xmrig | 5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f

Analysis

max time kernel
130s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01/07/2024, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
Size

1.8MB
MD5

065a2790861f0e0fea50607f46825830
SHA1

b81b83b3bf69196ec585451ef552daa108bd1107
SHA256

5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f
SHA512

039ef55c08bcac6450b05868823fb8d3b29c85b962aa0c94e4f1805d4d4bf192e820d0dbb28638592a2f52732f8c92ed9e76d1e89d64a0b0fad436436f424a0f
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlNIZbElhzBXeCnfJCwCc4MAKFpMloooIXruZ:Lz071uv4BPMkFfdgIZohteLMxRguK2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 24 IoCs

miner

resource	yara_rule
behavioral1/memory/2764-26-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2740-25-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2196-24-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2580-18-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2612-41-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2196-97-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/1536-93-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/1552-92-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2696-79-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2848-77-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2988-65-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/3020-60-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2208-48-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/296-4080-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2580-4620-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2848-4624-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/1552-4627-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/1536-4626-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2740-4625-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2696-4623-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2208-4622-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2764-4631-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2988-4621-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2612-4691-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2172	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2580	wDfNeAw.exe
2740	ezhsKNv.exe
2764	FZfWFiE.exe
2612	wmCzsTT.exe
2208	XhIvDsy.exe
3020	ZZDNyLl.exe
2988	CYiKpSr.exe
2848	FVskVWR.exe
2696	lGoaLgg.exe
1552	yDZGEDe.exe
1536	LGaYiKl.exe
296	SIucdPk.exe
756	Wtuembp.exe
2968	uIXttGN.exe
1512	nXxYbEC.exe
1060	RFqNBMx.exe
1448	miywffr.exe
844	WeopNnE.exe
2012	GMHQLWd.exe
2088	SQRdbPH.exe
2028	exlnzOD.exe
2272	fetaAsX.exe
2256	LwLBfko.exe
2284	AcJaSot.exe
664	uPzreTO.exe
440	cyBTfyJ.exe
288	ZzDHPxV.exe
1392	ebbZQON.exe
556	NbtqwNY.exe
352	sTxYdKc.exe
644	fcshmOv.exe
2336	vxAmFYT.exe
692	INCmKem.exe
2444	tlyipRH.exe
1312	vStdouF.exe
1196	xGYCgLb.exe
1008	MBRUUXG.exe
1212	slPuLxp.exe
1136	vUFRvPj.exe
2416	nCXrDff.exe
2184	kvoJmvo.exe
1964	fVdDnpF.exe
1672	cynqgFH.exe
2004	zBofHQS.exe
1940	vKtPrAz.exe
984	sJofCVd.exe
2384	YFjksuk.exe
1868	wmdbeQF.exe
2164	EzeeEaM.exe
2092	vrKOaFb.exe
1496	xJivsfv.exe
1520	GgNeBRL.exe
2584	vgYaZeW.exe
2592	xwCJqDB.exe
3008	OxnLPoP.exe
2644	XISRelI.exe
2492	pQrpjJB.exe
1928	fJMwuEL.exe
2624	TDOOSPw.exe
2652	nnUdRgc.exe
2964	rJmcpRu.exe
2716	YNrXoES.exe
1720	aITHQNL.exe
1432	nwYHOhq.exe

Loads dropped DLL 64 IoCs

pid	Process
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2196-1-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-3.dat	upx
behavioral1/files/0x0037000000015bc7-8.dat	upx
behavioral1/files/0x0008000000015cbf-12.dat	upx
behavioral1/memory/2764-26-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2740-25-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2580-18-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x0007000000015ce2-31.dat	upx
behavioral1/memory/2612-41-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/files/0x000f000000003683-42.dat	upx
behavioral1/files/0x0037000000015c82-56.dat	upx
behavioral1/files/0x0006000000016c4a-87.dat	upx
behavioral1/memory/2196-97-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x0006000000016c67-105.dat	upx
behavioral1/files/0x0006000000016d22-125.dat	upx
behavioral1/files/0x0006000000016d68-153.dat	upx
behavioral1/files/0x0006000000016dc8-177.dat	upx
behavioral1/files/0x0006000000016db2-173.dat	upx
behavioral1/files/0x0006000000016da0-169.dat	upx
behavioral1/files/0x0006000000016d78-165.dat	upx
behavioral1/files/0x0006000000016d70-161.dat	upx
behavioral1/files/0x0006000000016d6c-157.dat	upx
behavioral1/files/0x0006000000016d55-149.dat	upx
behavioral1/files/0x0006000000016d4c-145.dat	upx
behavioral1/files/0x0006000000016d44-141.dat	upx
behavioral1/files/0x0006000000016d3b-137.dat	upx
behavioral1/files/0x0006000000016d33-133.dat	upx
behavioral1/files/0x0006000000016d2b-129.dat	upx
behavioral1/files/0x0006000000016d1a-121.dat	upx
behavioral1/files/0x0006000000016d05-117.dat	upx
behavioral1/files/0x0006000000016cde-113.dat	upx
behavioral1/files/0x0006000000016caf-109.dat	upx
behavioral1/files/0x0006000000016c5d-101.dat	upx
behavioral1/memory/296-98-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/1536-93-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/1552-92-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2696-79-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2848-77-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0006000000016824-73.dat	upx
behavioral1/memory/2988-65-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0008000000015d09-61.dat	upx
behavioral1/files/0x0006000000016a7d-83.dat	upx
behavioral1/files/0x00070000000165d4-69.dat	upx
behavioral1/memory/3020-60-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2208-48-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0008000000015cf3-51.dat	upx
behavioral1/memory/296-4080-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2580-4620-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/memory/2848-4624-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/1552-4627-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/1536-4626-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2740-4625-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2696-4623-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2208-4622-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2764-4631-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2988-4621-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/memory/2612-4691-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IHeDZqe.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\rJiyjON.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\OlneRhW.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\NzsUOvJ.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\vfhTZua.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\rYeduNM.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\KlxWjSP.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\tzNxjnE.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\weFsnYR.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\DXWUwdQ.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\CrCqbiV.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\pHVHSvI.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\JafaCWM.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\xRnXWrm.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\DMqmJen.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\nWcqYMP.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\cOFUavS.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\gJqZsVx.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\gbgoQaR.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\YnpMfIn.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\pqNAshb.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\GgNeBRL.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\FrWmXWP.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\zSCVfkv.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\WbdjVdR.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\DjqswCE.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\hnnaBhg.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\jbHwFyi.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\JGcZPzv.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\CSCsjld.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\ToHsRBa.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\qiIccZA.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\QYcpOqF.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\jeeJFUM.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\JrSjqng.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\IlXbxqk.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\meNOuno.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\YJcJVbN.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\YRNvTDh.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\JPNqTXg.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\HWDwQiz.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\NOBuEZT.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\GMQCaxo.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\LFALfav.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\SnWEWKx.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\yKZXVgM.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\ZjrSysM.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\VTsaMwD.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\lFezhzA.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\yjuXGqE.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\iCyiICy.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\eFfeAjp.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\uRSNVey.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\QjelXTJ.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\MluGcmX.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\pVHTyPz.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\VYfHIpX.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\Tyivmtd.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\YUxRZkQ.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\avqfBGh.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\xIhQZUu.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\SUucbzf.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\VgHxCEq.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
File created	C:\Windows\System\UTthTgZ.exe	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2172	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2172	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2172	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	29
PID 2196 wrote to memory of 2580	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2580	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2580	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	30
PID 2196 wrote to memory of 2764	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2764	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2764	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	31
PID 2196 wrote to memory of 2740	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	32
PID 2196 wrote to memory of 2740	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	32
PID 2196 wrote to memory of 2740	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	32
PID 2196 wrote to memory of 2612	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	33
PID 2196 wrote to memory of 2612	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	33
PID 2196 wrote to memory of 2612	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	33
PID 2196 wrote to memory of 2208	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	34
PID 2196 wrote to memory of 2208	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	34
PID 2196 wrote to memory of 2208	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	34
PID 2196 wrote to memory of 3020	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	35
PID 2196 wrote to memory of 3020	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	35
PID 2196 wrote to memory of 3020	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	35
PID 2196 wrote to memory of 2988	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	36
PID 2196 wrote to memory of 2988	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	36
PID 2196 wrote to memory of 2988	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	36
PID 2196 wrote to memory of 2696	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	37
PID 2196 wrote to memory of 2696	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	37
PID 2196 wrote to memory of 2696	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	37
PID 2196 wrote to memory of 2848	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	38
PID 2196 wrote to memory of 2848	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	38
PID 2196 wrote to memory of 2848	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	38
PID 2196 wrote to memory of 1536	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	39
PID 2196 wrote to memory of 1536	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	39
PID 2196 wrote to memory of 1536	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	39
PID 2196 wrote to memory of 1552	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	40
PID 2196 wrote to memory of 1552	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	40
PID 2196 wrote to memory of 1552	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	40
PID 2196 wrote to memory of 296	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	41
PID 2196 wrote to memory of 296	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	41
PID 2196 wrote to memory of 296	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	41
PID 2196 wrote to memory of 756	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	42
PID 2196 wrote to memory of 756	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	42
PID 2196 wrote to memory of 756	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	42
PID 2196 wrote to memory of 2968	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	43
PID 2196 wrote to memory of 2968	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	43
PID 2196 wrote to memory of 2968	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	43
PID 2196 wrote to memory of 1512	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	44
PID 2196 wrote to memory of 1512	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	44
PID 2196 wrote to memory of 1512	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	44
PID 2196 wrote to memory of 1060	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	45
PID 2196 wrote to memory of 1060	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	45
PID 2196 wrote to memory of 1060	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	45
PID 2196 wrote to memory of 1448	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	46
PID 2196 wrote to memory of 1448	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	46
PID 2196 wrote to memory of 1448	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	46
PID 2196 wrote to memory of 844	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	47
PID 2196 wrote to memory of 844	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	47
PID 2196 wrote to memory of 844	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	47
PID 2196 wrote to memory of 2012	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	48
PID 2196 wrote to memory of 2012	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	48
PID 2196 wrote to memory of 2012	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	48
PID 2196 wrote to memory of 2088	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	49
PID 2196 wrote to memory of 2088	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	49
PID 2196 wrote to memory of 2088	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	49
PID 2196 wrote to memory of 2028	2196	5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5724eb138a0c6e3b6efcc4f973e3609b7876a92a022a990683036ba22538285f_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System\wDfNeAw.exe
  C:\Windows\System\wDfNeAw.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\FZfWFiE.exe
  C:\Windows\System\FZfWFiE.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\ezhsKNv.exe
  C:\Windows\System\ezhsKNv.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\wmCzsTT.exe
  C:\Windows\System\wmCzsTT.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\XhIvDsy.exe
  C:\Windows\System\XhIvDsy.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\ZZDNyLl.exe
  C:\Windows\System\ZZDNyLl.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\CYiKpSr.exe
  C:\Windows\System\CYiKpSr.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\lGoaLgg.exe
  C:\Windows\System\lGoaLgg.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\FVskVWR.exe
  C:\Windows\System\FVskVWR.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\LGaYiKl.exe
  C:\Windows\System\LGaYiKl.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\yDZGEDe.exe
  C:\Windows\System\yDZGEDe.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\SIucdPk.exe
  C:\Windows\System\SIucdPk.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\Wtuembp.exe
  C:\Windows\System\Wtuembp.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\uIXttGN.exe
  C:\Windows\System\uIXttGN.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\nXxYbEC.exe
  C:\Windows\System\nXxYbEC.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\RFqNBMx.exe
  C:\Windows\System\RFqNBMx.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\miywffr.exe
  C:\Windows\System\miywffr.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\WeopNnE.exe
  C:\Windows\System\WeopNnE.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\GMHQLWd.exe
  C:\Windows\System\GMHQLWd.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\SQRdbPH.exe
  C:\Windows\System\SQRdbPH.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\exlnzOD.exe
  C:\Windows\System\exlnzOD.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\fetaAsX.exe
  C:\Windows\System\fetaAsX.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\LwLBfko.exe
  C:\Windows\System\LwLBfko.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\AcJaSot.exe
  C:\Windows\System\AcJaSot.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\uPzreTO.exe
  C:\Windows\System\uPzreTO.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\cyBTfyJ.exe
  C:\Windows\System\cyBTfyJ.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\ZzDHPxV.exe
  C:\Windows\System\ZzDHPxV.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\ebbZQON.exe
  C:\Windows\System\ebbZQON.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\NbtqwNY.exe
  C:\Windows\System\NbtqwNY.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\sTxYdKc.exe
  C:\Windows\System\sTxYdKc.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\fcshmOv.exe
  C:\Windows\System\fcshmOv.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\vxAmFYT.exe
  C:\Windows\System\vxAmFYT.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\INCmKem.exe
  C:\Windows\System\INCmKem.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\tlyipRH.exe
  C:\Windows\System\tlyipRH.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\vStdouF.exe
  C:\Windows\System\vStdouF.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\xGYCgLb.exe
  C:\Windows\System\xGYCgLb.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\MBRUUXG.exe
  C:\Windows\System\MBRUUXG.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\slPuLxp.exe
  C:\Windows\System\slPuLxp.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\vUFRvPj.exe
  C:\Windows\System\vUFRvPj.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\nCXrDff.exe
  C:\Windows\System\nCXrDff.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\kvoJmvo.exe
  C:\Windows\System\kvoJmvo.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\fVdDnpF.exe
  C:\Windows\System\fVdDnpF.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\cynqgFH.exe
  C:\Windows\System\cynqgFH.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\zBofHQS.exe
  C:\Windows\System\zBofHQS.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\vKtPrAz.exe
  C:\Windows\System\vKtPrAz.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\sJofCVd.exe
  C:\Windows\System\sJofCVd.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\YFjksuk.exe
  C:\Windows\System\YFjksuk.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\wmdbeQF.exe
  C:\Windows\System\wmdbeQF.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\EzeeEaM.exe
  C:\Windows\System\EzeeEaM.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\vrKOaFb.exe
  C:\Windows\System\vrKOaFb.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\xJivsfv.exe
  C:\Windows\System\xJivsfv.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\GgNeBRL.exe
  C:\Windows\System\GgNeBRL.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\vgYaZeW.exe
  C:\Windows\System\vgYaZeW.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\xwCJqDB.exe
  C:\Windows\System\xwCJqDB.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\OxnLPoP.exe
  C:\Windows\System\OxnLPoP.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\XISRelI.exe
  C:\Windows\System\XISRelI.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\pQrpjJB.exe
  C:\Windows\System\pQrpjJB.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\fJMwuEL.exe
  C:\Windows\System\fJMwuEL.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\TDOOSPw.exe
  C:\Windows\System\TDOOSPw.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\nnUdRgc.exe
  C:\Windows\System\nnUdRgc.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\rJmcpRu.exe
  C:\Windows\System\rJmcpRu.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\YNrXoES.exe
  C:\Windows\System\YNrXoES.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\aITHQNL.exe
  C:\Windows\System\aITHQNL.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\nwYHOhq.exe
  C:\Windows\System\nwYHOhq.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\Rdffmrv.exe
  C:\Windows\System\Rdffmrv.exe
  2⤵
  PID:2008
- C:\Windows\System\cvTkryD.exe
  C:\Windows\System\cvTkryD.exe
  2⤵
  PID:2680
- C:\Windows\System\XjSdRhG.exe
  C:\Windows\System\XjSdRhG.exe
  2⤵
  PID:348
- C:\Windows\System\AnIXfyx.exe
  C:\Windows\System\AnIXfyx.exe
  2⤵
  PID:2104
- C:\Windows\System\TinfWkd.exe
  C:\Windows\System\TinfWkd.exe
  2⤵
  PID:832
- C:\Windows\System\sDeHMGO.exe
  C:\Windows\System\sDeHMGO.exe
  2⤵
  PID:1132
- C:\Windows\System\btGVwGo.exe
  C:\Windows\System\btGVwGo.exe
  2⤵
  PID:3064
- C:\Windows\System\eaiiepA.exe
  C:\Windows\System\eaiiepA.exe
  2⤵
  PID:2600
- C:\Windows\System\dAcyTQN.exe
  C:\Windows\System\dAcyTQN.exe
  2⤵
  PID:1124
- C:\Windows\System\jnPPRna.exe
  C:\Windows\System\jnPPRna.exe
  2⤵
  PID:1756
- C:\Windows\System\RvJmEOv.exe
  C:\Windows\System\RvJmEOv.exe
  2⤵
  PID:1692
- C:\Windows\System\oHTDOSB.exe
  C:\Windows\System\oHTDOSB.exe
  2⤵
  PID:1308
- C:\Windows\System\nmVkZMZ.exe
  C:\Windows\System\nmVkZMZ.exe
  2⤵
  PID:1656
- C:\Windows\System\PsIGoHT.exe
  C:\Windows\System\PsIGoHT.exe
  2⤵
  PID:988
- C:\Windows\System\knatmJK.exe
  C:\Windows\System\knatmJK.exe
  2⤵
  PID:1740
- C:\Windows\System\FeLGCJZ.exe
  C:\Windows\System\FeLGCJZ.exe
  2⤵
  PID:1880
- C:\Windows\System\dDfiPJw.exe
  C:\Windows\System\dDfiPJw.exe
  2⤵
  PID:2024
- C:\Windows\System\dkjQebQ.exe
  C:\Windows\System\dkjQebQ.exe
  2⤵
  PID:1784
- C:\Windows\System\ZJMcwwf.exe
  C:\Windows\System\ZJMcwwf.exe
  2⤵
  PID:2268
- C:\Windows\System\ybNXBMR.exe
  C:\Windows\System\ybNXBMR.exe
  2⤵
  PID:1424
- C:\Windows\System\dhyzdxK.exe
  C:\Windows\System\dhyzdxK.exe
  2⤵
  PID:2380
- C:\Windows\System\FGYkOHy.exe
  C:\Windows\System\FGYkOHy.exe
  2⤵
  PID:2860
- C:\Windows\System\GRUoIMc.exe
  C:\Windows\System\GRUoIMc.exe
  2⤵
  PID:3044
- C:\Windows\System\ZiZPkoX.exe
  C:\Windows\System\ZiZPkoX.exe
  2⤵
  PID:2876
- C:\Windows\System\QJQKtNJ.exe
  C:\Windows\System\QJQKtNJ.exe
  2⤵
  PID:2076
- C:\Windows\System\RXdnWAw.exe
  C:\Windows\System\RXdnWAw.exe
  2⤵
  PID:1564
- C:\Windows\System\hXIVDoQ.exe
  C:\Windows\System\hXIVDoQ.exe
  2⤵
  PID:2524
- C:\Windows\System\zWthSda.exe
  C:\Windows\System\zWthSda.exe
  2⤵
  PID:2176
- C:\Windows\System\SnWEWKx.exe
  C:\Windows\System\SnWEWKx.exe
  2⤵
  PID:2872
- C:\Windows\System\cHnLxzN.exe
  C:\Windows\System\cHnLxzN.exe
  2⤵
  PID:1412
- C:\Windows\System\eKKXCyJ.exe
  C:\Windows\System\eKKXCyJ.exe
  2⤵
  PID:2344
- C:\Windows\System\KgOuQzA.exe
  C:\Windows\System\KgOuQzA.exe
  2⤵
  PID:1592
- C:\Windows\System\bXIeUiI.exe
  C:\Windows\System\bXIeUiI.exe
  2⤵
  PID:300
- C:\Windows\System\yMtyzeK.exe
  C:\Windows\System\yMtyzeK.exe
  2⤵
  PID:1952
- C:\Windows\System\GeYVrgY.exe
  C:\Windows\System\GeYVrgY.exe
  2⤵
  PID:840
- C:\Windows\System\XfobtvM.exe
  C:\Windows\System\XfobtvM.exe
  2⤵
  PID:2448
- C:\Windows\System\oJydNXD.exe
  C:\Windows\System\oJydNXD.exe
  2⤵
  PID:1228
- C:\Windows\System\SyECvdl.exe
  C:\Windows\System\SyECvdl.exe
  2⤵
  PID:1460
- C:\Windows\System\TvJcQWR.exe
  C:\Windows\System\TvJcQWR.exe
  2⤵
  PID:328
- C:\Windows\System\zxseBZo.exe
  C:\Windows\System\zxseBZo.exe
  2⤵
  PID:344
- C:\Windows\System\MTArkzV.exe
  C:\Windows\System\MTArkzV.exe
  2⤵
  PID:2520
- C:\Windows\System\bkrzfhM.exe
  C:\Windows\System\bkrzfhM.exe
  2⤵
  PID:2188
- C:\Windows\System\zARryTa.exe
  C:\Windows\System\zARryTa.exe
  2⤵
  PID:2908
- C:\Windows\System\wKlRAmZ.exe
  C:\Windows\System\wKlRAmZ.exe
  2⤵
  PID:2044
- C:\Windows\System\WLfMpno.exe
  C:\Windows\System\WLfMpno.exe
  2⤵
  PID:2900
- C:\Windows\System\JjVxtAT.exe
  C:\Windows\System\JjVxtAT.exe
  2⤵
  PID:1508
- C:\Windows\System\XcDTujz.exe
  C:\Windows\System\XcDTujz.exe
  2⤵
  PID:2772
- C:\Windows\System\Nyvptwr.exe
  C:\Windows\System\Nyvptwr.exe
  2⤵
  PID:1968
- C:\Windows\System\JEsKDcg.exe
  C:\Windows\System\JEsKDcg.exe
  2⤵
  PID:2744
- C:\Windows\System\MZrfiGT.exe
  C:\Windows\System\MZrfiGT.exe
  2⤵
  PID:1440
- C:\Windows\System\yOGOnaF.exe
  C:\Windows\System\yOGOnaF.exe
  2⤵
  PID:1676
- C:\Windows\System\cJfCVmz.exe
  C:\Windows\System\cJfCVmz.exe
  2⤵
  PID:2632
- C:\Windows\System\DmOHbEn.exe
  C:\Windows\System\DmOHbEn.exe
  2⤵
  PID:868
- C:\Windows\System\kEDwbmf.exe
  C:\Windows\System\kEDwbmf.exe
  2⤵
  PID:1004
- C:\Windows\System\VwMuNTc.exe
  C:\Windows\System\VwMuNTc.exe
  2⤵
  PID:1016
- C:\Windows\System\HvhQPvO.exe
  C:\Windows\System\HvhQPvO.exe
  2⤵
  PID:780
- C:\Windows\System\HogEKRO.exe
  C:\Windows\System\HogEKRO.exe
  2⤵
  PID:1820
- C:\Windows\System\BhexqRs.exe
  C:\Windows\System\BhexqRs.exe
  2⤵
  PID:2864
- C:\Windows\System\bmosPdt.exe
  C:\Windows\System\bmosPdt.exe
  2⤵
  PID:760
- C:\Windows\System\EgKgLKW.exe
  C:\Windows\System\EgKgLKW.exe
  2⤵
  PID:2768
- C:\Windows\System\ehexOsT.exe
  C:\Windows\System\ehexOsT.exe
  2⤵
  PID:1584
- C:\Windows\System\IPxxgLg.exe
  C:\Windows\System\IPxxgLg.exe
  2⤵
  PID:3040
- C:\Windows\System\KaHCbpw.exe
  C:\Windows\System\KaHCbpw.exe
  2⤵
  PID:284
- C:\Windows\System\LaXAXQZ.exe
  C:\Windows\System\LaXAXQZ.exe
  2⤵
  PID:1256
- C:\Windows\System\JLgEGTI.exe
  C:\Windows\System\JLgEGTI.exe
  2⤵
  PID:1788
- C:\Windows\System\TeJgwRO.exe
  C:\Windows\System\TeJgwRO.exe
  2⤵
  PID:2000
- C:\Windows\System\dnEhLIC.exe
  C:\Windows\System\dnEhLIC.exe
  2⤵
  PID:2224
- C:\Windows\System\bUebDuQ.exe
  C:\Windows\System\bUebDuQ.exe
  2⤵
  PID:2060
- C:\Windows\System\QdVVZHB.exe
  C:\Windows\System\QdVVZHB.exe
  2⤵
  PID:3088
- C:\Windows\System\sbssPSt.exe
  C:\Windows\System\sbssPSt.exe
  2⤵
  PID:3108
- C:\Windows\System\CmqoVTC.exe
  C:\Windows\System\CmqoVTC.exe
  2⤵
  PID:3128
- C:\Windows\System\ARakwth.exe
  C:\Windows\System\ARakwth.exe
  2⤵
  PID:3148
- C:\Windows\System\sZgQpCD.exe
  C:\Windows\System\sZgQpCD.exe
  2⤵
  PID:3164
- C:\Windows\System\kkqLbWn.exe
  C:\Windows\System\kkqLbWn.exe
  2⤵
  PID:3184
- C:\Windows\System\QnwUbPk.exe
  C:\Windows\System\QnwUbPk.exe
  2⤵
  PID:3200
- C:\Windows\System\pNQlsyB.exe
  C:\Windows\System\pNQlsyB.exe
  2⤵
  PID:3216
- C:\Windows\System\ZXqbzgy.exe
  C:\Windows\System\ZXqbzgy.exe
  2⤵
  PID:3232
- C:\Windows\System\kYeLkEy.exe
  C:\Windows\System\kYeLkEy.exe
  2⤵
  PID:3248
- C:\Windows\System\QlALGer.exe
  C:\Windows\System\QlALGer.exe
  2⤵
  PID:3264
- C:\Windows\System\SsBoXoy.exe
  C:\Windows\System\SsBoXoy.exe
  2⤵
  PID:3280
- C:\Windows\System\ELvLUUo.exe
  C:\Windows\System\ELvLUUo.exe
  2⤵
  PID:3296
- C:\Windows\System\Iezkdis.exe
  C:\Windows\System\Iezkdis.exe
  2⤵
  PID:3312
- C:\Windows\System\pDDSrFO.exe
  C:\Windows\System\pDDSrFO.exe
  2⤵
  PID:3328
- C:\Windows\System\gwhNvtN.exe
  C:\Windows\System\gwhNvtN.exe
  2⤵
  PID:3344
- C:\Windows\System\SOxIRzC.exe
  C:\Windows\System\SOxIRzC.exe
  2⤵
  PID:3360
- C:\Windows\System\yZPyRqI.exe
  C:\Windows\System\yZPyRqI.exe
  2⤵
  PID:3376
- C:\Windows\System\tJBoqVi.exe
  C:\Windows\System\tJBoqVi.exe
  2⤵
  PID:3392
- C:\Windows\System\MxHxtDZ.exe
  C:\Windows\System\MxHxtDZ.exe
  2⤵
  PID:3408
- C:\Windows\System\KutRVTL.exe
  C:\Windows\System\KutRVTL.exe
  2⤵
  PID:3424
- C:\Windows\System\EwPFHAf.exe
  C:\Windows\System\EwPFHAf.exe
  2⤵
  PID:3440
- C:\Windows\System\tTmcqCf.exe
  C:\Windows\System\tTmcqCf.exe
  2⤵
  PID:3456
- C:\Windows\System\PArLNpt.exe
  C:\Windows\System\PArLNpt.exe
  2⤵
  PID:3472
- C:\Windows\System\ATKUTmz.exe
  C:\Windows\System\ATKUTmz.exe
  2⤵
  PID:3492
- C:\Windows\System\fGJBSMn.exe
  C:\Windows\System\fGJBSMn.exe
  2⤵
  PID:3508
- C:\Windows\System\PDjIraR.exe
  C:\Windows\System\PDjIraR.exe
  2⤵
  PID:3524
- C:\Windows\System\vQVMmyl.exe
  C:\Windows\System\vQVMmyl.exe
  2⤵
  PID:3540
- C:\Windows\System\FEjVYaE.exe
  C:\Windows\System\FEjVYaE.exe
  2⤵
  PID:3556
- C:\Windows\System\QjelXTJ.exe
  C:\Windows\System\QjelXTJ.exe
  2⤵
  PID:3572
- C:\Windows\System\nXtLNgo.exe
  C:\Windows\System\nXtLNgo.exe
  2⤵
  PID:3588
- C:\Windows\System\bDsBJDK.exe
  C:\Windows\System\bDsBJDK.exe
  2⤵
  PID:3604
- C:\Windows\System\GtIsBVF.exe
  C:\Windows\System\GtIsBVF.exe
  2⤵
  PID:3620
- C:\Windows\System\CaEJZCz.exe
  C:\Windows\System\CaEJZCz.exe
  2⤵
  PID:3636
- C:\Windows\System\WJhSNNl.exe
  C:\Windows\System\WJhSNNl.exe
  2⤵
  PID:3652
- C:\Windows\System\biDHTep.exe
  C:\Windows\System\biDHTep.exe
  2⤵
  PID:3668
- C:\Windows\System\eykNPkw.exe
  C:\Windows\System\eykNPkw.exe
  2⤵
  PID:3684
- C:\Windows\System\RYPkLPz.exe
  C:\Windows\System\RYPkLPz.exe
  2⤵
  PID:3700
- C:\Windows\System\zPFSOwB.exe
  C:\Windows\System\zPFSOwB.exe
  2⤵
  PID:3716
- C:\Windows\System\tRKumMe.exe
  C:\Windows\System\tRKumMe.exe
  2⤵
  PID:3732
- C:\Windows\System\TZTuDMo.exe
  C:\Windows\System\TZTuDMo.exe
  2⤵
  PID:3748
- C:\Windows\System\Jvzayov.exe
  C:\Windows\System\Jvzayov.exe
  2⤵
  PID:3764
- C:\Windows\System\RSXvZwU.exe
  C:\Windows\System\RSXvZwU.exe
  2⤵
  PID:3780
- C:\Windows\System\XmOcvru.exe
  C:\Windows\System\XmOcvru.exe
  2⤵
  PID:3796
- C:\Windows\System\BjrdOoL.exe
  C:\Windows\System\BjrdOoL.exe
  2⤵
  PID:3812
- C:\Windows\System\WIfypGj.exe
  C:\Windows\System\WIfypGj.exe
  2⤵
  PID:3832
- C:\Windows\System\hsQzKcU.exe
  C:\Windows\System\hsQzKcU.exe
  2⤵
  PID:3848
- C:\Windows\System\IalVHkW.exe
  C:\Windows\System\IalVHkW.exe
  2⤵
  PID:3864
- C:\Windows\System\xNOlpJl.exe
  C:\Windows\System\xNOlpJl.exe
  2⤵
  PID:3880
- C:\Windows\System\bSkYtmU.exe
  C:\Windows\System\bSkYtmU.exe
  2⤵
  PID:3896
- C:\Windows\System\KlxWjSP.exe
  C:\Windows\System\KlxWjSP.exe
  2⤵
  PID:3912
- C:\Windows\System\YObFgLQ.exe
  C:\Windows\System\YObFgLQ.exe
  2⤵
  PID:3928
- C:\Windows\System\BOFXziY.exe
  C:\Windows\System\BOFXziY.exe
  2⤵
  PID:3952
- C:\Windows\System\JVeftsF.exe
  C:\Windows\System\JVeftsF.exe
  2⤵
  PID:3968
- C:\Windows\System\gdvgMSm.exe
  C:\Windows\System\gdvgMSm.exe
  2⤵
  PID:3984
- C:\Windows\System\DPoPbMv.exe
  C:\Windows\System\DPoPbMv.exe
  2⤵
  PID:4000
- C:\Windows\System\DRZYrdl.exe
  C:\Windows\System\DRZYrdl.exe
  2⤵
  PID:4016
- C:\Windows\System\LPcvuDM.exe
  C:\Windows\System\LPcvuDM.exe
  2⤵
  PID:4032
- C:\Windows\System\pirhiJc.exe
  C:\Windows\System\pirhiJc.exe
  2⤵
  PID:4056
- C:\Windows\System\QYUeHRs.exe
  C:\Windows\System\QYUeHRs.exe
  2⤵
  PID:4072
- C:\Windows\System\pLsNsDr.exe
  C:\Windows\System\pLsNsDr.exe
  2⤵
  PID:4088
- C:\Windows\System\ceNdADp.exe
  C:\Windows\System\ceNdADp.exe
  2⤵
  PID:3104
- C:\Windows\System\IBUWlSp.exe
  C:\Windows\System\IBUWlSp.exe
  2⤵
  PID:1560
- C:\Windows\System\lzcaVvy.exe
  C:\Windows\System\lzcaVvy.exe
  2⤵
  PID:1708
- C:\Windows\System\TIEFPoN.exe
  C:\Windows\System\TIEFPoN.exe
  2⤵
  PID:268
- C:\Windows\System\GqDNPrC.exe
  C:\Windows\System\GqDNPrC.exe
  2⤵
  PID:2328
- C:\Windows\System\tgymTYn.exe
  C:\Windows\System\tgymTYn.exe
  2⤵
  PID:1500
- C:\Windows\System\LCMPVXa.exe
  C:\Windows\System\LCMPVXa.exe
  2⤵
  PID:2340
- C:\Windows\System\GpECNtz.exe
  C:\Windows\System\GpECNtz.exe
  2⤵
  PID:2244
- C:\Windows\System\fuXFpgo.exe
  C:\Windows\System\fuXFpgo.exe
  2⤵
  PID:3084
- C:\Windows\System\AotLyyO.exe
  C:\Windows\System\AotLyyO.exe
  2⤵
  PID:3076
- C:\Windows\System\leqmfrX.exe
  C:\Windows\System\leqmfrX.exe
  2⤵
  PID:3196
- C:\Windows\System\MpRsZni.exe
  C:\Windows\System\MpRsZni.exe
  2⤵
  PID:3240
- C:\Windows\System\seHUlen.exe
  C:\Windows\System\seHUlen.exe
  2⤵
  PID:3272
- C:\Windows\System\QGCksbn.exe
  C:\Windows\System\QGCksbn.exe
  2⤵
  PID:3308
- C:\Windows\System\syCwqST.exe
  C:\Windows\System\syCwqST.exe
  2⤵
  PID:3336
- C:\Windows\System\xSQvact.exe
  C:\Windows\System\xSQvact.exe
  2⤵
  PID:3352
- C:\Windows\System\ZZuJUXo.exe
  C:\Windows\System\ZZuJUXo.exe
  2⤵
  PID:3384
- C:\Windows\System\uKkZNoE.exe
  C:\Windows\System\uKkZNoE.exe
  2⤵
  PID:3432
- C:\Windows\System\SQRGzXT.exe
  C:\Windows\System\SQRGzXT.exe
  2⤵
  PID:3448
- C:\Windows\System\orWzsni.exe
  C:\Windows\System\orWzsni.exe
  2⤵
  PID:3500
- C:\Windows\System\yjuXGqE.exe
  C:\Windows\System\yjuXGqE.exe
  2⤵
  PID:3480
- C:\Windows\System\KzSbpKi.exe
  C:\Windows\System\KzSbpKi.exe
  2⤵
  PID:2664
- C:\Windows\System\fJEhltv.exe
  C:\Windows\System\fJEhltv.exe
  2⤵
  PID:3564
- C:\Windows\System\nODjTKi.exe
  C:\Windows\System\nODjTKi.exe
  2⤵
  PID:1840
- C:\Windows\System\MOkQAiy.exe
  C:\Windows\System\MOkQAiy.exe
  2⤵
  PID:3584
- C:\Windows\System\nZnZYmb.exe
  C:\Windows\System\nZnZYmb.exe
  2⤵
  PID:3712
- C:\Windows\System\KseqpuD.exe
  C:\Windows\System\KseqpuD.exe
  2⤵
  PID:3744
- C:\Windows\System\jsjBLsc.exe
  C:\Windows\System\jsjBLsc.exe
  2⤵
  PID:3908
- C:\Windows\System\mAsuoSo.exe
  C:\Windows\System\mAsuoSo.exe
  2⤵
  PID:3944
- C:\Windows\System\cyFZteA.exe
  C:\Windows\System\cyFZteA.exe
  2⤵
  PID:4008
- C:\Windows\System\sNcDQCK.exe
  C:\Windows\System\sNcDQCK.exe
  2⤵
  PID:3960
- C:\Windows\System\OndjYvL.exe
  C:\Windows\System\OndjYvL.exe
  2⤵
  PID:4024
- C:\Windows\System\fjhhTBE.exe
  C:\Windows\System\fjhhTBE.exe
  2⤵
  PID:2100
- C:\Windows\System\IBpDXDT.exe
  C:\Windows\System\IBpDXDT.exe
  2⤵
  PID:1660
- C:\Windows\System\rNUmpgH.exe
  C:\Windows\System\rNUmpgH.exe
  2⤵
  PID:2228
- C:\Windows\System\OvNIRKD.exe
  C:\Windows\System\OvNIRKD.exe
  2⤵
  PID:1568
- C:\Windows\System\esFkUjH.exe
  C:\Windows\System\esFkUjH.exe
  2⤵
  PID:1340
- C:\Windows\System\gJNYHoi.exe
  C:\Windows\System\gJNYHoi.exe
  2⤵
  PID:2596
- C:\Windows\System\ZKEdHNC.exe
  C:\Windows\System\ZKEdHNC.exe
  2⤵
  PID:3840
- C:\Windows\System\ovNWcxR.exe
  C:\Windows\System\ovNWcxR.exe
  2⤵
  PID:3136
- C:\Windows\System\AcNrlJj.exe
  C:\Windows\System\AcNrlJj.exe
  2⤵
  PID:1732
- C:\Windows\System\gjXGmPJ.exe
  C:\Windows\System\gjXGmPJ.exe
  2⤵
  PID:3156
- C:\Windows\System\NzsUOvJ.exe
  C:\Windows\System\NzsUOvJ.exe
  2⤵
  PID:3116
- C:\Windows\System\MnhGsAB.exe
  C:\Windows\System\MnhGsAB.exe
  2⤵
  PID:3224
- C:\Windows\System\gvoGggh.exe
  C:\Windows\System\gvoGggh.exe
  2⤵
  PID:3356
- C:\Windows\System\tCSpVGL.exe
  C:\Windows\System\tCSpVGL.exe
  2⤵
  PID:3452
- C:\Windows\System\mKAotBd.exe
  C:\Windows\System\mKAotBd.exe
  2⤵
  PID:2572
- C:\Windows\System\sdJDDgn.exe
  C:\Windows\System\sdJDDgn.exe
  2⤵
  PID:2824
- C:\Windows\System\JvgOPof.exe
  C:\Windows\System\JvgOPof.exe
  2⤵
  PID:2496
- C:\Windows\System\lTgZcMT.exe
  C:\Windows\System\lTgZcMT.exe
  2⤵
  PID:3340
- C:\Windows\System\bdvYNmb.exe
  C:\Windows\System\bdvYNmb.exe
  2⤵
  PID:2528
- C:\Windows\System\zQMhuNr.exe
  C:\Windows\System\zQMhuNr.exe
  2⤵
  PID:3548
- C:\Windows\System\ELtmMqH.exe
  C:\Windows\System\ELtmMqH.exe
  2⤵
  PID:1352
- C:\Windows\System\vVyNDaM.exe
  C:\Windows\System\vVyNDaM.exe
  2⤵
  PID:3644
- C:\Windows\System\ReWgHGC.exe
  C:\Windows\System\ReWgHGC.exe
  2⤵
  PID:3692
- C:\Windows\System\hfnJFzV.exe
  C:\Windows\System\hfnJFzV.exe
  2⤵
  PID:3724
- C:\Windows\System\hFngcSK.exe
  C:\Windows\System\hFngcSK.exe
  2⤵
  PID:4064
- C:\Windows\System\mItqrqo.exe
  C:\Windows\System\mItqrqo.exe
  2⤵
  PID:3096
- C:\Windows\System\etjNUnp.exe
  C:\Windows\System\etjNUnp.exe
  2⤵
  PID:4044
- C:\Windows\System\VHtEjUC.exe
  C:\Windows\System\VHtEjUC.exe
  2⤵
  PID:1020
- C:\Windows\System\ZqCEhfZ.exe
  C:\Windows\System\ZqCEhfZ.exe
  2⤵
  PID:1284
- C:\Windows\System\IxroiCl.exe
  C:\Windows\System\IxroiCl.exe
  2⤵
  PID:3892
- C:\Windows\System\TjTjSxb.exe
  C:\Windows\System\TjTjSxb.exe
  2⤵
  PID:3828
- C:\Windows\System\rdptAtI.exe
  C:\Windows\System\rdptAtI.exe
  2⤵
  PID:3808
- C:\Windows\System\ZbDcvnc.exe
  C:\Windows\System\ZbDcvnc.exe
  2⤵
  PID:340
- C:\Windows\System\cDHEmGB.exe
  C:\Windows\System\cDHEmGB.exe
  2⤵
  PID:3992
- C:\Windows\System\ytCVUgN.exe
  C:\Windows\System\ytCVUgN.exe
  2⤵
  PID:876
- C:\Windows\System\yjOKzBJ.exe
  C:\Windows\System\yjOKzBJ.exe
  2⤵
  PID:3580
- C:\Windows\System\TMeKIMC.exe
  C:\Windows\System\TMeKIMC.exe
  2⤵
  PID:2732
- C:\Windows\System\aauwWCi.exe
  C:\Windows\System\aauwWCi.exe
  2⤵
  PID:3936
- C:\Windows\System\rTcodAk.exe
  C:\Windows\System\rTcodAk.exe
  2⤵
  PID:1028
- C:\Windows\System\nAdjyoa.exe
  C:\Windows\System\nAdjyoa.exe
  2⤵
  PID:1624
- C:\Windows\System\CNmJBdK.exe
  C:\Windows\System\CNmJBdK.exe
  2⤵
  PID:2116
- C:\Windows\System\mCIgHtj.exe
  C:\Windows\System\mCIgHtj.exe
  2⤵
  PID:2576
- C:\Windows\System\cZbDTEX.exe
  C:\Windows\System\cZbDTEX.exe
  2⤵
  PID:2508
- C:\Windows\System\wLDzZED.exe
  C:\Windows\System\wLDzZED.exe
  2⤵
  PID:2512
- C:\Windows\System\LedMTRy.exe
  C:\Windows\System\LedMTRy.exe
  2⤵
  PID:3792
- C:\Windows\System\yywUrtF.exe
  C:\Windows\System\yywUrtF.exe
  2⤵
  PID:2812
- C:\Windows\System\odAdlHw.exe
  C:\Windows\System\odAdlHw.exe
  2⤵
  PID:3860
- C:\Windows\System\ZfgwGwd.exe
  C:\Windows\System\ZfgwGwd.exe
  2⤵
  PID:3628
- C:\Windows\System\jhzEGvI.exe
  C:\Windows\System\jhzEGvI.exe
  2⤵
  PID:3516
- C:\Windows\System\JlrSHOf.exe
  C:\Windows\System\JlrSHOf.exe
  2⤵
  PID:3708
- C:\Windows\System\vuynQBb.exe
  C:\Windows\System\vuynQBb.exe
  2⤵
  PID:3140
- C:\Windows\System\vMJQPai.exe
  C:\Windows\System\vMJQPai.exe
  2⤵
  PID:3776
- C:\Windows\System\BXpfPqC.exe
  C:\Windows\System\BXpfPqC.exe
  2⤵
  PID:3520
- C:\Windows\System\iEXmxAl.exe
  C:\Windows\System\iEXmxAl.exe
  2⤵
  PID:3400
- C:\Windows\System\TRyiYeh.exe
  C:\Windows\System\TRyiYeh.exe
  2⤵
  PID:1360
- C:\Windows\System\vMkNRiI.exe
  C:\Windows\System\vMkNRiI.exe
  2⤵
  PID:3276
- C:\Windows\System\wRTNwkW.exe
  C:\Windows\System\wRTNwkW.exe
  2⤵
  PID:2080
- C:\Windows\System\KPdvxJe.exe
  C:\Windows\System\KPdvxJe.exe
  2⤵
  PID:2428
- C:\Windows\System\UDIgDnj.exe
  C:\Windows\System\UDIgDnj.exe
  2⤵
  PID:3924
- C:\Windows\System\odjwqpa.exe
  C:\Windows\System\odjwqpa.exe
  2⤵
  PID:3844
- C:\Windows\System\kUvsAxD.exe
  C:\Windows\System\kUvsAxD.exe
  2⤵
  PID:3760
- C:\Windows\System\MVfycwM.exe
  C:\Windows\System\MVfycwM.exe
  2⤵
  PID:3372
- C:\Windows\System\TesQlCj.exe
  C:\Windows\System\TesQlCj.exe
  2⤵
  PID:3648
- C:\Windows\System\ilYGKUr.exe
  C:\Windows\System\ilYGKUr.exe
  2⤵
  PID:1856
- C:\Windows\System\vsTyNrT.exe
  C:\Windows\System\vsTyNrT.exe
  2⤵
  PID:2796
- C:\Windows\System\fnLpjoP.exe
  C:\Windows\System\fnLpjoP.exe
  2⤵
  PID:4104
- C:\Windows\System\iWsXuiF.exe
  C:\Windows\System\iWsXuiF.exe
  2⤵
  PID:4120
- C:\Windows\System\yxUKbZh.exe
  C:\Windows\System\yxUKbZh.exe
  2⤵
  PID:4136
- C:\Windows\System\txOnkci.exe
  C:\Windows\System\txOnkci.exe
  2⤵
  PID:4152
- C:\Windows\System\ZMSGjgm.exe
  C:\Windows\System\ZMSGjgm.exe
  2⤵
  PID:4168
- C:\Windows\System\TUbVDPv.exe
  C:\Windows\System\TUbVDPv.exe
  2⤵
  PID:4184
- C:\Windows\System\BPFfJbF.exe
  C:\Windows\System\BPFfJbF.exe
  2⤵
  PID:4216
- C:\Windows\System\wxiwjBK.exe
  C:\Windows\System\wxiwjBK.exe
  2⤵
  PID:4232
- C:\Windows\System\ubnklYJ.exe
  C:\Windows\System\ubnklYJ.exe
  2⤵
  PID:4248
- C:\Windows\System\UcdNbiW.exe
  C:\Windows\System\UcdNbiW.exe
  2⤵
  PID:4264
- C:\Windows\System\zuGYYPO.exe
  C:\Windows\System\zuGYYPO.exe
  2⤵
  PID:4280
- C:\Windows\System\nlujXtO.exe
  C:\Windows\System\nlujXtO.exe
  2⤵
  PID:4296
- C:\Windows\System\RFDsWxQ.exe
  C:\Windows\System\RFDsWxQ.exe
  2⤵
  PID:4312
- C:\Windows\System\WIzrhVg.exe
  C:\Windows\System\WIzrhVg.exe
  2⤵
  PID:4328
- C:\Windows\System\WFctJky.exe
  C:\Windows\System\WFctJky.exe
  2⤵
  PID:4344
- C:\Windows\System\WrkMFCf.exe
  C:\Windows\System\WrkMFCf.exe
  2⤵
  PID:4360
- C:\Windows\System\CrmlBMp.exe
  C:\Windows\System\CrmlBMp.exe
  2⤵
  PID:4376
- C:\Windows\System\ujNrNNb.exe
  C:\Windows\System\ujNrNNb.exe
  2⤵
  PID:4396
- C:\Windows\System\WwpDqDN.exe
  C:\Windows\System\WwpDqDN.exe
  2⤵
  PID:4412
- C:\Windows\System\lKWNIDA.exe
  C:\Windows\System\lKWNIDA.exe
  2⤵
  PID:4428
- C:\Windows\System\fbwrIig.exe
  C:\Windows\System\fbwrIig.exe
  2⤵
  PID:4444
- C:\Windows\System\EzMUOQc.exe
  C:\Windows\System\EzMUOQc.exe
  2⤵
  PID:4460
- C:\Windows\System\xLwjMRQ.exe
  C:\Windows\System\xLwjMRQ.exe
  2⤵
  PID:4476
- C:\Windows\System\qrzqCTU.exe
  C:\Windows\System\qrzqCTU.exe
  2⤵
  PID:4492
- C:\Windows\System\ikUtaEq.exe
  C:\Windows\System\ikUtaEq.exe
  2⤵
  PID:4508
- C:\Windows\System\IFZHiCK.exe
  C:\Windows\System\IFZHiCK.exe
  2⤵
  PID:4524
- C:\Windows\System\cUYipSM.exe
  C:\Windows\System\cUYipSM.exe
  2⤵
  PID:4540
- C:\Windows\System\urJNtQF.exe
  C:\Windows\System\urJNtQF.exe
  2⤵
  PID:4556
- C:\Windows\System\eeDqMwl.exe
  C:\Windows\System\eeDqMwl.exe
  2⤵
  PID:4572
- C:\Windows\System\GuZIQYi.exe
  C:\Windows\System\GuZIQYi.exe
  2⤵
  PID:4588
- C:\Windows\System\hnadQWr.exe
  C:\Windows\System\hnadQWr.exe
  2⤵
  PID:4604
- C:\Windows\System\wsgItGT.exe
  C:\Windows\System\wsgItGT.exe
  2⤵
  PID:4620
- C:\Windows\System\VpgIelx.exe
  C:\Windows\System\VpgIelx.exe
  2⤵
  PID:4636
- C:\Windows\System\jBBgIeT.exe
  C:\Windows\System\jBBgIeT.exe
  2⤵
  PID:4656
- C:\Windows\System\TvGNbDV.exe
  C:\Windows\System\TvGNbDV.exe
  2⤵
  PID:4672
- C:\Windows\System\EsZSruz.exe
  C:\Windows\System\EsZSruz.exe
  2⤵
  PID:4688
- C:\Windows\System\zanhSYn.exe
  C:\Windows\System\zanhSYn.exe
  2⤵
  PID:4704
- C:\Windows\System\FpKndDl.exe
  C:\Windows\System\FpKndDl.exe
  2⤵
  PID:4720
- C:\Windows\System\QRBIIMq.exe
  C:\Windows\System\QRBIIMq.exe
  2⤵
  PID:4736
- C:\Windows\System\XUsOsAv.exe
  C:\Windows\System\XUsOsAv.exe
  2⤵
  PID:4752
- C:\Windows\System\hdmPEqB.exe
  C:\Windows\System\hdmPEqB.exe
  2⤵
  PID:4768
- C:\Windows\System\XrFcAKS.exe
  C:\Windows\System\XrFcAKS.exe
  2⤵
  PID:4784
- C:\Windows\System\tOuPpoQ.exe
  C:\Windows\System\tOuPpoQ.exe
  2⤵
  PID:4804
- C:\Windows\System\RqDkagw.exe
  C:\Windows\System\RqDkagw.exe
  2⤵
  PID:4820
- C:\Windows\System\XAiMzUl.exe
  C:\Windows\System\XAiMzUl.exe
  2⤵
  PID:4844
- C:\Windows\System\URVYfLB.exe
  C:\Windows\System\URVYfLB.exe
  2⤵
  PID:4944
- C:\Windows\System\dPpAahv.exe
  C:\Windows\System\dPpAahv.exe
  2⤵
  PID:5080
- C:\Windows\System\WxJRTZs.exe
  C:\Windows\System\WxJRTZs.exe
  2⤵
  PID:3288
- C:\Windows\System\EpIdcWG.exe
  C:\Windows\System\EpIdcWG.exe
  2⤵
  PID:4128
- C:\Windows\System\HvaTiwC.exe
  C:\Windows\System\HvaTiwC.exe
  2⤵
  PID:4240
- C:\Windows\System\TqYHOwu.exe
  C:\Windows\System\TqYHOwu.exe
  2⤵
  PID:4456
- C:\Windows\System\ikYgGjq.exe
  C:\Windows\System\ikYgGjq.exe
  2⤵
  PID:4548
- C:\Windows\System\xWfhqZP.exe
  C:\Windows\System\xWfhqZP.exe
  2⤵
  PID:4612
- C:\Windows\System\mlmPYOs.exe
  C:\Windows\System\mlmPYOs.exe
  2⤵
  PID:4408
- C:\Windows\System\mpcUMYR.exe
  C:\Windows\System\mpcUMYR.exe
  2⤵
  PID:4776
- C:\Windows\System\KJKfObK.exe
  C:\Windows\System\KJKfObK.exe
  2⤵
  PID:4628
- C:\Windows\System\VlPqxxw.exe
  C:\Windows\System\VlPqxxw.exe
  2⤵
  PID:4728
- C:\Windows\System\doFBQRc.exe
  C:\Windows\System\doFBQRc.exe
  2⤵
  PID:4564
- C:\Windows\System\FzeNxNE.exe
  C:\Windows\System\FzeNxNE.exe
  2⤵
  PID:1724
- C:\Windows\System\MluGcmX.exe
  C:\Windows\System\MluGcmX.exe
  2⤵
  PID:1444
- C:\Windows\System\zIODcEs.exe
  C:\Windows\System\zIODcEs.exe
  2⤵
  PID:1780
- C:\Windows\System\ZSTodCZ.exe
  C:\Windows\System\ZSTodCZ.exe
  2⤵
  PID:4852
- C:\Windows\System\khKKLjz.exe
  C:\Windows\System\khKKLjz.exe
  2⤵
  PID:792
- C:\Windows\System\bGnAGxj.exe
  C:\Windows\System\bGnAGxj.exe
  2⤵
  PID:4868
- C:\Windows\System\IGgzoka.exe
  C:\Windows\System\IGgzoka.exe
  2⤵
  PID:4884
- C:\Windows\System\fbliEnr.exe
  C:\Windows\System\fbliEnr.exe
  2⤵
  PID:4904
- C:\Windows\System\nAzVhjq.exe
  C:\Windows\System\nAzVhjq.exe
  2⤵
  PID:4920
- C:\Windows\System\RJWbHhd.exe
  C:\Windows\System\RJWbHhd.exe
  2⤵
  PID:4940
- C:\Windows\System\HuFbWIZ.exe
  C:\Windows\System\HuFbWIZ.exe
  2⤵
  PID:4952
- C:\Windows\System\BqCMEFC.exe
  C:\Windows\System\BqCMEFC.exe
  2⤵
  PID:4988
- C:\Windows\System\CLkWQEq.exe
  C:\Windows\System\CLkWQEq.exe
  2⤵
  PID:5028
- C:\Windows\System\ZMBcHtU.exe
  C:\Windows\System\ZMBcHtU.exe
  2⤵
  PID:3180
- C:\Windows\System\yzbtMSO.exe
  C:\Windows\System\yzbtMSO.exe
  2⤵
  PID:5116
- C:\Windows\System\GVELHkb.exe
  C:\Windows\System\GVELHkb.exe
  2⤵
  PID:1696
- C:\Windows\System\htUqjXl.exe
  C:\Windows\System\htUqjXl.exe
  2⤵
  PID:4116
- C:\Windows\System\MWjypUD.exe
  C:\Windows\System\MWjypUD.exe
  2⤵
  PID:4180
- C:\Windows\System\vKdXxwD.exe
  C:\Windows\System\vKdXxwD.exe
  2⤵
  PID:3996
- C:\Windows\System\jdzPoNf.exe
  C:\Windows\System\jdzPoNf.exe
  2⤵
  PID:2692
- C:\Windows\System\gzCQZxn.exe
  C:\Windows\System\gzCQZxn.exe
  2⤵
  PID:4204
- C:\Windows\System\ALiaylU.exe
  C:\Windows\System\ALiaylU.exe
  2⤵
  PID:4164
- C:\Windows\System\QPEJBkE.exe
  C:\Windows\System\QPEJBkE.exe
  2⤵
  PID:4272
- C:\Windows\System\nBTeCoL.exe
  C:\Windows\System\nBTeCoL.exe
  2⤵
  PID:4324
- C:\Windows\System\lQXragT.exe
  C:\Windows\System\lQXragT.exe
  2⤵
  PID:264
- C:\Windows\System\XshZJzK.exe
  C:\Windows\System\XshZJzK.exe
  2⤵
  PID:4420
- C:\Windows\System\ZkEWPAW.exe
  C:\Windows\System\ZkEWPAW.exe
  2⤵
  PID:4308
- C:\Windows\System\shGJIYh.exe
  C:\Windows\System\shGJIYh.exe
  2⤵
  PID:4372
- C:\Windows\System\NklVWWp.exe
  C:\Windows\System\NklVWWp.exe
  2⤵
  PID:4484
- C:\Windows\System\upOukJb.exe
  C:\Windows\System\upOukJb.exe
  2⤵
  PID:2676
- C:\Windows\System\IAYwBvp.exe
  C:\Windows\System\IAYwBvp.exe
  2⤵
  PID:4580
- C:\Windows\System\QnNhrry.exe
  C:\Windows\System\QnNhrry.exe
  2⤵
  PID:4712
- C:\Windows\System\TQsKWKA.exe
  C:\Windows\System\TQsKWKA.exe
  2⤵
  PID:4536
- C:\Windows\System\rGjIvWO.exe
  C:\Windows\System\rGjIvWO.exe
  2⤵
  PID:4472
- C:\Windows\System\eegQBKl.exe
  C:\Windows\System\eegQBKl.exe
  2⤵
  PID:4500
- C:\Windows\System\mCPBdJp.exe
  C:\Windows\System\mCPBdJp.exe
  2⤵
  PID:4800
- C:\Windows\System\MBqWbPG.exe
  C:\Windows\System\MBqWbPG.exe
  2⤵
  PID:1180
- C:\Windows\System\IUXaxnp.exe
  C:\Windows\System\IUXaxnp.exe
  2⤵
  PID:4600
- C:\Windows\System\mUHedJT.exe
  C:\Windows\System\mUHedJT.exe
  2⤵
  PID:2892
- C:\Windows\System\NkYVudV.exe
  C:\Windows\System\NkYVudV.exe
  2⤵
  PID:4860
- C:\Windows\System\rjYyGRn.exe
  C:\Windows\System\rjYyGRn.exe
  2⤵
  PID:5040
- C:\Windows\System\ndfDbnW.exe
  C:\Windows\System\ndfDbnW.exe
  2⤵
  PID:4896
- C:\Windows\System\zzXHHVa.exe
  C:\Windows\System\zzXHHVa.exe
  2⤵
  PID:4960
- C:\Windows\System\Phqowlp.exe
  C:\Windows\System\Phqowlp.exe
  2⤵
  PID:5024
- C:\Windows\System\xoDBjCZ.exe
  C:\Windows\System\xoDBjCZ.exe
  2⤵
  PID:5060
- C:\Windows\System\owRHPRr.exe
  C:\Windows\System\owRHPRr.exe
  2⤵
  PID:5076
- C:\Windows\System\VoDcToy.exe
  C:\Windows\System\VoDcToy.exe
  2⤵
  PID:5108
- C:\Windows\System\zCgJDnt.exe
  C:\Windows\System\zCgJDnt.exe
  2⤵
  PID:772
- C:\Windows\System\mXpMPIY.exe
  C:\Windows\System\mXpMPIY.exe
  2⤵
  PID:4160
- C:\Windows\System\cxsIkoM.exe
  C:\Windows\System\cxsIkoM.exe
  2⤵
  PID:4112
- C:\Windows\System\mZUNdlK.exe
  C:\Windows\System\mZUNdlK.exe
  2⤵
  PID:4228
- C:\Windows\System\rKqLsKn.exe
  C:\Windows\System\rKqLsKn.exe
  2⤵
  PID:4192
- C:\Windows\System\iKuMHms.exe
  C:\Windows\System\iKuMHms.exe
  2⤵
  PID:4980
- C:\Windows\System\xNARHFN.exe
  C:\Windows\System\xNARHFN.exe
  2⤵
  PID:2688
- C:\Windows\System\LTGXSIG.exe
  C:\Windows\System\LTGXSIG.exe
  2⤵
  PID:580
- C:\Windows\System\YCiqtAu.exe
  C:\Windows\System\YCiqtAu.exe
  2⤵
  PID:5128
- C:\Windows\System\JLDTShc.exe
  C:\Windows\System\JLDTShc.exe
  2⤵
  PID:5144
- C:\Windows\System\ByyOhOQ.exe
  C:\Windows\System\ByyOhOQ.exe
  2⤵
  PID:5160
- C:\Windows\System\oUCibOq.exe
  C:\Windows\System\oUCibOq.exe
  2⤵
  PID:5176
- C:\Windows\System\JFIcpnS.exe
  C:\Windows\System\JFIcpnS.exe
  2⤵
  PID:5200
- C:\Windows\System\eBnFGKl.exe
  C:\Windows\System\eBnFGKl.exe
  2⤵
  PID:5216
- C:\Windows\System\PUZFZfy.exe
  C:\Windows\System\PUZFZfy.exe
  2⤵
  PID:5232
- C:\Windows\System\ixlLFYQ.exe
  C:\Windows\System\ixlLFYQ.exe
  2⤵
  PID:5248
- C:\Windows\System\YmBHGfa.exe
  C:\Windows\System\YmBHGfa.exe
  2⤵
  PID:5268
- C:\Windows\System\JFpxrFL.exe
  C:\Windows\System\JFpxrFL.exe
  2⤵
  PID:5284
- C:\Windows\System\KdkRlAg.exe
  C:\Windows\System\KdkRlAg.exe
  2⤵
  PID:5300
- C:\Windows\System\ImerLtp.exe
  C:\Windows\System\ImerLtp.exe
  2⤵
  PID:5316
- C:\Windows\System\EZWFJJa.exe
  C:\Windows\System\EZWFJJa.exe
  2⤵
  PID:5336
- C:\Windows\System\zbMaUaq.exe
  C:\Windows\System\zbMaUaq.exe
  2⤵
  PID:5352
- C:\Windows\System\wlBEZLP.exe
  C:\Windows\System\wlBEZLP.exe
  2⤵
  PID:5372
- C:\Windows\System\RIlfgPp.exe
  C:\Windows\System\RIlfgPp.exe
  2⤵
  PID:5420
- C:\Windows\System\qOorVYl.exe
  C:\Windows\System\qOorVYl.exe
  2⤵
  PID:5436
- C:\Windows\System\waJbvqt.exe
  C:\Windows\System\waJbvqt.exe
  2⤵
  PID:5452
- C:\Windows\System\pBOMlnF.exe
  C:\Windows\System\pBOMlnF.exe
  2⤵
  PID:5472
- C:\Windows\System\INwmETG.exe
  C:\Windows\System\INwmETG.exe
  2⤵
  PID:5488
- C:\Windows\System\AXLQUUa.exe
  C:\Windows\System\AXLQUUa.exe
  2⤵
  PID:5504
- C:\Windows\System\QdFOEFt.exe
  C:\Windows\System\QdFOEFt.exe
  2⤵
  PID:5520
- C:\Windows\System\CBOlIrc.exe
  C:\Windows\System\CBOlIrc.exe
  2⤵
  PID:5536
- C:\Windows\System\zhopTzr.exe
  C:\Windows\System\zhopTzr.exe
  2⤵
  PID:5608
- C:\Windows\System\zxFPtME.exe
  C:\Windows\System\zxFPtME.exe
  2⤵
  PID:5660
- C:\Windows\System\FIGGUJt.exe
  C:\Windows\System\FIGGUJt.exe
  2⤵
  PID:5676
- C:\Windows\System\eSDDAkM.exe
  C:\Windows\System\eSDDAkM.exe
  2⤵
  PID:5692
- C:\Windows\System\uQtkrNS.exe
  C:\Windows\System\uQtkrNS.exe
  2⤵
  PID:5708
- C:\Windows\System\LuqUtru.exe
  C:\Windows\System\LuqUtru.exe
  2⤵
  PID:5724
- C:\Windows\System\OBKBRgA.exe
  C:\Windows\System\OBKBRgA.exe
  2⤵
  PID:5740
- C:\Windows\System\LTlhBSU.exe
  C:\Windows\System\LTlhBSU.exe
  2⤵
  PID:5756
- C:\Windows\System\kqOfDEA.exe
  C:\Windows\System\kqOfDEA.exe
  2⤵
  PID:5772
- C:\Windows\System\BaQqEnW.exe
  C:\Windows\System\BaQqEnW.exe
  2⤵
  PID:5788
- C:\Windows\System\QpARkmt.exe
  C:\Windows\System\QpARkmt.exe
  2⤵
  PID:5804
- C:\Windows\System\VETTkAa.exe
  C:\Windows\System\VETTkAa.exe
  2⤵
  PID:5820
- C:\Windows\System\KayCQbJ.exe
  C:\Windows\System\KayCQbJ.exe
  2⤵
  PID:5836
- C:\Windows\System\NOkqFHg.exe
  C:\Windows\System\NOkqFHg.exe
  2⤵
  PID:5852
- C:\Windows\System\FTlGugH.exe
  C:\Windows\System\FTlGugH.exe
  2⤵
  PID:5868
- C:\Windows\System\AnCktwd.exe
  C:\Windows\System\AnCktwd.exe
  2⤵
  PID:5892
- C:\Windows\System\QNfBJcS.exe
  C:\Windows\System\QNfBJcS.exe
  2⤵
  PID:5908
- C:\Windows\System\BaEjgfg.exe
  C:\Windows\System\BaEjgfg.exe
  2⤵
  PID:5924
- C:\Windows\System\OCrKFlY.exe
  C:\Windows\System\OCrKFlY.exe
  2⤵
  PID:5940
- C:\Windows\System\qpTKzxO.exe
  C:\Windows\System\qpTKzxO.exe
  2⤵
  PID:5956
- C:\Windows\System\UfdpeCA.exe
  C:\Windows\System\UfdpeCA.exe
  2⤵
  PID:5972
- C:\Windows\System\ylwYcUt.exe
  C:\Windows\System\ylwYcUt.exe
  2⤵
  PID:5988
- C:\Windows\System\BUnGzXG.exe
  C:\Windows\System\BUnGzXG.exe
  2⤵
  PID:6008
- C:\Windows\System\LIkKvzd.exe
  C:\Windows\System\LIkKvzd.exe
  2⤵
  PID:6024
- C:\Windows\System\FKSQvkN.exe
  C:\Windows\System\FKSQvkN.exe
  2⤵
  PID:6040
- C:\Windows\System\keIzcBp.exe
  C:\Windows\System\keIzcBp.exe
  2⤵
  PID:6056
- C:\Windows\System\mYcevAd.exe
  C:\Windows\System\mYcevAd.exe
  2⤵
  PID:6072
- C:\Windows\System\WSwXZzY.exe
  C:\Windows\System\WSwXZzY.exe
  2⤵
  PID:6088
- C:\Windows\System\eCBRZaQ.exe
  C:\Windows\System\eCBRZaQ.exe
  2⤵
  PID:6116
- C:\Windows\System\yUXEYGZ.exe
  C:\Windows\System\yUXEYGZ.exe
  2⤵
  PID:6132
- C:\Windows\System\klJOsXX.exe
  C:\Windows\System\klJOsXX.exe
  2⤵
  PID:4276
- C:\Windows\System\pHjtmTF.exe
  C:\Windows\System\pHjtmTF.exe
  2⤵
  PID:5088
- C:\Windows\System\NnkAyLh.exe
  C:\Windows\System\NnkAyLh.exe
  2⤵
  PID:1736
- C:\Windows\System\HyzZhwm.exe
  C:\Windows\System\HyzZhwm.exe
  2⤵
  PID:5104
- C:\Windows\System\WUnXJFq.exe
  C:\Windows\System\WUnXJFq.exe
  2⤵
  PID:1932
- C:\Windows\System\YMPwygE.exe
  C:\Windows\System\YMPwygE.exe
  2⤵
  PID:4388
- C:\Windows\System\FiVgtRU.exe
  C:\Windows\System\FiVgtRU.exe
  2⤵
  PID:5136
- C:\Windows\System\BTHHXAR.exe
  C:\Windows\System\BTHHXAR.exe
  2⤵
  PID:4696
- C:\Windows\System\AXqczyZ.exe
  C:\Windows\System\AXqczyZ.exe
  2⤵
  PID:5368
- C:\Windows\System\ryprizg.exe
  C:\Windows\System\ryprizg.exe
  2⤵
  PID:5400
- C:\Windows\System\FVbryQx.exe
  C:\Windows\System\FVbryQx.exe
  2⤵
  PID:4780
- C:\Windows\System\SZIbxqu.exe
  C:\Windows\System\SZIbxqu.exe
  2⤵
  PID:4680
- C:\Windows\System\NTqzrQp.exe
  C:\Windows\System\NTqzrQp.exe
  2⤵
  PID:4700
- C:\Windows\System\TzrwMal.exe
  C:\Windows\System\TzrwMal.exe
  2⤵
  PID:4892
- C:\Windows\System\nSDMPLQ.exe
  C:\Windows\System\nSDMPLQ.exe
  2⤵
  PID:5056
- C:\Windows\System\yLVlPMa.exe
  C:\Windows\System\yLVlPMa.exe
  2⤵
  PID:3696
- C:\Windows\System\WWszjQA.exe
  C:\Windows\System\WWszjQA.exe
  2⤵
  PID:5112
- C:\Windows\System\lIKsUOK.exe
  C:\Windows\System\lIKsUOK.exe
  2⤵
  PID:4876
- C:\Windows\System\ZgQEyfm.exe
  C:\Windows\System\ZgQEyfm.exe
  2⤵
  PID:5188
- C:\Windows\System\XKvHSIo.exe
  C:\Windows\System\XKvHSIo.exe
  2⤵
  PID:5192
- C:\Windows\System\gxkRJul.exe
  C:\Windows\System\gxkRJul.exe
  2⤵
  PID:5360
- C:\Windows\System\QHKlkbX.exe
  C:\Windows\System\QHKlkbX.exe
  2⤵
  PID:5448
- C:\Windows\System\yFdRRIe.exe
  C:\Windows\System\yFdRRIe.exe
  2⤵
  PID:5512
- C:\Windows\System\RPRqqwp.exe
  C:\Windows\System\RPRqqwp.exe
  2⤵
  PID:5556
- C:\Windows\System\rijxoTW.exe
  C:\Windows\System\rijxoTW.exe
  2⤵
  PID:5464
- C:\Windows\System\ulNbDRv.exe
  C:\Windows\System\ulNbDRv.exe
  2⤵
  PID:5500
- C:\Windows\System\BBaDNvi.exe
  C:\Windows\System\BBaDNvi.exe
  2⤵
  PID:5584
- C:\Windows\System\hCtShzA.exe
  C:\Windows\System\hCtShzA.exe
  2⤵
  PID:5604
- C:\Windows\System\kjyIqpm.exe
  C:\Windows\System\kjyIqpm.exe
  2⤵
  PID:5620
- C:\Windows\System\nIbBQBD.exe
  C:\Windows\System\nIbBQBD.exe
  2⤵
  PID:5700
- C:\Windows\System\CEmyBBY.exe
  C:\Windows\System\CEmyBBY.exe
  2⤵
  PID:5764
- C:\Windows\System\SbjUFkz.exe
  C:\Windows\System\SbjUFkz.exe
  2⤵
  PID:5828
- C:\Windows\System\YcbfTld.exe
  C:\Windows\System\YcbfTld.exe
  2⤵
  PID:5900
- C:\Windows\System\HzMTRpw.exe
  C:\Windows\System\HzMTRpw.exe
  2⤵
  PID:5964
- C:\Windows\System\PWCJDsD.exe
  C:\Windows\System\PWCJDsD.exe
  2⤵
  PID:6004
- C:\Windows\System\pariXOp.exe
  C:\Windows\System\pariXOp.exe
  2⤵
  PID:6096
- C:\Windows\System\hywxesQ.exe
  C:\Windows\System\hywxesQ.exe
  2⤵
  PID:6104
- C:\Windows\System\spHpVkb.exe
  C:\Windows\System\spHpVkb.exe
  2⤵
  PID:5652
- C:\Windows\System\dfLIdhS.exe
  C:\Windows\System\dfLIdhS.exe
  2⤵
  PID:4760
- C:\Windows\System\aXNqeOQ.exe
  C:\Windows\System\aXNqeOQ.exe
  2⤵
  PID:6124
- C:\Windows\System\qiIccZA.exe
  C:\Windows\System\qiIccZA.exe
  2⤵
  PID:5748
- C:\Windows\System\sJxiPlL.exe
  C:\Windows\System\sJxiPlL.exe
  2⤵
  PID:5784
- C:\Windows\System\IIdsiZp.exe
  C:\Windows\System\IIdsiZp.exe
  2⤵
  PID:5844
- C:\Windows\System\UwCRNFM.exe
  C:\Windows\System\UwCRNFM.exe
  2⤵
  PID:5884
- C:\Windows\System\uZxmMNw.exe
  C:\Windows\System\uZxmMNw.exe
  2⤵
  PID:5984
- C:\Windows\System\qisRcvD.exe
  C:\Windows\System\qisRcvD.exe
  2⤵
  PID:6080
- C:\Windows\System\AcmrglU.exe
  C:\Windows\System\AcmrglU.exe
  2⤵
  PID:5172
- C:\Windows\System\qFRPrnN.exe
  C:\Windows\System\qFRPrnN.exe
  2⤵
  PID:540
- C:\Windows\System\hynBFJR.exe
  C:\Windows\System\hynBFJR.exe
  2⤵
  PID:1916
- C:\Windows\System\fVMMxLb.exe
  C:\Windows\System\fVMMxLb.exe
  2⤵
  PID:4928
- C:\Windows\System\UKOajJd.exe
  C:\Windows\System\UKOajJd.exe
  2⤵
  PID:5344
- C:\Windows\System\jmaxwpC.exe
  C:\Windows\System\jmaxwpC.exe
  2⤵
  PID:5292
- C:\Windows\System\ZsyugUS.exe
  C:\Windows\System\ZsyugUS.exe
  2⤵
  PID:5396
- C:\Windows\System\FywzMYE.exe
  C:\Windows\System\FywzMYE.exe
  2⤵
  PID:4468
- C:\Windows\System\TsxnioM.exe
  C:\Windows\System\TsxnioM.exe
  2⤵
  PID:1768
- C:\Windows\System\lGNDbTK.exe
  C:\Windows\System\lGNDbTK.exe
  2⤵
  PID:5328
- C:\Windows\System\zDxXryN.exe
  C:\Windows\System\zDxXryN.exe
  2⤵
  PID:5572
- C:\Windows\System\YdnDEBG.exe
  C:\Windows\System\YdnDEBG.exe
  2⤵
  PID:4644
- C:\Windows\System\qaAJuQp.exe
  C:\Windows\System\qaAJuQp.exe
  2⤵
  PID:5068
- C:\Windows\System\MICvKAu.exe
  C:\Windows\System\MICvKAu.exe
  2⤵
  PID:5732
- C:\Windows\System\IwPNJkl.exe
  C:\Windows\System\IwPNJkl.exe
  2⤵
  PID:5544
- C:\Windows\System\EiBcMPH.exe
  C:\Windows\System\EiBcMPH.exe
  2⤵
  PID:5568
- C:\Windows\System\nGmBKBu.exe
  C:\Windows\System\nGmBKBu.exe
  2⤵
  PID:5864
- C:\Windows\System\MlUQeQg.exe
  C:\Windows\System\MlUQeQg.exe
  2⤵
  PID:5668
- C:\Windows\System\giUQdiE.exe
  C:\Windows\System\giUQdiE.exe
  2⤵
  PID:5936
- C:\Windows\System\bUOEcgP.exe
  C:\Windows\System\bUOEcgP.exe
  2⤵
  PID:4424
- C:\Windows\System\dleELDd.exe
  C:\Windows\System\dleELDd.exe
  2⤵
  PID:5644
- C:\Windows\System\vvpSuIf.exe
  C:\Windows\System\vvpSuIf.exe
  2⤵
  PID:764
- C:\Windows\System\erRaTaV.exe
  C:\Windows\System\erRaTaV.exe
  2⤵
  PID:4532
- C:\Windows\System\mWhzpQy.exe
  C:\Windows\System\mWhzpQy.exe
  2⤵
  PID:5812
- C:\Windows\System\ljYwQBZ.exe
  C:\Windows\System\ljYwQBZ.exe
  2⤵
  PID:1908
- C:\Windows\System\aTYNHLJ.exe
  C:\Windows\System\aTYNHLJ.exe
  2⤵
  PID:4836
- C:\Windows\System\yBvxZkq.exe
  C:\Windows\System\yBvxZkq.exe
  2⤵
  PID:5392
- C:\Windows\System\qfpOkgn.exe
  C:\Windows\System\qfpOkgn.exe
  2⤵
  PID:5780
- C:\Windows\System\bacmsRl.exe
  C:\Windows\System\bacmsRl.exe
  2⤵
  PID:5348
- C:\Windows\System\WyYGwYX.exe
  C:\Windows\System\WyYGwYX.exe
  2⤵
  PID:5184
- C:\Windows\System\NmaixfH.exe
  C:\Windows\System\NmaixfH.exe
  2⤵
  PID:6048
- C:\Windows\System\AfdZJGA.exe
  C:\Windows\System\AfdZJGA.exe
  2⤵
  PID:5408
- C:\Windows\System\UQWMfmX.exe
  C:\Windows\System\UQWMfmX.exe
  2⤵
  PID:4404
- C:\Windows\System\nMLapKh.exe
  C:\Windows\System\nMLapKh.exe
  2⤵
  PID:1600
- C:\Windows\System\zTHGUss.exe
  C:\Windows\System\zTHGUss.exe
  2⤵
  PID:4964
- C:\Windows\System\hVNxNLy.exe
  C:\Windows\System\hVNxNLy.exe
  2⤵
  PID:4368
- C:\Windows\System\ASLkIya.exe
  C:\Windows\System\ASLkIya.exe
  2⤵
  PID:5932
- C:\Windows\System\YSUROnm.exe
  C:\Windows\System\YSUROnm.exe
  2⤵
  PID:6000
- C:\Windows\System\OkzZRzk.exe
  C:\Windows\System\OkzZRzk.exe
  2⤵
  PID:4100
- C:\Windows\System\QYFQDjI.exe
  C:\Windows\System\QYFQDjI.exe
  2⤵
  PID:5552
- C:\Windows\System\WhiAqeI.exe
  C:\Windows\System\WhiAqeI.exe
  2⤵
  PID:4052
- C:\Windows\System\eTMPgoZ.exe
  C:\Windows\System\eTMPgoZ.exe
  2⤵
  PID:5244
- C:\Windows\System\HBNlPnp.exe
  C:\Windows\System\HBNlPnp.exe
  2⤵
  PID:5484
- C:\Windows\System\BGHiPpw.exe
  C:\Windows\System\BGHiPpw.exe
  2⤵
  PID:5240
- C:\Windows\System\wRySSzF.exe
  C:\Windows\System\wRySSzF.exe
  2⤵
  PID:5260
- C:\Windows\System\WiMHkNm.exe
  C:\Windows\System\WiMHkNm.exe
  2⤵
  PID:5800
- C:\Windows\System\cqvdjFd.exe
  C:\Windows\System\cqvdjFd.exe
  2⤵
  PID:4320
- C:\Windows\System\RlcpILE.exe
  C:\Windows\System\RlcpILE.exe
  2⤵
  PID:6020
- C:\Windows\System\tkJJiWm.exe
  C:\Windows\System\tkJJiWm.exe
  2⤵
  PID:5952
- C:\Windows\System\rpADvgj.exe
  C:\Windows\System\rpADvgj.exe
  2⤵
  PID:6052
- C:\Windows\System\MMoSmTB.exe
  C:\Windows\System\MMoSmTB.exe
  2⤵
  PID:1200
- C:\Windows\System\SKtocpk.exe
  C:\Windows\System\SKtocpk.exe
  2⤵
  PID:5532
- C:\Windows\System\PNMBxug.exe
  C:\Windows\System\PNMBxug.exe
  2⤵
  PID:2500
- C:\Windows\System\snsijXi.exe
  C:\Windows\System\snsijXi.exe
  2⤵
  PID:5208
- C:\Windows\System\cmekNrV.exe
  C:\Windows\System\cmekNrV.exe
  2⤵
  PID:5880
- C:\Windows\System\YWkeHRZ.exe
  C:\Windows\System\YWkeHRZ.exe
  2⤵
  PID:4256
- C:\Windows\System\azngesJ.exe
  C:\Windows\System\azngesJ.exe
  2⤵
  PID:6152
- C:\Windows\System\RGRiolv.exe
  C:\Windows\System\RGRiolv.exe
  2⤵
  PID:6168
- C:\Windows\System\TlxMegx.exe
  C:\Windows\System\TlxMegx.exe
  2⤵
  PID:6184
- C:\Windows\System\VHIAdPK.exe
  C:\Windows\System\VHIAdPK.exe
  2⤵
  PID:6200
- C:\Windows\System\QYcpOqF.exe
  C:\Windows\System\QYcpOqF.exe
  2⤵
  PID:6216
- C:\Windows\System\YjnRGyn.exe
  C:\Windows\System\YjnRGyn.exe
  2⤵
  PID:6232
- C:\Windows\System\zXrXQwp.exe
  C:\Windows\System\zXrXQwp.exe
  2⤵
  PID:6248
- C:\Windows\System\vjyaCtk.exe
  C:\Windows\System\vjyaCtk.exe
  2⤵
  PID:6264
- C:\Windows\System\QDomzxK.exe
  C:\Windows\System\QDomzxK.exe
  2⤵
  PID:6280
- C:\Windows\System\HfXjOzY.exe
  C:\Windows\System\HfXjOzY.exe
  2⤵
  PID:6296
- C:\Windows\System\jycirIz.exe
  C:\Windows\System\jycirIz.exe
  2⤵
  PID:6312
- C:\Windows\System\bwBSIbh.exe
  C:\Windows\System\bwBSIbh.exe
  2⤵
  PID:6328
- C:\Windows\System\ukJKtjm.exe
  C:\Windows\System\ukJKtjm.exe
  2⤵
  PID:6344
- C:\Windows\System\OitCAGR.exe
  C:\Windows\System\OitCAGR.exe
  2⤵
  PID:6360
- C:\Windows\System\zEaOFLX.exe
  C:\Windows\System\zEaOFLX.exe
  2⤵
  PID:6376
- C:\Windows\System\UWwYWMY.exe
  C:\Windows\System\UWwYWMY.exe
  2⤵
  PID:6392
- C:\Windows\System\zyLksWj.exe
  C:\Windows\System\zyLksWj.exe
  2⤵
  PID:6408
- C:\Windows\System\TqKGILi.exe
  C:\Windows\System\TqKGILi.exe
  2⤵
  PID:6424
- C:\Windows\System\jCGCZjR.exe
  C:\Windows\System\jCGCZjR.exe
  2⤵
  PID:6440
- C:\Windows\System\WWQuAbS.exe
  C:\Windows\System\WWQuAbS.exe
  2⤵
  PID:6456
- C:\Windows\System\ThXGSob.exe
  C:\Windows\System\ThXGSob.exe
  2⤵
  PID:6472
- C:\Windows\System\qejVWxy.exe
  C:\Windows\System\qejVWxy.exe
  2⤵
  PID:6488
- C:\Windows\System\xjLUstT.exe
  C:\Windows\System\xjLUstT.exe
  2⤵
  PID:6504
- C:\Windows\System\WANgVQt.exe
  C:\Windows\System\WANgVQt.exe
  2⤵
  PID:6520
- C:\Windows\System\FSJayvH.exe
  C:\Windows\System\FSJayvH.exe
  2⤵
  PID:6536
- C:\Windows\System\Ztdnsbp.exe
  C:\Windows\System\Ztdnsbp.exe
  2⤵
  PID:6552
- C:\Windows\System\hoWkpIm.exe
  C:\Windows\System\hoWkpIm.exe
  2⤵
  PID:6568
- C:\Windows\System\jhgSdst.exe
  C:\Windows\System\jhgSdst.exe
  2⤵
  PID:6584
- C:\Windows\System\ICkPhHE.exe
  C:\Windows\System\ICkPhHE.exe
  2⤵
  PID:6600
- C:\Windows\System\JFJdyyh.exe
  C:\Windows\System\JFJdyyh.exe
  2⤵
  PID:6616
- C:\Windows\System\EZrlzUY.exe
  C:\Windows\System\EZrlzUY.exe
  2⤵
  PID:6632
- C:\Windows\System\UjApqKz.exe
  C:\Windows\System\UjApqKz.exe
  2⤵
  PID:6648
- C:\Windows\System\uGdRDLn.exe
  C:\Windows\System\uGdRDLn.exe
  2⤵
  PID:6664
- C:\Windows\System\qBOUoWw.exe
  C:\Windows\System\qBOUoWw.exe
  2⤵
  PID:6680
- C:\Windows\System\ykqFrZm.exe
  C:\Windows\System\ykqFrZm.exe
  2⤵
  PID:6700
- C:\Windows\System\ueDUljD.exe
  C:\Windows\System\ueDUljD.exe
  2⤵
  PID:6716
- C:\Windows\System\PmlhOnA.exe
  C:\Windows\System\PmlhOnA.exe
  2⤵
  PID:6732
- C:\Windows\System\SXePmEb.exe
  C:\Windows\System\SXePmEb.exe
  2⤵
  PID:6748
- C:\Windows\System\MTVFhaA.exe
  C:\Windows\System\MTVFhaA.exe
  2⤵
  PID:6764
- C:\Windows\System\Ydrujkd.exe
  C:\Windows\System\Ydrujkd.exe
  2⤵
  PID:6780
- C:\Windows\System\WUwiizK.exe
  C:\Windows\System\WUwiizK.exe
  2⤵
  PID:6796
- C:\Windows\System\qguaJVF.exe
  C:\Windows\System\qguaJVF.exe
  2⤵
  PID:6812
- C:\Windows\System\KhFcfmY.exe
  C:\Windows\System\KhFcfmY.exe
  2⤵
  PID:6828
- C:\Windows\System\lKnsazS.exe
  C:\Windows\System\lKnsazS.exe
  2⤵
  PID:6844
- C:\Windows\System\OuyUzjN.exe
  C:\Windows\System\OuyUzjN.exe
  2⤵
  PID:6864
- C:\Windows\System\SrmYVlx.exe
  C:\Windows\System\SrmYVlx.exe
  2⤵
  PID:6880
- C:\Windows\System\fNexXhS.exe
  C:\Windows\System\fNexXhS.exe
  2⤵
  PID:6896
- C:\Windows\System\QffCEMv.exe
  C:\Windows\System\QffCEMv.exe
  2⤵
  PID:6912
- C:\Windows\System\eBZZrjd.exe
  C:\Windows\System\eBZZrjd.exe
  2⤵
  PID:6928
- C:\Windows\System\OiErLFU.exe
  C:\Windows\System\OiErLFU.exe
  2⤵
  PID:6944
- C:\Windows\System\hxFTeVN.exe
  C:\Windows\System\hxFTeVN.exe
  2⤵
  PID:6960
- C:\Windows\System\aEjkfII.exe
  C:\Windows\System\aEjkfII.exe
  2⤵
  PID:6976
- C:\Windows\System\vHfBpfL.exe
  C:\Windows\System\vHfBpfL.exe
  2⤵
  PID:6992
- C:\Windows\System\UnmleeJ.exe
  C:\Windows\System\UnmleeJ.exe
  2⤵
  PID:7008
- C:\Windows\System\ikNqMWC.exe
  C:\Windows\System\ikNqMWC.exe
  2⤵
  PID:7024
- C:\Windows\System\ahlhxPe.exe
  C:\Windows\System\ahlhxPe.exe
  2⤵
  PID:7040
- C:\Windows\System\yYzNxNT.exe
  C:\Windows\System\yYzNxNT.exe
  2⤵
  PID:7056
- C:\Windows\System\kTqaaNZ.exe
  C:\Windows\System\kTqaaNZ.exe
  2⤵
  PID:6148
- C:\Windows\System\OsHbfkB.exe
  C:\Windows\System\OsHbfkB.exe
  2⤵
  PID:6212
- C:\Windows\System\elkePoM.exe
  C:\Windows\System\elkePoM.exe
  2⤵
  PID:316
- C:\Windows\System\pbncXBI.exe
  C:\Windows\System\pbncXBI.exe
  2⤵
  PID:6288
- C:\Windows\System\NhbALnT.exe
  C:\Windows\System\NhbALnT.exe
  2⤵
  PID:6336
- C:\Windows\System\meNOuno.exe
  C:\Windows\System\meNOuno.exe
  2⤵
  PID:6320
- C:\Windows\System\sKVuyWB.exe
  C:\Windows\System\sKVuyWB.exe
  2⤵
  PID:6164
- C:\Windows\System\fXKPOJl.exe
  C:\Windows\System\fXKPOJl.exe
  2⤵
  PID:6368
- C:\Windows\System\icoKYEA.exe
  C:\Windows\System\icoKYEA.exe
  2⤵
  PID:6404
- C:\Windows\System\GQXzPKG.exe
  C:\Windows\System\GQXzPKG.exe
  2⤵
  PID:6468
- C:\Windows\System\kpJUSjG.exe
  C:\Windows\System\kpJUSjG.exe
  2⤵
  PID:6388
- C:\Windows\System\unDanwz.exe
  C:\Windows\System\unDanwz.exe
  2⤵
  PID:6532
- C:\Windows\System\NaGqStJ.exe
  C:\Windows\System\NaGqStJ.exe
  2⤵
  PID:6516
- C:\Windows\System\nDVHSgd.exe
  C:\Windows\System\nDVHSgd.exe
  2⤵
  PID:6548
- C:\Windows\System\meUWwpS.exe
  C:\Windows\System\meUWwpS.exe
  2⤵
  PID:6576
- C:\Windows\System\czpOGkx.exe
  C:\Windows\System\czpOGkx.exe
  2⤵
  PID:5428
- C:\Windows\System\aUmfDsG.exe
  C:\Windows\System\aUmfDsG.exe
  2⤵
  PID:6728
- C:\Windows\System\OSmgkaZ.exe
  C:\Windows\System\OSmgkaZ.exe
  2⤵
  PID:6696
- C:\Windows\System\IzrZTXI.exe
  C:\Windows\System\IzrZTXI.exe
  2⤵
  PID:6820
- C:\Windows\System\XeMGBaO.exe
  C:\Windows\System\XeMGBaO.exe
  2⤵
  PID:6860
- C:\Windows\System\LPmoWRr.exe
  C:\Windows\System\LPmoWRr.exe
  2⤵
  PID:6924
- C:\Windows\System\UTthTgZ.exe
  C:\Windows\System\UTthTgZ.exe
  2⤵
  PID:6984
- C:\Windows\System\xVpcxFX.exe
  C:\Windows\System\xVpcxFX.exe
  2⤵
  PID:7020
- C:\Windows\System\QpjJmSv.exe
  C:\Windows\System\QpjJmSv.exe
  2⤵
  PID:7108
- C:\Windows\System\RMAcWIM.exe
  C:\Windows\System\RMAcWIM.exe
  2⤵
  PID:7128
- C:\Windows\System\jSlHPHt.exe
  C:\Windows\System\jSlHPHt.exe
  2⤵
  PID:7144
- C:\Windows\System\docCMnv.exe
  C:\Windows\System\docCMnv.exe
  2⤵
  PID:7160
- C:\Windows\System\TnKzAZU.exe
  C:\Windows\System\TnKzAZU.exe
  2⤵
  PID:5720
- C:\Windows\System\oWdkStv.exe
  C:\Windows\System\oWdkStv.exe
  2⤵
  PID:6352
- C:\Windows\System\VEqmAGf.exe
  C:\Windows\System\VEqmAGf.exe
  2⤵
  PID:6240
- C:\Windows\System\ymGDXul.exe
  C:\Windows\System\ymGDXul.exe
  2⤵
  PID:5688
- C:\Windows\System\QbxFNwd.exe
  C:\Windows\System\QbxFNwd.exe
  2⤵
  PID:6448
- C:\Windows\System\RDGOwSc.exe
  C:\Windows\System\RDGOwSc.exe
  2⤵
  PID:6244
- C:\Windows\System\fvqeoch.exe
  C:\Windows\System\fvqeoch.exe
  2⤵
  PID:6304
- C:\Windows\System\beAglGL.exe
  C:\Windows\System\beAglGL.exe
  2⤵
  PID:6608
- C:\Windows\System\GNzeQwN.exe
  C:\Windows\System\GNzeQwN.exe
  2⤵
  PID:6688
- C:\Windows\System\UrfBFHK.exe
  C:\Windows\System\UrfBFHK.exe
  2⤵
  PID:6856
- C:\Windows\System\CpWLkqs.exe
  C:\Windows\System\CpWLkqs.exe
  2⤵
  PID:7064
- C:\Windows\System\eKGsDYm.exe
  C:\Windows\System\eKGsDYm.exe
  2⤵
  PID:6656
- C:\Windows\System\tUdJcfg.exe
  C:\Windows\System\tUdJcfg.exe
  2⤵
  PID:6876
- C:\Windows\System\JafaCWM.exe
  C:\Windows\System\JafaCWM.exe
  2⤵
  PID:6836
- C:\Windows\System\XfQibtz.exe
  C:\Windows\System\XfQibtz.exe
  2⤵
  PID:6776
- C:\Windows\System\fVXCyMi.exe
  C:\Windows\System\fVXCyMi.exe
  2⤵
  PID:6972
- C:\Windows\System\rQucONB.exe
  C:\Windows\System\rQucONB.exe
  2⤵
  PID:6672
- C:\Windows\System\AQiKguQ.exe
  C:\Windows\System\AQiKguQ.exe
  2⤵
  PID:6908
- C:\Windows\System\FfxjlXy.exe
  C:\Windows\System\FfxjlXy.exe
  2⤵
  PID:6936
- C:\Windows\System\rWlnuRR.exe
  C:\Windows\System\rWlnuRR.exe
  2⤵
  PID:7084
- C:\Windows\System\dIjVvDB.exe
  C:\Windows\System\dIjVvDB.exe
  2⤵
  PID:7096
- C:\Windows\System\pOguiMU.exe
  C:\Windows\System\pOguiMU.exe
  2⤵
  PID:7140
- C:\Windows\System\RgwXmvN.exe
  C:\Windows\System\RgwXmvN.exe
  2⤵
  PID:7036
- C:\Windows\System\vPSQuGS.exe
  C:\Windows\System\vPSQuGS.exe
  2⤵
  PID:6512
- C:\Windows\System\KpuwXwx.exe
  C:\Windows\System\KpuwXwx.exe
  2⤵
  PID:6788
- C:\Windows\System\lQfhzeH.exe
  C:\Windows\System\lQfhzeH.exe
  2⤵
  PID:7088
- C:\Windows\System\EpiYVDe.exe
  C:\Windows\System\EpiYVDe.exe
  2⤵
  PID:6840
- C:\Windows\System\bNutWds.exe
  C:\Windows\System\bNutWds.exe
  2⤵
  PID:7092
- C:\Windows\System\IWJsWSX.exe
  C:\Windows\System\IWJsWSX.exe
  2⤵
  PID:6432
- C:\Windows\System\lcPfgGK.exe
  C:\Windows\System\lcPfgGK.exe
  2⤵
  PID:6340
- C:\Windows\System\sqTiHjN.exe
  C:\Windows\System\sqTiHjN.exe
  2⤵
  PID:6484
- C:\Windows\System\jeCjCZh.exe
  C:\Windows\System\jeCjCZh.exe
  2⤵
  PID:6356
- C:\Windows\System\YkcrFtO.exe
  C:\Windows\System\YkcrFtO.exe
  2⤵
  PID:6628
- C:\Windows\System\LRdhDZU.exe
  C:\Windows\System\LRdhDZU.exe
  2⤵
  PID:7000
- C:\Windows\System\QRPqnwx.exe
  C:\Windows\System\QRPqnwx.exe
  2⤵
  PID:6612
- C:\Windows\System\ynKsTar.exe
  C:\Windows\System\ynKsTar.exe
  2⤵
  PID:6640
- C:\Windows\System\LKbSAvB.exe
  C:\Windows\System\LKbSAvB.exe
  2⤵
  PID:6740
- C:\Windows\System\bunFWal.exe
  C:\Windows\System\bunFWal.exe
  2⤵
  PID:6452
- C:\Windows\System\pRAlksh.exe
  C:\Windows\System\pRAlksh.exe
  2⤵
  PID:6436
- C:\Windows\System\XtNdMpZ.exe
  C:\Windows\System\XtNdMpZ.exe
  2⤵
  PID:7176
- C:\Windows\System\DTJSWoK.exe
  C:\Windows\System\DTJSWoK.exe
  2⤵
  PID:7192
- C:\Windows\System\qHMHduh.exe
  C:\Windows\System\qHMHduh.exe
  2⤵
  PID:7212
- C:\Windows\System\gfnwbsO.exe
  C:\Windows\System\gfnwbsO.exe
  2⤵
  PID:7228
- C:\Windows\System\KhZCGhG.exe
  C:\Windows\System\KhZCGhG.exe
  2⤵
  PID:7244
- C:\Windows\System\GESnpdZ.exe
  C:\Windows\System\GESnpdZ.exe
  2⤵
  PID:7260
- C:\Windows\System\rcYaJJU.exe
  C:\Windows\System\rcYaJJU.exe
  2⤵
  PID:7276
- C:\Windows\System\FvYyvzH.exe
  C:\Windows\System\FvYyvzH.exe
  2⤵
  PID:7292
- C:\Windows\System\sUsiCCJ.exe
  C:\Windows\System\sUsiCCJ.exe
  2⤵
  PID:7308
- C:\Windows\System\DYWnWiD.exe
  C:\Windows\System\DYWnWiD.exe
  2⤵
  PID:7324
- C:\Windows\System\TOXVRvY.exe
  C:\Windows\System\TOXVRvY.exe
  2⤵
  PID:7340
- C:\Windows\System\aOqDJxb.exe
  C:\Windows\System\aOqDJxb.exe
  2⤵
  PID:7356
- C:\Windows\System\BYezIVO.exe
  C:\Windows\System\BYezIVO.exe
  2⤵
  PID:7372
- C:\Windows\System\GfPIvFY.exe
  C:\Windows\System\GfPIvFY.exe
  2⤵
  PID:7388
- C:\Windows\System\Mcofgqq.exe
  C:\Windows\System\Mcofgqq.exe
  2⤵
  PID:7404
- C:\Windows\System\OrjINqj.exe
  C:\Windows\System\OrjINqj.exe
  2⤵
  PID:7420
- C:\Windows\System\WXYKMRK.exe
  C:\Windows\System\WXYKMRK.exe
  2⤵
  PID:7436
- C:\Windows\System\ISzuJFX.exe
  C:\Windows\System\ISzuJFX.exe
  2⤵
  PID:7456
- C:\Windows\System\oRSPIva.exe
  C:\Windows\System\oRSPIva.exe
  2⤵
  PID:7472
- C:\Windows\System\YENAOdK.exe
  C:\Windows\System\YENAOdK.exe
  2⤵
  PID:7492
- C:\Windows\System\VSmAhHj.exe
  C:\Windows\System\VSmAhHj.exe
  2⤵
  PID:7532
- C:\Windows\System\ycxpnQn.exe
  C:\Windows\System\ycxpnQn.exe
  2⤵
  PID:7548
- C:\Windows\System\plVGheI.exe
  C:\Windows\System\plVGheI.exe
  2⤵
  PID:7564
- C:\Windows\System\BjKtwdt.exe
  C:\Windows\System\BjKtwdt.exe
  2⤵
  PID:7580
- C:\Windows\System\BWtQLtH.exe
  C:\Windows\System\BWtQLtH.exe
  2⤵
  PID:7596
- C:\Windows\System\WHNXCje.exe
  C:\Windows\System\WHNXCje.exe
  2⤵
  PID:7612
- C:\Windows\System\XeGEUzk.exe
  C:\Windows\System\XeGEUzk.exe
  2⤵
  PID:7632
- C:\Windows\System\AYKMtPJ.exe
  C:\Windows\System\AYKMtPJ.exe
  2⤵
  PID:7648
- C:\Windows\System\SBvflYi.exe
  C:\Windows\System\SBvflYi.exe
  2⤵
  PID:7664
- C:\Windows\System\AcMlffv.exe
  C:\Windows\System\AcMlffv.exe
  2⤵
  PID:7680
- C:\Windows\System\kAIwVyZ.exe
  C:\Windows\System\kAIwVyZ.exe
  2⤵
  PID:7700
- C:\Windows\System\vCJJGAj.exe
  C:\Windows\System\vCJJGAj.exe
  2⤵
  PID:7716
- C:\Windows\System\cEiZQSd.exe
  C:\Windows\System\cEiZQSd.exe
  2⤵
  PID:7732
- C:\Windows\System\ISdFYtw.exe
  C:\Windows\System\ISdFYtw.exe
  2⤵
  PID:7756
- C:\Windows\System\nObAIjA.exe
  C:\Windows\System\nObAIjA.exe
  2⤵
  PID:7792
- C:\Windows\System\zgQBqZi.exe
  C:\Windows\System\zgQBqZi.exe
  2⤵
  PID:7820
- C:\Windows\System\uslWiGn.exe
  C:\Windows\System\uslWiGn.exe
  2⤵
  PID:7836
- C:\Windows\System\YAGShHu.exe
  C:\Windows\System\YAGShHu.exe
  2⤵
  PID:7852
- C:\Windows\System\cexIhHX.exe
  C:\Windows\System\cexIhHX.exe
  2⤵
  PID:7876
- C:\Windows\System\MLfgTLU.exe
  C:\Windows\System\MLfgTLU.exe
  2⤵
  PID:7892
- C:\Windows\System\uQFHZdu.exe
  C:\Windows\System\uQFHZdu.exe
  2⤵
  PID:7908
- C:\Windows\System\iFzyrsI.exe
  C:\Windows\System\iFzyrsI.exe
  2⤵
  PID:7924
- C:\Windows\System\nKMWIbZ.exe
  C:\Windows\System\nKMWIbZ.exe
  2⤵
  PID:7956
- C:\Windows\System\uSBhDED.exe
  C:\Windows\System\uSBhDED.exe
  2⤵
  PID:7980
- C:\Windows\System\FpjjqoG.exe
  C:\Windows\System\FpjjqoG.exe
  2⤵
  PID:7996
- C:\Windows\System\mJROQmo.exe
  C:\Windows\System\mJROQmo.exe
  2⤵
  PID:8012
- C:\Windows\System\jeeJFUM.exe
  C:\Windows\System\jeeJFUM.exe
  2⤵
  PID:8028
- C:\Windows\System\ODujwzB.exe
  C:\Windows\System\ODujwzB.exe
  2⤵
  PID:8044
- C:\Windows\System\xSMalrr.exe
  C:\Windows\System\xSMalrr.exe
  2⤵
  PID:8060
- C:\Windows\System\fOBMsmM.exe
  C:\Windows\System\fOBMsmM.exe
  2⤵
  PID:8076
- C:\Windows\System\NKxDUVm.exe
  C:\Windows\System\NKxDUVm.exe
  2⤵
  PID:8092
- C:\Windows\System\wwtOYDz.exe
  C:\Windows\System\wwtOYDz.exe
  2⤵
  PID:8108
- C:\Windows\System\hRxShrn.exe
  C:\Windows\System\hRxShrn.exe
  2⤵
  PID:8124
- C:\Windows\System\urFIRcN.exe
  C:\Windows\System\urFIRcN.exe
  2⤵
  PID:8144
- C:\Windows\System\fcTjpkh.exe
  C:\Windows\System\fcTjpkh.exe
  2⤵
  PID:8160
- C:\Windows\System\cnzPcyB.exe
  C:\Windows\System\cnzPcyB.exe
  2⤵
  PID:8176
- C:\Windows\System\CQqQpJy.exe
  C:\Windows\System\CQqQpJy.exe
  2⤵
  PID:6256
- C:\Windows\System\tzNxjnE.exe
  C:\Windows\System\tzNxjnE.exe
  2⤵
  PID:7068
- C:\Windows\System\jTHKjLH.exe
  C:\Windows\System\jTHKjLH.exe
  2⤵
  PID:7220
- C:\Windows\System\RgdSDqn.exe
  C:\Windows\System\RgdSDqn.exe
  2⤵
  PID:7288
- C:\Windows\System\ZkzTCzK.exe
  C:\Windows\System\ZkzTCzK.exe
  2⤵
  PID:7444
- C:\Windows\System\qzBKRjQ.exe
  C:\Windows\System\qzBKRjQ.exe
  2⤵
  PID:7452
- C:\Windows\System\OFIoMcr.exe
  C:\Windows\System\OFIoMcr.exe
  2⤵
  PID:7504
- C:\Windows\System\RWfZTPO.exe
  C:\Windows\System\RWfZTPO.exe
  2⤵
  PID:6940
- C:\Windows\System\hdsXRhF.exe
  C:\Windows\System\hdsXRhF.exe
  2⤵
  PID:6276
- C:\Windows\System\QinZDAC.exe
  C:\Windows\System\QinZDAC.exe
  2⤵
  PID:6500
- C:\Windows\System\QyvMLej.exe
  C:\Windows\System\QyvMLej.exe
  2⤵
  PID:7272
- C:\Windows\System\kDCeWdd.exe
  C:\Windows\System\kDCeWdd.exe
  2⤵
  PID:7336
- C:\Windows\System\cKeKrQS.exe
  C:\Windows\System\cKeKrQS.exe
  2⤵
  PID:7524
- C:\Windows\System\iyFFUMJ.exe
  C:\Windows\System\iyFFUMJ.exe
  2⤵
  PID:7468
- C:\Windows\System\zbrWPSC.exe
  C:\Windows\System\zbrWPSC.exe
  2⤵
  PID:7512
- C:\Windows\System\psbovzM.exe
  C:\Windows\System\psbovzM.exe
  2⤵
  PID:7576
- C:\Windows\System\VQRJEcF.exe
  C:\Windows\System\VQRJEcF.exe
  2⤵
  PID:7672
- C:\Windows\System\YktjxBN.exe
  C:\Windows\System\YktjxBN.exe
  2⤵
  PID:7740
- C:\Windows\System\SiHefbT.exe
  C:\Windows\System\SiHefbT.exe
  2⤵
  PID:7556
- C:\Windows\System\ZYonxyL.exe
  C:\Windows\System\ZYonxyL.exe
  2⤵
  PID:7688
- C:\Windows\System\fBAbMmk.exe
  C:\Windows\System\fBAbMmk.exe
  2⤵
  PID:7920
- C:\Windows\System\BQMcnOw.exe
  C:\Windows\System\BQMcnOw.exe
  2⤵
  PID:8136
- C:\Windows\System\aeOKPgT.exe
  C:\Windows\System\aeOKPgT.exe
  2⤵
  PID:8172
- C:\Windows\System\MdxtstV.exe
  C:\Windows\System\MdxtstV.exe
  2⤵
  PID:7284
- C:\Windows\System\RkOplVw.exe
  C:\Windows\System\RkOplVw.exe
  2⤵
  PID:7188
- C:\Windows\System\ftDFfVT.exe
  C:\Windows\System\ftDFfVT.exe
  2⤵
  PID:8116
- C:\Windows\System\fbgVYUM.exe
  C:\Windows\System\fbgVYUM.exe
  2⤵
  PID:8088
- C:\Windows\System\fUsDGyx.exe
  C:\Windows\System\fUsDGyx.exe
  2⤵
  PID:8156
- C:\Windows\System\dSLYTlp.exe
  C:\Windows\System\dSLYTlp.exe
  2⤵
  PID:8188
- C:\Windows\System\BstmHhm.exe
  C:\Windows\System\BstmHhm.exe
  2⤵
  PID:7052
- C:\Windows\System\dJbrpYf.exe
  C:\Windows\System\dJbrpYf.exe
  2⤵
  PID:7208
- C:\Windows\System\TtiRASZ.exe
  C:\Windows\System\TtiRASZ.exe
  2⤵
  PID:7332
- C:\Windows\System\KNNvoDw.exe
  C:\Windows\System\KNNvoDw.exe
  2⤵
  PID:7572
- C:\Windows\System\lCkXCZX.exe
  C:\Windows\System\lCkXCZX.exe
  2⤵
  PID:7368
- C:\Windows\System\ESVmaFR.exe
  C:\Windows\System\ESVmaFR.exe
  2⤵
  PID:7640
- C:\Windows\System\iCyiICy.exe
  C:\Windows\System\iCyiICy.exe
  2⤵
  PID:7540
- C:\Windows\System\sUJlhXm.exe
  C:\Windows\System\sUJlhXm.exe
  2⤵
  PID:7772
- C:\Windows\System\NyaoIIS.exe
  C:\Windows\System\NyaoIIS.exe
  2⤵
  PID:7660
- C:\Windows\System\KkZTfek.exe
  C:\Windows\System\KkZTfek.exe
  2⤵
  PID:7808
- C:\Windows\System\PBxajZd.exe
  C:\Windows\System\PBxajZd.exe
  2⤵
  PID:7784
- C:\Windows\System\zbavLKo.exe
  C:\Windows\System\zbavLKo.exe
  2⤵
  PID:7848
- C:\Windows\System\IrvrtLt.exe
  C:\Windows\System\IrvrtLt.exe
  2⤵
  PID:7916
- C:\Windows\System\YhhPtFd.exe
  C:\Windows\System\YhhPtFd.exe
  2⤵
  PID:7904
- C:\Windows\System\fOPqaBm.exe
  C:\Windows\System\fOPqaBm.exe
  2⤵
  PID:7868
- C:\Windows\System\dkAbWFe.exe
  C:\Windows\System\dkAbWFe.exe
  2⤵
  PID:7968
- C:\Windows\System\YzywpcI.exe
  C:\Windows\System\YzywpcI.exe
  2⤵
  PID:8040
- C:\Windows\System\FADFycw.exe
  C:\Windows\System\FADFycw.exe
  2⤵
  PID:8068
- C:\Windows\System\nkNdqoN.exe
  C:\Windows\System\nkNdqoN.exe
  2⤵
  PID:8132
- C:\Windows\System\tkZxYra.exe
  C:\Windows\System\tkZxYra.exe
  2⤵
  PID:7016
- C:\Windows\System\AMkchHB.exe
  C:\Windows\System\AMkchHB.exe
  2⤵
  PID:8052
- C:\Windows\System\OVQfoPK.exe
  C:\Windows\System\OVQfoPK.exe
  2⤵
  PID:7992
- C:\Windows\System\WfpTFZi.exe
  C:\Windows\System\WfpTFZi.exe
  2⤵
  PID:8120
- C:\Windows\System\fEdzLrh.exe
  C:\Windows\System\fEdzLrh.exe
  2⤵
  PID:7352
- C:\Windows\System\XyshsAH.exe
  C:\Windows\System\XyshsAH.exe
  2⤵
  PID:7240
- C:\Windows\System\oyBQcdH.exe
  C:\Windows\System\oyBQcdH.exe
  2⤵
  PID:7712
- C:\Windows\System\wfqlBdF.exe
  C:\Windows\System\wfqlBdF.exe
  2⤵
  PID:7380
- C:\Windows\System\dhbJjLL.exe
  C:\Windows\System\dhbJjLL.exe
  2⤵
  PID:7628
- C:\Windows\System\KiVPDMY.exe
  C:\Windows\System\KiVPDMY.exe
  2⤵
  PID:7560
- C:\Windows\System\PEqoEbR.exe
  C:\Windows\System\PEqoEbR.exe
  2⤵
  PID:7860
- C:\Windows\System\aRZBJrP.exe
  C:\Windows\System\aRZBJrP.exe
  2⤵
  PID:8100
- C:\Windows\System\yccIZNV.exe
  C:\Windows\System\yccIZNV.exe
  2⤵
  PID:7844
- C:\Windows\System\SpKeWgn.exe
  C:\Windows\System\SpKeWgn.exe
  2⤵
  PID:7964
- C:\Windows\System\UzWyEyG.exe
  C:\Windows\System\UzWyEyG.exe
  2⤵
  PID:8008
- C:\Windows\System\mQSmTRp.exe
  C:\Windows\System\mQSmTRp.exe
  2⤵
  PID:7988
- C:\Windows\System\tsVaSHm.exe
  C:\Windows\System\tsVaSHm.exe
  2⤵
  PID:8184
- C:\Windows\System\ZJHDlFH.exe
  C:\Windows\System\ZJHDlFH.exe
  2⤵
  PID:7936
- C:\Windows\System\oajtCMK.exe
  C:\Windows\System\oajtCMK.exe
  2⤵
  PID:7396
- C:\Windows\System\lqPBsMG.exe
  C:\Windows\System\lqPBsMG.exe
  2⤵
  PID:7268
- C:\Windows\System\jQISXcr.exe
  C:\Windows\System\jQISXcr.exe
  2⤵
  PID:7940
- C:\Windows\System\JmtbCeS.exe
  C:\Windows\System\JmtbCeS.exe
  2⤵
  PID:7780
- C:\Windows\System\cGGqGLs.exe
  C:\Windows\System\cGGqGLs.exe
  2⤵
  PID:7804
- C:\Windows\System\uwFPOku.exe
  C:\Windows\System\uwFPOku.exe
  2⤵
  PID:7864
- C:\Windows\System\UWppBwO.exe
  C:\Windows\System\UWppBwO.exe
  2⤵
  PID:7800
- C:\Windows\System\gQiHRAw.exe
  C:\Windows\System\gQiHRAw.exe
  2⤵
  PID:7944
- C:\Windows\System\YKpSMuI.exe
  C:\Windows\System\YKpSMuI.exe
  2⤵
  PID:7728
- C:\Windows\System\IadrGbz.exe
  C:\Windows\System\IadrGbz.exe
  2⤵
  PID:7348
- C:\Windows\System\JGrRVvY.exe
  C:\Windows\System\JGrRVvY.exe
  2⤵
  PID:8204
- C:\Windows\System\PMqklJJ.exe
  C:\Windows\System\PMqklJJ.exe
  2⤵
  PID:8220
- C:\Windows\System\ywfhSXW.exe
  C:\Windows\System\ywfhSXW.exe
  2⤵
  PID:8236
- C:\Windows\System\TxXzVZx.exe
  C:\Windows\System\TxXzVZx.exe
  2⤵
  PID:8252
- C:\Windows\System\fgcyrAd.exe
  C:\Windows\System\fgcyrAd.exe
  2⤵
  PID:8268
- C:\Windows\System\TTkaSFV.exe
  C:\Windows\System\TTkaSFV.exe
  2⤵
  PID:8284
- C:\Windows\System\bHIdMXq.exe
  C:\Windows\System\bHIdMXq.exe
  2⤵
  PID:8300
- C:\Windows\System\fxKzGYB.exe
  C:\Windows\System\fxKzGYB.exe
  2⤵
  PID:8316
- C:\Windows\System\MRDeuDZ.exe
  C:\Windows\System\MRDeuDZ.exe
  2⤵
  PID:8332
- C:\Windows\System\RKGBzEH.exe
  C:\Windows\System\RKGBzEH.exe
  2⤵
  PID:8348
- C:\Windows\System\eKtdbjr.exe
  C:\Windows\System\eKtdbjr.exe
  2⤵
  PID:8364
- C:\Windows\System\evKcjPI.exe
  C:\Windows\System\evKcjPI.exe
  2⤵
  PID:8380
- C:\Windows\System\edrhEpz.exe
  C:\Windows\System\edrhEpz.exe
  2⤵
  PID:8396
- C:\Windows\System\eWGIuqt.exe
  C:\Windows\System\eWGIuqt.exe
  2⤵
  PID:8416
- C:\Windows\System\zSoAYzH.exe
  C:\Windows\System\zSoAYzH.exe
  2⤵
  PID:8432
- C:\Windows\System\ZLopjsK.exe
  C:\Windows\System\ZLopjsK.exe
  2⤵
  PID:8448
- C:\Windows\System\wcwbunO.exe
  C:\Windows\System\wcwbunO.exe
  2⤵
  PID:8464
- C:\Windows\System\RkfJClH.exe
  C:\Windows\System\RkfJClH.exe
  2⤵
  PID:8480
- C:\Windows\System\szpwmWX.exe
  C:\Windows\System\szpwmWX.exe
  2⤵
  PID:8496
- C:\Windows\System\LPXSIeJ.exe
  C:\Windows\System\LPXSIeJ.exe
  2⤵
  PID:8512
- C:\Windows\System\sgutRPx.exe
  C:\Windows\System\sgutRPx.exe
  2⤵
  PID:8528
- C:\Windows\System\arUyTwR.exe
  C:\Windows\System\arUyTwR.exe
  2⤵
  PID:8544
- C:\Windows\System\qHiGrYS.exe
  C:\Windows\System\qHiGrYS.exe
  2⤵
  PID:8560
- C:\Windows\System\grifPJY.exe
  C:\Windows\System\grifPJY.exe
  2⤵
  PID:8576
- C:\Windows\System\mdisKOc.exe
  C:\Windows\System\mdisKOc.exe
  2⤵
  PID:8592
- C:\Windows\System\bZtfANQ.exe
  C:\Windows\System\bZtfANQ.exe
  2⤵
  PID:8608
- C:\Windows\System\YmXcqPS.exe
  C:\Windows\System\YmXcqPS.exe
  2⤵
  PID:8624
- C:\Windows\System\xeLQsCY.exe
  C:\Windows\System\xeLQsCY.exe
  2⤵
  PID:8640
- C:\Windows\System\nWcqYMP.exe
  C:\Windows\System\nWcqYMP.exe
  2⤵
  PID:8656
- C:\Windows\System\Teucfaw.exe
  C:\Windows\System\Teucfaw.exe
  2⤵
  PID:8672
- C:\Windows\System\vdOxxaH.exe
  C:\Windows\System\vdOxxaH.exe
  2⤵
  PID:8688
- C:\Windows\System\SGafyxZ.exe
  C:\Windows\System\SGafyxZ.exe
  2⤵
  PID:8704
- C:\Windows\System\sXDASNb.exe
  C:\Windows\System\sXDASNb.exe
  2⤵
  PID:8720
- C:\Windows\System\mYggUle.exe
  C:\Windows\System\mYggUle.exe
  2⤵
  PID:8736
- C:\Windows\System\iJEaTSb.exe
  C:\Windows\System\iJEaTSb.exe
  2⤵
  PID:8752
- C:\Windows\System\XtFeUfT.exe
  C:\Windows\System\XtFeUfT.exe
  2⤵
  PID:8768
- C:\Windows\System\WRTIttm.exe
  C:\Windows\System\WRTIttm.exe
  2⤵
  PID:8784
- C:\Windows\System\FuhNkvA.exe
  C:\Windows\System\FuhNkvA.exe
  2⤵
  PID:8800
- C:\Windows\System\jIOPWWr.exe
  C:\Windows\System\jIOPWWr.exe
  2⤵
  PID:8816
- C:\Windows\System\KOFoZTL.exe
  C:\Windows\System\KOFoZTL.exe
  2⤵
  PID:8836
- C:\Windows\System\fcgOBmr.exe
  C:\Windows\System\fcgOBmr.exe
  2⤵
  PID:8856
- C:\Windows\System\CQeJXMH.exe
  C:\Windows\System\CQeJXMH.exe
  2⤵
  PID:8872
- C:\Windows\System\wsnXMac.exe
  C:\Windows\System\wsnXMac.exe
  2⤵
  PID:8888
- C:\Windows\System\vskVNGy.exe
  C:\Windows\System\vskVNGy.exe
  2⤵
  PID:8904
- C:\Windows\System\qwRuciQ.exe
  C:\Windows\System\qwRuciQ.exe
  2⤵
  PID:8920
- C:\Windows\System\QFgZunH.exe
  C:\Windows\System\QFgZunH.exe
  2⤵
  PID:8936
- C:\Windows\System\RIRtnnr.exe
  C:\Windows\System\RIRtnnr.exe
  2⤵
  PID:8952
- C:\Windows\System\sZpPLbC.exe
  C:\Windows\System\sZpPLbC.exe
  2⤵
  PID:8968
- C:\Windows\System\qKflGso.exe
  C:\Windows\System\qKflGso.exe
  2⤵
  PID:8984
- C:\Windows\System\zohyPAN.exe
  C:\Windows\System\zohyPAN.exe
  2⤵
  PID:9000
- C:\Windows\System\gJqZsVx.exe
  C:\Windows\System\gJqZsVx.exe
  2⤵
  PID:9016
- C:\Windows\System\EniKSuV.exe
  C:\Windows\System\EniKSuV.exe
  2⤵
  PID:9032
- C:\Windows\System\mjuyyQb.exe
  C:\Windows\System\mjuyyQb.exe
  2⤵
  PID:9056
- C:\Windows\System\UmgpglV.exe
  C:\Windows\System\UmgpglV.exe
  2⤵
  PID:9076
- C:\Windows\System\qCFOdDR.exe
  C:\Windows\System\qCFOdDR.exe
  2⤵
  PID:9096
- C:\Windows\System\wiFgeII.exe
  C:\Windows\System\wiFgeII.exe
  2⤵
  PID:9112
- C:\Windows\System\huSEwqW.exe
  C:\Windows\System\huSEwqW.exe
  2⤵
  PID:9128
- C:\Windows\System\SRspakY.exe
  C:\Windows\System\SRspakY.exe
  2⤵
  PID:9144
- C:\Windows\System\ZtvfSGS.exe
  C:\Windows\System\ZtvfSGS.exe
  2⤵
  PID:9160
- C:\Windows\System\YXYacLT.exe
  C:\Windows\System\YXYacLT.exe
  2⤵
  PID:9176
- C:\Windows\System\AYACIFX.exe
  C:\Windows\System\AYACIFX.exe
  2⤵
  PID:9192
- C:\Windows\System\LEEMvdB.exe
  C:\Windows\System\LEEMvdB.exe
  2⤵
  PID:9208
- C:\Windows\System\lGouogK.exe
  C:\Windows\System\lGouogK.exe
  2⤵
  PID:8372
- C:\Windows\System\WszYfKG.exe
  C:\Windows\System\WszYfKG.exe
  2⤵
  PID:7748
- C:\Windows\System\VcQYlbx.exe
  C:\Windows\System\VcQYlbx.exe
  2⤵
  PID:8200
- C:\Windows\System\ZHAFmFt.exe
  C:\Windows\System\ZHAFmFt.exe
  2⤵
  PID:8292
- C:\Windows\System\gNvEmpU.exe
  C:\Windows\System\gNvEmpU.exe
  2⤵
  PID:8408
- C:\Windows\System\JSOfbiy.exe
  C:\Windows\System\JSOfbiy.exe
  2⤵
  PID:8476
- C:\Windows\System\WGOoYfJ.exe
  C:\Windows\System\WGOoYfJ.exe
  2⤵
  PID:8536
- C:\Windows\System\iZzJHhf.exe
  C:\Windows\System\iZzJHhf.exe
  2⤵
  PID:8604
- C:\Windows\System\UJfdgsV.exe
  C:\Windows\System\UJfdgsV.exe
  2⤵
  PID:8696
- C:\Windows\System\UoUGpSx.exe
  C:\Windows\System\UoUGpSx.exe
  2⤵
  PID:8456
- C:\Windows\System\MvZWVNQ.exe
  C:\Windows\System\MvZWVNQ.exe
  2⤵
  PID:8792
- C:\Windows\System\uUvUGmi.exe
  C:\Windows\System\uUvUGmi.exe
  2⤵
  PID:8556
- C:\Windows\System\KugHQSt.exe
  C:\Windows\System\KugHQSt.exe
  2⤵
  PID:8620
- C:\Windows\System\ieFYlTj.exe
  C:\Windows\System\ieFYlTj.exe
  2⤵
  PID:8864
- C:\Windows\System\nHynvbO.exe
  C:\Windows\System\nHynvbO.exe
  2⤵
  PID:8896
- C:\Windows\System\USCOqHs.exe
  C:\Windows\System\USCOqHs.exe
  2⤵
  PID:8488
- C:\Windows\System\chmYjtq.exe
  C:\Windows\System\chmYjtq.exe
  2⤵
  PID:8960
- C:\Windows\System\zsknJbp.exe
  C:\Windows\System\zsknJbp.exe
  2⤵
  PID:8684
- C:\Windows\System\tmVSxbZ.exe
  C:\Windows\System\tmVSxbZ.exe
  2⤵
  PID:8776
- C:\Windows\System\rZrVdYP.exe
  C:\Windows\System\rZrVdYP.exe
  2⤵
  PID:8808
- C:\Windows\System\OczRJyV.exe
  C:\Windows\System\OczRJyV.exe
  2⤵
  PID:8852
- C:\Windows\System\AROdmQu.exe
  C:\Windows\System\AROdmQu.exe
  2⤵
  PID:8948
- C:\Windows\System\QFibpVy.exe
  C:\Windows\System\QFibpVy.exe
  2⤵
  PID:8996
- C:\Windows\System\yLLupnG.exe
  C:\Windows\System\yLLupnG.exe
  2⤵
  PID:9008
- C:\Windows\System\lJhgzTP.exe
  C:\Windows\System\lJhgzTP.exe
  2⤵
  PID:9068
- C:\Windows\System\kvacgkR.exe
  C:\Windows\System\kvacgkR.exe
  2⤵
  PID:9072
- C:\Windows\System\DljKcLB.exe
  C:\Windows\System\DljKcLB.exe
  2⤵
  PID:9140
- C:\Windows\System\uVKVYsy.exe
  C:\Windows\System\uVKVYsy.exe
  2⤵
  PID:8056
- C:\Windows\System\gfAeCph.exe
  C:\Windows\System\gfAeCph.exe
  2⤵
  PID:9152
- C:\Windows\System\MDcgLpa.exe
  C:\Windows\System\MDcgLpa.exe
  2⤵
  PID:9088
- C:\Windows\System\IChwlwV.exe
  C:\Windows\System\IChwlwV.exe
  2⤵
  PID:8244
- C:\Windows\System\mbFmONe.exe
  C:\Windows\System\mbFmONe.exe
  2⤵
  PID:8248
- C:\Windows\System\mKwbJBp.exe
  C:\Windows\System\mKwbJBp.exe
  2⤵
  PID:8340
- C:\Windows\System\cJRgAmy.exe
  C:\Windows\System\cJRgAmy.exe
  2⤵
  PID:6708
- C:\Windows\System\dtfBwRe.exe
  C:\Windows\System\dtfBwRe.exe
  2⤵
  PID:8196
- C:\Windows\System\ldYyesg.exe
  C:\Windows\System\ldYyesg.exe
  2⤵
  PID:8328
- C:\Windows\System\FEqLGtg.exe
  C:\Windows\System\FEqLGtg.exe
  2⤵
  PID:8540
- C:\Windows\System\hnnaBhg.exe
  C:\Windows\System\hnnaBhg.exe
  2⤵
  PID:8600
- C:\Windows\System\XWIqily.exe
  C:\Windows\System\XWIqily.exe
  2⤵
  PID:8664
- C:\Windows\System\BHbiMUW.exe
  C:\Windows\System\BHbiMUW.exe
  2⤵
  PID:8588
- C:\Windows\System\iUbzUrE.exe
  C:\Windows\System\iUbzUrE.exe
  2⤵
  PID:8832
- C:\Windows\System\wptFeaK.exe
  C:\Windows\System\wptFeaK.exe
  2⤵
  PID:8932
- C:\Windows\System\TIedhLr.exe
  C:\Windows\System\TIedhLr.exe
  2⤵
  PID:8428
- C:\Windows\System\tuKvyKW.exe
  C:\Windows\System\tuKvyKW.exe
  2⤵
  PID:8912
- C:\Windows\System\AMWNWkX.exe
  C:\Windows\System\AMWNWkX.exe
  2⤵
  PID:9024
- C:\Windows\System\vdIKNyi.exe
  C:\Windows\System\vdIKNyi.exe
  2⤵
  PID:9044
- C:\Windows\System\QUlVpnZ.exe
  C:\Windows\System\QUlVpnZ.exe
  2⤵
  PID:8980
- C:\Windows\System\dasgvag.exe
  C:\Windows\System\dasgvag.exe
  2⤵
  PID:9200
- C:\Windows\System\dfCBmDC.exe
  C:\Windows\System\dfCBmDC.exe
  2⤵
  PID:9040
- C:\Windows\System\xvZAJUq.exe
  C:\Windows\System\xvZAJUq.exe
  2⤵
  PID:8356
- C:\Windows\System\NjiSwbG.exe
  C:\Windows\System\NjiSwbG.exe
  2⤵
  PID:9156
- C:\Windows\System\BnGvLVn.exe
  C:\Windows\System\BnGvLVn.exe
  2⤵
  PID:8440
- C:\Windows\System\IBKgFFb.exe
  C:\Windows\System\IBKgFFb.exe
  2⤵
  PID:8388
- C:\Windows\System\UeFAIqC.exe
  C:\Windows\System\UeFAIqC.exe
  2⤵
  PID:8764
- C:\Windows\System\cMVIygc.exe
  C:\Windows\System\cMVIygc.exe
  2⤵
  PID:8424
- C:\Windows\System\alxuJAN.exe
  C:\Windows\System\alxuJAN.exe
  2⤵
  PID:8024
- C:\Windows\System\SyRwaxs.exe
  C:\Windows\System\SyRwaxs.exe
  2⤵
  PID:8716
- C:\Windows\System\CebPBTQ.exe
  C:\Windows\System\CebPBTQ.exe
  2⤵
  PID:8884
- C:\Windows\System\JrTCfgM.exe
  C:\Windows\System\JrTCfgM.exe
  2⤵
  PID:9172
- C:\Windows\System\oxIVJor.exe
  C:\Windows\System\oxIVJor.exe
  2⤵
  PID:9092
- C:\Windows\System\lIZUzCf.exe
  C:\Windows\System\lIZUzCf.exe
  2⤵
  PID:9136
- C:\Windows\System\QWSOVmf.exe
  C:\Windows\System\QWSOVmf.exe
  2⤵
  PID:8312
- C:\Windows\System\pOuIGhL.exe
  C:\Windows\System\pOuIGhL.exe
  2⤵
  PID:9028
- C:\Windows\System\tbDxbXL.exe
  C:\Windows\System\tbDxbXL.exe
  2⤵
  PID:9104
- C:\Windows\System\efacEdA.exe
  C:\Windows\System\efacEdA.exe
  2⤵
  PID:8520
- C:\Windows\System\QgmERBE.exe
  C:\Windows\System\QgmERBE.exe
  2⤵
  PID:8844
- C:\Windows\System\QuyXZgP.exe
  C:\Windows\System\QuyXZgP.exe
  2⤵
  PID:8260
- C:\Windows\System\BvpYFnZ.exe
  C:\Windows\System\BvpYFnZ.exe
  2⤵
  PID:944
- C:\Windows\System\hTHuTcM.exe
  C:\Windows\System\hTHuTcM.exe
  2⤵
  PID:8928
- C:\Windows\System\twfizJg.exe
  C:\Windows\System\twfizJg.exe
  2⤵
  PID:8728
- C:\Windows\System\uzBYgAV.exe
  C:\Windows\System\uzBYgAV.exe
  2⤵
  PID:9228
- C:\Windows\System\gtfsmSU.exe
  C:\Windows\System\gtfsmSU.exe
  2⤵
  PID:9244
- C:\Windows\System\rHRfTFZ.exe
  C:\Windows\System\rHRfTFZ.exe
  2⤵
  PID:9260
- C:\Windows\System\HWDwQiz.exe
  C:\Windows\System\HWDwQiz.exe
  2⤵
  PID:9276
- C:\Windows\System\ITwENPF.exe
  C:\Windows\System\ITwENPF.exe
  2⤵
  PID:9296
- C:\Windows\System\YvSAQWK.exe
  C:\Windows\System\YvSAQWK.exe
  2⤵
  PID:9312
- C:\Windows\System\JEytqaZ.exe
  C:\Windows\System\JEytqaZ.exe
  2⤵
  PID:9328
- C:\Windows\System\GxCfRWJ.exe
  C:\Windows\System\GxCfRWJ.exe
  2⤵
  PID:9344
- C:\Windows\System\ShzDNbR.exe
  C:\Windows\System\ShzDNbR.exe
  2⤵
  PID:9360
- C:\Windows\System\ZkSFINu.exe
  C:\Windows\System\ZkSFINu.exe
  2⤵
  PID:9376
- C:\Windows\System\qKyiJBt.exe
  C:\Windows\System\qKyiJBt.exe
  2⤵
  PID:9392
- C:\Windows\System\boYYsqP.exe
  C:\Windows\System\boYYsqP.exe
  2⤵
  PID:9408
- C:\Windows\System\mtqciOh.exe
  C:\Windows\System\mtqciOh.exe
  2⤵
  PID:9424
- C:\Windows\System\JzeDaBX.exe
  C:\Windows\System\JzeDaBX.exe
  2⤵
  PID:9440
- C:\Windows\System\fHVJoWW.exe
  C:\Windows\System\fHVJoWW.exe
  2⤵
  PID:9456
- C:\Windows\System\GdIyARG.exe
  C:\Windows\System\GdIyARG.exe
  2⤵
  PID:9472
- C:\Windows\System\EBMwAGX.exe
  C:\Windows\System\EBMwAGX.exe
  2⤵
  PID:9488
- C:\Windows\System\GKnMcEl.exe
  C:\Windows\System\GKnMcEl.exe
  2⤵
  PID:9504
- C:\Windows\System\hoefqks.exe
  C:\Windows\System\hoefqks.exe
  2⤵
  PID:9520
- C:\Windows\System\wyHpCJs.exe
  C:\Windows\System\wyHpCJs.exe
  2⤵
  PID:9568
- C:\Windows\System\rXxsQLT.exe
  C:\Windows\System\rXxsQLT.exe
  2⤵
  PID:9588
- C:\Windows\System\TBSgyKJ.exe
  C:\Windows\System\TBSgyKJ.exe
  2⤵
  PID:9604
- C:\Windows\System\AraTQDP.exe
  C:\Windows\System\AraTQDP.exe
  2⤵
  PID:9624
- C:\Windows\System\wseuyGp.exe
  C:\Windows\System\wseuyGp.exe
  2⤵
  PID:9640
- C:\Windows\System\lfTPhnM.exe
  C:\Windows\System\lfTPhnM.exe
  2⤵
  PID:9656
- C:\Windows\System\AToTbpJ.exe
  C:\Windows\System\AToTbpJ.exe
  2⤵
  PID:9672
- C:\Windows\System\CvhsoLf.exe
  C:\Windows\System\CvhsoLf.exe
  2⤵
  PID:9688
- C:\Windows\System\WakcWYB.exe
  C:\Windows\System\WakcWYB.exe
  2⤵
  PID:9704
- C:\Windows\System\uSGyEnH.exe
  C:\Windows\System\uSGyEnH.exe
  2⤵
  PID:9728
- C:\Windows\System\FrWmXWP.exe
  C:\Windows\System\FrWmXWP.exe
  2⤵
  PID:9744
- C:\Windows\System\wWwzWAv.exe
  C:\Windows\System\wWwzWAv.exe
  2⤵
  PID:9764
- C:\Windows\System\jBjPJqd.exe
  C:\Windows\System\jBjPJqd.exe
  2⤵
  PID:9780
- C:\Windows\System\OYKUGsK.exe
  C:\Windows\System\OYKUGsK.exe
  2⤵
  PID:9796
- C:\Windows\System\duYbGVZ.exe
  C:\Windows\System\duYbGVZ.exe
  2⤵
  PID:9812
- C:\Windows\System\hdemZbS.exe
  C:\Windows\System\hdemZbS.exe
  2⤵
  PID:9828
- C:\Windows\System\uuVpgNA.exe
  C:\Windows\System\uuVpgNA.exe
  2⤵
  PID:9844
- C:\Windows\System\yKBIlPJ.exe
  C:\Windows\System\yKBIlPJ.exe
  2⤵
  PID:9860
- C:\Windows\System\WFsWjMO.exe
  C:\Windows\System\WFsWjMO.exe
  2⤵
  PID:9876
- C:\Windows\System\yDtrtSQ.exe
  C:\Windows\System\yDtrtSQ.exe
  2⤵
  PID:9892
- C:\Windows\System\IvyRrUX.exe
  C:\Windows\System\IvyRrUX.exe
  2⤵
  PID:9920
- C:\Windows\System\EBvxEXy.exe
  C:\Windows\System\EBvxEXy.exe
  2⤵
  PID:9940
- C:\Windows\System\OycpxWv.exe
  C:\Windows\System\OycpxWv.exe
  2⤵
  PID:9956
- C:\Windows\System\lMpyvIO.exe
  C:\Windows\System\lMpyvIO.exe
  2⤵
  PID:9972
- C:\Windows\System\VgFRdWY.exe
  C:\Windows\System\VgFRdWY.exe
  2⤵
  PID:9988
- C:\Windows\System\UWOSPIu.exe
  C:\Windows\System\UWOSPIu.exe
  2⤵
  PID:10004
- C:\Windows\System\oXSSeee.exe
  C:\Windows\System\oXSSeee.exe
  2⤵
  PID:10020
- C:\Windows\System\afCGLNz.exe
  C:\Windows\System\afCGLNz.exe
  2⤵
  PID:10036
- C:\Windows\System\wBxLFgG.exe
  C:\Windows\System\wBxLFgG.exe
  2⤵
  PID:10052
- C:\Windows\System\PtyXBbG.exe
  C:\Windows\System\PtyXBbG.exe
  2⤵
  PID:10068
- C:\Windows\System\DLHmfVz.exe
  C:\Windows\System\DLHmfVz.exe
  2⤵
  PID:10088
- C:\Windows\System\avPMHZL.exe
  C:\Windows\System\avPMHZL.exe
  2⤵
  PID:10104
- C:\Windows\System\HjFaGsN.exe
  C:\Windows\System\HjFaGsN.exe
  2⤵
  PID:10120
- C:\Windows\System\BXpEXPb.exe
  C:\Windows\System\BXpEXPb.exe
  2⤵
  PID:10136
- C:\Windows\System\jdXvXrN.exe
  C:\Windows\System\jdXvXrN.exe
  2⤵
  PID:10152
- C:\Windows\System\MQrRpLK.exe
  C:\Windows\System\MQrRpLK.exe
  2⤵
  PID:10168
- C:\Windows\System\sSpdhmM.exe
  C:\Windows\System\sSpdhmM.exe
  2⤵
  PID:10184
- C:\Windows\System\klpcMzk.exe
  C:\Windows\System\klpcMzk.exe
  2⤵
  PID:10200
- C:\Windows\System\KBKatJc.exe
  C:\Windows\System\KBKatJc.exe
  2⤵
  PID:10216
- C:\Windows\System\VdlzqJa.exe
  C:\Windows\System\VdlzqJa.exe
  2⤵
  PID:10232
- C:\Windows\System\tXyAEBE.exe
  C:\Windows\System\tXyAEBE.exe
  2⤵
  PID:9240
- C:\Windows\System\Wxnhrpf.exe
  C:\Windows\System\Wxnhrpf.exe
  2⤵
  PID:9224
- C:\Windows\System\BjkUYYF.exe
  C:\Windows\System\BjkUYYF.exe
  2⤵
  PID:9292
- C:\Windows\System\edPwhwS.exe
  C:\Windows\System\edPwhwS.exe
  2⤵
  PID:9336
- C:\Windows\System\eLLhzDZ.exe
  C:\Windows\System\eLLhzDZ.exe
  2⤵
  PID:9324
- C:\Windows\System\wljigoR.exe
  C:\Windows\System\wljigoR.exe
  2⤵
  PID:9352
- C:\Windows\System\xzXvqoS.exe
  C:\Windows\System\xzXvqoS.exe
  2⤵
  PID:9384
- C:\Windows\System\vyVymIY.exe
  C:\Windows\System\vyVymIY.exe
  2⤵
  PID:9496
- C:\Windows\System\uaNDFdU.exe
  C:\Windows\System\uaNDFdU.exe
  2⤵
  PID:9420
- C:\Windows\System\SPmjaXz.exe
  C:\Windows\System\SPmjaXz.exe
  2⤵
  PID:9452
- C:\Windows\System\naTXQMx.exe
  C:\Windows\System\naTXQMx.exe
  2⤵
  PID:9532
- C:\Windows\System\Dktbtnw.exe
  C:\Windows\System\Dktbtnw.exe
  2⤵
  PID:9552
- C:\Windows\System\gVafBYE.exe
  C:\Windows\System\gVafBYE.exe
  2⤵
  PID:9564
- C:\Windows\System\CQqceWk.exe
  C:\Windows\System\CQqceWk.exe
  2⤵
  PID:9600
- C:\Windows\System\BuuOanv.exe
  C:\Windows\System\BuuOanv.exe
  2⤵
  PID:9772
- C:\Windows\System\VmUeScg.exe
  C:\Windows\System\VmUeScg.exe
  2⤵
  PID:9696
- C:\Windows\System\DykJtCW.exe
  C:\Windows\System\DykJtCW.exe
  2⤵
  PID:9620
- C:\Windows\System\ygYrkXE.exe
  C:\Windows\System\ygYrkXE.exe
  2⤵
  PID:9836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AcJaSot.exe

Filesize
1.8MB

MD5
3703f4429ab22f93006fffe2a7584c57

SHA1
aa4126db2cf0d32dfb5e140d58df0f09af689212

SHA256
d35258ad09e0c0b136e66f484d14f15fb7c65322d5642610f6e0579e2847cc49

SHA512
044c5f27a6f20fc7f0299fec0a2a430b50c4d49d4f6829815cba9a1d1305640f9101db4ce82ac547da3613b55948645984ab8d01715ee6382b0e555f0b34428a

Download Submit
C:\Windows\system\CYiKpSr.exe

Filesize
1.8MB

MD5
61585126e3f53a29d41ae26db2d2d8c4

SHA1
a676af42ce671cdc3e3152b88758bccddb2e6c3f

SHA256
683528710e2221fea6808c28d9bd24ade5d3fff7fb19b0ad765376478ede247e

SHA512
a6d6ef0200a7a864610a8265314d389a47e9ed249f8c7324d9a48c9c5fde5d10ed1b1902deacd6b4306c7df7af7d0fc440af20dbf566c54f411293623270778e

Download Submit
C:\Windows\system\FVskVWR.exe

Filesize
1.8MB

MD5
07b530e1da944eb269a036fb9cde01d2

SHA1
14480e917db47f65c6ea08f693dbfa64c87fab21

SHA256
6c6a3d63fcf62f6319b715b12d517774f155754617f3d963769667707a5d8350

SHA512
22a57020c9ff1091ec3c9473a60ef7043713ebb6b59c04e5c7a37c84eca4cea0118eb345bf0470aec9f25cb74b99c2eb84f4c88fc4b7b6bf5fc514d479141e9e

Download Submit
C:\Windows\system\GMHQLWd.exe

Filesize
1.8MB

MD5
113637176b6a4f0fd5552a14faadc53b

SHA1
da7ff0d4cd62ea9a6a9dc6dddd1a9a4096a565d1

SHA256
8ea098f2c50580a3f65ae727633476b8a8a247f9cbaabe165fb34e00967e76d1

SHA512
d3a8b6956b24b49ac2fc31d7b9b82896331b2276bc2460f99dc27986c441ab34b24c63dd8a35e5f8f8ecb496c9ead6e669c00ec0305fa860f8115a73a681f15a

Download Submit
C:\Windows\system\LwLBfko.exe

Filesize
1.8MB

MD5
e1428626ffbc49d12adb0eab6c74590a

SHA1
6bcd1e034c5b10c98ab2fad8d966a2d7def993f9

SHA256
e9f6ab88706ae1dc5bc9f0a27c408cedc44302758b65bab327b3b0742fa10f80

SHA512
c0878e0467499c0af6e5d888f6223a72611b4be6228074270ea602b357dfaeec8c1278a73366ae10034fd4b44f641a31adac14b45044a4a4c9ef30078ec510ce

Download Submit
C:\Windows\system\NbtqwNY.exe

Filesize
1.8MB

MD5
9e599616b1473732f7835d19f4708016

SHA1
450f26a47e24ff724d988b3244304e3639ea7071

SHA256
e4d1447180523ee1443e9e02882130f592f38977396c508b275ad4c6b8bed87a

SHA512
93dfa0b1d727211e49753221b534cda2dc5745a556cca0cc87e9eeabaecc998faa1d5566b3746ccb7f45a2d59a49bfec969cbb19794ad337c779fedd1d9af250

Download Submit
C:\Windows\system\RFqNBMx.exe

Filesize
1.8MB

MD5
c9e312cfd0524027dbeeb61bc956e74b

SHA1
1300a7cf0be2703a6b4f1019b46089fab25bff4e

SHA256
f19306a6d4a9fd67c32877ef31554da3f71746c0b609df008e3a023649439c9f

SHA512
0406693c152eb978721d2266a5015d3c5ddfb04817197ceab549acd349ce8c0ced9b89ce25ff14f6c97c0f743d5db0f34b2a2d52defeced0c372381f9edaccb4

Download Submit
C:\Windows\system\SQRdbPH.exe

Filesize
1.8MB

MD5
932541bfe60e913c2a31001c6f652244

SHA1
6381f92a9353e5bcac0ad8fbb078904ae89d07c8

SHA256
3356038836c77c90c6a1c2efd2bf354cbc383c2c0b6bffe0fbde658ed6107a83

SHA512
413af0bcd4783d76dc06e2f692560f5769f1a271ac4983b59130a3334394fe7f05131ce4352b00eb5e134567efb35bddaadf929ea8c5825001ba903b5130f367

Download Submit
C:\Windows\system\WeopNnE.exe

Filesize
1.8MB

MD5
7c549096b82de6897eabaf34afae587e

SHA1
e3d26fcc6809207fab02a4426235d1d9ed9719de

SHA256
8a46471bb1a012a7de45b736593aeba38eb788c6f06daf1937a691ea4bc7fb9f

SHA512
a4d7f1cbf18f75f53b94616f721575a07b61d92a05ab56241e56d7d1e1d61ee77bd129702e7518fe9b02adfd7c2dc278d4893a2209ade07aca937116fdd6efea

Download Submit
C:\Windows\system\Wtuembp.exe

Filesize
1.8MB

MD5
16432584d9c9cf9e75ddfc25dcfb350c

SHA1
47f606c4a16dd069d46884f04dd192afe6294255

SHA256
7f9399d7cf724dbdcd7e2665db8cb4280ed9a5a88a87f9abea69c6203b32cd01

SHA512
b4b57728329fcb12493157e209cc388f975016dbc0cc67d6e18351737b43a9b8c3b944e4bcfba3ebc8a9986159a7c881022016ab26bceb13f8d0f9f5ab186c83

Download Submit
C:\Windows\system\XhIvDsy.exe

Filesize
1.8MB

MD5
7e2eb14996e9f273f7407b071ac24d37

SHA1
79005e8b6561755a76c5705bed7f2b55910915c7

SHA256
942a5a0888f926987e56f31d3d5d337460492d3a88ae335a3170267665f5c412

SHA512
88d2eb1e10d8850c90eaf84879fabbfae804e07085564c9b483fd565e170907d0fc801e33877c622b7152e455bdd27c960419833fe7e1a19b2bc6bef3295f13f

Download Submit
C:\Windows\system\ZZDNyLl.exe

Filesize
1.8MB

MD5
8246f300573729b6a463f0ef5c2b8f42

SHA1
7df8919920534fc14b266df1fa98a48f90df6eb3

SHA256
cbfa54d4e87d1ed752a002b931734797646ba066e6c39d687cf6750050fcda7f

SHA512
6bbc3d48ad1036c91e968a84cee47fa0e85a54ecb0fbda4dc5842a3ca34cbbf537abcd2172b60c77bea1e6b1fe90403c7d94fb72b16448c06280f608dcd44759

Download Submit
C:\Windows\system\ZzDHPxV.exe

Filesize
1.8MB

MD5
c798ecf18e5edfbee601ec638d2da477

SHA1
c6ff7218206c5c2777ab975b4fcc5e0bd5de4067

SHA256
84edb576dc7a97d0013df14d5dd0830011492a80606b682beccdc8ea7dd4146e

SHA512
7304f71a8e82d003d7f8cc9dbef23aece986b2237cc7f89fc8f0581ef9996af6e55013f973df74af3c63b4ff1f0c3741cc94e5580a9e03590781a90e76a8ff25

Download Submit
C:\Windows\system\cyBTfyJ.exe

Filesize
1.8MB

MD5
bca6de5ae2b02a0db3d306536727b48b

SHA1
66cc1a95b2ef2ce90c0655544376e994683b7e4f

SHA256
63da65abe66453ec54696747026fe144e3ec9921b347b404d82a1bb02d8ea38b

SHA512
c0b6560392674e924a3ba2744e988a2e7f830b76a67ce8015e2c73931849bb9a7d9de393d40a40d505647658d593fbf32be44f6e5560e4a491613d49156d070e

Download Submit
C:\Windows\system\ebbZQON.exe

Filesize
1.8MB

MD5
a81fa6157c39c939a42e661e42c6c474

SHA1
0bbe80f1ed856fc02e3a1982e1667f3dd41bef38

SHA256
5414efb65c398612ac3e1845ee043e37eb511994e19d3a58e21f0574f5af6dbc

SHA512
83076562856bdcabc6373fc3f0fadc950bdecc6d212e47b5aac53bcc7c495cc5f8fa04f8767e51067cdd530b1c43a82906ba44c890da45ac0c1cc9bb9850dcf1

Download Submit
C:\Windows\system\exlnzOD.exe

Filesize
1.8MB

MD5
962d4bf7051c5d7b7f273ab2520e3dfa

SHA1
319833d763c0891a7d5eb8fdd48c8b7d6eca7921

SHA256
6f0266df86b5108623d331fb274451af7f5e4a90adc9456512cb0e8943dd6fc8

SHA512
970340907f26c8c1329916b6e316b060fdad8e295060ae73df8e39a65223b3e45154519fea71b58972bc82494a917392221c8069577bb696b8e307fb22a58405

Download Submit
C:\Windows\system\ezhsKNv.exe

Filesize
1.8MB

MD5
2c0623add27eebb8d31e753ae8d489ee

SHA1
a1ba5e0e7bb70370358a4504e09bd4a60bd2796a

SHA256
54a46105b13a5015741958bdcfb4c47f34cf3196a91f3d8ee44ad5642d444864

SHA512
ebb98010d080244311e0b7f7c41c09bb7d39781ba168449c7d047adc4d4c7870cf809c9447ace941fe95f174d2f31602c0d86cc893ba91d26af678c19dd9501c

Download Submit
C:\Windows\system\fcshmOv.exe

Filesize
1.8MB

MD5
60d92a5666fd255bd8249c8cf31cecac

SHA1
93c8c1024a11d98a1000c7efbde080b8bdd09e52

SHA256
f99487b74423004b2a6182492107e1109ddb304747973886d9d84a11c39a7774

SHA512
9f8ed12efe63511817cb8033f57f0de5b221e844c6944ab5709c0b3cafb81371fabebe2a6a86af36aca1060e6db74ca4946581672ec6b8030eaf55df6a3b9f0d

Download Submit
C:\Windows\system\fetaAsX.exe

Filesize
1.8MB

MD5
94dfea7643431651914f7a1332d7671c

SHA1
1b01cab477ef36737ca4fbf28b425970b90c7298

SHA256
fe7195c0b856ff7346e08a7ed58651c83fc1c9e4d95d950dd4005fcec353a536

SHA512
d957c21d50ec268010eabc483f86f1e06e8a65258c26dee67736258e70ac461e38e27590b41cc404d69deedea569328e63490a00bb2117cbe86e719dc1b31599

Download Submit
C:\Windows\system\miywffr.exe

Filesize
1.8MB

MD5
6643823b1f454fe2de413a30f491d2f5

SHA1
7ca111376ba32ca3eb30983a8dcb59bf1a03cecf

SHA256
4f0a62f320dfa69445163f6761ad0e06c6ba52e3576adad5fdf45448f1b16104

SHA512
5da7fe9ecdc8c74b1465998e2a4b248108fd75568700f689e652b4ef501a2887a74bed83fb8dae3cd69ad0ac260efc0364b19c7c9ca2580d9504e8a7b87e7029

Download Submit
C:\Windows\system\nXxYbEC.exe

Filesize
1.8MB

MD5
0067fa700b986f01535bc4a57cde94fe

SHA1
2862efc1553245eedf18a69518fbdf8d54777004

SHA256
7b67803ef4610f20fefad078b5764f026359a62289ac54f13f076ec5c2239200

SHA512
510232261af810b94ec342664849323eb42ca2e28d5bbf3b41e391c3962587760abd27e4d7147da00f5a2bff623f44ed96224083fb75ca1ee729692db81bfd32

Download Submit
C:\Windows\system\sTxYdKc.exe

Filesize
1.8MB

MD5
15a80ec36103aa52021fd60c51d14578

SHA1
1aa9e86b77affe2e03125622a89cb13f74bde4c7

SHA256
d91344055467e4fe3643ad4a4c422d3aa1d20a06c674658c69bbfe42c99da49b

SHA512
85bb34166b1ad5a353f303704a0733acd5a3910d7a8d0ac8e6fa3e54bf75a8e89fbd116838d35d1e765001c63c6e682a12728529b89091fb7f9d81a49d6604b0

Download Submit
C:\Windows\system\uIXttGN.exe

Filesize
1.8MB

MD5
6091dca3f4fda75c340e81863af0c4b8

SHA1
65d31e02995a70499c8e5f2b034cb5c23e53f298

SHA256
ac63acd21f3d03a8047cb2993bfded694ebacf0ae8f5003e46ffe97893399589

SHA512
2da336651b4f7131a12c60e24dbe15d1e089d50206590535ba90de3a36d1cfbd12383712c1cde1f1b9051037be3891d0f43e2a442132709736c8546ef6c9452d

Download Submit
C:\Windows\system\uPzreTO.exe

Filesize
1.8MB

MD5
a40f0877a570b9adcd494272d474ccd7

SHA1
64e76612824ca5f3417b198872ddd318b239bbb2

SHA256
f2df3646d74dda18366d834dc30f8e2af8d8a2682565879990c0e557c569ebfa

SHA512
9e32c071c6398cef7d339014553ba81ad80a63c91e8413b877424966655dfd49e99bc60479524cf29c8d9a1280da97432fdd7bddfc0e2e573374b0140e2a4299

Download Submit
C:\Windows\system\vxAmFYT.exe

Filesize
1.8MB

MD5
46e0e24993826642186c0db9576d0694

SHA1
ec679ff90be2f4c89d65b4e127f5a9114d54a9ad

SHA256
d07a7f64dc0f1f3372072cf31ef1e21eb4c1a33c27fe9a10f9b1125a93a2a06b

SHA512
c93be82bb39fc96af5a28ba903d4fe1c84e7b9a5ad056d0f747e3fd96f09afe917d2e857135c55b03cd94d3b4c4cc955dc4d0dbbdf7c0be0da3e13e0f2954915

Download Submit
C:\Windows\system\yDZGEDe.exe

Filesize
1.8MB

MD5
778917bf3f4c94f8c97c080016d8ca38

SHA1
8efcce3c8f1b66300ce9623b5c6a9f8c17fe62ee

SHA256
4fdec4452b35f1a9a04eff99c142d7f97bc34195c7840beab617fd8313569746

SHA512
0976251bb87f3f20a9b3700e2878f843047d607a9728214cb12cf1a2280cf76eaa64d0938cbc63bd0e42703c5bddbbada3a1dd93001351ffdfb1ff483b3ceca0

Download Submit
\Windows\system\FZfWFiE.exe

Filesize
1.8MB

MD5
dc6570de49ec3e23e72c2114d1b7af5d

SHA1
38aef06b6df379faac9f4a8d6b76baaa3dbd34d4

SHA256
4134872fcaaba68eecf8723151efdc01221de11a281c13676a91e8fcd7fb8229

SHA512
1386f62f3845cb2645b25169672a85ab0f4fb689079f3c3d266469b353a8daee041920e2c5d8cc80f3063e8d10141349a971b2db6d2f6d1d8e08ac5968fda023

Download Submit
\Windows\system\LGaYiKl.exe

Filesize
1.8MB

MD5
a22cdbe0c0828514c1df1cd86f5b307d

SHA1
67c3dbaa7ca554469e5e4cb2eb10a22596a2bb34

SHA256
4269c288d88779ea7b056d14b4650026b3375e7bea1b58c61741c764da706dc3

SHA512
3d30221e474a23ca908f18c517a1bd5534e5b54210b6e9538a7db86ae15c50cbf3d4b2f163d2bface3e14930d5a6f34b1bb7be29e159328c050834d98a22417d

Download Submit
\Windows\system\SIucdPk.exe

Filesize
1.8MB

MD5
2b673a810246ceca9a6c61f6dddd01b6

SHA1
1c19ac90dea234793ffe41bd06194086ba20c9d6

SHA256
4cdaa2e6de28a3e05ff2261e4dd3060ca0ae1e4ed45345d71823ddf163f41bc1

SHA512
fc3e315f14e3be6cac18c03a7be4d133d47f9230956eccb546aae8b6231bc81f876769ca6b842df511ca4f80abb553f740c78af9bcbc75a304190ab3e5bae41d

Download Submit
\Windows\system\lGoaLgg.exe

Filesize
1.8MB

MD5
f9963c46f6b3ead95e73f0ff83d0a155

SHA1
0974119613dcf37d33ebc3d6f539aba65de0ab50

SHA256
479a723a92c81cd4c3561bd13f0962d4b7dd7362bc8d82e9ad08d821d4417ddb

SHA512
61dd8b70f5f9117af62bbdd0923f33feb1238774e3d77095335ceae3c48c5ccab9e26872654760271858fed1e58fb30f696cda2d77a64aca511fc2f223855766

Download Submit
\Windows\system\wDfNeAw.exe

Filesize
1.8MB

MD5
b4d015ded31efabeb0dacfa14cfc49da

SHA1
508e455a7ecf61eda062f57ec41fbc4141fd7b5d

SHA256
7d8df9704722fd3bba491e06927ff554690fae230bf97499c9cdb39f363b5491

SHA512
392bde3197b8c4c2b577713618e92f6e49d43c5dd99e85ad35de768588794b9b93aea60ea1323b6ce10ae666de22fe4313c1246c7b088f3d511f9e46b70ccca3

Download Submit
\Windows\system\wmCzsTT.exe

Filesize
1.8MB

MD5
6cc69b67f74c65e5d62e392b4794903d

SHA1
a0d966b3b6ba30112f208cf9731dac8c30eef958

SHA256
a6a73b7e270dd3c9c95fab1787c42869474244d2cb127ba35442920b7ad88dd1

SHA512
4e3a8875301f9bfa0dc0ed578eae74dcf7630d00b800a0841070bf3138d9d1262bd4019ad9d23d2ad2b064be7ed28894056f1aba55f19c6508a8f148b215e1ec

Download Submit
memory/296-4080-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/296-98-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-4626-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1536-93-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-4627-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/1552-92-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2172-45-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-36-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-46-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-28-0x000007FEF55EE000-0x000007FEF55EF000-memory.dmp

Filesize
4KB

Download
memory/2172-27-0x0000000002B60000-0x0000000002BE0000-memory.dmp

Filesize
512KB

Download
memory/2172-218-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-90-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2172-29-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2172-30-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2196-64-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2196-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2196-94-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-43-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2196-1-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2196-91-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2196-40-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-80-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-76-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2196-66-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2196-14-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2196-97-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2196-58-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2196-24-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2196-47-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2208-48-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-4622-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-4620-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2580-18-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2612-41-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-4691-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-4623-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2696-79-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2740-4625-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2740-25-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2764-26-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2764-4631-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2848-4624-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2848-77-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2988-65-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2988-4621-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/3020-60-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download