xmrig | 5f29fdce7d7219a4254df1cfb76c51aef410fdb0291fa7aa9d59e35e8ae3f098

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
Size

1.7MB
MD5

c8e96e9d6204272108db8dcc8dd01da0
SHA1

b59dbea42bdd3e77a092eaadf80a3f7359bd29ee
SHA256

5f29fdce7d7219a4254df1cfb76c51aef410fdb0291fa7aa9d59e35e8ae3f098
SHA512

6e005160a2e331133217ef7bf47b59450d105f757481a52887e9245325e75599cfba2cac70d5b2cd668839a0af1231103b34c529adf1eaef7b5f215678678e86
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1V8:NABr

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 18 IoCs

miner

resource	yara_rule
behavioral1/memory/1560-77-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2612-84-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2524-216-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2992-94-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2708-90-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2108-80-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2504-57-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2524-55-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2740-41-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2504-5522-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2108-5523-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig
behavioral1/memory/2612-5524-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2992-5525-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2564-5532-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/1544-5531-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2740-5530-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2708-5529-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2188-5528-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2108	uJEUGMd.exe
2708	owruLsZ.exe
2612	OQfpnAZ.exe
2740	bzTwLSD.exe
2992	zGyASCZ.exe
2524	jYXUwhd.exe
2504	tyxUUCx.exe
2564	orvNDUl.exe
2188	EzIIXKi.exe
1544	fNzAGrk.exe
1876	HzqaLjG.exe
2152	JYQzIpe.exe
2200	JQgHaKB.exe
1768	kjvlTFW.exe
1016	nKPyWKX.exe
296	eRKdFQA.exe
1252	rqZYxLC.exe
1264	SbEeusr.exe
2028	gxeVIFI.exe
2764	ItKOrvb.exe
2328	YknXKAx.exe
2916	MREaNJj.exe
2352	lTDoObO.exe
552	dybUdIa.exe
592	SePkcfu.exe
1416	DJCahVZ.exe
2464	moDJtjc.exe
1488	KaGWFFS.exe
912	jmlJvVM.exe
3004	HFMmGST.exe
2960	vxkGvYa.exe
2836	vrCanpt.exe
956	iiRluRA.exe
2976	eSgdwtQ.exe
316	XnzKyww.exe
2132	vhbfHoW.exe
2572	EnmxYZd.exe
340	NovgDCE.exe
1724	WxXGDVA.exe
2944	TTqFLrx.exe
1436	nzdPeLe.exe
2236	qgEeTMS.exe
3032	KNCawpL.exe
1584	lHCCzyQ.exe
2760	nnQNvyB.exe
2640	HaFYnBx.exe
2652	LbJAlym.exe
2900	DfXYMGD.exe
2400	iSJOlSV.exe
1580	yKGIQGx.exe
628	GSbWRhl.exe
2472	bvcVMBP.exe
2120	mvaJSme.exe
1232	EOIaMfW.exe
2552	wmKOkTr.exe
1112	CJDtRlx.exe
1220	GJOyULo.exe
2460	kLeODbO.exe
1320	FFPkbHl.exe
2932	KOABBNJ.exe
1532	DPSZxco.exe
2724	UoqDfeR.exe
1892	StdvqBs.exe
2372	xtGkyIh.exe

Loads dropped DLL 64 IoCs

pid	Process
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe

UPX packed file 60 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1560-0-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-3.dat	upx
behavioral1/files/0x0035000000015c82-12.dat	upx
behavioral1/files/0x0008000000015cf3-29.dat	upx
behavioral1/memory/2708-23-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/files/0x0009000000015d13-49.dat	upx
behavioral1/files/0x0007000000015cfd-32.dat	upx
behavioral1/files/0x0008000000015cd6-26.dat	upx
behavioral1/files/0x000f000000003683-25.dat	upx
behavioral1/files/0x0006000000016a7d-65.dat	upx
behavioral1/files/0x0008000000016824-61.dat	upx
behavioral1/memory/2188-67-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/1560-77-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x0006000000016c5d-76.dat	upx
behavioral1/memory/1544-78-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/files/0x0006000000016c4a-81.dat	upx
behavioral1/memory/2612-84-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2564-62-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x0006000000016c67-95.dat	upx
behavioral1/files/0x0006000000016d1a-118.dat	upx
behavioral1/files/0x0006000000016d22-123.dat	upx
behavioral1/files/0x0006000000016d44-144.dat	upx
behavioral1/files/0x0006000000016d70-170.dat	upx
behavioral1/files/0x0006000000016d6c-162.dat	upx
behavioral1/files/0x0006000000016d55-151.dat	upx
behavioral1/files/0x0006000000016d68-158.dat	upx
behavioral1/files/0x0006000000016da0-181.dat	upx
behavioral1/memory/2524-216-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x00060000000171ba-196.dat	upx
behavioral1/files/0x0006000000016d78-176.dat	upx
behavioral1/files/0x0006000000016dc8-188.dat	upx
behavioral1/files/0x0006000000016d4c-148.dat	upx
behavioral1/files/0x0006000000016d33-133.dat	upx
behavioral1/files/0x0006000000016d3b-137.dat	upx
behavioral1/files/0x0006000000016d2b-128.dat	upx
behavioral1/files/0x0006000000016d05-114.dat	upx
behavioral1/files/0x0006000000016cde-109.dat	upx
behavioral1/files/0x0034000000015c8c-103.dat	upx
behavioral1/files/0x0006000000016caf-98.dat	upx
behavioral1/memory/2992-94-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2708-90-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/1876-85-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2108-80-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2504-57-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2524-55-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2992-54-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2740-41-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2612-36-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2108-8-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x0006000000016dd1-190.dat	upx
behavioral1/files/0x0006000000016db2-182.dat	upx
behavioral1/memory/2504-5522-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2108-5523-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/memory/2612-5524-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2992-5525-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2564-5532-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/1544-5531-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2740-5530-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2708-5529-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2188-5528-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RqZayoB.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\gVvLAPk.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\PbElZda.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\sKNlbqX.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\qbiIVhj.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\FVwkScP.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\LYsUOzY.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\KUACLZd.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\YAZnlcE.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\QgGRTMR.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\NhfnhRO.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\VEWuFyd.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\YzihhxU.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\nFHziYl.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\rmityeu.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\lGcimor.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\UsRcTGH.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\oODHVoj.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\QDYEciQ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\gaVesWU.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\vvkkzpc.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\letqIER.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\EUVqYed.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\AGKKsga.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\omsixtX.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\atQwvkT.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\UFHchhW.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\IvkxWfN.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\IEFJfIB.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\lJRqZwv.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\xcrfHKP.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\OAFAfSQ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\QsUrcOA.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\kybuOkO.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\CMecPQp.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\DSrVJjm.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\MpKzVTw.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\itonyVc.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\XShThjL.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\HJRBzEq.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\QaJWwvu.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\uaPIzbU.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\vmJGmPv.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\gEgxRLw.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\opUYwKS.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\wfsziMq.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\snuYjxW.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\qrzLxwZ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\lJHXKWj.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\AWNiplJ.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\erpLYFA.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\rrSZtcK.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\OWDtOIK.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\roiFlcK.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\yECZFzk.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\oOJXoxu.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\PVYebPe.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\jDfKyMT.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\WZFTOAP.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\DGikrSg.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\MzycSDn.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\lPNSGGA.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\JEutJVl.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
File created	C:\Windows\System\dDSCDeR.exe	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2752	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2752	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2752	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	29
PID 1560 wrote to memory of 2752	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	29
PID 1560 wrote to memory of 2752	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	29
PID 1560 wrote to memory of 2108	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	30
PID 1560 wrote to memory of 2108	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	30
PID 1560 wrote to memory of 2108	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	30
PID 1560 wrote to memory of 2708	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	31
PID 1560 wrote to memory of 2708	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	31
PID 1560 wrote to memory of 2708	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	31
PID 1560 wrote to memory of 2612	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	32
PID 1560 wrote to memory of 2612	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	32
PID 1560 wrote to memory of 2612	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	32
PID 1560 wrote to memory of 2992	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	33
PID 1560 wrote to memory of 2992	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	33
PID 1560 wrote to memory of 2992	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	33
PID 1560 wrote to memory of 2740	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	34
PID 1560 wrote to memory of 2740	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	34
PID 1560 wrote to memory of 2740	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	34
PID 1560 wrote to memory of 2524	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	35
PID 1560 wrote to memory of 2524	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	35
PID 1560 wrote to memory of 2524	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	35
PID 1560 wrote to memory of 2504	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	36
PID 1560 wrote to memory of 2504	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	36
PID 1560 wrote to memory of 2504	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	36
PID 1560 wrote to memory of 2564	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	37
PID 1560 wrote to memory of 2564	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	37
PID 1560 wrote to memory of 2564	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	37
PID 1560 wrote to memory of 2188	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	38
PID 1560 wrote to memory of 2188	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	38
PID 1560 wrote to memory of 2188	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	38
PID 1560 wrote to memory of 1876	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	39
PID 1560 wrote to memory of 1876	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	39
PID 1560 wrote to memory of 1876	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	39
PID 1560 wrote to memory of 1544	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	40
PID 1560 wrote to memory of 1544	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	40
PID 1560 wrote to memory of 1544	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	40
PID 1560 wrote to memory of 2152	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	41
PID 1560 wrote to memory of 2152	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	41
PID 1560 wrote to memory of 2152	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	41
PID 1560 wrote to memory of 2200	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	42
PID 1560 wrote to memory of 2200	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	42
PID 1560 wrote to memory of 2200	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	42
PID 1560 wrote to memory of 1768	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	43
PID 1560 wrote to memory of 1768	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	43
PID 1560 wrote to memory of 1768	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	43
PID 1560 wrote to memory of 1016	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	44
PID 1560 wrote to memory of 1016	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	44
PID 1560 wrote to memory of 1016	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	44
PID 1560 wrote to memory of 296	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	45
PID 1560 wrote to memory of 296	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	45
PID 1560 wrote to memory of 296	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	45
PID 1560 wrote to memory of 1252	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	46
PID 1560 wrote to memory of 1252	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	46
PID 1560 wrote to memory of 1252	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	46
PID 1560 wrote to memory of 1264	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	47
PID 1560 wrote to memory of 1264	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	47
PID 1560 wrote to memory of 1264	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	47
PID 1560 wrote to memory of 2028	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	48
PID 1560 wrote to memory of 2028	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	48
PID 1560 wrote to memory of 2028	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	48
PID 1560 wrote to memory of 2764	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	49
PID 1560 wrote to memory of 2764	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	49
PID 1560 wrote to memory of 2764	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	49
PID 1560 wrote to memory of 2328	1560	c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe	50

C:\Users\Admin\AppData\Local\Temp\c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c8e96e9d6204272108db8dcc8dd01da0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2752
- C:\Windows\System\uJEUGMd.exe
  C:\Windows\System\uJEUGMd.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\owruLsZ.exe
  C:\Windows\System\owruLsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\OQfpnAZ.exe
  C:\Windows\System\OQfpnAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\zGyASCZ.exe
  C:\Windows\System\zGyASCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\bzTwLSD.exe
  C:\Windows\System\bzTwLSD.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\jYXUwhd.exe
  C:\Windows\System\jYXUwhd.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\tyxUUCx.exe
  C:\Windows\System\tyxUUCx.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\orvNDUl.exe
  C:\Windows\System\orvNDUl.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\EzIIXKi.exe
  C:\Windows\System\EzIIXKi.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\HzqaLjG.exe
  C:\Windows\System\HzqaLjG.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\fNzAGrk.exe
  C:\Windows\System\fNzAGrk.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\JYQzIpe.exe
  C:\Windows\System\JYQzIpe.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\JQgHaKB.exe
  C:\Windows\System\JQgHaKB.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\kjvlTFW.exe
  C:\Windows\System\kjvlTFW.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\nKPyWKX.exe
  C:\Windows\System\nKPyWKX.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\eRKdFQA.exe
  C:\Windows\System\eRKdFQA.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\rqZYxLC.exe
  C:\Windows\System\rqZYxLC.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\SbEeusr.exe
  C:\Windows\System\SbEeusr.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\gxeVIFI.exe
  C:\Windows\System\gxeVIFI.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\ItKOrvb.exe
  C:\Windows\System\ItKOrvb.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\YknXKAx.exe
  C:\Windows\System\YknXKAx.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\MREaNJj.exe
  C:\Windows\System\MREaNJj.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\lTDoObO.exe
  C:\Windows\System\lTDoObO.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\SePkcfu.exe
  C:\Windows\System\SePkcfu.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\dybUdIa.exe
  C:\Windows\System\dybUdIa.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\DJCahVZ.exe
  C:\Windows\System\DJCahVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\moDJtjc.exe
  C:\Windows\System\moDJtjc.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\KaGWFFS.exe
  C:\Windows\System\KaGWFFS.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\jmlJvVM.exe
  C:\Windows\System\jmlJvVM.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\JtTiGDT.exe
  C:\Windows\System\JtTiGDT.exe
  2⤵
  PID:2324
- C:\Windows\System\HFMmGST.exe
  C:\Windows\System\HFMmGST.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\FbvUsVK.exe
  C:\Windows\System\FbvUsVK.exe
  2⤵
  PID:1132
- C:\Windows\System\vxkGvYa.exe
  C:\Windows\System\vxkGvYa.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\epTHspq.exe
  C:\Windows\System\epTHspq.exe
  2⤵
  PID:1284
- C:\Windows\System\vrCanpt.exe
  C:\Windows\System\vrCanpt.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\zYPosVv.exe
  C:\Windows\System\zYPosVv.exe
  2⤵
  PID:1704
- C:\Windows\System\iiRluRA.exe
  C:\Windows\System\iiRluRA.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\qLXkfnx.exe
  C:\Windows\System\qLXkfnx.exe
  2⤵
  PID:1800
- C:\Windows\System\eSgdwtQ.exe
  C:\Windows\System\eSgdwtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ADWQlNY.exe
  C:\Windows\System\ADWQlNY.exe
  2⤵
  PID:3052
- C:\Windows\System\XnzKyww.exe
  C:\Windows\System\XnzKyww.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\rSjmKzf.exe
  C:\Windows\System\rSjmKzf.exe
  2⤵
  PID:936
- C:\Windows\System\vhbfHoW.exe
  C:\Windows\System\vhbfHoW.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\GLwNhnt.exe
  C:\Windows\System\GLwNhnt.exe
  2⤵
  PID:1064
- C:\Windows\System\EnmxYZd.exe
  C:\Windows\System\EnmxYZd.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\RQgHJvZ.exe
  C:\Windows\System\RQgHJvZ.exe
  2⤵
  PID:1912
- C:\Windows\System\NovgDCE.exe
  C:\Windows\System\NovgDCE.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\NsQulwI.exe
  C:\Windows\System\NsQulwI.exe
  2⤵
  PID:2096
- C:\Windows\System\WxXGDVA.exe
  C:\Windows\System\WxXGDVA.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\cCxpRJo.exe
  C:\Windows\System\cCxpRJo.exe
  2⤵
  PID:2268
- C:\Windows\System\TTqFLrx.exe
  C:\Windows\System\TTqFLrx.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\lKNbLKb.exe
  C:\Windows\System\lKNbLKb.exe
  2⤵
  PID:2948
- C:\Windows\System\nzdPeLe.exe
  C:\Windows\System\nzdPeLe.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\yrBKhuH.exe
  C:\Windows\System\yrBKhuH.exe
  2⤵
  PID:880
- C:\Windows\System\qgEeTMS.exe
  C:\Windows\System\qgEeTMS.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\UlfFryM.exe
  C:\Windows\System\UlfFryM.exe
  2⤵
  PID:2264
- C:\Windows\System\KNCawpL.exe
  C:\Windows\System\KNCawpL.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\XnahkMk.exe
  C:\Windows\System\XnahkMk.exe
  2⤵
  PID:1540
- C:\Windows\System\lHCCzyQ.exe
  C:\Windows\System\lHCCzyQ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\dwGhBhQ.exe
  C:\Windows\System\dwGhBhQ.exe
  2⤵
  PID:2620
- C:\Windows\System\nnQNvyB.exe
  C:\Windows\System\nnQNvyB.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\RLaOhiT.exe
  C:\Windows\System\RLaOhiT.exe
  2⤵
  PID:2560
- C:\Windows\System\HaFYnBx.exe
  C:\Windows\System\HaFYnBx.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\VaNgttN.exe
  C:\Windows\System\VaNgttN.exe
  2⤵
  PID:2604
- C:\Windows\System\LbJAlym.exe
  C:\Windows\System\LbJAlym.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\RfCVpFE.exe
  C:\Windows\System\RfCVpFE.exe
  2⤵
  PID:1564
- C:\Windows\System\DfXYMGD.exe
  C:\Windows\System\DfXYMGD.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\TYLwxWD.exe
  C:\Windows\System\TYLwxWD.exe
  2⤵
  PID:2540
- C:\Windows\System\iSJOlSV.exe
  C:\Windows\System\iSJOlSV.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\xwmFFjj.exe
  C:\Windows\System\xwmFFjj.exe
  2⤵
  PID:1908
- C:\Windows\System\yKGIQGx.exe
  C:\Windows\System\yKGIQGx.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\hXOepeV.exe
  C:\Windows\System\hXOepeV.exe
  2⤵
  PID:1852
- C:\Windows\System\GSbWRhl.exe
  C:\Windows\System\GSbWRhl.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\fIHBGzu.exe
  C:\Windows\System\fIHBGzu.exe
  2⤵
  PID:2588
- C:\Windows\System\bvcVMBP.exe
  C:\Windows\System\bvcVMBP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\merCOJF.exe
  C:\Windows\System\merCOJF.exe
  2⤵
  PID:2348
- C:\Windows\System\mvaJSme.exe
  C:\Windows\System\mvaJSme.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\zALaSUY.exe
  C:\Windows\System\zALaSUY.exe
  2⤵
  PID:380
- C:\Windows\System\EOIaMfW.exe
  C:\Windows\System\EOIaMfW.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\MDIsunu.exe
  C:\Windows\System\MDIsunu.exe
  2⤵
  PID:872
- C:\Windows\System\wmKOkTr.exe
  C:\Windows\System\wmKOkTr.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\mBjjqdA.exe
  C:\Windows\System\mBjjqdA.exe
  2⤵
  PID:2436
- C:\Windows\System\CJDtRlx.exe
  C:\Windows\System\CJDtRlx.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\unNiPYP.exe
  C:\Windows\System\unNiPYP.exe
  2⤵
  PID:1708
- C:\Windows\System\GJOyULo.exe
  C:\Windows\System\GJOyULo.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\qEMxRCf.exe
  C:\Windows\System\qEMxRCf.exe
  2⤵
  PID:2376
- C:\Windows\System\kLeODbO.exe
  C:\Windows\System\kLeODbO.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\DhNScEH.exe
  C:\Windows\System\DhNScEH.exe
  2⤵
  PID:1904
- C:\Windows\System\FFPkbHl.exe
  C:\Windows\System\FFPkbHl.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\fSrAuJX.exe
  C:\Windows\System\fSrAuJX.exe
  2⤵
  PID:1432
- C:\Windows\System\KOABBNJ.exe
  C:\Windows\System\KOABBNJ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\xHiMjdd.exe
  C:\Windows\System\xHiMjdd.exe
  2⤵
  PID:2092
- C:\Windows\System\DPSZxco.exe
  C:\Windows\System\DPSZxco.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\VFdaiOx.exe
  C:\Windows\System\VFdaiOx.exe
  2⤵
  PID:2596
- C:\Windows\System\UoqDfeR.exe
  C:\Windows\System\UoqDfeR.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\uSwlRqU.exe
  C:\Windows\System\uSwlRqU.exe
  2⤵
  PID:1884
- C:\Windows\System\StdvqBs.exe
  C:\Windows\System\StdvqBs.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\HnbkgTH.exe
  C:\Windows\System\HnbkgTH.exe
  2⤵
  PID:856
- C:\Windows\System\xtGkyIh.exe
  C:\Windows\System\xtGkyIh.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\CFDJvlN.exe
  C:\Windows\System\CFDJvlN.exe
  2⤵
  PID:580
- C:\Windows\System\QgtAvRO.exe
  C:\Windows\System\QgtAvRO.exe
  2⤵
  PID:408
- C:\Windows\System\XaNyMhH.exe
  C:\Windows\System\XaNyMhH.exe
  2⤵
  PID:1144
- C:\Windows\System\QeyYCfi.exe
  C:\Windows\System\QeyYCfi.exe
  2⤵
  PID:1520
- C:\Windows\System\eXiOEbJ.exe
  C:\Windows\System\eXiOEbJ.exe
  2⤵
  PID:2632
- C:\Windows\System\aHLAXRx.exe
  C:\Windows\System\aHLAXRx.exe
  2⤵
  PID:1948
- C:\Windows\System\VRPFsyC.exe
  C:\Windows\System\VRPFsyC.exe
  2⤵
  PID:2592
- C:\Windows\System\FiisIEr.exe
  C:\Windows\System\FiisIEr.exe
  2⤵
  PID:2148
- C:\Windows\System\NRkcoxD.exe
  C:\Windows\System\NRkcoxD.exe
  2⤵
  PID:1864
- C:\Windows\System\SlQeGRs.exe
  C:\Windows\System\SlQeGRs.exe
  2⤵
  PID:1992
- C:\Windows\System\dKivKQe.exe
  C:\Windows\System\dKivKQe.exe
  2⤵
  PID:1944
- C:\Windows\System\dDfFFLI.exe
  C:\Windows\System\dDfFFLI.exe
  2⤵
  PID:2940
- C:\Windows\System\eAMNdGF.exe
  C:\Windows\System\eAMNdGF.exe
  2⤵
  PID:1608
- C:\Windows\System\iHsqNVx.exe
  C:\Windows\System\iHsqNVx.exe
  2⤵
  PID:3088
- C:\Windows\System\EQFYmCH.exe
  C:\Windows\System\EQFYmCH.exe
  2⤵
  PID:3104
- C:\Windows\System\lKYIJjU.exe
  C:\Windows\System\lKYIJjU.exe
  2⤵
  PID:3120
- C:\Windows\System\qEfwjPT.exe
  C:\Windows\System\qEfwjPT.exe
  2⤵
  PID:3136
- C:\Windows\System\bGjXwxE.exe
  C:\Windows\System\bGjXwxE.exe
  2⤵
  PID:3152
- C:\Windows\System\vEMuJPI.exe
  C:\Windows\System\vEMuJPI.exe
  2⤵
  PID:3168
- C:\Windows\System\OcxglKN.exe
  C:\Windows\System\OcxglKN.exe
  2⤵
  PID:3184
- C:\Windows\System\cMmNVAv.exe
  C:\Windows\System\cMmNVAv.exe
  2⤵
  PID:3200
- C:\Windows\System\blIegmY.exe
  C:\Windows\System\blIegmY.exe
  2⤵
  PID:3216
- C:\Windows\System\hquzcgS.exe
  C:\Windows\System\hquzcgS.exe
  2⤵
  PID:3232
- C:\Windows\System\rwVXysY.exe
  C:\Windows\System\rwVXysY.exe
  2⤵
  PID:3248
- C:\Windows\System\denyRvy.exe
  C:\Windows\System\denyRvy.exe
  2⤵
  PID:3264
- C:\Windows\System\IQVMOSR.exe
  C:\Windows\System\IQVMOSR.exe
  2⤵
  PID:3280
- C:\Windows\System\PEamPTw.exe
  C:\Windows\System\PEamPTw.exe
  2⤵
  PID:3296
- C:\Windows\System\cbCXIcY.exe
  C:\Windows\System\cbCXIcY.exe
  2⤵
  PID:3312
- C:\Windows\System\LooetFz.exe
  C:\Windows\System\LooetFz.exe
  2⤵
  PID:3328
- C:\Windows\System\peovxOQ.exe
  C:\Windows\System\peovxOQ.exe
  2⤵
  PID:3344
- C:\Windows\System\CxXpasG.exe
  C:\Windows\System\CxXpasG.exe
  2⤵
  PID:3360
- C:\Windows\System\oKvpUyw.exe
  C:\Windows\System\oKvpUyw.exe
  2⤵
  PID:3376
- C:\Windows\System\tYGjIui.exe
  C:\Windows\System\tYGjIui.exe
  2⤵
  PID:3392
- C:\Windows\System\iardZtz.exe
  C:\Windows\System\iardZtz.exe
  2⤵
  PID:3408
- C:\Windows\System\dmckedB.exe
  C:\Windows\System\dmckedB.exe
  2⤵
  PID:3424
- C:\Windows\System\hHSfVqC.exe
  C:\Windows\System\hHSfVqC.exe
  2⤵
  PID:3440
- C:\Windows\System\zryGCxI.exe
  C:\Windows\System\zryGCxI.exe
  2⤵
  PID:3456
- C:\Windows\System\vvxDAME.exe
  C:\Windows\System\vvxDAME.exe
  2⤵
  PID:3472
- C:\Windows\System\bsZkIoZ.exe
  C:\Windows\System\bsZkIoZ.exe
  2⤵
  PID:3488
- C:\Windows\System\zmNPPhU.exe
  C:\Windows\System\zmNPPhU.exe
  2⤵
  PID:3504
- C:\Windows\System\qhUAkJm.exe
  C:\Windows\System\qhUAkJm.exe
  2⤵
  PID:3520
- C:\Windows\System\zxQQWnr.exe
  C:\Windows\System\zxQQWnr.exe
  2⤵
  PID:3536
- C:\Windows\System\EXmaCvX.exe
  C:\Windows\System\EXmaCvX.exe
  2⤵
  PID:3552
- C:\Windows\System\jfQEKTS.exe
  C:\Windows\System\jfQEKTS.exe
  2⤵
  PID:3568
- C:\Windows\System\nYXFxAq.exe
  C:\Windows\System\nYXFxAq.exe
  2⤵
  PID:3584
- C:\Windows\System\PrDnOzA.exe
  C:\Windows\System\PrDnOzA.exe
  2⤵
  PID:3600
- C:\Windows\System\GiDwlII.exe
  C:\Windows\System\GiDwlII.exe
  2⤵
  PID:3616
- C:\Windows\System\NgJlgOa.exe
  C:\Windows\System\NgJlgOa.exe
  2⤵
  PID:3632
- C:\Windows\System\rUDwPhD.exe
  C:\Windows\System\rUDwPhD.exe
  2⤵
  PID:3648
- C:\Windows\System\vGDyRLC.exe
  C:\Windows\System\vGDyRLC.exe
  2⤵
  PID:3812
- C:\Windows\System\SwLuNvt.exe
  C:\Windows\System\SwLuNvt.exe
  2⤵
  PID:3828
- C:\Windows\System\ooQITXH.exe
  C:\Windows\System\ooQITXH.exe
  2⤵
  PID:3844
- C:\Windows\System\QABJGis.exe
  C:\Windows\System\QABJGis.exe
  2⤵
  PID:3964
- C:\Windows\System\nNPQmOt.exe
  C:\Windows\System\nNPQmOt.exe
  2⤵
  PID:3980
- C:\Windows\System\MrefujJ.exe
  C:\Windows\System\MrefujJ.exe
  2⤵
  PID:3996
- C:\Windows\System\mYqKYuZ.exe
  C:\Windows\System\mYqKYuZ.exe
  2⤵
  PID:4012
- C:\Windows\System\eWZZloS.exe
  C:\Windows\System\eWZZloS.exe
  2⤵
  PID:4028
- C:\Windows\System\kEQrOlW.exe
  C:\Windows\System\kEQrOlW.exe
  2⤵
  PID:4044
- C:\Windows\System\fTNJxJo.exe
  C:\Windows\System\fTNJxJo.exe
  2⤵
  PID:4064
- C:\Windows\System\borvkdV.exe
  C:\Windows\System\borvkdV.exe
  2⤵
  PID:700
- C:\Windows\System\WmJSNuW.exe
  C:\Windows\System\WmJSNuW.exe
  2⤵
  PID:3612
- C:\Windows\System\YDMcxmS.exe
  C:\Windows\System\YDMcxmS.exe
  2⤵
  PID:3824
- C:\Windows\System\gpFylzK.exe
  C:\Windows\System\gpFylzK.exe
  2⤵
  PID:3872
- C:\Windows\System\KwjTKZL.exe
  C:\Windows\System\KwjTKZL.exe
  2⤵
  PID:3888
- C:\Windows\System\boaxDZl.exe
  C:\Windows\System\boaxDZl.exe
  2⤵
  PID:3904
- C:\Windows\System\BhuvGSj.exe
  C:\Windows\System\BhuvGSj.exe
  2⤵
  PID:3928
- C:\Windows\System\enbvyae.exe
  C:\Windows\System\enbvyae.exe
  2⤵
  PID:3944
- C:\Windows\System\spEaJRm.exe
  C:\Windows\System\spEaJRm.exe
  2⤵
  PID:2408
- C:\Windows\System\oSHqSzt.exe
  C:\Windows\System\oSHqSzt.exe
  2⤵
  PID:1720
- C:\Windows\System\ABLszmX.exe
  C:\Windows\System\ABLszmX.exe
  2⤵
  PID:2056
- C:\Windows\System\oDjdhCR.exe
  C:\Windows\System\oDjdhCR.exe
  2⤵
  PID:4020
- C:\Windows\System\HOOmGfo.exe
  C:\Windows\System\HOOmGfo.exe
  2⤵
  PID:4060
- C:\Windows\System\laKFYaW.exe
  C:\Windows\System\laKFYaW.exe
  2⤵
  PID:1632
- C:\Windows\System\rfDMGzK.exe
  C:\Windows\System\rfDMGzK.exe
  2⤵
  PID:2696
- C:\Windows\System\DmzHIpj.exe
  C:\Windows\System\DmzHIpj.exe
  2⤵
  PID:1372
- C:\Windows\System\zXnpvuZ.exe
  C:\Windows\System\zXnpvuZ.exe
  2⤵
  PID:3128
- C:\Windows\System\LjCuzOh.exe
  C:\Windows\System\LjCuzOh.exe
  2⤵
  PID:3192
- C:\Windows\System\EXgwrpv.exe
  C:\Windows\System\EXgwrpv.exe
  2⤵
  PID:3260
- C:\Windows\System\oZhguRh.exe
  C:\Windows\System\oZhguRh.exe
  2⤵
  PID:3324
- C:\Windows\System\QqmKSRX.exe
  C:\Windows\System\QqmKSRX.exe
  2⤵
  PID:3384
- C:\Windows\System\NfBTfIc.exe
  C:\Windows\System\NfBTfIc.exe
  2⤵
  PID:3448
- C:\Windows\System\rRzHXtC.exe
  C:\Windows\System\rRzHXtC.exe
  2⤵
  PID:3484
- C:\Windows\System\HnfESHW.exe
  C:\Windows\System\HnfESHW.exe
  2⤵
  PID:3548
- C:\Windows\System\PGQJcLM.exe
  C:\Windows\System\PGQJcLM.exe
  2⤵
  PID:1684
- C:\Windows\System\hGSrMPh.exe
  C:\Windows\System\hGSrMPh.exe
  2⤵
  PID:3532
- C:\Windows\System\WCBNdLf.exe
  C:\Windows\System\WCBNdLf.exe
  2⤵
  PID:3596
- C:\Windows\System\YMDqnMk.exe
  C:\Windows\System\YMDqnMk.exe
  2⤵
  PID:4100
- C:\Windows\System\NUBwrzE.exe
  C:\Windows\System\NUBwrzE.exe
  2⤵
  PID:4116
- C:\Windows\System\TpgmBhN.exe
  C:\Windows\System\TpgmBhN.exe
  2⤵
  PID:4132
- C:\Windows\System\clPgMUB.exe
  C:\Windows\System\clPgMUB.exe
  2⤵
  PID:4148
- C:\Windows\System\Cbswtnl.exe
  C:\Windows\System\Cbswtnl.exe
  2⤵
  PID:4164
- C:\Windows\System\zizoRPw.exe
  C:\Windows\System\zizoRPw.exe
  2⤵
  PID:4180
- C:\Windows\System\mtUDkXk.exe
  C:\Windows\System\mtUDkXk.exe
  2⤵
  PID:4196
- C:\Windows\System\qaLtMff.exe
  C:\Windows\System\qaLtMff.exe
  2⤵
  PID:4212
- C:\Windows\System\szhxdxM.exe
  C:\Windows\System\szhxdxM.exe
  2⤵
  PID:4228
- C:\Windows\System\mklStfQ.exe
  C:\Windows\System\mklStfQ.exe
  2⤵
  PID:4244
- C:\Windows\System\NOhkPab.exe
  C:\Windows\System\NOhkPab.exe
  2⤵
  PID:4260
- C:\Windows\System\GpfAjxH.exe
  C:\Windows\System\GpfAjxH.exe
  2⤵
  PID:4276
- C:\Windows\System\PhFyvic.exe
  C:\Windows\System\PhFyvic.exe
  2⤵
  PID:4292
- C:\Windows\System\aKxMSRE.exe
  C:\Windows\System\aKxMSRE.exe
  2⤵
  PID:4308
- C:\Windows\System\BeXcZFN.exe
  C:\Windows\System\BeXcZFN.exe
  2⤵
  PID:4324
- C:\Windows\System\luuKqzt.exe
  C:\Windows\System\luuKqzt.exe
  2⤵
  PID:4340
- C:\Windows\System\IdIojIv.exe
  C:\Windows\System\IdIojIv.exe
  2⤵
  PID:4356
- C:\Windows\System\jvQVpac.exe
  C:\Windows\System\jvQVpac.exe
  2⤵
  PID:4372
- C:\Windows\System\LawhupH.exe
  C:\Windows\System\LawhupH.exe
  2⤵
  PID:4396
- C:\Windows\System\ByMYTum.exe
  C:\Windows\System\ByMYTum.exe
  2⤵
  PID:4420
- C:\Windows\System\PbElZda.exe
  C:\Windows\System\PbElZda.exe
  2⤵
  PID:4436
- C:\Windows\System\ECAYYqQ.exe
  C:\Windows\System\ECAYYqQ.exe
  2⤵
  PID:4452
- C:\Windows\System\mpEJyzC.exe
  C:\Windows\System\mpEJyzC.exe
  2⤵
  PID:4468
- C:\Windows\System\AOXnoOi.exe
  C:\Windows\System\AOXnoOi.exe
  2⤵
  PID:4484
- C:\Windows\System\WzIrxUU.exe
  C:\Windows\System\WzIrxUU.exe
  2⤵
  PID:4500
- C:\Windows\System\fbYCBRW.exe
  C:\Windows\System\fbYCBRW.exe
  2⤵
  PID:4516
- C:\Windows\System\BOllzGh.exe
  C:\Windows\System\BOllzGh.exe
  2⤵
  PID:4532
- C:\Windows\System\JflXcKk.exe
  C:\Windows\System\JflXcKk.exe
  2⤵
  PID:4548
- C:\Windows\System\ZGNpqrn.exe
  C:\Windows\System\ZGNpqrn.exe
  2⤵
  PID:4704
- C:\Windows\System\XCBLIqB.exe
  C:\Windows\System\XCBLIqB.exe
  2⤵
  PID:4720
- C:\Windows\System\diNVvKv.exe
  C:\Windows\System\diNVvKv.exe
  2⤵
  PID:4736
- C:\Windows\System\PbWOdFS.exe
  C:\Windows\System\PbWOdFS.exe
  2⤵
  PID:4756
- C:\Windows\System\wbhaIru.exe
  C:\Windows\System\wbhaIru.exe
  2⤵
  PID:4772
- C:\Windows\System\qKlgMTY.exe
  C:\Windows\System\qKlgMTY.exe
  2⤵
  PID:4788
- C:\Windows\System\JTbUrAn.exe
  C:\Windows\System\JTbUrAn.exe
  2⤵
  PID:4804
- C:\Windows\System\ItPwpnj.exe
  C:\Windows\System\ItPwpnj.exe
  2⤵
  PID:4820
- C:\Windows\System\wrWGZjA.exe
  C:\Windows\System\wrWGZjA.exe
  2⤵
  PID:4836
- C:\Windows\System\RpLKJPC.exe
  C:\Windows\System\RpLKJPC.exe
  2⤵
  PID:4852
- C:\Windows\System\DBbAiTe.exe
  C:\Windows\System\DBbAiTe.exe
  2⤵
  PID:4868
- C:\Windows\System\XCGrxeK.exe
  C:\Windows\System\XCGrxeK.exe
  2⤵
  PID:4884
- C:\Windows\System\tLzldth.exe
  C:\Windows\System\tLzldth.exe
  2⤵
  PID:4900
- C:\Windows\System\LKuOJLl.exe
  C:\Windows\System\LKuOJLl.exe
  2⤵
  PID:4916
- C:\Windows\System\epQoKNS.exe
  C:\Windows\System\epQoKNS.exe
  2⤵
  PID:4932
- C:\Windows\System\DBZezZH.exe
  C:\Windows\System\DBZezZH.exe
  2⤵
  PID:4948
- C:\Windows\System\bpbmTMS.exe
  C:\Windows\System\bpbmTMS.exe
  2⤵
  PID:4972
- C:\Windows\System\fJxekSf.exe
  C:\Windows\System\fJxekSf.exe
  2⤵
  PID:4992
- C:\Windows\System\iecZWII.exe
  C:\Windows\System\iecZWII.exe
  2⤵
  PID:5008
- C:\Windows\System\TUmmUXC.exe
  C:\Windows\System\TUmmUXC.exe
  2⤵
  PID:5024
- C:\Windows\System\WlldPMS.exe
  C:\Windows\System\WlldPMS.exe
  2⤵
  PID:5040
- C:\Windows\System\lyDNnvc.exe
  C:\Windows\System\lyDNnvc.exe
  2⤵
  PID:5060
- C:\Windows\System\IgglsAN.exe
  C:\Windows\System\IgglsAN.exe
  2⤵
  PID:5080
- C:\Windows\System\REjSEXD.exe
  C:\Windows\System\REjSEXD.exe
  2⤵
  PID:5096
- C:\Windows\System\XDbYaZZ.exe
  C:\Windows\System\XDbYaZZ.exe
  2⤵
  PID:5112
- C:\Windows\System\vNyDhWX.exe
  C:\Windows\System\vNyDhWX.exe
  2⤵
  PID:3608
- C:\Windows\System\cSJPbPx.exe
  C:\Windows\System\cSJPbPx.exe
  2⤵
  PID:3868
- C:\Windows\System\pJbMBMa.exe
  C:\Windows\System\pJbMBMa.exe
  2⤵
  PID:3940
- C:\Windows\System\hdfdjSJ.exe
  C:\Windows\System\hdfdjSJ.exe
  2⤵
  PID:3992
- C:\Windows\System\mBySIVU.exe
  C:\Windows\System\mBySIVU.exe
  2⤵
  PID:2204
- C:\Windows\System\LsSmXUy.exe
  C:\Windows\System\LsSmXUy.exe
  2⤵
  PID:3320
- C:\Windows\System\nwLkluL.exe
  C:\Windows\System\nwLkluL.exe
  2⤵
  PID:3544
- C:\Windows\System\pkclqjB.exe
  C:\Windows\System\pkclqjB.exe
  2⤵
  PID:3656
- C:\Windows\System\XBWIYYt.exe
  C:\Windows\System\XBWIYYt.exe
  2⤵
  PID:3668
- C:\Windows\System\HUrluoG.exe
  C:\Windows\System\HUrluoG.exe
  2⤵
  PID:3684
- C:\Windows\System\zEdmRfC.exe
  C:\Windows\System\zEdmRfC.exe
  2⤵
  PID:3700
- C:\Windows\System\uKFWETk.exe
  C:\Windows\System\uKFWETk.exe
  2⤵
  PID:3724
- C:\Windows\System\PXzSurS.exe
  C:\Windows\System\PXzSurS.exe
  2⤵
  PID:3740
- C:\Windows\System\LvnQNCp.exe
  C:\Windows\System\LvnQNCp.exe
  2⤵
  PID:3756
- C:\Windows\System\VRKQQHI.exe
  C:\Windows\System\VRKQQHI.exe
  2⤵
  PID:3772
- C:\Windows\System\UsysSYs.exe
  C:\Windows\System\UsysSYs.exe
  2⤵
  PID:3836
- C:\Windows\System\fqaUrGh.exe
  C:\Windows\System\fqaUrGh.exe
  2⤵
  PID:4188
- C:\Windows\System\JWlWkbM.exe
  C:\Windows\System\JWlWkbM.exe
  2⤵
  PID:4256
- C:\Windows\System\RMpxjTv.exe
  C:\Windows\System\RMpxjTv.exe
  2⤵
  PID:4320
- C:\Windows\System\xZHSyrk.exe
  C:\Windows\System\xZHSyrk.exe
  2⤵
  PID:4384
- C:\Windows\System\jyEvlur.exe
  C:\Windows\System\jyEvlur.exe
  2⤵
  PID:4432
- C:\Windows\System\fdHEXdk.exe
  C:\Windows\System\fdHEXdk.exe
  2⤵
  PID:4492
- C:\Windows\System\KPAxfar.exe
  C:\Windows\System\KPAxfar.exe
  2⤵
  PID:4556
- C:\Windows\System\vepXFrp.exe
  C:\Windows\System\vepXFrp.exe
  2⤵
  PID:4580
- C:\Windows\System\JPLUnEj.exe
  C:\Windows\System\JPLUnEj.exe
  2⤵
  PID:4596
- C:\Windows\System\jpqyisi.exe
  C:\Windows\System\jpqyisi.exe
  2⤵
  PID:4616
- C:\Windows\System\yuygxdO.exe
  C:\Windows\System\yuygxdO.exe
  2⤵
  PID:2448
- C:\Windows\System\kgdptwQ.exe
  C:\Windows\System\kgdptwQ.exe
  2⤵
  PID:4648
- C:\Windows\System\gpcAplj.exe
  C:\Windows\System\gpcAplj.exe
  2⤵
  PID:2000
- C:\Windows\System\DVgcUsN.exe
  C:\Windows\System\DVgcUsN.exe
  2⤵
  PID:3820
- C:\Windows\System\fEgQmDF.exe
  C:\Windows\System\fEgQmDF.exe
  2⤵
  PID:4680
- C:\Windows\System\sFuaBwz.exe
  C:\Windows\System\sFuaBwz.exe
  2⤵
  PID:2720
- C:\Windows\System\LHeMHWK.exe
  C:\Windows\System\LHeMHWK.exe
  2⤵
  PID:3452
- C:\Windows\System\tedPRDV.exe
  C:\Windows\System\tedPRDV.exe
  2⤵
  PID:2756
- C:\Windows\System\LnddDVO.exe
  C:\Windows\System\LnddDVO.exe
  2⤵
  PID:4112
- C:\Windows\System\nfeagNW.exe
  C:\Windows\System\nfeagNW.exe
  2⤵
  PID:4172
- C:\Windows\System\GaswZll.exe
  C:\Windows\System\GaswZll.exe
  2⤵
  PID:4208
- C:\Windows\System\uROVPOg.exe
  C:\Windows\System\uROVPOg.exe
  2⤵
  PID:4728
- C:\Windows\System\vsoEACk.exe
  C:\Windows\System\vsoEACk.exe
  2⤵
  PID:2688
- C:\Windows\System\mFCoevb.exe
  C:\Windows\System\mFCoevb.exe
  2⤵
  PID:4832
- C:\Windows\System\AWFyelV.exe
  C:\Windows\System\AWFyelV.exe
  2⤵
  PID:4896
- C:\Windows\System\eMPZhcK.exe
  C:\Windows\System\eMPZhcK.exe
  2⤵
  PID:4960
- C:\Windows\System\tKwSfrM.exe
  C:\Windows\System\tKwSfrM.exe
  2⤵
  PID:5032
- C:\Windows\System\tqGOAgK.exe
  C:\Windows\System\tqGOAgK.exe
  2⤵
  PID:5076
- C:\Windows\System\nYFSGbO.exe
  C:\Windows\System\nYFSGbO.exe
  2⤵
  PID:3676
- C:\Windows\System\ytkSmXC.exe
  C:\Windows\System\ytkSmXC.exe
  2⤵
  PID:4332
- C:\Windows\System\plnXFjU.exe
  C:\Windows\System\plnXFjU.exe
  2⤵
  PID:4480
- C:\Windows\System\XpdCpJN.exe
  C:\Windows\System\XpdCpJN.exe
  2⤵
  PID:4544
- C:\Windows\System\FwizCar.exe
  C:\Windows\System\FwizCar.exe
  2⤵
  PID:3752
- C:\Windows\System\ofLniBq.exe
  C:\Windows\System\ofLniBq.exe
  2⤵
  PID:3792
- C:\Windows\System\xDoEYar.exe
  C:\Windows\System\xDoEYar.exe
  2⤵
  PID:3808
- C:\Windows\System\LMikQsQ.exe
  C:\Windows\System\LMikQsQ.exe
  2⤵
  PID:4352
- C:\Windows\System\JrlCKXe.exe
  C:\Windows\System\JrlCKXe.exe
  2⤵
  PID:4576
- C:\Windows\System\PLiplEc.exe
  C:\Windows\System\PLiplEc.exe
  2⤵
  PID:4636
- C:\Windows\System\ROEHzhG.exe
  C:\Windows\System\ROEHzhG.exe
  2⤵
  PID:4672
- C:\Windows\System\nRfIhAz.exe
  C:\Windows\System\nRfIhAz.exe
  2⤵
  PID:3580
- C:\Windows\System\nihVEjM.exe
  C:\Windows\System\nihVEjM.exe
  2⤵
  PID:4268
- C:\Windows\System\JIkuxTD.exe
  C:\Windows\System\JIkuxTD.exe
  2⤵
  PID:4956
- C:\Windows\System\ZhnvBbe.exe
  C:\Windows\System\ZhnvBbe.exe
  2⤵
  PID:3712
- C:\Windows\System\FLgGwsf.exe
  C:\Windows\System\FLgGwsf.exe
  2⤵
  PID:1896
- C:\Windows\System\HVmMSVr.exe
  C:\Windows\System\HVmMSVr.exe
  2⤵
  PID:4224
- C:\Windows\System\gTNzlwe.exe
  C:\Windows\System\gTNzlwe.exe
  2⤵
  PID:1752
- C:\Windows\System\ntMohsk.exe
  C:\Windows\System\ntMohsk.exe
  2⤵
  PID:1500
- C:\Windows\System\KWKdMVV.exe
  C:\Windows\System\KWKdMVV.exe
  2⤵
  PID:4036
- C:\Windows\System\ZFkfgNq.exe
  C:\Windows\System\ZFkfgNq.exe
  2⤵
  PID:796
- C:\Windows\System\ZhpFtmT.exe
  C:\Windows\System\ZhpFtmT.exe
  2⤵
  PID:2984
- C:\Windows\System\zMeAQri.exe
  C:\Windows\System\zMeAQri.exe
  2⤵
  PID:3788
- C:\Windows\System\FJROzZp.exe
  C:\Windows\System\FJROzZp.exe
  2⤵
  PID:1696
- C:\Windows\System\FnriMWF.exe
  C:\Windows\System\FnriMWF.exe
  2⤵
  PID:1628
- C:\Windows\System\nmvHosq.exe
  C:\Windows\System\nmvHosq.exe
  2⤵
  PID:960
- C:\Windows\System\biVedZb.exe
  C:\Windows\System\biVedZb.exe
  2⤵
  PID:336
- C:\Windows\System\MutRTju.exe
  C:\Windows\System\MutRTju.exe
  2⤵
  PID:3112
- C:\Windows\System\ZyclfFj.exe
  C:\Windows\System\ZyclfFj.exe
  2⤵
  PID:3272
- C:\Windows\System\YGBnBSq.exe
  C:\Windows\System\YGBnBSq.exe
  2⤵
  PID:3336
- C:\Windows\System\qhlWGba.exe
  C:\Windows\System\qhlWGba.exe
  2⤵
  PID:3400
- C:\Windows\System\xvoOoHg.exe
  C:\Windows\System\xvoOoHg.exe
  2⤵
  PID:1184
- C:\Windows\System\lrCsAag.exe
  C:\Windows\System\lrCsAag.exe
  2⤵
  PID:3880
- C:\Windows\System\xlyNNmW.exe
  C:\Windows\System\xlyNNmW.exe
  2⤵
  PID:3920
- C:\Windows\System\uNzZCsn.exe
  C:\Windows\System\uNzZCsn.exe
  2⤵
  PID:4052
- C:\Windows\System\AKTXQIQ.exe
  C:\Windows\System\AKTXQIQ.exe
  2⤵
  PID:3096
- C:\Windows\System\WQFGUkc.exe
  C:\Windows\System\WQFGUkc.exe
  2⤵
  PID:3256
- C:\Windows\System\gCzQjdD.exe
  C:\Windows\System\gCzQjdD.exe
  2⤵
  PID:4748
- C:\Windows\System\lkqMPfV.exe
  C:\Windows\System\lkqMPfV.exe
  2⤵
  PID:4812
- C:\Windows\System\eqEntDE.exe
  C:\Windows\System\eqEntDE.exe
  2⤵
  PID:4876
- C:\Windows\System\BXYFTXi.exe
  C:\Windows\System\BXYFTXi.exe
  2⤵
  PID:4608
- C:\Windows\System\bOMDugz.exe
  C:\Windows\System\bOMDugz.exe
  2⤵
  PID:5048
- C:\Windows\System\utqheGW.exe
  C:\Windows\System\utqheGW.exe
  2⤵
  PID:4984
- C:\Windows\System\pBZWfYH.exe
  C:\Windows\System\pBZWfYH.exe
  2⤵
  PID:4692
- C:\Windows\System\LiNWNrf.exe
  C:\Windows\System\LiNWNrf.exe
  2⤵
  PID:3660
- C:\Windows\System\ucRxNTq.exe
  C:\Windows\System\ucRxNTq.exe
  2⤵
  PID:3900
- C:\Windows\System\ZfZFIDd.exe
  C:\Windows\System\ZfZFIDd.exe
  2⤵
  PID:2100
- C:\Windows\System\BcmqITo.exe
  C:\Windows\System\BcmqITo.exe
  2⤵
  PID:3008
- C:\Windows\System\wGBsrOG.exe
  C:\Windows\System\wGBsrOG.exe
  2⤵
  PID:3516
- C:\Windows\System\BFmyaGJ.exe
  C:\Windows\System\BFmyaGJ.exe
  2⤵
  PID:3696
- C:\Windows\System\RlqtMhn.exe
  C:\Windows\System\RlqtMhn.exe
  2⤵
  PID:3764
- C:\Windows\System\sdaCJtF.exe
  C:\Windows\System\sdaCJtF.exe
  2⤵
  PID:4160
- C:\Windows\System\FFoqxAW.exe
  C:\Windows\System\FFoqxAW.exe
  2⤵
  PID:4428
- C:\Windows\System\YqvheFr.exe
  C:\Windows\System\YqvheFr.exe
  2⤵
  PID:4524
- C:\Windows\System\tBrJBUn.exe
  C:\Windows\System\tBrJBUn.exe
  2⤵
  PID:2888
- C:\Windows\System\fnZxkVA.exe
  C:\Windows\System\fnZxkVA.exe
  2⤵
  PID:468
- C:\Windows\System\EoieCLn.exe
  C:\Windows\System\EoieCLn.exe
  2⤵
  PID:2432
- C:\Windows\System\tLZvweI.exe
  C:\Windows\System\tLZvweI.exe
  2⤵
  PID:2980
- C:\Windows\System\NAlSXks.exe
  C:\Windows\System\NAlSXks.exe
  2⤵
  PID:1460
- C:\Windows\System\QyWFzvE.exe
  C:\Windows\System\QyWFzvE.exe
  2⤵
  PID:3080
- C:\Windows\System\rYovXMZ.exe
  C:\Windows\System\rYovXMZ.exe
  2⤵
  PID:1208
- C:\Windows\System\kaaOqzf.exe
  C:\Windows\System\kaaOqzf.exe
  2⤵
  PID:2876
- C:\Windows\System\GsNlypf.exe
  C:\Windows\System\GsNlypf.exe
  2⤵
  PID:4004
- C:\Windows\System\KiHqubF.exe
  C:\Windows\System\KiHqubF.exe
  2⤵
  PID:4076
- C:\Windows\System\nZGQrAs.exe
  C:\Windows\System\nZGQrAs.exe
  2⤵
  PID:4092
- C:\Windows\System\lVpCAVG.exe
  C:\Windows\System\lVpCAVG.exe
  2⤵
  PID:2904
- C:\Windows\System\WRMKcNA.exe
  C:\Windows\System\WRMKcNA.exe
  2⤵
  PID:4660
- C:\Windows\System\vMbEhXg.exe
  C:\Windows\System\vMbEhXg.exe
  2⤵
  PID:4204
- C:\Windows\System\LtAOsju.exe
  C:\Windows\System\LtAOsju.exe
  2⤵
  PID:1236
- C:\Windows\System\tyEuIVV.exe
  C:\Windows\System\tyEuIVV.exe
  2⤵
  PID:4108
- C:\Windows\System\tGFhAdN.exe
  C:\Windows\System\tGFhAdN.exe
  2⤵
  PID:4864
- C:\Windows\System\MtrTMBd.exe
  C:\Windows\System\MtrTMBd.exe
  2⤵
  PID:5004
- C:\Windows\System\ThOytRS.exe
  C:\Windows\System\ThOytRS.exe
  2⤵
  PID:1216
- C:\Windows\System\DySZdXg.exe
  C:\Windows\System\DySZdXg.exe
  2⤵
  PID:1748
- C:\Windows\System\MegQorV.exe
  C:\Windows\System\MegQorV.exe
  2⤵
  PID:3800
- C:\Windows\System\YKGNOVZ.exe
  C:\Windows\System\YKGNOVZ.exe
  2⤵
  PID:4144
- C:\Windows\System\hZDnPYb.exe
  C:\Windows\System\hZDnPYb.exe
  2⤵
  PID:2964
- C:\Windows\System\DjETREs.exe
  C:\Windows\System\DjETREs.exe
  2⤵
  PID:3628
- C:\Windows\System\pEwXimE.exe
  C:\Windows\System\pEwXimE.exe
  2⤵
  PID:4444
- C:\Windows\System\oMAkCND.exe
  C:\Windows\System\oMAkCND.exe
  2⤵
  PID:4572
- C:\Windows\System\ColsTVd.exe
  C:\Windows\System\ColsTVd.exe
  2⤵
  PID:4512
- C:\Windows\System\fAeoBxd.exe
  C:\Windows\System\fAeoBxd.exe
  2⤵
  PID:3784
- C:\Windows\System\lyyoLzT.exe
  C:\Windows\System\lyyoLzT.exe
  2⤵
  PID:1556
- C:\Windows\System\aikEmtl.exe
  C:\Windows\System\aikEmtl.exe
  2⤵
  PID:3180
- C:\Windows\System\uOtjuEm.exe
  C:\Windows\System\uOtjuEm.exe
  2⤵
  PID:3244
- C:\Windows\System\yfCfFfV.exe
  C:\Windows\System\yfCfFfV.exe
  2⤵
  PID:3912
- C:\Windows\System\YdDCvJs.exe
  C:\Windows\System\YdDCvJs.exe
  2⤵
  PID:3916
- C:\Windows\System\qZZwZlY.exe
  C:\Windows\System\qZZwZlY.exe
  2⤵
  PID:1576
- C:\Windows\System\wlNCHlR.exe
  C:\Windows\System\wlNCHlR.exe
  2⤵
  PID:4716
- C:\Windows\System\AGKKsga.exe
  C:\Windows\System\AGKKsga.exe
  2⤵
  PID:4844
- C:\Windows\System\LYgIbRW.exe
  C:\Windows\System\LYgIbRW.exe
  2⤵
  PID:5056
- C:\Windows\System\GehrnCb.exe
  C:\Windows\System\GehrnCb.exe
  2⤵
  PID:4944
- C:\Windows\System\lRRqCyy.exe
  C:\Windows\System\lRRqCyy.exe
  2⤵
  PID:5092
- C:\Windows\System\FDtiLmh.exe
  C:\Windows\System\FDtiLmh.exe
  2⤵
  PID:4304
- C:\Windows\System\IHMBTzI.exe
  C:\Windows\System\IHMBTzI.exe
  2⤵
  PID:1668
- C:\Windows\System\cNwKhoK.exe
  C:\Windows\System\cNwKhoK.exe
  2⤵
  PID:2196
- C:\Windows\System\oWSHvyB.exe
  C:\Windows\System\oWSHvyB.exe
  2⤵
  PID:4316
- C:\Windows\System\qKsVCvB.exe
  C:\Windows\System\qKsVCvB.exe
  2⤵
  PID:4528
- C:\Windows\System\HJdbGKs.exe
  C:\Windows\System\HJdbGKs.exe
  2⤵
  PID:4560
- C:\Windows\System\WWSdKHN.exe
  C:\Windows\System\WWSdKHN.exe
  2⤵
  PID:884
- C:\Windows\System\rPHPClr.exe
  C:\Windows\System\rPHPClr.exe
  2⤵
  PID:1836
- C:\Windows\System\rGiscwu.exe
  C:\Windows\System\rGiscwu.exe
  2⤵
  PID:3972
- C:\Windows\System\EdXWraT.exe
  C:\Windows\System\EdXWraT.exe
  2⤵
  PID:4084
- C:\Windows\System\gmJhnpX.exe
  C:\Windows\System\gmJhnpX.exe
  2⤵
  PID:3356
- C:\Windows\System\zUeMfhz.exe
  C:\Windows\System\zUeMfhz.exe
  2⤵
  PID:4624
- C:\Windows\System\NkkQmvX.exe
  C:\Windows\System\NkkQmvX.exe
  2⤵
  PID:4764
- C:\Windows\System\KjdDemc.exe
  C:\Windows\System\KjdDemc.exe
  2⤵
  PID:3988
- C:\Windows\System\StXIsou.exe
  C:\Windows\System\StXIsou.exe
  2⤵
  PID:3292
- C:\Windows\System\iKNLSpx.exe
  C:\Windows\System\iKNLSpx.exe
  2⤵
  PID:764
- C:\Windows\System\caGUrlR.exe
  C:\Windows\System\caGUrlR.exe
  2⤵
  PID:4404
- C:\Windows\System\CXgIfhZ.exe
  C:\Windows\System\CXgIfhZ.exe
  2⤵
  PID:4464
- C:\Windows\System\mjBECHg.exe
  C:\Windows\System\mjBECHg.exe
  2⤵
  PID:1456
- C:\Windows\System\dnDkXwc.exe
  C:\Windows\System\dnDkXwc.exe
  2⤵
  PID:3212
- C:\Windows\System\sPYeREq.exe
  C:\Windows\System\sPYeREq.exe
  2⤵
  PID:3056
- C:\Windows\System\rllfLhQ.exe
  C:\Windows\System\rllfLhQ.exe
  2⤵
  PID:4744
- C:\Windows\System\FeqMBTx.exe
  C:\Windows\System\FeqMBTx.exe
  2⤵
  PID:4848
- C:\Windows\System\URIegvH.exe
  C:\Windows\System\URIegvH.exe
  2⤵
  PID:5088
- C:\Windows\System\TqTYyEB.exe
  C:\Windows\System\TqTYyEB.exe
  2⤵
  PID:4588
- C:\Windows\System\EVIcwOd.exe
  C:\Windows\System\EVIcwOd.exe
  2⤵
  PID:4928
- C:\Windows\System\IfGSLKg.exe
  C:\Windows\System\IfGSLKg.exe
  2⤵
  PID:1408
- C:\Windows\System\zKkhqrJ.exe
  C:\Windows\System\zKkhqrJ.exe
  2⤵
  PID:3664
- C:\Windows\System\iOIUplt.exe
  C:\Windows\System\iOIUplt.exe
  2⤵
  PID:2616
- C:\Windows\System\EDmcEjb.exe
  C:\Windows\System\EDmcEjb.exe
  2⤵
  PID:2920
- C:\Windows\System\dtlkUmW.exe
  C:\Windows\System\dtlkUmW.exe
  2⤵
  PID:2536
- C:\Windows\System\AkKTcOL.exe
  C:\Windows\System\AkKTcOL.exe
  2⤵
  PID:444
- C:\Windows\System\tjastgs.exe
  C:\Windows\System\tjastgs.exe
  2⤵
  PID:2600
- C:\Windows\System\kyJvpSL.exe
  C:\Windows\System\kyJvpSL.exe
  2⤵
  PID:5016
- C:\Windows\System\zEeTXLH.exe
  C:\Windows\System\zEeTXLH.exe
  2⤵
  PID:3564
- C:\Windows\System\wdoIJHw.exe
  C:\Windows\System\wdoIJHw.exe
  2⤵
  PID:1328
- C:\Windows\System\jiMhKXD.exe
  C:\Windows\System\jiMhKXD.exe
  2⤵
  PID:3592
- C:\Windows\System\bUuWmEn.exe
  C:\Windows\System\bUuWmEn.exe
  2⤵
  PID:2072
- C:\Windows\System\KIpapcX.exe
  C:\Windows\System\KIpapcX.exe
  2⤵
  PID:4712
- C:\Windows\System\nrmgaVe.exe
  C:\Windows\System\nrmgaVe.exe
  2⤵
  PID:2428
- C:\Windows\System\uDmOoDP.exe
  C:\Windows\System\uDmOoDP.exe
  2⤵
  PID:2180
- C:\Windows\System\jCJUoQY.exe
  C:\Windows\System\jCJUoQY.exe
  2⤵
  PID:3748
- C:\Windows\System\KKtMGDB.exe
  C:\Windows\System\KKtMGDB.exe
  2⤵
  PID:2532
- C:\Windows\System\VeIbWoN.exe
  C:\Windows\System\VeIbWoN.exe
  2⤵
  PID:2676
- C:\Windows\System\oEGgxto.exe
  C:\Windows\System\oEGgxto.exe
  2⤵
  PID:5128
- C:\Windows\System\KtWxkDi.exe
  C:\Windows\System\KtWxkDi.exe
  2⤵
  PID:5144
- C:\Windows\System\fygUUhs.exe
  C:\Windows\System\fygUUhs.exe
  2⤵
  PID:5160
- C:\Windows\System\yOpHuUn.exe
  C:\Windows\System\yOpHuUn.exe
  2⤵
  PID:5176
- C:\Windows\System\NxZVDKx.exe
  C:\Windows\System\NxZVDKx.exe
  2⤵
  PID:5192
- C:\Windows\System\bkMuTyS.exe
  C:\Windows\System\bkMuTyS.exe
  2⤵
  PID:5208
- C:\Windows\System\nclGjoi.exe
  C:\Windows\System\nclGjoi.exe
  2⤵
  PID:5224
- C:\Windows\System\BfSQuGK.exe
  C:\Windows\System\BfSQuGK.exe
  2⤵
  PID:5240
- C:\Windows\System\APdgOBk.exe
  C:\Windows\System\APdgOBk.exe
  2⤵
  PID:5256
- C:\Windows\System\jyigIgC.exe
  C:\Windows\System\jyigIgC.exe
  2⤵
  PID:5280
- C:\Windows\System\YAdSoUf.exe
  C:\Windows\System\YAdSoUf.exe
  2⤵
  PID:5296
- C:\Windows\System\IEJxNKE.exe
  C:\Windows\System\IEJxNKE.exe
  2⤵
  PID:5312
- C:\Windows\System\vxoSoBy.exe
  C:\Windows\System\vxoSoBy.exe
  2⤵
  PID:5328
- C:\Windows\System\OssCira.exe
  C:\Windows\System\OssCira.exe
  2⤵
  PID:5344
- C:\Windows\System\qxCKoHr.exe
  C:\Windows\System\qxCKoHr.exe
  2⤵
  PID:5360
- C:\Windows\System\DLsQLZs.exe
  C:\Windows\System\DLsQLZs.exe
  2⤵
  PID:5376
- C:\Windows\System\gcEthXM.exe
  C:\Windows\System\gcEthXM.exe
  2⤵
  PID:5392
- C:\Windows\System\XuULHkB.exe
  C:\Windows\System\XuULHkB.exe
  2⤵
  PID:5408
- C:\Windows\System\ufbIUdq.exe
  C:\Windows\System\ufbIUdq.exe
  2⤵
  PID:5424
- C:\Windows\System\bZgFmCD.exe
  C:\Windows\System\bZgFmCD.exe
  2⤵
  PID:5440
- C:\Windows\System\votKbEE.exe
  C:\Windows\System\votKbEE.exe
  2⤵
  PID:5456
- C:\Windows\System\sWlioSr.exe
  C:\Windows\System\sWlioSr.exe
  2⤵
  PID:5472
- C:\Windows\System\eVxUUPY.exe
  C:\Windows\System\eVxUUPY.exe
  2⤵
  PID:5488
- C:\Windows\System\jQHntXZ.exe
  C:\Windows\System\jQHntXZ.exe
  2⤵
  PID:5504
- C:\Windows\System\YwtTSvc.exe
  C:\Windows\System\YwtTSvc.exe
  2⤵
  PID:5520
- C:\Windows\System\IUXRgKI.exe
  C:\Windows\System\IUXRgKI.exe
  2⤵
  PID:5536
- C:\Windows\System\ObNiAqH.exe
  C:\Windows\System\ObNiAqH.exe
  2⤵
  PID:5552
- C:\Windows\System\OFAnQWM.exe
  C:\Windows\System\OFAnQWM.exe
  2⤵
  PID:5568
- C:\Windows\System\uSzYvgr.exe
  C:\Windows\System\uSzYvgr.exe
  2⤵
  PID:5584
- C:\Windows\System\qUiqPtb.exe
  C:\Windows\System\qUiqPtb.exe
  2⤵
  PID:5600
- C:\Windows\System\SbzQicN.exe
  C:\Windows\System\SbzQicN.exe
  2⤵
  PID:5616
- C:\Windows\System\dFwYpxo.exe
  C:\Windows\System\dFwYpxo.exe
  2⤵
  PID:5632
- C:\Windows\System\iAPAalk.exe
  C:\Windows\System\iAPAalk.exe
  2⤵
  PID:5648
- C:\Windows\System\rRlEhVN.exe
  C:\Windows\System\rRlEhVN.exe
  2⤵
  PID:5664
- C:\Windows\System\sXZpWAa.exe
  C:\Windows\System\sXZpWAa.exe
  2⤵
  PID:5680
- C:\Windows\System\kjxzQXb.exe
  C:\Windows\System\kjxzQXb.exe
  2⤵
  PID:5696
- C:\Windows\System\HsAQecL.exe
  C:\Windows\System\HsAQecL.exe
  2⤵
  PID:5712
- C:\Windows\System\pAZhCOy.exe
  C:\Windows\System\pAZhCOy.exe
  2⤵
  PID:5732
- C:\Windows\System\HtwamAq.exe
  C:\Windows\System\HtwamAq.exe
  2⤵
  PID:5748
- C:\Windows\System\dfSJpMB.exe
  C:\Windows\System\dfSJpMB.exe
  2⤵
  PID:5764
- C:\Windows\System\OTpVHev.exe
  C:\Windows\System\OTpVHev.exe
  2⤵
  PID:5848
- C:\Windows\System\dBJxxKQ.exe
  C:\Windows\System\dBJxxKQ.exe
  2⤵
  PID:5904
- C:\Windows\System\QNpFtIB.exe
  C:\Windows\System\QNpFtIB.exe
  2⤵
  PID:5928
- C:\Windows\System\CvEmrxZ.exe
  C:\Windows\System\CvEmrxZ.exe
  2⤵
  PID:5944
- C:\Windows\System\OSgnjhN.exe
  C:\Windows\System\OSgnjhN.exe
  2⤵
  PID:5960
- C:\Windows\System\SmZCjUA.exe
  C:\Windows\System\SmZCjUA.exe
  2⤵
  PID:5976
- C:\Windows\System\VSLSgUo.exe
  C:\Windows\System\VSLSgUo.exe
  2⤵
  PID:5992
- C:\Windows\System\uswBwsN.exe
  C:\Windows\System\uswBwsN.exe
  2⤵
  PID:6008
- C:\Windows\System\dCmkOMf.exe
  C:\Windows\System\dCmkOMf.exe
  2⤵
  PID:6024
- C:\Windows\System\SzALgkY.exe
  C:\Windows\System\SzALgkY.exe
  2⤵
  PID:6044
- C:\Windows\System\YVsOxte.exe
  C:\Windows\System\YVsOxte.exe
  2⤵
  PID:6060
- C:\Windows\System\bJcVaYe.exe
  C:\Windows\System\bJcVaYe.exe
  2⤵
  PID:6076
- C:\Windows\System\ngDqOSU.exe
  C:\Windows\System\ngDqOSU.exe
  2⤵
  PID:6096
- C:\Windows\System\FfZUAvA.exe
  C:\Windows\System\FfZUAvA.exe
  2⤵
  PID:6112
- C:\Windows\System\XvKtttp.exe
  C:\Windows\System\XvKtttp.exe
  2⤵
  PID:6128
- C:\Windows\System\xSsQKXM.exe
  C:\Windows\System\xSsQKXM.exe
  2⤵
  PID:2412
- C:\Windows\System\WBrvRpZ.exe
  C:\Windows\System\WBrvRpZ.exe
  2⤵
  PID:3708
- C:\Windows\System\gbxmhlF.exe
  C:\Windows\System\gbxmhlF.exe
  2⤵
  PID:5168
- C:\Windows\System\zHpVhNQ.exe
  C:\Windows\System\zHpVhNQ.exe
  2⤵
  PID:5272
- C:\Windows\System\tnWVIKE.exe
  C:\Windows\System\tnWVIKE.exe
  2⤵
  PID:5368
- C:\Windows\System\kBtrOHA.exe
  C:\Windows\System\kBtrOHA.exe
  2⤵
  PID:5404
- C:\Windows\System\HgElMXQ.exe
  C:\Windows\System\HgElMXQ.exe
  2⤵
  PID:2388
- C:\Windows\System\ImLdDnd.exe
  C:\Windows\System\ImLdDnd.exe
  2⤵
  PID:5156
- C:\Windows\System\bGTtxhn.exe
  C:\Windows\System\bGTtxhn.exe
  2⤵
  PID:5388
- C:\Windows\System\rDgdIna.exe
  C:\Windows\System\rDgdIna.exe
  2⤵
  PID:5624
- C:\Windows\System\QRFgOoz.exe
  C:\Windows\System\QRFgOoz.exe
  2⤵
  PID:5720
- C:\Windows\System\RqZayoB.exe
  C:\Windows\System\RqZayoB.exe
  2⤵
  PID:5448
- C:\Windows\System\hhjuSQk.exe
  C:\Windows\System\hhjuSQk.exe
  2⤵
  PID:5576
- C:\Windows\System\MHzrQqh.exe
  C:\Windows\System\MHzrQqh.exe
  2⤵
  PID:5640
- C:\Windows\System\AurDYtO.exe
  C:\Windows\System\AurDYtO.exe
  2⤵
  PID:5516
- C:\Windows\System\GdPVGgI.exe
  C:\Windows\System\GdPVGgI.exe
  2⤵
  PID:5544
- C:\Windows\System\fBIhzsX.exe
  C:\Windows\System\fBIhzsX.exe
  2⤵
  PID:5776
- C:\Windows\System\zLviylI.exe
  C:\Windows\System\zLviylI.exe
  2⤵
  PID:5788
- C:\Windows\System\xibYeOk.exe
  C:\Windows\System\xibYeOk.exe
  2⤵
  PID:5836
- C:\Windows\System\FcNeSjO.exe
  C:\Windows\System\FcNeSjO.exe
  2⤵
  PID:5856
- C:\Windows\System\FVIBkQO.exe
  C:\Windows\System\FVIBkQO.exe
  2⤵
  PID:5864
- C:\Windows\System\waHegxK.exe
  C:\Windows\System\waHegxK.exe
  2⤵
  PID:5876
- C:\Windows\System\ngnZpRF.exe
  C:\Windows\System\ngnZpRF.exe
  2⤵
  PID:5940
- C:\Windows\System\rMUGaeg.exe
  C:\Windows\System\rMUGaeg.exe
  2⤵
  PID:5984
- C:\Windows\System\apIKagK.exe
  C:\Windows\System\apIKagK.exe
  2⤵
  PID:6032
- C:\Windows\System\evySGCH.exe
  C:\Windows\System\evySGCH.exe
  2⤵
  PID:6040
- C:\Windows\System\IfJCiry.exe
  C:\Windows\System\IfJCiry.exe
  2⤵
  PID:6084
- C:\Windows\System\wLNwhsK.exe
  C:\Windows\System\wLNwhsK.exe
  2⤵
  PID:6108
- C:\Windows\System\zTTLZts.exe
  C:\Windows\System\zTTLZts.exe
  2⤵
  PID:6140
- C:\Windows\System\QxjrZbl.exe
  C:\Windows\System\QxjrZbl.exe
  2⤵
  PID:3860
- C:\Windows\System\FoaxaVD.exe
  C:\Windows\System\FoaxaVD.exe
  2⤵
  PID:5140
- C:\Windows\System\iqgiqYp.exe
  C:\Windows\System\iqgiqYp.exe
  2⤵
  PID:5304
- C:\Windows\System\dWZbxSg.exe
  C:\Windows\System\dWZbxSg.exe
  2⤵
  PID:5308
- C:\Windows\System\dghwval.exe
  C:\Windows\System\dghwval.exe
  2⤵
  PID:5248
- C:\Windows\System\hLPLoYY.exe
  C:\Windows\System\hLPLoYY.exe
  2⤵
  PID:484
- C:\Windows\System\sKsVXRu.exe
  C:\Windows\System\sKsVXRu.exe
  2⤵
  PID:5496
- C:\Windows\System\njchNLC.exe
  C:\Windows\System\njchNLC.exe
  2⤵
  PID:5356
- C:\Windows\System\OdwtUrQ.exe
  C:\Windows\System\OdwtUrQ.exe
  2⤵
  PID:5416
- C:\Windows\System\RpJlHbs.exe
  C:\Windows\System\RpJlHbs.exe
  2⤵
  PID:5760
- C:\Windows\System\TPCDkJu.exe
  C:\Windows\System\TPCDkJu.exe
  2⤵
  PID:5832
- C:\Windows\System\LpzESvI.exe
  C:\Windows\System\LpzESvI.exe
  2⤵
  PID:5956
- C:\Windows\System\pGiPFvK.exe
  C:\Windows\System\pGiPFvK.exe
  2⤵
  PID:6088
- C:\Windows\System\nmanOtl.exe
  C:\Windows\System\nmanOtl.exe
  2⤵
  PID:6148
- C:\Windows\System\RLKUUDn.exe
  C:\Windows\System\RLKUUDn.exe
  2⤵
  PID:6164
- C:\Windows\System\YePVVtD.exe
  C:\Windows\System\YePVVtD.exe
  2⤵
  PID:6180
- C:\Windows\System\NtvVghN.exe
  C:\Windows\System\NtvVghN.exe
  2⤵
  PID:6196
- C:\Windows\System\DOyWtvY.exe
  C:\Windows\System\DOyWtvY.exe
  2⤵
  PID:6212
- C:\Windows\System\QLlmgco.exe
  C:\Windows\System\QLlmgco.exe
  2⤵
  PID:6228
- C:\Windows\System\SDOmZiA.exe
  C:\Windows\System\SDOmZiA.exe
  2⤵
  PID:6244
- C:\Windows\System\WEdfmUG.exe
  C:\Windows\System\WEdfmUG.exe
  2⤵
  PID:6260
- C:\Windows\System\jtOYZhM.exe
  C:\Windows\System\jtOYZhM.exe
  2⤵
  PID:6276
- C:\Windows\System\eqfNltj.exe
  C:\Windows\System\eqfNltj.exe
  2⤵
  PID:6292
- C:\Windows\System\aufPJrw.exe
  C:\Windows\System\aufPJrw.exe
  2⤵
  PID:6308
- C:\Windows\System\uRebrUU.exe
  C:\Windows\System\uRebrUU.exe
  2⤵
  PID:6324
- C:\Windows\System\apsDSCc.exe
  C:\Windows\System\apsDSCc.exe
  2⤵
  PID:6340
- C:\Windows\System\NtqkHFn.exe
  C:\Windows\System\NtqkHFn.exe
  2⤵
  PID:6356
- C:\Windows\System\RdwRTHd.exe
  C:\Windows\System\RdwRTHd.exe
  2⤵
  PID:6372
- C:\Windows\System\akzeyna.exe
  C:\Windows\System\akzeyna.exe
  2⤵
  PID:6388
- C:\Windows\System\YSgPNKx.exe
  C:\Windows\System\YSgPNKx.exe
  2⤵
  PID:6404
- C:\Windows\System\GDdnqDy.exe
  C:\Windows\System\GDdnqDy.exe
  2⤵
  PID:6420
- C:\Windows\System\MHUKseW.exe
  C:\Windows\System\MHUKseW.exe
  2⤵
  PID:6436
- C:\Windows\System\sARJtuf.exe
  C:\Windows\System\sARJtuf.exe
  2⤵
  PID:6452
- C:\Windows\System\kBPnYof.exe
  C:\Windows\System\kBPnYof.exe
  2⤵
  PID:6468
- C:\Windows\System\JBfLuJJ.exe
  C:\Windows\System\JBfLuJJ.exe
  2⤵
  PID:6484
- C:\Windows\System\xyFchxH.exe
  C:\Windows\System\xyFchxH.exe
  2⤵
  PID:6500
- C:\Windows\System\opdfwnA.exe
  C:\Windows\System\opdfwnA.exe
  2⤵
  PID:6516
- C:\Windows\System\mKOAeby.exe
  C:\Windows\System\mKOAeby.exe
  2⤵
  PID:6532
- C:\Windows\System\nzhwdCi.exe
  C:\Windows\System\nzhwdCi.exe
  2⤵
  PID:6548
- C:\Windows\System\NlKtJHS.exe
  C:\Windows\System\NlKtJHS.exe
  2⤵
  PID:6564
- C:\Windows\System\xuFIGEQ.exe
  C:\Windows\System\xuFIGEQ.exe
  2⤵
  PID:6580
- C:\Windows\System\OYWJIei.exe
  C:\Windows\System\OYWJIei.exe
  2⤵
  PID:6596
- C:\Windows\System\FWvadRz.exe
  C:\Windows\System\FWvadRz.exe
  2⤵
  PID:6612
- C:\Windows\System\FGzAPjd.exe
  C:\Windows\System\FGzAPjd.exe
  2⤵
  PID:6628
- C:\Windows\System\ljylQVE.exe
  C:\Windows\System\ljylQVE.exe
  2⤵
  PID:6644
- C:\Windows\System\DoRvifn.exe
  C:\Windows\System\DoRvifn.exe
  2⤵
  PID:6660
- C:\Windows\System\JBSqAwv.exe
  C:\Windows\System\JBSqAwv.exe
  2⤵
  PID:6676
- C:\Windows\System\NZzUGvf.exe
  C:\Windows\System\NZzUGvf.exe
  2⤵
  PID:6692
- C:\Windows\System\XsvKKoz.exe
  C:\Windows\System\XsvKKoz.exe
  2⤵
  PID:6708
- C:\Windows\System\OVWPBva.exe
  C:\Windows\System\OVWPBva.exe
  2⤵
  PID:6724
- C:\Windows\System\pBaMsiV.exe
  C:\Windows\System\pBaMsiV.exe
  2⤵
  PID:6740
- C:\Windows\System\KHfvjNS.exe
  C:\Windows\System\KHfvjNS.exe
  2⤵
  PID:6756
- C:\Windows\System\YJhbfoS.exe
  C:\Windows\System\YJhbfoS.exe
  2⤵
  PID:6772
- C:\Windows\System\jWslriN.exe
  C:\Windows\System\jWslriN.exe
  2⤵
  PID:6788
- C:\Windows\System\EqVFAdi.exe
  C:\Windows\System\EqVFAdi.exe
  2⤵
  PID:6804
- C:\Windows\System\cTHYnOG.exe
  C:\Windows\System\cTHYnOG.exe
  2⤵
  PID:6820
- C:\Windows\System\qfLOvGt.exe
  C:\Windows\System\qfLOvGt.exe
  2⤵
  PID:6836
- C:\Windows\System\GaqHsGy.exe
  C:\Windows\System\GaqHsGy.exe
  2⤵
  PID:6856
- C:\Windows\System\cbYBnrU.exe
  C:\Windows\System\cbYBnrU.exe
  2⤵
  PID:6876
- C:\Windows\System\BmdIXHf.exe
  C:\Windows\System\BmdIXHf.exe
  2⤵
  PID:6892
- C:\Windows\System\LMSZTEL.exe
  C:\Windows\System\LMSZTEL.exe
  2⤵
  PID:6908
- C:\Windows\System\wwjKOxL.exe
  C:\Windows\System\wwjKOxL.exe
  2⤵
  PID:6924
- C:\Windows\System\QfPKyKz.exe
  C:\Windows\System\QfPKyKz.exe
  2⤵
  PID:6940
- C:\Windows\System\VSujJJf.exe
  C:\Windows\System\VSujJJf.exe
  2⤵
  PID:6956
- C:\Windows\System\uByEBsu.exe
  C:\Windows\System\uByEBsu.exe
  2⤵
  PID:6972
- C:\Windows\System\ZeKkDIk.exe
  C:\Windows\System\ZeKkDIk.exe
  2⤵
  PID:6992
- C:\Windows\System\NSvkKzx.exe
  C:\Windows\System\NSvkKzx.exe
  2⤵
  PID:7008
- C:\Windows\System\gcUcHfn.exe
  C:\Windows\System\gcUcHfn.exe
  2⤵
  PID:7024
- C:\Windows\System\vhRAfmv.exe
  C:\Windows\System\vhRAfmv.exe
  2⤵
  PID:7040
- C:\Windows\System\WdgvrfG.exe
  C:\Windows\System\WdgvrfG.exe
  2⤵
  PID:7056
- C:\Windows\System\MzZHNvv.exe
  C:\Windows\System\MzZHNvv.exe
  2⤵
  PID:7076
- C:\Windows\System\jEDKDQN.exe
  C:\Windows\System\jEDKDQN.exe
  2⤵
  PID:7092
- C:\Windows\System\VMXWfOQ.exe
  C:\Windows\System\VMXWfOQ.exe
  2⤵
  PID:7108
- C:\Windows\System\unqCvSu.exe
  C:\Windows\System\unqCvSu.exe
  2⤵
  PID:7124
- C:\Windows\System\ZXzvrnm.exe
  C:\Windows\System\ZXzvrnm.exe
  2⤵
  PID:7140
- C:\Windows\System\dZoEUKS.exe
  C:\Windows\System\dZoEUKS.exe
  2⤵
  PID:7156
- C:\Windows\System\RavMFkV.exe
  C:\Windows\System\RavMFkV.exe
  2⤵
  PID:5336
- C:\Windows\System\UyNeRDA.exe
  C:\Windows\System\UyNeRDA.exe
  2⤵
  PID:7180
- C:\Windows\System\IIWiuCt.exe
  C:\Windows\System\IIWiuCt.exe
  2⤵
  PID:7196
- C:\Windows\System\ujpOTKA.exe
  C:\Windows\System\ujpOTKA.exe
  2⤵
  PID:7228
- C:\Windows\System\ULTeIfp.exe
  C:\Windows\System\ULTeIfp.exe
  2⤵
  PID:7712
- C:\Windows\System\ijuFlrw.exe
  C:\Windows\System\ijuFlrw.exe
  2⤵
  PID:7728
- C:\Windows\System\pdbpkBF.exe
  C:\Windows\System\pdbpkBF.exe
  2⤵
  PID:7744
- C:\Windows\System\nvQAIlU.exe
  C:\Windows\System\nvQAIlU.exe
  2⤵
  PID:7760
- C:\Windows\System\lfYDxVK.exe
  C:\Windows\System\lfYDxVK.exe
  2⤵
  PID:7780
- C:\Windows\System\ZQVEDCG.exe
  C:\Windows\System\ZQVEDCG.exe
  2⤵
  PID:7796
- C:\Windows\System\CYQLaxB.exe
  C:\Windows\System\CYQLaxB.exe
  2⤵
  PID:7812
- C:\Windows\System\QDxQkUk.exe
  C:\Windows\System\QDxQkUk.exe
  2⤵
  PID:7828
- C:\Windows\System\lQpUQkP.exe
  C:\Windows\System\lQpUQkP.exe
  2⤵
  PID:7848
- C:\Windows\System\ISmWFHR.exe
  C:\Windows\System\ISmWFHR.exe
  2⤵
  PID:7864
- C:\Windows\System\iEeucWx.exe
  C:\Windows\System\iEeucWx.exe
  2⤵
  PID:7884
- C:\Windows\System\sGWupsj.exe
  C:\Windows\System\sGWupsj.exe
  2⤵
  PID:7900
- C:\Windows\System\ZMLrzNX.exe
  C:\Windows\System\ZMLrzNX.exe
  2⤵
  PID:7916
- C:\Windows\System\HsVDwiO.exe
  C:\Windows\System\HsVDwiO.exe
  2⤵
  PID:7932
- C:\Windows\System\NjmbvZM.exe
  C:\Windows\System\NjmbvZM.exe
  2⤵
  PID:7952
- C:\Windows\System\vbspFLL.exe
  C:\Windows\System\vbspFLL.exe
  2⤵
  PID:7968
- C:\Windows\System\KYMIqEq.exe
  C:\Windows\System\KYMIqEq.exe
  2⤵
  PID:7984
- C:\Windows\System\pIFUvoW.exe
  C:\Windows\System\pIFUvoW.exe
  2⤵
  PID:8004
- C:\Windows\System\GXRmRyB.exe
  C:\Windows\System\GXRmRyB.exe
  2⤵
  PID:8020
- C:\Windows\System\OBSBWAU.exe
  C:\Windows\System\OBSBWAU.exe
  2⤵
  PID:8040
- C:\Windows\System\sAtOqQF.exe
  C:\Windows\System\sAtOqQF.exe
  2⤵
  PID:8056
- C:\Windows\System\TQvdebK.exe
  C:\Windows\System\TQvdebK.exe
  2⤵
  PID:8076
- C:\Windows\System\oMkduaZ.exe
  C:\Windows\System\oMkduaZ.exe
  2⤵
  PID:8092
- C:\Windows\System\AgVbsXC.exe
  C:\Windows\System\AgVbsXC.exe
  2⤵
  PID:8112
- C:\Windows\System\DLiFobv.exe
  C:\Windows\System\DLiFobv.exe
  2⤵
  PID:8128
- C:\Windows\System\iVzokkA.exe
  C:\Windows\System\iVzokkA.exe
  2⤵
  PID:8148
- C:\Windows\System\DhJNSch.exe
  C:\Windows\System\DhJNSch.exe
  2⤵
  PID:8164
- C:\Windows\System\HuwDeft.exe
  C:\Windows\System\HuwDeft.exe
  2⤵
  PID:8184
- C:\Windows\System\hFzTdqI.exe
  C:\Windows\System\hFzTdqI.exe
  2⤵
  PID:6288
- C:\Windows\System\BaCGEoV.exe
  C:\Windows\System\BaCGEoV.exe
  2⤵
  PID:5436
- C:\Windows\System\KxZiOrB.exe
  C:\Windows\System\KxZiOrB.exe
  2⤵
  PID:6348
- C:\Windows\System\sGKodey.exe
  C:\Windows\System\sGKodey.exe
  2⤵
  PID:6412
- C:\Windows\System\SBPpnnJ.exe
  C:\Windows\System\SBPpnnJ.exe
  2⤵
  PID:6476
- C:\Windows\System\bOrZvmQ.exe
  C:\Windows\System\bOrZvmQ.exe
  2⤵
  PID:6540
- C:\Windows\System\gtTRDqy.exe
  C:\Windows\System\gtTRDqy.exe
  2⤵
  PID:6604
- C:\Windows\System\FoPhgPl.exe
  C:\Windows\System\FoPhgPl.exe
  2⤵
  PID:6668
- C:\Windows\System\ApdGcTg.exe
  C:\Windows\System\ApdGcTg.exe
  2⤵
  PID:6188
- C:\Windows\System\SxfjmoV.exe
  C:\Windows\System\SxfjmoV.exe
  2⤵
  PID:6768
- C:\Windows\System\hUnzTXP.exe
  C:\Windows\System\hUnzTXP.exe
  2⤵
  PID:6832
- C:\Windows\System\JikeCXz.exe
  C:\Windows\System\JikeCXz.exe
  2⤵
  PID:6904
- C:\Windows\System\jkZPcNj.exe
  C:\Windows\System\jkZPcNj.exe
  2⤵
  PID:7000
- C:\Windows\System\DpULfDw.exe
  C:\Windows\System\DpULfDw.exe
  2⤵
  PID:5564
- C:\Windows\System\FJMilWU.exe
  C:\Windows\System\FJMilWU.exe
  2⤵
  PID:6052
- C:\Windows\System\UGUjqxr.exe
  C:\Windows\System\UGUjqxr.exe
  2⤵
  PID:6964
- C:\Windows\System\RDiPEDQ.exe
  C:\Windows\System\RDiPEDQ.exe
  2⤵
  PID:7100
- C:\Windows\System\FQKnEDW.exe
  C:\Windows\System\FQKnEDW.exe
  2⤵
  PID:7164
- C:\Windows\System\DmDyUEV.exe
  C:\Windows\System\DmDyUEV.exe
  2⤵
  PID:7188
- C:\Windows\System\SDryVQy.exe
  C:\Windows\System\SDryVQy.exe
  2⤵
  PID:2624
- C:\Windows\System\oJmuMzu.exe
  C:\Windows\System\oJmuMzu.exe
  2⤵
  PID:5216
- C:\Windows\System\nvqNgWG.exe
  C:\Windows\System\nvqNgWG.exe
  2⤵
  PID:5656
- C:\Windows\System\sNMMvXU.exe
  C:\Windows\System\sNMMvXU.exe
  2⤵
  PID:5692
- C:\Windows\System\PFcJflo.exe
  C:\Windows\System\PFcJflo.exe
  2⤵
  PID:5744
- C:\Windows\System\kgDOkEq.exe
  C:\Windows\System\kgDOkEq.exe
  2⤵
  PID:5676
- C:\Windows\System\EjfPTAg.exe
  C:\Windows\System\EjfPTAg.exe
  2⤵
  PID:5796
- C:\Windows\System\iVlLXFk.exe
  C:\Windows\System\iVlLXFk.exe
  2⤵
  PID:6004
- C:\Windows\System\oqKlOop.exe
  C:\Windows\System\oqKlOop.exe
  2⤵
  PID:6136
- C:\Windows\System\xzTYcEn.exe
  C:\Windows\System\xzTYcEn.exe
  2⤵
  PID:5236
- C:\Windows\System\qzHvLnR.exe
  C:\Windows\System\qzHvLnR.exe
  2⤵
  PID:4940
- C:\Windows\System\MqgApzF.exe
  C:\Windows\System\MqgApzF.exe
  2⤵
  PID:5608
- C:\Windows\System\bpiSxTp.exe
  C:\Windows\System\bpiSxTp.exe
  2⤵
  PID:5892
- C:\Windows\System\MOcoGlZ.exe
  C:\Windows\System\MOcoGlZ.exe
  2⤵
  PID:6176
- C:\Windows\System\EvAKSaH.exe
  C:\Windows\System\EvAKSaH.exe
  2⤵
  PID:6240
- C:\Windows\System\pXdixlc.exe
  C:\Windows\System\pXdixlc.exe
  2⤵
  PID:6304
- C:\Windows\System\eGSGdLy.exe
  C:\Windows\System\eGSGdLy.exe
  2⤵
  PID:6368
- C:\Windows\System\rTAYxjZ.exe
  C:\Windows\System\rTAYxjZ.exe
  2⤵
  PID:6432
- C:\Windows\System\oExnwTQ.exe
  C:\Windows\System\oExnwTQ.exe
  2⤵
  PID:6688
- C:\Windows\System\GjaCHHp.exe
  C:\Windows\System\GjaCHHp.exe
  2⤵
  PID:6988
- C:\Windows\System\wKPrQeS.exe
  C:\Windows\System\wKPrQeS.exe
  2⤵
  PID:7084
- C:\Windows\System\VPSukKQ.exe
  C:\Windows\System\VPSukKQ.exe
  2⤵
  PID:7148
- C:\Windows\System\ITIMXoQ.exe
  C:\Windows\System\ITIMXoQ.exe
  2⤵
  PID:7204
- C:\Windows\System\UIIgyBt.exe
  C:\Windows\System\UIIgyBt.exe
  2⤵
  PID:5188
- C:\Windows\System\cJyjECJ.exe
  C:\Windows\System\cJyjECJ.exe
  2⤵
  PID:5868
- C:\Windows\System\ByBFoGh.exe
  C:\Windows\System\ByBFoGh.exe
  2⤵
  PID:5912
- C:\Windows\System\cEggYfL.exe
  C:\Windows\System\cEggYfL.exe
  2⤵
  PID:5400
- C:\Windows\System\AaHhAiG.exe
  C:\Windows\System\AaHhAiG.exe
  2⤵
  PID:6556
- C:\Windows\System\gLpIyKx.exe
  C:\Windows\System\gLpIyKx.exe
  2⤵
  PID:6620
- C:\Windows\System\mBfihzN.exe
  C:\Windows\System\mBfihzN.exe
  2⤵
  PID:6684
- C:\Windows\System\mDPMusZ.exe
  C:\Windows\System\mDPMusZ.exe
  2⤵
  PID:6752
- C:\Windows\System\ucuRsXm.exe
  C:\Windows\System\ucuRsXm.exe
  2⤵
  PID:6844
- C:\Windows\System\JNPofbt.exe
  C:\Windows\System\JNPofbt.exe
  2⤵
  PID:6916
- C:\Windows\System\oYhcGET.exe
  C:\Windows\System\oYhcGET.exe
  2⤵
  PID:7208
- C:\Windows\System\YitdvAr.exe
  C:\Windows\System\YitdvAr.exe
  2⤵
  PID:7224
- C:\Windows\System\fUpRaRw.exe
  C:\Windows\System\fUpRaRw.exe
  2⤵
  PID:7756
- C:\Windows\System\zEtvpat.exe
  C:\Windows\System\zEtvpat.exe
  2⤵
  PID:7820
- C:\Windows\System\dzpPxkS.exe
  C:\Windows\System\dzpPxkS.exe
  2⤵
  PID:7892
- C:\Windows\System\EeWDPRB.exe
  C:\Windows\System\EeWDPRB.exe
  2⤵
  PID:7960
- C:\Windows\System\nXiMeyB.exe
  C:\Windows\System\nXiMeyB.exe
  2⤵
  PID:7992
- C:\Windows\System\cFvsODC.exe
  C:\Windows\System\cFvsODC.exe
  2⤵
  PID:7456
- C:\Windows\System\Uzswczy.exe
  C:\Windows\System\Uzswczy.exe
  2⤵
  PID:8072
- C:\Windows\System\BTLyghE.exe
  C:\Windows\System\BTLyghE.exe
  2⤵
  PID:8136
- C:\Windows\System\iAnYtZy.exe
  C:\Windows\System\iAnYtZy.exe
  2⤵
  PID:8176
- C:\Windows\System\hhKeYdZ.exe
  C:\Windows\System\hhKeYdZ.exe
  2⤵
  PID:6380
- C:\Windows\System\fJgcpDt.exe
  C:\Windows\System\fJgcpDt.exe
  2⤵
  PID:6636
- C:\Windows\System\koYiMyT.exe
  C:\Windows\System\koYiMyT.exe
  2⤵
  PID:6764
- C:\Windows\System\mSsTVFx.exe
  C:\Windows\System\mSsTVFx.exe
  2⤵
  PID:7584
- C:\Windows\System\RudzZlq.exe
  C:\Windows\System\RudzZlq.exe
  2⤵
  PID:7596
- C:\Windows\System\xCJyycr.exe
  C:\Windows\System\xCJyycr.exe
  2⤵
  PID:7640
- C:\Windows\System\JtvWsTL.exe
  C:\Windows\System\JtvWsTL.exe
  2⤵
  PID:7660
- C:\Windows\System\PUUJIDN.exe
  C:\Windows\System\PUUJIDN.exe
  2⤵
  PID:7240
- C:\Windows\System\gdoEYeC.exe
  C:\Windows\System\gdoEYeC.exe
  2⤵
  PID:7348
- C:\Windows\System\RSFlhCU.exe
  C:\Windows\System\RSFlhCU.exe
  2⤵
  PID:7908
- C:\Windows\System\gEvqzDg.exe
  C:\Windows\System\gEvqzDg.exe
  2⤵
  PID:7400
- C:\Windows\System\oVBLBdS.exe
  C:\Windows\System\oVBLBdS.exe
  2⤵
  PID:7504
- C:\Windows\System\YAZnlcE.exe
  C:\Windows\System\YAZnlcE.exe
  2⤵
  PID:7556
- C:\Windows\System\Jsklzuc.exe
  C:\Windows\System\Jsklzuc.exe
  2⤵
  PID:6224
- C:\Windows\System\avCrekz.exe
  C:\Windows\System\avCrekz.exe
  2⤵
  PID:2628
- C:\Windows\System\WbVTdyv.exe
  C:\Windows\System\WbVTdyv.exe
  2⤵
  PID:7256
- C:\Windows\System\Azfvboe.exe
  C:\Windows\System\Azfvboe.exe
  2⤵
  PID:7276
- C:\Windows\System\xfxUtMy.exe
  C:\Windows\System\xfxUtMy.exe
  2⤵
  PID:7292
- C:\Windows\System\OkysBIN.exe
  C:\Windows\System\OkysBIN.exe
  2⤵
  PID:7304
- C:\Windows\System\zyyKphk.exe
  C:\Windows\System\zyyKphk.exe
  2⤵
  PID:7320
- C:\Windows\System\AeXHRqr.exe
  C:\Windows\System\AeXHRqr.exe
  2⤵
  PID:7336
- C:\Windows\System\ioTksnd.exe
  C:\Windows\System\ioTksnd.exe
  2⤵
  PID:7360
- C:\Windows\System\fxgIyrd.exe
  C:\Windows\System\fxgIyrd.exe
  2⤵
  PID:7380
- C:\Windows\System\fQanbdT.exe
  C:\Windows\System\fQanbdT.exe
  2⤵
  PID:7408
- C:\Windows\System\rumjpJp.exe
  C:\Windows\System\rumjpJp.exe
  2⤵
  PID:7424
- C:\Windows\System\fdtXhji.exe
  C:\Windows\System\fdtXhji.exe
  2⤵
  PID:7444
- C:\Windows\System\FNeraCR.exe
  C:\Windows\System\FNeraCR.exe
  2⤵
  PID:8052
- C:\Windows\System\zlVimPX.exe
  C:\Windows\System\zlVimPX.exe
  2⤵
  PID:7472
- C:\Windows\System\EtrzEku.exe
  C:\Windows\System\EtrzEku.exe
  2⤵
  PID:7496
- C:\Windows\System\JBQzkPZ.exe
  C:\Windows\System\JBQzkPZ.exe
  2⤵
  PID:7512
- C:\Windows\System\zNbpzxd.exe
  C:\Windows\System\zNbpzxd.exe
  2⤵
  PID:7528
- C:\Windows\System\OJTJRpA.exe
  C:\Windows\System\OJTJRpA.exe
  2⤵
  PID:8160
- C:\Windows\System\asVcvxO.exe
  C:\Windows\System\asVcvxO.exe
  2⤵
  PID:7608
- C:\Windows\System\BdbeKiv.exe
  C:\Windows\System\BdbeKiv.exe
  2⤵
  PID:7628
- C:\Windows\System\NTZClfk.exe
  C:\Windows\System\NTZClfk.exe
  2⤵
  PID:7644
- C:\Windows\System\MDnpPjh.exe
  C:\Windows\System\MDnpPjh.exe
  2⤵
  PID:7684
- C:\Windows\System\UaCcfDR.exe
  C:\Windows\System\UaCcfDR.exe
  2⤵
  PID:7700
- C:\Windows\System\eYLXxVb.exe
  C:\Windows\System\eYLXxVb.exe
  2⤵
  PID:7708
- C:\Windows\System\nUzPAXO.exe
  C:\Windows\System\nUzPAXO.exe
  2⤵
  PID:6124
- C:\Windows\System\gMeDbnE.exe
  C:\Windows\System\gMeDbnE.exe
  2⤵
  PID:7768
- C:\Windows\System\ZVeiTYT.exe
  C:\Windows\System\ZVeiTYT.exe
  2⤵
  PID:7840
- C:\Windows\System\YxfXTGu.exe
  C:\Windows\System\YxfXTGu.exe
  2⤵
  PID:5880
- C:\Windows\System\SSxpVMk.exe
  C:\Windows\System\SSxpVMk.exe
  2⤵
  PID:7980
- C:\Windows\System\kZTArUO.exe
  C:\Windows\System\kZTArUO.exe
  2⤵
  PID:8088
- C:\Windows\System\quixvGw.exe
  C:\Windows\System\quixvGw.exe
  2⤵
  PID:6256
- C:\Windows\System\RpSLGix.exe
  C:\Windows\System\RpSLGix.exe
  2⤵
  PID:6444
- C:\Windows\System\qENEAQT.exe
  C:\Windows\System\qENEAQT.exe
  2⤵
  PID:6672
- C:\Windows\System\FEpAJfO.exe
  C:\Windows\System\FEpAJfO.exe
  2⤵
  PID:6828
- C:\Windows\System\TzaOMaK.exe
  C:\Windows\System\TzaOMaK.exe
  2⤵
  PID:5972
- C:\Windows\System\qcNoGBX.exe
  C:\Windows\System\qcNoGBX.exe
  2⤵
  PID:5860
- C:\Windows\System\hMimmXf.exe
  C:\Windows\System\hMimmXf.exe
  2⤵
  PID:7052
- C:\Windows\System\ObROqUC.exe
  C:\Windows\System\ObROqUC.exe
  2⤵
  PID:6236
- C:\Windows\System\dxUAJAQ.exe
  C:\Windows\System\dxUAJAQ.exe
  2⤵
  PID:5204
- C:\Windows\System\yTzZXZH.exe
  C:\Windows\System\yTzZXZH.exe
  2⤵
  PID:3692
- C:\Windows\System\lhxMCUV.exe
  C:\Windows\System\lhxMCUV.exe
  2⤵
  PID:5672
- C:\Windows\System\NVNSIOR.exe
  C:\Windows\System\NVNSIOR.exe
  2⤵
  PID:5136
- C:\Windows\System\tXNamQx.exe
  C:\Windows\System\tXNamQx.exe
  2⤵
  PID:6984
- C:\Windows\System\pVRAINp.exe
  C:\Windows\System\pVRAINp.exe
  2⤵
  PID:5896
- C:\Windows\System\WcmqncA.exe
  C:\Windows\System\WcmqncA.exe
  2⤵
  PID:7116
- C:\Windows\System\RcrTvta.exe
  C:\Windows\System\RcrTvta.exe
  2⤵
  PID:6208
- C:\Windows\System\nnsTIDo.exe
  C:\Windows\System\nnsTIDo.exe
  2⤵
  PID:1504
- C:\Windows\System\KLoTXts.exe
  C:\Windows\System\KLoTXts.exe
  2⤵
  PID:6720
- C:\Windows\System\qAXaoCE.exe
  C:\Windows\System\qAXaoCE.exe
  2⤵
  PID:7216
- C:\Windows\System\onqzmPS.exe
  C:\Windows\System\onqzmPS.exe
  2⤵
  PID:6524
- C:\Windows\System\UkJekMD.exe
  C:\Windows\System\UkJekMD.exe
  2⤵
  PID:6812
- C:\Windows\System\rivQlvL.exe
  C:\Windows\System\rivQlvL.exe
  2⤵
  PID:7724
- C:\Windows\System\DSLXSCp.exe
  C:\Windows\System\DSLXSCp.exe
  2⤵
  PID:7392
- C:\Windows\System\QSysDjy.exe
  C:\Windows\System\QSysDjy.exe
  2⤵
  PID:8000
- C:\Windows\System\ZvHIJbI.exe
  C:\Windows\System\ZvHIJbI.exe
  2⤵
  PID:8104
- C:\Windows\System\cmgvTWD.exe
  C:\Windows\System\cmgvTWD.exe
  2⤵
  PID:8172
- C:\Windows\System\OFvqmFX.exe
  C:\Windows\System\OFvqmFX.exe
  2⤵
  PID:7036
- C:\Windows\System\PjTLsmg.exe
  C:\Windows\System\PjTLsmg.exe
  2⤵
  PID:6192
- C:\Windows\System\UaqIGrv.exe
  C:\Windows\System\UaqIGrv.exe
  2⤵
  PID:7588
- C:\Windows\System\tVgpOcB.exe
  C:\Windows\System\tVgpOcB.exe
  2⤵
  PID:7312
- C:\Windows\System\bGkJfYW.exe
  C:\Windows\System\bGkJfYW.exe
  2⤵
  PID:7376
- C:\Windows\System\hfeOMOx.exe
  C:\Windows\System\hfeOMOx.exe
  2⤵
  PID:7544
- C:\Windows\System\tDBGhwn.exe
  C:\Windows\System\tDBGhwn.exe
  2⤵
  PID:7384
- C:\Windows\System\PgjzAIl.exe
  C:\Windows\System\PgjzAIl.exe
  2⤵
  PID:7284
- C:\Windows\System\PtWMOgP.exe
  C:\Windows\System\PtWMOgP.exe
  2⤵
  PID:7776
- C:\Windows\System\PRoUYkE.exe
  C:\Windows\System\PRoUYkE.exe
  2⤵
  PID:7352
- C:\Windows\System\jTYPHAF.exe
  C:\Windows\System\jTYPHAF.exe
  2⤵
  PID:7736
- C:\Windows\System\YtHTPut.exe
  C:\Windows\System\YtHTPut.exe
  2⤵
  PID:7468
- C:\Windows\System\XQAaAuL.exe
  C:\Windows\System\XQAaAuL.exe
  2⤵
  PID:7412
- C:\Windows\System\KwxkGuc.exe
  C:\Windows\System\KwxkGuc.exe
  2⤵
  PID:7372
- C:\Windows\System\lavbhgh.exe
  C:\Windows\System\lavbhgh.exe
  2⤵
  PID:7492
- C:\Windows\System\ooBLbdT.exe
  C:\Windows\System\ooBLbdT.exe
  2⤵
  PID:7616
- C:\Windows\System\SZhnMlO.exe
  C:\Windows\System\SZhnMlO.exe
  2⤵
  PID:7600
- C:\Windows\System\vXtktYo.exe
  C:\Windows\System\vXtktYo.exe
  2⤵
  PID:8064
- C:\Windows\System\WDcGZDg.exe
  C:\Windows\System\WDcGZDg.exe
  2⤵
  PID:6072
- C:\Windows\System\grtyaZb.exe
  C:\Windows\System\grtyaZb.exe
  2⤵
  PID:7740
- C:\Windows\System\nymNrnN.exe
  C:\Windows\System\nymNrnN.exe
  2⤵
  PID:7940
- C:\Windows\System\JPrbtce.exe
  C:\Windows\System\JPrbtce.exe
  2⤵
  PID:8084
- C:\Windows\System\GbcIqjE.exe
  C:\Windows\System\GbcIqjE.exe
  2⤵
  PID:6572
- C:\Windows\System\FfyaKwW.exe
  C:\Windows\System\FfyaKwW.exe
  2⤵
  PID:7176
- C:\Windows\System\Xcavkmq.exe
  C:\Windows\System\Xcavkmq.exe
  2⤵
  PID:6704
- C:\Windows\System\YbHzvkZ.exe
  C:\Windows\System\YbHzvkZ.exe
  2⤵
  PID:6496
- C:\Windows\System\YzBScti.exe
  C:\Windows\System\YzBScti.exe
  2⤵
  PID:2452
- C:\Windows\System\sxKjqKh.exe
  C:\Windows\System\sxKjqKh.exe
  2⤵
  PID:6888
- C:\Windows\System\OyvciqV.exe
  C:\Windows\System\OyvciqV.exe
  2⤵
  PID:7072
- C:\Windows\System\BlobmlW.exe
  C:\Windows\System\BlobmlW.exe
  2⤵
  PID:5936
- C:\Windows\System\ccOpJwJ.exe
  C:\Windows\System\ccOpJwJ.exe
  2⤵
  PID:6000
- C:\Windows\System\poWuvgN.exe
  C:\Windows\System\poWuvgN.exe
  2⤵
  PID:6592
- C:\Windows\System\pNEekio.exe
  C:\Windows\System\pNEekio.exe
  2⤵
  PID:8068
- C:\Windows\System\ddTIqFu.exe
  C:\Windows\System\ddTIqFu.exe
  2⤵
  PID:7576
- C:\Windows\System\bYrSYUP.exe
  C:\Windows\System\bYrSYUP.exe
  2⤵
  PID:7244
- C:\Windows\System\slgfeiF.exe
  C:\Windows\System\slgfeiF.exe
  2⤵
  PID:6952
- C:\Windows\System\FkKidmQ.exe
  C:\Windows\System\FkKidmQ.exe
  2⤵
  PID:7248
- C:\Windows\System\WUGKYwE.exe
  C:\Windows\System\WUGKYwE.exe
  2⤵
  PID:5324
- C:\Windows\System\qnatiLL.exe
  C:\Windows\System\qnatiLL.exe
  2⤵
  PID:7604
- C:\Windows\System\lCMpqnh.exe
  C:\Windows\System\lCMpqnh.exe
  2⤵
  PID:7344
- C:\Windows\System\SGpDvgP.exe
  C:\Windows\System\SGpDvgP.exe
  2⤵
  PID:7264
- C:\Windows\System\OBEMdCV.exe
  C:\Windows\System\OBEMdCV.exe
  2⤵
  PID:7488
- C:\Windows\System\nGbcQbK.exe
  C:\Windows\System\nGbcQbK.exe
  2⤵
  PID:7696
- C:\Windows\System\fxDRPSn.exe
  C:\Windows\System\fxDRPSn.exe
  2⤵
  PID:7836
- C:\Windows\System\wmOsksV.exe
  C:\Windows\System\wmOsksV.exe
  2⤵
  PID:8156
- C:\Windows\System\IXjhrtz.exe
  C:\Windows\System\IXjhrtz.exe
  2⤵
  PID:2660
- C:\Windows\System\WSRELoV.exe
  C:\Windows\System\WSRELoV.exe
  2⤵
  PID:7448
- C:\Windows\System\ImpSTjD.exe
  C:\Windows\System\ImpSTjD.exe
  2⤵
  PID:6968
- C:\Windows\System\ZRAVWfs.exe
  C:\Windows\System\ZRAVWfs.exe
  2⤵
  PID:2004
- C:\Windows\System\WWnCWkq.exe
  C:\Windows\System\WWnCWkq.exe
  2⤵
  PID:5264
- C:\Windows\System\uqahyJl.exe
  C:\Windows\System\uqahyJl.exe
  2⤵
  PID:6736
- C:\Windows\System\AUPiMEk.exe
  C:\Windows\System\AUPiMEk.exe
  2⤵
  PID:6588
- C:\Windows\System\YZDCRFd.exe
  C:\Windows\System\YZDCRFd.exe
  2⤵
  PID:5500
- C:\Windows\System\xvbkYEQ.exe
  C:\Windows\System\xvbkYEQ.exe
  2⤵
  PID:7328
- C:\Windows\System\kEAVmCD.exe
  C:\Windows\System\kEAVmCD.exe
  2⤵
  PID:8144
- C:\Windows\System\czVGYAs.exe
  C:\Windows\System\czVGYAs.exe
  2⤵
  PID:5596
- C:\Windows\System\UONYZDO.exe
  C:\Windows\System\UONYZDO.exe
  2⤵
  PID:7440
- C:\Windows\System\iBfjlvt.exe
  C:\Windows\System\iBfjlvt.exe
  2⤵
  PID:6320
- C:\Windows\System\PHifZhJ.exe
  C:\Windows\System\PHifZhJ.exe
  2⤵
  PID:5920
- C:\Windows\System\BuxfGTa.exe
  C:\Windows\System\BuxfGTa.exe
  2⤵
  PID:8200
- C:\Windows\System\eLLgqHl.exe
  C:\Windows\System\eLLgqHl.exe
  2⤵
  PID:8216
- C:\Windows\System\JaKzStk.exe
  C:\Windows\System\JaKzStk.exe
  2⤵
  PID:8232
- C:\Windows\System\OZvwSNn.exe
  C:\Windows\System\OZvwSNn.exe
  2⤵
  PID:8248
- C:\Windows\System\HqAciqS.exe
  C:\Windows\System\HqAciqS.exe
  2⤵
  PID:8264
- C:\Windows\System\VHSQIKF.exe
  C:\Windows\System\VHSQIKF.exe
  2⤵
  PID:8280
- C:\Windows\System\TdngNTO.exe
  C:\Windows\System\TdngNTO.exe
  2⤵
  PID:8296
- C:\Windows\System\fCCoaSn.exe
  C:\Windows\System\fCCoaSn.exe
  2⤵
  PID:8312
- C:\Windows\System\CmilHaX.exe
  C:\Windows\System\CmilHaX.exe
  2⤵
  PID:8328
- C:\Windows\System\uAbtwSH.exe
  C:\Windows\System\uAbtwSH.exe
  2⤵
  PID:8344
- C:\Windows\System\AfmILbC.exe
  C:\Windows\System\AfmILbC.exe
  2⤵
  PID:8360
- C:\Windows\System\gLkfUdA.exe
  C:\Windows\System\gLkfUdA.exe
  2⤵
  PID:8376
- C:\Windows\System\JcEyDsY.exe
  C:\Windows\System\JcEyDsY.exe
  2⤵
  PID:8392
- C:\Windows\System\veRZtrM.exe
  C:\Windows\System\veRZtrM.exe
  2⤵
  PID:8408
- C:\Windows\System\FmgzsEB.exe
  C:\Windows\System\FmgzsEB.exe
  2⤵
  PID:8424
- C:\Windows\System\XymkYHX.exe
  C:\Windows\System\XymkYHX.exe
  2⤵
  PID:8440
- C:\Windows\System\skYhgDd.exe
  C:\Windows\System\skYhgDd.exe
  2⤵
  PID:8456
- C:\Windows\System\ozLhhyQ.exe
  C:\Windows\System\ozLhhyQ.exe
  2⤵
  PID:8472
- C:\Windows\System\zTGEUzW.exe
  C:\Windows\System\zTGEUzW.exe
  2⤵
  PID:8488
- C:\Windows\System\YQRCNyA.exe
  C:\Windows\System\YQRCNyA.exe
  2⤵
  PID:8504
- C:\Windows\System\qyYjzAk.exe
  C:\Windows\System\qyYjzAk.exe
  2⤵
  PID:8520
- C:\Windows\System\KSeIKmP.exe
  C:\Windows\System\KSeIKmP.exe
  2⤵
  PID:8536
- C:\Windows\System\jyJFFVN.exe
  C:\Windows\System\jyJFFVN.exe
  2⤵
  PID:8552
- C:\Windows\System\xLcNMiz.exe
  C:\Windows\System\xLcNMiz.exe
  2⤵
  PID:8568
- C:\Windows\System\jDhIobp.exe
  C:\Windows\System\jDhIobp.exe
  2⤵
  PID:8584
- C:\Windows\System\NXkmpco.exe
  C:\Windows\System\NXkmpco.exe
  2⤵
  PID:8600
- C:\Windows\System\uCpkYxn.exe
  C:\Windows\System\uCpkYxn.exe
  2⤵
  PID:8616
- C:\Windows\System\qWzbBaM.exe
  C:\Windows\System\qWzbBaM.exe
  2⤵
  PID:8632
- C:\Windows\System\tshSlyq.exe
  C:\Windows\System\tshSlyq.exe
  2⤵
  PID:8648
- C:\Windows\System\xlQTEvZ.exe
  C:\Windows\System\xlQTEvZ.exe
  2⤵
  PID:8664
- C:\Windows\System\eJwFvBS.exe
  C:\Windows\System\eJwFvBS.exe
  2⤵
  PID:8680
- C:\Windows\System\XlCZvrB.exe
  C:\Windows\System\XlCZvrB.exe
  2⤵
  PID:8696
- C:\Windows\System\VnELDqd.exe
  C:\Windows\System\VnELDqd.exe
  2⤵
  PID:8712
- C:\Windows\System\vJadeeB.exe
  C:\Windows\System\vJadeeB.exe
  2⤵
  PID:8728
- C:\Windows\System\wVNbwrt.exe
  C:\Windows\System\wVNbwrt.exe
  2⤵
  PID:8744
- C:\Windows\System\yjQIrvS.exe
  C:\Windows\System\yjQIrvS.exe
  2⤵
  PID:8760
- C:\Windows\System\QHfFQpm.exe
  C:\Windows\System\QHfFQpm.exe
  2⤵
  PID:8776
- C:\Windows\System\xgwXPBA.exe
  C:\Windows\System\xgwXPBA.exe
  2⤵
  PID:8792
- C:\Windows\System\DBmjSAb.exe
  C:\Windows\System\DBmjSAb.exe
  2⤵
  PID:8808
- C:\Windows\System\UaJuvOr.exe
  C:\Windows\System\UaJuvOr.exe
  2⤵
  PID:8824
- C:\Windows\System\bOfadyy.exe
  C:\Windows\System\bOfadyy.exe
  2⤵
  PID:8840
- C:\Windows\System\EKBQkVn.exe
  C:\Windows\System\EKBQkVn.exe
  2⤵
  PID:8856
- C:\Windows\System\ORjfZCr.exe
  C:\Windows\System\ORjfZCr.exe
  2⤵
  PID:8872
- C:\Windows\System\oPcsuKU.exe
  C:\Windows\System\oPcsuKU.exe
  2⤵
  PID:8888
- C:\Windows\System\xswoJuV.exe
  C:\Windows\System\xswoJuV.exe
  2⤵
  PID:8904
- C:\Windows\System\JtUxfXB.exe
  C:\Windows\System\JtUxfXB.exe
  2⤵
  PID:8920
- C:\Windows\System\siMVvqI.exe
  C:\Windows\System\siMVvqI.exe
  2⤵
  PID:8936
- C:\Windows\System\HiNsLOW.exe
  C:\Windows\System\HiNsLOW.exe
  2⤵
  PID:8952
- C:\Windows\System\TPIYxbU.exe
  C:\Windows\System\TPIYxbU.exe
  2⤵
  PID:8968
- C:\Windows\System\bXTnwTt.exe
  C:\Windows\System\bXTnwTt.exe
  2⤵
  PID:8984
- C:\Windows\System\buAjlJt.exe
  C:\Windows\System\buAjlJt.exe
  2⤵
  PID:9000
- C:\Windows\System\yxmOSsq.exe
  C:\Windows\System\yxmOSsq.exe
  2⤵
  PID:9016
- C:\Windows\System\DEdolfy.exe
  C:\Windows\System\DEdolfy.exe
  2⤵
  PID:9032
- C:\Windows\System\WbCuauY.exe
  C:\Windows\System\WbCuauY.exe
  2⤵
  PID:9048
- C:\Windows\System\cyZohAP.exe
  C:\Windows\System\cyZohAP.exe
  2⤵
  PID:9064
- C:\Windows\System\gABILjH.exe
  C:\Windows\System\gABILjH.exe
  2⤵
  PID:9080
- C:\Windows\System\AJcEbgx.exe
  C:\Windows\System\AJcEbgx.exe
  2⤵
  PID:9096
- C:\Windows\System\euBidsW.exe
  C:\Windows\System\euBidsW.exe
  2⤵
  PID:9112
- C:\Windows\System\GfqPFnX.exe
  C:\Windows\System\GfqPFnX.exe
  2⤵
  PID:9128
- C:\Windows\System\zZzCRhv.exe
  C:\Windows\System\zZzCRhv.exe
  2⤵
  PID:9144
- C:\Windows\System\aCqvmuo.exe
  C:\Windows\System\aCqvmuo.exe
  2⤵
  PID:9160
- C:\Windows\System\xNbNWkl.exe
  C:\Windows\System\xNbNWkl.exe
  2⤵
  PID:9176
- C:\Windows\System\tvAEahj.exe
  C:\Windows\System\tvAEahj.exe
  2⤵
  PID:9192
- C:\Windows\System\thotlze.exe
  C:\Windows\System\thotlze.exe
  2⤵
  PID:9208
- C:\Windows\System\FiboSrO.exe
  C:\Windows\System\FiboSrO.exe
  2⤵
  PID:2484
- C:\Windows\System\xExudSQ.exe
  C:\Windows\System\xExudSQ.exe
  2⤵
  PID:7452
- C:\Windows\System\npuwByo.exe
  C:\Windows\System\npuwByo.exe
  2⤵
  PID:8212
- C:\Windows\System\xRnzuib.exe
  C:\Windows\System\xRnzuib.exe
  2⤵
  PID:8276
- C:\Windows\System\WJNCUMF.exe
  C:\Windows\System\WJNCUMF.exe
  2⤵
  PID:8340
- C:\Windows\System\qbYFSDD.exe
  C:\Windows\System\qbYFSDD.exe
  2⤵
  PID:8404
- C:\Windows\System\WAwrBdP.exe
  C:\Windows\System\WAwrBdP.exe
  2⤵
  PID:8468
- C:\Windows\System\zeylYjn.exe
  C:\Windows\System\zeylYjn.exe
  2⤵
  PID:8532
- C:\Windows\System\GgHnAPu.exe
  C:\Windows\System\GgHnAPu.exe
  2⤵
  PID:8564
- C:\Windows\System\FyytUyA.exe
  C:\Windows\System\FyytUyA.exe
  2⤵
  PID:8624
- C:\Windows\System\hlxQycT.exe
  C:\Windows\System\hlxQycT.exe
  2⤵
  PID:8256
- C:\Windows\System\ilyMYwl.exe
  C:\Windows\System\ilyMYwl.exe
  2⤵
  PID:8320
- C:\Windows\System\rnmtgmT.exe
  C:\Windows\System\rnmtgmT.exe
  2⤵
  PID:8452
- C:\Windows\System\sAQHlDa.exe
  C:\Windows\System\sAQHlDa.exe
  2⤵
  PID:8516
- C:\Windows\System\aThurBZ.exe
  C:\Windows\System\aThurBZ.exe
  2⤵
  PID:8612
- C:\Windows\System\eVVysbP.exe
  C:\Windows\System\eVVysbP.exe
  2⤵
  PID:8388
- C:\Windows\System\TJdeGnP.exe
  C:\Windows\System\TJdeGnP.exe
  2⤵
  PID:8484
- C:\Windows\System\NmekUkw.exe
  C:\Windows\System\NmekUkw.exe
  2⤵
  PID:6868
- C:\Windows\System\SwbwqfY.exe
  C:\Windows\System\SwbwqfY.exe
  2⤵
  PID:6948
- C:\Windows\System\JYbjhwQ.exe
  C:\Windows\System\JYbjhwQ.exe
  2⤵
  PID:8224
- C:\Windows\System\JVkbmVc.exe
  C:\Windows\System\JVkbmVc.exe
  2⤵
  PID:8356
- C:\Windows\System\hFNHbym.exe
  C:\Windows\System\hFNHbym.exe
  2⤵
  PID:8720
- C:\Windows\System\foDLAcI.exe
  C:\Windows\System\foDLAcI.exe
  2⤵
  PID:8740
- C:\Windows\System\VDhtUDh.exe
  C:\Windows\System\VDhtUDh.exe
  2⤵
  PID:8788
- C:\Windows\System\FNsVJUx.exe
  C:\Windows\System\FNsVJUx.exe
  2⤵
  PID:8772
- C:\Windows\System\rQfpCwX.exe
  C:\Windows\System\rQfpCwX.exe
  2⤵
  PID:8884
- C:\Windows\System\dDSCDeR.exe
  C:\Windows\System\dDSCDeR.exe
  2⤵
  PID:8804
- C:\Windows\System\QiSNLhg.exe
  C:\Windows\System\QiSNLhg.exe
  2⤵
  PID:8944
- C:\Windows\System\ZptrHCe.exe
  C:\Windows\System\ZptrHCe.exe
  2⤵
  PID:8928
- C:\Windows\System\JjuxRnY.exe
  C:\Windows\System\JjuxRnY.exe
  2⤵
  PID:8964
- C:\Windows\System\NzOECQO.exe
  C:\Windows\System\NzOECQO.exe
  2⤵
  PID:8996
- C:\Windows\System\CjcBAOc.exe
  C:\Windows\System\CjcBAOc.exe
  2⤵
  PID:9072
- C:\Windows\System\lDJxvaa.exe
  C:\Windows\System\lDJxvaa.exe
  2⤵
  PID:9056
- C:\Windows\System\UUKgLcg.exe
  C:\Windows\System\UUKgLcg.exe
  2⤵
  PID:9136
- C:\Windows\System\paUiPot.exe
  C:\Windows\System\paUiPot.exe
  2⤵
  PID:9088
- C:\Windows\System\TgBmKvR.exe
  C:\Windows\System\TgBmKvR.exe
  2⤵
  PID:9152
- C:\Windows\System\AjAyebq.exe
  C:\Windows\System\AjAyebq.exe
  2⤵
  PID:9188
- C:\Windows\System\LgYcXDp.exe
  C:\Windows\System\LgYcXDp.exe
  2⤵
  PID:7300
- C:\Windows\System\RxJWtdM.exe
  C:\Windows\System\RxJWtdM.exe
  2⤵
  PID:8272
- C:\Windows\System\aQsrYpW.exe
  C:\Windows\System\aQsrYpW.exe
  2⤵
  PID:8336
- C:\Windows\System\slqvZVQ.exe
  C:\Windows\System\slqvZVQ.exe
  2⤵
  PID:8528
- C:\Windows\System\jcVvoSl.exe
  C:\Windows\System\jcVvoSl.exe
  2⤵
  PID:8596
- C:\Windows\System\pfcDuRz.exe
  C:\Windows\System\pfcDuRz.exe
  2⤵
  PID:8512
- C:\Windows\System\RYmCZKa.exe
  C:\Windows\System\RYmCZKa.exe
  2⤵
  PID:7808
- C:\Windows\System\FdUkhej.exe
  C:\Windows\System\FdUkhej.exe
  2⤵
  PID:6220
- C:\Windows\System\BuCVzyg.exe
  C:\Windows\System\BuCVzyg.exe
  2⤵
  PID:8384
- C:\Windows\System\BTOeWMx.exe
  C:\Windows\System\BTOeWMx.exe
  2⤵
  PID:6364
- C:\Windows\System\ChRAbjc.exe
  C:\Windows\System\ChRAbjc.exe
  2⤵
  PID:8708
- C:\Windows\System\djLyfYm.exe
  C:\Windows\System\djLyfYm.exe
  2⤵
  PID:8352
- C:\Windows\System\iYVKKXZ.exe
  C:\Windows\System\iYVKKXZ.exe
  2⤵
  PID:8912
- C:\Windows\System\NZUDntY.exe
  C:\Windows\System\NZUDntY.exe
  2⤵
  PID:8768
- C:\Windows\System\YBZHkDB.exe
  C:\Windows\System\YBZHkDB.exe
  2⤵
  PID:8960
- C:\Windows\System\tvaLkVg.exe
  C:\Windows\System\tvaLkVg.exe
  2⤵
  PID:9012
- C:\Windows\System\STfcSIF.exe
  C:\Windows\System\STfcSIF.exe
  2⤵
  PID:7680
- C:\Windows\System\OSNSixK.exe
  C:\Windows\System\OSNSixK.exe
  2⤵
  PID:8980
- C:\Windows\System\ZOkpPLp.exe
  C:\Windows\System\ZOkpPLp.exe
  2⤵
  PID:9028
- C:\Windows\System\qbZgiXj.exe
  C:\Windows\System\qbZgiXj.exe
  2⤵
  PID:8464
- C:\Windows\System\cikzzgu.exe
  C:\Windows\System\cikzzgu.exe
  2⤵
  PID:9184
- C:\Windows\System\GcxZatU.exe
  C:\Windows\System\GcxZatU.exe
  2⤵
  PID:8672
- C:\Windows\System\YJRVwPo.exe
  C:\Windows\System\YJRVwPo.exe
  2⤵
  PID:8692
- C:\Windows\System\spdPjEn.exe
  C:\Windows\System\spdPjEn.exe
  2⤵
  PID:8704
- C:\Windows\System\luUBmch.exe
  C:\Windows\System\luUBmch.exe
  2⤵
  PID:8048
- C:\Windows\System\bVLNaoZ.exe
  C:\Windows\System\bVLNaoZ.exe
  2⤵
  PID:7792
- C:\Windows\System\cXSvEHG.exe
  C:\Windows\System\cXSvEHG.exe
  2⤵
  PID:9108
- C:\Windows\System\gELzDCU.exe
  C:\Windows\System\gELzDCU.exe
  2⤵
  PID:8660
- C:\Windows\System\RNIRpPL.exe
  C:\Windows\System\RNIRpPL.exe
  2⤵
  PID:7568
- C:\Windows\System\nRRAvQk.exe
  C:\Windows\System\nRRAvQk.exe
  2⤵
  PID:9104
- C:\Windows\System\PXWpOsA.exe
  C:\Windows\System\PXWpOsA.exe
  2⤵
  PID:9168
- C:\Windows\System\GQgxDTu.exe
  C:\Windows\System\GQgxDTu.exe
  2⤵
  PID:8292
- C:\Windows\System\FQZgoDX.exe
  C:\Windows\System\FQZgoDX.exe
  2⤵
  PID:8644
- C:\Windows\System\uZyeLdj.exe
  C:\Windows\System\uZyeLdj.exe
  2⤵
  PID:8656
- C:\Windows\System\SOsucxF.exe
  C:\Windows\System\SOsucxF.exe
  2⤵
  PID:9200
- C:\Windows\System\MnYceIz.exe
  C:\Windows\System\MnYceIz.exe
  2⤵
  PID:9092
- C:\Windows\System\kLnuhgA.exe
  C:\Windows\System\kLnuhgA.exe
  2⤵
  PID:9232
- C:\Windows\System\FkHPhwi.exe
  C:\Windows\System\FkHPhwi.exe
  2⤵
  PID:9248
- C:\Windows\System\Wxrnbkr.exe
  C:\Windows\System\Wxrnbkr.exe
  2⤵
  PID:9264
- C:\Windows\System\FtyRrBV.exe
  C:\Windows\System\FtyRrBV.exe
  2⤵
  PID:9280
- C:\Windows\System\QvFJlCq.exe
  C:\Windows\System\QvFJlCq.exe
  2⤵
  PID:9296
- C:\Windows\System\svvJgkI.exe
  C:\Windows\System\svvJgkI.exe
  2⤵
  PID:9312
- C:\Windows\System\CUlMlQL.exe
  C:\Windows\System\CUlMlQL.exe
  2⤵
  PID:9328
- C:\Windows\System\coAREkW.exe
  C:\Windows\System\coAREkW.exe
  2⤵
  PID:9344
- C:\Windows\System\uAnbBrD.exe
  C:\Windows\System\uAnbBrD.exe
  2⤵
  PID:9360
- C:\Windows\System\LKfaQXg.exe
  C:\Windows\System\LKfaQXg.exe
  2⤵
  PID:9376
- C:\Windows\System\oNkDaFp.exe
  C:\Windows\System\oNkDaFp.exe
  2⤵
  PID:9392
- C:\Windows\System\nbSovsY.exe
  C:\Windows\System\nbSovsY.exe
  2⤵
  PID:9408
- C:\Windows\System\dhUxefK.exe
  C:\Windows\System\dhUxefK.exe
  2⤵
  PID:9424
- C:\Windows\System\ytxxQwf.exe
  C:\Windows\System\ytxxQwf.exe
  2⤵
  PID:9440
- C:\Windows\System\MDXmPNm.exe
  C:\Windows\System\MDXmPNm.exe
  2⤵
  PID:9456
- C:\Windows\System\gMKwftJ.exe
  C:\Windows\System\gMKwftJ.exe
  2⤵
  PID:9472
- C:\Windows\System\NguUmNI.exe
  C:\Windows\System\NguUmNI.exe
  2⤵
  PID:9488
- C:\Windows\System\COCIeKk.exe
  C:\Windows\System\COCIeKk.exe
  2⤵
  PID:9504
- C:\Windows\System\QYwSmru.exe
  C:\Windows\System\QYwSmru.exe
  2⤵
  PID:9520
- C:\Windows\System\hKbQPEg.exe
  C:\Windows\System\hKbQPEg.exe
  2⤵
  PID:9536
- C:\Windows\System\nfOmuHl.exe
  C:\Windows\System\nfOmuHl.exe
  2⤵
  PID:9552
- C:\Windows\System\kFGQqkx.exe
  C:\Windows\System\kFGQqkx.exe
  2⤵
  PID:9568
- C:\Windows\System\JpbazfS.exe
  C:\Windows\System\JpbazfS.exe
  2⤵
  PID:9584
- C:\Windows\System\qwByApA.exe
  C:\Windows\System\qwByApA.exe
  2⤵
  PID:9600
- C:\Windows\System\SHDLrDa.exe
  C:\Windows\System\SHDLrDa.exe
  2⤵
  PID:9616
- C:\Windows\System\ZVDQOVy.exe
  C:\Windows\System\ZVDQOVy.exe
  2⤵
  PID:9632
- C:\Windows\System\VDabMmc.exe
  C:\Windows\System\VDabMmc.exe
  2⤵
  PID:9648
- C:\Windows\System\TGPrCvN.exe
  C:\Windows\System\TGPrCvN.exe
  2⤵
  PID:9664
- C:\Windows\System\LyuOHNH.exe
  C:\Windows\System\LyuOHNH.exe
  2⤵
  PID:9680
- C:\Windows\System\vdSlaIv.exe
  C:\Windows\System\vdSlaIv.exe
  2⤵
  PID:9696
- C:\Windows\System\IdpBLmE.exe
  C:\Windows\System\IdpBLmE.exe
  2⤵
  PID:9712
- C:\Windows\System\fKIncgz.exe
  C:\Windows\System\fKIncgz.exe
  2⤵
  PID:9728
- C:\Windows\System\eFOSfYj.exe
  C:\Windows\System\eFOSfYj.exe
  2⤵
  PID:9744
- C:\Windows\System\FrwhLnI.exe
  C:\Windows\System\FrwhLnI.exe
  2⤵
  PID:9760
- C:\Windows\System\YemyxNp.exe
  C:\Windows\System\YemyxNp.exe
  2⤵
  PID:9776
- C:\Windows\System\FlWoToQ.exe
  C:\Windows\System\FlWoToQ.exe
  2⤵
  PID:9792
- C:\Windows\System\ogvoXdw.exe
  C:\Windows\System\ogvoXdw.exe
  2⤵
  PID:9808
- C:\Windows\System\nHIckAS.exe
  C:\Windows\System\nHIckAS.exe
  2⤵
  PID:9824
- C:\Windows\System\iLtkmyp.exe
  C:\Windows\System\iLtkmyp.exe
  2⤵
  PID:9840
- C:\Windows\System\lFiLIYB.exe
  C:\Windows\System\lFiLIYB.exe
  2⤵
  PID:9856
- C:\Windows\System\yoRHylo.exe
  C:\Windows\System\yoRHylo.exe
  2⤵
  PID:9872
- C:\Windows\System\pjjvBhs.exe
  C:\Windows\System\pjjvBhs.exe
  2⤵
  PID:9888
- C:\Windows\System\kvjibGZ.exe
  C:\Windows\System\kvjibGZ.exe
  2⤵
  PID:9904
- C:\Windows\System\UwwKeFN.exe
  C:\Windows\System\UwwKeFN.exe
  2⤵
  PID:9920
- C:\Windows\System\fMUqqWY.exe
  C:\Windows\System\fMUqqWY.exe
  2⤵
  PID:9936
- C:\Windows\System\wGCpiwM.exe
  C:\Windows\System\wGCpiwM.exe
  2⤵
  PID:9952
- C:\Windows\System\PfdRMUV.exe
  C:\Windows\System\PfdRMUV.exe
  2⤵
  PID:9968
- C:\Windows\System\zvoimeW.exe
  C:\Windows\System\zvoimeW.exe
  2⤵
  PID:9984
- C:\Windows\System\WKVUrWJ.exe
  C:\Windows\System\WKVUrWJ.exe
  2⤵
  PID:10004
- C:\Windows\System\EUOSHzC.exe
  C:\Windows\System\EUOSHzC.exe
  2⤵
  PID:10020
- C:\Windows\System\TGnXWhW.exe
  C:\Windows\System\TGnXWhW.exe
  2⤵
  PID:10036
- C:\Windows\System\bLNROtV.exe
  C:\Windows\System\bLNROtV.exe
  2⤵
  PID:10052
- C:\Windows\System\iBswrMr.exe
  C:\Windows\System\iBswrMr.exe
  2⤵
  PID:10068
- C:\Windows\System\GGvvzRR.exe
  C:\Windows\System\GGvvzRR.exe
  2⤵
  PID:10084
- C:\Windows\System\fpCqIBa.exe
  C:\Windows\System\fpCqIBa.exe
  2⤵
  PID:10100
- C:\Windows\System\IgzNYta.exe
  C:\Windows\System\IgzNYta.exe
  2⤵
  PID:10116
- C:\Windows\System\UhrMIhU.exe
  C:\Windows\System\UhrMIhU.exe
  2⤵
  PID:10132
- C:\Windows\System\enYvOAK.exe
  C:\Windows\System\enYvOAK.exe
  2⤵
  PID:10148
- C:\Windows\System\XbdBLcC.exe
  C:\Windows\System\XbdBLcC.exe
  2⤵
  PID:10164
- C:\Windows\System\tfjAgcz.exe
  C:\Windows\System\tfjAgcz.exe
  2⤵
  PID:10180
- C:\Windows\System\ajRGaTj.exe
  C:\Windows\System\ajRGaTj.exe
  2⤵
  PID:10196
- C:\Windows\System\mjRqnSG.exe
  C:\Windows\System\mjRqnSG.exe
  2⤵
  PID:10212
- C:\Windows\System\mZHoaFm.exe
  C:\Windows\System\mZHoaFm.exe
  2⤵
  PID:10228
- C:\Windows\System\QFTXPVY.exe
  C:\Windows\System\QFTXPVY.exe
  2⤵
  PID:9224
- C:\Windows\System\LoAjhPC.exe
  C:\Windows\System\LoAjhPC.exe
  2⤵
  PID:6020
- C:\Windows\System\CUVEAYm.exe
  C:\Windows\System\CUVEAYm.exe
  2⤵
  PID:9288
- C:\Windows\System\XqLsbvn.exe
  C:\Windows\System\XqLsbvn.exe
  2⤵
  PID:9240
- C:\Windows\System\csySleZ.exe
  C:\Windows\System\csySleZ.exe
  2⤵
  PID:9308
- C:\Windows\System\qpiFtpK.exe
  C:\Windows\System\qpiFtpK.exe
  2⤵
  PID:9384
- C:\Windows\System\Wruhvkv.exe
  C:\Windows\System\Wruhvkv.exe
  2⤵
  PID:9448
- C:\Windows\System\CDWnRny.exe
  C:\Windows\System\CDWnRny.exe
  2⤵
  PID:9404
- C:\Windows\System\PIfDNwl.exe
  C:\Windows\System\PIfDNwl.exe
  2⤵
  PID:9368
- C:\Windows\System\MXNckXq.exe
  C:\Windows\System\MXNckXq.exe
  2⤵
  PID:9436
- C:\Windows\System\SSWSCLN.exe
  C:\Windows\System\SSWSCLN.exe
  2⤵
  PID:9576
- C:\Windows\System\pAMmvNY.exe
  C:\Windows\System\pAMmvNY.exe
  2⤵
  PID:9640
- C:\Windows\System\qMpZycy.exe
  C:\Windows\System\qMpZycy.exe
  2⤵
  PID:9532
- C:\Windows\System\AsSOAen.exe
  C:\Windows\System\AsSOAen.exe
  2⤵
  PID:9624
- C:\Windows\System\yvcMnOJ.exe
  C:\Windows\System\yvcMnOJ.exe
  2⤵
  PID:9708
- C:\Windows\System\UeyPEuq.exe
  C:\Windows\System\UeyPEuq.exe
  2⤵
  PID:9564
- C:\Windows\System\qhDOoSH.exe
  C:\Windows\System\qhDOoSH.exe
  2⤵
  PID:9592
- C:\Windows\System\fwXoHfh.exe
  C:\Windows\System\fwXoHfh.exe
  2⤵
  PID:9688
- C:\Windows\System\NOdYhes.exe
  C:\Windows\System\NOdYhes.exe
  2⤵
  PID:9752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EzIIXKi.exe

Filesize
1.7MB

MD5
80ffbc59c0956b80c24ecdb795741a4c

SHA1
ca69a9103c6ab89bc2b3546782c5b2ec626223d7

SHA256
dbb36cded029a4e2489bd747251838b51c26ff0859ca77b4d9a78722add0f94e

SHA512
64231ab53d59062f4951f569cc40b6bab75455c3d7da505237ca3d4fc511aa803e152565226eba9c3806cc0ee1eb027da3e00351de16508817775118b1b4c4d1

Download Submit
C:\Windows\system\HFMmGST.exe

Filesize
1.7MB

MD5
0b7e67de961e558e6bac6eb53a6d3529

SHA1
f41211423cd5924e082527bb6b31497ce686962a

SHA256
4723c7b906fa22df989ce3c481178c865a308eddb39c51d530d91a558aa730f3

SHA512
96bddb092dd6ba3bce3fc4eb6e205c0e7b2cb77b3acb6fe00dc79e5aba6d3dd5937840a55f4caf9ff2fd877f2a463efeade1b307ed7573dc6b53d571e942443a

Download Submit
C:\Windows\system\HzqaLjG.exe

Filesize
1.7MB

MD5
ddd063102fb98709b73eb3695f941333

SHA1
9f164d0865c94c39273eeaba99d41610fe77a3cf

SHA256
91413b2b9f672f52ca4f14e6ef9769e67f76490e563e96cf9486dd1ac80756cb

SHA512
59e084fff7608d897c0b0ab86e285da0ae2d484becb540c42fc9c7fa4db6b820ee96304ff424b18a90395e039dc09ee65a77a4e9444f16d4ce7a5a99597526b1

Download Submit
C:\Windows\system\ItKOrvb.exe

Filesize
1.7MB

MD5
a03bf1aead60978bc6db7a8949bcf23b

SHA1
449af8371e17ae3c06a15c9cd1f9573f67a66a3c

SHA256
55fb9dc2fb0731f356d755a4d94d3ef40c294dfdf2925db3492eb322ccbbb4f6

SHA512
bfa5119ccfe69c4aa722420cf328ee30f385e9f2fa765e02ae8fe74484ffeb6f9fa79fccbd038ab3dc36166ec1a6995b63de78331549085be4cbf9af8e8080df

Download Submit
C:\Windows\system\JQgHaKB.exe

Filesize
1.7MB

MD5
7f312bcd93316ef225a1c072cc7ded8e

SHA1
073e13c113010cb4dc91d43ac8134736832ea10c

SHA256
ae481b301cf0295f3a81bd7b87e9681094471b937ea825571e731079a49e4217

SHA512
c24638d504fc41f36ac3ff4b184d03dc4459d2524bbd20737e0df1bcccada0bb624e527d6c336d2b12b9ee052ff276d248265e1fafb8ab1e1249b9aa14cd02d7

Download Submit
C:\Windows\system\JYQzIpe.exe

Filesize
1.7MB

MD5
025e8757aa7f60bcdbbdf2ebd4f65b3b

SHA1
47b4780e9df82b50ca33628bbf975c21229b3571

SHA256
281bed47fbbcc250c5cd14906f1f394f79873b7068d77f98d9f2fb7f22e990bc

SHA512
9d623cc55639bf907caca56a05620b8ff71824a913871421bccb4dd87334d0261e46aea21bfcb6b875cc671562024e0b1507d75e1e78cbb4a1845565a00fa0e5

Download Submit
C:\Windows\system\KaGWFFS.exe

Filesize
1.7MB

MD5
647c13d7ec76518f2ab56d4eb618c131

SHA1
db72464757ec2d78e2dacf58b2960cb21cb0e0fb

SHA256
5a91664c85dbb95a82f23fd868d570fe35387d18fa4396de2179e7d2cac6ed44

SHA512
76ecf36df3bc21de261080c1d5f15ad65774a2ca94106144912ea539ae163e933f5f1201676a5385f3852ba3f5f0e87cb0facbd7d06ee148b65b3642f2787f5e

Download Submit
C:\Windows\system\MREaNJj.exe

Filesize
1.7MB

MD5
773e59cfa2744f8d3871488fe65b7e36

SHA1
a00cff72a11bdbe5a9a2513715f73ec888b69ef6

SHA256
636061f75970ee207becf4d2cf9290739afd629b156d691cd2208a6c3800d3f5

SHA512
93386bdae6c237c6041f9ad2323b8095f16df7389f4913b68d9467bdb5f7d3cad30c37512544b352f1638755c77b2a9b56acd59d4880efbdff57fcb28f8ad300

Download Submit
C:\Windows\system\OQfpnAZ.exe

Filesize
1.7MB

MD5
29651c88b3302a4aefde0a0df36712cf

SHA1
80551cdc12b99c4e1bf5b1743713ead404189b5f

SHA256
24282527051017e3a243fc4f8b2baef6175382f000881679aa4f6767e228f8a8

SHA512
670d7e8b16e188360795258b44e56e05b603c517ded873a280d03765d71124a0eef216ee557aab46acb1e010d45f7d893a89c90edb2e1402c63f550669cce071

Download Submit
C:\Windows\system\SbEeusr.exe

Filesize
1.7MB

MD5
e3dd8bfe2e236f76b6c76824e7df7222

SHA1
795c4e58fd8fba6c7661eebee49f0a05f11d3971

SHA256
9d3e6c69ba94ed8fdf5a2df1915bf833f279e8daba290e062d9d387faeab9785

SHA512
ff9387e44320560b54d40083c21109efeba2a7c3f52a051a75bcb0bd725dae5ec4143d36a3d757e0250df024353cf3693fd458b56af528a84e7db84edb84ab3a

Download Submit
C:\Windows\system\YknXKAx.exe

Filesize
1.7MB

MD5
27d2cd0bc6ab459c2d16840739a35a63

SHA1
4c0cbb31da9e9fa5f14d2d77268d9475a5c9c8c8

SHA256
64c3525b4d459ed22026e2ede6db05c79a7f296839438ff80f8145df8b25ec78

SHA512
97e43bb6ef06e44df63d6c164903970117fc486a49c695202a4066e3e2d1ecc25a1e4d00b1dd3ce1114019a3982d96ed0933f47f3cec62c91f8cfde450532500

Download Submit
C:\Windows\system\dybUdIa.exe

Filesize
1.7MB

MD5
ceddfb805d1364fe26e9961d71c585f4

SHA1
a4537b9ab6b6e10f47d9b139c86c02b1fa158d83

SHA256
9ab7258d059cd3df528723d18d6fa7a5d99c575f58d6e0fd06e5987c28cb4cfa

SHA512
d9d8c0f879e596ec9e441c1dcf22c86ec664f5184ed8ddc5b48cd5c209f9b4d3292c34b095ac0bda503a1b51503505179a2f84c58791aadac3e4dc190d6d482b

Download Submit
C:\Windows\system\eRKdFQA.exe

Filesize
1.7MB

MD5
f3da7c2ed14c3f9964fae6f47c0ba03b

SHA1
cd27ac3f6f8e55ba3ca74b1a7d1cd8baa5e7b4e3

SHA256
8ba325596bf5b2a2085c767a802cb621ae3e1a33a193f6c2e3fd27667739185b

SHA512
13d3fd36ce07822d2936ba0d81ae339310d5c3fb0434cfcff8f11f05a6b09aba3c02aa264dbb5dfb611cdbb68859a6464f4e54acb84fd50b5a79ba119564f942

Download Submit
C:\Windows\system\fNzAGrk.exe

Filesize
1.7MB

MD5
b17e62b9efb6128da0722112693b5083

SHA1
7b38d3086e160b5452087675ae74c993c55fc18e

SHA256
9d620c13380bb9834326d704dedf8fcb3f415398b347b252c3a4e9bdc3adaa05

SHA512
180d5c1aed7499a75e54679fb5cd73532db82c4c1db347f5e3d8557ca652625391cd8fb2deeeed6ee14a43935f1353e0d2aea07ae94abd886dcc3e0f17d4c55e

Download Submit
C:\Windows\system\gxeVIFI.exe

Filesize
1.7MB

MD5
c7ba5d7cda66569928dc33ae4aa1febb

SHA1
05346e2a1fd55802b815f9512926300455a4ccd0

SHA256
c2e90a925dad3678c8e33c328386848ef0ad9111fcaf16203986dfd4899edc10

SHA512
4b2933a20248520e0fadfb27a2aaa0354517f6b1fe3927b186f2afbca23bdc526840981f5c199e8110b4fedacd9940241b025850ed81644f6345541a7f5642c8

Download Submit
C:\Windows\system\jmlJvVM.exe

Filesize
1.7MB

MD5
61a781c98bd7514d137e375bae20e2de

SHA1
596ae0f62ba7f2558ef262fb9e0dbae528d1a8cb

SHA256
7f77d16b80a4ee7084d54b0674c84af896c3db9624d88801eded2d38b1e0569f

SHA512
3f80a3f38385f20fad46d4b979581edd91a9c3ab20d86b07c0138f28b12fa1628324925625ee0270048d09b56bfeb7354153d12678966d712ce7714732a9e089

Download Submit
C:\Windows\system\kjvlTFW.exe

Filesize
1.7MB

MD5
81805b0fa4dfb8d9cb54a68db479d82c

SHA1
c47df3bc19b22aeebedb347e19c1fd85f5c2f950

SHA256
3f1d7a689078be800a46e88eeef0cf6f1fa552e8bcecf8e255abc2ddcc4a5bc6

SHA512
e5fb6321048d73c3b3a3bae6a0709379b10faad7bcc5b0138b4ba8aa9a80be1d9b85c6f05ad6539a1757ea5e684d0991a524d9bfcc65114873df713c9f9f133e

Download Submit
C:\Windows\system\lTDoObO.exe

Filesize
1.7MB

MD5
736c2ed2d7eeadbc8e651a4d0331d31d

SHA1
f7fe8a41831ce047c490175b6a712d1ecb9b8119

SHA256
9396db6054dcfff8b3da0329727317874ca9986a53a5d8d90a39228b5a303232

SHA512
91cfd5c2836a7869c405fd085032f55940133579e4952a124e7457a46c11ec2b4f35623f617898b0d6fb2cc15114687c3c9565aae840d0ea70d032d2678257aa

Download Submit
C:\Windows\system\moDJtjc.exe

Filesize
1.7MB

MD5
310f284547fddcfeef277586ce07b5f8

SHA1
5e1d78dc2642f5f3a65853e26182a0821c134ffd

SHA256
79f68a22176fb68692bdddbeb9ff391f77785c3f87d891bb9a1e2acf9c73b8f1

SHA512
8ac16804790e395e382f8f814cdd20553345586cf438f1369f5a41d85c8c39257bc43c8497a74e7eff56d4ae0f7f27095d02d97643e16ac5cf55196bc8c59992

Download Submit
C:\Windows\system\nKPyWKX.exe

Filesize
1.7MB

MD5
c8b3e155cbd43b5fd2543736df39a1a8

SHA1
868b273ef38a378a4642579b4447192064c3ee35

SHA256
ec9ed196c9b9c2803b6553f989a10ea0cdd08b33c7e89534b6762a5f5e76a887

SHA512
efca29a2f36ee73bef7f6d2efc72f8d9d9c2fe060958554261a86d07b00c4aefa233ed29e89314275fc44a1b038846f91986b7143f7820eae92dba27987020f2

Download Submit
C:\Windows\system\orvNDUl.exe

Filesize
1.7MB

MD5
fcfd2d3ddfbc77e8ee3d37c337295ab7

SHA1
b4e2357d532ab480b51d0de467ae632223a34d1b

SHA256
44c17d7ea0b0cc06c125def59a2208256559f2d9be9dcf53275b5ac53f74d31b

SHA512
94d48ef86700c42449cb62f48bc067f3069d382ae183e460431a177e75277e28b81908129ba27e8af84320ea9c30c0c3f5e1566b20da484b6947fbe63f472364

Download Submit
C:\Windows\system\owruLsZ.exe

Filesize
1.7MB

MD5
d68e64cdb114892960e5612fb0b2bec3

SHA1
d1e818e6ef142a40638dc814caf86f248791de84

SHA256
70e730c63bf829657eeabd838f5f28eeae412fd82b98d1163019c8cbdc1298fa

SHA512
9bae3d5358a50b5a2f1fcca53d78389b5edd389f1d717b6e6c9bb53173da6bef25ea12e3daea54951076e94e07f90870dc666656d43608bb3b48399841ca7865

Download Submit
C:\Windows\system\rkROZDg.exe

Filesize
18B

MD5
a2a8c31bfe674b2e51cc8c1e80154c36

SHA1
6eefb96252fb13dd347c4f09c8a67395771a54ac

SHA256
2a66120ff3f2505c7abec7468e6a93e728ab64fc27fd29e4a6d78ddb9330f4a1

SHA512
24bb2dc2797f030569b87e7efe894cb89aa16df5459f9c05da2f55cab827a557421455be6ec06073dcdfca856439a1738ef3a0fc0b90f141b648e6e8dfbdbf25

Download Submit
C:\Windows\system\rqZYxLC.exe

Filesize
1.7MB

MD5
00550d780484099a852798a297cab9ae

SHA1
0f971c3ff206923b65f9c85bf9e9eab9572d56a9

SHA256
85b4f1dadeac6f0ffa80ea2110ea241cb441e98468f08ed01e3d43deae0d1ebe

SHA512
462d1aab355416c159be7f1b9bc295f0f7b4994678d251adce59b1a89c513788c3e97cf4105ba20f1225ebd8109e2b923b4fad8fcf8a7dc0b75a364964171d5d

Download Submit
C:\Windows\system\tyxUUCx.exe

Filesize
1.7MB

MD5
ffafa2b1ccb12500a4b02e4cc923a7ac

SHA1
bc14cd5b27c52a5475cffd5682f6fb0e3b023ff5

SHA256
7a752bd5730a420e532fad92448e2bfb41365e45f01b428549811ed71b6635b5

SHA512
0bb2ad23a797efe8fec902c76d2b44528557f432a824113defbe82dd3d6ca76c1a12eff6b4c97c9013edc6e2fc29bb0f037c3791d549ce48fffc90d69cf8194d

Download Submit
C:\Windows\system\vxkGvYa.exe

Filesize
1.7MB

MD5
0e733b232c69f30fdf7d7754596f653e

SHA1
761539eb5a08f52e0715407b1655d8c1856fa135

SHA256
1530b4e77039c419be499825f5b16660e8192df68b7c8c9e31327db617d4ec87

SHA512
690c55f5e6b7dbbb0d5c856629c641ac02c1ea3f2c2820ac517bb40cb2b6836f282edbe05f391521b2c1db8b674f537cd89bec4c4ca9880d33812537456f26f4

Download Submit
\Windows\system\DJCahVZ.exe

Filesize
1.7MB

MD5
87902da1d601a50212da4a8d77e761b2

SHA1
cdfb6a574653d26d590fb751cc29e0ac49348602

SHA256
8821e619671b0b26b19d99ba4061f83fa7b3e3f01c54d0924ccb17cff855439e

SHA512
576913ba82d967b33bfb286c4e8603744742052f90ec3f66e27ea903e7434bf01289f41a49e8df66f4b77fcaf514605ae1c804c991ac337fa6c960bcf923fb06

Download Submit
\Windows\system\FbvUsVK.exe

Filesize
1.7MB

MD5
dd6c25a6b6fa9b9312234afbaabfdb24

SHA1
278f09748eeb30477987ea90db0224be2b91fc29

SHA256
628ae0ccdb101c28516ed5be8652b0d36000eff3c0d2e803ca42113f20742009

SHA512
189da83ddb8a9266e9eeaced85975611f3801e80863b5a5514bba7171349097eda9ed59f4532ed1bb35c03e3b6b1d77b3e883454531ae71d495f2de6050dfa11

Download Submit
\Windows\system\JtTiGDT.exe

Filesize
1.7MB

MD5
376104d33d30c6c2d9ae1a1913d4cfba

SHA1
eeafb4ec2c2ff530e5152eef1ad04b8a19a7815a

SHA256
25a4d66abb060237216ce2a2af082a43ba53be9c1e79b080dd68bf6fbcc2b897

SHA512
5614226e6e8bc74b356a981999e5858789c0319082653bc1fc16e604845c8133a18365aecede0c2608b17228085109e5d82e4e9efbe430021c3cff6992a3d470

Download Submit
\Windows\system\SePkcfu.exe

Filesize
1.7MB

MD5
72c608ee7d98774258c28d3a62a05db8

SHA1
1a683cd1c7275c14b8ab4d9379f19a9f8c10b561

SHA256
13f586d3cd4ba8ee6c5cc995846dc4b395cd18e6412d369cef4af26b9b53ced6

SHA512
4db1774d97be551f19b037673e10e62ed94e8562a4dfdf67aaab6532f1982e80bbcceadd265ccbeec07a78cd392bfe598b02554fd2a453715705c9a00da5d856

Download Submit
\Windows\system\bzTwLSD.exe

Filesize
1.7MB

MD5
83198ace3893baa9f0541c2e54a50839

SHA1
a72febe0998d2cf786a435f558f769b3b4de31f1

SHA256
2a858711407136d10297b9ee85c49c3743001524f2ce643097c5b0f5eb94d824

SHA512
92903a18be52d1b857352b45fc2827d67a13ef407c8620c3c054a3e62a268254c6ed3642db0c05b36c944dd2bc2bfb8df22bd2e376d635fba609967aa819b0bc

Download Submit
\Windows\system\jYXUwhd.exe

Filesize
1.7MB

MD5
cfe1465d916696767a03bff64e0b8e07

SHA1
dbfb6a98bf33d9ca8c2f5fb91550f2661f292035

SHA256
131c2b5dc8a20ec8c24dda2d95498e51137650c807043a40130128fb01a7b7e0

SHA512
a967aa134e5a03353cf2998a0c4f4f7944a898cdefda4d18e034c18cb52ee31aeae4b98fc05493440a7efc82a253bd41d5bf981e391ad333e10526c6e7fe31de

Download Submit
\Windows\system\uJEUGMd.exe

Filesize
1.7MB

MD5
82bf6abdb8ab76f5b93742d30dcb3646

SHA1
9bbd38b53dc632da887b066f71028e44e6d11668

SHA256
323a3318030ba36b87e53bd2a41467838e638f40164c08b86561204550083c2f

SHA512
21961d714daf0dfbcd057b6446bd6f28e181f414cf5ae208eafbc17fd266c032cc6b68fc5e0c6a4dfedace86eb8dc048aa0836637420810f5b8ef6066251d378

Download Submit
\Windows\system\zGyASCZ.exe

Filesize
1.7MB

MD5
f896b08694f085e091dca636e1ef1685

SHA1
94a8aaa4f9ac114828c1b5aa43055318d28da289

SHA256
a1c343a384cac4c60f22e36d278917d4c8c8005f0afa6ae786dd6dea56ba8188

SHA512
2cdbf1a93bd433e79bcc28ec1d5af4c7ea17f55537e54d8d0e709fb4bcea5b416cdd519e649959017a688b507b156aa9dc781c828a85c898a449731f01fc7411

Download Submit
memory/1544-78-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1544-5531-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-42-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1560-43-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-13247-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/1560-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1560-24-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1560-7-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1560-10-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1560-83-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1560-77-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/1560-39-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/1560-93-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/1560-92-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/1560-0-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/1560-56-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/1560-60-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/1560-75-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/1876-85-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2108-8-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2108-80-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2108-5523-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2188-5528-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-67-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-57-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2504-5522-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2524-55-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2524-216-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2564-62-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-5532-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-5524-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-84-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-36-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-90-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-23-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-5529-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-5530-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-41-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-40-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/2752-91-0x0000000002940000-0x00000000029C0000-memory.dmp

Filesize
512KB

Download
memory/2752-154-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2752-161-0x0000000001BB0000-0x0000000001BB8000-memory.dmp

Filesize
32KB

Download
memory/2992-5525-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-94-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2992-54-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download