windows\System\PsGxjLE.exe
  2⤵
  PID:4468
- C:\Windows\System\PHUxHKa.exe
  C:\Windows\System\PHUxHKa.exe
  2⤵
  PID:4560
- C:\Windows\System\aIVjQym.exe
  C:\Windows\System\aIVjQym.exe
  2⤵
  PID:4804
- C:\Windows\System\kWGznAX.exe
  C:\Windows\System\kWGznAX.exe
  2⤵
  PID:4136
- C:\Windows\System\FRarrFc.exe
  C:\Windows\System\FRarrFc.exe
  2⤵
  PID:4692
- C:\Windows\System\rrlSsVq.exe
  C:\Windows\System\rrlSsVq.exe
  2⤵
  PID:5080
- C:\Windows\System\ehFCBBF.exe
  C:\Windows\System\ehFCBBF.exe
  2⤵
  PID:4608
- C:\Windows\System\WEykgPG.exe
  C:\Windows\System\WEykgPG.exe
  2⤵
  PID:4648
- C:\Windows\System\mqjcFkW.exe
  C:\Windows\System\mqjcFkW.exe
  2⤵
  PID:4256
- C:\Windows\System\fbQFceg.exe
  C:\Windows\System\fbQFceg.exe
  2⤵
  PID:4236
- C:\Windows\System\NRhVHxq.exe
  C:\Windows\System\NRhVHxq.exe
  2⤵
  PID:4268
- C:\Windows\System\uKdRkxc.exe
  C:\Windows\System\uKdRkxc.exe
  2⤵
  PID:4184
- C:\Windows\System\JVuVxwx.exe
  C:\Windows\System\JVuVxwx.exe
  2⤵
  PID:5028
- C:\Windows\System\DTIrNbt.exe
  C:\Windows\System\DTIrNbt.exe
  2⤵
  PID:4748
- C:\Windows\System\LQcdrlw.exe
  C:\Windows\System\LQcdrlw.exe
  2⤵
  PID:4676
- C:\Windows\System\aDvNkxY.exe
  C:\Windows\System\aDvNkxY.exe
  2⤵
  PID:4304
- C:\Windows\System\nRgfRCL.exe
  C:\Windows\System\nRgfRCL.exe
  2⤵
  PID:4132
- C:\Windows\System\XRlPghQ.exe
  C:\Windows\System\XRlPghQ.exe
  2⤵
  PID:4884
- C:\Windows\System\BirNYZu.exe
  C:\Windows\System\BirNYZu.exe
  2⤵
  PID:4180
- C:\Windows\System\pWTVcSF.exe
  C:\Windows\System\pWTVcSF.exe
  2⤵
  PID:5132
- C:\Windows\System\NTectVp.exe
  C:\Windows\System\NTectVp.exe
  2⤵
  PID:5148
- C:\Windows\System\wLjQRtp.exe
  C:\Windows\System\wLjQRtp.exe
  2⤵
  PID:5164
- C:\Windows\System\qbhZycT.exe
  C:\Windows\System\qbhZycT.exe
  2⤵
  PID:5180
- C:\Windows\System\PawZmhe.exe
  C:\Windows\System\PawZmhe.exe
  2⤵
  PID:5196
- C:\Windows\System\oIFOpgw.exe
  C:\Windows\System\oIFOpgw.exe
  2⤵
  PID:5216
- C:\Windows\System\TgUfUMe.exe
  C:\Windows\System\TgUfUMe.exe
  2⤵
  PID:5232
- C:\Windows\System\rXTXGvU.exe
  C:\Windows\System\rXTXGvU.exe
  2⤵
  PID:5248
- C:\Windows\System\XwxIIgl.exe
  C:\Windows\System\XwxIIgl.exe
  2⤵
  PID:5264
- C:\Windows\System\EsuxkWc.exe
  C:\Windows\System\EsuxkWc.exe
  2⤵
  PID:5284
- C:\Windows\System\wvgbsVq.exe
  C:\Windows\System\wvgbsVq.exe
  2⤵
  PID:5300
- C:\Windows\System\njXcGco.exe
  C:\Windows\System\njXcGco.exe
  2⤵
  PID:5316
- C:\Windows\System\JXczPZQ.exe
  C:\Windows\System\JXczPZQ.exe
  2⤵
  PID:5336
- C:\Windows\System\JLmYmkG.exe
  C:\Windows\System\JLmYmkG.exe
  2⤵
  PID:5352
- C:\Windows\System\mPLZEOk.exe
  C:\Windows\System\mPLZEOk.exe
  2⤵
  PID:5368
- C:\Windows\System\jjmhIpi.exe
  C:\Windows\System\jjmhIpi.exe
  2⤵
  PID:5384
- C:\Windows\System\ZBrmQqp.exe
  C:\Windows\System\ZBrmQqp.exe
  2⤵
  PID:5404
- C:\Windows\System\dTJzXoR.exe
  C:\Windows\System\dTJzXoR.exe
  2⤵
  PID:5420
- C:\Windows\System\wzNUYpb.exe
  C:\Windows\System\wzNUYpb.exe
  2⤵
  PID:5436
- C:\Windows\System\pEcKwDL.exe
  C:\Windows\System\pEcKwDL.exe
  2⤵
  PID:5476
- C:\Windows\System\qMLbpUr.exe
  C:\Windows\System\qMLbpUr.exe
  2⤵
  PID:5492
- C:\Windows\System\eiBBdzr.exe
  C:\Windows\System\eiBBdzr.exe
  2⤵
  PID:5508
- C:\Windows\System\BzGRuGv.exe
  C:\Windows\System\BzGRuGv.exe
  2⤵
  PID:5524
- C:\Windows\System\vFrAktT.exe
  C:\Windows\System\vFrAktT.exe
  2⤵
  PID:5540
- C:\Windows\System\bdMHBMB.exe
  C:\Windows\System\bdMHBMB.exe
  2⤵
  PID:5556
- C:\Windows\System\fINwOvn.exe
  C:\Windows\System\fINwOvn.exe
  2⤵
  PID:5572
- C:\Windows\System\dSCvhOF.exe
  C:\Windows\System\dSCvhOF.exe
  2⤵
  PID:5588
- C:\Windows\System\VtBbHoq.exe
  C:\Windows\System\VtBbHoq.exe
  2⤵
  PID:5604
- C:\Windows\System\CbvVXqC.exe
  C:\Windows\System\CbvVXqC.exe
  2⤵
  PID:5620
- C:\Windows\System\RigUzar.exe
  C:\Windows\System\RigUzar.exe
  2⤵
  PID:5636
- C:\Windows\System\lZDOUbW.exe
  C:\Windows\System\lZDOUbW.exe
  2⤵
  PID:5652
- C:\Windows\System\BUgKGEj.exe
  C:\Windows\System\BUgKGEj.exe
  2⤵
  PID:5668
- C:\Windows\System\NFyMlOe.exe
  C:\Windows\System\NFyMlOe.exe
  2⤵
  PID:5684
- C:\Windows\System\BmuotIv.exe
  C:\Windows\System\BmuotIv.exe
  2⤵
  PID:5700
- C:\Windows\System\bUGvXsf.exe
  C:\Windows\System\bUGvXsf.exe
  2⤵
  PID:5716
- C:\Windows\System\NWLbwId.exe
  C:\Windows\System\NWLbwId.exe
  2⤵
  PID:5732
- C:\Windows\System\cRthbHw.exe
  C:\Windows\System\cRthbHw.exe
  2⤵
  PID:5748
- C:\Windows\System\QqLesAC.exe
  C:\Windows\System\QqLesAC.exe
  2⤵
  PID:5764
- C:\Windows\System\UVXjwHb.exe
  C:\Windows\System\UVXjwHb.exe
  2⤵
  PID:5780
- C:\Windows\System\vxoiQUV.exe
  C:\Windows\System\vxoiQUV.exe
  2⤵
  PID:5796
- C:\Windows\System\ZKSZCcG.exe
  C:\Windows\System\ZKSZCcG.exe
  2⤵
  PID:5812
- C:\Windows\System\xvLfqQd.exe
  C:\Windows\System\xvLfqQd.exe
  2⤵
  PID:5828
- C:\Windows\System\gYVXWmj.exe
  C:\Windows\System\gYVXWmj.exe
  2⤵
  PID:5844
- C:\Windows\System\tPMYhQy.exe
  C:\Windows\System\tPMYhQy.exe
  2⤵
  PID:5860
- C:\Windows\System\RDWiZwG.exe
  C:\Windows\System\RDWiZwG.exe
  2⤵
  PID:5876
- C:\Windows\System\pAXuZPo.exe
  C:\Windows\System\pAXuZPo.exe
  2⤵
  PID:5892
- C:\Windows\System\dNhzQAX.exe
  C:\Windows\System\dNhzQAX.exe
  2⤵
  PID:5908
- C:\Windows\System\gdhGiWe.exe
  C:\Windows\System\gdhGiWe.exe
  2⤵
  PID:5924
- C:\Windows\System\BvGNPXD.exe
  C:\Windows\System\BvGNPXD.exe
  2⤵
  PID:5940
- C:\Windows\System\ZaodLOP.exe
  C:\Windows\System\ZaodLOP.exe
  2⤵
  PID:5956
- C:\Windows\System\LeZywvv.exe
  C:\Windows\System\LeZywvv.exe
  2⤵
  PID:5972
- C:\Windows\System\UBGtmvC.exe
  C:\Windows\System\UBGtmvC.exe
  2⤵
  PID:5988
- C:\Windows\System\nMPvxeF.exe
  C:\Windows\System\nMPvxeF.exe
  2⤵
  PID:6004
- C:\Windows\System\Pqajefh.exe
  C:\Windows\System\Pqajefh.exe
  2⤵
  PID:6020
- C:\Windows\System\OCbuBFQ.exe
  C:\Windows\System\OCbuBFQ.exe
  2⤵
  PID:6036
- C:\Windows\System\WTcjIAN.exe
  C:\Windows\System\WTcjIAN.exe
  2⤵
  PID:6052
- C:\Windows\System\ipczLoU.exe
  C:\Windows\System\ipczLoU.exe
  2⤵
  PID:6068
- C:\Windows\System\dLyspSu.exe
  C:\Windows\System\dLyspSu.exe
  2⤵
  PID:6084
- C:\Windows\System\BHNnroE.exe
  C:\Windows\System\BHNnroE.exe
  2⤵
  PID:6100
- C:\Windows\System\hBeFvWL.exe
  C:\Windows\System\hBeFvWL.exe
  2⤵
  PID:6116
- C:\Windows\System\lvQmHPM.exe
  C:\Windows\System\lvQmHPM.exe
  2⤵
  PID:6132
- C:\Windows\System\SFPtTes.exe
  C:\Windows\System\SFPtTes.exe
  2⤵
  PID:4148
- C:\Windows\System\GNiFdmo.exe
  C:\Windows\System\GNiFdmo.exe
  2⤵
  PID:4956
- C:\Windows\System\fnZolNW.exe
  C:\Windows\System\fnZolNW.exe
  2⤵
  PID:5308
- C:\Windows\System\PIUBVeN.exe
  C:\Windows\System\PIUBVeN.exe
  2⤵
  PID:4712
- C:\Windows\System\ZhTATPE.exe
  C:\Windows\System\ZhTATPE.exe
  2⤵
  PID:4492
- C:\Windows\System\vcnLLDi.exe
  C:\Windows\System\vcnLLDi.exe
  2⤵
  PID:5416
- C:\Windows\System\ydybHpD.exe
  C:\Windows\System\ydybHpD.exe
  2⤵
  PID:4284
- C:\Windows\System\beCRJww.exe
  C:\Windows\System\beCRJww.exe
  2⤵
  PID:5192
- C:\Windows\System\mDPuwLh.exe
  C:\Windows\System\mDPuwLh.exe
  2⤵
  PID:5468
- C:\Windows\System\kmoZCjR.exe
  C:\Windows\System\kmoZCjR.exe
  2⤵
  PID:5456
- C:\Windows\System\RxdjSXx.exe
  C:\Windows\System\RxdjSXx.exe
  2⤵
  PID:5332
- C:\Windows\System\YHXLvTc.exe
  C:\Windows\System\YHXLvTc.exe
  2⤵
  PID:5324
- C:\Windows\System\TtbJtYt.exe
  C:\Windows\System\TtbJtYt.exe
  2⤵
  PID:5260
- C:\Windows\System\uajjIXP.exe
  C:\Windows\System\uajjIXP.exe
  2⤵
  PID:5360
- C:\Windows\System\rHGhTGC.exe
  C:\Windows\System\rHGhTGC.exe
  2⤵
  PID:5396
- C:\Windows\System\KGccaiW.exe
  C:\Windows\System\KGccaiW.exe
  2⤵
  PID:5532
- C:\Windows\System\TpAVBEc.exe
  C:\Windows\System\TpAVBEc.exe
  2⤵
  PID:5596
- C:\Windows\System\tMSZclI.exe
  C:\Windows\System\tMSZclI.exe
  2⤵
  PID:5628
- C:\Windows\System\fpxjmep.exe
  C:\Windows\System\fpxjmep.exe
  2⤵
  PID:5612
- C:\Windows\System\QTOOPKp.exe
  C:\Windows\System\QTOOPKp.exe
  2⤵
  PID:5696
- C:\Windows\System\vkubaZP.exe
  C:\Windows\System\vkubaZP.exe
  2⤵
  PID:5680
- C:\Windows\System\NdJdBbO.exe
  C:\Windows\System\NdJdBbO.exe
  2⤵
  PID:5788
- C:\Windows\System\FLHaUGK.exe
  C:\Windows\System\FLHaUGK.exe
  2⤵
  PID:5820
- C:\Windows\System\DBsyrGD.exe
  C:\Windows\System\DBsyrGD.exe
  2⤵
  PID:5856
- C:\Windows\System\yGvfOby.exe
  C:\Windows\System\yGvfOby.exe
  2⤵
  PID:5916
- C:\Windows\System\HwJqQPA.exe
  C:\Windows\System\HwJqQPA.exe
  2⤵
  PID:5868
- C:\Windows\System\dJrHTLB.exe
  C:\Windows\System\dJrHTLB.exe
  2⤵
  PID:5932
- C:\Windows\System\zaoOxuT.exe
  C:\Windows\System\zaoOxuT.exe
  2⤵
  PID:5980
- C:\Windows\System\nOhSeLa.exe
  C:\Windows\System\nOhSeLa.exe
  2⤵
  PID:5996
- C:\Windows\System\NSStWNY.exe
  C:\Windows\System\NSStWNY.exe
  2⤵
  PID:6044
- C:\Windows\System\mXPnrUy.exe
  C:\Windows\System\mXPnrUy.exe
  2⤵
  PID:6076
- C:\Windows\System\PDqvVgF.exe
  C:\Windows\System\PDqvVgF.exe
  2⤵
  PID:6096
- C:\Windows\System\wwJLqWT.exe
  C:\Windows\System\wwJLqWT.exe
  2⤵
  PID:4420
- C:\Windows\System\CYuSsJh.exe
  C:\Windows\System\CYuSsJh.exe
  2⤵
  PID:5312
- C:\Windows\System\yxpgTiH.exe
  C:\Windows\System\yxpgTiH.exe
  2⤵
  PID:3396
- C:\Windows\System\WgZrVUZ.exe
  C:\Windows\System\WgZrVUZ.exe
  2⤵
  PID:5124
- C:\Windows\System\DgFqDql.exe
  C:\Windows\System\DgFqDql.exe
  2⤵
  PID:5240
- C:\Windows\System\vAMMaBe.exe
  C:\Windows\System\vAMMaBe.exe
  2⤵
  PID:4476
- C:\Windows\System\GUOHEWj.exe
  C:\Windows\System\GUOHEWj.exe
  2⤵
  PID:5464
- C:\Windows\System\jCLyCtD.exe
  C:\Windows\System\jCLyCtD.exe
  2⤵
  PID:5204
- C:\Windows\System\UKkZvsv.exe
  C:\Windows\System\UKkZvsv.exe
  2⤵
  PID:5564
- C:\Windows\System\IJHhnYQ.exe
  C:\Windows\System\IJHhnYQ.exe
  2⤵
  PID:5580
- C:\Windows\System\GBXiWvx.exe
  C:\Windows\System\GBXiWvx.exe
  2⤵
  PID:5380
- C:\Windows\System\vgmpSCa.exe
  C:\Windows\System\vgmpSCa.exe
  2⤵
  PID:5884
- C:\Windows\System\PNPCocf.exe
  C:\Windows\System\PNPCocf.exe
  2⤵
  PID:5208
- C:\Windows\System\xsIpOUA.exe
  C:\Windows\System\xsIpOUA.exe
  2⤵
  PID:5292
- C:\Windows\System\FwzcTYa.exe
  C:\Windows\System\FwzcTYa.exe
  2⤵
  PID:5584
- C:\Windows\System\glxsXlP.exe
  C:\Windows\System\glxsXlP.exe
  2⤵
  PID:5644
- C:\Windows\System\UkRMqan.exe
  C:\Windows\System\UkRMqan.exe
  2⤵
  PID:5760
- C:\Windows\System\msTWSPO.exe
  C:\Windows\System\msTWSPO.exe
  2⤵
  PID:5776
- C:\Windows\System\WXevbdt.exe
  C:\Windows\System\WXevbdt.exe
  2⤵
  PID:5872
- C:\Windows\System\GFYYqYs.exe
  C:\Windows\System\GFYYqYs.exe
  2⤵
  PID:6060
- C:\Windows\System\MPrzsLI.exe
  C:\Windows\System\MPrzsLI.exe
  2⤵
  PID:5348
- C:\Windows\System\gJuPnUw.exe
  C:\Windows\System\gJuPnUw.exe
  2⤵
  PID:4424
- C:\Windows\System\lrQmZmw.exe
  C:\Windows\System\lrQmZmw.exe
  2⤵
  PID:5900
- C:\Windows\System\TLcHjud.exe
  C:\Windows\System\TLcHjud.exe
  2⤵
  PID:6092
- C:\Windows\System\WScouwN.exe
  C:\Windows\System\WScouwN.exe
  2⤵
  PID:5172
- C:\Windows\System\bsTrbJO.exe
  C:\Windows\System\bsTrbJO.exe
  2⤵
  PID:4680
- C:\Windows\System\IBkfkNp.exe
  C:\Windows\System\IBkfkNp.exe
  2⤵
  PID:5756
- C:\Windows\System\rBRXhyR.exe
  C:\Windows\System\rBRXhyR.exe
  2⤵
  PID:5504
- C:\Windows\System\QWieyBa.exe
  C:\Windows\System\QWieyBa.exe
  2⤵
  PID:5296
- C:\Windows\System\NHsEnxw.exe
  C:\Windows\System\NHsEnxw.exe
  2⤵
  PID:5836
- C:\Windows\System\qkIBgYI.exe
  C:\Windows\System\qkIBgYI.exe
  2⤵
  PID:5280
- C:\Windows\System\MGAqPFG.exe
  C:\Windows\System\MGAqPFG.exe
  2⤵
  PID:5484
- C:\Windows\System\fadtDWy.exe
  C:\Windows\System\fadtDWy.exe
  2⤵
  PID:6140
- C:\Windows\System\pHMvMtt.exe
  C:\Windows\System\pHMvMtt.exe
  2⤵
  PID:5804
- C:\Windows\System\moVWkvP.exe
  C:\Windows\System\moVWkvP.exe
  2⤵
  PID:6156
- C:\Windows\System\bQLWdhY.exe
  C:\Windows\System\bQLWdhY.exe
  2⤵
  PID:6172
- C:\Windows\System\TGTMjZe.exe
  C:\Windows\System\TGTMjZe.exe
  2⤵
  PID:6188
- C:\Windows\System\fSbpIqe.exe
  C:\Windows\System\fSbpIqe.exe
  2⤵
  PID:6204
- C:\Windows\System\tKrsdbY.exe
  C:\Windows\System\tKrsdbY.exe
  2⤵
  PID:6220
- C:\Windows\System\uoIWokc.exe
  C:\Windows\System\uoIWokc.exe
  2⤵
  PID:6236
- C:\Windows\System\ujTwTsh.exe
  C:\Windows\System\ujTwTsh.exe
  2⤵
  PID:6252
- C:\Windows\System\wEweCXX.exe
  C:\Windows\System\wEweCXX.exe
  2⤵
  PID:6268
- C:\Windows\System\NTFgeBH.exe
  C:\Windows\System\NTFgeBH.exe
  2⤵
  PID:6284
- C:\Windows\System\WjzQglK.exe
  C:\Windows\System\WjzQglK.exe
  2⤵
  PID:6300
- C:\Windows\System\hokATro.exe
  C:\Windows\System\hokATro.exe
  2⤵
  PID:6320
- C:\Windows\System\mKdFAvj.exe
  C:\Windows\System\mKdFAvj.exe
  2⤵
  PID:6336
- C:\Windows\System\bChtRkO.exe
  C:\Windows\System\bChtRkO.exe
  2⤵
  PID:6352
- C:\Windows\System\LDNgPLq.exe
  C:\Windows\System\LDNgPLq.exe
  2⤵
  PID:6368
- C:\Windows\System\zwvAwGt.exe
  C:\Windows\System\zwvAwGt.exe
  2⤵
  PID:6384
- C:\Windows\System\cTqxtge.exe
  C:\Windows\System\cTqxtge.exe
  2⤵
  PID:6400
- C:\Windows\System\YzWjCGN.exe
  C:\Windows\System\YzWjCGN.exe
  2⤵
  PID:6416
- C:\Windows\System\opMYGdW.exe
  C:\Windows\System\opMYGdW.exe
  2⤵
  PID:6432
- C:\Windows\System\bPKPGiv.exe
  C:\Windows\System\bPKPGiv.exe
  2⤵
  PID:6448
- C:\Windows\System\KzYQiAt.exe
  C:\Windows\System\KzYQiAt.exe
  2⤵
  PID:6464
- C:\Windows\System\nhPqlhE.exe
  C:\Windows\System\nhPqlhE.exe
  2⤵
  PID:6480
- C:\Windows\System\ylxduUF.exe
  C:\Windows\System\ylxduUF.exe
  2⤵
  PID:6496
- C:\Windows\System\gzMXZmm.exe
  C:\Windows\System\gzMXZmm.exe
  2⤵
  PID:6512
- C:\Windows\System\pPwXTVf.exe
  C:\Windows\System\pPwXTVf.exe
  2⤵
  PID:6528
- C:\Windows\System\gtFEtTb.exe
  C:\Windows\System\gtFEtTb.exe
  2⤵
  PID:6544
- C:\Windows\System\hJiGdPF.exe
  C:\Windows\System\hJiGdPF.exe
  2⤵
  PID:6560
- C:\Windows\System\CXtUkYW.exe
  C:\Windows\System\CXtUkYW.exe
  2⤵
  PID:6576
- C:\Windows\System\zbASWrU.exe
  C:\Windows\System\zbASWrU.exe
  2⤵
  PID:6592
- C:\Windows\System\TftOZAo.exe
  C:\Windows\System\TftOZAo.exe
  2⤵
  PID:6608
- C:\Windows\System\rEQJbDC.exe
  C:\Windows\System\rEQJbDC.exe
  2⤵
  PID:6624
- C:\Windows\System\FXgHgpy.exe
  C:\Windows\System\FXgHgpy.exe
  2⤵
  PID:6640
- C:\Windows\System\LauJREd.exe
  C:\Windows\System\LauJREd.exe
  2⤵
  PID:6656
- C:\Windows\System\jrgMulY.exe
  C:\Windows\System\jrgMulY.exe
  2⤵
  PID:6672
- C:\Windows\System\FPnHAkx.exe
  C:\Windows\System\FPnHAkx.exe
  2⤵
  PID:6688
- C:\Windows\System\LgfUtcq.exe
  C:\Windows\System\LgfUtcq.exe
  2⤵
  PID:6704
- C:\Windows\System\cIkiYgc.exe
  C:\Windows\System\cIkiYgc.exe
  2⤵
  PID:6720
- C:\Windows\System\folnRIo.exe
  C:\Windows\System\folnRIo.exe
  2⤵
  PID:6736
- C:\Windows\System\mNxmOTY.exe
  C:\Windows\System\mNxmOTY.exe
  2⤵
  PID:6752
- C:\Windows\System\uSTdlur.exe
  C:\Windows\System\uSTdlur.exe
  2⤵
  PID:6768
- C:\Windows\System\ocjifWn.exe
  C:\Windows\System\ocjifWn.exe
  2⤵
  PID:6784
- C:\Windows\System\GqMYDwY.exe
  C:\Windows\System\GqMYDwY.exe
  2⤵
  PID:6800
- C:\Windows\System\eafrhcj.exe
  C:\Windows\System\eafrhcj.exe
  2⤵
  PID:6816
- C:\Windows\System\tisFXJj.exe
  C:\Windows\System\tisFXJj.exe
  2⤵
  PID:6832
- C:\Windows\System\gQJGhOs.exe
  C:\Windows\System\gQJGhOs.exe
  2⤵
  PID:6848
- C:\Windows\System\chCgaNb.exe
  C:\Windows\System\chCgaNb.exe
  2⤵
  PID:6864
- C:\Windows\System\CqoiWbj.exe
  C:\Windows\System\CqoiWbj.exe
  2⤵
  PID:6884
- C:\Windows\System\oNusefu.exe
  C:\Windows\System\oNusefu.exe
  2⤵
  PID:6900
- C:\Windows\System\KzcnqDr.exe
  C:\Windows\System\KzcnqDr.exe
  2⤵
  PID:6916
- C:\Windows\System\KtKqXus.exe
  C:\Windows\System\KtKqXus.exe
  2⤵
  PID:6932
- C:\Windows\System\NwpcoMc.exe
  C:\Windows\System\NwpcoMc.exe
  2⤵
  PID:6948
- C:\Windows\System\zqpdTgX.exe
  C:\Windows\System\zqpdTgX.exe
  2⤵
  PID:6964
- C:\Windows\System\ShWjVMB.exe
  C:\Windows\System\ShWjVMB.exe
  2⤵
  PID:6980
- C:\Windows\System\mMhsMOd.exe
  C:\Windows\System\mMhsMOd.exe
  2⤵
  PID:6996
- C:\Windows\System\uklKfTY.exe
  C:\Windows\System\uklKfTY.exe
  2⤵
  PID:7012
- C:\Windows\System\CwDrpoo.exe
  C:\Windows\System\CwDrpoo.exe
  2⤵
  PID:7028
- C:\Windows\System\UwiPzpS.exe
  C:\Windows\System\UwiPzpS.exe
  2⤵
  PID:7044
- C:\Windows\System\IgPpYxx.exe
  C:\Windows\System\IgPpYxx.exe
  2⤵
  PID:7060
- C:\Windows\System\VdUoZSR.exe
  C:\Windows\System\VdUoZSR.exe
  2⤵
  PID:7076
- C:\Windows\System\vduwsMH.exe
  C:\Windows\System\vduwsMH.exe
  2⤵
  PID:7092
- C:\Windows\System\BVFXvok.exe
  C:\Windows\System\BVFXvok.exe
  2⤵
  PID:7108
- C:\Windows\System\eaioKbO.exe
  C:\Windows\System\eaioKbO.exe
  2⤵
  PID:7124
- C:\Windows\System\BLFCBQq.exe
  C:\Windows\System\BLFCBQq.exe
  2⤵
  PID:7140
- C:\Windows\System\YXJafoP.exe
  C:\Windows\System\YXJafoP.exe
  2⤵
  PID:7156
- C:\Windows\System\rAVJkkl.exe
  C:\Windows\System\rAVJkkl.exe
  2⤵
  PID:6152
- C:\Windows\System\KeHFbAr.exe
  C:\Windows\System\KeHFbAr.exe
  2⤵
  PID:6216
- C:\Windows\System\YfgOwXw.exe
  C:\Windows\System\YfgOwXw.exe
  2⤵
  PID:6200
- C:\Windows\System\xucMsnl.exe
  C:\Windows\System\xucMsnl.exe
  2⤵
  PID:6032
- C:\Windows\System\EJIMUhX.exe
  C:\Windows\System\EJIMUhX.exe
  2⤵
  PID:6244
- C:\Windows\System\fJEOBif.exe
  C:\Windows\System\fJEOBif.exe
  2⤵
  PID:5772
- C:\Windows\System\AReiFBr.exe
  C:\Windows\System\AReiFBr.exe
  2⤵
  PID:2580
- C:\Windows\System\mrFrBDa.exe
  C:\Windows\System\mrFrBDa.exe
  2⤵
  PID:5160
- C:\Windows\System\IgpgKnj.exe
  C:\Windows\System\IgpgKnj.exe
  2⤵
  PID:6280
- C:\Windows\System\WqvjRhx.exe
  C:\Windows\System\WqvjRhx.exe
  2⤵
  PID:6344
- C:\Windows\System\hQGHdGA.exe
  C:\Windows\System\hQGHdGA.exe
  2⤵
  PID:6376
- C:\Windows\System\CuVCKDd.exe
  C:\Windows\System\CuVCKDd.exe
  2⤵
  PID:6332
- C:\Windows\System\nCscXhI.exe
  C:\Windows\System\nCscXhI.exe
  2⤵
  PID:5428
- C:\Windows\System\uosZhXA.exe
  C:\Windows\System\uosZhXA.exe
  2⤵
  PID:6412
- C:\Windows\System\evWMEFV.exe
  C:\Windows\System\evWMEFV.exe
  2⤵
  PID:6472
- C:\Windows\System\HbtNtGu.exe
  C:\Windows\System\HbtNtGu.exe
  2⤵
  PID:5472
- C:\Windows\System\BoKQrIS.exe
  C:\Windows\System\BoKQrIS.exe
  2⤵
  PID:6456
- C:\Windows\System\jCUoSBY.exe
  C:\Windows\System\jCUoSBY.exe
  2⤵
  PID:6488
- C:\Windows\System\lcEwwGr.exe
  C:\Windows\System\lcEwwGr.exe
  2⤵
  PID:6524
- C:\Windows\System\HenKvoV.exe
  C:\Windows\System\HenKvoV.exe
  2⤵
  PID:6604
- C:\Windows\System\NVkoazM.exe
  C:\Windows\System\NVkoazM.exe
  2⤵
  PID:6616
- C:\Windows\System\BxWNDZI.exe
  C:\Windows\System\BxWNDZI.exe
  2⤵
  PID:6652
- C:\Windows\System\RbTEirx.exe
  C:\Windows\System\RbTEirx.exe
  2⤵
  PID:6696
- C:\Windows\System\yVqowPh.exe
  C:\Windows\System\yVqowPh.exe
  2⤵
  PID:6684
- C:\Windows\System\FNYXvcQ.exe
  C:\Windows\System\FNYXvcQ.exe
  2⤵
  PID:6856
- C:\Windows\System\QHMSRnk.exe
  C:\Windows\System\QHMSRnk.exe
  2⤵
  PID:6860
- C:\Windows\System\rPWEjWU.exe
  C:\Windows\System\rPWEjWU.exe
  2⤵
  PID:6928
- C:\Windows\System\vXpuuSt.exe
  C:\Windows\System\vXpuuSt.exe
  2⤵
  PID:6744
- C:\Windows\System\GkMParw.exe
  C:\Windows\System\GkMParw.exe
  2⤵
  PID:7024
- C:\Windows\System\GLjRsqk.exe
  C:\Windows\System\GLjRsqk.exe
  2⤵
  PID:6808
- C:\Windows\System\KpPvbGV.exe
  C:\Windows\System\KpPvbGV.exe
  2⤵
  PID:6872
- C:\Windows\System\zCtlpKZ.exe
  C:\Windows\System\zCtlpKZ.exe
  2⤵
  PID:6912
- C:\Windows\System\iqKRIvA.exe
  C:\Windows\System\iqKRIvA.exe
  2⤵
  PID:6976
- C:\Windows\System\dViqIfw.exe
  C:\Windows\System\dViqIfw.exe
  2⤵
  PID:7040
- C:\Windows\System\kwUBzTR.exe
  C:\Windows\System\kwUBzTR.exe
  2⤵
  PID:7088
- C:\Windows\System\rDCltXc.exe
  C:\Windows\System\rDCltXc.exe
  2⤵
  PID:7148
- C:\Windows\System\aIWWqqD.exe
  C:\Windows\System\aIWWqqD.exe
  2⤵
  PID:7152
- C:\Windows\System\qatOPjK.exe
  C:\Windows\System\qatOPjK.exe
  2⤵
  PID:6212
- C:\Windows\System\HXDhHKs.exe
  C:\Windows\System\HXDhHKs.exe
  2⤵
  PID:6196
- C:\Windows\System\ljYbTPw.exe
  C:\Windows\System\ljYbTPw.exe
  2⤵
  PID:5128
- C:\Windows\System\nZUzEJv.exe
  C:\Windows\System\nZUzEJv.exe
  2⤵
  PID:5188
- C:\Windows\System\PYzEUYg.exe
  C:\Windows\System\PYzEUYg.exe
  2⤵
  PID:6396
- C:\Windows\System\alfnnIb.exe
  C:\Windows\System\alfnnIb.exe
  2⤵
  PID:6228
- C:\Windows\System\SNVovbm.exe
  C:\Windows\System\SNVovbm.exe
  2⤵
  PID:6476
- C:\Windows\System\HosMMyV.exe
  C:\Windows\System\HosMMyV.exe
  2⤵
  PID:6364
- C:\Windows\System\nfhsmPa.exe
  C:\Windows\System\nfhsmPa.exe
  2⤵
  PID:6556
- C:\Windows\System\LVXgWhQ.exe
  C:\Windows\System\LVXgWhQ.exe
  2⤵
  PID:6520
- C:\Windows\System\tLoVxnu.exe
  C:\Windows\System\tLoVxnu.exe
  2⤵
  PID:6732
- C:\Windows\System\JnOMfnD.exe
  C:\Windows\System\JnOMfnD.exe
  2⤵
  PID:6700
- C:\Windows\System\TZAqCyM.exe
  C:\Windows\System\TZAqCyM.exe
  2⤵
  PID:6796
- C:\Windows\System\dXgzJLV.exe
  C:\Windows\System\dXgzJLV.exe
  2⤵
  PID:6924
- C:\Windows\System\IbQyLyE.exe
  C:\Windows\System\IbQyLyE.exe
  2⤵
  PID:6988
- C:\Windows\System\JukkXvS.exe
  C:\Windows\System\JukkXvS.exe
  2⤵
  PID:7036
- C:\Windows\System\lHatAWo.exe
  C:\Windows\System\lHatAWo.exe
  2⤵
  PID:7116
- C:\Windows\System\koShfUd.exe
  C:\Windows\System\koShfUd.exe
  2⤵
  PID:5664
- C:\Windows\System\QSlnXHw.exe
  C:\Windows\System\QSlnXHw.exe
  2⤵
  PID:7104
- C:\Windows\System\kDefjWp.exe
  C:\Windows\System\kDefjWp.exe
  2⤵
  PID:6972
- C:\Windows\System\kIQMKYt.exe
  C:\Windows\System\kIQMKYt.exe
  2⤵
  PID:6000
- C:\Windows\System\oPZjVwW.exe
  C:\Windows\System\oPZjVwW.exe
  2⤵
  PID:4896
- C:\Windows\System\wSCdjIf.exe
  C:\Windows\System\wSCdjIf.exe
  2⤵
  PID:6444
- C:\Windows\System\zqZLetP.exe
  C:\Windows\System\zqZLetP.exe
  2⤵
  PID:6776
- C:\Windows\System\NqkDqnj.exe
  C:\Windows\System\NqkDqnj.exe
  2⤵
  PID:5740
- C:\Windows\System\ezuhPYc.exe
  C:\Windows\System\ezuhPYc.exe
  2⤵
  PID:6908
- C:\Windows\System\XEEhCph.exe
  C:\Windows\System\XEEhCph.exe
  2⤵
  PID:7056
- C:\Windows\System\QHrWVDH.exe
  C:\Windows\System\QHrWVDH.exe
  2⤵
  PID:6380
- C:\Windows\System\HMApREo.exe
  C:\Windows\System\HMApREo.exe
  2⤵
  PID:6492
- C:\Windows\System\CMjmqjQ.exe
  C:\Windows\System\CMjmqjQ.exe
  2⤵
  PID:6664
- C:\Windows\System\XoNzyDn.exe
  C:\Windows\System\XoNzyDn.exe
  2⤵
  PID:7020
- C:\Windows\System\nEfYvaU.exe
  C:\Windows\System\nEfYvaU.exe
  2⤵
  PID:6168
- C:\Windows\System\kDyDydt.exe
  C:\Windows\System\kDyDydt.exe
  2⤵
  PID:7196
- C:\Windows\System\JURZWmv.exe
  C:\Windows\System\JURZWmv.exe
  2⤵
  PID:7212
- C:\Windows\System\PohMexz.exe
  C:\Windows\System\PohMexz.exe
  2⤵
  PID:7228
- C:\Windows\System\vbtRosl.exe
  C:\Windows\System\vbtRosl.exe
  2⤵
  PID:7244
- C:\Windows\System\nSwHTIP.exe
  C:\Windows\System\nSwHTIP.exe
  2⤵
  PID:7260
- C:\Windows\System\ypbHZtv.exe
  C:\Windows\System\ypbHZtv.exe
  2⤵
  PID:7276
- C:\Windows\System\PTyBjbQ.exe
  C:\Windows\System\PTyBjbQ.exe
  2⤵
  PID:7292
- C:\Windows\System\IbeVEvB.exe
  C:\Windows\System\IbeVEvB.exe
  2⤵
  PID:7308
- C:\Windows\System\LgUdRnR.exe
  C:\Windows\System\LgUdRnR.exe
  2⤵
  PID:7324
- C:\Windows\System\dlDvbIh.exe
  C:\Windows\System\dlDvbIh.exe
  2⤵
  PID:7340
- C:\Windows\System\NvNHWyc.exe
  C:\Windows\System\NvNHWyc.exe
  2⤵
  PID:7356
- C:\Windows\System\KsBzyph.exe
  C:\Windows\System\KsBzyph.exe
  2⤵
  PID:7372
- C:\Windows\System\WuNTNWU.exe
  C:\Windows\System\WuNTNWU.exe
  2⤵
  PID:7388
- C:\Windows\System\DEBJUOI.exe
  C:\Windows\System\DEBJUOI.exe
  2⤵
  PID:7404
- C:\Windows\System\GDYJSyV.exe
  C:\Windows\System\GDYJSyV.exe
  2⤵
  PID:7420
- C:\Windows\System\oBTCpxX.exe
  C:\Windows\System\oBTCpxX.exe
  2⤵
  PID:7436
- C:\Windows\System\OTukmVy.exe
  C:\Windows\System\OTukmVy.exe
  2⤵
  PID:7452
- C:\Windows\System\TxQHPGj.exe
  C:\Windows\System\TxQHPGj.exe
  2⤵
  PID:7468
- C:\Windows\System\mvvouzd.exe
  C:\Windows\System\mvvouzd.exe
  2⤵
  PID:7484
- C:\Windows\System\gVfrQDc.exe
  C:\Windows\System\gVfrQDc.exe
  2⤵
  PID:7500
- C:\Windows\System\hAqqJcm.exe
  C:\Windows\System\hAqqJcm.exe
  2⤵
  PID:7516
- C:\Windows\System\rjwYlIr.exe
  C:\Windows\System\rjwYlIr.exe
  2⤵
  PID:7532
- C:\Windows\System\kSRDKEW.exe
  C:\Windows\System\kSRDKEW.exe
  2⤵
  PID:7548
- C:\Windows\System\HaXvAKT.exe
  C:\Windows\System\HaXvAKT.exe
  2⤵
  PID:7564
- C:\Windows\System\hsJkALW.exe
  C:\Windows\System\hsJkALW.exe
  2⤵
  PID:7580
- C:\Windows\System\xESAACG.exe
  C:\Windows\System\xESAACG.exe
  2⤵
  PID:7596
- C:\Windows\System\aitpWyZ.exe
  C:\Windows\System\aitpWyZ.exe
  2⤵
  PID:7612
- C:\Windows\System\VFuwLPB.exe
  C:\Windows\System\VFuwLPB.exe
  2⤵
  PID:7628
- C:\Windows\System\tEZNaoh.exe
  C:\Windows\System\tEZNaoh.exe
  2⤵
  PID:7644
- C:\Windows\System\NYeNRkt.exe
  C:\Windows\System\NYeNRkt.exe
  2⤵
  PID:7660
- C:\Windows\System\RdlqhHB.exe
  C:\Windows\System\RdlqhHB.exe
  2⤵
  PID:7676
- C:\Windows\System\xmTDDWf.exe
  C:\Windows\System\xmTDDWf.exe
  2⤵
  PID:7692
- C:\Windows\System\VwkkuDD.exe
  C:\Windows\System\VwkkuDD.exe
  2⤵
  PID:7708
- C:\Windows\System\sQyNmaN.exe
  C:\Windows\System\sQyNmaN.exe
  2⤵
  PID:7724
- C:\Windows\System\dEUbHuN.exe
  C:\Windows\System\dEUbHuN.exe
  2⤵
  PID:7740
- C:\Windows\System\RZZMbQG.exe
  C:\Windows\System\RZZMbQG.exe
  2⤵
  PID:7760
- C:\Windows\System\eqINoCI.exe
  C:\Windows\System\eqINoCI.exe
  2⤵
  PID:7776
- C:\Windows\System\KxpYFSI.exe
  C:\Windows\System\KxpYFSI.exe
  2⤵
  PID:7792
- C:\Windows\System\dkyuESG.exe
  C:\Windows\System\dkyuESG.exe
  2⤵
  PID:7808
- C:\Windows\System\PdUwpQi.exe
  C:\Windows\System\PdUwpQi.exe
  2⤵
  PID:7824
- C:\Windows\System\AdcEDws.exe
  C:\Windows\System\AdcEDws.exe
  2⤵
  PID:7840
- C:\Windows\System\wvelrYE.exe
  C:\Windows\System\wvelrYE.exe
  2⤵
  PID:7856
- C:\Windows\System\UZxkbKV.exe
  C:\Windows\System\UZxkbKV.exe
  2⤵
  PID:7872
- C:\Windows\System\wzUlxIY.exe
  C:\Windows\System\wzUlxIY.exe
  2⤵
  PID:7888
- C:\Windows\System\gRkLpJI.exe
  C:\Windows\System\gRkLpJI.exe
  2⤵
  PID:7904
- C:\Windows\System\mHYLycq.exe
  C:\Windows\System\mHYLycq.exe
  2⤵
  PID:7920
- C:\Windows\System\EvDfIBD.exe
  C:\Windows\System\EvDfIBD.exe
  2⤵
  PID:7936
- C:\Windows\System\GkAnnUX.exe
  C:\Windows\System\GkAnnUX.exe
  2⤵
  PID:7952
- C:\Windows\System\YFkperx.exe
  C:\Windows\System\YFkperx.exe
  2⤵
  PID:7968
- C:\Windows\System\lGUHxqt.exe
  C:\Windows\System\lGUHxqt.exe
  2⤵
  PID:7984
- C:\Windows\System\GspZpUE.exe
  C:\Windows\System\GspZpUE.exe
  2⤵
  PID:8000
- C:\Windows\System\HtpfNbF.exe
  C:\Windows\System\HtpfNbF.exe
  2⤵
  PID:8016
- C:\Windows\System\GQDMLBB.exe
  C:\Windows\System\GQDMLBB.exe
  2⤵
  PID:8036
- C:\Windows\System\skkvcdT.exe
  C:\Windows\System\skkvcdT.exe
  2⤵
  PID:8052
- C:\Windows\System\VKOXTBx.exe
  C:\Windows\System\VKOXTBx.exe
  2⤵
  PID:8068
- C:\Windows\System\GZypQGD.exe
  C:\Windows\System\GZypQGD.exe
  2⤵
  PID:8084
- C:\Windows\System\fRPBebj.exe
  C:\Windows\System\fRPBebj.exe
  2⤵
  PID:8100
- C:\Windows\System\qposesY.exe
  C:\Windows\System\qposesY.exe
  2⤵
  PID:8156
- C:\Windows\System\mfANkQe.exe
  C:\Windows\System\mfANkQe.exe
  2⤵
  PID:8172
- C:\Windows\System\YSJDHfL.exe
  C:\Windows\System\YSJDHfL.exe
  2⤵
  PID:8188
- C:\Windows\System\drGXaSV.exe
  C:\Windows\System\drGXaSV.exe
  2⤵
  PID:7180
- C:\Windows\System\JZQtfWk.exe
  C:\Windows\System\JZQtfWk.exe
  2⤵
  PID:6992
- C:\Windows\System\TRqOxXj.exe
  C:\Windows\System\TRqOxXj.exe
  2⤵
  PID:6680
- C:\Windows\System\TTZihqG.exe
  C:\Windows\System\TTZihqG.exe
  2⤵
  PID:7256
- C:\Windows\System\tQwTwBk.exe
  C:\Windows\System\tQwTwBk.exe
  2⤵
  PID:7320
- C:\Windows\System\pmXcFQi.exe
  C:\Windows\System\pmXcFQi.exe
  2⤵
  PID:6536
- C:\Windows\System\qygSSiA.exe
  C:\Windows\System\qygSSiA.exe
  2⤵
  PID:6844
- C:\Windows\System\UwGtPdJ.exe
  C:\Windows\System\UwGtPdJ.exe
  2⤵
  PID:7444
- C:\Windows\System\nmGdlyF.exe
  C:\Windows\System\nmGdlyF.exe
  2⤵
  PID:7208
- C:\Windows\System\PfadDPG.exe
  C:\Windows\System\PfadDPG.exe
  2⤵
  PID:7544
- C:\Windows\System\KHTnhLS.exe
  C:\Windows\System\KHTnhLS.exe
  2⤵
  PID:7268
- C:\Windows\System\zguMtWG.exe
  C:\Windows\System\zguMtWG.exe
  2⤵
  PID:7332
- C:\Windows\System\kyrszHM.exe
  C:\Windows\System\kyrszHM.exe
  2⤵
  PID:7528
- C:\Windows\System\PycSrzk.exe
  C:\Windows\System\PycSrzk.exe
  2⤵
  PID:7576
- C:\Windows\System\YYyXmky.exe
  C:\Windows\System\YYyXmky.exe
  2⤵
  PID:7460
- C:\Windows\System\SnZKCmR.exe
  C:\Windows\System\SnZKCmR.exe
  2⤵
  PID:7396
- C:\Windows\System\CyIPXqM.exe
  C:\Windows\System\CyIPXqM.exe
  2⤵
  PID:7636
- C:\Windows\System\HYNUIEJ.exe
  C:\Windows\System\HYNUIEJ.exe
  2⤵
  PID:7700
- C:\Windows\System\seRotRH.exe
  C:\Windows\System\seRotRH.exe
  2⤵
  PID:7772
- C:\Windows\System\xsYSjlW.exe
  C:\Windows\System\xsYSjlW.exe
  2⤵
  PID:7836
- C:\Windows\System\aVBqiGu.exe
  C:\Windows\System\aVBqiGu.exe
  2⤵
  PID:7900
- C:\Windows\System\oIFRVmD.exe
  C:\Windows\System\oIFRVmD.exe
  2⤵
  PID:7964
- C:\Windows\System\vWeUfxd.exe
  C:\Windows\System\vWeUfxd.exe
  2⤵
  PID:7816
- C:\Windows\System\DAHGqqV.exe
  C:\Windows\System\DAHGqqV.exe
  2⤵
  PID:7884
- C:\Windows\System\fHSbYBV.exe
  C:\Windows\System\fHSbYBV.exe
  2⤵
  PID:7948
- C:\Windows\System\EvZBVRt.exe
  C:\Windows\System\EvZBVRt.exe
  2⤵
  PID:7592
- C:\Windows\System\lLZsnzE.exe
  C:\Windows\System\lLZsnzE.exe
  2⤵
  PID:8032
- C:\Windows\System\MdbLSsT.exe
  C:\Windows\System\MdbLSsT.exe
  2⤵
  PID:7656
- C:\Windows\System\rpwWRym.exe
  C:\Windows\System\rpwWRym.exe
  2⤵
  PID:7720
- C:\Windows\System\DGydWqR.exe
  C:\Windows\System\DGydWqR.exe
  2⤵
  PID:7820
- C:\Windows\System\bvuKdZh.exe
  C:\Windows\System\bvuKdZh.exe
  2⤵
  PID:8096
- C:\Windows\System\WSNqAUM.exe
  C:\Windows\System\WSNqAUM.exe
  2⤵
  PID:8044
- C:\Windows\System\mvXKiUy.exe
  C:\Windows\System\mvXKiUy.exe
  2⤵
  PID:8120
- C:\Windows\System\zOuKNkV.exe
  C:\Windows\System\zOuKNkV.exe
  2⤵
  PID:8132
- C:\Windows\System\DJEjPXY.exe
  C:\Windows\System\DJEjPXY.exe
  2⤵
  PID:8152
- C:\Windows\System\pEFWSdS.exe
  C:\Windows\System\pEFWSdS.exe
  2⤵
  PID:7132
- C:\Windows\System\fgYTazh.exe
  C:\Windows\System\fgYTazh.exe
  2⤵
  PID:7084
- C:\Windows\System\nzcMtiZ.exe
  C:\Windows\System\nzcMtiZ.exe
  2⤵
  PID:7380
- C:\Windows\System\KmZcrhm.exe
  C:\Windows\System\KmZcrhm.exe
  2⤵
  PID:7192
- C:\Windows\System\nrxMKEX.exe
  C:\Windows\System\nrxMKEX.exe
  2⤵
  PID:7512
- C:\Windows\System\pkUkGTQ.exe
  C:\Windows\System\pkUkGTQ.exe
  2⤵
  PID:7240
- C:\Windows\System\RdVaxPh.exe
  C:\Windows\System\RdVaxPh.exe
  2⤵
  PID:7364
- C:\Windows\System\EAYUKtg.exe
  C:\Windows\System\EAYUKtg.exe
  2⤵
  PID:7608
- C:\Windows\System\JLvhttn.exe
  C:\Windows\System\JLvhttn.exe
  2⤵
  PID:7752
- C:\Windows\System\YFoPVbY.exe
  C:\Windows\System\YFoPVbY.exe
  2⤵
  PID:7868
- C:\Windows\System\DLZSmAh.exe
  C:\Windows\System\DLZSmAh.exe
  2⤵
  PID:7428
- C:\Windows\System\nUgJJHt.exe
  C:\Windows\System\nUgJJHt.exe
  2⤵
  PID:7716
- C:\Windows\System\JtqSnKU.exe
  C:\Windows\System\JtqSnKU.exe
  2⤵
  PID:7560
- C:\Windows\System\DlmnCWw.exe
  C:\Windows\System\DlmnCWw.exe
  2⤵
  PID:8112
- C:\Windows\System\IvjVJMX.exe
  C:\Windows\System\IvjVJMX.exe
  2⤵
  PID:8140
- C:\Windows\System\EaSnCkB.exe
  C:\Windows\System\EaSnCkB.exe
  2⤵
  PID:7804
- C:\Windows\System\nCKLfUY.exe
  C:\Windows\System\nCKLfUY.exe
  2⤵
  PID:8076
- C:\Windows\System\BuKKtMl.exe
  C:\Windows\System\BuKKtMl.exe
  2⤵
  PID:7288
- C:\Windows\System\GTpFPce.exe
  C:\Windows\System\GTpFPce.exe
  2⤵
  PID:7236
- C:\Windows\System\RDPdJgg.exe
  C:\Windows\System\RDPdJgg.exe
  2⤵
  PID:7172
- C:\Windows\System\NtZisZU.exe
  C:\Windows\System\NtZisZU.exe
  2⤵
  PID:7416
- C:\Windows\System\ppYbEtJ.exe
  C:\Windows\System\ppYbEtJ.exe
  2⤵
  PID:7464
- C:\Windows\System\abeuHpL.exe
  C:\Windows\System\abeuHpL.exe
  2⤵
  PID:7768
- C:\Windows\System\ggGrtup.exe
  C:\Windows\System\ggGrtup.exe
  2⤵
  PID:8028
- C:\Windows\System\twmJWkX.exe
  C:\Windows\System\twmJWkX.exe
  2⤵
  PID:7832
- C:\Windows\System\cHxTQkw.exe
  C:\Windows\System\cHxTQkw.exe
  2⤵
  PID:7652
- C:\Windows\System\pypXzJu.exe
  C:\Windows\System\pypXzJu.exe
  2⤵
  PID:7932
- C:\Windows\System\rmPjReY.exe
  C:\Windows\System\rmPjReY.exe
  2⤵
  PID:7980
- C:\Windows\System\DqDTKwZ.exe
  C:\Windows\System\DqDTKwZ.exe
  2⤵
  PID:7176
- C:\Windows\System\EnXfOnC.exe
  C:\Windows\System\EnXfOnC.exe
  2⤵
  PID:7412
- C:\Windows\System\dbUdbYk.exe
  C:\Windows\System\dbUdbYk.exe
  2⤵
  PID:7944
- C:\Windows\System\qAPkWvV.exe
  C:\Windows\System\qAPkWvV.exe
  2⤵
  PID:8048
- C:\Windows\System\PEcaGYf.exe
  C:\Windows\System\PEcaGYf.exe
  2⤵
  PID:8024
- C:\Windows\System\cXxbHyO.exe
  C:\Windows\System\cXxbHyO.exe
  2⤵
  PID:7756
- C:\Windows\System\wTWHlnX.exe
  C:\Windows\System\wTWHlnX.exe
  2⤵
  PID:8196
- C:\Windows\System\WVsmCKh.exe
  C:\Windows\System\WVsmCKh.exe
  2⤵
  PID:8212
- C:\Windows\System\dwvpHMX.exe
  C:\Windows\System\dwvpHMX.exe
  2⤵
  PID:8228
- C:\Windows\System\vfDFtvv.exe
  C:\Windows\System\vfDFtvv.exe
  2⤵
  PID:8244
- C:\Windows\System\eabslcR.exe
  C:\Windows\System\eabslcR.exe
  2⤵
  PID:8260
- C:\Windows\System\IdgULZV.exe
  C:\Windows\System\IdgULZV.exe
  2⤵
  PID:8276
- C:\Windows\System\AmwAhVP.exe
  C:\Windows\System\AmwAhVP.exe
  2⤵
  PID:8292
- C:\Windows\System\okvHykM.exe
  C:\Windows\System\okvHykM.exe
  2⤵
  PID:8308
- C:\Windows\System\EWqMUPZ.exe
  C:\Windows\System\EWqMUPZ.exe
  2⤵
  PID:8324
- C:\Windows\System\sVGFBwv.exe
  C:\Windows\System\sVGFBwv.exe
  2⤵
  PID:8340
- C:\Windows\System\RhxEAMg.exe
  C:\Windows\System\RhxEAMg.exe
  2⤵
  PID:8356
- C:\Windows\System\cDdhQJU.exe
  C:\Windows\System\cDdhQJU.exe
  2⤵
  PID:8372
- C:\Windows\System\DBnosay.exe
  C:\Windows\System\DBnosay.exe
  2⤵
  PID:8388
- C:\Windows\System\doeaiFE.exe
  C:\Windows\System\doeaiFE.exe
  2⤵
  PID:8404
- C:\Windows\System\HdHbwMh.exe
  C:\Windows\System\HdHbwMh.exe
  2⤵
  PID:8420
- C:\Windows\System\BgZIvMw.exe
  C:\Windows\System\BgZIvMw.exe
  2⤵
  PID:8436
- C:\Windows\System\cCnrwnF.exe
  C:\Windows\System\cCnrwnF.exe
  2⤵
  PID:8452
- C:\Windows\System\BFLfLmJ.exe
  C:\Windows\System\BFLfLmJ.exe
  2⤵
  PID:8468
- C:\Windows\System\wNDNqXZ.exe
  C:\Windows\System\wNDNqXZ.exe
  2⤵
  PID:8484
- C:\Windows\System\POsiawf.exe
  C:\Windows\System\POsiawf.exe
  2⤵
  PID:8500
- C:\Windows\System\WQzExQE.exe
  C:\Windows\System\WQzExQE.exe
  2⤵
  PID:8516
- C:\Windows\System\wLdwNaR.exe
  C:\Windows\System\wLdwNaR.exe
  2⤵
  PID:8532
- C:\Windows\System\WMeCfQD.exe
  C:\Windows\System\WMeCfQD.exe
  2⤵
  PID:8548
- C:\Windows\System\nYOAjhU.exe
  C:\Windows\System\nYOAjhU.exe
  2⤵
  PID:8564
- C:\Windows\System\HapptvX.exe
  C:\Windows\System\HapptvX.exe
  2⤵
  PID:8580
- C:\Windows\System\oYutsiJ.exe
  C:\Windows\System\oYutsiJ.exe
  2⤵
  PID:8596
- C:\Windows\System\fuGViVV.exe
  C:\Windows\System\fuGViVV.exe
  2⤵
  PID:8612
- C:\Windows\System\szedemX.exe
  C:\Windows\System\szedemX.exe
  2⤵
  PID:8712
- C:\Windows\System\hQBRdTx.exe
  C:\Windows\System\hQBRdTx.exe
  2⤵
  PID:8740
- C:\Windows\System\QQzLOMR.exe
  C:\Windows\System\QQzLOMR.exe
  2⤵
  PID:8756
- C:\Windows\System\uaOqxTh.exe
  C:\Windows\System\uaOqxTh.exe
  2⤵
  PID:8772
- C:\Windows\System\gewNAUq.exe
  C:\Windows\System\gewNAUq.exe
  2⤵
  PID:8796
- C:\Windows\System\mtHbOjL.exe
  C:\Windows\System\mtHbOjL.exe
  2⤵
  PID:8812
- C:\Windows\System\lhlbOxr.exe
  C:\Windows\System\lhlbOxr.exe
  2⤵
  PID:8828
- C:\Windows\System\fxmEfcf.exe
  C:\Windows\System\fxmEfcf.exe
  2⤵
  PID:8844
- C:\Windows\System\acCJYrp.exe
  C:\Windows\System\acCJYrp.exe
  2⤵
  PID:8860
- C:\Windows\System\IyXzpzO.exe
  C:\Windows\System\IyXzpzO.exe
  2⤵
  PID:8988
- C:\Windows\System\mYlltYZ.exe
  C:\Windows\System\mYlltYZ.exe
  2⤵
  PID:9012
- C:\Windows\System\cqJwxNE.exe
  C:\Windows\System\cqJwxNE.exe
  2⤵
  PID:9028
- C:\Windows\System\MfjBVei.exe
  C:\Windows\System\MfjBVei.exe
  2⤵
  PID:9044
- C:\Windows\System\RmVuhYF.exe
  C:\Windows\System\RmVuhYF.exe
  2⤵
  PID:9060
- C:\Windows\System\cntvRXh.exe
  C:\Windows\System\cntvRXh.exe
  2⤵
  PID:9076
- C:\Windows\System\CaEmssR.exe
  C:\Windows\System\CaEmssR.exe
  2⤵
  PID:9092
- C:\Windows\System\IWOcDGQ.exe
  C:\Windows\System\IWOcDGQ.exe
  2⤵
  PID:9108
- C:\Windows\System\zEdAcOp.exe
  C:\Windows\System\zEdAcOp.exe
  2⤵
  PID:9124
- C:\Windows\System\XkdoZkg.exe
  C:\Windows\System\XkdoZkg.exe
  2⤵
  PID:9140
- C:\Windows\System\iBmxeap.exe
  C:\Windows\System\iBmxeap.exe
  2⤵
  PID:9156
- C:\Windows\System\GBcmMyK.exe
  C:\Windows\System\GBcmMyK.exe
  2⤵
  PID:9172
- C:\Windows\System\BvHurXZ.exe
  C:\Windows\System\BvHurXZ.exe
  2⤵
  PID:9188
- C:\Windows\System\WzTqdqw.exe
  C:\Windows\System\WzTqdqw.exe
  2⤵
  PID:9204
- C:\Windows\System\WQlNobt.exe
  C:\Windows\System\WQlNobt.exe
  2⤵
  PID:7224
- C:\Windows\System\RWvLAfV.exe
  C:\Windows\System\RWvLAfV.exe
  2⤵
  PID:8680
- C:\Windows\System\cqFtMIU.exe
  C:\Windows\System\cqFtMIU.exe
  2⤵
  PID:8704
- C:\Windows\System\fZPYvYv.exe
  C:\Windows\System\fZPYvYv.exe
  2⤵
  PID:8724
- C:\Windows\System\GrfiqGo.exe
  C:\Windows\System\GrfiqGo.exe
  2⤵
  PID:8784
- C:\Windows\System\ZnQgmZj.exe
  C:\Windows\System\ZnQgmZj.exe
  2⤵
  PID:8852
- C:\Windows\System\MmOplWv.exe
  C:\Windows\System\MmOplWv.exe
  2⤵
  PID:8736
- C:\Windows\System\pWbbySm.exe
  C:\Windows\System\pWbbySm.exe
  2⤵
  PID:8840
- C:\Windows\System\KOlTuNV.exe
  C:\Windows\System\KOlTuNV.exe
  2⤵
  PID:8872
- C:\Windows\System\AvBAiif.exe
  C:\Windows\System\AvBAiif.exe
  2⤵
  PID:8936
- C:\Windows\System\fRBrvAk.exe
  C:\Windows\System\fRBrvAk.exe
  2⤵
  PID:8956
- C:\Windows\System\BesqPQF.exe
  C:\Windows\System\BesqPQF.exe
  2⤵
  PID:8972
- C:\Windows\System\lEGnPRE.exe
  C:\Windows\System\lEGnPRE.exe
  2⤵
  PID:8996
- C:\Windows\System\CRXjfrG.exe
  C:\Windows\System\CRXjfrG.exe
  2⤵
  PID:9036
- C:\Windows\System\WuMmqSm.exe
  C:\Windows\System\WuMmqSm.exe
  2⤵
  PID:9072
- C:\Windows\System\vXbUwgS.exe
  C:\Windows\System\vXbUwgS.exe
  2⤵
  PID:9100
- C:\Windows\System\RmUBVWr.exe
  C:\Windows\System\RmUBVWr.exe
  2⤵
  PID:9164
- C:\Windows\System\gdJbgCN.exe
  C:\Windows\System\gdJbgCN.exe
  2⤵
  PID:8108
- C:\Windows\System\KhqFDXc.exe
  C:\Windows\System\KhqFDXc.exe
  2⤵
  PID:9116
- C:\Windows\System\utWWrLT.exe
  C:\Windows\System\utWWrLT.exe
  2⤵
  PID:8204
- C:\Windows\System\JhdKYCE.exe
  C:\Windows\System\JhdKYCE.exe
  2⤵
  PID:8236
- C:\Windows\System\bAiCeyf.exe
  C:\Windows\System\bAiCeyf.exe
  2⤵
  PID:8304
- C:\Windows\System\cUziCcg.exe
  C:\Windows\System\cUziCcg.exe
  2⤵
  PID:8368
- C:\Windows\System\yDhQPTd.exe
  C:\Windows\System\yDhQPTd.exe
  2⤵
  PID:8432
- C:\Windows\System\rxeanHN.exe
  C:\Windows\System\rxeanHN.exe
  2⤵
  PID:8496
- C:\Windows\System\zYExgiA.exe
  C:\Windows\System\zYExgiA.exe
  2⤵
  PID:8528
- C:\Windows\System\pKXjGNn.exe
  C:\Windows\System\pKXjGNn.exe
  2⤵
  PID:8252
- C:\Windows\System\JFnkspq.exe
  C:\Windows\System\JFnkspq.exe
  2⤵
  PID:8320
- C:\Windows\System\DOddkGl.exe
  C:\Windows\System\DOddkGl.exe
  2⤵
  PID:8476
- C:\Windows\System\gbdWByF.exe
  C:\Windows\System\gbdWByF.exe
  2⤵
  PID:8416
- C:\Windows\System\rjZwwoK.exe
  C:\Windows\System\rjZwwoK.exe
  2⤵
  PID:8560
- C:\Windows\System\wpmzqOZ.exe
  C:\Windows\System\wpmzqOZ.exe
  2⤵
  PID:8544
- C:\Windows\System\hSbcaLX.exe
  C:\Windows\System\hSbcaLX.exe
  2⤵
  PID:8628
- C:\Windows\System\HupbIal.exe
  C:\Windows\System\HupbIal.exe
  2⤵
  PID:8636
- C:\Windows\System\FJMNsir.exe
  C:\Windows\System\FJMNsir.exe
  2⤵
  PID:8656
- C:\Windows\System\SRWJUWB.exe
  C:\Windows\System\SRWJUWB.exe
  2⤵
  PID:8940
- C:\Windows\System\ygbCzzo.exe
  C:\Windows\System\ygbCzzo.exe
  2⤵
  PID:8692
- C:\Windows\System\HFdJShF.exe
  C:\Windows\System\HFdJShF.exe
  2⤵
  PID:8764
- C:\Windows\System\rxoatRi.exe
  C:\Windows\System\rxoatRi.exe
  2⤵
  PID:8732
- C:\Windows\System\rmjdaaQ.exe
  C:\Windows\System\rmjdaaQ.exe
  2⤵
  PID:8792
- C:\Windows\System\nRWyYes.exe
  C:\Windows\System\nRWyYes.exe
  2⤵
  PID:8824
- C:\Windows\System\zvQZNjE.exe
  C:\Windows\System\zvQZNjE.exe
  2⤵
  PID:8928
- C:\Windows\System\FeWJMdF.exe
  C:\Windows\System\FeWJMdF.exe
  2⤵
  PID:8908
- C:\Windows\System\wFmDShA.exe
  C:\Windows\System\wFmDShA.exe
  2⤵
  PID:9008
- C:\Windows\System\BCRsHzF.exe
  C:\Windows\System\BCRsHzF.exe
  2⤵
  PID:9196
- C:\Windows\System\QfwaTih.exe
  C:\Windows\System\QfwaTih.exe
  2⤵
  PID:8952
- C:\Windows\System\oOOhbRj.exe
  C:\Windows\System\oOOhbRj.exe
  2⤵
  PID:9088
- C:\Windows\System\sUGcUlY.exe
  C:\Windows\System\sUGcUlY.exe
  2⤵
  PID:8272
- C:\Windows\System\HBjkdlY.exe
  C:\Windows\System\HBjkdlY.exe
  2⤵
  PID:8524
- C:\Windows\System\gsJvZqd.exe
  C:\Windows\System\gsJvZqd.exe
  2⤵
  PID:8448
- C:\Windows\System\UbvFbev.exe
  C:\Windows\System\UbvFbev.exe
  2⤵
  PID:8624
- C:\Windows\System\nCiWlIz.exe
  C:\Windows\System\nCiWlIz.exe
  2⤵
  PID:8984
- C:\Windows\System\PpMBEgh.exe
  C:\Windows\System\PpMBEgh.exe
  2⤵
  PID:8672
- C:\Windows\System\LlLsVyy.exe
  C:\Windows\System\LlLsVyy.exe
  2⤵
  PID:8480
- C:\Windows\System\XwcuudX.exe
  C:\Windows\System\XwcuudX.exe
  2⤵
  PID:8896
- C:\Windows\System\KTQnlqx.exe
  C:\Windows\System\KTQnlqx.exe
  2⤵
  PID:8220
- C:\Windows\System\xJqixjh.exe
  C:\Windows\System\xJqixjh.exe
  2⤵
  PID:8380
- C:\Windows\System\tYcqqAU.exe
  C:\Windows\System\tYcqqAU.exe
  2⤵
  PID:8336
- C:\Windows\System\TOsdeTW.exe
  C:\Windows\System\TOsdeTW.exe
  2⤵
  PID:8648
- C:\Windows\System\AQIbRda.exe
  C:\Windows\System\AQIbRda.exe
  2⤵
  PID:8884
- C:\Windows\System\OcIEDnz.exe
  C:\Windows\System\OcIEDnz.exe
  2⤵
  PID:8932
- C:\Windows\System\OzahNhx.exe
  C:\Windows\System\OzahNhx.exe
  2⤵
  PID:9056
- C:\Windows\System\oJZgAzv.exe
  C:\Windows\System\oJZgAzv.exe
  2⤵
  PID:9132
- C:\Windows\System\MAJNIzo.exe
  C:\Windows\System\MAJNIzo.exe
  2⤵
  PID:8316
- C:\Windows\System\KahTBjP.exe
  C:\Windows\System\KahTBjP.exe
  2⤵
  PID:8540
- C:\Windows\System\KYokOIe.exe
  C:\Windows\System\KYokOIe.exe
  2⤵
  PID:8644
- C:\Windows\System\oFPXAJd.exe
  C:\Windows\System\oFPXAJd.exe
  2⤵
  PID:8904
- C:\Windows\System\JFzbPmP.exe
  C:\Windows\System\JFzbPmP.exe
  2⤵
  PID:8492
- C:\Windows\System\AjXtpSA.exe
  C:\Windows\System\AjXtpSA.exe
  2⤵
  PID:8428
- C:\Windows\System\UybiWfN.exe
  C:\Windows\System\UybiWfN.exe
  2⤵
  PID:7880
- C:\Windows\System\FEELPAF.exe
  C:\Windows\System\FEELPAF.exe
  2⤵
  PID:8652
- C:\Windows\System\oKuABJU.exe
  C:\Windows\System\oKuABJU.exe
  2⤵
  PID:8620
- C:\Windows\System\HUPXMAr.exe
  C:\Windows\System\HUPXMAr.exe
  2⤵
  PID:9136
- C:\Windows\System\SwWvgsQ.exe
  C:\Windows\System\SwWvgsQ.exe
  2⤵
  PID:8572
- C:\Windows\System\BoVWdaV.exe
  C:\Windows\System\BoVWdaV.exe
  2⤵
  PID:8664
- C:\Windows\System\ujdACGL.exe
  C:\Windows\System\ujdACGL.exe
  2⤵
  PID:8856
- C:\Windows\System\kKqCTFW.exe
  C:\Windows\System\kKqCTFW.exe
  2⤵
  PID:9228
- C:\Windows\System\gRJTodk.exe
  C:\Windows\System\gRJTodk.exe
  2⤵
  PID:9244
- C:\Windows\System\gAHYhST.exe
  C:\Windows\System\gAHYhST.exe
  2⤵
  PID:9260
- C:\Windows\System\FnfXyNn.exe
  C:\Windows\System\FnfXyNn.exe
  2⤵
  PID:9276
- C:\Windows\System\gnxArql.exe
  C:\Windows\System\gnxArql.exe
  2⤵
  PID:9296
- C:\Windows\System\SDOFPvg.exe
  C:\Windows\System\SDOFPvg.exe
  2⤵
  PID:9312
- C:\Windows\System\rRXADJv.exe
  C:\Windows\System\rRXADJv.exe
  2⤵
  PID:9328
- C:\Windows\System\nNfKYRz.exe
  C:\Windows\System\nNfKYRz.exe
  2⤵
  PID:9348
- C:\Windows\System\rRXdvOZ.exe
  C:\Windows\System\rRXdvOZ.exe
  2⤵
  PID:9364
- C:\Windows\System\aWmAHcY.exe
  C:\Windows\System\aWmAHcY.exe
  2⤵
  PID:9384
- C:\Windows\System\nJpIFxN.exe
  C:\Windows\System\nJpIFxN.exe
  2⤵
  PID:9400
- C:\Windows\System\AFVxglL.exe
  C:\Windows\System\AFVxglL.exe
  2⤵
  PID:9416
- C:\Windows\System\kEykmWn.exe
  C:\Windows\System\kEykmWn.exe
  2⤵
  PID:9432
- C:\Windows\System\yiiHLxM.exe
  C:\Windows\System\yiiHLxM.exe
  2⤵
  PID:9448
- C:\Windows\System\wYGqvYd.exe
  C:\Windows\System\wYGqvYd.exe
  2⤵
  PID:9464
- C:\Windows\System\xwgaeej.exe
  C:\Windows\System\xwgaeej.exe
  2⤵
  PID:9480
- C:\Windows\System\nMUqfKE.exe
  C:\Windows\System\nMUqfKE.exe
  2⤵
  PID:9496
- C:\Windows\System\JUpjthP.exe
  C:\Windows\System\JUpjthP.exe
  2⤵
  PID:9520
- C:\Windows\System\dfnpGWM.exe
  C:\Windows\System\dfnpGWM.exe
  2⤵
  PID:9536
- C:\Windows\System\sWvNNte.exe
  C:\Windows\System\sWvNNte.exe
  2⤵
  PID:9556
- C:\Windows\System\dELikVT.exe
  C:\Windows\System\dELikVT.exe
  2⤵
  PID:9572
- C:\Windows\System\BWvFICY.exe
  C:\Windows\System\BWvFICY.exe
  2⤵
  PID:9588
- C:\Windows\System\lrnTuuP.exe
  C:\Windows\System\lrnTuuP.exe
  2⤵
  PID:9604
- C:\Windows\System\sCKAsrW.exe
  C:\Windows\System\sCKAsrW.exe
  2⤵
  PID:9624
- C:\Windows\System\SRxwOYY.exe
  C:\Windows\System\SRxwOYY.exe
  2⤵
  PID:9640
- C:\Windows\System\rdYerND.exe
  C:\Windows\System\rdYerND.exe
  2⤵
  PID:9656
- C:\Windows\System\KvcNHbQ.exe
  C:\Windows\System\KvcNHbQ.exe
  2⤵
  PID:9672
- C:\Windows\System\GJvUjAR.exe
  C:\Windows\System\GJvUjAR.exe
  2⤵
  PID:9688
- C:\Windows\System\evashhS.exe
  C:\Windows\System\evashhS.exe
  2⤵
  PID:9712
- C:\Windows\System\vpInvCa.exe
  C:\Windows\System\vpInvCa.exe
  2⤵
  PID:9732
- C:\Windows\System\mpUoixq.exe
  C:\Windows\System\mpUoixq.exe
  2⤵
  PID:9748
- C:\Windows\System\DVturPq.exe
  C:\Windows\System\DVturPq.exe
  2⤵
  PID:9764
- C:\Windows\System\smWgdaQ.exe
  C:\Windows\System\smWgdaQ.exe
  2⤵
  PID:9784
- C:\Windows\System\rvAsKcW.exe
  C:\Windows\System\rvAsKcW.exe
  2⤵
  PID:9808
- C:\Windows\System\tptbOfh.exe
  C:\Windows\System\tptbOfh.exe
  2⤵
  PID:9928
- C:\Windows\System\dYaGlzG.exe
  C:\Windows\System\dYaGlzG.exe
  2⤵
  PID:9944
- C:\Windows\System\xvMnMXX.exe
  C:\Windows\System\xvMnMXX.exe
  2⤵
  PID:9960
- C:\Windows\System\PIHbyjq.exe
  C:\Windows\System\PIHbyjq.exe
  2⤵
  PID:9980
- C:\Windows\System\qZdYxfI.exe
  C:\Windows\System\qZdYxfI.exe
  2⤵
  PID:9996
- C:\Windows\System\cekDjNU.exe
  C:\Windows\System\cekDjNU.exe
  2⤵
  PID:10012
- C:\Windows\System\gsdLlZr.exe
  C:\Windows\System\gsdLlZr.exe
  2⤵
  PID:10032
- C:\Windows\System\VgTWHng.exe
  C:\Windows\System\VgTWHng.exe
  2⤵
  PID:10048
- C:\Windows\System\ssEWfLb.exe
  C:\Windows\System\ssEWfLb.exe
  2⤵
  PID:10064
- C:\Windows\System\hseVgPB.exe
  C:\Windows\System\hseVgPB.exe
  2⤵
  PID:10080
- C:\Windows\System\knNxjHT.exe
  C:\Windows\System\knNxjHT.exe
  2⤵
  PID:10096
- C:\Windows\System\PWpvZBs.exe
  C:\Windows\System\PWpvZBs.exe
  2⤵
  PID:10112
- C:\Windows\System\cZxTLTH.exe
  C:\Windows\System\cZxTLTH.exe
  2⤵
  PID:10128
- C:\Windows\System\prwzXmu.exe
  C:\Windows\System\prwzXmu.exe
  2⤵
  PID:10144
- C:\Windows\System\qYhWwzc.exe
  C:\Windows\System\qYhWwzc.exe
  2⤵
  PID:10160
- C:\Windows\System\xjUYLwf.exe
  C:\Windows\System\xjUYLwf.exe
  2⤵
  PID:10176
- C:\Windows\System\WWHYeju.exe
  C:\Windows\System\WWHYeju.exe
  2⤵
  PID:10192
- C:\Windows\System\ClNaVvV.exe
  C:\Windows\System\ClNaVvV.exe
  2⤵
  PID:10208
- C:\Windows\System\imBVfDo.exe
  C:\Windows\System\imBVfDo.exe
  2⤵
  PID:10224
- C:\Windows\System\gPMjgQS.exe
  C:\Windows\System\gPMjgQS.exe
  2⤵
  PID:8916
- C:\Windows\System\YRnWsFD.exe
  C:\Windows\System\YRnWsFD.exe
  2⤵
  PID:9240
- C:\Windows\System\CbETgBJ.exe
  C:\Windows\System\CbETgBJ.exe
  2⤵
  PID:9220
- C:\Windows\System\wwpuApQ.exe
  C:\Windows\System\wwpuApQ.exe
  2⤵
  PID:9256
- C:\Windows\System\XQNiDio.exe
  C:\Windows\System\XQNiDio.exe
  2⤵
  PID:9288
- C:\Windows\System\mFVgfWi.exe
  C:\Windows\System\mFVgfWi.exe
  2⤵
  PID:9336
- C:\Windows\System\dXjbMnu.exe
  C:\Windows\System\dXjbMnu.exe
  2⤵
  PID:9356
- C:\Windows\System\sZKKSGg.exe
  C:\Windows\System\sZKKSGg.exe
  2⤵
  PID:9324
- C:\Windows\System\BdZgyFl.exe
  C:\Windows\System\BdZgyFl.exe
  2⤵
  PID:9392
- C:\Windows\System\tTfDXox.exe
  C:\Windows\System\tTfDXox.exe
  2⤵
  PID:9424
- C:\Windows\System\THzlpEY.exe
  C:\Windows\System\THzlpEY.exe
  2⤵
  PID:9516
- C:\Windows\System\cEonpjs.exe
  C:\Windows\System\cEonpjs.exe
  2⤵
  PID:9616
- C:\Windows\System\ZZzeGHY.exe
  C:\Windows\System\ZZzeGHY.exe
  2⤵
  PID:9680
- C:\Windows\System\ptuKQCu.exe
  C:\Windows\System\ptuKQCu.exe
  2⤵
  PID:9564
- C:\Windows\System\gXqcXwQ.exe
  C:\Windows\System\gXqcXwQ.exe
  2⤵
  PID:9720
- C:\Windows\System\uHmXjuy.exe
  C:\Windows\System\uHmXjuy.exe
  2⤵
  PID:9792
- C:\Windows\System\yOVSdgO.exe
  C:\Windows\System\yOVSdgO.exe
  2⤵
  PID:9804
- C:\Windows\System\xdOxWNa.exe
  C:\Windows\System\xdOxWNa.exe
  2⤵
  PID:9740
- C:\Windows\System\rzdTaNw.exe
  C:\Windows\System\rzdTaNw.exe
  2⤵
  PID:9780
- C:\Windows\System\jRHKkMf.exe
  C:\Windows\System\jRHKkMf.exe
  2⤵
  PID:9704
- C:\Windows\System\TvqZtrk.exe
  C:\Windows\System\TvqZtrk.exe
  2⤵
  PID:9664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AIIRsPI.exe

Filesize
1.9MB

MD5
cb9721c8338df1a4ca1699609083771f

SHA1
bf7a8322df76e9c240067946c2ec06d6a8fb1deb

SHA256
34c7ca98095ed000f5da772ae1935050c4610ff18946f3f8ff1e40df004a30bd

SHA512
3fc8913e227507f4aeaf76ea5d7309ff603cffe05634b75082759eb82d737a6af565620ba4fb6dec4b5656166cc1a4641afb3d43ee6df386bddfbdcfc69a4aa0

Download Submit
C:\Windows\system\ASXjnao.exe

Filesize
1.9MB

MD5
a27935aeedcfb86d85ac0efc70030a70

SHA1
7977bebc2f7c4d6c1587aa6c51e9845ca2a0efa7

SHA256
6b857fe7ebff3e6bfa7e382b7cf8010507b0d153607ebcbc16b0883148fc5cab

SHA512
c624414be284b94c2bf2e09b7552e5d32599b5ca07f46046aad4a2012cf9070c5fd84b474916752734a177d35461acf1452f199678963889ab6280caa714cc0f

Download Submit
C:\Windows\system\DOzdBkT.exe

Filesize
1.9MB

MD5
204f74f7e99786bdc2b1cdf791bd4064

SHA1
59990b69ce25b76cf4435a02a9b8162db2b90a0b

SHA256
0229c267a905c982e3f2f2e3154c8e538c858a400dc56f2bbdc58ecb16f4f399

SHA512
977416599844a3549c6ed27f94deeb949cf9e2f123c6b6cfa5c877b4c42b8dda699ba78323f192c36a08401e80d3fd50c7a3a7fc19733d339db00401578f7c6b

Download Submit
C:\Windows\system\DVUHdyN.exe

Filesize
1.9MB

MD5
8bb02b72767c49d0d444901158d8ceb3

SHA1
aae71ece2dca38cc949b62984b7a7f3b01a9b33e

SHA256
2b06bb619ea74ce04cc5a1707946c7276c9d899a1aaed286f350e8d61f231626

SHA512
2e0692d19ba6e3a3eeee01e508903b6c0ca6d42fa6ed6e899f5dbd020e2caa0ac729c4d11fb87ed371a9252fc5c716a6cdde06d44d7475ebfa51489fdca6597d

Download Submit
C:\Windows\system\GCGZWhT.exe

Filesize
1.9MB

MD5
7621d74120e1f50f27403bc7f5d385f4

SHA1
588f998fdbff50579ab3eea3cbee5a337cbff49f

SHA256
640d75b9650217409a85d3082c0b8a0ffddba289a7c7006c16f93dce88a6f36f

SHA512
65603e1d464da30d0931b8f9ca72079044d8813c392777a7dcdf5248d53fcb6664d1857d9211bfeba95572e6423613ec7712ce178dd12dd9892215314c17c87f

Download Submit
C:\Windows\system\JWexIdX.exe

Filesize
1.9MB

MD5
2791edf73827b0b4ed238e6759e940ff

SHA1
873c69a1e53424db9f2d9ed873faa1589ee35426

SHA256
560925bec571440392d9831abbef5c7d5a26bbaab3ce78c756a18b4c9341ebf7

SHA512
094377aa20ace23c081a7d9d8c85cd3915ff023cc6bf6a86d6facd2bc7d0da4a6334a5c6240a893cb8be2becb842287db0b1909ece57494b4a71c7182a4fbf43

Download Submit
C:\Windows\system\KKmZwnX.exe

Filesize
1.9MB

MD5
46f631506ba6e9791dcab8d01e85d777

SHA1
cd18abc1414e9d1f4301e99534660f24f35a288a

SHA256
519154b80d78a34b040a58c4152a5784a3512c479e2f57248c6493e0977fd3cf

SHA512
298704d190a52d928027fa9a42da0da415750cc2c5d71334f297a8ebb4d34b280de37c90536323cd265881ada650dc2556a942e06744d646daf37bcde4aea5e6

Download Submit
C:\Windows\system\LDsZUwv.exe

Filesize
1.9MB

MD5
735ef839bcfc3208d341af7e9c58a48b

SHA1
2d0461ca8e6ee24996bb35e7252ae6b4d1f9ca85

SHA256
89f16626745c155899086128bd1a9445fe9319567f6b7581610028b6dd225069

SHA512
1e05385f93e53f4706116732c35a9a2d11a1dbb6840e3ba7bdbc127033dc38f6a8b1c4e03a04a9aa943359a66bf5ce9e2f10bb841d8aa9cfe8add2e985ee82cf

Download Submit
C:\Windows\system\NXfhXmi.exe

Filesize
1.9MB

MD5
b272abdf721b7c55d99bdb364580a73e

SHA1
1f20d148523cf9eea939a3157d378e7a454bdefc

SHA256
2ff12642b6ecd33b239b432279be918407859a565fd916ca9b4be16b3f0fc348

SHA512
facae8788f88cef648767af1799285c015855ebf371d0a48764d61ac311e7ba511e3284f7fe4b53fd0732e7f2e83ae203dc9010affa9bafaf267253fed6b86ed

Download Submit
C:\Windows\system\PNBoKRm.exe

Filesize
1.9MB

MD5
87bb9c664dcbc98ceeeaf989da105488

SHA1
390d893a122fe3398226083b101378a705ae5f7d

SHA256
4db36197e48178642bb436fcba3e37e1bb425dbd21da2e79594fe82e5ecb08e8

SHA512
07b8ca7b775e3b2c0573cd57bac65dd707a6057d0807cb72441ae2af34a443683315dc966ac2336937c91b0e8ac8690cddc718c282cdfff47b747c37aead54ff

Download Submit
C:\Windows\system\VoVfJlA.exe

Filesize
1.9MB

MD5
40426f5b8be0ea947065cf90ee59ddd5

SHA1
3777a43cf03abf857cfc57fc9472d3bbfb950b6c

SHA256
4be0cefcbc6c03933a584147d8f8bed095f23dfa7585e36492aa91d250284eb2

SHA512
e77238d3db6d2453fbfb793683ca404052b4e48f1de43395ec1c523c1cdf223962b80fe2d096f60c5364fb38a54186edfa001391f965de66b86d266d6912744e

Download Submit
C:\Windows\system\YfmiicI.exe

Filesize
1.9MB

MD5
4f5f0edffbee55dbda161500e16e159e

SHA1
835d3040d46c9afd0df464e105a9f1d3043098e1

SHA256
38be8d66cc6afa5050c74082f6fc3107405e5cea643820f412cc9e0a809e2237

SHA512
639204872ba2641612cfea28ceeae1c106b9944d862ef774a0da4002e075cd6a0d6107993c6a52b44e9fc09e1d773ae4ccc6a6ad078f8ca5a0e3f10b42b70a11

Download Submit
C:\Windows\system\ZZCWizA.exe

Filesize
1.9MB

MD5
961aaa41b000893d1e67d33785df464a

SHA1
cf503aab5910814b0c9dbcc7eb9dbf56224130a5

SHA256
bd25d5225ce5fe749706a65684858d94dec30a4c7ed8d6f925501542ed6c7880

SHA512
a27cf1c813c4dde6c8c3e925c464806373e0b6c0e3ea259fca8fb8b63cf9073ef445fc5b744bd857c742cf136d48f6ff0d3ec051a5b37fac05cb2b6d3e97caea

Download Submit
C:\Windows\system\bzJQqtQ.exe

Filesize
1.9MB

MD5
f6d25663701bec2e8e8d822e5c969d83

SHA1
93cf69bfdb7321bc55d9d01c03f70cedbb9624d7

SHA256
d50ac7a022b988b06a8953bd9e697308f82e3ab2f442525e057dbde3027bb3cd

SHA512
8919d35b254a8d1671fa1b653bad131f12ab4c4aa31c005a71030e6d31c65e77e2f31214583e167bfc1caa784261a1f907847fe4882dd7709934219f98e13065

Download Submit
C:\Windows\system\dEfvCUk.exe

Filesize
1.9MB

MD5
c1917b542cba9287c3e085547485602d

SHA1
0464c279188877883c12048bd9c8f6a7ec1d44b5

SHA256
f643b6e2b179bb7c982f9bb3c4ac36331219c4ad4707c2dc42ddc86aa0f3af5d

SHA512
f4f16a51d98f98d7d84e35e4636db594fd841daf397093dd4a2be5902a01ad0c737d6b0a2d4e606685132ed2b73f8bacddabf49cfa82092ef11cbdf8af323697

Download Submit
C:\Windows\system\egNSkPk.exe

Filesize
1.9MB

MD5
fdc817654d0c1cb33d2043f9482b7844

SHA1
017736d0d95f5742ae3b712d17ce7d2a234f4bf6

SHA256
62efb6ec127f2eaa5910846bbfaa7951732b447e24cea570279c133ac30b1a63

SHA512
1966cd9aa07c50f91f43f271f0506884d355629c62bc33f734466313195c6bcc065095dcb8592bce786cf0983a31d296e3803ee4f9004c40a0406b0f98e00efc

Download Submit
C:\Windows\system\ggQjcWC.exe

Filesize
1.9MB

MD5
bec722447bafb740a7e635470a25980e

SHA1
90a2928cadc8460895e29a1f2a7dab10f61da89f

SHA256
ef988089f4027ebd2bbeb9c63260516eab319f014d17639bf28e5c8b41e35654

SHA512
f3e98096b4e273ff3cc7db4d45e611b2ac0f1fcaed27c075d63b45709a3e91b0ab838e9891b5adf8393a666c9f076727ff60bfcb3b286d2fd5b868aa376f17b6

Download Submit
C:\Windows\system\iUCxaGP.exe

Filesize
1.9MB

MD5
3757c3784cedac57dec81400254f350c

SHA1
ac0c23696efc0337465eda3987c8ca8020b4067d

SHA256
94f76ac5139606c1f4266d025e25199ba5c4fe1fafbad12b3c97fcbf6ccf391f

SHA512
fb4e39949f8d4cd48a3d6f737198bd8fe756167c674570c002970cf16be4be43b689e5fc68e098aad9f092187ba066e97af6907083b8e252c8feba7e688dea33

Download Submit
C:\Windows\system\lRXKPNT.exe

Filesize
1.9MB

MD5
b7134735608b6c507928d4874d98eabc

SHA1
e2dec124613b2abbff4fea02ede21cdee281b201

SHA256
3972377587e7dc96d9219f3c3a122427b6c0fbe8bd7c08de16f5174cc8681021

SHA512
3949f1ef7c5fcad66d3700d7dc7a96a2c7acc81b8fe65ff2282e281063c8a890a1283848695299c63b429d2191c31a67ecc1fcd7ffe01bf21782c9c73816e108

Download Submit
C:\Windows\system\obfEWZX.exe

Filesize
1.9MB

MD5
594f83929ef2391422ed03a6090013f6

SHA1
01ebdde1d43348b9111bc1522f7f288556ab7848

SHA256
a40afe9b8d9dec5f99cd469ae59448ee3c4dbc435303caa7adedabf3877225be

SHA512
58b6bf76fba67a7aaaf046b5b011930c5a1d539f20d9d8cdf5786b86c3f8677c2ebe884f14ac808bd160dae04af071d438474bc2f53e72e7f00136bc55583cf8

Download Submit
C:\Windows\system\pcnkcSJ.exe

Filesize
1.9MB

MD5
739b8ec4f5e5b9cbd7c6435072eb8b94

SHA1
ca4b4d79724d7394f8f6e3c43a3f8366c8c303bf

SHA256
08a26c7bd4f23150a8d83935195996cd82e02554198d48b5722c6d3f43e1ec7c

SHA512
5135fd6a066707133b250dc2b9da430ff163fe217fa188c35162f0353884f84f12719243a63c4d419bd61ff64bdc6339695fabb5a15b1d817ef8a81173cd1f7d

Download Submit
C:\Windows\system\riNLAvk.exe

Filesize
1.9MB

MD5
8a1ce4488308585d906d0594dc28bc1d

SHA1
498c29737578c3e8a4cb3dd234a9cfd983f34281

SHA256
c74c575d492fabfa05092b93bb90e86a79d2b69d0f73f8def0688aa0dad17e90

SHA512
508872d14f7150e6d7d2791d32b8cf7e3a1817f51919fe2a3875e26a2663f748aa971cfc0c2d6cd3b90c00cacfefe40353660960bfcd2ea3b08e23d219a45184

Download Submit
C:\Windows\system\sSCVPDn.exe

Filesize
1.9MB

MD5
36fdbc16eaef505db0ad1bb4e631368e

SHA1
c7a59fdc9f450ba297cef78cace8a73843092ee0

SHA256
f254e10f49fff65119742d3bf410976932069761e0c529fe20d99a3df0e512fb

SHA512
c2bded4c8b3b39af7b62ae8b8c2514b8f379e2aa1679ffa91769763afca538b58210d5c3120f8c6dd7090002a19f08684e197cd212d9ae6b82828897643ba70a

Download Submit
C:\Windows\system\uunCQaL.exe

Filesize
1.9MB

MD5
9b65f86e518a0441da1dcfef1ef08744

SHA1
b3010129271f4e31b4418353804537d744cede92

SHA256
3fc9a26d6f0c01a6a1f259c2717645fd2d6124dcc7aa3249027883b3e13a86f1

SHA512
27d49e28b98ff96704cf724e170365ffce25727268f69326f3c41e06ee2885ef71b6214250a7c441380b8eb6d879f90c58415313a3939f1744dbff69e35afb80

Download Submit
C:\Windows\system\xuxMiDr.exe

Filesize
1.9MB

MD5
fdb0036d24c36878a33bff7a0a448223

SHA1
8c0bc043827d4f098b0f0088f0a1bdeb89c2ed97

SHA256
d2c607cdbf445000b84df8694d04a44561e6bc84bc444a93b21edf8937bc6566

SHA512
d1646bcc792739eab586f9ae7fdc678abeffffa6291955969599ebe8ae45cd900ba347c69721a83c679a64e9db3093633e27c515bc99143e811dd2fe9e95cc6a

Download Submit
C:\Windows\system\zaEqMpV.exe

Filesize
1.9MB

MD5
4bd5c293a46d26beba8fefb3c59fe5c1

SHA1
ee3c379b7a4907d1d163635d4bc6a674f8aadb23

SHA256
f7d27071db0720984eacf3563e54491f8762c8ca4f0b471b2257b923eae7120b

SHA512
0a656ed6885d1c00325fc764f94d3da5f39e54760c3e2fe4feb2edd4b77ec3a5bdd10179f906a7d8dbb7ed30b65f1da863d4a2977cb9e410f0e440a109647da7

Download Submit
\Windows\system\LsQuZMa.exe

Filesize
1.9MB

MD5
57a95528480dc277540ea71f02ab7826

SHA1
9619b91588edce86482297bea5beecd0ce36d1a4

SHA256
a30204fb6205f2c63ca4e6b892a5879228f7ab48916868c083bca3dbea2723ef

SHA512
78b27e23ea8bd48394039f6d0df95e4f2f88060f4d14c1a1b5b7cb6ab8d9114521a109b73c20509ede71538d3ba56006b6e5cd23d3b2b21304ebc9149c17f346

Download Submit
\Windows\system\QUlZuRj.exe

Filesize
1.9MB

MD5
5b79e7629f75990ce526170e7341421d

SHA1
b7622a6f64c5c7f90405da5cec5ed76988fd4322

SHA256
040339b20b753ff86fc9b03cf3354d5658c14bed45a2eb1a098ff4d87d1b1746

SHA512
9076f478b87af558029a7066d366e826814600c3ba8643a39603daa36b719bda73b36f4a44dd1e4a9f8e70775342c519b8c6c8c524432a8277151b3b0d40091d

Download Submit
\Windows\system\TuCkGmY.exe

Filesize
1.9MB

MD5
d715a67fce3b48d816fbcdd53a5fb617

SHA1
24920fe24178fd2102a59c91052c2876fdd2ba11

SHA256
bb7cc72bc6bd1031bd35301aa5065002b2100543c7cba54a019120a2a2647ed1

SHA512
6efc21b76413e2c49dbe1c02740ae5a7b71893cec4054df611b9ca323bd641bf47cb259b7d56f8ebdfe49ca294642f9c22587b1e64a29717af3f306e0736b2e6

Download Submit
\Windows\system\gnjZHMN.exe

Filesize
1.9MB

MD5
e01531caf46a5648389839ff1bf580b3

SHA1
548483e5a48dab150171a0c8759788332a75b521

SHA256
5910f0f2608b59d2263f0498c44547d837515e1f9c29a62acf2b789cd6de6b82

SHA512
e228a11252315cd6a43676256a63436d7a4bfb4c642615e58317daa5444cdc0802bd8e871217e2b94be2a71e5697d5c53fde5aadb38986964836a62619076ad7

Download Submit
\Windows\system\rMFWxnE.exe

Filesize
1.9MB

MD5
53281cf4431bf10d9cf760473247e518

SHA1
bbd1dff9d070e6900cf786056c83ce6386075047

SHA256
69d95dc32a877f325d46f5937c2dc68140a215ff92eb20fb9adaa8500075f2ac

SHA512
49817f7135775b58703fa9d226a7564fedcda87829b7ea5a0736299b5ee0d0df41105528a64070c4e58645e64c399ce0464ee453731652af87a907562eadab0b

Download Submit
\Windows\system\ydSLuqD.exe

Filesize
1.9MB

MD5
b99de672b1230080d36f10519606efe0

SHA1
3a084302e501ea93aaf4ea5d7dac691f1d84d0fe

SHA256
1d930968b656d8bab9f9aa605ca1e63954b9e2860f7e6da9b9d42999dba5aea6

SHA512
fdf703b805c6a4ba41b668d1d26a86c131a5a3b7b95608e1beb544f85e644f9eb694ab2924c983c91fa59af79480266f963bf43af46c8904736b430f6f98a1fd

Download Submit
memory/1704-178-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1704-164-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1704-1573-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1704-1-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1704-11-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1704-35-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/1704-31-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1704-0-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1704-30-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1704-176-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-166-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-174-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1704-168-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/1704-172-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1704-170-0x0000000003470000-0x0000000003862000-memory.dmp

Filesize
3.9MB

Download
memory/1960-175-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1960-4512-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-4091-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2288-173-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-29-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-28-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-36-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-18-0x000007FEF5B3E000-0x000007FEF5B3F000-memory.dmp

Filesize
4KB

Download
memory/2392-187-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-21-0x0000000002000000-0x0000000002008000-memory.dmp

Filesize
32KB

Download
memory/2392-20-0x000000001B560000-0x000000001B842000-memory.dmp

Filesize
2.9MB

Download
memory/2392-25-0x000007FEF5880000-0x000007FEF621D000-memory.dmp

Filesize
9.6MB

Download
memory/2532-165-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2532-4094-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2576-4519-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-167-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-4095-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-177-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-4093-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2660-169-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2688-33-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2772-163-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4216-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2840-179-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2840-4627-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2980-171-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2980-4880-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/3028-17-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/3064-32-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download