xmrig | 1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
Size

1.7MB
MD5

e17f89504f7845753db66aa5385e27d0
SHA1

42e79cd15381166939b984110d76ebf0e06fea80
SHA256

1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8
SHA512

8260be96fe3c19b0a76ddcd1b8ebf8c8562ad47ac3ed638505db6e0ad64504e50c648b38aa7a6fc10d76a83093c5bbb4fd2064aa78e9ff60a58e9d646d31135a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOoMc:Lz071uv4BPMkFfdg6NsOkc2Ec

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2884-17-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2740-47-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2620-57-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2512-62-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2764-51-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2708-49-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2680-45-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2636-75-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2108-110-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2488-105-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2680-4695-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2764-4698-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2708-4704-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2884-4696-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2512-4710-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2620-4709-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2108-4782-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2508-4777-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2488-4768-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2740-4707-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1992	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2884	MNRIXaV.exe
2680	oNAyNBI.exe
2740	vsBNGfc.exe
2708	pPKdmAE.exe
2764	OVGoSjp.exe
2620	ORgZdFF.exe
2512	oMTNFrK.exe
2508	hJIZKXC.exe
2636	YRATVQg.exe
2488	vkWImzG.exe
2108	nUlFpxh.exe
2004	AQdzoHL.exe
1888	ITwCsMR.exe
1096	cBvNeLW.exe
2140	QNHYJsh.exe
2376	AMewnqP.exe
2024	qAyHTYh.exe
1776	QXmjOmq.exe
1784	nsIqtZV.exe
1704	VudhugE.exe
2092	Psopdjr.exe
1700	kngurEQ.exe
2312	LApDaoA.exe
2952	KqgBHGT.exe
2148	ADzxRQC.exe
560	XSCycMg.exe
1320	GhlVrCu.exe
1500	CeGeAPA.exe
2192	eiaPmTQ.exe
796	ZZVmVtr.exe
448	MqDzVcg.exe
3048	oDHEBAe.exe
1004	wfViYBz.exe
1572	YreWajx.exe
1944	dMFbsQp.exe
1000	yWicMtN.exe
640	RqHhhdH.exe
916	pfWnwcd.exe
3056	xfwHJEJ.exe
2404	DMwHqHs.exe
1028	AgQkGSr.exe
3020	ppZZrWu.exe
1632	ayzkRaf.exe
944	DOvsbcL.exe
1540	rxpOsfh.exe
1268	pHZVoeD.exe
1440	NTOuvsE.exe
2216	ryRNxAi.exe
376	LdyxTTl.exe
2924	gJDmfNt.exe
2912	citkVsD.exe
2780	bdnXxwq.exe
1592	nhsuLTP.exe
2776	BIleYpM.exe
2084	hpSSvCY.exe
2696	OjWzWzs.exe
2916	mdVXCan.exe
2688	yHrBfaj.exe
2676	ypKwgYb.exe
2668	apHHoXU.exe
2044	AJiRxhn.exe
2292	LFVkuHh.exe
2432	qIqhsYl.exe
2684	PFIVjdA.exe

Loads dropped DLL 64 IoCs

pid	Process
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/880-1-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x000c0000000136fc-3.dat	upx
behavioral1/files/0x0036000000015d06-13.dat	upx
behavioral1/files/0x001400000000549e-15.dat	upx
behavioral1/memory/2884-17-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/files/0x00080000000160f8-28.dat	upx
behavioral1/files/0x0007000000016277-36.dat	upx
behavioral1/files/0x0007000000016411-38.dat	upx
behavioral1/memory/2740-47-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2620-57-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0007000000016525-56.dat	upx
behavioral1/memory/2512-62-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2764-51-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2708-49-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2680-45-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x0006000000016d17-69.dat	upx
behavioral1/memory/2508-67-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2636-75-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x0036000000015d5d-76.dat	upx
behavioral1/files/0x0006000000016d1f-83.dat	upx
behavioral1/files/0x0006000000016d67-101.dat	upx
behavioral1/memory/2108-110-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0006000000017458-137.dat	upx
behavioral1/files/0x0006000000016d40-91.dat	upx
behavioral1/files/0x0006000000017465-154.dat	upx
behavioral1/files/0x00050000000186cf-183.dat	upx
behavioral1/files/0x000500000001865b-174.dat	upx
behavioral1/files/0x00050000000186dd-188.dat	upx
behavioral1/files/0x00050000000186c4-180.dat	upx
behavioral1/files/0x0009000000018648-165.dat	upx
behavioral1/files/0x0005000000018717-194.dat	upx
behavioral1/files/0x0005000000018664-178.dat	upx
behavioral1/files/0x0031000000018649-169.dat	upx
behavioral1/files/0x0006000000017387-152.dat	upx
behavioral1/files/0x0006000000017185-150.dat	upx
behavioral1/files/0x0006000000016f82-148.dat	upx
behavioral1/files/0x0006000000017474-158.dat	upx
behavioral1/files/0x0006000000016d4b-98.dat	upx
behavioral1/files/0x0006000000017384-132.dat	upx
behavioral1/files/0x0006000000017060-125.dat	upx
behavioral1/files/0x0006000000016d27-112.dat	upx
behavioral1/files/0x0006000000016d44-108.dat	upx
behavioral1/files/0x0006000000016d3b-107.dat	upx
behavioral1/memory/2488-105-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x00090000000167ef-66.dat	upx
behavioral1/memory/2680-4695-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/memory/2764-4698-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2708-4704-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2884-4696-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2512-4710-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2620-4709-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2108-4782-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2508-4777-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2488-4768-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2740-4707-0x000000013F370000-0x000000013F762000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BZfmMPo.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\HmOwTkb.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ewIfuai.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\VbfAUwj.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\tvwKPth.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\intpoma.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ZaMWbmk.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\PxAeOAf.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\YqNuwyt.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ReaLyDb.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\NlNNEOm.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\NcjBfKM.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\LCiAnqw.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\XxiCJax.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\nLwjdqr.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\xNHSfpI.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\EWzlagi.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ICVmxyd.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\nCuwFyF.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\Ueolask.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\FygGYff.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\EewNUcM.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\qVXkrDl.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\zGfMaNY.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\GqRIqyz.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ynaqPzy.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\FCbdBKb.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\rIMenql.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\mFBeuUU.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\oXZbctB.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\TvmYTxK.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\HIxHqtX.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\AnZGUQp.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\oiqvfoz.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\TLBCyoU.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\WgGgJZs.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\JauunWk.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\BglPCct.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\gYNAbMW.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\lgnGomq.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\wgmztbL.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\umoPSRi.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\hWLuWJR.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\jkrGbAc.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\JpfXBwV.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\NpdmZUT.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\nCRxIZo.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\txYoyXg.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\wFUJWge.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\pDdiWAk.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\KVheWlu.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\BPxdQeo.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\kCEusMl.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\pbieNbY.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\qBoYuei.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\azYZgJR.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\EbctSRJ.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\gmGfBxF.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\ZuMUcnV.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\DvukvUM.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\segcfZy.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\cUTWACd.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\UxkFjMw.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
File created	C:\Windows\System\JXaKdwu.exe	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
Token: SeDebugPrivilege	1992	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 1992	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	29
PID 880 wrote to memory of 1992	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	29
PID 880 wrote to memory of 1992	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	29
PID 880 wrote to memory of 2884	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	30
PID 880 wrote to memory of 2884	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	30
PID 880 wrote to memory of 2884	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	30
PID 880 wrote to memory of 2680	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	31
PID 880 wrote to memory of 2680	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	31
PID 880 wrote to memory of 2680	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	31
PID 880 wrote to memory of 2740	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	32
PID 880 wrote to memory of 2740	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	32
PID 880 wrote to memory of 2740	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	32
PID 880 wrote to memory of 2708	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	33
PID 880 wrote to memory of 2708	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	33
PID 880 wrote to memory of 2708	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	33
PID 880 wrote to memory of 2764	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	34
PID 880 wrote to memory of 2764	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	34
PID 880 wrote to memory of 2764	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	34
PID 880 wrote to memory of 2620	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	35
PID 880 wrote to memory of 2620	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	35
PID 880 wrote to memory of 2620	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	35
PID 880 wrote to memory of 2512	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	36
PID 880 wrote to memory of 2512	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	36
PID 880 wrote to memory of 2512	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	36
PID 880 wrote to memory of 2508	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	37
PID 880 wrote to memory of 2508	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	37
PID 880 wrote to memory of 2508	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	37
PID 880 wrote to memory of 2636	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	38
PID 880 wrote to memory of 2636	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	38
PID 880 wrote to memory of 2636	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	38
PID 880 wrote to memory of 2488	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	39
PID 880 wrote to memory of 2488	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	39
PID 880 wrote to memory of 2488	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	39
PID 880 wrote to memory of 2108	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	40
PID 880 wrote to memory of 2108	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	40
PID 880 wrote to memory of 2108	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	40
PID 880 wrote to memory of 2140	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	41
PID 880 wrote to memory of 2140	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	41
PID 880 wrote to memory of 2140	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	41
PID 880 wrote to memory of 2004	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	42
PID 880 wrote to memory of 2004	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	42
PID 880 wrote to memory of 2004	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	42
PID 880 wrote to memory of 2376	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	43
PID 880 wrote to memory of 2376	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	43
PID 880 wrote to memory of 2376	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	43
PID 880 wrote to memory of 1888	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	44
PID 880 wrote to memory of 1888	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	44
PID 880 wrote to memory of 1888	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	44
PID 880 wrote to memory of 2024	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	45
PID 880 wrote to memory of 2024	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	45
PID 880 wrote to memory of 2024	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	45
PID 880 wrote to memory of 1096	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	46
PID 880 wrote to memory of 1096	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	46
PID 880 wrote to memory of 1096	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	46
PID 880 wrote to memory of 2092	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	47
PID 880 wrote to memory of 2092	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	47
PID 880 wrote to memory of 2092	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	47
PID 880 wrote to memory of 1776	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	48
PID 880 wrote to memory of 1776	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	48
PID 880 wrote to memory of 1776	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	48
PID 880 wrote to memory of 1700	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	49
PID 880 wrote to memory of 1700	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	49
PID 880 wrote to memory of 1700	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	49
PID 880 wrote to memory of 1784	880	1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1b9b73d02d8c1285cb40dd8c6c26dd071c21c981a0a4861d7a502a0855c9f5b8_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\System\MNRIXaV.exe
  C:\Windows\System\MNRIXaV.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\oNAyNBI.exe
  C:\Windows\System\oNAyNBI.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\vsBNGfc.exe
  C:\Windows\System\vsBNGfc.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\pPKdmAE.exe
  C:\Windows\System\pPKdmAE.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\OVGoSjp.exe
  C:\Windows\System\OVGoSjp.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ORgZdFF.exe
  C:\Windows\System\ORgZdFF.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\oMTNFrK.exe
  C:\Windows\System\oMTNFrK.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\hJIZKXC.exe
  C:\Windows\System\hJIZKXC.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\YRATVQg.exe
  C:\Windows\System\YRATVQg.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\vkWImzG.exe
  C:\Windows\System\vkWImzG.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\nUlFpxh.exe
  C:\Windows\System\nUlFpxh.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\QNHYJsh.exe
  C:\Windows\System\QNHYJsh.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\AQdzoHL.exe
  C:\Windows\System\AQdzoHL.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\AMewnqP.exe
  C:\Windows\System\AMewnqP.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\ITwCsMR.exe
  C:\Windows\System\ITwCsMR.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\qAyHTYh.exe
  C:\Windows\System\qAyHTYh.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\cBvNeLW.exe
  C:\Windows\System\cBvNeLW.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\Psopdjr.exe
  C:\Windows\System\Psopdjr.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\QXmjOmq.exe
  C:\Windows\System\QXmjOmq.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\kngurEQ.exe
  C:\Windows\System\kngurEQ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\nsIqtZV.exe
  C:\Windows\System\nsIqtZV.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\LApDaoA.exe
  C:\Windows\System\LApDaoA.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\VudhugE.exe
  C:\Windows\System\VudhugE.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\KqgBHGT.exe
  C:\Windows\System\KqgBHGT.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ADzxRQC.exe
  C:\Windows\System\ADzxRQC.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\XSCycMg.exe
  C:\Windows\System\XSCycMg.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\GhlVrCu.exe
  C:\Windows\System\GhlVrCu.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\CeGeAPA.exe
  C:\Windows\System\CeGeAPA.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\eiaPmTQ.exe
  C:\Windows\System\eiaPmTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\wfViYBz.exe
  C:\Windows\System\wfViYBz.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\ZZVmVtr.exe
  C:\Windows\System\ZZVmVtr.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\dMFbsQp.exe
  C:\Windows\System\dMFbsQp.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\MqDzVcg.exe
  C:\Windows\System\MqDzVcg.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\xfwHJEJ.exe
  C:\Windows\System\xfwHJEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\oDHEBAe.exe
  C:\Windows\System\oDHEBAe.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\DMwHqHs.exe
  C:\Windows\System\DMwHqHs.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\YreWajx.exe
  C:\Windows\System\YreWajx.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\AgQkGSr.exe
  C:\Windows\System\AgQkGSr.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\yWicMtN.exe
  C:\Windows\System\yWicMtN.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ppZZrWu.exe
  C:\Windows\System\ppZZrWu.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\RqHhhdH.exe
  C:\Windows\System\RqHhhdH.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ayzkRaf.exe
  C:\Windows\System\ayzkRaf.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\pfWnwcd.exe
  C:\Windows\System\pfWnwcd.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\DOvsbcL.exe
  C:\Windows\System\DOvsbcL.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\rxpOsfh.exe
  C:\Windows\System\rxpOsfh.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\pHZVoeD.exe
  C:\Windows\System\pHZVoeD.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\NTOuvsE.exe
  C:\Windows\System\NTOuvsE.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\gJDmfNt.exe
  C:\Windows\System\gJDmfNt.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ryRNxAi.exe
  C:\Windows\System\ryRNxAi.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\citkVsD.exe
  C:\Windows\System\citkVsD.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\LdyxTTl.exe
  C:\Windows\System\LdyxTTl.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\bdnXxwq.exe
  C:\Windows\System\bdnXxwq.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\nhsuLTP.exe
  C:\Windows\System\nhsuLTP.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\BIleYpM.exe
  C:\Windows\System\BIleYpM.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\hpSSvCY.exe
  C:\Windows\System\hpSSvCY.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\apHHoXU.exe
  C:\Windows\System\apHHoXU.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\OjWzWzs.exe
  C:\Windows\System\OjWzWzs.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\iiinIkJ.exe
  C:\Windows\System\iiinIkJ.exe
  2⤵
  PID:2564
- C:\Windows\System\mdVXCan.exe
  C:\Windows\System\mdVXCan.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\mWLaGpo.exe
  C:\Windows\System\mWLaGpo.exe
  2⤵
  PID:2560
- C:\Windows\System\yHrBfaj.exe
  C:\Windows\System\yHrBfaj.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\vjldbVU.exe
  C:\Windows\System\vjldbVU.exe
  2⤵
  PID:2028
- C:\Windows\System\ypKwgYb.exe
  C:\Windows\System\ypKwgYb.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\gsJZrgb.exe
  C:\Windows\System\gsJZrgb.exe
  2⤵
  PID:1676
- C:\Windows\System\AJiRxhn.exe
  C:\Windows\System\AJiRxhn.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\wdllGkm.exe
  C:\Windows\System\wdllGkm.exe
  2⤵
  PID:2036
- C:\Windows\System\LFVkuHh.exe
  C:\Windows\System\LFVkuHh.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\yOPFkqT.exe
  C:\Windows\System\yOPFkqT.exe
  2⤵
  PID:2812
- C:\Windows\System\qIqhsYl.exe
  C:\Windows\System\qIqhsYl.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\XBduxsy.exe
  C:\Windows\System\XBduxsy.exe
  2⤵
  PID:2808
- C:\Windows\System\PFIVjdA.exe
  C:\Windows\System\PFIVjdA.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\cuoYLNO.exe
  C:\Windows\System\cuoYLNO.exe
  2⤵
  PID:1804
- C:\Windows\System\subzLHt.exe
  C:\Windows\System\subzLHt.exe
  2⤵
  PID:808
- C:\Windows\System\rdmAnBG.exe
  C:\Windows\System\rdmAnBG.exe
  2⤵
  PID:2296
- C:\Windows\System\cIHtDgm.exe
  C:\Windows\System\cIHtDgm.exe
  2⤵
  PID:2800
- C:\Windows\System\KQHvkSt.exe
  C:\Windows\System\KQHvkSt.exe
  2⤵
  PID:1492
- C:\Windows\System\ZOFcGWx.exe
  C:\Windows\System\ZOFcGWx.exe
  2⤵
  PID:3044
- C:\Windows\System\YMkrLEV.exe
  C:\Windows\System\YMkrLEV.exe
  2⤵
  PID:1764
- C:\Windows\System\YjxAsJF.exe
  C:\Windows\System\YjxAsJF.exe
  2⤵
  PID:1664
- C:\Windows\System\dnJwrCj.exe
  C:\Windows\System\dnJwrCj.exe
  2⤵
  PID:2484
- C:\Windows\System\SLhqTbx.exe
  C:\Windows\System\SLhqTbx.exe
  2⤵
  PID:1560
- C:\Windows\System\NBtHWpr.exe
  C:\Windows\System\NBtHWpr.exe
  2⤵
  PID:3008
- C:\Windows\System\Riiwjkw.exe
  C:\Windows\System\Riiwjkw.exe
  2⤵
  PID:1516
- C:\Windows\System\aqlxaFa.exe
  C:\Windows\System\aqlxaFa.exe
  2⤵
  PID:1952
- C:\Windows\System\xTpVgQu.exe
  C:\Windows\System\xTpVgQu.exe
  2⤵
  PID:2660
- C:\Windows\System\quYYFsy.exe
  C:\Windows\System\quYYFsy.exe
  2⤵
  PID:2416
- C:\Windows\System\jOovXNR.exe
  C:\Windows\System\jOovXNR.exe
  2⤵
  PID:2580
- C:\Windows\System\TdizXPd.exe
  C:\Windows\System\TdizXPd.exe
  2⤵
  PID:2344
- C:\Windows\System\bksnnkh.exe
  C:\Windows\System\bksnnkh.exe
  2⤵
  PID:2272
- C:\Windows\System\uAtuVWG.exe
  C:\Windows\System\uAtuVWG.exe
  2⤵
  PID:3032
- C:\Windows\System\zzSFMCu.exe
  C:\Windows\System\zzSFMCu.exe
  2⤵
  PID:1780
- C:\Windows\System\AIgbvfu.exe
  C:\Windows\System\AIgbvfu.exe
  2⤵
  PID:2716
- C:\Windows\System\ZBzSfZF.exe
  C:\Windows\System\ZBzSfZF.exe
  2⤵
  PID:1036
- C:\Windows\System\LKhLrdw.exe
  C:\Windows\System\LKhLrdw.exe
  2⤵
  PID:580
- C:\Windows\System\bKrZkep.exe
  C:\Windows\System\bKrZkep.exe
  2⤵
  PID:1296
- C:\Windows\System\pfRLfBc.exe
  C:\Windows\System\pfRLfBc.exe
  2⤵
  PID:2996
- C:\Windows\System\eFdaaGO.exe
  C:\Windows\System\eFdaaGO.exe
  2⤵
  PID:1532
- C:\Windows\System\MziJGXI.exe
  C:\Windows\System\MziJGXI.exe
  2⤵
  PID:872
- C:\Windows\System\HXQLEdu.exe
  C:\Windows\System\HXQLEdu.exe
  2⤵
  PID:1712
- C:\Windows\System\HhmyPNI.exe
  C:\Windows\System\HhmyPNI.exe
  2⤵
  PID:2568
- C:\Windows\System\ZAlASuO.exe
  C:\Windows\System\ZAlASuO.exe
  2⤵
  PID:2704
- C:\Windows\System\jLabtFt.exe
  C:\Windows\System\jLabtFt.exe
  2⤵
  PID:780
- C:\Windows\System\ovuxblH.exe
  C:\Windows\System\ovuxblH.exe
  2⤵
  PID:2220
- C:\Windows\System\bGCQrwh.exe
  C:\Windows\System\bGCQrwh.exe
  2⤵
  PID:340
- C:\Windows\System\tEcmfCs.exe
  C:\Windows\System\tEcmfCs.exe
  2⤵
  PID:1328
- C:\Windows\System\ucSuNje.exe
  C:\Windows\System\ucSuNje.exe
  2⤵
  PID:2316
- C:\Windows\System\EFHJTGi.exe
  C:\Windows\System\EFHJTGi.exe
  2⤵
  PID:2132
- C:\Windows\System\qWBlLbO.exe
  C:\Windows\System\qWBlLbO.exe
  2⤵
  PID:1544
- C:\Windows\System\rTKzuuO.exe
  C:\Windows\System\rTKzuuO.exe
  2⤵
  PID:2496
- C:\Windows\System\ZEMOQuh.exe
  C:\Windows\System\ZEMOQuh.exe
  2⤵
  PID:2060
- C:\Windows\System\DhXLxYB.exe
  C:\Windows\System\DhXLxYB.exe
  2⤵
  PID:3004
- C:\Windows\System\YqtGNLj.exe
  C:\Windows\System\YqtGNLj.exe
  2⤵
  PID:1832
- C:\Windows\System\DIsRgoG.exe
  C:\Windows\System\DIsRgoG.exe
  2⤵
  PID:1380
- C:\Windows\System\pXgSeeZ.exe
  C:\Windows\System\pXgSeeZ.exe
  2⤵
  PID:2820
- C:\Windows\System\eIcSDhN.exe
  C:\Windows\System\eIcSDhN.exe
  2⤵
  PID:2652
- C:\Windows\System\LmQoaMO.exe
  C:\Windows\System\LmQoaMO.exe
  2⤵
  PID:2264
- C:\Windows\System\uakCAAs.exe
  C:\Windows\System\uakCAAs.exe
  2⤵
  PID:2644
- C:\Windows\System\OtkXBpX.exe
  C:\Windows\System\OtkXBpX.exe
  2⤵
  PID:1684
- C:\Windows\System\TdANiwo.exe
  C:\Windows\System\TdANiwo.exe
  2⤵
  PID:3092
- C:\Windows\System\ysaRDNo.exe
  C:\Windows\System\ysaRDNo.exe
  2⤵
  PID:3112
- C:\Windows\System\QANCIVb.exe
  C:\Windows\System\QANCIVb.exe
  2⤵
  PID:3128
- C:\Windows\System\qJIhQlU.exe
  C:\Windows\System\qJIhQlU.exe
  2⤵
  PID:3144
- C:\Windows\System\PxAeOAf.exe
  C:\Windows\System\PxAeOAf.exe
  2⤵
  PID:3160
- C:\Windows\System\MBfciSO.exe
  C:\Windows\System\MBfciSO.exe
  2⤵
  PID:3176
- C:\Windows\System\shiEPwm.exe
  C:\Windows\System\shiEPwm.exe
  2⤵
  PID:3192
- C:\Windows\System\CWvPiLp.exe
  C:\Windows\System\CWvPiLp.exe
  2⤵
  PID:3208
- C:\Windows\System\ypkJBBy.exe
  C:\Windows\System\ypkJBBy.exe
  2⤵
  PID:3232
- C:\Windows\System\lBNWzcC.exe
  C:\Windows\System\lBNWzcC.exe
  2⤵
  PID:3248
- C:\Windows\System\wDcbkTv.exe
  C:\Windows\System\wDcbkTv.exe
  2⤵
  PID:3264
- C:\Windows\System\FVsQAso.exe
  C:\Windows\System\FVsQAso.exe
  2⤵
  PID:3280
- C:\Windows\System\wZQwlxX.exe
  C:\Windows\System\wZQwlxX.exe
  2⤵
  PID:3296
- C:\Windows\System\wOdrrrR.exe
  C:\Windows\System\wOdrrrR.exe
  2⤵
  PID:3312
- C:\Windows\System\oXkNsqe.exe
  C:\Windows\System\oXkNsqe.exe
  2⤵
  PID:3328
- C:\Windows\System\gSHsHKd.exe
  C:\Windows\System\gSHsHKd.exe
  2⤵
  PID:3344
- C:\Windows\System\BairbPF.exe
  C:\Windows\System\BairbPF.exe
  2⤵
  PID:3376
- C:\Windows\System\dnzjvHT.exe
  C:\Windows\System\dnzjvHT.exe
  2⤵
  PID:3396
- C:\Windows\System\fBSyeyp.exe
  C:\Windows\System\fBSyeyp.exe
  2⤵
  PID:3412
- C:\Windows\System\AAUsZEh.exe
  C:\Windows\System\AAUsZEh.exe
  2⤵
  PID:3440
- C:\Windows\System\fYnGwJP.exe
  C:\Windows\System\fYnGwJP.exe
  2⤵
  PID:3456
- C:\Windows\System\BsXhpvs.exe
  C:\Windows\System\BsXhpvs.exe
  2⤵
  PID:3472
- C:\Windows\System\DnwIgFd.exe
  C:\Windows\System\DnwIgFd.exe
  2⤵
  PID:3488
- C:\Windows\System\vlyJfBj.exe
  C:\Windows\System\vlyJfBj.exe
  2⤵
  PID:3504
- C:\Windows\System\EHvsiBA.exe
  C:\Windows\System\EHvsiBA.exe
  2⤵
  PID:3520
- C:\Windows\System\hubeLCJ.exe
  C:\Windows\System\hubeLCJ.exe
  2⤵
  PID:3536
- C:\Windows\System\DDwpRWH.exe
  C:\Windows\System\DDwpRWH.exe
  2⤵
  PID:3552
- C:\Windows\System\ViOwmkX.exe
  C:\Windows\System\ViOwmkX.exe
  2⤵
  PID:3568
- C:\Windows\System\LxMUITC.exe
  C:\Windows\System\LxMUITC.exe
  2⤵
  PID:3584
- C:\Windows\System\naepVVE.exe
  C:\Windows\System\naepVVE.exe
  2⤵
  PID:3600
- C:\Windows\System\NOILnwQ.exe
  C:\Windows\System\NOILnwQ.exe
  2⤵
  PID:3616
- C:\Windows\System\hCmrJjO.exe
  C:\Windows\System\hCmrJjO.exe
  2⤵
  PID:3632
- C:\Windows\System\QLMzGgB.exe
  C:\Windows\System\QLMzGgB.exe
  2⤵
  PID:3648
- C:\Windows\System\juGVaZI.exe
  C:\Windows\System\juGVaZI.exe
  2⤵
  PID:3664
- C:\Windows\System\NZlLBAk.exe
  C:\Windows\System\NZlLBAk.exe
  2⤵
  PID:3680
- C:\Windows\System\PCeuXFB.exe
  C:\Windows\System\PCeuXFB.exe
  2⤵
  PID:3696
- C:\Windows\System\KospWWO.exe
  C:\Windows\System\KospWWO.exe
  2⤵
  PID:3712
- C:\Windows\System\xQXSXFE.exe
  C:\Windows\System\xQXSXFE.exe
  2⤵
  PID:3728
- C:\Windows\System\uvQBMMS.exe
  C:\Windows\System\uvQBMMS.exe
  2⤵
  PID:3744
- C:\Windows\System\trFubYR.exe
  C:\Windows\System\trFubYR.exe
  2⤵
  PID:3760
- C:\Windows\System\NBeGELR.exe
  C:\Windows\System\NBeGELR.exe
  2⤵
  PID:3776
- C:\Windows\System\qqYLgvz.exe
  C:\Windows\System\qqYLgvz.exe
  2⤵
  PID:3792
- C:\Windows\System\bRfgAIA.exe
  C:\Windows\System\bRfgAIA.exe
  2⤵
  PID:3808
- C:\Windows\System\UmqAbfR.exe
  C:\Windows\System\UmqAbfR.exe
  2⤵
  PID:3824
- C:\Windows\System\fbBPIju.exe
  C:\Windows\System\fbBPIju.exe
  2⤵
  PID:3840
- C:\Windows\System\ScczBKj.exe
  C:\Windows\System\ScczBKj.exe
  2⤵
  PID:3856
- C:\Windows\System\wJDHImv.exe
  C:\Windows\System\wJDHImv.exe
  2⤵
  PID:3872
- C:\Windows\System\hnoFhzp.exe
  C:\Windows\System\hnoFhzp.exe
  2⤵
  PID:3888
- C:\Windows\System\WleEnEf.exe
  C:\Windows\System\WleEnEf.exe
  2⤵
  PID:3904
- C:\Windows\System\fiDXnfU.exe
  C:\Windows\System\fiDXnfU.exe
  2⤵
  PID:3920
- C:\Windows\System\MbVGYib.exe
  C:\Windows\System\MbVGYib.exe
  2⤵
  PID:3936
- C:\Windows\System\EJowExy.exe
  C:\Windows\System\EJowExy.exe
  2⤵
  PID:3952
- C:\Windows\System\fSWrvdg.exe
  C:\Windows\System\fSWrvdg.exe
  2⤵
  PID:3968
- C:\Windows\System\YjkXsRd.exe
  C:\Windows\System\YjkXsRd.exe
  2⤵
  PID:3984
- C:\Windows\System\sEKvvrI.exe
  C:\Windows\System\sEKvvrI.exe
  2⤵
  PID:4000
- C:\Windows\System\IVgYBFu.exe
  C:\Windows\System\IVgYBFu.exe
  2⤵
  PID:4016
- C:\Windows\System\BglPCct.exe
  C:\Windows\System\BglPCct.exe
  2⤵
  PID:4032
- C:\Windows\System\FKmyTJd.exe
  C:\Windows\System\FKmyTJd.exe
  2⤵
  PID:4048
- C:\Windows\System\KeHThud.exe
  C:\Windows\System\KeHThud.exe
  2⤵
  PID:4064
- C:\Windows\System\saCvmWU.exe
  C:\Windows\System\saCvmWU.exe
  2⤵
  PID:4080
- C:\Windows\System\nrDHYtl.exe
  C:\Windows\System\nrDHYtl.exe
  2⤵
  PID:1484
- C:\Windows\System\WVFQgwM.exe
  C:\Windows\System\WVFQgwM.exe
  2⤵
  PID:2632
- C:\Windows\System\CmirVzb.exe
  C:\Windows\System\CmirVzb.exe
  2⤵
  PID:2844
- C:\Windows\System\arLNsnd.exe
  C:\Windows\System\arLNsnd.exe
  2⤵
  PID:2452
- C:\Windows\System\InWitlT.exe
  C:\Windows\System\InWitlT.exe
  2⤵
  PID:2612
- C:\Windows\System\UtwXyMJ.exe
  C:\Windows\System\UtwXyMJ.exe
  2⤵
  PID:1960
- C:\Windows\System\WvJnXft.exe
  C:\Windows\System\WvJnXft.exe
  2⤵
  PID:772
- C:\Windows\System\UwoDbTf.exe
  C:\Windows\System\UwoDbTf.exe
  2⤵
  PID:1236
- C:\Windows\System\ycuUNIk.exe
  C:\Windows\System\ycuUNIk.exe
  2⤵
  PID:1772
- C:\Windows\System\ldoknmH.exe
  C:\Windows\System\ldoknmH.exe
  2⤵
  PID:2804
- C:\Windows\System\PDMHEIO.exe
  C:\Windows\System\PDMHEIO.exe
  2⤵
  PID:3244
- C:\Windows\System\YvunLTk.exe
  C:\Windows\System\YvunLTk.exe
  2⤵
  PID:3308
- C:\Windows\System\yWXhIdQ.exe
  C:\Windows\System\yWXhIdQ.exe
  2⤵
  PID:3384
- C:\Windows\System\sNLgHAx.exe
  C:\Windows\System\sNLgHAx.exe
  2⤵
  PID:2856
- C:\Windows\System\HRjUFFC.exe
  C:\Windows\System\HRjUFFC.exe
  2⤵
  PID:1204
- C:\Windows\System\kTpXUNC.exe
  C:\Windows\System\kTpXUNC.exe
  2⤵
  PID:1660
- C:\Windows\System\HseodDK.exe
  C:\Windows\System\HseodDK.exe
  2⤵
  PID:2792
- C:\Windows\System\wvTnwkm.exe
  C:\Windows\System\wvTnwkm.exe
  2⤵
  PID:2336
- C:\Windows\System\chiyFRU.exe
  C:\Windows\System\chiyFRU.exe
  2⤵
  PID:600
- C:\Windows\System\MxpRqDO.exe
  C:\Windows\System\MxpRqDO.exe
  2⤵
  PID:620
- C:\Windows\System\vVZwEIV.exe
  C:\Windows\System\vVZwEIV.exe
  2⤵
  PID:3428
- C:\Windows\System\rHparnQ.exe
  C:\Windows\System\rHparnQ.exe
  2⤵
  PID:3184
- C:\Windows\System\WACSfzD.exe
  C:\Windows\System\WACSfzD.exe
  2⤵
  PID:3260
- C:\Windows\System\rThUSpG.exe
  C:\Windows\System\rThUSpG.exe
  2⤵
  PID:3324
- C:\Windows\System\ICVmxyd.exe
  C:\Windows\System\ICVmxyd.exe
  2⤵
  PID:3364
- C:\Windows\System\nehAQLJ.exe
  C:\Windows\System\nehAQLJ.exe
  2⤵
  PID:848
- C:\Windows\System\vgBYxak.exe
  C:\Windows\System\vgBYxak.exe
  2⤵
  PID:3480
- C:\Windows\System\GsoQeOr.exe
  C:\Windows\System\GsoQeOr.exe
  2⤵
  PID:3404
- C:\Windows\System\oFBPJIt.exe
  C:\Windows\System\oFBPJIt.exe
  2⤵
  PID:3512
- C:\Windows\System\rrocGDH.exe
  C:\Windows\System\rrocGDH.exe
  2⤵
  PID:3532
- C:\Windows\System\QkICgwT.exe
  C:\Windows\System\QkICgwT.exe
  2⤵
  PID:3544
- C:\Windows\System\mFBeuUU.exe
  C:\Windows\System\mFBeuUU.exe
  2⤵
  PID:3592
- C:\Windows\System\eONdUzk.exe
  C:\Windows\System\eONdUzk.exe
  2⤵
  PID:3628
- C:\Windows\System\nwLQnYo.exe
  C:\Windows\System\nwLQnYo.exe
  2⤵
  PID:3656
- C:\Windows\System\iTieNhP.exe
  C:\Windows\System\iTieNhP.exe
  2⤵
  PID:3688
- C:\Windows\System\XbOQfZS.exe
  C:\Windows\System\XbOQfZS.exe
  2⤵
  PID:3720
- C:\Windows\System\BRhxrbD.exe
  C:\Windows\System\BRhxrbD.exe
  2⤵
  PID:3736
- C:\Windows\System\bfhDlkI.exe
  C:\Windows\System\bfhDlkI.exe
  2⤵
  PID:3768
- C:\Windows\System\vkURyop.exe
  C:\Windows\System\vkURyop.exe
  2⤵
  PID:3788
- C:\Windows\System\pWuOEel.exe
  C:\Windows\System\pWuOEel.exe
  2⤵
  PID:3820
- C:\Windows\System\mgmmTgf.exe
  C:\Windows\System\mgmmTgf.exe
  2⤵
  PID:3852
- C:\Windows\System\aILfxPo.exe
  C:\Windows\System\aILfxPo.exe
  2⤵
  PID:2164
- C:\Windows\System\gBvRQAo.exe
  C:\Windows\System\gBvRQAo.exe
  2⤵
  PID:3900
- C:\Windows\System\XcpjYiT.exe
  C:\Windows\System\XcpjYiT.exe
  2⤵
  PID:3932
- C:\Windows\System\ftJlJXI.exe
  C:\Windows\System\ftJlJXI.exe
  2⤵
  PID:3976
- C:\Windows\System\SnRrOnD.exe
  C:\Windows\System\SnRrOnD.exe
  2⤵
  PID:4012
- C:\Windows\System\UWmXQxY.exe
  C:\Windows\System\UWmXQxY.exe
  2⤵
  PID:4028
- C:\Windows\System\JslTEVW.exe
  C:\Windows\System\JslTEVW.exe
  2⤵
  PID:4056
- C:\Windows\System\xpgDnCr.exe
  C:\Windows\System\xpgDnCr.exe
  2⤵
  PID:4088
- C:\Windows\System\gTfeJRV.exe
  C:\Windows\System\gTfeJRV.exe
  2⤵
  PID:1568
- C:\Windows\System\gwQCvgZ.exe
  C:\Windows\System\gwQCvgZ.exe
  2⤵
  PID:2420
- C:\Windows\System\LsqtwQI.exe
  C:\Windows\System\LsqtwQI.exe
  2⤵
  PID:2088
- C:\Windows\System\wszyVXa.exe
  C:\Windows\System\wszyVXa.exe
  2⤵
  PID:3172
- C:\Windows\System\kGNWnQk.exe
  C:\Windows\System\kGNWnQk.exe
  2⤵
  PID:3204
- C:\Windows\System\TvUPlpR.exe
  C:\Windows\System\TvUPlpR.exe
  2⤵
  PID:3340
- C:\Windows\System\oyYrzgv.exe
  C:\Windows\System\oyYrzgv.exe
  2⤵
  PID:1108
- C:\Windows\System\peAqNpm.exe
  C:\Windows\System\peAqNpm.exe
  2⤵
  PID:2160
- C:\Windows\System\uZsgErp.exe
  C:\Windows\System\uZsgErp.exe
  2⤵
  PID:2288
- C:\Windows\System\zkNswMa.exe
  C:\Windows\System\zkNswMa.exe
  2⤵
  PID:3436
- C:\Windows\System\bUZpcjN.exe
  C:\Windows\System\bUZpcjN.exe
  2⤵
  PID:912
- C:\Windows\System\mozYAiM.exe
  C:\Windows\System\mozYAiM.exe
  2⤵
  PID:2760
- C:\Windows\System\gRyaYMg.exe
  C:\Windows\System\gRyaYMg.exe
  2⤵
  PID:568
- C:\Windows\System\hFfvrgn.exe
  C:\Windows\System\hFfvrgn.exe
  2⤵
  PID:1744
- C:\Windows\System\gpXtdHn.exe
  C:\Windows\System\gpXtdHn.exe
  2⤵
  PID:3040
- C:\Windows\System\tcOssNS.exe
  C:\Windows\System\tcOssNS.exe
  2⤵
  PID:2548
- C:\Windows\System\EFXllDu.exe
  C:\Windows\System\EFXllDu.exe
  2⤵
  PID:2744
- C:\Windows\System\kVjQRDi.exe
  C:\Windows\System\kVjQRDi.exe
  2⤵
  PID:3152
- C:\Windows\System\iWfBdtN.exe
  C:\Windows\System\iWfBdtN.exe
  2⤵
  PID:1672
- C:\Windows\System\gtxdbxN.exe
  C:\Windows\System\gtxdbxN.exe
  2⤵
  PID:3224
- C:\Windows\System\gxEFlff.exe
  C:\Windows\System\gxEFlff.exe
  2⤵
  PID:3464
- C:\Windows\System\IaJOlLh.exe
  C:\Windows\System\IaJOlLh.exe
  2⤵
  PID:3500
- C:\Windows\System\jbTqqij.exe
  C:\Windows\System\jbTqqij.exe
  2⤵
  PID:3772
- C:\Windows\System\LWnPTUZ.exe
  C:\Windows\System\LWnPTUZ.exe
  2⤵
  PID:4024
- C:\Windows\System\COeOBVu.exe
  C:\Windows\System\COeOBVu.exe
  2⤵
  PID:3024
- C:\Windows\System\kUwTgFi.exe
  C:\Windows\System\kUwTgFi.exe
  2⤵
  PID:3704
- C:\Windows\System\qexlyrK.exe
  C:\Windows\System\qexlyrK.exe
  2⤵
  PID:3240
- C:\Windows\System\BZTvscc.exe
  C:\Windows\System\BZTvscc.exe
  2⤵
  PID:3928
- C:\Windows\System\IcnmGix.exe
  C:\Windows\System\IcnmGix.exe
  2⤵
  PID:1740
- C:\Windows\System\WhSeMlD.exe
  C:\Windows\System\WhSeMlD.exe
  2⤵
  PID:3140
- C:\Windows\System\kdFiFju.exe
  C:\Windows\System\kdFiFju.exe
  2⤵
  PID:2380
- C:\Windows\System\YmKLbjp.exe
  C:\Windows\System\YmKLbjp.exe
  2⤵
  PID:2076
- C:\Windows\System\dFWRjbo.exe
  C:\Windows\System\dFWRjbo.exe
  2⤵
  PID:2372
- C:\Windows\System\FCKfdla.exe
  C:\Windows\System\FCKfdla.exe
  2⤵
  PID:784
- C:\Windows\System\ocoYjkW.exe
  C:\Windows\System\ocoYjkW.exe
  2⤵
  PID:3372
- C:\Windows\System\lQoyjEf.exe
  C:\Windows\System\lQoyjEf.exe
  2⤵
  PID:3304
- C:\Windows\System\QKlKeha.exe
  C:\Windows\System\QKlKeha.exe
  2⤵
  PID:2248
- C:\Windows\System\ptvJOgI.exe
  C:\Windows\System\ptvJOgI.exe
  2⤵
  PID:3624
- C:\Windows\System\YRtwfmf.exe
  C:\Windows\System\YRtwfmf.exe
  2⤵
  PID:596
- C:\Windows\System\uMjrWxn.exe
  C:\Windows\System\uMjrWxn.exe
  2⤵
  PID:3848
- C:\Windows\System\wsTCwGN.exe
  C:\Windows\System\wsTCwGN.exe
  2⤵
  PID:4040
- C:\Windows\System\RDRpecJ.exe
  C:\Windows\System\RDRpecJ.exe
  2⤵
  PID:2940
- C:\Windows\System\NLIqeNu.exe
  C:\Windows\System\NLIqeNu.exe
  2⤵
  PID:4008
- C:\Windows\System\rrfTSWh.exe
  C:\Windows\System\rrfTSWh.exe
  2⤵
  PID:3076
- C:\Windows\System\zIfWJZz.exe
  C:\Windows\System\zIfWJZz.exe
  2⤵
  PID:3256
- C:\Windows\System\xGJhhJa.exe
  C:\Windows\System\xGJhhJa.exe
  2⤵
  PID:3964
- C:\Windows\System\FQrEtOp.exe
  C:\Windows\System\FQrEtOp.exe
  2⤵
  PID:3944
- C:\Windows\System\rbxqAcY.exe
  C:\Windows\System\rbxqAcY.exe
  2⤵
  PID:4108
- C:\Windows\System\MWydmPG.exe
  C:\Windows\System\MWydmPG.exe
  2⤵
  PID:4124
- C:\Windows\System\wADJXAG.exe
  C:\Windows\System\wADJXAG.exe
  2⤵
  PID:4140
- C:\Windows\System\tluPmbr.exe
  C:\Windows\System\tluPmbr.exe
  2⤵
  PID:4156
- C:\Windows\System\ygXNZhY.exe
  C:\Windows\System\ygXNZhY.exe
  2⤵
  PID:4172
- C:\Windows\System\ebzlvdk.exe
  C:\Windows\System\ebzlvdk.exe
  2⤵
  PID:4304
- C:\Windows\System\VUCdcyA.exe
  C:\Windows\System\VUCdcyA.exe
  2⤵
  PID:4320
- C:\Windows\System\BeYysMx.exe
  C:\Windows\System\BeYysMx.exe
  2⤵
  PID:4336
- C:\Windows\System\DciuTPp.exe
  C:\Windows\System\DciuTPp.exe
  2⤵
  PID:4352
- C:\Windows\System\bSzaYIr.exe
  C:\Windows\System\bSzaYIr.exe
  2⤵
  PID:4368
- C:\Windows\System\QFpVjpf.exe
  C:\Windows\System\QFpVjpf.exe
  2⤵
  PID:4384
- C:\Windows\System\ZLrSgjV.exe
  C:\Windows\System\ZLrSgjV.exe
  2⤵
  PID:4400
- C:\Windows\System\YqNuwyt.exe
  C:\Windows\System\YqNuwyt.exe
  2⤵
  PID:4416
- C:\Windows\System\bAZrXXw.exe
  C:\Windows\System\bAZrXXw.exe
  2⤵
  PID:4432
- C:\Windows\System\BBmFJZb.exe
  C:\Windows\System\BBmFJZb.exe
  2⤵
  PID:4448
- C:\Windows\System\JWqSAnn.exe
  C:\Windows\System\JWqSAnn.exe
  2⤵
  PID:4468
- C:\Windows\System\BblCufY.exe
  C:\Windows\System\BblCufY.exe
  2⤵
  PID:4484
- C:\Windows\System\mMCnHpp.exe
  C:\Windows\System\mMCnHpp.exe
  2⤵
  PID:4504
- C:\Windows\System\myTZwTz.exe
  C:\Windows\System\myTZwTz.exe
  2⤵
  PID:4520
- C:\Windows\System\BmVaYct.exe
  C:\Windows\System\BmVaYct.exe
  2⤵
  PID:4536
- C:\Windows\System\GFVZpAE.exe
  C:\Windows\System\GFVZpAE.exe
  2⤵
  PID:4552
- C:\Windows\System\TNzayOg.exe
  C:\Windows\System\TNzayOg.exe
  2⤵
  PID:4568
- C:\Windows\System\dYzXhTt.exe
  C:\Windows\System\dYzXhTt.exe
  2⤵
  PID:4592
- C:\Windows\System\tBjJVsl.exe
  C:\Windows\System\tBjJVsl.exe
  2⤵
  PID:4620
- C:\Windows\System\EBdhYWJ.exe
  C:\Windows\System\EBdhYWJ.exe
  2⤵
  PID:4636
- C:\Windows\System\XIkHscF.exe
  C:\Windows\System\XIkHscF.exe
  2⤵
  PID:4652
- C:\Windows\System\gfKMdPx.exe
  C:\Windows\System\gfKMdPx.exe
  2⤵
  PID:4672
- C:\Windows\System\xsfwRkH.exe
  C:\Windows\System\xsfwRkH.exe
  2⤵
  PID:4688
- C:\Windows\System\blykjYJ.exe
  C:\Windows\System\blykjYJ.exe
  2⤵
  PID:4704
- C:\Windows\System\IAFOdNk.exe
  C:\Windows\System\IAFOdNk.exe
  2⤵
  PID:4764
- C:\Windows\System\IKMNzkY.exe
  C:\Windows\System\IKMNzkY.exe
  2⤵
  PID:4780
- C:\Windows\System\qMGgkle.exe
  C:\Windows\System\qMGgkle.exe
  2⤵
  PID:4796
- C:\Windows\System\lsHMHnk.exe
  C:\Windows\System\lsHMHnk.exe
  2⤵
  PID:4812
- C:\Windows\System\auqRrsa.exe
  C:\Windows\System\auqRrsa.exe
  2⤵
  PID:4828
- C:\Windows\System\fbLNZMR.exe
  C:\Windows\System\fbLNZMR.exe
  2⤵
  PID:4860
- C:\Windows\System\aCfrXuc.exe
  C:\Windows\System\aCfrXuc.exe
  2⤵
  PID:4876
- C:\Windows\System\tRZuiBx.exe
  C:\Windows\System\tRZuiBx.exe
  2⤵
  PID:4892
- C:\Windows\System\JtLEXkW.exe
  C:\Windows\System\JtLEXkW.exe
  2⤵
  PID:4908
- C:\Windows\System\paWTszE.exe
  C:\Windows\System\paWTszE.exe
  2⤵
  PID:4924
- C:\Windows\System\vUhEwro.exe
  C:\Windows\System\vUhEwro.exe
  2⤵
  PID:4944
- C:\Windows\System\yTCVauH.exe
  C:\Windows\System\yTCVauH.exe
  2⤵
  PID:4960
- C:\Windows\System\CdRjiMV.exe
  C:\Windows\System\CdRjiMV.exe
  2⤵
  PID:4976
- C:\Windows\System\fsbuDXz.exe
  C:\Windows\System\fsbuDXz.exe
  2⤵
  PID:4992
- C:\Windows\System\bZoeyWr.exe
  C:\Windows\System\bZoeyWr.exe
  2⤵
  PID:5020
- C:\Windows\System\EYfIiLn.exe
  C:\Windows\System\EYfIiLn.exe
  2⤵
  PID:5040
- C:\Windows\System\qGitFJq.exe
  C:\Windows\System\qGitFJq.exe
  2⤵
  PID:5056
- C:\Windows\System\deuvcQv.exe
  C:\Windows\System\deuvcQv.exe
  2⤵
  PID:5072
- C:\Windows\System\bSsVZye.exe
  C:\Windows\System\bSsVZye.exe
  2⤵
  PID:5088
- C:\Windows\System\ifRfGgt.exe
  C:\Windows\System\ifRfGgt.exe
  2⤵
  PID:5104
- C:\Windows\System\JQCNPiu.exe
  C:\Windows\System\JQCNPiu.exe
  2⤵
  PID:268
- C:\Windows\System\gmoAtWV.exe
  C:\Windows\System\gmoAtWV.exe
  2⤵
  PID:976
- C:\Windows\System\TlLhGnx.exe
  C:\Windows\System\TlLhGnx.exe
  2⤵
  PID:2872
- C:\Windows\System\SpsznPs.exe
  C:\Windows\System\SpsznPs.exe
  2⤵
  PID:1652
- C:\Windows\System\dtrxJTd.exe
  C:\Windows\System\dtrxJTd.exe
  2⤵
  PID:3220
- C:\Windows\System\jWMuWnA.exe
  C:\Windows\System\jWMuWnA.exe
  2⤵
  PID:4120
- C:\Windows\System\yizNTRt.exe
  C:\Windows\System\yizNTRt.exe
  2⤵
  PID:4188
- C:\Windows\System\mNDEmdG.exe
  C:\Windows\System\mNDEmdG.exe
  2⤵
  PID:4204
- C:\Windows\System\igNyOsQ.exe
  C:\Windows\System\igNyOsQ.exe
  2⤵
  PID:4220
- C:\Windows\System\EqYuGTO.exe
  C:\Windows\System\EqYuGTO.exe
  2⤵
  PID:4236
- C:\Windows\System\vwfGDEv.exe
  C:\Windows\System\vwfGDEv.exe
  2⤵
  PID:4252
- C:\Windows\System\mXvegAA.exe
  C:\Windows\System\mXvegAA.exe
  2⤵
  PID:4272
- C:\Windows\System\wsUNogP.exe
  C:\Windows\System\wsUNogP.exe
  2⤵
  PID:4288
- C:\Windows\System\SZqOsJc.exe
  C:\Windows\System\SZqOsJc.exe
  2⤵
  PID:4184
- C:\Windows\System\KdonoMj.exe
  C:\Windows\System\KdonoMj.exe
  2⤵
  PID:4364
- C:\Windows\System\OnobLuU.exe
  C:\Windows\System\OnobLuU.exe
  2⤵
  PID:4428
- C:\Windows\System\MFkErIc.exe
  C:\Windows\System\MFkErIc.exe
  2⤵
  PID:4464
- C:\Windows\System\sUSsprS.exe
  C:\Windows\System\sUSsprS.exe
  2⤵
  PID:4528
- C:\Windows\System\yfetHfk.exe
  C:\Windows\System\yfetHfk.exe
  2⤵
  PID:4600
- C:\Windows\System\aItftak.exe
  C:\Windows\System\aItftak.exe
  2⤵
  PID:4616
- C:\Windows\System\CmrsFuV.exe
  C:\Windows\System\CmrsFuV.exe
  2⤵
  PID:4684
- C:\Windows\System\KJyfYzX.exe
  C:\Windows\System\KJyfYzX.exe
  2⤵
  PID:4728
- C:\Windows\System\qdBLFXG.exe
  C:\Windows\System\qdBLFXG.exe
  2⤵
  PID:4740
- C:\Windows\System\DvoXzfD.exe
  C:\Windows\System\DvoXzfD.exe
  2⤵
  PID:4756
- C:\Windows\System\DtHoikE.exe
  C:\Windows\System\DtHoikE.exe
  2⤵
  PID:4792
- C:\Windows\System\ekRwbAe.exe
  C:\Windows\System\ekRwbAe.exe
  2⤵
  PID:1996
- C:\Windows\System\KrJclwZ.exe
  C:\Windows\System\KrJclwZ.exe
  2⤵
  PID:2104
- C:\Windows\System\hUBRxom.exe
  C:\Windows\System\hUBRxom.exe
  2⤵
  PID:1880
- C:\Windows\System\FzDLcQN.exe
  C:\Windows\System\FzDLcQN.exe
  2⤵
  PID:3084
- C:\Windows\System\hMudYYQ.exe
  C:\Windows\System\hMudYYQ.exe
  2⤵
  PID:3560
- C:\Windows\System\qCXJAXp.exe
  C:\Windows\System\qCXJAXp.exe
  2⤵
  PID:3836
- C:\Windows\System\OsVbEwO.exe
  C:\Windows\System\OsVbEwO.exe
  2⤵
  PID:3052
- C:\Windows\System\MOCnyfY.exe
  C:\Windows\System\MOCnyfY.exe
  2⤵
  PID:4132
- C:\Windows\System\mwlUyCq.exe
  C:\Windows\System\mwlUyCq.exe
  2⤵
  PID:4312
- C:\Windows\System\npNPVHZ.exe
  C:\Windows\System\npNPVHZ.exe
  2⤵
  PID:4376
- C:\Windows\System\jKvXKtQ.exe
  C:\Windows\System\jKvXKtQ.exe
  2⤵
  PID:4440
- C:\Windows\System\vOvdJIh.exe
  C:\Windows\System\vOvdJIh.exe
  2⤵
  PID:4480
- C:\Windows\System\jjWxCgw.exe
  C:\Windows\System\jjWxCgw.exe
  2⤵
  PID:4548
- C:\Windows\System\YERfvBv.exe
  C:\Windows\System\YERfvBv.exe
  2⤵
  PID:4588
- C:\Windows\System\lkQAGZE.exe
  C:\Windows\System\lkQAGZE.exe
  2⤵
  PID:4664
- C:\Windows\System\gkZMDsf.exe
  C:\Windows\System\gkZMDsf.exe
  2⤵
  PID:2412
- C:\Windows\System\uFONdiI.exe
  C:\Windows\System\uFONdiI.exe
  2⤵
  PID:4804
- C:\Windows\System\bpZFkFA.exe
  C:\Windows\System\bpZFkFA.exe
  2⤵
  PID:4852
- C:\Windows\System\kcNGYZl.exe
  C:\Windows\System\kcNGYZl.exe
  2⤵
  PID:656
- C:\Windows\System\WtCaOPQ.exe
  C:\Windows\System\WtCaOPQ.exe
  2⤵
  PID:2364
- C:\Windows\System\ecKZcML.exe
  C:\Windows\System\ecKZcML.exe
  2⤵
  PID:4868
- C:\Windows\System\ZRMarcX.exe
  C:\Windows\System\ZRMarcX.exe
  2⤵
  PID:4936
- C:\Windows\System\zMbiTiq.exe
  C:\Windows\System\zMbiTiq.exe
  2⤵
  PID:4972
- C:\Windows\System\MsxLOVA.exe
  C:\Windows\System\MsxLOVA.exe
  2⤵
  PID:5008
- C:\Windows\System\kdqWcyV.exe
  C:\Windows\System\kdqWcyV.exe
  2⤵
  PID:4916
- C:\Windows\System\hAMIzeG.exe
  C:\Windows\System\hAMIzeG.exe
  2⤵
  PID:1240
- C:\Windows\System\ZduFfvY.exe
  C:\Windows\System\ZduFfvY.exe
  2⤵
  PID:5036
- C:\Windows\System\kTpqZfd.exe
  C:\Windows\System\kTpqZfd.exe
  2⤵
  PID:5080
- C:\Windows\System\qEsasOl.exe
  C:\Windows\System\qEsasOl.exe
  2⤵
  PID:3216
- C:\Windows\System\eoFHmgl.exe
  C:\Windows\System\eoFHmgl.exe
  2⤵
  PID:4152
- C:\Windows\System\abIEUsi.exe
  C:\Windows\System\abIEUsi.exe
  2⤵
  PID:4244
- C:\Windows\System\qggBkRx.exe
  C:\Windows\System\qggBkRx.exe
  2⤵
  PID:2260
- C:\Windows\System\AXBOmiM.exe
  C:\Windows\System\AXBOmiM.exe
  2⤵
  PID:4116
- C:\Windows\System\glVkskK.exe
  C:\Windows\System\glVkskK.exe
  2⤵
  PID:4232
- C:\Windows\System\nxnmOpp.exe
  C:\Windows\System\nxnmOpp.exe
  2⤵
  PID:4268
- C:\Windows\System\djMLbRA.exe
  C:\Windows\System\djMLbRA.exe
  2⤵
  PID:3672
- C:\Windows\System\DgLeejy.exe
  C:\Windows\System\DgLeejy.exe
  2⤵
  PID:4284
- C:\Windows\System\imWAVSe.exe
  C:\Windows\System\imWAVSe.exe
  2⤵
  PID:4496
- C:\Windows\System\voaAAyB.exe
  C:\Windows\System\voaAAyB.exe
  2⤵
  PID:4564
- C:\Windows\System\FJaAlnK.exe
  C:\Windows\System\FJaAlnK.exe
  2⤵
  PID:4460
- C:\Windows\System\sdllwkc.exe
  C:\Windows\System\sdllwkc.exe
  2⤵
  PID:4680
- C:\Windows\System\LzLwSGq.exe
  C:\Windows\System\LzLwSGq.exe
  2⤵
  PID:4748
- C:\Windows\System\XHlKRKs.exe
  C:\Windows\System\XHlKRKs.exe
  2⤵
  PID:4736
- C:\Windows\System\RGZtAug.exe
  C:\Windows\System\RGZtAug.exe
  2⤵
  PID:4820
- C:\Windows\System\hVqYAia.exe
  C:\Windows\System\hVqYAia.exe
  2⤵
  PID:3100
- C:\Windows\System\BqMVXwr.exe
  C:\Windows\System\BqMVXwr.exe
  2⤵
  PID:4100
- C:\Windows\System\cBhRmSm.exe
  C:\Windows\System\cBhRmSm.exe
  2⤵
  PID:2068
- C:\Windows\System\LNwghqJ.exe
  C:\Windows\System\LNwghqJ.exe
  2⤵
  PID:3360
- C:\Windows\System\FYNuigU.exe
  C:\Windows\System\FYNuigU.exe
  2⤵
  PID:4168
- C:\Windows\System\NJsEuOf.exe
  C:\Windows\System\NJsEuOf.exe
  2⤵
  PID:4580
- C:\Windows\System\hQufYIV.exe
  C:\Windows\System\hQufYIV.exe
  2⤵
  PID:4544
- C:\Windows\System\zHpPXJc.exe
  C:\Windows\System\zHpPXJc.exe
  2⤵
  PID:1812
- C:\Windows\System\WhcecpE.exe
  C:\Windows\System\WhcecpE.exe
  2⤵
  PID:4984
- C:\Windows\System\sOvBvAW.exe
  C:\Windows\System\sOvBvAW.exe
  2⤵
  PID:4884
- C:\Windows\System\POpkihc.exe
  C:\Windows\System\POpkihc.exe
  2⤵
  PID:4212
- C:\Windows\System\nmcpJxI.exe
  C:\Windows\System\nmcpJxI.exe
  2⤵
  PID:5068
- C:\Windows\System\qrwXScn.exe
  C:\Windows\System\qrwXScn.exe
  2⤵
  PID:4836
- C:\Windows\System\LUwtKWn.exe
  C:\Windows\System\LUwtKWn.exe
  2⤵
  PID:2464
- C:\Windows\System\RJcvWOe.exe
  C:\Windows\System\RJcvWOe.exe
  2⤵
  PID:4900
- C:\Windows\System\QYWLnBC.exe
  C:\Windows\System\QYWLnBC.exe
  2⤵
  PID:1760
- C:\Windows\System\yzOgJMw.exe
  C:\Windows\System\yzOgJMw.exe
  2⤵
  PID:1752
- C:\Windows\System\qTxjALk.exe
  C:\Windows\System\qTxjALk.exe
  2⤵
  PID:4200
- C:\Windows\System\sQpkbIa.exe
  C:\Windows\System\sQpkbIa.exe
  2⤵
  PID:2860
- C:\Windows\System\DtVrgvQ.exe
  C:\Windows\System\DtVrgvQ.exe
  2⤵
  PID:4476
- C:\Windows\System\xPIwefW.exe
  C:\Windows\System\xPIwefW.exe
  2⤵
  PID:4660
- C:\Windows\System\jsPnjcf.exe
  C:\Windows\System\jsPnjcf.exe
  2⤵
  PID:576
- C:\Windows\System\tfyGkpR.exe
  C:\Windows\System\tfyGkpR.exe
  2⤵
  PID:2468
- C:\Windows\System\eyMAEPz.exe
  C:\Windows\System\eyMAEPz.exe
  2⤵
  PID:1060
- C:\Windows\System\ttPmlCY.exe
  C:\Windows\System\ttPmlCY.exe
  2⤵
  PID:1808
- C:\Windows\System\gmVljYc.exe
  C:\Windows\System\gmVljYc.exe
  2⤵
  PID:5032
- C:\Windows\System\xoInKnJ.exe
  C:\Windows\System\xoInKnJ.exe
  2⤵
  PID:2500
- C:\Windows\System\SNbVGsh.exe
  C:\Windows\System\SNbVGsh.exe
  2⤵
  PID:4608
- C:\Windows\System\TJRTHLm.exe
  C:\Windows\System\TJRTHLm.exe
  2⤵
  PID:1852
- C:\Windows\System\stqpEhQ.exe
  C:\Windows\System\stqpEhQ.exe
  2⤵
  PID:320
- C:\Windows\System\zdirpBr.exe
  C:\Windows\System\zdirpBr.exe
  2⤵
  PID:3420
- C:\Windows\System\xjxtXoX.exe
  C:\Windows\System\xjxtXoX.exe
  2⤵
  PID:3868
- C:\Windows\System\xWCxFYt.exe
  C:\Windows\System\xWCxFYt.exe
  2⤵
  PID:4456
- C:\Windows\System\BChSxnh.exe
  C:\Windows\System\BChSxnh.exe
  2⤵
  PID:1600
- C:\Windows\System\zFaDfYQ.exe
  C:\Windows\System\zFaDfYQ.exe
  2⤵
  PID:2480
- C:\Windows\System\VNTLPOr.exe
  C:\Windows\System\VNTLPOr.exe
  2⤵
  PID:4348
- C:\Windows\System\pGxaRbs.exe
  C:\Windows\System\pGxaRbs.exe
  2⤵
  PID:4648
- C:\Windows\System\psgwYcv.exe
  C:\Windows\System\psgwYcv.exe
  2⤵
  PID:4412
- C:\Windows\System\cDeynNL.exe
  C:\Windows\System\cDeynNL.exe
  2⤵
  PID:4888
- C:\Windows\System\CWFHCuN.exe
  C:\Windows\System\CWFHCuN.exe
  2⤵
  PID:2460
- C:\Windows\System\QyMEUzk.exe
  C:\Windows\System\QyMEUzk.exe
  2⤵
  PID:5116
- C:\Windows\System\mpwMOcI.exe
  C:\Windows\System\mpwMOcI.exe
  2⤵
  PID:2244
- C:\Windows\System\OHxPGhh.exe
  C:\Windows\System\OHxPGhh.exe
  2⤵
  PID:4772
- C:\Windows\System\SnVjfhh.exe
  C:\Windows\System\SnVjfhh.exe
  2⤵
  PID:5004
- C:\Windows\System\bRrXjhu.exe
  C:\Windows\System\bRrXjhu.exe
  2⤵
  PID:5148
- C:\Windows\System\kfyHQJy.exe
  C:\Windows\System\kfyHQJy.exe
  2⤵
  PID:5164
- C:\Windows\System\ofvCNxu.exe
  C:\Windows\System\ofvCNxu.exe
  2⤵
  PID:5180
- C:\Windows\System\ZhhxWGB.exe
  C:\Windows\System\ZhhxWGB.exe
  2⤵
  PID:5240
- C:\Windows\System\XXTAOgW.exe
  C:\Windows\System\XXTAOgW.exe
  2⤵
  PID:5264
- C:\Windows\System\eYAhALL.exe
  C:\Windows\System\eYAhALL.exe
  2⤵
  PID:5316
- C:\Windows\System\QGMDJwt.exe
  C:\Windows\System\QGMDJwt.exe
  2⤵
  PID:5340
- C:\Windows\System\SNLmLGI.exe
  C:\Windows\System\SNLmLGI.exe
  2⤵
  PID:5368
- C:\Windows\System\SxhalWP.exe
  C:\Windows\System\SxhalWP.exe
  2⤵
  PID:5384
- C:\Windows\System\dzKNDqc.exe
  C:\Windows\System\dzKNDqc.exe
  2⤵
  PID:5404
- C:\Windows\System\xCtmvFN.exe
  C:\Windows\System\xCtmvFN.exe
  2⤵
  PID:5420
- C:\Windows\System\SAIlBaC.exe
  C:\Windows\System\SAIlBaC.exe
  2⤵
  PID:5436
- C:\Windows\System\ZvcvWVT.exe
  C:\Windows\System\ZvcvWVT.exe
  2⤵
  PID:5476
- C:\Windows\System\EVejUgv.exe
  C:\Windows\System\EVejUgv.exe
  2⤵
  PID:5516
- C:\Windows\System\oXWQqRu.exe
  C:\Windows\System\oXWQqRu.exe
  2⤵
  PID:5536
- C:\Windows\System\QyvxpIl.exe
  C:\Windows\System\QyvxpIl.exe
  2⤵
  PID:5560
- C:\Windows\System\uXVezkA.exe
  C:\Windows\System\uXVezkA.exe
  2⤵
  PID:5592
- C:\Windows\System\OJoZoUG.exe
  C:\Windows\System\OJoZoUG.exe
  2⤵
  PID:5644
- C:\Windows\System\PqaTVne.exe
  C:\Windows\System\PqaTVne.exe
  2⤵
  PID:5776
- C:\Windows\System\GnRtyjM.exe
  C:\Windows\System\GnRtyjM.exe
  2⤵
  PID:5816
- C:\Windows\System\XZkNYoD.exe
  C:\Windows\System\XZkNYoD.exe
  2⤵
  PID:5832
- C:\Windows\System\nSUaylO.exe
  C:\Windows\System\nSUaylO.exe
  2⤵
  PID:5856
- C:\Windows\System\nAGCiUS.exe
  C:\Windows\System\nAGCiUS.exe
  2⤵
  PID:5968
- C:\Windows\System\zbQoeaJ.exe
  C:\Windows\System\zbQoeaJ.exe
  2⤵
  PID:5984
- C:\Windows\System\vdFzmxu.exe
  C:\Windows\System\vdFzmxu.exe
  2⤵
  PID:6000
- C:\Windows\System\PcpFTTV.exe
  C:\Windows\System\PcpFTTV.exe
  2⤵
  PID:6016
- C:\Windows\System\jyjqasd.exe
  C:\Windows\System\jyjqasd.exe
  2⤵
  PID:6032
- C:\Windows\System\nBgVBqF.exe
  C:\Windows\System\nBgVBqF.exe
  2⤵
  PID:6048
- C:\Windows\System\tHODybL.exe
  C:\Windows\System\tHODybL.exe
  2⤵
  PID:6064
- C:\Windows\System\QqQPlUl.exe
  C:\Windows\System\QqQPlUl.exe
  2⤵
  PID:6084
- C:\Windows\System\lFZZdOB.exe
  C:\Windows\System\lFZZdOB.exe
  2⤵
  PID:6100
- C:\Windows\System\rUswJgW.exe
  C:\Windows\System\rUswJgW.exe
  2⤵
  PID:6116
- C:\Windows\System\SNkSTio.exe
  C:\Windows\System\SNkSTio.exe
  2⤵
  PID:6136
- C:\Windows\System\wpuOqxQ.exe
  C:\Windows\System\wpuOqxQ.exe
  2⤵
  PID:4720
- C:\Windows\System\BUTyydP.exe
  C:\Windows\System\BUTyydP.exe
  2⤵
  PID:4516
- C:\Windows\System\TSEFwZR.exe
  C:\Windows\System\TSEFwZR.exe
  2⤵
  PID:5096
- C:\Windows\System\zGGyQEX.exe
  C:\Windows\System\zGGyQEX.exe
  2⤵
  PID:5192
- C:\Windows\System\acfMgcO.exe
  C:\Windows\System\acfMgcO.exe
  2⤵
  PID:5256
- C:\Windows\System\yFdtKXu.exe
  C:\Windows\System\yFdtKXu.exe
  2⤵
  PID:5156
- C:\Windows\System\aKvdpKz.exe
  C:\Windows\System\aKvdpKz.exe
  2⤵
  PID:5204
- C:\Windows\System\iwdwwUi.exe
  C:\Windows\System\iwdwwUi.exe
  2⤵
  PID:5228
- C:\Windows\System\HCDVsqU.exe
  C:\Windows\System\HCDVsqU.exe
  2⤵
  PID:5280
- C:\Windows\System\hfIuYhe.exe
  C:\Windows\System\hfIuYhe.exe
  2⤵
  PID:5292
- C:\Windows\System\XUcQMTV.exe
  C:\Windows\System\XUcQMTV.exe
  2⤵
  PID:5336
- C:\Windows\System\dehKkfL.exe
  C:\Windows\System\dehKkfL.exe
  2⤵
  PID:5304
- C:\Windows\System\ZsnEfCI.exe
  C:\Windows\System\ZsnEfCI.exe
  2⤵
  PID:5356
- C:\Windows\System\ZTmnIOY.exe
  C:\Windows\System\ZTmnIOY.exe
  2⤵
  PID:5380
- C:\Windows\System\jJUIJYm.exe
  C:\Windows\System\jJUIJYm.exe
  2⤵
  PID:5412
- C:\Windows\System\usAmohm.exe
  C:\Windows\System\usAmohm.exe
  2⤵
  PID:5488
- C:\Windows\System\IPPBpXl.exe
  C:\Windows\System\IPPBpXl.exe
  2⤵
  PID:5500
- C:\Windows\System\oAdBOYR.exe
  C:\Windows\System\oAdBOYR.exe
  2⤵
  PID:5532
- C:\Windows\System\VkXBShN.exe
  C:\Windows\System\VkXBShN.exe
  2⤵
  PID:5552
- C:\Windows\System\aTrLdUW.exe
  C:\Windows\System\aTrLdUW.exe
  2⤵
  PID:5576
- C:\Windows\System\vSExvLR.exe
  C:\Windows\System\vSExvLR.exe
  2⤵
  PID:5604
- C:\Windows\System\jKaOdBl.exe
  C:\Windows\System\jKaOdBl.exe
  2⤵
  PID:5624
- C:\Windows\System\RsZgtpW.exe
  C:\Windows\System\RsZgtpW.exe
  2⤵
  PID:5616
- C:\Windows\System\PrSrVpR.exe
  C:\Windows\System\PrSrVpR.exe
  2⤵
  PID:5664
- C:\Windows\System\SvLdxKt.exe
  C:\Windows\System\SvLdxKt.exe
  2⤵
  PID:5680
- C:\Windows\System\EkuYEwV.exe
  C:\Windows\System\EkuYEwV.exe
  2⤵
  PID:5716
- C:\Windows\System\DKsLOqr.exe
  C:\Windows\System\DKsLOqr.exe
  2⤵
  PID:5756
- C:\Windows\System\OKOYUVE.exe
  C:\Windows\System\OKOYUVE.exe
  2⤵
  PID:5712
- C:\Windows\System\RFDXMlN.exe
  C:\Windows\System\RFDXMlN.exe
  2⤵
  PID:5788
- C:\Windows\System\HoHkMiN.exe
  C:\Windows\System\HoHkMiN.exe
  2⤵
  PID:5824
- C:\Windows\System\PctiCZx.exe
  C:\Windows\System\PctiCZx.exe
  2⤵
  PID:5880
- C:\Windows\System\vRfwSmc.exe
  C:\Windows\System\vRfwSmc.exe
  2⤵
  PID:5936
- C:\Windows\System\zmgroTJ.exe
  C:\Windows\System\zmgroTJ.exe
  2⤵
  PID:5920
- C:\Windows\System\TawyxCC.exe
  C:\Windows\System\TawyxCC.exe
  2⤵
  PID:5904
- C:\Windows\System\nmsoLSJ.exe
  C:\Windows\System\nmsoLSJ.exe
  2⤵
  PID:5800
- C:\Windows\System\fPZrCGQ.exe
  C:\Windows\System\fPZrCGQ.exe
  2⤵
  PID:5868
- C:\Windows\System\nCuwFyF.exe
  C:\Windows\System\nCuwFyF.exe
  2⤵
  PID:6028
- C:\Windows\System\TFrWKNp.exe
  C:\Windows\System\TFrWKNp.exe
  2⤵
  PID:5960
- C:\Windows\System\habREmy.exe
  C:\Windows\System\habREmy.exe
  2⤵
  PID:6132
- C:\Windows\System\OKYyEvB.exe
  C:\Windows\System\OKYyEvB.exe
  2⤵
  PID:5172
- C:\Windows\System\JFHMUaI.exe
  C:\Windows\System\JFHMUaI.exe
  2⤵
  PID:5212
- C:\Windows\System\zNTBGJA.exe
  C:\Windows\System\zNTBGJA.exe
  2⤵
  PID:5296
- C:\Windows\System\BvbgHkJ.exe
  C:\Windows\System\BvbgHkJ.exe
  2⤵
  PID:5364
- C:\Windows\System\WfWGjWz.exe
  C:\Windows\System\WfWGjWz.exe
  2⤵
  PID:2728
- C:\Windows\System\fPMjPXd.exe
  C:\Windows\System\fPMjPXd.exe
  2⤵
  PID:5804
- C:\Windows\System\XmREnWo.exe
  C:\Windows\System\XmREnWo.exe
  2⤵
  PID:1156
- C:\Windows\System\DBZvuMb.exe
  C:\Windows\System\DBZvuMb.exe
  2⤵
  PID:5852
- C:\Windows\System\GMfzegt.exe
  C:\Windows\System\GMfzegt.exe
  2⤵
  PID:6072
- C:\Windows\System\UGasXBd.exe
  C:\Windows\System\UGasXBd.exe
  2⤵
  PID:2444
- C:\Windows\System\cngayYP.exe
  C:\Windows\System\cngayYP.exe
  2⤵
  PID:5396
- C:\Windows\System\MOPkwgJ.exe
  C:\Windows\System\MOPkwgJ.exe
  2⤵
  PID:6076
- C:\Windows\System\ECXpZBq.exe
  C:\Windows\System\ECXpZBq.exe
  2⤵
  PID:5196
- C:\Windows\System\SgKbebp.exe
  C:\Windows\System\SgKbebp.exe
  2⤵
  PID:5324
- C:\Windows\System\oeGzRzn.exe
  C:\Windows\System\oeGzRzn.exe
  2⤵
  PID:5400
- C:\Windows\System\TawGBuw.exe
  C:\Windows\System\TawGBuw.exe
  2⤵
  PID:2196
- C:\Windows\System\ctYQBAp.exe
  C:\Windows\System\ctYQBAp.exe
  2⤵
  PID:5528
- C:\Windows\System\AQXvarD.exe
  C:\Windows\System\AQXvarD.exe
  2⤵
  PID:5508
- C:\Windows\System\tdorlGf.exe
  C:\Windows\System\tdorlGf.exe
  2⤵
  PID:5656
- C:\Windows\System\RfVoqxv.exe
  C:\Windows\System\RfVoqxv.exe
  2⤵
  PID:5636
- C:\Windows\System\dhNTuFJ.exe
  C:\Windows\System\dhNTuFJ.exe
  2⤵
  PID:5704
- C:\Windows\System\FJpiDCF.exe
  C:\Windows\System\FJpiDCF.exe
  2⤵
  PID:5708
- C:\Windows\System\YGHjnfn.exe
  C:\Windows\System\YGHjnfn.exe
  2⤵
  PID:5728
- C:\Windows\System\RbhNWvz.exe
  C:\Windows\System\RbhNWvz.exe
  2⤵
  PID:5840
- C:\Windows\System\XqrxsNy.exe
  C:\Windows\System\XqrxsNy.exe
  2⤵
  PID:6040
- C:\Windows\System\dnUmMnN.exe
  C:\Windows\System\dnUmMnN.exe
  2⤵
  PID:5444
- C:\Windows\System\wfjeePT.exe
  C:\Windows\System\wfjeePT.exe
  2⤵
  PID:5128
- C:\Windows\System\EmocdeX.exe
  C:\Windows\System\EmocdeX.exe
  2⤵
  PID:5844
- C:\Windows\System\bTIjMmp.exe
  C:\Windows\System\bTIjMmp.exe
  2⤵
  PID:5232
- C:\Windows\System\FAMJzio.exe
  C:\Windows\System\FAMJzio.exe
  2⤵
  PID:5464
- C:\Windows\System\WZgCJWq.exe
  C:\Windows\System\WZgCJWq.exe
  2⤵
  PID:5580
- C:\Windows\System\htNNDbY.exe
  C:\Windows\System\htNNDbY.exe
  2⤵
  PID:5620
- C:\Windows\System\tFFYzCo.exe
  C:\Windows\System\tFFYzCo.exe
  2⤵
  PID:5752
- C:\Windows\System\bZnxaUs.exe
  C:\Windows\System\bZnxaUs.exe
  2⤵
  PID:5764
- C:\Windows\System\lAeXdti.exe
  C:\Windows\System\lAeXdti.exe
  2⤵
  PID:5888
- C:\Windows\System\PROBXzU.exe
  C:\Windows\System\PROBXzU.exe
  2⤵
  PID:5908
- C:\Windows\System\wtXtckg.exe
  C:\Windows\System\wtXtckg.exe
  2⤵
  PID:6092
- C:\Windows\System\nKPwRpg.exe
  C:\Windows\System\nKPwRpg.exe
  2⤵
  PID:5872
- C:\Windows\System\zFWfxHQ.exe
  C:\Windows\System\zFWfxHQ.exe
  2⤵
  PID:6128
- C:\Windows\System\EaKCJwc.exe
  C:\Windows\System\EaKCJwc.exe
  2⤵
  PID:6024
- C:\Windows\System\yTiFglj.exe
  C:\Windows\System\yTiFglj.exe
  2⤵
  PID:5996
- C:\Windows\System\VZALTjB.exe
  C:\Windows\System\VZALTjB.exe
  2⤵
  PID:5140
- C:\Windows\System\LVJZgiV.exe
  C:\Windows\System\LVJZgiV.exe
  2⤵
  PID:5600
- C:\Windows\System\THSobck.exe
  C:\Windows\System\THSobck.exe
  2⤵
  PID:2824
- C:\Windows\System\botvDPk.exe
  C:\Windows\System\botvDPk.exe
  2⤵
  PID:5328
- C:\Windows\System\rmeboDY.exe
  C:\Windows\System\rmeboDY.exe
  2⤵
  PID:5548
- C:\Windows\System\xWFlSGy.exe
  C:\Windows\System\xWFlSGy.exe
  2⤵
  PID:5676
- C:\Windows\System\BIPXgeQ.exe
  C:\Windows\System\BIPXgeQ.exe
  2⤵
  PID:5956
- C:\Windows\System\WGeUogu.exe
  C:\Windows\System\WGeUogu.exe
  2⤵
  PID:5760
- C:\Windows\System\XLnNtMq.exe
  C:\Windows\System\XLnNtMq.exe
  2⤵
  PID:5928
- C:\Windows\System\IBwgiiA.exe
  C:\Windows\System\IBwgiiA.exe
  2⤵
  PID:5892
- C:\Windows\System\WYhcKXd.exe
  C:\Windows\System\WYhcKXd.exe
  2⤵
  PID:5216
- C:\Windows\System\ffmzLGj.exe
  C:\Windows\System\ffmzLGj.exe
  2⤵
  PID:5144
- C:\Windows\System\ZTZVtgA.exe
  C:\Windows\System\ZTZVtgA.exe
  2⤵
  PID:5744
- C:\Windows\System\BNOeKRN.exe
  C:\Windows\System\BNOeKRN.exe
  2⤵
  PID:5588
- C:\Windows\System\nhKyCTw.exe
  C:\Windows\System\nhKyCTw.exe
  2⤵
  PID:5828
- C:\Windows\System\JvFuoXq.exe
  C:\Windows\System\JvFuoXq.exe
  2⤵
  PID:5136
- C:\Windows\System\pbTCQQf.exe
  C:\Windows\System\pbTCQQf.exe
  2⤵
  PID:5796
- C:\Windows\System\eSnQqyl.exe
  C:\Windows\System\eSnQqyl.exe
  2⤵
  PID:5808
- C:\Windows\System\DSJPckG.exe
  C:\Windows\System\DSJPckG.exe
  2⤵
  PID:6160
- C:\Windows\System\XIxhfqS.exe
  C:\Windows\System\XIxhfqS.exe
  2⤵
  PID:6176
- C:\Windows\System\DoqfSjg.exe
  C:\Windows\System\DoqfSjg.exe
  2⤵
  PID:6192
- C:\Windows\System\IeRlzLp.exe
  C:\Windows\System\IeRlzLp.exe
  2⤵
  PID:6208
- C:\Windows\System\gJUurNn.exe
  C:\Windows\System\gJUurNn.exe
  2⤵
  PID:6224
- C:\Windows\System\ziZKSRx.exe
  C:\Windows\System\ziZKSRx.exe
  2⤵
  PID:6240
- C:\Windows\System\JdJtzlQ.exe
  C:\Windows\System\JdJtzlQ.exe
  2⤵
  PID:6256
- C:\Windows\System\IZpeqgZ.exe
  C:\Windows\System\IZpeqgZ.exe
  2⤵
  PID:6272
- C:\Windows\System\xuhTUgk.exe
  C:\Windows\System\xuhTUgk.exe
  2⤵
  PID:6288
- C:\Windows\System\ndsLKuV.exe
  C:\Windows\System\ndsLKuV.exe
  2⤵
  PID:6304
- C:\Windows\System\UJSjCaT.exe
  C:\Windows\System\UJSjCaT.exe
  2⤵
  PID:6320
- C:\Windows\System\EfvZQnG.exe
  C:\Windows\System\EfvZQnG.exe
  2⤵
  PID:6336
- C:\Windows\System\xQnYpAL.exe
  C:\Windows\System\xQnYpAL.exe
  2⤵
  PID:6352
- C:\Windows\System\TNoBsKG.exe
  C:\Windows\System\TNoBsKG.exe
  2⤵
  PID:6372
- C:\Windows\System\WLMOQVm.exe
  C:\Windows\System\WLMOQVm.exe
  2⤵
  PID:6388
- C:\Windows\System\PAKrtnq.exe
  C:\Windows\System\PAKrtnq.exe
  2⤵
  PID:6404
- C:\Windows\System\tRAsmnm.exe
  C:\Windows\System\tRAsmnm.exe
  2⤵
  PID:6420
- C:\Windows\System\UZDSIBw.exe
  C:\Windows\System\UZDSIBw.exe
  2⤵
  PID:6436
- C:\Windows\System\nyPXomu.exe
  C:\Windows\System\nyPXomu.exe
  2⤵
  PID:6452
- C:\Windows\System\CAswTHd.exe
  C:\Windows\System\CAswTHd.exe
  2⤵
  PID:6468
- C:\Windows\System\bqZPVJR.exe
  C:\Windows\System\bqZPVJR.exe
  2⤵
  PID:6484
- C:\Windows\System\FYhusHw.exe
  C:\Windows\System\FYhusHw.exe
  2⤵
  PID:6500
- C:\Windows\System\NpNTyyi.exe
  C:\Windows\System\NpNTyyi.exe
  2⤵
  PID:6516
- C:\Windows\System\udOaWsw.exe
  C:\Windows\System\udOaWsw.exe
  2⤵
  PID:6532
- C:\Windows\System\NLqDgUF.exe
  C:\Windows\System\NLqDgUF.exe
  2⤵
  PID:6556
- C:\Windows\System\EdsVnuR.exe
  C:\Windows\System\EdsVnuR.exe
  2⤵
  PID:6572
- C:\Windows\System\QbMNkNp.exe
  C:\Windows\System\QbMNkNp.exe
  2⤵
  PID:6588
- C:\Windows\System\eHMIZmJ.exe
  C:\Windows\System\eHMIZmJ.exe
  2⤵
  PID:6604
- C:\Windows\System\wDuAGRD.exe
  C:\Windows\System\wDuAGRD.exe
  2⤵
  PID:6620
- C:\Windows\System\eGlhglU.exe
  C:\Windows\System\eGlhglU.exe
  2⤵
  PID:6636
- C:\Windows\System\VbfAUwj.exe
  C:\Windows\System\VbfAUwj.exe
  2⤵
  PID:6652
- C:\Windows\System\GQEthdp.exe
  C:\Windows\System\GQEthdp.exe
  2⤵
  PID:6668
- C:\Windows\System\TyvzhMD.exe
  C:\Windows\System\TyvzhMD.exe
  2⤵
  PID:6684
- C:\Windows\System\nsOyvIW.exe
  C:\Windows\System\nsOyvIW.exe
  2⤵
  PID:6700
- C:\Windows\System\FDnWqtU.exe
  C:\Windows\System\FDnWqtU.exe
  2⤵
  PID:6716
- C:\Windows\System\QcJMUDu.exe
  C:\Windows\System\QcJMUDu.exe
  2⤵
  PID:6732
- C:\Windows\System\MUUzWIQ.exe
  C:\Windows\System\MUUzWIQ.exe
  2⤵
  PID:6748
- C:\Windows\System\ldUwVZJ.exe
  C:\Windows\System\ldUwVZJ.exe
  2⤵
  PID:6764
- C:\Windows\System\funLNpX.exe
  C:\Windows\System\funLNpX.exe
  2⤵
  PID:6780
- C:\Windows\System\EDJTBAZ.exe
  C:\Windows\System\EDJTBAZ.exe
  2⤵
  PID:6796
- C:\Windows\System\MZvqbJI.exe
  C:\Windows\System\MZvqbJI.exe
  2⤵
  PID:6812
- C:\Windows\System\nVtxhrs.exe
  C:\Windows\System\nVtxhrs.exe
  2⤵
  PID:6828
- C:\Windows\System\OntrICY.exe
  C:\Windows\System\OntrICY.exe
  2⤵
  PID:6844
- C:\Windows\System\XyUMKJJ.exe
  C:\Windows\System\XyUMKJJ.exe
  2⤵
  PID:6860
- C:\Windows\System\EMpSurW.exe
  C:\Windows\System\EMpSurW.exe
  2⤵
  PID:6876
- C:\Windows\System\hdyZNtB.exe
  C:\Windows\System\hdyZNtB.exe
  2⤵
  PID:6892
- C:\Windows\System\NVDIrTI.exe
  C:\Windows\System\NVDIrTI.exe
  2⤵
  PID:6908
- C:\Windows\System\XTWjbbY.exe
  C:\Windows\System\XTWjbbY.exe
  2⤵
  PID:6924
- C:\Windows\System\qNhoRTX.exe
  C:\Windows\System\qNhoRTX.exe
  2⤵
  PID:6940
- C:\Windows\System\ErvRXoC.exe
  C:\Windows\System\ErvRXoC.exe
  2⤵
  PID:6956
- C:\Windows\System\AeeOoxh.exe
  C:\Windows\System\AeeOoxh.exe
  2⤵
  PID:6972
- C:\Windows\System\UQbgqRg.exe
  C:\Windows\System\UQbgqRg.exe
  2⤵
  PID:6988
- C:\Windows\System\ZkDZSeV.exe
  C:\Windows\System\ZkDZSeV.exe
  2⤵
  PID:7004
- C:\Windows\System\Olctnpo.exe
  C:\Windows\System\Olctnpo.exe
  2⤵
  PID:7020
- C:\Windows\System\kZAmtVl.exe
  C:\Windows\System\kZAmtVl.exe
  2⤵
  PID:7036
- C:\Windows\System\XkSOOcn.exe
  C:\Windows\System\XkSOOcn.exe
  2⤵
  PID:7052
- C:\Windows\System\qaYlxxc.exe
  C:\Windows\System\qaYlxxc.exe
  2⤵
  PID:7068
- C:\Windows\System\kuVwjfV.exe
  C:\Windows\System\kuVwjfV.exe
  2⤵
  PID:7084
- C:\Windows\System\TJlMXPm.exe
  C:\Windows\System\TJlMXPm.exe
  2⤵
  PID:7100
- C:\Windows\System\KdhDUId.exe
  C:\Windows\System\KdhDUId.exe
  2⤵
  PID:7116
- C:\Windows\System\IksNIFl.exe
  C:\Windows\System\IksNIFl.exe
  2⤵
  PID:7132
- C:\Windows\System\hNevuqV.exe
  C:\Windows\System\hNevuqV.exe
  2⤵
  PID:7148
- C:\Windows\System\PhmnbJz.exe
  C:\Windows\System\PhmnbJz.exe
  2⤵
  PID:7164
- C:\Windows\System\VreDJNe.exe
  C:\Windows\System\VreDJNe.exe
  2⤵
  PID:6204
- C:\Windows\System\oFhqECA.exe
  C:\Windows\System\oFhqECA.exe
  2⤵
  PID:5584
- C:\Windows\System\aGthaxO.exe
  C:\Windows\System\aGthaxO.exe
  2⤵
  PID:6360
- C:\Windows\System\stlOOhI.exe
  C:\Windows\System\stlOOhI.exe
  2⤵
  PID:6400
- C:\Windows\System\TzOpIuW.exe
  C:\Windows\System\TzOpIuW.exe
  2⤵
  PID:6380
- C:\Windows\System\mlyNUbS.exe
  C:\Windows\System\mlyNUbS.exe
  2⤵
  PID:6596
- C:\Windows\System\uuNfjtt.exe
  C:\Windows\System\uuNfjtt.exe
  2⤵
  PID:6692
- C:\Windows\System\lyIozsp.exe
  C:\Windows\System\lyIozsp.exe
  2⤵
  PID:6548
- C:\Windows\System\yyRIMLx.exe
  C:\Windows\System\yyRIMLx.exe
  2⤵
  PID:6792
- C:\Windows\System\fQRuhwQ.exe
  C:\Windows\System\fQRuhwQ.exe
  2⤵
  PID:6884
- C:\Windows\System\AvPGuNv.exe
  C:\Windows\System\AvPGuNv.exe
  2⤵
  PID:6952
- C:\Windows\System\GdZqIPC.exe
  C:\Windows\System\GdZqIPC.exe
  2⤵
  PID:7016
- C:\Windows\System\TwKZVip.exe
  C:\Windows\System\TwKZVip.exe
  2⤵
  PID:7080
- C:\Windows\System\sBuPpih.exe
  C:\Windows\System\sBuPpih.exe
  2⤵
  PID:7144
- C:\Windows\System\qBQKOZY.exe
  C:\Windows\System\qBQKOZY.exe
  2⤵
  PID:6168
- C:\Windows\System\olOtzwK.exe
  C:\Windows\System\olOtzwK.exe
  2⤵
  PID:6580
- C:\Windows\System\feZOamM.exe
  C:\Windows\System\feZOamM.exe
  2⤵
  PID:6808
- C:\Windows\System\KHQFzrY.exe
  C:\Windows\System\KHQFzrY.exe
  2⤵
  PID:7060
- C:\Windows\System\JAsBEEt.exe
  C:\Windows\System\JAsBEEt.exe
  2⤵
  PID:6900
- C:\Windows\System\BCGoLji.exe
  C:\Windows\System\BCGoLji.exe
  2⤵
  PID:6708
- C:\Windows\System\qcOlaxL.exe
  C:\Windows\System\qcOlaxL.exe
  2⤵
  PID:6996
- C:\Windows\System\WvXhXqp.exe
  C:\Windows\System\WvXhXqp.exe
  2⤵
  PID:6804
- C:\Windows\System\NakLjcd.exe
  C:\Windows\System\NakLjcd.exe
  2⤵
  PID:6772
- C:\Windows\System\tvwKPth.exe
  C:\Windows\System\tvwKPth.exe
  2⤵
  PID:6676
- C:\Windows\System\fmMDZtc.exe
  C:\Windows\System\fmMDZtc.exe
  2⤵
  PID:6296
- C:\Windows\System\CqFihpc.exe
  C:\Windows\System\CqFihpc.exe
  2⤵
  PID:6396
- C:\Windows\System\uWVZqOI.exe
  C:\Windows\System\uWVZqOI.exe
  2⤵
  PID:6152
- C:\Windows\System\ZhxvldD.exe
  C:\Windows\System\ZhxvldD.exe
  2⤵
  PID:6284
- C:\Windows\System\ZyEKXyM.exe
  C:\Windows\System\ZyEKXyM.exe
  2⤵
  PID:6428
- C:\Windows\System\OIUCueJ.exe
  C:\Windows\System\OIUCueJ.exe
  2⤵
  PID:6528
- C:\Windows\System\aBdgQqT.exe
  C:\Windows\System\aBdgQqT.exe
  2⤵
  PID:6344
- C:\Windows\System\QDzYBYt.exe
  C:\Windows\System\QDzYBYt.exe
  2⤵
  PID:6476
- C:\Windows\System\lFdeFJx.exe
  C:\Windows\System\lFdeFJx.exe
  2⤵
  PID:6544
- C:\Windows\System\HwMGtnz.exe
  C:\Windows\System\HwMGtnz.exe
  2⤵
  PID:6664
- C:\Windows\System\mnAbuNl.exe
  C:\Windows\System\mnAbuNl.exe
  2⤵
  PID:6916
- C:\Windows\System\TWWvASc.exe
  C:\Windows\System\TWWvASc.exe
  2⤵
  PID:5348
- C:\Windows\System\XXoFapo.exe
  C:\Windows\System\XXoFapo.exe
  2⤵
  PID:6172
- C:\Windows\System\eZkDYXa.exe
  C:\Windows\System\eZkDYXa.exe
  2⤵
  PID:7032
- C:\Windows\System\zYllaFI.exe
  C:\Windows\System\zYllaFI.exe
  2⤵
  PID:6776
- C:\Windows\System\yDcXyFc.exe
  C:\Windows\System\yDcXyFc.exe
  2⤵
  PID:7156
- C:\Windows\System\DHgFqJu.exe
  C:\Windows\System\DHgFqJu.exe
  2⤵
  PID:6852
- C:\Windows\System\XxjTREA.exe
  C:\Windows\System\XxjTREA.exe
  2⤵
  PID:6744
- C:\Windows\System\KKlDxWe.exe
  C:\Windows\System\KKlDxWe.exe
  2⤵
  PID:7096
- C:\Windows\System\zvuTKzW.exe
  C:\Windows\System\zvuTKzW.exe
  2⤵
  PID:6964
- C:\Windows\System\wCxJWoK.exe
  C:\Windows\System\wCxJWoK.exe
  2⤵
  PID:6368
- C:\Windows\System\IMIguxy.exe
  C:\Windows\System\IMIguxy.exe
  2⤵
  PID:6216
- C:\Windows\System\ISJQsST.exe
  C:\Windows\System\ISJQsST.exe
  2⤵
  PID:6280
- C:\Windows\System\MeOqtON.exe
  C:\Windows\System\MeOqtON.exe
  2⤵
  PID:6384
- C:\Windows\System\aicsdQp.exe
  C:\Windows\System\aicsdQp.exe
  2⤵
  PID:6628
- C:\Windows\System\evuZSnE.exe
  C:\Windows\System\evuZSnE.exe
  2⤵
  PID:6840
- C:\Windows\System\oziaotK.exe
  C:\Windows\System\oziaotK.exe
  2⤵
  PID:6264
- C:\Windows\System\QIlpgIC.exe
  C:\Windows\System\QIlpgIC.exe
  2⤵
  PID:6728
- C:\Windows\System\dHMUSdK.exe
  C:\Windows\System\dHMUSdK.exe
  2⤵
  PID:6724
- C:\Windows\System\MSzBYeM.exe
  C:\Windows\System\MSzBYeM.exe
  2⤵
  PID:6948
- C:\Windows\System\BTNPNGv.exe
  C:\Windows\System\BTNPNGv.exe
  2⤵
  PID:7128
- C:\Windows\System\scNKsxD.exe
  C:\Windows\System\scNKsxD.exe
  2⤵
  PID:6252
- C:\Windows\System\qYVSzYE.exe
  C:\Windows\System\qYVSzYE.exe
  2⤵
  PID:6416
- C:\Windows\System\MPaajsv.exe
  C:\Windows\System\MPaajsv.exe
  2⤵
  PID:6932
- C:\Windows\System\gxSHByZ.exe
  C:\Windows\System\gxSHByZ.exe
  2⤵
  PID:6788
- C:\Windows\System\DGQPYwW.exe
  C:\Windows\System\DGQPYwW.exe
  2⤵
  PID:6660
- C:\Windows\System\nddxFcj.exe
  C:\Windows\System\nddxFcj.exe
  2⤵
  PID:6524
- C:\Windows\System\nImRwxM.exe
  C:\Windows\System\nImRwxM.exe
  2⤵
  PID:6156
- C:\Windows\System\aeitclM.exe
  C:\Windows\System\aeitclM.exe
  2⤵
  PID:7172
- C:\Windows\System\YoubTsK.exe
  C:\Windows\System\YoubTsK.exe
  2⤵
  PID:7188
- C:\Windows\System\ridZKvG.exe
  C:\Windows\System\ridZKvG.exe
  2⤵
  PID:7204
- C:\Windows\System\cjYBsia.exe
  C:\Windows\System\cjYBsia.exe
  2⤵
  PID:7220
- C:\Windows\System\tVCHjIh.exe
  C:\Windows\System\tVCHjIh.exe
  2⤵
  PID:7236
- C:\Windows\System\CZahncE.exe
  C:\Windows\System\CZahncE.exe
  2⤵
  PID:7252
- C:\Windows\System\HTlwoGU.exe
  C:\Windows\System\HTlwoGU.exe
  2⤵
  PID:7268
- C:\Windows\System\tuUmCYw.exe
  C:\Windows\System\tuUmCYw.exe
  2⤵
  PID:7284
- C:\Windows\System\HQsLVVm.exe
  C:\Windows\System\HQsLVVm.exe
  2⤵
  PID:7300
- C:\Windows\System\AksxlOu.exe
  C:\Windows\System\AksxlOu.exe
  2⤵
  PID:7316
- C:\Windows\System\SMINIQk.exe
  C:\Windows\System\SMINIQk.exe
  2⤵
  PID:7332
- C:\Windows\System\XYkhaed.exe
  C:\Windows\System\XYkhaed.exe
  2⤵
  PID:7348
- C:\Windows\System\gLbskra.exe
  C:\Windows\System\gLbskra.exe
  2⤵
  PID:7364
- C:\Windows\System\ydIWeNG.exe
  C:\Windows\System\ydIWeNG.exe
  2⤵
  PID:7380
- C:\Windows\System\nYZCJNE.exe
  C:\Windows\System\nYZCJNE.exe
  2⤵
  PID:7400
- C:\Windows\System\WzBIXnL.exe
  C:\Windows\System\WzBIXnL.exe
  2⤵
  PID:7416
- C:\Windows\System\vzOYXtq.exe
  C:\Windows\System\vzOYXtq.exe
  2⤵
  PID:7432
- C:\Windows\System\FIRjbXM.exe
  C:\Windows\System\FIRjbXM.exe
  2⤵
  PID:7448
- C:\Windows\System\WKRAkoF.exe
  C:\Windows\System\WKRAkoF.exe
  2⤵
  PID:7464
- C:\Windows\System\SQPlQcW.exe
  C:\Windows\System\SQPlQcW.exe
  2⤵
  PID:7480
- C:\Windows\System\dtNzGjs.exe
  C:\Windows\System\dtNzGjs.exe
  2⤵
  PID:7496
- C:\Windows\System\hOJeFQo.exe
  C:\Windows\System\hOJeFQo.exe
  2⤵
  PID:7512
- C:\Windows\System\wwpvArK.exe
  C:\Windows\System\wwpvArK.exe
  2⤵
  PID:7620
- C:\Windows\System\JdNaCDr.exe
  C:\Windows\System\JdNaCDr.exe
  2⤵
  PID:7636
- C:\Windows\System\mLfIVey.exe
  C:\Windows\System\mLfIVey.exe
  2⤵
  PID:7656
- C:\Windows\System\VvgzbeG.exe
  C:\Windows\System\VvgzbeG.exe
  2⤵
  PID:7672
- C:\Windows\System\kRfXtZS.exe
  C:\Windows\System\kRfXtZS.exe
  2⤵
  PID:7688
- C:\Windows\System\tpaVFrI.exe
  C:\Windows\System\tpaVFrI.exe
  2⤵
  PID:7704
- C:\Windows\System\NYtjORp.exe
  C:\Windows\System\NYtjORp.exe
  2⤵
  PID:7720
- C:\Windows\System\wNlWuLo.exe
  C:\Windows\System\wNlWuLo.exe
  2⤵
  PID:7736
- C:\Windows\System\tBaoUHM.exe
  C:\Windows\System\tBaoUHM.exe
  2⤵
  PID:7752
- C:\Windows\System\oOLmVuK.exe
  C:\Windows\System\oOLmVuK.exe
  2⤵
  PID:7896
- C:\Windows\System\QAksrwv.exe
  C:\Windows\System\QAksrwv.exe
  2⤵
  PID:7912
- C:\Windows\System\XNUSovp.exe
  C:\Windows\System\XNUSovp.exe
  2⤵
  PID:7928
- C:\Windows\System\nEflGBV.exe
  C:\Windows\System\nEflGBV.exe
  2⤵
  PID:7944
- C:\Windows\System\ZqhGtnf.exe
  C:\Windows\System\ZqhGtnf.exe
  2⤵
  PID:7960
- C:\Windows\System\NTvGwxT.exe
  C:\Windows\System\NTvGwxT.exe
  2⤵
  PID:7976
- C:\Windows\System\yHyAqAM.exe
  C:\Windows\System\yHyAqAM.exe
  2⤵
  PID:7992
- C:\Windows\System\okjPQnm.exe
  C:\Windows\System\okjPQnm.exe
  2⤵
  PID:8100
- C:\Windows\System\ESddLiL.exe
  C:\Windows\System\ESddLiL.exe
  2⤵
  PID:8120
- C:\Windows\System\mWptfKX.exe
  C:\Windows\System\mWptfKX.exe
  2⤵
  PID:8140
- C:\Windows\System\VSCVpZf.exe
  C:\Windows\System\VSCVpZf.exe
  2⤵
  PID:8156
- C:\Windows\System\intpoma.exe
  C:\Windows\System\intpoma.exe
  2⤵
  PID:8172
- C:\Windows\System\rTZEoVp.exe
  C:\Windows\System\rTZEoVp.exe
  2⤵
  PID:8188
- C:\Windows\System\YolItUn.exe
  C:\Windows\System\YolItUn.exe
  2⤵
  PID:7260
- C:\Windows\System\WmuDbVQ.exe
  C:\Windows\System\WmuDbVQ.exe
  2⤵
  PID:7292
- C:\Windows\System\zONNGVw.exe
  C:\Windows\System\zONNGVw.exe
  2⤵
  PID:6460
- C:\Windows\System\YILsaOE.exe
  C:\Windows\System\YILsaOE.exe
  2⤵
  PID:6248
- C:\Windows\System\SfLYgJG.exe
  C:\Windows\System\SfLYgJG.exe
  2⤵
  PID:6904
- C:\Windows\System\vktnIfp.exe
  C:\Windows\System\vktnIfp.exe
  2⤵
  PID:7324
- C:\Windows\System\ZiymUbh.exe
  C:\Windows\System\ZiymUbh.exe
  2⤵
  PID:7388
- C:\Windows\System\RbGRapI.exe
  C:\Windows\System\RbGRapI.exe
  2⤵
  PID:7456
- C:\Windows\System\gExkjJc.exe
  C:\Windows\System\gExkjJc.exe
  2⤵
  PID:7312
- C:\Windows\System\IRyRUUw.exe
  C:\Windows\System\IRyRUUw.exe
  2⤵
  PID:7408
- C:\Windows\System\LIzXiyx.exe
  C:\Windows\System\LIzXiyx.exe
  2⤵
  PID:7440
- C:\Windows\System\TRDStQy.exe
  C:\Windows\System\TRDStQy.exe
  2⤵
  PID:7508
- C:\Windows\System\gYNAbMW.exe
  C:\Windows\System\gYNAbMW.exe
  2⤵
  PID:7540
- C:\Windows\System\UAzIIUb.exe
  C:\Windows\System\UAzIIUb.exe
  2⤵
  PID:7564
- C:\Windows\System\gtwRmQb.exe
  C:\Windows\System\gtwRmQb.exe
  2⤵
  PID:7644
- C:\Windows\System\AorTCBb.exe
  C:\Windows\System\AorTCBb.exe
  2⤵
  PID:7760
- C:\Windows\System\cJPwsVg.exe
  C:\Windows\System\cJPwsVg.exe
  2⤵
  PID:7696
- C:\Windows\System\UaxOIKW.exe
  C:\Windows\System\UaxOIKW.exe
  2⤵
  PID:7776
- C:\Windows\System\bztzWiB.exe
  C:\Windows\System\bztzWiB.exe
  2⤵
  PID:7788
- C:\Windows\System\XQxUhNf.exe
  C:\Windows\System\XQxUhNf.exe
  2⤵
  PID:7804
- C:\Windows\System\BmYmtCw.exe
  C:\Windows\System\BmYmtCw.exe
  2⤵
  PID:7816
- C:\Windows\System\RdnEcfb.exe
  C:\Windows\System\RdnEcfb.exe
  2⤵
  PID:7836
- C:\Windows\System\sFpRdwl.exe
  C:\Windows\System\sFpRdwl.exe
  2⤵
  PID:7852
- C:\Windows\System\YVWworl.exe
  C:\Windows\System\YVWworl.exe
  2⤵
  PID:7864
- C:\Windows\System\sxEbtSO.exe
  C:\Windows\System\sxEbtSO.exe
  2⤵
  PID:7880
- C:\Windows\System\ugGEqAZ.exe
  C:\Windows\System\ugGEqAZ.exe
  2⤵
  PID:7940
- C:\Windows\System\luugHgm.exe
  C:\Windows\System\luugHgm.exe
  2⤵
  PID:7952
- C:\Windows\System\KtvtKZo.exe
  C:\Windows\System\KtvtKZo.exe
  2⤵
  PID:7924
- C:\Windows\System\dKdPGjP.exe
  C:\Windows\System\dKdPGjP.exe
  2⤵
  PID:7904
- C:\Windows\System\vzYYBWF.exe
  C:\Windows\System\vzYYBWF.exe
  2⤵
  PID:8016
- C:\Windows\System\bIhcZYx.exe
  C:\Windows\System\bIhcZYx.exe
  2⤵
  PID:8040
- C:\Windows\System\UYJwOle.exe
  C:\Windows\System\UYJwOle.exe
  2⤵
  PID:8060
- C:\Windows\System\EPPrYoF.exe
  C:\Windows\System\EPPrYoF.exe
  2⤵
  PID:8072
- C:\Windows\System\zwhejgO.exe
  C:\Windows\System\zwhejgO.exe
  2⤵
  PID:8092
- C:\Windows\System\JbavNqk.exe
  C:\Windows\System\JbavNqk.exe
  2⤵
  PID:8152
- C:\Windows\System\HmOwTkb.exe
  C:\Windows\System\HmOwTkb.exe
  2⤵
  PID:8096
- C:\Windows\System\lVzmhGZ.exe
  C:\Windows\System\lVzmhGZ.exe
  2⤵
  PID:8168
- C:\Windows\System\idVnNMF.exe
  C:\Windows\System\idVnNMF.exe
  2⤵
  PID:7280
- C:\Windows\System\oXZbctB.exe
  C:\Windows\System\oXZbctB.exe
  2⤵
  PID:6564
- C:\Windows\System\zgkBwap.exe
  C:\Windows\System\zgkBwap.exe
  2⤵
  PID:7340
- C:\Windows\System\UyayiwO.exe
  C:\Windows\System\UyayiwO.exe
  2⤵
  PID:7244
- C:\Windows\System\aFdDnCu.exe
  C:\Windows\System\aFdDnCu.exe
  2⤵
  PID:7428
- C:\Windows\System\fSLwdrp.exe
  C:\Windows\System\fSLwdrp.exe
  2⤵
  PID:7572
- C:\Windows\System\UxkFjMw.exe
  C:\Windows\System\UxkFjMw.exe
  2⤵
  PID:7576
- C:\Windows\System\MYYOfNP.exe
  C:\Windows\System\MYYOfNP.exe
  2⤵
  PID:7592
- C:\Windows\System\VHkCkHu.exe
  C:\Windows\System\VHkCkHu.exe
  2⤵
  PID:7596
- C:\Windows\System\clPgWYD.exe
  C:\Windows\System\clPgWYD.exe
  2⤵
  PID:7744
- C:\Windows\System\aXGctON.exe
  C:\Windows\System\aXGctON.exe
  2⤵
  PID:7648
- C:\Windows\System\SfDjRPJ.exe
  C:\Windows\System\SfDjRPJ.exe
  2⤵
  PID:7784
- C:\Windows\System\IFklGJL.exe
  C:\Windows\System\IFklGJL.exe
  2⤵
  PID:7844
- C:\Windows\System\UnjuBhg.exe
  C:\Windows\System\UnjuBhg.exe
  2⤵
  PID:7988
- C:\Windows\System\BmWwFZW.exe
  C:\Windows\System\BmWwFZW.exe
  2⤵
  PID:8032
- C:\Windows\System\kWaMODD.exe
  C:\Windows\System\kWaMODD.exe
  2⤵
  PID:8008
- C:\Windows\System\asFHUtk.exe
  C:\Windows\System\asFHUtk.exe
  2⤵
  PID:7680
- C:\Windows\System\AEtilkT.exe
  C:\Windows\System\AEtilkT.exe
  2⤵
  PID:7828
- C:\Windows\System\VbXhENc.exe
  C:\Windows\System\VbXhENc.exe
  2⤵
  PID:7936
- C:\Windows\System\PUPfvBM.exe
  C:\Windows\System\PUPfvBM.exe
  2⤵
  PID:8064
- C:\Windows\System\nkCtsmq.exe
  C:\Windows\System\nkCtsmq.exe
  2⤵
  PID:8148
- C:\Windows\System\zNgcavw.exe
  C:\Windows\System\zNgcavw.exe
  2⤵
  PID:8080
- C:\Windows\System\ilGRrsL.exe
  C:\Windows\System\ilGRrsL.exe
  2⤵
  PID:7200
- C:\Windows\System\bQkawAS.exe
  C:\Windows\System\bQkawAS.exe
  2⤵
  PID:8052
- C:\Windows\System\MRMGlLu.exe
  C:\Windows\System\MRMGlLu.exe
  2⤵
  PID:7216
- C:\Windows\System\sVFjomB.exe
  C:\Windows\System\sVFjomB.exe
  2⤵
  PID:7276
- C:\Windows\System\ZNZRiGv.exe
  C:\Windows\System\ZNZRiGv.exe
  2⤵
  PID:7424
- C:\Windows\System\hsFiIpz.exe
  C:\Windows\System\hsFiIpz.exe
  2⤵
  PID:7532
- C:\Windows\System\SNNDJpS.exe
  C:\Windows\System\SNNDJpS.exe
  2⤵
  PID:7584
- C:\Windows\System\cZIiaai.exe
  C:\Windows\System\cZIiaai.exe
  2⤵
  PID:7728
- C:\Windows\System\bCgXNGK.exe
  C:\Windows\System\bCgXNGK.exe
  2⤵
  PID:7684
- C:\Windows\System\VunwqVR.exe
  C:\Windows\System\VunwqVR.exe
  2⤵
  PID:7832
- C:\Windows\System\anGmNon.exe
  C:\Windows\System\anGmNon.exe
  2⤵
  PID:7920
- C:\Windows\System\zgErFKs.exe
  C:\Windows\System\zgErFKs.exe
  2⤵
  PID:8036
- C:\Windows\System\hrMZLIe.exe
  C:\Windows\System\hrMZLIe.exe
  2⤵
  PID:7228
- C:\Windows\System\zGpJHka.exe
  C:\Windows\System\zGpJHka.exe
  2⤵
  PID:7560
- C:\Windows\System\XiqMYVC.exe
  C:\Windows\System\XiqMYVC.exe
  2⤵
  PID:7848
- C:\Windows\System\fMUriFF.exe
  C:\Windows\System\fMUriFF.exe
  2⤵
  PID:7800
- C:\Windows\System\ttASmOe.exe
  C:\Windows\System\ttASmOe.exe
  2⤵
  PID:7908
- C:\Windows\System\eQHmhUt.exe
  C:\Windows\System\eQHmhUt.exe
  2⤵
  PID:8208
- C:\Windows\System\oRKUSOW.exe
  C:\Windows\System\oRKUSOW.exe
  2⤵
  PID:8224
- C:\Windows\System\ffkmOfN.exe
  C:\Windows\System\ffkmOfN.exe
  2⤵
  PID:8240
- C:\Windows\System\CnDYEiY.exe
  C:\Windows\System\CnDYEiY.exe
  2⤵
  PID:8256
- C:\Windows\System\IjtrRnp.exe
  C:\Windows\System\IjtrRnp.exe
  2⤵
  PID:8272
- C:\Windows\System\XteRpBL.exe
  C:\Windows\System\XteRpBL.exe
  2⤵
  PID:8288
- C:\Windows\System\gYXdbon.exe
  C:\Windows\System\gYXdbon.exe
  2⤵
  PID:8304
- C:\Windows\System\mKBxQIA.exe
  C:\Windows\System\mKBxQIA.exe
  2⤵
  PID:8320
- C:\Windows\System\tqFcKkR.exe
  C:\Windows\System\tqFcKkR.exe
  2⤵
  PID:8336
- C:\Windows\System\WWYXPpj.exe
  C:\Windows\System\WWYXPpj.exe
  2⤵
  PID:8352
- C:\Windows\System\SGenNwa.exe
  C:\Windows\System\SGenNwa.exe
  2⤵
  PID:8368
- C:\Windows\System\bZiEXxp.exe
  C:\Windows\System\bZiEXxp.exe
  2⤵
  PID:8384
- C:\Windows\System\yriphzK.exe
  C:\Windows\System\yriphzK.exe
  2⤵
  PID:8400
- C:\Windows\System\cSBgaqO.exe
  C:\Windows\System\cSBgaqO.exe
  2⤵
  PID:8416
- C:\Windows\System\UUnEDWd.exe
  C:\Windows\System\UUnEDWd.exe
  2⤵
  PID:8432
- C:\Windows\System\MweGDYz.exe
  C:\Windows\System\MweGDYz.exe
  2⤵
  PID:8448
- C:\Windows\System\NTxoCWN.exe
  C:\Windows\System\NTxoCWN.exe
  2⤵
  PID:8464
- C:\Windows\System\ZkgWmaC.exe
  C:\Windows\System\ZkgWmaC.exe
  2⤵
  PID:8480
- C:\Windows\System\HQaNkkV.exe
  C:\Windows\System\HQaNkkV.exe
  2⤵
  PID:8496
- C:\Windows\System\rYxLahc.exe
  C:\Windows\System\rYxLahc.exe
  2⤵
  PID:8516
- C:\Windows\System\odYhdpi.exe
  C:\Windows\System\odYhdpi.exe
  2⤵
  PID:8532
- C:\Windows\System\TSNKgYf.exe
  C:\Windows\System\TSNKgYf.exe
  2⤵
  PID:8548
- C:\Windows\System\oySgpMZ.exe
  C:\Windows\System\oySgpMZ.exe
  2⤵
  PID:8564
- C:\Windows\System\QHiBITl.exe
  C:\Windows\System\QHiBITl.exe
  2⤵
  PID:8580
- C:\Windows\System\ZOHvRgJ.exe
  C:\Windows\System\ZOHvRgJ.exe
  2⤵
  PID:8596
- C:\Windows\System\rDudppx.exe
  C:\Windows\System\rDudppx.exe
  2⤵
  PID:8612
- C:\Windows\System\aFipdBa.exe
  C:\Windows\System\aFipdBa.exe
  2⤵
  PID:8628
- C:\Windows\System\yLDKNxd.exe
  C:\Windows\System\yLDKNxd.exe
  2⤵
  PID:8644
- C:\Windows\System\oNssHBj.exe
  C:\Windows\System\oNssHBj.exe
  2⤵
  PID:8660
- C:\Windows\System\xjZgMaB.exe
  C:\Windows\System\xjZgMaB.exe
  2⤵
  PID:8676
- C:\Windows\System\cQAOLQt.exe
  C:\Windows\System\cQAOLQt.exe
  2⤵
  PID:8692
- C:\Windows\System\uKIWSvM.exe
  C:\Windows\System\uKIWSvM.exe
  2⤵
  PID:8708
- C:\Windows\System\JIrEgRZ.exe
  C:\Windows\System\JIrEgRZ.exe
  2⤵
  PID:8724
- C:\Windows\System\wpRnKSE.exe
  C:\Windows\System\wpRnKSE.exe
  2⤵
  PID:8740
- C:\Windows\System\cBfAmDn.exe
  C:\Windows\System\cBfAmDn.exe
  2⤵
  PID:8756
- C:\Windows\System\sIFXFKq.exe
  C:\Windows\System\sIFXFKq.exe
  2⤵
  PID:8772
- C:\Windows\System\cnBdowU.exe
  C:\Windows\System\cnBdowU.exe
  2⤵
  PID:8788
- C:\Windows\System\ZbKAmRG.exe
  C:\Windows\System\ZbKAmRG.exe
  2⤵
  PID:8804
- C:\Windows\System\vYOIhwd.exe
  C:\Windows\System\vYOIhwd.exe
  2⤵
  PID:8820
- C:\Windows\System\uSKTTYQ.exe
  C:\Windows\System\uSKTTYQ.exe
  2⤵
  PID:8836
- C:\Windows\System\RmSkRoQ.exe
  C:\Windows\System\RmSkRoQ.exe
  2⤵
  PID:8852
- C:\Windows\System\RYipCyN.exe
  C:\Windows\System\RYipCyN.exe
  2⤵
  PID:8872
- C:\Windows\System\NZsBOiM.exe
  C:\Windows\System\NZsBOiM.exe
  2⤵
  PID:8892
- C:\Windows\System\uXhMnjy.exe
  C:\Windows\System\uXhMnjy.exe
  2⤵
  PID:8908
- C:\Windows\System\FygGYff.exe
  C:\Windows\System\FygGYff.exe
  2⤵
  PID:8928
- C:\Windows\System\ZoMjheD.exe
  C:\Windows\System\ZoMjheD.exe
  2⤵
  PID:8944
- C:\Windows\System\jkrGbAc.exe
  C:\Windows\System\jkrGbAc.exe
  2⤵
  PID:8960
- C:\Windows\System\XRrAJFd.exe
  C:\Windows\System\XRrAJFd.exe
  2⤵
  PID:8976
- C:\Windows\System\CcdScsX.exe
  C:\Windows\System\CcdScsX.exe
  2⤵
  PID:8992
- C:\Windows\System\uODwfoL.exe
  C:\Windows\System\uODwfoL.exe
  2⤵
  PID:9008
- C:\Windows\System\iUrrKFe.exe
  C:\Windows\System\iUrrKFe.exe
  2⤵
  PID:9024
- C:\Windows\System\xNVaQYp.exe
  C:\Windows\System\xNVaQYp.exe
  2⤵
  PID:9040
- C:\Windows\System\nofTclh.exe
  C:\Windows\System\nofTclh.exe
  2⤵
  PID:9056
- C:\Windows\System\QOCbmSp.exe
  C:\Windows\System\QOCbmSp.exe
  2⤵
  PID:9072
- C:\Windows\System\yCRztAp.exe
  C:\Windows\System\yCRztAp.exe
  2⤵
  PID:9088
- C:\Windows\System\yFBTNpy.exe
  C:\Windows\System\yFBTNpy.exe
  2⤵
  PID:9104
- C:\Windows\System\dpaMFBR.exe
  C:\Windows\System\dpaMFBR.exe
  2⤵
  PID:9120
- C:\Windows\System\NLCvbRg.exe
  C:\Windows\System\NLCvbRg.exe
  2⤵
  PID:9136
- C:\Windows\System\pqvivoZ.exe
  C:\Windows\System\pqvivoZ.exe
  2⤵
  PID:9152
- C:\Windows\System\mOJqGwA.exe
  C:\Windows\System\mOJqGwA.exe
  2⤵
  PID:9172
- C:\Windows\System\iyxUVeC.exe
  C:\Windows\System\iyxUVeC.exe
  2⤵
  PID:9188
- C:\Windows\System\XVFTXzh.exe
  C:\Windows\System\XVFTXzh.exe
  2⤵
  PID:9204
- C:\Windows\System\BnwXBIe.exe
  C:\Windows\System\BnwXBIe.exe
  2⤵
  PID:8200
- C:\Windows\System\XKmYODB.exe
  C:\Windows\System\XKmYODB.exe
  2⤵
  PID:8024
- C:\Windows\System\pXUjuJK.exe
  C:\Windows\System\pXUjuJK.exe
  2⤵
  PID:8048
- C:\Windows\System\HDRKRDI.exe
  C:\Windows\System\HDRKRDI.exe
  2⤵
  PID:8232
- C:\Windows\System\gzFExpS.exe
  C:\Windows\System\gzFExpS.exe
  2⤵
  PID:7048
- C:\Windows\System\FtBxBRB.exe
  C:\Windows\System\FtBxBRB.exe
  2⤵
  PID:7504
- C:\Windows\System\bKXsbHR.exe
  C:\Windows\System\bKXsbHR.exe
  2⤵
  PID:8184
- C:\Windows\System\fHkEMJA.exe
  C:\Windows\System\fHkEMJA.exe
  2⤵
  PID:8248
- C:\Windows\System\adMTPAD.exe
  C:\Windows\System\adMTPAD.exe
  2⤵
  PID:8296
- C:\Windows\System\NyxQRqf.exe
  C:\Windows\System\NyxQRqf.exe
  2⤵
  PID:8360
- C:\Windows\System\DQYyODq.exe
  C:\Windows\System\DQYyODq.exe
  2⤵
  PID:8396
- C:\Windows\System\WYiRIOa.exe
  C:\Windows\System\WYiRIOa.exe
  2⤵
  PID:8312
- C:\Windows\System\rXTAyAm.exe
  C:\Windows\System\rXTAyAm.exe
  2⤵
  PID:8344
- C:\Windows\System\LVcHWAl.exe
  C:\Windows\System\LVcHWAl.exe
  2⤵
  PID:8544
- C:\Windows\System\YhItDjA.exe
  C:\Windows\System\YhItDjA.exe
  2⤵
  PID:8380
- C:\Windows\System\TsqrVId.exe
  C:\Windows\System\TsqrVId.exe
  2⤵
  PID:8472
- C:\Windows\System\xxRTamF.exe
  C:\Windows\System\xxRTamF.exe
  2⤵
  PID:8576
- C:\Windows\System\FNqeqbh.exe
  C:\Windows\System\FNqeqbh.exe
  2⤵
  PID:8688
- C:\Windows\System\qDEdeSH.exe
  C:\Windows\System\qDEdeSH.exe
  2⤵
  PID:8604
- C:\Windows\System\PNmhlVP.exe
  C:\Windows\System\PNmhlVP.exe
  2⤵
  PID:8752
- C:\Windows\System\CKgddWP.exe
  C:\Windows\System\CKgddWP.exe
  2⤵
  PID:8816
- C:\Windows\System\XKwaOKq.exe
  C:\Windows\System\XKwaOKq.exe
  2⤵
  PID:8732
- C:\Windows\System\XMltgsZ.exe
  C:\Windows\System\XMltgsZ.exe
  2⤵
  PID:8796
- C:\Windows\System\ITHzxyh.exe
  C:\Windows\System\ITHzxyh.exe
  2⤵
  PID:8848
- C:\Windows\System\pjhJwjH.exe
  C:\Windows\System\pjhJwjH.exe
  2⤵
  PID:8868
- C:\Windows\System\RkYBTCv.exe
  C:\Windows\System\RkYBTCv.exe
  2⤵
  PID:8920
- C:\Windows\System\uipZOsy.exe
  C:\Windows\System\uipZOsy.exe
  2⤵
  PID:8952
- C:\Windows\System\jVnpWQs.exe
  C:\Windows\System\jVnpWQs.exe
  2⤵
  PID:8936
- C:\Windows\System\sEgFstv.exe
  C:\Windows\System\sEgFstv.exe
  2⤵
  PID:8968
- C:\Windows\System\uCOKUKZ.exe
  C:\Windows\System\uCOKUKZ.exe
  2⤵
  PID:9032
- C:\Windows\System\zRPUmoK.exe
  C:\Windows\System\zRPUmoK.exe
  2⤵
  PID:9080
- C:\Windows\System\eEveVjQ.exe
  C:\Windows\System\eEveVjQ.exe
  2⤵
  PID:9144
- C:\Windows\System\ShYsAmm.exe
  C:\Windows\System\ShYsAmm.exe
  2⤵
  PID:9212
- C:\Windows\System\EfYVOdi.exe
  C:\Windows\System\EfYVOdi.exe
  2⤵
  PID:9132
- C:\Windows\System\ryipqqI.exe
  C:\Windows\System\ryipqqI.exe
  2⤵
  PID:9128
- C:\Windows\System\bHeKPlJ.exe
  C:\Windows\System\bHeKPlJ.exe
  2⤵
  PID:9200
- C:\Windows\System\ofoaHQp.exe
  C:\Windows\System\ofoaHQp.exe
  2⤵
  PID:7412
- C:\Windows\System\AEyCcDn.exe
  C:\Windows\System\AEyCcDn.exe
  2⤵
  PID:8088
- C:\Windows\System\RIQlWIF.exe
  C:\Windows\System\RIQlWIF.exe
  2⤵
  PID:7732
- C:\Windows\System\sBKAatF.exe
  C:\Windows\System\sBKAatF.exe
  2⤵
  PID:7600
- C:\Windows\System\FcAShAD.exe
  C:\Windows\System\FcAShAD.exe
  2⤵
  PID:8332
- C:\Windows\System\fQKieBF.exe
  C:\Windows\System\fQKieBF.exe
  2⤵
  PID:8460
- C:\Windows\System\cClkzmq.exe
  C:\Windows\System\cClkzmq.exe
  2⤵
  PID:8524
- C:\Windows\System\PhNWKXF.exe
  C:\Windows\System\PhNWKXF.exe
  2⤵
  PID:8284
- C:\Windows\System\GwoHhXn.exe
  C:\Windows\System\GwoHhXn.exe
  2⤵
  PID:8748
- C:\Windows\System\ViRYenV.exe
  C:\Windows\System\ViRYenV.exe
  2⤵
  PID:8832
- C:\Windows\System\fZhTOhV.exe
  C:\Windows\System\fZhTOhV.exe
  2⤵
  PID:8904
- C:\Windows\System\mfAkCnm.exe
  C:\Windows\System\mfAkCnm.exe
  2⤵
  PID:9052
- C:\Windows\System\xXFcgLc.exe
  C:\Windows\System\xXFcgLc.exe
  2⤵
  PID:9100
- C:\Windows\System\YeacBRq.exe
  C:\Windows\System\YeacBRq.exe
  2⤵
  PID:8668
- C:\Windows\System\WcNTIon.exe
  C:\Windows\System\WcNTIon.exe
  2⤵
  PID:8764
- C:\Windows\System\UMLhrNq.exe
  C:\Windows\System\UMLhrNq.exe
  2⤵
  PID:8328
- C:\Windows\System\XoNOlbu.exe
  C:\Windows\System\XoNOlbu.exe
  2⤵
  PID:8720
- C:\Windows\System\CdzTJYo.exe
  C:\Windows\System\CdzTJYo.exe
  2⤵
  PID:9068
- C:\Windows\System\QyYGaoO.exe
  C:\Windows\System\QyYGaoO.exe
  2⤵
  PID:8844
- C:\Windows\System\YfScCQt.exe
  C:\Windows\System\YfScCQt.exe
  2⤵
  PID:7748
- C:\Windows\System\mvhRIIt.exe
  C:\Windows\System\mvhRIIt.exe
  2⤵
  PID:8264
- C:\Windows\System\EBiOfrk.exe
  C:\Windows\System\EBiOfrk.exe
  2⤵
  PID:8588
- C:\Windows\System\AmMEjjG.exe
  C:\Windows\System\AmMEjjG.exe
  2⤵
  PID:9048
- C:\Windows\System\LtoyLso.exe
  C:\Windows\System\LtoyLso.exe
  2⤵
  PID:8556
- C:\Windows\System\bNbzDsN.exe
  C:\Windows\System\bNbzDsN.exe
  2⤵
  PID:8268
- C:\Windows\System\JEpnOxC.exe
  C:\Windows\System\JEpnOxC.exe
  2⤵
  PID:8800
- C:\Windows\System\hOLNVcg.exe
  C:\Windows\System\hOLNVcg.exe
  2⤵
  PID:8768
- C:\Windows\System\cwqvuaJ.exe
  C:\Windows\System\cwqvuaJ.exe
  2⤵
  PID:8392
- C:\Windows\System\cCfjDJX.exe
  C:\Windows\System\cCfjDJX.exe
  2⤵
  PID:8220
- C:\Windows\System\BVtEnzD.exe
  C:\Windows\System\BVtEnzD.exe
  2⤵
  PID:9168
- C:\Windows\System\qlcFXij.exe
  C:\Windows\System\qlcFXij.exe
  2⤵
  PID:8456
- C:\Windows\System\qOxGiUs.exe
  C:\Windows\System\qOxGiUs.exe
  2⤵
  PID:8512
- C:\Windows\System\OHCdQaG.exe
  C:\Windows\System\OHCdQaG.exe
  2⤵
  PID:8656
- C:\Windows\System\BzxPmxL.exe
  C:\Windows\System\BzxPmxL.exe
  2⤵
  PID:8828
- C:\Windows\System\yieEcHs.exe
  C:\Windows\System\yieEcHs.exe
  2⤵
  PID:8116
- C:\Windows\System\ZpGHgCy.exe
  C:\Windows\System\ZpGHgCy.exe
  2⤵
  PID:9116
- C:\Windows\System\LZjdXxK.exe
  C:\Windows\System\LZjdXxK.exe
  2⤵
  PID:8700
- C:\Windows\System\rWCdXDN.exe
  C:\Windows\System\rWCdXDN.exe
  2⤵
  PID:8508
- C:\Windows\System\LJmcTnk.exe
  C:\Windows\System\LJmcTnk.exe
  2⤵
  PID:8972
- C:\Windows\System\CMJZTij.exe
  C:\Windows\System\CMJZTij.exe
  2⤵
  PID:9232
- C:\Windows\System\jiJyGbd.exe
  C:\Windows\System\jiJyGbd.exe
  2⤵
  PID:9248
- C:\Windows\System\EvJjMoW.exe
  C:\Windows\System\EvJjMoW.exe
  2⤵
  PID:9264
- C:\Windows\System\qBoYuei.exe
  C:\Windows\System\qBoYuei.exe
  2⤵
  PID:9280
- C:\Windows\System\cUyTTgn.exe
  C:\Windows\System\cUyTTgn.exe
  2⤵
  PID:9296
- C:\Windows\System\UmHbULF.exe
  C:\Windows\System\UmHbULF.exe
  2⤵
  PID:9312
- C:\Windows\System\BqvUONd.exe
  C:\Windows\System\BqvUONd.exe
  2⤵
  PID:9328
- C:\Windows\System\yGVOenP.exe
  C:\Windows\System\yGVOenP.exe
  2⤵
  PID:9344
- C:\Windows\System\NHvjRcO.exe
  C:\Windows\System\NHvjRcO.exe
  2⤵
  PID:9360
- C:\Windows\System\yAumTQJ.exe
  C:\Windows\System\yAumTQJ.exe
  2⤵
  PID:9376
- C:\Windows\System\VjBGtct.exe
  C:\Windows\System\VjBGtct.exe
  2⤵
  PID:9392
- C:\Windows\System\WsUfprk.exe
  C:\Windows\System\WsUfprk.exe
  2⤵
  PID:9408
- C:\Windows\System\mPQvpoP.exe
  C:\Windows\System\mPQvpoP.exe
  2⤵
  PID:9424
- C:\Windows\System\oPyWjTB.exe
  C:\Windows\System\oPyWjTB.exe
  2⤵
  PID:9440
- C:\Windows\System\NbxKEYW.exe
  C:\Windows\System\NbxKEYW.exe
  2⤵
  PID:9456
- C:\Windows\System\FFmUCkH.exe
  C:\Windows\System\FFmUCkH.exe
  2⤵
  PID:9472
- C:\Windows\System\zdpHRDp.exe
  C:\Windows\System\zdpHRDp.exe
  2⤵
  PID:9488
- C:\Windows\System\iEezRPe.exe
  C:\Windows\System\iEezRPe.exe
  2⤵
  PID:9504
- C:\Windows\System\MvevcfS.exe
  C:\Windows\System\MvevcfS.exe
  2⤵
  PID:9520
- C:\Windows\System\tyrqjLY.exe
  C:\Windows\System\tyrqjLY.exe
  2⤵
  PID:9536
- C:\Windows\System\VMrDRFI.exe
  C:\Windows\System\VMrDRFI.exe
  2⤵
  PID:9552
- C:\Windows\System\udmCENL.exe
  C:\Windows\System\udmCENL.exe
  2⤵
  PID:9568
- C:\Windows\System\WKZCoTX.exe
  C:\Windows\System\WKZCoTX.exe
  2⤵
  PID:9584
- C:\Windows\System\iUCjWRf.exe
  C:\Windows\System\iUCjWRf.exe
  2⤵
  PID:9604
- C:\Windows\System\GjQrIzA.exe
  C:\Windows\System\GjQrIzA.exe
  2⤵
  PID:9620
- C:\Windows\System\fCSORdi.exe
  C:\Windows\System\fCSORdi.exe
  2⤵
  PID:9636
- C:\Windows\System\pzyezGm.exe
  C:\Windows\System\pzyezGm.exe
  2⤵
  PID:9652
- C:\Windows\System\GGnwtgB.exe
  C:\Windows\System\GGnwtgB.exe
  2⤵
  PID:9668
- C:\Windows\System\VmsrNHi.exe
  C:\Windows\System\VmsrNHi.exe
  2⤵
  PID:9684
- C:\Windows\System\cndkRGV.exe
  C:\Windows\System\cndkRGV.exe
  2⤵
  PID:9700
- C:\Windows\System\DXDSnqJ.exe
  C:\Windows\System\DXDSnqJ.exe
  2⤵
  PID:9716
- C:\Windows\System\ERGAlAY.exe
  C:\Windows\System\ERGAlAY.exe
  2⤵
  PID:9732
- C:\Windows\System\FnEhzbE.exe
  C:\Windows\System\FnEhzbE.exe
  2⤵
  PID:9748
- C:\Windows\System\ujoSJHJ.exe
  C:\Windows\System\ujoSJHJ.exe
  2⤵
  PID:9764
- C:\Windows\System\lNvcMoY.exe
  C:\Windows\System\lNvcMoY.exe
  2⤵
  PID:9784
- C:\Windows\System\xhmTmFW.exe
  C:\Windows\System\xhmTmFW.exe
  2⤵
  PID:9800
- C:\Windows\System\DpsSOJZ.exe
  C:\Windows\System\DpsSOJZ.exe
  2⤵
  PID:9816
- C:\Windows\System\VtCiwmg.exe
  C:\Windows\System\VtCiwmg.exe
  2⤵
  PID:9832
- C:\Windows\System\QUJHGBi.exe
  C:\Windows\System\QUJHGBi.exe
  2⤵
  PID:9848
- C:\Windows\System\QesIwSh.exe
  C:\Windows\System\QesIwSh.exe
  2⤵
  PID:9864
- C:\Windows\System\tTXcEBN.exe
  C:\Windows\System\tTXcEBN.exe
  2⤵
  PID:9880
- C:\Windows\System\xisanBo.exe
  C:\Windows\System\xisanBo.exe
  2⤵
  PID:9896
- C:\Windows\System\FUsRaBn.exe
  C:\Windows\System\FUsRaBn.exe
  2⤵
  PID:9912
- C:\Windows\System\UYnjtmC.exe
  C:\Windows\System\UYnjtmC.exe
  2⤵
  PID:9928
- C:\Windows\System\BjEsmza.exe
  C:\Windows\System\BjEsmza.exe
  2⤵
  PID:9944
- C:\Windows\System\wDXubxl.exe
  C:\Windows\System\wDXubxl.exe
  2⤵
  PID:9960
- C:\Windows\System\XuBOSdd.exe
  C:\Windows\System\XuBOSdd.exe
  2⤵
  PID:9976
- C:\Windows\System\kzwIxCf.exe
  C:\Windows\System\kzwIxCf.exe
  2⤵
  PID:9992
- C:\Windows\System\IDusdai.exe
  C:\Windows\System\IDusdai.exe
  2⤵
  PID:10008
- C:\Windows\System\guoWYcv.exe
  C:\Windows\System\guoWYcv.exe
  2⤵
  PID:10024
- C:\Windows\System\ylfjNbu.exe
  C:\Windows\System\ylfjNbu.exe
  2⤵
  PID:10040
- C:\Windows\System\XYMoqUd.exe
  C:\Windows\System\XYMoqUd.exe
  2⤵
  PID:10056
- C:\Windows\System\veyXEKd.exe
  C:\Windows\System\veyXEKd.exe
  2⤵
  PID:10072
- C:\Windows\System\REtfiGg.exe
  C:\Windows\System\REtfiGg.exe
  2⤵
  PID:10088
- C:\Windows\System\KUoaGCL.exe
  C:\Windows\System\KUoaGCL.exe
  2⤵
  PID:10104
- C:\Windows\System\ATSLnBA.exe
  C:\Windows\System\ATSLnBA.exe
  2⤵
  PID:10120
- C:\Windows\System\wOJUxHn.exe
  C:\Windows\System\wOJUxHn.exe
  2⤵
  PID:10136
- C:\Windows\System\HRYImqI.exe
  C:\Windows\System\HRYImqI.exe
  2⤵
  PID:10152
- C:\Windows\System\UEhAbKO.exe
  C:\Windows\System\UEhAbKO.exe
  2⤵
  PID:10168
- C:\Windows\System\QiWhJed.exe
  C:\Windows\System\QiWhJed.exe
  2⤵
  PID:10184
- C:\Windows\System\hRmvTsB.exe
  C:\Windows\System\hRmvTsB.exe
  2⤵
  PID:10200
- C:\Windows\System\BjVXenv.exe
  C:\Windows\System\BjVXenv.exe
  2⤵
  PID:10216
- C:\Windows\System\BXvUbvm.exe
  C:\Windows\System\BXvUbvm.exe
  2⤵
  PID:10232
- C:\Windows\System\EaPrGBy.exe
  C:\Windows\System\EaPrGBy.exe
  2⤵
  PID:9272
- C:\Windows\System\idgSzNn.exe
  C:\Windows\System\idgSzNn.exe
  2⤵
  PID:9308
- C:\Windows\System\feQzLse.exe
  C:\Windows\System\feQzLse.exe
  2⤵
  PID:9372
- C:\Windows\System\zBVfuWj.exe
  C:\Windows\System\zBVfuWj.exe
  2⤵
  PID:9432
- C:\Windows\System\jewYzQR.exe
  C:\Windows\System\jewYzQR.exe
  2⤵
  PID:9496
- C:\Windows\System\jwpWmQr.exe
  C:\Windows\System\jwpWmQr.exe
  2⤵
  PID:9528
- C:\Windows\System\YdvcONZ.exe
  C:\Windows\System\YdvcONZ.exe
  2⤵
  PID:9324
- C:\Windows\System\qhsXdWg.exe
  C:\Windows\System\qhsXdWg.exe
  2⤵
  PID:8684
- C:\Windows\System\KQhbRBq.exe
  C:\Windows\System\KQhbRBq.exe
  2⤵
  PID:9292
- C:\Windows\System\WPGXPNL.exe
  C:\Windows\System\WPGXPNL.exe
  2⤵
  PID:9416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ADzxRQC.exe

Filesize
1.7MB

MD5
da3f2aaef91711fbf22907e65925579a

SHA1
05b73d24afe0597304994057eb5788f291e3edb3

SHA256
84abc7a3fd577bb2cb4aa3edb0b67bd71e04eb7effc1afc3e476d30bf0f0a74e

SHA512
af97ca5f425ce45baf65abdbf7f29a6b2589b501515d891d2d68309ed4984b6f8a12a88f00e2b0e121f0c47832bff128269e3d3a91dde05802e50358102a270c

Download Submit
C:\Windows\system\AQdzoHL.exe

Filesize
1.7MB

MD5
c10cf6331335598286286c37e856a2d6

SHA1
5dff1145fd8018260b26c1c2f53e2a6de895efdf

SHA256
9260779fcf79e042fc4c34d5f6803adc74a0f0158985fea8a89549b8680bd83b

SHA512
2dcc31453301d67a134fc9dae1654626af39277a8a42c2e87cf5ae492a6a854688598a135ebc02836470959e1449be85b94f7de0df4221f6f5308f822585d6f8

Download Submit
C:\Windows\system\CeGeAPA.exe

Filesize
1.7MB

MD5
26168589fa2afe4ee67f627d111f9591

SHA1
ea429695928f987af709ef94ffe2bbb348defcd4

SHA256
324bc73ef469c04f1b2b23591cb943fc29c49ed7658ad7d56ae43d10c3c8b83e

SHA512
7579b41c1c4edbc156d580cc878c02104ea3cd79d24e8eb08011d411d2618d62f6f82be8a1b9647194a4de539ae0d6dadb122f512bc0c8b4cacd2b97c992272a

Download Submit
C:\Windows\system\GhlVrCu.exe

Filesize
1.7MB

MD5
38dfe74c4129fb0109a87fdd03eae67a

SHA1
1f1cb82783342e7c30fcf5650deb0fa01ec583f3

SHA256
7b12aebc064922df93f785cb3ae0522d9216784173b043886fcebfb921b2cabb

SHA512
a04c17ca6a174fa0fb73f64765d2a436518d41d718c89d1fb7e430c819af184236ea872ffd9ffb26662dcc979d5d660dcdd828d7efee5b3b997b58812def1f95

Download Submit
C:\Windows\system\ITwCsMR.exe

Filesize
1.7MB

MD5
198a14812775fe9b27c599245efe55d7

SHA1
4f278c7cba6679e1acb133dbcdb30487b46ceac2

SHA256
fee31f33086deb7b52962c2ea7f4768a23d406b7b0386ff5e23d2e195fe1aa84

SHA512
0af6b1657e95ee7d9c0517543b1ac86ba0e12d73a94023f9da9a4ca650e050f74e04a76e071af1e04c9ebbe08e692d6a1bbb6d9179141cba36ae1f64a7152cc6

Download Submit
C:\Windows\system\KqgBHGT.exe

Filesize
1.7MB

MD5
c525306ba5aa5a29f10a86ed48a50c4f

SHA1
839aeea43105f36a7974e7b0bfaa349f1c92ff1c

SHA256
0369154ec7996759a8bfe07498df1dcaea9459959b27e8c195132d6232df3480

SHA512
d321df33b765cb504955a880199584643fdfa349466aca847c9fc67ebd7c8a05e2971973364e32f0e574deebc16366fb4d8f9a9be6fd182e33c2af1c0ea012e7

Download Submit
C:\Windows\system\LApDaoA.exe

Filesize
1.7MB

MD5
b908b16a7844bbf6df5071a28db35873

SHA1
3f149c51fc78540029b8ed44fdedc2e16382142f

SHA256
0ac6f7faacb63c6bea796819da4a143ce7db2705bf13b0450bb65859451094bd

SHA512
7ac7ecc519e07c2b5e94f3671951b793d5fed9770bdcffa6de8532b27695f1cbe40f6002b1ad0116a1c73577db8ee5e9c8f01267cc2c4c1e5cef376592463261

Download Submit
C:\Windows\system\MqDzVcg.exe

Filesize
1.7MB

MD5
f376d44f1547a3728f069ad148ce3ee1

SHA1
466ac650f079374f76cbba35b32e58d0010b9e2c

SHA256
25712ae338a1c0c11725ceee7459d606437f068f7598c1ddd264a5cf53f7e6dc

SHA512
141132387ebdbdf1cf4b7005d225f1f24912d8f94069bfb9db2a554328a56482813090cc3d32839204f77bf2a00de93dc8380aa607d46f1ee01d03b2349ed3ef

Download Submit
C:\Windows\system\OVGoSjp.exe

Filesize
1.7MB

MD5
0475bc053b6369f4515cbe05ba8733c2

SHA1
2b38be13ce36da6980d0ccd8d16b14e6dc83a50f

SHA256
60e8398d6e622e958eeca77a2a0804b189c4ad7734747ef570cab9ce43c8fda7

SHA512
47bf8738b8d1d895fff345552176146a3e6b67dd906d1f6787771a365d0c9b4f09015612a6c89fb566621833c45551bd309c6ea28b372c1e1a79343bd82de697

Download Submit
C:\Windows\system\Psopdjr.exe

Filesize
1.7MB

MD5
4d3ab101b2b48e4ad30d327b7e5ec8d6

SHA1
76ea7a9cfcd7a412af2d8eda5225885afce42688

SHA256
a48c9329e185cf911ff58f2d610d5498eaf5d12a5f16bb1d0a8346e1d6870c64

SHA512
888411264d24fbf02d140c540d2dc0b3d8039d07303fd619904341b412791620db00d0a013c86dbf05c9295f44874281521dad2b60f113214469df762c1991f6

Download Submit
C:\Windows\system\QNHYJsh.exe

Filesize
1.7MB

MD5
f7d23004542af45e0204b63500d06dd5

SHA1
b450add279597a749911b1a48737858ff262f15d

SHA256
053c5bb2083358ea3fa7c08a203c6081d13c9b128318bcf732a02c41481da2db

SHA512
76a0f037410ba00d8dd498f7a01e47d89df8c476f04e29423dd0ef4e8f23e1fc804d36e014cde238c8ad21e86691dc05f5993dacff573690271a16aab8cf8185

Download Submit
C:\Windows\system\QXmjOmq.exe

Filesize
1.7MB

MD5
afe0d77a66feacd399a435d9c8c3aaa7

SHA1
573c2833f41da27ecc97da6c2b571ed2c5e0cdc9

SHA256
e57a1493ef830f343e3982ee92a4c70aba86bac7bc48b4646ddc7d7ea802ef72

SHA512
37ebb9084db6a5a941f23a1dc929b776305a96983eef1ffd0074ec85a6d73aeeffdfac0aa7c03664ba678fc01dfd5ab21eed4516759ea95d022f2b7b7468273b

Download Submit
C:\Windows\system\XSCycMg.exe

Filesize
1.7MB

MD5
ed85be695418c56ac6c23ba308b57896

SHA1
9ecef0df17349d3bba3b7ea9999ef97d9c220e3b

SHA256
698ad1b43e11426f78d04af4f24dcb6f569c2b44d2b04015061924c47b33dcc0

SHA512
f865d297e13d38ae37bb39905781a4327f5a2a88b368b9c57f18aa40887a0661d69370eb68003f106af9eba38775ff0e0bfd6ab1fcfe250a0bf3ff6bada2d7dd

Download Submit
C:\Windows\system\eiaPmTQ.exe

Filesize
1.7MB

MD5
f17137af9ef43d629df00d505c7b4a46

SHA1
13e806589f5fb4cbd8d3d0a95a204be433ae3d18

SHA256
510d2cfa4ca0a29ef29169965641087ca9e720e4c7b97bd2d392ed73b2d9a79e

SHA512
685c3e1b60a2a65818c85efc8a309f448c817f2d104699c0dead385a62ccad0776b8b0bf9642649628ae3cce8b2f9e64e816d9e1acb33e097d3835a121f4e714

Download Submit
C:\Windows\system\hJIZKXC.exe

Filesize
1.7MB

MD5
d9381efe21370a6747c7e1f587619bd0

SHA1
907d8a361d25dbcd0bb17036ed898945ff7456e8

SHA256
e57a2b0c4b86a22010cb6b96972b97e1579eacea8c9bfb8bbb58154a6855294f

SHA512
53549359858e9956211b35bcdd2167552027acedfd9731fa66e8079b47006fc8674d9ce84022f5b2e8e0dbb1be26773bfe99f4480e3e4923f5929e19e8b81c2e

Download Submit
C:\Windows\system\kngurEQ.exe

Filesize
1.7MB

MD5
c126d330fc6102537311e0fdaab298a6

SHA1
f46d3492adc769a8325b02380451b636a8b7d8e2

SHA256
23bc065b7d2b01dac6a5ec03bdf74d3c1aac10a0ac49a25e3a6abf6cc87384f7

SHA512
610a223798b067ca4d1e22eea22d011db59647c7ca8ced4afa0e3f30eeb23fe8fb9ce3708354a6362218e2eb671eb72b603517016e7116dd545ec5f6e4c9379e

Download Submit
C:\Windows\system\nUlFpxh.exe

Filesize
1.7MB

MD5
72e7a1b04be3be8de0f2811e3600655c

SHA1
a6f0da03937660511606045b4ccc710b002edd58

SHA256
3f8746912a2312d5b93d660f86c97115367d00c0219868851e1a89d7ecba8aff

SHA512
474cc38370b772560d272895c2c043d2bdbfcb5367e63e1865ea79e21958f0c67712b76277b40ec1d98b70a9dedf632e641032c0d3b7c323a025019516aa13e6

Download Submit
C:\Windows\system\nsIqtZV.exe

Filesize
1.7MB

MD5
84cb7e5d239b03ac1b5339925204d318

SHA1
6be37515e0a3e3864f015983d6707e97659ef66f

SHA256
001dc7ad833021f172a1f20bfa2714ba23f1389e86b00a7a786be9e550899ed8

SHA512
bf7871a05d5247dd27ec992e51df5de0acb37ea3b0524a2a9eb18c5936fca9b871f5aa645f85e6078d35c37cc75705e5be00cc165925c0070d0fdb5df5dd1eb3

Download Submit
C:\Windows\system\oMTNFrK.exe

Filesize
1.7MB

MD5
f6ca27ca77fe2bcad8549aba81e5c706

SHA1
19119c0a74b487dda8f4c9e203e0f63c7bb0ca91

SHA256
7000ecc37e8c34835faa5d2ce618e7e18e6e79fb121f7544919526260d8c87d3

SHA512
ab4512874b5cc8f93db7ef8757fac162fd4e914a5bad2fceaac29dee62ad159de08aac647d17c480b26904bb17cecc4dfbeb79cbdf2cae5e8b6b3fc5a3fa41be

Download Submit
C:\Windows\system\vsBNGfc.exe

Filesize
1.7MB

MD5
b2df78caddd7c37c489d548135f12a6c

SHA1
adc95492eb25ac245bb9aa7a2382c97afc6ed71c

SHA256
c99391634f71008caebcfcb234525b83c44863a437931401fd2906616d0a9033

SHA512
41d07743e37e3fb09e0c0d671ed3b96e8fcd4c7026c18ea2a4326b3146e4a5f423e5723b3932beb46e02b8b4df170a30038327cc56f0064120bdc0249efaed8f

Download Submit
\Windows\system\AMewnqP.exe

Filesize
1.7MB

MD5
43f061fcbc86628098d74946e1a96285

SHA1
d0bfbe063c9a1144b0f74593c53e998bad4a9a22

SHA256
91de14dcd0153f0c18c597e20f79b2203a8d80aa91617302b9386a926efb3d7e

SHA512
3eab441bb21f31cb5261d59a5acabfa688dfe4a1c071f5beb0a82e8ebcd76fcf94961f6376ff00efb9829570423a545a7aa271a01c9ee0eac5b0e5f5e236785f

Download Submit
\Windows\system\MNRIXaV.exe

Filesize
1.7MB

MD5
4defb3f7f5de3262bb78fcd2a5927b8c

SHA1
f0df8fb0be330115ec41b335cd0a8c24db72eed3

SHA256
50b9603b782b18cdfee45d7474f8877f8916208f4f1b39e42e5bc59414967ced

SHA512
5ca9453c82beb233198ee3bbc0ad73cac917aaa151b2740fa6f8d5c2c142808ad312af5cdb1880f3fa4dcf6dea8fb1cf67bbd667ba80091b178b14efdadefa02

Download Submit
\Windows\system\ORgZdFF.exe

Filesize
1.7MB

MD5
abc454cee8bbfffb48c128b572e16a9c

SHA1
36d889dc5441928d8b95ac98867b83f400fefd1c

SHA256
3a2f9074ae1776c0b85143623542d7627b56fa7dae8f1f936d9d397434995cd8

SHA512
6240bb2e70b843b0d85e1137127a82f3cce191737af7bc5521e260f1b823330573254272574a1a3a283bc198d6f48e0f1004d4745f719e9afdfab4823983d040

Download Submit
\Windows\system\VudhugE.exe

Filesize
1.7MB

MD5
6649f3c9154273d789f1103fe0881240

SHA1
2106b55d5a6409e3cf1273916a8c7130e258eb4d

SHA256
b78e5ba974e7ce7182fa88880292c89bc4d86580a5a33b73f09fa5003c8d8648

SHA512
c3d6ec28dde5d79eed1dc0c82b96c8170aeee97231277f17fb6ee5d4b5e7ae7beacbb53b2635334963cddf3c8e876ff4170850343de47dd28778b969b3482638

Download Submit
\Windows\system\YRATVQg.exe

Filesize
1.7MB

MD5
e1846b06ab0c8eb02648eecddf175aed

SHA1
18a6a157e42e37332ec899672f0a64722fe783d7

SHA256
bb56853bd383a958759e2cfd96a5489b8d808bde47d21321c1d6a7c33f5233f2

SHA512
61e0f9b8a2a90e1e7fbf37cb815d258a48639846de3cd17fb1a1fc4f8b34aa8d4ff441b43a9f9db75fc083c8d9d14e631d80ac5c8079520821486ed8ad770b78

Download Submit
\Windows\system\ZZVmVtr.exe

Filesize
1.7MB

MD5
70584b601acd4cf01dc39e8131a73269

SHA1
9896596774e555c9a17a338aae1d193703b22f05

SHA256
7d8c2b985433dcb36a0d0e70e87cb56ad4a9d0f15d1cdfd47589338228c401f3

SHA512
adecbd5fa20e76f3102799489c6b3c98799d8c0361d22397b0cb110e7c1930e065f08c9ddf461fd14373b993e9d34d2a7d11a9ad46760068bfd830070c33d6a3

Download Submit
\Windows\system\cBvNeLW.exe

Filesize
1.7MB

MD5
4034ed4af202542a5a376f83243438e0

SHA1
c855c86956dd2ad3af6418a8a318c08477adaae1

SHA256
a128c675c5bf6764f25998de4f0a982547ac01b365b0db5231d64c15e7eb2573

SHA512
5ec940e386cb58088f2dc61e4c1fb989f6ecd02059d209d2fa10d386bfb6ec58fec915ce35d1ac7ff70daaaa9d3c84fa4e119c592b80db2f7806f306cf005f30

Download Submit
\Windows\system\dMFbsQp.exe

Filesize
1.7MB

MD5
662c8a95164502c5ca21d578825ed5f6

SHA1
efea7ba40b6a3e0cdca68f02293847027df6d4a8

SHA256
f6e8a639e8707765b777776c7b1e0263bc682be6ab1a4e4c6bd78f23281ce324

SHA512
591bdd540aeef171dbbb8edca8864ab7bfeec4a1562ece38fb8945cf9783426a321a688d2651f4d24c4f37d342abaa24c1657799219e66f164d923eadae5aeb6

Download Submit
\Windows\system\oNAyNBI.exe

Filesize
1.7MB

MD5
d88aefae493675d27da589a0e7c7eacd

SHA1
78c90ef030cddbd7babb5e783484592eed3c7dc8

SHA256
4eacddf9f7d6e077b716bf98baa867675525b98a4fbd9e5c77fbc5f2cd95fa1a

SHA512
86fcee6f651dcdd1e2fb09d9b5122d065df316680d84e83e52cff33382e3c14ef813b5dfe0ea712b69815e2cd284d328b0c959a18db433242d99ad49d1ba0a4f

Download Submit
\Windows\system\pPKdmAE.exe

Filesize
1.7MB

MD5
633b0d846549f87ffe750508979a5d6f

SHA1
ab264f0ceff7979bcc18d0ca262989770f1f44d3

SHA256
e56925eda377476924bf3c82f34dc373e4469d33677257177c7fe9fee26353cc

SHA512
b97f77860a6fd22b63bc11ddf107248c9440a3ecf129133f75c0415103c9eb0f7afbe1a937223aa2c1b69ccffc3740c91f6a79340cd4a359c9e553f4196a6e44

Download Submit
\Windows\system\qAyHTYh.exe

Filesize
1.7MB

MD5
08092bc31c56dfb8f1dcf35bc7c43b04

SHA1
54fb248ab15475fffdf1e9a0ed278c5e1ecc14a3

SHA256
4292a0bae283139ebd08526e212d8324ca8798b752198fa03ea8e4ae078c1711

SHA512
a104595dc4a92aacb9ef925abfe3a2e75968486f906296348746672e5237ca4bf896ba55ed3f563c4149f199b5dea87d6e8de855431bf3c4129502657086df97

Download Submit
\Windows\system\vkWImzG.exe

Filesize
1.7MB

MD5
1093b5352098ce855c0942e8e6898b7b

SHA1
eb6b2e7020e09b38b801d5d9654c37ec94e3ec05

SHA256
ea470961cf736a58f1005f8700d7d825a87a2082a944c8317284bc1d130d5175

SHA512
8634fb5105d81b668cf7455704bca189cb9ff570236f26be7204b231134adf703d93f867c5afea1f61850b97f4c51f9d43ad429866de051cc8290a48c0cd8780

Download Submit
\Windows\system\wfViYBz.exe

Filesize
1.7MB

MD5
56e5baf5109dc95d67c2fdbefd52344d

SHA1
58fbf8c6c53a69ac96d108313c79bc27827ef8eb

SHA256
5b7057f1639fc789f7d1de31cc5fdc0b736e113dce8c970576662fbe441518ad

SHA512
d60fa4466c7399e19a2708f7f24979d02553c1172dc46b0c7eb57371296c2edcca0d9780adbff5d4f2b066ede3016bdf022efa96f77224a6d52a3faddd4c3ba0

Download Submit
memory/880-60-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/880-1-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/880-10667-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/880-74-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/880-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/880-116-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/880-55-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/880-79-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/880-48-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/880-106-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/880-50-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/880-8-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/880-111-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/880-20-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/880-61-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-59-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/1992-19-0x0000000002E60000-0x0000000002EE0000-memory.dmp

Filesize
512KB

Download
memory/1992-161-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/1992-43-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/1992-21-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

Filesize
4KB

Download
memory/1992-46-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/1992-25-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/1992-27-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2108-4782-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-110-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-105-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2488-4768-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2508-4777-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2508-67-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2512-4710-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-62-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-57-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2620-4709-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2636-75-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2680-4695-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2680-45-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2708-49-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-4704-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-47-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2740-4707-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2764-51-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4698-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2884-17-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2884-4696-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download